@sweny-ai/core 0.1.172 → 0.1.174

package/dist/agent-env.js

@@ -29,6 +29,7 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
+import { runKeyDir } from "./journal.js";
 // ─── Scoped env ──────────────────────────────────────────────────
 /**
  * Exact variable names always passed to the agent subprocess.
@@ -956,7 +957,11 @@ export function buildSandboxSettings(domains, opts = {}) {
         },
         credentials: {
             envVars: AGENT_AUTH_VARS.map((name) => ({ name, mode: "deny" })),
-            files: [{ path: path.join(opts.home ?? homedir(), ".claude", ".credentials.json"), mode: "deny" }],
+            files: [
+                { path: path.join(opts.home ?? homedir(), ".claude", ".credentials.json"), mode: "deny" },
+                // Run journal keys: an agent that could read them could forge journal records.
+                { path: runKeyDir(), mode: "deny" },
+            ],
         },
     };
 }

package/dist/budget.d.ts

@@ -16,6 +16,8 @@
  *   the attempt's signal, which stops the agent (harness cancel).
  * - between nodes: usage on the finished result is checked; a crossing fails the
  *   node, and the run halts before the next node starts.
+ * - across a resume: the run journal records each attempt's spend (live and
+ *   final), and `sweny workflow resume` seeds the run total with it.
  */
 import type { NodeUsage } from "./types.js";
 /** The `budget` field of a node or workflow. */
@@ -69,6 +71,12 @@ export declare class BudgetGuard {
     /** The run ceiling is already reached: no further attempt may start. */
     runExhausted(): BudgetOverrun | undefined;
     node(nodeLimits: SpendLimits): NodeBudget;
+    /**
+     * Spend the run made before this process (a resumed run's journaled usage).
+     * Counted against the run ceiling like any other spend, so a crash never
+     * resets the whole-run budget.
+     */
+    seed(s: Spend): void;
     /** @internal */
     commit(s: Spend): void;
 }

package/dist/budget.js

@@ -16,6 +16,8 @@
  *   the attempt's signal, which stops the agent (harness cancel).
  * - between nodes: usage on the finished result is checked; a crossing fails the
  *   node, and the run halts before the next node starts.
+ * - across a resume: the run journal records each attempt's spend (live and
+ *   final), and `sweny workflow resume` seeds the run total with it.
  */
 const isNum = (v) => typeof v === "number" && Number.isFinite(v);
 export function toLimits(b) {
@@ -89,6 +91,15 @@ export class BudgetGuard {
     node(nodeLimits) {
         return new NodeBudget(this, nodeLimits);
     }
+    /**
+     * Spend the run made before this process (a resumed run's journaled usage).
+     * Counted against the run ceiling like any other spend, so a crash never
+     * resets the whole-run budget.
+     */
+    seed(s) {
+        const ok = (n) => (Number.isFinite(n) && n > 0 ? n : 0);
+        this.commit({ tokens: ok(s.tokens), costUsd: ok(s.costUsd) });
+    }
     /** @internal */
     commit(s) {
         this.spent = { tokens: this.spent.tokens + s.tokens, costUsd: this.spent.costUsd + s.costUsd };

package/dist/cli/final-output.d.ts

@@ -4,9 +4,15 @@
  *
  * Unlike run-history and the receipt, this DOES read node output. It is
  * local-only: printed to the terminal and saved to
- * `.sweny/runs/<run-id>/output.md`. Nothing here is sent to the cloud.
+ * `.sweny/runs/<run-id>/output.md` (mode 0600). Nothing here is sent to the cloud.
+ *
+ * Secrets: node data is redacted with the run journal's redactor before
+ * anything renders (secret env and skill credential values, secret-named
+ * fields, known token shapes). In CI the answer is not printed unless asked
+ * (`--show-output`), since CI logs are often visible to more people than the
+ * repo's secrets are.
  */
-import type { JSONSchema, NodeResult, Workflow } from "../types.js";
+import type { ExecutionTrace, JSONSchema, NodeResult, Workflow } from "../types.js";
 /** Lines of the answer printed to the terminal before the rest is left in output.md. */
 export declare const FINAL_OUTPUT_MAX_LINES = 60;
 export interface FinalOutput {
@@ -18,12 +24,26 @@ export interface FinalOutput {
 }
 /** Render a node's declared output fields as a compact `key: value` block. Empty when nothing declared is present. */
 export declare function renderSchemaOutput(data: Record<string, unknown>, schema: JSONSchema): string[];
+export interface ResolveFinalOutputOptions {
+    /** The run's trace: the answer comes from the last successful visit in execution order. */
+    trace?: Pick<ExecutionTrace, "steps">;
+    /** Secret values to redact (default: secret-named values in `process.env`). */
+    secrets?: string[];
+}
 /**
- * Pick what the user should see: the last-run terminal node's result on
- * success, the first failed node's error on failure. Null when there is
+ * Pick what the user should see: the result of the last successful visit
+ * (from the trace, so a loop that ends on an earlier node shows that node) on
+ * success, the first failed node's error on failure. Without a trace, terminal
+ * nodes in result order. Everything is redacted first. Null when there is
  * nothing to show (no schema fields and no summary text).
  */
-export declare function resolveFinalOutput(workflow: Workflow, results: Map<string, NodeResult>): FinalOutput | null;
+export declare function resolveFinalOutput(workflow: Workflow, results: Map<string, NodeResult>, opts?: ResolveFinalOutputOptions): FinalOutput | null;
+/** True when the environment is CI (GitHub Actions, or a truthy `CI`). */
+export declare function isCiEnv(env: Record<string, string | undefined>): boolean;
+/** Print the answer block? Always outside CI; in CI only with `--show-output`. */
+export declare function shouldPrintFinalOutput(showOutput: boolean, env: Record<string, string | undefined>): boolean;
+/** The one line printed in CI instead of the answer. */
+export declare function formatSavedOutputLine(savedTo: string | null): string;
 /**
  * Terminal text: the first `maxLines` lines, then
  * `... (N more lines, see .sweny/runs/<id>/output.md)`. When no file was
@@ -37,5 +57,5 @@ export declare function formatFinalOutput(out: FinalOutput, opts?: {
 export declare function formatFinalMarkdown(workflow: Workflow, out: FinalOutput): string;
 /** Relative path shown to the user: `.sweny/runs/<id>/output.md`. */
 export declare function outputRelPath(runId: string): string;
-/** Write output.md. Local only. Returns the relative path, or null on failure. Never throws. */
+/** Write output.md (mode 0600). Local only. Returns the relative path, or null on failure. Never throws. */
 export declare function writeFinalOutput(runId: string, markdown: string, cwd?: string): string | null;

package/dist/cli/final-output.js

@@ -4,10 +4,17 @@
  *
  * Unlike run-history and the receipt, this DOES read node output. It is
  * local-only: printed to the terminal and saved to
- * `.sweny/runs/<run-id>/output.md`. Nothing here is sent to the cloud.
+ * `.sweny/runs/<run-id>/output.md` (mode 0600). Nothing here is sent to the cloud.
+ *
+ * Secrets: node data is redacted with the run journal's redactor before
+ * anything renders (secret env and skill credential values, secret-named
+ * fields, known token shapes). In CI the answer is not printed unless asked
+ * (`--show-output`), since CI logs are often visible to more people than the
+ * repo's secrets are.
  */
 import fs from "node:fs";
 import path from "node:path";
+import { collectSecretValues, redact } from "../journal.js";
 import { RUN_HISTORY_DIR } from "./run-history.js";
 /** Lines of the answer printed to the terminal before the rest is left in output.md. */
 export const FINAL_OUTPUT_MAX_LINES = 60;
@@ -83,30 +90,52 @@ function trimBlock(text) {
     return lines.map((l) => l.replace(/\s+$/, ""));
 }
 /**
- * Pick what the user should see: the last-run terminal node's result on
- * success, the first failed node's error on failure. Null when there is
+ * Pick what the user should see: the result of the last successful visit
+ * (from the trace, so a loop that ends on an earlier node shows that node) on
+ * success, the first failed node's error on failure. Without a trace, terminal
+ * nodes in result order. Everything is redacted first. Null when there is
  * nothing to show (no schema fields and no summary text).
  */
-export function resolveFinalOutput(workflow, results) {
+export function resolveFinalOutput(workflow, results, opts = {}) {
+    const secrets = opts.secrets ?? collectSecretValues(process.env);
+    const clean = (v) => redact(v, secrets).value;
     for (const [id, r] of results) {
         if (r.status !== "failed")
             continue;
         const err = r.data?.error;
-        const text = typeof err === "string" && err.trim() !== "" ? err : "node failed";
+        const text = typeof err === "string" && err.trim() !== "" ? clean(err) : "node failed";
         return { kind: "error", node: id, lines: trimBlock(text) };
     }
-    const hasOutgoing = new Set(workflow.edges.map((e) => e.from));
-    const succeeded = [...results].filter(([, r]) => r.status === "success");
-    const terminal = succeeded.filter(([id]) => !hasOutgoing.has(id));
-    // Walk back from the end: the last node that actually yields something wins.
-    const candidates = [...(terminal.length > 0 ? terminal : succeeded)].reverse();
+    let candidates;
+    if (opts.trace && opts.trace.steps.length > 0) {
+        // Last successful visit first: walk the trace backwards, each node once.
+        const seen = new Set();
+        candidates = [];
+        for (let i = opts.trace.steps.length - 1; i >= 0; i--) {
+            const step = opts.trace.steps[i];
+            if (step.status !== "success" || seen.has(step.node))
+                continue;
+            seen.add(step.node);
+            const r = results.get(step.node);
+            if (r?.status === "success")
+                candidates.push([step.node, r]);
+        }
+    }
+    else {
+        const hasOutgoing = new Set(workflow.edges.map((e) => e.from));
+        const succeeded = [...results].filter(([, r]) => r.status === "success");
+        const terminal = succeeded.filter(([id]) => !hasOutgoing.has(id));
+        // Walk back from the end: the last node that actually yields something wins.
+        candidates = [...(terminal.length > 0 ? terminal : succeeded)].reverse();
+    }
     for (const [id, r] of candidates) {
+        const data = clean(r.data ?? {});
         const schema = workflow.nodes[id]?.output;
         let lines = [];
         if (schema)
-            lines = renderSchemaOutput(r.data ?? {}, schema);
+            lines = renderSchemaOutput(data, schema);
         if (lines.length === 0) {
-            const summary = r.data?.summary;
+            const summary = data.summary;
             if (typeof summary === "string" && summary.trim() !== "")
                 lines = trimBlock(summary);
         }
@@ -115,6 +144,23 @@ export function resolveFinalOutput(workflow, results) {
     }
     return null;
 }
+/** True when the environment is CI (GitHub Actions, or a truthy `CI`). */
+export function isCiEnv(env) {
+    if (env.GITHUB_ACTIONS === "true")
+        return true;
+    const ci = env.CI?.trim().toLowerCase();
+    return !!ci && ci !== "false" && ci !== "0";
+}
+/** Print the answer block? Always outside CI; in CI only with `--show-output`. */
+export function shouldPrintFinalOutput(showOutput, env) {
+    return showOutput || !isCiEnv(env);
+}
+/** The one line printed in CI instead of the answer. */
+export function formatSavedOutputLine(savedTo) {
+    return savedTo
+        ? `  answer saved to ${savedTo} (pass --show-output to print it in CI)`
+        : "  answer not printed in CI (pass --show-output to print it)";
+}
 /**
  * Terminal text: the first `maxLines` lines, then
  * `... (N more lines, see .sweny/runs/<id>/output.md)`. When no file was
@@ -140,13 +186,16 @@ export function formatFinalMarkdown(workflow, out) {
 export function outputRelPath(runId) {
     return path.posix.join(...RUN_HISTORY_DIR.split(path.sep), runId, "output.md");
 }
-/** Write output.md. Local only. Returns the relative path, or null on failure. Never throws. */
+/** Write output.md (mode 0600). Local only. Returns the relative path, or null on failure. Never throws. */
 export function writeFinalOutput(runId, markdown, cwd = process.cwd()) {
     try {
         const rel = outputRelPath(runId);
         const file = path.join(cwd, rel);
-        fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, markdown);
+        fs.mkdirSync(path.dirname(path.dirname(file)), { recursive: true });
+        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(file, markdown, { mode: 0o600 });
+        // mode only applies on create: a resumed run overwrites an existing file.
+        fs.chmodSync(file, 0o600);
         return rel;
     }
     catch {

package/dist/cli/main.js

@@ -31,14 +31,15 @@ import * as readline from "node:readline";
 import { loadDotenv, loadConfigFile, applyAgentFileConfig } from "./config-file.js";
 import { buildCredentialMap } from "./credentials.js";
 import { nonInteractiveUsage, runNew } from "./new.js";
-import { formatFinalMarkdown, formatFinalOutput, resolveFinalOutput, writeFinalOutput } from "./final-output.js";
+import { formatFinalMarkdown, formatFinalOutput, formatSavedOutputLine, resolveFinalOutput, shouldPrintFinalOutput, writeFinalOutput, } from "./final-output.js";
 import { buildRunRecord, createNodeTimer, historyDisabled, newRunId, recordRun } from "./run-history.js";
 import { registerRunsCommand } from "./runs.js";
 import { registerTryCommand } from "./try.js";
-import { JournalLockedError, JournalMismatchError, RunJournal } from "../journal.js";
+import { JournalLockedError, JournalMismatchError, RunJournal, runSecretValues } from "../journal.js";
 import { journalDisabled, prepareResume, RESUME_SHARED_RUN_FLAGS, WORKFLOW_RESUME_OPTIONS, } from "./resume.js";
 import { runE2eRun, runWithWallClockBudget, DEFAULT_WORKFLOW_TIMEOUT_MS } from "./e2e.js";
 import { createVerboseToolObserver } from "./verbose-observer.js";
+import { createStreamObserver } from "./stream-observer.js";
 import { createRunLogger, summarizeRun, writeStepSummary, WORKFLOW_RUN_DESCRIPTION, WORKFLOW_RUN_OPTIONS, } from "./run-output.js";
 import { writeRunComment } from "./comment-output.js";
 import { writeReceipt } from "./ticket.js";
@@ -56,15 +57,9 @@ import { beginCloudLifecycle, finishCloudLifecycle, createCloudStreamObserver }
 import { runUpgrade, fetchLatestFromNpm } from "./upgrade.js";
 import { maybeNudge, defaultCachePath } from "./version-check.js";
 import { spawnSync } from "node:child_process";
-// ── Stream observer (NDJSON) ────────────────────────────────────────
-/**
- * Create an observer that writes NDJSON ExecutionEvents to stdout.
- * Studio and other consumers parse these line-by-line.
- */
-function createStreamObserver() {
-    return (event) => {
-        process.stdout.write(JSON.stringify(event) + "\n");
-    };
+/** Secret values a run can see, for redacting everything that prints node output. */
+function outputSecrets(skills) {
+    return runSecretValues([...(skills?.values() ?? []), ...builtinSkills], process.env);
 }
 // Verbose tool-detail observer lives in ./verbose-observer.ts so tests can
 // import it without triggering main.ts's top-level CLI parser.
@@ -446,7 +441,7 @@ triageCmd.action(async (options) => {
     if (cloudHandle?.dashboardUrl) {
         console.log(c.subtle(`  cloud: ${cloudHandle.dashboardUrl}`));
     }
-    const observer = composeObservers(progressObserver, config.verbose ? createVerboseToolObserver() : undefined, config.stream ? createStreamObserver() : undefined, createCloudStreamObserver(config, cloudHandle));
+    const observer = composeObservers(progressObserver, config.verbose ? createVerboseToolObserver() : undefined, config.stream ? createStreamObserver(outputSecrets(skills)) : undefined, createCloudStreamObserver(config, cloudHandle));
     // #365: pin safe outputs to the configured tracker and repo; nodes these
     // providers cannot run read-only or through safe outputs keep their old shape.
     const triageRun = bindForCli(triageWorkflow, config);
@@ -466,7 +461,7 @@ triageCmd.action(async (options) => {
         const durationMs = Date.now() - runStart;
         // Output
         if (config.json) {
-            await writeResultJson(results);
+            await writeResultJson(results, outputSecrets(skills));
         }
         else {
             console.log(formatDagResultHuman(results, durationMs, config));
@@ -654,7 +649,7 @@ implementCmd.action(async (issueId, options) => {
     if (implCloudHandle?.dashboardUrl) {
         console.log(c.subtle(`  cloud: ${implCloudHandle.dashboardUrl}`));
     }
-    const observer = composeObservers(implProgressObserver, config.verbose ? createVerboseToolObserver() : undefined, Boolean(options.stream) ? createStreamObserver() : undefined, createCloudStreamObserver(config, implCloudHandle));
+    const observer = composeObservers(implProgressObserver, config.verbose ? createVerboseToolObserver() : undefined, Boolean(options.stream) ? createStreamObserver(outputSecrets(skills)) : undefined, createCloudStreamObserver(config, implCloudHandle));
     const implementRun = bindForCli(implementWorkflow, config);
     try {
         const { results } = await execute(implementRun, workflowInput, {
@@ -681,7 +676,7 @@ implementCmd.action(async (issueId, options) => {
             // silent
         }
         if (config.json) {
-            await writeResultJson(results);
+            await writeResultJson(results, outputSecrets(skills));
         }
         if (hasFailed) {
             console.error(chalk.red(`\n  Implement workflow failed\n`));
@@ -1023,7 +1018,7 @@ resume) {
             // history must never fail a run
         }
     };
-    const observer = composeObservers(wfProgressObserver, nodeTimer.observer, options.verbose ? createVerboseToolObserver() : undefined, options.stream ? createStreamObserver() : undefined, createCloudStreamObserver(config, wfCloudHandle));
+    const observer = composeObservers(wfProgressObserver, nodeTimer.observer, options.verbose ? createVerboseToolObserver() : undefined, options.stream ? createStreamObserver(outputSecrets(skills)) : undefined, createCloudStreamObserver(config, wfCloudHandle));
     // #325: this is the primary run path (GitHub Action / CLI / MCP all land
     // here), and previously never passed signal/timeoutMs/max_steps to
     // execute() at all: a wedged node (hung tool call, runaway model turn)
@@ -1077,7 +1072,7 @@ resume) {
             });
         }
         if (isJson) {
-            await writeResultJson(results);
+            await writeResultJson(results, outputSecrets(skills));
             process.exit(wfHasFailed ? 1 : 0);
             return;
         }
@@ -1102,12 +1097,18 @@ resume) {
         writeStepSummary(workflow, results, receipt, trace);
         // The answer, above the receipt: the terminal node's result, or the failed node's error.
         // Also saved to .sweny/runs/<id>/output.md (local only; --no-history skips the file).
-        const finalOutput = resolveFinalOutput(workflow, results);
+        // Redacted with the journal's redactor; in CI printed only with --show-output.
+        const finalOutput = resolveFinalOutput(workflow, results, {
+            trace,
+            secrets: runSecretValues([...skills.values(), ...builtinSkills], process.env),
+        });
         if (finalOutput) {
             const savedTo = historyDisabled(options.history, fileConfig["history"])
                 ? null
                 : writeFinalOutput(runId, formatFinalMarkdown(workflow, finalOutput));
-            const block = formatFinalOutput(finalOutput, { outputPath: savedTo });
+            const block = shouldPrintFinalOutput(options.showOutput === true, process.env)
+                ? formatFinalOutput(finalOutput, { outputPath: savedTo })
+                : formatSavedOutputLine(savedTo);
             if (wfHasFailed)
                 console.error(`${block}\n`);
             else
@@ -1245,6 +1246,7 @@ for (const [flags, description] of WORKFLOW_RUN_OPTIONS) {
     workflowRunCmd.option(flags, description);
 }
 workflowRunCmd.option("--no-history", "Do not record this run or save its output.md in .sweny/runs/ (or set `history: off` in .sweny.yml)");
+workflowRunCmd.option("--show-output", "Print the final answer in CI too (off by default in CI: only the path to output.md is printed)");
 workflowRunCmd.option("--no-journal", "Do not write a run journal to .sweny/runs/<run-id>/ (or set `journal: off` in .sweny.yml); the run cannot be resumed");
 const workflowResumeCmd = workflowCmd
     .command("resume <run-id>")
@@ -1283,6 +1285,7 @@ for (const [flags, description] of WORKFLOW_RUN_OPTIONS) {
         workflowResumeCmd.option(flags, description);
 }
 workflowResumeCmd.option("--no-history", "Do not update this run's record in .sweny/runs/");
+workflowResumeCmd.option("--show-output", "Print the final answer in CI too (off by default in CI)");
 registerRunsCommand(program);
 workflowCmd
     .command("diagram <file>")

package/dist/cli/output.d.ts

@@ -24,9 +24,13 @@ export declare function formatValidationErrors(errors: string[]): string;
 export declare function extractCredentialHint(err: unknown): string | null;
 export declare function formatCrashError(error: unknown): string;
 export declare function formatCheckResults(results: CheckResult[]): string;
-export declare function formatResultJson(results: Map<string, NodeResult>): string;
+/**
+ * Node results as JSON, redacted with the run journal's redactor (secret
+ * values, secret-named fields, known token shapes). Structure and keys stay.
+ */
+export declare function formatResultJson(results: Map<string, NodeResult>, secrets?: string[]): string;
 /** Drain terminal JSON before process.exit(), including when stdout is a pipe. */
-export declare function writeResultJson(results: Map<string, NodeResult>): Promise<void>;
+export declare function writeResultJson(results: Map<string, NodeResult>, secrets?: string[]): Promise<void>;
 /**
  * Format triage results as GitHub-flavored markdown for `$GITHUB_STEP_SUMMARY`.
  *

package/dist/cli/output.js

@@ -1,4 +1,5 @@
 import chalk from "chalk";
+import { redact } from "../journal.js";
 import { toMermaidBlock } from "../mermaid.js";
 import { PALETTE, ROLE_COLORS } from "../theme.js";
 // ── Color palette (tokens from theme.ts; one color per meaning) ─
@@ -404,13 +405,17 @@ export function formatCheckResults(results) {
     ].join("\n");
 }
 // ── JSON output ─────────────────────────────────────────────────
-export function formatResultJson(results) {
-    return JSON.stringify(Object.fromEntries(results), null, 2);
+/**
+ * Node results as JSON, redacted with the run journal's redactor (secret
+ * values, secret-named fields, known token shapes). Structure and keys stay.
+ */
+export function formatResultJson(results, secrets = []) {
+    return JSON.stringify(redact(Object.fromEntries(results), secrets).value, null, 2);
 }
 /** Drain terminal JSON before process.exit(), including when stdout is a pipe. */
-export function writeResultJson(results) {
+export function writeResultJson(results, secrets = []) {
     return new Promise((resolve, reject) => {
-        process.stdout.write(formatResultJson(results) + "\n", (error) => {
+        process.stdout.write(formatResultJson(results, secrets) + "\n", (error) => {
             if (error)
                 reject(error);
             else

package/dist/cli/resume.js

@@ -7,7 +7,7 @@
  */
 import path from "node:path";
 import { validateRuntimeInput } from "../inputs.js";
-import { JOURNAL_DIR, JOURNAL_FILE, JournalLockedError, JournalVersionError, RunJournal, buildResumePlan, canonicalHash, findJournalRun, journalDir, mayRepeatWrites, readJournal, workflowHashOf, } from "../journal.js";
+import { JOURNAL_DIR, JOURNAL_FILE, JournalKeyError, JournalLockedError, JournalVersionError, RunJournal, buildResumePlan, canonicalHash, checkJournalAgainstWorkflow, findJournalRun, journalDir, mayRepeatWrites, readJournal, workflowHashOf, } from "../journal.js";
 import { parseInputFlag } from "./workflow-input.js";
 /** Resume-only flags; the rest are shared with `workflow run`. */
 export const WORKFLOW_RESUME_OPTIONS = [
@@ -83,10 +83,14 @@ export function prepareResume(ref, opts, deps) {
         read = readJournal(file, { repair: !opts.plan });
     }
     catch (err) {
-        if (err instanceof JournalVersionError)
+        if (err instanceof JournalVersionError || err instanceof JournalKeyError)
             return fail(err.message);
         return fail(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
     }
+    if (read.forgedAtLine !== undefined) {
+        return fail(`run journal ${file} line ${read.forgedAtLine} fails authentication: it was edited or written by something ` +
+            `other than this run. Refusing to resume. Start a new run.`);
+    }
     if (read.corruptAtLine !== undefined) {
         return fail(`run journal ${file} is damaged at line ${read.corruptAtLine}, with valid records after it. ` +
             `That is not a torn last write, so it cannot be repaired safely. Start a new run.`);
@@ -122,6 +126,10 @@ export function prepareResume(ref, opts, deps) {
         }
         lines.push(`warning: --force: workflow ${workflowFile} changed since the run started`);
     }
+    // Replayed control flow must exist in the workflow (not overridable by --force).
+    const flaw = checkJournalAgainstWorkflow(read.records, workflow);
+    if (flaw)
+        return fail(`cannot resume run ${runId}: ${flaw}. Start a new run.`);
     let input;
     if (opts.input !== undefined) {
         const parsed = parseInputFlag(opts.input);

package/dist/cli/stream-observer.d.ts

@@ -0,0 +1,10 @@
+import type { Observer } from "../types.js";
+/**
+ * Observer that writes NDJSON ExecutionEvents to stdout (`--stream`).
+ * Studio and other consumers parse these line-by-line.
+ *
+ * Every event goes through the run journal's redactor first (secret values,
+ * secret-named fields, known token shapes): node data, summaries, errors,
+ * tool inputs and outputs. Keys and structure are untouched.
+ */
+export declare function createStreamObserver(secrets?: string[], write?: (line: string) => void): Observer;

package/dist/cli/stream-observer.js

@@ -0,0 +1,14 @@
+import { redact } from "../journal.js";
+/**
+ * Observer that writes NDJSON ExecutionEvents to stdout (`--stream`).
+ * Studio and other consumers parse these line-by-line.
+ *
+ * Every event goes through the run journal's redactor first (secret values,
+ * secret-named fields, known token shapes): node data, summaries, errors,
+ * tool inputs and outputs. Keys and structure are untouched.
+ */
+export function createStreamObserver(secrets = [], write = (line) => void process.stdout.write(line)) {
+    return (event) => {
+        write(JSON.stringify(redact(event, secrets).value) + "\n");
+    };
+}

package/dist/executor.js

@@ -28,7 +28,7 @@ import "./skills/git-push.js";
 import { fenceUntrusted } from "./untrusted.js";
 import { asClaude } from "./harness/compat.js";
 import { budgetGate, isToolClass, policyGate, resolveHarnessPolicy } from "./harness/policy.js";
-import { BudgetGuard, describeOverrun, minLimits, toLimits } from "./budget.js";
+import { BudgetGuard, describeOverrun, minLimits, spendOf, toLimits } from "./budget.js";
 import { createShadowDecider, finishShadowDecision, startShadowDecision } from "./decider.js";
 import { buildNodePolicy, resolveNodePermissions } from "./node-policy.js";
 import { applySafeOutputs, createEmitOutputTool, createWriteStageState, resolveActor, safeOutputsInstruction, unresolvedOutputs, SAFE_OUTPUT_SCREEN_INSTRUCTION, } from "./safe-outputs.js";
@@ -161,6 +161,11 @@ export async function execute(workflow, input, options) {
         writeState,
         harnessId: options.harness?.id,
     });
+    // Resume (#363): the run budget is the logical run's, so it starts from what
+    // earlier attempts already spent, not from zero.
+    const priorSpend = journal?.priorSpend?.();
+    if (priorSpend)
+        budgetGuard.seed(priorSpend);
     safeObserve(observer, { type: "workflow:start", workflow: workflow.id }, logger);
     safeObserve(observer, { type: "sources:resolved", sources: resolvedSources }, logger);
     let currentId = workflow.entry;
@@ -205,8 +210,14 @@ export async function execute(workflow, input, options) {
             else {
                 if (replay.next !== null) {
                     const key = `${from}→${replay.next}`;
-                    edgeCounts.set(key, (edgeCounts.get(key) ?? 0) + 1);
-                    const reason = whenLabel(workflow.edges.find((e) => e.from === from && e.to === replay.next)?.when) ?? "only path";
+                    const edge = workflow.edges.find((e) => e.from === from && e.to === replay.next);
+                    const taken = (edgeCounts.get(key) ?? 0) + 1;
+                    // A replayed route must be a real edge its max_iterations still allows.
+                    if (!edge || (edge.max_iterations !== undefined && taken > edge.max_iterations)) {
+                        throw new Error(`run journal routes ${from} -> ${replay.next}, which ${edge ? "exceeds the edge's max_iterations" : "is not an edge of this workflow"}; refusing to replay it`);
+                    }
+                    edgeCounts.set(key, taken);
+                    const reason = whenLabel(edge.when) ?? "only path";
                     trace.edges.push({ from, to: replay.next, reason });
                 }
                 safeObserve(observer, { type: "route", from, to: replay.next ?? "(end)", reason: "replayed" }, logger);
@@ -431,6 +442,23 @@ export async function execute(workflow, input, options) {
             // Only the final attempt's intents may be applied.
             intents.length = 0;
             const attemptBudget = budgetOn ? nodeBudget.attempt(signal) : undefined;
+            // Resume (#363): spend is journaled as it is reported, so a crash mid-node
+            // does not hand the resumed run a fresh budget.
+            const usageNode = currentId;
+            const usageAttempt = attempt;
+            let liveUsage;
+            const journalUsage = journal?.usage
+                ? (u) => {
+                    liveUsage = { ...liveUsage, ...u };
+                    journal.usage(usageNode, iteration, usageAttempt, liveUsage, false);
+                }
+                : undefined;
+            const onUsage = attemptBudget || journalUsage
+                ? (u) => {
+                    attemptBudget?.onUsage(u);
+                    journalUsage?.(u);
+                }
+                : undefined;
             try {
                 result = await claude.run({
                     nodeId: currentId,
@@ -448,7 +476,7 @@ export async function execute(workflow, input, options) {
                     ...(nodePolicy ? { policy: nodePolicy } : {}),
                     ...(readOnlyNode ? {} : { mcpServers: skillMcpServers }),
                     ...(readOnlyNode ? { readOnly: true } : {}),
-                    ...(attemptBudget ? { onUsage: attemptBudget.onUsage } : {}),
+                    ...(onUsage ? { onUsage } : {}),
                     onProgress: (message) => {
                         safeObserve(observer, { type: "node:progress", node: currentId, message }, logger);
                     },
@@ -458,6 +486,16 @@ export async function execute(workflow, input, options) {
                 attemptBudget?.dispose();
             }
             previous = result;
+            // The attempt's final spend: the larger of the result's usage and the last live report, per unit.
+            if (journal?.usage) {
+                const finalSpend = spendOf(result.usage);
+                const seen = spendOf(liveUsage);
+                const tokens = Math.max(finalSpend.tokens ?? 0, seen.tokens ?? 0);
+                const costUsd = Math.max(finalSpend.costUsd ?? 0, seen.costUsd ?? 0);
+                if (finalSpend.tokens !== undefined || finalSpend.costUsd !== undefined || liveUsage) {
+                    journal.usage(usageNode, iteration, usageAttempt, { inputTokens: tokens, outputTokens: 0, costUsd }, true);
+                }
+            }
             if (budgetCheck && budgetCheck.degraded.length > 0) {
                 result = { ...result, degraded: [...new Set([...(result.degraded ?? []), ...budgetCheck.degraded])] };
             }

package/dist/harness/sandbox-wrapper.js

@@ -48,6 +48,7 @@ import { lstat, mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises
 import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
 import { DEFAULT_SANDBOX_DOMAINS, parseList, resolveSandboxMode } from "../agent-env.js";
+import { JOURNAL_DIR, runKeyDir } from "../journal.js";
 import { policyGate } from "./policy.js";
 // ─── srt settings ────────────────────────────────────────────────
 /**
@@ -131,10 +132,17 @@ export function buildSrtSettings(req, opts) {
     // cannot rename one out from under its read deny.
     const masked = [...new Set((req.denyRead ?? []).map(real))].filter((p) => exists(p));
     denyRead.push(...masked.filter((p) => !denyRead.includes(p)));
+    // Run journal keys (outside the workspace) are never readable by the agent,
+    // and the journals themselves are not writable.
+    const keyDir = runKeyDir();
+    if (exists(keyDir) && !denyRead.includes(keyDir))
+        denyRead.push(keyDir);
+    const journals = path.join(real(req.cwd), JOURNAL_DIR);
+    const denyWrite = !req.readOnly && exists(journals) ? [...masked, journals] : masked;
     const allowWrite = req.readOnly ? [opts.home] : [real(req.cwd), opts.home];
     return {
         network: { allowedDomains, deniedDomains: [], strictAllowlist: true, allowLocalBinding: false },
-        filesystem: { denyRead, allowRead: opts.isolationRoot ? [opts.home] : [], allowWrite, denyWrite: masked },
+        filesystem: { denyRead, allowRead: opts.isolationRoot ? [opts.home] : [], allowWrite, denyWrite },
     };
 }
 /** Env for the wrapped process: the adapter's env with HOME, XDG and temp dirs moved into the scratch HOME. */