@sweny-ai/core 0.1.77 → 0.1.79

package/dist/schema.js

@@ -36,6 +36,7 @@ export const mcpServerConfigZ = z
     headers: z.record(z.string()).optional(),
     env: z.record(z.string()).optional(),
 })
+    .strict()
     .refine((c) => c.command || c.url, {
     message: "MCP server must have either command (stdio) or url (HTTP)",
 });
@@ -46,6 +47,7 @@ export const skillDefinitionZ = z
     instruction: z.string().optional(),
     mcp: mcpServerConfigZ.optional(),
 })
+    .strict()
     .refine((s) => s.instruction || s.mcp, {
     message: "Inline skill must provide instruction, mcp, or both",
 });
@@ -82,6 +84,7 @@ export const outputMatchZ = z
     in: z.array(z.unknown()).optional(),
     matches: z.string().min(1).optional(),
 })
+    .strict()
     .refine((m) => {
     const operators = [m.equals !== undefined, m.in !== undefined, m.matches !== undefined];
     return operators.filter(Boolean).length === 1;
@@ -94,6 +97,12 @@ export const nodeVerifyZ = z
     output_required: z.array(z.string().min(1)).min(1).optional(),
     output_matches: z.array(outputMatchZ).min(1).optional(),
 })
+    // Fix #4 gap: the exported JSON Schema sets additionalProperties: false.
+    // Without .strict() here Zod would silently drop unknown keys and then
+    // the refine would run on the stripped object, producing a different
+    // verdict than ajv (which rejects the unknown key directly). Keep them
+    // in sync.
+    .strict()
     .refine((v) => v.any_tool_called !== undefined ||
     v.all_tools_called !== undefined ||
     v.no_tool_called !== undefined ||
@@ -107,16 +116,20 @@ export const nodeRequiresZ = z
     output_matches: z.array(outputMatchZ).min(1).optional(),
     on_fail: z.enum(["fail", "skip"]).optional(),
 })
+    .strict()
     .refine((r) => r.output_required !== undefined || r.output_matches !== undefined, {
     message: "requires must declare at least one check (output_required or output_matches)",
 });
 const retryInstructionAutoZ = z.object({ auto: z.literal(true) }).strict();
 const retryInstructionReflectZ = z.object({ reflect: z.string().min(1) }).strict();
-export const nodeRetryZ = z.object({
+export const nodeRetryZ = z
+    .object({
     max: z.number().int().min(1),
     instruction: z.union([z.string().min(1), retryInstructionAutoZ, retryInstructionReflectZ]).optional(),
-});
-export const nodeZ = z.object({
+})
+    .strict();
+export const nodeZ = z
+    .object({
     name: z.string().min(1),
     instruction: sourceZ,
     skills: z.array(z.string()).default([]),
@@ -127,13 +140,22 @@ export const nodeZ = z.object({
     verify: nodeVerifyZ.optional(),
     requires: nodeRequiresZ.optional(),
     retry: nodeRetryZ.optional(),
-});
-export const edgeZ = z.object({
+})
+    .strict();
+export const edgeZ = z
+    .object({
     from: z.string().min(1),
     to: z.string().min(1),
     when: z.string().optional(),
     max_iterations: z.number().int().min(1).optional(),
-});
+})
+    .strict();
+// Fix #4 gap — workflowZ is intentionally NOT .strict(). The published
+// JSON Schema's `additionalProperties: false` only scopes the properties
+// block, but marketplace workflows routinely carry top-level metadata
+// (author, category, tags) handled by publish.ts. Striping rather than
+// rejecting them preserves compatibility with the existing marketplace
+// contract while the inner objects (nodes, edges, skills) stay strict.
 export const workflowZ = z.object({
     id: z.string().min(1),
     name: z.string().min(1),
@@ -328,7 +350,10 @@ export const workflowJsonSchema = {
     description: "A declarative YAML format for AI agent orchestration as a directed graph with natural language routing.",
     type: "object",
     required: ["id", "name", "nodes", "edges", "entry"],
-    additionalProperties: false,
+    // Top-level is intentionally open: marketplace workflows carry extra
+    // metadata (author, category, tags) that publish.ts reads. Inner
+    // objects (nodes, edges, skills, verify, requires, etc.) are strict.
+    additionalProperties: true,
     $defs: {
         Source: sourceJsonSchema,
         NodeSources: {
@@ -396,6 +421,8 @@ export const workflowJsonSchema = {
                         type: "object",
                         description: "Machine-checked post-conditions evaluated after the LLM finishes.",
                         additionalProperties: false,
+                        // Fix #4: at least one check must be declared.
+                        minProperties: 1,
                         properties: {
                             any_tool_called: { type: "array", items: { type: "string", minLength: 1 }, minItems: 1 },
                             all_tools_called: { type: "array", items: { type: "string", minLength: 1 }, minItems: 1 },
@@ -413,6 +440,8 @@ export const workflowJsonSchema = {
                                         in: { type: "array" },
                                         matches: { type: "string", minLength: 1 },
                                     },
+                                    // Fix #4: exactly one operator must be declared.
+                                    oneOf: [{ required: ["equals"] }, { required: ["in"] }, { required: ["matches"] }],
                                 },
                                 minItems: 1,
                             },
@@ -422,6 +451,9 @@ export const workflowJsonSchema = {
                         type: "object",
                         description: "Pre-condition checks evaluated before the LLM runs.",
                         additionalProperties: false,
+                        // Fix #4: at least one of output_required / output_matches must be declared.
+                        // on_fail alone is not sufficient — it only tags how a failing check behaves.
+                        anyOf: [{ required: ["output_required"] }, { required: ["output_matches"] }],
                         properties: {
                             output_required: {
                                 type: "array",
@@ -440,6 +472,8 @@ export const workflowJsonSchema = {
                                         in: { type: "array" },
                                         matches: { type: "string", minLength: 1 },
                                     },
+                                    // Fix #4: exactly one operator must be declared.
+                                    oneOf: [{ required: ["equals"] }, { required: ["in"] }, { required: ["matches"] }],
                                 },
                                 minItems: 1,
                             },
@@ -498,6 +532,10 @@ export const workflowJsonSchema = {
             description: "Inline skill definitions scoped to this workflow",
             additionalProperties: {
                 type: "object",
+                // Fix #4: an inline skill must provide instruction, mcp, or both.
+                anyOf: [{ required: ["instruction"] }, { required: ["mcp"] }],
+                // Round 2: reject unknown keys to match Zod skillDefinitionZ.strict().
+                additionalProperties: false,
                 properties: {
                     name: { type: "string" },
                     description: { type: "string" },
@@ -505,6 +543,10 @@ export const workflowJsonSchema = {
                     mcp: {
                         type: "object",
                         description: "External MCP server definition",
+                        // Fix #4: an MCP server must declare command (stdio) or url (http).
+                        anyOf: [{ required: ["command"] }, { required: ["url"] }],
+                        // Round 2: reject unknown keys to match Zod mcpServerConfigZ.strict().
+                        additionalProperties: false,
                         properties: {
                             type: { type: "string", enum: ["stdio", "http"] },
                             command: { type: "string" },

package/dist/skills/custom-loader.d.ts

@@ -9,8 +9,33 @@
  *   .gemini/skills/ < .agents/skills/ < .claude/skills/ < .sweny/skills/
  */
 import type { Skill } from "../types.js";
+/**
+ * Diagnostic emitted when a SKILL.md file is skipped or overridden during
+ * discovery. CLI flows can render these as yellow warnings; library consumers
+ * can inspect `kind` to decide whether to surface, ignore, or fail.
+ */
+export interface SkillDiagnostic {
+    kind: "invalid-frontmatter" | "missing-name" | "invalid-id" | "unreadable-file" | "duplicate-id";
+    path: string;
+    message: string;
+}
+export interface SkillDiscoveryResult {
+    skills: Skill[];
+    warnings: SkillDiagnostic[];
+}
+/**
+ * Discover custom skills and surface diagnostics for broken ones.
+ *
+ * Prefer this over `discoverSkills` for CLI flows that can surface warnings
+ * to users. `discoverSkills` stays as a backward-compatible wrapper for
+ * callers that only want the happy-path skill list.
+ */
+export declare function discoverSkillsWithDiagnostics(cwd?: string): SkillDiscoveryResult;
 /**
  * Discover custom skills from all known harness directories.
+ *
+ * Backwards-compatible wrapper that drops diagnostics. Use
+ * `discoverSkillsWithDiagnostics` when you want to surface warnings.
  */
 export declare function discoverSkills(cwd?: string): Skill[];
 /**
@@ -18,7 +43,22 @@ export declare function discoverSkills(cwd?: string): Skill[];
  * @deprecated Use `discoverSkills` for multi-directory support.
  */
 export declare function loadCustomSkills(cwd?: string): Skill[];
+/**
+ * From all builtins + custom repo skills, return only the skills that are usable
+ * alongside any custom-skill loader diagnostics (warnings for malformed or
+ * duplicate SKILL.md files).
+ *
+ * Most CLI flows should prefer this over `configuredSkills` so they can
+ * surface warnings to the user.
+ */
+export declare function configuredSkillsWithDiagnostics(env?: Record<string, string | undefined>, cwd?: string): {
+    skills: Skill[];
+    warnings: SkillDiagnostic[];
+};
 /**
  * From all builtins + custom repo skills, return only the skills that are usable.
+ *
+ * Backwards-compatible wrapper that drops diagnostics. Prefer
+ * `configuredSkillsWithDiagnostics` in CLI flows so broken skill files surface.
  */
 export declare function configuredSkills(env?: Record<string, string | undefined>, cwd?: string): Skill[];

package/dist/skills/custom-loader.js

@@ -17,10 +17,15 @@ const SKILL_DIRS = [".gemini/skills", ".agents/skills", ".claude/skills", ".swen
 /** Valid skill ID: lowercase alphanumeric + hyphens, no leading/trailing/consecutive hyphens, max 64 chars. */
 const VALID_SKILL_ID = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
 /**
- * Discover custom skills from all known harness directories.
+ * Discover custom skills and surface diagnostics for broken ones.
+ *
+ * Prefer this over `discoverSkills` for CLI flows that can surface warnings
+ * to users. `discoverSkills` stays as a backward-compatible wrapper for
+ * callers that only want the happy-path skill list.
  */
-export function discoverSkills(cwd = process.cwd()) {
+export function discoverSkillsWithDiagnostics(cwd = process.cwd()) {
     const skillMap = new Map();
+    const warnings = [];
     for (const relDir of SKILL_DIRS) {
         const skillsDir = join(cwd, relDir);
         if (!existsSync(skillsDir))
@@ -38,32 +43,73 @@ export function discoverSkills(cwd = process.cwd()) {
             const skillFile = join(skillsDir, dirName, "SKILL.md");
             if (!existsSync(skillFile))
                 continue;
+            let content;
             try {
-                const content = readFileSync(skillFile, "utf-8");
-                const parsed = parseSkillMd(content);
-                if (!parsed)
-                    continue;
-                skillMap.set(parsed.id, parsed);
+                content = readFileSync(skillFile, "utf-8");
             }
-            catch {
-                // Skip malformed skill files
+            catch (err) {
+                const msg = err instanceof Error ? err.message : "unknown error";
+                warnings.push({
+                    kind: "unreadable-file",
+                    path: skillFile,
+                    message: `Could not read ${skillFile}: ${msg}`,
+                });
+                continue;
+            }
+            const parsed = parseSkillMd(content, skillFile);
+            if (parsed.kind === "ok") {
+                if (skillMap.has(parsed.skill.id)) {
+                    warnings.push({
+                        kind: "duplicate-id",
+                        path: skillFile,
+                        message: `Skill "${parsed.skill.id}" overrides an earlier definition (last-one-wins)`,
+                    });
+                }
+                skillMap.set(parsed.skill.id, parsed.skill);
+            }
+            else {
+                warnings.push(parsed.diagnostic);
             }
         }
     }
-    return [...skillMap.values()];
+    return { skills: [...skillMap.values()], warnings };
 }
 /**
- * Parse a SKILL.md file into a Skill object.
+ * Discover custom skills from all known harness directories.
+ *
+ * Backwards-compatible wrapper that drops diagnostics. Use
+ * `discoverSkillsWithDiagnostics` when you want to surface warnings.
  */
-function parseSkillMd(content) {
+export function discoverSkills(cwd = process.cwd()) {
+    return discoverSkillsWithDiagnostics(cwd).skills;
+}
+function parseSkillMd(content, path) {
     const raw = parseFrontmatter(content);
-    if (!raw?.name)
-        return null;
+    if (raw === "invalid") {
+        return {
+            kind: "err",
+            diagnostic: { kind: "invalid-frontmatter", path, message: `Invalid YAML frontmatter in ${path}` },
+        };
+    }
+    if (!raw?.name) {
+        return {
+            kind: "err",
+            diagnostic: { kind: "missing-name", path, message: `SKILL.md at ${path} has no 'name' field in frontmatter` },
+        };
+    }
     // Narrow the loosely-typed YAML output into the fields we expect
     const fm = raw;
     const id = String(fm.name);
-    if (!VALID_SKILL_ID.test(id) || id.includes("--") || id.length > 64)
-        return null;
+    if (!VALID_SKILL_ID.test(id) || id.includes("--") || id.length > 64) {
+        return {
+            kind: "err",
+            diagnostic: {
+                kind: "invalid-id",
+                path,
+                message: `Skill id "${id}" is invalid (lowercase alphanumeric + hyphens only, no consecutive hyphens, max 64 chars)`,
+            },
+        };
+    }
     const instruction = extractBody(content);
     let mcp;
     if (fm.mcp && typeof fm.mcp === "object") {
@@ -94,26 +140,42 @@ function parseSkillMd(content) {
         }
     }
     return {
-        id,
-        name: id,
-        description: typeof fm.description === "string" ? fm.description : `Custom skill: ${id}`,
-        category: "general",
-        config,
-        tools: [],
-        instruction: instruction || undefined,
-        mcp,
+        kind: "ok",
+        skill: {
+            id,
+            name: id,
+            description: typeof fm.description === "string" ? fm.description : `Custom skill: ${id}`,
+            category: "general",
+            config,
+            tools: [],
+            instruction: instruction || undefined,
+            mcp,
+        },
     };
 }
-/** Extract YAML frontmatter from a markdown file (between --- delimiters). */
+/**
+ * Extract and parse YAML frontmatter.
+ *
+ * Returns:
+ *   - parsed object when frontmatter is present and valid
+ *   - `null` when no frontmatter delimiters found (treat as no-op skip)
+ *   - `"invalid"` when delimiters are present but the YAML body is malformed
+ *     (distinct from "missing" so diagnostics can differentiate).
+ */
 function parseFrontmatter(content) {
     const match = content.match(/^---\s*\n([\s\S]*?)\n---/);
     if (!match)
         return null;
     try {
-        return YAML.parse(match[1]);
+        const parsed = YAML.parse(match[1]);
+        if (parsed === null || parsed === undefined)
+            return null;
+        if (typeof parsed !== "object")
+            return "invalid";
+        return parsed;
     }
     catch {
-        return null;
+        return "invalid";
     }
 }
 /** Extract the markdown body (everything after closing ---). */
@@ -131,18 +193,22 @@ export function loadCustomSkills(cwd = process.cwd()) {
     return discoverSkills(cwd);
 }
 /**
- * From all builtins + custom repo skills, return only the skills that are usable.
+ * From all builtins + custom repo skills, return only the skills that are usable
+ * alongside any custom-skill loader diagnostics (warnings for malformed or
+ * duplicate SKILL.md files).
+ *
+ * Most CLI flows should prefer this over `configuredSkills` so they can
+ * surface warnings to the user.
  */
-export function configuredSkills(env = process.env, cwd) {
+export function configuredSkillsWithDiagnostics(env = process.env, cwd) {
     const configured = builtinSkills.filter((s) => isSkillConfigured(s, env));
-    const custom = discoverSkills(cwd);
+    const { skills: custom, warnings } = discoverSkillsWithDiagnostics(cwd);
     // Custom skills can override built-in IDs. When overriding, merge:
     // keep the built-in's tools and config, add the custom instruction/mcp.
     const configuredMap = new Map(configured.map((s) => [s.id, s]));
     for (const skill of custom) {
         const existing = configuredMap.get(skill.id);
         if (existing) {
-            // Merge: built-in tools + config, custom instruction/mcp + extra config
             configuredMap.set(skill.id, {
                 ...existing,
                 config: { ...existing.config, ...skill.config },
@@ -154,5 +220,14 @@ export function configuredSkills(env = process.env, cwd) {
             configuredMap.set(skill.id, skill);
         }
     }
-    return [...configuredMap.values()];
+    return { skills: [...configuredMap.values()], warnings };
+}
+/**
+ * From all builtins + custom repo skills, return only the skills that are usable.
+ *
+ * Backwards-compatible wrapper that drops diagnostics. Prefer
+ * `configuredSkillsWithDiagnostics` in CLI flows so broken skill files surface.
+ */
+export function configuredSkills(env = process.env, cwd) {
+    return configuredSkillsWithDiagnostics(env, cwd).skills;
 }

package/dist/skills/index.d.ts

@@ -69,8 +69,20 @@ export interface SkillValidationResult {
     /** Nodes where notification category has zero configured skills (non-fatal) */
     warnings: string[];
 }
+/**
+ * Minimal shape we need off an inline skill definition. Matches
+ * `SkillDefinition` from types.ts (kept loose here to avoid a cross-import
+ * that drags the full type graph into skill-index consumers).
+ */
+type InlineSkillDef = {
+    name?: string;
+    description?: string;
+    instruction?: string;
+    mcp?: unknown;
+    category?: SkillCategory;
+};
 export declare function validateWorkflowSkills(workflow: {
     nodes: Record<string, {
         skills: string[];
     }>;
-}, available: Map<string, Skill>): SkillValidationResult;
+}, available: Map<string, Skill>, inlineSkills?: Record<string, InlineSkillDef>): SkillValidationResult;

package/dist/skills/index.js

@@ -69,13 +69,18 @@ export function isSkillConfigured(skill, env = {}) {
 export function configuredBuiltinSkills(env = {}) {
     return builtinSkills.filter((s) => isSkillConfigured(s, env));
 }
-export function validateWorkflowSkills(workflow, available) {
+export function validateWorkflowSkills(workflow, available, inlineSkills) {
     const configured = [];
     const configuredIds = new Set();
     const missing = [];
     const missingIds = new Set();
     const errors = [];
     const warnings = [];
+    // Inline workflow.skills are first-class at runtime (the executor merges
+    // them into the skill map via mergeInlineSkills). Treat them as present
+    // for validation so spec-valid workflows don't fail CLI pre-flight.
+    const inlineIds = new Set(inlineSkills ? Object.keys(inlineSkills) : []);
+    const inlineCategory = (id) => inlineSkills?.[id]?.category ?? "general";
     // Collect all referenced skill IDs
     const allReferencedIds = new Set();
     for (const node of Object.values(workflow.nodes)) {
@@ -91,6 +96,10 @@ export function validateWorkflowSkills(workflow, available) {
                 configuredIds.add(id);
             }
         }
+        else if (inlineIds.has(id)) {
+            // Inline skills need no env vars and are auto-configured by the executor.
+            continue;
+        }
         else {
             if (!missingIds.has(id)) {
                 // Try to find it in builtins to get its category and required env vars
@@ -114,14 +123,14 @@ export function validateWorkflowSkills(workflow, available) {
         for (const id of node.skills) {
             const skill = available.get(id);
             const builtin = builtinSkills.find((s) => s.id === id);
-            const cat = skill?.category ?? builtin?.category ?? "unknown";
+            const cat = skill?.category ?? builtin?.category ?? (inlineIds.has(id) ? inlineCategory(id) : "unknown");
             if (!categoriesNeeded.has(cat))
                 categoriesNeeded.set(cat, []);
             categoriesNeeded.get(cat).push(id);
         }
         // Check each category has at least one configured skill
         for (const [cat, skillIds] of categoriesNeeded) {
-            const hasAny = skillIds.some((id) => available.has(id));
+            const hasAny = skillIds.some((id) => available.has(id) || inlineIds.has(id));
             if (!hasAny) {
                 const msg = `Node "${nodeId}" has no configured ${cat} providers (needs one of: ${skillIds.join(", ")})`;
                 if (cat === "notification") {

package/dist/studio.js

@@ -123,8 +123,11 @@ export function applyExecutionEvent(event, nodeDataMap) {
         case "node:exit": {
             const data = nodeDataMap.get(event.node);
             if (data) {
+                // NodeResult.status is already one of "success" | "failed" | "skipped";
+                // pass it through so Studio can render each distinctly. Previously
+                // collapsed skipped → failed (Fix #7).
                 data.exec = {
-                    status: event.result.status === "success" ? "success" : "failed",
+                    status: event.result.status,
                     result: event.result,
                 };
             }

package/dist/templates.d.ts

@@ -1,13 +1,15 @@
 /**
- * Template loading for issues and PRs.
+ * Template + rules/context loading for the CLI.
  *
- * Templates can come from:
+ * Templates and additional-context documents can come from:
  *   1. Local file path (relative to repo root)
  *   2. URL (fetched at runtime)
- *   3. Built-in defaults
+ *   3. Built-in defaults / inline text
  *
- * Delegates to sources.ts for actual resolution; this module provides
- * backwards-compatible wrappers with fallback semantics.
+ * Delegates to source-resolver.ts for the actual fetch. Fix #16: both
+ * `loadTemplate` and `loadAdditionalContext` now honor `offline` and
+ * `fetchAuth` the same way the executor's per-node Sources do, so CLI-level
+ * rules/context stay consistent with everything the executor touches later.
  */
 export declare const DEFAULT_ISSUE_TEMPLATE = "## Summary\n<!-- One-line description of the issue -->\n\n## Root Cause\n<!-- What caused this issue -->\n\n## Impact\n- **Severity**: <!-- critical / high / medium / low -->\n- **Affected Services**: <!-- list -->\n- **User Impact**: <!-- description -->\n\n## Steps to Reproduce\n1. ...\n\n## Recommended Fix\n<!-- Proposed solution -->\n\n## Related\n- Commits: <!-- relevant commits -->\n- PRs: <!-- related PRs -->\n";
 export declare const DEFAULT_PR_TEMPLATE = "## Summary\n<!-- What does this PR do? -->\n\n## Root Cause\n<!-- What caused the issue this fixes? -->\n\n## Changes\n<!-- Bullet list of changes -->\n\n## Testing\n- [ ] Tested locally\n- [ ] No breaking changes\n\n## Related Issues\nFixes #\n";
@@ -15,25 +17,44 @@ export interface Templates {
     issueTemplate: string;
     prTemplate: string;
 }
+/**
+ * Options shared by `loadTemplate` and `loadAdditionalContext`.
+ *
+ * `offline` and `fetchAuth` mirror the same knobs on the executor's
+ * `ExecuteOptions`, so CLI-preloaded rules/context resolve under the same
+ * policy as Sources resolved later by the executor.
+ */
+export interface SourceLoadOptions {
+    cwd?: string;
+    offline?: boolean;
+    /** Host → env-var-name map for URL Source authentication (Bearer). */
+    fetchAuth?: Record<string, string>;
+    /** Environment used to resolve `fetchAuth` env-var names. Defaults to process.env. */
+    env?: NodeJS.ProcessEnv;
+}
 /**
  * Load a template from a file path or URL.
  * Returns the default if source is empty or loading fails.
+ *
+ * Accepts the legacy `cwd?: string` signature for backward compat.
  */
-export declare function loadTemplate(source: string | undefined, fallback: string, cwd?: string): Promise<string>;
+export declare function loadTemplate(source: string | undefined, fallback: string, options?: SourceLoadOptions | string): Promise<string>;
 /**
  * Resolve issue and PR templates from config.
  */
 export declare function resolveTemplates(config: {
     issueTemplate?: string;
     prTemplate?: string;
-}, cwd?: string): Promise<Templates>;
+}, options?: SourceLoadOptions | string): Promise<Templates>;
 /**
  * Load additional context documents (local files, URLs, or inline text).
  * Each source is resolved eagerly (including URLs) and wrapped with a header.
  * Returns { resolved, urls } — resolved text for all sources; urls is kept
  * for API compat but will be empty since URLs now resolve eagerly.
+ *
+ * Accepts the legacy `cwd?: string` signature for backward compat.
  */
-export declare function loadAdditionalContext(sources: string[], cwd?: string): Promise<{
+export declare function loadAdditionalContext(sources: string[], options?: SourceLoadOptions | string): Promise<{
     resolved: string;
     urls: string[];
 }>;