cowork-harness 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -6,6 +6,19 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [0.7.1] — 2026-06-20
+
+### Fixed
+
+- **`file_exists` and `user_visible_artifact` now pass for truncated (large) cassette artifacts.**
+  A truncated manifest entry (`truncated: true`) carries `path`, `bytes`, and `sha256` — positive
+  proof the file existed at record time. 0.7.0 incorrectly failed these existence/promotion
+  assertions with `"was truncated in the cassette — content was not committed; assertion cannot
+  pass"`, producing false-REDs for any cassette whose artifacts exceeded the 64 KiB inline cap.
+  Only **content** assertions (`artifact_json`) require the inlined body; existence assertions
+  now correctly pass from the manifest. `artifact_json` on a truncated artifact continues to fail
+  (the 0-byte placeholder is not valid JSON). Regression test added.
+
 ## [0.7.0] — 2026-06-19
 
 ### Added

package/dist/assert.js

@@ -192,7 +192,9 @@ function check(a, ctx) {
         else {
             const relPath = relative(resolve(ctx.workRoot), abs);
             if (truncated.has(relPath)) {
-                results.push(fail(`"${a.file_exists}" was truncated in the cassette — content was not committed; assertion cannot pass`));
+                // A truncated manifest entry carries path+bytes+sha256 — positive proof the file existed at
+                // record time. Existence is provable without the inlined body; only content assertions need it.
+                results.push(ok());
             }
             else {
                 // Bug 37: verify the real path (after symlink resolution) is still under workRoot.
@@ -214,7 +216,12 @@ function check(a, ctx) {
         else {
             const rel = relative(resolve(ctx.workRoot), abs); // normalized, guaranteed under workRoot
             if (truncated.has(rel)) {
-                results.push(fail(`"${p}" was truncated in the cassette — content was not committed; assertion cannot pass`));
+                // Truncated entry proves existence (path+bytes+sha256 recorded). Promotion is a path-prefix
+                // property — also knowable without the body. Pass if under a user-visible prefix.
+                const visible = ctx.userVisiblePrefixes.some((pre) => rel === pre || rel.startsWith(pre + "/"));
+                results.push(visible
+                    ? ok()
+                    : fail(`"${p}" is not under a user-visible prefix (${ctx.userVisiblePrefixes.join(", ")}) — invisible to the user in Cowork`));
             }
             else {
                 const visible = ctx.userVisiblePrefixes.some((pre) => rel === pre || rel.startsWith(pre + "/"));

package/dist/run/cassette.js

@@ -107,10 +107,11 @@ function decodeBody(e) {
 }
 /** #1: materialize a manifest into a temp work root so replay can run the filesystem assertions against it.
  *  Small files get their inlined body (decoded per its encoding marker); hash-only (truncated)
- *  files get an empty placeholder (file_exists FAILS; artifact_json on them fails loud — it needs the
- *  body, which only small files carry). each path is containment-checked before writing so a hostile
- *  cassette entry can't escape the temp root. every non-truncated body is verified against its
- *  recorded sha256 (over the decoded RAW bytes) — a mismatch fails replay (throws). */
+ *  files get an empty placeholder. A truncated entry carries path+bytes+sha256 — positive proof the
+ *  file existed at record time — so file_exists and user_visible_artifact PASS from the manifest;
+ *  only artifact_json fails loud (it needs the inlined body). each path is containment-checked before
+ *  writing so a hostile cassette entry can't escape the temp root. every non-truncated body is verified
+ *  against its recorded sha256 (over the decoded RAW bytes) — a mismatch fails replay (throws). */
 export function materializeManifest(entries) {
     const workRoot = mkdtempSync(join(tmpdir(), "cwh-replay-"));
     const truncatedPaths = new Set();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-harness",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Scriptable, CI-friendly harness for Claude Cowork's runtime contract for testing skills across scenarios — same agent, mounts, egress allowlist, permission protocol, and sandbox limitations.",
   "license": "MIT",
   "type": "module",