@sweny-ai/core 0.1.122 → 0.1.124

package/dist/claude.d.ts

@@ -9,6 +9,27 @@
  * is to use headless Claude Code — never the raw Anthropic API.
  */
 import type { Claude, Tool, ToolContext, NodeResult, JSONSchema, Logger, McpServerConfig } from "./types.js";
+import { type AgentAccess, type SandboxMode } from "./agent-env.js";
+/**
+ * Built-in tools disallowed for the route-evaluation (`evaluate`) and
+ * reflection/judge (`ask`) calls.
+ *
+ * These are pure classification calls over prior-node data that can be
+ * attacker-influenceable (a prior node summarizes an untrusted issue body,
+ * PR diff, log line, etc.). They must never be able to mutate the workspace
+ * or shell out, regardless of any node's own `disallowed_tools` policy.
+ * `maxTurns: 1` already bounds them; this removes the powerful built-ins
+ * from the model's context entirely as structural defense-in-depth.
+ */
+export declare const CLASSIFICATION_DISALLOWED_TOOLS: readonly ["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit", "WebFetch", "WebSearch"];
+/**
+ * Built-in tools disallowed for a node run with `readOnly: true` (dry run,
+ * #380): everything that can edit the workspace, shell out (and so reach
+ * `gh`, `curl`, `git push`), spawn a subagent that could, or fetch an
+ * arbitrary URL (a GET can still trigger a webhook or exfiltrate data).
+ * Read, Grep, Glob and WebSearch stay available for analysis.
+ */
+export declare const READ_ONLY_DISALLOWED_TOOLS: readonly ["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit", "Task", "Agent", "WebFetch"];
 /** How sweny resolves which credentials reach the Claude Code subprocess. */
 export type SwenyAuthMode = "auto" | "api-key" | "oauth";
 export interface ResolveAuthEnvOpts {
@@ -59,6 +80,27 @@ export interface ClaudeClientOptions {
     defaultContext?: ToolContext;
     /** External MCP servers (GitHub, Linear, Sentry, etc.) — merged with core skill tools */
     mcpServers?: Record<string, McpServerConfig>;
+    /**
+     * Extra env var names passed to the agent subprocess on top of the
+     * allowlist (see agent-env.ts). `"*"` inherits the full environment.
+     * Default: `SWENY_ENV_PASSTHROUGH` (comma-separated).
+     */
+    envPassthrough?: string[];
+    /**
+     * Scope the agent env to the allowlist. Default: `SWENY_ENV_SCOPE`, else on
+     * when CI is truthy and off locally (full env).
+     */
+    envScope?: boolean;
+    /**
+     * SDK sandbox for agent commands: `auto` (sandbox when the host supports
+     * it, else warn and run unsandboxed), `strict` (sandbox or fail), `off`.
+     * Default: `SWENY_SANDBOX`, else `auto` when CI is truthy, `off` otherwise.
+     */
+    sandbox?: SandboxMode;
+    /** Extra hosts sandboxed commands may reach. Default: `SWENY_SANDBOX_ALLOWED_DOMAINS`. */
+    sandboxAllowedDomains?: string[];
+    /** Sandbox preflight probe (test seam). Returns a reason when the sandbox cannot run. */
+    sandboxProbe?: () => string | undefined;
 }
 /**
  * Wire an optional timeout + caller signal onto a single AbortController.
@@ -81,10 +123,22 @@ export declare class ClaudeClient implements Claude {
     private logger;
     private defaultContext;
     private mcpServers;
+    private envPassthrough;
+    private sandboxMode;
+    private sandboxAllowedDomains;
+    private sandboxProbe;
+    private sandboxWarned;
+    private envScope;
+    private envWarned;
     constructor(opts?: ClaudeClientOptions);
     /**
-     * Build env for the Claude Code subprocess. Snapshots process.env (dropping
-     * nullish values) and applies auth precedence via {@link resolveAuthEnv}.
+     * Build env for the Claude Code subprocess (#360). Applies auth precedence
+     * via {@link resolveAuthEnv} on the full process env (it reads
+     * `SWENY_AUTH`). When env scoping is on (default in CI, see
+     * {@link resolveEnvScope}) the result is narrowed to the allowlist plus
+     * `extraVars` (the node's declared skill env vars) and the operator
+     * passthrough list, and the withheld names (never values) are warned once
+     * per client. When off, the full env passes through as before.
      */
     private buildEnv;
     run(opts: {
@@ -100,6 +154,10 @@ export declare class ClaudeClient implements Claude {
         timeoutMs?: number;
         /** Caller-supplied abort signal. Aborting it interrupts the query. */
         signal?: AbortSignal;
+        /** Dry run (#380): no external MCP servers, no write-capable built-ins. */
+        readOnly?: boolean;
+        /** Env var names + sandbox hosts this node's skills need (#360). */
+        agentAccess?: AgentAccess;
     }): Promise<NodeResult>;
     evaluate(opts: {
         question: string;
@@ -112,7 +170,7 @@ export declare class ClaudeClient implements Claude {
         timeoutMs?: number;
         /** Caller-supplied abort signal. Aborting it interrupts the query. */
         signal?: AbortSignal;
-    }): Promise<string>;
+    }): Promise<string | null>;
     ask(opts: {
         instruction: string;
         context: Record<string, unknown>;

package/dist/claude.js

@@ -11,7 +11,46 @@
 import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude-agent-sdk";
 import { z } from "zod";
 import { consoleLogger } from "./types.js";
+import { formatWithheldWarning, parseList, resolveEnvScope, scopeAgentEnv, resolveAgentSandbox, } from "./agent-env.js";
+import { fenceUntrustedJson } from "./untrusted.js";
 const SYSTEM_PROMPT = `You are a step in an automated workflow. Execute the instruction precisely using the tools available to you. Be thorough but concise. When you're done, summarize your findings and results.`;
+/**
+ * Built-in tools disallowed for the route-evaluation (`evaluate`) and
+ * reflection/judge (`ask`) calls.
+ *
+ * These are pure classification calls over prior-node data that can be
+ * attacker-influenceable (a prior node summarizes an untrusted issue body,
+ * PR diff, log line, etc.). They must never be able to mutate the workspace
+ * or shell out, regardless of any node's own `disallowed_tools` policy.
+ * `maxTurns: 1` already bounds them; this removes the powerful built-ins
+ * from the model's context entirely as structural defense-in-depth.
+ */
+export const CLASSIFICATION_DISALLOWED_TOOLS = [
+    "Bash",
+    "Write",
+    "Edit",
+    "MultiEdit",
+    "NotebookEdit",
+    "WebFetch",
+    "WebSearch",
+];
+/**
+ * Built-in tools disallowed for a node run with `readOnly: true` (dry run,
+ * #380): everything that can edit the workspace, shell out (and so reach
+ * `gh`, `curl`, `git push`), spawn a subagent that could, or fetch an
+ * arbitrary URL (a GET can still trigger a webhook or exfiltrate data).
+ * Read, Grep, Glob and WebSearch stay available for analysis.
+ */
+export const READ_ONLY_DISALLOWED_TOOLS = [
+    "Bash",
+    "Write",
+    "Edit",
+    "MultiEdit",
+    "NotebookEdit",
+    "Task",
+    "Agent",
+    "WebFetch",
+];
 /**
  * Decide which auth credentials survive into the Claude Code subprocess env.
  *
@@ -127,6 +166,10 @@ export function makeAbort(timeoutMs, signal) {
  * Swallows errors: the stream may already be done, and interrupt is only
  * supported in streaming-input mode.
  */
+// The return type is deliberately `Promise<unknown>`, not `Promise<void>`:
+// agent-sdk 0.3 changed `Query.interrupt()` to resolve with an
+// SDKControlInterruptResponse. We discard the value either way, and a `void`
+// parameter type would reject any SDK that resolves with something.
 async function interruptStream(stream) {
     if (!stream || typeof stream.interrupt !== "function")
         return;
@@ -137,6 +180,30 @@ async function interruptStream(stream) {
         /* already finished or not interruptible — nothing to clean up */
     }
 }
+/**
+ * Extract shape-only usage/cost from an SDK `result` message.
+ *
+ * Reads `total_cost_usd`, `usage` (in/out/cache tokens), and `num_turns` off
+ * the terminal result. Returns undefined when the message carries none of
+ * them (mocks, older SDKs) so callers leave `NodeResult.usage` absent rather
+ * than shipping an all-zero object. NEVER touches `result`/prompt text.
+ */
+function extractUsage(resultMsg) {
+    const m = resultMsg;
+    const num = (v) => (typeof v === "number" && Number.isFinite(v) ? v : undefined);
+    const u = m.usage;
+    const usage = {
+        costUsd: num(m.total_cost_usd),
+        inputTokens: num(u?.input_tokens),
+        outputTokens: num(u?.output_tokens),
+        cacheReadTokens: num(u?.cache_read_input_tokens),
+        cacheCreationTokens: num(u?.cache_creation_input_tokens),
+        numTurns: num(m.num_turns),
+    };
+    // Drop the object entirely when the SDK gave us nothing usable, so a
+    // mocked/legacy run reports no usage instead of a misleading zero-cost run.
+    return Object.values(usage).some((v) => v !== undefined) ? usage : undefined;
+}
 export class ClaudeClient {
     model;
     maxTurns;
@@ -144,6 +211,13 @@ export class ClaudeClient {
     logger;
     defaultContext;
     mcpServers;
+    envPassthrough;
+    sandboxMode;
+    sandboxAllowedDomains;
+    sandboxProbe;
+    sandboxWarned = false;
+    envScope;
+    envWarned = false;
     constructor(opts = {}) {
         this.model = opts.model;
         this.maxTurns = opts.maxTurns ?? 20;
@@ -151,18 +225,68 @@ export class ClaudeClient {
         this.logger = opts.logger ?? consoleLogger;
         this.defaultContext = opts.defaultContext ?? { config: {}, logger: this.logger };
         this.mcpServers = opts.mcpServers ?? {};
+        this.envPassthrough = opts.envPassthrough;
+        this.envScope = opts.envScope;
+        this.sandboxMode = opts.sandbox;
+        this.sandboxAllowedDomains = opts.sandboxAllowedDomains;
+        this.sandboxProbe = opts.sandboxProbe;
     }
     /**
-     * Build env for the Claude Code subprocess. Snapshots process.env (dropping
-     * nullish values) and applies auth precedence via {@link resolveAuthEnv}.
+     * Build env for the Claude Code subprocess (#360). Applies auth precedence
+     * via {@link resolveAuthEnv} on the full process env (it reads
+     * `SWENY_AUTH`). When env scoping is on (default in CI, see
+     * {@link resolveEnvScope}) the result is narrowed to the allowlist plus
+     * `extraVars` (the node's declared skill env vars) and the operator
+     * passthrough list, and the withheld names (never values) are warned once
+     * per client. When off, the full env passes through as before.
      */
-    buildEnv() {
-        const env = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
-        return resolveAuthEnv(env, { logger: this.logger });
+    buildEnv(extraVars = []) {
+        const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
+        const authed = resolveAuthEnv(full, { logger: this.logger });
+        if (!resolveEnvScope(process.env, this.envScope, this.logger))
+            return authed;
+        const { env, withheld } = scopeAgentEnv(authed, {
+            extraVars,
+            passthrough: this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH),
+            logger: this.logger,
+        });
+        if (withheld.length > 0 && !this.envWarned) {
+            this.envWarned = true;
+            const prefix = process.env.GITHUB_ACTIONS === "true" ? "::warning title=SWEny agent env::" : "";
+            this.logger.warn(`${prefix}${formatWithheldWarning(withheld)}`);
+        }
+        return env;
     }
     async run(opts) {
-        const { instruction, context, tools, outputSchema, onProgress, maxTurns, disallowedTools, model, timeoutMs, signal, } = opts;
+        const { instruction, context, tools, outputSchema, onProgress, maxTurns, model, timeoutMs, signal, readOnly, agentAccess, } = opts;
+        // Dry run (#380): external MCP servers cannot be classified per tool, so
+        // they are unknown, and unknown means write. Drop them, and disallow the
+        // built-ins that can change the workspace or shell out.
+        const disallowedTools = readOnly
+            ? [...new Set([...(opts.disallowedTools ?? []), ...READ_ONLY_DISALLOWED_TOOLS])]
+            : opts.disallowedTools;
         const effectiveModel = model ?? this.model;
+        // #360: run agent commands in the SDK sandbox. `auto` (default in CI) falls
+        // back to unsandboxed with one loud warning when the host cannot sandbox;
+        // `strict` fails the node here instead.
+        const sandbox = resolveAgentSandbox({
+            env: process.env,
+            mode: this.sandboxMode,
+            allowedDomains: this.sandboxAllowedDomains,
+            nodeDomains: agentAccess?.domains,
+            probe: this.sandboxProbe,
+            logger: this.logger,
+        });
+        if (sandbox.error) {
+            this.logger.error(sandbox.error);
+            return { status: "failed", data: { error: sandbox.error }, toolCalls: [] };
+        }
+        if (sandbox.warning && !this.sandboxWarned) {
+            this.sandboxWarned = true;
+            // GitHub Actions renders `::warning::` as a run annotation.
+            const prefix = process.env.GITHUB_ACTIONS === "true" ? "::warning title=SWEny agent sandbox::" : "";
+            this.logger.warn(`${prefix}${sandbox.warning}`);
+        }
         // Tool-call accounting (Fix #1).
         //
         // Stream-driven recording, correlated by tool_use_id:
@@ -190,30 +314,37 @@ export class ClaudeClient {
             name: "sweny-core",
             tools: sdkTools,
         });
-        // Build prompt
+        // Build prompt. Context (workflow input such as issues/alerts, plus prior
+        // node outputs) is fenced as untrusted data (#360).
         const prompt = [
             `## Instruction\n\n${instruction}`,
-            `## Context\n\n\`\`\`json\n${JSON.stringify(context, null, 2)}\n\`\`\``,
+            `## Context\n\n${fenceUntrustedJson(context, "context")}`,
             outputSchema
                 ? `## Required Output\n\nYou MUST end with a JSON object matching this schema:\n\`\`\`json\n${JSON.stringify(outputSchema, null, 2)}\n\`\`\``
                 : "",
         ]
             .filter(Boolean)
             .join("\n\n");
-        const env = this.buildEnv();
+        const env = this.buildEnv(agentAccess?.envVars);
         let response = "";
         // CC-08: when the SDK populates typed structured output (because we passed
         // an `outputFormat`), prefer it over re-parsing JSON out of the free-text
         // result. Left undefined when the SDK didn't provide it, so the
         // tryParseJSON heuristic remains the fallback (e.g. mocks, older results).
         let structuredOutput;
+        // Token + cost accounting. Read off the SDK's terminal `result` message
+        // (present on both success and error subtypes). Shape-only: counts and
+        // cost, never any prompt/response text. Left undefined when the SDK
+        // emitted no usage (mocks, older SDKs), so `usage` stays absent rather
+        // than shipping zeroes that read as a real (free) run.
+        let usage;
         // Timeout / abort wiring (back-compat: only armed when requested).
         // A single AbortController drives both an optional caller signal and an
         // optional timeout timer. The SDK aborts the subprocess when this fires.
         const abort = makeAbort(timeoutMs, signal);
         let stream;
         try {
-            const allMcpServers = { ...this.mcpServers };
+            const allMcpServers = readOnly ? {} : { ...this.mcpServers };
             if (sdkTools.length > 0)
                 allMcpServers["sweny-core"] = mcpServer;
             stream = query({
@@ -225,10 +356,16 @@ export class ClaudeClient {
                     env,
                     permissionMode: "bypassPermissions",
                     allowDangerouslySkipPermissions: true,
+                    ...(sandbox.settings ? { sandbox: sandbox.settings } : {}),
                     stderr: (data) => this.logger.debug(`[claude-code] ${data}`),
                     ...(abort ? { abortController: abort.controller } : {}),
                     ...(effectiveModel ? { model: effectiveModel } : {}),
                     ...(Object.keys(allMcpServers).length > 0 ? { mcpServers: allMcpServers } : {}),
+                    // Dry run (#380): settingSources is omitted, so the SDK loads user,
+                    // project and local settings, including their MCP servers (and
+                    // project .mcp.json, plugins). strictMcpConfig limits MCP to the
+                    // servers passed above, which under readOnly is only sweny-core.
+                    ...(readOnly ? { strictMcpConfig: true } : {}),
                     ...(disallowedTools && disallowedTools.length > 0 ? { disallowedTools } : {}),
                     // CC-08: ask the SDK to produce validated structured output when the
                     // node declares an output schema. The SDK then returns the parsed
@@ -310,6 +447,10 @@ export class ClaudeClient {
                 }
                 else if (message.type === "result") {
                     const resultMsg = message;
+                    // Capture token/cost accounting off the terminal result. Present on
+                    // both success and error subtypes; shape-only. Attached to every
+                    // return below (including early-termination and error paths).
+                    usage = extractUsage(resultMsg);
                     if (resultMsg.subtype === "success" && "result" in resultMsg) {
                         // terminal_reason was added in @anthropic-ai/claude-agent-sdk v0.2.91.
                         // When the turn budget is exhausted the SDK still emits subtype='success'
@@ -330,6 +471,7 @@ export class ClaudeClient {
                                     ...(partial !== "" ? { summary: partial } : {}),
                                 },
                                 toolCalls,
+                                ...(usage ? { usage } : {}),
                             };
                         }
                         response = resultMsg.result;
@@ -350,6 +492,7 @@ export class ClaudeClient {
                             status: "failed",
                             data: { error: prefix + (errors?.join("\n") ?? "Execution failed") },
                             toolCalls,
+                            ...(usage ? { usage } : {}),
                         };
                     }
                 }
@@ -385,6 +528,7 @@ export class ClaudeClient {
             status: "success",
             data: { summary: response, ...parsedData },
             toolCalls,
+            ...(usage ? { usage } : {}),
         };
     }
     async evaluate(opts) {
@@ -404,6 +548,15 @@ export class ClaudeClient {
                     env,
                     permissionMode: "bypassPermissions",
                     allowDangerouslySkipPermissions: true,
+                    // Route evaluation is a pure classification call over
+                    // possibly-attacker-influenceable prior-node data. Never let it
+                    // shell out or mutate, regardless of the node's own policy.
+                    // Disable ALL built-in tools (SDK `tools: []`); no MCP servers are passed.
+                    // The disallow list below stays as a second layer.
+                    tools: [],
+                    mcpServers: {},
+                    strictMcpConfig: true,
+                    disallowedTools: [...CLASSIFICATION_DISALLOWED_TOOLS],
                     stderr: (data) => this.logger.debug(`[claude-code] ${data}`),
                     ...(abort ? { abortController: abort.controller } : {}),
                     ...(this.model ? { model: this.model } : {}),
@@ -416,34 +569,33 @@ export class ClaudeClient {
                         response = resultMsg.result;
                     }
                     else {
-                        // Distinguish an SDK-level failure from a genuinely ambiguous
-                        // model answer. Without this, both fall through to validIds[0]
-                        // and log the same "Could not parse route choice" warning, so an
-                        // operator cannot tell them apart. Short-circuit below so the
-                        // ambiguous-answer warning never fires on top of this one.
+                        // Fail closed. An SDK-level failure (non-success subtype) is NOT a
+                        // routing decision. Signal it to the caller (null) so the executor
+                        // takes an explicit default edge or terminates — never the old
+                        // fall-through to the first choice, which silently routed an outage
+                        // down the first conditional edge (e.g. filing a real issue/PR).
                         sdkFailed = true;
-                        this.logger.warn(`claude.evaluate: SDK returned non-success subtype "${resultMsg.subtype}" — falling back to first choice.`);
+                        this.logger.warn(`claude.evaluate: SDK returned non-success subtype "${resultMsg.subtype}" — failing closed (no route decision).`);
                     }
                 }
             }
         }
         catch (err) {
             if (abort?.reason() === "timeout") {
-                this.logger.warn(`Evaluate query timed out after ${timeoutMs}ms. Falling back to first choice.`);
+                this.logger.warn(`Evaluate query timed out after ${timeoutMs}ms. Failing closed (no route decision).`);
             }
             else {
-                this.logger.warn(`Evaluate query failed: ${err.message}. Falling back to first choice.`);
+                this.logger.warn(`Evaluate query failed: ${err.message}. Failing closed (no route decision).`);
             }
-            return choices[0].id;
+            return null;
         }
         finally {
             abort?.clear();
             await interruptStream(stream);
         }
-        // An SDK-level failure already logged a distinct message; do not also emit
-        // the ambiguous-answer warning, which would misattribute the cause.
+        // An SDK-level failure already logged a distinct message; fail closed.
         if (sdkFailed)
-            return choices[0].id;
+            return null;
         const text = response.trim().replace(/^["']|["']$/g, "");
         const validIds = choices.map((c) => c.id);
         // Exact match
@@ -453,15 +605,18 @@ export class ClaudeClient {
         const match = validIds.find((id) => text.includes(id));
         if (match)
             return match;
-        // Fallback
-        this.logger.warn(`Could not parse route choice from: "${text.slice(0, 100)}". Falling back to first choice.`);
-        return validIds[0];
+        // Fail closed. An unparseable answer is not a decision. Returning
+        // validIds[0] here is the fail-open bug: on a node with a single
+        // conditional out-edge, the "first choice" is always that edge, so a
+        // garbled model answer would always take it. Signal no-decision instead.
+        this.logger.warn(`Could not parse route choice from: "${text.slice(0, 100)}". Failing closed (no route decision).`);
+        return null;
     }
     async ask(opts) {
         const { instruction, context, model, timeoutMs, signal } = opts;
         const prompt = [
             instruction,
-            Object.keys(context).length > 0 ? `\nContext:\n\`\`\`json\n${JSON.stringify(context, null, 2)}\n\`\`\`` : "",
+            Object.keys(context).length > 0 ? `\nContext:\n${fenceUntrustedJson(context, "context")}` : "",
         ]
             .filter(Boolean)
             .join("\n");
@@ -479,6 +634,15 @@ export class ClaudeClient {
                     env,
                     permissionMode: "bypassPermissions",
                     allowDangerouslySkipPermissions: true,
+                    // Reflection and judge scoring are pure classification calls over
+                    // possibly-attacker-influenceable prior-node data. Deny the powerful
+                    // built-ins so they can never shell out or mutate the workspace.
+                    // Disable ALL built-in tools (SDK `tools: []`); no MCP servers are passed.
+                    // The disallow list below stays as a second layer.
+                    tools: [],
+                    mcpServers: {},
+                    strictMcpConfig: true,
+                    disallowedTools: [...CLASSIFICATION_DISALLOWED_TOOLS],
                     stderr: (data) => this.logger.debug(`[claude-code] ${data}`),
                     ...(abort ? { abortController: abort.controller } : {}),
                     ...(effectiveModel ? { model: effectiveModel } : {}),
@@ -578,7 +742,7 @@ export function buildEvaluatePrompt(question, context, choices) {
     const choiceList = choices.map((c) => `- "${c.id}": ${c.description}`).join("\n");
     return [
         question,
-        `\nContext:\n\`\`\`json\n${JSON.stringify(context, null, 2)}\n\`\`\``,
+        `\nContext:\n${fenceUntrustedJson(context, "context")}`,
         `\nChoices:\n${choiceList}`,
         `\nEvaluation rules:`,
         `1. Read each choice's condition literally and match against the structured fields in the context (e.g. status, counts, enum values, boolean flags).`,

package/dist/cli/check.d.ts

@@ -8,7 +8,17 @@ export interface CheckResult {
  * Run lightweight connectivity checks for all configured providers.
  * Uses raw fetch — does NOT import provider packages.
  */
-export declare function checkProviderConnectivity(config: CliConfig): Promise<CheckResult[]>;
+export interface CheckOptions {
+    /**
+     * Skill ids the configured workflows use. When set, only providers those
+     * skills need are checked; everything else is omitted. When undefined
+     * (no workflows found), the legacy config-driven checks run.
+     */
+    scope?: ReadonlySet<string>;
+    /** A local Claude Code login exists, so no API key is required. */
+    claudeCodeLogin?: boolean;
+}
+export declare function checkProviderConnectivity(config: CliConfig, opts?: CheckOptions): Promise<CheckResult[]>;
 /** Which credential `sweny check` should validate, mirroring resolveAuthEnv intent. */
 export type CheckAuthMode = "oauth" | "api-key" | "auth-token" | "none";
 export declare function resolveCheckAuthMode(config: Pick<CliConfig, "anthropicApiKey" | "anthropicAuthToken" | "claudeOauthToken" | "swenyAuth">): CheckAuthMode;
@@ -16,3 +26,34 @@ export declare function resolveCheckAuthMode(config: Pick<CliConfig, "anthropicA
 export declare function redactUrl(raw: string): string;
 export declare function checkAnthropicGateway(base: string, config: Pick<CliConfig, "anthropicApiKey" | "anthropicAuthToken" | "claudeOauthToken">, mode: CheckAuthMode): Promise<CheckResult>;
 export declare function checkDatadog(creds: Record<string, string>): Promise<CheckResult>;
+/**
+ * Detect a local Claude Code login the way `sweny workflow run` benefits from
+ * it: the spawned Claude Code agent finds its own login, so no env credential
+ * is needed. Checks `~/.claude/.credentials.json` (or CLAUDE_CONFIG_DIR) and,
+ * on macOS, the Keychain entry (attributes only, the secret is never read).
+ */
+export declare function detectClaudeCodeLogin(opts?: {
+    env?: Record<string, string | undefined>;
+    home?: string;
+    platform?: NodeJS.Platform;
+    keychainHasLogin?: () => boolean;
+}): boolean;
+/**
+ * Skill ids used by the workflows in `.sweny/workflows/`. `found` is false when
+ * there are no workflow files, in which case callers keep the legacy checks.
+ */
+export declare function discoverWorkflowSkillIds(cwd: string): {
+    found: boolean;
+    skillIds: Set<string>;
+};
+/**
+ * Errors `sweny check` should report. With a workflow scope, only credentials
+ * those workflows need (plus agent auth) are required. A local Claude Code
+ * login satisfies agent auth.
+ */
+export declare function validateCheckInputs(config: CliConfig, opts?: {
+    scope?: ReadonlySet<string>;
+    claudeCodeLogin?: boolean;
+    env?: Record<string, string | undefined>;
+    cwd?: string;
+}): string[];