@sweny-ai/core 0.1.150 → 0.1.152

package/dist/cli/builtin-workflows.js

@@ -33,6 +33,7 @@ const LEGACY_WRITE_TOOLS = {
     comment: ["github_add_comment", "linear_add_comment", "linear_update_issue"],
     pr: ["github_create_pr"],
     label: ["github_add_labels"],
+    issue_state: ["linear_update_issue", "linear_set_issue_state", "github_set_issue_state"],
 };
 const writeToolsBySkill = new Map(builtinSkills.map((s) => [s.id, s.tools.filter((t) => t.access !== "read").map((t) => t.name)]));
 function skillWriteTools(node) {
@@ -59,7 +60,7 @@ export function readGaps(p) {
 }
 /** The skill that applies this output type for these providers, or undefined when none can. */
 export function outputSkill(type, p) {
-    if (type === "issue" || type === "comment")
+    if (type === "issue" || type === "comment" || type === "issue_state")
         return TRACKER_SKILL[p.issueTracker];
     return p.sourceControl === "github" ? "github" : undefined;
 }

package/dist/cli/main.js

@@ -1313,11 +1313,12 @@ workflowCmd
 program
     .command("tool-bridge", { hidden: true })
     .description("Internal: stdio MCP shim for sweny skill tools")
-    .requiredOption("--socket <path>", "Per-run bridge socket")
+    .option("--socket <path>", "Per-run bridge socket")
+    .option("--connect <host:port>", "Per-run bridge TCP endpoint (inside the process sandbox, via its proxy)")
     .option("--token <token>", "Per-run token (default: SWENY_TOOL_BRIDGE_TOKEN)")
     .action(async (options) => {
     const { runToolBridgeShim } = await import("../harness/tool-bridge/shim.js");
-    await runToolBridgeShim({ socket: options.socket, token: options.token, version });
+    await runToolBridgeShim({ socket: options.socket, connect: options.connect, token: options.token, version });
 });
 // ── sweny upgrade / update ────────────────────────────────────────────
 // Self-update the globally-installed @sweny-ai/core. Mirrors the UX of

package/dist/harness/pi.js

@@ -771,15 +771,24 @@ export class PiHarness {
                     tools: req.tools,
                     context: this.defaultContext,
                     logger: this.logger,
+                    // Wrapped, the shim cannot open the unix socket (srt blocks AF_UNIX on
+                    // Linux); it tunnels to a loopback port through the sandbox proxy (#439).
+                    tcp: wrapper !== undefined,
                     ...(this.toolBridgeShim ? { shimCommand: this.toolBridgeShim } : {}),
                 });
                 const shim = bridge.mcpServer;
                 // The token reaches the shim by reference (`${VAR}`), never in a file or argv.
                 env[TOKEN_ENV] = bridge.token;
+                const ref = (name) => "${" + name + "}";
                 entries[PI_BRIDGE_SERVER] = {
                     command: shim.command,
                     args: shim.args ?? [],
-                    env: { SWENY_NO_UPDATE_CHECK: "1", [TOKEN_ENV]: "${" + TOKEN_ENV + "}" },
+                    env: {
+                        SWENY_NO_UPDATE_CHECK: "1",
+                        [TOKEN_ENV]: ref(TOKEN_ENV),
+                        // The proxy srt sets for pi, which pi's MCP client does not pass on by itself.
+                        ...(bridge.tcp ? { HTTP_PROXY: ref("HTTP_PROXY"), http_proxy: ref("http_proxy") } : {}),
+                    },
                     exposure: "direct",
                     timeout: 600,
                 };
@@ -802,8 +811,10 @@ export class PiHarness {
                 toolArgs.push("--exclude-tools", [...excluded].join(","));
             }
             const args = [...this.baseArgs(model, Object.keys(entries).length > 0), ...toolArgs];
-            const harnessEgress = piBackendHosts(process.env, model);
-            if (mode !== "off" && harnessEgress.length === 0 && !this.egressWarned) {
+            const backendHosts = piBackendHosts(process.env, model);
+            // The bridge's loopback endpoint (wrapped runs only): the one extra host the shim needs.
+            const harnessEgress = [...backendHosts, ...(bridge?.egress ?? [])];
+            if (mode !== "off" && backendHosts.length === 0 && !this.egressWarned) {
                 this.egressWarned = true;
                 this.logger.warn("pi runs inside the sandbox wrapper with no known model API host; add it with SWENY_SANDBOX_ALLOWED_DOMAINS.");
             }

package/dist/harness/tool-bridge/server.d.ts

@@ -9,6 +9,11 @@
  * Security properties (this is an injection boundary):
  * - The socket lives in a fresh `mkdtemp` directory (mode 0700) and is itself
  *   chmod 0600, so other users cannot connect.
+ * - With `tcp` (only for agents inside the process sandbox wrapper, #439) the
+ *   same handler also listens on 127.0.0.1:<random port>. Other local users
+ *   can open that port, so there the token is the only gate; the sandboxed
+ *   agent reaches it through srt's proxy only because the adapter allowlists
+ *   exactly that host:port for the run.
  * - A random 256-bit token is required on every frame. A wrong or missing
  *   token gets an `unauthorized` error and the connection is dropped.
  * - Only the tools passed in are listed or callable. The executor has already
@@ -37,12 +42,27 @@ export interface ToolBridgeOptions {
     };
     /** Parent directory for the private socket dir. Default: `os.tmpdir()`. */
     tmpDir?: string;
+    /**
+     * Also serve on a loopback TCP port, and point the shim there (#439). For an
+     * agent inside the process sandbox wrapper: srt blocks `socket(AF_UNIX)` on
+     * Linux, so the shim cannot reach the unix socket, but it can reach an
+     * allowlisted host through srt's egress proxy. The adapter adds
+     * {@link ToolBridge.egress} to the node's egress; nothing else is opened.
+     */
+    tcp?: boolean;
 }
 export interface ToolBridge {
     /** Absolute path of the unix socket. */
     readonly socketPath: string;
     /** Per-run token. Never log it. */
     readonly token: string;
+    /** Loopback TCP endpoint, when started with `tcp: true`. */
+    readonly tcp?: {
+        host: string;
+        port: number;
+    };
+    /** Hosts a sandboxed shim must reach (`127.0.0.1:<port>` with `tcp`, else none). */
+    readonly egress: string[];
     /** stdio MCP server config a harness uses to start the shim. The token rides in `env`, not argv. */
     readonly mcpServer: McpServerConfig;
     /** Stop serving, drop connections, remove the socket and its directory. Idempotent. */

package/dist/harness/tool-bridge/server.js

@@ -9,6 +9,11 @@
  * Security properties (this is an injection boundary):
  * - The socket lives in a fresh `mkdtemp` directory (mode 0700) and is itself
  *   chmod 0600, so other users cannot connect.
+ * - With `tcp` (only for agents inside the process sandbox wrapper, #439) the
+ *   same handler also listens on 127.0.0.1:<random port>. Other local users
+ *   can open that port, so there the token is the only gate; the sandboxed
+ *   agent reaches it through srt's proxy only because the adapter allowlists
+ *   exactly that host:port for the run.
  * - A random 256-bit token is required on every frame. A wrong or missing
  *   token gets an `unauthorized` error and the connection is dropped.
  * - Only the tools passed in are listed or callable. The executor has already
@@ -98,7 +103,7 @@ export async function startToolBridge(opts) {
     liveDirs.add(dir);
     installCrashHooks();
     const sockets = new Set();
-    const server = net.createServer((sock) => {
+    const onConnection = (sock) => {
         sockets.add(sock);
         sock.on("close", () => sockets.delete(sock));
         sock.on("error", () => sock.destroy());
@@ -143,19 +148,29 @@ export async function startToolBridge(opts) {
             sock.destroy();
         });
         sock.on("data", read);
+    };
+    const server = net.createServer(onConnection);
+    // Same handler and token check; only started for sandboxed agents.
+    const tcpServer = opts.tcp ? net.createServer(onConnection) : undefined;
+    const listen = (s, options) => new Promise((resolve, reject) => {
+        s.once("error", reject);
+        s.listen(options, () => {
+            s.removeListener("error", reject);
+            resolve();
+        });
     });
+    let tcp;
     try {
-        await new Promise((resolve, reject) => {
-            server.once("error", reject);
-            server.listen(socketPath, () => {
-                server.removeListener("error", reject);
-                resolve();
-            });
-        });
+        await listen(server, { path: socketPath });
         fs.chmodSync(socketPath, 0o600);
+        if (tcpServer) {
+            await listen(tcpServer, { port: 0, host: "127.0.0.1" });
+            tcp = { host: "127.0.0.1", port: tcpServer.address().port };
+        }
     }
     catch (err) {
         server.close();
+        tcpServer?.close();
         liveDirs.delete(dir);
         removeDirSync(dir);
         uninstallCrashHooksIfIdle();
@@ -167,10 +182,12 @@ export async function startToolBridge(opts) {
     return {
         socketPath,
         token,
+        tcp,
+        egress: tcp ? [`${tcp.host}:${tcp.port}`] : [],
         mcpServer: {
             type: "stdio",
             command: shim.command,
-            args: [...shim.args, "--socket", socketPath],
+            args: [...shim.args, ...(tcp ? ["--connect", `${tcp.host}:${tcp.port}`] : ["--socket", socketPath])],
             // No update-check nudge in the shim: its stdio belongs to MCP.
             env: { [TOKEN_ENV]: token, SWENY_NO_UPDATE_CHECK: "1" },
         },
@@ -180,7 +197,7 @@ export async function startToolBridge(opts) {
             closed = true;
             for (const s of sockets)
                 s.destroy();
-            await new Promise((resolve) => server.close(() => resolve()));
+            await Promise.all([server, tcpServer].map((s) => (s ? new Promise((resolve) => s.close(() => resolve())) : undefined)));
             liveDirs.delete(dir);
             removeDirSync(dir);
             uninstallCrashHooksIfIdle();

package/dist/harness/tool-bridge/shim.d.ts

@@ -1,5 +1,7 @@
 /**
- * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`.
+ * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`, or
+ * `--connect 127.0.0.1:<port>` inside the process sandbox (#439), where it
+ * tunnels through the sandbox's HTTP proxy.
  *
  * A stdio MCP server a harness starts as a child process. It holds no tools
  * of its own: `tools/list` and `tools/call` are forwarded over the per-run
@@ -9,17 +11,49 @@
  * `--token` or, by default, the `SWENY_TOOL_BRIDGE_TOKEN` env var the server
  * puts in the MCP server config, so it never shows up in `ps` output.
  */
+import * as net from "node:net";
 import { type BridgeMethod, type BridgeResponse } from "./protocol.js";
+/** Where the bridge listens: the per-run unix socket, or its loopback TCP port (#439). */
+export type BridgeEndpoint = {
+    socketPath: string;
+} | {
+    host: string;
+    port: number;
+};
+/** Parse `--connect host:port` (IPv4 literal or `localhost`, or `[v6]:port`). */
+export declare function parseConnectTarget(value: string): {
+    host: string;
+    port: number;
+} | undefined;
+/**
+ * The HTTP proxy a sandboxed shim must tunnel through, from its env. srt sets
+ * HTTP_PROXY / HTTPS_PROXY (with its per-run credentials) for everything it
+ * wraps; inside the sandbox nothing else reaches the host. NO_PROXY is
+ * ignored on purpose: srt lists 127.0.0.1 there, but inside the sandbox's own
+ * network namespace 127.0.0.1 is not the host.
+ */
+export declare function bridgeProxyFromEnv(env: NodeJS.ProcessEnv): URL | undefined;
+/**
+ * Open a byte stream to the bridge. A TCP endpoint goes through an HTTP
+ * CONNECT tunnel when the env names a proxy (the sandboxed case), else
+ * straight to the port. `leftover` holds any bytes read past the proxy's
+ * response header.
+ */
+export declare function openBridgeStream(endpoint: BridgeEndpoint, env?: NodeJS.ProcessEnv): Promise<{
+    sock: net.Socket;
+    leftover: Buffer;
+}>;
 /** Socket client that multiplexes requests by id over one connection. */
 export declare class BridgeClient {
-    private readonly socketPath;
     private readonly token;
+    private readonly env;
     private sock;
     private connecting;
     private nextId;
     private pending;
     private closedError;
-    constructor(socketPath: string, token: string);
+    private readonly endpoint;
+    constructor(endpoint: string | BridgeEndpoint, token: string, env?: NodeJS.ProcessEnv);
     private connect;
     private failAll;
     request(method: BridgeMethod, params?: {
@@ -29,7 +63,10 @@ export declare class BridgeClient {
     close(): void;
 }
 export interface ShimOptions {
-    socket: string;
+    /** The per-run unix socket. */
+    socket?: string;
+    /** Or the bridge's loopback TCP endpoint, `host:port` (sandboxed agents, #439). */
+    connect?: string;
     /** Falls back to `SWENY_TOOL_BRIDGE_TOKEN`. */
     token?: string;
     version?: string;

package/dist/harness/tool-bridge/shim.js

@@ -1,5 +1,7 @@
 /**
- * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`.
+ * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`, or
+ * `--connect 127.0.0.1:<port>` inside the process sandbox (#439), where it
+ * tunnels through the sandbox's HTTP proxy.
  *
  * A stdio MCP server a harness starts as a child process. It holds no tools
  * of its own: `tools/list` and `tools/call` are forwarded over the per-run
@@ -14,18 +16,116 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { BRIDGE_PROTOCOL_VERSION, TOKEN_ENV, createFrameReader, encodeFrame, } from "./protocol.js";
+/** Parse `--connect host:port` (IPv4 literal or `localhost`, or `[v6]:port`). */
+export function parseConnectTarget(value) {
+    const m = /^(?:\[([0-9a-fA-F:.]+)\]|([A-Za-z0-9.-]+)):([1-9][0-9]{0,4})$/.exec(value);
+    if (!m)
+        return undefined;
+    const port = Number(m[3]);
+    return port <= 65535 ? { host: m[1] ?? m[2], port } : undefined;
+}
+/**
+ * The HTTP proxy a sandboxed shim must tunnel through, from its env. srt sets
+ * HTTP_PROXY / HTTPS_PROXY (with its per-run credentials) for everything it
+ * wraps; inside the sandbox nothing else reaches the host. NO_PROXY is
+ * ignored on purpose: srt lists 127.0.0.1 there, but inside the sandbox's own
+ * network namespace 127.0.0.1 is not the host.
+ */
+export function bridgeProxyFromEnv(env) {
+    for (const k of ["HTTP_PROXY", "http_proxy", "HTTPS_PROXY", "https_proxy", "ALL_PROXY", "all_proxy"]) {
+        const v = env[k];
+        if (!v)
+            continue;
+        try {
+            const u = new URL(v);
+            if (u.protocol === "http:")
+                return u;
+        }
+        catch {
+            // not a URL: try the next variable
+        }
+    }
+    return undefined;
+}
+const MAX_PROXY_RESPONSE_BYTES = 16 * 1024;
+/**
+ * Open a byte stream to the bridge. A TCP endpoint goes through an HTTP
+ * CONNECT tunnel when the env names a proxy (the sandboxed case), else
+ * straight to the port. `leftover` holds any bytes read past the proxy's
+ * response header.
+ */
+export function openBridgeStream(endpoint, env = process.env) {
+    const direct = (sock) => new Promise((resolve, reject) => {
+        sock.once("error", reject);
+        sock.once("connect", () => {
+            sock.removeListener("error", reject);
+            resolve({ sock, leftover: Buffer.alloc(0) });
+        });
+    });
+    if ("socketPath" in endpoint)
+        return direct(net.createConnection(endpoint.socketPath));
+    const proxy = bridgeProxyFromEnv(env);
+    if (!proxy)
+        return direct(net.createConnection(endpoint.port, endpoint.host));
+    return new Promise((resolve, reject) => {
+        const target = endpoint.host.includes(":")
+            ? `[${endpoint.host}]:${endpoint.port}`
+            : `${endpoint.host}:${endpoint.port}`;
+        const sock = net.createConnection(Number(proxy.port || 80), proxy.hostname.replace(/^\[|\]$/g, ""));
+        let buf = Buffer.alloc(0);
+        let done = false;
+        const fail = (err) => {
+            if (done)
+                return;
+            done = true;
+            sock.destroy();
+            reject(err);
+        };
+        const onData = (chunk) => {
+            buf = Buffer.concat([buf, chunk]);
+            const end = buf.indexOf("\r\n\r\n");
+            if (end === -1) {
+                if (buf.length > MAX_PROXY_RESPONSE_BYTES)
+                    fail(new Error("tool bridge: malformed proxy response"));
+                return;
+            }
+            const status = buf.subarray(0, buf.indexOf("\r\n")).toString("latin1");
+            if (!/^HTTP\/1\.[01] 200(\s|$)/.test(status)) {
+                fail(new Error(`tool bridge: the sandbox proxy refused ${target} (${status})`));
+                return;
+            }
+            done = true;
+            sock.removeListener("data", onData);
+            sock.removeListener("error", fail);
+            sock.removeListener("close", onClose);
+            resolve({ sock, leftover: buf.subarray(end + 4) });
+        };
+        const onClose = () => fail(new Error("tool bridge: the sandbox proxy closed the connection"));
+        sock.on("data", onData);
+        sock.once("error", fail);
+        sock.once("close", onClose);
+        sock.once("connect", () => {
+            const user = decodeURIComponent(proxy.username);
+            const pass = decodeURIComponent(proxy.password);
+            const auth = user || pass ? `Proxy-Authorization: Basic ${Buffer.from(`${user}:${pass}`).toString("base64")}\r\n` : "";
+            sock.write(`CONNECT ${target} HTTP/1.1\r\nHost: ${target}\r\n${auth}\r\n`);
+        });
+    });
+}
 /** Socket client that multiplexes requests by id over one connection. */
 export class BridgeClient {
-    socketPath;
     token;
+    env;
     sock;
     connecting;
     nextId = 1;
     pending = new Map();
     closedError;
-    constructor(socketPath, token) {
-        this.socketPath = socketPath;
+    endpoint;
+    constructor(endpoint, token, env = process.env) {
         this.token = token;
+        this.env = env;
+        this.endpoint = typeof endpoint === "string" ? { socketPath: endpoint } : endpoint;
     }
     connect() {
         // Once the connection is gone (bad token, server closed) every later call fails fast.
@@ -33,8 +133,7 @@ export class BridgeClient {
             return Promise.reject(this.closedError);
         if (this.sock)
             return Promise.resolve(this.sock);
-        this.connecting ??= new Promise((resolve, reject) => {
-            const sock = net.createConnection(this.socketPath);
+        this.connecting ??= openBridgeStream(this.endpoint, this.env).then(({ sock, leftover }) => {
             const read = createFrameReader((value) => {
                 const res = value;
                 if (!res || typeof res.id !== "number")
@@ -50,15 +149,15 @@ export class BridgeClient {
                 }
             }, () => this.failAll(new Error("tool bridge: response frame too large")));
             sock.on("data", read);
-            sock.once("connect", () => {
-                this.sock = sock;
-                resolve(sock);
-            });
-            sock.once("error", (err) => {
-                reject(err);
-                this.failAll(err);
-            });
+            sock.once("error", (err) => this.failAll(err));
             sock.once("close", () => this.failAll(new Error("tool bridge: connection closed")));
+            this.sock = sock;
+            if (leftover.length > 0)
+                read(leftover);
+            return sock;
+        }, (err) => {
+            this.failAll(err);
+            throw err;
         });
         return this.connecting;
     }
@@ -89,13 +188,15 @@ export class BridgeClient {
 /** Run the stdio MCP shim until stdin closes or the bridge goes away. */
 export async function runToolBridgeShim(opts) {
     const token = opts.token ?? process.env[TOKEN_ENV];
-    if (!opts.socket || !token) {
-        process.stderr.write(`sweny tool-bridge: --socket and a token (--token or ${TOKEN_ENV}) are required\n`);
+    const tcp = opts.connect ? parseConnectTarget(opts.connect) : undefined;
+    const endpoint = opts.socket ? { socketPath: opts.socket } : tcp;
+    if (!endpoint || (opts.socket && opts.connect) || (opts.connect && !tcp) || !token) {
+        process.stderr.write(`sweny tool-bridge: one of --socket <path> or --connect <host:port>, and a token (--token or ${TOKEN_ENV}), are required\n`);
         process.exit(2);
     }
     // Keep the token out of anything the shim might spawn or report.
     delete process.env[TOKEN_ENV];
-    const client = new BridgeClient(opts.socket, token);
+    const client = new BridgeClient(endpoint, token);
     const server = new Server({ name: "sweny-core", version: opts.version ?? "0.0.0" }, { capabilities: { tools: {} } });
     server.setRequestHandler(ListToolsRequestSchema, async () => {
         const res = await client.request("tools/list");

package/dist/safe-outputs.d.ts

@@ -9,7 +9,7 @@
  * the write, so this holds on every harness.
  *
  * Order of checks per intent (all deterministic): declared type, workflow
- * ceiling, actor trust, expiry, skill, target pin, issue pin, shape and size,
+ * ceiling, actor trust, expiry, skill, target pin, issue pin, state, shape and size,
  * labels, title prefix, dedupe, node cap, run cap. An optional model screen runs last
  * over the intents that passed and can only veto them.
  */
@@ -31,6 +31,8 @@ export interface SafeOutputIntent {
     labels?: string[];
     head?: string;
     base?: string;
+    /** issue_state: `reopen` or `close`. */
+    state?: string;
     dedupe_key?: string;
     /** ms since epoch when the intent was recorded. */
     recordedAt: number;

package/dist/safe-outputs.js

@@ -9,7 +9,7 @@
  * the write, so this holds on every harness.
  *
  * Order of checks per intent (all deterministic): declared type, workflow
- * ceiling, actor trust, expiry, skill, target pin, issue pin, shape and size,
+ * ceiling, actor trust, expiry, skill, target pin, issue pin, state, shape and size,
  * labels, title prefix, dedupe, node cap, run cap. An optional model screen runs last
  * over the intents that passed and can only veto them.
  */
@@ -49,7 +49,7 @@ export function createEmitOutputTool(declarations, buffer, now = Date.now) {
     return {
         name: EMIT_OUTPUT_TOOL,
         access: "read",
-        description: "Request a write (comment, issue, pr or label). This does NOT write anything now: sweny checks the request " +
+        description: "Request a write (comment, issue, pr, label or issue_state). This does NOT write anything now: sweny checks the request " +
             "against this step's declared outputs and limits, and applies it after the step finishes. Call once per write. " +
             `Allowed types here: ${types.join(", ")}.`,
         input_schema: {
@@ -64,8 +64,9 @@ export function createEmitOutputTool(declarations, buffer, now = Date.now) {
                 },
                 number: {
                     type: "string",
-                    description: "Issue or PR number (GitHub) or issue id (Linear), for comment and label",
+                    description: "Issue or PR number (GitHub) or issue id (Linear), for comment, label and issue_state",
                 },
+                state: { type: "string", enum: ["reopen", "close"], description: "issue_state only: reopen or close" },
                 labels: { type: "array", items: { type: "string" }, description: "Labels to add" },
                 head: { type: "string", description: "pr only: branch with the changes" },
                 base: { type: "string", description: "pr only: target branch (default main)" },
@@ -88,7 +89,7 @@ export function createEmitOutputTool(declarations, buffer, now = Date.now) {
                 return { recorded: false, error: `limit reached: at most ${max} ${type} write(s) from this step` };
             }
             const intent = { type, recordedAt: now() };
-            const fields = ["title", "body", "target", "number", "head", "base", "dedupe_key"];
+            const fields = ["title", "body", "target", "number", "head", "base", "state", "dedupe_key"];
             for (const f of fields) {
                 const v = str(input?.[f]);
                 if (v !== undefined)
@@ -117,6 +118,8 @@ export function safeOutputsInstruction(declarations, input) {
             const pin = resolvePin(d.number, input);
             parts.push(pin ? `only issue or PR ${pin} (the number may be omitted)` : "pinned issue not set for this run");
         }
+        if (d.type === "issue_state")
+            parts.push(d.state ? `only to ${d.state}` : "reopen or close");
         if (d.title_prefix)
             parts.push(`title prefix "${d.title_prefix}"`);
         if (d.type === "label" && d.labels?.length)
@@ -247,6 +250,11 @@ const APPLIERS = {
             needsTarget: true,
             build: (i) => ({ repo: i.target, issue_number: Number(i.number), labels: i.labels }),
         },
+        issue_state: {
+            tool: "github_set_issue_state",
+            needsTarget: true,
+            build: (i) => ({ repo: i.target, issue_number: Number(i.number), state: i.state }),
+        },
     },
     linear: {
         comment: {
@@ -264,6 +272,11 @@ const APPLIERS = {
                 ...(i.labels ? { labelIds: i.labels } : {}),
             }),
         },
+        issue_state: {
+            tool: "linear_set_issue_state",
+            needsTarget: false,
+            build: (i) => ({ issueId: i.number, state: i.state }),
+        },
     },
 };
 function dedupeKey(w, explicit) {
@@ -279,6 +292,7 @@ function dedupeKey(w, explicit) {
             [...(w.labels ?? [])].sort().join(","),
             w.head ?? "",
             w.base ?? "",
+            ...(w.state ? [w.state] : []),
         ];
     return createHash("sha256").update(JSON.stringify(parts)).digest("hex");
 }
@@ -377,9 +391,11 @@ export async function applySafeOutputs(o) {
             refuse(type === "comment" && !body.trim() ? "missing body" : "body too long", at);
             continue;
         }
-        // Issue pin: a pinned comment or label may only land on that issue or PR.
+        // Issue pin: a pinned comment, label or state change may only land on that issue or PR.
+        // issue_state never guesses an issue: it needs the pin or a number on the intent.
+        const onIssue = type === "comment" || type === "label" || type === "issue_state";
         let issueRef = intent.number?.trim().replace(/^#/, "") || undefined;
-        if ((type === "comment" || type === "label") && decl.number !== undefined) {
+        if (onIssue && decl.number !== undefined) {
             const pin = resolvePin(decl.number, o.input);
             if (!pin) {
                 refuse("pinned issue is not set for this run", at);
@@ -391,10 +407,29 @@ export async function applySafeOutputs(o) {
             }
             issueRef = pin;
         }
-        if ((type === "comment" || type === "label") && !issueRef) {
+        if (onIssue && !issueRef) {
             refuse("missing number", at);
             continue;
         }
+        // State change: reopen or close, inside the declared direction.
+        let state;
+        if (type === "issue_state") {
+            const asked = intent.state?.trim().toLowerCase() || decl.state;
+            if (asked !== "reopen" && asked !== "close") {
+                refuse("state must be reopen or close", at);
+                continue;
+            }
+            if (decl.state && asked !== decl.state) {
+                refuse("state outside the declared state", at);
+                continue;
+            }
+            // Closing needs the declaration to pin the issue (a workflow that skipped validation cannot bypass it).
+            if (asked === "close" && decl.number === undefined) {
+                refuse("close needs a pinned issue", at);
+                continue;
+            }
+            state = asked;
+        }
         if (via === "github" && issueRef !== undefined && !/^[1-9][0-9]*$/.test(issueRef)) {
             refuse("number must be an issue or PR number", at);
             continue;
@@ -432,11 +467,11 @@ export async function applySafeOutputs(o) {
             refuse("title too long", at);
             continue;
         }
-        // A Linear comment's issue ID does not encode or enforce its declared team.
+        // A Linear comment's (or state change's) issue ID does not encode or enforce its declared team.
         // Resolve it through the configured read tool and carry its immutable ID to
         // the write. Missing lookup support or unverifiable membership fails closed.
         let number = issueRef;
-        if (via === "linear" && type === "comment" && target) {
+        if (via === "linear" && (type === "comment" || type === "issue_state") && target) {
             const lookup = o.skills.get(via)?.tools.find((t) => t.name === "linear_get_issue" && t.access === "read");
             let issue;
             try {
@@ -464,7 +499,8 @@ export async function applySafeOutputs(o) {
             ...(target ? { target } : {}),
             ...(number !== undefined ? { number } : {}),
             ...(title ? { title } : {}),
-            ...(type !== "label" ? { body } : {}),
+            ...(type === "comment" || type === "issue" || type === "pr" ? { body } : {}),
+            ...(state ? { state } : {}),
             ...(labels ? { labels } : {}),
             ...(type === "pr" ? { head: intent.head, ...(intent.base ? { base: intent.base } : {}) } : {}),
         };
@@ -546,6 +582,8 @@ export async function applySafeOutputs(o) {
 function printPreview(w, logger) {
     const where = `${w.target ?? ""}${w.number ? `#${w.number}` : ""}`;
     logger.info(`  [staged] ${w.type} via ${w.via}${where ? ` -> ${where}` : ""}${w.title ? `: ${w.title}` : ""}`);
+    if (w.state)
+        logger.info(`    state: ${w.state}`);
     if (w.labels?.length)
         logger.info(`    labels: ${w.labels.join(", ")}`);
     if (w.type === "pr")