@sweny-ai/core 0.1.136 → 0.1.138

package/dist/cli/templates.d.ts

@@ -4,10 +4,23 @@
  * Each template is a valid SWEny workflow YAML. Templates are self-contained
  * strings — no filesystem reads needed, works from npm install.
  */
+/** Extra metadata for a recurring pack (#338): how to schedule it and what it produces. */
+export interface WorkflowPack {
+    /** A GitHub Actions workflow file to paste into .github/workflows/. */
+    trigger: string;
+    /** Sample of what the pack posts (issue body, comment, or message). */
+    sample: string;
+    /** Expected tokens per run. An estimate; the run receipt shows the real number. */
+    tokens: string;
+    /** Write tools the pack may call, by node id. Every other node is read-only. */
+    writes: Record<string, string[]>;
+}
 export interface WorkflowTemplate {
     id: string;
     name: string;
     description: string;
     yaml: string;
+    /** Present on the recurring packs only. */
+    pack?: WorkflowPack;
 }
 export declare const WORKFLOW_TEMPLATES: WorkflowTemplate[];

package/dist/cli/templates.js

@@ -4,6 +4,7 @@
  * Each template is a valid SWEny workflow YAML. Templates are self-contained
  * strings — no filesystem reads needed, works from npm install.
  */
+import { PACK_TEMPLATES } from "./packs.js";
 export const WORKFLOW_TEMPLATES = [
     {
         id: "explain-repo",
@@ -37,6 +38,9 @@ edges:
     to: explain
 `,
     },
+    // Recurring packs (#338): run weekly or on every PR. Kept right after the
+    // zero-credential starter so they are the next thing sweny new offers.
+    ...PACK_TEMPLATES,
     {
         id: "pr-review",
         name: "PR Review Bot",

package/dist/harness/claude-code.d.ts

@@ -8,7 +8,7 @@
  * This is the ONLY supported LLM backend. The whole point of sweny
  * is to use headless Claude Code - never the raw Anthropic API.
  */
-import type { Claude, ToolContext, Logger, McpServerConfig } from "../types.js";
+import type { Claude, Tool, ToolContext, Logger, McpServerConfig } from "../types.js";
 import { type SandboxMode } from "../agent-env.js";
 import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult } from "./types.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
@@ -107,6 +107,18 @@ export interface ClaudeCodeHarnessOptions {
     sandboxAllowedDomains?: string[];
     /** Sandbox preflight probe (test seam). Returns a reason when the sandbox cannot run. */
     sandboxProbe?: () => string | undefined;
+    /**
+     * Serve skill tools through the SwenyToolBridge (a stdio MCP shim over a
+     * per-run unix socket, #414) instead of the in-process SDK MCP server.
+     * Same tools, same results; used to run the harness contract suite both
+     * ways. Default: off, unless `SWENY_TOOL_BRIDGE=1`.
+     */
+    toolBridge?: boolean;
+    /** Shim command override for the bridge (test seam). Default: this package's `sweny tool-bridge`. */
+    toolBridgeShim?: {
+        command: string;
+        args: string[];
+    };
 }
 /**
  * Wire an optional timeout + caller signal onto a single AbortController.
@@ -139,6 +151,8 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     private sandboxProbe;
     private sandboxWarned;
     private envScope;
+    private toolBridge;
+    private toolBridgeShim;
     constructor(opts?: ClaudeCodeHarnessOptions);
     /**
      * Build env for the Claude Code subprocess (#360). Applies auth precedence
@@ -201,6 +215,18 @@ export type ClaudeClientOptions = ClaudeCodeHarnessOptions;
 export declare const ClaudeClient: typeof ClaudeCodeHarness;
 /** @deprecated Use {@link ClaudeCodeHarness}. */
 export type ClaudeClient = ClaudeCodeHarness;
+/**
+ * Convert a core Tool to an SDK MCP tool definition.
+ *
+ * The wrapper runs the user's handler and returns the MCP `CallToolResult`.
+ * Output bookkeeping happens on the stream side (see the tool_result
+ * handler in `run()`), keyed by `tool_use_id` - never from inside the
+ * wrapper. Keeping the wrapper stateless means parallel calls to the same
+ * tool cannot mis-pair outputs.
+ *
+ * @internal Exported for the tool bridge parity test (#414).
+ */
+export declare function coreToolToSdkTool(coreTool: Tool, defaultCtx: ToolContext): import("@anthropic-ai/claude-agent-sdk").SdkMcpToolDefinition<Record<string, import("zod").ZodType<any, import("zod").ZodTypeDef, any>>>;
 /**
  * Best-effort recovery of typed output from a tool_result's `content`.
  *

package/dist/harness/claude-code.js

@@ -10,13 +10,14 @@
  */
 import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude-agent-sdk";
 import { createRequire } from "node:module";
-import { z } from "zod";
 import { consoleLogger } from "../types.js";
 import { reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, resolveAgentSandbox, } from "../agent-env.js";
 import { fenceUntrustedJson } from "../untrusted.js";
 import { policyGate } from "./policy.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
 import { ask as coreAsk, evaluate as coreEvaluate, buildEvaluatePrompt } from "./prompts.js";
+import { jsonSchemaToZodShape, toolErrorToMcpResult, toolOutputToMcpResult } from "./tool-bridge/protocol.js";
+import { startToolBridge } from "./tool-bridge/server.js";
 export { buildEvaluatePrompt, CLAUDE_CODE_CAPABILITIES };
 let cachedSdkVersion;
 /** Version of the Claude Agent SDK this adapter drives; "unknown" when it cannot be read. */
@@ -241,6 +242,8 @@ export class ClaudeCodeHarness {
     sandboxProbe;
     sandboxWarned = false;
     envScope;
+    toolBridge;
+    toolBridgeShim;
     constructor(opts = {}) {
         this.model = opts.model;
         this.maxTurns = opts.maxTurns ?? 20;
@@ -254,6 +257,8 @@ export class ClaudeCodeHarness {
         this.sandboxMode = opts.sandbox;
         this.sandboxAllowedDomains = opts.sandboxAllowedDomains;
         this.sandboxProbe = opts.sandboxProbe;
+        this.toolBridge = opts.toolBridge ?? process.env.SWENY_TOOL_BRIDGE === "1";
+        this.toolBridgeShim = opts.toolBridgeShim;
     }
     /**
      * Build env for the Claude Code subprocess (#360). Applies auth precedence
@@ -352,12 +357,18 @@ export class ClaudeCodeHarness {
         // handler and returns `content` via the MCP transport. We do not push
         // to toolCalls from the wrapper - the stream's tool_result is the sole
         // signal of completion, which keeps pairing correct under parallelism.
-        const sdkTools = tools.map((t) => coreToolToSdkTool(t, this.defaultContext));
+        // #414: with the bridge on, the same tools reach Claude Code through the
+        // `sweny tool-bridge` stdio shim instead, so no in-process server is built.
+        const useBridge = this.toolBridge && tools.length > 0;
+        const sdkTools = useBridge ? [] : tools.map((t) => coreToolToSdkTool(t, this.defaultContext));
         // Create in-process MCP server
-        const mcpServer = createSdkMcpServer({
-            name: "sweny-core",
-            tools: sdkTools,
-        });
+        const mcpServer = useBridge
+            ? undefined
+            : createSdkMcpServer({
+                name: "sweny-core",
+                tools: sdkTools,
+            });
+        let bridge;
         // Build prompt. Context (workflow input such as issues/alerts, plus prior
         // node outputs) is fenced as untrusted data (#360).
         const prompt = [
@@ -394,8 +405,21 @@ export class ClaudeCodeHarness {
             const allMcpServers = readOnly
                 ? {}
                 : { ...this.defaultMcpServers, ...opts.mcpServers, ...this.mcpServers };
-            if (sdkTools.length > 0)
+            if (useBridge) {
+                // Only `tools` (already allow/deny and dry-run filtered by the
+                // executor) are exposed. Under readOnly it is still the only MCP
+                // server, and strictMcpConfig below keeps it that way.
+                bridge = await startToolBridge({
+                    tools,
+                    context: this.defaultContext,
+                    logger: this.logger,
+                    ...(this.toolBridgeShim ? { shimCommand: this.toolBridgeShim } : {}),
+                });
+                allMcpServers["sweny-core"] = bridge.mcpServer;
+            }
+            else if (sdkTools.length > 0) {
                 allMcpServers["sweny-core"] = mcpServer;
+            }
             stream = query({
                 prompt,
                 options: {
@@ -567,6 +591,8 @@ export class ClaudeCodeHarness {
             // it cannot fire after we are done.
             abort?.clear();
             await interruptStream(stream);
+            // #414: the socket and its directory go away with the run.
+            await bridge?.close();
         }
         if (!sawResult) {
             const msg = "agent stream ended without a result message";
@@ -703,8 +729,10 @@ export const ClaudeClient = ClaudeCodeHarness;
  * handler in `run()`), keyed by `tool_use_id` - never from inside the
  * wrapper. Keeping the wrapper stateless means parallel calls to the same
  * tool cannot mis-pair outputs.
+ *
+ * @internal Exported for the tool bridge parity test (#414).
  */
-function coreToolToSdkTool(coreTool, defaultCtx) {
+export function coreToolToSdkTool(coreTool, defaultCtx) {
     const zodShape = jsonSchemaToZodShape(coreTool.input_schema);
     return sdkTool(coreTool.name, coreTool.description, zodShape, async (args) => {
         try {
@@ -712,16 +740,12 @@ function coreToolToSdkTool(coreTool, defaultCtx) {
             // When used standalone, defaultCtx is the fallback.
             const output = await coreTool.handler(args, defaultCtx);
             // JSON-stringify structured output so the tool_result handler can
-            // recover it via parseToolResultContent. Strings pass through.
-            return {
-                content: [{ type: "text", text: typeof output === "string" ? output : JSON.stringify(output) }],
-            };
+            // recover it via parseToolResultContent. Strings pass through. Shared
+            // with the tool bridge so both paths return the same content.
+            return toolOutputToMcpResult(output);
         }
         catch (err) {
-            return {
-                content: [{ type: "text", text: `Error: ${err.message}` }],
-                isError: true,
-            };
+            return toolErrorToMcpResult(err);
         }
     });
 }
@@ -831,67 +855,6 @@ export function summarizeToolError(parsed) {
     const collapsed = raw.replace(/\s+/g, " ").trim();
     return collapsed.length > 300 ? collapsed.slice(0, 297) + "..." : collapsed;
 }
-// ─── JSON Schema → Zod conversion ───────────────────────────────
-/**
- * Convert a JSON Schema object to a Zod raw shape for the agent SDK.
- * Preserves property names, types, and descriptions so Claude sees
- * accurate tool parameters through the MCP protocol.
- */
-function jsonSchemaToZodShape(schema) {
-    const props = schema?.properties ?? {};
-    const required = new Set(schema?.required ?? []);
-    const shape = {};
-    for (const [key, prop] of Object.entries(props)) {
-        let zodType = jsonPropertyToZod(prop);
-        if (!required.has(key)) {
-            zodType = zodType.optional();
-        }
-        shape[key] = zodType;
-    }
-    return shape;
-}
-function jsonPropertyToZod(prop) {
-    if (!prop || typeof prop !== "object")
-        return z.unknown();
-    const desc = typeof prop.description === "string" ? prop.description : undefined;
-    switch (prop.type) {
-        case "string": {
-            if (prop.enum && Array.isArray(prop.enum)) {
-                const e = z.enum(prop.enum);
-                return desc ? e.describe(desc) : e;
-            }
-            const s = z.string();
-            return desc ? s.describe(desc) : s;
-        }
-        case "number":
-        case "integer": {
-            const n = z.number();
-            return desc ? n.describe(desc) : n;
-        }
-        case "boolean": {
-            const b = z.boolean();
-            return desc ? b.describe(desc) : b;
-        }
-        case "array": {
-            const items = prop.items ? jsonPropertyToZod(prop.items) : z.unknown();
-            const a = z.array(items);
-            return desc ? a.describe(desc) : a;
-        }
-        case "object": {
-            if (prop.properties && typeof prop.properties === "object") {
-                const nested = jsonSchemaToZodShape(prop);
-                const o = z.object(nested);
-                return desc ? o.describe(desc) : o;
-            }
-            const r = z.record(z.string(), z.unknown());
-            return desc ? r.describe(desc) : r;
-        }
-        default: {
-            const u = z.unknown();
-            return desc ? u.describe(desc) : u;
-        }
-    }
-}
 /** Strip MCP server prefix: "mcp__server__tool" → "tool" */
 function stripMcpPrefix(name) {
     const parts = name.split("__");

package/dist/harness/index.d.ts

@@ -9,6 +9,8 @@ export { policyGate } from "./policy.js";
 export { ask, evaluate, buildAskPrompt, buildEvaluatePrompt } from "./prompts.js";
 export { ClaudeCodeHarness, CLAUDE_CODE_CAPABILITIES } from "./claude-code.js";
 export type { ClaudeCodeHarnessOptions } from "./claude-code.js";
+export { startToolBridge } from "./tool-bridge/server.js";
+export type { ToolBridge, ToolBridgeOptions } from "./tool-bridge/server.js";
 /**
  * Build the harness for an agent id. `claude` is the historical `--agent` /
  * `coding-agent-provider` value and means the same as `claude-code`.

package/dist/harness/index.js

@@ -7,6 +7,7 @@ export { claudeCompat, asClaude } from "./compat.js";
 export { policyGate } from "./policy.js";
 export { ask, evaluate, buildAskPrompt, buildEvaluatePrompt } from "./prompts.js";
 export { ClaudeCodeHarness, CLAUDE_CODE_CAPABILITIES } from "./claude-code.js";
+export { startToolBridge } from "./tool-bridge/server.js";
 /**
  * Build the harness for an agent id. `claude` is the historical `--agent` /
  * `coding-agent-provider` value and means the same as `claude-code`.

package/dist/harness/tool-bridge/protocol.d.ts

@@ -0,0 +1,91 @@
+/**
+ * SwenyToolBridge wire protocol (#414).
+ *
+ * The bridge moves skill tool calls from a harness's stdio MCP client to the
+ * sweny process that owns the tool handlers:
+ *
+ *   harness --stdio MCP--> shim (`sweny tool-bridge`) --unix socket--> server (sweny run)
+ *
+ * The socket carries newline-delimited JSON frames. Every request carries the
+ * per-run token; the server rejects a frame with a wrong or missing token and
+ * drops the connection.
+ *
+ * This module also owns the one function that turns a core `Tool` handler
+ * outcome into an MCP `CallToolResult`, so the in-process Claude path
+ * (`createSdkMcpServer`) and the bridge return byte-identical content and the
+ * same `isError` status.
+ */
+import { z } from "zod";
+import type { JSONSchema, Tool, ToolContext } from "../../types.js";
+export declare const BRIDGE_PROTOCOL_VERSION = 1;
+/** Frames longer than this are refused and the connection is dropped. */
+export declare const MAX_FRAME_BYTES: number;
+/** Env var the shim reads the per-run token from (kept out of argv by default). */
+export declare const TOKEN_ENV = "SWENY_TOOL_BRIDGE_TOKEN";
+export type BridgeMethod = "tools/list" | "tools/call";
+export interface BridgeRequest {
+    v: typeof BRIDGE_PROTOCOL_VERSION;
+    id: number;
+    token: string;
+    method: BridgeMethod;
+    params?: {
+        name?: string;
+        arguments?: Record<string, unknown>;
+    };
+}
+export interface BridgeToolDescriptor {
+    name: string;
+    description: string;
+    inputSchema: JSONSchema;
+}
+export type McpTextContent = {
+    type: "text";
+    text: string;
+};
+/** The MCP `CallToolResult` subset sweny produces for skill tools. */
+export type McpCallToolResult = {
+    content: McpTextContent[];
+    isError?: true;
+};
+export type BridgeResponse = {
+    id: number;
+    ok: true;
+    result: {
+        tools: BridgeToolDescriptor[];
+    } | McpCallToolResult;
+} | {
+    id: number;
+    ok: false;
+    error: {
+        code: BridgeErrorCode;
+        message: string;
+    };
+};
+export type BridgeErrorCode = "unauthorized" | "bad_request" | "unknown_tool" | "internal";
+export declare function encodeFrame(frame: BridgeRequest | BridgeResponse): string;
+/**
+ * Split a byte stream into newline-delimited JSON frames. Calls `onFrame` with
+ * each parsed value (or `undefined` for a line that is not JSON) and
+ * `onOverflow` once when a single frame exceeds {@link MAX_FRAME_BYTES}.
+ */
+export declare function createFrameReader(onFrame: (value: unknown) => void, onOverflow: () => void, maxBytes?: number): (chunk: Buffer | string) => void;
+/** Constant-time token comparison. False for any non-string or length mismatch. */
+export declare function tokenMatches(expected: string, given: unknown): boolean;
+/** Structural check of an incoming request frame (token checked separately). */
+export declare function parseRequest(value: unknown): BridgeRequest | undefined;
+/** A handler's return value as MCP content. Strings pass through; anything else is JSON. */
+export declare function toolOutputToMcpResult(output: unknown): McpCallToolResult;
+/** A handler's thrown error as an MCP error result. */
+export declare function toolErrorToMcpResult(err: unknown): McpCallToolResult;
+/**
+ * Validate args against the tool's input schema (the same Zod shape the
+ * in-process SDK server validates with), run the handler, and return the MCP
+ * result. Invalid args come back as an error result, never reach the handler.
+ */
+export declare function callToolAsMcp(tool: Tool, args: unknown, ctx: ToolContext): Promise<McpCallToolResult>;
+/**
+ * Convert a JSON Schema object to a Zod raw shape. The in-process SDK server
+ * and the bridge both validate tool args with it, so both paths accept and
+ * reject the same inputs and preserve property names, types and descriptions.
+ */
+export declare function jsonSchemaToZodShape(schema: JSONSchema): Record<string, z.ZodType>;

package/dist/harness/tool-bridge/protocol.js

@@ -0,0 +1,184 @@
+/**
+ * SwenyToolBridge wire protocol (#414).
+ *
+ * The bridge moves skill tool calls from a harness's stdio MCP client to the
+ * sweny process that owns the tool handlers:
+ *
+ *   harness --stdio MCP--> shim (`sweny tool-bridge`) --unix socket--> server (sweny run)
+ *
+ * The socket carries newline-delimited JSON frames. Every request carries the
+ * per-run token; the server rejects a frame with a wrong or missing token and
+ * drops the connection.
+ *
+ * This module also owns the one function that turns a core `Tool` handler
+ * outcome into an MCP `CallToolResult`, so the in-process Claude path
+ * (`createSdkMcpServer`) and the bridge return byte-identical content and the
+ * same `isError` status.
+ */
+import { timingSafeEqual } from "node:crypto";
+import { z } from "zod";
+export const BRIDGE_PROTOCOL_VERSION = 1;
+/** Frames longer than this are refused and the connection is dropped. */
+export const MAX_FRAME_BYTES = 8 * 1024 * 1024;
+/** Env var the shim reads the per-run token from (kept out of argv by default). */
+export const TOKEN_ENV = "SWENY_TOOL_BRIDGE_TOKEN";
+export function encodeFrame(frame) {
+    return JSON.stringify(frame) + "\n";
+}
+/**
+ * Split a byte stream into newline-delimited JSON frames. Calls `onFrame` with
+ * each parsed value (or `undefined` for a line that is not JSON) and
+ * `onOverflow` once when a single frame exceeds {@link MAX_FRAME_BYTES}.
+ */
+export function createFrameReader(onFrame, onOverflow, maxBytes = MAX_FRAME_BYTES) {
+    let buf = "";
+    let overflowed = false;
+    return (chunk) => {
+        if (overflowed)
+            return;
+        buf += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        let nl;
+        while ((nl = buf.indexOf("\n")) !== -1) {
+            const line = buf.slice(0, nl);
+            buf = buf.slice(nl + 1);
+            if (line.trim() === "")
+                continue;
+            let value;
+            try {
+                value = JSON.parse(line);
+            }
+            catch {
+                value = undefined;
+            }
+            onFrame(value);
+        }
+        if (Buffer.byteLength(buf, "utf8") > maxBytes) {
+            overflowed = true;
+            buf = "";
+            onOverflow();
+        }
+    };
+}
+/** Constant-time token comparison. False for any non-string or length mismatch. */
+export function tokenMatches(expected, given) {
+    if (typeof given !== "string")
+        return false;
+    const a = Buffer.from(expected, "utf8");
+    const b = Buffer.from(given, "utf8");
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+/** Structural check of an incoming request frame (token checked separately). */
+export function parseRequest(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const r = value;
+    if (r.v !== BRIDGE_PROTOCOL_VERSION)
+        return undefined;
+    if (typeof r.id !== "number" || !Number.isInteger(r.id))
+        return undefined;
+    if (r.method !== "tools/list" && r.method !== "tools/call")
+        return undefined;
+    if (r.params !== undefined && (typeof r.params !== "object" || r.params === null || Array.isArray(r.params))) {
+        return undefined;
+    }
+    return value;
+}
+// ─── Tool result shape (shared with the in-process Claude path) ─────
+/** A handler's return value as MCP content. Strings pass through; anything else is JSON. */
+export function toolOutputToMcpResult(output) {
+    return {
+        content: [{ type: "text", text: typeof output === "string" ? output : JSON.stringify(output) }],
+    };
+}
+/** A handler's thrown error as an MCP error result. */
+export function toolErrorToMcpResult(err) {
+    const message = err instanceof Error ? err.message : err?.message;
+    return {
+        content: [{ type: "text", text: `Error: ${message}` }],
+        isError: true,
+    };
+}
+/**
+ * Validate args against the tool's input schema (the same Zod shape the
+ * in-process SDK server validates with), run the handler, and return the MCP
+ * result. Invalid args come back as an error result, never reach the handler.
+ */
+export async function callToolAsMcp(tool, args, ctx) {
+    const parsed = z.object(jsonSchemaToZodShape(tool.input_schema)).safeParse(args ?? {});
+    if (!parsed.success) {
+        const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+        return {
+            content: [{ type: "text", text: `Input validation error: invalid arguments for tool ${tool.name}: ${detail}` }],
+            isError: true,
+        };
+    }
+    try {
+        return toolOutputToMcpResult(await tool.handler(parsed.data, ctx));
+    }
+    catch (err) {
+        return toolErrorToMcpResult(err);
+    }
+}
+// ─── JSON Schema → Zod conversion ───────────────────────────────
+/**
+ * Convert a JSON Schema object to a Zod raw shape. The in-process SDK server
+ * and the bridge both validate tool args with it, so both paths accept and
+ * reject the same inputs and preserve property names, types and descriptions.
+ */
+export function jsonSchemaToZodShape(schema) {
+    const props = schema?.properties ?? {};
+    const required = new Set(schema?.required ?? []);
+    const shape = {};
+    for (const [key, prop] of Object.entries(props)) {
+        let zodType = jsonPropertyToZod(prop);
+        if (!required.has(key)) {
+            zodType = zodType.optional();
+        }
+        shape[key] = zodType;
+    }
+    return shape;
+}
+function jsonPropertyToZod(prop) {
+    if (!prop || typeof prop !== "object")
+        return z.unknown();
+    const desc = typeof prop.description === "string" ? prop.description : undefined;
+    switch (prop.type) {
+        case "string": {
+            if (prop.enum && Array.isArray(prop.enum)) {
+                const e = z.enum(prop.enum);
+                return desc ? e.describe(desc) : e;
+            }
+            const s = z.string();
+            return desc ? s.describe(desc) : s;
+        }
+        case "number":
+        case "integer": {
+            const n = z.number();
+            return desc ? n.describe(desc) : n;
+        }
+        case "boolean": {
+            const b = z.boolean();
+            return desc ? b.describe(desc) : b;
+        }
+        case "array": {
+            const items = prop.items ? jsonPropertyToZod(prop.items) : z.unknown();
+            const a = z.array(items);
+            return desc ? a.describe(desc) : a;
+        }
+        case "object": {
+            if (prop.properties && typeof prop.properties === "object") {
+                const nested = jsonSchemaToZodShape(prop);
+                const o = z.object(nested);
+                return desc ? o.describe(desc) : o;
+            }
+            const r = z.record(z.string(), z.unknown());
+            return desc ? r.describe(desc) : r;
+        }
+        default: {
+            const u = z.unknown();
+            return desc ? u.describe(desc) : u;
+        }
+    }
+}

package/dist/harness/tool-bridge/server.d.ts

@@ -0,0 +1,57 @@
+/**
+ * SwenyToolBridge server (#414): the sweny side of the bridge.
+ *
+ * Holds a node's skill `Tool[]` in the sweny process and serves them over a
+ * per-run unix socket to the stdio MCP shim (`sweny tool-bridge`), so any
+ * harness that speaks stdio MCP gets skill tools while the handlers, and the
+ * executor's tool:call / tool:result observation, stay in sweny.
+ *
+ * Security properties (this is an injection boundary):
+ * - The socket lives in a fresh `mkdtemp` directory (mode 0700) and is itself
+ *   chmod 0600, so other users cannot connect.
+ * - A random 256-bit token is required on every frame. A wrong or missing
+ *   token gets an `unauthorized` error and the connection is dropped.
+ * - Only the tools passed in are listed or callable. The executor has already
+ *   applied the node's allow/deny filter and the dry-run read-only filter, so
+ *   the bridge can never widen what the node sees.
+ * - Tool results use the same MCP content and `isError` status as the
+ *   in-process path (`callToolAsMcp`).
+ * - `close()` removes the socket and its directory; a process `exit` hook
+ *   and SIGINT/SIGTERM handlers do the same if the run crashes first.
+ * - Nothing here logs the tool list, tool arguments or results.
+ */
+import type { Logger, McpServerConfig, Tool, ToolContext } from "../../types.js";
+export interface ToolBridgeOptions {
+    /** The node's skill tools, already allow/deny and read-only filtered by core. */
+    tools: Tool[];
+    /** Context passed to handlers (the executor's tracked handlers ignore it and inject their own). */
+    context: ToolContext;
+    logger?: Pick<Logger, "debug" | "warn">;
+    /**
+     * Command that starts the shim. Default: this node binary running the
+     * sweny CLI next to this module (`dist/cli/main.js tool-bridge`).
+     */
+    shimCommand?: {
+        command: string;
+        args: string[];
+    };
+    /** Parent directory for the private socket dir. Default: `os.tmpdir()`. */
+    tmpDir?: string;
+}
+export interface ToolBridge {
+    /** Absolute path of the unix socket. */
+    readonly socketPath: string;
+    /** Per-run token. Never log it. */
+    readonly token: string;
+    /** stdio MCP server config a harness uses to start the shim. The token rides in `env`, not argv. */
+    readonly mcpServer: McpServerConfig;
+    /** Stop serving, drop connections, remove the socket and its directory. Idempotent. */
+    close(): Promise<void>;
+}
+/** Default shim command: the sweny CLI that ships next to this module. */
+export declare function defaultShimCommand(): {
+    command: string;
+    args: string[];
+};
+/** Start a bridge for one node run. Call `close()` when the run ends. */
+export declare function startToolBridge(opts: ToolBridgeOptions): Promise<ToolBridge>;