fix(core): guard extractStreamIds against circular references

[Osamaali313]

Bug

extractStreamIds (packages/core/src/serialization-format.ts) recursively walks arrays and objects with no cycle guard:

function traverse(value: unknown): void {
  if (isStreamId(value)) streamIds.push(value as string);
  else if (Array.isArray(value)) { for (const item of value) traverse(item); }
  else if (value && typeof value === 'object') { for (const val of Object.values(value)) traverse(val); }
}

The data it walks is hydrated observability data produced by devalue, which explicitly preserves circular and repeated references (see hydrateData → devalue.parse/unflatten). So a workflow step that returns a self-referential value (e.g. const o = {}; o.self = o; return o;) serializes fine, lands in the event log, and later crashes the inspection paths that call extractStreamIds — wf inspect (packages/cli/src/lib/inspect/hydration.ts) and the web dashboard (packages/web-shared/src/lib/hydration.ts) — with RangeError: Maximum call stack size exceeded.

Reproduction (real code, vitest)

Two new tests fail on main with RangeError: Maximum call stack size exceeded and pass after the fix:

RED  (unpatched): extractStreamIds > circular references … RangeError: Maximum call stack size exceeded  (2 failed)
GREEN (patched):  2 passed

(Confirmed devalue round-trips a cycle: dv.parse(dv.stringify(a)) with a.self = a yields round.self === round.)

Fix

Track visited containers in a WeakSet and skip already-seen ones. Behavior for acyclic inputs is unchanged (result de-duplication unaffected).

Test

Adds object-cycle and array-cycle regression tests to serialization-format.test.ts (describe('extractStreamIds')). Includes a changeset (@workflow/core patch). Commit is DCO signed-off and signed (Verified).

[changeset-bot]

🦋 Changeset detected

Latest commit: ffdd4b4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 16 packages

Name	Type
@workflow/core	Patch
@workflow/builders	Patch
@workflow/cli	Patch
@workflow/next	Patch
@workflow/nitro	Patch
@workflow/vitest	Patch
@workflow/web-shared	Patch
@workflow/web	Patch
workflow	Patch
@workflow/world-testing	Patch
@workflow/astro	Patch
@workflow/nest	Patch
@workflow/rollup	Patch
@workflow/sveltekit	Patch
@workflow/vite	Patch
@workflow/nuxt	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[vercel]

@Osamaali313 is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.