@sweny-ai/core 0.1.152 → 0.1.153

package/dist/agent-env.d.ts

@@ -150,10 +150,63 @@ export declare function scopeAgentEnv(source: Record<string, string | undefined>
  * values are always dropped. Pure: never mutates `source`.
  */
 export declare function buildAgentEnv(source: Record<string, string | undefined>, opts?: BuildAgentEnvOpts): Record<string, string>;
+/**
+ * Write tokens withheld from the agent when pushes are blocked. `gh`, the
+ * GitHub/GitLab REST APIs and git's HTTPS auth all read these; skill tools
+ * run in the sweny process, not the agent, so reads through skills still work.
+ * The harness's own model credentials are never in this list.
+ */
+export declare const PUSH_TOKEN_VARS: readonly string[];
+/** The remote name every push is pointed at under {@link withPushBlocked}. It never exists. */
+export declare const NO_PUSH_REMOTE = "sweny-no-push";
+/**
+ * A sweny-owned directory holding a `pre-push` hook and a `GIT_ASKPASS`
+ * program that both refuse, an ssh wrapper that refuses pushes, and an empty
+ * `gh` config dir. Created once per process under the OS temp dir.
+ */
+export declare function noPushDir(): string;
+/**
+ * Git config entries (command scope, via `GIT_CONFIG_COUNT`) that make every
+ * push fail while leaving fetch, commit and diff alone:
+ *
+ * - `credential.helper` set to empty resets the helper list, so no stored
+ *   credential (keychain, `gh auth git-credential`, store) reaches git;
+ * - `remote.pushDefault` names a remote that does not exist and
+ *   `push.default=nothing` refuses a bare `git push`;
+ * - `url.<unusable>.pushInsteadOf` rewrites every https/ssh/git/file/absolute
+ *   path push URL to a scheme git has no helper for;
+ * - `core.hooksPath` points at a sweny `pre-push` hook that exits 1, which
+ *   also covers a remote with an explicit `pushurl` (git ignores
+ *   pushInsteadOf there). Repo hooks do not run in these nodes.
+ */
+export declare function noPushGitConfig(dir: string): Array<[string, string]>;
+/**
+ * The agent env with pushes blocked (#442). Applied to every node's agent
+ * env when a run is staged or a dry run, on every harness, whether or not env
+ * scoping is on. Withholds {@link PUSH_TOKEN_VARS}, appends
+ * {@link noPushGitConfig} after any `GIT_CONFIG_*` entries already present,
+ * sets `GIT_ASKPASS` to a refusing program, turns off git's terminal prompt,
+ * routes git's ssh through a wrapper that refuses `git-receive-pack` (so an
+ * ssh push fails even to a remote with an explicit `pushurl` under
+ * `--no-verify`; ssh fetches still run the operator's own ssh command), and
+ * gives `gh` an empty config dir so a stored `gh auth login` is not used.
+ *
+ * Not a sandbox: a process that rewrites its own env or git config and
+ * finds a credential on disk (an ssh key without a passphrase, a keychain
+ * entry) is outside what env can stop. The sandbox wrapper hides credential
+ * files such as `~/.ssh`. `enabled` false returns `env` unchanged. Pure apart from
+ * creating {@link noPushDir} once.
+ */
+export declare function withPushBlocked(env: Record<string, string>, enabled: boolean | undefined): Record<string, string>;
 /** What one node's agent call may see: env var names and network hosts. */
 export interface AgentAccess {
     envVars: string[];
     domains: string[];
+    /**
+     * The run is staged or a dry run (#442): the harness applies
+     * {@link withPushBlocked} to the agent env, so no push can leave the node.
+     */
+    noPush?: boolean;
 }
 /** Hosts reachable by sandboxed commands in every node: source hosting + package registries. */
 export declare const DEFAULT_SANDBOX_DOMAINS: readonly string[];

package/dist/agent-env.js

@@ -22,8 +22,8 @@
  *   SWENY_SANDBOX_ALLOWED_DOMAINS  / sandbox-allowed-domains  extra hosts for sandboxed commands
  */
 import { execFileSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { homedir } from "node:os";
+import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
 // ─── Scoped env ──────────────────────────────────────────────────
 /**
@@ -429,6 +429,132 @@ export function buildAgentEnv(source, opts = {}) {
     }
     return out;
 }
+// ─── No push under --stage / --dry-run (#442) ────────────────────
+/**
+ * Write tokens withheld from the agent when pushes are blocked. `gh`, the
+ * GitHub/GitLab REST APIs and git's HTTPS auth all read these; skill tools
+ * run in the sweny process, not the agent, so reads through skills still work.
+ * The harness's own model credentials are never in this list.
+ */
+export const PUSH_TOKEN_VARS = [
+    "GITHUB_TOKEN",
+    "GH_TOKEN",
+    "GH_ENTERPRISE_TOKEN",
+    "GITHUB_ENTERPRISE_TOKEN",
+    "GITHUB_PAT",
+    "GITLAB_TOKEN",
+    "GL_TOKEN",
+    "CI_JOB_TOKEN",
+    "BITBUCKET_TOKEN",
+    // git transport credentials: the ssh agent socket and any askpass program
+    "SSH_AUTH_SOCK",
+    "SSH_ASKPASS",
+    "GIT_ASKPASS",
+];
+/** The remote name every push is pointed at under {@link withPushBlocked}. It never exists. */
+export const NO_PUSH_REMOTE = "sweny-no-push";
+/** URL prefixes rewritten to an unusable scheme for pushes only (fetches are untouched). */
+const PUSH_URL_PREFIXES = ["https://", "http://", "ssh://", "git://", "git@", "file://", "/"];
+const NO_PUSH_MESSAGE = "sweny: git push is blocked under --stage and --dry-run (#442)";
+let noPushDirCache;
+/** Single-quote for sh: git runs `GIT_SSH_COMMAND` through the shell. */
+function shQuote(s) {
+    return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * A sweny-owned directory holding a `pre-push` hook and a `GIT_ASKPASS`
+ * program that both refuse, an ssh wrapper that refuses pushes, and an empty
+ * `gh` config dir. Created once per process under the OS temp dir.
+ */
+export function noPushDir() {
+    if (noPushDirCache && existsSync(path.join(noPushDirCache, "hooks", "pre-push")))
+        return noPushDirCache;
+    const dir = mkdtempSync(path.join(tmpdir(), "sweny-no-push-"));
+    mkdirSync(path.join(dir, "hooks"));
+    mkdirSync(path.join(dir, "gh"));
+    const refuse = `#!/bin/sh\necho "${NO_PUSH_MESSAGE}" >&2\nexit 1\n`;
+    writeFileSync(path.join(dir, "hooks", "pre-push"), refuse, { mode: 0o755 });
+    writeFileSync(path.join(dir, "askpass"), refuse, { mode: 0o755 });
+    // git runs `<ssh> host "git-receive-pack '<path>'"` to push and
+    // git-upload-pack to fetch: refuse the first, hand everything else to the
+    // operator's own ssh command (or plain ssh).
+    const ssh = `#!/bin/sh\n` +
+        `for a in "$@"; do case "$a" in *receive-pack*) echo "${NO_PUSH_MESSAGE}" >&2; exit 1;; esac; done\n` +
+        `if [ -n "$SWENY_NO_PUSH_SSH" ]; then exec sh -c "$SWENY_NO_PUSH_SSH \\"\\$@\\"" ssh "$@"; fi\n` +
+        `exec ssh "$@"\n`;
+    writeFileSync(path.join(dir, "ssh"), ssh, { mode: 0o755 });
+    noPushDirCache = dir;
+    return dir;
+}
+/**
+ * Git config entries (command scope, via `GIT_CONFIG_COUNT`) that make every
+ * push fail while leaving fetch, commit and diff alone:
+ *
+ * - `credential.helper` set to empty resets the helper list, so no stored
+ *   credential (keychain, `gh auth git-credential`, store) reaches git;
+ * - `remote.pushDefault` names a remote that does not exist and
+ *   `push.default=nothing` refuses a bare `git push`;
+ * - `url.<unusable>.pushInsteadOf` rewrites every https/ssh/git/file/absolute
+ *   path push URL to a scheme git has no helper for;
+ * - `core.hooksPath` points at a sweny `pre-push` hook that exits 1, which
+ *   also covers a remote with an explicit `pushurl` (git ignores
+ *   pushInsteadOf there). Repo hooks do not run in these nodes.
+ */
+export function noPushGitConfig(dir) {
+    return [
+        ["credential.helper", ""],
+        ["remote.pushDefault", NO_PUSH_REMOTE],
+        ["push.default", "nothing"],
+        ["core.hooksPath", path.join(dir, "hooks")],
+        ...PUSH_URL_PREFIXES.map((p) => [`url.${NO_PUSH_REMOTE}://blocked/.pushInsteadOf`, p]),
+    ];
+}
+/**
+ * The agent env with pushes blocked (#442). Applied to every node's agent
+ * env when a run is staged or a dry run, on every harness, whether or not env
+ * scoping is on. Withholds {@link PUSH_TOKEN_VARS}, appends
+ * {@link noPushGitConfig} after any `GIT_CONFIG_*` entries already present,
+ * sets `GIT_ASKPASS` to a refusing program, turns off git's terminal prompt,
+ * routes git's ssh through a wrapper that refuses `git-receive-pack` (so an
+ * ssh push fails even to a remote with an explicit `pushurl` under
+ * `--no-verify`; ssh fetches still run the operator's own ssh command), and
+ * gives `gh` an empty config dir so a stored `gh auth login` is not used.
+ *
+ * Not a sandbox: a process that rewrites its own env or git config and
+ * finds a credential on disk (an ssh key without a passphrase, a keychain
+ * entry) is outside what env can stop. The sandbox wrapper hides credential
+ * files such as `~/.ssh`. `enabled` false returns `env` unchanged. Pure apart from
+ * creating {@link noPushDir} once.
+ */
+export function withPushBlocked(env, enabled) {
+    if (!enabled)
+        return env;
+    const dir = noPushDir();
+    const out = {};
+    for (const [k, v] of Object.entries(env)) {
+        if (PUSH_TOKEN_VARS.includes(k))
+            continue;
+        out[k] = v;
+    }
+    const base = Number.parseInt(out.GIT_CONFIG_COUNT ?? "0", 10);
+    let n = Number.isFinite(base) && base > 0 ? base : 0;
+    for (const [key, value] of noPushGitConfig(dir)) {
+        out[`GIT_CONFIG_KEY_${n}`] = key;
+        out[`GIT_CONFIG_VALUE_${n}`] = value;
+        n++;
+    }
+    out.GIT_CONFIG_COUNT = String(n);
+    const ownSsh = env.GIT_SSH_COMMAND ?? (env.GIT_SSH ? shQuote(env.GIT_SSH) : undefined);
+    if (ownSsh)
+        out.SWENY_NO_PUSH_SSH = ownSsh;
+    out.GIT_SSH_COMMAND = shQuote(path.join(dir, "ssh"));
+    out.GIT_SSH_VARIANT = "ssh";
+    out.GIT_ASKPASS = path.join(dir, "askpass");
+    out.GIT_TERMINAL_PROMPT = "0";
+    out.GH_CONFIG_DIR = path.join(dir, "gh");
+    out.GH_PROMPT_DISABLED = "1";
+    return out;
+}
 /** Hosts reachable by sandboxed commands in every node: source hosting + package registries. */
 export const DEFAULT_SANDBOX_DOMAINS = [
     "github.com",

package/dist/executor.js

@@ -281,7 +281,12 @@ export async function execute(workflow, input, options) {
         // compiles them or reports them in `degraded`.
         const denyClasses = (node.tools?.deny ?? []).filter(isToolClass);
         let degradedLogged = false;
-        const agentAccess = resolveAgentAccess(node.skills, skills);
+        // #442: a staged or dry run cannot push. The harness blocks git push and
+        // withholds write tokens in this node's agent env (see withPushBlocked).
+        const agentAccess = {
+            ...resolveAgentAccess(node.skills, skills),
+            ...(stageOutputs ? { noPush: true } : {}),
+        };
         // #365: a node or workflow that declares `permissions` or `outputs` gets
         // one portable policy, compiled by each adapter. The gate also runs here so
         // a strict refusal holds on every harness, before any spend. Nodes that

package/dist/harness/acp.js

@@ -48,7 +48,7 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, } from "../agent-env.js";
+import { parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
 import { ACP_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy, TOOL_CLASSES } from "./policy.js";
 import { buildNodePrompt } from "./prompts.js";
@@ -714,7 +714,7 @@ export class AcpHarness {
         const readOnly = policy.readOnly;
         // Permission answers: the node's deny list, plus legacy `disallowed_tools` names that map to a class.
         const deny = new Set([...policy.deny, ...translateDenyNames(policy.nativeDeny).classes]);
-        const env = this.buildEnv(req.agentAccess?.envVars);
+        const env = withPushBlocked(this.buildEnv(req.agentAccess?.envVars), req.agentAccess?.noPush);
         let bridge;
         try {
             // Dry run: external MCP servers cannot be classified per tool, so only

package/dist/harness/claude-code.js

@@ -11,7 +11,7 @@
 import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude-agent-sdk";
 import { createRequire } from "node:module";
 import { consoleLogger } from "../types.js";
-import { reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, resolveAgentSandbox, } from "../agent-env.js";
+import { reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, withPushBlocked, resolveAgentSandbox, } from "../agent-env.js";
 import { policyGate } from "./policy.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
 import { ask as coreAsk, evaluate as coreEvaluate, buildEvaluatePrompt, buildNodePrompt } from "./prompts.js";
@@ -310,7 +310,7 @@ export class ClaudeCodeHarness {
             disallowedTools: disallowedTools.length > 0 ? disallowedTools : undefined,
             strictMcp: readOnly || policy.strict || policy.exclusiveMcp === true,
             sandboxMode: policy.sandbox,
-            agentAccess: { envVars: req.agentAccess?.envVars ?? [], domains: policy.egress },
+            agentAccess: { envVars: req.agentAccess?.envVars ?? [], domains: policy.egress, noPush: req.agentAccess?.noPush },
         });
         return { ...result, harness: this.info(), degraded: gate.degraded };
     }
@@ -380,7 +380,7 @@ export class ClaudeCodeHarness {
         // Build prompt. Context (workflow input such as issues/alerts, plus prior
         // node outputs) is fenced as untrusted data (#360).
         const prompt = buildNodePrompt(instruction, context, outputSchema);
-        const env = this.buildEnv(agentAccess?.envVars);
+        const env = withPushBlocked(this.buildEnv(agentAccess?.envVars), agentAccess?.noPush);
         let response = "";
         // CC-08: when the SDK populates typed structured output (because we passed
         // an `outputFormat`), prefer it over re-parsing JSON out of the free-text

package/dist/harness/codex.js

@@ -28,7 +28,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, checkSandboxSupport, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, } from "../agent-env.js";
+import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, checkSandboxSupport, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
 import { CODEX_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
 import { buildNodePrompt } from "./prompts.js";
@@ -763,7 +763,7 @@ export class CodexHarness {
                 sandbox = s.mode;
             }
         }
-        const env = this.buildEnv(req.agentAccess?.envVars);
+        const env = withPushBlocked(this.buildEnv(req.agentAccess?.envVars), req.agentAccess?.noPush);
         if (wrapper && !env.CODEX_API_KEY && !env.CODEX_ACCESS_TOKEN && !this.loginWarned) {
             this.loginWarned = true;
             this.logger.warn("Codex runs inside the sandbox wrapper, where a stored `codex login` is not readable; set CODEX_API_KEY or OPENAI_API_KEY.");

package/dist/harness/pi.js

@@ -34,7 +34,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { PI_AUTH_VARS, PI_ENV_PREFIXES, parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, } from "../agent-env.js";
+import { PI_AUTH_VARS, PI_ENV_PREFIXES, parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
 import { PI_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
 import { buildNodePrompt } from "./prompts.js";
@@ -746,7 +746,7 @@ export class PiHarness {
         if (readOnly)
             for (const c of ["shell", "write", "edit"])
                 deny.add(c);
-        const env = this.buildEnv(req.agentAccess?.envVars);
+        const env = withPushBlocked(this.buildEnv(req.agentAccess?.envVars), req.agentAccess?.noPush);
         const model = req.model ?? this.model;
         let bridge;
         let agentDir;

package/dist/harness/types.d.ts

@@ -8,6 +8,7 @@
  *
  * Browser-safe: types only, no runtime imports.
  */
+import type { AgentAccess } from "../agent-env.js";
 import type { Claude, Logger, NodeResult } from "../types.js";
 export type HarnessId = "claude-code" | "mock" | "codex" | "pi" | "hermes" | "gemini" | `acp:${string}`;
 /** Portable tool vocabulary for node policy. */
@@ -100,6 +101,12 @@ export interface HarnessRunRequest extends ClaudeRunRequest {
      * `readOnly` / `disallowedTools` / `agentAccess` fields.
      */
     policy?: NodePolicy;
+    /**
+     * {@link ClaudeRunRequest.agentAccess} plus `noPush` (#442): the executor
+     * sets it for a staged or dry run, and every adapter applies
+     * `withPushBlocked` to the agent env.
+     */
+    agentAccess?: AgentAccess;
 }
 export interface HarnessRunResult extends NodeResult {
     harness: HarnessInfo;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.152",
+  "version": "0.1.153",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"