cool-workflow 0.1.86 → 0.1.88

package/dist/orchestrator/lifecycle-operations.js

@@ -27,6 +27,8 @@ const harness_1 = require("../harness");
 const workflow_app_framework_1 = require("../workflow-app-framework");
 const workflow_api_1 = require("../workflow-api");
 const observability_1 = require("../observability");
+const compare_1 = require("../compare");
+const loop_expansion_1 = require("../loop-expansion");
 const dispatch_1 = require("../dispatch");
 const verifier_1 = require("../verifier");
 const trust_audit_1 = require("../trust-audit");
@@ -53,7 +55,13 @@ function plan(appRecord, options) {
             inputs[declared.name] = declared.default ?? "";
     }
     const cwd = node_path_1.default.resolve(String(inputs.cwd || inputs.repo || process.cwd()));
-    const runId = createRunId(workflow.id);
+    // A caller (e.g. an inline sub-workflow task) may inject a DETERMINISTIC run id so
+    // the child run id is reproducible across re-runs; otherwise mint one. `runId` is
+    // never a declared workflow input, so strip it from inputs to keep run.inputs (and
+    // the digests derived from it) clean — POLA for every normal plan.
+    const injectedRunId = typeof options.runId === "string" && options.runId.trim() ? options.runId.trim() : undefined;
+    delete inputs.runId;
+    const runId = injectedRunId || createRunId(workflow.id);
     const runDir = node_path_1.default.join(cwd, ".cw", "runs", runId);
     const paths = (0, state_1.createRunPaths)(runDir);
     (0, state_1.ensureRunDirs)(paths);
@@ -79,7 +87,10 @@ function plan(appRecord, options) {
             status: "pending",
             taskIds: phase.tasks.map((task) => task.id),
             // parallel() DSL: the drive loop reads this to size its concurrent round.
-            ...(phase.mode ? { mode: phase.mode } : {})
+            ...(phase.mode ? { mode: phase.mode } : {}),
+            // loop() DSL: the ORIGIN phase carries the loop spec + round 1; the expander
+            // appends round-2+ phases after each round (loop-expansion / maybeExpandLoop).
+            ...(phase.loop ? { loop: phase.loop, loopRound: 1 } : {})
         })),
         tasks,
         dispatches: [],
@@ -323,6 +334,9 @@ function recordWorkerOutput(run, workerId, resultPath, options = {}) {
         }
         run.loopStage = "observe";
         (0, dispatch_1.updatePhaseStatuses)(run);
+        // Bounded dynamic loops: after a round's tasks complete, evaluate the predicate
+        // and either append the next round or mark the loop done (no-op for non-loop runs).
+        maybeExpandLoop(run);
         (0, verifier_1.validateRunGates)(run);
         (0, commit_1.commitState)(run, `worker:${workerId}:result`);
         (0, report_1.writeReport)(run);
@@ -410,6 +424,120 @@ function validateInputs(workflow, inputs) {
         }
     }
 }
+/** Bounded dynamic loop expansion. After a worker result is recorded: if the just-
+ *  completed phase is the LATEST round of a loop whose origin is not yet done, evaluate
+ *  the registered predicate over the round's recorded results and either append the
+ *  next round (clone the round-1 template tasks into a fresh phase, materialized like
+ *  plan() does) or mark the loop done. One deterministic `loop-control` node is recorded
+ *  per round boundary — the replay source of truth. No-op when the run has no loop
+ *  phases (POLA). Expands at most ONE loop boundary per call; the next accept handles
+ *  the next. Bounded: a loop never exceeds `maxRounds` (fail-closed); an unregistered
+ *  predicate stops the loop rather than spinning. */
+function maybeExpandLoop(run) {
+    for (const phase of [...run.phases]) {
+        const originId = phase.loop ? phase.id : phase.loopOrigin;
+        if (!originId)
+            continue;
+        const origin = run.phases.find((p) => p.id === originId);
+        if (!origin || !origin.loop || origin.loopDone)
+            continue;
+        // Act only from the LATEST round phase of this loop.
+        const loopPhases = run.phases.filter((p) => p.id === originId || p.loopOrigin === originId);
+        const latest = loopPhases.reduce((a, b) => ((b.loopRound || 1) >= (a.loopRound || 1) ? b : a));
+        if (phase.id !== latest.id)
+            continue;
+        const roundTasks = run.tasks.filter((t) => latest.taskIds.includes(t.id));
+        if (roundTasks.length === 0 || !roundTasks.every((t) => t.status === "completed"))
+            continue;
+        const round = latest.loopRound || 1;
+        const ordered = (tasks) => tasks.slice().sort((a, b) => (0, compare_1.compareBytes)(a.id, b.id)).map((t) => t.result);
+        const roundResults = ordered(roundTasks);
+        const allLoopTasks = run.tasks.filter((t) => t.status === "completed" && loopPhases.some((p) => p.taskIds.includes(t.id)));
+        const allResults = ordered(allLoopTasks);
+        const ctx = { round, roundResults, allResults, usageTotals: (0, observability_1.deriveUsageTotals)(run).totals, inputs: run.inputs };
+        const until = origin.loop.until;
+        let decision;
+        if (until.kind === "budget-target") {
+            // Budget-aware scaling: keep spawning rounds while RECORDED (attested-only) usage
+            // stays under the target. Composes with the fail-closed cap (limits.tokenBudget),
+            // which the drive enforces before each spawn and which remains the absolute
+            // backstop — whichever fires first wins, and the cap can never be overshot.
+            const spent = ctx.usageTotals.totalTokens;
+            decision = { done: spent >= until.target, reason: `budget-target: ${spent}/${until.target} recorded tokens` };
+        }
+        else {
+            const predicate = (0, loop_expansion_1.getLoopPredicate)(until.ref);
+            decision = predicate
+                ? predicate(ctx)
+                : { done: true, reason: `loop predicate "${until.ref}" not registered — stopping fail-closed` };
+        }
+        const atCap = round >= origin.loop.maxRounds;
+        const done = decision.done || atCap;
+        // Record the decision under a deterministic id (the replay source of truth).
+        (0, state_node_1.appendRunNode)(run, (0, state_node_1.createStateNode)({
+            id: `${run.id}:loop-control:${originId}:r${round}`,
+            kind: "loop-control",
+            status: "completed",
+            loopStage: "adjust",
+            outputs: { round, done, atCap, reason: decision.reason },
+            metadata: { originPhaseId: originId, until: until.kind === "predicate" ? until.ref : `budget-target:${until.target}`, round, done, atCap, reason: decision.reason }
+        }));
+        if (done) {
+            origin.loopDone = true;
+            return;
+        }
+        // Expand: clone the ROUND-1 template tasks into a fresh phase appended right after.
+        const nextRound = round + 1;
+        const nextPhaseName = `${origin.name} (round ${nextRound})`;
+        const templateTasks = run.tasks.filter((t) => origin.taskIds.includes(t.id));
+        const newTasks = templateTasks.map((t) => ({
+            id: `${t.id.replace(/@r\d+$/, "")}@r${nextRound}`,
+            kind: t.kind,
+            phase: nextPhaseName,
+            status: "pending",
+            requiresEvidence: t.requiresEvidence,
+            prompt: t.prompt,
+            taskPath: "",
+            resultPath: "",
+            loopStage: "interpret",
+            loopRound: nextRound,
+            ...(t.sandboxProfileId ? { sandboxProfileId: t.sandboxProfileId } : {}),
+            ...(t.label ? { label: t.label } : {}),
+            ...(t.model ? { model: t.model } : {}),
+            ...(t.agentType ? { agentType: t.agentType } : {}),
+            ...(t.schema ? { schema: t.schema } : {})
+        }));
+        const nextPhase = {
+            id: `${originId}@r${nextRound}`,
+            name: nextPhaseName,
+            status: "pending",
+            taskIds: newTasks.map((t) => t.id),
+            loopOrigin: originId,
+            loopRound: nextRound,
+            ...(origin.mode ? { mode: origin.mode } : {})
+        };
+        const insertAt = run.phases.findIndex((p) => p.id === latest.id);
+        run.phases.splice(insertAt + 1, 0, nextPhase);
+        run.tasks.push(...newTasks);
+        // Materialize: task files + a plan-stage contract node per new task (mirrors plan()).
+        (0, harness_1.writeTaskFiles)(run);
+        const contractId = run.contracts && run.contracts[0] ? run.contracts[0].id : undefined;
+        const inputNodeId = `${run.id}:input`;
+        const pipeline = (0, pipeline_runner_1.createPipelineRunner)({ contractId, persist: false });
+        for (const t of newTasks) {
+            const result = pipeline.runPipelineStage(run, "plan", inputNodeId, {
+                outputNodeId: `${run.id}:task:${t.id}`,
+                outputStatus: "pending",
+                loopStage: "interpret",
+                artifacts: [{ id: "task", kind: "markdown", path: t.taskPath }],
+                metadata: { workflowId: run.workflow.id, taskId: t.id, phase: t.phase, taskKind: t.kind, requiresEvidence: t.requiresEvidence, sandboxProfileId: t.sandboxProfileId }
+            });
+            t.stateNodeId = result.outputNodeId;
+        }
+        (0, dispatch_1.updatePhaseStatuses)(run);
+        return;
+    }
+}
 function flattenTasks(workflow, inputs) {
     const seen = new Set();
     const tasks = [];
@@ -437,7 +565,10 @@ function flattenTasks(workflow, inputs) {
                 ...(task.label ? { label: task.label } : {}),
                 ...(task.model ? { model: task.model } : {}),
                 ...(task.agentType ? { agentType: task.agentType } : {}),
-                ...(task.resultCache ? { resultCache: task.resultCache } : {})
+                ...(task.resultCache ? { resultCache: task.resultCache } : {}),
+                ...(task.subWorkflow ? { subWorkflow: task.subWorkflow } : {}),
+                // A loop phase's tasks are round 1 of the loop; the expander clones them.
+                ...(phase.loop ? { loopRound: 1 } : {})
             });
         }
     }

package/dist/orchestrator.js

@@ -36,8 +36,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CoolWorkflowRunner = void 0;
+exports.KNOWN_COMMANDS = exports.CoolWorkflowRunner = void 0;
 exports.parseArgv = parseArgv;
+exports.suggestCommand = suggestCommand;
+exports.formatSearchResults = formatSearchResults;
+exports.formatInfo = formatInfo;
 exports.formatHelp = formatHelp;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -68,6 +71,7 @@ const feedbackOps = __importStar(require("./orchestrator/feedback-operations"));
 const topologyOps = __importStar(require("./orchestrator/topology-operations"));
 const lifecycleOps = __importStar(require("./orchestrator/lifecycle-operations"));
 const migrationOps = __importStar(require("./orchestrator/migration-operations"));
+const term_1 = require("./term");
 // CoolWorkflowRunner — the single FACADE both surfaces (cli.ts and the MCP server)
 // call through. It is deliberately WIDE but THIN: each method either
 //   (a) loads the run's durable state and delegates to a domain function in
@@ -796,10 +800,20 @@ function parseArgv(argv) {
                 positionals.push(rest[restIndex]);
             break;
         }
-        if (!token.startsWith("--")) {
+        if (!token.startsWith("-")) {
             positionals.push(token);
             continue;
         }
+        if (!token.startsWith("--")) {
+            // Single-dash short flag aliases: -q → question, -r → repo, -a → agent-command, -h → help, -v → version
+            const shortMap = { q: "question", r: "repo", a: "agent-command", h: "help", v: "version" };
+            const flag = token.slice(1);
+            // Handle combined short flags like -qr (not common but safe to ignore)
+            const key = shortMap[flag] || flag;
+            const val = rest[index + 1] && !rest[index + 1].startsWith("-") ? rest[++index] : true;
+            appendOption(options, key, val);
+            continue;
+        }
         const withoutPrefix = token.slice(2);
         const equalsIndex = withoutPrefix.indexOf("=");
         let key;
@@ -816,84 +830,116 @@ function parseArgv(argv) {
     }
     return { command, positionals, options };
 }
+/** All known top-level CW commands. Used for "did you mean?" suggestions. */
+exports.KNOWN_COMMANDS = new Set([
+    "help", "list", "doctor", "info", "search", "man", "init", "quickstart", "plan", "status", "next",
+    "dispatch", "result", "state", "commit", "report", "app", "sandbox",
+    "backend", "contract", "node", "feedback", "worker", "audit", "candidate",
+    "review", "loop", "schedule", "routine", "registry", "run", "queue",
+    "history", "audit-run", "multi-agent", "topology", "summary", "blackboard",
+    "coordinator", "metrics", "operator", "sched", "gc", "telemetry",
+    "migration", "demo", "workbench", "approve", "reject", "comment", "handoff",
+    "graph", "eval", "version", "update", "fix"
+]);
+/** Levenshtein distance between two short strings. */
+function levenshtein(a, b) {
+    const m = a.length;
+    const n = b.length;
+    let prev = Array.from({ length: n + 1 }, (_, j) => j);
+    let curr = new Array(n + 1);
+    for (let i = 1; i <= m; i++) {
+        curr[0] = i;
+        for (let j = 1; j <= n; j++) {
+            curr[j] = Math.min(prev[j] + 1, curr[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        }
+        [prev, curr] = [curr, prev];
+    }
+    return prev[n];
+}
+/** Suggest the closest known command for a typo. Returns undefined if no match
+ *  within half the length of the input (avoiding wild guesses on short strings). */
+function suggestCommand(input) {
+    if (!input || input.length < 2)
+        return undefined;
+    const lower = input.toLowerCase();
+    let best = "";
+    let bestDist = Infinity;
+    for (const cmd of exports.KNOWN_COMMANDS) {
+        const dist = levenshtein(lower, cmd);
+        if (dist < bestDist) {
+            best = cmd;
+            bestDist = dist;
+        }
+    }
+    // Threshold: distance must be <= half the input length AND <= 3
+    if (bestDist <= 3 && bestDist <= lower.length / 2)
+        return best;
+    return undefined;
+}
+function formatSearchResults(keyword, results) {
+    if (!results.length)
+        return `No workflows matched "${keyword}".\n  Tip: cw list for all available workflows.`;
+    return [
+        (0, term_1.bold)(`${results.length} workflow${results.length !== 1 ? "s" : ""} matching "${keyword}"`),
+        ...results.map((r) => `  ${r.id} — ${r.title}\n    ${(0, term_1.dim)(r.summary.slice(0, 120))}${r.summary.length > 120 ? "…" : ""}`),
+        "",
+        (0, term_1.dim)("Use cw info <id> for full details.")
+    ].join("\n");
+}
+function formatInfo(appId, data) {
+    const app = (data.app || {});
+    const inputs = (Array.isArray(data.inputs) ? data.inputs : []);
+    const phases = (Array.isArray(data.phases) ? data.phases : []);
+    const lines = [(0, term_1.bold)(`cw info ${appId}`)];
+    if (data.title)
+        lines.push(`  Title: ${data.title}`);
+    if (data.version)
+        lines.push(`  Version: ${data.version}`);
+    if (data.summary)
+        lines.push(`  Summary: ${data.summary}`);
+    if (data.author)
+        lines.push(`  Author: ${typeof data.author === "object" ? data.author.name : data.author}`);
+    if (data.compatible !== undefined)
+        lines.push(`  Compatible: ${data.compatible ? "yes" : "no"}`);
+    if (inputs.length > 0) {
+        lines.push("  Inputs:");
+        for (const input of inputs) {
+            const name = input.name || "";
+            const type = input.type || "string";
+            const required = input.required ? ", required" : "";
+            const def = input.default ? `, default: ${input.default}` : "";
+            const desc = input.description ? ` — ${input.description}` : "";
+            lines.push(`    - ${name} (${type}${required}${def})${desc}`);
+        }
+    }
+    if (Array.isArray(data.sandboxProfiles) && data.sandboxProfiles.length > 0) {
+        lines.push(`  Sandbox: ${data.sandboxProfiles.join(", ")}`);
+    }
+    const taskCount = data.taskCount || 0;
+    if (phases.length > 0) {
+        lines.push(`  Phases: ${phases.length} phase${phases.length !== 1 ? "s" : ""}, ${taskCount} task${taskCount !== 1 ? "s" : ""}`);
+    }
+    lines.push(`  Run: cw quickstart ${appId} --repo . --question "..."`);
+    return lines.join("\n");
+}
 function formatHelp() {
     return [
-        "Cool Workflow",
+        (0, term_1.bold)("Cool Workflow"),
+        "",
+        "  -q \"question\" [-claude|-codex|-deepseek]  Ask a question, get a report",
+        "  version                                   Show version",
+        "  update                                    Update to latest release",
+        "  doctor                                    Check setup",
+        "  fix                                       Show fix commands for setup issues",
         "",
-        "Quick start (ONE command — plan -> drive -> report):",
-        "  quickstart [architecture-review] --repo PATH --question TEXT --agent-command \"claude -p\"",
-        "    (delegates each worker to YOUR configured agent backend; --preview for a dry run)",
+        (0, term_1.bold)("Flags"),
+        "  -q, --question TEXT    The task or question to answer",
+        "  -r, --repo PATH        Target repository path (default: .)",
+        "  -claude                Use Claude agent",
+        "  -codex                 Use Codex agent",
+        "  -deepseek              Use DeepSeek (via opencode)",
         "",
-        "Commands:",
-        "  list",
-        "  doctor [--json] [--onramp] [--changed-from REF]   (check setup and show the shortest safe next steps)",
-        "  init <workflow-id> [--title TEXT] [--output PATH]",
-        "  quickstart [app-id] [--repo PATH] [--question TEXT] [--agent-command CMD] [--check] [--once] [--preview]",
-        "  plan <workflow-id> [--repo PATH] [--question TEXT] [--invariant TEXT]",
-        "  status <run-id> [--json|--format json]",
-        "  next <run-id> [--limit N]",
-        "  graph <run-id> [--json]",
-        "  dispatch <run-id> [--limit N] [--sandbox PROFILE] [--backend node|bun|shell|container|remote|ci]",
-        "  result <run-id> <task-id> <result-file>",
-        "  state check <run-id> [--state PATH] [--write]",
-        "  commit <run-id> --verifier <node-id> [--reason TEXT]",
-        "  commit <run-id> --candidate <candidate-id> [--reason TEXT]",
-        "  commit <run-id> --selection <selection-id> [--reason TEXT]",
-        "  commit <run-id> --allow-unverified-checkpoint [--reason TEXT]",
-        "  commit summary <run-id> [--json]",
-        "  report <run-id> [--show|--summary]",
-        "  app list|show|validate|init|package",
-        "  sandbox list|show|validate",
-        "  backend list|show|probe [backend-id]",
-        "  contract show <run-id> [contract-id]",
-        "  node list|show|graph <run-id>",
-        "  feedback list|summary|show|collect|task|resolve <run-id>",
-        "  worker list|summary|show|manifest|output|fail|validate <run-id>",
-        "  audit summary <run-id>",
-        "  audit worker <run-id> <worker-id>",
-        "  audit provenance <run-id> [--worker ID|--candidate ID|--commit ID]",
-        "  audit multi-agent <run-id> [--json]",
-        "  audit policy <run-id> [--json]",
-        "  audit role <run-id> <role-id> [--json]",
-        "  audit blackboard <run-id> [--json]",
-        "  audit judge <run-id> [--json]",
-        "  audit attest <run-id> [--worker ID] [--hostEnforced true] [--env NAME]",
-        "  audit decision <run-id> <worker-id> [--path PATH|--command CMD|--network TARGET|--env NAME]",
-        "  candidate list|summary|register|score|rank|select|reject <run-id>",
-        "  eval snapshot|replay|compare|score|gate|report",
-        "  summary refresh|show <run-id> [--json]",
-        "  blackboard summary|summarize|graph|resolve <run-id>",
-        "  blackboard topic create <run-id> --id <topic-id> --title TEXT",
-        "  blackboard message post|list <run-id>",
-        "  blackboard context put <run-id>",
-        "  blackboard artifact add|list <run-id>",
-        "  blackboard snapshot <run-id>",
-        "  coordinator summary <run-id>",
-        "  coordinator decision <run-id> --kind KIND --outcome OUTCOME --reason TEXT",
-        "  multi-agent run|status|step|blackboard|score|select|summary|summarize|graph|dependencies|failures|evidence <run-id>",
-        "  multi-agent graph <run-id> --view full|compact|critical-path|failures|evidence|trust|topology|blackboard|candidate|commit-gate [--focus ID] [--depth N]",
-        "  topology list|show|validate|apply|summary|graph",
-        "  schedule create|list|due|complete|pause|resume|run-now|history|daemon|delete",
-        "  routine create|fire|list|events|delete",
-        "  registry refresh|show [--scope repo|home] [--json]",
-        "  run search|list|show|resume|archive|rerun|export|import|verify-import [run-id|archive] [--scope repo|home] [--json]",
-        "  queue add|list|drain|show [queue-id] [--repo PATH] [--priority N]",
-        "  history [--scope repo|home] [--app ID] [--status STATE] [--json]",
-        "  audit-run <app-id> [--repo PATH] [--question TEXT] [--agent-command CMD]",
-        "  metrics show|summary <run-id> [--scope repo|home] [--json]",
-        "  telemetry verify <run-id> [--pubkey PEM|PATH] [--json]",
-        "  gc plan|run|verify [run-id] [--json]",
-        "  sched plan|lease|release|complete|reclaim|reset|policy [--json]",
-        "  migration list|check|prove [target] [--json]",
-        "  operator status|report <run-id> [--json]",
-        "  review status|policy <run-id> [--json]",
-        "  approve|reject|comment <kind> <run-id> <target-id> [--reason TEXT]",
-        "  handoff <kind> <run-id> <target-id> [--to ROLE]",
-        "  loop --prompt TEXT [--interval-minutes N]",
-        "  demo tamper",
-        "  workbench view <run-id> [--json]",
-        "  workbench serve [--port N] [--scope repo|home] [--once|--json]",
-        ""
+        "  list|search|info|init|plan|status|next|dispatch|result|state|commit|report|app|sandbox|backend|contract|node|feedback|worker|audit|candidate|review|loop|schedule|routine|registry|run|queue|history|quickstart|audit-run|multi-agent|topology|summary|blackboard|coordinator|metrics|operator|sched|gc|telemetry|migration|demo|workbench|approve|reject|comment|handoff|graph|eval|man|version|update|fix  More commands"
     ].join("\n");
 }
 function appendOption(options, key, value) {

package/dist/run-export.js

@@ -26,6 +26,7 @@ const version_1 = require("./version");
 const telemetry_ledger_1 = require("./telemetry-ledger");
 const telemetry_attestation_1 = require("./telemetry-attestation");
 const trust_audit_1 = require("./trust-audit");
+const execution_backend_1 = require("./execution-backend");
 const compare_1 = require("./compare");
 /** Export a run to a portable JSON archive with run-local bytes and digests. */
 function exportRun(run, outputPath, options = {}) {
@@ -84,9 +85,21 @@ function importRun(exportPath, targetDir) {
     const archiveSha256 = sha256Bytes(node_fs_1.default.readFileSync(exportPath));
     const files = normalizeArchiveFiles(raw);
     verifyArchiveFileDigests(files, raw.integrity);
+    if (!raw.run || typeof raw.run !== "object") {
+        throw new Error("Invalid run export: missing run object");
+    }
+    // The run id from the archive becomes a directory name under the target's
+    // runs root; a crafted id like "../../etc" would otherwise escape it. Refuse
+    // any id that is not a single safe path segment, then assert containment as
+    // defense-in-depth (catches a symlinked runs root too) before any write.
+    const runId = (0, state_1.assertSafeRunId)(raw.run.id);
+    const runsRoot = node_path_1.default.join(targetDir, ".cw", "runs");
+    const runDir = node_path_1.default.join(runsRoot, runId);
+    if (!(0, state_1.isContainedPath)(runDir, runsRoot)) {
+        throw new Error(`Run id escapes the runs directory: ${JSON.stringify(raw.run.id)}`);
+    }
     const oldRunDir = raw.run.paths.runDir;
     const oldCwd = raw.run.cwd;
-    const runDir = node_path_1.default.join(targetDir, ".cw", "runs", raw.run.id);
     const paths = (0, state_1.createRunPaths)(runDir);
     (0, state_1.ensureRunDirs)(paths);
     for (const file of files) {
@@ -294,6 +307,28 @@ function importManifestPath(run) {
  *
  *  Key precedence is bundle > argument > environment, so the artifact verifies the
  *  same on any machine; only when the bundle omits a key do the override/env apply. */
+/** True when report.md embeds `expected` (the trimmed result) at the task's OWN
+ *  section, exactly as orchestrator/report.ts renderResults emits it: a
+ *  `### <taskId>` heading, a `Result: <path>` line, then the result body — and the
+ *  body STARTS WITH `expected`. Anchoring to the section (not a whole-file substring)
+ *  means a decoy copy buried elsewhere does not satisfy it; matching from the heading
+ *  forward (rather than to the next heading) means a result body that itself contains
+ *  `###` cannot break the bound. The `Result:` path is matched loosely since it is
+ *  host-specific (rebased on import). */
+function reportSectionEmbedsResult(reportMd, taskId, expected) {
+    const needle = `### ${taskId}\n`;
+    // Walk EVERY `### <taskId>` occurrence — not just the first — so a stray heading
+    // inside an earlier task's result body (which is not followed by the `Result:`
+    // structure) is skipped rather than mis-anchoring the check (a false positive on a
+    // legitimate, fully-signed bundle whose findings contain markdown headings).
+    for (let from = reportMd.indexOf(needle); from >= 0; from = reportMd.indexOf(needle, from + 1)) {
+        const after = reportMd.slice(from);
+        const prefix = after.match(/^### [^\n]*\n\nResult: [^\n]*\n\n/);
+        if (prefix && after.slice(prefix[0].length).startsWith(expected))
+            return true;
+    }
+    return false;
+}
 function verifyReportBundle(archivePath, options = {}) {
     const inspect = inspectArchive(archivePath);
     const failedChecks = inspect.checks
@@ -312,6 +347,8 @@ function verifyReportBundle(archivePath, options = {}) {
         signaturesChecked: 0,
         signaturesReverified: 0,
         signaturesFailed: 0,
+        trustLevel: "unsigned",
+        reportFindingsVerified: false,
         failedChecks
     };
     // A bundle that is not even a supported archive cannot be restored — report the
@@ -348,6 +385,8 @@ function verifyReportBundle(archivePath, options = {}) {
     let signaturesChecked = 0;
     let signaturesReverified = 0;
     let signaturesFailed = 0;
+    let signaturesResultBound = 0;
+    let reportFindingsOk = true;
     let reportExtractedTo;
     try {
         // Restore into the throwaway tree. importRun digest-checks every file and throws
@@ -370,9 +409,48 @@ function verifyReportBundle(archivePath, options = {}) {
         signaturesChecked = sig.checked;
         signaturesReverified = sig.reverified;
         signaturesFailed = sig.failed;
+        signaturesResultBound = sig.resultBound.length;
         for (const check of sig.checks)
             if (!check.pass)
                 failedChecks.push({ name: check.name, code: check.code });
+        // Report ⇄ result ⇄ signature cross-check — three links so the agent's findings
+        // cannot be altered undetected on a signed bundle. CRUCIALLY this is driven by
+        // sig.resultBound (the records whose signature actually COVERED the result
+        // digest), NOT the run.tasks list — run.tasks is in the archive but bound by
+        // nothing (not the manifest digest, the chain, or the signature), so iterating it
+        // would let an attacker silence the check by dropping/un-completing a task. The
+        // obligation comes from the chained+signed ledger record instead:
+        //   1. each bound record's resultDigest is anchored by the executor signature
+        //      (coversResult re-verified above) — a 4-field signature is excluded, so an
+        //      injected resultDigest is never trusted;
+        //   2. the matching completed task's RESTORED result file must hash to that signed
+        //      digest (a missing/un-completed task or edited/empty result is a forgery);
+        //   3. report.md must embed that result at the task's own `### <taskId>` section.
+        // Editing the report breaks link 3; editing the result breaks link 2; editing both
+        // to one consistent lie still breaks link 2 (the signed digest does not move);
+        // dropping the task fails link 2 (the signed obligation remains).
+        const reportPath = imported.run.paths.report;
+        const reportMd = reportPath && node_fs_1.default.existsSync(reportPath) ? node_fs_1.default.readFileSync(reportPath, "utf8") : "";
+        const completedById = new Map(imported.run.tasks.filter((task) => task.status === "completed").map((task) => [task.id, task]));
+        for (const bound of sig.resultBound) {
+            const failBound = (code) => {
+                reportFindingsOk = false;
+                failedChecks.push({ name: "report-findings", code: `${code}:${bound.taskId}` });
+            };
+            const task = completedById.get(bound.taskId);
+            if (!task || !task.resultPath || !node_fs_1.default.existsSync(task.resultPath)) {
+                failBound("result-missing");
+                continue;
+            }
+            const resultRaw = node_fs_1.default.readFileSync(task.resultPath, "utf8");
+            if ((0, execution_backend_1.sha256)(resultRaw) !== bound.resultDigest) {
+                failBound("result-digest-mismatch");
+                continue;
+            }
+            if (!reportSectionEmbedsResult(reportMd, bound.taskId, resultRaw.trim())) {
+                failBound("report-result-mismatch");
+            }
+        }
         if (options.extractReportTo && reportContent !== undefined) {
             reportExtractedTo = node_path_1.default.resolve(options.extractReportTo);
             node_fs_1.default.writeFileSync(reportExtractedTo, reportContent);
@@ -389,6 +467,23 @@ function verifyReportBundle(archivePath, options = {}) {
     const strictShortfall = Boolean(options.strictSignatures) && signaturesChecked > 0 && !trustKey;
     if (strictShortfall)
         failedChecks.push({ name: "signatures", code: "signature-key-required" });
+    // Trust level + requireSignatures — closes the prior fail-open. "signed" means the
+    // agent's SIGNED findings are present and unaltered: at least one result-COVERING
+    // signature re-verified against a key, none failed, and each signed result is
+    // faithfully embedded in report.md (the forward cross-check held). A usage-only
+    // (4-field) signature, an unverifiable one (no key), or a tampered signed finding
+    // all yield "unsigned". requireSignatures refuses "unsigned".
+    //
+    // SCOPE (honest): "signed" attests the SIGNED findings, NOT that the report is
+    // exhaustively signed. CW holds no key to sign the rendered report and the ledger
+    // chain is self-recomputable, so the report MAY carry additional unsigned content
+    // (prose, or extra sections), and a determined re-chainer can OMIT a signed
+    // finding. Verify findings against the signed results; full report-completeness
+    // needs an external anchor. See report-verifiable-bundle.7.md / trust-model.md.
+    const trustLevel = signaturesResultBound > 0 && signaturesFailed === 0 && reportFindingsOk ? "signed" : "unsigned";
+    const unsignedShortfall = Boolean(options.requireSignatures) && trustLevel === "unsigned";
+    if (unsignedShortfall)
+        failedChecks.push({ name: "signatures", code: "signatures-required" });
     // Extraction was requested but could not be fulfilled (no report.md in the bundle,
     // or the write failed): fail closed rather than silently green a missing artifact —
     // otherwise `report bundle <run> --extract-report r.md && send r.md` would ship
@@ -401,7 +496,14 @@ function verifyReportBundle(archivePath, options = {}) {
         schemaVersion: 1,
         archivePath,
         runId: inspect.runId,
-        ok: inspect.ok && telemetryVerified && trustAuditVerified && signaturesFailed === 0 && !strictShortfall && !extractShortfall,
+        ok: inspect.ok &&
+            telemetryVerified &&
+            trustAuditVerified &&
+            signaturesFailed === 0 &&
+            reportFindingsOk &&
+            !strictShortfall &&
+            !extractShortfall &&
+            !unsignedShortfall,
         archiveOk: inspect.ok,
         telemetryVerified,
         trustAuditVerified,
@@ -410,6 +512,8 @@ function verifyReportBundle(archivePath, options = {}) {
         signaturesChecked,
         signaturesReverified,
         signaturesFailed,
+        trustLevel,
+        reportFindingsVerified: reportFindingsOk,
         reportExtractedTo,
         failedChecks
     };

package/dist/state-node.js

@@ -164,10 +164,20 @@ function linkStateNodes(parent, child) {
     ];
 }
 function appendRunNode(run, node) {
-    const nodes = run.nodes || [];
+    // Mutate run.nodes in place rather than rebuilding the whole array on every
+    // append. The old code did `nodes.map(...)` / `[...nodes, node]` per call, so a
+    // run that appends N nodes allocated arrays of size 1..N — O(N^2) churn + GC on
+    // a hot path (every dispatch/result/blackboard node). In place: O(1) per append
+    // for the common new-node case, and the resulting array — content AND order — is
+    // byte-identical to before (push appends at the end, replace keeps the slot), so
+    // the persisted state.json is unchanged. appendRunNode is the only writer of
+    // run.nodes, so the array reference stays stable across a run.
+    const nodes = run.nodes || (run.nodes = []);
     const index = nodes.findIndex((candidate) => candidate.id === node.id);
-    const nextNodes = index >= 0 ? nodes.map((candidate) => (candidate.id === node.id ? node : candidate)) : [...nodes, node];
-    run.nodes = nextNodes;
+    if (index >= 0)
+        nodes[index] = node;
+    else
+        nodes.push(node);
     writeRunNode(run, node);
     return node;
 }

package/dist/state.js

@@ -19,6 +19,7 @@ exports.realResolve = realResolve;
 exports.isContainedPath = isContainedPath;
 exports.withFileLock = withFileLock;
 exports.safeFileName = safeFileName;
+exports.assertSafeRunId = assertSafeRunId;
 exports.hashArtifactFile = hashArtifactFile;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -293,6 +294,26 @@ function withFileLock(targetPath, fn) {
 function safeFileName(value) {
     return String(value).replace(/[^a-zA-Z0-9_.:-]+/g, "_");
 }
+/** Refuse a run id that is not a single safe path segment, so an id taken from
+ *  an untrusted source (an imported run archive / bundle) can never escape the
+ *  runs directory via a separator or a `..`/`.` component (path traversal). A
+ *  real run id is `${workflowId}-${stamp}-${suffix}` (createRunId), and a
+ *  workflow id is alnum-bounded [a-z0-9.-] (validateWorkflowId) — all within
+ *  [A-Za-z0-9._-]. Because the charset already forbids any separator, the whole
+ *  id is ONE path component, so the only values that could traverse are the
+ *  components `.` and `..` themselves; an embedded `..` (e.g. a workflow id like
+ *  `v1..2`) is a safe directory name and is allowed. A separator, an absolute
+ *  path, or an empty value is refused, fail-closed. Returns the id on success so
+ *  callers can use it inline. */
+function assertSafeRunId(value, context = "run id") {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`Invalid ${context}: expected a non-empty string`);
+    }
+    if (!/^[A-Za-z0-9._-]+$/.test(value) || value === "." || value === "..") {
+        throw new Error(`Unsafe ${context}: ${JSON.stringify(value)} must be a single path segment ([A-Za-z0-9._-], not '.' or '..')`);
+    }
+    return value;
+}
 /** Compute and set SHA256 + sizeBytes on a StateArtifact from its file path
  *  (v0.1.73). Fails silently when the file doesn't exist — does not throw. */
 function hashArtifactFile(artifact) {