@sweny-ai/core 0.1.89 → 0.1.91

package/dist/cli/cloud-lifecycle.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Lifecycle-endpoint reporter for SWEny Cloud.
+ *
+ * Posts run lifecycle events (start, finish, optional per-node updates) to
+ * cloud's universal ingest API at `${cloudUrl}/api/runs[/:id/...]`. Auth via
+ * the same `SWENY_CLOUD_TOKEN` that the legacy /api/report flow uses.
+ *
+ * This reporter is CI-agnostic: it works from GitHub Actions, GitLab CI,
+ * CircleCI, a developer's laptop — anywhere a workflow runs and a token is
+ * configured. The legacy `reportToCloud` (in cloud-report.ts) keeps working
+ * for back-compat; new code paths should prefer this lifecycle flow.
+ *
+ * Source proposal: cloud/docs/proposals/02-cloud-architecture-for-any-run.md
+ * (task 05).
+ *
+ * All errors are swallowed: cloud reporting MUST NEVER block the workflow.
+ */
+import type { NodeResult, Observer, Workflow } from "../types.js";
+export type TriggerSource = "github_action" | "gitlab_ci" | "circleci" | "buildkite" | "other_ci" | "manual" | "cron" | "mcp" | "unknown";
+export interface CloudReportConfig {
+    cloudToken: string;
+    cloudUrl?: string;
+    repository?: string;
+}
+export interface StartRunInput {
+    workflow_id: string;
+    workflow_type?: string;
+    trigger_source?: TriggerSource;
+    trigger_metadata?: Record<string, unknown>;
+    metadata?: Record<string, unknown>;
+    run_uuid?: string;
+}
+export interface StartRunResult {
+    run_id: string;
+    dashboard_url?: string;
+    stream_url?: string;
+    idempotent_replay?: boolean;
+}
+export interface FinishRunInput {
+    status: "success" | "failed" | "skipped" | "completed" | "partial";
+    metrics?: Record<string, unknown>;
+    duration_ms?: number;
+    error?: string;
+}
+/**
+ * Detect the CI trigger source from environment variables. Best-effort;
+ * returns "unknown" if no signal is present.
+ */
+export declare function detectTriggerSource(env?: NodeJS.ProcessEnv): TriggerSource;
+/**
+ * Build the trigger_metadata blob from env. Each CI provider exposes a
+ * different set of variables; pick the ones that are useful for debugging
+ * a specific run later (run id, actor, ref).
+ */
+export declare function buildTriggerMetadata(source: TriggerSource, env?: NodeJS.ProcessEnv): Record<string, unknown>;
+/**
+ * Generate a run UUID. Each call to startRun() should generate exactly one
+ * and reuse it for the matching finishRun() — this is the idempotency key.
+ */
+export declare function newRunUuid(): string;
+/**
+ * Build a run-start payload from a Workflow + env. Pure function; the caller
+ * is responsible for passing it to `startRun()`.
+ */
+export declare function buildStartRunPayload(workflow: Pick<Workflow, "id" | "workflow_type">, options: {
+    runUuid: string;
+    env?: NodeJS.ProcessEnv;
+}): StartRunInput;
+/**
+ * POST /api/runs — start a run, returning the run id (or null on failure).
+ * Failure is silent: cloud reporting must not block workflow execution.
+ */
+export declare function startRun(config: CloudReportConfig, payload: StartRunInput): Promise<StartRunResult | null>;
+/**
+ * POST /api/runs/:id/finish — record the final outcome + metrics.
+ */
+export declare function finishRun(config: CloudReportConfig, runId: string, payload: FinishRunInput): Promise<boolean>;
+/**
+ * POST /api/runs/:id/node — record a node lifecycle event. Optional helper
+ * for callers that want streaming updates; safe to skip if you only need
+ * start + finish. Fire-and-forget.
+ */
+export declare function postNodeEvent(config: CloudReportConfig, runId: string, event: {
+    event: "enter" | "exit" | "progress";
+    node: string;
+    timestamp?: string;
+    status?: "success" | "failed" | "skipped";
+    duration_ms?: number;
+    data?: Record<string, unknown>;
+}): Promise<void>;
+/**
+ * Derive a `metrics` blob from the executor's NodeResult map.
+ *
+ * For now this is intentionally minimal: total node count, failed-node
+ * count, success rate. Per-workflow-type metric extraction (Caught /
+ * Calibration / Missed for pr_review, flake rate for e2e_test, etc.) is
+ * the renderer's job; the engine just ships what it has.
+ */
+export declare function deriveGenericMetrics(results: Map<string, NodeResult>, durationMs: number): {
+    duration_ms: number;
+    node_count: number;
+    failed_nodes: number;
+    success_rate: number;
+};
+export interface CloudLifecycleHandle {
+    runUuid: string;
+    runId: string;
+    dashboardUrl?: string;
+}
+/**
+ * Open a cloud lifecycle session for an upcoming workflow run.
+ *
+ * Returns a handle if the cloud token is set AND `startRun()` succeeds; null
+ * otherwise. Callers should ALWAYS handle the null case — cloud reporting
+ * is opt-in and best-effort, the workflow must run regardless.
+ *
+ * Pair every successful call with `finishCloudLifecycle(handle, …)` once the
+ * workflow completes (success or failure).
+ */
+export declare function beginCloudLifecycle(config: {
+    cloudToken?: string;
+    repository?: string;
+}, workflow: Pick<Workflow, "id" | "workflow_type">): Promise<CloudLifecycleHandle | null>;
+/**
+ * Close a cloud lifecycle session opened by `beginCloudLifecycle`.
+ *
+ * No-op when handle is null (cloud reporting was disabled or startRun
+ * failed). Status maps the engine's `success | failed | partial` outcome
+ * onto the cloud's accepted enum. Failure is silent — the workflow's
+ * exit code already reflects the truth.
+ */
+export declare function finishCloudLifecycle(config: {
+    cloudToken?: string;
+}, handle: CloudLifecycleHandle | null, results: Map<string, NodeResult>, durationMs: number, status?: "success" | "failed" | "partial"): Promise<void>;
+/**
+ * Build an Observer that ships per-node lifecycle events to cloud.
+ *
+ * Maps the engine's ExecutionEvent stream onto `POST /api/runs/:id/node`:
+ *   node:enter   → { event: "enter",  node }
+ *   node:exit    → { event: "exit",   node, status, duration_ms }
+ *   node:progress → { event: "progress", node, data: { message } }
+ *   node:retry   → { event: "progress", node, data: { retry: true, attempt, reason } }
+ * Other events (workflow:start, tool:*, route, workflow:end) are dropped.
+ *
+ * Returns undefined when the handle is null (no cloud session) or the
+ * token is missing. The observer captures `node:enter` timestamps in a
+ * closure-scoped Map so it can compute duration_ms on the matching exit
+ * without depending on any external state.
+ *
+ * Hot-path safety contract:
+ *   1. The observer never throws synchronously. The whole body is
+ *      wrapped in try/catch — any future ExecutionEvent shape change
+ *      that breaks a field access cannot crash the engine.
+ *   2. The observer never awaits. postNodeEvent is fired with .catch
+ *      to swallow any rejection so node never sees an unhandledRejection.
+ *   3. The Map is keyed by node id; collisions only happen if the same
+ *      node id runs concurrently, which the engine does not do today.
+ */
+export declare function createCloudStreamObserver(config: {
+    cloudToken?: string;
+}, handle: CloudLifecycleHandle | null): Observer | undefined;

package/dist/cli/cloud-lifecycle.js

@@ -0,0 +1,328 @@
+/**
+ * Lifecycle-endpoint reporter for SWEny Cloud.
+ *
+ * Posts run lifecycle events (start, finish, optional per-node updates) to
+ * cloud's universal ingest API at `${cloudUrl}/api/runs[/:id/...]`. Auth via
+ * the same `SWENY_CLOUD_TOKEN` that the legacy /api/report flow uses.
+ *
+ * This reporter is CI-agnostic: it works from GitHub Actions, GitLab CI,
+ * CircleCI, a developer's laptop — anywhere a workflow runs and a token is
+ * configured. The legacy `reportToCloud` (in cloud-report.ts) keeps working
+ * for back-compat; new code paths should prefer this lifecycle flow.
+ *
+ * Source proposal: cloud/docs/proposals/02-cloud-architecture-for-any-run.md
+ * (task 05).
+ *
+ * All errors are swallowed: cloud reporting MUST NEVER block the workflow.
+ */
+import { randomUUID } from "node:crypto";
+const CLOUD_URL_DEFAULT = "https://cloud.sweny.ai";
+const TIMEOUT_MS = 10_000;
+// startRun runs on the critical path BEFORE execute(), so a slow cloud
+// would delay every workflow start. Cap it tighter than the general
+// timeout — if cloud can't accept the run-start in 3s, skip and run
+// uninstrumented rather than make the user wait.
+const START_TIMEOUT_MS = 3_000;
+/**
+ * Detect the CI trigger source from environment variables. Best-effort;
+ * returns "unknown" if no signal is present.
+ */
+export function detectTriggerSource(env = process.env) {
+    if (env.GITHUB_ACTIONS === "true")
+        return "github_action";
+    if (env.GITLAB_CI === "true")
+        return "gitlab_ci";
+    if (env.CIRCLECI === "true")
+        return "circleci";
+    if (env.BUILDKITE === "true")
+        return "buildkite";
+    if (env.CI === "true" || env.CI === "1")
+        return "other_ci";
+    return "manual";
+}
+/**
+ * Build the trigger_metadata blob from env. Each CI provider exposes a
+ * different set of variables; pick the ones that are useful for debugging
+ * a specific run later (run id, actor, ref).
+ */
+export function buildTriggerMetadata(source, env = process.env) {
+    switch (source) {
+        case "github_action":
+            return {
+                runner_id: env.RUNNER_NAME,
+                workflow_run_id: env.GITHUB_RUN_ID,
+                workflow_run_attempt: env.GITHUB_RUN_ATTEMPT,
+                actor: env.GITHUB_ACTOR,
+                event_name: env.GITHUB_EVENT_NAME,
+                ref: env.GITHUB_REF,
+                sha: env.GITHUB_SHA,
+            };
+        case "gitlab_ci":
+            return {
+                pipeline_id: env.CI_PIPELINE_ID,
+                job_id: env.CI_JOB_ID,
+                actor: env.GITLAB_USER_LOGIN,
+                ref: env.CI_COMMIT_REF_NAME,
+                sha: env.CI_COMMIT_SHA,
+            };
+        case "circleci":
+            return {
+                build_num: env.CIRCLE_BUILD_NUM,
+                actor: env.CIRCLE_USERNAME,
+                sha: env.CIRCLE_SHA1,
+            };
+        default:
+            return {};
+    }
+}
+/**
+ * Generate a run UUID. Each call to startRun() should generate exactly one
+ * and reuse it for the matching finishRun() — this is the idempotency key.
+ */
+export function newRunUuid() {
+    return randomUUID();
+}
+/**
+ * Build a run-start payload from a Workflow + env. Pure function; the caller
+ * is responsible for passing it to `startRun()`.
+ */
+export function buildStartRunPayload(workflow, options) {
+    const env = options.env ?? process.env;
+    const trigger_source = detectTriggerSource(env);
+    const trigger_metadata = buildTriggerMetadata(trigger_source, env);
+    const metadata = {};
+    if (env.GITHUB_REF)
+        metadata.branch = env.GITHUB_REF.replace(/^refs\/heads\//, "");
+    if (env.GITHUB_SHA)
+        metadata.commit_sha = env.GITHUB_SHA;
+    if (env.GITHUB_ACTOR)
+        metadata.actor = env.GITHUB_ACTOR;
+    return {
+        workflow_id: workflow.id,
+        workflow_type: workflow.workflow_type ?? "generic",
+        trigger_source,
+        trigger_metadata,
+        metadata,
+        run_uuid: options.runUuid,
+    };
+}
+/**
+ * POST /api/runs — start a run, returning the run id (or null on failure).
+ * Failure is silent: cloud reporting must not block workflow execution.
+ */
+export async function startRun(config, payload) {
+    const cloudUrl = config.cloudUrl ?? process.env.SWENY_CLOUD_URL ?? CLOUD_URL_DEFAULT;
+    try {
+        const res = await fetch(`${cloudUrl}/api/runs`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${config.cloudToken}`,
+            },
+            body: JSON.stringify(payload),
+            signal: AbortSignal.timeout(START_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return null;
+        const data = (await res.json().catch(() => ({})));
+        if (!data.run_id)
+            return null;
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * POST /api/runs/:id/finish — record the final outcome + metrics.
+ */
+export async function finishRun(config, runId, payload) {
+    const cloudUrl = config.cloudUrl ?? process.env.SWENY_CLOUD_URL ?? CLOUD_URL_DEFAULT;
+    try {
+        const res = await fetch(`${cloudUrl}/api/runs/${encodeURIComponent(runId)}/finish`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${config.cloudToken}`,
+            },
+            body: JSON.stringify(payload),
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * POST /api/runs/:id/node — record a node lifecycle event. Optional helper
+ * for callers that want streaming updates; safe to skip if you only need
+ * start + finish. Fire-and-forget.
+ */
+export async function postNodeEvent(config, runId, event) {
+    const cloudUrl = config.cloudUrl ?? process.env.SWENY_CLOUD_URL ?? CLOUD_URL_DEFAULT;
+    try {
+        await fetch(`${cloudUrl}/api/runs/${encodeURIComponent(runId)}/node`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${config.cloudToken}`,
+            },
+            body: JSON.stringify({ ...event, timestamp: event.timestamp ?? new Date().toISOString() }),
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch {
+        // Silent — never block the workflow.
+    }
+}
+/**
+ * Derive a `metrics` blob from the executor's NodeResult map.
+ *
+ * For now this is intentionally minimal: total node count, failed-node
+ * count, success rate. Per-workflow-type metric extraction (Caught /
+ * Calibration / Missed for pr_review, flake rate for e2e_test, etc.) is
+ * the renderer's job; the engine just ships what it has.
+ */
+export function deriveGenericMetrics(results, durationMs) {
+    const nodeCount = results.size;
+    const failedNodes = [...results.values()].filter((r) => r.status === "failed").length;
+    return {
+        duration_ms: durationMs,
+        node_count: nodeCount,
+        failed_nodes: failedNodes,
+        success_rate: nodeCount > 0 ? (nodeCount - failedNodes) / nodeCount : 0,
+    };
+}
+/**
+ * Open a cloud lifecycle session for an upcoming workflow run.
+ *
+ * Returns a handle if the cloud token is set AND `startRun()` succeeds; null
+ * otherwise. Callers should ALWAYS handle the null case — cloud reporting
+ * is opt-in and best-effort, the workflow must run regardless.
+ *
+ * Pair every successful call with `finishCloudLifecycle(handle, …)` once the
+ * workflow completes (success or failure).
+ */
+export async function beginCloudLifecycle(config, workflow) {
+    if (!config.cloudToken)
+        return null;
+    const runUuid = newRunUuid();
+    const payload = buildStartRunPayload(workflow, { runUuid });
+    const reportConfig = {
+        cloudToken: config.cloudToken,
+        repository: config.repository,
+    };
+    const result = await startRun(reportConfig, payload);
+    if (!result)
+        return null;
+    return {
+        runUuid,
+        runId: result.run_id,
+        dashboardUrl: result.dashboard_url,
+    };
+}
+/**
+ * Close a cloud lifecycle session opened by `beginCloudLifecycle`.
+ *
+ * No-op when handle is null (cloud reporting was disabled or startRun
+ * failed). Status maps the engine's `success | failed | partial` outcome
+ * onto the cloud's accepted enum. Failure is silent — the workflow's
+ * exit code already reflects the truth.
+ */
+export async function finishCloudLifecycle(config, handle, results, durationMs, status = "success") {
+    if (!handle || !config.cloudToken)
+        return;
+    const reportConfig = { cloudToken: config.cloudToken };
+    await finishRun(reportConfig, handle.runId, {
+        status,
+        duration_ms: durationMs,
+        metrics: deriveGenericMetrics(results, durationMs),
+    });
+}
+/**
+ * Build an Observer that ships per-node lifecycle events to cloud.
+ *
+ * Maps the engine's ExecutionEvent stream onto `POST /api/runs/:id/node`:
+ *   node:enter   → { event: "enter",  node }
+ *   node:exit    → { event: "exit",   node, status, duration_ms }
+ *   node:progress → { event: "progress", node, data: { message } }
+ *   node:retry   → { event: "progress", node, data: { retry: true, attempt, reason } }
+ * Other events (workflow:start, tool:*, route, workflow:end) are dropped.
+ *
+ * Returns undefined when the handle is null (no cloud session) or the
+ * token is missing. The observer captures `node:enter` timestamps in a
+ * closure-scoped Map so it can compute duration_ms on the matching exit
+ * without depending on any external state.
+ *
+ * Hot-path safety contract:
+ *   1. The observer never throws synchronously. The whole body is
+ *      wrapped in try/catch — any future ExecutionEvent shape change
+ *      that breaks a field access cannot crash the engine.
+ *   2. The observer never awaits. postNodeEvent is fired with .catch
+ *      to swallow any rejection so node never sees an unhandledRejection.
+ *   3. The Map is keyed by node id; collisions only happen if the same
+ *      node id runs concurrently, which the engine does not do today.
+ */
+export function createCloudStreamObserver(config, handle) {
+    if (!handle || !config.cloudToken)
+        return undefined;
+    const reportConfig = { cloudToken: config.cloudToken };
+    // Single-threaded-per-node assumption: the engine doesn't run the
+    // same node id twice concurrently, so node id alone is enough as a
+    // key. A future parallelizing executor change would need to revisit.
+    const enterTimes = new Map();
+    const fire = (event) => {
+        postNodeEvent(reportConfig, handle.runId, event).catch(() => {
+            // Cloud reporting must never bubble — postNodeEvent already
+            // swallows internally, but this is belt-and-suspenders.
+        });
+    };
+    return (event) => {
+        try {
+            switch (event.type) {
+                case "node:enter": {
+                    enterTimes.set(event.node, Date.now());
+                    fire({ event: "enter", node: event.node });
+                    break;
+                }
+                case "node:exit": {
+                    const enter = enterTimes.get(event.node);
+                    const duration_ms = typeof enter === "number" ? Date.now() - enter : undefined;
+                    enterTimes.delete(event.node);
+                    fire({
+                        event: "exit",
+                        node: event.node,
+                        status: event.result.status,
+                        duration_ms,
+                    });
+                    break;
+                }
+                case "node:progress": {
+                    fire({
+                        event: "progress",
+                        node: event.node,
+                        data: { message: event.message },
+                    });
+                    break;
+                }
+                case "node:retry": {
+                    fire({
+                        event: "progress",
+                        node: event.node,
+                        data: { retry: true, attempt: event.attempt, reason: event.reason },
+                    });
+                    break;
+                }
+                default:
+                    // Drop workflow:start, sources:resolved, tool:*, route,
+                    // workflow:end. Cloud only models the per-node lifecycle today.
+                    break;
+            }
+        }
+        catch {
+            // Hot-path defense: an unexpected event shape must not crash
+            // the engine. Silent swallow is the correct behavior here.
+        }
+    };
+}

package/dist/cli/main.js

@@ -32,6 +32,7 @@ import { registerSetupCommand } from "./setup.js";
 import { registerPublishCommand } from "./publish.js";
 import { registerSkillCommand } from "./skill.js";
 import { reportToCloud } from "./cloud-report.js";
+import { beginCloudLifecycle, finishCloudLifecycle, createCloudStreamObserver } from "./cloud-lifecycle.js";
 import { runUpgrade, fetchLatestFromNpm } from "./upgrade.js";
 import { maybeNudge, defaultCachePath } from "./version-check.js";
 import { spawnSync } from "node:child_process";
@@ -313,7 +314,6 @@ triageCmd.action(async (options) => {
                     break;
             }
         };
-    const observer = composeObservers(progressObserver, config.stream ? createStreamObserver() : undefined);
     // ── Build workflow input from config ──────────────────────
     const providerCtx = buildProviderCtx(config, mcpServers);
     const { rules, context } = await resolveRulesAndContext(config);
@@ -348,6 +348,15 @@ triageCmd.action(async (options) => {
         rules,
         context: fullContext,
     };
+    // Open the cloud lifecycle session BEFORE composing observers so the
+    // node-streaming observer can attach events to the correct runId.
+    // Null when the token is unset or startRun fails — cloud reporting
+    // must never block the workflow.
+    const cloudHandle = await beginCloudLifecycle(config, triageWorkflow);
+    if (cloudHandle?.dashboardUrl) {
+        console.log(c.subtle(`  cloud: ${cloudHandle.dashboardUrl}`));
+    }
+    const observer = composeObservers(progressObserver, config.stream ? createStreamObserver() : undefined, createCloudStreamObserver(config, cloudHandle));
     try {
         const { results, trace } = await execute(triageWorkflow, workflowInput, {
             skills,
@@ -381,7 +390,19 @@ triageCmd.action(async (options) => {
                 console.error(c.subtle(`  ⚠ could not write GITHUB_STEP_SUMMARY: ${err instanceof Error ? err.message : err}`));
             }
         }
-        // Report to SWEny Cloud (best-effort, never block the run)
+        // Close the cloud lifecycle session opened above. Status reflects
+        // whether any node failed — cloud's runs.status enum accepts the
+        // same vocabulary the engine uses.
+        const triageHasFailed = [...results.values()].some((r) => r.status === "failed");
+        try {
+            await finishCloudLifecycle(config, cloudHandle, results, durationMs, triageHasFailed ? "failed" : "success");
+        }
+        catch {
+            // silent
+        }
+        // Report to SWEny Cloud (best-effort, legacy /api/report path for
+        // back-compat with cloud builds that haven't deployed lifecycle
+        // endpoints yet — runs through both paths so neither side breaks).
         try {
             await reportToCloud(results, durationMs, config, "triage");
         }
@@ -481,7 +502,6 @@ implementCmd.action(async (issueId, options) => {
                 break;
         }
     };
-    const observer = composeObservers(implProgressObserver, Boolean(options.stream) ? createStreamObserver() : undefined);
     // Resolve rules/context from .sweny.yml (same as triage path)
     const providerCtx = buildProviderCtx(config, mcpServers);
     const { rules, context } = await resolveRulesAndContext(config);
@@ -502,6 +522,14 @@ implementCmd.action(async (issueId, options) => {
         rules,
         context: fullImplContext,
     };
+    // Open cloud lifecycle session BEFORE composing observers so the
+    // node-streaming observer can attach to the correct runId. See
+    // triage path for rationale.
+    const implCloudHandle = await beginCloudLifecycle(config, implementWorkflow);
+    if (implCloudHandle?.dashboardUrl) {
+        console.log(c.subtle(`  cloud: ${implCloudHandle.dashboardUrl}`));
+    }
+    const observer = composeObservers(implProgressObserver, Boolean(options.stream) ? createStreamObserver() : undefined, createCloudStreamObserver(config, implCloudHandle));
     try {
         const { results } = await execute(implementWorkflow, workflowInput, {
             skills,
@@ -514,6 +542,16 @@ implementCmd.action(async (issueId, options) => {
             offline: config.offline,
         });
         const hasFailed = [...results.values()].some((r) => r.status === "failed");
+        const implDurationMs = Date.now() - implRunStart;
+        // Close the cloud lifecycle session. We do this BEFORE the early
+        // process.exit(1) on failure so cloud sees the final status — a
+        // crashed-without-finish run would stay stuck at "started" forever.
+        try {
+            await finishCloudLifecycle(config, implCloudHandle, results, implDurationMs, hasFailed ? "failed" : "success");
+        }
+        catch {
+            // silent
+        }
         if (hasFailed) {
             console.error(chalk.red(`\n  Implement workflow failed\n`));
             process.exit(1);
@@ -526,9 +564,9 @@ implementCmd.action(async (issueId, options) => {
         else {
             console.log(chalk.green(`\n  Implement workflow completed\n`));
         }
-        // Report to SWEny Cloud (best-effort)
+        // Legacy /api/report back-compat — see triage path.
         try {
-            await reportToCloud(results, Date.now() - implRunStart, config, "implement");
+            await reportToCloud(results, implDurationMs, config, "implement");
         }
         catch {
             // silent
@@ -676,7 +714,6 @@ export async function workflowRunAction(file, options) {
                     break;
             }
         };
-    const observer = composeObservers(wfProgressObserver, options.stream ? createStreamObserver() : undefined);
     // Build workflow input — prefer --input JSON if provided, else fall back to config-derived input
     let workflowInput;
     if (options.input && typeof options.input === "string") {
@@ -709,6 +746,14 @@ export async function workflowRunAction(file, options) {
             context: buildProviderCtx(config, mcpServers),
         };
     }
+    // Open cloud lifecycle session BEFORE composing observers so the
+    // node-streaming observer can attach to the correct runId. See
+    // triage path for rationale.
+    const wfCloudHandle = await beginCloudLifecycle(config, workflow);
+    if (wfCloudHandle?.dashboardUrl && !isJson) {
+        console.log(c.subtle(`  cloud: ${wfCloudHandle.dashboardUrl}`));
+    }
+    const observer = composeObservers(wfProgressObserver, options.stream ? createStreamObserver() : undefined, createCloudStreamObserver(config, wfCloudHandle));
     try {
         const { results, trace } = await execute(workflow, workflowInput, {
             skills,
@@ -720,10 +765,20 @@ export async function workflowRunAction(file, options) {
             fetchAuth: config.fetchAuth,
             offline: config.offline,
         });
+        const wfDurationMs = Date.now() - runStart;
+        const wfHasFailed = [...results.values()].some((r) => r.status === "failed");
+        // Close the cloud lifecycle session BEFORE the JSON early-exit so
+        // every workflow run reports a terminal status, regardless of how
+        // the CLI returns (json, mermaid, or normal stdout).
+        try {
+            await finishCloudLifecycle(config, wfCloudHandle, results, wfDurationMs, wfHasFailed ? "failed" : "success");
+        }
+        catch {
+            // silent
+        }
         if (isJson) {
             process.stdout.write(JSON.stringify(Object.fromEntries(results), null, 2) + "\n");
-            const hasFailed = [...results.values()].some((r) => r.status === "failed");
-            process.exit(hasFailed ? 1 : 0);
+            process.exit(wfHasFailed ? 1 : 0);
             return;
         }
         // Mermaid diagram with execution state
@@ -734,15 +789,14 @@ export async function workflowRunAction(file, options) {
             }
             process.stdout.write(toMermaidBlock(workflow, { state, trace, title: workflow.name }) + "\n");
         }
-        // Report to SWEny Cloud (best-effort)
+        // Legacy /api/report back-compat — see triage path.
         try {
-            await reportToCloud(results, Date.now() - runStart, config, workflow.id);
+            await reportToCloud(results, wfDurationMs, config, workflow.id);
         }
         catch {
             // silent
         }
-        const hasFailed = [...results.values()].some((r) => r.status === "failed");
-        if (hasFailed) {
+        if (wfHasFailed) {
             console.error(chalk.red(`  Workflow failed\n`));
             process.exit(1);
             return;

package/dist/cli/publish.js

@@ -15,9 +15,9 @@ import { parse as parseYaml } from "yaml";
 import { parseWorkflow, validateWorkflow } from "../schema.js";
 import { builtinSkills } from "../skills/index.js";
 import { discoverSkillsWithDiagnostics } from "../skills/custom-loader.js";
+import { isValidSkillId } from "../types.js";
 // ── Types ──────────────────────────────────────────────────────────────
 const VALID_CATEGORIES = ["triage", "security", "devops", "code-review", "testing", "content", "ops"];
-const VALID_SKILL_ID = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
 // ── Validation helpers ─────────────────────────────────────────────────
 export function validateWorkflowFile(filePath) {
     const errors = [];
@@ -119,8 +119,8 @@ export function validateSkillDir(dirPath) {
     if (!id) {
         errors.push("Missing 'name' field in frontmatter");
     }
-    else if (!VALID_SKILL_ID.test(id) || id.includes("--") || id.length > 64) {
-        errors.push(`Invalid skill ID: "${id}" — must be lowercase, hyphens, no consecutive hyphens, max 64 chars`);
+    else if (!isValidSkillId(id)) {
+        errors.push(`Invalid skill ID: "${id}" (must be lowercase alphanumeric + hyphens, no consecutive hyphens, max 64 chars)`);
     }
     // Check directory name matches skill name
     const dirName = path.basename(dirPath);