@sweny-ai/core 0.1.177 → 0.1.179

package/dist/agent-env.d.ts

@@ -373,9 +373,11 @@ export declare function checkSandboxSupport(platform?: NodeJS.Platform, pathEnv?
 /**
  * The SDK sandbox settings used when the sandbox is on.
  *
- * - `failIfUnavailable`: true under `strict` (the SDK errors instead of
- *   running unsandboxed); false under `auto`, so a host that passes the
- *   preflight but still cannot start the sandbox degrades instead of failing.
+ * - `failIfUnavailable`: true whenever settings are built, `auto` included:
+ *   the preflight already passed, so a sandbox that then fails to start
+ *   fails the node instead of silently running the agent unsandboxed (which
+ *   the run would otherwise report as contained). `auto` on a host whose
+ *   preflight fails builds no settings and runs unsandboxed, reported as such.
  * - `allowUnsandboxedCommands: false`: the model cannot escape via the
  *   `dangerouslyDisableSandbox` parameter. Required, because nodes run under
  *   `bypassPermissions` (#365) which would otherwise auto-approve the escape.

package/dist/agent-env.js

@@ -29,7 +29,7 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
-import { runKeyDir } from "./journal.js";
+import { runStateRoot } from "./journal.js";
 // ─── Scoped env ──────────────────────────────────────────────────
 /**
  * Exact variable names always passed to the agent subprocess.
@@ -938,9 +938,11 @@ function defaultProbe() {
 /**
  * The SDK sandbox settings used when the sandbox is on.
  *
- * - `failIfUnavailable`: true under `strict` (the SDK errors instead of
- *   running unsandboxed); false under `auto`, so a host that passes the
- *   preflight but still cannot start the sandbox degrades instead of failing.
+ * - `failIfUnavailable`: true whenever settings are built, `auto` included:
+ *   the preflight already passed, so a sandbox that then fails to start
+ *   fails the node instead of silently running the agent unsandboxed (which
+ *   the run would otherwise report as contained). `auto` on a host whose
+ *   preflight fails builds no settings and runs unsandboxed, reported as such.
  * - `allowUnsandboxedCommands: false`: the model cannot escape via the
  *   `dangerouslyDisableSandbox` parameter. Required, because nodes run under
  *   `bypassPermissions` (#365) which would otherwise auto-approve the escape.
@@ -963,10 +965,12 @@ export function buildSandboxSettings(domains, opts = {}) {
             envVars: AGENT_AUTH_VARS.map((name) => ({ name, mode: "deny" })),
             files: [
                 { path: path.join(opts.home ?? homedir(), ".claude", ".credentials.json"), mode: "deny" },
-                // Run journal keys: an agent that could read them could forge journal records.
-                { path: runKeyDir(), mode: "deny" },
+                // Run journals and their keys: an agent that could read a key could forge records.
+                { path: runStateRoot(), mode: "deny" },
             ],
         },
+        // Nor may it write there: cut a journal, delete a lock, or plant a run.
+        filesystem: { denyRead: [runStateRoot()], denyWrite: [runStateRoot()] },
     };
 }
 /**
@@ -1003,7 +1007,8 @@ export function resolveAgentSandbox(opts) {
     return {
         mode,
         settings: buildSandboxSettings([...DEFAULT_SANDBOX_DOMAINS, ...(opts.nodeDomains ?? []), ...extra], {
-            failIfUnavailable: mode === "strict",
+            // Preflight passed: from here the sandbox is enforced or the node fails.
+            failIfUnavailable: true,
         }),
     };
 }

package/dist/cli/config-file.d.ts

@@ -24,6 +24,27 @@ export declare function loadDotenv(cwd?: string): void;
  * treats as on/off.
  */
 export declare function applyAgentFileConfig(fileConfig: FileConfig, env?: NodeJS.ProcessEnv): void;
+/**
+ * Operator config for the decision model (#357), one trust domain per
+ * credential. `.sweny.yml` is repo content a pull request can change, so:
+ *
+ *  - SWENY_DECIDER_URL (operator env) may point anywhere public; only then is
+ *    SWENY_DECIDER_API_KEY sent, and only SWENY_DECIDER_ALLOW_PRIVATE=true
+ *    (env) admits loopback or private addresses.
+ *  - A `.sweny.yml` `decider: { url, model }` URL must be loopback (local
+ *    Ollama) and never gets a key.
+ *
+ * `trusted(key)` reads an operator env value; it must not see values a
+ * committed `.env` supplied. `noDecider` (`--no-decider`) returns false.
+ * Undefined when no URL and model are configured.
+ */
+export declare function operatorDeciderConfig(fileConfig: FileConfig, env: NodeJS.ProcessEnv, noDecider: boolean, trusted?: (key: string) => string | undefined): {
+    url: string;
+    model: string;
+    apiKey?: string;
+    allowPrivate?: boolean;
+    loopbackOnly?: boolean;
+} | false | undefined;
 /** Parsed config file — flat strings for scalar fields, arrays for list fields, objects for nested blocks. */
 export type FileConfig = Record<string, string | string[] | Record<string, unknown>>;
 /**
@@ -33,4 +54,4 @@ export type FileConfig = Record<string, string | string[] | Record<string, unkno
  */
 export declare function loadConfigFile(cwd?: string): FileConfig;
 /** Starter config written by `sweny new`. */
-export declare const STARTER_CONFIG = "# .sweny.yml \u2014 SWEny project configuration\n# Commit this file. Secrets (API keys, tokens) go in .env (gitignored).\n#\n# Every key matches a CLI flag: \"time-range: 4h\" is the same as \"--time-range 4h\".\n# CLI flags override this file; env vars override this file; this file overrides defaults.\n\n# \u2500\u2500 Providers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# observability-provider: datadog        # datadog | sentry | cloudwatch | splunk | elastic | newrelic | loki | prometheus | pagerduty | heroku | opsgenie | vercel | supabase | netlify | fly | render | file\n# issue-tracker-provider: github-issues  # github-issues | linear | jira\n# source-control-provider: github        # github | gitlab\n# coding-agent-provider: claude          # claude | codex | pi\n# notification-provider: console         # console | slack | teams | discord | email | webhook\n\n# \u2500\u2500 Investigation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# time-range: 24h\n# severity-focus: errors\n# service-filter: \"*\"\n# investigation-depth: standard          # quick | standard | thorough\n\n# \u2500\u2500 PR / branch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# base-branch: main\n# pr-labels: agent,triage,needs-review\n\n# \u2500\u2500 Paths \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# service-map-path: .github/service-map.yml\n# log-file: ./logs/errors.json           # required when observability-provider is \"file\"\n\n# \u2500\u2500 Cache \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# cache-dir: .sweny/cache\n# cache-ttl: 86400\n\n# \u2500\u2500 Run reporting \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Opt-in and not currently available: token minting is not yet exposed, so\n# leaving this unset means no reporting request is ever made.\n# cloud-token: sweny_pk_...\n# Or set SWENY_CLOUD_TOKEN in your environment.\n\n# \u2500\u2500 Agent sandbox \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# See https://docs.sweny.ai/advanced/agent-sandbox/\n# sandbox: off                           # off (local default) | auto (CI default: sandbox if supported, else warn) | strict\n# sandbox-allowed-domains: [internal.example.com]   # extra hosts agent commands may reach\n# env-scope: off                         # off (local default: full env) | on (CI default: allowlist)\n# env-passthrough: [NPM_TOKEN]           # extra env vars the agent may see when scoped (\"*\" = all)\n\n# \u2500\u2500 MCP servers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Extend the coding agent with additional tools via MCP.\n# Value is a JSON object \u2014 each key is a server name you choose.\n# See https://docs.sweny.ai/advanced/mcp-servers/ for a full catalog with copy-paste configs.\n#\n# Example: GitHub MCP server (query PRs, issues, CI run logs)\n# mcp-servers-json: '{\"github\":{\"type\":\"stdio\",\"command\":\"npx\",\"args\":[\"-y\",\"@modelcontextprotocol/server-github@latest\"],\"env\":{\"GITHUB_PERSONAL_ACCESS_TOKEN\":\"ghp_...\"}}}'\n\n# \u2500\u2500 Local-only quick start \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Uncomment to run without any external services (just an LLM API key):\n# observability-provider: file\n# log-file: ./sample-errors.json\n# issue-tracker-provider: file\n# source-control-provider: file\n# notification-provider: file\n# output-dir: .sweny/output\n\n# \u2500\u2500 Credentials (.env) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Copy the relevant block into your .env file and fill in the values.\n#\n# Claude (coding agent) \u2014 https://console.anthropic.com/settings/api-keys\n#   ANTHROPIC_API_KEY=sk-ant-...\n#\n# GitHub (source control + issue tracker)\n#   GITHUB_TOKEN=ghp_...        # https://github.com/settings/tokens (repo + issues scopes)\n#\n# Datadog (observability) \u2014 https://app.datadoghq.com/organization-settings\n#   DD_API_KEY=...              # Organization Settings > API Keys\n#   DD_APP_KEY=...              # Organization Settings > Application Keys\n#   DD_SITE=datadoghq.com       # or datadoghq.eu, us3.datadoghq.com, etc.\n#\n# Sentry (observability) \u2014 https://sentry.io/settings/auth-tokens/\n#   SENTRY_AUTH_TOKEN=sntrys_...\n#   SENTRY_ORG=your-org-slug    # from sentry.io/organizations/<slug>/\n#   SENTRY_PROJECT=your-project # Project Settings > General > Project Slug\n#\n# Linear (issue tracker) \u2014 https://linear.app/settings/api\n#   LINEAR_API_KEY=lin_api_...\n#   LINEAR_TEAM_ID=...          # Settings > Workspace > Teams > [team] > copy ID from URL\n#   LINEAR_BUG_LABEL_ID=...     # Settings > Labels > [label] > copy ID from URL\n#\n# Jira (issue tracker) \u2014 https://your-org.atlassian.net\n#   JIRA_BASE_URL=https://your-org.atlassian.net\n#   JIRA_EMAIL=you@company.com  # your Atlassian account email\n#   JIRA_API_TOKEN=...          # https://id.atlassian.com/manage-profile/security/api-tokens\n#\n# Vercel (observability) \u2014 https://vercel.com/account/tokens\n#   VERCEL_TOKEN=...\n#   VERCEL_PROJECT_ID=prj_...      # Project Settings > General > Project ID\n#   VERCEL_TEAM_ID=team_...        # optional, for team-owned projects\n#\n# Supabase (observability) \u2014 https://supabase.com/dashboard/account/tokens\n#   SUPABASE_MANAGEMENT_KEY=...\n#   SUPABASE_PROJECT_REF=...       # Project Settings > General > Reference ID\n#\n# Netlify (observability) \u2014 https://app.netlify.com/user/applications#personal-access-tokens\n#   NETLIFY_TOKEN=...\n#   NETLIFY_SITE_ID=...         # Site Settings > General > Site ID\n#\n# Fly.io (observability) \u2014 https://fly.io/user/personal_access_tokens\n#   FLY_TOKEN=...\n#   FLY_APP_NAME=...             # the name of your Fly.io application\n#\n# Render (observability) \u2014 https://dashboard.render.com/u/settings\n#   RENDER_API_KEY=...\n#   RENDER_SERVICE_ID=srv-...    # from your service's Settings page\n#\n# Prometheus (observability) \u2014 self-hosted or Grafana Cloud\n#   PROMETHEUS_URL=http://prometheus.internal:9090\n#   PROMETHEUS_TOKEN=...         # optional, for secured instances\n#\n# PagerDuty (observability) \u2014 https://your-account.pagerduty.com/api_keys\n#   PAGERDUTY_API_KEY=...\n#\n# Honeycomb (observability) \u2014 https://docs.honeycomb.io/api/\n#   HONEYCOMB_API_KEY=...\n#   HONEYCOMB_DATASET=...        # dataset name (e.g. production)\n#\n# Heroku (observability) \u2014 https://devcenter.heroku.com/articles/platform-api-reference\n#   HEROKU_API_KEY=...           # https://dashboard.heroku.com/account\n#   HEROKU_APP_NAME=...          # the name of your Heroku application\n#\n# OpsGenie (observability) \u2014 https://support.atlassian.com/opsgenie/docs/api-key-management/\n#   OPSGENIE_API_KEY=...\n#   OPSGENIE_REGION=us           # or eu for EU-hosted accounts\n#\n# Slack (notifications) \u2014 https://api.slack.com/apps\n#   NOTIFICATION_WEBHOOK_URL=https://hooks.slack.com/services/...\n#   # or use a bot token: SLACK_BOT_TOKEN=xoxb-...\n";
+export declare const STARTER_CONFIG = "# .sweny.yml \u2014 SWEny project configuration\n# Commit this file. Secrets (API keys, tokens) go in .env (gitignored).\n#\n# Every key matches a CLI flag: \"time-range: 4h\" is the same as \"--time-range 4h\".\n# CLI flags override this file; env vars override this file; this file overrides defaults.\n\n# \u2500\u2500 Providers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# observability-provider: datadog        # datadog | sentry | cloudwatch | splunk | elastic | newrelic | loki | prometheus | pagerduty | heroku | opsgenie | vercel | supabase | netlify | fly | render | file\n# issue-tracker-provider: github-issues  # github-issues | linear | jira\n# source-control-provider: github        # github | gitlab\n# coding-agent-provider: claude          # claude | codex | pi\n# notification-provider: console         # console | slack | teams | discord | email | webhook\n\n# \u2500\u2500 Investigation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# time-range: 24h\n# severity-focus: errors\n# service-filter: \"*\"\n# investigation-depth: standard          # quick | standard | thorough\n\n# \u2500\u2500 PR / branch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# base-branch: main\n# pr-labels: agent,triage,needs-review\n\n# \u2500\u2500 Paths \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# service-map-path: .github/service-map.yml\n# log-file: ./logs/errors.json           # required when observability-provider is \"file\"\n\n# \u2500\u2500 Cache \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# cache-dir: .sweny/cache\n# cache-ttl: 86400\n\n# \u2500\u2500 Run reporting \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Opt-in and not currently available: token minting is not yet exposed, so\n# leaving this unset means no reporting request is ever made.\n# cloud-token: sweny_pk_...\n# Or set SWENY_CLOUD_TOKEN in your environment.\n\n# \u2500\u2500 Agent sandbox \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# See https://docs.sweny.ai/advanced/agent-sandbox/\n# sandbox: off                           # off (local default) | auto (CI default: sandbox if supported, else warn) | strict\n# sandbox-allowed-domains: [internal.example.com]   # extra hosts agent commands may reach\n# env-scope: off                         # off (local default: full env) | on (CI default: allowlist)\n# env-passthrough: [NPM_TOKEN]           # extra env vars the agent may see when scoped (\"*\" = all)\n\n# \u2500\u2500 MCP servers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Extend the coding agent with additional tools via MCP.\n# Value is a JSON object \u2014 each key is a server name you choose.\n# See https://docs.sweny.ai/advanced/mcp-servers/ for a full catalog with copy-paste configs.\n#\n# Example: GitHub MCP server (query PRs, issues, CI run logs)\n# mcp-servers-json: '{\"github\":{\"type\":\"stdio\",\"command\":\"npx\",\"args\":[\"-y\",\"@modelcontextprotocol/server-github@latest\"],\"env\":{\"GITHUB_PERSONAL_ACCESS_TOKEN\":\"ghp_...\"}}}'\n\n# \u2500\u2500 Local-only quick start \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Uncomment to run without any external services (just an LLM API key):\n# observability-provider: file\n# log-file: ./sample-errors.json\n# issue-tracker-provider: file\n# source-control-provider: file\n# notification-provider: file\n# output-dir: .sweny/output\n\n# \u2500\u2500 Credentials (.env) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Copy the relevant block into your .env file and fill in the values.\n#\n# Claude (coding agent) \u2014 https://console.anthropic.com/settings/api-keys\n#   ANTHROPIC_API_KEY=sk-ant-...\n#\n# GitHub (source control + issue tracker)\n#   GITHUB_TOKEN=ghp_...        # https://github.com/settings/tokens (repo + issues scopes)\n#\n# Datadog (observability) \u2014 https://app.datadoghq.com/organization-settings\n#   DD_API_KEY=...              # Organization Settings > API Keys\n#   DD_APP_KEY=...              # Organization Settings > Application Keys\n#   DD_SITE=datadoghq.com       # or datadoghq.eu, us3.datadoghq.com, etc.\n#\n# Sentry (observability) \u2014 https://sentry.io/settings/auth-tokens/\n#   SENTRY_AUTH_TOKEN=sntrys_...\n#   SENTRY_ORG=your-org-slug    # from sentry.io/organizations/<slug>/\n#   SENTRY_PROJECT=your-project # Project Settings > General > Project Slug\n#\n# Linear (issue tracker) \u2014 https://linear.app/settings/api\n#   LINEAR_API_KEY=lin_api_...\n#   LINEAR_TEAM_ID=...          # Settings > Workspace > Teams > [team] > copy ID from URL\n#   LINEAR_BUG_LABEL_ID=...     # Settings > Labels > [label] > copy ID from URL\n#\n# Jira (issue tracker) \u2014 https://your-org.atlassian.net\n#   JIRA_BASE_URL=https://your-org.atlassian.net\n#   JIRA_EMAIL=you@company.com  # your Atlassian account email\n#   JIRA_API_TOKEN=...          # https://id.atlassian.com/manage-profile/security/api-tokens\n#\n# Vercel (observability) \u2014 https://vercel.com/account/tokens\n#   VERCEL_TOKEN=...\n#   VERCEL_PROJECT_ID=prj_...      # Project Settings > General > Project ID\n#   VERCEL_TEAM_ID=team_...        # optional, for team-owned projects\n#\n# Supabase (observability) \u2014 https://supabase.com/dashboard/account/tokens\n#   SUPABASE_MANAGEMENT_KEY=...\n#   SUPABASE_PROJECT_REF=...       # Project Settings > General > Reference ID\n#\n# Netlify (observability) \u2014 https://app.netlify.com/user/applications#personal-access-tokens\n#   NETLIFY_TOKEN=...\n#   NETLIFY_SITE_ID=...         # Site Settings > General > Site ID\n#\n# Fly.io (observability) \u2014 https://fly.io/user/personal_access_tokens\n#   FLY_TOKEN=...\n#   FLY_APP_NAME=...             # the name of your Fly.io application\n#\n# Render (observability) \u2014 https://dashboard.render.com/u/settings\n#   RENDER_API_KEY=...\n#   RENDER_SERVICE_ID=srv-...    # from your service's Settings page\n#\n# Prometheus (observability) \u2014 self-hosted or Grafana Cloud\n#   PROMETHEUS_URL=http://prometheus.internal:9090\n#   PROMETHEUS_TOKEN=...         # optional, for secured instances\n#\n# PagerDuty (observability) \u2014 https://your-account.pagerduty.com/api_keys\n#   PAGERDUTY_API_KEY=...\n#\n# Honeycomb (observability) \u2014 https://docs.honeycomb.io/api/\n#   HONEYCOMB_API_KEY=...\n#   HONEYCOMB_DATASET=...        # dataset name (e.g. production)\n#\n# Heroku (observability) \u2014 https://devcenter.heroku.com/articles/platform-api-reference\n#   HEROKU_API_KEY=...           # https://dashboard.heroku.com/account\n#   HEROKU_APP_NAME=...          # the name of your Heroku application\n#\n# OpsGenie (observability) \u2014 https://support.atlassian.com/opsgenie/docs/api-key-management/\n#   OPSGENIE_API_KEY=...\n#   OPSGENIE_REGION=us           # or eu for EU-hosted accounts\n#\n# Slack (notifications) \u2014 https://api.slack.com/apps\n#   NOTIFICATION_WEBHOOK_URL=https://hooks.slack.com/services/...\n#   # or use a bot token: SLACK_BOT_TOKEN=xoxb-...\n#\n# Decision model (optional) for nodes with route_by: decider. https://docs.sweny.ai/advanced/decision-models/\n#   Local Ollama: set it here (a URL in this file must be loopback and never gets a key):\n#     decider:\n#       url: http://localhost:11434\n#       model: nimble\n#   Remote server: set it in the CI or shell environment only, never in this file or .env:\n#     SWENY_DECIDER_URL=https://...  SWENY_DECIDER_MODEL=...  SWENY_DECIDER_API_KEY=...\n";

package/dist/cli/config-file.js

@@ -91,6 +91,40 @@ export function applyAgentFileConfig(fileConfig, env = process.env) {
         }
     }
 }
+/**
+ * Operator config for the decision model (#357), one trust domain per
+ * credential. `.sweny.yml` is repo content a pull request can change, so:
+ *
+ *  - SWENY_DECIDER_URL (operator env) may point anywhere public; only then is
+ *    SWENY_DECIDER_API_KEY sent, and only SWENY_DECIDER_ALLOW_PRIVATE=true
+ *    (env) admits loopback or private addresses.
+ *  - A `.sweny.yml` `decider: { url, model }` URL must be loopback (local
+ *    Ollama) and never gets a key.
+ *
+ * `trusted(key)` reads an operator env value; it must not see values a
+ * committed `.env` supplied. `noDecider` (`--no-decider`) returns false.
+ * Undefined when no URL and model are configured.
+ */
+export function operatorDeciderConfig(fileConfig, env, noDecider, trusted = (key) => env[key]) {
+    if (noDecider)
+        return false;
+    const str = (v) => (typeof v === "string" && v.trim() ? v.trim() : undefined);
+    const model = str(trusted("SWENY_DECIDER_MODEL")) ?? str(env.SWENY_DECIDER_MODEL) ?? str(fileConfig["decider.model"]);
+    const envUrl = str(trusted("SWENY_DECIDER_URL"));
+    if (envUrl) {
+        if (!model)
+            return undefined;
+        const apiKey = str(trusted("SWENY_DECIDER_API_KEY"));
+        const allowPrivate = ["1", "true"].includes((str(trusted("SWENY_DECIDER_ALLOW_PRIVATE")) ?? "").toLowerCase());
+        return { url: envUrl, model, ...(apiKey ? { apiKey } : {}), ...(allowPrivate ? { allowPrivate } : {}) };
+    }
+    // Repo content: a URL a committed `.env` put in the environment (untrusted),
+    // else the `.sweny.yml` one. Loopback only, never a key.
+    const repoUrl = str(env.SWENY_DECIDER_URL) ?? str(fileConfig["decider.url"]);
+    if (!repoUrl || !model)
+        return undefined;
+    return { url: repoUrl, model, loopbackOnly: true };
+}
 /**
  * Search upward from `cwd` for `.sweny.yml` and parse it.
  * Scalar values are strings, list values (rules, context) are string arrays.
@@ -296,4 +330,12 @@ export const STARTER_CONFIG = `# .sweny.yml — SWEny project configuration
 # Slack (notifications) — https://api.slack.com/apps
 #   NOTIFICATION_WEBHOOK_URL=https://hooks.slack.com/services/...
 #   # or use a bot token: SLACK_BOT_TOKEN=xoxb-...
+#
+# Decision model (optional) for nodes with route_by: decider. https://docs.sweny.ai/advanced/decision-models/
+#   Local Ollama: set it here (a URL in this file must be loopback and never gets a key):
+#     decider:
+#       url: http://localhost:11434
+#       model: nimble
+#   Remote server: set it in the CI or shell environment only, never in this file or .env:
+#     SWENY_DECIDER_URL=https://...  SWENY_DECIDER_MODEL=...  SWENY_DECIDER_API_KEY=...
 `;

package/dist/cli/final-output.js

@@ -193,7 +193,10 @@ export function outputRelPath(runId) {
 export function writeFinalOutput(runId, markdown, cwd = process.cwd()) {
     try {
         const rel = outputRelPath(runId);
-        writeFileNoFollow(path.join(cwd, rel), markdown, { root: cwd, mode: 0o600 });
+        const file = path.join(cwd, rel);
+        // Node output: keep the run dir out of commits (an agent's `git add -A` included).
+        writeFileNoFollow(path.join(path.dirname(file), ".gitignore"), "*\n", { root: cwd, mode: 0o644 });
+        writeFileNoFollow(file, markdown, { root: cwd, mode: 0o600 });
         return rel;
     }
     catch {

package/dist/cli/main.d.ts

@@ -13,7 +13,8 @@ export declare function workflowRunAction(file: string | undefined, options: Rec
     maxTokens?: string;
     maxCost?: string;
     yes?: boolean;
-    decider?: string;
+    /** False with `--no-decider`. */
+    decider?: boolean;
 }, 
 /** Set by `sweny workflow resume` (#363): the journal, run id and original input. */
 resume?: ResumeContext): Promise<void>;

package/dist/cli/main.js

@@ -29,7 +29,7 @@ import { toMermaidBlock } from "../mermaid.js";
 import { runWorkflowDiagram } from "./diagram.js";
 import { DagRenderer } from "./renderer.js";
 import * as readline from "node:readline";
-import { loadDotenv, loadConfigFile, applyAgentFileConfig } from "./config-file.js";
+import { loadDotenv, loadConfigFile, applyAgentFileConfig, operatorDeciderConfig } from "./config-file.js";
 import { buildCredentialMap } from "./credentials.js";
 import { nonInteractiveUsage, runNew } from "./new.js";
 import { formatFinalMarkdown, formatFinalOutput, formatSavedOutputLine, resolveFinalOutput, shouldPrintFinalOutput, writeFinalOutput, } from "./final-output.js";
@@ -753,10 +753,6 @@ export function loadWorkflowFile(filePath, knownSkills) {
 export async function workflowRunAction(file, options, 
 /** Set by `sweny workflow resume` (#363): the journal, run id and original input. */
 resume) {
-    if (options.decider !== undefined && options.decider !== "off" && options.decider !== "shadow") {
-        console.error(chalk.red(`\n  --decider must be off or shadow, got "${options.decider}"\n`));
-        process.exit(1);
-    }
     // Reject junk --timeout/--max-steps up front (both paths) instead of
     // silently falling back to a default.
     let budget;
@@ -1053,7 +1049,9 @@ resume) {
             fileRoot: config.fileRoot || undefined,
             signal,
             max_steps: wfMaxSteps,
-            ...(options.decider ? { decider: options.decider } : {}),
+            // One trust domain per credential (#357): a URL, key or allowance a
+            // committed .env introduced is repo content, read as untrusted.
+            decider: operatorDeciderConfig(fileConfig, process.env, options.decider === false, (k) => trustedEnvValue(process.env, k)),
             stageOutputs: options.stage === true,
             journal,
             ...(spendBudget ? { budget: spendBudget } : {}),
@@ -1145,8 +1143,9 @@ resume) {
         progress.stop();
         console.error(formatCrashError(err));
         runLogger.flush();
+        const resumable = journal?.active === true;
         journal?.end("crashed");
-        if (journal)
+        if (resumable)
             console.error(c.subtle(`  resume with: sweny workflow resume ${runId}`));
         recordHistory(nodeTimer.lastResults, undefined, true);
         const crashSummary = summarizeRun(new Map(), Date.now() - runStart, true);
@@ -1257,7 +1256,7 @@ for (const [flags, description] of WORKFLOW_RUN_OPTIONS) {
 }
 workflowRunCmd.option("--no-history", "Do not record this run or save its output.md in .sweny/runs/ (or set `history: off` in .sweny.yml)");
 workflowRunCmd.option("--show-output", "Print the final answer in CI too (off by default in CI: only the path to output.md is printed)");
-workflowRunCmd.option("--no-journal", "Do not write a run journal to .sweny/runs/<run-id>/ (or set `journal: off` in .sweny.yml); the run cannot be resumed");
+workflowRunCmd.option("--no-journal", "Do not write a run journal (kept in the sweny state dir; or set `journal: off` in .sweny.yml); the run cannot be resumed");
 const workflowResumeCmd = workflowCmd
     .command("resume <run-id>")
     .description("Resume a killed or failed `workflow run` from its journal: finished nodes are replayed without calling the agent, " +

package/dist/cli/resume.d.ts

@@ -6,7 +6,7 @@
  * Lives outside main.ts so tests can import it (main.ts parses argv on import).
  */
 import type { Logger, Workflow } from "../types.js";
-import { RunJournal, type ResumePlan } from "../journal.js";
+import { RunJournal, type LockHooks, type ResumePlan } from "../journal.js";
 /** `sweny workflow resume` options (commander camelCases the flags). */
 export interface ResumeOptions {
     force?: boolean;
@@ -48,9 +48,18 @@ export interface PrepareResumeDeps {
     swenyVersion?: string;
     env?: Record<string, string | undefined>;
     logger?: Logger;
+    /** Where run journals live (default: {@link runStateRoot} of `env`). */
+    stateRoot?: string;
+    /** Test seam for the run lock. */
+    lockHooks?: LockHooks;
 }
 /** One line per planned visit, for humans. */
 export declare function formatResumePlan(plan: ResumePlan, mayRepeat: string[]): string[];
+/**
+ * Check a run journal and build the resume. The run's lock is taken first,
+ * before anything is read or repaired, and is kept by the returned journal
+ * (released on every other outcome, `--plan` included).
+ */
 export declare function prepareResume(ref: string, opts: ResumeOptions, deps: PrepareResumeDeps): PrepareResumeResult;
 /** Journal is on unless `--no-journal` (options.journal === false) or `.sweny.yml` has `journal: off`. */
 export declare function journalDisabled(optionJournal: unknown, configJournal: unknown): boolean;

package/dist/cli/resume.js

@@ -7,7 +7,8 @@
  */
 import path from "node:path";
 import { validateRuntimeInput } from "../inputs.js";
-import { JOURNAL_DIR, JOURNAL_FILE, JournalKeyError, JournalLockedError, JournalVersionError, RunJournal, buildResumePlan, canonicalHash, checkJournalAgainstWorkflow, findJournalRun, journalDir, mayRepeatWrites, readJournal, workflowHashOf, } from "../journal.js";
+import { existsSync } from "node:fs";
+import { JournalKeyError, JournalLocationError, assertStateOutsideWorkspace, JournalLockedError, JournalRollbackError, JournalVersionError, RunJournal, buildResumePlan, canonicalHash, checkJournalAgainstWorkflow, findJournalRun, findLegacyJournal, journalFile, lockRun, mayRepeatWrites, readJournal, runStateRoot, workflowHashOf, } from "../journal.js";
 import { parseInputFlag } from "./workflow-input.js";
 /** Resume-only flags; the rest are shared with `workflow run`. */
 export const WORKFLOW_RESUME_OPTIONS = [
@@ -34,6 +35,7 @@ export const RESUME_SHARED_RUN_FLAGS = [
     "--input <json>",
     "--agent <id>",
     "--harness-policy <mode>",
+    "--no-decider",
 ];
 /** One line per planned visit, for humans. */
 export function formatResumePlan(plan, mayRepeat) {
@@ -68,23 +70,80 @@ export function formatResumePlan(plan, mayRepeat) {
         lines.push("  every node finished; the resume only closes the run");
     return lines;
 }
+/**
+ * Check a run journal and build the resume. The run's lock is taken first,
+ * before anything is read or repaired, and is kept by the returned journal
+ * (released on every other outcome, `--plan` included).
+ */
 export function prepareResume(ref, opts, deps) {
     const cwd = deps.cwd ?? process.cwd();
-    const lines = [];
-    const fail = (error) => ({ ok: false, error, lines });
-    const runId = findJournalRun(ref, cwd);
+    const root = deps.stateRoot ?? runStateRoot(deps.env ?? process.env);
+    // A state dir that resolves into the workspace is agent-writable: nothing in it can be trusted.
+    if (existsSync(root)) {
+        try {
+            assertStateOutsideWorkspace(root, cwd);
+        }
+        catch (err) {
+            if (err instanceof JournalLocationError)
+                return { ok: false, lines: [], error: err.message };
+            throw err;
+        }
+    }
+    const runId = findJournalRun(ref, cwd, root);
     if (!runId) {
-        return fail(`no run journal matches "${ref}" in ${JOURNAL_DIR}/. Runs started with --no-journal (or before journals existed) cannot be resumed.`);
+        const legacy = findLegacyJournal(ref, cwd);
+        if (legacy) {
+            return {
+                ok: false,
+                lines: [],
+                error: `run ${ref} has a journal in the workspace (${path.relative(cwd, legacy)}), written by an older sweny. ` +
+                    `Journals now live in the sweny state dir, where agents cannot edit them; a workspace journal cannot ` +
+                    `be resumed safely. Start a new run.`,
+            };
+        }
+        return {
+            ok: false,
+            lines: [],
+            error: `no run journal matches "${ref}" for this workspace in ${root}. Runs started with --no-journal ` +
+                `(or by another user or state dir) cannot be resumed.`,
+        };
+    }
+    let lock;
+    try {
+        lock = lockRun(cwd, runId, root, deps.lockHooks);
+    }
+    catch (err) {
+        const error = err instanceof Error ? err.message : String(err);
+        return {
+            ok: false,
+            lines: [],
+            error: err instanceof JournalLockedError ? error : `cannot lock run ${runId}: ${error}`,
+        };
     }
-    const file = path.join(journalDir(cwd, runId), JOURNAL_FILE);
+    let result;
+    try {
+        result = prepareLocked(runId, journalFile(cwd, runId, root), lock, opts, deps, cwd, root);
+    }
+    catch (err) {
+        lock.release();
+        throw err;
+    }
+    if (!(result.ok && "ctx" in result))
+        lock.release();
+    return result;
+}
+function prepareLocked(runId, file, lock, opts, deps, cwd, root) {
+    const lines = [];
+    const fail = (error) => ({ ok: false, error, lines });
     let read;
     try {
         // --plan stays read-only: a torn tail is reported, not cut.
         read = readJournal(file, { repair: !opts.plan });
     }
     catch (err) {
-        if (err instanceof JournalVersionError || err instanceof JournalKeyError)
+        if (err instanceof JournalVersionError || err instanceof JournalKeyError || err instanceof JournalRollbackError) {
             return fail(err.message);
+        }
         return fail(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
     }
     if (read.forgedAtLine !== undefined) {
@@ -100,6 +159,11 @@ export function prepareResume(ref, opts, deps) {
             ? `note: the journal ends in a torn record (${read.truncatedBytes} bytes); resuming drops it`
             : `note: dropped a torn record at the end of the journal (${read.truncatedBytes} bytes)`);
     }
+    if (read.restored) {
+        lines.push(opts.plan
+            ? `note: the journal's last record was not appended before the crash; resuming restores it from the head`
+            : `note: restored the journal's last record from the head (the run stopped before appending it)`);
+    }
     let plan;
     try {
         plan = buildResumePlan(read.records);
@@ -153,6 +217,10 @@ export function prepareResume(ref, opts, deps) {
     }
     const mayRepeat = mayRepeatWrites(plan, workflow, input);
     lines.push(...formatResumePlan(plan, mayRepeat));
+    if (plan.unsandboxed.length > 0) {
+        lines.push(`warning: an earlier attempt ran ${plan.unsandboxed.join(", ")} without an enforced sandbox, so that agent ` +
+            `could have read the run key and edited this run's journaled spend and write records (journal_unsandboxed)`);
+    }
     if (opts.plan)
         return { ok: true, planOnly: true, lines };
     if (mayRepeat.length > 0 && !opts.allowRepeatWrites) {
@@ -169,8 +237,10 @@ export function prepareResume(ref, opts, deps) {
             swenyVersion: deps.swenyVersion,
             env: deps.env,
             logger: deps.logger,
+            stateRoot: root,
             read,
             plan,
+            lock,
             force: opts.force === true,
             allowRepeatWrites: opts.allowRepeatWrites === true,
         });

package/dist/cli/run-history.d.ts

@@ -10,7 +10,7 @@
  * builds on this format, so readers skip records with a version they do not
  * know instead of guessing.
  */
-import type { ExecutionEvent, ExecutionTrace, NodeResult, Workflow } from "../types.js";
+import type { ExecutionEvent, ExecutionTrace, NodeResult, RouteRung, Workflow } from "../types.js";
 export declare const RUN_HISTORY_SCHEMA_VERSION = 1;
 export declare const RUN_HISTORY_DIR: string;
 export declare const RUN_HISTORY_KEEP = 200;
@@ -43,9 +43,11 @@ export interface RunRecord {
     duration_ms: number;
     status: RunStatus;
     nodes: RunNodeRecord[];
+    /** Edges taken. `rung` says who chose a conditional route: expr, decider or agent (#357). */
     routes: Array<{
         from: string;
         to: string;
+        rung?: RouteRung;
     }>;
     totals: RunTotals;
     /** Harness that ran the nodes (id + version). Absent for runs with no harness-tagged result. */
@@ -55,12 +57,6 @@ export interface RunRecord {
     };
     /** Opinions the harness could not honor natively on some node, deduped. Absent when none. */
     degraded?: string[];
-    /** Shadow-mode decider agreement counts (#357). Absent when the decider was off. */
-    decider?: {
-        compared: number;
-        agreed: number;
-        fell_through: number;
-    };
 }
 /** sha256 (hex) of the workflow as canonical JSON: keys sorted, undefined dropped. */
 export declare function hashWorkflow(workflow: Workflow): string;

package/dist/cli/run-history.js

@@ -103,7 +103,7 @@ export function buildRunRecord(i) {
         duration_ms: Math.max(0, Math.round(i.durationMs)),
         status: i.crashed ? "crashed" : summary.ok ? "success" : "failed",
         nodes,
-        routes: (i.trace?.edges ?? []).map((e) => ({ from: e.from, to: e.to })),
+        routes: (i.trace?.edges ?? []).map((e) => ({ from: e.from, to: e.to, ...(e.rung ? { rung: e.rung } : {}) })),
         totals: {
             nodes_total: summary.nodesTotal,
             nodes_ok: summary.nodesOk,
@@ -114,15 +114,6 @@ export function buildRunRecord(i) {
         },
         ...(harness ? { harness: { id: harness.id, version: harness.version } } : {}),
         ...(degraded.length > 0 ? { degraded } : {}),
-        ...(summary.decider
-            ? {
-                decider: {
-                    compared: summary.decider.compared,
-                    agreed: summary.decider.agreed,
-                    fell_through: summary.decider.fellThrough,
-                },
-            }
-            : {}),
     };
 }
 // ── Write, prune, read ──────────────────────────────────────────

package/dist/cli/run-output.d.ts

@@ -40,15 +40,19 @@ export interface RunSummary {
         spent: number;
     };
     /**
-     * Shadow-mode decider agreement (#357), counts only. `compared` decisions
-     * passed every gate; `agreed` matched the agent; the rest fell through.
-     * Absent when the decider was off or never consulted.
+     * Who decided the run's conditional routes (#357), counts only: a `when`
+     * expression, the decision model, or the agent. The decider and expression
+     * counts are routes with no agent call. Absent when no route was a decision.
      */
-    decider?: {
-        compared: number;
-        agreed: number;
-        fellThrough: number;
-    };
+    routes?: RouteCounts;
+    /** Why the decider did not run for some or all routes (missing config, breaker, cap). */
+    deciderOff?: string;
+}
+export interface RouteCounts {
+    total: number;
+    decider: number;
+    expr: number;
+    agent: number;
 }
 export interface RunPolicy {
     /** Agent env narrowed to the allowlist. Absent when no node reported it. */
@@ -68,6 +72,8 @@ export interface RunPolicy {
 export declare function degradedKey(entry: string): string;
 /** Sum the per-node results into one run summary. */
 export declare function summarizeRun(results: Map<string, NodeResult>, durationMs: number, crashed?: boolean, trace?: ExecutionTrace): RunSummary;
+/** Conditional routes by rung. Unconditional edges decide nothing and are not counted. */
+export declare function countRoutes(trace: ExecutionTrace): RouteCounts;
 /**
  * The policy facts the run knew, as short phrases: `env scoped`, `sandbox on`,
  * `1 output staged`. No phrase for a fact no node reported.
@@ -85,8 +91,8 @@ export declare function formatCost(usd: number): string;
 export declare function formatBudgetAmount(b: NonNullable<RunSummary["budget"]>): string;
 /** `budget exceeded: tokens 52k of 50k (run, at node gather)`. */
 export declare function formatBudgetOverrun(b: NonNullable<RunSummary["budget"]>): string;
-/** `agreed 4/5`, or `fell through 2/2` when no decision passed the gates. */
-export declare function formatDeciderCounts(d: NonNullable<RunSummary["decider"]>): string;
+/** `5 (3 decider, 1 expr, 1 agent)`: zero rungs are left out. */
+export declare function formatRouteCounts(r: RouteCounts): string;
 /**
  * One plain line: `✓ 3/3 nodes · 41 tool calls · 2m10s · 12k tokens · $0.18`.
  * Token and cost segments are omitted when the SDK reported none. A harness

package/dist/cli/run-output.js

@@ -7,7 +7,6 @@
  */
 import { workspaceRoot, writeFileNoFollow } from "../safe-file.js";
 import { consoleLogger } from "../types.js";
-import { summarizeDecisions } from "../decider.js";
 import { toMermaidBlock } from "../mermaid.js";
 import { createPaint } from "./style.js";
 import { colorEnabled, glyphs } from "./terminal.js";
@@ -84,12 +83,20 @@ export function summarizeRun(results, durationMs, crashed = false, trace) {
         ...(degraded.size > 0 ? { degraded: [...degraded] } : {}),
         ...(Object.keys(policy).length > 0 ? { policy } : {}),
         ...(budget ? { budget } : {}),
-        ...(trace?.decisions && trace.decisions.length > 0 ? { decider: decisionCounts(trace) } : {}),
+        ...(trace && countRoutes(trace).total > 0 ? { routes: countRoutes(trace) } : {}),
+        ...(trace?.deciderOff ? { deciderOff: trace.deciderOff } : {}),
     };
 }
-function decisionCounts(trace) {
-    const d = summarizeDecisions(trace.decisions ?? []);
-    return { compared: d.compared, agreed: d.agreed, fellThrough: d.fell_through };
+/** Conditional routes by rung. Unconditional edges decide nothing and are not counted. */
+export function countRoutes(trace) {
+    const c = { total: 0, decider: 0, expr: 0, agent: 0 };
+    for (const e of trace.edges) {
+        if (!e.rung)
+            continue;
+        c.total++;
+        c[e.rung]++;
+    }
+    return c;
 }
 /**
  * The policy facts the run knew, as short phrases: `env scoped`, `sandbox on`,
@@ -157,9 +164,10 @@ export function formatBudgetAmount(b) {
 export function formatBudgetOverrun(b) {
     return `budget exceeded: ${formatBudgetAmount(b)} (${b.scope}, at node ${b.node})`;
 }
-/** `agreed 4/5`, or `fell through 2/2` when no decision passed the gates. */
-export function formatDeciderCounts(d) {
-    return d.compared > 0 ? `agreed ${d.agreed}/${d.compared}` : `fell through ${d.fellThrough}/${d.fellThrough}`;
+/** `5 (3 decider, 1 expr, 1 agent)`: zero rungs are left out. */
+export function formatRouteCounts(r) {
+    const parts = ["decider", "expr", "agent"].filter((k) => r[k] > 0).map((k) => `${r[k]} ${k}`);
+    return parts.length > 0 ? `${r.total} (${parts.join(", ")})` : String(r.total);
 }
 /**
  * One plain line: `✓ 3/3 nodes · 41 tool calls · 2m10s · 12k tokens · $0.18`.
@@ -180,7 +188,8 @@ export function formatReceipt(s) {
         ...(s.degraded && s.degraded.length > 0 ? [`degraded: ${s.degraded.join(", ")}`] : []),
         ...(formatPolicySegment(s.policy) ? [formatPolicySegment(s.policy)] : []),
         ...(s.budget ? [formatBudgetOverrun(s.budget)] : []),
-        ...(s.decider ? [`decider ${formatDeciderCounts(s.decider)}`] : []),
+        ...(s.routes && s.routes.total > 0 ? [`routes ${formatRouteCounts(s.routes)}`] : []),
+        ...(s.deciderOff ? [`decider off: ${s.deciderOff}`] : []),
     ];
     return parts.join(" · ");
 }
@@ -317,8 +326,5 @@ export const WORKFLOW_RUN_OPTIONS = [
         "--harness-policy <mode>",
         "strict: refuse a node whose policy the agent cannot enforce; warn: run it and report what was not enforced (default: strict under GitHub Actions, warn elsewhere; env SWENY_HARNESS_POLICY)",
     ],
-    [
-        "--decider <mode>",
-        "Decision model for route choices: off (default) or shadow. Shadow asks the workflow's decider.provider alongside the agent and reports agreement; the route is always the agent's. Needs decider.provider in the workflow (no default URL)",
-    ],
+    ["--no-decider", "Skip the decision model for this run: the agent decides the routes of route_by: decider nodes"],
 ];

package/dist/cli/ticket.js

@@ -6,7 +6,7 @@
  * METADATA ONLY, like the receipt line: counts, durations, tokens, cost,
  * policy facts. Never prompts, node outputs, tool inputs, or model prose.
  */
-import { formatBudgetAmount, formatCost, formatDeciderCounts, formatReceiptDuration, formatTokenCount, policyParts, renderReceiptLine, } from "./run-output.js";
+import { formatBudgetAmount, formatCost, formatRouteCounts, formatReceiptDuration, formatTokenCount, policyParts, renderReceiptLine, } from "./run-output.js";
 import { createPaint } from "./style.js";
 import { colorEnabled, glyphsFor, richOutput, supportsUnicode, terminalColumns, ticketBoxFor } from "./terminal.js";
 /** Widest ticket, in columns, frame included. */
@@ -69,7 +69,8 @@ function ticketFields(s) {
         ...(s.costUsd !== undefined ? [["cost", formatCost(s.costUsd)]] : []),
         ...(s.harness !== undefined && s.harness !== "claude-code" ? [["harness", s.harness]] : []),
         ...(s.degraded && s.degraded.length > 0 ? [["degraded", s.degraded.join(", ")]] : []),
-        ...(s.decider ? [["decider", formatDeciderCounts(s.decider)]] : []),
+        ...(s.routes && s.routes.total > 0 ? [["routes", formatRouteCounts(s.routes)]] : []),
+        ...(s.deciderOff ? [["decider off", s.deciderOff]] : []),
         ...(s.budget
             ? [
                 ["budget", `${formatBudgetAmount(s.budget)} (${s.budget.scope})`],