@ra3orblade/swarm 0.11.3 → 0.12.1

package/dist/swarmd.js

@@ -830,6 +830,9 @@ var AUDIT_TYPES = new Set([
   "claim.released",
   "claim.expired",
   "claim.orphaned",
+  "claim.denied",
+  "rules.changed",
+  "worktree.reclaimed",
   "worktree.created",
   "worktree.removed",
   "worktree.bootstrapped",
@@ -2202,6 +2205,82 @@ function collisionGraph(rows, writeTools = WRITE_TOOLS) {
     contested: out.filter((f) => f.contested).length
   };
 }
+// packages/core/src/heat.ts
+var HEAT_DEFAULTS = {
+  floor: 2,
+  candidateSessions: 2,
+  candidateRereads: 3,
+  candidateWriteShare: 0.2,
+  top: 40
+};
+function dirOf(path) {
+  const i = path.lastIndexOf("/");
+  return i <= 0 ? i === 0 ? "/" : "." : path.slice(0, i);
+}
+function fileHeat(rows, opts = {}, writeTools = WRITE_TOOLS) {
+  const o = { ...HEAT_DEFAULTS, ...opts };
+  const files = new Map;
+  for (const r of rows) {
+    if (!r.path || !r.sessionId)
+      continue;
+    const f = files.get(r.path) ?? { touches: 0, reads: 0, writes: 0, perSession: new Map };
+    f.touches++;
+    if (writeTools.has(r.tool))
+      f.writes++;
+    else
+      f.reads++;
+    f.perSession.set(r.sessionId, (f.perSession.get(r.sessionId) ?? 0) + 1);
+    files.set(r.path, f);
+  }
+  const all = [...files.entries()].map(([path, f]) => {
+    const rereads = [...f.perSession.values()].reduce((n, c) => n + (c - 1), 0);
+    const writeShare = f.touches ? f.writes / f.touches : 0;
+    return {
+      path,
+      touches: f.touches,
+      sessions: f.perSession.size,
+      reads: f.reads,
+      writes: f.writes,
+      rereads,
+      candidate: f.perSession.size >= o.candidateSessions && rereads >= o.candidateRereads && writeShare <= o.candidateWriteShare
+    };
+  });
+  const byTouches = (a, b) => b.touches - a.touches || b.sessions - a.sessions || a.path.localeCompare(b.path);
+  const dirs = new Map;
+  for (const [path, f] of files) {
+    const d = dirOf(path);
+    const cur = dirs.get(d) ?? {
+      touches: 0,
+      writes: 0,
+      sessions: new Set,
+      files: new Set
+    };
+    cur.touches += f.touches;
+    cur.writes += f.writes;
+    cur.files.add(path);
+    for (const s of f.perSession.keys())
+      cur.sessions.add(s);
+    dirs.set(d, cur);
+  }
+  return {
+    files: all.filter((f) => f.touches >= o.floor).sort(byTouches).slice(0, o.top),
+    dirs: [...dirs.entries()].map(([dir, d]) => ({
+      dir,
+      touches: d.touches,
+      sessions: d.sessions.size,
+      files: d.files.size,
+      writes: d.writes
+    })).sort((a, b) => b.touches - a.touches || a.dir.localeCompare(b.dir)).slice(0, o.top),
+    candidates: all.filter((f) => f.candidate).sort((a, b) => b.rereads - a.rereads || byTouches(a, b)).slice(0, o.top),
+    totals: {
+      files: all.length,
+      touches: all.reduce((n, f) => n + f.touches, 0),
+      sessions: new Set(rows.filter((r) => r.path && r.sessionId).map((r) => r.sessionId)).size,
+      rereads: all.reduce((n, f) => n + f.rereads, 0),
+      cold: all.filter((f) => f.touches === 1).length
+    }
+  };
+}
 // packages/core/src/worktree.ts
 import { join as join3 } from "path";
 function planBootstrap(cfg, repoRoot, worktree) {
@@ -2278,7 +2357,7 @@ function planGc(worktrees, claims) {
 
 // packages/core/src/hygiene.ts
 var HYGIENE_DEFAULTS = {
-  staleDays: 7,
+  staleDays: 2,
   abandonedDays: 30,
   hungryRssKb: 1024 * 1024,
   heavyKb: 2 * 1024 * 1024
@@ -2309,6 +2388,30 @@ function classifyProcess(p, opts = {}) {
     };
   return { ...p, issue: null, note: null, reclaimable: false };
 }
+var BUILD_DIRS = ["node_modules", "target", "dist", ".next", ".turbo"];
+function reclaimPlan(w, dirs, others = []) {
+  const refusals = [];
+  if (w.main)
+    refusals.push("this is the main checkout");
+  if (w.liveSessions > 0)
+    refusals.push(`${w.liveSessions} live session${w.liveSessions === 1 ? "" : "s"} in it`);
+  if (w.heldByClaim)
+    refusals.push(`claimed by ${w.heldByClaim}`);
+  const inside = dirs.filter((d) => d.path.startsWith(`${w.path}/`));
+  if (inside.length !== dirs.length)
+    refusals.push("a candidate lay outside the worktree");
+  const named = inside.filter((d) => BUILD_DIRS.includes(d.path.split("/").pop() ?? ""));
+  if (named.length !== inside.length)
+    refusals.push("a candidate was not a build directory");
+  const nested = others.filter((o) => o !== w.path && o.startsWith(`${w.path}/`));
+  const mine = named.filter((d) => !nested.some((n) => d.path.startsWith(`${n}/`)));
+  return {
+    path: w.path,
+    dirs: mine.map((d) => d.path),
+    kb: mine.reduce((n, d) => n + d.kb, 0),
+    refusals
+  };
+}
 function classifyWorktree(w, opts = {}) {
   const o = { ...HYGIENE_DEFAULTS, ...opts };
   const kb = w.diskKb ?? 0;
@@ -3366,6 +3469,107 @@ function formatOpenQuestions(qs) {
     return null;
   return `[swarm] waiting on a human for: ${open.map((q) => `#${q.id} "${q.text.slice(0, 120)}"`).join("; ")} \u2014 the answer arrives as context on a later tool call, or via swarm_inbox`;
 }
+// packages/core/src/resourcegraph.ts
+var nodeId = (kind, name, projectId) => `${kind}:${projectId ?? ""}:${name}`;
+function resourceGraph(held, wanted = [], now = Date.now()) {
+  const resources = new Map;
+  const holders = new Map;
+  for (const h of held) {
+    if (!h.name || !h.owner)
+      continue;
+    const id = nodeId(h.kind, h.name, h.projectId);
+    const expired = h.expiresAt ? Date.parse(h.expiresAt) < now : false;
+    const orphaned = Boolean(h.sessionEndedAt) || expired;
+    if (!resources.has(id))
+      resources.set(id, {
+        id,
+        kind: h.kind,
+        name: h.name,
+        holder: h.owner,
+        orphaned,
+        wanted: [],
+        projectId: h.projectId ?? null
+      });
+    const o = holders.get(h.owner) ?? { holds: 0, wants: 0, live: 0 };
+    o.holds++;
+    if (!orphaned)
+      o.live++;
+    holders.set(h.owner, o);
+  }
+  for (const w of wanted) {
+    if (!w.name || !w.owner)
+      continue;
+    const r = resources.get(nodeId(w.kind, w.name, w.projectId));
+    if (!r || r.holder === w.owner)
+      continue;
+    if (!r.wanted.includes(w.owner))
+      r.wanted.push(w.owner);
+    const o = holders.get(w.owner) ?? { holds: 0, wants: 0, live: 0 };
+    o.wants++;
+    holders.set(w.owner, o);
+  }
+  for (const r of resources.values())
+    r.wanted.sort();
+  const edges = [];
+  for (const r of [...resources.values()].sort((a, b) => a.id.localeCompare(b.id))) {
+    if (r.holder)
+      edges.push({ from: r.holder, to: r.id, kind: "holds" });
+    for (const w of r.wanted)
+      edges.push({ from: w, to: r.id, kind: "wants" });
+  }
+  const resourceList = [...resources.values()].sort((a, b) => Number(b.wanted.length > 0) - Number(a.wanted.length > 0) || Number(b.orphaned) - Number(a.orphaned) || a.id.localeCompare(b.id));
+  const holderList = [...holders.entries()].map(([id, o]) => ({ id, holds: o.holds, wants: o.wants, gone: o.holds > 0 && o.live === 0 })).sort((a, b) => b.holds + b.wants - (a.holds + a.wants) || a.id.localeCompare(b.id));
+  return {
+    holders: holderList,
+    resources: resourceList,
+    edges,
+    contention: findContention(resourceList),
+    totals: {
+      held: resourceList.length,
+      orphaned: resourceList.filter((r) => r.orphaned).length,
+      contested: resourceList.filter((r) => r.wanted.length > 0).length
+    }
+  };
+}
+function findContention(resources) {
+  const next = new Map;
+  for (const r of resources) {
+    if (!r.holder)
+      continue;
+    for (const w of r.wanted) {
+      const list = next.get(w) ?? [];
+      list.push({ to: r.holder, via: r.name });
+      next.set(w, list);
+    }
+  }
+  for (const list of next.values())
+    list.sort((a, b) => a.to.localeCompare(b.to) || a.via.localeCompare(b.via));
+  const found = new Map;
+  const walk = (start, at, owners, vias, depth) => {
+    if (depth > 6)
+      return;
+    for (const step of next.get(at) ?? []) {
+      if (step.to === start) {
+        const ring = [...owners];
+        const res = [...vias, step.via];
+        const pivot = ring.indexOf([...ring].sort()[0]);
+        const key = [...ring.slice(pivot), ...ring.slice(0, pivot)].join(">");
+        if (!found.has(key))
+          found.set(key, {
+            owners: [...ring.slice(pivot), ...ring.slice(0, pivot)],
+            resources: [...res.slice(pivot), ...res.slice(0, pivot)]
+          });
+        continue;
+      }
+      if (owners.includes(step.to))
+        continue;
+      walk(start, step.to, [...owners, step.to], [...vias, step.via], depth + 1);
+    }
+  };
+  for (const owner of [...next.keys()].sort())
+    walk(owner, owner, [owner], [], 0);
+  return [...found.values()].sort((a, b) => a.owners.length - b.owners.length || a.owners.join().localeCompare(b.owners.join()));
+}
 // packages/core/src/resources.ts
 var DEFAULT_RESOURCE_LEASE_MINUTES = 60;
 function isTrackedPid(pid) {
@@ -3499,6 +3703,202 @@ ${lines.join(`
 `)}` : ""}`
   };
 }
+// packages/core/src/ruleeffect.ts
+var DAY = 86400000;
+var dayOf = (iso) => iso.slice(0, 10);
+function commandSignature(command) {
+  const segments = (command ?? "").split(/&&|\|\||[;\n|]/).map((x) => x.trim()).filter(Boolean);
+  const first = segments.find((seg) => !/^(cd|pushd|export|source|\.)\b/.test(seg)) ?? segments[0] ?? "";
+  if (!first)
+    return "(none)";
+  const tokens = first.split(/\s+/).filter(Boolean);
+  const head = tokens[0] ?? "";
+  const name = head.includes("/") ? head.split("/").pop() ?? head : head;
+  const second = tokens[1];
+  const more = tokens.length > 2;
+  return `${name}${second ? ` ${second}` : ""}${more ? " \u2026" : ""}`;
+}
+function ruleEffect(incidents, changes = [], now = Date.now(), days3 = 30) {
+  const since = now - days3 * DAY;
+  const rows = incidents.filter((i) => i.rule && Date.parse(i.at) >= since);
+  const byRule = new Map;
+  for (const i of rows)
+    byRule.set(i.rule, [...byRule.get(i.rule) ?? [], i]);
+  const dayList = [];
+  for (let t = since;t <= now; t += DAY)
+    dayList.push(dayOf(new Date(t).toISOString()));
+  const rules = [...byRule.entries()].map(([rule, list]) => {
+    const sorted = [...list].sort((a, b) => a.at.localeCompare(b.at));
+    const counts = new Map;
+    for (const i of sorted)
+      counts.set(dayOf(i.at), (counts.get(dayOf(i.at)) ?? 0) + 1);
+    const perDay = dayList.map((day) => ({ day, n: counts.get(day) ?? 0 }));
+    const half = Math.floor(perDay.length / 2);
+    const early = perDay.slice(0, half).reduce((n, d) => n + d.n, 0);
+    const late = perDay.slice(half).reduce((n, d) => n + d.n, 0);
+    const trend = Math.abs(late - early) <= 1 ? "steady" : late > early ? "rising" : "falling";
+    const sig = new Map;
+    for (const i of sorted) {
+      const key = commandSignature(i.command);
+      const cur = sig.get(key) ?? { hits: 0, example: i.command };
+      cur.hits++;
+      sig.set(key, cur);
+    }
+    const clusters = [...sig.entries()].map(([signature, c]) => ({ signature, hits: c.hits, example: c.example })).sort((a, b) => b.hits - a.hits || a.signature.localeCompare(b.signature));
+    const added = changes.filter((c) => c.added.includes(rule) && Date.parse(c.at) >= since).sort((a, b) => b.at.localeCompare(a.at))[0];
+    let landed = null;
+    if (added) {
+      const at = Date.parse(added.at);
+      const beforeDays = Math.max(1, (at - since) / DAY);
+      const afterDays = Math.max(1, (now - at) / DAY);
+      landed = {
+        at: added.at,
+        beforePerDay: sorted.filter((i) => Date.parse(i.at) < at).length / beforeDays,
+        afterPerDay: sorted.filter((i) => Date.parse(i.at) >= at).length / afterDays
+      };
+    }
+    return {
+      rule,
+      total: sorted.length,
+      acked: sorted.filter((i) => i.acked).length,
+      firstAt: sorted[0].at,
+      lastAt: sorted.at(-1).at,
+      perDay,
+      trend,
+      concentration: sorted.length ? (clusters[0]?.hits ?? 0) / sorted.length : 0,
+      clusters: clusters.slice(0, 5),
+      landed
+    };
+  });
+  rules.sort((a, b) => b.total - a.total || a.rule.localeCompare(b.rule));
+  return {
+    rules,
+    totals: {
+      incidents: rows.length,
+      rules: rules.length,
+      acked: rows.filter((i) => i.acked).length,
+      unchanged: rules.filter((r) => r.trend !== "falling" && r.total > 1).length
+    },
+    noChangeHistory: !changes.some((c) => Date.parse(c.at) >= since)
+  };
+}
+// packages/core/src/security.ts
+var LOCAL = /^(localhost|127\.|0\.0\.0\.0|::1|\[::1\]|192\.168\.|10\.|172\.(1[6-9]|2\d|3[01])\.)/i;
+function hostsIn(text) {
+  const out = new Set;
+  for (const m of text.matchAll(/\bhttps?:\/\/(\[[^\]]+\][^/\s"'`)}>,;]*|[^/\s"'`)\]}>,;]+)/gi)) {
+    const hostPort = m[1].replace(/^[^@]*@/, "");
+    const bracket = /^\[([^\]]+)\]/.exec(hostPort);
+    const host = (bracket?.[1] ?? hostPort.split(":")[0]).toLowerCase();
+    if (host)
+      out.add(host);
+  }
+  return [...out].sort();
+}
+var INSTALLERS = [
+  { ecosystem: "npm", re: /^npm\s+(?:i|install|add)\b(.*)$/i },
+  { ecosystem: "pnpm", re: /^pnpm\s+(?:i|install|add)\b(.*)$/i },
+  { ecosystem: "yarn", re: /^yarn\s+add\b(.*)$/i },
+  { ecosystem: "bun", re: /^bun\s+(?:i|install|add)\b(.*)$/i },
+  { ecosystem: "pip", re: /^pip3?\s+install\b(.*)$/i },
+  { ecosystem: "cargo", re: /^cargo\s+(?:add|install)\b(.*)$/i },
+  { ecosystem: "go", re: /^go\s+(?:get|install)\b(.*)$/i },
+  { ecosystem: "gem", re: /^gem\s+install\b(.*)$/i },
+  { ecosystem: "brew", re: /^brew\s+install\b(.*)$/i },
+  { ecosystem: "apt", re: /^(?:sudo\s+)?apt(?:-get)?\s+install\b(.*)$/i }
+];
+var PKG_NAME = /^(@[\w.-]+\/)?[a-z0-9][\w.\-/]*([@=<>~^]=?[\w.\-^~*]+)?$/i;
+function installsIn(text) {
+  const out = [];
+  for (const raw of text.split(/&&|\|\||[;\n|]/)) {
+    const segment = raw.trim();
+    if (!segment)
+      continue;
+    for (const { ecosystem, re } of INSTALLERS) {
+      const m = re.exec(segment);
+      if (!m)
+        continue;
+      const args = [];
+      for (const tok of (m[1] ?? "").split(/\s+/)) {
+        const a = tok.trim();
+        if (!a)
+          continue;
+        if (/^\d*[<>&]/.test(a))
+          break;
+        if (a.startsWith("-"))
+          continue;
+        if (PKG_NAME.test(a))
+          args.push(a);
+      }
+      out.push(...args.length ? args.map((pkg) => ({ ecosystem, pkg })) : [{ ecosystem, pkg: "(from manifest)" }]);
+    }
+  }
+  return out;
+}
+var SECRETS = [
+  { what: ".env file", re: /(^|[/\s"'`])\.env(\.[\w-]+)?\b/i },
+  { what: "SSH private key", re: /(^|[/\s"'`])(id_rsa|id_ed25519|id_ecdsa|id_dsa)\b/i },
+  { what: "AWS credentials", re: /\.aws\/(credentials|config)\b/i },
+  { what: "npm token", re: /(^|[/\s"'`])\.npmrc\b/i },
+  { what: "kubeconfig", re: /\.kube\/config\b/i },
+  { what: "Google cloud credentials", re: /gcloud\/[\w-]*credential/i },
+  { what: "PEM or key file", re: /\.(pem|p12|pfx|key)\b/i },
+  { what: "macOS keychain", re: /\bsecurity\s+find-(generic|internet)-password\b/i },
+  { what: "netrc", re: /(^|[/\s"'`])\.netrc\b/i }
+];
+function secretsIn(text) {
+  return SECRETS.filter((s) => s.re.test(text)).map((s) => s.what);
+}
+function securityScan(rows) {
+  const egress = new Map;
+  const installs = new Map;
+  const secrets = new Map;
+  let scanned = 0;
+  for (const r of rows) {
+    if (!r.sessionId)
+      continue;
+    const text = `${r.command ?? ""} ${r.path ?? ""}`.trim();
+    if (!text)
+      continue;
+    scanned++;
+    for (const host of hostsIn(text)) {
+      const e = egress.get(host) ?? { hits: 0, sessions: new Set };
+      e.hits++;
+      e.sessions.add(r.sessionId);
+      egress.set(host, e);
+    }
+    for (const i of installsIn(r.command ?? "")) {
+      const key = `${i.ecosystem} ${i.pkg}`;
+      const cur = installs.get(key) ?? { ...i, hits: 0, sessions: new Set };
+      cur.hits++;
+      cur.sessions.add(r.sessionId);
+      installs.set(key, cur);
+    }
+    for (const what of secretsIn(text)) {
+      const cur = secrets.get(what) ?? { hits: 0, sessions: new Set };
+      cur.hits++;
+      cur.sessions.add(r.sessionId);
+      secrets.set(what, cur);
+    }
+  }
+  const egressList = [...egress.entries()].map(([host, e]) => ({
+    host,
+    hits: e.hits,
+    sessions: e.sessions.size,
+    local: LOCAL.test(host)
+  })).sort((a, b) => Number(a.local) - Number(b.local) || b.hits - a.hits || a.host.localeCompare(b.host));
+  return {
+    egress: egressList,
+    installs: [...installs.values()].map((i) => ({ ecosystem: i.ecosystem, pkg: i.pkg, hits: i.hits, sessions: i.sessions.size })).sort((a, b) => b.hits - a.hits || a.ecosystem.localeCompare(b.ecosystem) || a.pkg.localeCompare(b.pkg)),
+    secrets: [...secrets.entries()].map(([what, s]) => ({ what, hits: s.hits, sessions: s.sessions.size })).sort((a, b) => b.hits - a.hits || a.what.localeCompare(b.what)),
+    totals: {
+      scanned,
+      remoteHosts: egressList.filter((h) => !h.local).length,
+      installs: [...installs.values()].reduce((n, i) => n + i.hits, 0),
+      secrets: [...secrets.values()].reduce((n, s) => n + s.hits, 0)
+    }
+  };
+}
 // packages/core/src/stall.ts
 var STALL_DEFAULTS = { window: 12, repeat: 3, repeatErrors: 2, errors: 4 };
 function toolResponseErrored(resp) {
@@ -3730,6 +4130,70 @@ function clusterProjectKey(remoteUrl) {
     return null;
   return `${host}/${m[2]}`;
 }
+// packages/core/src/transitions.ts
+function transitionGraph(steps, { minWeight = 1 } = {}) {
+  const calls = new Map;
+  const selfLoops = new Map;
+  const edges = new Map;
+  const bySession = new Map;
+  let transitions = 0;
+  for (const s of steps) {
+    if (!s.sessionId || !s.tool)
+      continue;
+    calls.set(s.tool, (calls.get(s.tool) ?? 0) + 1);
+    const prev = bySession.get(s.sessionId);
+    if (prev !== undefined) {
+      const key = `${prev}\x00${s.tool}`;
+      const e = edges.get(key) ?? {
+        from: prev,
+        to: s.tool,
+        weight: 0,
+        sessions: new Set
+      };
+      e.weight++;
+      e.sessions.add(s.sessionId);
+      edges.set(key, e);
+      if (prev === s.tool)
+        selfLoops.set(s.tool, (selfLoops.get(s.tool) ?? 0) + 1);
+      transitions++;
+    }
+    bySession.set(s.sessionId, s.tool);
+  }
+  const edgeList = [...edges.values()].filter((e) => e.weight >= minWeight).map((e) => ({ from: e.from, to: e.to, weight: e.weight, sessions: e.sessions.size })).sort((a, b) => b.weight - a.weight || a.from.localeCompare(b.from) || a.to.localeCompare(b.to));
+  const nodeList = [...calls.entries()].map(([tool, n]) => ({ tool, calls: n, selfLoops: selfLoops.get(tool) ?? 0 })).sort((a, b) => b.calls - a.calls || a.tool.localeCompare(b.tool));
+  return {
+    nodes: nodeList,
+    edges: edgeList,
+    loops: findLoops(edgeList),
+    sessions: bySession.size,
+    steps: steps.filter((s) => s.sessionId && s.tool).length,
+    transitions
+  };
+}
+function findLoops(edges) {
+  const at = new Map(edges.map((e) => [`${e.from}\x00${e.to}`, e]));
+  const out = [];
+  const seen = new Set;
+  for (const e of edges) {
+    if (e.from === e.to) {
+      out.push({ tools: [e.from], weight: e.weight, sessions: e.sessions });
+      continue;
+    }
+    const back = at.get(`${e.to}\x00${e.from}`);
+    if (!back)
+      continue;
+    const pair = [e.from, e.to].sort().join("\x00");
+    if (seen.has(pair))
+      continue;
+    seen.add(pair);
+    out.push({
+      tools: [e.from, e.to],
+      weight: Math.min(e.weight, back.weight),
+      sessions: Math.max(e.sessions, back.sessions)
+    });
+  }
+  return out.sort((a, b) => b.weight - a.weight || a.tools.join().localeCompare(b.tools.join()));
+}
 // packages/core/src/waiting.ts
 var emptyByKind = () => ({
   permission: { episodes: 0, blockedMs: 0 },
@@ -6028,12 +6492,19 @@ function applyStatus(w, st, ah) {
   const a = ah?.trim();
   w.ahead = a === undefined || a === "" ? -1 : Number(a);
 }
-function applyDrift(w, behind, ancestor, firstParents) {
+function applyDrift(w, behind, ancestor, firstParents, cherry = null) {
   const b = behind?.trim();
   w.behind = b === undefined || b === "" ? -1 : Number(b);
   const onLine = firstParents?.split(`
 `).some((sha) => sha.startsWith(w.head)) ?? true;
-  w.merged = ancestor && !onLine;
+  w.merged = (ancestor || squashed(cherry)) && !onLine;
+}
+function squashed(cherry) {
+  if (!cherry)
+    return false;
+  const lines = cherry.split(`
+`).filter((l) => l.trim());
+  return lines.length > 0 && lines.every((l) => l.startsWith("-"));
 }
 var FIRST_PARENT_DEPTH = "5000";
 var baseOf = (wts) => wts[0]?.main ? wts[0].branch : null;
@@ -6055,15 +6526,16 @@ async function listWorktreesAsync(root) {
   const line = base ? await gitAsync(root, ["rev-list", "--first-parent", "-n", FIRST_PARENT_DEPTH, base]) : null;
   await Promise.all(wts.map(async (w) => {
     const drift = base && !w.main;
-    const [st, ah, be, mg] = await Promise.all([
+    const [st, ah, be, mg, ch] = await Promise.all([
       gitAsync(w.path, ["status", "--porcelain", "--untracked-files=no"]),
       gitAsync(w.path, ["rev-list", "--count", "@{upstream}..HEAD"]),
       drift ? gitAsync(w.path, ["rev-list", "--count", `HEAD..${base}`]) : null,
-      drift ? gitAsync(w.path, ["merge-base", "--is-ancestor", "HEAD", base]) : null
+      drift ? gitAsync(w.path, ["merge-base", "--is-ancestor", "HEAD", base]) : null,
+      drift ? gitAsync(w.path, ["cherry", base, "HEAD"]) : null
     ]);
     applyStatus(w, st, ah);
     if (drift)
-      applyDrift(w, be, mg !== null, line);
+      applyDrift(w, be, mg !== null, line, ch);
   }));
   return wts;
 }
@@ -6533,6 +7005,7 @@ import {
   readSync,
   realpathSync as realpathSync2,
   renameSync,
+  rmSync as rmSync2,
   statSync,
   unlinkSync,
   writeFileSync as writeFileSync2
@@ -7891,8 +8364,46 @@ ${err}
     const loaded = loadConfigDetailed({ repoRoot, home: this.home });
     this.policyCache.set(key, { at: Date.now(), loaded });
     this.writePolicyCache(loaded);
+    this.noteRuleChange(key, loaded.config.rules);
     return loaded;
   }
+  projectIdForRoot(root) {
+    if (!root)
+      return null;
+    const row = this.db.query("SELECT id FROM projects WHERE root = ?").get(root);
+    return row?.id ?? null;
+  }
+  noteRuleChange(key, rules2) {
+    const sig = JSON.stringify(Object.entries(rules2).sort());
+    const metaKey = `rules.sig:${key}`;
+    const prev = this.db.query("SELECT value FROM meta WHERE key = ?").get(metaKey)?.value;
+    if (prev === sig)
+      return;
+    this.db.query("INSERT OR REPLACE INTO meta (key, value) VALUES (?, ?)").run(metaKey, sig);
+    if (prev === undefined)
+      return;
+    const before = new Map(JSON.parse(prev));
+    const after = new Map(Object.entries(rules2));
+    const added = [...after.keys()].filter((r) => !before.has(r)).sort();
+    const removed = [...before.keys()].filter((r) => !after.has(r)).sort();
+    const retuned = [...after.entries()].filter(([r, mode]) => before.has(r) && before.get(r) !== mode).map(([r, mode]) => `${r}=${mode}`).sort();
+    if (!added.length && !removed.length && !retuned.length)
+      return;
+    this.append({
+      ts: new Date().toISOString(),
+      type: "rules.changed",
+      projectId: this.projectIdForRoot(key) ?? "",
+      sessionId: null,
+      payload: {
+        repo: key || null,
+        added,
+        removed,
+        retuned,
+        rules: [...after.keys()].sort(),
+        summary: `rules changed${added.length ? ` +${added.join(",")}` : ""}${removed.length ? ` -${removed.join(",")}` : ""}${retuned.length ? ` ~${retuned.join(",")}` : ""}`
+      }
+    });
+  }
   writePolicyCache(loaded) {
     const file = join8(this.home, POLICY_CACHE_FILE);
     try {
@@ -8928,8 +9439,24 @@ ${p2.reason ?? ""}`.trim(),
       return { ok: false, error: "unknown project" };
     const now = Date.now();
     const decision = canClaim(this.claimRows(projectId), task, owner, now);
-    if (!decision.ok)
+    if (!decision.ok) {
+      if (decision.heldBy !== owner)
+        this.append({
+          ts: new Date(now).toISOString(),
+          type: "claim.denied",
+          projectId,
+          sessionId,
+          actor: this.actorFor(owner, sessionId),
+          payload: {
+            task,
+            owner,
+            heldBy: decision.heldBy,
+            until: decision.until,
+            summary: `${owner} was refused ${task} \u2014 held by ${decision.heldBy}`
+          }
+        });
       return { ok: false, error: claimRefusalMessage(decision, task) };
+    }
     const branch = `task/${task}`;
     const worktree2 = this.worktreePath(projectId, task);
     if (existsSync6(worktree2))
@@ -9129,7 +9656,34 @@ ${p2.reason ?? ""}`.trim(),
     return newest ? Math.max(0, Date.now() - newest) : null;
   }
   duCache = new Map;
+  buildCache = new Map;
   duInflight = null;
+  async measureBuild(path) {
+    const args = ["-maxdepth", "4", "("];
+    BUILD_DIRS.forEach((d, i) => {
+      if (i)
+        args.push("-o");
+      args.push("-name", d);
+    });
+    args.push(")", "-type", "d", "-prune");
+    const out = [];
+    try {
+      const find = Bun.spawn(["find", path, ...args], { stdout: "pipe", stderr: "ignore" });
+      const found = (await new Response(find.stdout).text()).split(`
+`).filter(Boolean);
+      await find.exited;
+      for (const dir of found) {
+        const du = Bun.spawn(["du", "-sk", "-x", dir], { stdout: "pipe", stderr: "ignore" });
+        const text = await new Response(du.stdout).text();
+        if (await du.exited === 0) {
+          const kb = Number.parseInt(text.trim().split(/\s+/)[0] ?? "", 10);
+          if (Number.isFinite(kb))
+            out.push({ path: dir, kb });
+        }
+      }
+    } catch {}
+    return out;
+  }
   refreshDisk(paths, ttlMs) {
     if (this.duInflight)
       return;
@@ -9152,6 +9706,7 @@ ${p2.reason ?? ""}`.trim(),
           }
         } catch {}
         this.duCache.set(path, { v, t: Date.now() });
+        this.buildCache.set(path, { dirs: await this.measureBuild(path), t: Date.now() });
       }
     })().finally(() => {
       this.duInflight = null;
@@ -9211,6 +9766,7 @@ ${p2.reason ?? ""}`.trim(),
           merged: w.merged,
           idleMs: Store.worktreeIdleMs(w.path),
           diskKb: this.duCache.get(w.path)?.v ?? null,
+          buildKb: this.buildCache.has(w.path) ? this.buildCache.get(w.path).dirs.reduce((n, d) => n + d.kb, 0) : null,
           heldByClaim: held?.task ?? null,
           liveSessions: this.sessions().filter((s) => s.cwd?.startsWith(w.path) && !s.endedAt && s.state !== "ended").length
         });
@@ -9491,6 +10047,151 @@ ${p2.reason ?? ""}`.trim(),
       })
     };
   }
+  transitions(projectId, days3 = 7, minWeight = 1) {
+    const since = new Date(Date.now() - days3 * 86400000).toISOString();
+    const rows = this.db.query(`SELECT session_id, json_extract(payload,'$.tool') AS tool
+         FROM events
+         WHERE type = 'tool.requested' AND ts >= ?
+           AND json_extract(payload,'$.tool') IS NOT NULL${projectId ? " AND project_id = ?" : ""}
+         ORDER BY session_id, seq`).all(...projectId ? [since, projectId] : [since]);
+    return transitionGraph(rows.map((r) => ({ sessionId: r.session_id ?? "", tool: r.tool ?? "" })), { minWeight });
+  }
+  resourceHolding(projectId, days3 = 3) {
+    const since = new Date(Date.now() - days3 * 86400000).toISOString();
+    const p = projectId ? " AND c.project_id = ?" : "";
+    const args = projectId ? [projectId] : [];
+    const ended = new Map(this.db.query("SELECT id, ended_at FROM sessions WHERE ended_at IS NOT NULL").all().map((r) => [r.id, r.ended_at]));
+    const claims = this.db.query(`SELECT c.task AS name, c.owner, c.project_id, c.expires_at, c.actor_id AS session_id
+         FROM claims c WHERE c.state = 'held' AND c.released_at IS NULL${p}`).all(...args);
+    const resources2 = this.db.query(`SELECT c.name, c.owner, c.project_id, c.expires_at, c.session_id, c.port
+         FROM resources c WHERE c.released = 0${p}`).all(...args);
+    const procs = this.db.query(`SELECT c.name, c.owner, c.project_id, c.session_id, c.port
+         FROM processes c WHERE c.ended_at IS NULL${p}`).all(...args);
+    const denials = this.db.query(`SELECT json_extract(payload,'$.task') AS name, json_extract(payload,'$.owner') AS owner,
+                json_extract(payload,'$.heldBy') AS held_by, ts, project_id
+         FROM events WHERE type = 'claim.denied' AND ts >= ?${projectId ? " AND project_id = ?" : ""}`).all(since, ...args);
+    const held = [
+      ...claims.map((r) => ({
+        kind: "claim",
+        name: r.name,
+        owner: r.owner,
+        sessionId: r.session_id,
+        sessionEndedAt: r.session_id ? ended.get(r.session_id) ?? null : null,
+        expiresAt: r.expires_at,
+        projectId: r.project_id
+      })),
+      ...resources2.map((r) => ({
+        kind: r.port ? "port" : "lease",
+        name: r.port ? String(r.port) : r.name,
+        owner: r.owner ?? "unknown",
+        sessionId: r.session_id,
+        sessionEndedAt: r.session_id ? ended.get(r.session_id) ?? null : null,
+        expiresAt: r.expires_at,
+        projectId: r.project_id
+      })),
+      ...procs.map((r) => ({
+        kind: "process",
+        name: r.name ?? (r.port ? `:${r.port}` : "process"),
+        owner: r.owner ?? "unknown",
+        sessionId: r.session_id,
+        sessionEndedAt: r.session_id ? ended.get(r.session_id) ?? null : null,
+        expiresAt: null,
+        projectId: r.project_id
+      }))
+    ];
+    const wanted = denials.filter((d) => d.name && d.owner && d.held_by).map((d) => ({
+      kind: "claim",
+      name: d.name,
+      owner: d.owner,
+      heldBy: d.held_by,
+      at: d.ts,
+      projectId: d.project_id
+    }));
+    return resourceGraph(held, wanted);
+  }
+  fileHeat(projectId, days3 = 14) {
+    const since = new Date(Date.now() - days3 * 86400000).toISOString();
+    const rows = this.db.query(`SELECT session_id, json_extract(payload,'$.tool') AS tool,
+                json_extract(payload,'$.toolInput.file_path') AS path
+         FROM events
+         WHERE type = 'tool.requested' AND ts >= ?
+           AND json_extract(payload,'$.toolInput.file_path') IS NOT NULL${projectId ? " AND project_id = ?" : ""}`).all(...projectId ? [since, projectId] : [since]);
+    return fileHeat(rows.map((r) => ({ sessionId: r.session_id ?? "", tool: r.tool ?? "", path: r.path ?? "" })));
+  }
+  security(projectId, days3 = 14) {
+    const since = new Date(Date.now() - days3 * 86400000).toISOString();
+    const rows = this.db.query(`SELECT session_id, ts, json_extract(payload,'$.tool') AS tool,
+                COALESCE(json_extract(payload,'$.toolInput.command'),
+                         json_extract(payload,'$.toolInput.url'), '') AS command,
+                json_extract(payload,'$.toolInput.file_path') AS path
+         FROM events
+         WHERE type = 'tool.requested' AND ts >= ?${projectId ? " AND project_id = ?" : ""}`).all(...projectId ? [since, projectId] : [since]);
+    return securityScan(rows.map((r) => ({
+      sessionId: r.session_id ?? "",
+      tool: r.tool ?? "",
+      command: r.command ?? "",
+      path: r.path,
+      at: r.ts
+    })));
+  }
+  ruleEffect(projectId, days3 = 30) {
+    const since = new Date(Date.now() - days3 * 86400000).toISOString();
+    const rows = this.db.query(`SELECT e.seq, e.ts,
+                json_extract(e.payload,'$.rule') AS rule,
+                COALESCE(json_extract(e.payload,'$.command'), '') AS command,
+                (a.seq IS NOT NULL) AS acked
+         FROM events e LEFT JOIN incident_acks a ON a.seq = e.seq
+         WHERE e.type = 'incident.opened' AND e.ts >= ?${projectId ? " AND e.project_id = ?" : ""}`).all(...projectId ? [since, projectId] : [since]);
+    const changes = this.db.query(`SELECT ts, COALESCE(json_extract(payload,'$.added'), '[]') AS added
+         FROM events WHERE type = 'rules.changed' AND ts >= ?`).all(since);
+    return ruleEffect(rows.map((r) => ({
+      rule: r.rule ?? "",
+      command: r.command ?? "",
+      at: r.ts,
+      acked: Boolean(r.acked)
+    })), changes.map((c) => ({ at: c.ts, added: JSON.parse(c.added) })), Date.now(), days3);
+  }
+  reclaimBuild(path, { dryRun = false } = {}) {
+    const report = this.hygiene();
+    const w = report.worktrees.find((x) => x.path === path);
+    if (!w)
+      return { ok: false, error: `not a tracked worktree: ${path}` };
+    const cached = this.buildCache.get(path);
+    if (!cached)
+      return { ok: false, error: "not measured yet \u2014 try again in a moment" };
+    const plan = reclaimPlan(w, cached.dirs, report.worktrees.map((x) => x.path));
+    if (plan.refusals.length)
+      return { ok: false, error: plan.refusals.join("; "), plan };
+    if (dryRun)
+      return { ok: true, plan, removed: 0, freedKb: 0 };
+    let removed = 0;
+    let freedKb = 0;
+    for (const dir of plan.dirs) {
+      if (!dir.startsWith(`${path}/`))
+        continue;
+      try {
+        rmSync2(dir, { recursive: true, force: true });
+        removed++;
+        freedKb += cached.dirs.find((d) => d.path === dir)?.kb ?? 0;
+      } catch {}
+    }
+    this.duCache.delete(path);
+    this.buildCache.delete(path);
+    this.append({
+      ts: new Date().toISOString(),
+      type: "worktree.reclaimed",
+      projectId: w.projectId,
+      sessionId: null,
+      payload: {
+        path,
+        branch: w.branch,
+        dirs: removed,
+        freedKb,
+        summary: `reclaimed ${Math.round(freedKb / 1024)} MB of build output from ${w.branch ?? path}`
+      }
+    });
+    return { ok: true, plan, removed, freedKb };
+  }
   stalls = new Map;
   checkStalls() {
     const live = this.db.query("SELECT id, project_id FROM sessions WHERE state IN ('active','waiting') AND ended_at IS NULL AND last_seen_at >= ?").all(new Date(Date.now() - IDLE_MS).toISOString());
@@ -11120,7 +11821,7 @@ class WorkflowEngine {
 }
 
 // packages/daemon/src/app.ts
-var VERSION = "0.11.3";
+var VERSION = "0.12.1";
 var WEB_DIR = (() => {
   if (process.env.SWARM_WEB_DIR)
     return process.env.SWARM_WEB_DIR;
@@ -11247,6 +11948,18 @@ function createApp(store = new Store, hooks2 = {}) {
   app.get("/v1/stats", (c) => c.json(store.stats(c.req.query("project") || undefined)));
   app.get("/v1/graphs/collisions", (c) => c.json(store.collisions(c.req.query("project") || undefined)));
   app.get("/v1/graphs/lineage", (c) => c.json(store.lineage(c.req.query("project") || undefined, Math.max(1, Math.min(90, Number(c.req.query("days") ?? 14) || 14)), c.req.queries("expand") ?? [])));
+  app.get("/v1/rules/effect", (c) => c.json(store.ruleEffect(c.req.query("project") || undefined, Math.max(1, Math.min(365, Number(c.req.query("days") ?? 30) || 30)))));
+  app.post("/v1/hygiene/reclaim", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    if (!body.path)
+      return c.json({ ok: false, error: "path required" }, 400);
+    const r = store.reclaimBuild(body.path, { dryRun: Boolean(body.dry) });
+    return c.json(r, r.ok ? 200 : 409);
+  });
+  app.get("/v1/security", (c) => c.json(store.security(c.req.query("project") || undefined, Math.max(1, Math.min(90, Number(c.req.query("days") ?? 14) || 14)))));
+  app.get("/v1/heat", (c) => c.json(store.fileHeat(c.req.query("project") || undefined, Math.max(1, Math.min(90, Number(c.req.query("days") ?? 14) || 14)))));
+  app.get("/v1/graphs/resources", (c) => c.json(store.resourceHolding(c.req.query("project") || undefined, Math.max(1, Math.min(30, Number(c.req.query("days") ?? 3) || 3)))));
+  app.get("/v1/graphs/transitions", (c) => c.json(store.transitions(c.req.query("project") || undefined, Math.max(1, Math.min(90, Number(c.req.query("days") ?? 7) || 7)), Math.max(1, Math.min(50, Number(c.req.query("min") ?? 2) || 2)))));
   app.get("/v1/context", (c) => c.json(store.context(c.req.query("project") || undefined, Math.max(1, Math.min(90, Number(c.req.query("days") ?? 7) || 7)))));
   app.get("/v1/mcp/health", (c) => c.json(store.mcpHealth(c.req.query("project") || undefined, Math.max(1, Math.min(90, Number(c.req.query("days") ?? 7) || 7)))));
   app.get("/v1/hygiene", (c) => c.json(store.hygiene(c.req.query("project") || undefined)));