cool-workflow 0.1.95 → 0.1.97

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cool-workflow",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
-  "version": "0.1.95",
+  "version": "0.1.97",
   "author": {
     "name": "COOLWHITE LLC"
   },

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.1.95",
+  "version": "0.1.97",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
   "author": {
     "name": "COOLWHITE LLC"

package/apps/architecture-review/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review",
   "title": "Architecture Review",
   "summary": "Map a repository architecture, assess risks, verify important findings, and synthesize an evidence-backed verdict.",
-  "version": "0.1.95",
+  "version": "0.1.97",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/architecture-review/workflow.js

@@ -1,4 +1,4 @@
-module.exports = ({ workflow, phase, agent, artifact, input }) => {
+module.exports = ({ workflow, phase, parallel, agent, artifact, input }) => {
   const inputs = [
     input("repo", {
       type: "path",
@@ -33,7 +33,7 @@ module.exports = ({ workflow, phase, agent, artifact, input }) => {
     inputs,
     sandboxProfiles: ["readonly"],
     phases: [
-      phase("Map", [
+      parallel("Map", [
         agent(
           "map:server-api",
           "Map server/API entrypoints, request flows, service boundaries, auth surfaces, and owned state in {{repo}} for {{question}}. Focus: {{focus}}. Invariants: {{invariant}}. Return inspected files, dependencies, invariants, and candidate risks.",
@@ -65,7 +65,7 @@ module.exports = ({ workflow, phase, agent, artifact, input }) => {
           { sandboxProfileId: "readonly" }
         )
       ]),
-      phase("Assess", [
+      parallel("Assess", [
         agent(
           "assess:security",
           "Assess mapper findings through a security lens. Separate real, conditional, non-issue, and unknown risks with evidence, falsifiers, and exact files or config keys.",

package/apps/architecture-review-fast/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review-fast",
   "title": "Architecture Review Fast",
   "summary": "Run a shorter architecture review with parallel map and assess phases for faster first results.",
-  "version": "0.1.95",
+  "version": "0.1.97",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/end-to-end-golden-path/app.json

@@ -3,7 +3,7 @@
   "id": "end-to-end-golden-path",
   "title": "End-to-End Golden Path",
   "summary": "Deterministic one-worker workflow app for proving the CW integration chain.",
-  "version": "0.1.95",
+  "version": "0.1.97",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/pr-review-fix-ci/app.json

@@ -3,7 +3,7 @@
   "id": "pr-review-fix-ci",
   "title": "PR Review Fix CI",
   "summary": "Review a pull request or branch, inspect CI failures, diagnose actionable issues, optionally patch, verify, and summarize with evidence.",
-  "version": "0.1.95",
+  "version": "0.1.97",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/release-cut/app.json

@@ -3,7 +3,7 @@
   "id": "release-cut",
   "title": "Release Cut",
   "summary": "Prepare a release with checklist discipline: version checks, changelog, tests, packaging, release notes, and final verification.",
-  "version": "0.1.95",
+  "version": "0.1.97",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/research-synthesis/app.json

@@ -3,7 +3,7 @@
   "id": "research-synthesis",
   "title": "Research Synthesis",
   "summary": "Split a research question into claims, investigate sources, cross-check evidence, verify claims, and synthesize a concise answer.",
-  "version": "0.1.95",
+  "version": "0.1.97",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/dist/agent-config.js

@@ -31,6 +31,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const run_registry_1 = require("./run-registry");
 const execution_backend_1 = require("./execution-backend");
+const state_1 = require("./state");
 exports.AGENT_CONFIG_SCHEMA_VERSION = 1;
 function agentConfigPath(env = process.env) {
     return node_path_1.default.join((0, run_registry_1.resolveCwHome)(env), "agent-config.json");
@@ -260,7 +261,7 @@ function setAgentConfigFile(patch, env = process.env) {
     const stored = redacted(merged);
     const file = agentConfigPath(env);
     node_fs_1.default.mkdirSync(node_path_1.default.dirname(file), { recursive: true });
-    node_fs_1.default.writeFileSync(file, `${JSON.stringify(stored, null, 2)}\n`, "utf8");
+    (0, state_1.writeJson)(file, stored);
     return stored;
 }
 /** Read-only, deterministic projection of the effective config (secret-stripped).

package/dist/candidate-scoring.js

@@ -115,7 +115,7 @@ function getCandidate(run, candidateId) {
     // Fail-closed integrity boundary (F4/F5): validate the parsed record against
     // its type def BEFORE upserting it as a trusted CandidateRecord. A corrupt or
     // forged candidate.json must throw here rather than flow into the run.
-    const candidate = (0, validation_1.validateCandidateRecord)(JSON.parse(node_fs_1.default.readFileSync(file, "utf8")));
+    const candidate = (0, validation_1.validateCandidateRecord)((0, state_1.readJson)(file));
     upsertCandidate(run, candidate);
     return candidate;
 }
@@ -537,7 +537,7 @@ function loadCandidatesFromDisk(run) {
         // Fail-closed integrity boundary (F4/F5): each candidate.json is validated
         // against CandidateRecord before it merges into the run; a corrupt record
         // throws rather than entering the candidate set as a trusted cast.
-        .map((file) => (0, validation_1.validateCandidateRecord)(JSON.parse(node_fs_1.default.readFileSync(file, "utf8"))));
+        .map((file) => (0, validation_1.validateCandidateRecord)((0, state_1.readJson)(file)));
 }
 function readScores(run, candidateId) {
     const dir = node_path_1.default.join(candidateDir(run, candidateId), "scores");
@@ -550,7 +550,7 @@ function readScores(run, candidateId) {
         // Fail-closed integrity boundary (F4/F5): a score file is validated against
         // CandidateScore before it can feed ranking/selection. A corrupt score must
         // throw, not silently widen the normalized/verdict surface the gate reads.
-        .map((file) => (0, validation_1.validateCandidateScore)(JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(dir, file), "utf8"))));
+        .map((file) => (0, validation_1.validateCandidateScore)((0, state_1.readJson)(node_path_1.default.join(dir, file))));
 }
 function candidateArtifacts(run, candidate) {
     return [

package/dist/capability-core.js

@@ -288,7 +288,12 @@ function runExportArchive(runner, runId, args) {
     // offline. Default falls back to the same env the verify gate reads, so a single
     // configured key both attests at record-time and travels with the export.
     const trustPublicKey = optionalString(args["with-trust-key"] || args.withTrustKey || args.trustKey || args.pubkey) || process.env.CW_AGENT_ATTEST_PUBKEY;
-    return (0, run_export_1.exportRun)(runner.withBaseDir(optionalString(args.cwd)).loadRun(runId), node_path_1.default.resolve(base, output), { trustPublicKey });
+    const resolvedOutput = node_path_1.default.resolve(base, output);
+    const sysDirs = /^\/(etc|bin|sbin|usr|Library|System|Applications|boot|dev|proc|sys|root|var\/log|var\/run)\//;
+    if (sysDirs.test(resolvedOutput)) {
+        throw new Error(`Refusing to write archive to a system directory: ${output}`);
+    }
+    return (0, run_export_1.exportRun)(runner.withBaseDir(optionalString(args.cwd)).loadRun(runId), resolvedOutput, { trustPublicKey });
 }
 function runImportArchive(runner, args) {
     const base = invocationCwd(args);

package/dist/cli/handlers/scheduling.js

@@ -77,7 +77,13 @@ function handleRoutine(args, triggers) {
             return;
         case "fire": {
             const kind = (0, io_1.required)(idOrKind, "trigger kind");
-            const payload = payloadPath ? JSON.parse(node_fs_1.default.readFileSync(payloadPath, "utf8")) : args.options;
+            let payload;
+            try {
+                payload = payloadPath ? JSON.parse(node_fs_1.default.readFileSync(payloadPath, "utf8")) : args.options;
+            }
+            catch (e) {
+                throw new Error(`Failed to parse payload${payloadPath ? ` file "${payloadPath}"` : ""}: ${String(e && e.message || e)}`);
+            }
             (0, io_1.printJson)(triggers.fire(kind, payload));
             return;
         }

package/dist/dispatch.js

@@ -202,15 +202,16 @@ function formatDispatchTask(task) {
     };
 }
 // Deterministic dispatch id (replay-determinism self-audit): the wall-clock stamp
-// is an edge timestamp (stripped on replay), but the former Math.random() suffix
-// made every dispatch mint a non-reproducible id. The suffix is now a per-run
-// sequence — the count of dispatches already allocated on this run — so re-running
-// the same workflow yields byte-identical dispatch ids while each dispatch within a
-// run still gets a distinct, monotonically increasing id. Mirrors the de-clock done
-// for worker ids in src/worker-isolation/paths.ts.
+// is an edge timestamp for human readability. Set CW_DETERMINISTIC_RUN_IDS=1 to
+// use a content-hash-based id without wall-clock, so re-running the same workflow
+// yields byte-identical dispatch ids. The suffix is a per-run sequence, so each
+// dispatch still gets a distinct, monotonically increasing id.
 function createDispatchId(run) {
     const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "Z");
     const seq = (run.dispatches?.length || 0) + 1;
+    if (/^(1|true|yes|on)$/i.test(process.env.CW_DETERMINISTIC_RUN_IDS || "")) {
+        return `dispatch-${String(seq).padStart(4, "0")}`;
+    }
     return `dispatch-${stamp}-${String(seq).padStart(4, "0")}`;
 }
 // H7: persist a CUSTOM sandbox profile DEFINITION (loaded from a FILE at dispatch)
@@ -240,5 +241,10 @@ function persistCustomSandboxProfile(run, requested) {
     if (!definition || typeof definition !== "object" || typeof definition.id !== "string" || !definition.id)
         return;
     run.customSandboxProfiles = run.customSandboxProfiles || {};
+    const previous = run.customSandboxProfiles[definition.id];
+    if (previous && JSON.stringify(previous) !== JSON.stringify(definition)) {
+        throw new Error(`Sandbox profile id collision: "${definition.id}" is already defined by a different custom profile ` +
+            `(source: ${absolute}). Use a unique id in each custom profile file.`);
+    }
     run.customSandboxProfiles[definition.id] = definition;
 }

package/dist/drive.js

@@ -475,6 +475,16 @@ function prepareConcurrentOutcomes(ctx, batch) {
             continue;
         const job = (0, execution_backend_1.prepareAgentSpawn)(buildAgentRequest(ctx, run, task, manifest));
         if (job) {
+            const sandboxPolicy = manifest.sandboxPolicy;
+            if (sandboxPolicy) {
+                const filteredEnv = (0, execution_backend_1.buildChildEnv)(sandboxPolicy);
+                for (const key of Object.keys(process.env)) {
+                    if (/^(CW_|ANTHROPIC_|OPENAI_|GEMINI_|DEEPSEEK_|CODEX_|GOOGLE_|COHERE_|MISTRAL_|OLLAMA_|AZURE_|AWS_)/i.test(key)) {
+                        filteredEnv[key] = process.env[key];
+                    }
+                }
+                job.env = filteredEnv;
+            }
             jobs.push(job);
             jobTaskIds.push(taskId);
         }

package/dist/evidence-grounding.js

@@ -27,15 +27,14 @@ const node_path_1 = __importDefault(require("node:path"));
 // are all legitimate — so we cannot require "must be a file that exists" by
 // default without breaking cross-repo, URL, and runtime-token evidence. Instead:
 //
-//  1. DEFAULT (pure, deterministic): require evidence to be GROUNDED — a URL, a
-//     path-like locator, or a `namespace:value` token. This rejects bare prose
-//     ("x", "anything", "HIGH severity") while accepting every shape CW itself
-//     emits. Being a pure function of the string, it is replay-safe.
+//  1. DEFAULT: require evidence to be GROUNDED — a URL, a path-like locator, or
+//     a `namespace:value` token. This rejects bare prose ("x", "anything",
+//     "HIGH severity") while accepting every shape CW itself emits. Being a pure
+//     function of the string, it is replay-safe.
 //
-//  2. OPT-IN (CW_REQUIRE_RESOLVABLE_EVIDENCE=1): additionally resolve path-like
-//     locators against the run's base dirs and fail closed if a file locator does
-//     not exist on disk. Off by default because the resolving cwd is context-
-//     dependent; on for self-audit / compliance where evidence MUST be checkable.
+//  2. DEFAULT (v0.1.95): file-style evidence locators MUST also exist on disk.
+//     CW_REQUIRE_RESOLVABLE_EVIDENCE=0 restores the prior shape-only behavior.
+//     CW_REQUIRE_RESOLVABLE_EVIDENCE=url additionally requires URL reachability.
 // ---------------------------------------------------------------------------
 const URL_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
 const PATH_SEP_RE = /[\\/]/;
@@ -63,14 +62,20 @@ function hasGroundedEvidence(evidence) {
     return Array.isArray(evidence) && evidence.some((entry) => isGroundedEvidence(entry));
 }
 /** Whether opt-in strict resolution is requested via the environment.
- *  Set CW_REQUIRE_RESOLVABLE_EVIDENCE=1 for file resolution, =url for
- *  URL reachability checks too (v0.1.63). */
+ *  Enabled by DEFAULT (v0.1.95): file-style evidence locators MUST exist on disk.
+ *  Set CW_REQUIRE_RESOLVABLE_EVIDENCE=0 to restore the prior shape-only check.
+ *  Set CW_REQUIRE_RESOLVABLE_EVIDENCE=url for URL reachability checks too. */
 function requireResolvableEvidence() {
-    return /^(1|true|yes|on)$/i.test(process.env.CW_REQUIRE_RESOLVABLE_EVIDENCE || "");
+    const raw = process.env.CW_REQUIRE_RESOLVABLE_EVIDENCE;
+    if (raw === undefined || raw === null || raw === "")
+        return true;
+    if (/^(0|false|no|off)$/i.test(raw))
+        return false;
+    return true;
 }
-/** Whether URL reachability checks are enabled in strict mode (v0.1.63). */
+/** Whether URL reachability checks are enabled (v0.1.63). Always opt-in. */
 function requireUrlReachability() {
-    return requireResolvableEvidence() || /url/i.test(process.env.CW_REQUIRE_RESOLVABLE_EVIDENCE || "");
+    return /url/i.test(process.env.CW_REQUIRE_RESOLVABLE_EVIDENCE || "");
 }
 function classify(raw) {
     const value = raw.trim();

package/dist/execution-backend/agent.js

@@ -276,7 +276,7 @@ function runAgentBatchOutcomes(jobs) {
     const child = (0, node_child_process_1.spawnSync)(process.execPath, [BATCH_DELEGATE_CHILD_SCRIPT], {
         input: JSON.stringify(jobs),
         encoding: "utf8",
-        maxBuffer: 33 * 1024 * 1024 * jobs.length,
+        maxBuffer: Math.min(33 * 1024 * 1024 * jobs.length, 512 * 1024 * 1024),
         timeout: maxTimeout + 30000
     });
     if (!child.error && typeof child.status === "number" && child.status === 0) {

package/dist/execution-backend/probes.js

@@ -22,6 +22,7 @@ exports.probeAgentBackend = probeAgentBackend;
 //
 // Readiness probe. Deterministic given the host (PATH + configured env).
 const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
 const util_1 = require("./util");
 function probeNodeBackend() {
     const ok = (0, util_1.hasExecutable)("node");
@@ -63,20 +64,35 @@ function probeContainerBackend() {
         reason: docker || podman ? undefined : "no container runtime (docker/podman) found; supply --image to delegate explicitly"
     };
 }
+function delegateChildExists() {
+    return node_fs_1.default.existsSync(node_path_1.default.resolve(__dirname, "..", "..", "scripts", "children", "http-delegate-child.js"));
+}
 function probeRemoteBackend() {
     const endpoint = (process.env.CW_REMOTE_ENDPOINT || "").trim();
+    const scriptOk = delegateChildExists();
+    const checks = [
+        { name: "endpoint", ok: Boolean(endpoint), detail: endpoint ? "CW_REMOTE_ENDPOINT configured" : "CW_REMOTE_ENDPOINT not set" },
+        { name: "delegate-child-script", ok: scriptOk, detail: scriptOk ? "http-delegate-child.js found" : "http-delegate-child.js missing — reinstall cool-workflow" }
+    ];
+    const readiness = !endpoint ? "unverified" : !scriptOk ? "unavailable" : "ready";
     return {
-        checks: [{ name: "endpoint", ok: Boolean(endpoint), detail: endpoint ? "CW_REMOTE_ENDPOINT configured" : "CW_REMOTE_ENDPOINT not set" }],
-        readiness: endpoint ? "ready" : "unverified",
-        reason: endpoint ? undefined : "no remote endpoint configured (set CW_REMOTE_ENDPOINT or pass --endpoint)"
+        checks,
+        readiness,
+        reason: readiness === "ready" ? undefined : !endpoint ? "no remote endpoint configured (set CW_REMOTE_ENDPOINT or pass --endpoint)" : "delegate child script is missing"
     };
 }
 function probeCiBackend() {
     const endpoint = (process.env.CW_CI_ENDPOINT || "").trim();
+    const scriptOk = delegateChildExists();
+    const checks = [
+        { name: "ci-endpoint", ok: Boolean(endpoint), detail: endpoint ? "CW_CI_ENDPOINT configured" : "CW_CI_ENDPOINT not set" },
+        { name: "delegate-child-script", ok: scriptOk, detail: scriptOk ? "http-delegate-child.js found" : "http-delegate-child.js missing — reinstall cool-workflow" }
+    ];
+    const readiness = !endpoint ? "unverified" : !scriptOk ? "unavailable" : "ready";
     return {
-        checks: [{ name: "ci-endpoint", ok: Boolean(endpoint), detail: endpoint ? "CW_CI_ENDPOINT configured" : "CW_CI_ENDPOINT not set" }],
-        readiness: endpoint ? "ready" : "unverified",
-        reason: endpoint ? undefined : "no CI job target configured (set CW_CI_ENDPOINT or pass --job)"
+        checks,
+        readiness,
+        reason: readiness === "ready" ? undefined : !endpoint ? "no CI job target configured (set CW_CI_ENDPOINT or pass --job)" : "delegate child script is missing"
     };
 }
 function probeAgentBackend() {

package/dist/execution-backend.js

@@ -38,6 +38,8 @@ exports.requiredSandboxDimensions = requiredSandboxDimensions;
 exports.attestSandbox = attestSandbox;
 exports.probeBackend = probeBackend;
 exports.runBackend = runBackend;
+exports.delegateChildScript = delegateChildScript;
+exports.shouldStreamAgentStderr = shouldStreamAgentStderr;
 exports.createExecutionBackend = createExecutionBackend;
 exports.backendListPayload = backendListPayload;
 exports.backendShowPayload = backendShowPayload;
@@ -404,12 +406,22 @@ function executeLocal(descriptor, policy, request, label, attestation) {
     // shell backend runs via /bin/sh -c; node/bun run the command directly
     // (bun is Node-compatible by default so evidence stays byte-stable with node).
     // spawnStyle comes from the registered driver, not a hardcoded id check.
+    const spawnStyle = getBackendDriver(descriptor.id)?.spawnStyle;
+    if (spawnStyle === "shell") {
+        // Shell injection guard: reject args that contain shell control characters
+        // (beyond template placeholders). The command itself is operator-configured.
+        const shellArg = [command, ...args].join(" ").replace(/\{\{[a-zA-Z0-9_.-]+\}\}/g, "");
+        if (/[;&|`$(){}<>!\n\r#*?~]/.test(shellArg)) {
+            throw new Error(`Shell backend refused: args contain shell control characters. ` +
+                `Use the node, bun, or agent backend instead for untrusted inputs.`);
+        }
+    }
     const isTTY = process.stderr.isTTY;
     const shortLabel = command.split("/").pop() || command;
     if (isTTY)
         process.stderr.write(`● Running ${shortLabel}...\n`);
     const startedAt = process.hrtime.bigint();
-    const result = getBackendDriver(descriptor.id)?.spawnStyle === "shell"
+    const result = spawnStyle === "shell"
         ? (0, node_child_process_1.spawnSync)([command, ...args].join(" "), { ...options, shell: true })
         : (0, node_child_process_1.spawnSync)(command, args, { ...options, shell: false });
     const elapsedMs = Number((process.hrtime.bigint() - startedAt) / 1000000n);
@@ -587,7 +599,17 @@ function runContainer(descriptor, policy, request, label, handle, attestation) {
 // portable and synchronous from CW's view. We spawn it BY PATH (shell:false). The
 // path is resolved from this compiled module (dist/execution-backend.js) up to the
 // package's `scripts/children/` dir, which package.json ships in "files".
-const HTTP_DELEGATE_CHILD_SCRIPT = node_path_1.default.resolve(__dirname, "..", "scripts", "children", "http-delegate-child.js");
+function delegateChildScript() {
+    const resolved = node_path_1.default.resolve(__dirname, "..", "scripts", "children", "http-delegate-child.js");
+    if (!node_fs_1.default.existsSync(resolved)) {
+        throw new Error(`Delegate child script not found at ${resolved}. ` +
+            `This indicates a broken installation — reinstall cool-workflow or ensure ` +
+            `"scripts/children/http-delegate-child.js" is shipped in the package.`);
+    }
+    return resolved;
+}
+/** The shared HTTP delegation child script path (resolved at import time). */
+const HTTP_DELEGATE_CHILD_SCRIPT = delegateChildScript();
 /** remote / ci — real HTTP delegation. POSTs the job to the configured endpoint
  *  (and polls a returned jobId) via a Node child, then records the runner's exit +
  *  stdout digest as canonical evidence. Fails closed when the endpoint is missing,
@@ -654,6 +676,25 @@ function runHttpDelegation(descriptor, policy, request, label, handle, attestati
 // agentSubstitutions, substituteAgentArg, recordedAgentHandle, extractEndpointResult,
 // agentHandle) and the concurrent batch live in ./execution-backend/agent.ts; the
 // stateful runners below build the refusal/delegated envelopes and stay here.
+/** Decide whether cw FORWARDS the agent wrapper's live stderr view (stdio
+ *  "inherit") or captures it ("pipe"). Default follows isTTY — interactive shows
+ *  the live view, a pipe/CI stays silent (Rule of Silence). The two env knobs are
+ *  explicit opt-out/opt-in, honored regardless of isTTY so a piped/CI run can still
+ *  opt into the wrapper's plain append-only trace, exactly as the man page promises
+ *  (agent-delegation-drive.7.md "Live output"):
+ *    CW_NO_STREAM=1    — master off (wins over everything)
+ *    CW_AGENT_STREAM=0 — off
+ *    CW_AGENT_STREAM=1 — on, even without a TTY
+ *  With no env set this returns isTTY — byte-identical to the prior inline gate (POLA). */
+function shouldStreamAgentStderr(env, isTTY) {
+    if (env.CW_NO_STREAM === "1")
+        return false;
+    if (env.CW_AGENT_STREAM === "0")
+        return false;
+    if (env.CW_AGENT_STREAM === "1")
+        return true;
+    return isTTY;
+}
 function runAgentProcess(descriptor, policy, request, label, handle, attestation) {
     const resolved = (0, agent_1.resolveAgentInvocation)(request);
     const subst = (0, agent_1.agentSubstitutions)(request, resolved.model);
@@ -671,13 +712,21 @@ function runAgentProcess(descriptor, policy, request, label, handle, attestation
             outcome = request.preparedAgentOutcome;
         }
         else {
-            // Live output on by default when stderr is a TTY. stdout is always
-            // captured as data. CI/pipes stay silent. CW_AGENT_STREAM=0 or
-            // CW_NO_STREAM=1 forces off; CW_AGENT_STREAM=1 forces on.
-            const streamStderr = process.env.CW_AGENT_STREAM !== "0" && Boolean(process.stderr.isTTY) && process.env.CW_NO_STREAM !== "1";
+            // Live output on by default when stderr is a TTY. stdout is always captured
+            // as data. CI/pipes stay silent unless CW_AGENT_STREAM=1 opts them into the
+            // wrapper's plain append-only trace; CW_AGENT_STREAM=0 / CW_NO_STREAM=1 force off.
+            const streamStderr = shouldStreamAgentStderr(process.env, Boolean(process.stderr.isTTY));
+            // Build child env from sandbox policy as baseline (respects env.inherit/expose/deny),
+            // then re-allow CW_* + well-known API key env vars the agent needs.
+            const childEnv = buildChildEnv(policy);
+            for (const key of Object.keys(process.env)) {
+                if (/^(CW_|ANTHROPIC_|OPENAI_|GEMINI_|DEEPSEEK_|CODEX_|GOOGLE_|COHERE_|MISTRAL_|OLLAMA_|AZURE_|AWS_)/i.test(key)) {
+                    childEnv[key] = process.env[key];
+                }
+            }
             const child = (0, node_child_process_1.spawnSync)(resolved.binary, realArgs, {
                 cwd: request.cwd,
-                env: { ...process.env },
+                env: childEnv,
                 encoding: "utf8",
                 timeout: resolved.timeoutMs || 600000,
                 maxBuffer: 32 * 1024 * 1024,
@@ -896,7 +945,11 @@ function runtimeNote(descriptor) {
 }
 // ---- Probe cache (v0.1.60) — mechanism, not policy -----------------------
 const _probeCache = new Map();
-const PROBE_CACHE_TTL_MS = 60_000; // 60s
+const PROBE_CACHE_TTL_MS = (() => {
+    const raw = process.env.CW_PROBE_CACHE_TTL_MS;
+    const n = raw ? parseInt(raw, 10) : 60_000;
+    return Number.isFinite(n) && n >= 0 ? n : 60_000;
+})(); // default 60s; set CW_PROBE_CACHE_TTL_MS=0 to disable
 function cachedProbeBackend(id, context) {
     const key = `${id}:${context.cwd || ''}`;
     const cached = _probeCache.get(key);

package/dist/mcp-server.js

@@ -35,6 +35,10 @@ function handleLine(line) {
         sendError(null, -32700, `Parse error: ${messageOf(error)}`);
         return;
     }
+    if (message === null || typeof message !== "object" || Array.isArray(message)) {
+        sendError(null, -32600, "Invalid Request: not a JSON-RPC object");
+        return;
+    }
     try {
         if (message.method === "initialize") {
             sendResult(message.id, {

package/dist/node-snapshot.js

@@ -38,7 +38,7 @@ const pipeline_runner_1 = require("./pipeline-runner");
 const state_1 = require("./state");
 const multi_agent_eval_1 = require("./multi-agent-eval");
 const node_projection_1 = require("./node-projection");
-const state_explosion_1 = require("./state-explosion");
+const fingerprint_1 = require("./util/fingerprint");
 const validation_1 = require("./validation");
 exports.NODE_SNAPSHOT_SCHEMA_VERSION = 1;
 /** Structured fail-closed error (mirrors the PipelineContractError shape). */
@@ -75,7 +75,7 @@ function snapshotBody(node) {
 /** RAW fingerprint (NOT normalized): any transition (updatedAt/status) or
  *  artifact/evidence change flips it, which is how drift is detected. */
 function sourceFingerprint(node) {
-    return (0, state_explosion_1.fingerprintStrings)([
+    return (0, fingerprint_1.fingerprintStrings)([
         `node:${node.id}:${node.status}:${node.updatedAt}`,
         ...node.artifacts.map((artifact) => `artifact:${artifact.id}:${artifact.path}`),
         ...node.evidence.map((evidence) => `evidence:${evidence.id}:${evidence.path || ""}`)
@@ -203,7 +203,7 @@ function replayNodeSnapshot(run, snapshot, options = {}) {
         throw new NodeSnapshotError(freshness === "stale" ? "snapshot-stale" : "snapshot-absent", reason || `cannot replay a ${freshness} snapshot of node ${snapshot.nodeId}`, { freshness, details: { runId: run.id, nodeId: snapshot.nodeId } });
     }
     const body = (0, multi_agent_eval_1.normalizeValue)(snapshot.body);
-    const outputFingerprint = (0, state_explosion_1.fingerprintStrings)([(0, multi_agent_eval_1.replayStableStringify)(body)]);
+    const outputFingerprint = (0, fingerprint_1.fingerprintStrings)([(0, multi_agent_eval_1.replayStableStringify)(body)]);
     const replay = {
         schemaVersion: 1,
         replayId: `replay-${snapshot.snapshotId}-${outputFingerprint.replace("sha256:", "").slice(0, 8)}`,

package/dist/onramp.js

@@ -386,6 +386,8 @@ function resolveBaseRef(root, changedFrom, env) {
     return verifyRef(root, "HEAD");
 }
 function verifyRef(root, ref) {
+    if (ref.startsWith("-"))
+        throw new Error(`Invalid onramp base ref (must not start with '-'): ${ref}`);
     const resolved = gitOne(root, ["rev-parse", "--verify", `${ref}^{commit}`]);
     if (!resolved)
         throw new Error(`Unknown onramp base ref: ${ref}`);

package/dist/orchestrator/app-operations.js

@@ -169,6 +169,12 @@ function initApp(appsDir, appId, options, resolveFromBase, validateApp) {
         throw new Error("App id must include at least one letter or digit");
     const title = String(options.title || titleize(id));
     const destinationDir = resolveFromBase(String(options.directory || options.output || node_path_1.default.join(appsDir, id)));
+    // Reject writes to system-owned directories. The operator may provide any
+    // output path, but writing to /etc, /bin, /usr etc. is never valid.
+    const sysDirs = /^\/(etc|bin|sbin|usr|Library|System|Applications|boot|dev|proc|sys|root|var\/log|var\/run)\//;
+    if (sysDirs.test(node_path_1.default.resolve(destinationDir))) {
+        throw new Error(`Refusing to create app in a system directory: ${destinationDir}`);
+    }
     const manifestPath = node_path_1.default.join(destinationDir, "app.json");
     const entrypointPath = node_path_1.default.join(destinationDir, "workflow.js");
     if (!options.force && (node_fs_1.default.existsSync(manifestPath) || node_fs_1.default.existsSync(entrypointPath))) {

package/dist/orchestrator/cli-options.js

@@ -112,8 +112,14 @@ function metadataOption(options) {
     const raw = options.metadata;
     if (raw && typeof raw === "object" && !Array.isArray(raw))
         return raw;
-    if (typeof raw === "string")
-        return JSON.parse(raw);
+    if (typeof raw === "string") {
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            throw new Error(`Invalid JSON in --metadata: ${String(raw).slice(0, 80)}`);
+        }
+    }
     return undefined;
 }
 function withoutHostRunKeys(args) {

package/dist/orchestrator/lifecycle-operations.js

@@ -228,6 +228,9 @@ function recordResult(run, taskId, resultPath, options = {}) {
     try {
         (0, verifier_1.assertTaskCanComplete)(run, task);
         const absoluteResultPath = node_path_1.default.resolve(resultPath);
+        if (/^\/(etc|bin|sbin|usr|Library|System|Applications|boot|dev|proc|sys|root|var\/log|var\/run)\//.test(absoluteResultPath)) {
+            throw new Error(`Result path must not be a system directory: ${resultPath}`);
+        }
         if (!node_fs_1.default.existsSync(absoluteResultPath)) {
             throw new Error(`Result file does not exist: ${absoluteResultPath}`);
         }
@@ -599,12 +602,20 @@ function renderPrompt(prompt, inputs) {
 // worker ids in src/worker-isolation/paths.ts.
 let runIdSequence = 0;
 function createRunId(workflowId) {
+    // Use process.pid + monotonic counter for uniqueness (no wall-clock),
+    // but keep a second-resolution stamp for human readability in the id.
     const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "Z");
-    // The stamp is second-resolution, so several runs of the same workflowId minted
-    // within one second would otherwise hash to the SAME id. process.pid + a monotonic
-    // counter break the tie across BOTH same-process (counter) and concurrent-process
-    // (pid) minting — deterministic-by-environment, not a PRNG, so it keeps the
-    // replay-determinism intent; the id is an edge stamp stripped on replay anyway.
+    // Set CW_DETERMINISTIC_RUN_IDS=1 to use a content hash instead of wall-clock,
+    // so two plan() calls with the same inputs produce the same id (replay-safe).
+    if (/^(1|true|yes|on)$/i.test(process.env.CW_DETERMINISTIC_RUN_IDS || "")) {
+        runIdSequence += 1;
+        const suffix = node_crypto_1.default
+            .createHash("sha256")
+            .update(`${workflowId}:${process.pid}:${runIdSequence}`)
+            .digest("hex")
+            .slice(0, 6);
+        return `${workflowId}-${suffix}`;
+    }
     runIdSequence += 1;
     const suffix = node_crypto_1.default
         .createHash("sha256")

package/dist/orchestrator/migration-operations.js

@@ -40,5 +40,5 @@ function loadMigrationSnapshot(target, options) {
         : node_path_1.default.join(process.cwd(), ".cw", "runs", target, "state.json");
     if (!node_fs_1.default.existsSync(file))
         throw new Error(`Migration target not found: ${target}`);
-    return { snapshot: JSON.parse(node_fs_1.default.readFileSync(file, "utf8")), contract, dir: node_path_1.default.dirname(file) };
+    return { snapshot: (0, state_1.readJson)(file), contract, dir: node_path_1.default.dirname(file) };
 }