@sweny-ai/core 0.1.148 → 0.1.150

package/dist/harness/agents.d.ts

@@ -6,6 +6,10 @@
  */
 export declare const SUPPORTED_AGENTS: readonly ["claude", "codex", "pi"];
 export type SupportedAgent = (typeof SUPPORTED_AGENTS)[number];
-export declare function isSupportedAgent(id: string): id is SupportedAgent;
+/** `acp:<command>` (#416): any Agent Client Protocol agent, started with `<command>`. */
+export type AcpAgentId = `acp:${string}`;
+/** The command of an `acp:<command>` agent id (`"opencode acp"` for `acp:opencode acp`), or undefined when it is not one or the command is empty. */
+export declare function parseAcpAgent(id: string): string | undefined;
+export declare function isSupportedAgent(id: string): id is SupportedAgent | AcpAgentId;
 /** The error for an agent id with no adapter. */
 export declare function unsupportedAgentError(id: string): string;

package/dist/harness/agents.js

@@ -5,8 +5,15 @@
  * the harness factory share it).
  */
 export const SUPPORTED_AGENTS = ["claude", "codex", "pi"];
+/** The command of an `acp:<command>` agent id (`"opencode acp"` for `acp:opencode acp`), or undefined when it is not one or the command is empty. */
+export function parseAcpAgent(id) {
+    if (!id.startsWith("acp:"))
+        return undefined;
+    const command = id.slice("acp:".length).trim();
+    return command === "" ? undefined : command;
+}
 export function isSupportedAgent(id) {
-    return SUPPORTED_AGENTS.includes(id);
+    return SUPPORTED_AGENTS.includes(id) || parseAcpAgent(id) !== undefined;
 }
 /** The error for an agent id with no adapter. */
 export function unsupportedAgentError(id) {

package/dist/harness/auth.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Agent login probes (#339): does the agent a harness drives have a way to
+ * authenticate? Each adapter's `preflight()` calls its probe, so `sweny
+ * workflow run` and `sweny check` fail before any node runs, with the fix.
+ *
+ * Presence only. No probe reads a credential's value, and the macOS Keychain
+ * probe asks for the entry's attributes, never its secret.
+ */
+export type AuthProbeResult = {
+    ok: true;
+    via: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Test seam: adapters take one in their options instead of reading the host. */
+export type AuthProbe = () => AuthProbeResult;
+/** Same shape as the CLI's other "Missing:" lines; names the agent so the fix is unambiguous. */
+export declare const CLAUDE_CODE_AUTH_HINT: string;
+export declare const CODEX_AUTH_HINT = "Missing: OPENAI_API_KEY or CODEX_API_KEY, or a Codex login (`codex login`), for --agent codex";
+/**
+ * A local Claude Code login: `~/.claude/.credentials.json` (or under
+ * `CLAUDE_CONFIG_DIR`) and, on macOS, the Keychain entry (attributes only).
+ */
+export declare function detectClaudeCodeLogin(opts?: {
+    env?: Record<string, string | undefined>;
+    home?: string;
+    platform?: NodeJS.Platform;
+    keychainHasLogin?: () => boolean;
+}): boolean;
+/**
+ * Claude Code auth, the way the spawned agent will see it: Bedrock or Vertex
+ * routing, an env credential that survives `SWENY_AUTH` (`oauth` keeps only
+ * `CLAUDE_CODE_OAUTH_TOKEN`), or a stored Claude Code login.
+ */
+export declare function claudeCodeAuth(env?: Record<string, string | undefined>, login?: () => boolean): AuthProbeResult;
+/** Codex auth: an API key or access token in env, or a stored `codex login`. */
+export declare function codexAuth(env?: Record<string, string | undefined>, login?: () => boolean): AuthProbeResult;

package/dist/harness/auth.js

@@ -0,0 +1,93 @@
+/**
+ * Agent login probes (#339): does the agent a harness drives have a way to
+ * authenticate? Each adapter's `preflight()` calls its probe, so `sweny
+ * workflow run` and `sweny check` fail before any node runs, with the fix.
+ *
+ * Presence only. No probe reads a credential's value, and the macOS Keychain
+ * probe asks for the entry's attributes, never its secret.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import { hasCodexLogin } from "../agent-env.js";
+/** Same shape as the CLI's other "Missing:" lines; names the agent so the fix is unambiguous. */
+export const CLAUDE_CODE_AUTH_HINT = "Missing: ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`), " +
+    "or a Claude Code login (run `claude`, then /login), for --agent claude";
+export const CODEX_AUTH_HINT = "Missing: OPENAI_API_KEY or CODEX_API_KEY, or a Codex login (`codex login`), for --agent codex";
+function set(v) {
+    return typeof v === "string" && v.trim() !== "";
+}
+function truthy(v) {
+    if (!set(v))
+        return false;
+    const s = v.trim().toLowerCase();
+    return s !== "0" && s !== "false" && s !== "no" && s !== "off";
+}
+/**
+ * A local Claude Code login: `~/.claude/.credentials.json` (or under
+ * `CLAUDE_CONFIG_DIR`) and, on macOS, the Keychain entry (attributes only).
+ */
+export function detectClaudeCodeLogin(opts = {}) {
+    const env = opts.env ?? process.env;
+    const home = opts.home ?? os.homedir();
+    const platform = opts.platform ?? process.platform;
+    const configDir = env.CLAUDE_CONFIG_DIR || path.join(home, ".claude");
+    try {
+        if (fs.existsSync(path.join(configDir, ".credentials.json")))
+            return true;
+    }
+    catch {
+        // fall through
+    }
+    if (platform === "darwin") {
+        const probe = opts.keychainHasLogin ??
+            (() => {
+                const r = spawnSync("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
+                    stdio: "ignore",
+                    timeout: 3000,
+                });
+                return r.status === 0;
+            });
+        try {
+            return probe();
+        }
+        catch {
+            return false;
+        }
+    }
+    return false;
+}
+/**
+ * Claude Code auth, the way the spawned agent will see it: Bedrock or Vertex
+ * routing, an env credential that survives `SWENY_AUTH` (`oauth` keeps only
+ * `CLAUDE_CODE_OAUTH_TOKEN`), or a stored Claude Code login.
+ */
+export function claudeCodeAuth(env = process.env, login = () => detectClaudeCodeLogin({ env })) {
+    if (truthy(env.CLAUDE_CODE_USE_BEDROCK))
+        return { ok: true, via: "Amazon Bedrock" };
+    if (truthy(env.CLAUDE_CODE_USE_VERTEX))
+        return { ok: true, via: "Google Vertex AI" };
+    const mode = (env.SWENY_AUTH ?? "").trim().toLowerCase();
+    if (set(env.CLAUDE_CODE_OAUTH_TOKEN))
+        return { ok: true, via: "CLAUDE_CODE_OAUTH_TOKEN" };
+    if (mode !== "oauth") {
+        if (set(env.ANTHROPIC_API_KEY))
+            return { ok: true, via: "ANTHROPIC_API_KEY" };
+        if (set(env.ANTHROPIC_AUTH_TOKEN))
+            return { ok: true, via: "ANTHROPIC_AUTH_TOKEN" };
+    }
+    if (login())
+        return { ok: true, via: "Claude Code login" };
+    return { ok: false, reason: CLAUDE_CODE_AUTH_HINT };
+}
+/** Codex auth: an API key or access token in env, or a stored `codex login`. */
+export function codexAuth(env = process.env, login = () => hasCodexLogin(env)) {
+    for (const k of ["CODEX_API_KEY", "OPENAI_API_KEY", "CODEX_ACCESS_TOKEN"]) {
+        if (set(env[k]))
+            return { ok: true, via: k };
+    }
+    if (login())
+        return { ok: true, via: "codex login" };
+    return { ok: false, reason: CODEX_AUTH_HINT };
+}

package/dist/harness/capabilities.d.ts

@@ -56,3 +56,33 @@ export declare const CODEX_CAPABILITIES: HarnessCapabilities;
  * - cancel rpc: the `abort` command, then SIGTERM and SIGKILL.
  */
 export declare const PI_CAPABILITIES: HarnessCapabilities;
+/**
+ * Any ACP agent (`--agent acp:<command>`, #416), declared from the Agent
+ * Client Protocol schema v1.24.1 (agentclientprotocol/agent-client-protocol,
+ * `schema/v1/schema.json`, docs under `docs/protocol/v1/`) and probed by the
+ * contract suite against a scripted fake agent. ACP is the long-tail adapter:
+ * the protocol carries a prompt and a stream of updates, not sweny's opinions.
+ * - structuredOutput prompt: `PromptResponse` has only `stopReason`, so there
+ *   is no schema channel. sweny asks for the JSON in the prompt, parses it,
+ *   checks it and retries once.
+ * - toolTrace full: `tool_call` and `tool_call_update` session updates carry an
+ *   id, a kind, a status and (optionally) raw input and content.
+ * - builtinDeny none: the protocol has no tool allow or deny list. The only
+ *   hook is `session/request_permission`, which fires only when the agent
+ *   chooses to ask. sweny answers it by policy (best effort), but cannot
+ *   promise the agent asks, so nothing is declared.
+ * - mcp inject, exclusive none: `session/new` takes `mcpServers`, but whether
+ *   the agent also loads its own MCP config is agent-defined.
+ * - sandbox none: nothing in the protocol. The process wrapper (srt) is the
+ *   only containment, see sandbox-wrapper.ts.
+ * - readOnly none: modes are agent-defined. `policyGate` counts read-only as
+ *   enforced only with the wrapper's read-only mount.
+ * - turnLimit watchdog: no turn limit in the protocol; sweny counts tool calls.
+ * - usage costUsd only: `usage_update {used, size, cost?}` is the stable
+ *   usage. `used` and `size` are context window occupancy, not billed tokens,
+ *   so they are not mapped; `cost` (cumulative, ISO 4217 currency) is, when it
+ *   is USD. Per-turn token usage is behind an unstable flag.
+ * - cancel rpc: `session/cancel`, then kill.
+ * - resume false: sweny starts a fresh session per node.
+ */
+export declare const ACP_CAPABILITIES: HarnessCapabilities;

package/dist/harness/capabilities.js

@@ -90,3 +90,44 @@ export const PI_CAPABILITIES = {
     cancel: "rpc",
     resume: false,
 };
+/**
+ * Any ACP agent (`--agent acp:<command>`, #416), declared from the Agent
+ * Client Protocol schema v1.24.1 (agentclientprotocol/agent-client-protocol,
+ * `schema/v1/schema.json`, docs under `docs/protocol/v1/`) and probed by the
+ * contract suite against a scripted fake agent. ACP is the long-tail adapter:
+ * the protocol carries a prompt and a stream of updates, not sweny's opinions.
+ * - structuredOutput prompt: `PromptResponse` has only `stopReason`, so there
+ *   is no schema channel. sweny asks for the JSON in the prompt, parses it,
+ *   checks it and retries once.
+ * - toolTrace full: `tool_call` and `tool_call_update` session updates carry an
+ *   id, a kind, a status and (optionally) raw input and content.
+ * - builtinDeny none: the protocol has no tool allow or deny list. The only
+ *   hook is `session/request_permission`, which fires only when the agent
+ *   chooses to ask. sweny answers it by policy (best effort), but cannot
+ *   promise the agent asks, so nothing is declared.
+ * - mcp inject, exclusive none: `session/new` takes `mcpServers`, but whether
+ *   the agent also loads its own MCP config is agent-defined.
+ * - sandbox none: nothing in the protocol. The process wrapper (srt) is the
+ *   only containment, see sandbox-wrapper.ts.
+ * - readOnly none: modes are agent-defined. `policyGate` counts read-only as
+ *   enforced only with the wrapper's read-only mount.
+ * - turnLimit watchdog: no turn limit in the protocol; sweny counts tool calls.
+ * - usage costUsd only: `usage_update {used, size, cost?}` is the stable
+ *   usage. `used` and `size` are context window occupancy, not billed tokens,
+ *   so they are not mapped; `cost` (cumulative, ISO 4217 currency) is, when it
+ *   is USD. Per-turn token usage is behind an unstable flag.
+ * - cancel rpc: `session/cancel`, then kill.
+ * - resume false: sweny starts a fresh session per node.
+ */
+export const ACP_CAPABILITIES = {
+    structuredOutput: "prompt",
+    toolTrace: "full",
+    builtinDeny: "none",
+    mcp: { inject: true, exclusive: "none" },
+    sandbox: { fs: false, network: false },
+    readOnly: "none",
+    turnLimit: "watchdog",
+    usage: { tokens: false, costUsd: true, live: false },
+    cancel: "rpc",
+    resume: false,
+};

package/dist/harness/claude-code.d.ts

@@ -15,6 +15,7 @@ import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
 import { buildEvaluatePrompt } from "./prompts.js";
 import { parseToolResultContent, summarizeToolError } from "./parse.js";
 import { makeAbort } from "./abort.js";
+import { type AuthProbe } from "./auth.js";
 export { buildEvaluatePrompt, CLAUDE_CODE_CAPABILITIES };
 export { parseToolResultContent, summarizeToolError, makeAbort };
 /**
@@ -117,6 +118,8 @@ export interface ClaudeCodeHarnessOptions {
     sandboxAllowedDomains?: string[];
     /** Sandbox preflight probe (test seam). Returns a reason when the sandbox cannot run. */
     sandboxProbe?: () => string | undefined;
+    /** Login probe for `preflight()` (test seam). Default: {@link claudeCodeAuth} over `process.env`. */
+    authProbe?: AuthProbe;
     /**
      * Serve skill tools through the SwenyToolBridge (a stdio MCP shim over a
      * per-run unix socket, #414) instead of the in-process SDK MCP server.
@@ -149,6 +152,7 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     private envScope;
     private toolBridge;
     private toolBridgeShim;
+    private authProbe;
     constructor(opts?: ClaudeCodeHarnessOptions);
     /**
      * Build env for the Claude Code subprocess (#360). Applies auth precedence
@@ -162,9 +166,13 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     private buildEnv;
     /** Which harness (and SDK version) produced a result. */
     info(): HarnessInfo;
+    /** Checks the agent can authenticate (#339): an env credential, Bedrock/Vertex, or a Claude Code login. */
     preflight(): Promise<{
         ok: true;
         version: string;
+    } | {
+        ok: false;
+        reason: string;
     }>;
     /**
      * Run a node. Runs {@link policyGate} (always `degraded: []` for Claude

package/dist/harness/claude-code.js

@@ -19,6 +19,7 @@ import { jsonSchemaToZodShape, toolErrorToMcpResult, toolOutputToMcpResult } fro
 import { startToolBridge } from "./tool-bridge/server.js";
 import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./parse.js";
 import { makeAbort } from "./abort.js";
+import { claudeCodeAuth } from "./auth.js";
 export { buildEvaluatePrompt, CLAUDE_CODE_CAPABILITIES };
 export { parseToolResultContent, summarizeToolError, makeAbort };
 let cachedSdkVersion;
@@ -218,6 +219,7 @@ export class ClaudeCodeHarness {
     envScope;
     toolBridge;
     toolBridgeShim;
+    authProbe;
     constructor(opts = {}) {
         this.model = opts.model;
         this.maxTurns = opts.maxTurns ?? 20;
@@ -233,6 +235,7 @@ export class ClaudeCodeHarness {
         this.sandboxProbe = opts.sandboxProbe;
         this.toolBridge = opts.toolBridge ?? process.env.SWENY_TOOL_BRIDGE === "1";
         this.toolBridgeShim = opts.toolBridgeShim;
+        this.authProbe = opts.authProbe ?? (() => claudeCodeAuth(process.env));
     }
     /**
      * Build env for the Claude Code subprocess (#360). Applies auth precedence
@@ -260,7 +263,11 @@ export class ClaudeCodeHarness {
     info() {
         return { id: this.id, version: claudeSdkVersion() };
     }
+    /** Checks the agent can authenticate (#339): an env credential, Bedrock/Vertex, or a Claude Code login. */
     async preflight() {
+        const auth = this.authProbe();
+        if (!auth.ok)
+            return { ok: false, reason: auth.reason };
         return { ok: true, version: claudeSdkVersion() };
     }
     /**
@@ -301,7 +308,7 @@ export class ClaudeCodeHarness {
             ...req,
             readOnly,
             disallowedTools: disallowedTools.length > 0 ? disallowedTools : undefined,
-            strictMcp: readOnly || policy.strict,
+            strictMcp: readOnly || policy.strict || policy.exclusiveMcp === true,
             sandboxMode: policy.sandbox,
             agentAccess: { envVars: req.agentAccess?.envVars ?? [], domains: policy.egress },
         });

package/dist/harness/codex.d.ts

@@ -29,6 +29,7 @@ import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, Harness
 import { CODEX_CAPABILITIES } from "./capabilities.js";
 import { type HarnessPolicyMode } from "./policy.js";
 import { type SandboxWrapper } from "./sandbox-wrapper.js";
+import { type AuthProbe } from "./auth.js";
 export { CODEX_CAPABILITIES };
 /** Oldest Codex CLI whose flags this adapter uses (`--ignore-user-config`, `--ignore-rules`). */
 export declare const MIN_CODEX_VERSION = "0.159.0";
@@ -89,6 +90,8 @@ export interface CodexHarnessOptions {
     };
     /** Grace period between SIGTERM and SIGKILL when stopping Codex (default: 2000 ms). */
     killGraceMs?: number;
+    /** Login probe for `preflight()` (test seam). Default: {@link codexAuth} over `process.env`. */
+    authProbe?: AuthProbe;
 }
 /** A TOML value for `-c key=value`, as the official SDK writes it (sdk/typescript/src/exec.ts). */
 export declare function toTomlValue(value: unknown): string;
@@ -135,9 +138,13 @@ export declare class CodexHarness implements AgentHarness {
     private killGraceMs;
     private preflightResult;
     private version;
+    private authProbe;
     constructor(opts?: CodexHarnessOptions);
     info(): HarnessInfo;
-    /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
+    /**
+     * Before any node runs (#339): the Codex CLI is installed and new enough,
+     * and Codex can authenticate (an API key, an access token, or `codex login`).
+     */
     preflight(): Promise<{
         ok: true;
         version: string;
@@ -145,6 +152,8 @@ export declare class CodexHarness implements AgentHarness {
         ok: false;
         reason: string;
     }>;
+    /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
+    private checkCli;
     /** Env for the Codex process: scoped like Claude Code's, with Codex's auth vars instead of Anthropic's. */
     private buildEnv;
     /** The node policy after `disallowed_tools` names are translated into Codex classes. */

package/dist/harness/codex.js

@@ -37,6 +37,7 @@ import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./pars
 import { startToolBridge } from "./tool-bridge/server.js";
 import { defaultSandboxWrapper, prepareAgentSpawn, wrappersFrom, } from "./sandbox-wrapper.js";
 import { TOKEN_ENV } from "./tool-bridge/protocol.js";
+import { codexAuth } from "./auth.js";
 export { CODEX_CAPABILITIES };
 /** Oldest Codex CLI whose flags this adapter uses (`--ignore-user-config`, `--ignore-rules`). */
 export const MIN_CODEX_VERSION = "0.159.0";
@@ -288,6 +289,7 @@ export class CodexHarness {
     killGraceMs;
     preflightResult;
     version = "unknown";
+    authProbe;
     constructor(opts = {}) {
         this.model = opts.model;
         this.maxTurns = opts.maxTurns ?? 20;
@@ -305,12 +307,24 @@ export class CodexHarness {
         this.codexCommand = opts.codexCommand ?? { command: process.env.SWENY_CODEX_PATH || "codex", args: [] };
         this.toolBridgeShim = opts.toolBridgeShim;
         this.killGraceMs = opts.killGraceMs ?? 2000;
+        this.authProbe = opts.authProbe ?? (() => codexAuth(process.env));
     }
     info() {
         return { id: this.id, version: this.version };
     }
+    /**
+     * Before any node runs (#339): the Codex CLI is installed and new enough,
+     * and Codex can authenticate (an API key, an access token, or `codex login`).
+     */
+    async preflight() {
+        const cli = await this.checkCli();
+        if (!cli.ok)
+            return cli;
+        const auth = this.authProbe();
+        return auth.ok ? cli : { ok: false, reason: auth.reason };
+    }
     /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
-    preflight() {
+    checkCli() {
         this.preflightResult ??= new Promise((resolve) => {
             const { command, args } = this.codexCommand;
             execFile(command, [...args, "--version"], { timeout: 30_000 }, (err, stdout) => {
@@ -723,7 +737,7 @@ export class CodexHarness {
         };
         if (gate.refuse)
             return refused(gate.refuse);
-        const pre = await this.preflight();
+        const pre = await this.checkCli();
         if (!pre.ok) {
             this.logger.error(pre.reason);
             return tag({ status: "failed", data: { error: pre.reason }, toolCalls: [] });
@@ -922,7 +936,7 @@ export class CodexHarness {
                 : `codex.ask: ${why}. Returning empty string.`);
             return null;
         };
-        const pre = await this.preflight();
+        const pre = await this.checkCli();
         if (!pre.ok)
             return failClosed(pre.reason);
         const args = [

package/dist/harness/index.d.ts

@@ -4,6 +4,7 @@
  */
 import { ClaudeCodeHarness, type ClaudeCodeHarnessOptions } from "./claude-code.js";
 import { CodexHarness, type CodexHarnessOptions } from "./codex.js";
+import { AcpHarness, type AcpHarnessOptions } from "./acp.js";
 import { PiHarness, type PiHarnessOptions } from "./pi.js";
 export { claudeCompat, asClaude } from "./compat.js";
 export type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, PolicyGateResult, PolicyWrappers, ToolClass, } from "./types.js";
@@ -14,12 +15,14 @@ export { ClaudeCodeHarness, CLAUDE_CODE_CAPABILITIES } from "./claude-code.js";
 export type { ClaudeCodeHarnessOptions } from "./claude-code.js";
 export { CodexHarness, CODEX_CAPABILITIES, MIN_CODEX_VERSION } from "./codex.js";
 export type { CodexHarnessOptions } from "./codex.js";
+export { AcpHarness, ACP_CAPABILITIES, ACP_PROTOCOL_VERSION } from "./acp.js";
+export type { AcpHarnessOptions } from "./acp.js";
 export { PiHarness, PI_CAPABILITIES, MIN_PI_VERSION } from "./pi.js";
 export type { PiHarnessOptions } from "./pi.js";
 export { startToolBridge } from "./tool-bridge/server.js";
 export type { ToolBridge, ToolBridgeOptions } from "./tool-bridge/server.js";
-export { SUPPORTED_AGENTS, isSupportedAgent, unsupportedAgentError } from "./agents.js";
-export type { SupportedAgent } from "./agents.js";
+export { SUPPORTED_AGENTS, isSupportedAgent, parseAcpAgent, unsupportedAgentError } from "./agents.js";
+export type { AcpAgentId, SupportedAgent } from "./agents.js";
 /**
  * Build the harness for an agent id. `claude` is the historical `--agent` /
  * `coding-agent-provider` value and means the same as `claude-code`.
@@ -28,4 +31,5 @@ export type { SupportedAgent } from "./agents.js";
 export declare function createHarness(id: "claude" | "claude-code", opts?: ClaudeCodeHarnessOptions): ClaudeCodeHarness;
 export declare function createHarness(id: "codex", opts?: CodexHarnessOptions): CodexHarness;
 export declare function createHarness(id: "pi", opts?: PiHarnessOptions): PiHarness;
-export declare function createHarness(id: string, opts?: ClaudeCodeHarnessOptions & CodexHarnessOptions & PiHarnessOptions): ClaudeCodeHarness | CodexHarness | PiHarness;
+export declare function createHarness(id: `acp:${string}`, opts?: AcpHarnessOptions): AcpHarness;
+export declare function createHarness(id: string, opts?: ClaudeCodeHarnessOptions & CodexHarnessOptions & PiHarnessOptions & AcpHarnessOptions): ClaudeCodeHarness | CodexHarness | PiHarness | AcpHarness;

package/dist/harness/index.js

@@ -4,17 +4,22 @@
  */
 import { ClaudeCodeHarness } from "./claude-code.js";
 import { CodexHarness } from "./codex.js";
+import { AcpHarness } from "./acp.js";
 import { PiHarness } from "./pi.js";
-import { unsupportedAgentError } from "./agents.js";
+import { parseAcpAgent, unsupportedAgentError } from "./agents.js";
 export { claudeCompat, asClaude } from "./compat.js";
 export { policyGate, nativeDenyClasses, resolveHarnessPolicy, isToolClass, TOOL_CLASSES } from "./policy.js";
 export { ask, evaluate, buildAskPrompt, buildEvaluatePrompt } from "./prompts.js";
 export { ClaudeCodeHarness, CLAUDE_CODE_CAPABILITIES } from "./claude-code.js";
 export { CodexHarness, CODEX_CAPABILITIES, MIN_CODEX_VERSION } from "./codex.js";
+export { AcpHarness, ACP_CAPABILITIES, ACP_PROTOCOL_VERSION } from "./acp.js";
 export { PiHarness, PI_CAPABILITIES, MIN_PI_VERSION } from "./pi.js";
 export { startToolBridge } from "./tool-bridge/server.js";
-export { SUPPORTED_AGENTS, isSupportedAgent, unsupportedAgentError } from "./agents.js";
+export { SUPPORTED_AGENTS, isSupportedAgent, parseAcpAgent, unsupportedAgentError } from "./agents.js";
 export function createHarness(id, opts = {}) {
+    // `acp:<command>` (#416): any ACP agent. An empty command is an error, not a fallback.
+    if (id.startsWith("acp:"))
+        return new AcpHarness({ ...opts, acpCommand: parseAcpAgent(id) ?? "" });
     switch (id) {
         case "claude":
         case "claude-code":

package/dist/harness/parse.d.ts

@@ -47,3 +47,15 @@ export declare function summarizeToolError(parsed: unknown): string;
  * non-conforming model answer is at least attributable.
  */
 export declare function tryParseJSON(text: string, outputSchema?: JSONSchema, logger?: Pick<Logger, "warn">, label?: string): Record<string, unknown>;
+/**
+ * Lightweight structural check of a parsed object against a JSON Schema.
+ *
+ * Deliberately shallow: it verifies `required` keys are present and that the
+ * top-level `type` and each declared property `type` match. It does NOT do
+ * full JSON Schema validation (no `$ref`, `oneOf`, formats, nested arrays).
+ * The contract here is "flag an obviously non-conforming object" so a mismatch
+ * is logged rather than silently accepted; it is not a validation gate.
+ *
+ * Returns a list of human-readable problems; empty means no detected mismatch.
+ */
+export declare function schemaMismatches(value: unknown, schema: JSONSchema): string[];

package/dist/harness/parse.js

@@ -195,7 +195,7 @@ export function tryParseJSON(text, outputSchema, logger, label = "Claude") {
  *
  * Returns a list of human-readable problems; empty means no detected mismatch.
  */
-function schemaMismatches(value, schema) {
+export function schemaMismatches(value, schema) {
     const problems = [];
     const s = schema;
     if (s.type === "object" || s.properties || s.required) {

package/dist/harness/policy.js

@@ -74,6 +74,12 @@ export function policyGate(caps, policy, wrappers = {}) {
             unenforced.push(`disallowed_tools [${policy.nativeDeny.join(", ")}]: harness has no tools by these names`);
         }
     }
+    // Exclusive MCP (`permissions.strict`): only the servers sweny passes may
+    // load, never the user's own config. A harness that cannot exclude them
+    // cannot honor it, so strict refuses the node.
+    if (policy.exclusiveMcp && caps.mcp.exclusive === "none") {
+        unenforced.push("exclusive MCP: harness cannot keep the user's own MCP servers out of the run");
+    }
     if (policy.egress.length > 0 && !caps.sandbox.network && !wrappers.egress) {
         unenforced.push("egress allowlist: harness has no network sandbox and no egress wrapper is active");
     }

package/dist/harness/types.d.ts

@@ -55,6 +55,12 @@ export interface NodePolicy {
     egress: string[];
     /** Refuse instead of degrade when an opinion cannot be enforced. */
     strict: boolean;
+    /**
+     * Only the MCP servers sweny passes may load, never the user's own config
+     * (`permissions.strict`, #365). A harness whose `mcp.exclusive` is `none`
+     * cannot honor it: reported in `degraded`, refused under `strict`.
+     */
+    exclusiveMcp?: boolean;
     /**
      * Turn budget for the run. Set by adapters whose `turnLimit` is not native,
      * so the gate reports how the budget is kept (watchdog) or that it is not.

package/dist/index.d.ts

@@ -21,7 +21,7 @@
  * })
  * ```
  */
-export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, Source, ResolvedSource, SourceKind, SourceResolutionMap, WorkflowInputs, WorkflowInputField, WorkflowInputType, InputValidationError, InputValidationResult, Evaluator, EvaluatorRule, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, NodeToolFilter, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, NodeOnFail, McpTransport, WorkflowType, SkillHarnessKey, NodeAccess, NodePermissions, NodePermissionsSpec, SafeOutputType, SafeOutputDeclaration, SafeOutputsPolicy, SafeOutputReceipt, AuthorAssociation, } from "./types.js";
+export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, Source, ResolvedSource, SourceKind, SourceResolutionMap, WorkflowInputs, WorkflowInputField, WorkflowInputType, InputValidationError, InputValidationResult, Evaluator, EvaluatorRule, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, NodeToolFilter, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, NodeOnFail, McpTransport, WorkflowType, SkillHarnessKey, NodeAccess, NodePermissions, NodePermissionsSpec, SafeOutputType, SafeOutputDeclaration, SafeOutputsPolicy, SafeOutputReceipt, SafeOutputPin, AuthorAssociation, } from "./types.js";
 export { WORKFLOW_INPUT_TYPES } from "./types.js";
 export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, NODE_ACCESS, TOOL_CLASSES, SAFE_OUTPUT_TYPES, SAFE_OUTPUT_APPLIERS, AUTHOR_ASSOCIATIONS, } from "./types.js";
 export { consoleLogger } from "./types.js";

package/dist/node-policy.js

@@ -38,5 +38,6 @@ export function buildNodePolicy(opts) {
         ...(opts.disallowedTools && opts.disallowedTools.length > 0 ? { nativeDeny: opts.disallowedTools } : {}),
         egress: opts.egress ?? [],
         strict: opts.permissions.strict,
+        ...(opts.permissions.strict ? { exclusiveMcp: true } : {}),
     };
 }

package/dist/safe-outputs.d.ts

@@ -9,11 +9,11 @@
  * the write, so this holds on every harness.
  *
  * Order of checks per intent (all deterministic): declared type, workflow
- * ceiling, actor trust, expiry, skill, target pin, shape and size, labels,
- * title prefix, dedupe, node cap, run cap. An optional model screen runs last
+ * ceiling, actor trust, expiry, skill, target pin, issue pin, shape and size,
+ * labels, title prefix, dedupe, node cap, run cap. An optional model screen runs last
  * over the intents that passed and can only veto them.
  */
-import type { Logger, SafeOutputDeclaration, SafeOutputReceipt, SafeOutputsPolicy, SafeOutputType, Skill, Tool } from "./types.js";
+import type { Logger, SafeOutputDeclaration, SafeOutputPin, SafeOutputReceipt, SafeOutputsPolicy, SafeOutputType, Skill, Tool } from "./types.js";
 /** Name of the intent-recording tool a node with `outputs` receives. */
 export declare const EMIT_OUTPUT_TOOL = "emit_output";
 /** Longest title the write stage accepts (after the prefix). */
@@ -43,7 +43,7 @@ export interface SafeOutputIntent {
  */
 export declare function createEmitOutputTool(declarations: SafeOutputDeclaration[], buffer: SafeOutputIntent[], now?: () => number): Tool;
 /** Instruction block that tells the agent how writes work at this node. */
-export declare function safeOutputsInstruction(declarations: SafeOutputDeclaration[]): string;
+export declare function safeOutputsInstruction(declarations: SafeOutputDeclaration[], input?: Record<string, unknown>): string;
 export interface ActorInfo {
     /** GitHub login of whoever triggered the run. */
     login?: string;
@@ -54,9 +54,19 @@ export interface ActorInfo {
 export declare function resolveActor(env: Record<string, string | undefined>, override?: ActorInfo): ActorInfo;
 /** True when no trust list is declared, or the actor matches one. Unknown actor = untrusted. */
 export declare function actorTrusted(policy: SafeOutputsPolicy | undefined, actor: ActorInfo): boolean;
+/**
+ * The issue or PR a declaration pins, as a string. `{ input: name }` reads the
+ * run input; an absent or empty value is `undefined`, which refuses the write.
+ */
+export declare function resolvePin(pin: SafeOutputPin, input?: Record<string, unknown>): string | undefined;
 /** `30m` → 1_800_000. Undefined for anything the schema would reject. */
 export declare function parseDuration(s: string | undefined): number | undefined;
-/** The skill that applies a declaration: its `via`, else the first node skill (then any loaded skill) that can. */
+/**
+ * The skill that applies a declaration: its `via`, else the first node skill
+ * that can and is configured, else the first node skill that can, else any
+ * configured skill that can. A node listing `[linear, github]` therefore files
+ * on GitHub when only GitHub has credentials.
+ */
 export declare function resolveOutputSkill(decl: SafeOutputDeclaration, nodeSkills: string[], skills: Map<string, Skill>): string | undefined;
 /** Declarations whose applying skill is not configured (no credentials loaded). */
 export declare function unresolvedOutputs(declarations: SafeOutputDeclaration[], nodeSkills: string[], skills: Map<string, Skill>): SafeOutputType[];
@@ -85,6 +95,8 @@ export interface ApplySafeOutputsOptions {
     staged: boolean;
     state: WriteStageState;
     logger: Logger;
+    /** The run input, for `number: { input }` pins. */
+    input?: Record<string, unknown>;
     /**
      * Model screen (only called when `policy.screen` is on and at least one write
      * passed every deterministic check). Anything but `ALLOW` is a veto.