@sweny-ai/core 0.1.143 → 0.1.145

package/dist/cli/main.js

@@ -964,6 +964,7 @@ export async function workflowRunAction(file, options) {
             fileRoot: config.fileRoot || undefined,
             signal,
             max_steps: wfMaxSteps,
+            stageOutputs: options.stage === true,
         }), wfTimeoutMs, `Workflow ${workflow.name}`);
         const wfDurationMs = Date.now() - runStart;
         const wfHasFailed = [...results.values()].some((r) => r.status === "failed");

package/dist/cli/run-output.js

@@ -198,6 +198,10 @@ export const WORKFLOW_RUN_OPTIONS = [
         "--dry-run",
         "Run with read-only tools only: write tools, external MCP servers, and shell/file-edit tools are withheld, so nothing is created, posted, or sent. Stops at the first conditional edge. To inspect nodes without running, use --list-nodes.",
     ],
+    [
+        "--stage",
+        "Run normally, but preview every safe output (nodes with outputs:) instead of writing it: print what would be written and write nothing",
+    ],
     ["--list-nodes", "Validate, print nodes and skills, and exit without running"],
     ["--json", "Output result as JSON on stdout; suppress progress output"],
     ["--stream", "Stream NDJSON events to stdout (for Studio / automation)"],

package/dist/executor.d.ts

@@ -14,6 +14,7 @@
  */
 import type { Workflow, Skill, Tool, Claude, Observer, Logger, ExecutionResult } from "./types.js";
 import type { AgentHarness } from "./harness/types.js";
+import { type ActorInfo } from "./safe-outputs.js";
 export interface ExecuteOptions {
     /** Registered skills (id → Skill) */
     skills: Map<string, Skill>;
@@ -73,6 +74,17 @@ export interface ExecuteOptions {
      * whole-run budget. Default: no timeout (back-compat).
      */
     timeoutMs?: number;
+    /**
+     * Safe outputs (#365): preview every write and apply none (CLI `--stage`).
+     * A dry run always stages. Default: false.
+     */
+    stageOutputs?: boolean;
+    /**
+     * Who triggered the run, for `safe_outputs.trusted_actors` /
+     * `trusted_associations`. Default: `GITHUB_ACTOR` and the author
+     * association in the `GITHUB_EVENT_PATH` payload.
+     */
+    actor?: ActorInfo;
 }
 /**
  * Default workflow-level step budget. Counts total node executions across the

package/dist/executor.js

@@ -23,7 +23,9 @@ import { validateWorkflow } from "./schema.js";
 import { resolveAgentAccess } from "./agent-env.js";
 import { fenceUntrusted } from "./untrusted.js";
 import { asClaude } from "./harness/compat.js";
-import { isToolClass } from "./harness/policy.js";
+import { isToolClass, policyGate } from "./harness/policy.js";
+import { buildNodePolicy, resolveNodePermissions } from "./node-policy.js";
+import { applySafeOutputs, createEmitOutputTool, createWriteStageState, resolveActor, safeOutputsInstruction, unresolvedOutputs, SAFE_OUTPUT_SCREEN_INSTRUCTION, } from "./safe-outputs.js";
 /**
  * Default workflow-level step budget. Counts total node executions across the
  * whole run (loop iterations included). Generous enough for legitimate deep
@@ -71,6 +73,13 @@ export async function execute(workflow, input, options) {
     let stepCount = 0; // total node executions across the run (loop iterations included)
     const trace = { steps: [], edges: [], sources: {} };
     validate(workflow, skills);
+    // Safe outputs (#365): run-wide caps and dedupe, the staged switch and the
+    // triggering actor, resolved once per run.
+    const writeState = createWriteStageState();
+    const stageOutputs = dryRun || options.stageOutputs === true || workflow.safe_outputs?.staged === true;
+    const runEnv = options.env ?? process.env;
+    const usesOutputs = Object.values(workflow.nodes).some((n) => (n.outputs?.length ?? 0) > 0);
+    const actor = usesOutputs ? resolveActor(runEnv, options.actor) : {};
     // Build an eval-time alias table from the loaded skills. Each skill owns
     // its own mapping between skill-tool names and equivalent MCP names. Core
     // stays vendor-neutral; this call just unions what the skills declare.
@@ -150,11 +159,32 @@ export async function execute(workflow, input, options) {
         // Dry run (#380): only `access: "read"` tools reach the node. Write and
         // unclassified tools are withheld (never registered, so never callable)
         // and recorded on the node result as `skippedWrites`.
-        const tools = dryRun ? filteredTools.filter(isReadTool) : filteredTools;
+        // #365: `permissions: read` (explicit, inherited, or implied by `outputs`)
+        // gets the same tool gate as a dry run.
+        const permissions = resolveNodePermissions(node, workflow);
+        const declaresPolicy = node.permissions !== undefined || workflow.permissions !== undefined || (node.outputs?.length ?? 0) > 0;
+        const readOnlyNode = dryRun || permissions.access === "read";
+        const readTools = readOnlyNode ? filteredTools.filter(isReadTool) : filteredTools;
         const skippedWrites = dryRun ? filteredTools.filter((t) => !isReadTool(t)).map((t) => t.name) : [];
         if (skippedWrites.length > 0) {
             logger.info(`  dry run: withheld write tools: ${skippedWrites.join(", ")}`, { node: currentId });
         }
+        else if (readOnlyNode && readTools.length < filteredTools.length) {
+            const withheld = filteredTools.filter((t) => !isReadTool(t)).map((t) => t.name);
+            logger.info(`  permissions: read: withheld write tools: ${withheld.join(", ")}`, { node: currentId });
+        }
+        // Safe outputs (#365): the agent records write intents with emit_output;
+        // the write stage after the node applies them. One buffer per attempt.
+        const outputDecls = node.outputs ?? [];
+        const intents = [];
+        const tools = outputDecls.length > 0 ? [...readTools, createEmitOutputTool(outputDecls, intents)] : readTools;
+        if (outputDecls.length > 0 && !stageOutputs) {
+            const missing = unresolvedOutputs(outputDecls, node.skills, skills);
+            if (missing.length > 0) {
+                throw new Error(`Node "${currentId}" declares outputs [${missing.join(", ")}] but no configured skill can apply them ` +
+                    `(github or linear). Set the skill's environment variables, or run with --stage to preview.`);
+            }
+        }
         const skillInstructions = resolveSkillInstructions(node.skills, skills);
         const skillMcpServers = resolveSkillMcpServers(node.skills, skills);
         // Runtime guard: if this node declares skills but none resolved, the node
@@ -227,7 +257,8 @@ export async function execute(workflow, input, options) {
         const effectiveRules = assembleCascaded("rules", currentId, workflow.nodes[currentId], inputRules.length, (workflow.rules ?? []).length, resolvedSources);
         const effectiveContext = assembleCascaded("context", currentId, workflow.nodes[currentId], inputContext.length, (workflow.context ?? []).length, resolvedSources);
         const baseInstruction = buildNodeInstruction(resolvedInstruction, effectiveRules, effectiveContext, input, skillInstructions);
-        const instruction = dryRun ? `${dryRunNotice(skippedWrites)}\n\n---\n\n${baseInstruction}` : baseInstruction;
+        const nodeInstruction = outputDecls.length > 0 ? `${baseInstruction}\n\n${safeOutputsInstruction(outputDecls)}` : baseInstruction;
+        const instruction = dryRun ? `${dryRunNotice(skippedWrites)}\n\n---\n\n${nodeInstruction}` : nodeInstruction;
         // Run Claude on this node, with optional eval-failure retry loop.
         let attempt = 0;
         let result;
@@ -246,7 +277,38 @@ export async function execute(workflow, input, options) {
         // compiles them or reports them in `degraded`.
         const denyClasses = (node.tools?.deny ?? []).filter(isToolClass);
         let degradedLogged = false;
+        const agentAccess = resolveAgentAccess(node.skills, skills);
+        // #365: a node or workflow that declares `permissions` or `outputs` gets
+        // one portable policy, compiled by each adapter. The gate also runs here so
+        // a strict refusal holds on every harness, before any spend. Nodes that
+        // declare neither pass no policy, so each harness keeps its own defaults.
+        const nodePolicy = declaresPolicy
+            ? buildNodePolicy({
+                permissions: { ...permissions, deny: [...new Set([...permissions.deny, ...denyClasses])] },
+                dryRun,
+                disallowedTools: node.disallowed_tools,
+                egress: agentAccess.domains,
+            })
+            : undefined;
+        // Egress is left to the adapter: only it knows whether a process sandbox
+        // wrapper covers what its native sandbox cannot.
+        const gate = nodePolicy && options.harness
+            ? policyGate(options.harness.capabilities, { ...nodePolicy, egress: [] })
+            : undefined;
         while (true) {
+            if (gate?.refuse) {
+                // Not an agent failure: fail_soft never softens a policy refusal.
+                logger.warn(`  harness refused the node: ${gate.refuse}`, { node: currentId });
+                result = {
+                    status: "failed",
+                    data: { error: gate.refuse, refused: true },
+                    toolCalls: [],
+                    degraded: gate.degraded,
+                };
+                break;
+            }
+            // Only the final attempt's intents may be applied.
+            intents.length = 0;
             result = await claude.run({
                 instruction: currentInstruction,
                 context,
@@ -258,9 +320,10 @@ export async function execute(workflow, input, options) {
                 model: nodeModel,
                 signal,
                 timeoutMs,
-                agentAccess: resolveAgentAccess(node.skills, skills),
-                ...(dryRun ? {} : { mcpServers: skillMcpServers }),
-                ...(dryRun ? { readOnly: true } : {}),
+                agentAccess,
+                ...(nodePolicy ? { policy: nodePolicy } : {}),
+                ...(readOnlyNode ? {} : { mcpServers: skillMcpServers }),
+                ...(readOnlyNode ? { readOnly: true } : {}),
                 onProgress: (message) => {
                     safeObserve(observer, { type: "node:progress", node: currentId, message }, logger);
                 },
@@ -381,6 +444,45 @@ export async function execute(workflow, input, options) {
                 data: { ...(result.data ?? {}), fail_soft: true },
             };
         }
+        // Safe outputs write stage (#365). Runs only after the agent finished and
+        // every eval passed; deterministic checks first, an optional model screen
+        // may veto, and only then does sweny call the skill's own write handler.
+        if (outputDecls.length > 0) {
+            if (result.status === "success" && !agentRunFailed) {
+                const stage = await applySafeOutputs({
+                    nodeId: currentId,
+                    declarations: outputDecls,
+                    intents,
+                    policy: workflow.safe_outputs,
+                    nodeSkills: node.skills,
+                    skills,
+                    config,
+                    env: runEnv,
+                    actor,
+                    staged: stageOutputs,
+                    state: writeState,
+                    logger,
+                    screen: async (writes) => claude.ask({
+                        instruction: SAFE_OUTPUT_SCREEN_INSTRUCTION,
+                        context: { writes },
+                        model: nodeModel,
+                        signal,
+                        timeoutMs,
+                    }),
+                });
+                result = { ...result, outputs: stage.receipts };
+                if (stage.error) {
+                    logger.warn(`  ${stage.error}`, { node: currentId });
+                    result = { ...result, status: "failed", data: { ...result.data, error: stage.error } };
+                }
+            }
+            else if (intents.length > 0) {
+                result = {
+                    ...result,
+                    outputs: intents.map((i) => ({ type: i.type, status: "skipped", reason: "node did not succeed" })),
+                };
+            }
+        }
         if (skippedWrites.length > 0)
             result = { ...result, skippedWrites };
         results.set(currentId, result);

package/dist/harness/claude-code.d.ts

@@ -10,7 +10,7 @@
  */
 import type { Claude, Tool, ToolContext, Logger, McpServerConfig } from "../types.js";
 import { type SandboxMode } from "../agent-env.js";
-import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
+import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, ToolClass } from "./types.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
 import { buildEvaluatePrompt } from "./prompts.js";
 import { parseToolResultContent, summarizeToolError } from "./parse.js";
@@ -42,6 +42,8 @@ export declare const READ_ONLY_DISALLOWED_TOOLS: readonly ["Bash", "Write", "Edi
  * `tools.deny` classes compile to these names on `disallowedTools`.
  */
 export declare const CLAUDE_TOOLS_BY_CLASS: Readonly<Record<ToolClass, readonly string[]>>;
+/** Native `disallowedTools` for a policy: legacy names, compiled classes, and the read-only set. */
+export declare function compileClaudeCodeDeny(policy: NodePolicy, legacy?: readonly string[]): string[];
 /** How sweny resolves which credentials reach the Claude Code subprocess. */
 export type SwenyAuthMode = "auto" | "api-key" | "oauth";
 export interface ResolveAuthEnvOpts {
@@ -165,9 +167,15 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
         version: string;
     }>;
     /**
-     * Run a node. The query itself is unchanged by the harness seam; this only
-     * runs {@link policyGate} (always `degraded: []` for Claude Code) and tags
-     * the result with the harness id and version.
+     * Run a node. Runs {@link policyGate} (always `degraded: []` for Claude
+     * Code), compiles the policy to native options, and tags the result with the
+     * harness id and version.
+     *
+     * Policy compile (#365): `policy.readOnly` (or the legacy `readOnly` flag)
+     * is a read-only run; `policy.deny` classes become native `disallowedTools`
+     * names, merged with `nativeDeny` and the legacy `disallowedTools`; and
+     * `policy.strict` makes MCP exclusive (`strictMcpConfig`) even for a
+     * write-capable node.
      */
     run(req: HarnessRunRequest): Promise<HarnessRunResult>;
     private runQuery;

package/dist/harness/claude-code.js

@@ -85,6 +85,17 @@ export const CLAUDE_TOOLS_BY_CLASS = {
     net: ["WebFetch", "WebSearch"],
     subagent: ["Task", "Agent"],
 };
+/** Native `disallowedTools` for a policy: legacy names, compiled classes, and the read-only set. */
+export function compileClaudeCodeDeny(policy, legacy = []) {
+    return [
+        ...new Set([
+            ...legacy,
+            ...(policy.nativeDeny ?? []),
+            ...policy.deny.flatMap((c) => CLAUDE_TOOLS_BY_CLASS[c] ?? []),
+            ...(policy.readOnly ? READ_ONLY_DISALLOWED_TOOLS : []),
+        ]),
+    ];
+}
 /**
  * Decide which auth credentials survive into the Claude Code subprocess env.
  *
@@ -253,9 +264,15 @@ export class ClaudeCodeHarness {
         return { ok: true, version: claudeSdkVersion() };
     }
     /**
-     * Run a node. The query itself is unchanged by the harness seam; this only
-     * runs {@link policyGate} (always `degraded: []` for Claude Code) and tags
-     * the result with the harness id and version.
+     * Run a node. Runs {@link policyGate} (always `degraded: []` for Claude
+     * Code), compiles the policy to native options, and tags the result with the
+     * harness id and version.
+     *
+     * Policy compile (#365): `policy.readOnly` (or the legacy `readOnly` flag)
+     * is a read-only run; `policy.deny` classes become native `disallowedTools`
+     * names, merged with `nativeDeny` and the legacy `disallowedTools`; and
+     * `policy.strict` makes MCP exclusive (`strictMcpConfig`) even for a
+     * write-capable node.
      */
     async run(req) {
         const policy = req.policy ?? {
@@ -266,10 +283,25 @@ export class ClaudeCodeHarness {
             strict: false,
         };
         const gate = policyGate(this.capabilities, policy);
-        // Portable deny classes (`tools.deny: [write]`) compile to Claude Code tool names.
-        const classNames = policy.deny.flatMap((c) => CLAUDE_TOOLS_BY_CLASS[c] ?? []);
-        const disallowedTools = classNames.length > 0 ? [...new Set([...(req.disallowedTools ?? []), ...classNames])] : req.disallowedTools;
-        const result = await this.runQuery({ ...req, disallowedTools });
+        if (gate.refuse) {
+            this.logger.error(gate.refuse);
+            return {
+                status: "failed",
+                // `refused` keeps fail_soft from softening a policy refusal (executor.ts).
+                data: { error: gate.refuse, refused: true },
+                toolCalls: [],
+                harness: this.info(),
+                degraded: gate.degraded,
+            };
+        }
+        const readOnly = !!req.readOnly || policy.readOnly;
+        const disallowedTools = compileClaudeCodeDeny(policy, req.disallowedTools ?? []);
+        const result = await this.runQuery({
+            ...req,
+            readOnly,
+            disallowedTools: disallowedTools.length > 0 ? disallowedTools : undefined,
+            strictMcp: readOnly || policy.strict,
+        });
         return { ...result, harness: this.info(), degraded: gate.degraded };
     }
     async runQuery(opts) {
@@ -396,7 +428,8 @@ export class ClaudeCodeHarness {
                     // project and local settings, including their MCP servers (and
                     // project .mcp.json, plugins). strictMcpConfig limits MCP to the
                     // servers passed above, which under readOnly is only sweny-core.
-                    ...(readOnly ? { strictMcpConfig: true } : {}),
+                    // A strict policy (#365) makes it exclusive for write nodes too.
+                    ...(readOnly || opts.strictMcp ? { strictMcpConfig: true } : {}),
                     ...(disallowedTools && disallowedTools.length > 0 ? { disallowedTools } : {}),
                     // CC-08: ask the SDK to produce validated structured output when the
                     // node declares an output schema. The SDK then returns the parsed

package/dist/harness/codex.js

@@ -338,13 +338,17 @@ export class CodexHarness {
     }
     /** The node policy after `disallowed_tools` names are translated into Codex classes. */
     compilePolicy(req, maxTurns) {
-        const base = req.policy ?? {
-            readOnly: !!req.readOnly,
-            deny: req.deny ?? [],
-            nativeDeny: req.disallowedTools,
-            egress: req.agentAccess?.domains ?? [],
-            strict: this.policyMode === "strict",
-        };
+        // A node policy (#365) can make the run stricter, never looser than the
+        // harness policy mode.
+        const base = req.policy
+            ? { ...req.policy, strict: req.policy.strict || this.policyMode === "strict" }
+            : {
+                readOnly: !!req.readOnly,
+                deny: req.deny ?? [],
+                nativeDeny: req.disallowedTools,
+                egress: req.agentAccess?.domains ?? [],
+                strict: this.policyMode === "strict",
+            };
         const { classes, unknown } = translateDenyNames(base.nativeDeny);
         return {
             ...base,

package/dist/harness/sandbox-wrapper.d.ts

@@ -19,7 +19,10 @@
  *   host network except through that proxy.
  * - filesystem: the workspace (cwd) and a scratch HOME are writable; the rest
  *   of the filesystem is read-only; the operator's credential files are
- *   unreadable. Dry runs (`readOnly`) leave the workspace read-only too.
+ *   unreadable. Sibling homes under the same configured scratch root are
+ *   hidden; only this run's HOME is exposed. Dry runs (`readOnly`) leave the
+ *   workspace read-only too. All concurrent credential-bearing adapters must
+ *   use the same scratch root; different roots are not mutually isolated.
  * - env: exactly the env the adapter passes (already scoped by agent-env.ts),
  *   with HOME, XDG dirs and TMPDIR pointed into the scratch HOME. On Linux the
  *   process also gets its own PID namespace, so it cannot read another
@@ -55,7 +58,7 @@ export interface SandboxWrapRequest extends AgentSpawn {
 }
 /** The spawn to run instead, plus the scratch it owns. */
 export interface WrappedSpawn extends AgentSpawn {
-    /** Scratch HOME. Adapters may write config here (generated MCP config, copied auth) before spawning. */
+    /** Scratch HOME. Adapters sharing one scratch root may copy scoped auth/config here before spawning. */
     home: string;
     /** Remove the scratch HOME and the sandbox settings. Idempotent. */
     cleanup(): Promise<void>;
@@ -104,6 +107,8 @@ export declare function buildSrtSettings(req: Pick<SandboxWrapRequest, "cwd" | "
     credentialHome: string;
     exists?: (p: string) => boolean;
     credentialPaths?: readonly string[];
+    /** Shared wrapper storage to hide, with only `home` re-exposed. */
+    isolationRoot?: string;
 }): SrtSettings;
 /** Env for the wrapped process: the adapter's env with HOME, XDG and temp dirs moved into the scratch HOME. */
 export declare function scratchEnv(env: Record<string, string>, home: string): Record<string, string>;
@@ -114,7 +119,15 @@ export interface SrtWrapperOptions {
     credentialHome?: string;
     /** Override {@link CREDENTIAL_PATHS} (relative to `credentialHome`, or absolute). */
     credentialPaths?: readonly string[];
-    /** Where scratch dirs are created. Default: `os.tmpdir()`. */
+    /**
+     * Storage parent, default `os.tmpdir()`. Runs share a per-user child under
+     * this directory, hidden except for their own HOME. Concurrent adapters
+     * carrying credentials must use the same parent; separate roots are not
+     * mutually isolated. The existing parent is never removed. Its canonical
+     * hierarchy must be owned by this user or root; other-writable ancestors
+     * must be sticky (like /tmp). The shared child must be private and owned
+     * by this user. Unsafe existing paths are rejected, never repaired.
+     */
     scratchRoot?: string;
 }
 export declare class SrtSandboxWrapper implements SandboxWrapper {

package/dist/harness/sandbox-wrapper.js

@@ -19,7 +19,10 @@
  *   host network except through that proxy.
  * - filesystem: the workspace (cwd) and a scratch HOME are writable; the rest
  *   of the filesystem is read-only; the operator's credential files are
- *   unreadable. Dry runs (`readOnly`) leave the workspace read-only too.
+ *   unreadable. Sibling homes under the same configured scratch root are
+ *   hidden; only this run's HOME is exposed. Dry runs (`readOnly`) leave the
+ *   workspace read-only too. All concurrent credential-bearing adapters must
+ *   use the same scratch root; different roots are not mutually isolated.
  * - env: exactly the env the adapter passes (already scoped by agent-env.ts),
  *   with HOME, XDG dirs and TMPDIR pointed into the scratch HOME. On Linux the
  *   process also gets its own PID namespace, so it cannot read another
@@ -40,7 +43,7 @@
  */
 import { execFile } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
 import { DEFAULT_SANDBOX_DOMAINS, parseList, resolveSandboxMode } from "../agent-env.js";
@@ -119,10 +122,14 @@ export function buildSrtSettings(req, opts) {
     const denyRead = (opts.credentialPaths ?? CREDENTIAL_PATHS)
         .map((rel) => (path.isAbsolute(rel) ? rel : path.join(opts.credentialHome, rel)))
         .filter((p) => exists(p));
+    // Deny the parent, not a snapshot of sibling homes: later-created runs
+    // must stay hidden too. srt allowRead carves out only our own HOME.
+    if (opts.isolationRoot)
+        denyRead.push(opts.isolationRoot);
     const allowWrite = req.readOnly ? [opts.home] : [real(req.cwd), opts.home];
     return {
         network: { allowedDomains, deniedDomains: [], strictAllowlist: true, allowLocalBinding: false },
-        filesystem: { denyRead, allowRead: [], allowWrite, denyWrite: [] },
+        filesystem: { denyRead, allowRead: opts.isolationRoot ? [opts.home] : [], allowWrite, denyWrite: [] },
     };
 }
 /** Env for the wrapped process: the adapter's env with HOME, XDG and temp dirs moved into the scratch HOME. */
@@ -147,7 +154,39 @@ export class SrtSandboxWrapper {
         this.opts = opts;
     }
     async wrap(req) {
-        const dir = await mkdtemp(path.join(real(this.opts.scratchRoot ?? tmpdir()), "sweny-sbx-"));
+        const uid = process.getuid?.();
+        if (uid === undefined)
+            throw new Error("Cannot validate sandbox scratch ownership on this platform");
+        const storageParent = await realpath(this.opts.scratchRoot ?? tmpdir());
+        // A private child can still be renamed by another user through a writable
+        // ancestor. Check the canonical hierarchy before accepting any run paths.
+        for (let ancestor = storageParent;; ancestor = path.dirname(ancestor)) {
+            const info = await lstat(ancestor);
+            if (!info.isDirectory() ||
+                (info.uid !== uid && info.uid !== 0) ||
+                ((info.mode & 0o022) !== 0 && (info.mode & 0o1000) === 0)) {
+                throw new Error(`Unsafe sandbox scratch ancestor: ${ancestor}`);
+            }
+            if (ancestor === path.dirname(ancestor))
+                break;
+        }
+        // Keep these components short: srt creates Unix sockets beneath HOME/tmp,
+        // and Linux socket paths must fit in 107 bytes (including caller parents).
+        const isolationRoot = path.join(storageParent, `sweny-${uid}`);
+        try {
+            await mkdir(isolationRoot, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+        // Never adopt a symlink, a foreign-owned directory, or a directory other
+        // users can access. Validate newly created paths too; do not chmod them.
+        const info = await lstat(isolationRoot);
+        if (!info.isDirectory() || info.uid !== uid || (info.mode & 0o077) !== 0) {
+            throw new Error(`Unsafe sandbox scratch directory: ${isolationRoot}`);
+        }
+        const dir = await mkdtemp(path.join(isolationRoot, "r-"));
         let cleaned = false;
         const cleanup = async () => {
             if (cleaned)
@@ -162,6 +201,7 @@ export class SrtSandboxWrapper {
                 home,
                 credentialHome: this.opts.credentialHome ?? homedir(),
                 credentialPaths: this.opts.credentialPaths,
+                isolationRoot,
             });
             const settingsPath = path.join(dir, "srt-settings.json");
             await writeFile(settingsPath, JSON.stringify(settings, null, 2), { mode: 0o600 });

package/dist/index.d.ts

@@ -21,12 +21,16 @@
  * })
  * ```
  */
-export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, Source, ResolvedSource, SourceKind, SourceResolutionMap, WorkflowInputs, WorkflowInputField, WorkflowInputType, InputValidationError, InputValidationResult, Evaluator, EvaluatorRule, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, NodeToolFilter, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, NodeOnFail, McpTransport, WorkflowType, SkillHarnessKey, } from "./types.js";
+export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, Source, ResolvedSource, SourceKind, SourceResolutionMap, WorkflowInputs, WorkflowInputField, WorkflowInputType, InputValidationError, InputValidationResult, Evaluator, EvaluatorRule, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, NodeToolFilter, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, NodeOnFail, McpTransport, WorkflowType, SkillHarnessKey, NodeAccess, NodePermissions, NodePermissionsSpec, SafeOutputType, SafeOutputDeclaration, SafeOutputsPolicy, SafeOutputReceipt, AuthorAssociation, } from "./types.js";
 export { WORKFLOW_INPUT_TYPES } from "./types.js";
-export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, } from "./types.js";
+export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, NODE_ACCESS, TOOL_CLASSES, SAFE_OUTPUT_TYPES, SAFE_OUTPUT_APPLIERS, AUTHOR_ASSOCIATIONS, } from "./types.js";
 export { consoleLogger } from "./types.js";
 export { execute, RouteEvaluationError } from "./executor.js";
 export type { ExecuteOptions } from "./executor.js";
+export { resolveNodePermissions, buildNodePolicy } from "./node-policy.js";
+export type { ResolvedPermissions } from "./node-policy.js";
+export { applySafeOutputs, createEmitOutputTool, resolveActor, EMIT_OUTPUT_TOOL } from "./safe-outputs.js";
+export type { SafeOutputIntent, ActorInfo, WriteStageState } from "./safe-outputs.js";
 export { createHarness, claudeCompat, asClaude, policyGate, ClaudeCodeHarness, CodexHarness, SUPPORTED_AGENTS, } from "./harness/index.js";
 export type { AgentHarness, HarnessCapabilities, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, PolicyGateResult, PolicyWrappers, ToolClass, ClaudeCodeHarnessOptions, CodexHarnessOptions, } from "./harness/index.js";
 export { ClaudeClient, resolveAuthEnv } from "./harness/claude-code.js";

package/dist/index.js

@@ -23,10 +23,13 @@
  */
 export { WORKFLOW_INPUT_TYPES } from "./types.js";
 // Runtime enum constants + skill-id helpers
-export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, } from "./types.js";
+export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, NODE_ACCESS, TOOL_CLASSES, SAFE_OUTPUT_TYPES, SAFE_OUTPUT_APPLIERS, AUTHOR_ASSOCIATIONS, } from "./types.js";
 export { consoleLogger } from "./types.js";
 // Executor
 export { execute, RouteEvaluationError } from "./executor.js";
+// Least-privilege nodes and safe outputs (#365)
+export { resolveNodePermissions, buildNodePolicy } from "./node-policy.js";
+export { applySafeOutputs, createEmitOutputTool, resolveActor, EMIT_OUTPUT_TOOL } from "./safe-outputs.js";
 // Agent harness (the seam) and its adapters: Claude Code and Codex
 export { createHarness, claudeCompat, asClaude, policyGate, ClaudeCodeHarness, CodexHarness, SUPPORTED_AGENTS, } from "./harness/index.js";
 // Claude client (back-compat: ClaudeClient is ClaudeCodeHarness, @deprecated)

package/dist/node-policy.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Node permissions (#365): resolve what a node's agent may do.
+ *
+ * Pure and browser-safe. The workflow's `permissions` is both the default and
+ * the ceiling for every node; a node may narrow it, never widen it.
+ */
+import type { NodePolicy, ToolClass } from "./harness/types.js";
+import type { Node, NodeAccess, Workflow } from "./types.js";
+export interface ResolvedPermissions {
+    access: NodeAccess;
+    deny: ToolClass[];
+    strict: boolean;
+}
+/**
+ * Effective permissions for a node.
+ *
+ * access: the node's own, else `read` when it declares `outputs`, else the
+ * workflow's, else `write` (today's behavior). A workflow `read` ceiling wins
+ * over a node `write` (the loader rejects that combination; this is the
+ * runtime backstop). deny: union. strict: either.
+ */
+export declare function resolveNodePermissions(node: Pick<Node, "permissions" | "outputs">, workflow?: Pick<Workflow, "permissions">): ResolvedPermissions;
+/** True when a node asks for more than the workflow ceiling allows. */
+export declare function exceedsPermissionCeiling(node: Pick<Node, "permissions">, workflow: Pick<Workflow, "permissions">): boolean;
+/** The portable policy handed to the harness for one node run. */
+export declare function buildNodePolicy(opts: {
+    permissions: ResolvedPermissions;
+    dryRun: boolean;
+    disallowedTools?: string[];
+    egress?: string[];
+}): NodePolicy;

package/dist/node-policy.js

@@ -0,0 +1,42 @@
+/**
+ * Node permissions (#365): resolve what a node's agent may do.
+ *
+ * Pure and browser-safe. The workflow's `permissions` is both the default and
+ * the ceiling for every node; a node may narrow it, never widen it.
+ */
+function spec(p) {
+    if (p === undefined)
+        return {};
+    return typeof p === "string" ? { access: p } : p;
+}
+/**
+ * Effective permissions for a node.
+ *
+ * access: the node's own, else `read` when it declares `outputs`, else the
+ * workflow's, else `write` (today's behavior). A workflow `read` ceiling wins
+ * over a node `write` (the loader rejects that combination; this is the
+ * runtime backstop). deny: union. strict: either.
+ */
+export function resolveNodePermissions(node, workflow = {}) {
+    const wf = spec(workflow.permissions);
+    const own = spec(node.permissions);
+    let access = own.access ?? (node.outputs && node.outputs.length > 0 ? "read" : (wf.access ?? "write"));
+    if (wf.access === "read")
+        access = "read";
+    const deny = [...new Set([...(wf.deny ?? []), ...(own.deny ?? [])])];
+    return { access, deny, strict: wf.strict === true || own.strict === true };
+}
+/** True when a node asks for more than the workflow ceiling allows. */
+export function exceedsPermissionCeiling(node, workflow) {
+    return spec(workflow.permissions).access === "read" && spec(node.permissions).access === "write";
+}
+/** The portable policy handed to the harness for one node run. */
+export function buildNodePolicy(opts) {
+    return {
+        readOnly: opts.dryRun || opts.permissions.access === "read",
+        deny: opts.permissions.deny,
+        ...(opts.disallowedTools && opts.disallowedTools.length > 0 ? { nativeDeny: opts.disallowedTools } : {}),
+        egress: opts.egress ?? [],
+        strict: opts.permissions.strict,
+    };
+}