@sweny-ai/core 0.1.133 → 0.1.135

package/dist/cli/e2e.js

@@ -10,7 +10,7 @@ import * as p from "@clack/prompts";
 import chalk from "chalk";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { execute } from "../executor.js";
-import { ClaudeClient } from "../claude.js";
+import { createHarness } from "../harness/index.js";
 import { createSkillMap } from "../skills/index.js";
 import { configuredSkills } from "../skills/custom-loader.js";
 import { consoleLogger } from "../types.js";
@@ -906,7 +906,7 @@ export async function runE2eRun(options) {
         }
         // Build skills + Claude client
         const skills = createSkillMap(configuredSkills(process.env, cwd));
-        const claude = new ClaudeClient({
+        const claude = createHarness("claude-code", {
             maxTurns: 80,
             cwd,
             logger: consoleLogger,

package/dist/cli/main.js

@@ -9,7 +9,7 @@ import chalk from "chalk";
 import { execute } from "../executor.js";
 import { triageWorkflow, implementWorkflow, seedContentWorkflow } from "../workflows/index.js";
 import { consoleLogger } from "../types.js";
-import { ClaudeClient } from "../claude.js";
+import { createHarness } from "../harness/index.js";
 import { builtinSkills, createSkillMap, validateWorkflowSkills } from "../skills/index.js";
 import { formatMissingSkillLines, skillEnvWarnings } from "./skill-env.js";
 import { configuredSkills, configuredSkillsWithDiagnostics } from "../skills/custom-loader.js";
@@ -203,7 +203,7 @@ triageCmd.action(async (options) => {
     const skills = createSkillMap(triageSkillDiscovery.skills);
     const mcpAutoConfig = buildMcpAutoConfig(config);
     const mcpServers = buildAutoMcpServers(mcpAutoConfig);
-    const claude = new ClaudeClient({
+    const claude = createHarness("claude-code", {
         maxTurns: config.maxInvestigateTurns || 50,
         cwd: process.cwd(),
         logger: consoleLogger,
@@ -380,7 +380,7 @@ triageCmd.action(async (options) => {
     try {
         const { results, trace } = await execute(triageWorkflow, workflowInput, {
             skills,
-            claude,
+            harness: claude,
             observer,
             logger: consoleLogger,
             cwd: process.cwd(),
@@ -513,7 +513,7 @@ implementCmd.action(async (issueId, options) => {
     const skills = createSkillMap(implementSkillDiscovery.skills);
     const mcpAutoConfig = buildMcpAutoConfig(config);
     const mcpServers = buildAutoMcpServers(mcpAutoConfig);
-    const claude = new ClaudeClient({
+    const claude = createHarness("claude-code", {
         maxTurns: config.maxImplementTurns || 40,
         cwd: process.cwd(),
         logger: consoleLogger,
@@ -584,7 +584,7 @@ implementCmd.action(async (issueId, options) => {
     try {
         const { results } = await execute(implementWorkflow, workflowInput, {
             skills,
-            claude,
+            harness: claude,
             observer,
             logger: consoleLogger,
             cwd: process.cwd(),
@@ -757,7 +757,7 @@ export async function workflowRunAction(file, options) {
     });
     // Raw [info]/[debug] lines are verbose-only; warnings are rendered (#383).
     const runLogger = createRunLogger({ verbose: Boolean(options.verbose), tty: isTTY });
-    const claude = new ClaudeClient({
+    const claude = createHarness("claude-code", {
         maxTurns: config.maxInvestigateTurns || 50,
         cwd: process.cwd(),
         logger: runLogger,
@@ -926,7 +926,7 @@ export async function workflowRunAction(file, options) {
     try {
         const { results, trace } = await runWithWallClockBudget((signal) => execute(workflow, workflowInput, {
             skills,
-            claude,
+            harness: claude,
             observer,
             logger: runLogger,
             cwd: process.cwd(),
@@ -1101,7 +1101,7 @@ workflowCmd
         console.warn("\x1B[33m  ⚠  `sweny workflow create` is deprecated. Use `sweny new` instead.\x1B[0m\n");
     }
     const skills = configuredSkills();
-    const claude = new ClaudeClient({
+    const claude = createHarness("claude-code", {
         maxTurns: 3,
         cwd: process.cwd(),
         logger: consoleLogger,
@@ -1168,7 +1168,7 @@ workflowCmd
         return;
     }
     const skills = configuredSkills();
-    const claude = new ClaudeClient({
+    const claude = createHarness("claude-code", {
         maxTurns: 3,
         cwd: process.cwd(),
         logger: consoleLogger,

package/dist/cli/new.js

@@ -14,7 +14,7 @@ import chalk from "chalk";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { WORKFLOW_TEMPLATES } from "./templates.js";
 import { buildWorkflow, refineWorkflow } from "../workflow-builder.js";
-import { ClaudeClient } from "../claude.js";
+import { createHarness } from "../harness/index.js";
 import { consoleLogger } from "../types.js";
 import { configuredSkills } from "../skills/custom-loader.js";
 import { builtinSkills } from "../skills/index.js";
@@ -541,7 +541,7 @@ export async function runNew(options) {
         const { installMarketplaceWorkflow } = await import("./marketplace.js");
         const allSkills = configuredSkills(process.env, cwd);
         const hasAgent = !!process.env.ANTHROPIC_API_KEY;
-        const claude = hasAgent ? new ClaudeClient({ maxTurns: 3, cwd, logger: consoleLogger }) : null;
+        const claude = hasAgent ? createHarness("claude-code", { maxTurns: 3, cwd, logger: consoleLogger }) : null;
         if (!options.skipIntro)
             p.intro(`Installing ${options.marketplaceId} from marketplace`);
         // Pre-compute source-control from git-remote (same method as the wizard path).
@@ -833,7 +833,7 @@ async function runCustomWorkflowBuilder(skills) {
     });
     if (p.isCancel(description))
         return null;
-    const claude = new ClaudeClient({
+    const claude = createHarness("claude-code", {
         maxTurns: 3,
         cwd: process.cwd(),
         logger: consoleLogger,

package/dist/cli/run-history.d.ts

@@ -48,6 +48,11 @@ export interface RunRecord {
         to: string;
     }>;
     totals: RunTotals;
+    /** Harness that ran the nodes (id + version). Absent for runs with no harness-tagged result. */
+    harness?: {
+        id: string;
+        version: string;
+    };
 }
 /** sha256 (hex) of the workflow as canonical JSON: keys sorted, undefined dropped. */
 export declare function hashWorkflow(workflow: Workflow): string;

package/dist/cli/run-history.js

@@ -91,6 +91,7 @@ export function buildRunRecord(i) {
             retries: retries.get(id) ?? 0,
         };
     });
+    const harness = [...i.results.values()].find((r) => r.harness)?.harness;
     return {
         schema_version: RUN_HISTORY_SCHEMA_VERSION,
         run_id: i.runId,
@@ -109,6 +110,7 @@ export function buildRunRecord(i) {
             tokens: summary.tokens ?? null,
             cost_usd: summary.costUsd ?? null,
         },
+        ...(harness ? { harness: { id: harness.id, version: harness.version } } : {}),
     };
 }
 // ── Write, prune, read ──────────────────────────────────────────

package/dist/eval/index.js

@@ -8,7 +8,10 @@ import { evaluateFunctionRule } from "./function.js";
 import { evaluateJudge } from "./judge.js";
 /** Reasoning cap, matching the spec's ~500-character ceiling. */
 const MAX_REASONING_LENGTH = 500;
-/** Default judge model when neither evaluator nor node nor workflow specify one. */
+/**
+ * Judge model when neither evaluator, node, workflow nor the harness names one.
+ * Harnesses declare their own via `defaultJudgeModel` (Claude Code: this value).
+ */
 const DEFAULT_JUDGE_MODEL = "claude-haiku-4-5";
 function capReasoning(reasoning) {
     if (!reasoning)
@@ -17,8 +20,8 @@ function capReasoning(reasoning) {
         return reasoning;
     return reasoning.slice(0, MAX_REASONING_LENGTH - 1) + "…";
 }
-function resolveJudgeModel(evaluator, node, workflow) {
-    return evaluator.model ?? node?.judge_model ?? workflow?.judge_model ?? DEFAULT_JUDGE_MODEL;
+function resolveJudgeModel(evaluator, node, workflow, harnessDefault) {
+    return evaluator.model ?? node?.judge_model ?? workflow?.judge_model ?? harnessDefault ?? DEFAULT_JUDGE_MODEL;
 }
 /**
  * Run every declared evaluator against the node's result and return one
@@ -56,7 +59,7 @@ export async function evaluateAll(evaluators, result, opts = {}) {
             if (!opts.claude) {
                 throw new Error(`evaluator '${e.name}' is kind: judge but no Claude client was provided to evaluateAll`);
             }
-            const model = resolveJudgeModel(e, opts.node, opts.workflow);
+            const model = resolveJudgeModel(e, opts.node, opts.workflow, opts.claude.defaultJudgeModel);
             const verdict = await evaluateJudge(e, result, opts.claude, { model });
             out.push({
                 name: e.name,

package/dist/executor.d.ts

@@ -13,13 +13,22 @@
  * This replaces ~8k lines of engine + recipe step code.
  */
 import type { Workflow, Skill, Tool, Claude, Observer, Logger, ExecutionResult } from "./types.js";
+import type { AgentHarness } from "./harness/types.js";
 export interface ExecuteOptions {
     /** Registered skills (id → Skill) */
     skills: Map<string, Skill>;
     /** Config values — env vars + explicit overrides */
     config?: Record<string, string>;
-    /** Claude client */
-    claude: Claude;
+    /**
+     * The agent harness that runs nodes (`createHarness("claude-code")`).
+     * Required unless the deprecated `claude` option is given.
+     */
+    harness?: AgentHarness;
+    /**
+     * Claude client.
+     * @deprecated Pass `harness`. Still accepted (see `claudeCompat()`); when both are set, `harness` wins.
+     */
+    claude?: Claude;
     /** Event observer for streaming/logging */
     observer?: Observer;
     /** Logger */

package/dist/executor.js

@@ -22,6 +22,7 @@ import { buildToolAliases } from "./skills/index.js";
 import { validateWorkflow } from "./schema.js";
 import { resolveAgentAccess } from "./agent-env.js";
 import { fenceUntrusted } from "./untrusted.js";
+import { asClaude } from "./harness/compat.js";
 /**
  * Default workflow-level step budget. Counts total node executions across the
  * whole run (loop iterations included). Generous enough for legitimate deep
@@ -47,7 +48,12 @@ function throwIfAborted(signal) {
  * - `trace`: full ordered execution trace including loops and routing decisions
  */
 export async function execute(workflow, input, options) {
-    const { claude, observer, signal, timeoutMs } = options;
+    const { observer, signal, timeoutMs } = options;
+    // `harness` is the seam; a legacy `claude` object is used as-is (what `asClaude(claudeCompat(claude))` yields).
+    const claude = options.harness ? asClaude(options.harness) : options.claude;
+    if (!claude) {
+        throw new Error("execute() needs options.harness (or the deprecated options.claude)");
+    }
     // If the caller already aborted before we started, fail fast.
     throwIfAborted(signal);
     const dryRun = isDryRunInput(input);

package/dist/harness/capabilities.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Declared capabilities per adapter. No runtime imports, so the executor can use
+ * them without pulling in an agent SDK.
+ */
+import type { HarnessCapabilities } from "./types.js";
+/** Claude Code enforces every sweny opinion natively, so `policyGate` never degrades or refuses it. */
+export declare const CLAUDE_CODE_CAPABILITIES: HarnessCapabilities;

package/dist/harness/capabilities.js

@@ -0,0 +1,17 @@
+/**
+ * Declared capabilities per adapter. No runtime imports, so the executor can use
+ * them without pulling in an agent SDK.
+ */
+/** Claude Code enforces every sweny opinion natively, so `policyGate` never degrades or refuses it. */
+export const CLAUDE_CODE_CAPABILITIES = {
+    structuredOutput: "native",
+    toolTrace: "full",
+    builtinDeny: "by-name",
+    mcp: { inject: true, exclusive: "native" },
+    sandbox: { fs: true, network: true },
+    readOnly: "native",
+    turnLimit: "native",
+    usage: { tokens: true, costUsd: true, live: false },
+    cancel: "signal",
+    resume: false,
+};

package/dist/harness/claude-code.d.ts

@@ -0,0 +1,228 @@
+/**
+ * Claude Client - Headless Claude Code backend
+ *
+ * Uses the @anthropic-ai/claude-agent-sdk to run headless Claude Code
+ * as the LLM backend. Tools are exposed via an in-process MCP server
+ * that Claude Code calls during execution.
+ *
+ * This is the ONLY supported LLM backend. The whole point of sweny
+ * is to use headless Claude Code - never the raw Anthropic API.
+ */
+import type { Claude, ToolContext, Logger, McpServerConfig } from "../types.js";
+import { type SandboxMode } from "../agent-env.js";
+import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult } from "./types.js";
+import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
+import { buildEvaluatePrompt } from "./prompts.js";
+export { buildEvaluatePrompt, CLAUDE_CODE_CAPABILITIES };
+/**
+ * Built-in tools disallowed for the route-evaluation (`evaluate`) and
+ * reflection/judge (`ask`) calls.
+ *
+ * These are pure classification calls over prior-node data that can be
+ * attacker-influenceable (a prior node summarizes an untrusted issue body,
+ * PR diff, log line, etc.). They must never be able to mutate the workspace
+ * or shell out, regardless of any node's own `disallowed_tools` policy.
+ * `maxTurns: 1` already bounds them; this removes the powerful built-ins
+ * from the model's context entirely as structural defense-in-depth.
+ */
+export declare const CLASSIFICATION_DISALLOWED_TOOLS: readonly ["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit", "WebFetch", "WebSearch"];
+/**
+ * Built-in tools disallowed for a node run with `readOnly: true` (dry run,
+ * #380): everything that can edit the workspace, shell out (and so reach
+ * `gh`, `curl`, `git push`), spawn a subagent that could, or fetch an
+ * arbitrary URL (a GET can still trigger a webhook or exfiltrate data).
+ * Read, Grep, Glob and WebSearch stay available for analysis.
+ */
+export declare const READ_ONLY_DISALLOWED_TOOLS: readonly ["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit", "Task", "Agent", "WebFetch"];
+/** How sweny resolves which credentials reach the Claude Code subprocess. */
+export type SwenyAuthMode = "auto" | "api-key" | "oauth";
+export interface ResolveAuthEnvOpts {
+    /** Explicit override; when absent, read from `env.SWENY_AUTH`. Test seam. */
+    mode?: SwenyAuthMode;
+    /** Logger for the debug line + invalid-value warning. */
+    logger?: Pick<Logger, "debug" | "warn">;
+}
+/**
+ * Decide which auth credentials survive into the Claude Code subprocess env.
+ *
+ * sweny does not select the winning credential (the spawned agent and any
+ * on-disk `~/.claude/.credentials.json` do that). This function only controls
+ * what is *present* in the env we hand the agent.
+ *
+ * Modes (`SWENY_AUTH`, default `auto`):
+ *  - `auto`    - today's protective behavior: when an OAuth token is present,
+ *                strip `ANTHROPIC_API_KEY` so a stray `.env` key cannot
+ *                silently bill a metered API account. `ANTHROPIC_AUTH_TOKEN`
+ *                (a bearer token, not a console key) is never touched.
+ *  - `api-key` - user explicitly authenticates a gateway with a key/bearer:
+ *                preserve both even when an OAuth token is also present.
+ *  - `oauth`   - user explicitly wants subscription/OAuth: strip both
+ *                `ANTHROPIC_API_KEY` and `ANTHROPIC_AUTH_TOKEN` so a leftover
+ *                credential cannot win at the agent. Fails closed.
+ *
+ * Base-URL presence is deliberately NOT a signal here: pass-through proxies
+ * (corporate egress, observability) set `ANTHROPIC_BASE_URL` while still
+ * billing the real key, so inferring "use the key" from a base URL would
+ * re-introduce a surprise-billing path. Intent must be explicit.
+ *
+ * An unrecognized `SWENY_AUTH` value falls back to `auto` with a warning
+ * (never throws - an env typo must not crash a CI run).
+ *
+ * Pure: returns a copy, never mutates the input.
+ */
+export declare function resolveAuthEnv(env: Record<string, string>, opts?: ResolveAuthEnvOpts): Record<string, string>;
+export interface ClaudeCodeHarnessOptions {
+    /** Model override */
+    model?: string;
+    /** Max turns for tool use loop (default: 20) */
+    maxTurns?: number;
+    /** Working directory for Claude Code (default: process.cwd()) */
+    cwd?: string;
+    /** Logger */
+    logger?: Logger;
+    /** Default tool context for standalone usage (not via executor) */
+    defaultContext?: ToolContext;
+    /** Catalog defaults, overridden by per-run skill servers and explicit mcpServers. */
+    defaultMcpServers?: Record<string, McpServerConfig>;
+    /** Explicit external MCP servers, overriding defaults and per-run skill servers. */
+    mcpServers?: Record<string, McpServerConfig>;
+    /**
+     * Extra env var names passed to the agent subprocess on top of the
+     * allowlist (see agent-env.ts). `"*"` inherits the full environment.
+     * Default: `SWENY_ENV_PASSTHROUGH` (comma-separated).
+     */
+    envPassthrough?: string[];
+    /**
+     * Scope the agent env to the allowlist. Default: `SWENY_ENV_SCOPE`, else on
+     * when CI is truthy and off locally (full env).
+     */
+    envScope?: boolean;
+    /**
+     * SDK sandbox for agent commands: `auto` (sandbox when the host supports
+     * it, else warn and run unsandboxed), `strict` (sandbox or fail), `off`.
+     * Default: `SWENY_SANDBOX`, else `auto` when CI is truthy, `off` otherwise.
+     */
+    sandbox?: SandboxMode;
+    /** Extra hosts sandboxed commands may reach. Default: `SWENY_SANDBOX_ALLOWED_DOMAINS`. */
+    sandboxAllowedDomains?: string[];
+    /** Sandbox preflight probe (test seam). Returns a reason when the sandbox cannot run. */
+    sandboxProbe?: () => string | undefined;
+}
+/**
+ * Wire an optional timeout + caller signal onto a single AbortController.
+ *
+ * Returns undefined when neither a timeout nor a signal is supplied so the
+ * default code path (no abortController, no timer) is byte-for-byte unchanged.
+ *
+ * `reason()` reports whether the abort came from the timeout timer or an
+ * external signal, so callers can log a distinct timeout message.
+ */
+export declare function makeAbort(timeoutMs?: number, signal?: AbortSignal): {
+    controller: AbortController;
+    clear: () => void;
+    reason: () => "timeout" | "signal" | undefined;
+} | undefined;
+export declare class ClaudeCodeHarness implements Claude, AgentHarness {
+    readonly id: "claude-code";
+    readonly capabilities: HarnessCapabilities;
+    readonly defaultJudgeModel = "claude-haiku-4-5";
+    private model;
+    private maxTurns;
+    private cwd;
+    readonly logger: Logger;
+    private defaultContext;
+    private mcpServers;
+    private defaultMcpServers;
+    private envPassthrough;
+    private sandboxMode;
+    private sandboxAllowedDomains;
+    private sandboxProbe;
+    private sandboxWarned;
+    private envScope;
+    constructor(opts?: ClaudeCodeHarnessOptions);
+    /**
+     * Build env for the Claude Code subprocess (#360). Applies auth precedence
+     * via {@link resolveAuthEnv} on the full process env (it reads
+     * `SWENY_AUTH`). When env scoping is on (default in CI, see
+     * {@link resolveEnvScope}) the result is narrowed to the allowlist plus
+     * `extraVars` (the node's declared skill env vars) and the operator
+     * passthrough list, and the withheld names (never values) are reported once
+     * per process ({@link reportWithheldEnv}). When off, the full env passes through as before.
+     */
+    private buildEnv;
+    /** Which harness (and SDK version) produced a result. */
+    info(): HarnessInfo;
+    preflight(): Promise<{
+        ok: true;
+        version: string;
+    }>;
+    /**
+     * Run a node. The query itself is unchanged by the harness seam; this only
+     * runs {@link policyGate} (always `degraded: []` for Claude Code) and tags
+     * the result with the harness id and version.
+     */
+    run(req: HarnessRunRequest): Promise<HarnessRunResult>;
+    private runQuery;
+    /**
+     * Single completion: no tools, no MCP, one turn. Shared by core `ask()`
+     * (retry reflection, judge scoring) and `evaluate()` (route choice); the
+     * query options are the ones `ask` and `evaluate` used before the seam.
+     * Returns null when the query failed (SDK error, timeout, non-success
+     * subtype); callers fail closed.
+     */
+    complete(req: HarnessCompleteRequest): Promise<string | null>;
+    /** Route evaluation. Delegates to core {@link coreEvaluate} over {@link complete}. */
+    evaluate(opts: {
+        question: string;
+        context: Record<string, unknown>;
+        choices: {
+            id: string;
+            description: string;
+        }[];
+        /** Abort the query after this many ms. Default: no timeout (back-compat). */
+        timeoutMs?: number;
+        /** Caller-supplied abort signal. Aborting it interrupts the query. */
+        signal?: AbortSignal;
+    }): Promise<string | null>;
+    /** Free-text completion. Delegates to core {@link coreAsk} over {@link complete}. */
+    ask(opts: {
+        instruction: string;
+        context: Record<string, unknown>;
+        model?: string;
+        /** Abort the query after this many ms. Default: no timeout (back-compat). */
+        timeoutMs?: number;
+        /** Caller-supplied abort signal. Aborting it interrupts the query. */
+        signal?: AbortSignal;
+    }): Promise<string>;
+}
+/** @deprecated Use {@link ClaudeCodeHarnessOptions}. */
+export type ClaudeClientOptions = ClaudeCodeHarnessOptions;
+/** @deprecated Use {@link ClaudeCodeHarness} (or `createHarness("claude-code")`). */
+export declare const ClaudeClient: typeof ClaudeCodeHarness;
+/** @deprecated Use {@link ClaudeCodeHarness}. */
+export type ClaudeClient = ClaudeCodeHarness;
+/**
+ * Best-effort recovery of typed output from a tool_result's `content`.
+ *
+ * The MCP protocol sends tool results as string content. Our in-process
+ * wrapper JSON-stringifies structured output before returning; external
+ * MCP servers generally do the same for JSON payloads. If the string
+ * looks like a JSON object or array and parses, return the parsed value
+ * so verify's output-path walks work against typed data.
+ *
+ * Raw strings are preserved verbatim. JSON-primitive strings (e.g. the
+ * literal four characters `"42"`) are intentionally NOT parsed - we
+ * cannot distinguish a tool that returned the number 42 (wrapper sends
+ * `"42"`) from a tool that returned the string "42" (wrapper also sends
+ * `"42"`). Preserving the string is safer than guessing.
+ */
+export declare function parseToolResultContent(content: unknown): unknown;
+/**
+ * Produce a short, single-line description of a tool-error payload suitable
+ * for the CI log stream. The full parsed value stays on the ToolCall for
+ * verify and downstream tooling - this is only for inline observability.
+ *
+ * Collapses newlines, trims whitespace, and caps to 300 chars so a huge
+ * API response body doesn't flood the log.
+ */
+export declare function summarizeToolError(parsed: unknown): string;