cool-workflow 0.1.92 → 0.1.94

package/docs/control-plane-scheduling.7.md

@@ -146,4 +146,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/durable-state-and-locking.7.md

@@ -145,4 +145,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/evidence-adoption-reasoning-chain.7.md

@@ -306,4 +306,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/execution-backends.7.md

@@ -336,4 +336,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/mcp-app-surface.7.md

@@ -232,4 +232,16 @@ The CLI is still the easiest way for people to drive a run. MCP is the steady
 tool surface for agent hosts. New runtime powers should come up in both
 surfaces, keep old names as aliases or wrappers, and use clear JSON
 contracts in place of host-specific policy hidden in the bridge.
+
+## Implementation
+
+The app-management surface (`listWorkflows`, `listApps`, `showApp`,
+`validateApp`, `initApp`, `packageApp`) lives on the `CoolWorkflowRunner`
+facade as thin delegators with no logic of their own. Their bodies sit in
+`src/orchestrator/app-operations.ts` as pure functions — the same v0.1.40
+router pattern used by the other `src/orchestrator/*-operations.ts` modules.
+The runner-owned calls (`resolveFromBase`, `validateApp`) are passed in as
+callbacks so the moved bodies stay byte-for-byte the same. The public method
+names, signatures, and return types do not change, so the CLI/MCP parity gate
+stays green.
 0.1.51

package/docs/multi-agent-cli-mcp-surface.7.md

@@ -304,4 +304,6 @@ The host-facing surface tracks the CLI golden-path fixes (`cw -q` routing + repo
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/multi-agent-eval-replay-harness.7.md

@@ -338,4 +338,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/multi-agent-operator-ux.7.md

@@ -350,4 +350,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/node-snapshot-diff-replay.7.md

@@ -171,4 +171,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/observability-cost-accounting.7.md

@@ -230,4 +230,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/project-index.md

@@ -1,15 +1,15 @@
 # Cool Workflow Project Index
 
-Generated from the current repository code on 2026-06-21 by `npm run sync:project-index`.
+Generated from the current repository code on 2026-06-26 by `npm run sync:project-index`.
 
 ## Snapshot
 
 - Package: `cool-workflow`
-- Version: `0.1.92`
+- Version: `0.1.94`
 - Source modules: `68`
 - Workflow apps: `7`
 - Docs: `53`
-- Smoke tests: `139`
+- Smoke tests: `152`
 - Repository: https://github.com/coo1white/cool-workflow
 
 ## Architecture
@@ -196,6 +196,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [agent-delegation-drive-smoke.js](../test/agent-delegation-drive-smoke.js)
 - [append-run-node-no-realloc-smoke.js](../test/append-run-node-no-realloc-smoke.js)
 - [architecture-review-fast-automation-smoke.js](../test/architecture-review-fast-automation-smoke.js)
+- [architecture-review-fast-phase-cache-smoke.js](../test/architecture-review-fast-phase-cache-smoke.js)
 - [architecture-review-fast-smoke.js](../test/architecture-review-fast-smoke.js)
 - [artifact-integrity-smoke.js](../test/artifact-integrity-smoke.js)
 - [audit-verify-smoke.js](../test/audit-verify-smoke.js)
@@ -209,6 +210,12 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [claude-p-agent-wrapper-smoke.js](../test/claude-p-agent-wrapper-smoke.js)
 - [cli-arg-parsing-smoke.js](../test/cli-arg-parsing-smoke.js)
 - [cli-command-surface-smoke.js](../test/cli-command-surface-smoke.js)
+- [cli-format-smoke.js](../test/cli-format-smoke.js)
+- [cli-handler-clones-smoke.js](../test/cli-handler-clones-smoke.js)
+- [cli-handler-eval-node-smoke.js](../test/cli-handler-eval-node-smoke.js)
+- [cli-handler-maintenance-smoke.js](../test/cli-handler-maintenance-smoke.js)
+- [cli-handler-workbench-smoke.js](../test/cli-handler-workbench-smoke.js)
+- [cli-io-smoke.js](../test/cli-io-smoke.js)
 - [cli-jsonmode-parity-smoke.js](../test/cli-jsonmode-parity-smoke.js)
 - [cli-mcp-parity-smoke.js](../test/cli-mcp-parity-smoke.js)
 - [cli-progress-summary-smoke.js](../test/cli-progress-summary-smoke.js)
@@ -222,6 +229,9 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [contract-migration-tooling-smoke.js](../test/contract-migration-tooling-smoke.js)
 - [control-plane-scheduling-smoke.js](../test/control-plane-scheduling-smoke.js)
 - [coordinator-blackboard-smoke.js](../test/coordinator-blackboard-smoke.js)
+- [cw-help-per-command-smoke.js](../test/cw-help-per-command-smoke.js)
+- [dead-export-removal-guard-smoke.js](../test/dead-export-removal-guard-smoke.js)
+- [deepseek-agent-wrapper-smoke.js](../test/deepseek-agent-wrapper-smoke.js)
 - [demo-bundle-smoke.js](../test/demo-bundle-smoke.js)
 - [det-ids-b-smoke.js](../test/det-ids-b-smoke.js)
 - [doctor-smoke.js](../test/doctor-smoke.js)
@@ -239,6 +249,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [execution-backends-smoke.js](../test/execution-backends-smoke.js)
 - [freebsd-audit-fixes-smoke.js](../test/freebsd-audit-fixes-smoke.js)
 - [gemini-agent-wrapper-smoke.js](../test/gemini-agent-wrapper-smoke.js)
+- [gemini-opencode-agent-wrapper-smoke.js](../test/gemini-opencode-agent-wrapper-smoke.js)
 - [h7-custom-profile-persist-smoke.js](../test/h7-custom-profile-persist-smoke.js)
 - [headline-commands-smoke.js](../test/headline-commands-smoke.js)
 - [incremental-resume-smoke.js](../test/incremental-resume-smoke.js)
@@ -301,6 +312,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [run-import-tamper-failclosed-smoke.js](../test/run-import-tamper-failclosed-smoke.js)
 - [run-inspect-archive-smoke.js](../test/run-inspect-archive-smoke.js)
 - [run-registry-control-plane-smoke.js](../test/run-registry-control-plane-smoke.js)
+- [run-restore-failclosed-smoke.js](../test/run-restore-failclosed-smoke.js)
 - [run-resume-drive-smoke.js](../test/run-resume-drive-smoke.js)
 - [run-retention-reclamation-smoke.js](../test/run-retention-reclamation-smoke.js)
 - [sample-determinism-smoke.js](../test/sample-determinism-smoke.js)
@@ -325,6 +337,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [telemetry-verify-signatures-smoke.js](../test/telemetry-verify-signatures-smoke.js)
 - [token-budget-enforcement-smoke.js](../test/token-budget-enforcement-smoke.js)
 - [vendor-manifest-load-smoke.js](../test/vendor-manifest-load-smoke.js)
+- [vendor-preflight-smoke.js](../test/vendor-preflight-smoke.js)
 - [verifier-gated-commit-smoke.js](../test/verifier-gated-commit-smoke.js)
 - [verify-import-audit-chain-smoke.js](../test/verify-import-audit-chain-smoke.js)
 - [web-desktop-workbench-smoke.js](../test/web-desktop-workbench-smoke.js)

package/docs/real-execution-backends.7.md

@@ -178,4 +178,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/release-and-migration.7.md

@@ -318,4 +318,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/release-tooling.7.md

@@ -265,4 +265,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/run-registry-control-plane.7.md

@@ -216,9 +216,30 @@ before importing a bad archive. It is a true preview of import: under
 turn away) also inspects as `ok:false`; with the env unset (default) an absent integrity
 block is only reported, not failed.
 
+**Restore in one fail-closed step.** `run restore PATH --target DIR [--json]`
+does the whole move-a-run-to-another-machine flow as ONE atomic, fail-closed
+step: it integrity-**inspects** the bundle first (writing nothing), **imports**
+it, then reuses the verification `import` already ran — and reports `ok:true`
+ONLY when that verify passes. This closes a real gap: `run import` runs a
+verification (it re-proves restored file digests, the **telemetry ledger**, and
+the **trust-audit hash chain**) and reports it, but does NOT fail on it — it
+exits `0` even when that chain does not verify. So a run whose telemetry or
+trust-audit chain was tampered (yet whose file digests are intact) imports with a
+made-up success. `run restore` refuses exactly that: it fails closed on the same
+verification `import` only reports. A bundle that fails the up-front integrity
+inspect is refused **before any import**, so nothing is written and the run is
+never left part-restored; the result carries `imported:null` and `verify:null`.
+A bundle that imports but fails post-import verification is reported with
+`ok:false` too. It exits `1` whenever `ok:false`, so `cw run restore <path>` is a
+single command that either lands a fully-proven run or refuses with a non-zero
+exit — never a made-up success. The result is structured
+(`{ schemaVersion, ok, target, inspect, imported, verify, registry }`) so it is
+scriptable. `run import` and `run inspect-archive` are unchanged; restore is a
+thin composition of `inspectArchive` + `importRun` (reusing its verification).
+
 MCP gives the same mechanisms as `cw_run_export`, `cw_run_import`,
-`cw_run_verify_import`, and `cw_run_inspect_archive`; the CLI and MCP paths share
-the same runtime functions.
+`cw_run_verify_import`, `cw_run_inspect_archive`, and `cw_run_restore`; the CLI
+and MCP paths share the same runtime functions.
 
 ## Cross-repo history
 
@@ -243,6 +264,7 @@ node scripts/cw.js run export <run-id> --output PATH
 node scripts/cw.js run import PATH --target DIR
 node scripts/cw.js run verify-import <run-id> [--cwd DIR]
 node scripts/cw.js run inspect-archive PATH [--json]
+node scripts/cw.js run restore PATH --target DIR [--json]
 node scripts/cw.js queue add [--app ID|--workflow ID|--runId ID] [--repo PATH] [--priority N] [--note TEXT]
 node scripts/cw.js queue list [--status STATE] [--repo PATH] [--json]
 node scripts/cw.js queue show <queue-id>
@@ -439,4 +461,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/run-retention-reclamation.7.md

@@ -229,4 +229,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/state-explosion-management.7.md

@@ -307,4 +307,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/team-collaboration.7.md

@@ -243,4 +243,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/docs/web-desktop-workbench.7.md

@@ -251,4 +251,6 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 
 0.1.91
 
-0.1.92
+0.1.93
+
+0.1.94

package/manifest/plugin.manifest.json

@@ -2,7 +2,7 @@
   "_comment": "SINGLE SOURCE OF TRUTH for every vendor manifest. Edit THIS file, then run `npm run gen:manifests`. Do NOT hand-edit the generated vendor manifests (.claude-plugin/, .codex-plugin/, .agents/, .mcp.json) — `npm run gen:manifests -- --check` (run by release:check) will fail if they drift from this source.",
   "identity": {
     "name": "cool-workflow",
-    "version": "0.1.92",
+    "version": "0.1.94",
     "license": "BSD-2-Clause",
     "homepage": "https://github.com/coo1white/cool-workflow",
     "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.92",
+  "version": "0.1.94",
   "bin": {
     "cool-workflow": "scripts/cw.js",
     "cw": "scripts/cw.js"

package/scripts/agents/builtin-templates.json

@@ -4,8 +4,9 @@
   "templates": {
     "claude": "claude-p-agent.js",
     "codex": "codex-agent.js",
-    "gemini": "gemini-agent.js",
+    "gemini": "gemini-opencode-agent.js",
+    "gemini-cli": "gemini-agent.js",
     "opencode": "opencode-agent.js",
-    "deepseek": "opencode-agent.js"
+    "deepseek": "deepseek-agent.js"
   }
 }

package/scripts/agents/claude-p-agent.js

@@ -12,12 +12,12 @@
 // worker's result.md ({{result}}), and forward claude's JSON on STDOUT so CW
 // records the agent-reported provenance.
 //
-// LIVE OUTPUT (Unix discipline): default output is the legacy `--output-format
-// json` contract, forwarded verbatim on stdout. Set CW_AGENT_STREAM=1 to opt in
-// to claude `stream-json`; only then does this wrapper render a human-readable
-// trace to stderr, and only when stderr is a TTY. Diagnostics stay off stdout,
-// and vendor-specific stream parsing lives HERE in the wrapper (policy), not in
-// CW's core (which only forwards, never parses).
+// LIVE OUTPUT (Unix discipline): the DEFAULT is claude `stream-json` — this
+// wrapper renders a human-readable trace to stderr (only when stderr is a TTY).
+// Set CW_AGENT_STREAM=0 (or CW_NO_STREAM=1) to fall back to the legacy
+// `--output-format json` contract, forwarded verbatim on stdout. Either way
+// diagnostics stay off stdout, and vendor-specific stream parsing lives HERE in
+// the wrapper (policy), not in CW's core (which only forwards, never parses).
 //
 // READ-ONLY by design: claude gets NO Write tool; the architecture-review app
 // declares the `readonly` sandbox profile. This wrapper (the transport) writes

package/scripts/agents/codex-agent.js

@@ -16,6 +16,7 @@
 // stderr: optional live trace when CW_AGENT_STREAM=1 and attached to a TTY.
 
 const fs = require("node:fs");
+const os = require("node:os");
 const path = require("node:path");
 const { spawn } = require("node:child_process");
 const {
@@ -27,6 +28,21 @@ const {
   writeResult
 } = require("./agent-adapter-core");
 
+// codex exec --json (>=0.139) emits NO model field in its JSONL (only thread/turn
+// events + usage). For provenance, fall back to the model codex is configured to
+// use: $CODEX_HOME/config.toml (or ~/.codex/config.toml), key `model`. Best effort
+// — a stream model field (older/newer codex) still wins.
+function detectCodexModel() {
+  try {
+    const home = process.env.CODEX_HOME || path.join(os.homedir(), ".codex");
+    const cfg = fs.readFileSync(path.join(home, "config.toml"), "utf8");
+    const m = cfg.match(/^\s*model\s*=\s*["']([^"']+)["']/m);
+    return m ? m[1] : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 const inputPath = process.argv[2];
 const resultPath = process.argv[3];
 if (!inputPath || !resultPath) {
@@ -65,8 +81,6 @@ const args = [
   finalPath,
   "--sandbox",
   "read-only",
-  "--ask-for-approval",
-  "never",
   "--color",
   "never",
   "-"
@@ -133,5 +147,5 @@ child.on("close", (code) => {
     process.exit(1);
   }
 
-  emitReport(state.model, state.usage, resultText);
+  emitReport(state.model || detectCodexModel(), state.usage, resultText);
 });

package/scripts/agents/deepseek-agent.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+"use strict";
+
+// deepseek-agent.js - DeepSeek (via opencode) adapter for CW Agent Delegation Drive.
+//
+// DeepSeek ships no standalone CLI here; CW reaches it through
+// `opencode run --model deepseek/...`. This is a thin variant of the opencode
+// runner: it sets the variant env (display label + model) and delegates to
+// opencode-agent.js, so the run/parse/provenance logic lives in ONE place.
+//
+// Override the model with CW_DEEPSEEK_MODEL (default deepseek/deepseek-chat).
+// Requires opencode installed AND a DeepSeek provider configured in opencode
+// (`opencode auth login` or DEEPSEEK_API_KEY). Without that, opencode exits
+// nonzero and CW fails closed - it never fabricates a result.
+//
+// Contract (unchanged from opencode-agent.js):
+//   argv[2] = {{input}}   worker input.md
+//   argv[3] = {{result}}  worker result.md to persist
+
+process.env.CW_OPENCODE_LABEL = "deepseek";
+process.env.CW_OPENCODE_MODEL = process.env.CW_DEEPSEEK_MODEL || "deepseek/deepseek-chat";
+
+require("./opencode-agent.js");

package/scripts/agents/gemini-opencode-agent.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+"use strict";
+
+// gemini-opencode-agent.js - Gemini (via opencode) adapter for CW Agent Delegation.
+//
+// Reaches Gemini through `opencode run --model google/...`, the same gateway CW
+// uses for DeepSeek. Use this when the Gemini key lives in opencode (provider
+// "google") rather than the standalone `gemini` CLI. The native Gemini CLI path
+// is still available as builtin:gemini-cli (scripts/agents/gemini-agent.js).
+//
+// Thin variant of the opencode runner: it sets the variant env (display label +
+// model) and delegates to opencode-agent.js, so run/parse/provenance live in ONE
+// place. Override the model with CW_GEMINI_MODEL (default google/gemini-3.5-flash).
+// Requires opencode installed AND a "google" provider authed in opencode
+// (`opencode auth login` -> google). Without it, opencode exits nonzero and CW
+// fails closed - it never fabricates a result.
+//
+// Contract (unchanged from opencode-agent.js):
+//   argv[2] = {{input}}   worker input.md
+//   argv[3] = {{result}}  worker result.md to persist
+
+process.env.CW_OPENCODE_LABEL = "gemini";
+process.env.CW_OPENCODE_MODEL = process.env.CW_GEMINI_MODEL || "google/gemini-3.5-flash";
+
+require("./opencode-agent.js");

package/scripts/agents/opencode-agent.js

@@ -37,11 +37,35 @@ if (!inputPath || !resultPath) {
   process.exit(2);
 }
 
+// Same runner serves both `opencode` (provider default model) and `deepseek`
+// (DeepSeek via opencode). The variant sets CW_OPENCODE_LABEL + CW_OPENCODE_MODEL;
+// see deepseek-agent.js. Unset = plain opencode, unchanged behavior.
+const label = process.env.CW_OPENCODE_LABEL || "opencode";
+const requestedModel = process.env.CW_OPENCODE_MODEL || "";
+
 const prompt = buildPrompt(inputPath);
-const render = createRenderer({ env: process.env, stderr: process.stderr, label: "opencode" });
+const render = createRenderer({ env: process.env, stderr: process.stderr, label });
 const transcriptPath = path.join(path.dirname(resultPath), "transcript.md");
-const state = { provider: "opencode", buffer: "", model: undefined, usage: undefined, textFragments: [], finalResult: undefined, renderer: render };
+const state = {
+  provider: label,
+  buffer: "",
+  // opencode --format json carries NO model field; record the model we asked for.
+  model: requestedModel || undefined,
+  usage: undefined,
+  textFragments: [],
+  finalResult: undefined,
+  lastMessageId: undefined,
+  lastMessageText: "",
+  renderer: render
+};
 let childStderr = "";
+
+// opencode (>=1.x) --format json emits JSONL events of shape { type, part }:
+//   type:"text"        -> part.text         assistant text, grouped by part.messageID
+//   type:"step_finish" -> part.tokens       { input, output, ... } per step
+// The final answer is the LAST message's text (earlier "text" parts are mid-run
+// narration). Older opencode shapes (ev.result / ev.text / ev.delta) are still
+// accepted as a fallback so the wrapper is not pinned to one CLI version.
 function recordJsonLine(line) {
   let ev;
   try {
@@ -50,22 +74,47 @@ function recordJsonLine(line) {
     state.invalidJson = true;
     return;
   }
+  const part = ev && typeof ev.part === "object" && ev.part ? ev.part : {};
+
+  if (ev.type === "text" && typeof part.text === "string") {
+    const mid = typeof part.messageID === "string" ? part.messageID : "";
+    if (mid !== state.lastMessageId) {
+      state.lastMessageId = mid;
+      state.lastMessageText = "";
+    }
+    state.lastMessageText += (state.lastMessageText ? "\n" : "") + part.text;
+    if (part.text.trim()) state.textFragments.push(part.text);
+    return;
+  }
+
+  if (ev.type === "step_finish" && part.tokens && typeof part.tokens === "object") {
+    state.usage = state.usage || { input_tokens: 0, output_tokens: 0 };
+    state.usage.input_tokens += Number(part.tokens.input) || 0;
+    state.usage.output_tokens += Number(part.tokens.output) || 0;
+    return;
+  }
+
+  // Fallback: older opencode JSON shapes (single result object / delta stream).
   if (ev.result && typeof ev.result === "string") {
     state.finalResult = ev.result;
-  } else {
-    const text = typeof ev.text === "string" ? ev.text : (ev.delta ? (typeof ev.delta === "string" ? ev.delta : ev.delta.text) : undefined);
-    if (typeof text === "string" && text.trim()) state.textFragments.push(text);
+    return;
   }
+  const legacy = typeof ev.text === "string" ? ev.text : (ev.delta ? (typeof ev.delta === "string" ? ev.delta : ev.delta.text) : undefined);
+  if (typeof legacy === "string" && legacy.trim()) state.textFragments.push(legacy);
 }
 
-render.action("opencode: reading the repo…");
+render.action(`${label}: reading the repo…`);
 
+// `opencode run` takes the message as a POSITIONAL arg ("opencode run [message..]");
+// there is no --prompt flag. Pass the prompt last, as the positional message.
+// --model (provider/model, e.g. deepseek/deepseek-chat) is added only when a
+// variant requests it; otherwise opencode uses its configured default model.
 const args = [
   "run",
   "--format",
   "json",
   "--dangerously-skip-permissions",
-  "--prompt",
+  ...(requestedModel ? ["--model", requestedModel] : []),
   prompt
 ];
 
@@ -105,7 +154,7 @@ child.on("close", (code) => {
     process.exit(1);
   }
 
-  const resultText = state.finalResult || state.textFragments.join("\n\n");
+  const resultText = state.finalResult || state.lastMessageText || state.textFragments.join("\n\n");
   if (!resultText.trim()) {
     process.stderr.write("opencode produced no result text - refusing to fabricate a result\n");
     process.exit(1);

package/scripts/architecture-review-fast.js

@@ -38,13 +38,20 @@ function main() {
   const fastModel = stringArg(args.fastModel || args["fast-model"]);
   const strongModel = stringArg(args.strongModel || args["strong-model"]);
   const modelEnv = modelPolicyEnv(fastModel, strongModel);
+  // Opt-in incremental overlay: scope the exported source context to files
+  // changed since REF (e.g. origin/main). The source-context export resolves
+  // the ref, keys its cache separately, and records the base. The fast review
+  // then runs over the narrower context; the scheduled full review stays a
+  // complete audit (see scheduleFullReview).
+  const changedFrom = stringArg(args.changedFrom || args["changed-from"]);
 
   const contextExport = timed(() => exportSourceContext({
     repo,
     profile,
     ref,
     profileFile,
-    cacheDir
+    cacheDir,
+    changedFrom
   }));
   const contextText = contextExport.value;
   assertNonEmptySourceContext(contextText, profile, repo);
@@ -87,7 +94,8 @@ function main() {
     digest,
     profile,
     ref,
-    cacheDir
+    cacheDir,
+    ...(changedFrom ? { changedFrom } : {})
   };
   const fullReviewScheduleRun = truthy(args.scheduleFull || args["schedule-full"])
     ? timed(() => scheduleFullReview(repo, question, args, fastReview, sourceContextMeta))
@@ -101,7 +109,7 @@ function main() {
     fastReview,
     ...(fastModel || strongModel ? { modelPolicy: { ...(fastModel ? { fastModel } : {}), ...(strongModel ? { strongModel } : {}) } } : {}),
     ...(fullReviewSchedule ? { fullReviewSchedule } : {}),
-    ...(includeMetrics ? { metrics: buildMetrics(started, contextText, contextExport.elapsedMs, fastReview, fastReviewRun.elapsedMs, fullReviewScheduleRun?.elapsedMs) } : {})
+    ...(includeMetrics ? { metrics: buildMetrics(started, contextText, contextExport.elapsedMs, fastReview, fastReviewRun.elapsedMs, fullReviewScheduleRun?.elapsedMs, changedFrom) } : {})
   });
 }
 
@@ -119,6 +127,7 @@ function exportSourceContext(options) {
     options.cacheDir
   ];
   if (options.profileFile) argv.push("--profile-file", path.resolve(options.profileFile));
+  if (options.changedFrom) argv.push("--changed-from", options.changedFrom);
   const result = spawnSync(node, argv, {
     cwd: repoRoot,
     encoding: "utf8",
@@ -194,6 +203,9 @@ function scheduleFullReview(repo, question, args, fastReview, sourceContextMeta)
     fastReview?.reportPath ? `Fast review report: ${fastReview.reportPath}.` : "",
     `Fast review status: ${fastReview?.status || "unknown"} (${fastReview?.completedWorkers || 0}/${fastReview?.plannedWorkers || 0} workers completed).`,
     `Source context: ${sourceContextMeta.path} (${sourceContextMeta.digest}, profile ${sourceContextMeta.profile}, ref ${sourceContextMeta.ref}).`,
+    sourceContextMeta.changedFrom
+      ? `Fast review used an incremental overlay (changed-from ${sourceContextMeta.changedFrom}); this full review must audit the complete source, not only the changed files.`
+      : "",
     "Use the completed architecture-review-fast report as the foreground triage result; write the full review report path and digest when the background review finishes."
   ].filter(Boolean).join(" ");
   return runCwJson([
@@ -304,7 +316,7 @@ function timed(fn) {
   return { value, elapsedMs: elapsedMs(started) };
 }
 
-function buildMetrics(started, contextText, sourceContextElapsedMs, fastReview, fastReviewElapsedMs, fullReviewScheduleElapsedMs) {
+function buildMetrics(started, contextText, sourceContextElapsedMs, fastReview, fastReviewElapsedMs, fullReviewScheduleElapsedMs, changedFrom) {
   const steps = Array.isArray(fastReview?.steps) ? fastReview.steps : [];
   const handleKinds = countBy(steps.map((step) => step && step.handleKind).filter(Boolean));
   const actions = countBy(steps.map((step) => step && step.action).filter(Boolean));
@@ -314,7 +326,8 @@ function buildMetrics(started, contextText, sourceContextElapsedMs, fastReview,
     sourceContext: {
       elapsedMs: sourceContextElapsedMs,
       bytes: Buffer.byteLength(contextText, "utf8"),
-      digest: `sha256:${crypto.createHash("sha256").update(contextText, "utf8").digest("hex")}`
+      digest: `sha256:${crypto.createHash("sha256").update(contextText, "utf8").digest("hex")}`,
+      ...(changedFrom ? { changedFrom } : {})
     },
     fastReview: {
       elapsedMs: fastReviewElapsedMs,
@@ -388,6 +401,7 @@ function usage(code) {
     "",
     "options:",
     "  --profile core --ref HEAD --profile-file PATH --cache-dir DIR --context-out PATH",
+    "  --changed-from REF   (incremental overlay: scope context to files changed since REF)",
     "  --fast-model MODEL --strong-model MODEL",
     "  --invariant TEXT --focus TEXT --preview --once",
     "  --schedule-full [--full-delay-minutes N]",

package/scripts/bump-version.js

@@ -143,6 +143,22 @@ function main() {
     note(rel);
   }
 
+  // 5c. Homebrew formula (repo root, not under pluginRoot). Structured surface:
+  //     a git-tag formula with no sha256. Homebrew reads the version from the
+  //     tag, so the ONLY literal that moves is `tag: "v<version>"` (an explicit
+  //     `version` line would be redundant and brew audit rejects it). A targeted
+  //     exact-string swap keeps the file byte-formatting intact;
+  //     version-sync-check.js asserts the tag at HEAD, so it can never drift.
+  const formula = path.join(repoRoot, "Formula", "cool-workflow.rb");
+  if (fs.existsSync(formula)) {
+    const text = fs.readFileSync(formula, "utf8");
+    const updated = text.split(`tag: "v${current}"`).join(`tag: "v${next}"`);
+    if (updated !== text) {
+      fs.writeFileSync(formula, updated);
+      note("Formula/cool-workflow.rb");
+    }
+  }
+
   process.stdout.write(`bump:version ${current} -> ${next}\n`);
   for (const rel of touched) process.stdout.write(`  updated  ${rel}\n`);