@sweny-ai/core 0.1.190 → 0.1.192

package/dist/budget.d.ts

@@ -59,7 +59,7 @@ export declare function spendOf(u: NodeUsage | undefined): {
 export declare function describeOverrun(o: BudgetOverrun, nodeId?: string): string;
 /**
  * Tracks spend for one run. `node()` opens a visit to a node; `attempt()` opens
- * one agent run inside it. Spend is committed when an attempt finishes.
+ * one agent run inside it. Spend is committed once, when an attempt settles.
  */
 export declare class BudgetGuard {
     readonly runLimits: SpendLimits;
@@ -102,6 +102,7 @@ export declare class BudgetAttempt {
     private live;
     private liveUsage;
     private stopped;
+    private settled;
     private readonly onOuterAbort;
     constructor(guard: BudgetGuard, node: NodeBudget, outer?: AbortSignal | undefined);
     get signal(): AbortSignal;
@@ -113,11 +114,20 @@ export declare class BudgetAttempt {
     readonly onUsage: (u: NodeUsage) => void;
     private check;
     /**
-     * The attempt is over. Commit its spend (the larger of what the result
-     * reports and what was seen live) and return the breach, if any: the live
-     * stop, else a crossing visible only in the final usage.
+     * The attempt is over: commit its spend exactly once (#549). The spend is the
+     * larger of `finalUsage` and what was seen live, per unit. The breach (the
+     * live stop, else a crossing visible only in the final usage) is judged
+     * against the totals before this commit. Later calls change nothing and
+     * return the first call's breach, so the executor settles as soon as the
+     * harness returns, before any fallible work, and every exit path may settle
+     * again without double counting.
      */
+    settle(finalUsage?: NodeUsage): BudgetOverrun | undefined;
+    /** Settle with the attempt's final usage and return the breach, if any. */
     finish(finalUsage: NodeUsage | undefined): BudgetOverrun | undefined;
-    /** Release the outer-signal listener when the run threw before `finish`. */
+    /**
+     * Every exit path ends here: an attempt that threw still commits what it
+     * reported live. A no-op once settled.
+     */
     dispose(): void;
 }

package/dist/budget.js

@@ -69,7 +69,7 @@ export function describeOverrun(o, nodeId) {
 }
 /**
  * Tracks spend for one run. `node()` opens a visit to a node; `attempt()` opens
- * one agent run inside it. Spend is committed when an attempt finishes.
+ * one agent run inside it. Spend is committed once, when an attempt settles.
  */
 export class BudgetGuard {
     runLimits;
@@ -139,6 +139,7 @@ export class BudgetAttempt {
     live = { tokens: 0, costUsd: 0 };
     liveUsage;
     stopped;
+    settled;
     onOuterAbort = () => this.controller.abort();
     constructor(guard, node, outer) {
         this.guard = guard;
@@ -184,23 +185,37 @@ export class BudgetAttempt {
             breachOf("run", this.guard.runLimits, { tokens: r.tokens + attempt.tokens, costUsd: r.costUsd + attempt.costUsd }, true));
     }
     /**
-     * The attempt is over. Commit its spend (the larger of what the result
-     * reports and what was seen live) and return the breach, if any: the live
-     * stop, else a crossing visible only in the final usage.
+     * The attempt is over: commit its spend exactly once (#549). The spend is the
+     * larger of `finalUsage` and what was seen live, per unit. The breach (the
+     * live stop, else a crossing visible only in the final usage) is judged
+     * against the totals before this commit. Later calls change nothing and
+     * return the first call's breach, so the executor settles as soon as the
+     * harness returns, before any fallible work, and every exit path may settle
+     * again without double counting.
      */
-    finish(finalUsage) {
+    settle(finalUsage) {
+        if (this.settled)
+            return this.settled.breach;
         this.outer?.removeEventListener("abort", this.onOuterAbort);
         const f = spendOf(finalUsage);
         const spent = {
             tokens: Math.max(this.live.tokens, f.tokens ?? 0),
             costUsd: Math.max(this.live.costUsd, f.costUsd ?? 0),
         };
-        const b = this.stopped ?? this.check(spent);
+        const breach = this.stopped ?? this.check(spent);
+        this.settled = { breach };
         this.node.commit(spent);
-        return b;
+        return breach;
+    }
+    /** Settle with the attempt's final usage and return the breach, if any. */
+    finish(finalUsage) {
+        return this.settle(finalUsage);
     }
-    /** Release the outer-signal listener when the run threw before `finish`. */
+    /**
+     * Every exit path ends here: an attempt that threw still commits what it
+     * reported live. A no-op once settled.
+     */
     dispose() {
-        this.outer?.removeEventListener("abort", this.onOuterAbort);
+        this.settle();
     }
 }

package/dist/cli/run-answers.d.ts

@@ -41,6 +41,11 @@ export interface BuildRunAnswersInput {
     results: Map<string, NodeResult>;
     /** Secret values to redact (the same set the journal and output.md use). */
     secrets?: string[];
+    /**
+     * The key for redacted key names, asked for only when a key needs one. Default: a random key that
+     * lives only in this process (names then differ from run to run, which a diff shows as a change).
+     */
+    macKey?: () => Buffer;
 }
 /**
  * Declared fields of each successful node, deep, redacted (values and keys). A failed or skipped

package/dist/cli/run-answers.js

@@ -21,7 +21,7 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { redact } from "../journal.js";
+import { redact, workspaceSecretKey } from "../journal.js";
 import { writeFileNoFollow } from "../safe-file.js";
 import { RUN_HISTORY_DIR, RUN_ID_RE, listRuns } from "./run-history.js";
 export const RUN_ANSWERS_SCHEMA_VERSION = 1;
@@ -32,13 +32,56 @@ const isObj = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 // ── Build, write, read ──────────────────────────────────────────
 const has = (o, k) => Object.hasOwn(o, k);
 const sha = (s) => crypto.createHash("sha256").update(s).digest("hex");
+/** The JSON Schema types a schema declares: `type`, else implied by `properties` / `items`. */
+function declaredTypes(sch) {
+    if (typeof sch.type === "string")
+        return [sch.type];
+    if (Array.isArray(sch.type))
+        return sch.type.filter((t) => typeof t === "string");
+    if (isObj(sch.properties))
+        return ["object"];
+    if (isObj(sch.items))
+        return ["array"];
+    return undefined;
+}
+function typeMatches(value, types) {
+    return types.some((t) => {
+        switch (t) {
+            case "string":
+                return typeof value === "string";
+            case "number":
+                return typeof value === "number" && Number.isFinite(value);
+            case "integer":
+                return typeof value === "number" && Number.isInteger(value);
+            case "boolean":
+                return typeof value === "boolean";
+            case "null":
+                return value === null;
+            case "object":
+                return isObj(value);
+            case "array":
+                return Array.isArray(value);
+            default:
+                return false;
+        }
+    });
+}
 /**
- * Keep only what the schema declares, deep: `findings[].title` keeps `title` and nothing else. An
- * object with no declared properties is dropped (nothing in it was declared); scalars are kept.
- * Undefined means "drop".
+ * Keep only what the schema declares, deep, and only values whose shape matches it: `findings[].title`
+ * keeps `title` and nothing else, a string where an object is declared is dropped, as is a value of
+ * the wrong `type` or outside an `enum`. An object with no declared properties is dropped (nothing in
+ * it was declared). Undefined means "drop".
  */
 function pick(value, schema) {
     const sch = isObj(schema) ? schema : undefined;
+    if (sch) {
+        const types = declaredTypes(sch);
+        if (types && !typeMatches(value, types))
+            return undefined;
+        if (Array.isArray(sch.enum) && !isObj(value) && !Array.isArray(value) && !sch.enum.includes(value)) {
+            return undefined;
+        }
+    }
     if (Array.isArray(value)) {
         const items = sch && isObj(sch.items) ? sch.items : undefined;
         return value.map((v) => pick(v, items)).filter((v) => v !== undefined);
@@ -54,20 +97,24 @@ function pick(value, schema) {
     }
     return value;
 }
-/** Secrets in keys too (`redact` scrubs values and keeps keys). */
-function redactKeys(value, secrets) {
+/**
+ * Secrets in keys too (`redact` scrubs values and keeps keys). A key that redaction changes, or that
+ * already looks like a redacted name, becomes `[redacted-<first 16 hex of HMAC-SHA256(key)>]`, keyed
+ * with `macKey()`: injective (no two keys share a name, and no plain key can equal a generated one),
+ * stable (the same key gets the same name in every run, whatever else is present, so a diff lines
+ * them up) and not a guessing oracle for a low-entropy secret (a plain hash would be).
+ */
+function redactKeys(value, secrets, macKey) {
     if (Array.isArray(value))
-        return value.map((v) => redactKeys(v, secrets));
+        return value.map((v) => redactKeys(v, secrets, macKey));
     if (!isObj(value))
         return value;
-    const seen = new Map();
     return Object.fromEntries(Object.entries(value).map(([k, v]) => {
-        let name = redact(k, secrets).value;
-        const n = (seen.get(name) ?? 0) + 1;
-        seen.set(name, n);
-        if (n > 1)
-            name = `${name}#${n}`;
-        return [name, redactKeys(v, secrets)];
+        const scrubbed = redact(k, secrets).value;
+        const name = scrubbed !== k || k.startsWith("[redacted")
+            ? `[redacted-${crypto.createHmac("sha256", macKey()).update(k).digest("hex").slice(0, 16)}]`
+            : k;
+        return [name, redactKeys(v, secrets, macKey)];
     }));
 }
 /** [display value, digest tree]: strings over the cap are cut, and their full-text sha256 goes in the tree. */
@@ -97,6 +144,8 @@ function clipTree(value) {
  */
 export function buildRunAnswers(i) {
     const secrets = i.secrets ?? [];
+    let ephemeral;
+    const macKey = i.macKey ?? (() => (ephemeral ??= crypto.randomBytes(32)));
     const nodes = [];
     const digests = [];
     for (const [id, r] of i.results) {
@@ -109,12 +158,15 @@ export function buildRunAnswers(i) {
         if (isObj(props) && Object.keys(props).length > 0) {
             fields = pick(data, schema);
         }
-        else if (typeof data.summary === "string" && data.summary.trim() !== "") {
+        else if (typeof data.summary === "string" &&
+            data.summary.trim() !== "" &&
+            !(isObj(schema) && schema.additionalProperties === false)) {
+            // The free-form summary, unless the node's schema closes the object to its declared fields.
             fields = { summary: data.summary };
         }
         if (!isObj(fields) || Object.keys(fields).length === 0)
             continue;
-        const clean = redactKeys(redact(fields, secrets).value, secrets);
+        const clean = redactKeys(redact(fields, secrets).value, secrets, macKey);
         const [shown, digs] = clipTree(clean);
         nodes.push([id, shown]);
         if (digs !== undefined)
@@ -414,7 +466,10 @@ export function sinceLastRun(runId, workflowId, cwd = process.cwd()) {
 /** Save this run's answers, then compare with the previous run. Never throws. */
 export function recordRunAnswers(i, cwd = process.cwd()) {
     try {
-        if (!writeRunAnswers(buildRunAnswers(i), cwd))
+        // The key is per user and workspace and lives in the state dir; none usable means a process-only key.
+        let key;
+        const macKey = i.macKey ?? (() => (key ??= workspaceSecretKey(cwd, "answers") ?? crypto.randomBytes(32)));
+        if (!writeRunAnswers(buildRunAnswers({ ...i, macKey }), cwd))
             return null;
         return sinceLastRun(i.runId, i.workflow.id, cwd);
     }

package/dist/cli/run-history.js

@@ -19,6 +19,7 @@ import { openNoFollow } from "../safe-file.js";
 export const RUN_HISTORY_SCHEMA_VERSION = 1;
 export const RUN_HISTORY_DIR = path.join(".sweny", "runs");
 export const RUN_HISTORY_KEEP = 200;
+const RECORD_READ_MAX_BYTES = 1024 * 1024;
 // ── Hash + ids ──────────────────────────────────────────────────
 function canonicalize(value) {
     if (Array.isArray(value))
@@ -215,7 +216,12 @@ export function listRuns(cwd = process.cwd()) {
     const out = [];
     for (const f of files) {
         try {
-            const parsed = JSON.parse(fs.readFileSync(path.join(dir, f), "utf-8"));
+            // A link is not history: the target may be anywhere, and an agent can plant it.
+            const file = path.join(dir, f);
+            const st = fs.lstatSync(file);
+            if (!st.isFile() || st.size > RECORD_READ_MAX_BYTES)
+                continue;
+            const parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
             if (isRecord(parsed) && RUN_ID_RE.test(parsed.run_id) && f === `${parsed.run_id}.json`)
                 out.push(parsed);
         }

package/dist/cli/runs.js

@@ -222,12 +222,14 @@ function formatAnswersSection(cmp, color, g) {
             out.push(p.muted(`        ${g.ellipsis} and ${list.length - MAX_ITEMS_SHOWN} more ${word}`));
         }
     };
+    // Node, field and nested field names are keys of agent-writable files: terminal text, not trusted.
+    const key = (s) => sanitizeTerminal(s, 64);
     const fields = (list) => {
         if (list.length === 0)
             return;
-        const w = Math.max(...list.map((f) => f.field.length));
+        const w = Math.max(...list.map((f) => key(f.field).length));
         for (const f of list.slice(0, MAX_FIELDS_SHOWN)) {
-            out.push(`            ${pad(f.field, w)}  ${valueChange(f.before, f.after, g)}`);
+            out.push(`            ${pad(key(f.field), w)}  ${valueChange(f.before, f.after, g)}`);
         }
         if (list.length > MAX_FIELDS_SHOWN)
             out.push(p.muted(`            ${g.ellipsis} and ${list.length - MAX_FIELDS_SHOWN} more fields`));
@@ -236,14 +238,14 @@ function formatAnswersSection(cmp, color, g) {
     for (const node of nodes) {
         const changed = cmp.entries.filter((e) => e.node === node && isChangedEntry(e));
         if (changed.length === 0) {
-            out.push(`    ${node}  ${p.muted("unchanged")}`);
+            out.push(`    ${key(node)}  ${p.muted("unchanged")}`);
             continue;
         }
-        out.push(`    ${node}`);
-        const w = Math.max(...changed.map((e) => e.field.length));
+        out.push(`    ${key(node)}`);
+        const w = Math.max(...changed.map((e) => key(e.field).length));
         for (const e of changed) {
             if (e.kind === "collection") {
-                out.push(`      ${pad(e.field, w)}  ${p.muted(countsHead(e, g))}`);
+                out.push(`      ${pad(key(e.field), w)}  ${p.muted(countsHead(e, g))}`);
                 items("+", p.warning, e.added, "added");
                 items("-", p.success, e.resolved, "resolved");
                 for (const c of e.changed.slice(0, MAX_ITEMS_SHOWN)) {
@@ -255,18 +257,18 @@ function formatAnswersSection(cmp, color, g) {
                 }
             }
             else if (e.status === "added") {
-                out.push(`      ${pad(e.field, w)}  ${p.warning("added")} ${showValue(e.after, g)}`);
+                out.push(`      ${pad(key(e.field), w)}  ${p.warning("added")} ${showValue(e.after, g)}`);
             }
             else if (e.status === "resolved") {
-                out.push(`      ${pad(e.field, w)}  ${p.success("resolved")} ${p.muted(`(was ${showValue(e.before, g)})`)}`);
+                out.push(`      ${pad(key(e.field), w)}  ${p.success("resolved")} ${p.muted(`(was ${showValue(e.before, g)})`)}`);
             }
             else {
-                out.push(`      ${pad(e.field, w)}  ${valueChange(e.before, e.after, g)}`);
+                out.push(`      ${pad(key(e.field), w)}  ${valueChange(e.before, e.after, g)}`);
             }
         }
     }
     for (const n of cmp.not_compared) {
-        out.push(`    ${n.node}  ${p.muted(`not compared (answer in ${n.only_in} only)`)}`);
+        out.push(`    ${key(n.node)}  ${p.muted(`not compared (answer in ${n.only_in} only)`)}`);
     }
     if (nodes.length === 0 && cmp.not_compared.length === 0)
         out.push(p.muted("    no declared outputs to compare"));

package/dist/executor.js

@@ -598,6 +598,8 @@ async function executeRun(workflow, input, options, results, trace, at) {
                         safeObserve(observer, { type: "node:progress", node: currentId, message }, logger);
                     },
                 });
+                // Commit the attempt's spend before anything here can throw (#549); `finish` below reads the breach.
+                attemptBudget?.settle(result.usage);
             }
             catch (err) {
                 if (journalFault)
@@ -608,8 +610,9 @@ async function executeRun(workflow, input, options, results, trace, at) {
                 throw err;
             }
             finally {
-                parentSignal?.removeEventListener("abort", onParentAbort);
+                // A throw from the harness still commits the spend it reported live; a no-op once settled.
                 attemptBudget?.dispose();
+                parentSignal?.removeEventListener("abort", onParentAbort);
             }
             if (journalFault)
                 throw journalFault;
@@ -632,8 +635,8 @@ async function executeRun(workflow, input, options, results, trace, at) {
                 result = { ...result, degraded: [...new Set([...(result.degraded ?? []), ...budgetCheck.degraded])] };
             }
             if (attemptBudget) {
-                // Commit this attempt's spend; a live stop, or a crossing visible only
-                // in the final usage, fails the node whatever else it did.
+                // The spend was committed when the harness returned; a live stop, or a
+                // crossing visible only in the final usage, fails the node whatever else it did.
                 const breach = attemptBudget.finish(result.usage);
                 if (breach) {
                     const error = describeOverrun(breach, currentId);

package/dist/journal.d.ts

@@ -154,6 +154,14 @@ export declare class JournalLocationError extends Error {
  * it points. Throws {@link JournalLocationError}.
  */
 export declare function assertStateOutsideWorkspace(dir: string, cwd: string): void;
+/**
+ * A 32-byte random key private to this user and workspace, for MACs that must stay the same from run to
+ * run (a run's journal key is per run, so it cannot serve). Stored hex, mode 0600, at
+ * `<state dir>/keys/<workspace-hash>.<purpose>.key`, read and created without following a link. Null
+ * when the state dir cannot be trusted (inside the workspace, where an agent can read it) or used;
+ * callers then fall back to a key that lives only in the process. Never written anywhere an agent reads.
+ */
+export declare function workspaceSecretKey(cwd: string, purpose: string, env?: Record<string, string | undefined>): Buffer | null;
 /** Thrown when a journal's key is missing or unreadable: its records cannot be checked. */
 export declare class JournalKeyError extends Error {
     constructor(file: string, why: string);

package/dist/journal.js

@@ -313,6 +313,64 @@ export function assertStateOutsideWorkspace(dir, cwd) {
         throw new JournalLocationError(real, ws);
     }
 }
+/** True when `dir` (which may not exist yet) would resolve inside `cwd`: its nearest existing ancestor's real path decides. */
+function resolvesInside(dir, cwd) {
+    const ws = realOr(cwd);
+    let existing = path.resolve(dir);
+    const rest = [];
+    while (!fs.existsSync(existing) && path.dirname(existing) !== existing) {
+        rest.unshift(path.basename(existing));
+        existing = path.dirname(existing);
+    }
+    const real = path.join(realOr(existing), ...rest);
+    return real === ws || real.startsWith(ws.endsWith(path.sep) ? ws : ws + path.sep);
+}
+/**
+ * A 32-byte random key private to this user and workspace, for MACs that must stay the same from run to
+ * run (a run's journal key is per run, so it cannot serve). Stored hex, mode 0600, at
+ * `<state dir>/keys/<workspace-hash>.<purpose>.key`, read and created without following a link. Null
+ * when the state dir cannot be trusted (inside the workspace, where an agent can read it) or used;
+ * callers then fall back to a key that lives only in the process. Never written anywhere an agent reads.
+ */
+export function workspaceSecretKey(cwd, purpose, env = process.env) {
+    try {
+        const dir = path.join(swenyStateDir(env), "keys");
+        if (resolvesInside(dir, cwd))
+            return null;
+        makePrivateDir(dir);
+        if (resolvesInside(dir, cwd))
+            return null;
+        const file = path.join(dir, `${workspaceScope(cwd)}.${purpose.replace(/[^A-Za-z0-9_-]/g, "_")}.key`);
+        const read = () => {
+            const text = readNoFollow(file).toString("utf8").trim();
+            if (!/^[0-9a-f]{64}$/.test(text))
+                return null;
+            if (process.platform !== "win32" && (fs.lstatSync(file).mode & 0o077) !== 0)
+                return null;
+            return Buffer.from(text, "hex");
+        };
+        try {
+            return read();
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                return null;
+        }
+        const key = crypto.randomBytes(32);
+        try {
+            writeNew(file, key.toString("hex") + "\n");
+            return key;
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                return null;
+            return read(); // another run created it first
+        }
+    }
+    catch {
+        return null;
+    }
+}
 /** Thrown when a journal's key is missing or unreadable: its records cannot be checked. */
 export class JournalKeyError extends Error {
     constructor(file, why) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.190",
+  "version": "0.1.192",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"