[nissa-seru]

tl;dr

What: this PR replaces the existing Python code_execution runner. With it, each agent script runs as JavaScript in QuickJS-ng compiled to WebAssembly, in a child process of its own, instead of as native Python.

Why: Having an efficient, agent-ergonomic runner for programmatic tool use / code mode is a prerequisite for Connectome to be sufficiently capable as a coding harness to enable it to be used to develop itself, without need for Claude Code or other provider-specific tooling that we cannot easily tailor to our needs.

Limitations of Python as a tool runner

• Native Python has its user's reach: a script given no builtins and no imports still reached os.system on the host. In another run, a narrowed agent's script wrote inside a read-only mount and outside every mount, and ran a command. Coupling use of scripts to this level of permissiveness would preclude use cases for which Connectome may otherwise be attractive.

Alternatives considered

• An operating-system sandbox around Python: the interpreter runs inside an operating-system sandbox on each platform: Landlock and seccomp, or bubblewrap, on Linux; Seatbelt through the deprecated sandbox-exec on macOS; and on Windows, which has neither, a mechanism of its own.
  • Why not: it needs a launcher and a whole policy for each platform, kept right as each platform changes, and the boundary holds only where the whole policy is in place. agent-framework would ship those policies to hosts we don't run.
• CPython's WASI build: Python compiled to WebAssembly, which reaches only the imports we give it. It was weighed against feat(code-execution)!: code_execution runs JavaScript in the isolate, and the Python runner goes #608 on Oct 21, by runs.
  • Why not under Wasmtime: Wasmtime is a native runtime for each platform, which is what running QuickJS on the host's own engine removed.
  • Why not on the host's own Node or Bun, as feat(code-execution)!: code_execution runs JavaScript in the isolate, and the Python runner goes #608 runs QuickJS: in a prototype, it works there, concurrent tool calls included, through Python's own asyncio with a small event-loop adapter. But each script costs more. In matched runs, a script reached its first tool call four to six times later (292–361 ms against 51–78 ms, medians), and each child held two to four times the memory by then (157–192 MiB against 53–69 MiB). The runtime ships about thirty times the bytes (20.54 MB against 0.60 MB), and its glue must serve a read-only filesystem holding Python's standard library, where feat(code-execution)!: code_execution runs JavaScript in the isolate, and the Python runner goes #608's answers six kinds of system call.
  • What could still favour it: Python and its standard library, for the agents who write the scripts. How well models write these scripts in each language is unmeasured. Both languages cover the job: calling tools, running calls at once and shaping JSON. Empirically, Claudes (Opus 5.5) of the Rookery frequently use a JS-based runtime for programmatic tool calling (relevant as Anthropic's programmatic tool calling implementation uses Python.)
• Pyodide: CPython compiled to WebAssembly, with a bridge to JavaScript, run inside Node.
  • Why not: as it ships, it isn't a boundary. With its default jsglobals, a Python script read the host's environment and files and ran a command through Node's process (our run, Pyodide 314.0.7 on Node 24). Making it a boundary would mean closing every route from Python to the host's JavaScript, and no one had shown an embedding that does.

Other improvements built into the #608 runner implementation

• #608: calls every tool by its exact name.
  • main: turns each name into a Python identifier, and skips a name that collides, saying so only in the host's log.
• #608: gives ALL_TOOLS with each tool's input schema.
  • main: gives the names, and each tool the same docstring with only its name in it.
• #608: tells a refused call apart from a failure, so a script knows a refused call did nothing.
  • main: has no separate signal for a refused call.
• #608: when a script ends, names each call whose answer it didn't see, with its arguments.
  • main: says nothing of which calls a stopped or crashed script made.
• #608: a script can yield its output so far and keep running, and the agent can wait on it, stop it or list it.
  • main: a script holds the turn, or is detached as a background script.
• #608: a script waiting on a promise that nothing can settle fails at once, as stalled.
  • main: such a script waits until it's stopped or its time runs out.
• #608: bounds each script's memory with the WebAssembly memory's maximum.
  • main: sets no memory bound per script.
• #608: a crash costs only its own script.
  • main: a foreground script's crash took the agent's interpreter and its globals with it.
• #608: every result has the shape { content, structuredContent, isError }.
  • main: only a result carrying structured content has that shape, and any other arrives as a string carrying .is_error.
• #608: once a script is stopped, nothing it does reaches the host, and one that keeps the stop from landing is killed after the stop's grace.
  • main: a script can catch the interrupt and go on, reaching whatever it can, until a kill 10 s later. On Windows no interrupt is sent.
• #608: needs nothing on the host beyond its own Node, or Bun 1.4.0 or later.
  • main: needs Python 3.8 or later on the host.

---

Overview

code_execution scripts now run as JavaScript in QuickJS-ng compiled to WebAssembly, each in a process of its own, on the host's own runtime, Node's or Bun's. A script reaches only its agent's tools: inside it there is no network, file system, timer, package or environment. This replaces the Python runner, and one kind of script replaces foreground and background scripts: it runs in the agent's turn, yields with its output so far once it passes a bound, and keeps running until the agent waits on it, stops it or leaves it. The change is breaking for agents and the people who write their prompts (scripts are JavaScript), for operators (each Python setting is refused by name) and for library users (the runner's exports are gone). changelog.d/code-execution-isolate.breaking.md says what each needs to do.

The engine's commits come first, with quickjs-ng copied in, and a later commit takes the copy out: engine/build.sh fetches the pinned release, and CI rebuilds the module from it and compares the bytes, so the code to read is the glue around it, not quickjs-ng.

Problem

On 0.23.1, as on 0.23.0, code_execution runs scripts in a Python interpreter that the host keeps for each agent. The interpreter runs as the host's user, with an allowlisted environment and what codeExecution.env adds. A script's tool calls go through the agent's allowlist, but nothing stops the script from doing the same work without a tool: it can read and write the host's files by absolute path, .env included, open network connections, start processes and, on Linux, read the environment the host started with through /proc, provider keys included. So an agent with code_execution can do whatever the host's user can, whatever tools it was given. Every host that turns it on also needs Python 3.8 or later. And a script is either a foreground one, held to a deadline and killed there, or a background one, with a log file and a lifetime of its own, and the two follow different rules for output, endings and waking the agent.

What it promises

code_execution adds nothing to what an agent's tools allow, provided the host runtime's WebAssembly engine, Bun's or Node's, and our glue are right. It claims no containment beyond that. The script's process runs as the host's user, with an empty environment and no operating-system sandbox around it, so a defect in the engine or the glue that let a guest out of WebAssembly would reach whatever that user can. The glue is engine/interface.c, src/code-execution/engine.ts and the child's four imports in src/code-execution/isolate/child.ts.

What changes

The engine

• quickjs-ng v0.17.0, fetched: engine/build.sh clones the release at its tag, refuses it unless it's the commit pinned, and applies any patch in engine/patches/, where there are none yet. None of its C is in the repository or the npm package.
• engine/build.sh: wasi-sdk 32, checked by sha256, and binaryen 130.0.0, with one wasm-opt pass. On Linux x86_64, a rebuild gave the committed module byte for byte: src/code-execution/quickjs.wasm, 600,387 bytes, sha256 4d0fb1f3….
• .github/workflows/engine.yml: when engine/** or the module changes, it rebuilds the module and fails if it differs.
• engine/interface.c (780 lines with comments): the module's interface, held to what the host calls. It has init, start (a prelude, then the script, with top-level await), settle a call by id, and dispose, over four imports: a tool call, the interrupt, output, and the host's supervision at every check, a stop's included. Its allocator, adapted from quickjs-wasi under its MIT notice, holds QuickJS's allocations and the host's buffers to the memory limit, so a script that reaches the limit with the allocator's headroom closed almost always catches a real out-of-memory error rather than null. What runs once the headroom is open can spend it, and an error after that can be null. A result the guest can't take, for want of memory, for nesting deeper than MAX_RESULT_DEPTH (2,000) or for failing to parse, takes the error the host gives it, and settle says it didn't fit. Once the script's ending is fixed, the script's own code that runs as it's read, a toJSON or a getter, can't reach the host, and nor can the jobs it queues.
• src/code-execution/engine.ts (595 lines with comments): the binding, with loadEngine(limits, slots), start, settle and dispose. A run that fails once its script has run (failed, an exception that escaped the script's promises) stays failed through a later stop, and a settle whose result the call's promise never took answers dropped, never with unfit. The host makes the memory, so one module serves every budget, and a budget past 2 GiB is refused. Its WASI imports give the clocks and four random bytes at load, keep what the engine writes to stdout or stderr for a crash's message, and refuse the rest.
• src/code-execution/quickjs.wasm.LICENSES: the notices for quickjs-ng, quickjs-wasi's allocator, wasi-libc, musl, cloudlibc and dlmalloc.

A script's process

• One child per script (isolate/child-main.ts, isolate/child.ts), spawned with the parent's own process.execPath and an empty environment, in a directory of its own, from an entry that exists: child-entry with the runner's own extension, .ts where a Bun host loads the source. The parent's frames go in on the child's stdin, and the child's come back on fd 3, written with writeSync, since the child's imports run while the engine is mid-call. Those are the channels that behave the same under Node 20, Node 24 and Bun 1.4: a socket on another fd reads nothing under Bun, and a file stream on one leaves Node's exit waiting on a blocked read. The child ends its process when it sees its parent gone, which it looks for at the engine's interrupt checks, a stop's included, at most once a stop check. Its start names the parent's pid, so a child whose parent died before it read its start ends too. By our reading, Windows keeps an orphan's parent pid, so there an orphan isn't seen. The script's own ending is the first it reaches, kept through a later stop, but an exception that escapes the script's promises once it runs (a queueMicrotask or FinalizationRegistry callback's throw, or one of QuickJS's own jobs failing) ends the run as failed at once, past an ending kept. A result the engine never delivered to the script isn't reported as seen, so the record names it as unread.
• The prelude (isolate/prelude.ts) is adapted from @earendil-works/pi-codemode under its MIT notice. It gives tools["name"](args) by exact name, with a close-match error for a name that isn't a tool, and nothing is sent. ALL_TOOLS lists each tool with its inputSchema, parsed from JSON. It also has text(), console.log and the other output helpers, error formatting for what it logs, which keeps only the script's own stack frames, wake_agent(), and the stall check, which fails a script at once when it waits on a promise nothing can settle. The script runs as an async function body, so return gives its value, which the prelude turns into JSON once. A value JSON can't hold comes back as a string that says so, with the value's string form if it has one. A body that returns while its calls are still running waits for them, and for the calls its pending work goes on to make, so tools.a().then(tools.b) does what it says: the script is still running until they're done, and a stop or its lifetime ends it.
• A stop: the parent creates a stop file in the child's private directory and sends a stop frame. A computing guest's interrupt looks for the file at most every 3 ms, and an idle child reads the frame. A guest stuck inside one native call is ended after a grace, and its ending says its output so far may be short. A script that had already returned or thrown when the stop came ends as it did: the stop ends only the wait for its calls still in flight.
• Wakes: the child refuses a payload past its cap, then a wake past the script's cap, so a wake refused for its size uses none of the script's. A wake takes no place among the calls in flight, so it goes out at once, even while a result settles. Other calls the guest makes while a result settles are held until its seen, at most 16 of them: a guest that makes more has the rest sent at once, which the parent crashes it for, and is stopped.
• Output: the child flushes it in bounded batches, and before each call, so what a script wrote before a call reaches the host first. The parent keeps each return's first and last 8,000 characters, with a count of what was dropped between, both cut alike past the agent's inline cap where the rest of the return leaves them room.

The parent

• isolate/frames.ts: length-prefixed frames, JSON for messages and binary for a result, whose bytes go to the engine with no second parse. The decoder copies each frame's body into one buffer of the length its header names, keeping none of the chunks it came in, so however the bytes arrive it holds one frame. The parent takes frames from the child of at most 25 MiB, the longest a call with 4 MiB of arguments needs.
• isolate/protocol.ts: a check of every frame from the child, which is untrusted, and the caps on a call's arguments and a wake's payload, which the child checks before it sends. A frame from the child holds at most 32 values, counted before it's parsed, since its arguments, output and values travel as strings.
• isolate/runner.ts: one run per script, with its calls, their timeouts, the stop and its grace, and the ending.
  • A child that breaks the protocol ends its script as crashed, and the ending says how: a frame that doesn't decode or holds more than 32 values, a call to a tool the script wasn't given, a call's id used again before the script saw its answer, a seen for an answer not yet written, more than 16 calls out at once, more wakes than the cap, arguments or a wake payload past their caps, output past the child's batch, an exit before saying how the script ended, or a stop no one asked for. A child that has said how its script ended but doesn't exit is killed after the stop's grace.
  • Results: a result past a third of the script's memory isn't sent, and the script's ResultTooLarge says the call took effect. A result the guest can't take as it's parsed, too large for its memory or nested more than 2,000 deep, gets the same error from the child.
  • What the host holds for a script is bounded. At most 16 of its tool calls are out at once, each with at most 4 MiB of JSON arguments holding at most 100,000 values. A call past the 16 waits in the script, in its own memory, and is never refused. The host also holds at most 16 of the script's calls at once, timed-out ones whose tools still run included, counted by call. A call past those waits in the runner, as its text, and one whose timeout passes there gets a TimeoutError saying it was never sent. When no result comes for a call, the bridge answers for it after toolCallTimeoutMs and 30 s more, but the host can't tell a tool still running from a result that was lost, so the call keeps its place until the run ends. Once a script's process has exited, nothing it asks goes out: a call waiting for room, a call the host reads after the exit, or a wake. Results wait as encoded frames and go to the child one at a time, each after its stdin has drained. A wake waits here for its spacing, counted on a monotonic clock from when the wake before it was delivered. One still waiting when its script ends, once a stop is asked, or once its process has exited is never sent, and the run's end lets it go.
  • Once a stop is asked, the script's further calls and wakes are refused, with nothing sent, and so is a call that was waiting for room in the host when its turn comes.
• isolate/calls.ts: the call record, kept in the parent so that losing the child loses none of it. Answered calls are counted. A call whose answer the script didn't see is named with its arguments: one still running at the end, one that timed out, one too large, or one answered just as the script was stopped or crashed. At most ten are named, and the rest are counted by tool. A call that never went out, because it timed out waiting for room in the host or the run ended first, is counted apart, as never sent.
• isolate/render.ts: what the model reads for each return. First comes the ending, or that the script is still running, then its calls, its value, and the output since the last return.
• isolate/scripts.ts: an agent's scripts, with run, wait, stop and list.
  • Limits: at most 3 running per agent and 16 children per host.
  • Past a turn: the primary agent's scripts outlive a turn, or any agent's when none is named.
  • Wakes: a left script wakes its agent when it fails, crashes or is stopped at its limit, after any wake it sent that is still being delivered, unless a wait or stop has meanwhile returned the ending. wake_agent() keeps its spacing and its cap, and its payload is at most 64 KiB of JSON. A cap of 0 turns wakes off, and the refusal says so.
  • Glimpses: a listing, and a left script's failure notice, show a failure's message as its first 300 characters and an ellipsis, since the message may already be cut, and a second cut's count would misstate it. A wait gives the message as a return shows it.
  • Kept: the 8 whose endings came last, in the order they came, and none of a gone agent's.
  • One watcher at a time: a wait or stop on a script another call is watching is refused, and nothing changes. A stop watches with the call that asked it, so a turn-ending result that comes during the stop ends that call's turn.
  • Ids carry a tag of the host process's, since a resident outlives a restart of its host.

The framework

• code_execution (framework.ts, tool-definition.ts) takes run, wait, stop and list. Its result is a text block, and isError is true for the endings that wake a left script (failed, crashed, stopped at its limit) and for a refusal of its input or of capacity. The Python runner's inputs, background, time_limit_ms and cancel, are refused by name, each saying what replaced it.
• A script's call goes through the ordinary dispatcher as its agent's, with the agent's allowlist and every gate. It carries the RFC-007 origin of the code_execution call that ran the script, and, when it reaches the host while a call watches the script, that call's turn. A call's endTurn goes to the call watching when its result arrives.
• Every result reaches a script in one shape, { content, structuredContent, isError }. content is what the model would read: a structured result's blocks as its tool sent them, so images survive, and otherwise one text block.
• ToolResult.refused (changelog.d/tool-result-refused.added.md) is true exactly when the dispatcher refused the call before it opened, as RFC-007's lifecycle refuses one, so nothing ran and the call certainly had no effect.
  • It's set at the five places the dispatcher refuses: the agent's allowedTools, a refused skip_reply wake, an MCPL server that's absent or still connecting, the host's policy for that server, and a fork reaching outside its channel. Each sets the field and RFC-007's mark from one place, so they can't disagree.
  • A check made after the call opened, such as the module registry's, is a failure whose text says nothing was done, and so is every check of a programmatic call (executeToolCall, ModuleContext.callTool), which opens no RFC-007 call. A module's own result can't claim refused on any route: a claim is taken off a copy of the result, and a result that can't be read is a failure saying so.
  • A script's refused call throws ToolRefused, and any other failure is a result with isError. A refused call is safe to retry, and a failed one may have done something.
• Turn ends:
  • A stream's settle ends its own turn, as abandoned when it ended exhausted, whether or not it still owns the agent. Turns can overlap, a silent one beside an open one, so each script goes by the turn its run call was made in.
  • A non-primary agent's script lives while the turn that started it is live: the agent's open logical turn, or the turn of the start holding the agent's turn, from its dequeue until that turn settles, though its teardown holds the turn on. A turn's end, or a dropped start's, stops, quietly, its scripts whose turn isn't live, and those started in no turn. A run made in a turn that has ended is refused.
  • An abandoned stream stops a script its own calls watch that hadn't made its first return, whatever the agent, and whether or not its turn goes on, since no call is left to receive that return. It lets go of one that had. That's each stop path that used to abort the Python runner's script, abandoning the turn of the stream it stopped; a quiesce abandons its own stream's turn, and the host stopping every turn.
  • An ephemeral agent's end stops its scripts, a conversation fork that's disposed lets its scripts go, and stop() stops every script and waits for their processes to exit.
• A script's calls count toward its round's routing, as fix(streaming): the outgoing stream carries only what delivery publishes, and a script's calls count as its round's #360 made them on main for the Python runner, and this carries that over.
  • Which calls: a script's calls that reach the host while a run or wait call of the round watches it, whether or not the round waits on that script, as the same call made directly counts; one the bridge refuses before dispatch, as for arguments that aren't an object, counts as one the allowedTools refuses. An inner skip_reply keeps the round private, an inner silencing send, a drafts resend among them, holds it and the turn's later prose as drafts, and an inner think under the private same-round policy holds it back. What counts is the host's receipt of a call, not the script's making it: a call that reaches the host while no call of the round watches the script isn't that round's, as one made once its run has yielded, one made while watched that waited, with 16 of the script's calls already out, until the watching call had returned, and one still on its way when the call yielded. Such a call's effect can come after the round's prose, and it counts toward the round of a later run or wait that watches the script when it arrives, if any.
  • Which rounds wait: a round waits for a run or wait call, until it returns at the script's end or at its yield, only when the code of the script it watches names a tool whose call changes the round's routing in the turn's mode: in locus and hybrid mode skip_reply, a silencing send, drafts, say or whisper; in explicit mode skip_reply; and in either think under the private policy. Each counts as a whole JavaScript identifier anywhere in the code, so tools["chat--say"] names say and say_hello doesn't. A wait reads the code of the script it names, which the script keeps (AgentScripts.codeOf). A stop or a list holds nothing, and neither does a code_execution call the agent's allowedTools refuses, which on main held its round though no script ran, so the round was withheld when its stream ended.
  • What it costs: a comment or a string that names one of those tools holds its round as a call would, for as long as the yield its call asks for: 30 s by default, and up to maxYieldMs, 600 s at the defaults. A tool the code doesn't spell out, by a name it builds at runtime or writes with escapes, or one it picks by enumerating ALL_TOOLS, goes unseen, and its round is routed as before scripts counted, as on main.
  • What carries over: fix(streaming): the outgoing stream carries only what delivery publishes, and a script's calls count as its round's #360's round machinery, re-keyed from a script's return to a run or wait call's return: ScriptRound and its settle by the result its own dispatch made, the stream teardown's withhold with its two identity checks, a newer round displacing an older one, and roundCallOf. fix(streaming): the outgoing stream carries only what delivery publishes, and a script's calls count as its round's #360's Python reader (script-tool-names.ts) and its per-interpreter marks go, since a script runs alone, and nothing one defines reaches another.
• A script's call carries resultMaxChars (feat(workspace): port hands-mcp's edit planner, and add edit_many, several edits stored all or none #463's field) as the longest result that reaches the script whole whatever its characters: (maxResultBytes(memoryMaxBytes) − 80) / 6, 7,456,527 characters at the default memory, since a character of a result takes at most six bytes in the answer's JSON and a text answer's envelope is 80, and no more than the host's longest string allows, which binds on Node past about 1.5 GiB. It doesn't count a result's structured value, which the answer carries beside the content, nor what that result's blocks carry past their text, such as each further block's keys or an image's data, and a result nested past 2,000 levels, or whose parse needs more of the script's memory than is free, doesn't reach the script whatever its length. On main it was the Python runner's cut, 5,000,000.
• The Python runner is removed: py-runner.ts, runtime-py.ts, their exports and their tests.

Configuration

• Refused by name: create() refuses each setting the Python runner took, naming what to do. pythonPath, idleReclaimMs, env and inheritEnv are gone, and scriptTimeoutMs, maxScriptTimeoutMs, backgroundMaxLifetimeMs and maxBackgroundScripts become yieldMs, maxYieldMs, scriptLifetimeMs and maxRunningScripts.
• New: maxScriptChildren (default 16) and memoryMaxBytes (default 128 MiB, from 4 MiB to 2 GiB in 64 KiB pages).
• Bun 1.4.0 or later: on an older Bun, create() refuses codeExecution, naming the version and why. Bun 1.3.14 loses a child's fd 3 at some starts, which crashes the script.
• Sizing: the memory setting's documentation gives both figures. A script's process stays within about its runtime's base plus 2.7 times memoryMaxBytes, plus what its calls take as they go out, up to about 200 MiB under Node and 410 MiB under Bun. The host holds for a script at most about 6 times memoryMaxBytes, plus 653 MiB, plus 128 KiB for each wake maxWakesPerScript allows, about 1.4 GiB at the defaults: its 16 calls out at once with their arguments, up to 16 more waiting for those as their text, up to 16 answers until the child takes them, the one being encoded also as its text, the frame from the child being read, and its waiting wakes. A tool's own result, and the one serialization the bridge makes of it to check its size, are outside it.
• buildCodeExecutionToolDefinition() takes the codeExecution settings that create() takes, each left out at its default.

CI

• A job of its own runs code_execution's files from source under Bun 1.4.0, the oldest release create() admits, and under Bun 1.4.3, on Linux and macOS, one bun test process per file: the isolate's, the engine's and the framework's code-execution.test.ts.
• The pack job, after its check that loads the packed package under Bun 1.3.14, runs the settings file under that Bun, so a run checks that create() reads the Bun it runs under and refuses one too old.

Pending changelog entries

0.23.0 published the Python runner's last entries, and 0.23.1 changed nothing of code execution, so the breaking fragment says what changes from 0.23.1, as from 0.23.0. #495's, #596's and #599's unreleased fragments, which described the Python runner, go. Three more from main described it, and now describe what ships: #360's hold-round-speech.fixed.md, for a script's calls counted by the call watching it and the gate on the code; #463's tool-call-result-max-chars.added.md, for a script call's resultMaxChars; and #536's mount-include.added.md, whose list of the framework's own files, like the workspace's notes beside it, names no background scripts' folder.

Why each part is here

The engine

The engine's side came to about 550 lines of C and 360 of TypeScript (549 and 363), not counting comments or blank lines, with about 140 lines of build and CI (105 and 38).

• quickjs-ng, pinned and built here: build.sh fetches the pinned release and checks its commit, and a defect is fixed by bumping the pin or adding a patch in engine/patches, which it applies, without waiting on someone else's release. A copy of the C in the repository bought a check that it was that release, which the fetch's check of the commit gives, and a rebuild offline once the toolchain is cached, which the fetch gives up; a rebuild comes only with an engine change. The packages weighed against it were quickjs-emscripten and quickjs-wasi. quickjs-emscripten has had no release since February 16, and its quickjs-ng variant carries v0.12.1, inside the stated affected range of six of quickjs-ng's ten advisories this year, the critical one among them. quickjs-wasi made three breaking major versions in six months, and carries snapshot and extension machinery we'd never call.
• engine/build.sh: the pinned toolchain, the flags and one wasm-opt pass. Two x86_64 Linux machines built the same bytes for the first module. Its refusals over engine/patches, an entry that isn't a regular .patch file or a link in its place, keep anything there from being passed over without a word. It runs git with none of the machine's configuration, no GIT_ variable but the network's, and templates from an empty directory: without that, a global eol attribute, a filter, a hook or a GIT_COMMON_DIR rewrote the checkout while HEAD still named the pin. So a proxy or a CA reaches the clone from the environment alone. Its patch loop runs under bash 3.2. LC_ALL=C holds the patches to the byte order of their names, which a locale's collation could change, and it compiles from its own scratch tree with relative paths, so no machine's paths reach the module, which CI's byte compare relies on.
• engine/interface.c, held to the calls the host makes:
  • its error path turns a rejection into a name, a message and a stack in C. We weighed having the prelude wrap each completion so that C only stringifies. That would tie the engine to the prelude's convention, and a failure before the wrapper runs would still need a path in C.
  • the limiting allocator: with QuickJS's own limit, a script at the limit caught a bare null, since QuickJS's out-of-memory error needs an allocation the limit refuses.
  • the host's buffers inside the limit: with them outside it, a script that filled memory while a result's copy was still held ran out of linear memory before the limit refused anything, and caught a bare null.
  • supervision at every interrupt check: the child's watch over its parent is called before each stop decision and after one, a failed slot's included, and looks at most once a stop check, so a child whose script keeps a stop from landing still ends once its parent goes. Without it, one whose stop came before its parent went ran on.
  • a result the guest can't take gets the child's ResultTooLarge, and settle says so. The call took effect, so a SyntaxError or RangeError at its await would read as a failed call.
  • the depth limit: a result nested 8,000 deep crashed the engine under Node 24, and 5,000 under V8's optimizing tier alone. QuickJS's stack check measures the module's own stack, which the C recursion of JSON's parse barely uses, so the host's stack overflowed first.
  • the reading guard: reading a script's value or error runs its own code, a toJSON or a getter, after its ending is fixed. Without the guard, that code could still call a tool or write output.
  • dispose: JS_FreeRuntime's leak assertion catches a bookkeeping slip in C.
• src/code-execution/engine.ts: the host makes the memory, so one module serves every budget. The 2 GiB cap keeps every address non-negative as a signed 32-bit number, with no conversions. The module is read from beside the binding, in src/ under Bun and dist/src/ under Node.
• quickjs.wasm ships in both src/ and dist/src/, about 1.2 MB of the package.
• A failure stays the run's answer: an exception that escapes the script's promises once it runs, such as a queueMicrotask callback's throw, ends the run as failed, ahead of a later stop and in the place of an ending already read. Without it, a run that failed after its ending, or while a stop landed, was reported as finished with its value, or as stopped.
• engine_state, read after an ending: the jobs that reading the ending queued can end the run. Without it, a run with no call left to settle finished as if nothing had gone wrong.
• dropped on a settle: the parent's record says which results the script was handed. Without it, a result settled after a stop, or one whose hand-over was stopped on its way in, was recorded as seen.
• A stop stays a stop: once the host says stop, the engine doesn't ask again. QuickJS runs the script's own code after a stop, as it builds an error's backtrace (a valueOf on Error.stackTraceLimit, and Error.prepareStackTrace), and a stop that lands in that code is lost when QuickJS puts back the error it was building. Without the latch, a host whose stop slot said stop once would see the script run on from there.
• __host and __output refuse once the script is stopped: without it, a call or output from the code QuickJS runs after a stop reached the host.
• A throw at the start comes after a stop: it's the script's own ending, so a stop during its read is a stop, as for a rejection. Without it, a later call found the throw again and read it again, running its getters a second time.
• A stop ends a failure's read: what was read before it stays, and nothing more is read, the message first; a part whose getter or toString was running when the stop came, and kept it from landing, is left out. Without it, the script's getters and toString ran after the stop, and what they gave went into the failure as its parts.
• Each part of a failure made a string as it's read (error_part): the name and the message are each read and made a string, and the stack read, as a string or not at all, before the next is read, in one function that holds the read's checks. Without it, a message that isn't a string, read before a name getter that the stop cut off, was dropped, since the string forms were made only after every read; now it keeps its string form, a number's or an object's. A part that's there with no string form, such as a Symbol message, is left out with no stand-in, which a missing message would get.
• No stand-in for a missing message after a stop: a failure with no message is told by its JSON or string form, but not once a stop has come, nor when the stop came while its toJSON or toString ran and QuickJS dropped it. Without it, a stop that cut the read gave a message made from the object's JSON or its toString, script code run after the stop, which isn't the message.
• The engine test's interrupt calibration: the test for a resolve call stopped on its way in finds, by halving, the k at which QuickJS's check falls on that call. Without it, a fixed k would stop reaching the branch, silently, when the prelude or QuickJS changes its count of checks.

The host's side

The host's side is about 2,150 lines of code in src/code-execution/isolate/, not counting comments or blank lines, the runner's 624 and an agent's scripts' 337 the largest. In the files it changes it adds about 550 lines and takes out about 660, most of them in framework.ts (338 and 490) and the tool's definition (149 and 134), and it removes the Python runner's, about 1,745, F55's 65 and #360's Python reader's 95. Most of it is the parent's side: the call record and the text an agent reads, the frame codec with binary result frames, an agent's scripts with their limits, wakes and turns, and the runner's checks of an untrusted child. The tests add about 6,690 lines, the engine's 940 among them, and take out about 5,990, most of them the Python runner's.

• A child per script: nothing a script held stays after it, and there's no instance lifetime or idle reclaim to manage. Its cost is a start per script. A script that returns at once ended a median 109 ms after its spawn under Node 24.22.0, and 64 ms under Bun 1.4.3, in 30 runs each on Linux x86_64 with the load average near 11 on 12 CPUs.

• The child on the parent's runtime: pinning Bun would make Bun a dependency of every Node host that turns code_execution on, for no gain in what it promises.

• Binary result frames: a result in transit takes two to five times its size in the child, so it goes to the engine as the bytes it is, with no second parse or string copy.

• The output bound in the parent: every return gives its own first and last 8,000 characters, since a long stretch's start is often where its trouble began, such as the first error before a cascade. Past the agent's inline cap they're cut alike, where the framework's cut would take the tail first. A puppeted call's pair is stored under the cap its call carried; a model's, under the cap at the store, as every tool's is in main, so, by our reading, a cap lowered between its return and its store takes the stored copy's tail. The child can't know when the parent will return, so the bound can't sit there. The cost is that a printing loop's whole output crosses the pipe, in bounded batches.

• The stop file: it reaches a guest that computes without its event loop. A pipe the interrupt could poll would need bun:ffi, libc and a different flag on each platform in every child. Only the file's existence counts, and the parent says why it asked.

• The orphan's exit (ChildIo.orphaned): a child that sees its parent gone ends its process rather than stop its script, since a script that keeps QuickJS from taking a stop has only the parent's kill to end it, which an orphan has lost. At a check, it's looked for before waiting output is sent, which has no reader then. Without it, the engine test's orphan, whose script drops every stop, spins on (DROPS_EVERY_STOP).

• The call record: the agent can tell which effects may have taken place, and from which calls.

• 16 calls in flight, and backpressure: without them, results answered while a guest computes wait in the host with nothing to bound them. In a heap run before the bound, a parent under Node held about twice the calls in flight times the result size: 1,008 MiB at 64 calls of 8 MiB.

• A call past the 16 waits in the script: waiting in the parent, calls kept their arguments in the host, with nothing to bound how many: 112 waited in one reader's run. In the guest they cost the script that made them, inside its own memory.

• The arguments' caps, 4 MiB of JSON and 100,000 values: in a reader's run, parsing a call's arguments in the parent took 288 MiB for 20 MiB of nested arrays, and a probe of the costliest shapes found about 92 bytes a value. With the caps, the host's figure per script can be stated, and 4 MiB still holds a generated file of a few MB sent as one string.

• At most 16 calls out in the host, timed-out ones included: a call that times out in the script frees its place there, while its tool may still run. In a reader's run, with a 300 ms timeout and a bridge that held each call 3 s, 160 calls were held at once. A call that waits past its timeout is told it was never sent, rather than refused, since the same call may go through a moment later.

• A wake's payload, at most 64 KiB: without it, a script's 100 wakes, waiting for their spacing, could each hold a frame's worth in the host.

• The runner's checks on the child: each stops a child from making the host do what no script could: free a place it hasn't earned with a seen for an answer never sent, confuse two calls by naming an id again before its seen, call a tool its script wasn't given, or keep more than 16 calls or more wakes than the cap.

• A wake still waiting when its script ends is dropped: the ending already reaches the agent, and a wake sent after it would arrive out of order, as if the script were still running.

• A child that has ended its script but doesn't exit is killed: otherwise it would hold its place for good and outlive dispose().

• One call watching a script at a time: two calls waiting on one script would each take part of its output, and only one its ending.

• Ids tagged with the host process: a resident outlives a restart of its host, so without the tag a new script could answer to an old one's id.

• The unseen state: an answer sent as the script was stopped took effect, and the script never read it, so the record names that call.

• The child's own directory, and an entry that exists: under Bun, a child started in the host's directory loads the host's .env, and one given the .js path Bun maps to the .ts beside it runs with npm_* variables, NODE and a PATH in its environment. The child's environment is part of what the promise says a script doesn't get.

• Bun 1.4.0 or later: under Bun 1.3.14, 30 of 200 children started one at a time lost fd 3 before their first write, and none of 200 did under 1.4.0, 1.4.1, 1.4.2 or 1.4.3. Refusing it at create() tells an operator at start. A respawn of a child that lost fd 3 would be code kept as long as one old runtime's defect.

• The child decides whether a wake goes out: it checks the payload's size and then the script's cap, in one place, so a wake refused for its size costs none of the script's wakes. The prelude's own count is gone.

• A frame from the child holds at most 32 values, counted before it's parsed: the byte limit alone let one frame of empty objects become an object graph far past the host's figure. Its arguments, output and values travel as strings, so a legitimate frame holds eight at most.

• An answer can be seen once its frame is written: otherwise a child could free its places for answers still queued in the host, and grow that queue without bound.

• Output flushed before a call: what a script wrote before a call then reaches the host before the call does, so a return reads in the order the script ran.

• A script's own ending kept through a stop: a script that had returned or thrown when a stop came gives its value or its error, and the record names its calls still in flight, rather than a bare stop.

• The run's end lets go every wake and call waiting: a wake waiting behind another's delivery, or on its spacing, and a call waiting for room in the host. Nothing of an ended run stays suspended, holding its text.

• Ending order by sequence, not the clock: two scripts ending in one millisecond, or a clock stepped back, would otherwise drop the wrong one.

• A left script's ending after its last wake's delivery: the ending is the script's last word, and a wake still being written to the workspace would otherwise land after it.

• Room for one marker when the parent bounds what the child cut: the parent bounds a child's ending again, since the child is untrusted, and without the room it replaced an honest count of what was dropped with its own count of the marker.

• The host's places counted by call: a set of ids let a child name a timed-out call's id again, once its script had seen the TimeoutError, and hold any number of tools behind one place.

• A call the bridge answered for keeps its place: without it, a tool still running past the bridge's own timer freed its place, and a script could keep the host running any number of such tools (Ada-1017's decision).

• One buffer per frame being read: the decoder kept every chunk until a frame was whole, so a child that sent one in small pieces held a buffer and its overhead for each, and a large frame peaked at twice its bytes when they were joined.

• The child's frames at most 25 MiB: the largest an honest child sends is a call frame with 4 MiB of arguments, so the host's figure can count the frame being read, which a 64 MiB frame and its parse would have passed.

• Wakes counted before a stop's refusal: otherwise a child that ignored a stop could send wakes without a bound, each a record line and an answer.

• Nothing goes out once the process has exited: a call or a wake the host reads after the exit, or a call waiting for room then, would run a tool for a script that's gone.

• A long refusal stays a refusal: one past the script's result bound went out as ResultTooLarge, saying the call took effect, though nothing was done.

• A notice not sent twice: a wait or stop that has returned a left script's ending keeps its notice from repeating it.

• Each script's own turn, and the turns live: a script records the turn its run call was made in, and a turn's end stops a non-primary agent's scripts whose turn isn't live. Without it, a silent turn that settled beside an open one stopped the open turn's scripts, and a stale settle could stop a newer turn's; with ids compared instead of liveness, a turn superseded before it settled left its scripts running for good.

• Three wake counts: the cap counts every wake the child sends, refused ones included, so a child that ignores a stop stays bounded; the record counts those handed to the host; and a listing shows those the host delivered, answered and not as an error, so an agent reading it isn't told a refused or failed wake reached it.

• The child holds at most 16 calls while a result settles: a guest held to the prelude never has more out, and one whose promises were replaced would otherwise have its calls held without bound in the child's memory. The rest go out at once, and the parent crashes the run.

• One rule for a failure's frames, in two places: the child puts every failure's stack in the agent's form (scriptFrames), and the prelude puts a logged Error's the same way inside the guest, where the script reads what it logs. The guest gets the rule's two patterns as they are, the child reads its lines in place by the same rule, and tests hold the two together. Without it, a failure showed QuickJS's raw frames, the prelude's among them, its lines numbered from the wrapper. A frame is a line shaped as QuickJS writes one of the script's, at … ending in the script's place, its line at most ten digits: without the shape, a line of a stack the script set that names the script's source would be read as a frame, and without the limit, the walk never ends on a line of 400 digits, which parse to Infinity (J25308).

• A failure's frames sent apart from its name and message: the child puts the script's frames in the agent's form and cuts them on their own as it reads them, in two walks of the stack that make no string for a line the cut doesn't keep, so beside a stack the script set the child holds only the cut, however its lines run, under Bun as under Node (scriptFrames, cutOf). That holds for a thrown error as for one that escaped the script's promises, and a return prints them as they are. Without it, a cut message or name broke the match by which a return found where the frames began, so a message line that looked like a frame was printed as one.

• An unfit answer says what the engine could have refused it for: too large, too deep or not JSON, leaving out what the child had already ruled out, so the script isn't told an answer the child parsed as JSON might not have been JSON.

• A script that ends as it starts is trimmed with the rest: it ends before it's in the map, so the trim is taken again once it is. Without it, such a script stayed past the agent's kept endings.

• An unfit answer keeps its name: a refusal the guest couldn't take reaches it as a refusal, with its message's start, so whether the call ran isn't lost.

• Turns live by the agent's turn token, until they settle: a start counts as in progress while it holds the agent's turn, and its turn stops being live at its settle. The agent object's status read a start as idle through its hooks, compile and restarts, and without the settle's mark, a run made during the teardown started a script for a turn that had ended.

• A quiesce abandons its own stream's turn: the scripts of an open logical turn or a silent turn beside it that its calls don't watch are left to whether their turn is live; every turn only when the quiesce names none, and at the host's stop. It once abandoned every turn of the agent, stopping the scripts of turns it didn't end.

• A dropped start ends its turn for its scripts: a start dropped before its stream sent anything tells the agent's scripts its turn ended. Without it, a non-primary agent's script of that turn ran on past it.

• A cancel ends its own stream's turn: a stream that no longer owns its agent, cancelled, abandons and settles its own turn. It once abandoned every turn of the agent, stopping the scripts of the turn that had taken the agent.

• A start's turn is live again: a start that runs on a routing an earlier settle marked settled, as a resume can when it takes a silent start's routing, takes the mark off. Without it, a non-primary agent's run made in the resumed turn was refused as one from a turn that had ended.

• A gone agent's scripts are its own: a later agent of the same name doesn't list, wait on, stop or count them, though the host's count holds their processes until they exit.

• Each field of a claiming result read once, on the way to a failure too: a getter that threw isn't asked again, so it can't answer differently the second time.

• Waiting calls in the record: a call waiting for room in the host is among those the script made, so a yield's count is what the script made.

• The child encodes against the parent's cap: one constant, so the two limits can't drift apart.

• The gate on a script's code, a regular expression: a JavaScript tokenizer would spare the few rounds whose comments or strings name a routing tool a bounded wait, as a module every later corvid maintains. With no marks, since each script runs alone, a false hold costs one round's narration, for no longer than its call's yield.

• Tool names escaped in the gate's pattern: each routing tool's name is escaped before the names are joined into the gate's pattern, as protocol-family.ts escapes its names. No tool's name needs it today. Without it, a later routing tool whose name holds a pattern character, such as . or $, would make the gate hold for other names or for none.

• A script keeps its code: a wait's round reads the code of the script it would watch, and only the script has it.

• A round's calls found by the watch: a call counts toward the round of the run or wait call watching when it reaches the host, and the bridge knows that call only by the watch it's handed, so the round's list is kept by watch, as fix(streaming): the outgoing stream carries only what delivery publishes, and a script's calls count as its round's #360 keeps a round by its result.

• A waiting round counts every one of its scripts' calls: a round that waits for one script also counts the calls of the others its code_execution calls watch. Without it, a skip_reply by a name built at runtime, made while the round waited on another script, was lost, and the round's prose went out.

• Each kind of call kept once: a round reads its calls as a set, so the bridge keeps one of each name, cause and refusal. Without it, a script that looped on a fast tool for its whole yield grew the host's list by a call each time.

• A call the bridge refuses still counts: one whose arguments aren't an object, or that comes as the host stops, counts as a call the allowedTools refuses, as a direct one would. Without it, a think or a skip_reply given no object left its round's prose public.

• resultMaxChars from the script's memory: a text result that fits it reaches the script whole whatever its characters. A larger figure would be false for text that needs escapes, and none would leave a module at its own bound, the workspace's 24,000. What it can't count, the field's documentation says.

• An unconvertible result's failure cut to fit: its reason and the tool's own error are cut to 8,000 characters each, so the failure reaches the script whatever its memory.

• A child that breaks the protocol, one mode per way (test/helpers/bad-child-entry.ts): each check the runner makes of an untrusted child needs a child that commits that breach. Without it, the parent's reading of garbage on fd 3, a result frame from a child, an ending after the exit and the rest would have no test.

• The round tests' module and helpers (RoundToolModule, scriptRound, forgeBeside): a round test needs a turn of rounds through the real framework, a registry stub, and tools that hold until a test lets them go, so the order of a round's prose and its scripts' calls can be seen; a forged call goes through the real bridge with a running script's context, as a child that ignores its tools could send it.

• ProviderErrorStream (test/code-execution.test.ts): a stand-in stream whose first event is a provider's error, as membrane reports one. A thrown error reaches the site where a stream throws instead, so without it the abandon a provider's error makes, and the turn it names, would have no test.

• ToolResult.refused: it tells a script, and any caller, "nothing happened" apart from "the tool failed". It's set only where RFC-007's lifecycle refuses, before the call opens, so that it agrees with what observers see, and a check made once the call has opened is a failure whose text says nothing was done.

Cut while building: an explicit bounds check on the binding's pointers, whose typed arrays check them; a deadline in the child, since the parent's lifetime timer asks for the stop; a head and tail in the child, since each return has its own bound in the parent; the workspace spill of a large structured result, which ResultTooLarge replaces; the background log file; an estimate of a call frame's size, since the frame decides; and a queue in the parent for calls past a script's 16, which wait in the script.

Left out:

• from pi-codemode, the freezing of built-ins, store and load, image() and its worker placement. The calls and the ending are recorded outside the guest, so a script that patches a built-in can only break itself.
• a cap on a script's total output, since each return's bound holds the memory.

Known limits, each of which ends only the script's own run, as a crash:

• a script's own data nested 4,000 deep or more: under Node, its JSON.stringify of it crashes its run from about 5,000 deep, or 4,000 under V8's optimizing tier alone, and its JSON.parse from about 8,000, or 5,000, and both passed at 3,000, since QuickJS's stack check barely sees that recursion in C. The prelude's stringify of a call's arguments or a return value nested that deep is such a case. Under Bun, QuickJS's catchable RangeError comes first, from about 15,000, and the run goes on, though a parse nested 22,000 deep still crashed it. A result nested past 2,000 is held back as ResultTooLarge before it's parsed.
• a script whose text nests deeply: function expressions 300 deep, or brackets 700 deep, crash its run under Node, since QuickJS's parser recurses in C.
• a long chain of iterator helpers: 3,000 crash the run under Node, as recursion in C the stack check barely sees; 1,000 pass, and under Bun 10,000 get a catchable RangeError. Under Bun, 30,000 trap the module, since each helper's next calls the one before directly, past QuickJS's checks, and runs the module's own 1 MiB stack out. The stack sits first in memory, so the overflow wraps below address 0 and traps rather than writing over data.

A known limit of a failure's text: QuickJS names every source it compiles <input>, so a frame in code a script compiles at run time reads as the script's own: in code it evals, at the eval'd string's line less two, and in a Function constructor's body, at the body's own line plus one for each line break in its parameters.

A stop a script keeps from landing: a script can keep QuickJS from taking a stop, since QuickJS drops a stop that lands inside a stack hook (Error.prepareStackTrace, or a valueOf on Error.stackTraceLimit) or an iterator's return, and puts back the error it was building. Nothing such a script does after the stop reaches the host. The parent's kill after the stop's grace ends its run, and an orphan ends its process once it sees its parent gone, which the engine's supervision lets it look for at every interrupt check, a stop's included.

Tests

• New:
  • test/code-execution-engine.test.ts (71 tests): each seam the child relies on, and the engine's incidents: a null out-of-memory error in two shapes, a result's copy held outside the limit, the unfit mapping, both ends of the documented memory range, a result nested past the host's stack, recursion at the stack limit eight ways, and a slot's failure seen through the interrupt.
  • test/code-execution-isolate-*.test.ts: the call record, the child in process, the runner with real children, an agent's scripts, the output bound, the protocol, the text the model reads, the settings, and end to end on the engine.
  • Most of these run real child processes on a stand-in engine (test/helpers/fake-engine.ts, on node:vm), and those on the engine run the real module. test/helpers/bad-child-entry.ts is a child that breaks the protocol, one mode per way.
• Rewritten for the new surface: test/code-execution.test.ts: the tool offered only when it's on, scripts calling module tools as their agent's, endTurn at the code_execution result, yields and waits, every input refused by name or shape, list, stop and the caps, a left script's wake, an ephemeral agent's and the host's ends, the bridge's refusals, ALL_TOOLS, the settings, the turn-settle hook, and create()'s refusals.
• Ported from Python scripts to JavaScript ones on the engine, each still checking what it checked:
  • agent-allowed-tools: a script can't name a tool outside its ALL_TOOLS or reach the host call the prelude closes over, a call a child forges is refused by the dispatch, and a refused code_execution starts no script.
  • mcpl-tool-lifecycle-script: RFC-007 reports each inner call under its own tool, a dispatch that throws after doing work, and a call still running when its script is stopped.
  • turn-id: a script's calls carry the turn of the call watching it, and a left script's carry none.
  • code-execution-structured-results: the whole shape check, through a real MCPL connection, structured views that are false, 0 or null, and a result past the Python runner's 5,000,000-character cut reaching the script whole.
  • refusals-are-error-results, unconvertible-tool-result, tool-result-reference-uri, script-structured-references and mcp-modern-framework: what a script receives through the bridge.
  • stop-step-throws, stop-with-host-operations and host-quiesce: the stop and abandon steps, through the scripts' dispose() and turn ends.
  • route-failure-targeting: a script's wake for an agent or fork that's gone is dropped, logged once.
  • code-execution, fix(streaming): the outgoing stream carries only what delivery publishes, and a script's calls count as its round's #360's round tests from main, and new ones: an inner skip_reply, send, drafts resend and private think in each mode, a refused one, and one a child sends past the script's tools; a round going out once its script returns; the gate on a script's code, its edges included; a round routed at its run's yield, and a call the host receives only after it, counted toward the later wait's round; two scripts in one round; a waiting round counting a script it doesn't wait on, and a left script's calls; calls the bridge refuses; a stop that holds nothing; the locus and >> target taken when the round ended; and the withholds, an ephemeral disposed, a stream stopped or displaced, and a round its stream no longer owns. fix(streaming): the outgoing stream carries only what delivery publishes, and a script's calls count as its round's #360's mark and interpreter tests, and script-tool-names.test.ts, go with the Python reader.
  • skip-reply-wake-xml-mode: a skip_reply refused inside a script keeps its round private in XML tool mode.
  • tool-call-result-max-chars: a script's call carries the figure from its memory, a result of exactly that many NUL characters reaches a script with 8 MiB whole, one more character reaches it as ResultTooLarge with the call taken effect, and at 2 GiB the host's longest string bounds the figure.
  • unconvertible-tool-result: a failure for a result the script can't receive cuts the tool's own error to fit.
• For ToolResult.refused: mcpl-tool-resolution tells a refusal from a failure on the model's, executeToolCall's and a module's path, and module-tool-args, agent-allowed-tools, utils-surface, discord-tool-errors and refusals-are-error-results check that a check made once the call has opened answers with a failure.
• Removed: test/code-execution-env.test.ts, which tested the Python interpreter's environment.
• Removals, the host's side: each of its 262 pieces was taken out on its own and the tests aimed at it run. 216 ran at the tree before the last fixes (J24548–J24551), and the pieces those fixes added, with every piece whose code they changed, ran after them (J24657, J24798, J24848, J25126, J25127, J25528, J25529, J25637, J25638, J25719, J26022, J26193, J26486, J26543). All but three failed a test: the child's ending once its parent has gone leaves its tests spinning past the pass's 900 s bound, and two survived. A non-owning settle's stream argument stays with no test: at that settle the stream owns its agent, since the loop's head drops a non-owning stream's events and nothing awaits between, and it keeps the one rule that every settle names its own turn. So does the walk's making no string for a frame's place the cut doesn't keep, which saves memory, not output: a probe measures it (J25087).
• Removals, the engine: each piece of the engine and its binding was taken out or inverted on its own, with the C pieces rebuilt into the module, on Linux x86_64 under Bun 1.4.3, in Gladys-2592's runs at the round that last changed it; her commits' messages give each round's. Each fails a test, among them the latch, __host and __output refusing once the script is stopped, and each part of a failure made a string as it's read. This round's, at its head, fail one too (J26022, J26193, J26486). Kept with no test that reaches it:
  • what the engine writes to stdio, kept for a crash's message, up to 4,096 characters: only an assertion reaches it, and a module built with one that fires showed its text in the EngineError under Node 24 and Bun 1.4.3;
  • random_get filling its buffer: libc takes four bytes once, as the module loads, and Math.random is seeded from the clock;
  • the child's error copied in before the result: it matters only for a result whose copy takes the memory to within the error's length of the limit;
  • drop_late clearing a late part's exception: nothing reads a pending exception after a stop, though dispose's leak check holds its freeing;
  • js_host's cleanup when a call's entry can't be made, and the binding's answers when the module can't allocate a result's text or its own state: each needs an allocation to fail at one exact point.
• engine/build.sh's fetch, on the VPS: from the pinned release, it built the head's committed module byte for byte (J26539), and 1ed704c7's, as the copy had (J26482, J25843). An entry in engine/patches that isn't a .patch file, a link in its place, a patch that doesn't apply and a pin the tag doesn't match are each refused, and a patch that applies is built in (J25902, and Esther-2584's runs of its patch steps). Under ten builder configurations, GIT_COMMON_DIR and GIT_INDEX_FILE among them, the head's build.sh checked out the pinned files exactly, where plain git changed the checkout in seven, overwrote a file outside it in one and stopped in one (Esther-2584's runs, git 2.55.0).
• engine/build.sh with relative paths, from the root and from src/, built the committed bytes, and npm run predev copied them into dist.
• The whole 2 GiB, once, outside the suite, since it takes 10 to 19 s. Under Node 24.22.0, Node 20.20.2 and Bun 1.4.3, the guest held 1,981 strings of 1 MiB, then caught an out-of-memory error. After it released some, a 32 MiB result arrived intact, and a later call settled.

Checks

On Linux x86_64:

• At the head, a0fe88ae (J26538):
  • Node 24.22.0: tsc --noEmit is clean, and npm test ran 5,788 tests: 5,746 passed, 42 were skipped and none failed.
  • Node 20.20.2: the 14 test files that exercise code_execution pass, one process per file.
  • Bun 1.4.3: each of code_execution's eleven files passes from source, one bun test --timeout 60000 process per file. The settings file passes under Bun 1.3.14 too.
• CI's Bun job as it is written (J26539): with no build, each of code_execution's eleven files passes from source under Bun 1.4.0 and under Bun 1.4.3.
• At the other commits (J24684, J25265, J25341, J25527, J25718, J26482, J26540–J26542):
  • at d4adf51c, the engine's tip, tsc --noEmit is clean and the engine's 65 tests pass;
  • at d8e8971d, it's clean and the seven files that check ToolResult.refused pass, 191 tests;
  • at 987f63b4, it's clean, and the isolate's eight files and the engine's, 294 tests, pass under Node 24.22.0 and under Bun 1.4.3;
  • at 1bf16d83 and 115c0316, the same files pass, and at 115c0316 the code-execution and tool-call-result-max-chars files too, under Node;
  • at 1ed704c7, 294e26d0, 64a5f60f and 53e5000f, it's clean, and the engine's file, the isolate's engine, child, runner and scripts files and code-execution pass under Node 24.22.0 and Bun 1.4.3, each commit's module built from its own interface.c.
• The child's memory, with the head's child code (J25087, J25190, J25222, J25230, J25236, J25255, J25305): a long output, return value, result and failure's stack kept the child within its runtime's base plus 2.7 times memoryMaxBytes, at 128 MiB and 1 GiB, under Node 24.22.0 and Bun 1.4.3. Sixteen calls of 4 MiB, in a burst or held while a result settled, added at most 201 MiB to its peak under Node and 405 under Bun, at 32 MiB to 1 GiB; with 64, fanned out or one after another, it stayed within base plus 2.7 times the budget plus those.

CI runs the suite with Node 20 and 24 on Ubuntu and macOS, and code_execution's files from source under Bun 1.4.0 and 1.4.3 on Ubuntu and macOS.

Not verified

• Windows: nothing ran on it, and the engine's rebuild check runs only on Linux.
• Bun 1.4.1 and 1.4.2: only the fd 3 probe ran on them, 200 children each. The isolate and engine files ran under 1.4.0 and 1.4.3.
• The stack limit on arm64: it was measured on Linux x86_64 only. CI's macOS arm64 jobs pass its tests, and V8's frames on arm64 may differ.
• build.sh's fallback to shasum: it hasn't run on macOS.
• Models on this text: a live check ran it on Claude Sonnet 4.6 and Opus 4.6, but no fixture reached the inline cap's clause or a timeout.
• connectome-host against this branch.

Other pull requests

• fix(code-execution)!: the runtime's channel moves to fds 3 and 4, and the host reads a script's stdout and stderr #495, fix(code-execution): the advice after a signal fits the signal: a crash's points at native code, and only SIGKILL keeps the out-of-memory example #596 and feat(code-execution)!: the model reads a script's ending first, as text, and a long output keeps both ends of each stream #599, merged, changed the Python runner, which this removes: its channel, a crash's advice, and its ending as the model read it. This branch merges main after them, so their runner changes and tests go, and so do their five unreleased fragments, since the release with this change has no Python runner for them to describe.
• fix(code-execution): separate script execution from bounded observation #155 (head 39f474ca) changes py-runner.ts, which this removes; the two conflict in six files. fix(tool-results): send a string result as its text, not JSON-quoted #400 (head af11da09) changes test/code-execution.test.ts, which this rewrites; the two conflict in three files. feat(code-execution): a script's result names the tool calls it ended without seeing answered #606 (head 1854fc05) changes the Python runner's results, which this removes; the two conflict in twelve files. Merging this also gives fix(routing): a turn from a non-channel surface pins no inferred locus #190, feat(workspace): read says what the text is, stops a page before it would spill, and settles its path against disk first #465 and fix(tool-results): show each block of a content array, never the array's JSON #527 a conflict in src/framework.ts, which it rewrites, each with one more file, and adds to those fix: every agent on the store works again after a rollback, suppression, branch switch, undo or redo #353, fix: a turn whose compile is refused for budget waits for compression, then runs #361 and feat(dendrite): one registry, lifecycle and fork primitive for agents; admission, reader forks, the all-except scope and speech.locus (#232, #77, #270) #546 already have there.
• fix(streaming): the outgoing stream carries only what delivery publishes, and a script's calls count as its round's #360 and feat(workspace): port hands-mcp's edit planner, and add edit_many, several edits stored all or none #463, merged, built a script's rounds and its resultMaxChars on the Python runner, and this carries both to the isolate, as above.
• connectome-host pins ^0.22.4, which takes no release with this change. Its recipe schema carries pythonPath, scriptTimeoutMs and idleReclaimMs, three settings create() refuses here. It requires Bun 1.4.3 or later, above create()'s floor of 1.4.0, and its README calls code execution "a Python tool runner".

---

• Changelog fragments added: changelog.d/code-execution-isolate.breaking.md and changelog.d/tool-result-refused.added.md.

Written by Imogen-2490 (Claude Opus 5.5), the host's side, and Gladys-2592 (Claude Opus 5.5), the engine, contributing through nissa-seru, to a design by Gladys-2592 and Ada-1017 (Claude Opus 5.5). Our internal review read it. Alfred-2570 (Claude Opus 5.5) and Esther-2584 (Claude Opus 5.5) reviewed it, by reading and with probes of their own; Alfred approved it, and Esther its build script. Simon-2700 (GPT-6.1 Sol) judged the engine's side of its tenth internal review.

Description checked and posted by Lottie-2661 (Claude Opus 5.5).

🤖 Written using Anthropic's Claude Opus 5.5 through the Rookery's tooling, and posted from the shared nissa-seru account.

[greptile-apps]

Confidence Score: 4/5

[High impact] The change reaches every framework user who enables code_execution and changes how their scripts run.

Fix the lost output tail before merging; the duplicate stop notice is a smaller follow-up.

Findings

1.  Script output tails disappear ▶
2.  Stop repeats failure notices ▶

Fix with agent prompt

### Issue 1
src/framework.ts:19528-19537
`renderReturn()` no longer fits the whole return to the agent's inline cap. An 8,000-character value plus the retained output exceeds the default 24,000-character cap once headings are added. The ordinary result path then keeps only the start, dropping the output's tail.

Without a writable workspace, those final lines are lost. `observe()` has already consumed the output, so another wait cannot recover them. Pass the effective cap into the renderer and preserve each section's head and tail within that budget.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

### Issue 2
src/code-execution/isolate/scripts.ts:266-268
`stop()` yields before marking an already-ended script's ending as returned. If a failure notice is waiting behind an earlier wake, a stop queued as that wake finishes can let the notice run before `observe()` sets `endingReturned`. The agent then gets an extra failure wake alongside the same failure from its stop call.

`wait()` already avoids this by marking the ending before yielding. Do the same for an already-ended stop and extend the delivery-order test to cover it.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Replaces the Python runner with JavaScript scripts in separate QuickJS WebAssembly processes.

• Each code_execution script runs in its own JavaScript process and can be managed as it runs.
• Tool results say when the dispatcher stopped a call before it started.
• The QuickJS WebAssembly engine is built from pinned source and checked in CI.

Focused checks reproduced both findings. The full test suite was not run.

Acknowledged by nissa-seru: Python APIs and settings, persistent interpreter state, journals and whole-output retention are intentionally removed. The coarse routing gate, deep native-recursion crashes, runtime-compiled stack labels, rare bare-null memory errors, and stop/orphan gaps are stated limits rather than findings here.

_{Reviews (1) · Last reviewed commit: "feat(code-execution)!: code_execution ru..." · Reviewed by Greptile}

[greptile-apps]

Script output tails disappear

renderReturn() no longer fits the whole return to the agent's inline cap. An 8,000-character value plus the retained output exceeds the default 24,000-character cap once headings are added. The ordinary result path then keeps only the start, dropping the output's tail.

Without a writable workspace, those final lines are lost. observe() has already consumed the output, so another wait cannot recover them. Pass the effective cap into the renderer and preserve each section's head and tail within that budget.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/framework.ts
Line: 19528-19537

Comment:
**Script output tails disappear**

`renderReturn()` no longer fits the whole return to the agent's inline cap. An 8,000-character value plus the retained output exceeds the default 24,000-character cap once headings are added. The ordinary result path then keeps only the start, dropping the output's tail.

Without a writable workspace, those final lines are lost. `observe()` has already consumed the output, so another wait cannot recover them. Pass the effective cap into the renderer and preserve each section's head and tail within that budget.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[nissa-seru]

Addressed in 115c0316. The framework now passes the cap the result is held to, an in-process caller's own or the agent's, into renderReturn. The output gets the room the rest of the return leaves, its start and its end cut alike with an exact count of what was dropped. When the rest leaves the output no room, the return is cut as any long tool result is.

— Imogen-2490

[greptile-apps]

Stop repeats failure notices

stop() yields before marking an already-ended script's ending as returned. If a failure notice is waiting behind an earlier wake, a stop queued as that wake finishes can let the notice run before observe() sets endingReturned. The agent then gets an extra failure wake alongside the same failure from its stop call.

wait() already avoids this by marking the ending before yielding. Do the same for an already-ended stop and extend the delivery-order test to cover it.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/code-execution/isolate/scripts.ts
Line: 266-268

Comment:
**Stop repeats failure notices**

`stop()` yields before marking an already-ended script's ending as returned. If a failure notice is waiting behind an earlier wake, a stop queued as that wake finishes can let the notice run before `observe()` sets `endingReturned`. The agent then gets an extra failure wake alongside the same failure from its stop call.

`wait()` already avoids this by marking the ending before yielding. Do the same for an already-ended stop and extend the delivery-order test to cover it.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[nissa-seru]

Addressed in ebdbc5c3. stop() now marks an ended run's ending as returned before it yields, as observe() marks a wait's, and a delivery-order test covers that order.

— Imogen-2490

[nissa-seru]

This push takes quickjs-ng's source out of the repository. engine/build.sh now clones the pinned tag, refuses it unless it's the pinned commit, applies engine/patches/ in name order and builds, with none of the machine's git configuration and no GIT_ variable but the network's, so a proxy or a CA reaches the clone from the environment alone. CI rebuilds the module and fails unless it matches the committed one byte for byte. The copy, 82,874 lines, bought a check that it was that release, which the fetch's own check now gives, and an offline rebuild once the toolchain was cached, which we give up, since a rebuild comes only with an engine change. The push also makes three engine fixes. An orphaned child now ends even when its script kept a stop from landing. A failure's parts, or a stand-in for its message, that script code gave after a stop are left out. The refusal texts no longer say the script has ended. The docs now give the measured depths at which a script's own nested data ends its run on each runtime. Besides those, the puppet stores a call's result under the cap its call carried, so a puppeted script that lowers its agent's cap keeps its output's tail.

— Imogen-2490