@sweny-ai/core 0.1.179 → 0.1.181

package/dist/harness/capabilities.js

@@ -19,6 +19,7 @@ export const CLAUDE_CODE_CAPABILITIES = {
     usage: { tokens: true, costUsd: true, live: true, liveUnits: ["tokens"] },
     cancel: "signal",
     resume: false,
+    nativeNone: true,
 };
 /**
  * Codex (`codex exec --json`), declared from the openai/codex source at

package/dist/harness/claude-code.d.ts

@@ -276,4 +276,4 @@ export type ClaudeClient = ClaudeCodeHarness;
  *
  * @internal Exported for the tool bridge parity test (#414).
  */
-export declare function coreToolToSdkTool(coreTool: Tool, defaultCtx: ToolContext): import("@anthropic-ai/claude-agent-sdk").SdkMcpToolDefinition<Record<string, import("zod").ZodType<any, import("zod").ZodTypeDef, any>>>;
+export declare function coreToolToSdkTool(coreTool: Tool, defaultCtx: ToolContext): import("@anthropic-ai/claude-agent-sdk").SdkMcpToolDefinition<Record<string, import("zod").ZodType<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>>;

package/dist/harness/claude-code.js

@@ -360,6 +360,7 @@ export class ClaudeCodeHarness {
             readOnly,
             disallowedTools: disallowedTools.length > 0 ? disallowedTools : undefined,
             strictMcp: mcpWithheld(readOnly, req.agentAccess) || policy.strict || policy.exclusiveMcp === true,
+            nativeNone: policy.nativeNone === true,
             sandboxMode: policy.sandbox,
             agentAccess: {
                 envVars: req.agentAccess?.envVars ?? [],
@@ -569,6 +570,10 @@ export class ClaudeCodeHarness {
                     strictMcpConfig: true,
                     settingSources: [],
                     ...(disallowedTools && disallowedTools.length > 0 ? { disallowedTools } : {}),
+                    // permissions.native: none. `tools: []` removes every built-in tool whatever its
+                    // name; `settingSources: []` loads no user, project or local settings, CLAUDE.md or skills
+                    // (already the default above since #497; kept so the policy value states its whole contract).
+                    ...(opts.nativeNone ? { tools: [], settingSources: [] } : {}),
                     // CC-08: ask the SDK to produce validated structured output when the
                     // node declares an output schema. The SDK then returns the parsed
                     // value on `result.structured_output`, which we prefer over the

package/dist/harness/policy.js

@@ -96,6 +96,10 @@ export function policyGate(caps, policy, wrappers = {}) {
             unenforced.push(`disallowed_tools [${policy.nativeDeny.join(", ")}]: harness has no tools by these names`);
         }
     }
+    // `permissions.native: none`: no built-in tools and no settings sources.
+    if (policy.nativeNone && caps.nativeNone !== true) {
+        unenforced.push("native none: harness cannot run a node with no built-in tools and no settings sources");
+    }
     // Exclusive MCP (`permissions.strict`): only the servers sweny passes may
     // load, never the user's own config. A harness that cannot exclude them
     // cannot honor it, so strict refuses the node.

package/dist/harness/types.d.ts

@@ -50,6 +50,8 @@ export interface HarnessCapabilities {
     };
     cancel: "signal" | "rpc" | "kill";
     resume: boolean;
+    /** The harness can run a node with no built-in tools and no settings sources. Absent means false. */
+    nativeNone?: boolean;
 }
 /** What a node is allowed to do, compiled per adapter by the harness. */
 export interface NodePolicy {
@@ -69,6 +71,12 @@ export interface NodePolicy {
      * cannot honor it: reported in `degraded`, refused under `strict`.
      */
     exclusiveMcp?: boolean;
+    /**
+     * The agent gets no built-in tools and loads no settings from disk
+     * (`permissions.native: none`). A harness whose `nativeNone` capability is
+     * not true cannot honor it: reported in `degraded`, refused under `strict`.
+     */
+    nativeNone?: boolean;
     /**
      * Turn budget for the run. Set by adapters whose `turnLimit` is not native,
      * so the gate reports how the budget is kept (watchdog) or that it is not.

package/dist/inputs.d.ts

@@ -69,37 +69,18 @@ export interface WorkflowInputField {
 }
 /** Declared input contract for a workflow. Keys are field names. */
 export type WorkflowInputs = Record<string, WorkflowInputField>;
-export declare const workflowInputsZ: z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
-    type: z.ZodEnum<["string", "number", "boolean", "string[]"]>;
+export declare const workflowInputsZ: z.ZodRecord<z.ZodString, z.ZodObject<{
+    type: z.ZodEnum<{
+        string: "string";
+        number: "number";
+        boolean: "boolean";
+        "string[]": "string[]";
+    }>;
     description: z.ZodOptional<z.ZodString>;
     required: z.ZodOptional<z.ZodBoolean>;
     default: z.ZodOptional<z.ZodUnknown>;
-    enum: z.ZodOptional<z.ZodArray<z.ZodUnknown, "many">>;
-}, "strict", z.ZodTypeAny, {
-    type: "string" | "number" | "boolean" | "string[]";
-    description?: string | undefined;
-    required?: boolean | undefined;
-    default?: unknown;
-    enum?: unknown[] | undefined;
-}, {
-    type: "string" | "number" | "boolean" | "string[]";
-    description?: string | undefined;
-    required?: boolean | undefined;
-    default?: unknown;
-    enum?: unknown[] | undefined;
-}>, {
-    type: "string" | "number" | "boolean" | "string[]";
-    description?: string | undefined;
-    required?: boolean | undefined;
-    default?: unknown;
-    enum?: unknown[] | undefined;
-}, {
-    type: "string" | "number" | "boolean" | "string[]";
-    description?: string | undefined;
-    required?: boolean | undefined;
-    default?: unknown;
-    enum?: unknown[] | undefined;
-}>>;
+    enum: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+}, z.core.$strict>>;
 /** A single validation error against the declared input contract. */
 export interface InputValidationError {
     field: string;

package/dist/inputs.js

@@ -101,7 +101,7 @@ const workflowInputFieldZ = z
         }
     }
 });
-export const workflowInputsZ = z.record(workflowInputFieldZ);
+export const workflowInputsZ = z.record(z.string(), workflowInputFieldZ);
 /**
  * Validate the caller's raw input object against the workflow's declared
  * `inputs` block. Applies defaults for omitted optional fields. Surfaces

package/dist/node-policy.d.ts

@@ -5,11 +5,12 @@
  * the ceiling for every node; a node may narrow it, never widen it.
  */
 import type { NodePolicy, ToolClass } from "./harness/types.js";
-import type { Node, NodeAccess, Workflow } from "./types.js";
+import type { Node, NodeAccess, NodeNative, Workflow } from "./types.js";
 export interface ResolvedPermissions {
     access: NodeAccess;
     deny: ToolClass[];
     strict: boolean;
+    native?: NodeNative;
 }
 /**
  * Effective permissions for a node.
@@ -17,7 +18,7 @@ export interface ResolvedPermissions {
  * access: the node's own, else `read` when it declares `outputs`, else the
  * workflow's, else `write` (today's behavior). A workflow `read` ceiling wins
  * over a node `write` (the loader rejects that combination; this is the
- * runtime backstop). deny: union. strict: either.
+ * runtime backstop). deny: union. strict: either. native: `none` if either says so.
  */
 export declare function resolveNodePermissions(node: Pick<Node, "permissions" | "outputs">, workflow?: Pick<Workflow, "permissions">): ResolvedPermissions;
 /** True when a node asks for more than the workflow ceiling allows. */

package/dist/node-policy.js

@@ -15,7 +15,7 @@ function spec(p) {
  * access: the node's own, else `read` when it declares `outputs`, else the
  * workflow's, else `write` (today's behavior). A workflow `read` ceiling wins
  * over a node `write` (the loader rejects that combination; this is the
- * runtime backstop). deny: union. strict: either.
+ * runtime backstop). deny: union. strict: either. native: `none` if either says so.
  */
 export function resolveNodePermissions(node, workflow = {}) {
     const wf = spec(workflow.permissions);
@@ -24,7 +24,13 @@ export function resolveNodePermissions(node, workflow = {}) {
     if (wf.access === "read")
         access = "read";
     const deny = [...new Set([...(wf.deny ?? []), ...(own.deny ?? [])])];
-    return { access, deny, strict: wf.strict === true || own.strict === true };
+    const none = wf.native === "none" || own.native === "none";
+    return {
+        access,
+        deny,
+        strict: wf.strict === true || own.strict === true,
+        ...(none ? { native: "none" } : {}),
+    };
 }
 /** True when a node asks for more than the workflow ceiling allows. */
 export function exceedsPermissionCeiling(node, workflow) {
@@ -39,5 +45,6 @@ export function buildNodePolicy(opts) {
         egress: opts.egress ?? [],
         strict: opts.permissions.strict,
         ...(opts.permissions.strict ? { exclusiveMcp: true } : {}),
+        ...(opts.permissions.native === "none" ? { nativeNone: true } : {}),
     };
 }