@sweny-ai/core 0.1.136 → 0.1.138

package/dist/harness/tool-bridge/server.js

@@ -0,0 +1,189 @@
+/**
+ * SwenyToolBridge server (#414): the sweny side of the bridge.
+ *
+ * Holds a node's skill `Tool[]` in the sweny process and serves them over a
+ * per-run unix socket to the stdio MCP shim (`sweny tool-bridge`), so any
+ * harness that speaks stdio MCP gets skill tools while the handlers, and the
+ * executor's tool:call / tool:result observation, stay in sweny.
+ *
+ * Security properties (this is an injection boundary):
+ * - The socket lives in a fresh `mkdtemp` directory (mode 0700) and is itself
+ *   chmod 0600, so other users cannot connect.
+ * - A random 256-bit token is required on every frame. A wrong or missing
+ *   token gets an `unauthorized` error and the connection is dropped.
+ * - Only the tools passed in are listed or callable. The executor has already
+ *   applied the node's allow/deny filter and the dry-run read-only filter, so
+ *   the bridge can never widen what the node sees.
+ * - Tool results use the same MCP content and `isError` status as the
+ *   in-process path (`callToolAsMcp`).
+ * - `close()` removes the socket and its directory; a process `exit` hook
+ *   and SIGINT/SIGTERM handlers do the same if the run crashes first.
+ * - Nothing here logs the tool list, tool arguments or results.
+ */
+import * as fs from "node:fs";
+import * as net from "node:net";
+import * as os from "node:os";
+import * as path from "node:path";
+import { randomBytes } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { TOKEN_ENV, callToolAsMcp, createFrameReader, encodeFrame, parseRequest, tokenMatches, } from "./protocol.js";
+// ─── Crash cleanup ───────────────────────────────────────────────
+/** Directories of bridges that are still open, removed synchronously on exit or signal. */
+const liveDirs = new Set();
+let hooksInstalled = false;
+function removeDirSync(dir) {
+    try {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    catch {
+        // Best effort: the process is going down.
+    }
+}
+function cleanupAllSync() {
+    for (const dir of liveDirs)
+        removeDirSync(dir);
+    liveDirs.clear();
+}
+function onSignal(signal) {
+    cleanupAllSync();
+    // Keep default signal semantics: if nobody else handles it, re-raise so the
+    // process still dies with the signal.
+    process.removeListener("exit", cleanupAllSync);
+    process.removeListener("SIGINT", onSignal);
+    process.removeListener("SIGTERM", onSignal);
+    hooksInstalled = false;
+    if (process.listenerCount(signal) === 0)
+        process.kill(process.pid, signal);
+}
+function installCrashHooks() {
+    if (hooksInstalled)
+        return;
+    hooksInstalled = true;
+    // `exit` also fires after an uncaught exception, before the process ends.
+    process.on("exit", cleanupAllSync);
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
+}
+function uninstallCrashHooksIfIdle() {
+    if (!hooksInstalled || liveDirs.size > 0)
+        return;
+    hooksInstalled = false;
+    process.removeListener("exit", cleanupAllSync);
+    process.removeListener("SIGINT", onSignal);
+    process.removeListener("SIGTERM", onSignal);
+}
+// ─── Server ──────────────────────────────────────────────────────
+/** Default shim command: the sweny CLI that ships next to this module. */
+export function defaultShimCommand() {
+    const cli = fileURLToPath(new URL("../../cli/main.js", import.meta.url));
+    return { command: process.execPath, args: [cli, "tool-bridge"] };
+}
+function describeTool(t) {
+    return {
+        name: t.name,
+        description: t.description,
+        inputSchema: { type: "object", ...t.input_schema },
+    };
+}
+/** Start a bridge for one node run. Call `close()` when the run ends. */
+export async function startToolBridge(opts) {
+    const { tools, context, logger } = opts;
+    const byName = new Map(tools.map((t) => [t.name, t]));
+    const descriptors = tools.map(describeTool);
+    // mkdtemp creates the directory with mode 0700.
+    const dir = fs.mkdtempSync(path.join(opts.tmpDir ?? os.tmpdir(), "sweny-tb-"));
+    fs.chmodSync(dir, 0o700);
+    const socketPath = path.join(dir, "b.sock");
+    const token = randomBytes(32).toString("hex");
+    liveDirs.add(dir);
+    installCrashHooks();
+    const sockets = new Set();
+    const server = net.createServer((sock) => {
+        sockets.add(sock);
+        sock.on("close", () => sockets.delete(sock));
+        sock.on("error", () => sock.destroy());
+        // Set on the first bad token: later frames on this connection, even ones
+        // already buffered in the same chunk, are ignored.
+        let rejected = false;
+        const send = (res) => {
+            if (!sock.destroyed && sock.writable)
+                sock.write(encodeFrame(res));
+        };
+        const read = createFrameReader((value) => {
+            if (rejected)
+                return;
+            const req = parseRequest(value);
+            const id = req?.id ?? -1;
+            // Token first: an unauthenticated peer learns nothing else.
+            if (!tokenMatches(token, value?.token)) {
+                logger?.warn("tool bridge: rejected a request with a bad token");
+                send({ id, ok: false, error: { code: "unauthorized", message: "unauthorized" } });
+                rejected = true;
+                sock.end();
+                setTimeout(() => sock.destroy(), 1000).unref();
+                return;
+            }
+            if (!req) {
+                send({ id, ok: false, error: { code: "bad_request", message: "malformed request" } });
+                return;
+            }
+            if (req.method === "tools/list") {
+                send({ id, ok: true, result: { tools: descriptors } });
+                return;
+            }
+            const name = req.params?.name;
+            const tool = typeof name === "string" ? byName.get(name) : undefined;
+            if (!tool) {
+                send({ id, ok: false, error: { code: "unknown_tool", message: `unknown tool: ${String(name)}` } });
+                return;
+            }
+            callToolAsMcp(tool, req.params?.arguments, context).then((result) => send({ id, ok: true, result }), () => send({ id, ok: false, error: { code: "internal", message: "tool call failed" } }));
+        }, () => {
+            send({ id: -1, ok: false, error: { code: "bad_request", message: "frame too large" } });
+            sock.destroy();
+        });
+        sock.on("data", read);
+    });
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(socketPath, () => {
+                server.removeListener("error", reject);
+                resolve();
+            });
+        });
+        fs.chmodSync(socketPath, 0o600);
+    }
+    catch (err) {
+        server.close();
+        liveDirs.delete(dir);
+        removeDirSync(dir);
+        uninstallCrashHooksIfIdle();
+        throw err;
+    }
+    logger?.debug("tool bridge: listening");
+    const shim = opts.shimCommand ?? defaultShimCommand();
+    let closed = false;
+    return {
+        socketPath,
+        token,
+        mcpServer: {
+            type: "stdio",
+            command: shim.command,
+            args: [...shim.args, "--socket", socketPath],
+            // No update-check nudge in the shim: its stdio belongs to MCP.
+            env: { [TOKEN_ENV]: token, SWENY_NO_UPDATE_CHECK: "1" },
+        },
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            for (const s of sockets)
+                s.destroy();
+            await new Promise((resolve) => server.close(() => resolve()));
+            liveDirs.delete(dir);
+            removeDirSync(dir);
+            uninstallCrashHooksIfIdle();
+        },
+    };
+}

package/dist/harness/tool-bridge/shim.d.ts

@@ -0,0 +1,38 @@
+/**
+ * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`.
+ *
+ * A stdio MCP server a harness starts as a child process. It holds no tools
+ * of its own: `tools/list` and `tools/call` are forwarded over the per-run
+ * unix socket to the sweny process (server.ts), which runs the real handlers.
+ *
+ * stdout carries MCP only; diagnostics go to stderr. The token comes from
+ * `--token` or, by default, the `SWENY_TOOL_BRIDGE_TOKEN` env var the server
+ * puts in the MCP server config, so it never shows up in `ps` output.
+ */
+import { type BridgeMethod, type BridgeResponse } from "./protocol.js";
+/** Socket client that multiplexes requests by id over one connection. */
+export declare class BridgeClient {
+    private readonly socketPath;
+    private readonly token;
+    private sock;
+    private connecting;
+    private nextId;
+    private pending;
+    private closedError;
+    constructor(socketPath: string, token: string);
+    private connect;
+    private failAll;
+    request(method: BridgeMethod, params?: {
+        name: string;
+        arguments?: Record<string, unknown>;
+    }): Promise<BridgeResponse>;
+    close(): void;
+}
+export interface ShimOptions {
+    socket: string;
+    /** Falls back to `SWENY_TOOL_BRIDGE_TOKEN`. */
+    token?: string;
+    version?: string;
+}
+/** Run the stdio MCP shim until stdin closes or the bridge goes away. */
+export declare function runToolBridgeShim(opts: ShimOptions): Promise<void>;

package/dist/harness/tool-bridge/shim.js

@@ -0,0 +1,125 @@
+/**
+ * SwenyToolBridge shim (#414): `sweny tool-bridge --socket <path>`.
+ *
+ * A stdio MCP server a harness starts as a child process. It holds no tools
+ * of its own: `tools/list` and `tools/call` are forwarded over the per-run
+ * unix socket to the sweny process (server.ts), which runs the real handlers.
+ *
+ * stdout carries MCP only; diagnostics go to stderr. The token comes from
+ * `--token` or, by default, the `SWENY_TOOL_BRIDGE_TOKEN` env var the server
+ * puts in the MCP server config, so it never shows up in `ps` output.
+ */
+import * as net from "node:net";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { BRIDGE_PROTOCOL_VERSION, TOKEN_ENV, createFrameReader, encodeFrame, } from "./protocol.js";
+/** Socket client that multiplexes requests by id over one connection. */
+export class BridgeClient {
+    socketPath;
+    token;
+    sock;
+    connecting;
+    nextId = 1;
+    pending = new Map();
+    closedError;
+    constructor(socketPath, token) {
+        this.socketPath = socketPath;
+        this.token = token;
+    }
+    connect() {
+        // Once the connection is gone (bad token, server closed) every later call fails fast.
+        if (this.closedError)
+            return Promise.reject(this.closedError);
+        if (this.sock)
+            return Promise.resolve(this.sock);
+        this.connecting ??= new Promise((resolve, reject) => {
+            const sock = net.createConnection(this.socketPath);
+            const read = createFrameReader((value) => {
+                const res = value;
+                if (!res || typeof res.id !== "number")
+                    return;
+                const waiter = this.pending.get(res.id);
+                if (waiter) {
+                    this.pending.delete(res.id);
+                    waiter.resolve(res);
+                }
+                else if (res.ok === false) {
+                    // Unsolicited error (for example a frame-size rejection): fail everything.
+                    this.failAll(new Error(`tool bridge: ${res.error.message}`));
+                }
+            }, () => this.failAll(new Error("tool bridge: response frame too large")));
+            sock.on("data", read);
+            sock.once("connect", () => {
+                this.sock = sock;
+                resolve(sock);
+            });
+            sock.once("error", (err) => {
+                reject(err);
+                this.failAll(err);
+            });
+            sock.once("close", () => this.failAll(new Error("tool bridge: connection closed")));
+        });
+        return this.connecting;
+    }
+    failAll(err) {
+        this.closedError ??= err;
+        for (const w of this.pending.values())
+            w.reject(err);
+        this.pending.clear();
+        this.sock?.destroy();
+        this.sock = undefined;
+    }
+    async request(method, params) {
+        const sock = await this.connect();
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            if (this.closedError || sock.destroyed) {
+                reject(this.closedError ?? new Error("tool bridge: connection closed"));
+                return;
+            }
+            this.pending.set(id, { resolve, reject });
+            sock.write(encodeFrame({ v: BRIDGE_PROTOCOL_VERSION, id, token: this.token, method, params }));
+        });
+    }
+    close() {
+        this.sock?.destroy();
+    }
+}
+/** Run the stdio MCP shim until stdin closes or the bridge goes away. */
+export async function runToolBridgeShim(opts) {
+    const token = opts.token ?? process.env[TOKEN_ENV];
+    if (!opts.socket || !token) {
+        process.stderr.write(`sweny tool-bridge: --socket and a token (--token or ${TOKEN_ENV}) are required\n`);
+        process.exit(2);
+    }
+    // Keep the token out of anything the shim might spawn or report.
+    delete process.env[TOKEN_ENV];
+    const client = new BridgeClient(opts.socket, token);
+    const server = new Server({ name: "sweny-core", version: opts.version ?? "0.0.0" }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async () => {
+        const res = await client.request("tools/list");
+        if (!res.ok)
+            throw new Error(`tool bridge: ${res.error.message}`);
+        return { tools: res.result.tools };
+    });
+    server.setRequestHandler(CallToolRequestSchema, async (req) => {
+        const res = await client.request("tools/call", {
+            name: req.params.name,
+            arguments: req.params.arguments,
+        });
+        if (!res.ok) {
+            // Unknown tool and friends surface as a tool error result, the same way
+            // the in-process SDK server reports a call it cannot serve.
+            return { content: [{ type: "text", text: `Error: ${res.error.message}` }], isError: true };
+        }
+        return res.result;
+    });
+    const shutdown = () => {
+        client.close();
+        void server.close().finally(() => process.exit(0));
+    };
+    process.stdin.once("end", shutdown);
+    process.stdin.once("close", shutdown);
+    await server.connect(new StdioServerTransport());
+}

package/dist/skills/github.js

@@ -266,6 +266,79 @@ export const github = {
                 return data;
             },
         },
+        {
+            name: "github_list_pr_files",
+            access: "read",
+            description: "List the files changed in a pull request with per-file status and line counts (no patch bodies). " +
+                "Use it to size a change and spot risky paths without reading the whole diff.",
+            input_schema: {
+                type: "object",
+                properties: {
+                    repo: { type: "string", description: "owner/repo" },
+                    number: { type: "number", description: "Pull request number" },
+                },
+                required: ["repo", "number"],
+            },
+            handler: async (input, ctx) => {
+                const files = (await gh(`/repos/${input.repo}/pulls/${input.number}/files?per_page=100`, ctx));
+                return {
+                    count: files.length,
+                    truncated: files.length >= 100,
+                    files: files.map((f) => ({
+                        filename: f.filename,
+                        status: f.status,
+                        additions: f.additions,
+                        deletions: f.deletions,
+                        changes: f.changes,
+                    })),
+                };
+            },
+        },
+        {
+            name: "github_list_dependabot_alerts",
+            access: "read",
+            description: "List open Dependabot security alerts for a repository (package, severity, advisory id, patched version). " +
+                "Needs a token with Dependabot alerts read access; the built-in Actions GITHUB_TOKEN does not have it. " +
+                "Returns { unavailable: true } instead of throwing when alerts cannot be read.",
+            input_schema: {
+                type: "object",
+                properties: {
+                    repo: { type: "string", description: "owner/repo" },
+                    severity: { type: "string", description: "Optional filter: low, medium, high, or critical" },
+                },
+                required: ["repo"],
+            },
+            handler: async (input, ctx) => {
+                const sev = input.severity ? `&severity=${encodeURIComponent(input.severity)}` : "";
+                let alerts;
+                try {
+                    alerts = (await gh(`/repos/${input.repo}/dependabot/alerts?state=open&per_page=50${sev}`, ctx));
+                }
+                catch (err) {
+                    if (err instanceof GitHubApiError && (err.status === 403 || err.status === 404)) {
+                        return { unavailable: true, status: err.status, alerts: [] };
+                    }
+                    throw err;
+                }
+                return {
+                    unavailable: false,
+                    count: alerts.length,
+                    alerts: alerts.map((a) => ({
+                        number: a.number,
+                        package: a.dependency?.package?.name,
+                        ecosystem: a.dependency?.package?.ecosystem,
+                        manifest: a.dependency?.manifest_path,
+                        severity: a.security_advisory?.severity,
+                        ghsa_id: a.security_advisory?.ghsa_id,
+                        cve_id: a.security_advisory?.cve_id,
+                        summary: a.security_advisory?.summary,
+                        vulnerable_range: a.security_vulnerability?.vulnerable_version_range,
+                        patched_version: a.security_vulnerability?.first_patched_version?.identifier ?? null,
+                        url: a.html_url,
+                    })),
+                };
+            },
+        },
     ],
     // Equivalent tool names on GitHub's official MCP server
     // (github.com/github/github-mcp-server). Aliases declared for every

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.136",
+  "version": "0.1.138",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"
@@ -59,6 +59,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.220",
     "@clack/prompts": "^1.7.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "chalk": "^5",
     "commander": "^13",
     "yaml": "^2.9.0",