@sweny-ai/core 0.1.143 → 0.1.144

package/dist/cli/main.js

@@ -964,6 +964,7 @@ export async function workflowRunAction(file, options) {
             fileRoot: config.fileRoot || undefined,
             signal,
             max_steps: wfMaxSteps,
+            stageOutputs: options.stage === true,
         }), wfTimeoutMs, `Workflow ${workflow.name}`);
         const wfDurationMs = Date.now() - runStart;
         const wfHasFailed = [...results.values()].some((r) => r.status === "failed");

package/dist/cli/run-output.js

@@ -198,6 +198,10 @@ export const WORKFLOW_RUN_OPTIONS = [
         "--dry-run",
         "Run with read-only tools only: write tools, external MCP servers, and shell/file-edit tools are withheld, so nothing is created, posted, or sent. Stops at the first conditional edge. To inspect nodes without running, use --list-nodes.",
     ],
+    [
+        "--stage",
+        "Run normally, but preview every safe output (nodes with outputs:) instead of writing it: print what would be written and write nothing",
+    ],
     ["--list-nodes", "Validate, print nodes and skills, and exit without running"],
     ["--json", "Output result as JSON on stdout; suppress progress output"],
     ["--stream", "Stream NDJSON events to stdout (for Studio / automation)"],

package/dist/executor.d.ts

@@ -14,6 +14,7 @@
  */
 import type { Workflow, Skill, Tool, Claude, Observer, Logger, ExecutionResult } from "./types.js";
 import type { AgentHarness } from "./harness/types.js";
+import { type ActorInfo } from "./safe-outputs.js";
 export interface ExecuteOptions {
     /** Registered skills (id → Skill) */
     skills: Map<string, Skill>;
@@ -73,6 +74,17 @@ export interface ExecuteOptions {
      * whole-run budget. Default: no timeout (back-compat).
      */
     timeoutMs?: number;
+    /**
+     * Safe outputs (#365): preview every write and apply none (CLI `--stage`).
+     * A dry run always stages. Default: false.
+     */
+    stageOutputs?: boolean;
+    /**
+     * Who triggered the run, for `safe_outputs.trusted_actors` /
+     * `trusted_associations`. Default: `GITHUB_ACTOR` and the author
+     * association in the `GITHUB_EVENT_PATH` payload.
+     */
+    actor?: ActorInfo;
 }
 /**
  * Default workflow-level step budget. Counts total node executions across the

package/dist/executor.js

@@ -23,7 +23,9 @@ import { validateWorkflow } from "./schema.js";
 import { resolveAgentAccess } from "./agent-env.js";
 import { fenceUntrusted } from "./untrusted.js";
 import { asClaude } from "./harness/compat.js";
-import { isToolClass } from "./harness/policy.js";
+import { isToolClass, policyGate } from "./harness/policy.js";
+import { buildNodePolicy, resolveNodePermissions } from "./node-policy.js";
+import { applySafeOutputs, createEmitOutputTool, createWriteStageState, resolveActor, safeOutputsInstruction, unresolvedOutputs, SAFE_OUTPUT_SCREEN_INSTRUCTION, } from "./safe-outputs.js";
 /**
  * Default workflow-level step budget. Counts total node executions across the
  * whole run (loop iterations included). Generous enough for legitimate deep
@@ -71,6 +73,13 @@ export async function execute(workflow, input, options) {
     let stepCount = 0; // total node executions across the run (loop iterations included)
     const trace = { steps: [], edges: [], sources: {} };
     validate(workflow, skills);
+    // Safe outputs (#365): run-wide caps and dedupe, the staged switch and the
+    // triggering actor, resolved once per run.
+    const writeState = createWriteStageState();
+    const stageOutputs = dryRun || options.stageOutputs === true || workflow.safe_outputs?.staged === true;
+    const runEnv = options.env ?? process.env;
+    const usesOutputs = Object.values(workflow.nodes).some((n) => (n.outputs?.length ?? 0) > 0);
+    const actor = usesOutputs ? resolveActor(runEnv, options.actor) : {};
     // Build an eval-time alias table from the loaded skills. Each skill owns
     // its own mapping between skill-tool names and equivalent MCP names. Core
     // stays vendor-neutral; this call just unions what the skills declare.
@@ -150,11 +159,32 @@ export async function execute(workflow, input, options) {
         // Dry run (#380): only `access: "read"` tools reach the node. Write and
         // unclassified tools are withheld (never registered, so never callable)
         // and recorded on the node result as `skippedWrites`.
-        const tools = dryRun ? filteredTools.filter(isReadTool) : filteredTools;
+        // #365: `permissions: read` (explicit, inherited, or implied by `outputs`)
+        // gets the same tool gate as a dry run.
+        const permissions = resolveNodePermissions(node, workflow);
+        const declaresPolicy = node.permissions !== undefined || workflow.permissions !== undefined || (node.outputs?.length ?? 0) > 0;
+        const readOnlyNode = dryRun || permissions.access === "read";
+        const readTools = readOnlyNode ? filteredTools.filter(isReadTool) : filteredTools;
         const skippedWrites = dryRun ? filteredTools.filter((t) => !isReadTool(t)).map((t) => t.name) : [];
         if (skippedWrites.length > 0) {
             logger.info(`  dry run: withheld write tools: ${skippedWrites.join(", ")}`, { node: currentId });
         }
+        else if (readOnlyNode && readTools.length < filteredTools.length) {
+            const withheld = filteredTools.filter((t) => !isReadTool(t)).map((t) => t.name);
+            logger.info(`  permissions: read: withheld write tools: ${withheld.join(", ")}`, { node: currentId });
+        }
+        // Safe outputs (#365): the agent records write intents with emit_output;
+        // the write stage after the node applies them. One buffer per attempt.
+        const outputDecls = node.outputs ?? [];
+        const intents = [];
+        const tools = outputDecls.length > 0 ? [...readTools, createEmitOutputTool(outputDecls, intents)] : readTools;
+        if (outputDecls.length > 0 && !stageOutputs) {
+            const missing = unresolvedOutputs(outputDecls, node.skills, skills);
+            if (missing.length > 0) {
+                throw new Error(`Node "${currentId}" declares outputs [${missing.join(", ")}] but no configured skill can apply them ` +
+                    `(github or linear). Set the skill's environment variables, or run with --stage to preview.`);
+            }
+        }
         const skillInstructions = resolveSkillInstructions(node.skills, skills);
         const skillMcpServers = resolveSkillMcpServers(node.skills, skills);
         // Runtime guard: if this node declares skills but none resolved, the node
@@ -227,7 +257,8 @@ export async function execute(workflow, input, options) {
         const effectiveRules = assembleCascaded("rules", currentId, workflow.nodes[currentId], inputRules.length, (workflow.rules ?? []).length, resolvedSources);
         const effectiveContext = assembleCascaded("context", currentId, workflow.nodes[currentId], inputContext.length, (workflow.context ?? []).length, resolvedSources);
         const baseInstruction = buildNodeInstruction(resolvedInstruction, effectiveRules, effectiveContext, input, skillInstructions);
-        const instruction = dryRun ? `${dryRunNotice(skippedWrites)}\n\n---\n\n${baseInstruction}` : baseInstruction;
+        const nodeInstruction = outputDecls.length > 0 ? `${baseInstruction}\n\n${safeOutputsInstruction(outputDecls)}` : baseInstruction;
+        const instruction = dryRun ? `${dryRunNotice(skippedWrites)}\n\n---\n\n${nodeInstruction}` : nodeInstruction;
         // Run Claude on this node, with optional eval-failure retry loop.
         let attempt = 0;
         let result;
@@ -246,7 +277,38 @@ export async function execute(workflow, input, options) {
         // compiles them or reports them in `degraded`.
         const denyClasses = (node.tools?.deny ?? []).filter(isToolClass);
         let degradedLogged = false;
+        const agentAccess = resolveAgentAccess(node.skills, skills);
+        // #365: a node or workflow that declares `permissions` or `outputs` gets
+        // one portable policy, compiled by each adapter. The gate also runs here so
+        // a strict refusal holds on every harness, before any spend. Nodes that
+        // declare neither pass no policy, so each harness keeps its own defaults.
+        const nodePolicy = declaresPolicy
+            ? buildNodePolicy({
+                permissions: { ...permissions, deny: [...new Set([...permissions.deny, ...denyClasses])] },
+                dryRun,
+                disallowedTools: node.disallowed_tools,
+                egress: agentAccess.domains,
+            })
+            : undefined;
+        // Egress is left to the adapter: only it knows whether a process sandbox
+        // wrapper covers what its native sandbox cannot.
+        const gate = nodePolicy && options.harness
+            ? policyGate(options.harness.capabilities, { ...nodePolicy, egress: [] })
+            : undefined;
         while (true) {
+            if (gate?.refuse) {
+                // Not an agent failure: fail_soft never softens a policy refusal.
+                logger.warn(`  harness refused the node: ${gate.refuse}`, { node: currentId });
+                result = {
+                    status: "failed",
+                    data: { error: gate.refuse, refused: true },
+                    toolCalls: [],
+                    degraded: gate.degraded,
+                };
+                break;
+            }
+            // Only the final attempt's intents may be applied.
+            intents.length = 0;
             result = await claude.run({
                 instruction: currentInstruction,
                 context,
@@ -258,9 +320,10 @@ export async function execute(workflow, input, options) {
                 model: nodeModel,
                 signal,
                 timeoutMs,
-                agentAccess: resolveAgentAccess(node.skills, skills),
-                ...(dryRun ? {} : { mcpServers: skillMcpServers }),
-                ...(dryRun ? { readOnly: true } : {}),
+                agentAccess,
+                ...(nodePolicy ? { policy: nodePolicy } : {}),
+                ...(readOnlyNode ? {} : { mcpServers: skillMcpServers }),
+                ...(readOnlyNode ? { readOnly: true } : {}),
                 onProgress: (message) => {
                     safeObserve(observer, { type: "node:progress", node: currentId, message }, logger);
                 },
@@ -381,6 +444,45 @@ export async function execute(workflow, input, options) {
                 data: { ...(result.data ?? {}), fail_soft: true },
             };
         }
+        // Safe outputs write stage (#365). Runs only after the agent finished and
+        // every eval passed; deterministic checks first, an optional model screen
+        // may veto, and only then does sweny call the skill's own write handler.
+        if (outputDecls.length > 0) {
+            if (result.status === "success" && !agentRunFailed) {
+                const stage = await applySafeOutputs({
+                    nodeId: currentId,
+                    declarations: outputDecls,
+                    intents,
+                    policy: workflow.safe_outputs,
+                    nodeSkills: node.skills,
+                    skills,
+                    config,
+                    env: runEnv,
+                    actor,
+                    staged: stageOutputs,
+                    state: writeState,
+                    logger,
+                    screen: async (writes) => claude.ask({
+                        instruction: SAFE_OUTPUT_SCREEN_INSTRUCTION,
+                        context: { writes },
+                        model: nodeModel,
+                        signal,
+                        timeoutMs,
+                    }),
+                });
+                result = { ...result, outputs: stage.receipts };
+                if (stage.error) {
+                    logger.warn(`  ${stage.error}`, { node: currentId });
+                    result = { ...result, status: "failed", data: { ...result.data, error: stage.error } };
+                }
+            }
+            else if (intents.length > 0) {
+                result = {
+                    ...result,
+                    outputs: intents.map((i) => ({ type: i.type, status: "skipped", reason: "node did not succeed" })),
+                };
+            }
+        }
         if (skippedWrites.length > 0)
             result = { ...result, skippedWrites };
         results.set(currentId, result);

package/dist/harness/claude-code.d.ts

@@ -10,7 +10,7 @@
  */
 import type { Claude, Tool, ToolContext, Logger, McpServerConfig } from "../types.js";
 import { type SandboxMode } from "../agent-env.js";
-import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
+import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, ToolClass } from "./types.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
 import { buildEvaluatePrompt } from "./prompts.js";
 import { parseToolResultContent, summarizeToolError } from "./parse.js";
@@ -42,6 +42,8 @@ export declare const READ_ONLY_DISALLOWED_TOOLS: readonly ["Bash", "Write", "Edi
  * `tools.deny` classes compile to these names on `disallowedTools`.
  */
 export declare const CLAUDE_TOOLS_BY_CLASS: Readonly<Record<ToolClass, readonly string[]>>;
+/** Native `disallowedTools` for a policy: legacy names, compiled classes, and the read-only set. */
+export declare function compileClaudeCodeDeny(policy: NodePolicy, legacy?: readonly string[]): string[];
 /** How sweny resolves which credentials reach the Claude Code subprocess. */
 export type SwenyAuthMode = "auto" | "api-key" | "oauth";
 export interface ResolveAuthEnvOpts {
@@ -165,9 +167,15 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
         version: string;
     }>;
     /**
-     * Run a node. The query itself is unchanged by the harness seam; this only
-     * runs {@link policyGate} (always `degraded: []` for Claude Code) and tags
-     * the result with the harness id and version.
+     * Run a node. Runs {@link policyGate} (always `degraded: []` for Claude
+     * Code), compiles the policy to native options, and tags the result with the
+     * harness id and version.
+     *
+     * Policy compile (#365): `policy.readOnly` (or the legacy `readOnly` flag)
+     * is a read-only run; `policy.deny` classes become native `disallowedTools`
+     * names, merged with `nativeDeny` and the legacy `disallowedTools`; and
+     * `policy.strict` makes MCP exclusive (`strictMcpConfig`) even for a
+     * write-capable node.
      */
     run(req: HarnessRunRequest): Promise<HarnessRunResult>;
     private runQuery;

package/dist/harness/claude-code.js

@@ -85,6 +85,17 @@ export const CLAUDE_TOOLS_BY_CLASS = {
     net: ["WebFetch", "WebSearch"],
     subagent: ["Task", "Agent"],
 };
+/** Native `disallowedTools` for a policy: legacy names, compiled classes, and the read-only set. */
+export function compileClaudeCodeDeny(policy, legacy = []) {
+    return [
+        ...new Set([
+            ...legacy,
+            ...(policy.nativeDeny ?? []),
+            ...policy.deny.flatMap((c) => CLAUDE_TOOLS_BY_CLASS[c] ?? []),
+            ...(policy.readOnly ? READ_ONLY_DISALLOWED_TOOLS : []),
+        ]),
+    ];
+}
 /**
  * Decide which auth credentials survive into the Claude Code subprocess env.
  *
@@ -253,9 +264,15 @@ export class ClaudeCodeHarness {
         return { ok: true, version: claudeSdkVersion() };
     }
     /**
-     * Run a node. The query itself is unchanged by the harness seam; this only
-     * runs {@link policyGate} (always `degraded: []` for Claude Code) and tags
-     * the result with the harness id and version.
+     * Run a node. Runs {@link policyGate} (always `degraded: []` for Claude
+     * Code), compiles the policy to native options, and tags the result with the
+     * harness id and version.
+     *
+     * Policy compile (#365): `policy.readOnly` (or the legacy `readOnly` flag)
+     * is a read-only run; `policy.deny` classes become native `disallowedTools`
+     * names, merged with `nativeDeny` and the legacy `disallowedTools`; and
+     * `policy.strict` makes MCP exclusive (`strictMcpConfig`) even for a
+     * write-capable node.
      */
     async run(req) {
         const policy = req.policy ?? {
@@ -266,10 +283,25 @@ export class ClaudeCodeHarness {
             strict: false,
         };
         const gate = policyGate(this.capabilities, policy);
-        // Portable deny classes (`tools.deny: [write]`) compile to Claude Code tool names.
-        const classNames = policy.deny.flatMap((c) => CLAUDE_TOOLS_BY_CLASS[c] ?? []);
-        const disallowedTools = classNames.length > 0 ? [...new Set([...(req.disallowedTools ?? []), ...classNames])] : req.disallowedTools;
-        const result = await this.runQuery({ ...req, disallowedTools });
+        if (gate.refuse) {
+            this.logger.error(gate.refuse);
+            return {
+                status: "failed",
+                // `refused` keeps fail_soft from softening a policy refusal (executor.ts).
+                data: { error: gate.refuse, refused: true },
+                toolCalls: [],
+                harness: this.info(),
+                degraded: gate.degraded,
+            };
+        }
+        const readOnly = !!req.readOnly || policy.readOnly;
+        const disallowedTools = compileClaudeCodeDeny(policy, req.disallowedTools ?? []);
+        const result = await this.runQuery({
+            ...req,
+            readOnly,
+            disallowedTools: disallowedTools.length > 0 ? disallowedTools : undefined,
+            strictMcp: readOnly || policy.strict,
+        });
         return { ...result, harness: this.info(), degraded: gate.degraded };
     }
     async runQuery(opts) {
@@ -396,7 +428,8 @@ export class ClaudeCodeHarness {
                     // project and local settings, including their MCP servers (and
                     // project .mcp.json, plugins). strictMcpConfig limits MCP to the
                     // servers passed above, which under readOnly is only sweny-core.
-                    ...(readOnly ? { strictMcpConfig: true } : {}),
+                    // A strict policy (#365) makes it exclusive for write nodes too.
+                    ...(readOnly || opts.strictMcp ? { strictMcpConfig: true } : {}),
                     ...(disallowedTools && disallowedTools.length > 0 ? { disallowedTools } : {}),
                     // CC-08: ask the SDK to produce validated structured output when the
                     // node declares an output schema. The SDK then returns the parsed

package/dist/harness/codex.js

@@ -338,13 +338,17 @@ export class CodexHarness {
     }
     /** The node policy after `disallowed_tools` names are translated into Codex classes. */
     compilePolicy(req, maxTurns) {
-        const base = req.policy ?? {
-            readOnly: !!req.readOnly,
-            deny: req.deny ?? [],
-            nativeDeny: req.disallowedTools,
-            egress: req.agentAccess?.domains ?? [],
-            strict: this.policyMode === "strict",
-        };
+        // A node policy (#365) can make the run stricter, never looser than the
+        // harness policy mode.
+        const base = req.policy
+            ? { ...req.policy, strict: req.policy.strict || this.policyMode === "strict" }
+            : {
+                readOnly: !!req.readOnly,
+                deny: req.deny ?? [],
+                nativeDeny: req.disallowedTools,
+                egress: req.agentAccess?.domains ?? [],
+                strict: this.policyMode === "strict",
+            };
         const { classes, unknown } = translateDenyNames(base.nativeDeny);
         return {
             ...base,

package/dist/index.d.ts

@@ -21,12 +21,16 @@
  * })
  * ```
  */
-export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, Source, ResolvedSource, SourceKind, SourceResolutionMap, WorkflowInputs, WorkflowInputField, WorkflowInputType, InputValidationError, InputValidationResult, Evaluator, EvaluatorRule, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, NodeToolFilter, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, NodeOnFail, McpTransport, WorkflowType, SkillHarnessKey, } from "./types.js";
+export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, Source, ResolvedSource, SourceKind, SourceResolutionMap, WorkflowInputs, WorkflowInputField, WorkflowInputType, InputValidationError, InputValidationResult, Evaluator, EvaluatorRule, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, NodeToolFilter, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, NodeOnFail, McpTransport, WorkflowType, SkillHarnessKey, NodeAccess, NodePermissions, NodePermissionsSpec, SafeOutputType, SafeOutputDeclaration, SafeOutputsPolicy, SafeOutputReceipt, AuthorAssociation, } from "./types.js";
 export { WORKFLOW_INPUT_TYPES } from "./types.js";
-export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, } from "./types.js";
+export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, NODE_ACCESS, TOOL_CLASSES, SAFE_OUTPUT_TYPES, SAFE_OUTPUT_APPLIERS, AUTHOR_ASSOCIATIONS, } from "./types.js";
 export { consoleLogger } from "./types.js";
 export { execute, RouteEvaluationError } from "./executor.js";
 export type { ExecuteOptions } from "./executor.js";
+export { resolveNodePermissions, buildNodePolicy } from "./node-policy.js";
+export type { ResolvedPermissions } from "./node-policy.js";
+export { applySafeOutputs, createEmitOutputTool, resolveActor, EMIT_OUTPUT_TOOL } from "./safe-outputs.js";
+export type { SafeOutputIntent, ActorInfo, WriteStageState } from "./safe-outputs.js";
 export { createHarness, claudeCompat, asClaude, policyGate, ClaudeCodeHarness, CodexHarness, SUPPORTED_AGENTS, } from "./harness/index.js";
 export type { AgentHarness, HarnessCapabilities, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, PolicyGateResult, PolicyWrappers, ToolClass, ClaudeCodeHarnessOptions, CodexHarnessOptions, } from "./harness/index.js";
 export { ClaudeClient, resolveAuthEnv } from "./harness/claude-code.js";

package/dist/index.js

@@ -23,10 +23,13 @@
  */
 export { WORKFLOW_INPUT_TYPES } from "./types.js";
 // Runtime enum constants + skill-id helpers
-export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, } from "./types.js";
+export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, NODE_ACCESS, TOOL_CLASSES, SAFE_OUTPUT_TYPES, SAFE_OUTPUT_APPLIERS, AUTHOR_ASSOCIATIONS, } from "./types.js";
 export { consoleLogger } from "./types.js";
 // Executor
 export { execute, RouteEvaluationError } from "./executor.js";
+// Least-privilege nodes and safe outputs (#365)
+export { resolveNodePermissions, buildNodePolicy } from "./node-policy.js";
+export { applySafeOutputs, createEmitOutputTool, resolveActor, EMIT_OUTPUT_TOOL } from "./safe-outputs.js";
 // Agent harness (the seam) and its adapters: Claude Code and Codex
 export { createHarness, claudeCompat, asClaude, policyGate, ClaudeCodeHarness, CodexHarness, SUPPORTED_AGENTS, } from "./harness/index.js";
 // Claude client (back-compat: ClaudeClient is ClaudeCodeHarness, @deprecated)

package/dist/node-policy.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Node permissions (#365): resolve what a node's agent may do.
+ *
+ * Pure and browser-safe. The workflow's `permissions` is both the default and
+ * the ceiling for every node; a node may narrow it, never widen it.
+ */
+import type { NodePolicy, ToolClass } from "./harness/types.js";
+import type { Node, NodeAccess, Workflow } from "./types.js";
+export interface ResolvedPermissions {
+    access: NodeAccess;
+    deny: ToolClass[];
+    strict: boolean;
+}
+/**
+ * Effective permissions for a node.
+ *
+ * access: the node's own, else `read` when it declares `outputs`, else the
+ * workflow's, else `write` (today's behavior). A workflow `read` ceiling wins
+ * over a node `write` (the loader rejects that combination; this is the
+ * runtime backstop). deny: union. strict: either.
+ */
+export declare function resolveNodePermissions(node: Pick<Node, "permissions" | "outputs">, workflow?: Pick<Workflow, "permissions">): ResolvedPermissions;
+/** True when a node asks for more than the workflow ceiling allows. */
+export declare function exceedsPermissionCeiling(node: Pick<Node, "permissions">, workflow: Pick<Workflow, "permissions">): boolean;
+/** The portable policy handed to the harness for one node run. */
+export declare function buildNodePolicy(opts: {
+    permissions: ResolvedPermissions;
+    dryRun: boolean;
+    disallowedTools?: string[];
+    egress?: string[];
+}): NodePolicy;

package/dist/node-policy.js

@@ -0,0 +1,42 @@
+/**
+ * Node permissions (#365): resolve what a node's agent may do.
+ *
+ * Pure and browser-safe. The workflow's `permissions` is both the default and
+ * the ceiling for every node; a node may narrow it, never widen it.
+ */
+function spec(p) {
+    if (p === undefined)
+        return {};
+    return typeof p === "string" ? { access: p } : p;
+}
+/**
+ * Effective permissions for a node.
+ *
+ * access: the node's own, else `read` when it declares `outputs`, else the
+ * workflow's, else `write` (today's behavior). A workflow `read` ceiling wins
+ * over a node `write` (the loader rejects that combination; this is the
+ * runtime backstop). deny: union. strict: either.
+ */
+export function resolveNodePermissions(node, workflow = {}) {
+    const wf = spec(workflow.permissions);
+    const own = spec(node.permissions);
+    let access = own.access ?? (node.outputs && node.outputs.length > 0 ? "read" : (wf.access ?? "write"));
+    if (wf.access === "read")
+        access = "read";
+    const deny = [...new Set([...(wf.deny ?? []), ...(own.deny ?? [])])];
+    return { access, deny, strict: wf.strict === true || own.strict === true };
+}
+/** True when a node asks for more than the workflow ceiling allows. */
+export function exceedsPermissionCeiling(node, workflow) {
+    return spec(workflow.permissions).access === "read" && spec(node.permissions).access === "write";
+}
+/** The portable policy handed to the harness for one node run. */
+export function buildNodePolicy(opts) {
+    return {
+        readOnly: opts.dryRun || opts.permissions.access === "read",
+        deny: opts.permissions.deny,
+        ...(opts.disallowedTools && opts.disallowedTools.length > 0 ? { nativeDeny: opts.disallowedTools } : {}),
+        egress: opts.egress ?? [],
+        strict: opts.permissions.strict,
+    };
+}

package/dist/safe-outputs.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Safe outputs (#365): a deterministic write boundary for any agent.
+ *
+ * A node that declares `outputs` gets one extra tool, `emit_output`, which only
+ * records a typed write intent in memory. After the node succeeds, the write
+ * stage ({@link applySafeOutputs}) checks every intent against the node's
+ * declarations and the workflow's `safe_outputs` policy, then applies what
+ * passes by calling the owning skill's own tool handler. The agent never holds
+ * the write, so this holds on every harness.
+ *
+ * Order of checks per intent (all deterministic): declared type, workflow
+ * ceiling, actor trust, expiry, skill, target pin, shape and size, labels,
+ * title prefix, dedupe, node cap, run cap. An optional model screen runs last
+ * over the intents that passed and can only veto them.
+ */
+import type { Logger, SafeOutputDeclaration, SafeOutputReceipt, SafeOutputsPolicy, SafeOutputType, Skill, Tool } from "./types.js";
+/** Name of the intent-recording tool a node with `outputs` receives. */
+export declare const EMIT_OUTPUT_TOOL = "emit_output";
+/** Longest title the write stage accepts (after the prefix). */
+export declare const SAFE_OUTPUT_TITLE_MAX = 256;
+/** Longest body the write stage accepts (GitHub's own limit). */
+export declare const SAFE_OUTPUT_BODY_MAX = 65536;
+/** One write the agent asked for. Recorded by `emit_output`, never applied by it. */
+export interface SafeOutputIntent {
+    type: string;
+    title?: string;
+    body?: string;
+    target?: string;
+    /** Issue / PR number (GitHub) or issue id (Linear) for comment and label. */
+    number?: string;
+    labels?: string[];
+    head?: string;
+    base?: string;
+    dedupe_key?: string;
+    /** ms since epoch when the intent was recorded. */
+    recordedAt: number;
+}
+/**
+ * Build the `emit_output` tool for one node. `access: "read"`: it changes
+ * nothing outside the run, so it survives dry runs and read-only nodes.
+ * Its checks are advisory (they tell the agent early); the write stage
+ * re-checks everything.
+ */
+export declare function createEmitOutputTool(declarations: SafeOutputDeclaration[], buffer: SafeOutputIntent[], now?: () => number): Tool;
+/** Instruction block that tells the agent how writes work at this node. */
+export declare function safeOutputsInstruction(declarations: SafeOutputDeclaration[]): string;
+export interface ActorInfo {
+    /** GitHub login of whoever triggered the run. */
+    login?: string;
+    /** Author association of the event's comment, review, issue or PR author. */
+    association?: string;
+}
+/** Who triggered this run: an explicit override, else GitHub Actions' env and event payload. */
+export declare function resolveActor(env: Record<string, string | undefined>, override?: ActorInfo): ActorInfo;
+/** True when no trust list is declared, or the actor matches one. Unknown actor = untrusted. */
+export declare function actorTrusted(policy: SafeOutputsPolicy | undefined, actor: ActorInfo): boolean;
+/** `30m` → 1_800_000. Undefined for anything the schema would reject. */
+export declare function parseDuration(s: string | undefined): number | undefined;
+/** The skill that applies a declaration: its `via`, else the first node skill (then any loaded skill) that can. */
+export declare function resolveOutputSkill(decl: SafeOutputDeclaration, nodeSkills: string[], skills: Map<string, Skill>): string | undefined;
+/** Declarations whose applying skill is not configured (no credentials loaded). */
+export declare function unresolvedOutputs(declarations: SafeOutputDeclaration[], nodeSkills: string[], skills: Map<string, Skill>): SafeOutputType[];
+/** Run-wide counters shared by every node's write stage in one execute() call. */
+export interface WriteStageState {
+    /** `${nodeId}:${type}` → writes accepted (applied or staged). */
+    counts: Map<string, number>;
+    /** Writes accepted across the run. */
+    total: number;
+    /** Dedupe keys already accepted this run. */
+    seen: Set<string>;
+}
+export declare function createWriteStageState(): WriteStageState;
+export interface ApplySafeOutputsOptions {
+    nodeId: string;
+    declarations: SafeOutputDeclaration[];
+    intents: SafeOutputIntent[];
+    policy?: SafeOutputsPolicy;
+    nodeSkills: string[];
+    skills: Map<string, Skill>;
+    /** Resolved skill config (credentials), handed to the skill's tool handler. */
+    config: Record<string, string>;
+    env: Record<string, string | undefined>;
+    actor: ActorInfo;
+    /** Preview only: print what would be written, write nothing. */
+    staged: boolean;
+    state: WriteStageState;
+    logger: Logger;
+    /**
+     * Model screen (only called when `policy.screen` is on and at least one write
+     * passed every deterministic check). Anything but `ALLOW` is a veto.
+     */
+    screen?: (writes: Record<string, unknown>[]) => Promise<string | null>;
+    now?: () => number;
+}
+export interface ApplySafeOutputsResult {
+    receipts: SafeOutputReceipt[];
+    /** Set when an apply call failed; the node fails with it. */
+    error?: string;
+}
+/** Check, then apply (or stage) one node's intents. See the module comment for the order of checks. */
+export declare function applySafeOutputs(o: ApplySafeOutputsOptions): Promise<ApplySafeOutputsResult>;
+/** Instruction for the optional screen. The writes arrive as fenced, untrusted context. */
+export declare const SAFE_OUTPUT_SCREEN_INSTRUCTION: string;