cool-workflow 0.1.87 → 0.1.89

package/scripts/agents/opencode-agent.js

@@ -79,7 +79,7 @@ child.stdout.on("data", (chunk) => {
 child.stderr.setEncoding("utf8");
 child.stderr.on("data", (chunk) => {
   childStderr += chunk;
-  if (process.env.CW_AGENT_STREAM === "1" && process.env.CW_NO_STREAM !== "1" && process.stderr.isTTY) {
+  if (process.env.CW_AGENT_STREAM !== "0" && process.env.CW_NO_STREAM !== "1" && process.stderr.isTTY) {
     process.stderr.write(chunk);
   }
 });

package/scripts/canonical-apps.js

@@ -83,7 +83,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.1.87",
+      "Cool Workflow v0.1.89",
       "--freshness",
       "as of release preparation"
     ]
@@ -117,14 +117,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.1.87");
+    assert.equal(summary.version, "0.1.89");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.1.87");
+    assert.equal(shown.app.version, "0.1.89");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -135,7 +135,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.1.87");
+    assert.equal(state.workflow.app.version, "0.1.89");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);

package/scripts/coverage-gate.js

@@ -25,7 +25,7 @@
 //
 // Usage: node scripts/coverage-gate.js [--min 80] [--concurrency <n|auto>]
 
-const { spawn } = require("node:child_process");
+const { spawn, spawnSync } = require("node:child_process");
 const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
@@ -50,11 +50,25 @@ if (!Number.isFinite(floor) || floor < 0 || floor > 100) {
 
 const covDir = fs.mkdtempSync(path.join(os.tmpdir(), "cw-coverage-"));
 
+// Pre-check: ensure dist/ is built before entering the coverage merge phase
+// (parity with the `test` and `test:ci` package.json scripts).
+{
+  const cli = path.join(packageDir, "dist", "cli.js");
+  const check = spawnSync(process.execPath, [cli, "version"], { cwd: packageDir, stdio: "pipe", encoding: "utf8" });
+  const out = String(check.stdout || "").trim();
+  if (check.status !== 0 || !out) {
+    process.stderr.write(`${SELF}: dist/cli.js version failed (exit ${check.status}) — build may be stale. Run \`npm run build\` first.\n`);
+    process.exit(1);
+  }
+}
+
 function runSuite() {
   return new Promise((resolve) => {
     const args = [path.join(packageDir, "test", "run-all.js")];
     const concurrency = flagValue("--concurrency");
     if (concurrency) args.push("--concurrency", concurrency);
+    const sample = flagValue("--sample");
+    if (sample) args.push("--sample", sample);
     const child = spawn(process.execPath, args, {
       cwd: packageDir,
       stdio: "inherit",

package/scripts/dogfood-release.js

@@ -6,7 +6,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { CoolWorkflowRunner } = require("../dist/orchestrator.js");
 
-const TARGET_VERSION = "0.1.87";
+const TARGET_VERSION = "0.1.89";
 const PREVIOUS_VERSION = "0.1.31";
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");

package/scripts/golden-path.js

@@ -33,7 +33,7 @@ function main() {
     const appValidation = runJson(["app", "validate", "end-to-end-golden-path"], pluginRoot);
     assert.equal(appValidation.valid, true);
     assert.equal(appValidation.summary.id, "end-to-end-golden-path");
-    assert.equal(appValidation.summary.version, "0.1.87");
+    assert.equal(appValidation.summary.version, "0.1.89");
 
     const plan = runJson(
       [
@@ -42,7 +42,7 @@ function main() {
         "--repo",
         tmp,
         "--question",
-        "Prove the deterministic v0.1.87 end-to-end golden path."
+        "Prove the deterministic v0.1.89 end-to-end golden path."
       ],
       pluginRoot
     );
@@ -52,7 +52,7 @@ function main() {
 
     let state = readJson(plan.statePath);
     assert.equal(state.workflow.app.id, "end-to-end-golden-path");
-    assert.equal(state.workflow.app.version, "0.1.87");
+    assert.equal(state.workflow.app.version, "0.1.89");
     assert.equal(state.loopStage, "interpret");
 
     const dispatch = runJson(["dispatch", plan.runId, "--limit", "1", "--sandbox", "readonly"], tmp);
@@ -195,7 +195,7 @@ function main() {
     assert.equal(reportPath, plan.reportPath);
     assert.ok(fs.existsSync(reportPath));
     const report = fs.readFileSync(reportPath, "utf8");
-    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.87/);
+    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.89/);
     assert.match(report, /## Candidates/);
     assert.match(report, /## Trust Audit/);
     assert.match(report, /## Acceptance Rationale/);

package/scripts/release-flow.js

@@ -25,6 +25,12 @@
 //                                                  --soft for best-effort (skip-not-fail).
 // Flags also accepted: --prev-tag <t>, --agent-command "...", --agent-model m, --dry-run
 //
+// VERDICT CONTRACT (auto-generated by --cut, never write by hand):
+//   Path:  .cw-release/review-<FULLSHA>.verdict
+//   First line:  "APPROVED <FULLSHA>"
+//   Both release-flow.js --cut and CI's release-gate.yml verify this exact path and
+//   format. The file MUST be committed to the tag's history.
+//
 // Test seams (smoke/operator only, never the delegated agent):
 //   CW_RELEASE_FLOW_GATE_CMD  overrides the deterministic gate command
 //     (default: `bash <thisdir>/release-gate.sh`) so the smoke can exercise the
@@ -153,6 +159,32 @@ function substitute(arg, map) {
   return arg.replace(/\{\{(\w+)\}\}/g, (m, k) => (k in map ? String(map[k]) : m));
 }
 
+/** Extract verdict lines from agent stdout. Returns the verdict text (first line
+ *  must be APPROVED <sha> or REJECTED) or null if no valid verdict found.
+ *  Also logs failures to stderr so the operator can inspect. */
+function extractVerdictFromStdout(stdout, resultPath) {
+  const lines = stdout.split(/\r?\n/);
+  const approvedLine = lines.find((line) => /^APPROVED\s+\S+/.test(line.trim()));
+  if (approvedLine) {
+    const idx = lines.indexOf(approvedLine);
+    // Include the APPROVED line and any capability line that follows.
+    const capLine = (lines[idx + 1] || "").trim();
+    const verdict = capLine && !capLine.startsWith("#") && !/^(APPROVED|REJECTED)\s/.test(capLine)
+      ? [approvedLine.trim(), capLine].join("\n")
+      : approvedLine.trim();
+    say(`reviewer verdict captured from stdout → ${resultPath}`);
+    return verdict;
+  }
+  const rejectedLine = lines.find((line) => /^REJECTED/i.test(line.trim()));
+  if (rejectedLine) {
+    process.stderr.write(`reviewer REJECTED via stdout — full output:\n${stdout.trim()}\n`);
+    return rejectedLine.trim();
+  }
+  // Partial: print the last 20 lines to help the operator diagnose.
+  process.stderr.write(`reviewer stdout had no APPROVED/REJECTED line. Last 20 lines:\n${lines.slice(-20).join("\n").trim()}\n`);
+  return null;
+}
+
 function delegateReview(resultPath, inputPath) {
   // Reuse the canonical agent-config resolver (flags > env > file).
   let resolveAgentConfig;
@@ -188,16 +220,31 @@ function delegateReview(resultPath, inputPath) {
     say(`[2/3] reviewer — delegating to: ${cfg.command} ${(cfg.args || []).join(" ")} (model: ${cfg.model || "unreported"})`);
     // RED LINE: argv-style, shell:false. The agent runs the model in its own
     // process and inherits its own credentials; CW holds none.
+    // Capture stdout so agents that print verdicts (rather than writing the
+    // result file) are supported. Agents that DO write the file still work:
+    // the file takes precedence. stderr goes to the terminal for live output.
     const r = spawnSync(cfg.command, args, {
       cwd: repoRoot,
       env: { ...process.env },
       encoding: "utf8",
       timeout: cfg.timeoutMs || 600000,
       shell: false,
-      stdio: "inherit"
+      stdio: ["ignore", "pipe", "inherit"],
+      maxBuffer: 32 * 1024 * 1024
     });
     if (r.status !== 0) die(`reviewer agent exited ${r.status === null ? "(timeout/no-exit)" : r.status} — no verdict trusted.`);
-    return;
+    // If the agent already wrote the verdict file (backward compat), use it.
+    // Otherwise extract the verdict from stdout (headless agent path).
+    if (fs.existsSync(resultPath)) return;
+    const stdout = String(r.stdout || "").trim();
+    if (stdout) {
+      const verdictLines = extractVerdictFromStdout(stdout, resultPath);
+      if (verdictLines) {
+        fs.writeFileSync(resultPath, `${verdictLines}\n`);
+        return;
+      }
+    }
+    die("reviewer agent produced no verdict — stdout had no APPROVED <sha> or REJECTED line, and no verdict file was written. Ensure the agent writes the verdict to {{result}} or prints the verdict lines to stdout.");
   }
 
   // Endpoint mode (e.g. DeepSeek HTTP): POST the prompt, write the response as

package/scripts/release-gate.sh

@@ -51,7 +51,7 @@ if [[ -n "$PREV_TAG" ]]; then
   TESTS_CHANGED=$(git diff --name-only "$RANGE" | grep -cE '\.(test|spec)\.|/tests?/' || true)
   [[ "$TESTS_CHANGED" -gt 0 ]] || fail "zero test changes since $PREV_TAG"
 
-  # --- 4. Cadence: >=4 cycles logged OR >=24h since previous tag -------
+  # --- 4. Cadence: >=4 cycles logged OR >=24h since previous tag, or a recorded HOTFIX ---
   say "[5/6] cadence"
   CYCLES=0
   if [[ -f ITERATION_LOG.md && -n "$PREV_TAG" ]]; then
@@ -60,8 +60,17 @@ if [[ -n "$PREV_TAG" ]]; then
   PREV_TS=$(git log -1 --format=%ct "$PREV_TAG")
   NOW_TS=$(date +%s)
   HOURS=$(( (NOW_TS - PREV_TS) / 3600 ))
+  # Hotfix path: an urgent fix may ship inside the cadence window, but ONLY via an
+  # EXPLICIT, RECORDED declaration — a "HOTFIX:" line added to ITERATION_LOG.md in this
+  # release range, carrying a reason. It is committed (auditable in the tag's history)
+  # and echoed here, so the bypass is never silent and a reviewer sees the reason.
+  HOTFIX="$(git diff "$RANGE" -- ITERATION_LOG.md | grep -E '^\+.*HOTFIX:' | head -1 | sed -E 's/^\+[[:space:]]*//' || true)"
   if [[ "$CYCLES" -lt 4 && "$HOURS" -lt 24 ]]; then
-    fail "cadence: only $CYCLES cycles logged and ${HOURS}h since $PREV_TAG (need >=4 cycles or >=24h)"
+    if [[ -n "$HOTFIX" ]]; then
+      say "  cadence bypassed by recorded HOTFIX (${HOURS}h, ${CYCLES} cycle-lines): ${HOTFIX}"
+    else
+      fail "cadence: only $CYCLES cycles logged and ${HOURS}h since $PREV_TAG (need >=4 cycles, >=24h, or a recorded 'HOTFIX:' line in ITERATION_LOG.md)"
+    fi
   fi
 else
   say "[3-5/6] no previous tag; substance/evidence/cadence checks skipped"

package/tsconfig.json

@@ -8,7 +8,9 @@
     "strict": true,
     "esModuleInterop": true,
     "forceConsistentCasingInFileNames": true,
-    "skipLibCheck": true
+    "skipLibCheck": true,
+    "incremental": true,
+    "tsBuildInfoFile": ".cache/tsconfig.tsbuildinfo"
   },
   "include": [
     "src/**/*.ts"