akm-cli 0.10.261012-beta → 0.10.261013-beta

package/dist/tasks/run/run-workflow-task.js

@@ -71,7 +71,7 @@ export async function runWorkflowTask(input) {
     // aborted by a timer. The engine reads `options.signal` at every step
     // boundary and breaks GRACEFULLY — in-flight units are cancelled, the journal
     // and the run lease are retained, and the run is left `active`, i.e.
-    // resumable with `akm workflow resume`.
+    // continuable with `akm workflow run <run-id>`.
     const controller = new AbortController();
     const deadline = armAbortDeadline(controller, {
         timeoutMs,
@@ -130,7 +130,7 @@ export async function runWorkflowTask(input) {
     const timeoutError = timedOutAfterMs === undefined
         ? undefined
         : new Error(`Workflow run timed out after ${timedOutAfterMs}ms and was aborted at a step boundary` +
-            (detail?.id ? ` — resume it with \`akm workflow resume ${detail.id}\`.` : "."));
+            (detail?.id ? ` — continue it with \`akm workflow run ${detail.id}\`.` : "."));
     // One failure value for the three sinks below (status, log line, history
     // detail): a thrown error outranks a gate rejection, which outranks the
     // deadline. Re-laddering per sink is how a log line ends up naming a

package/dist/tasks/scheduler-sync.js

@@ -49,7 +49,6 @@ async function compileTaskSources(input, desired, failures) {
             const parsed = parseTaskSource({
                 yaml: fs.readFileSync(file, "utf8"),
                 filePath: file,
-                workspaceRoot: input.sourceRoot,
             });
             // A task with no `schedule:` is run by hand or by a workflow step; it
             // contributes no binding and is not sync's to validate.

package/dist/tasks/source/bounded-document.js

@@ -43,8 +43,6 @@
  * `["akm", …]`-hardcoding helper but is NOT in D2-N4's named list and stays
  * declared directly in `source-v3.ts`.
  */
-import fs from "node:fs";
-import path from "node:path";
 import { types as utilTypes } from "node:util";
 import { isAlias, isMap, isScalar, isSeq, LineCounter, parseDocument } from "yaml";
 import { wellFormedUnicode } from "../../core/common.js";
@@ -256,45 +254,6 @@ export function parseTools(value, ctx) {
         return value;
     sourceError(ctx, ["akm", "tools"], "must be a string, string array, mapping, or null.");
 }
-/**
- * `working-directory:` is already a top-level field in both grammars —
- * reused body-intact, field path unchanged (`source-v3.ts:677-714`).
- */
-export function validateWorkingDirectory(value, ctx) {
-    if (value.trim().length === 0 ||
-        value.includes("\0") ||
-        path.posix.isAbsolute(value.replaceAll("\\", "/")) ||
-        /^[A-Za-z]:[\\/]/.test(value) ||
-        value.startsWith("\\\\")) {
-        sourceError(ctx, ["working-directory"], "must be a non-empty relative path contained by the workspace root.");
-    }
-    const segments = value.replaceAll("\\", "/").split("/");
-    if (segments.some((segment) => segment === ".." || segment.length === 0)) {
-        sourceError(ctx, ["working-directory"], "must not contain empty or escaping path segments.");
-    }
-    if (!ctx.workspaceRoot) {
-        sourceError(ctx, ["working-directory"], "requires a workspace root so physical containment can be verified.");
-    }
-    let realRoot;
-    let realCandidate;
-    try {
-        realRoot = fs.realpathSync(ctx.workspaceRoot);
-        const candidate = path.resolve(realRoot, value);
-        const stat = fs.statSync(candidate);
-        if (!stat.isDirectory())
-            sourceError(ctx, ["working-directory"], "must resolve to a directory.");
-        realCandidate = fs.realpathSync(candidate);
-    }
-    catch (cause) {
-        if (cause instanceof UsageError)
-            throw cause;
-        sourceError(ctx, ["working-directory"], `cannot be physically verified: ${cause instanceof Error ? cause.message : String(cause)}.`);
-    }
-    const relative = path.relative(realRoot, realCandidate);
-    if (relative.startsWith("..") || path.isAbsolute(relative)) {
-        sourceError(ctx, ["working-directory"], "resolves outside the workspace root and is not physically contained.");
-    }
-}
 export function yamlProblem(message) {
     return message.split("\n")[0]?.trim() || "invalid YAML";
 }

package/dist/tasks/source/parse-task-source.js

@@ -75,7 +75,6 @@ export function parseTaskSource(input) {
     }
     const documentOptions = {
         filePath: input.filePath,
-        ...(input.workspaceRoot ? { workspaceRoot: input.workspaceRoot } : {}),
         lineAt,
     };
     return Object.freeze({ version: 4, v4: parseTaskSourceV4Document(root, documentOptions) });

package/dist/tasks/source/task-source-v4.js

@@ -45,7 +45,7 @@ import { detectSecretShapedParams } from "../../workflows/exec/param-secrets.js"
 import { WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_SCHEMA_BYTES } from "../../workflows/resource-limits.js";
 import { TASK_V3_HOST_SHELLS, TASK_V3_MAX_SCHEDULES } from "../source-v3.js";
 import { TASK_RUN_RESERVED_FLAG_NAMES } from "../task-run-reserved-flags.js";
-import { asRecord, checkKeys, cloneBoundedJson, noGithubExpression, own, parseEnvironment, parseStringArray, presentJsonValue, readBoundedTaskSourceYaml, sourceError, stringField, TASK_V3_MAX_REDACT_NAMES, utf8Bytes, validateWorkingDirectory, } from "./bounded-document.js";
+import { asRecord, checkKeys, cloneBoundedJson, noGithubExpression, own, parseEnvironment, parseStringArray, presentJsonValue, readBoundedTaskSourceYaml, sourceError, stringField, TASK_V3_MAX_REDACT_NAMES, utf8Bytes, } from "./bounded-document.js";
 // ── Closed constants (D1, D2-N3, D2-N7) ─────────────────────────────────────
 export const TASK_SOURCE_V4_VERSION = 4;
 /** The exact, closed top-level key set (D2-N7) — `akm` and `on` are deliberately absent. */
@@ -95,7 +95,6 @@ function ctxFrom(options) {
     return {
         filePath: options.filePath,
         sourceLabel: SOURCE_LABEL,
-        ...(options.workspaceRoot ? { workspaceRoot: options.workspaceRoot } : {}),
         ...(options.lineAt ? { lineAt: options.lineAt } : {}),
     };
 }
@@ -272,7 +271,6 @@ function parseTarget(input, ctx) {
         workingDirectory = stringField(input["working-directory"], ctx, ["working-directory"], {
             nonempty: true,
         });
-        validateWorkingDirectory(workingDirectory, ctx);
     }
     return Object.freeze({
         kind: "run",
@@ -596,7 +594,6 @@ export function parseTaskSourceV4(input) {
     const { root, lineAt } = readBoundedTaskSourceYaml(input, { sourceLabel: SOURCE_LABEL });
     return parseTaskSourceV4Document(root, {
         filePath: input.filePath,
-        ...(input.workspaceRoot ? { workspaceRoot: input.workspaceRoot } : {}),
         lineAt,
     });
 }

package/dist/workflows/compile.js

@@ -11,7 +11,6 @@
 import path from "node:path";
 import { parseWorkflow } from "./parser.js";
 import { formatReference, parseReference } from "./program/expressions.js";
-import { canonicalizeWorkflowWorkingDirectory, WorkflowSourceSemanticError } from "./source-semantics.js";
 /** Compile by authoritative source extension. */
 export function compileWorkflowSource(source, options) {
     const extension = path.extname(options.path).toLowerCase();
@@ -29,20 +28,7 @@ export function compileWorkflowSource(source, options) {
             ],
         };
     }
-    const parsed = parseWorkflow(source, {
-        path: options.path,
-        title,
-        validateExecCwd: (value) => {
-            try {
-                return { ok: true, value: canonicalizeWorkflowWorkingDirectory(value, options.workspaceRoot) };
-            }
-            catch (cause) {
-                if (cause instanceof WorkflowSourceSemanticError)
-                    return { ok: false, code: cause.code, message: cause.message };
-                return { ok: false, code: "working-directory-unverifiable", message: "cwd cannot be physically verified." };
-            }
-        },
-    });
+    const parsed = parseWorkflow(source, { path: options.path, title });
     if (parsed.ok)
         return parsed;
     return {

package/dist/workflows/exec/child-workflow.js

@@ -104,8 +104,6 @@ async function publishChildRun(input, invocationKey) {
             run: {
                 id: childRunId,
                 workflowRef: target.ref,
-                scopeKey: parentRow.scope_key,
-                workflowEntryId: null,
                 workflowTitle: target.frozenPlan.title,
                 paramsJson: JSON.stringify(childParams),
                 currentStepId: target.frozenPlan.steps[0]?.stepId ?? null,
@@ -149,6 +147,7 @@ async function driveChildRun(input, childRow) {
         ...(ctx.dispatcher ? { dispatcher: ctx.dispatcher } : {}),
         ...(ctx.maxConcurrency !== undefined ? { maxConcurrency: ctx.maxConcurrency } : {}),
         ...(ctx.eventSource !== undefined ? { eventSource: ctx.eventSource } : {}),
+        ...(ctx.bundleRootOverride !== undefined ? { bundleRootOverride: ctx.bundleRootOverride } : {}),
         // The parent's own `finally` owns the process-lifecycle drain; no maxSteps/maxRetries.
         disposeDispatchResources: () => { },
     };

package/dist/workflows/exec/dispatch-redaction.js

@@ -10,12 +10,14 @@ import { collectSensitiveValues, isEnvPassthroughValueSafeToExpose, redactSensit
 import { lookupApiKeyFileValue, lookupApiKeySecretRefValue } from "../../integrations/agent/engine-resolution.js";
 /**
  * Every exact value that must never reach the journal from one dispatch: the
- * resolved `env` bindings, the engine's (and SDK fallback's) credential from
- * env, file, or secret store, and unsafe passthrough values. Read at call time,
- * so collect no earlier than the dispatch being scrubbed.
+ * secrets substituted into the unit's env bindings (`dispatch.sensitiveValues`;
+ * the rest of an env asset is configuration and reaches the journal as is), the
+ * engine's (and SDK fallback's) credential from env, file, or secret store, and
+ * unsafe passthrough values. Read at call time, so collect no earlier than the
+ * dispatch being scrubbed.
  */
-export function collectWorkflowDispatchSensitiveValues(dispatch, env) {
-    const values = new Set([...Object.values(env ?? {}), ...(dispatch.sensitiveValues ?? [])]);
+export function collectWorkflowDispatchSensitiveValues(dispatch) {
+    const values = new Set(dispatch.sensitiveValues ?? []);
     const addCredential = (runner) => {
         if (!runner)
             return;
@@ -66,12 +68,28 @@ export function collectWorkflowDispatchSensitiveValues(dispatch, env) {
     addCredential(dispatch.runner);
     return collectSensitiveValues(values);
 }
+/**
+ * Turn a number leaf that is exactly a sensitive value into its text, so the string scrub redacts it (a
+ * numeric secret echoed as a JSON number). Only the unit's parsed `result` takes this path: a number
+ * elsewhere in an outcome (`tokens`) stays a number.
+ */
+function stringifySensitiveNumbers(value, sensitiveValues) {
+    if (typeof value === "number")
+        return sensitiveValues.includes(String(value)) ? String(value) : value;
+    if (Array.isArray(value))
+        return value.map((entry) => stringifySensitiveNumbers(entry, sensitiveValues));
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, stringifySensitiveNumbers(child, sensitiveValues)]));
+    }
+    return value;
+}
 /**
  * Scrub a dispatch outcome before anything about it is journaled. A
  * `failureReason` the scrub altered carried a secret, so it is downgraded.
  */
 export function redactUnitOutcome(outcome, sensitiveValues) {
-    const redacted = redactSensitiveValue(outcome, sensitiveValues);
+    const prepared = "result" in outcome ? { ...outcome, result: stringifySensitiveNumbers(outcome.result, sensitiveValues) } : outcome;
+    const redacted = redactSensitiveValue(prepared, sensitiveValues);
     if (outcome.failureReason !== undefined && redacted.failureReason !== outcome.failureReason) {
         redacted.failureReason = "reported_failure";
     }

package/dist/workflows/exec/environment.js

@@ -3,27 +3,18 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
  * Materialize a unit's frozen environment at dispatch. Env-file values are the
- * one deliberately live input to a frozen plan: freeze records each ref's
- * owner, key set and `${secret:…}` names; the values (and the secrets they
- * name) are read here, per dispatch, and nothing is returned until every read
- * has succeeded.
+ * one deliberately live input to a frozen plan: freeze records each env ref;
+ * the values (and the secrets and paths their `${ref}` tokens name) are read
+ * here, per dispatch, through `resolveEnvBinding` — the same machinery `akm env
+ * run` uses — and nothing is returned until every read has succeeded.
  */
-import fs from "node:fs";
-import path from "node:path";
-import dotenv from "dotenv";
-import { assetPathForName } from "../../core/asset/asset-placement.js";
-import { compareCodePoints, isWithin } from "../../core/common.js";
-import { NotFoundError, UsageError } from "../../core/errors.js";
-export const SECRET_TOKEN_RE = /\$\{secret:([A-Za-z0-9_./-]+)\}/g;
-export function materializeFrozenWorkflowEnvironment(descriptors, options = {}) {
+import { resolveEnvBinding } from "../../commands/env/env-binding.js";
+export function materializeFrozenWorkflowEnvironment(descriptors) {
     const values = {};
     const sensitive = new Set();
-    const audits = [];
     for (const descriptor of descriptors) {
         if (descriptor.kind === "literal") {
             values[descriptor.name] = descriptor.value;
-            if (descriptor.value)
-                sensitive.add(descriptor.value);
             continue;
         }
         // `pass_env` names reach the exec child through its allowlist
@@ -31,64 +22,10 @@ export function materializeFrozenWorkflowEnvironment(descriptors, options = {})
         // deliberately not redacted, so they are neither read nor marked sensitive here.
         if (descriptor.kind === "pass-through")
             continue;
-        const source = options.readEnvFile ? options.readEnvFile(descriptor) : readEnvFile(descriptor.owner);
-        const parsed = dotenv.parse(typeof source === "string" ? source : Buffer.from(source));
-        const keys = Object.keys(parsed).sort(compareCodePoints);
-        if (!sameStrings(keys, descriptor.keys))
-            invalid(`environment ${descriptor.ref} key set changed after it was frozen`);
-        const secretValues = new Map();
-        for (const name of descriptor.secretNames) {
-            const raw = options.readSecret ? options.readSecret({ name, descriptor }) : readSecret(descriptor.owner, name);
-            if (raw === undefined) {
-                throw new NotFoundError(`Environment ${descriptor.ref} references missing secret ${name}; nothing was materialized.`, "FILE_NOT_FOUND");
-            }
-            const value = typeof raw === "string" ? raw : Buffer.from(raw).toString("utf8");
-            secretValues.set(name, value);
-            if (value)
-                sensitive.add(value);
-        }
-        for (const [key, rawValue] of Object.entries(parsed)) {
-            const resolved = rawValue.replace(SECRET_TOKEN_RE, (_token, name) => {
-                const secret = secretValues.get(name);
-                if (secret === undefined)
-                    invalid(`environment ${descriptor.ref} secret ${name} was not frozen`);
-                return secret;
-            });
-            values[key] = resolved;
-            if (resolved)
-                sensitive.add(resolved);
-        }
-        audits.push({
-            eventType: "env_access",
-            ref: descriptor.ref,
-            keys: [...descriptor.keys],
-            secretNames: [...descriptor.secretNames],
-        });
-    }
-    return { values, sensitiveValues: [...sensitive], audits };
-}
-function readEnvFile(owner) {
-    if (!isWithin(owner.requestedPath, owner.requestedRoot))
-        invalid(`env file ${owner.relativePath} escapes its bundle`);
-    return fs.readFileSync(owner.requestedPath);
-}
-function readSecret(owner, name) {
-    const secretsRoot = path.join(owner.requestedRoot, "secrets");
-    const secretPath = assetPathForName("secret", secretsRoot, name);
-    if (!isWithin(secretPath, secretsRoot))
-        invalid(`secret name ${name} escapes its bundle`);
-    try {
-        return fs.readFileSync(secretPath);
-    }
-    catch (cause) {
-        if (cause.code === "ENOENT")
-            return undefined;
-        throw cause;
+        const binding = resolveEnvBinding(descriptor.ref);
+        Object.assign(values, binding.values);
+        for (const secret of binding.secretValues)
+            sensitive.add(secret);
     }
-}
-function sameStrings(left, right) {
-    return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-function invalid(message) {
-    throw new UsageError(`Invalid frozen workflow environment: ${message}.`, "WORKFLOW_SOURCE_INVALID");
+    return { values, sensitiveValues: [...sensitive] };
 }

package/dist/workflows/exec/exec-unit.js

@@ -4,14 +4,14 @@
 /**
  * The `exec` unit runner — the one place a frozen workflow spawns a command:
  * argv-only, detached with a SIGTERM→SIGKILL ladder against the process group,
- * cwd-contained by a resolved-path recheck, bounded (timeout, output bytes,
- * context size), with an allowlisted environment ({@link childEnv}). The
+ * bounded (timeout, output bytes, context size), with an allowlisted
+ * environment ({@link childEnv}). The
  * caller redacts the outcome before anything is journaled.
  * See docs/architecture/decisions/0003-child-env-allowlist-and-provenance.md.
  */
 import fs from "node:fs";
 import path from "node:path";
-import { isWithinAsync } from "../../core/common.js";
+import { getCacheDir, getConfigDir, getDataDir, getStateDir } from "../../core/paths.js";
 import { COMMON_SPAWN_ENV_PASSTHROUGH, collectAllowlistedEnv, WIN32_SPAWN_ENV_FLOOR } from "../../core/spawn-env.js";
 import { runManagedSubprocess, streamCaptureFailure, } from "../../core/subprocess.js";
 import { warn } from "../../core/warn.js";
@@ -25,8 +25,9 @@ const EXEC_STDERR_DIAGNOSTIC_CLIP = WORKFLOW_UNIT_DIAGNOSTIC_CLIP - 500;
 /**
  * The default environment allowlist for an exec unit's child (`exec.passEnv`
  * extends it): the agent-harness baseline plus names ordinary commands need
- * and `AKM_EVENT_SOURCE`. Credentials, cloud/CI vars, and proxies reach a
- * child only through `pass_env` or `env:`.
+ * and `AKM_EVENT_SOURCE`. akm's own directories are not listed: {@link childEnv}
+ * sets them from the parent's effective locations. Credentials, cloud/CI vars, and proxies reach a child only through
+ * `pass_env` or `env:`.
  */
 export const EXEC_DEFAULT_ENV_PASSTHROUGH = [
     // PATH, HOME, USER, LANG, LC_ALL, TERM, TMPDIR, AKM_EVENT_SOURCE
@@ -49,7 +50,7 @@ export const EXEC_DEFAULT_ENV_PASSTHROUGH = [
 /**
  * Run one exec unit and map its outcome onto the dispatch vocabulary
  * (`non_zero_exit`, `timeout`, `aborted`, `spawn_failed` — retryable). The
- * `exec_*` reasons (cwd escape, output limit, context too large, incomplete
+ * `exec_*` reasons (output limit, context too large, incomplete
  * capture) are deliberately outside `retry.on`. Output overflow fails only a
  * unit that declared an `output:` schema.
  */
@@ -220,21 +221,11 @@ function contextTooLarge(input, what, names, limits) {
     };
 }
 /**
- * Resolve `exec.cwd` inside `baseDir` and prove containment against the
- * resolved base (a symlinked `reports` could point at `/etc`). Async: it runs
- * per unit on the dispatch path.
+ * Join `exec.cwd` onto `baseDir` once. `exec.cwd` may be relative or absolute and is not contained:
+ * the command is arbitrary code in its own right. Async: it runs per unit on the dispatch path.
  */
 async function resolveExecCwd(input) {
-    const base = path.resolve(input.baseDir);
-    const target = input.exec.cwd ? path.resolve(base, input.exec.cwd) : base;
-    if (!(await isWithinAsync(target, base))) {
-        return {
-            ok: false,
-            failureReason: "exec_cwd_escape",
-            error: `exec unit "${input.unitId}" declares cwd ${JSON.stringify(input.exec.cwd ?? ".")}, which resolves to ` +
-                `${target} — outside its working directory ${base}. Refusing to run outside the unit's tree.`,
-        };
-    }
+    const target = path.resolve(input.baseDir, input.exec.cwd ?? ".");
     if (!(await isExistingDirectory(target))) {
         return {
             ok: false,
@@ -253,12 +244,12 @@ async function isExistingDirectory(candidate) {
     }
 }
 /**
- * The child's environment, in precedence order: the allowlist plus
- * `exec.passEnv`; the resolved `env:` bindings; then the engine's `AKM_*`
- * context, last so a binding cannot shadow it.
+ * The child's environment, in precedence order: the parent's effective akm
+ * directories; the allowlist plus `exec.passEnv`; the resolved `env:` bindings;
+ * then the engine's `AKM_*` context, last so a binding cannot shadow it.
  */
 function childEnv(exec, bindings, context, eventSource) {
-    const env = collectAllowlistedEnv(execAllowlist(exec));
+    const env = { ...akmLocations(), ...collectAllowlistedEnv(execAllowlist(exec)) };
     // Only when absent from the base, and before the overlays, so ambient and authored values win.
     if (eventSource !== undefined && env.AKM_EVENT_SOURCE === undefined) {
         env.AKM_EVENT_SOURCE = eventSource;
@@ -269,6 +260,23 @@ function childEnv(exec, bindings, context, eventSource) {
         env[name] = value;
     return env;
 }
+/**
+ * The directories this akm resolved, as the `AKM_*` variables that name them, so
+ * a step that runs `akm` uses the same installation even when the parent found
+ * them through `XDG_*_HOME`. `AKM_BUNDLE_DIR` is passed only when the parent set one.
+ */
+function akmLocations() {
+    const locations = {
+        AKM_CONFIG_DIR: getConfigDir(),
+        AKM_DATA_DIR: getDataDir(),
+        AKM_CACHE_DIR: getCacheDir(),
+        AKM_STATE_DIR: getStateDir(),
+    };
+    const bundleDir = process.env.AKM_BUNDLE_DIR?.trim();
+    if (bundleDir)
+        locations.AKM_BUNDLE_DIR = bundleDir;
+    return locations;
+}
 /** The unit's effective allowlist: the shared default plus its own `passEnv` names. */
 function execAllowlist(exec) {
     return exec.passEnv ? [...EXEC_DEFAULT_ENV_PASSTHROUGH, ...exec.passEnv] : [...EXEC_DEFAULT_ENV_PASSTHROUGH];

package/dist/workflows/exec/frozen-judge.js

@@ -9,12 +9,22 @@
  * bindings (a step's environment belongs to the work, not the verifier).
  */
 import { warn } from "../../core/warn.js";
+import { resolveRunBundleRoot } from "../runtime/workflow-asset-loader.js";
 import { collectWorkflowDispatchSensitiveValues, withDispatchRedaction } from "./dispatch-redaction.js";
 import { dispatchWorkflowExecution, prepareWorkflowExecution, } from "./unit-dispatch.js";
 /** The gate's node id — identical to what `journalGateEvaluationStart` writes. */
 export function gateNodeId(stepId) {
     return `${stepId}.gate`;
 }
+/**
+ * The root of the bundle the run's workflow lives in, found when the judge is built (a bundle update moves it).
+ * No frozen judge, no root needed. When the bundle does not resolve the judge is not built, and the error names the ref.
+ */
+export function resolveJudgeCwd(target, workflowRef) {
+    if (!target)
+        return undefined;
+    return resolveRunBundleRoot(workflowRef);
+}
 /** Identity for one judge dispatch: the caller's row identity, else the run/step with the gate node id. */
 function dispatchIdentity(owner, identity) {
     return identity ?? { ...owner, unitId: gateNodeId(owner.stepId) };
@@ -31,8 +41,11 @@ function warnLoweringNotices(...groups) {
         }
     }
 }
-/** Build a gate judge from the frozen target without consulting live config; `eventSource` stamps it like a unit. */
-export function frozenSummaryJudge(target, signal, dispatcher, owner, eventSource) {
+/**
+ * Build a gate judge from the frozen target without consulting live config; `eventSource` stamps it like a unit.
+ * `cwd` is the root of the run's bundle, where the judge works like every other agent dispatch.
+ */
+export function frozenSummaryJudge(target, signal, dispatcher, owner, eventSource, cwd) {
     if (!target)
         return null;
     const dispatch = withDispatchRedaction(dispatcher ?? dispatchWorkflowExecution);
@@ -52,6 +65,7 @@ export function frozenSummaryJudge(target, signal, dispatcher, owner, eventSourc
         const request = {
             ...commonRequest,
             frozenTarget: target,
+            ...(cwd !== undefined ? { cwd } : {}),
             timeoutMs: target.runner.timeoutMs ?? null,
             ...(eventSource !== undefined ? { eventSource } : {}),
         };
@@ -59,7 +73,7 @@ export function frozenSummaryJudge(target, signal, dispatcher, owner, eventSourc
         // sample. The injected dispatcher may be a test seam, but it receives the
         // exact same already-validated request and redaction declaration.
         const lowered = prepareWorkflowExecution(request);
-        const sensitiveValues = collectWorkflowDispatchSensitiveValues({ runner: target.runner }, undefined);
+        const sensitiveValues = collectWorkflowDispatchSensitiveValues({ runner: target.runner });
         const outcome = await dispatch({
             ...request,
             ...(sensitiveValues.length > 0 ? { sensitiveValues } : {}),