@sweny-ai/core 0.1.170 → 0.1.172

package/dist/cli/ticket.js

@@ -0,0 +1,218 @@
+/**
+ * The receipt ticket: the run receipt as a small perforated card with a tear
+ * line and a policy stamp. Shown at the end of a run on a TTY, and at the top
+ * of the PR comment. CI logs, pipes and `--json` keep the plain receipt line.
+ *
+ * METADATA ONLY, like the receipt line: counts, durations, tokens, cost,
+ * policy facts. Never prompts, node outputs, tool inputs, or model prose.
+ */
+import { formatBudgetAmount, formatCost, formatDeciderCounts, formatReceiptDuration, formatTokenCount, policyParts, renderReceiptLine, } from "./run-output.js";
+import { createPaint } from "./style.js";
+import { colorEnabled, glyphsFor, richOutput, supportsUnicode, terminalColumns, ticketBoxFor } from "./terminal.js";
+/** Widest ticket, in columns, frame included. */
+export const TICKET_MAX_WIDTH = 48;
+/** Narrowest ticket. Below this the fields stop being readable. */
+export const TICKET_MIN_WIDTH = 32;
+/** Left indent the CLI prints the ticket at. */
+export const TICKET_INDENT = 2;
+/** How long the stub sits empty before the stamp lands (the one animation frame). */
+export const STAMP_DELAY_MS = 140;
+const LABEL_WIDTH = 12;
+/** `20260930-110000-3f9a2c` shows as `3f9a2c`; any other id as its first 8 characters. */
+export function shortRunId(runId) {
+    const m = /-([0-9a-f]{6,})$/i.exec(runId);
+    return m ? m[1] : runId.slice(0, 8);
+}
+/** The ticket's status word. */
+export function ticketStatus(data) {
+    if (data.crashed)
+        return "crashed";
+    if (data.summary.budget)
+        return "budget stop";
+    return data.summary.ok ? "passed" : "failed";
+}
+/**
+ * The policy stamp words, from what the run reported: `ENV SCOPED`,
+ * `SANDBOXED`. Empty when no node reported env scope or sandbox facts.
+ * `strong` is false when any fact is weaker than the default (an unscoped
+ * env, no sandbox), which the stamp shows in the warning color.
+ */
+export function stampWords(summary) {
+    const p = summary.policy;
+    const words = [];
+    let strong = true;
+    if (p?.envScope !== undefined) {
+        words.push(p.envScope ? "ENV SCOPED" : "ENV UNSCOPED");
+        strong &&= p.envScope;
+    }
+    if (p?.sandbox) {
+        const on = p.sandbox.mode !== "off" && p.sandbox.started;
+        words.push(on ? "SANDBOXED" : "UNSANDBOXED");
+        strong &&= on;
+    }
+    return { words, strong };
+}
+/** Field rows, label then value, metadata only. */
+function ticketFields(s) {
+    const failed = Math.max(0, s.nodesTotal - s.nodesOk - s.nodesSkipped);
+    const nodes = [
+        `${s.nodesOk}/${s.nodesTotal}`,
+        ...(failed > 0 ? [`${failed} failed`] : []),
+        ...(s.nodesSkipped > 0 ? [`${s.nodesSkipped} skipped`] : []),
+    ].join(", ");
+    const policy = policyParts(s.policy);
+    return [
+        ["nodes", nodes],
+        ["tool calls", String(s.toolCalls)],
+        ["duration", formatReceiptDuration(s.durationMs)],
+        ...(s.tokens !== undefined ? [["tokens", formatTokenCount(s.tokens)]] : []),
+        ...(s.costUsd !== undefined ? [["cost", formatCost(s.costUsd)]] : []),
+        ...(s.harness !== undefined && s.harness !== "claude-code" ? [["harness", s.harness]] : []),
+        ...(s.degraded && s.degraded.length > 0 ? [["degraded", s.degraded.join(", ")]] : []),
+        ...(s.decider ? [["decider", formatDeciderCounts(s.decider)]] : []),
+        ...(s.budget
+            ? [
+                ["budget", `${formatBudgetAmount(s.budget)} (${s.budget.scope})`],
+                ["stopped at", s.budget.node],
+            ]
+            : []),
+        ...(policy.length > 0 ? [["policy", policy.join(", ")]] : []),
+    ];
+}
+/** Word-wrap to `width`, hard-breaking any word longer than the line. */
+function wrap(text, width) {
+    const out = [];
+    let line = "";
+    for (let word of text.split(" ")) {
+        while (word.length > width) {
+            if (line) {
+                out.push(line);
+                line = "";
+            }
+            out.push(word.slice(0, width));
+            word = word.slice(width);
+        }
+        if (!line)
+            line = word;
+        else if (line.length + 1 + word.length <= width)
+            line += ` ${word}`;
+        else {
+            out.push(line);
+            line = word;
+        }
+    }
+    if (line || out.length === 0)
+        out.push(line);
+    return out;
+}
+function clip(text, width, ellipsis) {
+    if (text.length <= width)
+        return text;
+    return text.slice(0, Math.max(0, width - ellipsis.length)) + ellipsis;
+}
+/** Ticket width for a terminal of `columns`: fits beside the indent, within the min and max. */
+export function ticketWidth(columns) {
+    return Math.max(TICKET_MIN_WIDTH, Math.min(TICKET_MAX_WIDTH, columns - TICKET_INDENT));
+}
+/**
+ * Render the ticket. Pure: same input, same rows. Every row is exactly the
+ * ticket width in visible columns.
+ */
+export function renderTicket(data, opts = {}) {
+    const unicode = opts.unicode ?? true;
+    const paint = opts.paint ?? createPaint(false);
+    const box = ticketBoxFor(unicode);
+    const g = glyphsFor(unicode);
+    const width = ticketWidth(opts.columns ?? 80);
+    const inner = width - 4;
+    const valueWidth = inner - LABEL_WIDTH;
+    const s = data.summary;
+    const frame = paint.muted;
+    const edge = (left, fill, right) => {
+        const run = fill.repeat(Math.ceil((width - 2) / fill.length)).slice(0, width - 2);
+        return frame(left + run + right);
+    };
+    /** One content row: `raw` sets the width, `painted` is what prints. */
+    const row = (raw, painted = raw) => `${frame(box.vertical)} ${painted}${" ".repeat(Math.max(0, inner - raw.length))} ${frame(box.vertical)}`;
+    const lines = [edge(box.topLeft, box.horizontal, box.topRight)];
+    // Status and run id.
+    const status = ticketStatus(data);
+    const good = status === "passed";
+    const tone = good ? paint.success : paint.error;
+    const left = `${good ? g.success : g.failure} ${status}`;
+    const right = data.runId ? `run ${shortRunId(data.runId)}` : "";
+    const gap = inner - left.length - right.length;
+    if (right && gap >= 2) {
+        lines.push(row(left + " ".repeat(gap) + right, paint.strong(tone(left)) + " ".repeat(gap) + paint.muted(right)));
+    }
+    else {
+        lines.push(row(left, paint.strong(tone(left))));
+    }
+    const name = clip(data.workflow, inner, g.ellipsis);
+    lines.push(row(name));
+    lines.push(row(""));
+    // Fields, aligned: label column then value column; long values wrap under the value.
+    for (const [label, value] of ticketFields(s)) {
+        wrap(value, valueWidth).forEach((part, i) => {
+            const lab = (i === 0 ? label : "").padEnd(LABEL_WIDTH);
+            lines.push(row(lab + part, paint.muted(lab) + part));
+        });
+    }
+    // Tear line and stub with the policy stamp.
+    let stampRow = -1;
+    const stamp = stampWords(s);
+    if (stamp.words.length > 0) {
+        lines.push(edge(box.tearLeft, box.tear, box.tearRight));
+        let text = `[ ${stamp.words.join(` ${g.sep} `)} ]`;
+        if (text.length > inner)
+            text = clip(stamp.words.join(` ${g.sep} `), inner, g.ellipsis);
+        const padL = Math.floor((inner - text.length) / 2);
+        const raw = " ".repeat(padL) + text;
+        stampRow = lines.length;
+        if (opts.stamp === false)
+            lines.push(row(""));
+        else
+            lines.push(row(raw, " ".repeat(padL) + paint.strong((stamp.strong ? paint.brand : paint.warning)(text))));
+    }
+    lines.push(edge(box.bottomLeft, box.horizontal, box.bottomRight));
+    return { lines, stampRow };
+}
+/** The ticket as plain text (no color, Unicode): what the PR comment carries. */
+export function formatTicketText(data, columns = TICKET_MAX_WIDTH + TICKET_INDENT) {
+    return renderTicket(data, { columns }).lines.join("\n");
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+ * Print the receipt. A TTY (not CI) gets the ticket, its stamp landing one
+ * frame after the card; anything else gets the plain line. Both end with a
+ * blank line.
+ */
+export async function writeReceipt(summary, opts) {
+    const env = opts.env ?? process.env;
+    const { stream } = opts;
+    const color = opts.color ?? colorEnabled(stream, env);
+    const rich = opts.rich ?? richOutput(stream, env);
+    if (!rich) {
+        stream.write(`  ${renderReceiptLine(summary, color)}\n\n`);
+        return;
+    }
+    const data = { summary, workflow: opts.workflow, runId: opts.runId, crashed: opts.crashed };
+    const base = {
+        columns: terminalColumns(stream, env),
+        unicode: opts.unicode ?? supportsUnicode(env),
+        paint: createPaint(color),
+    };
+    const pad = " ".repeat(TICKET_INDENT);
+    const full = renderTicket(data, base);
+    const animate = (opts.animate ?? true) && full.stampRow >= 0;
+    if (!animate) {
+        stream.write(full.lines.map((l) => pad + l).join("\n") + "\n\n");
+        return;
+    }
+    const blank = renderTicket(data, { ...base, stamp: false });
+    stream.write(blank.lines.map((l) => pad + l).join("\n") + "\n");
+    await sleep(STAMP_DELAY_MS);
+    // Up to the stub row, redraw it with the stamp, back down below the ticket.
+    const up = full.lines.length - full.stampRow;
+    stream.write(`\x1B[${up}A\r\x1B[2K${pad}${full.lines[full.stampRow]}\x1B[${up}B\r\n`);
+}

package/dist/cli/try.d.ts

@@ -2,8 +2,8 @@
  * `sweny try`: a zero-credential demo (#475).
  *
  * Replays a recorded explain-repo run through the REAL executor, with a replay
- * harness standing in for the agent, so the real progress line, answer block
- * (#460), receipt, policy segment and PR-comment markdown (#396) are what a
+ * harness standing in for the agent, so the real progress lines, answer block
+ * (#460), receipt ticket, policy stamp and PR comment (#396, #479) are what a
  * user sees. No agent, no model, no network, no env credentials, no files
  * written (no `.sweny/runs`, no journal). The environment handed to the
  * executor is empty by construction.
@@ -14,6 +14,7 @@
 import type { Command } from "commander";
 import type { AgentHarness } from "../harness/types.js";
 import type { Workflow } from "../types.js";
+import { type Paint } from "./style.js";
 export interface TryFixtureNode {
     /** Recorded wall-clock time of the node. */
     duration_ms: number;
@@ -64,14 +65,16 @@ export declare function createReplayHarness(fixture: TryFixture, opts: {
     paceMs: number;
 }): AgentHarness;
 export declare const TRY_BANNER_TITLE = "Recorded demo";
-/** The real commands, same as the README quickstart. */
-export declare const TRY_NEXT_COMMANDS: readonly ["npm install -g @sweny-ai/core", "sweny new --template explain-repo --yes", "sweny workflow run .sweny/workflows/explain-repo.yml"];
+/** The one command to run next: scaffolds the same workflow on the user's repo and says how to run it. */
+export declare const TRY_NEXT_COMMAND = "npx @sweny-ai/core new --template explain-repo";
 /** Appended to `sweny try --help`. */
 export declare const TRY_HELP_NOTE: string;
-export declare function formatTryBanner(fixture: TryFixture): string;
-export declare function formatTryNext(): string;
+/** The tagline, then the demo notice as one dim line. */
+export declare function formatTryBanner(fixture: TryFixture, paint?: Paint, unicode?: boolean): string;
+/** The closing line: one command. */
+export declare function formatTryNext(paint?: Paint): string;
 export interface TryOptions {
-    /** Replay instantly. */
+    /** Replay instantly (and land the stamp without the one-frame pause). */
     fast?: boolean;
     /** Milliseconds each node takes to replay. Default 1200. Ignored with `fast`. */
     paceMs?: number;
@@ -79,8 +82,16 @@ export interface TryOptions {
     commentFile?: string;
     /** Output sink. Default stdout. */
     write?: (s: string) => void;
-    /** Rewrite progress lines in place. Default: stdout is a TTY. */
+    /** Rich output: spinner, ticket, color. Default: stdout is a TTY. */
     tty?: boolean;
+    /** Draw with Unicode. Default: what the terminal supports. */
+    unicode?: boolean;
+    /** Force ANSI color on or off. Default: on for a TTY that allows color. */
+    color?: boolean;
+    /** Force the receipt ticket (true) or the plain receipt line (false). Default: `tty`. */
+    rich?: boolean;
+    /** Terminal width. Default: stdout's. */
+    columns?: number;
     fixture?: TryFixture;
 }
 export declare const DEFAULT_TRY_PACE_MS = 1200;

package/dist/cli/try.js

@@ -2,8 +2,8 @@
  * `sweny try`: a zero-credential demo (#475).
  *
  * Replays a recorded explain-repo run through the REAL executor, with a replay
- * harness standing in for the agent, so the real progress line, answer block
- * (#460), receipt, policy segment and PR-comment markdown (#396) are what a
+ * harness standing in for the agent, so the real progress lines, answer block
+ * (#460), receipt ticket, policy stamp and PR comment (#396, #479) are what a
  * user sees. No agent, no model, no network, no env credentials, no files
  * written (no `.sweny/runs`, no journal). The environment handed to the
  * executor is empty by construction.
@@ -14,15 +14,19 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import chalk from "chalk";
 import { parse as parseYaml } from "yaml";
 import { execute } from "../executor.js";
 import { validateParsed } from "../loader.js";
 import { WORKFLOW_TEMPLATES } from "./templates.js";
 import { formatFinalOutput, resolveFinalOutput } from "./final-output.js";
 import { formatRunComment } from "./comment-output.js";
-import { formatReceiptDuration, renderReceiptLine, summarizeRun } from "./run-output.js";
-import { c } from "./output.js";
+import { formatReceiptDuration, summarizeRun } from "./run-output.js";
+import { DagRenderer } from "./renderer.js";
+import { createNodeProgress, toolCallsText } from "./progress.js";
+import { createPaint } from "./style.js";
+import { colorEnabled, glyphsFor, supportsUnicode, terminalColumns } from "./terminal.js";
+import { writeReceipt } from "./ticket.js";
+import { SWENY_TAGLINE } from "../theme.js";
 const isObj = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 /** Shape check with a message naming the first bad field. Throws on a malformed fixture. */
 export function parseTryFixture(raw) {
@@ -152,34 +156,24 @@ export function createReplayHarness(fixture, opts) {
 }
 // ── Output ──────────────────────────────────────────────────────
 export const TRY_BANNER_TITLE = "Recorded demo";
-/** The real commands, same as the README quickstart. */
-export const TRY_NEXT_COMMANDS = [
-    "npm install -g @sweny-ai/core",
-    "sweny new --template explain-repo --yes",
-    "sweny workflow run .sweny/workflows/explain-repo.yml",
-];
+/** The one command to run next: scaffolds the same workflow on the user's repo and says how to run it. */
+export const TRY_NEXT_COMMAND = "npx @sweny-ai/core new --template explain-repo";
 /** Appended to `sweny try --help`. */
 export const TRY_HELP_NOTE = "The recording is ILLUSTRATIVE SAMPLE DATA (a fictional repo, hand-written timings and token counts), not output from a real run. " +
     "Nothing runs: no agent, no network, no credentials read, no files written.";
-export function formatTryBanner(fixture) {
-    const lines = [
-        `${c.brand("▲")} ${chalk.bold("sweny try")}  ${chalk.bold.yellow(TRY_BANNER_TITLE)}, not a live run`,
-        chalk.dim(`  A replay of an ${fixture.workflow} run on a sample repo (${fixture.sample_repo}).`),
-        chalk.dim(fixture.illustrative
-            ? "  The sample data is illustrative, not output from your code. No agent, no network, no credentials."
-            : "  No agent, no network, no credentials."),
-    ];
-    return lines.map((l, i) => (i === 0 ? `  ${l}` : l)).join("\n");
-}
-export function formatTryNext() {
+/** The tagline, then the demo notice as one dim line. */
+export function formatTryBanner(fixture, paint = createPaint(false), unicode = true) {
+    const g = glyphsFor(unicode);
+    const data = fixture.illustrative ? ", illustrative data" : "";
     return [
-        `  ${chalk.bold("Run it for real")} on your own repo:`,
-        "",
-        ...TRY_NEXT_COMMANDS.map((cmd) => `    ${cmd}`),
-        "",
-        chalk.dim("  Needs a Claude login (`claude` signed in) or ANTHROPIC_API_KEY. Your run ends with the same receipt."),
+        `  ${paint.brand(g.brand)} ${paint.strong("SWEny")}  ${SWENY_TAGLINE}`,
+        paint.muted(`  ${TRY_BANNER_TITLE} of ${fixture.workflow} on a sample repo (${fixture.sample_repo})${data}. No agent, network or credentials.`),
     ].join("\n");
 }
+/** The closing line: one command. */
+export function formatTryNext(paint = createPaint(false)) {
+    return `  ${paint.muted("Run it on your repo:")}  ${paint.strong(TRY_NEXT_COMMAND)}`;
+}
 export const DEFAULT_TRY_PACE_MS = 1200;
 const silentLogger = { info() { }, warn() { }, error() { }, debug() { } };
 /** Replay the recording. Returns the process exit code. */
@@ -193,72 +187,97 @@ export async function runTry(opts = {}) {
         if (!workflow.nodes[id])
             throw new Error(`try-fixture.json: node "${id}" is not in ${fixture.workflow}`);
     }
-    write(`\n${formatTryBanner(fixture)}\n\n`);
-    const ticks = new Map();
+    const env = process.env;
+    const unicode = opts.unicode ?? supportsUnicode(env);
+    const color = opts.color ?? (tty && colorEnabled({ isTTY: true }, env));
+    const paint = createPaint(color);
+    const g = glyphsFor(unicode);
+    const columns = opts.columns ?? terminalColumns(process.stdout, env);
+    write(`\n${formatTryBanner(fixture, paint, unicode)}\n\n`);
+    const progress = createNodeProgress({
+        write,
+        live: tty,
+        unicode,
+        paint,
+        idWidth: Math.max(...Object.keys(fixture.nodes).map((id) => id.length)),
+    });
+    // The same events drive the DAG in the comment preview.
+    const dag = new DagRenderer(workflow, { legend: false, unicode });
     const observer = (event) => {
+        dag.update(event);
         switch (event.type) {
-            case "workflow:start":
-                write(`  ${c.brand("▲")} ${chalk.bold(event.workflow)}\n\n`);
-                break;
             case "node:enter":
-                ticks.set(event.node, 0);
-                if (tty)
-                    write(`  ${c.subtle("○")} ${chalk.dim(event.node)}…`);
+                progress.enter(event.node);
                 break;
-            case "node:progress": {
-                const n = (ticks.get(event.node) ?? 0) + 1;
-                ticks.set(event.node, n);
-                if (tty) {
-                    write(`\r\x1B[2K  ${c.subtle("○")} ${chalk.dim(event.node)}… ${chalk.dim(`${n} tool ${n === 1 ? "call" : "calls"}`)}`);
-                }
+            case "node:progress":
+                progress.tick(event.node);
                 break;
-            }
             case "node:exit": {
                 const rec = fixture.nodes[event.node];
-                const ok = event.result.status === "success";
-                const icon = ok ? c.ok("✓") : c.fail("✗");
                 const calls = event.result.toolCalls.length;
-                const detail = [formatReceiptDuration(rec?.duration_ms ?? 0), ...(calls > 0 ? [`${calls} tool calls`] : [])];
-                write(`${tty ? "\r\x1B[2K" : ""}  ${icon} ${event.node}  ${chalk.dim(detail.join(" · "))}\n`);
+                // The recording's timing, not the replay's wall clock.
+                const detail = [formatReceiptDuration(rec?.duration_ms ?? 0), ...(calls > 0 ? [toolCallsText(calls)] : [])];
+                const status = event.result.status === "success" ? "success" : event.result.status === "failed" ? "failed" : "skipped";
+                progress.exit(event.node, status, detail.join(` ${g.sep} `));
                 break;
             }
         }
     };
-    const { results, trace } = await execute(workflow, {}, {
-        skills: new Map(),
-        harness: createReplayHarness(fixture, { paceMs }),
-        observer,
-        logger: silentLogger,
-        // Nothing for the executor to read: no credentials, no PATH, no config.
-        env: {},
-        offline: true,
-        harnessPolicy: "warn",
-    });
+    let executed;
+    try {
+        executed = await execute(workflow, {}, {
+            skills: new Map(),
+            harness: createReplayHarness(fixture, { paceMs }),
+            observer,
+            logger: silentLogger,
+            // Nothing for the executor to read: no credentials, no PATH, no config.
+            env: {},
+            offline: true,
+            harnessPolicy: "warn",
+        });
+    }
+    finally {
+        progress.stop();
+    }
+    const { results, trace } = executed;
     write("\n");
-    // The recording's timings, not the replay's wall clock.
     const durationsMs = Object.fromEntries(Object.entries(fixture.nodes).map(([id, n]) => [id, n.duration_ms]));
     const totalMs = Object.values(durationsMs).reduce((a, b) => a + b, 0);
     const receipt = summarizeRun(results, totalMs, false, trace);
     const answer = resolveFinalOutput(workflow, results);
     if (answer)
         write(`${formatFinalOutput(answer)}\n\n`);
-    write(`  ${renderReceiptLine(receipt, tty)}\n\n`);
+    // Compact preview of the PR comment: its heading and DAG here, its ticket (the receipt) below.
     const comment = formatRunComment(workflow, results, receipt, { trace, durationsMs });
-    write(`  ${chalk.dim("What CI posts on a pull request (sweny workflow run --comment-file):")}\n\n`);
-    write(`${comment
+    write(`  ${paint.muted("On a pull request, CI posts this heading, this DAG and the receipt below:")}\n\n`);
+    const tone = receipt.ok ? paint.success : paint.error;
+    write(`    ${tone(receipt.ok ? g.success : g.failure)} ${paint.strong(workflow.name)}\n\n`);
+    write(`${dag
+        .renderToString()
         .split("\n")
-        .map((l) => (l === "" ? l : `    ${l}`))
-        .join("\n")}\n`);
+        .slice(2)
+        .map((l) => (l === "" ? l : `  ${l}`))
+        .join("\n")}\n\n`);
+    await writeReceipt(receipt, {
+        workflow: workflow.id,
+        runId: "demo",
+        stream: { write, isTTY: tty, columns },
+        env,
+        rich: opts.rich ?? tty,
+        color,
+        unicode,
+        animate: !opts.fast,
+    });
     if (opts.commentFile) {
         try {
             fs.mkdirSync(path.dirname(path.resolve(opts.commentFile)), { recursive: true });
             fs.writeFileSync(opts.commentFile, comment);
         }
         catch (err) {
-            process.stderr.write(`  ⚠ could not write comment file: ${err instanceof Error ? err.message : err}\n`);
+            process.stderr.write(`  ${g.warning} could not write comment file: ${err instanceof Error ? err.message : err}\n`);
         }
     }
-    write(`${formatTryNext()}\n\n`);
+    write(`${formatTryNext(paint)}\n\n`);
     return receipt.ok ? 0 : 1;
 }
 export function registerTryCommand(program) {
@@ -268,13 +287,26 @@ export function registerTryCommand(program) {
         .option("--fast", "Replay instantly instead of pacing the progress")
         .option("--pace <ms>", `Milliseconds each node takes to replay (default ${DEFAULT_TRY_PACE_MS})`)
         .option("--comment-file <path>", "Also write the PR-comment markdown to <path>")
+        .option("--record <file.svg>", "Write the demo as an animated, self-contained SVG terminal recording to <file.svg>")
         .addHelpText("after", `\n${TRY_HELP_NOTE}\n`)
         .action(async (options) => {
+        if (options.record) {
+            try {
+                const { recordTrySvgToFile } = await import("./record.js");
+                const bytes = await recordTrySvgToFile(options.record);
+                process.stdout.write(`  wrote ${options.record} (${bytes} bytes)\n`);
+            }
+            catch (err) {
+                console.error(`\n  could not record the demo: ${err instanceof Error ? err.message : err}\n`);
+                process.exitCode = 1;
+            }
+            return;
+        }
         let paceMs;
         if (options.pace !== undefined) {
             paceMs = Number(options.pace);
             if (!Number.isFinite(paceMs) || paceMs < 0) {
-                console.error(chalk.red(`\n  --pace must be a non-negative number of milliseconds, got "${options.pace}"\n`));
+                console.error(createPaint(colorEnabled(process.stderr)).error(`\n  --pace must be a non-negative number of milliseconds, got "${options.pace}"\n`));
                 process.exitCode = 1;
                 return;
             }

package/dist/cli/upgrade.js

@@ -154,7 +154,7 @@ export async function runUpgrade(options, deps) {
         latest = await deps.fetchLatestVersion(tag);
     }
     catch (err) {
-        stderr.write(chalk.red(`  Error: couldn't reach the npm registry — ${err instanceof Error ? err.message : String(err)}`) +
+        stderr.write(chalk.red(`  Error: couldn't reach the npm registry - ${err instanceof Error ? err.message : String(err)}`) +
             "\n");
         stderr.write(chalk.dim("  Check your network connection and try again.") + "\n");
         exit(1);

package/dist/executor.d.ts

@@ -12,7 +12,8 @@
  *
  * This replaces ~8k lines of engine + recipe step code.
  */
-import type { Workflow, Skill, Tool, Claude, Observer, Logger, ExecutionResult } from "./types.js";
+import type { Workflow, Skill, Tool, Claude, Observer, NodeResult, Logger, ExecutionResult } from "./types.js";
+import "./skills/git-push.js";
 import type { HarnessPolicyMode } from "./harness/policy.js";
 import type { AgentHarness } from "./harness/types.js";
 import type { DeciderMode } from "./decider.js";
@@ -138,6 +139,12 @@ export declare class RouteEvaluationError extends Error {
     readonly node: string;
     constructor(node: string, message: string);
 }
+/**
+ * The bounded prompt context for one node: `input` plus its dependencies' entries.
+ * Exported for the property tests only; not part of the package API (index.ts does not re-export it).
+ * @internal
+ */
+export declare function buildBoundedContext(workflow: Workflow, nodeId: string, results: Map<string, NodeResult>, input: unknown, instruction: string): Record<string, unknown>;
 /**
  * Dry-run tool gate (#380). Only an explicit `access: "read"` passes; a tool
  * with no `access` is treated as a write so new tools fail safe.

package/dist/executor.js

@@ -22,6 +22,9 @@ import { resolveExecutionModel } from "./model.js";
 import { buildToolAliases } from "./skills/index.js";
 import { validateWorkflow } from "./schema.js";
 import { grantedAgentEnv, resolveAgentAccess } from "./agent-env.js";
+import { gitCredentialWarning, scanGitCredentials } from "./git-credentials.js";
+// #473: arms the sweny-side branch push in `github_create_pr` (Node only; skills/ stays browser-safe).
+import "./skills/git-push.js";
 import { fenceUntrusted } from "./untrusted.js";
 import { asClaude } from "./harness/compat.js";
 import { budgetGate, isToolClass, policyGate, resolveHarnessPolicy } from "./harness/policy.js";
@@ -89,6 +92,17 @@ export async function execute(workflow, input, options) {
     // `budget` and the caller's (`--max-tokens`, `--max-cost`).
     const budgetGuard = new BudgetGuard(minLimits(toLimits(workflow.budget), toLimits(options.budget)));
     const harnessPolicy = options.harnessPolicy ?? resolveHarnessPolicy(runEnv);
+    // #473: a checkout that persisted a git credential (actions/checkout's
+    // default). Each harness masks it for read-only and staged nodes, or reports
+    // the node degraded; this says so once per run. Paths and keys, never values.
+    try {
+        const credentialWarning = gitCredentialWarning(scanGitCredentials(process.cwd(), { env: runEnv }));
+        if (credentialWarning)
+            logger.warn(credentialWarning);
+    }
+    catch {
+        // A scan failure never stops a run; each node scans again before it starts.
+    }
     // Decision model (#357): shadow only. Null (the default) means no HTTP at all.
     const shadow = createShadowDecider(workflow.decider, options.decider, runEnv, (m) => logger.warn(m));
     if (shadow)
@@ -911,8 +925,12 @@ function contextDependencies(workflow, nodeId, instruction = "") {
     }
     return deps;
 }
-/** The bounded prompt context for one node: `input` plus its dependencies' entries. */
-function buildBoundedContext(workflow, nodeId, results, input, instruction) {
+/**
+ * The bounded prompt context for one node: `input` plus its dependencies' entries.
+ * Exported for the property tests only; not part of the package API (index.ts does not re-export it).
+ * @internal
+ */
+export function buildBoundedContext(workflow, nodeId, results, input, instruction) {
     const deps = contextDependencies(workflow, nodeId, instruction);
     return {
         input,