cowork-harness 2.2.0 → 2.4.0

package/baselines/prompts/cowork-system-prompt-fingerprints.json

@@ -335,6 +335,33 @@
         "working_with_user_files"
       ],
       "note": "Cowork system prompt BYTE-IDENTICAL to 1.32352.0 on both the raw and the decoded hash (38505 raw / 37811 decoded code points, 43 tags, same 10 placeholders); only the minifier-assigned constant id rotated umt -> Zlt. Raw retained locally per localRawRetention."
+    },
+    "1.34493.1": {
+      "sha256": "e62bd9fa1eefc153ddcbd7e56cc6406a2950965e691b96b8d79dd0dbd7032f07",
+      "codePoints": 38505,
+      "decodedSha256": "a14592804dfc6728e855d3be17eeb40cef654aeb0bc6457487f5963dbedc7fdf",
+      "decodedCodePoints": 37811,
+      "sectionTags": 43,
+      "constantId": "tpt",
+      "note": "BACK-FILLED 2026-08-26 from the retained asar backup — the entry was owed at the 1.34493.1 pass and was never written, which is why the raw was also missing from ~/cowork-agent-backup/desktop-asar/1.34493.1/ until now. Cowork system prompt BYTE-IDENTICAL to 1.32885.1 on both the raw and the decoded hash (38505 raw / 37811 decoded code points, 43 tags, same 10 placeholders); only the minifier-assigned constant id rotated Zlt -> tpt."
+    },
+    "1.37937.0": {
+      "sha256": "e62bd9fa1eefc153ddcbd7e56cc6406a2950965e691b96b8d79dd0dbd7032f07",
+      "codePoints": 38505,
+      "decodedSha256": "a14592804dfc6728e855d3be17eeb40cef654aeb0bc6457487f5963dbedc7fdf",
+      "decodedCodePoints": 37811,
+      "sectionTags": 43,
+      "constantId": "Qgt",
+      "note": "Cowork system prompt BYTE-IDENTICAL to 1.34493.1; only the constant id rotated tpt -> Qgt. Corroborated by a SECOND source rather than by re-running the same extractor: the retained raw files for 1.32885.1, 1.34493.1, 1.37937.0 and 1.37937.1 are byte-identical to each other on disk (cmp), so the prompt has not moved since 1.20186.0."
+    },
+    "1.37937.1": {
+      "sha256": "e62bd9fa1eefc153ddcbd7e56cc6406a2950965e691b96b8d79dd0dbd7032f07",
+      "codePoints": 38505,
+      "decodedSha256": "a14592804dfc6728e855d3be17eeb40cef654aeb0bc6457487f5963dbedc7fdf",
+      "decodedCodePoints": 37811,
+      "sectionTags": 43,
+      "constantId": "Qgt",
+      "note": "Desktop self-updated 1.37937.0 -> 1.37937.1 mid-pass. Prompt BYTE-IDENTICAL to 1.37937.0, same constant id Qgt. Recorded separately because provenance.asarFingerprint is the SAME 16-char value on both builds (it hashes only the cowork slices), so the baseline's own fingerprint cannot distinguish them and this file is where that distinction is kept."
     }
   },
   "subagentAppendMethod": "Independent of the single-text `versions` fingerprints above: the sub-agent environment append is a TWO-BRANCH generator selected on hostLoopMode. In the SINGLE bundle module that references buildSubagentEnvironmentPrompt AND contains both branch discriminators, slice each branch's raw backtick-template body by scanning outward from its discriminator fragment (escaped backticks are decoded to bare backticks; other escapes left intact); DECODE escapes (same decoder as decodedSha256 -- 1.32352.0's codegen escape change moved BOTH branch fingerprints while the rendered branch text was byte-identical), then normalize every ${...} interpolation to the literal token ${} ; sha256 the UTF-8 bytes; keep the first 16 hex chars. The hl (host-loop) branch is discriminated by the fragment 'on the user's machine' (anchored to the occurrence immediately preceding the vm branch, since the phrase also occurs in unrelated prose), the vm (sandbox) branch by 'exist only in the sandbox'. BOTH fingerprints are mandatory per version entry. Consumed by checkSubagentPromptFacts in src/sync/cowork-sync.ts; re-derive with readMainBundleFiles + extractSubagentBranchSlices + subagentBranchFingerprint (see docs/maintenance.md). Raw texts retained locally only (see localRawRetention).",

package/dist/assert.js

@@ -48,6 +48,30 @@ function resolveContainedManifestPath(workRoot, p) {
  *  scenario asserting any of these CANNOT take. A hand-copied list there would rot exactly the way the
  *  `--out`-outside-the-repo advice it replaces did. `test/hostloop-only-keys.test.ts` pins this array
  *  against the `hostloopOnly("…")` call sites by scanning this file's source. */
+/** The founder-visible strings of one gate, as SEPARATE fields: its question label, then every option's
+ *  label and description. The evidence behind `question_context`.
+ *
+ *  Sourced from RunRecord.gateOptions, i.e. the ASK-TIME AskUserQuestion payload the model emitted — never
+ *  from a tool_result. That distinction is the key's whole value: a skill's producer script typically also
+ *  writes the same sentence into its own gate-state file, so a `tool_result_matches` on that phrase grades
+ *  true whether or not the model ever surfaced it. This function can only ever see what was actually
+ *  offered.
+ *
+ *  RETURNS A LIST, and the evaluator tests each entry separately, so a pattern can never match text spanning
+ *  two fields. An earlier version returned one newline-joined string and claimed the newline prevented that.
+ *  It did not, and it was measured doing the opposite: on the committed multiselect example,
+ *  `invoicing[\s\S]*Audit logging` stitched one option's DESCRIPTION to the next option's LABEL and passed —
+ *  a "sentence" no one was ever shown. The neighbouring transcript keys' docs actively teach `[\s\S]` for
+ *  spanning turns, so that is the habit an author brings to this key. Structure beats a documented caveat. */
+export function gateVisibleFields(g) {
+    const parts = [g.question];
+    for (const o of g.options) {
+        parts.push(o.label);
+        if (o.description !== undefined)
+            parts.push(o.description);
+    }
+    return parts;
+}
 /** Order-insensitive multiset equality over option labels — `question_options` with `order: "any"`.
  *  A multiset, not a Set: a gate that offered the same label twice is a different offer from one that
  *  offered it once, and collapsing them would green a duplicated option. */
@@ -349,7 +373,7 @@ function capForJudge(text, cap) {
         return text;
     return `${text.slice(0, cap)}\n…[${text.length - cap} chars truncated for the judge input budget — evidence beyond this point was NOT shown; do not infer absence from this cut]`;
 }
-function buildJudgedDocument(ctx, includeSubagentText = false) {
+export function buildJudgedDocument(ctx, includeSubagentText = false) {
     // SCRUB BEFORE CAP: scrub is exact-string replacement, so a secret straddling a cap boundary would
     // be truncated mid-token and slip past scrub into the doc sent to the (external) judge. Scrub each raw
     // section FIRST, then cap the already-redacted text — capping redacted content can never re-expose a secret.
@@ -381,8 +405,33 @@ function buildJudgedDocument(ctx, includeSubagentText = false) {
             parts.push(`## Sub-agent output: ${s(label)}\n${capForJudge(s(text), JUDGE_SUBAGENT_CAP)}`);
         }
     }
-    for (const f of ctx.authoredFiles ?? [])
-        parts.push(`## Authored file: ${s(f.path)}${f.truncated ? " (truncated)" : ""}\n${s(f.content)}`);
+    // AUTHORED is not DELIVERED. The capture deliberately includes the scratchpad (the run DID write those
+    // files, and production's sandbox would too), but production DISCARDS anything outside `mnt/` — its own
+    // sub-agent prompt: "never reaches the user or your file tools". Unlabelled, a rubric like "the report
+    // was written" grades TRUE on a file the user never receives — the harness's own false-green, inside the
+    // one evaluator that reads free-form prose and cannot infer the convention.
+    //
+    // The distinction is already carried in the path: the scratchpad walk emits a synthetic `scratchpad/`
+    // prefix (run/artifacts.ts). This only makes it legible to the judge, rather than restructuring the set.
+    // `scratchpad` is NOT in RESERVED_MOUNT_NAMES, so a user may connect a folder with that exact name.
+    // Its files then arrive workRoot-relative as `scratchpad/…` — indistinguishable by prefix from the
+    // synthetic walk. Labelling those would hand the judge a FALSE statement ("NOT delivered" about a file
+    // the user does receive) and false-RED a "was the report delivered?" rubric. A wrong claim is worse
+    // than a missing one, so the collision disables the label rather than guessing.
+    // `?? []` because a partial AssertContext (tests, and any caller building one by hand) may omit this;
+    // an absent prefix list means "nothing is user-visible", which keeps the label ON — the safe direction.
+    const scratchIsUserVisible = (ctx.userVisiblePrefixes ?? []).some((p) => p === "scratchpad" || p === SCRATCHPAD_PREFIX);
+    let sawScratch = false;
+    for (const f of ctx.authoredFiles ?? []) {
+        const scratch = !scratchIsUserVisible && f.path.startsWith(SCRATCHPAD_PREFIX);
+        sawScratch ||= scratch;
+        const tag = scratch ? " — SCRATCH, NOT delivered to the user" : "";
+        parts.push(`## Authored file: ${s(f.path)}${tag}${f.truncated ? " (truncated)" : ""}\n${s(f.content)}`);
+    }
+    if (sawScratch)
+        parts.push("## Note on scratch files\nFiles marked SCRATCH were written to the session's scratch area, which is " +
+            "discarded and never reaches the user. Treat them as working intermediates: they are evidence of what " +
+            "the run DID, and are NOT evidence that anything was delivered, saved, shared, or produced for the user.");
     // Surface authored-file incompleteness to the judge so it never reads an omitted/unreadable file's
     // ABSENCE as evidence the skill didn't produce it (#14/#16). The verdict is separately forced to
     // evidence-unavailable in the semantic_matches check; this note keeps a still-produced grade honest.
@@ -1516,6 +1565,59 @@ function check(a, ctx) {
                 results.push(ctx.questions.some((q) => c.re.test(q)) ? ok() : fail(`no question matched: ${a.question_asked}`));
         }
     }
+    if (a.question_context !== undefined) {
+        const qc = a.question_context;
+        // Fail CLOSED on every "we cannot see the gates" path, exactly as question_options does: an absent or
+        // partial gate payload must never satisfy a key whose whole job is to prove what a person was shown.
+        if (ctx.gateOptionsMissing || ctx.gateOptions === undefined) {
+            results.push(fail("evidence unavailable: gate-option evidence absent for this run — cannot evaluate question_context"));
+        }
+        else {
+            const c = compileUserRegex(qc.matches);
+            if ("error" in c) {
+                results.push(fail(`question_context: bad regex "${qc.matches}": ${c.error}`));
+            }
+            else {
+                const all = ctx.gateOptions;
+                let pool = all;
+                let selector = "";
+                let badSelector = false;
+                if (qc.when_question !== undefined) {
+                    const w = compileUserRegex(qc.when_question);
+                    if ("error" in w) {
+                        results.push(fail(`question_context: bad regex "${qc.when_question}": ${w.error}`));
+                        badSelector = true;
+                    }
+                    else {
+                        pool = all.filter((g) => w.re.test(g.question));
+                        selector = ` matching /${qc.when_question}/i`;
+                    }
+                }
+                // NOTE: deliberately NO ambiguity refusal here, unlike question_options. That key pins WHICH gate
+                // offered WHICH set, so silently taking the first would make it depend on gate order. This key asks
+                // whether the founder was shown a phrase at a decision point at all, for which "some selected gate's
+                // payload matches" is the whole semantic — there is nothing to disambiguate. Mirroring the refusal
+                // would red a multi-gate run on which the founder WAS told (measured: the deck-review fixture fires
+                // 5 sub-questions across 2 gates).
+                if (badSelector) {
+                    /* already reported */
+                }
+                else if (pool.length === 0) {
+                    results.push(fail(`question_context: no question${selector} was asked (${all.length} gate(s) recorded)`));
+                }
+                else {
+                    // The founder-visible payload, in the order it is presented: question label, then each option's
+                    // label and description. Joined with newlines so a regex cannot straddle two fields by accident.
+                    const hit = pool.find((g) => gateVisibleFields(g).some((f) => c.re.test(f)));
+                    results.push(hit
+                        ? ok(`question_context: gate ${JSON.stringify(hit.question)} showed text matching /${qc.matches}/i`)
+                        : fail(`question_context: no gate${selector} showed text matching /${qc.matches}/i (searched ${pool.length} gate(s): ${pool
+                            .map((g) => JSON.stringify(g.question))
+                            .join(", ")})`));
+                }
+            }
+        }
+    }
     if (a.question_options !== undefined) {
         const qo = a.question_options;
         // Fail CLOSED on every "we cannot see the gates" path. An empty/absent list must never satisfy a

package/dist/cli.js

@@ -436,7 +436,7 @@ const SUBCOMMAND_USAGE = {
     // flags any physical line naming an artifact next to something that looks like a path-join call).
     trace: `usage: trace <run-id | run-dir | events.jsonl> [--view ${TRACE_VIEWS.join("|")}] [--translate-paths] [--full-results] [--output-format json]
        --view tools              tool call / result rows
-       --view questions          gate lifecycle (question → answer → delivered)
+       --view questions          gate lifecycle (question → offered options, incl. each option's description → answer → delivered)
        --view dispatches         sub-agent dispatch tree + dispatch_count_max
        --view tool-durations     per-tool call-count/timing table, folded from the sibling timeline.jsonl ({} when the run has no timing data)
        --view tool-errors        one row per errored tool call, with the full command + full multi-line stderr (each capped at 4KB); the tools view shows only the first 120 chars
@@ -3660,7 +3660,7 @@ async function cmdVerifyRun(args) {
     // asserting option order with no scripted answers (`on_unanswered: first`, an LLM-decided gate, a
     // post-hoc check on a kept run) would silently reach the evaluator with no evidence at all. Parsed only
     // when the key is asserted — a full events.jsonl read is not free on a long run.
-    const wantsGateOptions = scenario.assert.some((a) => a.question_options !== undefined);
+    const wantsGateOptions = scenario.assert.some((a) => a.question_options !== undefined || a.question_context !== undefined);
     const parsedGates = wantsGateOptions ? parseGatesFromEvents(join(runDir, "events.jsonl")) : undefined;
     // Absent file OR any unparseable frame ⇒ evidence-missing, never a partial set graded as complete:
     // a present-but-corrupt events.jsonl is otherwise indistinguishable from "these were all the gates".
@@ -4384,8 +4384,19 @@ function cmdDiff(args) {
     if (!["tools", "transcript", "artifacts", "meta", "all"].includes(view))
         return void fail("diff", "usage", `--view must be one of tools|transcript|artifacts|meta|all (got "${view}")`, undefined, json);
     const allPositionals = positionals(args, ["--output-format", "--view"]);
-    if (allPositionals.length !== 2)
-        return void fail("diff", "usage", SUBCOMMAND_USAGE.diff, undefined, json);
+    if (allPositionals.length !== 2) {
+        // A single positional is the common typo AND a reasonable intent ("compare this cassette to the
+        // committed one"). That intent is not implementable as a default: `diff` is polymorphic over
+        // baselines, run dirs and cassettes, so a one-arg form needs type dispatch plus a defined source for
+        // "the committed version" (git HEAD, tracked path, inside a repo). Until that exists, say what the
+        // missing operand is instead of printing bare usage at someone who gave us most of what we needed.
+        const hint = allPositionals.length === 1
+            ? `diff needs TWO things to compare; got one (${allPositionals[0]}). Pass the other side explicitly — ` +
+                `e.g. the previously committed cassette (\`git show HEAD:<path> > /tmp/before.cassette.json\`), the ` +
+                `other run dir, or the other baseline. There is no one-argument form.\n\n`
+            : "";
+        return void fail("diff", "usage", hint + SUBCOMMAND_USAGE.diff, undefined, json);
+    }
     const [aName, bName] = allPositionals;
     const aKind = detectDiffKind(aName);
     const bKind = detectDiffKind(bName);

package/dist/hostloop/workspace-handler.js

@@ -228,10 +228,12 @@ const defaultRawFetch = async (url, pinnedAddresses) => {
 const BASH_DESC = "Run a shell command in the session's isolated Linux workspace. Your connected folders are mounted under {{mnt}}/ — the Shell access section of your system prompt lists the exact path for each folder. Each bash call is independent (no cwd/env carryover). Use absolute paths.";
 const FETCH_DESC = "Fetch a URL from the session network (subject to the egress allowlist). web_fetch can only retrieve URLs that appeared in a user message or a prior result.";
 export function makeWorkspaceHandler(opts) {
-    const { containerName, vmMnt, runner = "docker", webFetchAllow = ["*"], onEgress, onInfraError, provenanceRef, dedup, rawFetch = defaultRawFetch, resolve = defaultResolver, execCwd = vmMnt, } = opts;
+    const { containerName, vmMnt, runner = "docker", webFetchAllow = [], // DENY-ALL when unset — see the option doc; an open default was a real hole
+    onEgress, onInfraError, provenanceRef, dedup, rawFetch = defaultRawFetch, resolve = defaultResolver, execCwd = vmMnt, } = opts;
     // Per-handler (per-spawn) latch for the provenance-unenforced warning — was module-level, which
     // silenced the gap after the first run in a long-lived process. Each fresh handler warns once.
     const provWarned = { value: false };
+    const exposed = opts.tools ?? ["bash", "web_fetch"];
     const tools = [
         {
             name: "bash",
@@ -243,7 +245,7 @@ export function makeWorkspaceHandler(opts) {
             description: FETCH_DESC,
             inputSchema: { type: "object", properties: { url: { type: "string" } }, required: ["url"] },
         },
-    ];
+    ].filter((td) => exposed.includes(td.name));
     return async (_server, jr) => {
         const method = jr.method;
         if (method === "initialize")
@@ -259,6 +261,12 @@ export function makeWorkspaceHandler(opts) {
         if (method === "tools/call") {
             const name = jr.params?.name;
             const a = jr.params?.arguments ?? {};
+            // Gate the DISPATCH on the same set as the advertisement, not just the tools/list response. An
+            // unadvertised tool that still executes when named is a real hole: the VM-loop registration exposes
+            // web_fetch ONLY, and a `bash` call arriving there must be refused, not quietly exec'd into the
+            // container.
+            if (!exposed.includes(name))
+                return { result: textResult(`error: unknown tool "${String(name)}"`, true) };
             if (name === "bash")
                 return {
                     result: await execInContainer(runner, containerName, execCwd, String(a.command ?? ""), clampTimeout(a.timeout_ms), onInfraError),
@@ -267,6 +275,8 @@ export function makeWorkspaceHandler(opts) {
                 return {
                     result: await fetchViaHost(String(a.url ?? ""), webFetchAllow, onEgress, provenanceRef?.current, provWarned, rawFetch, resolve, dedup),
                 };
+            // Unreachable: the dispatch gate above rejects every name outside `exposed`, and `exposed` is a
+            // subset of the two handled here. Kept as a total-function backstop if that gate is ever loosened.
             return { error: { code: -32602, message: `unknown tool: ${name}` } };
         }
         return { result: {} }; // ping / notifications