cool-workflow 0.2.3 → 0.2.5

package/dist/shell/drive.js

@@ -630,7 +630,7 @@ function maybeExpandLoop(run) {
                     requiresEvidence: t.requiresEvidence,
                     sandboxProfileId: t.sandboxProfileId,
                 },
-            }, { persist: false, persistNode: (r, node) => void (0, node_store_1.appendRunNode)(r, node) });
+            }, { persist: false, persistNode: (r, node) => void (0, node_store_1.appendRunNode)(r, node), pathExists: fs.existsSync });
             t.stateNodeId = result.outputNodeId;
         }
         (0, dispatch_1.updatePhaseStatuses)(run);
@@ -656,17 +656,32 @@ function driveStep(ctx) {
     return processSelectedTask(ctx, selected.id);
 }
 /** Dispatch every batch task (sequential — dispatch mutates state), then
- *  collect ALL spawn-style agent child outcomes in one concurrent window
- *  (one batch delegate child process, per-job timeout kill). Returns
- *  outcomes keyed by task id; a cache-hit or endpoint-configured agent
- *  gets no prepared outcome and settles through the serial accept path
- *  inside processSelectedTask. Dispatch failures become recorded fail
- *  steps up front, exactly what the serial path would emit. Byte-exact
- *  to the old build's src/drive.ts's prepareConcurrentOutcomes. */
+ *  collect ALL agent child outcomes in one concurrent window: spawn-style
+ *  (CLI-binary) agents through the batch delegate child, and endpoint-mode
+ *  agents through the HTTP batch delegate child — so `--concurrency N` runs N
+ *  endpoint delegations in parallel instead of one-at-a-time on the serial
+ *  path. Returns outcomes keyed by task id; a cache-hit, endpoint-configured
+ *  agent, or sub-workflow task gets no prepared outcome and settles through
+ *  the serial accept path inside processSelectedTask (a sub-workflow task is
+ *  never spawn-eligible in the first place — processSelectedTask always
+ *  takes its own runSubWorkflow branch for it, so building a spawn job here
+ *  would only be spawned and thrown away unused). Dispatch failures become
+ *  recorded fail steps up front, exactly what the serial path would emit. */
 function prepareConcurrentOutcomes(ctx, batch) {
     const failSteps = new Map();
     const jobs = [];
     const jobTaskIds = [];
+    const endpointJobs = [];
+    const endpointTaskIds = [];
+    // Set whenever a task's status flips pending -> running (workerId
+    // assigned) this round, regardless of whether it later becomes a real
+    // spawn job, an endpoint job, a cache hit, or a sub-workflow task. That
+    // dispatch is a real state mutation on the round-cached run object that
+    // nothing has written to disk yet — the pre-spawn checkpoint below must
+    // flush it even when the batch produces zero spawn/endpoint jobs (e.g. an
+    // all-sub-workflow batch), or a crash before the round-end flush loses
+    // the dispatch.
+    let dispatchedThisRound = false;
     for (const taskId of batch) {
         const run = loadRun(ctx);
         const task = run.tasks.find((candidate) => candidate.id === taskId);
@@ -681,6 +696,7 @@ function prepareConcurrentOutcomes(ctx, batch) {
                 continue;
             }
             workerId = dispatchedTask.workerId;
+            dispatchedThisRound = true;
         }
         if (!workerId) {
             failSteps.set(taskId, (0, drive_decide_1.makeStep)("dispatch", "failed", { runId: ctx.runId, taskId, phase: task.phase, reason: "no worker scope for task" }));
@@ -694,7 +710,15 @@ function prepareConcurrentOutcomes(ctx, batch) {
         const cachePath = resultCachePath(freshRun, task, (0, hash_1.sha256)(task.prompt || ""), ctx.incremental, delegationDigest);
         if (cachePath && fs.existsSync(cachePath))
             continue;
-        const job = (0, agent_1.prepareAgentSpawn)({
+        // A sub-workflow task never goes through the spawn path — processSelectedTask
+        // checks task.subWorkflow before it ever looks at a prepared spawn outcome
+        // and always takes its own runSubWorkflow branch instead (mirrors that
+        // check byte-for-byte). Building a spawn OR endpoint job for it here would
+        // just be a real agent child spawned/delegated and thrown away unused.
+        const subWorkflow = task.subWorkflow;
+        if (subWorkflow)
+            continue;
+        const request = {
             schemaVersion: 1,
             runId: ctx.runId,
             taskId: task.id,
@@ -705,7 +729,8 @@ function prepareConcurrentOutcomes(ctx, batch) {
             label: task.id,
             timeoutMs: ctx.config.timeoutMs,
             delegation: { command: ctx.config.command, args: ctx.config.args, endpoint: ctx.config.endpoint, model: task.model || ctx.config.model },
-        });
+        };
+        const job = (0, agent_1.prepareAgentSpawn)(request);
         if (job) {
             const sandboxPolicy = manifest.sandboxPolicy;
             if (sandboxPolicy) {
@@ -713,24 +738,53 @@ function prepareConcurrentOutcomes(ctx, batch) {
             }
             jobs.push(job);
             jobTaskIds.push(taskId);
+            continue;
+        }
+        // Endpoint-configured agent: no CLI binary to batch-spawn, but its HTTP
+        // delegation joins the concurrent window through the endpoint batch child
+        // (runEndpointBatchOutcomes) rather than settling one-at-a-time on the
+        // serial path. An unconfigured agent (neither command nor endpoint) returns
+        // undefined from both prepares here and falls to the serial refusal.
+        const endpointJob = (0, agent_1.prepareEndpointJob)(request);
+        if (endpointJob) {
+            endpointJobs.push(endpointJob);
+            endpointTaskIds.push(taskId);
         }
     }
-    if (jobs.length) {
-        emitProgress(`⇉ concurrent round: ${jobs.length} agent${jobs.length > 1 ? "s" : ""} spawning in parallel, may take minutes…`);
+    const totalJobs = jobs.length + endpointJobs.length;
+    if (totalJobs) {
+        emitProgress(`⇉ concurrent round: ${totalJobs} agent${totalJobs > 1 ? "s" : ""} spawning in parallel, may take minutes…`);
+    }
+    if (totalJobs || dispatchedThisRound) {
+        // Every task above that reached "pending" got dispatched (workerId
+        // assigned) in the round-cached run object, but nothing durable was
+        // written for it — unlike the serial path's own dispatch branch, which
+        // always checkpoints immediately. Flush now, BEFORE the batch's long
+        // settle window opens: a crash mid-spawn OR mid-sub-workflow-recursion
+        // (both can run for minutes) then leaves state.json correctly showing
+        // these tasks as dispatched, instead of losing the dispatch entirely.
+        // Gated on dispatchedThisRound (not just totalJobs) so a batch made
+        // entirely of sub-workflow and/or cache-hit tasks — which builds zero
+        // spawn/endpoint jobs — still gets this flush before its long-running
+        // settle loop starts.
+        (0, run_store_1.saveCheckpoint)(loadRun(ctx));
     }
-    const settled = (0, agent_1.runAgentBatchOutcomes)(jobs);
     const outcomes = new Map();
+    const settled = (0, agent_1.runAgentBatchOutcomes)(jobs);
     jobTaskIds.forEach((taskId, index) => outcomes.set(taskId, settled[index]));
+    const endpointSettled = (0, agent_1.runEndpointBatchOutcomes)(endpointJobs);
+    endpointTaskIds.forEach((taskId, index) => outcomes.set(taskId, endpointSettled[index]));
     return { outcomes, failSteps };
 }
 /** One concurrent round inside one cached in-memory run: dispatches every
  *  batch task, spawns all spawn-style agent children in one concurrent
- *  window, then settles + accepts in DETERMINISTIC batch (task-id) order
- *  regardless of wall-clock finish order. At round end it flushes once:
- *  commitState(run, "concurrent-round:<n>-tasks") + writeReport +
- *  saveCheckpoint. Cache-hit tasks and endpoint-only agents get no
- *  prepared outcome and settle through the serial path (still inside
- *  this one deferred-persist round). If no step was produced (nothing
+ *  window (CLI-binary agents through the batch child, endpoint agents
+ *  through the HTTP batch child), then settles + accepts in DETERMINISTIC
+ *  batch (task-id) order regardless of wall-clock finish order. At round end
+ *  it flushes once: commitState(run, "concurrent-round:<n>-tasks") +
+ *  writeReport + saveCheckpoint. Cache-hit tasks get no prepared outcome and
+ *  settle through the serial path (still inside this one deferred-persist
+ *  round). If no step was produced (nothing
  *  runnable at round entry — terminal/blocked/token-budget gate) the
  *  round degrades to one plain driveStep. Byte-exact to the old build's
  *  src/drive.ts's driveConcurrentRound. */
@@ -896,14 +950,14 @@ function driveOneRound(ctx, options, steps, emitPhaseProgress) {
  *  finishes its own bookkeeping first. A SECOND signal means the caller
  *  wants out right now, not a graceful stop, and force-exits immediately
  *  with the conventional 128+signum code. */
-function createStopSignalController() {
+function createStopSignalController(runId) {
     let interruptedBy;
     let stopSignalHits = 0;
     const onStopSignal = (signal) => {
         stopSignalHits += 1;
         if (stopSignalHits === 1) {
             interruptedBy = signal;
-            emitProgress(`received ${signal} — stopping after the current step (run again with the same run id to resume)`);
+            emitProgress(`received ${signal} — stopping after the current step (resume: cw run resume ${runId} --drive)`);
             return;
         }
         // A second signal means the caller wants out right now, not a graceful stop.
@@ -952,11 +1006,11 @@ function finalizeDriveResult(ctx, options, steps, plannedWorkers, maxIter, exhau
     if (interruptedBy) {
         exhaustedMaxIterations = false;
         if (!alreadyComplete) {
-            steps.push((0, drive_decide_1.makeStep)("blocked", "blocked", { runId: ctx.runId, reason: `drive interrupted by ${interruptedBy} — run again with the same run id to resume` }));
+            steps.push((0, drive_decide_1.makeStep)("blocked", "blocked", { runId: ctx.runId, reason: `drive interrupted by ${interruptedBy} — resume: cw run resume ${ctx.runId} --drive` }));
         }
     }
     else if (exhaustedMaxIterations) {
-        steps.push((0, drive_decide_1.makeStep)("blocked", "blocked", { runId: ctx.runId, reason: `drive reached max iteration limit (${maxIter}) before a terminal state` }));
+        steps.push((0, drive_decide_1.makeStep)("blocked", "blocked", { runId: ctx.runId, reason: `drive reached max iteration limit (${maxIter}) before a terminal state — resume: cw run resume ${ctx.runId} --drive` }));
     }
     const statusInputs = {
         once: Boolean(options.once),
@@ -996,28 +1050,35 @@ function finalizeDriveResult(ctx, options, steps, plannedWorkers, maxIter, exhau
  *  exact synchronous shape) and fixed only in driveAsync(). */
 function drive(runId, cwd, options = {}) {
     const ctx = buildDriveContext(runId, cwd, options);
-    const steps = [];
-    const run0 = loadRun(ctx);
-    const plannedWorkers = run0.tasks.length;
-    const maxIter = (0, drive_decide_1.maxIterations)(plannedWorkers, (0, loop_expansion_1.maxLoopExpansion)(run0), ctx.policy);
-    const emitPhaseProgress = createPhaseProgressEmitter();
-    let exhaustedMaxIterations = !options.once;
-    const stopSignal = createStopSignalController();
-    stopSignal.install();
-    try {
-        for (let i = 0; i < maxIter; i++) {
-            if (stopSignal.getInterruptedBy())
-                break;
-            if (!driveOneRound(ctx, options, steps, emitPhaseProgress)) {
-                exhaustedMaxIterations = false;
-                break;
+    // Resolve the run dir before the mutex: a missing run throws "Run not found"
+    // here (never a drive.lock side effect on a nonexistent run), via a stat only
+    // so the per-round read accounting is unchanged. Mirrors withRunStateLock's
+    // own probe-before-lock.
+    const runDir = (0, run_store_1.resolveRunDir)(runId, cwd);
+    return (0, run_store_1.withDriveLock)(runDir, runId, () => {
+        const steps = [];
+        const run0 = loadRun(ctx);
+        const plannedWorkers = run0.tasks.length;
+        const maxIter = (0, drive_decide_1.maxIterations)(plannedWorkers, (0, loop_expansion_1.maxLoopExpansion)(run0), ctx.policy);
+        const emitPhaseProgress = createPhaseProgressEmitter();
+        let exhaustedMaxIterations = !options.once;
+        const stopSignal = createStopSignalController(runId);
+        stopSignal.install();
+        try {
+            for (let i = 0; i < maxIter; i++) {
+                if (stopSignal.getInterruptedBy())
+                    break;
+                if (!driveOneRound(ctx, options, steps, emitPhaseProgress)) {
+                    exhaustedMaxIterations = false;
+                    break;
+                }
             }
         }
-    }
-    finally {
-        stopSignal.remove();
-    }
-    return finalizeDriveResult(ctx, options, steps, plannedWorkers, maxIter, exhaustedMaxIterations, stopSignal.getInterruptedBy());
+        finally {
+            stopSignal.remove();
+        }
+        return finalizeDriveResult(ctx, options, steps, plannedWorkers, maxIter, exhaustedMaxIterations, stopSignal.getInterruptedBy());
+    });
 }
 /** Same contract and same DriveResult as drive() -- but actually
  *  interruptible. After every round it awaits yieldToEventLoop(), a real
@@ -1045,29 +1106,33 @@ function drive(runId, cwd, options = {}) {
  *  future cycle if it proves needed in practice. */
 async function driveAsync(runId, cwd, options = {}) {
     const ctx = buildDriveContext(runId, cwd, options);
-    const steps = [];
-    const run0 = loadRun(ctx);
-    const plannedWorkers = run0.tasks.length;
-    const maxIter = (0, drive_decide_1.maxIterations)(plannedWorkers, (0, loop_expansion_1.maxLoopExpansion)(run0), ctx.policy);
-    const emitPhaseProgress = createPhaseProgressEmitter();
-    let exhaustedMaxIterations = !options.once;
-    const stopSignal = createStopSignalController();
-    stopSignal.install();
-    try {
-        for (let i = 0; i < maxIter; i++) {
-            if (stopSignal.getInterruptedBy())
-                break;
-            if (!driveOneRound(ctx, options, steps, emitPhaseProgress)) {
-                exhaustedMaxIterations = false;
-                break;
+    // Resolve the run dir before the mutex — see drive() above.
+    const runDir = (0, run_store_1.resolveRunDir)(runId, cwd);
+    return (0, run_store_1.withDriveLockAsync)(runDir, runId, async () => {
+        const steps = [];
+        const run0 = loadRun(ctx);
+        const plannedWorkers = run0.tasks.length;
+        const maxIter = (0, drive_decide_1.maxIterations)(plannedWorkers, (0, loop_expansion_1.maxLoopExpansion)(run0), ctx.policy);
+        const emitPhaseProgress = createPhaseProgressEmitter();
+        let exhaustedMaxIterations = !options.once;
+        const stopSignal = createStopSignalController(runId);
+        stopSignal.install();
+        try {
+            for (let i = 0; i < maxIter; i++) {
+                if (stopSignal.getInterruptedBy())
+                    break;
+                if (!driveOneRound(ctx, options, steps, emitPhaseProgress)) {
+                    exhaustedMaxIterations = false;
+                    break;
+                }
+                await yieldToEventLoop();
             }
-            await yieldToEventLoop();
         }
-    }
-    finally {
-        stopSignal.remove();
-    }
-    return finalizeDriveResult(ctx, options, steps, plannedWorkers, maxIter, exhaustedMaxIterations, stopSignal.getInterruptedBy());
+        finally {
+            stopSignal.remove();
+        }
+        return finalizeDriveResult(ctx, options, steps, plannedWorkers, maxIter, exhaustedMaxIterations, stopSignal.getInterruptedBy());
+    });
 }
 function drivePreview(runId, cwd, args = {}) {
     const run = (0, run_store_1.loadRunFromCwd)(runId, cwd);

package/dist/shell/error-feedback-io.js

@@ -290,6 +290,12 @@ function resolveFeedback(run, feedbackId, result) {
 function runPipelineStage(run, stageId, inputNodeId, options = {}, runnerOptions = {}) {
     return (0, runner_1.runPipelineStage)(run, stageId, inputNodeId, options, {
         ...runnerOptions,
+        // The core gate's `pathExists` defaults to `() => true` (a pure core/
+        // module never reads the filesystem). This is the shell seam, so default
+        // it to the real `fs.existsSync` — that is what makes the contract's
+        // `requireReadablePaths` / `missing-artifact-path` gate live. A caller may
+        // still override it (e.g. a replay against a captured path set).
+        pathExists: runnerOptions.pathExists || fs.existsSync,
         // Keep the caller-named failure node id (the old build honored outputNodeId
         // for the preserved failure node); the raw core auto-mints when unset.
         failureNodeId: runnerOptions.failureNodeId || options.outputNodeId,

package/dist/shell/execution-backend/agent.js

@@ -5,7 +5,10 @@
 // MILESTONE 5 (docs/rebuild/PLAN.md build order, step 5). Byte-exact port of
 // plugins/cool-workflow/src/execution-backend/agent.ts. This module holds
 // the PURE data-transform helpers (invocation resolution, arg substitution,
-// secret redaction, report parsing) plus the batch delegate-child spawn.
+// secret redaction, report parsing) plus the batch delegate-child spawn — both
+// the CLI-binary batch (runAgentBatchOutcomes) and, added later, its
+// HTTP-endpoint sibling (runEndpointBatchOutcomes) so `--concurrency N` gives
+// endpoint-mode agents real concurrency instead of a serial per-task spawn.
 //
 // THE RED LINE: CW spawns the agent and records its attested output. It
 // NEVER imports a model SDK, holds an API key, or constructs a model API
@@ -49,6 +52,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.reapRecordedVendor = reapRecordedVendor;
 exports.buildAgentChildEnv = buildAgentChildEnv;
 exports.resolveAgentInvocation = resolveAgentInvocation;
 exports.stripSecretArgs = stripSecretArgs;
@@ -59,12 +63,15 @@ exports.recordedAgentHandle = recordedAgentHandle;
 exports.extractEndpointResult = extractEndpointResult;
 exports.agentHandle = agentHandle;
 exports.prepareAgentSpawn = prepareAgentSpawn;
+exports.prepareEndpointJob = prepareEndpointJob;
 exports.reconcileBatchOutcomes = reconcileBatchOutcomes;
 exports.runAgentBatchOutcomes = runAgentBatchOutcomes;
+exports.runEndpointBatchOutcomes = runEndpointBatchOutcomes;
 exports.shouldStreamAgentStderr = shouldStreamAgentStderr;
 exports.runAgentProcess = runAgentProcess;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
 const node_child_process_1 = require("node:child_process");
 const local_1 = require("./local");
 const envelopes_1 = require("./envelopes");
@@ -85,16 +92,73 @@ const AGENT_PROVIDER_KEY_ENV_RE = /^(CW_|ANTHROPIC_|OPENAI_|GEMINI_|DEEPSEEK_|CO
  *  call it, so the allowlist cannot drift into a second silent copy again.
  *  Returns the forwarded var NAMES too (never values) for the
  *  worker.agent-env trust-audit event. */
+/** A unique sidecar path a shipped wrapper writes its vendor child's PID to
+ *  (via the env CW_AGENT_VENDOR_PIDFILE we set below), so cw can reap the
+ *  vendor if it has to SIGKILL the wrapper on a timeout. */
+function vendorPidFilePath() {
+    return path.join(os.tmpdir(), `cw-agent-vendor-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.pid`);
+}
+/** Reap the vendor process a shipped wrapper recorded, then remove the sidecar.
+ *  A wrapper that exited cleanly already removed the file, so this is a no-op
+ *  then; only a wrapper cw SIGKILLed on a timeout leaves a live vendor PID
+ *  here. Best-effort and race-tolerant: a missing file, an unparseable/too-low
+ *  PID, or an already-gone process are all silently fine. Scope: kills the
+ *  vendor process itself (the token spender), not a deeper grandchild tree,
+ *  and only for the shipped vendor wrappers (claude, codex, gemini, and
+ *  opencode/deepseek) -- an arbitrary CW_AGENT_COMMAND records no PID and is
+ *  not covered. Returns true only if it
+ *  actually signalled a process. Exported for tests; agent.ts is not part of
+ *  the package public surface (index.ts). */
+function reapRecordedVendor(pidFile) {
+    let raw;
+    try {
+        raw = fs.readFileSync(pidFile, "utf8");
+    }
+    catch {
+        return false; // no sidecar => the wrapper cleaned up (or never recorded one)
+    }
+    try {
+        fs.unlinkSync(pidFile);
+    }
+    catch { /* already gone */ }
+    const pid = Number(raw.trim());
+    if (!Number.isInteger(pid) || pid <= 1)
+        return false;
+    try {
+        process.kill(pid, "SIGKILL");
+        return true;
+    }
+    catch {
+        return false; // already exited, or a pid we may not signal
+    }
+}
 function buildAgentChildEnv(policy, baseEnv = process.env) {
     const env = (0, local_1.buildChildEnv)(policy, baseEnv);
+    // deny must win here too: buildChildEnv already applied it above, but the
+    // provider-key/USER re-add below exists specifically to put vars BACK
+    // that buildChildEnv's readonly/locked-down defaults strip — without this
+    // check that re-add silently overrode an operator's explicit deny (e.g.
+    // deny:["AWS_SECRET_ACCESS_KEY"] still forwarded it, since AWS_ matches
+    // AGENT_PROVIDER_KEY_ENV_RE).
+    const denied = new Set(policy.env.deny || []);
     const forwarded = [];
     for (const key of Object.keys(baseEnv)) {
+        if (denied.has(key))
+            continue;
+        // Parent-only CW secrets are never re-added, even though they match the
+        // CW_ arm of AGENT_PROVIDER_KEY_ENV_RE and even if the operator forgot to
+        // deny them. buildChildEnv already stripped them above; this keeps the
+        // re-add loop from putting them back (and out of the trust-audit
+        // `forwarded` list). CW_AGENT_ATTEST_PRIVKEY is intentionally NOT in that
+        // set, so the attest wrapper still gets its signing key.
+        if (local_1.CW_NEVER_FORWARD_ENV.has(key))
+            continue;
         if (AGENT_PROVIDER_KEY_ENV_RE.test(key)) {
             env[key] = baseEnv[key];
             forwarded.push(key);
         }
     }
-    if (baseEnv.USER !== undefined && env.USER === undefined) {
+    if (!denied.has("USER") && baseEnv.USER !== undefined && env.USER === undefined) {
         env.USER = baseEnv.USER;
         forwarded.push("USER");
     }
@@ -288,9 +352,9 @@ function agentHandle(request, env = process.env) {
         },
     };
 }
-/** Resolve a request to a spawn-style batch job, or undefined when the agent
- *  is endpoint-configured/unconfigured (those settle through the serial
- *  path). */
+/** Resolve a request to a spawn-style (CLI-binary) batch job, or undefined when
+ *  the agent is endpoint-configured (see prepareEndpointJob) or unconfigured
+ *  (those settle through the serial path). */
 function prepareAgentSpawn(request) {
     const resolved = resolveAgentInvocation(request);
     if (!resolved.binary)
@@ -303,6 +367,27 @@ function prepareAgentSpawn(request) {
         timeoutMs: resolved.timeoutMs || 600000,
     };
 }
+/** Resolve a request to an endpoint (HTTP-delegate) batch job, or undefined when
+ *  the agent has a CLI binary (see prepareAgentSpawn) or is unconfigured. The
+ *  POST body mirrors runAgentEndpoint's exactly: {manifest, prompt, model,
+ *  resultPath, sandboxProfileId} — sandboxProfileId comes from
+ *  request.sandboxPolicy.id, which runBackend sets to the same policy the serial
+ *  path passes (registry.ts: `const policy = request.sandboxPolicy`), so the two
+ *  paths post identical bytes. */
+function prepareEndpointJob(request) {
+    const resolved = resolveAgentInvocation(request);
+    if (resolved.binary || !resolved.endpoint)
+        return undefined;
+    const manifest = request.manifest;
+    const job = JSON.stringify({
+        manifest,
+        prompt: manifest?.prompt,
+        model: resolved.model,
+        resultPath: manifest?.resultPath,
+        sandboxProfileId: request.sandboxPolicy.id,
+    });
+    return { endpoint: resolved.endpoint, job, timeoutMs: resolved.timeoutMs || 600000 };
+}
 // __dirname is dist/shell/execution-backend at runtime — THREE levels up
 // (execution-backend -> shell -> dist -> package root) reaches scripts/,
 // a sibling of dist/, not two (that was a bug: it resolved to a
@@ -367,6 +452,36 @@ function runAgentBatchOutcomes(jobs) {
     }
     return reconcileBatchOutcomes(jobs, child);
 }
+// Same package-root depth fix as BATCH_DELEGATE_CHILD_SCRIPT above.
+const HTTP_BATCH_DELEGATE_CHILD_SCRIPT = path.resolve(__dirname, "..", "..", "..", "scripts", "children", "http-batch-delegate-child.js");
+/** Run a batch of ENDPOINT (HTTP-delegate) jobs concurrently; outcomes
+ *  index-align with jobs. The endpoint sibling of runAgentBatchOutcomes: one
+ *  spawnSync of http-batch-delegate-child.js POSTs all N at once from a single
+ *  process, so `--concurrency N` with an endpoint agent runs N delegations in
+ *  parallel instead of serially. The child streams the SAME NDJSON line shape as
+ *  batch-delegate-child.js — `{i, spawnError?, exitCode, stdout}` — so the same
+ *  reconcileBatchOutcomes reads it (byte-boundary split on a Buffer, index-aligned,
+ *  every job that produced no full line failed closed). Env is inherited (the
+ *  serial runAgentEndpoint likewise runs the child with the full process env for
+ *  any endpoint auth); no sandbox child-env is built here, matching the serial
+ *  endpoint path. */
+function runEndpointBatchOutcomes(jobs) {
+    if (!jobs.length)
+        return [];
+    const maxTimeout = Math.max(...jobs.map((job) => job.timeoutMs));
+    let child;
+    try {
+        child = (0, node_child_process_1.spawnSync)(process.execPath, [HTTP_BATCH_DELEGATE_CHILD_SCRIPT], {
+            input: JSON.stringify(jobs),
+            maxBuffer: 34 * 1024 * 1024 * jobs.length,
+            timeout: maxTimeout + 30000,
+        });
+    }
+    catch (error) {
+        child = { error: error instanceof Error ? error : new Error(String(error)), status: null, stdout: null };
+    }
+    return reconcileBatchOutcomes(jobs, child);
+}
 // ---------------------------------------------------------------------------
 // The stateful agent runners (spawn + settle). Byte-exact port of
 // src/execution-backend.ts's runAgentProcess (:915-995), runAgentEndpoint
@@ -406,9 +521,15 @@ function runAgentProcess(descriptor, policy, request, label, attestation) {
         else {
             const streamStderr = shouldStreamAgentStderr(process.env, Boolean(process.stderr.isTTY));
             const built = buildAgentChildEnv(policy);
-            const childEnv = built.env;
             forwardedEnvVars = built.forwarded;
             const timeoutMs = resolved.timeoutMs || 600000;
+            // A shipped wrapper (claude/codex/gemini) records its vendor child's PID
+            // here so we can reap the vendor if the timeout below SIGKILLs the
+            // wrapper -- a SIGKILL is uncatchable, so the wrapper cannot forward the
+            // stop itself. Not a forwarded secret; it is cw plumbing, so it stays out
+            // of `built.forwarded` / the trust-audit forwarded list.
+            const vendorPidFile = vendorPidFilePath();
+            const childEnv = { ...built.env, CW_AGENT_VENDOR_PIDFILE: vendorPidFile };
             const child = (0, node_child_process_1.spawnSync)(resolved.binary, realArgs, {
                 cwd: request.cwd,
                 env: childEnv,
@@ -430,12 +551,30 @@ function runAgentProcess(descriptor, policy, request, label, attestation) {
             // and the null-exit-code "timed out or killed" branch was dead code
             // for real timeouts.
             if (child.error && child.error.code === "ETIMEDOUT") {
+                // spawnSync SIGKILLed the wrapper (uncatchable, so the wrapper could
+                // not forward the stop to its vendor child). Reap the vendor a shipped
+                // wrapper recorded, so a timed-out agent's vendor process does not live
+                // on as an orphan and keep spending. Scoped: reaps the vendor process
+                // itself for the shipped wrappers (claude, codex, gemini, opencode/
+                // deepseek), not a deeper grandchild tree nor an arbitrary
+                // CW_AGENT_COMMAND (which records no PID). We do
+                // NOT use `detached:true` -- that would make the wrapper its own group
+                // leader, so an interactive Ctrl-C / a group SIGINT to cw would no
+                // longer reach it (strictly worse); reaping from the recorded PID keeps
+                // the wrapper in cw's group.
+                reapRecordedVendor(vendorPidFile);
                 const handleOut = recordedAgentHandle(resolved.binary, undefined, recordedArgs, resolved.model, "unreported", undefined, undefined, forwardedEnvVars);
                 return (0, envelopes_1.refusedEnvelope)(descriptor, policy, label, "delegation-failed", `agent process timed out after ${timeoutMs}ms and was killed (SIGKILL)`, {
                     ...attestation,
                     handle: handleOut,
                 });
             }
+            // Non-timeout paths: a wrapper that ran to any normal end removed its own
+            // sidecar on exit; clear any stray file best-effort so tmp cannot grow.
+            try {
+                fs.unlinkSync(vendorPidFile);
+            }
+            catch { /* usually already gone */ }
             outcome = {
                 ...(child.error ? { spawnError: messageOf(child.error) } : {}),
                 exitCode: typeof child.status === "number" ? child.status : null,
@@ -464,12 +603,70 @@ function runAgentProcess(descriptor, policy, request, label, attestation) {
     }
     return (0, envelopes_1.refusedEnvelope)(descriptor, policy, label, "delegation-target-missing", `Backend ${descriptor.id} has no command-template or endpoint configured`, attestation);
 }
+/** Settle a completed endpoint delegation (a numeric exitCode + stdout) into
+ *  its envelope: parse the agent report, write result.md as transport when the
+ *  runner returned a body and none exists yet, record the handle. Shared by the
+ *  serial spawn path and the concurrent prepared-outcome path so the two never
+ *  drift. The result-write stays HERE (the cw shell process), never in the batch
+ *  child, so the child does no filesystem writes into the run dir. */
+function settleEndpointResult(descriptor, label, endpoint, resolvedModel, manifest, attestation, exitCode, stdout) {
+    const report = parseAgentReport(stdout);
+    if (manifest?.resultPath && report.usage === undefined) {
+        const body = extractEndpointResult(stdout);
+        if (body && !fs.existsSync(manifest.resultPath)) {
+            try {
+                fs.writeFileSync(manifest.resultPath, body, "utf8");
+            }
+            catch {
+                /* the accept layer will fail closed on a missing result.md */
+            }
+        }
+    }
+    const reportedModel = report.model && report.model.trim() ? report.model.trim() : "unreported";
+    const handleOut = recordedAgentHandle(undefined, endpoint, [], resolvedModel, reportedModel, report.usage, report.usageSignature);
+    return (0, envelopes_1.delegatedEnvelope)(descriptor, label, handleOut, { ...attestation, handle: handleOut }, "agent-endpoint", [endpoint], exitCode, stdout);
+}
 /** Agent HTTP endpoint variant — POSTs the worker manifest/prompt to a
  *  configured agent endpoint via the shared Node delegate child. Byte-exact
- *  port of src/execution-backend.ts:1002-1062. */
+ *  port of src/execution-backend.ts:1002-1062, plus a prepared-outcome branch:
+ *  in a concurrent round the POST already ran in the batch child
+ *  (runEndpointBatchOutcomes), so settle that pre-collected outcome instead of
+ *  spawning again. The serial (no prepared outcome) path is unchanged. */
 function runAgentEndpoint(descriptor, policy, request, label, resolved, attestation) {
     const endpoint = resolved.endpoint;
     const manifest = request.manifest;
+    const baseHandle = recordedAgentHandle(undefined, endpoint, [], resolved.model, "unreported");
+    // Concurrent round: the batch child already POSTed and settled this job. Any
+    // failure (network, non-2xx, poll, unparseable, timeout, no exitCode) is a
+    // spawnError; a success carries a numeric exitCode + stdout.
+    if (request.preparedAgentOutcome) {
+        const prep = request.preparedAgentOutcome;
+        if (prep.spawnError) {
+            // Match the SERIAL path's refusal wording so a concurrent round records the
+            // same reason bytes as a serial one. A per-job HTTP failure (non-2xx, poll,
+            // timeout, no exitCode) is the serial `{error}` branch — `agent endpoint
+            // error:`. A whole-batch-child process failure surfaces as
+            // reconcileBatchOutcomes' `batch delegate failed:` fallback — the serial
+            // analog is `child.error` — `agent endpoint delegation failed:`.
+            const summary = prep.spawnError.startsWith("batch delegate failed:")
+                ? `agent endpoint delegation failed: ${prep.spawnError}`
+                : `agent endpoint error: ${prep.spawnError}`;
+            return (0, envelopes_1.refusedEnvelope)(descriptor, policy, label, "delegation-failed", summary, {
+                ...attestation,
+                handle: baseHandle,
+            });
+        }
+        // Defensive: the batch child always pairs a null exitCode with a spawnError,
+        // so this is unreachable in practice — kept as a fail-closed backstop with
+        // the same wording the serial no-exitCode refusal uses.
+        if (typeof prep.exitCode !== "number") {
+            return (0, envelopes_1.refusedEnvelope)(descriptor, policy, label, "delegation-failed", `agent endpoint error: no exitCode reported`, {
+                ...attestation,
+                handle: baseHandle,
+            });
+        }
+        return settleEndpointResult(descriptor, label, endpoint, resolved.model, manifest, attestation, prep.exitCode, prep.stdout);
+    }
     const job = JSON.stringify({
         manifest,
         prompt: manifest?.prompt,
@@ -484,7 +681,6 @@ function runAgentEndpoint(descriptor, policy, request, label, resolved, attestat
         timeout: resolved.timeoutMs || 600000,
         maxBuffer: 32 * 1024 * 1024,
     });
-    const baseHandle = recordedAgentHandle(undefined, endpoint, [], resolved.model, "unreported");
     if (child.error) {
         return (0, envelopes_1.refusedEnvelope)(descriptor, policy, label, "delegation-failed", `agent endpoint delegation failed: ${messageOf(child.error)}`, {
             ...attestation,
@@ -507,20 +703,5 @@ function runAgentEndpoint(descriptor, policy, request, label, resolved, attestat
             handle: baseHandle,
         });
     }
-    const stdout = String(parsed.stdout || "");
-    const report = parseAgentReport(stdout);
-    if (manifest?.resultPath && report.usage === undefined) {
-        const body = extractEndpointResult(stdout);
-        if (body && !fs.existsSync(manifest.resultPath)) {
-            try {
-                fs.writeFileSync(manifest.resultPath, body, "utf8");
-            }
-            catch {
-                /* the accept layer will fail closed on a missing result.md */
-            }
-        }
-    }
-    const reportedModel = report.model && report.model.trim() ? report.model.trim() : "unreported";
-    const handleOut = recordedAgentHandle(undefined, endpoint, [], resolved.model, reportedModel, report.usage, report.usageSignature);
-    return (0, envelopes_1.delegatedEnvelope)(descriptor, label, handleOut, { ...attestation, handle: handleOut }, "agent-endpoint", [endpoint], parsed.exitCode, stdout);
+    return settleEndpointResult(descriptor, label, endpoint, resolved.model, manifest, attestation, parsed.exitCode, String(parsed.stdout || ""));
 }