@sweny-ai/core 0.1.149 → 0.1.150

package/dist/cli/packs.js

@@ -10,11 +10,15 @@
  *   - validates with no credentials
  *   - every node declares an `output` schema and at least one `eval` gate
  *   - value and function gates first; a judge only where a rule cannot decide
- *   - every node is read-only except the delivery node, and each node's write
- *     tools are named in `pack.writes`; the delivery node also restricts its
- *     tool list with `tools.allow`
- *   - harness-agnostic: instructions name SWEny skill tools and plain
- *     read-only shell commands, never a specific agent's built-in tools
+ *   - safe outputs (#365): every GitHub write (issue, comment) is a declared
+ *     output with a cap, and a pin or title prefix where one applies; sweny
+ *     applies it after the node. No node holds a GitHub write tool.
+ *   - least privilege: a workflow-level `permissions` ceiling, and every node
+ *     is `read` except a delivery node that needs a write no safe output
+ *     covers (Slack); its write tools are named in `pack.writes` and its tool
+ *     list is restricted with `tools.allow`
+ *   - harness-agnostic: instructions name SWEny skill tools, never a specific
+ *     agent's built-in tools
  */
 const DIGEST_YAML = `id: weekly-digest
 name: Weekly Repo Digest
@@ -37,13 +41,20 @@ inputs:
     enum: [issue, slack, none]
     default: issue
 
+# Ceiling (#365): write only for the Slack post in publish. The digest issue is
+# a safe output, applied by sweny after publish, at most one per run.
+permissions: write
+safe_outputs:
+  allow: [issue]
+  max: 1
+
 nodes:
   collect:
     name: Collect the Week
     instruction: |
       Gather facts about the last N days, where N is context.input.days
-      (default 7). The repo is context.input.repo; if empty, use the
-      GITHUB_REPOSITORY environment variable, else the origin remote.
+      (default 7). The repo is context.input.repo; if empty, read the origin
+      remote URL from .git/config in the checkout.
       Compute the window as UTC dates: until is today, since is N days ago.
 
       1. Commits on the default branch in the window:
@@ -54,18 +65,19 @@ nodes:
       3. Issues opened and issues closed in the window:
          github_search_issues with "is:issue created:>=SINCE" and
          "is:issue closed:>=SINCE".
-      4. Files touched, with churn: run a read-only git command in the
-         checkout, for example "git log --since=SINCE --no-merges
-         --numstat --format=", and sum added plus deleted lines per path.
-         Keep the 15 paths with the most churn.
+      4. Files touched, with churn: github_list_pr_files for each merged PR
+         (at most 20, newest first), and sum additions plus deletions per
+         path. Keep the 15 paths with the most churn.
 
-      Only read. Never create, edit, comment, post, or push anything.
-      Report only what the tools returned. A quiet week is a valid result.
+      Only read. Report only what the tools returned. A quiet week is a
+      valid result.
     skills: [github]
+    permissions: read
     tools:
       allow:
         - github_list_recent_commits
         - github_search_issues
+        - github_list_pr_files
     max_turns: 30
     output:
       type: object
@@ -199,6 +211,7 @@ nodes:
       Copy the counts exactly from the collected facts; never estimate.
       watch_next is at most 3 short items a maintainer should look at next
       week (for example, a risky file that changed without a test).
+    permissions: read
     max_turns: 5
     output:
       type: object
@@ -271,19 +284,27 @@ nodes:
 
       - issue: first call github_search_issues for an open issue labelled
         sweny-digest whose title is "Weekly digest SINCE to UNTIL". If one
-        exists, do not create another. Otherwise call github_create_issue
-        with that title, the body, and the label sweny-digest.
+        exists, do not request another. Otherwise request it with
+        emit_output: type issue, that title, the body, and dedupe_key
+        "weekly-digest-SINCE". sweny files it after this step and adds the
+        sweny-digest label.
       - slack: call slack_send_message once with the body as mrkdwn.
-      - none: call no tool; just return the body.
+      - none: request nothing; just return the body.
 
-      This is the only step allowed to write, and only to the destination
-      above.
+      delivered means the issue was requested or the Slack message was sent.
     skills: [github, slack]
+    # Write only for slack_send_message (no safe output covers Slack). The
+    # issue is a declared output: capped at one, labelled, title-prefixed.
+    permissions: write
     tools:
       allow:
         - github_search_issues
-        - github_create_issue
         - slack_send_message
+    outputs:
+      - type: issue
+        max: 1
+        title_prefix: "Weekly digest "
+        labels: [sweny-digest]
     max_turns: 8
     output:
       type: object
@@ -307,12 +328,13 @@ nodes:
           output_matches:
             - path: destination
               in: [issue, slack, none]
-      - name: delivery_never_opens_a_pr
+      - name: delivery_never_writes_github_directly
         kind: function
         rule:
           no_tool_called:
             - github_create_pr
             - github_add_comment
+            - github_create_issue
 
 edges:
   - from: collect
@@ -342,7 +364,8 @@ jobs:
         with:
           workflow: .sweny/workflows/weekly-digest.yml
           claude-oauth-token: \${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          # input: '{"days": 7, "deliver": "slack"}'
+          input: '{"repo": "\${{ github.repository }}"}'
+          # input: '{"repo": "\${{ github.repository }}", "days": 7, "deliver": "slack"}'
         env:
           GITHUB_TOKEN: \${{ github.token }}
           # SLACK_WEBHOOK_URL: \${{ secrets.SLACK_WEBHOOK_URL }}
@@ -381,6 +404,13 @@ inputs:
     enum: [low, medium, high, critical]
     default: medium
 
+# Ceiling (#365): every node is read-only. The one issue (or the one comment
+# on it) is a safe output, applied by sweny after file-issue.
+permissions: read
+safe_outputs:
+  allow: [issue, comment]
+  max: 1
+
 nodes:
   inventory:
     name: Read the Lockfiles
@@ -446,7 +476,7 @@ nodes:
     name: Fetch Open Advisories
     instruction: |
       Call github_list_dependabot_alerts for the repo (context.input.repo;
-      if empty, GITHUB_REPOSITORY or the origin remote).
+      if empty, the origin remote URL in .git/config).
 
       If the tool returns unavailable: true, record available as false and
       return no alerts. Do NOT guess advisories from memory: an advisory you
@@ -589,24 +619,31 @@ nodes:
       Always start with github_search_issues for an open issue labelled
       sweny-drift (query: "is:issue is:open label:sweny-drift").
 
-      - If action is "none": create nothing. Return result "none".
+      - If action is "none": request nothing. Return result "none".
       - If an open sweny-drift issue exists and lists the same advisory ids
         and drift paths: change nothing. Return result "unchanged".
-      - If it exists but the set changed: call github_add_comment once on
-        that issue with only what is new. Return result "updated".
-      - If none exists: call github_create_issue once, titled
-        "Dependency drift: N actionable", label sweny-drift. The body has a
-        table (package, severity, advisory id, why it matters, fix), the
-        drift paths with reasons, and the deferred count. Return "created".
-
-      Never open a pull request. Never edit code or lockfiles. At most one
-      issue is created per run.
+      - If it exists but the set changed: request one comment on that issue
+        (emit_output type comment, number = the issue number) with only what
+        is new. Return result "updated".
+      - If none exists: request one issue (emit_output type issue) titled
+        "Dependency drift: N actionable". The body has a table (package,
+        severity, advisory id, why it matters, fix), the drift paths with
+        reasons, and the deferred count. Return "created". sweny files it
+        after this step and adds the sweny-drift label.
+
+      You cannot write to GitHub directly here: requests are applied after
+      this step, at most one per run.
     skills: [github]
     tools:
       allow:
         - github_search_issues
-        - github_create_issue
-        - github_add_comment
+    outputs:
+      - type: issue
+        max: 1
+        title_prefix: "Dependency drift: "
+        labels: [sweny-drift]
+      - type: comment
+        max: 1
     max_turns: 8
     output:
       type: object
@@ -627,11 +664,13 @@ nodes:
         rule:
           any_tool_called:
             - github_search_issues
-      - name: no_code_writes
+      - name: no_direct_github_writes
         kind: function
         rule:
           no_tool_called:
             - github_create_pr
+            - github_create_issue
+            - github_add_comment
       - name: result_is_valid
         kind: value
         rule:
@@ -669,6 +708,7 @@ jobs:
         with:
           workflow: .sweny/workflows/dependency-drift.yml
           claude-oauth-token: \${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          input: '{"repo": "\${{ github.repository }}"}'
         env:
           # The built-in token cannot read Dependabot alerts. Use a fine-grained
           # token with Dependabot alerts: read, Issues: write, Contents: read.
@@ -703,6 +743,14 @@ inputs:
     description: Pull request number. The Action snippet passes github.event.pull_request.number.
     default: 0
 
+# Ceiling (#365): every node is read-only. The review comment is a safe
+# output pinned to context.input.pr_number, applied by sweny after
+# post-comment.
+permissions: read
+safe_outputs:
+  allow: [comment]
+  max: 1
+
 nodes:
   scope:
     name: Measure the Change
@@ -876,9 +924,9 @@ nodes:
   post-comment:
     name: Post the Review Comment
     instruction: |
-      Post exactly one comment on the pull request with github_add_comment
-      (repo context.input.repo or GITHUB_REPOSITORY, issue_number
-      context.input.pr_number).
+      Request exactly one comment on the pull request with emit_output
+      (type comment). It can only land on context.input.pr_number; sweny
+      posts it after this step.
 
       Start the body with the line: <!-- sweny-pr-risk -->
       Then: "Risk: LEVEL" with the size, then the reasons as short bullets
@@ -886,34 +934,36 @@ nodes:
       "Read-only scope review. No code was changed."
       Keep it under 15 lines. No emoji walls, no praise.
 
-      This is the only step allowed to write, and it may only comment.
+      This is the only step that asks for a write, and it may only comment.
     skills: [github]
     tools:
       allow:
-        - github_add_comment
+        - github_get_issue
+    outputs:
+      - type: comment
+        max: 1
+        number: { input: pr_number }
     max_turns: 4
     output:
       type: object
       properties:
-        posted:
+        requested:
           type: boolean
-        comment_url:
-          type: string
         risk_level:
           type: string
           enum: [low, medium, high]
-      required: [posted, risk_level]
+      required: [requested, risk_level]
     eval:
-      - name: comment_was_posted
+      - name: comment_was_requested
         kind: function
         rule:
           all_tools_called:
-            - github_add_comment
+            - emit_output
       - name: comment_result
         kind: value
         rule:
           output_matches:
-            - path: posted
+            - path: requested
               equals: true
             - path: risk_level
               in: [low, medium, high]
@@ -974,7 +1024,7 @@ export const PACK_TEMPLATES = [
             trigger: DIGEST_TRIGGER,
             sample: DIGEST_SAMPLE,
             tokens: "15k to 40k per run (estimate)",
-            writes: { publish: ["github_create_issue", "slack_send_message"] },
+            writes: { publish: ["slack_send_message"] },
         },
     },
     {
@@ -986,7 +1036,7 @@ export const PACK_TEMPLATES = [
             trigger: DRIFT_TRIGGER,
             sample: DRIFT_SAMPLE,
             tokens: "20k to 60k per run (estimate)",
-            writes: { "file-issue": ["github_create_issue", "github_add_comment"] },
+            writes: {},
         },
     },
     {
@@ -998,7 +1048,7 @@ export const PACK_TEMPLATES = [
             trigger: RISK_TRIGGER,
             sample: RISK_SAMPLE,
             tokens: "10k to 30k per run (estimate)",
-            writes: { "post-comment": ["github_add_comment"] },
+            writes: {},
         },
     },
 ];

package/dist/executor.js

@@ -80,6 +80,8 @@ export async function execute(workflow, input, options) {
     const runEnv = options.env ?? process.env;
     const usesOutputs = Object.values(workflow.nodes).some((n) => (n.outputs?.length ?? 0) > 0);
     const actor = usesOutputs ? resolveActor(runEnv, options.actor) : {};
+    // The run input, for `number: { input }` issue pins on outputs.
+    const runInput = input && typeof input === "object" ? input : undefined;
     // Build an eval-time alias table from the loaded skills. Each skill owns
     // its own mapping between skill-tool names and equivalent MCP names. Core
     // stays vendor-neutral; this call just unions what the skills declare.
@@ -257,7 +259,9 @@ export async function execute(workflow, input, options) {
         const effectiveRules = assembleCascaded("rules", currentId, workflow.nodes[currentId], inputRules.length, (workflow.rules ?? []).length, resolvedSources);
         const effectiveContext = assembleCascaded("context", currentId, workflow.nodes[currentId], inputContext.length, (workflow.context ?? []).length, resolvedSources);
         const baseInstruction = buildNodeInstruction(resolvedInstruction, effectiveRules, effectiveContext, input, skillInstructions);
-        const nodeInstruction = outputDecls.length > 0 ? `${baseInstruction}\n\n${safeOutputsInstruction(outputDecls)}` : baseInstruction;
+        const nodeInstruction = outputDecls.length > 0
+            ? `${baseInstruction}\n\n${safeOutputsInstruction(outputDecls, runInput)}`
+            : baseInstruction;
         const instruction = dryRun ? `${dryRunNotice(skippedWrites)}\n\n---\n\n${nodeInstruction}` : nodeInstruction;
         // Run Claude on this node, with optional eval-failure retry loop.
         let attempt = 0;
@@ -462,6 +466,7 @@ export async function execute(workflow, input, options) {
                     staged: stageOutputs,
                     state: writeState,
                     logger,
+                    input: runInput,
                     screen: async (writes) => claude.ask({
                         instruction: SAFE_OUTPUT_SCREEN_INSTRUCTION,
                         context: { writes },
@@ -610,10 +615,17 @@ function warnOnJudgeBudget(workflow, logger) {
  * including when no evaluator ran (the trusted namespace is then empty).
  */
 function buildPriorNodeContext(result) {
-    const data = (result.data ?? {});
+    const { safe_outputs: _forged, ...data } = (result.data ?? {});
     const evals = result.evals ?? [];
     const evalsByName = Object.fromEntries(evals.map((e) => [e.name, e]));
-    return { ...data, evals: evalsByName };
+    // Safe-output receipts (#365) are runtime facts, like evals: what sweny
+    // actually wrote (type, status, ref, url). A downstream node reads the new
+    // issue's identifier here. Agent data can never shadow them.
+    return {
+        ...data,
+        evals: evalsByName,
+        ...(result.outputs && result.outputs.length > 0 ? { safe_outputs: result.outputs } : {}),
+    };
 }
 /**
  * Build the prior-node entry shown to the LLM route evaluator.

package/dist/harness/auth.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Agent login probes (#339): does the agent a harness drives have a way to
+ * authenticate? Each adapter's `preflight()` calls its probe, so `sweny
+ * workflow run` and `sweny check` fail before any node runs, with the fix.
+ *
+ * Presence only. No probe reads a credential's value, and the macOS Keychain
+ * probe asks for the entry's attributes, never its secret.
+ */
+export type AuthProbeResult = {
+    ok: true;
+    via: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Test seam: adapters take one in their options instead of reading the host. */
+export type AuthProbe = () => AuthProbeResult;
+/** Same shape as the CLI's other "Missing:" lines; names the agent so the fix is unambiguous. */
+export declare const CLAUDE_CODE_AUTH_HINT: string;
+export declare const CODEX_AUTH_HINT = "Missing: OPENAI_API_KEY or CODEX_API_KEY, or a Codex login (`codex login`), for --agent codex";
+/**
+ * A local Claude Code login: `~/.claude/.credentials.json` (or under
+ * `CLAUDE_CONFIG_DIR`) and, on macOS, the Keychain entry (attributes only).
+ */
+export declare function detectClaudeCodeLogin(opts?: {
+    env?: Record<string, string | undefined>;
+    home?: string;
+    platform?: NodeJS.Platform;
+    keychainHasLogin?: () => boolean;
+}): boolean;
+/**
+ * Claude Code auth, the way the spawned agent will see it: Bedrock or Vertex
+ * routing, an env credential that survives `SWENY_AUTH` (`oauth` keeps only
+ * `CLAUDE_CODE_OAUTH_TOKEN`), or a stored Claude Code login.
+ */
+export declare function claudeCodeAuth(env?: Record<string, string | undefined>, login?: () => boolean): AuthProbeResult;
+/** Codex auth: an API key or access token in env, or a stored `codex login`. */
+export declare function codexAuth(env?: Record<string, string | undefined>, login?: () => boolean): AuthProbeResult;

package/dist/harness/auth.js

@@ -0,0 +1,93 @@
+/**
+ * Agent login probes (#339): does the agent a harness drives have a way to
+ * authenticate? Each adapter's `preflight()` calls its probe, so `sweny
+ * workflow run` and `sweny check` fail before any node runs, with the fix.
+ *
+ * Presence only. No probe reads a credential's value, and the macOS Keychain
+ * probe asks for the entry's attributes, never its secret.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import { hasCodexLogin } from "../agent-env.js";
+/** Same shape as the CLI's other "Missing:" lines; names the agent so the fix is unambiguous. */
+export const CLAUDE_CODE_AUTH_HINT = "Missing: ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`), " +
+    "or a Claude Code login (run `claude`, then /login), for --agent claude";
+export const CODEX_AUTH_HINT = "Missing: OPENAI_API_KEY or CODEX_API_KEY, or a Codex login (`codex login`), for --agent codex";
+function set(v) {
+    return typeof v === "string" && v.trim() !== "";
+}
+function truthy(v) {
+    if (!set(v))
+        return false;
+    const s = v.trim().toLowerCase();
+    return s !== "0" && s !== "false" && s !== "no" && s !== "off";
+}
+/**
+ * A local Claude Code login: `~/.claude/.credentials.json` (or under
+ * `CLAUDE_CONFIG_DIR`) and, on macOS, the Keychain entry (attributes only).
+ */
+export function detectClaudeCodeLogin(opts = {}) {
+    const env = opts.env ?? process.env;
+    const home = opts.home ?? os.homedir();
+    const platform = opts.platform ?? process.platform;
+    const configDir = env.CLAUDE_CONFIG_DIR || path.join(home, ".claude");
+    try {
+        if (fs.existsSync(path.join(configDir, ".credentials.json")))
+            return true;
+    }
+    catch {
+        // fall through
+    }
+    if (platform === "darwin") {
+        const probe = opts.keychainHasLogin ??
+            (() => {
+                const r = spawnSync("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
+                    stdio: "ignore",
+                    timeout: 3000,
+                });
+                return r.status === 0;
+            });
+        try {
+            return probe();
+        }
+        catch {
+            return false;
+        }
+    }
+    return false;
+}
+/**
+ * Claude Code auth, the way the spawned agent will see it: Bedrock or Vertex
+ * routing, an env credential that survives `SWENY_AUTH` (`oauth` keeps only
+ * `CLAUDE_CODE_OAUTH_TOKEN`), or a stored Claude Code login.
+ */
+export function claudeCodeAuth(env = process.env, login = () => detectClaudeCodeLogin({ env })) {
+    if (truthy(env.CLAUDE_CODE_USE_BEDROCK))
+        return { ok: true, via: "Amazon Bedrock" };
+    if (truthy(env.CLAUDE_CODE_USE_VERTEX))
+        return { ok: true, via: "Google Vertex AI" };
+    const mode = (env.SWENY_AUTH ?? "").trim().toLowerCase();
+    if (set(env.CLAUDE_CODE_OAUTH_TOKEN))
+        return { ok: true, via: "CLAUDE_CODE_OAUTH_TOKEN" };
+    if (mode !== "oauth") {
+        if (set(env.ANTHROPIC_API_KEY))
+            return { ok: true, via: "ANTHROPIC_API_KEY" };
+        if (set(env.ANTHROPIC_AUTH_TOKEN))
+            return { ok: true, via: "ANTHROPIC_AUTH_TOKEN" };
+    }
+    if (login())
+        return { ok: true, via: "Claude Code login" };
+    return { ok: false, reason: CLAUDE_CODE_AUTH_HINT };
+}
+/** Codex auth: an API key or access token in env, or a stored `codex login`. */
+export function codexAuth(env = process.env, login = () => hasCodexLogin(env)) {
+    for (const k of ["CODEX_API_KEY", "OPENAI_API_KEY", "CODEX_ACCESS_TOKEN"]) {
+        if (set(env[k]))
+            return { ok: true, via: k };
+    }
+    if (login())
+        return { ok: true, via: "codex login" };
+    return { ok: false, reason: CODEX_AUTH_HINT };
+}

package/dist/harness/claude-code.d.ts

@@ -15,6 +15,7 @@ import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
 import { buildEvaluatePrompt } from "./prompts.js";
 import { parseToolResultContent, summarizeToolError } from "./parse.js";
 import { makeAbort } from "./abort.js";
+import { type AuthProbe } from "./auth.js";
 export { buildEvaluatePrompt, CLAUDE_CODE_CAPABILITIES };
 export { parseToolResultContent, summarizeToolError, makeAbort };
 /**
@@ -117,6 +118,8 @@ export interface ClaudeCodeHarnessOptions {
     sandboxAllowedDomains?: string[];
     /** Sandbox preflight probe (test seam). Returns a reason when the sandbox cannot run. */
     sandboxProbe?: () => string | undefined;
+    /** Login probe for `preflight()` (test seam). Default: {@link claudeCodeAuth} over `process.env`. */
+    authProbe?: AuthProbe;
     /**
      * Serve skill tools through the SwenyToolBridge (a stdio MCP shim over a
      * per-run unix socket, #414) instead of the in-process SDK MCP server.
@@ -149,6 +152,7 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     private envScope;
     private toolBridge;
     private toolBridgeShim;
+    private authProbe;
     constructor(opts?: ClaudeCodeHarnessOptions);
     /**
      * Build env for the Claude Code subprocess (#360). Applies auth precedence
@@ -162,9 +166,13 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     private buildEnv;
     /** Which harness (and SDK version) produced a result. */
     info(): HarnessInfo;
+    /** Checks the agent can authenticate (#339): an env credential, Bedrock/Vertex, or a Claude Code login. */
     preflight(): Promise<{
         ok: true;
         version: string;
+    } | {
+        ok: false;
+        reason: string;
     }>;
     /**
      * Run a node. Runs {@link policyGate} (always `degraded: []` for Claude

package/dist/harness/claude-code.js

@@ -19,6 +19,7 @@ import { jsonSchemaToZodShape, toolErrorToMcpResult, toolOutputToMcpResult } fro
 import { startToolBridge } from "./tool-bridge/server.js";
 import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./parse.js";
 import { makeAbort } from "./abort.js";
+import { claudeCodeAuth } from "./auth.js";
 export { buildEvaluatePrompt, CLAUDE_CODE_CAPABILITIES };
 export { parseToolResultContent, summarizeToolError, makeAbort };
 let cachedSdkVersion;
@@ -218,6 +219,7 @@ export class ClaudeCodeHarness {
     envScope;
     toolBridge;
     toolBridgeShim;
+    authProbe;
     constructor(opts = {}) {
         this.model = opts.model;
         this.maxTurns = opts.maxTurns ?? 20;
@@ -233,6 +235,7 @@ export class ClaudeCodeHarness {
         this.sandboxProbe = opts.sandboxProbe;
         this.toolBridge = opts.toolBridge ?? process.env.SWENY_TOOL_BRIDGE === "1";
         this.toolBridgeShim = opts.toolBridgeShim;
+        this.authProbe = opts.authProbe ?? (() => claudeCodeAuth(process.env));
     }
     /**
      * Build env for the Claude Code subprocess (#360). Applies auth precedence
@@ -260,7 +263,11 @@ export class ClaudeCodeHarness {
     info() {
         return { id: this.id, version: claudeSdkVersion() };
     }
+    /** Checks the agent can authenticate (#339): an env credential, Bedrock/Vertex, or a Claude Code login. */
     async preflight() {
+        const auth = this.authProbe();
+        if (!auth.ok)
+            return { ok: false, reason: auth.reason };
         return { ok: true, version: claudeSdkVersion() };
     }
     /**
@@ -301,7 +308,7 @@ export class ClaudeCodeHarness {
             ...req,
             readOnly,
             disallowedTools: disallowedTools.length > 0 ? disallowedTools : undefined,
-            strictMcp: readOnly || policy.strict,
+            strictMcp: readOnly || policy.strict || policy.exclusiveMcp === true,
             sandboxMode: policy.sandbox,
             agentAccess: { envVars: req.agentAccess?.envVars ?? [], domains: policy.egress },
         });

package/dist/harness/codex.d.ts

@@ -29,6 +29,7 @@ import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, Harness
 import { CODEX_CAPABILITIES } from "./capabilities.js";
 import { type HarnessPolicyMode } from "./policy.js";
 import { type SandboxWrapper } from "./sandbox-wrapper.js";
+import { type AuthProbe } from "./auth.js";
 export { CODEX_CAPABILITIES };
 /** Oldest Codex CLI whose flags this adapter uses (`--ignore-user-config`, `--ignore-rules`). */
 export declare const MIN_CODEX_VERSION = "0.159.0";
@@ -89,6 +90,8 @@ export interface CodexHarnessOptions {
     };
     /** Grace period between SIGTERM and SIGKILL when stopping Codex (default: 2000 ms). */
     killGraceMs?: number;
+    /** Login probe for `preflight()` (test seam). Default: {@link codexAuth} over `process.env`. */
+    authProbe?: AuthProbe;
 }
 /** A TOML value for `-c key=value`, as the official SDK writes it (sdk/typescript/src/exec.ts). */
 export declare function toTomlValue(value: unknown): string;
@@ -135,9 +138,13 @@ export declare class CodexHarness implements AgentHarness {
     private killGraceMs;
     private preflightResult;
     private version;
+    private authProbe;
     constructor(opts?: CodexHarnessOptions);
     info(): HarnessInfo;
-    /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
+    /**
+     * Before any node runs (#339): the Codex CLI is installed and new enough,
+     * and Codex can authenticate (an API key, an access token, or `codex login`).
+     */
     preflight(): Promise<{
         ok: true;
         version: string;
@@ -145,6 +152,8 @@ export declare class CodexHarness implements AgentHarness {
         ok: false;
         reason: string;
     }>;
+    /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
+    private checkCli;
     /** Env for the Codex process: scoped like Claude Code's, with Codex's auth vars instead of Anthropic's. */
     private buildEnv;
     /** The node policy after `disallowed_tools` names are translated into Codex classes. */