cool-workflow 0.1.94 → 0.1.96

package/scripts/agents/claude-p-agent.js

@@ -34,7 +34,7 @@ const { spawn, spawnSync } = require("node:child_process");
 // wrappers instead of carrying a private copy. A drifted inline copy (ASCII
 // hyphens silently became em-dashes here) meant claude was sent a different
 // instruction text than the other providers for the same contract.
-const { buildPrompt, createRenderer, toolLabel, summarizeToolResult } = require("./agent-adapter-core");
+const { buildPrompt, createRenderer, persistStderr, toolLabel, summarizeToolResult } = require("./agent-adapter-core");
 
 const inputPath = process.argv[2];
 const resultPath = process.argv[3];
@@ -56,11 +56,14 @@ if (!streamEnabled) {
     shell: false
   });
   if (child.error) {
+    persistStderr(resultPath, `claude spawn failed: ${child.error.message}`);
     process.stderr.write(`claude spawn failed: ${child.error.message}\n`);
     process.exit(1);
   }
   if (child.status !== 0) {
-    process.stderr.write(String(child.stderr || `claude exited ${child.status}`));
+    const detail = String(child.stderr || `claude exited ${child.status}`);
+    persistStderr(resultPath, detail);
+    process.stderr.write(detail);
     process.exit(child.status === null ? 1 : child.status);
   }
 
@@ -69,6 +72,7 @@ if (!streamEnabled) {
   try {
     parsed = JSON.parse(out);
   } catch (error) {
+    persistStderr(resultPath, `claude output was not JSON: ${error.message}`);
     process.stderr.write(`claude output was not JSON: ${error.message}\n`);
     process.exit(1);
   }
@@ -166,6 +170,7 @@ function renderEvent(ev) {
 
 child.on("error", (err) => {
   render.finishLive(); // restore the terminal before exiting
+  persistStderr(resultPath, `claude spawn failed: ${err.message}`);
   process.stderr.write(`claude spawn failed: ${err.message}\n`);
   process.exit(1);
 });
@@ -174,12 +179,15 @@ child.on("close", (code) => {
   render.finishLive(); // stop the spinner + restore the cursor BEFORE any further output
   render.writeTranscript(transcriptPath); // full narration + tool I/O always saved
   if (code !== 0) {
+    const detail = childStderr.trim() || `claude exited ${code === null ? "(timeout/killed)" : code}`;
+    persistStderr(resultPath, detail);
     if (childStderr.trim()) process.stderr.write(`${childStderr.trim()}\n`);
     process.stderr.write(`claude exited ${code === null ? "(timeout/killed)" : code}\n`);
     process.exit(code === null ? 1 : code);
   }
   if (typeof resultText !== "string") {
     // Fail closed: no result event ⇒ no result.md ⇒ CW records a failed hop.
+    persistStderr(resultPath, childStderr.trim() || "claude produced no result event — refusing to fabricate a result");
     process.stderr.write("claude produced no result event — refusing to fabricate a result\n");
     process.exit(1);
   }

package/scripts/agents/codex-agent.js

@@ -14,6 +14,13 @@
 //
 // stdout: one JSON object { model, usage, result } for CW provenance.
 // stderr: optional live trace when CW_AGENT_STREAM=1 and attached to a TTY.
+//
+// SPEED: codex `exec` inherits the user's ~/.codex/config.toml, including a heavy
+// `model_reasoning_effort` (e.g. "high"), which makes every read/grep turn slow.
+// CW caps it for ITS runs only via `-c model_reasoning_effort=<effort>` — a
+// per-run override that does NOT touch the user's interactive codex. Tune with
+// CW_CODEX_REASONING_EFFORT (default "low"); set it to "medium"/"high" to opt back
+// into more thinking.
 
 const fs = require("node:fs");
 const os = require("node:os");
@@ -25,6 +32,7 @@ const {
   emitReport,
   flushJsonLines,
   parseJsonLines,
+  persistStderr,
   writeResult
 } = require("./agent-adapter-core");
 
@@ -74,9 +82,14 @@ function recordJsonLine(line) {
 
 render.action("codex: reading the repo (read-only)…");
 
+// Cap codex's reasoning effort for CW runs (speed) — overrides config.toml for
+// THIS invocation only. Default "low"; CW_CODEX_REASONING_EFFORT opts back up.
+const effort = process.env.CW_CODEX_REASONING_EFFORT || "low";
 const args = [
   "exec",
   "--json",
+  "-c",
+  `model_reasoning_effort=${effort}`,
   "--output-last-message",
   finalPath,
   "--sandbox",
@@ -108,6 +121,7 @@ child.stderr.on("data", (chunk) => {
 
 child.on("error", (error) => {
   render.finishLive();
+  persistStderr(resultPath, `codex spawn failed: ${error.message}`);
   process.stderr.write(`codex spawn failed: ${error.message}\n`);
   process.exit(1);
 });
@@ -118,11 +132,14 @@ child.on("close", (code) => {
   render.writeTranscript(transcriptPath);
   if (code !== 0) {
     const detail = childStderr.trim() || `codex exited ${code === null ? "(timeout/killed)" : code}`;
+    persistStderr(resultPath, detail);
     process.stderr.write(`${detail}\n`);
     process.exit(code === null ? 1 : code);
   }
   if (state.invalidJson) {
-    process.stderr.write("codex --json produced a non-JSONL stdout line - refusing to trust the result\n");
+    const detail = "codex --json produced a non-JSONL stdout line - refusing to trust the result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
@@ -130,7 +147,9 @@ child.on("close", (code) => {
   try {
     resultText = fs.readFileSync(finalPath, "utf8");
   } catch {
-    process.stderr.write("codex produced no final output file - refusing to fabricate a result\n");
+    const detail = "codex produced no final output file - refusing to fabricate a result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   } finally {
     try {
@@ -143,6 +162,7 @@ child.on("close", (code) => {
   try {
     writeResult(resultPath, resultText);
   } catch (error) {
+    persistStderr(resultPath, `codex produced no final result: ${error.message}`);
     process.stderr.write(`codex produced no final result: ${error.message}\n`);
     process.exit(1);
   }

package/scripts/agents/gemini-agent.js

@@ -22,6 +22,7 @@ const {
   emitReport,
   flushJsonLines,
   parseJsonLines,
+  persistStderr,
   writeResult
 } = require("./agent-adapter-core");
 
@@ -83,6 +84,7 @@ child.stderr.on("data", (chunk) => {
 
 child.on("error", (error) => {
   render.finishLive();
+  persistStderr(resultPath, `gemini spawn failed: ${error.message}`);
   process.stderr.write(`gemini spawn failed: ${error.message}\n`);
   process.exit(1);
 });
@@ -93,23 +95,29 @@ child.on("close", (code) => {
   render.writeTranscript(transcriptPath);
   if (code !== 0) {
     const detail = childStderr.trim() || `gemini exited ${code === null ? "(timeout/killed)" : code}`;
+    persistStderr(resultPath, detail);
     process.stderr.write(`${detail}\n`);
     process.exit(code === null ? 1 : code);
   }
   if (state.invalidJson) {
-    process.stderr.write("gemini --output-format stream-json produced a non-JSONL stdout line - refusing to trust the result\n");
+    const detail = "gemini --output-format stream-json produced a non-JSONL stdout line - refusing to trust the result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
   const resultText = state.finalResult || state.textFragments.join("\n\n");
   if (!resultText.trim()) {
-    process.stderr.write("gemini produced no result text - refusing to fabricate a result\n");
+    const detail = "gemini produced no result text - refusing to fabricate a result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
   try {
     writeResult(resultPath, resultText);
   } catch (error) {
+    persistStderr(resultPath, `gemini produced no final result: ${error.message}`);
     process.stderr.write(`gemini produced no final result: ${error.message}\n`);
     process.exit(1);
   }

package/scripts/agents/opencode-agent.js

@@ -27,6 +27,7 @@ const {
   emitReport,
   flushJsonLines,
   parseJsonLines,
+  persistStderr,
   writeResult
 } = require("./agent-adapter-core");
 
@@ -136,6 +137,7 @@ child.stderr.on("data", (chunk) => {
 
 child.on("error", (error) => {
   render.finishLive();
+  persistStderr(resultPath, `opencode spawn failed: ${error.message}`);
   process.stderr.write(`opencode spawn failed: ${error.message}\n`);
   process.exit(1);
 });
@@ -146,23 +148,29 @@ child.on("close", (code) => {
   render.writeTranscript(transcriptPath);
   if (code !== 0) {
     const detail = childStderr.trim() || `opencode exited ${code === null ? "(timeout/killed)" : code}`;
+    persistStderr(resultPath, detail);
     process.stderr.write(`${detail}\n`);
     process.exit(code === null ? 1 : code);
   }
   if (state.invalidJson) {
-    process.stderr.write("opencode --format json produced a non-JSONL stdout line - refusing to trust the result\n");
+    const detail = "opencode --format json produced a non-JSONL stdout line - refusing to trust the result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
   const resultText = state.finalResult || state.lastMessageText || state.textFragments.join("\n\n");
   if (!resultText.trim()) {
-    process.stderr.write("opencode produced no result text - refusing to fabricate a result\n");
+    const detail = "opencode produced no result text - refusing to fabricate a result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
   try {
     writeResult(resultPath, resultText);
   } catch (error) {
+    persistStderr(resultPath, `opencode produced no final result: ${error.message}`);
     process.stderr.write(`opencode produced no final result: ${error.message}\n`);
     process.exit(1);
   }

package/scripts/bump-version.js

@@ -79,6 +79,16 @@ function main() {
   const lock = path.join(pluginRoot, "package-lock.json");
   if (fs.existsSync(lock) && replaceFirstVersionField(lock, next)) note("package-lock.json");
 
+  // 2b. Official MCP Registry server metadata (top-level server version + npm package version).
+  const serverJson = path.join(pluginRoot, "server.json");
+  if (fs.existsSync(serverJson)) {
+    const json = JSON.parse(fs.readFileSync(serverJson, "utf8"));
+    json.version = next;
+    if (json.packages && json.packages[0]) json.packages[0].version = next;
+    fs.writeFileSync(serverJson, `${JSON.stringify(json, null, 2)}\n`);
+    note("server.json");
+  }
+
   // 3. src/version.ts runtime constant
   const versionTs = path.join(pluginRoot, "src", "version.ts");
   const vtsText = fs.readFileSync(versionTs, "utf8");

package/scripts/canonical-apps.js

@@ -83,7 +83,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.1.94",
+      "Cool Workflow v0.1.96",
       "--freshness",
       "as of release preparation"
     ]
@@ -117,14 +117,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.1.94");
+    assert.equal(summary.version, "0.1.96");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.1.94");
+    assert.equal(shown.app.version, "0.1.96");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -135,7 +135,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.1.94");
+    assert.equal(state.workflow.app.version, "0.1.96");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);

package/scripts/dogfood-release.js

@@ -6,7 +6,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { CoolWorkflowRunner } = require("../dist/orchestrator.js");
 
-const TARGET_VERSION = "0.1.94";
+const TARGET_VERSION = "0.1.96";
 const PREVIOUS_VERSION = "0.1.31";
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");

package/scripts/golden-path.js

@@ -33,7 +33,7 @@ function main() {
     const appValidation = runJson(["app", "validate", "end-to-end-golden-path"], pluginRoot);
     assert.equal(appValidation.valid, true);
     assert.equal(appValidation.summary.id, "end-to-end-golden-path");
-    assert.equal(appValidation.summary.version, "0.1.94");
+    assert.equal(appValidation.summary.version, "0.1.96");
 
     const plan = runJson(
       [
@@ -42,7 +42,7 @@ function main() {
         "--repo",
         tmp,
         "--question",
-        "Prove the deterministic v0.1.94 end-to-end golden path."
+        "Prove the deterministic v0.1.96 end-to-end golden path."
       ],
       pluginRoot
     );
@@ -52,7 +52,7 @@ function main() {
 
     let state = readJson(plan.statePath);
     assert.equal(state.workflow.app.id, "end-to-end-golden-path");
-    assert.equal(state.workflow.app.version, "0.1.94");
+    assert.equal(state.workflow.app.version, "0.1.96");
     assert.equal(state.loopStage, "interpret");
 
     const dispatch = runJson(["dispatch", plan.runId, "--limit", "1", "--sandbox", "readonly"], tmp);
@@ -195,7 +195,7 @@ function main() {
     assert.equal(reportPath, plan.reportPath);
     assert.ok(fs.existsSync(reportPath));
     const report = fs.readFileSync(reportPath, "utf8");
-    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.94/);
+    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.96/);
     assert.match(report, /## Candidates/);
     assert.match(report, /## Trust Audit/);
     assert.match(report, /## Acceptance Rationale/);

package/scripts/release-check.js

@@ -7,6 +7,7 @@ const path = require("node:path");
 
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");
+const skipTests = process.argv.includes("--skip-tests") || process.env.CW_RELEASE_CHECK_SKIP_TESTS === "1";
 const checks = [
   {
     name: "docs presence",
@@ -87,6 +88,11 @@ function main() {
     process.stdout.write(`release:check ${check.name} ... `);
     const started = Date.now();
     try {
+      if (skipTests && check.name === "tests") {
+        results.push({ name: check.name, ok: true, skipped: true, elapsedMs: 0 });
+        process.stdout.write("skipped\n");
+        continue;
+      }
       if (check.run) check.run();
       else runCommand(check.command);
       const elapsedMs = Date.now() - started;
@@ -103,7 +109,7 @@ function main() {
   const failed = results.filter((entry) => !entry.ok);
   process.stdout.write("\nRelease Check Summary\n");
   for (const result of results) {
-    process.stdout.write(`- ${result.ok ? "PASS" : "FAIL"} ${result.name}\n`);
+    process.stdout.write(`- ${result.skipped ? "SKIP" : result.ok ? "PASS" : "FAIL"} ${result.name}\n`);
   }
   process.stdout.write(`\nDry-run only: no tag, push, publish, or fixture mutation was requested.\n`);
   if (failed.length > 0) {

package/scripts/release-flow.js

@@ -185,6 +185,11 @@ function buildReviewerInput(resultPath) {
     "or:",
     "  REJECTED",
     "  <numbered gate failures with file:line references>",
+    "",
+    "If your host wrapper asks for Markdown, JSON, or a fenced result block, still put",
+    "the exact APPROVED/REJECTED verdict line above as a standalone line outside any",
+    "prose or code fence. The release tool extracts only strict standalone verdict",
+    "lines; prose such as 'Verdict: APPROVED' is not trusted.",
     ""
   ].join("\n");
 }
@@ -250,14 +255,28 @@ function delegateReview(resultPath, inputPath) {
   };
 
   if (cfg.command) {
-    const args = (cfg.args || []).map((a) => substitute(a, subMap));
-    say(`[2/3] reviewer — delegating to: ${cfg.command} ${(cfg.args || []).join(" ")} (model: ${cfg.model || "unreported"})`);
+    // cfg.command can arrive as a SINGLE unsplit multi-token string. A
+    // builtin:<vendor> template (CW_AGENT_COMMAND=builtin:claude) expands to
+    // "node /abs/claude-p-agent.js {{input}} {{result}}" with cfg.args undefined,
+    // and a durable agent-config.json command field is read verbatim (no split).
+    // Split it on whitespace into binary + inline args — the SAME way the
+    // orchestrator does (src/execution-backend/agent.ts resolveAgentInvocation) —
+    // so we spawn the real binary, never one literally named
+    // "node /abs/... {{input}}" (an instant ENOENT the old code mislabeled as a
+    // timeout). An explicit cfg.args array still follows the inline args. A plain
+    // CW_AGENT_COMMAND="claude -p {{input}}" is already pre-split by
+    // resolveAgentConfig, so this leaves it unchanged (no inline args).
+    const parts = cfg.command.split(/\s+/).filter(Boolean);
+    const bin = parts[0];
+    const argTemplate = [...parts.slice(1), ...(cfg.args || [])];
+    const args = argTemplate.map((a) => substitute(a, subMap));
+    say(`[2/3] reviewer — delegating to: ${bin} ${argTemplate.join(" ")} (model: ${cfg.model || "unreported"})`);
     // RED LINE: argv-style, shell:false. The agent runs the model in its own
     // process and inherits its own credentials; CW holds none.
     // Capture stdout so agents that print verdicts (rather than writing the
     // result file) are supported. Agents that DO write the file still work:
     // the file takes precedence. stderr goes to the terminal for live output.
-    const r = spawnSync(cfg.command, args, {
+    const r = spawnSync(bin, args, {
       cwd: repoRoot,
       env: { ...process.env },
       encoding: "utf8",
@@ -266,6 +285,10 @@ function delegateReview(resultPath, inputPath) {
       stdio: ["ignore", "pipe", "inherit"],
       maxBuffer: 32 * 1024 * 1024
     });
+    // A spawn that never started (ENOENT for a missing binary, ETIMEDOUT on the
+    // deadline) sets r.error — surface its real message instead of the old
+    // catch-all "(timeout/no-exit)" that hid the builtin: ENOENT for so long.
+    if (r.error) die(`reviewer agent could not be spawned (${bin}): ${r.error.message} — no verdict trusted.`);
     if (r.status !== 0) die(`reviewer agent exited ${r.status === null ? "(timeout/no-exit)" : r.status} — no verdict trusted.`);
     // If the agent already wrote the verdict file (backward compat), use it.
     // Otherwise extract the verdict from stdout (headless agent path).
@@ -316,6 +339,14 @@ function verifyVerdict(resultPath) {
   const lines = text.split(/\r?\n/);
   const firstLine = lines[0] || "";
   if (firstLine !== `APPROVED ${HEAD}`) {
+    if (firstLine.toUpperCase() !== "REJECTED") {
+      const normalized = extractVerdictFromStdout(text, resultPath);
+      if (normalized && normalized.split(/\r?\n/)[0] === `APPROVED ${HEAD}`) {
+        fs.writeFileSync(resultPath, `${normalized}\n`);
+        const normalizedLines = normalized.split(/\r?\n/);
+        return (normalizedLines[1] || "").trim();
+      }
+    }
     die(`verdict first line must be exactly "APPROVED ${HEAD}" — release blocked.`, text.trim());
   }
   const cap = (lines[1] || "").trim();
@@ -472,6 +503,16 @@ function cut(resultPath, capability) {
   if (bump.status !== 0) die("bump:version failed");
   // Regenerate the gated project index after the version bump (PR #87 gate).
   spawnSync("npm", ["run", "sync:project-index", "--", "--repo-only"], { cwd: pluginRoot, stdio: "inherit" });
+  // Belt-and-suspenders: the reviewer agent writes a narration transcript into
+  // .cw-release/ that may carry local paths (the operator's home dir). It is
+  // .gitignored, but `git add -A` would still stage it if it were ever tracked,
+  // and a tracked transcript leaks PII into the immutable tag commit (it tripped
+  // pii-redaction-smoke and red-failed release-gate for v0.1.96). Remove any
+  // transcript before staging so it can never ride into the tag.
+  const releaseDir = path.join(repoRoot, ".cw-release");
+  for (const f of fs.existsSync(releaseDir) ? fs.readdirSync(releaseDir) : []) {
+    if (/^transcript.*\.md$/.test(f)) fs.rmSync(path.join(releaseDir, f), { force: true });
+  }
   git(["add", "-A"]);
   const commit = git(["commit", "-m", `chore(release): record APPROVED reviewer verdict for v${cutVersion}`]);
   if (commit.code !== 0) die("verdict commit failed", commit.err);

package/scripts/release-gate.sh

@@ -30,7 +30,7 @@ say "[1/6] build"
 npm run --prefix plugins/cool-workflow build >/dev/null 2>&1 || fail "build failed"
 
 say "[2/6] tests"
-CW_TEST_CONCURRENCY=1 npm test --prefix plugins/cool-workflow >/dev/null 2>&1 || fail "tests failed"
+CW_TEST_CONCURRENCY=1 npm run test:gate --prefix plugins/cool-workflow >/dev/null 2>&1 || fail "tests failed"
 
 if [[ -n "$PREV_TAG" ]]; then
   RANGE="$PREV_TAG..HEAD"

package/scripts/version-sync-check.js

@@ -60,6 +60,8 @@ function main() {
   // uses `npm install --no-package-lock`), so only validate it when present.
   checkJsonIfPresent("plugins/cool-workflow/package-lock.json", "version", VERSION, checks);
   checkJson("plugins/cool-workflow/.codex-plugin/plugin.json", "version", VERSION, checks);
+  checkJson("plugins/cool-workflow/server.json", "version", VERSION, checks);
+  checkNestedJson("plugins/cool-workflow/server.json", ["packages", 0, "version"], VERSION, checks);
   checkNestedJson("plugins/cool-workflow/manifest/plugin.manifest.json", ["identity", "version"], VERSION, checks);
   checkJson("plugins/cool-workflow/.claude-plugin/plugin.json", "version", VERSION, checks);
   checkJson("plugins/cool-workflow/.gemini-plugin/plugin.json", "version", VERSION, checks);