cool-workflow 0.1.97 → 0.2.0

package/dist/shell/state-cli.js

@@ -0,0 +1,181 @@
+"use strict";
+// shell/state-cli.ts — CLI/MCP-reachable bodies for the state-kernel
+// capability rows (state.check, migration.list|check|prove, node.list|
+// show|graph|snapshot|diff|replay|replay.verify, contract.show).
+//
+// MILESTONE 3. Byte-exact port of the old build's checkState (src/
+// orchestrator/lifecycle-operations.ts:428-435), migrationList/Check/Prove
+// (src/orchestrator/migration-operations.ts), and the node.* runner
+// methods (src/orchestrator.ts:387-397,570-587). Impure (fs) — this is the
+// shell layer the capability-table's CLI/MCP handlers delegate to; the
+// decision logic itself lives in core/state/*.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkState = checkState;
+exports.migrationList = migrationList;
+exports.migrationCheck = migrationCheck;
+exports.migrationProve = migrationProve;
+exports.nextCli = nextCli;
+exports.listNodes = listNodes;
+exports.getRunNode = getRunNode;
+exports.showNode = showNode;
+exports.graphNodes = graphNodes;
+exports.nodeSnapshotCli = nodeSnapshotCli;
+exports.nodeDiffCli = nodeDiffCli;
+exports.nodeReplayCli = nodeReplayCli;
+exports.nodeReplayVerifyCli = nodeReplayVerifyCli;
+exports.optionalStringArg = optionalStringArg;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const fs_atomic_1 = require("./fs-atomic");
+const run_store_1 = require("./run-store");
+const node_store_1 = require("./node-store");
+const contract_migration_1 = require("../core/state/contract-migration");
+const node_snapshot_1 = require("../core/state/node-snapshot");
+const dispatch_1 = require("../core/pipeline/dispatch");
+function optionalStringArg(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function resolveCwd(options) {
+    return path.resolve(String(options.cwd || process.cwd()));
+}
+// ---------------------------------------------------------------------
+// state.check
+// ---------------------------------------------------------------------
+/** `cw state check <run-id> [--state PATH] [--write] [--cwd PATH]`. */
+function checkState(runId, options = {}) {
+    const cwd = resolveCwd(options);
+    const statePath = options.state ? path.resolve(String(options.state)) : path.join(cwd, ".cw", "runs", runId, "state.json");
+    const result = (0, run_store_1.migrateRunStateFile)(statePath, { write: Boolean(options.write) });
+    return result.report;
+}
+// ---------------------------------------------------------------------
+// migration.list | migration.check | migration.prove
+// ---------------------------------------------------------------------
+function migrationList() {
+    return { contracts: (0, contract_migration_1.listMigrationContracts)() };
+}
+/** Resolves `target` to an existing file (absolute/relative to
+ *  `process.cwd()`, NOT the `--cwd` option — matches the old build's
+ *  `loadMigrationSnapshot` literally) else `<cwd>/.cw/runs/<target>/
+ *  state.json`. Throws `Migration target not found: <target>` when
+ *  neither exists. */
+function loadMigrationSnapshot(target, options) {
+    const contract = options.contract === "workflow-app" ? "workflow-app" : "run-state";
+    const file = fs.existsSync(target) && fs.statSync(target).isFile()
+        ? path.resolve(target)
+        : path.join(process.cwd(), ".cw", "runs", target, "state.json");
+    if (!fs.existsSync(file))
+        throw new Error(`Migration target not found: ${target}`);
+    return { snapshot: (0, fs_atomic_1.readJson)(file), contract, dir: path.dirname(file) };
+}
+function migrationCheck(target, options = {}) {
+    const { snapshot, contract } = loadMigrationSnapshot(target, options);
+    return (0, contract_migration_1.checkMigration)(contract, snapshot);
+}
+/** Appends the proof beside the target (NEVER overwriting source) under
+ *  `<targetDir>/migration/<first 16 hex of fingerprint>.json`; a
+ *  read-only target still returns the proof (write failure is
+ *  best-effort/swallowed). */
+function migrationProve(target, options = {}) {
+    const { snapshot, contract, dir } = loadMigrationSnapshot(target, options);
+    const proof = (0, contract_migration_1.proveMigration)(contract, snapshot);
+    try {
+        (0, fs_atomic_1.writeJson)(path.join(dir, "migration", `${proof.fingerprint.replace("sha256:", "").slice(0, 16)}.json`), proof);
+    }
+    catch {
+        /* read-only target — the proof is still returned */
+    }
+    return proof;
+}
+// ---------------------------------------------------------------------
+// node.list | node.show | node.graph | node.snapshot | node.diff |
+// node.replay | node.replay.verify
+// ---------------------------------------------------------------------
+function loadRun(runId, options = {}) {
+    const cwd = options.cwd ? path.resolve(String(options.cwd)) : process.cwd();
+    return (0, run_store_1.loadRunFromCwd)(runId, cwd);
+}
+function numberOption(value) {
+    if (value === undefined || value === null || value === true)
+        return undefined;
+    const n = Number(value);
+    return Number.isFinite(n) ? n : undefined;
+}
+/** `cw next <run-id> [--limit N]` — the read-only "what would dispatch next"
+ *  preview: the runnable tasks the next `cw dispatch` would pick, in order,
+ *  without mutating state. A byte-behavior port of the old build's
+ *  orchestrator.next (nextDispatchTasks over the loaded run). Both the CLI and
+ *  the cw_next MCP tool render this same DispatchTask[] value, so their
+ *  payloads stay identical. */
+function nextCli(runId, options = {}) {
+    return (0, dispatch_1.nextDispatchTasks)(loadRun(runId, options), numberOption(options.limit));
+}
+function listNodes(runId, options = {}) {
+    return loadRun(runId, options).nodes || [];
+}
+function getRunNode(run, nodeId) {
+    const node = (run.nodes || []).find((candidate) => candidate.id === nodeId);
+    if (!node)
+        throw new Error(`Unknown state node for run ${run.id}: ${nodeId}`);
+    return node;
+}
+function showNode(runId, nodeId, options = {}) {
+    return getRunNode(loadRun(runId, options), nodeId);
+}
+function graphNodes(runId, options = {}) {
+    return (loadRun(runId, options).nodes || []).map((node) => ({
+        id: node.id,
+        kind: node.kind,
+        status: node.status,
+        parents: node.parents,
+        children: node.children,
+    }));
+}
+function nodeSnapshotCli(runId, nodeId, options = {}) {
+    return (0, node_store_1.snapshotNode)(loadRun(runId, options), nodeId, options);
+}
+function nodeDiffCli(runId, baselineSnapshotId, candidateSnapshotId, options = {}) {
+    const run = loadRun(runId, options);
+    return (0, node_snapshot_1.diffNodeSnapshots)((0, node_store_1.readNodeSnapshot)(run, baselineSnapshotId), (0, node_store_1.readNodeSnapshot)(run, candidateSnapshotId));
+}
+function nodeReplayCli(runId, snapshotId, options = {}) {
+    const run = loadRun(runId, options);
+    return (0, node_store_1.replayNodeSnapshot)(run, (0, node_store_1.readNodeSnapshot)(run, snapshotId), options);
+}
+function nodeReplayVerifyCli(runId, replayId, options = {}) {
+    const run = loadRun(runId, options);
+    return (0, node_snapshot_1.verifyNodeReplay)(run, (0, node_store_1.readNodeReplay)(run, replayId), options);
+}

package/dist/shell/state-explosion-cli.js

@@ -0,0 +1,197 @@
+"use strict";
+// shell/state-explosion-cli.ts — CLI/MCP-reachable bodies for the
+// state-explosion capability rows (summary.refresh, summary.show).
+//
+// MILESTONE 4. Byte-exact port of the old build's
+// `refreshStateExplosionSummaries`/`loadStateExplosionSummaryIndex`/
+// `showStateExplosionSummary`/`maybeCompactRun` (src/state-explosion.ts)
+// DISK I/O half — the report VALUE itself is built by core/state/state-
+// explosion/report.ts's `buildStateExplosionReport` (pure); this file only
+// writes/reads the summary files and wires the CLI handler bodies.
+//
+// Evidence: SPEC/state-core.md "refreshStateExplosionSummaries(...)",
+// "loadStateExplosionSummaryIndex(...)", "showStateExplosionSummary(...)",
+// "maybeCompactRun(...) — best-effort ... ALL errors silently caught".
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildStateExplosionReport = void 0;
+exports.maybeCompactRun = maybeCompactRun;
+exports.refreshStateExplosionSummaries = refreshStateExplosionSummaries;
+exports.loadStateExplosionSummaryIndex = loadStateExplosionSummaryIndex;
+exports.showStateExplosionSummary = showStateExplosionSummary;
+exports.summaryRefreshCli = summaryRefreshCli;
+exports.summaryShowCli = summaryShowCli;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const fs_atomic_1 = require("./fs-atomic");
+const run_store_1 = require("./run-store");
+const hash_1 = require("../core/hash");
+const size_1 = require("../core/state/state-explosion/size");
+const graph_1 = require("../core/state/state-explosion/graph");
+const digest_1 = require("../core/state/state-explosion/digest");
+const helpers_1 = require("../core/state/state-explosion/helpers");
+const report_1 = require("../core/state/state-explosion/report");
+Object.defineProperty(exports, "buildStateExplosionReport", { enumerable: true, get: function () { return report_1.buildStateExplosionReport; } });
+const size_2 = require("../core/state/state-explosion/size");
+const multi_agent_operator_ux_1 = require("./multi-agent-operator-ux");
+function summariesDir(run) {
+    return path.join(run.paths.runDir, "summaries");
+}
+/** Best-effort: when `shouldCompactRun(run)`, refresh the summaries. ALL
+ *  errors silently caught — a state mutation must never fail because of
+ *  compaction. */
+function maybeCompactRun(run) {
+    try {
+        if ((0, report_1.shouldCompactRun)(run))
+            refreshStateExplosionSummaries(run);
+    }
+    catch {
+        // Best-effort optimization only.
+    }
+}
+/** Writes every summary record plus `index.json` and
+ *  `state-explosion-report.json` under `<runDir>/summaries/`. Trust-audit
+ *  event recording (`kind: "summary.refresh"`) is deferred to milestone 8
+ *  (no trust-audit module exists yet); this is a purely observational
+ *  side effect in the old build and does not affect the JSON this
+ *  function returns or persists. */
+function refreshStateExplosionSummaries(run, options = {}) {
+    const thresholds = options.thresholds || size_1.DEFAULT_STATE_EXPLOSION_THRESHOLDS;
+    const now = options.now || new Date().toISOString();
+    const dir = summariesDir(run);
+    fs.mkdirSync(dir, { recursive: true });
+    const views = options.views || graph_1.GRAPH_VIEWS;
+    const graphView = (0, graph_1.runToGraphViewFromWorkflowRun)(run);
+    // See core/state/state-explosion/report.ts's own note on this cast.
+    const blackboardDigest = (0, digest_1.summarizeBlackboardDigest)({
+        id: run.id,
+        blackboard: run.blackboard,
+    }, undefined, now);
+    const stateSize = (0, size_2.computeStateSizeWithGraph)(run, thresholds, graphView);
+    const compactGraph = (0, graph_1.buildCompactGraphFromView)(run.id, graphView, "compact", { thresholds, now });
+    // Built once here and reused below (report tail) so this refresh calls
+    // operatorDigestInput/summarizeMultiAgentOperator exactly once.
+    const operatorInput = (0, multi_agent_operator_ux_1.operatorDigestInput)(run);
+    const operatorDigest = (0, report_1.buildOperatorDigest)(run, compactGraph, blackboardDigest, stateSize, now, operatorInput);
+    const graphRecords = views.map((view) => (0, graph_1.buildCompactGraphFromView)(run.id, graphView, view, { thresholds, now }));
+    const entries = [];
+    const writeRecord = (id, record, scope, fingerprint, included, omitted) => {
+        const file = path.join(dir, `${(0, fs_atomic_1.safeFileName)(id)}.json`);
+        (0, fs_atomic_1.writeJson)(file, record);
+        entries.push({ scope, id, path: file, sourceFingerprint: fingerprint, includedCount: included, omittedCount: omitted, status: "valid" });
+    };
+    writeRecord(blackboardDigest.id, blackboardDigest, "blackboard", blackboardDigest.sourceFingerprint, blackboardDigest.includedCount, blackboardDigest.omittedCount);
+    writeRecord(operatorDigest.id, operatorDigest, "run", operatorDigest.sourceFingerprint, operatorDigest.includedCount, operatorDigest.omittedCount);
+    for (const record of graphRecords) {
+        writeRecord(record.id, record, "run", record.sourceFingerprint, record.compactNodeCount, record.collapsedNodeCount);
+    }
+    const reportPath = path.join(dir, "state-explosion-report.json");
+    const index = {
+        schemaVersion: operatorDigest.schemaVersion,
+        runId: run.id,
+        id: "multi-agent-summary-index",
+        scope: "run",
+        sourceRecordIds: (0, helpers_1.unique)([...blackboardDigest.sourceRecordIds, ...operatorDigest.sourceRecordIds]),
+        sourceFingerprint: (0, hash_1.fingerprintStrings)([compactGraph.sourceFingerprint, blackboardDigest.sourceFingerprint, operatorDigest.sourceFingerprint, String(stateSize.total)]),
+        includedCount: entries.reduce((acc, e) => acc + e.includedCount, 0),
+        omittedCount: entries.reduce((acc, e) => acc + e.omittedCount, 0),
+        importantRefs: operatorDigest.criticalPath,
+        evidenceRefs: operatorDigest.evidenceRefs,
+        trustAuditEventRefs: blackboardDigest.trustAuditEventRefs,
+        generatedAt: now,
+        status: "valid",
+        deterministic: true,
+        nextAction: `node scripts/cw.js summary show ${run.id}`,
+        entries: entries.sort((a, b) => a.id.localeCompare(b.id)),
+        views,
+        paths: { summariesDir: dir, indexPath: path.join(dir, "index.json"), reportPath },
+    };
+    (0, fs_atomic_1.writeJson)(index.paths.indexPath, index);
+    // Pass the graphView and operator input already built above so
+    // buildStateExplosionReport does not call runToGraphViewFromWorkflowRun(run)
+    // or operatorDigestInput(run) a second time this refresh.
+    const report = (0, report_1.buildStateExplosionReport)(run, { thresholds, index, now, operator: operatorInput, graphView });
+    (0, fs_atomic_1.writeJson)(reportPath, report);
+    return index;
+}
+/** Reads `summaries/index.json`; returns `undefined` when the file is
+ *  missing, unparseable, or its `id` is not `multi-agent-summary-index`. */
+function loadStateExplosionSummaryIndex(run) {
+    const indexPath = path.join(summariesDir(run), "index.json");
+    if (!fs.existsSync(indexPath))
+        return undefined;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(indexPath, "utf8"));
+        if (!parsed || parsed.id !== "multi-agent-summary-index")
+            return undefined;
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Loads the persisted index (if any), builds the report against it.
+ *  Trust-audit `summary.stale` event recording is deferred to milestone 8
+ *  (see `refreshStateExplosionSummaries`'s own note). */
+function showStateExplosionSummary(run, options = {}) {
+    const index = loadStateExplosionSummaryIndex(run);
+    return (0, report_1.buildStateExplosionReport)(run, { thresholds: options.thresholds, index, operator: (0, multi_agent_operator_ux_1.operatorDigestInput)(run) });
+}
+// ---------------------------------------------------------------------
+// CLI-facing wrappers: `cw summary refresh <run-id> [--json]` / `cw
+// summary show <run-id> [--json]`.
+// ---------------------------------------------------------------------
+function loadRun(runId, options = {}) {
+    const cwd = options.cwd ? path.resolve(String(options.cwd)) : process.cwd();
+    return (0, run_store_1.loadRunFromCwd)(runId, cwd);
+}
+/** `cw summary refresh <run-id> [--json]` — refresh also runs `writeReport`
+ *  + `saveCheckpoint` in the old build; `writeReport` (report.md) is a
+ *  later-milestone (11) concern, so this milestone runs `saveCheckpoint`
+ *  only (the run-state checkpoint write is real and load-bearing today;
+ *  report.md rendering is not). */
+function summaryRefreshCli(runId, options = {}) {
+    const run = loadRun(runId, options);
+    const index = refreshStateExplosionSummaries(run);
+    (0, run_store_1.saveCheckpoint)(run);
+    return index;
+}
+/** `cw summary show <run-id> [--json]` — also runs `saveCheckpoint`. */
+function summaryShowCli(runId, options = {}) {
+    const run = loadRun(runId, options);
+    const report = showStateExplosionSummary(run);
+    (0, run_store_1.saveCheckpoint)(run);
+    return report;
+}

package/dist/shell/telemetry-cli.js

@@ -0,0 +1,85 @@
+"use strict";
+// shell/telemetry-cli.ts — CLI/MCP-reachable body for `cw telemetry
+// verify`.
+//
+// MILESTONE 8. Byte-exact port of the old build's capability-core.ts's
+// `telemetryVerify` + src/cli/handlers/maintenance.ts's argv shape.
+//
+// Evidence: SPEC/ledger-trust.md "CLI: `cw telemetry verify`", "`cw
+// telemetry verify` JSON"; plugins/cool-workflow/src/capability-
+// core.ts:1181-1215.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.telemetryVerifyCli = telemetryVerifyCli;
+const path = __importStar(require("node:path"));
+const telemetry_attestation_1 = require("../core/trust/telemetry-attestation");
+const run_store_1 = require("./run-store");
+const telemetry_ledger_io_1 = require("./telemetry-ledger-io");
+function optionalString(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function invocationCwd(args) {
+    return typeof args.cwd === "string" && args.cwd.trim() ? path.resolve(args.cwd) : process.cwd();
+}
+function telemetryVerifyCli(runId, args) {
+    if (!runId)
+        throw new Error("telemetry verify requires a run id (cw telemetry verify <run-id>)");
+    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    const v = (0, telemetry_ledger_io_1.verifyTelemetryLedger)(run);
+    // Opt-in independent signature re-verification: supplying the trust
+    // public key (--pubkey / CW_AGENT_ATTEST_PUBKEY) additionally RE-RUNS
+    // the ed25519 check over each `attested` record's stored raw usage
+    // rather than trusting that verdict.
+    const trustPublicKeyInput = optionalString(args.pubkey || args.pubKey || args.publicKey) || process.env.CW_AGENT_ATTEST_PUBKEY;
+    const trustPublicKey = (0, telemetry_attestation_1.resolveTrustPublicKey)(trustPublicKeyInput);
+    const keyChecks = trustPublicKeyInput && !trustPublicKey ? [{ name: "signature-key", pass: false, code: "telemetry-pubkey-unreadable" }] : [];
+    const sig = (0, telemetry_attestation_1.verifyTelemetrySignatures)(v.records, trustPublicKey);
+    const failedChecks = [...v.checks.filter((c) => !c.pass), ...keyChecks, ...sig.checks.filter((c) => !c.pass)];
+    return {
+        schemaVersion: 1,
+        runId: run.id,
+        present: v.present,
+        verified: v.verified && keyChecks.length === 0 && sig.failed === 0,
+        records: v.records.length,
+        attested: v.attested,
+        unattested: v.unattested,
+        absent: v.absent,
+        signatureKeyProvided: sig.keyProvided,
+        signaturesChecked: sig.checked,
+        signaturesReverified: sig.reverified,
+        signaturesFailed: sig.failed,
+        failedChecks: failedChecks.map((c) => ({ name: c.name, code: c.code })),
+    };
+}