cool-workflow 0.2.2 → 0.2.3

package/scripts/verify-bump-reproduction.sh

@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+# verify-bump-reproduction.sh — closes the HEAD~1 verdict-replay bypass.
+#
+# release-gate.yml / npm-publish.yml tolerate a verdict written for the tag
+# commit's PARENT (release-flow.js's cut() reviews content, then adds a
+# mechanical version-bump + the verdict as a NEW child commit that actually
+# gets tagged). A validly-signed verdict at the parent proves someone once
+# approved THAT commit — it does NOT prove the child (the thing actually being
+# tagged) is the deterministic bump cut() would have produced, rather than an
+# attacker's own commit smuggling in arbitrary changes on top of an old,
+# genuinely-approved parent (a real signature on a REPLAYED verdict).
+#
+# This script independently reproduces the bump: checks out the approved
+# parent into a scratch worktree, runs the SAME bump:version/sync:project-index
+# steps cut() runs, stages the SAME way cut() stages (git add -u + the
+# explicit verdict/.sig paths, never -A), and requires the resulting tree to
+# match the ACTUAL tagged commit's tree byte-for-byte. Any difference —
+# anywhere, including a single added file — fails closed.
+#
+# Usage: verify-bump-reproduction.sh <approved-parent-sha> <tagged-sha> <verdict-repo-relative-path> [sig-repo-relative-path]
+#
+# Exit 0: the tagged commit's tree matches the reproduced bump exactly.
+# Exit 1: mismatch, or any step failed (install, bump, sync, worktree, etc).
+set -uo pipefail
+
+# Where THIS SCRIPT ITSELF lives — distinct from REPO_ROOT (the git repo being
+# operated ON, resolved below from the invocation cwd). These coincide in
+# ordinary production use (the script runs from within the same checkout it
+# verifies), but conflating them is wrong: REPO_ROOT could be an ARBITRARY git
+# context (e.g. a test harness's throwaway clone of old history, which never
+# has this script's own sibling files, since they postdate whatever was
+# cloned). Sibling files this script depends on must be found relative to
+# where it is installed, never relative to the repo it happens to be pointed at.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+PARENT="${1:-}"
+TAGGED="${2:-}"
+VERDICT_REL="${3:-}"
+SIG_REL="${4:-}"
+if [[ -z "$PARENT" || -z "$TAGGED" || -z "$VERDICT_REL" ]]; then
+  echo "usage: verify-bump-reproduction.sh <parent-sha> <tagged-sha> <verdict-rel-path> [sig-rel-path]" >&2
+  exit 1
+fi
+
+REPO_ROOT="$(git rev-parse --show-toplevel)" || exit 1
+SCRATCH_PARENT="$(mktemp -d)"
+SCRATCH="$SCRATCH_PARENT/wt"
+cleanup() {
+  git -C "$REPO_ROOT" worktree remove --force "$SCRATCH" >/dev/null 2>&1
+  rm -rf "$SCRATCH_PARENT"
+}
+trap cleanup EXIT
+
+if ! git -C "$REPO_ROOT" worktree add --quiet --detach "$SCRATCH" "$PARENT" 2>/dev/null; then
+  echo "verify-bump-reproduction: could not create a scratch worktree at $PARENT" >&2
+  exit 1
+fi
+
+# The target version comes from the TAGGED commit (not the parent, which may
+# still be pre-bump) — read via git plumbing, no separate checkout needed.
+VERSION="$(git -C "$REPO_ROOT" show "$TAGGED:plugins/cool-workflow/package.json" 2>/dev/null | node -e '
+  let s=""; process.stdin.on("data",d=>s+=d).on("end",()=>{ try { process.stdout.write(JSON.parse(s).version||""); } catch { process.stdout.write(""); } });
+')"
+if [[ -z "$VERSION" ]]; then
+  echo "verify-bump-reproduction: could not read package.json version from tagged commit $TAGGED" >&2
+  exit 1
+fi
+
+# sync-project-index.js embeds a wall-clock "Generated on <date>" line. Pin it
+# to the TAGGED commit's own committer date (UTC) via a Node --require preload
+# that overrides the global Date constructor (fake-date-for-reproduction.js),
+# NOT an application-level env var: the scratch worktree runs the APPROVED
+# PARENT's OWN checked-out copy of sync-project-index.js, which for every
+# release cut before this mechanism existed has no idea any such env var is
+# meant to be read — an app-level opt-in is a no-op against code that doesn't
+# know to opt in, so it can only ever "work" for releases cut after the
+# mechanism landed (confirmed empirically: re-running an already-shipped
+# release's real approved-parent/tagged pair on a later calendar day produced
+# a tree mismatch whose ONLY diff was that one date line). A global override
+# of the Date constructor, injected before any application code runs, is
+# transparent to the code being executed regardless of which version it is.
+CUT_DATE="$(TZ=UTC git -C "$REPO_ROOT" show -s --format=%cd --date=format-local:%Y-%m-%d "$TAGGED" 2>/dev/null)"
+if [[ -z "$CUT_DATE" ]]; then
+  echo "verify-bump-reproduction: could not read the tagged commit's committer date" >&2
+  exit 1
+fi
+FAKE_DATE_PRELOAD="$SCRIPT_DIR/fake-date-for-reproduction.js"
+
+# Each step's exit code is checked EXPLICITLY and immediately (not via a
+# `cmd1 && cmd2 && cmd3` chain) — a chain's overall success can silently
+# survive an earlier step's failure if a future edit ever loosens it (e.g.
+# `&&` accidentally becoming `;`), which would flip this fail-closed gate to
+# fail-open without changing its outward shape. stdout/stderr from each step
+# are captured (not discarded to /dev/null) so a real failure — a transient
+# npm registry hiccup vs. an actual reproduction mismatch — is distinguishable
+# in the workflow log instead of both collapsing into the same generic message.
+run_step() {
+  local label="$1"
+  shift
+  local out
+  out="$("$@" 2>&1)"
+  local code=$?
+  if [[ $code -ne 0 ]]; then
+    echo "verify-bump-reproduction: $label failed (exit $code):" >&2
+    echo "$out" >&2
+    return 1
+  fi
+  return 0
+}
+
+(
+  cd "$SCRATCH/plugins/cool-workflow" || exit 1
+  export NODE_OPTIONS="--require $FAKE_DATE_PRELOAD"
+  export CW_FAKE_DATE="$CUT_DATE"
+  run_step "npm install" npm install --no-package-lock --ignore-scripts || exit 1
+  run_step "bump:version" npm run bump:version -- "$VERSION" || exit 1
+  run_step "sync:project-index" npm run sync:project-index -- --repo-only || exit 1
+)
+BUMP_STATUS=$?
+if [[ $BUMP_STATUS -ne 0 ]]; then
+  echo "verify-bump-reproduction: reproducing the bump for $PARENT -> v$VERSION failed" >&2
+  exit 1
+fi
+
+mkdir -p "$SCRATCH/.cw-release"
+cp "$REPO_ROOT/$VERDICT_REL" "$SCRATCH/$VERDICT_REL" || exit 1
+if [[ -n "$SIG_REL" && -f "$REPO_ROOT/$SIG_REL" ]]; then
+  cp "$REPO_ROOT/$SIG_REL" "$SCRATCH/$SIG_REL" || exit 1
+fi
+
+# Mirror cut()'s OWN staging exactly (git-add -u + the explicit verdict/.sig
+# paths) — never -A, so an untracked stray left by npm/tooling in the scratch
+# worktree can never silently ride into what we compare.
+git -C "$SCRATCH" add -u
+git -C "$SCRATCH" add -- "$VERDICT_REL"
+if [[ -n "$SIG_REL" && -f "$SCRATCH/$SIG_REL" ]]; then
+  git -C "$SCRATCH" add -- "$SIG_REL"
+fi
+
+EXPECTED_TREE="$(git -C "$SCRATCH" write-tree)"
+ACTUAL_TREE="$(git -C "$REPO_ROOT" rev-parse "$TAGGED^{tree}")"
+
+if [[ "$EXPECTED_TREE" != "$ACTUAL_TREE" ]]; then
+  echo "verify-bump-reproduction: $TAGGED's tree ($ACTUAL_TREE) does not match the deterministic bump reproduced from approved parent $PARENT ($EXPECTED_TREE) — refusing" >&2
+  exit 1
+fi
+
+exit 0

package/scripts/verify-verdict-signature.js

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+"use strict";
+
+// verify-verdict-signature.js — verify an ed25519 signature over a committed
+// release verdict file, against the committed public key
+// (.cw-release/verdict-signing.pub). Portable (node + node:crypto only) so
+// CI (release-gate.yml, npm-publish.yml) and the local block-unapproved-tag.sh
+// hook can all shell out to the SAME check instead of three drifting copies.
+//
+// Exit 0: signature verifies. Exit 1: missing file, unreadable key, or a
+// signature that does not match (tampered verdict, wrong key, hand-written
+// verdict with no real signature). Never throws uncaught — callers rely on
+// the exit code alone, not stderr text.
+//
+// Usage: node verify-verdict-signature.js <verdict-file> <sig-file> <pubkey-file>
+
+const fs = require("node:fs");
+const crypto = require("node:crypto");
+
+function fail(message) {
+  process.stderr.write(`verify-verdict-signature: ${message}\n`);
+  process.exit(1);
+}
+
+const [, , verdictPath, sigPath, pubkeyPath] = process.argv;
+if (!verdictPath || !sigPath || !pubkeyPath) {
+  process.stderr.write("usage: verify-verdict-signature.js <verdict-file> <sig-file> <pubkey-file>\n");
+  process.exit(2);
+}
+
+let message;
+try {
+  message = fs.readFileSync(verdictPath);
+} catch (error) {
+  fail(`cannot read verdict file ${verdictPath}: ${error.message}`);
+}
+
+let signature;
+try {
+  signature = Buffer.from(fs.readFileSync(sigPath, "utf8").trim(), "base64");
+  if (signature.length === 0) fail(`signature file ${sigPath} is empty`);
+} catch (error) {
+  fail(`cannot read signature file ${sigPath}: ${error.message}`);
+}
+
+let publicKey;
+try {
+  publicKey = crypto.createPublicKey(fs.readFileSync(pubkeyPath, "utf8"));
+} catch (error) {
+  fail(`cannot read public key ${pubkeyPath}: ${error.message}`);
+}
+
+let ok = false;
+try {
+  ok = crypto.verify(null, message, publicKey, signature);
+} catch (error) {
+  fail(`verification error: ${error.message}`);
+}
+
+if (!ok) fail(`signature does not match ${verdictPath} (tampered, wrong key, or not a real signature)`);
+process.exit(0);

package/skills/cool-workflow/SKILL.md

@@ -62,16 +62,16 @@ Use this loop to explain workflow progress when reporting status.
 ## Operating Loop
 
 1. Pick or create a workflow.
-2. `node scripts/cw.js plan <workflow-id> ...` from the plugin root (or the
+2. `cw plan <workflow-id> ...` from the plugin root (or the
    absolute plugin script path).
-3. `node scripts/cw.js dispatch <run-id> --limit N` to create a dispatch
+3. `cw dispatch <run-id> --limit N` to create a dispatch
    manifest for the current phase. Add `--sandbox <profile-id>` when an explicit
    worker policy profile is needed.
 4. If — and only if — the user explicitly asked for agents, spawn one subagent
    per dispatched task with disjoint scopes.
 5. Save each subagent summary to `.cw/runs/<run-id>/results/<task-id>.md`.
-6. `node scripts/cw.js result <run-id> <task-id> <result-file>`.
-7. When all required work is complete, `node scripts/cw.js report <run-id>`.
+6. `cw result <run-id> <task-id> <result-file>`.
+7. When all required work is complete, `cw report <run-id>`.
 8. Synthesize the final user-facing answer from the report and verified
    evidence.
 
@@ -114,11 +114,11 @@ report chain. See `references/commands.md` for the exact invocations.
 ## Essential Commands
 
 ```bash
-node scripts/cw.js list
-node scripts/cw.js plan architecture-review --repo /path/to/repo --question "Is this architecture sound?"
-node scripts/cw.js dispatch <run-id> --limit 6
-node scripts/cw.js result <run-id> <task-id> /path/to/result.md
-node scripts/cw.js report <run-id> --show
+cw list
+cw plan architecture-review --repo /path/to/repo --question "Is this architecture sound?"
+cw dispatch <run-id> --limit 6
+cw result <run-id> <task-id> /path/to/result.md
+cw report <run-id> --show
 ```
 
 When working in this repository, the plugin root is `plugins/cool-workflow`.

package/skills/cool-workflow/references/commands.md

@@ -26,19 +26,20 @@ absolute plugin script path. Run data is written to `.cw/runs/<run-id>/` under
 ## Discovery & apps
 
 ```bash
-node scripts/cw.js list
-node scripts/cw.js app list
-node scripts/cw.js app show architecture-review
-node scripts/cw.js app show pr-review-fix-ci
-node scripts/cw.js app show release-cut
-node scripts/cw.js app show research-synthesis
-node scripts/cw.js app validate apps/architecture-review/app.json
-node scripts/cw.js app show workflow-app-framework-demo
-node scripts/cw.js app validate apps/workflow-app-framework-demo/app.json
-node scripts/cw.js app validate end-to-end-golden-path
-node scripts/cw.js app package workflow-app-framework-demo
-node scripts/cw.js app init my-app --title "My App"
-node scripts/cw.js init my-workflow --title "My Workflow"
+cw list
+cw search architecture
+cw app list
+cw app show architecture-review
+cw app show pr-review-fix-ci
+cw app show release-cut
+cw app show research-synthesis
+cw app validate apps/architecture-review/app.json
+cw app show workflow-app-framework-demo
+cw app validate apps/workflow-app-framework-demo/app.json
+cw app validate end-to-end-golden-path
+cw app package workflow-app-framework-demo
+cw app init my-app --title "My App"
+cw init my-workflow --title "My Workflow"
 ```
 
 The canonical app ids are `architecture-review`, `pr-review-fix-ci`,
@@ -62,16 +63,16 @@ harness; the reviewer is delegated via `CW_AGENT_COMMAND`/`CW_AGENT_ENDPOINT`
 ## Plan / dispatch / result / report
 
 ```bash
-node scripts/cw.js plan architecture-review --repo /path/to/repo --question "Is this architecture sound?"
-node scripts/cw.js status <run-id>
-node scripts/cw.js status <run-id> --json
-node scripts/cw.js graph <run-id>
-node scripts/cw.js graph <run-id> --json
-node scripts/cw.js dispatch <run-id> --limit 6
-node scripts/cw.js dispatch <run-id> --sandbox readonly
-node scripts/cw.js result <run-id> <task-id> /path/to/result.md
-node scripts/cw.js report <run-id>
-node scripts/cw.js report <run-id> --show
+cw plan architecture-review --repo /path/to/repo --question "Is this architecture sound?"
+cw status <run-id>
+cw status <run-id> --json
+cw graph <run-id>
+cw graph <run-id> --json
+cw dispatch <run-id> --limit 6
+cw dispatch <run-id> --sandbox readonly
+cw result <run-id> <task-id> /path/to/result.md
+cw report <run-id>
+cw report <run-id> --show
 ```
 
 Operator UX is human-readable by default for `status`, `graph`, report
@@ -87,12 +88,12 @@ role, group, fanout/fanin, blackboard, coordinator, candidate, commit, and audit
 records — deterministic recipes, not hidden autonomous coordination.
 
 ```bash
-node scripts/cw.js topology list
-node scripts/cw.js topology show map-reduce
-node scripts/cw.js topology validate map-reduce
-node scripts/cw.js topology apply <run-id> map-reduce --task task-id --mapper-count 2
-node scripts/cw.js topology summary <run-id>
-node scripts/cw.js topology graph <run-id>
+cw topology list
+cw topology show map-reduce
+cw topology validate map-reduce
+cw topology apply <run-id> map-reduce --task task-id --mapper-count 2
+cw topology summary <run-id>
+cw topology graph <run-id>
 ```
 
 ## Multi-agent host surface
@@ -103,22 +104,22 @@ plumbing. It wraps the topology, multi-agent, blackboard, candidate, commit, and
 audit primitives; it does not replace them.
 
 ```bash
-node scripts/cw.js multi-agent run <run-id> --topology judge-panel --task task-id
-node scripts/cw.js multi-agent status <run-id>
-node scripts/cw.js multi-agent step <run-id> --sandbox readonly
-node scripts/cw.js multi-agent blackboard <run-id> summary
-node scripts/cw.js multi-agent score <run-id> candidate-id --criterion correctness=1 --evidence ref
-node scripts/cw.js multi-agent select <run-id> candidate-id --reason "verified winner"
+cw multi-agent run <run-id> --topology judge-panel --task task-id
+cw multi-agent status <run-id>
+cw multi-agent step <run-id> --sandbox readonly
+cw multi-agent blackboard <run-id> summary
+cw multi-agent score <run-id> candidate-id --criterion correctness=1 --evidence ref
+cw multi-agent select <run-id> candidate-id --reason "verified winner"
 ```
 
 Operator views (who depends on whom, who is blocked, which evidence was adopted):
 
 ```bash
-node scripts/cw.js multi-agent summary <run-id>
-node scripts/cw.js multi-agent graph <run-id>
-node scripts/cw.js multi-agent dependencies <run-id>
-node scripts/cw.js multi-agent failures <run-id>
-node scripts/cw.js multi-agent evidence <run-id>
+cw multi-agent summary <run-id>
+cw multi-agent graph <run-id>
+cw multi-agent dependencies <run-id>
+cw multi-agent failures <run-id>
+cw multi-agent evidence <run-id>
 ```
 
 State Explosion Management — when a run grows too large to read, use derived,
@@ -126,11 +127,11 @@ provenance-backed digests (they never delete raw records and fail closed when
 stale; every synthetic node carries source ids and an expansion command):
 
 ```bash
-node scripts/cw.js summary refresh <run-id>
-node scripts/cw.js summary show <run-id>
-node scripts/cw.js blackboard summarize <run-id>
-node scripts/cw.js multi-agent summarize <run-id>
-node scripts/cw.js multi-agent graph <run-id> --view compact|critical-path|failures|... [--focus <id>] [--depth <n>]
+cw summary refresh <run-id>
+cw summary show <run-id>
+cw blackboard summarize <run-id>
+cw multi-agent summarize <run-id>
+cw multi-agent graph <run-id> --view compact|critical-path|failures|... [--focus <id>] [--depth <n>]
 ```
 
 Trust / Policy / Audit — inspect role authority, message provenance, blackboard
@@ -138,11 +139,11 @@ write decisions, judge rationale, panel decisions, and why a result is trusted
 (missing policy/evidence/provenance/rationale fail closed):
 
 ```bash
-node scripts/cw.js audit multi-agent <run-id>
-node scripts/cw.js audit policy <run-id>
-node scripts/cw.js audit role <run-id>
-node scripts/cw.js audit blackboard <run-id>
-node scripts/cw.js audit judge <run-id>
+cw audit multi-agent <run-id>
+cw audit policy <run-id>
+cw audit role <run-id>
+cw audit blackboard <run-id>
+cw audit judge <run-id>
 ```
 
 ## Multi-agent low-level state
@@ -154,12 +155,12 @@ transitions, duplicate memberships, ambiguous dispatch attachment, and missing
 fanin evidence fail closed.
 
 ```bash
-node scripts/cw.js multi-agent run <run-id> --id ma --objective "coordinated work"
-node scripts/cw.js multi-agent role <run-id> role --multi-agent-run ma --responsibility "do work" --required-evidence "result evidence"
-node scripts/cw.js multi-agent group <run-id> group --multi-agent-run ma --task task-id
-node scripts/cw.js multi-agent fanout <run-id> fanout --group group --reason "split work" --role role --task task-id
-node scripts/cw.js dispatch <run-id> --multi-agent-run ma --multi-agent-group group --multi-agent-role role --multi-agent-fanout fanout
-node scripts/cw.js multi-agent fanin <run-id> fanin --group group --fanout fanout --required-role role
+cw multi-agent run <run-id> --id ma --objective "coordinated work"
+cw multi-agent role <run-id> role --multi-agent-run ma --responsibility "do work" --required-evidence "result evidence"
+cw multi-agent group <run-id> group --multi-agent-run ma --task task-id
+cw multi-agent fanout <run-id> fanout --group group --reason "split work" --role role --task task-id
+cw dispatch <run-id> --multi-agent-run ma --multi-agent-group group --multi-agent-role role --multi-agent-fanout fanout
+cw multi-agent fanin <run-id> fanin --group group --fanout fanout --required-role role
 ```
 
 ## Eval & replay
@@ -168,12 +169,12 @@ Use when a topology-backed multi-agent run needs release-gate evidence.
 Artifacts live under `.cw/evals/<suite-id>/` as plain JSON plus `report.md`.
 
 ```bash
-node scripts/cw.js eval snapshot <run-id> --id suite-id
-node scripts/cw.js eval replay .cw/evals/suite-id/snapshot.json
-node scripts/cw.js eval compare .cw/evals/suite-id/snapshot.json .cw/evals/suite-id/replay-run.json
-node scripts/cw.js eval score .cw/evals/suite-id/replay-run.json
-node scripts/cw.js eval gate .cw/evals/suite-id
-node scripts/cw.js eval report .cw/evals/suite-id/replay-run.json
+cw eval snapshot <run-id> --id suite-id
+cw eval replay .cw/evals/suite-id/snapshot.json
+cw eval compare .cw/evals/suite-id/snapshot.json .cw/evals/suite-id/replay-run.json
+cw eval score .cw/evals/suite-id/replay-run.json
+cw eval gate .cw/evals/suite-id
+cw eval report .cw/evals/suite-id/replay-run.json
 ```
 
 ## Blackboard & coordinator
@@ -183,14 +184,14 @@ context frames, artifact refs, snapshots, and coordinator decisions under
 `.cw/runs/<run-id>/blackboard/`.
 
 ```bash
-node scripts/cw.js blackboard summary <run-id>
-node scripts/cw.js blackboard topic create <run-id> --id topic --title "Shared context"
-node scripts/cw.js blackboard message post <run-id> --topic topic --body "message"
-node scripts/cw.js blackboard context put <run-id> --topic topic --kind fact --key finding --value "evidence-backed fact"
-node scripts/cw.js blackboard artifact add <run-id> --topic topic --path /path/to/result.md --kind worker-result
-node scripts/cw.js blackboard snapshot <run-id>
-node scripts/cw.js coordinator summary <run-id>
-node scripts/cw.js coordinator decision <run-id> --kind conflict-resolution --outcome accepted --reason "evidence supports this"
+cw blackboard summary <run-id>
+cw blackboard topic create <run-id> --id topic --title "Shared context"
+cw blackboard message post <run-id> --topic topic --body "message"
+cw blackboard context put <run-id> --topic topic --kind fact --key finding --value "evidence-backed fact"
+cw blackboard artifact add <run-id> --topic topic --path /path/to/result.md --kind worker-result
+cw blackboard snapshot <run-id>
+cw coordinator summary <run-id>
+cw coordinator decision <run-id> --kind conflict-resolution --outcome accepted --reason "evidence supports this"
 ```
 
 ## Sandbox profiles
@@ -201,10 +202,10 @@ CW enforces profile validation and worker result acceptance; the agent host
 enforces OS/process/network/environment controls.
 
 ```bash
-node scripts/cw.js sandbox list
-node scripts/cw.js sandbox show readonly
-node scripts/cw.js sandbox validate ./site-sandbox.json
-node scripts/cw.js worker manifest <run-id> <worker-id>
+cw sandbox list
+cw sandbox show readonly
+cw sandbox validate ./site-sandbox.json
+cw worker manifest <run-id> <worker-id>
 ```
 
 ## Commit, state & summaries
@@ -214,14 +215,14 @@ dry-runs migration and normalization; newer unsupported schemas fail closed and
 unknown user data is preserved.
 
 ```bash
-node scripts/cw.js commit <run-id> --verifier <node-id> --reason "verified result"
-node scripts/cw.js commit <run-id> --selection <selection-id> --reason "verified winner"
-node scripts/cw.js commit <run-id> --allow-unverified-checkpoint --reason "manual checkpoint"
-node scripts/cw.js worker summary <run-id>
-node scripts/cw.js candidate summary <run-id>
-node scripts/cw.js feedback summary <run-id>
-node scripts/cw.js commit summary <run-id>
-node scripts/cw.js state check <run-id>
+cw commit <run-id> --verifier <node-id> --reason "verified result"
+cw commit <run-id> --selection <selection-id> --reason "verified winner"
+cw commit <run-id> --allow-unverified-checkpoint --reason "manual checkpoint"
+cw worker summary <run-id>
+cw candidate summary <run-id>
+cw feedback summary <run-id>
+cw commit summary <run-id>
+cw state check <run-id>
 ```
 
 ## Scheduling & routines
@@ -232,12 +233,12 @@ prompt is handled. `routine create`/`routine fire` handle API/GitHub trigger
 events.
 
 ```bash
-node scripts/cw.js loop --intervalMinutes 30 --prompt "Continue this workflow."
-node scripts/cw.js schedule create --kind loop --intervalMinutes 30 --prompt "Continue this workflow."
-node scripts/cw.js schedule due
-node scripts/cw.js schedule daemon --once
-node scripts/cw.js routine create --kind github --prompt "Handle this GitHub event."
-node scripts/cw.js routine fire github payload.json
+cw loop --intervalMinutes 30 --prompt "Continue this workflow."
+cw schedule create --kind loop --intervalMinutes 30 --prompt "Continue this workflow."
+cw schedule due
+cw schedule daemon --once
+cw routine create --kind github --prompt "Handle this GitHub event."
+cw routine fire github payload.json
 ```
 
 ## Release & maintenance npm scripts

package/ui/workbench/app.css

@@ -12,6 +12,20 @@
   --absent: #d29922;
   --bad: #f85149;
 }
+@media (prefers-color-scheme: light) {
+  :root {
+    --bg: #f6f7f9;
+    --panel: #ffffff;
+    --panel-2: #eef0f4;
+    --ink: #1b1f27;
+    --muted: #5b6472;
+    --line: #d7dce4;
+    --accent: #1a6fd6;
+    --present: #1a7f37;
+    --absent: #9a6700;
+    --bad: #cf222e;
+  }
+}
 * { box-sizing: border-box; }
 body {
   margin: 0;
@@ -45,8 +59,17 @@ input[type="search"] {
 }
 .run-list li:hover { border-color: var(--accent); }
 .run-list li.active { border-color: var(--accent); background: var(--panel-2); }
-.run-list .rid { font-family: ui-monospace, monospace; font-size: 12px; }
+.run-list .rid { font-family: ui-monospace, monospace; font-size: 12px; display: flex; align-items: center; gap: 6px; }
 .run-list .meta { color: var(--muted); font-size: 11px; margin-top: 2px; }
+.status-dot {
+  display: inline-block; width: 8px; height: 8px; border-radius: 50%; flex: none;
+  background: var(--muted);
+}
+.status-dot.running { background: var(--accent); }
+.status-dot.completed { background: var(--present); }
+.status-dot.queued, .status-dot.archived, .status-dot.reclaimed { background: var(--muted); }
+.status-dot.blocked { background: var(--absent); }
+.status-dot.failed { background: var(--bad); }
 .detail { overflow-y: auto; padding: 16px 20px; }
 .detail .empty { color: var(--muted); }
 .tabs { display: flex; gap: 6px; flex-wrap: wrap; border-bottom: 1px solid var(--line); padding-bottom: 8px; margin-bottom: 12px; }
@@ -74,3 +97,16 @@ pre.json {
 .kv { display: flex; gap: 16px; flex-wrap: wrap; padding: 8px 12px; font-size: 12px; color: var(--muted); }
 .kv b { color: var(--ink); font-weight: 600; }
 .err { color: var(--bad); }
+.struct-block { padding: 10px 12px; border-top: 1px solid var(--line); }
+.struct-block:first-child { border-top: none; }
+.struct-block .struct-title { font-size: 11px; text-transform: uppercase; letter-spacing: 0.04em; color: var(--muted); margin-bottom: 6px; }
+.struct-table { width: 100%; border-collapse: collapse; font-size: 12px; }
+.struct-table th, .struct-table td {
+  text-align: left; padding: 4px 8px; border-bottom: 1px solid var(--line);
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace; vertical-align: top;
+}
+.struct-table th { color: var(--muted); font-weight: 400; }
+.struct-edges { list-style: none; margin: 0; padding: 0; font-size: 12px; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
+.struct-edges li { padding: 3px 0; }
+.struct-edges .arrow { color: var(--muted); padding: 0 6px; }
+.struct-empty { color: var(--muted); font-size: 12px; }