Merge remote-tracking branch 'origin/master' into codex/model-experience-readmes-20260712

# Conflicts:
#	package.json
#	packages/code-runtime/code-runtime-worker/README.md
#	packages/workflow/tool-workflow/README.md

packages/code-runtime/code-runtime-worker/README.md

@@ -29,7 +29,7 @@ Every field is validated (positive numbers) and defaulted; there are no other tu
 
 ## The worker entry, unbuilt and built
 
-`worker.ts` is deliberately erasable-only TypeScript with type-only cross-package imports: unbuilt (vitest/tsx), the host spawns `src/worker.ts` directly and Node's native type stripping loads it; built, the entry ships as the sibling bundle `lib/worker.js` (its own tsdown entry). The built path is pinned by `tests/built-lib.e2e.ts`, the real-load-path guard from [docs/testing.md](../../../docs/testing.md).
+`worker.ts` is deliberately erasable-only TypeScript with type-only cross-package imports: unbuilt (vitest/tsx), the host spawns `src/worker.ts` directly and Node's native type stripping loads it; built, the entry ships as the sibling CommonJS bundle `lib/worker.cjs` (its own tsdown entry). The CommonJS format is required because pkg's VFS Worker hook compiles filesystem-string entries as CommonJS. The host converts either entry URL to a filesystem string before constructing `Worker`, which works through both ordinary Node resolution and that pkg hook. The built path is pinned by `tests/built-lib.e2e.ts`, the real-load-path guard from [docs/testing.md](../../../docs/testing.md).
 
 ## Model Experience
 

packages/code-runtime/code-runtime-worker/package.json

@@ -13,14 +13,14 @@
     },
     "./worker": {
       "types": "./lib/types/worker.d.ts",
-      "default": "./lib/worker.js"
+      "default": "./lib/worker.cjs"
     },
     "./src/*": "./src/*",
     "./package.json": "./package.json"
   },
   "files": [
     "lib/index.js",
-    "lib/worker.js",
+    "lib/worker.cjs",
     "lib/types/**/*.d.ts",
     "lib/types/**/*.d.ts.map",
     "src"

packages/code-runtime/code-runtime-worker/src/index.ts

@@ -14,6 +14,7 @@
 
 import { Worker } from 'node:worker_threads'
 import { stripTypeScriptTypes } from 'node:module'
+import { fileURLToPath } from 'node:url'
 import { Context } from 'cordis'
 import z from 'schemastery'
 import { CodeRuntime } from '@deepseek-ai/dsh-code-runtime'
@@ -98,16 +99,19 @@ interface LiveRun {
 }
 
 /**
- * The worker entry module. Source runs unbuilt (`src/worker.ts`, loadable
+ * The worker entry path. Source runs unbuilt (`src/worker.ts`, loadable
  * directly on this repo's Node range via native type stripping — the file
  * is erasable-only with type-only relative imports); the built package
- * ships it as a sibling bundle (`lib/worker.js`, its own tsdown entry).
+ * ships it as a sibling CommonJS bundle (`lib/worker.cjs`, its own tsdown
+ * entry) because pkg's VFS Worker hook compiles string-path entries as
+ * CommonJS.
  * The URL *pathname*'s extension says which world this module is in —
  * pathname, because dev-time module runners (vitest) may suffix
- * `import.meta.url` with a query string; relative resolution drops it.
+ * `import.meta.url` with a query string; relative resolution drops it. Worker
+ * receives a filesystem string so pkg's VFS Worker hook can resolve it.
  */
-/* v8 ignore next -- the './worker.js' arm is the built-lib world, unreachable unbuilt by construction; the built-lib e2e pins it. */
-const WORKER_URL = new URL(new URL(import.meta.url).pathname.endsWith('.ts') ? './worker.ts' : './worker.js', import.meta.url)
+/* v8 ignore next -- the './worker.cjs' arm is the built-lib world, unreachable unbuilt by construction; the built-lib e2e pins it. */
+const WORKER_PATH = fileURLToPath(new URL(new URL(import.meta.url).pathname.endsWith('.ts') ? './worker.ts' : './worker.cjs', import.meta.url))
 
 /** Render an unknown thrown value as a message, `Error` or not. */
 function messageOf(error: unknown): string {
@@ -273,7 +277,7 @@ export class WorkerCodeRuntime extends CodeRuntime {
       maxLogBytes: this.config.maxLogBytes,
       maxValueBytes: this.config.maxValueBytes,
     }
-    const worker = new Worker(WORKER_URL, {
+    const worker = new Worker(WORKER_PATH, {
       workerData: bootData,
       // Model code gets NO ambient environment — stronger than the scrubbed
       // env the defensive-patterns rule requires for spawned commands.

packages/code-runtime/code-runtime-worker/src/worker.ts

@@ -17,4 +17,4 @@ import type { WorkerBootData } from './protocol.ts'
 // A worker always has a parent port; guard loudly rather than run detached.
 if (!parentPort) throw new Error('dsh-code-runtime-worker: worker entry loaded outside a worker thread')
 
-await runWorkerMain(parentPort, workerData as WorkerBootData, { stdout: process.stdout, stderr: process.stderr })
+void runWorkerMain(parentPort, workerData as WorkerBootData, { stdout: process.stdout, stderr: process.stderr })

packages/code-runtime/code-runtime-worker/tests/built-lib.e2e.ts

@@ -8,7 +8,7 @@ import { describe, expect, it } from 'vitest'
  * BUILT-ARTIFACT smoke for the published package (the real-load-path guard
  * from docs/testing.md): the unit suite runs `src/` under vitest, where the
  * worker entry resolves to `src/worker.ts` — a consumer runs `lib/index.js`
- * under plain `node`, where it must resolve the sibling `lib/worker.js`
+ * under plain `node`, where it must resolve the sibling `lib/worker.cjs`
  * bundle instead. This spawns plain `node` (NOT tsx) from inside the package
  * directory and imports the package BY NAME, so resolution flows through the
  * real `exports` map exactly as it would from a downstream install; the
@@ -21,11 +21,11 @@ import { describe, expect, it } from 'vitest'
  */
 
 const pkgDir = fileURLToPath(new URL('..', import.meta.url))
-const built = ['lib/index.js', 'lib/worker.js'].every(file => existsSync(join(pkgDir, file)))
+const built = ['lib/index.js', 'lib/worker.cjs'].every(file => existsSync(join(pkgDir, file)))
   && existsSync(join(pkgDir, '../code-runtime/lib/index.js'))
 
 describe.skipIf(!built)('built lib real load path (plain node)', () => {
-  it('runs a TypeScript program with a binding through lib/index.js and its lib/worker.js entry', async () => {
+  it('runs a TypeScript program with a binding through lib/index.js and its lib/worker.cjs entry', async () => {
     const script = `
       const { Context } = await import('cordis')
       const { WorkerCodeRuntime } = await import('@deepseek-ai/dsh-code-runtime-worker')

packages/code-runtime/code-runtime-worker/tsdown.config.ts

@@ -3,8 +3,10 @@ import { defineConfig } from 'tsdown'
 /**
  * Package-shape override (see the root tsdown.config.ts): besides the
  * default lib/index.js bundle, the worker BOOTSTRAP ships as its own
- * sibling entry — `new Worker(new URL('./worker.js', import.meta.url))`
- * loads it as a file, so it cannot be part of the index bundle. TWO
+ * sibling CommonJS entry — `new Worker(fileURLToPath(new URL('./worker.cjs', import.meta.url)))`
+ * loads it as a file, so it cannot be part of the index bundle. pkg's VFS
+ * Worker hook compiles string-path entries as CommonJS, so an ESM worker is
+ * not viable inside the executable. TWO
  * single-entry builds, not one two-entry build: a multi-entry build emits
  * the shared bootstrap module as a `lib/bootstrap-*.js` chunk both bundles
  * import, which the package.json `files` whitelist (deliberately exact)
@@ -25,7 +27,7 @@ export default defineConfig([
   {
     entry: ['lib/types/worker.js'],
     outDir: 'lib',
-    format: ['esm'],
+    format: ['cjs'],
     platform: 'node',
     target: 'es2024',
     fixedExtension: false,