@sweny-ai/core 0.1.164 → 0.1.166

package/dist/schema.js

@@ -9,6 +9,7 @@
 import { z } from "zod";
 import { AUTHOR_ASSOCIATIONS, CONTEXT_MODES, EVALUATOR_KINDS, EVAL_POLICIES, MCP_TRANSPORTS, NODE_ACCESS, NODE_ON_FAIL, REQUIRES_ON_FAIL, SAFE_OUTPUT_APPLIERS, SAFE_OUTPUT_EXPIRES_PATTERN, SAFE_OUTPUT_MAX_CEILING, SAFE_OUTPUT_STATES, SAFE_OUTPUT_TYPES, SKILL_CATEGORIES, SKILL_ID_MAX_LENGTH, SKILL_ID_PATTERN, TOOL_ACCESS, TOOL_CLASSES, WORKFLOW_TYPES, } from "./types.js";
 import { sourceZ } from "./sources.js";
+import { resolveNodePermissions } from "./node-policy.js";
 import { workflowInputsZ, WORKFLOW_INPUT_TYPES } from "./inputs.js";
 import { checkExpression, isWhenExpression, WHEN_EXPR_MAX_LENGTH } from "./when.js";
 // Studio and other schema-only consumers label edges without importing the root entry.
@@ -326,6 +327,8 @@ export const safeOutputsPolicyZ = z
     screen: z.boolean().optional(),
 })
     .strict();
+/** An environment variable name (`agent_env` entries). */
+export const ENV_VAR_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
 export const nodeZ = z
     .object({
     name: z.string().min(1),
@@ -335,6 +338,7 @@ export const nodeZ = z
     max_turns: z.number().int().min(1).optional(),
     budget: budgetZ.optional(),
     disallowed_tools: z.array(z.string().min(1)).optional(),
+    agent_env: z.array(z.string().regex(ENV_VAR_NAME_PATTERN)).min(1).optional(),
     tools: nodeToolsZ.optional(),
     fail_soft: z.boolean().optional(),
     on_fail: z.enum(NODE_ON_FAIL).optional(),
@@ -719,6 +723,17 @@ export function validateWorkflow(workflow, knownSkills) {
                 nodeId,
             });
         }
+        // A read-only node's agent never holds a credential: a filesystem mount
+        // does not stop an API write (security review 2026-09-30).
+        if ((node.agent_env?.length ?? 0) > 0 && resolveNodePermissions(node, workflow).access === "read") {
+            errors.push({
+                code: "AGENT_ENV_READ_ONLY",
+                message: `Node "${nodeId}" grants agent_env [${node.agent_env.join(", ")}] but its permissions are read. ` +
+                    `A read-only node's agent never holds a credential; its skill tools already have them. ` +
+                    `Remove agent_env, or make the node permissions: write.`,
+                nodeId,
+            });
+        }
         // Budgets (#449): the workflow's `budget` is the ceiling for every node.
         const wfBudget = workflow.budget;
         const nodeBudget = node.budget;
@@ -1286,6 +1301,12 @@ export const workflowJsonSchema = {
                         items: { type: "string", minLength: 1 },
                         description: "Built-in tool names the agent cannot use at this node, in the harness's own names (Claude Code: ['Bash']). Passed through to the harness: Claude Code removes them from the model context; Codex maps known names to tool classes and reports what it cannot deny as degraded. For portable workflows prefer tool classes in tools.deny.",
                     },
+                    agent_env: {
+                        type: "array",
+                        items: { type: "string", pattern: ENV_VAR_NAME_PATTERN.source },
+                        minItems: 1,
+                        description: "Secrets this node's agent process gets in its env. Skill tools run in sweny, so by default the agent never holds a skill credential (GITHUB_TOKEN, LINEAR_API_KEY, ...). Name one here only when the agent's own shell needs it: the agent can use it outside sweny's opinions (any API call, any push). Not allowed on a permissions: read node; withheld in a staged or dry run.",
+                    },
                     tools: {
                         type: "object",
                         description: "Per-node filter over skill-provided tools. 'allow' keeps only the listed skill tools; 'deny' removes the listed skill tools (applied after 'allow'). Filtered tools are never registered for the node's run. Absent field = all skill tools exposed. A 'deny' entry that names a portable tool class (shell, write, edit, net, subagent) also denies that class of built-in agent tools on every harness.",

package/dist/types.d.ts

@@ -331,6 +331,15 @@ export interface Node {
      * `git push`. Names follow the SDK's tool naming (e.g. `Bash`, `Write`).
      */
     disallowed_tools?: string[];
+    /**
+     * Secrets this node's agent process receives in its env. Skill tools run
+     * in the sweny process, so by default the agent never holds a skill
+     * credential (`GITHUB_TOKEN`, `LINEAR_API_KEY`, ...) on any harness. Name a
+     * variable here only when the agent's own shell needs it: the agent can use
+     * it outside sweny's opinions (any API call, any push). Refused on a
+     * `permissions: read` node; withheld in a staged or dry run.
+     */
+    agent_env?: string[];
     /**
      * Per-node filter over skill-provided tools. Complements
      * `disallowed_tools` (which covers built-in agent tools only): this field
@@ -816,13 +825,16 @@ export interface Claude {
         /** Caller-supplied abort signal. Aborting it interrupts the query. */
         signal?: AbortSignal;
         /**
-         * What this node's agent may see (#360): env var names declared by the
-         * node's skills (added to the scoped subprocess env) and the provider
-         * hosts its sandboxed commands may reach. Absent = allowlist only.
+         * What this node's agent may see (#360): `envVars` are the names the node
+         * granted with `agent_env` (the only skill credentials that reach the
+         * agent), `withhold` the run's skill credential names (never passed
+         * otherwise), and `domains` the provider hosts its sandboxed commands may
+         * reach. Absent = allowlist only, known credentials withheld.
          */
         agentAccess?: {
             envVars: string[];
             domains: string[];
+            withhold?: string[];
         };
         /**
          * Dry-run: the node must not change anything. `tools` is already filtered

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.164",
+  "version": "0.1.166",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"