cool-workflow 0.2.5 → 0.2.6

package/dist/shell/drive.js

@@ -79,6 +79,7 @@ const reporter_1 = require("./reporter");
 const fs_atomic_1 = require("./fs-atomic");
 const observability_1 = require("./observability");
 const telemetry_attestation_1 = require("../core/trust/telemetry-attestation");
+const perf_trace_1 = require("./perf-trace");
 /** Total RECORDED tokens across the run's attested units, reading the
  *  agent-reported usage through normalizeReportedUsage so a hop that
  *  reported snake_case buckets (`input_tokens`/`output_tokens`, the shape
@@ -117,8 +118,9 @@ function tokenBudgetUsage(run) {
         return undefined;
     return { spent: recordedTokenTotal(run), budget };
 }
-exports.DRIVE_SCHEMA_VERSION = 1;
-exports.MAX_SUB_WORKFLOW_DEPTH = 4;
+var drive_decide_2 = require("../core/pipeline/drive-decide");
+Object.defineProperty(exports, "DRIVE_SCHEMA_VERSION", { enumerable: true, get: function () { return drive_decide_2.DRIVE_SCHEMA_VERSION; } });
+Object.defineProperty(exports, "MAX_SUB_WORKFLOW_DEPTH", { enumerable: true, get: function () { return drive_decide_2.MAX_SUB_WORKFLOW_DEPTH; } });
 function agentConfigured(config) {
     return Boolean(config.command || config.endpoint);
 }
@@ -433,8 +435,8 @@ function processSelectedTask(ctx, selectedId, preparedOutcome, deferPersist = fa
 }
 function runSubWorkflow(ctx, run, selected, workerId, manifest, spec, deferPersist = false) {
     const parentApp = run.workflow.id;
-    if (ctx.depth + 1 > exports.MAX_SUB_WORKFLOW_DEPTH) {
-        return handleHop(ctx, selected, workerId, `sub-workflow depth limit exceeded (> ${exports.MAX_SUB_WORKFLOW_DEPTH})`, deferPersist, deferPersist ? run : undefined);
+    if (ctx.depth + 1 > drive_decide_1.MAX_SUB_WORKFLOW_DEPTH) {
+        return handleHop(ctx, selected, workerId, `sub-workflow depth limit exceeded (> ${drive_decide_1.MAX_SUB_WORKFLOW_DEPTH})`, deferPersist, deferPersist ? run : undefined);
     }
     if ([...ctx.visitedAppIds, parentApp].includes(spec.appId)) {
         return handleHop(ctx, selected, workerId, `sub-workflow cycle detected: ${[...ctx.visitedAppIds, parentApp, spec.appId].join(" -> ")}`, deferPersist, deferPersist ? run : undefined);
@@ -682,75 +684,79 @@ function prepareConcurrentOutcomes(ctx, batch) {
     // all-sub-workflow batch), or a crash before the round-end flush loses
     // the dispatch.
     let dispatchedThisRound = false;
-    for (const taskId of batch) {
-        const run = loadRun(ctx);
-        const task = run.tasks.find((candidate) => candidate.id === taskId);
-        if (!task || (task.status !== "pending" && task.status !== "running"))
-            continue;
-        let workerId = task.workerId;
-        if (task.status === "pending") {
-            const manifest = (0, dispatch_2.createDispatchManifest)(run, 1, { backendId: task.agentType || "agent" });
-            const dispatchedTask = manifest.tasks.find((entry) => entry.id === task.id) || manifest.tasks[0];
-            if (!dispatchedTask || !dispatchedTask.workerId) {
-                failSteps.set(taskId, (0, drive_decide_1.makeStep)("dispatch", "failed", { runId: ctx.runId, taskId, phase: task.phase, reason: "dispatch produced no worker scope" }));
+    // Dispatch is a short local mutation group. Keep its audit lock only until
+    // its events have one durable append; the agent work below stays outside it.
+    (0, trust_audit_1.withTrustAuditBatch)(loadRun(ctx), () => {
+        for (const taskId of batch) {
+            const run = loadRun(ctx);
+            const task = run.tasks.find((candidate) => candidate.id === taskId);
+            if (!task || (task.status !== "pending" && task.status !== "running"))
                 continue;
+            let workerId = task.workerId;
+            if (task.status === "pending") {
+                const manifest = (0, dispatch_2.createDispatchManifest)(run, 1, { backendId: task.agentType || "agent" });
+                const dispatchedTask = manifest.tasks.find((entry) => entry.id === task.id) || manifest.tasks[0];
+                if (!dispatchedTask || !dispatchedTask.workerId) {
+                    failSteps.set(taskId, (0, drive_decide_1.makeStep)("dispatch", "failed", { runId: ctx.runId, taskId, phase: task.phase, reason: "dispatch produced no worker scope" }));
+                    continue;
+                }
+                workerId = dispatchedTask.workerId;
+                dispatchedThisRound = true;
             }
-            workerId = dispatchedTask.workerId;
-            dispatchedThisRound = true;
-        }
-        if (!workerId) {
-            failSteps.set(taskId, (0, drive_decide_1.makeStep)("dispatch", "failed", { runId: ctx.runId, taskId, phase: task.phase, reason: "no worker scope for task" }));
-            continue;
-        }
-        const freshRun = loadRun(ctx);
-        const manifest = (0, worker_isolation_1.showWorkerManifest)(freshRun, workerId);
-        const delegationDigest = ctx.incremental
-            ? (0, drive_decide_1.incrementalDelegationDigest)(task.model || ctx.config.model || "", task.agentType || "agent", manifest.sandboxPolicy?.id || task.sandboxProfileId || "", ctx.config.command || "", ctx.config.args ? (0, agent_1.stripSecretArgs)(ctx.config.args) : [], ctx.config.endpoint || "")
-            : "";
-        const cachePath = resultCachePath(freshRun, task, (0, hash_1.sha256)(task.prompt || ""), ctx.incremental, delegationDigest);
-        if (cachePath && fs.existsSync(cachePath))
-            continue;
-        // A sub-workflow task never goes through the spawn path — processSelectedTask
-        // checks task.subWorkflow before it ever looks at a prepared spawn outcome
-        // and always takes its own runSubWorkflow branch instead (mirrors that
-        // check byte-for-byte). Building a spawn OR endpoint job for it here would
-        // just be a real agent child spawned/delegated and thrown away unused.
-        const subWorkflow = task.subWorkflow;
-        if (subWorkflow)
-            continue;
-        const request = {
-            schemaVersion: 1,
-            runId: ctx.runId,
-            taskId: task.id,
-            backendId: task.agentType || "agent",
-            cwd: freshRun.cwd,
-            sandboxPolicy: manifest.sandboxPolicy,
-            manifest: { workerDir: manifest.workerDir, manifestPath: manifest.manifestPath, inputPath: manifest.inputPath, resultPath: manifest.resultPath, prompt: manifest.prompt },
-            label: task.id,
-            timeoutMs: ctx.config.timeoutMs,
-            delegation: { command: ctx.config.command, args: ctx.config.args, endpoint: ctx.config.endpoint, model: task.model || ctx.config.model },
-        };
-        const job = (0, agent_1.prepareAgentSpawn)(request);
-        if (job) {
-            const sandboxPolicy = manifest.sandboxPolicy;
-            if (sandboxPolicy) {
-                job.env = (0, agent_1.buildAgentChildEnv)(sandboxPolicy).env;
+            if (!workerId) {
+                failSteps.set(taskId, (0, drive_decide_1.makeStep)("dispatch", "failed", { runId: ctx.runId, taskId, phase: task.phase, reason: "no worker scope for task" }));
+                continue;
+            }
+            const freshRun = loadRun(ctx);
+            const manifest = (0, worker_isolation_1.showWorkerManifest)(freshRun, workerId);
+            const delegationDigest = ctx.incremental
+                ? (0, drive_decide_1.incrementalDelegationDigest)(task.model || ctx.config.model || "", task.agentType || "agent", manifest.sandboxPolicy?.id || task.sandboxProfileId || "", ctx.config.command || "", ctx.config.args ? (0, agent_1.stripSecretArgs)(ctx.config.args) : [], ctx.config.endpoint || "")
+                : "";
+            const cachePath = resultCachePath(freshRun, task, (0, hash_1.sha256)(task.prompt || ""), ctx.incremental, delegationDigest);
+            if (cachePath && fs.existsSync(cachePath))
+                continue;
+            // A sub-workflow task never goes through the spawn path — processSelectedTask
+            // checks task.subWorkflow before it ever looks at a prepared spawn outcome
+            // and always takes its own runSubWorkflow branch instead (mirrors that
+            // check byte-for-byte). Building a spawn OR endpoint job for it here would
+            // just be a real agent child spawned/delegated and thrown away unused.
+            const subWorkflow = task.subWorkflow;
+            if (subWorkflow)
+                continue;
+            const request = {
+                schemaVersion: 1,
+                runId: ctx.runId,
+                taskId: task.id,
+                backendId: task.agentType || "agent",
+                cwd: freshRun.cwd,
+                sandboxPolicy: manifest.sandboxPolicy,
+                manifest: { workerDir: manifest.workerDir, manifestPath: manifest.manifestPath, inputPath: manifest.inputPath, resultPath: manifest.resultPath, prompt: manifest.prompt },
+                label: task.id,
+                timeoutMs: ctx.config.timeoutMs,
+                delegation: { command: ctx.config.command, args: ctx.config.args, endpoint: ctx.config.endpoint, model: task.model || ctx.config.model },
+            };
+            const job = (0, agent_1.prepareAgentSpawn)(request);
+            if (job) {
+                const sandboxPolicy = manifest.sandboxPolicy;
+                if (sandboxPolicy) {
+                    job.env = (0, agent_1.buildAgentChildEnv)(sandboxPolicy).env;
+                }
+                jobs.push(job);
+                jobTaskIds.push(taskId);
+                continue;
+            }
+            // Endpoint-configured agent: no CLI binary to batch-spawn, but its HTTP
+            // delegation joins the concurrent window through the endpoint batch child
+            // (runEndpointBatchOutcomes) rather than settling one-at-a-time on the
+            // serial path. An unconfigured agent (neither command nor endpoint) returns
+            // undefined from both prepares here and falls to the serial refusal.
+            const endpointJob = (0, agent_1.prepareEndpointJob)(request);
+            if (endpointJob) {
+                endpointJobs.push(endpointJob);
+                endpointTaskIds.push(taskId);
             }
-            jobs.push(job);
-            jobTaskIds.push(taskId);
-            continue;
-        }
-        // Endpoint-configured agent: no CLI binary to batch-spawn, but its HTTP
-        // delegation joins the concurrent window through the endpoint batch child
-        // (runEndpointBatchOutcomes) rather than settling one-at-a-time on the
-        // serial path. An unconfigured agent (neither command nor endpoint) returns
-        // undefined from both prepares here and falls to the serial refusal.
-        const endpointJob = (0, agent_1.prepareEndpointJob)(request);
-        if (endpointJob) {
-            endpointJobs.push(endpointJob);
-            endpointTaskIds.push(taskId);
         }
-    }
+    });
     const totalJobs = jobs.length + endpointJobs.length;
     if (totalJobs) {
         emitProgress(`⇉ concurrent round: ${totalJobs} agent${totalJobs > 1 ? "s" : ""} spawning in parallel, may take minutes…`);
@@ -802,28 +808,32 @@ function driveConcurrentRound(ctx, limit) {
             .filter((task) => phaseTaskIds.has(task.id) && (task.status === "pending" || task.status === "running"))
             .slice(0, width)
             .map((task) => task.id);
-        const prepared = prepareConcurrentOutcomes(ctx, batch);
+        const prepared = (0, perf_trace_1.withPerfTraceGroup)("dispatch", () => prepareConcurrentOutcomes(ctx, batch));
         const steps = [];
-        for (const taskId of batch) {
-            const failStep = prepared.failSteps.get(taskId);
-            if (failStep) {
-                steps.push(failStep);
-                continue;
+        // Settlement is also local and synchronous. Flush the complete audit
+        // group before the existing round checkpoint, never across it.
+        (0, perf_trace_1.withPerfTraceGroup)("settlement", () => (0, trust_audit_1.withTrustAuditBatch)(loadRun(ctx), () => {
+            for (const taskId of batch) {
+                const failStep = prepared.failSteps.get(taskId);
+                if (failStep) {
+                    steps.push(failStep);
+                    continue;
+                }
+                // Re-read per task: a prior accept in this round mutated state (the
+                // SAME cached object via loadRun's round cache — no disk round-trip
+                // until the round-end flush below).
+                const freshRun = loadRun(ctx);
+                const fresh = freshRun.tasks.find((task) => task.id === taskId);
+                if (!fresh || (fresh.status !== "pending" && fresh.status !== "running"))
+                    continue;
+                steps.push(processSelectedTask(ctx, taskId, prepared.outcomes.get(taskId), true));
             }
-            // Re-read per task: a prior accept in this round mutated state (the
-            // SAME cached object via loadRun's round cache — no disk round-trip
-            // until the round-end flush below).
-            const freshRun = loadRun(ctx);
-            const fresh = freshRun.tasks.find((task) => task.id === taskId);
-            if (!fresh || (fresh.status !== "pending" && fresh.status !== "running"))
-                continue;
-            steps.push(processSelectedTask(ctx, taskId, prepared.outcomes.get(taskId), true));
-        }
+        }));
         if (steps.length > 0) {
             const settledRun = loadRun(ctx);
-            (0, commit_1.commitState)(settledRun, `concurrent-round:${batch.length}-tasks`);
-            (0, report_1.writeReport)(settledRun);
-            (0, run_store_1.saveCheckpoint)(settledRun);
+            (0, perf_trace_1.withPerfTraceGroup)("checkpoint", () => (0, commit_1.commitState)(settledRun, `concurrent-round:${batch.length}-tasks`));
+            (0, perf_trace_1.withPerfTraceGroup)("report", () => (0, report_1.writeReport)(settledRun));
+            (0, perf_trace_1.withPerfTraceGroup)("checkpoint", () => (0, run_store_1.saveCheckpoint)(settledRun));
         }
         return steps.length > 0 ? steps : [driveStep(ctx)];
     });
@@ -918,7 +928,7 @@ function driveOneRound(ctx, options, steps, emitPhaseProgress) {
     // re-read+re-parse state.json even though nothing on disk changed
     // between them — reads that only reflect the mutations THIS round's
     // own steps make, which the shared in-memory object already carries.
-    const roundSteps = withRoundCache(ctx, () => {
+    const roundSteps = (0, perf_trace_1.withPerfTraceGroup)("round", () => withRoundCache(ctx, () => {
         const width = (0, drive_decide_1.roundWidth)(loadRun(ctx), options.concurrency);
         // width>1 (an explicit --concurrency>1, or an auto-width parallel
         // phase) runs the whole round through driveConcurrentRound — one or
@@ -926,7 +936,7 @@ function driveOneRound(ctx, options, steps, emitPhaseProgress) {
         // end. `--once` still stops after this ONE round even though a round
         // can yield multiple steps.
         return width > 1 ? driveConcurrentRound(ctx, width) : [driveStep(ctx)];
-    });
+    }));
     for (const stepResult of roundSteps)
         steps.push(stepResult);
     // Brew-style phase boundaries: after each round, announce a newly-active

package/dist/shell/execution-backend/agent.js

@@ -75,6 +75,7 @@ const os = __importStar(require("node:os"));
 const node_child_process_1 = require("node:child_process");
 const local_1 = require("./local");
 const envelopes_1 = require("./envelopes");
+const perf_trace_1 = require("../perf-trace");
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -438,19 +439,21 @@ function reconcileBatchOutcomes(jobs, child) {
 function runAgentBatchOutcomes(jobs) {
     if (!jobs.length)
         return [];
-    const maxTimeout = Math.max(...jobs.map((job) => job.timeoutMs));
-    let child;
-    try {
-        child = (0, node_child_process_1.spawnSync)(process.execPath, [BATCH_DELEGATE_CHILD_SCRIPT], {
-            input: JSON.stringify(jobs),
-            maxBuffer: 34 * 1024 * 1024 * jobs.length,
-            timeout: maxTimeout + 30000,
-        });
-    }
-    catch (error) {
-        child = { error: error instanceof Error ? error : new Error(String(error)), status: null, stdout: null };
-    }
-    return reconcileBatchOutcomes(jobs, child);
+    return (0, perf_trace_1.withPerfTraceGroup)("agent-wait", () => {
+        const maxTimeout = Math.max(...jobs.map((job) => job.timeoutMs));
+        let child;
+        try {
+            child = (0, node_child_process_1.spawnSync)(process.execPath, [BATCH_DELEGATE_CHILD_SCRIPT], {
+                input: JSON.stringify(jobs),
+                maxBuffer: 34 * 1024 * 1024 * jobs.length,
+                timeout: maxTimeout + 30000,
+            });
+        }
+        catch (error) {
+            child = { error: error instanceof Error ? error : new Error(String(error)), status: null, stdout: null };
+        }
+        return reconcileBatchOutcomes(jobs, child);
+    });
 }
 // Same package-root depth fix as BATCH_DELEGATE_CHILD_SCRIPT above.
 const HTTP_BATCH_DELEGATE_CHILD_SCRIPT = path.resolve(__dirname, "..", "..", "..", "scripts", "children", "http-batch-delegate-child.js");
@@ -530,7 +533,7 @@ function runAgentProcess(descriptor, policy, request, label, attestation) {
             // of `built.forwarded` / the trust-audit forwarded list.
             const vendorPidFile = vendorPidFilePath();
             const childEnv = { ...built.env, CW_AGENT_VENDOR_PIDFILE: vendorPidFile };
-            const child = (0, node_child_process_1.spawnSync)(resolved.binary, realArgs, {
+            const child = (0, perf_trace_1.withPerfTraceGroup)("agent-wait", () => (0, node_child_process_1.spawnSync)(resolved.binary, realArgs, {
                 cwd: request.cwd,
                 env: childEnv,
                 encoding: "utf8",
@@ -544,7 +547,7 @@ function runAgentProcess(descriptor, policy, request, label, attestation) {
                 // anyway — so a hard kill loses nothing and cannot wedge cw.
                 killSignal: "SIGKILL",
                 stdio: ["ignore", "pipe", streamStderr ? "inherit" : "pipe"],
-            });
+            }));
             // A timeout surfaces as child.error with code ETIMEDOUT (status null,
             // signal set). Classify it FIRST: without this, the generic spawnError
             // branch below reported "agent process failed to spawn: ...ETIMEDOUT"

package/dist/shell/execution-backend/local.js

@@ -31,6 +31,7 @@ function messageOf(error) {
 exports.CW_NEVER_FORWARD_ENV = new Set([
     "CW_RELEASE_VERDICT_PRIVKEY", // release verdict signing key — release-flow.js only
     "CW_WORKBENCH_TOKEN", // workbench HTTP bearer token — workbench-host.ts only
+    "CW_BENCH_TRACE_FILE", // benchmark trace path — parent drive only
 ]);
 function buildChildEnv(policy, baseEnv = process.env) {
     // deny must win regardless of inherit: a custom profile combining

package/dist/shell/fs-atomic.js

@@ -53,6 +53,7 @@ exports.nextBackoffMs = nextBackoffMs;
 exports.withFileLock = withFileLock;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const perf_trace_1 = require("./perf-trace");
 // ---------------------------------------------------------------------------
 // writeJson — the ONE JSON-on-disk byte format: JSON.stringify(value, null, 2)
 // + "\n", written via temp-file + optional fsync + rename (atomic).
@@ -104,6 +105,7 @@ function writeBytesAtomic(file, contents, durable) {
         catch {
             /* directory fsync is best-effort (not supported on every platform) */
         }
+        (0, perf_trace_1.recordPerfDurableWrite)(Buffer.byteLength(contents, "utf8"));
     }
 }
 /** Atomic, optionally-durable JSON write — see `writeBytesAtomic`. */
@@ -197,6 +199,7 @@ function durableAppendFileSync(file, data) {
     finally {
         fs.closeSync(fd);
     }
+    (0, perf_trace_1.recordPerfDurableWrite)(Buffer.byteLength(data, "utf8"));
 }
 /** True when `file`'s final byte is "\n", given its already-known `size`.
  *  A COMPLETED `durableAppendFileSync` always leaves the file ending in

package/dist/shell/metrics-cli.js

@@ -71,7 +71,7 @@ function nowOf(args) {
 function metricsShowCli(runId, args) {
     const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
     const policy = (0, observability_1.loadCostPolicy)(args, pluginRoot());
-    return (0, observability_1.showMetricsReport)(run, { now: nowOf(args), policy });
+    return (0, observability_1.showMetricsReport)(run, { now: nowOf(args), policy, persist: args.__cwWorkbenchReadOnlyProjection !== true });
 }
 /** `cw metrics summary [--scope repo|home] [--pricing ...] [--now ISO] [--limit N]`.
  *  `--limit` defaults to RunRegistry.list()'s own 50-record floor when omitted. */

package/dist/shell/multi-agent-cli.js

@@ -140,7 +140,10 @@ function invocationCwd(args) {
     return typeof args.cwd === "string" && args.cwd.trim() ? path.resolve(args.cwd) : process.cwd();
 }
 function loadRun(args, runId) {
-    return (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    if (args.__cwWorkbenchReadOnlyProjection === true)
+        run.__cwWorkbenchReadOnlyProjection = true;
+    return run;
 }
 /** Hold the run's state.json lock across the WHOLE load -> change ->
  *  persist cycle. A bare loadRun + persist pair races: two processes both

package/dist/shell/multi-agent-operator-ux.js

@@ -91,7 +91,7 @@ function summarizeMultiAgentOperator(run) {
     const topologies = (0, topology_io_1.summarizeTopologies)(run);
     const multiAgent = (0, multi_agent_io_1.summarizeMultiAgent)(run);
     const blackboard = (0, coordinator_io_1.summarizeBlackboard)(run);
-    const trust = (0, trust_audit_1.summarizeTrustAudit)(run);
+    const trust = (0, trust_audit_1.summarizeTrustAudit)(run, { persist: run.__cwWorkbenchReadOnlyProjection !== true });
     const dependencies = deriveDependencies(run);
     const failures = deriveFailures(run, dependencies);
     const evidence = deriveEvidence(run);

package/dist/shell/observability.js

@@ -453,13 +453,16 @@ function loadPersistedMetricsFingerprint(run) {
 }
 /** Derive + persist the per-run report. The RETURNED payload is pinned to
  *  `freshness: "valid"` (persistedFingerprint === itself) so `cw metrics
- *  show --json` and the MCP tool are byte-identical; NEVER touches
- *  state.json (invariant 6). */
+ *  show --json` and the MCP tool are byte-identical. The Workbench's private
+ *  projection mode keeps that established payload but does not create a
+ *  derived file; NEVER touches state.json (invariant 6). */
 function showMetricsReport(run, options) {
     const live = deriveMetricsReport(run, { now: options.now, policy: options.policy });
     const report = { ...live, freshness: { status: "valid", persistedFingerprint: live.sourceFingerprint, currentFingerprint: live.sourceFingerprint } };
-    fs.mkdirSync(metricsDir(run), { recursive: true });
-    (0, fs_atomic_1.writeJson)(metricsReportPath(run), report);
+    if (options.persist !== false) {
+        fs.mkdirSync(metricsDir(run), { recursive: true });
+        (0, fs_atomic_1.writeJson)(metricsReportPath(run), report);
+    }
     return report;
 }
 function poolRates(metric, rates) {

package/dist/shell/operator-ux.js

@@ -290,7 +290,7 @@ function summarizeOperatorRun(run) {
     const multiAgentOperator = (0, multi_agent_operator_ux_1.summarizeMultiAgentOperator)(run);
     const multiAgentTrust = (0, trust_policy_io_1.summarizeMultiAgentTrust)(run);
     const blackboard = (0, coordinator_io_1.summarizeBlackboard)(run);
-    const trust = (0, trust_audit_1.summarizeTrustAudit)(run);
+    const trust = (0, trust_audit_1.summarizeTrustAudit)(run, { persist: run.__cwWorkbenchReadOnlyProjection !== true });
     const activePhase = phases.find((p) => p.status === "running") || phases.find((p) => p.status === "pending");
     const blockedReasons = [];
     for (const worker of workers.workers) {

package/dist/shell/perf-trace.js

@@ -0,0 +1,136 @@
+"use strict";
+// shell/perf-trace.ts — opt-in cold-path timing evidence for the benchmark
+// runner. This is not a product log: it is off unless CW_BENCH_TRACE_FILE is
+// set by scripts/bench/run.js, and it writes one JSON report when the drive
+// process ends. Normal CLI and MCP work do not see it.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withPerfTraceGroup = withPerfTraceGroup;
+exports.recordPerfDurableWrite = recordPerfDurableWrite;
+const fs = __importStar(require("node:fs"));
+const TRACE_FILE = process.env.CW_BENCH_TRACE_FILE || "";
+const groups = new Map();
+const scopes = [];
+function enabled() {
+    return TRACE_FILE.length > 0;
+}
+function groupFor(name) {
+    let group = groups.get(name);
+    if (!group) {
+        group = { durationMs: 0, selfMs: 0, durableWriteCount: 0, durableWriteBytes: 0, samples: [] };
+        groups.set(name, group);
+    }
+    return group;
+}
+function elapsedMs(startedAt) {
+    return Number(process.hrtime.bigint() - startedAt) / 1_000_000;
+}
+/** Run synchronous work as one named benchmark group. Nested work is kept in
+ * the parent duration, but removed from its self time. That lets the report
+ * show dispatch work apart from its agent wait without changing call order. */
+function withPerfTraceGroup(name, fn) {
+    if (!enabled())
+        return fn();
+    const scope = { name, startedAt: process.hrtime.bigint(), childMs: 0, durableWriteCount: 0, durableWriteBytes: 0 };
+    scopes.push(scope);
+    try {
+        return fn();
+    }
+    finally {
+        const ended = scopes.pop();
+        if (ended) {
+            const durationMs = elapsedMs(ended.startedAt);
+            const group = groupFor(ended.name);
+            group.durationMs += durationMs;
+            group.selfMs += Math.max(0, durationMs - ended.childMs);
+            group.durableWriteCount += ended.durableWriteCount;
+            group.durableWriteBytes += ended.durableWriteBytes;
+            group.samples.push({
+                durationMs: rounded(durationMs),
+                selfMs: rounded(Math.max(0, durationMs - ended.childMs)),
+                durableWriteCount: ended.durableWriteCount,
+                durableWriteBytes: ended.durableWriteBytes,
+            });
+            const parent = scopes[scopes.length - 1];
+            if (parent)
+                parent.childMs += durationMs;
+        }
+    }
+}
+/** Count a completed durable file write in the active benchmark group. */
+function recordPerfDurableWrite(bytes) {
+    if (!enabled())
+        return;
+    const active = scopes[scopes.length - 1];
+    if (!active) {
+        const group = groupFor("other");
+        group.durableWriteCount += 1;
+        group.durableWriteBytes += bytes;
+        return;
+    }
+    for (const scope of scopes) {
+        scope.durableWriteCount += 1;
+        scope.durableWriteBytes += bytes;
+    }
+}
+function rounded(value) {
+    return Math.round(value * 1000) / 1000;
+}
+function writeTrace() {
+    if (!enabled())
+        return;
+    const value = {
+        schemaVersion: 1,
+        benchmark: "cw-cold-path",
+        groups: [...groups.entries()]
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([name, group]) => ({
+            name,
+            durationMs: rounded(group.durationMs),
+            selfMs: rounded(group.selfMs),
+            durableWriteCount: group.durableWriteCount,
+            durableWriteBytes: group.durableWriteBytes,
+            samples: group.samples,
+        })),
+    };
+    try {
+        fs.writeFileSync(TRACE_FILE, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+    }
+    catch {
+        // A benchmark trace must never change the drive result or exit status.
+    }
+}
+if (enabled())
+    process.once("exit", writeTrace);

package/dist/shell/pipeline.js

@@ -148,7 +148,7 @@ function plan(app, options) {
     const runId = injectedRunId || createRunId(app.workflow.id);
     const runDir = path.join(cwd, ".cw", "runs", runId);
     const paths = (0, run_paths_1.createRunPaths)(runDir);
-    (0, run_paths_1.ensureRunDirs)(paths);
+    (0, run_store_1.ensureRunDirs)(paths);
     const tasks = flattenTasks(app, inputs);
     // Stamp a real wall-clock createdAt/updatedAt at plan time (shell layer —
     // clock reads are allowed here). The pure migration defaults a run that

package/dist/shell/report-view-cli.js

@@ -109,6 +109,8 @@ function operatorReportText(runId, args) {
 /** `cw graph <id> [--json]` / `cw operator graph`. */
 function graphCli(runId, args) {
     const run = (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
+    if (args.__cwWorkbenchReadOnlyProjection === true)
+        run.__cwWorkbenchReadOnlyProjection = true;
     return (0, operator_ux_1.buildOperatorGraph)(run);
 }
 function graphText(runId, args) {

package/dist/shell/run-export-cli.js

@@ -100,7 +100,10 @@ function runRestoreCli(archivePath, args) {
     if (!inspect.ok) {
         return { schemaVersion: 1, ok: false, target, inspect, imported: null, verify: null, registry: null };
     }
-    const imported = (0, run_export_1.importRun)(resolvedArchive, target);
+    const restored = (0, run_export_1.restoreRunAtomically)(resolvedArchive, target);
+    if (!restored.imported) {
+        return { schemaVersion: 1, ok: false, target, inspect, imported: null, verify: restored.verification, registry: null };
+    }
     const registry = new run_registry_io_1.RunRegistry(target).refresh({ scope: "repo" });
-    return { schemaVersion: 1, ok: imported.verification.ok, target, inspect, imported: imported.run, verify: imported.verification, registry };
+    return { schemaVersion: 1, ok: true, target, inspect, imported: restored.imported.run, verify: restored.verification, registry };
 }