cool-workflow 0.2.4 → 0.2.6

package/scripts/verify-bump-reproduction.js

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+"use strict";
+// verify-bump-reproduction.js — closes the HEAD~1 verdict-replay bypass.
+//
+// release-gate.yml / npm-publish.yml tolerate a verdict written for the tag
+// commit's PARENT (release-flow.js's cut() reviews content, then adds a
+// mechanical version-bump + the verdict as a NEW child commit that actually
+// gets tagged). A validly-signed verdict at the parent proves someone once
+// approved THAT commit — it does NOT prove the child (the thing actually being
+// tagged) is the deterministic bump cut() would have produced, rather than an
+// attacker's own commit smuggling in arbitrary changes on top of an old,
+// genuinely-approved parent (a real signature on a REPLAYED verdict).
+//
+// This script independently reproduces the bump: checks out the approved
+// parent into a scratch worktree, runs the SAME bump:version/sync:project-index
+// steps cut() runs, stages the SAME way cut() stages (git add -u + the
+// explicit verdict/.sig paths, never -A), and requires the resulting tree to
+// match the ACTUAL tagged commit's tree byte-for-byte. Any difference —
+// anywhere, including a single added file — fails closed.
+//
+// (Node port of the former verify-bump-reproduction.sh; behavior kept line
+// for line — same steps, same messages, same exit map.)
+//
+// Usage: verify-bump-reproduction.js <approved-parent-sha> <tagged-sha> <verdict-repo-relative-path> [sig-repo-relative-path]
+//
+// Exit 0: the tagged commit's tree matches the reproduced bump exactly.
+// Exit 1: mismatch, or any step failed (install, bump, sync, worktree, etc).
+
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+// Where THIS SCRIPT ITSELF lives — distinct from REPO_ROOT (the git repo being
+// operated ON, resolved below from the invocation cwd). These coincide in
+// ordinary production use (the script runs from within the same checkout it
+// verifies), but conflating them is wrong: REPO_ROOT could be an ARBITRARY git
+// context (e.g. a test harness's throwaway clone of old history, which never
+// has this script's own sibling files, since they postdate whatever was
+// cloned). Sibling files this script depends on must be found relative to
+// where it is installed, never relative to the repo it happens to be pointed at.
+const SCRIPT_DIR = __dirname;
+
+function err(msg) {
+  process.stderr.write(`${msg}\n`);
+}
+
+const [, , PARENT, TAGGED, VERDICT_REL, SIG_REL = ""] = process.argv;
+if (!PARENT || !TAGGED || !VERDICT_REL) {
+  err("usage: verify-bump-reproduction.js <parent-sha> <tagged-sha> <verdict-rel-path> [sig-rel-path]");
+  process.exit(1);
+}
+
+function run(cmd, args, opts = {}) {
+  return spawnSync(cmd, args, { encoding: "utf8", ...opts });
+}
+function gitIn(dir, args, opts = {}) {
+  return run("git", ["-C", dir, ...args], opts);
+}
+
+const top = run("git", ["rev-parse", "--show-toplevel"]);
+if (top.status !== 0) process.exit(1);
+const REPO_ROOT = top.stdout.trim();
+
+const SCRATCH_PARENT = fs.mkdtempSync(path.join(os.tmpdir(), "cw-bump-repro-"));
+const SCRATCH = path.join(SCRATCH_PARENT, "wt");
+function cleanup() {
+  gitIn(REPO_ROOT, ["worktree", "remove", "--force", SCRATCH], { stdio: "ignore" });
+  fs.rmSync(SCRATCH_PARENT, { recursive: true, force: true });
+}
+
+function main() {
+  const wt = gitIn(REPO_ROOT, ["worktree", "add", "--quiet", "--detach", SCRATCH, PARENT], { stdio: "ignore" });
+  if (wt.status !== 0) {
+    err(`verify-bump-reproduction: could not create a scratch worktree at ${PARENT}`);
+    return 1;
+  }
+
+  // The target version comes from the TAGGED commit (not the parent, which may
+  // still be pre-bump) — read via git plumbing, no separate checkout needed.
+  const pkgShow = gitIn(REPO_ROOT, ["show", `${TAGGED}:plugins/cool-workflow/package.json`]);
+  let VERSION = "";
+  if (pkgShow.status === 0) {
+    try {
+      VERSION = JSON.parse(pkgShow.stdout).version || "";
+    } catch {
+      VERSION = "";
+    }
+  }
+  if (!VERSION) {
+    err(`verify-bump-reproduction: could not read package.json version from tagged commit ${TAGGED}`);
+    return 1;
+  }
+
+  // sync-project-index.js embeds a wall-clock "Generated on <date>" line. Pin it
+  // to the TAGGED commit's own committer date (UTC) via a Node --require preload
+  // that overrides the global Date constructor (fake-date-for-reproduction.js),
+  // NOT an application-level env var: the scratch worktree runs the APPROVED
+  // PARENT's OWN checked-out copy of sync-project-index.js, which for every
+  // release cut before this mechanism existed has no idea any such env var is
+  // meant to be read — an app-level opt-in is a no-op against code that doesn't
+  // know to opt in, so it can only ever "work" for releases cut after the
+  // mechanism landed (confirmed empirically: re-running an already-shipped
+  // release's real approved-parent/tagged pair on a later calendar day produced
+  // a tree mismatch whose ONLY diff was that one date line). A global override
+  // of the Date constructor, injected before any application code runs, is
+  // transparent to the code being executed regardless of which version it is.
+  const dateShow = gitIn(REPO_ROOT, ["show", "-s", "--format=%cd", "--date=format-local:%Y-%m-%d", TAGGED], {
+    env: { ...process.env, TZ: "UTC" },
+  });
+  const CUT_DATE = dateShow.status === 0 ? dateShow.stdout.trim() : "";
+  if (!CUT_DATE) {
+    err("verify-bump-reproduction: could not read the tagged commit's committer date");
+    return 1;
+  }
+  const FAKE_DATE_PRELOAD = path.join(SCRIPT_DIR, "fake-date-for-reproduction.js");
+
+  // Each step's exit code is checked EXPLICITLY and immediately (not via one
+  // combined chain) — a chain's overall success can silently survive an earlier
+  // step's failure if a future edit ever loosens it, which would flip this
+  // fail-closed gate to fail-open without changing its outward shape.
+  // stdout/stderr from each step are captured (not discarded) so a real
+  // failure — a transient npm registry hiccup vs. an actual reproduction
+  // mismatch — is distinguishable in the workflow log instead of both
+  // collapsing into the same generic message.
+  const stepCwd = path.join(SCRATCH, "plugins", "cool-workflow");
+  const stepEnv = {
+    ...process.env,
+    NODE_OPTIONS: `--require ${FAKE_DATE_PRELOAD}`,
+    CW_FAKE_DATE: CUT_DATE,
+  };
+  function runStep(label, cmd, args) {
+    const r = run(cmd, args, { cwd: stepCwd, env: stepEnv });
+    const out = (r.stdout || "") + (r.stderr || "");
+    const code = r.error ? 1 : r.status;
+    if (code !== 0) {
+      err(`verify-bump-reproduction: ${label} failed (exit ${code}):`);
+      err(out);
+      return false;
+    }
+    return true;
+  }
+
+  const bumpOk =
+    runStep("npm install", "npm", ["install", "--no-package-lock", "--ignore-scripts"]) &&
+    runStep("bump:version", "npm", ["run", "bump:version", "--", VERSION]) &&
+    runStep("sync:project-index", "npm", ["run", "sync:project-index", "--", "--repo-only"]);
+  if (!bumpOk) {
+    err(`verify-bump-reproduction: reproducing the bump for ${PARENT} -> v${VERSION} failed`);
+    return 1;
+  }
+
+  fs.mkdirSync(path.join(SCRATCH, ".cw-release"), { recursive: true });
+  try {
+    fs.copyFileSync(path.join(REPO_ROOT, VERDICT_REL), path.join(SCRATCH, VERDICT_REL));
+  } catch {
+    return 1;
+  }
+  if (SIG_REL && fs.existsSync(path.join(REPO_ROOT, SIG_REL))) {
+    try {
+      fs.copyFileSync(path.join(REPO_ROOT, SIG_REL), path.join(SCRATCH, SIG_REL));
+    } catch {
+      return 1;
+    }
+  }
+
+  // Mirror cut()'s OWN staging exactly (git-add -u + the explicit verdict/.sig
+  // paths) — never -A, so an untracked stray left by npm/tooling in the scratch
+  // worktree can never silently ride into what we compare.
+  gitIn(SCRATCH, ["add", "-u"]);
+  gitIn(SCRATCH, ["add", "--", VERDICT_REL]);
+  if (SIG_REL && fs.existsSync(path.join(SCRATCH, SIG_REL))) {
+    gitIn(SCRATCH, ["add", "--", SIG_REL]);
+  }
+
+  const EXPECTED_TREE = gitIn(SCRATCH, ["write-tree"]).stdout.trim();
+  const ACTUAL_TREE = gitIn(REPO_ROOT, ["rev-parse", `${TAGGED}^{tree}`]).stdout.trim();
+
+  if (EXPECTED_TREE !== ACTUAL_TREE) {
+    err(`verify-bump-reproduction: ${TAGGED}'s tree (${ACTUAL_TREE}) does not match the deterministic bump reproduced from approved parent ${PARENT} (${EXPECTED_TREE}) — refusing`);
+    return 1;
+  }
+
+  return 0;
+}
+
+let code = 1;
+try {
+  code = main();
+} finally {
+  cleanup();
+}
+process.exit(code);

package/scripts/verify-release-verdict.js

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+"use strict";
+// verify-release-verdict.js — the one true "find a signed, committed release
+// verdict for this commit" check. Both CI workflows call it:
+//   .github/workflows/release-gate.yml   (cwd = repo root)
+//   .github/workflows/npm-publish.yml    (cwd = plugins/cool-workflow)
+// Before this file, each workflow kept its own ~35-line bash copy of this
+// same loop, and the two copies could drift apart. Now the logic lives here
+// only, and each workflow step is one line.
+//
+// One more win: a GitHub Actions `run:` step prints its FULL script text to
+// the log before it runs. With the old inline bash, the "::error::" lines of
+// the fail branch were printed on EVERY run — even a fully green one — and
+// GitHub's log UI marked them red, which made a good release look bad. With
+// a one-line `run:`, the "::error::" text only ever gets printed when this
+// script truly fails.
+//
+// WHY the check is shaped this way (was: near-same comments in both YAMLs):
+// The tag commit itself bumps version/changelog; the reviewed sha is its
+// parent. So a verdict for HEAD or HEAD~1 is accepted. But a validly-signed
+// verdict for the PARENT alone does not prove HEAD is the same mechanical
+// bump release-flow.js's cut() would have made on top of the approved
+// parent — it could be an attacker's own commit smuggling in changes on top
+// of an old, truly-approved parent, replaying that parent's already-public
+// verdict + signature (public git objects; no secret is needed to copy
+// them). So when the match is at HEAD~1, HEAD must ALSO reproduce exactly
+// as the deterministic bump (verify-bump-reproduction.js).
+//
+// The pubkey is read from origin/main, NOT from the checked-out tree. The
+// checked-out tree IS the commit under test — an attacker's tag could just
+// delete .cw-release/verdict-signing.pub and fall back to a no-signature
+// check. origin/main is a ref the tag being judged cannot rewrite. Until a
+// pubkey is committed there, this stays a first-line-only text check
+// (opt-in, backward compatible — see scripts/verdict-keygen.js).
+//
+// cwd does not matter: everything is anchored on
+// `git rev-parse --show-toplevel`, and the two helper scripts are loaded
+// from this script's own directory (never from the repo under test).
+//
+// Usage: verify-release-verdict.js [--context "<one sentence for the fail message>"]
+// Exit 0: a valid verdict was found. Exit 1: none found — the two
+// "::error::" lines are printed here and nowhere else.
+
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+// Where THIS SCRIPT lives — the helper scripts are siblings of the installed
+// script, never files of the (possibly throwaway) repo being checked. Same
+// rule as in verify-bump-reproduction.js.
+const VERIFY_SIG = path.join(__dirname, "verify-verdict-signature.js");
+const VERIFY_BUMP = path.join(__dirname, "verify-bump-reproduction.js");
+
+function git(args) {
+  const r = spawnSync("git", args, { encoding: "utf8" });
+  return r.status === 0 ? r.stdout.trim() : "";
+}
+
+function main() {
+  let context = "The release flow was bypassed.";
+  const argv = process.argv.slice(2);
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === "--context" && argv[i + 1]) context = argv[++i];
+  }
+
+  const REPO_ROOT = git(["rev-parse", "--show-toplevel"]);
+  if (!REPO_ROOT) {
+    process.stderr.write("verify-release-verdict: not inside a git repo\n");
+    return 1;
+  }
+
+  const SHA = git(["-C", REPO_ROOT, "rev-parse", "HEAD^{commit}"]);
+  if (!SHA) {
+    process.stderr.write("verify-release-verdict: could not resolve HEAD\n");
+    return 1;
+  }
+  const PARENT = git(["-C", REPO_ROOT, "rev-parse", "HEAD~1"]) || "none";
+
+  let PUBKEY = "";
+  const pk = spawnSync("git", ["-C", REPO_ROOT, "show", "origin/main:.cw-release/verdict-signing.pub"], {
+    encoding: "utf8",
+  });
+  if (pk.status === 0 && pk.stdout.trim() !== "") {
+    PUBKEY = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "cw-verdict-pub-")), "verdict-signing.pub");
+    fs.writeFileSync(PUBKEY, pk.stdout);
+  }
+
+  for (const C of [SHA, PARENT]) {
+    if (C === "none") continue;
+    const VERDICT_REL = `.cw-release/review-${C}.verdict`;
+    const VERDICT = path.join(REPO_ROOT, VERDICT_REL);
+    if (!fs.existsSync(VERDICT)) continue;
+    // The first line must say EXACTLY "APPROVED <this candidate's sha>". A
+    // starts-with check is not enough: the signature binds the BYTES, never
+    // the file NAME, so a real signed verdict for some other sha could be
+    // parked under this candidate's filename and still verify.
+    const FIRST_LINE = fs.readFileSync(VERDICT, "utf8").split("\n", 1)[0];
+    if (FIRST_LINE !== `APPROVED ${C}`) continue;
+
+    if (PUBKEY) {
+      const SIG_REL = `${VERDICT_REL}.sig`;
+      const SIG = path.join(REPO_ROOT, SIG_REL);
+      const sigOk =
+        fs.existsSync(SIG) &&
+        spawnSync(process.execPath, [VERIFY_SIG, VERDICT, SIG, PUBKEY], { stdio: "inherit" }).status === 0;
+      if (sigOk) {
+        if (C !== SHA) {
+          const bump = spawnSync(process.execPath, [VERIFY_BUMP, C, SHA, VERDICT_REL, SIG_REL], {
+            cwd: REPO_ROOT,
+            stdio: "inherit",
+          });
+          if (bump.status !== 0) {
+            console.log(
+              `verdict for ${C} has a valid signature but HEAD does not reproduce as its deterministic bump — trying the other candidate`
+            );
+            continue;
+          }
+        }
+        console.log(`verdict found + signature verified for ${C}`);
+        return 0;
+      }
+      console.log(`verdict for ${C} has no valid signature — trying the other candidate`);
+      continue;
+    }
+    console.log(`verdict found for ${C} (no verdict-signing.pub committed yet — signature not required)`);
+    return 0;
+  }
+
+  console.log(
+    `::error::No committed APPROVED verdict for this tag (with a valid signature, if .cw-release/verdict-signing.pub is committed). ${context}`
+  );
+  console.log(
+    "::error::Expected: .cw-release/review-<sha>.verdict with first line 'APPROVED <sha>' — auto-created by release-flow.js --cut"
+  );
+  return 1;
+}
+
+process.exit(main());

package/scripts/verify-verdict-signature.js

@@ -4,7 +4,7 @@
 // verify-verdict-signature.js — verify an ed25519 signature over a committed
 // release verdict file, against the committed public key
 // (.cw-release/verdict-signing.pub). Portable (node + node:crypto only) so
-// CI (release-gate.yml, npm-publish.yml) and the local block-unapproved-tag.sh
+// CI (release-gate.yml, npm-publish.yml) and the local block-unapproved-tag.js
 // hook can all shell out to the SAME check instead of three drifting copies.
 //
 // Exit 0: signature verifies. Exit 1: missing file, unreadable key, or a

package/ui/workbench/app.css

@@ -27,21 +27,31 @@
   }
 }
 * { box-sizing: border-box; }
+/* The body is a flex column and main takes the leftover height (flex: 1 +
+   min-height: 0 so the inner panes can scroll) — no hardcoded header
+   height, so a header that wraps to two lines no longer pushes the panes
+   past the bottom of the window. */
 body {
   margin: 0;
   font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
   background: var(--bg);
   color: var(--ink);
   font-size: 14px;
+  display: flex;
+  flex-direction: column;
+  height: 100vh;
 }
 header { padding: 14px 20px; border-bottom: 1px solid var(--line); }
 header h1 { margin: 0; font-size: 18px; font-weight: 600; }
 header .muted, .muted { color: var(--muted); font-weight: 400; }
 header .trust { margin: 4px 0 0; font-size: 12px; color: var(--muted); }
 code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
-main { display: grid; grid-template-columns: 320px 1fr; height: calc(100vh - 64px); }
+main { display: grid; grid-template-columns: 320px 1fr; flex: 1; min-height: 0; }
 .sidebar { border-right: 1px solid var(--line); overflow-y: auto; padding: 12px; }
 .bar { display: flex; align-items: center; justify-content: space-between; margin-bottom: 8px; }
+/* The sidebar heading is a real <h2> (document outline / screen-reader
+   navigation) styled to the size the old <strong> label had. */
+.bar h2 { margin: 0; font-size: 14px; font-weight: 600; }
 button {
   background: var(--panel-2); color: var(--ink); border: 1px solid var(--line);
   border-radius: 6px; padding: 4px 10px; cursor: pointer; font-size: 12px;
@@ -51,16 +61,30 @@ input[type="search"] {
   width: 100%; background: var(--panel); color: var(--ink);
   border: 1px solid var(--line); border-radius: 6px; padding: 6px 8px; margin-bottom: 8px;
 }
-.freshness { font-size: 11px; color: var(--muted); margin-bottom: 8px; }
+.freshness { font-size: 12px; color: var(--muted); margin-bottom: 8px; }
 .run-list { list-style: none; margin: 0; padding: 0; }
-.run-list li {
+.run-list > li { margin-bottom: 6px; }
+.run-list > li:not(.run-entry),
+.run-list .run-entry > button {
   padding: 8px; border: 1px solid var(--line); border-radius: 6px;
-  margin-bottom: 6px; cursor: pointer; background: var(--panel);
+  cursor: pointer; background: var(--panel);
 }
-.run-list li:hover { border-color: var(--accent); }
-.run-list li.active { border-color: var(--accent); background: var(--panel-2); }
+/* Only the run-row <button> needs a plain-element reset: a <button> has
+   its own default display/width/font/color, a plain <li> (used only for
+   the error and empty-state rows) does not and must keep its own color
+   (.err red, .muted gray) — see app.js. */
+.run-list .run-entry > button {
+  display: block; width: 100%; text-align: left; font: inherit; color: inherit;
+}
+.run-list > li:not(.run-entry):hover, .run-list .run-entry > button:hover { border-color: var(--accent); }
+.run-list .run-entry > button.active { border-color: var(--accent); background: var(--panel-2); }
+/* Run rows are now real <button> elements (for Tab/Enter/Space); make the
+   keyboard focus ring visible — there is no :focus-visible rule for this
+   element otherwise. */
+.run-list button:focus-visible,
+.tabs button:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
 .run-list .rid { font-family: ui-monospace, monospace; font-size: 12px; display: flex; align-items: center; gap: 6px; }
-.run-list .meta { color: var(--muted); font-size: 11px; margin-top: 2px; }
+.run-list .meta { color: var(--muted); font-size: 12px; margin-top: 2px; }
 .status-dot {
   display: inline-block; width: 8px; height: 8px; border-radius: 50%; flex: none;
   background: var(--muted);
@@ -81,25 +105,41 @@ input[type="search"] {
   padding: 8px 12px; border-bottom: 1px solid var(--line);
 }
 .panel-card > .head .title { font-weight: 600; }
-.panel-card > .head .src { font-size: 11px; color: var(--muted); font-family: ui-monospace, monospace; }
-.badge { font-size: 11px; padding: 2px 8px; border-radius: 999px; border: 1px solid var(--line); }
+.panel-card > .head .src { font-size: 12px; color: var(--muted); font-family: ui-monospace, monospace; }
+.badge { font-size: 12px; padding: 2px 8px; border-radius: 999px; border: 1px solid var(--line); }
 .badge.present { color: var(--present); border-color: var(--present); }
 .badge.absent { color: var(--absent); border-color: var(--absent); }
 .badge.stale { color: var(--absent); border-color: var(--absent); }
 .badge.valid { color: var(--present); border-color: var(--present); }
 .badge.missing, .badge.bad { color: var(--bad); border-color: var(--bad); }
+/* Lifecycle states shown as a badge in the run detail header (the other
+   lifecycle values reuse the neutral/present/absent colors above). */
+.badge.blocked { color: var(--absent); border-color: var(--absent); }
+.badge.failed { color: var(--bad); border-color: var(--bad); }
+.badge.completed { color: var(--present); border-color: var(--present); }
+.badge.running { color: var(--accent); border-color: var(--accent); }
+/* One plain next-step line under the header when a run is blocked/failed. */
+.recovery-hint { margin: 0 0 12px; font-size: 12px; color: var(--absent); }
+/* Second line of the empty-list state: the suggested next command. */
+.run-list li .hint { margin-top: 4px; font-size: 12px; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
 pre.json {
   margin: 0; padding: 12px; overflow-x: auto; font-size: 12px;
   font-family: ui-monospace, SFMono-Regular, Menlo, monospace; line-height: 1.5;
   color: var(--ink); white-space: pre; max-height: 460px;
 }
 .panel-card .absent-note { padding: 10px 12px; color: var(--absent); font-size: 12px; }
+.what-matters { padding: 10px 12px; border-top: 1px solid var(--line); background: var(--panel-2); }
+.what-matters-title { margin: 0 0 8px; font-size: 12px; text-transform: uppercase; letter-spacing: 0.04em; color: var(--muted); }
+.action-fact { display: grid; grid-template-columns: minmax(100px, 140px) 1fr; gap: 10px; margin-top: 6px; }
+.action-fact:first-of-type { margin-top: 0; }
+.action-label { color: var(--muted); font-size: 12px; }
+.action-items { margin: 0; padding-left: 18px; font: 12px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace; white-space: pre-wrap; overflow-wrap: anywhere; }
 .kv { display: flex; gap: 16px; flex-wrap: wrap; padding: 8px 12px; font-size: 12px; color: var(--muted); }
 .kv b { color: var(--ink); font-weight: 600; }
 .err { color: var(--bad); }
 .struct-block { padding: 10px 12px; border-top: 1px solid var(--line); }
 .struct-block:first-child { border-top: none; }
-.struct-block .struct-title { font-size: 11px; text-transform: uppercase; letter-spacing: 0.04em; color: var(--muted); margin-bottom: 6px; }
+.struct-block .struct-title { font-size: 12px; text-transform: uppercase; letter-spacing: 0.04em; color: var(--muted); margin-bottom: 6px; }
 .struct-table { width: 100%; border-collapse: collapse; font-size: 12px; }
 .struct-table th, .struct-table td {
   text-align: left; padding: 4px 8px; border-bottom: 1px solid var(--line);