cool-workflow 0.1.97 → 0.2.0

package/dist/shell/registry-cli.js

@@ -0,0 +1,329 @@
+"use strict";
+// shell/registry-cli.ts — CLI/MCP-reachable bodies for the milestone-10
+// capability rows: schedule.*, routine.*, registry.*, run.search|list|
+// show|resume|archive|rerun, queue.*, sched.*, gc.*, orphans.*, clones.*,
+// history.
+//
+// MILESTONE 10. Byte-exact port of the old build's
+// src/cli/handlers/{scheduling,registry,maintenance,orphans,clones}.ts +
+// the run-registry-owned slice of src/capability-core.ts. Impure (fs) —
+// this is the shell layer the capability-table's CLI/MCP handlers
+// delegate to.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scheduleCreateCli = scheduleCreateCli;
+exports.scheduleListCli = scheduleListCli;
+exports.scheduleDeleteCli = scheduleDeleteCli;
+exports.scheduleDueCli = scheduleDueCli;
+exports.scheduleCompleteCli = scheduleCompleteCli;
+exports.schedulePauseCli = schedulePauseCli;
+exports.scheduleResumeCli = scheduleResumeCli;
+exports.scheduleRunNowCli = scheduleRunNowCli;
+exports.scheduleHistoryCli = scheduleHistoryCli;
+exports.scheduleDaemonTickCli = scheduleDaemonTickCli;
+exports.scheduleDaemonRunForever = scheduleDaemonRunForever;
+exports.routineCreateCli = routineCreateCli;
+exports.routineListCli = routineListCli;
+exports.routineDeleteCli = routineDeleteCli;
+exports.routineFireCli = routineFireCli;
+exports.routineEventsCli = routineEventsCli;
+exports.registryRefreshCli = registryRefreshCli;
+exports.registryShowCli = registryShowCli;
+exports.runSearchCli = runSearchCli;
+exports.runListCli = runListCli;
+exports.runShowCli = runShowCli;
+exports.runResumeCli = runResumeCli;
+exports.runArchiveCli = runArchiveCli;
+exports.runRerunCli = runRerunCli;
+exports.historyCli = historyCli;
+exports.queueAddCli = queueAddCli;
+exports.queueListCli = queueListCli;
+exports.queueShowCli = queueShowCli;
+exports.queueDrainCli = queueDrainCli;
+exports.gcPlanCli = gcPlanCli;
+exports.gcRunCli = gcRunCli;
+exports.gcVerifyCli = gcVerifyCli;
+exports.orphansListCli = orphansListCli;
+exports.orphansGcCli = orphansGcCli;
+exports.clonesListCli = clonesListCli;
+exports.clonesGcCli = clonesGcCli;
+const path = __importStar(require("node:path"));
+const run_registry_io_1 = require("./run-registry-io");
+const pipeline_1 = require("./pipeline");
+const workflow_app_loader_1 = require("./workflow-app-loader");
+const scheduler_io_1 = require("./scheduler-io");
+const reclamation_io_1 = require("./reclamation-io");
+const pipeline_cli_1 = require("./pipeline-cli");
+function resolveCwd(options) {
+    return path.resolve(String(options.cwd || process.cwd()));
+}
+function optionalString(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function scopeOf(options, fallback) {
+    return options.scope === "repo" || options.scope === "home" ? options.scope : fallback;
+}
+// ---------------------------------------------------------------------
+// schedule.* / cw loop
+// ---------------------------------------------------------------------
+function scheduleCreateCli(options = {}) {
+    return new scheduler_io_1.Scheduler(resolveCwd(options)).create(options);
+}
+function scheduleListCli(options = {}) {
+    return new scheduler_io_1.Scheduler(resolveCwd(options)).list(optionalString(options.status));
+}
+function scheduleDeleteCli(id, options = {}) {
+    return new scheduler_io_1.Scheduler(resolveCwd(options)).delete(id);
+}
+function scheduleDueCli(options = {}) {
+    return new scheduler_io_1.Scheduler(resolveCwd(options)).due();
+}
+function scheduleCompleteCli(id, options = {}) {
+    return new scheduler_io_1.Scheduler(resolveCwd(options)).complete(id, options);
+}
+function schedulePauseCli(id, options = {}) {
+    return new scheduler_io_1.Scheduler(resolveCwd(options)).pause(id);
+}
+function scheduleResumeCli(id, options = {}) {
+    return new scheduler_io_1.Scheduler(resolveCwd(options)).resume(id);
+}
+function scheduleRunNowCli(id, options = {}) {
+    return new scheduler_io_1.Scheduler(resolveCwd(options)).runNow(id);
+}
+function scheduleHistoryCli(id, options = {}) {
+    return new scheduler_io_1.Scheduler(resolveCwd(options)).history(id);
+}
+function scheduleDaemonTickCli(options = {}) {
+    return new scheduler_io_1.DesktopSchedulerDaemon({ cwd: resolveCwd(options), intervalSeconds: options.intervalSeconds ? Number(options.intervalSeconds) : options.interval ? Number(options.interval) : undefined }).tick();
+}
+function scheduleDaemonRunForever(options = {}) {
+    return new scheduler_io_1.DesktopSchedulerDaemon({
+        cwd: resolveCwd(options),
+        intervalSeconds: options.intervalSeconds ? Number(options.intervalSeconds) : options.interval ? Number(options.interval) : undefined,
+    }).run();
+}
+// ---------------------------------------------------------------------
+// routine.*
+// ---------------------------------------------------------------------
+function routineCreateCli(options = {}) {
+    return new scheduler_io_1.RoutineTriggerBridge(resolveCwd(options)).create(options);
+}
+function routineListCli(options = {}) {
+    return new scheduler_io_1.RoutineTriggerBridge(resolveCwd(options)).list(optionalString(options.kind));
+}
+function routineDeleteCli(id, options = {}) {
+    return new scheduler_io_1.RoutineTriggerBridge(resolveCwd(options)).delete(id);
+}
+function routineFireCli(kind, payload, options = {}) {
+    return new scheduler_io_1.RoutineTriggerBridge(resolveCwd(options)).fire(kind, payload);
+}
+function routineEventsCli(id, options = {}) {
+    return new scheduler_io_1.RoutineTriggerBridge(resolveCwd(options)).events(id);
+}
+// ---------------------------------------------------------------------
+// registry.* / run.* / queue.* / history
+// ---------------------------------------------------------------------
+function registryRefreshCli(options = {}) {
+    return new run_registry_io_1.RunRegistry(resolveCwd(options)).refresh({ scope: scopeOf(options, "repo") });
+}
+function registryShowCli(options = {}) {
+    return new run_registry_io_1.RunRegistry(resolveCwd(options)).show({ scope: scopeOf(options, "repo") });
+}
+function runSearchCli(options = {}) {
+    return new run_registry_io_1.RunRegistry(resolveCwd(options)).search({
+        scope: scopeOf(options, "home"),
+        text: optionalString(options.text),
+        app: optionalString(options.app),
+        status: optionalString(options.status),
+        repo: optionalString(options.repo),
+        since: optionalString(options.since),
+        until: optionalString(options.until),
+        includeArchived: options.includeArchived === undefined ? undefined : Boolean(options.includeArchived),
+        limit: options.limit === undefined ? undefined : Number(options.limit),
+        offset: options.offset === undefined ? undefined : Number(options.offset),
+    });
+}
+function runListCli(options = {}) {
+    return new run_registry_io_1.RunRegistry(resolveCwd(options)).list({
+        scope: scopeOf(options, "home"),
+        includeArchived: options.includeArchived === undefined ? undefined : Boolean(options.includeArchived),
+        limit: options.limit === undefined ? undefined : Number(options.limit),
+        offset: options.offset === undefined ? undefined : Number(options.offset),
+    });
+}
+function runShowCli(runId, options = {}) {
+    return new run_registry_io_1.RunRegistry(resolveCwd(options)).showRun(runId, { scope: scopeOf(options, "home") });
+}
+/** `run resume <run-id> [--drive|--once]` — SPEC/pipeline-run.md: default
+ *  is read-only and byte-identical to the registry resume payload; with
+ *  `--drive`/`--once` the SAME run (nothing re-planned) is handed to the
+ *  real drive loop and the payload gains a `drive: DriveResult` field. */
+function runResumeCli(runId, options = {}) {
+    const base = new run_registry_io_1.RunRegistry(resolveCwd(options)).resume(runId, {
+        scope: scopeOf(options, "home"),
+        limit: options.limit === undefined ? undefined : Number(options.limit),
+    });
+    if (!options.drive && !options.once)
+        return base;
+    const drive = (0, pipeline_cli_1.runDriveStep)({ ...options, runId: base.runId, repo: base.repo, once: Boolean(options.once) });
+    return { ...base, drive };
+}
+function runArchiveCli(runId, options = {}) {
+    const registry = new run_registry_io_1.RunRegistry(resolveCwd(options));
+    if (!runId) {
+        const olderThanDays = Number(options.olderThanDays ?? options["older-than-days"]);
+        if (!Number.isFinite(olderThanDays))
+            throw new Error("Missing run id (or --older-than-days N for the retention policy path).");
+        const states = Array.isArray(options.state) ? options.state : options.state ? [options.state] : undefined;
+        return registry.archiveByPolicy({
+            schemaVersion: 1,
+            archiveOlderThanDays: olderThanDays,
+            archiveStates: states || ["completed", "failed"],
+            defaultQueuePriority: 100,
+        }, { scope: scopeOf(options, "home") });
+    }
+    return registry.archive(runId, {
+        reason: optionalString(options.reason),
+        scope: scopeOf(options, "home"),
+        unarchive: Boolean(options.unarchive),
+    });
+}
+/** The CLI/MCP-path run planner: the old build injected the CoolWorkflowRunner
+ *  (its `.plan(appId, inputs)`) as RunRegistry's planner so `cw run rerun` /
+ *  `cw_run_rerun` could plan the new linked run. v2 dismantled that facade, so
+ *  we rebuild the same `.plan(appId, inputs)` surface from the two pieces that
+ *  replaced it: resolve the app object with loadWorkflowApp, then hand it to the
+ *  pure pipeline plan(). Without this, RunRegistry.rerun throws
+ *  "rerun requires a run planner (CoolWorkflowRunner)". */
+function cliRunPlanner() {
+    return { plan: (appId, inputs) => (0, pipeline_1.plan)((0, workflow_app_loader_1.loadWorkflowApp)(appId), inputs) };
+}
+function runRerunCli(runId, options = {}) {
+    return new run_registry_io_1.RunRegistry(resolveCwd(options), cliRunPlanner()).rerun(runId, { reason: optionalString(options.reason), scope: scopeOf(options, "home") });
+}
+function historyCli(options = {}) {
+    return new run_registry_io_1.RunRegistry(resolveCwd(options)).history({
+        scope: scopeOf(options, "home"),
+        app: optionalString(options.app),
+        status: optionalString(options.status),
+        limit: options.limit === undefined ? undefined : Number(options.limit),
+        offset: options.offset === undefined ? undefined : Number(options.offset),
+    });
+}
+function queueAddCli(options = {}) {
+    return new run_registry_io_1.RunRegistry(resolveCwd(options)).queueAdd({
+        runId: optionalString(options.runId),
+        appId: optionalString(options.app || options.appId),
+        workflowId: optionalString(options.workflow || options.workflowId),
+        repo: optionalString(options.repo),
+        priority: options.priority === undefined ? undefined : Number(options.priority),
+        note: optionalString(options.note),
+        id: optionalString(options.id),
+    });
+}
+function queueListCli(options = {}) {
+    return new run_registry_io_1.RunRegistry(resolveCwd(options)).queueList({ status: optionalString(options.status), repo: optionalString(options.repo) });
+}
+function queueShowCli(id, options = {}) {
+    return new run_registry_io_1.RunRegistry(resolveCwd(options)).queueShow(id);
+}
+function queueDrainCli(options = {}) {
+    return new run_registry_io_1.RunRegistry(resolveCwd(options)).queueDrain({
+        limit: options.limit === undefined ? undefined : Number(options.limit),
+        repo: optionalString(options.repo),
+    });
+}
+// ---------------------------------------------------------------------
+// gc.* / orphans.* / clones.*
+// ---------------------------------------------------------------------
+function gcPolicyOverridesFrom(options) {
+    const overrides = {};
+    if (options.reclaimAfterArchiveDays !== undefined)
+        overrides.reclaimAfterArchiveDays = Number(options.reclaimAfterArchiveDays);
+    if (options.keepScratch !== undefined)
+        overrides.keepScratch = Boolean(options.keepScratch);
+    if (options["keep-scratch"] !== undefined)
+        overrides.keepScratch = Boolean(options["keep-scratch"]);
+    if (options.keepSnapshots !== undefined)
+        overrides.keepSnapshots = Boolean(options.keepSnapshots);
+    if (options["keep-snapshots"] !== undefined)
+        overrides.keepSnapshots = Boolean(options["keep-snapshots"]);
+    if (options.state !== undefined)
+        overrides.reclaimStates = Array.isArray(options.state) ? options.state : [options.state];
+    return overrides;
+}
+function gcPlanCli(runId, options = {}) {
+    const registry = new run_registry_io_1.RunRegistry(resolveCwd(options));
+    return (0, reclamation_io_1.gcPlan)(registry, {
+        scope: scopeOf(options, "home"),
+        runId,
+        policy: gcPolicyOverridesFrom(options),
+        now: optionalString(options.now),
+    });
+}
+function gcRunCli(runId, options = {}) {
+    const registry = new run_registry_io_1.RunRegistry(resolveCwd(options));
+    return (0, reclamation_io_1.gcRun)(registry, {
+        scope: scopeOf(options, "home"),
+        runId,
+        policy: gcPolicyOverridesFrom(options),
+        now: optionalString(options.now),
+        actor: optionalString(options.actor),
+        limit: options.limit === undefined ? undefined : Number(options.limit),
+    });
+}
+function gcVerifyCli(runId, options = {}) {
+    const registry = new run_registry_io_1.RunRegistry(resolveCwd(options));
+    return (0, reclamation_io_1.gcVerify)(registry, runId, { scope: scopeOf(options, "home") });
+}
+function orphansListCli(options = {}) {
+    const registry = new run_registry_io_1.RunRegistry(resolveCwd(options));
+    return (0, reclamation_io_1.listOrphanRuns)(registry, { scope: scopeOf(options, "home"), now: optionalString(options.now) });
+}
+function orphansGcCli(options = {}) {
+    const registry = new run_registry_io_1.RunRegistry(resolveCwd(options));
+    return (0, reclamation_io_1.gcOrphanRuns)(registry, {
+        scope: scopeOf(options, "home"),
+        minAgeMinutes: options.minAgeMinutes !== undefined ? Number(options.minAgeMinutes) : options["min-age-minutes"] !== undefined ? Number(options["min-age-minutes"]) : undefined,
+        all: Boolean(options.all),
+        now: optionalString(options.now),
+    });
+}
+function clonesListCli() {
+    return (0, reclamation_io_1.listClones)(process.env);
+}
+function clonesGcCli(options = {}) {
+    return (0, reclamation_io_1.gcClones)({ olderThanDays: options.olderThanDays ?? options["older-than-days"], all: options.all, now: options.now }, process.env);
+}

package/dist/{remote-source.js → shell/remote-source.js}

@@ -27,7 +27,7 @@ const node_crypto_1 = require("node:crypto");
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_url_1 = require("node:url");
-const run_registry_1 = require("./run-registry");
+const agent_config_1 = require("./agent-config");
 /** Upper bound on a downloaded archive (200 MiB) — a review target should be source, not a
  *  binary blob; a giant download fails closed rather than exhausting disk/memory. */
 const MAX_ARCHIVE_BYTES = 200 * 1024 * 1024;
@@ -126,7 +126,7 @@ function safePathname(value) {
     }
 }
 function cacheRoot(opts) {
-    return node_path_1.default.join(opts.home || (0, run_registry_1.resolveCwHome)(opts.env), "clones");
+    return node_path_1.default.join(opts.home || (0, agent_config_1.resolveCwHome)(opts.env), "clones");
 }
 function cacheDirFor(root, sanitizedUrl, ref) {
     const key = (0, node_crypto_1.createHash)("sha256").update(`${sanitizedUrl}\0${ref || ""}`).digest("hex").slice(0, 24);
@@ -287,9 +287,13 @@ function fetchArchiveBytes(rawUrl, sanitizedUrl, dest, opts) {
         "if(!r.ok){process.stderr.write('HTTP '+r.status+' '+r.statusText);process.exit(2);}",
         "const len=Number(r.headers.get('content-length')||0);",
         "if(cap&&len>cap){process.stderr.write('archive too large');process.exit(3);}",
-        "const buf=Buffer.from(await r.arrayBuffer());",
-        "if(cap&&buf.length>cap){process.stderr.write('archive too large');process.exit(3);}",
-        "fs.writeFileSync(out,buf);return;}",
+        "if(!r.body||!r.body.getReader){process.stderr.write('response body is not streamable');process.exit(4);}",
+        "const fd=fs.openSync(out,'w');let total=0;",
+        "try{const reader=r.body.getReader();for(;;){const x=await reader.read();if(x.done)break;",
+        "const chunk=Buffer.from(x.value);total+=chunk.length;",
+        "if(cap&&total>cap){try{await reader.cancel();}catch{};fs.closeSync(fd);fs.rmSync(out,{force:true});process.stderr.write('archive too large');process.exit(3);}",
+        "fs.writeSync(fd,chunk,0,chunk.length);}fs.closeSync(fd);return;}",
+        "catch(e){try{fs.closeSync(fd);}catch{};fs.rmSync(out,{force:true});throw e;}}",
         "process.stderr.write('too many redirects');process.exit(6);",
         "})().catch(e=>{process.stderr.write(String((e&&e.message)||e));process.exit(4);});"
     ].join("");
@@ -315,6 +319,9 @@ function listArchive(file, isZip) {
         if (isZip && result.error?.code === "ENOENT") {
             throw new Error("unzip is required to review a .zip link but was not found on PATH (use a .tar.gz or a git URL)");
         }
+        if (!isZip && result.error?.code === "ENOENT") {
+            throw new Error("tar is required to review a .tar/.tgz link but was not found on PATH");
+        }
         throw new Error(`could not read archive: ${String(result.stderr || "").trim() || `exit ${result.status}`}`);
     }
     return String(result.stdout || "").split(/\r?\n/).filter(Boolean);

package/dist/shell/report-cli.js

@@ -0,0 +1,101 @@
+"use strict";
+// shell/report-cli.ts — CLI/MCP-reachable bodies for `cw report bundle`
+// and `cw report verify-bundle`.
+//
+// MILESTONE 8. Byte-exact port of the old build's capability-core.ts's
+// `reportBundle`/`runVerifyReportBundle` argv shapes.
+//
+// Evidence: SPEC/ledger-trust.md "CLI: `cw report verify-bundle` and `cw
+// report bundle`"; plugins/cool-workflow/src/capability-core.ts:396-433.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reportBundleCli = reportBundleCli;
+exports.reportVerifyBundleCli = reportVerifyBundleCli;
+const path = __importStar(require("node:path"));
+const run_export_1 = require("./run-export");
+const run_store_1 = require("./run-store");
+function optionalString(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function invocationCwd(args) {
+    return typeof args.cwd === "string" && args.cwd.trim() ? path.resolve(args.cwd) : process.cwd();
+}
+const SYSTEM_DIRS = /^\/(etc|bin|sbin|usr|Library|System|Applications|boot|dev|proc|sys|root|var\/log|var\/run)\//;
+function reportBundleCli(runId, args) {
+    if (!runId)
+        throw new Error("report bundle requires a run id (cw report bundle <run-id>)");
+    const base = invocationCwd(args);
+    const run = (0, run_store_1.loadRunFromCwd)(runId, base);
+    const output = optionalString(args.output || args.path || args.archive) || `${runId}.cwrun.json`;
+    const outputPath = path.resolve(base, output);
+    if (SYSTEM_DIRS.test(outputPath)) {
+        throw new Error(`Refusing to write archive to a system directory: ${output}`);
+    }
+    // Optionally seal in the operator's PUBLIC trust key so the bundle
+    // re-verifies offline. Default falls back to the same env the verify
+    // gate reads, so a single configured key both attests at record-time
+    // and travels with the export.
+    const trustKeyArg = optionalString(args["with-trust-key"] || args.withTrustKey || args.trustKey || args.pubkey) || process.env.CW_AGENT_ATTEST_PUBKEY;
+    const exported = (0, run_export_1.exportRun)(run, outputPath, { trustPublicKey: trustKeyArg });
+    const extractReportTo = optionalString(args["extract-report"] || args.extractReport || args.extractReportTo);
+    const verification = (0, run_export_1.verifyReportBundle)(exported.path, {
+        pubkey: optionalString(args.pubkey || args.pubKey || args.publicKey),
+        extractReportTo: extractReportTo ? path.resolve(base, extractReportTo) : undefined,
+        strictSignatures: Boolean(args["strict-signatures"] || args.strictSignatures || args.strictSigs),
+        requireSignatures: Boolean(args["require-signatures"] || args.requireSignatures || args.requireSigs),
+    });
+    return {
+        schemaVersion: 1,
+        runId,
+        archivePath: exported.path,
+        trustKeyEmbedded: exported.trustKeyEmbedded,
+        reportExtractedTo: verification.reportExtractedTo,
+        verification,
+        ok: verification.ok,
+    };
+}
+function reportVerifyBundleCli(args) {
+    const base = invocationCwd(args);
+    const archive = optionalString(args.archive || args.path || args.file || args.bundle);
+    if (!archive)
+        throw new Error("report verify-bundle requires a bundle path (positional, --archive, --path, --file, or --bundle)");
+    const extractReportTo = optionalString(args["extract-report"] || args.extractReport || args.extractReportTo);
+    return (0, run_export_1.verifyReportBundle)(path.resolve(base, archive), {
+        pubkey: optionalString(args.pubkey || args.pubKey || args.publicKey),
+        extractReportTo: extractReportTo ? path.resolve(base, extractReportTo) : undefined,
+        strictSignatures: Boolean(args["strict-signatures"] || args.strictSignatures || args.strictSigs),
+        requireSignatures: Boolean(args["require-signatures"] || args.requireSignatures || args.requireSigs),
+    });
+}

package/dist/shell/report-view-cli.js

@@ -0,0 +1,117 @@
+"use strict";
+// shell/report-view-cli.ts — CLI/MCP-facing entry points for `cw report
+// <run-id>`, `cw status`, `cw graph`, `cw operator status|report|graph`.
+//
+// MILESTONE 11 (reporting/observability). Wires shell/operator-ux.ts +
+// shell/report.ts + shell/operator-ux-text.ts into the shapes
+// core/capability-table.ts's CLI/MCP bindings call, matching shell/
+// pipeline-cli.ts's pattern.
+//
+// Evidence: SPEC/reporting-ux.md "CLI commands" (`cw report`, `cw
+// status`, `cw operator status|report`, `cw graph`).
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reportWriteCli = reportWriteCli;
+exports.statusCli = statusCli;
+exports.statusSummaryText = statusSummaryText;
+exports.statusFullText = statusFullText;
+exports.operatorStatusCli = operatorStatusCli;
+exports.operatorReportCli = operatorReportCli;
+exports.operatorReportText = operatorReportText;
+exports.graphCli = graphCli;
+exports.graphText = graphText;
+exports.optionalString = optionalString;
+const path = __importStar(require("node:path"));
+const run_store_1 = require("./run-store");
+const report_1 = require("./report");
+const operator_ux_1 = require("./operator-ux");
+const operator_ux_text_1 = require("./operator-ux-text");
+function invocationCwd(args) {
+    return typeof args.cwd === "string" && args.cwd.trim() ? path.resolve(args.cwd) : process.cwd();
+}
+function optionalString(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+/** `cw report <run-id>` — writes report.md fresh and returns just its
+ *  path (the CLI binding prints ONLY this path + "\n" to stdout; `--json`
+ *  prints `{path}`). */
+function reportWriteCli(runId, args) {
+    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    return { path: (0, report_1.writeReport)(run) };
+}
+/** `cw status [<run-id>]` / `cw_status` — no id: the fixed advice shape;
+ *  with an id: `summarizeRun`'s payload. */
+function statusCli(runId, args) {
+    if (!runId)
+        return { runId: null, nextActions: (0, operator_ux_1.adviseNoRun)() };
+    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    return (0, operator_ux_1.summarizeRun)(run);
+}
+/** `cw status <id> --summary`/`--brief` human text. */
+function statusSummaryText(runId, args) {
+    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    return (0, operator_ux_text_1.formatOperatorSummary)((0, operator_ux_1.summarizeOperatorRun)(run));
+}
+/** The full `cw status <id>` human text. */
+function statusFullText(runId, args) {
+    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    return (0, operator_ux_text_1.formatOperatorStatus)((0, operator_ux_1.summarizeOperatorRun)(run));
+}
+/** `cw operator status <id> [--json]`. */
+function operatorStatusCli(runId, args) {
+    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    return (0, operator_ux_1.summarizeOperatorRun)(run);
+}
+/** `cw operator report <id> [--json]` — also re-writes report.md as a
+ *  side effect (byte-exact to the old build's operator report verb). */
+function operatorReportCli(runId, args) {
+    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    (0, report_1.writeReport)(run);
+    return (0, operator_ux_1.summarizeOperatorRun)(run);
+}
+function operatorReportText(runId, args) {
+    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    (0, report_1.writeReport)(run);
+    return (0, operator_ux_text_1.formatOperatorReport)((0, operator_ux_1.summarizeOperatorRun)(run), []);
+}
+/** `cw graph <id> [--json]` / `cw operator graph`. */
+function graphCli(runId, args) {
+    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    return (0, operator_ux_1.buildOperatorGraph)(run);
+}
+function graphText(runId, args) {
+    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    return (0, operator_ux_text_1.formatOperatorGraph)((0, operator_ux_1.buildOperatorGraph)(run));
+}