cool-workflow 0.2.3 → 0.2.5

package/dist/shell/execution-backend/container.js

@@ -7,14 +7,49 @@
 //
 // Evidence: SPEC/execution-backend.md "container driver (runContainer)".
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildContainerEnvArgs = buildContainerEnvArgs;
 exports.containerHandle = containerHandle;
 exports.runContainer = runContainer;
 const node_child_process_1 = require("node:child_process");
 const probes_1 = require("./probes");
+const local_1 = require("./local");
 const envelopes_1 = require("./envelopes");
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }
+/** buildContainerEnvArgs — build the `-e NAME=value` args passed into the
+ *  container run command. Pulled out as its own pure function so it can be
+ *  checked without a real docker/podman on the box (see local.ts's
+ *  buildChildEnv for the same shape of test-only split).
+ *
+ *  deny must win here too: an operator who sets inherit:true plus a deny
+ *  list (a valid, normalized combination — see sandbox-profile.ts's
+ *  normalizeEnv) means "everything EXCEPT these". Before this fix, deny was
+ *  never read here, so a secret like AWS_SECRET_ACCESS_KEY that the operator
+ *  named in deny still got copied into the container's `-e` args.
+ *
+ *  This backend builds its `-e` args straight from baseEnv rather than through
+ *  buildChildEnv, so it must apply CW_NEVER_FORWARD_ENV itself — otherwise
+ *  inherit:true would still copy CW's own parent-only secrets (the release
+ *  signing key, the workbench token) into the container. */
+function buildContainerEnvArgs(policy, baseEnv = process.env) {
+    const args = [];
+    if (policy.env.inherit || (policy.env.expose && policy.env.expose.length)) {
+        const deny = new Set(policy.env.deny || []);
+        for (const name of policy.env.inherit ? Object.keys(baseEnv) : policy.env.expose || []) {
+            if (name === "PATH" || name === "HOME")
+                continue;
+            if (deny.has(name))
+                continue;
+            if (local_1.CW_NEVER_FORWARD_ENV.has(name))
+                continue; // parent-only secrets never enter the container
+            const value = baseEnv[name];
+            if (value !== undefined)
+                args.push("-e", `${name}=${value}`);
+        }
+    }
+    return args;
+}
 function containerHandle(request, env = process.env) {
     const delegation = request.delegation || {};
     const image = delegation.image || (env.CW_CONTAINER_IMAGE || "").trim() || undefined;
@@ -46,20 +81,19 @@ function runContainer(descriptor, policy, request, label, handle, attestation) {
     if (policy.network.mode !== "any")
         runArgs.push("--network", "none");
     runArgs.push("-v", `${cwd}:${cwd}:ro`, "-w", cwd);
-    if (policy.env.inherit || (policy.env.expose && policy.env.expose.length)) {
-        for (const name of policy.env.inherit ? Object.keys(process.env) : policy.env.expose || []) {
-            if (name === "PATH" || name === "HOME")
-                continue;
-            const value = process.env[name];
-            if (value !== undefined)
-                runArgs.push("-e", `${name}=${value}`);
-        }
-    }
+    runArgs.push(...buildContainerEnvArgs(policy));
     runArgs.push(handle.ref, command, ...args);
     // An unset timeoutMs must not mean "no timeout" — spawnSync would then
     // block forever on a hung container with no kill path. 600000 matches the
     // agent backend's own default fallback (execution-backend/agent.ts).
-    const result = (0, node_child_process_1.spawnSync)(runtime, runArgs, { cwd, encoding: "utf8", timeout: request.timeoutMs || 600000, maxBuffer: 32 * 1024 * 1024 });
+    // killSignal SIGKILL, not the default SIGTERM: a container runtime that
+    // ignores SIGTERM would leave this blocking spawnSync waiting forever (no
+    // second-stage escalation is possible from inside a sync call), so the
+    // timeout above would not actually bound anything. SIGKILL is uncatchable,
+    // so the runtime always dies and spawnSync returns; a timed-out run is
+    // classified the same either way (status null, ETIMEDOUT message does not
+    // name the signal, result.signal is never recorded). Mirrors agent.ts.
+    const result = (0, node_child_process_1.spawnSync)(runtime, runArgs, { cwd, encoding: "utf8", timeout: request.timeoutMs || 600000, maxBuffer: 32 * 1024 * 1024, killSignal: "SIGKILL" });
     if (result.error) {
         return (0, envelopes_1.refusedEnvelope)(descriptor, policy, label, "delegation-failed", `${runtime} run failed: ${messageOf(result.error)}`, attestation);
     }

package/dist/shell/execution-backend/local.js

@@ -8,6 +8,7 @@
 //
 // Evidence: SPEC/execution-backend.md "Local execution (executeLocal)".
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CW_NEVER_FORWARD_ENV = void 0;
 exports.buildChildEnv = buildChildEnv;
 exports.checkShellGuard = checkShellGuard;
 exports.runtimeNoteFor = runtimeNoteFor;
@@ -18,21 +19,43 @@ const probes_1 = require("./probes");
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }
+/** CW's OWN secrets that must NEVER reach ANY child process — on any backend
+ *  (local/container/remote/agent), regardless of policy.env.inherit / expose /
+ *  deny. Each is read only by parent-side tooling, so no spawned child ever
+ *  needs it; stripping them here, unconditionally, is a fail-closed backstop
+ *  that does not depend on an operator remembering to list them in
+ *  policy.env.deny. Do NOT add the agent-attest private key
+ *  (CW_AGENT_ATTEST_PRIVKEY) here: the attest wrapper
+ *  (scripts/agents/cw-attest-wrap.js) is spawned AS the agent and must receive
+ *  it to sign telemetry. */
+exports.CW_NEVER_FORWARD_ENV = new Set([
+    "CW_RELEASE_VERDICT_PRIVKEY", // release verdict signing key — release-flow.js only
+    "CW_WORKBENCH_TOKEN", // workbench HTTP bearer token — workbench-host.ts only
+]);
 function buildChildEnv(policy, baseEnv = process.env) {
-    if (policy.env.inherit)
-        return { ...baseEnv };
-    const env = {};
-    if (baseEnv.PATH !== undefined)
-        env.PATH = baseEnv.PATH;
-    if (baseEnv.HOME !== undefined)
-        env.HOME = baseEnv.HOME;
-    for (const name of policy.env.expose || []) {
-        if (baseEnv[name] !== undefined)
-            env[name] = baseEnv[name];
+    // deny must win regardless of inherit: a custom profile combining
+    // inherit:true with deny:[...] (a valid, normalized combination — see
+    // sandbox-profile.ts's normalizeEnv) means "everything EXCEPT these".
+    // An early return on inherit before this loop ran meant deny was
+    // silently skipped whenever inherit was true.
+    const env = policy.env.inherit ? { ...baseEnv } : {};
+    if (!policy.env.inherit) {
+        if (baseEnv.PATH !== undefined)
+            env.PATH = baseEnv.PATH;
+        if (baseEnv.HOME !== undefined)
+            env.HOME = baseEnv.HOME;
+        for (const name of policy.env.expose || []) {
+            if (baseEnv[name] !== undefined)
+                env[name] = baseEnv[name];
+        }
     }
     for (const name of policy.env.deny || []) {
         delete env[name];
     }
+    // Fail-closed backstop: parent-only secrets never cross into a child, even
+    // when inherit:true forwarded them above or an operator exposed one by name.
+    for (const name of exports.CW_NEVER_FORWARD_ENV)
+        delete env[name];
     return env;
 }
 /** Shell injection guard (SPEC/execution-backend.md "Local execution"): for
@@ -70,6 +93,20 @@ function executeLocal(descriptor, request, label, attestation, spawnStyle) {
         // agent backend's own default fallback (execution-backend/agent.ts).
         timeout: request.timeoutMs || 600000,
         maxBuffer: 32 * 1024 * 1024,
+        // SIGKILL, not the default SIGTERM: a child that ignores SIGTERM would
+        // leave this blocking spawnSync waiting forever (no second-stage
+        // escalation is possible from inside a sync call), so the `timeout` above
+        // would not actually bound anything. SIGKILL is uncatchable, so the child
+        // always dies and spawnSync returns. A timed-out run is classified as
+        // failed regardless of the signal (status stays null, the ETIMEDOUT
+        // message does not name the signal, and this backend never records
+        // result.signal). The exact captured stdout/stderr on a timeout is not
+        // guaranteed identical to the old SIGTERM path: a child that catches
+        // SIGTERM could flush a last partial write or exit with a code before it
+        // dies, while under SIGKILL it cannot — but that output belongs to a run
+        // we already treat as failed, so the hard kill loses nothing that counts.
+        // Mirrors execution-backend/agent.ts's fix.
+        killSignal: "SIGKILL",
     };
     if (spawnStyle === "shell") {
         checkShellGuard(command, args);

package/dist/shell/fs-atomic.js

@@ -48,6 +48,8 @@ exports.assertSafeRunId = assertSafeRunId;
 exports.realResolve = realResolve;
 exports.isContainedPath = isContainedPath;
 exports.durableAppendFileSync = durableAppendFileSync;
+exports.logEndsWithNewline = logEndsWithNewline;
+exports.nextBackoffMs = nextBackoffMs;
 exports.withFileLock = withFileLock;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -196,18 +198,55 @@ function durableAppendFileSync(file, data) {
         fs.closeSync(fd);
     }
 }
+/** True when `file`'s final byte is "\n", given its already-known `size`.
+ *  A COMPLETED `durableAppendFileSync` always leaves the file ending in
+ *  "\n" (every append is `<line>\n`), so a non-newline last byte means the
+ *  previous append was torn by a crash — its bytes were never a confirmed
+ *  record. Reads ONLY the last byte at `size-1`, so callers on an append
+ *  hot path stay O(1) and never re-read the whole file. A read failure
+ *  returns false (treat as "not newline-terminated") — the safe side: an
+ *  extra leading newline is harmless for an NDJSON reader that skips blank
+ *  lines, while a MISSED torn boundary would merge two records into one
+ *  unparseable line. Shared by trust-audit's events.jsonl and the
+ *  blackboard's messages.jsonl append paths — same file shape, same
+ *  torn-tail risk, one implementation. */
+function logEndsWithNewline(file, size) {
+    if (size <= 0)
+        return false;
+    let fd;
+    try {
+        fd = fs.openSync(file, "r");
+        const buf = Buffer.alloc(1);
+        fs.readSync(fd, buf, 0, 1, size - 1);
+        return buf[0] === 0x0a; // "\n"
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
 // ---------------------------------------------------------------------------
 // withFileLock — portable advisory cross-process lock.
 //
 // Lock file: `<targetPath>.lock`, created by hard-linking a per-attempt temp
 // file onto the lock path (single-winner `link(2)`), body `"<pid>@<ISO>\n"`.
-// Up to 240 tries; on EEXIST, a lock whose mtime is older than
-// FILE_LOCK_STALE_MS (30_000) is stolen — judged and deleted only while
-// holding the single-winner `<lock>.steal` guard (see
-// stealStaleLockUnderGuard) — and retried AT ONCE; else sleep 25ms
-// (Atomics.wait busy-safe sleep) and retry. Any non-EEXIST link error is
-// rethrown. No lock after 240 tries throws
-// `could not acquire file lock for <targetPath>`.
+// On EEXIST, a lock whose mtime is older than FILE_LOCK_STALE_MS (30_000) is
+// stolen — judged and deleted only while holding the single-winner
+// `<lock>.steal` guard (see stealStaleLockUnderGuard) — and retried AT ONCE
+// (so is a lock that vanished between the EEXIST and the stat). Otherwise the
+// thread sleeps a short, growing backoff (Atomics.wait busy-safe sleep:
+// FILE_LOCK_BACKOFF_BASE_MS doubling toward FILE_LOCK_BACKOFF_MAX_MS, with
+// jitter so many processes contending on ONE lock do not retry in lock-step)
+// and tries again. The WHOLE acquire is bounded by wall-clock, not a try
+// count: after FILE_LOCK_ACQUIRE_BUDGET_MS (~6s, kept well under the 30s steal
+// window so a fresh orphan lock fails fast rather than being waited out) with
+// no lock, it throws `could not acquire file lock for <targetPath>`. The tiny
+// early sleeps re-grab a briefly-held lock in a few ms; the wall-clock bound
+// (not the try count) is what keeps the worst case at ~6s. Any non-EEXIST
+// link error is rethrown.
 //
 // Right before fn() the lock mtime is refreshed (utimesSync, best-effort).
 // After fn() returns, the lock body is re-read: if it no longer starts with
@@ -227,15 +266,37 @@ const FILE_LOCK_FORCE_STALE_MS = FILE_LOCK_STALE_MS * 10;
 // guarded window (which is a handful of syscalls, microseconds for any live
 // process) — remove it so stealing cannot wedge forever.
 const FILE_LOCK_STEAL_GUARD_STALE_MS = FILE_LOCK_STALE_MS;
+// Acquire-retry pacing (all internal to withFileLock — no wire/protocol
+// meaning). The wall-clock BUDGET, not a fixed try count, bounds how long a
+// contended acquire blocks the calling thread; kept at ~6s so it stays well
+// under the 30s steal window (a fresh orphan lock is failed fast, not waited
+// out — a later command past 30s steals it). Between misses the thread sleeps
+// a backoff that starts at BASE and doubles to MAX, so a briefly-held lock is
+// re-grabbed in a few ms while a genuinely busy one is not hot-spun. Jitter on
+// each sleep (applied at the call site) de-syncs many contenders on one lock.
+// MAX_ATTEMPTS is only a loop-termination backstop for the (never-observed)
+// case of a clock that fails to advance; the budget is the real bound.
+const FILE_LOCK_ACQUIRE_BUDGET_MS = 6_000;
+const FILE_LOCK_BACKOFF_BASE_MS = 1;
+const FILE_LOCK_BACKOFF_MAX_MS = 50;
+const FILE_LOCK_MAX_ATTEMPTS = 10_000;
 // Lock paths this process holds right now. A nested withFileLock on the
 // SAME target runs its fn directly (re-entrant) instead of waiting on its
-// own lock file until the 240 tries run out — that lets a whole
+// own lock file until the acquire budget runs out — that lets a whole
 // load -> change -> save cycle hold one lock while the save path inside
 // it keeps its own withFileLock call unchanged.
 const HELD_LOCKS = new Set();
 function sleepSync(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
+/** Next backoff ceiling (ms) given the previous one: double it, capped at
+ *  FILE_LOCK_BACKOFF_MAX_MS. Pure and deterministic (the per-sleep jitter is
+ *  applied separately at the call site), so the retry schedule is
+ *  unit-testable without any timing. Exported for that test only — fs-atomic
+ *  is not part of the public index.ts surface. */
+function nextBackoffMs(previous) {
+    return Math.min(previous * 2, FILE_LOCK_BACKOFF_MAX_MS);
+}
 /** Whether the pid recorded in a lock body ("<pid>@<ISO>\n") is still a
  *  live process on this machine. Locks here are local-advisory only (no
  *  network-shared run directories in this tool's model), so
@@ -375,7 +436,9 @@ function withFileLock(targetPath, fn) {
     fs.mkdirSync(path.dirname(lock), { recursive: true });
     const pid = String(process.pid);
     let acquired = false;
-    for (let attempt = 0; attempt < 240 && !acquired; attempt++) {
+    const deadline = Date.now() + FILE_LOCK_ACQUIRE_BUDGET_MS;
+    let backoff = FILE_LOCK_BACKOFF_BASE_MS;
+    for (let attempt = 0; attempt < FILE_LOCK_MAX_ATTEMPTS && !acquired; attempt++) {
         // Acquire via `linkSync`, not `open(lock, "wx")`: directly testing the
         // retry loop under contention showed `open(O_CREAT|O_EXCL)` is NOT
         // reliably single-winner on every Node version this runs on — under
@@ -421,16 +484,34 @@ function withFileLock(targetPath, fn) {
                 // The steal itself runs under a single-winner guard lock — see
                 // stealStaleLockUnderGuard for why judging staleness and deleting
                 // the lock without one can never be made safe from here.
-                if (stealStaleLockUnderGuard(lock, pid, attempt))
+                if (stealStaleLockUnderGuard(lock, pid, attempt)) {
+                    // Verdict rendered and the lock likely just freed — retry AT ONCE
+                    // and reset the backoff so we grab it before another waiter does.
+                    backoff = FILE_LOCK_BACKOFF_BASE_MS;
                     continue;
+                }
                 // Guard was busy — another process is mid-steal. Back off like
-                // ordinary contention instead of hot-spinning the attempt budget.
+                // ordinary contention instead of hot-spinning.
             }
         }
         catch {
+            // The lock vanished between the EEXIST and the stat — it is likely free
+            // now, so retry AT ONCE (no sleep) with a reset backoff.
+            backoff = FILE_LOCK_BACKOFF_BASE_MS;
             continue;
         }
-        sleepSync(25);
+        // Give up on wall-clock, never on a raw try count: this keeps the worst-
+        // case block at ~6s even though the per-sleep backoff grew. Bounding by a
+        // fixed try count instead (as the old flat-25ms loop's 240 tries did)
+        // would have let the growing backoff roughly double that worst case.
+        if (Date.now() >= deadline)
+            break;
+        // Sleep a jittered span in [BASE, backoff] — never 0, so never a busy
+        // spin — then grow the backoff toward the cap. The jitter de-syncs many
+        // processes contending on the SAME lock so they do not retry in lock-step.
+        const span = backoff - FILE_LOCK_BACKOFF_BASE_MS;
+        sleepSync(FILE_LOCK_BACKOFF_BASE_MS + Math.floor(Math.random() * (span + 1)));
+        backoff = nextBackoffMs(backoff);
     }
     if (!acquired)
         throw new Error(`could not acquire file lock for ${targetPath}`);

package/dist/shell/ledger-cli.js

@@ -188,10 +188,17 @@ function ledgerApplyCli(options) {
     return (0, ledger_1.applyLedgerProposal)(parsed);
 }
 function ledgerListCli(options) {
-    const dirs = Array.isArray(options.dir) ? options.dir.map(String).filter(Boolean) : [];
+    // `--ledger-dir` is the preferred flag: the global CLI front door
+    // (cli/entry.ts) treats `--dir` as an alias of `--repo` for EVERY
+    // command, so `cw ledger list --dir X` made one flag mean two things.
+    // `--dir` keeps working unchanged as the legacy spelling; when both are
+    // given, `--ledger-dir` wins. Repeated flags become an array via
+    // parseArgv's append behavior, same as `--dir` always has.
+    const input = options["ledger-dir"] ?? options.dir;
+    const dirs = Array.isArray(input) ? input.map(String).filter(Boolean) : [];
     if (dirs.length > 1)
         return (0, ledger_io_1.unionLedgerEntries)(dirs);
-    const dir = required(dirs[0] || stringOption(options.dir), "--dir <ledger-directory>");
+    const dir = required(dirs[0] || stringOption(input), "--ledger-dir <ledger-directory>");
     return (0, ledger_io_1.listLedgerEntries)(dir);
 }
 /** MCP-facing verify/apply take the entry OBJECT directly (not a file/

package/dist/shell/multi-agent-cli.js

@@ -113,6 +113,7 @@ exports.evalScoreCli = evalScoreCli;
 exports.evalGateCli = evalGateCli;
 exports.evalReportCli = evalReportCli;
 const path = __importStar(require("node:path"));
+const cli_args_1 = require("../core/util/cli-args");
 const numeric_flag_1 = require("../core/util/numeric-flag");
 const run_store_1 = require("./run-store");
 const report_1 = require("./report");
@@ -188,7 +189,10 @@ function numberArg(value) {
     return Number.isFinite(parsed) ? parsed : undefined;
 }
 function boolArg(value) {
-    return Boolean(value);
+    // parseBoolFlag reads "false"/"0"/"no"/"off" as false and throws on an
+    // unrecognized string — Boolean("false") is true, which silently
+    // ENABLED flags like `--allow-self-approval false` (fail-open).
+    return (0, cli_args_1.parseBoolFlag)(value, "flag") ?? false;
 }
 /** `--multi-agent-run <id>` — parseArgv keeps kebab-case option keys
  *  verbatim (no camelCase folding), so this must check the literal

package/dist/shell/onramp.js

@@ -278,9 +278,9 @@ function resolveChangedFiles(options = {}) {
     const root = gitRoot(cwd);
     const baseRef = resolveBaseRef(root, options.changedFrom, options.env || process.env);
     const files = new Set();
-    for (const file of gitLines(root, ["diff", "--name-only", baseRef, "--"]))
+    for (const file of gitLinesOrThrow(root, ["diff", "--name-only", baseRef, "--"]))
         files.add(normalizeChangedPath(file));
-    for (const file of gitLines(root, ["ls-files", "--others", "--exclude-standard"]))
+    for (const file of gitLinesOrThrow(root, ["ls-files", "--others", "--exclude-standard"]))
         files.add(normalizeChangedPath(file));
     return { baseRef, files: [...files].filter(Boolean).sort() };
 }
@@ -406,8 +406,26 @@ function resolveBaseRef(root, changedFrom, env) {
         return verifyRef(root, changedFrom);
     if (env.CW_ONRAMP_BASE)
         return verifyRef(root, env.CW_ONRAMP_BASE);
-    const baseBranch = env.GITHUB_BASE_REF ? `origin/${env.GITHUB_BASE_REF}` : "origin/main";
-    const mergeBase = gitOne(root, ["merge-base", "HEAD", baseBranch]);
+    // A pull_request CI context sets GITHUB_BASE_REF, so a base ref is EXPECTED:
+    // the diff must run against the PR's own base branch. If merge-base cannot
+    // resolve there (a shallow clone that never fetched the base, a missing
+    // origin ref), we must NOT quietly degrade to HEAD -- a HEAD..HEAD diff on a
+    // clean, already-committed tree is empty, and an empty change set has no
+    // issues, so onramp:check would report ok:true on a real, unseen change (the
+    // same vacuous-pass class PR #446 closed one layer below). Fail closed.
+    if (env.GITHUB_BASE_REF) {
+        const baseBranch = `origin/${env.GITHUB_BASE_REF}`;
+        const mergeBase = gitOne(root, ["merge-base", "HEAD", baseBranch]);
+        if (mergeBase)
+            return mergeBase;
+        throw new Error(`onramp: cannot resolve a base ref -- git merge-base HEAD ${baseBranch} found no common commit (fail closed, not treated as zero changes). Fetch the base branch with a full (non-shallow) clone, or pass --changed-from / CW_ONRAMP_BASE.`);
+    }
+    // No base ref was requested (--changed-from / CW_ONRAMP_BASE) or expected
+    // (GITHUB_BASE_REF): this is the local "show my own changes" use. merge-base
+    // against origin/main narrows the diff to this branch's commits when the
+    // remote is present; with no remote we fall back to HEAD so `git diff HEAD`
+    // still surfaces the working-tree (uncommitted) changes.
+    const mergeBase = gitOne(root, ["merge-base", "HEAD", "origin/main"]);
     if (mergeBase)
         return mergeBase;
     return verifyRef(root, "HEAD");
@@ -423,12 +441,37 @@ function verifyRef(root, ref) {
 function gitRoot(cwd) {
     return gitOne(node_path_1.default.resolve(cwd), ["rev-parse", "--show-toplevel"]) || node_path_1.default.resolve(cwd);
 }
+// Every onramp git call is a quick metadata read (rev-parse, merge-base, diff
+// --name-only, ls-files). A finite timeout keeps a HUNG git -- a cold fsmonitor
+// daemon, a credential prompt on a misconfigured remote -- from blocking the
+// gate forever; 5s matches the git-metadata timeout already used in
+// shell/commit.ts and shell/doctor.ts. On a timeout spawnSync sets
+// `result.error` (and a null status), so gitLinesOrThrow fails closed while
+// gitLines/gitOne fall back the same way they do for any other git failure.
+const GIT_TIMEOUT_MS = 5000;
 function gitLines(cwd, args) {
-    const result = (0, node_child_process_1.spawnSync)("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    const result = (0, node_child_process_1.spawnSync)("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: GIT_TIMEOUT_MS });
     if (result.status !== 0)
         return [];
     return String(result.stdout || "").split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
 }
+/** Same as gitLines, but a failed git invocation THROWS instead of silently
+ *  becoming []. resolveChangedFiles must never mistake "git could not run
+ *  this diff" for "there is nothing to diff" -- that turns a transient git
+ *  failure into a vacuous onramp-contract pass (a 2026-07-12 security audit
+ *  finding: a broken base ref or a git error made the changed-file set
+ *  empty, and an empty set has no issues, so the gate reported ok:true on a
+ *  real, unseen change). Callers that WANT a soft fallback (merge-base
+ *  probing, optional discovery) should keep using gitLines/gitOne. */
+function gitLinesOrThrow(cwd, args) {
+    const result = (0, node_child_process_1.spawnSync)("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: GIT_TIMEOUT_MS });
+    if (result.error)
+        throw new Error(`onramp: git ${args.join(" ")} failed to run: ${result.error.message}`);
+    if (result.status !== 0) {
+        throw new Error(`onramp: git ${args.join(" ")} exited ${result.status} -- cannot resolve changed files (fail closed, not treated as zero changes): ${String(result.stderr || "").trim()}`);
+    }
+    return String(result.stdout || "").split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+}
 function gitOne(cwd, args) {
     return gitLines(cwd, args)[0] || "";
 }

package/dist/shell/pipeline-cli.js

@@ -159,6 +159,24 @@ function planInputsFor(args) {
 function invocationCwd(args) {
     return typeof args.cwd === "string" && args.cwd.trim() ? path.resolve(args.cwd) : process.cwd();
 }
+/** Same as invocationCwd, but ALSO falls back to `--repo` before
+ *  process.cwd() -- for resolving an EXISTING run's directory specifically
+ *  (loadRunFromCwd's target), never for a fresh plan()'s repo input (see
+ *  planRun's own comment on why THAT path deliberately never auto-fills
+ *  repo from cwd). A caller resuming a run they didn't originally start
+ *  from this exact directory (the common case: `cw run resume <id>
+ *  --drive` or `cw quickstart <app> --resume --run <id>` typed from
+ *  wherever the terminal happens to be, not necessarily the run's own
+ *  --repo) must not have that already-known fact silently discarded in
+ *  favor of process.cwd() -- this mirrors the --preview branch's own
+ *  repoCwd fallback a few lines below, which already gets this right. */
+function existingRunCwd(args) {
+    if (typeof args.cwd === "string" && args.cwd.trim())
+        return path.resolve(args.cwd);
+    if (typeof args.repo === "string" && args.repo.trim())
+        return path.resolve(args.repo);
+    return process.cwd();
+}
 /** True for a value that counts as "not supplied" — byte-exact to the old
  *  build's cli-options.isMissing (undefined / null / empty string). */
 function isMissingInput(value) {
@@ -239,7 +257,7 @@ async function runDriveStep(args) {
         incremental: Boolean(args.incremental),
     };
     if (existingRunId) {
-        const cwd = invocationCwd(args);
+        const cwd = existingRunCwd(args);
         const run = (0, run_store_1.loadRunFromCwd)(existingRunId, cwd);
         return (0, drive_1.driveAsync)(existingRunId, run.cwd, options);
     }
@@ -502,7 +520,7 @@ async function quickstartRun(args) {
     };
     let run;
     if (existingRunId) {
-        run = (0, run_store_1.loadRunFromCwd)(existingRunId, invocationCwd(args));
+        run = (0, run_store_1.loadRunFromCwd)(existingRunId, existingRunCwd(args));
     }
     else {
         run = (0, pipeline_1.plan)(resolveWorkflowAppForPlan(appId), planInputsFor(args));

package/dist/shell/pipeline.js

@@ -48,6 +48,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.pureAppendRunNode = exports.writeJson = void 0;
 exports.plan = plan;
 const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const run_paths_1 = require("../core/state/run-paths");
 const migrations_1 = require("../core/state/migrations");
@@ -207,7 +208,7 @@ function plan(app, options) {
             loopStage: "interpret",
             artifacts: [{ id: "task", kind: "markdown", path: task.taskPath }],
             metadata: { workflowId: app.workflow.id, appId: app.id, appVersion: app.version, taskId: task.id, phase: task.phase, taskKind: task.kind, requiresEvidence: task.requiresEvidence, sandboxProfileId: task.sandboxProfileId },
-        }, { persist: false, persistNode: node_store_1.writeRunNode });
+        }, { persist: false, persistNode: node_store_1.writeRunNode, pathExists: fs.existsSync });
         task.stateNodeId = taskResult.outputNodeId;
     }
     (0, report_1.writeReport)(run);