@sweny-ai/core 0.1.177 → 0.1.179

package/dist/harness/acp.js

@@ -713,6 +713,8 @@ export class AcpHarness {
         const extraDegraded = [];
         const tag = (r) => ({
             ...r,
+            // Only the process wrapper keeps the agent out of the sweny state dir.
+            contained: wrapper !== undefined,
             harness: this.info(),
             degraded: [...degraded, ...extraDegraded],
         });

package/dist/harness/claude-code.d.ts

@@ -51,6 +51,24 @@ export declare const CLAUDE_TOOLS_BY_CLASS: Readonly<Record<ToolClass, readonly
  * `denyRead` (merged with these rules) covers Bash.
  */
 export declare function claudeReadDenyRule(absPath: string): string;
+/**
+ * Deny rules keeping every built-in file tool out of the run journals' state
+ * dir ({@link runStateRoot}): an agent that could read a run key could forge
+ * journal records, and one that could write there could cut a journal or
+ * plant a run.
+ *
+ * Mechanism: scoped deny rules on `disallowedTools`. Per the Agent SDK's
+ * permission evaluation order (code.claude.com/docs/en/agent-sdk/permissions,
+ * "Deny rules"), a matching deny rule from `disallowed_tools` blocks the tool
+ * "even in `bypassPermissions` mode", which every node runs under (#365);
+ * `canUseTool` and allow rules are never reached in that mode. `Read(path)`
+ * rules govern the built-in file readers (Read, and Grep/Glob), and
+ * `Edit(path)` rules "govern all built-in tools that write files, including
+ * `Write` and `NotebookEdit`" (a `Write(path)` rule is never matched, so none
+ * is emitted). `//` anchors an absolute filesystem path. Both the path as
+ * configured and its real path are denied (macOS `/var` is `/private/var`).
+ */
+export declare function claudeStateDirDenyRules(root?: string): string[];
 /** Native `disallowedTools` for a policy: legacy names, compiled classes, and the read-only set. */
 export declare function compileClaudeCodeDeny(policy: NodePolicy, legacy?: readonly string[]): string[];
 /** How sweny resolves which credentials reach the Claude Code subprocess. */

package/dist/harness/claude-code.js

@@ -10,6 +10,7 @@
  */
 import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude-agent-sdk";
 import { createRequire } from "node:module";
+import { realpathSync } from "node:fs";
 import { consoleLogger } from "../types.js";
 import { AGENT_AUTH_VARS, finishAgentEnv, reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, withPushBlocked, mcpWithheld, resolveAgentSandbox, } from "../agent-env.js";
 import { gitCredentialGap, policyGate } from "./policy.js";
@@ -20,6 +21,7 @@ import { jsonSchemaToZodShape, toolErrorToMcpResult, toolOutputToMcpResult } fro
 import { startToolBridge } from "./tool-bridge/server.js";
 import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./parse.js";
 import { makeAbort } from "./abort.js";
+import { runStateRoot } from "../journal.js";
 import { claudeCodeAuth } from "./auth.js";
 export { buildEvaluatePrompt, CLAUDE_CODE_CAPABILITIES };
 export { parseToolResultContent, summarizeToolError, makeAbort };
@@ -96,6 +98,39 @@ export const CLAUDE_TOOLS_BY_CLASS = {
 export function claudeReadDenyRule(absPath) {
     return `Read(/${absPath.startsWith("/") ? absPath : `/${absPath}`})`;
 }
+/**
+ * Deny rules keeping every built-in file tool out of the run journals' state
+ * dir ({@link runStateRoot}): an agent that could read a run key could forge
+ * journal records, and one that could write there could cut a journal or
+ * plant a run.
+ *
+ * Mechanism: scoped deny rules on `disallowedTools`. Per the Agent SDK's
+ * permission evaluation order (code.claude.com/docs/en/agent-sdk/permissions,
+ * "Deny rules"), a matching deny rule from `disallowed_tools` blocks the tool
+ * "even in `bypassPermissions` mode", which every node runs under (#365);
+ * `canUseTool` and allow rules are never reached in that mode. `Read(path)`
+ * rules govern the built-in file readers (Read, and Grep/Glob), and
+ * `Edit(path)` rules "govern all built-in tools that write files, including
+ * `Write` and `NotebookEdit`" (a `Write(path)` rule is never matched, so none
+ * is emitted). `//` anchors an absolute filesystem path. Both the path as
+ * configured and its real path are denied (macOS `/var` is `/private/var`).
+ */
+export function claudeStateDirDenyRules(root = runStateRoot()) {
+    let real = root;
+    try {
+        real = realpathSync(root);
+    }
+    catch {
+        // not created yet: the configured path is the one tools would use
+    }
+    const abs = (p) => (p.startsWith("/") ? p : `/${p}`);
+    return [...new Set([root, real])].flatMap((dir) => [
+        `Read(/${abs(dir)})`,
+        `Read(/${abs(dir)}/**)`,
+        `Edit(/${abs(dir)})`,
+        `Edit(/${abs(dir)}/**)`,
+    ]);
+}
 /** Native `disallowedTools` for a policy: legacy names, compiled classes, and the read-only set. */
 export function compileClaudeCodeDeny(policy, legacy = []) {
     return [
@@ -344,6 +379,8 @@ export class ClaudeCodeHarness {
             harness: this.info(),
             degraded,
             ...(this.lastPolicyFacts ? { policy: this.lastPolicyFacts } : {}),
+            // The state dir deny rules hold for the file tools either way; Bash is held only by the sandbox.
+            contained: this.lastPolicyFacts?.sandboxStarted === true,
         };
     }
     async runQuery(opts) {
@@ -354,6 +391,9 @@ export class ClaudeCodeHarness {
         let disallowedTools = readOnly
             ? [...new Set([...(opts.disallowedTools ?? []), ...READ_ONLY_DISALLOWED_TOOLS])]
             : opts.disallowedTools;
+        // Run journals, their keys and locks live in the sweny state dir: no built-in
+        // file tool may read or write there (Bash is held by the sandbox's filesystem deny).
+        disallowedTools = [...new Set([...(disallowedTools ?? []), ...claudeStateDirDenyRules()])];
         const effectiveModel = model ?? this.model;
         // #360: run agent commands in the SDK sandbox. `auto` (default in CI) falls
         // back to unsandboxed with one loud warning when the host cannot sandbox;
@@ -517,12 +557,17 @@ export class ClaudeCodeHarness {
                     ...(abort ? { abortController: abort.controller } : {}),
                     ...(effectiveModel ? { model: effectiveModel } : {}),
                     ...(Object.keys(allMcpServers).length > 0 ? { mcpServers: allMcpServers } : {}),
-                    // Dry run (#380): settingSources is omitted, so the SDK loads user,
-                    // project and local settings, including their MCP servers (and
-                    // project .mcp.json, plugins). strictMcpConfig limits MCP to the
-                    // servers passed above, which under readOnly is only sweny-core.
-                    // A strict policy (#365) makes it exclusive for write nodes too.
-                    ...(mcpWithheld(!!readOnly, agentAccess) || opts.strictMcp ? { strictMcpConfig: true } : {}),
+                    // Only what sweny passes runs: an ambient MCP server or plugin (user
+                    // settings, a repo's .mcp.json or .claude/settings.json, which are
+                    // repo content) could read the run journals' state dir around the
+                    // sandbox and the deny rules. SDK Options (sdk.d.ts):
+                    // `strictMcpConfig` "Only use MCP servers passed via the `mcpServers`
+                    // option ... ignoring ... project `.mcp.json`, user settings,
+                    // plugins"; `settingSources` "Pass `[]` to disable filesystem
+                    // settings (SDK isolation mode)", so no user/project/local
+                    // settings, hooks or settings-enabled plugins load either.
+                    strictMcpConfig: true,
+                    settingSources: [],
                     ...(disallowedTools && disallowedTools.length > 0 ? { disallowedTools } : {}),
                     // CC-08: ask the SDK to produce validated structured output when the
                     // node declares an output schema. The SDK then returns the parsed

package/dist/harness/codex.js

@@ -758,6 +758,8 @@ export class CodexHarness {
         let degraded = gate.degraded;
         const tag = (r, extra = []) => ({
             ...r,
+            // Only the process wrapper keeps Codex out of the sweny state dir (its own sandbox allows reads).
+            contained: wrapper !== undefined,
             harness: this.info(),
             degraded: [...degraded, ...extra],
         });

package/dist/harness/pi.js

@@ -756,6 +756,8 @@ export class PiHarness {
         const extraDegraded = [];
         const tag = (r) => ({
             ...r,
+            // Only the process wrapper keeps the agent out of the sweny state dir.
+            contained: wrapper !== undefined,
             harness: this.info(),
             degraded: [...degraded, ...extraDegraded],
         });

package/dist/harness/sandbox-wrapper.js

@@ -48,7 +48,7 @@ import { lstat, mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises
 import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
 import { DEFAULT_SANDBOX_DOMAINS, parseList, resolveSandboxMode } from "../agent-env.js";
-import { JOURNAL_DIR, runKeyDir } from "../journal.js";
+import { runStateRoot } from "../journal.js";
 import { policyGate } from "./policy.js";
 // ─── srt settings ────────────────────────────────────────────────
 /**
@@ -132,13 +132,13 @@ export function buildSrtSettings(req, opts) {
     // cannot rename one out from under its read deny.
     const masked = [...new Set((req.denyRead ?? []).map(real))].filter((p) => exists(p));
     denyRead.push(...masked.filter((p) => !denyRead.includes(p)));
-    // Run journal keys (outside the workspace) are never readable by the agent,
-    // and the journals themselves are not writable.
-    const keyDir = runKeyDir();
-    if (exists(keyDir) && !denyRead.includes(keyDir))
-        denyRead.push(keyDir);
-    const journals = path.join(real(req.cwd), JOURNAL_DIR);
-    const denyWrite = !req.readOnly && exists(journals) ? [...masked, journals] : masked;
+    // Run journals, their keys and locks (the sweny state dir, outside the
+    // workspace) are neither readable nor writable by the agent.
+    const journals = real(runStateRoot());
+    const journalsExist = exists(journals);
+    if (journalsExist && !denyRead.includes(journals))
+        denyRead.push(journals);
+    const denyWrite = journalsExist ? [...masked, journals] : masked;
     const allowWrite = req.readOnly ? [opts.home] : [real(req.cwd), opts.home];
     return {
         network: { allowedDomains, deniedDomains: [], strictAllowlist: true, allowLocalBinding: false },

package/dist/index.d.ts

@@ -27,8 +27,8 @@ export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRA
 export { consoleLogger } from "./types.js";
 export { execute, RouteEvaluationError } from "./executor.js";
 export type { ExecuteOptions } from "./executor.js";
-export { systemOneProvider, DecideError, gateVerdict, DECIDER_MIN_CONFIDENCE, DECIDER_MIN_MARGIN } from "./decider.js";
-export type { DecisionProvider, DeciderConfig, DeciderMode, DeciderRecord, SystemOneOptions } from "./decider.js";
+export { systemOneProvider } from "./decider.js";
+export type { DeciderConfig, DeciderOperatorConfig } from "./decider.js";
 export { BudgetGuard, describeOverrun, minLimits, toLimits } from "./budget.js";
 export type { Budget, BudgetOverrun, BudgetUnit, SpendLimits } from "./budget.js";
 export { resolveNodePermissions, buildNodePolicy } from "./node-policy.js";

package/dist/index.js

@@ -27,8 +27,8 @@ export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRA
 export { consoleLogger } from "./types.js";
 // Executor
 export { execute, RouteEvaluationError } from "./executor.js";
-// Decision models, shadow mode (#357)
-export { systemOneProvider, DecideError, gateVerdict, DECIDER_MIN_CONFIDENCE, DECIDER_MIN_MARGIN } from "./decider.js";
+// Decision models (#357): config types and the provider adapter only
+export { systemOneProvider } from "./decider.js";
 // Least-privilege nodes and safe outputs (#365)
 export { BudgetGuard, describeOverrun, minLimits, toLimits } from "./budget.js";
 export { resolveNodePermissions, buildNodePolicy } from "./node-policy.js";