fix(code-runtime): accept deeply nested JSON

.agents/notes/implemented/feature/2026-07-20-code-mode-typed-tool-returns.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write
-2026-07-20-code-mode-typed-tool-returns.md: 089773cc715b9003ab4e1667e5af36a8aa1686d4
-2026-07-20-code-mode-typed-tool-returns.zh.md: 24e41ae49182e2d1976e451601cfc8008b1ed11a
+2026-07-20-code-mode-typed-tool-returns.md: 2f7b39ddaa3d4f2441a9061583bb60dbb4c8e14c
+2026-07-20-code-mode-typed-tool-returns.zh.md: 9842897cb372d04b4b09679ed13062511347cdc2

.agents/notes/implemented/feature/2026-07-20-code-mode-typed-tool-returns.md

@@ -53,7 +53,7 @@ Before dispatch the bridge snapshots binding arguments as lossless JSON and make
 
 The worker exposes the actual `ToolCallError` constructor used for `tools` binding failures, so `error instanceof ToolCallError` works. The error has the standard `Error` message plus the exact `toolName`; it deliberately omits `ToolFailure.info`, error codes, and Native content. This is an exception contract for control flow, not a failure union for programmatic classification.
 
-Binding arguments and resolutions are revalidated as lossless JSON on both sides of the hostile worker protocol and cross through structured clone with no byte cap. The dependency-light runtime seam names its structural equivalent `CodeJsonValue` so it need not depend on the session-owned canonical type; the generated SDK and tool API use `JsonValue`. Intermediate values are not prompt-truncated, context-spilled, or persisted. This preserves full acquired search, workflow, task, filesystem, and MCP values for programmatic filtering while leaving provider and executor acquisition limits truthful.
+Binding arguments and resolutions are revalidated as lossless JSON on both sides of the hostile worker protocol and cross through structured clone with no byte cap. Both snapshot boundaries traverse iteratively, so valid nesting has no JavaScript call-stack depth cap. The dependency-light runtime seam names its structural equivalent `CodeJsonValue` so it need not depend on the session-owned canonical type; the generated SDK and tool API use `JsonValue`. Intermediate values are not prompt-truncated, context-spilled, or persisted. This preserves full acquired search, workflow, task, filesystem, and MCP values for programmatic filtering while leaving provider and executor acquisition limits truthful.
 
 ### Outer result and output ledger
 

.agents/notes/implemented/feature/2026-07-20-code-mode-typed-tool-returns.zh.md

@@ -53,7 +53,7 @@ declare const tools: {
 
 worker 暴露的是真正用于 `tools` 绑定失败的 `ToolCallError` 构造函数，因此 `error instanceof ToolCallError` 能够成立。该错误包含标准的 `Error` 消息和确切的 `toolName`，并有意省略 `ToolFailure.info`、错误代码与 Native 内容。这是一项用于控制流的异常契约，而不是供程序分类的失败联合。
 
-绑定参数与绑定返回值会在不可信 worker 协议的两端重新校验为无损 JSON，再通过结构化克隆传输，且不设字节上限。为保持依赖轻量，运行时 seam 将结构等价类型命名为 `CodeJsonValue`，从而无需依赖会话侧拥有的规范类型；生成的 SDK 和工具 API 则使用 `JsonValue`。这些值不会经过提示词截断、上下文输出落盘或持久化。因此，程序可以完整筛选已经采集的搜索、工作流、任务、文件系统与 MCP 值，同时提供方和执行器的采集上限仍会实际生效。
+绑定参数与绑定返回值会在不可信 worker 协议的两端重新校验为无损 JSON，再通过结构化克隆传输，且不设字节上限。两处快照边界均采用迭代方式遍历，因此有效嵌套不受 JavaScript 调用栈深度上限限制。为保持依赖轻量，运行时 seam 将结构等价类型命名为 `CodeJsonValue`，从而无需依赖会话侧拥有的规范类型；生成的 SDK 和工具 API 则使用 `JsonValue`。这些值不会经过提示词截断、上下文输出落盘或持久化。因此，程序可以完整筛选已经采集的搜索、工作流、任务、文件系统与 MCP 值，同时提供方和执行器的采集上限仍会实际生效。
 
 ### 外层结果与输出账本
 

packages/code-runtime/code-runtime-worker/README.md

@@ -22,7 +22,7 @@ Every field is validated and defaulted; `maxOutputBytes` is a safe integer of at
 - **Type-strip host-side, in execution context** — the program is wrapped in an async-function shell, stripped with `node:module`'s `stripTypeScriptTypes` (erasable syntax only — `enum`/namespaces are rejected as a program `exception` and no worker spawns), and sliced back out byte-positioned; it then executes as the body of an `AsyncFunction`, so top-level `await`/`return` work.
 - **The port assumes a hostile peer** — model code can reach `parentPort` and forge traffic, so every inbound message is shape-validated and REBUILT before anything reads it (`null`, primitives, junk types, and malformed payloads drop without a throw; forged extra fields never ride along), the host answers each call id at most once, resolves binding names as OWN properties only (a forged `constructor` cannot walk a prototype chain), drops post-settlement replies, and validates every binding resolution and completion as lossless JSON. Forged `log`/`done` messages cannot bypass the outer cap: the host repeats validation and accounts every admitted log plus the completion or diagnostic. Worker-side namespaces are null-prototype with `defineProperty`, so `__proto__`-shaped binding names are ordinary keys.
 - **Two independent budgets, because the peer is hostile** — `computeMs` meters the worker's MEASURED busy time (`worker.performance.eventLoopUtilization()` polling): a hot loop cannot hide behind a pending decoy dispatch, and a program awaiting a slow tool accrues nothing. `maxWallMs` backstops what busy time cannot see (awaiting a promise nobody resolves). Both funnel into `worker.terminate()`, which ends hot synchronous loops too; heap overflow surfaces as the worker's OOM exit (`kind: 'worker-exit'`).
-- **Intermediate binding values are complete JSON** — binding arguments and resolutions cross by structured clone after lossless-JSON validation and have no byte cap. They never enter the outer-output ledger or model context; provider/executor acquisition bounds and process/worker memory remain the limits.
+- **Intermediate binding values are complete JSON** — binding arguments and resolutions cross by structured clone after iterative lossless-JSON validation and have no byte or call-stack depth cap. They never enter the outer-output ledger or model context; provider/executor acquisition bounds and process/worker memory remain the limits.
 - **Logs stream eagerly into one outer ledger** — console/stdout/stderr text crosses the port in emission order, so a timed-out or killed program still shows what it printed. Native writes that bypass the patched stream slots arrive on pipes independent of the completion port; settlement therefore continues bounded pipe capture until worker termination completes before materializing the result. `maxOutputBytes` accounts the JSON serialization of the outer `logs` array plus the completion value or failure diagnostic. At or below the cap the exact value returns; a lossy completion is `invalid-output`, and a combined overflow is `output-limit` rather than a substituted inspected string. The failure retains the fitting captured prefix and later follows the normal outer `run_code` spill policy.
 - **Empty environment** — the worker gets `env: {}` and `execArgv: []`: no ambient credentials (stronger than the scrubbed-env rule for spawned commands) and no inherited loader flags.
 - **Dispose to quiescence** — teardown fails in-flight runs as `abort` and AWAITS each worker's exit before resolving.

packages/code-runtime/code-runtime-worker/src/worker-json.ts

@@ -40,71 +40,114 @@ function enumerableStringKeys(value: object): string[] | undefined {
   if (keys.some(key => typeof key !== 'string' || !Object.prototype.propertyIsEnumerable.call(value, key))) return undefined
   return keys as string[]
 }
-/* jscpd:ignore-end */
+
+type SnapshotDestination =
+  | { kind: 'root' }
+  | { kind: 'array'; target: CodeJsonValue[]; index: number }
+  | { kind: 'object'; target: Record<string, CodeJsonValue>; key: string }
+
+type SnapshotTask =
+  | { kind: 'visit'; value: unknown; destination: SnapshotDestination }
+  | { kind: 'array-item'; source: unknown[]; index: number; target: CodeJsonValue[] }
+  | { kind: 'object-property'; source: Record<string, unknown>; key: string; target: Record<string, CodeJsonValue> }
+  | { kind: 'leave'; source: object }
 
 /**
  * Validate and detach one worker-boundary value without loading another
  * workspace package at runtime. This mirrors the session-owned canonical
  * JSON boundary while remaining safe to import from the unbuilt worker.
+ * Its iterative traversal adds no JavaScript call-stack depth limit.
  *
  * @param value - the candidate completion value.
  * @returns a detached lossless-JSON snapshot, or `undefined` when invalid.
  */
 export function snapshotCodeJsonValue(value: unknown): CodeJsonValue | undefined {
   const active = new Set<object>()
-
-  const within = <T extends CodeJsonValue>(source: object, build: () => T | undefined): T | undefined => {
-    if (active.has(source)) return undefined
-    active.add(source)
-    try {
-      return build()
-    } finally {
-      active.delete(source)
+  let root: CodeJsonValue | undefined
+  const assign = (destination: SnapshotDestination, item: CodeJsonValue): void => {
+    if (destination.kind === 'root') {
+      root = item
+    } else if (destination.kind === 'array') {
+      destination.target[destination.index] = item
+    } else {
+      Object.defineProperty(destination.target, destination.key, {
+        value: item,
+        enumerable: true,
+        configurable: true,
+        writable: true,
+      })
     }
   }
 
-  const copy = (candidate: unknown): CodeJsonValue | undefined => {
-    if (candidate === null) return null
-    if (typeof candidate === 'boolean' || typeof candidate === 'string') return candidate
+  const tasks: SnapshotTask[] = [{ kind: 'visit', value, destination: { kind: 'root' } }]
+  for (let task = tasks.pop(); task !== undefined; task = tasks.pop()) {
+    if (task.kind === 'leave') {
+      active.delete(task.source)
+      continue
+    }
+    if (task.kind === 'array-item') {
+      if (!Object.hasOwn(task.source, task.index)) return undefined
+      tasks.push({
+        kind: 'visit',
+        value: task.source[task.index],
+        destination: { kind: 'array', target: task.target, index: task.index },
+      })
+      continue
+    }
+    if (task.kind === 'object-property') {
+      tasks.push({
+        kind: 'visit',
+        value: task.source[task.key],
+        destination: { kind: 'object', target: task.target, key: task.key },
+      })
+      continue
+    }
+
+    const candidate = task.value
+    if (candidate === null) {
+      assign(task.destination, null)
+      continue
+    }
+    if (typeof candidate === 'boolean' || typeof candidate === 'string') {
+      assign(task.destination, candidate)
+      continue
+    }
     if (typeof candidate === 'number') {
-      return Number.isFinite(candidate) && !Object.is(candidate, -0) ? candidate : undefined
+      if (!Number.isFinite(candidate) || Object.is(candidate, -0)) return undefined
+      assign(task.destination, candidate)
+      continue
     }
     if (typeof candidate !== 'object') return undefined
+    if (active.has(candidate)) return undefined
 
     if (Array.isArray(candidate)) {
       if (!hasPlainArrayPrototype(candidate)) return undefined
       const length = candidate.length
       if (Reflect.ownKeys(candidate).length !== length + 1) return undefined
-      return within(candidate, () => {
-        const result: CodeJsonValue[] = []
-        for (let index = 0; index < length; index++) {
-          if (!Object.hasOwn(candidate, index)) return undefined
-          const item = copy(candidate[index])
-          if (item === undefined) return undefined
-          result.push(item)
-        }
-        return result
-      })
+      const target: CodeJsonValue[] = []
+      assign(task.destination, target)
+      active.add(candidate)
+      tasks.push({ kind: 'leave', source: candidate })
+      for (let index = length - 1; index >= 0; index--) {
+        tasks.push({ kind: 'array-item', source: candidate, index, target })
+      }
+      continue
     }
 
     if (!hasPlainObjectPrototype(candidate)) return undefined
     const keys = enumerableStringKeys(candidate)
     if (keys === undefined) return undefined
-    return within(candidate, () => {
-      const result: Record<string, CodeJsonValue> = {}
-      for (const key of keys) {
-        const item = copy((candidate as Record<string, unknown>)[key])
-        if (item === undefined) return undefined
-        Object.defineProperty(result, key, {
-          value: item,
-          enumerable: true,
-          configurable: true,
-          writable: true,
-        })
-      }
-      return result
-    })
+    const target: Record<string, CodeJsonValue> = {}
+    assign(task.destination, target)
+    active.add(candidate)
+    tasks.push({ kind: 'leave', source: candidate })
+    for (let index = keys.length - 1; index >= 0; index--) {
+      const key = keys[index]
+      /* v8 ignore next -- the loop is bounded by the captured key count. */
+      if (key === undefined) return undefined
+      tasks.push({ kind: 'object-property', source: candidate as Record<string, unknown>, key, target })
+    }
   }
-
-  return copy(value)
+  return root
 }
+/* jscpd:ignore-end */

packages/code-runtime/code-runtime-worker/tests/runtime.spec.ts

@@ -74,6 +74,26 @@ describe('WorkerCodeRuntime — programs and bindings (real workers)', () => {
     expect(calls).toEqual([{ n: 1 }])
   })
 
+  it('bridges a deeply nested lossless JSON argument, resolution, and completion', async () => {
+    const { runtime } = await setup()
+    const result = await runtime.run({
+      program: `
+        let value = 'leaf';
+        for (let depth = 0; depth < 3_000; depth++) value = [value];
+        return await tools.echo(value);
+      `,
+      bindings: tools({ echo: async args => args }),
+    })
+
+    expect(result.error).toBeUndefined()
+    let cursor = result.value
+    for (let depth = 0; depth < 3_000; depth++) {
+      expect(Array.isArray(cursor)).toBe(true)
+      cursor = Array.isArray(cursor) ? cursor[0] : undefined
+    }
+    expect(cursor).toBe('leaf')
+  })
+
   it('reports non-erasable syntax as an exception without spawning a worker', async () => {
     const { runtime } = await setup()
     const result = await runtime.run({ program: 'enum E { A }\nreturn 1', bindings: [] })

packages/code-runtime/code-runtime-worker/tests/worker-json.spec.ts

@@ -64,6 +64,18 @@ describe('snapshotCodeJsonValue', () => {
     expect(snapshot[0]?.['__proto__']).toEqual({ safe: true })
   })
 
+  it('accepts deeply nested valid JSON without using the JavaScript call stack', () => {
+    let value: unknown = 'leaf'
+    for (let depth = 0; depth < 5_000; depth++) value = [value]
+
+    let cursor = snapshotCodeJsonValue(value)
+    for (let depth = 0; depth < 5_000; depth++) {
+      expect(Array.isArray(cursor)).toBe(true)
+      cursor = Array.isArray(cursor) ? cursor[0] : undefined
+    }
+    expect(cursor).toBe('leaf')
+  })
+
   it('rejects exotic containers, sparse arrays, cycles, and invalid children', () => {
     class ExoticObject {
       readonly value = 1