cool-workflow 0.1.93 → 0.1.94

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cool-workflow",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
-  "version": "0.1.93",
+  "version": "0.1.94",
   "author": {
     "name": "COOLWHITE LLC"
   },

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.93",
+  "version": "0.1.94",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
   "author": {
     "name": "COOLWHITE LLC"

package/apps/architecture-review/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review",
   "title": "Architecture Review",
   "summary": "Map a repository architecture, assess risks, verify important findings, and synthesize an evidence-backed verdict.",
-  "version": "0.1.93",
+  "version": "0.1.94",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/architecture-review-fast/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review-fast",
   "title": "Architecture Review Fast",
   "summary": "Run a shorter architecture review with parallel map and assess phases for faster first results.",
-  "version": "0.1.93",
+  "version": "0.1.94",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/end-to-end-golden-path/app.json

@@ -3,7 +3,7 @@
   "id": "end-to-end-golden-path",
   "title": "End-to-End Golden Path",
   "summary": "Deterministic one-worker workflow app for proving the CW integration chain.",
-  "version": "0.1.93",
+  "version": "0.1.94",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/pr-review-fix-ci/app.json

@@ -3,7 +3,7 @@
   "id": "pr-review-fix-ci",
   "title": "PR Review Fix CI",
   "summary": "Review a pull request or branch, inspect CI failures, diagnose actionable issues, optionally patch, verify, and summarize with evidence.",
-  "version": "0.1.93",
+  "version": "0.1.94",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/release-cut/app.json

@@ -3,7 +3,7 @@
   "id": "release-cut",
   "title": "Release Cut",
   "summary": "Prepare a release with checklist discipline: version checks, changelog, tests, packaging, release notes, and final verification.",
-  "version": "0.1.93",
+  "version": "0.1.94",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/research-synthesis/app.json

@@ -3,7 +3,7 @@
   "id": "research-synthesis",
   "title": "Research Synthesis",
   "summary": "Split a research question into claims, investigate sources, cross-check evidence, verify claims, and synthesize a concise answer.",
-  "version": "0.1.93",
+  "version": "0.1.94",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/dist/version.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MIN_SUPPORTED_RUN_STATE_SCHEMA_VERSION = exports.LEGACY_RUN_STATE_SCHEMA_VERSION = exports.CURRENT_RUN_STATE_SCHEMA_VERSION = exports.WORKFLOW_APP_SCHEMA_VERSION = exports.CURRENT_COOL_WORKFLOW_VERSION = void 0;
-exports.CURRENT_COOL_WORKFLOW_VERSION = "0.1.93";
+exports.CURRENT_COOL_WORKFLOW_VERSION = "0.1.94";
 exports.WORKFLOW_APP_SCHEMA_VERSION = 1;
 exports.CURRENT_RUN_STATE_SCHEMA_VERSION = 1;
 exports.LEGACY_RUN_STATE_SCHEMA_VERSION = 0;

package/docs/agent-delegation-drive.7.md

@@ -239,14 +239,18 @@ never polluted.
 The built-in templates are:
 
 ```text
---agent-command builtin:claude
---agent-command builtin:codex
+--agent-command builtin:claude       # claude -p (native)
+--agent-command builtin:codex        # codex exec (native)
+--agent-command builtin:gemini       # Gemini via opencode (google/gemini-3.5-flash)
+--agent-command builtin:gemini-cli   # native gemini CLI (needs GEMINI_API_KEY)
+--agent-command builtin:opencode     # opencode (its configured default model)
+--agent-command builtin:deepseek     # DeepSeek via opencode (deepseek/deepseek-chat)
 ```
 
-Gemini, OpenCode, DeepSeek, and GLM stay as external agent commands or HTTP
-endpoints until their stream format is proven by a local, deterministic wrapper
-smoke. DeepSeek and GLM are best reached through OpenCode or an HTTP agent
-adapter first; CW still imports no model SDK.
+claude and codex run their own CLIs; gemini and deepseek route through opencode
+(where their keys live), each proven by a local, deterministic wrapper smoke
+(override the model with CW_GEMINI_MODEL / CW_DEEPSEEK_MODEL). GLM stays an
+external agent command or HTTP endpoint. CW still imports no model SDK.
 
 ## Compatibility
 
@@ -338,3 +342,5 @@ The one-command `cw -q` headline now routes the question and defaults the repo t
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/cli-mcp-parity.7.md

@@ -545,3 +545,5 @@ CLI golden-path fixes: `cw -q "…"` routes the question (was read as an app id
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/contract-migration-tooling.7.md

@@ -163,3 +163,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/control-plane-scheduling.7.md

@@ -147,3 +147,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/durable-state-and-locking.7.md

@@ -146,3 +146,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/evidence-adoption-reasoning-chain.7.md

@@ -307,3 +307,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/execution-backends.7.md

@@ -337,3 +337,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/multi-agent-cli-mcp-surface.7.md

@@ -305,3 +305,5 @@ The host-facing surface tracks the CLI golden-path fixes (`cw -q` routing + repo
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/multi-agent-eval-replay-harness.7.md

@@ -339,3 +339,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/multi-agent-operator-ux.7.md

@@ -351,3 +351,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/node-snapshot-diff-replay.7.md

@@ -172,3 +172,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/observability-cost-accounting.7.md

@@ -231,3 +231,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/project-index.md

@@ -1,15 +1,15 @@
 # Cool Workflow Project Index
 
-Generated from the current repository code on 2026-06-25 by `npm run sync:project-index`.
+Generated from the current repository code on 2026-06-26 by `npm run sync:project-index`.
 
 ## Snapshot
 
 - Package: `cool-workflow`
-- Version: `0.1.93`
+- Version: `0.1.94`
 - Source modules: `68`
 - Workflow apps: `7`
 - Docs: `53`
-- Smoke tests: `149`
+- Smoke tests: `152`
 - Repository: https://github.com/coo1white/cool-workflow
 
 ## Architecture
@@ -231,6 +231,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [coordinator-blackboard-smoke.js](../test/coordinator-blackboard-smoke.js)
 - [cw-help-per-command-smoke.js](../test/cw-help-per-command-smoke.js)
 - [dead-export-removal-guard-smoke.js](../test/dead-export-removal-guard-smoke.js)
+- [deepseek-agent-wrapper-smoke.js](../test/deepseek-agent-wrapper-smoke.js)
 - [demo-bundle-smoke.js](../test/demo-bundle-smoke.js)
 - [det-ids-b-smoke.js](../test/det-ids-b-smoke.js)
 - [doctor-smoke.js](../test/doctor-smoke.js)
@@ -248,6 +249,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [execution-backends-smoke.js](../test/execution-backends-smoke.js)
 - [freebsd-audit-fixes-smoke.js](../test/freebsd-audit-fixes-smoke.js)
 - [gemini-agent-wrapper-smoke.js](../test/gemini-agent-wrapper-smoke.js)
+- [gemini-opencode-agent-wrapper-smoke.js](../test/gemini-opencode-agent-wrapper-smoke.js)
 - [h7-custom-profile-persist-smoke.js](../test/h7-custom-profile-persist-smoke.js)
 - [headline-commands-smoke.js](../test/headline-commands-smoke.js)
 - [incremental-resume-smoke.js](../test/incremental-resume-smoke.js)
@@ -335,6 +337,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [telemetry-verify-signatures-smoke.js](../test/telemetry-verify-signatures-smoke.js)
 - [token-budget-enforcement-smoke.js](../test/token-budget-enforcement-smoke.js)
 - [vendor-manifest-load-smoke.js](../test/vendor-manifest-load-smoke.js)
+- [vendor-preflight-smoke.js](../test/vendor-preflight-smoke.js)
 - [verifier-gated-commit-smoke.js](../test/verifier-gated-commit-smoke.js)
 - [verify-import-audit-chain-smoke.js](../test/verify-import-audit-chain-smoke.js)
 - [web-desktop-workbench-smoke.js](../test/web-desktop-workbench-smoke.js)

package/docs/real-execution-backends.7.md

@@ -179,3 +179,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/release-and-migration.7.md

@@ -319,3 +319,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/release-tooling.7.md

@@ -266,3 +266,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/run-registry-control-plane.7.md

@@ -462,3 +462,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/run-retention-reclamation.7.md

@@ -230,3 +230,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/state-explosion-management.7.md

@@ -308,3 +308,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/team-collaboration.7.md

@@ -244,3 +244,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/docs/web-desktop-workbench.7.md

@@ -252,3 +252,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.91
 
 0.1.93
+
+0.1.94

package/manifest/plugin.manifest.json

@@ -2,7 +2,7 @@
   "_comment": "SINGLE SOURCE OF TRUTH for every vendor manifest. Edit THIS file, then run `npm run gen:manifests`. Do NOT hand-edit the generated vendor manifests (.claude-plugin/, .codex-plugin/, .agents/, .mcp.json) — `npm run gen:manifests -- --check` (run by release:check) will fail if they drift from this source.",
   "identity": {
     "name": "cool-workflow",
-    "version": "0.1.93",
+    "version": "0.1.94",
     "license": "BSD-2-Clause",
     "homepage": "https://github.com/coo1white/cool-workflow",
     "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.93",
+  "version": "0.1.94",
   "bin": {
     "cool-workflow": "scripts/cw.js",
     "cw": "scripts/cw.js"

package/scripts/agents/builtin-templates.json

@@ -4,8 +4,9 @@
   "templates": {
     "claude": "claude-p-agent.js",
     "codex": "codex-agent.js",
-    "gemini": "gemini-agent.js",
+    "gemini": "gemini-opencode-agent.js",
+    "gemini-cli": "gemini-agent.js",
     "opencode": "opencode-agent.js",
-    "deepseek": "opencode-agent.js"
+    "deepseek": "deepseek-agent.js"
   }
 }

package/scripts/agents/claude-p-agent.js

@@ -12,12 +12,12 @@
 // worker's result.md ({{result}}), and forward claude's JSON on STDOUT so CW
 // records the agent-reported provenance.
 //
-// LIVE OUTPUT (Unix discipline): default output is the legacy `--output-format
-// json` contract, forwarded verbatim on stdout. Set CW_AGENT_STREAM=1 to opt in
-// to claude `stream-json`; only then does this wrapper render a human-readable
-// trace to stderr, and only when stderr is a TTY. Diagnostics stay off stdout,
-// and vendor-specific stream parsing lives HERE in the wrapper (policy), not in
-// CW's core (which only forwards, never parses).
+// LIVE OUTPUT (Unix discipline): the DEFAULT is claude `stream-json` — this
+// wrapper renders a human-readable trace to stderr (only when stderr is a TTY).
+// Set CW_AGENT_STREAM=0 (or CW_NO_STREAM=1) to fall back to the legacy
+// `--output-format json` contract, forwarded verbatim on stdout. Either way
+// diagnostics stay off stdout, and vendor-specific stream parsing lives HERE in
+// the wrapper (policy), not in CW's core (which only forwards, never parses).
 //
 // READ-ONLY by design: claude gets NO Write tool; the architecture-review app
 // declares the `readonly` sandbox profile. This wrapper (the transport) writes

package/scripts/agents/codex-agent.js

@@ -16,6 +16,7 @@
 // stderr: optional live trace when CW_AGENT_STREAM=1 and attached to a TTY.
 
 const fs = require("node:fs");
+const os = require("node:os");
 const path = require("node:path");
 const { spawn } = require("node:child_process");
 const {
@@ -27,6 +28,21 @@ const {
   writeResult
 } = require("./agent-adapter-core");
 
+// codex exec --json (>=0.139) emits NO model field in its JSONL (only thread/turn
+// events + usage). For provenance, fall back to the model codex is configured to
+// use: $CODEX_HOME/config.toml (or ~/.codex/config.toml), key `model`. Best effort
+// — a stream model field (older/newer codex) still wins.
+function detectCodexModel() {
+  try {
+    const home = process.env.CODEX_HOME || path.join(os.homedir(), ".codex");
+    const cfg = fs.readFileSync(path.join(home, "config.toml"), "utf8");
+    const m = cfg.match(/^\s*model\s*=\s*["']([^"']+)["']/m);
+    return m ? m[1] : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 const inputPath = process.argv[2];
 const resultPath = process.argv[3];
 if (!inputPath || !resultPath) {
@@ -65,8 +81,6 @@ const args = [
   finalPath,
   "--sandbox",
   "read-only",
-  "--ask-for-approval",
-  "never",
   "--color",
   "never",
   "-"
@@ -133,5 +147,5 @@ child.on("close", (code) => {
     process.exit(1);
   }
 
-  emitReport(state.model, state.usage, resultText);
+  emitReport(state.model || detectCodexModel(), state.usage, resultText);
 });

package/scripts/agents/deepseek-agent.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+"use strict";
+
+// deepseek-agent.js - DeepSeek (via opencode) adapter for CW Agent Delegation Drive.
+//
+// DeepSeek ships no standalone CLI here; CW reaches it through
+// `opencode run --model deepseek/...`. This is a thin variant of the opencode
+// runner: it sets the variant env (display label + model) and delegates to
+// opencode-agent.js, so the run/parse/provenance logic lives in ONE place.
+//
+// Override the model with CW_DEEPSEEK_MODEL (default deepseek/deepseek-chat).
+// Requires opencode installed AND a DeepSeek provider configured in opencode
+// (`opencode auth login` or DEEPSEEK_API_KEY). Without that, opencode exits
+// nonzero and CW fails closed - it never fabricates a result.
+//
+// Contract (unchanged from opencode-agent.js):
+//   argv[2] = {{input}}   worker input.md
+//   argv[3] = {{result}}  worker result.md to persist
+
+process.env.CW_OPENCODE_LABEL = "deepseek";
+process.env.CW_OPENCODE_MODEL = process.env.CW_DEEPSEEK_MODEL || "deepseek/deepseek-chat";
+
+require("./opencode-agent.js");

package/scripts/agents/gemini-opencode-agent.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+"use strict";
+
+// gemini-opencode-agent.js - Gemini (via opencode) adapter for CW Agent Delegation.
+//
+// Reaches Gemini through `opencode run --model google/...`, the same gateway CW
+// uses for DeepSeek. Use this when the Gemini key lives in opencode (provider
+// "google") rather than the standalone `gemini` CLI. The native Gemini CLI path
+// is still available as builtin:gemini-cli (scripts/agents/gemini-agent.js).
+//
+// Thin variant of the opencode runner: it sets the variant env (display label +
+// model) and delegates to opencode-agent.js, so run/parse/provenance live in ONE
+// place. Override the model with CW_GEMINI_MODEL (default google/gemini-3.5-flash).
+// Requires opencode installed AND a "google" provider authed in opencode
+// (`opencode auth login` -> google). Without it, opencode exits nonzero and CW
+// fails closed - it never fabricates a result.
+//
+// Contract (unchanged from opencode-agent.js):
+//   argv[2] = {{input}}   worker input.md
+//   argv[3] = {{result}}  worker result.md to persist
+
+process.env.CW_OPENCODE_LABEL = "gemini";
+process.env.CW_OPENCODE_MODEL = process.env.CW_GEMINI_MODEL || "google/gemini-3.5-flash";
+
+require("./opencode-agent.js");

package/scripts/agents/opencode-agent.js

@@ -37,11 +37,35 @@ if (!inputPath || !resultPath) {
   process.exit(2);
 }
 
+// Same runner serves both `opencode` (provider default model) and `deepseek`
+// (DeepSeek via opencode). The variant sets CW_OPENCODE_LABEL + CW_OPENCODE_MODEL;
+// see deepseek-agent.js. Unset = plain opencode, unchanged behavior.
+const label = process.env.CW_OPENCODE_LABEL || "opencode";
+const requestedModel = process.env.CW_OPENCODE_MODEL || "";
+
 const prompt = buildPrompt(inputPath);
-const render = createRenderer({ env: process.env, stderr: process.stderr, label: "opencode" });
+const render = createRenderer({ env: process.env, stderr: process.stderr, label });
 const transcriptPath = path.join(path.dirname(resultPath), "transcript.md");
-const state = { provider: "opencode", buffer: "", model: undefined, usage: undefined, textFragments: [], finalResult: undefined, renderer: render };
+const state = {
+  provider: label,
+  buffer: "",
+  // opencode --format json carries NO model field; record the model we asked for.
+  model: requestedModel || undefined,
+  usage: undefined,
+  textFragments: [],
+  finalResult: undefined,
+  lastMessageId: undefined,
+  lastMessageText: "",
+  renderer: render
+};
 let childStderr = "";
+
+// opencode (>=1.x) --format json emits JSONL events of shape { type, part }:
+//   type:"text"        -> part.text         assistant text, grouped by part.messageID
+//   type:"step_finish" -> part.tokens       { input, output, ... } per step
+// The final answer is the LAST message's text (earlier "text" parts are mid-run
+// narration). Older opencode shapes (ev.result / ev.text / ev.delta) are still
+// accepted as a fallback so the wrapper is not pinned to one CLI version.
 function recordJsonLine(line) {
   let ev;
   try {
@@ -50,22 +74,47 @@ function recordJsonLine(line) {
     state.invalidJson = true;
     return;
   }
+  const part = ev && typeof ev.part === "object" && ev.part ? ev.part : {};
+
+  if (ev.type === "text" && typeof part.text === "string") {
+    const mid = typeof part.messageID === "string" ? part.messageID : "";
+    if (mid !== state.lastMessageId) {
+      state.lastMessageId = mid;
+      state.lastMessageText = "";
+    }
+    state.lastMessageText += (state.lastMessageText ? "\n" : "") + part.text;
+    if (part.text.trim()) state.textFragments.push(part.text);
+    return;
+  }
+
+  if (ev.type === "step_finish" && part.tokens && typeof part.tokens === "object") {
+    state.usage = state.usage || { input_tokens: 0, output_tokens: 0 };
+    state.usage.input_tokens += Number(part.tokens.input) || 0;
+    state.usage.output_tokens += Number(part.tokens.output) || 0;
+    return;
+  }
+
+  // Fallback: older opencode JSON shapes (single result object / delta stream).
   if (ev.result && typeof ev.result === "string") {
     state.finalResult = ev.result;
-  } else {
-    const text = typeof ev.text === "string" ? ev.text : (ev.delta ? (typeof ev.delta === "string" ? ev.delta : ev.delta.text) : undefined);
-    if (typeof text === "string" && text.trim()) state.textFragments.push(text);
+    return;
   }
+  const legacy = typeof ev.text === "string" ? ev.text : (ev.delta ? (typeof ev.delta === "string" ? ev.delta : ev.delta.text) : undefined);
+  if (typeof legacy === "string" && legacy.trim()) state.textFragments.push(legacy);
 }
 
-render.action("opencode: reading the repo…");
+render.action(`${label}: reading the repo…`);
 
+// `opencode run` takes the message as a POSITIONAL arg ("opencode run [message..]");
+// there is no --prompt flag. Pass the prompt last, as the positional message.
+// --model (provider/model, e.g. deepseek/deepseek-chat) is added only when a
+// variant requests it; otherwise opencode uses its configured default model.
 const args = [
   "run",
   "--format",
   "json",
   "--dangerously-skip-permissions",
-  "--prompt",
+  ...(requestedModel ? ["--model", requestedModel] : []),
   prompt
 ];
 
@@ -105,7 +154,7 @@ child.on("close", (code) => {
     process.exit(1);
   }
 
-  const resultText = state.finalResult || state.textFragments.join("\n\n");
+  const resultText = state.finalResult || state.lastMessageText || state.textFragments.join("\n\n");
   if (!resultText.trim()) {
     process.stderr.write("opencode produced no result text - refusing to fabricate a result\n");
     process.exit(1);

package/scripts/canonical-apps.js

@@ -83,7 +83,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.1.93",
+      "Cool Workflow v0.1.94",
       "--freshness",
       "as of release preparation"
     ]
@@ -117,14 +117,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.1.93");
+    assert.equal(summary.version, "0.1.94");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.1.93");
+    assert.equal(shown.app.version, "0.1.94");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -135,7 +135,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.1.93");
+    assert.equal(state.workflow.app.version, "0.1.94");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);

package/scripts/dogfood-release.js

@@ -6,7 +6,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { CoolWorkflowRunner } = require("../dist/orchestrator.js");
 
-const TARGET_VERSION = "0.1.93";
+const TARGET_VERSION = "0.1.94";
 const PREVIOUS_VERSION = "0.1.31";
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");

package/scripts/golden-path.js

@@ -33,7 +33,7 @@ function main() {
     const appValidation = runJson(["app", "validate", "end-to-end-golden-path"], pluginRoot);
     assert.equal(appValidation.valid, true);
     assert.equal(appValidation.summary.id, "end-to-end-golden-path");
-    assert.equal(appValidation.summary.version, "0.1.93");
+    assert.equal(appValidation.summary.version, "0.1.94");
 
     const plan = runJson(
       [
@@ -42,7 +42,7 @@ function main() {
         "--repo",
         tmp,
         "--question",
-        "Prove the deterministic v0.1.93 end-to-end golden path."
+        "Prove the deterministic v0.1.94 end-to-end golden path."
       ],
       pluginRoot
     );
@@ -52,7 +52,7 @@ function main() {
 
     let state = readJson(plan.statePath);
     assert.equal(state.workflow.app.id, "end-to-end-golden-path");
-    assert.equal(state.workflow.app.version, "0.1.93");
+    assert.equal(state.workflow.app.version, "0.1.94");
     assert.equal(state.loopStage, "interpret");
 
     const dispatch = runJson(["dispatch", plan.runId, "--limit", "1", "--sandbox", "readonly"], tmp);
@@ -195,7 +195,7 @@ function main() {
     assert.equal(reportPath, plan.reportPath);
     assert.ok(fs.existsSync(reportPath));
     const report = fs.readFileSync(reportPath, "utf8");
-    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.93/);
+    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.94/);
     assert.match(report, /## Candidates/);
     assert.match(report, /## Trust Audit/);
     assert.match(report, /## Acceptance Rationale/);

package/scripts/release-flow.js

@@ -119,6 +119,40 @@ function runGate() {
   if (r.status !== 0) die("deterministic gate FAILED — fix findings in normal cycles, do not retry the release here.");
 }
 
+// ---- 1b. vendor liveness preflight (cut only) ------------------------------
+// CW promises claude/codex/gemini/deepseek all work; this proves it before a cut.
+// LIVE: spends real tokens on each vendor, so it runs on --cut (release machine
+// has the keys), not on --check. HARD-BLOCK: any vendor not green stops the cut.
+// Escape hatch CW_SKIP_VENDOR_PREFLIGHT=1 (emergencies/offline). Test seam
+// CW_RELEASE_FLOW_PREFLIGHT_CMD overrides the command (smoke stubs it).
+function runVendorPreflight() {
+  if (!MODE_CUT) {
+    say("[1b/3] vendor preflight — skipped (check mode; live vendor calls run on --cut)");
+    return;
+  }
+  if (process.env.CW_SKIP_VENDOR_PREFLIGHT === "1") {
+    say("[1b/3] vendor preflight — SKIPPED via CW_SKIP_VENDOR_PREFLIGHT=1 (operator override)");
+    return;
+  }
+  const vendors = (process.env.CW_PREFLIGHT_VENDORS || "claude,codex,gemini,deepseek").trim();
+  const override = (process.env.CW_RELEASE_FLOW_PREFLIGHT_CMD || "").trim();
+  say(`[1b/3] vendor preflight — live liveness check: ${vendors}`);
+  let r;
+  if (override) {
+    // Test/override seam — shell:true, smoke/operator only, never the delegated agent.
+    r = spawnSync(override, { cwd: repoRoot, encoding: "utf8", shell: true, stdio: "inherit" });
+  } else {
+    r = spawnSync(process.execPath, [path.join(scriptsDir, "vendor-preflight.js"), "--vendors", vendors], {
+      cwd: repoRoot,
+      encoding: "utf8",
+      stdio: "inherit"
+    });
+  }
+  if (r.status !== 0) {
+    die("vendor preflight FAILED — a promised vendor is not live (missing CLI/key or broken). Users must not be limited to one vendor; fix before cutting, or set CW_SKIP_VENDOR_PREFLIGHT=1 to override.");
+  }
+}
+
 // ---- 2. independent reviewer, delegated to the configured agent -------------
 function reviewerPromptBody() {
   // Reuse the committed reviewer spec as the prompt; strip YAML frontmatter.
@@ -476,6 +510,7 @@ function main() {
   const inputPath = path.join(markerDir, `review-input-${HEAD}.md`);
 
   runGate();
+  runVendorPreflight();
   fs.writeFileSync(inputPath, buildReviewerInput(resultPath));
   delegateReview(resultPath, inputPath);
   const capability = verifyVerdict(resultPath);

package/scripts/vendor-preflight.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+"use strict";
+
+// vendor-preflight.js — pre-release liveness gate for ALL agent vendors.
+//
+// CW promises that claude, codex, gemini, and deepseek all work. This gate
+// proves it before a release: it runs EACH builtin wrapper against a tiny
+// throwaway git repo with a trivial question and checks the wrapper returns a
+// real, non-empty result. It is the enforcement behind that promise.
+//
+// HARD-BLOCK policy (operator chose this): a vendor that does not return a valid
+// result — missing CLI, auth error, empty/garbage output — counts as FAIL and
+// the gate exits nonzero. There is no "skip"; an unconfigured vendor blocks.
+//
+// This is a LIVE gate: it spends real tokens on each configured vendor. It is
+// meant for the release machine (where all keys/logins exist), NOT the offline
+// CI test suite. The offline smoke (test/vendor-preflight-smoke.js) exercises
+// this script's LOGIC with PATH shims, no keys.
+//
+// Zero runtime dependency: node + git only. stdout is data (the matrix), stderr
+// is diagnostics — same discipline as the rest of CW.
+//
+// Usage:
+//   node vendor-preflight.js [--vendors claude,codex,deepseek] [--question "..."]
+//                            [--timeout-ms 180000] [--json] [--keep]
+//
+// Test seam (smoke/operator only):
+//   CW_PREFLIGHT_AGENTS_DIR  override where wrapper scripts + builtin-templates.json
+//                            are read from (the smoke points this at a shim dir).
+
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+function argValue(flag, fallback) {
+  const i = process.argv.indexOf(flag);
+  return i >= 0 && i + 1 < process.argv.length ? process.argv[i + 1] : fallback;
+}
+const hasFlag = (flag) => process.argv.includes(flag);
+
+const agentsDir = process.env.CW_PREFLIGHT_AGENTS_DIR || path.join(__dirname, "agents");
+const manifestPath = path.join(agentsDir, "builtin-templates.json");
+const question = argValue("--question", "In one sentence, what does this repo do? Keep it short.");
+const timeoutMs = Number(argValue("--timeout-ms", "180000")) || 180000;
+const asJson = hasFlag("--json");
+const keep = hasFlag("--keep");
+
+function die(msg) {
+  process.stderr.write(msg + "\n");
+  process.exit(2);
+}
+
+let templates;
+try {
+  templates = JSON.parse(fs.readFileSync(manifestPath, "utf8")).templates || {};
+} catch (e) {
+  die(`vendor-preflight: cannot read ${manifestPath}: ${e.message}`);
+}
+
+const onlyRaw = argValue("--vendors", "");
+const only = onlyRaw ? onlyRaw.split(",").map((s) => s.trim()).filter(Boolean) : null;
+const vendors = Object.keys(templates).filter((v) => !only || only.includes(v));
+if (only) {
+  for (const v of only) if (!templates[v]) die(`vendor-preflight: unknown vendor "${v}" — known: ${Object.keys(templates).join(", ")}`);
+}
+if (!vendors.length) die("vendor-preflight: no vendors to check");
+
+// One throwaway git repo + worker input, reused read-only across vendors.
+const work = fs.mkdtempSync(path.join(os.tmpdir(), "cw-preflight-"));
+const repo = path.join(work, "repo");
+fs.mkdirSync(repo, { recursive: true });
+spawnSync("git", ["init", "-q"], { cwd: repo });
+fs.writeFileSync(path.join(repo, "README.md"), "# Tiny App\n\nA one-file demo. main.js reads input and prints it.\n");
+const inputPath = path.join(repo, "input.md");
+fs.writeFileSync(inputPath, `# Worker preflight\n\n- Result: ${path.join(repo, "result.md")}\n\n## Task\n\n${question}\n`);
+
+function checkVendor(name) {
+  const script = templates[name];
+  const wrapper = path.join(agentsDir, script);
+  const resultPath = path.join(repo, `result-${name}.md`);
+  try { fs.rmSync(resultPath, { force: true }); } catch { /* ignore */ }
+  const started = process.hrtime.bigint();
+  const r = spawnSync(process.execPath, [wrapper, inputPath, resultPath], {
+    cwd: repo,
+    encoding: "utf8",
+    timeout: timeoutMs,
+    env: { ...process.env, CW_AGENT_STREAM: "0" }
+  });
+  const ms = Number((process.hrtime.bigint() - started) / 1000000n);
+  const result = (() => { try { return fs.readFileSync(resultPath, "utf8"); } catch { return ""; } })();
+  let model;
+  try { model = JSON.parse(r.stdout || "{}").model; } catch { /* provenance optional */ }
+
+  let status = "PASS";
+  let reason = "";
+  if (r.error && r.error.code === "ETIMEDOUT") {
+    status = "FAIL"; reason = `timed out after ${timeoutMs}ms`;
+  } else if (r.status !== 0) {
+    status = "FAIL"; reason = (r.stderr || "").trim().split("\n").pop() || `exit ${r.status}`;
+  } else if (!result.trim()) {
+    status = "FAIL"; reason = "exit 0 but empty result";
+  }
+  return { vendor: name, status, reason, ms, model, hasContract: /```cw:result/.test(result) };
+}
+
+const rows = vendors.map(checkVendor);
+if (!keep) { try { fs.rmSync(work, { recursive: true, force: true }); } catch { /* ignore */ } }
+
+const failed = rows.filter((r) => r.status !== "PASS");
+
+if (asJson) {
+  process.stdout.write(JSON.stringify({ ok: failed.length === 0, vendors: rows }, null, 2) + "\n");
+} else {
+  for (const r of rows) {
+    const mark = r.status === "PASS" ? "✓" : "✗";
+    const extra = r.status === "PASS"
+      ? `${r.ms}ms${r.model ? `, ${r.model}` : ""}${r.hasContract ? "" : ", no cw:result block"}`
+      : r.reason;
+    process.stdout.write(`  ${mark} ${r.vendor.padEnd(10)} ${r.status}  (${extra})\n`);
+  }
+  process.stdout.write(failed.length === 0
+    ? `vendor-preflight: ok — ${rows.length}/${rows.length} vendors live\n`
+    : `vendor-preflight: BLOCKED — ${failed.length}/${rows.length} vendor(s) not live: ${failed.map((r) => r.vendor).join(", ")}\n`);
+}
+
+process.exit(failed.length === 0 ? 0 : 1);