@sweny-ai/core 0.1.164 → 0.1.166

package/dist/cli/main.js

@@ -34,6 +34,8 @@ import { nonInteractiveUsage, runNew } from "./new.js";
 import { formatFinalMarkdown, formatFinalOutput, resolveFinalOutput, writeFinalOutput } from "./final-output.js";
 import { buildRunRecord, createNodeTimer, historyDisabled, newRunId, recordRun } from "./run-history.js";
 import { registerRunsCommand } from "./runs.js";
+import { JournalLockedError, JournalMismatchError, RunJournal } from "../journal.js";
+import { journalDisabled, prepareResume, RESUME_SHARED_RUN_FLAGS, WORKFLOW_RESUME_OPTIONS, } from "./resume.js";
 import { runE2eRun, runWithWallClockBudget, DEFAULT_WORKFLOW_TIMEOUT_MS } from "./e2e.js";
 import { createVerboseToolObserver } from "./verbose-observer.js";
 import { createRunLogger, renderReceiptLine, summarizeRun, writeStepSummary, WORKFLOW_RUN_DESCRIPTION, WORKFLOW_RUN_OPTIONS, } from "./run-output.js";
@@ -730,7 +732,9 @@ export function loadWorkflowFile(filePath, knownSkills) {
         console.error(chalk.yellow(`  \u26A0 ${w}`));
     return result.workflow;
 }
-export async function workflowRunAction(file, options) {
+export async function workflowRunAction(file, options, 
+/** Set by `sweny workflow resume` (#363): the journal, run id and original input. */
+resume) {
     if (options.decider !== undefined && options.decider !== "off" && options.decider !== "shadow") {
         console.error(chalk.red(`\n  --decider must be off or shadow, got "${options.decider}"\n`));
         process.exit(1);
@@ -877,7 +881,10 @@ export async function workflowRunAction(file, options) {
         };
     // Build workflow input — prefer --input JSON if provided, else fall back to config-derived input
     let workflowInput;
-    if (options.input && typeof options.input === "string") {
+    if (resume) {
+        workflowInput = resume.input;
+    }
+    else if (options.input && typeof options.input === "string") {
         const parsedInput = parseInputFlag(options.input);
         if (!parsedInput.ok) {
             for (const line of parsedInput.lines)
@@ -962,7 +969,18 @@ export async function workflowRunAction(file, options) {
     }
     // Run history (#388): metadata-only record under .sweny/runs/, written once at run end.
     const nodeTimer = createNodeTimer();
-    const runId = newRunId(runStart);
+    const runId = resume?.runId ?? newRunId(runStart);
+    // Run journal (#363): what `sweny workflow resume <run-id>` continues from.
+    const journal = resume?.journal ??
+        (journalDisabled(options.journal, fileConfig["journal"])
+            ? undefined
+            : RunJournal.create({
+                runId,
+                workflowFile: path.resolve(file),
+                swenyVersion: version,
+                env: process.env,
+                logger: runLogger,
+            }));
     let historyRecorded = false;
     const recordHistory = (results, trace, crashed) => {
         if (historyRecorded || historyDisabled(options.history, fileConfig["history"]))
@@ -1011,11 +1029,13 @@ export async function workflowRunAction(file, options) {
             max_steps: wfMaxSteps,
             ...(options.decider ? { decider: options.decider } : {}),
             stageOutputs: options.stage === true,
+            journal,
             ...(spendBudget ? { budget: spendBudget } : {}),
             harnessPolicy: resolveHarnessPolicy(process.env, typeof options.harnessPolicy === "string" ? options.harnessPolicy : undefined, runLogger),
         }), wfTimeoutMs, `Workflow ${workflow.name}`);
         const wfDurationMs = Date.now() - runStart;
         const wfHasFailed = [...results.values()].some((r) => r.status === "failed");
+        journal?.end(wfHasFailed ? "failed" : "success");
         recordHistory(results, trace, false);
         // Close the cloud lifecycle session BEFORE the JSON early-exit so
         // every workflow run reports a terminal status, regardless of how
@@ -1073,6 +1093,8 @@ export async function workflowRunAction(file, options) {
         }
         if (wfHasFailed) {
             console.error(`  ${renderReceiptLine(receipt, isTTY)}\n`);
+            if (journal?.active)
+                console.error(c.subtle(`  resume with: sweny workflow resume ${runId}\n`));
             process.exit(1);
             return;
         }
@@ -1080,8 +1102,17 @@ export async function workflowRunAction(file, options) {
         process.exit(0);
     }
     catch (err) {
+        // A refused resume ran nothing: leave the run's journal and history as they were.
+        if (err instanceof JournalMismatchError || err instanceof JournalLockedError) {
+            console.error(chalk.red(`\n  ${err.message}\n`));
+            process.exit(1);
+            return;
+        }
         console.error(formatCrashError(err));
         runLogger.flush();
+        journal?.end("crashed");
+        if (journal)
+            console.error(c.subtle(`  resume with: sweny workflow resume ${runId}`));
         recordHistory(nodeTimer.lastResults, undefined, true);
         console.error(`  ${renderReceiptLine(summarizeRun(new Map(), Date.now() - runStart, true), isTTY)}\n`);
         // A crash must not leave a stale success comment behind.
@@ -1191,6 +1222,44 @@ for (const [flags, description] of WORKFLOW_RUN_OPTIONS) {
     workflowRunCmd.option(flags, description);
 }
 workflowRunCmd.option("--no-history", "Do not record this run or save its output.md in .sweny/runs/ (or set `history: off` in .sweny.yml)");
+workflowRunCmd.option("--no-journal", "Do not write a run journal to .sweny/runs/<run-id>/ (or set `journal: off` in .sweny.yml); the run cannot be resumed");
+const workflowResumeCmd = workflowCmd
+    .command("resume <run-id>")
+    .description("Resume a killed or failed `workflow run` from its journal: finished nodes are replayed without calling the agent, " +
+    "the first unfinished node runs again, and writes already applied are not re-sent")
+    .action(async (runRef, options) => {
+    const discovered = configuredSkillsWithDiagnostics(process.env, process.cwd());
+    const known = new Set([...discovered.skills.map((s) => s.id), ...builtinSkills.map((s) => s.id)]);
+    const prepared = prepareResume(runRef, {
+        force: options.force === true,
+        allowRepeatWrites: options.allowRepeatWrites === true,
+        plan: options.plan === true,
+        workflow: typeof options.workflow === "string" ? options.workflow : undefined,
+        input: typeof options.input === "string" ? options.input : undefined,
+    }, { loadWorkflow: (f) => loadWorkflowFile(f, known), swenyVersion: version, env: process.env });
+    const out = options.json ? process.stderr : process.stdout;
+    for (const line of prepared.lines)
+        out.write(`  ${line}\n`);
+    if (!prepared.ok) {
+        console.error(chalk.red(`\n  ${prepared.error}\n`));
+        process.exit(1);
+        return;
+    }
+    if ("planOnly" in prepared) {
+        process.exit(0);
+        return;
+    }
+    // The run's own input goes to the executor (--input was only checked against it).
+    const runOptions = { ...options, input: undefined };
+    await workflowRunAction(prepared.ctx.file, runOptions, prepared.ctx);
+});
+for (const [flags, description] of WORKFLOW_RESUME_OPTIONS)
+    workflowResumeCmd.option(flags, description);
+for (const [flags, description] of WORKFLOW_RUN_OPTIONS) {
+    if (RESUME_SHARED_RUN_FLAGS.includes(flags))
+        workflowResumeCmd.option(flags, description);
+}
+workflowResumeCmd.option("--no-history", "Do not update this run's record in .sweny/runs/");
 registerRunsCommand(program);
 workflowCmd
     .command("diagram <file>")

package/dist/cli/resume.d.ts

@@ -0,0 +1,56 @@
+/**
+ * `sweny workflow resume <run-id>` (#363): checks a run journal, prints the
+ * resume plan, refuses what is unsafe, and hands `workflowRunAction` the
+ * journal, the run id and the run's input.
+ *
+ * Lives outside main.ts so tests can import it (main.ts parses argv on import).
+ */
+import type { Logger, Workflow } from "../types.js";
+import { RunJournal, type ResumePlan } from "../journal.js";
+/** `sweny workflow resume` options (commander camelCases the flags). */
+export interface ResumeOptions {
+    force?: boolean;
+    allowRepeatWrites?: boolean;
+    /** Print the plan and exit without running anything. */
+    plan?: boolean;
+    /** Workflow file to load instead of the path the journal recorded. */
+    workflow?: string;
+    /** Same JSON as the original run's --input (needed when the journal redacted it). */
+    input?: string;
+}
+/** Resume-only flags; the rest are shared with `workflow run`. */
+export declare const WORKFLOW_RESUME_OPTIONS: ReadonlyArray<readonly [flags: string, description: string]>;
+/** Shared `workflow run` flags that make sense on resume (no --dry-run, --stage or --list-nodes: they change the run). */
+export declare const RESUME_SHARED_RUN_FLAGS: string[];
+export interface ResumeContext {
+    runId: string;
+    file: string;
+    input: Record<string, unknown>;
+    journal: RunJournal;
+    plan: ResumePlan;
+}
+export type PrepareResumeResult = {
+    ok: true;
+    ctx: ResumeContext;
+    lines: string[];
+} | {
+    ok: true;
+    planOnly: true;
+    lines: string[];
+} | {
+    ok: false;
+    error: string;
+    lines: string[];
+};
+export interface PrepareResumeDeps {
+    cwd?: string;
+    loadWorkflow: (file: string) => Workflow;
+    swenyVersion?: string;
+    env?: Record<string, string | undefined>;
+    logger?: Logger;
+}
+/** One line per planned visit, for humans. */
+export declare function formatResumePlan(plan: ResumePlan, mayRepeat: string[]): string[];
+export declare function prepareResume(ref: string, opts: ResumeOptions, deps: PrepareResumeDeps): PrepareResumeResult;
+/** Journal is on unless `--no-journal` (options.journal === false) or `.sweny.yml` has `journal: off`. */
+export declare function journalDisabled(optionJournal: unknown, configJournal: unknown): boolean;

package/dist/cli/resume.js

@@ -0,0 +1,182 @@
+/**
+ * `sweny workflow resume <run-id>` (#363): checks a run journal, prints the
+ * resume plan, refuses what is unsafe, and hands `workflowRunAction` the
+ * journal, the run id and the run's input.
+ *
+ * Lives outside main.ts so tests can import it (main.ts parses argv on import).
+ */
+import path from "node:path";
+import { validateRuntimeInput } from "../inputs.js";
+import { JOURNAL_DIR, JOURNAL_FILE, JournalLockedError, JournalVersionError, RunJournal, buildResumePlan, canonicalHash, findJournalRun, journalDir, mayRepeatWrites, readJournal, workflowHashOf, } from "../journal.js";
+import { parseInputFlag } from "./workflow-input.js";
+/** Resume-only flags; the rest are shared with `workflow run`. */
+export const WORKFLOW_RESUME_OPTIONS = [
+    ["--plan", "Print what would be replayed and re-run, then exit without running anything"],
+    [
+        "--force",
+        "Resume even though the workflow, its instruction files, the input, or the configured skills/agent changed (warns)",
+    ],
+    [
+        "--allow-repeat-writes",
+        "Re-run nodes that may repeat a write (not read-only, started before the crash), and re-send writes whose outcome cannot be confirmed on the provider",
+    ],
+    ["--workflow <file>", "Workflow file to load, when it moved since the run (its content must still match)"],
+];
+/** Shared `workflow run` flags that make sense on resume (no --dry-run, --stage or --list-nodes: they change the run). */
+export const RESUME_SHARED_RUN_FLAGS = [
+    "--timeout <ms>",
+    "--max-steps <n>",
+    "--json",
+    "--stream",
+    "--verbose",
+    "--mermaid",
+    "--comment-file <path>",
+    "--input <json>",
+    "--agent <id>",
+    "--harness-policy <mode>",
+];
+/** One line per planned visit, for humans. */
+export function formatResumePlan(plan, mayRepeat) {
+    const lines = [`Resume run ${plan.runId} (workflow ${plan.start.workflow_id}, attempt ${plan.attempts + 1})`];
+    const width = Math.max(4, ...plan.visits.map((v) => v.node.length), (plan.freshNode ?? "").length);
+    const label = (node, iteration) => (iteration > 1 ? `${node} (#${iteration})` : node).padEnd(width + 5);
+    for (const v of plan.visits) {
+        if (v.action === "replay") {
+            const writes = v.applied > 0 ? `, ${v.applied} write(s) not re-sent` : "";
+            lines.push(`  ✓ ${label(v.node, v.iteration)} replay from journal (${v.status}${writes})`);
+        }
+        else if (v.action === "write-stage") {
+            const parts = ["agent result reused"];
+            if (v.applied > 0)
+                parts.push(`${v.applied} write(s) already applied, not re-sent`);
+            if (v.unconfirmed > 0)
+                parts.push(`${v.unconfirmed} write(s) to confirm on the provider first`);
+            lines.push(`  ↻ ${label(v.node, v.iteration)} write stage only: ${parts.join("; ")}`);
+        }
+        else {
+            const risk = mayRepeat.includes(v.node) ? " (may repeat writes: the node is not read-only)" : "";
+            lines.push(`  ▶ ${label(v.node, v.iteration)} run again${risk}`);
+        }
+    }
+    if (plan.freshNode)
+        lines.push(`  ▶ ${label(plan.freshNode, 1)} run (not started before the crash)`);
+    const last = plan.visits[plan.visits.length - 1];
+    if (!plan.freshNode && last?.action === "replay" && last.next === undefined) {
+        lines.push(`  → route from ${last.node} is decided again (not journaled before the crash)`);
+    }
+    if (plan.finished)
+        lines.push("  every node finished; the resume only closes the run");
+    return lines;
+}
+export function prepareResume(ref, opts, deps) {
+    const cwd = deps.cwd ?? process.cwd();
+    const lines = [];
+    const fail = (error) => ({ ok: false, error, lines });
+    const runId = findJournalRun(ref, cwd);
+    if (!runId) {
+        return fail(`no run journal matches "${ref}" in ${JOURNAL_DIR}/. Runs started with --no-journal (or before journals existed) cannot be resumed.`);
+    }
+    const file = path.join(journalDir(cwd, runId), JOURNAL_FILE);
+    let read;
+    try {
+        // --plan stays read-only: a torn tail is reported, not cut.
+        read = readJournal(file, { repair: !opts.plan });
+    }
+    catch (err) {
+        if (err instanceof JournalVersionError)
+            return fail(err.message);
+        return fail(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (read.corruptAtLine !== undefined) {
+        return fail(`run journal ${file} is damaged at line ${read.corruptAtLine}, with valid records after it. ` +
+            `That is not a torn last write, so it cannot be repaired safely. Start a new run.`);
+    }
+    if (read.truncatedBytes > 0) {
+        lines.push(opts.plan
+            ? `note: the journal ends in a torn record (${read.truncatedBytes} bytes); resuming drops it`
+            : `note: dropped a torn record at the end of the journal (${read.truncatedBytes} bytes)`);
+    }
+    let plan;
+    try {
+        plan = buildResumePlan(read.records);
+    }
+    catch (err) {
+        return fail(err instanceof Error ? err.message : String(err));
+    }
+    if (plan.lastStatus === "success")
+        return fail(`run ${runId} already finished successfully; nothing to resume`);
+    const workflowFile = opts.workflow ?? plan.start.workflow_file;
+    if (!workflowFile)
+        return fail(`the journal does not record the workflow file; pass --workflow <file>`);
+    let workflow;
+    try {
+        workflow = deps.loadWorkflow(workflowFile);
+    }
+    catch (err) {
+        return fail(`cannot load workflow ${workflowFile}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (workflowHashOf(workflow) !== plan.start.workflow_hash) {
+        if (!opts.force) {
+            return fail(`workflow ${workflowFile} changed since run ${runId} started. Resuming would mix results from two ` +
+                `different workflows. Start a new run, or pass --force to resume anyway.`);
+        }
+        lines.push(`warning: --force: workflow ${workflowFile} changed since the run started`);
+    }
+    let input;
+    if (opts.input !== undefined) {
+        const parsed = parseInputFlag(opts.input);
+        if (!parsed.ok)
+            return fail(parsed.lines.join(" "));
+        const validated = validateRuntimeInput(workflow.inputs, parsed.value);
+        if (!validated.ok)
+            return fail(`--input: ${validated.errors.map((e) => `${e.field}: ${e.message}`).join("; ")}`);
+        input = validated.value;
+        if (canonicalHash(input) !== plan.start.input_hash) {
+            if (!opts.force)
+                return fail(`--input differs from the run's original input; pass the same JSON, or --force`);
+            lines.push("warning: --force: --input differs from the run's original input");
+        }
+    }
+    else if (plan.start.input_redacted) {
+        return fail(`the run's input held secrets, which the journal does not keep; pass the same --input again`);
+    }
+    else {
+        input = (plan.start.input ?? {});
+    }
+    const mayRepeat = mayRepeatWrites(plan, workflow, input);
+    lines.push(...formatResumePlan(plan, mayRepeat));
+    if (opts.plan)
+        return { ok: true, planOnly: true, lines };
+    if (mayRepeat.length > 0 && !opts.allowRepeatWrites) {
+        return fail(`node(s) ${mayRepeat.join(", ")} started before the crash and can write outside safe outputs ` +
+            `(write tools, shell, git push). Running again may repeat those writes. Check what they did, ` +
+            `then resume with --allow-repeat-writes.`);
+    }
+    let journal;
+    try {
+        journal = RunJournal.openForResume({
+            runId,
+            cwd,
+            workflowFile: path.resolve(cwd, workflowFile),
+            swenyVersion: deps.swenyVersion,
+            env: deps.env,
+            logger: deps.logger,
+            read,
+            plan,
+            force: opts.force === true,
+            allowRepeatWrites: opts.allowRepeatWrites === true,
+        });
+    }
+    catch (err) {
+        if (err instanceof JournalLockedError)
+            return fail(err.message);
+        return fail(`cannot open the run journal: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return { ok: true, ctx: { runId, file: path.resolve(cwd, workflowFile), input, journal, plan }, lines };
+}
+/** Journal is on unless `--no-journal` (options.journal === false) or `.sweny.yml` has `journal: off`. */
+export function journalDisabled(optionJournal, configJournal) {
+    if (optionJournal === false)
+        return true;
+    return typeof configJournal === "string" && ["off", "false", "no", "0"].includes(configJournal.trim().toLowerCase());
+}

package/dist/executor.d.ts

@@ -18,6 +18,7 @@ import type { AgentHarness } from "./harness/types.js";
 import type { DeciderMode } from "./decider.js";
 import type { Budget } from "./budget.js";
 import { type ActorInfo } from "./safe-outputs.js";
+import type { ExecutionJournal } from "./journal.js";
 export interface ExecuteOptions {
     /** Registered skills (id → Skill) */
     skills: Map<string, Skill>;
@@ -88,6 +89,12 @@ export interface ExecuteOptions {
      * association in the `GITHUB_EVENT_PATH` payload.
      */
     actor?: ActorInfo;
+    /**
+     * Run journal (#363): an append-only record of the run for `sweny workflow
+     * resume`. In resume mode it also replays the visits an earlier attempt
+     * finished, so their agents are not called again. Default: none.
+     */
+    journal?: ExecutionJournal;
     /**
      * Run-wide spend ceiling (#449), tightening `workflow.budget` (the lowest of
      * the two wins per unit). CLI: `--max-tokens`, `--max-cost`. Default: none.

package/dist/executor.js

@@ -21,7 +21,7 @@ import { buildRetryPreamble } from "./retry.js";
 import { resolveExecutionModel } from "./model.js";
 import { buildToolAliases } from "./skills/index.js";
 import { validateWorkflow } from "./schema.js";
-import { resolveAgentAccess } from "./agent-env.js";
+import { grantedAgentEnv, resolveAgentAccess } from "./agent-env.js";
 import { fenceUntrusted } from "./untrusted.js";
 import { asClaude } from "./harness/compat.js";
 import { budgetGate, isToolClass, policyGate, resolveHarnessPolicy } from "./harness/policy.js";
@@ -54,7 +54,7 @@ function throwIfAborted(signal) {
  * - `trace`: full ordered execution trace including loops and routing decisions
  */
 export async function execute(workflow, input, options) {
-    const { observer, signal, timeoutMs } = options;
+    const { observer, signal, timeoutMs, journal } = options;
     // `harness` is the seam; a legacy `claude` object is used as-is (what `asClaude(claudeCompat(claude))` yields).
     const claude = options.harness ? asClaude(options.harness) : options.claude;
     if (!claude) {
@@ -138,6 +138,15 @@ export async function execute(workflow, input, options) {
         logger,
     });
     trace.sources = resolvedSources;
+    journal?.begin({
+        workflow,
+        input,
+        sources: resolvedSources,
+        skills,
+        config,
+        writeState,
+        harnessId: options.harness?.id,
+    });
     safeObserve(observer, { type: "workflow:start", workflow: workflow.id }, logger);
     safeObserve(observer, { type: "sources:resolved", sources: resolvedSources }, logger);
     let currentId = workflow.entry;
@@ -164,6 +173,34 @@ export async function execute(workflow, input, options) {
         const resolvedInstruction = resolvedSources[`nodes.${currentId}.instruction`].content;
         safeObserve(observer, { type: "node:enter", node: currentId, instruction: resolvedInstruction }, logger);
         logger.info(`→ ${node.name}`, { node: currentId });
+        // Resume (#363): a visit an earlier attempt finished is replayed from the journal, not re-run.
+        const replay = journal?.replay(currentId, iteration);
+        if (replay?.kind === "complete") {
+            results.set(currentId, replay.result);
+            trace.steps.push({ node: currentId, status: replay.result.status, iteration });
+            safeObserve(observer, { type: "node:exit", node: currentId, result: replay.result }, logger);
+            logger.info(`  replayed from the run journal: ${replay.result.status}`, { node: currentId });
+            const from = currentId;
+            if (replay.next === undefined) {
+                currentId = await advanceFromNode(workflow, from, results, input, claude, observer, edgeCounts, logger, trace, {
+                    signal,
+                    timeoutMs,
+                });
+                journal?.route(from, currentId);
+            }
+            else {
+                if (replay.next !== null) {
+                    const key = `${from}→${replay.next}`;
+                    edgeCounts.set(key, (edgeCounts.get(key) ?? 0) + 1);
+                    const reason = whenLabel(workflow.edges.find((e) => e.from === from && e.to === replay.next)?.when) ?? "only path";
+                    trace.edges.push({ from, to: replay.next, reason });
+                }
+                safeObserve(observer, { type: "route", from, to: replay.next ?? "(end)", reason: "replayed" }, logger);
+                currentId = replay.next;
+            }
+            continue;
+        }
+        journal?.nodeStart(currentId, iteration);
         // Gather tools from the node's skills, then apply the node's optional
         // skill-tool filter (`tools.allow` / `tools.deny`). Filtered tools are
         // never registered for the run, so the model cannot see or call them.
@@ -199,7 +236,7 @@ export async function execute(workflow, input, options) {
             }
         }
         const skillInstructions = resolveSkillInstructions(node.skills, skills);
-        const skillMcpServers = resolveSkillMcpServers(node.skills, skills);
+        const skillMcpServers = resolveSkillMcpServers(node.skills, skills, config);
         // Runtime guard: if this node declares skills but none resolved, the node
         // cannot do its job (e.g. "create a Linear issue" with no linear skill).
         // The startup validate() warns about this possibility, but only throw when
@@ -247,6 +284,7 @@ export async function execute(workflow, input, options) {
                     toolCalls: [],
                 };
             results.set(currentId, result);
+            journal?.nodeEnd(currentId, iteration, result, writeState);
             trace.steps.push({ node: currentId, status: result.status, iteration });
             safeObserve(observer, { type: "node:exit", node: currentId, result }, logger);
             logger.warn(`  requires ${onFail === "skip" ? "skipped" : "failed"}: ${requiresError}`, { node: currentId });
@@ -260,6 +298,7 @@ export async function execute(workflow, input, options) {
             // Apply normal routing rules (dry run gate + resolveNext).
             // TODO: dedupe with requires path — see advanceFromNode helper below
             const next = await advanceFromNode(workflow, currentId, results, input, claude, observer, edgeCounts, logger, trace, { signal, timeoutMs, shadow });
+            journal?.route(currentId, next);
             currentId = next;
             continue;
         }
@@ -302,8 +341,13 @@ export async function execute(workflow, input, options) {
         let degradedLogged = false;
         // #442: a staged or dry run cannot push. The harness blocks git push and
         // withholds write tokens in this node's agent env (see withPushBlocked).
+        // Skill credentials stay in sweny: the agent gets only what the node grants
+        // with `agent_env`, never on a read-only node or in a staged run.
+        const granted = grantedAgentEnv(node.agent_env, { readOnly: readOnlyNode, staged: stageOutputs });
+        if (granted.dropped)
+            logger.warn(`  ${granted.dropped}`, { node: currentId });
         const agentAccess = {
-            ...resolveAgentAccess(node.skills, skills),
+            ...resolveAgentAccess(node.skills, skills, granted.grant),
             ...(stageOutputs ? { noPush: true } : {}),
         };
         // #365: a node or workflow that declares `permissions` or `outputs` gets
@@ -335,6 +379,13 @@ export async function execute(workflow, input, options) {
         let budgetStop;
         let previous;
         while (true) {
+            if (replay?.kind === "checkpoint") {
+                // Resume (#363): the agent finished this visit before the crash. Reuse its result and
+                // write intents; the write stage below skips what the journal shows was already applied.
+                ({ result, agentRunFailed, attempt } = replay);
+                intents.push(...replay.intents);
+                break;
+            }
             const refusal = gate?.refuse ?? budgetCheck?.refuse;
             if (refusal) {
                 // Not an agent failure: fail_soft never softens a policy refusal.
@@ -536,13 +587,14 @@ export async function execute(workflow, input, options) {
         // may veto, and only then does sweny call the skill's own write handler.
         if (outputDecls.length > 0) {
             if (result.status === "success" && !agentRunFailed) {
+                journal?.checkpoint(currentId, iteration, { result, intents, agentRunFailed, attempt });
                 const stage = await applySafeOutputs({
                     nodeId: currentId,
                     declarations: outputDecls,
                     intents,
                     policy: workflow.safe_outputs,
                     nodeSkills: node.skills,
-                    skills,
+                    skills: journal ? journal.wrapWrites(currentId, iteration, skills) : skills,
                     config,
                     env: runEnv,
                     actor,
@@ -574,6 +626,7 @@ export async function execute(workflow, input, options) {
         if (skippedWrites.length > 0)
             result = { ...result, skippedWrites };
         results.set(currentId, result);
+        journal?.nodeEnd(currentId, iteration, result, writeState);
         trace.steps.push(attempt > 0
             ? { node: currentId, status: result.status, iteration, retryAttempt: attempt }
             : { node: currentId, status: result.status, iteration });
@@ -593,11 +646,13 @@ export async function execute(workflow, input, options) {
             break;
         }
         // Dry run gate + routing — shared with requires path via advanceFromNode helper.
+        const routedFrom = currentId;
         currentId = await advanceFromNode(workflow, currentId, results, input, claude, observer, edgeCounts, logger, trace, {
             signal,
             timeoutMs,
             shadow,
         });
+        journal?.route(routedFrom, currentId);
     }
     safeObserve(observer, {
         type: "workflow:end",
@@ -1005,12 +1060,33 @@ function dryRunNotice(skippedWrites) {
         `Do not create, modify, post, or send anything. Do the analysis, and where this step would ` +
         `normally write, describe exactly what it would have written instead.`);
 }
-/** Only this node's resolved skills contribute external servers. */
-function resolveSkillMcpServers(skillIds, skills) {
-    return Object.fromEntries(skillIds.flatMap((id) => {
-        const mcp = skills.get(id)?.mcp;
-        return mcp ? [[id, { ...mcp, type: mcp.type ?? (mcp.command ? "stdio" : "http") }]] : [];
-    }));
+/**
+ * Only this node's resolved skills contribute external servers. A stdio
+ * server gets its skill's declared credentials in its own `env` (explicit
+ * server env wins): the agent env no longer carries them, so the server must
+ * not rely on inheriting them from the agent process.
+ */
+function resolveSkillMcpServers(skillIds, skills, config = {}) {
+    const servers = {};
+    for (const id of skillIds) {
+        const skill = skills.get(id);
+        const mcp = skill?.mcp;
+        if (!skill || !mcp)
+            continue;
+        const type = mcp.type ?? (mcp.command ? "stdio" : "http");
+        if (type !== "stdio") {
+            servers[id] = { ...mcp, type };
+            continue;
+        }
+        const declared = {};
+        for (const [key, field] of Object.entries(skill.config ?? {})) {
+            if (field.env && config[key] !== undefined)
+                declared[field.env] = config[key];
+        }
+        const env = { ...declared, ...(mcp.env ?? {}) };
+        servers[id] = { ...mcp, type, ...(Object.keys(env).length > 0 ? { env } : {}) };
+    }
+    return servers;
 }
 function resolveTools(skillIds, skills) {
     return skillIds

package/dist/harness/acp.d.ts

@@ -162,7 +162,12 @@ export declare class AcpHarness implements AgentHarness {
         ok: false;
         reason: string;
     }>;
-    /** Env for the agent process: scoped like Claude Code's, with only the auth vars the operator named. */
+    /**
+     * Env for the agent process: scoped like Claude Code's, with only the auth
+     * vars the operator named. Skill credentials are dropped either way
+     * ({@link finishAgentEnv}) unless the node granted them with `agent_env`; an
+     * operator-named auth var stays, and the gate counts it if it is a write token.
+     */
     private buildEnv;
     /** The node policy, with the harness policy mode and the watchdog budget applied. */
     private compilePolicy;