@sweny-ai/core 0.1.176 → 0.1.178

package/dist/agent-env.d.ts

@@ -322,7 +322,16 @@ export interface AgentAccess {
      * hooks; only a sandbox stops a deliberate agent from undoing it.
      */
     noPush?: boolean;
+    /**
+     * The run is staged or a dry run: no skill or external MCP server reaches
+     * the node (an MCP server cannot be classified per tool, so it may write).
+     * Only sweny's own tool bridge, already filtered to read tools, remains,
+     * and Claude Code runs with `strictMcpConfig`. Same MCP rule as `readOnly`.
+     */
+    noMcp?: boolean;
 }
+/** True when a run request may load no MCP server but sweny's own bridge (read-only or staged). */
+export declare function mcpWithheld(readOnly: boolean, access: Pick<AgentAccess, "noMcp"> | undefined): boolean;
 /** Hosts reachable by sandboxed commands in every node: source hosting + package registries. */
 export declare const DEFAULT_SANDBOX_DOMAINS: readonly string[];
 /** Provider hosts added when a node references the built-in skill. */

package/dist/agent-env.js

@@ -814,6 +814,10 @@ export function grantedAgentEnv(agentEnv, opts) {
         return { grant: [], dropped: `agent_env withheld in a staged or dry run: ${names.join(", ")}` };
     return { grant: names };
 }
+/** True when a run request may load no MCP server but sweny's own bridge (read-only or staged). */
+export function mcpWithheld(readOnly, access) {
+    return readOnly || access?.noMcp === true;
+}
 /** Hosts reachable by sandboxed commands in every node: source hosting + package registries. */
 export const DEFAULT_SANDBOX_DOMAINS = [
     "github.com",

package/dist/cli/comment-output.js

@@ -6,8 +6,7 @@
  * METADATA ONLY. Node names, statuses, counts, and durations. Never prompts,
  * tool inputs, node outputs, errors, or model prose.
  */
-import fs from "node:fs";
-import path from "node:path";
+import { workspaceRoot, writeFileNoFollow } from "../safe-file.js";
 import { toMermaidBlock } from "../mermaid.js";
 import { formatReceiptDuration, nodeStates } from "./run-output.js";
 import { formatTicketText } from "./ticket.js";
@@ -77,10 +76,10 @@ export function formatCrashComment(workflow, summary, runId) {
 /** Write the comment markdown to `file`. Never throws; returns true only when written. */
 export function writeRunComment(file, workflow, results, summary, opts = {}) {
     try {
-        fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, opts.crashed
+        // The file may sit in the agent-writable workspace: no link on the path is followed.
+        writeFileNoFollow(file, opts.crashed
             ? formatCrashComment(workflow, summary, opts.runId)
-            : formatRunComment(workflow, results, summary, opts));
+            : formatRunComment(workflow, results, summary, opts), { ...workspaceRoot(file), mode: 0o644, dirMode: 0o755 });
         return true;
     }
     catch (err) {

package/dist/cli/config-file.d.ts

@@ -1,6 +1,20 @@
+/**
+ * Keys a workspace `.env` may never set. The workspace is agent-writable, and
+ * these name runtime or platform state sweny trusts as the operator's: CI and
+ * runner identity and the files the runner hands sweny to write
+ * (GITHUB_STEP_SUMMARY, GITHUB_OUTPUT, ...), where binaries are found (PATH),
+ * how Node and git behave (NODE_*, GIT_*), where traffic goes and which CAs it
+ * trusts (proxies, SSL/CA vars), and the home and temp dirs. A `.env` value
+ * for one of them is skipped with a warning. GITHUB_TOKEN is a credential the
+ * `.env` template documents, not platform state, so it stays allowed.
+ */
+export declare const DOTENV_DENIED_KEYS: RegExp;
+/** True when a workspace `.env` may not set `key` (see {@link DOTENV_DENIED_KEYS}). */
+export declare function isDotenvDenied(key: string): boolean;
 /**
  * Auto-load a `.env` file from the given directory.
- * Sets `process.env[KEY]` only if not already defined (real env vars win).
+ * Sets `process.env[KEY]` only if not already defined (real env vars win),
+ * and never a runtime or platform key ({@link DOTENV_DENIED_KEYS}).
  */
 export declare function loadDotenv(cwd?: string): void;
 /**
@@ -10,6 +24,27 @@ export declare function loadDotenv(cwd?: string): void;
  * treats as on/off.
  */
 export declare function applyAgentFileConfig(fileConfig: FileConfig, env?: NodeJS.ProcessEnv): void;
+/**
+ * Operator config for the decision model (#357), one trust domain per
+ * credential. `.sweny.yml` is repo content a pull request can change, so:
+ *
+ *  - SWENY_DECIDER_URL (operator env) may point anywhere public; only then is
+ *    SWENY_DECIDER_API_KEY sent, and only SWENY_DECIDER_ALLOW_PRIVATE=true
+ *    (env) admits loopback or private addresses.
+ *  - A `.sweny.yml` `decider: { url, model }` URL must be loopback (local
+ *    Ollama) and never gets a key.
+ *
+ * `trusted(key)` reads an operator env value; it must not see values a
+ * committed `.env` supplied. `noDecider` (`--no-decider`) returns false.
+ * Undefined when no URL and model are configured.
+ */
+export declare function operatorDeciderConfig(fileConfig: FileConfig, env: NodeJS.ProcessEnv, noDecider: boolean, trusted?: (key: string) => string | undefined): {
+    url: string;
+    model: string;
+    apiKey?: string;
+    allowPrivate?: boolean;
+    loopbackOnly?: boolean;
+} | false | undefined;
 /** Parsed config file — flat strings for scalar fields, arrays for list fields, objects for nested blocks. */
 export type FileConfig = Record<string, string | string[] | Record<string, unknown>>;
 /**
@@ -19,4 +54,4 @@ export type FileConfig = Record<string, string | string[] | Record<string, unkno
  */
 export declare function loadConfigFile(cwd?: string): FileConfig;
 /** Starter config written by `sweny new`. */
-export declare const STARTER_CONFIG = "# .sweny.yml \u2014 SWEny project configuration\n# Commit this file. Secrets (API keys, tokens) go in .env (gitignored).\n#\n# Every key matches a CLI flag: \"time-range: 4h\" is the same as \"--time-range 4h\".\n# CLI flags override this file; env vars override this file; this file overrides defaults.\n\n# \u2500\u2500 Providers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# observability-provider: datadog        # datadog | sentry | cloudwatch | splunk | elastic | newrelic | loki | prometheus | pagerduty | heroku | opsgenie | vercel | supabase | netlify | fly | render | file\n# issue-tracker-provider: github-issues  # github-issues | linear | jira\n# source-control-provider: github        # github | gitlab\n# coding-agent-provider: claude          # claude | codex | pi\n# notification-provider: console         # console | slack | teams | discord | email | webhook\n\n# \u2500\u2500 Investigation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# time-range: 24h\n# severity-focus: errors\n# service-filter: \"*\"\n# investigation-depth: standard          # quick | standard | thorough\n\n# \u2500\u2500 PR / branch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# base-branch: main\n# pr-labels: agent,triage,needs-review\n\n# \u2500\u2500 Paths \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# service-map-path: .github/service-map.yml\n# log-file: ./logs/errors.json           # required when observability-provider is \"file\"\n\n# \u2500\u2500 Cache \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# cache-dir: .sweny/cache\n# cache-ttl: 86400\n\n# \u2500\u2500 Run reporting \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Opt-in and not currently available: token minting is not yet exposed, so\n# leaving this unset means no reporting request is ever made.\n# cloud-token: sweny_pk_...\n# Or set SWENY_CLOUD_TOKEN in your environment.\n\n# \u2500\u2500 Agent sandbox \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# See https://docs.sweny.ai/advanced/agent-sandbox/\n# sandbox: off                           # off (local default) | auto (CI default: sandbox if supported, else warn) | strict\n# sandbox-allowed-domains: [internal.example.com]   # extra hosts agent commands may reach\n# env-scope: off                         # off (local default: full env) | on (CI default: allowlist)\n# env-passthrough: [NPM_TOKEN]           # extra env vars the agent may see when scoped (\"*\" = all)\n\n# \u2500\u2500 MCP servers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Extend the coding agent with additional tools via MCP.\n# Value is a JSON object \u2014 each key is a server name you choose.\n# See https://docs.sweny.ai/advanced/mcp-servers/ for a full catalog with copy-paste configs.\n#\n# Example: GitHub MCP server (query PRs, issues, CI run logs)\n# mcp-servers-json: '{\"github\":{\"type\":\"stdio\",\"command\":\"npx\",\"args\":[\"-y\",\"@modelcontextprotocol/server-github@latest\"],\"env\":{\"GITHUB_PERSONAL_ACCESS_TOKEN\":\"ghp_...\"}}}'\n\n# \u2500\u2500 Local-only quick start \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Uncomment to run without any external services (just an LLM API key):\n# observability-provider: file\n# log-file: ./sample-errors.json\n# issue-tracker-provider: file\n# source-control-provider: file\n# notification-provider: file\n# output-dir: .sweny/output\n\n# \u2500\u2500 Credentials (.env) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Copy the relevant block into your .env file and fill in the values.\n#\n# Claude (coding agent) \u2014 https://console.anthropic.com/settings/api-keys\n#   ANTHROPIC_API_KEY=sk-ant-...\n#\n# GitHub (source control + issue tracker)\n#   GITHUB_TOKEN=ghp_...        # https://github.com/settings/tokens (repo + issues scopes)\n#\n# Datadog (observability) \u2014 https://app.datadoghq.com/organization-settings\n#   DD_API_KEY=...              # Organization Settings > API Keys\n#   DD_APP_KEY=...              # Organization Settings > Application Keys\n#   DD_SITE=datadoghq.com       # or datadoghq.eu, us3.datadoghq.com, etc.\n#\n# Sentry (observability) \u2014 https://sentry.io/settings/auth-tokens/\n#   SENTRY_AUTH_TOKEN=sntrys_...\n#   SENTRY_ORG=your-org-slug    # from sentry.io/organizations/<slug>/\n#   SENTRY_PROJECT=your-project # Project Settings > General > Project Slug\n#\n# Linear (issue tracker) \u2014 https://linear.app/settings/api\n#   LINEAR_API_KEY=lin_api_...\n#   LINEAR_TEAM_ID=...          # Settings > Workspace > Teams > [team] > copy ID from URL\n#   LINEAR_BUG_LABEL_ID=...     # Settings > Labels > [label] > copy ID from URL\n#\n# Jira (issue tracker) \u2014 https://your-org.atlassian.net\n#   JIRA_BASE_URL=https://your-org.atlassian.net\n#   JIRA_EMAIL=you@company.com  # your Atlassian account email\n#   JIRA_API_TOKEN=...          # https://id.atlassian.com/manage-profile/security/api-tokens\n#\n# Vercel (observability) \u2014 https://vercel.com/account/tokens\n#   VERCEL_TOKEN=...\n#   VERCEL_PROJECT_ID=prj_...      # Project Settings > General > Project ID\n#   VERCEL_TEAM_ID=team_...        # optional, for team-owned projects\n#\n# Supabase (observability) \u2014 https://supabase.com/dashboard/account/tokens\n#   SUPABASE_MANAGEMENT_KEY=...\n#   SUPABASE_PROJECT_REF=...       # Project Settings > General > Reference ID\n#\n# Netlify (observability) \u2014 https://app.netlify.com/user/applications#personal-access-tokens\n#   NETLIFY_TOKEN=...\n#   NETLIFY_SITE_ID=...         # Site Settings > General > Site ID\n#\n# Fly.io (observability) \u2014 https://fly.io/user/personal_access_tokens\n#   FLY_TOKEN=...\n#   FLY_APP_NAME=...             # the name of your Fly.io application\n#\n# Render (observability) \u2014 https://dashboard.render.com/u/settings\n#   RENDER_API_KEY=...\n#   RENDER_SERVICE_ID=srv-...    # from your service's Settings page\n#\n# Prometheus (observability) \u2014 self-hosted or Grafana Cloud\n#   PROMETHEUS_URL=http://prometheus.internal:9090\n#   PROMETHEUS_TOKEN=...         # optional, for secured instances\n#\n# PagerDuty (observability) \u2014 https://your-account.pagerduty.com/api_keys\n#   PAGERDUTY_API_KEY=...\n#\n# Honeycomb (observability) \u2014 https://docs.honeycomb.io/api/\n#   HONEYCOMB_API_KEY=...\n#   HONEYCOMB_DATASET=...        # dataset name (e.g. production)\n#\n# Heroku (observability) \u2014 https://devcenter.heroku.com/articles/platform-api-reference\n#   HEROKU_API_KEY=...           # https://dashboard.heroku.com/account\n#   HEROKU_APP_NAME=...          # the name of your Heroku application\n#\n# OpsGenie (observability) \u2014 https://support.atlassian.com/opsgenie/docs/api-key-management/\n#   OPSGENIE_API_KEY=...\n#   OPSGENIE_REGION=us           # or eu for EU-hosted accounts\n#\n# Slack (notifications) \u2014 https://api.slack.com/apps\n#   NOTIFICATION_WEBHOOK_URL=https://hooks.slack.com/services/...\n#   # or use a bot token: SLACK_BOT_TOKEN=xoxb-...\n";
+export declare const STARTER_CONFIG = "# .sweny.yml \u2014 SWEny project configuration\n# Commit this file. Secrets (API keys, tokens) go in .env (gitignored).\n#\n# Every key matches a CLI flag: \"time-range: 4h\" is the same as \"--time-range 4h\".\n# CLI flags override this file; env vars override this file; this file overrides defaults.\n\n# \u2500\u2500 Providers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# observability-provider: datadog        # datadog | sentry | cloudwatch | splunk | elastic | newrelic | loki | prometheus | pagerduty | heroku | opsgenie | vercel | supabase | netlify | fly | render | file\n# issue-tracker-provider: github-issues  # github-issues | linear | jira\n# source-control-provider: github        # github | gitlab\n# coding-agent-provider: claude          # claude | codex | pi\n# notification-provider: console         # console | slack | teams | discord | email | webhook\n\n# \u2500\u2500 Investigation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# time-range: 24h\n# severity-focus: errors\n# service-filter: \"*\"\n# investigation-depth: standard          # quick | standard | thorough\n\n# \u2500\u2500 PR / branch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# base-branch: main\n# pr-labels: agent,triage,needs-review\n\n# \u2500\u2500 Paths \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# service-map-path: .github/service-map.yml\n# log-file: ./logs/errors.json           # required when observability-provider is \"file\"\n\n# \u2500\u2500 Cache \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# cache-dir: .sweny/cache\n# cache-ttl: 86400\n\n# \u2500\u2500 Run reporting \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Opt-in and not currently available: token minting is not yet exposed, so\n# leaving this unset means no reporting request is ever made.\n# cloud-token: sweny_pk_...\n# Or set SWENY_CLOUD_TOKEN in your environment.\n\n# \u2500\u2500 Agent sandbox \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# See https://docs.sweny.ai/advanced/agent-sandbox/\n# sandbox: off                           # off (local default) | auto (CI default: sandbox if supported, else warn) | strict\n# sandbox-allowed-domains: [internal.example.com]   # extra hosts agent commands may reach\n# env-scope: off                         # off (local default: full env) | on (CI default: allowlist)\n# env-passthrough: [NPM_TOKEN]           # extra env vars the agent may see when scoped (\"*\" = all)\n\n# \u2500\u2500 MCP servers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Extend the coding agent with additional tools via MCP.\n# Value is a JSON object \u2014 each key is a server name you choose.\n# See https://docs.sweny.ai/advanced/mcp-servers/ for a full catalog with copy-paste configs.\n#\n# Example: GitHub MCP server (query PRs, issues, CI run logs)\n# mcp-servers-json: '{\"github\":{\"type\":\"stdio\",\"command\":\"npx\",\"args\":[\"-y\",\"@modelcontextprotocol/server-github@latest\"],\"env\":{\"GITHUB_PERSONAL_ACCESS_TOKEN\":\"ghp_...\"}}}'\n\n# \u2500\u2500 Local-only quick start \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Uncomment to run without any external services (just an LLM API key):\n# observability-provider: file\n# log-file: ./sample-errors.json\n# issue-tracker-provider: file\n# source-control-provider: file\n# notification-provider: file\n# output-dir: .sweny/output\n\n# \u2500\u2500 Credentials (.env) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Copy the relevant block into your .env file and fill in the values.\n#\n# Claude (coding agent) \u2014 https://console.anthropic.com/settings/api-keys\n#   ANTHROPIC_API_KEY=sk-ant-...\n#\n# GitHub (source control + issue tracker)\n#   GITHUB_TOKEN=ghp_...        # https://github.com/settings/tokens (repo + issues scopes)\n#\n# Datadog (observability) \u2014 https://app.datadoghq.com/organization-settings\n#   DD_API_KEY=...              # Organization Settings > API Keys\n#   DD_APP_KEY=...              # Organization Settings > Application Keys\n#   DD_SITE=datadoghq.com       # or datadoghq.eu, us3.datadoghq.com, etc.\n#\n# Sentry (observability) \u2014 https://sentry.io/settings/auth-tokens/\n#   SENTRY_AUTH_TOKEN=sntrys_...\n#   SENTRY_ORG=your-org-slug    # from sentry.io/organizations/<slug>/\n#   SENTRY_PROJECT=your-project # Project Settings > General > Project Slug\n#\n# Linear (issue tracker) \u2014 https://linear.app/settings/api\n#   LINEAR_API_KEY=lin_api_...\n#   LINEAR_TEAM_ID=...          # Settings > Workspace > Teams > [team] > copy ID from URL\n#   LINEAR_BUG_LABEL_ID=...     # Settings > Labels > [label] > copy ID from URL\n#\n# Jira (issue tracker) \u2014 https://your-org.atlassian.net\n#   JIRA_BASE_URL=https://your-org.atlassian.net\n#   JIRA_EMAIL=you@company.com  # your Atlassian account email\n#   JIRA_API_TOKEN=...          # https://id.atlassian.com/manage-profile/security/api-tokens\n#\n# Vercel (observability) \u2014 https://vercel.com/account/tokens\n#   VERCEL_TOKEN=...\n#   VERCEL_PROJECT_ID=prj_...      # Project Settings > General > Project ID\n#   VERCEL_TEAM_ID=team_...        # optional, for team-owned projects\n#\n# Supabase (observability) \u2014 https://supabase.com/dashboard/account/tokens\n#   SUPABASE_MANAGEMENT_KEY=...\n#   SUPABASE_PROJECT_REF=...       # Project Settings > General > Reference ID\n#\n# Netlify (observability) \u2014 https://app.netlify.com/user/applications#personal-access-tokens\n#   NETLIFY_TOKEN=...\n#   NETLIFY_SITE_ID=...         # Site Settings > General > Site ID\n#\n# Fly.io (observability) \u2014 https://fly.io/user/personal_access_tokens\n#   FLY_TOKEN=...\n#   FLY_APP_NAME=...             # the name of your Fly.io application\n#\n# Render (observability) \u2014 https://dashboard.render.com/u/settings\n#   RENDER_API_KEY=...\n#   RENDER_SERVICE_ID=srv-...    # from your service's Settings page\n#\n# Prometheus (observability) \u2014 self-hosted or Grafana Cloud\n#   PROMETHEUS_URL=http://prometheus.internal:9090\n#   PROMETHEUS_TOKEN=...         # optional, for secured instances\n#\n# PagerDuty (observability) \u2014 https://your-account.pagerduty.com/api_keys\n#   PAGERDUTY_API_KEY=...\n#\n# Honeycomb (observability) \u2014 https://docs.honeycomb.io/api/\n#   HONEYCOMB_API_KEY=...\n#   HONEYCOMB_DATASET=...        # dataset name (e.g. production)\n#\n# Heroku (observability) \u2014 https://devcenter.heroku.com/articles/platform-api-reference\n#   HEROKU_API_KEY=...           # https://dashboard.heroku.com/account\n#   HEROKU_APP_NAME=...          # the name of your Heroku application\n#\n# OpsGenie (observability) \u2014 https://support.atlassian.com/opsgenie/docs/api-key-management/\n#   OPSGENIE_API_KEY=...\n#   OPSGENIE_REGION=us           # or eu for EU-hosted accounts\n#\n# Slack (notifications) \u2014 https://api.slack.com/apps\n#   NOTIFICATION_WEBHOOK_URL=https://hooks.slack.com/services/...\n#   # or use a bot token: SLACK_BOT_TOKEN=xoxb-...\n#\n# Decision model (optional) for nodes with route_by: decider. https://docs.sweny.ai/advanced/decision-models/\n#   Local Ollama: set it here (a URL in this file must be loopback and never gets a key):\n#     decider:\n#       url: http://localhost:11434\n#       model: nimble\n#   Remote server: set it in the CI or shell environment only, never in this file or .env:\n#     SWENY_DECIDER_URL=https://...  SWENY_DECIDER_MODEL=...  SWENY_DECIDER_API_KEY=...\n";

package/dist/cli/config-file.js

@@ -1,9 +1,27 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { parse as parseYaml } from "yaml";
+// Imported for its side effect too: the startup env snapshot is taken before loadDotenv runs.
+import { markWorkspaceEnv } from "../startup-env.js";
+/**
+ * Keys a workspace `.env` may never set. The workspace is agent-writable, and
+ * these name runtime or platform state sweny trusts as the operator's: CI and
+ * runner identity and the files the runner hands sweny to write
+ * (GITHUB_STEP_SUMMARY, GITHUB_OUTPUT, ...), where binaries are found (PATH),
+ * how Node and git behave (NODE_*, GIT_*), where traffic goes and which CAs it
+ * trusts (proxies, SSL/CA vars), and the home and temp dirs. A `.env` value
+ * for one of them is skipped with a warning. GITHUB_TOKEN is a credential the
+ * `.env` template documents, not platform state, so it stays allowed.
+ */
+export const DOTENV_DENIED_KEYS = /^(GITHUB_(?!TOKEN$)[A-Za-z0-9_]*|RUNNER_[A-Za-z0-9_]*|ACTIONS_[A-Za-z0-9_]*|CI|PATH|Path|NODE_[A-Za-z0-9_]*|GIT_[A-Za-z0-9_]*|(HTTPS?|ALL|NO|FTP)_PROXY|(https?|all|no|ftp)_proxy|SSL_CERT_FILE|SSL_CERT_DIR|CURL_CA_BUNDLE|REQUESTS_CA_BUNDLE|TMPDIR|TEMP|TMP|HOME|USERPROFILE)$/;
+/** True when a workspace `.env` may not set `key` (see {@link DOTENV_DENIED_KEYS}). */
+export function isDotenvDenied(key) {
+    return DOTENV_DENIED_KEYS.test(key);
+}
 /**
  * Auto-load a `.env` file from the given directory.
- * Sets `process.env[KEY]` only if not already defined (real env vars win).
+ * Sets `process.env[KEY]` only if not already defined (real env vars win),
+ * and never a runtime or platform key ({@link DOTENV_DENIED_KEYS}).
  */
 export function loadDotenv(cwd = process.cwd()) {
     const envPath = path.join(cwd, ".env");
@@ -27,9 +45,14 @@ export function loadDotenv(cwd = process.cwd()) {
         if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
             value = value.slice(1, -1);
         }
-        if (process.env[key] === undefined) {
-            process.env[key] = value;
+        if (process.env[key] !== undefined)
+            continue;
+        if (isDotenvDenied(key)) {
+            process.stderr.write(`  warning: .env sets ${key}, a runtime/platform variable; ignored\n`);
+            continue;
         }
+        process.env[key] = value;
+        markWorkspaceEnv(key);
     }
 }
 /**
@@ -68,6 +91,40 @@ export function applyAgentFileConfig(fileConfig, env = process.env) {
         }
     }
 }
+/**
+ * Operator config for the decision model (#357), one trust domain per
+ * credential. `.sweny.yml` is repo content a pull request can change, so:
+ *
+ *  - SWENY_DECIDER_URL (operator env) may point anywhere public; only then is
+ *    SWENY_DECIDER_API_KEY sent, and only SWENY_DECIDER_ALLOW_PRIVATE=true
+ *    (env) admits loopback or private addresses.
+ *  - A `.sweny.yml` `decider: { url, model }` URL must be loopback (local
+ *    Ollama) and never gets a key.
+ *
+ * `trusted(key)` reads an operator env value; it must not see values a
+ * committed `.env` supplied. `noDecider` (`--no-decider`) returns false.
+ * Undefined when no URL and model are configured.
+ */
+export function operatorDeciderConfig(fileConfig, env, noDecider, trusted = (key) => env[key]) {
+    if (noDecider)
+        return false;
+    const str = (v) => (typeof v === "string" && v.trim() ? v.trim() : undefined);
+    const model = str(trusted("SWENY_DECIDER_MODEL")) ?? str(env.SWENY_DECIDER_MODEL) ?? str(fileConfig["decider.model"]);
+    const envUrl = str(trusted("SWENY_DECIDER_URL"));
+    if (envUrl) {
+        if (!model)
+            return undefined;
+        const apiKey = str(trusted("SWENY_DECIDER_API_KEY"));
+        const allowPrivate = ["1", "true"].includes((str(trusted("SWENY_DECIDER_ALLOW_PRIVATE")) ?? "").toLowerCase());
+        return { url: envUrl, model, ...(apiKey ? { apiKey } : {}), ...(allowPrivate ? { allowPrivate } : {}) };
+    }
+    // Repo content: a URL a committed `.env` put in the environment (untrusted),
+    // else the `.sweny.yml` one. Loopback only, never a key.
+    const repoUrl = str(env.SWENY_DECIDER_URL) ?? str(fileConfig["decider.url"]);
+    if (!repoUrl || !model)
+        return undefined;
+    return { url: repoUrl, model, loopbackOnly: true };
+}
 /**
  * Search upward from `cwd` for `.sweny.yml` and parse it.
  * Scalar values are strings, list values (rules, context) are string arrays.
@@ -273,4 +330,12 @@ export const STARTER_CONFIG = `# .sweny.yml — SWEny project configuration
 # Slack (notifications) — https://api.slack.com/apps
 #   NOTIFICATION_WEBHOOK_URL=https://hooks.slack.com/services/...
 #   # or use a bot token: SLACK_BOT_TOKEN=xoxb-...
+#
+# Decision model (optional) for nodes with route_by: decider. https://docs.sweny.ai/advanced/decision-models/
+#   Local Ollama: set it here (a URL in this file must be loopback and never gets a key):
+#     decider:
+#       url: http://localhost:11434
+#       model: nimble
+#   Remote server: set it in the CI or shell environment only, never in this file or .env:
+#     SWENY_DECIDER_URL=https://...  SWENY_DECIDER_MODEL=...  SWENY_DECIDER_API_KEY=...
 `;

package/dist/cli/final-output.d.ts

@@ -57,5 +57,8 @@ export declare function formatFinalOutput(out: FinalOutput, opts?: {
 export declare function formatFinalMarkdown(workflow: Workflow, out: FinalOutput): string;
 /** Relative path shown to the user: `.sweny/runs/<id>/output.md`. */
 export declare function outputRelPath(runId: string): string;
-/** Write output.md (mode 0600). Local only. Returns the relative path, or null on failure. Never throws. */
+/**
+ * Write output.md (mode 0600). Local only. Returns the relative path, or null on failure. Never throws.
+ * The run dir is agent-writable: no link on the path is followed (see safe-file.ts).
+ */
 export declare function writeFinalOutput(runId: string, markdown: string, cwd?: string): string | null;

package/dist/cli/final-output.js

@@ -12,7 +12,7 @@
  * (`--show-output`), since CI logs are often visible to more people than the
  * repo's secrets are.
  */
-import fs from "node:fs";
+import { writeFileNoFollow } from "../safe-file.js";
 import path from "node:path";
 import { collectSecretValues, redact } from "../journal.js";
 import { RUN_HISTORY_DIR } from "./run-history.js";
@@ -186,16 +186,14 @@ export function formatFinalMarkdown(workflow, out) {
 export function outputRelPath(runId) {
     return path.posix.join(...RUN_HISTORY_DIR.split(path.sep), runId, "output.md");
 }
-/** Write output.md (mode 0600). Local only. Returns the relative path, or null on failure. Never throws. */
+/**
+ * Write output.md (mode 0600). Local only. Returns the relative path, or null on failure. Never throws.
+ * The run dir is agent-writable: no link on the path is followed (see safe-file.ts).
+ */
 export function writeFinalOutput(runId, markdown, cwd = process.cwd()) {
     try {
         const rel = outputRelPath(runId);
-        const file = path.join(cwd, rel);
-        fs.mkdirSync(path.dirname(path.dirname(file)), { recursive: true });
-        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-        fs.writeFileSync(file, markdown, { mode: 0o600 });
-        // mode only applies on create: a resumed run overwrites an existing file.
-        fs.chmodSync(file, 0o600);
+        writeFileNoFollow(path.join(cwd, rel), markdown, { root: cwd, mode: 0o600 });
         return rel;
     }
     catch {

package/dist/cli/main.d.ts

@@ -13,7 +13,8 @@ export declare function workflowRunAction(file: string | undefined, options: Rec
     maxTokens?: string;
     maxCost?: string;
     yes?: boolean;
-    decider?: string;
+    /** False with `--no-decider`. */
+    decider?: boolean;
 }, 
 /** Set by `sweny workflow resume` (#363): the journal, run id and original input. */
 resume?: ResumeContext): Promise<void>;

package/dist/cli/main.js

@@ -2,6 +2,7 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { createRequire } from "node:module";
+import { workspaceRoot, writeFileNoFollow } from "../safe-file.js";
 import { Command } from "commander";
 const _require = createRequire(import.meta.url);
 const { version } = _require("../../package.json");
@@ -28,7 +29,7 @@ import { toMermaidBlock } from "../mermaid.js";
 import { runWorkflowDiagram } from "./diagram.js";
 import { DagRenderer } from "./renderer.js";
 import * as readline from "node:readline";
-import { loadDotenv, loadConfigFile, applyAgentFileConfig } from "./config-file.js";
+import { loadDotenv, loadConfigFile, applyAgentFileConfig, operatorDeciderConfig } from "./config-file.js";
 import { buildCredentialMap } from "./credentials.js";
 import { nonInteractiveUsage, runNew } from "./new.js";
 import { formatFinalMarkdown, formatFinalOutput, formatSavedOutputLine, resolveFinalOutput, shouldPrintFinalOutput, writeFinalOutput, } from "./final-output.js";
@@ -57,6 +58,15 @@ import { beginCloudLifecycle, finishCloudLifecycle, createCloudStreamObserver }
 import { runUpgrade, fetchLatestFromNpm } from "./upgrade.js";
 import { maybeNudge, defaultCachePath } from "./version-check.js";
 import { spawnSync } from "node:child_process";
+import { trustedEnvValue } from "../startup-env.js";
+/** GITHUB_STEP_SUMMARY as the operator set it: never a value a workspace `.env` introduced. */
+function stepSummaryPath() {
+    return trustedEnvValue(process.env, "GITHUB_STEP_SUMMARY") || undefined;
+}
+/** Append to GITHUB_STEP_SUMMARY without following a link (the path may sit in the workspace). */
+function appendStepSummary(file, md) {
+    writeFileNoFollow(file, md, { ...workspaceRoot(file), append: true, mkdirs: false, mode: 0o644 });
+}
 /** Secret values a run can see, for redacting everything that prints node output. */
 function outputSecrets(skills) {
     return runSecretValues([...(skills?.values() ?? []), ...builtinSkills], process.env);
@@ -467,13 +477,13 @@ triageCmd.action(async (options) => {
             console.log(formatDagResultHuman(results, durationMs, config));
         }
         // GitHub Actions step summary
-        if (config.notificationProvider === "github-summary" && process.env.GITHUB_STEP_SUMMARY) {
+        if (config.notificationProvider === "github-summary" && stepSummaryPath()) {
             try {
                 const md = formatDagResultMarkdown(results, durationMs, config, {
                     workflow: triageWorkflow,
                     trace,
                 });
-                fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, md);
+                appendStepSummary(stepSummaryPath(), md);
             }
             catch (err) {
                 // Don't fail the run if the summary file can't be written
@@ -531,9 +541,9 @@ triageCmd.action(async (options) => {
             // silent — cloud reporting must never block or mask the crash
         }
         // Best-effort GitHub Actions step summary on crash
-        if (config.notificationProvider === "github-summary" && process.env.GITHUB_STEP_SUMMARY) {
+        if (config.notificationProvider === "github-summary" && stepSummaryPath()) {
             try {
-                fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, `## ❌ SWEny Triage Crashed\n\n\`\`\`\n${crashMsg}\n\`\`\`\n`);
+                appendStepSummary(stepSummaryPath(), `## ❌ SWEny Triage Crashed\n\n\`\`\`\n${crashMsg}\n\`\`\`\n`);
             }
             catch {
                 // ignore
@@ -743,10 +753,6 @@ export function loadWorkflowFile(filePath, knownSkills) {
 export async function workflowRunAction(file, options, 
 /** Set by `sweny workflow resume` (#363): the journal, run id and original input. */
 resume) {
-    if (options.decider !== undefined && options.decider !== "off" && options.decider !== "shadow") {
-        console.error(chalk.red(`\n  --decider must be off or shadow, got "${options.decider}"\n`));
-        process.exit(1);
-    }
     // Reject junk --timeout/--max-steps up front (both paths) instead of
     // silently falling back to a default.
     let budget;
@@ -1043,7 +1049,9 @@ resume) {
             fileRoot: config.fileRoot || undefined,
             signal,
             max_steps: wfMaxSteps,
-            ...(options.decider ? { decider: options.decider } : {}),
+            // One trust domain per credential (#357): a URL, key or allowance a
+            // committed .env introduced is repo content, read as untrusted.
+            decider: operatorDeciderConfig(fileConfig, process.env, options.decider === false, (k) => trustedEnvValue(process.env, k)),
             stageOutputs: options.stage === true,
             journal,
             ...(spendBudget ? { budget: spendBudget } : {}),

package/dist/cli/resume.js

@@ -34,6 +34,7 @@ export const RESUME_SHARED_RUN_FLAGS = [
     "--input <json>",
     "--agent <id>",
     "--harness-policy <mode>",
+    "--no-decider",
 ];
 /** One line per planned visit, for humans. */
 export function formatResumePlan(plan, mayRepeat) {

package/dist/cli/run-history.d.ts

@@ -10,7 +10,7 @@
  * builds on this format, so readers skip records with a version they do not
  * know instead of guessing.
  */
-import type { ExecutionEvent, ExecutionTrace, NodeResult, Workflow } from "../types.js";
+import type { ExecutionEvent, ExecutionTrace, NodeResult, RouteRung, Workflow } from "../types.js";
 export declare const RUN_HISTORY_SCHEMA_VERSION = 1;
 export declare const RUN_HISTORY_DIR: string;
 export declare const RUN_HISTORY_KEEP = 200;
@@ -43,9 +43,11 @@ export interface RunRecord {
     duration_ms: number;
     status: RunStatus;
     nodes: RunNodeRecord[];
+    /** Edges taken. `rung` says who chose a conditional route: expr, decider or agent (#357). */
     routes: Array<{
         from: string;
         to: string;
+        rung?: RouteRung;
     }>;
     totals: RunTotals;
     /** Harness that ran the nodes (id + version). Absent for runs with no harness-tagged result. */
@@ -55,12 +57,6 @@ export interface RunRecord {
     };
     /** Opinions the harness could not honor natively on some node, deduped. Absent when none. */
     degraded?: string[];
-    /** Shadow-mode decider agreement counts (#357). Absent when the decider was off. */
-    decider?: {
-        compared: number;
-        agreed: number;
-        fell_through: number;
-    };
 }
 /** sha256 (hex) of the workflow as canonical JSON: keys sorted, undefined dropped. */
 export declare function hashWorkflow(workflow: Workflow): string;

package/dist/cli/run-history.js

@@ -14,6 +14,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { summarizeRun } from "./run-output.js";
+import { openNoFollow } from "../safe-file.js";
 export const RUN_HISTORY_SCHEMA_VERSION = 1;
 export const RUN_HISTORY_DIR = path.join(".sweny", "runs");
 export const RUN_HISTORY_KEEP = 200;
@@ -102,7 +103,7 @@ export function buildRunRecord(i) {
         duration_ms: Math.max(0, Math.round(i.durationMs)),
         status: i.crashed ? "crashed" : summary.ok ? "success" : "failed",
         nodes,
-        routes: (i.trace?.edges ?? []).map((e) => ({ from: e.from, to: e.to })),
+        routes: (i.trace?.edges ?? []).map((e) => ({ from: e.from, to: e.to, ...(e.rung ? { rung: e.rung } : {}) })),
         totals: {
             nodes_total: summary.nodesTotal,
             nodes_ok: summary.nodesOk,
@@ -113,15 +114,6 @@ export function buildRunRecord(i) {
         },
         ...(harness ? { harness: { id: harness.id, version: harness.version } } : {}),
         ...(degraded.length > 0 ? { degraded } : {}),
-        ...(summary.decider
-            ? {
-                decider: {
-                    compared: summary.decider.compared,
-                    agreed: summary.decider.agreed,
-                    fell_through: summary.decider.fellThrough,
-                },
-            }
-            : {}),
     };
 }
 // ── Write, prune, read ──────────────────────────────────────────
@@ -131,8 +123,9 @@ export function writeRunRecord(record, cwd = process.cwd()) {
     const final = path.join(dir, `${record.run_id}.json`);
     const tmp = path.join(dir, `.${record.run_id}.json.${process.pid}.tmp`);
     try {
-        fs.mkdirSync(dir, { recursive: true });
-        const fd = fs.openSync(tmp, "w");
+        // The workspace is agent-writable: no link on the path is followed (safe-file.ts).
+        // rename() replaces a link at `final` itself, never its target.
+        const fd = openNoFollow(tmp, { root: cwd, mode: 0o644 });
         try {
             fs.writeSync(fd, JSON.stringify(record, null, 2) + "\n");
             fs.fsyncSync(fd);

package/dist/cli/run-output.d.ts

@@ -40,15 +40,19 @@ export interface RunSummary {
         spent: number;
     };
     /**
-     * Shadow-mode decider agreement (#357), counts only. `compared` decisions
-     * passed every gate; `agreed` matched the agent; the rest fell through.
-     * Absent when the decider was off or never consulted.
+     * Who decided the run's conditional routes (#357), counts only: a `when`
+     * expression, the decision model, or the agent. The decider and expression
+     * counts are routes with no agent call. Absent when no route was a decision.
      */
-    decider?: {
-        compared: number;
-        agreed: number;
-        fellThrough: number;
-    };
+    routes?: RouteCounts;
+    /** Why the decider did not run for some or all routes (missing config, breaker, cap). */
+    deciderOff?: string;
+}
+export interface RouteCounts {
+    total: number;
+    decider: number;
+    expr: number;
+    agent: number;
 }
 export interface RunPolicy {
     /** Agent env narrowed to the allowlist. Absent when no node reported it. */
@@ -68,6 +72,8 @@ export interface RunPolicy {
 export declare function degradedKey(entry: string): string;
 /** Sum the per-node results into one run summary. */
 export declare function summarizeRun(results: Map<string, NodeResult>, durationMs: number, crashed?: boolean, trace?: ExecutionTrace): RunSummary;
+/** Conditional routes by rung. Unconditional edges decide nothing and are not counted. */
+export declare function countRoutes(trace: ExecutionTrace): RouteCounts;
 /**
  * The policy facts the run knew, as short phrases: `env scoped`, `sandbox on`,
  * `1 output staged`. No phrase for a fact no node reported.
@@ -85,8 +91,8 @@ export declare function formatCost(usd: number): string;
 export declare function formatBudgetAmount(b: NonNullable<RunSummary["budget"]>): string;
 /** `budget exceeded: tokens 52k of 50k (run, at node gather)`. */
 export declare function formatBudgetOverrun(b: NonNullable<RunSummary["budget"]>): string;
-/** `agreed 4/5`, or `fell through 2/2` when no decision passed the gates. */
-export declare function formatDeciderCounts(d: NonNullable<RunSummary["decider"]>): string;
+/** `5 (3 decider, 1 expr, 1 agent)`: zero rungs are left out. */
+export declare function formatRouteCounts(r: RouteCounts): string;
 /**
  * One plain line: `✓ 3/3 nodes · 41 tool calls · 2m10s · 12k tokens · $0.18`.
  * Token and cost segments are omitted when the SDK reported none. A harness

package/dist/cli/run-output.js

@@ -5,12 +5,12 @@
  * METADATA ONLY. Nothing here reads prompts, node outputs, tool inputs, or
  * model prose: only counts, durations, token totals, and cost.
  */
-import fs from "node:fs";
+import { workspaceRoot, writeFileNoFollow } from "../safe-file.js";
 import { consoleLogger } from "../types.js";
-import { summarizeDecisions } from "../decider.js";
 import { toMermaidBlock } from "../mermaid.js";
 import { createPaint } from "./style.js";
 import { colorEnabled, glyphs } from "./terminal.js";
+import { trustedEnvValue } from "../startup-env.js";
 /** The short key of a `degraded` entry: the text before its first colon. */
 export function degradedKey(entry) {
     const i = entry.indexOf(":");
@@ -83,12 +83,20 @@ export function summarizeRun(results, durationMs, crashed = false, trace) {
         ...(degraded.size > 0 ? { degraded: [...degraded] } : {}),
         ...(Object.keys(policy).length > 0 ? { policy } : {}),
         ...(budget ? { budget } : {}),
-        ...(trace?.decisions && trace.decisions.length > 0 ? { decider: decisionCounts(trace) } : {}),
+        ...(trace && countRoutes(trace).total > 0 ? { routes: countRoutes(trace) } : {}),
+        ...(trace?.deciderOff ? { deciderOff: trace.deciderOff } : {}),
     };
 }
-function decisionCounts(trace) {
-    const d = summarizeDecisions(trace.decisions ?? []);
-    return { compared: d.compared, agreed: d.agreed, fellThrough: d.fell_through };
+/** Conditional routes by rung. Unconditional edges decide nothing and are not counted. */
+export function countRoutes(trace) {
+    const c = { total: 0, decider: 0, expr: 0, agent: 0 };
+    for (const e of trace.edges) {
+        if (!e.rung)
+            continue;
+        c.total++;
+        c[e.rung]++;
+    }
+    return c;
 }
 /**
  * The policy facts the run knew, as short phrases: `env scoped`, `sandbox on`,
@@ -156,9 +164,10 @@ export function formatBudgetAmount(b) {
 export function formatBudgetOverrun(b) {
     return `budget exceeded: ${formatBudgetAmount(b)} (${b.scope}, at node ${b.node})`;
 }
-/** `agreed 4/5`, or `fell through 2/2` when no decision passed the gates. */
-export function formatDeciderCounts(d) {
-    return d.compared > 0 ? `agreed ${d.agreed}/${d.compared}` : `fell through ${d.fellThrough}/${d.fellThrough}`;
+/** `5 (3 decider, 1 expr, 1 agent)`: zero rungs are left out. */
+export function formatRouteCounts(r) {
+    const parts = ["decider", "expr", "agent"].filter((k) => r[k] > 0).map((k) => `${r[k]} ${k}`);
+    return parts.length > 0 ? `${r.total} (${parts.join(", ")})` : String(r.total);
 }
 /**
  * One plain line: `✓ 3/3 nodes · 41 tool calls · 2m10s · 12k tokens · $0.18`.
@@ -179,7 +188,8 @@ export function formatReceipt(s) {
         ...(s.degraded && s.degraded.length > 0 ? [`degraded: ${s.degraded.join(", ")}`] : []),
         ...(formatPolicySegment(s.policy) ? [formatPolicySegment(s.policy)] : []),
         ...(s.budget ? [formatBudgetOverrun(s.budget)] : []),
-        ...(s.decider ? [`decider ${formatDeciderCounts(s.decider)}`] : []),
+        ...(s.routes && s.routes.total > 0 ? [`routes ${formatRouteCounts(s.routes)}`] : []),
+        ...(s.deciderOff ? [`decider off: ${s.deciderOff}`] : []),
     ];
     return parts.join(" · ");
 }
@@ -219,11 +229,18 @@ export function formatStepSummary(workflow, results, summary, trace) {
  * Never throws; returns true only when something was written.
  */
 export function writeStepSummary(workflow, results, summary, trace, env = process.env) {
-    const file = env.GITHUB_STEP_SUMMARY;
+    // The operator's value only: never one a workspace `.env` introduced.
+    const file = trustedEnvValue(env, "GITHUB_STEP_SUMMARY");
     if (!file)
         return false;
     try {
-        fs.appendFileSync(file, formatStepSummary(workflow, results, summary, trace));
+        // Never through a link, in case the path sits in the agent-writable workspace.
+        writeFileNoFollow(file, formatStepSummary(workflow, results, summary, trace), {
+            ...workspaceRoot(file),
+            append: true,
+            mkdirs: false,
+            mode: 0o644,
+        });
         return true;
     }
     catch (err) {
@@ -309,8 +326,5 @@ export const WORKFLOW_RUN_OPTIONS = [
         "--harness-policy <mode>",
         "strict: refuse a node whose policy the agent cannot enforce; warn: run it and report what was not enforced (default: strict under GitHub Actions, warn elsewhere; env SWENY_HARNESS_POLICY)",
     ],
-    [
-        "--decider <mode>",
-        "Decision model for route choices: off (default) or shadow. Shadow asks the workflow's decider.provider alongside the agent and reports agreement; the route is always the agent's. Needs decider.provider in the workflow (no default URL)",
-    ],
+    ["--no-decider", "Skip the decision model for this run: the agent decides the routes of route_by: decider nodes"],
 ];