@sweny-ai/core 0.1.165 → 0.1.167

package/dist/cli/try.d.ts

@@ -0,0 +1,89 @@
+/**
+ * `sweny try`: a zero-credential demo (#475).
+ *
+ * Replays a recorded explain-repo run through the REAL executor, with a replay
+ * harness standing in for the agent, so the real progress line, answer block
+ * (#460), receipt, policy segment and PR-comment markdown (#396) are what a
+ * user sees. No agent, no model, no network, no env credentials, no files
+ * written (no `.sweny/runs`, no journal). The environment handed to the
+ * executor is empty by construction.
+ *
+ * The recording lives in `try-fixture.json` (metadata plus the sample answer
+ * only). Until a real run is recorded it is labelled illustrative.
+ */
+import type { Command } from "commander";
+import type { AgentHarness } from "../harness/types.js";
+import type { Workflow } from "../types.js";
+export interface TryFixtureNode {
+    /** Recorded wall-clock time of the node. */
+    duration_ms: number;
+    /** Tool name to number of calls. Counts only: no inputs or outputs are recorded. */
+    tool_calls: Record<string, number>;
+    usage?: {
+        inputTokens?: number;
+        outputTokens?: number;
+        costUsd?: number;
+        numTurns?: number;
+    };
+    /** The node's declared output fields (the sample answer). */
+    output?: Record<string, unknown>;
+}
+export interface TryFixture {
+    schema_version: 1;
+    /** True until the owner replaces the file with a recording of a real run. */
+    illustrative: boolean;
+    notice: string;
+    /** Built-in template id the recording is of. */
+    workflow: string;
+    sample_repo: string;
+    harness: {
+        id: string;
+        version: string;
+    };
+    policy?: {
+        envScope: boolean;
+        sandbox: "off" | "auto" | "strict";
+        sandboxStarted: boolean;
+    };
+    /** Node id to recording, in execution order. */
+    nodes: Record<string, TryFixtureNode>;
+}
+/** Shape check with a message naming the first bad field. Throws on a malformed fixture. */
+export declare function parseTryFixture(raw: unknown): TryFixture;
+/** The shipped fixture: `try-fixture.json` next to this module (src/cli or dist/cli). */
+export declare function loadTryFixture(file?: string): TryFixture;
+/** The real explain-repo template, parsed and validated like any workflow file. */
+export declare function loadTryWorkflow(templateId: string): Workflow;
+/**
+ * An AgentHarness that plays the recording back: node N of the run gets
+ * recording N. It never spawns a process, reads env, or touches the network.
+ * `paceMs` is how long each node takes to replay (0 = instant); tool calls are
+ * reported through `onProgress` spread across that time so progress feels live.
+ */
+export declare function createReplayHarness(fixture: TryFixture, opts: {
+    paceMs: number;
+}): AgentHarness;
+export declare const TRY_BANNER_TITLE = "Recorded demo";
+/** The real commands, same as the README quickstart. */
+export declare const TRY_NEXT_COMMANDS: readonly ["npm install -g @sweny-ai/core", "sweny new --template explain-repo --yes", "sweny workflow run .sweny/workflows/explain-repo.yml"];
+/** Appended to `sweny try --help`. */
+export declare const TRY_HELP_NOTE: string;
+export declare function formatTryBanner(fixture: TryFixture): string;
+export declare function formatTryNext(): string;
+export interface TryOptions {
+    /** Replay instantly. */
+    fast?: boolean;
+    /** Milliseconds each node takes to replay. Default 1200. Ignored with `fast`. */
+    paceMs?: number;
+    /** Also write the PR-comment markdown here. */
+    commentFile?: string;
+    /** Output sink. Default stdout. */
+    write?: (s: string) => void;
+    /** Rewrite progress lines in place. Default: stdout is a TTY. */
+    tty?: boolean;
+    fixture?: TryFixture;
+}
+export declare const DEFAULT_TRY_PACE_MS = 1200;
+/** Replay the recording. Returns the process exit code. */
+export declare function runTry(opts?: TryOptions): Promise<number>;
+export declare function registerTryCommand(program: Command): Command;

package/dist/cli/try.js

@@ -0,0 +1,284 @@
+/**
+ * `sweny try`: a zero-credential demo (#475).
+ *
+ * Replays a recorded explain-repo run through the REAL executor, with a replay
+ * harness standing in for the agent, so the real progress line, answer block
+ * (#460), receipt, policy segment and PR-comment markdown (#396) are what a
+ * user sees. No agent, no model, no network, no env credentials, no files
+ * written (no `.sweny/runs`, no journal). The environment handed to the
+ * executor is empty by construction.
+ *
+ * The recording lives in `try-fixture.json` (metadata plus the sample answer
+ * only). Until a real run is recorded it is labelled illustrative.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import chalk from "chalk";
+import { parse as parseYaml } from "yaml";
+import { execute } from "../executor.js";
+import { validateParsed } from "../loader.js";
+import { WORKFLOW_TEMPLATES } from "./templates.js";
+import { formatFinalOutput, resolveFinalOutput } from "./final-output.js";
+import { formatRunComment } from "./comment-output.js";
+import { formatReceiptDuration, renderReceiptLine, summarizeRun } from "./run-output.js";
+import { c } from "./output.js";
+const isObj = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+/** Shape check with a message naming the first bad field. Throws on a malformed fixture. */
+export function parseTryFixture(raw) {
+    const bad = (what) => {
+        throw new Error(`try-fixture.json: ${what}`);
+    };
+    if (!isObj(raw))
+        return bad("expected an object");
+    if (raw.schema_version !== 1)
+        bad("schema_version must be 1");
+    for (const key of ["notice", "workflow", "sample_repo"]) {
+        if (typeof raw[key] !== "string" || raw[key] === "")
+            bad(`${key} must be a non-empty string`);
+    }
+    if (typeof raw.illustrative !== "boolean")
+        bad("illustrative must be a boolean");
+    if (!isObj(raw.harness) || typeof raw.harness.id !== "string" || typeof raw.harness.version !== "string") {
+        bad("harness must be { id, version }");
+    }
+    if (!isObj(raw.nodes) || Object.keys(raw.nodes).length === 0)
+        return bad("nodes must be a non-empty object");
+    for (const [id, n] of Object.entries(raw.nodes)) {
+        if (!isObj(n) || typeof n.duration_ms !== "number" || !isObj(n.tool_calls)) {
+            bad(`nodes.${id} needs duration_ms and tool_calls`);
+        }
+        for (const [tool, count] of Object.entries(n.tool_calls)) {
+            if (!Number.isInteger(count) || count < 0)
+                bad(`nodes.${id}.tool_calls.${tool} must be a count`);
+        }
+    }
+    return raw;
+}
+/** The shipped fixture: `try-fixture.json` next to this module (src/cli or dist/cli). */
+export function loadTryFixture(file) {
+    const p = file ?? fileURLToPath(new URL("./try-fixture.json", import.meta.url));
+    return parseTryFixture(JSON.parse(fs.readFileSync(p, "utf-8")));
+}
+/** The real explain-repo template, parsed and validated like any workflow file. */
+export function loadTryWorkflow(templateId) {
+    const tpl = WORKFLOW_TEMPLATES.find((t) => t.id === templateId);
+    if (!tpl)
+        throw new Error(`try-fixture.json: unknown template "${templateId}"`);
+    const loaded = validateParsed(parseYaml(tpl.yaml));
+    if (!loaded.ok)
+        throw new Error(`template ${templateId} is invalid: ${loaded.errors.map((e) => e.message).join("; ")}`);
+    return loaded.workflow;
+}
+// ── Replay harness ──────────────────────────────────────────────
+const REPLAY_CAPABILITIES = {
+    structuredOutput: "prompt",
+    toolTrace: "skill-only",
+    builtinDeny: "none",
+    mcp: { inject: false, exclusive: "none" },
+    sandbox: { fs: false, network: false },
+    readOnly: "none",
+    turnLimit: "none",
+    usage: { tokens: true, costUsd: true, live: false },
+    cancel: "signal",
+    resume: false,
+};
+function sleep(ms, signal) {
+    if (ms <= 0)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        const t = setTimeout(resolve, ms);
+        signal?.addEventListener("abort", () => {
+            clearTimeout(t);
+            resolve();
+        }, { once: true });
+    });
+}
+/**
+ * An AgentHarness that plays the recording back: node N of the run gets
+ * recording N. It never spawns a process, reads env, or touches the network.
+ * `paceMs` is how long each node takes to replay (0 = instant); tool calls are
+ * reported through `onProgress` spread across that time so progress feels live.
+ */
+export function createReplayHarness(fixture, opts) {
+    const order = Object.keys(fixture.nodes);
+    let next = 0;
+    return {
+        id: "mock",
+        capabilities: REPLAY_CAPABILITIES,
+        async preflight() {
+            return { ok: true, version: "replay" };
+        },
+        // Routing and judging never run in a linear recorded workflow; fail closed if asked.
+        async complete() {
+            return null;
+        },
+        async run(req) {
+            const id = order[next++];
+            const rec = id ? fixture.nodes[id] : undefined;
+            const harness = { id: fixture.harness.id, version: fixture.harness.version };
+            if (!rec) {
+                return {
+                    status: "failed",
+                    data: { error: "recording has no more nodes" },
+                    toolCalls: [],
+                    harness,
+                    degraded: [],
+                };
+            }
+            const toolCalls = [];
+            for (const [tool, count] of Object.entries(rec.tool_calls)) {
+                for (let i = 0; i < count; i++)
+                    toolCalls.push({ tool, input: {} });
+            }
+            const step = toolCalls.length > 0 ? opts.paceMs / toolCalls.length : opts.paceMs;
+            for (const tc of toolCalls) {
+                await sleep(step, req.signal);
+                req.onProgress?.(tc.tool);
+            }
+            if (toolCalls.length === 0)
+                await sleep(step, req.signal);
+            return {
+                status: "success",
+                data: { ...(rec.output ?? {}) },
+                toolCalls,
+                ...(rec.usage ? { usage: rec.usage } : {}),
+                ...(fixture.policy ? { policy: fixture.policy } : {}),
+                harness,
+                degraded: [],
+            };
+        },
+    };
+}
+// ── Output ──────────────────────────────────────────────────────
+export const TRY_BANNER_TITLE = "Recorded demo";
+/** The real commands, same as the README quickstart. */
+export const TRY_NEXT_COMMANDS = [
+    "npm install -g @sweny-ai/core",
+    "sweny new --template explain-repo --yes",
+    "sweny workflow run .sweny/workflows/explain-repo.yml",
+];
+/** Appended to `sweny try --help`. */
+export const TRY_HELP_NOTE = "The recording is ILLUSTRATIVE SAMPLE DATA (a fictional repo, hand-written timings and token counts), not output from a real run. " +
+    "Nothing runs: no agent, no network, no credentials read, no files written.";
+export function formatTryBanner(fixture) {
+    const lines = [
+        `${c.brand("▲")} ${chalk.bold("sweny try")}  ${chalk.bold.yellow(TRY_BANNER_TITLE)}, not a live run`,
+        chalk.dim(`  A replay of an ${fixture.workflow} run on a sample repo (${fixture.sample_repo}).`),
+        chalk.dim(fixture.illustrative
+            ? "  The sample data is illustrative, not output from your code. No agent, no network, no credentials."
+            : "  No agent, no network, no credentials."),
+    ];
+    return lines.map((l, i) => (i === 0 ? `  ${l}` : l)).join("\n");
+}
+export function formatTryNext() {
+    return [
+        `  ${chalk.bold("Run it for real")} on your own repo:`,
+        "",
+        ...TRY_NEXT_COMMANDS.map((cmd) => `    ${cmd}`),
+        "",
+        chalk.dim("  Needs a Claude login (`claude` signed in) or ANTHROPIC_API_KEY. Your run ends with the same receipt."),
+    ].join("\n");
+}
+export const DEFAULT_TRY_PACE_MS = 1200;
+const silentLogger = { info() { }, warn() { }, error() { }, debug() { } };
+/** Replay the recording. Returns the process exit code. */
+export async function runTry(opts = {}) {
+    const write = opts.write ?? ((s) => void process.stdout.write(s));
+    const tty = opts.tty ?? Boolean(process.stdout.isTTY);
+    const paceMs = opts.fast ? 0 : Math.max(0, opts.paceMs ?? DEFAULT_TRY_PACE_MS);
+    const fixture = opts.fixture ?? loadTryFixture();
+    const workflow = loadTryWorkflow(fixture.workflow);
+    for (const id of Object.keys(fixture.nodes)) {
+        if (!workflow.nodes[id])
+            throw new Error(`try-fixture.json: node "${id}" is not in ${fixture.workflow}`);
+    }
+    write(`\n${formatTryBanner(fixture)}\n\n`);
+    const ticks = new Map();
+    const observer = (event) => {
+        switch (event.type) {
+            case "workflow:start":
+                write(`  ${c.brand("▲")} ${chalk.bold(event.workflow)}\n\n`);
+                break;
+            case "node:enter":
+                ticks.set(event.node, 0);
+                if (tty)
+                    write(`  ${c.subtle("○")} ${chalk.dim(event.node)}…`);
+                break;
+            case "node:progress": {
+                const n = (ticks.get(event.node) ?? 0) + 1;
+                ticks.set(event.node, n);
+                if (tty) {
+                    write(`\r\x1B[2K  ${c.subtle("○")} ${chalk.dim(event.node)}… ${chalk.dim(`${n} tool ${n === 1 ? "call" : "calls"}`)}`);
+                }
+                break;
+            }
+            case "node:exit": {
+                const rec = fixture.nodes[event.node];
+                const ok = event.result.status === "success";
+                const icon = ok ? c.ok("✓") : c.fail("✗");
+                const calls = event.result.toolCalls.length;
+                const detail = [formatReceiptDuration(rec?.duration_ms ?? 0), ...(calls > 0 ? [`${calls} tool calls`] : [])];
+                write(`${tty ? "\r\x1B[2K" : ""}  ${icon} ${event.node}  ${chalk.dim(detail.join(" · "))}\n`);
+                break;
+            }
+        }
+    };
+    const { results, trace } = await execute(workflow, {}, {
+        skills: new Map(),
+        harness: createReplayHarness(fixture, { paceMs }),
+        observer,
+        logger: silentLogger,
+        // Nothing for the executor to read: no credentials, no PATH, no config.
+        env: {},
+        offline: true,
+        harnessPolicy: "warn",
+    });
+    write("\n");
+    // The recording's timings, not the replay's wall clock.
+    const durationsMs = Object.fromEntries(Object.entries(fixture.nodes).map(([id, n]) => [id, n.duration_ms]));
+    const totalMs = Object.values(durationsMs).reduce((a, b) => a + b, 0);
+    const receipt = summarizeRun(results, totalMs, false, trace);
+    const answer = resolveFinalOutput(workflow, results);
+    if (answer)
+        write(`${formatFinalOutput(answer)}\n\n`);
+    write(`  ${renderReceiptLine(receipt, tty)}\n\n`);
+    const comment = formatRunComment(workflow, results, receipt, { trace, durationsMs });
+    write(`  ${chalk.dim("What CI posts on a pull request (sweny workflow run --comment-file):")}\n\n`);
+    write(`${comment
+        .split("\n")
+        .map((l) => (l === "" ? l : `    ${l}`))
+        .join("\n")}\n`);
+    if (opts.commentFile) {
+        try {
+            fs.mkdirSync(path.dirname(path.resolve(opts.commentFile)), { recursive: true });
+            fs.writeFileSync(opts.commentFile, comment);
+        }
+        catch (err) {
+            process.stderr.write(`  ⚠ could not write comment file: ${err instanceof Error ? err.message : err}\n`);
+        }
+    }
+    write(`${formatTryNext()}\n\n`);
+    return receipt.ok ? 0 : 1;
+}
+export function registerTryCommand(program) {
+    return program
+        .command("try")
+        .description("Replay a recorded demo run: no credentials, no network, no model calls (illustrative sample data)")
+        .option("--fast", "Replay instantly instead of pacing the progress")
+        .option("--pace <ms>", `Milliseconds each node takes to replay (default ${DEFAULT_TRY_PACE_MS})`)
+        .option("--comment-file <path>", "Also write the PR-comment markdown to <path>")
+        .addHelpText("after", `\n${TRY_HELP_NOTE}\n`)
+        .action(async (options) => {
+        let paceMs;
+        if (options.pace !== undefined) {
+            paceMs = Number(options.pace);
+            if (!Number.isFinite(paceMs) || paceMs < 0) {
+                console.error(chalk.red(`\n  --pace must be a non-negative number of milliseconds, got "${options.pace}"\n`));
+                process.exitCode = 1;
+                return;
+            }
+        }
+        process.exitCode = await runTry({ fast: options.fast, paceMs, commentFile: options.commentFile });
+    });
+}

package/dist/cli/version-check.js

@@ -38,6 +38,9 @@ export function shouldSkip(env, isTty, commandName) {
         return true;
     if (commandName === "upgrade" || commandName === "update")
         return true;
+    // `sweny try` makes no network calls, the version check included.
+    if (commandName === "try")
+        return true;
     return false;
 }
 export function readCache(cachePath) {

package/dist/executor.js

@@ -21,7 +21,7 @@ import { buildRetryPreamble } from "./retry.js";
 import { resolveExecutionModel } from "./model.js";
 import { buildToolAliases } from "./skills/index.js";
 import { validateWorkflow } from "./schema.js";
-import { resolveAgentAccess } from "./agent-env.js";
+import { grantedAgentEnv, resolveAgentAccess } from "./agent-env.js";
 import { fenceUntrusted } from "./untrusted.js";
 import { asClaude } from "./harness/compat.js";
 import { budgetGate, isToolClass, policyGate, resolveHarnessPolicy } from "./harness/policy.js";
@@ -236,7 +236,7 @@ export async function execute(workflow, input, options) {
             }
         }
         const skillInstructions = resolveSkillInstructions(node.skills, skills);
-        const skillMcpServers = resolveSkillMcpServers(node.skills, skills);
+        const skillMcpServers = resolveSkillMcpServers(node.skills, skills, config);
         // Runtime guard: if this node declares skills but none resolved, the node
         // cannot do its job (e.g. "create a Linear issue" with no linear skill).
         // The startup validate() warns about this possibility, but only throw when
@@ -341,8 +341,13 @@ export async function execute(workflow, input, options) {
         let degradedLogged = false;
         // #442: a staged or dry run cannot push. The harness blocks git push and
         // withholds write tokens in this node's agent env (see withPushBlocked).
+        // Skill credentials stay in sweny: the agent gets only what the node grants
+        // with `agent_env`, never on a read-only node or in a staged run.
+        const granted = grantedAgentEnv(node.agent_env, { readOnly: readOnlyNode, staged: stageOutputs });
+        if (granted.dropped)
+            logger.warn(`  ${granted.dropped}`, { node: currentId });
         const agentAccess = {
-            ...resolveAgentAccess(node.skills, skills),
+            ...resolveAgentAccess(node.skills, skills, granted.grant),
             ...(stageOutputs ? { noPush: true } : {}),
         };
         // #365: a node or workflow that declares `permissions` or `outputs` gets
@@ -1055,12 +1060,33 @@ function dryRunNotice(skippedWrites) {
         `Do not create, modify, post, or send anything. Do the analysis, and where this step would ` +
         `normally write, describe exactly what it would have written instead.`);
 }
-/** Only this node's resolved skills contribute external servers. */
-function resolveSkillMcpServers(skillIds, skills) {
-    return Object.fromEntries(skillIds.flatMap((id) => {
-        const mcp = skills.get(id)?.mcp;
-        return mcp ? [[id, { ...mcp, type: mcp.type ?? (mcp.command ? "stdio" : "http") }]] : [];
-    }));
+/**
+ * Only this node's resolved skills contribute external servers. A stdio
+ * server gets its skill's declared credentials in its own `env` (explicit
+ * server env wins): the agent env no longer carries them, so the server must
+ * not rely on inheriting them from the agent process.
+ */
+function resolveSkillMcpServers(skillIds, skills, config = {}) {
+    const servers = {};
+    for (const id of skillIds) {
+        const skill = skills.get(id);
+        const mcp = skill?.mcp;
+        if (!skill || !mcp)
+            continue;
+        const type = mcp.type ?? (mcp.command ? "stdio" : "http");
+        if (type !== "stdio") {
+            servers[id] = { ...mcp, type };
+            continue;
+        }
+        const declared = {};
+        for (const [key, field] of Object.entries(skill.config ?? {})) {
+            if (field.env && config[key] !== undefined)
+                declared[field.env] = config[key];
+        }
+        const env = { ...declared, ...(mcp.env ?? {}) };
+        servers[id] = { ...mcp, type, ...(Object.keys(env).length > 0 ? { env } : {}) };
+    }
+    return servers;
 }
 function resolveTools(skillIds, skills) {
     return skillIds

package/dist/harness/acp.d.ts

@@ -162,7 +162,12 @@ export declare class AcpHarness implements AgentHarness {
         ok: false;
         reason: string;
     }>;
-    /** Env for the agent process: scoped like Claude Code's, with only the auth vars the operator named. */
+    /**
+     * Env for the agent process: scoped like Claude Code's, with only the auth
+     * vars the operator named. Skill credentials are dropped either way
+     * ({@link finishAgentEnv}) unless the node granted them with `agent_env`; an
+     * operator-named auth var stays, and the gate counts it if it is a write token.
+     */
     private buildEnv;
     /** The node policy, with the harness policy mode and the watchdog budget applied. */
     private compilePolicy;

package/dist/harness/acp.js

@@ -48,7 +48,7 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
+import { finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
 import { ACP_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy, TOOL_CLASSES } from "./policy.js";
 import { buildNodePrompt } from "./prompts.js";
@@ -265,20 +265,28 @@ export class AcpHarness {
         }
         return { ok: true, version: this.agentVersion };
     }
-    /** Env for the agent process: scoped like Claude Code's, with only the auth vars the operator named. */
-    buildEnv(extraVars = []) {
+    /**
+     * Env for the agent process: scoped like Claude Code's, with only the auth
+     * vars the operator named. Skill credentials are dropped either way
+     * ({@link finishAgentEnv}) unless the node granted them with `agent_env`; an
+     * operator-named auth var stays, and the gate counts it if it is a write token.
+     */
+    buildEnv(access) {
         const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
-        if (!resolveEnvScope(process.env, this.envScope, this.logger))
-            return full;
-        const { env, withheld } = scopeAgentEnv(full, {
-            extraVars,
-            passthrough: this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH),
-            authVars: this.authVars,
-            prefixes: ["LC_"],
-            logger: this.logger,
-        });
-        reportWithheldEnv(withheld, this.logger);
-        return env;
+        const passthrough = this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH);
+        let env = full;
+        if (resolveEnvScope(process.env, this.envScope, this.logger)) {
+            const scoped = scopeAgentEnv(full, {
+                extraVars: access?.envVars ?? [],
+                passthrough,
+                authVars: this.authVars,
+                prefixes: ["LC_"],
+                logger: this.logger,
+            });
+            reportWithheldEnv(scoped.withheld, this.logger);
+            env = scoped.env;
+        }
+        return finishAgentEnv(env, { access, keep: this.authVars, passthrough, logger: this.logger }).env;
     }
     /** The node policy, with the harness policy mode and the watchdog budget applied. */
     compilePolicy(req, maxTurns) {
@@ -684,7 +692,15 @@ export class AcpHarness {
     async run(req) {
         const maxTurns = req.maxTurns ?? this.maxTurns;
         const mode = req.policy?.sandbox ?? resolveSandboxMode(process.env, this.sandboxMode, this.logger);
-        const policy = { ...this.compilePolicy(req, maxTurns), sandbox: mode };
+        const env = withPushBlocked(this.buildEnv(req.agentAccess), req.agentAccess?.noPush);
+        const compiled = this.compilePolicy(req, maxTurns);
+        const held = heldCredentials(env, req.agentAccess?.withhold);
+        const policy = {
+            ...compiled,
+            sandbox: mode,
+            ...(held.length > 0 ? { agentCredentials: held } : {}),
+            ...(req.agentAccess?.noPush && !compiled.readOnly ? { stagedWrite: true } : {}),
+        };
         // ACP has no sandbox of its own: any mode but off needs the process wrapper.
         const wrapper = mode !== "off" && this.sandboxWrapper !== null
             ? (this.sandboxWrapper ?? (await defaultSandboxWrapper()).wrapper)
@@ -716,7 +732,6 @@ export class AcpHarness {
         const readOnly = policy.readOnly;
         // Permission answers: the node's deny list, plus legacy `disallowed_tools` names that map to a class.
         const deny = new Set([...policy.deny, ...translateDenyNames(policy.nativeDeny).classes]);
-        const env = withPushBlocked(this.buildEnv(req.agentAccess?.envVars), req.agentAccess?.noPush);
         let bridge;
         try {
             // Dry run: external MCP servers cannot be classified per tool, so only
@@ -885,6 +900,8 @@ export class AcpHarness {
             return failClosed(pre.reason);
         // A judge call is a dry run with nothing allowed: same gate, same wrapper.
         const mode = resolveSandboxMode(process.env, this.sandboxMode, this.logger);
+        const env = this.buildEnv();
+        const held = heldCredentials(env);
         const policy = {
             readOnly: true,
             // Nothing to deny at the gate: there is no MCP server and every permission request is rejected below.
@@ -892,6 +909,7 @@ export class AcpHarness {
             egress: [],
             strict: this.policyMode === "strict",
             sandbox: mode,
+            ...(held.length > 0 ? { agentCredentials: held } : {}),
         };
         const wrapper = mode !== "off" && this.sandboxWrapper !== null
             ? (this.sandboxWrapper ?? (await defaultSandboxWrapper()).wrapper)
@@ -899,7 +917,7 @@ export class AcpHarness {
         const prep = await prepareAgentSpawn({
             caps: this.capabilities,
             policy,
-            spawn: { command: this.agent.command, args: this.agent.args, env: this.buildEnv(), cwd: this.cwd },
+            spawn: { command: this.agent.command, args: this.agent.args, env, cwd: this.cwd },
             wrapper: wrapper ?? null,
             harnessEgress: this.egress,
             env: process.env,

package/dist/harness/claude-code.d.ts

@@ -11,6 +11,7 @@
 import type { Claude, Tool, ToolContext, Logger, McpServerConfig } from "../types.js";
 import { type SandboxMode } from "../agent-env.js";
 import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, ToolClass } from "./types.js";
+import { type HarnessPolicyMode } from "./policy.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
 import { buildEvaluatePrompt } from "./prompts.js";
 import { parseToolResultContent, summarizeToolError } from "./parse.js";
@@ -132,6 +133,14 @@ export interface ClaudeCodeHarnessOptions {
         command: string;
         args: string[];
     };
+    /**
+     * Harness policy mode. Claude Code honors every node opinion natively, so
+     * this only decides one case: a staged or dry-run write node whose agent
+     * runs unsandboxed is refused under `strict` (its push block is env and git
+     * hooks, which a deliberate agent can undo) and reported under `warn`.
+     * Default: `warn`; the CLI passes `resolveHarnessPolicy()` (strict under GitHub Actions).
+     */
+    policy?: HarnessPolicyMode;
 }
 export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     readonly id: "claude-code";
@@ -155,6 +164,7 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
     private toolBridge;
     private toolBridgeShim;
     private authProbe;
+    private policyMode;
     constructor(opts?: ClaudeCodeHarnessOptions);
     /**
      * Build env for the Claude Code subprocess (#360). Applies auth precedence
@@ -164,6 +174,8 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
      * `extraVars` (the node's declared skill env vars) and the operator
      * passthrough list, and the withheld names (never values) are reported once
      * per process ({@link reportWithheldEnv}). When off, the full env passes through as before.
+     * Either way, skill credentials are then dropped ({@link finishAgentEnv}):
+     * only the names the node granted with `agent_env` reach the agent.
      */
     private buildEnv;
     /** Which harness (and SDK version) produced a result. */