cool-workflow 0.1.95 → 0.1.97

package/dist/orchestrator.js

@@ -56,6 +56,7 @@ const worker_isolation_1 = require("./worker-isolation");
 const sandbox_profile_1 = require("./sandbox-profile");
 const execution_backend_1 = require("./execution-backend");
 const operator_ux_1 = require("./operator-ux");
+const trust_audit_1 = require("./trust-audit");
 const multi_agent_1 = require("./multi-agent");
 const multi_agent_operator_ux_1 = require("./multi-agent-operator-ux");
 const multi_agent_eval_1 = require("./multi-agent-eval");
@@ -102,12 +103,29 @@ class CoolWorkflowRunner {
     // reads runs from disk per call (no in-memory run state), so withBaseDir hands back
     // a cheap scoped clone instead of mutating the global process cwd.
     baseDir;
+    // Per-request cache (v0.1.95): when set, loadRun memoizes by runId so the 17
+    // workbench sub-panels that each call loadRun independently share one read.
+    _requestCache;
     constructor({ pluginRoot, baseDir }) {
         this.pluginRoot = resolvePluginRoot(pluginRoot);
         this.workflowsDir = node_path_1.default.join(this.pluginRoot, "workflows");
         this.appsDir = node_path_1.default.join(this.pluginRoot, "apps");
         this.baseDir = baseDir ? node_path_1.default.resolve(baseDir) : undefined;
     }
+    /** Run fn with a per-request loadRun cache. All loadRun calls inside fn share
+     *  the same cached run state, collapsing 18 reads into 1. Returns fn's result
+     *  and clears the cache afterwards (never leaks between requests). */
+    loadWithCache(fn) {
+        this._requestCache = new Map();
+        (0, trust_audit_1.setAuditEventCache)(new Map());
+        try {
+            return fn(this);
+        }
+        finally {
+            this._requestCache = undefined;
+            (0, trust_audit_1.clearAuditEventCache)();
+        }
+    }
     /** Return a runner that resolves runs against `dir` instead of process.cwd(),
      *  WITHOUT chdir-ing the process (F7). Same instance when the dir is unchanged. */
     withBaseDir(dir) {
@@ -632,7 +650,14 @@ class CoolWorkflowRunner {
         return feedbackOps.resolveFeedback(this.loadRun(runId), feedbackId, options);
     }
     loadRun(runId) {
-        return (0, state_1.loadRunFromCwd)(runId, this.baseDir);
+        if (this._requestCache) {
+            const cached = this._requestCache.get(runId);
+            if (cached)
+                return cached;
+        }
+        const run = (0, state_1.loadRunFromCwd)(runId, this.baseDir);
+        this._requestCache?.set(runId, run);
+        return run;
     }
     invocationCwd() {
         return this.baseDir || process.cwd();

package/dist/reclamation.js

@@ -121,7 +121,10 @@ function loadReclamationLog(run) {
         return { schemaVersion: 1, runId: run.id, tombstones: [] };
     try {
         const parsed = JSON.parse(node_fs_1.default.readFileSync(file, "utf8"));
-        return { schemaVersion: 1, runId: run.id, tombstones: Array.isArray(parsed.tombstones) ? parsed.tombstones : [] };
+        if (!parsed || typeof parsed !== "object" || parsed.schemaVersion !== 1 || !Array.isArray(parsed.tombstones)) {
+            return { schemaVersion: 1, runId: run.id, tombstones: [] };
+        }
+        return { schemaVersion: 1, runId: run.id, tombstones: parsed.tombstones };
     }
     catch {
         // A malformed overlay must NOT brick the run — fail closed to an empty chain.
@@ -420,7 +423,10 @@ function planReclamation(run, policy = {}) {
                     catch {
                         continue; // unreadable snapshot → retain (fail closed)
                     }
-                    const node = (run.nodes || []).find((n) => n.id === snap.nodeId);
+                    if (!snap || typeof snap !== "object" || typeof snap.nodeId !== "string")
+                        continue;
+                    const nodeId = snap.nodeId;
+                    const node = (run.nodes || []).find((n) => n.id === nodeId);
                     if (!node)
                         continue; // source node gone → cannot reconstruct → retain
                     if (repointNodeIds.has(node.id))

package/dist/run-export.js

@@ -453,7 +453,16 @@ function verifyReportBundle(archivePath, options = {}) {
         }
         if (options.extractReportTo && reportContent !== undefined) {
             reportExtractedTo = node_path_1.default.resolve(options.extractReportTo);
-            node_fs_1.default.writeFileSync(reportExtractedTo, reportContent);
+            if (options.cwd) {
+                const baseCwd = node_path_1.default.resolve(options.cwd);
+                if (!(0, state_1.isContainedPath)(reportExtractedTo, baseCwd)) {
+                    failedChecks.push({ name: "extract-report", code: "path-outside-working-directory" });
+                    reportExtractedTo = undefined;
+                }
+            }
+            if (reportExtractedTo) {
+                node_fs_1.default.writeFileSync(reportExtractedTo, reportContent);
+            }
         }
     }
     catch (error) {

package/dist/run-registry/derive.js

@@ -164,7 +164,10 @@ function loadReclaimedFromDir(runDir) {
         return { schemaVersion: 1, runId: "", tombstones: [] };
     try {
         const parsed = JSON.parse(node_fs_1.default.readFileSync(file, "utf8"));
-        return { schemaVersion: 1, runId: parsed.runId || "", tombstones: Array.isArray(parsed.tombstones) ? parsed.tombstones : [] };
+        if (!parsed || typeof parsed !== "object" || parsed.schemaVersion !== 1 || !Array.isArray(parsed.tombstones)) {
+            return { schemaVersion: 1, runId: "", tombstones: [] };
+        }
+        return { schemaVersion: 1, runId: String(parsed.runId || ""), tombstones: parsed.tombstones };
     }
     catch {
         return { schemaVersion: 1, runId: "", tombstones: [] };

package/dist/sandbox-profile.js

@@ -132,7 +132,12 @@ function resolveSandboxProfileById(id, context = defaultSandboxContext()) {
     // This closes the gap where `sandbox validate` accepted a custom profile that
     // dispatch/worker-isolation then refused — validated but never enforceable.
     // A non-bundled, non-file id still fails closed via showBundledSandboxProfile.
-    const absolute = node_path_1.default.resolve(requested);
+    const absolute = node_path_1.default.resolve(context.cwd, requested);
+    if (!absolute.startsWith(node_path_1.default.resolve(context.cwd) + node_path_1.default.sep) && absolute !== node_path_1.default.resolve(context.cwd)) {
+        throw new SandboxProfileError("sandbox-profile-path-escape", `Custom profile path traversal denied: ${requested}`, {
+            details: { requested }
+        });
+    }
     if (node_fs_1.default.existsSync(absolute) && node_fs_1.default.statSync(absolute).isFile()) {
         const result = validateSandboxProfileFile(requested, context);
         if (!result.valid || !result.profile) {

package/dist/scheduler.js

@@ -274,21 +274,19 @@ function addJitter(date, jitterSeconds) {
     return new Date(date.getTime() + seconds * 1000);
 }
 // Deterministic schedule id (replay-determinism self-audit): the stamp is an edge
-// timestamp (recorded once), but the former Math.random() suffix made each
-// persisted schedule id non-reproducible. The suffix is now a content hash of the
-// schedule's deterministic identity (kind + the recorded stamp), so re-deriving the
-// id for a recorded schedule yields the byte-identical value while schedules created
-// at distinct instants still get distinct ids. Mirrors src/worker-isolation/paths.ts.
+// timestamp (recorded once). Set CW_DETERMINISTIC_RUN_IDS=1 to use a
+// content-hash-based id without wall-clock, so re-deriving the id for a recorded
+// schedule yields the byte-identical value. Distinct instants still get distinct
+// ids via the monotonic counter.
 let scheduleIdSequence = 0;
 function createScheduleId(kind) {
     const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "Z");
-    // Second-resolution stamp: two schedules of the same kind created within one
-    // second would otherwise collide on an identical id. process.pid + a monotonic
-    // counter break the tie across concurrent processes and within one process,
-    // deterministically (not a PRNG).
     scheduleIdSequence += 1;
-    const suffix = node_crypto_1.default.createHash("sha256").update(`${kind}:${stamp}:${process.pid}:${scheduleIdSequence}`).digest("hex").slice(0, 6);
-    return `${kind}-${stamp}-${suffix}`;
+    const deterministic = /^(1|true|yes|on)$/i.test(process.env.CW_DETERMINISTIC_RUN_IDS || "");
+    const suffix = node_crypto_1.default.createHash("sha256")
+        .update(deterministic ? `${kind}:${process.pid}:${scheduleIdSequence}` : `${kind}:${stamp}:${process.pid}:${scheduleIdSequence}`)
+        .digest("hex").slice(0, 6);
+    return deterministic ? `${kind}-${suffix}` : `${kind}-${stamp}-${suffix}`;
 }
 // Deterministic schedule-run (history) id — same rationale as createScheduleId. The
 // history record stamp differs from the owning schedule's, so the hashed identity
@@ -297,10 +295,12 @@ function createScheduleId(kind) {
 let scheduleRunIdSequence = 0;
 function createScheduleRunId(kind) {
     const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\..+/, "Z");
-    // pid + counter break same-kind/same-second collisions (see createScheduleId).
     scheduleRunIdSequence += 1;
-    const suffix = node_crypto_1.default.createHash("sha256").update(`run:${kind}:${stamp}:${process.pid}:${scheduleRunIdSequence}`).digest("hex").slice(0, 6);
-    return `run-${kind}-${stamp}-${suffix}`;
+    const deterministic = /^(1|true|yes|on)$/i.test(process.env.CW_DETERMINISTIC_RUN_IDS || "");
+    const suffix = node_crypto_1.default.createHash("sha256")
+        .update(deterministic ? `run:${kind}:${process.pid}:${scheduleRunIdSequence}` : `run:${kind}:${stamp}:${process.pid}:${scheduleRunIdSequence}`)
+        .digest("hex").slice(0, 6);
+    return deterministic ? `run-${kind}-${suffix}` : `run-${kind}-${stamp}-${suffix}`;
 }
 function requiredString(value, name) {
     const text = stringOption(value);

package/dist/schema-validate.js

@@ -12,8 +12,8 @@
 //   type (object|array|string|number|integer|boolean|null, or an array of them),
 //   enum, const, required, properties, additionalProperties (false), items.
 // Unsupported keywords ($ref, allOf/anyOf/oneOf, pattern, formats, numeric
-// bounds) are IGNORED — never silently "passed" as a constraint that wasn't
-// checked; a schema relying on them simply isn't enforced for those keywords.
+// bounds) are surfaced as WARNINGS (a constraint that wasn't checked), so the
+// operator can see their schema reliance is incomplete.
 // (If full JSON Schema is needed later, swap this module's impl for ajv behind
 // the same signature.)
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -52,6 +52,12 @@ function validateAgainstSchema(value, schema, path = "$") {
     const errors = [];
     if (!schema || typeof schema !== "object")
         return errors;
+    // Unsupported keywords — surface as diagnostics (Rule of Silence: stderr)
+    const UNSUPPORTED = new Set(["$ref", "allOf", "anyOf", "oneOf", "not", "pattern", "format", "minimum", "maximum", "minLength", "maxLength", "minItems", "maxItems", "uniqueItems", "contains", "if", "then", "else"]);
+    const unsupported = Object.keys(schema).filter((k) => UNSUPPORTED.has(k));
+    if (unsupported.length && process.stderr.isTTY) {
+        process.stderr.write(`[cw] schema at ${path}: unsupported keywords ignored: ${unsupported.join(", ")}\n`);
+    }
     // type
     if (schema.type !== undefined) {
         const types = Array.isArray(schema.type) ? schema.type.map(String) : [String(schema.type)];

package/dist/state-explosion/helpers.js

@@ -1,13 +1,9 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.fingerprintStrings = exports.fingerprintRecords = void 0;
 exports.isProtectedStatus = isProtectedStatus;
 exports.dominantStatus = dominantStatus;
 exports.parentMap = parentMap;
-exports.fingerprintRecords = fingerprintRecords;
-exports.fingerprintStrings = fingerprintStrings;
 exports.stableLine = stableLine;
 exports.sortKeys = sortKeys;
 exports.stripRunId = stripRunId;
@@ -15,14 +11,9 @@ exports.unique = unique;
 exports.byId = byId;
 exports.truncate = truncate;
 exports.slug = slug;
-// Pure, stateless helpers for the state-explosion derived-index layer —
-// status priority, fingerprinting, deterministic key-sorting, id/string
-// utilities. Carved out of state-explosion.ts (FreeBSD-audit god-module carve)
-// so the report/graph/digest builders no longer bundle the primitive helper
-// layer. Nothing here touches run state beyond its arguments; every function is
-// pure (`fingerprintStrings` is re-exported from state-explosion.ts to keep the
-// public surface byte-identical for importers).
-const node_crypto_1 = __importDefault(require("node:crypto"));
+const fingerprint_1 = require("../util/fingerprint");
+Object.defineProperty(exports, "fingerprintRecords", { enumerable: true, get: function () { return fingerprint_1.fingerprintRecords; } });
+Object.defineProperty(exports, "fingerprintStrings", { enumerable: true, get: function () { return fingerprint_1.fingerprintStrings; } });
 function isProtectedStatus(status) {
     return ["failed", "blocked", "rejected", "conflicting"].includes(status);
 }
@@ -41,14 +32,6 @@ function parentMap(edges) {
     }
     return parents;
 }
-function fingerprintRecords(records) {
-    return fingerprintStrings(records.map((r) => `${r.id}:${r.status || ""}`).sort());
-}
-function fingerprintStrings(values) {
-    const hash = node_crypto_1.default.createHash("sha256");
-    hash.update(JSON.stringify([...values].sort()));
-    return `sha256:${hash.digest("hex").slice(0, 32)}`;
-}
 function stableLine(value) {
     return JSON.stringify(sortKeys(value));
 }

package/dist/state-explosion/size.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_STATE_EXPLOSION_THRESHOLDS = exports.STATE_EXPLOSION_SCHEMA_VERSION = void 0;
+exports.computeStateSize = computeStateSize;
+exports.computeStateSizeWithGraph = computeStateSizeWithGraph;
+const multi_agent_operator_ux_1 = require("../multi-agent-operator-ux");
+exports.STATE_EXPLOSION_SCHEMA_VERSION = 1;
+exports.DEFAULT_STATE_EXPLOSION_THRESHOLDS = {
+    graphNodes: 40,
+    graphEdges: 60,
+    blackboardMessages: 25,
+    blackboardRecords: 40,
+    collapseBucket: 6,
+    totalRecords: 80
+};
+function computeStateSize(run, thresholds = exports.DEFAULT_STATE_EXPLOSION_THRESHOLDS) {
+    return computeStateSizeWithGraph(run, thresholds, (0, multi_agent_operator_ux_1.buildMultiAgentOperatorGraph)(run));
+}
+function computeStateSizeWithGraph(run, thresholds, graph) {
+    const ma = run.multiAgent || { runs: [], roles: [], groups: [], memberships: [], fanouts: [], fanins: [] };
+    const bb = run.blackboard || { topics: [], messages: [], contexts: [], artifacts: [], snapshots: [], decisions: [] };
+    const counts = {
+        multiAgentRuns: (ma.runs || []).length,
+        roles: (ma.roles || []).length,
+        groups: (ma.groups || []).length,
+        memberships: (ma.memberships || []).length,
+        fanouts: (ma.fanouts || []).length,
+        fanins: (ma.fanins || []).length,
+        topics: (bb.topics || []).length,
+        messages: (bb.messages || []).length,
+        contexts: (bb.contexts || []).length,
+        artifacts: (bb.artifacts || []).length,
+        snapshots: (bb.snapshots || []).length,
+        decisions: (bb.decisions || []).length,
+        graphNodes: graph.nodes.length,
+        graphEdges: graph.edges.length
+    };
+    const total = counts.multiAgentRuns +
+        counts.roles +
+        counts.groups +
+        counts.memberships +
+        counts.fanouts +
+        counts.fanins +
+        counts.topics +
+        counts.messages +
+        counts.contexts +
+        counts.artifacts +
+        counts.snapshots +
+        counts.decisions;
+    const reasons = [];
+    if (counts.graphNodes > thresholds.graphNodes)
+        reasons.push(`graph has ${counts.graphNodes} nodes (> ${thresholds.graphNodes})`);
+    if (counts.graphEdges > thresholds.graphEdges)
+        reasons.push(`graph has ${counts.graphEdges} edges (> ${thresholds.graphEdges})`);
+    if (counts.messages > thresholds.blackboardMessages)
+        reasons.push(`blackboard has ${counts.messages} messages (> ${thresholds.blackboardMessages})`);
+    const bbRecords = counts.topics + counts.messages + counts.contexts + counts.artifacts + counts.snapshots + counts.decisions;
+    if (bbRecords > thresholds.blackboardRecords)
+        reasons.push(`blackboard has ${bbRecords} records (> ${thresholds.blackboardRecords})`);
+    if (total > thresholds.totalRecords)
+        reasons.push(`run has ${total} multi-agent records (> ${thresholds.totalRecords})`);
+    return { ...counts, total, compactionRecommended: reasons.length > 0, reasons: reasons.sort() };
+}

package/dist/state-explosion.js

@@ -3,8 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.stateExplosionReportLines = exports.formatBlackboardDigest = exports.formatCompactGraph = exports.formatStateExplosionReport = exports.fingerprintStrings = exports.GRAPH_VIEWS = exports.DEFAULT_STATE_EXPLOSION_THRESHOLDS = exports.STATE_EXPLOSION_SCHEMA_VERSION = void 0;
-exports.computeStateSize = computeStateSize;
+exports.stateExplosionReportLines = exports.formatBlackboardDigest = exports.formatCompactGraph = exports.formatStateExplosionReport = exports.fingerprintStrings = exports.GRAPH_VIEWS = exports.STATE_EXPLOSION_SCHEMA_VERSION = exports.DEFAULT_STATE_EXPLOSION_THRESHOLDS = exports.computeStateSizeWithGraph = exports.computeStateSize = void 0;
 exports.summarizeBlackboardDigest = summarizeBlackboardDigest;
 exports.buildCompactGraph = buildCompactGraph;
 exports.buildStateExplosionReport = buildStateExplosionReport;
@@ -21,15 +20,11 @@ const multi_agent_operator_ux_1 = require("./multi-agent-operator-ux");
 const trust_audit_1 = require("./trust-audit");
 const evidence_reasoning_1 = require("./evidence-reasoning");
 const helpers_1 = require("./state-explosion/helpers");
-exports.STATE_EXPLOSION_SCHEMA_VERSION = 1;
-exports.DEFAULT_STATE_EXPLOSION_THRESHOLDS = {
-    graphNodes: 40,
-    graphEdges: 60,
-    blackboardMessages: 25,
-    blackboardRecords: 40,
-    collapseBucket: 6,
-    totalRecords: 80
-};
+const size_1 = require("./state-explosion/size");
+Object.defineProperty(exports, "computeStateSize", { enumerable: true, get: function () { return size_1.computeStateSize; } });
+Object.defineProperty(exports, "computeStateSizeWithGraph", { enumerable: true, get: function () { return size_1.computeStateSizeWithGraph; } });
+Object.defineProperty(exports, "DEFAULT_STATE_EXPLOSION_THRESHOLDS", { enumerable: true, get: function () { return size_1.DEFAULT_STATE_EXPLOSION_THRESHOLDS; } });
+Object.defineProperty(exports, "STATE_EXPLOSION_SCHEMA_VERSION", { enumerable: true, get: function () { return size_1.STATE_EXPLOSION_SCHEMA_VERSION; } });
 exports.GRAPH_VIEWS = [
     "full",
     "compact",
@@ -79,65 +74,17 @@ function graphKey(view, options) {
         view,
         options.focus || "",
         options.depth === undefined ? "" : String(options.depth),
-        thresholdsKey(options.thresholds || exports.DEFAULT_STATE_EXPLOSION_THRESHOLDS)
+        thresholdsKey(options.thresholds || size_1.DEFAULT_STATE_EXPLOSION_THRESHOLDS)
     ].join("\0");
 }
 // ---------------------------------------------------------------------------
-// State size
+// State size (implementation in state-explosion/size.ts)
 // ---------------------------------------------------------------------------
-function computeStateSize(run, thresholds = exports.DEFAULT_STATE_EXPLOSION_THRESHOLDS) {
-    return computeStateSizeWithGraph(run, thresholds, (0, multi_agent_operator_ux_1.buildMultiAgentOperatorGraph)(run));
-}
-function computeStateSizeWithGraph(run, thresholds, graph) {
-    const ma = run.multiAgent || { runs: [], roles: [], groups: [], memberships: [], fanouts: [], fanins: [] };
-    const bb = run.blackboard || { topics: [], messages: [], contexts: [], artifacts: [], snapshots: [], decisions: [] };
-    const counts = {
-        multiAgentRuns: (ma.runs || []).length,
-        roles: (ma.roles || []).length,
-        groups: (ma.groups || []).length,
-        memberships: (ma.memberships || []).length,
-        fanouts: (ma.fanouts || []).length,
-        fanins: (ma.fanins || []).length,
-        topics: (bb.topics || []).length,
-        messages: (bb.messages || []).length,
-        contexts: (bb.contexts || []).length,
-        artifacts: (bb.artifacts || []).length,
-        snapshots: (bb.snapshots || []).length,
-        decisions: (bb.decisions || []).length,
-        graphNodes: graph.nodes.length,
-        graphEdges: graph.edges.length
-    };
-    const total = counts.multiAgentRuns +
-        counts.roles +
-        counts.groups +
-        counts.memberships +
-        counts.fanouts +
-        counts.fanins +
-        counts.topics +
-        counts.messages +
-        counts.contexts +
-        counts.artifacts +
-        counts.snapshots +
-        counts.decisions;
-    const reasons = [];
-    if (counts.graphNodes > thresholds.graphNodes)
-        reasons.push(`graph has ${counts.graphNodes} nodes (> ${thresholds.graphNodes})`);
-    if (counts.graphEdges > thresholds.graphEdges)
-        reasons.push(`graph has ${counts.graphEdges} edges (> ${thresholds.graphEdges})`);
-    if (counts.messages > thresholds.blackboardMessages)
-        reasons.push(`blackboard has ${counts.messages} messages (> ${thresholds.blackboardMessages})`);
-    const bbRecords = counts.topics + counts.messages + counts.contexts + counts.artifacts + counts.snapshots + counts.decisions;
-    if (bbRecords > thresholds.blackboardRecords)
-        reasons.push(`blackboard has ${bbRecords} records (> ${thresholds.blackboardRecords})`);
-    if (total > thresholds.totalRecords)
-        reasons.push(`run has ${total} multi-agent records (> ${thresholds.totalRecords})`);
-    return { ...counts, total, compactionRecommended: reasons.length > 0, reasons: reasons.sort() };
-}
 function stateSizeFor(run, thresholds, context) {
     const key = thresholdsKey(thresholds);
     let size = context.stateSizes.get(key);
     if (!size) {
-        size = computeStateSizeWithGraph(run, thresholds, fullGraphFor(run, context));
+        size = (0, size_1.computeStateSizeWithGraph)(run, thresholds, fullGraphFor(run, context));
         context.stateSizes.set(key, size);
     }
     return size;
@@ -321,7 +268,7 @@ function summarizeBlackboardDigest(run, blackboardId) {
     ]);
     const fingerprint = (0, helpers_1.fingerprintRecords)([...topics, ...messages, ...contexts, ...artifacts, ...decisions]);
     return {
-        schemaVersion: exports.STATE_EXPLOSION_SCHEMA_VERSION,
+        schemaVersion: size_1.STATE_EXPLOSION_SCHEMA_VERSION,
         runId: run.id,
         id: `blackboard-digest${boardId ? `:${boardId}` : ""}`,
         scope: "blackboard",
@@ -368,7 +315,7 @@ function buildCompactGraph(run, view = "compact", options = {}) {
     return buildCompactGraphWithContext(run, view, options, createStateExplosionBuildContext());
 }
 function buildCompactGraphWithContext(run, view, options, context) {
-    const thresholds = options.thresholds || exports.DEFAULT_STATE_EXPLOSION_THRESHOLDS;
+    const thresholds = options.thresholds || size_1.DEFAULT_STATE_EXPLOSION_THRESHOLDS;
     const key = graphKey(view, { ...options, thresholds });
     const cached = context.graphRecords.get(key);
     if (cached)
@@ -517,7 +464,7 @@ function finalizeGraphRecord(run, view, options, full, built) {
         ...built.syntheticNodes.filter((s) => s.blockedReason).map((s) => s.blockedReason)
     ]);
     return {
-        schemaVersion: exports.STATE_EXPLOSION_SCHEMA_VERSION,
+        schemaVersion: size_1.STATE_EXPLOSION_SCHEMA_VERSION,
         runId: run.id,
         id: `graph-${view}${options.focus ? `:focus:${(0, helpers_1.slug)(options.focus)}` : ""}`,
         scope: "run",
@@ -754,7 +701,7 @@ function buildOperatorDigestWithContext(run, thresholds, context) {
         ...compact.syntheticNodes.map((syn) => syn.expansionCommand)
     ]);
     return {
-        schemaVersion: exports.STATE_EXPLOSION_SCHEMA_VERSION,
+        schemaVersion: size_1.STATE_EXPLOSION_SCHEMA_VERSION,
         runId: run.id,
         id: "operator-digest",
         scope: "run",
@@ -817,7 +764,7 @@ function buildStateExplosionReport(run, options = {}) {
     return buildStateExplosionReportWithContext(run, options, createStateExplosionBuildContext());
 }
 function buildStateExplosionReportWithContext(run, options, context) {
-    const thresholds = options.thresholds || exports.DEFAULT_STATE_EXPLOSION_THRESHOLDS;
+    const thresholds = options.thresholds || size_1.DEFAULT_STATE_EXPLOSION_THRESHOLDS;
     const stateSize = stateSizeFor(run, thresholds, context);
     const compactGraph = buildCompactGraphWithContext(run, "compact", { thresholds }, context);
     const criticalPathGraph = buildCompactGraphWithContext(run, "critical-path", { thresholds }, context);
@@ -847,7 +794,7 @@ function buildStateExplosionReportWithContext(run, options, context) {
         ? `node scripts/cw.js summary refresh ${run.id}`
         : operatorDigest.nextAction;
     return {
-        schemaVersion: exports.STATE_EXPLOSION_SCHEMA_VERSION,
+        schemaVersion: size_1.STATE_EXPLOSION_SCHEMA_VERSION,
         runId: run.id,
         generatedAt: new Date().toISOString(),
         stateSize,
@@ -887,7 +834,7 @@ function currentEntryFingerprint(run, entry, records) {
  *  BSD: mechanism (check + refresh); policy (when to call) is at the call site. */
 function maybeCompactRun(run) {
     try {
-        const size = computeStateSize(run);
+        const size = (0, size_1.computeStateSize)(run);
         if (size.compactionRecommended) {
             refreshStateExplosionSummaries(run);
         }
@@ -900,7 +847,7 @@ function summariesDir(run) {
     return node_path_1.default.join(run.paths.runDir, "summaries");
 }
 function refreshStateExplosionSummaries(run, options = {}) {
-    const thresholds = options.thresholds || exports.DEFAULT_STATE_EXPLOSION_THRESHOLDS;
+    const thresholds = options.thresholds || size_1.DEFAULT_STATE_EXPLOSION_THRESHOLDS;
     const context = createStateExplosionBuildContext();
     const dir = summariesDir(run);
     node_fs_1.default.mkdirSync(dir, { recursive: true });
@@ -923,7 +870,7 @@ function refreshStateExplosionSummaries(run, options = {}) {
     const compactGraph = buildCompactGraphWithContext(run, "compact", { thresholds }, context);
     const reportPath = node_path_1.default.join(dir, "state-explosion-report.json");
     const index = {
-        schemaVersion: exports.STATE_EXPLOSION_SCHEMA_VERSION,
+        schemaVersion: size_1.STATE_EXPLOSION_SCHEMA_VERSION,
         runId: run.id,
         id: "multi-agent-summary-index",
         scope: "run",

package/dist/state.js

@@ -70,6 +70,7 @@ function ensureRunDirs(paths) {
 function loadRunFromCwd(runId, cwd = process.cwd()) {
     if (!runId)
         throw new Error("Missing run id");
+    assertSafeRunId(runId);
     const statePath = node_path_1.default.join(cwd, ".cw", "runs", runId, "state.json");
     const result = loadRunStateFile(statePath, { dryRun: true });
     if (result.report.status === "unsupported") {
@@ -98,8 +99,11 @@ function migrateRunStateFile(statePath, options = {}) {
 }
 function saveCheckpoint(run) {
     run.updatedAt = new Date().toISOString();
-    // state.json is the single source of truth — write it DURABLY (v0.1.40).
-    writeJson(run.paths.state, run, { durable: true });
+    // state.json is the single source of truth — write it DURABLY with a lock
+    // so concurrent processes never lose an update (v0.1.95).
+    withFileLock(run.paths.state, () => {
+        writeJson(run.paths.state, run, { durable: true });
+    });
 }
 /** Compact a run checkpoint by stripping empty optional arrays and null values
  *  that don't carry semantic meaning (v0.1.60). The normalization layer
@@ -245,6 +249,12 @@ function isContainedPath(candidate, allowed) {
 // per-run reclamation chain) so a concurrent writer can never lose a record.
 // O_EXCL (`wx`) is portable (no native flock); a stale holder is stolen so a
 // crashed process can never wedge the store forever.
+//
+// v0.1.95: the lock mtime is refreshed immediately before fn() runs, and
+// verified AFTER fn() returns — if another process stole the lock mid-operation
+// (the stale check fired and it overwrote our lock), the holder refuses to
+// release and throws. This guards long-running RMW operations (e.g. GC over a
+// large run) against mid-operation theft.
 // ---------------------------------------------------------------------------
 const FILE_LOCK_STALE_MS = 30_000;
 function sleepSync(ms) {
@@ -254,11 +264,12 @@ function sleepSync(ms) {
 function withFileLock(targetPath, fn) {
     const lock = `${targetPath}.lock`;
     node_fs_1.default.mkdirSync(node_path_1.default.dirname(lock), { recursive: true });
+    const pid = String(process.pid);
     let acquired = false;
     for (let attempt = 0; attempt < 240 && !acquired; attempt++) {
         try {
             const fd = node_fs_1.default.openSync(lock, "wx");
-            node_fs_1.default.writeFileSync(fd, `${process.pid}@${new Date().toISOString()}\n`, "utf8");
+            node_fs_1.default.writeFileSync(fd, `${pid}@${new Date().toISOString()}\n`, "utf8");
             node_fs_1.default.closeSync(fd);
             acquired = true;
         }
@@ -272,19 +283,45 @@ function withFileLock(targetPath, fn) {
                 }
             }
             catch {
-                continue; // lock vanished between open and stat — retry immediately
+                continue;
             }
             sleepSync(25);
         }
     }
     if (!acquired)
         throw new Error(`could not acquire file lock for ${targetPath}`);
+    // Refresh mtime right before the critical section
     try {
-        return fn();
+        node_fs_1.default.utimesSync(lock, new Date(), new Date());
+    }
+    catch { /* best-effort */ }
+    try {
+        const result = fn();
+        // Verify lock was not stolen during fn(). The lock content may have changed
+        // if another process opened it with wx after stealing it. If our PID is not
+        // in the lock file, the lock was stolen — do NOT release the stolen lock
+        // (the thief owns it now, and releasing would corrupt its operation).
+        try {
+            const current = node_fs_1.default.readFileSync(lock, "utf8");
+            if (!current.startsWith(pid + "@")) {
+                throw new Error(`File lock for ${targetPath} was stolen during the critical section ` +
+                    `(lock now owned by another process). The operation may have lost ` +
+                    `cross-process isolation — increase FILE_LOCK_STALE_MS or split the work.`);
+            }
+        }
+        catch (checkError) {
+            if (checkError instanceof Error && checkError.message.includes("stolen"))
+                throw checkError;
+            /* lock vanished — another process already released it, nothing to clean up */
+        }
+        return result;
     }
     finally {
         try {
-            node_fs_1.default.rmSync(lock, { force: true });
+            // Only release if we still own the lock
+            const current = node_fs_1.default.readFileSync(lock, "utf8");
+            if (current.startsWith(pid + "@"))
+                node_fs_1.default.rmSync(lock, { force: true });
         }
         catch {
             /* releasing a missing lock is fine */
@@ -299,7 +336,8 @@ function safeFileName(value) {
  *  runs directory via a separator or a `..`/`.` component (path traversal). A
  *  real run id is `${workflowId}-${stamp}-${suffix}` (createRunId), and a
  *  workflow id is alnum-bounded [a-z0-9.-] (validateWorkflowId) — all within
- *  [A-Za-z0-9._-]. Because the charset already forbids any separator, the whole
+ *  [A-Za-z0-9._:-]. Sub-workflow ids also include `:` from the task id prefix.
+ *  Because the charset already forbids any separator, the whole
  *  id is ONE path component, so the only values that could traverse are the
  *  components `.` and `..` themselves; an embedded `..` (e.g. a workflow id like
  *  `v1..2`) is a safe directory name and is allowed. A separator, an absolute
@@ -309,8 +347,8 @@ function assertSafeRunId(value, context = "run id") {
     if (typeof value !== "string" || value.length === 0) {
         throw new Error(`Invalid ${context}: expected a non-empty string`);
     }
-    if (!/^[A-Za-z0-9._-]+$/.test(value) || value === "." || value === "..") {
-        throw new Error(`Unsafe ${context}: ${JSON.stringify(value)} must be a single path segment ([A-Za-z0-9._-], not '.' or '..')`);
+    if (!/^[A-Za-z0-9._:-]+$/.test(value) || value === "." || value === "..") {
+        throw new Error(`Unsafe ${context}: ${JSON.stringify(value)} must be a single path segment ([A-Za-z0-9._:-], not '.' or '..')`);
     }
     return value;
 }

package/dist/triggers.js

@@ -147,7 +147,13 @@ function parseJsonObject(value) {
         return undefined;
     if (typeof value === "object")
         return value;
-    const parsed = JSON.parse(String(value));
+    let parsed;
+    try {
+        parsed = JSON.parse(String(value));
+    }
+    catch {
+        throw new Error("Expected a JSON object, got invalid JSON");
+    }
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
         throw new Error("Expected JSON object");
     }