@sweny-ai/core 0.1.176 → 0.1.178

package/dist/schema.js

@@ -7,7 +7,7 @@
  * parsing untrusted input (JSON/YAML import, Studio editor).
  */
 import { z } from "zod";
-import { AUTHOR_ASSOCIATIONS, CONTEXT_MODES, EVALUATOR_KINDS, EVAL_POLICIES, MCP_TRANSPORTS, NODE_ACCESS, NODE_ON_FAIL, REQUIRES_ON_FAIL, SAFE_OUTPUT_APPLIERS, SAFE_OUTPUT_EXPIRES_PATTERN, SAFE_OUTPUT_MAX_CEILING, SAFE_OUTPUT_STATES, SAFE_OUTPUT_TYPES, SKILL_CATEGORIES, SKILL_ID_MAX_LENGTH, SKILL_ID_PATTERN, TOOL_ACCESS, TOOL_CLASSES, WORKFLOW_TYPES, } from "./types.js";
+import { AUTHOR_ASSOCIATIONS, CONTEXT_MODES, DECIDER_CONFIDENCE_FLOOR, DECIDER_MARGIN_FLOOR, DECIDER_MIN_CONFIDENCE, DECIDER_MIN_MARGIN, DECIDER_MODE_REMOVED, DECIDER_PROVIDER_MOVED, EVALUATOR_KINDS, EVAL_POLICIES, MCP_TRANSPORTS, NODE_ACCESS, NODE_ON_FAIL, REQUIRES_ON_FAIL, ROUTE_BY, SAFE_OUTPUT_APPLIERS, SAFE_OUTPUT_EXPIRES_PATTERN, SAFE_OUTPUT_MAX_CEILING, SAFE_OUTPUT_STATES, SAFE_OUTPUT_TYPES, SKILL_CATEGORIES, SKILL_ID_MAX_LENGTH, SKILL_ID_PATTERN, TOOL_ACCESS, TOOL_CLASSES, WORKFLOW_TYPES, } from "./types.js";
 import { sourceZ } from "./sources.js";
 import { resolveNodePermissions } from "./node-policy.js";
 import { workflowInputsZ, WORKFLOW_INPUT_TYPES } from "./inputs.js";
@@ -280,26 +280,22 @@ export const budgetZ = z
     message: "budget must declare at least one of tokens, cost_usd",
 });
 /**
- * Decision model for route choices (#357). `shadow` needs a provider; the
- * state only ever goes to that `base_url`, there is no fallback. The key is
- * named by env var, never inlined.
+ * Decision model thresholds (#357) for the nodes that set `route_by:
+ * decider`. Thresholds may be raised, and lowered no further than the floors.
+ * The provider (endpoint, model, key) comes only from operator config.
+ *
+ * Shapes from the shadow-mode release fail with an explanation instead of
+ * silently changing routing: `mode` ({@link DECIDER_MODE_REMOVED}) and
+ * `provider` ({@link DECIDER_PROVIDER_MOVED}).
  */
 export const deciderZ = z
     .object({
-    mode: z.enum(["off", "shadow"]),
-    provider: z
-        .object({
-        base_url: z.string().url(),
-        model: z.string().min(1),
-        api_key_env: z.string().min(1).optional(),
-    })
-        .strict()
-        .optional(),
+    mode: z.custom(() => false, { message: DECIDER_MODE_REMOVED }).optional(),
+    provider: z.custom(() => false, { message: DECIDER_PROVIDER_MOVED }).optional(),
+    min_confidence: z.number().min(DECIDER_CONFIDENCE_FLOOR).max(1).optional(),
+    min_margin: z.number().min(DECIDER_MARGIN_FLOOR).max(1).optional(),
 })
-    .strict()
-    .refine((d) => d.mode === "off" || d.provider !== undefined, {
-    message: "decider.provider is required when mode is shadow",
-});
+    .strict();
 /** One typed write intent a node may emit (#365). */
 export const safeOutputDeclarationZ = z
     .object({
@@ -342,6 +338,7 @@ export const nodeZ = z
     tools: nodeToolsZ.optional(),
     fail_soft: z.boolean().optional(),
     on_fail: z.enum(NODE_ON_FAIL).optional(),
+    route_by: z.enum(ROUTE_BY).optional(),
     permissions: nodePermissionsZ.optional(),
     outputs: z.array(safeOutputDeclarationZ).min(1).optional(),
     rules: nodeSourcesZ.optional(),
@@ -361,6 +358,7 @@ export const edgeZ = z
     // Natural language (the harness picks the edge) or `{ expr }`, a
     // deterministic expression sweny evaluates itself (#461). One or the other.
     when: z.union([z.string(), z.object({ expr: z.string().min(1).max(WHEN_EXPR_MAX_LENGTH) }).strict()]).optional(),
+    description: z.string().min(1).optional(),
     max_iterations: z.number().int().min(1).max(EDGE_MAX_ITERATIONS_CEILING).optional(),
 })
     .strict();
@@ -478,6 +476,22 @@ export function validateWorkflow(workflow, knownSkills) {
         else
             m.set(k, [v]);
     };
+    // One edge per (from, to) pair (#357). A route picks a target node, so two
+    // edges to the same target would make their conditions ambiguous (which
+    // one's max_iterations counts, which one's condition the router saw). Write
+    // one edge whose condition covers both cases instead.
+    const seenPairs = new Set();
+    for (const edge of workflow.edges) {
+        const key = JSON.stringify([edge.from, edge.to]);
+        if (seenPairs.has(key)) {
+            errors.push({
+                code: "DUPLICATE_EDGE",
+                message: `More than one edge from "${edge.from}" to "${edge.to}"; merge them into one edge (combine the conditions with OR)`,
+                nodeId: edge.from,
+            });
+        }
+        seenPairs.add(key);
+    }
     // Edge targets must exist
     for (const edge of workflow.edges) {
         if (!nodeIds.has(edge.from)) {
@@ -1000,28 +1014,24 @@ export const workflowJsonSchema = {
         },
         Decider: {
             type: "object",
-            required: ["mode"],
             additionalProperties: false,
-            description: "Decision model for route choices. 'shadow' asks it alongside the agent and logs whether they agree; the route is always the agent's. The workflow state goes only to provider.base_url, with no fallback.",
+            description: "Decision model thresholds for the nodes that set route_by: decider. The provider (URL, model, key) comes only from operator config (.sweny.yml or SWENY_DECIDER_* env), never from the workflow; 'provider' and the removed 'mode' key are rejected.",
             properties: {
-                mode: { type: "string", enum: ["off", "shadow"] },
-                provider: {
-                    type: "object",
-                    required: ["base_url", "model"],
-                    additionalProperties: false,
-                    properties: {
-                        base_url: {
-                            type: "string",
-                            format: "uri",
-                            description: "Server root serving POST /v1/systemone (Ollama or TypeSafe Jev).",
-                        },
-                        model: { type: "string", minLength: 1 },
-                        api_key_env: { type: "string", minLength: 1, description: "Env var holding the bearer key." },
-                    },
+                min_confidence: {
+                    type: "number",
+                    minimum: DECIDER_CONFIDENCE_FLOOR,
+                    maximum: 1,
+                    default: DECIDER_MIN_CONFIDENCE,
+                    description: "Accept the decider's answer only at or above this confidence.",
+                },
+                min_margin: {
+                    type: "number",
+                    minimum: DECIDER_MARGIN_FLOOR,
+                    maximum: 1,
+                    default: DECIDER_MIN_MARGIN,
+                    description: "Accept it only when the top label leads the runner-up by at least this much.",
                 },
             },
-            if: { properties: { mode: { const: "shadow" } } },
-            then: { required: ["provider"] },
         },
         SafeOutput: {
             type: "object",
@@ -1174,7 +1184,7 @@ export const workflowJsonSchema = {
         },
         decider: {
             $ref: "#/$defs/Decider",
-            description: "Decision model for route choices (shadow mode only). Default: off.",
+            description: "Thresholds for the decision model that decides the routes of route_by: decider nodes when confident. Default: 0.85 confidence, 0.2 margin.",
         },
         context_mode: {
             type: "string",
@@ -1335,6 +1345,11 @@ export const workflowJsonSchema = {
                         enum: [...NODE_ON_FAIL],
                         description: "What to do when this node finishes 'failed' (agent-level failure, or an eval failure that exhausted retries and was not softened by fail_soft). 'halt' (default) stops the workflow with the failure surfaced so a broken node never advances down a conditional edge; 'continue' preserves the legacy fall-through where routing proceeds from the failed node. Distinct from requires.on_fail (the pre-condition gate).",
                     },
+                    route_by: {
+                        type: "string",
+                        enum: [...ROUTE_BY],
+                        description: "Who picks this node's natural-language route. 'agent' (default): the agent's route evaluation. 'decider': the operator's decision model first, the agent when it is not confident. Expressions always win over both; put safety conditions in expressions.",
+                    },
                     permissions: {
                         $ref: "#/$defs/Permissions",
                         description: "What this node's agent may do. Absent: read when the node declares outputs, else the workflow's permissions, else write.",
@@ -1456,6 +1471,11 @@ export const workflowJsonSchema = {
                             },
                         ],
                     },
+                    description: {
+                        type: "string",
+                        minLength: 1,
+                        description: "The condition in natural language. For an { expr } edge, what the next rung reads when the expression cannot be evaluated because a field it needs is missing or invalid.",
+                    },
                     max_iterations: {
                         type: "integer",
                         minimum: 1,

package/dist/skills/git-push.d.ts

@@ -7,14 +7,51 @@
  * the sweny process, with the github skill's token (`GITHUB_TOKEN`), right
  * before it opens the PR. The agent never holds the token.
  *
- * Guard rails: only a local branch that exists, only to `origin` when it is
- * the PR's own repo, never force, never the base branch or the remote's
- * default branch. The token goes to git through command-scope config in the
- * child env (`GIT_CONFIG_*`), never argv, as an `http.<server>/.extraheader`
- * that first resets any persisted one (so the job token is never sent twice).
+ * The checkout is agent-written, so nothing in it may run, or steer the push,
+ * while the token is in play. The push therefore never runs in the checkout:
+ *
+ * 1. Read-only git in the checkout, with no token in its env, resolves the
+ *    head commit, checks that every fetch and push URL of `origin` is the PR's
+ *    repo on the GitHub server, and finds the object store.
+ * 2. A private temporary bare repo borrows those objects (`alternates`, data
+ *    only) and gets one ref, the head commit.
+ * 3. git pushes from that repo, with no system or global config, an empty
+ *    hooks dir, `--no-verify` and no credential helper, to an explicit URL
+ *    built from the PR's repo (`<server>/<owner>/<repo>.git`) with an explicit
+ *    refspec. No agent-written config, hook, push URL or `insteadOf` is read.
+ *    The token goes to git as command-scope config in the child env, never
+ *    argv, and only on this one invocation.
+ *
+ * The git binary, its PATH, the proxy and CA settings and the server URL come
+ * from the environment captured at process startup (startup-env.ts), never
+ * from a value the workspace `.env` introduced, and git is run by an absolute
+ * path that lies outside the workspace, the temp dir and any directory this
+ * user can write (see {@link resolveTrustedGit}).
+ *
+ * The private repo lives in the temp dir, which this user (and so the agent)
+ * can write. A process the agent left running could edit its config between
+ * `init` and `push` (an `insteadOf`, a proxy, `sslVerify=false`). Two layers:
+ * the push carries command-scope config for its exact URL (proxy from the
+ * trusted env or none, `sslVerify=true`, CA only from the trusted env), which
+ * beats repo-local config of the same URL; and the repo's config, alternates,
+ * top-level entries and hooks dir are fingerprinted after setup and compared
+ * right before the push, which is refused on any change. git has no switch to
+ * skip `$GIT_DIR/config`, so a byte check is the idiomatic guard. Residual
+ * risk: a change landing in the milliseconds between that check and git's own
+ * config read. The harnesses stop the agent's process (Codex its whole process
+ * group) when a node ends, but a deliberately detached process (`setsid`)
+ * escapes any group kill; only the sandbox's own process boundary ends it.
+ *
+ * Guard rails: only a local branch that exists, only when origin is the PR's
+ * own repo, never the base branch or the repo's default branch (from the
+ * GitHub API, not the checkout's `origin/HEAD`). The head must be new on the
+ * remote, or an unprotected branch with an open PR into the base (checked by
+ * the caller through the API); the push leases on the sha that check saw and
+ * only fast-forwards.
  * A push that fails is logged and the PR is still requested: the agent may
  * already have pushed (persisted credentials, an `agent_env` grant).
  */
+import type { BranchPusher } from "../types.js";
 export interface GitRunResult {
     code: number;
     stdout: string;
@@ -24,6 +61,16 @@ export type GitRunner = (args: string[], opts: {
     cwd: string;
     env: NodeJS.ProcessEnv;
 }) => Promise<GitRunResult>;
+/** The trusted entries of a PATH value, in order (see {@link trustedDir}). */
+export declare function trustedPathDirs(pathValue: string | undefined, workspace: string): string[];
+/**
+ * The absolute path of the first `git` on `pathValue` (the startup PATH) whose
+ * directory, and whose resolved file and its directory, pass
+ * {@link trustedDir}. Undefined when there is none: nothing is pushed.
+ */
+export declare function resolveTrustedGit(pathValue: string | undefined, workspace: string): string | undefined;
+/** A runner that executes the git at `gitPath` (absolute), never a PATH lookup. */
+export declare function gitAt(gitPath: string): GitRunner;
 export interface PushHeadOptions {
     /** `owner/repo` the PR is for. */
     repo: string;
@@ -31,12 +78,30 @@ export interface PushHeadOptions {
     head: string;
     /** The PR's base branch. */
     base: string;
-    /** The github skill's token. Without it, git uses whatever credential the checkout has. */
+    /**
+     * The repo's default branch, from the GitHub API. Without it nothing is
+     * pushed: the checkout's `origin/HEAD` is agent-written and not consulted.
+     */
+    defaultBranch?: string;
+    /**
+     * The head branch's sha on the remote, as the API reported it, or "" when it
+     * did not exist (`headPushLease` in github.ts). The push leases on it, so a
+     * branch created or moved since the check is not overwritten. Without it
+     * nothing is pushed.
+     */
+    remoteSha?: string;
+    /** The github skill's token. Without it nothing is pushed. */
     token?: string;
-    /** The checkout. Default: `process.cwd()`. */
-    cwd?: string;
+    /** The checkout (the run's `cwd`). */
+    cwd: string;
+    /**
+     * The operator's env: `GITHUB_SERVER_URL`, proxy and CA settings. Default:
+     * `process.env`, read through the startup snapshot (startup-env.ts), so a
+     * value the workspace `.env` introduced is never used. PATH always comes from
+     * the startup snapshot.
+     */
     env?: NodeJS.ProcessEnv;
-    /** Test seam. */
+    /** Test seam. Default: the git {@link resolveTrustedGit} finds on the startup PATH. */
     git?: GitRunner;
 }
 export interface PushHeadResult {
@@ -54,9 +119,33 @@ export declare function repoFromRemote(url: string): {
 } | undefined;
 /** A branch name sweny will pass to git: plain ref characters, no option or traversal forms. */
 export declare function isSafeBranch(name: string): boolean;
+/** `owner/repo` with plain name characters only. */
+export declare function isSafeRepo(repo: string): boolean;
 /** The command-scope git config that authenticates one push to `server` with `token`. */
 export declare function pushAuthConfig(server: string, token: string, env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 /**
- * Push the PR's head branch to `origin` from the sweny process. Never throws.
+ * Command-scope transport config for the push to `destination`, keyed to that
+ * exact URL so it beats repo-local `http.*` and `http.<url>.*` entries: the
+ * proxy from the trusted env or none (an empty `http.proxy` disables proxying,
+ * env included), TLS verification on, and a CA bundle only from the trusted env.
+ */
+export declare function pushTransportConfig(destination: string, trusted: NodeJS.ProcessEnv): Array<[string, string]>;
+/**
+ * The env every sweny-side git call runs with: the trusted PATH, no system or
+ * global config, no prompts, no inherited git settings, and no kept value the
+ * workspace `.env` introduced.
+ */
+export declare function hardenedGitEnv(env: NodeJS.ProcessEnv, trustedPath?: string): NodeJS.ProcessEnv;
+/**
+ * True when a fresh `git init --bare` config holds only repo-format keys
+ * (`[core]` format/fs flags, `[extensions]` object format and ref storage).
+ */
+export declare function isPlainRepoConfig(text: string): boolean;
+/** A branch name without a leading `refs/heads/`, so `refs/heads/develop` and `develop` compare equal. */
+export declare function branchName(ref: string): string;
+/**
+ * Push the PR's head branch from the sweny process. Never throws.
  */
 export declare function pushHeadBranch(opts: PushHeadOptions): Promise<PushHeadResult>;
+/** A pusher bound to one run's checkout and env (handed to tools as `ToolContext.pushBranch`). */
+export declare function bindBranchPusher(cwd: string, env?: NodeJS.ProcessEnv): BranchPusher;