@sweny-ai/core 0.1.171 → 0.1.173

package/dist/agent-env.js

@@ -29,6 +29,7 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
+import { runKeyDir } from "./journal.js";
 // ─── Scoped env ──────────────────────────────────────────────────
 /**
  * Exact variable names always passed to the agent subprocess.
@@ -956,7 +957,11 @@ export function buildSandboxSettings(domains, opts = {}) {
         },
         credentials: {
             envVars: AGENT_AUTH_VARS.map((name) => ({ name, mode: "deny" })),
-            files: [{ path: path.join(opts.home ?? homedir(), ".claude", ".credentials.json"), mode: "deny" }],
+            files: [
+                { path: path.join(opts.home ?? homedir(), ".claude", ".credentials.json"), mode: "deny" },
+                // Run journal keys: an agent that could read them could forge journal records.
+                { path: runKeyDir(), mode: "deny" },
+            ],
         },
     };
 }

package/dist/budget.d.ts

@@ -16,6 +16,8 @@
  *   the attempt's signal, which stops the agent (harness cancel).
  * - between nodes: usage on the finished result is checked; a crossing fails the
  *   node, and the run halts before the next node starts.
+ * - across a resume: the run journal records each attempt's spend (live and
+ *   final), and `sweny workflow resume` seeds the run total with it.
  */
 import type { NodeUsage } from "./types.js";
 /** The `budget` field of a node or workflow. */
@@ -69,6 +71,12 @@ export declare class BudgetGuard {
     /** The run ceiling is already reached: no further attempt may start. */
     runExhausted(): BudgetOverrun | undefined;
     node(nodeLimits: SpendLimits): NodeBudget;
+    /**
+     * Spend the run made before this process (a resumed run's journaled usage).
+     * Counted against the run ceiling like any other spend, so a crash never
+     * resets the whole-run budget.
+     */
+    seed(s: Spend): void;
     /** @internal */
     commit(s: Spend): void;
 }

package/dist/budget.js

@@ -16,6 +16,8 @@
  *   the attempt's signal, which stops the agent (harness cancel).
  * - between nodes: usage on the finished result is checked; a crossing fails the
  *   node, and the run halts before the next node starts.
+ * - across a resume: the run journal records each attempt's spend (live and
+ *   final), and `sweny workflow resume` seeds the run total with it.
  */
 const isNum = (v) => typeof v === "number" && Number.isFinite(v);
 export function toLimits(b) {
@@ -89,6 +91,15 @@ export class BudgetGuard {
     node(nodeLimits) {
         return new NodeBudget(this, nodeLimits);
     }
+    /**
+     * Spend the run made before this process (a resumed run's journaled usage).
+     * Counted against the run ceiling like any other spend, so a crash never
+     * resets the whole-run budget.
+     */
+    seed(s) {
+        const ok = (n) => (Number.isFinite(n) && n > 0 ? n : 0);
+        this.commit({ tokens: ok(s.tokens), costUsd: ok(s.costUsd) });
+    }
     /** @internal */
     commit(s) {
         this.spent = { tokens: this.spent.tokens + s.tokens, costUsd: this.spent.costUsd + s.costUsd };

package/dist/cli/check.js

@@ -63,7 +63,7 @@ export async function checkProviderConnectivity(config, opts = {}) {
             results.push(await checkSentry(creds));
         }
         else if (provider === "file") {
-            results.push({ name: "Observability (file)", status: "skip", detail: "File provider — no network check needed" });
+            results.push({ name: "Observability (file)", status: "skip", detail: "File provider - no network check needed" });
         }
         else {
             results.push({
@@ -89,7 +89,7 @@ export async function checkProviderConnectivity(config, opts = {}) {
         results.push({
             name: "Issue tracker (file)",
             status: "skip",
-            detail: "File provider — no network check needed",
+            detail: "File provider - no network check needed",
         });
     }
     else {
@@ -118,7 +118,7 @@ export async function checkProviderConnectivity(config, opts = {}) {
         results.push({
             name: "Source control (file)",
             status: "skip",
-            detail: "File provider — no network check needed",
+            detail: "File provider - no network check needed",
         });
     }
     else {
@@ -145,7 +145,7 @@ async function checkAnthropic(apiKey) {
             return {
                 name,
                 status: "fail",
-                detail: "401 Unauthorized — check ANTHROPIC_API_KEY at https://console.anthropic.com",
+                detail: "401 Unauthorized - check ANTHROPIC_API_KEY at https://console.anthropic.com",
             };
         }
         return { name, status: "fail", detail: `Unexpected HTTP ${res.status}` };
@@ -220,7 +220,7 @@ export async function checkDatadog(creds) {
         return {
             name,
             status: "fail",
-            detail: `Invalid DD_SITE "${site}" — expected a hostname like datadoghq.com or datadoghq.eu`,
+            detail: `Invalid DD_SITE "${site}" - expected a hostname like datadoghq.com or datadoghq.eu`,
         };
     }
     try {
@@ -235,7 +235,7 @@ export async function checkDatadog(creds) {
             return {
                 name,
                 status: "fail",
-                detail: "403 Forbidden — check DD_API_KEY and DD_APP_KEY at https://app.datadoghq.com/organization-settings/api-keys",
+                detail: "403 Forbidden - check DD_API_KEY and DD_APP_KEY at https://app.datadoghq.com/organization-settings/api-keys",
             };
         }
         return { name, status: "fail", detail: `Unexpected HTTP ${res.status}` };
@@ -262,7 +262,7 @@ async function checkSentry(creds) {
             return {
                 name,
                 status: "fail",
-                detail: "401 Unauthorized — check SENTRY_AUTH_TOKEN at https://sentry.io/settings/auth-tokens/",
+                detail: "401 Unauthorized - check SENTRY_AUTH_TOKEN at https://sentry.io/settings/auth-tokens/",
             };
         }
         return { name, status: "fail", detail: `Unexpected HTTP ${res.status}` };
@@ -286,7 +286,7 @@ async function checkLinear(apiKey) {
         if (res.status === 200) {
             const body = (await res.json());
             if (body.errors?.length) {
-                return { name, status: "fail", detail: "GraphQL error — check LINEAR_API_KEY" };
+                return { name, status: "fail", detail: "GraphQL error - check LINEAR_API_KEY" };
             }
             const displayName = body.data?.viewer?.name ?? "authenticated";
             return { name, status: "ok", detail: `Authenticated as ${displayName}` };
@@ -295,7 +295,7 @@ async function checkLinear(apiKey) {
             return {
                 name,
                 status: "fail",
-                detail: "401 Unauthorized — check LINEAR_API_KEY at https://linear.app/settings/api",
+                detail: "401 Unauthorized - check LINEAR_API_KEY at https://linear.app/settings/api",
             };
         }
         return { name, status: "fail", detail: `Unexpected HTTP ${res.status}` };
@@ -321,7 +321,7 @@ async function checkGitHub(token, name) {
             return {
                 name,
                 status: "fail",
-                detail: "401 Bad credentials — check GITHUB_TOKEN at https://github.com/settings/tokens",
+                detail: "401 Bad credentials - check GITHUB_TOKEN at https://github.com/settings/tokens",
             };
         }
         return { name, status: "fail", detail: `Unexpected HTTP ${res.status}` };
@@ -335,11 +335,11 @@ function networkErrorMessage(err) {
     // explicit abort surfaces as "AbortError". Either means we gave up waiting.
     const errName = err instanceof Error ? err.name : "";
     if (errName === "TimeoutError" || errName === "AbortError") {
-        return `Connection timed out after ${CHECK_TIMEOUT_MS}ms — host unreachable or too slow`;
+        return `Connection timed out after ${CHECK_TIMEOUT_MS}ms - host unreachable or too slow`;
     }
     const msg = err instanceof Error ? err.message : String(err);
     if (/ENOTFOUND|ETIMEDOUT|ECONNREFUSED/i.test(msg)) {
-        return `Network error — check your internet connection (${msg})`;
+        return `Network error - check your internet connection (${msg})`;
     }
     return msg;
 }

package/dist/cli/config.js

@@ -149,7 +149,7 @@ export function parseCliInputs(options, fileConfig = {}) {
             const fromEnv = env.SWENY_CLOUD_TOKEN || "";
             const fromFile = f("cloud-token") || "";
             if (!fromEnv && fromFile) {
-                console.warn("\x1b[33m⚠ cloud-token is set in .sweny.yml — consider using SWENY_CLOUD_TOKEN env var instead to avoid accidental commits.\x1b[0m");
+                console.warn("\x1b[33m⚠ cloud-token is set in .sweny.yml - consider using SWENY_CLOUD_TOKEN env var instead to avoid accidental commits.\x1b[0m");
             }
             return fromEnv || fromFile;
         })(),
@@ -229,7 +229,7 @@ export function validateInputs(config) {
     switch (config.codingAgentProvider) {
         case "claude":
             if (!config.anthropicApiKey && !config.claudeOauthToken) {
-                errors.push("Missing: ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN — get a key at https://console.anthropic.com");
+                errors.push("Missing: ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN - get a key at https://console.anthropic.com");
             }
             break;
         case "codex":
@@ -262,13 +262,13 @@ export function validateInputs(config) {
         switch (provider) {
             case "datadog":
                 if (!creds.apiKey)
-                    errors.push("Missing: DD_API_KEY — find API keys at https://app.datadoghq.com/organization-settings/api-keys");
+                    errors.push("Missing: DD_API_KEY - find API keys at https://app.datadoghq.com/organization-settings/api-keys");
                 if (!creds.appKey)
-                    errors.push("Missing: DD_APP_KEY — find application keys at https://app.datadoghq.com/organization-settings/application-keys");
+                    errors.push("Missing: DD_APP_KEY - find application keys at https://app.datadoghq.com/organization-settings/application-keys");
                 break;
             case "sentry":
                 if (!creds.authToken)
-                    errors.push("Missing: SENTRY_AUTH_TOKEN — create a token at https://sentry.io/settings/auth-tokens/");
+                    errors.push("Missing: SENTRY_AUTH_TOKEN - create a token at https://sentry.io/settings/auth-tokens/");
                 if (!creds.organization)
                     errors.push("Missing: --sentry-org is required for sentry provider");
                 if (!creds.project)
@@ -342,33 +342,33 @@ export function validateInputs(config) {
                 break;
             case "vercel":
                 if (!creds.token)
-                    errors.push("Missing: VERCEL_TOKEN — create a token at https://vercel.com/account/tokens");
+                    errors.push("Missing: VERCEL_TOKEN - create a token at https://vercel.com/account/tokens");
                 if (!creds.projectId)
-                    errors.push("Missing: VERCEL_PROJECT_ID — find it in your Vercel project settings");
+                    errors.push("Missing: VERCEL_PROJECT_ID - find it in your Vercel project settings");
                 break;
             case "supabase":
                 if (!creds.managementApiKey)
-                    errors.push("Missing: SUPABASE_MANAGEMENT_KEY — create a token at https://supabase.com/dashboard/account/tokens");
+                    errors.push("Missing: SUPABASE_MANAGEMENT_KEY - create a token at https://supabase.com/dashboard/account/tokens");
                 if (!creds.projectRef)
-                    errors.push("Missing: SUPABASE_PROJECT_REF — find it in your Supabase project settings > General");
+                    errors.push("Missing: SUPABASE_PROJECT_REF - find it in your Supabase project settings > General");
                 break;
             case "netlify":
                 if (!creds.token)
-                    errors.push("Missing: NETLIFY_TOKEN — create a token at https://app.netlify.com/user/applications#personal-access-tokens");
+                    errors.push("Missing: NETLIFY_TOKEN - create a token at https://app.netlify.com/user/applications#personal-access-tokens");
                 if (!creds.siteId)
-                    errors.push("Missing: NETLIFY_SITE_ID — find it in Site Settings > General > Site details");
+                    errors.push("Missing: NETLIFY_SITE_ID - find it in Site Settings > General > Site details");
                 break;
             case "fly":
                 if (!creds.token)
-                    errors.push("Missing: FLY_TOKEN — create a token at https://fly.io/user/personal_access_tokens");
+                    errors.push("Missing: FLY_TOKEN - create a token at https://fly.io/user/personal_access_tokens");
                 if (!creds.appName)
-                    errors.push("Missing: FLY_APP_NAME — the name of your Fly.io application");
+                    errors.push("Missing: FLY_APP_NAME - the name of your Fly.io application");
                 break;
             case "render":
                 if (!creds.apiKey)
-                    errors.push("Missing: RENDER_API_KEY — create an API key at https://dashboard.render.com/u/settings");
+                    errors.push("Missing: RENDER_API_KEY - create an API key at https://dashboard.render.com/u/settings");
                 if (!creds.serviceId)
-                    errors.push("Missing: RENDER_SERVICE_ID — find it in your service's Settings page (srv-...)");
+                    errors.push("Missing: RENDER_SERVICE_ID - find it in your service's Settings page (srv-...)");
                 break;
             default:
                 errors.push(`Unknown --observability-provider "${provider}". Valid values: none, datadog, sentry, cloudwatch, splunk, elastic, newrelic, loki, prometheus, pagerduty, honeycomb, heroku, opsgenie, axiom, betterstack, vercel, supabase, netlify, fly, render, file`);
@@ -378,17 +378,17 @@ export function validateInputs(config) {
     switch (config.issueTrackerProvider) {
         case "linear":
             if (!config.linearApiKey)
-                errors.push("Missing: LINEAR_API_KEY — find API keys at https://linear.app/settings/api");
+                errors.push("Missing: LINEAR_API_KEY - find API keys at https://linear.app/settings/api");
             if (!config.linearTeamId)
-                errors.push("Missing: LINEAR_TEAM_ID — find it in Linear > Settings > Workspace > Teams > [your team] > copy the ID from the URL");
+                errors.push("Missing: LINEAR_TEAM_ID - find it in Linear > Settings > Workspace > Teams > [your team] > copy the ID from the URL");
             break;
         case "jira":
             if (!config.jiraBaseUrl)
-                errors.push("Missing: JIRA_BASE_URL — set to your Atlassian domain, e.g. https://your-org.atlassian.net");
+                errors.push("Missing: JIRA_BASE_URL - set to your Atlassian domain, e.g. https://your-org.atlassian.net");
             if (!config.jiraEmail)
-                errors.push("Missing: JIRA_EMAIL — your Atlassian account email address");
+                errors.push("Missing: JIRA_EMAIL - your Atlassian account email address");
             if (!config.jiraApiToken)
-                errors.push("Missing: JIRA_API_TOKEN — create a token at https://id.atlassian.com/manage-profile/security/api-tokens");
+                errors.push("Missing: JIRA_API_TOKEN - create a token at https://id.atlassian.com/manage-profile/security/api-tokens");
             break;
         case "github-issues":
         case "file":
@@ -401,13 +401,13 @@ export function validateInputs(config) {
     switch (config.sourceControlProvider) {
         case "github":
             if (!config.githubToken && !config.botToken)
-                errors.push("Missing: GITHUB_TOKEN — create a Personal Access Token at https://github.com/settings/tokens");
+                errors.push("Missing: GITHUB_TOKEN - create a Personal Access Token at https://github.com/settings/tokens");
             break;
         case "gitlab":
             if (!config.gitlabToken)
-                errors.push("Missing: GITLAB_TOKEN — create a Personal Access Token at https://gitlab.com/-/user_settings/personal_access_tokens (api + read_repository + write_repository scopes)");
+                errors.push("Missing: GITLAB_TOKEN - create a Personal Access Token at https://gitlab.com/-/user_settings/personal_access_tokens (api + read_repository + write_repository scopes)");
             if (!config.gitlabProjectId)
-                errors.push("Missing: GITLAB_PROJECT_ID — find it in GitLab > [your project] > Settings > General (numeric ID at the top)");
+                errors.push("Missing: GITLAB_PROJECT_ID - find it in GitLab > [your project] > Settings > General (numeric ID at the top)");
             break;
         case "file":
             // No external credentials needed
@@ -670,7 +670,7 @@ export function registerImplementCommand(program) {
         .option("--coding-agent-provider <provider>", "Coding agent provider (alias for --agent)")
         .option("--issue-tracker-provider <provider>", "Issue tracker (linear|jira|github-issues|file)")
         .option("--source-control-provider <provider>", "Source control (github|gitlab|file)")
-        .option("--dry-run", "Skip creating PR — report only", false)
+        .option("--dry-run", "Skip creating PR - report only", false)
         .option("--stage", "Run normally, but preview the PR and issue comment instead of writing them", false)
         .option("--max-implement-turns <n>", "Max coding agent turns (default: 40)")
         .option("--base-branch <branch>", "Base branch for PRs (default: main)")

package/dist/cli/e2e.js

@@ -87,17 +87,17 @@ This returns element references like @e1, @e2, @e3.
 Use those refs with: agent-browser click @e5, agent-browser fill @e7 "text", etc.
 
 Available commands:
-- agent-browser open <url> — navigate to URL
-- agent-browser snapshot — get accessibility tree with @refs
-- agent-browser click <ref> — click an element
-- agent-browser fill <ref> <text> — clear input and fill with text
-- agent-browser press <key> — press keyboard key (Enter, Tab, Escape)
-- agent-browser get url — get current page URL
-- agent-browser get text <ref> — get element text content
-- agent-browser screenshot <path> — save screenshot to file
-- agent-browser scroll <direction> <pixels> — scroll page
-- agent-browser scrollintoview <ref> — scroll element into view
-- agent-browser select <ref> <value> — select dropdown option`,
+- agent-browser open <url> - navigate to URL
+- agent-browser snapshot - get accessibility tree with @refs
+- agent-browser click <ref> - click an element
+- agent-browser fill <ref> <text> - clear input and fill with text
+- agent-browser press <key> - press keyboard key (Enter, Tab, Escape)
+- agent-browser get url - get current page URL
+- agent-browser get text <ref> - get element text content
+- agent-browser screenshot <path> - save screenshot to file
+- agent-browser scroll <direction> <pixels> - scroll page
+- agent-browser scrollintoview <ref> - scroll element into view
+- agent-browser select <ref> <value> - select dropdown option`,
         skills: [],
         output: {
             type: "object",
@@ -142,7 +142,7 @@ Use curl to call the Supabase Admin API:
 2. Filter for emails starting with "e2e-" and ending with "@yourapp.test"
 3. Delete each matching user: DELETE {SUPABASE_URL}/auth/v1/admin/users/{user_id}
 
-If no test users are found, that's fine — skip gracefully.
+If no test users are found, that's fine - skip gracefully.
 If the service role key is not available, skip cleanup gracefully.`;
             break;
         case "firebase":
@@ -501,7 +501,7 @@ const CLEANUP_ENV_VARS = {
  */
 export function buildE2eEnvTemplate(selections) {
     const lines = [];
-    lines.push("# E2E Testing — SWEny");
+    lines.push("# E2E Testing - SWEny");
     lines.push("# Fill in values, then run: sweny workflow run");
     lines.push("");
     lines.push(`E2E_BASE_URL=${selections.baseUrl}`);
@@ -640,7 +640,7 @@ export async function runE2eInit(options = {}) {
             if (p.isCancel(overwrite))
                 cancel();
             if (!overwrite) {
-                p.cancel("Setup cancelled — existing files preserved.");
+                p.cancel("Setup cancelled - existing files preserved.");
                 process.exit(0);
             }
         }
@@ -741,7 +741,7 @@ export async function runE2eInit(options = {}) {
             p.log.success(`Appended E2E vars to ${chalk.cyan(".env")}`);
         }
         else {
-            p.log.warn(".env already has E2E vars — skipped");
+            p.log.warn(".env already has E2E vars - skipped");
         }
     }
     else {
@@ -930,10 +930,10 @@ export async function runE2eRun(options) {
                     const elapsed = ((Date.now() - enterTime) / 1000).toFixed(1);
                     const status = event.result.data?.status || event.result.status;
                     if (isTTY) {
-                        process.stderr.write(`\x1B[1A\x1B[2K  ${icon} ${event.node} — ${status} (${elapsed}s)\n`);
+                        process.stderr.write(`\x1B[1A\x1B[2K  ${icon} ${event.node} - ${status} (${elapsed}s)\n`);
                     }
                     else {
-                        process.stderr.write(`  ${icon} ${event.node} — ${status} (${elapsed}s)\n`);
+                        process.stderr.write(`  ${icon} ${event.node} - ${status} (${elapsed}s)\n`);
                     }
                     break;
                 }

package/dist/cli/final-output.d.ts

@@ -4,9 +4,15 @@
  *
  * Unlike run-history and the receipt, this DOES read node output. It is
  * local-only: printed to the terminal and saved to
- * `.sweny/runs/<run-id>/output.md`. Nothing here is sent to the cloud.
+ * `.sweny/runs/<run-id>/output.md` (mode 0600). Nothing here is sent to the cloud.
+ *
+ * Secrets: node data is redacted with the run journal's redactor before
+ * anything renders (secret env and skill credential values, secret-named
+ * fields, known token shapes). In CI the answer is not printed unless asked
+ * (`--show-output`), since CI logs are often visible to more people than the
+ * repo's secrets are.
  */
-import type { JSONSchema, NodeResult, Workflow } from "../types.js";
+import type { ExecutionTrace, JSONSchema, NodeResult, Workflow } from "../types.js";
 /** Lines of the answer printed to the terminal before the rest is left in output.md. */
 export declare const FINAL_OUTPUT_MAX_LINES = 60;
 export interface FinalOutput {
@@ -18,12 +24,26 @@ export interface FinalOutput {
 }
 /** Render a node's declared output fields as a compact `key: value` block. Empty when nothing declared is present. */
 export declare function renderSchemaOutput(data: Record<string, unknown>, schema: JSONSchema): string[];
+export interface ResolveFinalOutputOptions {
+    /** The run's trace: the answer comes from the last successful visit in execution order. */
+    trace?: Pick<ExecutionTrace, "steps">;
+    /** Secret values to redact (default: secret-named values in `process.env`). */
+    secrets?: string[];
+}
 /**
- * Pick what the user should see: the last-run terminal node's result on
- * success, the first failed node's error on failure. Null when there is
+ * Pick what the user should see: the result of the last successful visit
+ * (from the trace, so a loop that ends on an earlier node shows that node) on
+ * success, the first failed node's error on failure. Without a trace, terminal
+ * nodes in result order. Everything is redacted first. Null when there is
  * nothing to show (no schema fields and no summary text).
  */
-export declare function resolveFinalOutput(workflow: Workflow, results: Map<string, NodeResult>): FinalOutput | null;
+export declare function resolveFinalOutput(workflow: Workflow, results: Map<string, NodeResult>, opts?: ResolveFinalOutputOptions): FinalOutput | null;
+/** True when the environment is CI (GitHub Actions, or a truthy `CI`). */
+export declare function isCiEnv(env: Record<string, string | undefined>): boolean;
+/** Print the answer block? Always outside CI; in CI only with `--show-output`. */
+export declare function shouldPrintFinalOutput(showOutput: boolean, env: Record<string, string | undefined>): boolean;
+/** The one line printed in CI instead of the answer. */
+export declare function formatSavedOutputLine(savedTo: string | null): string;
 /**
  * Terminal text: the first `maxLines` lines, then
  * `... (N more lines, see .sweny/runs/<id>/output.md)`. When no file was
@@ -37,5 +57,5 @@ export declare function formatFinalOutput(out: FinalOutput, opts?: {
 export declare function formatFinalMarkdown(workflow: Workflow, out: FinalOutput): string;
 /** Relative path shown to the user: `.sweny/runs/<id>/output.md`. */
 export declare function outputRelPath(runId: string): string;
-/** Write output.md. Local only. Returns the relative path, or null on failure. Never throws. */
+/** Write output.md (mode 0600). Local only. Returns the relative path, or null on failure. Never throws. */
 export declare function writeFinalOutput(runId: string, markdown: string, cwd?: string): string | null;

package/dist/cli/final-output.js

@@ -4,10 +4,17 @@
  *
  * Unlike run-history and the receipt, this DOES read node output. It is
  * local-only: printed to the terminal and saved to
- * `.sweny/runs/<run-id>/output.md`. Nothing here is sent to the cloud.
+ * `.sweny/runs/<run-id>/output.md` (mode 0600). Nothing here is sent to the cloud.
+ *
+ * Secrets: node data is redacted with the run journal's redactor before
+ * anything renders (secret env and skill credential values, secret-named
+ * fields, known token shapes). In CI the answer is not printed unless asked
+ * (`--show-output`), since CI logs are often visible to more people than the
+ * repo's secrets are.
  */
 import fs from "node:fs";
 import path from "node:path";
+import { collectSecretValues, redact } from "../journal.js";
 import { RUN_HISTORY_DIR } from "./run-history.js";
 /** Lines of the answer printed to the terminal before the rest is left in output.md. */
 export const FINAL_OUTPUT_MAX_LINES = 60;
@@ -83,30 +90,52 @@ function trimBlock(text) {
     return lines.map((l) => l.replace(/\s+$/, ""));
 }
 /**
- * Pick what the user should see: the last-run terminal node's result on
- * success, the first failed node's error on failure. Null when there is
+ * Pick what the user should see: the result of the last successful visit
+ * (from the trace, so a loop that ends on an earlier node shows that node) on
+ * success, the first failed node's error on failure. Without a trace, terminal
+ * nodes in result order. Everything is redacted first. Null when there is
  * nothing to show (no schema fields and no summary text).
  */
-export function resolveFinalOutput(workflow, results) {
+export function resolveFinalOutput(workflow, results, opts = {}) {
+    const secrets = opts.secrets ?? collectSecretValues(process.env);
+    const clean = (v) => redact(v, secrets).value;
     for (const [id, r] of results) {
         if (r.status !== "failed")
             continue;
         const err = r.data?.error;
-        const text = typeof err === "string" && err.trim() !== "" ? err : "node failed";
+        const text = typeof err === "string" && err.trim() !== "" ? clean(err) : "node failed";
         return { kind: "error", node: id, lines: trimBlock(text) };
     }
-    const hasOutgoing = new Set(workflow.edges.map((e) => e.from));
-    const succeeded = [...results].filter(([, r]) => r.status === "success");
-    const terminal = succeeded.filter(([id]) => !hasOutgoing.has(id));
-    // Walk back from the end: the last node that actually yields something wins.
-    const candidates = [...(terminal.length > 0 ? terminal : succeeded)].reverse();
+    let candidates;
+    if (opts.trace && opts.trace.steps.length > 0) {
+        // Last successful visit first: walk the trace backwards, each node once.
+        const seen = new Set();
+        candidates = [];
+        for (let i = opts.trace.steps.length - 1; i >= 0; i--) {
+            const step = opts.trace.steps[i];
+            if (step.status !== "success" || seen.has(step.node))
+                continue;
+            seen.add(step.node);
+            const r = results.get(step.node);
+            if (r?.status === "success")
+                candidates.push([step.node, r]);
+        }
+    }
+    else {
+        const hasOutgoing = new Set(workflow.edges.map((e) => e.from));
+        const succeeded = [...results].filter(([, r]) => r.status === "success");
+        const terminal = succeeded.filter(([id]) => !hasOutgoing.has(id));
+        // Walk back from the end: the last node that actually yields something wins.
+        candidates = [...(terminal.length > 0 ? terminal : succeeded)].reverse();
+    }
     for (const [id, r] of candidates) {
+        const data = clean(r.data ?? {});
         const schema = workflow.nodes[id]?.output;
         let lines = [];
         if (schema)
-            lines = renderSchemaOutput(r.data ?? {}, schema);
+            lines = renderSchemaOutput(data, schema);
         if (lines.length === 0) {
-            const summary = r.data?.summary;
+            const summary = data.summary;
             if (typeof summary === "string" && summary.trim() !== "")
                 lines = trimBlock(summary);
         }
@@ -115,6 +144,23 @@ export function resolveFinalOutput(workflow, results) {
     }
     return null;
 }
+/** True when the environment is CI (GitHub Actions, or a truthy `CI`). */
+export function isCiEnv(env) {
+    if (env.GITHUB_ACTIONS === "true")
+        return true;
+    const ci = env.CI?.trim().toLowerCase();
+    return !!ci && ci !== "false" && ci !== "0";
+}
+/** Print the answer block? Always outside CI; in CI only with `--show-output`. */
+export function shouldPrintFinalOutput(showOutput, env) {
+    return showOutput || !isCiEnv(env);
+}
+/** The one line printed in CI instead of the answer. */
+export function formatSavedOutputLine(savedTo) {
+    return savedTo
+        ? `  answer saved to ${savedTo} (pass --show-output to print it in CI)`
+        : "  answer not printed in CI (pass --show-output to print it)";
+}
 /**
  * Terminal text: the first `maxLines` lines, then
  * `... (N more lines, see .sweny/runs/<id>/output.md)`. When no file was
@@ -140,13 +186,16 @@ export function formatFinalMarkdown(workflow, out) {
 export function outputRelPath(runId) {
     return path.posix.join(...RUN_HISTORY_DIR.split(path.sep), runId, "output.md");
 }
-/** Write output.md. Local only. Returns the relative path, or null on failure. Never throws. */
+/** Write output.md (mode 0600). Local only. Returns the relative path, or null on failure. Never throws. */
 export function writeFinalOutput(runId, markdown, cwd = process.cwd()) {
     try {
         const rel = outputRelPath(runId);
         const file = path.join(cwd, rel);
-        fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(file, markdown);
+        fs.mkdirSync(path.dirname(path.dirname(file)), { recursive: true });
+        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(file, markdown, { mode: 0o600 });
+        // mode only applies on create: a resumed run overwrites an existing file.
+        fs.chmodSync(file, 0o600);
         return rel;
     }
     catch {

package/dist/cli/main.js

@@ -31,11 +31,11 @@ import * as readline from "node:readline";
 import { loadDotenv, loadConfigFile, applyAgentFileConfig } from "./config-file.js";
 import { buildCredentialMap } from "./credentials.js";
 import { nonInteractiveUsage, runNew } from "./new.js";
-import { formatFinalMarkdown, formatFinalOutput, resolveFinalOutput, writeFinalOutput } from "./final-output.js";
+import { formatFinalMarkdown, formatFinalOutput, formatSavedOutputLine, resolveFinalOutput, shouldPrintFinalOutput, writeFinalOutput, } from "./final-output.js";
 import { buildRunRecord, createNodeTimer, historyDisabled, newRunId, recordRun } from "./run-history.js";
 import { registerRunsCommand } from "./runs.js";
 import { registerTryCommand } from "./try.js";
-import { JournalLockedError, JournalMismatchError, RunJournal } from "../journal.js";
+import { JournalLockedError, JournalMismatchError, RunJournal, runSecretValues } from "../journal.js";
 import { journalDisabled, prepareResume, RESUME_SHARED_RUN_FLAGS, WORKFLOW_RESUME_OPTIONS, } from "./resume.js";
 import { runE2eRun, runWithWallClockBudget, DEFAULT_WORKFLOW_TIMEOUT_MS } from "./e2e.js";
 import { createVerboseToolObserver } from "./verbose-observer.js";
@@ -1102,12 +1102,18 @@ resume) {
         writeStepSummary(workflow, results, receipt, trace);
         // The answer, above the receipt: the terminal node's result, or the failed node's error.
         // Also saved to .sweny/runs/<id>/output.md (local only; --no-history skips the file).
-        const finalOutput = resolveFinalOutput(workflow, results);
+        // Redacted with the journal's redactor; in CI printed only with --show-output.
+        const finalOutput = resolveFinalOutput(workflow, results, {
+            trace,
+            secrets: runSecretValues([...skills.values(), ...builtinSkills], process.env),
+        });
         if (finalOutput) {
             const savedTo = historyDisabled(options.history, fileConfig["history"])
                 ? null
                 : writeFinalOutput(runId, formatFinalMarkdown(workflow, finalOutput));
-            const block = formatFinalOutput(finalOutput, { outputPath: savedTo });
+            const block = shouldPrintFinalOutput(options.showOutput === true, process.env)
+                ? formatFinalOutput(finalOutput, { outputPath: savedTo })
+                : formatSavedOutputLine(savedTo);
             if (wfHasFailed)
                 console.error(`${block}\n`);
             else
@@ -1245,6 +1251,7 @@ for (const [flags, description] of WORKFLOW_RUN_OPTIONS) {
     workflowRunCmd.option(flags, description);
 }
 workflowRunCmd.option("--no-history", "Do not record this run or save its output.md in .sweny/runs/ (or set `history: off` in .sweny.yml)");
+workflowRunCmd.option("--show-output", "Print the final answer in CI too (off by default in CI: only the path to output.md is printed)");
 workflowRunCmd.option("--no-journal", "Do not write a run journal to .sweny/runs/<run-id>/ (or set `journal: off` in .sweny.yml); the run cannot be resumed");
 const workflowResumeCmd = workflowCmd
     .command("resume <run-id>")
@@ -1283,6 +1290,7 @@ for (const [flags, description] of WORKFLOW_RUN_OPTIONS) {
         workflowResumeCmd.option(flags, description);
 }
 workflowResumeCmd.option("--no-history", "Do not update this run's record in .sweny/runs/");
+workflowResumeCmd.option("--show-output", "Print the final answer in CI too (off by default in CI)");
 registerRunsCommand(program);
 workflowCmd
     .command("diagram <file>")

package/dist/cli/marketplace.js

@@ -22,7 +22,7 @@ export async function fetchMarketplaceWorkflow(id) {
         res = await fetch(url);
     }
     catch {
-        const err = new Error(`Could not reach github.com — check your connection`);
+        const err = new Error(`Could not reach github.com - check your connection`);
         err.kind = "network";
         throw err;
     }
@@ -147,8 +147,8 @@ export async function adaptWorkflowInteractive(workflow, options) {
         const action = await p.select({
             message: "Looks good?",
             options: [
-                { value: "accept", label: "Yes — use this workflow" },
-                { value: "refine", label: "Refine — describe what to change" },
+                { value: "accept", label: "Yes - use this workflow" },
+                { value: "refine", label: "Refine - describe what to change" },
                 { value: "cancel", label: "Cancel" },
             ],
         });