@ra3orblade/swarm 0.11.2 → 0.12.0

package/dist/swarmd.js

@@ -731,36 +731,95 @@ function normalizeHook(event, raw, projectId, ts = new Date().toISOString()) {
 }
 // packages/core/src/art.ts
 var ROBOT = [
-  "       g       g       ",
-  "       X       X       ",
-  "       X       X       ",
-  "     ddddddddddddd     ",
-  "     dXXXXXXXXXXXd     ",
-  "     dggXXXXXXXXXd     ",
-  "   dddXXddXXXddXXddd   ",
-  "   dddXXddXXXddXXddd   ",
-  "   dddXXXXXXXXXXXddd   ",
-  "   dddXXdddddddXXddd   ",
-  "     dXXXXXXXXXXXd     ",
-  "     dXXXXXXXXXXXd     ",
-  "     ddddddddddddd     ",
-  "          XXX          ",
-  "         ddddd         ",
-  "      ddddddddddd      ",
-  "   dXXdggXXXXXXXdXXd   ",
-  "   dXXdXggggXddddXXd   ",
-  "   dXXdXggggXXXXdXXd   ",
-  "   dXXdXXXXXXddddXXd   ",
-  "   dXXdXXXXXXXXXdXXd   ",
-  "   dXXdXdddXXXXXdXXd   ",
-  "   ddddXXXXXXXXXdddd   ",
-  "      ddddddddddd      ",
-  "        XX   XX        ",
-  "        XX   XX        ",
-  "       XXXX XXXX       ",
-  "       dddd dddd       "
+  "                        MM                     MM                        ",
+  "                        LL                     LL                        ",
+  "                        LL                     LL                        ",
+  "                        LM                     MM                        ",
+  "                        MD                     MS                        ",
+  "                        LE                     LE                        ",
+  "                        ME                     ME                        ",
+  "                        MS                     MS                        ",
+  "                        KK                     KK                        ",
+  "                   SSDDDSDDDDDDDDDDDDDDDDDDDDDDDDDDDDS                   ",
+  "                   SSDSDDDDDDDDDDDDDDDDDDDDDDDDDDDDDSS                   ",
+  "                   SSDOOOOOOOOOOOOOOOOOOOOOOOOOOOOOKSS                   ",
+  "                   SSOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMOSS                   ",
+  "                   DDKMMLLLMLLMMMMMMMMMMMMMMMMMMMMMODD                   ",
+  "                   DDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
+  "              SSSSODDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSSSS              ",
+  "              SSSSODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSSSS              ",
+  "             SMMMMODDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSMMMS             ",
+  "             DMSSSODDOMMMMOOOOOOMMMMMMMMMOOOOOOMMMMODDOSSSED             ",
+  "             DSSSSODDOMMMMODDDDDMMMMMMMMMODDDDDMMMMODDOSSSSK             ",
+  "             DSMMSODDOMMMMDDDDDDMMMMMMMMMKDDDDDMMMMODDOSMMSK             ",
+  "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDOSSSSK             ",
+  "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSK             ",
+  "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSK             ",
+  "             DSSSKODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSD             ",
+  "             OKKKKODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOKKKKO             ",
+  "              KKKKODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOOKKK              ",
+  "              KKKOODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOOKKK              ",
+  "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
+  "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
+  "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
+  "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
+  "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
+  "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
+  "                   DDDOOOOOOOOOOOOOOOOOOOOOOOOOOOOOKDD                   ",
+  "                   DDDDDDDDDDDDDDDDDDDDDDDDDDDDDKDDDDD                   ",
+  "                   DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD                   ",
+  "                               OOOOOOOOOOO                               ",
+  "                               OODDDDDKKOO                               ",
+  "                               DSMMMMMMSDD                               ",
+  "                               OOOOOOOOOOO                               ",
+  "                              KDSMMMMMESSKK                              ",
+  "                   MMMMMMSSKOOKDSMMMMMSSSDKOODSEMMMMMM                   ",
+  "         SSSSDO   MMMMMMSSKKOOOOOOOOOOOOOOOOOKSSSMMMMMM   ODSSSS         ",
+  "        EEESSSSOOLLLLMMMMMESSSSSSSSSSSSSSSSSSSSMMMMMLLLLOOSSSSMME        ",
+  "       SMMSSSSKOEELLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLEEOOSSSSEMS       ",
+  "      DSSSSSSSOOSEEKSMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMSOEEDOOSSSSSSSK      ",
+  "      DSSSSSSDOOSEOSKEMMMMMMMMMMMMMMMMMMMMMMMMMMMMMEOSDEDOODSSSSSSK      ",
+  "      KSSSSSSKOODSSOSEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEESOEEDOOKSSSSSSK      ",
+  "      DKSSSSKKOODSMEEMLLLLLLLLLLLLLLLLLLLLLLLLLLLLLMSEMSDOOKKSSSSDK      ",
+  "      OKDDKDKKOOKSMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMSKOOKKKKKKKO      ",
+  "      OOOOOKKKOOKSMMMMESSSSSSSSSSSSSMMMMEEEEEESSSSEMMMMSKOOKKKOOOOO      ",
+  "      OOOOOOKKOOKSMMMSSKKKKKKKKKKKKKKMMMDKOOOOOOOODDMMMSKOOKKOOOOOO      ",
+  "      OKSSKOOOOOKSMMMKKMLLLLLLLLLLLMKMMMDDSSSSSSSSDDMMMSKOOOOODSSKO      ",
+  "      SDOKKK    KSMMMKDLLLLLLLLLLLLLKMMMKDKKKDDKKKDKMMMSK    KKKKDS      ",
+  "     DMLLMKO    KSMMMKDLLLLLLLLLLLLLKMMMDDDDDDDDDSKDMMMSK    ODMLLMD     ",
+  "     DELLMSD    KSMMMKKMLLLLLLLLLLLLKMMMDKKKKKKKKKDDMMMSK    DSMLLEO     ",
+  "    KSKKKKDO    KSMMMEDDDDKKDDDKKKDKSMMMDDDDDDDDDSDDMMMSK    ODDKKKSK    ",
+  "    EMLLMDO     KSMMMMLLLLLLLLLLLLLLLMMMDOOOOOOOOODDMMMSK     ODMLLME    ",
+  "    KMLLMSD     KSMMMMMMMMMMMMMMMMMMMMMMDDSSDDSSSSDDMMMSK     SSMLLEK    ",
+  "   KSKKKKSO     KSMMMMMOOMMOOMKOEMOOMMMMDOOOOOOOOODDMMMSK     OSKKKKSO   ",
+  "   SMLLMDO      KSMMMMMKKMMKKMDKEMKKMMMMKDDDDSSSSDDDMMMSK      ODMLLMS   ",
+  "   SMMMMSD      KSMMMMMEEMMEEMEEMMEEMMMMDSOOOOOOOODDMMSSK      DSMMMMD   ",
+  "   OOOOOOO      KSSMMMMMMMMMMMMMMMMMMMMMDDDDDDDDDDDDMSSSK      OOOOOOO   ",
+  " KSMLLLMMSKO    KSSSSMMMMMMMMMMMMMMMMMMMSOOOOOOOOOOSSSSSK    OKSMLLLLMSO ",
+  " DSMMMEEESKK    KSSKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSOSSK    KDSMMMMMESD ",
+  " DSMMMMMESKK    KSOOKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSOOKSK    KKSMMMMMMSD ",
+  " DSMMMMMESKK    OKSKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSDSKO    KDSMMMMMMSD ",
+  " KDDDDDDDDKK      KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK      KKDDDDDDDDO ",
+  " OOOOOOOOOOO         OOOOOOOOO             OOOOOOOOO         OOOOOOOOOOO ",
+  "DSDO     OSSO        ODKKKKKKK             OKKKKKKKO        KEDO     ODEK",
+  "SMDO     OSMD        KDSSSSSSK             KDSSSSSKO        SMDO     ODMS",
+  "DEKO     OOED         OOKKKOOO             OOOKKOOO         SSOO     OKMS",
+  "DEKO     OOED         SEMMMMSK             OSMMMMED         SSKO     OKES",
+  "DSSO     OESK         SEMMMMSK             OSMMMMED         KSSO     OSSK",
+  "KSMS     EEDO         OOKKKKKO             OOKKKKKO         OSEE     EMSO",
+  " DSS     SSK          OSEEESDO             ODSEEESO          KSS     SSD ",
+  " OOO     OO           SEMMMMSK             OSMMMMED           OO     OOO ",
+  "                      KSSSSSDO             OKSSESSK                      ",
+  "                   DKKDDDDDDKKDK         KDKDDDDDDDKDK                   ",
+  "                  SSMLLMMMMMMLMSK       DSSMMMMMMMLLMSS                  ",
+  "                  SMLMMMMMMMMLLED       SEMMMMMMMMMMLMS                  ",
+  "                 DMMMMMMMMMMMMMMD       SMMMMMMMMMMMMMSK                 ",
+  "                ODSSSSSSSSSSSSSSDO     ODSSSSSSSSSSSSSSKO                ",
+  "                OOOOOOOOOOOOOOOOO       OOOOOOOOOOOOOOOOO                ",
+  "                OKSSSSSSSSSSSSSSK       KSSSSSSSSSSSSSSKO                ",
+  "                OKDDDDDDDDDDDDDDK       KDDDDDDDDDDDDDDOO                "
 ];
-var ROBOT_HEAD = ROBOT.slice(0, 13);
+var HEAD = ROBOT.slice(0, 37);
 // packages/core/src/audit.ts
 var AUDIT_TYPES = new Set([
   "session.started",
@@ -771,6 +830,8 @@ var AUDIT_TYPES = new Set([
   "claim.released",
   "claim.expired",
   "claim.orphaned",
+  "claim.denied",
+  "rules.changed",
   "worktree.created",
   "worktree.removed",
   "worktree.bootstrapped",
@@ -2143,6 +2204,82 @@ function collisionGraph(rows, writeTools = WRITE_TOOLS) {
     contested: out.filter((f) => f.contested).length
   };
 }
+// packages/core/src/heat.ts
+var HEAT_DEFAULTS = {
+  floor: 2,
+  candidateSessions: 2,
+  candidateRereads: 3,
+  candidateWriteShare: 0.2,
+  top: 40
+};
+function dirOf(path) {
+  const i = path.lastIndexOf("/");
+  return i <= 0 ? i === 0 ? "/" : "." : path.slice(0, i);
+}
+function fileHeat(rows, opts = {}, writeTools = WRITE_TOOLS) {
+  const o = { ...HEAT_DEFAULTS, ...opts };
+  const files = new Map;
+  for (const r of rows) {
+    if (!r.path || !r.sessionId)
+      continue;
+    const f = files.get(r.path) ?? { touches: 0, reads: 0, writes: 0, perSession: new Map };
+    f.touches++;
+    if (writeTools.has(r.tool))
+      f.writes++;
+    else
+      f.reads++;
+    f.perSession.set(r.sessionId, (f.perSession.get(r.sessionId) ?? 0) + 1);
+    files.set(r.path, f);
+  }
+  const all = [...files.entries()].map(([path, f]) => {
+    const rereads = [...f.perSession.values()].reduce((n, c) => n + (c - 1), 0);
+    const writeShare = f.touches ? f.writes / f.touches : 0;
+    return {
+      path,
+      touches: f.touches,
+      sessions: f.perSession.size,
+      reads: f.reads,
+      writes: f.writes,
+      rereads,
+      candidate: f.perSession.size >= o.candidateSessions && rereads >= o.candidateRereads && writeShare <= o.candidateWriteShare
+    };
+  });
+  const byTouches = (a, b) => b.touches - a.touches || b.sessions - a.sessions || a.path.localeCompare(b.path);
+  const dirs = new Map;
+  for (const [path, f] of files) {
+    const d = dirOf(path);
+    const cur = dirs.get(d) ?? {
+      touches: 0,
+      writes: 0,
+      sessions: new Set,
+      files: new Set
+    };
+    cur.touches += f.touches;
+    cur.writes += f.writes;
+    cur.files.add(path);
+    for (const s of f.perSession.keys())
+      cur.sessions.add(s);
+    dirs.set(d, cur);
+  }
+  return {
+    files: all.filter((f) => f.touches >= o.floor).sort(byTouches).slice(0, o.top),
+    dirs: [...dirs.entries()].map(([dir, d]) => ({
+      dir,
+      touches: d.touches,
+      sessions: d.sessions.size,
+      files: d.files.size,
+      writes: d.writes
+    })).sort((a, b) => b.touches - a.touches || a.dir.localeCompare(b.dir)).slice(0, o.top),
+    candidates: all.filter((f) => f.candidate).sort((a, b) => b.rereads - a.rereads || byTouches(a, b)).slice(0, o.top),
+    totals: {
+      files: all.length,
+      touches: all.reduce((n, f) => n + f.touches, 0),
+      sessions: new Set(rows.filter((r) => r.path && r.sessionId).map((r) => r.sessionId)).size,
+      rereads: all.reduce((n, f) => n + f.rereads, 0),
+      cold: all.filter((f) => f.touches === 1).length
+    }
+  };
+}
 // packages/core/src/worktree.ts
 import { join as join3 } from "path";
 function planBootstrap(cfg, repoRoot, worktree) {
@@ -3307,6 +3444,107 @@ function formatOpenQuestions(qs) {
     return null;
   return `[swarm] waiting on a human for: ${open.map((q) => `#${q.id} "${q.text.slice(0, 120)}"`).join("; ")} \u2014 the answer arrives as context on a later tool call, or via swarm_inbox`;
 }
+// packages/core/src/resourcegraph.ts
+var nodeId = (kind, name, projectId) => `${kind}:${projectId ?? ""}:${name}`;
+function resourceGraph(held, wanted = [], now = Date.now()) {
+  const resources = new Map;
+  const holders = new Map;
+  for (const h of held) {
+    if (!h.name || !h.owner)
+      continue;
+    const id = nodeId(h.kind, h.name, h.projectId);
+    const expired = h.expiresAt ? Date.parse(h.expiresAt) < now : false;
+    const orphaned = Boolean(h.sessionEndedAt) || expired;
+    if (!resources.has(id))
+      resources.set(id, {
+        id,
+        kind: h.kind,
+        name: h.name,
+        holder: h.owner,
+        orphaned,
+        wanted: [],
+        projectId: h.projectId ?? null
+      });
+    const o = holders.get(h.owner) ?? { holds: 0, wants: 0, live: 0 };
+    o.holds++;
+    if (!orphaned)
+      o.live++;
+    holders.set(h.owner, o);
+  }
+  for (const w of wanted) {
+    if (!w.name || !w.owner)
+      continue;
+    const r = resources.get(nodeId(w.kind, w.name, w.projectId));
+    if (!r || r.holder === w.owner)
+      continue;
+    if (!r.wanted.includes(w.owner))
+      r.wanted.push(w.owner);
+    const o = holders.get(w.owner) ?? { holds: 0, wants: 0, live: 0 };
+    o.wants++;
+    holders.set(w.owner, o);
+  }
+  for (const r of resources.values())
+    r.wanted.sort();
+  const edges = [];
+  for (const r of [...resources.values()].sort((a, b) => a.id.localeCompare(b.id))) {
+    if (r.holder)
+      edges.push({ from: r.holder, to: r.id, kind: "holds" });
+    for (const w of r.wanted)
+      edges.push({ from: w, to: r.id, kind: "wants" });
+  }
+  const resourceList = [...resources.values()].sort((a, b) => Number(b.wanted.length > 0) - Number(a.wanted.length > 0) || Number(b.orphaned) - Number(a.orphaned) || a.id.localeCompare(b.id));
+  const holderList = [...holders.entries()].map(([id, o]) => ({ id, holds: o.holds, wants: o.wants, gone: o.holds > 0 && o.live === 0 })).sort((a, b) => b.holds + b.wants - (a.holds + a.wants) || a.id.localeCompare(b.id));
+  return {
+    holders: holderList,
+    resources: resourceList,
+    edges,
+    contention: findContention(resourceList),
+    totals: {
+      held: resourceList.length,
+      orphaned: resourceList.filter((r) => r.orphaned).length,
+      contested: resourceList.filter((r) => r.wanted.length > 0).length
+    }
+  };
+}
+function findContention(resources) {
+  const next = new Map;
+  for (const r of resources) {
+    if (!r.holder)
+      continue;
+    for (const w of r.wanted) {
+      const list = next.get(w) ?? [];
+      list.push({ to: r.holder, via: r.name });
+      next.set(w, list);
+    }
+  }
+  for (const list of next.values())
+    list.sort((a, b) => a.to.localeCompare(b.to) || a.via.localeCompare(b.via));
+  const found = new Map;
+  const walk = (start, at, owners, vias, depth) => {
+    if (depth > 6)
+      return;
+    for (const step of next.get(at) ?? []) {
+      if (step.to === start) {
+        const ring = [...owners];
+        const res = [...vias, step.via];
+        const pivot = ring.indexOf([...ring].sort()[0]);
+        const key = [...ring.slice(pivot), ...ring.slice(0, pivot)].join(">");
+        if (!found.has(key))
+          found.set(key, {
+            owners: [...ring.slice(pivot), ...ring.slice(0, pivot)],
+            resources: [...res.slice(pivot), ...res.slice(0, pivot)]
+          });
+        continue;
+      }
+      if (owners.includes(step.to))
+        continue;
+      walk(start, step.to, [...owners, step.to], [...vias, step.via], depth + 1);
+    }
+  };
+  for (const owner of [...next.keys()].sort())
+    walk(owner, owner, [owner], [], 0);
+  return [...found.values()].sort((a, b) => a.owners.length - b.owners.length || a.owners.join().localeCompare(b.owners.join()));
+}
 // packages/core/src/resources.ts
 var DEFAULT_RESOURCE_LEASE_MINUTES = 60;
 function isTrackedPid(pid) {
@@ -3440,6 +3678,202 @@ ${lines.join(`
 `)}` : ""}`
   };
 }
+// packages/core/src/ruleeffect.ts
+var DAY = 86400000;
+var dayOf = (iso) => iso.slice(0, 10);
+function commandSignature(command) {
+  const segments = (command ?? "").split(/&&|\|\||[;\n|]/).map((x) => x.trim()).filter(Boolean);
+  const first = segments.find((seg) => !/^(cd|pushd|export|source|\.)\b/.test(seg)) ?? segments[0] ?? "";
+  if (!first)
+    return "(none)";
+  const tokens = first.split(/\s+/).filter(Boolean);
+  const head = tokens[0] ?? "";
+  const name = head.includes("/") ? head.split("/").pop() ?? head : head;
+  const second = tokens[1];
+  const more = tokens.length > 2;
+  return `${name}${second ? ` ${second}` : ""}${more ? " \u2026" : ""}`;
+}
+function ruleEffect(incidents, changes = [], now = Date.now(), days3 = 30) {
+  const since = now - days3 * DAY;
+  const rows = incidents.filter((i) => i.rule && Date.parse(i.at) >= since);
+  const byRule = new Map;
+  for (const i of rows)
+    byRule.set(i.rule, [...byRule.get(i.rule) ?? [], i]);
+  const dayList = [];
+  for (let t = since;t <= now; t += DAY)
+    dayList.push(dayOf(new Date(t).toISOString()));
+  const rules = [...byRule.entries()].map(([rule, list]) => {
+    const sorted = [...list].sort((a, b) => a.at.localeCompare(b.at));
+    const counts = new Map;
+    for (const i of sorted)
+      counts.set(dayOf(i.at), (counts.get(dayOf(i.at)) ?? 0) + 1);
+    const perDay = dayList.map((day) => ({ day, n: counts.get(day) ?? 0 }));
+    const half = Math.floor(perDay.length / 2);
+    const early = perDay.slice(0, half).reduce((n, d) => n + d.n, 0);
+    const late = perDay.slice(half).reduce((n, d) => n + d.n, 0);
+    const trend = Math.abs(late - early) <= 1 ? "steady" : late > early ? "rising" : "falling";
+    const sig = new Map;
+    for (const i of sorted) {
+      const key = commandSignature(i.command);
+      const cur = sig.get(key) ?? { hits: 0, example: i.command };
+      cur.hits++;
+      sig.set(key, cur);
+    }
+    const clusters = [...sig.entries()].map(([signature, c]) => ({ signature, hits: c.hits, example: c.example })).sort((a, b) => b.hits - a.hits || a.signature.localeCompare(b.signature));
+    const added = changes.filter((c) => c.added.includes(rule) && Date.parse(c.at) >= since).sort((a, b) => b.at.localeCompare(a.at))[0];
+    let landed = null;
+    if (added) {
+      const at = Date.parse(added.at);
+      const beforeDays = Math.max(1, (at - since) / DAY);
+      const afterDays = Math.max(1, (now - at) / DAY);
+      landed = {
+        at: added.at,
+        beforePerDay: sorted.filter((i) => Date.parse(i.at) < at).length / beforeDays,
+        afterPerDay: sorted.filter((i) => Date.parse(i.at) >= at).length / afterDays
+      };
+    }
+    return {
+      rule,
+      total: sorted.length,
+      acked: sorted.filter((i) => i.acked).length,
+      firstAt: sorted[0].at,
+      lastAt: sorted.at(-1).at,
+      perDay,
+      trend,
+      concentration: sorted.length ? (clusters[0]?.hits ?? 0) / sorted.length : 0,
+      clusters: clusters.slice(0, 5),
+      landed
+    };
+  });
+  rules.sort((a, b) => b.total - a.total || a.rule.localeCompare(b.rule));
+  return {
+    rules,
+    totals: {
+      incidents: rows.length,
+      rules: rules.length,
+      acked: rows.filter((i) => i.acked).length,
+      unchanged: rules.filter((r) => r.trend !== "falling" && r.total > 1).length
+    },
+    noChangeHistory: !changes.some((c) => Date.parse(c.at) >= since)
+  };
+}
+// packages/core/src/security.ts
+var LOCAL = /^(localhost|127\.|0\.0\.0\.0|::1|\[::1\]|192\.168\.|10\.|172\.(1[6-9]|2\d|3[01])\.)/i;
+function hostsIn(text) {
+  const out = new Set;
+  for (const m of text.matchAll(/\bhttps?:\/\/(\[[^\]]+\][^/\s"'`)}>,;]*|[^/\s"'`)\]}>,;]+)/gi)) {
+    const hostPort = m[1].replace(/^[^@]*@/, "");
+    const bracket = /^\[([^\]]+)\]/.exec(hostPort);
+    const host = (bracket?.[1] ?? hostPort.split(":")[0]).toLowerCase();
+    if (host)
+      out.add(host);
+  }
+  return [...out].sort();
+}
+var INSTALLERS = [
+  { ecosystem: "npm", re: /^npm\s+(?:i|install|add)\b(.*)$/i },
+  { ecosystem: "pnpm", re: /^pnpm\s+(?:i|install|add)\b(.*)$/i },
+  { ecosystem: "yarn", re: /^yarn\s+add\b(.*)$/i },
+  { ecosystem: "bun", re: /^bun\s+(?:i|install|add)\b(.*)$/i },
+  { ecosystem: "pip", re: /^pip3?\s+install\b(.*)$/i },
+  { ecosystem: "cargo", re: /^cargo\s+(?:add|install)\b(.*)$/i },
+  { ecosystem: "go", re: /^go\s+(?:get|install)\b(.*)$/i },
+  { ecosystem: "gem", re: /^gem\s+install\b(.*)$/i },
+  { ecosystem: "brew", re: /^brew\s+install\b(.*)$/i },
+  { ecosystem: "apt", re: /^(?:sudo\s+)?apt(?:-get)?\s+install\b(.*)$/i }
+];
+var PKG_NAME = /^(@[\w.-]+\/)?[a-z0-9][\w.\-/]*([@=<>~^]=?[\w.\-^~*]+)?$/i;
+function installsIn(text) {
+  const out = [];
+  for (const raw of text.split(/&&|\|\||[;\n|]/)) {
+    const segment = raw.trim();
+    if (!segment)
+      continue;
+    for (const { ecosystem, re } of INSTALLERS) {
+      const m = re.exec(segment);
+      if (!m)
+        continue;
+      const args = [];
+      for (const tok of (m[1] ?? "").split(/\s+/)) {
+        const a = tok.trim();
+        if (!a)
+          continue;
+        if (/^\d*[<>&]/.test(a))
+          break;
+        if (a.startsWith("-"))
+          continue;
+        if (PKG_NAME.test(a))
+          args.push(a);
+      }
+      out.push(...args.length ? args.map((pkg) => ({ ecosystem, pkg })) : [{ ecosystem, pkg: "(from manifest)" }]);
+    }
+  }
+  return out;
+}
+var SECRETS = [
+  { what: ".env file", re: /(^|[/\s"'`])\.env(\.[\w-]+)?\b/i },
+  { what: "SSH private key", re: /(^|[/\s"'`])(id_rsa|id_ed25519|id_ecdsa|id_dsa)\b/i },
+  { what: "AWS credentials", re: /\.aws\/(credentials|config)\b/i },
+  { what: "npm token", re: /(^|[/\s"'`])\.npmrc\b/i },
+  { what: "kubeconfig", re: /\.kube\/config\b/i },
+  { what: "Google cloud credentials", re: /gcloud\/[\w-]*credential/i },
+  { what: "PEM or key file", re: /\.(pem|p12|pfx|key)\b/i },
+  { what: "macOS keychain", re: /\bsecurity\s+find-(generic|internet)-password\b/i },
+  { what: "netrc", re: /(^|[/\s"'`])\.netrc\b/i }
+];
+function secretsIn(text) {
+  return SECRETS.filter((s) => s.re.test(text)).map((s) => s.what);
+}
+function securityScan(rows) {
+  const egress = new Map;
+  const installs = new Map;
+  const secrets = new Map;
+  let scanned = 0;
+  for (const r of rows) {
+    if (!r.sessionId)
+      continue;
+    const text = `${r.command ?? ""} ${r.path ?? ""}`.trim();
+    if (!text)
+      continue;
+    scanned++;
+    for (const host of hostsIn(text)) {
+      const e = egress.get(host) ?? { hits: 0, sessions: new Set };
+      e.hits++;
+      e.sessions.add(r.sessionId);
+      egress.set(host, e);
+    }
+    for (const i of installsIn(r.command ?? "")) {
+      const key = `${i.ecosystem} ${i.pkg}`;
+      const cur = installs.get(key) ?? { ...i, hits: 0, sessions: new Set };
+      cur.hits++;
+      cur.sessions.add(r.sessionId);
+      installs.set(key, cur);
+    }
+    for (const what of secretsIn(text)) {
+      const cur = secrets.get(what) ?? { hits: 0, sessions: new Set };
+      cur.hits++;
+      cur.sessions.add(r.sessionId);
+      secrets.set(what, cur);
+    }
+  }
+  const egressList = [...egress.entries()].map(([host, e]) => ({
+    host,
+    hits: e.hits,
+    sessions: e.sessions.size,
+    local: LOCAL.test(host)
+  })).sort((a, b) => Number(a.local) - Number(b.local) || b.hits - a.hits || a.host.localeCompare(b.host));
+  return {
+    egress: egressList,
+    installs: [...installs.values()].map((i) => ({ ecosystem: i.ecosystem, pkg: i.pkg, hits: i.hits, sessions: i.sessions.size })).sort((a, b) => b.hits - a.hits || a.ecosystem.localeCompare(b.ecosystem) || a.pkg.localeCompare(b.pkg)),
+    secrets: [...secrets.entries()].map(([what, s]) => ({ what, hits: s.hits, sessions: s.sessions.size })).sort((a, b) => b.hits - a.hits || a.what.localeCompare(b.what)),
+    totals: {
+      scanned,
+      remoteHosts: egressList.filter((h) => !h.local).length,
+      installs: [...installs.values()].reduce((n, i) => n + i.hits, 0),
+      secrets: [...secrets.values()].reduce((n, s) => n + s.hits, 0)
+    }
+  };
+}
 // packages/core/src/stall.ts
 var STALL_DEFAULTS = { window: 12, repeat: 3, repeatErrors: 2, errors: 4 };
 function toolResponseErrored(resp) {
@@ -3671,6 +4105,70 @@ function clusterProjectKey(remoteUrl) {
     return null;
   return `${host}/${m[2]}`;
 }
+// packages/core/src/transitions.ts
+function transitionGraph(steps, { minWeight = 1 } = {}) {
+  const calls = new Map;
+  const selfLoops = new Map;
+  const edges = new Map;
+  const bySession = new Map;
+  let transitions = 0;
+  for (const s of steps) {
+    if (!s.sessionId || !s.tool)
+      continue;
+    calls.set(s.tool, (calls.get(s.tool) ?? 0) + 1);
+    const prev = bySession.get(s.sessionId);
+    if (prev !== undefined) {
+      const key = `${prev}\x00${s.tool}`;
+      const e = edges.get(key) ?? {
+        from: prev,
+        to: s.tool,
+        weight: 0,
+        sessions: new Set
+      };
+      e.weight++;
+      e.sessions.add(s.sessionId);
+      edges.set(key, e);
+      if (prev === s.tool)
+        selfLoops.set(s.tool, (selfLoops.get(s.tool) ?? 0) + 1);
+      transitions++;
+    }
+    bySession.set(s.sessionId, s.tool);
+  }
+  const edgeList = [...edges.values()].filter((e) => e.weight >= minWeight).map((e) => ({ from: e.from, to: e.to, weight: e.weight, sessions: e.sessions.size })).sort((a, b) => b.weight - a.weight || a.from.localeCompare(b.from) || a.to.localeCompare(b.to));
+  const nodeList = [...calls.entries()].map(([tool, n]) => ({ tool, calls: n, selfLoops: selfLoops.get(tool) ?? 0 })).sort((a, b) => b.calls - a.calls || a.tool.localeCompare(b.tool));
+  return {
+    nodes: nodeList,
+    edges: edgeList,
+    loops: findLoops(edgeList),
+    sessions: bySession.size,
+    steps: steps.filter((s) => s.sessionId && s.tool).length,
+    transitions
+  };
+}
+function findLoops(edges) {
+  const at = new Map(edges.map((e) => [`${e.from}\x00${e.to}`, e]));
+  const out = [];
+  const seen = new Set;
+  for (const e of edges) {
+    if (e.from === e.to) {
+      out.push({ tools: [e.from], weight: e.weight, sessions: e.sessions });
+      continue;
+    }
+    const back = at.get(`${e.to}\x00${e.from}`);
+    if (!back)
+      continue;
+    const pair = [e.from, e.to].sort().join("\x00");
+    if (seen.has(pair))
+      continue;
+    seen.add(pair);
+    out.push({
+      tools: [e.from, e.to],
+      weight: Math.min(e.weight, back.weight),
+      sessions: Math.max(e.sessions, back.sessions)
+    });
+  }
+  return out.sort((a, b) => b.weight - a.weight || a.tools.join().localeCompare(b.tools.join()));
+}
 // packages/core/src/waiting.ts
 var emptyByKind = () => ({
   permission: { episodes: 0, blockedMs: 0 },
@@ -7832,8 +8330,46 @@ ${err}
     const loaded = loadConfigDetailed({ repoRoot, home: this.home });
     this.policyCache.set(key, { at: Date.now(), loaded });
     this.writePolicyCache(loaded);
+    this.noteRuleChange(key, loaded.config.rules);
     return loaded;
   }
+  projectIdForRoot(root) {
+    if (!root)
+      return null;
+    const row = this.db.query("SELECT id FROM projects WHERE root = ?").get(root);
+    return row?.id ?? null;
+  }
+  noteRuleChange(key, rules2) {
+    const sig = JSON.stringify(Object.entries(rules2).sort());
+    const metaKey = `rules.sig:${key}`;
+    const prev = this.db.query("SELECT value FROM meta WHERE key = ?").get(metaKey)?.value;
+    if (prev === sig)
+      return;
+    this.db.query("INSERT OR REPLACE INTO meta (key, value) VALUES (?, ?)").run(metaKey, sig);
+    if (prev === undefined)
+      return;
+    const before = new Map(JSON.parse(prev));
+    const after = new Map(Object.entries(rules2));
+    const added = [...after.keys()].filter((r) => !before.has(r)).sort();
+    const removed = [...before.keys()].filter((r) => !after.has(r)).sort();
+    const retuned = [...after.entries()].filter(([r, mode]) => before.has(r) && before.get(r) !== mode).map(([r, mode]) => `${r}=${mode}`).sort();
+    if (!added.length && !removed.length && !retuned.length)
+      return;
+    this.append({
+      ts: new Date().toISOString(),
+      type: "rules.changed",
+      projectId: this.projectIdForRoot(key) ?? "",
+      sessionId: null,
+      payload: {
+        repo: key || null,
+        added,
+        removed,
+        retuned,
+        rules: [...after.keys()].sort(),
+        summary: `rules changed${added.length ? ` +${added.join(",")}` : ""}${removed.length ? ` -${removed.join(",")}` : ""}${retuned.length ? ` ~${retuned.join(",")}` : ""}`
+      }
+    });
+  }
   writePolicyCache(loaded) {
     const file = join8(this.home, POLICY_CACHE_FILE);
     try {
@@ -8869,8 +9405,24 @@ ${p2.reason ?? ""}`.trim(),
       return { ok: false, error: "unknown project" };
     const now = Date.now();
     const decision = canClaim(this.claimRows(projectId), task, owner, now);
-    if (!decision.ok)
+    if (!decision.ok) {
+      if (decision.heldBy !== owner)
+        this.append({
+          ts: new Date(now).toISOString(),
+          type: "claim.denied",
+          projectId,
+          sessionId,
+          actor: this.actorFor(owner, sessionId),
+          payload: {
+            task,
+            owner,
+            heldBy: decision.heldBy,
+            until: decision.until,
+            summary: `${owner} was refused ${task} \u2014 held by ${decision.heldBy}`
+          }
+        });
       return { ok: false, error: claimRefusalMessage(decision, task) };
+    }
     const branch = `task/${task}`;
     const worktree2 = this.worktreePath(projectId, task);
     if (existsSync6(worktree2))
@@ -9432,6 +9984,110 @@ ${p2.reason ?? ""}`.trim(),
       })
     };
   }
+  transitions(projectId, days3 = 7, minWeight = 1) {
+    const since = new Date(Date.now() - days3 * 86400000).toISOString();
+    const rows = this.db.query(`SELECT session_id, json_extract(payload,'$.tool') AS tool
+         FROM events
+         WHERE type = 'tool.requested' AND ts >= ?
+           AND json_extract(payload,'$.tool') IS NOT NULL${projectId ? " AND project_id = ?" : ""}
+         ORDER BY session_id, seq`).all(...projectId ? [since, projectId] : [since]);
+    return transitionGraph(rows.map((r) => ({ sessionId: r.session_id ?? "", tool: r.tool ?? "" })), { minWeight });
+  }
+  resourceHolding(projectId, days3 = 3) {
+    const since = new Date(Date.now() - days3 * 86400000).toISOString();
+    const p = projectId ? " AND c.project_id = ?" : "";
+    const args = projectId ? [projectId] : [];
+    const ended = new Map(this.db.query("SELECT id, ended_at FROM sessions WHERE ended_at IS NOT NULL").all().map((r) => [r.id, r.ended_at]));
+    const claims = this.db.query(`SELECT c.task AS name, c.owner, c.project_id, c.expires_at, c.actor_id AS session_id
+         FROM claims c WHERE c.state = 'held' AND c.released_at IS NULL${p}`).all(...args);
+    const resources2 = this.db.query(`SELECT c.name, c.owner, c.project_id, c.expires_at, c.session_id, c.port
+         FROM resources c WHERE c.released = 0${p}`).all(...args);
+    const procs = this.db.query(`SELECT c.name, c.owner, c.project_id, c.session_id, c.port
+         FROM processes c WHERE c.ended_at IS NULL${p}`).all(...args);
+    const denials = this.db.query(`SELECT json_extract(payload,'$.task') AS name, json_extract(payload,'$.owner') AS owner,
+                json_extract(payload,'$.heldBy') AS held_by, ts, project_id
+         FROM events WHERE type = 'claim.denied' AND ts >= ?${projectId ? " AND project_id = ?" : ""}`).all(since, ...args);
+    const held = [
+      ...claims.map((r) => ({
+        kind: "claim",
+        name: r.name,
+        owner: r.owner,
+        sessionId: r.session_id,
+        sessionEndedAt: r.session_id ? ended.get(r.session_id) ?? null : null,
+        expiresAt: r.expires_at,
+        projectId: r.project_id
+      })),
+      ...resources2.map((r) => ({
+        kind: r.port ? "port" : "lease",
+        name: r.port ? String(r.port) : r.name,
+        owner: r.owner ?? "unknown",
+        sessionId: r.session_id,
+        sessionEndedAt: r.session_id ? ended.get(r.session_id) ?? null : null,
+        expiresAt: r.expires_at,
+        projectId: r.project_id
+      })),
+      ...procs.map((r) => ({
+        kind: "process",
+        name: r.name ?? (r.port ? `:${r.port}` : "process"),
+        owner: r.owner ?? "unknown",
+        sessionId: r.session_id,
+        sessionEndedAt: r.session_id ? ended.get(r.session_id) ?? null : null,
+        expiresAt: null,
+        projectId: r.project_id
+      }))
+    ];
+    const wanted = denials.filter((d) => d.name && d.owner && d.held_by).map((d) => ({
+      kind: "claim",
+      name: d.name,
+      owner: d.owner,
+      heldBy: d.held_by,
+      at: d.ts,
+      projectId: d.project_id
+    }));
+    return resourceGraph(held, wanted);
+  }
+  fileHeat(projectId, days3 = 14) {
+    const since = new Date(Date.now() - days3 * 86400000).toISOString();
+    const rows = this.db.query(`SELECT session_id, json_extract(payload,'$.tool') AS tool,
+                json_extract(payload,'$.toolInput.file_path') AS path
+         FROM events
+         WHERE type = 'tool.requested' AND ts >= ?
+           AND json_extract(payload,'$.toolInput.file_path') IS NOT NULL${projectId ? " AND project_id = ?" : ""}`).all(...projectId ? [since, projectId] : [since]);
+    return fileHeat(rows.map((r) => ({ sessionId: r.session_id ?? "", tool: r.tool ?? "", path: r.path ?? "" })));
+  }
+  security(projectId, days3 = 14) {
+    const since = new Date(Date.now() - days3 * 86400000).toISOString();
+    const rows = this.db.query(`SELECT session_id, ts, json_extract(payload,'$.tool') AS tool,
+                COALESCE(json_extract(payload,'$.toolInput.command'),
+                         json_extract(payload,'$.toolInput.url'), '') AS command,
+                json_extract(payload,'$.toolInput.file_path') AS path
+         FROM events
+         WHERE type = 'tool.requested' AND ts >= ?${projectId ? " AND project_id = ?" : ""}`).all(...projectId ? [since, projectId] : [since]);
+    return securityScan(rows.map((r) => ({
+      sessionId: r.session_id ?? "",
+      tool: r.tool ?? "",
+      command: r.command ?? "",
+      path: r.path,
+      at: r.ts
+    })));
+  }
+  ruleEffect(projectId, days3 = 30) {
+    const since = new Date(Date.now() - days3 * 86400000).toISOString();
+    const rows = this.db.query(`SELECT e.seq, e.ts,
+                json_extract(e.payload,'$.rule') AS rule,
+                COALESCE(json_extract(e.payload,'$.command'), '') AS command,
+                (a.seq IS NOT NULL) AS acked
+         FROM events e LEFT JOIN incident_acks a ON a.seq = e.seq
+         WHERE e.type = 'incident.opened' AND e.ts >= ?${projectId ? " AND e.project_id = ?" : ""}`).all(...projectId ? [since, projectId] : [since]);
+    const changes = this.db.query(`SELECT ts, COALESCE(json_extract(payload,'$.added'), '[]') AS added
+         FROM events WHERE type = 'rules.changed' AND ts >= ?`).all(since);
+    return ruleEffect(rows.map((r) => ({
+      rule: r.rule ?? "",
+      command: r.command ?? "",
+      at: r.ts,
+      acked: Boolean(r.acked)
+    })), changes.map((c) => ({ at: c.ts, added: JSON.parse(c.added) })), Date.now(), days3);
+  }
   stalls = new Map;
   checkStalls() {
     const live = this.db.query("SELECT id, project_id FROM sessions WHERE state IN ('active','waiting') AND ended_at IS NULL AND last_seen_at >= ?").all(new Date(Date.now() - IDLE_MS).toISOString());
@@ -11061,7 +11717,7 @@ class WorkflowEngine {
 }
 
 // packages/daemon/src/app.ts
-var VERSION = "0.11.2";
+var VERSION = "0.12.0";
 var WEB_DIR = (() => {
   if (process.env.SWARM_WEB_DIR)
     return process.env.SWARM_WEB_DIR;
@@ -11188,6 +11844,11 @@ function createApp(store = new Store, hooks2 = {}) {
   app.get("/v1/stats", (c) => c.json(store.stats(c.req.query("project") || undefined)));
   app.get("/v1/graphs/collisions", (c) => c.json(store.collisions(c.req.query("project") || undefined)));
   app.get("/v1/graphs/lineage", (c) => c.json(store.lineage(c.req.query("project") || undefined, Math.max(1, Math.min(90, Number(c.req.query("days") ?? 14) || 14)), c.req.queries("expand") ?? [])));
+  app.get("/v1/rules/effect", (c) => c.json(store.ruleEffect(c.req.query("project") || undefined, Math.max(1, Math.min(365, Number(c.req.query("days") ?? 30) || 30)))));
+  app.get("/v1/security", (c) => c.json(store.security(c.req.query("project") || undefined, Math.max(1, Math.min(90, Number(c.req.query("days") ?? 14) || 14)))));
+  app.get("/v1/heat", (c) => c.json(store.fileHeat(c.req.query("project") || undefined, Math.max(1, Math.min(90, Number(c.req.query("days") ?? 14) || 14)))));
+  app.get("/v1/graphs/resources", (c) => c.json(store.resourceHolding(c.req.query("project") || undefined, Math.max(1, Math.min(30, Number(c.req.query("days") ?? 3) || 3)))));
+  app.get("/v1/graphs/transitions", (c) => c.json(store.transitions(c.req.query("project") || undefined, Math.max(1, Math.min(90, Number(c.req.query("days") ?? 7) || 7)), Math.max(1, Math.min(50, Number(c.req.query("min") ?? 2) || 2)))));
   app.get("/v1/context", (c) => c.json(store.context(c.req.query("project") || undefined, Math.max(1, Math.min(90, Number(c.req.query("days") ?? 7) || 7)))));
   app.get("/v1/mcp/health", (c) => c.json(store.mcpHealth(c.req.query("project") || undefined, Math.max(1, Math.min(90, Number(c.req.query("days") ?? 7) || 7)))));
   app.get("/v1/hygiene", (c) => c.json(store.hygiene(c.req.query("project") || undefined)));