cool-workflow 0.1.95 → 0.1.97

package/scripts/agents/codex-agent.js

@@ -14,6 +14,13 @@
 //
 // stdout: one JSON object { model, usage, result } for CW provenance.
 // stderr: optional live trace when CW_AGENT_STREAM=1 and attached to a TTY.
+//
+// SPEED: codex `exec` inherits the user's ~/.codex/config.toml, including a heavy
+// `model_reasoning_effort` (e.g. "high"), which makes every read/grep turn slow.
+// CW caps it for ITS runs only via `-c model_reasoning_effort=<effort>` — a
+// per-run override that does NOT touch the user's interactive codex. Tune with
+// CW_CODEX_REASONING_EFFORT (default "low"); set it to "medium"/"high" to opt back
+// into more thinking.
 
 const fs = require("node:fs");
 const os = require("node:os");
@@ -25,6 +32,7 @@ const {
   emitReport,
   flushJsonLines,
   parseJsonLines,
+  persistStderr,
   writeResult
 } = require("./agent-adapter-core");
 
@@ -74,9 +82,14 @@ function recordJsonLine(line) {
 
 render.action("codex: reading the repo (read-only)…");
 
+// Cap codex's reasoning effort for CW runs (speed) — overrides config.toml for
+// THIS invocation only. Default "low"; CW_CODEX_REASONING_EFFORT opts back up.
+const effort = process.env.CW_CODEX_REASONING_EFFORT || "low";
 const args = [
   "exec",
   "--json",
+  "-c",
+  `model_reasoning_effort=${effort}`,
   "--output-last-message",
   finalPath,
   "--sandbox",
@@ -108,6 +121,7 @@ child.stderr.on("data", (chunk) => {
 
 child.on("error", (error) => {
   render.finishLive();
+  persistStderr(resultPath, `codex spawn failed: ${error.message}`);
   process.stderr.write(`codex spawn failed: ${error.message}\n`);
   process.exit(1);
 });
@@ -118,11 +132,14 @@ child.on("close", (code) => {
   render.writeTranscript(transcriptPath);
   if (code !== 0) {
     const detail = childStderr.trim() || `codex exited ${code === null ? "(timeout/killed)" : code}`;
+    persistStderr(resultPath, detail);
     process.stderr.write(`${detail}\n`);
     process.exit(code === null ? 1 : code);
   }
   if (state.invalidJson) {
-    process.stderr.write("codex --json produced a non-JSONL stdout line - refusing to trust the result\n");
+    const detail = "codex --json produced a non-JSONL stdout line - refusing to trust the result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
@@ -130,7 +147,9 @@ child.on("close", (code) => {
   try {
     resultText = fs.readFileSync(finalPath, "utf8");
   } catch {
-    process.stderr.write("codex produced no final output file - refusing to fabricate a result\n");
+    const detail = "codex produced no final output file - refusing to fabricate a result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   } finally {
     try {
@@ -143,6 +162,7 @@ child.on("close", (code) => {
   try {
     writeResult(resultPath, resultText);
   } catch (error) {
+    persistStderr(resultPath, `codex produced no final result: ${error.message}`);
     process.stderr.write(`codex produced no final result: ${error.message}\n`);
     process.exit(1);
   }

package/scripts/agents/gemini-agent.js

@@ -22,6 +22,7 @@ const {
   emitReport,
   flushJsonLines,
   parseJsonLines,
+  persistStderr,
   writeResult
 } = require("./agent-adapter-core");
 
@@ -83,6 +84,7 @@ child.stderr.on("data", (chunk) => {
 
 child.on("error", (error) => {
   render.finishLive();
+  persistStderr(resultPath, `gemini spawn failed: ${error.message}`);
   process.stderr.write(`gemini spawn failed: ${error.message}\n`);
   process.exit(1);
 });
@@ -93,23 +95,29 @@ child.on("close", (code) => {
   render.writeTranscript(transcriptPath);
   if (code !== 0) {
     const detail = childStderr.trim() || `gemini exited ${code === null ? "(timeout/killed)" : code}`;
+    persistStderr(resultPath, detail);
     process.stderr.write(`${detail}\n`);
     process.exit(code === null ? 1 : code);
   }
   if (state.invalidJson) {
-    process.stderr.write("gemini --output-format stream-json produced a non-JSONL stdout line - refusing to trust the result\n");
+    const detail = "gemini --output-format stream-json produced a non-JSONL stdout line - refusing to trust the result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
   const resultText = state.finalResult || state.textFragments.join("\n\n");
   if (!resultText.trim()) {
-    process.stderr.write("gemini produced no result text - refusing to fabricate a result\n");
+    const detail = "gemini produced no result text - refusing to fabricate a result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
   try {
     writeResult(resultPath, resultText);
   } catch (error) {
+    persistStderr(resultPath, `gemini produced no final result: ${error.message}`);
     process.stderr.write(`gemini produced no final result: ${error.message}\n`);
     process.exit(1);
   }

package/scripts/agents/opencode-agent.js

@@ -27,6 +27,7 @@ const {
   emitReport,
   flushJsonLines,
   parseJsonLines,
+  persistStderr,
   writeResult
 } = require("./agent-adapter-core");
 
@@ -136,6 +137,7 @@ child.stderr.on("data", (chunk) => {
 
 child.on("error", (error) => {
   render.finishLive();
+  persistStderr(resultPath, `opencode spawn failed: ${error.message}`);
   process.stderr.write(`opencode spawn failed: ${error.message}\n`);
   process.exit(1);
 });
@@ -146,23 +148,29 @@ child.on("close", (code) => {
   render.writeTranscript(transcriptPath);
   if (code !== 0) {
     const detail = childStderr.trim() || `opencode exited ${code === null ? "(timeout/killed)" : code}`;
+    persistStderr(resultPath, detail);
     process.stderr.write(`${detail}\n`);
     process.exit(code === null ? 1 : code);
   }
   if (state.invalidJson) {
-    process.stderr.write("opencode --format json produced a non-JSONL stdout line - refusing to trust the result\n");
+    const detail = "opencode --format json produced a non-JSONL stdout line - refusing to trust the result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
   const resultText = state.finalResult || state.lastMessageText || state.textFragments.join("\n\n");
   if (!resultText.trim()) {
-    process.stderr.write("opencode produced no result text - refusing to fabricate a result\n");
+    const detail = "opencode produced no result text - refusing to fabricate a result";
+    persistStderr(resultPath, childStderr.trim() || detail);
+    process.stderr.write(`${detail}\n`);
     process.exit(1);
   }
 
   try {
     writeResult(resultPath, resultText);
   } catch (error) {
+    persistStderr(resultPath, `opencode produced no final result: ${error.message}`);
     process.stderr.write(`opencode produced no final result: ${error.message}\n`);
     process.exit(1);
   }

package/scripts/canonical-apps.js

@@ -83,7 +83,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.1.95",
+      "Cool Workflow v0.1.97",
       "--freshness",
       "as of release preparation"
     ]
@@ -117,14 +117,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.1.95");
+    assert.equal(summary.version, "0.1.97");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.1.95");
+    assert.equal(shown.app.version, "0.1.97");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -135,7 +135,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.1.95");
+    assert.equal(state.workflow.app.version, "0.1.97");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);

package/scripts/children/batch-delegate-child.js

@@ -18,10 +18,17 @@
 
 const { spawn } = require("node:child_process");
 let raw = "";
+const MAX_STDIN_BYTES = 32 * 1024 * 1024;
 process.stdin.setEncoding("utf8");
-process.stdin.on("data", (d) => (raw += d));
+process.stdin.on("data", (d) => { if (raw.length < MAX_STDIN_BYTES) raw += d; });
 process.stdin.on("end", () => {
-  const jobs = JSON.parse(raw);
+  let jobs;
+  try {
+    jobs = JSON.parse(raw);
+  } catch (e) {
+    process.stdout.write(JSON.stringify([{ spawnError: `invalid stdin JSON: ${String(e && e.message || e)}`, exitCode: null, stdout: "" }]));
+    return;
+  }
   if (!jobs.length) { process.stdout.write("[]"); return; }
   const out = new Array(jobs.length);
   let pending = jobs.length;
@@ -37,7 +44,7 @@ process.stdin.on("end", () => {
     };
     let child;
     try {
-      child = spawn(job.binary, job.args, { cwd: job.cwd, env: process.env, shell: false });
+      child = spawn(job.binary, job.args, { cwd: job.cwd, env: job.env || process.env, shell: false });
     } catch (error) {
       settle({ spawnError: String((error && error.message) || error), exitCode: null, stdout: "" });
       return;

package/scripts/children/http-delegate-child.js

@@ -15,7 +15,8 @@
 // API request. Behavior MUST stay byte-identical to the previous embedded string.
 
 (async () => {
-  const read = () => new Promise((res) => { let b = ""; process.stdin.on("data", (c) => (b += c)); process.stdin.on("end", () => res(b)); });
+  const MAX_STDIN_BYTES = 32 * 1024 * 1024;
+  const read = () => new Promise((res) => { let b = ""; process.stdin.on("data", (c) => { if (b.length < MAX_STDIN_BYTES) b += c; }); process.stdin.on("end", () => res(b)); });
   try {
     const job = JSON.parse((await read()) || "{}");
     const endpoint = process.env.CW_DELEGATE_ENDPOINT;

package/scripts/dogfood-release.js

@@ -6,7 +6,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { CoolWorkflowRunner } = require("../dist/orchestrator.js");
 
-const TARGET_VERSION = "0.1.95";
+const TARGET_VERSION = "0.1.97";
 const PREVIOUS_VERSION = "0.1.31";
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");

package/scripts/golden-path.js

@@ -33,7 +33,7 @@ function main() {
     const appValidation = runJson(["app", "validate", "end-to-end-golden-path"], pluginRoot);
     assert.equal(appValidation.valid, true);
     assert.equal(appValidation.summary.id, "end-to-end-golden-path");
-    assert.equal(appValidation.summary.version, "0.1.95");
+    assert.equal(appValidation.summary.version, "0.1.97");
 
     const plan = runJson(
       [
@@ -42,7 +42,7 @@ function main() {
         "--repo",
         tmp,
         "--question",
-        "Prove the deterministic v0.1.95 end-to-end golden path."
+        "Prove the deterministic v0.1.97 end-to-end golden path."
       ],
       pluginRoot
     );
@@ -52,7 +52,7 @@ function main() {
 
     let state = readJson(plan.statePath);
     assert.equal(state.workflow.app.id, "end-to-end-golden-path");
-    assert.equal(state.workflow.app.version, "0.1.95");
+    assert.equal(state.workflow.app.version, "0.1.97");
     assert.equal(state.loopStage, "interpret");
 
     const dispatch = runJson(["dispatch", plan.runId, "--limit", "1", "--sandbox", "readonly"], tmp);
@@ -195,7 +195,7 @@ function main() {
     assert.equal(reportPath, plan.reportPath);
     assert.ok(fs.existsSync(reportPath));
     const report = fs.readFileSync(reportPath, "utf8");
-    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.95/);
+    assert.match(report, /Workflow App: end-to-end-golden-path@0\.1\.97/);
     assert.match(report, /## Candidates/);
     assert.match(report, /## Trust Audit/);
     assert.match(report, /## Acceptance Rationale/);

package/scripts/release-flow.js

@@ -154,6 +154,11 @@ function runVendorPreflight() {
 }
 
 // ---- 2. independent reviewer, delegated to the configured agent -------------
+// Default reviewer deadline. The zero-trust reviewer re-runs release-gate.sh,
+// whose sequential test suite alone is ~12 min, then reads + reasons over the
+// diff — so a 10-min default guaranteed a timeout on a real release. 30 min gives
+// headroom; override with CW_AGENT_TIMEOUT_MS (or --agent-timeout-ms).
+const REVIEWER_TIMEOUT_MS = 1800000;
 function reviewerPromptBody() {
   // Reuse the committed reviewer spec as the prompt; strip YAML frontmatter.
   const specPath = path.join(pluginRoot, "agents", "release-reviewer.md");
@@ -280,7 +285,7 @@ function delegateReview(resultPath, inputPath) {
       cwd: repoRoot,
       env: { ...process.env },
       encoding: "utf8",
-      timeout: cfg.timeoutMs || 600000,
+      timeout: cfg.timeoutMs || REVIEWER_TIMEOUT_MS,
       shell: false,
       stdio: ["ignore", "pipe", "inherit"],
       maxBuffer: 32 * 1024 * 1024
@@ -310,7 +315,7 @@ function delegateReview(resultPath, inputPath) {
   say(`[2/3] reviewer — POSTing to endpoint ${cfg.endpoint} (model: ${cfg.model || "unreported"})`);
   const body = JSON.stringify({ prompt: subMap.prompt, model: cfg.model, sha: HEAD });
   const lib = cfg.endpoint.startsWith("https:") ? https : http;
-  const text = postSync(lib, cfg.endpoint, body, cfg.timeoutMs || 600000);
+  const text = postSync(lib, cfg.endpoint, body, cfg.timeoutMs || REVIEWER_TIMEOUT_MS);
   if (text === null) die("reviewer endpoint call failed — no verdict trusted.");
   fs.writeFileSync(resultPath, text.endsWith("\n") ? text : `${text}\n`);
 }
@@ -502,15 +507,28 @@ function cut(resultPath, capability) {
   const bump = spawnSync("npm", ["run", "bump:version", "--", cutVersion], { cwd: pluginRoot, encoding: "utf8", stdio: "inherit" });
   if (bump.status !== 0) die("bump:version failed");
   // Regenerate the gated project index after the version bump (PR #87 gate).
-  spawnSync("npm", ["run", "sync:project-index", "--", "--repo-only"], { cwd: pluginRoot, stdio: "inherit" });
-  git(["add", "-A"]);
+  // Fail closed: a failed regen must not bake a stale index into the immutable tag.
+  const sync = spawnSync("npm", ["run", "sync:project-index", "--", "--repo-only"], { cwd: pluginRoot, encoding: "utf8", stdio: "inherit" });
+  if (sync.status !== 0) die("sync:project-index failed — refusing to cut with a stale project index");
+  // Stage ONLY tracked-file modifications (the bump surfaces, project-index, dist)
+  // plus the ONE intended new file: the reviewer verdict. NEVER `git add -A` — an
+  // untracked stray (e.g. the reviewer's narration transcript, which carries the
+  // operator's local home path) must never ride into the immutable tag commit
+  // (that tripped pii-redaction-smoke and red-failed release-gate for v0.1.96).
+  // `git add -u` touches tracked files only, so no untracked file can be swept in;
+  // the verdict is the single new path the cut is allowed to add.
+  git(["add", "-u"]);
+  git(["add", "--", path.relative(repoRoot, resultPath)]);
   const commit = git(["commit", "-m", `chore(release): record APPROVED reviewer verdict for v${cutVersion}`]);
   if (commit.code !== 0) die("verdict commit failed", commit.err);
   const tag = git(["tag", "-a", `v${cutVersion}`, "-m", `v${cutVersion}: ${capability || "release"}`]);
   if (tag.code !== 0) die("git tag failed", tag.err);
   if (PUSH) {
-    git(["push", "origin", "HEAD"]);
-    git(["push", "origin", `v${cutVersion}`]);
+    // Atomic: the verdict commit on HEAD and the tag land together or not at all.
+    // A non-atomic two-push could leave main advanced with no tag, so CI's
+    // release-gate (which fires on the tag) never runs and the release silently stalls.
+    const push = git(["push", "--atomic", "origin", "HEAD", `v${cutVersion}`]);
+    if (push.code !== 0) die("atomic push of HEAD + tag failed (nothing partially pushed)", push.err);
   }
   say(`tagged v${cutVersion}${PUSH ? " and pushed" : " (local only; push when ready)"}`);
   // Finishing step: create the GitHub Release for the just-pushed tag. Only when

package/scripts/release-gate.sh

@@ -30,7 +30,7 @@ say "[1/6] build"
 npm run --prefix plugins/cool-workflow build >/dev/null 2>&1 || fail "build failed"
 
 say "[2/6] tests"
-CW_TEST_CONCURRENCY=1 npm test --prefix plugins/cool-workflow >/dev/null 2>&1 || fail "tests failed"
+CW_TEST_CONCURRENCY=1 npm run test:gate --prefix plugins/cool-workflow >/dev/null 2>&1 || fail "tests failed"
 
 if [[ -n "$PREV_TAG" ]]; then
   RANGE="$PREV_TAG..HEAD"