@sweny-ai/core 0.1.202 → 0.1.204

package/dist/harness/codex.d.ts

@@ -25,7 +25,7 @@
  */
 import type { Logger, McpServerConfig, ToolContext } from "../types.js";
 import { type HarnessEnvOptions, type SandboxMode } from "../agent-env.js";
-import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
+import type { AgentHarness, HarnessCapabilities, HarnessCheck, HarnessCompleteRequest, HarnessDiagnoseOptions, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
 import { CODEX_CAPABILITIES } from "./capabilities.js";
 import { type HarnessPolicyMode } from "./policy.js";
 import { type SandboxWrapper } from "./sandbox-wrapper.js";
@@ -162,9 +162,10 @@ export declare class CodexHarness implements AgentHarness {
         reason: string;
     }>;
     /**
-     * `process.env` with the caller's `env` / `envRemove` applied, unscoped: where
-     * sweny reads Codex's own settings (`OPENAI_BASE_URL`) and the login probe.
-     * The scoped agent env would drop an inherited base URL.
+     * `process.env` (or `base`, for `sweny check`) with the caller's `env` /
+     * `envRemove` applied, unscoped: where sweny reads Codex's own settings
+     * (`OPENAI_BASE_URL`) and the login probe. The scoped agent env would drop
+     * an inherited base URL.
      */
     private hostEnv;
     /**
@@ -177,6 +178,23 @@ export declare class CodexHarness implements AgentHarness {
     private cliPath;
     /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
     private checkCli;
+    /** Run `<resolved> --version` with `hostEnv` and parse it. No caching, no side effects. */
+    private probeVersion;
+    /**
+     * `sweny check` (#532): the CLI and its version (resolved and parsed the way
+     * {@link preflight} does), a credential ({@link codexAuth}), the CLI's own
+     * `codex login status`, and an upstream probe when an API key is set
+     * (`GET /models`: read-only, no model call, no tokens). A ChatGPT login or
+     * an access token has no cheap upstream probe, so that line is skipped.
+     * Nothing is cached and no credential value is printed.
+     */
+    diagnose(opts?: HarnessDiagnoseOptions): Promise<HarnessCheck[]>;
+    /**
+     * `codex login status`: exit 0 when a login is stored, non-zero when not
+     * (codex-rs/cli/src/login.rs). Its output can carry a masked key, so it is
+     * classified, never printed.
+     */
+    private loginStatus;
     /**
      * Env for the Codex process: scoped like Claude Code's, with Codex's auth
      * vars instead of Anthropic's, then the caller's `envRemove` / `env`

package/dist/harness/codex.js

@@ -28,7 +28,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { consoleLogger } from "../types.js";
-import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, agentEnvOverlay, applyEnvOverlay, checkSandboxSupport, finishAgentEnv, resolveExecutable, overlaidProcessEnv, heldCredentials, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
+import { CODEX_AUTH_VARS, CODEX_ENV_PREFIXES, agentEnvOverlay, applyEnvOverlay, checkSandboxSupport, finishAgentEnv, resolveExecutable, heldCredentials, hasCodexLogin, parseList, reportWithheldEnv, resolveCodexAuthEnv, resolveEnvScope, resolveSandboxMode, scopeAgentEnv, withPushBlocked, mcpWithheld, } from "../agent-env.js";
 import { CODEX_CAPABILITIES } from "./capabilities.js";
 import { policyGate, resolveHarnessPolicy } from "./policy.js";
 import { gitCredentialPolicy } from "../git-credentials.js";
@@ -39,6 +39,7 @@ import { startToolBridge } from "./tool-bridge/server.js";
 import { defaultSandboxWrapper, prepareAgentSpawn, wrappersFrom, } from "./sandbox-wrapper.js";
 import { TOKEN_ENV } from "./tool-bridge/protocol.js";
 import { codexAuth } from "./auth.js";
+import { CHECK_TIMEOUT_MS, checkOpenAI, cliCheck, diagnoseEnv, runCli } from "./diagnose.js";
 export { CODEX_CAPABILITIES };
 /**
  * The credentials an `env` overlay replaces as a set ({@link applyEnvOverlay}):
@@ -342,20 +343,21 @@ export class CodexHarness {
         return auth.ok ? cli : { ok: false, reason: auth.reason };
     }
     /**
-     * `process.env` with the caller's `env` / `envRemove` applied, unscoped: where
-     * sweny reads Codex's own settings (`OPENAI_BASE_URL`) and the login probe.
-     * The scoped agent env would drop an inherited base URL.
+     * `process.env` (or `base`, for `sweny check`) with the caller's `env` /
+     * `envRemove` applied, unscoped: where sweny reads Codex's own settings
+     * (`OPENAI_BASE_URL`) and the login probe. The scoped agent env would drop
+     * an inherited base URL.
      */
-    hostEnv() {
-        return overlaidProcessEnv(this.envOverlay, CODEX_CREDENTIAL_VARS);
+    hostEnv(base) {
+        return diagnoseEnv(base, this.envOverlay, CODEX_CREDENTIAL_VARS);
     }
     /**
      * {@link hostEnv} as the login probe should see it: an inherited
      * OPENAI_API_KEY does not count once `envRemove` names CODEX_API_KEY, since
      * the agent env no longer derives CODEX_API_KEY from it.
      */
-    loginEnv() {
-        const env = this.hostEnv();
+    loginEnv(base) {
+        const env = this.hostEnv(base);
         const overlay = this.envOverlay;
         if (overlay?.remove.includes("CODEX_API_KEY") && !Object.hasOwn(overlay.env, "OPENAI_API_KEY")) {
             delete env.OPENAI_API_KEY;
@@ -368,13 +370,32 @@ export class CodexHarness {
     }
     /** `codex --version`, checked against {@link MIN_CODEX_VERSION}. Cached per instance. */
     checkCli() {
-        this.preflightResult ??= new Promise((resolve) => {
-            const { command, args } = this.codexCommand;
+        this.preflightResult ??= (() => {
             // Probe the file the spawn will run: resolved on the run's PATH and cwd, then reused at spawn.
             const hostEnv = this.hostEnv();
-            this.resolvedCommand = resolveExecutable(command, hostEnv, this.cwd);
+            this.resolvedCommand = resolveExecutable(this.codexCommand.command, hostEnv, this.cwd);
+            return this.probeVersion(this.resolvedCommand, hostEnv).then((res) => {
+                if (!res.ok)
+                    return res;
+                this.version = res.version;
+                // Newer than the tested version: the declared capabilities may no longer hold. Warn once
+                // (the result is cached per instance). Not `degraded`: that is a per-node policy report and
+                // there is no node yet; not a refusal: it would break anyone who chose `latest` on purpose.
+                if (compareVersions(res.version, TESTED_CODEX_VERSION) > 0) {
+                    this.logger.warn(`codex ${res.version} is newer than ${TESTED_CODEX_VERSION}, the version sweny's Codex capabilities were tested against; ` +
+                        `flags and event shapes may differ. Pin @openai/codex@${TESTED_CODEX_VERSION} (action input codex-version) for the tested behavior.`);
+                }
+                return res;
+            });
+        })();
+        return this.preflightResult;
+    }
+    /** Run `<resolved> --version` with `hostEnv` and parse it. No caching, no side effects. */
+    probeVersion(resolved, hostEnv) {
+        const { command, args } = this.codexCommand;
+        return new Promise((resolve) => {
             const opts = { timeout: 30_000, cwd: this.cwd, env: hostEnv };
-            execFile(this.resolvedCommand ?? command, [...args, "--version"], opts, (err, stdout) => {
+            execFile(resolved ?? command, [...args, "--version"], opts, (err, stdout) => {
                 if (err) {
                     const code = err.code;
                     resolve({
@@ -394,18 +415,72 @@ export class CodexHarness {
                     resolve({ ok: false, reason: `codex ${m[1]} is too old; sweny needs >= ${MIN_CODEX_VERSION}` });
                     return;
                 }
-                this.version = m[1];
-                // Newer than the tested version: the declared capabilities may no longer hold. Warn once
-                // (the result is cached per instance). Not `degraded`: that is a per-node policy report and
-                // there is no node yet; not a refusal: it would break anyone who chose `latest` on purpose.
-                if (compareVersions(m[1], TESTED_CODEX_VERSION) > 0) {
-                    this.logger.warn(`codex ${m[1]} is newer than ${TESTED_CODEX_VERSION}, the version sweny's Codex capabilities were tested against; ` +
-                        `flags and event shapes may differ. Pin @openai/codex@${TESTED_CODEX_VERSION} (action input codex-version) for the tested behavior.`);
-                }
                 resolve({ ok: true, version: m[1] });
             });
         });
-        return this.preflightResult;
+    }
+    /**
+     * `sweny check` (#532): the CLI and its version (resolved and parsed the way
+     * {@link preflight} does), a credential ({@link codexAuth}), the CLI's own
+     * `codex login status`, and an upstream probe when an API key is set
+     * (`GET /models`: read-only, no model call, no tokens). A ChatGPT login or
+     * an access token has no cheap upstream probe, so that line is skipped.
+     * Nothing is cached and no credential value is printed.
+     */
+    async diagnose(opts = {}) {
+        const hostEnv = this.hostEnv(opts.env);
+        const env = this.loginEnv(opts.env);
+        const timeoutMs = opts.timeoutMs ?? CHECK_TIMEOUT_MS;
+        const resolved = resolveExecutable(this.codexCommand.command, hostEnv, this.cwd);
+        const pre = await this.probeVersion(resolved, hostEnv);
+        const newer = pre.ok && compareVersions(pre.version, TESTED_CODEX_VERSION) > 0
+            ? `(newer than ${TESTED_CODEX_VERSION}, the version sweny is tested against)`
+            : undefined;
+        const checks = [cliCheck("Agent CLI (codex)", resolved, pre, newer)];
+        const auth = codexAuth(env, opts.hasLogin ?? (() => hasCodexLogin(env)));
+        checks.push(auth.ok
+            ? { name: "Agent auth (codex)", status: "ok", detail: `via ${auth.via}` }
+            : { name: "Agent auth (codex)", status: "fail", detail: auth.reason });
+        // No credential at all: the auth line already names `codex login`; asking the CLI adds nothing.
+        if (!auth.ok)
+            return checks;
+        if (pre.ok)
+            checks.push(await this.loginStatus(resolved, hostEnv, timeoutMs, auth.via));
+        const keyVar = ["CODEX_API_KEY", "OPENAI_API_KEY"].find((k) => env[k]?.trim());
+        checks.push(keyVar
+            ? await checkOpenAI(env[keyVar].trim(), keyVar, hostEnv.OPENAI_BASE_URL || undefined, timeoutMs)
+            : {
+                name: "OpenAI API (codex agent)",
+                status: "skip",
+                detail: `auth via ${auth.via}, skipping upstream API check`,
+            });
+        return checks;
+    }
+    /**
+     * `codex login status`: exit 0 when a login is stored, non-zero when not
+     * (codex-rs/cli/src/login.rs). Its output can carry a masked key, so it is
+     * classified, never printed.
+     */
+    async loginStatus(resolved, env, timeoutMs, via) {
+        const name = "Agent login (codex)";
+        const { command, args } = this.codexCommand;
+        const r = await runCli(resolved ?? command, [...args, "login", "status"], { env, cwd: this.cwd, timeoutMs });
+        if (r.code === 0) {
+            const out = `${r.stdout}\n${r.stderr}`;
+            const how = /ChatGPT/i.test(out) ? " with ChatGPT" : /API key/i.test(out) ? " with an API key" : "";
+            return { name, status: "ok", detail: `logged in${how} (codex login status)` };
+        }
+        if (r.code === null)
+            return { name, status: "fail", detail: `codex login status did not finish: ${r.error}` };
+        // Not logged in. Fine when an env credential carries auth instead.
+        if (via !== "codex login") {
+            return { name, status: "skip", detail: `no stored login (codex login status); Codex authenticates with ${via}` };
+        }
+        return {
+            name,
+            status: "fail",
+            detail: "codex login status: not logged in, though auth.json exists. Run `codex login` again",
+        };
     }
     /**
      * Env for the Codex process: scoped like Claude Code's, with Codex's auth

package/dist/harness/diagnose.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Probes behind `AgentHarness.diagnose()` (#532), the agent lines of `sweny
+ * check`. Read-only and cheap: env and file presence, a CLI's own version or
+ * status command, and HTTP requests that list models (no model call, no
+ * tokens). Nothing here prints a credential value.
+ */
+import { type AgentEnvOverlay } from "../agent-env.js";
+import type { HarnessCheck } from "./types.js";
+/** Per-probe timeout: a hung connect or CLI must not make `sweny check` hang. */
+export declare const CHECK_TIMEOUT_MS = 5000;
+/**
+ * The env a harness's checks read: `base` (default `process.env`) with the
+ * harness's `env` / `envRemove` overlay applied the way `preflight()` applies
+ * it (`overlaidProcessEnv` in agent-env.ts, which this matches for
+ * `process.env`), so `sweny check` sees the same PATH, HOME and credentials a
+ * run would. `SWENY_*` overlay names stay out, as there.
+ */
+export declare function diagnoseEnv(base: Record<string, string | undefined> | undefined, overlay: AgentEnvOverlay | undefined, credentials: readonly string[]): Record<string, string>;
+/** Redact a URL to scheme + host so userinfo / query (which can carry a key) never logs. */
+export declare function redactUrl(raw: string): string;
+export declare function networkErrorMessage(err: unknown, timeoutMs?: number): string;
+/**
+ * The CLI line: the adapter's own version check (the same resolution and
+ * parse a run's `preflight()` does) plus the file it resolved to.
+ */
+export declare function cliCheck(name: string, resolved: string | undefined, pre: {
+    ok: true;
+    version: string;
+} | {
+    ok: false;
+    reason: string;
+}, note?: string): HarnessCheck;
+export interface CliRun {
+    /** Exit code; null when the process could not start or was killed. */
+    code: number | null;
+    stdout: string;
+    stderr: string;
+    /** Set when the process could not start (ENOENT) or timed out. */
+    error?: string;
+}
+/** Run a CLI subcommand with a timeout. Never throws; output is for parsing, not printing. */
+export declare function runCli(command: string, args: string[], opts?: {
+    env?: Record<string, string | undefined>;
+    cwd?: string;
+    timeoutMs?: number;
+}): Promise<CliRun>;
+/** `GET <base>/models` with an OpenAI key (Codex). */
+export declare function checkOpenAI(apiKey: string, envName: string, baseUrl?: string, timeoutMs?: number): Promise<HarnessCheck>;
+/** Which credential `sweny check` should validate for Claude, mirroring resolveAuthEnv intent. */
+export type CheckAuthMode = "oauth" | "api-key" | "auth-token" | "none";
+export interface ClaudeCheckAuth {
+    anthropicApiKey: string;
+    anthropicAuthToken: string;
+    claudeOauthToken: string;
+    swenyAuth: "auto" | "api-key" | "oauth";
+}
+export declare function resolveCheckAuthMode(config: ClaudeCheckAuth): CheckAuthMode;
+/** `GET https://api.anthropic.com/v1/models` with an API key. */
+export declare function checkAnthropic(apiKey: string, timeoutMs?: number): Promise<HarnessCheck>;
+/** Probe an Anthropic-compatible gateway, never real Anthropic with a gateway-bound key. */
+export declare function checkAnthropicGateway(base: string, config: Pick<ClaudeCheckAuth, "anthropicApiKey" | "anthropicAuthToken" | "claudeOauthToken">, mode: CheckAuthMode, timeoutMs?: number): Promise<HarnessCheck>;
+/**
+ * Claude Code's `sweny check` line, unchanged from before #532: a stored
+ * login, an upstream probe for an API key or a gateway, or a skip that names
+ * the auth mode.
+ */
+export declare function diagnoseClaudeCode(opts: {
+    env: Record<string, string | undefined>;
+    hasLogin: () => boolean;
+    timeoutMs?: number;
+}): Promise<HarnessCheck[]>;

package/dist/harness/diagnose.js

@@ -0,0 +1,201 @@
+/**
+ * Probes behind `AgentHarness.diagnose()` (#532), the agent lines of `sweny
+ * check`. Read-only and cheap: env and file presence, a CLI's own version or
+ * status command, and HTTP requests that list models (no model call, no
+ * tokens). Nothing here prints a credential value.
+ */
+import { execFile } from "node:child_process";
+import { applyEnvOverlay } from "../agent-env.js";
+/** Per-probe timeout: a hung connect or CLI must not make `sweny check` hang. */
+export const CHECK_TIMEOUT_MS = 5000;
+/**
+ * The env a harness's checks read: `base` (default `process.env`) with the
+ * harness's `env` / `envRemove` overlay applied the way `preflight()` applies
+ * it (`overlaidProcessEnv` in agent-env.ts, which this matches for
+ * `process.env`), so `sweny check` sees the same PATH, HOME and credentials a
+ * run would. `SWENY_*` overlay names stay out, as there.
+ */
+export function diagnoseEnv(base, overlay, credentials) {
+    const full = Object.fromEntries(Object.entries(base ?? process.env).filter((e) => e[1] != null));
+    if (!overlay)
+        return full;
+    const own = (n) => !n.startsWith("SWENY_");
+    return applyEnvOverlay(full, {
+        env: Object.fromEntries(Object.entries(overlay.env).filter(([k]) => own(k))),
+        remove: overlay.remove.filter(own),
+    }, credentials);
+}
+/** Redact a URL to scheme + host so userinfo / query (which can carry a key) never logs. */
+export function redactUrl(raw) {
+    try {
+        const u = new URL(raw);
+        return `${u.protocol}//${u.host}`;
+    }
+    catch {
+        return "(invalid URL)";
+    }
+}
+export function networkErrorMessage(err, timeoutMs = CHECK_TIMEOUT_MS) {
+    // AbortSignal.timeout fires a DOMException with name "TimeoutError"; an
+    // explicit abort surfaces as "AbortError". Either means we gave up waiting.
+    const errName = err instanceof Error ? err.name : "";
+    if (errName === "TimeoutError" || errName === "AbortError") {
+        return `Connection timed out after ${timeoutMs}ms - host unreachable or too slow`;
+    }
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/ENOTFOUND|ETIMEDOUT|ECONNREFUSED/i.test(msg)) {
+        return `Network error - check your internet connection (${msg})`;
+    }
+    return msg;
+}
+/**
+ * The CLI line: the adapter's own version check (the same resolution and
+ * parse a run's `preflight()` does) plus the file it resolved to.
+ */
+export function cliCheck(name, resolved, pre, note) {
+    if (!pre.ok)
+        return { name, status: "fail", detail: pre.reason };
+    return { name, status: "ok", detail: [pre.version, resolved && `(${resolved})`, note].filter(Boolean).join(" ") };
+}
+/** Run a CLI subcommand with a timeout. Never throws; output is for parsing, not printing. */
+export function runCli(command, args, opts = {}) {
+    const env = Object.fromEntries(Object.entries(opts.env ?? process.env).filter((e) => e[1] != null));
+    return new Promise((resolve) => {
+        const execOpts = { env, cwd: opts.cwd, timeout: opts.timeoutMs ?? CHECK_TIMEOUT_MS };
+        execFile(command, args, execOpts, (err, stdout, stderr) => {
+            const out = { stdout: String(stdout ?? ""), stderr: String(stderr ?? "") };
+            if (!err)
+                return resolve({ code: 0, ...out });
+            const e = err;
+            if (typeof e.code === "number")
+                return resolve({ code: e.code, ...out });
+            resolve({
+                code: null,
+                ...out,
+                error: e.killed ? `timed out after ${opts.timeoutMs ?? CHECK_TIMEOUT_MS}ms` : e.message,
+            });
+        });
+    });
+}
+// ─── Upstream probes (list models: no model call, no tokens) ─────
+/** `GET <base>/models` with an OpenAI key (Codex). */
+export async function checkOpenAI(apiKey, envName, baseUrl = "https://api.openai.com/v1", timeoutMs = CHECK_TIMEOUT_MS) {
+    const name = "OpenAI API (codex agent)";
+    const safeBase = redactUrl(baseUrl);
+    try {
+        const res = await fetch(baseUrl.replace(/\/+$/, "") + "/models", {
+            headers: { Authorization: `Bearer ${apiKey}` },
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        if (res.status === 200)
+            return { name, status: "ok", detail: `${envName} is valid (${safeBase})` };
+        if (res.status === 401 || res.status === 403) {
+            return {
+                name,
+                status: "fail",
+                detail: `${res.status} from ${safeBase} - check ${envName} at https://platform.openai.com/api-keys`,
+            };
+        }
+        return { name, status: "fail", detail: `Unexpected HTTP ${res.status} from ${safeBase}` };
+    }
+    catch (err) {
+        return { name, status: "fail", detail: networkErrorMessage(err, timeoutMs) };
+    }
+}
+export function resolveCheckAuthMode(config) {
+    const hasKey = !!config.anthropicApiKey;
+    const hasBearer = !!config.anthropicAuthToken;
+    const hasOauth = !!config.claudeOauthToken;
+    if (config.swenyAuth === "oauth")
+        return hasOauth ? "oauth" : "none";
+    if (config.swenyAuth === "api-key")
+        return hasKey ? "api-key" : hasBearer ? "auth-token" : "none";
+    // auto: OAuth wins when present (today's protective behavior)
+    if (hasOauth)
+        return "oauth";
+    if (hasKey)
+        return "api-key";
+    if (hasBearer)
+        return "auth-token";
+    return "none";
+}
+/** `GET https://api.anthropic.com/v1/models` with an API key. */
+export async function checkAnthropic(apiKey, timeoutMs = CHECK_TIMEOUT_MS) {
+    const name = "Anthropic (claude agent)";
+    try {
+        const res = await fetch("https://api.anthropic.com/v1/models", {
+            headers: { "x-api-key": apiKey, "anthropic-version": "2023-06-01" },
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        if (res.status === 200) {
+            return { name, status: "ok", detail: "API key is valid" };
+        }
+        if (res.status === 401) {
+            return {
+                name,
+                status: "fail",
+                detail: "401 Unauthorized - check ANTHROPIC_API_KEY at https://console.anthropic.com",
+            };
+        }
+        return { name, status: "fail", detail: `Unexpected HTTP ${res.status}` };
+    }
+    catch (err) {
+        return { name, status: "fail", detail: networkErrorMessage(err, timeoutMs) };
+    }
+}
+/** Probe an Anthropic-compatible gateway, never real Anthropic with a gateway-bound key. */
+export async function checkAnthropicGateway(base, config, mode, timeoutMs = CHECK_TIMEOUT_MS) {
+    const name = "Anthropic (gateway)";
+    const safeBase = redactUrl(base);
+    const headers = { "anthropic-version": "2023-06-01" };
+    if (mode === "api-key") {
+        headers["x-api-key"] = config.anthropicApiKey;
+    }
+    else {
+        // auth-token or oauth against the gateway
+        headers.Authorization = `Bearer ${config.anthropicAuthToken || config.claudeOauthToken}`;
+    }
+    try {
+        const url = base.replace(/\/+$/, "") + "/v1/models";
+        const res = await fetch(url, { headers, signal: AbortSignal.timeout(timeoutMs) });
+        // Gateways vary on whether /v1/models exists; reachable + non-auth-error is good enough.
+        if (res.ok || res.status === 404) {
+            return { name, status: "ok", detail: `gateway reachable (${safeBase}), auth mode: ${mode}` };
+        }
+        if (res.status === 401 || res.status === 403) {
+            return { name, status: "fail", detail: `${res.status} from gateway ${safeBase}, check gateway credentials` };
+        }
+        return { name, status: "fail", detail: `Unexpected HTTP ${res.status} from gateway ${safeBase}` };
+    }
+    catch (err) {
+        return { name, status: "fail", detail: networkErrorMessage(err, timeoutMs) };
+    }
+}
+/**
+ * Claude Code's `sweny check` line, unchanged from before #532: a stored
+ * login, an upstream probe for an API key or a gateway, or a skip that names
+ * the auth mode.
+ */
+export async function diagnoseClaudeCode(opts) {
+    const { env } = opts;
+    const raw = (env.SWENY_AUTH ?? "").trim().toLowerCase();
+    const auth = {
+        anthropicApiKey: env.ANTHROPIC_API_KEY || "",
+        anthropicAuthToken: env.ANTHROPIC_AUTH_TOKEN || "",
+        claudeOauthToken: env.CLAUDE_CODE_OAUTH_TOKEN || "",
+        swenyAuth: raw === "api-key" || raw === "oauth" ? raw : "auto",
+    };
+    const mode = resolveCheckAuthMode(auth);
+    const base = env.ANTHROPIC_BASE_URL || "";
+    const name = "Anthropic (claude agent)";
+    if (mode === "none" && opts.hasLogin())
+        return [{ name, status: "ok", detail: "Claude Code login detected" }];
+    if (mode === "none")
+        return [{ name, status: "skip", detail: "No credential configured" }];
+    if (base)
+        return [await checkAnthropicGateway(base, auth, mode, opts.timeoutMs)];
+    if (mode === "api-key")
+        return [await checkAnthropic(auth.anthropicApiKey, opts.timeoutMs)];
+    // oauth or auth-token, no base URL: nothing cheap to probe, report the mode.
+    return [{ name, status: "skip", detail: `auth mode: ${mode}, skipping upstream API check` }];
+}

package/dist/harness/index.d.ts

@@ -7,7 +7,7 @@ import { CodexHarness, type CodexHarnessOptions } from "./codex.js";
 import { AcpHarness, type AcpHarnessOptions } from "./acp.js";
 import { PiHarness, type PiHarnessOptions } from "./pi.js";
 export { claudeCompat, asClaude } from "./compat.js";
-export type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, PolicyGateResult, PolicyWrappers, ToolClass, } from "./types.js";
+export type { AgentHarness, HarnessCapabilities, HarnessCheck, HarnessCompleteRequest, HarnessDiagnoseOptions, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, PolicyGateResult, PolicyWrappers, ToolClass, } from "./types.js";
 export { policyGate, budgetGate, nativeDenyClasses, resolveHarnessPolicy, isToolClass, TOOL_CLASSES, } from "./policy.js";
 export type { HarnessPolicyMode } from "./policy.js";
 export { ask, evaluate, buildAskPrompt, buildEvaluatePrompt, reportCompletionUsage } from "./prompts.js";

package/dist/harness/pi.d.ts

@@ -30,7 +30,7 @@
  */
 import type { Logger, McpServerConfig, NodeUsage, ToolContext, Tool } from "../types.js";
 import { type HarnessEnvOptions, type SandboxMode } from "../agent-env.js";
-import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
+import type { AgentHarness, HarnessCapabilities, HarnessCheck, HarnessCompleteRequest, HarnessDiagnoseOptions, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
 import { PI_CAPABILITIES } from "./capabilities.js";
 import { type HarnessPolicyMode } from "./policy.js";
 import { type SandboxWrapper } from "./sandbox-wrapper.js";
@@ -186,6 +186,18 @@ export declare class PiHarness implements AgentHarness {
         ok: false;
         reason: string;
     }>;
+    /** Run `<resolved> --version` with `hostEnv` and parse it. No caching, no side effects. */
+    private probeVersion;
+    /**
+     * `sweny check` (#532): the CLI and its version (resolved and parsed the way
+     * {@link preflight} does), and the provider credential a run would hand pi
+     * ({@link resolvePiProvider}), or the custom `models.json`. pi runs without
+     * its stored `auth.json`, so env is the only source. No upstream probe: pi
+     * talks to any provider, and none has one cheap, provider-neutral check.
+     * Nothing is cached and no credential value is printed.
+     */
+    diagnose(opts?: HarnessDiagnoseOptions): Promise<HarnessCheck[]>;
+    private authCheck;
     /** Which provider's credential this call gets ({@link resolvePiProvider}), over the env with the overlay applied. */
     private resolveProvider;
     /**

package/dist/harness/pi.js

@@ -41,6 +41,7 @@ import { gitCredentialPolicy } from "../git-credentials.js";
 import { buildNodePrompt, reportCompletionUsage } from "./prompts.js";
 import { makeAbort } from "./abort.js";
 import { parseToolResultContent, summarizeToolError, tryParseJSON } from "./parse.js";
+import { cliCheck, diagnoseEnv } from "./diagnose.js";
 import { startToolBridge } from "./tool-bridge/server.js";
 import { defaultSandboxWrapper, prepareAgentSpawn, wrappersFrom, } from "./sandbox-wrapper.js";
 import { TOKEN_ENV } from "./tool-bridge/protocol.js";
@@ -370,13 +371,24 @@ export class PiHarness {
     }
     /** `pi --version`, checked against {@link MIN_PI_VERSION}. Cached per instance. */
     preflight() {
-        this.preflightResult ??= new Promise((resolve) => {
-            const { command, args } = this.piCommand;
+        this.preflightResult ??= (() => {
             // Probe the file the spawn will run: resolved on the run's PATH and cwd, then reused at spawn.
             const hostEnv = overlaidProcessEnv(this.envOverlay, PI_CREDENTIAL_VARS);
-            this.resolvedCommand = resolveExecutable(command, hostEnv, this.cwd);
+            this.resolvedCommand = resolveExecutable(this.piCommand.command, hostEnv, this.cwd);
+            return this.probeVersion(this.resolvedCommand, hostEnv).then((res) => {
+                if (res.ok)
+                    this.version = res.version;
+                return res;
+            });
+        })();
+        return this.preflightResult;
+    }
+    /** Run `<resolved> --version` with `hostEnv` and parse it. No caching, no side effects. */
+    probeVersion(resolved, hostEnv) {
+        const { command, args } = this.piCommand;
+        return new Promise((resolve) => {
             const opts = { timeout: 30_000, cwd: this.cwd, env: hostEnv };
-            execFile(this.resolvedCommand ?? command, [...args, "--version"], opts, (err, stdout, stderr) => {
+            execFile(resolved ?? command, [...args, "--version"], opts, (err, stdout, stderr) => {
                 if (err) {
                     const code = err.code;
                     resolve({
@@ -397,11 +409,54 @@ export class PiHarness {
                     resolve({ ok: false, reason: `pi ${m[1]} is too old; sweny needs >= ${MIN_PI_VERSION}` });
                     return;
                 }
-                this.version = m[1];
                 resolve({ ok: true, version: m[1] });
             });
         });
-        return this.preflightResult;
+    }
+    /**
+     * `sweny check` (#532): the CLI and its version (resolved and parsed the way
+     * {@link preflight} does), and the provider credential a run would hand pi
+     * ({@link resolvePiProvider}), or the custom `models.json`. pi runs without
+     * its stored `auth.json`, so env is the only source. No upstream probe: pi
+     * talks to any provider, and none has one cheap, provider-neutral check.
+     * Nothing is cached and no credential value is printed.
+     */
+    async diagnose(opts = {}) {
+        const env = diagnoseEnv(opts.env, this.envOverlay, PI_CREDENTIAL_VARS);
+        const resolved = resolveExecutable(this.piCommand.command, env, this.cwd);
+        const cli = cliCheck("Agent CLI (pi)", resolved, await this.probeVersion(resolved, env));
+        return [cli, this.authCheck(env)];
+    }
+    authCheck(env) {
+        const name = "Agent auth (pi)";
+        const res = resolvePiProvider(env, this.model, this.provider);
+        if (res.error)
+            return { name, status: "fail", detail: res.error };
+        const set = res.vars.filter((v) => env[v]?.trim());
+        const provider = res.provider ? `provider ${res.provider}` : "provider";
+        if (set.length > 0)
+            return { name, status: "ok", detail: `${provider} via ${set.join(", ")}` };
+        if (this.modelsFile) {
+            return fs.existsSync(this.modelsFile)
+                ? { name, status: "ok", detail: `custom models from ${this.modelsFile} (SWENY_PI_MODELS_JSON)` }
+                : { name, status: "fail", detail: `SWENY_PI_MODELS_JSON points to a missing file: ${this.modelsFile}` };
+        }
+        if (res.provider && res.vars.length > 0) {
+            return { name, status: "fail", detail: `Missing: ${res.vars.join(" or ")} for pi ${provider}` };
+        }
+        if (res.provider) {
+            return {
+                name,
+                status: "skip",
+                detail: `${provider}: sweny does not know its credential; pi reports a missing one`,
+            };
+        }
+        return {
+            name,
+            status: "fail",
+            detail: "Missing: a model provider credential for pi, such as ANTHROPIC_API_KEY or OPENAI_API_KEY " +
+                "(pi runs without its stored auth.json), or SWENY_PI_MODELS_JSON for a custom provider",
+        };
     }
     /** Which provider's credential this call gets ({@link resolvePiProvider}), over the env with the overlay applied. */
     resolveProvider(model) {

package/dist/harness/types.d.ts

@@ -172,6 +172,24 @@ export interface HarnessCompleteRequest {
      */
     onUsage?: (usage: NodeUsage) => void;
 }
+/**
+ * One line of `sweny check` for the agent (#532): the CLI and its version, a
+ * credential, a stored login, an upstream probe. `detail` names credentials,
+ * never their values.
+ */
+export interface HarnessCheck {
+    name: string;
+    status: "ok" | "fail" | "skip";
+    detail: string;
+}
+export interface HarnessDiagnoseOptions {
+    /** Where credentials are read from (default: `process.env`). */
+    env?: Record<string, string | undefined>;
+    /** Timeout for each probe (default: 5000 ms). */
+    timeoutMs?: number;
+    /** Stored-login probe override (Claude Code, Codex). Default: the adapter's own file probe. */
+    hasLogin?: () => boolean;
+}
 export interface AgentHarness {
     readonly id: HarnessId;
     readonly capabilities: HarnessCapabilities;
@@ -186,6 +204,13 @@ export interface AgentHarness {
         ok: false;
         reason: string;
     }>;
+    /**
+     * `sweny check` (#532): each thing this agent needs, checked and reported
+     * line by line. Read-only and cheap: CLI version and status commands, env
+     * and file presence, and an upstream request only where one costs no model
+     * tokens. Never a model call. Optional; `sweny check` reports its absence.
+     */
+    diagnose?(opts?: HarnessDiagnoseOptions): Promise<HarnessCheck[]>;
     run(req: HarnessRunRequest): Promise<HarnessRunResult>;
     /** One completion, no tools, no MCP. null = failed (callers fail closed). */
     complete(req: HarnessCompleteRequest): Promise<string | null>;