@sweny-ai/core 0.1.208 → 0.1.210

package/dist/cli/record.d.ts

@@ -18,6 +18,12 @@ import { type TryFixture } from "./try.js";
 export declare const RECORD_COLUMNS = 80;
 /** Lines longer than this wrap in the window, like a terminal would. */
 export declare const RECORD_WRAP = 96;
+/**
+ * Items of each list the recorded answer shows (the rest is counted in the heading). The README's
+ * first screen has a 900px budget; the real answer is longer than that, so the recording shows a
+ * summary of it. `sweny try` in a terminal shows all of it.
+ */
+export declare const RECORD_ANSWER_ITEMS = 2;
 /** Width of one terminal column in the window, in px. Every segment is placed at column * CELL_W. */
 export declare const CELL_W = 7.85;
 /** Left edge of column 0. */

package/dist/cli/record.js

@@ -22,6 +22,12 @@ import { loadTryFixture, runTry, SUMMARY_PREVIEW_LEAD } from "./try.js";
 export const RECORD_COLUMNS = 80;
 /** Lines longer than this wrap in the window, like a terminal would. */
 export const RECORD_WRAP = 96;
+/**
+ * Items of each list the recorded answer shows (the rest is counted in the heading). The README's
+ * first screen has a 900px budget; the real answer is longer than that, so the recording shows a
+ * summary of it. `sweny try` in a terminal shows all of it.
+ */
+export const RECORD_ANSWER_ITEMS = 2;
 const FONT_SIZE = 13;
 /** Width of one terminal column in the window, in px. Every segment is placed at column * CELL_W. */
 export const CELL_W = 7.85;
@@ -317,6 +323,7 @@ export async function recordTrySvg(fixture = loadTryFixture()) {
             rich: true,
             unicode: true,
             columns: RECORD_COLUMNS,
+            compactAnswer: RECORD_ANSWER_ITEMS,
             fixture,
             write: (s) => {
                 out += s;

package/dist/cli/try-fixture.json

@@ -1,33 +1,73 @@
 {
   "schema_version": 1,
-  "illustrative": true,
-  "notice": "ILLUSTRATIVE SAMPLE DATA. This is not output from a real run and not about your code. The repo (acme-notes-api) is fictional; timings, tool-call counts, token usage and cost are plausible numbers for a small repo, written by hand. Replace this file with a recorded real run (metadata plus the sample answer only) and set illustrative to false.",
+  "illustrative": false,
+  "captured_at": "2026-11-10T20:09:47.380Z",
+  "notice": "A replay of a real run of explain-repo on swenyai/sweny, started 2026-11-10T20:09:47Z (2026-11-10). Durations, tool-call counts, token usage and cost are as recorded; the answer is redacted. Made by `sweny try --capture`; do not edit by hand.",
   "workflow": "explain-repo",
-  "sample_repo": "acme-notes-api",
-  "harness": { "id": "claude-code", "version": "sample" },
-  "policy": { "envScope": true, "sandbox": "auto", "sandboxStarted": true },
+  "sample_repo": "swenyai/sweny",
+  "harness": {
+    "id": "claude-code",
+    "version": "0.3.322"
+  },
+  "policy": {
+    "envScope": true,
+    "sandbox": "strict",
+    "sandboxStarted": true
+  },
   "nodes": {
     "survey": {
-      "duration_ms": 18400,
-      "tool_calls": { "Glob": 3, "Read": 7, "Grep": 2 },
-      "usage": { "inputTokens": 21300, "outputTokens": 1150, "costUsd": 0.09, "numTurns": 8 }
+      "duration_ms": 15711,
+      "tool_calls": {
+        "Bash": 2
+      },
+      "usage": {
+        "inputTokens": 6,
+        "outputTokens": 2006,
+        "costUsd": 0.1197956,
+        "numTurns": 3
+      }
     },
     "explain": {
-      "duration_ms": 9100,
-      "tool_calls": {},
-      "usage": { "inputTokens": 6800, "outputTokens": 640, "costUsd": 0.04, "numTurns": 1 },
+      "duration_ms": 7211,
+      "tool_calls": {
+        "StructuredOutput": 1
+      },
+      "usage": {
+        "inputTokens": 2,
+        "outputTokens": 877,
+        "costUsd": 0.0871939,
+        "numTurns": 2
+      },
       "output": {
-        "purpose": "A small REST API for storing and searching notes, built with Express and TypeScript on top of SQLite. Meant as the backend for a notes app.",
-        "how_to_run": ["npm install", "npm run build", "npm test", "npm start (serves on http://localhost:3000)"],
+        "purpose": "SWEny runs DAGs of coding-agent steps (Claude Code, Codex, pi, ACP agents) defined in YAML workflows, locally or in CI. It scopes each step's env and tools, validates output schemas, and records a receipt per run. For teams automating coding-agent work.",
+        "how_to_run": [
+          "Use Node >=22, then run: npm install (installs all workspaces)",
+          "npm run build",
+          "npm run typecheck",
+          "npm test (Vitest)",
+          "npm run lint",
+          "Run the CLI: node packages/core/dist/cli/main.js workflow run <file.yml> (the `sweny` bin)",
+          "Docs site: npm run dev:web",
+          "In CI: use the GitHub Action swenyai/sweny@v5 (action.yml)"
+        ],
         "key_files": [
-          "src/server.ts: the entry point, wires routes and the database",
-          "src/routes/notes.ts: the CRUD and search endpoints",
-          "src/db/schema.sql: the tables, applied on first start",
-          "test/notes.test.ts: the API tests, a good map of expected behavior"
+          "README.md, ARCHITECTURE.md, CONTRIBUTING.md, CLAUDE.md: start here for the concepts and the contributor rules",
+          "packages/core/src/executor.ts: runs the DAG",
+          "packages/core/src/cli/: CLI entry point (main.js is built from here)",
+          "packages/core/src/schema.ts, types.ts, loader.ts: workflow definition and validation",
+          "packages/core/src/node-policy.ts, agent-env.ts, safe-outputs.ts, untrusted.ts: security scoping and output checks",
+          "packages/core/src/journal.ts: run receipts",
+          "packages/core/src/workflows/, .sweny/workflows/, examples/: built-in and sample workflows",
+          "packages/mcp/src/index.ts: MCP server",
+          "packages/studio: visual workflow editor",
+          "action.yml and .github/workflows/ci.yml, release.yml: Action and CI/release"
         ],
         "risks": [
-          "No auth on any route: fine locally, not safe to expose as is.",
-          "The README does not mention the PORT or DB_PATH environment variables that src/server.ts reads."
+          "Only Claude Code is fully supported. Codex, pi and ACP agents are experimental.",
+          "Every push to main triggers release.yml, which publishes to npm, so merges ship straight away. There are no changesets.",
+          "The build, test and run commands above come from a survey of the root scripts, not from running them. Check them against package.json.",
+          "The repo has many moving parts: 5 packages, 2 Astro sites, the plugin and the Action. Run builds from the repo root so workspaces resolve.",
+          "Security-sensitive code (env scoping, input fencing, output checks) needs careful review. Read SECURITY.md first."
         ]
       }
     }

package/dist/cli/try.d.ts

@@ -16,6 +16,7 @@
 import type { Command } from "commander";
 import type { AgentHarness } from "../harness/types.js";
 import type { Workflow } from "../types.js";
+import { type FinalOutput } from "./final-output.js";
 import { type Paint } from "./style.js";
 export interface TryFixtureNode {
     /** Recorded wall-clock time of the node. */
@@ -109,6 +110,12 @@ export interface TryOptions {
     rich?: boolean;
     /** Terminal width. Default: stdout's. */
     columns?: number;
+    /**
+     * Show at most this many items of each list in the answer, with the count in its heading
+     * ("How to run it (2 of 8):"). The recording uses it to stay README-sized; a real terminal run
+     * leaves it unset and shows the whole answer.
+     */
+    compactAnswer?: number;
     fixture?: TryFixture;
 }
 /** A default replay takes about this long in total, however long the real run took. */
@@ -117,6 +124,11 @@ export declare const REPLAY_TARGET_MS = 8000;
 export declare const REPLAY_NODE_MIN_MS = 250;
 /** Per-node replay time: the recorded durations scaled to {@link REPLAY_TARGET_MS} in total (never slowed down). */
 export declare function scaledPace(fixture: TryFixture, targetMs?: number): (nodeId: string) => number;
+/**
+ * The answer with each list cut to its first `maxItems` items; the heading then says
+ * "<title> (<maxItems> of <total>):". Scalars, short lists and errors pass through. Pure.
+ */
+export declare function compactAnswer(out: FinalOutput, maxItems: number): FinalOutput;
 /** The line that opens the job summary preview (record.ts cuts the preview from here). */
 export declare const SUMMARY_PREVIEW_LEAD = "In CI, the job summary gets this heading, this DAG and the receipt below:";
 /** Replay the recording. Returns the process exit code. */

package/dist/cli/try.js

@@ -211,6 +211,41 @@ export function scaledPace(fixture, targetMs = REPLAY_TARGET_MS) {
     const scale = total > targetMs ? targetMs / total : 1;
     return (id) => Math.max(REPLAY_NODE_MIN_MS, Math.round((fixture.nodes[id]?.duration_ms ?? 0) * scale));
 }
+/**
+ * The answer with each list cut to its first `maxItems` items; the heading then says
+ * "<title> (<maxItems> of <total>):". Scalars, short lists and errors pass through. Pure.
+ */
+export function compactAnswer(out, maxItems) {
+    if (out.kind !== "result" || !Number.isInteger(maxItems) || maxItems < 1)
+        return out;
+    const src = out.lines;
+    const lines = [];
+    let i = 0;
+    while (i < src.length) {
+        const head = src[i];
+        // A list is a heading with no value ("Key files:") followed by "- " items and their indented continuations.
+        if (!/^[^\s-].*:$/.test(head) || !src[i + 1]?.startsWith("- ")) {
+            lines.push(head);
+            i++;
+            continue;
+        }
+        const items = [];
+        let j = i + 1;
+        while (j < src.length && (src[j].startsWith("- ") || src[j].startsWith(" "))) {
+            if (src[j].startsWith("- "))
+                items.push([src[j]]);
+            else
+                items[items.length - 1].push(src[j]);
+            j++;
+        }
+        if (items.length <= maxItems)
+            lines.push(head, ...items.flat());
+        else
+            lines.push(`${head.slice(0, -1)} (${maxItems} of ${items.length}):`, ...items.slice(0, maxItems).flat());
+        i = j;
+    }
+    return { ...out, lines };
+}
 const silentLogger = { info() { }, warn() { }, error() { }, debug() { } };
 /** The line that opens the job summary preview (record.ts cuts the preview from here). */
 export const SUMMARY_PREVIEW_LEAD = "In CI, the job summary gets this heading, this DAG and the receipt below:";
@@ -291,8 +326,10 @@ export async function runTry(opts = {}) {
     const totalMs = Object.values(durationsMs).reduce((a, b) => a + b, 0);
     const receipt = summarizeRun(results, totalMs, false, trace);
     const answer = resolveFinalOutput(workflow, results);
-    if (answer)
-        write(`${formatFinalOutput(answer)}\n\n`);
+    if (answer) {
+        const shown = opts.compactAnswer ? compactAnswer(answer, opts.compactAnswer) : answer;
+        write(`${formatFinalOutput(shown)}\n\n`);
+    }
     // Compact preview of CI's job summary: heading and DAG here, receipt below.
     const comment = formatRunComment(workflow, results, receipt, { trace, durationsMs });
     write(`  ${paint.muted(SUMMARY_PREVIEW_LEAD)}\n\n`);

package/dist/executor.d.ts

@@ -12,7 +12,8 @@
  *
  * This replaces ~8k lines of engine + recipe step code.
  */
-import type { Workflow, Node, Skill, Tool, Claude, Observer, NodeResult, Logger, ExecutionResult, JSONSchema } from "./types.js";
+import type { Workflow, Node, Skill, Tool, Claude, Observer, NodeResult, Logger, ExecutionResult, JSONSchema, EvalResult, Evaluator, ToolCall } from "./types.js";
+import type { ToolAliases } from "./eval/index.js";
 import type { HarnessPolicyMode } from "./harness/policy.js";
 import type { AgentHarness } from "./harness/types.js";
 import type { DeciderOperatorConfig } from "./decider.js";
@@ -190,6 +191,20 @@ export declare const COUNT_OF_KEYWORD = "x-sweny-count-of";
  * nested shapes and additionalProperties stay the author's concern.
  */
 export declare function outputContractProblems(data: unknown, output: JSONSchema | undefined): ContractProblem[];
+/**
+ * Required tools the agent never called, when that is the only reason a node
+ * failed its evals and another turn could call them: every failure is a
+ * `function` evaluator, none saw a forbidden call, every required tool it names
+ * is absent from the trace (not called and failed: that is the retry path's
+ * job), and every one is reachable, i.e. on `agentTools`, the tool list the
+ * harness reported for the run, by its own name or an alias (an MCP tool
+ * counts by its bare name). Empty otherwise, and empty when the harness
+ * reported no list. An `any_tool_called` set needs one reachable member and
+ * reads "one of a, b" over its reachable members.
+ */
+export declare function uncalledRequiredTools(evaluators: Evaluator[] | undefined, failures: EvalResult[], toolCalls: ToolCall[], agentTools: readonly string[] | undefined, aliases?: ToolAliases): string[];
+/** The repair turn for {@link uncalledRequiredTools}: names the tools, then the step again. */
+export declare function requiredToolsRepairInstruction(uncalled: string[], instruction: string): string;
 /**
  * Dry-run tool gate (#380). Only an explicit `access: "read"` passes; a tool
  * with no `access` is treated as a write so new tools fail safe.

package/dist/executor.js

@@ -15,6 +15,7 @@
 import { consoleLogger } from "./types.js";
 import { resolveSources } from "./source-resolver.js";
 import { evaluateAll, aggregateEval } from "./eval/index.js";
+import { checkAllToolsCalled, checkAnyToolCalled, checkNoToolCalled } from "./eval/function.js";
 import { evaluateRequires } from "./requires.js";
 import { evaluateExpression, isWhenExpression, parseExpression, whenLabel } from "./when.js";
 import { buildRetryPreamble } from "./retry.js";
@@ -602,6 +603,8 @@ async function executeRun(workflow, input, options, results, trace, at) {
         let currentInstruction = instruction;
         // One structured-output repair per visit (#357), before any eval retry.
         let repaired = false;
+        // One required-tool repair per visit, before any eval retry.
+        let toolRepaired = false;
         const retry = node.retry;
         // Per-node execution model: node.model ?? workflow.model. When undefined,
         // claude.run falls back to its own client default (then Claude Code's).
@@ -723,8 +726,8 @@ async function executeRun(workflow, input, options, results, trace, at) {
             // Resume (#363): spend is journaled as it is reported, so a crash mid-node
             // does not hand the resumed run a fresh budget.
             const usageNode = currentId;
-            // The repair call (at most one) shifts later attempts by one, so every agent call has its own key.
-            const usageAttempt = attempt + (repaired ? 1 : 0);
+            // Each repair call (at most one of each) shifts later attempts by one, so every agent call has its own key.
+            const usageAttempt = attempt + (repaired ? 1 : 0) + (toolRepaired ? 1 : 0);
             let liveUsage;
             // A live usage record the journal cannot write stops the agent at once:
             // its spend would be invisible to a resume.
@@ -957,6 +960,30 @@ async function executeRun(workflow, input, options, results, trace, at) {
             }
             if (outcome.pass)
                 break;
+            // Required tools: a node whose only failures are `function` evals naming
+            // tools its agent never called, all of them on the tool list the harness
+            // says the agent had, gets one repair turn that names them, before any
+            // eval retry. Same footing as the output contract repair: part
+            // of this visit (no extra max_steps slot), its spend counted. Agents
+            // sometimes answer on turn 1 without the tools they were given (dogfood
+            // run 42890245104: `called: [StructuredOutput]`).
+            const uncalled = toolRepaired
+                ? []
+                : uncalledRequiredTools(node.eval, outcome.failures, result.toolCalls, result.agentTools, toolAliases);
+            if (uncalled.length > 0) {
+                toolRepaired = true;
+                logger.warn(`  required tools not called: ${uncalled.join(", ")}; asking the agent once to call them`, {
+                    node: currentId,
+                });
+                safeObserve(observer, {
+                    type: "node:warning",
+                    node: currentId,
+                    reason: "required tools not called; one repair attempt",
+                    fields: uncalled,
+                }, logger);
+                currentInstruction = requiredToolsRepairInstruction(uncalled, currentInstruction);
+                continue;
+            }
             // Apply the failure to the result.
             result.status = "failed";
             result.data = { ...result.data, error: outcome.error };
@@ -1599,6 +1626,62 @@ export function outputContractProblems(data, output) {
     }
     return problems;
 }
+/**
+ * Required tools the agent never called, when that is the only reason a node
+ * failed its evals and another turn could call them: every failure is a
+ * `function` evaluator, none saw a forbidden call, every required tool it names
+ * is absent from the trace (not called and failed: that is the retry path's
+ * job), and every one is reachable, i.e. on `agentTools`, the tool list the
+ * harness reported for the run, by its own name or an alias (an MCP tool
+ * counts by its bare name). Empty otherwise, and empty when the harness
+ * reported no list. An `any_tool_called` set needs one reachable member and
+ * reads "one of a, b" over its reachable members.
+ */
+export function uncalledRequiredTools(evaluators, failures, toolCalls, agentTools, aliases) {
+    if (!agentTools)
+        return [];
+    const listed = new Set(agentTools.map(bareToolName));
+    const reachable = (name) => listed.has(name) || [...(aliases?.get(name) ?? [])].some((a) => listed.has(a));
+    const uncalled = [];
+    // A call to any of these (by name or alias), successful or not.
+    const invoked = (names) => checkNoToolCalled(names, toolCalls, aliases) !== null;
+    for (const failure of failures) {
+        const rule = failure.kind === "function"
+            ? evaluators?.find((e) => e.kind === "function" && e.name === failure.name)?.rule
+            : undefined;
+        if (!rule)
+            return [];
+        if (rule.no_tool_called && rule.no_tool_called.length > 0 && invoked(rule.no_tool_called))
+            return [];
+        for (const name of rule.all_tools_called ?? []) {
+            if (checkAllToolsCalled([name], toolCalls, aliases) === null)
+                continue;
+            if (invoked([name]) || !reachable(name))
+                return [];
+            uncalled.push(name);
+        }
+        const any = rule.any_tool_called ?? [];
+        if (any.length > 0 && checkAnyToolCalled(any, toolCalls, aliases) !== null) {
+            const open = any.filter(reachable);
+            if (invoked(any) || open.length === 0)
+                return [];
+            uncalled.push(open.length === 1 ? open[0] : `one of ${open.join(", ")}`);
+        }
+    }
+    return [...new Set(uncalled)];
+}
+/** `mcp__<server>__<tool>` → `<tool>`; any other name unchanged. Tool calls are recorded the same way. */
+function bareToolName(name) {
+    const parts = name.split("__");
+    return parts.length >= 3 && parts[0] === "mcp" ? parts.slice(2).join("__") : name;
+}
+/** The repair turn for {@link uncalledRequiredTools}: names the tools, then the step again. */
+export function requiredToolsRepairInstruction(uncalled, instruction) {
+    const listed = uncalled.map((t) => `- ${t}`).join("\n");
+    return (`This step requires these tools, and your previous attempt finished without calling them:\n${listed}\n\n` +
+        `Do the step again: call each listed tool, use what it returns, then return the complete output.` +
+        `\n\n---\n\n${instruction}`);
+}
 /** The output fields of `nodeId` that some `{ expr }` in the workflow reads. */
 function routingFieldsOf(workflow, nodeId) {
     const out = new Set();

package/dist/harness/claude-code.d.ts

@@ -34,11 +34,12 @@ export declare const CLASSIFICATION_DISALLOWED_TOOLS: readonly ["Bash", "Write",
 /**
  * Built-in tools disallowed for a node run with `readOnly: true` (dry run,
  * #380): everything that can edit the workspace, shell out (and so reach
- * `gh`, `curl`, `git push`), spawn a subagent that could, or fetch an
- * arbitrary URL (a GET can still trigger a webhook or exfiltrate data).
- * Read, Grep, Glob and WebSearch stay available for analysis.
+ * `gh`, `curl`, `git push`), spawn a subagent that could, fetch an arbitrary
+ * URL (a GET can still trigger a webhook or exfiltrate data) or search the web
+ * (a query is an egress channel that can carry repo data out). Read, Grep and
+ * Glob stay available for analysis.
  */
-export declare const READ_ONLY_DISALLOWED_TOOLS: readonly ["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit", "Task", "Agent", "WebFetch"];
+export declare const READ_ONLY_DISALLOWED_TOOLS: readonly ["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit", "Task", "Agent", "WebFetch", "WebSearch"];
 /**
  * Claude Code built-in tool names per portable tool class. A node's
  * `tools.deny` classes compile to these names on `disallowedTools`.
@@ -71,6 +72,40 @@ export declare function claudeReadDenyRule(absPath: string): string;
 export declare function claudeStateDirDenyRules(root?: string): string[];
 /** Native `disallowedTools` for a policy: legacy names, compiled classes, and the read-only set. */
 export declare function compileClaudeCodeDeny(policy: NodePolicy, legacy?: readonly string[]): string[];
+/**
+ * The only Claude Code built-in tools a node may get, by policy. Every node
+ * reads and searches the checkout, and a read-only node gets nothing else: no
+ * web search or fetch, since either can carry repo data out. A write node adds
+ * the shell, file-edit and web built-ins (its `tools.deny` classes and
+ * `disallowed_tools` names then leave the list). No node gets the subagent
+ * tools (Task, Agent) by default: nothing shows a subagent is held to its
+ * parent's `tools`, so the default must not depend on it.
+ *
+ * Passed as the SDK's `tools` option, which "Specif[ies] the base set of
+ * available built-in tools" (sdk.d.ts); `allowedTools` only auto-approves
+ * ("To restrict which tools are available, use the `tools` option instead").
+ * Anything not named here never reaches a node: agent-to-agent messaging
+ * (SendMessage, ListAgents), scheduling (Cron*, ScheduleWakeup), remote
+ * triggers, notifications, worktrees, design sync, Skill, Workflow and
+ * ToolSearch (added back only while a server defers its tools, see
+ * {@link runQuery}). Dogfood run 42890468912 listed 23 tools for a read-only
+ * node that needed two.
+ */
+export declare const CLAUDE_READ_ONLY_BUILTIN_TOOLS: readonly ["Read", "Grep", "Glob"];
+export declare const CLAUDE_WRITE_BUILTIN_TOOLS: readonly ["Read", "Grep", "Glob", ...string[]];
+/**
+ * The built-in allow-list for one node: the policy's list minus every name the
+ * compiled deny list removes. Path-scoped rules (`Read(//dir/**)`) narrow a
+ * tool, they do not remove it, so they are not matched here.
+ */
+export declare function claudeCodeBuiltinTools(policy: {
+    readOnly: boolean;
+}, deny?: readonly string[]): string[];
+/**
+ * Env vars the harness itself sets on the agent (not passed through from the
+ * parent): `ENABLE_TOOL_SEARCH`, see {@link ClaudeCodeHarness} runQuery.
+ */
+export declare const CLAUDE_CODE_HARNESS_VARS: readonly ["ENABLE_TOOL_SEARCH"];
 /** How sweny resolves which credentials reach the Claude Code subprocess. */
 export type SwenyAuthMode = "auto" | "api-key" | "oauth";
 export interface ResolveAuthEnvOpts {

package/dist/harness/claude-code.js

@@ -68,9 +68,10 @@ export const CLASSIFICATION_DISALLOWED_TOOLS = [
 /**
  * Built-in tools disallowed for a node run with `readOnly: true` (dry run,
  * #380): everything that can edit the workspace, shell out (and so reach
- * `gh`, `curl`, `git push`), spawn a subagent that could, or fetch an
- * arbitrary URL (a GET can still trigger a webhook or exfiltrate data).
- * Read, Grep, Glob and WebSearch stay available for analysis.
+ * `gh`, `curl`, `git push`), spawn a subagent that could, fetch an arbitrary
+ * URL (a GET can still trigger a webhook or exfiltrate data) or search the web
+ * (a query is an egress channel that can carry repo data out). Read, Grep and
+ * Glob stay available for analysis.
  */
 export const READ_ONLY_DISALLOWED_TOOLS = [
     "Bash",
@@ -81,6 +82,7 @@ export const READ_ONLY_DISALLOWED_TOOLS = [
     "Task",
     "Agent",
     "WebFetch",
+    "WebSearch",
 ];
 /**
  * Claude Code built-in tool names per portable tool class. A node's
@@ -146,6 +148,55 @@ export function compileClaudeCodeDeny(policy, legacy = []) {
         ]),
     ];
 }
+/**
+ * The only Claude Code built-in tools a node may get, by policy. Every node
+ * reads and searches the checkout, and a read-only node gets nothing else: no
+ * web search or fetch, since either can carry repo data out. A write node adds
+ * the shell, file-edit and web built-ins (its `tools.deny` classes and
+ * `disallowed_tools` names then leave the list). No node gets the subagent
+ * tools (Task, Agent) by default: nothing shows a subagent is held to its
+ * parent's `tools`, so the default must not depend on it.
+ *
+ * Passed as the SDK's `tools` option, which "Specif[ies] the base set of
+ * available built-in tools" (sdk.d.ts); `allowedTools` only auto-approves
+ * ("To restrict which tools are available, use the `tools` option instead").
+ * Anything not named here never reaches a node: agent-to-agent messaging
+ * (SendMessage, ListAgents), scheduling (Cron*, ScheduleWakeup), remote
+ * triggers, notifications, worktrees, design sync, Skill, Workflow and
+ * ToolSearch (added back only while a server defers its tools, see
+ * {@link runQuery}). Dogfood run 42890468912 listed 23 tools for a read-only
+ * node that needed two.
+ */
+export const CLAUDE_READ_ONLY_BUILTIN_TOOLS = ["Read", "Grep", "Glob"];
+export const CLAUDE_WRITE_BUILTIN_TOOLS = [
+    "Read",
+    "Grep",
+    "Glob",
+    ...CLAUDE_TOOLS_BY_CLASS.shell,
+    ...CLAUDE_TOOLS_BY_CLASS.write,
+    ...CLAUDE_TOOLS_BY_CLASS.edit,
+    ...CLAUDE_TOOLS_BY_CLASS.net,
+];
+/**
+ * The built-in allow-list for one node: the policy's list minus every name the
+ * compiled deny list removes. Path-scoped rules (`Read(//dir/**)`) narrow a
+ * tool, they do not remove it, so they are not matched here.
+ */
+export function claudeCodeBuiltinTools(policy, deny = []) {
+    const denied = new Set(deny);
+    const base = policy.readOnly ? CLAUDE_READ_ONLY_BUILTIN_TOOLS : CLAUDE_WRITE_BUILTIN_TOOLS;
+    return base.filter((t) => !denied.has(t));
+}
+/**
+ * Env vars the harness itself sets on the agent (not passed through from the
+ * parent): `ENABLE_TOOL_SEARCH`, see {@link ClaudeCodeHarness} runQuery.
+ */
+export const CLAUDE_CODE_HARNESS_VARS = ["ENABLE_TOOL_SEARCH"];
+/** CI: a truthy `CI` (not "", "0", "false", "no", "off"), or GitHub Actions itself. */
+function runningInCi(env = process.env) {
+    const ci = (env.CI ?? "").trim().toLowerCase();
+    return env.GITHUB_ACTIONS === "true" || !["", "0", "false", "no", "off"].includes(ci);
+}
 /**
  * Decide which auth credentials survive into the Claude Code subprocess env.
  *
@@ -562,6 +613,8 @@ export class ClaudeCodeHarness {
         // Fail closed: a stream that ends with no terminal `result` message
         // (subprocess died, stream truncated) is not a success.
         let sawResult = false;
+        // The tool names the agent was given (init message), for the executor's repair rule.
+        let agentTools;
         // Timeout / abort wiring (back-compat: only armed when requested).
         // A single AbortController drives both an optional caller signal and an
         // optional timeout timer. The SDK aborts the subprocess when this fires.
@@ -596,6 +649,20 @@ export class ClaudeCodeHarness {
             else if (sdkTools.length > 0) {
                 allMcpServers["sweny-core"] = mcpServer;
             }
+            // Deterministic tool loading: when every server loads its tools up front
+            // (sweny-core always does; a node's skill servers do unless they opt out),
+            // tool search has nothing to defer, so it is off and ToolSearch is not on
+            // the list. `ENABLE_TOOL_SEARCH=false` is the bundled CLI's switch (its
+            // own docs: "To turn it off ... set `ENABLE_TOOL_SEARCH` to `false`"; CLI
+            // 0.3.319 drops ToolSearch from the init tool list with it). A client-level
+            // server not marked alwaysLoad keeps tool search, and ToolSearch, so its
+            // deferred tools stay reachable.
+            const defers = Object.entries(allMcpServers).some(([name, cfg]) => name !== "sweny-core" && cfg?.alwaysLoad !== true);
+            if (!defers)
+                env.ENABLE_TOOL_SEARCH = "false";
+            const builtinTools = opts.nativeNone
+                ? []
+                : [...claudeCodeBuiltinTools({ readOnly: !!readOnly }, disallowedTools), ...(defers ? ["ToolSearch"] : [])];
             stream = query({
                 prompt,
                 options: {
@@ -622,10 +689,13 @@ export class ClaudeCodeHarness {
                     strictMcpConfig: true,
                     settingSources: [],
                     ...(disallowedTools && disallowedTools.length > 0 ? { disallowedTools } : {}),
-                    // permissions.native: none. `tools: []` removes every built-in tool whatever its
-                    // name; `settingSources: []` loads no user, project or local settings, CLAUDE.md or skills
-                    // (already the default above since #497; kept so the policy value states its whole contract).
-                    ...(opts.nativeNone ? { tools: [], settingSources: [] } : {}),
+                    // Least privilege: only the built-ins this node's policy names (see
+                    // CLAUDE_WRITE_BUILTIN_TOOLS). permissions.native: none passes `tools: []`,
+                    // which removes every built-in tool whatever its name.
+                    tools: builtinTools,
+                    // `settingSources: []` loads no user, project or local settings, CLAUDE.md or skills
+                    // (already the default above since #497; kept so native: none states its whole contract).
+                    ...(opts.nativeNone ? { settingSources: [] } : {}),
                     // CC-08: ask the SDK to produce validated structured output when the
                     // node declares an output schema. The SDK then returns the parsed
                     // value on `result.structured_output`, which we prefer over the
@@ -635,11 +705,27 @@ export class ClaudeCodeHarness {
             });
             for await (const message of stream) {
                 if (message.type === "system" && message.subtype === "init") {
-                    // What the agent was actually given: the tool list (--verbose) and,
-                    // loudly, a node tool server that did not come up.
+                    // What the agent was actually given: the tool names (never inputs)
+                    // and, loudly, a node tool or tool server that did not make it onto
+                    // the list. In CI the names go out as one warning-level line, the
+                    // level the default (non-verbose) run log shows, so a failed node is
+                    // diagnosable without a verbose rerun; locally they stay at info.
                     const init = message;
-                    if (Array.isArray(init.tools))
-                        this.logger.debug(`  agent tools: ${init.tools.join(", ")}`);
+                    if (Array.isArray(init.tools)) {
+                        agentTools = init.tools.filter((t) => typeof t === "string");
+                        const line = `  agent tools: ${init.tools.join(", ")}`;
+                        if (runningInCi())
+                            this.logger.warn(line);
+                        else
+                            this.logger.info(line);
+                        const listed = new Set(init.tools);
+                        const absent = allMcpServers["sweny-core"]
+                            ? tools.map((t) => t.name).filter((n) => !listed.has(`mcp__sweny-core__${n}`))
+                            : [];
+                        if (absent.length > 0) {
+                            this.logger.warn(`  node tools missing from the agent's tool list: ${absent.join(", ")}`);
+                        }
+                    }
                     const core = Array.isArray(init.mcp_servers)
                         ? init.mcp_servers.find((s) => s?.name === "sweny-core")
                         : undefined;
@@ -833,6 +919,7 @@ export class ClaudeCodeHarness {
             data: { summary: response, ...parsedData },
             toolCalls,
             ...(usage ? { usage } : {}),
+            ...(agentTools ? { agentTools } : {}),
         };
     }
     /**

package/dist/harness/types.d.ts

@@ -152,6 +152,14 @@ export interface HarnessRunRequest extends ClaudeRunRequest {
 export interface HarnessRunResult extends NodeResult {
     harness: HarnessInfo;
     degraded: string[];
+    /**
+     * Names of every tool the agent was given for this run, as the agent itself
+     * listed them (Claude Code: the init message; MCP tools as
+     * `mcp__<server>__<tool>`). The executor repairs a skipped required tool
+     * only when it is on this list. Absent when the harness does not report it,
+     * and then no such repair happens. Never journaled.
+     */
+    agentTools?: string[];
 }
 export interface HarnessCompleteRequest {
     prompt: string;

package/dist/schema.d.ts

@@ -1035,7 +1035,7 @@ export declare function parseWorkflow(raw: unknown): {
     } | undefined;
 };
 export interface WorkflowError {
-    code: "MISSING_ENTRY" | "UNKNOWN_EDGE_SOURCE" | "UNKNOWN_EDGE_TARGET" | "UNREACHABLE_NODE" | "UNKNOWN_SKILL" | "SELF_LOOP" | "UNBOUNDED_CYCLE" | "AMBIGUOUS_EDGES" | "UNSUPPORTED_EVAL_POLICY" | "INVALID_INLINE_SKILL" | "EDGE_ITERATIONS_EXCEEDED" | "RETRY_MAX_EXCEEDED" | "PERMISSION_CEILING" | "AGENT_ENV_READ_ONLY" | "BUDGET_CEILING" | "OUTPUT_NOT_ALLOWED" | "DUPLICATE_OUTPUT" | "UNSUPPORTED_OUTPUT" | "INVALID_WHEN_EXPRESSION" | "MIXED_EDGE_CONDITIONS" | "DUPLICATE_EDGE";
+    code: "MISSING_ENTRY" | "UNKNOWN_EDGE_SOURCE" | "UNKNOWN_EDGE_TARGET" | "UNREACHABLE_NODE" | "UNKNOWN_SKILL" | "SELF_LOOP" | "UNBOUNDED_CYCLE" | "AMBIGUOUS_EDGES" | "UNSUPPORTED_EVAL_POLICY" | "DUPLICATE_EVALUATOR" | "INVALID_INLINE_SKILL" | "EDGE_ITERATIONS_EXCEEDED" | "RETRY_MAX_EXCEEDED" | "PERMISSION_CEILING" | "AGENT_ENV_READ_ONLY" | "BUDGET_CEILING" | "OUTPUT_NOT_ALLOWED" | "DUPLICATE_OUTPUT" | "UNSUPPORTED_OUTPUT" | "INVALID_WHEN_EXPRESSION" | "MIXED_EDGE_CONDITIONS" | "DUPLICATE_EDGE";
     message: string;
     nodeId?: string;
 }

package/dist/schema.js

@@ -710,6 +710,22 @@ export function validateWorkflow(workflow, knownSkills) {
             });
         }
     }
+    // Evaluator names are a node's eval keys: results, retry preambles, routes
+    // (`node.evals.<name>.pass`) and the required-tool repair look a verdict up
+    // by name, so two evaluators with one name would make that lookup ambiguous.
+    for (const [nodeId, node] of Object.entries(workflow.nodes)) {
+        const seen = new Set();
+        for (const e of node.eval ?? []) {
+            if (seen.has(e.name)) {
+                errors.push({
+                    code: "DUPLICATE_EVALUATOR",
+                    message: `Node "${nodeId}" declares two evaluators named "${e.name}"; evaluator names must be unique within a node`,
+                    nodeId,
+                });
+            }
+            seen.add(e.name);
+        }
+    }
     // Inline skills need usage instructions; the engine server name is reserved.
     for (const [skillId, def] of Object.entries(workflow.skills ?? {})) {
         if (!def.instruction?.trim()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.208",
+  "version": "0.1.210",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"