@sweny-ai/core 0.1.105 → 0.1.107

package/dist/executor.js

@@ -625,18 +625,50 @@ function resolveSkillInstructions(skillIds, skills) {
  * `options.env ?? process.env` so an explicit env map is honored consistently
  * with Source resolution (which reads the same map). Defaults to
  * `process.env` when omitted.
+ *
+ * Presence vs. truthiness: an explicitly-provided empty string is treated as
+ * present, not absent. Resolution rules:
+ *   - An override that is present (any string, including "") wins; the env
+ *     var is not consulted. An explicit "" override does NOT silently fall
+ *     through to env.
+ *   - Otherwise the env var (when declared) is used.
+ *   - A value that is `undefined` (no override, no env var) is absent: a
+ *     required field reports "not provided".
+ *   - A value that is "" is present-but-empty: a required field reports a
+ *     distinct "set to empty" message (you set it, but to an unusable value),
+ *     while an optional field passes the empty string through.
  */
 function resolveConfig(skills, overrides, env = process.env) {
     const config = {};
     const missing = [];
     for (const skill of skills.values()) {
         for (const [key, field] of Object.entries(skill.config)) {
-            const value = overrides?.[key] ?? (field.env ? env[field.env] : undefined);
-            if (value) {
-                config[key] = value;
+            // Explicit override wins, including an empty string — `in` distinguishes
+            // a present "" from an absent key, so an override never falls through to
+            // env in a surprising way.
+            const hasOverride = overrides != null && key in overrides;
+            const value = hasOverride ? overrides[key] : field.env ? env[field.env] : undefined;
+            const source = field.env ? ` (env: ${field.env})` : "";
+            const label = `${skill.id}.${key}${source || " (env: none)"}`;
+            if (value === undefined) {
+                // Truly absent: no override and no env value.
+                if (field.required) {
+                    missing.push(`${label}: not provided`);
+                }
             }
-            else if (field.required) {
-                missing.push(`${skill.id}.${key} (env: ${field.env ?? "none"})`);
+            else if (value === "") {
+                // Present but empty. An empty credential is unusable for a required
+                // field; surface a distinct message so the user can tell "set to empty"
+                // from "forgot it". Optional empty values pass through unchanged.
+                if (field.required) {
+                    missing.push(`${label}: set to empty`);
+                }
+                else {
+                    config[key] = value;
+                }
+            }
+            else {
+                config[key] = value;
             }
         }
     }
@@ -710,6 +742,23 @@ async function resolveNext(workflow, current, results, input, claude, observer,
     // Check for a default (unconditional) edge among conditionals
     const defaultEdge = outEdges.find((e) => !e.when);
     const conditionalEdges = outEdges.filter((e) => e.when);
+    // Defense-in-depth for AMBIGUOUS_EDGES (rejected by validateWorkflow): with
+    // no conditional edges there is nothing for the route evaluator to decide.
+    // Follow the (first) unconditional edge directly and skip the no-op
+    // claude.evaluate call. validateWorkflow already rejects 2+ unconditional
+    // edges, so a well-formed workflow reaching here has exactly one default.
+    if (conditionalEdges.length === 0 && defaultEdge) {
+        if (outEdges.length > 1) {
+            logger?.warn(`  route eval: node '${current}' has ${outEdges.length} unconditional out-edges; following '${defaultEdge.to}' ` +
+                `and ignoring the rest. Add 'when' clauses to make routing deterministic (see AMBIGUOUS_EDGES).`, { node: current });
+        }
+        if (edgeCounts) {
+            const key = `${current}→${defaultEdge.to}`;
+            edgeCounts.set(key, (edgeCounts.get(key) ?? 0) + 1);
+        }
+        safeObserve(observer, { type: "route", from: current, to: defaultEdge.to, reason: "only path" }, logger);
+        return defaultEdge.to;
+    }
     // Claude evaluates which condition matches. Include input so conditions
     // can reference workflow-level flags like dryRun, and expose evals so
     // routing edges can read `priorNode.evals.X.pass`.
@@ -724,7 +773,14 @@ async function resolveNext(workflow, current, results, input, claude, observer,
     for (const [k, v] of results.entries()) {
         const { view, missing } = buildRouteEvalEntry(v, workflow.nodes[k]);
         context[k] = view;
-        if (missing.length > 0) {
+        // Only a successful node has an output contract to violate. A node that
+        // was skipped (requires not met) or failed before producing output never
+        // emitted its declared properties; its data is { skipped_reason } / { error }.
+        // Warning that those nodes are "missing declared properties" is misleading
+        // noise — it alarms operators and pollutes telemetry on every skip. Still
+        // build the view above so routing can read the skipped/failed data; only
+        // suppress the warning + node:warning for non-success nodes.
+        if (missing.length > 0 && v.status === "success") {
             // Loud signal for the operator. The view itself already replaces the
             // missing keys with explicit `null`, so the LLM evaluator cannot
             // ghost-match "is N" or "is undefined" against a structurally-absent

package/dist/schema.d.ts

@@ -17,7 +17,7 @@ export declare const configFieldZ: z.ZodObject<{
     description: z.ZodString;
     required: z.ZodOptional<z.ZodBoolean>;
     env: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
+}, "strict", z.ZodTypeAny, {
     description: string;
     required?: boolean | undefined;
     env?: string | undefined;
@@ -30,12 +30,14 @@ export declare const configFieldZ: z.ZodObject<{
  * Zod schema for tool metadata (name, description, input_schema).
  * Note: `handler` is intentionally omitted — Zod schemas validate
  * serializable data (JSON import/export), not runtime function refs.
+ *
+ * .strict() to match the published Tool `$def`'s `additionalProperties: false`.
  */
 export declare const toolZ: z.ZodObject<{
     name: z.ZodString;
     description: z.ZodString;
     input_schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-}, "strip", z.ZodTypeAny, {
+}, "strict", z.ZodTypeAny, {
     description: string;
     name: string;
     input_schema: Record<string, unknown>;
@@ -179,7 +181,7 @@ export declare const skillZ: z.ZodEffects<z.ZodObject<{
         description: z.ZodString;
         required: z.ZodOptional<z.ZodBoolean>;
         env: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
+    }, "strict", z.ZodTypeAny, {
         description: string;
         required?: boolean | undefined;
         env?: string | undefined;
@@ -192,7 +194,7 @@ export declare const skillZ: z.ZodEffects<z.ZodObject<{
         name: z.ZodString;
         description: z.ZodString;
         input_schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    }, "strip", z.ZodTypeAny, {
+    }, "strict", z.ZodTypeAny, {
         description: string;
         name: string;
         input_schema: Record<string, unknown>;
@@ -2623,7 +2625,7 @@ export declare function parseWorkflow(raw: unknown): {
     }> | undefined;
 };
 export interface WorkflowError {
-    code: "MISSING_ENTRY" | "UNKNOWN_EDGE_SOURCE" | "UNKNOWN_EDGE_TARGET" | "UNREACHABLE_NODE" | "UNKNOWN_SKILL" | "SELF_LOOP" | "UNBOUNDED_CYCLE" | "UNSUPPORTED_EVAL_POLICY" | "INVALID_INLINE_SKILL";
+    code: "MISSING_ENTRY" | "UNKNOWN_EDGE_SOURCE" | "UNKNOWN_EDGE_TARGET" | "UNREACHABLE_NODE" | "UNKNOWN_SKILL" | "SELF_LOOP" | "UNBOUNDED_CYCLE" | "AMBIGUOUS_EDGES" | "UNSUPPORTED_EVAL_POLICY" | "INVALID_INLINE_SKILL";
     message: string;
     nodeId?: string;
 }
@@ -3402,6 +3404,11 @@ export declare const skillJsonSchema: {
         readonly McpServerConfig: {
             readonly type: "object";
             readonly description: "External MCP server definition.";
+            readonly anyOf: readonly [{
+                readonly required: readonly ["command"];
+            }, {
+                readonly required: readonly ["url"];
+            }];
             readonly additionalProperties: false;
             readonly properties: {
                 readonly type: {

package/dist/schema.js

@@ -14,21 +14,32 @@ export { sourceZ };
 export { workflowInputsZ };
 // ─── Zod Schemas ─────────────────────────────────────────────────
 export const jsonSchemaZ = z.record(z.unknown());
-export const configFieldZ = z.object({
+// .strict() to match the published skill JSON Schema's ConfigField
+// `additionalProperties: false`. Without it Zod silently STRIPPED an unknown
+// nested key while ajv REJECTED it (the #214/#225 divergence class, missed for
+// configFieldZ/toolZ). custom-loader.ts builds Skill objects from frontmatter
+// and never runs these schemas, so tightening is safe downstream.
+export const configFieldZ = z
+    .object({
     description: z.string(),
     required: z.boolean().optional(),
     env: z.string().optional(),
-});
+})
+    .strict();
 /**
  * Zod schema for tool metadata (name, description, input_schema).
  * Note: `handler` is intentionally omitted — Zod schemas validate
  * serializable data (JSON import/export), not runtime function refs.
+ *
+ * .strict() to match the published Tool `$def`'s `additionalProperties: false`.
  */
-export const toolZ = z.object({
+export const toolZ = z
+    .object({
     name: z.string().min(1),
     description: z.string(),
     input_schema: jsonSchemaZ,
-});
+})
+    .strict();
 export const skillCategoryZ = z.enum(SKILL_CATEGORIES);
 export const mcpServerConfigZ = z
     .object({
@@ -344,6 +355,32 @@ export function validateWorkflow(workflow, knownSkills) {
             });
         }
     }
+    // Edge determinism: a node with two or more out-edges that have no `when`
+    // clause is ambiguous. The executor's resolveNext picks the first such edge
+    // and silently drops the rest, wasting a route eval on a deterministic hop
+    // and leaving the other targets unreachable. Reject it at load time so the
+    // author sees the problem instead of getting a silent first-edge-wins.
+    // Only count edges whose source is a real node (broken sources are already
+    // reported above as UNKNOWN_EDGE_SOURCE).
+    const unconditionalByNode = new Map();
+    for (const edge of workflow.edges) {
+        if (!nodeIds.has(edge.from))
+            continue;
+        if (edge.when)
+            continue;
+        const list = unconditionalByNode.get(edge.from) ?? [];
+        list.push(edge.to);
+        unconditionalByNode.set(edge.from, list);
+    }
+    for (const [from, targets] of unconditionalByNode) {
+        if (targets.length > 1) {
+            errors.push({
+                code: "AMBIGUOUS_EDGES",
+                message: `Node "${from}" has ${targets.length} unconditional out-edges (to ${targets.join(", ")}); add a 'when' clause to all but one so routing is deterministic`,
+                nodeId: from,
+            });
+        }
+    }
     // Don't check reachability if there are structural errors
     if (errors.length > 0)
         return errors;
@@ -1009,6 +1046,11 @@ export const skillJsonSchema = {
         McpServerConfig: {
             type: "object",
             description: "External MCP server definition.",
+            // An MCP server must declare command (stdio) or url (http), mirroring
+            // mcpServerConfigZ.refine(c => c.command || c.url) and the workflow
+            // inline-skill mcp block. Without this the published skill.json accepted a
+            // transport-less mcp block the runtime parser rejects (Zod<->ajv drift).
+            anyOf: [{ required: ["command"] }, { required: ["url"] }],
             additionalProperties: false,
             properties: {
                 type: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.105",
+  "version": "0.1.107",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"