cool-workflow 0.2.3 → 0.2.5

package/docs/scheduled-tasks.md

@@ -1,80 +0,0 @@
-# Scheduled Tasks
-
-CW scheduled tasks let you make looping prompts, cron-like schedules, one-shot
-reminders, expiration, jitter, and clear completion.
-
-CW keeps schedules in:
-
-```text
-.cw/schedules/tasks.json
-```
-
-## Commands
-
-Make a `/loop`-ready schedule:
-
-```bash
-cw loop \
-  --intervalMinutes 30 \
-  --prompt "Check this workflow and continue if work is due."
-```
-
-Make a loop:
-
-```bash
-cw schedule create \
-  --kind loop \
-  --intervalMinutes 30 \
-  --prompt "Check this workflow and continue if work is due."
-```
-
-Make a cron schedule:
-
-```bash
-cw schedule create \
-  --kind cron \
-  --cron "*/15 * * * *" \
-  --prompt "Run the due workflow scan."
-```
-
-Make a reminder:
-
-```bash
-cw schedule create \
-  --kind reminder \
-  --delayMinutes 60 \
-  --prompt "Remind me to inspect the report."
-```
-
-List and look through:
-
-```bash
-cw schedule list
-cw schedule due
-cw schedule complete <schedule-id>
-cw schedule pause <schedule-id>
-cw schedule resume <schedule-id>
-cw schedule run-now <schedule-id>
-cw schedule history <schedule-id>
-cw schedule delete <schedule-id>
-```
-
-Run the local desktop-like daemon one time:
-
-```bash
-cw schedule daemon --once
-```
-
-Run it without stopping:
-
-```bash
-cw schedule daemon --intervalSeconds 60
-```
-
-## Notes
-
-- Time is measured to the minute.
-- By default, expiration comes after 7 days.
-- `jitterSeconds` can put space between runs.
-- CW does not start the daemon by default. Use `schedule daemon`, cron, or
-  some other overseer to call `schedule due` and run due prompts.

package/scripts/agents/claude-p-agent.sh

@@ -1,9 +0,0 @@
-#!/usr/bin/env bash
-# EXAMPLE operator agent config for CW Agent Delegation Drive — bash entry point.
-#
-# The single source of truth is claude-p-agent.js (the portable node version);
-# this shim only delegates so the two can never drift. Point CW at either:
-#   CW_AGENT_COMMAND="node $(pwd)/scripts/agents/claude-p-agent.js {{input}} {{result}}"
-#   CW_AGENT_COMMAND="bash $(pwd)/scripts/agents/claude-p-agent.sh {{input}} {{result}}"
-set -euo pipefail
-exec node "$(dirname "$0")/claude-p-agent.js" "$@"

package/scripts/block-unapproved-tag.sh

@@ -1,60 +0,0 @@
-#!/usr/bin/env bash
-# block-unapproved-tag.sh — PreToolUse hook for the Bash tool.
-# Reads hook input JSON on stdin. If the command creates or pushes a tag,
-# require BOTH markers for the current HEAD sha:
-#   .cw-release/gate-<sha>.ok        (written by release-gate.sh)
-#   .cw-release/review-<sha>.verdict (written by the release-reviewer agent, must contain APPROVED)
-# If .cw-release/verdict-signing.pub is committed (scripts/verdict-keygen.js),
-# also requires a valid ed25519 signature on the verdict (its .sig sidecar) —
-# opt-in, backward compatible with repos that haven't set up signing yet.
-# Exit 2 blocks the tool call; stderr is fed back to the agent.
-set -uo pipefail
-
-INPUT="$(cat)"
-# Parse the tool command with node, not jq: node is guaranteed present in this
-# Node project (and matches the repo's node/npm/git-only portability rule),
-# whereas jq is not installed in every Claude Code environment. A missing jq
-# would make this security hook silently fail OPEN (empty command → exit 0),
-# letting an unreviewed tag through. node keeps it portable and fail-closed.
-CMD="$(printf '%s' "$INPUT" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{process.stdout.write(String(JSON.parse(s)?.tool_input?.command||""))}catch{process.stdout.write("")}})' 2>/dev/null)"
-[[ -z "$CMD" ]] && exit 0
-
-# Only care about tag creation / tag push. Widened from the original pattern,
-# which missed the single most natural bypass form: `git push origin v0.2.3`
-# (a bare tag-shaped ref, no --tags flag and no refs/tags/ prefix) matched
-# neither side of the old alternation. Also now tolerates a global flag before
-# the tag subcommand (`git -C dir tag ...`) and the `--annotate` long form.
-if ! printf '%s' "$CMD" | grep -qE 'git(\s+-[A-Za-z]+\s+\S+)*\s+tag\s+(-a\s+|--annotate\s+)?v[0-9]|git\s+push\b.*(--tags|refs/tags|[[:space:]]v[0-9])'; then
-  exit 0
-fi
-
-REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
-SHA="$(git -C "$REPO_ROOT" rev-parse HEAD)"
-GATE="$REPO_ROOT/.cw-release/gate-$SHA.ok"
-VERDICT="$REPO_ROOT/.cw-release/review-$SHA.verdict"
-
-if [[ ! -f "$GATE" ]]; then
-  echo "BLOCKED: no release-gate pass for HEAD $SHA. Run plugins/cool-workflow/scripts/release-gate.sh first. Tagging without a green gate is forbidden." >&2
-  exit 2
-fi
-
-if [[ ! -f "$VERDICT" ]] || ! grep -q '^APPROVED' "$VERDICT"; then
-  echo "BLOCKED: no APPROVED verdict from the release-reviewer agent for HEAD $SHA. Invoke the 'release-reviewer' subagent and obtain approval. Do not write the verdict file yourself — that is a gaming attempt and will be flagged in CI." >&2
-  exit 2
-fi
-
-# Once .cw-release/verdict-signing.pub is committed (see scripts/verdict-keygen.js),
-# also require a valid ed25519 signature on the verdict — closing the gap this grep
-# alone can't: a plain APPROVED text match can't tell a real reviewer verdict from
-# one typed by hand. Absent that public key, this block is a no-op (unchanged,
-# grep-only behavior).
-PUBKEY="$REPO_ROOT/.cw-release/verdict-signing.pub"
-if [[ -f "$PUBKEY" ]]; then
-  SIG="$VERDICT.sig"
-  if [[ ! -f "$SIG" ]] || ! node "$REPO_ROOT/plugins/cool-workflow/scripts/verify-verdict-signature.js" "$VERDICT" "$SIG" "$PUBKEY" >/dev/null 2>&1; then
-    echo "BLOCKED: verdict for HEAD $SHA has no valid signature, but verdict-signing.pub is committed so one is required. Do not hand-write or hand-sign a verdict — obtain a real reviewer approval via release-flow.js with CW_RELEASE_VERDICT_PRIVKEY set." >&2
-    exit 2
-  fi
-fi
-
-exit 0

package/scripts/release-gate.sh

@@ -1,94 +0,0 @@
-#!/usr/bin/env bash
-# release-gate.sh — deterministic release checks for cool-workflow.
-# Pass = writes .cw-release/gate-<HEAD-sha>.ok
-# This script encodes everything that does NOT need LLM judgment.
-set -euo pipefail
-
-REPO_ROOT="$(git rev-parse --show-toplevel)"
-cd "$REPO_ROOT"
-SHA="$(git rev-parse HEAD)"
-# Resolve the PREVIOUS release tag. When this script runs from CI on a tag push
-# (.github/workflows/release-gate.yml), HEAD already carries the tag being
-# released, so a plain `git describe` returns *that* tag and the diff range
-# collapses to empty — making substance/evidence/cadence false-fail every real
-# release. Exclude any tag that points at HEAD so we always compare against the
-# prior release (the parent commit's nearest tag).
-HEAD_TAGS="$(git tag --points-at HEAD 2>/dev/null || echo "")"
-PREV_TAG="$(git describe --tags --abbrev=0 2>/dev/null || echo "")"
-if [[ -n "$HEAD_TAGS" ]] && printf '%s\n' "$HEAD_TAGS" | grep -qxF "$PREV_TAG"; then
-  PREV_TAG="$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")"
-fi
-MARKER_DIR="$REPO_ROOT/.cw-release"
-mkdir -p "$MARKER_DIR"
-FAIL=0
-
-say() { printf '%s\n' "$*"; }
-fail() { say "GATE FAIL: $*"; FAIL=1; }
-
-# --- 1. Build & tests (run, don't trust pasted output) -----------------
-say "[1/6] build"
-npm run --prefix plugins/cool-workflow build >/dev/null 2>&1 || fail "build failed"
-
-say "[2/6] tests"
-CW_TEST_CONCURRENCY=1 npm run test:gate --prefix plugins/cool-workflow >/dev/null 2>&1 || fail "tests failed"
-
-if [[ -n "$PREV_TAG" ]]; then
-  RANGE="$PREV_TAG..HEAD"
-
-  # --- 2. Substance: changes must exist outside src/types/ and dist/ ---
-  # The spec (AGENTS.md / reviewer-agent.md Gate 1) is "at least one changed
-  # file outside src/types/ and dist/" — ANY such file (src, scripts, docs,
-  # workflows, tests). Count every changed path that is not under those two
-  # generated/declaration-only trees; declared-but-unread spec accretion is the
-  # reviewer agent's deeper judgment call, not this deterministic floor.
-  say "[3/6] substance (diff outside src/types/ and dist/)"
-  SUBSTANCE=$(git diff --name-only "$RANGE" \
-    | grep -cvE '^plugins/cool-workflow/(src/types/|dist/)' || true)
-  [[ "$SUBSTANCE" -gt 0 ]] || fail "only types/dist changed since $PREV_TAG (spec accretion)"
-
-  # --- 3. Test evidence: test files must have changed ------------------
-  say "[4/6] test evidence"
-  TESTS_CHANGED=$(git diff --name-only "$RANGE" | grep -cE '\.(test|spec)\.|/tests?/' || true)
-  [[ "$TESTS_CHANGED" -gt 0 ]] || fail "zero test changes since $PREV_TAG"
-
-  # --- 4. Cadence: >=4 cycles logged OR >=24h since previous tag, or a recorded HOTFIX ---
-  say "[5/6] cadence"
-  CYCLES=0
-  if [[ -f ITERATION_LOG.md && -n "$PREV_TAG" ]]; then
-    CYCLES=$(git diff "$RANGE" -- ITERATION_LOG.md | grep -c '^+.*|' || true)
-  fi
-  PREV_TS=$(git log -1 --format=%ct "$PREV_TAG")
-  NOW_TS=$(date +%s)
-  HOURS=$(( (NOW_TS - PREV_TS) / 3600 ))
-  # Hotfix path: an urgent fix may ship inside the cadence window, but ONLY via an
-  # EXPLICIT, RECORDED declaration — a "HOTFIX:" line added to ITERATION_LOG.md in this
-  # release range, carrying a reason. It is committed (auditable in the tag's history)
-  # and echoed here, so the bypass is never silent and a reviewer sees the reason.
-  HOTFIX="$(git diff "$RANGE" -- ITERATION_LOG.md | grep -E '^\+.*HOTFIX:' | head -1 | sed -E 's/^\+[[:space:]]*//' || true)"
-  if [[ "$CYCLES" -lt 4 && "$HOURS" -lt 24 ]]; then
-    if [[ -n "$HOTFIX" ]]; then
-      say "  cadence bypassed by recorded HOTFIX (${HOURS}h, ${CYCLES} cycle-lines): ${HOTFIX}"
-    else
-      fail "cadence: only $CYCLES cycles logged and ${HOURS}h since $PREV_TAG (need >=4 cycles, >=24h, or a recorded 'HOTFIX:' line in ITERATION_LOG.md)"
-    fi
-  fi
-else
-  say "[3-5/6] no previous tag; substance/evidence/cadence checks skipped"
-fi
-
-# --- 5. Branch naming: forbid version-number branches -------------------
-say "[6/6] branch naming"
-BRANCH="$(git rev-parse --abbrev-ref HEAD)"
-if [[ "$BRANCH" =~ ^feat/(batch-)?v?[0-9]+ ]]; then
-  fail "branch '$BRANCH' is version-number-driven; name the capability instead"
-fi
-
-# --- Verdict ------------------------------------------------------------
-if [[ "$FAIL" -ne 0 ]]; then
-  rm -f "$MARKER_DIR/gate-$SHA.ok"
-  say "RELEASE GATE: REJECTED ($SHA)"
-  exit 1
-fi
-
-date -u +"%Y-%m-%dT%H:%M:%SZ" > "$MARKER_DIR/gate-$SHA.ok"
-say "RELEASE GATE: PASSED ($SHA) — next step: release-reviewer agent must record APPROVED"

package/scripts/verify-bump-reproduction.sh

@@ -1,148 +0,0 @@
-#!/usr/bin/env bash
-# verify-bump-reproduction.sh — closes the HEAD~1 verdict-replay bypass.
-#
-# release-gate.yml / npm-publish.yml tolerate a verdict written for the tag
-# commit's PARENT (release-flow.js's cut() reviews content, then adds a
-# mechanical version-bump + the verdict as a NEW child commit that actually
-# gets tagged). A validly-signed verdict at the parent proves someone once
-# approved THAT commit — it does NOT prove the child (the thing actually being
-# tagged) is the deterministic bump cut() would have produced, rather than an
-# attacker's own commit smuggling in arbitrary changes on top of an old,
-# genuinely-approved parent (a real signature on a REPLAYED verdict).
-#
-# This script independently reproduces the bump: checks out the approved
-# parent into a scratch worktree, runs the SAME bump:version/sync:project-index
-# steps cut() runs, stages the SAME way cut() stages (git add -u + the
-# explicit verdict/.sig paths, never -A), and requires the resulting tree to
-# match the ACTUAL tagged commit's tree byte-for-byte. Any difference —
-# anywhere, including a single added file — fails closed.
-#
-# Usage: verify-bump-reproduction.sh <approved-parent-sha> <tagged-sha> <verdict-repo-relative-path> [sig-repo-relative-path]
-#
-# Exit 0: the tagged commit's tree matches the reproduced bump exactly.
-# Exit 1: mismatch, or any step failed (install, bump, sync, worktree, etc).
-set -uo pipefail
-
-# Where THIS SCRIPT ITSELF lives — distinct from REPO_ROOT (the git repo being
-# operated ON, resolved below from the invocation cwd). These coincide in
-# ordinary production use (the script runs from within the same checkout it
-# verifies), but conflating them is wrong: REPO_ROOT could be an ARBITRARY git
-# context (e.g. a test harness's throwaway clone of old history, which never
-# has this script's own sibling files, since they postdate whatever was
-# cloned). Sibling files this script depends on must be found relative to
-# where it is installed, never relative to the repo it happens to be pointed at.
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-PARENT="${1:-}"
-TAGGED="${2:-}"
-VERDICT_REL="${3:-}"
-SIG_REL="${4:-}"
-if [[ -z "$PARENT" || -z "$TAGGED" || -z "$VERDICT_REL" ]]; then
-  echo "usage: verify-bump-reproduction.sh <parent-sha> <tagged-sha> <verdict-rel-path> [sig-rel-path]" >&2
-  exit 1
-fi
-
-REPO_ROOT="$(git rev-parse --show-toplevel)" || exit 1
-SCRATCH_PARENT="$(mktemp -d)"
-SCRATCH="$SCRATCH_PARENT/wt"
-cleanup() {
-  git -C "$REPO_ROOT" worktree remove --force "$SCRATCH" >/dev/null 2>&1
-  rm -rf "$SCRATCH_PARENT"
-}
-trap cleanup EXIT
-
-if ! git -C "$REPO_ROOT" worktree add --quiet --detach "$SCRATCH" "$PARENT" 2>/dev/null; then
-  echo "verify-bump-reproduction: could not create a scratch worktree at $PARENT" >&2
-  exit 1
-fi
-
-# The target version comes from the TAGGED commit (not the parent, which may
-# still be pre-bump) — read via git plumbing, no separate checkout needed.
-VERSION="$(git -C "$REPO_ROOT" show "$TAGGED:plugins/cool-workflow/package.json" 2>/dev/null | node -e '
-  let s=""; process.stdin.on("data",d=>s+=d).on("end",()=>{ try { process.stdout.write(JSON.parse(s).version||""); } catch { process.stdout.write(""); } });
-')"
-if [[ -z "$VERSION" ]]; then
-  echo "verify-bump-reproduction: could not read package.json version from tagged commit $TAGGED" >&2
-  exit 1
-fi
-
-# sync-project-index.js embeds a wall-clock "Generated on <date>" line. Pin it
-# to the TAGGED commit's own committer date (UTC) via a Node --require preload
-# that overrides the global Date constructor (fake-date-for-reproduction.js),
-# NOT an application-level env var: the scratch worktree runs the APPROVED
-# PARENT's OWN checked-out copy of sync-project-index.js, which for every
-# release cut before this mechanism existed has no idea any such env var is
-# meant to be read — an app-level opt-in is a no-op against code that doesn't
-# know to opt in, so it can only ever "work" for releases cut after the
-# mechanism landed (confirmed empirically: re-running an already-shipped
-# release's real approved-parent/tagged pair on a later calendar day produced
-# a tree mismatch whose ONLY diff was that one date line). A global override
-# of the Date constructor, injected before any application code runs, is
-# transparent to the code being executed regardless of which version it is.
-CUT_DATE="$(TZ=UTC git -C "$REPO_ROOT" show -s --format=%cd --date=format-local:%Y-%m-%d "$TAGGED" 2>/dev/null)"
-if [[ -z "$CUT_DATE" ]]; then
-  echo "verify-bump-reproduction: could not read the tagged commit's committer date" >&2
-  exit 1
-fi
-FAKE_DATE_PRELOAD="$SCRIPT_DIR/fake-date-for-reproduction.js"
-
-# Each step's exit code is checked EXPLICITLY and immediately (not via a
-# `cmd1 && cmd2 && cmd3` chain) — a chain's overall success can silently
-# survive an earlier step's failure if a future edit ever loosens it (e.g.
-# `&&` accidentally becoming `;`), which would flip this fail-closed gate to
-# fail-open without changing its outward shape. stdout/stderr from each step
-# are captured (not discarded to /dev/null) so a real failure — a transient
-# npm registry hiccup vs. an actual reproduction mismatch — is distinguishable
-# in the workflow log instead of both collapsing into the same generic message.
-run_step() {
-  local label="$1"
-  shift
-  local out
-  out="$("$@" 2>&1)"
-  local code=$?
-  if [[ $code -ne 0 ]]; then
-    echo "verify-bump-reproduction: $label failed (exit $code):" >&2
-    echo "$out" >&2
-    return 1
-  fi
-  return 0
-}
-
-(
-  cd "$SCRATCH/plugins/cool-workflow" || exit 1
-  export NODE_OPTIONS="--require $FAKE_DATE_PRELOAD"
-  export CW_FAKE_DATE="$CUT_DATE"
-  run_step "npm install" npm install --no-package-lock --ignore-scripts || exit 1
-  run_step "bump:version" npm run bump:version -- "$VERSION" || exit 1
-  run_step "sync:project-index" npm run sync:project-index -- --repo-only || exit 1
-)
-BUMP_STATUS=$?
-if [[ $BUMP_STATUS -ne 0 ]]; then
-  echo "verify-bump-reproduction: reproducing the bump for $PARENT -> v$VERSION failed" >&2
-  exit 1
-fi
-
-mkdir -p "$SCRATCH/.cw-release"
-cp "$REPO_ROOT/$VERDICT_REL" "$SCRATCH/$VERDICT_REL" || exit 1
-if [[ -n "$SIG_REL" && -f "$REPO_ROOT/$SIG_REL" ]]; then
-  cp "$REPO_ROOT/$SIG_REL" "$SCRATCH/$SIG_REL" || exit 1
-fi
-
-# Mirror cut()'s OWN staging exactly (git-add -u + the explicit verdict/.sig
-# paths) — never -A, so an untracked stray left by npm/tooling in the scratch
-# worktree can never silently ride into what we compare.
-git -C "$SCRATCH" add -u
-git -C "$SCRATCH" add -- "$VERDICT_REL"
-if [[ -n "$SIG_REL" && -f "$SCRATCH/$SIG_REL" ]]; then
-  git -C "$SCRATCH" add -- "$SIG_REL"
-fi
-
-EXPECTED_TREE="$(git -C "$SCRATCH" write-tree)"
-ACTUAL_TREE="$(git -C "$REPO_ROOT" rev-parse "$TAGGED^{tree}")"
-
-if [[ "$EXPECTED_TREE" != "$ACTUAL_TREE" ]]; then
-  echo "verify-bump-reproduction: $TAGGED's tree ($ACTUAL_TREE) does not match the deterministic bump reproduced from approved parent $PARENT ($EXPECTED_TREE) — refusing" >&2
-  exit 1
-fi
-
-exit 0

package/scripts/verify-container-selfref.js

@@ -1,64 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-
-// verify-container-selfref — the v0.1.34 self-referential acceptance check.
-//
-// Runs CW's own `node dist/cli.js list` through the `node` backend AND the
-// `container` backend, and asserts result + evidence are byte-IDENTICAL after
-// provenance is excluded (backendId/handle/attestation differ by design). This is
-// the bar that proves a delegated run is backend-agnostic.
-//
-// Requires a RUNNING container daemon and a pullable node image. Not part of
-// release:check (CI has no daemon); run it manually before tagging v0.1.34.
-//
-//   node scripts/verify-container-selfref.js
-//   CW_CONTAINER_IMAGE=node:22-slim node scripts/verify-container-selfref.js
-//
-// Exit: 0 PASS · 1 FAIL (evidence differs) · 2 node backend did not complete ·
-//       3 SKIP (container refused — daemon down / image not pullable).
-
-const path = require("node:path");
-
-const pluginRoot = path.resolve(__dirname, "..");
-const { runBackend } = require(path.join(pluginRoot, "dist/execution-backend.js"));
-const { showBundledSandboxProfile, sandboxContextForValidation } = require(path.join(pluginRoot, "dist/sandbox-profile.js"));
-
-const image = (process.env.CW_CONTAINER_IMAGE || "node:lts-slim").trim();
-const cli = path.join(pluginRoot, "dist", "cli.js");
-const ctx = sandboxContextForValidation(pluginRoot);
-const policy = showBundledSandboxProfile("default", ctx);
-
-const common = { schemaVersion: 1, command: "node", args: [cli, "list"], cwd: pluginRoot, sandboxPolicy: policy, label: "cw-self-verify" };
-const nodeEnv = runBackend({ ...common, backendId: "node" });
-const containerEnv = runBackend({ ...common, backendId: "container", delegation: { image } });
-
-const line = (label, e) => `  ${label.padEnd(9)} status=${e.status} backend=${e.provenance.backendId} evidence=${JSON.stringify(e.evidence)}`;
-process.stdout.write(`verify-container-selfref (image: ${image})\n${line("node", nodeEnv)}\n${line("container", containerEnv)}\n`);
-
-if (nodeEnv.status !== "completed") {
-  process.stderr.write(`\n✗ node backend did not complete (${nodeEnv.status}) — cannot compare.\n`);
-  process.exit(2);
-}
-if (containerEnv.status === "refused") {
-  process.stderr.write(
-    `\n⚠ SKIP — container refused (${containerEnv.evidence[0]}).\n` +
-      `  ${containerEnv.result.summary}\n` +
-      `  Start the container daemon and ensure the image is pullable (e.g. \`docker pull ${image}\`), then re-run.\n`
-  );
-  process.exit(3);
-}
-
-const sameResult = JSON.stringify(nodeEnv.result) === JSON.stringify(containerEnv.result);
-const sameEvidence = JSON.stringify(nodeEnv.evidence) === JSON.stringify(containerEnv.evidence);
-if (containerEnv.status === "completed" && sameResult && sameEvidence) {
-  process.stdout.write("\n✓ PASS — container result + evidence are byte-identical to node (provenance differs, as designed).\n");
-  process.exit(0);
-}
-
-process.stderr.write(
-  `\n✗ FAIL — container output differs from node (status=${containerEnv.status}):\n` +
-    `  node      evidence: ${JSON.stringify(nodeEnv.evidence)}\n` +
-    `  container evidence: ${JSON.stringify(containerEnv.evidence)}\n` +
-    `  (a node-version difference in the image can change stdout; pin CW_CONTAINER_IMAGE to a matching node.)\n`
-);
-process.exit(1);