@sweny-ai/core 0.1.172 → 0.1.173

package/dist/agent-env.js

@@ -29,6 +29,7 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
+import { runKeyDir } from "./journal.js";
 // ─── Scoped env ──────────────────────────────────────────────────
 /**
  * Exact variable names always passed to the agent subprocess.
@@ -956,7 +957,11 @@ export function buildSandboxSettings(domains, opts = {}) {
         },
         credentials: {
             envVars: AGENT_AUTH_VARS.map((name) => ({ name, mode: "deny" })),
-            files: [{ path: path.join(opts.home ?? homedir(), ".claude", ".credentials.json"), mode: "deny" }],
+            files: [
+                { path: path.join(opts.home ?? homedir(), ".claude", ".credentials.json"), mode: "deny" },
+                // Run journal keys: an agent that could read them could forge journal records.
+                { path: runKeyDir(), mode: "deny" },
+            ],
         },
     };
 }

package/dist/budget.d.ts

@@ -16,6 +16,8 @@
  *   the attempt's signal, which stops the agent (harness cancel).
  * - between nodes: usage on the finished result is checked; a crossing fails the
  *   node, and the run halts before the next node starts.
+ * - across a resume: the run journal records each attempt's spend (live and
+ *   final), and `sweny workflow resume` seeds the run total with it.
  */
 import type { NodeUsage } from "./types.js";
 /** The `budget` field of a node or workflow. */
@@ -69,6 +71,12 @@ export declare class BudgetGuard {
     /** The run ceiling is already reached: no further attempt may start. */
     runExhausted(): BudgetOverrun | undefined;
     node(nodeLimits: SpendLimits): NodeBudget;
+    /**
+     * Spend the run made before this process (a resumed run's journaled usage).
+     * Counted against the run ceiling like any other spend, so a crash never
+     * resets the whole-run budget.
+     */
+    seed(s: Spend): void;
     /** @internal */
     commit(s: Spend): void;
 }

package/dist/budget.js

@@ -16,6 +16,8 @@
  *   the attempt's signal, which stops the agent (harness cancel).
  * - between nodes: usage on the finished result is checked; a crossing fails the
  *   node, and the run halts before the next node starts.
+ * - across a resume: the run journal records each attempt's spend (live and
+ *   final), and `sweny workflow resume` seeds the run total with it.
  */
 const isNum = (v) => typeof v === "number" && Number.isFinite(v);
 export function toLimits(b) {
@@ -89,6 +91,15 @@ export class BudgetGuard {
     node(nodeLimits) {
         return new NodeBudget(this, nodeLimits);
     }
+    /**
+     * Spend the run made before this process (a resumed run's journaled usage).
+     * Counted against the run ceiling like any other spend, so a crash never
+     * resets the whole-run budget.
+     */
+    seed(s) {
+        const ok = (n) => (Number.isFinite(n) && n > 0 ? n : 0);
+        this.commit({ tokens: ok(s.tokens), costUsd: ok(s.costUsd) });
+    }
     /** @internal */
     commit(s) {
         this.spent = { tokens: this.spent.tokens + s.tokens, costUsd: this.spent.costUsd + s.costUsd };

package/dist/cli/final-output.d.ts

@@ -4,9 +4,15 @@
  *
  * Unlike run-history and the receipt, this DOES read node output. It is
  * local-only: printed to the terminal and saved to
- * `.sweny/runs/<run-id>/output.md`. Nothing here is sent to the cloud.
+ * `.sweny/runs/<run-id>/output.md` (mode 0600). Nothing here is sent to the cloud.
+ *
+ * Secrets: node data is redacted with the run journal's redactor before
+ * anything renders (secret env and skill credential values, secret-named
+ * fields, known token shapes). In CI the answer is not printed unless asked
+ * (`--show-output`), since CI logs are often visible to more people than the
+ * repo's secrets are.
  */
-import type { JSONSchema, NodeResult, Workflow } from "../types.js";
+import type { ExecutionTrace, JSONSchema, NodeResult, Workflow } from "../types.js";
 /** Lines of the answer printed to the terminal before the rest is left in output.md. */
 export declare const FINAL_OUTPUT_MAX_LINES = 60;
 export interface FinalOutput {
@@ -18,12 +24,26 @@ export interface FinalOutput {
 }
 /** Render a node's declared output fields as a compact `key: value` block. Empty when nothing declared is present. */
 export declare function renderSchemaOutput(data: Record<string, unknown>, schema: JSONSchema): string[];
+export interface ResolveFinalOutputOptions {
+    /** The run's trace: the answer comes from the last successful visit in execution order. */
+    trace?: Pick<ExecutionTrace, "steps">;
+    /** Secret values to redact (default: secret-named values in `process.env`). */
+    secrets?: string[];
+}
 /**
- * Pick what the user should see: the last-run terminal node's result on
- * success, the first failed node's error on failure. Null when there is
+ * Pick what the user should see: the result of the last successful visit
+ * (from the trace, so a loop that ends on an earlier node shows that node) on
+ * success, the first failed node's error on failure. Without a trace, terminal
+ * nodes in result order. Everything is redacted first. Null when there is
  * nothing to show (no schema fields and no summary text).
  */
-export declare function resolveFinalOutput(workflow: Workflow, results: Map<string, NodeResult>): FinalOutput | null;
+export declare function resolveFinalOutput(workflow: Workflow, results: Map<string, NodeResult>, opts?: ResolveFinalOutputOptions): FinalOutput | null;
+/** True when the environment is CI (GitHub Actions, or a truthy `CI`). */
+export declare function isCiEnv(env: Record<string, string | undefined>): boolean;
+/** Print the answer block? Always outside CI; in CI only with `--show-output`. */
+export declare function shouldPrintFinalOutput(showOutput: boolean, env: Record<string, string | undefined>): boolean;
+/** The one line printed in CI instead of the answer. */
+export declare function formatSavedOutputLine(savedTo: string | null): string;
 /**
  * Terminal text: the first `maxLines` lines, then
  * `... (N more lines, see .sweny/runs/<id>/output.md)`. When no file was
@@ -37,5 +57,5 @@ export declare function formatFinalOutput(out: FinalOutput, opts?: {
 export declare function formatFinalMarkdown(workflow: Workflow, out: FinalOutput): string;
 /** Relative path shown to the user: `.sweny/runs/<id>/output.md`. */
 export declare function outputRelPath(runId: string): string;
-/** Write output.md. Local only. Returns the relative path, or null on failure. Never throws. */
+/** Write output.md (mode 0600). Local only. Returns the relative path, or null on failure. Never throws. */
 export declare function writeFinalOutput(runId: string, markdown: string, cwd?: string): string | null;

package/dist/cli/final-output.js

@@ -4,10 +4,17 @@
  *
  * Unlike run-history and the receipt, this DOES read node output. It is
  * local-only: printed to the terminal and saved to
- * `.sweny/runs/<run-id>/output.md`. Nothing here is sent to the cloud.
+ * `.sweny/runs/<run-id>/output.md` (mode 0600). Nothing here is sent to the cloud.
+ *
+ * Secrets: node data is redacted with the run journal's redactor before
+ * anything renders (secret env and skill credential values, secret-named
+ * fields, known token shapes). In CI the answer is not printed unless asked
+ * (`--show-output`), since CI logs are often visible to more people than the
+ * repo's secrets are.
  */
 import fs from "node:fs";
 import path from "node:path";
+import { collectSecretValues, redact } from "../journal.js";
 import { RUN_HISTORY_DIR } from "./run-history.js";
 /** Lines of the answer printed to the terminal before the rest is left in output.md. */
 export const FINAL_OUTPUT_MAX_LINES = 60;
@@ -83,30 +90,52 @@ function trimBlock(text) {
     return lines.map((l) => l.replace(/\s+$/, ""));
 }
 /**
- * Pick what the user should see: the last-run terminal node's result on
- * success, the first failed node's error on failure. Null when there is
+ * Pick what the user should see: the result of the last successful visit
+ * (from the trace, so a loop that ends on an earlier node shows that node) on
+ * success, the first failed node's error on failure. Without a trace, terminal
+ * nodes in result order. Everything is redacted first. Null when there is
  * nothing to show (no schema fields and no summary text).
  */
-export function resolveFinalOutput(workflow, results) {
+export function resolveFinalOutput(workflow, results, opts = {}) {
+    const secrets = opts.secrets ?? collectSecretValues(process.env);
+    const clean = (v) => redact(v, secrets).value;
     for (const [id, r] of results) {
         if (r.status !== "failed")
             continue;
         const err = r.data?.error;
-        const text = typeof err === "string" && err.trim() !== "" ? err : "node failed";
+        const text = typeof err === "string" && err.trim() !== "" ? clean(err) : "node failed";
         return { kind: "error", node: id, lines: trimBlock(text) };
     }
-    const hasOutgoing = new Set(workflow.edges.map((e) => e.from));
-    const succeeded = [...results].filter(([, r]) => r.status === "success");
-    const terminal = succeeded.filter(([id]) => !hasOutgoing.has(id));
-    // Walk back from the end: the last node that actually yields something wins.
-    const candidates = [...(terminal.length > 0 ? terminal : succeeded)].reverse();
+    let candidates;
+    if (opts.trace && opts.trace.steps.length > 0) {
+        // Last successful visit first: walk the trace backwards, each node once.
+        const seen = new Set();
+        candidates = [];
+        for (let i = opts.trace.steps.length - 1; i >= 0; i--) {
+            const step = opts.trace.steps[i];
+            if (step.status !== "success" || seen.has(step.node))
+                continue;
+            seen.add(step.node);
+            const r = results.get(step.node);
+            if (r?.status === "success")
+                candidates.push([step.node, r]);
+        }
+    }
+    else {
+        const hasOutgoing = new Set(workflow.edges.map((e) => e.from));
+        const succeeded = [...results].filter(([, r]) => r.status === "success");
+        const terminal = succeeded.filter(([id]) => !hasOutgoing.has(id));
+        // Walk back from the end: the last node that actually yields something wins.
+        candidates = [...(terminal.length > 0 ? terminal : succeeded)].reverse();
+    }
     for (const [id, r] of candidates) {
+        const data = clean(r.data ?? {});
         const schema = workflow.nodes[id]?.output;
         let lines = [];
         if (schema)
-            lines = renderSchemaOutput(r.data ?? {}, schema);
+            lines = renderSchemaOutput(data, schema);
         if (lines.length === 0) {
-            const summary = r.data?.summary;
+            const summary = data.summary;
             if (typeof summary === "string" && summary.trim() !== "")
                 lines = trimBlock(summary);
         }
@@ -115,6 +144,23 @@ export function resolveFinalOutput(workflow, results) {
     }
     return null;
 }
+/** True when the environment is CI (GitHub Actions, or a truthy `CI`). */
+export function isCiEnv(env) {
+    if (env.GITHUB_ACTIONS === "true")
+        return true;
+    const ci = env.CI?.trim().toLowerCase();
+    return !!ci && ci !== "false" && ci !== "0";
+}
+/** Print the answer block? Always outside CI; in CI only with `--show-output`. */
+export function shouldPrintFinalOutput(showOutput, env) {
+    return showOutput || !isCiEnv(env);
+}
+/** The one line printed in CI instead of the answer. */
+export function formatSavedOutputLine(savedTo) {
+    return savedTo
+        ? `  answer saved to ${savedTo} (pass --show-output to print it in CI)`
+        : "  answer not printed in CI (pass --show-output to print it)";
+}
 /**
  * Terminal text: the first `maxLines` lines, then
  * `... (N more lines, see .sweny/runs/<id>/output.md)`. When no file was
@@ -140,13 +186,16 @@ export function formatFinalMarkdown(workflow, out) {
 export function outputRelPath(runId) {
     return path.posix.join(...RUN_HISTORY_DIR.split(path.sep), runId, "output.md");
 }
-/** Write output.md. Local only. Returns the relative path, or null on failure. Never throws. */
+/** Write output.md (mode 0600). Local only. Returns the relative path, or null on failure. Never throws. */
 export function writeFinalOutput(runId, markdown, cwd = process.cwd()) {
     try {
         const rel = outputRelPath(runId);
         const file = path.join(cwd, rel);
-        fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, markdown);
+        fs.mkdirSync(path.dirname(path.dirname(file)), { recursive: true });
+        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(file, markdown, { mode: 0o600 });
+        // mode only applies on create: a resumed run overwrites an existing file.
+        fs.chmodSync(file, 0o600);
         return rel;
     }
     catch {

package/dist/cli/main.js

@@ -31,11 +31,11 @@ import * as readline from "node:readline";
 import { loadDotenv, loadConfigFile, applyAgentFileConfig } from "./config-file.js";
 import { buildCredentialMap } from "./credentials.js";
 import { nonInteractiveUsage, runNew } from "./new.js";
-import { formatFinalMarkdown, formatFinalOutput, resolveFinalOutput, writeFinalOutput } from "./final-output.js";
+import { formatFinalMarkdown, formatFinalOutput, formatSavedOutputLine, resolveFinalOutput, shouldPrintFinalOutput, writeFinalOutput, } from "./final-output.js";
 import { buildRunRecord, createNodeTimer, historyDisabled, newRunId, recordRun } from "./run-history.js";
 import { registerRunsCommand } from "./runs.js";
 import { registerTryCommand } from "./try.js";
-import { JournalLockedError, JournalMismatchError, RunJournal } from "../journal.js";
+import { JournalLockedError, JournalMismatchError, RunJournal, runSecretValues } from "../journal.js";
 import { journalDisabled, prepareResume, RESUME_SHARED_RUN_FLAGS, WORKFLOW_RESUME_OPTIONS, } from "./resume.js";
 import { runE2eRun, runWithWallClockBudget, DEFAULT_WORKFLOW_TIMEOUT_MS } from "./e2e.js";
 import { createVerboseToolObserver } from "./verbose-observer.js";
@@ -1102,12 +1102,18 @@ resume) {
         writeStepSummary(workflow, results, receipt, trace);
         // The answer, above the receipt: the terminal node's result, or the failed node's error.
         // Also saved to .sweny/runs/<id>/output.md (local only; --no-history skips the file).
-        const finalOutput = resolveFinalOutput(workflow, results);
+        // Redacted with the journal's redactor; in CI printed only with --show-output.
+        const finalOutput = resolveFinalOutput(workflow, results, {
+            trace,
+            secrets: runSecretValues([...skills.values(), ...builtinSkills], process.env),
+        });
         if (finalOutput) {
             const savedTo = historyDisabled(options.history, fileConfig["history"])
                 ? null
                 : writeFinalOutput(runId, formatFinalMarkdown(workflow, finalOutput));
-            const block = formatFinalOutput(finalOutput, { outputPath: savedTo });
+            const block = shouldPrintFinalOutput(options.showOutput === true, process.env)
+                ? formatFinalOutput(finalOutput, { outputPath: savedTo })
+                : formatSavedOutputLine(savedTo);
             if (wfHasFailed)
                 console.error(`${block}\n`);
             else
@@ -1245,6 +1251,7 @@ for (const [flags, description] of WORKFLOW_RUN_OPTIONS) {
     workflowRunCmd.option(flags, description);
 }
 workflowRunCmd.option("--no-history", "Do not record this run or save its output.md in .sweny/runs/ (or set `history: off` in .sweny.yml)");
+workflowRunCmd.option("--show-output", "Print the final answer in CI too (off by default in CI: only the path to output.md is printed)");
 workflowRunCmd.option("--no-journal", "Do not write a run journal to .sweny/runs/<run-id>/ (or set `journal: off` in .sweny.yml); the run cannot be resumed");
 const workflowResumeCmd = workflowCmd
     .command("resume <run-id>")
@@ -1283,6 +1290,7 @@ for (const [flags, description] of WORKFLOW_RUN_OPTIONS) {
         workflowResumeCmd.option(flags, description);
 }
 workflowResumeCmd.option("--no-history", "Do not update this run's record in .sweny/runs/");
+workflowResumeCmd.option("--show-output", "Print the final answer in CI too (off by default in CI)");
 registerRunsCommand(program);
 workflowCmd
     .command("diagram <file>")

package/dist/cli/resume.js

@@ -7,7 +7,7 @@
  */
 import path from "node:path";
 import { validateRuntimeInput } from "../inputs.js";
-import { JOURNAL_DIR, JOURNAL_FILE, JournalLockedError, JournalVersionError, RunJournal, buildResumePlan, canonicalHash, findJournalRun, journalDir, mayRepeatWrites, readJournal, workflowHashOf, } from "../journal.js";
+import { JOURNAL_DIR, JOURNAL_FILE, JournalKeyError, JournalLockedError, JournalVersionError, RunJournal, buildResumePlan, canonicalHash, checkJournalAgainstWorkflow, findJournalRun, journalDir, mayRepeatWrites, readJournal, workflowHashOf, } from "../journal.js";
 import { parseInputFlag } from "./workflow-input.js";
 /** Resume-only flags; the rest are shared with `workflow run`. */
 export const WORKFLOW_RESUME_OPTIONS = [
@@ -83,10 +83,14 @@ export function prepareResume(ref, opts, deps) {
         read = readJournal(file, { repair: !opts.plan });
     }
     catch (err) {
-        if (err instanceof JournalVersionError)
+        if (err instanceof JournalVersionError || err instanceof JournalKeyError)
             return fail(err.message);
         return fail(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
     }
+    if (read.forgedAtLine !== undefined) {
+        return fail(`run journal ${file} line ${read.forgedAtLine} fails authentication: it was edited or written by something ` +
+            `other than this run. Refusing to resume. Start a new run.`);
+    }
     if (read.corruptAtLine !== undefined) {
         return fail(`run journal ${file} is damaged at line ${read.corruptAtLine}, with valid records after it. ` +
             `That is not a torn last write, so it cannot be repaired safely. Start a new run.`);
@@ -122,6 +126,10 @@ export function prepareResume(ref, opts, deps) {
         }
         lines.push(`warning: --force: workflow ${workflowFile} changed since the run started`);
     }
+    // Replayed control flow must exist in the workflow (not overridable by --force).
+    const flaw = checkJournalAgainstWorkflow(read.records, workflow);
+    if (flaw)
+        return fail(`cannot resume run ${runId}: ${flaw}. Start a new run.`);
     let input;
     if (opts.input !== undefined) {
         const parsed = parseInputFlag(opts.input);

package/dist/executor.js

@@ -28,7 +28,7 @@ import "./skills/git-push.js";
 import { fenceUntrusted } from "./untrusted.js";
 import { asClaude } from "./harness/compat.js";
 import { budgetGate, isToolClass, policyGate, resolveHarnessPolicy } from "./harness/policy.js";
-import { BudgetGuard, describeOverrun, minLimits, toLimits } from "./budget.js";
+import { BudgetGuard, describeOverrun, minLimits, spendOf, toLimits } from "./budget.js";
 import { createShadowDecider, finishShadowDecision, startShadowDecision } from "./decider.js";
 import { buildNodePolicy, resolveNodePermissions } from "./node-policy.js";
 import { applySafeOutputs, createEmitOutputTool, createWriteStageState, resolveActor, safeOutputsInstruction, unresolvedOutputs, SAFE_OUTPUT_SCREEN_INSTRUCTION, } from "./safe-outputs.js";
@@ -161,6 +161,11 @@ export async function execute(workflow, input, options) {
         writeState,
         harnessId: options.harness?.id,
     });
+    // Resume (#363): the run budget is the logical run's, so it starts from what
+    // earlier attempts already spent, not from zero.
+    const priorSpend = journal?.priorSpend?.();
+    if (priorSpend)
+        budgetGuard.seed(priorSpend);
     safeObserve(observer, { type: "workflow:start", workflow: workflow.id }, logger);
     safeObserve(observer, { type: "sources:resolved", sources: resolvedSources }, logger);
     let currentId = workflow.entry;
@@ -205,8 +210,14 @@ export async function execute(workflow, input, options) {
             else {
                 if (replay.next !== null) {
                     const key = `${from}→${replay.next}`;
-                    edgeCounts.set(key, (edgeCounts.get(key) ?? 0) + 1);
-                    const reason = whenLabel(workflow.edges.find((e) => e.from === from && e.to === replay.next)?.when) ?? "only path";
+                    const edge = workflow.edges.find((e) => e.from === from && e.to === replay.next);
+                    const taken = (edgeCounts.get(key) ?? 0) + 1;
+                    // A replayed route must be a real edge its max_iterations still allows.
+                    if (!edge || (edge.max_iterations !== undefined && taken > edge.max_iterations)) {
+                        throw new Error(`run journal routes ${from} -> ${replay.next}, which ${edge ? "exceeds the edge's max_iterations" : "is not an edge of this workflow"}; refusing to replay it`);
+                    }
+                    edgeCounts.set(key, taken);
+                    const reason = whenLabel(edge.when) ?? "only path";
                     trace.edges.push({ from, to: replay.next, reason });
                 }
                 safeObserve(observer, { type: "route", from, to: replay.next ?? "(end)", reason: "replayed" }, logger);
@@ -431,6 +442,23 @@ export async function execute(workflow, input, options) {
             // Only the final attempt's intents may be applied.
             intents.length = 0;
             const attemptBudget = budgetOn ? nodeBudget.attempt(signal) : undefined;
+            // Resume (#363): spend is journaled as it is reported, so a crash mid-node
+            // does not hand the resumed run a fresh budget.
+            const usageNode = currentId;
+            const usageAttempt = attempt;
+            let liveUsage;
+            const journalUsage = journal?.usage
+                ? (u) => {
+                    liveUsage = { ...liveUsage, ...u };
+                    journal.usage(usageNode, iteration, usageAttempt, liveUsage, false);
+                }
+                : undefined;
+            const onUsage = attemptBudget || journalUsage
+                ? (u) => {
+                    attemptBudget?.onUsage(u);
+                    journalUsage?.(u);
+                }
+                : undefined;
             try {
                 result = await claude.run({
                     nodeId: currentId,
@@ -448,7 +476,7 @@ export async function execute(workflow, input, options) {
                     ...(nodePolicy ? { policy: nodePolicy } : {}),
                     ...(readOnlyNode ? {} : { mcpServers: skillMcpServers }),
                     ...(readOnlyNode ? { readOnly: true } : {}),
-                    ...(attemptBudget ? { onUsage: attemptBudget.onUsage } : {}),
+                    ...(onUsage ? { onUsage } : {}),
                     onProgress: (message) => {
                         safeObserve(observer, { type: "node:progress", node: currentId, message }, logger);
                     },
@@ -458,6 +486,16 @@ export async function execute(workflow, input, options) {
                 attemptBudget?.dispose();
             }
             previous = result;
+            // The attempt's final spend: the larger of the result's usage and the last live report, per unit.
+            if (journal?.usage) {
+                const finalSpend = spendOf(result.usage);
+                const seen = spendOf(liveUsage);
+                const tokens = Math.max(finalSpend.tokens ?? 0, seen.tokens ?? 0);
+                const costUsd = Math.max(finalSpend.costUsd ?? 0, seen.costUsd ?? 0);
+                if (finalSpend.tokens !== undefined || finalSpend.costUsd !== undefined || liveUsage) {
+                    journal.usage(usageNode, iteration, usageAttempt, { inputTokens: tokens, outputTokens: 0, costUsd }, true);
+                }
+            }
             if (budgetCheck && budgetCheck.degraded.length > 0) {
                 result = { ...result, degraded: [...new Set([...(result.degraded ?? []), ...budgetCheck.degraded])] };
             }

package/dist/harness/sandbox-wrapper.js

@@ -48,6 +48,7 @@ import { lstat, mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises
 import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
 import { DEFAULT_SANDBOX_DOMAINS, parseList, resolveSandboxMode } from "../agent-env.js";
+import { JOURNAL_DIR, runKeyDir } from "../journal.js";
 import { policyGate } from "./policy.js";
 // ─── srt settings ────────────────────────────────────────────────
 /**
@@ -131,10 +132,17 @@ export function buildSrtSettings(req, opts) {
     // cannot rename one out from under its read deny.
     const masked = [...new Set((req.denyRead ?? []).map(real))].filter((p) => exists(p));
     denyRead.push(...masked.filter((p) => !denyRead.includes(p)));
+    // Run journal keys (outside the workspace) are never readable by the agent,
+    // and the journals themselves are not writable.
+    const keyDir = runKeyDir();
+    if (exists(keyDir) && !denyRead.includes(keyDir))
+        denyRead.push(keyDir);
+    const journals = path.join(real(req.cwd), JOURNAL_DIR);
+    const denyWrite = !req.readOnly && exists(journals) ? [...masked, journals] : masked;
     const allowWrite = req.readOnly ? [opts.home] : [real(req.cwd), opts.home];
     return {
         network: { allowedDomains, deniedDomains: [], strictAllowlist: true, allowLocalBinding: false },
-        filesystem: { denyRead, allowRead: opts.isolationRoot ? [opts.home] : [], allowWrite, denyWrite: masked },
+        filesystem: { denyRead, allowRead: opts.isolationRoot ? [opts.home] : [], allowWrite, denyWrite },
     };
 }
 /** Env for the wrapped process: the adapter's env with HOME, XDG and temp dirs moved into the scratch HOME. */