@sweny-ai/core 0.1.209 → 0.1.210

package/dist/executor.d.ts

@@ -12,7 +12,8 @@
  *
  * This replaces ~8k lines of engine + recipe step code.
  */
-import type { Workflow, Node, Skill, Tool, Claude, Observer, NodeResult, Logger, ExecutionResult, JSONSchema } from "./types.js";
+import type { Workflow, Node, Skill, Tool, Claude, Observer, NodeResult, Logger, ExecutionResult, JSONSchema, EvalResult, Evaluator, ToolCall } from "./types.js";
+import type { ToolAliases } from "./eval/index.js";
 import type { HarnessPolicyMode } from "./harness/policy.js";
 import type { AgentHarness } from "./harness/types.js";
 import type { DeciderOperatorConfig } from "./decider.js";
@@ -190,6 +191,20 @@ export declare const COUNT_OF_KEYWORD = "x-sweny-count-of";
  * nested shapes and additionalProperties stay the author's concern.
  */
 export declare function outputContractProblems(data: unknown, output: JSONSchema | undefined): ContractProblem[];
+/**
+ * Required tools the agent never called, when that is the only reason a node
+ * failed its evals and another turn could call them: every failure is a
+ * `function` evaluator, none saw a forbidden call, every required tool it names
+ * is absent from the trace (not called and failed: that is the retry path's
+ * job), and every one is reachable, i.e. on `agentTools`, the tool list the
+ * harness reported for the run, by its own name or an alias (an MCP tool
+ * counts by its bare name). Empty otherwise, and empty when the harness
+ * reported no list. An `any_tool_called` set needs one reachable member and
+ * reads "one of a, b" over its reachable members.
+ */
+export declare function uncalledRequiredTools(evaluators: Evaluator[] | undefined, failures: EvalResult[], toolCalls: ToolCall[], agentTools: readonly string[] | undefined, aliases?: ToolAliases): string[];
+/** The repair turn for {@link uncalledRequiredTools}: names the tools, then the step again. */
+export declare function requiredToolsRepairInstruction(uncalled: string[], instruction: string): string;
 /**
  * Dry-run tool gate (#380). Only an explicit `access: "read"` passes; a tool
  * with no `access` is treated as a write so new tools fail safe.

package/dist/executor.js

@@ -15,6 +15,7 @@
 import { consoleLogger } from "./types.js";
 import { resolveSources } from "./source-resolver.js";
 import { evaluateAll, aggregateEval } from "./eval/index.js";
+import { checkAllToolsCalled, checkAnyToolCalled, checkNoToolCalled } from "./eval/function.js";
 import { evaluateRequires } from "./requires.js";
 import { evaluateExpression, isWhenExpression, parseExpression, whenLabel } from "./when.js";
 import { buildRetryPreamble } from "./retry.js";
@@ -602,6 +603,8 @@ async function executeRun(workflow, input, options, results, trace, at) {
         let currentInstruction = instruction;
         // One structured-output repair per visit (#357), before any eval retry.
         let repaired = false;
+        // One required-tool repair per visit, before any eval retry.
+        let toolRepaired = false;
         const retry = node.retry;
         // Per-node execution model: node.model ?? workflow.model. When undefined,
         // claude.run falls back to its own client default (then Claude Code's).
@@ -723,8 +726,8 @@ async function executeRun(workflow, input, options, results, trace, at) {
             // Resume (#363): spend is journaled as it is reported, so a crash mid-node
             // does not hand the resumed run a fresh budget.
             const usageNode = currentId;
-            // The repair call (at most one) shifts later attempts by one, so every agent call has its own key.
-            const usageAttempt = attempt + (repaired ? 1 : 0);
+            // Each repair call (at most one of each) shifts later attempts by one, so every agent call has its own key.
+            const usageAttempt = attempt + (repaired ? 1 : 0) + (toolRepaired ? 1 : 0);
             let liveUsage;
             // A live usage record the journal cannot write stops the agent at once:
             // its spend would be invisible to a resume.
@@ -957,6 +960,30 @@ async function executeRun(workflow, input, options, results, trace, at) {
             }
             if (outcome.pass)
                 break;
+            // Required tools: a node whose only failures are `function` evals naming
+            // tools its agent never called, all of them on the tool list the harness
+            // says the agent had, gets one repair turn that names them, before any
+            // eval retry. Same footing as the output contract repair: part
+            // of this visit (no extra max_steps slot), its spend counted. Agents
+            // sometimes answer on turn 1 without the tools they were given (dogfood
+            // run 42890245104: `called: [StructuredOutput]`).
+            const uncalled = toolRepaired
+                ? []
+                : uncalledRequiredTools(node.eval, outcome.failures, result.toolCalls, result.agentTools, toolAliases);
+            if (uncalled.length > 0) {
+                toolRepaired = true;
+                logger.warn(`  required tools not called: ${uncalled.join(", ")}; asking the agent once to call them`, {
+                    node: currentId,
+                });
+                safeObserve(observer, {
+                    type: "node:warning",
+                    node: currentId,
+                    reason: "required tools not called; one repair attempt",
+                    fields: uncalled,
+                }, logger);
+                currentInstruction = requiredToolsRepairInstruction(uncalled, currentInstruction);
+                continue;
+            }
             // Apply the failure to the result.
             result.status = "failed";
             result.data = { ...result.data, error: outcome.error };
@@ -1599,6 +1626,62 @@ export function outputContractProblems(data, output) {
     }
     return problems;
 }
+/**
+ * Required tools the agent never called, when that is the only reason a node
+ * failed its evals and another turn could call them: every failure is a
+ * `function` evaluator, none saw a forbidden call, every required tool it names
+ * is absent from the trace (not called and failed: that is the retry path's
+ * job), and every one is reachable, i.e. on `agentTools`, the tool list the
+ * harness reported for the run, by its own name or an alias (an MCP tool
+ * counts by its bare name). Empty otherwise, and empty when the harness
+ * reported no list. An `any_tool_called` set needs one reachable member and
+ * reads "one of a, b" over its reachable members.
+ */
+export function uncalledRequiredTools(evaluators, failures, toolCalls, agentTools, aliases) {
+    if (!agentTools)
+        return [];
+    const listed = new Set(agentTools.map(bareToolName));
+    const reachable = (name) => listed.has(name) || [...(aliases?.get(name) ?? [])].some((a) => listed.has(a));
+    const uncalled = [];
+    // A call to any of these (by name or alias), successful or not.
+    const invoked = (names) => checkNoToolCalled(names, toolCalls, aliases) !== null;
+    for (const failure of failures) {
+        const rule = failure.kind === "function"
+            ? evaluators?.find((e) => e.kind === "function" && e.name === failure.name)?.rule
+            : undefined;
+        if (!rule)
+            return [];
+        if (rule.no_tool_called && rule.no_tool_called.length > 0 && invoked(rule.no_tool_called))
+            return [];
+        for (const name of rule.all_tools_called ?? []) {
+            if (checkAllToolsCalled([name], toolCalls, aliases) === null)
+                continue;
+            if (invoked([name]) || !reachable(name))
+                return [];
+            uncalled.push(name);
+        }
+        const any = rule.any_tool_called ?? [];
+        if (any.length > 0 && checkAnyToolCalled(any, toolCalls, aliases) !== null) {
+            const open = any.filter(reachable);
+            if (invoked(any) || open.length === 0)
+                return [];
+            uncalled.push(open.length === 1 ? open[0] : `one of ${open.join(", ")}`);
+        }
+    }
+    return [...new Set(uncalled)];
+}
+/** `mcp__<server>__<tool>` → `<tool>`; any other name unchanged. Tool calls are recorded the same way. */
+function bareToolName(name) {
+    const parts = name.split("__");
+    return parts.length >= 3 && parts[0] === "mcp" ? parts.slice(2).join("__") : name;
+}
+/** The repair turn for {@link uncalledRequiredTools}: names the tools, then the step again. */
+export function requiredToolsRepairInstruction(uncalled, instruction) {
+    const listed = uncalled.map((t) => `- ${t}`).join("\n");
+    return (`This step requires these tools, and your previous attempt finished without calling them:\n${listed}\n\n` +
+        `Do the step again: call each listed tool, use what it returns, then return the complete output.` +
+        `\n\n---\n\n${instruction}`);
+}
 /** The output fields of `nodeId` that some `{ expr }` in the workflow reads. */
 function routingFieldsOf(workflow, nodeId) {
     const out = new Set();

package/dist/harness/claude-code.d.ts

@@ -34,11 +34,12 @@ export declare const CLASSIFICATION_DISALLOWED_TOOLS: readonly ["Bash", "Write",
 /**
  * Built-in tools disallowed for a node run with `readOnly: true` (dry run,
  * #380): everything that can edit the workspace, shell out (and so reach
- * `gh`, `curl`, `git push`), spawn a subagent that could, or fetch an
- * arbitrary URL (a GET can still trigger a webhook or exfiltrate data).
- * Read, Grep, Glob and WebSearch stay available for analysis.
+ * `gh`, `curl`, `git push`), spawn a subagent that could, fetch an arbitrary
+ * URL (a GET can still trigger a webhook or exfiltrate data) or search the web
+ * (a query is an egress channel that can carry repo data out). Read, Grep and
+ * Glob stay available for analysis.
  */
-export declare const READ_ONLY_DISALLOWED_TOOLS: readonly ["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit", "Task", "Agent", "WebFetch"];
+export declare const READ_ONLY_DISALLOWED_TOOLS: readonly ["Bash", "Write", "Edit", "MultiEdit", "NotebookEdit", "Task", "Agent", "WebFetch", "WebSearch"];
 /**
  * Claude Code built-in tool names per portable tool class. A node's
  * `tools.deny` classes compile to these names on `disallowedTools`.
@@ -71,6 +72,40 @@ export declare function claudeReadDenyRule(absPath: string): string;
 export declare function claudeStateDirDenyRules(root?: string): string[];
 /** Native `disallowedTools` for a policy: legacy names, compiled classes, and the read-only set. */
 export declare function compileClaudeCodeDeny(policy: NodePolicy, legacy?: readonly string[]): string[];
+/**
+ * The only Claude Code built-in tools a node may get, by policy. Every node
+ * reads and searches the checkout, and a read-only node gets nothing else: no
+ * web search or fetch, since either can carry repo data out. A write node adds
+ * the shell, file-edit and web built-ins (its `tools.deny` classes and
+ * `disallowed_tools` names then leave the list). No node gets the subagent
+ * tools (Task, Agent) by default: nothing shows a subagent is held to its
+ * parent's `tools`, so the default must not depend on it.
+ *
+ * Passed as the SDK's `tools` option, which "Specif[ies] the base set of
+ * available built-in tools" (sdk.d.ts); `allowedTools` only auto-approves
+ * ("To restrict which tools are available, use the `tools` option instead").
+ * Anything not named here never reaches a node: agent-to-agent messaging
+ * (SendMessage, ListAgents), scheduling (Cron*, ScheduleWakeup), remote
+ * triggers, notifications, worktrees, design sync, Skill, Workflow and
+ * ToolSearch (added back only while a server defers its tools, see
+ * {@link runQuery}). Dogfood run 42890468912 listed 23 tools for a read-only
+ * node that needed two.
+ */
+export declare const CLAUDE_READ_ONLY_BUILTIN_TOOLS: readonly ["Read", "Grep", "Glob"];
+export declare const CLAUDE_WRITE_BUILTIN_TOOLS: readonly ["Read", "Grep", "Glob", ...string[]];
+/**
+ * The built-in allow-list for one node: the policy's list minus every name the
+ * compiled deny list removes. Path-scoped rules (`Read(//dir/**)`) narrow a
+ * tool, they do not remove it, so they are not matched here.
+ */
+export declare function claudeCodeBuiltinTools(policy: {
+    readOnly: boolean;
+}, deny?: readonly string[]): string[];
+/**
+ * Env vars the harness itself sets on the agent (not passed through from the
+ * parent): `ENABLE_TOOL_SEARCH`, see {@link ClaudeCodeHarness} runQuery.
+ */
+export declare const CLAUDE_CODE_HARNESS_VARS: readonly ["ENABLE_TOOL_SEARCH"];
 /** How sweny resolves which credentials reach the Claude Code subprocess. */
 export type SwenyAuthMode = "auto" | "api-key" | "oauth";
 export interface ResolveAuthEnvOpts {

package/dist/harness/claude-code.js

@@ -68,9 +68,10 @@ export const CLASSIFICATION_DISALLOWED_TOOLS = [
 /**
  * Built-in tools disallowed for a node run with `readOnly: true` (dry run,
  * #380): everything that can edit the workspace, shell out (and so reach
- * `gh`, `curl`, `git push`), spawn a subagent that could, or fetch an
- * arbitrary URL (a GET can still trigger a webhook or exfiltrate data).
- * Read, Grep, Glob and WebSearch stay available for analysis.
+ * `gh`, `curl`, `git push`), spawn a subagent that could, fetch an arbitrary
+ * URL (a GET can still trigger a webhook or exfiltrate data) or search the web
+ * (a query is an egress channel that can carry repo data out). Read, Grep and
+ * Glob stay available for analysis.
  */
 export const READ_ONLY_DISALLOWED_TOOLS = [
     "Bash",
@@ -81,6 +82,7 @@ export const READ_ONLY_DISALLOWED_TOOLS = [
     "Task",
     "Agent",
     "WebFetch",
+    "WebSearch",
 ];
 /**
  * Claude Code built-in tool names per portable tool class. A node's
@@ -146,6 +148,55 @@ export function compileClaudeCodeDeny(policy, legacy = []) {
         ]),
     ];
 }
+/**
+ * The only Claude Code built-in tools a node may get, by policy. Every node
+ * reads and searches the checkout, and a read-only node gets nothing else: no
+ * web search or fetch, since either can carry repo data out. A write node adds
+ * the shell, file-edit and web built-ins (its `tools.deny` classes and
+ * `disallowed_tools` names then leave the list). No node gets the subagent
+ * tools (Task, Agent) by default: nothing shows a subagent is held to its
+ * parent's `tools`, so the default must not depend on it.
+ *
+ * Passed as the SDK's `tools` option, which "Specif[ies] the base set of
+ * available built-in tools" (sdk.d.ts); `allowedTools` only auto-approves
+ * ("To restrict which tools are available, use the `tools` option instead").
+ * Anything not named here never reaches a node: agent-to-agent messaging
+ * (SendMessage, ListAgents), scheduling (Cron*, ScheduleWakeup), remote
+ * triggers, notifications, worktrees, design sync, Skill, Workflow and
+ * ToolSearch (added back only while a server defers its tools, see
+ * {@link runQuery}). Dogfood run 42890468912 listed 23 tools for a read-only
+ * node that needed two.
+ */
+export const CLAUDE_READ_ONLY_BUILTIN_TOOLS = ["Read", "Grep", "Glob"];
+export const CLAUDE_WRITE_BUILTIN_TOOLS = [
+    "Read",
+    "Grep",
+    "Glob",
+    ...CLAUDE_TOOLS_BY_CLASS.shell,
+    ...CLAUDE_TOOLS_BY_CLASS.write,
+    ...CLAUDE_TOOLS_BY_CLASS.edit,
+    ...CLAUDE_TOOLS_BY_CLASS.net,
+];
+/**
+ * The built-in allow-list for one node: the policy's list minus every name the
+ * compiled deny list removes. Path-scoped rules (`Read(//dir/**)`) narrow a
+ * tool, they do not remove it, so they are not matched here.
+ */
+export function claudeCodeBuiltinTools(policy, deny = []) {
+    const denied = new Set(deny);
+    const base = policy.readOnly ? CLAUDE_READ_ONLY_BUILTIN_TOOLS : CLAUDE_WRITE_BUILTIN_TOOLS;
+    return base.filter((t) => !denied.has(t));
+}
+/**
+ * Env vars the harness itself sets on the agent (not passed through from the
+ * parent): `ENABLE_TOOL_SEARCH`, see {@link ClaudeCodeHarness} runQuery.
+ */
+export const CLAUDE_CODE_HARNESS_VARS = ["ENABLE_TOOL_SEARCH"];
+/** CI: a truthy `CI` (not "", "0", "false", "no", "off"), or GitHub Actions itself. */
+function runningInCi(env = process.env) {
+    const ci = (env.CI ?? "").trim().toLowerCase();
+    return env.GITHUB_ACTIONS === "true" || !["", "0", "false", "no", "off"].includes(ci);
+}
 /**
  * Decide which auth credentials survive into the Claude Code subprocess env.
  *
@@ -562,6 +613,8 @@ export class ClaudeCodeHarness {
         // Fail closed: a stream that ends with no terminal `result` message
         // (subprocess died, stream truncated) is not a success.
         let sawResult = false;
+        // The tool names the agent was given (init message), for the executor's repair rule.
+        let agentTools;
         // Timeout / abort wiring (back-compat: only armed when requested).
         // A single AbortController drives both an optional caller signal and an
         // optional timeout timer. The SDK aborts the subprocess when this fires.
@@ -596,6 +649,20 @@ export class ClaudeCodeHarness {
             else if (sdkTools.length > 0) {
                 allMcpServers["sweny-core"] = mcpServer;
             }
+            // Deterministic tool loading: when every server loads its tools up front
+            // (sweny-core always does; a node's skill servers do unless they opt out),
+            // tool search has nothing to defer, so it is off and ToolSearch is not on
+            // the list. `ENABLE_TOOL_SEARCH=false` is the bundled CLI's switch (its
+            // own docs: "To turn it off ... set `ENABLE_TOOL_SEARCH` to `false`"; CLI
+            // 0.3.319 drops ToolSearch from the init tool list with it). A client-level
+            // server not marked alwaysLoad keeps tool search, and ToolSearch, so its
+            // deferred tools stay reachable.
+            const defers = Object.entries(allMcpServers).some(([name, cfg]) => name !== "sweny-core" && cfg?.alwaysLoad !== true);
+            if (!defers)
+                env.ENABLE_TOOL_SEARCH = "false";
+            const builtinTools = opts.nativeNone
+                ? []
+                : [...claudeCodeBuiltinTools({ readOnly: !!readOnly }, disallowedTools), ...(defers ? ["ToolSearch"] : [])];
             stream = query({
                 prompt,
                 options: {
@@ -622,10 +689,13 @@ export class ClaudeCodeHarness {
                     strictMcpConfig: true,
                     settingSources: [],
                     ...(disallowedTools && disallowedTools.length > 0 ? { disallowedTools } : {}),
-                    // permissions.native: none. `tools: []` removes every built-in tool whatever its
-                    // name; `settingSources: []` loads no user, project or local settings, CLAUDE.md or skills
-                    // (already the default above since #497; kept so the policy value states its whole contract).
-                    ...(opts.nativeNone ? { tools: [], settingSources: [] } : {}),
+                    // Least privilege: only the built-ins this node's policy names (see
+                    // CLAUDE_WRITE_BUILTIN_TOOLS). permissions.native: none passes `tools: []`,
+                    // which removes every built-in tool whatever its name.
+                    tools: builtinTools,
+                    // `settingSources: []` loads no user, project or local settings, CLAUDE.md or skills
+                    // (already the default above since #497; kept so native: none states its whole contract).
+                    ...(opts.nativeNone ? { settingSources: [] } : {}),
                     // CC-08: ask the SDK to produce validated structured output when the
                     // node declares an output schema. The SDK then returns the parsed
                     // value on `result.structured_output`, which we prefer over the
@@ -635,11 +705,27 @@ export class ClaudeCodeHarness {
             });
             for await (const message of stream) {
                 if (message.type === "system" && message.subtype === "init") {
-                    // What the agent was actually given: the tool list (--verbose) and,
-                    // loudly, a node tool server that did not come up.
+                    // What the agent was actually given: the tool names (never inputs)
+                    // and, loudly, a node tool or tool server that did not make it onto
+                    // the list. In CI the names go out as one warning-level line, the
+                    // level the default (non-verbose) run log shows, so a failed node is
+                    // diagnosable without a verbose rerun; locally they stay at info.
                     const init = message;
-                    if (Array.isArray(init.tools))
-                        this.logger.debug(`  agent tools: ${init.tools.join(", ")}`);
+                    if (Array.isArray(init.tools)) {
+                        agentTools = init.tools.filter((t) => typeof t === "string");
+                        const line = `  agent tools: ${init.tools.join(", ")}`;
+                        if (runningInCi())
+                            this.logger.warn(line);
+                        else
+                            this.logger.info(line);
+                        const listed = new Set(init.tools);
+                        const absent = allMcpServers["sweny-core"]
+                            ? tools.map((t) => t.name).filter((n) => !listed.has(`mcp__sweny-core__${n}`))
+                            : [];
+                        if (absent.length > 0) {
+                            this.logger.warn(`  node tools missing from the agent's tool list: ${absent.join(", ")}`);
+                        }
+                    }
                     const core = Array.isArray(init.mcp_servers)
                         ? init.mcp_servers.find((s) => s?.name === "sweny-core")
                         : undefined;
@@ -833,6 +919,7 @@ export class ClaudeCodeHarness {
             data: { summary: response, ...parsedData },
             toolCalls,
             ...(usage ? { usage } : {}),
+            ...(agentTools ? { agentTools } : {}),
         };
     }
     /**

package/dist/harness/types.d.ts

@@ -152,6 +152,14 @@ export interface HarnessRunRequest extends ClaudeRunRequest {
 export interface HarnessRunResult extends NodeResult {
     harness: HarnessInfo;
     degraded: string[];
+    /**
+     * Names of every tool the agent was given for this run, as the agent itself
+     * listed them (Claude Code: the init message; MCP tools as
+     * `mcp__<server>__<tool>`). The executor repairs a skipped required tool
+     * only when it is on this list. Absent when the harness does not report it,
+     * and then no such repair happens. Never journaled.
+     */
+    agentTools?: string[];
 }
 export interface HarnessCompleteRequest {
     prompt: string;

package/dist/schema.d.ts

@@ -1035,7 +1035,7 @@ export declare function parseWorkflow(raw: unknown): {
     } | undefined;
 };
 export interface WorkflowError {
-    code: "MISSING_ENTRY" | "UNKNOWN_EDGE_SOURCE" | "UNKNOWN_EDGE_TARGET" | "UNREACHABLE_NODE" | "UNKNOWN_SKILL" | "SELF_LOOP" | "UNBOUNDED_CYCLE" | "AMBIGUOUS_EDGES" | "UNSUPPORTED_EVAL_POLICY" | "INVALID_INLINE_SKILL" | "EDGE_ITERATIONS_EXCEEDED" | "RETRY_MAX_EXCEEDED" | "PERMISSION_CEILING" | "AGENT_ENV_READ_ONLY" | "BUDGET_CEILING" | "OUTPUT_NOT_ALLOWED" | "DUPLICATE_OUTPUT" | "UNSUPPORTED_OUTPUT" | "INVALID_WHEN_EXPRESSION" | "MIXED_EDGE_CONDITIONS" | "DUPLICATE_EDGE";
+    code: "MISSING_ENTRY" | "UNKNOWN_EDGE_SOURCE" | "UNKNOWN_EDGE_TARGET" | "UNREACHABLE_NODE" | "UNKNOWN_SKILL" | "SELF_LOOP" | "UNBOUNDED_CYCLE" | "AMBIGUOUS_EDGES" | "UNSUPPORTED_EVAL_POLICY" | "DUPLICATE_EVALUATOR" | "INVALID_INLINE_SKILL" | "EDGE_ITERATIONS_EXCEEDED" | "RETRY_MAX_EXCEEDED" | "PERMISSION_CEILING" | "AGENT_ENV_READ_ONLY" | "BUDGET_CEILING" | "OUTPUT_NOT_ALLOWED" | "DUPLICATE_OUTPUT" | "UNSUPPORTED_OUTPUT" | "INVALID_WHEN_EXPRESSION" | "MIXED_EDGE_CONDITIONS" | "DUPLICATE_EDGE";
     message: string;
     nodeId?: string;
 }

package/dist/schema.js

@@ -710,6 +710,22 @@ export function validateWorkflow(workflow, knownSkills) {
             });
         }
     }
+    // Evaluator names are a node's eval keys: results, retry preambles, routes
+    // (`node.evals.<name>.pass`) and the required-tool repair look a verdict up
+    // by name, so two evaluators with one name would make that lookup ambiguous.
+    for (const [nodeId, node] of Object.entries(workflow.nodes)) {
+        const seen = new Set();
+        for (const e of node.eval ?? []) {
+            if (seen.has(e.name)) {
+                errors.push({
+                    code: "DUPLICATE_EVALUATOR",
+                    message: `Node "${nodeId}" declares two evaluators named "${e.name}"; evaluator names must be unique within a node`,
+                    nodeId,
+                });
+            }
+            seen.add(e.name);
+        }
+    }
     // Inline skills need usage instructions; the engine server name is reserved.
     for (const [skillId, def] of Object.entries(workflow.skills ?? {})) {
         if (!def.instruction?.trim()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.209",
+  "version": "0.1.210",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"