@sweny-ai/core 0.1.145 → 0.1.147

package/dist/harness/claude-code.d.ts

@@ -175,7 +175,8 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
      * is a read-only run; `policy.deny` classes become native `disallowedTools`
      * names, merged with `nativeDeny` and the legacy `disallowedTools`; and
      * `policy.strict` makes MCP exclusive (`strictMcpConfig`) even for a
-     * write-capable node.
+     * write-capable node. Per-request sandbox mode overrides the client default,
+     * and policy egress supplies the node hosts without dropping scoped env access.
      */
     run(req: HarnessRunRequest): Promise<HarnessRunResult>;
     private runQuery;

package/dist/harness/claude-code.js

@@ -272,7 +272,8 @@ export class ClaudeCodeHarness {
      * is a read-only run; `policy.deny` classes become native `disallowedTools`
      * names, merged with `nativeDeny` and the legacy `disallowedTools`; and
      * `policy.strict` makes MCP exclusive (`strictMcpConfig`) even for a
-     * write-capable node.
+     * write-capable node. Per-request sandbox mode overrides the client default,
+     * and policy egress supplies the node hosts without dropping scoped env access.
      */
     async run(req) {
         const policy = req.policy ?? {
@@ -301,6 +302,8 @@ export class ClaudeCodeHarness {
             readOnly,
             disallowedTools: disallowedTools.length > 0 ? disallowedTools : undefined,
             strictMcp: readOnly || policy.strict,
+            sandboxMode: policy.sandbox,
+            agentAccess: { envVars: req.agentAccess?.envVars ?? [], domains: policy.egress },
         });
         return { ...result, harness: this.info(), degraded: gate.degraded };
     }
@@ -318,7 +321,7 @@ export class ClaudeCodeHarness {
         // `strict` fails the node here instead.
         const sandbox = resolveAgentSandbox({
             env: process.env,
-            mode: this.sandboxMode,
+            mode: opts.sandboxMode ?? this.sandboxMode,
             allowedDomains: this.sandboxAllowedDomains,
             nodeDomains: agentAccess?.domains,
             probe: this.sandboxProbe,
@@ -326,7 +329,7 @@ export class ClaudeCodeHarness {
         });
         if (sandbox.error) {
             this.logger.error(sandbox.error);
-            return { status: "failed", data: { error: sandbox.error }, toolCalls: [] };
+            return { status: "failed", data: { error: sandbox.error, refused: true }, toolCalls: [] };
         }
         if (sandbox.warning && !this.sandboxWarned) {
             this.sandboxWarned = true;

package/dist/harness/codex.d.ts

@@ -20,7 +20,7 @@
  *
  * Every sweny opinion in the Codex column of the enforcement matrix is
  * enforced natively here, kept by sweny (watchdog, fencing, env scoping,
- * output validation), reported in `degraded`, or refused under strict policy
+ * output parsing), reported in `degraded`, or refused under strict policy
  * by `policyGate`. Nothing is dropped silently.
  */
 import type { Logger, McpServerConfig, ToolContext } from "../types.js";

package/dist/harness/codex.js

@@ -20,7 +20,7 @@
  *
  * Every sweny opinion in the Codex column of the enforcement matrix is
  * enforced natively here, kept by sweny (watchdog, fencing, env scoping,
- * output validation), reported in `degraded`, or refused under strict policy
+ * output parsing), reported in `degraded`, or refused under strict policy
  * by `policyGate`. Nothing is dropped silently.
  */
 import { spawn, execFile } from "node:child_process";
@@ -201,15 +201,21 @@ export function isStrictCompatibleSchema(schema) {
 // ─── Process registry (crash cleanup) ────────────────────────────
 const liveChildren = new Set();
 let exitHookInstalled = false;
-/**
- * Stop Codex. It stays in sweny's process group (not detached), so a Ctrl-C
- * or a CI cancel reaches it too; its MCP servers exit when their stdin closes.
- */
+/** Stop the owned process tree, even after its leader has exited. */
 function stopChild(child, signal) {
-    if (child.pid === undefined || child.exitCode !== null || child.signalCode !== null)
+    if (child.pid === undefined)
         return;
     try {
-        child.kill(signal);
+        if (process.platform !== "win32") {
+            // exec() gives each run its own process group. Descendants can retain
+            // stdout/stderr after the leader exits, so do not gate this on exitCode.
+            process.kill(-child.pid, signal);
+        }
+        else {
+            // Windows has no POSIX process groups. Bound the tree-kill utility too.
+            execFile("taskkill", ["/pid", String(child.pid), "/T", "/F"], { timeout: 1000 }, () => { });
+            child.kill(signal);
+        }
     }
     catch {
         // already gone
@@ -220,10 +226,23 @@ function trackChild(child) {
     if (!exitHookInstalled) {
         exitHookInstalled = true;
         // A crashing sweny must not leave Codex (and its MCP servers) running.
-        process.on("exit", () => {
+        const cleanup = () => {
             for (const c of liveChildren)
                 stopChild(c, "SIGKILL");
-        });
+        };
+        process.on("exit", cleanup);
+        // Detached POSIX groups no longer receive our terminal's signals. Clean
+        // them up before host once-handlers remove themselves during dispatch.
+        for (const signal of ["SIGINT", "SIGTERM"]) {
+            const onSignal = () => {
+                cleanup();
+                if (process.listenerCount(signal) === 1) {
+                    process.removeListener(signal, onSignal);
+                    process.kill(process.pid, signal);
+                }
+            };
+            process.prependListener(signal, onSignal);
+        }
     }
 }
 function mapUsage(u) {
@@ -470,6 +489,7 @@ export class CodexHarness {
                 cwd: opts.spawn.cwd,
                 env: opts.spawn.env,
                 stdio: ["pipe", "pipe", "pipe"],
+                detached: process.platform !== "win32",
             });
         }
         catch (err) {
@@ -478,7 +498,9 @@ export class CodexHarness {
             return out;
         }
         trackChild(child);
+        let finish;
         const closed = new Promise((resolve) => {
+            finish = resolve;
             child.once("close", (code, signal) => {
                 out.exitCode = code;
                 out.exitSignal = signal;
@@ -495,9 +517,24 @@ export class CodexHarness {
                 return;
             stopped = true;
             stopChild(child, "SIGTERM");
-            killTimer = setTimeout(() => stopChild(child, "SIGKILL"), this.killGraceMs);
+            killTimer = setTimeout(() => {
+                stopChild(child, "SIGKILL");
+                // An escaped descendant or failed OS kill must not retain this await
+                // through inherited pipes after cancellation or leader exit.
+                child.stdin?.destroy();
+                child.stdout?.destroy();
+                child.stderr?.destroy();
+                child.unref();
+                finish();
+            }, this.killGraceMs);
             killTimer.unref?.();
         };
+        child.once("exit", (code, signal) => {
+            out.exitCode = code;
+            out.exitSignal = signal;
+            // The leader is done, but its descendants may still own our pipes.
+            stop();
+        });
         if (abort) {
             const onAbort = () => {
                 out.abortReason = abort.reason();
@@ -649,6 +686,7 @@ export class CodexHarness {
             onLine(buf);
         if (killTimer)
             clearTimeout(killTimer);
+        stopChild(child, "SIGKILL");
         abort?.clear();
         liveChildren.delete(child);
         return out;
@@ -677,11 +715,11 @@ export class CodexHarness {
             harness: this.info(),
             degraded: [...degraded, ...extra],
         });
-        const refused = (why) => {
+        const refused = (why, extra = []) => {
             const msg = `codex refused this node: ${why}`;
             this.logger.error(msg);
             // `refused` keeps fail_soft from softening a policy refusal (executor.ts).
-            return tag({ status: "failed", data: { error: msg, refused: true }, toolCalls: [] });
+            return tag({ status: "failed", data: { error: msg, refused: true }, toolCalls: [] }, extra);
         };
         if (gate.refuse)
             return refused(gate.refuse);
@@ -799,7 +837,7 @@ export class CodexHarness {
                 return refused(out.refuse);
             // OpenAI strict structured outputs reject some JSON schemas. When Codex
             // fails on the schema before doing anything, run once more without the
-            // native schema: sweny still asks for it in the prompt and checks it.
+            // native schema in relaxed mode. Prompt-only output is not schema-validated.
             if (schemaArgs.length > 0 &&
                 !out.completed &&
                 !out.abortReason &&
@@ -808,7 +846,10 @@ export class CodexHarness {
                 const why = isStrictCompatibleSchema(req.outputSchema)
                     ? "codex rejected the output schema"
                     : "the output schema is not OpenAI strict-compatible";
-                extraDegraded.push(`structured_output: ${why}; sweny parsed and checked the output instead`);
+                extraDegraded.push(`structured_output: ${why}; native schema validation unavailable`);
+                if (policy.strict) {
+                    return refused("strict policy requires structured_output validation; refusing prompt-only fallback", extraDegraded);
+                }
                 this.logger.warn(`  codex: ${why}; retrying without --output-schema`);
                 const again = await execOnce(false);
                 if ("refuse" in again)

package/dist/safe-outputs.d.ts

@@ -47,7 +47,7 @@ export declare function safeOutputsInstruction(declarations: SafeOutputDeclarati
 export interface ActorInfo {
     /** GitHub login of whoever triggered the run. */
     login?: string;
-    /** Author association of the event's comment, review, issue or PR author. */
+    /** Association verified for this login, or explicitly supplied by the trusted caller. */
     association?: string;
 }
 /** Who triggered this run: an explicit override, else GitHub Actions' env and event payload. */

package/dist/safe-outputs.js

@@ -129,13 +129,16 @@ export function safeOutputsInstruction(declarations) {
         "Requests outside these types or limits are refused. Do not claim a write happened; say what you requested.",
     ].join("\n");
 }
-function eventAssociation(path) {
-    if (!path)
+function eventAssociation(path, login) {
+    if (!path || !login)
         return undefined;
     try {
         const ev = JSON.parse(readFileSync(path, "utf-8"));
         for (const key of ["comment", "review", "issue", "pull_request"]) {
-            const a = ev?.[key]?.author_association;
+            const author = ev?.[key];
+            if (typeof author?.user?.login !== "string" || author.user.login.toLowerCase() !== login.toLowerCase())
+                continue;
+            const a = author.author_association;
             if (typeof a === "string" && a.length > 0)
                 return a;
         }
@@ -148,7 +151,7 @@ function eventAssociation(path) {
 /** Who triggered this run: an explicit override, else GitHub Actions' env and event payload. */
 export function resolveActor(env, override) {
     const login = override?.login ?? env.GITHUB_ACTOR ?? undefined;
-    const association = override?.association ?? eventAssociation(env.GITHUB_EVENT_PATH);
+    const association = override?.association ?? eventAssociation(env.GITHUB_EVENT_PATH, login);
     return { ...(login ? { login } : {}), ...(association ? { association } : {}) };
 }
 /** True when no trust list is declared, or the actor matches one. Unknown actor = untrusted. */
@@ -356,11 +359,37 @@ export async function applySafeOutputs(o) {
             refuse("title too long", at);
             continue;
         }
+        // A Linear comment's issue ID does not encode or enforce its declared team.
+        // Resolve it through the configured read tool and carry its immutable ID to
+        // the write. Missing lookup support or unverifiable membership fails closed.
+        let number = intent.number;
+        if (via === "linear" && type === "comment" && target) {
+            const lookup = o.skills.get(via)?.tools.find((t) => t.name === "linear_get_issue" && t.access === "read");
+            let issue;
+            try {
+                const result = await lookup?.handler({ id: number }, { config: o.config, logger: o.logger });
+                if (result && typeof result === "object") {
+                    issue = result.issue;
+                }
+            }
+            catch {
+                // A lookup error cannot authorize a write.
+            }
+            if (typeof issue?.id !== "string" || !issue.id || typeof issue.team?.id !== "string") {
+                refuse("cannot verify Linear issue team", at);
+                continue;
+            }
+            if (issue.team.id.toLowerCase() !== target.toLowerCase()) {
+                refuse("issue outside the declared team", at);
+                continue;
+            }
+            number = issue.id;
+        }
         const write = {
             type,
             via,
             ...(target ? { target } : {}),
-            ...(intent.number !== undefined ? { number: intent.number } : {}),
+            ...(number !== undefined ? { number } : {}),
             ...(title ? { title } : {}),
             ...(type !== "label" ? { body } : {}),
             ...(labels ? { labels } : {}),

package/dist/skills/linear.js

@@ -106,7 +106,7 @@ export const linear = {
               priority priorityLabel
               assignee { name email }
               labels { nodes { name } }
-              team { key name }
+              team { id key name }
               createdAt updatedAt
             }
           }`, { id: input.id }, ctx),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.145",
+  "version": "0.1.147",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"