@sweny-ai/core 0.1.176 → 0.1.177

package/dist/agent-env.d.ts

@@ -322,7 +322,16 @@ export interface AgentAccess {
      * hooks; only a sandbox stops a deliberate agent from undoing it.
      */
     noPush?: boolean;
+    /**
+     * The run is staged or a dry run: no skill or external MCP server reaches
+     * the node (an MCP server cannot be classified per tool, so it may write).
+     * Only sweny's own tool bridge, already filtered to read tools, remains,
+     * and Claude Code runs with `strictMcpConfig`. Same MCP rule as `readOnly`.
+     */
+    noMcp?: boolean;
 }
+/** True when a run request may load no MCP server but sweny's own bridge (read-only or staged). */
+export declare function mcpWithheld(readOnly: boolean, access: Pick<AgentAccess, "noMcp"> | undefined): boolean;
 /** Hosts reachable by sandboxed commands in every node: source hosting + package registries. */
 export declare const DEFAULT_SANDBOX_DOMAINS: readonly string[];
 /** Provider hosts added when a node references the built-in skill. */

package/dist/agent-env.js

@@ -814,6 +814,10 @@ export function grantedAgentEnv(agentEnv, opts) {
         return { grant: [], dropped: `agent_env withheld in a staged or dry run: ${names.join(", ")}` };
     return { grant: names };
 }
+/** True when a run request may load no MCP server but sweny's own bridge (read-only or staged). */
+export function mcpWithheld(readOnly, access) {
+    return readOnly || access?.noMcp === true;
+}
 /** Hosts reachable by sandboxed commands in every node: source hosting + package registries. */
 export const DEFAULT_SANDBOX_DOMAINS = [
     "github.com",

package/dist/cli/comment-output.js

@@ -6,8 +6,7 @@
  * METADATA ONLY. Node names, statuses, counts, and durations. Never prompts,
  * tool inputs, node outputs, errors, or model prose.
  */
-import fs from "node:fs";
-import path from "node:path";
+import { workspaceRoot, writeFileNoFollow } from "../safe-file.js";
 import { toMermaidBlock } from "../mermaid.js";
 import { formatReceiptDuration, nodeStates } from "./run-output.js";
 import { formatTicketText } from "./ticket.js";
@@ -77,10 +76,10 @@ export function formatCrashComment(workflow, summary, runId) {
 /** Write the comment markdown to `file`. Never throws; returns true only when written. */
 export function writeRunComment(file, workflow, results, summary, opts = {}) {
     try {
-        fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, opts.crashed
+        // The file may sit in the agent-writable workspace: no link on the path is followed.
+        writeFileNoFollow(file, opts.crashed
             ? formatCrashComment(workflow, summary, opts.runId)
-            : formatRunComment(workflow, results, summary, opts));
+            : formatRunComment(workflow, results, summary, opts), { ...workspaceRoot(file), mode: 0o644, dirMode: 0o755 });
         return true;
     }
     catch (err) {

package/dist/cli/config-file.d.ts

@@ -1,6 +1,20 @@
+/**
+ * Keys a workspace `.env` may never set. The workspace is agent-writable, and
+ * these name runtime or platform state sweny trusts as the operator's: CI and
+ * runner identity and the files the runner hands sweny to write
+ * (GITHUB_STEP_SUMMARY, GITHUB_OUTPUT, ...), where binaries are found (PATH),
+ * how Node and git behave (NODE_*, GIT_*), where traffic goes and which CAs it
+ * trusts (proxies, SSL/CA vars), and the home and temp dirs. A `.env` value
+ * for one of them is skipped with a warning. GITHUB_TOKEN is a credential the
+ * `.env` template documents, not platform state, so it stays allowed.
+ */
+export declare const DOTENV_DENIED_KEYS: RegExp;
+/** True when a workspace `.env` may not set `key` (see {@link DOTENV_DENIED_KEYS}). */
+export declare function isDotenvDenied(key: string): boolean;
 /**
  * Auto-load a `.env` file from the given directory.
- * Sets `process.env[KEY]` only if not already defined (real env vars win).
+ * Sets `process.env[KEY]` only if not already defined (real env vars win),
+ * and never a runtime or platform key ({@link DOTENV_DENIED_KEYS}).
  */
 export declare function loadDotenv(cwd?: string): void;
 /**

package/dist/cli/config-file.js

@@ -1,9 +1,27 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { parse as parseYaml } from "yaml";
+// Imported for its side effect too: the startup env snapshot is taken before loadDotenv runs.
+import { markWorkspaceEnv } from "../startup-env.js";
+/**
+ * Keys a workspace `.env` may never set. The workspace is agent-writable, and
+ * these name runtime or platform state sweny trusts as the operator's: CI and
+ * runner identity and the files the runner hands sweny to write
+ * (GITHUB_STEP_SUMMARY, GITHUB_OUTPUT, ...), where binaries are found (PATH),
+ * how Node and git behave (NODE_*, GIT_*), where traffic goes and which CAs it
+ * trusts (proxies, SSL/CA vars), and the home and temp dirs. A `.env` value
+ * for one of them is skipped with a warning. GITHUB_TOKEN is a credential the
+ * `.env` template documents, not platform state, so it stays allowed.
+ */
+export const DOTENV_DENIED_KEYS = /^(GITHUB_(?!TOKEN$)[A-Za-z0-9_]*|RUNNER_[A-Za-z0-9_]*|ACTIONS_[A-Za-z0-9_]*|CI|PATH|Path|NODE_[A-Za-z0-9_]*|GIT_[A-Za-z0-9_]*|(HTTPS?|ALL|NO|FTP)_PROXY|(https?|all|no|ftp)_proxy|SSL_CERT_FILE|SSL_CERT_DIR|CURL_CA_BUNDLE|REQUESTS_CA_BUNDLE|TMPDIR|TEMP|TMP|HOME|USERPROFILE)$/;
+/** True when a workspace `.env` may not set `key` (see {@link DOTENV_DENIED_KEYS}). */
+export function isDotenvDenied(key) {
+    return DOTENV_DENIED_KEYS.test(key);
+}
 /**
  * Auto-load a `.env` file from the given directory.
- * Sets `process.env[KEY]` only if not already defined (real env vars win).
+ * Sets `process.env[KEY]` only if not already defined (real env vars win),
+ * and never a runtime or platform key ({@link DOTENV_DENIED_KEYS}).
  */
 export function loadDotenv(cwd = process.cwd()) {
     const envPath = path.join(cwd, ".env");
@@ -27,9 +45,14 @@ export function loadDotenv(cwd = process.cwd()) {
         if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
             value = value.slice(1, -1);
         }
-        if (process.env[key] === undefined) {
-            process.env[key] = value;
+        if (process.env[key] !== undefined)
+            continue;
+        if (isDotenvDenied(key)) {
+            process.stderr.write(`  warning: .env sets ${key}, a runtime/platform variable; ignored\n`);
+            continue;
         }
+        process.env[key] = value;
+        markWorkspaceEnv(key);
     }
 }
 /**

package/dist/cli/final-output.d.ts

@@ -57,5 +57,8 @@ export declare function formatFinalOutput(out: FinalOutput, opts?: {
 export declare function formatFinalMarkdown(workflow: Workflow, out: FinalOutput): string;
 /** Relative path shown to the user: `.sweny/runs/<id>/output.md`. */
 export declare function outputRelPath(runId: string): string;
-/** Write output.md (mode 0600). Local only. Returns the relative path, or null on failure. Never throws. */
+/**
+ * Write output.md (mode 0600). Local only. Returns the relative path, or null on failure. Never throws.
+ * The run dir is agent-writable: no link on the path is followed (see safe-file.ts).
+ */
 export declare function writeFinalOutput(runId: string, markdown: string, cwd?: string): string | null;

package/dist/cli/final-output.js

@@ -12,7 +12,7 @@
  * (`--show-output`), since CI logs are often visible to more people than the
  * repo's secrets are.
  */
-import fs from "node:fs";
+import { writeFileNoFollow } from "../safe-file.js";
 import path from "node:path";
 import { collectSecretValues, redact } from "../journal.js";
 import { RUN_HISTORY_DIR } from "./run-history.js";
@@ -186,16 +186,14 @@ export function formatFinalMarkdown(workflow, out) {
 export function outputRelPath(runId) {
     return path.posix.join(...RUN_HISTORY_DIR.split(path.sep), runId, "output.md");
 }
-/** Write output.md (mode 0600). Local only. Returns the relative path, or null on failure. Never throws. */
+/**
+ * Write output.md (mode 0600). Local only. Returns the relative path, or null on failure. Never throws.
+ * The run dir is agent-writable: no link on the path is followed (see safe-file.ts).
+ */
 export function writeFinalOutput(runId, markdown, cwd = process.cwd()) {
     try {
         const rel = outputRelPath(runId);
-        const file = path.join(cwd, rel);
-        fs.mkdirSync(path.dirname(path.dirname(file)), { recursive: true });
-        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-        fs.writeFileSync(file, markdown, { mode: 0o600 });
-        // mode only applies on create: a resumed run overwrites an existing file.
-        fs.chmodSync(file, 0o600);
+        writeFileNoFollow(path.join(cwd, rel), markdown, { root: cwd, mode: 0o600 });
         return rel;
     }
     catch {

package/dist/cli/main.js

@@ -2,6 +2,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { createRequire } from "node:module";
+import { workspaceRoot, writeFileNoFollow } from "../safe-file.js";
 import { Command } from "commander";
 const _require = createRequire(import.meta.url);
 const { version } = _require("../../package.json");
@@ -57,6 +58,15 @@ import { beginCloudLifecycle, finishCloudLifecycle, createCloudStreamObserver }
 import { runUpgrade, fetchLatestFromNpm } from "./upgrade.js";
 import { maybeNudge, defaultCachePath } from "./version-check.js";
 import { spawnSync } from "node:child_process";
+import { trustedEnvValue } from "../startup-env.js";
+/** GITHUB_STEP_SUMMARY as the operator set it: never a value a workspace `.env` introduced. */
+function stepSummaryPath() {
+    return trustedEnvValue(process.env, "GITHUB_STEP_SUMMARY") || undefined;
+}
+/** Append to GITHUB_STEP_SUMMARY without following a link (the path may sit in the workspace). */
+function appendStepSummary(file, md) {
+    writeFileNoFollow(file, md, { ...workspaceRoot(file), append: true, mkdirs: false, mode: 0o644 });
+}
 /** Secret values a run can see, for redacting everything that prints node output. */
 function outputSecrets(skills) {
     return runSecretValues([...(skills?.values() ?? []), ...builtinSkills], process.env);
@@ -467,13 +477,13 @@ triageCmd.action(async (options) => {
             console.log(formatDagResultHuman(results, durationMs, config));
         }
         // GitHub Actions step summary
-        if (config.notificationProvider === "github-summary" && process.env.GITHUB_STEP_SUMMARY) {
+        if (config.notificationProvider === "github-summary" && stepSummaryPath()) {
             try {
                 const md = formatDagResultMarkdown(results, durationMs, config, {
                     workflow: triageWorkflow,
                     trace,
                 });
-                fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, md);
+                appendStepSummary(stepSummaryPath(), md);
             }
             catch (err) {
                 // Don't fail the run if the summary file can't be written
@@ -531,9 +541,9 @@ triageCmd.action(async (options) => {
             // silent — cloud reporting must never block or mask the crash
         }
         // Best-effort GitHub Actions step summary on crash
-        if (config.notificationProvider === "github-summary" && process.env.GITHUB_STEP_SUMMARY) {
+        if (config.notificationProvider === "github-summary" && stepSummaryPath()) {
             try {
-                fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, `## ❌ SWEny Triage Crashed\n\n\`\`\`\n${crashMsg}\n\`\`\`\n`);
+                appendStepSummary(stepSummaryPath(), `## ❌ SWEny Triage Crashed\n\n\`\`\`\n${crashMsg}\n\`\`\`\n`);
             }
             catch {
                 // ignore

package/dist/cli/run-history.js

@@ -14,6 +14,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { summarizeRun } from "./run-output.js";
+import { openNoFollow } from "../safe-file.js";
 export const RUN_HISTORY_SCHEMA_VERSION = 1;
 export const RUN_HISTORY_DIR = path.join(".sweny", "runs");
 export const RUN_HISTORY_KEEP = 200;
@@ -131,8 +132,9 @@ export function writeRunRecord(record, cwd = process.cwd()) {
     const final = path.join(dir, `${record.run_id}.json`);
     const tmp = path.join(dir, `.${record.run_id}.json.${process.pid}.tmp`);
     try {
-        fs.mkdirSync(dir, { recursive: true });
-        const fd = fs.openSync(tmp, "w");
+        // The workspace is agent-writable: no link on the path is followed (safe-file.ts).
+        // rename() replaces a link at `final` itself, never its target.
+        const fd = openNoFollow(tmp, { root: cwd, mode: 0o644 });
         try {
             fs.writeSync(fd, JSON.stringify(record, null, 2) + "\n");
             fs.fsyncSync(fd);

package/dist/cli/run-output.js

@@ -5,12 +5,13 @@
  * METADATA ONLY. Nothing here reads prompts, node outputs, tool inputs, or
  * model prose: only counts, durations, token totals, and cost.
  */
-import fs from "node:fs";
+import { workspaceRoot, writeFileNoFollow } from "../safe-file.js";
 import { consoleLogger } from "../types.js";
 import { summarizeDecisions } from "../decider.js";
 import { toMermaidBlock } from "../mermaid.js";
 import { createPaint } from "./style.js";
 import { colorEnabled, glyphs } from "./terminal.js";
+import { trustedEnvValue } from "../startup-env.js";
 /** The short key of a `degraded` entry: the text before its first colon. */
 export function degradedKey(entry) {
     const i = entry.indexOf(":");
@@ -219,11 +220,18 @@ export function formatStepSummary(workflow, results, summary, trace) {
  * Never throws; returns true only when something was written.
  */
 export function writeStepSummary(workflow, results, summary, trace, env = process.env) {
-    const file = env.GITHUB_STEP_SUMMARY;
+    // The operator's value only: never one a workspace `.env` introduced.
+    const file = trustedEnvValue(env, "GITHUB_STEP_SUMMARY");
     if (!file)
         return false;
     try {
-        fs.appendFileSync(file, formatStepSummary(workflow, results, summary, trace));
+        // Never through a link, in case the path sits in the agent-writable workspace.
+        writeFileNoFollow(file, formatStepSummary(workflow, results, summary, trace), {
+            ...workspaceRoot(file),
+            append: true,
+            mkdirs: false,
+            mode: 0o644,
+        });
         return true;
     }
     catch (err) {

package/dist/cli/try.js

@@ -12,7 +12,7 @@
  * only). Until a real run is recorded it is labelled illustrative.
  */
 import fs from "node:fs";
-import path from "node:path";
+import { workspaceRoot, writeFileNoFollow } from "../safe-file.js";
 import { fileURLToPath } from "node:url";
 import { parse as parseYaml } from "yaml";
 import { execute } from "../executor.js";
@@ -270,8 +270,7 @@ export async function runTry(opts = {}) {
     });
     if (opts.commentFile) {
         try {
-            fs.mkdirSync(path.dirname(path.resolve(opts.commentFile)), { recursive: true });
-            fs.writeFileSync(opts.commentFile, comment);
+            writeFileNoFollow(opts.commentFile, comment, { ...workspaceRoot(opts.commentFile), mode: 0o644, dirMode: 0o755 });
         }
         catch (err) {
             process.stderr.write(`  ${g.warning} could not write comment file: ${err instanceof Error ? err.message : err}\n`);

package/dist/executor.d.ts

@@ -13,7 +13,6 @@
  * This replaces ~8k lines of engine + recipe step code.
  */
 import type { Workflow, Skill, Tool, Claude, Observer, NodeResult, Logger, ExecutionResult } from "./types.js";
-import "./skills/git-push.js";
 import type { HarnessPolicyMode } from "./harness/policy.js";
 import type { AgentHarness } from "./harness/types.js";
 import type { DeciderMode } from "./decider.js";
@@ -150,3 +149,9 @@ export declare function buildBoundedContext(workflow: Workflow, nodeId: string,
  * with no `access` is treated as a write so new tools fail safe.
  */
 export declare function isReadTool(tool: Pick<Tool, "access">): boolean;
+/**
+ * The tool dispatcher's staged-run gate: in a staged or dry run no write (or
+ * unclassified) tool handler runs, whatever reached the agent. Throws before
+ * any side effect.
+ */
+export declare function guardStagedWrite(tool: Pick<Tool, "name" | "access">, staged: boolean): void;

package/dist/executor.js

@@ -23,8 +23,9 @@ import { buildToolAliases } from "./skills/index.js";
 import { validateWorkflow } from "./schema.js";
 import { grantedAgentEnv, resolveAgentAccess } from "./agent-env.js";
 import { gitCredentialWarning, scanGitCredentials } from "./git-credentials.js";
-// #473: arms the sweny-side branch push in `github_create_pr` (Node only; skills/ stays browser-safe).
-import "./skills/git-push.js";
+// #473: the sweny-side branch push in `github_create_pr` (Node only; skills/ stays browser-safe).
+import { bindBranchPusher } from "./skills/git-push.js";
+import { trustedEnvValue } from "./startup-env.js";
 import { fenceUntrusted } from "./untrusted.js";
 import { asClaude } from "./harness/compat.js";
 import { budgetGate, isToolClass, policyGate, resolveHarnessPolicy } from "./harness/policy.js";
@@ -96,7 +97,8 @@ export async function execute(workflow, input, options) {
     // default). Each harness masks it for read-only and staged nodes, or reports
     // the node degraded; this says so once per run. Paths and keys, never values.
     try {
-        const credentialWarning = gitCredentialWarning(scanGitCredentials(process.cwd(), { env: runEnv }));
+        // The run's checkout (ExecuteOptions.cwd), not the embedding process's cwd.
+        const credentialWarning = gitCredentialWarning(scanGitCredentials(options.cwd ?? process.cwd(), { env: runEnv }));
         if (credentialWarning)
             logger.warn(credentialWarning);
     }
@@ -141,6 +143,11 @@ export async function execute(workflow, input, options) {
         nodeContext.forEach((s, i) => (sourceMap[`nodes.${nodeId}.context.${i}`] = s));
     }
     const resolveCwd = options.cwd ?? process.cwd();
+    // #473: the PR head push runs in this run's checkout, never process.cwd() of
+    // an embedding process. Tools get it through ToolContext.
+    const pushBranch = bindBranchPusher(resolveCwd, runEnv);
+    // GHES: the REST base for the github skill, never a value the workspace .env introduced.
+    const githubApiUrl = trustedEnvValue(runEnv, "GITHUB_API_URL") || undefined;
     const resolvedSources = await resolveSources(sourceMap, {
         cwd: resolveCwd,
         env: options.env ?? process.env,
@@ -239,10 +246,16 @@ export async function execute(workflow, input, options) {
         const permissions = resolveNodePermissions(node, workflow);
         const declaresPolicy = node.permissions !== undefined || workflow.permissions !== undefined || (node.outputs?.length ?? 0) > 0;
         const readOnlyNode = dryRun || permissions.access === "read";
-        const readTools = readOnlyNode ? filteredTools.filter(isReadTool) : filteredTools;
-        const skippedWrites = dryRun ? filteredTools.filter((t) => !isReadTool(t)).map((t) => t.name) : [];
+        // A staged run (--stage, safe_outputs.staged) writes nothing either: its
+        // write tools are withheld too, and the dispatcher below refuses any that
+        // still reach a handler.
+        const readTools = readOnlyNode || stageOutputs ? filteredTools.filter(isReadTool) : filteredTools;
+        // A staged write node records what it lost, like a dry run.
+        const stagedWriteNode = stageOutputs && !readOnlyNode;
+        const skippedWrites = dryRun || stagedWriteNode ? filteredTools.filter((t) => !isReadTool(t)).map((t) => t.name) : [];
         if (skippedWrites.length > 0) {
-            logger.info(`  dry run: withheld write tools: ${skippedWrites.join(", ")}`, { node: currentId });
+            const why = dryRun ? "dry run" : "staged";
+            logger.info(`  ${why}: withheld write tools: ${skippedWrites.join(", ")}`, { node: currentId });
         }
         else if (readOnlyNode && readTools.length < filteredTools.length) {
             const withheld = filteredTools.filter((t) => !isReadTool(t)).map((t) => t.name);
@@ -332,7 +345,15 @@ export async function execute(workflow, input, options) {
             ...t,
             handler: async (toolInput) => {
                 safeObserve(observer, { type: "tool:call", node: currentId, tool: t.name, input: toolInput }, logger);
-                const toolCtx = { config, logger };
+                guardStagedWrite(t, stageOutputs);
+                const toolCtx = {
+                    config,
+                    logger,
+                    cwd: resolveCwd,
+                    staged: stageOutputs,
+                    pushBranch,
+                    ...(githubApiUrl ? { githubApiUrl } : {}),
+                };
                 const output = await t.handler(toolInput, toolCtx);
                 safeObserve(observer, { type: "tool:result", node: currentId, tool: t.name, output }, logger);
                 return output;
@@ -345,7 +366,11 @@ export async function execute(workflow, input, options) {
         const nodeInstruction = outputDecls.length > 0
             ? `${baseInstruction}\n\n${safeOutputsInstruction(outputDecls, runInput)}`
             : baseInstruction;
-        const instruction = dryRun ? `${dryRunNotice(skippedWrites)}\n\n---\n\n${nodeInstruction}` : nodeInstruction;
+        const instruction = dryRun
+            ? `${dryRunNotice(skippedWrites)}\n\n---\n\n${nodeInstruction}`
+            : skippedWrites.length > 0
+                ? `${stagedNotice(skippedWrites)}\n\n---\n\n${nodeInstruction}`
+                : nodeInstruction;
         // Run Claude on this node, with optional eval-failure retry loop.
         let attempt = 0;
         let result;
@@ -373,7 +398,8 @@ export async function execute(workflow, input, options) {
             logger.warn(`  ${granted.dropped}`, { node: currentId });
         const agentAccess = {
             ...resolveAgentAccess(node.skills, skills, granted.grant),
-            ...(stageOutputs ? { noPush: true } : {}),
+            // A staged run loads no skill or external MCP server either: it may write.
+            ...(stageOutputs ? { noPush: true, noMcp: true } : {}),
         };
         // #365: a node or workflow that declares `permissions` or `outputs` gets
         // one portable policy, compiled by each adapter. The gate also runs here so
@@ -474,7 +500,7 @@ export async function execute(workflow, input, options) {
                     timeoutMs,
                     agentAccess,
                     ...(nodePolicy ? { policy: nodePolicy } : {}),
-                    ...(readOnlyNode ? {} : { mcpServers: skillMcpServers }),
+                    ...(readOnlyNode || stageOutputs ? {} : { mcpServers: skillMcpServers }),
                     ...(readOnlyNode ? { readOnly: true } : {}),
                     ...(onUsage ? { onUsage } : {}),
                     onProgress: (message) => {
@@ -652,6 +678,9 @@ export async function execute(workflow, input, options) {
                     env: runEnv,
                     actor,
                     staged: stageOutputs,
+                    cwd: resolveCwd,
+                    pushBranch,
+                    ...(githubApiUrl ? { githubApiUrl } : {}),
                     state: writeState,
                     logger,
                     input: runInput,
@@ -1110,6 +1139,16 @@ function isDryRunInput(input) {
 export function isReadTool(tool) {
     return tool.access === "read";
 }
+/**
+ * The tool dispatcher's staged-run gate: in a staged or dry run no write (or
+ * unclassified) tool handler runs, whatever reached the agent. Throws before
+ * any side effect.
+ */
+export function guardStagedWrite(tool, staged) {
+    if (staged && !isReadTool(tool)) {
+        throw new Error(`${tool.name} is a write tool and this run is staged: nothing was written`);
+    }
+}
 /** Instruction section prepended to every node under dry-run. */
 function dryRunNotice(skippedWrites) {
     const withheld = skippedWrites.length > 0 ? `These write tools were withheld from this step: ${skippedWrites.join(", ")}. ` : "";
@@ -1117,6 +1156,12 @@ function dryRunNotice(skippedWrites) {
         `Do not create, modify, post, or send anything. Do the analysis, and where this step would ` +
         `normally write, describe exactly what it would have written instead.`);
 }
+/** Instruction section prepended to a staged write node whose write tools were withheld. */
+function stagedNotice(skippedWrites) {
+    return (`## Staged run\n\nThis run is staged: nothing is written outside the workspace. These write tools were ` +
+        `withheld from this step: ${skippedWrites.join(", ")}. Where this step would call one, describe ` +
+        `exactly what it would have written instead.`);
+}
 /**
  * Only this node's resolved skills contribute external servers. A stdio
  * server gets its skill's declared credentials in its own `env` (explicit

package/dist/harness/acp.js

@@ -48,7 +48,7 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
+import { finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
 import { ACP_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy, TOOL_CLASSES } from "./policy.js";
 import { gitCredentialPolicy } from "../git-credentials.js";
@@ -739,7 +739,7 @@ export class AcpHarness {
         try {
             // Dry run: external MCP servers cannot be classified per tool, so only
             // sweny's own (already read-filtered) skill tools remain.
-            const servers = readOnly
+            const servers = mcpWithheld(readOnly, req.agentAccess)
                 ? {}
                 : { ...this.defaultMcpServers, ...req.mcpServers, ...this.mcpServers };
             if (req.tools.length > 0) {

package/dist/harness/claude-code.js

@@ -11,7 +11,7 @@
 import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude-agent-sdk";
 import { createRequire } from "node:module";
 import { consoleLogger } from "../types.js";
-import { AGENT_AUTH_VARS, finishAgentEnv, reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, withPushBlocked, resolveAgentSandbox, } from "../agent-env.js";
+import { AGENT_AUTH_VARS, finishAgentEnv, reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, withPushBlocked, mcpWithheld, resolveAgentSandbox, } from "../agent-env.js";
 import { gitCredentialGap, policyGate } from "./policy.js";
 import { gitCredentialPolicy } from "../git-credentials.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
@@ -324,13 +324,14 @@ export class ClaudeCodeHarness {
             ...req,
             readOnly,
             disallowedTools: disallowedTools.length > 0 ? disallowedTools : undefined,
-            strictMcp: readOnly || policy.strict || policy.exclusiveMcp === true,
+            strictMcp: mcpWithheld(readOnly, req.agentAccess) || policy.strict || policy.exclusiveMcp === true,
             sandboxMode: policy.sandbox,
             agentAccess: {
                 envVars: req.agentAccess?.envVars ?? [],
                 domains: policy.egress,
                 withhold: req.agentAccess?.withhold,
                 noPush: req.agentAccess?.noPush,
+                noMcp: req.agentAccess?.noMcp,
             },
             stagedWrite: !!req.agentAccess?.noPush && !readOnly,
             strict: policy.strict || this.policyMode === "strict",
@@ -483,7 +484,8 @@ export class ClaudeCodeHarness {
         const abort = makeAbort(timeoutMs, signal);
         let stream;
         try {
-            const allMcpServers = readOnly
+            // Read-only and staged runs: no skill or external MCP server (it may write).
+            const allMcpServers = mcpWithheld(!!readOnly, agentAccess)
                 ? {}
                 : { ...this.defaultMcpServers, ...opts.mcpServers, ...this.mcpServers };
             if (useBridge) {
@@ -520,7 +522,7 @@ export class ClaudeCodeHarness {
                     // project .mcp.json, plugins). strictMcpConfig limits MCP to the
                     // servers passed above, which under readOnly is only sweny-core.
                     // A strict policy (#365) makes it exclusive for write nodes too.
-                    ...(readOnly || opts.strictMcp ? { strictMcpConfig: true } : {}),
+                    ...(mcpWithheld(!!readOnly, agentAccess) || opts.strictMcp ? { strictMcpConfig: true } : {}),
                     ...(disallowedTools && disallowedTools.length > 0 ? { disallowedTools } : {}),
                     // CC-08: ask the SDK to produce validated structured output when the
                     // node declares an output schema. The SDK then returns the parsed

package/dist/harness/codex.js

@@ -28,7 +28,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, checkSandboxSupport, finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
+import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, checkSandboxSupport, finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
 import { CODEX_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
 import { gitCredentialPolicy } from "../git-credentials.js";
@@ -816,7 +816,7 @@ export class CodexHarness {
         try {
             // Dry run: external MCP servers cannot be classified per tool, so only
             // sweny's own (already read-filtered) skill tools remain.
-            const servers = readOnly
+            const servers = mcpWithheld(readOnly, req.agentAccess)
                 ? {}
                 : { ...this.defaultMcpServers, ...req.mcpServers, ...this.mcpServers };
             const { args: mcpArgs, unsupported } = this.mcpArgs(servers);

package/dist/harness/pi.js

@@ -34,7 +34,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { PI_AUTH_VARS, PI_ENV_PREFIXES, finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveEnvScope, resolvePiProvider, resolveSandboxMode, scopeAgentEnv, withPushBlocked, } from "../agent-env.js";
+import { PI_AUTH_VARS, PI_ENV_PREFIXES, finishAgentEnv, heldCredentials, parseList, reportWithheldEnv, resolveEnvScope, resolvePiProvider, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
 import { PI_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
 import { gitCredentialPolicy } from "../git-credentials.js";
@@ -788,7 +788,7 @@ export class PiHarness {
             // Dry run: external MCP servers cannot be classified per tool (and a
             // `--tools` allowlist cannot name tools it has not seen), so only sweny's
             // own (already read-filtered) skill tools remain.
-            const servers = readOnly
+            const servers = mcpWithheld(readOnly, req.agentAccess)
                 ? {}
                 : { ...this.defaultMcpServers, ...req.mcpServers, ...this.mcpServers };
             const { entries, unsupported } = piMcpServers(servers);

package/dist/journal.d.ts

@@ -382,7 +382,7 @@ export declare class RunJournal implements ExecutionJournal {
     /** False once an append failed: the rest of the run is not journaled. */
     get active(): boolean;
     private takeLock;
-    /** The run dir is private (0700); its parents are created as usual. */
+    /** The run dir is private (0700); no link on the path from cwd is followed (safe-file.ts). */
     private makeDir;
     private releaseLock;
     private append;

package/dist/journal.js

@@ -59,6 +59,7 @@ import path from "node:path";
 import { resolveNodePermissions } from "./node-policy.js";
 import { CURRENT_SPEC_VERSION } from "./migrations.js";
 import { spendOf } from "./budget.js";
+import { ensureDirNoFollow, openNoFollow, writeFileNoFollow } from "./safe-file.js";
 /** v2: records are authenticated with a per-run HMAC key (v1 used a public checksum and is refused). */
 export const JOURNAL_SCHEMA_VERSION = 2;
 export const JOURNAL_DIR = path.join(".sweny", "runs");
@@ -1005,12 +1006,11 @@ export class RunJournal {
                 throw err;
         }
         this.makeDir();
-        fs.writeFileSync(lock, String(process.pid), { mode: 0o600 });
+        writeFileNoFollow(lock, String(process.pid), { root: this.cwd, mode: 0o600 });
     }
-    /** The run dir is private (0700); its parents are created as usual. */
+    /** The run dir is private (0700); no link on the path from cwd is followed (safe-file.ts). */
     makeDir() {
-        fs.mkdirSync(path.dirname(this.dir), { recursive: true });
-        fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        ensureDirNoFollow(this.dir, this.cwd);
     }
     releaseLock() {
         try {
@@ -1052,8 +1052,7 @@ export class RunJournal {
         try {
             if (this.fd === undefined) {
                 this.makeDir();
-                this.fd = fs.openSync(this.file, "a", 0o600);
-                fs.fchmodSync(this.fd, 0o600);
+                this.fd = openNoFollow(this.file, { root: this.cwd, append: true, mode: 0o600 });
             }
             fs.writeSync(this.fd, JSON.stringify(record) + "\n");
             fs.fsyncSync(this.fd);
@@ -1126,7 +1125,7 @@ export class RunJournal {
         try {
             this.makeDir();
             // Journals hold node output: keep them out of commits (an agent's `git add -A` included).
-            fs.writeFileSync(path.join(this.dir, ".gitignore"), "*\n");
+            writeFileNoFollow(path.join(this.dir, ".gitignore"), "*\n", { root: this.cwd, mode: 0o644 });
             this.takeLock();
         }
         catch {