@sweny-ai/core 0.1.169 → 0.1.171

package/dist/mermaid.d.ts

@@ -10,11 +10,16 @@
  * to highlight which edges were taken and show loop iterations.
  */
 import type { Workflow, ExecutionTrace } from "./types.js";
-export type NodeStatus = "current" | "success" | "failed" | "skipped";
+import { type DiagramNodeStatus } from "./theme.js";
+/**
+ * A node's state in a diagram. `pending` is applied automatically to every
+ * node missing from a non-empty `state` map (the run never reached it).
+ */
+export type NodeStatus = DiagramNodeStatus;
 export interface MermaidOptions {
-    /** Execution state — nodes not in this map render as default (pending) */
+    /** Execution state. With a non-empty map, nodes missing from it render as `pending`. */
     state?: Record<string, NodeStatus>;
-    /** Execution trace — highlights taken/not-taken edges and loop counts */
+    /** Execution trace: highlights taken and not-taken edges and loop counts */
     trace?: ExecutionTrace;
     /** Graph direction: TB (top-bottom) or LR (left-right). Default: TB */
     direction?: "TB" | "LR";
@@ -22,8 +27,8 @@ export interface MermaidOptions {
     title?: string;
     /**
      * Override the `classDef` style body (the part after the class name) for
-     * specific statuses, e.g. `{ success: "fill:#2563eb,stroke:#1d4ed8,color:#fff" }`.
-     * Unset statuses keep the defaults.
+     * specific statuses. Unset statuses keep the brand defaults
+     * (`MERMAID_CLASS_DEFS` in theme.ts). SWEny's own surfaces pass none.
      */
     classDefs?: Partial<Record<NodeStatus, string>>;
 }

package/dist/mermaid.js

@@ -10,6 +10,7 @@
  * to highlight which edges were taken and show loop iterations.
  */
 import { whenLabel } from "./when.js";
+import { MERMAID_CLASS_DEFS, MERMAID_EDGE_STYLES } from "./theme.js";
 /**
  * Convert a Workflow to a Mermaid flowchart diagram string.
  *
@@ -91,7 +92,7 @@ export function toMermaid(workflow, options = {}) {
             edgeTakenCounts.set(key, (edgeTakenCounts.get(key) ?? 0) + 1);
         }
     }
-    // Edges — track index for linkStyle directives
+    // Edges: track index for linkStyle directives
     const takenIndices = [];
     const notTakenIndices = [];
     let edgeIndex = 0;
@@ -129,32 +130,29 @@ export function toMermaid(workflow, options = {}) {
         }
         edgeIndex++;
     }
-    // Node status styling
+    // Node status styling (brand classDefs from theme.ts)
     const statusNodes = groupByStatus(state);
     if (statusNodes.size > 0) {
+        const unreached = Object.keys(workflow.nodes).filter((id) => !(id in state));
+        if (unreached.length > 0)
+            statusNodes.set("pending", [...(statusNodes.get("pending") ?? []), ...unreached]);
         lines.push("");
-        const defaults = {
-            current: "fill:#3b82f6,stroke:#2563eb,color:#fff,stroke-width:2px",
-            success: "fill:#22c55e,stroke:#16a34a,color:#fff,stroke-width:2px",
-            failed: "fill:#ef4444,stroke:#dc2626,color:#fff,stroke-width:2px",
-            skipped: "fill:#6b7280,stroke:#4b5563,color:#fff,stroke-dasharray:5 5",
-        };
-        for (const status of ["current", "success", "failed", "skipped"]) {
-            lines.push(`    classDef ${status} ${classDefs[status] ?? defaults[status]}`);
+        for (const status of ["current", "success", "failed", "skipped", "pending"]) {
+            lines.push(`    classDef ${status} ${classDefs[status] ?? MERMAID_CLASS_DEFS[status]}`);
         }
         for (const [status, ids] of statusNodes) {
             const sanitized = ids.map(aliasFor).join(",");
             lines.push(`    class ${sanitized} ${status}`);
         }
     }
-    // Edge styling — taken edges bold green, not-taken edges dashed gray
+    // Edge styling: taken edges bold brand blue, not-taken edges dashed slate
     if (trace) {
         lines.push("");
         if (takenIndices.length > 0) {
-            lines.push(`    linkStyle ${takenIndices.join(",")} stroke:#22c55e,stroke-width:3px`);
+            lines.push(`    linkStyle ${takenIndices.join(",")} ${MERMAID_EDGE_STYLES.taken}`);
         }
         if (notTakenIndices.length > 0) {
-            lines.push(`    linkStyle ${notTakenIndices.join(",")} stroke:#6b7280,stroke-width:1px,stroke-dasharray:5 5`);
+            lines.push(`    linkStyle ${notTakenIndices.join(",")} ${MERMAID_EDGE_STYLES.notTaken}`);
         }
     }
     return lines.join("\n");

package/dist/safe-outputs.js

@@ -428,6 +428,11 @@ export async function applySafeOutputs(o) {
                 refuse("close needs a pinned issue", at);
                 continue;
             }
+            // ...and the repository (or Linear team) must come from the declaration or the run, never from the agent's intent.
+            if (asked === "close" && !pinned) {
+                refuse("close needs a pinned repository", at);
+                continue;
+            }
             state = asked;
         }
         if (via === "github" && issueRef !== undefined && !/^[1-9][0-9]*$/.test(issueRef)) {

package/dist/skills/git-push.d.ts

@@ -0,0 +1,62 @@
+/**
+ * sweny-side branch push for `github_create_pr` (#473).
+ *
+ * With `actions/checkout`'s recommended `persist-credentials: false` the
+ * checkout holds no token, so the agent's own `git push` in the create_pr node
+ * has nothing to push with. sweny pushes the PR's head branch itself, from
+ * the sweny process, with the github skill's token (`GITHUB_TOKEN`), right
+ * before it opens the PR. The agent never holds the token.
+ *
+ * Guard rails: only a local branch that exists, only to `origin` when it is
+ * the PR's own repo, never force, never the base branch or the remote's
+ * default branch. The token goes to git through command-scope config in the
+ * child env (`GIT_CONFIG_*`), never argv, as an `http.<server>/.extraheader`
+ * that first resets any persisted one (so the job token is never sent twice).
+ * A push that fails is logged and the PR is still requested: the agent may
+ * already have pushed (persisted credentials, an `agent_env` grant).
+ */
+export interface GitRunResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+export type GitRunner = (args: string[], opts: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+}) => Promise<GitRunResult>;
+export interface PushHeadOptions {
+    /** `owner/repo` the PR is for. */
+    repo: string;
+    /** The PR's head branch. */
+    head: string;
+    /** The PR's base branch. */
+    base: string;
+    /** The github skill's token. Without it, git uses whatever credential the checkout has. */
+    token?: string;
+    /** The checkout. Default: `process.cwd()`. */
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    /** Test seam. */
+    git?: GitRunner;
+}
+export interface PushHeadResult {
+    pushed: boolean;
+    /** A push ran (and `pushed` says whether it worked); false when a guard skipped it. */
+    attempted: boolean;
+    /** Why nothing was pushed, or why the push failed. Never carries the token. */
+    reason?: string;
+}
+/** `owner/repo` from a GitHub remote URL (https, ssh or scp form), lowercased, or undefined. */
+export declare function repoFromRemote(url: string): {
+    host: string;
+    repo: string;
+    https: boolean;
+} | undefined;
+/** A branch name sweny will pass to git: plain ref characters, no option or traversal forms. */
+export declare function isSafeBranch(name: string): boolean;
+/** The command-scope git config that authenticates one push to `server` with `token`. */
+export declare function pushAuthConfig(server: string, token: string, env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * Push the PR's head branch to `origin` from the sweny process. Never throws.
+ */
+export declare function pushHeadBranch(opts: PushHeadOptions): Promise<PushHeadResult>;

package/dist/skills/git-push.js

@@ -0,0 +1,132 @@
+/**
+ * sweny-side branch push for `github_create_pr` (#473).
+ *
+ * With `actions/checkout`'s recommended `persist-credentials: false` the
+ * checkout holds no token, so the agent's own `git push` in the create_pr node
+ * has nothing to push with. sweny pushes the PR's head branch itself, from
+ * the sweny process, with the github skill's token (`GITHUB_TOKEN`), right
+ * before it opens the PR. The agent never holds the token.
+ *
+ * Guard rails: only a local branch that exists, only to `origin` when it is
+ * the PR's own repo, never force, never the base branch or the remote's
+ * default branch. The token goes to git through command-scope config in the
+ * child env (`GIT_CONFIG_*`), never argv, as an `http.<server>/.extraheader`
+ * that first resets any persisted one (so the job token is never sent twice).
+ * A push that fails is logged and the PR is still requested: the agent may
+ * already have pushed (persisted credentials, an `agent_env` grant).
+ */
+import { execFile } from "node:child_process";
+import { setBranchPusher } from "./github.js";
+const defaultGit = (args, opts) => new Promise((resolve) => {
+    execFile("git", args, { cwd: opts.cwd, env: opts.env, timeout: 120_000 }, (err, stdout, stderr) => {
+        const code = err
+            ? typeof err.code === "number"
+                ? err.code
+                : 1
+            : 0;
+        resolve({ code, stdout: String(stdout ?? ""), stderr: String(stderr ?? "") });
+    });
+});
+/** `owner/repo` from a GitHub remote URL (https, ssh or scp form), lowercased, or undefined. */
+export function repoFromRemote(url) {
+    const u = url.trim();
+    const https = /^https?:\/\/(?:[^@/]*@)?([^/:]+)(?::\d+)?\/(.+?)(?:\.git)?\/?$/i.exec(u);
+    if (https)
+        return { host: https[1].toLowerCase(), repo: https[2].toLowerCase(), https: true };
+    const ssh = /^ssh:\/\/(?:[^@/]*@)?([^/:]+)(?::\d+)?\/(.+?)(?:\.git)?\/?$/i.exec(u);
+    if (ssh)
+        return { host: ssh[1].toLowerCase(), repo: ssh[2].toLowerCase(), https: false };
+    const scp = /^(?:[^@/]+@)?([^/:]+):(.+?)(?:\.git)?\/?$/.exec(u);
+    if (scp)
+        return { host: scp[1].toLowerCase(), repo: scp[2].toLowerCase(), https: false };
+    return undefined;
+}
+/** A branch name sweny will pass to git: plain ref characters, no option or traversal forms. */
+export function isSafeBranch(name) {
+    return (/^[A-Za-z0-9._/-]+$/.test(name) &&
+        !name.startsWith("-") &&
+        !name.startsWith("/") &&
+        !name.endsWith("/") &&
+        !name.endsWith(".lock") &&
+        !name.includes("..") &&
+        !name.includes("//"));
+}
+/** The command-scope git config that authenticates one push to `server` with `token`. */
+export function pushAuthConfig(server, token, env) {
+    const out = { ...env };
+    const base = Number.parseInt(out.GIT_CONFIG_COUNT ?? "0", 10);
+    let n = Number.isFinite(base) && base > 0 ? base : 0;
+    const key = `http.${server.replace(/\/+$/, "")}/.extraheader`;
+    const basic = Buffer.from(`x-access-token:${token}`).toString("base64");
+    // An empty value resets the list, so a header the checkout persisted is not sent too.
+    for (const value of ["", `AUTHORIZATION: basic ${basic}`]) {
+        out[`GIT_CONFIG_KEY_${n}`] = key;
+        out[`GIT_CONFIG_VALUE_${n}`] = value;
+        n++;
+    }
+    out.GIT_CONFIG_COUNT = String(n);
+    return out;
+}
+/**
+ * Push the PR's head branch to `origin` from the sweny process. Never throws.
+ */
+export async function pushHeadBranch(opts) {
+    const git = opts.git ?? defaultGit;
+    const cwd = opts.cwd ?? process.cwd();
+    const env = { ...(opts.env ?? process.env), GIT_TERMINAL_PROMPT: "0" };
+    const { head, base } = opts;
+    if (!isSafeBranch(head))
+        return { pushed: false, attempted: false, reason: `head "${head}" is not a plain branch name` };
+    if (head === base)
+        return { pushed: false, attempted: false, reason: "head is the base branch" };
+    try {
+        const local = await git(["rev-parse", "--verify", "--quiet", `refs/heads/${head}^{commit}`], { cwd, env });
+        if (local.code !== 0)
+            return { pushed: false, attempted: false, reason: `no local branch ${head}` };
+        const remote = await git(["remote", "get-url", "origin"], { cwd, env });
+        if (remote.code !== 0)
+            return { pushed: false, attempted: false, reason: "no origin remote" };
+        const parsed = repoFromRemote(remote.stdout);
+        if (!parsed || parsed.repo !== opts.repo.toLowerCase()) {
+            return { pushed: false, attempted: false, reason: `origin is not ${opts.repo}` };
+        }
+        const originHead = await git(["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"], { cwd, env });
+        const defaultBranch = originHead.code === 0 ? originHead.stdout.trim().replace(/^origin\//, "") : undefined;
+        if (head === defaultBranch || head === "main" || head === "master") {
+            return { pushed: false, attempted: false, reason: `head ${head} is the default branch` };
+        }
+        const server = (env.GITHUB_SERVER_URL || "https://github.com").replace(/\/+$/, "");
+        let serverHost;
+        try {
+            serverHost = new URL(server).host.toLowerCase();
+        }
+        catch {
+            serverHost = "github.com";
+        }
+        const pushEnv = opts.token && parsed.https && parsed.host === serverHost ? pushAuthConfig(server, opts.token, env) : env;
+        const r = await git(["push", "--porcelain", "origin", `refs/heads/${head}:refs/heads/${head}`], {
+            cwd,
+            env: pushEnv,
+        });
+        if (r.code !== 0) {
+            const why = (r.stderr || r.stdout).trim().split("\n").at(-1) ?? "";
+            return { pushed: false, attempted: true, reason: `git push failed: ${redact(why, opts.token)}` };
+        }
+        return { pushed: true, attempted: true };
+    }
+    catch (err) {
+        return {
+            pushed: false,
+            attempted: false,
+            reason: redact(err instanceof Error ? err.message : String(err), opts.token),
+        };
+    }
+}
+function redact(text, token) {
+    if (!token)
+        return text;
+    const basic = Buffer.from(`x-access-token:${token}`).toString("base64");
+    return text.split(token).join("***").split(basic).join("***");
+}
+// The Node entry imports this module (executor.ts), which arms the push in `github_create_pr`.
+setBranchPusher(pushHeadBranch);

package/dist/skills/github.d.ts

@@ -5,6 +5,23 @@
  * ~800 lines → ~120 lines
  */
 import type { Skill } from "../types.js";
+/**
+ * Pushes a PR's head branch from the sweny process (#473). The Node entry
+ * registers it (skills/git-push.ts, imported by the executor); this module
+ * stays browser-safe, and without a pusher `github_create_pr` only calls the API.
+ */
+export type BranchPusher = (opts: {
+    repo: string;
+    head: string;
+    base: string;
+    token?: string;
+}) => Promise<{
+    pushed: boolean;
+    attempted: boolean;
+    reason?: string;
+}>;
+/** Register (or clear, with `undefined`) the sweny-side branch pusher. */
+export declare function setBranchPusher(fn: BranchPusher | undefined): void;
 /**
  * Encode an LLM-chosen repo file path for safe interpolation into a
  * GitHub API request path.

package/dist/skills/github.js

@@ -4,6 +4,11 @@
  * Replaces: source-control/github.ts + issue-tracking/github-issues.ts
  * ~800 lines → ~120 lines
  */
+let branchPusher;
+/** Register (or clear, with `undefined`) the sweny-side branch pusher. */
+export function setBranchPusher(fn) {
+    branchPusher = fn;
+}
 class GitHubApiError extends Error {
     status;
     body;
@@ -178,6 +183,24 @@ export const github = {
             handler: async (input, ctx) => {
                 let pr;
                 let reused = false;
+                // #473: push the head branch from sweny with this skill's token, so the
+                // recommended `persist-credentials: false` checkout still ships the
+                // branch and the agent never holds a write token. Skipped unless the
+                // branch exists locally and origin is this repo; never forced.
+                if (branchPusher) {
+                    const push = await branchPusher({
+                        repo: input.repo,
+                        head: input.head,
+                        base: input.base ?? "main",
+                        token: ctx.config.GITHUB_TOKEN,
+                    });
+                    if (push.pushed)
+                        ctx.logger?.info?.(`  github_create_pr: pushed ${input.head} to origin`);
+                    else if (push.attempted)
+                        ctx.logger?.warn?.(`  github_create_pr: ${push.reason}; requesting the PR anyway`);
+                    else
+                        ctx.logger?.debug?.(`  github_create_pr: no sweny-side push (${push.reason})`);
+                }
                 try {
                     pr = (await gh(`/repos/${input.repo}/pulls`, ctx, {
                         method: "POST",

package/dist/testing.d.ts

@@ -1,20 +1,18 @@
 /**
  * Test Helpers
  *
- * MockClaude for running workflows without an API key.
+ * MockHarness for running workflows without an API key.
  * File-based skill for local testing.
  *
  * @example
  * ```ts
- * import { MockClaude, fileSkill } from '@sweny-ai/core/testing'
+ * import { MockHarness } from '@sweny-ai/core/testing'
  *
- * const claude = new MockClaude({
- *   gather: {
- *     toolCalls: [{ tool: 'fs_read_json', input: { path: 'logs.json' } }],
- *     data: { logs: [...] },
- *   },
- *   investigate: {
- *     data: { root_cause: 'NPE in handler', severity: 'high' },
+ * const harness = new MockHarness({
+ *   strict: true,
+ *   responses: {
+ *     gather: { data: { logs: [] } },
+ *     investigate: { data: { root_cause: 'NPE in handler', severity: 'high' } },
  *   },
  * })
  * ```
@@ -33,11 +31,13 @@ export interface MockNodeResponse {
     status?: "success" | "skipped" | "failed";
 }
 export interface MockHarnessOptions {
+    /** Refuse incomplete or ambiguous fixtures. Does not isolate supplied tool handlers. */
+    strict?: boolean;
     /** Node ID → scripted response */
     responses: Record<string, MockNodeResponse>;
     /** Route decisions: "fromNode" → chosen target node ID */
     routes?: Record<string, string>;
-    /** Workflow definition — enables instruction-based node matching (required for branching workflows) */
+    /** Enables instruction matching for manual calls without nodeId; execute() supplies node IDs. */
     workflow?: Workflow;
     /** Scripted handler for `ask()` calls. */
     ask?: (instruction: string, context: Record<string, unknown>) => string;
@@ -57,6 +57,7 @@ export declare class MockHarness implements Claude, AgentHarness {
     private responses;
     private routes;
     private instructionMap;
+    private strict;
     private askFn?;
     constructor(opts: MockHarnessOptions);
     /** Returns the order in which nodes were executed */
@@ -70,6 +71,7 @@ export declare class MockHarness implements Claude, AgentHarness {
         prompt: string;
     }): Promise<string | null>;
     run(opts: {
+        nodeId?: string;
         instruction: string;
         context: Record<string, unknown>;
         tools: Tool[];
@@ -92,9 +94,11 @@ export declare class MockHarness implements Claude, AgentHarness {
      * Identify which node is being executed.
      *
      * Strategy:
-     * 1. If a workflow was provided, match by instruction text (accurate for branching)
-     * 2. Otherwise, fall back to sequential key matching (works for linear DAGs)
+     * Manual calls without nodeId can match a unique workflow instruction.
+     * Legacy mode also permits heuristic/sequential matching for compatibility.
+     * Strict mode never guesses from response order or instruction substrings.
      */
+    private fixtureFailure;
     private identifyNode;
 }
 /** @deprecated Use {@link MockHarnessOptions}. */

package/dist/testing.js

@@ -1,20 +1,18 @@
 /**
  * Test Helpers
  *
- * MockClaude for running workflows without an API key.
+ * MockHarness for running workflows without an API key.
  * File-based skill for local testing.
  *
  * @example
  * ```ts
- * import { MockClaude, fileSkill } from '@sweny-ai/core/testing'
+ * import { MockHarness } from '@sweny-ai/core/testing'
  *
- * const claude = new MockClaude({
- *   gather: {
- *     toolCalls: [{ tool: 'fs_read_json', input: { path: 'logs.json' } }],
- *     data: { logs: [...] },
- *   },
- *   investigate: {
- *     data: { root_cause: 'NPE in handler', severity: 'high' },
+ * const harness = new MockHarness({
+ *   strict: true,
+ *   responses: {
+ *     gather: { data: { logs: [] } },
+ *     investigate: { data: { root_cause: 'NPE in handler', severity: 'high' } },
  *   },
  * })
  * ```
@@ -47,9 +45,11 @@ export class MockHarness {
     callOrder = [];
     responses;
     routes;
-    instructionMap; // instruction text → node ID
+    instructionMap; // instruction text → matching node IDs
+    strict;
     askFn;
     constructor(opts) {
+        this.strict = opts.strict ?? false;
         this.responses = opts.responses;
         this.routes = opts.routes ?? {};
         this.askFn = opts.ask;
@@ -59,7 +59,9 @@ export class MockHarness {
             for (const [id, node] of Object.entries(opts.workflow.nodes)) {
                 // Source can be a string or an object — only index string instructions
                 if (typeof node.instruction === "string") {
-                    this.instructionMap.set(node.instruction, id);
+                    const ids = this.instructionMap.get(node.instruction) ?? [];
+                    ids.push(id);
+                    this.instructionMap.set(node.instruction, ids);
                 }
             }
         }
@@ -80,19 +82,29 @@ export class MockHarness {
         return { ...result, harness: { id: "mock", version: "mock" }, degraded: [] };
     }
     async runScripted(opts) {
-        // Identify which node this is by matching instruction text against responses
-        // The executor wraps tools with event tracking, so we can find the node
-        // by checking which response key's instruction appears
-        const nodeId = this.identifyNode(opts.instruction);
+        // Executor identity is authoritative. Text matching is for older manual callers.
+        const nodeId = opts.nodeId ?? this.identifyNode(opts.instruction);
+        if (nodeId === null) {
+            return this.fixtureFailure("ambiguous or unknown instruction; pass nodeId or provide a workflow with unique instructions");
+        }
         this.callOrder.push(nodeId);
-        const response = this.responses[nodeId];
+        const response = Object.hasOwn(this.responses, nodeId) ? this.responses[nodeId] : undefined;
         if (!response) {
+            if (this.strict)
+                return this.fixtureFailure(`node "${nodeId}" has no scripted response`);
             return {
                 status: "success",
                 data: { summary: `Mock: no scripted response for "${nodeId}"` },
                 toolCalls: [],
             };
         }
+        // Check the entire script before executing any handler, so an incomplete
+        // fixture cannot perform an earlier write before discovering a missing tool.
+        if (this.strict) {
+            const missing = response.toolCalls?.find((tc) => !opts.tools.some((tool) => tool.name === tc.tool));
+            if (missing)
+                return this.fixtureFailure(`node "${nodeId}" requests unavailable tool "${missing.tool}"`);
+        }
         // Execute scripted tool calls
         const toolCalls = [];
         if (response.toolCalls) {
@@ -136,16 +148,29 @@ export class MockHarness {
      * Identify which node is being executed.
      *
      * Strategy:
-     * 1. If a workflow was provided, match by instruction text (accurate for branching)
-     * 2. Otherwise, fall back to sequential key matching (works for linear DAGs)
+     * Manual calls without nodeId can match a unique workflow instruction.
+     * Legacy mode also permits heuristic/sequential matching for compatibility.
+     * Strict mode never guesses from response order or instruction substrings.
      */
+    fixtureFailure(reason) {
+        return {
+            status: "failed",
+            data: { error: `MockHarness fixture error: ${reason}`, refused: true },
+            toolCalls: [],
+        };
+    }
     identifyNode(instruction) {
         // 1. Instruction-based matching (accurate for branching workflows)
         if (this.instructionMap.size > 0) {
-            const nodeId = this.instructionMap.get(instruction);
-            if (nodeId && nodeId in this.responses)
+            const matches = this.instructionMap.get(instruction);
+            if (this.strict)
+                return matches?.length === 1 ? matches[0] : null;
+            const nodeId = matches?.at(-1);
+            if (nodeId && Object.hasOwn(this.responses, nodeId))
                 return nodeId;
         }
+        if (this.strict)
+            return null;
         // 2. Check if any response key appears literally in the instruction
         const keys = Object.keys(this.responses);
         for (const key of keys) {