@sweny-ai/core 0.1.210 → 0.1.212

package/dist/cli/workflow-upgrade.js

@@ -11,11 +11,15 @@
  * keys a migration renamed (they are added at the end of their map), and
  * formatting of arrays whose length a migration changed (rewritten whole).
  * JSON files carry no comments and are rewritten with 2-space indentation.
+ *
+ * Migration notes (#598): each spot a migration made explicit for the author
+ * to review gets a comment above its key (YAML), and is returned in `notes`
+ * so the CLI can print it (YAML and JSON).
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { isMap, parseDocument } from "yaml";
-import { DEFAULT_MIGRATION_CONFIG, migrateWorkflow } from "../migrations.js";
+import { isMap, isScalar, parseDocument } from "yaml";
+import { DEFAULT_MIGRATION_CONFIG, migrateWorkflow, } from "../migrations.js";
 import { validateParsed } from "../loader.js";
 function isPlainObject(v) {
     return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -54,6 +58,25 @@ function applyDiff(doc, at, old, next) {
     else
         doc.setIn(at, next);
 }
+/** Put `comment` on its own line above the key at `at`. No-op when the key is not in a block map. */
+function commentAbove(doc, at, comment) {
+    if (at.length === 0)
+        return;
+    const parent = at.length === 1 ? doc.contents : doc.getIn(at.slice(0, -1), true);
+    if (!isMap(parent))
+        return;
+    // A flow map (`{ deny: [shell] }`) has no room for a comment line: put it above the map's own key.
+    if (parent.flow)
+        return commentAbove(doc, at.slice(0, -1), comment);
+    const last = at[at.length - 1];
+    const pair = parent.items.find((p) => (isScalar(p.key) ? p.key.value : p.key) === last);
+    if (!pair)
+        return;
+    if (!isScalar(pair.key))
+        pair.key = doc.createNode(pair.key);
+    if (isScalar(pair.key))
+        pair.key.commentBefore = ` ${comment}`;
+}
 function setSpecVersion(doc, version) {
     const root = doc.contents;
     if (!isMap(root))
@@ -121,6 +144,8 @@ export function upgradeWorkflowFile(filePath, options = {}) {
     let out;
     if (doc) {
         applyDiff(doc, [], withoutSpecVersion(raw), withoutSpecVersion(migrated.workflow));
+        for (const note of migrated.notes)
+            commentAbove(doc, note.path, note.comment);
         setSpecVersion(doc, versionText);
         out = doc.toString();
     }
@@ -134,6 +159,7 @@ export function upgradeWorkflowFile(filePath, options = {}) {
         from: migrated.from,
         to: migrated.to,
         steps: migrated.applied.map((m) => m.description),
+        notes: migrated.notes,
         content: out,
     };
 }

package/dist/executor.js

@@ -34,7 +34,7 @@ import { budgetGate, isToolClass, policyGate, resolveHarnessPolicy } from "./har
 import { BudgetGuard, BudgetRefusal, describeOverrun, minLimits, spendOf, toLimits } from "./budget.js";
 import { createRunDecider, wantsDecider } from "./decider.js";
 import { redact, runSecretValues } from "./journal.js";
-import { buildNodePolicy, resolveNodePermissions } from "./node-policy.js";
+import { buildNodePolicy, hasNodePolicy, resolveNodePermissions } from "./node-policy.js";
 import { applySafeOutputs, createEmitOutputTool, createWriteStageState, resolveActor, safeOutputsInstruction, unresolvedOutputs, SAFE_OUTPUT_SCREEN_INSTRUCTION, } from "./safe-outputs.js";
 import { JournalWriteError } from "./journal.js";
 /**
@@ -463,7 +463,8 @@ async function executeRun(workflow, input, options, results, trace, at) {
         // #365: `permissions: read` (explicit, inherited, or implied by `outputs`)
         // gets the same tool gate as a dry run.
         const permissions = resolveNodePermissions(node, workflow);
-        const declaresPolicy = node.permissions !== undefined || workflow.permissions !== undefined || (node.outputs?.length ?? 0) > 0;
+        // #598: a spec v2 node with nothing declared is `read`, a policy like any other.
+        const declaresPolicy = hasNodePolicy(node, workflow);
         const readOnlyNode = dryRun || permissions.access === "read";
         // A staged run (--stage, safe_outputs.staged) writes nothing either: its
         // write tools are withheld too, and the dispatcher below refuses any that

package/dist/journal.d.ts

@@ -123,7 +123,8 @@ export declare function canonicalHash(value: unknown): string;
 /**
  * Hash of the workflow a journal is bound to: the canonical workflow plus its
  * effective `spec_version` (#469), so a file that only changes spec version
- * (and therefore migrations) is a different workflow for resume.
+ * (and therefore migrations) is a different workflow for resume. Absent means
+ * 1, the version such a workflow runs as (#598), not the current one.
  */
 export declare function workflowHashOf(workflow: Workflow): string;
 /** Hash of what the nodes were told: every resolved instruction, rule and context Source. */

package/dist/journal.js

@@ -109,7 +109,7 @@ import os from "node:os";
 import path from "node:path";
 import { isRefusal, refusalReason } from "./types.js";
 import { resolveNodePermissions } from "./node-policy.js";
-import { CURRENT_SPEC_VERSION } from "./migrations.js";
+import { effectiveSpecVersion } from "./migrations.js";
 import { spendOf } from "./budget.js";
 /**
  * v3: each record's HMAC chains the run id and the previous record's HMAC.
@@ -152,10 +152,11 @@ export function canonicalHash(value) {
 /**
  * Hash of the workflow a journal is bound to: the canonical workflow plus its
  * effective `spec_version` (#469), so a file that only changes spec version
- * (and therefore migrations) is a different workflow for resume.
+ * (and therefore migrations) is a different workflow for resume. Absent means
+ * 1, the version such a workflow runs as (#598), not the current one.
  */
 export function workflowHashOf(workflow) {
-    return canonicalHash({ ...workflow, spec_version: workflow.spec_version ?? String(CURRENT_SPEC_VERSION) });
+    return canonicalHash({ ...workflow, spec_version: String(effectiveSpecVersion(workflow)) });
 }
 /** Hash of what the nodes were told: every resolved instruction, rule and context Source. */
 export function instructionHash(sources) {

package/dist/loader.js

@@ -14,6 +14,7 @@ import * as path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { ZodError } from "zod";
 import { workflowZ, validateWorkflow, preflightLegacyVerify } from "./schema.js";
+import { approveDirectiveWarnings } from "./node-policy.js";
 import { DEFAULT_MIGRATION_CONFIG, migrateWorkflow, migrationWarning, } from "./migrations.js";
 /**
  * Load a workflow YAML or JSON file, parse with the canonical Zod schema,
@@ -57,6 +58,9 @@ export function validateParsed(raw, options = {}) {
     }
     raw = migrated.workflow;
     const warnings = migrated.applied.length > 0 ? [migrationWarning(migrated.from, migrated.to, options.filePath)] : [];
+    for (const note of migrated.notes)
+        if (note.warning)
+            warnings.push(note.warning);
     // Detect legacy `verify:` blocks (renamed to `eval:` in v0.2.0) before the
     // Zod parse. workflowZ is intentionally non-strict at the top level, so a
     // top-level `verify:` would be silently STRIPPED instead of surfacing the
@@ -93,5 +97,6 @@ export function validateParsed(raw, options = {}) {
             errors: structural.map((e) => ({ message: e.message, code: e.code, nodeId: e.nodeId })),
         };
     }
+    warnings.push(...approveDirectiveWarnings(parsed));
     return warnings.length > 0 ? { ok: true, workflow: parsed, warnings } : { ok: true, workflow: parsed };
 }

package/dist/migrations.d.ts

@@ -12,6 +12,11 @@
  *
  * Adding a migration: see `__tests__/migrations.test.ts` for the harness
  * (registry validity check plus a chain test to copy).
+ *
+ * A migration must keep behavior: a file migrated in memory runs exactly as it
+ * did. Where a new version changes a default, the migration writes the old
+ * default out explicitly, and reports each spot as a {@link MigrationNote}: the
+ * loader turns notes into warnings, `sweny workflow upgrade` into comments.
  */
 /** A raw, not-yet-validated workflow object as parsed from YAML or JSON. */
 export type RawWorkflow = Record<string, unknown>;
@@ -24,11 +29,35 @@ export interface Migration {
     description: string;
     /** Pure: must not mutate its input. Returns the next-version object. */
     migrate: (raw: RawWorkflow) => RawWorkflow;
+    /** Optional, pure: what the author should know about this step's changes to `raw` (its input). */
+    notes?: (raw: RawWorkflow) => MigrationNote[];
+}
+/** One spot a migration made explicit that the author should review. */
+export interface MigrationNote {
+    /** Path of the key the migration set, in the migrated object (e.g. `["nodes", "post", "permissions"]`). */
+    path: (string | number)[];
+    /** The node it is about, when there is one. */
+    nodeId?: string;
+    /** One line `sweny workflow upgrade` writes as a comment above `path`. */
+    comment: string;
+    /** One line the loader emits when it migrates in memory. Absent: nothing to warn about. */
+    warning?: string;
 }
 /** The spec version this build of sweny reads natively. */
-export declare const CURRENT_SPEC_VERSION = 1;
+export declare const CURRENT_SPEC_VERSION = 2;
+/**
+ * The spec version a workflow object runs as: its `spec_version`, or 1 when
+ * absent (a file written before the field, or a workflow built in code that
+ * the loader never migrated). Permission defaults and the journal's workflow
+ * hash both read this, so resume binds to the version the policy ran under.
+ */
+export declare function effectiveSpecVersion(workflow: {
+    spec_version?: string;
+}): number;
+/** The warning for one node that can write only because nothing limits it. */
+export declare function implicitWriteWarning(nodeId: string): string;
 /**
- * Ordered registry, one entry per version step. Empty while v1 is current.
+ * Ordered registry, one entry per version step.
  * Append only; never edit a shipped migration.
  */
 export declare const MIGRATIONS: readonly Migration[];
@@ -53,6 +82,8 @@ export type MigrateResult = {
     declared: boolean;
     /** Migrations applied, in order. Empty when the file is already current. */
     applied: Migration[];
+    /** Notes from the applied migrations, in order. Empty when there are none. */
+    notes: MigrationNote[];
 } | ({
     ok: false;
 } & MigrateError);

package/dist/migrations.js

@@ -12,14 +12,113 @@
  *
  * Adding a migration: see `__tests__/migrations.test.ts` for the harness
  * (registry validity check plus a chain test to copy).
+ *
+ * A migration must keep behavior: a file migrated in memory runs exactly as it
+ * did. Where a new version changes a default, the migration writes the old
+ * default out explicitly, and reports each spot as a {@link MigrationNote}: the
+ * loader turns notes into warnings, `sweny workflow upgrade` into comments.
  */
 /** The spec version this build of sweny reads natively. */
-export const CURRENT_SPEC_VERSION = 1;
+export const CURRENT_SPEC_VERSION = 2;
+/**
+ * The spec version a workflow object runs as: its `spec_version`, or 1 when
+ * absent (a file written before the field, or a workflow built in code that
+ * the loader never migrated). Permission defaults and the journal's workflow
+ * hash both read this, so resume binds to the version the policy ran under.
+ */
+export function effectiveSpecVersion(workflow) {
+    return workflow.spec_version === undefined ? 1 : Number(workflow.spec_version);
+}
+// ─── v1 -> v2: safe by default (#598) ────────────────────────────
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** The `access` a raw `permissions` value declares, if any. */
+function declaredAccess(p) {
+    if (typeof p === "string")
+        return p;
+    return isRecord(p) ? p.access : undefined;
+}
+function declaresNativeNone(p) {
+    return isRecord(p) && p.native === "none";
+}
+function skillList(node) {
+    return Array.isArray(node.skills) ? node.skills.filter((s) => typeof s === "string") : [];
+}
+/**
+ * Nodes whose access spec v1 left to its `write` fallback: no `access` of
+ * their own, no `outputs`, and no workflow `access`. Spec v2 reads those as
+ * `read`, so the migration declares what each one had.
+ *
+ * `read` only where it is provably the same: a node with no skills that runs
+ * with `native: none` (its own or the workflow's) has no tool at all, so
+ * nothing for `write` to unlock. Every other such node keeps `write`, the
+ * access it had; the migration never grants more than v1 did.
+ */
+function implicitAccessNodes(raw) {
+    if (declaredAccess(raw.permissions) !== undefined || !isRecord(raw.nodes))
+        return [];
+    const wfNone = declaresNativeNone(raw.permissions);
+    const found = [];
+    for (const [id, node] of Object.entries(raw.nodes)) {
+        if (!isRecord(node))
+            continue;
+        if (declaredAccess(node.permissions) !== undefined)
+            continue;
+        if (Array.isArray(node.outputs) && node.outputs.length > 0)
+            continue;
+        const skills = skillList(node);
+        const noTools = skills.length === 0 && (wfNone || declaresNativeNone(node.permissions));
+        const path = isRecord(node.permissions) ? ["nodes", id, "permissions", "access"] : ["nodes", id, "permissions"];
+        found.push({ id, access: noTools ? "read" : "write", path, skills });
+    }
+    return found;
+}
+/** The warning for one node that can write only because nothing limits it. */
+export function implicitWriteWarning(nodeId) {
+    return (`Node "${nodeId}" can write because nothing limits it (spec_version "1" default). ` +
+        "Declare permissions or outputs on it, or run `sweny workflow upgrade`.");
+}
+const v1ToV2 = {
+    from: 1,
+    to: 2,
+    description: "safe by default: declare `permissions` on every node that relied on the v1 `write` default",
+    migrate: (raw) => {
+        const found = implicitAccessNodes(raw);
+        if (found.length === 0)
+            return { ...raw };
+        const nodes = { ...raw.nodes };
+        for (const { id, access } of found) {
+            const node = nodes[id];
+            nodes[id] = {
+                ...node,
+                permissions: isRecord(node.permissions) ? { ...node.permissions, access } : access,
+            };
+        }
+        return { ...raw, nodes };
+    },
+    notes: (raw) => implicitAccessNodes(raw).map(({ id, access, path, skills }) => access === "read"
+        ? {
+            path,
+            nodeId: id,
+            comment: "sweny workflow upgrade: read, because this node has no skills and no built-in tools.",
+        }
+        : {
+            path,
+            nodeId: id,
+            comment: `sweny workflow upgrade: write, kept from spec v1 (nothing limited this node; ` +
+                (skills.length > 0
+                    ? `its skills [${skills.join(", ")}] may need their write tools). `
+                    : "it can use built-in shell and file edit tools). ") +
+                "If it only reads, set permissions: read; if it only posts, declare outputs.",
+            warning: implicitWriteWarning(id),
+        }),
+};
 /**
- * Ordered registry, one entry per version step. Empty while v1 is current.
+ * Ordered registry, one entry per version step.
  * Append only; never edit a shipped migration.
  */
-export const MIGRATIONS = [];
+export const MIGRATIONS = [v1ToV2];
 export const DEFAULT_MIGRATION_CONFIG = {
     current: CURRENT_SPEC_VERSION,
     migrations: MIGRATIONS,
@@ -65,12 +164,15 @@ export function migrateWorkflow(raw, config = DEFAULT_MIGRATION_CONFIG) {
     }
     let current = declared ? { ...raw, spec_version: String(from) } : raw;
     const applied = [];
+    const notes = [];
     for (let v = from; v < config.current; v++) {
         const step = config.migrations.find((m) => m.from === v);
         if (!step) {
             return { ok: false, code: "MIGRATION_FAILED", message: `No migration registered from spec_version "${v}".` };
         }
         try {
+            if (step.notes)
+                notes.push(...step.notes(current));
             current = { ...step.migrate(current), spec_version: String(step.to) };
         }
         catch (err) {
@@ -83,7 +185,7 @@ export function migrateWorkflow(raw, config = DEFAULT_MIGRATION_CONFIG) {
         }
         applied.push(step);
     }
-    return { ok: true, workflow: current, from, to: config.current, declared, applied };
+    return { ok: true, workflow: current, from, to: config.current, declared, applied, notes };
 }
 /** The single warning the loader emits when it migrated in memory. */
 export function migrationWarning(from, to, filePath) {

package/dist/node-policy.d.ts

@@ -12,15 +12,29 @@ export interface ResolvedPermissions {
     strict: boolean;
     native?: NodeNative;
 }
+/**
+ * The access a node gets when neither it nor the workflow declares one (#598).
+ * Spec v2 and later: `read`, safe by default. Spec v1, or no `spec_version` (a
+ * workflow built in code, or one the loader did not migrate): `write`, the v1
+ * behavior. The loader migrates v1 files to v2 with that `write` made explicit.
+ */
+export declare function defaultNodeAccess(workflow?: Pick<Workflow, "spec_version">): NodeAccess;
+/**
+ * True when the node runs under a declared policy: its own or the workflow's
+ * `permissions`, its `outputs`, or the spec v2 `read` default. A node that runs
+ * under none keeps each harness's own defaults (spec v1 only).
+ */
+export declare function hasNodePolicy(node: Pick<Node, "permissions" | "outputs">, workflow?: Pick<Workflow, "permissions" | "spec_version">): boolean;
 /**
  * Effective permissions for a node.
  *
  * access: the node's own, else `read` when it declares `outputs`, else the
- * workflow's, else `write` (today's behavior). A workflow `read` ceiling wins
- * over a node `write` (the loader rejects that combination; this is the
- * runtime backstop). deny: union. strict: either. native: `none` if either says so.
+ * workflow's, else {@link defaultNodeAccess} (`read` from spec v2, `write` in
+ * v1). A workflow `read` ceiling wins over a node `write` (the loader rejects
+ * that combination; this is the runtime backstop). deny: union. strict:
+ * either. native: `none` if either says so.
  */
-export declare function resolveNodePermissions(node: Pick<Node, "permissions" | "outputs">, workflow?: Pick<Workflow, "permissions">): ResolvedPermissions;
+export declare function resolveNodePermissions(node: Pick<Node, "permissions" | "outputs">, workflow?: Pick<Workflow, "permissions" | "spec_version">): ResolvedPermissions;
 /** True when a node asks for more than the workflow ceiling allows. */
 export declare function exceedsPermissionCeiling(node: Pick<Node, "permissions">, workflow: Pick<Workflow, "permissions">): boolean;
 /** The portable policy handed to the harness for one node run. */
@@ -30,3 +44,12 @@ export declare function buildNodePolicy(opts: {
     disallowedTools?: string[];
     egress?: string[];
 }): NodePolicy;
+/**
+ * Load warnings for review nodes told to approve (#598). The pr-review
+ * template before #598 said "If no issues found, approve with a brief note";
+ * files generated from it keep that line through `sweny workflow upgrade`.
+ * Precise on purpose: only a node that can write (so it could act on it), in a
+ * `pr_review` workflow or whose instruction is about a pull request or review,
+ * with an inline instruction line that says "approve", not negated ("never approve").
+ */
+export declare function approveDirectiveWarnings(workflow: Workflow): string[];

package/dist/node-policy.js

@@ -4,23 +4,45 @@
  * Pure and browser-safe. The workflow's `permissions` is both the default and
  * the ceiling for every node; a node may narrow it, never widen it.
  */
+import { effectiveSpecVersion } from "./migrations.js";
 function spec(p) {
     if (p === undefined)
         return {};
     return typeof p === "string" ? { access: p } : p;
 }
+/**
+ * The access a node gets when neither it nor the workflow declares one (#598).
+ * Spec v2 and later: `read`, safe by default. Spec v1, or no `spec_version` (a
+ * workflow built in code, or one the loader did not migrate): `write`, the v1
+ * behavior. The loader migrates v1 files to v2 with that `write` made explicit.
+ */
+export function defaultNodeAccess(workflow = {}) {
+    return effectiveSpecVersion(workflow) >= 2 ? "read" : "write";
+}
+/**
+ * True when the node runs under a declared policy: its own or the workflow's
+ * `permissions`, its `outputs`, or the spec v2 `read` default. A node that runs
+ * under none keeps each harness's own defaults (spec v1 only).
+ */
+export function hasNodePolicy(node, workflow = {}) {
+    return (node.permissions !== undefined ||
+        workflow.permissions !== undefined ||
+        (node.outputs?.length ?? 0) > 0 ||
+        defaultNodeAccess(workflow) === "read");
+}
 /**
  * Effective permissions for a node.
  *
  * access: the node's own, else `read` when it declares `outputs`, else the
- * workflow's, else `write` (today's behavior). A workflow `read` ceiling wins
- * over a node `write` (the loader rejects that combination; this is the
- * runtime backstop). deny: union. strict: either. native: `none` if either says so.
+ * workflow's, else {@link defaultNodeAccess} (`read` from spec v2, `write` in
+ * v1). A workflow `read` ceiling wins over a node `write` (the loader rejects
+ * that combination; this is the runtime backstop). deny: union. strict:
+ * either. native: `none` if either says so.
  */
 export function resolveNodePermissions(node, workflow = {}) {
     const wf = spec(workflow.permissions);
     const own = spec(node.permissions);
-    let access = own.access ?? (node.outputs && node.outputs.length > 0 ? "read" : (wf.access ?? "write"));
+    let access = own.access ?? (node.outputs && node.outputs.length > 0 ? "read" : (wf.access ?? defaultNodeAccess(workflow)));
     if (wf.access === "read")
         access = "read";
     const deny = [...new Set([...(wf.deny ?? []), ...(own.deny ?? [])])];
@@ -48,3 +70,36 @@ export function buildNodePolicy(opts) {
         ...(opts.permissions.native === "none" ? { nativeNone: true } : {}),
     };
 }
+const APPROVE = /\bapprove\b/i;
+/** "never approve", "do not approve", "don't ever approve": the negation governs approve itself. */
+const NEGATED = /(?:\b(?:never|not|no|nor)|n't)\s+(?:\w+\s+)?approve\b/i;
+const REVIEW = /\bpull requests?\b|\bPRs?\b|\breview/i;
+/**
+ * Load warnings for review nodes told to approve (#598). The pr-review
+ * template before #598 said "If no issues found, approve with a brief note";
+ * files generated from it keep that line through `sweny workflow upgrade`.
+ * Precise on purpose: only a node that can write (so it could act on it), in a
+ * `pr_review` workflow or whose instruction is about a pull request or review,
+ * with an inline instruction line that says "approve", not negated ("never approve").
+ */
+export function approveDirectiveWarnings(workflow) {
+    const warnings = [];
+    for (const [id, node] of Object.entries(workflow.nodes)) {
+        const text = typeof node.instruction === "string"
+            ? node.instruction
+            : "inline" in node.instruction
+                ? node.instruction.inline
+                : undefined;
+        if (text === undefined || resolveNodePermissions(node, workflow).access !== "write")
+            continue;
+        if (workflow.workflow_type !== "pr_review" && !REVIEW.test(text))
+            continue;
+        const line = text.split("\n").find((l) => APPROVE.test(l) && !NEGATED.test(l));
+        if (line === undefined)
+            continue;
+        warnings.push(`Node "${id}" can write and its instruction tells the agent to approve ("${line.trim()}"). ` +
+            "An AI reviewer should never approve: delete that line, and post the review as a comment output " +
+            "(see `sweny new --template pr-review`).");
+    }
+    return warnings;
+}

package/dist/safe-outputs.d.ts

@@ -13,7 +13,7 @@
  * labels, title prefix, dedupe, node cap, run cap. An optional model screen runs last
  * over the intents that passed and can only veto them.
  */
-import type { BranchPusher, Logger, SafeOutputDeclaration, SafeOutputPin, SafeOutputReceipt, SafeOutputsPolicy, SafeOutputType, Skill, Tool, ToolContext } from "./types.js";
+import type { BranchPusher, Logger, SafeOutputDeclaration, SafeOutputPin, SafeOutputTarget, SafeOutputReceipt, SafeOutputsPolicy, SafeOutputType, Skill, Tool, ToolContext } from "./types.js";
 /** Name of the intent-recording tool a node with `outputs` receives. */
 export declare const EMIT_OUTPUT_TOOL = "emit_output";
 /** Longest title the write stage accepts (after the prefix). */
@@ -60,6 +60,8 @@ export declare function actorTrusted(policy: SafeOutputsPolicy | undefined, acto
  * The issue or PR a declaration pins, as a string. `{ input: name }` reads the
  * run input; an absent or empty value is `undefined`, which refuses the write.
  */
+/** A declared target: the literal, or the run input it names. Empty or missing: undefined. */
+export declare function resolveTarget(target: SafeOutputTarget | undefined, input?: Record<string, unknown>): string | undefined;
 export declare function resolvePin(pin: SafeOutputPin, input?: Record<string, unknown>): string | undefined;
 /** `30m` → 1_800_000. Undefined for anything the schema would reject. */
 export declare function parseDuration(s: string | undefined): number | undefined;

package/dist/safe-outputs.js

@@ -113,8 +113,9 @@ export function createEmitOutputTool(declarations, buffer, now = Date.now) {
 export function safeOutputsInstruction(declarations, input) {
     const lines = declarations.map((d) => {
         const parts = [`at most ${d.max ?? 1}`];
-        if (d.target)
-            parts.push(`target ${d.target}`);
+        const target = resolveTarget(d.target, input);
+        if (target)
+            parts.push(`target ${target}`);
         if (d.number !== undefined) {
             const pin = resolvePin(d.number, input);
             parts.push(pin ? `only issue or PR ${pin} (the number may be omitted)` : "pinned issue not set for this run");
@@ -179,6 +180,14 @@ export function actorTrusted(policy, actor) {
  * The issue or PR a declaration pins, as a string. `{ input: name }` reads the
  * run input; an absent or empty value is `undefined`, which refuses the write.
  */
+/** A declared target: the literal, or the run input it names. Empty or missing: undefined. */
+export function resolveTarget(target, input) {
+    const raw = typeof target === "object" ? input?.[target.input] : target;
+    if (typeof raw !== "string")
+        return undefined;
+    const v = raw.trim();
+    return v.length > 0 ? v : undefined;
+}
 export function resolvePin(pin, input) {
     const raw = typeof pin === "object" ? input?.[pin.input] : pin;
     if (typeof raw === "number" && Number.isInteger(raw) && raw > 0)
@@ -375,12 +384,21 @@ export async function applySafeOutputs(o) {
             refuse("no skill can apply this type");
             continue;
         }
-        // The run's repo from the operator's env, never one a workspace .env introduced.
-        const pinned = decl.target ?? (via === "github" ? trustedEnvValue(o.env, "GITHUB_REPOSITORY") || undefined : undefined);
+        // The declared target (a literal, or the run input it names), else the run's
+        // repo from the operator's env, never one a workspace .env introduced.
+        const pinned = resolveTarget(decl.target, o.input) ??
+            (via === "github" ? trustedEnvValue(o.env, "GITHUB_REPOSITORY") || undefined : undefined);
         if (intent.target && pinned && intent.target.toLowerCase() !== pinned.toLowerCase()) {
             refuse("target outside the declared target", { via });
             continue;
         }
+        // #598: an output pinned to one issue or PR is pinned to one repository too, and that
+        // repository comes only from the declaration, a run input, or GITHUB_REPOSITORY. Never
+        // from the agent: PR #N of any repo the token can write to is not the pinned PR.
+        if (via === "github" && decl.number !== undefined && !pinned) {
+            refuse("pinned output needs a trusted repository", { via });
+            continue;
+        }
         const target = intent.target ?? pinned;
         if (applier.needsTarget && !target) {
             refuse("no target", { via });

package/dist/schema.d.ts

@@ -297,7 +297,9 @@ export declare const safeOutputDeclarationZ: z.ZodObject<{
     }>;
     via: z.ZodOptional<z.ZodString>;
     max: z.ZodOptional<z.ZodNumber>;
-    target: z.ZodOptional<z.ZodString>;
+    target: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        input: z.ZodString;
+    }, z.core.$strict>]>>;
     title_prefix: z.ZodOptional<z.ZodString>;
     labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
     expires: z.ZodOptional<z.ZodString>;
@@ -397,7 +399,9 @@ export declare const nodeZ: z.ZodObject<{
         }>;
         via: z.ZodOptional<z.ZodString>;
         max: z.ZodOptional<z.ZodNumber>;
-        target: z.ZodOptional<z.ZodString>;
+        target: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            input: z.ZodString;
+        }, z.core.$strict>]>>;
         title_prefix: z.ZodOptional<z.ZodString>;
         labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
         expires: z.ZodOptional<z.ZodString>;
@@ -603,7 +607,9 @@ export declare const workflowZ: z.ZodObject<{
             }>;
             via: z.ZodOptional<z.ZodString>;
             max: z.ZodOptional<z.ZodNumber>;
-            target: z.ZodOptional<z.ZodString>;
+            target: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                input: z.ZodString;
+            }, z.core.$strict>]>>;
             title_prefix: z.ZodOptional<z.ZodString>;
             labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
             expires: z.ZodOptional<z.ZodString>;
@@ -871,7 +877,9 @@ export declare function parseWorkflow(raw: unknown): {
             type: "label" | "comment" | "issue" | "pr" | "issue_state";
             via?: string | undefined;
             max?: number | undefined;
-            target?: string | undefined;
+            target?: string | {
+                input: string;
+            } | undefined;
             title_prefix?: string | undefined;
             labels?: string[] | undefined;
             expires?: string | undefined;
@@ -1360,9 +1368,21 @@ export declare const workflowJsonSchema: {
                     readonly description: "Max writes of this type from this node per run. Default 1.";
                 };
                 readonly target: {
-                    readonly type: "string";
-                    readonly minLength: 1;
-                    readonly description: "Pinned target (GitHub owner/repo, Linear team id). GitHub default: GITHUB_REPOSITORY.";
+                    readonly description: "Pinned target (GitHub owner/repo, Linear team id), or { input: <name> } to take it from a run input. GitHub default: GITHUB_REPOSITORY. An output that pins number never takes its GitHub repository from the agent.";
+                    readonly oneOf: readonly [{
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    }, {
+                        readonly type: "object";
+                        readonly required: readonly ["input"];
+                        readonly additionalProperties: false;
+                        readonly properties: {
+                            readonly input: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                        };
+                    }];
                 };
                 readonly title_prefix: {
                     readonly type: "string";
@@ -1427,7 +1447,7 @@ export declare const workflowJsonSchema: {
         readonly spec_version: {
             readonly type: "string";
             readonly pattern: "^[1-9][0-9]*$";
-            readonly description: "Workflow spec version as a positive integer string. Absent means 1. Older versions are migrated in memory on load; newer than the CLI supports is refused. Run `sweny workflow upgrade <file>` to rewrite a file at the current version.";
+            readonly description: "Workflow spec version as a positive integer string. Absent means 1. Version 2 is safe by default: a node that declares no permissions and no outputs, in a workflow that declares no permissions, is read-only. Version 1 files are migrated in memory on load, keeping write on such nodes with one warning each; newer than the CLI supports is refused. Run `sweny workflow upgrade <file>` to rewrite a file at the current version.";
         };
         readonly entry: {
             readonly type: "string";
@@ -1465,7 +1485,7 @@ export declare const workflowJsonSchema: {
         };
         readonly permissions: {
             readonly $ref: "#/$defs/Permissions";
-            readonly description: "Default and ceiling for every node's permissions. Absent: write.";
+            readonly description: "Default and ceiling for every node's permissions. Absent: read (spec_version 2), write (spec_version 1).";
         };
         readonly safe_outputs: {
             readonly type: "object";
@@ -1759,7 +1779,7 @@ export declare const workflowJsonSchema: {
                     };
                     readonly permissions: {
                         readonly $ref: "#/$defs/Permissions";
-                        readonly description: "What this node's agent may do. Absent: read when the node declares outputs, else the workflow's permissions, else write.";
+                        readonly description: "What this node's agent may do. Absent: read when the node declares outputs, else the workflow's permissions, else read (spec_version 2) or write (spec_version 1).";
                     };
                     readonly outputs: {
                         readonly type: "array";