@sweny-ai/core 0.1.123 → 0.1.124

package/dist/cli/check.js

@@ -1,20 +1,33 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+import { parse as parseYaml } from "yaml";
+import { validateInputs } from "./config.js";
+import { findSkillEnvGaps } from "./skill-env.js";
+import { configuredSkills } from "../skills/custom-loader.js";
 /**
  * Per-check network timeout. A hung connect must not make `sweny check` hang
  * indefinitely — the whole point of the command is fast diagnostics.
  */
 const CHECK_TIMEOUT_MS = 5000;
-/**
- * Run lightweight connectivity checks for all configured providers.
- * Uses raw fetch — does NOT import provider packages.
- */
-export async function checkProviderConnectivity(config) {
+export async function checkProviderConnectivity(config, opts = {}) {
     const results = [];
+    const scope = opts.scope;
+    const inScope = (skillId) => !scope || scope.has(skillId);
     const githubChecked = { done: false }; // avoid double-checking same token
     // ── Coding agent ────────────────────────────────────────────────────────────
     if (config.codingAgentProvider === "claude") {
         const mode = resolveCheckAuthMode(config);
         const base = config.anthropicBaseUrl;
-        if (mode === "none") {
+        if (mode === "none" && opts.claudeCodeLogin) {
+            results.push({
+                name: "Anthropic (claude agent)",
+                status: "ok",
+                detail: "Claude Code login detected",
+            });
+        }
+        else if (mode === "none") {
             results.push({ name: "Anthropic (claude agent)", status: "skip", detail: "No credential configured" });
         }
         else if (base) {
@@ -42,6 +55,8 @@ export async function checkProviderConnectivity(config) {
     }
     // ── Observability ────────────────────────────────────────────────────────────
     for (const provider of config.observabilityProviders) {
+        if (!inScope(provider))
+            continue;
         const creds = config.observabilityCredentials[provider] ?? {};
         if (provider === "datadog") {
             results.push(await checkDatadog(creds));
@@ -61,7 +76,10 @@ export async function checkProviderConnectivity(config) {
         }
     }
     // ── Issue tracker ────────────────────────────────────────────────────────────
-    if (config.issueTrackerProvider === "linear") {
+    if (scope && !inScope(config.issueTrackerProvider === "github-issues" ? "github" : config.issueTrackerProvider)) {
+        // No workflow uses this tracker: nothing to check.
+    }
+    else if (config.issueTrackerProvider === "linear") {
         results.push(await checkLinear(config.linearApiKey));
     }
     else if (config.issueTrackerProvider === "github-issues") {
@@ -84,7 +102,10 @@ export async function checkProviderConnectivity(config) {
         });
     }
     // ── Source control ───────────────────────────────────────────────────────────
-    if (config.sourceControlProvider === "github" && !githubChecked.done) {
+    if (scope && !inScope(config.sourceControlProvider)) {
+        // No workflow uses this source control: nothing to check.
+    }
+    else if (config.sourceControlProvider === "github" && !githubChecked.done) {
         const token = config.githubToken || config.botToken;
         results.push(await checkGitHub(token, "Source control (github)"));
     }
@@ -324,3 +345,104 @@ function networkErrorMessage(err) {
     }
     return msg;
 }
+// ── Workflow-scoped checks ───────────────────────────────────────────────────
+/**
+ * Detect a local Claude Code login the way `sweny workflow run` benefits from
+ * it: the spawned Claude Code agent finds its own login, so no env credential
+ * is needed. Checks `~/.claude/.credentials.json` (or CLAUDE_CONFIG_DIR) and,
+ * on macOS, the Keychain entry (attributes only, the secret is never read).
+ */
+export function detectClaudeCodeLogin(opts = {}) {
+    const env = opts.env ?? process.env;
+    const home = opts.home ?? os.homedir();
+    const platform = opts.platform ?? process.platform;
+    const configDir = env.CLAUDE_CONFIG_DIR || path.join(home, ".claude");
+    try {
+        if (fs.existsSync(path.join(configDir, ".credentials.json")))
+            return true;
+    }
+    catch {
+        // fall through
+    }
+    if (platform === "darwin") {
+        const probe = opts.keychainHasLogin ??
+            (() => {
+                const r = spawnSync("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
+                    stdio: "ignore",
+                    timeout: 3000,
+                });
+                return r.status === 0;
+            });
+        try {
+            return probe();
+        }
+        catch {
+            return false;
+        }
+    }
+    return false;
+}
+/**
+ * Skill ids used by the workflows in `.sweny/workflows/`. `found` is false when
+ * there are no workflow files, in which case callers keep the legacy checks.
+ */
+export function discoverWorkflowSkillIds(cwd) {
+    const dir = path.join(cwd, ".sweny", "workflows");
+    const skillIds = new Set();
+    let files;
+    try {
+        files = fs.readdirSync(dir).filter((f) => /\.(ya?ml|json)$/i.test(f));
+    }
+    catch {
+        return { found: false, skillIds };
+    }
+    let found = false;
+    for (const f of files) {
+        try {
+            const raw = parseYaml(fs.readFileSync(path.join(dir, f), "utf-8"));
+            if (!raw || typeof raw !== "object")
+                continue;
+            found = true;
+            for (const node of Object.values(raw.nodes ?? {})) {
+                if (Array.isArray(node?.skills)) {
+                    for (const id of node.skills)
+                        if (typeof id === "string")
+                            skillIds.add(id);
+                }
+            }
+        }
+        catch {
+            // unparseable file: `workflow validate` reports it; check ignores it
+        }
+    }
+    return { found, skillIds };
+}
+const CLAUDE_AUTH_ERROR_PREFIX = "Missing: ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN";
+/**
+ * Errors `sweny check` should report. With a workflow scope, only credentials
+ * those workflows need (plus agent auth) are required. A local Claude Code
+ * login satisfies agent auth.
+ */
+export function validateCheckInputs(config, opts = {}) {
+    let errors;
+    if (opts.scope) {
+        // Agent auth only; repo / tracker / observability requirements come from skills below.
+        errors = validateInputs({
+            ...config,
+            issueTrackerProvider: "file",
+            sourceControlProvider: "file",
+            observabilityProviders: [],
+        });
+        const env = opts.env ?? process.env;
+        const available = new Set(configuredSkills(env, opts.cwd ?? process.cwd()).map((s) => s.id));
+        for (const gap of findSkillEnvGaps(opts.scope, available)) {
+            errors.push(`Missing: ${gap.missingEnv.join(", ")} (needed by skill "${gap.id}")`);
+        }
+    }
+    else {
+        errors = validateInputs(config);
+    }
+    if (opts.claudeCodeLogin)
+        errors = errors.filter((e) => !e.startsWith(CLAUDE_AUTH_ERROR_PREFIX));
+    return errors;
+}

package/dist/cli/cloud-lifecycle.d.ts

@@ -107,13 +107,25 @@ export declare function postNodeEvent(config: CloudReportConfig, runId: string,
     duration_ms?: number;
     data?: Record<string, unknown>;
 }): Promise<void>;
+/**
+ * Aggregate SHAPE-ONLY telemetry off the executor's NodeResult map for the
+ * finish payload: token/cost totals, eval verdict counts, and tool-call
+ * NAME + STATUS counts. Never any prompt, response, tool input, or tool
+ * output. This is the substrate the paid cloud "brain" derives type-specific
+ * metrics from; the engine just ships the counts it has.
+ *
+ * Returns undefined when there is nothing to report (no usage, no evals, no
+ * tool calls) so the finish payload stays lean for trivial runs.
+ */
+export declare function deriveTypeMetricSubstrate(results: Map<string, NodeResult>): Record<string, unknown> | undefined;
 /**
  * Derive a `metrics` blob from the executor's NodeResult map.
  *
- * For now this is intentionally minimal: total node count, failed-node
- * count, success rate. Per-workflow-type metric extraction (Caught /
- * Calibration / Missed for pr_review, flake rate for e2e_test, etc.) is
- * the renderer's job; the engine just ships what it has.
+ * Ships node counts + success rate, plus the shape-only type-metric
+ * substrate (token/cost totals, eval verdict counts, tool-call name+status
+ * counts) when present. Per-workflow-type metric extraction (Caught /
+ * Calibration / Missed for pr_review, flake rate for e2e_test, etc.) is the
+ * renderer's job; the engine just ships what it has.
  */
 export declare function deriveGenericMetrics(results: Map<string, NodeResult>, durationMs: number): {
     duration_ms: number;
@@ -151,33 +163,16 @@ export declare function beginCloudLifecycle(config: {
  * onto the cloud's accepted enum. Failure is silent — the workflow's
  * exit code already reflects the truth.
  */
-export declare function finishCloudLifecycle(config: {
-    cloudToken?: string;
-}, handle: CloudLifecycleHandle | null, results: Map<string, NodeResult>, durationMs: number, status?: "success" | "failed" | "partial"): Promise<void>;
 /**
- * Build an Observer that ships per-node lifecycle events to cloud.
- *
- * Maps the engine's ExecutionEvent stream onto `POST /api/runs/:id/node`:
- *   node:enter   → { event: "enter",  node }
- *   node:exit    → { event: "exit",   node, status, duration_ms }
- *   node:progress → { event: "progress", node, data: { message } }
- *   node:retry   → { event: "progress", node, data: { retry: true, attempt, reason } }
- * Other events (workflow:start, tool:*, route, workflow:end) are dropped.
- *
- * Returns undefined when the handle is null (no cloud session) or the
- * token is missing. The observer captures `node:enter` timestamps in a
- * closure-scoped Map so it can compute duration_ms on the matching exit
- * without depending on any external state.
- *
- * Hot-path safety contract:
- *   1. The observer never throws synchronously. The whole body is
- *      wrapped in try/catch — any future ExecutionEvent shape change
- *      that breaks a field access cannot crash the engine.
- *   2. The observer never awaits. postNodeEvent is fired with .catch
- *      to swallow any rejection so node never sees an unhandledRejection.
- *   3. The Map is keyed by node id; collisions only happen if the same
- *      node id runs concurrently, which the engine does not do today.
+ * Crash summary for the cloud: `error.name` plus a message capped at 200
+ * chars. Thrown messages can embed agent/LLM prose, file paths, or log
+ * excerpts (e.g. a wrapped SDK error), so the cloud only gets a short,
+ * bounded diagnostic, never the full text. Accepts an Error or a string.
  */
+export declare function crashSummaryForCloud(err: unknown): string;
+export declare function finishCloudLifecycle(config: {
+    cloudToken?: string;
+}, handle: CloudLifecycleHandle | null, results: Map<string, NodeResult>, durationMs: number, status?: "success" | "failed" | "partial", error?: unknown): Promise<void>;
 export declare function createCloudStreamObserver(config: {
     cloudToken?: string;
 }, handle: CloudLifecycleHandle | null): Observer | undefined;

package/dist/cli/cloud-lifecycle.js

@@ -194,22 +194,102 @@ export async function postNodeEvent(config, runId, event) {
         // Silent — never block the workflow.
     }
 }
+/**
+ * Aggregate SHAPE-ONLY telemetry off the executor's NodeResult map for the
+ * finish payload: token/cost totals, eval verdict counts, and tool-call
+ * NAME + STATUS counts. Never any prompt, response, tool input, or tool
+ * output. This is the substrate the paid cloud "brain" derives type-specific
+ * metrics from; the engine just ships the counts it has.
+ *
+ * Returns undefined when there is nothing to report (no usage, no evals, no
+ * tool calls) so the finish payload stays lean for trivial runs.
+ */
+export function deriveTypeMetricSubstrate(results) {
+    let costUsd = 0;
+    let inputTokens = 0;
+    let outputTokens = 0;
+    let cacheReadTokens = 0;
+    let cacheCreationTokens = 0;
+    let numTurns = 0;
+    let sawUsage = false;
+    let evalsTotal = 0;
+    let evalsPassed = 0;
+    let evalsFailed = 0;
+    let toolCallsTotal = 0;
+    let toolCallsError = 0;
+    // NAME → count. Names only (e.g. "Bash", "create_pr"); never tool input
+    // or output, which can carry source, diffs, or customer data.
+    const toolCallsByName = {};
+    const add = (v) => (typeof v === "number" && Number.isFinite(v) ? v : 0);
+    for (const r of results.values()) {
+        if (r.usage) {
+            sawUsage = true;
+            costUsd += add(r.usage.costUsd);
+            inputTokens += add(r.usage.inputTokens);
+            outputTokens += add(r.usage.outputTokens);
+            cacheReadTokens += add(r.usage.cacheReadTokens);
+            cacheCreationTokens += add(r.usage.cacheCreationTokens);
+            numTurns += add(r.usage.numTurns);
+        }
+        if (r.evals && r.evals.length > 0) {
+            for (const e of r.evals) {
+                evalsTotal++;
+                if (e.pass)
+                    evalsPassed++;
+                else
+                    evalsFailed++;
+            }
+        }
+        for (const call of r.toolCalls ?? []) {
+            toolCallsTotal++;
+            if (call.status === "error")
+                toolCallsError++;
+            const name = call.tool || "unknown";
+            toolCallsByName[name] = (toolCallsByName[name] ?? 0) + 1;
+        }
+    }
+    const substrate = {};
+    if (sawUsage) {
+        substrate.cost = {
+            total_cost_usd: costUsd,
+            input_tokens: inputTokens,
+            output_tokens: outputTokens,
+            cache_read_tokens: cacheReadTokens,
+            cache_creation_tokens: cacheCreationTokens,
+            num_turns: numTurns,
+        };
+    }
+    if (evalsTotal > 0) {
+        substrate.evals = { total: evalsTotal, passed: evalsPassed, failed: evalsFailed };
+    }
+    if (toolCallsTotal > 0) {
+        substrate.tool_calls = {
+            total: toolCallsTotal,
+            error: toolCallsError,
+            by_name: toolCallsByName,
+        };
+    }
+    return Object.keys(substrate).length > 0 ? substrate : undefined;
+}
 /**
  * Derive a `metrics` blob from the executor's NodeResult map.
  *
- * For now this is intentionally minimal: total node count, failed-node
- * count, success rate. Per-workflow-type metric extraction (Caught /
- * Calibration / Missed for pr_review, flake rate for e2e_test, etc.) is
- * the renderer's job; the engine just ships what it has.
+ * Ships node counts + success rate, plus the shape-only type-metric
+ * substrate (token/cost totals, eval verdict counts, tool-call name+status
+ * counts) when present. Per-workflow-type metric extraction (Caught /
+ * Calibration / Missed for pr_review, flake rate for e2e_test, etc.) is the
+ * renderer's job; the engine just ships what it has.
  */
 export function deriveGenericMetrics(results, durationMs) {
     const nodeCount = results.size;
     const failedNodes = [...results.values()].filter((r) => r.status === "failed").length;
+    const substrate = deriveTypeMetricSubstrate(results);
     return {
         duration_ms: durationMs,
         node_count: nodeCount,
         failed_nodes: failedNodes,
         success_rate: nodeCount > 0 ? (nodeCount - failedNodes) / nodeCount : 0,
+        ...(substrate ?? {}),
     };
 }
 /**
@@ -252,14 +332,36 @@ export async function beginCloudLifecycle(config, workflow, options) {
  * onto the cloud's accepted enum. Failure is silent — the workflow's
  * exit code already reflects the truth.
  */
-export async function finishCloudLifecycle(config, handle, results, durationMs, status = "success") {
+/**
+ * Crash summary for the cloud: `error.name` plus a message capped at 200
+ * chars. Thrown messages can embed agent/LLM prose, file paths, or log
+ * excerpts (e.g. a wrapped SDK error), so the cloud only gets a short,
+ * bounded diagnostic, never the full text. Accepts an Error or a string.
+ */
+export function crashSummaryForCloud(err) {
+    const name = err instanceof Error ? err.name || "Error" : "Error";
+    const raw = err instanceof Error ? err.message : typeof err === "string" ? err : "Unknown error";
+    const msg = raw.replace(/\s+/g, " ").trim().slice(0, 200);
+    return msg ? `${name}: ${msg}` : name;
+}
+// Handles already finished. A run gets exactly one terminal finish: a throw
+// after the in-try finish must not send a second "failed" over a real result.
+const finishedHandles = new WeakSet();
+export async function finishCloudLifecycle(config, handle, results, durationMs, status = "success", error) {
     if (!handle || !config.cloudToken)
         return;
+    if (finishedHandles.has(handle))
+        return;
+    finishedHandles.add(handle);
     const reportConfig = { cloudToken: config.cloudToken };
     await finishRun(reportConfig, handle.runId, {
         status,
         duration_ms: durationMs,
         metrics: deriveGenericMetrics(results, durationMs),
+        // `error` is reduced to name + 200-char message (see crashSummaryForCloud).
+        // Only forwarded on the crash/throw path where the executor never
+        // returned a results map.
+        ...(error ? { error: crashSummaryForCloud(error) } : {}),
     });
 }
 /**
@@ -267,10 +369,18 @@ export async function finishCloudLifecycle(config, handle, results, durationMs,
  *
  * Maps the engine's ExecutionEvent stream onto `POST /api/runs/:id/node`:
  *   node:enter   → { event: "enter",  node }
- *   node:exit    → { event: "exit",   node, status, duration_ms }
- *   node:progress → { event: "progress", node, data: { message } }
+ *   node:exit    → { event: "exit",   node, status, duration_ms, data: { evals, tool_calls } }
+ *   node:progress → { event: "progress", node, data: { progress: true } }
  *   node:retry   → { event: "progress", node, data: { retry: true, attempt, reason } }
- * Other events (workflow:start, tool:*, route, workflow:end) are dropped.
+ *   node:warning → { event: "progress", node, data: { warning: true, reason, fields } }
+ *   route        → { event: "progress", node: from, data: { route: { to, reason } } }
+ * Other events (workflow:start, tool:*, workflow:end) are dropped.
+ *
+ * The node:exit `data` carries the SHAPE-ONLY type-metric substrate for the
+ * node: eval verdicts (name + pass, never reasoning prose) and tool-call
+ * NAME + STATUS counts (never tool input/output). This is the same substrate
+ * the finish payload aggregates; streaming it per-node lets the cloud render
+ * progress without waiting for finish.
  *
  * Returns undefined when the handle is null (no cloud session) or the
  * token is missing. The observer captures `node:enter` timestamps in a
@@ -286,6 +396,45 @@ export async function finishCloudLifecycle(config, handle, results, durationMs,
  *   3. The Map is keyed by node id; collisions only happen if the same
  *      node id runs concurrently, which the engine does not do today.
  */
+/**
+ * Build the SHAPE-ONLY per-node substrate for a `node:exit` event's `data`.
+ *
+ * Emits eval verdicts (name + kind + pass, and reasoning only when the
+ * evaluator's reasoning is itself a machine verdict, which it is NOT here, so
+ * reasoning is omitted), tool-call NAME + STATUS counts, and usage totals.
+ * NEVER emits tool input/output, response text, or eval reasoning prose.
+ * Returns undefined when the node carries none of it.
+ */
+function summarizeNodeResult(result) {
+    const data = {};
+    if (result.evals && result.evals.length > 0) {
+        // name + kind + pass only. `reasoning` can quote agent output or bug
+        // detail, so it is deliberately dropped.
+        data.evals = result.evals.map((e) => ({ name: e.name, kind: e.kind, pass: e.pass }));
+    }
+    if (result.toolCalls && result.toolCalls.length > 0) {
+        let error = 0;
+        const byName = {};
+        for (const call of result.toolCalls) {
+            if (call.status === "error")
+                error++;
+            const name = call.tool || "unknown";
+            byName[name] = (byName[name] ?? 0) + 1;
+        }
+        data.tool_calls = { total: result.toolCalls.length, error, by_name: byName };
+    }
+    if (result.usage) {
+        data.usage = {
+            total_cost_usd: result.usage.costUsd,
+            input_tokens: result.usage.inputTokens,
+            output_tokens: result.usage.outputTokens,
+            cache_read_tokens: result.usage.cacheReadTokens,
+            cache_creation_tokens: result.usage.cacheCreationTokens,
+            num_turns: result.usage.numTurns,
+        };
+    }
+    return Object.keys(data).length > 0 ? data : undefined;
+}
 export function createCloudStreamObserver(config, handle) {
     if (!handle || !config.cloudToken)
         return undefined;
@@ -312,11 +461,13 @@ export function createCloudStreamObserver(config, handle) {
                     const enter = enterTimes.get(event.node);
                     const duration_ms = typeof enter === "number" ? Date.now() - enter : undefined;
                     enterTimes.delete(event.node);
+                    const data = summarizeNodeResult(event.result);
                     fire({
                         event: "exit",
                         node: event.node,
                         status: event.result.status,
                         duration_ms,
+                        ...(data ? { data } : {}),
                     });
                     break;
                 }
@@ -324,7 +475,9 @@ export function createCloudStreamObserver(config, handle) {
                     fire({
                         event: "progress",
                         node: event.node,
-                        data: { message: event.message },
+                        // PRIVACY: event.message is SDK tool_use_summary prose (model-written)
+                        // or "tool (Ns)". Never ship it; the heartbeat alone is the signal.
+                        data: { progress: true },
                     });
                     break;
                 }
@@ -332,13 +485,35 @@ export function createCloudStreamObserver(config, handle) {
                     fire({
                         event: "progress",
                         node: event.node,
-                        data: { retry: true, attempt: event.attempt, reason: event.reason },
+                        // PRIVACY: `reason` can carry model/SDK error prose; omit it.
+                        data: { retry: true, attempt: event.attempt },
+                    });
+                    break;
+                }
+                case "node:warning": {
+                    // Shape-only: reason is a short summary and fields are declared
+                    // property NAMES, never values. See the node:warning docs in types.ts.
+                    fire({
+                        event: "progress",
+                        node: event.node,
+                        data: { warning: true, reason: event.reason, fields: event.fields },
+                    });
+                    break;
+                }
+                case "route": {
+                    // Routing decision. `reason` is LLM-written prose and is NEVER
+                    // forwarded; only the node ids (author-written workflow structure).
+                    // Attributed to the `from` node.
+                    fire({
+                        event: "progress",
+                        node: event.from,
+                        data: { route: { from: event.from, to: event.to } },
                     });
                     break;
                 }
                 default:
-                    // Drop workflow:start, sources:resolved, tool:*, route,
-                    // workflow:end. Cloud only models the per-node lifecycle today.
+                    // Drop workflow:start, sources:resolved, tool:*, workflow:end.
+                    // Cloud only models the per-node lifecycle today.
                     break;
             }
         }

package/dist/cli/cloud-report.js

@@ -4,6 +4,32 @@ const _require = createRequire(import.meta.url);
 const { version } = _require("../../package.json");
 // ── Cloud reporting ────────────────────────────────────────────────
 const CLOUD_URL_DEFAULT = "https://cloud.sweny.ai";
+/**
+ * Reduce a raw finding to its shape-only classification. Keeps severity,
+ * novel-vs-duplicate, fix complexity, and affected-service COUNT. Drops
+ * `title`, `root_cause`, `fix_approach`, and `duplicate_of` — the fields that
+ * would leak the customer's private bug description, the raw root-cause
+ * analysis, the proposed fix prose, or a linkable existing-issue id.
+ */
+function shapeFinding(f) {
+    const shaped = {
+        severity: typeof f.severity === "string" ? f.severity : undefined,
+        is_duplicate: f.is_duplicate === true,
+    };
+    if (typeof f.fix_complexity === "string")
+        shaped.fix_complexity = f.fix_complexity;
+    // COUNT only. Service names are LLM-written strings; never ship them.
+    if (Array.isArray(f.affected_services)) {
+        shaped.affected_services_count = f.affected_services.filter((s) => typeof s === "string").length;
+    }
+    return shaped;
+}
+const RECOMMENDATIONS = ["implement", "escalate", "skip"];
+/** Clamp free LLM text to a closed enum so no prose can ride in `recommendation`. */
+function toRecommendationEnum(v) {
+    const t = typeof v === "string" ? v.trim().toLowerCase() : "";
+    return RECOMMENDATIONS.includes(t) ? t : "other";
+}
 /**
  * Opt-in run reporting to SWEny Cloud.
  *
@@ -24,8 +50,22 @@ export async function reportToCloud(results, durationMs, config, workflow) {
     const investigateData = results.get("investigate")?.data;
     const createPrData = results.get("create_pr")?.data;
     const createIssueData = results.get("create_issue")?.data ?? results.get("create-issue")?.data;
-    const findings = investigateData?.findings ?? [];
+    const rawFindings = investigateData?.findings ?? [];
+    // SHAPE-ONLY findings. The raw finding carries `title`, `root_cause`, and
+    // `fix_approach` — free LLM prose about the customer's private bug and the
+    // proposed fix. That MUST NEVER leave the host (product rule: show don't
+    // store code). We ship only the classification metadata: severity, novel vs
+    // duplicate, fix complexity, and affected-service count. Mirrors the
+    // `inputs_shape` precedent in cloud-lifecycle.ts (key shape, never values).
+    const findings = rawFindings.map(shapeFinding);
     const hasFailed = [...results.values()].some((r) => r.status === "failed");
+    // Severity histogram — counts only, derived from the shape-only findings.
+    const severityCounts = {};
+    for (const f of findings) {
+        if (f.severity)
+            severityCounts[f.severity] = (severityCounts[f.severity] ?? 0) + 1;
+    }
+    const duplicateCount = findings.filter((f) => f.is_duplicate).length;
     const nodes = [...results.entries()].map(([id, r]) => ({
         id,
         name: id,
@@ -42,8 +82,11 @@ export async function reportToCloud(results, durationMs, config, workflow) {
         status: hasFailed ? "failed" : "completed",
         workflow,
         duration_ms: durationMs,
-        recommendation: investigateData?.recommendation,
+        recommendation: investigateData?.recommendation === undefined ? undefined : toRecommendationEnum(investigateData.recommendation),
         findings,
+        findings_count: findings.length,
+        duplicate_count: duplicateCount,
+        severity_counts: severityCounts,
         highest_severity: investigateData?.highest_severity,
         novel_count: investigateData?.novel_count,
         pr_url: createPrData?.prUrl,

package/dist/cli/config-file.d.ts

@@ -3,6 +3,13 @@
  * Sets `process.env[KEY]` only if not already defined (real env vars win).
  */
 export declare function loadDotenv(cwd?: string): void;
+/**
+ * Copy agent sandbox / env-passthrough settings from `.sweny.yml` into the
+ * environment. Real env vars win (same precedence as {@link loadDotenv}).
+ * YAML booleans arrive as "true"/"false", which the sandbox mode parser
+ * treats as on/off.
+ */
+export declare function applyAgentFileConfig(fileConfig: FileConfig, env?: NodeJS.ProcessEnv): void;
 /** Parsed config file — flat strings for scalar fields, arrays for list fields, objects for nested blocks. */
 export type FileConfig = Record<string, string | string[] | Record<string, unknown>>;
 /**
@@ -12,4 +19,4 @@ export type FileConfig = Record<string, string | string[] | Record<string, unkno
  */
 export declare function loadConfigFile(cwd?: string): FileConfig;
 /** Starter config written by `sweny new`. */
-export declare const STARTER_CONFIG = "# .sweny.yml \u2014 SWEny project configuration\n# Commit this file. Secrets (API keys, tokens) go in .env (gitignored).\n#\n# Every key matches a CLI flag: \"time-range: 4h\" is the same as \"--time-range 4h\".\n# CLI flags override this file; env vars override this file; this file overrides defaults.\n\n# \u2500\u2500 Providers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# observability-provider: datadog        # datadog | sentry | cloudwatch | splunk | elastic | newrelic | loki | prometheus | pagerduty | heroku | opsgenie | vercel | supabase | netlify | fly | render | file\n# issue-tracker-provider: github-issues  # github-issues | linear | jira\n# source-control-provider: github        # github | gitlab\n# coding-agent-provider: claude          # claude | codex | gemini\n# notification-provider: console         # console | slack | teams | discord | email | webhook\n\n# \u2500\u2500 Investigation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# time-range: 24h\n# severity-focus: errors\n# service-filter: \"*\"\n# investigation-depth: standard          # quick | standard | thorough\n\n# \u2500\u2500 PR / branch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# base-branch: main\n# pr-labels: agent,triage,needs-review\n\n# \u2500\u2500 Paths \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# service-map-path: .github/service-map.yml\n# log-file: ./logs/errors.json           # required when observability-provider is \"file\"\n\n# \u2500\u2500 Cache \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# cache-dir: .sweny/cache\n# cache-ttl: 86400\n\n# \u2500\u2500 Run reporting \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Opt-in and not currently available: token minting is not yet exposed, so\n# leaving this unset means no reporting request is ever made.\n# cloud-token: sweny_pk_...\n# Or set SWENY_CLOUD_TOKEN in your environment.\n\n# \u2500\u2500 MCP servers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Extend the coding agent with additional tools via MCP.\n# Value is a JSON object \u2014 each key is a server name you choose.\n# See https://docs.sweny.ai/advanced/mcp-servers/ for a full catalog with copy-paste configs.\n#\n# Example: GitHub MCP server (query PRs, issues, CI run logs)\n# mcp-servers-json: '{\"github\":{\"type\":\"stdio\",\"command\":\"npx\",\"args\":[\"-y\",\"@modelcontextprotocol/server-github@latest\"],\"env\":{\"GITHUB_PERSONAL_ACCESS_TOKEN\":\"ghp_...\"}}}'\n\n# \u2500\u2500 Local-only quick start \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Uncomment to run without any external services (just an LLM API key):\n# observability-provider: file\n# log-file: ./sample-errors.json\n# issue-tracker-provider: file\n# source-control-provider: file\n# notification-provider: file\n# output-dir: .sweny/output\n\n# \u2500\u2500 Credentials (.env) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Copy the relevant block into your .env file and fill in the values.\n#\n# Claude (coding agent) \u2014 https://console.anthropic.com/settings/api-keys\n#   ANTHROPIC_API_KEY=sk-ant-...\n#\n# GitHub (source control + issue tracker)\n#   GITHUB_TOKEN=ghp_...        # https://github.com/settings/tokens (repo + issues scopes)\n#\n# Datadog (observability) \u2014 https://app.datadoghq.com/organization-settings\n#   DD_API_KEY=...              # Organization Settings > API Keys\n#   DD_APP_KEY=...              # Organization Settings > Application Keys\n#   DD_SITE=datadoghq.com       # or datadoghq.eu, us3.datadoghq.com, etc.\n#\n# Sentry (observability) \u2014 https://sentry.io/settings/auth-tokens/\n#   SENTRY_AUTH_TOKEN=sntrys_...\n#   SENTRY_ORG=your-org-slug    # from sentry.io/organizations/<slug>/\n#   SENTRY_PROJECT=your-project # Project Settings > General > Project Slug\n#\n# Linear (issue tracker) \u2014 https://linear.app/settings/api\n#   LINEAR_API_KEY=lin_api_...\n#   LINEAR_TEAM_ID=...          # Settings > Workspace > Teams > [team] > copy ID from URL\n#   LINEAR_BUG_LABEL_ID=...     # Settings > Labels > [label] > copy ID from URL\n#\n# Jira (issue tracker) \u2014 https://your-org.atlassian.net\n#   JIRA_BASE_URL=https://your-org.atlassian.net\n#   JIRA_EMAIL=you@company.com  # your Atlassian account email\n#   JIRA_API_TOKEN=...          # https://id.atlassian.com/manage-profile/security/api-tokens\n#\n# Vercel (observability) \u2014 https://vercel.com/account/tokens\n#   VERCEL_TOKEN=...\n#   VERCEL_PROJECT_ID=prj_...      # Project Settings > General > Project ID\n#   VERCEL_TEAM_ID=team_...        # optional, for team-owned projects\n#\n# Supabase (observability) \u2014 https://supabase.com/dashboard/account/tokens\n#   SUPABASE_MANAGEMENT_KEY=...\n#   SUPABASE_PROJECT_REF=...       # Project Settings > General > Reference ID\n#\n# Netlify (observability) \u2014 https://app.netlify.com/user/applications#personal-access-tokens\n#   NETLIFY_TOKEN=...\n#   NETLIFY_SITE_ID=...         # Site Settings > General > Site ID\n#\n# Fly.io (observability) \u2014 https://fly.io/user/personal_access_tokens\n#   FLY_TOKEN=...\n#   FLY_APP_NAME=...             # the name of your Fly.io application\n#\n# Render (observability) \u2014 https://dashboard.render.com/u/settings\n#   RENDER_API_KEY=...\n#   RENDER_SERVICE_ID=srv-...    # from your service's Settings page\n#\n# Prometheus (observability) \u2014 self-hosted or Grafana Cloud\n#   PROMETHEUS_URL=http://prometheus.internal:9090\n#   PROMETHEUS_TOKEN=...         # optional, for secured instances\n#\n# PagerDuty (observability) \u2014 https://your-account.pagerduty.com/api_keys\n#   PAGERDUTY_API_KEY=...\n#\n# Honeycomb (observability) \u2014 https://docs.honeycomb.io/api/\n#   HONEYCOMB_API_KEY=...\n#   HONEYCOMB_DATASET=...        # dataset name (e.g. production)\n#\n# Heroku (observability) \u2014 https://devcenter.heroku.com/articles/platform-api-reference\n#   HEROKU_API_KEY=...           # https://dashboard.heroku.com/account\n#   HEROKU_APP_NAME=...          # the name of your Heroku application\n#\n# OpsGenie (observability) \u2014 https://support.atlassian.com/opsgenie/docs/api-key-management/\n#   OPSGENIE_API_KEY=...\n#   OPSGENIE_REGION=us           # or eu for EU-hosted accounts\n#\n# Slack (notifications) \u2014 https://api.slack.com/apps\n#   NOTIFICATION_WEBHOOK_URL=https://hooks.slack.com/services/...\n#   # or use a bot token: SLACK_BOT_TOKEN=xoxb-...\n";
+export declare const STARTER_CONFIG = "# .sweny.yml \u2014 SWEny project configuration\n# Commit this file. Secrets (API keys, tokens) go in .env (gitignored).\n#\n# Every key matches a CLI flag: \"time-range: 4h\" is the same as \"--time-range 4h\".\n# CLI flags override this file; env vars override this file; this file overrides defaults.\n\n# \u2500\u2500 Providers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# observability-provider: datadog        # datadog | sentry | cloudwatch | splunk | elastic | newrelic | loki | prometheus | pagerduty | heroku | opsgenie | vercel | supabase | netlify | fly | render | file\n# issue-tracker-provider: github-issues  # github-issues | linear | jira\n# source-control-provider: github        # github | gitlab\n# coding-agent-provider: claude          # claude (the only supported agent)\n# notification-provider: console         # console | slack | teams | discord | email | webhook\n\n# \u2500\u2500 Investigation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# time-range: 24h\n# severity-focus: errors\n# service-filter: \"*\"\n# investigation-depth: standard          # quick | standard | thorough\n\n# \u2500\u2500 PR / branch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# base-branch: main\n# pr-labels: agent,triage,needs-review\n\n# \u2500\u2500 Paths \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# service-map-path: .github/service-map.yml\n# log-file: ./logs/errors.json           # required when observability-provider is \"file\"\n\n# \u2500\u2500 Cache \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# cache-dir: .sweny/cache\n# cache-ttl: 86400\n\n# \u2500\u2500 Run reporting \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Opt-in and not currently available: token minting is not yet exposed, so\n# leaving this unset means no reporting request is ever made.\n# cloud-token: sweny_pk_...\n# Or set SWENY_CLOUD_TOKEN in your environment.\n\n# \u2500\u2500 Agent sandbox \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# See https://docs.sweny.ai/advanced/agent-sandbox/\n# sandbox: off                           # off (local default) | auto (CI default: sandbox if supported, else warn) | strict\n# sandbox-allowed-domains: [internal.example.com]   # extra hosts agent commands may reach\n# env-scope: off                         # off (local default: full env) | on (CI default: allowlist)\n# env-passthrough: [NPM_TOKEN]           # extra env vars the agent may see when scoped (\"*\" = all)\n\n# \u2500\u2500 MCP servers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Extend the coding agent with additional tools via MCP.\n# Value is a JSON object \u2014 each key is a server name you choose.\n# See https://docs.sweny.ai/advanced/mcp-servers/ for a full catalog with copy-paste configs.\n#\n# Example: GitHub MCP server (query PRs, issues, CI run logs)\n# mcp-servers-json: '{\"github\":{\"type\":\"stdio\",\"command\":\"npx\",\"args\":[\"-y\",\"@modelcontextprotocol/server-github@latest\"],\"env\":{\"GITHUB_PERSONAL_ACCESS_TOKEN\":\"ghp_...\"}}}'\n\n# \u2500\u2500 Local-only quick start \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Uncomment to run without any external services (just an LLM API key):\n# observability-provider: file\n# log-file: ./sample-errors.json\n# issue-tracker-provider: file\n# source-control-provider: file\n# notification-provider: file\n# output-dir: .sweny/output\n\n# \u2500\u2500 Credentials (.env) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Copy the relevant block into your .env file and fill in the values.\n#\n# Claude (coding agent) \u2014 https://console.anthropic.com/settings/api-keys\n#   ANTHROPIC_API_KEY=sk-ant-...\n#\n# GitHub (source control + issue tracker)\n#   GITHUB_TOKEN=ghp_...        # https://github.com/settings/tokens (repo + issues scopes)\n#\n# Datadog (observability) \u2014 https://app.datadoghq.com/organization-settings\n#   DD_API_KEY=...              # Organization Settings > API Keys\n#   DD_APP_KEY=...              # Organization Settings > Application Keys\n#   DD_SITE=datadoghq.com       # or datadoghq.eu, us3.datadoghq.com, etc.\n#\n# Sentry (observability) \u2014 https://sentry.io/settings/auth-tokens/\n#   SENTRY_AUTH_TOKEN=sntrys_...\n#   SENTRY_ORG=your-org-slug    # from sentry.io/organizations/<slug>/\n#   SENTRY_PROJECT=your-project # Project Settings > General > Project Slug\n#\n# Linear (issue tracker) \u2014 https://linear.app/settings/api\n#   LINEAR_API_KEY=lin_api_...\n#   LINEAR_TEAM_ID=...          # Settings > Workspace > Teams > [team] > copy ID from URL\n#   LINEAR_BUG_LABEL_ID=...     # Settings > Labels > [label] > copy ID from URL\n#\n# Jira (issue tracker) \u2014 https://your-org.atlassian.net\n#   JIRA_BASE_URL=https://your-org.atlassian.net\n#   JIRA_EMAIL=you@company.com  # your Atlassian account email\n#   JIRA_API_TOKEN=...          # https://id.atlassian.com/manage-profile/security/api-tokens\n#\n# Vercel (observability) \u2014 https://vercel.com/account/tokens\n#   VERCEL_TOKEN=...\n#   VERCEL_PROJECT_ID=prj_...      # Project Settings > General > Project ID\n#   VERCEL_TEAM_ID=team_...        # optional, for team-owned projects\n#\n# Supabase (observability) \u2014 https://supabase.com/dashboard/account/tokens\n#   SUPABASE_MANAGEMENT_KEY=...\n#   SUPABASE_PROJECT_REF=...       # Project Settings > General > Reference ID\n#\n# Netlify (observability) \u2014 https://app.netlify.com/user/applications#personal-access-tokens\n#   NETLIFY_TOKEN=...\n#   NETLIFY_SITE_ID=...         # Site Settings > General > Site ID\n#\n# Fly.io (observability) \u2014 https://fly.io/user/personal_access_tokens\n#   FLY_TOKEN=...\n#   FLY_APP_NAME=...             # the name of your Fly.io application\n#\n# Render (observability) \u2014 https://dashboard.render.com/u/settings\n#   RENDER_API_KEY=...\n#   RENDER_SERVICE_ID=srv-...    # from your service's Settings page\n#\n# Prometheus (observability) \u2014 self-hosted or Grafana Cloud\n#   PROMETHEUS_URL=http://prometheus.internal:9090\n#   PROMETHEUS_TOKEN=...         # optional, for secured instances\n#\n# PagerDuty (observability) \u2014 https://your-account.pagerduty.com/api_keys\n#   PAGERDUTY_API_KEY=...\n#\n# Honeycomb (observability) \u2014 https://docs.honeycomb.io/api/\n#   HONEYCOMB_API_KEY=...\n#   HONEYCOMB_DATASET=...        # dataset name (e.g. production)\n#\n# Heroku (observability) \u2014 https://devcenter.heroku.com/articles/platform-api-reference\n#   HEROKU_API_KEY=...           # https://dashboard.heroku.com/account\n#   HEROKU_APP_NAME=...          # the name of your Heroku application\n#\n# OpsGenie (observability) \u2014 https://support.atlassian.com/opsgenie/docs/api-key-management/\n#   OPSGENIE_API_KEY=...\n#   OPSGENIE_REGION=us           # or eu for EU-hosted accounts\n#\n# Slack (notifications) \u2014 https://api.slack.com/apps\n#   NOTIFICATION_WEBHOOK_URL=https://hooks.slack.com/services/...\n#   # or use a bot token: SLACK_BOT_TOKEN=xoxb-...\n";