cool-workflow 0.2.1 → 0.2.3

package/dist/shell/orchestrator.js

@@ -102,18 +102,22 @@ class CoolWorkflowRunner {
     /** `dispatch` — build the next dispatch manifest (persisting through
      *  createDispatchManifest's own writes) and checkpoint. */
     dispatch(runId, options = {}) {
-        const run = this.loadRun(runId);
-        const limit = numberOption(options.limit);
-        const manifest = (0, dispatch_1.createDispatchManifest)(run, limit, {
-            sandboxProfileId: stringOption(options.sandbox) || stringOption(options.sandboxProfile) || stringOption(options.sandboxProfileId),
-            backendId: stringOption(options.backend) || stringOption(options.backendId) || stringOption(options.executionBackend),
-            multiAgentRunId: stringOption(options.multiAgentRun || options.multiAgentRunId || options["multi-agent-run"]),
-            multiAgentGroupId: stringOption(options.multiAgentGroup || options.multiAgentGroupId || options.group || options["multi-agent-group"]),
-            multiAgentRoleId: stringOption(options.multiAgentRole || options.multiAgentRoleId || options.role || options["multi-agent-role"]),
-            multiAgentFanoutId: stringOption(options.multiAgentFanout || options.multiAgentFanoutId || options.fanout || options["multi-agent-fanout"]),
+        // Hold the state.json lock across the whole load -> change -> save so a
+        // concurrent run mutation cannot drop this dispatch (lost-update class,
+        // matching pipeline-cli.ts's dispatchRun).
+        return (0, run_store_2.withRunStateLock)(runId, this.cwd(), (run) => {
+            const limit = numberOption(options.limit);
+            const manifest = (0, dispatch_1.createDispatchManifest)(run, limit, {
+                sandboxProfileId: stringOption(options.sandbox) || stringOption(options.sandboxProfile) || stringOption(options.sandboxProfileId),
+                backendId: stringOption(options.backend) || stringOption(options.backendId) || stringOption(options.executionBackend),
+                multiAgentRunId: stringOption(options.multiAgentRun || options.multiAgentRunId || options["multi-agent-run"]),
+                multiAgentGroupId: stringOption(options.multiAgentGroup || options.multiAgentGroupId || options.group || options["multi-agent-group"]),
+                multiAgentRoleId: stringOption(options.multiAgentRole || options.multiAgentRoleId || options.role || options["multi-agent-role"]),
+                multiAgentFanoutId: stringOption(options.multiAgentFanout || options.multiAgentFanoutId || options.fanout || options["multi-agent-fanout"]),
+            });
+            (0, run_store_2.saveCheckpoint)(run);
+            return manifest;
         });
-        (0, run_store_2.saveCheckpoint)(run);
-        return manifest;
     }
     /** `showWorkerManifest` — write + return a worker's manifest. */
     showWorkerManifest(runId, workerId) {
@@ -126,10 +130,13 @@ class CoolWorkflowRunner {
     /** `recordWorkerOutput` — accept a worker's result and checkpoint. Mirrors
      *  v2's workerOutputCli: recordWorkerOutput + saveCheckpoint. */
     recordWorkerOutput(runId, workerId, resultPath, options = {}) {
-        const run = this.loadRun(runId);
-        const output = (0, worker_isolation_1.recordWorkerOutput)(run, workerId, this.resolveFromBase(resultPath), options);
-        (0, run_store_2.saveCheckpoint)(run);
-        return output;
+        // Hold the state.json lock across the whole load -> change -> save so a
+        // concurrent run mutation cannot drop this worker output (lost-update class).
+        return (0, run_store_2.withRunStateLock)(runId, this.cwd(), (run) => {
+            const output = (0, worker_isolation_1.recordWorkerOutput)(run, workerId, this.resolveFromBase(resultPath), options);
+            (0, run_store_2.saveCheckpoint)(run);
+            return output;
+        });
     }
     /** `auditSummary` — the trust-audit rollup. */
     auditSummary(runId) {
@@ -172,29 +179,33 @@ class CoolWorkflowRunner {
      *  `{ runId, commit }` to match the old orchestrator's shape (the scripts
      *  read `commitResult.commit`). */
     commit(runId, input = {}) {
-        const run = this.loadRun(runId);
-        const options = typeof input === "string" ? { reason: input } : input;
-        const allowCheckpoint = Boolean(options.allowUnverifiedCheckpoint || options["allow-unverified-checkpoint"]);
-        const hasGateOption = Boolean(options.verifier || options.verifierNode || options["verifier-node"] || options.candidate || options.selection);
-        try {
-            const commit = (0, commit_1.commitState)(run, {
-                reason: stringOption(options.reason) || "manual",
-                verifierNodeId: stringOption(options.verifier) || stringOption(options.verifierNode) || stringOption(options["verifier-node"]),
-                candidateId: stringOption(options.candidate),
-                selectionId: stringOption(options.selection),
-                verifierGated: hasGateOption || !allowCheckpoint,
-                allowUnverifiedCheckpoint: allowCheckpoint,
-                source: "cli",
-            });
-            (0, report_1.writeReport)(run);
-            (0, run_store_2.saveCheckpoint)(run);
-            return { runId: run.id, commit };
-        }
-        catch (error) {
-            (0, report_1.writeReport)(run);
-            (0, run_store_2.saveCheckpoint)(run);
-            throw error;
-        }
+        // Hold the state.json lock across the whole load -> commit -> save (both
+        // the success and the fail-closed catch persist) so a concurrent run
+        // mutation cannot drop this commit (lost-update class).
+        return (0, run_store_2.withRunStateLock)(runId, this.cwd(), (run) => {
+            const options = typeof input === "string" ? { reason: input } : input;
+            const allowCheckpoint = Boolean(options.allowUnverifiedCheckpoint || options["allow-unverified-checkpoint"]);
+            const hasGateOption = Boolean(options.verifier || options.verifierNode || options["verifier-node"] || options.candidate || options.selection);
+            try {
+                const commit = (0, commit_1.commitState)(run, {
+                    reason: stringOption(options.reason) || "manual",
+                    verifierNodeId: stringOption(options.verifier) || stringOption(options.verifierNode) || stringOption(options["verifier-node"]),
+                    candidateId: stringOption(options.candidate),
+                    selectionId: stringOption(options.selection),
+                    verifierGated: hasGateOption || !allowCheckpoint,
+                    allowUnverifiedCheckpoint: allowCheckpoint,
+                    source: "cli",
+                });
+                (0, report_1.writeReport)(run);
+                (0, run_store_2.saveCheckpoint)(run);
+                return { runId: run.id, commit };
+            }
+            catch (error) {
+                (0, report_1.writeReport)(run);
+                (0, run_store_2.saveCheckpoint)(run);
+                throw error;
+            }
+        });
     }
     /** `report` — write the run's report.md; returns `{ path }` (old shape). */
     report(runId) {

package/dist/shell/pipeline-cli.js

@@ -52,6 +52,8 @@ exports.recordResultRun = recordResultRun;
 exports.commitRun = commitRun;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const readlinePromises = __importStar(require("node:readline/promises"));
+const numeric_flag_1 = require("../core/util/numeric-flag");
 const pipeline_1 = require("./pipeline");
 const workflow_app_loader_1 = require("./workflow-app-loader");
 const drive_1 = require("./drive");
@@ -223,8 +225,11 @@ function runDrivePreview(args) {
     return (0, drive_1.drivePreview)(runId, cwd, args);
 }
 /** `cw run <app|--run id> --drive [--once]` — plans a fresh run (unless
- *  `--run` continues an existing one) and drives it. */
-function runDriveStep(args) {
+ *  `--run` continues an existing one) and drives it. Uses driveAsync (not
+ *  the plain synchronous drive()) so a live multi-round run actually
+ *  responds to Ctrl-C/SIGTERM instead of silently ignoring it — see
+ *  shell/drive.ts's driveAsync doc comment. */
+async function runDriveStep(args) {
     const existingRunId = String(args.runId || args.run || "");
     const options = {
         once: Boolean(args.once),
@@ -236,7 +241,7 @@ function runDriveStep(args) {
     if (existingRunId) {
         const cwd = invocationCwd(args);
         const run = (0, run_store_1.loadRunFromCwd)(existingRunId, cwd);
-        return (0, drive_1.drive)(existingRunId, run.cwd, options);
+        return (0, drive_1.driveAsync)(existingRunId, run.cwd, options);
     }
     const appId = String(args.appId || args.app || args.positionalApp || "");
     if (!appId)
@@ -245,7 +250,7 @@ function runDriveStep(args) {
         args.repo = invocationCwd(args);
     const app = (0, workflow_app_loader_1.loadWorkflowApp)(appId);
     const run = (0, pipeline_1.plan)(app, planInputsFor(args));
-    return (0, drive_1.drive)(run.id, run.cwd, options);
+    return (0, drive_1.driveAsync)(run.id, run.cwd, options);
 }
 /** `cw quickstart [app] --check` — read-only preflight: does the app
  *  resolve, is the repo readable/writable, is a question set, is an
@@ -385,6 +390,21 @@ function remoteQuickstartCheck(appId, args, candidate) {
     const nextCommand = `cw quickstart ${shellWord(appId)} --link ${shellWord(validation.url)}${question ? ` --question ${shellWord(question)}` : ""}`;
     return { schemaVersion: 1, mode: "check", ok, appId, repo: validation.url, checks, nextCommand };
 }
+/** Prompts `Question: ` on STDERR (stdout stays data-only, matching the
+ *  Rule of Silence) and reads one line from stdin. Returns the trimmed
+ *  answer, or `undefined` for a blank line. Callers must only invoke this
+ *  when `process.stdin.isTTY` — it would otherwise block forever on a
+ *  piped/CI invocation. */
+async function promptForQuestion() {
+    const rl = readlinePromises.createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = await rl.question("Question: ");
+        return answer.trim() || undefined;
+    }
+    finally {
+        rl.close();
+    }
+}
 /** `cw quickstart [app] --question ...` — composes plan -> runDrive ->
  *  report in one call. Default app is architecture-review. `--check` is a
  *  read-only preflight that never plans/drives/writes (see
@@ -392,7 +412,7 @@ function remoteQuickstartCheck(appId, args, candidate) {
  *  projection (never drives), `--resume` advances one step (no --run) or
  *  continues a named run to completion (--run <id>) — both ported byte-for-
  *  byte from the old build's src/capability-core.ts quickstart(). */
-function quickstartRun(args) {
+async function quickstartRun(args) {
     const appId = String(args.appId || args.app || args.workflowId || QUICKSTART_DEFAULT_APP);
     // Remote source: a `--link <url>` — or a URL passed to `--repo`/`-dir` — is
     // materialized to a LOCAL checkout HERE (capability/shell layer). Cloning is
@@ -406,6 +426,37 @@ function quickstartRun(args) {
         args.repo = invocationCwd(args);
     if (Boolean(args.check))
         return quickstartCheck(appId, args, remoteCandidate);
+    // `--resume`: a discoverability flag over the existing continuation. With no
+    // `--run`, advance exactly ONE step (reuse the `--once` path) and print a
+    // copy-pasteable continue line; with `--run <id>`, continue that run to
+    // completion (the default drive). It adds no new execution path. Byte-exact to
+    // the old build's src/capability-core.ts quickstart(). Hoisted above the TTY
+    // prompt below: `existingRunId` is the one fact (mirrored at both the
+    // `--preview` branch's `if (!previewRunId)` and the main path's `if
+    // (existingRunId) {...} else { run = plan(...) }`) that decides whether THIS
+    // invocation plans a fresh run at all — an existing run never needs a
+    // question, no matter which mode (--preview/--resume/plain) is asking for it.
+    const resume = Boolean(args.resume);
+    const existingRunId = String(args.runId || args.run || "");
+    const resumeRunId = resume && existingRunId ? existingRunId : undefined;
+    // On an interactive TTY with no --question, ask for one instead of
+    // failing closed with "Missing required input: question" (byte-behavior
+    // port of the old build's TTY prompt — SPEC/cli-surface.md:34,502). A
+    // blank/empty answer leaves `question` unset, same as never passing
+    // --question at all — plan()'s own required-input check still fails
+    // closed for an app that declares `question` required. Never fires
+    // under --check (returned above; --check reports a missing question as
+    // a preflight issue, not something to prompt for), off a TTY (a piped
+    // invocation must never block on stdin), or when `existingRunId` is set
+    // (a `--preview --run <id>` or `--resume --run <id>` continues an
+    // already-planned run and never calls `plan()` again, so it never
+    // needs a question — prompting there would block on stdin for no
+    // reason; a review on this cycle caught exactly that regression).
+    if (process.stdin.isTTY && !existingRunId && !(typeof args.question === "string" && args.question.trim())) {
+        const answer = await promptForQuestion();
+        if (answer)
+            args.question = answer;
+    }
     // Materialize the remote NOW — after `--check` (never fetches) and before any
     // plan/drive — so the core only ever sees the local checkout. Fails closed: a
     // bad URL / blocked scheme / missing git / fetch failure throws here.
@@ -424,14 +475,6 @@ function quickstartRun(args) {
         if (remoteSource.ref)
             args.sourceRef = remoteSource.ref;
     }
-    // `--resume`: a discoverability flag over the existing continuation. With no
-    // `--run`, advance exactly ONE step (reuse the `--once` path) and print a
-    // copy-pasteable continue line; with `--run <id>`, continue that run to
-    // completion (the default drive). It adds no new execution path. Byte-exact to
-    // the old build's src/capability-core.ts quickstart().
-    const resume = Boolean(args.resume);
-    const existingRunId = String(args.runId || args.run || "");
-    const resumeRunId = resume && existingRunId ? existingRunId : undefined;
     // `--preview`: read-only, deterministic next-step projection (no spawn, no
     // commit). Plan a fresh run (the read-only first verb) then project the next
     // drive step. Never drives.
@@ -464,7 +507,7 @@ function quickstartRun(args) {
     else {
         run = (0, pipeline_1.plan)(resolveWorkflowAppForPlan(appId), planInputsFor(args));
     }
-    const result = (0, drive_1.drive)(run.id, run.cwd, options);
+    const result = await (0, drive_1.driveAsync)(run.id, run.cwd, options);
     const finalRun = (0, run_store_1.loadRunFromCwd)(run.id, run.cwd);
     (0, report_1.writeReport)(finalRun);
     // Tamper-evident provenance: bind the remote origin (url@sha) into the run's
@@ -552,84 +595,94 @@ function quickstartRun(args) {
 }
 function dispatchRun(args) {
     const runId = String(args.runId);
-    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
-    // parseArgv keys long flags in kebab-case; accept camelCase as a fallback.
-    const flag = (kebab, camel) => {
-        const v = args[kebab] ?? args[camel];
-        return typeof v === "string" && v.trim() ? v : undefined;
-    };
-    const manifest = (0, dispatch_1.createDispatchManifest)(run, args.limit !== undefined ? Number(args.limit) : undefined, {
-        sandboxProfileId: typeof args.sandbox === "string" ? args.sandbox : undefined,
-        sandbox: typeof args.sandbox === "string" ? args.sandbox : undefined,
-        backendId: typeof args.backend === "string" ? args.backend : undefined,
-        multiAgentRunId: flag("multi-agent-run", "multiAgentRun"),
-        multiAgentGroupId: flag("multi-agent-group", "multiAgentGroup"),
-        multiAgentRoleId: flag("multi-agent-role", "multiAgentRole"),
-        multiAgentFanoutId: flag("multi-agent-fanout", "multiAgentFanout"),
+    // The whole load -> change -> save cycle holds the state.json lock so a
+    // concurrent dispatch/result on the same run cannot drop this update.
+    return (0, run_store_1.withRunStateLock)(runId, invocationCwd(args), (run) => {
+        // parseArgv keys long flags in kebab-case; accept camelCase as a fallback.
+        const flag = (kebab, camel) => {
+            const v = args[kebab] ?? args[camel];
+            return typeof v === "string" && v.trim() ? v : undefined;
+        };
+        const manifest = (0, dispatch_1.createDispatchManifest)(run, (0, numeric_flag_1.requiredNumberFlag)(args.limit, "--limit"), {
+            sandboxProfileId: typeof args.sandbox === "string" ? args.sandbox : undefined,
+            sandbox: typeof args.sandbox === "string" ? args.sandbox : undefined,
+            backendId: typeof args.backend === "string" ? args.backend : undefined,
+            multiAgentRunId: flag("multi-agent-run", "multiAgentRun"),
+            multiAgentGroupId: flag("multi-agent-group", "multiAgentGroup"),
+            multiAgentRoleId: flag("multi-agent-role", "multiAgentRole"),
+            multiAgentFanoutId: flag("multi-agent-fanout", "multiAgentFanout"),
+        });
+        if (manifest.dispatchId) {
+            (0, commit_1.commitState)(run, `dispatch:${manifest.dispatchId}`);
+            (0, run_store_1.saveCheckpoint)(run);
+            (0, report_1.writeReport)(run);
+        }
+        return manifest;
     });
-    if (manifest.dispatchId) {
-        (0, commit_1.commitState)(run, `dispatch:${manifest.dispatchId}`);
-        (0, run_store_1.saveCheckpoint)(run);
-        (0, report_1.writeReport)(run);
-    }
-    return manifest;
 }
 function recordResultRun(args) {
     const runId = String(args.runId);
     const taskId = String(args.taskId);
     const resultPath = String(args.resultPath);
-    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
-    const task = run.tasks.find((t) => t.id === taskId);
-    if (!task || !task.workerId)
-        throw new Error(`Unknown task id for run ${runId}: ${taskId}`);
-    const absolute = path.resolve(resultPath);
-    // A result path inside a system directory is never accepted (POLA): the
-    // operator file gets copied into the worker's result.md, so a /etc/passwd
-    // source would smuggle system content into a run. Byte-behavior port of the
-    // old build's recordResult system-directory blacklist.
-    if (/^\/(etc|bin|sbin|usr|Library|System|Applications|boot|dev|proc|sys|root|var\/log|var\/run)\//.test(absolute)) {
-        throw new Error(`Result path must not be a system directory: ${resultPath}`);
-    }
-    if (!fs.existsSync(absolute))
-        throw new Error(`Result file does not exist: ${resultPath}`);
-    const workerId = String(task.workerId);
-    // Host-attested `cw result <run> <task> <file>` intake: the operator hands CW
-    // an EXTERNAL result file that lives OUTSIDE the worker's read-only write
-    // boundary. The old task-level recordResult (lifecycle-operations.ts:279-280)
-    // COPIED that external file into the run's results area and recorded the
-    // internal path — it never ran the external path through validateSandboxWrite.
-    // v2 collapsed the two intakes into recordWorkerOutput, which sandbox-validates
-    // its input against the worker boundary, so a bare external path is rejected
-    // ("write path is outside sandbox profile <id>"). Restore the copy-in: stage
-    // the operator file at the worker's OWN result.md (which IS inside the write
-    // boundary), then record that internal path exactly like a driven worker.
-    const manifest = (0, worker_isolation_1.showWorkerManifest)(run, workerId);
-    fs.mkdirSync(path.dirname(manifest.resultPath), { recursive: true });
-    fs.copyFileSync(absolute, manifest.resultPath);
-    const output = (0, worker_isolation_1.recordWorkerOutput)(run, workerId, manifest.resultPath);
-    // Host-attested token usage (v0.1.31): record it verbatim as provenance when
-    // the operator supplied `--usage-*` flags; CW never synthesizes usage. The old
-    // task-level recordResult set `task.usage = usage` (lifecycle-operations.ts:286)
-    // and its unit was the TASK. v2 records through recordWorkerOutput, which gives
-    // the worker an `output` record — so the observability usage UNIT becomes the
-    // WORKER (deriveUsageTotals reads worker.usage for workers with output, and
-    // EXCLUDES that task). Attach the usage to the worker scope so the report counts
-    // it as an attested unit; also stamp task.usage for byte-parity with the old
-    // task-level record.
-    const usage = (0, observability_1.parseUsageFromArgs)(args, new Date().toISOString());
-    if (usage) {
-        task.usage = usage;
-        const scope = (0, worker_isolation_1.getWorkerScope)(run, workerId);
-        if (scope)
-            scope.usage = usage;
-    }
-    // Byte-exact to the old build's orchestrator recordWorkerOutput()
-    // wrapper: an accepted result is its own checkpoint commit, not just a
-    // bare saveCheckpoint (SPEC/pipeline-run.md's persist-ordering rule).
-    (0, commit_1.commitState)(run, `worker:${workerId}:result`);
-    (0, run_store_1.saveCheckpoint)(run);
-    (0, report_1.writeReport)(run);
-    return output;
+    // Two processes recording results for two tasks of the SAME run used to
+    // race: both loaded, and the later saveCheckpoint dropped the earlier
+    // task's completion. The lock now covers the whole cycle.
+    return (0, run_store_1.withRunStateLock)(runId, invocationCwd(args), (run) => {
+        const task = run.tasks.find((t) => t.id === taskId);
+        if (!task || !task.workerId)
+            throw new Error(`Unknown task id for run ${runId}: ${taskId}`);
+        const absolute = path.resolve(resultPath);
+        // A result path inside a system directory is never accepted (POLA): the
+        // operator file gets copied into the worker's result.md, so a /etc/passwd
+        // source would smuggle system content into a run. Byte-behavior port of the
+        // old build's recordResult system-directory blacklist.
+        if (/^\/(etc|bin|sbin|usr|Library|System|Applications|boot|dev|proc|sys|root|var\/log|var\/run)\//.test(absolute)) {
+            throw new Error(`Result path must not be a system directory: ${resultPath}`);
+        }
+        if (!fs.existsSync(absolute))
+            throw new Error(`Result file does not exist: ${resultPath}`);
+        const workerId = String(task.workerId);
+        // Host-attested `cw result <run> <task> <file>` intake: the operator hands CW
+        // an EXTERNAL result file that lives OUTSIDE the worker's read-only write
+        // boundary. The old task-level recordResult (lifecycle-operations.ts:279-280)
+        // COPIED that external file into the run's results area and recorded the
+        // internal path — it never ran the external path through validateSandboxWrite.
+        // v2 collapsed the two intakes into recordWorkerOutput, which sandbox-validates
+        // its input against the worker boundary, so a bare external path is rejected
+        // ("write path is outside sandbox profile <id>"). Restore the copy-in: stage
+        // the operator file at the worker's OWN result.md (which IS inside the write
+        // boundary), then record that internal path exactly like a driven worker.
+        const manifest = (0, worker_isolation_1.showWorkerManifest)(run, workerId);
+        fs.mkdirSync(path.dirname(manifest.resultPath), { recursive: true });
+        fs.copyFileSync(absolute, manifest.resultPath);
+        const output = (0, worker_isolation_1.recordWorkerOutput)(run, workerId, manifest.resultPath, {
+            requireAttestedTelemetry: (0, agent_config_1.resolveAgentConfig)(args).requireAttestedTelemetry,
+            allowUnattested: Boolean(args.allowUnattested ?? args["allow-unattested"]),
+        });
+        // Host-attested token usage (v0.1.31): record it verbatim as provenance when
+        // the operator supplied `--usage-*` flags; CW never synthesizes usage. The old
+        // task-level recordResult set `task.usage = usage` (lifecycle-operations.ts:286)
+        // and its unit was the TASK. v2 records through recordWorkerOutput, which gives
+        // the worker an `output` record — so the observability usage UNIT becomes the
+        // WORKER (deriveUsageTotals reads worker.usage for workers with output, and
+        // EXCLUDES that task). Attach the usage to the worker scope so the report counts
+        // it as an attested unit; also stamp task.usage for byte-parity with the old
+        // task-level record.
+        const usage = (0, observability_1.parseUsageFromArgs)(args, new Date().toISOString());
+        if (usage) {
+            task.usage = usage;
+            const scope = (0, worker_isolation_1.getWorkerScope)(run, workerId);
+            if (scope)
+                scope.usage = usage;
+        }
+        // Byte-exact to the old build's orchestrator recordWorkerOutput()
+        // wrapper: an accepted result is its own checkpoint commit, not just a
+        // bare saveCheckpoint (SPEC/pipeline-run.md's persist-ordering rule).
+        (0, commit_1.commitState)(run, `worker:${workerId}:result`);
+        (0, run_store_1.saveCheckpoint)(run);
+        (0, report_1.writeReport)(run);
+        return output;
+    });
 }
 /** `cw commit <run-id>` — byte-exact port of the old build's
  *  `orchestrator/lifecycle-operations.ts`'s `commit()`: the CLI/MCP
@@ -639,29 +692,33 @@ function recordResultRun(args) {
  *  still leaves the run's report/state current on disk. */
 function commitRun(args) {
     const runId = String(args.runId);
-    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
-    const allowCheckpoint = Boolean(args.allowUnverifiedCheckpoint || args["allow-unverified-checkpoint"]);
-    const hasGateOption = Boolean(args.verifier || args.verifierNode || args["verifier-node"] || args.candidate || args.selection);
-    try {
-        const commit = (0, commit_1.commitState)(run, {
-            reason: typeof args.reason === "string" && args.reason ? args.reason : "manual",
-            verifierNodeId: (typeof args.verifier === "string" && args.verifier) ||
-                (typeof args.verifierNode === "string" && args.verifierNode) ||
-                (typeof args["verifier-node"] === "string" && args["verifier-node"]) ||
-                undefined,
-            candidateId: typeof args.candidate === "string" ? args.candidate : undefined,
-            selectionId: typeof args.selection === "string" ? args.selection : undefined,
-            verifierGated: hasGateOption || !allowCheckpoint,
-            allowUnverifiedCheckpoint: allowCheckpoint,
-            source: "cli",
-        });
-        (0, report_1.writeReport)(run);
-        (0, run_store_1.saveCheckpoint)(run);
-        return { runId: run.id, commit };
-    }
-    catch (error) {
-        (0, report_1.writeReport)(run);
-        (0, run_store_1.saveCheckpoint)(run);
-        throw error;
-    }
+    // Hold the state.json lock across the whole load -> commit -> save (both the
+    // success and the fail-closed catch persist) so a concurrent run mutation
+    // cannot drop this commit (lost-update class, matching dispatchRun/recordResultRun).
+    return (0, run_store_1.withRunStateLock)(runId, invocationCwd(args), (run) => {
+        const allowCheckpoint = Boolean(args.allowUnverifiedCheckpoint || args["allow-unverified-checkpoint"]);
+        const hasGateOption = Boolean(args.verifier || args.verifierNode || args["verifier-node"] || args.candidate || args.selection);
+        try {
+            const commit = (0, commit_1.commitState)(run, {
+                reason: typeof args.reason === "string" && args.reason ? args.reason : "manual",
+                verifierNodeId: (typeof args.verifier === "string" && args.verifier) ||
+                    (typeof args.verifierNode === "string" && args.verifierNode) ||
+                    (typeof args["verifier-node"] === "string" && args["verifier-node"]) ||
+                    undefined,
+                candidateId: typeof args.candidate === "string" ? args.candidate : undefined,
+                selectionId: typeof args.selection === "string" ? args.selection : undefined,
+                verifierGated: hasGateOption || !allowCheckpoint,
+                allowUnverifiedCheckpoint: allowCheckpoint,
+                source: "cli",
+            });
+            (0, report_1.writeReport)(run);
+            (0, run_store_1.saveCheckpoint)(run);
+            return { runId: run.id, commit };
+        }
+        catch (error) {
+            (0, report_1.writeReport)(run);
+            (0, run_store_1.saveCheckpoint)(run);
+            throw error;
+        }
+    });
 }

package/dist/shell/reclamation-io.js

@@ -106,6 +106,7 @@ const node_store_1 = require("./node-store");
 const node_snapshot_1 = require("../core/state/node-snapshot");
 const node_projection_1 = require("../core/state/node-projection");
 const hash_1 = require("../core/hash");
+const collate_1 = require("../core/util/collate");
 const run_registry_io_1 = require("./run-registry-io");
 // ---------------------------------------------------------------------------
 // Content addressing + byte measurement (in-process, no `du`) — carried
@@ -638,6 +639,16 @@ function freeBulk(run, tombstone) {
     let freedBytes = 0;
     for (const entry of tombstone.freed) {
         const abs = path.join(runDir, entry.path);
+        // planReclamation always derives entry.path as a relative path already
+        // confined under runDir, but a tampered/imported state.json could carry a
+        // worker/artifact path that resolves outside it — re-check containment
+        // right before the recursive delete so that can never turn into an
+        // out-of-tree rmSync.
+        if (!(0, fs_atomic_1.isContainedPath)(abs, runDir)) {
+            throw new ReclamationError("unsafe-free-path", `refusing to free path outside the run directory: ${entry.path}`, {
+                path: entry.path,
+            });
+        }
         const before = dirBytes(abs);
         fs.rmSync(abs, { recursive: true, force: true });
         freedBytes += before;
@@ -866,7 +877,7 @@ function gcPlan(host, options = {}) {
         eligibleCount,
         bytesToFree,
         entries,
-        nextAction: eligibleCount ? "node scripts/cw.js gc run" : "node scripts/cw.js run search",
+        nextAction: eligibleCount ? "cw gc run" : "cw run search",
     };
 }
 function gcRun(host, options = {}) {
@@ -935,7 +946,7 @@ function gcRun(host, options = {}) {
         reclaimed,
         refused,
         totalBytesFreed,
-        nextAction: reclaimed.length ? "node scripts/cw.js gc verify <run-id>" : "node scripts/cw.js gc plan",
+        nextAction: reclaimed.length ? "cw gc verify <run-id>" : "cw gc plan",
     };
 }
 function gcVerify(host, runId, options = {}) {
@@ -951,7 +962,7 @@ function gcVerify(host, runId, options = {}) {
             capability: "re-runnable",
             chainLength: 0,
             checks: [{ name: "located", pass: false, code: "not-reclaimed", detail: "run source not found" }],
-            nextAction: "node scripts/cw.js registry refresh" + (scope === "home" ? " --scope home" : ""),
+            nextAction: "cw registry refresh" + (scope === "home" ? " --scope home" : ""),
         };
     }
     const run = host.loadRun(located.record.repo, runId);
@@ -984,7 +995,7 @@ function gcVerify(host, runId, options = {}) {
         tombstoneHash: last?.tombstoneHash,
         chainLength: result.tombstones.length,
         checks,
-        nextAction: verified ? "node scripts/cw.js run show " + runId : "node scripts/cw.js gc plan",
+        nextAction: verified ? "cw run show " + runId : "cw gc plan",
     };
 }
 // ---------------------------------------------------------------------------
@@ -1287,7 +1298,7 @@ function readCloneEntries(root) {
             bytes: dirSize(dir),
         });
     }
-    entries.sort((a, b) => (a.fetchedAt || "").localeCompare(b.fetchedAt || ""));
+    entries.sort((a, b) => (0, collate_1.stableCompare)(a.fetchedAt || "", b.fetchedAt || ""));
     return entries;
 }
 /** `cw clones list` — every cached remote checkout with its origin,