cool-workflow 0.1.86 → 0.1.88

package/scripts/agents/gemini-agent.js

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+"use strict";
+
+// gemini-agent.js - Gemini CLI adapter for CW Agent Delegation Drive.
+//
+// This is a CONFIG wrapper, not a CW runtime dependency. CW spawns this script
+// out-of-process; this script spawns `gemini -p` out-of-process. Vendor NDJSON
+// parsing stays here in userland policy.
+//
+// Contract:
+//   argv[2] = {{input}}   worker input.md
+//   argv[3] = {{result}}  worker result.md to persist
+//
+// stdout: one JSON object { model, usage, result } for CW provenance.
+// stderr: optional live trace when CW_AGENT_STREAM=1 and attached to a TTY.
+
+const { spawn } = require("node:child_process");
+const {
+  buildPrompt,
+  emitReport,
+  flushJsonLines,
+  parseJsonLines,
+  trace,
+  writeResult
+} = require("./agent-adapter-core");
+
+const inputPath = process.argv[2];
+const resultPath = process.argv[3];
+if (!inputPath || !resultPath) {
+  process.stderr.write("usage: gemini-agent.js <inputPath> <resultPath>  (CW substitutes {{input}} {{result}})\n");
+  process.exit(2);
+}
+
+const prompt = buildPrompt(inputPath);
+const state = { provider: "gemini", buffer: "", model: undefined, usage: undefined, textFragments: [], finalResult: undefined };
+let childStderr = "";
+function recordJsonLine(line) {
+  let ev;
+  try {
+    ev = JSON.parse(line);
+  } catch {
+    state.invalidJson = true;
+    return;
+  }
+  // Prefer the final result event text; delta events are incremental fallback.
+  if (ev.result && typeof ev.result === "string") {
+    state.finalResult = ev.result;
+  } else {
+    const text = typeof ev.text === "string" ? ev.text : (ev.delta ? (typeof ev.delta === "string" ? ev.delta : ev.delta.text) : undefined);
+    if (typeof text === "string" && text.trim()) state.textFragments.push(text);
+  }
+}
+
+trace("* gemini: reading the repo (read-only)...");
+
+const args = [
+  "-p",
+  prompt,
+  "--output-format",
+  "stream-json",
+  "--approval-mode",
+  "plan"
+];
+
+const child = spawn("gemini", args, {
+  stdio: ["ignore", "pipe", "pipe"],
+  shell: false
+});
+
+child.stdout.setEncoding("utf8");
+child.stdout.on("data", (chunk) => {
+  parseJsonLines("gemini", chunk, state, recordJsonLine);
+});
+
+child.stderr.setEncoding("utf8");
+child.stderr.on("data", (chunk) => {
+  childStderr += chunk;
+  if (process.env.CW_AGENT_STREAM !== "0" && process.env.CW_NO_STREAM !== "1" && process.stderr.isTTY) {
+    process.stderr.write(chunk);
+  }
+});
+
+child.on("error", (error) => {
+  process.stderr.write(`gemini spawn failed: ${error.message}\n`);
+  process.exit(1);
+});
+
+child.on("close", (code) => {
+  flushJsonLines("gemini", state, recordJsonLine);
+  if (code !== 0) {
+    const detail = childStderr.trim() || `gemini exited ${code === null ? "(timeout/killed)" : code}`;
+    process.stderr.write(`${detail}\n`);
+    process.exit(code === null ? 1 : code);
+  }
+  if (state.invalidJson) {
+    process.stderr.write("gemini --output-format stream-json produced a non-JSONL stdout line - refusing to trust the result\n");
+    process.exit(1);
+  }
+
+  const resultText = state.finalResult || state.textFragments.join("\n\n");
+  if (!resultText.trim()) {
+    process.stderr.write("gemini produced no result text - refusing to fabricate a result\n");
+    process.exit(1);
+  }
+
+  try {
+    writeResult(resultPath, resultText);
+  } catch (error) {
+    process.stderr.write(`gemini produced no final result: ${error.message}\n`);
+    process.exit(1);
+  }
+
+  trace("* done - result captured");
+  emitReport(state.model, state.usage, resultText);
+});

package/scripts/agents/opencode-agent.js

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+"use strict";
+
+// opencode-agent.js - OpenCode CLI adapter for CW Agent Delegation Drive.
+//
+// This is a CONFIG wrapper, not a CW runtime dependency. CW spawns this script
+// out-of-process; this script spawns `opencode run` out-of-process. Vendor JSONL
+// parsing stays here in userland policy.
+//
+// Contract:
+//   argv[2] = {{input}}   worker input.md
+//   argv[3] = {{result}}  worker result.md to persist
+//
+// stdout: one JSON object { model, usage, result } for CW provenance.
+// stderr: optional live trace when CW_AGENT_STREAM=1 and attached to a TTY.
+//
+// NOTE: --dangerously-skip-permissions is used because OpenCode lacks a native
+// --read-only or --allowed-tools flag. CW's sandbox layer enforces write safety
+// via execution-backend boundary controls. If OpenCode adds a cleaner read-only
+// flag, prefer that here.
+
+const { spawn } = require("node:child_process");
+const {
+  buildPrompt,
+  emitReport,
+  flushJsonLines,
+  parseJsonLines,
+  trace,
+  writeResult
+} = require("./agent-adapter-core");
+
+const inputPath = process.argv[2];
+const resultPath = process.argv[3];
+if (!inputPath || !resultPath) {
+  process.stderr.write("usage: opencode-agent.js <inputPath> <resultPath>  (CW substitutes {{input}} {{result}})\n");
+  process.exit(2);
+}
+
+const prompt = buildPrompt(inputPath);
+const state = { provider: "opencode", buffer: "", model: undefined, usage: undefined, textFragments: [], finalResult: undefined };
+let childStderr = "";
+function recordJsonLine(line) {
+  let ev;
+  try {
+    ev = JSON.parse(line);
+  } catch {
+    state.invalidJson = true;
+    return;
+  }
+  if (ev.result && typeof ev.result === "string") {
+    state.finalResult = ev.result;
+  } else {
+    const text = typeof ev.text === "string" ? ev.text : (ev.delta ? (typeof ev.delta === "string" ? ev.delta : ev.delta.text) : undefined);
+    if (typeof text === "string" && text.trim()) state.textFragments.push(text);
+  }
+}
+
+trace("* opencode: reading the repo...");
+
+const args = [
+  "run",
+  "--format",
+  "json",
+  "--dangerously-skip-permissions",
+  "--prompt",
+  prompt
+];
+
+const child = spawn("opencode", args, {
+  stdio: ["ignore", "pipe", "pipe"],
+  shell: false
+});
+
+child.stdout.setEncoding("utf8");
+child.stdout.on("data", (chunk) => {
+  parseJsonLines("opencode", chunk, state, recordJsonLine);
+});
+
+child.stderr.setEncoding("utf8");
+child.stderr.on("data", (chunk) => {
+  childStderr += chunk;
+  if (process.env.CW_AGENT_STREAM !== "0" && process.env.CW_NO_STREAM !== "1" && process.stderr.isTTY) {
+    process.stderr.write(chunk);
+  }
+});
+
+child.on("error", (error) => {
+  process.stderr.write(`opencode spawn failed: ${error.message}\n`);
+  process.exit(1);
+});
+
+child.on("close", (code) => {
+  flushJsonLines("opencode", state, recordJsonLine);
+  if (code !== 0) {
+    const detail = childStderr.trim() || `opencode exited ${code === null ? "(timeout/killed)" : code}`;
+    process.stderr.write(`${detail}\n`);
+    process.exit(code === null ? 1 : code);
+  }
+  if (state.invalidJson) {
+    process.stderr.write("opencode --format json produced a non-JSONL stdout line - refusing to trust the result\n");
+    process.exit(1);
+  }
+
+  const resultText = state.finalResult || state.textFragments.join("\n\n");
+  if (!resultText.trim()) {
+    process.stderr.write("opencode produced no result text - refusing to fabricate a result\n");
+    process.exit(1);
+  }
+
+  try {
+    writeResult(resultPath, resultText);
+  } catch (error) {
+    process.stderr.write(`opencode produced no final result: ${error.message}\n`);
+    process.exit(1);
+  }
+
+  trace("* done - result captured");
+  emitReport(state.model, state.usage, resultText);
+});

package/scripts/canonical-apps.js

@@ -83,7 +83,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.1.86",
+      "Cool Workflow v0.1.88",
       "--freshness",
       "as of release preparation"
     ]
@@ -117,14 +117,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.1.86");
+    assert.equal(summary.version, "0.1.88");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.1.86");
+    assert.equal(shown.app.version, "0.1.88");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -135,7 +135,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.1.86");
+    assert.equal(state.workflow.app.version, "0.1.88");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);

package/scripts/coverage-gate.js

@@ -25,7 +25,7 @@
 //
 // Usage: node scripts/coverage-gate.js [--min 80] [--concurrency <n|auto>]
 
-const { spawn } = require("node:child_process");
+const { spawn, spawnSync } = require("node:child_process");
 const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
@@ -50,11 +50,25 @@ if (!Number.isFinite(floor) || floor < 0 || floor > 100) {
 
 const covDir = fs.mkdtempSync(path.join(os.tmpdir(), "cw-coverage-"));
 
+// Pre-check: ensure dist/ is built before entering the coverage merge phase
+// (parity with the `test` and `test:ci` package.json scripts).
+{
+  const cli = path.join(packageDir, "dist", "cli.js");
+  const check = spawnSync(process.execPath, [cli, "version"], { cwd: packageDir, stdio: "pipe", encoding: "utf8" });
+  const out = String(check.stdout || "").trim();
+  if (check.status !== 0 || !out) {
+    process.stderr.write(`${SELF}: dist/cli.js version failed (exit ${check.status}) — build may be stale. Run \`npm run build\` first.\n`);
+    process.exit(1);
+  }
+}
+
 function runSuite() {
   return new Promise((resolve) => {
     const args = [path.join(packageDir, "test", "run-all.js")];
     const concurrency = flagValue("--concurrency");
     if (concurrency) args.push("--concurrency", concurrency);
+    const sample = flagValue("--sample");
+    if (sample) args.push("--sample", sample);
     const child = spawn(process.execPath, args, {
       cwd: packageDir,
       stdio: "inherit",

package/scripts/dogfood-release.js

@@ -6,7 +6,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { CoolWorkflowRunner } = require("../dist/orchestrator.js");
 
-const TARGET_VERSION = "0.1.86";
+const TARGET_VERSION = "0.1.88";
 const PREVIOUS_VERSION = "0.1.31";
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");

package/scripts/golden-path.js

@@ -33,7 +33,7 @@ function main() {
     const appValidation = runJson(["app", "validate", "end-to-end-golden-path"], pluginRoot);
     assert.equal(appValidation.valid, true);
     assert.equal(appValidation.summary.id, "end-to-end-golden-path");
-    assert.equal(appValidation.summary.version, "0.1.86");
+    assert.equal(appValidation.summary.version, "0.1.88");
 
     const plan = runJson(
       [
@@ -42,7 +42,7 @@ function main() {
         "--repo",
         tmp,
         "--question",
-        "Prove the deterministic v0.1.86 end-to-end golden path."
+        "Prove the deterministic v0.1.88 end-to-end golden path."
       ],
       pluginRoot
     );
@@ -52,7 +52,7 @@ function main() {
 
     let state = readJson(plan.statePath);
     assert.equal(state.workflow.app.id, "end-to-end-golden-path");
-    assert.equal(state.workflow.app.version, "0.1.86");
+    assert.equal(state.workflow.app.version, "0.1.88");
     assert.equal(state.loopStage, "interpret");
 
     const dispatch = runJson(["dispatch", plan.runId, "--limit", "1", "--sandbox", "readonly"], tmp);
@@ -195,7 +195,7 @@ function main() {
     assert.equal(reportPath, plan.reportPath);
     assert.ok(fs.existsSync(reportPath));
     const report = fs.readFileSync(reportPath, "utf8");
-    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.86/);
+    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.88/);
     assert.match(report, /## Candidates/);
     assert.match(report, /## Trust Audit/);
     assert.match(report, /## Acceptance Rationale/);

package/scripts/parity-check.js

@@ -74,12 +74,13 @@ function cliDispatchSources() {
 
 function cliHelpTokens() {
   const lines = formatHelp().split(/\r?\n/);
-  const start = lines.indexOf("Commands:");
-  if (start < 0) return [];
   const tokens = new Set();
-  for (const line of lines.slice(start + 1)) {
-    if (!line.trim()) break;
-    const first = line.trim().split(/\s+/)[0];
+  for (const line of lines) {
+    // Command lines start with exactly 2 spaces; examples are 4-space.
+    if (!line.startsWith("  ") || line.startsWith("    ")) continue;
+    const trimmed = line.trim();
+    if (!trimmed || !/^[a-z]/.test(trimmed)) continue;
+    const first = trimmed.split(/\s+/)[0];
     for (const token of first.split("|")) {
       const clean = token.replace(/[<[].*$/, "");
       if (clean) tokens.add(clean);

package/scripts/release-check.js

@@ -60,9 +60,9 @@ const checks = [
   { name: "type check", command: ["npm", "run", "check"] },
   { name: "onramp contract", command: ["npm", "run", "onramp:check"] },
   { name: "run-state schema consistency", command: ["node", "scripts/validate-run-state-schema.js"] },
-  // Parallel suite (test:ci = run-all.js --concurrency auto). Each smoke runs in
-  // a private cwd + state roots (CW_HOME/HOME/TMPDIR), so concurrency is race-free.
-  // The bare `npm test` and the tag-gate (release-gate.sh) stay sequential as the
+  // Every test path uses --concurrency auto by default (parallel, race-free:
+  // each smoke runs in a private cwd + state roots). The release tag-gate
+  // (release-gate.sh) forces CW_TEST_CONCURRENCY=1 to stay sequential as the
   // deterministic backstop.
   { name: "tests", command: ["npm", "run", "test:ci"] },
   { name: "canonical apps", command: ["npm", "run", "canonical-apps"] },

package/scripts/release-flow.js

@@ -25,6 +25,12 @@
 //                                                  --soft for best-effort (skip-not-fail).
 // Flags also accepted: --prev-tag <t>, --agent-command "...", --agent-model m, --dry-run
 //
+// VERDICT CONTRACT (auto-generated by --cut, never write by hand):
+//   Path:  .cw-release/review-<FULLSHA>.verdict
+//   First line:  "APPROVED <FULLSHA>"
+//   Both release-flow.js --cut and CI's release-gate.yml verify this exact path and
+//   format. The file MUST be committed to the tag's history.
+//
 // Test seams (smoke/operator only, never the delegated agent):
 //   CW_RELEASE_FLOW_GATE_CMD  overrides the deterministic gate command
 //     (default: `bash <thisdir>/release-gate.sh`) so the smoke can exercise the
@@ -153,6 +159,32 @@ function substitute(arg, map) {
   return arg.replace(/\{\{(\w+)\}\}/g, (m, k) => (k in map ? String(map[k]) : m));
 }
 
+/** Extract verdict lines from agent stdout. Returns the verdict text (first line
+ *  must be APPROVED <sha> or REJECTED) or null if no valid verdict found.
+ *  Also logs failures to stderr so the operator can inspect. */
+function extractVerdictFromStdout(stdout, resultPath) {
+  const lines = stdout.split(/\r?\n/);
+  const approvedLine = lines.find((line) => /^APPROVED\s+\S+/.test(line.trim()));
+  if (approvedLine) {
+    const idx = lines.indexOf(approvedLine);
+    // Include the APPROVED line and any capability line that follows.
+    const capLine = (lines[idx + 1] || "").trim();
+    const verdict = capLine && !capLine.startsWith("#") && !/^(APPROVED|REJECTED)\s/.test(capLine)
+      ? [approvedLine.trim(), capLine].join("\n")
+      : approvedLine.trim();
+    say(`reviewer verdict captured from stdout → ${resultPath}`);
+    return verdict;
+  }
+  const rejectedLine = lines.find((line) => /^REJECTED/i.test(line.trim()));
+  if (rejectedLine) {
+    process.stderr.write(`reviewer REJECTED via stdout — full output:\n${stdout.trim()}\n`);
+    return rejectedLine.trim();
+  }
+  // Partial: print the last 20 lines to help the operator diagnose.
+  process.stderr.write(`reviewer stdout had no APPROVED/REJECTED line. Last 20 lines:\n${lines.slice(-20).join("\n").trim()}\n`);
+  return null;
+}
+
 function delegateReview(resultPath, inputPath) {
   // Reuse the canonical agent-config resolver (flags > env > file).
   let resolveAgentConfig;
@@ -188,16 +220,31 @@ function delegateReview(resultPath, inputPath) {
     say(`[2/3] reviewer — delegating to: ${cfg.command} ${(cfg.args || []).join(" ")} (model: ${cfg.model || "unreported"})`);
     // RED LINE: argv-style, shell:false. The agent runs the model in its own
     // process and inherits its own credentials; CW holds none.
+    // Capture stdout so agents that print verdicts (rather than writing the
+    // result file) are supported. Agents that DO write the file still work:
+    // the file takes precedence. stderr goes to the terminal for live output.
     const r = spawnSync(cfg.command, args, {
       cwd: repoRoot,
       env: { ...process.env },
       encoding: "utf8",
       timeout: cfg.timeoutMs || 600000,
       shell: false,
-      stdio: "inherit"
+      stdio: ["ignore", "pipe", "inherit"],
+      maxBuffer: 32 * 1024 * 1024
     });
     if (r.status !== 0) die(`reviewer agent exited ${r.status === null ? "(timeout/no-exit)" : r.status} — no verdict trusted.`);
-    return;
+    // If the agent already wrote the verdict file (backward compat), use it.
+    // Otherwise extract the verdict from stdout (headless agent path).
+    if (fs.existsSync(resultPath)) return;
+    const stdout = String(r.stdout || "").trim();
+    if (stdout) {
+      const verdictLines = extractVerdictFromStdout(stdout, resultPath);
+      if (verdictLines) {
+        fs.writeFileSync(resultPath, `${verdictLines}\n`);
+        return;
+      }
+    }
+    die("reviewer agent produced no verdict — stdout had no APPROVED <sha> or REJECTED line, and no verdict file was written. Ensure the agent writes the verdict to {{result}} or prints the verdict lines to stdout.");
   }
 
   // Endpoint mode (e.g. DeepSeek HTTP): POST the prompt, write the response as

package/scripts/release-gate.sh

@@ -30,7 +30,7 @@ say "[1/6] build"
 npm run --prefix plugins/cool-workflow build >/dev/null 2>&1 || fail "build failed"
 
 say "[2/6] tests"
-npm test --prefix plugins/cool-workflow >/dev/null 2>&1 || fail "tests failed"
+CW_TEST_CONCURRENCY=1 npm test --prefix plugins/cool-workflow >/dev/null 2>&1 || fail "tests failed"
 
 if [[ -n "$PREV_TAG" ]]; then
   RANGE="$PREV_TAG..HEAD"

package/tsconfig.json

@@ -8,7 +8,9 @@
     "strict": true,
     "esModuleInterop": true,
     "forceConsistentCasingInFileNames": true,
-    "skipLibCheck": true
+    "skipLibCheck": true,
+    "incremental": true,
+    "tsBuildInfoFile": ".cache/tsconfig.tsbuildinfo"
   },
   "include": [
     "src/**/*.ts"