@sweny-ai/core 0.1.55 → 0.1.57

package/dist/cli/config.js

@@ -127,7 +127,14 @@ export function parseCliInputs(options, fileConfig = {}) {
         serviceMapPath: options.serviceMapPath || f("service-map-path") || ".github/service-map.yml",
         githubToken: env.GITHUB_TOKEN || "",
         botToken: env.BOT_TOKEN || "",
-        cloudToken: env.SWENY_CLOUD_TOKEN || f("cloud-token") || "",
+        cloudToken: (() => {
+            const fromEnv = env.SWENY_CLOUD_TOKEN || "";
+            const fromFile = f("cloud-token") || "";
+            if (!fromEnv && fromFile) {
+                console.warn("\x1b[33m⚠ cloud-token is set in .sweny.yml — consider using SWENY_CLOUD_TOKEN env var instead to avoid accidental commits.\x1b[0m");
+            }
+            return fromEnv || fromFile;
+        })(),
         sourceControlProvider: options.sourceControlProvider || f("source-control-provider") || "github",
         // Secrets: env only
         jiraBaseUrl: env.JIRA_BASE_URL || "",

package/dist/cli/main.js

@@ -134,7 +134,7 @@ function buildProviderCtx(config, mcpServers) {
 }
 /**
  * Resolve rules and context from config into structured workflow input fields.
- * Local files + inline text are resolved now; URLs are passed to the prepare node.
+ * All source kinds (inline, file, URL) are resolved eagerly.
  */
 async function resolveRulesAndContext(config) {
     const [rulesResult, contextResult] = await Promise.all([
@@ -144,8 +144,6 @@ async function resolveRulesAndContext(config) {
     return {
         rules: rulesResult.resolved,
         context: contextResult.resolved,
-        rulesUrls: rulesResult.urls,
-        contextUrls: contextResult.urls,
     };
 }
 // ── sweny triage ──────────────────────────────────────────────────────
@@ -298,7 +296,7 @@ triageCmd.action(async (options) => {
     const observer = composeObservers(progressObserver, config.stream ? createStreamObserver() : undefined);
     // ── Build workflow input from config ──────────────────────
     const providerCtx = buildProviderCtx(config, mcpServers);
-    const { rules, context, rulesUrls, contextUrls } = await resolveRulesAndContext(config);
+    const { rules, context } = await resolveRulesAndContext(config);
     // Combine provider context + additional instructions into the context field
     const contextParts = [providerCtx];
     if (config.additionalInstructions)
@@ -328,8 +326,6 @@ triageCmd.action(async (options) => {
         // Structured rules/context for executor (URLs resolved eagerly by loadAdditionalContext)
         rules,
         context: fullContext,
-        rulesUrls,
-        contextUrls,
     };
     try {
         const { results, trace } = await execute(triageWorkflow, workflowInput, {
@@ -463,7 +459,7 @@ implementCmd.action(async (issueId, options) => {
     const observer = composeObservers(implProgressObserver, Boolean(options.stream) ? createStreamObserver() : undefined);
     // Resolve rules/context from .sweny.yml (same as triage path)
     const providerCtx = buildProviderCtx(config, mcpServers);
-    const { rules, context, rulesUrls, contextUrls } = await resolveRulesAndContext(config);
+    const { rules, context } = await resolveRulesAndContext(config);
     const implContextParts = [providerCtx];
     if (config.additionalInstructions)
         implContextParts.push(config.additionalInstructions);
@@ -480,8 +476,6 @@ implementCmd.action(async (issueId, options) => {
         // Structured rules/context for executor
         rules,
         context: fullImplContext,
-        rulesUrls,
-        contextUrls,
     };
     try {
         const { results } = await execute(implementWorkflow, workflowInput, {
@@ -710,13 +704,6 @@ export async function workflowRunAction(file, options) {
             // silent
         }
         const hasFailed = [...results.values()].some((r) => r.status === "failed");
-        // Report to SWEny Cloud (best-effort)
-        try {
-            await reportToCloud(results, 0, config, workflow.id);
-        }
-        catch {
-            // silent
-        }
         if (hasFailed) {
             console.error(chalk.red(`  Workflow failed\n`));
             process.exit(1);

package/dist/schema.d.ts

@@ -713,6 +713,7 @@ export declare const workflowJsonSchema: {
                 readonly properties: {
                     readonly inline: {
                         readonly type: "string";
+                        readonly minLength: 1;
                     };
                 };
                 readonly required: readonly ["inline"];

package/dist/schema.js

@@ -239,7 +239,7 @@ const sourceJsonSchema = {
         { type: "string", minLength: 1 },
         {
             type: "object",
-            properties: { inline: { type: "string" } },
+            properties: { inline: { type: "string", minLength: 1 } },
             required: ["inline"],
             additionalProperties: false,
         },

package/dist/sources.validation.test.js

@@ -10,11 +10,12 @@
  *   - Security: no auth token leakage, URL validation
  */
 import { mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { tmpdir } from "node:os";
 import * as path from "node:path";
 import { describe, it, expect, beforeEach, vi } from "vitest";
 import { classifySource, sourceZ, hashContent, resolveSource, resolveSources, } from "./sources.js";
-const fileTmp = path.join(tmpdir(), "sweny-sources-validation-test");
+const fileTmp = path.join(tmpdir(), `sweny-sources-validation-test-${randomBytes(4).toString("hex")}`);
 const baseCtx = () => ({
     cwd: "/tmp",
     env: {},
@@ -253,6 +254,24 @@ describe("error messages include actionable information", () => {
             expect(e.message).toContain("--offline");
         }
     });
+    it("SOURCE_FILE_READ_FAILED on permission denied", async () => {
+        const unreadable = path.join(fileTmp, "unreadable.md");
+        writeFileSync(unreadable, "secret");
+        const { chmodSync } = await import("node:fs");
+        chmodSync(unreadable, 0o000);
+        try {
+            await resolveSource("./unreadable.md", "context[0]", { ...baseCtx(), cwd: fileTmp });
+            expect.unreachable("should have thrown");
+        }
+        catch (e) {
+            expect(e.message).toContain("SOURCE_FILE_READ_FAILED");
+            expect(e.message).toContain("unreadable.md");
+            expect(e.message).toContain("context[0]");
+        }
+        finally {
+            chmodSync(unreadable, 0o644);
+        }
+    });
     it("SOURCE_OFFLINE_REQUIRES_FETCH includes the URL and field path", async () => {
         try {
             await resolveSource("https://example.com/rules.md", "rules[1]", { ...baseCtx(), offline: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.55",
+  "version": "0.1.57",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"