cool-workflow 0.2.0 → 0.2.1

package/dist/shell/scheduler-io.js

@@ -2,7 +2,7 @@
 // shell/scheduler-io.ts — Scheduler (cw schedule/loop), the daemon tick
 // (cw schedule daemon), and routine triggers (cw routine).
 //
-// MILESTONE 10 (v2/PLAN.md build order, step 10). Byte-exact port of the
+// MILESTONE 10 (docs/rebuild/PLAN.md build order, step 10). Byte-exact port of the
 // old build's src/scheduler.ts + src/daemon.ts + src/triggers.ts. Reuses
 // shell/fs-atomic.ts's `withFileLock`/`readJson`/`writeJson`/`safeFileName`
 // directly (no reimplementation).
@@ -387,51 +387,60 @@ class RoutineTriggerBridge {
         this.storePath = path.join(this.cwd, ".cw", "routines", "triggers.json");
         this.payloadsDir = path.join(this.cwd, ".cw", "routines", "payloads");
     }
+    locked(fn) {
+        return (0, fs_atomic_1.withFileLock)(this.storePath, fn);
+    }
     create(options) {
-        const now = new Date().toISOString();
-        const store = this.load();
-        // Monotonic id, NOT triggers.length: delete shrinks the collection, so
-        // a length-based seq would reuse a live id after delete+create.
-        const seq = (store.nextTriggerSeq || 0) + 1;
-        store.nextTriggerSeq = seq;
-        const trigger = {
-            id: createTriggerId(normalizeTriggerKind(options.kind), seq),
-            kind: normalizeTriggerKind(options.kind),
-            createdAt: now,
-            updatedAt: now,
-            source: String(options.source || options.kind || "api"),
-            prompt: requiredString(options.prompt, "prompt"),
-            workflowId: stringOption(options.workflowId),
-            runId: stringOption(options.runId),
-            match: parseJsonObject(options.match),
-            metadata: parseJsonObject(options.metadata),
-        };
-        store.triggers.push(trigger);
-        this.save(store);
-        return trigger;
+        return this.locked(() => {
+            const now = new Date().toISOString();
+            const store = this.load();
+            // Monotonic id, NOT triggers.length: delete shrinks the collection, so
+            // a length-based seq would reuse a live id after delete+create.
+            const seq = (store.nextTriggerSeq || 0) + 1;
+            store.nextTriggerSeq = seq;
+            const trigger = {
+                id: createTriggerId(normalizeTriggerKind(options.kind), seq),
+                kind: normalizeTriggerKind(options.kind),
+                createdAt: now,
+                updatedAt: now,
+                source: String(options.source || options.kind || "api"),
+                prompt: requiredString(options.prompt, "prompt"),
+                workflowId: stringOption(options.workflowId),
+                runId: stringOption(options.runId),
+                match: parseJsonObject(options.match),
+                metadata: parseJsonObject(options.metadata),
+            };
+            store.triggers.push(trigger);
+            this.save(store);
+            return trigger;
+        });
     }
     list(kind) {
         const store = this.load();
         return kind ? store.triggers.filter((trigger) => trigger.kind === kind) : store.triggers;
     }
     delete(id) {
-        const store = this.load();
-        const before = store.triggers.length;
-        store.triggers = store.triggers.filter((trigger) => trigger.id !== id);
-        this.save(store);
-        return { deleted: store.triggers.length !== before, id };
+        return this.locked(() => {
+            const store = this.load();
+            const before = store.triggers.length;
+            store.triggers = store.triggers.filter((trigger) => trigger.id !== id);
+            this.save(store);
+            return { deleted: store.triggers.length !== before, id };
+        });
     }
     fire(kind, payload) {
-        const normalizedKind = normalizeTriggerKind(kind);
-        const store = this.load();
-        const now = new Date().toISOString();
-        const base = store.events.length;
-        const events = store.triggers
-            .filter((trigger) => trigger.kind === normalizedKind)
-            .map((trigger, index) => this.createEvent(trigger, payload, now, base + index + 1));
-        store.events.push(...events);
-        this.save(store);
-        return events;
+        return this.locked(() => {
+            const normalizedKind = normalizeTriggerKind(kind);
+            const store = this.load();
+            const now = new Date().toISOString();
+            const base = store.events.length;
+            const events = store.triggers
+                .filter((trigger) => trigger.kind === normalizedKind)
+                .map((trigger, index) => this.createEvent(trigger, payload, now, base + index + 1));
+            store.events.push(...events);
+            this.save(store);
+            return events;
+        });
     }
     events(triggerId) {
         const store = this.load();

package/dist/shell/scheduling-io.js

@@ -3,7 +3,7 @@
 // lease-plan mechanism over the run-registry-io.ts queue store, plus the
 // policy file IO.
 //
-// MILESTONE 10 (v2/PLAN.md build order, step 10). Byte-exact port of the
+// MILESTONE 10 (docs/rebuild/PLAN.md build order, step 10). Byte-exact port of the
 // old build's src/scheduling.ts + the sched-specific slice of
 // src/capability-core.ts. `sched` is a DIFFERENT system from `schedule`
 // (see scheduler-io.ts's file header) — this operates on
@@ -251,43 +251,53 @@ function schedLeaseCli(options = {}) {
     const now = nowIso(options);
     const policy = loadSchedulingPolicy(registry).policy;
     const limit = options.limit === undefined ? undefined : Number(options.limit);
-    const { entries, leases } = applyLease(registry.loadQueueEntries(), policy, now, limit);
-    registry.saveQueueEntries(entries);
-    return { schemaVersion: 1, now, granted: leases.length, leases };
+    return (0, fs_atomic_1.withFileLock)(registry.queueFilePath(), () => {
+        const { entries, leases } = applyLease(registry.loadQueueEntries(), policy, now, limit);
+        registry.saveQueueEntries(entries);
+        return { schemaVersion: 1, now, granted: leases.length, leases };
+    });
 }
 function schedReleaseCli(leaseId, options = {}) {
     const registry = new run_registry_io_1.RunRegistry(resolveCwd(options));
     const now = nowIso(options);
     const failed = isTrue(options.failed);
     const reason = typeof options.reason === "string" ? options.reason : undefined;
-    const { entries, matched } = leaseRelease(registry.loadQueueEntries(), leaseId, loadSchedulingPolicy(registry).policy, now, { failed, reason });
-    if (!matched)
-        throw new Error(`No active lease to release: ${leaseId}`);
-    registry.saveQueueEntries(entries);
-    return { schemaVersion: 1, released: leaseId, failed };
+    return (0, fs_atomic_1.withFileLock)(registry.queueFilePath(), () => {
+        const { entries, matched } = leaseRelease(registry.loadQueueEntries(), leaseId, loadSchedulingPolicy(registry).policy, now, { failed, reason });
+        if (!matched)
+            throw new Error(`No active lease to release: ${leaseId}`);
+        registry.saveQueueEntries(entries);
+        return { schemaVersion: 1, released: leaseId, failed };
+    });
 }
 function schedCompleteCli(leaseId, options = {}) {
     const registry = new run_registry_io_1.RunRegistry(resolveCwd(options));
-    const { entries, matched } = leaseComplete(registry.loadQueueEntries(), leaseId, nowIso(options));
-    if (!matched)
-        throw new Error(`No active lease to complete: ${leaseId}`);
-    registry.saveQueueEntries(entries);
-    return { schemaVersion: 1, completed: leaseId };
+    return (0, fs_atomic_1.withFileLock)(registry.queueFilePath(), () => {
+        const { entries, matched } = leaseComplete(registry.loadQueueEntries(), leaseId, nowIso(options));
+        if (!matched)
+            throw new Error(`No active lease to complete: ${leaseId}`);
+        registry.saveQueueEntries(entries);
+        return { schemaVersion: 1, completed: leaseId };
+    });
 }
 function schedReclaimCli(options = {}) {
     const registry = new run_registry_io_1.RunRegistry(resolveCwd(options));
     const now = nowIso(options);
-    const { entries, reclaimed } = reclaimExpired(registry.loadQueueEntries(), loadSchedulingPolicy(registry).policy, now);
-    registry.saveQueueEntries(entries);
-    return { schemaVersion: 1, now, reclaimed };
+    return (0, fs_atomic_1.withFileLock)(registry.queueFilePath(), () => {
+        const { entries, reclaimed } = reclaimExpired(registry.loadQueueEntries(), loadSchedulingPolicy(registry).policy, now);
+        registry.saveQueueEntries(entries);
+        return { schemaVersion: 1, now, reclaimed };
+    });
 }
 function schedResetCli(id, options = {}) {
     const registry = new run_registry_io_1.RunRegistry(resolveCwd(options));
-    const { entries, matched } = resetEntry(registry.loadQueueEntries(), id);
-    if (!matched)
-        throw new Error(`No parked entry to reset: ${id}`);
-    registry.saveQueueEntries(entries);
-    return { schemaVersion: 1, reset: id };
+    return (0, fs_atomic_1.withFileLock)(registry.queueFilePath(), () => {
+        const { entries, matched } = resetEntry(registry.loadQueueEntries(), id);
+        if (!matched)
+            throw new Error(`No parked entry to reset: ${id}`);
+        registry.saveQueueEntries(entries);
+        return { schemaVersion: 1, reset: id };
+    });
 }
 function schedPolicyShowCli(options = {}) {
     const registry = new run_registry_io_1.RunRegistry(resolveCwd(options));

package/dist/shell/telemetry-ledger-io.js

@@ -4,7 +4,7 @@
 // math lives in core/trust/telemetry-ledger.ts.
 //
 // MILESTONE 8. Byte-exact port of the old build's src/telemetry-ledger.ts
-// IO-touching half. CRITICAL invariant (v2/PLAN.md byte-compat item 12):
+// IO-touching half. CRITICAL invariant (docs/rebuild/PLAN.md byte-compat item 12):
 // an ABSENT telemetry.json is an empty, clean-verifying chain
 // (`present:false`); a PRESENT but unparseable one is CORRUPT — reads
 // report `telemetry-ledger-corrupt`, and append THROWS

package/dist/shell/term.js

@@ -1,7 +1,7 @@
 "use strict";
 // shell/term.ts — zero-dependency terminal styling.
 //
-// MILESTONE 5 (v2/PLAN.md build order, step 5, doctor/fix): TTY-gated
+// MILESTONE 5 (docs/rebuild/PLAN.md build order, step 5, doctor/fix): TTY-gated
 // ANSI formatting, so a piped run (every conformance case pipes with
 // NO_COLOR=1) prints plain text. EXTENDED at MILESTONE 11 (reporting/
 // observability) with the rest of the old build's src/term.ts: indent,

package/dist/shell/trust-audit.js

@@ -13,7 +13,7 @@
 // the era-rule check + trustAuditGenesis on top, and switches
 // computeEventHash to use core/hash.ts's named `eventHashInput` export
 // (byte-identical behavior to the pre-existing inline JSON-round-trip,
-// now shared with the rest of the hash-dedup story per v2/PLAN.md byte-
+// now shared with the rest of the hash-dedup story per docs/rebuild/PLAN.md byte-
 // compat item 2).
 //
 // Evidence: SPEC/ledger-trust.md "Trust-audit chain", invariant 10 (era
@@ -97,7 +97,7 @@ function trustAuditGenesis(runId) {
  *  itself, via core/hash.ts's `eventHashInput` (the JSON round-trip
  *  pre-pass that drops nested `undefined`-valued keys BEFORE the
  *  sort-and-stringify step — not a formatting flag on the same shape,
- *  see v2/PLAN.md byte-compat item 2). Hashing the PERSISTED form this
+ *  see docs/rebuild/PLAN.md byte-compat item 2). Hashing the PERSISTED form this
  *  way makes record-time hashes equal verify-time (parsed-from-disk)
  *  hashes. */
 function computeEventHash(event) {
@@ -142,7 +142,7 @@ function listTrustAuditEvents(run) {
  *  hash are reported as `unchained` (skipped), NOT treated as a forgery
  *  — they predate the chain.
  *
- *  ERA RULE (v2/PLAN.md, SPEC/ledger-trust.md invariant 10): a single
+ *  ERA RULE (docs/rebuild/PLAN.md, SPEC/ledger-trust.md invariant 10): a single
  *  run is written by one code version, so a log is all-chained (chain
  *  era) or all-legacy (pre-chain). An unchained (eventHash-less) line
  *  mixed into an otherwise-chained log is a forgery attempt — dropping
@@ -277,6 +277,7 @@ function recordTrustAuditEvent(run, input) {
         normalizedPath: input.normalizedPath ? path.resolve(input.normalizedPath) : undefined,
         command: input.command,
         networkTarget: input.networkTarget,
+        envVars: input.envVars?.filter(Boolean).sort(),
         evidence: normalizeEvidence(run, input.evidence || [], { source: input.source, workerId: input.workerId, taskId: input.taskId, resultNodeId: input.nodeId }),
         evidenceRefs: unique(input.evidenceRefs || []).sort(),
         parentEventIds: unique(input.parentEventIds || []).sort(),

package/dist/shell/workbench-host.js

@@ -233,8 +233,16 @@ class WorkbenchHost {
     /** `cw workbench serve` entry point: `--once`/`--json` prints ONLY the
      *  descriptor (compact JSON) and starts nothing; the default binds and
      *  blocks, printing one compact line (`{...descriptor, boundPort}`)
-     *  once listening. */
+     *  once listening. `--require-token` is a strict opt-in: default behavior
+     *  (unauthenticated local reads when no token is configured) is
+     *  unchanged unless the caller explicitly asks to fail closed. */
     async run() {
+        const requireToken = Boolean(this.args.requireToken || this.args["require-token"]);
+        if (requireToken && !this.token) {
+            process.stderr.write("workbench serve --require-token: CW_WORKBENCH_TOKEN is not set; refusing to start.\n");
+            process.exitCode = 1;
+            return;
+        }
         const once = Boolean(this.args.once || this.args.json);
         if (once) {
             process.stdout.write(`${JSON.stringify(this.descriptor(true))}\n`);

package/dist/shell/workbench.js

@@ -116,18 +116,13 @@ function buildWorkbenchRunView(runId, args = {}) {
     }
     return { schemaVersion: 1, surface: "workbench", runId, resolved, ...(resolveError ? { error: resolveError } : {}), panels };
 }
+/** Package-relative resolution only — never falls back to the invocation
+ *  cwd. `ui/` ships as a sibling of `dist/` in the published package
+ *  (package.json's `files`), so from `dist/shell/workbench.js` the fixed
+ *  path is two levels up. Matches the existing precedent in
+ *  execution-backend/agent.ts's BATCH_DELEGATE_CHILD_SCRIPT resolution. */
 function workbenchUiRoot() {
-    let dir = __dirname;
-    for (let i = 0; i < 8; i++) {
-        const candidate = path.join(dir, "plugins", "cool-workflow", exports.WORKBENCH_UI_RELATIVE);
-        if (require("node:fs").existsSync(candidate))
-            return candidate;
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    return path.join(process.cwd(), exports.WORKBENCH_UI_RELATIVE);
+    return path.resolve(__dirname, "..", "..", exports.WORKBENCH_UI_RELATIVE);
 }
 const WORKBENCH_ROUTES = [
     { method: "GET", path: "/", description: "Index page (or the UI's index.html, when installed)." },

package/docs/agent-delegation-drive.7.md

@@ -415,3 +415,5 @@ The one-command `cw -q` headline now routes the question and defaults the repo t
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/cli-mcp-parity.7.md

@@ -626,3 +626,5 @@ CLI golden-path fixes: `cw -q "…"` routes the question (was read as an app id
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/contract-migration-tooling.7.md

@@ -175,3 +175,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/control-plane-scheduling.7.md

@@ -159,3 +159,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/durable-state-and-locking.7.md

@@ -158,3 +158,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/evidence-adoption-reasoning-chain.7.md

@@ -319,3 +319,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/execution-backends.7.md

@@ -349,3 +349,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/multi-agent-cli-mcp-surface.7.md

@@ -325,3 +325,5 @@ The host-facing surface tracks the CLI golden-path fixes (`cw -q` routing + repo
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/multi-agent-eval-replay-harness.7.md

@@ -351,3 +351,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/multi-agent-operator-ux.7.md

@@ -363,3 +363,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/node-snapshot-diff-replay.7.md

@@ -184,3 +184,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/observability-cost-accounting.7.md

@@ -113,7 +113,8 @@ read-only metrics panel from the same payload, showing coverage and
 - `cw metrics summary` — the cross-repo rollup over the v0.1.28 run registry:
   pooled rates, summed attested usage/cost with coverage, and per-app and
   per-backend breakdowns. `--scope repo|home`; runs that cannot be read are counted
-  (`unreadableRuns`), never quietly dropped.
+  (`unreadableRuns`), never quietly dropped. `--limit N` caps how many run
+  states are loaded (default 50, matching `run list`/`run search`'s own floor).
 
 MCP hosts call `cw_metrics_show` and `cw_metrics_summary` with the same
 payloads. Old runs load and report `unreported` cost while still giving correct
@@ -243,3 +244,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/project-index.md

@@ -1,15 +1,15 @@
 # Cool Workflow Project Index
 
-Generated from the current repository code on 2026-07-05 by `npm run sync:project-index`.
+Generated from the current repository code on 2026-07-07 by `npm run sync:project-index`.
 
 ## Snapshot
 
 - Package: `cool-workflow`
-- Version: `0.2.0`
+- Version: `0.2.1`
 - Source modules: `129`
 - Workflow apps: `8`
 - Docs: `61`
-- Smoke tests: `173`
+- Smoke tests: `178`
 - Repository: https://github.com/coo1white/cool-workflow
 
 ## Architecture
@@ -263,6 +263,8 @@ multi-agent host -> topology -> blackboard/coordinator
 
 Smoke tests mirror the public contracts. The high-signal suites are:
 
+- [agent-backend-concurrent-user-env-smoke.js](../test/agent-backend-concurrent-user-env-smoke.js)
+- [agent-backend-user-env-smoke.js](../test/agent-backend-user-env-smoke.js)
 - [agent-config-atomic-write-smoke.js](../test/agent-config-atomic-write-smoke.js)
 - [agent-delegation-drive-smoke.js](../test/agent-delegation-drive-smoke.js)
 - [agent-stream-gate-smoke.js](../test/agent-stream-gate-smoke.js)
@@ -270,6 +272,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [architecture-review-fast-automation-smoke.js](../test/architecture-review-fast-automation-smoke.js)
 - [architecture-review-fast-phase-cache-smoke.js](../test/architecture-review-fast-phase-cache-smoke.js)
 - [architecture-review-fast-smoke.js](../test/architecture-review-fast-smoke.js)
+- [architecture-review-question-aware-smoke.js](../test/architecture-review-question-aware-smoke.js)
 - [artifact-integrity-smoke.js](../test/artifact-integrity-smoke.js)
 - [audit-verify-smoke.js](../test/audit-verify-smoke.js)
 - [backend-registry-smoke.js](../test/backend-registry-smoke.js)
@@ -339,6 +342,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [mcp-app-surface-smoke.js](../test/mcp-app-surface-smoke.js)
 - [mcp-surface-registry-smoke.js](../test/mcp-surface-registry-smoke.js)
 - [mcp-tool-call-coverage-smoke.js](../test/mcp-tool-call-coverage-smoke.js)
+- [metrics-summary-limit-smoke.js](../test/metrics-summary-limit-smoke.js)
 - [multi-agent-cli-mcp-surface-smoke.js](../test/multi-agent-cli-mcp-surface-smoke.js)
 - [multi-agent-eval-determinism-regression-smoke.js](../test/multi-agent-eval-determinism-regression-smoke.js)
 - [multi-agent-eval-replay-harness-smoke.js](../test/multi-agent-eval-replay-harness-smoke.js)
@@ -410,6 +414,7 @@ Smoke tests mirror the public contracts. The high-signal suites are:
 - [sandbox-profile-smoke.js](../test/sandbox-profile-smoke.js)
 - [sched-policy-validation-smoke.js](../test/sched-policy-validation-smoke.js)
 - [schedule-routine-daemon-smoke.js](../test/schedule-routine-daemon-smoke.js)
+- [scheduling-routine-lock-concurrency-smoke.js](../test/scheduling-routine-lock-concurrency-smoke.js)
 - [schema-validation-smoke.js](../test/schema-validation-smoke.js)
 - [security-trust-hardening-smoke.js](../test/security-trust-hardening-smoke.js)
 - [self-audit-hardening-smoke.js](../test/self-audit-hardening-smoke.js)

package/docs/real-execution-backends.7.md

@@ -191,3 +191,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/release-and-migration.7.md

@@ -331,3 +331,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/release-tooling.7.md

@@ -294,3 +294,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/remote-source-review.7.md

@@ -1,15 +1,15 @@
 # Remote-Source Review (`--link`)
 
 CW v0.1.91 lets you point a review at **any repository on the internet** instead
-of only a local path: `cw -q "what are the risks?" --link <url>`. CW materializes
+of only a local path: `cw -q "how does this work?" --link <url>`. CW materializes
 the remote into a local checkout and runs the **existing** review pipeline against
 it — identical downstream to reviewing a folder. A URL passed to `-dir`/`--repo`
 is auto-detected, so `--link <url>` and `-dir <url>` are equivalent.
 
 ```bash
-cw -q "What are the risks?" --link https://github.com/owner/repo
-cw -q "What are the risks?" --link git@gitlab.com:owner/repo.git --ref v1.2.0
-cw -q "What are the risks?" --link https://github.com/owner/repo/archive/refs/heads/main.tar.gz
+cw -q "How does auth work end-to-end here?" --link https://github.com/owner/repo
+cw -q "What are the security risks?" --link git@gitlab.com:owner/repo.git --ref v1.2.0
+cw -q "Is it safe to swap this queue for Redis?" --link https://github.com/owner/repo/archive/refs/heads/main.tar.gz
 cw -q "..." --link <url> --check     # validate the URL + tooling WITHOUT fetching
 ```
 

package/docs/report-verifiable-bundle.7.md

@@ -127,7 +127,7 @@ npx cool-workflow demo bundle
 #      catching both offline with only the embedded public key.
 
 # Run the review AND get a shippable, client-verifiable bundle from ONE command:
-cw quickstart architecture-review --repo . --question "What are the risks?" \
+cw quickstart architecture-review --repo . --question "How does auth work end-to-end here?" \
   --agent-command "claude -p" --bundle --with-trust-key ./trust-pub.pem
 #   -> after the drive COMPLETES, the run is sealed into a self-verified bundle and
 #      the verdict is folded into the quickstart JSON (result.bundle). Exits non-zero

package/docs/run-registry-control-plane.7.md

@@ -474,3 +474,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/run-retention-reclamation.7.md

@@ -263,3 +263,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/security-trust-hardening.7.md

@@ -37,7 +37,9 @@ Event sources are clear:
 - `runtime-derived`: CW got the event from run state.
 
 CW does not keep secrets or raw environment values. Environment audit records
-keep names only.
+keep names only — for example, `worker.agent-env` records which provider-namespace
+env var NAMES (`CW_`, `ANTHROPIC_`, `OPENAI_`, and similar) were forwarded from
+the host process to a delegated agent child, queryable via `cw audit summary`/`cw audit`.
 
 ## Enforcement Boundary
 

package/docs/state-explosion-management.7.md

@@ -320,3 +320,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/team-collaboration.7.md

@@ -256,3 +256,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/docs/web-desktop-workbench.7.md

@@ -96,11 +96,21 @@ The console is read-only. It offers no actions. If a later release adds an actio
 capability core entry that already exists — never a side code path — so it cannot drift from the
 CLI/MCP and is covered by the parity gate.
 
+Authentication is opt-in, not on by default: set `CW_WORKBENCH_TOKEN` and every
+request must carry it as `Authorization: Bearer <token>` or `?token=<token>`
+(timing-safe compare); left unset, the loopback/read-only/GET-only controls
+above are the only defense and any local process can read. Pass
+`--require-token` to `cw workbench serve` to fail closed instead: the server
+refuses to start at all unless `CW_WORKBENCH_TOKEN` is already set. This is a
+strict opt-in — leaving it off keeps today's default behavior unchanged.
+(`--require-token` has no effect on `cw_workbench_serve`'s MCP path, which
+never actually binds a listener.)
+
 ## Surfaces
 
 ```
 cw workbench view <run-id> [--json]         # five-panel WorkbenchRunView for one run
-cw workbench serve [--port N] [--scope repo|home] [--once|--json]
+cw workbench serve [--port N] [--scope repo|home] [--once|--json] [--require-token]
 ```
 
 `cw workbench serve` with `--once`/`--json` prints the serve descriptor (bind
@@ -264,3 +274,5 @@ _No behavioral change in v0.1.89 (CLI-surface golden-path + help-output fixes on
 0.1.98
 
 0.2.0
+
+0.2.1

package/manifest/plugin.manifest.json

@@ -2,7 +2,7 @@
   "_comment": "SINGLE SOURCE OF TRUTH for every vendor manifest. Edit THIS file, then run `npm run gen:manifests`. Do NOT hand-edit the generated vendor manifests (.claude-plugin/, .codex-plugin/, .agents/, .mcp.json) — `npm run gen:manifests -- --check` (run by release:check) will fail if they drift from this source.",
   "identity": {
     "name": "cool-workflow",
-    "version": "0.2.0",
+    "version": "0.2.1",
     "license": "BSD-2-Clause",
     "homepage": "https://github.com/coo1white/cool-workflow",
     "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "bin": {
     "cool-workflow": "scripts/cw.js",
     "cw": "scripts/cw.js"

package/scripts/agents/agent-adapter-core.js

@@ -18,7 +18,7 @@ cw:result block that EXACTLY follows this schema:
   "findings": [
     {
       "id": "unique-kebab-id",
-      "title": "short risk title",
+      "title": "short finding title",
       "severity": "P0",
       "classification": "real",
       "evidence": ["path/to/file.ts:42"]
@@ -471,6 +471,25 @@ function persistStderr(resultPath, text) {
   }
 }
 
+// Build the failure-path diagnostic string for a non-zero exit. Real OS-level
+// stderr wins when present (the common case: a crash, a killed process, a
+// vendor CLI that DOES write to stderr) — byte-identical to before this
+// helper existed. When stderr is EMPTY, fall back to whatever partial/
+// structured text the wrapper already parsed from stdout before the child
+// died (a stream-json `result` event with is_error:true is how claude
+// reports terminal errors like an auth failure — that text was being parsed
+// and then silently thrown away). If there is no partial text either, say so
+// plainly instead of just repeating the bare exit code. Never throws; always
+// returns a non-empty string.
+function buildFailureDetail({ label, code, childStderr, partialText }) {
+  const stderrText = String(childStderr || "").trim();
+  if (stderrText) return stderrText;
+  const partial = String(partialText || "").trim();
+  const codeText = `${label} exited ${code === null ? "(timeout/killed)" : code}`;
+  if (partial) return `${codeText} — ${label} stdout (no stderr) said: ${partial}`;
+  return codeText;
+}
+
 module.exports = {
   RESULT_CONTRACT,
   buildPrompt,
@@ -485,5 +504,6 @@ module.exports = {
   flushJsonLines,
   writeResult,
   emitReport,
-  persistStderr // save a failed agent's stderr to <workerDir>/logs/agent-stderr.log (shared by all wrappers)
+  persistStderr, // save a failed agent's stderr to <workerDir>/logs/agent-stderr.log (shared by all wrappers)
+  buildFailureDetail // fold in parsed partial stdout text when real stderr is empty (shared by all wrappers)
 };