cool-workflow 0.2.5 → 0.2.6

package/dist/shell/run-export.js

@@ -44,6 +44,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.exportRun = exportRun;
 exports.importRun = importRun;
+exports.restoreRunAtomically = restoreRunAtomically;
 exports.verifyImportedRun = verifyImportedRun;
 exports.inspectArchive = inspectArchive;
 exports.importManifestPath = importManifestPath;
@@ -98,12 +99,15 @@ function exportRun(run, outputPath, options = {}) {
 }
 /** Import a run from a portable JSON file into a target directory. */
 function importRun(exportPath, targetDir) {
-    const raw = (0, fs_atomic_1.readJson)(exportPath);
+    const limits = archiveIntakeLimits();
+    const archiveBytes = readArchiveBytes(exportPath, limits);
+    const raw = JSON.parse(archiveBytes.toString("utf8"));
     if (raw.schemaVersion !== 1)
         throw new Error(`Unsupported export schema version: ${raw.schemaVersion}`);
-    const archiveSha256 = (0, hash_1.sha256Bytes)(fs.readFileSync(exportPath));
+    const archiveSha256 = (0, hash_1.sha256Bytes)(archiveBytes);
     const files = normalizeArchiveFiles(raw);
-    verifyArchiveFileDigests(files, raw.integrity);
+    validateArchiveIntake(files, limits);
+    verifyArchiveFileDigests(files, raw.integrity, limits);
     if (!raw.run || typeof raw.run !== "object") {
         throw new Error("Invalid run export: missing run object");
     }
@@ -127,7 +131,7 @@ function importRun(exportPath, targetDir) {
     const oldRunDir = raw.run.paths.runDir;
     const oldCwd = raw.run.cwd;
     const paths = (0, run_paths_1.createRunPaths)(runDir);
-    (0, run_paths_1.ensureRunDirs)(paths);
+    (0, run_store_1.ensureRunDirs)(paths);
     for (const file of files) {
         const destination = path.join(runDir, file.relativePath);
         if (!(0, fs_atomic_1.isContainedPath)(destination, runDir)) {
@@ -164,6 +168,66 @@ function importRun(exportPath, targetDir) {
         verification,
     };
 }
+/** Restore through a same-disk staging tree, then publish the checked run with
+ *  one rename. Low-level import keeps its old report-only chain behavior. */
+function restoreRunAtomically(exportPath, targetDir) {
+    const physicalTarget = path.resolve(targetDir);
+    fs.mkdirSync(physicalTarget, { recursive: true });
+    const stageRoot = fs.mkdtempSync(path.join(physicalTarget, ".cw-restore-"));
+    let publishedRunDir;
+    try {
+        const staged = importRun(exportPath, stageRoot);
+        const finalRunDir = path.join(targetDir, ".cw", "runs", staged.run.id);
+        const physicalFinalRunDir = path.resolve(finalRunDir);
+        const stagedVerification = rebaseVerificationPaths(staged.verification, staged.run.paths.runDir, finalRunDir);
+        if (!staged.verification.ok)
+            return { imported: null, verification: stagedVerification };
+        if (fs.existsSync(physicalFinalRunDir)) {
+            throw new Error(`Refusing to overwrite existing restored run: ${staged.run.id}`);
+        }
+        const finalPaths = (0, run_paths_1.createRunPaths)(finalRunDir);
+        const finalRun = rebaseRun(staged.run, {
+            oldRunDir: staged.run.paths.runDir,
+            newRunDir: finalRunDir,
+            oldCwd: stageRoot,
+            newCwd: targetDir,
+            paths: finalPaths,
+        });
+        (0, fs_atomic_1.writeJson)(staged.run.paths.state, finalRun, { durable: true });
+        const stateCheck = (0, run_store_1.checkRunStateFile)(staged.run.paths.state);
+        if (stateCheck.report.status === "unsupported") {
+            throw new Error(`Restore state validation failed: ${stateCheck.report.errors.join("; ") || "unsupported run state"}`);
+        }
+        fs.mkdirSync(path.dirname(physicalFinalRunDir), { recursive: true });
+        fs.renameSync(path.resolve(staged.run.paths.runDir), physicalFinalRunDir);
+        publishedRunDir = physicalFinalRunDir;
+        const verification = verifyImportedRun(finalRun);
+        if (!verification.ok) {
+            fs.rmSync(physicalFinalRunDir, { recursive: true, force: true });
+            publishedRunDir = undefined;
+            return { imported: null, verification };
+        }
+        return {
+            imported: {
+                run: finalRun,
+                runDir: finalRunDir,
+                statePath: finalPaths.state,
+                manifestPath: importManifestPath(finalRun),
+                verifyCommand: `cw run verify-import ${finalRun.id} --cwd ${targetDir} --json`,
+                verification,
+            },
+            verification,
+        };
+    }
+    catch (error) {
+        if (publishedRunDir)
+            fs.rmSync(publishedRunDir, { recursive: true, force: true });
+        throw error;
+    }
+    finally {
+        fs.rmSync(stageRoot, { recursive: true, force: true });
+    }
+}
 /** Verify an imported run against its restore manifest and telemetry
  *  chain. */
 function verifyImportedRun(run) {
@@ -239,12 +303,21 @@ function inspectArchive(archivePath) {
         archiveSha256: null,
         checks: [],
     };
+    let limits;
+    try {
+        limits = archiveIntakeLimits();
+    }
+    catch (error) {
+        return { ...base, checks: [{ name: "archive-limit", pass: false, code: "archive-limit-invalid", actual: messageOf(error) }] };
+    }
     let bytes;
     try {
-        bytes = fs.readFileSync(archivePath);
+        bytes = readArchiveBytes(archivePath, limits);
     }
     catch (error) {
-        return { ...base, checks: [{ name: "archive", pass: false, code: "archive-unreadable", path: archivePath, actual: messageOf(error) }] };
+        const message = messageOf(error);
+        const limited = message.startsWith("Archive raw byte limit exceeded:");
+        return { ...base, checks: [{ name: limited ? "archive-limit" : "archive", pass: false, code: limited ? "archive-limit-raw-bytes" : "archive-unreadable", path: archivePath, actual: message }] };
     }
     base.archiveSha256 = (0, hash_1.sha256Bytes)(bytes);
     let raw;
@@ -263,7 +336,23 @@ function inspectArchive(archivePath) {
     }
     try {
         const files = normalizeArchiveFiles(raw);
-        const { checks } = collectArchiveDigestChecks(files, raw.integrity);
+        try {
+            validateArchiveIntake(files, limits);
+        }
+        catch (error) {
+            return {
+                schemaVersion: 1,
+                archivePath,
+                ok: false,
+                schemaSupported: true,
+                runId: raw.run && raw.run.id ? raw.run.id : null,
+                fileCount: files.length,
+                manifestSha256: raw.integrity ? digestManifest(files) : null,
+                archiveSha256: base.archiveSha256,
+                checks: [archiveLimitCheck(error)],
+            };
+        }
+        const checks = collectArchiveDigestChecks(files, raw.integrity, limits).checks;
         if (!raw.integrity && /^(1|true|yes|on)$/i.test(process.env.CW_REQUIRE_ARCHIVE_INTEGRITY || "")) {
             checks.push({ name: "archive-integrity", pass: false, code: "archive-integrity-required" });
         }
@@ -325,12 +414,12 @@ function verifyReportBundle(archivePath, options = {}) {
         reportFindingsVerified: false,
         failedChecks,
     };
-    if (!inspect.schemaSupported)
+    if (!inspect.schemaSupported || inspect.checks.some((check) => check.code?.startsWith("archive-limit-")))
         return base;
     let bundleKey;
     let reportContent;
     try {
-        const raw = JSON.parse(fs.readFileSync(archivePath, "utf8"));
+        const raw = JSON.parse(readArchiveBytes(archivePath, archiveIntakeLimits()).toString("utf8"));
         bundleKey = raw.trust?.publicKeyPem;
         if (options.extractReportTo) {
             const reportFile = (raw.files || []).find((file) => file.relativePath === "report.md");
@@ -565,28 +654,133 @@ function roleForRelativePath(relativePath) {
     return "run-file";
 }
 function normalizeArchiveFiles(raw) {
-    const modern = raw.files || [];
+    const modernValue = raw.files;
+    if (modernValue !== undefined && !Array.isArray(modernValue)) {
+        throw new Error("Invalid run export: files must be an array");
+    }
+    const modern = (modernValue || []);
     if (modern.length) {
-        return modern.map((file) => ({
-            relativePath: cleanArchiveRelativePath(file.relativePath),
-            role: file.role,
-            contentBase64: file.contentBase64,
-            sha256: file.sha256,
-            sizeBytes: file.sizeBytes,
-            sourcePath: file.sourcePath,
-        }));
-    }
-    return (raw.artifacts || []).map((artifact) => {
+        return validateArchiveFileTable(modern.map(normalizeModernArchiveFile));
+    }
+    const legacyValue = raw.artifacts;
+    if (legacyValue !== undefined && !Array.isArray(legacyValue)) {
+        throw new Error("Invalid run export: artifacts must be an array");
+    }
+    const legacy = (legacyValue || []).map((value) => {
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+            throw new Error("Invalid run export: every artifact must be an object");
+        }
+        const artifact = value;
+        if (typeof artifact.path !== "string")
+            throw new Error("Invalid run export: artifact path must be a string");
         const contentBase64 = artifact.contentBase64 || Buffer.from("", "utf8").toString("base64");
+        if (typeof contentBase64 !== "string")
+            throw new Error(`Invalid run export: contentBase64 must be a string for ${artifact.path}`);
         const bytes = Buffer.from(contentBase64, "base64");
         return {
             relativePath: cleanArchiveRelativePath(artifact.path),
             role: "artifact",
             contentBase64,
-            sha256: artifact.sha256 || (0, hash_1.sha256Bytes)(bytes),
-            sizeBytes: artifact.sizeBytes ?? bytes.length,
+            sha256: typeof artifact.sha256 === "string" ? artifact.sha256 : (0, hash_1.sha256Bytes)(bytes),
+            sizeBytes: artifact.sizeBytes === undefined ? bytes.length : artifact.sizeBytes,
         };
     });
+    return validateArchiveFileTable(legacy);
+}
+function archiveIntakeLimits() {
+    return {
+        rawBytes: archiveLimitFromEnvironment("CW_MAX_RUN_ARCHIVE_BYTES"),
+        fileCount: archiveLimitFromEnvironment("CW_MAX_RUN_ARCHIVE_FILES"),
+        contentBytes: archiveLimitFromEnvironment("CW_MAX_RUN_ARCHIVE_CONTENT_BYTES"),
+    };
+}
+function archiveLimitFromEnvironment(name) {
+    const value = process.env[name];
+    if (value === undefined)
+        return undefined;
+    if (!/^[1-9][0-9]*$/.test(value))
+        throw new Error(`Invalid ${name}: expected a positive safe integer`);
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed))
+        throw new Error(`Invalid ${name}: expected a positive safe integer`);
+    return parsed;
+}
+/** Read the archive only after its operator-set raw-byte limit has passed. */
+function readArchiveBytes(archivePath, limits) {
+    if (limits.rawBytes !== undefined) {
+        const size = fs.statSync(archivePath).size;
+        if (size > limits.rawBytes)
+            throw new Error(`Archive raw byte limit exceeded: max ${limits.rawBytes}, got ${size}`);
+    }
+    return fs.readFileSync(archivePath);
+}
+function validateArchiveIntake(files, limits) {
+    if (limits.fileCount !== undefined && files.length > limits.fileCount) {
+        throw new Error(`Archive file count limit exceeded: max ${limits.fileCount}, got ${files.length}`);
+    }
+    if (limits.contentBytes === undefined)
+        return;
+    let total = 0;
+    for (const file of files) {
+        if (file.sizeBytes > limits.contentBytes - total) {
+            throw new Error(`Archive content byte limit exceeded: max ${limits.contentBytes}, got more than ${limits.contentBytes}`);
+        }
+        total += file.sizeBytes;
+    }
+}
+function archiveLimitCheck(error) {
+    const actual = messageOf(error);
+    const code = actual.startsWith("Archive file count limit exceeded:")
+        ? "archive-limit-file-count"
+        : actual.startsWith("Archive content byte limit exceeded:")
+            ? "archive-limit-content-bytes"
+            : "archive-limit-invalid";
+    return { name: "archive-limit", pass: false, code, actual };
+}
+function normalizeModernArchiveFile(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Invalid run export: every file entry must be an object");
+    }
+    const file = value;
+    if (typeof file.relativePath !== "string")
+        throw new Error("Invalid run export: file relativePath must be a string");
+    if (typeof file.contentBase64 !== "string")
+        throw new Error(`Invalid run export: contentBase64 must be a string for ${file.relativePath}`);
+    if (typeof file.sha256 !== "string")
+        throw new Error(`Invalid run export: sha256 must be a string for ${file.relativePath}`);
+    if (file.sourcePath !== undefined && typeof file.sourcePath !== "string") {
+        throw new Error(`Invalid run export: sourcePath must be a string for ${file.relativePath}`);
+    }
+    return {
+        relativePath: cleanArchiveRelativePath(file.relativePath),
+        role: file.role,
+        contentBase64: file.contentBase64,
+        sha256: file.sha256,
+        sizeBytes: file.sizeBytes,
+        sourcePath: file.sourcePath,
+    };
+}
+/** Make one canonical, unique archive file table before any caller writes.
+ *  Digest and base64 checks run next, but shape and path faults stop here. */
+function validateArchiveFileTable(files) {
+    const roles = new Set(["artifact", "audit", "telemetry", "run-file"]);
+    const seen = new Set();
+    for (const file of files) {
+        if (!roles.has(file.role))
+            throw new Error(`Invalid archive file role for ${file.relativePath}: ${String(file.role)}`);
+        if (!/^[a-f0-9]{64}$/.test(file.sha256))
+            throw new Error(`Invalid archive sha256 for ${file.relativePath}`);
+        if (!Number.isSafeInteger(file.sizeBytes) || file.sizeBytes < 0) {
+            throw new Error(`Invalid archive size for ${file.relativePath}: ${String(file.sizeBytes)}`);
+        }
+        if (file.relativePath === "state.json" || file.relativePath === "import-manifest.json" || file.relativePath.endsWith(".lock")) {
+            throw new Error(`Reserved archive relative path: ${file.relativePath}`);
+        }
+        if (seen.has(file.relativePath))
+            throw new Error(`Duplicate archive relative path: ${file.relativePath}`);
+        seen.add(file.relativePath);
+    }
+    return files;
 }
 function decodeBase64StrictResult(value, relativePath) {
     if (typeof value !== "string") {
@@ -610,8 +804,9 @@ function decodeBase64Strict(value, relativePath) {
         throw new Error(archiveCheckMessage(decoded.check));
     return decoded.bytes;
 }
-function collectArchiveDigestChecks(files, integrity) {
+function collectArchiveDigestChecks(files, integrity, limits = {}) {
     const checks = [];
+    let decodedTotal = 0;
     for (const file of files) {
         const decoded = decodeBase64StrictResult(file.contentBase64, file.relativePath);
         if (!decoded.ok) {
@@ -619,6 +814,12 @@ function collectArchiveDigestChecks(files, integrity) {
             continue;
         }
         const bytes = decoded.bytes;
+        if (limits.contentBytes !== undefined && bytes.length > limits.contentBytes - decodedTotal) {
+            checks.push({ name: "archive-limit", pass: false, code: "archive-limit-content-bytes", path: file.relativePath, expected: String(limits.contentBytes), actual: `more than ${limits.contentBytes}` });
+        }
+        else {
+            decodedTotal += bytes.length;
+        }
         const actual = (0, hash_1.sha256Bytes)(bytes);
         const digestOk = actual === file.sha256;
         checks.push(digestOk ? { name: "archive-file", pass: true, path: file.relativePath } : { name: "archive-file", pass: false, code: "digest-mismatch", path: file.relativePath, expected: file.sha256, actual });
@@ -650,11 +851,11 @@ function archiveCheckMessage(check) {
             return `Archive verification failed: ${check.name}`;
     }
 }
-function verifyArchiveFileDigests(files, integrity) {
+function verifyArchiveFileDigests(files, integrity, limits = {}) {
     if (!integrity && /^(1|true|yes|on)$/i.test(process.env.CW_REQUIRE_ARCHIVE_INTEGRITY || "")) {
         throw new Error("Archive integrity block required but absent (CW_REQUIRE_ARCHIVE_INTEGRITY=1)");
     }
-    const failed = collectArchiveDigestChecks(files, integrity).checks.find((c) => !c.pass);
+    const failed = collectArchiveDigestChecks(files, integrity, limits).checks.find((c) => !c.pass);
     if (failed)
         throw new Error(archiveCheckMessage(failed));
 }
@@ -679,6 +880,16 @@ function rebaseRun(source, context) {
         : cloned.audit;
     return cloned;
 }
+function rebaseVerificationPaths(result, oldRunDir, newRunDir) {
+    const replace = (value) => value === oldRunDir || value.startsWith(oldRunDir + path.sep)
+        ? newRunDir + value.slice(oldRunDir.length)
+        : value;
+    return {
+        ...result,
+        manifestPath: replace(result.manifestPath),
+        checks: result.checks.map((check) => ({ ...check, ...(check.path ? { path: replace(check.path) } : {}) })),
+    };
+}
 function deepRebase(value, context) {
     if (typeof value === "string")
         return rebaseString(value, context);
@@ -705,10 +916,13 @@ function rebaseString(value, context) {
     return value;
 }
 function cleanArchiveRelativePath(value) {
-    const cleaned = toArchivePath(value).replace(/^\/+/, "");
-    if (!cleaned || cleaned === "." || cleaned.startsWith("../") || cleaned.includes("/../")) {
+    const portable = value.replace(/\\/g, "/");
+    if (portable.startsWith("/") || /^[A-Za-z]:\//.test(portable) || /(^|\/)\.\.(\/|$)/.test(portable) || /[\u0000-\u001f\u007f]/.test(portable)) {
         throw new Error(`Invalid archive relative path: ${value}`);
     }
+    const cleaned = path.posix.normalize(portable);
+    if (!cleaned || cleaned === "." || cleaned.startsWith("../") || cleaned.includes("/../"))
+        throw new Error(`Invalid archive relative path: ${value}`);
     return cleaned;
 }
 function toArchivePath(value) {

package/dist/shell/run-registry-io.js

@@ -1048,6 +1048,14 @@ function formatResume(result) {
         `Resume ${result.runId} [${result.lifecycle}] loopStage=${result.loopStage} (resolved from ${result.resolvedFrom}, ${result.freshness})`,
         `  resumable=${result.resumable} nextTasks=${result.nextTasks.length}`,
     ];
+    if (result.drive) {
+        lines.push(`  drive=${result.drive.status} workers=${result.drive.completedWorkers}/${result.drive.plannedWorkers} parked=${result.drive.parkedWorkers}`);
+        for (const step of result.drive.steps) {
+            lines.push(`  step ${step.action} [${step.status}]${step.taskId ? ` task=${step.taskId}` : ""}${step.reason ? ` reason=${step.reason}` : ""}`);
+        }
+        if (result.drive.commitId)
+            lines.push(`  commit=${result.drive.commitId}`);
+    }
     for (const action of result.nextActions)
         lines.push(`  -> ${action.command}\n     ${action.reason}`);
     return lines.join("\n");

package/dist/shell/run-store.js

@@ -44,7 +44,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ensureRunDirs = exports.createRunPaths = void 0;
+exports.createRunPaths = void 0;
+exports.ensureRunDirs = ensureRunDirs;
 exports.hashArtifactFile = hashArtifactFile;
 exports.loadRunStateFile = loadRunStateFile;
 exports.checkRunStateFile = checkRunStateFile;
@@ -63,9 +64,32 @@ const path = __importStar(require("node:path"));
 const fs_atomic_1 = require("./fs-atomic");
 const run_paths_1 = require("../core/state/run-paths");
 Object.defineProperty(exports, "createRunPaths", { enumerable: true, get: function () { return run_paths_1.createRunPaths; } });
-Object.defineProperty(exports, "ensureRunDirs", { enumerable: true, get: function () { return run_paths_1.ensureRunDirs; } });
 const migrations_1 = require("../core/state/migrations");
 const hash_1 = require("../core/hash");
+/** `mkdirSync` (recursive) every dir this run needs. Missing optional dir
+ *  fields fall back to `path.join(runDir, "<name>")`, matching the old
+ *  build's defensive default (a RunPaths loaded from an old/partial
+ *  state.json may be missing an optional key). */
+function ensureRunDirs(paths) {
+    const dirs = [
+        paths.runDir,
+        paths.tasksDir,
+        paths.resultsDir,
+        paths.dispatchesDir,
+        paths.artifactsDir,
+        paths.commitsDir,
+        paths.stateNodesDir,
+        paths.feedbackDir,
+        paths.auditDir || path.join(paths.runDir, "audit"),
+        paths.workersDir || path.join(paths.runDir, "workers"),
+        paths.candidatesDir || path.join(paths.runDir, "candidates"),
+        paths.multiAgentDir || path.join(paths.runDir, "multi-agent"),
+        paths.blackboardDir || path.join(paths.runDir, "blackboard"),
+        paths.topologiesDir || path.join(paths.runDir, "topologies"),
+    ];
+    for (const dir of dirs)
+        fs.mkdirSync(dir, { recursive: true });
+}
 /** Read the file at artifact.path and stamp sha256 (the core `sha256:`+hex
  *  form) + sizeBytes onto the StateArtifact. A missing/unreadable file is
  *  silently skipped so hashing an absent artifact never throws. Byte-exact
@@ -393,7 +417,7 @@ function compactCheckpoint(run) {
  *  same primitive. */
 function createRun(runDir, runId, workflowId, cwd) {
     const paths = (0, run_paths_1.createRunPaths)(runDir);
-    (0, run_paths_1.ensureRunDirs)(paths);
+    ensureRunDirs(paths);
     const seed = {
         id: runId,
         cwd,

package/dist/shell/state-explosion-cli.js

@@ -176,7 +176,10 @@ function showStateExplosionSummary(run, options = {}) {
 // ---------------------------------------------------------------------
 function loadRun(runId, options = {}) {
     const cwd = options.cwd ? path.resolve(String(options.cwd)) : process.cwd();
-    return (0, run_store_1.loadRunFromCwd)(runId, cwd);
+    const run = (0, run_store_1.loadRunFromCwd)(runId, cwd);
+    if (options.__cwWorkbenchReadOnlyProjection === true)
+        run.__cwWorkbenchReadOnlyProjection = true;
+    return run;
 }
 /** `cw summary refresh <run-id> [--json]` — refresh also runs `writeReport`
  *  + `saveCheckpoint` in the old build; `writeReport` (report.md) is a

package/dist/shell/telemetry-demo.js

@@ -219,7 +219,7 @@ function runBundleDemo(options = {}) {
     const runId = "demo-bundle-run";
     const runDir = path.join(workdir, ".cw", "runs", runId);
     const paths = (0, run_paths_1.createRunPaths)(runDir);
-    (0, run_paths_1.ensureRunDirs)(paths);
+    (0, run_store_1.ensureRunDirs)(paths);
     const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
     const publicKeyPem = publicKey.export({ type: "spki", format: "pem" }).toString();
     const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();

package/dist/shell/trust-audit.js

@@ -62,6 +62,7 @@ exports.trustAuditHead = trustAuditHead;
 exports.verifyTrustAudit = verifyTrustAudit;
 exports.repairTrustAuditTornTail = repairTrustAuditTornTail;
 exports.recordTrustAuditEvent = recordTrustAuditEvent;
+exports.withTrustAuditBatch = withTrustAuditBatch;
 exports.recordSandboxPathDecision = recordSandboxPathDecision;
 exports.normalizeEvidence = normalizeEvidence;
 exports.writeTrustAuditIndexPlaceholder = writeTrustAuditIndexPlaceholder;
@@ -114,6 +115,7 @@ function computeEventHash(event) {
     void eventHash;
     return (0, hash_1.sha256)((0, hash_1.eventHashInput)(rest));
 }
+const ACTIVE_AUDIT_BATCHES = new Map();
 function tailCachePathFor(eventLogPath) {
     return path.join(path.dirname(eventLogPath), "tail-cache.json");
 }
@@ -474,49 +476,90 @@ function recordTrustAuditEvent(run, input) {
         parentEventIds: unique(input.parentEventIds || []).sort(),
         metadata: scrubMetadata(input.metadata || {}),
     });
+    const batch = ACTIVE_AUDIT_BATCHES.get(path.resolve(audit.eventLogPath));
+    if (batch)
+        return appendTrustAuditEvent(run, input, event, batch);
     return (0, fs_atomic_1.withFileLock)(audit.eventLogPath, () => {
-        // The prior event count and last-event hash are the ONLY two things
-        // this append needs from the existing log. A tail cache (keyed on the
-        // log's own byte size) serves both without a full parse when nothing
-        // else has touched the log since it was written; any size mismatch
-        // (a repair, a torn write, this being the very first append) falls
-        // back to the full parse, same as before this cache existed.
-        const tailCachePath = tailCachePathFor(audit.eventLogPath);
         const currentBytes = fs.existsSync(audit.eventLogPath) ? fs.statSync(audit.eventLogPath).size : 0;
-        const cached = readAuditTailCache(tailCachePath);
-        let count;
-        let prevHash;
-        if (cached && cached.logBytes === currentBytes) {
-            count = cached.count;
-            prevHash = cached.lastHash;
+        const cached = readAuditTailCache(tailCachePathFor(audit.eventLogPath));
+        const prior = cached && cached.logBytes === currentBytes ? undefined : readEventsRaw(audit.eventLogPath);
+        const state = {
+            audit,
+            currentBytes,
+            count: cached && cached.logBytes === currentBytes ? cached.count : prior.length,
+            lastHash: cached && cached.logBytes === currentBytes ? cached.lastHash : (prior.length ? prior[prior.length - 1].eventHash || computeEventHash(prior[prior.length - 1]) : trustAuditGenesis(run.id)),
+            lines: [],
+        };
+        const result = appendTrustAuditEvent(run, input, event, state);
+        flushTrustAuditBatch(state);
+        return result;
+    });
+}
+function appendTrustAuditEvent(run, input, event, batch) {
+    // The prior event count and last-event hash are the ONLY two things
+    // this append needs from the existing log. A tail cache (keyed on the
+    // log's own byte size) serves both without a full parse when nothing
+    // else has touched the log since it was written; any size mismatch
+    // (a repair, a torn write, this being the very first append) falls
+    // back to the full parse, same as before this cache existed.
+    event.id = createEventId(input.kind, batch.count);
+    event.prevEventHash = batch.lastHash;
+    event.eventHash = computeEventHash(event);
+    // Newline-boundary safety (fail-closed). `durableAppendFileSync` only ever
+    // ADDS bytes at the end of file and never writes a separator of its own. A
+    // completed append always leaves the log ending in "\n"; if the last byte
+    // is NOT "\n", the previous append was torn by a crash (its bytes were
+    // never a confirmed event — the append never returned). Writing this new,
+    // already-cross-linked event straight onto that partial byte-run would
+    // MERGE the two into one line that no longer parses — losing THIS event and
+    // poisoning the forward chain (the next append's prevEventHash would point
+    // into an unparseable blob), with no repair for that shape. So put the new
+    // event on its own clean line: prepend a "\n" when the log does not already
+    // end in one, confining any crash artifact to its own now-orphaned line.
+    // (Reads only the last byte, so the O(1) tail-cache path is preserved.)
+    // An empty log (currentBytes === 0, e.g. the first append) has no tail to
+    // merge with, so it never needs a leading newline.
+    const leadingNewline = batch.currentBytes > 0 && batch.lines.length === 0 && !(0, fs_atomic_1.logEndsWithNewline)(batch.audit.eventLogPath, batch.currentBytes) ? "\n" : "";
+    const line = `${leadingNewline}${JSON.stringify(event)}\n`;
+    batch.lines.push(line);
+    batch.currentBytes += Buffer.byteLength(line, "utf8");
+    batch.count += 1;
+    batch.lastHash = event.eventHash;
+    return event;
+}
+function flushTrustAuditBatch(batch) {
+    if (!batch.lines.length)
+        return;
+    (0, fs_atomic_1.durableAppendFileSync)(batch.audit.eventLogPath, batch.lines.join(""));
+    writeAuditTailCache(tailCachePathFor(batch.audit.eventLogPath), { schemaVersion: 1, logBytes: batch.currentBytes, count: batch.count, lastHash: batch.lastHash });
+}
+/** Run a short, synchronous mutation group under one audit lock and append its
+ *  exact NDJSON lines with one durable write before the caller checkpoints. */
+function withTrustAuditBatch(run, fn) {
+    const audit = ensureTrustAudit(run);
+    const key = path.resolve(audit.eventLogPath);
+    if (ACTIVE_AUDIT_BATCHES.has(key))
+        return fn();
+    return (0, fs_atomic_1.withFileLock)(audit.eventLogPath, () => {
+        const currentBytes = fs.existsSync(audit.eventLogPath) ? fs.statSync(audit.eventLogPath).size : 0;
+        const cached = readAuditTailCache(tailCachePathFor(audit.eventLogPath));
+        const prior = cached && cached.logBytes === currentBytes ? undefined : readEventsRaw(audit.eventLogPath);
+        const batch = {
+            audit,
+            currentBytes,
+            count: cached && cached.logBytes === currentBytes ? cached.count : prior.length,
+            lastHash: cached && cached.logBytes === currentBytes ? cached.lastHash : (prior.length ? prior[prior.length - 1].eventHash || computeEventHash(prior[prior.length - 1]) : trustAuditGenesis(run.id)),
+            lines: [],
+        };
+        ACTIVE_AUDIT_BATCHES.set(key, batch);
+        try {
+            const result = fn();
+            flushTrustAuditBatch(batch);
+            return result;
         }
-        else {
-            const prior = readEventsRaw(audit.eventLogPath);
-            count = prior.length;
-            prevHash = prior.length ? prior[prior.length - 1].eventHash || computeEventHash(prior[prior.length - 1]) : trustAuditGenesis(run.id);
+        finally {
+            ACTIVE_AUDIT_BATCHES.delete(key);
         }
-        event.id = createEventId(input.kind, count);
-        event.prevEventHash = prevHash;
-        event.eventHash = computeEventHash(event);
-        // Newline-boundary safety (fail-closed). `durableAppendFileSync` only ever
-        // ADDS bytes at the end of file and never writes a separator of its own. A
-        // completed append always leaves the log ending in "\n"; if the last byte
-        // is NOT "\n", the previous append was torn by a crash (its bytes were
-        // never a confirmed event — the append never returned). Writing this new,
-        // already-cross-linked event straight onto that partial byte-run would
-        // MERGE the two into one line that no longer parses — losing THIS event and
-        // poisoning the forward chain (the next append's prevEventHash would point
-        // into an unparseable blob), with no repair for that shape. So put the new
-        // event on its own clean line: prepend a "\n" when the log does not already
-        // end in one, confining any crash artifact to its own now-orphaned line.
-        // (Reads only the last byte, so the O(1) tail-cache path is preserved.)
-        // An empty log (currentBytes === 0, e.g. the first append) has no tail to
-        // merge with, so it never needs a leading newline.
-        const leadingNewline = currentBytes > 0 && !(0, fs_atomic_1.logEndsWithNewline)(audit.eventLogPath, currentBytes) ? "\n" : "";
-        const line = `${leadingNewline}${JSON.stringify(event)}\n`;
-        (0, fs_atomic_1.durableAppendFileSync)(audit.eventLogPath, line);
-        writeAuditTailCache(tailCachePath, { schemaVersion: 1, logBytes: currentBytes + Buffer.byteLength(line, "utf8"), count: count + 1, lastHash: event.eventHash });
-        return event;
     });
 }
 function recordSandboxPathDecision(run, input) {
@@ -711,8 +754,12 @@ function writeSummaryFingerprint(fingerprintPath, fingerprint) {
         // -- it just means the next call falls back to a real rewrite.
     }
 }
-function summarizeTrustAudit(run) {
-    const audit = ensureTrustAudit(run);
+function summarizeTrustAudit(run, options = {}) {
+    const persist = options.persist !== false;
+    // A read-only projection must not call ensureTrustAudit(): that helper is
+    // deliberately for mutation paths and creates the audit directory and an
+    // empty event log when they are absent.
+    const audit = persist ? ensureTrustAudit(run) : { schemaVersion: 1, ...trustAuditPaths(run) };
     const { events, corruptLines } = readEventsRawCounted(audit.eventLogPath);
     const ma = run.multiAgent;
     const bb = run.blackboard;
@@ -797,11 +844,12 @@ function summarizeTrustAudit(run) {
     const fingerprintPath = summaryFingerprintPathFor(audit.summaryPath);
     const freshFingerprint = (0, hash_1.stableHash)({ summary: summaryForFingerprint, index });
     const priorFingerprint = readSummaryFingerprint(fingerprintPath);
-    if (priorFingerprint !== freshFingerprint) {
+    if (persist && priorFingerprint !== freshFingerprint) {
         (0, fs_atomic_1.writeJson)(audit.summaryPath, summary, { durable: true });
         (0, fs_atomic_1.writeJson)(audit.indexPath, index, { durable: true });
         writeSummaryFingerprint(fingerprintPath, { schemaVersion: 1, hash: freshFingerprint });
     }
-    run.audit = { schemaVersion: exports.TRUST_AUDIT_SCHEMA_VERSION, ...audit };
+    if (persist)
+        run.audit = { schemaVersion: exports.TRUST_AUDIT_SCHEMA_VERSION, ...audit };
     return summary;
 }

package/dist/shell/workbench.js

@@ -147,7 +147,10 @@ function buildWorkbenchRunView(runId, args = {}) {
         lifecycle = undefined;
     }
     const panels = {};
-    const panelArgs = { ...args, runId, cwd };
+    // This is an internal mechanism flag, not a CLI/MCP option. The Workbench
+    // must use the same capability bodies as the other front doors, but its
+    // GET-only projection must not make derived audit or metrics files.
+    const panelArgs = { ...args, runId, cwd, __cwWorkbenchReadOnlyProjection: true };
     for (const [group, members] of Object.entries(PANEL_MAP)) {
         panels[group] = {};
         for (const [member, capability] of Object.entries(members)) {