d12cb45838
The documented vm escape reaches process, and the worker inherited the harness's env - so a buggy or prompt-injected script could read and exfiltrate ambient credentials (DEEPSEEK_API_KEY et al.) without touching a single file (ds-review-bot finding on #233). Spawn with env: {} and a hermetic execArgv on both runtime shapes, the same stance as dsh-code-runtime-worker and stronger than the scrubbed env the defensive-patterns rule requires for spawned commands (a shell needs PATH; this worker needs nothing). Ambient-channel hardening only: an escapee keeps the process-wide privileges the trust premise already admits - the genuine sandbox remains an engine swap.
workflow/ — dynamic-workflow capability family
The workflow seam: a model-written JavaScript orchestration script that fans out subagents at scale (phases, structured per-agent results, concurrency caps), modeled on Claude Code's dynamic workflows. A capability seam (see capability seams) in the bash shape: ONE engine implementation per context registers as ctx.workflows; the model-facing tool consumes it.
| Package | Role | ctx key |
|---|---|---|
workflow/ |
Abstract workflow seam: service base class + run vocabulary + workflow/* events |
ctx.workflows |
workflow-workerthread/ |
node:worker_threads engine: one worker per run; the script's vm context lives inside the worker, agent() bridges to ctx.subagents over the message port |
(provides ctx.workflows) |
tool-workflow/ |
Model-facing workflow tool over ctx.workflows |
(registers on ctx.tools) |
The interface lives at workflow/workflow/. The engine's agent() hook rides the subagent seam (any registered provider; the shipped examples use spawn), and agent({ schema }) rides the structured-output support the in-process backends implement. The worker thread isolates the SCRIPT — the host never blocks on it, and a cancelled run's post-grace termination is real — but it is NOT a security boundary; an isolated-vm/separate-process engine (actual sandboxing) swaps in behind the same interface if that ever matters.
The proposal, decisions, and deferred work: docs/rfc/implemented/feature/2026-07-05-dynamic-workflows.md.