@sweny-ai/core 0.1.141 → 0.1.143

package/dist/agent-env.d.ts

@@ -42,9 +42,33 @@ export declare const AGENT_ENV_PREFIXES: readonly string[];
 export declare const AGENT_AUTH_VARS: readonly string[];
 /** Split a comma/whitespace separated list, dropping empties. */
 export declare function parseList(v: string | undefined): string[];
+/**
+ * Codex's own credentials and home (openai/codex rust-v0.159.2,
+ * login/src/auth/manager.rs): `codex exec` authenticates with `CODEX_API_KEY`
+ * (it does not read `OPENAI_API_KEY` for this; see {@link resolveCodexAuthEnv})
+ * or `CODEX_ACCESS_TOKEN`, else the login stored in `$CODEX_HOME/auth.json`.
+ */
+export declare const CODEX_AUTH_VARS: readonly string[];
+/** Prefixes for a Codex run: locale only. `ANTHROPIC_*` / `CLAUDE_*` never reach Codex. */
+export declare const CODEX_ENV_PREFIXES: readonly string[];
+/**
+ * `codex exec` reads `CODEX_API_KEY`, not `OPENAI_API_KEY`. Copy the OpenAI
+ * key into `CODEX_API_KEY` when only the former is set, so either works.
+ * Pure: returns a copy.
+ */
+export declare function resolveCodexAuthEnv(env: Record<string, string>): Record<string, string>;
+/** A stored Codex login (`codex login`): `auth.json` under `CODEX_HOME`, default `~/.codex`. */
+export declare function hasCodexLogin(env?: Record<string, string | undefined>, exists?: (p: string) => boolean): boolean;
 export interface BuildAgentEnvOpts {
     /** Per-call names to include (a node's declared skill env vars). */
     extraVars?: readonly string[];
+    /**
+     * The harness's own credential names (Codex: {@link CODEX_AUTH_VARS}).
+     * Default: none beyond the Claude prefixes.
+     */
+    authVars?: readonly string[];
+    /** Prefixes always kept. Default: {@link AGENT_ENV_PREFIXES} (Claude Code's). */
+    prefixes?: readonly string[];
     /** Operator passthrough list (`env-passthrough`). `"*"` inherits everything. */
     passthrough?: readonly string[];
     logger?: Pick<Logger, "warn">;

package/dist/agent-env.js

@@ -138,6 +138,31 @@ export function parseList(v) {
         .map((s) => s.trim())
         .filter(Boolean);
 }
+/**
+ * Codex's own credentials and home (openai/codex rust-v0.159.2,
+ * login/src/auth/manager.rs): `codex exec` authenticates with `CODEX_API_KEY`
+ * (it does not read `OPENAI_API_KEY` for this; see {@link resolveCodexAuthEnv})
+ * or `CODEX_ACCESS_TOKEN`, else the login stored in `$CODEX_HOME/auth.json`.
+ */
+export const CODEX_AUTH_VARS = ["CODEX_API_KEY", "CODEX_ACCESS_TOKEN", "CODEX_HOME"];
+/** Prefixes for a Codex run: locale only. `ANTHROPIC_*` / `CLAUDE_*` never reach Codex. */
+export const CODEX_ENV_PREFIXES = ["LC_"];
+/**
+ * `codex exec` reads `CODEX_API_KEY`, not `OPENAI_API_KEY`. Copy the OpenAI
+ * key into `CODEX_API_KEY` when only the former is set, so either works.
+ * Pure: returns a copy.
+ */
+export function resolveCodexAuthEnv(env) {
+    const out = { ...env };
+    if (!out.CODEX_API_KEY && out.OPENAI_API_KEY)
+        out.CODEX_API_KEY = out.OPENAI_API_KEY;
+    return out;
+}
+/** A stored Codex login (`codex login`): `auth.json` under `CODEX_HOME`, default `~/.codex`. */
+export function hasCodexLogin(env = process.env, exists = existsSync) {
+    const home = env.CODEX_HOME || path.join(homedir(), ".codex");
+    return exists(path.join(home, "auth.json"));
+}
 /**
  * Whether the agent env is scoped to the allowlist. `SWENY_ENV_SCOPE` (or the
  * explicit value) `on|true|1` / `off|false|0` wins everywhere; otherwise on
@@ -319,13 +344,21 @@ export function buildAgentEnv(source, opts = {}) {
         opts.logger?.warn("[sweny] env-passthrough contains '*': the agent inherits the full environment, including every secret.");
         return Object.fromEntries(Object.entries(source).filter((e) => e[1] != null));
     }
-    const exact = new Set([...AGENT_ENV_ALLOWLIST, ...(opts.extraVars ?? []), ...passthrough]);
-    const prefixes = [...AGENT_ENV_PREFIXES];
-    if (truthy(source.CLAUDE_CODE_USE_BEDROCK))
-        prefixes.push(...BEDROCK_PREFIXES);
-    if (truthy(source.CLAUDE_CODE_USE_VERTEX))
-        for (const v of VERTEX_VARS)
-            exact.add(v);
+    const exact = new Set([
+        ...AGENT_ENV_ALLOWLIST,
+        ...(opts.extraVars ?? []),
+        ...(opts.authVars ?? []),
+        ...passthrough,
+    ]);
+    const prefixes = [...(opts.prefixes ?? AGENT_ENV_PREFIXES)];
+    // Bedrock / Vertex routing is a Claude Code setting; only its default prefixes carry it.
+    if (!opts.prefixes) {
+        if (truthy(source.CLAUDE_CODE_USE_BEDROCK))
+            prefixes.push(...BEDROCK_PREFIXES);
+        if (truthy(source.CLAUDE_CODE_USE_VERTEX))
+            for (const v of VERTEX_VARS)
+                exact.add(v);
+    }
     const out = {};
     for (const [k, v] of Object.entries(source)) {
         if (v == null)

package/dist/cli/config-file.d.ts

@@ -19,4 +19,4 @@ export type FileConfig = Record<string, string | string[] | Record<string, unkno
  */
 export declare function loadConfigFile(cwd?: string): FileConfig;
 /** Starter config written by `sweny new`. */
-export declare const STARTER_CONFIG = "# .sweny.yml \u2014 SWEny project configuration\n# Commit this file. Secrets (API keys, tokens) go in .env (gitignored).\n#\n# Every key matches a CLI flag: \"time-range: 4h\" is the same as \"--time-range 4h\".\n# CLI flags override this file; env vars override this file; this file overrides defaults.\n\n# \u2500\u2500 Providers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# observability-provider: datadog        # datadog | sentry | cloudwatch | splunk | elastic | newrelic | loki | prometheus | pagerduty | heroku | opsgenie | vercel | supabase | netlify | fly | render | file\n# issue-tracker-provider: github-issues  # github-issues | linear | jira\n# source-control-provider: github        # github | gitlab\n# coding-agent-provider: claude          # claude (the only supported agent)\n# notification-provider: console         # console | slack | teams | discord | email | webhook\n\n# \u2500\u2500 Investigation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# time-range: 24h\n# severity-focus: errors\n# service-filter: \"*\"\n# investigation-depth: standard          # quick | standard | thorough\n\n# \u2500\u2500 PR / branch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# base-branch: main\n# pr-labels: agent,triage,needs-review\n\n# \u2500\u2500 Paths \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# service-map-path: .github/service-map.yml\n# log-file: ./logs/errors.json           # required when observability-provider is \"file\"\n\n# \u2500\u2500 Cache \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# cache-dir: .sweny/cache\n# cache-ttl: 86400\n\n# \u2500\u2500 Run reporting \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Opt-in and not currently available: token minting is not yet exposed, so\n# leaving this unset means no reporting request is ever made.\n# cloud-token: sweny_pk_...\n# Or set SWENY_CLOUD_TOKEN in your environment.\n\n# \u2500\u2500 Agent sandbox \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# See https://docs.sweny.ai/advanced/agent-sandbox/\n# sandbox: off                           # off (local default) | auto (CI default: sandbox if supported, else warn) | strict\n# sandbox-allowed-domains: [internal.example.com]   # extra hosts agent commands may reach\n# env-scope: off                         # off (local default: full env) | on (CI default: allowlist)\n# env-passthrough: [NPM_TOKEN]           # extra env vars the agent may see when scoped (\"*\" = all)\n\n# \u2500\u2500 MCP servers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Extend the coding agent with additional tools via MCP.\n# Value is a JSON object \u2014 each key is a server name you choose.\n# See https://docs.sweny.ai/advanced/mcp-servers/ for a full catalog with copy-paste configs.\n#\n# Example: GitHub MCP server (query PRs, issues, CI run logs)\n# mcp-servers-json: '{\"github\":{\"type\":\"stdio\",\"command\":\"npx\",\"args\":[\"-y\",\"@modelcontextprotocol/server-github@latest\"],\"env\":{\"GITHUB_PERSONAL_ACCESS_TOKEN\":\"ghp_...\"}}}'\n\n# \u2500\u2500 Local-only quick start \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Uncomment to run without any external services (just an LLM API key):\n# observability-provider: file\n# log-file: ./sample-errors.json\n# issue-tracker-provider: file\n# source-control-provider: file\n# notification-provider: file\n# output-dir: .sweny/output\n\n# \u2500\u2500 Credentials (.env) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Copy the relevant block into your .env file and fill in the values.\n#\n# Claude (coding agent) \u2014 https://console.anthropic.com/settings/api-keys\n#   ANTHROPIC_API_KEY=sk-ant-...\n#\n# GitHub (source control + issue tracker)\n#   GITHUB_TOKEN=ghp_...        # https://github.com/settings/tokens (repo + issues scopes)\n#\n# Datadog (observability) \u2014 https://app.datadoghq.com/organization-settings\n#   DD_API_KEY=...              # Organization Settings > API Keys\n#   DD_APP_KEY=...              # Organization Settings > Application Keys\n#   DD_SITE=datadoghq.com       # or datadoghq.eu, us3.datadoghq.com, etc.\n#\n# Sentry (observability) \u2014 https://sentry.io/settings/auth-tokens/\n#   SENTRY_AUTH_TOKEN=sntrys_...\n#   SENTRY_ORG=your-org-slug    # from sentry.io/organizations/<slug>/\n#   SENTRY_PROJECT=your-project # Project Settings > General > Project Slug\n#\n# Linear (issue tracker) \u2014 https://linear.app/settings/api\n#   LINEAR_API_KEY=lin_api_...\n#   LINEAR_TEAM_ID=...          # Settings > Workspace > Teams > [team] > copy ID from URL\n#   LINEAR_BUG_LABEL_ID=...     # Settings > Labels > [label] > copy ID from URL\n#\n# Jira (issue tracker) \u2014 https://your-org.atlassian.net\n#   JIRA_BASE_URL=https://your-org.atlassian.net\n#   JIRA_EMAIL=you@company.com  # your Atlassian account email\n#   JIRA_API_TOKEN=...          # https://id.atlassian.com/manage-profile/security/api-tokens\n#\n# Vercel (observability) \u2014 https://vercel.com/account/tokens\n#   VERCEL_TOKEN=...\n#   VERCEL_PROJECT_ID=prj_...      # Project Settings > General > Project ID\n#   VERCEL_TEAM_ID=team_...        # optional, for team-owned projects\n#\n# Supabase (observability) \u2014 https://supabase.com/dashboard/account/tokens\n#   SUPABASE_MANAGEMENT_KEY=...\n#   SUPABASE_PROJECT_REF=...       # Project Settings > General > Reference ID\n#\n# Netlify (observability) \u2014 https://app.netlify.com/user/applications#personal-access-tokens\n#   NETLIFY_TOKEN=...\n#   NETLIFY_SITE_ID=...         # Site Settings > General > Site ID\n#\n# Fly.io (observability) \u2014 https://fly.io/user/personal_access_tokens\n#   FLY_TOKEN=...\n#   FLY_APP_NAME=...             # the name of your Fly.io application\n#\n# Render (observability) \u2014 https://dashboard.render.com/u/settings\n#   RENDER_API_KEY=...\n#   RENDER_SERVICE_ID=srv-...    # from your service's Settings page\n#\n# Prometheus (observability) \u2014 self-hosted or Grafana Cloud\n#   PROMETHEUS_URL=http://prometheus.internal:9090\n#   PROMETHEUS_TOKEN=...         # optional, for secured instances\n#\n# PagerDuty (observability) \u2014 https://your-account.pagerduty.com/api_keys\n#   PAGERDUTY_API_KEY=...\n#\n# Honeycomb (observability) \u2014 https://docs.honeycomb.io/api/\n#   HONEYCOMB_API_KEY=...\n#   HONEYCOMB_DATASET=...        # dataset name (e.g. production)\n#\n# Heroku (observability) \u2014 https://devcenter.heroku.com/articles/platform-api-reference\n#   HEROKU_API_KEY=...           # https://dashboard.heroku.com/account\n#   HEROKU_APP_NAME=...          # the name of your Heroku application\n#\n# OpsGenie (observability) \u2014 https://support.atlassian.com/opsgenie/docs/api-key-management/\n#   OPSGENIE_API_KEY=...\n#   OPSGENIE_REGION=us           # or eu for EU-hosted accounts\n#\n# Slack (notifications) \u2014 https://api.slack.com/apps\n#   NOTIFICATION_WEBHOOK_URL=https://hooks.slack.com/services/...\n#   # or use a bot token: SLACK_BOT_TOKEN=xoxb-...\n";
+export declare const STARTER_CONFIG = "# .sweny.yml \u2014 SWEny project configuration\n# Commit this file. Secrets (API keys, tokens) go in .env (gitignored).\n#\n# Every key matches a CLI flag: \"time-range: 4h\" is the same as \"--time-range 4h\".\n# CLI flags override this file; env vars override this file; this file overrides defaults.\n\n# \u2500\u2500 Providers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# observability-provider: datadog        # datadog | sentry | cloudwatch | splunk | elastic | newrelic | loki | prometheus | pagerduty | heroku | opsgenie | vercel | supabase | netlify | fly | render | file\n# issue-tracker-provider: github-issues  # github-issues | linear | jira\n# source-control-provider: github        # github | gitlab\n# coding-agent-provider: claude          # claude | codex\n# notification-provider: console         # console | slack | teams | discord | email | webhook\n\n# \u2500\u2500 Investigation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# time-range: 24h\n# severity-focus: errors\n# service-filter: \"*\"\n# investigation-depth: standard          # quick | standard | thorough\n\n# \u2500\u2500 PR / branch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# base-branch: main\n# pr-labels: agent,triage,needs-review\n\n# \u2500\u2500 Paths \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# service-map-path: .github/service-map.yml\n# log-file: ./logs/errors.json           # required when observability-provider is \"file\"\n\n# \u2500\u2500 Cache \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# cache-dir: .sweny/cache\n# cache-ttl: 86400\n\n# \u2500\u2500 Run reporting \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Opt-in and not currently available: token minting is not yet exposed, so\n# leaving this unset means no reporting request is ever made.\n# cloud-token: sweny_pk_...\n# Or set SWENY_CLOUD_TOKEN in your environment.\n\n# \u2500\u2500 Agent sandbox \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# See https://docs.sweny.ai/advanced/agent-sandbox/\n# sandbox: off                           # off (local default) | auto (CI default: sandbox if supported, else warn) | strict\n# sandbox-allowed-domains: [internal.example.com]   # extra hosts agent commands may reach\n# env-scope: off                         # off (local default: full env) | on (CI default: allowlist)\n# env-passthrough: [NPM_TOKEN]           # extra env vars the agent may see when scoped (\"*\" = all)\n\n# \u2500\u2500 MCP servers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Extend the coding agent with additional tools via MCP.\n# Value is a JSON object \u2014 each key is a server name you choose.\n# See https://docs.sweny.ai/advanced/mcp-servers/ for a full catalog with copy-paste configs.\n#\n# Example: GitHub MCP server (query PRs, issues, CI run logs)\n# mcp-servers-json: '{\"github\":{\"type\":\"stdio\",\"command\":\"npx\",\"args\":[\"-y\",\"@modelcontextprotocol/server-github@latest\"],\"env\":{\"GITHUB_PERSONAL_ACCESS_TOKEN\":\"ghp_...\"}}}'\n\n# \u2500\u2500 Local-only quick start \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Uncomment to run without any external services (just an LLM API key):\n# observability-provider: file\n# log-file: ./sample-errors.json\n# issue-tracker-provider: file\n# source-control-provider: file\n# notification-provider: file\n# output-dir: .sweny/output\n\n# \u2500\u2500 Credentials (.env) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Copy the relevant block into your .env file and fill in the values.\n#\n# Claude (coding agent) \u2014 https://console.anthropic.com/settings/api-keys\n#   ANTHROPIC_API_KEY=sk-ant-...\n#\n# GitHub (source control + issue tracker)\n#   GITHUB_TOKEN=ghp_...        # https://github.com/settings/tokens (repo + issues scopes)\n#\n# Datadog (observability) \u2014 https://app.datadoghq.com/organization-settings\n#   DD_API_KEY=...              # Organization Settings > API Keys\n#   DD_APP_KEY=...              # Organization Settings > Application Keys\n#   DD_SITE=datadoghq.com       # or datadoghq.eu, us3.datadoghq.com, etc.\n#\n# Sentry (observability) \u2014 https://sentry.io/settings/auth-tokens/\n#   SENTRY_AUTH_TOKEN=sntrys_...\n#   SENTRY_ORG=your-org-slug    # from sentry.io/organizations/<slug>/\n#   SENTRY_PROJECT=your-project # Project Settings > General > Project Slug\n#\n# Linear (issue tracker) \u2014 https://linear.app/settings/api\n#   LINEAR_API_KEY=lin_api_...\n#   LINEAR_TEAM_ID=...          # Settings > Workspace > Teams > [team] > copy ID from URL\n#   LINEAR_BUG_LABEL_ID=...     # Settings > Labels > [label] > copy ID from URL\n#\n# Jira (issue tracker) \u2014 https://your-org.atlassian.net\n#   JIRA_BASE_URL=https://your-org.atlassian.net\n#   JIRA_EMAIL=you@company.com  # your Atlassian account email\n#   JIRA_API_TOKEN=...          # https://id.atlassian.com/manage-profile/security/api-tokens\n#\n# Vercel (observability) \u2014 https://vercel.com/account/tokens\n#   VERCEL_TOKEN=...\n#   VERCEL_PROJECT_ID=prj_...      # Project Settings > General > Project ID\n#   VERCEL_TEAM_ID=team_...        # optional, for team-owned projects\n#\n# Supabase (observability) \u2014 https://supabase.com/dashboard/account/tokens\n#   SUPABASE_MANAGEMENT_KEY=...\n#   SUPABASE_PROJECT_REF=...       # Project Settings > General > Reference ID\n#\n# Netlify (observability) \u2014 https://app.netlify.com/user/applications#personal-access-tokens\n#   NETLIFY_TOKEN=...\n#   NETLIFY_SITE_ID=...         # Site Settings > General > Site ID\n#\n# Fly.io (observability) \u2014 https://fly.io/user/personal_access_tokens\n#   FLY_TOKEN=...\n#   FLY_APP_NAME=...             # the name of your Fly.io application\n#\n# Render (observability) \u2014 https://dashboard.render.com/u/settings\n#   RENDER_API_KEY=...\n#   RENDER_SERVICE_ID=srv-...    # from your service's Settings page\n#\n# Prometheus (observability) \u2014 self-hosted or Grafana Cloud\n#   PROMETHEUS_URL=http://prometheus.internal:9090\n#   PROMETHEUS_TOKEN=...         # optional, for secured instances\n#\n# PagerDuty (observability) \u2014 https://your-account.pagerduty.com/api_keys\n#   PAGERDUTY_API_KEY=...\n#\n# Honeycomb (observability) \u2014 https://docs.honeycomb.io/api/\n#   HONEYCOMB_API_KEY=...\n#   HONEYCOMB_DATASET=...        # dataset name (e.g. production)\n#\n# Heroku (observability) \u2014 https://devcenter.heroku.com/articles/platform-api-reference\n#   HEROKU_API_KEY=...           # https://dashboard.heroku.com/account\n#   HEROKU_APP_NAME=...          # the name of your Heroku application\n#\n# OpsGenie (observability) \u2014 https://support.atlassian.com/opsgenie/docs/api-key-management/\n#   OPSGENIE_API_KEY=...\n#   OPSGENIE_REGION=us           # or eu for EU-hosted accounts\n#\n# Slack (notifications) \u2014 https://api.slack.com/apps\n#   NOTIFICATION_WEBHOOK_URL=https://hooks.slack.com/services/...\n#   # or use a bot token: SLACK_BOT_TOKEN=xoxb-...\n";

package/dist/cli/config-file.js

@@ -148,7 +148,7 @@ export const STARTER_CONFIG = `# .sweny.yml — SWEny project configuration
 # observability-provider: datadog        # datadog | sentry | cloudwatch | splunk | elastic | newrelic | loki | prometheus | pagerduty | heroku | opsgenie | vercel | supabase | netlify | fly | render | file
 # issue-tracker-provider: github-issues  # github-issues | linear | jira
 # source-control-provider: github        # github | gitlab
-# coding-agent-provider: claude          # claude (the only supported agent)
+# coding-agent-provider: claude          # claude | codex
 # notification-provider: console         # console | slack | teams | discord | email | webhook
 
 # ── Investigation ────────────────────────────────────────────────────

package/dist/cli/config.d.ts

@@ -11,6 +11,8 @@ export interface CliConfig {
     /** Auth precedence mode: auto (default), api-key, or oauth. */
     swenyAuth: "auto" | "api-key" | "oauth";
     openaiApiKey: string;
+    /** Codex's own credential: CODEX_API_KEY, else CODEX_ACCESS_TOKEN. */
+    codexApiKey?: string;
     geminiApiKey: string;
     observabilityProviders: string[];
     observabilityCredentials: Record<string, Record<string, string>>;

package/dist/cli/config.js

@@ -1,12 +1,14 @@
 import { execSync } from "node:child_process";
 import * as fs from "node:fs";
+import { hasCodexLogin } from "../agent-env.js";
+import { unsupportedAgentError } from "../harness/agents.js";
 export function registerTriageCommand(program) {
     // NOTE: File-eligible options omit Commander defaults so parseCliInputs() can
     // distinguish "user passed flag" from "not passed" and fall through to .sweny.yml.
     return program
         .command("triage")
         .description("Run the SWEny triage workflow")
-        .option("--agent <provider>", "Coding agent: claude (the only supported agent)")
+        .option("--agent <provider>", "Coding agent: claude (default) or codex")
         .option("--coding-agent-provider <provider>", "Coding agent provider (alias for --agent)")
         .option("--observability-provider <provider>", "Observability provider (default: none)")
         .option("--issue-tracker-provider <provider>", "Issue tracker provider (default: github-issues)")
@@ -107,6 +109,7 @@ export function parseCliInputs(options, fileConfig = {}) {
         anthropicBaseUrl: env.ANTHROPIC_BASE_URL || f("anthropic-base-url") || "",
         swenyAuth: normalizeSwenyAuth(env.SWENY_AUTH || f("sweny-auth")),
         openaiApiKey: env.OPENAI_API_KEY || "",
+        codexApiKey: env.CODEX_API_KEY || env.CODEX_ACCESS_TOKEN || "",
         geminiApiKey: env.GEMINI_API_KEY || env.GOOGLE_API_KEY || "",
         observabilityProviders: obsProviders,
         observabilityCredentials: obsCreds,
@@ -228,12 +231,17 @@ export function validateInputs(config) {
                 errors.push("Missing: ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN — get a key at https://console.anthropic.com");
             }
             break;
+        case "codex":
+            // codex exec authenticates with CODEX_API_KEY (OPENAI_API_KEY is mapped
+            // to it) or a stored `codex login` under CODEX_HOME.
+            if (!config.openaiApiKey && !config.codexApiKey && !hasCodexLogin(process.env)) {
+                errors.push("Missing: CODEX_API_KEY or OPENAI_API_KEY, or a Codex login (`codex login`), for --agent codex");
+            }
+            break;
         default:
-            // Honest --agent (#330): SWEny runs headless Claude Code only. Nothing
-            // dispatches on other values, so accepting them would silently run
-            // Claude under a different name.
-            errors.push(`Unsupported coding agent "${config.codingAgentProvider}": the only supported agent is "claude" ` +
-                `(headless Claude Code). Remove --agent / coding-agent-provider or set it to claude.`);
+            // Honest --agent (#330): only agents with an adapter are accepted.
+            // Anything else would silently run a different agent under that name.
+            errors.push(unsupportedAgentError(config.codingAgentProvider));
     }
     // Repository required unless all providers are file-based
     const allLocal = config.issueTrackerProvider === "file" && config.sourceControlProvider === "file";
@@ -650,7 +658,7 @@ export function registerImplementCommand(program) {
     return program
         .command("implement <issueId>")
         .description("Implement a fix for a specific issue and open a PR")
-        .option("--agent <provider>", "Coding agent: claude (the only supported agent)")
+        .option("--agent <provider>", "Coding agent: claude (default) or codex")
         .option("--coding-agent-provider <provider>", "Coding agent provider (alias for --agent)")
         .option("--issue-tracker-provider <provider>", "Issue tracker (linear|jira|github-issues|file)")
         .option("--source-control-provider <provider>", "Source control (github|gitlab|file)")

package/dist/cli/main.js

@@ -10,6 +10,8 @@ import { execute } from "../executor.js";
 import { triageWorkflow, implementWorkflow, seedContentWorkflow } from "../workflows/index.js";
 import { consoleLogger } from "../types.js";
 import { createHarness } from "../harness/index.js";
+import { isSupportedAgent, unsupportedAgentError } from "../harness/agents.js";
+import { resolveHarnessPolicy } from "../harness/policy.js";
 import { builtinSkills, createSkillMap, validateWorkflowSkills } from "../skills/index.js";
 import { formatMissingSkillLines, skillEnvWarnings } from "./skill-env.js";
 import { configuredSkills, configuredSkillsWithDiagnostics } from "../skills/custom-loader.js";
@@ -34,7 +36,7 @@ import { createVerboseToolObserver } from "./verbose-observer.js";
 import { createRunLogger, renderReceiptLine, summarizeRun, writeStepSummary, WORKFLOW_RUN_DESCRIPTION, WORKFLOW_RUN_OPTIONS, } from "./run-output.js";
 import { writeRunComment } from "./comment-output.js";
 import { registerTriageCommand, registerImplementCommand, parseCliInputs, validateInputs, validateWarnings, parsePositiveInt, } from "./config.js";
-import { c, formatBanner, getStepDetails, formatStepLine, formatDagResultHuman, formatDagResultMarkdown, formatResultJson, formatValidationErrors, formatCrashError, formatCheckResults, } from "./output.js";
+import { c, formatBanner, getStepDetails, formatStepLine, formatDagResultHuman, formatDagResultMarkdown, writeResultJson, formatValidationErrors, formatCrashError, formatCheckResults, } from "./output.js";
 import { checkProviderConnectivity, detectClaudeCodeLogin, discoverWorkflowSkillIds, validateCheckInputs, } from "./check.js";
 import { registerSetupCommand } from "./setup.js";
 import { registerPublishCommand } from "./publish.js";
@@ -175,6 +177,28 @@ async function resolveRulesAndContext(config) {
         context: contextResult.resolved,
     };
 }
+/**
+ * Build the harness for `--agent` (#331). A non-Claude agent is checked before
+ * any node runs, so a missing or too-old CLI fails fast with the fix.
+ */
+async function harnessFor(agent, opts, harnessPolicy) {
+    if (!isSupportedAgent(agent)) {
+        console.error(chalk.red(`\n  ${unsupportedAgentError(agent)}\n`));
+        process.exit(1);
+    }
+    const harness = createHarness(agent, {
+        ...opts,
+        policy: resolveHarnessPolicy(process.env, harnessPolicy, opts.logger),
+    });
+    if (agent !== "claude") {
+        const pre = await harness.preflight();
+        if (!pre.ok) {
+            console.error(chalk.red(`\n  ${pre.reason}\n`));
+            process.exit(1);
+        }
+    }
+    return harness;
+}
 // ── sweny triage ──────────────────────────────────────────────────────
 const triageCmd = registerTriageCommand(program);
 triageCmd.action(async (options) => {
@@ -203,7 +227,7 @@ triageCmd.action(async (options) => {
     const skills = createSkillMap(triageSkillDiscovery.skills);
     const mcpAutoConfig = buildMcpAutoConfig(config);
     const mcpServers = buildAutoMcpServers(mcpAutoConfig);
-    const claude = createHarness("claude-code", {
+    const claude = await harnessFor(config.codingAgentProvider, {
         maxTurns: config.maxInvestigateTurns || 50,
         cwd: process.cwd(),
         logger: consoleLogger,
@@ -392,7 +416,7 @@ triageCmd.action(async (options) => {
         const durationMs = Date.now() - runStart;
         // Output
         if (config.json) {
-            console.log(formatResultJson(results));
+            await writeResultJson(results);
         }
         else {
             console.log(formatDagResultHuman(results, durationMs, config));
@@ -477,7 +501,7 @@ triageCmd.action(async (options) => {
     }
 });
 // ── sweny implement ───────────────────────────────────────────────────
-const implementCmd = registerImplementCommand(program);
+const implementCmd = registerImplementCommand(program).option("--json", "Output result as JSON", false);
 implementCmd.action(async (issueId, options) => {
     const fileConfig = loadConfigFile();
     // Build a minimal CliConfig for the implement command by merging CLI opts with env/file
@@ -513,7 +537,7 @@ implementCmd.action(async (issueId, options) => {
     const skills = createSkillMap(implementSkillDiscovery.skills);
     const mcpAutoConfig = buildMcpAutoConfig(config);
     const mcpServers = buildAutoMcpServers(mcpAutoConfig);
-    const claude = createHarness("claude-code", {
+    const claude = await harnessFor(config.codingAgentProvider, {
         maxTurns: config.maxImplementTurns || 40,
         cwd: process.cwd(),
         logger: consoleLogger,
@@ -604,17 +628,22 @@ implementCmd.action(async (issueId, options) => {
         catch {
             // silent
         }
+        if (config.json) {
+            await writeResultJson(results);
+        }
         if (hasFailed) {
             console.error(chalk.red(`\n  Implement workflow failed\n`));
             process.exit(1);
         }
-        const prResult = results.get("create_pr");
-        const prUrl = prResult?.data?.prUrl;
-        if (prUrl) {
-            console.log(chalk.green(`\n  PR created: ${prUrl}\n`));
-        }
-        else {
-            console.log(chalk.green(`\n  Implement workflow completed\n`));
+        if (!config.json) {
+            const prResult = results.get("create_pr");
+            const prUrl = prResult?.data?.prUrl;
+            if (prUrl) {
+                console.log(chalk.green(`\n  PR created: ${prUrl}\n`));
+            }
+            else {
+                console.log(chalk.green(`\n  Implement workflow completed\n`));
+            }
         }
         // Legacy /api/report back-compat — see triage path.
         try {
@@ -756,14 +785,15 @@ export async function workflowRunAction(file, options) {
     });
     // Raw [info]/[debug] lines are verbose-only; warnings are rendered (#383).
     const runLogger = createRunLogger({ verbose: Boolean(options.verbose), tty: isTTY });
-    const claude = createHarness("claude-code", {
+    // --agent picks the harness (#331): claude (default) or codex.
+    const claude = await harnessFor(config.codingAgentProvider, {
         maxTurns: config.maxInvestigateTurns || 50,
         cwd: process.cwd(),
         logger: runLogger,
         defaultMcpServers: mcpServers,
         mcpServers: config.mcpServers,
         model: workflow.model,
-    });
+    }, typeof options.harnessPolicy === "string" ? options.harnessPolicy : undefined);
     // Track per-node entry time to compute elapsed on exit
     const nodeEnterTimes = new Map();
     const wfProgressObserver = isJson
@@ -956,7 +986,7 @@ export async function workflowRunAction(file, options) {
             });
         }
         if (isJson) {
-            process.stdout.write(JSON.stringify(Object.fromEntries(results), null, 2) + "\n");
+            await writeResultJson(results);
             process.exit(wfHasFailed ? 1 : 0);
             return;
         }

package/dist/cli/output.d.ts

@@ -24,6 +24,8 @@ export declare function extractCredentialHint(err: unknown): string | null;
 export declare function formatCrashError(error: unknown): string;
 export declare function formatCheckResults(results: CheckResult[]): string;
 export declare function formatResultJson(results: Map<string, NodeResult>): string;
+/** Drain terminal JSON before process.exit(), including when stdout is a pipe. */
+export declare function writeResultJson(results: Map<string, NodeResult>): Promise<void>;
 /**
  * Format triage results as GitHub-flavored markdown for `$GITHUB_STEP_SUMMARY`.
  *

package/dist/cli/output.js

@@ -405,6 +405,17 @@ export function formatCheckResults(results) {
 export function formatResultJson(results) {
     return JSON.stringify(Object.fromEntries(results), null, 2);
 }
+/** Drain terminal JSON before process.exit(), including when stdout is a pipe. */
+export function writeResultJson(results) {
+    return new Promise((resolve, reject) => {
+        process.stdout.write(formatResultJson(results) + "\n", (error) => {
+            if (error)
+                reject(error);
+            else
+                resolve();
+        });
+    });
+}
 export function formatDagResultMarkdown(results, durationMs, config, options = {}) {
     const duration = formatDuration(durationMs);
     const lines = [];

package/dist/cli/run-history.d.ts

@@ -53,6 +53,8 @@ export interface RunRecord {
         id: string;
         version: string;
     };
+    /** Opinions the harness could not honor natively on some node, deduped. Absent when none. */
+    degraded?: string[];
 }
 /** sha256 (hex) of the workflow as canonical JSON: keys sorted, undefined dropped. */
 export declare function hashWorkflow(workflow: Workflow): string;

package/dist/cli/run-history.js

@@ -92,6 +92,7 @@ export function buildRunRecord(i) {
         };
     });
     const harness = [...i.results.values()].find((r) => r.harness)?.harness;
+    const degraded = [...new Set([...i.results.values()].flatMap((r) => r.degraded ?? []))];
     return {
         schema_version: RUN_HISTORY_SCHEMA_VERSION,
         run_id: i.runId,
@@ -111,6 +112,7 @@ export function buildRunRecord(i) {
             cost_usd: summary.costUsd ?? null,
         },
         ...(harness ? { harness: { id: harness.id, version: harness.version } } : {}),
+        ...(degraded.length > 0 ? { degraded } : {}),
     };
 }
 // ── Write, prune, read ──────────────────────────────────────────

package/dist/cli/run-output.d.ts

@@ -18,7 +18,16 @@ export interface RunSummary {
     tokens?: number;
     /** Sum of SDK-reported cost. Undefined when the SDK reported none (never estimated). */
     costUsd?: number;
+    /** Harness that ran the nodes, when a result was tagged. */
+    harness?: string;
+    /**
+     * Opinions some node's harness could not honor natively, as short keys
+     * (`max_turns`, `egress allowlist`, `deny [write]`). Absent when none.
+     */
+    degraded?: string[];
 }
+/** The short key of a `degraded` entry: the text before its first colon. */
+export declare function degradedKey(entry: string): string;
 /** Sum the per-node results into one run summary. */
 export declare function summarizeRun(results: Map<string, NodeResult>, durationMs: number, crashed?: boolean): RunSummary;
 export declare function formatReceiptDuration(ms: number): string;
@@ -26,8 +35,10 @@ export declare function formatTokenCount(n: number): string;
 export declare function formatCost(usd: number): string;
 /**
  * One plain line: `✓ 3/3 nodes · 41 tool calls · 2m10s · 12k tokens · $0.18`.
- * Token and cost segments are omitted when the SDK reported none. No ANSI;
- * callers colorize only when writing to a TTY.
+ * Token and cost segments are omitted when the SDK reported none. A harness
+ * other than Claude Code is named, and anything it could not honor natively
+ * is listed (`· codex · degraded: max_turns`). No ANSI; callers colorize only
+ * when writing to a TTY.
  */
 export declare function formatReceipt(s: RunSummary): string;
 /** Receipt for a terminal: colored only when `color` is true. */

package/dist/cli/run-output.js

@@ -9,6 +9,11 @@ import fs from "node:fs";
 import chalk from "chalk";
 import { consoleLogger } from "../types.js";
 import { toMermaidBlock } from "../mermaid.js";
+/** The short key of a `degraded` entry: the text before its first colon. */
+export function degradedKey(entry) {
+    const i = entry.indexOf(":");
+    return (i === -1 ? entry : entry.slice(0, i)).trim();
+}
 /** Sum the per-node results into one run summary. */
 export function summarizeRun(results, durationMs, crashed = false) {
     let nodesOk = 0;
@@ -17,8 +22,13 @@ export function summarizeRun(results, durationMs, crashed = false) {
     let toolCalls = 0;
     let tokens;
     let costUsd;
+    let harness;
+    const degraded = new Set();
     const isNum = (v) => typeof v === "number" && Number.isFinite(v);
     for (const r of results.values()) {
+        harness ??= r.harness?.id;
+        for (const d of r.degraded ?? [])
+            degraded.add(degradedKey(d));
         if (r.status === "success")
             nodesOk++;
         else if (r.status === "skipped")
@@ -45,6 +55,8 @@ export function summarizeRun(results, durationMs, crashed = false) {
         durationMs,
         ...(tokens !== undefined ? { tokens } : {}),
         ...(costUsd !== undefined ? { costUsd } : {}),
+        ...(harness !== undefined ? { harness } : {}),
+        ...(degraded.size > 0 ? { degraded: [...degraded] } : {}),
     };
 }
 export function formatReceiptDuration(ms) {
@@ -71,8 +83,10 @@ export function formatCost(usd) {
 }
 /**
  * One plain line: `✓ 3/3 nodes · 41 tool calls · 2m10s · 12k tokens · $0.18`.
- * Token and cost segments are omitted when the SDK reported none. No ANSI;
- * callers colorize only when writing to a TTY.
+ * Token and cost segments are omitted when the SDK reported none. A harness
+ * other than Claude Code is named, and anything it could not honor natively
+ * is listed (`· codex · degraded: max_turns`). No ANSI; callers colorize only
+ * when writing to a TTY.
  */
 export function formatReceipt(s) {
     const parts = [
@@ -82,6 +96,8 @@ export function formatReceipt(s) {
         formatReceiptDuration(s.durationMs),
         ...(s.tokens !== undefined ? [`${formatTokenCount(s.tokens)} tokens`] : []),
         ...(s.costUsd !== undefined ? [formatCost(s.costUsd)] : []),
+        ...(s.harness !== undefined && s.harness !== "claude-code" ? [s.harness] : []),
+        ...(s.degraded && s.degraded.length > 0 ? [`degraded: ${s.degraded.join(", ")}`] : []),
     ];
     return parts.join(" · ");
 }
@@ -195,4 +211,9 @@ export const WORKFLOW_RUN_OPTIONS = [
         "Write a PR-comment markdown (run receipt, status-colored DAG, per-node table; metadata only) to <path> so any CI can post it",
     ],
     ["--input <json>", "JSON string of input data to pass to the workflow"],
+    ["--agent <id>", "Coding agent that runs the nodes: claude (default) or codex"],
+    [
+        "--harness-policy <mode>",
+        "strict: refuse a node whose policy the agent cannot enforce; warn: run it and report what was not enforced (default: strict under GitHub Actions, warn elsewhere; env SWENY_HARNESS_POLICY)",
+    ],
 ];

package/dist/executor.js

@@ -23,6 +23,7 @@ import { validateWorkflow } from "./schema.js";
 import { resolveAgentAccess } from "./agent-env.js";
 import { fenceUntrusted } from "./untrusted.js";
 import { asClaude } from "./harness/compat.js";
+import { isToolClass } from "./harness/policy.js";
 /**
  * Default workflow-level step budget. Counts total node executions across the
  * whole run (loop iterations included). Generous enough for legitimate deep
@@ -171,8 +172,8 @@ export async function execute(workflow, input, options) {
         // Build context: input + all prior node results.
         // Each prior node entry is the node's `data` augmented with `evals`
         // (a Record<name, EvalResult> for downstream lookup like
-        // `priorNode.evals.tests_run_clean.pass`). When `data` already has an
-        // `evals` key, the data field wins (back-compat with existing workflows).
+        // `priorNode.evals.tests_run_clean.pass`). This namespace is reserved
+        // for runtime verdicts; an agent-provided `data.evals` never overrides it.
         const context = {
             input,
             ...Object.fromEntries([...results.entries()].map(([k, v]) => [k, buildPriorNodeContext(v)])),
@@ -240,6 +241,11 @@ export async function execute(workflow, input, options) {
         // Per-node execution model: node.model ?? workflow.model. When undefined,
         // claude.run falls back to its own client default (then Claude Code's).
         const nodeModel = resolveExecutionModel(node, workflow);
+        // `tools.deny` entries that name a portable class (shell, write, edit, net,
+        // subagent) also deny that class of built-in agent tools; the harness
+        // compiles them or reports them in `degraded`.
+        const denyClasses = (node.tools?.deny ?? []).filter(isToolClass);
+        let degradedLogged = false;
         while (true) {
             result = await claude.run({
                 instruction: currentInstruction,
@@ -248,6 +254,7 @@ export async function execute(workflow, input, options) {
                 outputSchema: node.output,
                 maxTurns: node.max_turns,
                 disallowedTools: node.disallowed_tools,
+                ...(denyClasses.length > 0 ? { deny: denyClasses } : {}),
                 model: nodeModel,
                 signal,
                 timeoutMs,
@@ -258,6 +265,12 @@ export async function execute(workflow, input, options) {
                     safeObserve(observer, { type: "node:progress", node: currentId, message }, logger);
                 },
             });
+            // Opinions the harness could not honor natively: said once per node, never silently dropped.
+            if (!degradedLogged && result.degraded && result.degraded.length > 0) {
+                degradedLogged = true;
+                const who = result.harness?.id ?? "harness";
+                logger.warn(`  ${who} could not honor natively: ${result.degraded.join("; ")}`, { node: currentId });
+            }
             // Retry only triggers on eval failure. Bail on tool/API errors.
             if (result.status !== "success") {
                 agentRunFailed = true;
@@ -355,7 +368,9 @@ export async function execute(workflow, input, options) {
         // instead of failing outright. The original error stays in `data.error`
         // and `data.fail_soft` marks the downgrade for downstream nodes and
         // observers. Eval failures never take this path (agentRunFailed guards it).
-        if (agentRunFailed && result.status === "failed" && node.fail_soft === true) {
+        // A strict-policy refusal (#331) is not an agent failure: fail_soft never softens it.
+        const refused = result.data?.refused === true;
+        if (agentRunFailed && result.status === "failed" && node.fail_soft === true && !refused) {
             const failError = result.data?.error;
             logger.warn(`  fail_soft: node failed (${String(failError ?? "unknown error")}); continuing with partial output`, {
                 node: currentId,
@@ -488,23 +503,15 @@ function warnOnJudgeBudget(workflow, logger) {
  *
  * Spec contract (https://spec.sweny.ai/nodes/#evalresult-type): downstream
  * nodes can read `priorNode.evals.<name>.pass` via the natural lookup path.
- * To honor this without breaking back-compat with workflows that read
- * `priorNode.<dataField>` directly, we spread `data` first and then attach
- * an `evals` namespace keyed by evaluator name. If the agent's structured
- * output happens to include a literal `evals` field, that field wins (and
- * the lookup degrades to "evals not available" for downstream readers).
+ * Preserve ordinary data fields, but reserve `evals` for runtime verdicts.
+ * Agent output must not forge a pass for downstream `requires` gates,
+ * including when no evaluator ran (the trusted namespace is then empty).
  */
 function buildPriorNodeContext(result) {
     const data = (result.data ?? {});
     const evals = result.evals ?? [];
-    if (evals.length === 0)
-        return data;
-    const evalsByName = {};
-    for (const e of evals) {
-        evalsByName[e.name] = e;
-    }
-    // Spread evals first so a data-side `evals` key shadows it (back-compat).
-    return { evals: evalsByName, ...data };
+    const evalsByName = Object.fromEntries(evals.map((e) => [e.name, e]));
+    return { ...data, evals: evalsByName };
 }
 /**
  * Build the prior-node entry shown to the LLM route evaluator.
@@ -564,14 +571,9 @@ function buildRouteEvalEntry(result, sourceNode) {
         dataView = fullData;
     }
     const evals = result.evals ?? [];
-    if (evals.length === 0)
-        return { view: dataView, missing };
-    const evalsByName = {};
-    for (const e of evals) {
-        evalsByName[e.name] = e;
-    }
-    // Spread evals first so a data-side `evals` key shadows it (back-compat).
-    return { view: { evals: evalsByName, ...dataView }, missing };
+    const evalsByName = Object.fromEntries(evals.map((e) => [e.name, e]));
+    // Schema projection never grants agent data authority over runtime verdicts.
+    return { view: { ...dataView, evals: evalsByName }, missing };
 }
 /**
  * Return the declared output property names for a node, or null when the
@@ -762,7 +764,10 @@ function filterNodeTools(tools, filter, nodeId, logger) {
     if (!filter)
         return tools;
     const resolvedNames = new Set(tools.map((t) => t.name));
-    for (const name of [...(filter.allow ?? []), ...(filter.deny ?? [])]) {
+    // A deny entry that names a tool class (write, shell, ...) targets built-in
+    // agent tools too, so it is not a typo when no skill tool has that name.
+    const denyNames = (filter.deny ?? []).filter((n) => !isToolClass(n));
+    for (const name of [...(filter.allow ?? []), ...denyNames]) {
         if (!resolvedNames.has(name)) {
             logger.warn(`  tools filter: '${name}' does not match any tool resolved for node '${nodeId}'`, {
                 node: nodeId,