@sweny-ai/core 0.1.136 → 0.1.137

package/dist/cli/main.js

@@ -1244,6 +1244,18 @@ workflowCmd
     }
     console.log();
 });
+// ── sweny tool-bridge (hidden, #414) ──────────────────────────────────
+// stdio MCP shim a harness starts to reach this run's skill tools over the
+// per-run unix socket. Not for humans; started by harness/tool-bridge/server.ts.
+program
+    .command("tool-bridge", { hidden: true })
+    .description("Internal: stdio MCP shim for sweny skill tools")
+    .requiredOption("--socket <path>", "Per-run bridge socket")
+    .option("--token <token>", "Per-run token (default: SWENY_TOOL_BRIDGE_TOKEN)")
+    .action(async (options) => {
+    const { runToolBridgeShim } = await import("../harness/tool-bridge/shim.js");
+    await runToolBridgeShim({ socket: options.socket, token: options.token, version });
+});
 // ── sweny upgrade / update ────────────────────────────────────────────
 // Self-update the globally-installed @sweny-ai/core. Mirrors the UX of
 // `bun upgrade`, `deno upgrade`, `rustup update`, etc.

package/dist/harness/claude-code.d.ts

@@ -8,7 +8,7 @@
  * This is the ONLY supported LLM backend. The whole point of sweny
  * is to use headless Claude Code - never the raw Anthropic API.
  */
-import type { Claude, ToolContext, Logger, McpServerConfig } from "../types.js";
+import type { Claude, Tool, ToolContext, Logger, McpServerConfig } from "../types.js";
 import { type SandboxMode } from "../agent-env.js";
 import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult } from "./types.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
@@ -107,6 +107,18 @@ export interface ClaudeCodeHarnessOptions {
     sandboxAllowedDomains?: string[];
     /** Sandbox preflight probe (test seam). Returns a reason when the sandbox cannot run. */
     sandboxProbe?: () => string | undefined;
+    /**
+     * Serve skill tools through the SwenyToolBridge (a stdio MCP shim over a
+     * per-run unix socket, #414) instead of the in-process SDK MCP server.
+     * Same tools, same results; used to run the harness contract suite both
+     * ways. Default: off, unless `SWENY_TOOL_BRIDGE=1`.
+     */
+    toolBridge?: boolean;
+    /** Shim command override for the bridge (test seam). Default: this package's `sweny tool-bridge`. */
+    toolBridgeShim?: {
+        command: string;
+        args: string[];
+    };
 }
 /**
  * Wire an optional timeout + caller signal onto a single AbortController.
@@ -139,6 +151,8 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     private sandboxProbe;
     private sandboxWarned;
     private envScope;
+    private toolBridge;
+    private toolBridgeShim;
     constructor(opts?: ClaudeCodeHarnessOptions);
     /**
      * Build env for the Claude Code subprocess (#360). Applies auth precedence
@@ -201,6 +215,18 @@ export type ClaudeClientOptions = ClaudeCodeHarnessOptions;
 export declare const ClaudeClient: typeof ClaudeCodeHarness;
 /** @deprecated Use {@link ClaudeCodeHarness}. */
 export type ClaudeClient = ClaudeCodeHarness;
+/**
+ * Convert a core Tool to an SDK MCP tool definition.
+ *
+ * The wrapper runs the user's handler and returns the MCP `CallToolResult`.
+ * Output bookkeeping happens on the stream side (see the tool_result
+ * handler in `run()`), keyed by `tool_use_id` - never from inside the
+ * wrapper. Keeping the wrapper stateless means parallel calls to the same
+ * tool cannot mis-pair outputs.
+ *
+ * @internal Exported for the tool bridge parity test (#414).
+ */
+export declare function coreToolToSdkTool(coreTool: Tool, defaultCtx: ToolContext): import("@anthropic-ai/claude-agent-sdk").SdkMcpToolDefinition<Record<string, import("zod").ZodType<any, import("zod").ZodTypeDef, any>>>;
 /**
  * Best-effort recovery of typed output from a tool_result's `content`.
  *

package/dist/harness/claude-code.js

@@ -10,13 +10,14 @@
  */
 import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude-agent-sdk";
 import { createRequire } from "node:module";
-import { z } from "zod";
 import { consoleLogger } from "../types.js";
 import { reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, resolveAgentSandbox, } from "../agent-env.js";
 import { fenceUntrustedJson } from "../untrusted.js";
 import { policyGate } from "./policy.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
 import { ask as coreAsk, evaluate as coreEvaluate, buildEvaluatePrompt } from "./prompts.js";
+import { jsonSchemaToZodShape, toolErrorToMcpResult, toolOutputToMcpResult } from "./tool-bridge/protocol.js";
+import { startToolBridge } from "./tool-bridge/server.js";
 export { buildEvaluatePrompt, CLAUDE_CODE_CAPABILITIES };
 let cachedSdkVersion;
 /** Version of the Claude Agent SDK this adapter drives; "unknown" when it cannot be read. */
@@ -241,6 +242,8 @@ export class ClaudeCodeHarness {
     sandboxProbe;
     sandboxWarned = false;
     envScope;
+    toolBridge;
+    toolBridgeShim;
     constructor(opts = {}) {
         this.model = opts.model;
         this.maxTurns = opts.maxTurns ?? 20;
@@ -254,6 +257,8 @@ export class ClaudeCodeHarness {
         this.sandboxMode = opts.sandbox;
         this.sandboxAllowedDomains = opts.sandboxAllowedDomains;
         this.sandboxProbe = opts.sandboxProbe;
+        this.toolBridge = opts.toolBridge ?? process.env.SWENY_TOOL_BRIDGE === "1";
+        this.toolBridgeShim = opts.toolBridgeShim;
     }
     /**
      * Build env for the Claude Code subprocess (#360). Applies auth precedence
@@ -352,12 +357,18 @@ export class ClaudeCodeHarness {
         // handler and returns `content` via the MCP transport. We do not push
         // to toolCalls from the wrapper - the stream's tool_result is the sole
         // signal of completion, which keeps pairing correct under parallelism.
-        const sdkTools = tools.map((t) => coreToolToSdkTool(t, this.defaultContext));
+        // #414: with the bridge on, the same tools reach Claude Code through the
+        // `sweny tool-bridge` stdio shim instead, so no in-process server is built.
+        const useBridge = this.toolBridge && tools.length > 0;
+        const sdkTools = useBridge ? [] : tools.map((t) => coreToolToSdkTool(t, this.defaultContext));
         // Create in-process MCP server
-        const mcpServer = createSdkMcpServer({
-            name: "sweny-core",
-            tools: sdkTools,
-        });
+        const mcpServer = useBridge
+            ? undefined
+            : createSdkMcpServer({
+                name: "sweny-core",
+                tools: sdkTools,
+            });
+        let bridge;
         // Build prompt. Context (workflow input such as issues/alerts, plus prior
         // node outputs) is fenced as untrusted data (#360).
         const prompt = [
@@ -394,8 +405,21 @@ export class ClaudeCodeHarness {
             const allMcpServers = readOnly
                 ? {}
                 : { ...this.defaultMcpServers, ...opts.mcpServers, ...this.mcpServers };
-            if (sdkTools.length > 0)
+            if (useBridge) {
+                // Only `tools` (already allow/deny and dry-run filtered by the
+                // executor) are exposed. Under readOnly it is still the only MCP
+                // server, and strictMcpConfig below keeps it that way.
+                bridge = await startToolBridge({
+                    tools,
+                    context: this.defaultContext,
+                    logger: this.logger,
+                    ...(this.toolBridgeShim ? { shimCommand: this.toolBridgeShim } : {}),
+                });
+                allMcpServers["sweny-core"] = bridge.mcpServer;
+            }
+            else if (sdkTools.length > 0) {
                 allMcpServers["sweny-core"] = mcpServer;
+            }
             stream = query({
                 prompt,
                 options: {
@@ -567,6 +591,8 @@ export class ClaudeCodeHarness {
             // it cannot fire after we are done.
             abort?.clear();
             await interruptStream(stream);
+            // #414: the socket and its directory go away with the run.
+            await bridge?.close();
         }
         if (!sawResult) {
             const msg = "agent stream ended without a result message";
@@ -703,8 +729,10 @@ export const ClaudeClient = ClaudeCodeHarness;
  * handler in `run()`), keyed by `tool_use_id` - never from inside the
  * wrapper. Keeping the wrapper stateless means parallel calls to the same
  * tool cannot mis-pair outputs.
+ *
+ * @internal Exported for the tool bridge parity test (#414).
  */
-function coreToolToSdkTool(coreTool, defaultCtx) {
+export function coreToolToSdkTool(coreTool, defaultCtx) {
     const zodShape = jsonSchemaToZodShape(coreTool.input_schema);
     return sdkTool(coreTool.name, coreTool.description, zodShape, async (args) => {
         try {
@@ -712,16 +740,12 @@ function coreToolToSdkTool(coreTool, defaultCtx) {
             // When used standalone, defaultCtx is the fallback.
             const output = await coreTool.handler(args, defaultCtx);
             // JSON-stringify structured output so the tool_result handler can
-            // recover it via parseToolResultContent. Strings pass through.
-            return {
-                content: [{ type: "text", text: typeof output === "string" ? output : JSON.stringify(output) }],
-            };
+            // recover it via parseToolResultContent. Strings pass through. Shared
+            // with the tool bridge so both paths return the same content.
+            return toolOutputToMcpResult(output);
         }
         catch (err) {
-            return {
-                content: [{ type: "text", text: `Error: ${err.message}` }],
-                isError: true,
-            };
+            return toolErrorToMcpResult(err);
         }
     });
 }
@@ -831,67 +855,6 @@ export function summarizeToolError(parsed) {
     const collapsed = raw.replace(/\s+/g, " ").trim();
     return collapsed.length > 300 ? collapsed.slice(0, 297) + "..." : collapsed;
 }
-// ─── JSON Schema → Zod conversion ───────────────────────────────
-/**
- * Convert a JSON Schema object to a Zod raw shape for the agent SDK.
- * Preserves property names, types, and descriptions so Claude sees
- * accurate tool parameters through the MCP protocol.
- */
-function jsonSchemaToZodShape(schema) {
-    const props = schema?.properties ?? {};
-    const required = new Set(schema?.required ?? []);
-    const shape = {};
-    for (const [key, prop] of Object.entries(props)) {
-        let zodType = jsonPropertyToZod(prop);
-        if (!required.has(key)) {
-            zodType = zodType.optional();
-        }
-        shape[key] = zodType;
-    }
-    return shape;
-}
-function jsonPropertyToZod(prop) {
-    if (!prop || typeof prop !== "object")
-        return z.unknown();
-    const desc = typeof prop.description === "string" ? prop.description : undefined;
-    switch (prop.type) {
-        case "string": {
-            if (prop.enum && Array.isArray(prop.enum)) {
-                const e = z.enum(prop.enum);
-                return desc ? e.describe(desc) : e;
-            }
-            const s = z.string();
-            return desc ? s.describe(desc) : s;
-        }
-        case "number":
-        case "integer": {
-            const n = z.number();
-            return desc ? n.describe(desc) : n;
-        }
-        case "boolean": {
-            const b = z.boolean();
-            return desc ? b.describe(desc) : b;
-        }
-        case "array": {
-            const items = prop.items ? jsonPropertyToZod(prop.items) : z.unknown();
-            const a = z.array(items);
-            return desc ? a.describe(desc) : a;
-        }
-        case "object": {
-            if (prop.properties && typeof prop.properties === "object") {
-                const nested = jsonSchemaToZodShape(prop);
-                const o = z.object(nested);
-                return desc ? o.describe(desc) : o;
-            }
-            const r = z.record(z.string(), z.unknown());
-            return desc ? r.describe(desc) : r;
-        }
-        default: {
-            const u = z.unknown();
-            return desc ? u.describe(desc) : u;
-        }
-    }
-}
 /** Strip MCP server prefix: "mcp__server__tool" → "tool" */
 function stripMcpPrefix(name) {
     const parts = name.split("__");

package/dist/harness/index.d.ts

@@ -9,6 +9,8 @@ export { policyGate } from "./policy.js";
 export { ask, evaluate, buildAskPrompt, buildEvaluatePrompt } from "./prompts.js";
 export { ClaudeCodeHarness, CLAUDE_CODE_CAPABILITIES } from "./claude-code.js";
 export type { ClaudeCodeHarnessOptions } from "./claude-code.js";
+export { startToolBridge } from "./tool-bridge/server.js";
+export type { ToolBridge, ToolBridgeOptions } from "./tool-bridge/server.js";
 /**
  * Build the harness for an agent id. `claude` is the historical `--agent` /
  * `coding-agent-provider` value and means the same as `claude-code`.

package/dist/harness/index.js

@@ -7,6 +7,7 @@ export { claudeCompat, asClaude } from "./compat.js";
 export { policyGate } from "./policy.js";
 export { ask, evaluate, buildAskPrompt, buildEvaluatePrompt } from "./prompts.js";
 export { ClaudeCodeHarness, CLAUDE_CODE_CAPABILITIES } from "./claude-code.js";
+export { startToolBridge } from "./tool-bridge/server.js";
 /**
  * Build the harness for an agent id. `claude` is the historical `--agent` /
  * `coding-agent-provider` value and means the same as `claude-code`.

package/dist/harness/tool-bridge/protocol.d.ts

@@ -0,0 +1,91 @@
+/**
+ * SwenyToolBridge wire protocol (#414).
+ *
+ * The bridge moves skill tool calls from a harness's stdio MCP client to the
+ * sweny process that owns the tool handlers:
+ *
+ *   harness --stdio MCP--> shim (`sweny tool-bridge`) --unix socket--> server (sweny run)
+ *
+ * The socket carries newline-delimited JSON frames. Every request carries the
+ * per-run token; the server rejects a frame with a wrong or missing token and
+ * drops the connection.
+ *
+ * This module also owns the one function that turns a core `Tool` handler
+ * outcome into an MCP `CallToolResult`, so the in-process Claude path
+ * (`createSdkMcpServer`) and the bridge return byte-identical content and the
+ * same `isError` status.
+ */
+import { z } from "zod";
+import type { JSONSchema, Tool, ToolContext } from "../../types.js";
+export declare const BRIDGE_PROTOCOL_VERSION = 1;
+/** Frames longer than this are refused and the connection is dropped. */
+export declare const MAX_FRAME_BYTES: number;
+/** Env var the shim reads the per-run token from (kept out of argv by default). */
+export declare const TOKEN_ENV = "SWENY_TOOL_BRIDGE_TOKEN";
+export type BridgeMethod = "tools/list" | "tools/call";
+export interface BridgeRequest {
+    v: typeof BRIDGE_PROTOCOL_VERSION;
+    id: number;
+    token: string;
+    method: BridgeMethod;
+    params?: {
+        name?: string;
+        arguments?: Record<string, unknown>;
+    };
+}
+export interface BridgeToolDescriptor {
+    name: string;
+    description: string;
+    inputSchema: JSONSchema;
+}
+export type McpTextContent = {
+    type: "text";
+    text: string;
+};
+/** The MCP `CallToolResult` subset sweny produces for skill tools. */
+export type McpCallToolResult = {
+    content: McpTextContent[];
+    isError?: true;
+};
+export type BridgeResponse = {
+    id: number;
+    ok: true;
+    result: {
+        tools: BridgeToolDescriptor[];
+    } | McpCallToolResult;
+} | {
+    id: number;
+    ok: false;
+    error: {
+        code: BridgeErrorCode;
+        message: string;
+    };
+};
+export type BridgeErrorCode = "unauthorized" | "bad_request" | "unknown_tool" | "internal";
+export declare function encodeFrame(frame: BridgeRequest | BridgeResponse): string;
+/**
+ * Split a byte stream into newline-delimited JSON frames. Calls `onFrame` with
+ * each parsed value (or `undefined` for a line that is not JSON) and
+ * `onOverflow` once when a single frame exceeds {@link MAX_FRAME_BYTES}.
+ */
+export declare function createFrameReader(onFrame: (value: unknown) => void, onOverflow: () => void, maxBytes?: number): (chunk: Buffer | string) => void;
+/** Constant-time token comparison. False for any non-string or length mismatch. */
+export declare function tokenMatches(expected: string, given: unknown): boolean;
+/** Structural check of an incoming request frame (token checked separately). */
+export declare function parseRequest(value: unknown): BridgeRequest | undefined;
+/** A handler's return value as MCP content. Strings pass through; anything else is JSON. */
+export declare function toolOutputToMcpResult(output: unknown): McpCallToolResult;
+/** A handler's thrown error as an MCP error result. */
+export declare function toolErrorToMcpResult(err: unknown): McpCallToolResult;
+/**
+ * Validate args against the tool's input schema (the same Zod shape the
+ * in-process SDK server validates with), run the handler, and return the MCP
+ * result. Invalid args come back as an error result, never reach the handler.
+ */
+export declare function callToolAsMcp(tool: Tool, args: unknown, ctx: ToolContext): Promise<McpCallToolResult>;
+/**
+ * Convert a JSON Schema object to a Zod raw shape. The in-process SDK server
+ * and the bridge both validate tool args with it, so both paths accept and
+ * reject the same inputs and preserve property names, types and descriptions.
+ */
+export declare function jsonSchemaToZodShape(schema: JSONSchema): Record<string, z.ZodType>;

package/dist/harness/tool-bridge/protocol.js

@@ -0,0 +1,184 @@
+/**
+ * SwenyToolBridge wire protocol (#414).
+ *
+ * The bridge moves skill tool calls from a harness's stdio MCP client to the
+ * sweny process that owns the tool handlers:
+ *
+ *   harness --stdio MCP--> shim (`sweny tool-bridge`) --unix socket--> server (sweny run)
+ *
+ * The socket carries newline-delimited JSON frames. Every request carries the
+ * per-run token; the server rejects a frame with a wrong or missing token and
+ * drops the connection.
+ *
+ * This module also owns the one function that turns a core `Tool` handler
+ * outcome into an MCP `CallToolResult`, so the in-process Claude path
+ * (`createSdkMcpServer`) and the bridge return byte-identical content and the
+ * same `isError` status.
+ */
+import { timingSafeEqual } from "node:crypto";
+import { z } from "zod";
+export const BRIDGE_PROTOCOL_VERSION = 1;
+/** Frames longer than this are refused and the connection is dropped. */
+export const MAX_FRAME_BYTES = 8 * 1024 * 1024;
+/** Env var the shim reads the per-run token from (kept out of argv by default). */
+export const TOKEN_ENV = "SWENY_TOOL_BRIDGE_TOKEN";
+export function encodeFrame(frame) {
+    return JSON.stringify(frame) + "\n";
+}
+/**
+ * Split a byte stream into newline-delimited JSON frames. Calls `onFrame` with
+ * each parsed value (or `undefined` for a line that is not JSON) and
+ * `onOverflow` once when a single frame exceeds {@link MAX_FRAME_BYTES}.
+ */
+export function createFrameReader(onFrame, onOverflow, maxBytes = MAX_FRAME_BYTES) {
+    let buf = "";
+    let overflowed = false;
+    return (chunk) => {
+        if (overflowed)
+            return;
+        buf += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        let nl;
+        while ((nl = buf.indexOf("\n")) !== -1) {
+            const line = buf.slice(0, nl);
+            buf = buf.slice(nl + 1);
+            if (line.trim() === "")
+                continue;
+            let value;
+            try {
+                value = JSON.parse(line);
+            }
+            catch {
+                value = undefined;
+            }
+            onFrame(value);
+        }
+        if (Buffer.byteLength(buf, "utf8") > maxBytes) {
+            overflowed = true;
+            buf = "";
+            onOverflow();
+        }
+    };
+}
+/** Constant-time token comparison. False for any non-string or length mismatch. */
+export function tokenMatches(expected, given) {
+    if (typeof given !== "string")
+        return false;
+    const a = Buffer.from(expected, "utf8");
+    const b = Buffer.from(given, "utf8");
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+/** Structural check of an incoming request frame (token checked separately). */
+export function parseRequest(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const r = value;
+    if (r.v !== BRIDGE_PROTOCOL_VERSION)
+        return undefined;
+    if (typeof r.id !== "number" || !Number.isInteger(r.id))
+        return undefined;
+    if (r.method !== "tools/list" && r.method !== "tools/call")
+        return undefined;
+    if (r.params !== undefined && (typeof r.params !== "object" || r.params === null || Array.isArray(r.params))) {
+        return undefined;
+    }
+    return value;
+}
+// ─── Tool result shape (shared with the in-process Claude path) ─────
+/** A handler's return value as MCP content. Strings pass through; anything else is JSON. */
+export function toolOutputToMcpResult(output) {
+    return {
+        content: [{ type: "text", text: typeof output === "string" ? output : JSON.stringify(output) }],
+    };
+}
+/** A handler's thrown error as an MCP error result. */
+export function toolErrorToMcpResult(err) {
+    const message = err instanceof Error ? err.message : err?.message;
+    return {
+        content: [{ type: "text", text: `Error: ${message}` }],
+        isError: true,
+    };
+}
+/**
+ * Validate args against the tool's input schema (the same Zod shape the
+ * in-process SDK server validates with), run the handler, and return the MCP
+ * result. Invalid args come back as an error result, never reach the handler.
+ */
+export async function callToolAsMcp(tool, args, ctx) {
+    const parsed = z.object(jsonSchemaToZodShape(tool.input_schema)).safeParse(args ?? {});
+    if (!parsed.success) {
+        const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+        return {
+            content: [{ type: "text", text: `Input validation error: invalid arguments for tool ${tool.name}: ${detail}` }],
+            isError: true,
+        };
+    }
+    try {
+        return toolOutputToMcpResult(await tool.handler(parsed.data, ctx));
+    }
+    catch (err) {
+        return toolErrorToMcpResult(err);
+    }
+}
+// ─── JSON Schema → Zod conversion ───────────────────────────────
+/**
+ * Convert a JSON Schema object to a Zod raw shape. The in-process SDK server
+ * and the bridge both validate tool args with it, so both paths accept and
+ * reject the same inputs and preserve property names, types and descriptions.
+ */
+export function jsonSchemaToZodShape(schema) {
+    const props = schema?.properties ?? {};
+    const required = new Set(schema?.required ?? []);
+    const shape = {};
+    for (const [key, prop] of Object.entries(props)) {
+        let zodType = jsonPropertyToZod(prop);
+        if (!required.has(key)) {
+            zodType = zodType.optional();
+        }
+        shape[key] = zodType;
+    }
+    return shape;
+}
+function jsonPropertyToZod(prop) {
+    if (!prop || typeof prop !== "object")
+        return z.unknown();
+    const desc = typeof prop.description === "string" ? prop.description : undefined;
+    switch (prop.type) {
+        case "string": {
+            if (prop.enum && Array.isArray(prop.enum)) {
+                const e = z.enum(prop.enum);
+                return desc ? e.describe(desc) : e;
+            }
+            const s = z.string();
+            return desc ? s.describe(desc) : s;
+        }
+        case "number":
+        case "integer": {
+            const n = z.number();
+            return desc ? n.describe(desc) : n;
+        }
+        case "boolean": {
+            const b = z.boolean();
+            return desc ? b.describe(desc) : b;
+        }
+        case "array": {
+            const items = prop.items ? jsonPropertyToZod(prop.items) : z.unknown();
+            const a = z.array(items);
+            return desc ? a.describe(desc) : a;
+        }
+        case "object": {
+            if (prop.properties && typeof prop.properties === "object") {
+                const nested = jsonSchemaToZodShape(prop);
+                const o = z.object(nested);
+                return desc ? o.describe(desc) : o;
+            }
+            const r = z.record(z.string(), z.unknown());
+            return desc ? r.describe(desc) : r;
+        }
+        default: {
+            const u = z.unknown();
+            return desc ? u.describe(desc) : u;
+        }
+    }
+}

package/dist/harness/tool-bridge/server.d.ts

@@ -0,0 +1,57 @@
+/**
+ * SwenyToolBridge server (#414): the sweny side of the bridge.
+ *
+ * Holds a node's skill `Tool[]` in the sweny process and serves them over a
+ * per-run unix socket to the stdio MCP shim (`sweny tool-bridge`), so any
+ * harness that speaks stdio MCP gets skill tools while the handlers, and the
+ * executor's tool:call / tool:result observation, stay in sweny.
+ *
+ * Security properties (this is an injection boundary):
+ * - The socket lives in a fresh `mkdtemp` directory (mode 0700) and is itself
+ *   chmod 0600, so other users cannot connect.
+ * - A random 256-bit token is required on every frame. A wrong or missing
+ *   token gets an `unauthorized` error and the connection is dropped.
+ * - Only the tools passed in are listed or callable. The executor has already
+ *   applied the node's allow/deny filter and the dry-run read-only filter, so
+ *   the bridge can never widen what the node sees.
+ * - Tool results use the same MCP content and `isError` status as the
+ *   in-process path (`callToolAsMcp`).
+ * - `close()` removes the socket and its directory; a process `exit` hook
+ *   and SIGINT/SIGTERM handlers do the same if the run crashes first.
+ * - Nothing here logs the tool list, tool arguments or results.
+ */
+import type { Logger, McpServerConfig, Tool, ToolContext } from "../../types.js";
+export interface ToolBridgeOptions {
+    /** The node's skill tools, already allow/deny and read-only filtered by core. */
+    tools: Tool[];
+    /** Context passed to handlers (the executor's tracked handlers ignore it and inject their own). */
+    context: ToolContext;
+    logger?: Pick<Logger, "debug" | "warn">;
+    /**
+     * Command that starts the shim. Default: this node binary running the
+     * sweny CLI next to this module (`dist/cli/main.js tool-bridge`).
+     */
+    shimCommand?: {
+        command: string;
+        args: string[];
+    };
+    /** Parent directory for the private socket dir. Default: `os.tmpdir()`. */
+    tmpDir?: string;
+}
+export interface ToolBridge {
+    /** Absolute path of the unix socket. */
+    readonly socketPath: string;
+    /** Per-run token. Never log it. */
+    readonly token: string;
+    /** stdio MCP server config a harness uses to start the shim. The token rides in `env`, not argv. */
+    readonly mcpServer: McpServerConfig;
+    /** Stop serving, drop connections, remove the socket and its directory. Idempotent. */
+    close(): Promise<void>;
+}
+/** Default shim command: the sweny CLI that ships next to this module. */
+export declare function defaultShimCommand(): {
+    command: string;
+    args: string[];
+};
+/** Start a bridge for one node run. Call `close()` when the run ends. */
+export declare function startToolBridge(opts: ToolBridgeOptions): Promise<ToolBridge>;

package/dist/harness/tool-bridge/server.js

@@ -0,0 +1,189 @@
+/**
+ * SwenyToolBridge server (#414): the sweny side of the bridge.
+ *
+ * Holds a node's skill `Tool[]` in the sweny process and serves them over a
+ * per-run unix socket to the stdio MCP shim (`sweny tool-bridge`), so any
+ * harness that speaks stdio MCP gets skill tools while the handlers, and the
+ * executor's tool:call / tool:result observation, stay in sweny.
+ *
+ * Security properties (this is an injection boundary):
+ * - The socket lives in a fresh `mkdtemp` directory (mode 0700) and is itself
+ *   chmod 0600, so other users cannot connect.
+ * - A random 256-bit token is required on every frame. A wrong or missing
+ *   token gets an `unauthorized` error and the connection is dropped.
+ * - Only the tools passed in are listed or callable. The executor has already
+ *   applied the node's allow/deny filter and the dry-run read-only filter, so
+ *   the bridge can never widen what the node sees.
+ * - Tool results use the same MCP content and `isError` status as the
+ *   in-process path (`callToolAsMcp`).
+ * - `close()` removes the socket and its directory; a process `exit` hook
+ *   and SIGINT/SIGTERM handlers do the same if the run crashes first.
+ * - Nothing here logs the tool list, tool arguments or results.
+ */
+import * as fs from "node:fs";
+import * as net from "node:net";
+import * as os from "node:os";
+import * as path from "node:path";
+import { randomBytes } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { TOKEN_ENV, callToolAsMcp, createFrameReader, encodeFrame, parseRequest, tokenMatches, } from "./protocol.js";
+// ─── Crash cleanup ───────────────────────────────────────────────
+/** Directories of bridges that are still open, removed synchronously on exit or signal. */
+const liveDirs = new Set();
+let hooksInstalled = false;
+function removeDirSync(dir) {
+    try {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    catch {
+        // Best effort: the process is going down.
+    }
+}
+function cleanupAllSync() {
+    for (const dir of liveDirs)
+        removeDirSync(dir);
+    liveDirs.clear();
+}
+function onSignal(signal) {
+    cleanupAllSync();
+    // Keep default signal semantics: if nobody else handles it, re-raise so the
+    // process still dies with the signal.
+    process.removeListener("exit", cleanupAllSync);
+    process.removeListener("SIGINT", onSignal);
+    process.removeListener("SIGTERM", onSignal);
+    hooksInstalled = false;
+    if (process.listenerCount(signal) === 0)
+        process.kill(process.pid, signal);
+}
+function installCrashHooks() {
+    if (hooksInstalled)
+        return;
+    hooksInstalled = true;
+    // `exit` also fires after an uncaught exception, before the process ends.
+    process.on("exit", cleanupAllSync);
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
+}
+function uninstallCrashHooksIfIdle() {
+    if (!hooksInstalled || liveDirs.size > 0)
+        return;
+    hooksInstalled = false;
+    process.removeListener("exit", cleanupAllSync);
+    process.removeListener("SIGINT", onSignal);
+    process.removeListener("SIGTERM", onSignal);
+}
+// ─── Server ──────────────────────────────────────────────────────
+/** Default shim command: the sweny CLI that ships next to this module. */
+export function defaultShimCommand() {
+    const cli = fileURLToPath(new URL("../../cli/main.js", import.meta.url));
+    return { command: process.execPath, args: [cli, "tool-bridge"] };
+}
+function describeTool(t) {
+    return {
+        name: t.name,
+        description: t.description,
+        inputSchema: { type: "object", ...t.input_schema },
+    };
+}
+/** Start a bridge for one node run. Call `close()` when the run ends. */
+export async function startToolBridge(opts) {
+    const { tools, context, logger } = opts;
+    const byName = new Map(tools.map((t) => [t.name, t]));
+    const descriptors = tools.map(describeTool);
+    // mkdtemp creates the directory with mode 0700.
+    const dir = fs.mkdtempSync(path.join(opts.tmpDir ?? os.tmpdir(), "sweny-tb-"));
+    fs.chmodSync(dir, 0o700);
+    const socketPath = path.join(dir, "b.sock");
+    const token = randomBytes(32).toString("hex");
+    liveDirs.add(dir);
+    installCrashHooks();
+    const sockets = new Set();
+    const server = net.createServer((sock) => {
+        sockets.add(sock);
+        sock.on("close", () => sockets.delete(sock));
+        sock.on("error", () => sock.destroy());
+        // Set on the first bad token: later frames on this connection, even ones
+        // already buffered in the same chunk, are ignored.
+        let rejected = false;
+        const send = (res) => {
+            if (!sock.destroyed && sock.writable)
+                sock.write(encodeFrame(res));
+        };
+        const read = createFrameReader((value) => {
+            if (rejected)
+                return;
+            const req = parseRequest(value);
+            const id = req?.id ?? -1;
+            // Token first: an unauthenticated peer learns nothing else.
+            if (!tokenMatches(token, value?.token)) {
+                logger?.warn("tool bridge: rejected a request with a bad token");
+                send({ id, ok: false, error: { code: "unauthorized", message: "unauthorized" } });
+                rejected = true;
+                sock.end();
+                setTimeout(() => sock.destroy(), 1000).unref();
+                return;
+            }
+            if (!req) {
+                send({ id, ok: false, error: { code: "bad_request", message: "malformed request" } });
+                return;
+            }
+            if (req.method === "tools/list") {
+                send({ id, ok: true, result: { tools: descriptors } });
+                return;
+            }
+            const name = req.params?.name;
+            const tool = typeof name === "string" ? byName.get(name) : undefined;
+            if (!tool) {
+                send({ id, ok: false, error: { code: "unknown_tool", message: `unknown tool: ${String(name)}` } });
+                return;
+            }
+            callToolAsMcp(tool, req.params?.arguments, context).then((result) => send({ id, ok: true, result }), () => send({ id, ok: false, error: { code: "internal", message: "tool call failed" } }));
+        }, () => {
+            send({ id: -1, ok: false, error: { code: "bad_request", message: "frame too large" } });
+            sock.destroy();
+        });
+        sock.on("data", read);
+    });
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(socketPath, () => {
+                server.removeListener("error", reject);
+                resolve();
+            });
+        });
+        fs.chmodSync(socketPath, 0o600);
+    }
+    catch (err) {
+        server.close();
+        liveDirs.delete(dir);
+        removeDirSync(dir);
+        uninstallCrashHooksIfIdle();
+        throw err;
+    }
+    logger?.debug("tool bridge: listening");
+    const shim = opts.shimCommand ?? defaultShimCommand();
+    let closed = false;
+    return {
+        socketPath,
+        token,
+        mcpServer: {
+            type: "stdio",
+            command: shim.command,
+            args: [...shim.args, "--socket", socketPath],
+            // No update-check nudge in the shim: its stdio belongs to MCP.
+            env: { [TOKEN_ENV]: token, SWENY_NO_UPDATE_CHECK: "1" },
+        },
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            for (const s of sockets)
+                s.destroy();
+            await new Promise((resolve) => server.close(() => resolve()));
+            liveDirs.delete(dir);
+            removeDirSync(dir);
+            uninstallCrashHooksIfIdle();
+        },
+    };
+}

package/dist/harness/tool-bridge/shim.d.ts

@@ -0,0 +1,38 @@
+/**
+ * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`.
+ *
+ * A stdio MCP server a harness starts as a child process. It holds no tools
+ * of its own: `tools/list` and `tools/call` are forwarded over the per-run
+ * unix socket to the sweny process (server.ts), which runs the real handlers.
+ *
+ * stdout carries MCP only; diagnostics go to stderr. The token comes from
+ * `--token` or, by default, the `SWENY_TOOL_BRIDGE_TOKEN` env var the server
+ * puts in the MCP server config, so it never shows up in `ps` output.
+ */
+import { type BridgeMethod, type BridgeResponse } from "./protocol.js";
+/** Socket client that multiplexes requests by id over one connection. */
+export declare class BridgeClient {
+    private readonly socketPath;
+    private readonly token;
+    private sock;
+    private connecting;
+    private nextId;
+    private pending;
+    private closedError;
+    constructor(socketPath: string, token: string);
+    private connect;
+    private failAll;
+    request(method: BridgeMethod, params?: {
+        name: string;
+        arguments?: Record<string, unknown>;
+    }): Promise<BridgeResponse>;
+    close(): void;
+}
+export interface ShimOptions {
+    socket: string;
+    /** Falls back to `SWENY_TOOL_BRIDGE_TOKEN`. */
+    token?: string;
+    version?: string;
+}
+/** Run the stdio MCP shim until stdin closes or the bridge goes away. */
+export declare function runToolBridgeShim(opts: ShimOptions): Promise<void>;

package/dist/harness/tool-bridge/shim.js

@@ -0,0 +1,125 @@
+/**
+ * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`.
+ *
+ * A stdio MCP server a harness starts as a child process. It holds no tools
+ * of its own: `tools/list` and `tools/call` are forwarded over the per-run
+ * unix socket to the sweny process (server.ts), which runs the real handlers.
+ *
+ * stdout carries MCP only; diagnostics go to stderr. The token comes from
+ * `--token` or, by default, the `SWENY_TOOL_BRIDGE_TOKEN` env var the server
+ * puts in the MCP server config, so it never shows up in `ps` output.
+ */
+import * as net from "node:net";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { BRIDGE_PROTOCOL_VERSION, TOKEN_ENV, createFrameReader, encodeFrame, } from "./protocol.js";
+/** Socket client that multiplexes requests by id over one connection. */
+export class BridgeClient {
+    socketPath;
+    token;
+    sock;
+    connecting;
+    nextId = 1;
+    pending = new Map();
+    closedError;
+    constructor(socketPath, token) {
+        this.socketPath = socketPath;
+        this.token = token;
+    }
+    connect() {
+        // Once the connection is gone (bad token, server closed) every later call fails fast.
+        if (this.closedError)
+            return Promise.reject(this.closedError);
+        if (this.sock)
+            return Promise.resolve(this.sock);
+        this.connecting ??= new Promise((resolve, reject) => {
+            const sock = net.createConnection(this.socketPath);
+            const read = createFrameReader((value) => {
+                const res = value;
+                if (!res || typeof res.id !== "number")
+                    return;
+                const waiter = this.pending.get(res.id);
+                if (waiter) {
+                    this.pending.delete(res.id);
+                    waiter.resolve(res);
+                }
+                else if (res.ok === false) {
+                    // Unsolicited error (for example a frame-size rejection): fail everything.
+                    this.failAll(new Error(`tool bridge: ${res.error.message}`));
+                }
+            }, () => this.failAll(new Error("tool bridge: response frame too large")));
+            sock.on("data", read);
+            sock.once("connect", () => {
+                this.sock = sock;
+                resolve(sock);
+            });
+            sock.once("error", (err) => {
+                reject(err);
+                this.failAll(err);
+            });
+            sock.once("close", () => this.failAll(new Error("tool bridge: connection closed")));
+        });
+        return this.connecting;
+    }
+    failAll(err) {
+        this.closedError ??= err;
+        for (const w of this.pending.values())
+            w.reject(err);
+        this.pending.clear();
+        this.sock?.destroy();
+        this.sock = undefined;
+    }
+    async request(method, params) {
+        const sock = await this.connect();
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            if (this.closedError || sock.destroyed) {
+                reject(this.closedError ?? new Error("tool bridge: connection closed"));
+                return;
+            }
+            this.pending.set(id, { resolve, reject });
+            sock.write(encodeFrame({ v: BRIDGE_PROTOCOL_VERSION, id, token: this.token, method, params }));
+        });
+    }
+    close() {
+        this.sock?.destroy();
+    }
+}
+/** Run the stdio MCP shim until stdin closes or the bridge goes away. */
+export async function runToolBridgeShim(opts) {
+    const token = opts.token ?? process.env[TOKEN_ENV];
+    if (!opts.socket || !token) {
+        process.stderr.write(`sweny tool-bridge: --socket and a token (--token or ${TOKEN_ENV}) are required\n`);
+        process.exit(2);
+    }
+    // Keep the token out of anything the shim might spawn or report.
+    delete process.env[TOKEN_ENV];
+    const client = new BridgeClient(opts.socket, token);
+    const server = new Server({ name: "sweny-core", version: opts.version ?? "0.0.0" }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async () => {
+        const res = await client.request("tools/list");
+        if (!res.ok)
+            throw new Error(`tool bridge: ${res.error.message}`);
+        return { tools: res.result.tools };
+    });
+    server.setRequestHandler(CallToolRequestSchema, async (req) => {
+        const res = await client.request("tools/call", {
+            name: req.params.name,
+            arguments: req.params.arguments,
+        });
+        if (!res.ok) {
+            // Unknown tool and friends surface as a tool error result, the same way
+            // the in-process SDK server reports a call it cannot serve.
+            return { content: [{ type: "text", text: `Error: ${res.error.message}` }], isError: true };
+        }
+        return res.result;
+    });
+    const shutdown = () => {
+        client.close();
+        void server.close().finally(() => process.exit(0));
+    };
+    process.stdin.once("end", shutdown);
+    process.stdin.once("close", shutdown);
+    await server.connect(new StdioServerTransport());
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.136",
+  "version": "0.1.137",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"
@@ -59,6 +59,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.220",
     "@clack/prompts": "^1.7.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "chalk": "^5",
     "commander": "^13",
     "yaml": "^2.9.0",