Expose a json codec to the subagents.lua sandbox

Model-authored workflow Lua could reach string, table, math, and utf8 but
had no way to parse an agent's report, so any fan-out over discovered work
had to invent an ad-hoc line format and hand-roll string.gmatch. Hand the
guest panto.ext.json instead. decode returns nil plus a message rather
than raising: the sandbox deliberately has no pcall, so a raising decoder
would let one malformed agent line kill an entire workflow.

Teach the pattern in the injected guidance too: deterministic Lua owns the
loops, counts, ordering, and gates, agents supply discovery and judgment,
and a worker that feeds Lua ends its report with one parseable line. The
existing static-graph example stays; a discover-then-fan-out example joins
it.

1 files changed, 25 insertions, 1 deletions

diff --git a/subagents/luatool.lua b/subagents/luatool.lua
index dee7398..fced6b1 100644
--- a/subagents/luatool.lua
+++ b/subagents/luatool.lua
@@ -10,7 +10,8 @@
 --
 -- The source is loaded in text mode only (`load(source, chunkname, "t", env)`)
 -- against a restricted `_ENV`. That environment holds a safe slice of the
--- standard library plus `subagents.workflow`; it has no `os`, `io`, `debug`,
+-- standard library, a `json` codec, and `subagents.workflow`; it has no `os`,
+-- `io`, `debug`,
 -- `package`, `require`, `load`, `dofile`, `coroutine`, `setmetatable`, or
 -- `getmetatable`, and `print` is a no-op so generated code cannot scribble on
 -- the TUI. `string`, `table`, `math`, and `utf8` are shallow copies, so a guest
@@ -63,6 +64,27 @@ local function shallow_copy(source, skip)
     return copy
 end
 
+-- JSON for the guest. `decode` returns `nil, message` instead of raising:
+-- the sandbox has no `pcall`, so a raising decoder would make one malformed
+-- agent line kill the whole workflow.
+local function guest_json()
+    return {
+        decode = function(text)
+            if type(text) ~= "string" then
+                return nil, "expected a string"
+            end
+            local ok, value = pcall(workflow.json_decode, text)
+            if not ok then
+                return nil, tostring(value)
+            end
+            return value
+        end,
+        encode = function(value)
+            return workflow.json_encode(value)
+        end,
+    }
+end
+
 -- Build a fresh restricted environment per call: the guest may mutate anything
 -- it can reach, so nothing here is shared between invocations.
 local function build_env(schedule)
@@ -82,6 +104,7 @@ local function build_env(schedule)
         math = shallow_copy(math),
         utf8 = shallow_copy(utf8),
         print = function() end,
+        json = guest_json(),
         subagents = {
             workflow = schedule,
             workflows = workflow.workflows,
@@ -92,6 +115,7 @@ local function build_env(schedule)
 end
 
 M.build_env = build_env
+M.guest_json = guest_json
 
 -- Overlay workflow-local profiles without mutating the activation-time set.
 -- Inline names intentionally win, matching normal layered profile precedence