@sweny-ai/core 0.1.125 → 0.1.126

package/dist/agent-env.d.ts

@@ -58,11 +58,48 @@ export interface BuildAgentEnvOpts {
 export declare function resolveEnvScope(env: Record<string, string | undefined>, explicit?: boolean, logger?: Pick<Logger, "warn">): boolean;
 /** Max names listed in the withheld-vars warning before "and N more". */
 export declare const WITHHELD_WARNING_CAP = 30;
+/**
+ * Runner baseline: exact names set by common CI images (GitHub-hosted runner
+ * image, Actions runner context, Debian-based containers). They are present on
+ * every run, so listing them as "withheld" is noise. Names only; none of these
+ * is a credential the operator supplied. Secrets such as `GITHUB_TOKEN`,
+ * `NPM_TOKEN`, or `AWS_*` are deliberately absent, so withholding them still
+ * warns.
+ */
+export declare const RUNNER_BASELINE_VARS: ReadonlySet<string>;
+/**
+ * Runner baseline: name patterns for families the CI images set in bulk
+ * (Actions runner internals, Android/Java/.NET/Go/Python toolchains, browsers
+ * and webdrivers, Azure CLI, vcpkg, ghcup, ...). `AWS_*`, `NPM_*` and
+ * `GITHUB_TOKEN`-style names are intentionally not matched.
+ */
+export declare const RUNNER_BASELINE_PATTERNS: readonly RegExp[];
+/** True when `name` is set by the CI image itself, not by the workflow author. */
+export declare function isRunnerBaselineVar(name: string): boolean;
+/** Split withheld names into the runner baseline and everything else. */
+export declare function classifyWithheld(withheld: readonly string[]): {
+    baseline: string[];
+    other: string[];
+};
 /**
  * One-line warning naming the withheld variables. Names only, never values;
  * sorted; capped at {@link WITHHELD_WARNING_CAP}.
  */
 export declare function formatWithheldWarning(withheld: readonly string[]): string;
+/** Plain-log summary: counts only, no names. */
+export declare function formatScopeSummary(total: number, baseline: number): string;
+/** Test seam: forget that the withheld notice was already emitted. */
+export declare function resetWithheldReport(): void;
+/**
+ * Report withheld env names, once per process (not per node or per client).
+ *
+ * - always: one plain `info` line with counts (not a `::warning::` annotation);
+ * - only when non-baseline names were withheld: a `warn` listing just those
+ *   (capped), as a `::warning title=SWEny agent env::` annotation under GitHub
+ *   Actions;
+ * - `debug` (shown with `--verbose`): every withheld name.
+ */
+export declare function reportWithheldEnv(withheld: readonly string[], logger: Pick<Logger, "info" | "warn" | "debug">, env?: Record<string, string | undefined>): void;
 /**
  * Scope the agent env and report which variable names were withheld.
  * `withheld` holds names only; values never leave `source`.

package/dist/agent-env.js

@@ -159,6 +159,100 @@ export function resolveEnvScope(env, explicit, logger) {
 }
 /** Max names listed in the withheld-vars warning before "and N more". */
 export const WITHHELD_WARNING_CAP = 30;
+/**
+ * Runner baseline: exact names set by common CI images (GitHub-hosted runner
+ * image, Actions runner context, Debian-based containers). They are present on
+ * every run, so listing them as "withheld" is noise. Names only; none of these
+ * is a credential the operator supplied. Secrets such as `GITHUB_TOKEN`,
+ * `NPM_TOKEN`, or `AWS_*` are deliberately absent, so withholding them still
+ * warns.
+ */
+export const RUNNER_BASELINE_VARS = new Set([
+    // image / OS
+    "ImageOS",
+    "ImageVersion",
+    "ACCEPT_EULA",
+    "DEBIAN_FRONTEND",
+    "AGENT_TOOLSDIRECTORY",
+    "CONDA",
+    "SWIFT_PATH",
+    "LEIN_HOME",
+    "LEIN_JAR",
+    "ANT_HOME",
+    "GRADLE_HOME",
+    "M2_HOME",
+    "SELENIUM_JAR_PATH",
+    "ENABLE_RUNNER_TRACING",
+    "INVOCATION_ID",
+    "JOURNAL_STREAM",
+    "SYSTEMD_EXEC_PID",
+    "MANAGERPID",
+    "OLDPWD",
+    "PWD",
+    "SHLVL",
+    "_",
+    // GitHub Actions context (never GITHUB_TOKEN)
+    "GITHUB_ACTION",
+    "GITHUB_ACTION_PATH",
+    "GITHUB_ACTION_REF",
+    "GITHUB_ACTION_REPOSITORY",
+    "GITHUB_ACTOR",
+    "GITHUB_ACTOR_ID",
+    "GITHUB_ENV",
+    "GITHUB_EVENT_PATH",
+    "GITHUB_GRAPHQL_URL",
+    "GITHUB_JOB",
+    "GITHUB_OUTPUT",
+    "GITHUB_PATH",
+    "GITHUB_REF_PROTECTED",
+    "GITHUB_REF_TYPE",
+    "GITHUB_REPOSITORY_ID",
+    "GITHUB_REPOSITORY_OWNER_ID",
+    "GITHUB_RETENTION_DAYS",
+    "GITHUB_RUN_ATTEMPT",
+    "GITHUB_STATE",
+    "GITHUB_STEP_SUMMARY",
+    "GITHUB_TRIGGERING_ACTOR",
+    "GITHUB_WORKFLOW",
+    "GITHUB_WORKFLOW_REF",
+    "GITHUB_WORKFLOW_SHA",
+]);
+/**
+ * Runner baseline: name patterns for families the CI images set in bulk
+ * (Actions runner internals, Android/Java/.NET/Go/Python toolchains, browsers
+ * and webdrivers, Azure CLI, vcpkg, ghcup, ...). `AWS_*`, `NPM_*` and
+ * `GITHUB_TOKEN`-style names are intentionally not matched.
+ */
+export const RUNNER_BASELINE_PATTERNS = [
+    /^ACTIONS_/,
+    /^RUNNER_/,
+    /^ANDROID_/,
+    /^JAVA_HOME(_|$)/,
+    /^CHROME/,
+    /WEBDRIVER$/,
+    /^DOTNET_/,
+    /^GOROOT(_|$)/,
+    /^PIPX_/,
+    /^POWERSHELL_/,
+    /^VCPKG_/,
+    /^GHCUP_/,
+    /^BOOTSTRAP_HASKELL_/,
+    /^AZURE_(EXTENSION_DIR|HTTP_USER_AGENT|CONFIG_DIR)$/,
+    /^HOMEBREW_/,
+    /^STATS_/,
+];
+/** True when `name` is set by the CI image itself, not by the workflow author. */
+export function isRunnerBaselineVar(name) {
+    return RUNNER_BASELINE_VARS.has(name) || RUNNER_BASELINE_PATTERNS.some((re) => re.test(name));
+}
+/** Split withheld names into the runner baseline and everything else. */
+export function classifyWithheld(withheld) {
+    const baseline = [];
+    const other = [];
+    for (const n of withheld)
+        (isRunnerBaselineVar(n) ? baseline : other).push(n);
+    return { baseline: baseline.sort(), other: other.sort() };
+}
 /**
  * One-line warning naming the withheld variables. Names only, never values;
  * sorted; capped at {@link WITHHELD_WARNING_CAP}.
@@ -171,6 +265,37 @@ export function formatWithheldWarning(withheld) {
         `If a node's commands need any of them, add the names to env-passthrough ` +
         `(SWENY_ENV_PASSTHROUGH), or set env-scope: off (SWENY_ENV_SCOPE=off).`);
 }
+/** Plain-log summary: counts only, no names. */
+export function formatScopeSummary(total, baseline) {
+    return (`sweny: agent env scoped (${total} withheld, ${baseline} from the CI image). ` +
+        `Add names to env-passthrough if a node needs them; --verbose lists them.`);
+}
+let withheldReported = false;
+/** Test seam: forget that the withheld notice was already emitted. */
+export function resetWithheldReport() {
+    withheldReported = false;
+}
+/**
+ * Report withheld env names, once per process (not per node or per client).
+ *
+ * - always: one plain `info` line with counts (not a `::warning::` annotation);
+ * - only when non-baseline names were withheld: a `warn` listing just those
+ *   (capped), as a `::warning title=SWEny agent env::` annotation under GitHub
+ *   Actions;
+ * - `debug` (shown with `--verbose`): every withheld name.
+ */
+export function reportWithheldEnv(withheld, logger, env = process.env) {
+    if (withheld.length === 0 || withheldReported)
+        return;
+    withheldReported = true;
+    const { baseline, other } = classifyWithheld(withheld);
+    logger.info(formatScopeSummary(withheld.length, baseline.length));
+    if (other.length > 0) {
+        const prefix = env.GITHUB_ACTIONS === "true" ? "::warning title=SWEny agent env::" : "";
+        logger.warn(`${prefix}${formatWithheldWarning(other)}`);
+    }
+    logger.debug(`sweny: agent env withheld: ${[...withheld].sort().join(", ")}`);
+}
 /**
  * Scope the agent env and report which variable names were withheld.
  * `withheld` holds names only; values never leave `source`.

package/dist/claude.d.ts

@@ -129,7 +129,6 @@ export declare class ClaudeClient implements Claude {
     private sandboxProbe;
     private sandboxWarned;
     private envScope;
-    private envWarned;
     constructor(opts?: ClaudeClientOptions);
     /**
      * Build env for the Claude Code subprocess (#360). Applies auth precedence
@@ -137,8 +136,8 @@ export declare class ClaudeClient implements Claude {
      * `SWENY_AUTH`). When env scoping is on (default in CI, see
      * {@link resolveEnvScope}) the result is narrowed to the allowlist plus
      * `extraVars` (the node's declared skill env vars) and the operator
-     * passthrough list, and the withheld names (never values) are warned once
-     * per client. When off, the full env passes through as before.
+     * passthrough list, and the withheld names (never values) are reported once
+     * per process ({@link reportWithheldEnv}). When off, the full env passes through as before.
      */
     private buildEnv;
     run(opts: {

package/dist/claude.js

@@ -11,7 +11,7 @@
 import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude-agent-sdk";
 import { z } from "zod";
 import { consoleLogger } from "./types.js";
-import { formatWithheldWarning, parseList, resolveEnvScope, scopeAgentEnv, resolveAgentSandbox, } from "./agent-env.js";
+import { reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, resolveAgentSandbox, } from "./agent-env.js";
 import { fenceUntrustedJson } from "./untrusted.js";
 const SYSTEM_PROMPT = `You are a step in an automated workflow. Execute the instruction precisely using the tools available to you. Be thorough but concise. When you're done, summarize your findings and results.`;
 /**
@@ -217,7 +217,6 @@ export class ClaudeClient {
     sandboxProbe;
     sandboxWarned = false;
     envScope;
-    envWarned = false;
     constructor(opts = {}) {
         this.model = opts.model;
         this.maxTurns = opts.maxTurns ?? 20;
@@ -237,8 +236,8 @@ export class ClaudeClient {
      * `SWENY_AUTH`). When env scoping is on (default in CI, see
      * {@link resolveEnvScope}) the result is narrowed to the allowlist plus
      * `extraVars` (the node's declared skill env vars) and the operator
-     * passthrough list, and the withheld names (never values) are warned once
-     * per client. When off, the full env passes through as before.
+     * passthrough list, and the withheld names (never values) are reported once
+     * per process ({@link reportWithheldEnv}). When off, the full env passes through as before.
      */
     buildEnv(extraVars = []) {
         const full = Object.fromEntries(Object.entries(process.env).filter((e) => e[1] != null));
@@ -250,11 +249,7 @@ export class ClaudeClient {
             passthrough: this.envPassthrough ?? parseList(process.env.SWENY_ENV_PASSTHROUGH),
             logger: this.logger,
         });
-        if (withheld.length > 0 && !this.envWarned) {
-            this.envWarned = true;
-            const prefix = process.env.GITHUB_ACTIONS === "true" ? "::warning title=SWEny agent env::" : "";
-            this.logger.warn(`${prefix}${formatWithheldWarning(withheld)}`);
-        }
+        reportWithheldEnv(withheld, this.logger);
         return env;
     }
     async run(opts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.125",
+  "version": "0.1.126",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"