@sweny-ai/core 0.1.103 → 0.1.105

package/dist/browser.d.ts

@@ -16,7 +16,7 @@
 export type { Skill, SkillCategory, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, Evaluator, EvaluatorRule, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, McpTransport, WorkflowType, SkillHarnessKey, } from "./types.js";
 export { consoleLogger } from "./types.js";
 export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, } from "./types.js";
-export { github, linear, slack, sentry, datadog, notification, builtinSkills, createSkillMap, allSkills, isSkillConfigured, configuredBuiltinSkills, validateWorkflowSkills, } from "./skills/index.js";
+export { github, linear, slack, sentry, datadog, betterstack, notification, supabase, builtinSkills, createSkillMap, allSkills, isSkillConfigured, configuredBuiltinSkills, validateWorkflowSkills, } from "./skills/index.js";
 export type { SkillValidationResult } from "./skills/index.js";
 export { workflowZ, nodeZ, edgeZ, skillZ, parseWorkflow, validateWorkflow, workflowJsonSchema, skillJsonSchema, } from "./schema.js";
 export type { WorkflowError } from "./schema.js";

package/dist/browser.js

@@ -20,7 +20,7 @@ export { consoleLogger } from "./types.js";
 // skill id, needs these without hardcoding the members.
 export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, } from "./types.js";
 // Skills (browser-safe — no filesystem access, no `process.env` reads)
-export { github, linear, slack, sentry, datadog, notification, builtinSkills, createSkillMap, allSkills, isSkillConfigured, configuredBuiltinSkills, validateWorkflowSkills, } from "./skills/index.js";
+export { github, linear, slack, sentry, datadog, betterstack, notification, supabase, builtinSkills, createSkillMap, allSkills, isSkillConfigured, configuredBuiltinSkills, validateWorkflowSkills, } from "./skills/index.js";
 // Schema & validation
 export { workflowZ, nodeZ, edgeZ, skillZ, parseWorkflow, validateWorkflow, workflowJsonSchema, skillJsonSchema, } from "./schema.js";
 // Studio adapter

package/dist/cli/e2e.js

@@ -760,9 +760,15 @@ export async function runE2eInit(options = {}) {
     }
 }
 // ── Timeout helper ─────────────────────────────────────────────────────
-function withTimeout(promise, ms, label) {
+function withTimeout(promise, ms, label, onTimeout) {
     return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => reject(new Error(`${label} timed out after ${ms / 1000}s`)), ms);
+        const timer = setTimeout(() => {
+            // Abort the underlying work first so it stops advancing and the in-flight
+            // model query is interrupted, then reject the wrapper. Without the abort
+            // the execute() promise is abandoned but its model query keeps running.
+            onTimeout?.();
+            reject(new Error(`${label} timed out after ${ms / 1000}s`));
+        }, ms);
         promise
             .then(resolve)
             .catch(reject)
@@ -905,8 +911,9 @@ export async function runE2eRun(options) {
                 }
             }
         };
+        const controller = new AbortController();
         try {
-            const { results } = await withTimeout(execute(workflow, { run_id: vars.run_id, base_url: vars.base_url }, { skills, claude, observer, logger: consoleLogger }), timeoutMs, `Workflow ${workflow.name}`);
+            const { results } = await withTimeout(execute(workflow, { run_id: vars.run_id, base_url: vars.base_url }, { skills, claude, observer, logger: consoleLogger, signal: controller.signal }), timeoutMs, `Workflow ${workflow.name}`, () => controller.abort());
             // Extract report
             const report = results.get("report");
             if (report?.data) {

package/dist/cli/skill.js

@@ -29,7 +29,12 @@ export function renderSkillTemplate(opts) {
     const lines = [];
     lines.push("---");
     lines.push(`name: ${id}`);
-    lines.push(`description: ${description}`);
+    // JSON-quote the user-supplied description so YAML-special chars (`:`, a
+    // leading `[`/`{`/`@`/`>`/`|`, `#`, embedded quotes) round-trip cleanly
+    // through the loader's frontmatter parser. A JSON double-quoted string is a
+    // valid YAML double-quoted scalar. `id`/`category` are constrained elsewhere
+    // (isValidSkillId / SKILL_CATEGORIES) so they stay bare.
+    lines.push(`description: ${JSON.stringify(description)}`);
     lines.push(`category: ${category}`);
     lines.push("# config:");
     lines.push("#   EXAMPLE_ENV_VAR:");

package/dist/executor.d.ts

@@ -41,6 +41,20 @@ export interface ExecuteOptions {
      * Per-edge `max_iterations` behavior is unchanged.
      */
     max_steps?: number;
+    /**
+     * Caller-supplied abort signal. When it aborts, `execute()` rejects promptly
+     * and issues no further node / eval / route model calls. The signal is also
+     * threaded into every `claude.run` / `claude.evaluate` / `claude.ask` call so
+     * the underlying query is interrupted rather than left running detached.
+     * Default: no signal (back-compat).
+     */
+    signal?: AbortSignal;
+    /**
+     * Per-model-call wall-clock budget in ms, forwarded to every `claude.run` /
+     * `claude.evaluate` / `claude.ask` call. This is a per-call timeout, not a
+     * whole-run budget. Default: no timeout (back-compat).
+     */
+    timeoutMs?: number;
 }
 /**
  * Default workflow-level step budget. Counts total node executions across the

package/dist/executor.js

@@ -26,6 +26,16 @@ import { buildToolAliases } from "./skills/index.js";
  * before it burns meaningful model spend.
  */
 export const DEFAULT_MAX_STEPS = 200;
+/**
+ * Throw a clear "workflow aborted" error if the caller's signal has aborted.
+ * Used at the top of the run loop and before issuing any further model call so
+ * an aborted run stops promptly instead of advancing to the next node.
+ */
+function throwIfAborted(signal) {
+    if (signal?.aborted) {
+        throw new Error("workflow aborted");
+    }
+}
 /**
  * Execute a workflow from entry to completion.
  *
@@ -34,7 +44,9 @@ export const DEFAULT_MAX_STEPS = 200;
  * - `trace`: full ordered execution trace including loops and routing decisions
  */
 export async function execute(workflow, input, options) {
-    const { claude, observer } = options;
+    const { claude, observer, signal, timeoutMs } = options;
+    // If the caller already aborted before we started, fail fast.
+    throwIfAborted(signal);
     // Merge inline workflow skills into the skill map so they resolve at runtime.
     // Inline skills (instruction/mcp only) become Skill objects with empty tools/config.
     // The caller's skill map takes precedence — inline skills only fill gaps.
@@ -93,6 +105,9 @@ export async function execute(workflow, input, options) {
     safeObserve(observer, { type: "sources:resolved", sources: resolvedSources }, logger);
     let currentId = workflow.entry;
     while (currentId) {
+        // Abort before issuing the next node/eval/route model call. Aborting the
+        // signal mid-run makes execute() reject promptly rather than advancing.
+        throwIfAborted(signal);
         const node = workflow.nodes[currentId];
         if (!node)
             throw new Error(`Unknown node: "${currentId}"`);
@@ -156,7 +171,7 @@ export async function execute(workflow, input, options) {
             logger.warn(`  requires ${onFail === "skip" ? "skipped" : "failed"}: ${requiresError}`, { node: currentId });
             // Apply normal routing rules (dry run gate + resolveNext).
             // TODO: dedupe with requires path — see advanceFromNode helper below
-            const next = await advanceFromNode(workflow, currentId, results, input, claude, observer, edgeCounts, logger, trace);
+            const next = await advanceFromNode(workflow, currentId, results, input, claude, observer, edgeCounts, logger, trace, { signal, timeoutMs });
             currentId = next;
             continue;
         }
@@ -192,6 +207,8 @@ export async function execute(workflow, input, options) {
                 maxTurns: node.max_turns,
                 disallowedTools: node.disallowed_tools,
                 model: nodeModel,
+                signal,
+                timeoutMs,
                 onProgress: (message) => {
                     safeObserve(observer, { type: "node:progress", node: currentId, message }, logger);
                 },
@@ -261,6 +278,8 @@ export async function execute(workflow, input, options) {
                 logger,
                 context,
                 model: nodeModel,
+                signal,
+                timeoutMs,
             });
             currentInstruction = `${preamble}\n\n---\n\n${instruction}`;
             safeObserve(observer, { type: "node:retry", node: currentId, attempt: attempt + 1, reason: outcome.error ?? "eval failed", preamble }, logger);
@@ -273,7 +292,10 @@ export async function execute(workflow, input, options) {
         safeObserve(observer, { type: "node:exit", node: currentId, result }, logger);
         logger.info(`  ✓ ${result.status}`, { node: currentId, toolCalls: result.toolCalls.length });
         // Dry run gate + routing — shared with requires path via advanceFromNode helper.
-        currentId = await advanceFromNode(workflow, currentId, results, input, claude, observer, edgeCounts, logger, trace);
+        currentId = await advanceFromNode(workflow, currentId, results, input, claude, observer, edgeCounts, logger, trace, {
+            signal,
+            timeoutMs,
+        });
     }
     safeObserve(observer, {
         type: "workflow:end",
@@ -631,7 +653,7 @@ function resolveConfig(skills, overrides, env = process.env) {
  *
  * Returns the next node ID, or null when execution should stop.
  */
-async function advanceFromNode(workflow, currentId, results, input, claude, observer, edgeCounts, logger, trace) {
+async function advanceFromNode(workflow, currentId, results, input, claude, observer, edgeCounts, logger, trace, abort) {
     // Dry run hard gate — stop at the first conditional routing decision.
     // Unconditional edges are analysis flow (prepare→gather→investigate);
     // conditional edges are action decisions (investigate→create_issue/skip).
@@ -645,7 +667,7 @@ async function advanceFromNode(workflow, currentId, results, input, claude, obse
         }
     }
     const prevId = currentId;
-    const nextId = await resolveNext(workflow, currentId, results, input, claude, observer, edgeCounts, logger);
+    const nextId = await resolveNext(workflow, currentId, results, input, claude, observer, edgeCounts, logger, abort);
     if (nextId) {
         const reason = workflow.edges.find((e) => e.from === prevId && e.to === nextId)?.when ?? "only path";
         trace.edges.push({ from: prevId, to: nextId, reason });
@@ -661,7 +683,7 @@ async function advanceFromNode(workflow, currentId, results, input, claude, obse
  *
  * Edges with max_iterations are filtered out once exhausted.
  */
-async function resolveNext(workflow, current, results, input, claude, observer, edgeCounts, logger) {
+async function resolveNext(workflow, current, results, input, claude, observer, edgeCounts, logger, abort) {
     // Filter out edges that have exceeded their max_iterations
     const outEdges = workflow.edges.filter((e) => {
         if (e.from !== current)
@@ -731,6 +753,8 @@ async function resolveNext(workflow, current, results, input, claude, observer,
         question: "Based on the results so far, which condition is true?",
         context,
         choices,
+        signal: abort?.signal,
+        timeoutMs: abort?.timeoutMs,
     });
     // Validate that Claude returned a valid target.
     const validTargets = new Set(outEdges.map((e) => e.to));

package/dist/mermaid.js

@@ -32,6 +32,31 @@ export function toMermaid(workflow, options = {}) {
         lines.push("---");
     }
     lines.push(`graph ${direction}`);
+    // Build an injective real-ID → Mermaid-alias map. `sanitizeId` is lossy
+    // (every non-alphanumeric char collapses to `_`), so distinct node IDs like
+    // `a.b` and `a_b` would otherwise sanitize to the same alias and render as a
+    // single merged node, silently corrupting the diagram. Resolve every alias
+    // through this map so node declarations, edge endpoints, and class styling
+    // all stay consistent and collision-free.
+    const idAlias = new Map();
+    const usedAliases = new Set();
+    const aliasFor = (id) => {
+        const cached = idAlias.get(id);
+        if (cached)
+            return cached;
+        const base = sanitizeId(id);
+        let alias = base;
+        let n = 2;
+        while (usedAliases.has(alias))
+            alias = `${base}_${n++}`;
+        usedAliases.add(alias);
+        idAlias.set(id, alias);
+        return alias;
+    };
+    // Seed aliases in node-declaration order so already-alphanumeric IDs keep
+    // their byte-identical alias (and stable suffixing for any collisions).
+    for (const id of Object.keys(workflow.nodes))
+        aliasFor(id);
     // Build node iteration counts from trace
     const nodeIterations = new Map();
     if (trace) {
@@ -48,10 +73,10 @@ export function toMermaid(workflow, options = {}) {
         const iterations = nodeIterations.get(id);
         const iterTag = iterations && iterations > 1 ? ` ×${iterations}` : "";
         if (isEntry) {
-            lines.push(`    ${sanitizeId(id)}([${label}${entryTag}${iterTag}])`);
+            lines.push(`    ${aliasFor(id)}([${label}${entryTag}${iterTag}])`);
         }
         else {
-            lines.push(`    ${sanitizeId(id)}[${label}${iterTag}]`);
+            lines.push(`    ${aliasFor(id)}[${label}${iterTag}]`);
         }
     }
     lines.push("");
@@ -70,8 +95,8 @@ export function toMermaid(workflow, options = {}) {
     const notTakenIndices = [];
     let edgeIndex = 0;
     for (const edge of workflow.edges) {
-        const from = sanitizeId(edge.from);
-        const to = sanitizeId(edge.to);
+        const from = aliasFor(edge.from);
+        const to = aliasFor(edge.to);
         const key = `${edge.from}→${edge.to}`;
         const taken = takenEdges.has(key);
         const takenCount = edgeTakenCounts.get(key) ?? 0;
@@ -111,7 +136,7 @@ export function toMermaid(workflow, options = {}) {
         lines.push("    classDef failed fill:#ef4444,stroke:#dc2626,color:#fff,stroke-width:2px");
         lines.push("    classDef skipped fill:#6b7280,stroke:#4b5563,color:#fff,stroke-dasharray:5 5");
         for (const [status, ids] of statusNodes) {
-            const sanitized = ids.map(sanitizeId).join(",");
+            const sanitized = ids.map(aliasFor).join(",");
             lines.push(`    class ${sanitized} ${status}`);
         }
     }
@@ -141,7 +166,11 @@ function sanitizeId(id) {
 }
 /** Escape characters that break Mermaid labels */
 function escapeLabel(text) {
-    return text.replace(/"/g, """).replace(/\[/g, "[").replace(/\]/g, "]");
+    // `|` must be escaped too: edge labels are emitted as `-->|"label"|`, so a
+    // literal `|` inside the label (e.g. an edge `when` of "high | critical")
+    // terminates Mermaid's edge-label token and corrupts the edge. `|`
+    // renders as a literal `|`, consistent with the existing `[`/`]`.
+    return text.replace(/"/g, """).replace(/\[/g, "[").replace(/\]/g, "]").replace(/\|/g, "|");
 }
 /** Group node IDs by their status */
 function groupByStatus(state) {

package/dist/retry.d.ts

@@ -17,6 +17,10 @@ export interface BuildRetryPreambleOptions {
      * runs on the node's model. When undefined, the client default applies.
      */
     model?: string;
+    /** Caller-supplied abort signal, forwarded to the reflection `claude.ask`. */
+    signal?: AbortSignal;
+    /** Per-call wall-clock budget in ms, forwarded to the reflection `claude.ask`. */
+    timeoutMs?: number;
 }
 /**
  * Build the retry preamble for a single retry attempt.

package/dist/retry.js

@@ -21,7 +21,7 @@ const DEFAULT_PREAMBLE_HEADER = "## Previous attempt failed evaluation";
  * default static preamble and logs a warning.
  */
 export async function buildRetryPreamble(opts) {
-    const { retry, evalFailures, toolCalls, nodeInstruction, claude, logger, context, model } = opts;
+    const { retry, evalFailures, toolCalls, nodeInstruction, claude, logger, context, model, signal, timeoutMs } = opts;
     const failureList = formatEvalFailures(evalFailures);
     const inst = retry.instruction;
     if (typeof inst === "string") {
@@ -31,7 +31,7 @@ export async function buildRetryPreamble(opts) {
         const reflectPrompt = "reflect" in inst && typeof inst.reflect === "string" ? inst.reflect : DEFAULT_REFLECTION_PROMPT;
         const askInstruction = buildReflectionPrompt(reflectPrompt, nodeInstruction, failureList, toolCalls);
         try {
-            const diagnosis = await claude.ask({ instruction: askInstruction, context, model });
+            const diagnosis = await claude.ask({ instruction: askInstruction, context, model, signal, timeoutMs });
             const trimmed = diagnosis.trim();
             if (trimmed.length > 0) {
                 return `## Reflection on previous attempt\n\n${trimmed}\n\n${DEFAULT_PREAMBLE_HEADER}\n\n${failureList}`;

package/dist/schema.d.ts

@@ -2623,7 +2623,7 @@ export declare function parseWorkflow(raw: unknown): {
     }> | undefined;
 };
 export interface WorkflowError {
-    code: "MISSING_ENTRY" | "UNKNOWN_EDGE_SOURCE" | "UNKNOWN_EDGE_TARGET" | "UNREACHABLE_NODE" | "UNKNOWN_SKILL" | "SELF_LOOP" | "UNBOUNDED_CYCLE" | "INVALID_INLINE_SKILL";
+    code: "MISSING_ENTRY" | "UNKNOWN_EDGE_SOURCE" | "UNKNOWN_EDGE_TARGET" | "UNREACHABLE_NODE" | "UNKNOWN_SKILL" | "SELF_LOOP" | "UNBOUNDED_CYCLE" | "UNSUPPORTED_EVAL_POLICY" | "INVALID_INLINE_SKILL";
     message: string;
     nodeId?: string;
 }

package/dist/schema.js

@@ -102,6 +102,13 @@ export const outputMatchZ = z
 }, { message: "output_matches entry must declare exactly one of: equals, in, matches" });
 export const evaluatorKindZ = z.enum(EVALUATOR_KINDS);
 export const evalPolicyZ = z.enum(EVAL_POLICIES);
+/**
+ * Eval policies actually implemented at runtime. The Zod schema and published
+ * JSON schema accept the full {@link EVAL_POLICIES} vocabulary (the others are
+ * reserved), but `validateWorkflow` rejects any policy not in this set so a
+ * workflow fails at load time rather than throwing mid-run from `aggregateEval`.
+ */
+const SUPPORTED_EVAL_POLICIES = new Set(["all_pass"]);
 export const evaluatorRuleZ = z
     .object({
     any_tool_called: z.array(z.string().min(1)).min(1).optional(),
@@ -400,6 +407,23 @@ export function validateWorkflow(workflow, knownSkills) {
             }
         }
     }
+    // Reject eval policies that are reserved in the vocabulary but not yet
+    // implemented. The Zod schema accepts the whole EVAL_POLICIES enum (the
+    // published JSON schema advertises them as reserved), but only `all_pass`
+    // is implemented at runtime. Without this check a workflow declaring
+    // `eval_policy: "any_pass"` or `"weighted"` parses and validates cleanly,
+    // then `aggregateEval` throws uncaught mid-run — a validate-then-crash
+    // failure mode. Reject it at load time instead. The runtime throw in
+    // aggregateEval stays as a defense-in-depth backstop.
+    for (const [nodeId, node] of Object.entries(workflow.nodes)) {
+        if (node.eval_policy != null && !SUPPORTED_EVAL_POLICIES.has(node.eval_policy)) {
+            errors.push({
+                code: "UNSUPPORTED_EVAL_POLICY",
+                message: `Node "${nodeId}" declares eval_policy "${node.eval_policy}", which is reserved but not yet implemented; use "all_pass" (the only supported policy in v1.0)`,
+                nodeId,
+            });
+        }
+    }
     // Inline skill definitions must have instruction or mcp
     for (const [skillId, def] of Object.entries(workflow.skills ?? {})) {
         if (!def.instruction && !def.mcp) {

package/dist/skills/custom-loader.js

@@ -249,14 +249,20 @@ export function configuredSkillsWithDiagnostics(env = process.env, cwd) {
     // Custom skills can override built-in IDs. When overriding, merge:
     // keep the built-in's tools and config, add the custom instruction/mcp.
     const configuredMap = new Map(configured.map((s) => [s.id, s]));
+    // Resolve override targets against the FULL built-in set, not the
+    // env-filtered `configured` list. Otherwise a custom override of a built-in
+    // whose required env var happens to be unset falls through to the
+    // "net-new custom skill" branch and silently drops the built-in's tools.
+    // The tool surface of a built-in must not hinge on an unrelated env check.
+    const builtinById = new Map(builtinSkills.map((s) => [s.id, s]));
     for (const skill of custom) {
-        const existing = configuredMap.get(skill.id);
-        if (existing) {
+        const base = configuredMap.get(skill.id) ?? builtinById.get(skill.id);
+        if (base) {
             configuredMap.set(skill.id, {
-                ...existing,
-                config: { ...existing.config, ...skill.config },
-                instruction: skill.instruction ?? existing.instruction,
-                mcp: skill.mcp ?? existing.mcp,
+                ...base,
+                config: { ...base.config, ...skill.config },
+                instruction: skill.instruction ?? base.instruction,
+                mcp: skill.mcp ?? base.mcp,
             });
         }
         else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.103",
+  "version": "0.1.105",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"