@sweny-ai/core 0.1.169 → 0.1.171

package/dist/cli/try.js

@@ -2,8 +2,8 @@
  * `sweny try`: a zero-credential demo (#475).
  *
  * Replays a recorded explain-repo run through the REAL executor, with a replay
- * harness standing in for the agent, so the real progress line, answer block
- * (#460), receipt, policy segment and PR-comment markdown (#396) are what a
+ * harness standing in for the agent, so the real progress lines, answer block
+ * (#460), receipt ticket, policy stamp and PR comment (#396, #479) are what a
  * user sees. No agent, no model, no network, no env credentials, no files
  * written (no `.sweny/runs`, no journal). The environment handed to the
  * executor is empty by construction.
@@ -14,15 +14,19 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import chalk from "chalk";
 import { parse as parseYaml } from "yaml";
 import { execute } from "../executor.js";
 import { validateParsed } from "../loader.js";
 import { WORKFLOW_TEMPLATES } from "./templates.js";
 import { formatFinalOutput, resolveFinalOutput } from "./final-output.js";
 import { formatRunComment } from "./comment-output.js";
-import { formatReceiptDuration, renderReceiptLine, summarizeRun } from "./run-output.js";
-import { c } from "./output.js";
+import { formatReceiptDuration, summarizeRun } from "./run-output.js";
+import { DagRenderer } from "./renderer.js";
+import { createNodeProgress, toolCallsText } from "./progress.js";
+import { createPaint } from "./style.js";
+import { colorEnabled, glyphsFor, supportsUnicode, terminalColumns } from "./terminal.js";
+import { writeReceipt } from "./ticket.js";
+import { SWENY_TAGLINE } from "../theme.js";
 const isObj = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 /** Shape check with a message naming the first bad field. Throws on a malformed fixture. */
 export function parseTryFixture(raw) {
@@ -152,34 +156,24 @@ export function createReplayHarness(fixture, opts) {
 }
 // ── Output ──────────────────────────────────────────────────────
 export const TRY_BANNER_TITLE = "Recorded demo";
-/** The real commands, same as the README quickstart. */
-export const TRY_NEXT_COMMANDS = [
-    "npm install -g @sweny-ai/core",
-    "sweny new --template explain-repo --yes",
-    "sweny workflow run .sweny/workflows/explain-repo.yml",
-];
+/** The one command to run next: scaffolds the same workflow on the user's repo and says how to run it. */
+export const TRY_NEXT_COMMAND = "npx @sweny-ai/core new --template explain-repo";
 /** Appended to `sweny try --help`. */
 export const TRY_HELP_NOTE = "The recording is ILLUSTRATIVE SAMPLE DATA (a fictional repo, hand-written timings and token counts), not output from a real run. " +
     "Nothing runs: no agent, no network, no credentials read, no files written.";
-export function formatTryBanner(fixture) {
-    const lines = [
-        `${c.brand("▲")} ${chalk.bold("sweny try")}  ${chalk.bold.yellow(TRY_BANNER_TITLE)}, not a live run`,
-        chalk.dim(`  A replay of an ${fixture.workflow} run on a sample repo (${fixture.sample_repo}).`),
-        chalk.dim(fixture.illustrative
-            ? "  The sample data is illustrative, not output from your code. No agent, no network, no credentials."
-            : "  No agent, no network, no credentials."),
-    ];
-    return lines.map((l, i) => (i === 0 ? `  ${l}` : l)).join("\n");
-}
-export function formatTryNext() {
+/** The tagline, then the demo notice as one dim line. */
+export function formatTryBanner(fixture, paint = createPaint(false), unicode = true) {
+    const g = glyphsFor(unicode);
+    const data = fixture.illustrative ? ", illustrative data" : "";
     return [
-        `  ${chalk.bold("Run it for real")} on your own repo:`,
-        "",
-        ...TRY_NEXT_COMMANDS.map((cmd) => `    ${cmd}`),
-        "",
-        chalk.dim("  Needs a Claude login (`claude` signed in) or ANTHROPIC_API_KEY. Your run ends with the same receipt."),
+        `  ${paint.brand(g.brand)} ${paint.strong("SWEny")}  ${SWENY_TAGLINE}`,
+        paint.muted(`  ${TRY_BANNER_TITLE} of ${fixture.workflow} on a sample repo (${fixture.sample_repo})${data}. No agent, network or credentials.`),
     ].join("\n");
 }
+/** The closing line: one command. */
+export function formatTryNext(paint = createPaint(false)) {
+    return `  ${paint.muted("Run it on your repo:")}  ${paint.strong(TRY_NEXT_COMMAND)}`;
+}
 export const DEFAULT_TRY_PACE_MS = 1200;
 const silentLogger = { info() { }, warn() { }, error() { }, debug() { } };
 /** Replay the recording. Returns the process exit code. */
@@ -193,72 +187,97 @@ export async function runTry(opts = {}) {
         if (!workflow.nodes[id])
             throw new Error(`try-fixture.json: node "${id}" is not in ${fixture.workflow}`);
     }
-    write(`\n${formatTryBanner(fixture)}\n\n`);
-    const ticks = new Map();
+    const env = process.env;
+    const unicode = opts.unicode ?? supportsUnicode(env);
+    const color = tty && colorEnabled({ isTTY: true }, env);
+    const paint = createPaint(color);
+    const g = glyphsFor(unicode);
+    const columns = opts.columns ?? terminalColumns(process.stdout, env);
+    write(`\n${formatTryBanner(fixture, paint, unicode)}\n\n`);
+    const progress = createNodeProgress({
+        write,
+        live: tty,
+        unicode,
+        paint,
+        idWidth: Math.max(...Object.keys(fixture.nodes).map((id) => id.length)),
+    });
+    // The same events drive the DAG in the comment preview.
+    const dag = new DagRenderer(workflow, { legend: false, unicode });
     const observer = (event) => {
+        dag.update(event);
         switch (event.type) {
-            case "workflow:start":
-                write(`  ${c.brand("▲")} ${chalk.bold(event.workflow)}\n\n`);
-                break;
             case "node:enter":
-                ticks.set(event.node, 0);
-                if (tty)
-                    write(`  ${c.subtle("○")} ${chalk.dim(event.node)}…`);
+                progress.enter(event.node);
                 break;
-            case "node:progress": {
-                const n = (ticks.get(event.node) ?? 0) + 1;
-                ticks.set(event.node, n);
-                if (tty) {
-                    write(`\r\x1B[2K  ${c.subtle("○")} ${chalk.dim(event.node)}… ${chalk.dim(`${n} tool ${n === 1 ? "call" : "calls"}`)}`);
-                }
+            case "node:progress":
+                progress.tick(event.node);
                 break;
-            }
             case "node:exit": {
                 const rec = fixture.nodes[event.node];
-                const ok = event.result.status === "success";
-                const icon = ok ? c.ok("✓") : c.fail("✗");
                 const calls = event.result.toolCalls.length;
-                const detail = [formatReceiptDuration(rec?.duration_ms ?? 0), ...(calls > 0 ? [`${calls} tool calls`] : [])];
-                write(`${tty ? "\r\x1B[2K" : ""}  ${icon} ${event.node}  ${chalk.dim(detail.join(" · "))}\n`);
+                // The recording's timing, not the replay's wall clock.
+                const detail = [formatReceiptDuration(rec?.duration_ms ?? 0), ...(calls > 0 ? [toolCallsText(calls)] : [])];
+                const status = event.result.status === "success" ? "success" : event.result.status === "failed" ? "failed" : "skipped";
+                progress.exit(event.node, status, detail.join(` ${g.sep} `));
                 break;
             }
         }
     };
-    const { results, trace } = await execute(workflow, {}, {
-        skills: new Map(),
-        harness: createReplayHarness(fixture, { paceMs }),
-        observer,
-        logger: silentLogger,
-        // Nothing for the executor to read: no credentials, no PATH, no config.
-        env: {},
-        offline: true,
-        harnessPolicy: "warn",
-    });
+    let executed;
+    try {
+        executed = await execute(workflow, {}, {
+            skills: new Map(),
+            harness: createReplayHarness(fixture, { paceMs }),
+            observer,
+            logger: silentLogger,
+            // Nothing for the executor to read: no credentials, no PATH, no config.
+            env: {},
+            offline: true,
+            harnessPolicy: "warn",
+        });
+    }
+    finally {
+        progress.stop();
+    }
+    const { results, trace } = executed;
     write("\n");
-    // The recording's timings, not the replay's wall clock.
     const durationsMs = Object.fromEntries(Object.entries(fixture.nodes).map(([id, n]) => [id, n.duration_ms]));
     const totalMs = Object.values(durationsMs).reduce((a, b) => a + b, 0);
     const receipt = summarizeRun(results, totalMs, false, trace);
     const answer = resolveFinalOutput(workflow, results);
     if (answer)
         write(`${formatFinalOutput(answer)}\n\n`);
-    write(`  ${renderReceiptLine(receipt, tty)}\n\n`);
+    // Compact preview of the PR comment: its heading and DAG here, its ticket (the receipt) below.
     const comment = formatRunComment(workflow, results, receipt, { trace, durationsMs });
-    write(`  ${chalk.dim("What CI posts on a pull request (sweny workflow run --comment-file):")}\n\n`);
-    write(`${comment
+    write(`  ${paint.muted("On a pull request, CI posts this heading, this DAG and the receipt below:")}\n\n`);
+    const tone = receipt.ok ? paint.success : paint.error;
+    write(`    ${tone(receipt.ok ? g.success : g.failure)} ${paint.strong(workflow.name)}\n\n`);
+    write(`${dag
+        .renderToString()
         .split("\n")
-        .map((l) => (l === "" ? l : `    ${l}`))
-        .join("\n")}\n`);
+        .slice(2)
+        .map((l) => (l === "" ? l : `  ${l}`))
+        .join("\n")}\n\n`);
+    await writeReceipt(receipt, {
+        workflow: workflow.id,
+        runId: "demo",
+        stream: { write, isTTY: tty, columns },
+        env,
+        rich: tty,
+        color,
+        unicode,
+        animate: !opts.fast,
+    });
     if (opts.commentFile) {
         try {
             fs.mkdirSync(path.dirname(path.resolve(opts.commentFile)), { recursive: true });
             fs.writeFileSync(opts.commentFile, comment);
         }
         catch (err) {
-            process.stderr.write(`  ⚠ could not write comment file: ${err instanceof Error ? err.message : err}\n`);
+            process.stderr.write(`  ${g.warning} could not write comment file: ${err instanceof Error ? err.message : err}\n`);
         }
     }
-    write(`${formatTryNext()}\n\n`);
+    write(`${formatTryNext(paint)}\n\n`);
     return receipt.ok ? 0 : 1;
 }
 export function registerTryCommand(program) {
@@ -274,7 +293,7 @@ export function registerTryCommand(program) {
         if (options.pace !== undefined) {
             paceMs = Number(options.pace);
             if (!Number.isFinite(paceMs) || paceMs < 0) {
-                console.error(chalk.red(`\n  --pace must be a non-negative number of milliseconds, got "${options.pace}"\n`));
+                console.error(createPaint(colorEnabled(process.stderr)).error(`\n  --pace must be a non-negative number of milliseconds, got "${options.pace}"\n`));
                 process.exitCode = 1;
                 return;
             }

package/dist/executor.d.ts

@@ -12,7 +12,8 @@
  *
  * This replaces ~8k lines of engine + recipe step code.
  */
-import type { Workflow, Skill, Tool, Claude, Observer, Logger, ExecutionResult } from "./types.js";
+import type { Workflow, Skill, Tool, Claude, Observer, NodeResult, Logger, ExecutionResult } from "./types.js";
+import "./skills/git-push.js";
 import type { HarnessPolicyMode } from "./harness/policy.js";
 import type { AgentHarness } from "./harness/types.js";
 import type { DeciderMode } from "./decider.js";
@@ -138,6 +139,12 @@ export declare class RouteEvaluationError extends Error {
     readonly node: string;
     constructor(node: string, message: string);
 }
+/**
+ * The bounded prompt context for one node: `input` plus its dependencies' entries.
+ * Exported for the property tests only; not part of the package API (index.ts does not re-export it).
+ * @internal
+ */
+export declare function buildBoundedContext(workflow: Workflow, nodeId: string, results: Map<string, NodeResult>, input: unknown, instruction: string): Record<string, unknown>;
 /**
  * Dry-run tool gate (#380). Only an explicit `access: "read"` passes; a tool
  * with no `access` is treated as a write so new tools fail safe.

package/dist/executor.js

@@ -22,6 +22,9 @@ import { resolveExecutionModel } from "./model.js";
 import { buildToolAliases } from "./skills/index.js";
 import { validateWorkflow } from "./schema.js";
 import { grantedAgentEnv, resolveAgentAccess } from "./agent-env.js";
+import { gitCredentialWarning, scanGitCredentials } from "./git-credentials.js";
+// #473: arms the sweny-side branch push in `github_create_pr` (Node only; skills/ stays browser-safe).
+import "./skills/git-push.js";
 import { fenceUntrusted } from "./untrusted.js";
 import { asClaude } from "./harness/compat.js";
 import { budgetGate, isToolClass, policyGate, resolveHarnessPolicy } from "./harness/policy.js";
@@ -89,6 +92,17 @@ export async function execute(workflow, input, options) {
     // `budget` and the caller's (`--max-tokens`, `--max-cost`).
     const budgetGuard = new BudgetGuard(minLimits(toLimits(workflow.budget), toLimits(options.budget)));
     const harnessPolicy = options.harnessPolicy ?? resolveHarnessPolicy(runEnv);
+    // #473: a checkout that persisted a git credential (actions/checkout's
+    // default). Each harness masks it for read-only and staged nodes, or reports
+    // the node degraded; this says so once per run. Paths and keys, never values.
+    try {
+        const credentialWarning = gitCredentialWarning(scanGitCredentials(process.cwd(), { env: runEnv }));
+        if (credentialWarning)
+            logger.warn(credentialWarning);
+    }
+    catch {
+        // A scan failure never stops a run; each node scans again before it starts.
+    }
     // Decision model (#357): shadow only. Null (the default) means no HTTP at all.
     const shadow = createShadowDecider(workflow.decider, options.decider, runEnv, (m) => logger.warn(m));
     if (shadow)
@@ -419,6 +433,7 @@ export async function execute(workflow, input, options) {
             const attemptBudget = budgetOn ? nodeBudget.attempt(signal) : undefined;
             try {
                 result = await claude.run({
+                    nodeId: currentId,
                     instruction: currentInstruction,
                     context,
                     tools: trackedTools,
@@ -910,8 +925,12 @@ function contextDependencies(workflow, nodeId, instruction = "") {
     }
     return deps;
 }
-/** The bounded prompt context for one node: `input` plus its dependencies' entries. */
-function buildBoundedContext(workflow, nodeId, results, input, instruction) {
+/**
+ * The bounded prompt context for one node: `input` plus its dependencies' entries.
+ * Exported for the property tests only; not part of the package API (index.ts does not re-export it).
+ * @internal
+ */
+export function buildBoundedContext(workflow, nodeId, results, input, instruction) {
     const deps = contextDependencies(workflow, nodeId, instruction);
     return {
         input,

package/dist/git-credentials.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Persisted git credentials in the checkout (#473).
+ *
+ * `actions/checkout` keeps the job token on disk by default
+ * (`persist-credentials: true`): v4 and v5 write it into `.git/config` as an
+ * `http.<origin>/.extraheader`; v6 and later write it to a separate file under
+ * `$RUNNER_TEMP` that `.git/config` pulls in with `includeIf.gitdir:...path`.
+ * Either way, any agent that can read the repo can read a token that pushes to
+ * it. Env scoping cannot reach a file.
+ *
+ * {@link scanGitCredentials} finds the files that hold such a credential, so a
+ * harness can make them unreadable to the agent of a read-only or staged node
+ * (the process wrapper's `denyRead`, Claude Code's `Read(...)` deny rules and
+ * SDK sandbox `denyRead`), or report the node `degraded` (refused under strict)
+ * where it cannot. The fix that needs no masking at all is
+ * `persist-credentials: false`: sweny pushes the PR branch itself
+ * (`github_create_pr`), with the skill's own token, in the sweny process.
+ *
+ * What counts as a credential:
+ * - `http.extraheader` / `http.<url>.extraheader` (the checkout's header);
+ * - `credential.helper` with an inline secret (`!f() { echo password=...; }; f`);
+ *   a `store` helper's file (default `~/.git-credentials`, or `--file <path>`);
+ * - `url.<base>.insteadOf` / `pushInsteadOf` whose base carries userinfo with
+ *   a password or a token, and `remote.<name>.url` / `pushurl` that do.
+ *
+ * Files scanned: the repo config (`<commondir>/config`), the worktree config
+ * (`<gitdir>/config.worktree`), the global config (`GIT_CONFIG_GLOBAL`, else
+ * `~/.gitconfig` and `$XDG_CONFIG_HOME/git/config`), and every file they
+ * include (`include.path`, and `includeIf.*.path` whatever the condition).
+ * Values never leave this module: findings carry the file and a redacted key.
+ */
+export { gitCredentialGap } from "./harness/policy.js";
+export type GitCredentialKind = "extraheader" | "credential-helper" | "credential-store" | "url-userinfo";
+export interface GitCredentialFinding {
+    /** The file holding the credential (absolute, symlinks resolved). */
+    file: string;
+    /** The config key, with any embedded credential redacted (`url.<redacted>.insteadof`). */
+    key: string;
+    kind: GitCredentialKind;
+}
+export interface GitCredentialScan {
+    findings: GitCredentialFinding[];
+    /** Every file to keep from the agent, deduplicated, in scan order. */
+    files: string[];
+}
+export interface ScanGitCredentialsOptions {
+    env?: Record<string, string | undefined>;
+    /** Test seam. Default: `fs.readFileSync(p, "utf8")`; a throw means "not there". */
+    readFile?: (p: string) => string;
+    /** Test seam. Default: `fs.existsSync`. */
+    exists?: (p: string) => boolean;
+}
+/** Does a URL carry a credential in its userinfo (`https://user:pass@`, `https://<token>@`)? */
+export declare function urlHasCredential(url: string): boolean;
+/** Does a `credential.helper` value hold the secret itself (an inline shell helper)? */
+export declare function helperHasInlineSecret(value: string): boolean;
+/** The file a `store` credential helper writes, or undefined when the helper is not `store`. */
+export declare function storeHelperFiles(value: string, env: Record<string, string | undefined>): string[] | undefined;
+interface ConfigEntry {
+    section: string;
+    /** Case preserved, as git does. */
+    subsection?: string;
+    key: string;
+    value: string;
+}
+/**
+ * Minimal git-config parser: `[section]`, `[section "sub"]`, the legacy
+ * `[section.sub]`, `key = value`, bare `key` (boolean), quoted values with
+ * escapes, `#` and `;` comments, and `\` line continuations. Section and key
+ * names are lowercased; subsections keep their case. Enough to find keys; not
+ * a validator.
+ */
+export declare function parseGitConfig(text: string): ConfigEntry[];
+/** The repo's git dir and common dir for `cwd`, walking up to the filesystem root. */
+export declare function findGitDirs(cwd: string, readFile: (p: string) => string, exists: (p: string) => boolean): {
+    gitDir: string;
+    commonDir: string;
+} | undefined;
+/**
+ * Find persisted git credentials visible from `cwd`. Pure apart from reading
+ * config files; never returns a credential value.
+ */
+export declare function scanGitCredentials(cwd: string, opts?: ScanGitCredentialsOptions): GitCredentialScan;
+/**
+ * The files to keep from one node's agent: the scan's files for a read-only
+ * node or a staged write node, nothing otherwise. A default write node keeps
+ * today's behavior (it may push with the checkout's credential); the
+ * recommended `persist-credentials: false` leaves nothing to find.
+ */
+export declare function gitCredentialMask(cwd: string, node: {
+    readOnly: boolean;
+    staged: boolean;
+}, opts?: ScanGitCredentialsOptions): string[];
+/** The run-start warning for a checkout that persists a credential. Paths and kinds only. */
+export declare function gitCredentialWarning(scan: GitCredentialScan): string | undefined;
+/**
+ * The `NodePolicy.gitCredentials` fragment for one node run (#473): the
+ * credential files to keep from a read-only or staged node's agent, or
+ * nothing. Adapters spread it into the policy they gate and wrap with.
+ */
+export declare function gitCredentialPolicy(cwd: string, node: {
+    readOnly: boolean;
+    noPush?: boolean;
+}, opts?: ScanGitCredentialsOptions): {
+    gitCredentials?: string[];
+};