@sweny-ai/core 0.1.51 → 0.1.52

package/dist/cli/templates.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Starter workflow templates offered during `sweny init`.
+ *
+ * Each template is a valid SWEny workflow YAML. Templates are self-contained
+ * strings — no filesystem reads needed, works from npm install.
+ */
+export interface WorkflowTemplate {
+    id: string;
+    name: string;
+    description: string;
+    yaml: string;
+}
+export declare const WORKFLOW_TEMPLATES: WorkflowTemplate[];

package/dist/cli/templates.js

@@ -0,0 +1,181 @@
+/**
+ * Starter workflow templates offered during `sweny init`.
+ *
+ * Each template is a valid SWEny workflow YAML. Templates are self-contained
+ * strings — no filesystem reads needed, works from npm install.
+ */
+export const WORKFLOW_TEMPLATES = [
+    {
+        id: "pr-review",
+        name: "PR Review Bot",
+        description: "Automated code review on pull requests",
+        yaml: `id: pr-review
+name: PR Review Bot
+description: Review pull requests for code quality, security issues, and best practices.
+entry: fetch-diff
+
+nodes:
+  fetch-diff:
+    name: Fetch PR Changes
+    instruction: |
+      Fetch the pull request diff. Identify which files changed,
+      what was added, modified, or removed. Summarize the scope
+      of the change.
+    skills: [github]
+
+  review-code:
+    name: Review Code
+    instruction: |
+      Review the code changes for:
+      - Security vulnerabilities (injection, auth issues, secrets)
+      - Logic errors and edge cases
+      - Code style and readability
+      - Test coverage gaps
+
+      Be specific — reference file names and line numbers.
+      Categorize findings as critical, important, or minor.
+    skills: [github]
+
+  post-review:
+    name: Post Review Comment
+    instruction: |
+      Post a structured review comment on the pull request.
+      Lead with a summary, then list findings by severity.
+      If no issues found, approve with a brief note.
+    skills: [github]
+
+edges:
+  - from: fetch-diff
+    to: review-code
+  - from: review-code
+    to: post-review
+`,
+    },
+    {
+        id: "issue-triage",
+        name: "Issue Triage",
+        description: "Classify, prioritize, and label incoming issues",
+        yaml: `id: issue-triage
+name: Issue Triage
+description: Automatically classify, prioritize, and label new issues.
+entry: classify
+
+nodes:
+  classify:
+    name: Classify Issue
+    instruction: |
+      Read the issue title and body. Classify it as one of:
+      - bug: Something is broken
+      - feature: A new capability request
+      - question: Asking for help or clarification
+      - chore: Maintenance, refactoring, docs
+
+      Also assess priority:
+      - P0: Production is down or data loss
+      - P1: Major feature broken, workaround exists
+      - P2: Minor issue, low impact
+      - P3: Nice to have, no urgency
+    skills: [github]
+
+  label-and-assign:
+    name: Apply Labels
+    instruction: |
+      Based on the classification, apply the appropriate labels
+      to the issue (e.g. "bug", "P1", "needs-triage").
+      Add a comment explaining the classification rationale.
+    skills: [github]
+
+edges:
+  - from: classify
+    to: label-and-assign
+`,
+    },
+    {
+        id: "security-scan",
+        name: "Security Audit",
+        description: "Scan code and dependencies for security issues",
+        yaml: `id: security-scan
+name: Security Audit
+description: Scan repository code and dependencies for security vulnerabilities.
+entry: scan-code
+
+nodes:
+  scan-code:
+    name: Scan Code for Secrets
+    instruction: |
+      Search the repository for exposed secrets, API keys,
+      passwords, and tokens in code, config files, and
+      environment templates. Check for common patterns:
+      hardcoded credentials, leaked keys, insecure defaults.
+    skills: [github]
+
+  scan-deps:
+    name: Scan Dependencies
+    instruction: |
+      Review dependency manifests (package.json, requirements.txt,
+      go.mod, etc.) for known vulnerable versions. Check for
+      outdated packages with security advisories.
+    skills: [github]
+
+  compile-report:
+    name: Compile Security Report
+    instruction: |
+      Compile findings from the code and dependency scans into
+      a structured security report. Categorize by severity
+      (critical, high, medium, low). Include remediation steps
+      for each finding.
+    skills: [github]
+
+edges:
+  - from: scan-code
+    to: scan-deps
+  - from: scan-deps
+    to: compile-report
+`,
+    },
+    {
+        id: "release-notes",
+        name: "Release Notes",
+        description: "Generate release notes from commits and PRs",
+        yaml: `id: release-notes
+name: Release Notes Generator
+description: Generate structured release notes from recent commits and merged PRs.
+entry: gather
+
+nodes:
+  gather:
+    name: Gather Changes
+    instruction: |
+      List all commits and merged pull requests since the last
+      release tag. For each, extract: title, author, PR number,
+      and a brief description of what changed.
+    skills: [github]
+
+  categorize:
+    name: Categorize Changes
+    instruction: |
+      Group the changes into categories:
+      - Features: New capabilities
+      - Fixes: Bug fixes
+      - Improvements: Performance, refactoring, DX
+      - Breaking Changes: Anything that requires migration
+
+      Flag any breaking changes prominently.
+    skills: [github]
+
+  write-notes:
+    name: Write Release Notes
+    instruction: |
+      Write polished release notes in markdown. Lead with
+      highlights, then list changes by category. Credit
+      contributors. Keep it concise but informative.
+    skills: [github]
+
+edges:
+  - from: gather
+    to: categorize
+  - from: categorize
+    to: write-notes
+`,
+    },
+];

package/dist/executor.js

@@ -21,7 +21,11 @@ import { consoleLogger } from "./types.js";
  * - `trace`: full ordered execution trace including loops and routing decisions
  */
 export async function execute(workflow, input, options) {
-    const { skills, claude, observer } = options;
+    const { claude, observer } = options;
+    // Merge inline workflow skills into the skill map so they resolve at runtime.
+    // Inline skills (instruction/mcp only) become Skill objects with empty tools/config.
+    // The caller's skill map takes precedence — inline skills only fill gaps.
+    const skills = mergeInlineSkills(options.skills, workflow.skills);
     const config = resolveConfig(skills, options.config);
     const logger = options.logger ?? consoleLogger;
     const results = new Map();
@@ -41,11 +45,13 @@ export async function execute(workflow, input, options) {
         logger.info(`→ ${node.name}`, { node: currentId });
         // Gather tools from the node's skills
         const tools = resolveTools(node.skills, skills);
+        const skillInstructions = resolveSkillInstructions(node.skills, skills);
         // Runtime guard: if this node declares skills but none resolved, the node
         // cannot do its job (e.g. "create a Linear issue" with no linear skill).
         // The startup validate() warns about this possibility, but only throw when
         // the node is actually reached — unreachable nodes with missing skills are fine.
-        if (node.skills.length > 0 && tools.length === 0) {
+        // Instruction-only skills (no tools) are valid — they inject context into the prompt.
+        if (node.skills.length > 0 && tools.length === 0 && skillInstructions.length === 0) {
             throw new Error(`Node "${currentId}" requires skills [${node.skills.join(", ")}] but none are configured. ` +
                 `Set the required environment variables and try again.`);
         }
@@ -66,7 +72,7 @@ export async function execute(workflow, input, options) {
             },
         }));
         // Prepend rules and context to instruction if provided
-        const instruction = buildNodeInstruction(node.instruction, input);
+        const instruction = buildNodeInstruction(node.instruction, input, skillInstructions);
         // Run Claude on this node
         const result = await claude.run({
             instruction,
@@ -116,30 +122,35 @@ export async function execute(workflow, input, options) {
  * Rules get "You MUST follow" framing; context gets "Background" framing.
  * Falls back to legacy `additionalContext` if rules/context aren't set.
  */
-function buildNodeInstruction(baseInstruction, input) {
+function buildNodeInstruction(baseInstruction, input, skillInstructions) {
     const inp = input;
-    if (!inp)
-        return baseInstruction;
     const sections = [];
-    // New structured format
-    const rules = typeof inp.rules === "string" && inp.rules ? inp.rules : "";
-    const context = typeof inp.context === "string" && inp.context ? inp.context : "";
-    if (rules) {
-        sections.push(`## Rules — You MUST Follow These\n\n${rules}`);
-    }
-    if (context) {
-        sections.push(`## Background Context\n\n${context}`);
+    if (inp) {
+        const rules = typeof inp.rules === "string" && inp.rules ? inp.rules : "";
+        const context = typeof inp.context === "string" && inp.context ? inp.context : "";
+        if (rules) {
+            sections.push(`## Rules — You MUST Follow These\n\n${rules}`);
+        }
+        if (context) {
+            sections.push(`## Background Context\n\n${context}`);
+        }
+        // Legacy fallback
+        if (sections.length === 0) {
+            const legacy = typeof inp.additionalContext === "string" ? inp.additionalContext : "";
+            if (legacy) {
+                sections.push(`## Additional Context & Rules\n\n${legacy}`);
+            }
+        }
     }
-    // Legacy fallback
-    if (sections.length === 0) {
-        const legacy = typeof inp.additionalContext === "string" ? inp.additionalContext : "";
-        if (legacy) {
-            sections.push(`## Additional Context & Rules\n\n${legacy}`);
+    // Skill instructions — injected between context and base instruction
+    if (skillInstructions && skillInstructions.length > 0) {
+        for (const { name, instruction } of skillInstructions) {
+            sections.push(`## Skill: ${name}\n\n${instruction}`);
         }
     }
     if (sections.length === 0)
         return baseInstruction;
-    return `${sections.join("\n\n")}\n\n---\n\n${baseInstruction}`;
+    return `${sections.join("\n\n---\n\n")}\n\n---\n\n${baseInstruction}`;
 }
 /**
  * Call observer without letting exceptions crash the workflow.
@@ -157,12 +168,44 @@ function safeObserve(observer, event, logger) {
         (logger ?? consoleLogger).warn(`Observer error (non-fatal): ${err.message}`);
     }
 }
+/**
+ * Merge inline workflow skill definitions into the skill map.
+ * Inline skills (from workflow.skills) become Skill objects with empty tools/config.
+ * The caller's skill map takes precedence — inline skills only fill gaps.
+ */
+function mergeInlineSkills(skills, inlineSkills) {
+    if (!inlineSkills || Object.keys(inlineSkills).length === 0)
+        return skills;
+    const merged = new Map(skills);
+    for (const [id, def] of Object.entries(inlineSkills)) {
+        if (merged.has(id))
+            continue; // caller-provided skill takes precedence
+        merged.set(id, {
+            id,
+            name: def.name ?? id,
+            description: def.description ?? `Inline skill: ${id}`,
+            category: "general",
+            config: {},
+            tools: [],
+            instruction: def.instruction,
+            mcp: def.mcp,
+        });
+    }
+    return merged;
+}
 function resolveTools(skillIds, skills) {
     return skillIds
         .map((id) => skills.get(id))
         .filter((s) => s != null)
         .flatMap((s) => s.tools);
 }
+/** Collect instruction strings from skills that have them, in array order. */
+function resolveSkillInstructions(skillIds, skills) {
+    return skillIds
+        .map((id) => skills.get(id))
+        .filter((s) => s != null && s.instruction != null)
+        .map((s) => ({ name: s.name, instruction: s.instruction }));
+}
 /**
  * Resolve config values: check explicit overrides first, then env vars.
  * Throws if a required field is missing.

package/dist/executor.test.js

@@ -313,3 +313,236 @@ describe("file skill", () => {
         expect(existsSync(path.join(outputDir, "deep/nested/file.json"))).toBe(true);
     });
 });
+// ─── Skill instruction injection tests ──────────────────────────
+describe("skill instruction injection", () => {
+    let outputDir;
+    beforeEach(() => {
+        outputDir = freshDir("skill-inject");
+    });
+    it("injects skill instructions into the prompt", async () => {
+        const instructionSkill = {
+            id: "code-standards",
+            name: "Code Standards",
+            description: "Team conventions",
+            category: "general",
+            config: {},
+            tools: [],
+            instruction: "Always use camelCase for variable names.",
+        };
+        const workflow = {
+            id: "test-inject",
+            name: "Inject Test",
+            description: "",
+            entry: "step",
+            nodes: {
+                step: {
+                    name: "Do Work",
+                    instruction: "Write some code.",
+                    skills: ["code-standards"],
+                },
+            },
+            edges: [],
+        };
+        let capturedInstruction = "";
+        const claude = {
+            async run(opts) {
+                capturedInstruction = opts.instruction;
+                return { status: "success", data: {}, toolCalls: [] };
+            },
+            async evaluate() {
+                return "";
+            },
+        };
+        await execute(workflow, {}, {
+            skills: createSkillMap([instructionSkill]),
+            claude,
+            config: {},
+        });
+        expect(capturedInstruction).toContain("## Skill: Code Standards");
+        expect(capturedInstruction).toContain("Always use camelCase for variable names.");
+        expect(capturedInstruction).toContain("Write some code.");
+    });
+    it("injects multiple skill instructions in array order", async () => {
+        const skillA = {
+            id: "skill-a",
+            name: "Skill A",
+            description: "First",
+            category: "general",
+            config: {},
+            tools: [],
+            instruction: "AAA instruction",
+        };
+        const skillB = {
+            id: "skill-b",
+            name: "Skill B",
+            description: "Second",
+            category: "general",
+            config: {},
+            tools: [],
+            instruction: "BBB instruction",
+        };
+        const workflow = {
+            id: "test-multi",
+            name: "Multi Inject",
+            description: "",
+            entry: "step",
+            nodes: {
+                step: {
+                    name: "Work",
+                    instruction: "Do the work.",
+                    skills: ["skill-a", "skill-b"],
+                },
+            },
+            edges: [],
+        };
+        let capturedInstruction = "";
+        const claude = {
+            async run(opts) {
+                capturedInstruction = opts.instruction;
+                return { status: "success", data: {}, toolCalls: [] };
+            },
+            async evaluate() {
+                return "";
+            },
+        };
+        await execute(workflow, {}, {
+            skills: createSkillMap([skillA, skillB]),
+            claude,
+            config: {},
+        });
+        const posA = capturedInstruction.indexOf("AAA instruction");
+        const posB = capturedInstruction.indexOf("BBB instruction");
+        const posBase = capturedInstruction.indexOf("Do the work.");
+        expect(posA).toBeLessThan(posB);
+        expect(posB).toBeLessThan(posBase);
+    });
+    it("allows instruction-only nodes (no tools, no error)", async () => {
+        const instructionSkill = {
+            id: "rubric",
+            name: "Evaluation Rubric",
+            description: "Scoring criteria",
+            category: "general",
+            config: {},
+            tools: [],
+            instruction: "Score quality 1-5.",
+        };
+        const workflow = {
+            id: "test-notools",
+            name: "No Tools",
+            description: "",
+            entry: "judge",
+            nodes: {
+                judge: {
+                    name: "Judge",
+                    instruction: "Evaluate the output.",
+                    skills: ["rubric"],
+                },
+            },
+            edges: [],
+        };
+        const claude = {
+            async run() {
+                return { status: "success", data: { score: 4 }, toolCalls: [] };
+            },
+            async evaluate() {
+                return "";
+            },
+        };
+        // Should NOT throw "none are configured"
+        const { results } = await execute(workflow, {}, {
+            skills: createSkillMap([instructionSkill]),
+            claude,
+            config: {},
+        });
+        expect(results.get("judge")?.status).toBe("success");
+    });
+    it("wires inline workflow.skills into the executor automatically", async () => {
+        const workflow = {
+            id: "test-inline",
+            name: "Inline Skills",
+            description: "",
+            entry: "review",
+            nodes: {
+                review: {
+                    name: "Review",
+                    instruction: "Review the code.",
+                    skills: ["my-rubric"],
+                },
+            },
+            edges: [],
+            skills: {
+                "my-rubric": {
+                    name: "My Rubric",
+                    instruction: "Check for security issues first, then correctness.",
+                },
+            },
+        };
+        let capturedInstruction = "";
+        const claude = {
+            async run(opts) {
+                capturedInstruction = opts.instruction;
+                return { status: "success", data: {}, toolCalls: [] };
+            },
+            async evaluate() {
+                return "";
+            },
+        };
+        // No "my-rubric" in the skill map — executor must pull it from workflow.skills
+        const { results } = await execute(workflow, {}, {
+            skills: createSkillMap([]),
+            claude,
+            config: {},
+        });
+        expect(results.get("review")?.status).toBe("success");
+        expect(capturedInstruction).toContain("## Skill: My Rubric");
+        expect(capturedInstruction).toContain("Check for security issues first");
+    });
+    it("caller-provided skills take precedence over inline workflow.skills", async () => {
+        const callerSkill = {
+            id: "shared",
+            name: "Caller Version",
+            description: "From caller",
+            category: "general",
+            config: {},
+            tools: [],
+            instruction: "Caller instruction wins.",
+        };
+        const workflow = {
+            id: "test-precedence",
+            name: "Precedence",
+            description: "",
+            entry: "step",
+            nodes: {
+                step: {
+                    name: "Step",
+                    instruction: "Do work.",
+                    skills: ["shared"],
+                },
+            },
+            edges: [],
+            skills: {
+                shared: {
+                    name: "Inline Version",
+                    instruction: "Inline instruction should NOT appear.",
+                },
+            },
+        };
+        let capturedInstruction = "";
+        const claude = {
+            async run(opts) {
+                capturedInstruction = opts.instruction;
+                return { status: "success", data: {}, toolCalls: [] };
+            },
+            async evaluate() {
+                return "";
+            },
+        };
+        await execute(workflow, {}, {
+            skills: createSkillMap([callerSkill]),
+            claude,
+            config: {},
+        });
+        expect(capturedInstruction).toContain("Caller instruction wins.");
+        expect(capturedInstruction).not.toContain("Inline instruction should NOT appear.");
+    });
+});

package/dist/index.d.ts

@@ -21,7 +21,7 @@
  * })
  * ```
  */
-export type { Skill, SkillCategory, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, } from "./types.js";
+export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ConfigField, JSONSchema, Workflow, Node, Edge, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, } from "./types.js";
 export { consoleLogger } from "./types.js";
 export { execute } from "./executor.js";
 export type { ExecuteOptions } from "./executor.js";
@@ -29,11 +29,11 @@ export { ClaudeClient } from "./claude.js";
 export type { ClaudeClientOptions } from "./claude.js";
 export { github, linear, slack, sentry, datadog, notification, supabase, builtinSkills, createSkillMap, allSkills, isSkillConfigured, configuredBuiltinSkills, validateWorkflowSkills, } from "./skills/index.js";
 export type { SkillValidationResult } from "./skills/index.js";
-export { loadCustomSkills, configuredSkills } from "./skills/custom-loader.js";
-export { workflowZ, nodeZ, edgeZ, skillZ, parseWorkflow, validateWorkflow, workflowJsonSchema } from "./schema.js";
+export { loadCustomSkills, discoverSkills, configuredSkills } from "./skills/custom-loader.js";
+export { workflowZ, nodeZ, edgeZ, skillZ, mcpServerConfigZ, skillDefinitionZ, parseWorkflow, validateWorkflow, workflowJsonSchema, } from "./schema.js";
 export type { WorkflowError } from "./schema.js";
-export { buildAutoMcpServers, buildProviderContext } from "./mcp.js";
-export type { ProviderContextOptions } from "./mcp.js";
+export { buildAutoMcpServers, buildSkillMcpServers, buildProviderContext } from "./mcp.js";
+export type { ProviderContextOptions, SkillMcpOptions } from "./mcp.js";
 export type { McpServerConfig, McpAutoConfig } from "./types.js";
 export { buildWorkflow, refineWorkflow } from "./workflow-builder.js";
 export type { BuildWorkflowOptions } from "./workflow-builder.js";

package/dist/index.js

@@ -29,11 +29,11 @@ export { ClaudeClient } from "./claude.js";
 // Skills
 export { github, linear, slack, sentry, datadog, notification, supabase, builtinSkills, createSkillMap, allSkills, isSkillConfigured, configuredBuiltinSkills, validateWorkflowSkills, } from "./skills/index.js";
 // Node-only skill discovery (filesystem-based)
-export { loadCustomSkills, configuredSkills } from "./skills/custom-loader.js";
+export { loadCustomSkills, discoverSkills, configuredSkills } from "./skills/custom-loader.js";
 // Schema & validation
-export { workflowZ, nodeZ, edgeZ, skillZ, parseWorkflow, validateWorkflow, workflowJsonSchema } from "./schema.js";
+export { workflowZ, nodeZ, edgeZ, skillZ, mcpServerConfigZ, skillDefinitionZ, parseWorkflow, validateWorkflow, workflowJsonSchema, } from "./schema.js";
 // MCP auto-injection
-export { buildAutoMcpServers, buildProviderContext } from "./mcp.js";
+export { buildAutoMcpServers, buildSkillMcpServers, buildProviderContext } from "./mcp.js";
 // Workflow builder
 export { buildWorkflow, refineWorkflow } from "./workflow-builder.js";
 // Templates

package/dist/mcp.d.ts

@@ -6,6 +6,8 @@ export interface SkillMcpOptions {
     credentials: Record<string, string>;
     /** User-supplied MCP servers — always win on key conflict. */
     userMcpServers?: Record<string, McpServerConfig>;
+    /** MCP servers declared by custom skills. Only wired when the skill is referenced. */
+    skillMcpServers?: Record<string, McpServerConfig>;
 }
 /**
  * Build MCP server configs for the skills a workflow references.

package/dist/mcp.js

@@ -155,6 +155,14 @@ export function buildSkillMcpServers(opts) {
             env: { ASANA_ACCESS_TOKEN: creds.ASANA_ACCESS_TOKEN },
         };
     }
+    // Skill-declared MCP servers — only include for referenced skills.
+    if (opts.skillMcpServers) {
+        for (const [skillId, mcpConfig] of Object.entries(opts.skillMcpServers)) {
+            if (refs.has(skillId) && !auto[skillId]) {
+                auto[skillId] = mcpConfig;
+            }
+        }
+    }
     // User-supplied servers always win on key conflict.
     return { ...auto, ...(opts.userMcpServers ?? {}) };
 }