cowork-harness 2.2.0 → 2.3.0

package/baselines/prompts/cowork-system-prompt-fingerprints.json

@@ -335,6 +335,33 @@
         "working_with_user_files"
       ],
       "note": "Cowork system prompt BYTE-IDENTICAL to 1.32352.0 on both the raw and the decoded hash (38505 raw / 37811 decoded code points, 43 tags, same 10 placeholders); only the minifier-assigned constant id rotated umt -> Zlt. Raw retained locally per localRawRetention."
+    },
+    "1.34493.1": {
+      "sha256": "e62bd9fa1eefc153ddcbd7e56cc6406a2950965e691b96b8d79dd0dbd7032f07",
+      "codePoints": 38505,
+      "decodedSha256": "a14592804dfc6728e855d3be17eeb40cef654aeb0bc6457487f5963dbedc7fdf",
+      "decodedCodePoints": 37811,
+      "sectionTags": 43,
+      "constantId": "tpt",
+      "note": "BACK-FILLED 2026-08-26 from the retained asar backup — the entry was owed at the 1.34493.1 pass and was never written, which is why the raw was also missing from ~/cowork-agent-backup/desktop-asar/1.34493.1/ until now. Cowork system prompt BYTE-IDENTICAL to 1.32885.1 on both the raw and the decoded hash (38505 raw / 37811 decoded code points, 43 tags, same 10 placeholders); only the minifier-assigned constant id rotated Zlt -> tpt."
+    },
+    "1.37937.0": {
+      "sha256": "e62bd9fa1eefc153ddcbd7e56cc6406a2950965e691b96b8d79dd0dbd7032f07",
+      "codePoints": 38505,
+      "decodedSha256": "a14592804dfc6728e855d3be17eeb40cef654aeb0bc6457487f5963dbedc7fdf",
+      "decodedCodePoints": 37811,
+      "sectionTags": 43,
+      "constantId": "Qgt",
+      "note": "Cowork system prompt BYTE-IDENTICAL to 1.34493.1; only the constant id rotated tpt -> Qgt. Corroborated by a SECOND source rather than by re-running the same extractor: the retained raw files for 1.32885.1, 1.34493.1, 1.37937.0 and 1.37937.1 are byte-identical to each other on disk (cmp), so the prompt has not moved since 1.20186.0."
+    },
+    "1.37937.1": {
+      "sha256": "e62bd9fa1eefc153ddcbd7e56cc6406a2950965e691b96b8d79dd0dbd7032f07",
+      "codePoints": 38505,
+      "decodedSha256": "a14592804dfc6728e855d3be17eeb40cef654aeb0bc6457487f5963dbedc7fdf",
+      "decodedCodePoints": 37811,
+      "sectionTags": 43,
+      "constantId": "Qgt",
+      "note": "Desktop self-updated 1.37937.0 -> 1.37937.1 mid-pass. Prompt BYTE-IDENTICAL to 1.37937.0, same constant id Qgt. Recorded separately because provenance.asarFingerprint is the SAME 16-char value on both builds (it hashes only the cowork slices), so the baseline's own fingerprint cannot distinguish them and this file is where that distinction is kept."
     }
   },
   "subagentAppendMethod": "Independent of the single-text `versions` fingerprints above: the sub-agent environment append is a TWO-BRANCH generator selected on hostLoopMode. In the SINGLE bundle module that references buildSubagentEnvironmentPrompt AND contains both branch discriminators, slice each branch's raw backtick-template body by scanning outward from its discriminator fragment (escaped backticks are decoded to bare backticks; other escapes left intact); DECODE escapes (same decoder as decodedSha256 -- 1.32352.0's codegen escape change moved BOTH branch fingerprints while the rendered branch text was byte-identical), then normalize every ${...} interpolation to the literal token ${} ; sha256 the UTF-8 bytes; keep the first 16 hex chars. The hl (host-loop) branch is discriminated by the fragment 'on the user's machine' (anchored to the occurrence immediately preceding the vm branch, since the phrase also occurs in unrelated prose), the vm (sandbox) branch by 'exist only in the sandbox'. BOTH fingerprints are mandatory per version entry. Consumed by checkSubagentPromptFacts in src/sync/cowork-sync.ts; re-derive with readMainBundleFiles + extractSubagentBranchSlices + subagentBranchFingerprint (see docs/maintenance.md). Raw texts retained locally only (see localRawRetention).",

package/dist/assert.js

@@ -48,6 +48,30 @@ function resolveContainedManifestPath(workRoot, p) {
  *  scenario asserting any of these CANNOT take. A hand-copied list there would rot exactly the way the
  *  `--out`-outside-the-repo advice it replaces did. `test/hostloop-only-keys.test.ts` pins this array
  *  against the `hostloopOnly("…")` call sites by scanning this file's source. */
+/** The founder-visible strings of one gate, as SEPARATE fields: its question label, then every option's
+ *  label and description. The evidence behind `question_context`.
+ *
+ *  Sourced from RunRecord.gateOptions, i.e. the ASK-TIME AskUserQuestion payload the model emitted — never
+ *  from a tool_result. That distinction is the key's whole value: a skill's producer script typically also
+ *  writes the same sentence into its own gate-state file, so a `tool_result_matches` on that phrase grades
+ *  true whether or not the model ever surfaced it. This function can only ever see what was actually
+ *  offered.
+ *
+ *  RETURNS A LIST, and the evaluator tests each entry separately, so a pattern can never match text spanning
+ *  two fields. An earlier version returned one newline-joined string and claimed the newline prevented that.
+ *  It did not, and it was measured doing the opposite: on the committed multiselect example,
+ *  `invoicing[\s\S]*Audit logging` stitched one option's DESCRIPTION to the next option's LABEL and passed —
+ *  a "sentence" no one was ever shown. The neighbouring transcript keys' docs actively teach `[\s\S]` for
+ *  spanning turns, so that is the habit an author brings to this key. Structure beats a documented caveat. */
+export function gateVisibleFields(g) {
+    const parts = [g.question];
+    for (const o of g.options) {
+        parts.push(o.label);
+        if (o.description !== undefined)
+            parts.push(o.description);
+    }
+    return parts;
+}
 /** Order-insensitive multiset equality over option labels — `question_options` with `order: "any"`.
  *  A multiset, not a Set: a gate that offered the same label twice is a different offer from one that
  *  offered it once, and collapsing them would green a duplicated option. */
@@ -1516,6 +1540,59 @@ function check(a, ctx) {
                 results.push(ctx.questions.some((q) => c.re.test(q)) ? ok() : fail(`no question matched: ${a.question_asked}`));
         }
     }
+    if (a.question_context !== undefined) {
+        const qc = a.question_context;
+        // Fail CLOSED on every "we cannot see the gates" path, exactly as question_options does: an absent or
+        // partial gate payload must never satisfy a key whose whole job is to prove what a person was shown.
+        if (ctx.gateOptionsMissing || ctx.gateOptions === undefined) {
+            results.push(fail("evidence unavailable: gate-option evidence absent for this run — cannot evaluate question_context"));
+        }
+        else {
+            const c = compileUserRegex(qc.matches);
+            if ("error" in c) {
+                results.push(fail(`question_context: bad regex "${qc.matches}": ${c.error}`));
+            }
+            else {
+                const all = ctx.gateOptions;
+                let pool = all;
+                let selector = "";
+                let badSelector = false;
+                if (qc.when_question !== undefined) {
+                    const w = compileUserRegex(qc.when_question);
+                    if ("error" in w) {
+                        results.push(fail(`question_context: bad regex "${qc.when_question}": ${w.error}`));
+                        badSelector = true;
+                    }
+                    else {
+                        pool = all.filter((g) => w.re.test(g.question));
+                        selector = ` matching /${qc.when_question}/i`;
+                    }
+                }
+                // NOTE: deliberately NO ambiguity refusal here, unlike question_options. That key pins WHICH gate
+                // offered WHICH set, so silently taking the first would make it depend on gate order. This key asks
+                // whether the founder was shown a phrase at a decision point at all, for which "some selected gate's
+                // payload matches" is the whole semantic — there is nothing to disambiguate. Mirroring the refusal
+                // would red a multi-gate run on which the founder WAS told (measured: the deck-review fixture fires
+                // 5 sub-questions across 2 gates).
+                if (badSelector) {
+                    /* already reported */
+                }
+                else if (pool.length === 0) {
+                    results.push(fail(`question_context: no question${selector} was asked (${all.length} gate(s) recorded)`));
+                }
+                else {
+                    // The founder-visible payload, in the order it is presented: question label, then each option's
+                    // label and description. Joined with newlines so a regex cannot straddle two fields by accident.
+                    const hit = pool.find((g) => gateVisibleFields(g).some((f) => c.re.test(f)));
+                    results.push(hit
+                        ? ok(`question_context: gate ${JSON.stringify(hit.question)} showed text matching /${qc.matches}/i`)
+                        : fail(`question_context: no gate${selector} showed text matching /${qc.matches}/i (searched ${pool.length} gate(s): ${pool
+                            .map((g) => JSON.stringify(g.question))
+                            .join(", ")})`));
+                }
+            }
+        }
+    }
     if (a.question_options !== undefined) {
         const qo = a.question_options;
         // Fail CLOSED on every "we cannot see the gates" path. An empty/absent list must never satisfy a

package/dist/cli.js

@@ -436,7 +436,7 @@ const SUBCOMMAND_USAGE = {
     // flags any physical line naming an artifact next to something that looks like a path-join call).
     trace: `usage: trace <run-id | run-dir | events.jsonl> [--view ${TRACE_VIEWS.join("|")}] [--translate-paths] [--full-results] [--output-format json]
        --view tools              tool call / result rows
-       --view questions          gate lifecycle (question → answer → delivered)
+       --view questions          gate lifecycle (question → offered options, incl. each option's description → answer → delivered)
        --view dispatches         sub-agent dispatch tree + dispatch_count_max
        --view tool-durations     per-tool call-count/timing table, folded from the sibling timeline.jsonl ({} when the run has no timing data)
        --view tool-errors        one row per errored tool call, with the full command + full multi-line stderr (each capped at 4KB); the tools view shows only the first 120 chars
@@ -3660,7 +3660,7 @@ async function cmdVerifyRun(args) {
     // asserting option order with no scripted answers (`on_unanswered: first`, an LLM-decided gate, a
     // post-hoc check on a kept run) would silently reach the evaluator with no evidence at all. Parsed only
     // when the key is asserted — a full events.jsonl read is not free on a long run.
-    const wantsGateOptions = scenario.assert.some((a) => a.question_options !== undefined);
+    const wantsGateOptions = scenario.assert.some((a) => a.question_options !== undefined || a.question_context !== undefined);
     const parsedGates = wantsGateOptions ? parseGatesFromEvents(join(runDir, "events.jsonl")) : undefined;
     // Absent file OR any unparseable frame ⇒ evidence-missing, never a partial set graded as complete:
     // a present-but-corrupt events.jsonl is otherwise indistinguishable from "these were all the gates".
@@ -4384,8 +4384,19 @@ function cmdDiff(args) {
     if (!["tools", "transcript", "artifacts", "meta", "all"].includes(view))
         return void fail("diff", "usage", `--view must be one of tools|transcript|artifacts|meta|all (got "${view}")`, undefined, json);
     const allPositionals = positionals(args, ["--output-format", "--view"]);
-    if (allPositionals.length !== 2)
-        return void fail("diff", "usage", SUBCOMMAND_USAGE.diff, undefined, json);
+    if (allPositionals.length !== 2) {
+        // A single positional is the common typo AND a reasonable intent ("compare this cassette to the
+        // committed one"). That intent is not implementable as a default: `diff` is polymorphic over
+        // baselines, run dirs and cassettes, so a one-arg form needs type dispatch plus a defined source for
+        // "the committed version" (git HEAD, tracked path, inside a repo). Until that exists, say what the
+        // missing operand is instead of printing bare usage at someone who gave us most of what we needed.
+        const hint = allPositionals.length === 1
+            ? `diff needs TWO things to compare; got one (${allPositionals[0]}). Pass the other side explicitly — ` +
+                `e.g. the previously committed cassette (\`git show HEAD:<path> > /tmp/before.cassette.json\`), the ` +
+                `other run dir, or the other baseline. There is no one-argument form.\n\n`
+            : "";
+        return void fail("diff", "usage", hint + SUBCOMMAND_USAGE.diff, undefined, json);
+    }
     const [aName, bName] = allPositionals;
     const aKind = detectDiffKind(aName);
     const bKind = detectDiffKind(bName);