cool-workflow 0.2.4 → 0.2.6

package/dist/shell/ledger-cli.js

@@ -188,10 +188,17 @@ function ledgerApplyCli(options) {
     return (0, ledger_1.applyLedgerProposal)(parsed);
 }
 function ledgerListCli(options) {
-    const dirs = Array.isArray(options.dir) ? options.dir.map(String).filter(Boolean) : [];
+    // `--ledger-dir` is the preferred flag: the global CLI front door
+    // (cli/entry.ts) treats `--dir` as an alias of `--repo` for EVERY
+    // command, so `cw ledger list --dir X` made one flag mean two things.
+    // `--dir` keeps working unchanged as the legacy spelling; when both are
+    // given, `--ledger-dir` wins. Repeated flags become an array via
+    // parseArgv's append behavior, same as `--dir` always has.
+    const input = options["ledger-dir"] ?? options.dir;
+    const dirs = Array.isArray(input) ? input.map(String).filter(Boolean) : [];
     if (dirs.length > 1)
         return (0, ledger_io_1.unionLedgerEntries)(dirs);
-    const dir = required(dirs[0] || stringOption(options.dir), "--dir <ledger-directory>");
+    const dir = required(dirs[0] || stringOption(input), "--ledger-dir <ledger-directory>");
     return (0, ledger_io_1.listLedgerEntries)(dir);
 }
 /** MCP-facing verify/apply take the entry OBJECT directly (not a file/

package/dist/shell/metrics-cli.js

@@ -71,7 +71,7 @@ function nowOf(args) {
 function metricsShowCli(runId, args) {
     const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
     const policy = (0, observability_1.loadCostPolicy)(args, pluginRoot());
-    return (0, observability_1.showMetricsReport)(run, { now: nowOf(args), policy });
+    return (0, observability_1.showMetricsReport)(run, { now: nowOf(args), policy, persist: args.__cwWorkbenchReadOnlyProjection !== true });
 }
 /** `cw metrics summary [--scope repo|home] [--pricing ...] [--now ISO] [--limit N]`.
  *  `--limit` defaults to RunRegistry.list()'s own 50-record floor when omitted. */

package/dist/shell/multi-agent-cli.js

@@ -113,6 +113,7 @@ exports.evalScoreCli = evalScoreCli;
 exports.evalGateCli = evalGateCli;
 exports.evalReportCli = evalReportCli;
 const path = __importStar(require("node:path"));
+const cli_args_1 = require("../core/util/cli-args");
 const numeric_flag_1 = require("../core/util/numeric-flag");
 const run_store_1 = require("./run-store");
 const report_1 = require("./report");
@@ -139,7 +140,10 @@ function invocationCwd(args) {
     return typeof args.cwd === "string" && args.cwd.trim() ? path.resolve(args.cwd) : process.cwd();
 }
 function loadRun(args, runId) {
-    return (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    if (args.__cwWorkbenchReadOnlyProjection === true)
+        run.__cwWorkbenchReadOnlyProjection = true;
+    return run;
 }
 /** Hold the run's state.json lock across the WHOLE load -> change ->
  *  persist cycle. A bare loadRun + persist pair races: two processes both
@@ -188,7 +192,10 @@ function numberArg(value) {
     return Number.isFinite(parsed) ? parsed : undefined;
 }
 function boolArg(value) {
-    return Boolean(value);
+    // parseBoolFlag reads "false"/"0"/"no"/"off" as false and throws on an
+    // unrecognized string — Boolean("false") is true, which silently
+    // ENABLED flags like `--allow-self-approval false` (fail-open).
+    return (0, cli_args_1.parseBoolFlag)(value, "flag") ?? false;
 }
 /** `--multi-agent-run <id>` — parseArgv keeps kebab-case option keys
  *  verbatim (no camelCase folding), so this must check the literal

package/dist/shell/multi-agent-operator-ux.js

@@ -91,7 +91,7 @@ function summarizeMultiAgentOperator(run) {
     const topologies = (0, topology_io_1.summarizeTopologies)(run);
     const multiAgent = (0, multi_agent_io_1.summarizeMultiAgent)(run);
     const blackboard = (0, coordinator_io_1.summarizeBlackboard)(run);
-    const trust = (0, trust_audit_1.summarizeTrustAudit)(run);
+    const trust = (0, trust_audit_1.summarizeTrustAudit)(run, { persist: run.__cwWorkbenchReadOnlyProjection !== true });
     const dependencies = deriveDependencies(run);
     const failures = deriveFailures(run, dependencies);
     const evidence = deriveEvidence(run);

package/dist/shell/observability.js

@@ -453,13 +453,16 @@ function loadPersistedMetricsFingerprint(run) {
 }
 /** Derive + persist the per-run report. The RETURNED payload is pinned to
  *  `freshness: "valid"` (persistedFingerprint === itself) so `cw metrics
- *  show --json` and the MCP tool are byte-identical; NEVER touches
- *  state.json (invariant 6). */
+ *  show --json` and the MCP tool are byte-identical. The Workbench's private
+ *  projection mode keeps that established payload but does not create a
+ *  derived file; NEVER touches state.json (invariant 6). */
 function showMetricsReport(run, options) {
     const live = deriveMetricsReport(run, { now: options.now, policy: options.policy });
     const report = { ...live, freshness: { status: "valid", persistedFingerprint: live.sourceFingerprint, currentFingerprint: live.sourceFingerprint } };
-    fs.mkdirSync(metricsDir(run), { recursive: true });
-    (0, fs_atomic_1.writeJson)(metricsReportPath(run), report);
+    if (options.persist !== false) {
+        fs.mkdirSync(metricsDir(run), { recursive: true });
+        (0, fs_atomic_1.writeJson)(metricsReportPath(run), report);
+    }
     return report;
 }
 function poolRates(metric, rates) {

package/dist/shell/onramp.js

@@ -278,9 +278,9 @@ function resolveChangedFiles(options = {}) {
     const root = gitRoot(cwd);
     const baseRef = resolveBaseRef(root, options.changedFrom, options.env || process.env);
     const files = new Set();
-    for (const file of gitLines(root, ["diff", "--name-only", baseRef, "--"]))
+    for (const file of gitLinesOrThrow(root, ["diff", "--name-only", baseRef, "--"]))
         files.add(normalizeChangedPath(file));
-    for (const file of gitLines(root, ["ls-files", "--others", "--exclude-standard"]))
+    for (const file of gitLinesOrThrow(root, ["ls-files", "--others", "--exclude-standard"]))
         files.add(normalizeChangedPath(file));
     return { baseRef, files: [...files].filter(Boolean).sort() };
 }
@@ -406,8 +406,26 @@ function resolveBaseRef(root, changedFrom, env) {
         return verifyRef(root, changedFrom);
     if (env.CW_ONRAMP_BASE)
         return verifyRef(root, env.CW_ONRAMP_BASE);
-    const baseBranch = env.GITHUB_BASE_REF ? `origin/${env.GITHUB_BASE_REF}` : "origin/main";
-    const mergeBase = gitOne(root, ["merge-base", "HEAD", baseBranch]);
+    // A pull_request CI context sets GITHUB_BASE_REF, so a base ref is EXPECTED:
+    // the diff must run against the PR's own base branch. If merge-base cannot
+    // resolve there (a shallow clone that never fetched the base, a missing
+    // origin ref), we must NOT quietly degrade to HEAD -- a HEAD..HEAD diff on a
+    // clean, already-committed tree is empty, and an empty change set has no
+    // issues, so onramp:check would report ok:true on a real, unseen change (the
+    // same vacuous-pass class PR #446 closed one layer below). Fail closed.
+    if (env.GITHUB_BASE_REF) {
+        const baseBranch = `origin/${env.GITHUB_BASE_REF}`;
+        const mergeBase = gitOne(root, ["merge-base", "HEAD", baseBranch]);
+        if (mergeBase)
+            return mergeBase;
+        throw new Error(`onramp: cannot resolve a base ref -- git merge-base HEAD ${baseBranch} found no common commit (fail closed, not treated as zero changes). Fetch the base branch with a full (non-shallow) clone, or pass --changed-from / CW_ONRAMP_BASE.`);
+    }
+    // No base ref was requested (--changed-from / CW_ONRAMP_BASE) or expected
+    // (GITHUB_BASE_REF): this is the local "show my own changes" use. merge-base
+    // against origin/main narrows the diff to this branch's commits when the
+    // remote is present; with no remote we fall back to HEAD so `git diff HEAD`
+    // still surfaces the working-tree (uncommitted) changes.
+    const mergeBase = gitOne(root, ["merge-base", "HEAD", "origin/main"]);
     if (mergeBase)
         return mergeBase;
     return verifyRef(root, "HEAD");
@@ -423,12 +441,37 @@ function verifyRef(root, ref) {
 function gitRoot(cwd) {
     return gitOne(node_path_1.default.resolve(cwd), ["rev-parse", "--show-toplevel"]) || node_path_1.default.resolve(cwd);
 }
+// Every onramp git call is a quick metadata read (rev-parse, merge-base, diff
+// --name-only, ls-files). A finite timeout keeps a HUNG git -- a cold fsmonitor
+// daemon, a credential prompt on a misconfigured remote -- from blocking the
+// gate forever; 5s matches the git-metadata timeout already used in
+// shell/commit.ts and shell/doctor.ts. On a timeout spawnSync sets
+// `result.error` (and a null status), so gitLinesOrThrow fails closed while
+// gitLines/gitOne fall back the same way they do for any other git failure.
+const GIT_TIMEOUT_MS = 5000;
 function gitLines(cwd, args) {
-    const result = (0, node_child_process_1.spawnSync)("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    const result = (0, node_child_process_1.spawnSync)("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: GIT_TIMEOUT_MS });
     if (result.status !== 0)
         return [];
     return String(result.stdout || "").split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
 }
+/** Same as gitLines, but a failed git invocation THROWS instead of silently
+ *  becoming []. resolveChangedFiles must never mistake "git could not run
+ *  this diff" for "there is nothing to diff" -- that turns a transient git
+ *  failure into a vacuous onramp-contract pass (a 2026-07-12 security audit
+ *  finding: a broken base ref or a git error made the changed-file set
+ *  empty, and an empty set has no issues, so the gate reported ok:true on a
+ *  real, unseen change). Callers that WANT a soft fallback (merge-base
+ *  probing, optional discovery) should keep using gitLines/gitOne. */
+function gitLinesOrThrow(cwd, args) {
+    const result = (0, node_child_process_1.spawnSync)("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: GIT_TIMEOUT_MS });
+    if (result.error)
+        throw new Error(`onramp: git ${args.join(" ")} failed to run: ${result.error.message}`);
+    if (result.status !== 0) {
+        throw new Error(`onramp: git ${args.join(" ")} exited ${result.status} -- cannot resolve changed files (fail closed, not treated as zero changes): ${String(result.stderr || "").trim()}`);
+    }
+    return String(result.stdout || "").split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+}
 function gitOne(cwd, args) {
     return gitLines(cwd, args)[0] || "";
 }

package/dist/shell/operator-ux.js

@@ -290,7 +290,7 @@ function summarizeOperatorRun(run) {
     const multiAgentOperator = (0, multi_agent_operator_ux_1.summarizeMultiAgentOperator)(run);
     const multiAgentTrust = (0, trust_policy_io_1.summarizeMultiAgentTrust)(run);
     const blackboard = (0, coordinator_io_1.summarizeBlackboard)(run);
-    const trust = (0, trust_audit_1.summarizeTrustAudit)(run);
+    const trust = (0, trust_audit_1.summarizeTrustAudit)(run, { persist: run.__cwWorkbenchReadOnlyProjection !== true });
     const activePhase = phases.find((p) => p.status === "running") || phases.find((p) => p.status === "pending");
     const blockedReasons = [];
     for (const worker of workers.workers) {

package/dist/shell/perf-trace.js

@@ -0,0 +1,136 @@
+"use strict";
+// shell/perf-trace.ts — opt-in cold-path timing evidence for the benchmark
+// runner. This is not a product log: it is off unless CW_BENCH_TRACE_FILE is
+// set by scripts/bench/run.js, and it writes one JSON report when the drive
+// process ends. Normal CLI and MCP work do not see it.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withPerfTraceGroup = withPerfTraceGroup;
+exports.recordPerfDurableWrite = recordPerfDurableWrite;
+const fs = __importStar(require("node:fs"));
+const TRACE_FILE = process.env.CW_BENCH_TRACE_FILE || "";
+const groups = new Map();
+const scopes = [];
+function enabled() {
+    return TRACE_FILE.length > 0;
+}
+function groupFor(name) {
+    let group = groups.get(name);
+    if (!group) {
+        group = { durationMs: 0, selfMs: 0, durableWriteCount: 0, durableWriteBytes: 0, samples: [] };
+        groups.set(name, group);
+    }
+    return group;
+}
+function elapsedMs(startedAt) {
+    return Number(process.hrtime.bigint() - startedAt) / 1_000_000;
+}
+/** Run synchronous work as one named benchmark group. Nested work is kept in
+ * the parent duration, but removed from its self time. That lets the report
+ * show dispatch work apart from its agent wait without changing call order. */
+function withPerfTraceGroup(name, fn) {
+    if (!enabled())
+        return fn();
+    const scope = { name, startedAt: process.hrtime.bigint(), childMs: 0, durableWriteCount: 0, durableWriteBytes: 0 };
+    scopes.push(scope);
+    try {
+        return fn();
+    }
+    finally {
+        const ended = scopes.pop();
+        if (ended) {
+            const durationMs = elapsedMs(ended.startedAt);
+            const group = groupFor(ended.name);
+            group.durationMs += durationMs;
+            group.selfMs += Math.max(0, durationMs - ended.childMs);
+            group.durableWriteCount += ended.durableWriteCount;
+            group.durableWriteBytes += ended.durableWriteBytes;
+            group.samples.push({
+                durationMs: rounded(durationMs),
+                selfMs: rounded(Math.max(0, durationMs - ended.childMs)),
+                durableWriteCount: ended.durableWriteCount,
+                durableWriteBytes: ended.durableWriteBytes,
+            });
+            const parent = scopes[scopes.length - 1];
+            if (parent)
+                parent.childMs += durationMs;
+        }
+    }
+}
+/** Count a completed durable file write in the active benchmark group. */
+function recordPerfDurableWrite(bytes) {
+    if (!enabled())
+        return;
+    const active = scopes[scopes.length - 1];
+    if (!active) {
+        const group = groupFor("other");
+        group.durableWriteCount += 1;
+        group.durableWriteBytes += bytes;
+        return;
+    }
+    for (const scope of scopes) {
+        scope.durableWriteCount += 1;
+        scope.durableWriteBytes += bytes;
+    }
+}
+function rounded(value) {
+    return Math.round(value * 1000) / 1000;
+}
+function writeTrace() {
+    if (!enabled())
+        return;
+    const value = {
+        schemaVersion: 1,
+        benchmark: "cw-cold-path",
+        groups: [...groups.entries()]
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([name, group]) => ({
+            name,
+            durationMs: rounded(group.durationMs),
+            selfMs: rounded(group.selfMs),
+            durableWriteCount: group.durableWriteCount,
+            durableWriteBytes: group.durableWriteBytes,
+            samples: group.samples,
+        })),
+    };
+    try {
+        fs.writeFileSync(TRACE_FILE, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+    }
+    catch {
+        // A benchmark trace must never change the drive result or exit status.
+    }
+}
+if (enabled())
+    process.once("exit", writeTrace);

package/dist/shell/pipeline.js

@@ -48,6 +48,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.pureAppendRunNode = exports.writeJson = void 0;
 exports.plan = plan;
 const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const run_paths_1 = require("../core/state/run-paths");
 const migrations_1 = require("../core/state/migrations");
@@ -147,7 +148,7 @@ function plan(app, options) {
     const runId = injectedRunId || createRunId(app.workflow.id);
     const runDir = path.join(cwd, ".cw", "runs", runId);
     const paths = (0, run_paths_1.createRunPaths)(runDir);
-    (0, run_paths_1.ensureRunDirs)(paths);
+    (0, run_store_1.ensureRunDirs)(paths);
     const tasks = flattenTasks(app, inputs);
     // Stamp a real wall-clock createdAt/updatedAt at plan time (shell layer —
     // clock reads are allowed here). The pure migration defaults a run that
@@ -207,7 +208,7 @@ function plan(app, options) {
             loopStage: "interpret",
             artifacts: [{ id: "task", kind: "markdown", path: task.taskPath }],
             metadata: { workflowId: app.workflow.id, appId: app.id, appVersion: app.version, taskId: task.id, phase: task.phase, taskKind: task.kind, requiresEvidence: task.requiresEvidence, sandboxProfileId: task.sandboxProfileId },
-        }, { persist: false, persistNode: node_store_1.writeRunNode });
+        }, { persist: false, persistNode: node_store_1.writeRunNode, pathExists: fs.existsSync });
         task.stateNodeId = taskResult.outputNodeId;
     }
     (0, report_1.writeReport)(run);

package/dist/shell/reclamation-io.js

@@ -473,14 +473,15 @@ function planReclamation(run, policy = {}) {
         }
     }
     // (3) Superseded, non-verifier-gated commit snapshots. Each commitState()
-    // call embeds the FULL run into commits/<id>.json, so these grow without
-    // bound (both in count and per-file size) with no reclamation path today.
-    // Only the run's LATEST commit and any verifier-gated commit (the actual
-    // audit-significant milestones) are kept — an intermediate, non-gated
-    // "checkpoint" commit's only value is as a point-in-time snapshot, and
-    // state.json (not commits/) is the source of truth for resume. Not
-    // reconstructable (no recipe): a commit snapshot is a genuine
-    // point-in-time capture, not a projection derivable from retained data.
+    // call writes only the commit's own small record into commits/<id>.json
+    // (not the whole run), but these files still add up over a long run with
+    // no reclamation path today. Only the run's LATEST commit and any
+    // verifier-gated commit (the actual audit-significant milestones) are
+    // kept — an intermediate, non-gated "checkpoint" commit's only value is
+    // as a point-in-time snapshot, and state.json (not commits/) is the
+    // source of truth for resume. Treated as not reconstructable (no recipe)
+    // on purpose, kept conservative: a commit snapshot is not offered a
+    // projection path derivable from retained data.
     let reclaimedCommitSnapshot = false;
     if (!policy.keepCommits) {
         const commits = run.commits || [];
@@ -663,7 +664,7 @@ function prepareFree(run, tombstone) {
     for (const nodeId of repointed) {
         try {
             const fresh = (0, node_store_1.snapshotNode)(run, nodeId, { persist: false });
-            const { freshness } = (0, node_snapshot_1.loadNodeSnapshot)(run, fresh);
+            const { freshness } = (0, node_snapshot_1.loadNodeSnapshot)(run, fresh, fs.existsSync);
             if (freshness === "absent") {
                 throw new ReclamationError("repoint-incomplete", `re-pointed node ${nodeId} snapshot is absent (dangling artifact)`, { nodeId });
             }

package/dist/shell/report-view-cli.js

@@ -109,6 +109,8 @@ function operatorReportText(runId, args) {
 /** `cw graph <id> [--json]` / `cw operator graph`. */
 function graphCli(runId, args) {
     const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    if (args.__cwWorkbenchReadOnlyProjection === true)
+        run.__cwWorkbenchReadOnlyProjection = true;
     return (0, operator_ux_1.buildOperatorGraph)(run);
 }
 function graphText(runId, args) {

package/dist/shell/run-export-cli.js

@@ -100,7 +100,10 @@ function runRestoreCli(archivePath, args) {
     if (!inspect.ok) {
         return { schemaVersion: 1, ok: false, target, inspect, imported: null, verify: null, registry: null };
     }
-    const imported = (0, run_export_1.importRun)(resolvedArchive, target);
+    const restored = (0, run_export_1.restoreRunAtomically)(resolvedArchive, target);
+    if (!restored.imported) {
+        return { schemaVersion: 1, ok: false, target, inspect, imported: null, verify: restored.verification, registry: null };
+    }
     const registry = new run_registry_io_1.RunRegistry(target).refresh({ scope: "repo" });
-    return { schemaVersion: 1, ok: imported.verification.ok, target, inspect, imported: imported.run, verify: imported.verification, registry };
+    return { schemaVersion: 1, ok: true, target, inspect, imported: restored.imported.run, verify: restored.verification, registry };
 }