@sweny-ai/core 0.1.151 → 0.1.153

package/dist/agent-env.d.ts

@@ -150,10 +150,63 @@ export declare function scopeAgentEnv(source: Record<string, string | undefined>
  * values are always dropped. Pure: never mutates `source`.
  */
 export declare function buildAgentEnv(source: Record<string, string | undefined>, opts?: BuildAgentEnvOpts): Record<string, string>;
+/**
+ * Write tokens withheld from the agent when pushes are blocked. `gh`, the
+ * GitHub/GitLab REST APIs and git's HTTPS auth all read these; skill tools
+ * run in the sweny process, not the agent, so reads through skills still work.
+ * The harness's own model credentials are never in this list.
+ */
+export declare const PUSH_TOKEN_VARS: readonly string[];
+/** The remote name every push is pointed at under {@link withPushBlocked}. It never exists. */
+export declare const NO_PUSH_REMOTE = "sweny-no-push";
+/**
+ * A sweny-owned directory holding a `pre-push` hook and a `GIT_ASKPASS`
+ * program that both refuse, an ssh wrapper that refuses pushes, and an empty
+ * `gh` config dir. Created once per process under the OS temp dir.
+ */
+export declare function noPushDir(): string;
+/**
+ * Git config entries (command scope, via `GIT_CONFIG_COUNT`) that make every
+ * push fail while leaving fetch, commit and diff alone:
+ *
+ * - `credential.helper` set to empty resets the helper list, so no stored
+ *   credential (keychain, `gh auth git-credential`, store) reaches git;
+ * - `remote.pushDefault` names a remote that does not exist and
+ *   `push.default=nothing` refuses a bare `git push`;
+ * - `url.<unusable>.pushInsteadOf` rewrites every https/ssh/git/file/absolute
+ *   path push URL to a scheme git has no helper for;
+ * - `core.hooksPath` points at a sweny `pre-push` hook that exits 1, which
+ *   also covers a remote with an explicit `pushurl` (git ignores
+ *   pushInsteadOf there). Repo hooks do not run in these nodes.
+ */
+export declare function noPushGitConfig(dir: string): Array<[string, string]>;
+/**
+ * The agent env with pushes blocked (#442). Applied to every node's agent
+ * env when a run is staged or a dry run, on every harness, whether or not env
+ * scoping is on. Withholds {@link PUSH_TOKEN_VARS}, appends
+ * {@link noPushGitConfig} after any `GIT_CONFIG_*` entries already present,
+ * sets `GIT_ASKPASS` to a refusing program, turns off git's terminal prompt,
+ * routes git's ssh through a wrapper that refuses `git-receive-pack` (so an
+ * ssh push fails even to a remote with an explicit `pushurl` under
+ * `--no-verify`; ssh fetches still run the operator's own ssh command), and
+ * gives `gh` an empty config dir so a stored `gh auth login` is not used.
+ *
+ * Not a sandbox: a process that rewrites its own env or git config and
+ * finds a credential on disk (an ssh key without a passphrase, a keychain
+ * entry) is outside what env can stop. The sandbox wrapper hides credential
+ * files such as `~/.ssh`. `enabled` false returns `env` unchanged. Pure apart from
+ * creating {@link noPushDir} once.
+ */
+export declare function withPushBlocked(env: Record<string, string>, enabled: boolean | undefined): Record<string, string>;
 /** What one node's agent call may see: env var names and network hosts. */
 export interface AgentAccess {
     envVars: string[];
     domains: string[];
+    /**
+     * The run is staged or a dry run (#442): the harness applies
+     * {@link withPushBlocked} to the agent env, so no push can leave the node.
+     */
+    noPush?: boolean;
 }
 /** Hosts reachable by sandboxed commands in every node: source hosting + package registries. */
 export declare const DEFAULT_SANDBOX_DOMAINS: readonly string[];

package/dist/agent-env.js

@@ -22,8 +22,8 @@
  *   SWENY_SANDBOX_ALLOWED_DOMAINS  / sandbox-allowed-domains  extra hosts for sandboxed commands
  */
 import { execFileSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { homedir } from "node:os";
+import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
 // ─── Scoped env ──────────────────────────────────────────────────
 /**
@@ -429,6 +429,132 @@ export function buildAgentEnv(source, opts = {}) {
     }
     return out;
 }
+// ─── No push under --stage / --dry-run (#442) ────────────────────
+/**
+ * Write tokens withheld from the agent when pushes are blocked. `gh`, the
+ * GitHub/GitLab REST APIs and git's HTTPS auth all read these; skill tools
+ * run in the sweny process, not the agent, so reads through skills still work.
+ * The harness's own model credentials are never in this list.
+ */
+export const PUSH_TOKEN_VARS = [
+    "GITHUB_TOKEN",
+    "GH_TOKEN",
+    "GH_ENTERPRISE_TOKEN",
+    "GITHUB_ENTERPRISE_TOKEN",
+    "GITHUB_PAT",
+    "GITLAB_TOKEN",
+    "GL_TOKEN",
+    "CI_JOB_TOKEN",
+    "BITBUCKET_TOKEN",
+    // git transport credentials: the ssh agent socket and any askpass program
+    "SSH_AUTH_SOCK",
+    "SSH_ASKPASS",
+    "GIT_ASKPASS",
+];
+/** The remote name every push is pointed at under {@link withPushBlocked}. It never exists. */
+export const NO_PUSH_REMOTE = "sweny-no-push";
+/** URL prefixes rewritten to an unusable scheme for pushes only (fetches are untouched). */
+const PUSH_URL_PREFIXES = ["https://", "http://", "ssh://", "git://", "git@", "file://", "/"];
+const NO_PUSH_MESSAGE = "sweny: git push is blocked under --stage and --dry-run (#442)";
+let noPushDirCache;
+/** Single-quote for sh: git runs `GIT_SSH_COMMAND` through the shell. */
+function shQuote(s) {
+    return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * A sweny-owned directory holding a `pre-push` hook and a `GIT_ASKPASS`
+ * program that both refuse, an ssh wrapper that refuses pushes, and an empty
+ * `gh` config dir. Created once per process under the OS temp dir.
+ */
+export function noPushDir() {
+    if (noPushDirCache && existsSync(path.join(noPushDirCache, "hooks", "pre-push")))
+        return noPushDirCache;
+    const dir = mkdtempSync(path.join(tmpdir(), "sweny-no-push-"));
+    mkdirSync(path.join(dir, "hooks"));
+    mkdirSync(path.join(dir, "gh"));
+    const refuse = `#!/bin/sh\necho "${NO_PUSH_MESSAGE}" >&2\nexit 1\n`;
+    writeFileSync(path.join(dir, "hooks", "pre-push"), refuse, { mode: 0o755 });
+    writeFileSync(path.join(dir, "askpass"), refuse, { mode: 0o755 });
+    // git runs `<ssh> host "git-receive-pack '<path>'"` to push and
+    // git-upload-pack to fetch: refuse the first, hand everything else to the
+    // operator's own ssh command (or plain ssh).
+    const ssh = `#!/bin/sh\n` +
+        `for a in "$@"; do case "$a" in *receive-pack*) echo "${NO_PUSH_MESSAGE}" >&2; exit 1;; esac; done\n` +
+        `if [ -n "$SWENY_NO_PUSH_SSH" ]; then exec sh -c "$SWENY_NO_PUSH_SSH \\"\\$@\\"" ssh "$@"; fi\n` +
+        `exec ssh "$@"\n`;
+    writeFileSync(path.join(dir, "ssh"), ssh, { mode: 0o755 });
+    noPushDirCache = dir;
+    return dir;
+}
+/**
+ * Git config entries (command scope, via `GIT_CONFIG_COUNT`) that make every
+ * push fail while leaving fetch, commit and diff alone:
+ *
+ * - `credential.helper` set to empty resets the helper list, so no stored
+ *   credential (keychain, `gh auth git-credential`, store) reaches git;
+ * - `remote.pushDefault` names a remote that does not exist and
+ *   `push.default=nothing` refuses a bare `git push`;
+ * - `url.<unusable>.pushInsteadOf` rewrites every https/ssh/git/file/absolute
+ *   path push URL to a scheme git has no helper for;
+ * - `core.hooksPath` points at a sweny `pre-push` hook that exits 1, which
+ *   also covers a remote with an explicit `pushurl` (git ignores
+ *   pushInsteadOf there). Repo hooks do not run in these nodes.
+ */
+export function noPushGitConfig(dir) {
+    return [
+        ["credential.helper", ""],
+        ["remote.pushDefault", NO_PUSH_REMOTE],
+        ["push.default", "nothing"],
+        ["core.hooksPath", path.join(dir, "hooks")],
+        ...PUSH_URL_PREFIXES.map((p) => [`url.${NO_PUSH_REMOTE}://blocked/.pushInsteadOf`, p]),
+    ];
+}
+/**
+ * The agent env with pushes blocked (#442). Applied to every node's agent
+ * env when a run is staged or a dry run, on every harness, whether or not env
+ * scoping is on. Withholds {@link PUSH_TOKEN_VARS}, appends
+ * {@link noPushGitConfig} after any `GIT_CONFIG_*` entries already present,
+ * sets `GIT_ASKPASS` to a refusing program, turns off git's terminal prompt,
+ * routes git's ssh through a wrapper that refuses `git-receive-pack` (so an
+ * ssh push fails even to a remote with an explicit `pushurl` under
+ * `--no-verify`; ssh fetches still run the operator's own ssh command), and
+ * gives `gh` an empty config dir so a stored `gh auth login` is not used.
+ *
+ * Not a sandbox: a process that rewrites its own env or git config and
+ * finds a credential on disk (an ssh key without a passphrase, a keychain
+ * entry) is outside what env can stop. The sandbox wrapper hides credential
+ * files such as `~/.ssh`. `enabled` false returns `env` unchanged. Pure apart from
+ * creating {@link noPushDir} once.
+ */
+export function withPushBlocked(env, enabled) {
+    if (!enabled)
+        return env;
+    const dir = noPushDir();
+    const out = {};
+    for (const [k, v] of Object.entries(env)) {
+        if (PUSH_TOKEN_VARS.includes(k))
+            continue;
+        out[k] = v;
+    }
+    const base = Number.parseInt(out.GIT_CONFIG_COUNT ?? "0", 10);
+    let n = Number.isFinite(base) && base > 0 ? base : 0;
+    for (const [key, value] of noPushGitConfig(dir)) {
+        out[`GIT_CONFIG_KEY_${n}`] = key;
+        out[`GIT_CONFIG_VALUE_${n}`] = value;
+        n++;
+    }
+    out.GIT_CONFIG_COUNT = String(n);
+    const ownSsh = env.GIT_SSH_COMMAND ?? (env.GIT_SSH ? shQuote(env.GIT_SSH) : undefined);
+    if (ownSsh)
+        out.SWENY_NO_PUSH_SSH = ownSsh;
+    out.GIT_SSH_COMMAND = shQuote(path.join(dir, "ssh"));
+    out.GIT_SSH_VARIANT = "ssh";
+    out.GIT_ASKPASS = path.join(dir, "askpass");
+    out.GIT_TERMINAL_PROMPT = "0";
+    out.GH_CONFIG_DIR = path.join(dir, "gh");
+    out.GH_PROMPT_DISABLED = "1";
+    return out;
+}
 /** Hosts reachable by sandboxed commands in every node: source hosting + package registries. */
 export const DEFAULT_SANDBOX_DOMAINS = [
     "github.com",

package/dist/cli/builtin-workflows.js

@@ -33,6 +33,7 @@ const LEGACY_WRITE_TOOLS = {
     comment: ["github_add_comment", "linear_add_comment", "linear_update_issue"],
     pr: ["github_create_pr"],
     label: ["github_add_labels"],
+    issue_state: ["linear_update_issue", "linear_set_issue_state", "github_set_issue_state"],
 };
 const writeToolsBySkill = new Map(builtinSkills.map((s) => [s.id, s.tools.filter((t) => t.access !== "read").map((t) => t.name)]));
 function skillWriteTools(node) {
@@ -59,7 +60,7 @@ export function readGaps(p) {
 }
 /** The skill that applies this output type for these providers, or undefined when none can. */
 export function outputSkill(type, p) {
-    if (type === "issue" || type === "comment")
+    if (type === "issue" || type === "comment" || type === "issue_state")
         return TRACKER_SKILL[p.issueTracker];
     return p.sourceControl === "github" ? "github" : undefined;
 }

package/dist/executor.js

@@ -281,7 +281,12 @@ export async function execute(workflow, input, options) {
         // compiles them or reports them in `degraded`.
         const denyClasses = (node.tools?.deny ?? []).filter(isToolClass);
         let degradedLogged = false;
-        const agentAccess = resolveAgentAccess(node.skills, skills);
+        // #442: a staged or dry run cannot push. The harness blocks git push and
+        // withholds write tokens in this node's agent env (see withPushBlocked).
+        const agentAccess = {
+            ...resolveAgentAccess(node.skills, skills),
+            ...(stageOutputs ? { noPush: true } : {}),
+        };
         // #365: a node or workflow that declares `permissions` or `outputs` gets
         // one portable policy, compiled by each adapter. The gate also runs here so
         // a strict refusal holds on every harness, before any spend. Nodes that

package/dist/harness/acp.js

@@ -48,7 +48,7 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, } from "../agent-env.js";
+import { parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
 import { ACP_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy, TOOL_CLASSES } from "./policy.js";
 import { buildNodePrompt } from "./prompts.js";
@@ -714,7 +714,7 @@ export class AcpHarness {
         const readOnly = policy.readOnly;
         // Permission answers: the node's deny list, plus legacy `disallowed_tools` names that map to a class.
         const deny = new Set([...policy.deny, ...translateDenyNames(policy.nativeDeny).classes]);
-        const env = this.buildEnv(req.agentAccess?.envVars);
+        const env = withPushBlocked(this.buildEnv(req.agentAccess?.envVars), req.agentAccess?.noPush);
         let bridge;
         try {
             // Dry run: external MCP servers cannot be classified per tool, so only

package/dist/harness/claude-code.js

@@ -11,7 +11,7 @@
 import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude-agent-sdk";
 import { createRequire } from "node:module";
 import { consoleLogger } from "../types.js";
-import { reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, resolveAgentSandbox, } from "../agent-env.js";
+import { reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, withPushBlocked, resolveAgentSandbox, } from "../agent-env.js";
 import { policyGate } from "./policy.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
 import { ask as coreAsk, evaluate as coreEvaluate, buildEvaluatePrompt, buildNodePrompt } from "./prompts.js";
@@ -310,7 +310,7 @@ export class ClaudeCodeHarness {
             disallowedTools: disallowedTools.length > 0 ? disallowedTools : undefined,
             strictMcp: readOnly || policy.strict || policy.exclusiveMcp === true,
             sandboxMode: policy.sandbox,
-            agentAccess: { envVars: req.agentAccess?.envVars ?? [], domains: policy.egress },
+            agentAccess: { envVars: req.agentAccess?.envVars ?? [], domains: policy.egress, noPush: req.agentAccess?.noPush },
         });
         return { ...result, harness: this.info(), degraded: gate.degraded };
     }
@@ -380,7 +380,7 @@ export class ClaudeCodeHarness {
         // Build prompt. Context (workflow input such as issues/alerts, plus prior
         // node outputs) is fenced as untrusted data (#360).
         const prompt = buildNodePrompt(instruction, context, outputSchema);
-        const env = this.buildEnv(agentAccess?.envVars);
+        const env = withPushBlocked(this.buildEnv(agentAccess?.envVars), agentAccess?.noPush);
         let response = "";
         // CC-08: when the SDK populates typed structured output (because we passed
         // an `outputFormat`), prefer it over re-parsing JSON out of the free-text

package/dist/harness/codex.js

@@ -28,7 +28,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, checkSandboxSupport, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, } from "../agent-env.js";
+import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, checkSandboxSupport, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
 import { CODEX_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
 import { buildNodePrompt } from "./prompts.js";
@@ -763,7 +763,7 @@ export class CodexHarness {
                 sandbox = s.mode;
             }
         }
-        const env = this.buildEnv(req.agentAccess?.envVars);
+        const env = withPushBlocked(this.buildEnv(req.agentAccess?.envVars), req.agentAccess?.noPush);
         if (wrapper && !env.CODEX_API_KEY && !env.CODEX_ACCESS_TOKEN && !this.loginWarned) {
             this.loginWarned = true;
             this.logger.warn("Codex runs inside the sandbox wrapper, where a stored `codex login` is not readable; set CODEX_API_KEY or OPENAI_API_KEY.");

package/dist/harness/pi.js

@@ -34,7 +34,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { PI_AUTH_VARS, PI_ENV_PREFIXES, parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, } from "../agent-env.js";
+import { PI_AUTH_VARS, PI_ENV_PREFIXES, parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
 import { PI_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
 import { buildNodePrompt } from "./prompts.js";
@@ -746,7 +746,7 @@ export class PiHarness {
         if (readOnly)
             for (const c of ["shell", "write", "edit"])
                 deny.add(c);
-        const env = this.buildEnv(req.agentAccess?.envVars);
+        const env = withPushBlocked(this.buildEnv(req.agentAccess?.envVars), req.agentAccess?.noPush);
         const model = req.model ?? this.model;
         let bridge;
         let agentDir;

package/dist/harness/types.d.ts

@@ -8,6 +8,7 @@
  *
  * Browser-safe: types only, no runtime imports.
  */
+import type { AgentAccess } from "../agent-env.js";
 import type { Claude, Logger, NodeResult } from "../types.js";
 export type HarnessId = "claude-code" | "mock" | "codex" | "pi" | "hermes" | "gemini" | `acp:${string}`;
 /** Portable tool vocabulary for node policy. */
@@ -100,6 +101,12 @@ export interface HarnessRunRequest extends ClaudeRunRequest {
      * `readOnly` / `disallowedTools` / `agentAccess` fields.
      */
     policy?: NodePolicy;
+    /**
+     * {@link ClaudeRunRequest.agentAccess} plus `noPush` (#442): the executor
+     * sets it for a staged or dry run, and every adapter applies
+     * `withPushBlocked` to the agent env.
+     */
+    agentAccess?: AgentAccess;
 }
 export interface HarnessRunResult extends NodeResult {
     harness: HarnessInfo;

package/dist/safe-outputs.d.ts

@@ -9,7 +9,7 @@
  * the write, so this holds on every harness.
  *
  * Order of checks per intent (all deterministic): declared type, workflow
- * ceiling, actor trust, expiry, skill, target pin, issue pin, shape and size,
+ * ceiling, actor trust, expiry, skill, target pin, issue pin, state, shape and size,
  * labels, title prefix, dedupe, node cap, run cap. An optional model screen runs last
  * over the intents that passed and can only veto them.
  */
@@ -31,6 +31,8 @@ export interface SafeOutputIntent {
     labels?: string[];
     head?: string;
     base?: string;
+    /** issue_state: `reopen` or `close`. */
+    state?: string;
     dedupe_key?: string;
     /** ms since epoch when the intent was recorded. */
     recordedAt: number;

package/dist/safe-outputs.js

@@ -9,7 +9,7 @@
  * the write, so this holds on every harness.
  *
  * Order of checks per intent (all deterministic): declared type, workflow
- * ceiling, actor trust, expiry, skill, target pin, issue pin, shape and size,
+ * ceiling, actor trust, expiry, skill, target pin, issue pin, state, shape and size,
  * labels, title prefix, dedupe, node cap, run cap. An optional model screen runs last
  * over the intents that passed and can only veto them.
  */
@@ -49,7 +49,7 @@ export function createEmitOutputTool(declarations, buffer, now = Date.now) {
     return {
         name: EMIT_OUTPUT_TOOL,
         access: "read",
-        description: "Request a write (comment, issue, pr or label). This does NOT write anything now: sweny checks the request " +
+        description: "Request a write (comment, issue, pr, label or issue_state). This does NOT write anything now: sweny checks the request " +
             "against this step's declared outputs and limits, and applies it after the step finishes. Call once per write. " +
             `Allowed types here: ${types.join(", ")}.`,
         input_schema: {
@@ -64,8 +64,9 @@ export function createEmitOutputTool(declarations, buffer, now = Date.now) {
                 },
                 number: {
                     type: "string",
-                    description: "Issue or PR number (GitHub) or issue id (Linear), for comment and label",
+                    description: "Issue or PR number (GitHub) or issue id (Linear), for comment, label and issue_state",
                 },
+                state: { type: "string", enum: ["reopen", "close"], description: "issue_state only: reopen or close" },
                 labels: { type: "array", items: { type: "string" }, description: "Labels to add" },
                 head: { type: "string", description: "pr only: branch with the changes" },
                 base: { type: "string", description: "pr only: target branch (default main)" },
@@ -88,7 +89,7 @@ export function createEmitOutputTool(declarations, buffer, now = Date.now) {
                 return { recorded: false, error: `limit reached: at most ${max} ${type} write(s) from this step` };
             }
             const intent = { type, recordedAt: now() };
-            const fields = ["title", "body", "target", "number", "head", "base", "dedupe_key"];
+            const fields = ["title", "body", "target", "number", "head", "base", "state", "dedupe_key"];
             for (const f of fields) {
                 const v = str(input?.[f]);
                 if (v !== undefined)
@@ -117,6 +118,8 @@ export function safeOutputsInstruction(declarations, input) {
             const pin = resolvePin(d.number, input);
             parts.push(pin ? `only issue or PR ${pin} (the number may be omitted)` : "pinned issue not set for this run");
         }
+        if (d.type === "issue_state")
+            parts.push(d.state ? `only to ${d.state}` : "reopen or close");
         if (d.title_prefix)
             parts.push(`title prefix "${d.title_prefix}"`);
         if (d.type === "label" && d.labels?.length)
@@ -247,6 +250,11 @@ const APPLIERS = {
             needsTarget: true,
             build: (i) => ({ repo: i.target, issue_number: Number(i.number), labels: i.labels }),
         },
+        issue_state: {
+            tool: "github_set_issue_state",
+            needsTarget: true,
+            build: (i) => ({ repo: i.target, issue_number: Number(i.number), state: i.state }),
+        },
     },
     linear: {
         comment: {
@@ -264,6 +272,11 @@ const APPLIERS = {
                 ...(i.labels ? { labelIds: i.labels } : {}),
             }),
         },
+        issue_state: {
+            tool: "linear_set_issue_state",
+            needsTarget: false,
+            build: (i) => ({ issueId: i.number, state: i.state }),
+        },
     },
 };
 function dedupeKey(w, explicit) {
@@ -279,6 +292,7 @@ function dedupeKey(w, explicit) {
             [...(w.labels ?? [])].sort().join(","),
             w.head ?? "",
             w.base ?? "",
+            ...(w.state ? [w.state] : []),
         ];
     return createHash("sha256").update(JSON.stringify(parts)).digest("hex");
 }
@@ -377,9 +391,11 @@ export async function applySafeOutputs(o) {
             refuse(type === "comment" && !body.trim() ? "missing body" : "body too long", at);
             continue;
         }
-        // Issue pin: a pinned comment or label may only land on that issue or PR.
+        // Issue pin: a pinned comment, label or state change may only land on that issue or PR.
+        // issue_state never guesses an issue: it needs the pin or a number on the intent.
+        const onIssue = type === "comment" || type === "label" || type === "issue_state";
         let issueRef = intent.number?.trim().replace(/^#/, "") || undefined;
-        if ((type === "comment" || type === "label") && decl.number !== undefined) {
+        if (onIssue && decl.number !== undefined) {
             const pin = resolvePin(decl.number, o.input);
             if (!pin) {
                 refuse("pinned issue is not set for this run", at);
@@ -391,10 +407,29 @@ export async function applySafeOutputs(o) {
             }
             issueRef = pin;
         }
-        if ((type === "comment" || type === "label") && !issueRef) {
+        if (onIssue && !issueRef) {
             refuse("missing number", at);
             continue;
         }
+        // State change: reopen or close, inside the declared direction.
+        let state;
+        if (type === "issue_state") {
+            const asked = intent.state?.trim().toLowerCase() || decl.state;
+            if (asked !== "reopen" && asked !== "close") {
+                refuse("state must be reopen or close", at);
+                continue;
+            }
+            if (decl.state && asked !== decl.state) {
+                refuse("state outside the declared state", at);
+                continue;
+            }
+            // Closing needs the declaration to pin the issue (a workflow that skipped validation cannot bypass it).
+            if (asked === "close" && decl.number === undefined) {
+                refuse("close needs a pinned issue", at);
+                continue;
+            }
+            state = asked;
+        }
         if (via === "github" && issueRef !== undefined && !/^[1-9][0-9]*$/.test(issueRef)) {
             refuse("number must be an issue or PR number", at);
             continue;
@@ -432,11 +467,11 @@ export async function applySafeOutputs(o) {
             refuse("title too long", at);
             continue;
         }
-        // A Linear comment's issue ID does not encode or enforce its declared team.
+        // A Linear comment's (or state change's) issue ID does not encode or enforce its declared team.
         // Resolve it through the configured read tool and carry its immutable ID to
         // the write. Missing lookup support or unverifiable membership fails closed.
         let number = issueRef;
-        if (via === "linear" && type === "comment" && target) {
+        if (via === "linear" && (type === "comment" || type === "issue_state") && target) {
             const lookup = o.skills.get(via)?.tools.find((t) => t.name === "linear_get_issue" && t.access === "read");
             let issue;
             try {
@@ -464,7 +499,8 @@ export async function applySafeOutputs(o) {
             ...(target ? { target } : {}),
             ...(number !== undefined ? { number } : {}),
             ...(title ? { title } : {}),
-            ...(type !== "label" ? { body } : {}),
+            ...(type === "comment" || type === "issue" || type === "pr" ? { body } : {}),
+            ...(state ? { state } : {}),
             ...(labels ? { labels } : {}),
             ...(type === "pr" ? { head: intent.head, ...(intent.base ? { base: intent.base } : {}) } : {}),
         };
@@ -546,6 +582,8 @@ export async function applySafeOutputs(o) {
 function printPreview(w, logger) {
     const where = `${w.target ?? ""}${w.number ? `#${w.number}` : ""}`;
     logger.info(`  [staged] ${w.type} via ${w.via}${where ? ` -> ${where}` : ""}${w.title ? `: ${w.title}` : ""}`);
+    if (w.state)
+        logger.info(`    state: ${w.state}`);
     if (w.labels?.length)
         logger.info(`    labels: ${w.labels.join(", ")}`);
     if (w.type === "pr")