@sweny-ai/core 0.1.201 → 0.1.203

package/dist/cli/check.d.ts

@@ -1,4 +1,7 @@
 import type { CliConfig } from "./config.js";
+import { type AgentHarness } from "../harness/index.js";
+export { resolveCheckAuthMode, redactUrl, checkAnthropicGateway } from "../harness/diagnose.js";
+export type { CheckAuthMode } from "../harness/diagnose.js";
 export interface CheckResult {
     name: string;
     status: "ok" | "fail" | "skip";
@@ -15,16 +18,45 @@ export interface CheckOptions {
      * (no workflows found), the legacy config-driven checks run.
      */
     scope?: ReadonlySet<string>;
-    /** A local Claude Code login exists, so no API key is required. */
+    /**
+     * Not read by the agent lines since #532: each harness probes its own stored
+     * login. Kept so existing callers compile; {@link validateCheckInputs} takes
+     * its own copy.
+     */
     claudeCodeLogin?: boolean;
+    /** The agent harness to diagnose (test seam). Default: `createHarness(codingAgentProvider)`. */
+    harness?: Pick<AgentHarness, "diagnose">;
+    /** Leave out the agent lines ({@link runCheck} renders them itself). */
+    skipAgent?: boolean;
+    /** Env the agent credentials are read from (default: `process.env`). */
+    env?: Record<string, string | undefined>;
 }
 export declare function checkProviderConnectivity(config: CliConfig, opts?: CheckOptions): Promise<CheckResult[]>;
-/** Which credential `sweny check` should validate, mirroring resolveAuthEnv intent. */
-export type CheckAuthMode = "oauth" | "api-key" | "auth-token" | "none";
-export declare function resolveCheckAuthMode(config: Pick<CliConfig, "anthropicApiKey" | "anthropicAuthToken" | "claudeOauthToken" | "swenyAuth">): CheckAuthMode;
-/** Redact a URL to scheme + host so userinfo / query (which can carry a key) never logs. */
-export declare function redactUrl(raw: string): string;
-export declare function checkAnthropicGateway(base: string, config: Pick<CliConfig, "anthropicApiKey" | "anthropicAuthToken" | "claudeOauthToken">, mode: CheckAuthMode): Promise<CheckResult>;
+/**
+ * The agent lines (#532): whatever the harness's `diagnose()` checks (CLI and
+ * version, credentials, a stored login, a cheap upstream probe), rendered
+ * like every other line. The harness owns the checks; nothing here branches
+ * on the agent.
+ */
+export declare function checkAgent(config: CliConfig, opts?: Pick<CheckOptions, "harness" | "env">): Promise<CheckResult[]>;
+export interface CheckReport {
+    /** Every line to render: the agent's first, then the providers'. */
+    results: CheckResult[];
+    /** Config errors (not the agent's): when set, no provider is probed. */
+    errors: string[];
+    /** True when `sweny check` must exit non-zero. */
+    failed: boolean;
+}
+/**
+ * `sweny check` end to end (#532). The agent's lines always render, even when
+ * its run gate (`preflight()`, the check `sweny workflow run` makes before any
+ * node) fails, so a broken setup sees its diagnosis. When the gate fails and
+ * no agent line already says why, its reason is added as a failed line. Config
+ * errors skip the provider probes but not the agent lines.
+ */
+export declare function runCheck(config: CliConfig, opts?: Omit<CheckOptions, "harness" | "skipAgent"> & {
+    harness?: Pick<AgentHarness, "diagnose" | "preflight">;
+}): Promise<CheckReport>;
 export declare function checkDatadog(creds: Record<string, string>): Promise<CheckResult>;
 /**
  * Detect a local Claude Code login the way `sweny workflow run` benefits from

package/dist/cli/check.js

@@ -4,53 +4,19 @@ import { parse as parseYaml } from "yaml";
 import { validateInputs } from "./config.js";
 import { findSkillEnvGaps } from "./skill-env.js";
 import { configuredSkills } from "../skills/custom-loader.js";
-/**
- * Per-check network timeout. A hung connect must not make `sweny check` hang
- * indefinitely — the whole point of the command is fast diagnostics.
- */
-const CHECK_TIMEOUT_MS = 5000;
+import { consoleLogger } from "../types.js";
+import { createHarness, isSupportedAgent, unsupportedAgentError } from "../harness/index.js";
+import { CHECK_TIMEOUT_MS, networkErrorMessage } from "../harness/diagnose.js";
+// The Claude probes moved behind the harness seam (#532); these names stay importable from here.
+export { resolveCheckAuthMode, redactUrl, checkAnthropicGateway } from "../harness/diagnose.js";
 export async function checkProviderConnectivity(config, opts = {}) {
     const results = [];
     const scope = opts.scope;
     const inScope = (skillId) => !scope || scope.has(skillId);
     const githubChecked = { done: false }; // avoid double-checking same token
     // ── Coding agent ────────────────────────────────────────────────────────────
-    if (config.codingAgentProvider === "claude") {
-        const mode = resolveCheckAuthMode(config);
-        const base = config.anthropicBaseUrl;
-        if (mode === "none" && opts.claudeCodeLogin) {
-            results.push({
-                name: "Anthropic (claude agent)",
-                status: "ok",
-                detail: "Claude Code login detected",
-            });
-        }
-        else if (mode === "none") {
-            results.push({ name: "Anthropic (claude agent)", status: "skip", detail: "No credential configured" });
-        }
-        else if (base) {
-            // Gateway: probe the gateway, never real Anthropic with a gateway-bound key.
-            results.push(await checkAnthropicGateway(base, config, mode));
-        }
-        else if (mode === "api-key") {
-            results.push(await checkAnthropic(config.anthropicApiKey));
-        }
-        else {
-            // oauth or auth-token, no base URL: nothing cheap to probe, report the mode.
-            results.push({
-                name: "Anthropic (claude agent)",
-                status: "skip",
-                detail: `auth mode: ${mode}, skipping upstream API check`,
-            });
-        }
-    }
-    else {
-        results.push({
-            name: `Coding agent (${config.codingAgentProvider})`,
-            status: "skip",
-            detail: "Connectivity check not implemented for this provider",
-        });
-    }
+    if (!opts.skipAgent)
+        results.push(...(await checkAgent(config, opts)));
     // ── Observability ────────────────────────────────────────────────────────────
     for (const provider of config.observabilityProviders) {
         if (!inScope(provider))
@@ -131,82 +97,69 @@ export async function checkProviderConnectivity(config, opts = {}) {
     return results;
 }
 // ── Provider check functions ─────────────────────────────────────────────────
-async function checkAnthropic(apiKey) {
-    const name = "Anthropic (claude agent)";
+/**
+ * The agent lines (#532): whatever the harness's `diagnose()` checks (CLI and
+ * version, credentials, a stored login, a cheap upstream probe), rendered
+ * like every other line. The harness owns the checks; nothing here branches
+ * on the agent.
+ */
+export async function checkAgent(config, opts = {}) {
+    const agent = config.codingAgentProvider;
+    const name = `Coding agent (${agent})`;
+    if (!isSupportedAgent(agent))
+        return [{ name, status: "fail", detail: unsupportedAgentError(agent) }];
+    let harness;
     try {
-        const res = await fetch("https://api.anthropic.com/v1/models", {
-            headers: { "x-api-key": apiKey, "anthropic-version": "2023-06-01" },
-            signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
-        });
-        if (res.status === 200) {
-            return { name, status: "ok", detail: "API key is valid" };
-        }
-        if (res.status === 401) {
-            return {
-                name,
-                status: "fail",
-                detail: "401 Unauthorized - check ANTHROPIC_API_KEY at https://console.anthropic.com",
-            };
-        }
-        return { name, status: "fail", detail: `Unexpected HTTP ${res.status}` };
+        harness = opts.harness ?? createHarness(agent, { logger: consoleLogger });
     }
     catch (err) {
-        return { name, status: "fail", detail: networkErrorMessage(err) };
-    }
-}
-export function resolveCheckAuthMode(config) {
-    const hasKey = !!config.anthropicApiKey;
-    const hasBearer = !!config.anthropicAuthToken;
-    const hasOauth = !!config.claudeOauthToken;
-    if (config.swenyAuth === "oauth")
-        return hasOauth ? "oauth" : "none";
-    if (config.swenyAuth === "api-key")
-        return hasKey ? "api-key" : hasBearer ? "auth-token" : "none";
-    // auto: OAuth wins when present (today's protective behavior)
-    if (hasOauth)
-        return "oauth";
-    if (hasKey)
-        return "api-key";
-    if (hasBearer)
-        return "auth-token";
-    return "none";
-}
-/** Redact a URL to scheme + host so userinfo / query (which can carry a key) never logs. */
-export function redactUrl(raw) {
-    try {
-        const u = new URL(raw);
-        return `${u.protocol}//${u.host}`;
-    }
-    catch {
-        return "(invalid URL)";
+        return [{ name, status: "fail", detail: err instanceof Error ? err.message : String(err) }];
     }
+    if (!harness.diagnose)
+        return [{ name, status: "skip", detail: "This agent has no preflight checks" }];
+    return harness.diagnose({ env: agentCheckEnv(config, opts.env ?? process.env), timeoutMs: CHECK_TIMEOUT_MS });
 }
-export async function checkAnthropicGateway(base, config, mode) {
-    const name = "Anthropic (gateway)";
-    const safeBase = redactUrl(base);
-    const headers = { "anthropic-version": "2023-06-01" };
-    if (mode === "api-key") {
-        headers["x-api-key"] = config.anthropicApiKey;
-    }
-    else {
-        // auth-token or oauth against the gateway
-        headers.Authorization = `Bearer ${config.anthropicAuthToken || config.claudeOauthToken}`;
-    }
-    try {
-        const url = base.replace(/\/+$/, "") + "/v1/models";
-        const res = await fetch(url, { headers, signal: AbortSignal.timeout(CHECK_TIMEOUT_MS) });
-        // Gateways vary on whether /v1/models exists; reachable + non-auth-error is good enough.
-        if (res.ok || res.status === 404) {
-            return { name, status: "ok", detail: `gateway reachable (${safeBase}), auth mode: ${mode}` };
+/** validateInputs' generic agent-auth lines; the harness's own lines replace them (#339, #532). */
+const AGENT_AUTH_ERROR_PREFIXES = ["Missing: ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN", "Missing: CODEX_API_KEY"];
+/**
+ * `sweny check` end to end (#532). The agent's lines always render, even when
+ * its run gate (`preflight()`, the check `sweny workflow run` makes before any
+ * node) fails, so a broken setup sees its diagnosis. When the gate fails and
+ * no agent line already says why, its reason is added as a failed line. Config
+ * errors skip the provider probes but not the agent lines.
+ */
+export async function runCheck(config, opts = {}) {
+    const agent = config.codingAgentProvider;
+    const errors = validateCheckInputs(config, { scope: opts.scope, env: opts.env }).filter((e) => !AGENT_AUTH_ERROR_PREFIXES.some((p) => e.startsWith(p)) && e !== unsupportedAgentError(agent));
+    let harness = opts.harness;
+    if (!harness && isSupportedAgent(agent)) {
+        try {
+            harness = createHarness(agent, { logger: consoleLogger });
         }
-        if (res.status === 401 || res.status === 403) {
-            return { name, status: "fail", detail: `${res.status} from gateway ${safeBase}, check gateway credentials` };
+        catch {
+            // checkAgent reports the construction error as the agent's line.
         }
-        return { name, status: "fail", detail: `Unexpected HTTP ${res.status} from gateway ${safeBase}` };
     }
-    catch (err) {
-        return { name, status: "fail", detail: networkErrorMessage(err) };
+    const results = await checkAgent(config, { harness, env: opts.env });
+    if (harness && !results.some((r) => r.status === "fail")) {
+        const pre = await harness.preflight();
+        if (!pre.ok)
+            results.push({ name: `Agent (${agent})`, status: "fail", detail: pre.reason });
     }
+    if (errors.length === 0)
+        results.push(...(await checkProviderConnectivity(config, { ...opts, skipAgent: true })));
+    return { results, errors, failed: errors.length > 0 || results.some((r) => r.status === "fail") };
+}
+/** Env for the agent checks: the process env, with the agent settings `.sweny.yml` can also carry. */
+function agentCheckEnv(config, env) {
+    return {
+        ...env,
+        ANTHROPIC_API_KEY: config.anthropicApiKey,
+        ANTHROPIC_AUTH_TOKEN: config.anthropicAuthToken,
+        CLAUDE_CODE_OAUTH_TOKEN: config.claudeOauthToken,
+        ANTHROPIC_BASE_URL: config.anthropicBaseUrl,
+        SWENY_AUTH: config.swenyAuth,
+    };
 }
 export async function checkDatadog(creds) {
     const name = "Observability (datadog)";
@@ -330,19 +283,6 @@ async function checkGitHub(token, name) {
         return { name, status: "fail", detail: networkErrorMessage(err) };
     }
 }
-function networkErrorMessage(err) {
-    // AbortSignal.timeout fires a DOMException with name "TimeoutError"; an
-    // explicit abort surfaces as "AbortError". Either means we gave up waiting.
-    const errName = err instanceof Error ? err.name : "";
-    if (errName === "TimeoutError" || errName === "AbortError") {
-        return `Connection timed out after ${CHECK_TIMEOUT_MS}ms - host unreachable or too slow`;
-    }
-    const msg = err instanceof Error ? err.message : String(err);
-    if (/ENOTFOUND|ETIMEDOUT|ECONNREFUSED/i.test(msg)) {
-        return `Network error - check your internet connection (${msg})`;
-    }
-    return msg;
-}
 // ── Workflow-scoped checks ───────────────────────────────────────────────────
 /**
  * Detect a local Claude Code login the way `sweny workflow run` benefits from

package/dist/cli/main.js

@@ -51,7 +51,7 @@ import { applyNoColor, createPaint } from "./style.js";
 import { colorEnabled, glyphsFor, richOutput, spinnerFramesFor, supportsUnicode } from "./terminal.js";
 import { registerTriageCommand, registerImplementCommand, parseCliInputs, validateInputs, parsePositiveInt, } from "./config.js";
 import { c, formatBanner, getStepDetails, formatStepLine, formatDagResultHuman, formatDagResultMarkdown, writeResultJson, formatValidationErrors, formatCrashError, formatCheckResults, } from "./output.js";
-import { checkProviderConnectivity, detectClaudeCodeLogin, discoverWorkflowSkillIds, validateCheckInputs, } from "./check.js";
+import { discoverWorkflowSkillIds, runCheck } from "./check.js";
 import { registerSetupCommand } from "./setup.js";
 import { registerPublishCommand } from "./publish.js";
 import { registerSkillCommand } from "./skill.js";
@@ -119,8 +119,6 @@ program
 // ── sweny try ─────────────────────────────────────────────────────────
 registerTryCommand(program);
 // ── sweny check ───────────────────────────────────────────────────────
-/** validateInputs' generic agent-auth lines, replaced by the harness preflight reason (#339). */
-const AGENT_AUTH_ERROR_PREFIXES = ["Missing: ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN", "Missing: CODEX_API_KEY"];
 program
     .command("check")
     .description("Verify provider credentials and connectivity")
@@ -129,26 +127,13 @@ program
     const config = parseCliInputs({}, fileConfig);
     const workflows = discoverWorkflowSkillIds(process.cwd());
     const scope = workflows.found ? workflows.skillIds : undefined;
-    const claudeCodeLogin = detectClaudeCodeLogin();
-    let errors = validateCheckInputs(config, { scope, claudeCodeLogin });
-    // #339: the agent's own preflight (install and login), named by --agent.
-    // Its reason replaces the generic agent-auth line from validateInputs.
-    const agent = config.codingAgentProvider;
-    const pre = isSupportedAgent(agent) ? await createHarness(agent, { logger: consoleLogger }).preflight() : undefined;
-    if (pre && !pre.ok) {
-        errors = [pre.reason, ...errors.filter((e) => !AGENT_AUTH_ERROR_PREFIXES.some((p) => e.startsWith(p)))];
-    }
-    if (errors.length > 0) {
-        console.error(formatValidationErrors(errors));
-        process.exit(1);
-    }
     console.log(chalk.dim("\n  Checking provider connectivity…\n"));
-    const results = await checkProviderConnectivity(config, { scope, claudeCodeLogin });
-    if (pre?.ok)
-        results.unshift({ name: `Agent (${agent})`, status: "ok", detail: `ready (${pre.version})` });
-    console.log(formatCheckResults(results));
-    const hasFailure = results.some((r) => r.status === "fail");
-    process.exit(hasFailure ? 1 : 0);
+    // #532: the agent's diagnosis always renders, even when its run gate fails.
+    const report = await runCheck(config, { scope });
+    console.log(formatCheckResults(report.results, { color: colorEnabled(process.stdout), unicode: supportsUnicode() }));
+    if (report.errors.length > 0)
+        console.error(formatValidationErrors(report.errors));
+    process.exit(report.failed ? 1 : 0);
 });
 registerSetupCommand(program);
 registerPublishCommand(program);

package/dist/cli/new.js

@@ -38,7 +38,6 @@ export const SKILL_EXTRAS = {
     BETTERSTACK_API_TOKEN: { url: "https://betterstack.com/docs/logs/api" },
     NR_API_KEY: { url: "https://one.newrelic.com/api-keys" },
     LINEAR_API_KEY: { url: "https://linear.app/settings/api" },
-    LINEAR_TEAM_ID: { hint: "Settings > Teams > copy ID from URL" },
     JIRA_BASE_URL: { hint: "e.g. https://your-org.atlassian.net" },
     JIRA_EMAIL: { hint: "your Atlassian account email" },
     JIRA_API_TOKEN: { url: "https://id.atlassian.com/manage-profile/security/api-tokens" },
@@ -77,10 +76,8 @@ export const SKILL_CREDENTIALS = {
     ],
     betterstack: [{ key: "BETTERSTACK_API_TOKEN", url: "https://betterstack.com/docs/logs/api" }],
     newrelic: [{ key: "NR_API_KEY", url: "https://one.newrelic.com/api-keys" }],
-    linear: [
-        { key: "LINEAR_API_KEY", url: "https://linear.app/settings/api" },
-        { key: "LINEAR_TEAM_ID", hint: "Settings > Teams > copy ID from URL" },
-    ],
+    // No LINEAR_TEAM_ID: only `sweny setup linear` reads it, and it takes --team-id (#532).
+    linear: [{ key: "LINEAR_API_KEY", url: "https://linear.app/settings/api" }],
     jira: [
         { key: "JIRA_BASE_URL", hint: "e.g. https://your-org.atlassian.net" },
         { key: "JIRA_EMAIL", hint: "your Atlassian account email" },

package/dist/cli/output.d.ts

@@ -23,7 +23,19 @@ export declare function formatDagResultHuman(results: Map<string, NodeResult>, d
 export declare function formatValidationErrors(errors: string[]): string;
 export declare function extractCredentialHint(err: unknown): string | null;
 export declare function formatCrashError(error: unknown): string;
-export declare function formatCheckResults(results: CheckResult[]): string;
+export interface CheckFormatOptions {
+    /** ANSI color (`colorEnabled(stdout)`: off under NO_COLOR, a pipe, TERM=dumb). Default off. */
+    color?: boolean;
+    /** Unicode glyphs and box lines (`supportsUnicode()`); false draws ASCII. Default on. */
+    unicode?: boolean;
+}
+/**
+ * `sweny check`'s box: one line per check (glyph, name, detail below), then a
+ * summary. Painted through {@link createPaint} and the theme `GLYPHS`,
+ * so `NO_COLOR` and ASCII terminals get the same text without color or with
+ * ASCII glyphs and box lines.
+ */
+export declare function formatCheckResults(results: CheckResult[], opts?: CheckFormatOptions): string;
 /**
  * Node results as JSON, redacted with the run journal's redactor (secret
  * values, secret-named fields, known token shapes). Structure and keys stay.

package/dist/cli/output.js

@@ -2,6 +2,8 @@ import chalk from "chalk";
 import { redact } from "../journal.js";
 import { toMermaidBlock } from "../mermaid.js";
 import { PALETTE, ROLE_COLORS } from "../theme.js";
+import { createPaint } from "./style.js";
+import { glyphsFor, toAsciiDrawing } from "./terminal.js";
 // ── Color palette (tokens from theme.ts; one color per meaning) ─
 export const c = {
     brand: chalk.hex(ROLE_COLORS.brand),
@@ -376,33 +378,52 @@ export function formatCrashError(error) {
     ];
     return ["", boxTop(), ...boxSection(header), boxDivider(), ...boxSection(body), boxBottom(), ""].join("\n");
 }
-// ── Check results ────────────────────────────────────────────────
-export function formatCheckResults(results) {
-    const title = `${chalk.bold("Provider Connectivity Check")}`;
-    const header = [title];
-    const body = results.map((r) => {
-        const icon = r.status === "ok" ? c.ok("\u2713") : r.status === "fail" ? c.fail("\u2717") : c.subtle("\u2212");
-        const name = chalk.white(r.name);
-        const detail = r.status === "ok" ? c.subtle(r.detail) : r.status === "fail" ? c.fail(r.detail) : c.subtle(r.detail);
-        return `${icon}  ${name}\n     ${detail}`;
+/**
+ * `sweny check`'s box: one line per check (glyph, name, detail below), then a
+ * summary. Painted through {@link createPaint} and the theme `GLYPHS`,
+ * so `NO_COLOR` and ASCII terminals get the same text without color or with
+ * ASCII glyphs and box lines.
+ */
+export function formatCheckResults(results, opts = {}) {
+    const paint = createPaint(opts.color ?? false);
+    const unicode = opts.unicode ?? true;
+    const g = glyphsFor(unicode);
+    const inner = BOX_WIDTH - 4;
+    const bar = paint.muted("\u2502");
+    const edge = (l, r) => paint.muted(`  ${l}${"\u2500".repeat(BOX_WIDTH)}${r}`);
+    const blank = `  ${bar}${" ".repeat(BOX_WIDTH)}${bar}`;
+    // A line that fits keeps its color; a longer one wraps as plain text.
+    const row = (text) => (visLen(text) <= inner ? [text] : wrapText(text, inner)).map((l) => `  ${bar}  ${padLine(l, inner)}  ${bar}`);
+    const section = (rows) => [blank, ...rows, blank];
+    const body = results.flatMap((r) => {
+        const icon = r.status === "ok"
+            ? paint.success(g.success)
+            : r.status === "fail"
+                ? paint.error(g.failure)
+                : paint.muted(g.skipped);
+        const tone = r.status === "fail" ? paint.error : paint.muted;
+        // The detail sits under the name, indented past the glyph, each wrapped line painted on its own.
+        const detail = wrapText(r.detail, inner - 5).flatMap((l) => row(`     ${tone(l)}`));
+        return [...row(`${icon}  ${r.name}`), ...detail];
     });
     const hasFailure = results.some((r) => r.status === "fail");
     const summary = hasFailure
-        ? c.fail("One or more checks failed. Fix the issues above before running sweny triage.")
+        ? paint.error("One or more checks failed. Fix the issues above before running a workflow.")
         : results.every((r) => r.status === "skip")
-            ? c.subtle("All providers set to file mode: no network checks performed.")
-            : c.ok("All checks passed.");
-    return [
+            ? paint.muted("All providers set to file mode: no network checks performed.")
+            : paint.success("All checks passed.");
+    const out = [
         "",
-        boxTop(),
-        ...boxSection(header),
-        boxDivider(),
-        ...boxSection(body),
-        boxDivider(),
-        ...boxSection([summary]),
-        boxBottom(),
+        edge("\u256D", "\u256E"),
+        ...section(row(paint.strong("Provider Connectivity Check"))),
+        edge("\u251C", "\u2524"),
+        ...section(body),
+        edge("\u251C", "\u2524"),
+        ...section(row(summary)),
+        edge("\u2570", "\u256F"),
         "",
     ].join("\n");
+    return unicode ? out : toAsciiDrawing(out);
 }
 // ── JSON output ─────────────────────────────────────────────────
 /**

package/dist/harness/acp.d.ts

@@ -46,7 +46,7 @@
  */
 import type { Logger, McpServerConfig, ToolContext } from "../types.js";
 import { type HarnessEnvOptions, type SandboxMode } from "../agent-env.js";
-import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
+import type { AgentHarness, HarnessCapabilities, HarnessCheck, HarnessCompleteRequest, HarnessDiagnoseOptions, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
 import { ACP_CAPABILITIES } from "./capabilities.js";
 import { type HarnessPolicyMode } from "./policy.js";
 import { type SandboxWrapper } from "./sandbox-wrapper.js";
@@ -163,6 +163,14 @@ export declare class AcpHarness implements AgentHarness {
         ok: false;
         reason: string;
     }>;
+    private notFoundReason;
+    /**
+     * `sweny check` (#532): the command resolves (the way {@link preflight}
+     * does), and the operator-named auth vars are set. The agent is not started
+     * (same reason as `preflight`), so its version and its own login are
+     * reported on the first run. No credential value is printed.
+     */
+    diagnose(opts?: HarnessDiagnoseOptions): Promise<HarnessCheck[]>;
     /**
      * Env for the agent process: scoped like Claude Code's, with only the auth
      * vars the operator named. Skill credentials are dropped either way

package/dist/harness/acp.js

@@ -59,6 +59,7 @@ import { defaultSandboxWrapper, prepareAgentSpawn, wrappersFrom, } from "./sandb
 import { TOKEN_ENV } from "./tool-bridge/protocol.js";
 import { translateDenyNames } from "./codex.js";
 import { RPC_ERROR, RpcError, RpcPeer, splitCommandLine } from "./acp-rpc.js";
+import { diagnoseEnv } from "./diagnose.js";
 export { ACP_CAPABILITIES };
 /** The ACP major version sweny speaks (`InitializeRequest.protocolVersion`). */
 export const ACP_PROTOCOL_VERSION = 1;
@@ -239,15 +240,40 @@ export class AcpHarness {
      */
     async preflight() {
         const found = resolveExecutable(this.agent.command, overlaidProcessEnv(this.envOverlay, this.authVars), this.cwd);
-        if (!found) {
-            const example = [this.agent.command, ...this.agent.args].join(" ");
-            return {
-                ok: false,
-                reason: `ACP agent command "${this.agent.command}" was not found on PATH (or is not executable). Install the agent and check that \`${example}\` starts an ACP server.`,
-            };
-        }
+        if (!found)
+            return { ok: false, reason: this.notFoundReason() };
         return { ok: true, version: this.agentVersion };
     }
+    notFoundReason() {
+        const example = [this.agent.command, ...this.agent.args].join(" ");
+        return `ACP agent command "${this.agent.command}" was not found on PATH (or is not executable). Install the agent and check that \`${example}\` starts an ACP server.`;
+    }
+    /**
+     * `sweny check` (#532): the command resolves (the way {@link preflight}
+     * does), and the operator-named auth vars are set. The agent is not started
+     * (same reason as `preflight`), so its version and its own login are
+     * reported on the first run. No credential value is printed.
+     */
+    async diagnose(opts = {}) {
+        const env = diagnoseEnv(opts.env, this.envOverlay, this.authVars);
+        const cliName = `Agent CLI (${this.id})`;
+        const found = resolveExecutable(this.agent.command, env, this.cwd);
+        const cli = found
+            ? { name: cliName, status: "ok", detail: `${found} (the agent reports its version when a run starts)` }
+            : { name: cliName, status: "fail", detail: this.notFoundReason() };
+        const authName = `Agent auth (${this.id})`;
+        const missing = this.authVars.filter((v) => !env[v]?.trim());
+        const auth = this.authVars.length === 0
+            ? {
+                name: authName,
+                status: "skip",
+                detail: "ACP agents handle their own login; the agent reports a missing one when a run starts",
+            }
+            : missing.length > 0
+                ? { name: authName, status: "fail", detail: `Missing: ${missing.join(", ")}` }
+                : { name: authName, status: "ok", detail: `set: ${this.authVars.join(", ")}` };
+        return [cli, auth];
+    }
     /**
      * Env for the agent process: scoped like Claude Code's, with only the auth
      * vars the operator named. Skill credentials are dropped either way

package/dist/harness/claude-code.d.ts

@@ -10,7 +10,7 @@
  */
 import type { Claude, Tool, ToolContext, NodeUsage, Logger, McpServerConfig } from "../types.js";
 import { type HarnessEnvOptions, type SandboxMode } from "../agent-env.js";
-import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, ToolClass } from "./types.js";
+import type { AgentHarness, HarnessCapabilities, HarnessCheck, HarnessCompleteRequest, HarnessDiagnoseOptions, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, ToolClass } from "./types.js";
 import { type HarnessPolicyMode } from "./policy.js";
 import { CLAUDE_CODE_CAPABILITIES } from "./capabilities.js";
 import { buildEvaluatePrompt } from "./prompts.js";
@@ -216,6 +216,13 @@ export declare class ClaudeCodeHarness implements Claude, AgentHarness {
         ok: false;
         reason: string;
     }>;
+    /**
+     * `sweny check` (#532): the Agent SDK sweny ships with, then the credential
+     * line `sweny check` always printed (a stored login, an API key or gateway
+     * probe that lists models, or the auth mode). The env is the one
+     * {@link preflight} reads: the caller's `env` / `envRemove` applied.
+     */
+    diagnose(opts?: HarnessDiagnoseOptions): Promise<HarnessCheck[]>;
     /**
      * Run a node. Runs {@link policyGate} (always `degraded: []` for Claude
      * Code), compiles the policy to native options, and tags the result with the

package/dist/harness/claude-code.js

@@ -10,7 +10,8 @@
  */
 import { query, createSdkMcpServer, tool as sdkTool } from "@anthropic-ai/claude-agent-sdk";
 import { createRequire } from "node:module";
-import { realpathSync } from "node:fs";
+import { readFileSync, realpathSync } from "node:fs";
+import * as path from "node:path";
 import { consoleLogger } from "../types.js";
 import { AGENT_AUTH_VARS, agentEnvOverlay, applyEnvOverlay, finishAgentEnv, overlaidProcessEnv, reportWithheldEnv, parseList, resolveEnvScope, scopeAgentEnv, withPushBlocked, mcpWithheld, resolveAgentSandbox, } from "../agent-env.js";
 import { gitCredentialGap, policyGate } from "./policy.js";
@@ -22,7 +23,8 @@ import { startToolBridge } from "./tool-bridge/server.js";
 import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./parse.js";
 import { makeAbort } from "./abort.js";
 import { runStateRoot } from "../journal.js";
-import { claudeCodeAuth } from "./auth.js";
+import { claudeCodeAuth, detectClaudeCodeLogin } from "./auth.js";
+import { diagnoseClaudeCode, diagnoseEnv } from "./diagnose.js";
 export { buildEvaluatePrompt, CLAUDE_CODE_CAPABILITIES };
 export { parseToolResultContent, summarizeToolError, makeAbort };
 let cachedSdkVersion;
@@ -31,9 +33,11 @@ function claudeSdkVersion() {
     if (cachedSdkVersion !== undefined)
         return cachedSdkVersion;
     try {
-        const req = createRequire(import.meta.url);
-        const pkg = req("@anthropic-ai/claude-agent-sdk/package.json");
-        cachedSdkVersion = typeof pkg.version === "string" ? pkg.version : "unknown";
+        // The SDK's `exports` map has no "./package.json", so read it next to the entry file (the package root).
+        const entry = createRequire(import.meta.url).resolve("@anthropic-ai/claude-agent-sdk");
+        const pkg = JSON.parse(readFileSync(path.join(path.dirname(entry), "package.json"), "utf-8"));
+        cachedSdkVersion =
+            pkg.name === "@anthropic-ai/claude-agent-sdk" && typeof pkg.version === "string" ? pkg.version : "unknown";
     }
     catch {
         cachedSdkVersion = "unknown";
@@ -333,6 +337,22 @@ export class ClaudeCodeHarness {
             return { ok: false, reason: auth.reason };
         return { ok: true, version: claudeSdkVersion() };
     }
+    /**
+     * `sweny check` (#532): the Agent SDK sweny ships with, then the credential
+     * line `sweny check` always printed (a stored login, an API key or gateway
+     * probe that lists models, or the auth mode). The env is the one
+     * {@link preflight} reads: the caller's `env` / `envRemove` applied.
+     */
+    async diagnose(opts = {}) {
+        const env = diagnoseEnv(opts.env, this.envOverlay, AGENT_AUTH_VARS);
+        const sdk = {
+            name: "Agent CLI (claude)",
+            status: "ok",
+            detail: `Claude Agent SDK ${claudeSdkVersion()} (installed with sweny)`,
+        };
+        const hasLogin = opts.hasLogin ?? (() => detectClaudeCodeLogin({ env }));
+        return [sdk, ...(await diagnoseClaudeCode({ env, hasLogin, timeoutMs: opts.timeoutMs }))];
+    }
     /**
      * Run a node. Runs {@link policyGate} (always `degraded: []` for Claude
      * Code), compiles the policy to native options, and tags the result with the