cool-workflow 0.2.5 → 0.2.6

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cool-workflow",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "author": {
     "name": "COOLWHITE LLC"
   },

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cool-workflow",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
   "author": {
     "name": "COOLWHITE LLC"

package/.gemini-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cool-workflow",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "author": {
     "name": "COOLWHITE LLC"
   },

package/.opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cool-workflow",
   "description": "A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents to do their parts together, and talks MCP. It gives the doing of the work to outside agents — it never runs the models itself.",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "author": {
     "name": "COOLWHITE LLC"
   },

package/README.md

@@ -95,9 +95,11 @@ cw -q "How does auth work end-to-end here?"
 Any question works — "how does X work", "is it safe to change Y", "what would
 break if Z rotated". CW uses the current repo and the first agent it finds on
 your `PATH`. Want a specific agent? Add a flag (`-claude`, `-codex`, `-gemini`,
-`-opencode`, `-deepseek`). DeepSeek is the one with no auto-detect — it runs
-through `opencode` — so `-deepseek` is the only way to get it. You can
-point CW at any folder, or at a **repo on the web by
+`-opencode`, `-deepseek`). Note: the `-gemini` and `-deepseek` flags reach
+their models through `opencode`, so those two need `opencode` installed and
+its provider signed in. DeepSeek also has no auto-detect, so `-deepseek` is
+the only way to get it. (A native `gemini` CLI found on your `PATH` is used
+directly.) You can point CW at any folder, or at a **repo on the web by
 URL** — CW clones it and reviews the copy:
 
 ```bash

package/apps/architecture-review/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review",
   "title": "Architecture Review",
   "summary": "Map a repository architecture, assess risks, verify important findings, and synthesize an evidence-backed verdict.",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/architecture-review-fast/app.json

@@ -3,7 +3,7 @@
   "id": "architecture-review-fast",
   "title": "Architecture Review Fast",
   "summary": "Run a shorter architecture review with parallel map and assess phases for faster first results.",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/end-to-end-golden-path/app.json

@@ -3,7 +3,7 @@
   "id": "end-to-end-golden-path",
   "title": "End-to-End Golden Path",
   "summary": "Deterministic one-worker workflow app for proving the CW integration chain.",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/pr-review-fix-ci/app.json

@@ -3,7 +3,7 @@
   "id": "pr-review-fix-ci",
   "title": "PR Review Fix CI",
   "summary": "Review a pull request or branch, inspect CI failures, diagnose actionable issues, optionally patch, verify, and summarize with evidence.",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/release-cut/app.json

@@ -3,7 +3,7 @@
   "id": "release-cut",
   "title": "Release Cut",
   "summary": "Prepare a release with checklist discipline: version checks, changelog, tests, packaging, release notes, and final verification.",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/apps/research-synthesis/app.json

@@ -3,7 +3,7 @@
   "id": "research-synthesis",
   "title": "Research Synthesis",
   "summary": "Split a research question into claims, investigate sources, cross-check evidence, verify claims, and synthesize a concise answer.",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "author": "COOLWHITE LLC",
   "inputs": [
     {

package/dist/core/state/run-paths.js

@@ -1,10 +1,9 @@
 "use strict";
-// core/state/run-paths.ts — createRunPaths, ensureRunDirs.
+// core/state/run-paths.ts — pure RunPaths construction.
 //
 // MILESTONE 3. Byte-exact port of the old build's src/state.ts:10-50.
-// `createRunPaths` is pure path math (core/); `ensureRunDirs` touches disk
-// (mkdirSync) so it lives here but is called from shell/run-store.ts, the
-// only place that actually creates a run directory tree.
+// `createRunPaths` is pure path math. The directory write mechanism lives in
+// shell/run-store.ts.
 //
 // Evidence: SPEC/state-core.md "src/state.ts — persistence kernel" and "The
 // full .cw/runs/<run-id>/ layout".
@@ -43,8 +42,6 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRunPaths = createRunPaths;
-exports.ensureRunDirs = ensureRunDirs;
-const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 /** The 16-key RunPaths object, all joined under `runDir`. */
 function createRunPaths(runDir) {
@@ -67,27 +64,3 @@ function createRunPaths(runDir) {
         topologiesDir: path.join(runDir, "topologies"),
     };
 }
-/** `mkdirSync` (recursive) every dir this run needs. Missing optional dir
- *  fields fall back to `path.join(runDir, "<name>")`, matching the old
- *  build's defensive default (a RunPaths loaded from an old/partial
- *  state.json may be missing an optional key). */
-function ensureRunDirs(paths) {
-    const dirs = [
-        paths.runDir,
-        paths.tasksDir,
-        paths.resultsDir,
-        paths.dispatchesDir,
-        paths.artifactsDir,
-        paths.commitsDir,
-        paths.stateNodesDir,
-        paths.feedbackDir,
-        paths.auditDir || path.join(paths.runDir, "audit"),
-        paths.workersDir || path.join(paths.runDir, "workers"),
-        paths.candidatesDir || path.join(paths.runDir, "candidates"),
-        paths.multiAgentDir || path.join(paths.runDir, "multi-agent"),
-        paths.blackboardDir || path.join(paths.runDir, "blackboard"),
-        paths.topologiesDir || path.join(paths.runDir, "topologies"),
-    ];
-    for (const dir of dirs)
-        fs.mkdirSync(dir, { recursive: true });
-}

package/dist/core/version.js

@@ -7,7 +7,7 @@ exports.MIN_SUPPORTED_RUN_STATE_SCHEMA_VERSION = exports.LEGACY_RUN_STATE_SCHEMA
 // `cw version` output does not change bytes just because the code under it
 // was rebuilt. See SPEC/cli-surface.md "Exact outputs > Version" and
 // conformance/cases/version-basic.case.js (regex `/^\d+\.\d+\.\d+\n$/`).
-exports.CURRENT_COOL_WORKFLOW_VERSION = "0.2.5";
+exports.CURRENT_COOL_WORKFLOW_VERSION = "0.2.6";
 // State-kernel schema version constants (SPEC/state-core.md "Version
 // constants"). Pinned to the old build's src/version.ts byte-for-byte.
 exports.WORKFLOW_APP_SCHEMA_VERSION = 1;

package/dist/mcp/server.js

@@ -63,12 +63,13 @@
 //     path. The envelope-level "missing field: name" check (right above
 //     this bullet) is unchanged — it still answers -32000.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.mcpToolAuthority = mcpToolAuthority;
 exports.negotiateProtocolVersion = negotiateProtocolVersion;
 exports.startServer = startServer;
 const version_1 = require("../core/version");
-const safe_json_1 = require("../core/format/safe-json");
 const recovery_hint_1 = require("../core/format/recovery-hint");
 const dispatch_1 = require("./dispatch");
+const tool_process_1 = require("./tool-process");
 const MAX_LINE_BYTES = 16 * 1024 * 1024;
 /** Protocol versions this server can speak, oldest first. `initialize`
  *  echoes the client's `params.protocolVersion` when it is in this list,
@@ -77,6 +78,41 @@ const MAX_LINE_BYTES = 16 * 1024 * 1024;
  *  behavior-identical to the old hard-coded reply (mechanism first; a
  *  second version is a one-line append here). */
 const SUPPORTED_PROTOCOL_VERSIONS = ["2024-11-05"];
+/** Read the optional server-side tool policy. When both values are unset, the
+ * full present tool list and access stay unchanged. An enabled list is an
+ * allowlist; disabled names are then removed. */
+function mcpToolAuthority(definitions = (0, dispatch_1.toolDefinitions)(), environment = process.env) {
+    const known = new Set(definitions.map((definition) => definition.name));
+    const enabled = configuredToolNames("CW_MCP_ENABLED_TOOLS", environment, known);
+    const disabled = configuredToolNames("CW_MCP_DISABLED_TOOLS", environment, known);
+    if (!enabled && !disabled)
+        return {};
+    const allowed = enabled ? new Set(enabled) : new Set(known);
+    for (const name of disabled ?? [])
+        allowed.delete(name);
+    return { allowed };
+}
+function configuredToolNames(name, environment, known) {
+    const value = environment[name];
+    if (value === undefined)
+        return undefined;
+    const names = value.split(",").map((part) => part.trim());
+    if (names.some((tool) => tool.length === 0))
+        throw new Error(`MCP tool policy ${name} contains an empty tool name`);
+    const selected = new Set(names);
+    for (const tool of selected) {
+        if (!known.has(tool))
+            throw new Error(`MCP tool policy ${name} names an unknown tool: ${tool}`);
+    }
+    return selected;
+}
+function permittedToolDefinitions(authority) {
+    const definitions = (0, dispatch_1.toolDefinitions)();
+    return authority.allowed ? definitions.filter((definition) => authority.allowed?.has(definition.name)) : definitions;
+}
+function toolPermitted(name, authority) {
+    return authority.allowed === undefined || authority.allowed.has(name);
+}
 /** Picks the `initialize` reply's protocolVersion from the client's
  *  requested one (see SUPPORTED_PROTOCOL_VERSIONS). Exported for the
  *  protocol-version smoke; pure. */
@@ -154,18 +190,9 @@ function resultMessage(id, result) {
     // MUST NOT be answered) pinned by SPEC/mcp.md's edge-cases. Revisit only
     // as a deliberate spec change, not as a drive-by fix.
 }
-/** Handles one already-parsed JSON-RPC request object. May write zero or
- *  one reply line to stdout. `await`ing callTool's result is a no-op for
- *  the ~197 tools whose handler returns a plain value already (an `await`
- *  on a non-Promise resolves on the next microtask, invisible to a
- *  caller that already awaits handleRequest) -- it only matters for
- *  `cw_run`, whose live drive loop returns a real Promise so it can
- *  actually stay interruptible (see shell/drive.ts's driveAsync). This
- *  must stay inside the existing try/catch: an async tool handler throws
- *  by REJECTING its returned Promise rather than throwing synchronously,
- *  and an unawaited rejection here would be an unhandled rejection
- *  instead of the normal `-32000` JSON-RPC error reply. */
-async function handleRequest(message) {
+/** Handles one already-parsed JSON-RPC request object. The parent owns the
+ * protocol reply while the durable tool process owns the blocking tool work. */
+async function handleRequest(message, tools, authority) {
     const hasId = Object.prototype.hasOwnProperty.call(message, "id");
     const id = message.id;
     if (typeof message.method !== "string") {
@@ -187,7 +214,7 @@ async function handleRequest(message) {
                 return;
             }
             case "tools/list": {
-                writeMessage(resultMessage(id, { tools: (0, dispatch_1.toolDefinitions)() }));
+                writeMessage(resultMessage(id, { tools: permittedToolDefinitions(authority) }));
                 return;
             }
             case "ping": {
@@ -221,8 +248,10 @@ async function handleRequest(message) {
                 // a tool-call outcome, and keeps going through the outer
                 // try/catch as a -32000 error, unchanged.
                 try {
-                    const coreResult = await (0, dispatch_1.callTool)(name, args ?? {});
-                    const content = [{ type: "text", text: (0, safe_json_1.safeJsonStringify)(coreResult) }];
+                    if (!toolPermitted(name, authority))
+                        throw new Error(`MCP tool disabled by policy: ${name}`);
+                    const text = await tools.execute(name, args ?? {});
+                    const content = [{ type: "text", text }];
                     const advisory = untrustedContentAdvisory(name);
                     if (advisory)
                         content.push({ type: "text", text: advisory });
@@ -248,22 +277,28 @@ async function handleRequest(message) {
         writeMessage(errorMessage(id, -32000, text));
     }
 }
-/** Handles one raw (already-trimmed, non-empty) stdin line. */
-async function handleLine(line) {
+/** Parses a raw stdin line without writing. This lets a valid ping use the
+ * control path while parse errors keep their old place in the work queue. */
+function parseLine(line) {
     let parsed;
     try {
         parsed = JSON.parse(line);
     }
     catch (error) {
         const detail = error instanceof Error ? error.message : String(error);
-        writeMessage(errorMessage(null, -32700, `Parse error: ${detail}`));
-        return;
+        return { error: { code: -32700, message: `Parse error: ${detail}` } };
     }
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-        writeMessage(errorMessage(null, -32600, "Invalid Request: not a JSON-RPC object"));
+        return { error: { code: -32600, message: "Invalid Request: not a JSON-RPC object" } };
+    }
+    return { message: parsed };
+}
+async function handleLine(parsed, tools, authority) {
+    if ("error" in parsed) {
+        writeMessage(errorMessage(null, parsed.error.code, parsed.error.message));
         return;
     }
-    await handleRequest(parsed);
+    await handleRequest(parsed.message, tools, authority);
 }
 /** Starts the stdio read loop. Never resolves — the server is long-lived
  *  and stops only when its stdin closes / the process exits.
@@ -277,7 +312,24 @@ async function handleLine(line) {
  *  answered in handleRequest's fast path before any tool work, so a
  *  keep-alive ping still gets a reply while a long drive holds the queue. */
 function startServer() {
+    const authority = mcpToolAuthority();
     process.stdin.setEncoding("utf8");
+    const tools = new tool_process_1.ToolProcessExecutor();
+    // EOF is a normal protocol close: keep the queue alive so a client which
+    // sent a batch and then closed stdin still gets its ordered replies. A
+    // process stop is different. Stop the child before giving the same signal
+    // back to the parent, so a child in a synchronous lock wait cannot wake up
+    // later and write state after its MCP parent is gone.
+    const stopForSignal = (signal) => {
+        const stop = () => {
+            tools.close();
+            process.removeListener(signal, stop);
+            process.kill(process.pid, signal);
+        };
+        process.once(signal, stop);
+    };
+    stopForSignal("SIGINT");
+    stopForSignal("SIGTERM");
     let buffer = "";
     // True while the REST of an oversize line is still streaming in: emit one
     // -32700 for the whole line and skip everything up to its terminating
@@ -325,8 +377,20 @@ function startServer() {
             const line = buffer.slice(0, newlineIndex);
             buffer = buffer.slice(newlineIndex + 1);
             const trimmed = line.trim();
-            if (trimmed)
-                enqueue(() => handleLine(trimmed));
+            if (!trimmed)
+                continue;
+            const parsed = parseLine(trimmed);
+            // Ping is a control-plane keep-alive. It must not wait behind a tool
+            // process that is blocked on a file lock or an outside agent.
+            if ("message" in parsed && parsed.message.method === "ping") {
+                void handleLine(parsed, tools, authority).catch((error) => {
+                    const detail = error instanceof Error ? (error.stack ?? error.message) : String(error);
+                    process.stderr.write(`cool-workflow mcp: a ping reply failed: ${detail}\n`);
+                });
+            }
+            else {
+                enqueue(() => handleLine(parsed, tools, authority));
+            }
         }
         // No newline yet and the pending (unterminated) line already exceeds the
         // cap: report ONCE, drop the head, and discard the rest of this line
@@ -335,9 +399,13 @@ function startServer() {
         if (!discarding && buffer.length > MAX_LINE_BYTES) {
             buffer = "";
             discarding = true;
-            enqueue(() => {
-                writeMessage(errorMessage(null, -32700, `Parse error: request line exceeds ${MAX_LINE_BYTES} bytes`));
-            });
+            enqueue(() => writeMessage(errorMessage(null, -32700, `Parse error: request line exceeds ${MAX_LINE_BYTES} bytes`)));
         }
     });
+    // A client may send a batch and close stdin at once. Keep the tool process
+    // alive until the serial queue has written those replies, then close it so
+    // it cannot outlive the MCP parent.
+    process.stdin.on("end", () => {
+        void queue.finally(() => tools.close());
+    });
 }

package/dist/mcp/tool-process.js

@@ -0,0 +1,181 @@
+"use strict";
+// mcp/tool-process.ts — the private execution lane for MCP tools.
+//
+// The MCP server keeps its stdio protocol work in the parent process. This
+// child process runs one tools/call at a time, so a synchronous file-lock wait
+// or a long agent call cannot stop the parent from reading and answering ping.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolProcessExecutor = void 0;
+exports.startToolProcessWorker = startToolProcessWorker;
+const node_child_process_1 = require("node:child_process");
+const path = __importStar(require("node:path"));
+const safe_json_1 = require("../core/format/safe-json");
+const dispatch_1 = require("./dispatch");
+function isResponse(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const record = value;
+    return record.schemaVersion === 1 && typeof record.id === "number" && typeof record.ok === "boolean" &&
+        (record.ok ? typeof record.text === "string" : typeof record.error === "string");
+}
+function diagnostic(kind, chunk) {
+    const text = String(chunk);
+    if (text)
+        process.stderr.write(`cool-workflow mcp tool process ${kind}: ${text}`);
+}
+/** One durable, serial child process for tools/call. The public MCP server
+ * owns response shapes; this class moves only a tool request and its already
+ * rendered JSON text across IPC. A stopped child never causes an automatic
+ * retry because a tool may already have written part of its state. */
+class ToolProcessExecutor {
+    workerPath;
+    child;
+    nextId = 1;
+    pending;
+    constructor(options = {}) {
+        this.workerPath = options.workerPath ?? path.join(__dirname, "tool-process.js");
+    }
+    execute(name, args) {
+        if (this.pending)
+            throw new Error("MCP tool process received concurrent work");
+        const child = this.ensureChild();
+        const id = this.nextId++;
+        const request = { schemaVersion: 1, id, name, args };
+        return new Promise((resolve, reject) => {
+            this.pending = { id, name, resolve, reject };
+            try {
+                child.send(request, (error) => {
+                    if (!error || this.pending?.id !== id)
+                        return;
+                    this.pending = undefined;
+                    reject(error);
+                });
+            }
+            catch (error) {
+                if (this.pending?.id === id)
+                    this.pending = undefined;
+                reject(error instanceof Error ? error : new Error(String(error)));
+            }
+        });
+    }
+    close() {
+        const child = this.child;
+        this.child = undefined;
+        const pending = this.pending;
+        this.pending = undefined;
+        if (pending)
+            pending.reject(new Error(`MCP tool process stopped before ${pending.name} ended`));
+        if (!child)
+            return;
+        if (child.connected)
+            child.disconnect();
+        child.kill();
+    }
+    ensureChild() {
+        if (this.child && !this.child.killed && this.child.connected)
+            return this.child;
+        const child = (0, node_child_process_1.fork)(this.workerPath, [], {
+            cwd: process.cwd(),
+            env: process.env,
+            stdio: ["ignore", "pipe", "pipe", "ipc"],
+            serialization: "json",
+        });
+        child.stdout?.on("data", (chunk) => diagnostic("stdout", chunk));
+        child.stderr?.on("data", (chunk) => diagnostic("stderr", chunk));
+        child.on("message", (message) => this.handleMessage(child, message));
+        child.on("error", (error) => this.handleStopped(child, error));
+        child.on("exit", () => this.handleStopped(child));
+        this.child = child;
+        return child;
+    }
+    handleMessage(child, message) {
+        if (child !== this.child || !isResponse(message)) {
+            this.handleStopped(child, new Error("MCP tool process sent an invalid response"));
+            child.kill();
+            return;
+        }
+        const pending = this.pending;
+        if (!pending || pending.id !== message.id) {
+            this.handleStopped(child, new Error("MCP tool process sent an unexpected response"));
+            child.kill();
+            return;
+        }
+        this.pending = undefined;
+        if (message.ok)
+            pending.resolve(message.text);
+        else
+            pending.reject(new Error(message.error));
+    }
+    handleStopped(child, error) {
+        if (child !== this.child)
+            return;
+        this.child = undefined;
+        const pending = this.pending;
+        this.pending = undefined;
+        if (pending) {
+            pending.reject(error ?? new Error(`MCP tool process stopped before ${pending.name} ended`));
+        }
+    }
+}
+exports.ToolProcessExecutor = ToolProcessExecutor;
+function isRequest(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const record = value;
+    return record.schemaVersion === 1 && typeof record.id === "number" && typeof record.name === "string";
+}
+function send(message) {
+    if (process.send)
+        process.send(message);
+}
+/** Child entry point. Kept in this module so the parent and child share one
+ * small, checked IPC shape. */
+function startToolProcessWorker() {
+    process.on("disconnect", () => process.exit(0));
+    process.on("message", async (message) => {
+        if (!isRequest(message))
+            return;
+        try {
+            const result = await (0, dispatch_1.callTool)(message.name, message.args);
+            send({ schemaVersion: 1, id: message.id, ok: true, text: (0, safe_json_1.safeJsonStringify)(result) });
+        }
+        catch (error) {
+            send({ schemaVersion: 1, id: message.id, ok: false, error: error instanceof Error ? error.message : String(error) });
+        }
+    });
+}
+if (require.main === module)
+    startToolProcessWorker();

package/dist/mcp-server.js

@@ -26,4 +26,11 @@ function exitQuietOnEpipe(stream) {
 }
 exitQuietOnEpipe(process.stdout);
 exitQuietOnEpipe(process.stderr);
-(0, server_1.startServer)();
+try {
+    (0, server_1.startServer)();
+}
+catch (error) {
+    const text = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`cool-workflow mcp: ${text}\n`);
+    process.exitCode = 1;
+}

package/dist/shell/agent-config.js

@@ -246,10 +246,19 @@ function resolveAgentConfig(args = {}, env = process.env) {
     if (!finalCommand && !endpoint) {
         const detected = detectAgentFromPath(env);
         if (detected) {
-            finalCommand = expandBuiltinAgentCommand(`builtin:${detected}`);
+            // Detect = use what was found. Auto-detect saw a BINARY on PATH, so it
+            // must resolve to the wrapper that runs THAT binary. For "gemini" the
+            // plain builtin:gemini template goes through opencode instead (a user
+            // choice kept for the explicit -gemini flag, where --help says "via
+            // opencode") — a machine with only the native gemini CLI would be
+            // detected as ready and then fail when the wrapper spawns a missing
+            // opencode. So the auto path maps gemini to builtin:gemini-cli, the
+            // wrapper that spawns the found binary itself.
+            const template = detected === "gemini" ? "gemini-cli" : detected;
+            finalCommand = expandBuiltinAgentCommand(`builtin:${template}`);
             finalSource = "auto";
             if (!finalModel)
-                finalModel = `builtin:${detected}`;
+                finalModel = `builtin:${template}`;
         }
     }
     return {

package/dist/shell/audit-cli.js

@@ -160,7 +160,7 @@ function auditRepairCli(runId, args) {
  *  data can never drift from the standalone commands' output. */
 function auditSummaryCli(runId, args) {
     const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
-    return (0, trust_audit_1.summarizeTrustAudit)(run);
+    return (0, trust_audit_1.summarizeTrustAudit)(run, { persist: args.__cwWorkbenchReadOnlyProjection !== true });
 }
 function auditMultiAgentCli(runId, args) {
     const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));