Add restricted JavaScript workflow runtime

[Waishnav]

Summary

• add a separate permission-restricted JavaScript orchestration process with agent, parallel, pipeline, phase, log, args, and budget primitives
• confine untrusted workflow code in a fresh SES 2.2.0 Compartment after lockdown(), with hardened capabilities, JSON-only crossings, an empty environment, Node permission mode, and rejected dynamic imports
• journal runtime runs, events, and agent-call prefixes for idempotent replay without a second scheduler
• expose workflows script through the strict JSON CLI and document sandbox, budget, and replay semantics

Stack

PR 5 of 5. Depends on #81.

Security review

• replaced the original unsafe node:vm cross-realm boundary after reproducing host Function constructor recovery
• adversarial coverage checks constructor chains, ambient globals, promises/callback crossings, and dynamic imports
• two exact-commit reviews found no verified HIGH/MEDIUM SES sandbox escape; residual trust remains in SES and supported Node engine correctness

Validation

• npm test
• npm run build
• focused sandbox, replay, concurrency, cancellation, migration, and CLI tests
• PR Add typed MCP workflow tools and bounded DAG scheduling #81 smoke CI passes on Ubuntu, macOS, and Windows

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0b0c640c-29b2-4925-8418-a4246b300d98

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/workflow-js-runtime

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}