@sweny-ai/core 0.1.102 → 0.1.104

package/dist/cli/check.js

@@ -1,3 +1,8 @@
+/**
+ * Per-check network timeout. A hung connect must not make `sweny check` hang
+ * indefinitely — the whole point of the command is fast diagnostics.
+ */
+const CHECK_TIMEOUT_MS = 5000;
 /**
  * Run lightweight connectivity checks for all configured providers.
  * Uses raw fetch — does NOT import provider packages.
@@ -7,17 +12,24 @@ export async function checkProviderConnectivity(config) {
     const githubChecked = { done: false }; // avoid double-checking same token
     // ── Coding agent ────────────────────────────────────────────────────────────
     if (config.codingAgentProvider === "claude") {
-        if (!config.anthropicApiKey && !config.claudeOauthToken) {
-            results.push({ name: "Anthropic (claude agent)", status: "skip", detail: "No key configured" });
+        const mode = resolveCheckAuthMode(config);
+        const base = config.anthropicBaseUrl;
+        if (mode === "none") {
+            results.push({ name: "Anthropic (claude agent)", status: "skip", detail: "No credential configured" });
+        }
+        else if (base) {
+            // Gateway: probe the gateway, never real Anthropic with a gateway-bound key.
+            results.push(await checkAnthropicGateway(base, config, mode));
         }
-        else if (config.anthropicApiKey) {
+        else if (mode === "api-key") {
             results.push(await checkAnthropic(config.anthropicApiKey));
         }
         else {
+            // oauth or auth-token, no base URL: nothing cheap to probe, report the mode.
             results.push({
                 name: "Anthropic (claude agent)",
                 status: "skip",
-                detail: "CLAUDE_CODE_OAUTH_TOKEN set — skipping API check",
+                detail: `auth mode: ${mode}, skipping upstream API check`,
             });
         }
     }
@@ -105,6 +117,7 @@ async function checkAnthropic(apiKey) {
     try {
         const res = await fetch("https://api.anthropic.com/v1/models", {
             headers: { "x-api-key": apiKey, "anthropic-version": "2023-06-01" },
+            signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
         });
         if (res.status === 200) {
             return { name, status: "ok", detail: "API key is valid" };
@@ -122,15 +135,79 @@ async function checkAnthropic(apiKey) {
         return { name, status: "fail", detail: networkErrorMessage(err) };
     }
 }
-async function checkDatadog(creds) {
+export function resolveCheckAuthMode(config) {
+    const hasKey = !!config.anthropicApiKey;
+    const hasBearer = !!config.anthropicAuthToken;
+    const hasOauth = !!config.claudeOauthToken;
+    if (config.swenyAuth === "oauth")
+        return hasOauth ? "oauth" : "none";
+    if (config.swenyAuth === "api-key")
+        return hasKey ? "api-key" : hasBearer ? "auth-token" : "none";
+    // auto: OAuth wins when present (today's protective behavior)
+    if (hasOauth)
+        return "oauth";
+    if (hasKey)
+        return "api-key";
+    if (hasBearer)
+        return "auth-token";
+    return "none";
+}
+/** Redact a URL to scheme + host so userinfo / query (which can carry a key) never logs. */
+export function redactUrl(raw) {
+    try {
+        const u = new URL(raw);
+        return `${u.protocol}//${u.host}`;
+    }
+    catch {
+        return "(invalid URL)";
+    }
+}
+export async function checkAnthropicGateway(base, config, mode) {
+    const name = "Anthropic (gateway)";
+    const safeBase = redactUrl(base);
+    const headers = { "anthropic-version": "2023-06-01" };
+    if (mode === "api-key") {
+        headers["x-api-key"] = config.anthropicApiKey;
+    }
+    else {
+        // auth-token or oauth against the gateway
+        headers.Authorization = `Bearer ${config.anthropicAuthToken || config.claudeOauthToken}`;
+    }
+    try {
+        const url = base.replace(/\/+$/, "") + "/v1/models";
+        const res = await fetch(url, { headers, signal: AbortSignal.timeout(CHECK_TIMEOUT_MS) });
+        // Gateways vary on whether /v1/models exists; reachable + non-auth-error is good enough.
+        if (res.ok || res.status === 404) {
+            return { name, status: "ok", detail: `gateway reachable (${safeBase}), auth mode: ${mode}` };
+        }
+        if (res.status === 401 || res.status === 403) {
+            return { name, status: "fail", detail: `${res.status} from gateway ${safeBase}, check gateway credentials` };
+        }
+        return { name, status: "fail", detail: `Unexpected HTTP ${res.status} from gateway ${safeBase}` };
+    }
+    catch (err) {
+        return { name, status: "fail", detail: networkErrorMessage(err) };
+    }
+}
+export async function checkDatadog(creds) {
     const name = "Observability (datadog)";
     const { apiKey, appKey, site = "datadoghq.com" } = creds;
     if (!apiKey || !appKey) {
         return { name, status: "skip", detail: "DD_API_KEY or DD_APP_KEY not configured" };
     }
+    // `site` (DD_SITE) is interpolated into the request URL — reject anything
+    // outside a hostname allowlist before it can smuggle a path/query/host.
+    if (!/^[a-z0-9.-]+$/.test(site)) {
+        return {
+            name,
+            status: "fail",
+            detail: `Invalid DD_SITE "${site}" — expected a hostname like datadoghq.com or datadoghq.eu`,
+        };
+    }
     try {
         const res = await fetch(`https://api.${site}/api/v2/validate`, {
             headers: { "DD-API-KEY": apiKey, "DD-APPLICATION-KEY": appKey },
+            signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
         });
         if (res.status === 200) {
             return { name, status: "ok", detail: "API key is valid" };
@@ -157,6 +234,7 @@ async function checkSentry(creds) {
     try {
         const res = await fetch("https://sentry.io/api/0/", {
             headers: { Authorization: `Bearer ${authToken}` },
+            signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
         });
         if (res.status === 200) {
             return { name, status: "ok", detail: "Auth token is valid" };
@@ -184,6 +262,7 @@ async function checkLinear(apiKey) {
             method: "POST",
             headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
             body: JSON.stringify({ query: "{ viewer { id name } }" }),
+            signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
         });
         if (res.status === 200) {
             const body = (await res.json());
@@ -213,6 +292,7 @@ async function checkGitHub(token, name) {
     try {
         const res = await fetch("https://api.github.com/user", {
             headers: { Authorization: `token ${token}`, "User-Agent": "sweny-cli" },
+            signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
         });
         if (res.status === 200) {
             const body = (await res.json());
@@ -232,6 +312,12 @@ async function checkGitHub(token, name) {
     }
 }
 function networkErrorMessage(err) {
+    // AbortSignal.timeout fires a DOMException with name "TimeoutError"; an
+    // explicit abort surfaces as "AbortError". Either means we gave up waiting.
+    const errName = err instanceof Error ? err.name : "";
+    if (errName === "TimeoutError" || errName === "AbortError") {
+        return `Connection timed out after ${CHECK_TIMEOUT_MS}ms — host unreachable or too slow`;
+    }
     const msg = err instanceof Error ? err.message : String(err);
     if (/ENOTFOUND|ETIMEDOUT|ECONNREFUSED/i.test(msg)) {
         return `Network error — check your internet connection (${msg})`;

package/dist/cli/config-file.js

@@ -52,7 +52,11 @@ export function loadConfigFile(cwd = process.cwd()) {
     try {
         raw = parseYaml(content);
     }
-    catch {
+    catch (err) {
+        // A malformed config file must not silently fall back to defaults — the
+        // user would get unexpected behavior with no clue their file was dropped.
+        const reason = err instanceof Error ? err.message : String(err);
+        console.warn(`⚠  Ignoring malformed config file ${filePath}: ${reason}`);
         return {};
     }
     if (!raw || typeof raw !== "object")

package/dist/cli/config.d.ts

@@ -4,7 +4,12 @@ import type { FileConfig } from "./config-file.js";
 export interface CliConfig {
     codingAgentProvider: string;
     anthropicApiKey: string;
+    anthropicAuthToken: string;
     claudeOauthToken: string;
+    /** Anthropic-compatible base URL (e.g. a LiteLLM gateway). */
+    anthropicBaseUrl: string;
+    /** Auth precedence mode: auto (default), api-key, or oauth. */
+    swenyAuth: "auto" | "api-key" | "oauth";
     openaiApiKey: string;
     geminiApiKey: string;
     observabilityProviders: string[];
@@ -82,6 +87,12 @@ export declare function parseCliInputs(options: Record<string, unknown>, fileCon
  */
 export declare const SUPPORTED_WORKSPACE_TOOLS: Set<string>;
 export declare function validateInputs(config: CliConfig): string[];
+/**
+ * Normalize a SWENY_AUTH value. Unknown / empty values fall back to "auto"
+ * (the safe, billing-protective default). Never throws: an env typo must not
+ * crash a run, and `auto` only ever strips a key to protect a subscription.
+ */
+export declare function normalizeSwenyAuth(raw: unknown): "auto" | "api-key" | "oauth";
 /**
  * Parse a value as a positive integer (>= 1).
  *

package/dist/cli/config.js

@@ -59,7 +59,7 @@ export function registerTriageCommand(program) {
         .option("--verbose", "Print each tool call's input and output inline (human-readable, truncated). Use --stream for full untruncated NDJSON.", false)
         .option("--bell", "Ring terminal bell on completion", false)
         .option("--cache-dir <path>", "Step cache directory (default: .sweny/cache)")
-        .option("--cache-ttl <seconds>", "Cache TTL in seconds, 0 = infinite (default: 86400)")
+        .option("--cache-ttl <seconds>", "Cache TTL in seconds, 1 to 31536000 (default: 86400)")
         .option("--no-cache", "Disable step cache")
         .option("--output-dir <path>", "Output directory for file providers (default: .sweny/output)")
         .option("--workspace-tools <tools>", "Comma-separated workspace tool integrations to enable (slack, notion, pagerduty, monday)")
@@ -100,7 +100,11 @@ export function parseCliInputs(options, fileConfig = {}) {
         codingAgentProvider: options.agent || options.codingAgentProvider || f("coding-agent-provider") || "claude",
         // Secrets: env only — never from config file
         anthropicApiKey: env.ANTHROPIC_API_KEY || "",
+        anthropicAuthToken: env.ANTHROPIC_AUTH_TOKEN || "",
         claudeOauthToken: env.CLAUDE_CODE_OAUTH_TOKEN || "",
+        // Non-secret config: env or .sweny config file (mirrors gitlabBaseUrl)
+        anthropicBaseUrl: env.ANTHROPIC_BASE_URL || f("anthropic-base-url") || "",
+        swenyAuth: normalizeSwenyAuth(env.SWENY_AUTH || f("sweny-auth")),
         openaiApiKey: env.OPENAI_API_KEY || "",
         geminiApiKey: env.GEMINI_API_KEY || env.GOOGLE_API_KEY || "",
         observabilityProviders: obsProviders,
@@ -431,6 +435,9 @@ export function validateInputs(config) {
     // bounds check let junk through).
     validateIntegerBound(errors, "--max-investigate-turns", config.maxInvestigateTurns, 1, 500);
     validateIntegerBound(errors, "--max-implement-turns", config.maxImplementTurns, 1, 500);
+    // cacheTtl is parsed with parsePositiveInt (junk → NaN); bound it so a
+    // malformed --cache-ttl / cache-ttl: surfaces a field error instead of NaN.
+    validateIntegerBound(errors, "--cache-ttl", config.cacheTtl, 1, 31_536_000);
     return errors;
 }
 function validateIntegerBound(errors, flag, value, min, max) {
@@ -442,6 +449,17 @@ function validateIntegerBound(errors, flag, value, min, max) {
         errors.push(`${flag} must be between ${min} and ${max}`);
     }
 }
+/**
+ * Normalize a SWENY_AUTH value. Unknown / empty values fall back to "auto"
+ * (the safe, billing-protective default). Never throws: an env typo must not
+ * crash a run, and `auto` only ever strips a key to protect a subscription.
+ */
+export function normalizeSwenyAuth(raw) {
+    const v = String(raw ?? "")
+        .trim()
+        .toLowerCase();
+    return v === "api-key" || v === "oauth" ? v : "auto";
+}
 /**
  * Parse a value as a positive integer (>= 1).
  *

package/dist/cli/e2e.d.ts

@@ -1,5 +1,5 @@
 /**
- * sweny e2e — Generate and run agent-driven end-to-end browser tests.
+ * sweny e2e (now `sweny new e2e` + `sweny workflow run`) — generate and run agent-driven end-to-end browser tests.
  *
  * Pure functions for workflow generation + thin @clack/prompts interactive layer.
  * Tests cover the pure functions; the interactive wizard is thin glue.
@@ -78,7 +78,20 @@ export declare function runE2eInit(options?: E2eInitOptions): Promise<void>;
 export interface E2eRunOptions {
     file?: string;
     timeout?: number;
+    /** Skip the batch confirmation prompt (CI). Only applies to no-file batch runs. */
+    yes?: boolean;
 }
+/**
+ * Policy for a no-file batch run. Pure so it can be unit-tested without
+ * touching the filesystem, stdin, or the engine.
+ * - `yes` → run without asking (CI).
+ * - non-interactive without `yes` → refuse (don't fire every workflow by accident).
+ * - interactive → ask for confirmation.
+ */
+export declare function batchRunDecision(opts: {
+    yes?: boolean;
+    isTTY: boolean;
+}): "run" | "confirm" | "refuse-noninteractive";
 /**
  * Load and execute e2e workflow files from .sweny/e2e/.
  */

package/dist/cli/e2e.js

@@ -1,5 +1,5 @@
 /**
- * sweny e2e — Generate and run agent-driven end-to-end browser tests.
+ * sweny e2e (now `sweny new e2e` + `sweny workflow run`) — generate and run agent-driven end-to-end browser tests.
  *
  * Pure functions for workflow generation + thin @clack/prompts interactive layer.
  * Tests cover the pure functions; the interactive wizard is thin glue.
@@ -501,7 +501,7 @@ const CLEANUP_ENV_VARS = {
 export function buildE2eEnvTemplate(selections) {
     const lines = [];
     lines.push("# E2E Testing — SWEny");
-    lines.push("# Fill in values, then run: sweny e2e run");
+    lines.push("# Fill in values, then run: sweny workflow run");
     lines.push("");
     lines.push(`E2E_BASE_URL=${selections.baseUrl}`);
     lines.push("");
@@ -753,10 +753,10 @@ export async function runE2eInit(options = {}) {
     console.log(chalk.dim("  1. Fill in your .env values"));
     if (selections.flows.some((f) => AUTH_REQUIRED_FLOWS.includes(f.type) || f.type === "login")) {
         console.log(chalk.dim("  2. Set E2E_EMAIL and E2E_PASSWORD to a test account"));
-        console.log(chalk.dim(`  3. Run: ${chalk.cyan("sweny e2e run")}\n`));
+        console.log(chalk.dim(`  3. Run: ${chalk.cyan("sweny workflow run")}\n`));
     }
     else {
-        console.log(chalk.dim(`  2. Run: ${chalk.cyan("sweny e2e run")}\n`));
+        console.log(chalk.dim(`  2. Run: ${chalk.cyan("sweny workflow run")}\n`));
     }
 }
 // ── Timeout helper ─────────────────────────────────────────────────────
@@ -769,6 +769,20 @@ function withTimeout(promise, ms, label) {
             .finally(() => clearTimeout(timer));
     });
 }
+/**
+ * Policy for a no-file batch run. Pure so it can be unit-tested without
+ * touching the filesystem, stdin, or the engine.
+ * - `yes` → run without asking (CI).
+ * - non-interactive without `yes` → refuse (don't fire every workflow by accident).
+ * - interactive → ask for confirmation.
+ */
+export function batchRunDecision(opts) {
+    if (opts.yes)
+        return "run";
+    if (!opts.isTTY)
+        return "refuse-noninteractive";
+    return "confirm";
+}
 /**
  * Load and execute e2e workflow files from .sweny/e2e/.
  */
@@ -789,7 +803,7 @@ export async function runE2eRun(options) {
         const e2eDir = path.join(cwd, ".sweny", "e2e");
         if (!fs.existsSync(e2eDir)) {
             console.error(chalk.red("  No .sweny/e2e/ directory found."));
-            console.error(chalk.dim("  Run 'sweny e2e init' to set up e2e testing."));
+            console.error(chalk.dim("  Run 'sweny new e2e' to set up e2e testing."));
             process.exit(1);
         }
         files = fs
@@ -799,9 +813,29 @@ export async function runE2eRun(options) {
             .map((f) => path.join(e2eDir, f));
         if (files.length === 0) {
             console.error(chalk.red("  No workflow files found in .sweny/e2e/"));
-            console.error(chalk.dim("  Run 'sweny e2e init' to set up e2e testing."));
+            console.error(chalk.dim("  Run 'sweny new e2e' to set up e2e testing."));
             process.exit(1);
         }
+        // Batch run (no explicit file): list what will run and confirm, so an
+        // accidental `sweny workflow run` doesn't fire every e2e workflow.
+        // --yes bypasses for CI.
+        const decision = batchRunDecision({ yes: options.yes, isTTY: process.stdin.isTTY ?? false });
+        if (decision !== "run") {
+            console.log(chalk.bold(`\n  About to run ${files.length} e2e workflow(s) from .sweny/e2e/:`));
+            for (const f of files)
+                console.log(chalk.dim(`    • ${path.basename(f)}`));
+            console.log("");
+            if (decision === "refuse-noninteractive") {
+                console.error(chalk.red("  Refusing to batch-run without confirmation in a non-interactive shell."));
+                console.error(chalk.dim("  Re-run with --yes to proceed (or pass a specific file)."));
+                process.exit(1);
+            }
+            const ok = await p.confirm({ message: `Run all ${files.length} e2e workflow(s)?` });
+            if (p.isCancel(ok) || !ok) {
+                p.cancel("Cancelled.");
+                process.exit(0);
+            }
+        }
     }
     // 2. Build template vars
     const vars = buildE2eVars(process.env);

package/dist/cli/main.d.ts

@@ -1,11 +1,13 @@
 #!/usr/bin/env node
 import type { Workflow } from "../types.js";
 export declare function loadWorkflowFile(filePath: string, knownSkills?: Set<string>): Workflow;
-export declare function workflowRunAction(file: string, options: Record<string, unknown> & {
+export declare function workflowRunAction(file: string | undefined, options: Record<string, unknown> & {
     json?: boolean;
     stream?: boolean;
     mermaid?: boolean;
     verbose?: boolean;
+    timeout?: string;
+    yes?: boolean;
 }): Promise<void>;
 export declare function workflowExportAction(name: string): void;
 export declare function workflowValidateAction(file: string, options: {

package/dist/cli/main.js

@@ -27,7 +27,7 @@ import { buildCredentialMap } from "./credentials.js";
 import { runNew } from "./new.js";
 import { runE2eRun } from "./e2e.js";
 import { createVerboseToolObserver } from "./verbose-observer.js";
-import { registerTriageCommand, registerImplementCommand, parseCliInputs, validateInputs, validateWarnings, } from "./config.js";
+import { registerTriageCommand, registerImplementCommand, parseCliInputs, validateInputs, validateWarnings, parsePositiveInt, } from "./config.js";
 import { c, formatBanner, getStepDetails, formatStepLine, formatDagResultHuman, formatDagResultMarkdown, formatResultJson, formatValidationErrors, formatCrashError, formatCheckResults, } from "./output.js";
 import { checkProviderConnectivity } from "./check.js";
 import { registerSetupCommand } from "./setup.js";
@@ -75,18 +75,6 @@ program
     .action(async (id) => {
     await runNew(id ? { marketplaceId: id } : undefined);
 });
-// ── sweny e2e ────────────────────────────────────────────────────────
-const e2eCmd = program.command("e2e").description("End-to-end browser testing");
-e2eCmd
-    .command("run [file]")
-    .description("Run e2e workflow files from .sweny/e2e/")
-    .option("--timeout <ms>", "Timeout per workflow in milliseconds (default: 900000 = 15 min)")
-    .action(async (file, options) => {
-    await runE2eRun({
-        file,
-        timeout: options.timeout ? parseInt(options.timeout, 10) : undefined,
-    });
-});
 // ── sweny check ───────────────────────────────────────────────────────
 program
     .command("check")
@@ -462,7 +450,9 @@ implementCmd.action(async (issueId, options) => {
         sourceControlProvider: options.sourceControlProvider || fileConfig["source-control-provider"] || "github",
         codingAgentProvider: options.codingAgentProvider || fileConfig["coding-agent-provider"] || "claude",
         dryRun: Boolean(options.dryRun),
-        maxImplementTurns: parseInt(String(options.maxImplementTurns || fileConfig["max-implement-turns"] || "40"), 10),
+        // parsePositiveInt mirrors the triage path: junk → NaN, which
+        // validateInputs rejects via validateIntegerBound below.
+        maxImplementTurns: parsePositiveInt(options.maxImplementTurns ?? fileConfig["max-implement-turns"], 40),
         baseBranch: options.baseBranch || fileConfig["base-branch"] || "main",
         repository: options.repository || process.env.GITHUB_REPOSITORY || "",
         outputDir: options.outputDir ||
@@ -470,6 +460,14 @@ implementCmd.action(async (issueId, options) => {
             fileConfig["output-dir"] ||
             ".sweny/output",
     };
+    // Validate (parity with triage): surface the curated "Missing: ..." errors
+    // and reject malformed integer flags before any execution.
+    const implErrors = validateInputs(config);
+    if (implErrors.length > 0) {
+        console.error(formatValidationErrors(implErrors));
+        console.error(c.subtle("\n  Run sweny implement --help for usage information.\n"));
+        process.exit(1);
+    }
     const implementSkillDiscovery = configuredSkillsWithDiagnostics(process.env, process.cwd());
     for (const w of implementSkillDiscovery.warnings) {
         console.error(chalk.yellow(`  ⚠  ${w.message}`));
@@ -611,6 +609,16 @@ export function loadWorkflowFile(filePath, knownSkills) {
     return result.workflow;
 }
 export async function workflowRunAction(file, options) {
+    // No file given → batch-run the e2e workflows in .sweny/e2e/. This is the
+    // home for what used to be `sweny e2e run`; it lists what will run and
+    // confirms first (bypass with --yes).
+    if (!file) {
+        await runE2eRun({
+            timeout: options.timeout ? parseInt(options.timeout, 10) : undefined,
+            yes: Boolean(options.yes),
+        });
+        return;
+    }
     // Discover skills first so the loader can flag UNKNOWN_SKILL at parse
     // time. validateWorkflowSkills below still runs for richer category /
     // env-var diagnostics, but the loader's structural check fires earlier
@@ -912,8 +920,10 @@ workflowCmd
     .option("--json", "Output result as JSON")
     .action(workflowValidateAction);
 workflowCmd
-    .command("run <file>")
-    .description("Run a workflow from a YAML or JSON file")
+    .command("run [file]")
+    .description("Run a workflow from a YAML or JSON file. With no file, batch-runs every workflow in .sweny/e2e/ (lists and confirms first; use --yes to skip the prompt).")
+    .option("--timeout <ms>", "Per-workflow timeout in ms for batch runs (default: 900000 = 15 min)")
+    .option("-y, --yes", "Skip the batch confirmation prompt (for CI)")
     .option("--dry-run", "Execute until the first conditional routing decision, then stop (no side effects past that point). NOTE: behavior changed in this release — previously --dry-run only printed the node list. For that behavior use --list-nodes.")
     .option("--list-nodes", "Validate, print nodes/skills, and exit without running. (Replaces the pre-Fix-#6 --dry-run behavior.)")
     .option("--json", "Output result as JSON on stdout; suppress progress output")

package/dist/cli/new.js

@@ -468,6 +468,13 @@ function cancel() {
  */
 export async function runNew(options) {
     const cwd = process.cwd();
+    // ── E2E shortcut: `sweny new e2e` jumps straight into the e2e wizard ──
+    // `new` is the single entry for all workflow creation; this is a named
+    // shortcut into the same flow the interactive picker reaches via "__e2e".
+    if (options?.marketplaceId === "e2e") {
+        await runE2eInit({ skipIntro: options.skipIntro });
+        return;
+    }
     // ── Marketplace install fast path ───────────────────────────────────
     if (options?.marketplaceId) {
         const { installMarketplaceWorkflow } = await import("./marketplace.js");

package/dist/eval/value.js

@@ -115,7 +115,18 @@ export function checkOutputRequired(paths, data) {
             continue;
         }
         if (r.mode === "all") {
-            if (r.values.length > 0 && !r.values.every((v) => v !== null && v !== undefined)) {
+            // An empty wildcard expansion (e.g. `findings[*].severity` when
+            // `findings` is `[]`) resolves to zero values. That is a
+            // structurally-absent required output, not a satisfied gate: treat it
+            // as a failure rather than vacuously passing. A non-wildcard path always
+            // yields exactly one value, so this branch only ever sees an empty array
+            // for an empty wildcard expansion. Same class as the route-eval
+            // `missing` warning: a required field that is absent must not green-light
+            // the gate.
+            if (r.values.length === 0) {
+                failures.push(`'${path}' resolved to no elements (empty wildcard expansion)`);
+            }
+            else if (!r.values.every((v) => v !== null && v !== undefined)) {
                 failures.push(`'${path}' resolved to null/undefined value(s)`);
             }
         }

package/dist/executor.d.ts

@@ -32,7 +32,23 @@ export interface ExecuteOptions {
     fetchAuth?: Record<string, string>;
     /** When true, URL Sources throw instead of fetching */
     offline?: boolean;
+    /**
+     * Workflow-level hard cap on total node executions (the number of times the
+     * main loop visits a node). Guards against unbounded cycles, e.g. a back-edge
+     * with no `max_iterations` or an LLM route evaluator that keeps choosing the
+     * loop-back edge. Defaults to {@link DEFAULT_MAX_STEPS}. When exceeded the
+     * executor throws a clear "step budget exceeded" error rather than hanging.
+     * Per-edge `max_iterations` behavior is unchanged.
+     */
+    max_steps?: number;
 }
+/**
+ * Default workflow-level step budget. Counts total node executions across the
+ * whole run (loop iterations included). Generous enough for legitimate deep
+ * workflows with controlled cycles, tight enough to terminate a runaway loop
+ * before it burns meaningful model spend.
+ */
+export declare const DEFAULT_MAX_STEPS = 200;
 /**
  * Execute a workflow from entry to completion.
  *