@sweny-ai/core 0.1.178 → 0.1.179

package/dist/agent-env.d.ts

@@ -373,9 +373,11 @@ export declare function checkSandboxSupport(platform?: NodeJS.Platform, pathEnv?
 /**
  * The SDK sandbox settings used when the sandbox is on.
  *
- * - `failIfUnavailable`: true under `strict` (the SDK errors instead of
- *   running unsandboxed); false under `auto`, so a host that passes the
- *   preflight but still cannot start the sandbox degrades instead of failing.
+ * - `failIfUnavailable`: true whenever settings are built, `auto` included:
+ *   the preflight already passed, so a sandbox that then fails to start
+ *   fails the node instead of silently running the agent unsandboxed (which
+ *   the run would otherwise report as contained). `auto` on a host whose
+ *   preflight fails builds no settings and runs unsandboxed, reported as such.
  * - `allowUnsandboxedCommands: false`: the model cannot escape via the
  *   `dangerouslyDisableSandbox` parameter. Required, because nodes run under
  *   `bypassPermissions` (#365) which would otherwise auto-approve the escape.

package/dist/agent-env.js

@@ -29,7 +29,7 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
-import { runKeyDir } from "./journal.js";
+import { runStateRoot } from "./journal.js";
 // ─── Scoped env ──────────────────────────────────────────────────
 /**
  * Exact variable names always passed to the agent subprocess.
@@ -938,9 +938,11 @@ function defaultProbe() {
 /**
  * The SDK sandbox settings used when the sandbox is on.
  *
- * - `failIfUnavailable`: true under `strict` (the SDK errors instead of
- *   running unsandboxed); false under `auto`, so a host that passes the
- *   preflight but still cannot start the sandbox degrades instead of failing.
+ * - `failIfUnavailable`: true whenever settings are built, `auto` included:
+ *   the preflight already passed, so a sandbox that then fails to start
+ *   fails the node instead of silently running the agent unsandboxed (which
+ *   the run would otherwise report as contained). `auto` on a host whose
+ *   preflight fails builds no settings and runs unsandboxed, reported as such.
  * - `allowUnsandboxedCommands: false`: the model cannot escape via the
  *   `dangerouslyDisableSandbox` parameter. Required, because nodes run under
  *   `bypassPermissions` (#365) which would otherwise auto-approve the escape.
@@ -963,10 +965,12 @@ export function buildSandboxSettings(domains, opts = {}) {
             envVars: AGENT_AUTH_VARS.map((name) => ({ name, mode: "deny" })),
             files: [
                 { path: path.join(opts.home ?? homedir(), ".claude", ".credentials.json"), mode: "deny" },
-                // Run journal keys: an agent that could read them could forge journal records.
-                { path: runKeyDir(), mode: "deny" },
+                // Run journals and their keys: an agent that could read a key could forge records.
+                { path: runStateRoot(), mode: "deny" },
             ],
         },
+        // Nor may it write there: cut a journal, delete a lock, or plant a run.
+        filesystem: { denyRead: [runStateRoot()], denyWrite: [runStateRoot()] },
     };
 }
 /**
@@ -1003,7 +1007,8 @@ export function resolveAgentSandbox(opts) {
     return {
         mode,
         settings: buildSandboxSettings([...DEFAULT_SANDBOX_DOMAINS, ...(opts.nodeDomains ?? []), ...extra], {
-            failIfUnavailable: mode === "strict",
+            // Preflight passed: from here the sandbox is enforced or the node fails.
+            failIfUnavailable: true,
         }),
     };
 }

package/dist/cli/final-output.js

@@ -193,7 +193,10 @@ export function outputRelPath(runId) {
 export function writeFinalOutput(runId, markdown, cwd = process.cwd()) {
     try {
         const rel = outputRelPath(runId);
-        writeFileNoFollow(path.join(cwd, rel), markdown, { root: cwd, mode: 0o600 });
+        const file = path.join(cwd, rel);
+        // Node output: keep the run dir out of commits (an agent's `git add -A` included).
+        writeFileNoFollow(path.join(path.dirname(file), ".gitignore"), "*\n", { root: cwd, mode: 0o644 });
+        writeFileNoFollow(file, markdown, { root: cwd, mode: 0o600 });
         return rel;
     }
     catch {

package/dist/cli/main.js

@@ -1143,8 +1143,9 @@ resume) {
         progress.stop();
         console.error(formatCrashError(err));
         runLogger.flush();
+        const resumable = journal?.active === true;
         journal?.end("crashed");
-        if (journal)
+        if (resumable)
             console.error(c.subtle(`  resume with: sweny workflow resume ${runId}`));
         recordHistory(nodeTimer.lastResults, undefined, true);
         const crashSummary = summarizeRun(new Map(), Date.now() - runStart, true);
@@ -1255,7 +1256,7 @@ for (const [flags, description] of WORKFLOW_RUN_OPTIONS) {
 }
 workflowRunCmd.option("--no-history", "Do not record this run or save its output.md in .sweny/runs/ (or set `history: off` in .sweny.yml)");
 workflowRunCmd.option("--show-output", "Print the final answer in CI too (off by default in CI: only the path to output.md is printed)");
-workflowRunCmd.option("--no-journal", "Do not write a run journal to .sweny/runs/<run-id>/ (or set `journal: off` in .sweny.yml); the run cannot be resumed");
+workflowRunCmd.option("--no-journal", "Do not write a run journal (kept in the sweny state dir; or set `journal: off` in .sweny.yml); the run cannot be resumed");
 const workflowResumeCmd = workflowCmd
     .command("resume <run-id>")
     .description("Resume a killed or failed `workflow run` from its journal: finished nodes are replayed without calling the agent, " +

package/dist/cli/resume.d.ts

@@ -6,7 +6,7 @@
  * Lives outside main.ts so tests can import it (main.ts parses argv on import).
  */
 import type { Logger, Workflow } from "../types.js";
-import { RunJournal, type ResumePlan } from "../journal.js";
+import { RunJournal, type LockHooks, type ResumePlan } from "../journal.js";
 /** `sweny workflow resume` options (commander camelCases the flags). */
 export interface ResumeOptions {
     force?: boolean;
@@ -48,9 +48,18 @@ export interface PrepareResumeDeps {
     swenyVersion?: string;
     env?: Record<string, string | undefined>;
     logger?: Logger;
+    /** Where run journals live (default: {@link runStateRoot} of `env`). */
+    stateRoot?: string;
+    /** Test seam for the run lock. */
+    lockHooks?: LockHooks;
 }
 /** One line per planned visit, for humans. */
 export declare function formatResumePlan(plan: ResumePlan, mayRepeat: string[]): string[];
+/**
+ * Check a run journal and build the resume. The run's lock is taken first,
+ * before anything is read or repaired, and is kept by the returned journal
+ * (released on every other outcome, `--plan` included).
+ */
 export declare function prepareResume(ref: string, opts: ResumeOptions, deps: PrepareResumeDeps): PrepareResumeResult;
 /** Journal is on unless `--no-journal` (options.journal === false) or `.sweny.yml` has `journal: off`. */
 export declare function journalDisabled(optionJournal: unknown, configJournal: unknown): boolean;

package/dist/cli/resume.js

@@ -7,7 +7,8 @@
  */
 import path from "node:path";
 import { validateRuntimeInput } from "../inputs.js";
-import { JOURNAL_DIR, JOURNAL_FILE, JournalKeyError, JournalLockedError, JournalVersionError, RunJournal, buildResumePlan, canonicalHash, checkJournalAgainstWorkflow, findJournalRun, journalDir, mayRepeatWrites, readJournal, workflowHashOf, } from "../journal.js";
+import { existsSync } from "node:fs";
+import { JournalKeyError, JournalLocationError, assertStateOutsideWorkspace, JournalLockedError, JournalRollbackError, JournalVersionError, RunJournal, buildResumePlan, canonicalHash, checkJournalAgainstWorkflow, findJournalRun, findLegacyJournal, journalFile, lockRun, mayRepeatWrites, readJournal, runStateRoot, workflowHashOf, } from "../journal.js";
 import { parseInputFlag } from "./workflow-input.js";
 /** Resume-only flags; the rest are shared with `workflow run`. */
 export const WORKFLOW_RESUME_OPTIONS = [
@@ -69,23 +70,80 @@ export function formatResumePlan(plan, mayRepeat) {
         lines.push("  every node finished; the resume only closes the run");
     return lines;
 }
+/**
+ * Check a run journal and build the resume. The run's lock is taken first,
+ * before anything is read or repaired, and is kept by the returned journal
+ * (released on every other outcome, `--plan` included).
+ */
 export function prepareResume(ref, opts, deps) {
     const cwd = deps.cwd ?? process.cwd();
-    const lines = [];
-    const fail = (error) => ({ ok: false, error, lines });
-    const runId = findJournalRun(ref, cwd);
+    const root = deps.stateRoot ?? runStateRoot(deps.env ?? process.env);
+    // A state dir that resolves into the workspace is agent-writable: nothing in it can be trusted.
+    if (existsSync(root)) {
+        try {
+            assertStateOutsideWorkspace(root, cwd);
+        }
+        catch (err) {
+            if (err instanceof JournalLocationError)
+                return { ok: false, lines: [], error: err.message };
+            throw err;
+        }
+    }
+    const runId = findJournalRun(ref, cwd, root);
     if (!runId) {
-        return fail(`no run journal matches "${ref}" in ${JOURNAL_DIR}/. Runs started with --no-journal (or before journals existed) cannot be resumed.`);
+        const legacy = findLegacyJournal(ref, cwd);
+        if (legacy) {
+            return {
+                ok: false,
+                lines: [],
+                error: `run ${ref} has a journal in the workspace (${path.relative(cwd, legacy)}), written by an older sweny. ` +
+                    `Journals now live in the sweny state dir, where agents cannot edit them; a workspace journal cannot ` +
+                    `be resumed safely. Start a new run.`,
+            };
+        }
+        return {
+            ok: false,
+            lines: [],
+            error: `no run journal matches "${ref}" for this workspace in ${root}. Runs started with --no-journal ` +
+                `(or by another user or state dir) cannot be resumed.`,
+        };
+    }
+    let lock;
+    try {
+        lock = lockRun(cwd, runId, root, deps.lockHooks);
+    }
+    catch (err) {
+        const error = err instanceof Error ? err.message : String(err);
+        return {
+            ok: false,
+            lines: [],
+            error: err instanceof JournalLockedError ? error : `cannot lock run ${runId}: ${error}`,
+        };
     }
-    const file = path.join(journalDir(cwd, runId), JOURNAL_FILE);
+    let result;
+    try {
+        result = prepareLocked(runId, journalFile(cwd, runId, root), lock, opts, deps, cwd, root);
+    }
+    catch (err) {
+        lock.release();
+        throw err;
+    }
+    if (!(result.ok && "ctx" in result))
+        lock.release();
+    return result;
+}
+function prepareLocked(runId, file, lock, opts, deps, cwd, root) {
+    const lines = [];
+    const fail = (error) => ({ ok: false, error, lines });
     let read;
     try {
         // --plan stays read-only: a torn tail is reported, not cut.
         read = readJournal(file, { repair: !opts.plan });
     }
     catch (err) {
-        if (err instanceof JournalVersionError || err instanceof JournalKeyError)
+        if (err instanceof JournalVersionError || err instanceof JournalKeyError || err instanceof JournalRollbackError) {
             return fail(err.message);
+        }
         return fail(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
     }
     if (read.forgedAtLine !== undefined) {
@@ -101,6 +159,11 @@ export function prepareResume(ref, opts, deps) {
             ? `note: the journal ends in a torn record (${read.truncatedBytes} bytes); resuming drops it`
             : `note: dropped a torn record at the end of the journal (${read.truncatedBytes} bytes)`);
     }
+    if (read.restored) {
+        lines.push(opts.plan
+            ? `note: the journal's last record was not appended before the crash; resuming restores it from the head`
+            : `note: restored the journal's last record from the head (the run stopped before appending it)`);
+    }
     let plan;
     try {
         plan = buildResumePlan(read.records);
@@ -154,6 +217,10 @@ export function prepareResume(ref, opts, deps) {
     }
     const mayRepeat = mayRepeatWrites(plan, workflow, input);
     lines.push(...formatResumePlan(plan, mayRepeat));
+    if (plan.unsandboxed.length > 0) {
+        lines.push(`warning: an earlier attempt ran ${plan.unsandboxed.join(", ")} without an enforced sandbox, so that agent ` +
+            `could have read the run key and edited this run's journaled spend and write records (journal_unsandboxed)`);
+    }
     if (opts.plan)
         return { ok: true, planOnly: true, lines };
     if (mayRepeat.length > 0 && !opts.allowRepeatWrites) {
@@ -170,8 +237,10 @@ export function prepareResume(ref, opts, deps) {
             swenyVersion: deps.swenyVersion,
             env: deps.env,
             logger: deps.logger,
+            stateRoot: root,
             read,
             plan,
+            lock,
             force: opts.force === true,
             allowRepeatWrites: opts.allowRepeatWrites === true,
         });

package/dist/executor.d.ts

@@ -18,7 +18,7 @@ import type { AgentHarness } from "./harness/types.js";
 import type { DeciderOperatorConfig } from "./decider.js";
 import type { Budget } from "./budget.js";
 import { type ActorInfo } from "./safe-outputs.js";
-import type { ExecutionJournal } from "./journal.js";
+import { type ExecutionJournal } from "./journal.js";
 export interface ExecuteOptions {
     /** Registered skills (id → Skill) */
     skills: Map<string, Skill>;

package/dist/executor.js

@@ -34,6 +34,7 @@ import { createRunDecider, wantsDecider } from "./decider.js";
 import { redact, runSecretValues } from "./journal.js";
 import { buildNodePolicy, resolveNodePermissions } from "./node-policy.js";
 import { applySafeOutputs, createEmitOutputTool, createWriteStageState, resolveActor, safeOutputsInstruction, unresolvedOutputs, SAFE_OUTPUT_SCREEN_INSTRUCTION, } from "./safe-outputs.js";
+import { JournalWriteError } from "./journal.js";
 /**
  * Default workflow-level step budget. Counts total node executions across the
  * whole run (loop iterations included). Generous enough for legitimate deep
@@ -59,6 +60,43 @@ function throwIfAborted(signal) {
  * - `trace`: full ordered execution trace including loops and routing decisions
  */
 export async function execute(workflow, input, options) {
+    const results = new Map();
+    const trace = { steps: [], edges: [], sources: {} };
+    const at = { node: null, iteration: 0 };
+    // Resume of a journal an uncontained agent could have edited: the receipt says so.
+    const journalDegraded = () => {
+        const extra = options.journal?.degraded?.() ?? [];
+        if (extra.length === 0)
+            return;
+        for (const [id, r] of results)
+            results.set(id, { ...r, degraded: [...new Set([...(r.degraded ?? []), ...extra])] });
+    };
+    try {
+        const out = await executeRun(workflow, input, options, results, trace, at);
+        journalDegraded();
+        return out;
+    }
+    catch (err) {
+        // Resume (#363): a journal that cannot record the run stops it. The node
+        // fails with the reason; nothing after it runs (no model call, no write).
+        if (!(err instanceof JournalWriteError) || at.node === null)
+            throw err;
+        const logger = options.logger ?? consoleLogger;
+        const result = {
+            ...(results.get(at.node) ?? { toolCalls: [] }),
+            status: "failed",
+            data: { ...(results.get(at.node)?.data ?? {}), error: err.message, journal_failed: true },
+        };
+        results.set(at.node, result);
+        trace.steps.push({ node: at.node, status: "failed", iteration: at.iteration });
+        safeObserve(options.observer, { type: "node:exit", node: at.node, result }, logger);
+        logger.error(`  ${err.message}`, { node: at.node });
+        journalDegraded();
+        safeObserve(options.observer, { type: "workflow:end", results: Object.fromEntries(results) }, logger);
+        return { results, trace };
+    }
+}
+async function executeRun(workflow, input, options, results, trace, at) {
     const { observer, signal, timeoutMs, journal } = options;
     // `harness` is the seam; a legacy `claude` object is used as-is (what `asClaude(claudeCompat(claude))` yields).
     const claude = options.harness ? asClaude(options.harness) : options.claude;
@@ -74,12 +112,10 @@ export async function execute(workflow, input, options) {
     const skills = mergeInlineSkills(options.skills, workflow.skills);
     const config = resolveConfig(skills, options.config, options.env ?? process.env);
     const logger = options.logger ?? consoleLogger;
-    const results = new Map();
     const edgeCounts = new Map(); // "from→to" → times followed
     const nodeRunCounts = new Map(); // node → times executed
     const maxSteps = options.max_steps ?? DEFAULT_MAX_STEPS;
     let stepCount = 0; // total node executions across the run (loop iterations included)
-    const trace = { steps: [], edges: [], sources: {} };
     validate(workflow, skills);
     // Safe outputs (#365): run-wide caps and dedupe, the staged switch and the
     // triggering actor, resolved once per run.
@@ -226,6 +262,8 @@ export async function execute(workflow, input, options) {
         }
         const iteration = (nodeRunCounts.get(currentId) ?? 0) + 1;
         nodeRunCounts.set(currentId, iteration);
+        at.node = currentId;
+        at.iteration = iteration;
         const resolvedInstruction = resolvedSources[`nodes.${currentId}.instruction`].content;
         safeObserve(observer, { type: "node:enter", node: currentId, instruction: resolvedInstruction }, logger);
         logger.info(`→ ${node.name}`, { node: currentId });
@@ -506,10 +544,30 @@ export async function execute(workflow, input, options) {
             // The repair call (at most one) shifts later attempts by one, so every agent call has its own key.
             const usageAttempt = attempt + (repaired ? 1 : 0);
             let liveUsage;
+            // A live usage record the journal cannot write stops the agent at once:
+            // its spend would be invisible to a resume.
+            let journalFault;
+            const journalStop = journal?.usage ? new AbortController() : undefined;
+            const parentSignal = attemptBudget?.signal ?? signal;
+            const onParentAbort = () => journalStop?.abort(parentSignal?.reason);
+            if (journalStop && parentSignal) {
+                if (parentSignal.aborted)
+                    journalStop.abort(parentSignal.reason);
+                else
+                    parentSignal.addEventListener("abort", onParentAbort, { once: true });
+            }
             const journalUsage = journal?.usage
                 ? (u) => {
                     liveUsage = { ...liveUsage, ...u };
-                    journal.usage(usageNode, iteration, usageAttempt, liveUsage, false);
+                    if (journalFault)
+                        return;
+                    try {
+                        journal.usage(usageNode, iteration, usageAttempt, liveUsage, false);
+                    }
+                    catch (err) {
+                        journalFault = err;
+                        journalStop?.abort(err);
+                    }
                 }
                 : undefined;
             const onUsage = attemptBudget || journalUsage
@@ -529,7 +587,7 @@ export async function execute(workflow, input, options) {
                     disallowedTools: node.disallowed_tools,
                     ...(denyClasses.length > 0 ? { deny: denyClasses } : {}),
                     model: nodeModel,
-                    signal: attemptBudget?.signal ?? signal,
+                    signal: journalStop?.signal ?? parentSignal,
                     timeoutMs,
                     agentAccess,
                     ...(nodePolicy ? { policy: nodePolicy } : {}),
@@ -541,9 +599,24 @@ export async function execute(workflow, input, options) {
                     },
                 });
             }
+            catch (err) {
+                if (journalFault)
+                    throw journalFault;
+                // The attempt ended abnormally (abort, timeout, harness error): whether its agent was
+                // contained is unknown, so the journal says it was not.
+                journal?.uncontained?.(usageNode, iteration);
+                throw err;
+            }
             finally {
+                parentSignal?.removeEventListener("abort", onParentAbort);
                 attemptBudget?.dispose();
             }
+            if (journalFault)
+                throw journalFault;
+            // Key secrecy (and so the journal's spend and write records) holds only for a contained agent.
+            if (result.contained !== true && result.data?.refused !== true) {
+                journal?.uncontained?.(usageNode, iteration);
+            }
             previous = result;
             // The attempt's final spend: the larger of the result's usage and the last live report, per unit.
             if (journal?.usage) {

package/dist/harness/acp.js

@@ -713,6 +713,8 @@ export class AcpHarness {
         const extraDegraded = [];
         const tag = (r) => ({
             ...r,
+            // Only the process wrapper keeps the agent out of the sweny state dir.
+            contained: wrapper !== undefined,
             harness: this.info(),
             degraded: [...degraded, ...extraDegraded],
         });

package/dist/harness/claude-code.d.ts

@@ -51,6 +51,24 @@ export declare const CLAUDE_TOOLS_BY_CLASS: Readonly<Record<ToolClass, readonly
  * `denyRead` (merged with these rules) covers Bash.
  */
 export declare function claudeReadDenyRule(absPath: string): string;
+/**
+ * Deny rules keeping every built-in file tool out of the run journals' state
+ * dir ({@link runStateRoot}): an agent that could read a run key could forge
+ * journal records, and one that could write there could cut a journal or
+ * plant a run.
+ *
+ * Mechanism: scoped deny rules on `disallowedTools`. Per the Agent SDK's
+ * permission evaluation order (code.claude.com/docs/en/agent-sdk/permissions,
+ * "Deny rules"), a matching deny rule from `disallowed_tools` blocks the tool
+ * "even in `bypassPermissions` mode", which every node runs under (#365);
+ * `canUseTool` and allow rules are never reached in that mode. `Read(path)`
+ * rules govern the built-in file readers (Read, and Grep/Glob), and
+ * `Edit(path)` rules "govern all built-in tools that write files, including
+ * `Write` and `NotebookEdit`" (a `Write(path)` rule is never matched, so none
+ * is emitted). `//` anchors an absolute filesystem path. Both the path as
+ * configured and its real path are denied (macOS `/var` is `/private/var`).
+ */
+export declare function claudeStateDirDenyRules(root?: string): string[];
 /** Native `disallowedTools` for a policy: legacy names, compiled classes, and the read-only set. */
 export declare function compileClaudeCodeDeny(policy: NodePolicy, legacy?: readonly string[]): string[];
 /** How sweny resolves which credentials reach the Claude Code subprocess. */

package/dist/harness/claude-code.js

@@ -10,6 +10,7 @@
  */
 import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude-agent-sdk";
 import { createRequire } from "node:module";
+import { realpathSync } from "node:fs";
 import { consoleLogger } from "../types.js";
 import { AGENT_AUTH_VARS, finishAgentEnv, reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, withPushBlocked, mcpWithheld, resolveAgentSandbox, } from "../agent-env.js";
 import { gitCredentialGap, policyGate } from "./policy.js";
@@ -20,6 +21,7 @@ import { jsonSchemaToZodShape, toolErrorToMcpResult, toolOutputToMcpResult } fro
 import { startToolBridge } from "./tool-bridge/server.js";
 import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./parse.js";
 import { makeAbort } from "./abort.js";
+import { runStateRoot } from "../journal.js";
 import { claudeCodeAuth } from "./auth.js";
 export { buildEvaluatePrompt, CLAUDE_CODE_CAPABILITIES };
 export { parseToolResultContent, summarizeToolError, makeAbort };
@@ -96,6 +98,39 @@ export const CLAUDE_TOOLS_BY_CLASS = {
 export function claudeReadDenyRule(absPath) {
     return `Read(/${absPath.startsWith("/") ? absPath : `/${absPath}`})`;
 }
+/**
+ * Deny rules keeping every built-in file tool out of the run journals' state
+ * dir ({@link runStateRoot}): an agent that could read a run key could forge
+ * journal records, and one that could write there could cut a journal or
+ * plant a run.
+ *
+ * Mechanism: scoped deny rules on `disallowedTools`. Per the Agent SDK's
+ * permission evaluation order (code.claude.com/docs/en/agent-sdk/permissions,
+ * "Deny rules"), a matching deny rule from `disallowed_tools` blocks the tool
+ * "even in `bypassPermissions` mode", which every node runs under (#365);
+ * `canUseTool` and allow rules are never reached in that mode. `Read(path)`
+ * rules govern the built-in file readers (Read, and Grep/Glob), and
+ * `Edit(path)` rules "govern all built-in tools that write files, including
+ * `Write` and `NotebookEdit`" (a `Write(path)` rule is never matched, so none
+ * is emitted). `//` anchors an absolute filesystem path. Both the path as
+ * configured and its real path are denied (macOS `/var` is `/private/var`).
+ */
+export function claudeStateDirDenyRules(root = runStateRoot()) {
+    let real = root;
+    try {
+        real = realpathSync(root);
+    }
+    catch {
+        // not created yet: the configured path is the one tools would use
+    }
+    const abs = (p) => (p.startsWith("/") ? p : `/${p}`);
+    return [...new Set([root, real])].flatMap((dir) => [
+        `Read(/${abs(dir)})`,
+        `Read(/${abs(dir)}/**)`,
+        `Edit(/${abs(dir)})`,
+        `Edit(/${abs(dir)}/**)`,
+    ]);
+}
 /** Native `disallowedTools` for a policy: legacy names, compiled classes, and the read-only set. */
 export function compileClaudeCodeDeny(policy, legacy = []) {
     return [
@@ -344,6 +379,8 @@ export class ClaudeCodeHarness {
             harness: this.info(),
             degraded,
             ...(this.lastPolicyFacts ? { policy: this.lastPolicyFacts } : {}),
+            // The state dir deny rules hold for the file tools either way; Bash is held only by the sandbox.
+            contained: this.lastPolicyFacts?.sandboxStarted === true,
         };
     }
     async runQuery(opts) {
@@ -354,6 +391,9 @@ export class ClaudeCodeHarness {
         let disallowedTools = readOnly
             ? [...new Set([...(opts.disallowedTools ?? []), ...READ_ONLY_DISALLOWED_TOOLS])]
             : opts.disallowedTools;
+        // Run journals, their keys and locks live in the sweny state dir: no built-in
+        // file tool may read or write there (Bash is held by the sandbox's filesystem deny).
+        disallowedTools = [...new Set([...(disallowedTools ?? []), ...claudeStateDirDenyRules()])];
         const effectiveModel = model ?? this.model;
         // #360: run agent commands in the SDK sandbox. `auto` (default in CI) falls
         // back to unsandboxed with one loud warning when the host cannot sandbox;
@@ -517,12 +557,17 @@ export class ClaudeCodeHarness {
                     ...(abort ? { abortController: abort.controller } : {}),
                     ...(effectiveModel ? { model: effectiveModel } : {}),
                     ...(Object.keys(allMcpServers).length > 0 ? { mcpServers: allMcpServers } : {}),
-                    // Dry run (#380): settingSources is omitted, so the SDK loads user,
-                    // project and local settings, including their MCP servers (and
-                    // project .mcp.json, plugins). strictMcpConfig limits MCP to the
-                    // servers passed above, which under readOnly is only sweny-core.
-                    // A strict policy (#365) makes it exclusive for write nodes too.
-                    ...(mcpWithheld(!!readOnly, agentAccess) || opts.strictMcp ? { strictMcpConfig: true } : {}),
+                    // Only what sweny passes runs: an ambient MCP server or plugin (user
+                    // settings, a repo's .mcp.json or .claude/settings.json, which are
+                    // repo content) could read the run journals' state dir around the
+                    // sandbox and the deny rules. SDK Options (sdk.d.ts):
+                    // `strictMcpConfig` "Only use MCP servers passed via the `mcpServers`
+                    // option ... ignoring ... project `.mcp.json`, user settings,
+                    // plugins"; `settingSources` "Pass `[]` to disable filesystem
+                    // settings (SDK isolation mode)", so no user/project/local
+                    // settings, hooks or settings-enabled plugins load either.
+                    strictMcpConfig: true,
+                    settingSources: [],
                     ...(disallowedTools && disallowedTools.length > 0 ? { disallowedTools } : {}),
                     // CC-08: ask the SDK to produce validated structured output when the
                     // node declares an output schema. The SDK then returns the parsed

package/dist/harness/codex.js

@@ -758,6 +758,8 @@ export class CodexHarness {
         let degraded = gate.degraded;
         const tag = (r, extra = []) => ({
             ...r,
+            // Only the process wrapper keeps Codex out of the sweny state dir (its own sandbox allows reads).
+            contained: wrapper !== undefined,
             harness: this.info(),
             degraded: [...degraded, ...extra],
         });

package/dist/harness/pi.js

@@ -756,6 +756,8 @@ export class PiHarness {
         const extraDegraded = [];
         const tag = (r) => ({
             ...r,
+            // Only the process wrapper keeps the agent out of the sweny state dir.
+            contained: wrapper !== undefined,
             harness: this.info(),
             degraded: [...degraded, ...extraDegraded],
         });

package/dist/harness/sandbox-wrapper.js

@@ -48,7 +48,7 @@ import { lstat, mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises
 import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
 import { DEFAULT_SANDBOX_DOMAINS, parseList, resolveSandboxMode } from "../agent-env.js";
-import { JOURNAL_DIR, runKeyDir } from "../journal.js";
+import { runStateRoot } from "../journal.js";
 import { policyGate } from "./policy.js";
 // ─── srt settings ────────────────────────────────────────────────
 /**
@@ -132,13 +132,13 @@ export function buildSrtSettings(req, opts) {
     // cannot rename one out from under its read deny.
     const masked = [...new Set((req.denyRead ?? []).map(real))].filter((p) => exists(p));
     denyRead.push(...masked.filter((p) => !denyRead.includes(p)));
-    // Run journal keys (outside the workspace) are never readable by the agent,
-    // and the journals themselves are not writable.
-    const keyDir = runKeyDir();
-    if (exists(keyDir) && !denyRead.includes(keyDir))
-        denyRead.push(keyDir);
-    const journals = path.join(real(req.cwd), JOURNAL_DIR);
-    const denyWrite = !req.readOnly && exists(journals) ? [...masked, journals] : masked;
+    // Run journals, their keys and locks (the sweny state dir, outside the
+    // workspace) are neither readable nor writable by the agent.
+    const journals = real(runStateRoot());
+    const journalsExist = exists(journals);
+    if (journalsExist && !denyRead.includes(journals))
+        denyRead.push(journals);
+    const denyWrite = journalsExist ? [...masked, journals] : masked;
     const allowWrite = req.readOnly ? [opts.home] : [real(req.cwd), opts.home];
     return {
         network: { allowedDomains, deniedDomains: [], strictAllowlist: true, allowLocalBinding: false },