@sweny-ai/core 0.1.142 → 0.1.144

package/dist/executor.js

@@ -23,6 +23,9 @@ import { validateWorkflow } from "./schema.js";
 import { resolveAgentAccess } from "./agent-env.js";
 import { fenceUntrusted } from "./untrusted.js";
 import { asClaude } from "./harness/compat.js";
+import { isToolClass, policyGate } from "./harness/policy.js";
+import { buildNodePolicy, resolveNodePermissions } from "./node-policy.js";
+import { applySafeOutputs, createEmitOutputTool, createWriteStageState, resolveActor, safeOutputsInstruction, unresolvedOutputs, SAFE_OUTPUT_SCREEN_INSTRUCTION, } from "./safe-outputs.js";
 /**
  * Default workflow-level step budget. Counts total node executions across the
  * whole run (loop iterations included). Generous enough for legitimate deep
@@ -70,6 +73,13 @@ export async function execute(workflow, input, options) {
     let stepCount = 0; // total node executions across the run (loop iterations included)
     const trace = { steps: [], edges: [], sources: {} };
     validate(workflow, skills);
+    // Safe outputs (#365): run-wide caps and dedupe, the staged switch and the
+    // triggering actor, resolved once per run.
+    const writeState = createWriteStageState();
+    const stageOutputs = dryRun || options.stageOutputs === true || workflow.safe_outputs?.staged === true;
+    const runEnv = options.env ?? process.env;
+    const usesOutputs = Object.values(workflow.nodes).some((n) => (n.outputs?.length ?? 0) > 0);
+    const actor = usesOutputs ? resolveActor(runEnv, options.actor) : {};
     // Build an eval-time alias table from the loaded skills. Each skill owns
     // its own mapping between skill-tool names and equivalent MCP names. Core
     // stays vendor-neutral; this call just unions what the skills declare.
@@ -149,11 +159,32 @@ export async function execute(workflow, input, options) {
         // Dry run (#380): only `access: "read"` tools reach the node. Write and
         // unclassified tools are withheld (never registered, so never callable)
         // and recorded on the node result as `skippedWrites`.
-        const tools = dryRun ? filteredTools.filter(isReadTool) : filteredTools;
+        // #365: `permissions: read` (explicit, inherited, or implied by `outputs`)
+        // gets the same tool gate as a dry run.
+        const permissions = resolveNodePermissions(node, workflow);
+        const declaresPolicy = node.permissions !== undefined || workflow.permissions !== undefined || (node.outputs?.length ?? 0) > 0;
+        const readOnlyNode = dryRun || permissions.access === "read";
+        const readTools = readOnlyNode ? filteredTools.filter(isReadTool) : filteredTools;
         const skippedWrites = dryRun ? filteredTools.filter((t) => !isReadTool(t)).map((t) => t.name) : [];
         if (skippedWrites.length > 0) {
             logger.info(`  dry run: withheld write tools: ${skippedWrites.join(", ")}`, { node: currentId });
         }
+        else if (readOnlyNode && readTools.length < filteredTools.length) {
+            const withheld = filteredTools.filter((t) => !isReadTool(t)).map((t) => t.name);
+            logger.info(`  permissions: read: withheld write tools: ${withheld.join(", ")}`, { node: currentId });
+        }
+        // Safe outputs (#365): the agent records write intents with emit_output;
+        // the write stage after the node applies them. One buffer per attempt.
+        const outputDecls = node.outputs ?? [];
+        const intents = [];
+        const tools = outputDecls.length > 0 ? [...readTools, createEmitOutputTool(outputDecls, intents)] : readTools;
+        if (outputDecls.length > 0 && !stageOutputs) {
+            const missing = unresolvedOutputs(outputDecls, node.skills, skills);
+            if (missing.length > 0) {
+                throw new Error(`Node "${currentId}" declares outputs [${missing.join(", ")}] but no configured skill can apply them ` +
+                    `(github or linear). Set the skill's environment variables, or run with --stage to preview.`);
+            }
+        }
         const skillInstructions = resolveSkillInstructions(node.skills, skills);
         const skillMcpServers = resolveSkillMcpServers(node.skills, skills);
         // Runtime guard: if this node declares skills but none resolved, the node
@@ -226,7 +257,8 @@ export async function execute(workflow, input, options) {
         const effectiveRules = assembleCascaded("rules", currentId, workflow.nodes[currentId], inputRules.length, (workflow.rules ?? []).length, resolvedSources);
         const effectiveContext = assembleCascaded("context", currentId, workflow.nodes[currentId], inputContext.length, (workflow.context ?? []).length, resolvedSources);
         const baseInstruction = buildNodeInstruction(resolvedInstruction, effectiveRules, effectiveContext, input, skillInstructions);
-        const instruction = dryRun ? `${dryRunNotice(skippedWrites)}\n\n---\n\n${baseInstruction}` : baseInstruction;
+        const nodeInstruction = outputDecls.length > 0 ? `${baseInstruction}\n\n${safeOutputsInstruction(outputDecls)}` : baseInstruction;
+        const instruction = dryRun ? `${dryRunNotice(skippedWrites)}\n\n---\n\n${nodeInstruction}` : nodeInstruction;
         // Run Claude on this node, with optional eval-failure retry loop.
         let attempt = 0;
         let result;
@@ -240,7 +272,43 @@ export async function execute(workflow, input, options) {
         // Per-node execution model: node.model ?? workflow.model. When undefined,
         // claude.run falls back to its own client default (then Claude Code's).
         const nodeModel = resolveExecutionModel(node, workflow);
+        // `tools.deny` entries that name a portable class (shell, write, edit, net,
+        // subagent) also deny that class of built-in agent tools; the harness
+        // compiles them or reports them in `degraded`.
+        const denyClasses = (node.tools?.deny ?? []).filter(isToolClass);
+        let degradedLogged = false;
+        const agentAccess = resolveAgentAccess(node.skills, skills);
+        // #365: a node or workflow that declares `permissions` or `outputs` gets
+        // one portable policy, compiled by each adapter. The gate also runs here so
+        // a strict refusal holds on every harness, before any spend. Nodes that
+        // declare neither pass no policy, so each harness keeps its own defaults.
+        const nodePolicy = declaresPolicy
+            ? buildNodePolicy({
+                permissions: { ...permissions, deny: [...new Set([...permissions.deny, ...denyClasses])] },
+                dryRun,
+                disallowedTools: node.disallowed_tools,
+                egress: agentAccess.domains,
+            })
+            : undefined;
+        // Egress is left to the adapter: only it knows whether a process sandbox
+        // wrapper covers what its native sandbox cannot.
+        const gate = nodePolicy && options.harness
+            ? policyGate(options.harness.capabilities, { ...nodePolicy, egress: [] })
+            : undefined;
         while (true) {
+            if (gate?.refuse) {
+                // Not an agent failure: fail_soft never softens a policy refusal.
+                logger.warn(`  harness refused the node: ${gate.refuse}`, { node: currentId });
+                result = {
+                    status: "failed",
+                    data: { error: gate.refuse, refused: true },
+                    toolCalls: [],
+                    degraded: gate.degraded,
+                };
+                break;
+            }
+            // Only the final attempt's intents may be applied.
+            intents.length = 0;
             result = await claude.run({
                 instruction: currentInstruction,
                 context,
@@ -248,16 +316,24 @@ export async function execute(workflow, input, options) {
                 outputSchema: node.output,
                 maxTurns: node.max_turns,
                 disallowedTools: node.disallowed_tools,
+                ...(denyClasses.length > 0 ? { deny: denyClasses } : {}),
                 model: nodeModel,
                 signal,
                 timeoutMs,
-                agentAccess: resolveAgentAccess(node.skills, skills),
-                ...(dryRun ? {} : { mcpServers: skillMcpServers }),
-                ...(dryRun ? { readOnly: true } : {}),
+                agentAccess,
+                ...(nodePolicy ? { policy: nodePolicy } : {}),
+                ...(readOnlyNode ? {} : { mcpServers: skillMcpServers }),
+                ...(readOnlyNode ? { readOnly: true } : {}),
                 onProgress: (message) => {
                     safeObserve(observer, { type: "node:progress", node: currentId, message }, logger);
                 },
             });
+            // Opinions the harness could not honor natively: said once per node, never silently dropped.
+            if (!degradedLogged && result.degraded && result.degraded.length > 0) {
+                degradedLogged = true;
+                const who = result.harness?.id ?? "harness";
+                logger.warn(`  ${who} could not honor natively: ${result.degraded.join("; ")}`, { node: currentId });
+            }
             // Retry only triggers on eval failure. Bail on tool/API errors.
             if (result.status !== "success") {
                 agentRunFailed = true;
@@ -355,7 +431,9 @@ export async function execute(workflow, input, options) {
         // instead of failing outright. The original error stays in `data.error`
         // and `data.fail_soft` marks the downgrade for downstream nodes and
         // observers. Eval failures never take this path (agentRunFailed guards it).
-        if (agentRunFailed && result.status === "failed" && node.fail_soft === true) {
+        // A strict-policy refusal (#331) is not an agent failure: fail_soft never softens it.
+        const refused = result.data?.refused === true;
+        if (agentRunFailed && result.status === "failed" && node.fail_soft === true && !refused) {
             const failError = result.data?.error;
             logger.warn(`  fail_soft: node failed (${String(failError ?? "unknown error")}); continuing with partial output`, {
                 node: currentId,
@@ -366,6 +444,45 @@ export async function execute(workflow, input, options) {
                 data: { ...(result.data ?? {}), fail_soft: true },
             };
         }
+        // Safe outputs write stage (#365). Runs only after the agent finished and
+        // every eval passed; deterministic checks first, an optional model screen
+        // may veto, and only then does sweny call the skill's own write handler.
+        if (outputDecls.length > 0) {
+            if (result.status === "success" && !agentRunFailed) {
+                const stage = await applySafeOutputs({
+                    nodeId: currentId,
+                    declarations: outputDecls,
+                    intents,
+                    policy: workflow.safe_outputs,
+                    nodeSkills: node.skills,
+                    skills,
+                    config,
+                    env: runEnv,
+                    actor,
+                    staged: stageOutputs,
+                    state: writeState,
+                    logger,
+                    screen: async (writes) => claude.ask({
+                        instruction: SAFE_OUTPUT_SCREEN_INSTRUCTION,
+                        context: { writes },
+                        model: nodeModel,
+                        signal,
+                        timeoutMs,
+                    }),
+                });
+                result = { ...result, outputs: stage.receipts };
+                if (stage.error) {
+                    logger.warn(`  ${stage.error}`, { node: currentId });
+                    result = { ...result, status: "failed", data: { ...result.data, error: stage.error } };
+                }
+            }
+            else if (intents.length > 0) {
+                result = {
+                    ...result,
+                    outputs: intents.map((i) => ({ type: i.type, status: "skipped", reason: "node did not succeed" })),
+                };
+            }
+        }
         if (skippedWrites.length > 0)
             result = { ...result, skippedWrites };
         results.set(currentId, result);
@@ -749,7 +866,10 @@ function filterNodeTools(tools, filter, nodeId, logger) {
     if (!filter)
         return tools;
     const resolvedNames = new Set(tools.map((t) => t.name));
-    for (const name of [...(filter.allow ?? []), ...(filter.deny ?? [])]) {
+    // A deny entry that names a tool class (write, shell, ...) targets built-in
+    // agent tools too, so it is not a typo when no skill tool has that name.
+    const denyNames = (filter.deny ?? []).filter((n) => !isToolClass(n));
+    for (const name of [...(filter.allow ?? []), ...denyNames]) {
         if (!resolvedNames.has(name)) {
             logger.warn(`  tools filter: '${name}' does not match any tool resolved for node '${nodeId}'`, {
                 node: nodeId,

package/dist/harness/abort.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Timeout + caller-signal wiring shared by every adapter. No agent SDK imports.
+ */
+/**
+ * Wire an optional timeout + caller signal onto a single AbortController.
+ *
+ * Returns undefined when neither a timeout nor a signal is supplied so the
+ * default code path (no abortController, no timer) is byte-for-byte unchanged.
+ *
+ * `reason()` reports whether the abort came from the timeout timer or an
+ * external signal, so callers can log a distinct timeout message.
+ */
+export declare function makeAbort(timeoutMs?: number, signal?: AbortSignal): {
+    controller: AbortController;
+    clear: () => void;
+    reason: () => "timeout" | "signal" | undefined;
+} | undefined;

package/dist/harness/abort.js

@@ -0,0 +1,53 @@
+/**
+ * Timeout + caller-signal wiring shared by every adapter. No agent SDK imports.
+ */
+/**
+ * Wire an optional timeout + caller signal onto a single AbortController.
+ *
+ * Returns undefined when neither a timeout nor a signal is supplied so the
+ * default code path (no abortController, no timer) is byte-for-byte unchanged.
+ *
+ * `reason()` reports whether the abort came from the timeout timer or an
+ * external signal, so callers can log a distinct timeout message.
+ */
+export function makeAbort(timeoutMs, signal) {
+    if (!timeoutMs && !signal)
+        return undefined;
+    const controller = new AbortController();
+    let reason;
+    let timer;
+    const onSignalAbort = () => {
+        if (controller.signal.aborted)
+            return;
+        reason = "signal";
+        controller.abort();
+    };
+    if (signal) {
+        if (signal.aborted) {
+            reason = "signal";
+            controller.abort();
+        }
+        else {
+            signal.addEventListener("abort", onSignalAbort, { once: true });
+        }
+    }
+    if (timeoutMs && timeoutMs > 0 && !controller.signal.aborted) {
+        timer = setTimeout(() => {
+            if (controller.signal.aborted)
+                return;
+            reason = "timeout";
+            controller.abort();
+        }, timeoutMs);
+        // Don't keep the event loop alive just for the abort timer.
+        timer?.unref?.();
+    }
+    return {
+        controller,
+        reason: () => reason,
+        clear: () => {
+            if (timer)
+                clearTimeout(timer);
+            signal?.removeEventListener("abort", onSignalAbort);
+        },
+    };
+}

package/dist/harness/agents.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The agent ids `--agent` / `coding-agent-provider` accept. Each one has an
+ * adapter and a green contract suite; anything else is refused, so sweny never
+ * runs one agent under another's name. No runtime imports (the CLI config and
+ * the harness factory share it).
+ */
+export declare const SUPPORTED_AGENTS: readonly ["claude", "codex"];
+export type SupportedAgent = (typeof SUPPORTED_AGENTS)[number];
+export declare function isSupportedAgent(id: string): id is SupportedAgent;
+/** The error for an agent id with no adapter. */
+export declare function unsupportedAgentError(id: string): string;

package/dist/harness/agents.js

@@ -0,0 +1,15 @@
+/**
+ * The agent ids `--agent` / `coding-agent-provider` accept. Each one has an
+ * adapter and a green contract suite; anything else is refused, so sweny never
+ * runs one agent under another's name. No runtime imports (the CLI config and
+ * the harness factory share it).
+ */
+export const SUPPORTED_AGENTS = ["claude", "codex"];
+export function isSupportedAgent(id) {
+    return SUPPORTED_AGENTS.includes(id);
+}
+/** The error for an agent id with no adapter. */
+export function unsupportedAgentError(id) {
+    return (`Unsupported coding agent "${id}": supported agents are "claude" (headless Claude Code) ` +
+        `and "codex" (Codex CLI). Remove --agent / coding-agent-provider or set it to one of them.`);
+}

package/dist/harness/capabilities.d.ts

@@ -5,3 +5,26 @@
 import type { HarnessCapabilities } from "./types.js";
 /** Claude Code enforces every sweny opinion natively, so `policyGate` never degrades or refuses it. */
 export declare const CLAUDE_CODE_CAPABILITIES: HarnessCapabilities;
+/**
+ * Codex (`codex exec --json`), declared from the openai/codex source at
+ * rust-v0.159.2 and probed by the contract suite against the scripted fake:
+ * - structuredOutput native: `--output-schema <file>` (exec/src/cli.rs).
+ * - toolTrace full: `item.*` events for command_execution, file_change,
+ *   mcp_tool_call and web_search, each with an id and a status
+ *   (exec/src/exec_events.rs).
+ * - builtinDeny shell-only, plus net and subagent: `features.shell_tool=false`
+ *   removes every shell tool (core/src/tools/spec_plan.rs add_shell_tools),
+ *   `web_search="disabled"` removes web search, and `features.multi_agent=false`
+ *   with `agents.enabled=false` removes subagents. apply_patch has no switch,
+ *   so write and edit cannot be denied as classes.
+ * - mcp exclusive native: `--ignore-user-config` drops `$CODEX_HOME/config.toml`,
+ *   and project `.codex/config.toml` layers stay disabled for a project that
+ *   is not trusted in that ignored file (config/src/loader/mod.rs).
+ * - sandbox fs only: `--sandbox read-only|workspace-write`. Network is one
+ *   on/off switch (`sandbox_workspace_write.network_access`), not a host list.
+ * - readOnly native: `--sandbox read-only` plus the shell, web search and
+ *   subagent switches above.
+ * - turnLimit watchdog: codex exec has no turn limit; sweny counts tool calls.
+ * - usage tokens only: `turn.completed.usage`; Codex reports no cost.
+ */
+export declare const CODEX_CAPABILITIES: HarnessCapabilities;

package/dist/harness/capabilities.js

@@ -15,3 +15,38 @@ export const CLAUDE_CODE_CAPABILITIES = {
     cancel: "signal",
     resume: false,
 };
+/**
+ * Codex (`codex exec --json`), declared from the openai/codex source at
+ * rust-v0.159.2 and probed by the contract suite against the scripted fake:
+ * - structuredOutput native: `--output-schema <file>` (exec/src/cli.rs).
+ * - toolTrace full: `item.*` events for command_execution, file_change,
+ *   mcp_tool_call and web_search, each with an id and a status
+ *   (exec/src/exec_events.rs).
+ * - builtinDeny shell-only, plus net and subagent: `features.shell_tool=false`
+ *   removes every shell tool (core/src/tools/spec_plan.rs add_shell_tools),
+ *   `web_search="disabled"` removes web search, and `features.multi_agent=false`
+ *   with `agents.enabled=false` removes subagents. apply_patch has no switch,
+ *   so write and edit cannot be denied as classes.
+ * - mcp exclusive native: `--ignore-user-config` drops `$CODEX_HOME/config.toml`,
+ *   and project `.codex/config.toml` layers stay disabled for a project that
+ *   is not trusted in that ignored file (config/src/loader/mod.rs).
+ * - sandbox fs only: `--sandbox read-only|workspace-write`. Network is one
+ *   on/off switch (`sandbox_workspace_write.network_access`), not a host list.
+ * - readOnly native: `--sandbox read-only` plus the shell, web search and
+ *   subagent switches above.
+ * - turnLimit watchdog: codex exec has no turn limit; sweny counts tool calls.
+ * - usage tokens only: `turn.completed.usage`; Codex reports no cost.
+ */
+export const CODEX_CAPABILITIES = {
+    structuredOutput: "native",
+    toolTrace: "full",
+    builtinDeny: "shell-only",
+    denyClasses: ["shell", "net", "subagent"],
+    mcp: { inject: true, exclusive: "native" },
+    sandbox: { fs: true, network: false },
+    readOnly: "native",
+    turnLimit: "watchdog",
+    usage: { tokens: true, costUsd: false, live: false },
+    cancel: "kill",
+    resume: false,
+};

package/dist/harness/claude-code.d.ts

@@ -10,10 +10,13 @@
  */
 import type { Claude, Tool, ToolContext, Logger, McpServerConfig } from "../types.js";
 import { type SandboxMode } from "../agent-env.js";
-import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult } from "./types.js";
+import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, ToolClass } from "./types.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
 import { buildEvaluatePrompt } from "./prompts.js";
+import { parseToolResultContent, summarizeToolError } from "./parse.js";
+import { makeAbort } from "./abort.js";
 export { buildEvaluatePrompt, CLAUDE_CODE_CAPABILITIES };
+export { parseToolResultContent, summarizeToolError, makeAbort };
 /**
  * Built-in tools disallowed for the route-evaluation (`evaluate`) and
  * reflection/judge (`ask`) calls.
@@ -34,6 +37,13 @@ export declare const CLASSIFICATION_DISALLOWED_TOOLS: readonly ["Bash", "Write",
  * Read, Grep, Glob and WebSearch stay available for analysis.
  */
 export declare const READ_ONLY_DISALLOWED_TOOLS: readonly ["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit", "Task", "Agent", "WebFetch"];
+/**
+ * Claude Code built-in tool names per portable tool class. A node's
+ * `tools.deny` classes compile to these names on `disallowedTools`.
+ */
+export declare const CLAUDE_TOOLS_BY_CLASS: Readonly<Record<ToolClass, readonly string[]>>;
+/** Native `disallowedTools` for a policy: legacy names, compiled classes, and the read-only set. */
+export declare function compileClaudeCodeDeny(policy: NodePolicy, legacy?: readonly string[]): string[];
 /** How sweny resolves which credentials reach the Claude Code subprocess. */
 export type SwenyAuthMode = "auto" | "api-key" | "oauth";
 export interface ResolveAuthEnvOpts {
@@ -120,20 +130,6 @@ export interface ClaudeCodeHarnessOptions {
         args: string[];
     };
 }
-/**
- * Wire an optional timeout + caller signal onto a single AbortController.
- *
- * Returns undefined when neither a timeout nor a signal is supplied so the
- * default code path (no abortController, no timer) is byte-for-byte unchanged.
- *
- * `reason()` reports whether the abort came from the timeout timer or an
- * external signal, so callers can log a distinct timeout message.
- */
-export declare function makeAbort(timeoutMs?: number, signal?: AbortSignal): {
-    controller: AbortController;
-    clear: () => void;
-    reason: () => "timeout" | "signal" | undefined;
-} | undefined;
 export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     readonly id: "claude-code";
     readonly capabilities: HarnessCapabilities;
@@ -171,9 +167,15 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
         version: string;
     }>;
     /**
-     * Run a node. The query itself is unchanged by the harness seam; this only
-     * runs {@link policyGate} (always `degraded: []` for Claude Code) and tags
-     * the result with the harness id and version.
+     * Run a node. Runs {@link policyGate} (always `degraded: []` for Claude
+     * Code), compiles the policy to native options, and tags the result with the
+     * harness id and version.
+     *
+     * Policy compile (#365): `policy.readOnly` (or the legacy `readOnly` flag)
+     * is a read-only run; `policy.deny` classes become native `disallowedTools`
+     * names, merged with `nativeDeny` and the legacy `disallowedTools`; and
+     * `policy.strict` makes MCP exclusive (`strictMcpConfig`) even for a
+     * write-capable node.
      */
     run(req: HarnessRunRequest): Promise<HarnessRunResult>;
     private runQuery;
@@ -227,28 +229,3 @@ export type ClaudeClient = ClaudeCodeHarness;
  * @internal Exported for the tool bridge parity test (#414).
  */
 export declare function coreToolToSdkTool(coreTool: Tool, defaultCtx: ToolContext): import("@anthropic-ai/claude-agent-sdk").SdkMcpToolDefinition<Record<string, import("zod").ZodType<any, import("zod").ZodTypeDef, any>>>;
-/**
- * Best-effort recovery of typed output from a tool_result's `content`.
- *
- * The MCP protocol sends tool results as string content. Our in-process
- * wrapper JSON-stringifies structured output before returning; external
- * MCP servers generally do the same for JSON payloads. If the string
- * looks like a JSON object or array and parses, return the parsed value
- * so verify's output-path walks work against typed data.
- *
- * Raw strings are preserved verbatim. JSON-primitive strings (e.g. the
- * literal four characters `"42"`) are intentionally NOT parsed - we
- * cannot distinguish a tool that returned the number 42 (wrapper sends
- * `"42"`) from a tool that returned the string "42" (wrapper also sends
- * `"42"`). Preserving the string is safer than guessing.
- */
-export declare function parseToolResultContent(content: unknown): unknown;
-/**
- * Produce a short, single-line description of a tool-error payload suitable
- * for the CI log stream. The full parsed value stays on the ToolCall for
- * verify and downstream tooling - this is only for inline observability.
- *
- * Collapses newlines, trims whitespace, and caps to 300 chars so a huge
- * API response body doesn't flood the log.
- */
-export declare function summarizeToolError(parsed: unknown): string;