@sweny-ai/core 0.1.149 → 0.1.150

package/dist/harness/codex.js

@@ -37,6 +37,7 @@ import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./pars
 import { startToolBridge } from "./tool-bridge/server.js";
 import { defaultSandboxWrapper, prepareAgentSpawn, wrappersFrom, } from "./sandbox-wrapper.js";
 import { TOKEN_ENV } from "./tool-bridge/protocol.js";
+import { codexAuth } from "./auth.js";
 export { CODEX_CAPABILITIES };
 /** Oldest Codex CLI whose flags this adapter uses (`--ignore-user-config`, `--ignore-rules`). */
 export const MIN_CODEX_VERSION = "0.159.0";
@@ -288,6 +289,7 @@ export class CodexHarness {
     killGraceMs;
     preflightResult;
     version = "unknown";
+    authProbe;
     constructor(opts = {}) {
         this.model = opts.model;
         this.maxTurns = opts.maxTurns ?? 20;
@@ -305,12 +307,24 @@ export class CodexHarness {
         this.codexCommand = opts.codexCommand ?? { command: process.env.SWENY_CODEX_PATH || "codex", args: [] };
         this.toolBridgeShim = opts.toolBridgeShim;
         this.killGraceMs = opts.killGraceMs ?? 2000;
+        this.authProbe = opts.authProbe ?? (() => codexAuth(process.env));
     }
     info() {
         return { id: this.id, version: this.version };
     }
+    /**
+     * Before any node runs (#339): the Codex CLI is installed and new enough,
+     * and Codex can authenticate (an API key, an access token, or `codex login`).
+     */
+    async preflight() {
+        const cli = await this.checkCli();
+        if (!cli.ok)
+            return cli;
+        const auth = this.authProbe();
+        return auth.ok ? cli : { ok: false, reason: auth.reason };
+    }
     /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
-    preflight() {
+    checkCli() {
         this.preflightResult ??= new Promise((resolve) => {
             const { command, args } = this.codexCommand;
             execFile(command, [...args, "--version"], { timeout: 30_000 }, (err, stdout) => {
@@ -723,7 +737,7 @@ export class CodexHarness {
         };
         if (gate.refuse)
             return refused(gate.refuse);
-        const pre = await this.preflight();
+        const pre = await this.checkCli();
         if (!pre.ok) {
             this.logger.error(pre.reason);
             return tag({ status: "failed", data: { error: pre.reason }, toolCalls: [] });
@@ -922,7 +936,7 @@ export class CodexHarness {
                 : `codex.ask: ${why}. Returning empty string.`);
             return null;
         };
-        const pre = await this.preflight();
+        const pre = await this.checkCli();
         if (!pre.ok)
             return failClosed(pre.reason);
         const args = [

package/dist/harness/policy.js

@@ -74,6 +74,12 @@ export function policyGate(caps, policy, wrappers = {}) {
             unenforced.push(`disallowed_tools [${policy.nativeDeny.join(", ")}]: harness has no tools by these names`);
         }
     }
+    // Exclusive MCP (`permissions.strict`): only the servers sweny passes may
+    // load, never the user's own config. A harness that cannot exclude them
+    // cannot honor it, so strict refuses the node.
+    if (policy.exclusiveMcp && caps.mcp.exclusive === "none") {
+        unenforced.push("exclusive MCP: harness cannot keep the user's own MCP servers out of the run");
+    }
     if (policy.egress.length > 0 && !caps.sandbox.network && !wrappers.egress) {
         unenforced.push("egress allowlist: harness has no network sandbox and no egress wrapper is active");
     }

package/dist/harness/types.d.ts

@@ -55,6 +55,12 @@ export interface NodePolicy {
     egress: string[];
     /** Refuse instead of degrade when an opinion cannot be enforced. */
     strict: boolean;
+    /**
+     * Only the MCP servers sweny passes may load, never the user's own config
+     * (`permissions.strict`, #365). A harness whose `mcp.exclusive` is `none`
+     * cannot honor it: reported in `degraded`, refused under `strict`.
+     */
+    exclusiveMcp?: boolean;
     /**
      * Turn budget for the run. Set by adapters whose `turnLimit` is not native,
      * so the gate reports how the budget is kept (watchdog) or that it is not.

package/dist/index.d.ts

@@ -21,7 +21,7 @@
  * })
  * ```
  */
-export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, Source, ResolvedSource, SourceKind, SourceResolutionMap, WorkflowInputs, WorkflowInputField, WorkflowInputType, InputValidationError, InputValidationResult, Evaluator, EvaluatorRule, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, NodeToolFilter, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, NodeOnFail, McpTransport, WorkflowType, SkillHarnessKey, NodeAccess, NodePermissions, NodePermissionsSpec, SafeOutputType, SafeOutputDeclaration, SafeOutputsPolicy, SafeOutputReceipt, AuthorAssociation, } from "./types.js";
+export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, Source, ResolvedSource, SourceKind, SourceResolutionMap, WorkflowInputs, WorkflowInputField, WorkflowInputType, InputValidationError, InputValidationResult, Evaluator, EvaluatorRule, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, NodeToolFilter, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, NodeOnFail, McpTransport, WorkflowType, SkillHarnessKey, NodeAccess, NodePermissions, NodePermissionsSpec, SafeOutputType, SafeOutputDeclaration, SafeOutputsPolicy, SafeOutputReceipt, SafeOutputPin, AuthorAssociation, } from "./types.js";
 export { WORKFLOW_INPUT_TYPES } from "./types.js";
 export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, NODE_ACCESS, TOOL_CLASSES, SAFE_OUTPUT_TYPES, SAFE_OUTPUT_APPLIERS, AUTHOR_ASSOCIATIONS, } from "./types.js";
 export { consoleLogger } from "./types.js";

package/dist/node-policy.js

@@ -38,5 +38,6 @@ export function buildNodePolicy(opts) {
         ...(opts.disallowedTools && opts.disallowedTools.length > 0 ? { nativeDeny: opts.disallowedTools } : {}),
         egress: opts.egress ?? [],
         strict: opts.permissions.strict,
+        ...(opts.permissions.strict ? { exclusiveMcp: true } : {}),
     };
 }

package/dist/safe-outputs.d.ts

@@ -9,11 +9,11 @@
  * the write, so this holds on every harness.
  *
  * Order of checks per intent (all deterministic): declared type, workflow
- * ceiling, actor trust, expiry, skill, target pin, shape and size, labels,
- * title prefix, dedupe, node cap, run cap. An optional model screen runs last
+ * ceiling, actor trust, expiry, skill, target pin, issue pin, shape and size,
+ * labels, title prefix, dedupe, node cap, run cap. An optional model screen runs last
  * over the intents that passed and can only veto them.
  */
-import type { Logger, SafeOutputDeclaration, SafeOutputReceipt, SafeOutputsPolicy, SafeOutputType, Skill, Tool } from "./types.js";
+import type { Logger, SafeOutputDeclaration, SafeOutputPin, SafeOutputReceipt, SafeOutputsPolicy, SafeOutputType, Skill, Tool } from "./types.js";
 /** Name of the intent-recording tool a node with `outputs` receives. */
 export declare const EMIT_OUTPUT_TOOL = "emit_output";
 /** Longest title the write stage accepts (after the prefix). */
@@ -43,7 +43,7 @@ export interface SafeOutputIntent {
  */
 export declare function createEmitOutputTool(declarations: SafeOutputDeclaration[], buffer: SafeOutputIntent[], now?: () => number): Tool;
 /** Instruction block that tells the agent how writes work at this node. */
-export declare function safeOutputsInstruction(declarations: SafeOutputDeclaration[]): string;
+export declare function safeOutputsInstruction(declarations: SafeOutputDeclaration[], input?: Record<string, unknown>): string;
 export interface ActorInfo {
     /** GitHub login of whoever triggered the run. */
     login?: string;
@@ -54,9 +54,19 @@ export interface ActorInfo {
 export declare function resolveActor(env: Record<string, string | undefined>, override?: ActorInfo): ActorInfo;
 /** True when no trust list is declared, or the actor matches one. Unknown actor = untrusted. */
 export declare function actorTrusted(policy: SafeOutputsPolicy | undefined, actor: ActorInfo): boolean;
+/**
+ * The issue or PR a declaration pins, as a string. `{ input: name }` reads the
+ * run input; an absent or empty value is `undefined`, which refuses the write.
+ */
+export declare function resolvePin(pin: SafeOutputPin, input?: Record<string, unknown>): string | undefined;
 /** `30m` → 1_800_000. Undefined for anything the schema would reject. */
 export declare function parseDuration(s: string | undefined): number | undefined;
-/** The skill that applies a declaration: its `via`, else the first node skill (then any loaded skill) that can. */
+/**
+ * The skill that applies a declaration: its `via`, else the first node skill
+ * that can and is configured, else the first node skill that can, else any
+ * configured skill that can. A node listing `[linear, github]` therefore files
+ * on GitHub when only GitHub has credentials.
+ */
 export declare function resolveOutputSkill(decl: SafeOutputDeclaration, nodeSkills: string[], skills: Map<string, Skill>): string | undefined;
 /** Declarations whose applying skill is not configured (no credentials loaded). */
 export declare function unresolvedOutputs(declarations: SafeOutputDeclaration[], nodeSkills: string[], skills: Map<string, Skill>): SafeOutputType[];
@@ -85,6 +95,8 @@ export interface ApplySafeOutputsOptions {
     staged: boolean;
     state: WriteStageState;
     logger: Logger;
+    /** The run input, for `number: { input }` pins. */
+    input?: Record<string, unknown>;
     /**
      * Model screen (only called when `policy.screen` is on and at least one write
      * passed every deterministic check). Anything but `ALLOW` is a veto.

package/dist/safe-outputs.js

@@ -9,8 +9,8 @@
  * the write, so this holds on every harness.
  *
  * Order of checks per intent (all deterministic): declared type, workflow
- * ceiling, actor trust, expiry, skill, target pin, shape and size, labels,
- * title prefix, dedupe, node cap, run cap. An optional model screen runs last
+ * ceiling, actor trust, expiry, skill, target pin, issue pin, shape and size,
+ * labels, title prefix, dedupe, node cap, run cap. An optional model screen runs last
  * over the intents that passed and can only veto them.
  */
 import { createHash } from "node:crypto";
@@ -108,11 +108,15 @@ export function createEmitOutputTool(declarations, buffer, now = Date.now) {
     };
 }
 /** Instruction block that tells the agent how writes work at this node. */
-export function safeOutputsInstruction(declarations) {
+export function safeOutputsInstruction(declarations, input) {
     const lines = declarations.map((d) => {
         const parts = [`at most ${d.max ?? 1}`];
         if (d.target)
             parts.push(`target ${d.target}`);
+        if (d.number !== undefined) {
+            const pin = resolvePin(d.number, input);
+            parts.push(pin ? `only issue or PR ${pin} (the number may be omitted)` : "pinned issue not set for this run");
+        }
         if (d.title_prefix)
             parts.push(`title prefix "${d.title_prefix}"`);
         if (d.type === "label" && d.labels?.length)
@@ -167,18 +171,42 @@ export function actorTrusted(policy, actor) {
     return false;
 }
 // ─── Helpers ──────────────────────────────────────────────────────
+/**
+ * The issue or PR a declaration pins, as a string. `{ input: name }` reads the
+ * run input; an absent or empty value is `undefined`, which refuses the write.
+ */
+export function resolvePin(pin, input) {
+    const raw = typeof pin === "object" ? input?.[pin.input] : pin;
+    if (typeof raw === "number" && Number.isInteger(raw) && raw > 0)
+        return String(raw);
+    if (typeof raw !== "string")
+        return undefined;
+    const v = raw.trim().replace(/^#/, "");
+    return v.length > 0 ? v : undefined;
+}
+/** Same issue or PR: `#42` and `42`, `OFF-12` and `off-12` match. */
+function sameIssue(a, b) {
+    const norm = (x) => x.trim().replace(/^#/, "").toLowerCase();
+    return norm(a) === norm(b);
+}
 const UNIT_MS = { s: 1_000, m: 60_000, h: 3_600_000, d: 86_400_000 };
 /** `30m` → 1_800_000. Undefined for anything the schema would reject. */
 export function parseDuration(s) {
     const m = s ? /^([1-9][0-9]*)(s|m|h|d)$/.exec(s) : null;
     return m ? Number(m[1]) * UNIT_MS[m[2]] : undefined;
 }
-/** The skill that applies a declaration: its `via`, else the first node skill (then any loaded skill) that can. */
+/**
+ * The skill that applies a declaration: its `via`, else the first node skill
+ * that can and is configured, else the first node skill that can, else any
+ * configured skill that can. A node listing `[linear, github]` therefore files
+ * on GitHub when only GitHub has credentials.
+ */
 export function resolveOutputSkill(decl, nodeSkills, skills) {
     if (decl.via)
         return decl.via;
     const supports = (id) => SAFE_OUTPUT_APPLIERS[id]?.includes(decl.type) === true;
-    return (nodeSkills.find((id) => supports(id)) ??
+    return (nodeSkills.find((id) => supports(id) && skills.has(id)) ??
+        nodeSkills.find((id) => supports(id)) ??
         Object.keys(SAFE_OUTPUT_APPLIERS).find((id) => supports(id) && skills.has(id)));
 }
 /** Declarations whose applying skill is not configured (no credentials loaded). */
@@ -254,10 +282,29 @@ function dedupeKey(w, explicit) {
         ];
     return createHash("sha256").update(JSON.stringify(parts)).digest("hex");
 }
+/**
+ * The object an apply call produced: the output itself (GitHub REST), or the
+ * record a GraphQL mutation wraps (`{ issueCreate: { issue: {...} } }`, Linear).
+ */
+function producedRecord(output) {
+    let o = output;
+    for (let depth = 0; depth < 3; depth++) {
+        if (!o || typeof o !== "object" || Array.isArray(o))
+            return undefined;
+        const rec = o;
+        if (["number", "identifier", "id"].some((k) => k in rec))
+            return rec;
+        const nested = Object.values(rec).filter((v) => v && typeof v === "object" && !Array.isArray(v));
+        if (nested.length !== 1)
+            return undefined;
+        o = nested[0];
+    }
+    return undefined;
+}
 function refOf(output) {
-    if (!output || typeof output !== "object")
+    const o = producedRecord(output);
+    if (!o)
         return undefined;
-    const o = output;
     for (const k of ["number", "identifier", "id"]) {
         const v = o[k];
         if (typeof v === "number" || (typeof v === "string" && v.length > 0 && v.length <= 64))
@@ -265,6 +312,18 @@ function refOf(output) {
     }
     return undefined;
 }
+/** The web URL of what a write produced (`html_url` on GitHub, `url` on Linear). */
+function urlOf(output) {
+    const o = producedRecord(output);
+    if (!o)
+        return undefined;
+    for (const k of ["html_url", "url"]) {
+        const v = o[k];
+        if (typeof v === "string" && /^https:\/\//.test(v) && v.length <= 512 && !/\/\/api\./.test(v))
+            return v;
+    }
+    return undefined;
+}
 export function createWriteStageState() {
     return { counts: new Map(), total: 0, seen: new Set() };
 }
@@ -318,11 +377,25 @@ export async function applySafeOutputs(o) {
             refuse(type === "comment" && !body.trim() ? "missing body" : "body too long", at);
             continue;
         }
-        if ((type === "comment" || type === "label") && !intent.number) {
+        // Issue pin: a pinned comment or label may only land on that issue or PR.
+        let issueRef = intent.number?.trim().replace(/^#/, "") || undefined;
+        if ((type === "comment" || type === "label") && decl.number !== undefined) {
+            const pin = resolvePin(decl.number, o.input);
+            if (!pin) {
+                refuse("pinned issue is not set for this run", at);
+                continue;
+            }
+            if (issueRef !== undefined && !sameIssue(issueRef, pin)) {
+                refuse("issue outside the declared number", at);
+                continue;
+            }
+            issueRef = pin;
+        }
+        if ((type === "comment" || type === "label") && !issueRef) {
             refuse("missing number", at);
             continue;
         }
-        if (via === "github" && intent.number !== undefined && !/^[1-9][0-9]*$/.test(intent.number)) {
+        if (via === "github" && issueRef !== undefined && !/^[1-9][0-9]*$/.test(issueRef)) {
             refuse("number must be an issue or PR number", at);
             continue;
         }
@@ -362,7 +435,7 @@ export async function applySafeOutputs(o) {
         // A Linear comment's issue ID does not encode or enforce its declared team.
         // Resolve it through the configured read tool and carry its immutable ID to
         // the write. Missing lookup support or unverifiable membership fails closed.
-        let number = intent.number;
+        let number = issueRef;
         if (via === "linear" && type === "comment" && target) {
             const lookup = o.skills.get(via)?.tools.find((t) => t.name === "linear_get_issue" && t.access === "read");
             let issue;
@@ -453,7 +526,8 @@ export async function applySafeOutputs(o) {
         try {
             const output = await tool.handler(applier.build(write), { config: o.config, logger: o.logger });
             const ref = refOf(output);
-            receipts[index] = { ...receipts[index], ...(ref !== undefined ? { ref } : {}) };
+            const url = urlOf(output);
+            receipts[index] = { ...receipts[index], ...(ref !== undefined ? { ref } : {}), ...(url ? { url } : {}) };
             o.logger.info(`  safe output: ${write.type} via ${write.via} applied${ref !== undefined ? ` (${ref})` : ""}`, {
                 node: o.nodeId,
             });

package/dist/schema.d.ts

@@ -857,8 +857,18 @@ export declare const safeOutputDeclarationZ: z.ZodObject<{
     title_prefix: z.ZodOptional<z.ZodString>;
     labels: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     expires: z.ZodOptional<z.ZodString>;
+    number: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodObject<{
+        input: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        input: string;
+    }, {
+        input: string;
+    }>]>>;
 }, "strict", z.ZodTypeAny, {
     type: "comment" | "issue" | "pr" | "label";
+    number?: string | number | {
+        input: string;
+    } | undefined;
     labels?: string[] | undefined;
     max?: number | undefined;
     via?: string | undefined;
@@ -867,6 +877,9 @@ export declare const safeOutputDeclarationZ: z.ZodObject<{
     expires?: string | undefined;
 }, {
     type: "comment" | "issue" | "pr" | "label";
+    number?: string | number | {
+        input: string;
+    } | undefined;
     labels?: string[] | undefined;
     max?: number | undefined;
     via?: string | undefined;
@@ -972,8 +985,18 @@ export declare const nodeZ: z.ZodObject<{
         title_prefix: z.ZodOptional<z.ZodString>;
         labels: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         expires: z.ZodOptional<z.ZodString>;
+        number: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodObject<{
+            input: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            input: string;
+        }, {
+            input: string;
+        }>]>>;
     }, "strict", z.ZodTypeAny, {
         type: "comment" | "issue" | "pr" | "label";
+        number?: string | number | {
+            input: string;
+        } | undefined;
         labels?: string[] | undefined;
         max?: number | undefined;
         via?: string | undefined;
@@ -982,6 +1005,9 @@ export declare const nodeZ: z.ZodObject<{
         expires?: string | undefined;
     }, {
         type: "comment" | "issue" | "pr" | "label";
+        number?: string | number | {
+            input: string;
+        } | undefined;
         labels?: string[] | undefined;
         max?: number | undefined;
         via?: string | undefined;
@@ -1403,6 +1429,9 @@ export declare const nodeZ: z.ZodObject<{
     } | undefined;
     outputs?: {
         type: "comment" | "issue" | "pr" | "label";
+        number?: string | number | {
+            input: string;
+        } | undefined;
         labels?: string[] | undefined;
         max?: number | undefined;
         via?: string | undefined;
@@ -1513,6 +1542,9 @@ export declare const nodeZ: z.ZodObject<{
     } | undefined;
     outputs?: {
         type: "comment" | "issue" | "pr" | "label";
+        number?: string | number | {
+            input: string;
+        } | undefined;
         labels?: string[] | undefined;
         max?: number | undefined;
         via?: string | undefined;
@@ -1706,8 +1738,18 @@ export declare const workflowZ: z.ZodObject<{
             title_prefix: z.ZodOptional<z.ZodString>;
             labels: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             expires: z.ZodOptional<z.ZodString>;
+            number: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodObject<{
+                input: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                input: string;
+            }, {
+                input: string;
+            }>]>>;
         }, "strict", z.ZodTypeAny, {
             type: "comment" | "issue" | "pr" | "label";
+            number?: string | number | {
+                input: string;
+            } | undefined;
             labels?: string[] | undefined;
             max?: number | undefined;
             via?: string | undefined;
@@ -1716,6 +1758,9 @@ export declare const workflowZ: z.ZodObject<{
             expires?: string | undefined;
         }, {
             type: "comment" | "issue" | "pr" | "label";
+            number?: string | number | {
+                input: string;
+            } | undefined;
             labels?: string[] | undefined;
             max?: number | undefined;
             via?: string | undefined;
@@ -2137,6 +2182,9 @@ export declare const workflowZ: z.ZodObject<{
         } | undefined;
         outputs?: {
             type: "comment" | "issue" | "pr" | "label";
+            number?: string | number | {
+                input: string;
+            } | undefined;
             labels?: string[] | undefined;
             max?: number | undefined;
             via?: string | undefined;
@@ -2247,6 +2295,9 @@ export declare const workflowZ: z.ZodObject<{
         } | undefined;
         outputs?: {
             type: "comment" | "issue" | "pr" | "label";
+            number?: string | number | {
+                input: string;
+            } | undefined;
             labels?: string[] | undefined;
             max?: number | undefined;
             via?: string | undefined;
@@ -2602,6 +2653,9 @@ export declare const workflowZ: z.ZodObject<{
         } | undefined;
         outputs?: {
             type: "comment" | "issue" | "pr" | "label";
+            number?: string | number | {
+                input: string;
+            } | undefined;
             labels?: string[] | undefined;
             max?: number | undefined;
             via?: string | undefined;
@@ -2763,6 +2817,9 @@ export declare const workflowZ: z.ZodObject<{
         } | undefined;
         outputs?: {
             type: "comment" | "issue" | "pr" | "label";
+            number?: string | number | {
+                input: string;
+            } | undefined;
             labels?: string[] | undefined;
             max?: number | undefined;
             via?: string | undefined;
@@ -2966,6 +3023,9 @@ export declare function parseWorkflow(raw: unknown): {
         } | undefined;
         outputs?: {
             type: "comment" | "issue" | "pr" | "label";
+            number?: string | number | {
+                input: string;
+            } | undefined;
             labels?: string[] | undefined;
             max?: number | undefined;
             via?: string | undefined;
@@ -3403,6 +3463,26 @@ export declare const workflowJsonSchema: {
                     readonly pattern: string;
                     readonly description: "Drop an intent older than this when the write stage runs (e.g. 30m, 2h, 7d).";
                 };
+                readonly number: {
+                    readonly description: "comment / label: the only issue or PR this output may write to (GitHub number, Linear identifier), or { input: <name> } to pin it to a run input.";
+                    readonly oneOf: readonly [{
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    }, {
+                        readonly type: "integer";
+                        readonly minimum: 1;
+                    }, {
+                        readonly type: "object";
+                        readonly required: readonly ["input"];
+                        readonly additionalProperties: false;
+                        readonly properties: {
+                            readonly input: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                        };
+                    }];
+                };
             };
         };
     };

package/dist/schema.js

@@ -272,6 +272,9 @@ export const safeOutputDeclarationZ = z
     title_prefix: z.string().min(1).max(64).optional(),
     labels: z.array(z.string().min(1)).min(1).optional(),
     expires: z.string().regex(SAFE_OUTPUT_EXPIRES_PATTERN).optional(),
+    number: z
+        .union([z.string().min(1), z.number().int().min(1), z.object({ input: z.string().min(1) }).strict()])
+        .optional(),
 })
     .strict();
 /** Workflow-level safe-output policy (#365): the ceiling and run-wide limits. */
@@ -633,6 +636,13 @@ export function validateWorkflow(workflow, knownSkills) {
                     nodeId,
                 });
             }
+            if (out.number !== undefined && out.type !== "comment" && out.type !== "label") {
+                errors.push({
+                    code: "UNSUPPORTED_OUTPUT",
+                    message: `Node "${nodeId}" output "${out.type}" pins number, which only applies to comment and label outputs`,
+                    nodeId,
+                });
+            }
         }
     }
     // Skill references
@@ -855,6 +865,19 @@ export const workflowJsonSchema = {
                     pattern: SAFE_OUTPUT_EXPIRES_PATTERN.source,
                     description: "Drop an intent older than this when the write stage runs (e.g. 30m, 2h, 7d).",
                 },
+                number: {
+                    description: "comment / label: the only issue or PR this output may write to (GitHub number, Linear identifier), or { input: <name> } to pin it to a run input.",
+                    oneOf: [
+                        { type: "string", minLength: 1 },
+                        { type: "integer", minimum: 1 },
+                        {
+                            type: "object",
+                            required: ["input"],
+                            additionalProperties: false,
+                            properties: { input: { type: "string", minLength: 1 } },
+                        },
+                    ],
+                },
             },
         },
     },

package/dist/types.d.ts

@@ -422,7 +422,18 @@ export interface SafeOutputDeclaration {
     labels?: string[];
     /** Drop an intent older than this when the write stage runs (e.g. `30m`, `2h`, `7d`). */
     expires?: string;
+    /**
+     * comment / label: the only issue or PR this output may write to (GitHub
+     * issue or PR number, Linear issue identifier), or `{ input: <name> }` to pin
+     * it to a run input. An intent naming another is refused; an intent naming
+     * none uses the pin. An empty pinned input refuses the write.
+     */
+    number?: SafeOutputPin;
 }
+/** A pinned issue / PR: a literal number or identifier, or the name of a run input that holds one. */
+export type SafeOutputPin = string | number | {
+    input: string;
+};
 /** Workflow-level safe-output policy: the ceiling and run-wide limits. */
 export interface SafeOutputsPolicy {
     /** Output types any node may declare. Absent: all types. */
@@ -449,6 +460,8 @@ export interface SafeOutputReceipt {
     target?: string;
     /** Issue / PR / comment number or id the write produced. */
     ref?: string | number;
+    /** Web URL of what the write produced, as the API returned it. */
+    url?: string;
 }
 /**
  * Per-node skill-tool filter. See {@link Node.tools}.