cool-workflow 0.2.4 → 0.2.5

package/dist/shell/execution-backend/agent.js

@@ -5,7 +5,10 @@
 // MILESTONE 5 (docs/rebuild/PLAN.md build order, step 5). Byte-exact port of
 // plugins/cool-workflow/src/execution-backend/agent.ts. This module holds
 // the PURE data-transform helpers (invocation resolution, arg substitution,
-// secret redaction, report parsing) plus the batch delegate-child spawn.
+// secret redaction, report parsing) plus the batch delegate-child spawn — both
+// the CLI-binary batch (runAgentBatchOutcomes) and, added later, its
+// HTTP-endpoint sibling (runEndpointBatchOutcomes) so `--concurrency N` gives
+// endpoint-mode agents real concurrency instead of a serial per-task spawn.
 //
 // THE RED LINE: CW spawns the agent and records its attested output. It
 // NEVER imports a model SDK, holds an API key, or constructs a model API
@@ -49,6 +52,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.reapRecordedVendor = reapRecordedVendor;
 exports.buildAgentChildEnv = buildAgentChildEnv;
 exports.resolveAgentInvocation = resolveAgentInvocation;
 exports.stripSecretArgs = stripSecretArgs;
@@ -59,12 +63,15 @@ exports.recordedAgentHandle = recordedAgentHandle;
 exports.extractEndpointResult = extractEndpointResult;
 exports.agentHandle = agentHandle;
 exports.prepareAgentSpawn = prepareAgentSpawn;
+exports.prepareEndpointJob = prepareEndpointJob;
 exports.reconcileBatchOutcomes = reconcileBatchOutcomes;
 exports.runAgentBatchOutcomes = runAgentBatchOutcomes;
+exports.runEndpointBatchOutcomes = runEndpointBatchOutcomes;
 exports.shouldStreamAgentStderr = shouldStreamAgentStderr;
 exports.runAgentProcess = runAgentProcess;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
 const node_child_process_1 = require("node:child_process");
 const local_1 = require("./local");
 const envelopes_1 = require("./envelopes");
@@ -85,6 +92,46 @@ const AGENT_PROVIDER_KEY_ENV_RE = /^(CW_|ANTHROPIC_|OPENAI_|GEMINI_|DEEPSEEK_|CO
  *  call it, so the allowlist cannot drift into a second silent copy again.
  *  Returns the forwarded var NAMES too (never values) for the
  *  worker.agent-env trust-audit event. */
+/** A unique sidecar path a shipped wrapper writes its vendor child's PID to
+ *  (via the env CW_AGENT_VENDOR_PIDFILE we set below), so cw can reap the
+ *  vendor if it has to SIGKILL the wrapper on a timeout. */
+function vendorPidFilePath() {
+    return path.join(os.tmpdir(), `cw-agent-vendor-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.pid`);
+}
+/** Reap the vendor process a shipped wrapper recorded, then remove the sidecar.
+ *  A wrapper that exited cleanly already removed the file, so this is a no-op
+ *  then; only a wrapper cw SIGKILLed on a timeout leaves a live vendor PID
+ *  here. Best-effort and race-tolerant: a missing file, an unparseable/too-low
+ *  PID, or an already-gone process are all silently fine. Scope: kills the
+ *  vendor process itself (the token spender), not a deeper grandchild tree,
+ *  and only for the shipped vendor wrappers (claude, codex, gemini, and
+ *  opencode/deepseek) -- an arbitrary CW_AGENT_COMMAND records no PID and is
+ *  not covered. Returns true only if it
+ *  actually signalled a process. Exported for tests; agent.ts is not part of
+ *  the package public surface (index.ts). */
+function reapRecordedVendor(pidFile) {
+    let raw;
+    try {
+        raw = fs.readFileSync(pidFile, "utf8");
+    }
+    catch {
+        return false; // no sidecar => the wrapper cleaned up (or never recorded one)
+    }
+    try {
+        fs.unlinkSync(pidFile);
+    }
+    catch { /* already gone */ }
+    const pid = Number(raw.trim());
+    if (!Number.isInteger(pid) || pid <= 1)
+        return false;
+    try {
+        process.kill(pid, "SIGKILL");
+        return true;
+    }
+    catch {
+        return false; // already exited, or a pid we may not signal
+    }
+}
 function buildAgentChildEnv(policy, baseEnv = process.env) {
     const env = (0, local_1.buildChildEnv)(policy, baseEnv);
     // deny must win here too: buildChildEnv already applied it above, but the
@@ -98,6 +145,14 @@ function buildAgentChildEnv(policy, baseEnv = process.env) {
     for (const key of Object.keys(baseEnv)) {
         if (denied.has(key))
             continue;
+        // Parent-only CW secrets are never re-added, even though they match the
+        // CW_ arm of AGENT_PROVIDER_KEY_ENV_RE and even if the operator forgot to
+        // deny them. buildChildEnv already stripped them above; this keeps the
+        // re-add loop from putting them back (and out of the trust-audit
+        // `forwarded` list). CW_AGENT_ATTEST_PRIVKEY is intentionally NOT in that
+        // set, so the attest wrapper still gets its signing key.
+        if (local_1.CW_NEVER_FORWARD_ENV.has(key))
+            continue;
         if (AGENT_PROVIDER_KEY_ENV_RE.test(key)) {
             env[key] = baseEnv[key];
             forwarded.push(key);
@@ -297,9 +352,9 @@ function agentHandle(request, env = process.env) {
         },
     };
 }
-/** Resolve a request to a spawn-style batch job, or undefined when the agent
- *  is endpoint-configured/unconfigured (those settle through the serial
- *  path). */
+/** Resolve a request to a spawn-style (CLI-binary) batch job, or undefined when
+ *  the agent is endpoint-configured (see prepareEndpointJob) or unconfigured
+ *  (those settle through the serial path). */
 function prepareAgentSpawn(request) {
     const resolved = resolveAgentInvocation(request);
     if (!resolved.binary)
@@ -312,6 +367,27 @@ function prepareAgentSpawn(request) {
         timeoutMs: resolved.timeoutMs || 600000,
     };
 }
+/** Resolve a request to an endpoint (HTTP-delegate) batch job, or undefined when
+ *  the agent has a CLI binary (see prepareAgentSpawn) or is unconfigured. The
+ *  POST body mirrors runAgentEndpoint's exactly: {manifest, prompt, model,
+ *  resultPath, sandboxProfileId} — sandboxProfileId comes from
+ *  request.sandboxPolicy.id, which runBackend sets to the same policy the serial
+ *  path passes (registry.ts: `const policy = request.sandboxPolicy`), so the two
+ *  paths post identical bytes. */
+function prepareEndpointJob(request) {
+    const resolved = resolveAgentInvocation(request);
+    if (resolved.binary || !resolved.endpoint)
+        return undefined;
+    const manifest = request.manifest;
+    const job = JSON.stringify({
+        manifest,
+        prompt: manifest?.prompt,
+        model: resolved.model,
+        resultPath: manifest?.resultPath,
+        sandboxProfileId: request.sandboxPolicy.id,
+    });
+    return { endpoint: resolved.endpoint, job, timeoutMs: resolved.timeoutMs || 600000 };
+}
 // __dirname is dist/shell/execution-backend at runtime — THREE levels up
 // (execution-backend -> shell -> dist -> package root) reaches scripts/,
 // a sibling of dist/, not two (that was a bug: it resolved to a
@@ -376,6 +452,36 @@ function runAgentBatchOutcomes(jobs) {
     }
     return reconcileBatchOutcomes(jobs, child);
 }
+// Same package-root depth fix as BATCH_DELEGATE_CHILD_SCRIPT above.
+const HTTP_BATCH_DELEGATE_CHILD_SCRIPT = path.resolve(__dirname, "..", "..", "..", "scripts", "children", "http-batch-delegate-child.js");
+/** Run a batch of ENDPOINT (HTTP-delegate) jobs concurrently; outcomes
+ *  index-align with jobs. The endpoint sibling of runAgentBatchOutcomes: one
+ *  spawnSync of http-batch-delegate-child.js POSTs all N at once from a single
+ *  process, so `--concurrency N` with an endpoint agent runs N delegations in
+ *  parallel instead of serially. The child streams the SAME NDJSON line shape as
+ *  batch-delegate-child.js — `{i, spawnError?, exitCode, stdout}` — so the same
+ *  reconcileBatchOutcomes reads it (byte-boundary split on a Buffer, index-aligned,
+ *  every job that produced no full line failed closed). Env is inherited (the
+ *  serial runAgentEndpoint likewise runs the child with the full process env for
+ *  any endpoint auth); no sandbox child-env is built here, matching the serial
+ *  endpoint path. */
+function runEndpointBatchOutcomes(jobs) {
+    if (!jobs.length)
+        return [];
+    const maxTimeout = Math.max(...jobs.map((job) => job.timeoutMs));
+    let child;
+    try {
+        child = (0, node_child_process_1.spawnSync)(process.execPath, [HTTP_BATCH_DELEGATE_CHILD_SCRIPT], {
+            input: JSON.stringify(jobs),
+            maxBuffer: 34 * 1024 * 1024 * jobs.length,
+            timeout: maxTimeout + 30000,
+        });
+    }
+    catch (error) {
+        child = { error: error instanceof Error ? error : new Error(String(error)), status: null, stdout: null };
+    }
+    return reconcileBatchOutcomes(jobs, child);
+}
 // ---------------------------------------------------------------------------
 // The stateful agent runners (spawn + settle). Byte-exact port of
 // src/execution-backend.ts's runAgentProcess (:915-995), runAgentEndpoint
@@ -415,9 +521,15 @@ function runAgentProcess(descriptor, policy, request, label, attestation) {
         else {
             const streamStderr = shouldStreamAgentStderr(process.env, Boolean(process.stderr.isTTY));
             const built = buildAgentChildEnv(policy);
-            const childEnv = built.env;
             forwardedEnvVars = built.forwarded;
             const timeoutMs = resolved.timeoutMs || 600000;
+            // A shipped wrapper (claude/codex/gemini) records its vendor child's PID
+            // here so we can reap the vendor if the timeout below SIGKILLs the
+            // wrapper -- a SIGKILL is uncatchable, so the wrapper cannot forward the
+            // stop itself. Not a forwarded secret; it is cw plumbing, so it stays out
+            // of `built.forwarded` / the trust-audit forwarded list.
+            const vendorPidFile = vendorPidFilePath();
+            const childEnv = { ...built.env, CW_AGENT_VENDOR_PIDFILE: vendorPidFile };
             const child = (0, node_child_process_1.spawnSync)(resolved.binary, realArgs, {
                 cwd: request.cwd,
                 env: childEnv,
@@ -439,12 +551,30 @@ function runAgentProcess(descriptor, policy, request, label, attestation) {
             // and the null-exit-code "timed out or killed" branch was dead code
             // for real timeouts.
             if (child.error && child.error.code === "ETIMEDOUT") {
+                // spawnSync SIGKILLed the wrapper (uncatchable, so the wrapper could
+                // not forward the stop to its vendor child). Reap the vendor a shipped
+                // wrapper recorded, so a timed-out agent's vendor process does not live
+                // on as an orphan and keep spending. Scoped: reaps the vendor process
+                // itself for the shipped wrappers (claude, codex, gemini, opencode/
+                // deepseek), not a deeper grandchild tree nor an arbitrary
+                // CW_AGENT_COMMAND (which records no PID). We do
+                // NOT use `detached:true` -- that would make the wrapper its own group
+                // leader, so an interactive Ctrl-C / a group SIGINT to cw would no
+                // longer reach it (strictly worse); reaping from the recorded PID keeps
+                // the wrapper in cw's group.
+                reapRecordedVendor(vendorPidFile);
                 const handleOut = recordedAgentHandle(resolved.binary, undefined, recordedArgs, resolved.model, "unreported", undefined, undefined, forwardedEnvVars);
                 return (0, envelopes_1.refusedEnvelope)(descriptor, policy, label, "delegation-failed", `agent process timed out after ${timeoutMs}ms and was killed (SIGKILL)`, {
                     ...attestation,
                     handle: handleOut,
                 });
             }
+            // Non-timeout paths: a wrapper that ran to any normal end removed its own
+            // sidecar on exit; clear any stray file best-effort so tmp cannot grow.
+            try {
+                fs.unlinkSync(vendorPidFile);
+            }
+            catch { /* usually already gone */ }
             outcome = {
                 ...(child.error ? { spawnError: messageOf(child.error) } : {}),
                 exitCode: typeof child.status === "number" ? child.status : null,
@@ -473,12 +603,70 @@ function runAgentProcess(descriptor, policy, request, label, attestation) {
     }
     return (0, envelopes_1.refusedEnvelope)(descriptor, policy, label, "delegation-target-missing", `Backend ${descriptor.id} has no command-template or endpoint configured`, attestation);
 }
+/** Settle a completed endpoint delegation (a numeric exitCode + stdout) into
+ *  its envelope: parse the agent report, write result.md as transport when the
+ *  runner returned a body and none exists yet, record the handle. Shared by the
+ *  serial spawn path and the concurrent prepared-outcome path so the two never
+ *  drift. The result-write stays HERE (the cw shell process), never in the batch
+ *  child, so the child does no filesystem writes into the run dir. */
+function settleEndpointResult(descriptor, label, endpoint, resolvedModel, manifest, attestation, exitCode, stdout) {
+    const report = parseAgentReport(stdout);
+    if (manifest?.resultPath && report.usage === undefined) {
+        const body = extractEndpointResult(stdout);
+        if (body && !fs.existsSync(manifest.resultPath)) {
+            try {
+                fs.writeFileSync(manifest.resultPath, body, "utf8");
+            }
+            catch {
+                /* the accept layer will fail closed on a missing result.md */
+            }
+        }
+    }
+    const reportedModel = report.model && report.model.trim() ? report.model.trim() : "unreported";
+    const handleOut = recordedAgentHandle(undefined, endpoint, [], resolvedModel, reportedModel, report.usage, report.usageSignature);
+    return (0, envelopes_1.delegatedEnvelope)(descriptor, label, handleOut, { ...attestation, handle: handleOut }, "agent-endpoint", [endpoint], exitCode, stdout);
+}
 /** Agent HTTP endpoint variant — POSTs the worker manifest/prompt to a
  *  configured agent endpoint via the shared Node delegate child. Byte-exact
- *  port of src/execution-backend.ts:1002-1062. */
+ *  port of src/execution-backend.ts:1002-1062, plus a prepared-outcome branch:
+ *  in a concurrent round the POST already ran in the batch child
+ *  (runEndpointBatchOutcomes), so settle that pre-collected outcome instead of
+ *  spawning again. The serial (no prepared outcome) path is unchanged. */
 function runAgentEndpoint(descriptor, policy, request, label, resolved, attestation) {
     const endpoint = resolved.endpoint;
     const manifest = request.manifest;
+    const baseHandle = recordedAgentHandle(undefined, endpoint, [], resolved.model, "unreported");
+    // Concurrent round: the batch child already POSTed and settled this job. Any
+    // failure (network, non-2xx, poll, unparseable, timeout, no exitCode) is a
+    // spawnError; a success carries a numeric exitCode + stdout.
+    if (request.preparedAgentOutcome) {
+        const prep = request.preparedAgentOutcome;
+        if (prep.spawnError) {
+            // Match the SERIAL path's refusal wording so a concurrent round records the
+            // same reason bytes as a serial one. A per-job HTTP failure (non-2xx, poll,
+            // timeout, no exitCode) is the serial `{error}` branch — `agent endpoint
+            // error:`. A whole-batch-child process failure surfaces as
+            // reconcileBatchOutcomes' `batch delegate failed:` fallback — the serial
+            // analog is `child.error` — `agent endpoint delegation failed:`.
+            const summary = prep.spawnError.startsWith("batch delegate failed:")
+                ? `agent endpoint delegation failed: ${prep.spawnError}`
+                : `agent endpoint error: ${prep.spawnError}`;
+            return (0, envelopes_1.refusedEnvelope)(descriptor, policy, label, "delegation-failed", summary, {
+                ...attestation,
+                handle: baseHandle,
+            });
+        }
+        // Defensive: the batch child always pairs a null exitCode with a spawnError,
+        // so this is unreachable in practice — kept as a fail-closed backstop with
+        // the same wording the serial no-exitCode refusal uses.
+        if (typeof prep.exitCode !== "number") {
+            return (0, envelopes_1.refusedEnvelope)(descriptor, policy, label, "delegation-failed", `agent endpoint error: no exitCode reported`, {
+                ...attestation,
+                handle: baseHandle,
+            });
+        }
+        return settleEndpointResult(descriptor, label, endpoint, resolved.model, manifest, attestation, prep.exitCode, prep.stdout);
+    }
     const job = JSON.stringify({
         manifest,
         prompt: manifest?.prompt,
@@ -493,7 +681,6 @@ function runAgentEndpoint(descriptor, policy, request, label, resolved, attestat
         timeout: resolved.timeoutMs || 600000,
         maxBuffer: 32 * 1024 * 1024,
     });
-    const baseHandle = recordedAgentHandle(undefined, endpoint, [], resolved.model, "unreported");
     if (child.error) {
         return (0, envelopes_1.refusedEnvelope)(descriptor, policy, label, "delegation-failed", `agent endpoint delegation failed: ${messageOf(child.error)}`, {
             ...attestation,
@@ -516,20 +703,5 @@ function runAgentEndpoint(descriptor, policy, request, label, resolved, attestat
             handle: baseHandle,
         });
     }
-    const stdout = String(parsed.stdout || "");
-    const report = parseAgentReport(stdout);
-    if (manifest?.resultPath && report.usage === undefined) {
-        const body = extractEndpointResult(stdout);
-        if (body && !fs.existsSync(manifest.resultPath)) {
-            try {
-                fs.writeFileSync(manifest.resultPath, body, "utf8");
-            }
-            catch {
-                /* the accept layer will fail closed on a missing result.md */
-            }
-        }
-    }
-    const reportedModel = report.model && report.model.trim() ? report.model.trim() : "unreported";
-    const handleOut = recordedAgentHandle(undefined, endpoint, [], resolved.model, reportedModel, report.usage, report.usageSignature);
-    return (0, envelopes_1.delegatedEnvelope)(descriptor, label, handleOut, { ...attestation, handle: handleOut }, "agent-endpoint", [endpoint], parsed.exitCode, stdout);
+    return settleEndpointResult(descriptor, label, endpoint, resolved.model, manifest, attestation, parsed.exitCode, String(parsed.stdout || ""));
 }

package/dist/shell/execution-backend/container.js

@@ -7,14 +7,49 @@
 //
 // Evidence: SPEC/execution-backend.md "container driver (runContainer)".
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildContainerEnvArgs = buildContainerEnvArgs;
 exports.containerHandle = containerHandle;
 exports.runContainer = runContainer;
 const node_child_process_1 = require("node:child_process");
 const probes_1 = require("./probes");
+const local_1 = require("./local");
 const envelopes_1 = require("./envelopes");
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }
+/** buildContainerEnvArgs — build the `-e NAME=value` args passed into the
+ *  container run command. Pulled out as its own pure function so it can be
+ *  checked without a real docker/podman on the box (see local.ts's
+ *  buildChildEnv for the same shape of test-only split).
+ *
+ *  deny must win here too: an operator who sets inherit:true plus a deny
+ *  list (a valid, normalized combination — see sandbox-profile.ts's
+ *  normalizeEnv) means "everything EXCEPT these". Before this fix, deny was
+ *  never read here, so a secret like AWS_SECRET_ACCESS_KEY that the operator
+ *  named in deny still got copied into the container's `-e` args.
+ *
+ *  This backend builds its `-e` args straight from baseEnv rather than through
+ *  buildChildEnv, so it must apply CW_NEVER_FORWARD_ENV itself — otherwise
+ *  inherit:true would still copy CW's own parent-only secrets (the release
+ *  signing key, the workbench token) into the container. */
+function buildContainerEnvArgs(policy, baseEnv = process.env) {
+    const args = [];
+    if (policy.env.inherit || (policy.env.expose && policy.env.expose.length)) {
+        const deny = new Set(policy.env.deny || []);
+        for (const name of policy.env.inherit ? Object.keys(baseEnv) : policy.env.expose || []) {
+            if (name === "PATH" || name === "HOME")
+                continue;
+            if (deny.has(name))
+                continue;
+            if (local_1.CW_NEVER_FORWARD_ENV.has(name))
+                continue; // parent-only secrets never enter the container
+            const value = baseEnv[name];
+            if (value !== undefined)
+                args.push("-e", `${name}=${value}`);
+        }
+    }
+    return args;
+}
 function containerHandle(request, env = process.env) {
     const delegation = request.delegation || {};
     const image = delegation.image || (env.CW_CONTAINER_IMAGE || "").trim() || undefined;
@@ -46,20 +81,19 @@ function runContainer(descriptor, policy, request, label, handle, attestation) {
     if (policy.network.mode !== "any")
         runArgs.push("--network", "none");
     runArgs.push("-v", `${cwd}:${cwd}:ro`, "-w", cwd);
-    if (policy.env.inherit || (policy.env.expose && policy.env.expose.length)) {
-        for (const name of policy.env.inherit ? Object.keys(process.env) : policy.env.expose || []) {
-            if (name === "PATH" || name === "HOME")
-                continue;
-            const value = process.env[name];
-            if (value !== undefined)
-                runArgs.push("-e", `${name}=${value}`);
-        }
-    }
+    runArgs.push(...buildContainerEnvArgs(policy));
     runArgs.push(handle.ref, command, ...args);
     // An unset timeoutMs must not mean "no timeout" — spawnSync would then
     // block forever on a hung container with no kill path. 600000 matches the
     // agent backend's own default fallback (execution-backend/agent.ts).
-    const result = (0, node_child_process_1.spawnSync)(runtime, runArgs, { cwd, encoding: "utf8", timeout: request.timeoutMs || 600000, maxBuffer: 32 * 1024 * 1024 });
+    // killSignal SIGKILL, not the default SIGTERM: a container runtime that
+    // ignores SIGTERM would leave this blocking spawnSync waiting forever (no
+    // second-stage escalation is possible from inside a sync call), so the
+    // timeout above would not actually bound anything. SIGKILL is uncatchable,
+    // so the runtime always dies and spawnSync returns; a timed-out run is
+    // classified the same either way (status null, ETIMEDOUT message does not
+    // name the signal, result.signal is never recorded). Mirrors agent.ts.
+    const result = (0, node_child_process_1.spawnSync)(runtime, runArgs, { cwd, encoding: "utf8", timeout: request.timeoutMs || 600000, maxBuffer: 32 * 1024 * 1024, killSignal: "SIGKILL" });
     if (result.error) {
         return (0, envelopes_1.refusedEnvelope)(descriptor, policy, label, "delegation-failed", `${runtime} run failed: ${messageOf(result.error)}`, attestation);
     }

package/dist/shell/execution-backend/local.js

@@ -8,6 +8,7 @@
 //
 // Evidence: SPEC/execution-backend.md "Local execution (executeLocal)".
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CW_NEVER_FORWARD_ENV = void 0;
 exports.buildChildEnv = buildChildEnv;
 exports.checkShellGuard = checkShellGuard;
 exports.runtimeNoteFor = runtimeNoteFor;
@@ -18,6 +19,19 @@ const probes_1 = require("./probes");
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }
+/** CW's OWN secrets that must NEVER reach ANY child process — on any backend
+ *  (local/container/remote/agent), regardless of policy.env.inherit / expose /
+ *  deny. Each is read only by parent-side tooling, so no spawned child ever
+ *  needs it; stripping them here, unconditionally, is a fail-closed backstop
+ *  that does not depend on an operator remembering to list them in
+ *  policy.env.deny. Do NOT add the agent-attest private key
+ *  (CW_AGENT_ATTEST_PRIVKEY) here: the attest wrapper
+ *  (scripts/agents/cw-attest-wrap.js) is spawned AS the agent and must receive
+ *  it to sign telemetry. */
+exports.CW_NEVER_FORWARD_ENV = new Set([
+    "CW_RELEASE_VERDICT_PRIVKEY", // release verdict signing key — release-flow.js only
+    "CW_WORKBENCH_TOKEN", // workbench HTTP bearer token — workbench-host.ts only
+]);
 function buildChildEnv(policy, baseEnv = process.env) {
     // deny must win regardless of inherit: a custom profile combining
     // inherit:true with deny:[...] (a valid, normalized combination — see
@@ -38,6 +52,10 @@ function buildChildEnv(policy, baseEnv = process.env) {
     for (const name of policy.env.deny || []) {
         delete env[name];
     }
+    // Fail-closed backstop: parent-only secrets never cross into a child, even
+    // when inherit:true forwarded them above or an operator exposed one by name.
+    for (const name of exports.CW_NEVER_FORWARD_ENV)
+        delete env[name];
     return env;
 }
 /** Shell injection guard (SPEC/execution-backend.md "Local execution"): for
@@ -75,6 +93,20 @@ function executeLocal(descriptor, request, label, attestation, spawnStyle) {
         // agent backend's own default fallback (execution-backend/agent.ts).
         timeout: request.timeoutMs || 600000,
         maxBuffer: 32 * 1024 * 1024,
+        // SIGKILL, not the default SIGTERM: a child that ignores SIGTERM would
+        // leave this blocking spawnSync waiting forever (no second-stage
+        // escalation is possible from inside a sync call), so the `timeout` above
+        // would not actually bound anything. SIGKILL is uncatchable, so the child
+        // always dies and spawnSync returns. A timed-out run is classified as
+        // failed regardless of the signal (status stays null, the ETIMEDOUT
+        // message does not name the signal, and this backend never records
+        // result.signal). The exact captured stdout/stderr on a timeout is not
+        // guaranteed identical to the old SIGTERM path: a child that catches
+        // SIGTERM could flush a last partial write or exit with a code before it
+        // dies, while under SIGKILL it cannot — but that output belongs to a run
+        // we already treat as failed, so the hard kill loses nothing that counts.
+        // Mirrors execution-backend/agent.ts's fix.
+        killSignal: "SIGKILL",
     };
     if (spawnStyle === "shell") {
         checkShellGuard(command, args);

package/dist/shell/fs-atomic.js

@@ -48,6 +48,8 @@ exports.assertSafeRunId = assertSafeRunId;
 exports.realResolve = realResolve;
 exports.isContainedPath = isContainedPath;
 exports.durableAppendFileSync = durableAppendFileSync;
+exports.logEndsWithNewline = logEndsWithNewline;
+exports.nextBackoffMs = nextBackoffMs;
 exports.withFileLock = withFileLock;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -196,18 +198,55 @@ function durableAppendFileSync(file, data) {
         fs.closeSync(fd);
     }
 }
+/** True when `file`'s final byte is "\n", given its already-known `size`.
+ *  A COMPLETED `durableAppendFileSync` always leaves the file ending in
+ *  "\n" (every append is `<line>\n`), so a non-newline last byte means the
+ *  previous append was torn by a crash — its bytes were never a confirmed
+ *  record. Reads ONLY the last byte at `size-1`, so callers on an append
+ *  hot path stay O(1) and never re-read the whole file. A read failure
+ *  returns false (treat as "not newline-terminated") — the safe side: an
+ *  extra leading newline is harmless for an NDJSON reader that skips blank
+ *  lines, while a MISSED torn boundary would merge two records into one
+ *  unparseable line. Shared by trust-audit's events.jsonl and the
+ *  blackboard's messages.jsonl append paths — same file shape, same
+ *  torn-tail risk, one implementation. */
+function logEndsWithNewline(file, size) {
+    if (size <= 0)
+        return false;
+    let fd;
+    try {
+        fd = fs.openSync(file, "r");
+        const buf = Buffer.alloc(1);
+        fs.readSync(fd, buf, 0, 1, size - 1);
+        return buf[0] === 0x0a; // "\n"
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
 // ---------------------------------------------------------------------------
 // withFileLock — portable advisory cross-process lock.
 //
 // Lock file: `<targetPath>.lock`, created by hard-linking a per-attempt temp
 // file onto the lock path (single-winner `link(2)`), body `"<pid>@<ISO>\n"`.
-// Up to 240 tries; on EEXIST, a lock whose mtime is older than
-// FILE_LOCK_STALE_MS (30_000) is stolen — judged and deleted only while
-// holding the single-winner `<lock>.steal` guard (see
-// stealStaleLockUnderGuard) — and retried AT ONCE; else sleep 25ms
-// (Atomics.wait busy-safe sleep) and retry. Any non-EEXIST link error is
-// rethrown. No lock after 240 tries throws
-// `could not acquire file lock for <targetPath>`.
+// On EEXIST, a lock whose mtime is older than FILE_LOCK_STALE_MS (30_000) is
+// stolen — judged and deleted only while holding the single-winner
+// `<lock>.steal` guard (see stealStaleLockUnderGuard) — and retried AT ONCE
+// (so is a lock that vanished between the EEXIST and the stat). Otherwise the
+// thread sleeps a short, growing backoff (Atomics.wait busy-safe sleep:
+// FILE_LOCK_BACKOFF_BASE_MS doubling toward FILE_LOCK_BACKOFF_MAX_MS, with
+// jitter so many processes contending on ONE lock do not retry in lock-step)
+// and tries again. The WHOLE acquire is bounded by wall-clock, not a try
+// count: after FILE_LOCK_ACQUIRE_BUDGET_MS (~6s, kept well under the 30s steal
+// window so a fresh orphan lock fails fast rather than being waited out) with
+// no lock, it throws `could not acquire file lock for <targetPath>`. The tiny
+// early sleeps re-grab a briefly-held lock in a few ms; the wall-clock bound
+// (not the try count) is what keeps the worst case at ~6s. Any non-EEXIST
+// link error is rethrown.
 //
 // Right before fn() the lock mtime is refreshed (utimesSync, best-effort).
 // After fn() returns, the lock body is re-read: if it no longer starts with
@@ -227,15 +266,37 @@ const FILE_LOCK_FORCE_STALE_MS = FILE_LOCK_STALE_MS * 10;
 // guarded window (which is a handful of syscalls, microseconds for any live
 // process) — remove it so stealing cannot wedge forever.
 const FILE_LOCK_STEAL_GUARD_STALE_MS = FILE_LOCK_STALE_MS;
+// Acquire-retry pacing (all internal to withFileLock — no wire/protocol
+// meaning). The wall-clock BUDGET, not a fixed try count, bounds how long a
+// contended acquire blocks the calling thread; kept at ~6s so it stays well
+// under the 30s steal window (a fresh orphan lock is failed fast, not waited
+// out — a later command past 30s steals it). Between misses the thread sleeps
+// a backoff that starts at BASE and doubles to MAX, so a briefly-held lock is
+// re-grabbed in a few ms while a genuinely busy one is not hot-spun. Jitter on
+// each sleep (applied at the call site) de-syncs many contenders on one lock.
+// MAX_ATTEMPTS is only a loop-termination backstop for the (never-observed)
+// case of a clock that fails to advance; the budget is the real bound.
+const FILE_LOCK_ACQUIRE_BUDGET_MS = 6_000;
+const FILE_LOCK_BACKOFF_BASE_MS = 1;
+const FILE_LOCK_BACKOFF_MAX_MS = 50;
+const FILE_LOCK_MAX_ATTEMPTS = 10_000;
 // Lock paths this process holds right now. A nested withFileLock on the
 // SAME target runs its fn directly (re-entrant) instead of waiting on its
-// own lock file until the 240 tries run out — that lets a whole
+// own lock file until the acquire budget runs out — that lets a whole
 // load -> change -> save cycle hold one lock while the save path inside
 // it keeps its own withFileLock call unchanged.
 const HELD_LOCKS = new Set();
 function sleepSync(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
+/** Next backoff ceiling (ms) given the previous one: double it, capped at
+ *  FILE_LOCK_BACKOFF_MAX_MS. Pure and deterministic (the per-sleep jitter is
+ *  applied separately at the call site), so the retry schedule is
+ *  unit-testable without any timing. Exported for that test only — fs-atomic
+ *  is not part of the public index.ts surface. */
+function nextBackoffMs(previous) {
+    return Math.min(previous * 2, FILE_LOCK_BACKOFF_MAX_MS);
+}
 /** Whether the pid recorded in a lock body ("<pid>@<ISO>\n") is still a
  *  live process on this machine. Locks here are local-advisory only (no
  *  network-shared run directories in this tool's model), so
@@ -375,7 +436,9 @@ function withFileLock(targetPath, fn) {
     fs.mkdirSync(path.dirname(lock), { recursive: true });
     const pid = String(process.pid);
     let acquired = false;
-    for (let attempt = 0; attempt < 240 && !acquired; attempt++) {
+    const deadline = Date.now() + FILE_LOCK_ACQUIRE_BUDGET_MS;
+    let backoff = FILE_LOCK_BACKOFF_BASE_MS;
+    for (let attempt = 0; attempt < FILE_LOCK_MAX_ATTEMPTS && !acquired; attempt++) {
         // Acquire via `linkSync`, not `open(lock, "wx")`: directly testing the
         // retry loop under contention showed `open(O_CREAT|O_EXCL)` is NOT
         // reliably single-winner on every Node version this runs on — under
@@ -421,16 +484,34 @@ function withFileLock(targetPath, fn) {
                 // The steal itself runs under a single-winner guard lock — see
                 // stealStaleLockUnderGuard for why judging staleness and deleting
                 // the lock without one can never be made safe from here.
-                if (stealStaleLockUnderGuard(lock, pid, attempt))
+                if (stealStaleLockUnderGuard(lock, pid, attempt)) {
+                    // Verdict rendered and the lock likely just freed — retry AT ONCE
+                    // and reset the backoff so we grab it before another waiter does.
+                    backoff = FILE_LOCK_BACKOFF_BASE_MS;
                     continue;
+                }
                 // Guard was busy — another process is mid-steal. Back off like
-                // ordinary contention instead of hot-spinning the attempt budget.
+                // ordinary contention instead of hot-spinning.
             }
         }
         catch {
+            // The lock vanished between the EEXIST and the stat — it is likely free
+            // now, so retry AT ONCE (no sleep) with a reset backoff.
+            backoff = FILE_LOCK_BACKOFF_BASE_MS;
             continue;
         }
-        sleepSync(25);
+        // Give up on wall-clock, never on a raw try count: this keeps the worst-
+        // case block at ~6s even though the per-sleep backoff grew. Bounding by a
+        // fixed try count instead (as the old flat-25ms loop's 240 tries did)
+        // would have let the growing backoff roughly double that worst case.
+        if (Date.now() >= deadline)
+            break;
+        // Sleep a jittered span in [BASE, backoff] — never 0, so never a busy
+        // spin — then grow the backoff toward the cap. The jitter de-syncs many
+        // processes contending on the SAME lock so they do not retry in lock-step.
+        const span = backoff - FILE_LOCK_BACKOFF_BASE_MS;
+        sleepSync(FILE_LOCK_BACKOFF_BASE_MS + Math.floor(Math.random() * (span + 1)));
+        backoff = nextBackoffMs(backoff);
     }
     if (!acquired)
         throw new Error(`could not acquire file lock for ${targetPath}`);

package/dist/shell/ledger-cli.js

@@ -188,10 +188,17 @@ function ledgerApplyCli(options) {
     return (0, ledger_1.applyLedgerProposal)(parsed);
 }
 function ledgerListCli(options) {
-    const dirs = Array.isArray(options.dir) ? options.dir.map(String).filter(Boolean) : [];
+    // `--ledger-dir` is the preferred flag: the global CLI front door
+    // (cli/entry.ts) treats `--dir` as an alias of `--repo` for EVERY
+    // command, so `cw ledger list --dir X` made one flag mean two things.
+    // `--dir` keeps working unchanged as the legacy spelling; when both are
+    // given, `--ledger-dir` wins. Repeated flags become an array via
+    // parseArgv's append behavior, same as `--dir` always has.
+    const input = options["ledger-dir"] ?? options.dir;
+    const dirs = Array.isArray(input) ? input.map(String).filter(Boolean) : [];
     if (dirs.length > 1)
         return (0, ledger_io_1.unionLedgerEntries)(dirs);
-    const dir = required(dirs[0] || stringOption(options.dir), "--dir <ledger-directory>");
+    const dir = required(dirs[0] || stringOption(input), "--ledger-dir <ledger-directory>");
     return (0, ledger_io_1.listLedgerEntries)(dir);
 }
 /** MCP-facing verify/apply take the entry OBJECT directly (not a file/