pkg stores application files in a virtual filesystem, and its
worker_threads hook discovers worker entry points only when they are passed
as filesystem strings. Convert the code-runtime entry with fileURLToPath()
and return the workflow built entry as a string while retaining its
source-mode data URL bootstrap.
Emit worker entry bundles as CommonJS .cjs files. pkg executes a VFS-backed
string-path worker through Module._compile, so an ESM-only entry can be
present in the executable yet still fail when launched. Keep the public hosts
ESM, adapt worker startup accordingly, and align exports, package file lists,
workspace constraints, documentation, and built-worker tests with the actual
artifact format.
Expand the custom-config executable smoke to load the Code Mode and workflow
plugins and script real run_code and zero-agent workflow calls. Require both
tools to return 42 from workers launched inside the pkg VFS, turning worker
support from an asset-presence assumption into an end-to-end runtime
contract.
Update the implemented RFC and verification gates to describe and exercise
the supported built-worker path. This adds no tool or JSON-RPC protocol shape;
it fixes how existing worker-backed capabilities are located and executed in
the single-file distribution.
Two findings from the GitHub review bot on the ready PR:
The tsdown two-entry build emitted the shared bootstrap module as a
lib/bootstrap-*.js chunk imported by both bundles, which the package.json
files whitelist (deliberately exact) omitted — a packed install had
dangling imports. The package now runs two single-entry builds, so each
bundle inlines its own bootstrap copy and every shipped file is
self-contained.
prepareValue admitted any cloneable value whose BOUNDED inspect rendering
fit maxValueBytes, so a huge container with a compact rendering (a
50k-element array renders as '... N more items') crossed the port raw,
bypassing the cap on both sides. The cap now measures the value's real
cross-boundary size — exact bytes for strings, the structured-clone wire
size (v8.serialize) for everything else — and oversized containers cross
as their bounded rendering instead.
The shipped backend of the code-execution seam, per the Code Mode RFC's
worker-thread section: one fresh Node worker per run, executing the
model's TypeScript after a host-side type-strip (wrapped in an
async-function shell so top-level return/await parse, sliced back out
position-preserved), bindings bridged over the message port under
hostile-peer rules (own-property name lookup, at-most-once replies,
post-settlement drops, null-prototype namespaces), logs streamed eagerly
with an in-band truncation marker, and two independent budgets — measured
event-loop busy time (computeMs) plus a never-pausing wall ceiling
(maxWallMs) — funneling into worker.terminate(). env: {} and execArgv: []
keep the isolate hermetic; disposal aborts in-flight runs and awaits
worker exits.
The worker entry loads unbuilt via Node's native type stripping
(src/worker.ts, erasable-only) and ships built as a sibling tsdown bundle
(lib/worker.js); tests/built-lib.e2e.ts pins the built load path under
plain node and joins the built-artifact smoke gate. Unit suites cover the
bootstrap in-process (fake port) and the runtime over real workers,
per-file 100%.
Tianyi Cui