@sweny-ai/core 0.1.181 → 0.1.182

package/dist/agent-env.d.ts

@@ -355,11 +355,55 @@ export declare function resolveAgentAccess(skillIds: readonly string[], skills:
 export type SandboxMode = "off" | "auto" | "strict";
 /**
  * Parse the sandbox mode from the explicit `mode` or `SWENY_SANDBOX`.
- * Accepts `off|false|0`, `auto`, `strict|on|true|1` (`on` is an alias for
+ * Accepts `off|false|0|no`, `auto`, `strict|on|true|1` (`on` is an alias for
  * `strict`). Unset or unknown (with a warning) uses the default: `auto` when
  * `CI` is truthy, `off` otherwise. An explicit value always wins.
  */
 export declare function resolveSandboxMode(env: Record<string, string | undefined>, mode?: string, logger?: Pick<Logger, "warn">): SandboxMode;
+/**
+ * The fix-it hint for a sandbox start that failed on a user namespace. Ubuntu
+ * 23.10+ restricts unprivileged user namespaces (the sysctl), and Ubuntu 26.04
+ * also loads the `bwrap-userns-restrict` AppArmor profile, which denies every
+ * capability to bwrap's children, so the seccomp helper of
+ * @anthropic-ai/sandbox-runtime cannot nest its own user namespace
+ * (`apply-seccomp: write /proc/self/setgroups ... Permission denied`,
+ * anthropics/sandbox-runtime#429). Empty when `stderr` is not a namespace error.
+ */
+export declare function usernsHint(stderr: string): string;
+/**
+ * Where the host probes look for `bwrap` and `unshare`. Never PATH: a probe runs
+ * a real binary, and a directory an agent can write may be on PATH.
+ */
+export declare const SYSTEM_BIN_DIRS: readonly ["/usr/bin", "/bin", "/usr/local/bin", "/usr/sbin"];
+/** Absolute path of `name` in {@link SYSTEM_BIN_DIRS} (first match), never from PATH. */
+export declare function systemBin(name: string, exists?: (p: string) => boolean): string | undefined;
+export interface ProbeResult {
+    /** Exit status; null when the process could not start or was killed. */
+    status: number | null;
+    stdout: string;
+    stderr: string;
+    /** Spawn error (ENOENT, timeout). */
+    error?: Error;
+}
+/** Run a probe binary (an absolute path) and collect its result. */
+export type ProbeRunner = (file: string, args: string[]) => ProbeResult;
+/** One line of a probe's output for a warning: the first line, control characters masked, capped. */
+export declare function probeLine(text: string): string;
+/**
+ * Functional bubblewrap check: can it actually create a sandbox on this host?
+ * The same runs as the Action's `scripts/sandbox-userns.sh probe`: a plain
+ * `bwrap ... true`, then a user namespace nested inside bwrap, which the SDK
+ * sandbox's seccomp helper needs. On Ubuntu 26.04 the first passes and the
+ * second does not, so a plain probe would report a sandbox that then fails
+ * every command.
+ *
+ * `bwrap` and `unshare` come only from {@link SYSTEM_BIN_DIRS}, run by absolute
+ * path with {@link PROBE_ENV}, and at most one sanitized line of their stderr
+ * reaches the warning. The nested run is skipped (not failed) when there is no
+ * system `unshare` or it has no `--map-root-user` (busybox): an unusable probe
+ * tool is not a restricted host.
+ */
+export declare function bwrapWorks(run?: ProbeRunner, findBin?: (name: string) => string | undefined): string | undefined;
 /**
  * Probe whether the SDK sandbox can start on this host. Returns a reason
  * string when it cannot, undefined when it looks supported.

package/dist/agent-env.js

@@ -25,8 +25,8 @@
  *   SWENY_SANDBOX                  / sandbox                  auto | strict | off (default: auto in CI, off locally)
  *   SWENY_SANDBOX_ALLOWED_DOMAINS  / sandbox-allowed-domains  extra hosts for sandboxed commands
  */
-import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { accessSync, constants as fsConstants, existsSync, mkdirSync, mkdtempSync, statSync, writeFileSync, } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
 import { runStateRoot } from "./journal.js";
@@ -872,13 +872,13 @@ export function resolveAgentAccess(skillIds, skills, grant = []) {
 }
 /**
  * Parse the sandbox mode from the explicit `mode` or `SWENY_SANDBOX`.
- * Accepts `off|false|0`, `auto`, `strict|on|true|1` (`on` is an alias for
+ * Accepts `off|false|0|no`, `auto`, `strict|on|true|1` (`on` is an alias for
  * `strict`). Unset or unknown (with a warning) uses the default: `auto` when
  * `CI` is truthy, `off` otherwise. An explicit value always wins.
  */
 export function resolveSandboxMode(env, mode, logger) {
     const raw = (mode ?? env.SWENY_SANDBOX ?? "").trim().toLowerCase();
-    if (raw === "off" || raw === "false" || raw === "0")
+    if (raw === "off" || raw === "false" || raw === "0" || raw === "no")
         return "off";
     if (raw === "strict" || raw === "on" || raw === "true" || raw === "1")
         return "strict";
@@ -889,23 +889,105 @@ export function resolveSandboxMode(env, mode, logger) {
         logger?.warn(`SWENY_SANDBOX="${raw}" is not one of off|auto|strict; using ${fallback}`);
     return fallback;
 }
-/** Functional bubblewrap check: can it actually create a sandbox on this host? */
-function bwrapWorks() {
+/**
+ * The fix-it hint for a sandbox start that failed on a user namespace. Ubuntu
+ * 23.10+ restricts unprivileged user namespaces (the sysctl), and Ubuntu 26.04
+ * also loads the `bwrap-userns-restrict` AppArmor profile, which denies every
+ * capability to bwrap's children, so the seccomp helper of
+ * @anthropic-ai/sandbox-runtime cannot nest its own user namespace
+ * (`apply-seccomp: write /proc/self/setgroups ... Permission denied`,
+ * anthropics/sandbox-runtime#429). Empty when `stderr` is not a namespace error.
+ */
+export function usernsHint(stderr) {
+    return /user namespace|userns|uid map|uid_map|setgroups|setting up uid|Operation not permitted|Permission denied/i.test(stderr)
+        ? "; unprivileged user namespaces look restricted (Ubuntu 23.10+: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0; " +
+            "Ubuntu 26.04 also: sudo apparmor_parser -R /etc/apparmor.d/bwrap-userns-restrict)"
+        : "";
+}
+const BWRAP_PROBE = ["--ro-bind", "/", "/", "--dev", "/dev", "--proc", "/proc"];
+/**
+ * Where the host probes look for `bwrap` and `unshare`. Never PATH: a probe runs
+ * a real binary, and a directory an agent can write may be on PATH.
+ */
+export const SYSTEM_BIN_DIRS = ["/usr/bin", "/bin", "/usr/local/bin", "/usr/sbin"];
+/** The whole environment a probe runs with: no parent variables, no secrets. */
+const PROBE_ENV = { PATH: "/usr/bin:/bin" };
+/** Longest probe stderr echoed into a warning. */
+const PROBE_ECHO_MAX = 200;
+function isExecutableFile(p) {
     try {
-        execFileSync("bwrap", ["--ro-bind", "/", "/", "--dev", "/dev", "--proc", "/proc", "true"], {
-            stdio: ["ignore", "ignore", "pipe"],
-            timeout: 10_000,
-        });
-        return undefined;
+        if (!statSync(p).isFile())
+            return false;
+        accessSync(p, fsConstants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Absolute path of `name` in {@link SYSTEM_BIN_DIRS} (first match), never from PATH. */
+export function systemBin(name, exists = isExecutableFile) {
+    for (const dir of SYSTEM_BIN_DIRS) {
+        const p = path.posix.join(dir, name);
+        if (exists(p))
+            return p;
     }
-    catch (err) {
-        const stderr = String(err.stderr ?? err.message ?? "").trim();
-        const userns = /user namespace|uid map|setting up uid|Operation not permitted|Permission denied/i.test(stderr);
-        return (`bwrap cannot create a sandbox (${stderr.split("\n")[0] || "unknown error"})` +
-            (userns
-                ? "; unprivileged user namespaces look restricted (Ubuntu 23.10+: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0)"
-                : ""));
+    return undefined;
+}
+const runProbe = (file, args) => {
+    const r = spawnSync(file, args, {
+        env: PROBE_ENV,
+        stdio: ["ignore", "pipe", "pipe"],
+        encoding: "utf8",
+        timeout: 10_000,
+        maxBuffer: 64 * 1024,
+    });
+    return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "", error: r.error };
+};
+/** One line of a probe's output for a warning: the first line, control characters masked, capped. */
+export function probeLine(text) {
+    const line = text.trim().split(/\r?\n/)[0] ?? "";
+    return line.replace(/[\u0000-\u001f\u007f-\u009f]/g, "?").slice(0, PROBE_ECHO_MAX) || "unknown error";
+}
+function probeEcho(r) {
+    return probeLine(r.stderr.trim() || r.error?.message || (r.status === null ? "killed" : `exit ${r.status}`));
+}
+/**
+ * Functional bubblewrap check: can it actually create a sandbox on this host?
+ * The same runs as the Action's `scripts/sandbox-userns.sh probe`: a plain
+ * `bwrap ... true`, then a user namespace nested inside bwrap, which the SDK
+ * sandbox's seccomp helper needs. On Ubuntu 26.04 the first passes and the
+ * second does not, so a plain probe would report a sandbox that then fails
+ * every command.
+ *
+ * `bwrap` and `unshare` come only from {@link SYSTEM_BIN_DIRS}, run by absolute
+ * path with {@link PROBE_ENV}, and at most one sanitized line of their stderr
+ * reaches the warning. The nested run is skipped (not failed) when there is no
+ * system `unshare` or it has no `--map-root-user` (busybox): an unusable probe
+ * tool is not a restricted host.
+ */
+export function bwrapWorks(run = runProbe, findBin = (name) => systemBin(name)) {
+    const ok = (r) => r.status === 0 && !r.error;
+    const bwrap = findBin("bwrap");
+    if (!bwrap) {
+        const dirs = SYSTEM_BIN_DIRS.slice(0, -1).join(", ") + " or " + SYSTEM_BIN_DIRS[SYSTEM_BIN_DIRS.length - 1];
+        return `bwrap is not installed in ${dirs} (the sandbox probe does not search PATH)`;
+    }
+    const plain = run(bwrap, [...BWRAP_PROBE, "true"]);
+    if (!ok(plain))
+        return `bwrap cannot create a sandbox (${probeEcho(plain)})${usernsHint(plain.stderr)}`;
+    const unshare = findBin("unshare");
+    if (!unshare)
+        return undefined;
+    const help = run(unshare, ["--help"]);
+    if (!`${help.stdout}\n${help.stderr}`.includes("--map-root-user"))
+        return undefined;
+    const nested = run(bwrap, [...BWRAP_PROBE, unshare, "--user", "--map-root-user", "true"]);
+    if (!ok(nested)) {
+        return (`bwrap cannot nest a user namespace, which the sandbox's seccomp helper needs (${probeEcho(nested)})` +
+            usernsHint("user namespace"));
     }
+    return undefined;
 }
 /**
  * Probe whether the SDK sandbox can start on this host. Returns a reason

package/dist/cli/config-file.d.ts

@@ -54,4 +54,4 @@ export type FileConfig = Record<string, string | string[] | Record<string, unkno
  */
 export declare function loadConfigFile(cwd?: string): FileConfig;
 /** Starter config written by `sweny new`. */
-export declare const STARTER_CONFIG = "# .sweny.yml \u2014 SWEny project configuration\n# Commit this file. Secrets (API keys, tokens) go in .env (gitignored).\n#\n# Every key matches a CLI flag: \"time-range: 4h\" is the same as \"--time-range 4h\".\n# CLI flags override this file; env vars override this file; this file overrides defaults.\n\n# \u2500\u2500 Providers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# observability-provider: datadog        # datadog | sentry | cloudwatch | splunk | elastic | newrelic | loki | prometheus | pagerduty | heroku | opsgenie | vercel | supabase | netlify | fly | render | file\n# issue-tracker-provider: github-issues  # github-issues | linear | jira\n# source-control-provider: github        # github | gitlab\n# coding-agent-provider: claude          # claude | codex | pi\n# notification-provider: console         # console | slack | teams | discord | email | webhook\n\n# \u2500\u2500 Investigation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# time-range: 24h\n# severity-focus: errors\n# service-filter: \"*\"\n# investigation-depth: standard          # quick | standard | thorough\n\n# \u2500\u2500 PR / branch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# base-branch: main\n# pr-labels: agent,triage,needs-review\n\n# \u2500\u2500 Paths \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# service-map-path: .github/service-map.yml\n# log-file: ./logs/errors.json           # required when observability-provider is \"file\"\n\n# \u2500\u2500 Cache \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# cache-dir: .sweny/cache\n# cache-ttl: 86400\n\n# \u2500\u2500 Run reporting \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Opt-in and not currently available: token minting is not yet exposed, so\n# leaving this unset means no reporting request is ever made.\n# cloud-token: sweny_pk_...\n# Or set SWENY_CLOUD_TOKEN in your environment.\n\n# \u2500\u2500 Agent sandbox \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# See https://docs.sweny.ai/advanced/agent-sandbox/\n# sandbox: off                           # off (local default) | auto (CI default: sandbox if supported, else warn) | strict\n# sandbox-allowed-domains: [internal.example.com]   # extra hosts agent commands may reach\n# env-scope: off                         # off (local default: full env) | on (CI default: allowlist)\n# env-passthrough: [NPM_TOKEN]           # extra env vars the agent may see when scoped (\"*\" = all)\n\n# \u2500\u2500 MCP servers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Extend the coding agent with additional tools via MCP.\n# Value is a JSON object \u2014 each key is a server name you choose.\n# See https://docs.sweny.ai/advanced/mcp-servers/ for a full catalog with copy-paste configs.\n#\n# Example: GitHub MCP server (query PRs, issues, CI run logs)\n# mcp-servers-json: '{\"github\":{\"type\":\"stdio\",\"command\":\"npx\",\"args\":[\"-y\",\"@modelcontextprotocol/server-github@latest\"],\"env\":{\"GITHUB_PERSONAL_ACCESS_TOKEN\":\"ghp_...\"}}}'\n\n# \u2500\u2500 Local-only quick start \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Uncomment to run without any external services (just an LLM API key):\n# observability-provider: file\n# log-file: ./sample-errors.json\n# issue-tracker-provider: file\n# source-control-provider: file\n# notification-provider: file\n# output-dir: .sweny/output\n\n# \u2500\u2500 Credentials (.env) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Copy the relevant block into your .env file and fill in the values.\n#\n# Claude (coding agent) \u2014 https://console.anthropic.com/settings/api-keys\n#   ANTHROPIC_API_KEY=sk-ant-...\n#\n# GitHub (source control + issue tracker)\n#   GITHUB_TOKEN=ghp_...        # https://github.com/settings/tokens (repo + issues scopes)\n#\n# Datadog (observability) \u2014 https://app.datadoghq.com/organization-settings\n#   DD_API_KEY=...              # Organization Settings > API Keys\n#   DD_APP_KEY=...              # Organization Settings > Application Keys\n#   DD_SITE=datadoghq.com       # or datadoghq.eu, us3.datadoghq.com, etc.\n#\n# Sentry (observability) \u2014 https://sentry.io/settings/auth-tokens/\n#   SENTRY_AUTH_TOKEN=sntrys_...\n#   SENTRY_ORG=your-org-slug    # from sentry.io/organizations/<slug>/\n#   SENTRY_PROJECT=your-project # Project Settings > General > Project Slug\n#\n# Linear (issue tracker) \u2014 https://linear.app/settings/api\n#   LINEAR_API_KEY=lin_api_...\n#   LINEAR_TEAM_ID=...          # Settings > Workspace > Teams > [team] > copy ID from URL\n#   LINEAR_BUG_LABEL_ID=...     # Settings > Labels > [label] > copy ID from URL\n#\n# Jira (issue tracker) \u2014 https://your-org.atlassian.net\n#   JIRA_BASE_URL=https://your-org.atlassian.net\n#   JIRA_EMAIL=you@company.com  # your Atlassian account email\n#   JIRA_API_TOKEN=...          # https://id.atlassian.com/manage-profile/security/api-tokens\n#\n# Vercel (observability) \u2014 https://vercel.com/account/tokens\n#   VERCEL_TOKEN=...\n#   VERCEL_PROJECT_ID=prj_...      # Project Settings > General > Project ID\n#   VERCEL_TEAM_ID=team_...        # optional, for team-owned projects\n#\n# Supabase (observability) \u2014 https://supabase.com/dashboard/account/tokens\n#   SUPABASE_MANAGEMENT_KEY=...\n#   SUPABASE_PROJECT_REF=...       # Project Settings > General > Reference ID\n#\n# Netlify (observability) \u2014 https://app.netlify.com/user/applications#personal-access-tokens\n#   NETLIFY_TOKEN=...\n#   NETLIFY_SITE_ID=...         # Site Settings > General > Site ID\n#\n# Fly.io (observability) \u2014 https://fly.io/user/personal_access_tokens\n#   FLY_TOKEN=...\n#   FLY_APP_NAME=...             # the name of your Fly.io application\n#\n# Render (observability) \u2014 https://dashboard.render.com/u/settings\n#   RENDER_API_KEY=...\n#   RENDER_SERVICE_ID=srv-...    # from your service's Settings page\n#\n# Prometheus (observability) \u2014 self-hosted or Grafana Cloud\n#   PROMETHEUS_URL=http://prometheus.internal:9090\n#   PROMETHEUS_TOKEN=...         # optional, for secured instances\n#\n# PagerDuty (observability) \u2014 https://your-account.pagerduty.com/api_keys\n#   PAGERDUTY_API_KEY=...\n#\n# Honeycomb (observability) \u2014 https://docs.honeycomb.io/api/\n#   HONEYCOMB_API_KEY=...\n#   HONEYCOMB_DATASET=...        # dataset name (e.g. production)\n#\n# Heroku (observability) \u2014 https://devcenter.heroku.com/articles/platform-api-reference\n#   HEROKU_API_KEY=...           # https://dashboard.heroku.com/account\n#   HEROKU_APP_NAME=...          # the name of your Heroku application\n#\n# OpsGenie (observability) \u2014 https://support.atlassian.com/opsgenie/docs/api-key-management/\n#   OPSGENIE_API_KEY=...\n#   OPSGENIE_REGION=us           # or eu for EU-hosted accounts\n#\n# Slack (notifications) \u2014 https://api.slack.com/apps\n#   NOTIFICATION_WEBHOOK_URL=https://hooks.slack.com/services/...\n#   # or use a bot token: SLACK_BOT_TOKEN=xoxb-...\n#\n# Decision model (optional) for nodes with route_by: decider. https://docs.sweny.ai/advanced/decision-models/\n#   Local Ollama: set it here (a URL in this file must be loopback and never gets a key):\n#     decider:\n#       url: http://localhost:11434\n#       model: nimble\n#   Remote server: set it in the CI or shell environment only, never in this file or .env:\n#     SWENY_DECIDER_URL=https://...  SWENY_DECIDER_MODEL=...  SWENY_DECIDER_API_KEY=...\n";
+export declare const STARTER_CONFIG = "# .sweny.yml \u2014 SWEny project configuration\n# Commit this file. Secrets (API keys, tokens) go in .env (gitignored).\n#\n# Every key matches a CLI flag: \"time-range: 4h\" is the same as \"--time-range 4h\".\n# CLI flags override this file; env vars override this file; this file overrides defaults.\n\n# \u2500\u2500 Providers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# observability-provider: datadog        # datadog | sentry | cloudwatch | splunk | elastic | newrelic | loki | prometheus | pagerduty | heroku | opsgenie | vercel | supabase | netlify | fly | render | file\n# issue-tracker-provider: github-issues  # github-issues | linear | jira\n# source-control-provider: github        # github | gitlab\n# coding-agent-provider: claude          # claude | codex | pi\n# notification-provider: console         # console | slack | teams | discord | email | webhook\n\n# \u2500\u2500 Investigation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# time-range: 24h\n# severity-focus: errors\n# service-filter: \"*\"\n# investigation-depth: standard          # quick | standard | thorough\n\n# \u2500\u2500 PR / branch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# base-branch: main\n# pr-labels: agent,triage,needs-review\n\n# \u2500\u2500 Paths \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# log-file: ./logs/errors.json           # required when observability-provider is \"file\"\n\n# \u2500\u2500 Run reporting \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Opt-in and not currently available: token minting is not yet exposed, so\n# leaving this unset means no reporting request is ever made.\n# cloud-token: sweny_pk_...\n# Or set SWENY_CLOUD_TOKEN in your environment.\n\n# \u2500\u2500 Agent sandbox \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# See https://docs.sweny.ai/advanced/agent-sandbox/\n# sandbox: off                           # off (local default) | auto (CI default: sandbox if supported, else warn) | strict\n# sandbox-allowed-domains: [internal.example.com]   # extra hosts agent commands may reach\n# env-scope: off                         # off (local default: full env) | on (CI default: allowlist)\n# env-passthrough: [NPM_TOKEN]           # extra env vars the agent may see when scoped (\"*\" = all)\n\n# \u2500\u2500 MCP servers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Extend the coding agent with additional tools via MCP.\n# Value is a JSON object \u2014 each key is a server name you choose.\n# See https://docs.sweny.ai/advanced/mcp-servers/ for a full catalog with copy-paste configs.\n#\n# Example: GitHub MCP server (query PRs, issues, CI run logs)\n# mcp-servers-json: '{\"github\":{\"type\":\"stdio\",\"command\":\"npx\",\"args\":[\"-y\",\"@modelcontextprotocol/server-github@latest\"],\"env\":{\"GITHUB_PERSONAL_ACCESS_TOKEN\":\"ghp_...\"}}}'\n\n# \u2500\u2500 Local-only quick start \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Uncomment to run without any external services (just an LLM API key):\n# observability-provider: file\n# log-file: ./sample-errors.json\n# issue-tracker-provider: file\n# source-control-provider: file\n# notification-provider: file\n\n# \u2500\u2500 Credentials (.env) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n# Copy the relevant block into your .env file and fill in the values.\n#\n# Claude (coding agent) \u2014 https://console.anthropic.com/settings/api-keys\n#   ANTHROPIC_API_KEY=sk-ant-...\n#\n# GitHub (source control + issue tracker)\n#   GITHUB_TOKEN=ghp_...        # https://github.com/settings/tokens (repo + issues scopes)\n#\n# Datadog (observability) \u2014 https://app.datadoghq.com/organization-settings\n#   DD_API_KEY=...              # Organization Settings > API Keys\n#   DD_APP_KEY=...              # Organization Settings > Application Keys\n#   DD_SITE=datadoghq.com       # or datadoghq.eu, us3.datadoghq.com, etc.\n#\n# Sentry (observability) \u2014 https://sentry.io/settings/auth-tokens/\n#   SENTRY_AUTH_TOKEN=sntrys_...\n#   SENTRY_ORG=your-org-slug    # from sentry.io/organizations/<slug>/\n#   SENTRY_PROJECT=your-project # Project Settings > General > Project Slug\n#\n# Linear (issue tracker) \u2014 https://linear.app/settings/api\n#   LINEAR_API_KEY=lin_api_...\n#\n# Jira (issue tracker) \u2014 https://your-org.atlassian.net\n#   JIRA_BASE_URL=https://your-org.atlassian.net\n#   JIRA_EMAIL=you@company.com  # your Atlassian account email\n#   JIRA_API_TOKEN=...          # https://id.atlassian.com/manage-profile/security/api-tokens\n#\n# Vercel (observability) \u2014 https://vercel.com/account/tokens\n#   VERCEL_TOKEN=...\n#   VERCEL_PROJECT_ID=prj_...      # Project Settings > General > Project ID\n#   VERCEL_TEAM_ID=team_...        # optional, for team-owned projects\n#\n# Supabase (observability) \u2014 https://supabase.com/dashboard/account/tokens\n#   SUPABASE_MANAGEMENT_KEY=...\n#   SUPABASE_PROJECT_REF=...       # Project Settings > General > Reference ID\n#\n# Netlify (observability) \u2014 https://app.netlify.com/user/applications#personal-access-tokens\n#   NETLIFY_TOKEN=...\n#   NETLIFY_SITE_ID=...         # Site Settings > General > Site ID\n#\n# Fly.io (observability) \u2014 https://fly.io/user/personal_access_tokens\n#   FLY_TOKEN=...\n#   FLY_APP_NAME=...             # the name of your Fly.io application\n#\n# Render (observability) \u2014 https://dashboard.render.com/u/settings\n#   RENDER_API_KEY=...\n#   RENDER_SERVICE_ID=srv-...    # from your service's Settings page\n#\n# Prometheus (observability) \u2014 self-hosted or Grafana Cloud\n#   PROMETHEUS_URL=http://prometheus.internal:9090\n#   PROMETHEUS_TOKEN=...         # optional, for secured instances\n#\n# PagerDuty (observability) \u2014 https://your-account.pagerduty.com/api_keys\n#   PAGERDUTY_API_KEY=...\n#\n# Honeycomb (observability) \u2014 https://docs.honeycomb.io/api/\n#   HONEYCOMB_API_KEY=...\n#   HONEYCOMB_DATASET=...        # dataset name (e.g. production)\n#\n# Heroku (observability) \u2014 https://devcenter.heroku.com/articles/platform-api-reference\n#   HEROKU_API_KEY=...           # https://dashboard.heroku.com/account\n#   HEROKU_APP_NAME=...          # the name of your Heroku application\n#\n# OpsGenie (observability) \u2014 https://support.atlassian.com/opsgenie/docs/api-key-management/\n#   OPSGENIE_API_KEY=...\n#   OPSGENIE_REGION=us           # or eu for EU-hosted accounts\n#\n# Slack (notifications) \u2014 https://api.slack.com/apps\n#   NOTIFICATION_WEBHOOK_URL=https://hooks.slack.com/services/...\n#   # or use a bot token: SLACK_BOT_TOKEN=xoxb-...\n#\n# Decision model (optional) for nodes with route_by: decider. https://docs.sweny.ai/advanced/decision-models/\n#   Local Ollama: set it here (a URL in this file must be loopback and never gets a key):\n#     decider:\n#       url: http://localhost:11434\n#       model: nimble\n#   Remote server: set it in the CI or shell environment only, never in this file or .env:\n#     SWENY_DECIDER_URL=https://...  SWENY_DECIDER_MODEL=...  SWENY_DECIDER_API_KEY=...\n";

package/dist/cli/config-file.js

@@ -221,13 +221,8 @@ export const STARTER_CONFIG = `# .sweny.yml — SWEny project configuration
 # pr-labels: agent,triage,needs-review
 
 # ── Paths ─────────────────────────────────────────────────────────────
-# service-map-path: .github/service-map.yml
 # log-file: ./logs/errors.json           # required when observability-provider is "file"
 
-# ── Cache ─────────────────────────────────────────────────────────────
-# cache-dir: .sweny/cache
-# cache-ttl: 86400
-
 # ── Run reporting ─────────────────────────────────────────────────────
 # Opt-in and not currently available: token minting is not yet exposed, so
 # leaving this unset means no reporting request is ever made.
@@ -256,7 +251,6 @@ export const STARTER_CONFIG = `# .sweny.yml — SWEny project configuration
 # issue-tracker-provider: file
 # source-control-provider: file
 # notification-provider: file
-# output-dir: .sweny/output
 
 # ── Credentials (.env) ───────────────────────────────────────────────
 # Copy the relevant block into your .env file and fill in the values.
@@ -279,8 +273,6 @@ export const STARTER_CONFIG = `# .sweny.yml — SWEny project configuration
 #
 # Linear (issue tracker) — https://linear.app/settings/api
 #   LINEAR_API_KEY=lin_api_...
-#   LINEAR_TEAM_ID=...          # Settings > Workspace > Teams > [team] > copy ID from URL
-#   LINEAR_BUG_LABEL_ID=...     # Settings > Labels > [label] > copy ID from URL
 #
 # Jira (issue tracker) — https://your-org.atlassian.net
 #   JIRA_BASE_URL=https://your-org.atlassian.net

package/dist/cli/config.d.ts

@@ -18,12 +18,6 @@ export interface CliConfig {
     observabilityCredentials: Record<string, Record<string, string>>;
     issueTrackerProvider: string;
     linearApiKey: string;
-    linearTeamId: string;
-    linearBugLabelId: string;
-    linearTriageLabelId: string;
-    linearStateBacklog: string;
-    linearStateInProgress: string;
-    linearStatePeerReview: string;
     timeRange: string;
     severityFocus: string;
     serviceFilter: string;
@@ -38,7 +32,6 @@ export interface CliConfig {
     noveltyMode: boolean;
     issueOverride: string;
     additionalInstructions: string;
-    serviceMapPath: string;
     githubToken: string;
     botToken: string;
     cloudToken: string;
@@ -48,7 +41,6 @@ export interface CliConfig {
     jiraApiToken: string;
     gitlabToken: string;
     gitlabProjectId: string;
-    gitlabBaseUrl: string;
     notificationProvider: string;
     notificationWebhookUrl: string;
     sendgridApiKey: string;
@@ -66,10 +58,6 @@ export interface CliConfig {
      */
     verbose: boolean;
     bell: boolean;
-    cacheDir: string;
-    cacheTtl: number;
-    noCache: boolean;
-    outputDir: string;
     mcpServers: Record<string, McpServerConfig>;
     workspaceTools: string[];
     rules: string[];
@@ -118,17 +106,10 @@ export declare function normalizeSwenyAuth(raw: unknown): "auto" | "api-key" | "
  * `0` and breaking downstream invariants.
  *
  * Why zero is rejected: every current caller (max-investigate-turns,
- * max-implement-turns, cache-ttl) uses the result as a positive count or
- * timeout. There is no "zero means disabled" semantics anywhere — a
- * cache-ttl of 0 wouldn't disable cache, it would expire entries
- * immediately, which is broken. If a future flag wants "0 = disabled",
- * use a sibling helper (parseNonNegativeInt) rather than weakening this
- * one's contract.
+ * max-implement-turns) uses the result as a positive turn count. There is
+ * no "zero means disabled" semantics anywhere. If a future flag wants
+ * "0 = disabled", use a sibling helper (parseNonNegativeInt) rather than
+ * weakening this one's contract.
  */
 export declare function parsePositiveInt(raw: unknown, fallback: number): number;
-/**
- * Returns non-fatal warnings about the configuration.
- * These are surfaced before the spinner starts but do not abort the run.
- */
-export declare function validateWarnings(config: Pick<CliConfig, "serviceMapPath">): string[];
 export declare function registerImplementCommand(program: Command): Command;

package/dist/cli/config.js

@@ -1,5 +1,4 @@
 import { execSync } from "node:child_process";
-import * as fs from "node:fs";
 import { hasCodexLogin } from "../agent-env.js";
 import { parseAcpAgent, unsupportedAgentError } from "../harness/agents.js";
 export function registerTriageCommand(program) {
@@ -18,8 +17,8 @@ export function registerTriageCommand(program) {
         .option("--severity-focus <focus>", "Severity level focus (default: errors)")
         .option("--service-filter <filter>", "Service filter pattern (default: *)")
         .option("--investigation-depth <depth>", "Investigation depth (default: standard)")
-        .option("--max-investigate-turns <n>", "Max Claude turns for investigation (default: 50)")
-        .option("--max-implement-turns <n>", "Max Claude turns for implementation (default: 30)")
+        .option("--max-investigate-turns <n>", "Max coding agent turns for investigation (default: 50)")
+        .option("--max-implement-turns <n>", "Max coding agent turns for implementation (default: 30)")
         .option("--base-branch <branch>", "Base branch for PRs (default: main)")
         .option("--pr-labels <labels>", "Comma-separated PR labels (default: agent,triage,needs-review)")
         .option("--dry-run", "Analyze only, do not create issues or PRs", false)
@@ -27,16 +26,9 @@ export function registerTriageCommand(program) {
         .option("--review-mode <mode>", "PR merge behavior: auto (merge when CI passes) | review (human approval, default)", "review")
         .option("--no-novelty-mode", "Disable novelty mode (allow +1 on existing issues)")
         .option("--issue-override <issue>", "Work on a specific existing issue")
-        .option("--additional-instructions <text>", "Extra instructions for the Claude agent")
-        .option("--service-map-path <path>", "Path to service map YAML (default: .github/service-map.yml)")
+        .option("--additional-instructions <text>", "Extra instructions for the coding agent")
         .option("--repository <owner/repo>", "Repository (auto-detected from git remote)")
-        .option("--linear-team-id <id>", "Linear team ID")
-        .option("--linear-bug-label-id <id>", "Linear bug label ID")
-        .option("--linear-triage-label-id <id>", "Linear triage label ID")
         .option("--issue-labels <labels>", "Comma-separated extra labels applied to every agent-created issue (e.g. agent UUID for Linear, 'agent' for GitHub Issues)")
-        .option("--linear-state-backlog <name>", "Linear backlog state name")
-        .option("--linear-state-in-progress <name>", "Linear in-progress state name")
-        .option("--linear-state-peer-review <name>", "Linear peer-review state name")
         .option("--log-file <path>", "Path to JSON log file (use with --observability-provider file)")
         .option("--dd-site <site>", "Datadog site (default: datadoghq.com)")
         .option("--sentry-org <org>", "Sentry organization slug")
@@ -56,15 +48,10 @@ export function registerTriageCommand(program) {
         .option("--axiom-org-id <id>", "Axiom org ID (required for multi-org Axiom accounts)")
         .option("--betterstack-source-id <id>", "Better Stack log source ID (used to auto-discover ClickHouse table)")
         .option("--betterstack-table-name <name>", 'Better Stack ClickHouse table name, e.g. "t273774.my_source"')
-        .option("--gitlab-base-url <url>", "GitLab base URL (default: https://gitlab.com)")
         .option("--json", "Output results as JSON", false)
         .option("--stream", "Stream NDJSON events to stdout (for Studio / automation)", false)
         .option("--verbose", "Print each tool call's input and output inline (human-readable, truncated). Use --stream for full untruncated NDJSON.", false)
         .option("--bell", "Ring terminal bell on completion", false)
-        .option("--cache-dir <path>", "Step cache directory (default: .sweny/cache)")
-        .option("--cache-ttl <seconds>", "Cache TTL in seconds, 1 to 31536000 (default: 86400)")
-        .option("--no-cache", "Disable step cache")
-        .option("--output-dir <path>", "Output directory for file providers (default: .sweny/output)")
         .option("--workspace-tools <tools>", "Comma-separated workspace tool integrations to enable (slack, notion, pagerduty, monday)")
         .option("--offline", "Skip URL Sources and fail fast if any are referenced", false)
         .option("--file-root [dir]", "Sandbox file: Sources to this directory tree (defaults to the working directory when the flag is given without a value)");
@@ -106,7 +93,7 @@ export function parseCliInputs(options, fileConfig = {}) {
         anthropicApiKey: env.ANTHROPIC_API_KEY || "",
         anthropicAuthToken: env.ANTHROPIC_AUTH_TOKEN || "",
         claudeOauthToken: env.CLAUDE_CODE_OAUTH_TOKEN || "",
-        // Non-secret config: env or .sweny config file (mirrors gitlabBaseUrl)
+        // Non-secret config: env or .sweny config file
         anthropicBaseUrl: env.ANTHROPIC_BASE_URL || f("anthropic-base-url") || "",
         swenyAuth: normalizeSwenyAuth(env.SWENY_AUTH || f("sweny-auth")),
         openaiApiKey: env.OPENAI_API_KEY || "",
@@ -116,12 +103,6 @@ export function parseCliInputs(options, fileConfig = {}) {
         observabilityCredentials: obsCreds,
         issueTrackerProvider: options.issueTrackerProvider || f("issue-tracker-provider") || "github-issues",
         linearApiKey: env.LINEAR_API_KEY || "",
-        linearTeamId: options.linearTeamId || env.LINEAR_TEAM_ID || f("linear-team-id") || "",
-        linearBugLabelId: options.linearBugLabelId || env.LINEAR_BUG_LABEL_ID || f("linear-bug-label-id") || "",
-        linearTriageLabelId: options.linearTriageLabelId || env.LINEAR_TRIAGE_LABEL_ID || f("linear-triage-label-id") || "",
-        linearStateBacklog: options.linearStateBacklog || env.LINEAR_STATE_BACKLOG || f("linear-state-backlog") || "",
-        linearStateInProgress: options.linearStateInProgress || env.LINEAR_STATE_IN_PROGRESS || f("linear-state-in-progress") || "",
-        linearStatePeerReview: options.linearStatePeerReview || env.LINEAR_STATE_PEER_REVIEW || f("linear-state-peer-review") || "",
         timeRange: options.timeRange || f("time-range") || "24h",
         severityFocus: options.severityFocus || f("severity-focus") || "errors",
         serviceFilter: options.serviceFilter || f("service-filter") || "*",
@@ -142,7 +123,6 @@ export function parseCliInputs(options, fileConfig = {}) {
         noveltyMode: options.noveltyMode !== false,
         issueOverride: options.issueOverride || "",
         additionalInstructions: options.additionalInstructions || "",
-        serviceMapPath: options.serviceMapPath || f("service-map-path") || ".github/service-map.yml",
         githubToken: env.GITHUB_TOKEN || "",
         botToken: env.BOT_TOKEN || "",
         cloudToken: (() => {
@@ -160,7 +140,6 @@ export function parseCliInputs(options, fileConfig = {}) {
         jiraApiToken: env.JIRA_API_TOKEN || "",
         gitlabToken: env.GITLAB_TOKEN || "",
         gitlabProjectId: env.GITLAB_PROJECT_ID || "",
-        gitlabBaseUrl: options.gitlabBaseUrl || env.GITLAB_BASE_URL || f("gitlab-base-url") || "https://gitlab.com",
         notificationProvider: options.notificationProvider || f("notification-provider") || "console",
         // Secrets: env only
         notificationWebhookUrl: env.NOTIFICATION_WEBHOOK_URL || "",
@@ -175,10 +154,6 @@ export function parseCliInputs(options, fileConfig = {}) {
         stream: Boolean(options.stream),
         verbose: Boolean(options.verbose),
         bell: Boolean(options.bell),
-        cacheDir: options.cacheDir || env.SWENY_CACHE_DIR || f("cache-dir") || ".sweny/cache",
-        cacheTtl: parsePositiveInt(options.cacheTtl ?? f("cache-ttl"), 86400),
-        noCache: options.cache === false,
-        outputDir: options.outputDir || env.SWENY_OUTPUT_DIR || f("output-dir") || ".sweny/output",
         mcpServers: parseMcpServers(env.SWENY_MCP_SERVERS || f("mcp-servers-json") || ""),
         workspaceTools: (options.workspaceTools || env.SWENY_WORKSPACE_TOOLS || f("workspace-tools") || "")
             .split(",")
@@ -379,8 +354,6 @@ export function validateInputs(config) {
         case "linear":
             if (!config.linearApiKey)
                 errors.push("Missing: LINEAR_API_KEY - find API keys at https://linear.app/settings/api");
-            if (!config.linearTeamId)
-                errors.push("Missing: LINEAR_TEAM_ID - find it in Linear > Settings > Workspace > Teams > [your team] > copy the ID from the URL");
             break;
         case "jira":
             if (!config.jiraBaseUrl)
@@ -459,9 +432,6 @@ export function validateInputs(config) {
     // bounds check let junk through).
     validateIntegerBound(errors, "--max-investigate-turns", config.maxInvestigateTurns, 1, 500);
     validateIntegerBound(errors, "--max-implement-turns", config.maxImplementTurns, 1, 500);
-    // cacheTtl is parsed with parsePositiveInt (junk → NaN); bound it so a
-    // malformed --cache-ttl / cache-ttl: surfaces a field error instead of NaN.
-    validateIntegerBound(errors, "--cache-ttl", config.cacheTtl, 1, 31_536_000);
     return errors;
 }
 function validateIntegerBound(errors, flag, value, min, max) {
@@ -498,12 +468,10 @@ export function normalizeSwenyAuth(raw) {
  * `0` and breaking downstream invariants.
  *
  * Why zero is rejected: every current caller (max-investigate-turns,
- * max-implement-turns, cache-ttl) uses the result as a positive count or
- * timeout. There is no "zero means disabled" semantics anywhere — a
- * cache-ttl of 0 wouldn't disable cache, it would expire entries
- * immediately, which is broken. If a future flag wants "0 = disabled",
- * use a sibling helper (parseNonNegativeInt) rather than weakening this
- * one's contract.
+ * max-implement-turns) uses the result as a positive turn count. There is
+ * no "zero means disabled" semantics anywhere. If a future flag wants
+ * "0 = disabled", use a sibling helper (parseNonNegativeInt) rather than
+ * weakening this one's contract.
  */
 export function parsePositiveInt(raw, fallback) {
     if (raw === undefined || raw === null || raw === "")
@@ -524,22 +492,6 @@ export function parsePositiveInt(raw, fallback) {
     const truncated = Math.trunc(parsed);
     return truncated >= 1 ? truncated : Number.NaN;
 }
-const DEFAULT_SERVICE_MAP_PATH = ".github/service-map.yml";
-/**
- * Returns non-fatal warnings about the configuration.
- * These are surfaced before the spinner starts but do not abort the run.
- */
-export function validateWarnings(config) {
-    const warnings = [];
-    // Warn when an explicitly configured serviceMapPath doesn't exist on disk.
-    // We skip the default path to avoid noise for users who never set it up.
-    if (config.serviceMapPath && config.serviceMapPath !== DEFAULT_SERVICE_MAP_PATH) {
-        if (!fs.existsSync(config.serviceMapPath)) {
-            warnings.push(`Service map file not found: "${config.serviceMapPath}". Cross-repo routing will be disabled.`);
-        }
-    }
-    return warnings;
-}
 function parseObservabilityCredentials(provider, options, fileConfig = {}) {
     const env = process.env;
     const f = (key) => {
@@ -675,10 +627,6 @@ export function registerImplementCommand(program) {
         .option("--max-implement-turns <n>", "Max coding agent turns (default: 40)")
         .option("--base-branch <branch>", "Base branch for PRs (default: main)")
         .option("--repository <owner/repo>", "Repository (auto-detected from git remote)")
-        .option("--linear-team-id <id>", "Linear team ID")
-        .option("--linear-state-in-progress <name>", "Linear in-progress state name")
-        .option("--linear-state-peer-review <name>", "Linear peer-review state name")
-        .option("--output-dir <path>", "Output directory for file providers (default: .sweny/output)")
         .option("--workspace-tools <tools>", "Comma-separated workspace tool integrations to enable (slack, notion, pagerduty, monday)")
         .option("--review-mode <mode>", "PR merge behavior: auto (GitHub auto-merge when CI passes) | review (human approval, default)", "review")
         .option("--additional-instructions <text>", "Extra instructions for the coding agent")

package/dist/cli/main.js

@@ -47,7 +47,7 @@ import { writeReceipt } from "./ticket.js";
 import { createNodeProgress, toolCallsText } from "./progress.js";
 import { applyNoColor, createPaint } from "./style.js";
 import { colorEnabled, glyphsFor, richOutput, spinnerFramesFor, supportsUnicode } from "./terminal.js";
-import { registerTriageCommand, registerImplementCommand, parseCliInputs, validateInputs, validateWarnings, parsePositiveInt, } from "./config.js";
+import { registerTriageCommand, registerImplementCommand, parseCliInputs, validateInputs, parsePositiveInt, } from "./config.js";
 import { c, formatBanner, getStepDetails, formatStepLine, formatDagResultHuman, formatDagResultMarkdown, writeResultJson, formatValidationErrors, formatCrashError, formatCheckResults, } from "./output.js";
 import { checkProviderConnectivity, detectClaudeCodeLogin, discoverWorkflowSkillIds, validateCheckInputs, } from "./check.js";
 import { registerSetupCommand } from "./setup.js";
@@ -262,10 +262,6 @@ triageCmd.action(async (options) => {
         console.error(c.subtle("\n  Run sweny triage --help for usage information.\n"));
         process.exit(1);
     }
-    // Non-fatal warnings (e.g. missing service map file)
-    for (const warning of validateWarnings(config)) {
-        console.warn(chalk.yellow(`  \u26A0  ${warning}`));
-    }
     // Banner
     if (!config.json) {
         console.log(formatBanner(config, version));
@@ -572,10 +568,6 @@ implementCmd.action(async (issueId, options) => {
         maxImplementTurns: parsePositiveInt(options.maxImplementTurns ?? fileConfig["max-implement-turns"], 40),
         baseBranch: options.baseBranch || fileConfig["base-branch"] || "main",
         repository: options.repository || process.env.GITHUB_REPOSITORY || "",
-        outputDir: options.outputDir ||
-            process.env.SWENY_OUTPUT_DIR ||
-            fileConfig["output-dir"] ||
-            ".sweny/output",
     };
     // Validate (parity with triage): surface the curated "Missing: ..." errors
     // and reject malformed integer flags before any execution.

package/dist/cli/setup.js

@@ -165,24 +165,17 @@ export async function setupLinear(apiKey, teamId) {
     const bugLabel = byName.get("bug") ?? (await ensure(BUG_LABEL));
     const bugId = bugLabel.id;
     // ── Print config snippet ─────────────────────────────────────────────────
-    const triageId = workTypeIds["triage"] ?? byName.get("triage")?.id ?? "";
     console.log(`
 ${chalk.bold("  Done.")} ${created.length} created, ${skipped.length} already existed.
 
 ${chalk.bold("  Add these to your .sweny.yml:")}
 
 ${chalk.cyan(`  issue-tracker-provider: linear
-  linear-team-id: ${teamId}
-  linear-triage-label-id: ${triageId}
-  linear-bug-label-id: ${bugId}
   issue-labels: ${agentLabel.id}`)}
 
 ${chalk.bold("  Or as environment variables / GitHub Actions secrets:")}
 
-${chalk.cyan(`  LINEAR_TEAM_ID=${teamId}
-  LINEAR_TRIAGE_LABEL_ID=${triageId}
-  LINEAR_BUG_LABEL_ID=${bugId}
-  SWENY_ISSUE_LABELS=${agentLabel.id}`)}
+${chalk.cyan(`  SWENY_ISSUE_LABELS=${agentLabel.id}`)}
 
 ${chalk.dim("  Full label inventory:")}
 ${chalk.dim(`  agent               ${agentLabel.id}`)}

package/dist/harness/agents.js

@@ -17,6 +17,7 @@ export function isSupportedAgent(id) {
 }
 /** The error for an agent id with no adapter. */
 export function unsupportedAgentError(id) {
-    return (`Unsupported coding agent "${id}": supported agents are "claude" (headless Claude Code) ` +
-        `and "codex" (Codex CLI), or "pi" (pi coding agent, experimental). Remove --agent / coding-agent-provider or set it to one of them.`);
+    return (`Unsupported coding agent "${id}": supported agents are "claude" (headless Claude Code), ` +
+        `"codex" (Codex CLI), "pi" (pi coding agent, experimental), or "acp:<command>" (any Agent Client Protocol agent, ` +
+        `experimental, for example "acp:opencode acp"). Remove --agent / coding-agent-provider or set it to one of them.`);
 }

package/dist/harness/sandbox-wrapper.d.ts

@@ -35,7 +35,9 @@
  * socat for step 1: install it with `npm i -g @anthropic-ai/sandbox-runtime`, or
  * point `SWENY_SRT_PATH` at the binary. Linux also needs bubblewrap, socat and
  * ripgrep, and unprivileged user namespaces (Ubuntu 23.10+:
- * `sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0`).
+ * `sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0`; Ubuntu 26.04
+ * also `sudo apparmor_parser -R /etc/apparmor.d/bwrap-userns-restrict`, see
+ * {@link usernsHint}).
  *
  * Modes are the step 1 modes, unchanged (`SWENY_SANDBOX`, default `auto` in CI
  * and `off` locally): `off` never wraps; `auto` wraps when a wrapper is

package/dist/harness/sandbox-wrapper.js

@@ -35,7 +35,9 @@
  * socat for step 1: install it with `npm i -g @anthropic-ai/sandbox-runtime`, or
  * point `SWENY_SRT_PATH` at the binary. Linux also needs bubblewrap, socat and
  * ripgrep, and unprivileged user namespaces (Ubuntu 23.10+:
- * `sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0`).
+ * `sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0`; Ubuntu 26.04
+ * also `sudo apparmor_parser -R /etc/apparmor.d/bwrap-userns-restrict`, see
+ * {@link usernsHint}).
  *
  * Modes are the step 1 modes, unchanged (`SWENY_SANDBOX`, default `auto` in CI
  * and `off` locally): `off` never wraps; `auto` wraps when a wrapper is
@@ -47,7 +49,7 @@ import { existsSync, realpathSync } from "node:fs";
 import { lstat, mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import * as path from "node:path";
-import { DEFAULT_SANDBOX_DOMAINS, parseList, resolveSandboxMode } from "../agent-env.js";
+import { DEFAULT_SANDBOX_DOMAINS, parseList, probeLine, resolveSandboxMode, usernsHint, } from "../agent-env.js";
 import { runStateRoot } from "../journal.js";
 import { policyGate } from "./policy.js";
 // ─── srt settings ────────────────────────────────────────────────
@@ -256,14 +258,8 @@ async function srtWorks(srtPath, env) {
             execFile(srtPath, ["--settings", settings, "--", "true"], { env: { PATH: env.PATH ?? "", HOME: dir }, timeout: 30_000 }, (err, _stdout, stderr) => {
                 if (!err)
                     return resolve(undefined);
-                const first = String(stderr || err.message)
-                    .trim()
-                    .split("\n")[0] || "unknown error";
-                const userns = /user namespace|uid map|setting up uid|Operation not permitted|Permission denied/i.test(String(stderr));
-                resolve(`srt cannot sandbox on this host (${first})` +
-                    (userns
-                        ? "; unprivileged user namespaces look restricted (Ubuntu 23.10+: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0)"
-                        : ""));
+                const first = probeLine(String(stderr || err.message));
+                resolve(`srt cannot sandbox on this host (${first})${usernsHint(String(stderr))}`);
             });
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.181",
+  "version": "0.1.182",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"