cool-workflow 0.1.96 → 0.1.98

package/dist/drive.js

@@ -43,6 +43,8 @@ const observability_1 = require("./observability");
 const loop_expansion_1 = require("./loop-expansion");
 const telemetry_attestation_1 = require("./telemetry-attestation");
 const state_1 = require("./state");
+const commit_1 = require("./commit");
+const report_1 = require("./orchestrator/report");
 const trust_audit_1 = require("./trust-audit");
 const compare_1 = require("./compare");
 exports.DRIVE_SCHEMA_VERSION = 1;
@@ -183,7 +185,7 @@ function buildAgentRequest(ctx, run, task, manifest, preparedOutcome) {
  *  fulfill step then settles it through runBackend instead of spawning again,
  *  so the concurrent round and the serial step share EVERY envelope/accept
  *  branch by construction. */
-function processSelectedTask(ctx, selected, preparedOutcome) {
+function processSelectedTask(ctx, selected, preparedOutcome, deferPersist = false) {
     const { runner, runId } = ctx;
     let run = runner.loadRun(runId);
     // 1. DISPATCH (only a fresh pending task; a running task is a retry on its scope).
@@ -191,7 +193,7 @@ function processSelectedTask(ctx, selected, preparedOutcome) {
     let workerId = selected.workerId;
     let dispatched = false;
     if (selected.status === "pending") {
-        const manifest = runner.dispatch(runId, { limit: 1, backend: selected.agentType || "agent" });
+        const manifest = runner.dispatch(runId, { limit: 1, backend: selected.agentType || "agent", ...(deferPersist ? { persistState: false } : {}) });
         const task = manifest.tasks.find((entry) => entry.id === selected.id) || manifest.tasks[0];
         if (!task || !task.workerId) {
             return step("dispatch", "failed", { runId, taskId: selected.id, phase: selected.phase, reason: "dispatch produced no worker scope" });
@@ -216,10 +218,10 @@ function processSelectedTask(ctx, selected, preparedOutcome) {
         emitProgress(`↺ ${selected.label || selected.id} (${selected.phase}) — accepting cached result`);
         try {
             node_fs_1.default.writeFileSync(manifest.resultPath, node_fs_1.default.readFileSync(cachePath, "utf8"), "utf8");
-            runner.recordWorkerOutput(runId, workerId, manifest.resultPath, {});
+            runner.recordWorkerOutput(runId, workerId, manifest.resultPath, deferPersist ? { persistState: false } : {});
         }
         catch (error) {
-            return handleHop(ctx, selected, workerId, `result cache rejected: ${error instanceof Error ? error.message : String(error)}`);
+            return handleHop(ctx, selected, workerId, `result cache rejected: ${error instanceof Error ? error.message : String(error)}`, deferPersist);
         }
         return step("accept", "ok", {
             runId,
@@ -233,7 +235,7 @@ function processSelectedTask(ctx, selected, preparedOutcome) {
     // CHILD run and bind its report back as this task's result. Leaf work is still
     // external-agent delegation at every level; CW imports no model SDK here.
     if (selected.subWorkflow) {
-        return runSubWorkflow(ctx, run, selected, workerId, manifest);
+        return runSubWorkflow(ctx, run, selected, workerId, manifest, deferPersist);
     }
     emitProgress(`→ ${selected.label || selected.id} (${selected.phase}) — ${dispatched ? "dispatched, " : ""}spawning agent, may take minutes…`);
     const envelope = (0, execution_backend_1.runBackend)(buildAgentRequest(ctx, run, selected, manifest, preparedOutcome));
@@ -242,16 +244,17 @@ function processSelectedTask(ctx, selected, preparedOutcome) {
     const reportedUsage = handle?.metadata?.reportedUsage;
     const usageSignature = handle?.metadata?.usageSignature;
     if (envelope.status !== "completed") {
-        return handleHop(ctx, selected, workerId, `agent hop ${envelope.status}: ${envelope.result.summary}`);
+        return handleHop(ctx, selected, workerId, `agent hop ${envelope.status}: ${envelope.result.summary}`, deferPersist);
     }
     // 3. ACCEPT — the SEPARATE recordWorkerOutput layer validates + records result.md.
     //    A missing result.md is a failed hop (pre-checked so no terminal side effect);
     //    an invalid result.md throws at validation BEFORE any state mutation.
     if (!manifest.resultPath || !node_fs_1.default.existsSync(manifest.resultPath)) {
-        return handleHop(ctx, selected, workerId, "agent produced no result.md");
+        return handleHop(ctx, selected, workerId, "agent produced no result.md", deferPersist);
     }
     try {
         runner.recordWorkerOutput(runId, workerId, manifest.resultPath, {
+            ...(deferPersist ? { persistState: false } : {}),
             agentDelegation: {
                 handle: handle,
                 model: reportedModel,
@@ -270,7 +273,7 @@ function processSelectedTask(ctx, selected, preparedOutcome) {
         });
     }
     catch (error) {
-        return handleHop(ctx, selected, workerId, `result.md rejected: ${error instanceof Error ? error.message : String(error)}`);
+        return handleHop(ctx, selected, workerId, `result.md rejected: ${error instanceof Error ? error.message : String(error)}`, deferPersist);
     }
     if (cachePath && manifest.resultPath && node_fs_1.default.existsSync(manifest.resultPath)) {
         writeResultCache(cachePath, node_fs_1.default.readFileSync(manifest.resultPath, "utf8"));
@@ -404,41 +407,61 @@ function writeResultCache(file, content) {
  *  collect-all: a failed/hung/dirty hop never aborts its siblings, every hop
  *  settles and is recorded (failures park via the same retryOrPark). */
 function driveConcurrentRound(ctx, limit) {
-    const run = ctx.runner.loadRun(ctx.runId);
-    const selected = selectDriveTask(run);
-    const gate = terminalOrConfigStep(ctx, run, selected);
-    if (gate)
-        return [gate];
-    const phase = (0, dispatch_1.firstRunnablePhase)(run);
-    const width = Math.max(1, Math.floor(limit) || 1);
-    const batch = run.tasks
-        .filter((task) => phase.taskIds.includes(task.id) && (task.status === "pending" || task.status === "running"))
-        .slice(0, width)
-        .map((task) => task.id);
-    // Phase A+B: dispatch every batch task (sequential — dispatch mutates state),
-    // then collect ALL spawn-style child outcomes in one concurrent window. The
-    // token-budget gate ran at round entry; it is NOT re-checked between accepts —
-    // the spawns already happened, and refusing to RECORD finished work would
-    // discard real results (collect-all + never-claw-back). Overshoot is bounded
-    // by the round width; the next round blocks.
-    const prepared = prepareConcurrentOutcomes(ctx, batch);
-    // Phase C: settle + accept in deterministic batch order, regardless of the
-    // wall-clock order the children finished in.
-    const steps = [];
-    for (const taskId of batch) {
-        const failStep = prepared.failSteps.get(taskId);
-        if (failStep) {
-            steps.push(failStep);
-            continue;
+    // The whole round runs inside ONE cached in-memory run object (loadWithCache —
+    // reentrant, so a sub-workflow task's recursive drive() call cannot clobber this
+    // scope's cache). Every dispatch/accept in the round defers its own state.json
+    // write (persistState:false / deferPersist) and mutates that SAME shared object;
+    // the round flushes to disk exactly ONCE at the end instead of once per task —
+    // was O(N) full-state durable rewrites per round (measured: dominates wall time
+    // at scale), now O(1). A crash mid-round loses that round's dispatch/accept
+    // bookkeeping (bounded by the round width, i.e. limits.maxConcurrentAgents) and
+    // forces a safe-but-wasteful re-dispatch/re-spawn on the next drive — never
+    // disk corruption or double-counting, since the atomic-rename+fsync write
+    // itself is untouched; only the write FREQUENCY changed.
+    return ctx.runner.loadWithCache(() => {
+        const run = ctx.runner.loadRun(ctx.runId);
+        const selected = selectDriveTask(run);
+        const gate = terminalOrConfigStep(ctx, run, selected);
+        if (gate)
+            return [gate];
+        const phase = (0, dispatch_1.firstRunnablePhase)(run);
+        const width = Math.max(1, Math.floor(limit) || 1);
+        const batch = run.tasks
+            .filter((task) => phase.taskIds.includes(task.id) && (task.status === "pending" || task.status === "running"))
+            .slice(0, width)
+            .map((task) => task.id);
+        // Phase A+B: dispatch every batch task (sequential — dispatch mutates state),
+        // then collect ALL spawn-style child outcomes in one concurrent window. The
+        // token-budget gate ran at round entry; it is NOT re-checked between accepts —
+        // the spawns already happened, and refusing to RECORD finished work would
+        // discard real results (collect-all + never-claw-back). Overshoot is bounded
+        // by the round width; the next round blocks.
+        const prepared = prepareConcurrentOutcomes(ctx, batch);
+        // Phase C: settle + accept in deterministic batch order, regardless of the
+        // wall-clock order the children finished in.
+        const steps = [];
+        for (const taskId of batch) {
+            const failStep = prepared.failSteps.get(taskId);
+            if (failStep) {
+                steps.push(failStep);
+                continue;
+            }
+            // Re-read per task: a prior accept in this round mutated state (the SAME
+            // cached object — no disk round-trip until the round-end flush below).
+            const freshRun = ctx.runner.loadRun(ctx.runId);
+            const fresh = freshRun.tasks.find((task) => task.id === taskId);
+            if (!fresh || (fresh.status !== "pending" && fresh.status !== "running"))
+                continue;
+            steps.push(processSelectedTask(ctx, fresh, prepared.outcomes.get(taskId), true));
         }
-        // Re-read per task: a prior accept in this round mutated state.
-        const freshRun = ctx.runner.loadRun(ctx.runId);
-        const fresh = freshRun.tasks.find((task) => task.id === taskId);
-        if (!fresh || (fresh.status !== "pending" && fresh.status !== "running"))
-            continue;
-        steps.push(processSelectedTask(ctx, fresh, prepared.outcomes.get(taskId)));
-    }
-    return steps.length > 0 ? steps : [driveStep(ctx)];
+        if (steps.length > 0) {
+            const settledRun = ctx.runner.loadRun(ctx.runId);
+            (0, commit_1.commitState)(settledRun, `concurrent-round:${batch.length}-tasks`);
+            (0, report_1.writeReport)(settledRun);
+            (0, state_1.saveCheckpoint)(settledRun);
+        }
+        return steps.length > 0 ? steps : [driveStep(ctx)];
+    });
 }
 /** Dispatch each batch task and run every spawn-style agent child concurrently
  *  (one batch delegate child, per-job timeout kill). Returns outcomes keyed by
@@ -457,7 +480,7 @@ function prepareConcurrentOutcomes(ctx, batch) {
             continue;
         let workerId = task.workerId;
         if (task.status === "pending") {
-            const manifest = runner.dispatch(runId, { limit: 1, backend: task.agentType || "agent" });
+            const manifest = runner.dispatch(runId, { limit: 1, backend: task.agentType || "agent", persistState: false });
             const dispatchedTask = manifest.tasks.find((entry) => entry.id === task.id) || manifest.tasks[0];
             if (!dispatchedTask || !dispatchedTask.workerId) {
                 failSteps.set(taskId, step("dispatch", "failed", { runId, taskId, phase: task.phase, reason: "dispatch produced no worker scope" }));
@@ -475,6 +498,16 @@ function prepareConcurrentOutcomes(ctx, batch) {
             continue;
         const job = (0, execution_backend_1.prepareAgentSpawn)(buildAgentRequest(ctx, run, task, manifest));
         if (job) {
+            const sandboxPolicy = manifest.sandboxPolicy;
+            if (sandboxPolicy) {
+                const filteredEnv = (0, execution_backend_1.buildChildEnv)(sandboxPolicy);
+                for (const key of Object.keys(process.env)) {
+                    if (/^(CW_|ANTHROPIC_|OPENAI_|GEMINI_|DEEPSEEK_|CODEX_|GOOGLE_|COHERE_|MISTRAL_|OLLAMA_|AZURE_|AWS_)/i.test(key)) {
+                        filteredEnv[key] = process.env[key];
+                    }
+                }
+                job.env = filteredEnv;
+            }
             jobs.push(job);
             jobTaskIds.push(taskId);
         }
@@ -489,7 +522,7 @@ function prepareConcurrentOutcomes(ctx, batch) {
 }
 /** A failed agent hop: charge one attempt and (reuse v0.1.37 retryOrPark) either
  *  retry on the SAME worker scope next step, or PARK past the retry budget. */
-function handleHop(ctx, task, workerId, reason) {
+function handleHop(ctx, task, workerId, reason, deferPersist = false) {
     const persisted = ctx.runner.showWorker(ctx.runId, workerId).retryCount || 0;
     const prior = Math.max(ctx.attempts.get(task.id) || 0, persisted);
     const entry = {
@@ -510,7 +543,8 @@ function handleHop(ctx, task, workerId, reason) {
         ctx.runner.recordWorkerFailure(ctx.runId, workerId, decided.parkedReason || reason, {
             code: "agent-delegation-parked",
             retryable: false,
-            retryCount: attempts
+            retryCount: attempts,
+            ...(deferPersist ? { persistState: false } : {})
         });
         return step("park", "parked", {
             runId: ctx.runId,
@@ -522,7 +556,7 @@ function handleHop(ctx, task, workerId, reason) {
         });
     }
     // Retryable: leave the task running (scope reused) for the next step.
-    (0, worker_isolation_1.recordWorkerRetryAttempt)(ctx.runner.loadRun(ctx.runId), workerId, decided.attempts || prior + 1, reason);
+    (0, worker_isolation_1.recordWorkerRetryAttempt)(ctx.runner.loadRun(ctx.runId), workerId, decided.attempts || prior + 1, reason, deferPersist ? { persist: false } : {});
     return step("fulfill", "failed", {
         runId: ctx.runId,
         taskId: task.id,
@@ -555,17 +589,17 @@ function renderSubInputs(spec, parentInputs) {
  *  own telemetry/audit live in the child run; the parent records ONE honest
  *  `worker.sub-workflow` cross-link (child run id + report digest + child audit
  *  verdict) — nothing is summed or fabricated. */
-function runSubWorkflow(ctx, run, selected, workerId, manifest) {
+function runSubWorkflow(ctx, run, selected, workerId, manifest, deferPersist = false) {
     const spec = selected.subWorkflow;
     const parentApp = run.workflow.id;
     // Fail-closed BEFORE planning a child (no child state minted when refused).
     if (ctx.depth + 1 > exports.MAX_SUB_WORKFLOW_DEPTH) {
-        return handleHop(ctx, selected, workerId, `sub-workflow depth limit exceeded (> ${exports.MAX_SUB_WORKFLOW_DEPTH})`);
+        return handleHop(ctx, selected, workerId, `sub-workflow depth limit exceeded (> ${exports.MAX_SUB_WORKFLOW_DEPTH})`, deferPersist);
     }
     // Include the CURRENT app on the path, so a direct self-cycle (A→A) is caught at
     // depth 0 — before any child run dir is minted.
     if ([...ctx.visitedAppIds, parentApp].includes(spec.appId)) {
-        return handleHop(ctx, selected, workerId, `sub-workflow cycle detected: ${[...ctx.visitedAppIds, parentApp, spec.appId].join(" -> ")}`);
+        return handleHop(ctx, selected, workerId, `sub-workflow cycle detected: ${[...ctx.visitedAppIds, parentApp, spec.appId].join(" -> ")}`, deferPersist);
     }
     // Deterministic child run id derived from the parent run + task (no clock/random).
     const childRunId = `sub-${run.id}-${(0, state_1.safeFileName)(selected.id)}`;
@@ -582,7 +616,7 @@ function runSubWorkflow(ctx, run, selected, workerId, manifest) {
         childRun = ctx.runner.plan(spec.appId, childInputs);
     }
     catch (error) {
-        return handleHop(ctx, selected, workerId, `sub-workflow plan failed (${spec.appId}): ${errMessage(error)}`);
+        return handleHop(ctx, selected, workerId, `sub-workflow plan failed (${spec.appId}): ${errMessage(error)}`, deferPersist);
     }
     const childResult = drive(ctx.runner, childRun.id, {
         now: ctx.now,
@@ -593,7 +627,7 @@ function runSubWorkflow(ctx, run, selected, workerId, manifest) {
         visitedAppIds: [...ctx.visitedAppIds, parentApp]
     });
     if (childResult.status !== "complete") {
-        return handleHop(ctx, selected, workerId, `sub-workflow ${spec.appId} did not complete (status: ${childResult.status})`);
+        return handleHop(ctx, selected, workerId, `sub-workflow ${spec.appId} did not complete (status: ${childResult.status})`, deferPersist);
     }
     // Bind the child's bytes: the rendered report (default) or the verdict result.
     const finalChild = ctx.runner.loadRun(childRun.id);
@@ -606,15 +640,15 @@ function runSubWorkflow(ctx, run, selected, workerId, manifest) {
         childBytes = node_fs_1.default.existsSync(finalChild.paths.report) ? node_fs_1.default.readFileSync(finalChild.paths.report, "utf8") : undefined;
     }
     if (childBytes === undefined) {
-        return handleHop(ctx, selected, workerId, `sub-workflow ${spec.appId} produced no ${spec.bindResult || "report"}`);
+        return handleHop(ctx, selected, workerId, `sub-workflow ${spec.appId} produced no ${spec.bindResult || "report"}`, deferPersist);
     }
     // Accept through the SAME path as any other result (verifier/schema/evidence gate).
     try {
         node_fs_1.default.writeFileSync(manifest.resultPath, childBytes, "utf8");
-        ctx.runner.recordWorkerOutput(run.id, workerId, manifest.resultPath, {});
+        ctx.runner.recordWorkerOutput(run.id, workerId, manifest.resultPath, deferPersist ? { persistState: false } : {});
     }
     catch (error) {
-        return handleHop(ctx, selected, workerId, `sub-workflow result rejected by parent gate: ${errMessage(error)}`);
+        return handleHop(ctx, selected, workerId, `sub-workflow result rejected by parent gate: ${errMessage(error)}`, deferPersist);
     }
     // Honest cross-link (provenance only — never fails the accepted hop): one
     // worker.sub-workflow audit event on the parent pins the child run + report digest
@@ -720,6 +754,7 @@ function drive(runner, runId, options = {}) {
             return; // only the first not-yet-complete phase is "active"
         }
     };
+    let exhaustedMaxIterations = !options.once;
     for (let i = 0; i < maxIterations; i++) {
         const width = concurrency > 1 ? concurrency : autoWidth(runner.loadRun(runId));
         const roundSteps = width > 1 ? driveConcurrentRound(ctx, width) : [driveStep(ctx)];
@@ -741,27 +776,39 @@ function drive(runner, runId, options = {}) {
         // reuses the run we just advanced; goes to stderr via emitProgress so stdout is clean.
         emitPhaseProgress(runner.loadRun(runId));
         const last = roundSteps[roundSteps.length - 1];
-        if (options.once)
+        if (options.once) {
+            exhaustedMaxIterations = false;
             break;
-        if (last && (last.status === "complete" || last.status === "parked" || last.status === "blocked"))
+        }
+        if (last && (last.status === "complete" || last.status === "parked" || last.status === "blocked")) {
+            exhaustedMaxIterations = false;
             break;
+        }
     }
     const run = runner.loadRun(runId);
     const completedWorkers = countCompleted(run);
     const parkedWorkers = countParked(run);
     const committed = (run.commits || []).find((commit) => commit.reason && commit.reason.startsWith("agent-delegation-drive"));
     const last = steps[steps.length - 1];
+    if (exhaustedMaxIterations) {
+        steps.push(step("blocked", "blocked", {
+            runId,
+            reason: `drive reached max iteration limit (${maxIterations}) before a terminal state`
+        }));
+    }
     const status = options.once
         ? completedWorkers === plannedWorkers && committed
             ? "complete"
             : last && (last.status === "parked" || last.status === "blocked")
                 ? last.status
                 : "in-progress"
-        : parkedWorkers > 0 || (last && last.status === "parked")
-            ? "parked"
-            : last && last.status === "blocked"
-                ? "blocked"
-                : "complete";
+        : exhaustedMaxIterations
+            ? "blocked"
+            : parkedWorkers > 0 || (last && last.status === "parked")
+                ? "parked"
+                : last && last.status === "blocked"
+                    ? "blocked"
+                    : "complete";
     return {
         schemaVersion: 1,
         runId,

package/dist/execution-backend/agent.js

@@ -12,6 +12,7 @@ exports.recordedAgentHandle = recordedAgentHandle;
 exports.extractEndpointResult = extractEndpointResult;
 exports.agentHandle = agentHandle;
 exports.prepareAgentSpawn = prepareAgentSpawn;
+exports.reconcileBatchOutcomes = reconcileBatchOutcomes;
 exports.runAgentBatchOutcomes = runAgentBatchOutcomes;
 // Agent-delegation pure helpers + concurrent batch fulfillment for the
 // execution-backend driver layer. Carved out of execution-backend.ts
@@ -259,36 +260,95 @@ function prepareAgentSpawn(request) {
 // `node -e` string — F11). It reads jobs JSON on stdin, spawns ALL concurrently
 // (shell:false, inherited env — the agent's own credentials resolve; CW never
 // reads them), per-job SIGTERM at timeoutMs + SIGKILL at +5s, caps each captured
-// stdout at 32MB, and prints the outcome array when every job has settled. stderr
-// is drained (a full pipe must never wedge a child). A kill yields exitCode null —
-// the no-exit-code refusal. We spawn it BY PATH (shell:false); the path is
-// resolved from this compiled module (dist/execution-backend/agent.js) up to the
-// package's `scripts/children/` dir, which package.json ships in "files".
+// stdout at 32MB, and streams ONE NDJSON line per job the instant it settles.
+// stderr is drained (a full pipe must never wedge a child). A kill yields
+// exitCode null — the no-exit-code refusal. We spawn it BY PATH (shell:false);
+// the path is resolved from this compiled module (dist/execution-backend/agent.js)
+// up to the package's `scripts/children/` dir, which package.json ships in "files".
 const BATCH_DELEGATE_CHILD_SCRIPT = node_path_1.default.resolve(__dirname, "..", "..", "scripts", "children", "batch-delegate-child.js");
+/** Parse the delegate child's NDJSON stdout and reconcile it against `jobs` by
+ *  index. Runs even when `child.error` is set (ENOBUFS from the combined
+ *  output exceeding maxBuffer, ETIMEDOUT from the parent backstop, or a
+ *  nonzero/null exit) — a batch-level failure must fail-close ONLY the jobs
+ *  whose line never fully arrived, never every job in the batch: a job whose
+ *  line already streamed through keeps its REAL outcome.
+ *
+ *  `stdout` is split on the raw newline BYTE, on a Buffer, before any UTF-8
+ *  decoding — never on a decoded string. 0x0A never appears inside a UTF-8
+ *  continuation byte, so this is a safe boundary; decoding is deferred to
+ *  ONE LINE at a time (bounded by the delegate's own 32MB-per-job cap), so
+ *  no single decode ever approaches V8's hard per-string character ceiling
+ *  regardless of how large the COMBINED batch output is. Decoding the whole
+ *  combined buffer as one string up front (the prior approach) could itself
+ *  throw past that ceiling for a large-enough batch — an uncaught crash, not
+ *  a graceful `child.error` — which this line-at-a-time approach avoids by
+ *  construction. The trailing split segment is always dropped before
+ *  parsing (empty from a clean trailing newline, or a line truncated
+ *  mid-write by a hard kill — either way, never a complete line), and one
+ *  corrupt line can never crash the reconciliation of its siblings. */
+function reconcileBatchOutcomes(jobs, child) {
+    const buf = Buffer.isBuffer(child.stdout) ? child.stdout : Buffer.from(String(child.stdout || ""), "utf8");
+    const byIndex = new Map();
+    let lineStart = 0;
+    for (let i = 0; i < buf.length; i++) {
+        if (buf[i] !== 0x0a)
+            continue;
+        const lineBuf = buf.subarray(lineStart, i);
+        lineStart = i + 1;
+        if (lineBuf.length === 0)
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(lineBuf.toString("utf8"));
+        }
+        catch {
+            continue;
+        }
+        if (typeof parsed.i !== "number" || parsed.i < 0 || parsed.i >= jobs.length)
+            continue;
+        byIndex.set(parsed.i, {
+            ...(parsed.spawnError ? { spawnError: parsed.spawnError } : {}),
+            exitCode: typeof parsed.exitCode === "number" ? parsed.exitCode : null,
+            stdout: String(parsed.stdout || "")
+        });
+    }
+    const reason = child.error
+        ? (0, util_1.messageOf)(child.error)
+        : typeof child.status === "number" && child.status !== 0
+            ? `batch delegate exited with ${child.status}`
+            : "batch delegate produced no outcome for this job";
+    return jobs.map((_, index) => byIndex.get(index) || { spawnError: `batch delegate failed: ${reason}`, exitCode: null, stdout: "" });
+}
 /** Run a batch of agent spawns concurrently; outcomes index-align with jobs. The
  *  parent backstop timeout (max job timeout + 30s) means even a wedged delegate
- *  child cannot deadlock the drive: on any batch-level failure EVERY job settles
- *  as a fail-closed spawn refusal — never a fabricated completion, never a hang. */
+ *  child cannot deadlock the drive. `maxBuffer` scales with batch size (the
+ *  delegate's own per-job 32MB cap is the real safety bound — no separate outer
+ *  ceiling here, since a flat ceiling that stops scaling with job count is
+ *  exactly what let one verbose batch strand its siblings before this fix).
+ *  Collect-all is a real guarantee even under buffer/timeout pressure: a job
+ *  whose NDJSON line fully streamed through keeps its real outcome regardless
+ *  of what happens to the rest of the batch. */
 function runAgentBatchOutcomes(jobs) {
     if (!jobs.length)
         return [];
     const maxTimeout = Math.max(...jobs.map((job) => job.timeoutMs));
-    const child = (0, node_child_process_1.spawnSync)(process.execPath, [BATCH_DELEGATE_CHILD_SCRIPT], {
-        input: JSON.stringify(jobs),
-        encoding: "utf8",
-        maxBuffer: 33 * 1024 * 1024 * jobs.length,
-        timeout: maxTimeout + 30000
-    });
-    if (!child.error && typeof child.status === "number" && child.status === 0) {
-        try {
-            const parsed = JSON.parse(String(child.stdout || ""));
-            if (Array.isArray(parsed) && parsed.length === jobs.length)
-                return parsed;
-        }
-        catch {
-            // fall through to the fail-closed mapping below
-        }
+    // No `encoding` option: keep stdout as a raw Buffer so reconcileBatchOutcomes
+    // can split on the newline byte and decode one line at a time — decoding the
+    // WHOLE combined buffer as one string up front could itself throw past V8's
+    // per-string character ceiling for a large-enough batch (an uncaught crash,
+    // not a graceful child.error). The try/catch below is a second backstop for
+    // any other unexpected native failure at this boundary — a wedged or
+    // over-limit delegate must fail every job closed, never crash the drive.
+    let child;
+    try {
+        child = (0, node_child_process_1.spawnSync)(process.execPath, [BATCH_DELEGATE_CHILD_SCRIPT], {
+            input: JSON.stringify(jobs),
+            maxBuffer: 34 * 1024 * 1024 * jobs.length,
+            timeout: maxTimeout + 30000
+        });
+    }
+    catch (error) {
+        child = { error: error instanceof Error ? error : new Error(String(error)), status: null, stdout: null };
     }
-    const reason = child.error ? (0, util_1.messageOf)(child.error) : `batch delegate exited ${child.status === null ? "without an exit code (timed out or killed)" : `with ${child.status}`}`;
-    return jobs.map(() => ({ spawnError: `batch delegate failed: ${reason}`, exitCode: null, stdout: "" }));
+    return reconcileBatchOutcomes(jobs, child);
 }

package/dist/execution-backend.js

@@ -39,6 +39,7 @@ exports.attestSandbox = attestSandbox;
 exports.probeBackend = probeBackend;
 exports.runBackend = runBackend;
 exports.delegateChildScript = delegateChildScript;
+exports.shouldStreamAgentStderr = shouldStreamAgentStderr;
 exports.createExecutionBackend = createExecutionBackend;
 exports.backendListPayload = backendListPayload;
 exports.backendShowPayload = backendShowPayload;
@@ -410,7 +411,7 @@ function executeLocal(descriptor, policy, request, label, attestation) {
         // Shell injection guard: reject args that contain shell control characters
         // (beyond template placeholders). The command itself is operator-configured.
         const shellArg = [command, ...args].join(" ").replace(/\{\{[a-zA-Z0-9_.-]+\}\}/g, "");
-        if (/[;&|`$(){}<>!\n\r]/.test(shellArg)) {
+        if (/[;&|`$(){}<>!\n\r#*?~]/.test(shellArg)) {
             throw new Error(`Shell backend refused: args contain shell control characters. ` +
                 `Use the node, bun, or agent backend instead for untrusted inputs.`);
         }
@@ -675,6 +676,25 @@ function runHttpDelegation(descriptor, policy, request, label, handle, attestati
 // agentSubstitutions, substituteAgentArg, recordedAgentHandle, extractEndpointResult,
 // agentHandle) and the concurrent batch live in ./execution-backend/agent.ts; the
 // stateful runners below build the refusal/delegated envelopes and stay here.
+/** Decide whether cw FORWARDS the agent wrapper's live stderr view (stdio
+ *  "inherit") or captures it ("pipe"). Default follows isTTY — interactive shows
+ *  the live view, a pipe/CI stays silent (Rule of Silence). The two env knobs are
+ *  explicit opt-out/opt-in, honored regardless of isTTY so a piped/CI run can still
+ *  opt into the wrapper's plain append-only trace, exactly as the man page promises
+ *  (agent-delegation-drive.7.md "Live output"):
+ *    CW_NO_STREAM=1    — master off (wins over everything)
+ *    CW_AGENT_STREAM=0 — off
+ *    CW_AGENT_STREAM=1 — on, even without a TTY
+ *  With no env set this returns isTTY — byte-identical to the prior inline gate (POLA). */
+function shouldStreamAgentStderr(env, isTTY) {
+    if (env.CW_NO_STREAM === "1")
+        return false;
+    if (env.CW_AGENT_STREAM === "0")
+        return false;
+    if (env.CW_AGENT_STREAM === "1")
+        return true;
+    return isTTY;
+}
 function runAgentProcess(descriptor, policy, request, label, handle, attestation) {
     const resolved = (0, agent_1.resolveAgentInvocation)(request);
     const subst = (0, agent_1.agentSubstitutions)(request, resolved.model);
@@ -692,10 +712,10 @@ function runAgentProcess(descriptor, policy, request, label, handle, attestation
             outcome = request.preparedAgentOutcome;
         }
         else {
-            // Live output on by default when stderr is a TTY. stdout is always
-            // captured as data. CI/pipes stay silent. CW_AGENT_STREAM=0 or
-            // CW_NO_STREAM=1 forces off; CW_AGENT_STREAM=1 forces on.
-            const streamStderr = process.env.CW_AGENT_STREAM !== "0" && Boolean(process.stderr.isTTY) && process.env.CW_NO_STREAM !== "1";
+            // Live output on by default when stderr is a TTY. stdout is always captured
+            // as data. CI/pipes stay silent unless CW_AGENT_STREAM=1 opts them into the
+            // wrapper's plain append-only trace; CW_AGENT_STREAM=0 / CW_NO_STREAM=1 force off.
+            const streamStderr = shouldStreamAgentStderr(process.env, Boolean(process.stderr.isTTY));
             // Build child env from sandbox policy as baseline (respects env.inherit/expose/deny),
             // then re-allow CW_* + well-known API key env vars the agent needs.
             const childEnv = buildChildEnv(policy);