@sweny-ai/core 0.1.149 → 0.1.151

package/dist/harness/codex.js

@@ -37,6 +37,7 @@ import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./pars
 import { startToolBridge } from "./tool-bridge/server.js";
 import { defaultSandboxWrapper, prepareAgentSpawn, wrappersFrom, } from "./sandbox-wrapper.js";
 import { TOKEN_ENV } from "./tool-bridge/protocol.js";
+import { codexAuth } from "./auth.js";
 export { CODEX_CAPABILITIES };
 /** Oldest Codex CLI whose flags this adapter uses (`--ignore-user-config`, `--ignore-rules`). */
 export const MIN_CODEX_VERSION = "0.159.0";
@@ -288,6 +289,7 @@ export class CodexHarness {
     killGraceMs;
     preflightResult;
     version = "unknown";
+    authProbe;
     constructor(opts = {}) {
         this.model = opts.model;
         this.maxTurns = opts.maxTurns ?? 20;
@@ -305,12 +307,24 @@ export class CodexHarness {
         this.codexCommand = opts.codexCommand ?? { command: process.env.SWENY_CODEX_PATH || "codex", args: [] };
         this.toolBridgeShim = opts.toolBridgeShim;
         this.killGraceMs = opts.killGraceMs ?? 2000;
+        this.authProbe = opts.authProbe ?? (() => codexAuth(process.env));
     }
     info() {
         return { id: this.id, version: this.version };
     }
+    /**
+     * Before any node runs (#339): the Codex CLI is installed and new enough,
+     * and Codex can authenticate (an API key, an access token, or `codex login`).
+     */
+    async preflight() {
+        const cli = await this.checkCli();
+        if (!cli.ok)
+            return cli;
+        const auth = this.authProbe();
+        return auth.ok ? cli : { ok: false, reason: auth.reason };
+    }
     /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
-    preflight() {
+    checkCli() {
         this.preflightResult ??= new Promise((resolve) => {
             const { command, args } = this.codexCommand;
             execFile(command, [...args, "--version"], { timeout: 30_000 }, (err, stdout) => {
@@ -723,7 +737,7 @@ export class CodexHarness {
         };
         if (gate.refuse)
             return refused(gate.refuse);
-        const pre = await this.preflight();
+        const pre = await this.checkCli();
         if (!pre.ok) {
             this.logger.error(pre.reason);
             return tag({ status: "failed", data: { error: pre.reason }, toolCalls: [] });
@@ -922,7 +936,7 @@ export class CodexHarness {
                 : `codex.ask: ${why}. Returning empty string.`);
             return null;
         };
-        const pre = await this.preflight();
+        const pre = await this.checkCli();
         if (!pre.ok)
             return failClosed(pre.reason);
         const args = [

package/dist/harness/pi.js

@@ -771,15 +771,24 @@ export class PiHarness {
                     tools: req.tools,
                     context: this.defaultContext,
                     logger: this.logger,
+                    // Wrapped, the shim cannot open the unix socket (srt blocks AF_UNIX on
+                    // Linux); it tunnels to a loopback port through the sandbox proxy (#439).
+                    tcp: wrapper !== undefined,
                     ...(this.toolBridgeShim ? { shimCommand: this.toolBridgeShim } : {}),
                 });
                 const shim = bridge.mcpServer;
                 // The token reaches the shim by reference (`${VAR}`), never in a file or argv.
                 env[TOKEN_ENV] = bridge.token;
+                const ref = (name) => "${" + name + "}";
                 entries[PI_BRIDGE_SERVER] = {
                     command: shim.command,
                     args: shim.args ?? [],
-                    env: { SWENY_NO_UPDATE_CHECK: "1", [TOKEN_ENV]: "${" + TOKEN_ENV + "}" },
+                    env: {
+                        SWENY_NO_UPDATE_CHECK: "1",
+                        [TOKEN_ENV]: ref(TOKEN_ENV),
+                        // The proxy srt sets for pi, which pi's MCP client does not pass on by itself.
+                        ...(bridge.tcp ? { HTTP_PROXY: ref("HTTP_PROXY"), http_proxy: ref("http_proxy") } : {}),
+                    },
                     exposure: "direct",
                     timeout: 600,
                 };
@@ -802,8 +811,10 @@ export class PiHarness {
                 toolArgs.push("--exclude-tools", [...excluded].join(","));
             }
             const args = [...this.baseArgs(model, Object.keys(entries).length > 0), ...toolArgs];
-            const harnessEgress = piBackendHosts(process.env, model);
-            if (mode !== "off" && harnessEgress.length === 0 && !this.egressWarned) {
+            const backendHosts = piBackendHosts(process.env, model);
+            // The bridge's loopback endpoint (wrapped runs only): the one extra host the shim needs.
+            const harnessEgress = [...backendHosts, ...(bridge?.egress ?? [])];
+            if (mode !== "off" && backendHosts.length === 0 && !this.egressWarned) {
                 this.egressWarned = true;
                 this.logger.warn("pi runs inside the sandbox wrapper with no known model API host; add it with SWENY_SANDBOX_ALLOWED_DOMAINS.");
             }

package/dist/harness/policy.js

@@ -74,6 +74,12 @@ export function policyGate(caps, policy, wrappers = {}) {
             unenforced.push(`disallowed_tools [${policy.nativeDeny.join(", ")}]: harness has no tools by these names`);
         }
     }
+    // Exclusive MCP (`permissions.strict`): only the servers sweny passes may
+    // load, never the user's own config. A harness that cannot exclude them
+    // cannot honor it, so strict refuses the node.
+    if (policy.exclusiveMcp && caps.mcp.exclusive === "none") {
+        unenforced.push("exclusive MCP: harness cannot keep the user's own MCP servers out of the run");
+    }
     if (policy.egress.length > 0 && !caps.sandbox.network && !wrappers.egress) {
         unenforced.push("egress allowlist: harness has no network sandbox and no egress wrapper is active");
     }

package/dist/harness/tool-bridge/server.d.ts

@@ -9,6 +9,11 @@
  * Security properties (this is an injection boundary):
  * - The socket lives in a fresh `mkdtemp` directory (mode 0700) and is itself
  *   chmod 0600, so other users cannot connect.
+ * - With `tcp` (only for agents inside the process sandbox wrapper, #439) the
+ *   same handler also listens on 127.0.0.1:<random port>. Other local users
+ *   can open that port, so there the token is the only gate; the sandboxed
+ *   agent reaches it through srt's proxy only because the adapter allowlists
+ *   exactly that host:port for the run.
  * - A random 256-bit token is required on every frame. A wrong or missing
  *   token gets an `unauthorized` error and the connection is dropped.
  * - Only the tools passed in are listed or callable. The executor has already
@@ -37,12 +42,27 @@ export interface ToolBridgeOptions {
     };
     /** Parent directory for the private socket dir. Default: `os.tmpdir()`. */
     tmpDir?: string;
+    /**
+     * Also serve on a loopback TCP port, and point the shim there (#439). For an
+     * agent inside the process sandbox wrapper: srt blocks `socket(AF_UNIX)` on
+     * Linux, so the shim cannot reach the unix socket, but it can reach an
+     * allowlisted host through srt's egress proxy. The adapter adds
+     * {@link ToolBridge.egress} to the node's egress; nothing else is opened.
+     */
+    tcp?: boolean;
 }
 export interface ToolBridge {
     /** Absolute path of the unix socket. */
     readonly socketPath: string;
     /** Per-run token. Never log it. */
     readonly token: string;
+    /** Loopback TCP endpoint, when started with `tcp: true`. */
+    readonly tcp?: {
+        host: string;
+        port: number;
+    };
+    /** Hosts a sandboxed shim must reach (`127.0.0.1:<port>` with `tcp`, else none). */
+    readonly egress: string[];
     /** stdio MCP server config a harness uses to start the shim. The token rides in `env`, not argv. */
     readonly mcpServer: McpServerConfig;
     /** Stop serving, drop connections, remove the socket and its directory. Idempotent. */

package/dist/harness/tool-bridge/server.js

@@ -9,6 +9,11 @@
  * Security properties (this is an injection boundary):
  * - The socket lives in a fresh `mkdtemp` directory (mode 0700) and is itself
  *   chmod 0600, so other users cannot connect.
+ * - With `tcp` (only for agents inside the process sandbox wrapper, #439) the
+ *   same handler also listens on 127.0.0.1:<random port>. Other local users
+ *   can open that port, so there the token is the only gate; the sandboxed
+ *   agent reaches it through srt's proxy only because the adapter allowlists
+ *   exactly that host:port for the run.
  * - A random 256-bit token is required on every frame. A wrong or missing
  *   token gets an `unauthorized` error and the connection is dropped.
  * - Only the tools passed in are listed or callable. The executor has already
@@ -98,7 +103,7 @@ export async function startToolBridge(opts) {
     liveDirs.add(dir);
     installCrashHooks();
     const sockets = new Set();
-    const server = net.createServer((sock) => {
+    const onConnection = (sock) => {
         sockets.add(sock);
         sock.on("close", () => sockets.delete(sock));
         sock.on("error", () => sock.destroy());
@@ -143,19 +148,29 @@ export async function startToolBridge(opts) {
             sock.destroy();
         });
         sock.on("data", read);
+    };
+    const server = net.createServer(onConnection);
+    // Same handler and token check; only started for sandboxed agents.
+    const tcpServer = opts.tcp ? net.createServer(onConnection) : undefined;
+    const listen = (s, options) => new Promise((resolve, reject) => {
+        s.once("error", reject);
+        s.listen(options, () => {
+            s.removeListener("error", reject);
+            resolve();
+        });
     });
+    let tcp;
     try {
-        await new Promise((resolve, reject) => {
-            server.once("error", reject);
-            server.listen(socketPath, () => {
-                server.removeListener("error", reject);
-                resolve();
-            });
-        });
+        await listen(server, { path: socketPath });
         fs.chmodSync(socketPath, 0o600);
+        if (tcpServer) {
+            await listen(tcpServer, { port: 0, host: "127.0.0.1" });
+            tcp = { host: "127.0.0.1", port: tcpServer.address().port };
+        }
     }
     catch (err) {
         server.close();
+        tcpServer?.close();
         liveDirs.delete(dir);
         removeDirSync(dir);
         uninstallCrashHooksIfIdle();
@@ -167,10 +182,12 @@ export async function startToolBridge(opts) {
     return {
         socketPath,
         token,
+        tcp,
+        egress: tcp ? [`${tcp.host}:${tcp.port}`] : [],
         mcpServer: {
             type: "stdio",
             command: shim.command,
-            args: [...shim.args, "--socket", socketPath],
+            args: [...shim.args, ...(tcp ? ["--connect", `${tcp.host}:${tcp.port}`] : ["--socket", socketPath])],
             // No update-check nudge in the shim: its stdio belongs to MCP.
             env: { [TOKEN_ENV]: token, SWENY_NO_UPDATE_CHECK: "1" },
         },
@@ -180,7 +197,7 @@ export async function startToolBridge(opts) {
             closed = true;
             for (const s of sockets)
                 s.destroy();
-            await new Promise((resolve) => server.close(() => resolve()));
+            await Promise.all([server, tcpServer].map((s) => (s ? new Promise((resolve) => s.close(() => resolve())) : undefined)));
             liveDirs.delete(dir);
             removeDirSync(dir);
             uninstallCrashHooksIfIdle();

package/dist/harness/tool-bridge/shim.d.ts

@@ -1,5 +1,7 @@
 /**
- * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`.
+ * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`, or
+ * `--connect 127.0.0.1:<port>` inside the process sandbox (#439), where it
+ * tunnels through the sandbox's HTTP proxy.
  *
  * A stdio MCP server a harness starts as a child process. It holds no tools
  * of its own: `tools/list` and `tools/call` are forwarded over the per-run
@@ -9,17 +11,49 @@
  * `--token` or, by default, the `SWENY_TOOL_BRIDGE_TOKEN` env var the server
  * puts in the MCP server config, so it never shows up in `ps` output.
  */
+import * as net from "node:net";
 import { type BridgeMethod, type BridgeResponse } from "./protocol.js";
+/** Where the bridge listens: the per-run unix socket, or its loopback TCP port (#439). */
+export type BridgeEndpoint = {
+    socketPath: string;
+} | {
+    host: string;
+    port: number;
+};
+/** Parse `--connect host:port` (IPv4 literal or `localhost`, or `[v6]:port`). */
+export declare function parseConnectTarget(value: string): {
+    host: string;
+    port: number;
+} | undefined;
+/**
+ * The HTTP proxy a sandboxed shim must tunnel through, from its env. srt sets
+ * HTTP_PROXY / HTTPS_PROXY (with its per-run credentials) for everything it
+ * wraps; inside the sandbox nothing else reaches the host. NO_PROXY is
+ * ignored on purpose: srt lists 127.0.0.1 there, but inside the sandbox's own
+ * network namespace 127.0.0.1 is not the host.
+ */
+export declare function bridgeProxyFromEnv(env: NodeJS.ProcessEnv): URL | undefined;
+/**
+ * Open a byte stream to the bridge. A TCP endpoint goes through an HTTP
+ * CONNECT tunnel when the env names a proxy (the sandboxed case), else
+ * straight to the port. `leftover` holds any bytes read past the proxy's
+ * response header.
+ */
+export declare function openBridgeStream(endpoint: BridgeEndpoint, env?: NodeJS.ProcessEnv): Promise<{
+    sock: net.Socket;
+    leftover: Buffer;
+}>;
 /** Socket client that multiplexes requests by id over one connection. */
 export declare class BridgeClient {
-    private readonly socketPath;
     private readonly token;
+    private readonly env;
     private sock;
     private connecting;
     private nextId;
     private pending;
     private closedError;
-    constructor(socketPath: string, token: string);
+    private readonly endpoint;
+    constructor(endpoint: string | BridgeEndpoint, token: string, env?: NodeJS.ProcessEnv);
     private connect;
     private failAll;
     request(method: BridgeMethod, params?: {
@@ -29,7 +63,10 @@ export declare class BridgeClient {
     close(): void;
 }
 export interface ShimOptions {
-    socket: string;
+    /** The per-run unix socket. */
+    socket?: string;
+    /** Or the bridge's loopback TCP endpoint, `host:port` (sandboxed agents, #439). */
+    connect?: string;
     /** Falls back to `SWENY_TOOL_BRIDGE_TOKEN`. */
     token?: string;
     version?: string;

package/dist/harness/tool-bridge/shim.js

@@ -1,5 +1,7 @@
 /**
- * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`.
+ * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`, or
+ * `--connect 127.0.0.1:<port>` inside the process sandbox (#439), where it
+ * tunnels through the sandbox's HTTP proxy.
  *
  * A stdio MCP server a harness starts as a child process. It holds no tools
  * of its own: `tools/list` and `tools/call` are forwarded over the per-run
@@ -14,18 +16,116 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { BRIDGE_PROTOCOL_VERSION, TOKEN_ENV, createFrameReader, encodeFrame, } from "./protocol.js";
+/** Parse `--connect host:port` (IPv4 literal or `localhost`, or `[v6]:port`). */
+export function parseConnectTarget(value) {
+    const m = /^(?:\[([0-9a-fA-F:.]+)\]|([A-Za-z0-9.-]+)):([1-9][0-9]{0,4})$/.exec(value);
+    if (!m)
+        return undefined;
+    const port = Number(m[3]);
+    return port <= 65535 ? { host: m[1] ?? m[2], port } : undefined;
+}
+/**
+ * The HTTP proxy a sandboxed shim must tunnel through, from its env. srt sets
+ * HTTP_PROXY / HTTPS_PROXY (with its per-run credentials) for everything it
+ * wraps; inside the sandbox nothing else reaches the host. NO_PROXY is
+ * ignored on purpose: srt lists 127.0.0.1 there, but inside the sandbox's own
+ * network namespace 127.0.0.1 is not the host.
+ */
+export function bridgeProxyFromEnv(env) {
+    for (const k of ["HTTP_PROXY", "http_proxy", "HTTPS_PROXY", "https_proxy", "ALL_PROXY", "all_proxy"]) {
+        const v = env[k];
+        if (!v)
+            continue;
+        try {
+            const u = new URL(v);
+            if (u.protocol === "http:")
+                return u;
+        }
+        catch {
+            // not a URL: try the next variable
+        }
+    }
+    return undefined;
+}
+const MAX_PROXY_RESPONSE_BYTES = 16 * 1024;
+/**
+ * Open a byte stream to the bridge. A TCP endpoint goes through an HTTP
+ * CONNECT tunnel when the env names a proxy (the sandboxed case), else
+ * straight to the port. `leftover` holds any bytes read past the proxy's
+ * response header.
+ */
+export function openBridgeStream(endpoint, env = process.env) {
+    const direct = (sock) => new Promise((resolve, reject) => {
+        sock.once("error", reject);
+        sock.once("connect", () => {
+            sock.removeListener("error", reject);
+            resolve({ sock, leftover: Buffer.alloc(0) });
+        });
+    });
+    if ("socketPath" in endpoint)
+        return direct(net.createConnection(endpoint.socketPath));
+    const proxy = bridgeProxyFromEnv(env);
+    if (!proxy)
+        return direct(net.createConnection(endpoint.port, endpoint.host));
+    return new Promise((resolve, reject) => {
+        const target = endpoint.host.includes(":")
+            ? `[${endpoint.host}]:${endpoint.port}`
+            : `${endpoint.host}:${endpoint.port}`;
+        const sock = net.createConnection(Number(proxy.port || 80), proxy.hostname.replace(/^\[|\]$/g, ""));
+        let buf = Buffer.alloc(0);
+        let done = false;
+        const fail = (err) => {
+            if (done)
+                return;
+            done = true;
+            sock.destroy();
+            reject(err);
+        };
+        const onData = (chunk) => {
+            buf = Buffer.concat([buf, chunk]);
+            const end = buf.indexOf("\r\n\r\n");
+            if (end === -1) {
+                if (buf.length > MAX_PROXY_RESPONSE_BYTES)
+                    fail(new Error("tool bridge: malformed proxy response"));
+                return;
+            }
+            const status = buf.subarray(0, buf.indexOf("\r\n")).toString("latin1");
+            if (!/^HTTP\/1\.[01] 200(\s|$)/.test(status)) {
+                fail(new Error(`tool bridge: the sandbox proxy refused ${target} (${status})`));
+                return;
+            }
+            done = true;
+            sock.removeListener("data", onData);
+            sock.removeListener("error", fail);
+            sock.removeListener("close", onClose);
+            resolve({ sock, leftover: buf.subarray(end + 4) });
+        };
+        const onClose = () => fail(new Error("tool bridge: the sandbox proxy closed the connection"));
+        sock.on("data", onData);
+        sock.once("error", fail);
+        sock.once("close", onClose);
+        sock.once("connect", () => {
+            const user = decodeURIComponent(proxy.username);
+            const pass = decodeURIComponent(proxy.password);
+            const auth = user || pass ? `Proxy-Authorization: Basic ${Buffer.from(`${user}:${pass}`).toString("base64")}\r\n` : "";
+            sock.write(`CONNECT ${target} HTTP/1.1\r\nHost: ${target}\r\n${auth}\r\n`);
+        });
+    });
+}
 /** Socket client that multiplexes requests by id over one connection. */
 export class BridgeClient {
-    socketPath;
     token;
+    env;
     sock;
     connecting;
     nextId = 1;
     pending = new Map();
     closedError;
-    constructor(socketPath, token) {
-        this.socketPath = socketPath;
+    endpoint;
+    constructor(endpoint, token, env = process.env) {
         this.token = token;
+        this.env = env;
+        this.endpoint = typeof endpoint === "string" ? { socketPath: endpoint } : endpoint;
     }
     connect() {
         // Once the connection is gone (bad token, server closed) every later call fails fast.
@@ -33,8 +133,7 @@ export class BridgeClient {
             return Promise.reject(this.closedError);
         if (this.sock)
             return Promise.resolve(this.sock);
-        this.connecting ??= new Promise((resolve, reject) => {
-            const sock = net.createConnection(this.socketPath);
+        this.connecting ??= openBridgeStream(this.endpoint, this.env).then(({ sock, leftover }) => {
             const read = createFrameReader((value) => {
                 const res = value;
                 if (!res || typeof res.id !== "number")
@@ -50,15 +149,15 @@ export class BridgeClient {
                 }
             }, () => this.failAll(new Error("tool bridge: response frame too large")));
             sock.on("data", read);
-            sock.once("connect", () => {
-                this.sock = sock;
-                resolve(sock);
-            });
-            sock.once("error", (err) => {
-                reject(err);
-                this.failAll(err);
-            });
+            sock.once("error", (err) => this.failAll(err));
             sock.once("close", () => this.failAll(new Error("tool bridge: connection closed")));
+            this.sock = sock;
+            if (leftover.length > 0)
+                read(leftover);
+            return sock;
+        }, (err) => {
+            this.failAll(err);
+            throw err;
         });
         return this.connecting;
     }
@@ -89,13 +188,15 @@ export class BridgeClient {
 /** Run the stdio MCP shim until stdin closes or the bridge goes away. */
 export async function runToolBridgeShim(opts) {
     const token = opts.token ?? process.env[TOKEN_ENV];
-    if (!opts.socket || !token) {
-        process.stderr.write(`sweny tool-bridge: --socket and a token (--token or ${TOKEN_ENV}) are required\n`);
+    const tcp = opts.connect ? parseConnectTarget(opts.connect) : undefined;
+    const endpoint = opts.socket ? { socketPath: opts.socket } : tcp;
+    if (!endpoint || (opts.socket && opts.connect) || (opts.connect && !tcp) || !token) {
+        process.stderr.write(`sweny tool-bridge: one of --socket <path> or --connect <host:port>, and a token (--token or ${TOKEN_ENV}), are required\n`);
         process.exit(2);
     }
     // Keep the token out of anything the shim might spawn or report.
     delete process.env[TOKEN_ENV];
-    const client = new BridgeClient(opts.socket, token);
+    const client = new BridgeClient(endpoint, token);
     const server = new Server({ name: "sweny-core", version: opts.version ?? "0.0.0" }, { capabilities: { tools: {} } });
     server.setRequestHandler(ListToolsRequestSchema, async () => {
         const res = await client.request("tools/list");

package/dist/harness/types.d.ts

@@ -55,6 +55,12 @@ export interface NodePolicy {
     egress: string[];
     /** Refuse instead of degrade when an opinion cannot be enforced. */
     strict: boolean;
+    /**
+     * Only the MCP servers sweny passes may load, never the user's own config
+     * (`permissions.strict`, #365). A harness whose `mcp.exclusive` is `none`
+     * cannot honor it: reported in `degraded`, refused under `strict`.
+     */
+    exclusiveMcp?: boolean;
     /**
      * Turn budget for the run. Set by adapters whose `turnLimit` is not native,
      * so the gate reports how the budget is kept (watchdog) or that it is not.

package/dist/index.d.ts

@@ -21,7 +21,7 @@
  * })
  * ```
  */
-export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, Source, ResolvedSource, SourceKind, SourceResolutionMap, WorkflowInputs, WorkflowInputField, WorkflowInputType, InputValidationError, InputValidationResult, Evaluator, EvaluatorRule, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, NodeToolFilter, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, NodeOnFail, McpTransport, WorkflowType, SkillHarnessKey, NodeAccess, NodePermissions, NodePermissionsSpec, SafeOutputType, SafeOutputDeclaration, SafeOutputsPolicy, SafeOutputReceipt, AuthorAssociation, } from "./types.js";
+export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, Source, ResolvedSource, SourceKind, SourceResolutionMap, WorkflowInputs, WorkflowInputField, WorkflowInputType, InputValidationError, InputValidationResult, Evaluator, EvaluatorRule, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, NodeToolFilter, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, NodeOnFail, McpTransport, WorkflowType, SkillHarnessKey, NodeAccess, NodePermissions, NodePermissionsSpec, SafeOutputType, SafeOutputDeclaration, SafeOutputsPolicy, SafeOutputReceipt, SafeOutputPin, AuthorAssociation, } from "./types.js";
 export { WORKFLOW_INPUT_TYPES } from "./types.js";
 export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, NODE_ACCESS, TOOL_CLASSES, SAFE_OUTPUT_TYPES, SAFE_OUTPUT_APPLIERS, AUTHOR_ASSOCIATIONS, } from "./types.js";
 export { consoleLogger } from "./types.js";

package/dist/node-policy.js

@@ -38,5 +38,6 @@ export function buildNodePolicy(opts) {
         ...(opts.disallowedTools && opts.disallowedTools.length > 0 ? { nativeDeny: opts.disallowedTools } : {}),
         egress: opts.egress ?? [],
         strict: opts.permissions.strict,
+        ...(opts.permissions.strict ? { exclusiveMcp: true } : {}),
     };
 }

package/dist/safe-outputs.d.ts

@@ -9,11 +9,11 @@
  * the write, so this holds on every harness.
  *
  * Order of checks per intent (all deterministic): declared type, workflow
- * ceiling, actor trust, expiry, skill, target pin, shape and size, labels,
- * title prefix, dedupe, node cap, run cap. An optional model screen runs last
+ * ceiling, actor trust, expiry, skill, target pin, issue pin, shape and size,
+ * labels, title prefix, dedupe, node cap, run cap. An optional model screen runs last
  * over the intents that passed and can only veto them.
  */
-import type { Logger, SafeOutputDeclaration, SafeOutputReceipt, SafeOutputsPolicy, SafeOutputType, Skill, Tool } from "./types.js";
+import type { Logger, SafeOutputDeclaration, SafeOutputPin, SafeOutputReceipt, SafeOutputsPolicy, SafeOutputType, Skill, Tool } from "./types.js";
 /** Name of the intent-recording tool a node with `outputs` receives. */
 export declare const EMIT_OUTPUT_TOOL = "emit_output";
 /** Longest title the write stage accepts (after the prefix). */
@@ -43,7 +43,7 @@ export interface SafeOutputIntent {
  */
 export declare function createEmitOutputTool(declarations: SafeOutputDeclaration[], buffer: SafeOutputIntent[], now?: () => number): Tool;
 /** Instruction block that tells the agent how writes work at this node. */
-export declare function safeOutputsInstruction(declarations: SafeOutputDeclaration[]): string;
+export declare function safeOutputsInstruction(declarations: SafeOutputDeclaration[], input?: Record<string, unknown>): string;
 export interface ActorInfo {
     /** GitHub login of whoever triggered the run. */
     login?: string;
@@ -54,9 +54,19 @@ export interface ActorInfo {
 export declare function resolveActor(env: Record<string, string | undefined>, override?: ActorInfo): ActorInfo;
 /** True when no trust list is declared, or the actor matches one. Unknown actor = untrusted. */
 export declare function actorTrusted(policy: SafeOutputsPolicy | undefined, actor: ActorInfo): boolean;
+/**
+ * The issue or PR a declaration pins, as a string. `{ input: name }` reads the
+ * run input; an absent or empty value is `undefined`, which refuses the write.
+ */
+export declare function resolvePin(pin: SafeOutputPin, input?: Record<string, unknown>): string | undefined;
 /** `30m` → 1_800_000. Undefined for anything the schema would reject. */
 export declare function parseDuration(s: string | undefined): number | undefined;
-/** The skill that applies a declaration: its `via`, else the first node skill (then any loaded skill) that can. */
+/**
+ * The skill that applies a declaration: its `via`, else the first node skill
+ * that can and is configured, else the first node skill that can, else any
+ * configured skill that can. A node listing `[linear, github]` therefore files
+ * on GitHub when only GitHub has credentials.
+ */
 export declare function resolveOutputSkill(decl: SafeOutputDeclaration, nodeSkills: string[], skills: Map<string, Skill>): string | undefined;
 /** Declarations whose applying skill is not configured (no credentials loaded). */
 export declare function unresolvedOutputs(declarations: SafeOutputDeclaration[], nodeSkills: string[], skills: Map<string, Skill>): SafeOutputType[];
@@ -85,6 +95,8 @@ export interface ApplySafeOutputsOptions {
     staged: boolean;
     state: WriteStageState;
     logger: Logger;
+    /** The run input, for `number: { input }` pins. */
+    input?: Record<string, unknown>;
     /**
      * Model screen (only called when `policy.screen` is on and at least one write
      * passed every deterministic check). Anything but `ALLOW` is a veto.