@sweny-ai/core 0.1.173 → 0.1.174

package/dist/cli/main.js

@@ -39,6 +39,7 @@ import { JournalLockedError, JournalMismatchError, RunJournal, runSecretValues }
 import { journalDisabled, prepareResume, RESUME_SHARED_RUN_FLAGS, WORKFLOW_RESUME_OPTIONS, } from "./resume.js";
 import { runE2eRun, runWithWallClockBudget, DEFAULT_WORKFLOW_TIMEOUT_MS } from "./e2e.js";
 import { createVerboseToolObserver } from "./verbose-observer.js";
+import { createStreamObserver } from "./stream-observer.js";
 import { createRunLogger, summarizeRun, writeStepSummary, WORKFLOW_RUN_DESCRIPTION, WORKFLOW_RUN_OPTIONS, } from "./run-output.js";
 import { writeRunComment } from "./comment-output.js";
 import { writeReceipt } from "./ticket.js";
@@ -56,15 +57,9 @@ import { beginCloudLifecycle, finishCloudLifecycle, createCloudStreamObserver }
 import { runUpgrade, fetchLatestFromNpm } from "./upgrade.js";
 import { maybeNudge, defaultCachePath } from "./version-check.js";
 import { spawnSync } from "node:child_process";
-// ── Stream observer (NDJSON) ────────────────────────────────────────
-/**
- * Create an observer that writes NDJSON ExecutionEvents to stdout.
- * Studio and other consumers parse these line-by-line.
- */
-function createStreamObserver() {
-    return (event) => {
-        process.stdout.write(JSON.stringify(event) + "\n");
-    };
+/** Secret values a run can see, for redacting everything that prints node output. */
+function outputSecrets(skills) {
+    return runSecretValues([...(skills?.values() ?? []), ...builtinSkills], process.env);
 }
 // Verbose tool-detail observer lives in ./verbose-observer.ts so tests can
 // import it without triggering main.ts's top-level CLI parser.
@@ -446,7 +441,7 @@ triageCmd.action(async (options) => {
     if (cloudHandle?.dashboardUrl) {
         console.log(c.subtle(`  cloud: ${cloudHandle.dashboardUrl}`));
     }
-    const observer = composeObservers(progressObserver, config.verbose ? createVerboseToolObserver() : undefined, config.stream ? createStreamObserver() : undefined, createCloudStreamObserver(config, cloudHandle));
+    const observer = composeObservers(progressObserver, config.verbose ? createVerboseToolObserver() : undefined, config.stream ? createStreamObserver(outputSecrets(skills)) : undefined, createCloudStreamObserver(config, cloudHandle));
     // #365: pin safe outputs to the configured tracker and repo; nodes these
     // providers cannot run read-only or through safe outputs keep their old shape.
     const triageRun = bindForCli(triageWorkflow, config);
@@ -466,7 +461,7 @@ triageCmd.action(async (options) => {
         const durationMs = Date.now() - runStart;
         // Output
         if (config.json) {
-            await writeResultJson(results);
+            await writeResultJson(results, outputSecrets(skills));
         }
         else {
             console.log(formatDagResultHuman(results, durationMs, config));
@@ -654,7 +649,7 @@ implementCmd.action(async (issueId, options) => {
     if (implCloudHandle?.dashboardUrl) {
         console.log(c.subtle(`  cloud: ${implCloudHandle.dashboardUrl}`));
     }
-    const observer = composeObservers(implProgressObserver, config.verbose ? createVerboseToolObserver() : undefined, Boolean(options.stream) ? createStreamObserver() : undefined, createCloudStreamObserver(config, implCloudHandle));
+    const observer = composeObservers(implProgressObserver, config.verbose ? createVerboseToolObserver() : undefined, Boolean(options.stream) ? createStreamObserver(outputSecrets(skills)) : undefined, createCloudStreamObserver(config, implCloudHandle));
     const implementRun = bindForCli(implementWorkflow, config);
     try {
         const { results } = await execute(implementRun, workflowInput, {
@@ -681,7 +676,7 @@ implementCmd.action(async (issueId, options) => {
             // silent
         }
         if (config.json) {
-            await writeResultJson(results);
+            await writeResultJson(results, outputSecrets(skills));
         }
         if (hasFailed) {
             console.error(chalk.red(`\n  Implement workflow failed\n`));
@@ -1023,7 +1018,7 @@ resume) {
             // history must never fail a run
         }
     };
-    const observer = composeObservers(wfProgressObserver, nodeTimer.observer, options.verbose ? createVerboseToolObserver() : undefined, options.stream ? createStreamObserver() : undefined, createCloudStreamObserver(config, wfCloudHandle));
+    const observer = composeObservers(wfProgressObserver, nodeTimer.observer, options.verbose ? createVerboseToolObserver() : undefined, options.stream ? createStreamObserver(outputSecrets(skills)) : undefined, createCloudStreamObserver(config, wfCloudHandle));
     // #325: this is the primary run path (GitHub Action / CLI / MCP all land
     // here), and previously never passed signal/timeoutMs/max_steps to
     // execute() at all: a wedged node (hung tool call, runaway model turn)
@@ -1077,7 +1072,7 @@ resume) {
             });
         }
         if (isJson) {
-            await writeResultJson(results);
+            await writeResultJson(results, outputSecrets(skills));
             process.exit(wfHasFailed ? 1 : 0);
             return;
         }

package/dist/cli/output.d.ts

@@ -24,9 +24,13 @@ export declare function formatValidationErrors(errors: string[]): string;
 export declare function extractCredentialHint(err: unknown): string | null;
 export declare function formatCrashError(error: unknown): string;
 export declare function formatCheckResults(results: CheckResult[]): string;
-export declare function formatResultJson(results: Map<string, NodeResult>): string;
+/**
+ * Node results as JSON, redacted with the run journal's redactor (secret
+ * values, secret-named fields, known token shapes). Structure and keys stay.
+ */
+export declare function formatResultJson(results: Map<string, NodeResult>, secrets?: string[]): string;
 /** Drain terminal JSON before process.exit(), including when stdout is a pipe. */
-export declare function writeResultJson(results: Map<string, NodeResult>): Promise<void>;
+export declare function writeResultJson(results: Map<string, NodeResult>, secrets?: string[]): Promise<void>;
 /**
  * Format triage results as GitHub-flavored markdown for `$GITHUB_STEP_SUMMARY`.
  *

package/dist/cli/output.js

@@ -1,4 +1,5 @@
 import chalk from "chalk";
+import { redact } from "../journal.js";
 import { toMermaidBlock } from "../mermaid.js";
 import { PALETTE, ROLE_COLORS } from "../theme.js";
 // ── Color palette (tokens from theme.ts; one color per meaning) ─
@@ -404,13 +405,17 @@ export function formatCheckResults(results) {
     ].join("\n");
 }
 // ── JSON output ─────────────────────────────────────────────────
-export function formatResultJson(results) {
-    return JSON.stringify(Object.fromEntries(results), null, 2);
+/**
+ * Node results as JSON, redacted with the run journal's redactor (secret
+ * values, secret-named fields, known token shapes). Structure and keys stay.
+ */
+export function formatResultJson(results, secrets = []) {
+    return JSON.stringify(redact(Object.fromEntries(results), secrets).value, null, 2);
 }
 /** Drain terminal JSON before process.exit(), including when stdout is a pipe. */
-export function writeResultJson(results) {
+export function writeResultJson(results, secrets = []) {
     return new Promise((resolve, reject) => {
-        process.stdout.write(formatResultJson(results) + "\n", (error) => {
+        process.stdout.write(formatResultJson(results, secrets) + "\n", (error) => {
             if (error)
                 reject(error);
             else

package/dist/cli/stream-observer.d.ts

@@ -0,0 +1,10 @@
+import type { Observer } from "../types.js";
+/**
+ * Observer that writes NDJSON ExecutionEvents to stdout (`--stream`).
+ * Studio and other consumers parse these line-by-line.
+ *
+ * Every event goes through the run journal's redactor first (secret values,
+ * secret-named fields, known token shapes): node data, summaries, errors,
+ * tool inputs and outputs. Keys and structure are untouched.
+ */
+export declare function createStreamObserver(secrets?: string[], write?: (line: string) => void): Observer;

package/dist/cli/stream-observer.js

@@ -0,0 +1,14 @@
+import { redact } from "../journal.js";
+/**
+ * Observer that writes NDJSON ExecutionEvents to stdout (`--stream`).
+ * Studio and other consumers parse these line-by-line.
+ *
+ * Every event goes through the run journal's redactor first (secret values,
+ * secret-named fields, known token shapes): node data, summaries, errors,
+ * tool inputs and outputs. Keys and structure are untouched.
+ */
+export function createStreamObserver(secrets = [], write = (line) => void process.stdout.write(line)) {
+    return (event) => {
+        write(JSON.stringify(redact(event, secrets).value) + "\n");
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.173",
+  "version": "0.1.174",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"