cowork-harness 0.5.0 → 0.7.0

package/.claude/skills/cowork-harness/scripts/assertion-keys.json

@@ -1,6 +1,7 @@
 {
   "$comment": "GENERATED from the Zod Assertion schema (src/types.ts) by scripts/gen-schema.ts — do not edit; run `npm run schema`.",
   "keys": [
+    "allow_l0_plugin_divergence",
     "allow_permissive_auto_allow",
     "artifact_json",
     "dispatch_count_max",
@@ -20,6 +21,8 @@
     "subagent_tool_used",
     "tool_called",
     "tool_not_called",
+    "tool_result_contains",
+    "tool_result_not_contains",
     "transcript_contains",
     "transcript_matches",
     "transcript_no_host_path",

package/.claude/skills/cowork-harness/scripts/scenario.py

@@ -45,6 +45,8 @@ CONTENT_KEYS = {
     "transcript_not_contains",
     "transcript_matches",
     "transcript_not_matches",
+    "tool_result_contains",
+    "tool_result_not_contains",
     "tool_called",
     "tool_not_called",
     "subagent_tool_used",
@@ -68,7 +70,7 @@ LIVE_ONLY_KEYS = {
 }
 EGRESS_KEYS = {"egress_denied", "egress_allowed"}
 # verdict modifiers — don't verify anything themselves (e.g. suppress a default-fail)
-VERDICT_MODIFIER_KEYS = {"allow_permissive_auto_allow"}
+VERDICT_MODIFIER_KEYS = {"allow_permissive_auto_allow", "allow_l0_plugin_divergence"}
 
 # Every key the replay-class logic knows how to handle. `replay_protocol_fidelity` is valid-but-not-authorable
 # (errored separately below). This is also the embedded fallback for ASSERT_KEYS — kept EQUAL to the generated

package/CHANGELOG.md

@@ -6,6 +6,139 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.7.0] — 2026-06-19
+
+### Added
+
+- **`chat --plugin <dir>` (repeatable)** — load additional local plugins into a `chat` session alongside
+  the primary skill folder. Each `--plugin <dir>` is appended to `plugins.local_plugins` so multi-plugin
+  interactive debugging no longer requires a custom session YAML. In `--raw` mode (native Docker), `--plugin`
+  flags are silently ignored with a warning: `chat --raw: --plugin flags are ignored in --raw mode`.
+- **`/help` in the `chat` REPL** — typing `/help` in an interactive session now prints
+  `Commands: /exit  /quit  /help` and continues rather than forwarding the text to the model. The startup
+  prompt was updated from "type your message, /exit to quit" to "type your message (/help for commands)".
+- **`scrubField(value, secrets)` exported from `src/secrets.ts`** — a new multi-pass field-level scrubber
+  that covers token appearances beyond direct substring matches:
+  - Pass 1: direct `scrub()` — catches literal, base64-encoded, and `encodeURIComponent`-encoded tokens.
+  - Pass 2: whole-field base64 decode (≥20-char pure base64 strings) — if the decoded form contains a
+    secret hit, returns `[REDACTED:base64]`.
+  - Pass 3: whole-field URI decode (values containing `%`) — if the decoded form contains a secret hit,
+    returns `[REDACTED:uri]`.
+  Applied in `cassette.ts` artifact scrubbing: base64 artifacts (`encoding === "base64"`) are replaced
+  wholesale with `[REDACTED:base64]`, the encoding marker is cleared (so replay decodes as UTF-8), and the
+  sha256 is recomputed over the marker bytes (with a `::warning::` that artifact assertions will fail at
+  replay). UTF-8 artifacts pass through `scrubField` safely.
+- **`prompt_asset_missing` VerdictSignal** — `computeVerdict()` now pushes a `{ code: "prompt_asset_missing",
+  severity: "warn" }` signal when `result.fidelityWarnings` contains a "referenced asset not found" entry,
+  making a missing prompt asset visible in the verdict output rather than buried in the run log.
+- **`onInfraError` callback in `makeWorkspaceHandler`** — an optional sixth parameter
+  `onInfraError?: (message: string) => void` lets callers intercept infrastructure errors
+  (ETIMEDOUT / killed / no code+stdout+stderr) separately from model-visible error text.
+  `spawnHostLoop()` wires this to append `{ type: "infra_error", ts, message }` to `events.jsonl` so
+  infrastructure failures are structured and queryable rather than only appearing in the model-visible
+  response string.
+
+### Fixed
+
+- **`ExternalDecider` no longer coerces `"first"` to option 1.** `coerceLabel` gained an
+  `enableFirstShorthand` parameter (default `true`). External deciders (`--decider-cmd`,
+  `--decider-dir` helpers) now call `coerceLabel(raw, labels, false)`, so a helper script that
+  accidentally returns the string `"first"` must match an actual label named `"first"` — it is no
+  longer silently promoted to the first option. The shorthand remains active for internal (scripted)
+  use.
+- **`flagValue` and `chat --model` reject empty strings.** `flagValue()` in `src/cli.ts` now exits `2`
+  with a clear message when the supplied value is blank or whitespace-only. `chat` additionally guards
+  the `--model` value inline after parsing, so `--model ""` and `--model $UNSET_VAR` both fail loudly
+  instead of passing an empty model ID to the runtime.
+- **`redactCassette` skips `[REDACTED*]` marker bodies.** The per-line JSON redaction pass
+  (`redactJsonLine`) is now bypassed for artifact bodies that already start with `[REDACTED` — preventing
+  the sha256 from being corrupted by a second redaction pass over the marker string.
+- **TLD list extended from 22 to 51 entries.** The domain scanner in `src/scan.ts` now recognises
+  major European, Asian, and Latin American ccTLDs:
+  `ch|nl|se|no|it|jp|br|nz|in|sg|kr|mx|es|pt|pl|be|at|dk|fi|ie|ru|cn|tw|hu|cz|ro|il|za|ar|cl|pe|tr`.
+  Domain findings that were previously missed on these TLDs now fire correctly.
+
+## [0.6.0] — 2026-06-19
+
+### Breaking changes
+
+- **Exit code 3 for boundary/integrity violations.** Commands that previously exited `2` for a
+  boundary constraint (e.g. `skill` hitting the egress sandbox, `run` with a `boundary`-category
+  failure) now exit `3`. Exit `2` is narrowed to usage errors, unknown flags, and runtime errors.
+  Scripts that check `$? -eq 2` to detect boundary failures must be updated to `$? -eq 3`.
+- **`verify-cassettes --staleness-only` / `--privacy-only` removed.** Replaced by
+  `--skip-staleness` (run privacy scan only) and `--skip-privacy` (run staleness scan only). The
+  old flags are not aliased — they now exit `2` as unknown flags.
+- **`decide` with no configuration exits `2` instead of `1`.** Previously, calling `decide` with no
+  `--decider-*`, `--answer`, or `--answer-policy` would fall through to a `ScriptedDecider([])` and
+  exit `1` ("no rule matched"). It now fails early with exit `2` ("no decider configured") and a
+  clear message.
+
+### Added
+
+- **`chat` — full flag parity for interactive debugging:**
+  - `[prompt]` — optional seed prompt sent as the first turn before the REPL opens.
+  - `--upload <file>` (repeatable) — attach a file at `mnt/uploads/<basename>`; live at session start.
+  - `--folder <dir>` (repeatable) — connect a project folder at `mnt/.projects/<basename>` as a live bind mount.
+  - `--verbose` / `-V` — show thinking blocks, tool inputs, and the sub-agent tree (previously hardcoded off).
+  - `--fidelity protocol` — no-Docker fastest tier; accepted alongside `container` and `hostloop`.
+  - `--model` in `--raw` mode — previously silently dropped; now passed as `--model <id>` to the docker argv.
+  - Idle heartbeat wired in all three fidelity branches (protocol / hostloop / container).
+  - Run ID printed at session start (before first turn) so a mid-session crash still tells you where the transcript is.
+- **`assertions` command** — canonical rename of `assert`; `assert` is kept as a deprecated alias
+  that prints a migration notice. `assertions --list` is the new canonical form.
+- **`scaffold <run-id>` positional** — canonical form; `--from-run <id>` is kept as a deprecated
+  alias that prints a migration notice.
+- **`trace --view tools|questions|dispatches`** — replaces the three separate `--tools` / `--gates`
+  / `--dispatches` flags with a single `--view` enum. Legacy flags are kept as backward-compat
+  aliases (`--gates` maps to `--view questions`).
+- **Env-var defaults for all live commands:**
+  - `COWORK_HARNESS_FIDELITY` — default fidelity tier for `skill` and `chat` (validated; exits 2 on an invalid value).
+  - `COWORK_HARNESS_MODEL` — default model override for `skill` and `chat`.
+  - `COWORK_HARNESS_OUTPUT_FORMAT` — default `--output-format` for all commands (`text` or `json`).
+- **`decide` no-decider guard** — calling `decide` with no configuration fails immediately with a
+  clear message and exit `2` instead of falling through to a vacuous "no rule matched" exit `1`.
+- **`vm` per-subcommand `--help`** — `vm <sub> --help` prints the subcommand usage and exits `0`.
+- **`--quiet` / `-q` accepted in `decide`** — no-op flag for flag-surface consistency with `skill` / `run`.
+
+### Fixed
+
+- **`--rerecord-stale` now prefers on-disk scenario over embedded snapshot (G-1).** When a
+  `scenarios/<name>.yaml` exists alongside the cassette dir, `--rerecord-stale` re-records from it
+  instead of the embedded copy. Edits to the scenario (e.g. adding `skills:` for staleness scoping)
+  now take effect. Falls back to the embedded snapshot when no on-disk file is found, with a clear
+  warning.
+- **Staleness message distinguishes format-version bump from real content change (G-2).** After a
+  harness upgrade that changes the hash algorithm, `verify-cassettes` now reports
+  `recorded under an older hash format (vN → vM)` instead of the misleading
+  `local skill/plugin dir contents changed`.
+- **`.cowork-hashignore` leading-slash patterns now correctly anchor to the mount root (G-3).**
+  `/tests` previously compiled to a regex that never matched (no leading slash in relative paths);
+  it now matches only the top-level `tests/` dir, as expected.
+- **Scoped staleness findings now name the changed bucket (G-4).** When a cassette was recorded with
+  `skills: [<name>]` scoping, `verify-cassettes` now reports `skills/<name> changed` or
+  `shared root changed` rather than the generic `local skill/plugin dir contents changed`.
+- **Unknown flags in `chat` now exit `2`.** Previously ignored silently; any unrecognised flag now
+  exits `2` with a clear message.
+- **`chat --model` bounds-checked.** If `--model` is the last argument (no value following), the
+  command now exits `2` with a clear message instead of silently using `undefined`.
+- **`cmdSync` platform guard fires before argument parsing.** On non-macOS platforms the guard now
+  exits before `parseArgs`, so `sync --help` on Linux no longer crashes on a missing flag.
+- **`record` conflict check.** Passing both a positional and `--cassette` now exits `2` immediately
+  instead of silently preferring one.
+- **L0 plugin divergence signal.** `spawnProtocol` now reports whether the skill resolved at L0
+  (no container) vs. L1, so callers can surface the divergence accurately.
+- **System-prompt threading.** `systemPromptAppend` is now passed through all runtime paths that
+  previously dropped it.
+- **Strict agent binary resolution.** When the exact staged binary path is missing, the harness now
+  fails with a clear message pointing to `COWORK_HARNESS_ALLOW_AGENT_FALLBACK=1` instead of
+  silently falling back to an arbitrary sibling version.
+- **Path traversal guard on plugin sources.** Plugin source paths are now validated to be
+  directories (not files or traversal strings) before mounting.
+- **Cassette correctness (batch):** privacy/staleness coverage tracking, redaction verdict
+  preservation across re-records, base64-encoded artifact body scanning, and exhaustiveness
+  checks on the replay assertion set.
+
 ## [0.5.0] — 2026-06-18
 
 ### Added

package/README.md

@@ -24,6 +24,15 @@ Scriptable, CI-friendly test harness that reproduces **Claude Cowork's observabl
 
 > **What this is and isn't.** This is an *emulator of the contract*, not the Desktop runtime. Cowork's real session control plane lives behind the Desktop renderer's IPC (per-build UUID + `senderFrame` origin checks) and the app ships with remote debugging disabled (verified: `--remote-debugging-port` opens no listener; Electron `EnableNodeCliInspectArguments` fuse is OFF). So you **cannot** drive the real Apple Virtualization.framework microVM from a script. What you *can* faithfully reproduce is everything that actually changes how a **skill** behaves: the same agent binary in **cowork mode** (`CLAUDE_CODE_IS_COWORK=1` — there is no `--cowork` flag), the same mount layout, the same egress allowlist, and the same permission/question protocol. That's what this project does.
 
+**Zero-friction preview — no token, no Docker.** A committed cassette replays on a fresh clone:
+
+```bash
+npm install -g cowork-harness
+cowork-harness replay examples/replays/example-pdf-skill.cassette.json
+```
+
+Full setup → [Quick start](#quick-start).
+
 ---
 
 ## Why this works for skill testing
@@ -78,14 +87,15 @@ Skill testing is the headline use, but the tool is a general harness over the Co
 |---|---|---|
 | `skill <folder> "<prompt>"` | Run a local skill/plugin folder once against the staged agent | ad-hoc "is the skill alive / does it do X?" — the fast inner loop |
 | `run <scenario.yaml \| dir/>` | Run authored scenarios with `assert:` + a CI-ready exit code | you want a repeatable, **asserted regression test** |
-| `chat <folder>` | Interactive multi-turn REPL against a skill (TTY) | debugging a multi-turn flow by hand |
+| `chat <folder> [prompt]` | Interactive multi-turn REPL against a skill (TTY); optional seed prompt is sent as the first turn. `--upload <file>` / `--folder <dir>` (repeatable) attach files/project folders; `--verbose` / `-V` shows thinking blocks + tool inputs; `--fidelity protocol\|container\|hostloop` | debugging a multi-turn flow by hand |
 | `record` / `replay` | `record` saves a control-protocol cassette (one scenario, or batch a `dir/`; `--rerecord-stale` refreshes only drifted ones; `--max-artifact-bytes` raises the 64 KiB inline-body cap); `replay` runs a cassette **file or a `dir/` of `*.cassette.json`** deterministically (`<file\|dir>`, `--cassette <file>` for the explicit single form; `--strict` fails on a stale one; exits on the worst verdict) | **token-free, Docker-free CI** from a once-recorded run |
-| `verify-cassettes <file\|dir>` | Token-free CI gate over committed cassettes: a privacy scan (email/currency/domain → exit 1; whole-token allows via `--allow` / class-scoped `--allow-domain` / `--allow-email` / `--allow-file`) + a staleness check (`--staleness-only`). A dir argument scans `*.cassette.json` in that dir only (**non-recursive**) | gating **committed cassettes** against PII leaks + "edited the skill, forgot to re-record" |
+| `verify-cassettes <file\|dir>` | Token-free CI gate over committed cassettes: a privacy scan (email/currency/domain → exit 1; whole-token allows via `--allow` / class-scoped `--allow-domain` / `--allow-email` / `--allow-file`) + a staleness check (`--skip-privacy` or `--skip-staleness` to run only one half). A dir argument scans `*.cassette.json` in that dir only (**non-recursive**) | gating **committed cassettes** against PII leaks + "edited the skill, forgot to re-record" |
 | `verify-run <run-dir> <scenario.yaml>` | Re-evaluate a scenario's `assert:` against an already-kept run dir — **no live agent, no tokens, no Docker** (~1s) | iterating on a wrong assertion without a full live re-record |
-| `trace <run-id>` | Digest a run's `events.jsonl` (`--tools`, `--gates`, `--dispatches` for the sub-agent dispatch tree + total) | "how many sub-agents *actually* dispatched, and which?" |
-| `scaffold --from-run <id>` | Turn a kept run into a starter scenario YAML (gates→answers, artifacts→`file_exists`) | authoring a scenario from a real run instead of guessing |
+| `trace <run-id>` | Digest a run's `events.jsonl` (`--view tools\|questions\|dispatches`; legacy `--tools` / `--gates` / `--dispatches` aliases still accepted) | "how many sub-agents *actually* dispatched, and which?" |
+| `scaffold <run-id>` | Turn a kept run into a starter scenario YAML (gates→answers, artifacts→`file_exists`); `--from-run <id>` is a deprecated alias for the positional | authoring a scenario from a real run instead of guessing |
+| `python3 …/scenario.py scaffold --name <name> --skill <dir>` | Generate a starter scenario skeleton from scratch (the `…` is `.claude/skills/cowork-harness/scripts/`; `cowork-harness lint --help` shows the resolved path) | starting a new scenario when you have no prior run |
 | `lint <scenario.yaml>…` | Check scenarios for silent false-greens — assertions placed on the wrong CI lane, mixed content/live keys, missing `controlOut`-required keys (bundled `scenario.py`; needs python3 + PyYAML) | before committing a new scenario or after changing assertions |
-| `assert --list` | List the available scenario assertions (generated from the schema) | "what can I assert?" without grepping the source |
+| `assertions --list` | List the available scenario assertions (generated from the schema); `assert` is a deprecated alias | "what can I assert?" without grepping the source |
 | `decide` | Validate a decider against a sample question in ~2 s (no run) | sanity-check a `--decider-*` / `--answer` wiring before a long run |
 | `gates` / `answer` | Stream / answer in-band gates for `--decider-dir` | a **driving agent** answers live questions via a Monitor |
 | `boundary-check [baseline] [--session <file>]` | Prove the sandbox enforces Cowork's limitations; `--session` folds a session's `egress.extra_allow` into the probe allowlist | verifying the harness's own fidelity |
@@ -119,7 +129,7 @@ cowork-harness skill ~/my-plugin 'review this deck' --upload deck.pdf      # att
 cowork-harness skill ~/my-plugin "..." --session-id s1                     # pin a session…
 cowork-harness skill ~/my-plugin '<next turn>' --session-id s1 --resume    # …then resume it (gated/checkpoint skills)
 cowork-harness skill ~/my-plugin "..." --keep                            # then: trace the run
-cowork-harness trace <run-id> --tools                                     # tool calls + sub-agent dispatches from events.jsonl
+cowork-harness trace <run-id> --view tools                                # tool calls + sub-agent dispatches from events.jsonl
 cowork-harness skill --help                                               # full per-command flag reference
 
 cowork-harness chat ~/my-plugin                  # interactive multi-turn REPL (full harness: egress sandbox + control protocol)
@@ -132,8 +142,8 @@ cowork-harness chat ~/my-plugin                  # interactive multi-turn REPL (
 `run`/CI), `prompt` (ask at the TTY — the default for `skill` when interactive), or `first` (pick
 option 1, loudly warn). Pick with `--on-unanswered`; left unset, `skill` is **adaptive** (`prompt` on
 a TTY, `fail` when piped/CI) and `run` is always `fail`. Exit codes: `0`
-pass · `1` assertion/agent failure · `2` usage /
-unanswered-under-`fail` / boundary / runtime. After a run, the footer **echoes every auto-answered
+pass · `1` assertion/agent failure · `2` usage / unanswered-under-`fail` / runtime · `3` boundary/integrity.
+After a run, the footer **echoes every auto-answered
 question as a copy-pasteable `--answer "<q>=<choice>"` line** — run once exploratorily, then paste them
 back to lock in a deterministic re-run.
 
@@ -194,9 +204,11 @@ The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it
 
 It also follows the open [Agent Skills](https://github.com/vercel-labs/skills) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) by pointing the `npx skills` CLI at `.claude/skills/cowork-harness` in this repo. (Working *inside* this repo, the skill auto-loads as a project skill — no install needed.)
 
+> Note: `npm install -g cowork-harness` ships `scenario.py` and assertion keys (enough for `lint` in CI) but not the full SKILL.md teaching document; install via the marketplace command above to get the teaching skill.
+
 **Prerequisites for anything above `protocol` fidelity** (the `protocol` tier skips items 1–2 — no Docker, no staged agent — but still calls a real model via the host `claude`, so it needs item 3, the auth token; only a committed-cassette `replay` needs nothing at all):
 1. **Claude Desktop, opened once.** The Cowork agent binary is **bind-mounted from your own install** at run time — nothing Anthropic-owned is bundled. Open Cowork once so the agent ELF is staged (`…/claude-code-vm/<ver>/claude`); the harness auto-detects it, or set `COWORK_AGENT_BINARY=<path>` to point at it. Without a staged agent, container/cowork runs fail with "Open Cowork once to stage it…".
-2. **Docker (arm64)** + the agent image: `docker build --platform linux/arm64 -t cowork-agent-base:1 -f docker/Dockerfile.agent .` (override the tag with `COWORK_AGENT_IMAGE`). The `-f docker/Dockerfile.agent .` paths are **repo-relative** — run it from a source checkout, not a global `npm install -g` (where the Dockerfile lives under the package dir).
+2. **Docker (arm64)** + the agent image: `docker build --platform linux/arm64 -t cowork-agent-base:1 -f docker/Dockerfile.agent .` (override the tag with `COWORK_AGENT_IMAGE`). The `-f docker/Dockerfile.agent .` paths are **repo-relative** — run it from a source checkout, not a global `npm install -g` (where the Dockerfile lives under the package dir). (Global install? Run `cowork-harness doctor --tier container` — it prints the exact `docker build` command with the correct package-local Dockerfile path.)
 3. **An auth token** — either `export CLAUDE_CODE_OAUTH_TOKEN=$(claude setup-token)` or a **`.env`** file (copy `.env.example` → `.env`; gitignored). The token resolves in priority order: exported env > `--dotenv <path>` > `./.env` (cwd) > `<install>/.env` (the package root), so a `npm link`ed install works from any directory. Keep `.env` at a working-dir or install root, never inside a mounted skill/project folder. (Use `--dotenv`, not `--env-file` — Node reserves the latter.)
 
 > `sync` (below) is **optional for a first run** — the repo ships `baselines/desktop-*.json`, so `baseline: latest` already resolves. Run `sync` only to refresh the platform baseline after Claude Desktop updates. (`sync` is **macOS-only** today; on Linux/Windows use the committed baselines — they work cross-platform.)
@@ -221,11 +233,11 @@ cowork-harness run examples/scenarios/ --output-format json
 cowork-harness record examples/scenarios/example-pdf-skill.yaml --out examples/replays/example-pdf-skill.cassette.json
 cowork-harness replay --cassette examples/replays/example-pdf-skill.cassette.json
 
-# A committed synthetic fixture is ready to replay on a fresh clone (no record step needed):
-cowork-harness replay --cassette examples/replays/example-pdf-skill.cassette.json
-
 # Cassettes are COMMITTED fixtures — record against synthetic data, and gate them in CI:
 cowork-harness verify-cassettes examples/replays/   # privacy scan (email/currency/domain) + staleness; exit 1 on a finding
+
+# 5. Lint scenarios before committing (catches silent false-greens in assertion placement)
+cowork-harness lint scenarios/*.yaml
 ```
 
 > **Privacy:** a cassette snapshots the transcript and the `outputs/` JSON bodies, so it's committed PII
@@ -239,7 +251,8 @@ cowork-harness verify-cassettes examples/replays/   # privacy scan (email/curren
 > orchestration from both, re-evaluates the **content** assertions, and re-exercises
 > `serializeDecision` as a token-free O7 guard (the AskUserQuestion `{questions,answers}` answer-shape
 > invariant). Evaluated on replay: `transcript_*`, `tool_*`, `subagent_*`, `dispatch_count_max`,
-> `result`. **`question_asked`, `questions_count_max`, and `gate_answers_delivered` are also evaluated —
+> `result`, `allow_permissive_auto_allow` (always-on Cowork-parity scan). **`question_asked`,
+> `questions_count_max`, and `gate_answers_delivered` are also evaluated —
 > but only when the cassette carries `controlOut` (full-fidelity)**; old cassettes without it get a
 > loud warning and those three keys are excluded (not vacuously passed). **Filesystem assertions
 > (`file_exists`, `user_visible_artifact`, `artifact_json`) are evaluated when the cassette carries an
@@ -296,7 +309,7 @@ assert:
 ```
 
 ```yaml
-# sessions/default.yaml  (abridged — see the file for every field)
+# examples/sessions/default.yaml  (abridged — see the file for every field)
 # Relative paths below resolve from THIS file's dir (absolute and ~ are used as-is).
 model: claude-opus-4-8
 effort: high
@@ -522,7 +535,7 @@ This repo is built to be driven by agents, not just read by humans:
 - ✅ **Three isolation tiers (L0/L1/L2) + two loop-mode overlays** — `protocol` (L0 control loop), `container` (L1 sandboxed arm64 + per-run default-deny egress sidecar), `microvm` (L2 real Apple-VZ Linux microVM + guest firewall); plus the loop-mode overlays `hostloop` (production split-execution: agent loop on host, shell/web via the workspace SDK-MCP server) and `cowork` (auto-picks host-loop vs container the way Cowork does — gate `1143815894`). Egress enforced at container/microvm/hostloop; `boundary-check` reports **ALL CONSTRAINTS ENFORCED**.
 - ✅ **Three-seam driver** — `AgentSession` (control protocol) → `Decider` (scripted + `on_unanswered` policy, no silent false-greens) → `Run` (turn loop, sub-agent dispatch tree, `RunRecord`). Multi-turn `chat`, deterministic cassette `record`/`replay` (no token), `run.jsonl`/`trace.json` logging with secret-scrub.
 - ✅ **Answering live questions, every way you'd need** — `--decider-llm --intent "<one line>"` (a small model picks per question, steered by your test intent — the ergonomic default; non-determinism is flagged so a green isn't mistaken for a scripted pass), `--answer-policy <yaml>`/`--answer "rx=c"` (declarative regex→label, deterministic CI), `--decider-cmd '<helper>'` (custom logic — the Python `serve_decider(fn)` adapter pre-builds the wire loop so the helper writes only the decision), and **`--decider-dir <dir>`** (the *driving agent* answers each gate **in-band** with full context — it arms a Monitor on `cowork-harness gates <dir> --follow` and replies with `cowork-harness answer <dir> --gate <N> --choose <label>`; the session-under-test stays live, no resume/re-worded question — binary-verified). Every channel keeps stdout free, so all compose with `--output-format json`. A question is **never silently answered with option 1** — unhandled fails loud. Validate any decider in ~2s with `cowork-harness decide`.
-- ✅ **Sub-agent aggregation + `trace`** — recognizes the real `Agent` dispatch tool (binary-verified; `Task` is its alias) so `subagent_dispatched`/`dispatch_count_max` fire under `--fidelity cowork`, excluding the `TaskCreate` todo list; `cowork-harness trace <id> --tools` digests `events.jsonl` (each tool row now shows its **result status** `ok`/`error`), and `trace <id> --gates` shows the gate lifecycle (**question → injected answer → delivered result**); `result.json`/`--keep` surface the deep `mnt/outputs` deliverable path.
+- ✅ **Sub-agent aggregation + `trace`** — recognizes the real `Agent` dispatch tool (binary-verified; `Task` is its alias) so `subagent_dispatched`/`dispatch_count_max` fire under `--fidelity cowork`, excluding the `TaskCreate` todo list; `cowork-harness trace <id> --view tools` digests `events.jsonl` (each tool row now shows its **result status** `ok`/`error`), and `trace <id> --view questions` shows the gate lifecycle (**question → injected answer → delivered result**); `result.json`/`--keep` surface the deep `mnt/outputs` deliverable path.
 - ✅ **Answer delivery is verified, not assumed** — an AskUserQuestion answer is injected as the binary's full tool input (`{questions, answers}`, ELF-verified), so the answer actually reaches the model; `RunResult.gateDeliveries[]` + the `gate_answers_delivered` assertion catch any delivery failure, and `RunResult.toolCounts` gives the **truthful** per-tool call count (host-routed `WebSearch` shows here, not the always-0 `usage.server_tool_use`).
 - ✅ **Binary-grounded fidelity** — cwd `/sessions/<id>`, the three-channel MCP model (`--mcp-config` honored in plain cowork mode; host/API-routed `web_fetch`; SDK-server delivery), host-loop tool partition, auth-env token-only drop, and production GrowthBook gates pinned per release.
 - ✅ The agent binary is **bind-mounted from your own install** at run time — nothing Anthropic-owned is in any image or distributed.

package/dist/agent/session.js

@@ -162,6 +162,10 @@ export class LiveAgentSession {
     rejectError;
     /** Bounded tail of the child's stderr, for the nonzero-exit error message. */
     stderrTail = "";
+    writeQueue = [];
+    pumping = false;
+    queueIdle;
+    closing = false;
     constructor(proc, outDir) {
         this.proc = proc;
         this.outDir = outDir;
@@ -180,7 +184,7 @@ export class LiveAgentSession {
             if (this.rejectError)
                 this.rejectError(e);
             // else: the error fired before/after the generator — log it but don't throw
-            else
+            else if (!this.closing)
                 this.events.write(JSON.stringify({ _emu: "stdin_error", message: String(e) }) + "\n");
         });
     }
@@ -214,7 +218,8 @@ export class LiveAgentSession {
         // below rejects and the generator yields a typed {type:"error"} event instead of hanging on
         // stdout that will never arrive.
         this.proc.on("error", (e) => {
-            this.events.write(JSON.stringify({ _emu: "spawn_error", message: String(e) }) + "\n");
+            if (!this.closing)
+                this.events.write(JSON.stringify({ _emu: "spawn_error", message: String(e) }) + "\n");
             if (this.rejectError)
                 this.rejectError(e instanceof Error ? e : new Error(String(e)));
         });
@@ -238,7 +243,8 @@ export class LiveAgentSession {
                 const line = next.value;
                 if (!line.trim())
                     continue;
-                this.events.write(line + "\n");
+                if (!this.closing)
+                    this.events.write(line + "\n");
                 let msg;
                 try {
                     msg = JSON.parse(line);
@@ -266,6 +272,8 @@ export class LiveAgentSession {
         }
         finally {
             this.rejectError = undefined; // generator is done; stop routing errors here
+            this.closing = true; // discard any late write() from translate()'s async hook/mcp paths
+            await this.drainAll(); // queue empty + all callbacks confirmed before ending either stream
             // #46: AWAIT the stream flush before the generator resolves. executeScenario reads/scans/scrubs
             // events.jsonl + control-out.jsonl immediately after `drive()` returns; a fire-and-forget end()
             // races the final buffered writes. end(cb) fires the callback on 'finish' (fully flushed).
@@ -344,6 +352,9 @@ export class LiveAgentSession {
         if (req.kind !== r.kind)
             warn(`::warning:: decider returned kind "${r.kind}" for a "${req.kind}" request (id ${decisionId}) → sending a safe deny/cancel; the agent did NOT receive an answer\n`);
         this.write(serializeDecision(req, r));
+        // Invariant: each decision id is answered at most once. Delete after a successful write so
+        // stale entries don't accumulate (live sessions may process thousands of decisions per run).
+        this.reqById.delete(decisionId);
     }
     close() {
         try {
@@ -355,14 +366,98 @@ export class LiveAgentSession {
     }
     write(obj) {
         const line = JSON.stringify(obj);
-        // The control protocol writes small single-line JSON frames, so stdin backpressure effectively never
-        // engages; we ignore the write() return / drain here. A frame past the safe threshold is anomalous —
-        // hard-FAIL rather than risk a partially-buffered write that silently corrupts the protocol stream.
-        // (If large control frames ever become legitimate, switch to a drain-aware queue, making writes async.)
-        if (line.length > 256 * 1024)
-            throw new Error(`control frame is ${line.length} bytes (> 256 KiB safe limit) — refusing to write to avoid partial stdin buffering; this indicates an unexpectedly large control payload`);
-        this.controlOut.write(line + "\n");
-        this.proc.stdin.write(line + "\n");
+        if (this.closing)
+            return; // session draining — discard silently
+        // Bug 34: check stream writability before writing — a closed/destroyed stdin after a child crash
+        // loses decision frames silently. Throw immediately so callers surface the failure rather than
+        // hanging or silently dropping frames.
+        if (this.proc.stdin.destroyed || !this.proc.stdin.writable)
+            throw new Error("control-protocol write failed: child stdin is no longer writable (process may have crashed)");
+        this.writeQueue.push(line + "\n");
+        void this.pump().catch((err) => {
+            // Route unexpected pump errors through rejectError so they surface as a typed error + clean
+            // teardown instead of a silent hang. Known failure modes call rejectError themselves before
+            // the pump returns, so this only fires on unanticipated throws.
+            if (this.rejectError)
+                this.rejectError(err instanceof Error ? err : new Error(String(err)));
+        });
+    }
+    async pump() {
+        if (this.pumping)
+            return;
+        this.pumping = true;
+        try {
+            while (this.writeQueue.length) {
+                const frame = this.writeQueue.shift();
+                if (this.proc.stdin.destroyed || !this.proc.stdin.writable) {
+                    this.events.write(JSON.stringify({ _emu: "control_undelivered", frame }) + "\n");
+                    if (this.rejectError)
+                        this.rejectError(new Error("stdin no longer writable while draining queue"));
+                    while (this.writeQueue.length) {
+                        const remaining = this.writeQueue.shift();
+                        this.events.write(JSON.stringify({ _emu: "control_undelivered", frame: remaining }) + "\n");
+                    }
+                    break;
+                }
+                // Await the write callback directly — the ONLY reliable signal for child-process stdin
+                // pipes (EPIPE goes to the callback, not an 'error' event; 'drain'/'close' are unreliable).
+                // Awaiting inline also bounds in-flight depth to 1, giving deterministic replay ordering.
+                const writeErr = await new Promise((resolve) => {
+                    try {
+                        this.proc.stdin.write(frame, (err) => {
+                            resolve(err ?? null);
+                        });
+                    }
+                    catch (e) {
+                        resolve(e instanceof Error ? e : new Error(String(e)));
+                    }
+                });
+                if (writeErr) {
+                    this.events.write(JSON.stringify({ _emu: "control_undelivered", frame }) + "\n");
+                    if (this.rejectError)
+                        this.rejectError(writeErr);
+                    while (this.writeQueue.length) {
+                        const remaining = this.writeQueue.shift();
+                        this.events.write(JSON.stringify({ _emu: "control_undelivered", frame: remaining }) + "\n");
+                    }
+                    break;
+                }
+                else {
+                    if (frame.length > 256 * 1024) {
+                        // Frame too large to mirror verbatim — record a truncation marker instead.
+                        this.controlOut.write(JSON.stringify({ _emu: "control_out_truncated", bytes: frame.length, head: frame.slice(0, 4096) }) + "\n");
+                    }
+                    else {
+                        this.controlOut.write(frame);
+                    }
+                }
+            }
+        }
+        finally {
+            this.pumping = false;
+            // Unconditionally drain any remaining frames — handles a synchronous throw from
+            // controlOut.write/events.write inside the try body, which would otherwise leave
+            // writeQueue non-empty and queueIdle unfired, hanging drainAll().
+            while (this.writeQueue.length) {
+                const remaining = this.writeQueue.shift();
+                try {
+                    this.events.write(JSON.stringify({ _emu: "control_undelivered", frame: remaining }) + "\n");
+                }
+                catch {
+                    /* events may already be ended; discard silently */
+                }
+            }
+            const idle = this.queueIdle;
+            this.queueIdle = undefined;
+            idle?.();
+        }
+    }
+    drainAll() {
+        if (!this.pumping && this.writeQueue.length === 0)
+            return Promise.resolve();
+        return new Promise((resolve) => {
+            this.queueIdle = resolve;
+        });
     }
 }
 /** Pure translation of one parsed stream-json message → AgentEvents (no side-effects). Shared by
@@ -385,8 +480,13 @@ export function parseMessage(msg) {
             break;
         }
         case "assistant": {
-            const parentToolUseId = msg.parent_tool_use_id ? String(msg.parent_tool_use_id) : undefined;
+            // Protocol v1: parentToolUseId is message-level. Block-level parent_tool_use_id (if present)
+            // is canonical — prefer it when both exist (block-level is more precise for nested dispatches).
+            const msgParentToolUseId = msg.parent_tool_use_id ? String(msg.parent_tool_use_id) : undefined;
+            let blockIndex = 0;
             for (const block of msg.message?.content ?? []) {
+                // Block-level parent wins over message-level when both are present (see comment above).
+                const parentToolUseId = block.parent_tool_use_id ? String(block.parent_tool_use_id) : msgParentToolUseId;
                 if (block.type === "text")
                     ev.push({ type: "assistant_text", text: block.text, parentToolUseId });
                 else if (block.type === "thinking")
@@ -411,9 +511,12 @@ export function parseMessage(msg) {
                             : Array.isArray(inp.allowedTools)
                                 ? inp.allowedTools.map(String)
                                 : []; // the `Agent` tool declares no tools list → []; declared-but-unused is legacy-`Task`-only
+                        // When block.id is absent, synthesize a fallback to avoid collapsing all anonymous
+                        // dispatches into the empty-string identity, which breaks dispatch tracking.
+                        const toolUseId = block.id ? String(block.id) : `unpaired-${blockIndex}`;
                         ev.push({
                             type: "subagent_dispatch",
-                            toolUseId: String(block.id ?? ""),
+                            toolUseId,
                             parentToolUseId,
                             // Skills often dispatch with only {description, prompt} (no subagent_type) → agentType is
                             // "unknown" but the description still identifies the dispatch (e.g. "TOP_DOWN market sizing").
@@ -423,6 +526,7 @@ export function parseMessage(msg) {
                         });
                     }
                 }
+                blockIndex++;
             }
             break;
         }
@@ -438,6 +542,7 @@ export function parseMessage(msg) {
                         isError: !!block.is_error,
                         text: toolResultText(block.content),
                         provenanceText: toolResultRaw(block.content),
+                        assertText: toolResultAssertText(block.content),
                     });
             }
             break;
@@ -447,15 +552,26 @@ export function parseMessage(msg) {
     }
     return ev;
 }
-/** Flatten a tool_result `content` (a string, or an array of `{type:"text",text}` blocks), capped at
+/** Flatten a tool_result `content` (a string, or an array of content blocks), capped at
  *  `max` chars. The 500-char DISPLAY value (toolResultText) keeps the recorder/trace compact; the larger
- *  PROVENANCE value (toolResultRaw) is what seeds web_fetch provenance, so a URL past char 500 isn't lost. */
+ *  PROVENANCE value (toolResultRaw) is what seeds web_fetch provenance, so a URL past char 500 isn't lost.
+ *  Bug 35: preserve all content block types — text blocks use their text value; all other block types
+ *  (json, resource, link, unknown shapes) are JSON-stringified so no content is silently dropped. */
 function flattenToolResult(content, max) {
     if (typeof content === "string")
         return content.slice(0, max);
     if (Array.isArray(content))
         return content
-            .map((b) => (b && typeof b === "object" && "text" in b ? String(b.text) : ""))
+            .map((b) => {
+            if (b && typeof b === "object" && "text" in b)
+                return String(b.text);
+            // Non-text blocks (json, resource, link, unknown): JSON-stringify to preserve all content.
+            // JSON.stringify returns `undefined` for blocks that contain functions or other
+            // non-serializable values; wrap those in an explicit marker so downstream code can identify
+            // and skip them rather than treating the literal string "undefined" as block content.
+            const serialized = JSON.stringify(b);
+            return serialized !== undefined ? serialized : JSON.stringify({ type: "unsupported", raw: "[unserializable]" });
+        })
             .join(" ")
             .slice(0, max);
     return "";
@@ -468,8 +584,19 @@ function toolResultText(content) {
 function toolResultRaw(content) {
     return flattenToolResult(content, 200_000);
 }
+/** Assertion-fidelity cap — enough to cover realistic tool outputs for content assertions without
+ *  blowing up result.json; deliberately larger than the 500-char display cap so text past the display
+ *  truncation is still assertable. */
+function toolResultAssertText(content) {
+    return flattenToolResult(content, 10_240);
+}
 export function toDecisionRequest(msg) {
     const sub = msg.request?.subtype;
+    // Validate request_id early — every DecisionRequest.id is a non-empty string. A missing or
+    // non-string request_id means the agent sent a malformed control_request; reject loudly rather
+    // than silently building a DecisionRequest with an unusable id (respond() would always miss it).
+    if (typeof msg.request_id !== "string" || msg.request_id === "")
+        throw new Error(`control-in: malformed request_id: ${JSON.stringify(msg.request_id)}`);
     const id = msg.request_id;
     if (sub === "can_use_tool") {
         const tool = msg.request.tool_name ?? "";