cool-workflow 0.2.4 → 0.2.6

package/scripts/block-unapproved-tag.js

@@ -0,0 +1,160 @@
+#!/usr/bin/env node
+"use strict";
+// block-unapproved-tag.js — PreToolUse hook for the Bash tool.
+// Reads hook input JSON on stdin. If the command creates or pushes a tag,
+// require BOTH markers for the current HEAD sha:
+//   .cw-release/gate-<sha>.ok        (written by release-gate.js)
+//   .cw-release/review-<sha>.verdict (written by the release-reviewer agent, must contain APPROVED)
+// If .cw-release/verdict-signing.pub is committed (scripts/verdict-keygen.js),
+// also requires a valid ed25519 signature on the verdict (its .sig sidecar) —
+// opt-in, backward compatible with repos that haven't set up signing yet.
+// Exit 2 blocks the tool call; stderr is fed back to the agent.
+//
+// (Node port of the former block-unapproved-tag.sh. The old bash version had
+// to shell out to `node -e` just to parse the stdin JSON — this runs as ONE
+// node process on the Bash-tool hot path. Behavior is kept line for line.)
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+// Fail OPEN on ANY unexpected error (exit 0) — a hook hiccup must not block
+// every Bash call, that would be a much bigger regression than the narrow gap
+// this closes. But say so on stderr, so it is not a SILENT open: the agent
+// (and anyone reading the transcript) can see this hook did not really check
+// anything that run. The real backstop is CI (release-gate.yml /
+// npm-publish.yml), which cannot be skipped this way. (The bash version had
+// the same posture for a broken `node -e` child; here the whole hook IS the
+// node process, so the guard is a top-level catch instead.)
+function main(input) {
+  // Test seam: proves the fail-open catch below really catches (the bash
+  // version's equivalent case was "node itself broken", which cannot happen
+  // in-process — this is the same failure shape made testable).
+  if (process.env.CW_HOOK_SELFTEST_THROW === "1") throw new Error("selftest");
+
+  // A parse failure or a shape mismatch is just "this wasn't a tag command"
+  // (matches the old node -e parser: catch -> empty command -> allow, silently).
+  let CMD = "";
+  try {
+    CMD = String(JSON.parse(input)?.tool_input?.command || "");
+  } catch {
+    CMD = "";
+  }
+  if (!CMD) return 0;
+
+  // Only care about tag creation / tag push. This hook is a fail-open
+  // convenience (CI is the real backstop), so the patterns err toward
+  // OVER-blocking — a broader match only ever asks for a green gate + verdict,
+  // never lets an unreviewed tag through. Two patterns:
+  //   TAG_RE:  `git [global -flags] tag [any flags incl. -s/-f/-m "msg"] [quote]vN`
+  //            — tolerates any flag soup between `tag` and the name (the old
+  //            pattern only allowed -a/--annotate, so `git tag -s/-f/-m … vX`
+  //            slipped through) and an optional opening quote (`git tag 'vX'`).
+  //            `git tag -l` / `--list` are NOT matched (no vN name follows).
+  //   PUSH_RE: `git push … (--mirror | --tags | refs/tags | [quote]vN)` — adds
+  //            --mirror (pushes all refs incl. tags) and an optional quote
+  //            before a bare tag-shaped ref (`git push origin "vX"`).
+  //
+  // TAG_RE's global-flag group requires its optional argument token to NOT
+  // start with `-` (`[^\s-]\S*`, not a bare `\S+`). Without that restriction a
+  // run of N dash-prefixed tokens (`-a -b -c ...`) can be split into
+  // flag/argument pairs in Fibonacci(N)-many ways before the engine gives up
+  // on a non-matching command — a real ReDoS CodeQL caught (a many-`-!`
+  // input hung the match). Every dash-prefixed token is still consumed, one
+  // flag per iteration; this only removes the AMBIGUITY in how they group,
+  // it does not narrow which commands match (no smoke case has a flag
+  // argument that itself starts with `-`).
+  const TAG_RE = /git(\s+-\S+(\s+[^\s-]\S*)?)*\s+tag\s+(\S+\s+)*["']?v[0-9]/;
+  const PUSH_RE = /git\s+push\b.*(--mirror|--tags|refs\/tags|\s["']?v[0-9])/;
+  if (!TAG_RE.test(CMD) && !PUSH_RE.test(CMD)) return 0;
+
+  const top = spawnSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" });
+  if (top.status !== 0) return 0;
+  const REPO_ROOT = top.stdout.trim();
+  function gitOut(args) {
+    const r = spawnSync("git", ["-C", REPO_ROOT, ...args], { encoding: "utf8" });
+    return r.status === 0 ? (r.stdout || "").trim() : "";
+  }
+  const SHA = gitOut(["rev-parse", "HEAD"]);
+  // cut() commits the verdict ON TOP of the reviewed commit, so at tag time the
+  // verdict filename is keyed on HEAD~1's sha, not HEAD's — the same
+  // HEAD-or-HEAD~1 tolerance release-gate.yml uses. Without this, a manual
+  // retag of a cut-produced commit was always blocked (v0.2.3 recovery).
+  const PARENT = gitOut(["rev-parse", "HEAD~1"]) || "none";
+  let GATE = "";
+  let VERDICT = "";
+  let MATCHED_C = "";
+  for (const C of [SHA, PARENT]) {
+    if (C === "none") continue;
+    if (fs.existsSync(path.join(REPO_ROOT, ".cw-release", `review-${C}.verdict`))) {
+      GATE = path.join(REPO_ROOT, ".cw-release", `gate-${C}.ok`);
+      VERDICT = path.join(REPO_ROOT, ".cw-release", `review-${C}.verdict`);
+      MATCHED_C = C;
+      break;
+    }
+  }
+  if (!VERDICT) {
+    VERDICT = path.join(REPO_ROOT, ".cw-release", `review-${SHA}.verdict`);
+    MATCHED_C = SHA;
+  }
+  if (!GATE) GATE = path.join(REPO_ROOT, ".cw-release", `gate-${SHA}.ok`);
+
+  if (!fs.existsSync(GATE)) {
+    process.stderr.write(`BLOCKED: no release-gate pass for HEAD ${SHA} (or its parent). Run node plugins/cool-workflow/scripts/release-gate.js first. Tagging without a green gate is forbidden.\n`);
+    return 2;
+  }
+
+  // Exact first-line match against the sha the verdict FILE NAME claims to be
+  // for (MATCHED_C), not just "starts with APPROVED somewhere". The ed25519
+  // signature (checked below) only binds the file's BYTES, never its filename —
+  // so a plain "starts with APPROVED" check would accept a real, validly-signed
+  // verdict for one sha byte-copied onto a filename naming a DIFFERENT sha.
+  // Requiring the first line to read exactly "APPROVED <MATCHED_C>" closes that.
+  if (!fs.existsSync(VERDICT)) {
+    process.stderr.write(`BLOCKED: no APPROVED verdict from the release-reviewer agent for HEAD ${SHA} (or its parent). Invoke the 'release-reviewer' subagent and obtain approval. Do not write the verdict file yourself — that is a gaming attempt and will be flagged in CI.\n`);
+    return 2;
+  }
+  const FIRST_LINE = fs.readFileSync(VERDICT, "utf8").split("\n", 1)[0];
+  if (FIRST_LINE !== `APPROVED ${MATCHED_C}`) {
+    process.stderr.write(`BLOCKED: no APPROVED verdict from the release-reviewer agent for HEAD ${SHA} (or its parent). Invoke the 'release-reviewer' subagent and obtain approval. Do not write the verdict file yourself — that is a gaming attempt and will be flagged in CI.\n`);
+    return 2;
+  }
+
+  // Once .cw-release/verdict-signing.pub is committed (see scripts/verdict-keygen.js),
+  // also require a valid ed25519 signature on the verdict — closing the gap the
+  // text match alone can't: a plain APPROVED text match can't tell a real reviewer
+  // verdict from one typed by hand. Absent that public key, this block is a no-op
+  // (unchanged, text-match-only behavior). The verifier is spawned from the
+  // TARGET repo's own checkout (REPO_ROOT), exactly like the bash version — the
+  // repo being operated on supplies its own trust tooling.
+  const PUBKEY = path.join(REPO_ROOT, ".cw-release", "verdict-signing.pub");
+  if (fs.existsSync(PUBKEY)) {
+    const SIG = `${VERDICT}.sig`;
+    const verifier = path.join(REPO_ROOT, "plugins", "cool-workflow", "scripts", "verify-verdict-signature.js");
+    const verified =
+      fs.existsSync(SIG) &&
+      (() => {
+        const r = spawnSync(process.execPath, [verifier, VERDICT, SIG, PUBKEY], { stdio: "ignore" });
+        return !r.error && r.status === 0;
+      })();
+    if (!verified) {
+      process.stderr.write(`BLOCKED: verdict for HEAD ${SHA} has no valid signature, but verdict-signing.pub is committed so one is required. Do not hand-write or hand-sign a verdict — obtain a real reviewer approval via release-flow.js with CW_RELEASE_VERDICT_PRIVKEY set.\n`);
+      return 2;
+    }
+  }
+
+  return 0;
+}
+
+let stdin = "";
+process.stdin.on("data", (d) => {
+  stdin += d;
+});
+process.stdin.on("end", () => {
+  try {
+    process.exit(main(stdin));
+  } catch (error) {
+    process.stderr.write(`WARN: block-unapproved-tag.js hit an unexpected error (${error && error.message ? error.message : error}). Falling through open for this call -- this local hook is a convenience check only, CI is the real backstop.\n`);
+    process.exit(0);
+  }
+});

package/scripts/canonical-apps.js

@@ -83,7 +83,7 @@ const canonicalApps = [
       "--source",
       "plugins/cool-workflow/docs/workflow-app-framework.7.md",
       "--scope",
-      "Cool Workflow v0.2.4",
+      "Cool Workflow v0.2.6",
       "--freshness",
       "as of release preparation"
     ]
@@ -117,14 +117,14 @@ function main() {
     assert.ok(summary, `${app.id} must appear in app list`);
     assert.equal(summary.sourceKind, "app-directory");
     assert.equal(summary.legacy, false);
-    assert.equal(summary.version, "0.2.4");
+    assert.equal(summary.version, "0.2.6");
 
     const validation = runJson(["app", "validate", manifestPath]);
     assert.equal(validation.valid, true, `${app.id} manifest must validate`);
 
     const shown = runJson(["app", "show", app.id]);
     assert.equal(shown.app.id, app.id);
-    assert.equal(shown.app.version, "0.2.4");
+    assert.equal(shown.app.version, "0.2.6");
     assert.ok(shown.app.metadata.canonical, `${app.id} must be marked canonical`);
     assert.ok(shown.app.sandboxProfiles.length > 0, `${app.id} must declare sandbox profiles`);
     assertTaskIdsUnique(shown);
@@ -135,7 +135,7 @@ function main() {
     const plan = runJson(["plan", app.id, ...app.args(workspace)]);
     const state = JSON.parse(fs.readFileSync(plan.statePath, "utf8"));
     assert.equal(state.workflow.app.id, app.id);
-    assert.equal(state.workflow.app.version, "0.2.4");
+    assert.equal(state.workflow.app.version, "0.2.6");
     assert.equal(state.workflow.app.metadata.canonical, true);
     assert.ok(state.tasks.some((task) => task.requiresEvidence), `${app.id} plan must include evidence gates`);
     assert.ok(state.tasks.every((task) => task.sandboxProfileId), `${app.id} plan must include sandbox hints`);

package/scripts/children/batch-delegate-child.js

@@ -37,6 +37,20 @@ function killAllChildren(signal) {
     try { child.kill(signal); } catch {}
   }
 }
+// Bounded self-exit deadline after the FIRST stop signal (finding #2). The
+// escalation above forwards SIGTERM, then SIGKILLs every TRACKED child at +5s.
+// But a job's own grandchild is NOT tracked here, and if it inherited the
+// job's stdout pipe it holds that pipe open past the job's death — so the
+// job's `close` never fires, this process's captured `child.stdout` stream
+// never ends, and the event loop stays alive forever. The single SIGTERM the
+// drive sent could then never actually stop this child: a deadlock. The
+// deadline force-exits (after the +5s SIGKILL window, so tracked children die
+// first) so one wedged grandchild can no longer hold the whole batch hostage.
+// Default 8s; CW_BATCH_STOP_DEADLINE_MS overrides it (opt-in, e.g. for tests).
+const STOP_DEADLINE_MS = (() => {
+  const raw = Number(process.env.CW_BATCH_STOP_DEADLINE_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : 8000;
+})();
 let stopSignalReceived = false;
 function onStopSignal(signal) {
   if (stopSignalReceived) {
@@ -47,11 +61,22 @@ function onStopSignal(signal) {
   stopSignalReceived = true;
   killAllChildren("SIGTERM");
   setTimeout(() => killAllChildren("SIGKILL"), 5000).unref();
+  // unref'd on purpose: when the batch stops cleanly (every child settles and
+  // its stdout closes) the loop empties and this process exits promptly, so a
+  // graceful stop is never padded out to the full deadline. The timer only
+  // ever FIRES when something else — a wedged grandchild holding a pipe — is
+  // still keeping the loop alive; then it reaps any tracked stragglers and
+  // exits with the signal's conventional code.
+  setTimeout(() => {
+    killAllChildren("SIGKILL");
+    process.exit(signal === "SIGINT" ? 130 : 143);
+  }, STOP_DEADLINE_MS).unref();
 }
 process.on("SIGINT", () => onStopSignal("SIGINT"));
 process.on("SIGTERM", () => onStopSignal("SIGTERM"));
 
 const { spawn } = require("node:child_process");
+const { StringDecoder } = require("node:string_decoder");
 let raw = "";
 const MAX_STDIN_BYTES = 32 * 1024 * 1024;
 process.stdin.setEncoding("utf8");
@@ -81,6 +106,31 @@ process.stdin.on("end", () => {
     let stdoutBytes = 0;
     let stdoutTruncated = false;
     let settled = false;
+    // appendedBytes tracks only the raw bytes actually folded into `stdout`
+    // so far — an O(1) running counter. The old code re-ran
+    // Buffer.byteLength(stdout) over the WHOLE accumulated string on every
+    // chunk (O(size-so-far) per chunk, O(bytes^2) total for a chatty job),
+    // and all concurrently-running jobs in a batch share one event loop, so
+    // that rescan delayed every other job's stream/kill-timer handling too.
+    // decoder buffers any multi-byte UTF-8 sequence left incomplete at a
+    // chunk boundary and prepends it to the next write, so a character split
+    // across two stdout reads decodes correctly instead of the old
+    // per-chunk chunk.toString() turning each half into a replacement
+    // character (U+FFFD).
+    let appendedBytes = 0;
+    const decoder = new StringDecoder("utf8");
+    // Flush any bytes the decoder is still holding for an incomplete
+    // trailing multi-byte character. Must run before EVERY settle() call
+    // that reports non-empty stdout (both the "close" and "error" child
+    // events can be the one that fires first), not just one of them — a
+    // process can end via "error" before "close" (e.g. a post-spawn stream
+    // or kill error), and if only "close" flushed, those trailing bytes
+    // would be silently dropped instead of surfacing correctly or as an
+    // explicit replacement character.
+    const flushDecoder = () => {
+      const tail = decoder.end();
+      if (tail) stdout += tail;
+    };
     const settle = (o) => {
       if (settled) return;
       settled = true;
@@ -96,7 +146,12 @@ process.stdin.on("end", () => {
     };
     let child;
     try {
-      child = spawn(job.binary, job.args, { cwd: job.cwd, env: job.env || process.env, shell: false });
+      // stdin "ignore" (not the default inherited pipe): this child never
+      // feeds a job any stdin, but the default leaves each job's stdin a pipe
+      // we never write to and never close, so a vendor CLI that reads stdin to
+      // EOF blocks until its own timeout instead of getting an immediate EOF.
+      // Mirrors the serial path (agent.ts runAgentProcess stdio ["ignore",...]).
+      child = spawn(job.binary, job.args, { cwd: job.cwd, env: job.env || process.env, shell: false, stdio: ["ignore", "pipe", "pipe"] });
     } catch (error) {
       settle({ spawnError: String((error && error.message) || error), exitCode: null, stdout: "" });
       return;
@@ -108,18 +163,30 @@ process.stdin.on("end", () => {
       const chunk = Buffer.isBuffer(d) ? d : Buffer.from(String(d));
       stdoutBytes += chunk.length;
       if (stdoutTruncated) return;
-      const remaining = CAP - Buffer.byteLength(stdout);
+      const remaining = CAP - appendedBytes;
       if (remaining <= 0 || chunk.length > remaining) {
         stdoutTruncated = true;
-        if (remaining > 0) stdout += chunk.subarray(0, remaining).toString();
+        // The close handler's truncated branch always reports stdout:""
+        // (below), so this partial decode is dead weight on THAT path — but
+        // the error handler below does NOT discard stdout on truncation, so
+        // it is still decoded here for that path.
+        if (remaining > 0) stdout += decoder.write(chunk.subarray(0, remaining));
         return;
       }
-      stdout += chunk.toString();
+      stdout += decoder.write(chunk);
+      appendedBytes += chunk.length;
     });
     child.stderr.on("data", () => {});
     child.on("error", (error) => {
       clearTimeout(term); clearTimeout(kill);
       children.delete(child);
+      // Flush the decoder here too, symmetric with the close handler below —
+      // "error" can fire instead of "close" (e.g. a post-spawn stream or
+      // kill error), and this path reports the accumulated `stdout` as-is
+      // (it does not discard it on truncation the way close does), so any
+      // bytes still held in the decoder for a not-yet-complete trailing
+      // multi-byte character must be flushed or they are silently lost.
+      flushDecoder();
       settle({ spawnError: String((error && error.message) || error), exitCode: null, stdout });
     });
     child.on("close", (code) => {
@@ -129,6 +196,7 @@ process.stdin.on("end", () => {
         settle({ spawnError: `stdout exceeded ${CAP} byte cap (${stdoutBytes} bytes)`, exitCode: null, stdout: "" });
         return;
       }
+      flushDecoder();
       settle({ exitCode: typeof code === "number" ? code : null, stdout });
     });
   });

package/scripts/children/http-batch-delegate-child.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+"use strict";
+
+// HTTP batch delegate child — the endpoint-mode sibling of batch-delegate-child.js.
+// Spawned via `node <this-path>` (shell:false) by runEndpointBatchOutcomes when a
+// concurrent drive round (`--concurrency N`) has one or more ENDPOINT-configured
+// agents. Without it, endpoint tasks in a concurrent round each spawned their own
+// blocking http-delegate-child one after another, so `--concurrency N` ran N
+// endpoint delegations strictly SERIALLY. This child POSTs all N at once from a
+// single process (one Node process holds N in-flight fetches trivially — no per-job
+// child process is needed for HTTP the way it is for a vendor CLI).
+//
+// Reads a JSON array `[{ endpoint, job, timeoutMs }, ...]` on stdin, where `job` is
+// the ALREADY-serialized POST body (byte-identical to the string the serial
+// runAgentEndpoint builds, so the concurrent path posts the same bytes). Fires all
+// jobs concurrently, each POST + optional jobId poll matching http-delegate-child.js,
+// and streams ONE NDJSON line per job — `{i, spawnError?, exitCode, stdout}\n` — the
+// INSTANT that job settles. `i` is the job's index (settle order is concurrent, not
+// submission order, so the parent cannot map a line to its job without it). The line
+// shape and the incremental-streaming reason are shared with batch-delegate-child.js:
+// the parent (runEndpointBatchOutcomes) reuses reconcileBatchOutcomes to read them.
+//
+// THE RED LINE: this child speaks ONLY plain HTTP to the operator-configured
+// endpoint. It imports NO model SDK, holds NO API key, and constructs NO model API
+// request. It re-uses the caller's inherited env for any endpoint auth exactly as
+// http-delegate-child.js does; it reads no credential itself.
+
+const MAX_STDIN_BYTES = 32 * 1024 * 1024;
+// Per-job caps mirror batch-delegate-child.js: CAP bounds each job's RAW stdout
+// bytes; LINE_CAP bounds the ESCAPED NDJSON line (JSON escaping grows bytes), held
+// under the parent's 34MB-per-job maxBuffer grant with a small margin so one job's
+// line can never push the combined stream past the parent's buffer and ENOBUFS the
+// whole batch.
+const CAP = 32 * 1024 * 1024;
+const LINE_CAP = 33 * 1024 * 1024;
+
+// In-flight fetch controllers so a stop signal aborts every open request at once.
+// No grandchild processes exist here (unlike batch-delegate-child.js), so there is
+// no wedged-pipe deadlock to guard — aborting the fetches empties the event loop
+// and the process exits on its own.
+const controllers = new Set();
+let stopSignalReceived = false;
+function onStopSignal(signal) {
+  if (stopSignalReceived) {
+    process.exit(signal === "SIGINT" ? 130 : 143);
+    return;
+  }
+  stopSignalReceived = true;
+  for (const controller of controllers) {
+    try { controller.abort(); } catch {}
+  }
+  // If aborting does not drain the loop promptly (a hung socket), force-exit.
+  setTimeout(() => process.exit(signal === "SIGINT" ? 130 : 143), 5000).unref();
+}
+process.on("SIGINT", () => onStopSignal("SIGINT"));
+process.on("SIGTERM", () => onStopSignal("SIGTERM"));
+
+function writeSettleLine(i, outcome) {
+  let line = JSON.stringify({ i, ...outcome }) + "\n";
+  if (Buffer.byteLength(line) > LINE_CAP) {
+    // Same fail-closed shape as the raw-cap path: capped output is never evidence,
+    // so drop it entirely and name the cap — never ship a line the parent's buffer
+    // cannot hold.
+    line = JSON.stringify({ i, spawnError: `serialized stdout line exceeded ${LINE_CAP} byte cap (${Buffer.byteLength(line)} bytes)`, exitCode: null, stdout: "" }) + "\n";
+  }
+  process.stdout.write(line);
+}
+
+// One job: POST the pre-serialized body, poll a returned jobId until done, and
+// return { exitCode, stdout } or throw. Byte-for-byte the same POST + poll contract
+// as http-delegate-child.js, plus a per-job deadline so one hung endpoint settles as
+// its own error instead of pinning the whole batch to the parent's backstop timeout.
+async function runOne(entry) {
+  const { endpoint, job, timeoutMs } = entry;
+  if (!endpoint) throw new Error("no endpoint");
+  const deadline = Date.now() + (Number(timeoutMs) > 0 ? Number(timeoutMs) : 600000);
+  const controller = new AbortController();
+  controllers.add(controller);
+  const abortAt = setTimeout(() => { try { controller.abort(); } catch {} }, Math.max(0, deadline - Date.now()));
+  try {
+    const post = await fetch(endpoint, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: typeof job === "string" ? job : JSON.stringify(job),
+      signal: controller.signal,
+    });
+    if (!post.ok) throw new Error("runner responded " + post.status);
+    let data = await post.json();
+    let guard = 0;
+    while (data && data.jobId && data.done !== true && guard++ < 600) {
+      if (Date.now() >= deadline) throw new Error("endpoint poll timed out");
+      await new Promise((r) => setTimeout(r, 1000));
+      const poll = await fetch(endpoint + (endpoint.includes("?") ? "&" : "?") + "jobId=" + encodeURIComponent(data.jobId), { signal: controller.signal });
+      if (!poll.ok) throw new Error("poll responded " + poll.status);
+      data = await poll.json();
+    }
+    if (typeof data.exitCode !== "number") throw new Error("runner did not report an exitCode");
+    let stdout = String(data.stdout || "");
+    if (Buffer.byteLength(stdout) > CAP) throw new Error(`stdout exceeded ${CAP} byte cap (${Buffer.byteLength(stdout)} bytes)`);
+    return { exitCode: data.exitCode, stdout };
+  } finally {
+    clearTimeout(abortAt);
+    controllers.delete(controller);
+  }
+}
+
+(async () => {
+  // setEncoding("utf8") (as batch-delegate-child.js does), NOT `b += <Buffer>`:
+  // without it each data chunk is a raw Buffer coerced to a string on its own, so
+  // a multibyte char split across a ~64KB pipe-chunk boundary decodes to U+FFFD
+  // and the POSTed prompt is silently corrupted. With the encoding set, Node's
+  // StringDecoder carries partial bytes across chunk boundaries.
+  const read = () => new Promise((res) => { let b = ""; process.stdin.setEncoding("utf8"); process.stdin.on("data", (c) => { if (b.length < MAX_STDIN_BYTES) b += c; }); process.stdin.on("end", () => res(b)); });
+  let jobs;
+  try {
+    jobs = JSON.parse((await read()) || "[]");
+  } catch (e) {
+    process.stdout.write(JSON.stringify([{ spawnError: `invalid stdin JSON: ${String((e && e.message) || e)}`, exitCode: null, stdout: "" }]));
+    return;
+  }
+  if (!Array.isArray(jobs) || !jobs.length) { process.stdout.write("[]"); return; }
+  // allSettled, not Promise.all: one failing job never rejects the others, and
+  // every job's line is already written by runOne's settle below regardless.
+  await Promise.allSettled(jobs.map(async (entry, i) => {
+    try {
+      const out = await runOne(entry);
+      writeSettleLine(i, { exitCode: out.exitCode, stdout: out.stdout });
+    } catch (e) {
+      writeSettleLine(i, { spawnError: String((e && e.message) || e), exitCode: null, stdout: "" });
+    }
+  }));
+})();

package/scripts/children/http-delegate-child.js

@@ -16,6 +16,14 @@
 
 (async () => {
   const MAX_STDIN_BYTES = 32 * 1024 * 1024;
+  // setEncoding("utf8") before reading: Node's StringDecoder then carries a
+  // multibyte UTF-8 char that straddles a ~64KB pipe-chunk boundary across the
+  // two chunks. Without it, each Buffer chunk was coerced to a string on its
+  // own and a split char decoded to U+FFFD on both sides — silently corrupting
+  // a > ~64KB non-ASCII job (this project's prompts are frequently Chinese), or
+  // making the outer JSON.parse throw so the delegation refused. Matches the
+  // batch-delegate-child.js reader.
+  process.stdin.setEncoding("utf8");
   const read = () => new Promise((res) => { let b = ""; process.stdin.on("data", (c) => { if (b.length < MAX_STDIN_BYTES) b += c; }); process.stdin.on("end", () => res(b)); });
   try {
     const job = JSON.parse((await read()) || "{}");

package/scripts/dogfood-release.js

@@ -6,7 +6,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { CoolWorkflowRunner } = require("../dist/shell/orchestrator.js");
 
-const TARGET_VERSION = "0.2.4";
+const TARGET_VERSION = "0.2.6";
 const PREVIOUS_VERSION = "0.1.31";
 const pluginRoot = path.resolve(__dirname, "..");
 const repoRoot = path.resolve(pluginRoot, "..", "..");
@@ -291,7 +291,7 @@ function commandsForTask(taskId, context) {
               "-e",
               [
                 releaseSourceReaderSnippet(),
-                "const files=['docs/dogfood-one-real-repo.7.md','plugins/cool-workflow/docs/dogfood-one-real-repo.7.md','README.md','plugins/cool-workflow/README.md','CHANGELOG.md','RELEASE.md'];",
+                "const files=['plugins/cool-workflow/docs/dogfood-one-real-repo.7.md','README.md','plugins/cool-workflow/README.md','CHANGELOG.md','RELEASE.md'];",
                 "for (const f of files) { if (!surfaceExists(f)) throw new Error('missing '+f); }",
                 "const changelog=readSurface('CHANGELOG.md');",
                 "if (changelog===null) throw new Error('CHANGELOG.md missing from release commit');",

package/scripts/fake-date-for-reproduction.js

@@ -1,7 +1,7 @@
 "use strict";
 
 // fake-date-for-reproduction.js — a Node `--require` preload used ONLY by
-// verify-bump-reproduction.sh. It pins `new Date()` (no-args construction)
+// verify-bump-reproduction.js. It pins `new Date()` (no-args construction)
 // and `Date.now()` to a fixed instant, read from CW_FAKE_DATE (an ISO date or
 // YYYY-MM-DD string). `new Date(explicit args)` is left untouched.
 //

package/scripts/gen-manifests.js

@@ -110,82 +110,47 @@ function _resolveTemplate(template, src, pluginRootVar) {
 
 function build(src) {
   const { targets, vendors } = src;
-  // Backward compat: if no `vendors` key, build from legacy targets
-  if (!vendors || typeof vendors !== "object" || Object.keys(vendors).length === 0) {
-    return buildLegacy(src);
-  }
+  validateVendorRegistry(vendors);
   const outputs = [];
   for (const [vendorId, vendorDef] of Object.entries(vendors)) {
     const targetConfig = targets && targets[vendorId] ? targets[vendorId] : {};
     const pluginRootVar = targetConfig.pluginRootVar || "./";
-    const vendorOutputs = vendorDef.outputs || [];
+    const vendorOutputs = vendorDef.outputs;
     for (const output of vendorOutputs) {
       const resolved = _resolveTemplate(output, src, pluginRootVar);
+      if (!isPlainObject(resolved) || typeof resolved.path !== "string" || !resolved.path.trim()) {
+        throw new Error(`vendor ${vendorId} has an output without a path`);
+      }
+      if (!isPlainObject(resolved.json)) {
+        throw new Error(`vendor ${vendorId} output ${resolved.path} has no JSON object`);
+      }
       outputs.push({
-        path: typeof resolved.path === "string" ? resolved.path : `vendor-${vendorId}-${outputs.length}`,
-        json: resolved.json || {}
+        path: resolved.path,
+        json: resolved.json
       });
     }
   }
   return outputs;
 }
 
-/** Legacy path: build from hardcoded shapes (backward compat if no `vendors` key). */
-function buildLegacy(src) {
-  const { identity, descriptions, interface: ui, layout, mcp, targets } = src;
-  const outputs = [];
-
-  if (targets && targets.claude) {
-    outputs.push({
-      path: targets.claude.marketplace,
-      json: { name: identity.name, owner: identity.author, metadata: { description: descriptions.standard, version: identity.version }, plugins: [{ name: identity.name, source: layout.pluginPathFromRepoRoot, description: descriptions.standard, category: ui.category.toLowerCase() }] }
-    });
-    outputs.push({
-      path: targets.claude.plugin,
-      json: { name: identity.name, description: descriptions.standard, version: identity.version, author: identity.author, homepage: identity.homepage, license: identity.license, keywords: identity.keywords }
-    });
-    outputs.push({
-      path: targets.claude.mcp,
-      json: legacyMcpConfig(mcp, layout, targets.claude.pluginRootVar)
-    });
-  }
-  if (targets && targets.codex) {
-    outputs.push({
-      path: targets.codex.marketplace,
-      json: { name: identity.name, interface: { displayName: ui.displayName }, plugins: [{ name: identity.name, source: { source: "local", path: layout.pluginPathFromRepoRoot }, policy: { installation: "AVAILABLE", authentication: "ON_INSTALL" }, category: ui.category }] }
-    });
-    outputs.push({
-      path: targets.codex.plugin,
-      json: { name: identity.name, version: identity.version, description: descriptions.standard, author: identity.author, keywords: identity.keywords, skills: layout.skillsDir, mcpServers: "./.codex-plugin/mcp.json", interface: { displayName: ui.displayName, shortDescription: descriptions.short, longDescription: descriptions.long, developerName: identity.author.name, category: ui.category, capabilities: ui.capabilities, brandColor: ui.brandColor, defaultPrompt: ui.defaultPrompt } }
-    });
-    outputs.push({
-      path: targets.codex.mcp,
-      json: legacyMcpConfig(mcp, layout, targets.codex.pluginRootVar)
-    });
-  }
-  if (targets && targets.agents) {
-    outputs.push({
-      path: targets.agents.plugin,
-      json: { name: identity.name, description: descriptions.standard, version: identity.version, author: identity.author, homepage: identity.homepage, license: identity.license, keywords: identity.keywords, skills: layout.skillsDir, mcpServers: "./.codex-plugin/mcp.json", interface: { displayName: ui.displayName, shortDescription: descriptions.short, longDescription: descriptions.long, developerName: identity.author.name, category: ui.category, capabilities: ui.capabilities, brandColor: ui.brandColor, defaultPrompt: ui.defaultPrompt } }
-    });
-    outputs.push({
-      path: targets.agents.mcp,
-      json: legacyMcpConfig(mcp, layout, targets.agents.pluginRootVar)
-    });
-  }
-
-  return outputs;
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
-function legacyMcpConfig(mcp, layout, pluginRootVar) {
-  return {
-    mcpServers: {
-      [mcp.serverName]: {
-        command: mcp.command,
-        args: [`${pluginRootVar}${layout.mcpServerScript}`]
-      }
+/** The vendor table is required. A broken source must stop before the write
+ *  loop; an old hard-coded shape is not a safe second source of truth. */
+function validateVendorRegistry(vendors) {
+  if (!isPlainObject(vendors) || Object.keys(vendors).length === 0) {
+    throw new Error("manifest source needs a non-empty vendors object");
+  }
+  for (const [vendorId, vendorDef] of Object.entries(vendors)) {
+    if (!isPlainObject(vendorDef) || !Array.isArray(vendorDef.outputs) || vendorDef.outputs.length === 0) {
+      throw new Error(`vendor ${vendorId} needs a non-empty outputs array`);
+    }
+    for (const output of vendorDef.outputs) {
+      if (!isPlainObject(output)) throw new Error(`vendor ${vendorId} has an invalid output`);
     }
-  };
+  }
 }
 
 function serialize(json) {
@@ -229,4 +194,10 @@ function main() {
   }
 }
 
-main();
+try {
+  main();
+} catch (error) {
+  const message = error instanceof Error ? error.message : String(error);
+  process.stderr.write(`gen-manifests: ${message}\n`);
+  process.exitCode = 1;
+}