@sweny-ai/core 0.1.123 → 0.1.124

package/dist/cli/workflow-input.js

@@ -0,0 +1,56 @@
+/**
+ * Small, side-effect-free helpers for building the `workflowInput` bag that
+ * `sweny workflow run` hands to `execute()`.
+ *
+ * Deliberately NOT in main.ts: main.ts ends with a top-level
+ * `await program.parseAsync()` (see bottom of file), so importing it at all
+ * triggers full CLI argv parsing as a side effect. That makes main.ts unsafe
+ * to `import` from a test. Anything worth unit-testing in isolation lives
+ * here instead (same pattern as config.ts / credentials.ts / e2e.ts).
+ */
+/**
+ * Merge the CLI-level `--dry-run` flag into a `--input`-validated workflow
+ * input bag.
+ *
+ * #324: `sweny workflow run <file> --dry-run --input '{...}'` (what the
+ * GitHub Action and MCP server both pass) silently dropped `dryRun` before
+ * this fix: the `--input` branch built `workflowInput` from the caller's
+ * JSON alone, and only the config-derived (no-`--input`) branch merged in
+ * `config.dryRun`. The executor's fail-closed dry-run gate (see
+ * `advanceFromNode` in executor.ts) reads `input.dryRun` directly, so a
+ * dropped flag meant the full workflow, side effects included, ran anyway.
+ *
+ * Only forces `dryRun` *on*: when `--dry-run` is set it always wins, but a
+ * caller-supplied `dryRun: true` already present in the `--input` JSON must
+ * never be downgraded just because `--dry-run` was omitted.
+ */
+export function mergeDryRunIntoInput(validatedInput, cliDryRun) {
+    if (!cliDryRun)
+        return validatedInput;
+    return { ...validatedInput, dryRun: true };
+}
+/**
+ * Parse `--timeout` / `--max-steps` for `sweny workflow run`. Throws a clear
+ * error on non-numeric or out-of-range values instead of silently falling
+ * back to a default (which hid typos like `--timeout 15m`).
+ *
+ * - `--timeout <ms>`: whole-run wall-clock budget in ms. `0` means no
+ *   wall-clock budget (returned as `0`). Absent returns `defaultTimeoutMs`.
+ * - `--max-steps <n>`: positive integer. Absent returns `undefined` (the
+ *   executor's own default applies).
+ */
+export function parseRunBudgetFlags(timeout, maxSteps, defaultTimeoutMs) {
+    const parse = (raw, flag, min) => {
+        const t = raw.trim();
+        const n = t === "" ? Number.NaN : Number(t);
+        if (!Number.isInteger(n) || n < min) {
+            throw new Error(`${flag} must be ${min === 0 ? "a non-negative" : "a positive"} integer, got "${raw}"` +
+                (flag === "--timeout" ? " (milliseconds; 0 disables the wall-clock budget)" : ""));
+        }
+        return n;
+    };
+    return {
+        timeoutMs: timeout === undefined ? defaultTimeoutMs : parse(timeout, "--timeout", 0),
+        maxSteps: maxSteps === undefined ? undefined : parse(maxSteps, "--max-steps", 1),
+    };
+}

package/dist/executor.d.ts

@@ -12,7 +12,7 @@
  *
  * This replaces ~8k lines of engine + recipe step code.
  */
-import type { Workflow, Skill, Claude, Observer, Logger, ExecutionResult } from "./types.js";
+import type { Workflow, Skill, Tool, Claude, Observer, Logger, ExecutionResult } from "./types.js";
 export interface ExecuteOptions {
     /** Registered skills (id → Skill) */
     skills: Map<string, Skill>;
@@ -80,3 +80,19 @@ export declare const DEFAULT_MAX_STEPS = 200;
  * - `trace`: full ordered execution trace including loops and routing decisions
  */
 export declare function execute(workflow: Workflow, input: unknown, options: ExecuteOptions): Promise<ExecutionResult>;
+/**
+ * Thrown when a conditional routing decision could not be made and there is
+ * no explicit default (unconditional) edge to fall back to. Fails closed: the
+ * executor refuses to guess an edge (the historical fail-open bug), so an LLM
+ * outage terminates the run loudly instead of silently taking the first
+ * conditional edge.
+ */
+export declare class RouteEvaluationError extends Error {
+    readonly node: string;
+    constructor(node: string, message: string);
+}
+/**
+ * Dry-run tool gate (#380). Only an explicit `access: "read"` passes; a tool
+ * with no `access` is treated as a write so new tools fail safe.
+ */
+export declare function isReadTool(tool: Pick<Tool, "access">): boolean;

package/dist/executor.js

@@ -19,6 +19,8 @@ import { evaluateRequires } from "./requires.js";
 import { buildRetryPreamble } from "./retry.js";
 import { resolveExecutionModel } from "./model.js";
 import { buildToolAliases } from "./skills/index.js";
+import { resolveAgentAccess } from "./agent-env.js";
+import { fenceUntrusted } from "./untrusted.js";
 /**
  * Default workflow-level step budget. Counts total node executions across the
  * whole run (loop iterations included). Generous enough for legitimate deep
@@ -47,6 +49,7 @@ export async function execute(workflow, input, options) {
     const { claude, observer, signal, timeoutMs } = options;
     // If the caller already aborted before we started, fail fast.
     throwIfAborted(signal);
+    const dryRun = isDryRunInput(input);
     // Merge inline workflow skills into the skill map so they resolve at runtime.
     // Inline skills (instruction/mcp only) become Skill objects with empty tools/config.
     // The caller's skill map takes precedence — inline skills only fill gaps.
@@ -135,7 +138,15 @@ export async function execute(workflow, input, options) {
         // skill-tool filter (`tools.allow` / `tools.deny`). Filtered tools are
         // never registered for the run, so the model cannot see or call them.
         const resolvedSkillTools = resolveTools(node.skills, skills);
-        const tools = filterNodeTools(resolvedSkillTools, node.tools, currentId, logger);
+        const filteredTools = filterNodeTools(resolvedSkillTools, node.tools, currentId, logger);
+        // Dry run (#380): only `access: "read"` tools reach the node. Write and
+        // unclassified tools are withheld (never registered, so never callable)
+        // and recorded on the node result as `skippedWrites`.
+        const tools = dryRun ? filteredTools.filter(isReadTool) : filteredTools;
+        const skippedWrites = dryRun ? filteredTools.filter((t) => !isReadTool(t)).map((t) => t.name) : [];
+        if (skippedWrites.length > 0) {
+            logger.info(`  dry run: withheld write tools: ${skippedWrites.join(", ")}`, { node: currentId });
+        }
         const skillInstructions = resolveSkillInstructions(node.skills, skills);
         // Runtime guard: if this node declares skills but none resolved, the node
         // cannot do its job (e.g. "create a Linear issue" with no linear skill).
@@ -176,6 +187,13 @@ export async function execute(workflow, input, options) {
             trace.steps.push({ node: currentId, status: result.status, iteration });
             safeObserve(observer, { type: "node:exit", node: currentId, result }, logger);
             logger.warn(`  requires ${onFail === "skip" ? "skipped" : "failed"}: ${requiresError}`, { node: currentId });
+            // Fail closed here too: a requires failure with on_fail: fail yields a
+            // failed node, which halts by default (same policy as a failed run).
+            if (result.status === "failed" && (node.on_fail ?? "halt") === "halt") {
+                logger.warn(`  requires failed; halting workflow (on_fail: halt)`, { node: currentId });
+                safeObserve(observer, { type: "route", from: currentId, to: "(end)", reason: "node failed (on_fail: halt)" }, logger);
+                break;
+            }
             // Apply normal routing rules (dry run gate + resolveNext).
             // TODO: dedupe with requires path — see advanceFromNode helper below
             const next = await advanceFromNode(workflow, currentId, results, input, claude, observer, edgeCounts, logger, trace, { signal, timeoutMs });
@@ -196,7 +214,8 @@ export async function execute(workflow, input, options) {
         // Prepend rules and context to instruction per cascade semantics
         const effectiveRules = assembleCascaded("rules", currentId, workflow.nodes[currentId], inputRules.length, (workflow.rules ?? []).length, resolvedSources);
         const effectiveContext = assembleCascaded("context", currentId, workflow.nodes[currentId], inputContext.length, (workflow.context ?? []).length, resolvedSources);
-        const instruction = buildNodeInstruction(resolvedInstruction, effectiveRules, effectiveContext, input, skillInstructions);
+        const baseInstruction = buildNodeInstruction(resolvedInstruction, effectiveRules, effectiveContext, input, skillInstructions);
+        const instruction = dryRun ? `${dryRunNotice(skippedWrites)}\n\n---\n\n${baseInstruction}` : baseInstruction;
         // Run Claude on this node, with optional eval-failure retry loop.
         let attempt = 0;
         let result;
@@ -221,6 +240,8 @@ export async function execute(workflow, input, options) {
                 model: nodeModel,
                 signal,
                 timeoutMs,
+                agentAccess: resolveAgentAccess(node.skills, skills),
+                ...(dryRun ? { readOnly: true } : {}),
                 onProgress: (message) => {
                     safeObserve(observer, { type: "node:progress", node: currentId, message }, logger);
                 },
@@ -283,6 +304,23 @@ export async function execute(workflow, input, options) {
             logger.warn(`  eval failed (attempt ${attempt + 1}/${retry.max + 1}): ${outcome.error}`, {
                 node: currentId,
             });
+            // #325: a retry attempt re-invokes the agent on this node (full model
+            // spend) exactly like a fresh node visit, so it counts against the same
+            // `stepCount`/`maxSteps` budget. Checked BEFORE buildRetryPreamble so no
+            // paid reflection call happens once the budget is exhausted. On
+            // exhaustion, record a failed result and emit node:exit so observers
+            // never see node:enter without a matching node:exit.
+            stepCount++;
+            if (stepCount > maxSteps) {
+                const budgetError = `step budget exceeded: workflow '${workflow.id}' ran ${stepCount} steps (max_steps: ${maxSteps}) ` +
+                    `while retrying node '${currentId}' (attempt ${attempt + 1}/${retry.max}). Lower 'retry.max' on the ` +
+                    `offending node or raise 'max_steps' if the workflow legitimately needs more steps.`;
+                result = { ...result, status: "failed", data: { ...result.data, error: budgetError } };
+                results.set(currentId, result);
+                trace.steps.push({ node: currentId, status: "failed", iteration, retryAttempt: attempt });
+                safeObserve(observer, { type: "node:exit", node: currentId, result }, logger);
+                throw new Error(budgetError);
+            }
             const preamble = await buildRetryPreamble({
                 retry,
                 evalFailures: outcome.failures,
@@ -316,12 +354,26 @@ export async function execute(workflow, input, options) {
                 data: { ...(result.data ?? {}), fail_soft: true },
             };
         }
+        if (skippedWrites.length > 0)
+            result = { ...result, skippedWrites };
         results.set(currentId, result);
         trace.steps.push(attempt > 0
             ? { node: currentId, status: result.status, iteration, retryAttempt: attempt }
             : { node: currentId, status: result.status, iteration });
         safeObserve(observer, { type: "node:exit", node: currentId, result }, logger);
         logger.info(`  ✓ ${result.status}`, { node: currentId, toolCalls: result.toolCalls.length });
+        // Fail closed on node failure. A node that finishes `failed` (agent-level
+        // failure, or an eval failure that exhausted retries and was not softened
+        // by `fail_soft`) HALTS the workflow by default. This stops a broken node
+        // from advancing down a conditional out-edge (e.g. filing an issue/PR) on
+        // the back of a failure. The failed result stays in `results`, so the run
+        // surfaces as failed to callers (CLI exit code, cloud status). Authors who
+        // want the legacy fall-through opt in per-node with `on_fail: "continue"`.
+        if (result.status === "failed" && (node.on_fail ?? "halt") === "halt") {
+            logger.warn(`  node failed; halting workflow (on_fail: halt)`, { node: currentId });
+            safeObserve(observer, { type: "route", from: currentId, to: "(end)", reason: "node failed (on_fail: halt)" }, logger);
+            break;
+        }
         // Dry run gate + routing — shared with requires path via advanceFromNode helper.
         currentId = await advanceFromNode(workflow, currentId, results, input, claude, observer, edgeCounts, logger, trace, {
             signal,
@@ -335,6 +387,21 @@ export async function execute(workflow, input, options) {
     return { results, trace };
 }
 // ─── Internals ───────────────────────────────────────────────────
+/**
+ * Thrown when a conditional routing decision could not be made and there is
+ * no explicit default (unconditional) edge to fall back to. Fails closed: the
+ * executor refuses to guess an edge (the historical fail-open bug), so an LLM
+ * outage terminates the run loudly instead of silently taking the first
+ * conditional edge.
+ */
+export class RouteEvaluationError extends Error {
+    node;
+    constructor(node, message) {
+        super(message);
+        this.node = node;
+        this.name = "RouteEvaluationError";
+    }
+}
 /**
  * Build the full instruction for a node.
  *
@@ -353,7 +420,8 @@ function buildNodeInstruction(baseInstruction, effectiveRules, effectiveContext,
         sections.push(`## Rules — You MUST Follow These\n\n${effectiveRules}`);
     }
     if (effectiveContext) {
-        sections.push(`## Background Context\n\n${effectiveContext}`);
+        // Context Sources can be fetched pages or runtime input: fence as untrusted (#360).
+        sections.push(`## Background Context\n\n${fenceUntrusted(effectiveContext, "background-context")}`);
     }
     // Legacy fallback for `input.additionalContext` when no rules/context cascaded
     if (sections.length === 0) {
@@ -635,6 +703,24 @@ function mergeInlineSkills(skills, inlineSkills) {
     }
     return merged;
 }
+/** True when the run input requests a dry run (`dryRun === true`, strictly). */
+function isDryRunInput(input) {
+    return input != null && typeof input === "object" && input.dryRun === true;
+}
+/**
+ * Dry-run tool gate (#380). Only an explicit `access: "read"` passes; a tool
+ * with no `access` is treated as a write so new tools fail safe.
+ */
+export function isReadTool(tool) {
+    return tool.access === "read";
+}
+/** Instruction section prepended to every node under dry-run. */
+function dryRunNotice(skippedWrites) {
+    const withheld = skippedWrites.length > 0 ? `These write tools were withheld from this step: ${skippedWrites.join(", ")}. ` : "";
+    return (`## Dry run\n\nThis is a dry run. Only read-only tools are available. ${withheld}` +
+        `Do not create, modify, post, or send anything. Do the analysis, and where this step would ` +
+        `normally write, describe exactly what it would have written instead.`);
+}
 function resolveTools(skillIds, skills) {
     return skillIds
         .map((id) => skills.get(id))
@@ -745,12 +831,13 @@ function resolveConfig(skills, overrides, env = process.env) {
  * Returns the next node ID, or null when execution should stop.
  */
 async function advanceFromNode(workflow, currentId, results, input, claude, observer, edgeCounts, logger, trace, abort) {
-    // Dry run hard gate — stop at the first conditional routing decision.
-    // Unconditional edges are analysis flow (prepare→gather→investigate);
-    // conditional edges are action decisions (investigate→create_issue/skip).
-    // Enforced in the executor so it cannot be bypassed by LLM evaluation.
-    const isDryRun = input && typeof input === "object" && input.dryRun === true;
-    if (isDryRun) {
+    // Dry run path gate: stop at the first conditional routing decision.
+    // Safety does not depend on this (#380): under dry-run every node already
+    // runs read-only (see execute()). The stop keeps the dry-run path a pure
+    // function of the graph (no LLM route evaluation, so the same workflow
+    // always visits the same nodes) and skips action branches whose output
+    // would only describe writes that cannot happen.
+    if (isDryRunInput(input)) {
         const outEdges = workflow.edges.filter((e) => e.from === currentId);
         if (outEdges.some((e) => e.when)) {
             safeObserve(observer, { type: "route", from: currentId, to: "(end)", reason: "dry run" }, logger);
@@ -871,6 +958,29 @@ async function resolveNext(workflow, current, results, input, claude, observer,
         signal: abort?.signal,
         timeoutMs: abort?.timeoutMs,
     });
+    // Fail closed. `evaluate` returns null when the routing decision could not
+    // be made (SDK error, timeout, non-success subtype, or an unparseable
+    // answer). We must NOT fall through to a conditional edge: on a node with a
+    // single conditional out-edge, "the first choice" IS that edge, so an outage
+    // would always take it (the fail-open bug that silently filed real
+    // issues/PRs instead of routing to `skip`). Take the author's explicit
+    // default/else edge if one exists; otherwise terminate the run loudly.
+    if (chosen === null) {
+        if (defaultEdge) {
+            logger?.warn(`  route eval: evaluation failed for node '${current}'; taking default (unconditional) edge '${defaultEdge.to}'.`, { node: current });
+            safeObserve(observer, { type: "route", from: current, to: defaultEdge.to, reason: "route evaluation failed; default edge" }, logger);
+            if (edgeCounts) {
+                const key = `${current}→${defaultEdge.to}`;
+                edgeCounts.set(key, (edgeCounts.get(key) ?? 0) + 1);
+            }
+            return defaultEdge.to;
+        }
+        logger?.error(`  route eval: evaluation failed for node '${current}' and there is no default (unconditional) edge; ` +
+            `refusing to fail open. Terminating the run. Add a default edge or fix the model backend.`, { node: current });
+        safeObserve(observer, { type: "route", from: current, to: "(end)", reason: "route evaluation failed; no default edge" }, logger);
+        throw new RouteEvaluationError(current, `route evaluation failed for node '${current}' and no default (unconditional) edge exists; ` +
+            `refusing to fail open`);
+    }
     // Validate that Claude returned a valid target.
     const validTargets = new Set(outEdges.map((e) => e.to));
     if (!validTargets.has(chosen)) {

package/dist/index.d.ts

@@ -21,11 +21,11 @@
  * })
  * ```
  */
-export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, Source, ResolvedSource, SourceKind, SourceResolutionMap, WorkflowInputs, WorkflowInputField, WorkflowInputType, InputValidationError, InputValidationResult, Evaluator, EvaluatorRule, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, NodeToolFilter, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, McpTransport, WorkflowType, SkillHarnessKey, } from "./types.js";
+export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, Source, ResolvedSource, SourceKind, SourceResolutionMap, WorkflowInputs, WorkflowInputField, WorkflowInputType, InputValidationError, InputValidationResult, Evaluator, EvaluatorRule, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, NodeToolFilter, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, NodeOnFail, McpTransport, WorkflowType, SkillHarnessKey, } from "./types.js";
 export { WORKFLOW_INPUT_TYPES } from "./types.js";
-export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, } from "./types.js";
+export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, } from "./types.js";
 export { consoleLogger } from "./types.js";
-export { execute } from "./executor.js";
+export { execute, RouteEvaluationError } from "./executor.js";
 export type { ExecuteOptions } from "./executor.js";
 export { ClaudeClient, resolveAuthEnv } from "./claude.js";
 export type { ClaudeClientOptions, SwenyAuthMode, ResolveAuthEnvOpts } from "./claude.js";

package/dist/index.js

@@ -23,10 +23,10 @@
  */
 export { WORKFLOW_INPUT_TYPES } from "./types.js";
 // Runtime enum constants + skill-id helpers
-export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, } from "./types.js";
+export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, } from "./types.js";
 export { consoleLogger } from "./types.js";
 // Executor
-export { execute } from "./executor.js";
+export { execute, RouteEvaluationError } from "./executor.js";
 // Claude client
 export { ClaudeClient, resolveAuthEnv } from "./claude.js";
 // Execution model resolution

package/dist/mermaid.d.ts

@@ -20,6 +20,12 @@ export interface MermaidOptions {
     direction?: "TB" | "LR";
     /** Title rendered above the diagram */
     title?: string;
+    /**
+     * Override the `classDef` style body (the part after the class name) for
+     * specific statuses, e.g. `{ success: "fill:#2563eb,stroke:#1d4ed8,color:#fff" }`.
+     * Unset statuses keep the defaults.
+     */
+    classDefs?: Partial<Record<NodeStatus, string>>;
 }
 /**
  * Convert a Workflow to a Mermaid flowchart diagram string.

package/dist/mermaid.js

@@ -24,7 +24,7 @@
  * ```
  */
 export function toMermaid(workflow, options = {}) {
-    const { state = {}, trace, direction = "TB", title } = options;
+    const { state = {}, trace, direction = "TB", title, classDefs = {} } = options;
     const lines = [];
     if (title) {
         lines.push("---");
@@ -131,10 +131,15 @@ export function toMermaid(workflow, options = {}) {
     const statusNodes = groupByStatus(state);
     if (statusNodes.size > 0) {
         lines.push("");
-        lines.push("    classDef current fill:#3b82f6,stroke:#2563eb,color:#fff,stroke-width:2px");
-        lines.push("    classDef success fill:#22c55e,stroke:#16a34a,color:#fff,stroke-width:2px");
-        lines.push("    classDef failed fill:#ef4444,stroke:#dc2626,color:#fff,stroke-width:2px");
-        lines.push("    classDef skipped fill:#6b7280,stroke:#4b5563,color:#fff,stroke-dasharray:5 5");
+        const defaults = {
+            current: "fill:#3b82f6,stroke:#2563eb,color:#fff,stroke-width:2px",
+            success: "fill:#22c55e,stroke:#16a34a,color:#fff,stroke-width:2px",
+            failed: "fill:#ef4444,stroke:#dc2626,color:#fff,stroke-width:2px",
+            skipped: "fill:#6b7280,stroke:#4b5563,color:#fff,stroke-dasharray:5 5",
+        };
+        for (const status of ["current", "success", "failed", "skipped"]) {
+            lines.push(`    classDef ${status} ${classDefs[status] ?? defaults[status]}`);
+        }
         for (const [status, ids] of statusNodes) {
             const sanitized = ids.map(aliasFor).join(",");
             lines.push(`    class ${sanitized} ${status}`);