@sweny-ai/core 0.1.149 → 0.1.150

package/dist/cli/builtin-workflows.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Bind a built-in workflow (triage, implement) to the providers `sweny triage`
+ * and `sweny implement` run with (#365).
+ *
+ * The bundled YAML is written for the exemplary case: analysis nodes are
+ * `read`, and tracker and PR writes are safe outputs that the github or linear
+ * skill applies after the node. Here the CLI pins each output to the tracker
+ * the user configured (`via`) and to the repository (`target`), so a Linear key
+ * in the environment never redirects a GitHub-issues user's issues, and back.
+ *
+ * Two setups cannot run that way. Each affected node keeps its pre-#365 shape,
+ * and the CLI prints one notice naming the nodes and the reason:
+ *
+ *  - Reads that need the shell or an MCP server (a Jira or GitLab integration,
+ *    an observability provider with no built-in skill, user MCP servers or
+ *    workspace tools). A `read` node has neither, so the analysis nodes run
+ *    write-capable with file edits and every skill write tool denied, as before.
+ *  - Writes no safe-output skill can apply (a Jira or file tracker, GitLab or
+ *    file source control). Those nodes use the tracker's own tools, as before.
+ *
+ * Pure: returns a new workflow, never mutates the input.
+ */
+import type { SafeOutputType, Workflow } from "../types.js";
+export interface BuiltinProviders {
+    /** `github-issues` | `linear` | `jira` | `file` */
+    issueTracker: string;
+    /** `github` | `gitlab` | `file` */
+    sourceControl: string;
+    observability: string[];
+    /** `owner/repo`; pins GitHub outputs. */
+    repository?: string;
+    /** User-configured MCP servers (`SWENY_MCP_SERVERS`). */
+    userMcpServers?: string[];
+    workspaceTools?: string[];
+}
+export interface BoundWorkflow {
+    workflow: Workflow;
+    /** One line per fallback, for the CLI to print. Empty when every node runs as written. */
+    notes: string[];
+}
+/** What a read-only node could not reach for these providers. Empty when it reaches everything. */
+export declare function readGaps(p: BuiltinProviders): string[];
+/** The skill that applies this output type for these providers, or undefined when none can. */
+export declare function outputSkill(type: SafeOutputType, p: BuiltinProviders): string | undefined;
+export declare function bindBuiltinWorkflow(workflow: Workflow, p: BuiltinProviders): BoundWorkflow;

package/dist/cli/builtin-workflows.js

@@ -0,0 +1,129 @@
+/**
+ * Bind a built-in workflow (triage, implement) to the providers `sweny triage`
+ * and `sweny implement` run with (#365).
+ *
+ * The bundled YAML is written for the exemplary case: analysis nodes are
+ * `read`, and tracker and PR writes are safe outputs that the github or linear
+ * skill applies after the node. Here the CLI pins each output to the tracker
+ * the user configured (`via`) and to the repository (`target`), so a Linear key
+ * in the environment never redirects a GitHub-issues user's issues, and back.
+ *
+ * Two setups cannot run that way. Each affected node keeps its pre-#365 shape,
+ * and the CLI prints one notice naming the nodes and the reason:
+ *
+ *  - Reads that need the shell or an MCP server (a Jira or GitLab integration,
+ *    an observability provider with no built-in skill, user MCP servers or
+ *    workspace tools). A `read` node has neither, so the analysis nodes run
+ *    write-capable with file edits and every skill write tool denied, as before.
+ *  - Writes no safe-output skill can apply (a Jira or file tracker, GitLab or
+ *    file source control). Those nodes use the tracker's own tools, as before.
+ *
+ * Pure: returns a new workflow, never mutates the input.
+ */
+import { builtinSkills } from "../skills/index.js";
+import { resolveNodePermissions } from "../node-policy.js";
+/** Observability providers a read-only node can reach: a built-in skill, or a local log file (Read). */
+const SKILL_OBSERVABILITY = new Set(["sentry", "datadog", "betterstack", "file"]);
+/** Trackers whose issues and comments a safe-output skill applies. */
+const TRACKER_SKILL = { "github-issues": "github", linear: "linear" };
+/** Skill write tools a legacy node keeps for each output type it declared. */
+const LEGACY_WRITE_TOOLS = {
+    issue: ["github_create_issue", "linear_create_issue"],
+    // Reopening a closed duplicate goes with the +1 comment.
+    comment: ["github_add_comment", "linear_add_comment", "linear_update_issue"],
+    pr: ["github_create_pr"],
+    label: ["github_add_labels"],
+};
+const writeToolsBySkill = new Map(builtinSkills.map((s) => [s.id, s.tools.filter((t) => t.access !== "read").map((t) => t.name)]));
+function skillWriteTools(node) {
+    return node.skills.flatMap((id) => writeToolsBySkill.get(id) ?? []);
+}
+function union(...lists) {
+    return [...new Set(lists.flatMap((l) => l ?? []))];
+}
+/** What a read-only node could not reach for these providers. Empty when it reaches everything. */
+export function readGaps(p) {
+    const gaps = [];
+    for (const o of p.observability)
+        if (!SKILL_OBSERVABILITY.has(o))
+            gaps.push(o);
+    if (!(p.issueTracker in TRACKER_SKILL) && p.issueTracker !== "file")
+        gaps.push(p.issueTracker);
+    if (p.sourceControl !== "github")
+        gaps.push(`${p.sourceControl} source control`);
+    if ((p.userMcpServers ?? []).length > 0)
+        gaps.push("user MCP servers");
+    if ((p.workspaceTools ?? []).length > 0)
+        gaps.push("workspace tools");
+    return [...new Set(gaps)];
+}
+/** The skill that applies this output type for these providers, or undefined when none can. */
+export function outputSkill(type, p) {
+    if (type === "issue" || type === "comment")
+        return TRACKER_SKILL[p.issueTracker];
+    return p.sourceControl === "github" ? "github" : undefined;
+}
+/** A read node that needs the shell or MCP: write-capable, but no file edits and no skill write tool. */
+function legacyRead(node) {
+    return {
+        ...node,
+        permissions: { access: "write", deny: ["write", "edit"] },
+        tools: { ...(node.tools ?? {}), deny: union(node.tools?.deny, skillWriteTools(node)) },
+    };
+}
+/** An output node whose writes no safe-output skill can apply: the tracker's own tools, as before. */
+function legacyWrite(node) {
+    const { outputs, ...rest } = node;
+    const keep = new Set((outputs ?? []).flatMap((o) => LEGACY_WRITE_TOOLS[o.type]));
+    const deny = union(node.tools?.deny, skillWriteTools(node)).filter((t) => !keep.has(t));
+    const tools = node.tools?.allow
+        ? { allow: node.tools.allow, ...(deny.length > 0 ? { deny } : {}) }
+        : deny.length > 0
+            ? { deny }
+            : undefined;
+    const { tools: _old, ...base } = rest;
+    return { ...base, permissions: "write", ...(tools ? { tools } : {}) };
+}
+function bindOutput(o, p) {
+    const via = o.via ?? outputSkill(o.type, p);
+    const target = o.target ?? (via === "github" && p.repository ? p.repository : undefined);
+    return { ...o, ...(via ? { via } : {}), ...(target ? { target } : {}) };
+}
+export function bindBuiltinWorkflow(workflow, p) {
+    const gaps = readGaps(p);
+    const legacyReads = [];
+    const legacyWrites = [];
+    const unsupported = new Set();
+    const nodes = {};
+    for (const [id, node] of Object.entries(workflow.nodes)) {
+        const outputs = node.outputs ?? [];
+        const access = resolveNodePermissions(node, workflow).access;
+        const missing = outputs.filter((o) => !outputSkill(o.type, p));
+        if (missing.length > 0) {
+            for (const o of missing)
+                unsupported.add(o.type === "pr" || o.type === "label" ? p.sourceControl : p.issueTracker);
+            legacyWrites.push(id);
+            nodes[id] = legacyWrite(node);
+        }
+        else if (outputs.length > 0) {
+            nodes[id] = { ...node, outputs: outputs.map((o) => bindOutput(o, p)) };
+        }
+        else if (access === "read" && gaps.length > 0) {
+            legacyReads.push(id);
+            nodes[id] = legacyRead(node);
+        }
+        else {
+            nodes[id] = node;
+        }
+    }
+    const notes = [];
+    if (legacyReads.length > 0) {
+        notes.push(`${legacyReads.join(", ")} run write-capable (file edits and write tools still denied): ` +
+            `a read-only step cannot reach ${gaps.join(", ")}`);
+    }
+    if (legacyWrites.length > 0) {
+        notes.push(`${legacyWrites.join(", ")} write through the tracker's own tools: ` +
+            `no safe-output skill writes to ${[...unsupported].join(", ")}`);
+    }
+    return { workflow: { ...workflow, nodes }, notes };
+}

package/dist/cli/check.d.ts

@@ -29,15 +29,9 @@ export declare function checkDatadog(creds: Record<string, string>): Promise<Che
 /**
  * Detect a local Claude Code login the way `sweny workflow run` benefits from
  * it: the spawned Claude Code agent finds its own login, so no env credential
- * is needed. Checks `~/.claude/.credentials.json` (or CLAUDE_CONFIG_DIR) and,
- * on macOS, the Keychain entry (attributes only, the secret is never read).
+ * is needed. Lives with the harness login probes (#339); re-exported here.
  */
-export declare function detectClaudeCodeLogin(opts?: {
-    env?: Record<string, string | undefined>;
-    home?: string;
-    platform?: NodeJS.Platform;
-    keychainHasLogin?: () => boolean;
-}): boolean;
+export { detectClaudeCodeLogin } from "../harness/auth.js";
 /**
  * Skill ids used by the workflows in `.sweny/workflows/`. `found` is false when
  * there are no workflow files, in which case callers keep the legacy checks.

package/dist/cli/check.js

@@ -1,7 +1,5 @@
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
-import { spawnSync } from "node:child_process";
 import { parse as parseYaml } from "yaml";
 import { validateInputs } from "./config.js";
 import { findSkillEnvGaps } from "./skill-env.js";
@@ -349,39 +347,9 @@ function networkErrorMessage(err) {
 /**
  * Detect a local Claude Code login the way `sweny workflow run` benefits from
  * it: the spawned Claude Code agent finds its own login, so no env credential
- * is needed. Checks `~/.claude/.credentials.json` (or CLAUDE_CONFIG_DIR) and,
- * on macOS, the Keychain entry (attributes only, the secret is never read).
+ * is needed. Lives with the harness login probes (#339); re-exported here.
  */
-export function detectClaudeCodeLogin(opts = {}) {
-    const env = opts.env ?? process.env;
-    const home = opts.home ?? os.homedir();
-    const platform = opts.platform ?? process.platform;
-    const configDir = env.CLAUDE_CONFIG_DIR || path.join(home, ".claude");
-    try {
-        if (fs.existsSync(path.join(configDir, ".credentials.json")))
-            return true;
-    }
-    catch {
-        // fall through
-    }
-    if (platform === "darwin") {
-        const probe = opts.keychainHasLogin ??
-            (() => {
-                const r = spawnSync("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
-                    stdio: "ignore",
-                    timeout: 3000,
-                });
-                return r.status === 0;
-            });
-        try {
-            return probe();
-        }
-        catch {
-            return false;
-        }
-    }
-    return false;
-}
+export { detectClaudeCodeLogin } from "../harness/auth.js";
 /**
  * Skill ids used by the workflows in `.sweny/workflows/`. `found` is false when
  * there are no workflow files, in which case callers keep the legacy checks.

package/dist/cli/config.js

@@ -23,6 +23,7 @@ export function registerTriageCommand(program) {
         .option("--base-branch <branch>", "Base branch for PRs (default: main)")
         .option("--pr-labels <labels>", "Comma-separated PR labels (default: agent,triage,needs-review)")
         .option("--dry-run", "Analyze only, do not create issues or PRs", false)
+        .option("--stage", "Run normally, but preview the issues, comments and PR instead of filing them; stops before any code is pushed", false)
         .option("--review-mode <mode>", "PR merge behavior: auto (merge when CI passes) | review (human approval, default)", "review")
         .option("--no-novelty-mode", "Disable novelty mode (allow +1 on existing issues)")
         .option("--issue-override <issue>", "Work on a specific existing issue")
@@ -670,6 +671,7 @@ export function registerImplementCommand(program) {
         .option("--issue-tracker-provider <provider>", "Issue tracker (linear|jira|github-issues|file)")
         .option("--source-control-provider <provider>", "Source control (github|gitlab|file)")
         .option("--dry-run", "Skip creating PR — report only", false)
+        .option("--stage", "Run normally, but preview the PR and issue comment instead of writing them", false)
         .option("--max-implement-turns <n>", "Max coding agent turns (default: 40)")
         .option("--base-branch <branch>", "Base branch for PRs (default: main)")
         .option("--repository <owner/repo>", "Repository (auto-detected from git remote)")

package/dist/cli/main.js

@@ -10,6 +10,7 @@ import { execute } from "../executor.js";
 import { triageWorkflow, implementWorkflow, seedContentWorkflow } from "../workflows/index.js";
 import { consoleLogger } from "../types.js";
 import { createHarness } from "../harness/index.js";
+import { bindBuiltinWorkflow } from "./builtin-workflows.js";
 import { isSupportedAgent, unsupportedAgentError } from "../harness/agents.js";
 import { resolveHarnessPolicy } from "../harness/policy.js";
 import { builtinSkills, createSkillMap, validateWorkflowSkills } from "../skills/index.js";
@@ -94,6 +95,8 @@ program
     await runNew({ marketplaceId: id, template: options.template, yes: options.yes });
 });
 // ── sweny check ───────────────────────────────────────────────────────
+/** validateInputs' generic agent-auth lines, replaced by the harness preflight reason (#339). */
+const AGENT_AUTH_ERROR_PREFIXES = ["Missing: ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN", "Missing: CODEX_API_KEY"];
 program
     .command("check")
     .description("Verify provider credentials and connectivity")
@@ -103,13 +106,22 @@ program
     const workflows = discoverWorkflowSkillIds(process.cwd());
     const scope = workflows.found ? workflows.skillIds : undefined;
     const claudeCodeLogin = detectClaudeCodeLogin();
-    const errors = validateCheckInputs(config, { scope, claudeCodeLogin });
+    let errors = validateCheckInputs(config, { scope, claudeCodeLogin });
+    // #339: the agent's own preflight (install and login), named by --agent.
+    // Its reason replaces the generic agent-auth line from validateInputs.
+    const agent = config.codingAgentProvider;
+    const pre = isSupportedAgent(agent) ? await createHarness(agent, { logger: consoleLogger }).preflight() : undefined;
+    if (pre && !pre.ok) {
+        errors = [pre.reason, ...errors.filter((e) => !AGENT_AUTH_ERROR_PREFIXES.some((p) => e.startsWith(p)))];
+    }
     if (errors.length > 0) {
         console.error(formatValidationErrors(errors));
         process.exit(1);
     }
     console.log(chalk.dim("\n  Checking provider connectivity…\n"));
     const results = await checkProviderConnectivity(config, { scope, claudeCodeLogin });
+    if (pre?.ok)
+        results.unshift({ name: `Agent (${agent})`, status: "ok", detail: `ready (${pre.version})` });
     console.log(formatCheckResults(results));
     const hasFailure = results.some((r) => r.status === "fail");
     process.exit(hasFailure ? 1 : 0);
@@ -178,8 +190,9 @@ async function resolveRulesAndContext(config) {
     };
 }
 /**
- * Build the harness for `--agent` (#331). A non-Claude agent is checked before
- * any node runs, so a missing or too-old CLI fails fast with the fix.
+ * Build the harness for `--agent` (#331) and preflight it before any node
+ * runs (#339): the adapter checks its own install and login, so a missing
+ * CLI or a missing login fails fast with the fix, naming the agent.
  */
 async function harnessFor(agent, opts, harnessPolicy) {
     if (!isSupportedAgent(agent)) {
@@ -190,15 +203,31 @@ async function harnessFor(agent, opts, harnessPolicy) {
         ...opts,
         policy: resolveHarnessPolicy(process.env, harnessPolicy, opts.logger),
     });
-    if (agent !== "claude") {
-        const pre = await harness.preflight();
-        if (!pre.ok) {
-            console.error(chalk.red(`\n  ${pre.reason}\n`));
-            process.exit(1);
-        }
+    const pre = await harness.preflight();
+    if (!pre.ok) {
+        console.error(chalk.red(`\n  ${pre.reason}\n`));
+        process.exit(1);
     }
     return harness;
 }
+/**
+ * Bind a built-in workflow to this run's providers (#365) and say which nodes
+ * fall back to their pre-safe-outputs shape, and why.
+ */
+function bindForCli(workflow, config) {
+    const bound = bindBuiltinWorkflow(workflow, {
+        issueTracker: config.issueTrackerProvider,
+        sourceControl: config.sourceControlProvider,
+        observability: config.observabilityProviders,
+        repository: config.repository || undefined,
+        userMcpServers: Object.keys(config.mcpServers),
+        workspaceTools: config.workspaceTools,
+    });
+    if (!config.json)
+        for (const note of bound.notes)
+            console.error(c.subtle(`  ${workflow.id}: ${note}`));
+    return bound.workflow;
+}
 // ── sweny triage ──────────────────────────────────────────────────────
 const triageCmd = registerTriageCommand(program);
 triageCmd.action(async (options) => {
@@ -401,8 +430,11 @@ triageCmd.action(async (options) => {
         console.log(c.subtle(`  cloud: ${cloudHandle.dashboardUrl}`));
     }
     const observer = composeObservers(progressObserver, config.verbose ? createVerboseToolObserver() : undefined, config.stream ? createStreamObserver() : undefined, createCloudStreamObserver(config, cloudHandle));
+    // #365: pin safe outputs to the configured tracker and repo; nodes these
+    // providers cannot run read-only or through safe outputs keep their old shape.
+    const triageRun = bindForCli(triageWorkflow, config);
     try {
-        const { results, trace } = await execute(triageWorkflow, workflowInput, {
+        const { results, trace } = await execute(triageRun, workflowInput, {
             skills,
             harness: claude,
             observer,
@@ -412,6 +444,7 @@ triageCmd.action(async (options) => {
             fetchAuth: config.fetchAuth,
             offline: config.offline,
             fileRoot: config.fileRoot || undefined,
+            stageOutputs: options.stage === true,
         });
         const durationMs = Date.now() - runStart;
         // Output
@@ -605,8 +638,9 @@ implementCmd.action(async (issueId, options) => {
         console.log(c.subtle(`  cloud: ${implCloudHandle.dashboardUrl}`));
     }
     const observer = composeObservers(implProgressObserver, config.verbose ? createVerboseToolObserver() : undefined, Boolean(options.stream) ? createStreamObserver() : undefined, createCloudStreamObserver(config, implCloudHandle));
+    const implementRun = bindForCli(implementWorkflow, config);
     try {
-        const { results } = await execute(implementWorkflow, workflowInput, {
+        const { results } = await execute(implementRun, workflowInput, {
             skills,
             harness: claude,
             observer,
@@ -616,6 +650,7 @@ implementCmd.action(async (issueId, options) => {
             fetchAuth: config.fetchAuth,
             offline: config.offline,
             fileRoot: config.fileRoot || undefined,
+            stageOutputs: options.stage === true,
         });
         const hasFailed = [...results.values()].some((r) => r.status === "failed");
         const implDurationMs = Date.now() - implRunStart;

package/dist/cli/packs.d.ts

@@ -10,11 +10,15 @@
  *   - validates with no credentials
  *   - every node declares an `output` schema and at least one `eval` gate
  *   - value and function gates first; a judge only where a rule cannot decide
- *   - every node is read-only except the delivery node, and each node's write
- *     tools are named in `pack.writes`; the delivery node also restricts its
- *     tool list with `tools.allow`
- *   - harness-agnostic: instructions name SWEny skill tools and plain
- *     read-only shell commands, never a specific agent's built-in tools
+ *   - safe outputs (#365): every GitHub write (issue, comment) is a declared
+ *     output with a cap, and a pin or title prefix where one applies; sweny
+ *     applies it after the node. No node holds a GitHub write tool.
+ *   - least privilege: a workflow-level `permissions` ceiling, and every node
+ *     is `read` except a delivery node that needs a write no safe output
+ *     covers (Slack); its write tools are named in `pack.writes` and its tool
+ *     list is restricted with `tools.allow`
+ *   - harness-agnostic: instructions name SWEny skill tools, never a specific
+ *     agent's built-in tools
  */
 import type { WorkflowTemplate } from "./templates.js";
 export declare const PACK_TEMPLATES: WorkflowTemplate[];