@ra3orblade/swarm 0.13.2 → 0.14.0

package/dist/swarmd.js

@@ -15,7 +15,8 @@ var SRC = {
   swarm: "cli",
   swarmd: "daemon",
   "swarm-hook": "hook",
-  "swarm-mcp": "mcp"
+  "swarm-mcp": "mcp",
+  "swarm-teamd": "team"
 };
 function resolveBin(name, from = import.meta.url) {
   const here = dirname(fileURLToPath(from));
@@ -360,9 +361,14 @@ function parseTranscriptChunk(chunk) {
 }
 
 // packages/core/src/adapters/codex/rollout.ts
-function parseCodexRollout(chunk) {
-  const out = { turns: [], sessionId: null, cwd: null, model: null, title: null };
-  let n = 0;
+function parseCodexRollout(chunk, sessionIdHint) {
+  const out = {
+    turns: [],
+    sessionId: sessionIdHint ?? null,
+    cwd: null,
+    model: null,
+    title: null
+  };
   let text = "";
   let tools = [];
   let lastTs = "";
@@ -400,9 +406,10 @@ function parseCodexRollout(chunk) {
         if (!u)
           continue;
         const cacheRead = u.cached_input_tokens ?? 0;
+        const ts = d.timestamp ?? (lastTs || new Date(0).toISOString());
         const turn = {
-          id: `${out.sessionId ?? "codex"}-t${n}`,
-          ts: d.timestamp ?? (lastTs || new Date(0).toISOString()),
+          id: `${out.sessionId ?? "codex"}-${ts}-${u.input_tokens ?? 0}-${cacheRead}-${u.output_tokens ?? 0}-${u.reasoning_output_tokens ?? 0}`,
+          ts,
           model: out.model ?? "gpt-5",
           usage: {
             input: Math.max(0, (u.input_tokens ?? 0) - cacheRead),
@@ -418,7 +425,6 @@ function parseCodexRollout(chunk) {
           sidechain: false
         };
         out.turns.push(turn);
-        n++;
         text = "";
         tools = [];
       }
@@ -443,8 +449,14 @@ function partText(content) {
   }
   return out.slice(0, 400);
 }
-function parseGeminiChat(chunk) {
-  const out = { turns: [], sessionId: null, model: null, cwd: null, title: null };
+function parseGeminiChat(chunk, sessionIdHint) {
+  const out = {
+    turns: [],
+    sessionId: sessionIdHint ?? null,
+    model: null,
+    cwd: null,
+    title: null
+  };
   let subagent = false;
   for (const raw of chunk.split(`
 `)) {
@@ -634,7 +646,8 @@ var HOOK_EVENTS = [
   "Stop",
   "SessionEnd",
   "Notification",
-  "PreCompact"
+  "PreCompact",
+  "PermissionRequest"
 ];
 var MAP = {
   SessionStart: "session.started",
@@ -646,8 +659,20 @@ var MAP = {
   Stop: "agent.text",
   SessionEnd: "session.ended",
   Notification: "session.notification",
-  PreCompact: "agent.text"
+  PreCompact: "agent.text",
+  PermissionRequest: "permission.requested"
 };
+function permissionReason(raw) {
+  const sug = raw.permission_suggestions;
+  if (Array.isArray(sug)) {
+    for (const x of sug) {
+      const r = x?.reasoning;
+      if (typeof r === "string" && r.trim())
+        return r.trim();
+    }
+  }
+  return `Claude Code is asking before it runs this (${typeof raw.permission_mode === "string" ? raw.permission_mode : "default"} mode)`;
+}
 function summarizeToolInput(tool, input) {
   const i = input ?? {};
   const s = (v) => typeof v === "string" ? v : JSON.stringify(v ?? "");
@@ -711,10 +736,20 @@ function normalizeHook(event, raw, projectId, ts = new Date().toISOString()) {
     case "PreCompact":
       summary = "context compaction";
       break;
+    case "PermissionRequest":
+      summary = `permission: ${tool ?? "?"} ${summarizeToolInput(tool, raw.tool_input)}`.trim();
+      break;
     default:
       summary = event;
   }
   const payload = { hook: event, cwd: raw.cwd ?? null, summary };
+  if (event === "PermissionRequest") {
+    if (typeof raw.tool_use_id === "string")
+      payload.requestId = raw.tool_use_id;
+    payload.display = summarizeToolInput(tool, raw.tool_input);
+    payload.reason = permissionReason(raw);
+    payload.source = "interactive";
+  }
   if (tool)
     payload.tool = tool;
   if (raw.tool_input !== undefined)
@@ -848,6 +883,8 @@ var AUDIT_TYPES = new Set([
   "process.started",
   "process.exited",
   "gate.recorded",
+  "gate.blocked",
+  "codify.applied",
   "handoff.recorded",
   "permission.requested",
   "permission.resolved",
@@ -1027,6 +1064,31 @@ function runProfile(name) {
     return null;
   return RUN_PROFILES[name] ?? null;
 }
+// packages/core/src/collision-context.ts
+var DEFAULT_COLLISION_WINDOW_MIN = 15;
+function ago(ms) {
+  const m = Math.floor(ms / 60000);
+  if (m < 1)
+    return "moments ago";
+  if (m === 1)
+    return "a minute ago";
+  return `${m} minutes ago`;
+}
+function collisionWarning(path, sessionId, edits, live, now, windowMs) {
+  const others = edits.filter((e) => e.sessionId !== sessionId && now - e.at <= windowMs && live.has(e.sessionId)).sort((a, b) => b.at - a.at).map((e) => ({ ...live.get(e.sessionId), agoMs: now - e.at }));
+  if (!others.length)
+    return null;
+  const who = others.map((o) => {
+    const name = o.title ? `"${o.title}"` : `session ${o.sessionId.slice(0, 8)}`;
+    const where = [o.task ? `task ${o.task}` : null, o.branch ? `branch ${o.branch}` : null].filter(Boolean).join(", ");
+    return `${name}${where ? ` (${where})` : ""} ${ago(o.agoMs)}`;
+  }).join("; ");
+  return {
+    path,
+    others,
+    text: `[swarm] heads-up: ${path} was also edited by ${who} \u2014 still live. You may be changing the same thing twice or undoing theirs. Look at what changed there (git diff / git log -p on that file) before you go further, or leave that file to them.`
+  };
+}
 // packages/core/src/config.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
 import { join as join2 } from "path";
@@ -1125,11 +1187,21 @@ function parseGateDefs(gates) {
 var DEFAULT_CONFIG = {
   daemon: { port: 7777, auth: "loopback-optional" },
   tasks: { source: null, labels: [], team: null },
-  gates: { required: [], auto: "session-end", defs: {} },
+  gates: {
+    required: [],
+    auto: "session-end",
+    on_stop: "record",
+    max_blocks: 3,
+    stop_timeout: 300,
+    defs: {}
+  },
   workflows: {},
-  budget: { daily: null, weekly: null, warn_at: 0.8, on_exceed: "warn" },
+  budget: { daily: null, weekly: null, warn_at: 0.8, on_exceed: "warn", window_warn_at: 0.8 },
   models: { allow: [] },
   notify: { webhook: null },
+  messages: { wake: true },
+  codify: { target: "both" },
+  broker: { interactive_wait: 30 },
   team: { url: null, forward: ["ledger", "cost"], interval: 5 },
   events: { retain_days: 30 },
   audit: { retain_days: 0 },
@@ -1150,10 +1222,45 @@ var DEFAULT_CONFIG = {
     protected_ports: "ask",
     no_foreign_worktree: "ask",
     claim_required_to_write: "off",
+    no_verify: "off",
+    dry_run_first: "off",
+    custom: [],
+    collision_context: true,
+    collision_window: 15,
     protected: { ports: [] }
   }
 };
 var MODES = ["ask", "deny", "off"];
+var REWRITE_MODES = ["rewrite", "ask", "deny", "off"];
+function parseCustomRules(raw) {
+  if (!Array.isArray(raw))
+    return [];
+  const out = [];
+  const seen = new Set;
+  for (const v of raw) {
+    if (!isRecord2(v))
+      continue;
+    const name = typeof v.name === "string" ? v.name.trim() : "";
+    const match = typeof v.match === "string" ? v.match : "";
+    if (!/^[a-z0-9][a-z0-9_.-]{0,39}$/i.test(name) || !match || seen.has(name))
+      continue;
+    try {
+      new RegExp(match);
+    } catch {
+      continue;
+    }
+    const action = REWRITE_MODES.includes(v.action) ? v.action : "ask";
+    seen.add(name);
+    out.push({
+      name,
+      match,
+      action,
+      ...typeof v.replace === "string" ? { replace: v.replace } : {},
+      ...typeof v.reason === "string" && v.reason.trim() ? { reason: v.reason.trim() } : {}
+    });
+  }
+  return out;
+}
 function isRecord2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -1187,6 +1294,7 @@ var days = (v, fallback) => {
 };
 function validate(c) {
   const mode = (v, fallback) => MODES.includes(v) ? v : fallback;
+  const rewriteMode = (v, fallback) => REWRITE_MODES.includes(v) ? v : fallback;
   const port = Number(c.daemon?.port);
   const source = c.tasks?.source;
   const setup = c.worktree?.setup;
@@ -1217,13 +1325,28 @@ function validate(c) {
     gates: {
       required: Array.isArray(rawGates?.required) ? rawGates.required.filter((g) => typeof g === "string" && g.trim() !== "") : [],
       auto: AUTO_MODES.includes(auto) ? auto : "session-end",
+      on_stop: rawGates?.on_stop === "block" ? "block" : "record",
+      max_blocks: (() => {
+        const n = Number(rawGates?.max_blocks);
+        return Number.isInteger(n) && n >= 0 && n <= 20 ? n : 3;
+      })(),
+      stop_timeout: (() => {
+        const n = Number(rawGates?.stop_timeout);
+        return Number.isFinite(n) && n >= 5 && n <= 1800 ? n : 300;
+      })(),
       defs: parseGateDefs(rawGates)
     },
     budget: {
       daily: usd(b.daily),
       weekly: usd(b.weekly),
       warn_at: Number.isFinite(warnAt) && warnAt > 0 && warnAt < 1 ? warnAt : 0.8,
-      on_exceed: b.on_exceed === "ask" || b.on_exceed === "stop" ? b.on_exceed : "warn"
+      on_exceed: b.on_exceed === "ask" || b.on_exceed === "stop" ? b.on_exceed : "warn",
+      window_warn_at: (() => {
+        if (b.window_warn_at === false || b.window_warn_at === null || b.window_warn_at === 0)
+          return null;
+        const w = Number(b.window_warn_at);
+        return Number.isFinite(w) && w > 0 && w < 1 ? w : 0.8;
+      })()
     },
     workflows: parseWorkflows(c.workflows),
     notify: {
@@ -1232,6 +1355,23 @@ function validate(c) {
         return typeof w === "string" && /^https?:\/\//.test(w.trim()) ? w.trim() : null;
       })()
     },
+    messages: {
+      wake: c.messages?.wake !== false
+    },
+    codify: {
+      target: (() => {
+        const t = c.codify?.target;
+        return t === "claude-md" || t === "swarm-toml" ? t : "both";
+      })()
+    },
+    broker: {
+      interactive_wait: (() => {
+        const w = Number(c.broker?.interactive_wait);
+        if (!Number.isFinite(w) || w < 0)
+          return 30;
+        return Math.min(Math.round(w), 120);
+      })()
+    },
     models: {
       allow: Array.isArray(c.models?.allow) ? c.models.allow.filter((m) => typeof m === "string" && m.trim() !== "") : []
     },
@@ -1278,6 +1418,14 @@ function validate(c) {
       protected_ports: mode(c.rules?.protected_ports, "ask"),
       no_foreign_worktree: mode(c.rules?.no_foreign_worktree, "ask"),
       claim_required_to_write: mode(c.rules?.claim_required_to_write, "off"),
+      no_verify: rewriteMode(c.rules?.no_verify, "off"),
+      dry_run_first: rewriteMode(c.rules?.dry_run_first, "off"),
+      custom: parseCustomRules(c.rules?.custom),
+      collision_context: c.rules?.collision_context !== false,
+      collision_window: (() => {
+        const n = Number(c.rules?.collision_window);
+        return Number.isFinite(n) && n >= 1 && n <= 240 ? Math.round(n) : 15;
+      })(),
       protected: {
         ports: Array.isArray(c.rules?.protected?.ports) ? c.rules.protected.ports.filter((p) => Number.isInteger(p) && p > 0 && p < 65536) : []
       }
@@ -1719,14 +1867,120 @@ var DEFAULT_MODES = {
   protected_ports: "ask",
   no_foreign_worktree: "ask",
   claim_required_to_write: "off",
+  no_verify: "off",
+  dry_run_first: "off",
+  custom: [],
   protected: { ports: [] }
 };
-function guardBash(cmd, current, sessions, now, modes = DEFAULT_MODES) {
+function isSingleCommand(cmd) {
+  return !/[&|;<>`\n]/.test(cmd) && !cmd.includes("$(");
+}
+function stripFlagsOutsideQuotes(cmd, flags) {
+  let out = "";
+  let quote = null;
+  let i = 0;
+  while (i < cmd.length) {
+    const ch = cmd[i];
+    if (quote) {
+      out += ch;
+      if (ch === quote && cmd[i - 1] !== "\\")
+        quote = null;
+      i++;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      out += ch;
+      i++;
+      continue;
+    }
+    const rest = cmd.slice(i);
+    const hit = flags.find((f) => rest.startsWith(f) && /^(\s|$)/.test(rest.slice(f.length)));
+    if (hit) {
+      out = out.replace(/[ \t]+$/, "");
+      i += hit.length;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+function rewriteNoVerify(cmd) {
+  if (!isSingleCommand(cmd) || !/^\s*git\s/.test(cmd))
+    return null;
+  if (!/--no-(verify|gpg-sign)\b/.test(cmd))
+    return null;
+  const out = stripFlagsOutsideQuotes(cmd, ["--no-verify", "--no-gpg-sign"]);
+  return out === cmd ? null : out;
+}
+function rewriteDryRun(cmd) {
+  if (!isSingleCommand(cmd))
+    return null;
+  const key = cmd.replace(/\s+/g, " ").trim();
+  if (/^\s*terraform\s+apply\b/.test(cmd)) {
+    const tail = cmd.replace(/^\s*terraform\s+apply\b/, "").trim();
+    if (tail.length > 0 && tail.split(/\s+/).some((a) => !a.startsWith("-")))
+      return null;
+    return {
+      key,
+      command: cmd.replace(/^(\s*)terraform\s+apply\b/, "$1terraform plan").replace(/\s+-auto-approve\b/g, "").replace(/ {2,}/g, " ").trimEnd()
+    };
+  }
+  if (/^\s*kubectl\s+delete\b/.test(cmd) && !/--dry-run\b/.test(cmd))
+    return { key, command: `${cmd.trimEnd()} --dry-run=client` };
+  if (/^\s*helm\s+(uninstall|delete)\b/.test(cmd) && !/--dry-run\b/.test(cmd))
+    return { key, command: `${cmd.trimEnd()} --dry-run` };
+  return null;
+}
+var customRe = new WeakMap;
+function compiled(rule) {
+  const hit = customRe.get(rule);
+  if (hit !== undefined)
+    return hit;
+  let re = null;
+  try {
+    re = new RegExp(rule.match, rule.action === "rewrite" ? "g" : "");
+  } catch {
+    re = null;
+  }
+  customRe.set(rule, re);
+  return re;
+}
+function applyCustomRule(rule, cmd) {
+  const re = compiled(rule);
+  if (!re)
+    return null;
+  if (rule.action === "off" || !re.test(cmd))
+    return null;
+  const id = `custom:${rule.name}`;
+  const reason = rule.reason ?? `matches custom rule "${rule.name}" (${rule.match})`;
+  if (rule.action !== "rewrite")
+    return { action: rule.action, rule: id, reason };
+  if (!isSingleCommand(cmd))
+    return {
+      action: "ask",
+      rule: id,
+      reason: `${reason} \u2014 not rewritten: the command chains or redirects`
+    };
+  re.lastIndex = 0;
+  const out = cmd.replace(re, rule.replace ?? "").trim();
+  return out === cmd ? null : { action: "rewrite", rule: id, reason, command: out };
+}
+function guardBash(cmd, current, sessions, now, modes = DEFAULT_MODES, ctx = {}) {
   const other = () => otherLiveInSameTree(current, sessions, now);
   const hit = (rule, reason) => {
     const mode = modes[rule];
     return mode === "off" ? { action: "allow" } : { action: mode, rule, reason };
   };
+  const fix = (rule, reason, command, key) => {
+    const mode = modes[rule] ?? "off";
+    if (mode === "off")
+      return { action: "allow" };
+    if (mode === "rewrite")
+      return { action: "rewrite", rule, reason, command, ...key ? { key } : {} };
+    return { action: mode, rule, reason };
+  };
   if (modes.protected_ports !== "off" && modes.protected.ports.length) {
     const target = killedPorts(cmd).filter((p) => modes.protected.ports.includes(p));
     if (target.length) {
@@ -1756,6 +2010,23 @@ function guardBash(cmd, current, sessions, now, modes = DEFAULT_MODES) {
         return d;
     }
   }
+  for (const rule of modes.custom ?? []) {
+    const d = applyCustomRule(rule, cmd);
+    if (d)
+      return d;
+  }
+  const nv = rewriteNoVerify(cmd);
+  if (nv) {
+    const d = fix("no_verify", "Hooks and signing exist for a reason: `--no-verify` / `--no-gpg-sign` was dropped. If a hook is wrong, fix the hook.", nv);
+    if (d.action !== "allow")
+      return d;
+  }
+  const dr = rewriteDryRun(cmd);
+  if (dr && !ctx.rewritesDone?.has(dr.key)) {
+    const d = fix("dry_run_first", `The first \`${dr.key}\` in a session runs as a dry run so you can read what it would change; run the real one next.`, dr.command, dr.key);
+    if (d.action !== "allow")
+      return d;
+  }
   return { action: "allow" };
 }
 function norm(p) {
@@ -1818,7 +2089,9 @@ var RULE_IDS = [
   "destructive_git",
   "protected_ports",
   "no_foreign_worktree",
-  "claim_required_to_write"
+  "claim_required_to_write",
+  "no_verify",
+  "dry_run_first"
 ];
 function normalizeDisplay(s) {
   return s.replace(/\s+/g, " ").trim().slice(0, 160);
@@ -1828,7 +2101,7 @@ function dryRunRules(calls, modes, ctx) {
   const minRepeat = ctx.minRepeat ?? 3;
   const maxHits = ctx.maxHits ?? 200;
   const live = new Map;
-  const byRule = Object.fromEntries(RULE_IDS.map((r) => [r, { ask: 0, deny: 0 }]));
+  const byRule = Object.fromEntries(RULE_IDS.map((r) => [r, { ask: 0, deny: 0, rewrite: 0 }]));
   const hits = [];
   const groups = new Map;
   let evaluated = 0;
@@ -1861,7 +2134,9 @@ function dryRunRules(calls, modes, ctx) {
       continue;
     if (d.action === "allow")
       continue;
-    byRule[d.rule][d.action]++;
+    const tally = byRule[d.rule] ?? { ask: 0, deny: 0, rewrite: 0 };
+    tally[d.action]++;
+    byRule[d.rule] = tally;
     const norm = normalizeDisplay(display);
     if (hits.length < maxHits)
       hits.push({
@@ -2596,6 +2871,18 @@ function portsIn(cmd) {
 var RECURRING = 3;
 function suggestFromIncident(inc) {
   const n = inc.count ?? 1;
+  if (inc.rule.startsWith("custom:")) {
+    const name = inc.rule.slice("custom:".length);
+    const escaped = inc.command.slice(0, 160).replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/"/g, "\\\"");
+    return {
+      title: n >= RECURRING ? `Deny "${name}" outright (recurring)` : `Tighten custom rule "${name}"`,
+      toml: `[[rules.custom]]
+name = "${name}"
+match = "${escaped}"
+action = "${n >= RECURRING ? "deny" : "ask"}"`,
+      lesson: `Custom rule "${name}" fired on \`${inc.command.slice(0, 120)}\` \u2014 don't run that here; see .swarm.toml [[rules.custom]] for why.`
+    };
+  }
   switch (inc.rule) {
     case "protected_ports": {
       const ports = portsIn(inc.command);
@@ -2644,6 +2931,20 @@ no_foreign_worktree = "deny"`,
 claim_required_to_write = "deny"`,
         lesson: "Claim a task (`swarm claim`) and work in the worktree it creates before editing this repo."
       };
+    case "no_verify":
+      return {
+        title: "Always drop --no-verify",
+        toml: `[rules]
+no_verify = "rewrite"`,
+        lesson: "Never pass `--no-verify` / `--no-gpg-sign` to git \u2014 the hooks are the repo's checks. Fix the hook if it is wrong."
+      };
+    case "dry_run_first":
+      return {
+        title: "Dry-run infrastructure changes first",
+        toml: `[rules]
+dry_run_first = "rewrite"`,
+        lesson: "Run `terraform plan` / `kubectl \u2026 --dry-run=client` / `helm \u2026 --dry-run` and read it before the real apply, delete or uninstall."
+      };
     case "orphaned_claim":
       return {
         title: "A claim expired with unfinished work",
@@ -2669,6 +2970,143 @@ function incidentKey(inc) {
     return `protected_ports:${portsIn(inc.command).join(",")}`;
   return inc.rule;
 }
+// packages/core/src/lessons-apply.ts
+var LESSONS_HEADING = "## Lessons from Swarm";
+function nextHeading(text) {
+  let fence = null;
+  let at = 0;
+  for (const line of text.split(`
+`)) {
+    const open = line.match(/^\s*(```+|~~~+)/);
+    if (fence) {
+      if (open && line.trim().startsWith(fence))
+        fence = null;
+    } else if (open) {
+      fence = open[1];
+    } else if (at > 0 && /^#{1,6} /.test(line)) {
+      return at - 1;
+    }
+    at += line.length + 1;
+  }
+  return -1;
+}
+function mergeLesson(existing, lesson) {
+  const line = `- ${lesson.trim()}`;
+  const text = existing ?? "";
+  if (text.split(`
+`).some((l) => l.trim() === line))
+    return text;
+  const idx = text.indexOf(LESSONS_HEADING);
+  if (idx < 0) {
+    const base = text.trimEnd();
+    return `${base ? `${base}
+
+` : `# CLAUDE.md
+
+`}${LESSONS_HEADING}
+
+${line}
+`;
+  }
+  const after = idx + LESSONS_HEADING.length;
+  const rest = text.slice(after);
+  const next = nextHeading(rest);
+  const cut = next < 0 ? text.length : after + next;
+  const section = text.slice(after, cut).trimEnd();
+  return `${text.slice(0, after)}${section}
+${line}
+${next < 0 ? "" : text.slice(cut)}`;
+}
+var SECTION_HEADER = /^\s*\[\[?[A-Za-z0-9_.-]+\]\]?\s*(#.*)?$/;
+function parseSnippet(snippet) {
+  const out = [];
+  for (const raw of snippet.split(`
+`)) {
+    const line = raw.trimEnd();
+    const h = SECTION_HEADER.test(line) ? line.match(/^\[\[?([^\]]+)\]\]?$/) : null;
+    if (h) {
+      out.push({ header: line.trim(), array: line.startsWith("[["), lines: [] });
+      continue;
+    }
+    if (!line.trim())
+      continue;
+    const cur = out.at(-1);
+    if (cur)
+      cur.lines.push(line);
+  }
+  return out;
+}
+function sectionBounds(lines, header) {
+  const start = lines.findIndex((l) => l.trim() === header);
+  if (start < 0)
+    return null;
+  let end = lines.length;
+  for (let i = start + 1;i < lines.length; i++) {
+    if (SECTION_HEADER.test(lines[i])) {
+      end = i;
+      break;
+    }
+  }
+  return { start, end };
+}
+function setKey(lines, start, end, key, value) {
+  for (let i = start + 1;i < end; i++) {
+    if (new RegExp(`^\\s*${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*=`).test(lines[i])) {
+      lines[i] = `${key} = ${value}`;
+      return end;
+    }
+  }
+  let at = end;
+  while (at > start + 1 && !lines[at - 1].trim())
+    at--;
+  lines.splice(at, 0, `${key} = ${value}`);
+  return end + 1;
+}
+function unionPorts(existing, incoming) {
+  const nums = (s) => [...s.replace(/#.*$/, "").matchAll(/\d+/g)].map((m) => Number(m[0])).filter((n) => Number.isInteger(n));
+  const set = new Set([...nums(existing), ...nums(incoming)]);
+  return `[${[...set].sort((a, b) => a - b).join(", ")}]`;
+}
+function mergeToml(existing, snippet) {
+  const lines = (existing ?? "").replace(/\r\n/g, `
+`).split(`
+`);
+  if (lines.length === 1 && lines[0] === "")
+    lines.length = 0;
+  for (const block of parseSnippet(snippet)) {
+    if (block.array) {
+      if (lines.length && lines.at(-1).trim() !== "")
+        lines.push("");
+      lines.push(block.header, ...block.lines);
+      continue;
+    }
+    let bounds = sectionBounds(lines, block.header);
+    if (!bounds) {
+      if (lines.length && lines.at(-1).trim() !== "")
+        lines.push("");
+      lines.push(block.header);
+      bounds = { start: lines.length - 1, end: lines.length };
+    }
+    let end = bounds.end;
+    for (const l of block.lines) {
+      const m = l.match(/^\s*([A-Za-z0-9_.-]+)\s*=\s*(.+?)\s*$/);
+      if (!m)
+        continue;
+      const [, key, value] = m;
+      let v = value;
+      if (block.header === "[rules.protected]" && key === "ports") {
+        const cur = lines.slice(bounds.start + 1, end).find((x) => /^\s*ports\s*=/.test(x))?.split("=")[1];
+        v = unionPorts(cur ?? "", value);
+      }
+      end = setKey(lines, bounds.start, end, key, v);
+    }
+  }
+  const out = lines.join(`
+`);
+  return out.endsWith(`
+`) ? out : `${out}
+`;
+}
 // packages/core/src/lineage.ts
 var LINEAGE_MAX_NODES = 40;
 var LINEAGE_FANOUT = 4;
@@ -3125,6 +3563,21 @@ function outcomeReport(sessions, prs, revertedShas) {
 function parseReverts(gitLog) {
   return new Set([...gitLog.matchAll(/This reverts commit ([0-9a-f]{7,40})/gi)].map((m) => m[1].toLowerCase()));
 }
+// packages/core/src/permissions.ts
+function permissionHookOutput(a, input) {
+  if (!a.behavior)
+    return {};
+  return {
+    hookSpecificOutput: {
+      hookEventName: "PermissionRequest",
+      decision: {
+        behavior: a.behavior,
+        message: a.message ?? `[swarm] ${a.behavior === "allow" ? "allowed" : "denied"} from the dashboard`,
+        ...a.behavior === "allow" ? { updatedInput: input } : {}
+      }
+    }
+  };
+}
 // packages/core/src/policy.ts
 import { createHash } from "crypto";
 var HOOK_MARK = "swarm-hook";
@@ -3473,6 +3926,143 @@ function formatOpenQuestions(qs) {
     return null;
   return `[swarm] waiting on a human for: ${open.map((q) => `#${q.id} "${q.text.slice(0, 120)}"`).join("; ")} \u2014 the answer arrives as context on a later tool call, or via swarm_inbox`;
 }
+// packages/core/src/quota.ts
+var QUOTA_WINDOWS = ["five_hour", "seven_day", "spend_limit"];
+var QUOTA_LABEL = {
+  five_hour: "5-hour window",
+  seven_day: "7-day window",
+  spend_limit: "spend limit"
+};
+function quotaSamples(payload, at) {
+  const out = [];
+  const rl = payload.rate_limits;
+  if (!rl || typeof rl !== "object")
+    return out;
+  for (const w of QUOTA_WINDOWS) {
+    const v = rl[w];
+    if (!v || typeof v.used_percentage !== "number" || !Number.isFinite(v.used_percentage))
+      continue;
+    out.push({
+      window: w,
+      usedPct: v.used_percentage,
+      resetsAt: typeof v.resets_at === "number" && Number.isFinite(v.resets_at) ? v.resets_at : null,
+      at
+    });
+  }
+  return out;
+}
+var BURN_MIN_SPAN_MS = 10 * 60000;
+function quotaLevel(usedPct, warnAt) {
+  if (usedPct >= 100)
+    return "exceeded";
+  if (warnAt != null && warnAt > 0 && usedPct >= warnAt * 100)
+    return "warn";
+  return "ok";
+}
+function quotaReport(samples, now, warnAt) {
+  const windows = [];
+  let newest = null;
+  for (const w of QUOTA_WINDOWS) {
+    const all = samples.filter((s) => s.window === w).sort((a, b) => a.at - b.at);
+    const last = all.at(-1);
+    if (!last)
+      continue;
+    newest = newest === null ? last.at : Math.max(newest, last.at);
+    const period = all.filter((s) => s.resetsAt === last.resetsAt);
+    const first = period.find((s) => last.at - s.at >= BURN_MIN_SPAN_MS);
+    let burn = null;
+    if (first) {
+      burn = (last.usedPct - first.usedPct) / ((last.at - first.at) / 3600000);
+      if (!Number.isFinite(burn))
+        burn = null;
+    }
+    const hoursToLimit = burn != null && burn > 0 && last.usedPct < 100 ? (100 - last.usedPct) / burn : null;
+    const hoursToReset = last.resetsAt != null ? Math.max(0, (last.resetsAt * 1000 - now) / 3600000) : null;
+    windows.push({
+      window: w,
+      usedPct: last.usedPct,
+      resetsAt: last.resetsAt,
+      sampledAt: last.at,
+      burnPctPerHour: burn,
+      hoursToLimit,
+      hoursToReset,
+      limitBeforeReset: hoursToLimit != null && (hoursToReset == null || hoursToLimit < hoursToReset),
+      level: quotaLevel(last.usedPct, warnAt)
+    });
+  }
+  return { windows, sampledAt: newest };
+}
+function tightestWindow(report) {
+  let best = null;
+  for (const w of report.windows) {
+    if (w.level === "exceeded")
+      return w;
+    if (!w.limitBeforeReset || w.hoursToLimit == null)
+      continue;
+    if (!best || (best.hoursToLimit ?? Number.POSITIVE_INFINITY) > w.hoursToLimit)
+      best = w;
+  }
+  return best;
+}
+function hoursText(h) {
+  const minutes = Math.round(h * 60);
+  if (minutes < 1)
+    return "<1m";
+  if (minutes < 60)
+    return `${minutes}m`;
+  if (minutes < 24 * 60) {
+    const m = minutes % 60;
+    return m ? `${Math.floor(minutes / 60)}h ${m}m` : `${Math.floor(minutes / 60)}h`;
+  }
+  const hours = Math.round(h);
+  const d = Math.floor(hours / 24);
+  const rest = hours % 24;
+  return rest ? `${d}d ${rest}h` : `${d}d`;
+}
+function quotaMessage(w) {
+  const label = QUOTA_LABEL[w.window];
+  const used = `${Math.round(w.usedPct)}% of the ${label}`;
+  if (w.level === "exceeded")
+    return `${used} used \u2014 the plan is out of budget until it resets${w.hoursToReset != null ? ` in ${hoursText(w.hoursToReset)}` : ""}`;
+  const pace = w.hoursToLimit != null ? `, at the current pace the limit lands in ${hoursText(w.hoursToLimit)}${w.hoursToReset != null ? ` and the window resets in ${hoursText(w.hoursToReset)}` : ""}` : w.hoursToReset != null ? `, resets in ${hoursText(w.hoursToReset)}` : "";
+  return `${used} used${pace}`;
+}
+// packages/core/src/repair.ts
+var REASON_TAIL_CHARS = 1200;
+function repairDecision(input) {
+  if (input.onStop !== "block")
+    return { kind: "allow", why: "record" };
+  if (input.maxBlocks <= 0)
+    return { kind: "allow", why: "disabled" };
+  if (!input.runs.length)
+    return { kind: "allow", why: "nothing-to-run" };
+  const failed = input.runs.filter((r) => r.verdict !== "pass");
+  if (!failed.length)
+    return { kind: "allow", why: "passed" };
+  if (input.blocksSoFar >= input.maxBlocks)
+    return {
+      kind: "exhausted",
+      failed,
+      reason: `${failed.map((r) => r.gate).join(", ")} still failing after ${input.maxBlocks} refusal${input.maxBlocks === 1 ? "" : "s"} \u2014 letting the session stop`
+    };
+  const attempt = input.blocksSoFar + 1;
+  return { kind: "block", attempt, failed, reason: blockReason(failed, attempt, input.maxBlocks) };
+}
+function blockReason(failed, attempt, maxBlocks) {
+  const parts = failed.map((r) => {
+    const tail = (r.evidence ?? "").trim();
+    const clipped = tail.length > REASON_TAIL_CHARS ? `\u2026${tail.slice(tail.length - REASON_TAIL_CHARS)}` : tail;
+    return `gate "${r.gate}" failed (${r.rubric})${clipped ? `:
+${clipped}` : ""}`;
+  });
+  const left = maxBlocks - attempt;
+  return [
+    `[swarm] not done yet \u2014 ${failed.length === 1 ? "a required gate is" : `${failed.length} required gates are`} failing in this worktree. Fix the cause, run it again, then finish.`,
+    ...parts,
+    left > 0 ? `(refusal ${attempt} of ${maxBlocks}; after ${left} more the stop goes through and an incident opens)` : `(refusal ${attempt} of ${maxBlocks}; the next stop goes through and an incident opens)`
+  ].join(`
+`);
+}
 // packages/core/src/resourcegraph.ts
 var nodeId = (kind, name, projectId) => `${kind}:${projectId ?? ""}:${name}`;
 function resourceGraph(held, wanted = [], now = Date.now()) {
@@ -4134,6 +4724,145 @@ function clusterProjectKey(remoteUrl) {
     return null;
   return `${host}/${m[2]}`;
 }
+// packages/core/src/teamsetup.ts
+var DEFAULT_TEAM_SETUP = {
+  name: null,
+  host: "0.0.0.0",
+  port: 7878,
+  mode: "token",
+  token: null,
+  issuer: null,
+  clientId: null,
+  db: null
+};
+function mintTeamSecret() {
+  return `swt_${crypto.randomUUID().replaceAll("-", "")}`;
+}
+var str = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
+function parseTeamSetup(text) {
+  const out = { ...DEFAULT_TEAM_SETUP };
+  if (!text)
+    return out;
+  for (const raw of text.split(`
+`)) {
+    const line = raw.replace(/(^|\s)#.*$/, "").trim();
+    const m = line.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.+)$/);
+    if (!m)
+      continue;
+    const key = m[1];
+    const value = m[2].trim().replace(/^["']|["']$/g, "");
+    switch (key) {
+      case "name":
+        out.name = str(value);
+        break;
+      case "host":
+        out.host = str(value) ?? out.host;
+        break;
+      case "port": {
+        const n = Number(value);
+        if (Number.isInteger(n) && n > 0 && n < 65536)
+          out.port = n;
+        break;
+      }
+      case "mode":
+        if (value === "oidc" || value === "token" || value === "open")
+          out.mode = value;
+        break;
+      case "token":
+        out.token = str(value);
+        break;
+      case "issuer":
+        out.issuer = str(value);
+        break;
+      case "client_id":
+        out.clientId = str(value);
+        break;
+      case "db":
+        out.db = str(value);
+        break;
+      default:
+        break;
+    }
+  }
+  return out;
+}
+function renderTeamSetup(s) {
+  const lines = [
+    "# swarm-teamd \u2014 written by `swarm-teamd setup` or the dashboard's Team panel.",
+    "# Environment variables still win: SWARM_TEAM_PORT / _HOST / _TOKEN / _OIDC_ISSUER /",
+    "# _OIDC_CLIENT_ID / _DB override anything here.",
+    "",
+    `name = ${JSON.stringify(s.name ?? "")}`,
+    `host = ${JSON.stringify(s.host)}`,
+    `port = ${s.port}`,
+    `mode = ${JSON.stringify(s.mode)}`
+  ];
+  if (s.mode === "token")
+    lines.push(`token = ${JSON.stringify(s.token ?? "")}`);
+  if (s.mode === "oidc") {
+    lines.push(`issuer = ${JSON.stringify(s.issuer ?? "")}`);
+    lines.push(`client_id = ${JSON.stringify(s.clientId ?? "")}`);
+  }
+  if (s.db)
+    lines.push(`db = ${JSON.stringify(s.db)}`);
+  return `${lines.join(`
+`)}
+`;
+}
+function inviteLink(url, token) {
+  const q = new URLSearchParams({ url: url.replace(/\/+$/, "") });
+  if (token)
+    q.set("token", token);
+  return `swarm+team://join?${q}`;
+}
+function parseInvite(text) {
+  const raw = text.trim();
+  if (!raw)
+    return null;
+  const invite = raw.match(/^swarm\+team:\/\/join\?(.*)$/i);
+  if (invite) {
+    const q = new URLSearchParams(invite[1]);
+    const url = q.get("url");
+    return url && /^https?:\/\//i.test(url) ? { url: url.replace(/\/+$/, ""), token: q.get("token") || null } : null;
+  }
+  const hash = raw.match(/^(https?:\/\/[^\s#]+)#(.+)$/i);
+  if (hash)
+    return {
+      url: hash[1].replace(/\/+$/, ""),
+      token: hash[2].trim() || null
+    };
+  if (/^https?:\/\/\S+$/i.test(raw))
+    return { url: raw.replace(/\/+$/, ""), token: null };
+  if (/^[A-Za-z0-9][A-Za-z0-9.-]*(:\d{2,5})?$/.test(raw))
+    return {
+      url: `http://${raw.includes(":") ? raw : `${raw}:${DEFAULT_TEAM_SETUP.port}`}`,
+      token: null
+    };
+  return null;
+}
+function hostedUrl(address, port) {
+  return `http://${address}:${port}`;
+}
+function withTeamUrl(text, url) {
+  const section = text.match(/(^|\n)\[team\]([\s\S]*?)(?=\n\[|$)/);
+  if (!section) {
+    if (!url)
+      return text;
+    return `${text}${text && !text.endsWith(`
+`) ? `
+` : ""}
+[team]
+url = ${JSON.stringify(url)}
+`;
+  }
+  const body = section[2] ?? "";
+  const line = url ? `url = ${JSON.stringify(url)}` : "";
+  const next = /^[ \t]*url[ \t]*=/m.test(body) ? body.replace(/^[ \t]*url[ \t]*=.*$/m, line).replace(/\n{3,}/g, `
+
+`) : url ? `
+${line}${body}` : body;
+  return text.replace(section[0], `${section[1]}[team]${next}`);
+}
 // packages/core/src/transitions.ts
 function transitionGraph(steps, { minWeight = 1 } = {}) {
   const calls = new Map;
@@ -4312,9 +5041,9 @@ function waitingReport(episodes) {
   };
 }
 // packages/daemon/src/app.ts
-import { existsSync as existsSync7, readdirSync as readdirSync2, readFileSync as readFileSync4, realpathSync as realpathSync3, statSync as statSync2 } from "fs";
+import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync6, realpathSync as realpathSync3, statSync as statSync2 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname4, join as join10 } from "path";
+import { dirname as dirname4, join as join12 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // node_modules/.bun/hono@4.13.3/node_modules/hono/dist/compose.js
@@ -5934,738 +6663,853 @@ var streamSSE = (c, cb, onError) => {
   return c.newResponse(stream.responseReadable);
 };
 
-// packages/daemon/src/dispatcher.ts
-class Dispatcher {
-  store;
-  runner;
-  forge;
-  entries = new Map;
-  opts = new Map;
-  constructor(store, runner, forge) {
-    this.store = store;
-    this.runner = runner;
-    this.forge = forge;
-    runner.onEnd((run) => void this.onRunEnd(run));
+// packages/daemon/src/codify.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { join as join5 } from "path";
+
+// packages/daemon/src/git.ts
+import { realpathSync } from "fs";
+import { join as join4 } from "path";
+function git(cwd, args) {
+  try {
+    const r = Bun.spawnSync(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore" });
+    return r.exitCode === 0 ? r.stdout.toString() : null;
+  } catch {
+    return null;
   }
-  project(projectId) {
-    let m = this.entries.get(projectId);
-    if (!m) {
-      m = new Map;
-      this.entries.set(projectId, m);
-    }
-    return m;
+}
+function gitCommonDir(cwd) {
+  const out = git(cwd, ["rev-parse", "--git-common-dir"])?.trim();
+  if (!out)
+    return null;
+  try {
+    return realpathSync(out.startsWith("/") ? out : join4(cwd, out));
+  } catch {
+    return null;
   }
-  status(projectId) {
-    return [...this.entries.get(projectId)?.values() ?? []];
+}
+function gitToplevel(cwd) {
+  const out = git(cwd, ["rev-parse", "--show-toplevel"])?.trim();
+  if (!out)
+    return null;
+  try {
+    return realpathSync(out);
+  } catch {
+    return null;
   }
-  async dispatch(projectId, wanted, o = {}) {
-    const board = this.store.tasks(projectId);
-    if (!board)
-      return {
-        ok: false,
-        error: "this repo has no task source ([tasks] source in .swarm.toml)"
-      };
-    if (board.error)
-      return { ok: false, error: `task source: ${board.error}` };
-    const cfg = this.store.config(projectId).dispatch;
-    const opts = {
-      owner: o.owner ?? "dispatch",
-      ...o,
-      maxParallel: o.maxParallel ?? cfg.max_parallel
-    };
-    this.opts.set(projectId, opts);
-    const m = this.project(projectId);
-    const running = [...m.values()].filter((e) => e.state === "running").length;
-    const plan = planDispatch(board.tasks, wanted, {
-      maxParallel: opts.maxParallel,
-      running,
-      max: o.max,
-      alreadyQueued: [...m.values()].filter((e) => e.state !== "finished").map((e) => e.task)
-    });
-    const now = new Date().toISOString();
-    for (const t of [...plan.start, ...plan.queued]) {
-      m.set(t.id, {
-        task: t.id,
-        title: t.title,
-        state: "queued",
-        runId: null,
-        sessionId: null,
-        queuedAt: now,
-        startedAt: null,
-        endedAt: null,
-        outcome: null,
-        detail: null,
-        costUsd: null
-      });
-    }
-    if (plan.start.length || plan.queued.length)
-      this.store.append({
-        ts: now,
-        type: "dispatch.queued",
-        projectId,
-        sessionId: null,
-        payload: {
-          tasks: [...plan.start, ...plan.queued].map((t) => t.id),
-          maxParallel: opts.maxParallel,
-          summary: `dispatch ${[...plan.start, ...plan.queued].map((t) => t.id).join(", ")}`
-        }
-      });
-    const started = [];
-    const failed = [];
-    for (const t of plan.start) {
-      const r = await this.startOne(projectId, t);
-      if (r.ok)
-        started.push(t.id);
-      else
-        failed.push({ id: t.id, reason: r.reason });
-    }
-    await this.fill(projectId);
-    return {
-      ok: true,
-      started,
-      queued: plan.queued.map((t) => t.id).filter((id) => m.get(id)?.state === "queued"),
-      rejected: [...plan.rejected, ...failed]
-    };
-  }
-  async startOne(projectId, t) {
-    const m = this.project(projectId);
-    const e = m.get(t.id);
-    const opts = this.opts.get(projectId) ?? { owner: "dispatch" };
-    const cfg = this.store.config(projectId);
-    const gates = cfg.gates;
-    const prompt = taskPrompt(t, {
-      requiredGates: gates.required,
-      executableGates: gates.required.filter((g) => gates.defs[g]),
-      openPr: cfg.dispatch.require_pr
-    });
-    const r = await this.runner.start({
-      projectId,
-      task: t.id,
-      prompt,
-      owner: opts.owner,
-      permissionMode: opts.permissionMode ?? cfg.dispatch.permission_mode ?? "acceptEdits",
-      model: opts.model ?? cfg.dispatch.model ?? undefined,
-      maxTurns: opts.maxTurns ?? cfg.dispatch.max_turns ?? undefined,
-      profile: opts.profile ?? cfg.dispatch.profile ?? undefined
-    });
-    if (!r.ok) {
-      if (e) {
-        e.state = "finished";
-        e.endedAt = new Date().toISOString();
-        e.outcome = "crashed";
-        e.detail = r.reason;
-      }
-      this.store.append({
-        ts: new Date().toISOString(),
-        type: "dispatch.finished",
-        projectId,
-        sessionId: null,
-        payload: {
-          task: t.id,
-          outcome: "crashed",
-          detail: r.reason,
-          summary: `dispatch ${t.id}: could not start \u2014 ${r.reason}`
-        }
+}
+function parseWorktreeList(out) {
+  const wts = [];
+  let cur = null;
+  const flush = () => {
+    if (cur?.path) {
+      wts.push({
+        path: cur.path,
+        branch: cur.branch ?? null,
+        head: (cur.head ?? "").slice(0, 7),
+        main: wts.length === 0,
+        dirty: -1,
+        ahead: -1,
+        behind: -1,
+        merged: false
       });
-      return { ok: false, reason: r.reason };
-    }
-    if (e) {
-      e.state = "running";
-      e.runId = r.run.id;
-      e.sessionId = r.run.sessionId;
-      e.startedAt = r.run.startedAt;
-    }
-    this.store.append({
-      ts: r.run.startedAt,
-      type: "dispatch.started",
-      projectId,
-      sessionId: r.run.sessionId,
-      payload: {
-        task: t.id,
-        runId: r.run.id,
-        worktree: r.run.worktree,
-        by: this.opts.get(projectId)?.owner ?? null,
-        summary: `dispatch ${t.id} \u2192 run ${r.run.id}`
-      }
-    });
-    return { ok: true };
-  }
-  async fill(projectId) {
-    const m = this.project(projectId);
-    const cap = this.opts.get(projectId)?.maxParallel ?? this.store.config(projectId).dispatch.max_parallel;
-    for (const e of m.values()) {
-      const running = [...m.values()].filter((x) => x.state === "running").length;
-      if (running >= cap)
-        return;
-      if (e.state !== "queued")
-        continue;
-      await this.startOne(projectId, { id: e.task, title: e.title });
     }
+    cur = null;
+  };
+  for (const line of out.split(`
+`)) {
+    if (line.startsWith("worktree ")) {
+      flush();
+      cur = { path: line.slice(9) };
+    } else if (line.startsWith("HEAD ") && cur)
+      cur.head = line.slice(5);
+    else if (line.startsWith("branch ") && cur)
+      cur.branch = line.slice(7).replace(/^refs\/heads\//, "");
+    else if (line === "")
+      flush();
   }
-  async onRunEnd(run) {
-    const m = this.entries.get(run.projectId);
-    const e = m?.get(run.task);
-    if (!e || e.runId !== run.id)
-      return;
-    const cfg = this.store.config(run.projectId);
-    const required = cfg.gates.required;
-    let runs = this.store.gateRuns(run.projectId, run.task);
-    const status = this.store.gateStatusFor(runs, required);
-    const missing = required.filter((g) => cfg.gates.defs[g] && status.find((s) => s.gate === g)?.verdict !== "pass");
-    if (missing.length && !run.stopped) {
-      await this.store.runGates(run.projectId, run.task, missing, {
-        sessionId: run.sessionId,
-        owner: "dispatch"
-      });
-      runs = this.store.gateRuns(run.projectId, run.task);
-    }
-    const satisfied = gatesSatisfied(runs, required);
-    await this.forge.refresh(0).catch(() => {});
-    const branch = `task/${run.task}`;
-    const pr = this.forge.prs().find((p) => p.projectId === run.projectId && p.branch === branch);
-    const outcome = dispatchOutcome({
-      exitCode: run.exitCode,
-      isError: run.result?.isError ?? false,
-      gatesSatisfied: satisfied,
-      prOpen: Boolean(pr),
-      requirePr: cfg.dispatch.require_pr,
-      stopped: run.stopped ?? false
-    });
-    const verdicts = this.store.gateStatusFor(runs, required).map((s) => `${s.gate} ${s.verdict ?? "\u2014"}`).join(", ");
-    const detail = [
-      `exit ${run.exitCode}${run.result?.isError ? " (error)" : ""}`,
-      required.length ? `gates: ${verdicts}` : null,
-      pr ? `PR ${pr.url}` : cfg.dispatch.require_pr ? "no PR" : null
-    ].filter(Boolean).join(" \xB7 ");
-    e.state = "finished";
-    e.endedAt = run.endedAt;
-    e.outcome = outcome;
-    e.detail = detail;
-    e.costUsd = run.result?.costUsd ?? null;
-    const ts = run.endedAt ?? new Date().toISOString();
-    this.store.append({
-      ts,
-      type: "dispatch.finished",
-      projectId: run.projectId,
-      sessionId: run.sessionId,
-      payload: {
-        task: run.task,
-        runId: run.id,
-        outcome,
-        detail,
-        costUsd: e.costUsd,
-        summary: `dispatch ${run.task}: ${outcome} \u2014 ${detail}`
-      }
-    });
-    if (outcome !== "done" && outcome !== "stopped")
-      this.store.append({
-        ts,
-        type: "incident.opened",
-        projectId: run.projectId,
-        sessionId: run.sessionId,
-        payload: {
-          rule: "dispatch_failed",
-          action: outcome,
-          command: run.task,
-          reason: `dispatched run on ${run.task} ended ${outcome}: ${detail}. The worktree and claim are kept; resume it from the session page or release it.`
-        }
-      });
-    this.store.touch();
-    await this.fill(run.projectId);
+  flush();
+  return wts;
+}
+function applyStatus(w, st, ah) {
+  w.dirty = st === null ? -1 : st.split(`
+`).filter(Boolean).length;
+  const a = ah?.trim();
+  w.ahead = a === undefined || a === "" ? -1 : Number(a);
+}
+function applyDrift(w, behind, ancestor, firstParents, cherry = null) {
+  const b = behind?.trim();
+  w.behind = b === undefined || b === "" ? -1 : Number(b);
+  const onLine = firstParents?.split(`
+`).some((sha) => sha.startsWith(w.head)) ?? true;
+  w.merged = (ancestor || squashed(cherry)) && !onLine;
+}
+function squashed(cherry) {
+  if (!cherry)
+    return false;
+  const lines = cherry.split(`
+`).filter((l) => l.trim());
+  return lines.length > 0 && lines.every((l) => l.startsWith("-"));
+}
+var FIRST_PARENT_DEPTH = "5000";
+var baseOf = (wts) => wts[0]?.main ? wts[0].branch : null;
+async function gitAsync(cwd, args) {
+  try {
+    const p = Bun.spawn(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore" });
+    const [out, code] = await Promise.all([new Response(p.stdout).text(), p.exited]);
+    return code === 0 ? out : null;
+  } catch {
+    return null;
   }
-  clear(projectId, task) {
-    const m = this.project(projectId);
-    let n = 0;
-    for (const [id, e] of m) {
-      if (task && id !== task)
-        continue;
-      if (e.state === "queued" || e.state === "finished" && !task) {
-        m.delete(id);
-        n++;
-      }
-    }
-    return n;
+}
+async function listWorktreesAsync(root) {
+  const out = await gitAsync(root, ["worktree", "list", "--porcelain"]);
+  if (!out)
+    return [];
+  const wts = parseWorktreeList(out);
+  const base = baseOf(wts);
+  const line = base ? await gitAsync(root, ["rev-list", "--first-parent", "-n", FIRST_PARENT_DEPTH, base]) : null;
+  await Promise.all(wts.map(async (w) => {
+    const drift = base && !w.main;
+    const [st, ah, be, mg, ch] = await Promise.all([
+      gitAsync(w.path, ["status", "--porcelain", "--untracked-files=no"]),
+      gitAsync(w.path, ["rev-list", "--count", "@{upstream}..HEAD"]),
+      drift ? gitAsync(w.path, ["rev-list", "--count", `HEAD..${base}`]) : null,
+      drift ? gitAsync(w.path, ["merge-base", "--is-ancestor", "HEAD", base]) : null,
+      drift ? gitAsync(w.path, ["cherry", base, "HEAD"]) : null
+    ]);
+    applyStatus(w, st, ah);
+    if (drift)
+      applyDrift(w, be, mg !== null, line, ch);
+  }));
+  return wts;
+}
+var branchCache = new Map;
+function currentBranch(cwd) {
+  const hit = branchCache.get(cwd);
+  const now = Date.now();
+  if (hit && now - hit.t < 5000)
+    return hit.v;
+  const v = git(cwd, ["rev-parse", "--abbrev-ref", "HEAD"])?.trim() ?? null;
+  branchCache.set(cwd, { v: v === "HEAD" ? "(detached)" : v, t: now });
+  return branchCache.get(cwd)?.v ?? null;
+}
+var originCache = new Map;
+function originUrl(root) {
+  const hit = originCache.get(root);
+  const now = Date.now();
+  if (hit && now - hit.t < 300000)
+    return hit.v;
+  const v = git(root, ["config", "--get", "remote.origin.url"])?.trim() || null;
+  originCache.set(root, { v, t: now });
+  return v;
+}
+function worktreeAdd(repoRoot, path, branch, baseRef = "HEAD") {
+  const branchExists = git(repoRoot, ["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`]) !== null;
+  const args = branchExists ? ["worktree", "add", path, branch] : ["worktree", "add", "-b", branch, path, baseRef];
+  if (git(repoRoot, args) === null)
+    return null;
+  try {
+    return realpathSync(path);
+  } catch {
+    return path;
   }
 }
-
-// packages/daemon/src/forge.ts
-import { existsSync as existsSync4 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join4 } from "path";
-var EXTRA_BIN_DIRS = [
-  "/opt/homebrew/bin",
-  "/usr/local/bin",
-  "/home/linuxbrew/.linuxbrew/bin",
-  join4(homedir2(), ".local", "bin"),
-  join4(homedir2(), "bin")
-];
-function findBin(name) {
-  if (!name)
+function commitPaths(cwd, paths, message) {
+  if (!paths.length || git(cwd, ["add", "--", ...paths]) === null)
     return null;
-  const onPath = Bun.which(name, { PATH: process.env.PATH ?? "" });
-  if (onPath)
-    return onPath;
-  for (const d of EXTRA_BIN_DIRS) {
-    const p = join4(d, name);
-    if (existsSync4(p))
-      return p;
+  if (git(cwd, ["diff", "--cached", "--quiet"]) !== null)
+    return null;
+  if (git(cwd, [
+    "-c",
+    "user.email=swarm@localhost",
+    "-c",
+    "user.name=Swarm",
+    "commit",
+    "-q",
+    "-m",
+    message
+  ]) === null)
+    return null;
+  return git(cwd, ["rev-parse", "HEAD"])?.trim() ?? null;
+}
+function worktreeRemove(repoRoot, path, force) {
+  const args = ["worktree", "remove", path];
+  if (force)
+    args.push("--force");
+  return git(repoRoot, args) !== null;
+}
+function heldWork(path) {
+  const status = git(path, ["status", "--porcelain"]);
+  const dirty = status !== null && status.trim().length > 0;
+  const count = (args) => {
+    const out = git(path, ["rev-list", "--count", ...args])?.trim();
+    return out !== undefined && out !== "" ? Number(out) : 0;
+  };
+  let unpushed;
+  if (git(path, ["rev-parse", "--verify", "--quiet", "@{upstream}"]) !== null) {
+    unpushed = count(["@{upstream}..HEAD"]) > 0;
+  } else {
+    const baselines = ["--remotes"];
+    for (const b of ["main", "master"]) {
+      if (git(path, ["rev-parse", "--verify", "--quiet", `refs/heads/${b}`]) !== null)
+        baselines.push(b);
+    }
+    unpushed = baselines.length > 1 ? count(["HEAD", "--not", ...baselines]) > 0 : false;
   }
-  return null;
+  return { dirty, unpushed };
 }
-var GH_FIELDS = "number,title,headRefName,url,author,isDraft,mergeable,reviewDecision,statusCheckRollup,createdAt";
-
-class ForgeService {
-  store;
-  cache = new Map;
-  inflight = new Set;
-  constructor(store) {
-    this.store = store;
+async function worktreeDiff(root, path) {
+  const wts = parseWorktreeList(await gitAsync(root, ["worktree", "list", "--porcelain"]) ?? "");
+  const baseRef = wts[0]?.path === realpathOr(root) || wts[0]?.main ? wts[0]?.branch ?? null : null;
+  const isMain = wts[0]?.path === path;
+  const mb = baseRef && !isMain ? (await gitAsync(path, ["merge-base", baseRef, "HEAD"]))?.trim() : null;
+  const from = mb || "HEAD";
+  const [numstat, names, log, status] = await Promise.all([
+    gitAsync(path, ["diff", "--numstat", from]),
+    gitAsync(path, ["diff", "--name-status", from]),
+    mb ? gitAsync(path, ["log", "--format=%s", `${mb}..HEAD`]) : Promise.resolve(""),
+    gitAsync(path, ["status", "--porcelain"])
+  ]);
+  const files = parseNumstat(numstat ?? "", names ?? "");
+  for (const line of (status ?? "").split(`
+`)) {
+    if (line.startsWith("?? "))
+      files.push({ path: line.slice(3), added: -1, deleted: -1, status: "?" });
   }
-  prs() {
-    this.refresh();
-    const all = [...this.cache.values()].flatMap((c) => c.prs);
-    return all.sort((a, b) => a.createdAt < b.createdAt ? 1 : -1);
+  return {
+    base: mb ?? null,
+    baseRef,
+    files,
+    commits: (log ?? "").split(`
+`).filter(Boolean),
+    dirty: (status ?? "").trim().length > 0
+  };
+}
+async function worktreePatch(path, base, file) {
+  const from = base ?? "HEAD";
+  if (file) {
+    const tracked = await gitAsync(path, ["ls-files", "--error-unmatch", "--", file]) !== null;
+    if (!tracked) {
+      const p = Bun.spawn(["git", "-C", path, "diff", "--no-index", "--", "/dev/null", file], {
+        stdout: "pipe",
+        stderr: "ignore"
+      });
+      const [out] = await Promise.all([new Response(p.stdout).text(), p.exited]);
+      return out;
+    }
+    return await gitAsync(path, ["diff", from, "--", file]) ?? "";
   }
-  async refresh(maxAgeMs = 120000) {
-    const projects = this.store.liveProjects();
-    await Promise.all(projects.map(async (p) => {
-      const hit = this.cache.get(p.id);
-      if (hit && Date.now() - hit.at < maxAgeMs)
-        return;
-      if (this.inflight.has(p.id))
-        return;
-      this.inflight.add(p.id);
-      try {
-        const prs = await this.poll(p.id, p.root);
-        this.cache.set(p.id, { at: Date.now(), prs });
-      } catch {
-        this.cache.set(p.id, { at: Date.now(), prs: this.cache.get(p.id)?.prs ?? [] });
-      } finally {
-        this.inflight.delete(p.id);
-      }
-    }));
+  return await gitAsync(path, ["diff", from]) ?? "";
+}
+function realpathOr(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
   }
-  outcomeCache = new Map;
-  outcomeInflight = new Map;
-  mergedCached(projectId, root) {
-    const hit = this.outcomeCache.get(projectId);
-    const fresh = !!hit && Date.now() - hit.at < 600000;
-    if (!fresh)
-      this.merged(projectId, root).catch(() => {});
-    return { merged: hit?.merged ?? [], reverted: hit?.reverted ?? [], fresh };
+}
+
+// packages/daemon/src/codify.ts
+async function applyCodify(store, forge, projectId, seq, target) {
+  const project = store.project(projectId);
+  if (!project)
+    return { ok: false, error: "unknown project" };
+  const incident = store.incident(seq);
+  if (!incident || incident.projectId !== projectId)
+    return { ok: false, error: `no incident #${seq} in ${project.name}` };
+  const s = incident.suggestion;
+  if (!s)
+    return { ok: false, error: "this incident carries no suggestion to apply" };
+  const wantToml = target !== "claude-md" && Boolean(s.toml);
+  const wantLesson = target !== "swarm-toml";
+  if (!wantToml && !wantLesson)
+    return { ok: false, error: "nothing to write for this target (the rule has no config form)" };
+  const name = `codify-${seq}`;
+  const branch = `swarm/${name}`;
+  const created = store.createWorktree(projectId, name, "HEAD", branch);
+  if (!created.ok)
+    return { ok: false, error: created.error };
+  const wt = created.worktree;
+  const files = [];
+  const read = (f) => existsSync4(join5(wt, f)) ? readFileSync3(join5(wt, f), "utf8") : null;
+  if (wantLesson) {
+    writeFileSync2(join5(wt, "CLAUDE.md"), mergeLesson(read("CLAUDE.md"), s.lesson));
+    files.push("CLAUDE.md");
   }
-  async merged(projectId, root) {
-    const hit = this.outcomeCache.get(projectId);
-    if (hit && Date.now() - hit.at < 600000)
-      return hit;
-    const inflight = this.outcomeInflight.get(projectId);
-    if (inflight)
-      return inflight;
-    const run = this.fetchMerged(projectId, root).finally(() => this.outcomeInflight.delete(projectId));
-    this.outcomeInflight.set(projectId, run);
-    return run;
+  if (wantToml && s.toml) {
+    writeFileSync2(join5(wt, ".swarm.toml"), mergeToml(read(".swarm.toml"), s.toml));
+    files.push(".swarm.toml");
   }
-  async fetchMerged(projectId, root) {
-    let merged = [];
-    const remote = await this.remote(root);
-    if (remote?.forge === "github") {
-      const out = await this.run([
-        "gh",
-        "pr",
-        "list",
-        "--state",
-        "merged",
-        "--limit",
-        "200",
-        "--json",
-        "number,title,headRefName,url,createdAt,mergedAt,mergeCommit"
-      ], root);
-      if (out)
-        merged = JSON.parse(out).map((r) => ({
-          branch: String(r.headRefName ?? ""),
-          number: Number(r.number ?? 0),
-          title: String(r.title ?? ""),
-          url: String(r.url ?? ""),
-          createdAt: r.createdAt ?? null,
-          mergedAt: r.mergedAt ?? null,
-          mergeSha: (r.mergeCommit?.oid ?? null)?.toLowerCase() ?? null
-        }));
-    } else if (remote?.forge === "gitlab") {
-      const out = await this.run(["glab", "mr", "list", "--merged", "--output", "json"], root);
-      if (out)
-        merged = JSON.parse(out).map((r) => ({
-          branch: String(r.source_branch ?? ""),
-          number: Number(r.iid ?? 0),
-          title: String(r.title ?? ""),
-          url: String(r.web_url ?? ""),
-          createdAt: r.created_at ?? null,
-          mergedAt: r.merged_at ?? null,
-          mergeSha: (r.merge_commit_sha ?? null)?.toLowerCase() ?? null
-        }));
+  const rule = String(incident.rule ?? "rule");
+  const message = `${s.title}
+
+Codified from Swarm incident #${seq} (${rule}):
+${String(incident.command ?? "").slice(0, 200)}
+
+${s.lesson}`;
+  const commit = commitPaths(wt, files, message);
+  if (!commit) {
+    await store.removeWorktree(projectId, wt, true);
+    return { ok: false, error: "nothing changed \u2014 the lesson and the rule were already in place" };
+  }
+  store.append({
+    ts: new Date().toISOString(),
+    type: "codify.applied",
+    projectId,
+    sessionId: null,
+    payload: {
+      seq,
+      rule,
+      branch,
+      files,
+      commit,
+      summary: `codified incident #${seq} onto ${branch}`
     }
-    const log = await this.run(["git", "log", "--grep", "This reverts commit", "--format=%B", "-n", "300"], root);
-    const reverted = log ? [...parseReverts(log)] : [];
-    const entry = { at: Date.now(), merged, reverted };
-    this.outcomeCache.set(projectId, entry);
-    return entry;
+  });
+  const pr = await forge.openPR(projectId, { path: wt, branch, dirty: 0, main: false }, {
+    title: s.title,
+    body: `Codified from Swarm incident #${seq} (\`${rule}\`).
+
+\`\`\`
+${String(incident.command ?? "").slice(0, 400)}
+\`\`\`
+
+${s.lesson}${s.toml ? `
+
+\`\`\`toml
+${s.toml}
+\`\`\`` : ""}`,
+    isDraft: false
+  });
+  if (pr.ok) {
+    store.recordPrOpened(projectId, name, wt, pr.url);
+    await store.removeWorktree(projectId, wt, false);
+    return {
+      ok: true,
+      branch,
+      files,
+      commit,
+      pr: { url: pr.url, ...pr.number ? { number: pr.number } : {} }
+    };
   }
-  remoteCache = new Map;
-  async remote(root) {
-    const hit = this.remoteCache.get(root);
-    if (hit && Date.now() - hit.at < (hit.v ? 600000 : 60000))
-      return hit.v;
-    const out = await this.run(["git", "remote", "get-url", "origin"], root);
-    const v = out ? parseRemote(out.trim()) : null;
-    this.remoteCache.set(root, { at: Date.now(), v });
-    return v;
+  return {
+    ok: true,
+    branch,
+    files,
+    commit,
+    worktree: wt,
+    gitLine: `git -C ${JSON.stringify(wt)} push -u origin ${branch}`
+  };
+}
+
+// packages/daemon/src/dispatcher.ts
+class Dispatcher {
+  store;
+  runner;
+  forge;
+  entries = new Map;
+  opts = new Map;
+  constructor(store, runner, forge) {
+    this.store = store;
+    this.runner = runner;
+    this.forge = forge;
+    runner.onEnd((run) => void this.onRunEnd(run));
   }
-  async run(cmd, cwd, timeoutMs = 20000) {
-    const bin = findBin(cmd[0]);
-    if (!bin)
-      return null;
-    let proc;
-    try {
-      proc = Bun.spawn([bin, ...cmd.slice(1)], { cwd, stdout: "pipe", stderr: "ignore" });
-    } catch {
-      return null;
-    }
-    const killer = setTimeout(() => proc.kill(), timeoutMs);
-    try {
-      const out = await new Response(proc.stdout).text();
-      return await proc.exited === 0 ? out : null;
-    } catch {
-      return null;
-    } finally {
-      clearTimeout(killer);
+  project(projectId) {
+    let m = this.entries.get(projectId);
+    if (!m) {
+      m = new Map;
+      this.entries.set(projectId, m);
     }
+    return m;
   }
-  async poll(projectId, root) {
-    const remote = await this.remote(root);
-    if (!remote)
-      return [];
-    let prs = [];
-    if (remote.forge === "github") {
-      const out = await this.run(["gh", "pr", "list", "--json", GH_FIELDS], root);
-      if (out)
-        prs = normalizeGithub(JSON.parse(out), remote.repo);
-    } else {
-      const out = await this.run(["glab", "mr", "list", "--output", "json"], root);
-      if (out)
-        prs = normalizeGitlab(JSON.parse(out), remote.repo);
-    }
-    return prs.map((pr) => ({ ...pr, projectId, projectRoot: root }));
+  status(projectId) {
+    return [...this.entries.get(projectId)?.values() ?? []];
   }
-  async openPR(projectId, worktree, draft) {
-    const p = this.store.projects().find((x) => x.id === projectId);
-    if (!p)
-      return { ok: false, error: "unknown project" };
-    if (worktree.main)
-      return { ok: false, error: "that is the main checkout \u2014 open the PR from a task worktree" };
-    if (!worktree.branch)
-      return { ok: false, error: "detached HEAD \u2014 check out a branch first" };
-    if (worktree.dirty > 0)
+  async dispatch(projectId, wanted, o = {}) {
+    const board = this.store.tasks(projectId);
+    if (!board)
       return {
         ok: false,
-        error: `${worktree.path} has uncommitted changes \u2014 commit them first (Swarm never commits for you)`
+        error: "this repo has no task source ([tasks] source in .swarm.toml)"
       };
-    const remote = await this.remote(p.root);
-    if (!remote)
-      return { ok: false, error: "no GitHub/GitLab remote on origin" };
-    const cli = remote.forge === "github" ? "gh" : "glab";
-    const bin = findBin(cli);
-    if (!bin)
-      return { ok: false, error: `${cli} is not installed` };
-    const sh = async (cmd, cwd) => {
-      const proc = Bun.spawn(cmd, { cwd, stdout: "pipe", stderr: "pipe" });
-      const out = await new Response(proc.stdout).text() + await new Response(proc.stderr).text();
-      return { ok: await proc.exited === 0, out: out.trim() };
+    if (board.error)
+      return { ok: false, error: `task source: ${board.error}` };
+    const cfg = this.store.config(projectId).dispatch;
+    const opts = {
+      owner: o.owner ?? "dispatch",
+      ...o,
+      maxParallel: o.maxParallel ?? cfg.max_parallel
+    };
+    this.opts.set(projectId, opts);
+    const m = this.project(projectId);
+    const running = [...m.values()].filter((e) => e.state === "running").length;
+    const plan = planDispatch(board.tasks, wanted, {
+      maxParallel: opts.maxParallel,
+      running,
+      max: o.max,
+      alreadyQueued: [...m.values()].filter((e) => e.state !== "finished").map((e) => e.task)
+    });
+    const now = new Date().toISOString();
+    for (const t of [...plan.start, ...plan.queued]) {
+      m.set(t.id, {
+        task: t.id,
+        title: t.title,
+        state: "queued",
+        runId: null,
+        sessionId: null,
+        queuedAt: now,
+        startedAt: null,
+        endedAt: null,
+        outcome: null,
+        detail: null,
+        costUsd: null
+      });
+    }
+    if (plan.start.length || plan.queued.length)
+      this.store.append({
+        ts: now,
+        type: "dispatch.queued",
+        projectId,
+        sessionId: null,
+        payload: {
+          tasks: [...plan.start, ...plan.queued].map((t) => t.id),
+          maxParallel: opts.maxParallel,
+          summary: `dispatch ${[...plan.start, ...plan.queued].map((t) => t.id).join(", ")}`
+        }
+      });
+    const started = [];
+    const failed = [];
+    for (const t of plan.start) {
+      const r = await this.startOne(projectId, t);
+      if (r.ok)
+        started.push(t.id);
+      else
+        failed.push({ id: t.id, reason: r.reason });
+    }
+    await this.fill(projectId);
+    return {
+      ok: true,
+      started,
+      queued: plan.queued.map((t) => t.id).filter((id) => m.get(id)?.state === "queued"),
+      rejected: [...plan.rejected, ...failed]
     };
-    const push = await sh(["git", "push", "-u", "origin", worktree.branch], worktree.path);
-    if (!push.ok)
-      return { ok: false, error: `git push failed: ${push.out.slice(0, 400)}` };
-    const existing = this.prs().find((x) => x.projectId === projectId && x.branch === worktree.branch);
-    if (existing)
-      return { ok: true, url: existing.url, number: existing.number };
-    const cmd = remote.forge === "github" ? [
-      bin,
-      "pr",
-      "create",
-      "--head",
-      worktree.branch,
-      "--title",
-      draft.title,
-      "--body",
-      draft.body,
-      ...draft.isDraft ? ["--draft"] : []
-    ] : [
-      bin,
-      "mr",
-      "create",
-      "--source-branch",
-      worktree.branch,
-      "--title",
-      draft.title,
-      "--description",
-      draft.body,
-      "--yes",
-      ...draft.isDraft ? ["--draft"] : []
-    ];
-    const r = await sh(cmd, worktree.path);
-    if (!r.ok)
-      return { ok: false, error: `${cli} failed: ${r.out.slice(0, 400)}` };
-    const url = r.out.match(/https?:\/\/\S+/)?.[0] ?? r.out;
-    const num = Number(url.match(/\/(\d+)\s*$/)?.[1]);
-    this.cache.delete(projectId);
-    return { ok: true, url, number: Number.isFinite(num) ? num : null };
-  }
-  async merge(projectId, number) {
-    const p = this.store.projects().find((x) => x.id === projectId);
-    if (!p)
-      return { ok: false, output: "unknown project" };
-    const remote = await this.remote(p.root);
-    if (!remote)
-      return { ok: false, output: "no forge remote" };
-    const cmd = remote.forge === "github" ? ["gh", "pr", "merge", String(number), "--squash"] : ["glab", "mr", "merge", String(number), "--squash", "--yes"];
-    const bin = findBin(cmd[0]);
-    if (!bin)
-      return { ok: false, output: `${cmd[0] ?? "forge CLI"} is not installed` };
-    const proc = Bun.spawn([bin, ...cmd.slice(1)], { cwd: p.root, stdout: "pipe", stderr: "pipe" });
-    const out = await new Response(proc.stdout).text() + await new Response(proc.stderr).text();
-    const ok = await proc.exited === 0;
-    if (ok)
-      this.cache.delete(projectId);
-    return { ok, output: out.trim().slice(0, 800) };
-  }
-}
-
-// packages/daemon/src/git.ts
-import { realpathSync } from "fs";
-import { join as join5 } from "path";
-function git(cwd, args) {
-  try {
-    const r = Bun.spawnSync(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore" });
-    return r.exitCode === 0 ? r.stdout.toString() : null;
-  } catch {
-    return null;
   }
-}
-function gitCommonDir(cwd) {
-  const out = git(cwd, ["rev-parse", "--git-common-dir"])?.trim();
-  if (!out)
-    return null;
-  try {
-    return realpathSync(out.startsWith("/") ? out : join5(cwd, out));
-  } catch {
-    return null;
+  async startOne(projectId, t) {
+    const m = this.project(projectId);
+    const e = m.get(t.id);
+    const opts = this.opts.get(projectId) ?? { owner: "dispatch" };
+    const cfg = this.store.config(projectId);
+    const gates = cfg.gates;
+    const prompt = taskPrompt(t, {
+      requiredGates: gates.required,
+      executableGates: gates.required.filter((g) => gates.defs[g]),
+      openPr: cfg.dispatch.require_pr
+    });
+    const r = await this.runner.start({
+      projectId,
+      task: t.id,
+      prompt,
+      owner: opts.owner,
+      permissionMode: opts.permissionMode ?? cfg.dispatch.permission_mode ?? "acceptEdits",
+      model: opts.model ?? cfg.dispatch.model ?? undefined,
+      maxTurns: opts.maxTurns ?? cfg.dispatch.max_turns ?? undefined,
+      profile: opts.profile ?? cfg.dispatch.profile ?? undefined
+    });
+    if (!r.ok) {
+      if (e) {
+        e.state = "finished";
+        e.endedAt = new Date().toISOString();
+        e.outcome = "crashed";
+        e.detail = r.reason;
+      }
+      this.store.append({
+        ts: new Date().toISOString(),
+        type: "dispatch.finished",
+        projectId,
+        sessionId: null,
+        payload: {
+          task: t.id,
+          outcome: "crashed",
+          detail: r.reason,
+          summary: `dispatch ${t.id}: could not start \u2014 ${r.reason}`
+        }
+      });
+      return { ok: false, reason: r.reason };
+    }
+    if (e) {
+      e.state = "running";
+      e.runId = r.run.id;
+      e.sessionId = r.run.sessionId;
+      e.startedAt = r.run.startedAt;
+    }
+    this.store.append({
+      ts: r.run.startedAt,
+      type: "dispatch.started",
+      projectId,
+      sessionId: r.run.sessionId,
+      payload: {
+        task: t.id,
+        runId: r.run.id,
+        worktree: r.run.worktree,
+        by: this.opts.get(projectId)?.owner ?? null,
+        summary: `dispatch ${t.id} \u2192 run ${r.run.id}`
+      }
+    });
+    return { ok: true };
   }
-}
-function gitToplevel(cwd) {
-  const out = git(cwd, ["rev-parse", "--show-toplevel"])?.trim();
-  if (!out)
-    return null;
-  try {
-    return realpathSync(out);
-  } catch {
-    return null;
+  async fill(projectId) {
+    const m = this.project(projectId);
+    const cap = this.opts.get(projectId)?.maxParallel ?? this.store.config(projectId).dispatch.max_parallel;
+    for (const e of m.values()) {
+      const running = [...m.values()].filter((x) => x.state === "running").length;
+      if (running >= cap)
+        return;
+      if (e.state !== "queued")
+        continue;
+      await this.startOne(projectId, { id: e.task, title: e.title });
+    }
   }
-}
-function parseWorktreeList(out) {
-  const wts = [];
-  let cur = null;
-  const flush = () => {
-    if (cur?.path) {
-      wts.push({
-        path: cur.path,
-        branch: cur.branch ?? null,
-        head: (cur.head ?? "").slice(0, 7),
-        main: wts.length === 0,
-        dirty: -1,
-        ahead: -1,
-        behind: -1,
-        merged: false
+  async onRunEnd(run) {
+    const m = this.entries.get(run.projectId);
+    const e = m?.get(run.task);
+    if (!e || e.runId !== run.id)
+      return;
+    const cfg = this.store.config(run.projectId);
+    const required = cfg.gates.required;
+    let runs = this.store.gateRuns(run.projectId, run.task);
+    const status = this.store.gateStatusFor(runs, required);
+    const missing = required.filter((g) => cfg.gates.defs[g] && status.find((s) => s.gate === g)?.verdict !== "pass");
+    if (missing.length && !run.stopped) {
+      await this.store.runGates(run.projectId, run.task, missing, {
+        sessionId: run.sessionId,
+        owner: "dispatch"
       });
+      runs = this.store.gateRuns(run.projectId, run.task);
     }
-    cur = null;
-  };
-  for (const line of out.split(`
-`)) {
-    if (line.startsWith("worktree ")) {
-      flush();
-      cur = { path: line.slice(9) };
-    } else if (line.startsWith("HEAD ") && cur)
-      cur.head = line.slice(5);
-    else if (line.startsWith("branch ") && cur)
-      cur.branch = line.slice(7).replace(/^refs\/heads\//, "");
-    else if (line === "")
-      flush();
+    const satisfied = gatesSatisfied(runs, required);
+    await this.forge.refresh(0).catch(() => {});
+    const branch = `task/${run.task}`;
+    const pr = this.forge.prs().find((p) => p.projectId === run.projectId && p.branch === branch);
+    const outcome = dispatchOutcome({
+      exitCode: run.exitCode,
+      isError: run.result?.isError ?? false,
+      gatesSatisfied: satisfied,
+      prOpen: Boolean(pr),
+      requirePr: cfg.dispatch.require_pr,
+      stopped: run.stopped ?? false
+    });
+    const verdicts = this.store.gateStatusFor(runs, required).map((s) => `${s.gate} ${s.verdict ?? "\u2014"}`).join(", ");
+    const detail = [
+      `exit ${run.exitCode}${run.result?.isError ? " (error)" : ""}`,
+      required.length ? `gates: ${verdicts}` : null,
+      pr ? `PR ${pr.url}` : cfg.dispatch.require_pr ? "no PR" : null
+    ].filter(Boolean).join(" \xB7 ");
+    e.state = "finished";
+    e.endedAt = run.endedAt;
+    e.outcome = outcome;
+    e.detail = detail;
+    e.costUsd = run.result?.costUsd ?? null;
+    const ts = run.endedAt ?? new Date().toISOString();
+    this.store.append({
+      ts,
+      type: "dispatch.finished",
+      projectId: run.projectId,
+      sessionId: run.sessionId,
+      payload: {
+        task: run.task,
+        runId: run.id,
+        outcome,
+        detail,
+        costUsd: e.costUsd,
+        summary: `dispatch ${run.task}: ${outcome} \u2014 ${detail}`
+      }
+    });
+    if (outcome !== "done" && outcome !== "stopped")
+      this.store.append({
+        ts,
+        type: "incident.opened",
+        projectId: run.projectId,
+        sessionId: run.sessionId,
+        payload: {
+          rule: "dispatch_failed",
+          action: outcome,
+          command: run.task,
+          reason: `dispatched run on ${run.task} ended ${outcome}: ${detail}. The worktree and claim are kept; resume it from the session page or release it.`
+        }
+      });
+    this.store.touch();
+    await this.fill(run.projectId);
+  }
+  clear(projectId, task) {
+    const m = this.project(projectId);
+    let n = 0;
+    for (const [id, e] of m) {
+      if (task && id !== task)
+        continue;
+      if (e.state === "queued" || e.state === "finished" && !task) {
+        m.delete(id);
+        n++;
+      }
+    }
+    return n;
   }
-  flush();
-  return wts;
-}
-function applyStatus(w, st, ah) {
-  w.dirty = st === null ? -1 : st.split(`
-`).filter(Boolean).length;
-  const a = ah?.trim();
-  w.ahead = a === undefined || a === "" ? -1 : Number(a);
-}
-function applyDrift(w, behind, ancestor, firstParents, cherry = null) {
-  const b = behind?.trim();
-  w.behind = b === undefined || b === "" ? -1 : Number(b);
-  const onLine = firstParents?.split(`
-`).some((sha) => sha.startsWith(w.head)) ?? true;
-  w.merged = (ancestor || squashed(cherry)) && !onLine;
-}
-function squashed(cherry) {
-  if (!cherry)
-    return false;
-  const lines = cherry.split(`
-`).filter((l) => l.trim());
-  return lines.length > 0 && lines.every((l) => l.startsWith("-"));
 }
-var FIRST_PARENT_DEPTH = "5000";
-var baseOf = (wts) => wts[0]?.main ? wts[0].branch : null;
-async function gitAsync(cwd, args) {
-  try {
-    const p = Bun.spawn(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore" });
-    const [out, code] = await Promise.all([new Response(p.stdout).text(), p.exited]);
-    return code === 0 ? out : null;
-  } catch {
+
+// packages/daemon/src/forge.ts
+import { existsSync as existsSync5 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join6 } from "path";
+var EXTRA_BIN_DIRS = [
+  "/opt/homebrew/bin",
+  "/usr/local/bin",
+  "/home/linuxbrew/.linuxbrew/bin",
+  join6(homedir2(), ".local", "bin"),
+  join6(homedir2(), "bin")
+];
+function findBin(name) {
+  if (!name)
     return null;
+  const onPath = Bun.which(name, { PATH: process.env.PATH ?? "" });
+  if (onPath)
+    return onPath;
+  for (const d of EXTRA_BIN_DIRS) {
+    const p = join6(d, name);
+    if (existsSync5(p))
+      return p;
   }
+  return null;
 }
-async function listWorktreesAsync(root) {
-  const out = await gitAsync(root, ["worktree", "list", "--porcelain"]);
-  if (!out)
-    return [];
-  const wts = parseWorktreeList(out);
-  const base = baseOf(wts);
-  const line = base ? await gitAsync(root, ["rev-list", "--first-parent", "-n", FIRST_PARENT_DEPTH, base]) : null;
-  await Promise.all(wts.map(async (w) => {
-    const drift = base && !w.main;
-    const [st, ah, be, mg, ch] = await Promise.all([
-      gitAsync(w.path, ["status", "--porcelain", "--untracked-files=no"]),
-      gitAsync(w.path, ["rev-list", "--count", "@{upstream}..HEAD"]),
-      drift ? gitAsync(w.path, ["rev-list", "--count", `HEAD..${base}`]) : null,
-      drift ? gitAsync(w.path, ["merge-base", "--is-ancestor", "HEAD", base]) : null,
-      drift ? gitAsync(w.path, ["cherry", base, "HEAD"]) : null
-    ]);
-    applyStatus(w, st, ah);
-    if (drift)
-      applyDrift(w, be, mg !== null, line, ch);
-  }));
-  return wts;
-}
-var branchCache = new Map;
-function currentBranch(cwd) {
-  const hit = branchCache.get(cwd);
-  const now = Date.now();
-  if (hit && now - hit.t < 5000)
-    return hit.v;
-  const v = git(cwd, ["rev-parse", "--abbrev-ref", "HEAD"])?.trim() ?? null;
-  branchCache.set(cwd, { v: v === "HEAD" ? "(detached)" : v, t: now });
-  return branchCache.get(cwd)?.v ?? null;
-}
-var originCache = new Map;
-function originUrl(root) {
-  const hit = originCache.get(root);
-  const now = Date.now();
-  if (hit && now - hit.t < 300000)
-    return hit.v;
-  const v = git(root, ["config", "--get", "remote.origin.url"])?.trim() || null;
-  originCache.set(root, { v, t: now });
-  return v;
-}
-function worktreeAdd(repoRoot, path, branch, baseRef = "HEAD") {
-  const branchExists = git(repoRoot, ["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`]) !== null;
-  const args = branchExists ? ["worktree", "add", path, branch] : ["worktree", "add", "-b", branch, path, baseRef];
-  if (git(repoRoot, args) === null)
-    return null;
-  try {
-    return realpathSync(path);
-  } catch {
-    return path;
+var GH_FIELDS = "number,title,headRefName,url,author,isDraft,mergeable,reviewDecision,statusCheckRollup,createdAt";
+
+class ForgeService {
+  store;
+  cache = new Map;
+  inflight = new Set;
+  constructor(store) {
+    this.store = store;
   }
-}
-function worktreeRemove(repoRoot, path, force) {
-  const args = ["worktree", "remove", path];
-  if (force)
-    args.push("--force");
-  return git(repoRoot, args) !== null;
-}
-function heldWork(path) {
-  const status = git(path, ["status", "--porcelain"]);
-  const dirty = status !== null && status.trim().length > 0;
-  const count = (args) => {
-    const out = git(path, ["rev-list", "--count", ...args])?.trim();
-    return out !== undefined && out !== "" ? Number(out) : 0;
-  };
-  let unpushed;
-  if (git(path, ["rev-parse", "--verify", "--quiet", "@{upstream}"]) !== null) {
-    unpushed = count(["@{upstream}..HEAD"]) > 0;
-  } else {
-    const baselines = ["--remotes"];
-    for (const b of ["main", "master"]) {
-      if (git(path, ["rev-parse", "--verify", "--quiet", `refs/heads/${b}`]) !== null)
-        baselines.push(b);
+  prs() {
+    this.refresh();
+    const all = [...this.cache.values()].flatMap((c) => c.prs);
+    return all.sort((a, b) => a.createdAt < b.createdAt ? 1 : -1);
+  }
+  async refresh(maxAgeMs = 120000) {
+    const projects = this.store.liveProjects();
+    await Promise.all(projects.map(async (p) => {
+      const hit = this.cache.get(p.id);
+      if (hit && Date.now() - hit.at < maxAgeMs)
+        return;
+      if (this.inflight.has(p.id))
+        return;
+      this.inflight.add(p.id);
+      try {
+        const prs = await this.poll(p.id, p.root);
+        this.cache.set(p.id, { at: Date.now(), prs });
+      } catch {
+        this.cache.set(p.id, { at: Date.now(), prs: this.cache.get(p.id)?.prs ?? [] });
+      } finally {
+        this.inflight.delete(p.id);
+      }
+    }));
+  }
+  outcomeCache = new Map;
+  outcomeInflight = new Map;
+  mergedCached(projectId, root) {
+    const hit = this.outcomeCache.get(projectId);
+    const fresh = !!hit && Date.now() - hit.at < 600000;
+    if (!fresh)
+      this.merged(projectId, root).catch(() => {});
+    return { merged: hit?.merged ?? [], reverted: hit?.reverted ?? [], fresh };
+  }
+  async merged(projectId, root) {
+    const hit = this.outcomeCache.get(projectId);
+    if (hit && Date.now() - hit.at < 600000)
+      return hit;
+    const inflight = this.outcomeInflight.get(projectId);
+    if (inflight)
+      return inflight;
+    const run = this.fetchMerged(projectId, root).finally(() => this.outcomeInflight.delete(projectId));
+    this.outcomeInflight.set(projectId, run);
+    return run;
+  }
+  async fetchMerged(projectId, root) {
+    let merged = [];
+    const remote = await this.remote(root);
+    if (remote?.forge === "github") {
+      const out = await this.run([
+        "gh",
+        "pr",
+        "list",
+        "--state",
+        "merged",
+        "--limit",
+        "200",
+        "--json",
+        "number,title,headRefName,url,createdAt,mergedAt,mergeCommit"
+      ], root);
+      if (out)
+        merged = JSON.parse(out).map((r) => ({
+          branch: String(r.headRefName ?? ""),
+          number: Number(r.number ?? 0),
+          title: String(r.title ?? ""),
+          url: String(r.url ?? ""),
+          createdAt: r.createdAt ?? null,
+          mergedAt: r.mergedAt ?? null,
+          mergeSha: (r.mergeCommit?.oid ?? null)?.toLowerCase() ?? null
+        }));
+    } else if (remote?.forge === "gitlab") {
+      const out = await this.run(["glab", "mr", "list", "--merged", "--output", "json"], root);
+      if (out)
+        merged = JSON.parse(out).map((r) => ({
+          branch: String(r.source_branch ?? ""),
+          number: Number(r.iid ?? 0),
+          title: String(r.title ?? ""),
+          url: String(r.web_url ?? ""),
+          createdAt: r.created_at ?? null,
+          mergedAt: r.merged_at ?? null,
+          mergeSha: (r.merge_commit_sha ?? null)?.toLowerCase() ?? null
+        }));
+    }
+    const log = await this.run(["git", "log", "--grep", "This reverts commit", "--format=%B", "-n", "300"], root);
+    const reverted = log ? [...parseReverts(log)] : [];
+    const entry = { at: Date.now(), merged, reverted };
+    this.outcomeCache.set(projectId, entry);
+    return entry;
+  }
+  remoteCache = new Map;
+  async remote(root) {
+    const hit = this.remoteCache.get(root);
+    if (hit && Date.now() - hit.at < (hit.v ? 600000 : 60000))
+      return hit.v;
+    const out = await this.run(["git", "remote", "get-url", "origin"], root);
+    const v = out ? parseRemote(out.trim()) : null;
+    this.remoteCache.set(root, { at: Date.now(), v });
+    return v;
+  }
+  async run(cmd, cwd, timeoutMs = 20000) {
+    const bin = findBin(cmd[0]);
+    if (!bin)
+      return null;
+    let proc;
+    try {
+      proc = Bun.spawn([bin, ...cmd.slice(1)], { cwd, stdout: "pipe", stderr: "ignore" });
+    } catch {
+      return null;
+    }
+    const killer = setTimeout(() => proc.kill(), timeoutMs);
+    try {
+      const out = await new Response(proc.stdout).text();
+      return await proc.exited === 0 ? out : null;
+    } catch {
+      return null;
+    } finally {
+      clearTimeout(killer);
     }
-    unpushed = baselines.length > 1 ? count(["HEAD", "--not", ...baselines]) > 0 : false;
-  }
-  return { dirty, unpushed };
-}
-async function worktreeDiff(root, path) {
-  const wts = parseWorktreeList(await gitAsync(root, ["worktree", "list", "--porcelain"]) ?? "");
-  const baseRef = wts[0]?.path === realpathOr(root) || wts[0]?.main ? wts[0]?.branch ?? null : null;
-  const isMain = wts[0]?.path === path;
-  const mb = baseRef && !isMain ? (await gitAsync(path, ["merge-base", baseRef, "HEAD"]))?.trim() : null;
-  const from = mb || "HEAD";
-  const [numstat, names, log, status] = await Promise.all([
-    gitAsync(path, ["diff", "--numstat", from]),
-    gitAsync(path, ["diff", "--name-status", from]),
-    mb ? gitAsync(path, ["log", "--format=%s", `${mb}..HEAD`]) : Promise.resolve(""),
-    gitAsync(path, ["status", "--porcelain"])
-  ]);
-  const files = parseNumstat(numstat ?? "", names ?? "");
-  for (const line of (status ?? "").split(`
-`)) {
-    if (line.startsWith("?? "))
-      files.push({ path: line.slice(3), added: -1, deleted: -1, status: "?" });
   }
-  return {
-    base: mb ?? null,
-    baseRef,
-    files,
-    commits: (log ?? "").split(`
-`).filter(Boolean),
-    dirty: (status ?? "").trim().length > 0
-  };
-}
-async function worktreePatch(path, base, file) {
-  const from = base ?? "HEAD";
-  if (file) {
-    const tracked = await gitAsync(path, ["ls-files", "--error-unmatch", "--", file]) !== null;
-    if (!tracked) {
-      const p = Bun.spawn(["git", "-C", path, "diff", "--no-index", "--", "/dev/null", file], {
-        stdout: "pipe",
-        stderr: "ignore"
-      });
-      const [out] = await Promise.all([new Response(p.stdout).text(), p.exited]);
-      return out;
+  async poll(projectId, root) {
+    const remote = await this.remote(root);
+    if (!remote)
+      return [];
+    let prs = [];
+    if (remote.forge === "github") {
+      const out = await this.run(["gh", "pr", "list", "--json", GH_FIELDS], root);
+      if (out)
+        prs = normalizeGithub(JSON.parse(out), remote.repo);
+    } else {
+      const out = await this.run(["glab", "mr", "list", "--output", "json"], root);
+      if (out)
+        prs = normalizeGitlab(JSON.parse(out), remote.repo);
     }
-    return await gitAsync(path, ["diff", from, "--", file]) ?? "";
+    return prs.map((pr) => ({ ...pr, projectId, projectRoot: root }));
   }
-  return await gitAsync(path, ["diff", from]) ?? "";
-}
-function realpathOr(p) {
-  try {
-    return realpathSync(p);
-  } catch {
-    return p;
+  async openPR(projectId, worktree, draft) {
+    const p = this.store.projects().find((x) => x.id === projectId);
+    if (!p)
+      return { ok: false, error: "unknown project" };
+    if (worktree.main)
+      return { ok: false, error: "that is the main checkout \u2014 open the PR from a task worktree" };
+    if (!worktree.branch)
+      return { ok: false, error: "detached HEAD \u2014 check out a branch first" };
+    if (worktree.dirty > 0)
+      return {
+        ok: false,
+        error: `${worktree.path} has uncommitted changes \u2014 commit them first (Swarm never commits for you)`
+      };
+    const remote = await this.remote(p.root);
+    if (!remote)
+      return { ok: false, error: "no GitHub/GitLab remote on origin" };
+    const cli = remote.forge === "github" ? "gh" : "glab";
+    const bin = findBin(cli);
+    if (!bin)
+      return { ok: false, error: `${cli} is not installed` };
+    const sh = async (cmd, cwd) => {
+      const proc = Bun.spawn(cmd, { cwd, stdout: "pipe", stderr: "pipe" });
+      const out = await new Response(proc.stdout).text() + await new Response(proc.stderr).text();
+      return { ok: await proc.exited === 0, out: out.trim() };
+    };
+    const push = await sh(["git", "push", "-u", "origin", worktree.branch], worktree.path);
+    if (!push.ok)
+      return { ok: false, error: `git push failed: ${push.out.slice(0, 400)}` };
+    const existing = this.prs().find((x) => x.projectId === projectId && x.branch === worktree.branch);
+    if (existing)
+      return { ok: true, url: existing.url, number: existing.number };
+    const cmd = remote.forge === "github" ? [
+      bin,
+      "pr",
+      "create",
+      "--head",
+      worktree.branch,
+      "--title",
+      draft.title,
+      "--body",
+      draft.body,
+      ...draft.isDraft ? ["--draft"] : []
+    ] : [
+      bin,
+      "mr",
+      "create",
+      "--source-branch",
+      worktree.branch,
+      "--title",
+      draft.title,
+      "--description",
+      draft.body,
+      "--yes",
+      ...draft.isDraft ? ["--draft"] : []
+    ];
+    const r = await sh(cmd, worktree.path);
+    if (!r.ok)
+      return { ok: false, error: `${cli} failed: ${r.out.slice(0, 400)}` };
+    const url = r.out.match(/https?:\/\/\S+/)?.[0] ?? r.out;
+    const num = Number(url.match(/\/(\d+)\s*$/)?.[1]);
+    this.cache.delete(projectId);
+    return { ok: true, url, number: Number.isFinite(num) ? num : null };
+  }
+  async merge(projectId, number) {
+    const p = this.store.projects().find((x) => x.id === projectId);
+    if (!p)
+      return { ok: false, output: "unknown project" };
+    const remote = await this.remote(p.root);
+    if (!remote)
+      return { ok: false, output: "no forge remote" };
+    const cmd = remote.forge === "github" ? ["gh", "pr", "merge", String(number), "--squash"] : ["glab", "mr", "merge", String(number), "--squash", "--yes"];
+    const bin = findBin(cmd[0]);
+    if (!bin)
+      return { ok: false, output: `${cmd[0] ?? "forge CLI"} is not installed` };
+    const proc = Bun.spawn([bin, ...cmd.slice(1)], { cwd: p.root, stdout: "pipe", stderr: "pipe" });
+    const out = await new Response(proc.stdout).text() + await new Response(proc.stderr).text();
+    const ok = await proc.exited === 0;
+    if (ok)
+      this.cache.delete(projectId);
+    return { ok, output: out.trim().slice(0, 800) };
   }
 }
 
 // packages/daemon/src/runner.ts
 import { appendFileSync, mkdirSync as mkdirSync2, openSync } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var PERMISSION_MODES = [
   "acceptEdits",
   "auto",
@@ -6732,9 +7576,9 @@ class Runner {
     await this.store.awaitBootstrap(worktree);
     const sessionId = crypto.randomUUID();
     const id = sessionId.slice(0, 8);
-    const logDir = join6(this.home, "logs", project.id);
+    const logDir = join7(this.home, "logs", project.id);
     mkdirSync2(logDir, { recursive: true });
-    const log = join6(logDir, `run-${input.task.replace(/[^a-zA-Z0-9_.-]+/g, "-")}-${id}.log`);
+    const log = join7(logDir, `run-${input.task.replace(/[^a-zA-Z0-9_.-]+/g, "-")}-${id}.log`);
     const logFd = openSync(log, "a");
     const args = [
       bin,
@@ -6917,6 +7761,18 @@ class Runner {
       this.answerPermission(run.id, requestId, true);
       return;
     }
+    if (decision.action === "rewrite") {
+      const second = this.store.evaluateTool(tool, { command: decision.command }, run.sessionId, run.worktree, false).decision;
+      if (second.action === "deny" || second.action === "ask") {
+        this.answerPermission(run.id, requestId, false, `[swarm] ${second.reason}`);
+        return;
+      }
+      this.answerPermission(run.id, requestId, true, undefined, {
+        ...input,
+        command: decision.command
+      });
+      return;
+    }
     run.pending.push({
       requestId,
       tool,
@@ -6941,7 +7797,7 @@ class Runner {
     });
     this.store.touch();
   }
-  answerPermission(runId, requestId, allow, message) {
+  answerPermission(runId, requestId, allow, message, updatedInput) {
     const entry = this.live.get(runId);
     if (!entry)
       return { ok: false, reason: "no live run" };
@@ -6949,7 +7805,7 @@ class Runner {
     if (!stdin || typeof stdin === "number")
       return { ok: false, reason: "stdin not available" };
     const pend = entry.run.pending.find((p) => p.requestId === requestId);
-    const response = allow ? { behavior: "allow", updatedInput: pend?.input ?? {} } : { behavior: "deny", message: message ?? "Denied from the Swarm dashboard" };
+    const response = allow ? { behavior: "allow", updatedInput: updatedInput ?? pend?.input ?? {} } : { behavior: "deny", message: message ?? "Denied from the Swarm dashboard" };
     stdin.write(`${JSON.stringify({ type: "control_response", response: { subtype: "success", request_id: requestId, response } })}
 `);
     stdin.flush();
@@ -7013,33 +7869,33 @@ import { Database } from "bun:sqlite";
 import {
   closeSync,
   copyFileSync,
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync4,
   openSync as openSync3,
   readdirSync,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync4,
   readSync,
   realpathSync as realpathSync2,
   renameSync,
   rmSync as rmSync2,
   statSync,
   unlinkSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "fs";
 import { homedir as homedir3, hostname, tmpdir, userInfo } from "os";
-import { basename, dirname as dirname3, join as join8 } from "path";
+import { basename, dirname as dirname3, join as join9 } from "path";
 
 // packages/daemon/src/bootstrap.ts
-import { cpSync, existsSync as existsSync5, mkdirSync as mkdirSync3, openSync as openSync2 } from "fs";
-import { dirname as dirname2, join as join7 } from "path";
+import { cpSync, existsSync as existsSync6, mkdirSync as mkdirSync3, openSync as openSync2 } from "fs";
+import { dirname as dirname2, join as join8 } from "path";
 function runBootstrap(plan, opts) {
-  const logDir = join7(opts.home, "logs", opts.projectId);
+  const logDir = join8(opts.home, "logs", opts.projectId);
   mkdirSync3(logDir, { recursive: true });
-  const log = join7(logDir, `bootstrap-${opts.task.replace(/[^a-zA-Z0-9_.-]+/g, "-")}.log`);
+  const log = join8(logDir, `bootstrap-${opts.task.replace(/[^a-zA-Z0-9_.-]+/g, "-")}.log`);
   const copied = [];
   const skipped = [];
   for (const c of plan.copies) {
-    if (!existsSync5(c.from)) {
+    if (!existsSync6(c.from)) {
       skipped.push(c.rel);
       continue;
     }
@@ -7209,6 +8065,15 @@ CREATE TABLE IF NOT EXISTS messages (
   answer TEXT, answered_by TEXT, answered_at TEXT, delivered_at TEXT
 );
 CREATE INDEX IF NOT EXISTS messages_open ON messages(project_id, answered_at, delivered_at);
+-- the statusline asks per session after every assistant message; messages_open cannot serve that
+CREATE INDEX IF NOT EXISTS messages_session ON messages(session_id, kind, answered_at);
+CREATE TABLE IF NOT EXISTS quota (
+  id INTEGER PRIMARY KEY AUTOINCREMENT, at INTEGER, window TEXT, used_pct REAL, resets_at INTEGER,
+  session_id TEXT, project_id TEXT
+);
+CREATE INDEX IF NOT EXISTS quota_window_at ON quota(window, at);
+-- the report reads a time range across every window; (window, at) cannot serve a bare at >= ?
+CREATE INDEX IF NOT EXISTS quota_at ON quota(at);
 CREATE TABLE IF NOT EXISTS workflow_runs (
   id INTEGER PRIMARY KEY AUTOINCREMENT, project_id TEXT, task TEXT, workflow TEXT,
   step INTEGER, step_label TEXT, steps TEXT, state TEXT, detail TEXT, run_id TEXT,
@@ -7237,7 +8102,7 @@ class Store {
   constructor(home = swarmHome()) {
     mkdirSync4(home, { recursive: true });
     this.home = home;
-    this.db = new Database(join8(home, "swarm.db"));
+    this.db = new Database(join9(home, "swarm.db"));
     this.loadPricing();
     this.db.exec("PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL; PRAGMA mmap_size=268435456; PRAGMA cache_size=-32000;");
     this.db.exec(SCHEMA);
@@ -7250,7 +8115,7 @@ class Store {
     this.ensureColumn("messages", "to_kind", "TEXT");
     this.ensureColumn("messages", "from_session", "TEXT");
     this.migrate();
-    this.migrateProjectsJson(join8(home, "projects.json"));
+    this.migrateProjectsJson(join9(home, "projects.json"));
     this.reconcileMovedProjects();
     this.slimExistingEvents();
     this.retypeNotificationIncidents();
@@ -7303,13 +8168,22 @@ class Store {
   }
   reconcileMovedProjects() {
     const all = this.projects();
+    const byId = new Map(all.map((p) => [p.id, p]));
     for (const stale of all) {
-      if (existsSync6(stale.root))
+      if (!byId.has(stale.id))
         continue;
-      const live = all.filter((p) => p.id !== stale.id && p.name === stale.name && existsSync6(p.root));
+      if (existsSync7(stale.root)) {
+        const current = projectIdentity({ root: stale.root, commonDir: gitCommonDir(stale.root) });
+        const live = current.id !== stale.id ? byId.get(current.id) : undefined;
+        if (live && this.mergeProject(stale.id, live.id))
+          byId.delete(stale.id);
+        continue;
+      }
+      const live = all.filter((p) => p.id !== stale.id && p.name === stale.name && existsSync7(p.root));
       if (live.length !== 1)
         continue;
-      this.mergeProject(stale.id, live[0].id);
+      if (this.mergeProject(stale.id, live[0].id))
+        byId.delete(stale.id);
     }
   }
   mergeProject(from, into) {
@@ -7400,10 +8274,10 @@ class Store {
     return actorFrom(owner, sessionId, { user: osUser(), runId });
   }
   migrateProjectsJson(file) {
-    if (!existsSync6(file))
+    if (!existsSync7(file))
       return;
     try {
-      const list = JSON.parse(readFileSync3(file, "utf8"));
+      const list = JSON.parse(readFileSync4(file, "utf8"));
       const ins = this.db.query("INSERT OR IGNORE INTO projects (id, root, common_dir, name, discovered, created_at) VALUES (?, ?, ?, ?, ?, ?)");
       for (const p of list)
         ins.run(p.id, p.root, p.commonDir, p.name, p.discovered ? 1 : 0, p.createdAt);
@@ -7415,7 +8289,7 @@ class Store {
     const hit = this.topCache.get(cwd);
     if (hit && Date.now() - hit.t < 1e4)
       return hit.v;
-    const v = cwd && existsSync6(cwd) ? gitToplevel(cwd) : null;
+    const v = cwd && existsSync7(cwd) ? gitToplevel(cwd) : null;
     this.topCache.set(cwd, { v, t: Date.now() });
     return v;
   }
@@ -7621,7 +8495,7 @@ class Store {
     }));
   }
   sessionContext(cwd) {
-    if (!cwd || !existsSync6(cwd))
+    if (!cwd || !existsSync7(cwd))
       return null;
     const toplevel = this.toplevel(cwd);
     const project = this.resolveProject(cwd);
@@ -7749,6 +8623,7 @@ class Store {
       payload: { id, task: q.task, answer: a, by, summary: `answer to #${id}: ${a.slice(0, 120)}` }
     });
     this.touch();
+    this.wakeAll();
     return { ok: true, question: this.question(id) };
   }
   inbox(sessionId, opts = {}) {
@@ -7857,6 +8732,7 @@ class Store {
         summary: `message to ${String(input.to)}: ${v.text.slice(0, 120)}`
       }
     });
+    this.wakeAll();
     return { ok: true, message };
   }
   message(id) {
@@ -7898,48 +8774,334 @@ class Store {
       this.db.query(`UPDATE messages SET delivered_at = ?, session_id = ? WHERE id IN (${ms.map(() => "?").join(",")})`).run(new Date().toISOString(), sessionId, ...ms.map((m) => m.id));
     return ms;
   }
-  markMessageDelivered(id, sessionId) {
-    this.db.query("UPDATE messages SET delivered_at = ?, session_id = COALESCE(?, session_id) WHERE id = ? AND delivered_at IS NULL").run(new Date().toISOString(), sessionId, id);
+  markMessageDelivered(id, sessionId) {
+    this.db.query("UPDATE messages SET delivered_at = ?, session_id = COALESCE(?, session_id) WHERE id = ? AND delivered_at IS NULL").run(new Date().toISOString(), sessionId, id);
+  }
+  leadSession(projectId) {
+    const r = this.db.query("SELECT id FROM sessions WHERE project_id = ? AND kind = 'interactive' AND state != 'ended' ORDER BY last_seen_at DESC LIMIT 1").get(projectId);
+    return r?.id ?? null;
+  }
+  sessionByPrefix(prefix) {
+    const rows = this.db.query("SELECT id FROM sessions WHERE id LIKE ? ORDER BY last_seen_at DESC LIMIT 2").all(`${prefix}%`);
+    return rows.length === 1 ? rows[0]?.id ?? null : null;
+  }
+  sessionForTask(projectId, task) {
+    const claim = this.claims(projectId).find((c) => c.task === task && c.state === "held");
+    if (!claim?.worktree)
+      return null;
+    const rows = this.db.query("SELECT id, cwd FROM sessions WHERE project_id = ? AND state != 'ended' ORDER BY last_seen_at DESC").all(projectId);
+    return rows.find((r) => isInside(r.cwd, claim.worktree))?.id ?? null;
+  }
+  questionContext(task, projectId) {
+    if (!task)
+      return null;
+    const qs = this.db.query("SELECT * FROM messages WHERE kind = 'question' AND project_id = ? AND task = ? AND (answered_at IS NULL OR delivered_at IS NULL) ORDER BY id").all(projectId, task);
+    const list = qs.map((r) => this.rowToQuestion(r));
+    const parts = [formatAnswers(list), formatOpenQuestions(list)].filter(Boolean);
+    if (list.some((q) => q.answer !== null))
+      this.db.query("UPDATE messages SET delivered_at = ? WHERE kind = 'question' AND project_id = ? AND task = ? AND answered_at IS NOT NULL AND delivered_at IS NULL").run(new Date().toISOString(), projectId, task);
+    return parts.length ? parts.join(`
+`) : null;
+  }
+  contextFor(cwd, sessionId) {
+    const parts = [];
+    const base = this.sessionContext(cwd);
+    if (base)
+      parts.push(base);
+    const answers = this.answerContext(sessionId);
+    if (answers)
+      parts.push(answers);
+    const open = formatOpenQuestions(this.questions({ sessionId: sessionId ?? undefined, open: true }));
+    if (open && !base?.includes(open))
+      parts.push(open);
+    return { text: parts.length ? parts.join(`
+`) : null, parts };
+  }
+  dashboardSeenAt = 0;
+  touchDashboard() {
+    this.dashboardSeenAt = Date.now();
+  }
+  dashboardWatching(withinMs = 12000) {
+    return Date.now() - this.dashboardSeenAt < withinMs;
+  }
+  interactive = new Map;
+  interactiveSeq = 0;
+  pendingPermissions() {
+    return [...this.interactive.values()].map((x) => x.p);
+  }
+  askInteractive(raw, waitMs) {
+    const sessionId = typeof raw.session_id === "string" ? raw.session_id : "";
+    const cwd = typeof raw.cwd === "string" ? raw.cwd : "";
+    const tool = typeof raw.tool_name === "string" ? raw.tool_name : "tool";
+    const input = raw.tool_input ?? {};
+    const id = typeof raw.tool_use_id === "string" && raw.tool_use_id ? raw.tool_use_id : `perm_${++this.interactiveSeq}`;
+    const project = cwd && existsSync7(cwd) ? this.resolveProject(cwd) : null;
+    const verdict = this.evaluateTool(tool, input, sessionId, cwd, false).decision;
+    const rule = verdict.action === "ask" || verdict.action === "deny" ? verdict.rule : null;
+    const now = Date.now();
+    const p = {
+      id,
+      sessionId,
+      projectId: project?.id ?? null,
+      tool,
+      display: summarizeToolInput(tool, input),
+      input,
+      reason: verdict.action === "ask" || verdict.action === "deny" ? verdict.reason : permissionReason(raw),
+      rule,
+      askedAt: new Date(now).toISOString(),
+      terminalAt: new Date(now + waitMs).toISOString()
+    };
+    return new Promise((resolve) => {
+      const done = (a) => {
+        const cur = this.interactive.get(id);
+        if (!cur || cur.resolve !== done)
+          return;
+        clearTimeout(cur.timer);
+        this.interactive.delete(id);
+        this.append({
+          ts: new Date().toISOString(),
+          type: "permission.resolved",
+          projectId: p.projectId ?? "p_unknown",
+          sessionId: sessionId || null,
+          payload: {
+            requestId: id,
+            tool,
+            display: p.display,
+            decision: a?.behavior ?? "terminal",
+            by: a?.by ?? "terminal",
+            source: "interactive",
+            summary: `${tool} ${a?.behavior ?? "handed to the terminal"} (${a?.by ?? "no answer in time"})`
+          }
+        });
+        this.touch();
+        resolve(a);
+      };
+      const timer = setTimeout(() => done(null), waitMs);
+      this.interactive.set(id, { p, resolve: done, timer });
+      this.touch();
+    });
+  }
+  answerInteractive(id, a) {
+    const cur = this.interactive.get(id);
+    if (!cur)
+      return {
+        ok: false,
+        reason: "no such pending permission (answered, or the terminal took over)"
+      };
+    cur.resolve(a);
+    return { ok: true };
+  }
+  recentEdits = new Map;
+  collisionWarned = new Map;
+  static EDIT_CAP = 5000;
+  lastEditPrune = 0;
+  noteEdit(sessionId, path, at = Date.now()) {
+    const m = this.recentEdits.get(path) ?? new Map;
+    m.set(sessionId, at);
+    this.recentEdits.delete(path);
+    this.recentEdits.set(path, m);
+    if (this.recentEdits.size > Store.EDIT_CAP && at - this.lastEditPrune > 60000)
+      this.pruneEdits(at);
+  }
+  pruneEdits(now) {
+    this.lastEditPrune = now;
+    const keep = 4 * 60 * 60000;
+    for (const [path, m] of this.recentEdits) {
+      for (const [sid, at] of m)
+        if (now - at > keep)
+          m.delete(sid);
+      if (!m.size)
+        this.recentEdits.delete(path);
+    }
+    for (const [k, at] of this.collisionWarned)
+      if (now - at > keep)
+        this.collisionWarned.delete(k);
+    for (const path of this.recentEdits.keys()) {
+      if (this.recentEdits.size <= Store.EDIT_CAP)
+        break;
+      this.recentEdits.delete(path);
+    }
+  }
+  collisionContext(sessionId, cwd, path) {
+    const modes = this.rulesFor(this.toplevel(cwd));
+    if (modes.collision_context === false)
+      return null;
+    const windowMs = (modes.collision_window ?? DEFAULT_COLLISION_WINDOW_MIN) * 60000;
+    const now = Date.now();
+    const edits = [...this.recentEdits.get(path) ?? []].map(([sid, at]) => ({
+      sessionId: sid,
+      at
+    }));
+    if (edits.length < 2)
+      return null;
+    const cutoff = new Date(now - LIVE_WINDOW_MS - 1e4).toISOString();
+    const rows = this.db.query("SELECT id, cwd, branch, title FROM sessions WHERE state != 'ended' AND last_seen_at > ? AND id != ?").all(cutoff, sessionId);
+    const held = this.heldClaimsWithWorktree();
+    const live = new Map(rows.map((r) => [
+      r.id,
+      {
+        sessionId: r.id,
+        task: r.cwd ? held.find((c) => isInside(r.cwd, c.worktree))?.task ?? null : null,
+        branch: r.branch,
+        title: r.title
+      }
+    ]));
+    const w = collisionWarning(path, sessionId, edits, live, now, windowMs);
+    if (!w)
+      return null;
+    const fresh = w.others.filter((o) => {
+      const k = `${sessionId}|${o.sessionId}|${path}`;
+      const at = this.collisionWarned.get(k);
+      if (at && now - at < windowMs)
+        return false;
+      this.collisionWarned.set(k, now);
+      return true;
+    });
+    if (!fresh.length)
+      return null;
+    const project = cwd && existsSync7(cwd) ? this.resolveProject(cwd) : null;
+    this.append({
+      ts: new Date(now).toISOString(),
+      type: "collision.warned",
+      projectId: project?.id ?? "p_unknown",
+      sessionId,
+      payload: {
+        path,
+        others: fresh.map((o) => ({ sessionId: o.sessionId, task: o.task, branch: o.branch })),
+        summary: `also edited by ${fresh.map((o) => o.title ?? o.sessionId.slice(0, 8)).join(", ")}: ${path}`
+      }
+    });
+    return w.text;
+  }
+  wakers = new Map;
+  waitForWake(sessionId, maxMs) {
+    this.wakers.get(sessionId)?.resolve({ wake: false, reason: "replaced" });
+    if (!this.policyFor(null).config.messages.wake)
+      return Promise.resolve({ wake: false, reason: "off" });
+    const already = this.answerContext(sessionId);
+    if (already)
+      return Promise.resolve({ wake: true, text: already });
+    return new Promise((resolve) => {
+      const done = (r) => {
+        const cur = this.wakers.get(sessionId);
+        if (cur?.resolve !== done)
+          return;
+        clearTimeout(cur.timer);
+        this.wakers.delete(sessionId);
+        resolve(r);
+      };
+      const timer = setTimeout(() => done({ wake: false, reason: "timeout" }), maxMs);
+      this.wakers.set(sessionId, { resolve: done, timer });
+    });
+  }
+  wakeAll() {
+    for (const [sid, w] of [...this.wakers]) {
+      if (!this.hasPending(sid))
+        continue;
+      const text = this.answerContext(sid);
+      if (text) {
+        w.resolve({ wake: true, text });
+        this.append({
+          ts: new Date().toISOString(),
+          type: "message.delivered",
+          projectId: this.sessionProject(sid) ?? "p_unknown",
+          sessionId: sid,
+          payload: { by: "wake", summary: "woke the session with its inbox" }
+        });
+      }
+    }
+  }
+  hasPending(sessionId) {
+    return this.inbox(sessionId, { peek: true }).length > 0 || this.messageInbox(sessionId, { peek: true }).length > 0;
   }
-  leadSession(projectId) {
-    const r = this.db.query("SELECT id FROM sessions WHERE project_id = ? AND kind = 'interactive' AND state != 'ended' ORDER BY last_seen_at DESC LIMIT 1").get(projectId);
-    return r?.id ?? null;
+  cancelWake(sessionId, reason) {
+    this.wakers.get(sessionId)?.resolve({ wake: false, reason });
   }
-  sessionByPrefix(prefix) {
-    const rows = this.db.query("SELECT id FROM sessions WHERE id LIKE ? ORDER BY last_seen_at DESC LIMIT 2").all(`${prefix}%`);
-    return rows.length === 1 ? rows[0]?.id ?? null : null;
+  sessionProject(sessionId) {
+    const r = this.db.query("SELECT project_id FROM sessions WHERE id = ?").get(sessionId);
+    return r?.project_id ?? null;
   }
-  sessionForTask(projectId, task) {
-    const claim = this.claims(projectId).find((c) => c.task === task && c.state === "held");
-    if (!claim?.worktree)
-      return null;
-    const rows = this.db.query("SELECT id, cwd FROM sessions WHERE project_id = ? AND state != 'ended' ORDER BY last_seen_at DESC").all(projectId);
-    return rows.find((r) => isInside(r.cwd, claim.worktree))?.id ?? null;
+  statuslines = new Map;
+  statuslineFor(payload) {
+    const sessionId = typeof payload.session_id === "string" ? payload.session_id : null;
+    const cwd = typeof payload.cwd === "string" ? payload.cwd : payload.workspace?.current_dir ?? "";
+    if (sessionId)
+      this.statuslines.set(sessionId, { at: Date.now(), payload });
+    const held = cwd ? this.heldClaimsWithWorktree().find((c) => isInside(cwd, c.worktree)) : null;
+    const project = held ? this.project(held.projectId) : cwd && existsSync7(cwd) ? this.resolveProject(cwd) : null;
+    const budget = project ? this.budgetFor(project.id) : null;
+    this.recordQuota(payload, sessionId, project?.id ?? null);
+    const tight = tightestWindow(this.quota());
+    return {
+      quota: tight ? { window: tight.window, hoursToLimit: tight.hoursToLimit } : null,
+      task: held ? {
+        id: held.task,
+        leftMin: Math.max(0, Math.round((new Date(held.expiresAt).getTime() - Date.now()) / 60000))
+      } : null,
+      budget: budget?.status.limit != null ? { level: budget.status.level, pct: budget.status.pct } : null,
+      incidents: project ? this.openIncidents(project.id) : 0,
+      waitingOn: sessionId ? this.questions({ sessionId, open: true }).length : 0,
+      inbox: sessionId ? this.inbox(sessionId, { peek: true }).length : 0
+    };
   }
-  questionContext(task, projectId) {
-    if (!task)
-      return null;
-    const qs = this.db.query("SELECT * FROM messages WHERE kind = 'question' AND project_id = ? AND task = ? AND (answered_at IS NULL OR delivered_at IS NULL) ORDER BY id").all(projectId, task);
-    const list = qs.map((r) => this.rowToQuestion(r));
-    const parts = [formatAnswers(list), formatOpenQuestions(list)].filter(Boolean);
-    if (list.some((q) => q.answer !== null))
-      this.db.query("UPDATE messages SET delivered_at = ? WHERE kind = 'question' AND project_id = ? AND task = ? AND answered_at IS NOT NULL AND delivered_at IS NULL").run(new Date().toISOString(), projectId, task);
-    return parts.length ? parts.join(`
-`) : null;
+  recordQuota(payload, sessionId, projectId) {
+    const now = Date.now();
+    for (const q of quotaSamples(payload, now)) {
+      const last = this.db.query("SELECT at, used_pct, resets_at FROM quota WHERE window = ? ORDER BY at DESC LIMIT 1").get(q.window);
+      const moved = !last || Math.round(last.used_pct * 10) !== Math.round(q.usedPct * 10);
+      const reset = !last || last.resets_at !== q.resetsAt;
+      if (last && !reset && !moved && now - last.at < BURN_MIN_SPAN_MS)
+        continue;
+      this.db.query("INSERT INTO quota (at, window, used_pct, resets_at, session_id, project_id) VALUES (?, ?, ?, ?, ?, ?)").run(now, q.window, q.usedPct, q.resetsAt, sessionId, projectId);
+      this.quotaDirty = true;
+      this.quotaMemo = null;
+    }
   }
-  contextFor(cwd, sessionId) {
-    const parts = [];
-    const base = this.sessionContext(cwd);
-    if (base)
-      parts.push(base);
-    const answers = this.answerContext(sessionId);
-    if (answers)
-      parts.push(answers);
-    const open = formatOpenQuestions(this.questions({ sessionId: sessionId ?? undefined, open: true }));
-    if (open && !base?.includes(open))
-      parts.push(open);
-    return { text: parts.length ? parts.join(`
-`) : null, parts };
+  quotaDirty = true;
+  quotaMemo = null;
+  quota() {
+    const now = Date.now();
+    if (!this.quotaDirty && this.quotaMemo && now - this.quotaMemo.at < 30000)
+      return this.quotaMemo.report;
+    const rows = this.db.query("SELECT at, window, used_pct, resets_at FROM quota WHERE at >= ? ORDER BY at").all(now - 8 * 86400000);
+    const report = quotaReport(rows.map((r) => ({ window: r.window, usedPct: r.used_pct, resetsAt: r.resets_at, at: r.at })), now, this.policyFor(null).config.budget.window_warn_at);
+    this.quotaMemo = { at: now, report };
+    this.quotaDirty = false;
+    return report;
+  }
+  quotaNotified = new Map;
+  checkQuota() {
+    const out = [];
+    for (const w of this.quota().windows) {
+      if (w.level === "ok")
+        continue;
+      out.push(w);
+      const key = `${w.resetsAt ?? "none"}:${w.level}`;
+      if (this.quotaNotified.get(w.window) === key)
+        continue;
+      this.quotaNotified.set(w.window, key);
+      const src = this.db.query("SELECT project_id FROM quota WHERE window = ? ORDER BY at DESC LIMIT 1").get(w.window);
+      const projectId = src?.project_id ?? this.projects()[0]?.id ?? null;
+      if (!projectId)
+        continue;
+      this.append({
+        ts: new Date().toISOString(),
+        type: "incident.opened",
+        projectId,
+        sessionId: null,
+        payload: {
+          rule: "budget",
+          action: "warn",
+          command: `${QUOTA_LABEL[w.window]} (plan quota)`,
+          reason: w.level === "exceeded" ? `${quotaMessage(w)}. Sessions on this plan will be rate-limited; API-key sessions are unaffected.` : `${quotaMessage(w)} \u2014 approaching the plan limit ([budget] window_warn_at)`
+        }
+      });
+      this.touch();
+    }
+    return out;
+  }
+  lastStatusline(sessionId) {
+    return this.statuslines.get(sessionId) ?? null;
   }
   rowToGate(r) {
     return {
@@ -7992,24 +9154,24 @@ class Store {
       };
     const claim = this.claims(projectId).find((c) => c.task === task && c.state === "held");
     const worktree = claim?.worktree;
-    if (!worktree || !existsSync6(worktree))
+    if (!worktree || !existsSync7(worktree))
       return {
         ok: false,
         reason: `${task} has no held worktree to run ${gate} in \u2014 claim it first`
       };
-    const cwd = def.cwd ? join8(worktree, def.cwd) : worktree;
-    if (!existsSync6(cwd))
+    const cwd = def.cwd ? join9(worktree, def.cwd) : worktree;
+    if (!existsSync7(cwd))
       return { ok: false, reason: `gate cwd ${cwd} does not exist` };
     const key = `${projectId}:${task}:${gate}`;
     if (this.gateJobs.has(key))
       return { ok: false, reason: `${gate} is already running on ${task}` };
     const slug = (x) => x.replace(/[^a-zA-Z0-9_.-]+/g, "-");
-    const logDir = join8(this.home, "logs", projectId);
+    const logDir = join9(this.home, "logs", projectId);
     mkdirSync4(logDir, { recursive: true });
-    const log = join8(logDir, `gate-${slug(task)}-${slug(gate)}.log`);
+    const log = join9(logDir, `gate-${slug(task)}-${slug(gate)}.log`);
     if (def.builtin === "review")
       return this.runReviewGate(projectId, task, gate, def, { worktree, cwd, key, log }, opts);
-    writeFileSync2(log, `$ ${def.cmd}
+    writeFileSync3(log, `$ ${def.cmd}
 # cwd ${cwd} \xB7 ${new Date().toISOString()}
 `);
     const fd = openSync3(log, "a");
@@ -8069,7 +9231,7 @@ class Store {
       closeSync(fd);
       let output = "";
       try {
-        output = readFileSync3(log, "utf8");
+        output = readFileSync4(log, "utf8");
       } catch {}
       const input = executedGateInput(task, gate, def.cmd, {
         exitCode: timedOut ? null : code,
@@ -8130,7 +9292,7 @@ class Store {
         stat,
         patch: diffText
       });
-      writeFileSync2(where.log, `$ claude -p <review prompt, ${prompt.length} chars> --output-format json (read-only)
+      writeFileSync3(where.log, `$ claude -p <review prompt, ${prompt.length} chars> --output-format json (read-only)
 # cwd ${where.cwd} \xB7 ${new Date().toISOString()}
 `);
       let proc;
@@ -8185,7 +9347,7 @@ class Store {
       const code = await proc.exited;
       clearTimeout(timer);
       try {
-        writeFileSync2(where.log, `${readFileSync3(where.log, "utf8")}${out}
+        writeFileSync3(where.log, `${readFileSync4(where.log, "utf8")}${out}
 ${err}
 # exit ${timedOut ? "timeout" : code} \xB7 ${((Date.now() - started) / 1000).toFixed(0)}s
 `);
@@ -8258,6 +9420,8 @@ ${err}
       return;
     if (cfg.auto === "session-end" && event !== "SessionEnd")
       return;
+    if (event === "Stop" && cfg.on_stop === "block")
+      return;
     if (!cfg.required.some((g) => cfg.defs[g]))
       return;
     const key = `${held.projectId}:${held.task}`;
@@ -8265,13 +9429,119 @@ ${err}
     if (event === "Stop" && now - (this.autoGateAt.get(key) ?? 0) < 120000)
       return;
     this.autoGateAt.set(key, now);
-    this.runGates(held.projectId, held.task, undefined, { sessionId, owner: "auto" }).then((r) => {
-      if (!r.runs.length)
-        return;
-      const line = r.runs.map((x) => `${x.gate} ${x.verdict === "pass" ? "\u2713" : "\u2717"} (${x.rubric})`).join("; ");
-      this.db.query("UPDATE handoffs SET verify = ? WHERE project_id = ? AND task = ? AND session_id = ? AND by LIKE 'auto%'").run(`auto-gates: ${line}`, held.projectId, held.task, sessionId);
-      this.touch();
+    this.runGates(held.projectId, held.task, undefined, { sessionId, owner: "auto" }).then((r) => this.writeAutoVerify(held.projectId, held.task, sessionId, r.runs));
+  }
+  writeAutoVerify(projectId, task, sessionId, runs) {
+    if (!runs.length)
+      return;
+    const line = runs.map((x) => `${x.gate} ${x.verdict === "pass" ? "\u2713" : "\u2717"} (${x.rubric})`).join("; ");
+    this.db.query("UPDATE handoffs SET verify = ? WHERE project_id = ? AND task = ? AND session_id = ? AND by LIKE 'auto%'").run(`auto-gates: ${line}`, projectId, task, sessionId);
+    this.touch();
+  }
+  stopBlocks(sessionId) {
+    const r = this.db.query("SELECT COUNT(*) AS n FROM events WHERE type = 'gate.blocked' AND session_id = ?").get(sessionId);
+    return r.n;
+  }
+  stopExhausted = new Set;
+  repairArmed(cwd) {
+    if (!cwd || !existsSync7(cwd))
+      return false;
+    const held = this.heldClaimsWithWorktree().find((c) => isInside(cwd, c.worktree));
+    if (!held)
+      return false;
+    const cfg = this.gateDefs(held.projectId);
+    return cfg?.on_stop === "block" && cfg.max_blocks > 0 && cfg.required.some((g) => cfg.defs[g]);
+  }
+  async stopDecision(sessionId, cwd) {
+    if (!cwd || !existsSync7(cwd))
+      return null;
+    const held = this.heldClaimsWithWorktree().find((c) => isInside(cwd, c.worktree));
+    if (!held)
+      return null;
+    const cfg = this.gateDefs(held.projectId);
+    if (cfg?.on_stop !== "block" || cfg.max_blocks <= 0)
+      return null;
+    const executable = cfg.required.filter((g) => cfg.defs[g]);
+    if (!executable.length)
+      return null;
+    const blocksSoFar = this.stopBlocks(sessionId);
+    if (blocksSoFar >= cfg.max_blocks) {
+      if (!this.stopExhausted.has(sessionId)) {
+        this.stopExhausted.add(sessionId);
+        const failed = this.gateStatusFor(this.gateRuns(held.projectId, held.task), executable).filter((g) => g.verdict !== "pass").map((g) => g.gate);
+        this.append({
+          ts: new Date().toISOString(),
+          type: "incident.opened",
+          projectId: held.projectId,
+          sessionId,
+          payload: {
+            rule: "gate_failed",
+            action: "warn",
+            command: `stop on ${held.task}`,
+            reason: `${failed.join(", ") || "a required gate"} still failing after ${cfg.max_blocks} refusal${cfg.max_blocks === 1 ? "" : "s"} \u2014 letting the session stop. The runs are on the Board.`,
+            task: held.task,
+            gates: failed
+          }
+        });
+      }
+      return null;
+    }
+    const batch = this.runGates(held.projectId, held.task, undefined, {
+      sessionId,
+      owner: "stop"
+    });
+    let timer;
+    const timeout = new Promise((resolve) => {
+      timer = setTimeout(() => resolve(null), cfg.stop_timeout * 1000);
+    });
+    const r = await Promise.race([batch, timeout]).finally(() => clearTimeout(timer));
+    if (!r)
+      return null;
+    this.writeAutoVerify(held.projectId, held.task, sessionId, r.runs);
+    const d = repairDecision({
+      onStop: cfg.on_stop,
+      blocksSoFar,
+      maxBlocks: cfg.max_blocks,
+      runs: r.runs,
+      unexecutable: cfg.required.filter((g) => !cfg.defs[g])
+    });
+    if (d.kind === "allow")
+      return null;
+    const failed = d.failed.map((x) => x.gate);
+    if (d.kind === "exhausted") {
+      if (!this.stopExhausted.has(sessionId)) {
+        this.stopExhausted.add(sessionId);
+        this.append({
+          ts: new Date().toISOString(),
+          type: "incident.opened",
+          projectId: held.projectId,
+          sessionId,
+          payload: {
+            rule: "gate_failed",
+            action: "warn",
+            command: `stop on ${held.task}`,
+            reason: `${d.reason}. The session stopped with ${failed.join(", ")} failing; the runs are on the Board.`,
+            task: held.task,
+            gates: failed
+          }
+        });
+      }
+      return null;
+    }
+    this.append({
+      ts: new Date().toISOString(),
+      type: "gate.blocked",
+      projectId: held.projectId,
+      sessionId,
+      payload: {
+        task: held.task,
+        gates: failed,
+        attempt: d.attempt,
+        maxBlocks: cfg.max_blocks,
+        summary: `stop refused (${d.attempt}/${cfg.max_blocks}): ${failed.join(", ")} failing on ${held.task}`
+      }
     });
+    return { decision: "block", reason: d.reason };
   }
   requiredGates(projectId) {
     const p = this.project(projectId);
@@ -8340,8 +9610,8 @@ ${err}
       error = e.error;
       loading = e.at === 0 && e.error === null;
     } else {
-      const path = join8(p.root, source);
-      if (!existsSync6(path))
+      const path = join9(p.root, source);
+      if (!existsSync7(path))
         return {
           source,
           required: this.requiredGates(projectId),
@@ -8352,7 +9622,7 @@ ${err}
       const mtime = statSync(path).mtimeMs;
       let md = this.taskCache.get(projectId);
       if (!md || md.path !== path || md.mtime !== mtime) {
-        md = { path, mtime, tasks: parseMarkdownTasks(readFileSync3(path, "utf8")) };
+        md = { path, mtime, tasks: parseMarkdownTasks(readFileSync4(path, "utf8")) };
         this.taskCache.set(projectId, md);
       }
       hit = md;
@@ -8382,6 +9652,9 @@ ${err}
   rulesFor(repoRoot) {
     return this.policyFor(repoRoot).config.rules;
   }
+  invalidateConfig() {
+    this.policyCache.clear();
+  }
   policyFor(repoRoot) {
     const key = repoRoot ?? "";
     const hit = this.policyCache.get(key);
@@ -8431,15 +9704,15 @@ ${err}
     });
   }
   writePolicyCache(loaded) {
-    const file = join8(this.home, POLICY_CACHE_FILE);
+    const file = join9(this.home, POLICY_CACHE_FILE);
     try {
       if (!hasLockedRules(loaded)) {
-        if (existsSync6(file))
+        if (existsSync7(file))
           unlinkSync(file);
         return;
       }
       const cache = buildPolicyCache(loaded, this.liveSessions(), this.heldWorktrees());
-      writeFileSync2(file, JSON.stringify(cache), { mode: 384 });
+      writeFileSync3(file, JSON.stringify(cache), { mode: 384 });
     } catch (e) {
       console.error(`swarm: policy cache: ${e.message}`);
     }
@@ -8448,15 +9721,15 @@ ${err}
     return process.env.SWARM_GUARD === "off" && !hasLockedRules(this.policyFor(repoRoot));
   }
   claudeSettings() {
-    const p = process.env.CLAUDE_SETTINGS ?? join8(homedir3(), ".claude", "settings.json");
+    const p = process.env.CLAUDE_SETTINGS ?? join9(homedir3(), ".claude", "settings.json");
     try {
-      return existsSync6(p) ? JSON.parse(readFileSync3(p, "utf8")) : null;
+      return existsSync7(p) ? JSON.parse(readFileSync4(p, "utf8")) : null;
     } catch {
       return null;
     }
   }
   checkPolicy(cwd, sessionId) {
-    const project = existsSync6(cwd) ? this.resolveProject(cwd) : null;
+    const project = existsSync7(cwd) ? this.resolveProject(cwd) : null;
     const repoRoot = project?.root ?? null;
     const loaded = this.policyFor(repoRoot);
     const settings = this.claudeSettings();
@@ -8481,7 +9754,7 @@ ${err}
     return findings;
   }
   evaluateTool(tool, input, sessionId, cwd, recordIncident = true) {
-    if (BUDGET_ASK_TOOLS.has(tool) && cwd && existsSync6(cwd)) {
+    if (BUDGET_ASK_TOOLS.has(tool) && cwd && existsSync7(cwd)) {
       const project = this.resolveProject(cwd);
       const b = this.budgetFor(project.id);
       if (b && b.status.level === "exceeded" && b.config.on_exceed === "ask") {
@@ -8530,7 +9803,7 @@ ${err}
       const d = guardBash(cmd, current, this.liveSessions(), Date.now(), {
         ...modes,
         protected: { ports: [...new Set([...modes.protected.ports, ...this.heldPorts()])] }
-      });
+      }, this.rewriteCtx(sessionId));
       if (d.action !== "allow" && recordIncident)
         this.openIncident(d, cwd, sessionId, cmd);
       return { decision: d, display: cmd };
@@ -8578,22 +9851,37 @@ ${err}
     const d = guardBash(cmd, current, sessions, Date.now(), {
       ...modes,
       protected: { ports: [...new Set([...modes.protected.ports, ...this.heldPorts()])] }
-    });
+    }, this.rewriteCtx(id));
     if (d.action === "allow")
       return null;
     return this.openIncident(d, cwd, id, cmd);
   }
   openIncident(d, cwd, sessionId, command) {
-    const project = cwd && existsSync6(cwd) ? this.resolveProject(cwd) : null;
+    const project = cwd && existsSync7(cwd) ? this.resolveProject(cwd) : null;
+    if (d.action === "rewrite" && d.key && sessionId) {
+      const done = this.rewritesDone.get(sessionId) ?? new Set;
+      done.add(d.key);
+      this.rewritesDone.set(sessionId, done);
+    }
     this.append({
       ts: new Date().toISOString(),
       type: "incident.opened",
       projectId: project?.id ?? "p_unknown",
       sessionId: sessionId || null,
-      payload: { rule: d.rule, action: d.action, command: command.slice(0, 400), reason: d.reason }
+      payload: {
+        rule: d.rule,
+        action: d.action,
+        command: command.slice(0, 400),
+        reason: d.reason,
+        ...d.action === "rewrite" ? { rewritten: d.command.slice(0, 400) } : {}
+      }
     });
     return d;
   }
+  rewritesDone = new Map;
+  rewriteCtx(sessionId) {
+    return { rewritesDone: this.rewritesDone.get(sessionId) ?? new Set };
+  }
   heldWorktreesCache = null;
   dryRun(projectId, overrides = {}, limit = 5000) {
     const project = this.project(projectId);
@@ -8635,7 +9923,7 @@ ${err}
       }
     }
     const report = dryRunRules(calls, modes, {
-      toplevel: (cwd) => cwd && existsSync6(cwd) ? this.toplevel(cwd) : null,
+      toplevel: (cwd) => cwd && existsSync7(cwd) ? this.toplevel(cwd) : null,
       claims: this.heldWorktrees()
     });
     return { ...report, modes };
@@ -8650,11 +9938,11 @@ ${err}
   loadPricing() {
     this.prices = { ...PRICES };
     for (const f of ["pricing.litellm.json", "pricing.json"]) {
-      const p = join8(this.home, f);
-      if (!existsSync6(p))
+      const p = join9(this.home, f);
+      if (!existsSync7(p))
         continue;
       try {
-        const j = JSON.parse(readFileSync3(p, "utf8"));
+        const j = JSON.parse(readFileSync4(p, "utf8"));
         const table = f === "pricing.json" ? j : fromLiteLLM(j);
         Object.assign(this.prices, table);
       } catch {}
@@ -8666,7 +9954,7 @@ ${err}
       throw new Error(`pricing fetch ${r.status}`);
     const j = await r.json();
     const slim = Object.fromEntries(Object.entries(j).filter(([k, v]) => typeof v.input_cost_per_token === "number" && !k.includes("/")));
-    writeFileSync2(join8(this.home, "pricing.litellm.json"), JSON.stringify(slim, null, 1));
+    writeFileSync3(join9(this.home, "pricing.litellm.json"), JSON.stringify(slim, null, 1));
     this.loadPricing();
     this.reprice();
   }
@@ -8921,6 +10209,7 @@ ${p.reason ?? ""}`.trim(),
     const cfg = this.policyFor(null).config;
     const chatter = days ?? cfg.events.retain_days;
     const cutoff = new Date(Date.now() - chatter * 86400000).toISOString();
+    this.db.query("DELETE FROM quota WHERE at < ?").run(Date.now() - 14 * 86400000);
     let n = this.db.query(`DELETE FROM events WHERE ts < ? AND type NOT IN (${AUDIT_TYPES_SQL})`).run(cutoff).changes;
     if (cfg.audit.retain_days > 0) {
       const acut = new Date(Date.now() - cfg.audit.retain_days * 86400000).toISOString();
@@ -8936,10 +10225,25 @@ ${p.reason ?? ""}`.trim(),
     if (typeof raw.cwd === "string")
       this.autoRenewFor(typeof raw.session_id === "string" ? raw.session_id : null, raw.cwd);
     const cwd = typeof raw.cwd === "string" ? raw.cwd : process.cwd();
-    const project = existsSync6(cwd) ? this.resolveProject(cwd) : null;
+    if (typeof raw.session_id === "string") {
+      if (event === "UserPromptSubmit" || event === "PreToolUse")
+        this.cancelWake(raw.session_id, "active");
+      else if (event === "SessionEnd") {
+        this.cancelWake(raw.session_id, "ended");
+        this.statuslines.delete(raw.session_id);
+        this.rewritesDone.delete(raw.session_id);
+        this.stopExhausted.delete(raw.session_id);
+      }
+    }
+    if (event === "PreToolUse" && typeof raw.session_id === "string") {
+      const fp = raw.tool_input?.file_path;
+      if (WRITE_TOOLS.has(String(raw.tool_name)) && typeof fp === "string")
+        this.noteEdit(raw.session_id, absolutePath(fp, cwd));
+    }
+    const project = existsSync7(cwd) ? this.resolveProject(cwd) : null;
     const e = this.append(normalizeHook(event, raw, project?.id ?? "p_unknown"));
     if ((event === "Stop" || event === "SessionEnd") && e.sessionId) {
-      if (existsSync6(cwd)) {
+      if (existsSync7(cwd)) {
         this.autoHandoff(e.sessionId, cwd);
         this.autoGate(event, e.sessionId, cwd);
       }
@@ -8975,6 +10279,7 @@ ${p.reason ?? ""}`.trim(),
     "dispatch.started",
     "dispatch.finished",
     "gate.recorded",
+    "gate.blocked",
     "handoff.recorded",
     "incident.opened",
     "incident.acked",
@@ -8985,7 +10290,7 @@ ${p.reason ?? ""}`.trim(),
       return;
     const p = e.payload;
     const row = this.db.query("SELECT id, tool_counts FROM sessions WHERE id = ?").get(e.sessionId);
-    const branch = p.cwd && existsSync6(p.cwd) ? currentBranch(p.cwd) : null;
+    const branch = p.cwd && existsSync7(p.cwd) ? currentBranch(p.cwd) : null;
     if (!row) {
       this.db.query("INSERT INTO sessions (id, project_id, kind, cwd, branch, started_at, last_seen_at, last, last_type, state) VALUES (?, ?, 'interactive', ?, ?, ?, ?, ?, ?, 'active')").run(e.sessionId, e.projectId, p.cwd ?? "", branch, e.ts, e.ts, p.summary ?? e.type, e.type);
     }
@@ -9057,12 +10362,12 @@ ${p.reason ?? ""}`.trim(),
   }
   tailSession(sessionId) {
     const s = this.db.query("SELECT transcript_path FROM sessions WHERE id = ?").get(sessionId);
-    if (!s?.transcript_path || !existsSync6(s.transcript_path))
+    if (!s?.transcript_path || !existsSync7(s.transcript_path))
       return 0;
     let n = this.tailFile(s.transcript_path, sessionId, null);
-    const subDir = join8(dirname3(s.transcript_path), basename(s.transcript_path, ".jsonl"), "subagents");
+    const subDir = join9(dirname3(s.transcript_path), basename(s.transcript_path, ".jsonl"), "subagents");
     for (const f of this.subagentFiles(subDir)) {
-      n += this.tailFile(join8(subDir, f), sessionId, f.replace(/^agent-|\.jsonl$/g, ""));
+      n += this.tailFile(join9(subDir, f), sessionId, f.replace(/^agent-|\.jsonl$/g, ""));
     }
     return n;
   }
@@ -9094,7 +10399,7 @@ ${p.reason ?? ""}`.trim(),
     return n;
   }
   codexRoot() {
-    return process.env.SWARM_CODEX_DIR ?? join8(homedir3(), ".codex", "sessions");
+    return process.env.SWARM_CODEX_DIR ?? join9(homedir3(), ".codex", "sessions");
   }
   codexRolloutFiles(sinceMs) {
     const root = this.codexRoot();
@@ -9109,18 +10414,18 @@ ${p.reason ?? ""}`.trim(),
     for (const y of ls(root)) {
       if (!/^\d{4}$/.test(y))
         continue;
-      for (const m of ls(join8(root, y))) {
+      for (const m of ls(join9(root, y))) {
         if (!/^\d\d$/.test(m))
           continue;
-        for (const day of ls(join8(root, y, m))) {
+        for (const day of ls(join9(root, y, m))) {
           if (!/^\d\d$/.test(day))
             continue;
           if (Date.parse(`${y}-${m}-${day}T23:59:59Z`) < sinceMs)
             continue;
-          const dir = join8(root, y, m, day);
+          const dir = join9(root, y, m, day);
           for (const f of ls(dir)) {
             if (f.startsWith("rollout-") && f.endsWith(".jsonl"))
-              out.push(join8(dir, f));
+              out.push(join9(dir, f));
           }
         }
       }
@@ -9128,7 +10433,7 @@ ${p.reason ?? ""}`.trim(),
     return out;
   }
   tailCodex(windowMs = 3 * 24 * 60 * 60000) {
-    if (!existsSync6(this.codexRoot()))
+    if (!existsSync7(this.codexRoot()))
       return 0;
     let n = 0;
     for (const path of this.codexRolloutFiles(Date.now() - windowMs)) {
@@ -9137,12 +10442,12 @@ ${p.reason ?? ""}`.trim(),
     return n;
   }
   grokRoot() {
-    return process.env.SWARM_GROK_DIR ?? join8(homedir3(), ".grok", "sessions");
+    return process.env.SWARM_GROK_DIR ?? join9(homedir3(), ".grok", "sessions");
   }
   grokSummary = new Map;
   tailGemini(windowMs = 3 * 24 * 60 * 60000) {
-    const root = process.env.SWARM_GEMINI_ROOT ?? join8(homedir3(), ".gemini", "tmp");
-    if (!existsSync6(root))
+    const root = process.env.SWARM_GEMINI_ROOT ?? join9(homedir3(), ".gemini", "tmp");
+    if (!existsSync7(root))
       return 0;
     const since = Date.now() - windowMs;
     const ls = (p) => {
@@ -9155,13 +10460,13 @@ ${p.reason ?? ""}`.trim(),
     let n = 0;
     const ingestDir = (dir) => {
       for (const f of ls(dir)) {
-        const path = join8(dir, f);
+        const path = join9(dir, f);
         if (!f.endsWith(".jsonl")) {
           try {
             if (statSync(path).isDirectory()) {
               for (const g of ls(path))
                 if (g.endsWith(".jsonl"))
-                  ingestFile(join8(path, g));
+                  ingestFile(join9(path, g));
             }
           } catch {}
           continue;
@@ -9179,15 +10484,15 @@ ${p.reason ?? ""}`.trim(),
       n += this.ingestLog(path, "gemini", parseGeminiChat);
     };
     for (const hash of ls(root)) {
-      const chats = join8(root, hash, "chats");
-      if (existsSync6(chats))
+      const chats = join9(root, hash, "chats");
+      if (existsSync7(chats))
         ingestDir(chats);
     }
     return n;
   }
   tailGrok(windowMs = 3 * 24 * 60 * 60000) {
     const root = this.grokRoot();
-    if (!existsSync6(root))
+    if (!existsSync7(root))
       return 0;
     const since = Date.now() - windowMs;
     const ls = (p) => {
@@ -9207,10 +10512,10 @@ ${p.reason ?? ""}`.trim(),
       } catch {
         cwd = enc;
       }
-      const cwdDir = join8(root, enc);
+      const cwdDir = join9(root, enc);
       for (const sid of ls(cwdDir)) {
-        const path = join8(cwdDir, sid, "updates.jsonl");
-        if (!existsSync6(path))
+        const path = join9(cwdDir, sid, "updates.jsonl");
+        if (!existsSync7(path))
           continue;
         try {
           if (statSync(path).mtimeMs < since)
@@ -9218,7 +10523,7 @@ ${p.reason ?? ""}`.trim(),
         } catch {
           continue;
         }
-        const sumPath = join8(cwdDir, sid, "summary.json");
+        const sumPath = join9(cwdDir, sid, "summary.json");
         let title;
         let fresh = false;
         try {
@@ -9227,7 +10532,7 @@ ${p.reason ?? ""}`.trim(),
           if (hit && hit.mtime === m)
             title = hit.title;
           else {
-            const sum = JSON.parse(readFileSync3(sumPath, "utf8"));
+            const sum = JSON.parse(readFileSync4(sumPath, "utf8"));
             title = sum.session_summary;
             this.grokSummary.set(sumPath, { mtime: m, title });
             fresh = true;
@@ -9302,7 +10607,7 @@ ${p.reason ?? ""}`.trim(),
     const roots = this.db.query("SELECT DISTINCT root FROM projects WHERE root IS NOT NULL AND root != ''").all();
     let n = 0;
     for (const { root } of roots) {
-      const path = join8(root, ".aider.chat.history.md");
+      const path = join9(root, ".aider.chat.history.md");
       let mtime;
       try {
         mtime = statSync(path).mtimeMs;
@@ -9336,7 +10641,7 @@ ${p.reason ?? ""}`.trim(),
   }
   ocDbs = new Map;
   tailOpencode(windowMs = 3 * 24 * 60 * 60000) {
-    const dir = process.env.SWARM_OPENCODE_DIR ?? join8(process.env.XDG_DATA_HOME ?? join8(homedir3(), ".local", "share"), "opencode");
+    const dir = process.env.SWARM_OPENCODE_DIR ?? join9(process.env.XDG_DATA_HOME ?? join9(homedir3(), ".local", "share"), "opencode");
     let files;
     try {
       files = readdirSync(dir).filter((f) => /^opencode[^/]*\.db$/.test(f));
@@ -9345,7 +10650,7 @@ ${p.reason ?? ""}`.trim(),
     }
     let n = 0;
     for (const f of files) {
-      const path = join8(dir, f);
+      const path = join9(dir, f);
       let db = this.ocDbs.get(path);
       if (!db) {
         try {
@@ -9396,12 +10701,12 @@ ${p.reason ?? ""}`.trim(),
     return n;
   }
   ingestLog(path, agent, parse, cwdHint, titleHint) {
-    const off = this.db.query("SELECT offset FROM tails WHERE path = ?").get(path) ?? { offset: 0 };
+    const off = this.db.query("SELECT offset, session_id FROM tails WHERE path = ?").get(path) ?? { offset: 0, session_id: null };
     const r = this.readFrom(path, off.offset);
     if (!r)
       return 0;
-    const d = parse(r.chunk);
-    const sid = d.sessionId;
+    const d = parse(r.chunk, off.session_id);
+    const sid = d.sessionId ?? off.session_id;
     if (!sid)
       return 0;
     const mtime = (() => {
@@ -9423,9 +10728,9 @@ ${p.reason ?? ""}`.trim(),
   ensureAgentSession(sid, agent, cwd, mtime) {
     if (this.db.query("SELECT 1 FROM sessions WHERE id = ?").get(sid))
       return;
-    const project = cwd && existsSync6(cwd) ? this.resolveProject(cwd) : null;
+    const project = cwd && existsSync7(cwd) ? this.resolveProject(cwd) : null;
     const ts = new Date(mtime).toISOString();
-    this.db.query("INSERT INTO sessions (id, project_id, kind, agent, cwd, branch, started_at, last_seen_at, last, last_type, state) VALUES (?, ?, 'interactive', ?, ?, ?, ?, ?, '', '', 'active')").run(sid, project?.id ?? "p_unknown", agent, cwd, cwd && existsSync6(cwd) ? currentBranch(cwd) : null, ts, ts);
+    this.db.query("INSERT INTO sessions (id, project_id, kind, agent, cwd, branch, started_at, last_seen_at, last, last_type, state) VALUES (?, ?, 'interactive', ?, ?, ?, ?, ?, '', '', 'active')").run(sid, project?.id ?? "p_unknown", agent, cwd, cwd && existsSync7(cwd) ? currentBranch(cwd) : null, ts, ts);
   }
   claimRows(projectId) {
     return this.db.query("SELECT * FROM claims WHERE project_id = ?").all(projectId).map((r) => ({
@@ -9460,7 +10765,7 @@ ${p.reason ?? ""}`.trim(),
   worktreePath(projectId, task) {
     const slug = (x) => x.replace(/[^a-zA-Z0-9._-]+/g, "-").toLowerCase();
     const p = this.project(projectId);
-    return join8(this.home, "worktrees", slug(p?.name ?? projectId), slug(task));
+    return join9(this.home, "worktrees", slug(p?.name ?? projectId), slug(task));
   }
   claim(projectId, task, owner, baseRef = "HEAD", sessionId = null) {
     const p = this.project(projectId);
@@ -9488,7 +10793,7 @@ ${p.reason ?? ""}`.trim(),
     }
     const branch = `task/${task}`;
     const worktree = this.worktreePath(projectId, task);
-    if (existsSync6(worktree))
+    if (existsSync7(worktree))
       return { ok: false, error: `${worktree} already exists; release ${task} first` };
     mkdirSync4(dirname3(worktree), { recursive: true });
     const created = worktreeAdd(p.root, worktree, branch, baseRef);
@@ -9677,7 +10982,7 @@ ${p.reason ?? ""}`.trim(),
   }
   static worktreeIdleMs(path) {
     let newest = 0;
-    for (const f of [path, join8(path, ".git")]) {
+    for (const f of [path, join9(path, ".git")]) {
       try {
         newest = Math.max(newest, statSync(f).mtimeMs);
       } catch {}
@@ -10279,7 +11584,7 @@ ${p.reason ?? ""}`.trim(),
       for (const c of this.claimRows(p.id)) {
         if (c.state !== "held" || isActive(c, now))
           continue;
-        const exists = c.worktree ? existsSync6(c.worktree) : false;
+        const exists = c.worktree ? existsSync7(c.worktree) : false;
         const work = exists ? heldWork(c.worktree) : null;
         if (reapAction(c, now, exists, work) !== "keep-orphaned")
           continue;
@@ -10335,7 +11640,7 @@ ${p.reason ?? ""}`.trim(),
     if (!row)
       return { ok: false, error: `no claim on ${task}` };
     const worktree = row.worktree ?? "";
-    if (worktree && existsSync6(worktree)) {
+    if (worktree && existsSync7(worktree)) {
       const work = heldWork(worktree);
       const can = canRelease(work, force);
       if (!can.ok)
@@ -10370,7 +11675,7 @@ ${p.reason ?? ""}`.trim(),
           continue;
         if (isActive({ ...c, state: "held" }, now))
           continue;
-        const exists = c.worktree ? existsSync6(c.worktree) : false;
+        const exists = c.worktree ? existsSync7(c.worktree) : false;
         const work = exists ? heldWork(c.worktree) : null;
         const action = reapAction({ ...c, state: "held" }, now, exists, work);
         if (action === "not-expired")
@@ -10469,7 +11774,7 @@ ${p.reason ?? ""}`.trim(),
     if (!slug || slug === "." || slug === "..")
       return { ok: false, error: "bad worktree name" };
     const path = this.worktreePath(projectId, slug);
-    if (existsSync6(path))
+    if (existsSync7(path))
       return { ok: false, error: `${path} already exists` };
     mkdirSync4(dirname3(path), { recursive: true });
     const br = branch?.trim() || `wt/${slug}`;
@@ -10771,8 +12076,8 @@ ${p.reason ?? ""}`.trim(),
   backupTo(destDir) {
     mkdirSync4(destDir, { recursive: true });
     const files = [];
-    const dbDest = join8(destDir, "swarm.db");
-    if (existsSync6(dbDest))
+    const dbDest = join9(destDir, "swarm.db");
+    if (existsSync7(dbDest))
       unlinkSync(dbDest);
     this.db.exec(`VACUUM INTO '${dbDest.replaceAll("'", "''")}'`);
     files.push("swarm.db");
@@ -10785,10 +12090,10 @@ ${p.reason ?? ""}`.trim(),
       "pricing.litellm.json",
       "team-token"
     ]) {
-      const src = join8(this.home, f);
-      if (!existsSync6(src))
+      const src = join9(this.home, f);
+      if (!existsSync7(src))
         continue;
-      copyFileSync(src, join8(destDir, f));
+      copyFileSync(src, join9(destDir, f));
       files.push(f);
     }
     return { dest: destDir, files };
@@ -10979,6 +12284,38 @@ ${p.reason ?? ""}`.trim(),
       return { ...i, count: counts.get(key) ?? 1, suggestion };
     });
   }
+  incident(seq) {
+    const r = this.db.query(`SELECT e.seq, e.ts, e.project_id, e.session_id, e.payload, a.acked_at FROM events e
+         LEFT JOIN incident_acks a ON a.seq = e.seq WHERE e.seq = ? AND e.type = 'incident.opened'`).get(seq);
+    if (!r)
+      return null;
+    const payload = JSON.parse(r.payload || "{}");
+    const base = {
+      seq: r.seq,
+      ts: r.ts,
+      projectId: r.project_id,
+      sessionId: r.session_id,
+      acked: r.acked_at,
+      ...payload
+    };
+    if (typeof payload.rule !== "string")
+      return base;
+    const rule = payload.rule;
+    const command = typeof payload.command === "string" ? payload.command : "";
+    const count = this.db.query(`SELECT COUNT(*) AS n FROM events WHERE type = 'incident.opened' AND project_id = ?
+             AND json_extract(payload,'$.rule') = ? AND json_extract(payload,'$.command') = ?`).get(r.project_id, rule, command).n;
+    return {
+      ...base,
+      count: Math.max(1, count),
+      suggestion: suggestFromIncident({
+        rule,
+        action: typeof payload.action === "string" ? payload.action : "",
+        command,
+        reason: typeof payload.reason === "string" ? payload.reason : "",
+        count: Math.max(1, count)
+      })
+    };
+  }
   openIncidents(projectId) {
     const r = this.db.query(`SELECT COUNT(*) AS n FROM events e LEFT JOIN incident_acks a ON a.seq = e.seq
          WHERE e.type = 'incident.opened' AND a.seq IS NULL${projectId ? " AND e.project_id = ?" : ""}`).get(...projectId ? [projectId] : []);
@@ -11341,12 +12678,14 @@ ${p.reason ?? ""}`.trim(),
       sessions: this.sessions(),
       spend: this.memoised("spend", 30000, () => this.spend()),
       spendSparks: this.memoised("spendSparks", 60000, () => this.spendSparks()),
+      quota: this.quota(),
       claims: this.claims(),
       processes: this.memoised("processes", 5000, () => this.processes()),
       incidents: this.memoised("incidents", 30000, () => this.incidents(20, { open: true })),
       openIncidents: this.memoised("openIncidents", 30000, () => this.openIncidents()),
       openIncidentsByProject: this.memoised("openIncidentsByProject", 30000, () => this.openIncidentsByProject()),
       questions: this.questions({ open: true, limit: 50 }),
+      permissions: this.pendingPermissions(),
       resources: this.resources(),
       seq: this.seq()
     };
@@ -11487,8 +12826,8 @@ function localDayIso(offsetDays) {
 }
 
 // packages/daemon/src/team.ts
-import { writeFileSync as writeFileSync3 } from "fs";
-import { join as join9 } from "path";
+import { writeFileSync as writeFileSync4 } from "fs";
+import { join as join10 } from "path";
 var SPEND_EVERY_MS = 60000;
 var MAX_BACKOFF_MS = 300000;
 var POLICY_EVERY_MS = 300000;
@@ -11656,12 +12995,12 @@ class TeamForwarder {
         this.store.setMetaValue("team_last_error", "org policy signature invalid \u2014 not installed");
         return;
       }
-      const file = join9(this.store.home, "policy.toml");
+      const file = join10(this.store.home, "policy.toml");
       const prev = this.store.metaValue("team_policy_sig");
       if (prev === policy.signature)
         return;
-      writeFileSync3(file, policy.toml, { mode: 384 });
-      writeFileSync3(join9(this.store.home, "policy.sig.json"), JSON.stringify({
+      writeFileSync4(file, policy.toml, { mode: 384 });
+      writeFileSync4(join10(this.store.home, "policy.sig.json"), JSON.stringify({
         signature: policy.signature,
         publicKey: pinned,
         fetchedAt: new Date(now).toISOString(),
@@ -11672,6 +13011,237 @@ class TeamForwarder {
   }
 }
 
+// packages/daemon/src/teamctl.ts
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { networkInterfaces } from "os";
+import { join as join11 } from "path";
+var HOSTED_PID = "team_hosted_pid";
+function alive(pid) {
+  if (!Number.isInteger(pid) || pid <= 1)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function hostedPid(store) {
+  const pid = Number(store.metaValue(HOSTED_PID) ?? 0);
+  if (!alive(pid)) {
+    if (pid)
+      store.setMetaValue(HOSTED_PID, "");
+    return null;
+  }
+  return pid;
+}
+async function hostedPidChecked(store) {
+  const pid = hostedPid(store);
+  if (!pid)
+    return null;
+  if (await healthy(hostedUrl("127.0.0.1", readSetup(store.home).port)))
+    return pid;
+  store.setMetaValue(HOSTED_PID, "");
+  return null;
+}
+function lanAddress() {
+  for (const list of Object.values(networkInterfaces())) {
+    for (const n of list ?? []) {
+      if (n.family === "IPv4" && !n.internal)
+        return n.address;
+    }
+  }
+  return null;
+}
+function setupPath(home) {
+  return join11(home, "team.toml");
+}
+function readSetup(home) {
+  const p = setupPath(home);
+  return parseTeamSetup(existsSync8(p) ? readFileSync5(p, "utf8") : null);
+}
+function writeSetup(home, setup) {
+  mkdirSync5(home, { recursive: true });
+  writeFileSync5(setupPath(home), renderTeamSetup(setup), { mode: 384 });
+}
+function setTeamUrl(store, url) {
+  const path = join11(store.home, "config.toml");
+  const text = existsSync8(path) ? readFileSync5(path, "utf8") : "";
+  mkdirSync5(store.home, { recursive: true });
+  writeFileSync5(path, withTeamUrl(text, url));
+  store.invalidateConfig();
+}
+async function healthy(url, ms = 500) {
+  try {
+    const r = await fetch(`${url}/t1/health`, { signal: AbortSignal.timeout(ms) });
+    return r.ok;
+  } catch {
+    return false;
+  }
+}
+async function registerMachine(store, url, token) {
+  let mode = "open";
+  let policyPublicKey;
+  try {
+    const cfg = await (await fetch(`${url}/t1/auth/config`, { signal: AbortSignal.timeout(4000) })).json();
+    mode = cfg.mode ?? "open";
+    policyPublicKey = cfg.policyPublicKey;
+  } catch {
+    return { ok: false, error: `no team daemon answering at ${url}` };
+  }
+  if (mode === "oidc" && !token)
+    return {
+      ok: false,
+      error: "this team uses your identity provider \u2014 run `swarm login` in a terminal once"
+    };
+  const machine = store.machineIdentity();
+  let reg = {};
+  try {
+    const res = await fetch(`${url}/t1/machines/register`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...token ? { authorization: `Bearer ${token}` } : {}
+      },
+      body: JSON.stringify({ id: machine.id, name: machine.name }),
+      signal: AbortSignal.timeout(6000)
+    });
+    reg = await res.json().catch(() => ({}));
+    if (!res.ok)
+      return {
+        ok: false,
+        error: `registration refused (${res.status}): ${reg.error ?? "check the secret"}`
+      };
+  } catch {
+    return { ok: false, error: `registration failed: ${url} did not answer` };
+  }
+  const machineToken = reg.token ?? (mode === "token" ? token : null);
+  if (mode !== "open" && !machineToken)
+    return { ok: false, error: `registration refused: ${reg.error ?? "check the secret"}` };
+  if (machineToken)
+    store.setMetaValue("team_machine_token", machineToken);
+  if (policyPublicKey)
+    store.setMetaValue("team_policy_pubkey", policyPublicKey);
+  return { ok: true, mode };
+}
+async function hostTeam(store, input = {}) {
+  const existing = await hostedPidChecked(store);
+  if (existing)
+    return { ok: false, error: `already hosting a team (pid ${existing})` };
+  const cur = readSetup(store.home);
+  const mode = input.mode ?? cur.mode;
+  const setup = {
+    ...DEFAULT_TEAM_SETUP,
+    ...cur,
+    mode,
+    port: input.port ?? cur.port,
+    name: input.name ?? cur.name,
+    token: mode === "token" ? input.token ?? cur.token ?? mintTeamSecret() : null
+  };
+  if (mode === "oidc" && (!setup.issuer || !setup.clientId))
+    return {
+      ok: false,
+      error: "an identity-provider team needs an issuer and a client id \u2014 run `swarm-teamd setup` once"
+    };
+  writeSetup(store.home, setup);
+  const loopback = hostedUrl("127.0.0.1", setup.port);
+  if (await healthy(loopback))
+    return { ok: false, error: `something is already listening on port ${setup.port}` };
+  const [cmd, ...args] = resolveBin("swarm-teamd");
+  const logDir = join11(store.home, "logs");
+  mkdirSync5(logDir, { recursive: true });
+  const log = join11(logDir, "teamd.log");
+  const proc = Bun.spawn([cmd, ...args], {
+    cwd: store.home,
+    env: { ...process.env, SWARM_HOME: store.home },
+    stdout: Bun.file(log).writer(),
+    stderr: Bun.file(log).writer(),
+    stdin: "ignore"
+  });
+  proc.unref();
+  const until = Date.now() + 15000;
+  while (Date.now() < until) {
+    if (await healthy(loopback))
+      break;
+    if (proc.exitCode !== null)
+      return {
+        ok: false,
+        error: `swarm-teamd exited (${proc.exitCode}) \u2014 see ${log}`
+      };
+    await Bun.sleep(200);
+  }
+  if (!await healthy(loopback)) {
+    proc.kill();
+    return {
+      ok: false,
+      error: `swarm-teamd (${cmd} ${args.join(" ")}) did not come up on ${setup.port} \u2014 see ${log}. The team daemon is source-available and ships separately; run it from a clone, or put swarm-teamd on PATH.`
+    };
+  }
+  store.setMetaValue(HOSTED_PID, String(proc.pid));
+  setTeamUrl(store, loopback);
+  const reg = await registerMachine(store, loopback, setup.token);
+  if (!reg.ok) {
+    setTeamUrl(store, null);
+    store.setMetaValue(HOSTED_PID, "");
+    try {
+      process.kill(proc.pid, "SIGTERM");
+    } catch {}
+    return reg;
+  }
+  const address = lanAddress();
+  return {
+    ok: true,
+    url: loopback,
+    invite: inviteLink(hostedUrl(address ?? "127.0.0.1", setup.port), setup.token),
+    setup,
+    pid: proc.pid,
+    address
+  };
+}
+async function joinTeam(store, input) {
+  const parsed = input.invite ? parseInvite(input.invite) : null;
+  const url = (parsed?.url ?? input.url ?? "").replace(/\/+$/, "");
+  if (!url)
+    return { ok: false, error: "paste an invite link or the team daemon's URL" };
+  const token = input.token ?? parsed?.token ?? null;
+  const reg = await registerMachine(store, url, token);
+  if (!reg.ok)
+    return reg;
+  setTeamUrl(store, url);
+  return { ok: true, url, mode: reg.mode };
+}
+async function leaveTeam(store, opts = {}) {
+  setTeamUrl(store, null);
+  store.setMetaValue("team_machine_token", "");
+  let stopped = false;
+  const pid = hostedPid(store);
+  if (opts.stopHosted && pid) {
+    try {
+      process.kill(pid, "SIGTERM");
+      stopped = true;
+    } catch {
+      stopped = false;
+    }
+    store.setMetaValue(HOSTED_PID, "");
+  }
+  return { ok: true, stopped };
+}
+function hostingStatus(store) {
+  const pid = hostedPid(store);
+  if (!pid)
+    return { hosting: false, pid: null, port: null, invite: null, mode: null, address: null };
+  const setup = readSetup(store.home);
+  const address = lanAddress();
+  return {
+    hosting: true,
+    pid,
+    port: setup.port,
+    invite: inviteLink(hostedUrl(address ?? "127.0.0.1", setup.port), setup.token),
+    mode: setup.mode,
+    address
+  };
+}
+
 // packages/daemon/src/workflow.ts
 class WorkflowEngine {
   store;
@@ -11863,13 +13433,13 @@ class WorkflowEngine {
 }
 
 // packages/daemon/src/app.ts
-var VERSION = "0.13.2";
+var VERSION = "0.14.0";
 var WEB_DIR = (() => {
   if (process.env.SWARM_WEB_DIR)
     return process.env.SWARM_WEB_DIR;
   const here = dirname4(fileURLToPath2(import.meta.url));
-  const dev = join10(here, "../../web/public");
-  return existsSync7(join10(dev, "index.html")) ? dev : join10(here, "../web");
+  const dev = join12(here, "../../web/public");
+  return existsSync9(join12(dev, "index.html")) ? dev : join12(here, "../web");
 })();
 var REPLAY_TAIL = 200;
 var wireCache = new WeakMap;
@@ -11883,12 +13453,12 @@ function wireJson(e) {
 }
 function hookRepoRoot(store, raw) {
   const cwd = typeof raw.cwd === "string" ? raw.cwd : "";
-  return cwd && existsSync7(cwd) ? store.resolveProject(cwd)?.root ?? null : null;
+  return cwd && existsSync9(cwd) ? store.resolveProject(cwd)?.root ?? null : null;
 }
 function claudeSettings() {
   try {
-    const p = process.env.CLAUDE_SETTINGS ?? join10(homedir4(), ".claude", "settings.json");
-    return existsSync7(p) ? JSON.parse(readFileSync4(p, "utf8")) : null;
+    const p = process.env.CLAUDE_SETTINGS ?? join12(homedir4(), ".claude", "settings.json");
+    return existsSync9(p) ? JSON.parse(readFileSync6(p, "utf8")) : null;
   } catch {
     return null;
   }
@@ -11896,12 +13466,12 @@ function claudeSettings() {
 function diskVersion() {
   try {
     const entry = daemonCommand().at(-1);
-    if (!entry || !existsSync7(entry))
+    if (!entry || !existsSync9(entry))
       return null;
-    for (const f of [entry, join10(dirname4(entry), "app.ts")]) {
-      if (!existsSync7(f))
+    for (const f of [entry, join12(dirname4(entry), "app.ts")]) {
+      if (!existsSync9(f))
         continue;
-      const m = /SWARM_VERSION\s*\?\?\s*"(\d+\.\d+\.\d+)"/.exec(readFileSync4(f, "utf8"));
+      const m = /SWARM_VERSION\s*\?\?\s*"(\d+\.\d+\.\d+)"/.exec(readFileSync6(f, "utf8"));
       if (m?.[1])
         return m[1];
     }
@@ -11914,7 +13484,7 @@ function expandHome(p, home = homedir4()) {
   if (p === "~")
     return home;
   if (p.startsWith("~/"))
-    return join10(home, p.slice(2));
+    return join12(home, p.slice(2));
   return p;
 }
 function createApp(store = new Store, hooks = {}) {
@@ -11979,7 +13549,7 @@ function createApp(store = new Store, hooks = {}) {
   app.delete("/v1/projects/:id", (c) => store.removeProject(c.req.param("id")) ? c.body(null, 204) : c.json({ error: "not found" }, 404));
   app.get("/v1/fs/ls", (c) => {
     const q = expandHome(c.req.query("path") ?? "");
-    if (q && !existsSync7(q))
+    if (q && !existsSync9(q))
       return c.json({ error: "no such folder", path: q }, 404);
     let dir;
     try {
@@ -11988,7 +13558,7 @@ function createApp(store = new Store, hooks = {}) {
       dir = homedir4();
     }
     try {
-      const entries = readdirSync2(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, repo: existsSync7(join10(dir, e.name, ".git")) })).sort((a, b) => a.name.localeCompare(b.name));
+      const entries = readdirSync2(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, repo: existsSync9(join12(dir, e.name, ".git")) })).sort((a, b) => a.name.localeCompare(b.name));
       const parent = dirname4(dir);
       return c.json({ path: dir, parent: parent === dir ? null : parent, entries });
     } catch (e) {
@@ -11996,6 +13566,8 @@ function createApp(store = new Store, hooks = {}) {
     }
   });
   app.get("/v1/state", (c) => {
+    if (c.req.query("watching") === "1")
+      store.touchDashboard();
     const body = JSON.stringify(store.snapshot());
     const etag = `W/"${Bun.hash(body).toString(36)}"`;
     const head = { etag, "cache-control": "no-cache" };
@@ -12176,7 +13748,21 @@ function createApp(store = new Store, hooks = {}) {
       return c.json({ error: e.message }, 500);
     }
   });
-  app.get("/v1/team", (c) => c.json(team.status()));
+  app.get("/v1/team", (c) => c.json({ ...team.status(), ...hostingStatus(store) }));
+  app.post("/v1/team/host", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    const r = await hostTeam(store, b);
+    return c.json(r, r.ok ? 201 : 409);
+  });
+  app.post("/v1/team/join", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    const r = await joinTeam(store, b);
+    return c.json(r, r.ok ? 200 : 409);
+  });
+  app.post("/v1/team/leave", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    return c.json(await leaveTeam(store, b));
+  });
   app.post("/v1/team/credentials", async (c) => {
     const b = await c.req.json().catch(() => ({}));
     if (typeof b.token !== "string" || !b.token)
@@ -12223,7 +13809,7 @@ function createApp(store = new Store, hooks = {}) {
       return c.json({ ok: false, error: "project required" }, 400);
     const overrides = {};
     for (const [k, v] of Object.entries(c.req.query()))
-      if (RULE_IDS.includes(k) && ["ask", "deny", "off"].includes(v))
+      if (RULE_IDS.includes(k) && ["ask", "deny", "off", "rewrite"].includes(v))
         overrides[k] = v;
     const limit = Math.min(20000, Math.max(100, Number(c.req.query("limit")) || 5000));
     return c.json(store.dryRun(projectId, overrides, limit));
@@ -12232,6 +13818,15 @@ function createApp(store = new Store, hooks = {}) {
     const body = await c.req.json().catch(() => ({}));
     return c.json({ ok: true, acked: store.ackAllIncidents(body.project || undefined, body.by) });
   });
+  app.post("/v1/incidents/:seq/apply", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    const seq = Number(c.req.param("seq"));
+    if (!b.projectId || !Number.isInteger(seq))
+      return c.json({ ok: false, error: "projectId and a numeric seq required" }, 400);
+    const target = b.target === "claude-md" || b.target === "swarm-toml" || b.target === "both" ? b.target : store.policyFor(null).config.codify.target;
+    const r = await applyCodify(store, forge, b.projectId, seq, target);
+    return c.json(r, r.ok ? 201 : 409);
+  });
   app.post("/v1/incidents/:seq/ack", (c) => {
     const seq = Number(c.req.param("seq"));
     if (!Number.isInteger(seq) || !store.ackIncident(seq, c.req.query("by")))
@@ -12313,6 +13908,7 @@ function createApp(store = new Store, hooks = {}) {
       return c.json({ error: "project required" }, 400);
     return c.json(store.budgetFor(project) ?? { status: null, config: store.config(project).budget });
   });
+  app.get("/v1/quota", (c) => c.json(store.quota()));
   app.get("/v1/context", (c) => {
     const cwd = c.req.query("cwd");
     if (!cwd)
@@ -12444,6 +14040,27 @@ function createApp(store = new Store, hooks = {}) {
     const r = runner.answerPermission(c.req.param("id"), c.req.param("reqId"), b.allow === true, b.message);
     return r.ok ? c.json(r) : c.json({ ok: false, error: r.reason }, 404);
   });
+  app.get("/v1/repair", (c) => {
+    const cwd = c.req.query("cwd") ?? "";
+    return c.json({ block: store.repairArmed(cwd) });
+  });
+  app.post("/v1/wake", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    const sid = typeof b.session_id === "string" ? b.session_id : "";
+    if (!sid)
+      return c.json({ wake: false, reason: "no session" }, 400);
+    return c.json(await store.waitForWake(sid, 10 * 60000));
+  });
+  app.get("/v1/permissions", (c) => c.json({ permissions: store.pendingPermissions() }));
+  app.post("/v1/permissions/:id", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    const r = store.answerInteractive(c.req.param("id"), {
+      behavior: b.terminal ? null : b.allow === true ? "allow" : "deny",
+      ...b.message ? { message: b.message } : {},
+      by: b.terminal ? "terminal" : b.by ?? "dashboard"
+    });
+    return r.ok ? c.json(r) : c.json({ ok: false, error: r.reason }, 404);
+  });
   app.delete("/v1/runs/:id", async (c) => {
     const r = await runner.stop(c.req.param("id"));
     return r.ok ? c.json(r) : c.json({ ok: false, error: r.reason }, 404);
@@ -12690,9 +14307,61 @@ function createApp(store = new Store, hooks = {}) {
         });
     }
     const sid = typeof raw.session_id === "string" ? raw.session_id : null;
+    if (event === "PermissionRequest" && sid) {
+      const waitS = store.policyFor(null).config.broker.interactive_wait;
+      if (waitS > 0 && store.dashboardWatching()) {
+        const a = await store.askInteractive(raw, waitS * 1000);
+        return c.json(permissionHookOutput(a ?? { behavior: null, by: "terminal" }, raw.tool_input ?? {}));
+      }
+      store.append({
+        ts: new Date().toISOString(),
+        type: "permission.resolved",
+        projectId: typeof raw.cwd === "string" && existsSync9(raw.cwd) ? store.resolveProject(raw.cwd).id : "p_unknown",
+        sessionId: sid,
+        payload: {
+          requestId: raw.tool_use_id ?? null,
+          decision: "terminal",
+          by: "terminal",
+          source: "interactive",
+          summary: "handed to the terminal (no dashboard watching)"
+        }
+      });
+      return c.json({});
+    }
+    if (event === "Stop" && sid && typeof raw.cwd === "string") {
+      const d = await store.stopDecision(sid, raw.cwd);
+      if (d)
+        return c.json({
+          decision: "block",
+          reason: d.reason,
+          hookSpecificOutput: { hookEventName: "Stop", decision: "block", reason: d.reason }
+        });
+    }
     const answers = event === "UserPromptSubmit" || event === "PreToolUse" || event === "PostToolUse" ? store.answerContext(sid) : null;
     if (event === "PreToolUse" && !store.guardDisabled(hookRepoRoot(store, raw))) {
       const guard = store.guardHook(raw);
+      if (guard?.action === "rewrite") {
+        const input = raw.tool_input ?? {};
+        const second = store.evaluateTool(typeof raw.tool_name === "string" ? raw.tool_name : "Bash", { command: guard.command }, sid ?? "", typeof raw.cwd === "string" ? raw.cwd : "", false).decision;
+        if (second.action === "deny" || second.action === "ask")
+          return c.json({
+            hookSpecificOutput: {
+              hookEventName: "PreToolUse",
+              permissionDecision: second.action,
+              permissionDecisionReason: `[swarm] ${second.reason}`
+            }
+          });
+        const note = `[swarm] rewrote the command (${guard.rule}): ${guard.reason}
+ran: ${guard.command}`;
+        return c.json({
+          hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            updatedInput: { ...input, command: guard.command },
+            additionalContext: answers ? `${note}
+${answers}` : note
+          }
+        });
+      }
       if (guard) {
         return c.json({
           hookSpecificOutput: {
@@ -12704,13 +14373,33 @@ function createApp(store = new Store, hooks = {}) {
         });
       }
     }
-    if (answers)
+    let collision = null;
+    if (event === "PostToolUse" && sid && typeof raw.cwd === "string") {
+      const fp = raw.tool_input?.file_path;
+      if (WRITE_TOOLS.has(String(raw.tool_name)) && typeof fp === "string")
+        collision = store.collisionContext(sid, raw.cwd, absolutePath(fp, raw.cwd));
+    }
+    const context = [collision, answers].filter(Boolean).join(`
+`);
+    if (context)
       return c.json({
-        additionalContext: answers,
-        hookSpecificOutput: { hookEventName: event, additionalContext: answers }
+        additionalContext: context,
+        hookSpecificOutput: { hookEventName: event, additionalContext: context }
       });
     return c.json({});
   });
+  app.post("/v1/statusline", async (c) => {
+    const raw = await c.req.json().catch(() => null);
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+      return c.json({ ok: false, error: "expected the statusLine JSON object" }, 400);
+    return c.json(store.statuslineFor(raw));
+  });
+  app.post("/v1/shutdown", (c) => {
+    if (!hooks.shutdown)
+      return c.json({ ok: false, error: "shutdown not available" }, 501);
+    setTimeout(() => hooks.shutdown?.(), 50);
+    return c.json({ ok: true, pid: process.pid });
+  });
   app.post("/v1/events", async (c) => {
     const e = await c.req.json();
     return c.json(store.append(e), 201);
@@ -12737,7 +14426,7 @@ function createApp(store = new Store, hooks = {}) {
       });
     });
   });
-  app.get("/", (c) => c.html(readFileSync4(join10(WEB_DIR, "index.html"), "utf8")));
+  app.get("/", (c) => c.html(readFileSync6(join12(WEB_DIR, "index.html"), "utf8")));
   app.get("/next", (c) => c.redirect("/", 308));
   const MIME = {
     js: "text/javascript",
@@ -12749,15 +14438,15 @@ function createApp(store = new Store, hooks = {}) {
   const BINARY = new Set(["ico", "png"]);
   app.get("/:file{[a-z0-9-]+\\.(js|css|svg|ico|png)}", (c) => {
     const f = c.req.param("file");
-    const p = join10(WEB_DIR, f);
-    if (!existsSync7(p))
+    const p = join12(WEB_DIR, f);
+    if (!existsSync9(p))
       return c.text(`${f} not built \u2014 run: bun run build:web`, 404);
     const st = statSync2(p);
     const etag = `W/"${st.size.toString(16)}-${st.mtimeMs.toString(16)}"`;
     if (c.req.header("if-none-match") === etag)
       return c.body(null, 304, { etag });
     const ext = f.split(".").pop() ?? "";
-    return c.body(BINARY.has(ext) ? readFileSync4(p) : readFileSync4(p, "utf8"), 200, {
+    return c.body(BINARY.has(ext) ? readFileSync6(p) : readFileSync6(p, "utf8"), 200, {
       "content-type": MIME[ext] ?? "text/plain",
       "cache-control": "no-cache",
       etag
@@ -12892,6 +14581,7 @@ var restart = () => {
   setTimeout(() => process.exit(0), 100);
 };
 appHooks.restart = restart;
+appHooks.shutdown = () => void shutdown();
 server = serve();
 var port = server.port ?? DEFAULT_PORT2;
 ensureToken();
@@ -12924,6 +14614,8 @@ var tailer = setInterval(() => {
     store.sweepOrphans();
   if (tick % 6 === 0)
     store.checkBudgets();
+  if (tick % 6 === 0)
+    store.checkQuota();
   if (tick % 12 === 0)
     store.checkModels();
   if (tick % 2 === 0)
@@ -12952,4 +14644,15 @@ async function shutdown() {
 }
 process.on("SIGINT", shutdown);
 process.on("SIGTERM", shutdown);
+var parentPid = Number(process.env.SWARM_PARENT_PID);
+if (Number.isInteger(parentPid) && parentPid > 1) {
+  setInterval(() => {
+    try {
+      process.kill(parentPid, 0);
+    } catch {
+      console.error(`swarmd: parent ${parentPid} is gone \u2014 shutting down`);
+      shutdown();
+    }
+  }, 2000).unref();
+}
 process.on("exit", () => clearDaemonInfo());