@sweny-ai/core 0.1.148 → 0.1.150

package/dist/cli/packs.js

@@ -10,11 +10,15 @@
  *   - validates with no credentials
  *   - every node declares an `output` schema and at least one `eval` gate
  *   - value and function gates first; a judge only where a rule cannot decide
- *   - every node is read-only except the delivery node, and each node's write
- *     tools are named in `pack.writes`; the delivery node also restricts its
- *     tool list with `tools.allow`
- *   - harness-agnostic: instructions name SWEny skill tools and plain
- *     read-only shell commands, never a specific agent's built-in tools
+ *   - safe outputs (#365): every GitHub write (issue, comment) is a declared
+ *     output with a cap, and a pin or title prefix where one applies; sweny
+ *     applies it after the node. No node holds a GitHub write tool.
+ *   - least privilege: a workflow-level `permissions` ceiling, and every node
+ *     is `read` except a delivery node that needs a write no safe output
+ *     covers (Slack); its write tools are named in `pack.writes` and its tool
+ *     list is restricted with `tools.allow`
+ *   - harness-agnostic: instructions name SWEny skill tools, never a specific
+ *     agent's built-in tools
  */
 const DIGEST_YAML = `id: weekly-digest
 name: Weekly Repo Digest
@@ -37,13 +41,20 @@ inputs:
     enum: [issue, slack, none]
     default: issue
 
+# Ceiling (#365): write only for the Slack post in publish. The digest issue is
+# a safe output, applied by sweny after publish, at most one per run.
+permissions: write
+safe_outputs:
+  allow: [issue]
+  max: 1
+
 nodes:
   collect:
     name: Collect the Week
     instruction: |
       Gather facts about the last N days, where N is context.input.days
-      (default 7). The repo is context.input.repo; if empty, use the
-      GITHUB_REPOSITORY environment variable, else the origin remote.
+      (default 7). The repo is context.input.repo; if empty, read the origin
+      remote URL from .git/config in the checkout.
       Compute the window as UTC dates: until is today, since is N days ago.
 
       1. Commits on the default branch in the window:
@@ -54,18 +65,19 @@ nodes:
       3. Issues opened and issues closed in the window:
          github_search_issues with "is:issue created:>=SINCE" and
          "is:issue closed:>=SINCE".
-      4. Files touched, with churn: run a read-only git command in the
-         checkout, for example "git log --since=SINCE --no-merges
-         --numstat --format=", and sum added plus deleted lines per path.
-         Keep the 15 paths with the most churn.
+      4. Files touched, with churn: github_list_pr_files for each merged PR
+         (at most 20, newest first), and sum additions plus deletions per
+         path. Keep the 15 paths with the most churn.
 
-      Only read. Never create, edit, comment, post, or push anything.
-      Report only what the tools returned. A quiet week is a valid result.
+      Only read. Report only what the tools returned. A quiet week is a
+      valid result.
     skills: [github]
+    permissions: read
     tools:
       allow:
         - github_list_recent_commits
         - github_search_issues
+        - github_list_pr_files
     max_turns: 30
     output:
       type: object
@@ -199,6 +211,7 @@ nodes:
       Copy the counts exactly from the collected facts; never estimate.
       watch_next is at most 3 short items a maintainer should look at next
       week (for example, a risky file that changed without a test).
+    permissions: read
     max_turns: 5
     output:
       type: object
@@ -271,19 +284,27 @@ nodes:
 
       - issue: first call github_search_issues for an open issue labelled
         sweny-digest whose title is "Weekly digest SINCE to UNTIL". If one
-        exists, do not create another. Otherwise call github_create_issue
-        with that title, the body, and the label sweny-digest.
+        exists, do not request another. Otherwise request it with
+        emit_output: type issue, that title, the body, and dedupe_key
+        "weekly-digest-SINCE". sweny files it after this step and adds the
+        sweny-digest label.
       - slack: call slack_send_message once with the body as mrkdwn.
-      - none: call no tool; just return the body.
+      - none: request nothing; just return the body.
 
-      This is the only step allowed to write, and only to the destination
-      above.
+      delivered means the issue was requested or the Slack message was sent.
     skills: [github, slack]
+    # Write only for slack_send_message (no safe output covers Slack). The
+    # issue is a declared output: capped at one, labelled, title-prefixed.
+    permissions: write
     tools:
       allow:
         - github_search_issues
-        - github_create_issue
         - slack_send_message
+    outputs:
+      - type: issue
+        max: 1
+        title_prefix: "Weekly digest "
+        labels: [sweny-digest]
     max_turns: 8
     output:
       type: object
@@ -307,12 +328,13 @@ nodes:
           output_matches:
             - path: destination
               in: [issue, slack, none]
-      - name: delivery_never_opens_a_pr
+      - name: delivery_never_writes_github_directly
         kind: function
         rule:
           no_tool_called:
             - github_create_pr
             - github_add_comment
+            - github_create_issue
 
 edges:
   - from: collect
@@ -342,7 +364,8 @@ jobs:
         with:
           workflow: .sweny/workflows/weekly-digest.yml
           claude-oauth-token: \${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          # input: '{"days": 7, "deliver": "slack"}'
+          input: '{"repo": "\${{ github.repository }}"}'
+          # input: '{"repo": "\${{ github.repository }}", "days": 7, "deliver": "slack"}'
         env:
           GITHUB_TOKEN: \${{ github.token }}
           # SLACK_WEBHOOK_URL: \${{ secrets.SLACK_WEBHOOK_URL }}
@@ -381,6 +404,13 @@ inputs:
     enum: [low, medium, high, critical]
     default: medium
 
+# Ceiling (#365): every node is read-only. The one issue (or the one comment
+# on it) is a safe output, applied by sweny after file-issue.
+permissions: read
+safe_outputs:
+  allow: [issue, comment]
+  max: 1
+
 nodes:
   inventory:
     name: Read the Lockfiles
@@ -446,7 +476,7 @@ nodes:
     name: Fetch Open Advisories
     instruction: |
       Call github_list_dependabot_alerts for the repo (context.input.repo;
-      if empty, GITHUB_REPOSITORY or the origin remote).
+      if empty, the origin remote URL in .git/config).
 
       If the tool returns unavailable: true, record available as false and
       return no alerts. Do NOT guess advisories from memory: an advisory you
@@ -589,24 +619,31 @@ nodes:
       Always start with github_search_issues for an open issue labelled
       sweny-drift (query: "is:issue is:open label:sweny-drift").
 
-      - If action is "none": create nothing. Return result "none".
+      - If action is "none": request nothing. Return result "none".
       - If an open sweny-drift issue exists and lists the same advisory ids
         and drift paths: change nothing. Return result "unchanged".
-      - If it exists but the set changed: call github_add_comment once on
-        that issue with only what is new. Return result "updated".
-      - If none exists: call github_create_issue once, titled
-        "Dependency drift: N actionable", label sweny-drift. The body has a
-        table (package, severity, advisory id, why it matters, fix), the
-        drift paths with reasons, and the deferred count. Return "created".
-
-      Never open a pull request. Never edit code or lockfiles. At most one
-      issue is created per run.
+      - If it exists but the set changed: request one comment on that issue
+        (emit_output type comment, number = the issue number) with only what
+        is new. Return result "updated".
+      - If none exists: request one issue (emit_output type issue) titled
+        "Dependency drift: N actionable". The body has a table (package,
+        severity, advisory id, why it matters, fix), the drift paths with
+        reasons, and the deferred count. Return "created". sweny files it
+        after this step and adds the sweny-drift label.
+
+      You cannot write to GitHub directly here: requests are applied after
+      this step, at most one per run.
     skills: [github]
     tools:
       allow:
         - github_search_issues
-        - github_create_issue
-        - github_add_comment
+    outputs:
+      - type: issue
+        max: 1
+        title_prefix: "Dependency drift: "
+        labels: [sweny-drift]
+      - type: comment
+        max: 1
     max_turns: 8
     output:
       type: object
@@ -627,11 +664,13 @@ nodes:
         rule:
           any_tool_called:
             - github_search_issues
-      - name: no_code_writes
+      - name: no_direct_github_writes
         kind: function
         rule:
           no_tool_called:
             - github_create_pr
+            - github_create_issue
+            - github_add_comment
       - name: result_is_valid
         kind: value
         rule:
@@ -669,6 +708,7 @@ jobs:
         with:
           workflow: .sweny/workflows/dependency-drift.yml
           claude-oauth-token: \${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          input: '{"repo": "\${{ github.repository }}"}'
         env:
           # The built-in token cannot read Dependabot alerts. Use a fine-grained
           # token with Dependabot alerts: read, Issues: write, Contents: read.
@@ -703,6 +743,14 @@ inputs:
     description: Pull request number. The Action snippet passes github.event.pull_request.number.
     default: 0
 
+# Ceiling (#365): every node is read-only. The review comment is a safe
+# output pinned to context.input.pr_number, applied by sweny after
+# post-comment.
+permissions: read
+safe_outputs:
+  allow: [comment]
+  max: 1
+
 nodes:
   scope:
     name: Measure the Change
@@ -876,9 +924,9 @@ nodes:
   post-comment:
     name: Post the Review Comment
     instruction: |
-      Post exactly one comment on the pull request with github_add_comment
-      (repo context.input.repo or GITHUB_REPOSITORY, issue_number
-      context.input.pr_number).
+      Request exactly one comment on the pull request with emit_output
+      (type comment). It can only land on context.input.pr_number; sweny
+      posts it after this step.
 
       Start the body with the line: <!-- sweny-pr-risk -->
       Then: "Risk: LEVEL" with the size, then the reasons as short bullets
@@ -886,34 +934,36 @@ nodes:
       "Read-only scope review. No code was changed."
       Keep it under 15 lines. No emoji walls, no praise.
 
-      This is the only step allowed to write, and it may only comment.
+      This is the only step that asks for a write, and it may only comment.
     skills: [github]
     tools:
       allow:
-        - github_add_comment
+        - github_get_issue
+    outputs:
+      - type: comment
+        max: 1
+        number: { input: pr_number }
     max_turns: 4
     output:
       type: object
       properties:
-        posted:
+        requested:
           type: boolean
-        comment_url:
-          type: string
         risk_level:
           type: string
           enum: [low, medium, high]
-      required: [posted, risk_level]
+      required: [requested, risk_level]
     eval:
-      - name: comment_was_posted
+      - name: comment_was_requested
         kind: function
         rule:
           all_tools_called:
-            - github_add_comment
+            - emit_output
       - name: comment_result
         kind: value
         rule:
           output_matches:
-            - path: posted
+            - path: requested
               equals: true
             - path: risk_level
               in: [low, medium, high]
@@ -974,7 +1024,7 @@ export const PACK_TEMPLATES = [
             trigger: DIGEST_TRIGGER,
             sample: DIGEST_SAMPLE,
             tokens: "15k to 40k per run (estimate)",
-            writes: { publish: ["github_create_issue", "slack_send_message"] },
+            writes: { publish: ["slack_send_message"] },
         },
     },
     {
@@ -986,7 +1036,7 @@ export const PACK_TEMPLATES = [
             trigger: DRIFT_TRIGGER,
             sample: DRIFT_SAMPLE,
             tokens: "20k to 60k per run (estimate)",
-            writes: { "file-issue": ["github_create_issue", "github_add_comment"] },
+            writes: {},
         },
     },
     {
@@ -998,7 +1048,7 @@ export const PACK_TEMPLATES = [
             trigger: RISK_TRIGGER,
             sample: RISK_SAMPLE,
             tokens: "10k to 30k per run (estimate)",
-            writes: { "post-comment": ["github_add_comment"] },
+            writes: {},
         },
     },
 ];

package/dist/executor.js

@@ -80,6 +80,8 @@ export async function execute(workflow, input, options) {
     const runEnv = options.env ?? process.env;
     const usesOutputs = Object.values(workflow.nodes).some((n) => (n.outputs?.length ?? 0) > 0);
     const actor = usesOutputs ? resolveActor(runEnv, options.actor) : {};
+    // The run input, for `number: { input }` issue pins on outputs.
+    const runInput = input && typeof input === "object" ? input : undefined;
     // Build an eval-time alias table from the loaded skills. Each skill owns
     // its own mapping between skill-tool names and equivalent MCP names. Core
     // stays vendor-neutral; this call just unions what the skills declare.
@@ -257,7 +259,9 @@ export async function execute(workflow, input, options) {
         const effectiveRules = assembleCascaded("rules", currentId, workflow.nodes[currentId], inputRules.length, (workflow.rules ?? []).length, resolvedSources);
         const effectiveContext = assembleCascaded("context", currentId, workflow.nodes[currentId], inputContext.length, (workflow.context ?? []).length, resolvedSources);
         const baseInstruction = buildNodeInstruction(resolvedInstruction, effectiveRules, effectiveContext, input, skillInstructions);
-        const nodeInstruction = outputDecls.length > 0 ? `${baseInstruction}\n\n${safeOutputsInstruction(outputDecls)}` : baseInstruction;
+        const nodeInstruction = outputDecls.length > 0
+            ? `${baseInstruction}\n\n${safeOutputsInstruction(outputDecls, runInput)}`
+            : baseInstruction;
         const instruction = dryRun ? `${dryRunNotice(skippedWrites)}\n\n---\n\n${nodeInstruction}` : nodeInstruction;
         // Run Claude on this node, with optional eval-failure retry loop.
         let attempt = 0;
@@ -462,6 +466,7 @@ export async function execute(workflow, input, options) {
                     staged: stageOutputs,
                     state: writeState,
                     logger,
+                    input: runInput,
                     screen: async (writes) => claude.ask({
                         instruction: SAFE_OUTPUT_SCREEN_INSTRUCTION,
                         context: { writes },
@@ -610,10 +615,17 @@ function warnOnJudgeBudget(workflow, logger) {
  * including when no evaluator ran (the trusted namespace is then empty).
  */
 function buildPriorNodeContext(result) {
-    const data = (result.data ?? {});
+    const { safe_outputs: _forged, ...data } = (result.data ?? {});
     const evals = result.evals ?? [];
     const evalsByName = Object.fromEntries(evals.map((e) => [e.name, e]));
-    return { ...data, evals: evalsByName };
+    // Safe-output receipts (#365) are runtime facts, like evals: what sweny
+    // actually wrote (type, status, ref, url). A downstream node reads the new
+    // issue's identifier here. Agent data can never shadow them.
+    return {
+        ...data,
+        evals: evalsByName,
+        ...(result.outputs && result.outputs.length > 0 ? { safe_outputs: result.outputs } : {}),
+    };
 }
 /**
  * Build the prior-node entry shown to the LLM route evaluator.

package/dist/harness/acp-rpc.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Newline-delimited JSON-RPC 2.0 over a child process's stdio: the ACP stdio
+ * transport (agentclientprotocol.com/protocol/v1/transports, schema v1.24.1).
+ *
+ * - The client launches the agent as a subprocess and writes one JSON-RPC
+ *   message per line to its stdin; the agent answers on stdout.
+ * - Messages MUST NOT contain embedded newlines (`JSON.stringify` never emits
+ *   one).
+ * - The agent MAY log on stderr. It MUST NOT write anything but ACP messages
+ *   to stdout; real agents sometimes do, so a stdout line that is not JSON is
+ *   logged and skipped instead of ending the run.
+ *
+ * Hand-rolled on purpose: the wire is four message shapes, so sweny takes no
+ * SDK dependency for it, and the contract fake speaks the raw wire, which means
+ * the suite checks the protocol itself and not an SDK's reading of it.
+ *
+ * No agent SDK imports.
+ */
+import type { ChildProcess } from "node:child_process";
+/** JSON-RPC / ACP error codes (schema `ErrorCode`). */
+export declare const RPC_ERROR: {
+    readonly parse: -32700;
+    readonly invalidRequest: -32600;
+    readonly methodNotFound: -32601;
+    readonly invalidParams: -32602;
+    readonly internal: -32603;
+    readonly requestCancelled: -32800;
+    readonly authRequired: -32000;
+    readonly resourceNotFound: -32002;
+};
+/** An error response from the peer (or a local failure reaching it). */
+export declare class RpcError extends Error {
+    readonly code: number;
+    readonly data?: unknown | undefined;
+    constructor(message: string, code: number, data?: unknown | undefined);
+}
+export interface RpcHandlers {
+    /** A request from the peer. Resolve with the `result`, or throw {@link RpcError} for an error response. */
+    onRequest(method: string, params: unknown): Promise<unknown>;
+    /** A notification from the peer. */
+    onNotification(method: string, params: unknown): void;
+    /** A stdout line that was not a JSON-RPC message (debug only). */
+    onJunk?(line: string): void;
+}
+/**
+ * One JSON-RPC connection. Requests from us are matched to responses by id;
+ * requests from the peer are answered through {@link RpcHandlers.onRequest}.
+ * When the peer goes away every pending request rejects.
+ */
+export declare class RpcPeer {
+    private readonly child;
+    private readonly handlers;
+    private nextId;
+    private pending;
+    private buf;
+    private ended;
+    constructor(child: Pick<ChildProcess, "stdin" | "stdout">, handlers: RpcHandlers);
+    private onData;
+    private onLine;
+    private answer;
+    private write;
+    /** Send a request and wait for its response. */
+    request<T = unknown>(method: string, params: unknown): Promise<T>;
+    /** Send a notification (no response). */
+    notify(method: string, params: unknown): void;
+    /** The peer is gone: reject everything still waiting. Idempotent. */
+    end(reason: string): void;
+}
+/**
+ * Split a command line into argv: whitespace separates words, single and
+ * double quotes group, backslash escapes the next character outside single
+ * quotes. No expansion of any kind (no globbing, no variables, no shell), so
+ * the string after `acp:` can never run anything but the program it names.
+ */
+export declare function splitCommandLine(input: string): string[];

package/dist/harness/acp-rpc.js

@@ -0,0 +1,204 @@
+/**
+ * Newline-delimited JSON-RPC 2.0 over a child process's stdio: the ACP stdio
+ * transport (agentclientprotocol.com/protocol/v1/transports, schema v1.24.1).
+ *
+ * - The client launches the agent as a subprocess and writes one JSON-RPC
+ *   message per line to its stdin; the agent answers on stdout.
+ * - Messages MUST NOT contain embedded newlines (`JSON.stringify` never emits
+ *   one).
+ * - The agent MAY log on stderr. It MUST NOT write anything but ACP messages
+ *   to stdout; real agents sometimes do, so a stdout line that is not JSON is
+ *   logged and skipped instead of ending the run.
+ *
+ * Hand-rolled on purpose: the wire is four message shapes, so sweny takes no
+ * SDK dependency for it, and the contract fake speaks the raw wire, which means
+ * the suite checks the protocol itself and not an SDK's reading of it.
+ *
+ * No agent SDK imports.
+ */
+/** JSON-RPC / ACP error codes (schema `ErrorCode`). */
+export const RPC_ERROR = {
+    parse: -32700,
+    invalidRequest: -32600,
+    methodNotFound: -32601,
+    invalidParams: -32602,
+    internal: -32603,
+    requestCancelled: -32800,
+    authRequired: -32000,
+    resourceNotFound: -32002,
+};
+/** An error response from the peer (or a local failure reaching it). */
+export class RpcError extends Error {
+    code;
+    data;
+    constructor(message, code, data) {
+        super(message);
+        this.code = code;
+        this.data = data;
+        this.name = "RpcError";
+    }
+}
+/**
+ * One JSON-RPC connection. Requests from us are matched to responses by id;
+ * requests from the peer are answered through {@link RpcHandlers.onRequest}.
+ * When the peer goes away every pending request rejects.
+ */
+export class RpcPeer {
+    child;
+    handlers;
+    nextId = 1;
+    pending = new Map();
+    buf = "";
+    ended;
+    constructor(child, handlers) {
+        this.child = child;
+        this.handlers = handlers;
+        child.stdout?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => this.onData(chunk));
+        child.stdin?.on("error", () => {
+            // The agent exited before reading; the exit handling reports why.
+        });
+    }
+    onData(chunk) {
+        this.buf += chunk;
+        let nl;
+        while ((nl = this.buf.indexOf("\n")) !== -1) {
+            const line = this.buf.slice(0, nl);
+            this.buf = this.buf.slice(nl + 1);
+            this.onLine(line);
+        }
+    }
+    onLine(raw) {
+        const line = raw.trim();
+        if (!line)
+            return;
+        let msg;
+        try {
+            const parsed = JSON.parse(line);
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                throw new Error("not an object");
+            msg = parsed;
+        }
+        catch {
+            this.handlers.onJunk?.(line.length > 200 ? line.slice(0, 199) + "..." : line);
+            return;
+        }
+        const id = msg.id;
+        const hasId = typeof id === "number" || typeof id === "string";
+        if (typeof msg.method === "string") {
+            if (hasId)
+                void this.answer(id, msg.method, msg.params);
+            else
+                this.handlers.onNotification(msg.method, msg.params);
+            return;
+        }
+        if (!hasId)
+            return;
+        const p = this.pending.get(id);
+        if (!p)
+            return;
+        this.pending.delete(id);
+        const err = msg.error;
+        if (err && typeof err === "object") {
+            p.reject(new RpcError(typeof err.message === "string" ? err.message : `${p.method} failed`, typeof err.code === "number" ? err.code : RPC_ERROR.internal, err.data));
+        }
+        else {
+            p.resolve(msg.result);
+        }
+    }
+    async answer(id, method, params) {
+        try {
+            const result = await this.handlers.onRequest(method, params);
+            this.write({ jsonrpc: "2.0", id, result: result ?? null });
+        }
+        catch (err) {
+            const e = err instanceof RpcError
+                ? err
+                : new RpcError(err instanceof Error ? err.message : String(err), RPC_ERROR.internal);
+            this.write({ jsonrpc: "2.0", id, error: { code: e.code, message: e.message } });
+        }
+    }
+    write(msg) {
+        const stdin = this.child.stdin;
+        if (!stdin || stdin.destroyed || !stdin.writable)
+            return;
+        stdin.write(JSON.stringify(msg) + "\n");
+    }
+    /** Send a request and wait for its response. */
+    request(method, params) {
+        if (this.ended !== undefined)
+            return Promise.reject(new RpcError(this.ended, RPC_ERROR.internal));
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            this.pending.set(id, { resolve: (v) => resolve(v), reject, method });
+            this.write({ jsonrpc: "2.0", id, method, params });
+        });
+    }
+    /** Send a notification (no response). */
+    notify(method, params) {
+        if (this.ended !== undefined)
+            return;
+        this.write({ jsonrpc: "2.0", method, params });
+    }
+    /** The peer is gone: reject everything still waiting. Idempotent. */
+    end(reason) {
+        if (this.ended !== undefined)
+            return;
+        this.ended = reason;
+        // A final line without a newline is complete only if it parses.
+        if (this.buf.trim())
+            this.onLine(this.buf);
+        this.buf = "";
+        const pending = [...this.pending.values()];
+        this.pending.clear();
+        for (const p of pending)
+            p.reject(new RpcError(reason, RPC_ERROR.internal));
+    }
+}
+/**
+ * Split a command line into argv: whitespace separates words, single and
+ * double quotes group, backslash escapes the next character outside single
+ * quotes. No expansion of any kind (no globbing, no variables, no shell), so
+ * the string after `acp:` can never run anything but the program it names.
+ */
+export function splitCommandLine(input) {
+    const out = [];
+    let cur = "";
+    let started = false;
+    let quote = null;
+    for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            else if (ch === "\\" && quote === '"' && i + 1 < input.length)
+                cur += input[++i];
+            else
+                cur += ch;
+        }
+        else if (ch === '"' || ch === "'") {
+            quote = ch;
+            started = true;
+        }
+        else if (ch === "\\" && i + 1 < input.length) {
+            cur += input[++i];
+            started = true;
+        }
+        else if (/\s/.test(ch)) {
+            if (started) {
+                out.push(cur);
+                cur = "";
+                started = false;
+            }
+        }
+        else {
+            cur += ch;
+            started = true;
+        }
+    }
+    if (quote)
+        throw new Error(`unterminated ${quote} quote in "${input}"`);
+    if (started)
+        out.push(cur);
+    return out;
+}