@ra3orblade/swarm 0.13.2 → 0.15.0

package/dist/swarm-hook.js

@@ -1,9 +1,19 @@
 #!/usr/bin/env bun
 // @bun
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
+};
 
-// packages/hook/src/bin.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { dirname, join as join2 } from "path";
+// packages/client/src/bins.ts
+var init_bins = () => {};
 
 // packages/client/src/daemon.ts
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
@@ -12,8 +22,6 @@ import { join } from "path";
 function swarmHome() {
   return process.env.SWARM_HOME ?? join(homedir(), ".swarm");
 }
-var DEFAULT_PORT = Number(process.env.SWARM_PORT ?? 7777);
-var infoFile = () => join(swarmHome(), "daemon.json");
 function readDaemonInfo() {
   const file = infoFile();
   if (!existsSync(file))
@@ -24,7 +32,6 @@ function readDaemonInfo() {
     return null;
   }
 }
-var tokenFile = (home = swarmHome()) => join(home, "token");
 function readToken(home = swarmHome()) {
   try {
     const t = readFileSync(tokenFile(home), "utf8").trim();
@@ -33,153 +40,329 @@ function readToken(home = swarmHome()) {
     return null;
   }
 }
-var authedFetch = (input, init) => {
+function resolveBaseUrl(explicit) {
+  const raw = explicit ?? process.env.SWARM_URL ?? readDaemonInfo()?.url ?? `http://127.0.0.1:${DEFAULT_PORT}`;
+  return raw.replace(/\/$/, "");
+}
+var DEFAULT_PORT, infoFile = () => join(swarmHome(), "daemon.json"), tokenFile = (home = swarmHome()) => join(home, "token"), authedFetch = (input, init) => {
   const h = new Headers(init?.headers);
   const t = readToken();
   if (t && !h.has("authorization"))
     h.set("authorization", `Bearer ${t}`);
   return fetch(input, { ...init, headers: h });
 };
-function resolveBaseUrl(explicit) {
-  const raw = explicit ?? process.env.SWARM_URL ?? readDaemonInfo()?.url ?? `http://127.0.0.1:${DEFAULT_PORT}`;
-  return raw.replace(/\/$/, "");
-}
+var init_daemon = __esm(() => {
+  init_bins();
+  DEFAULT_PORT = Number(process.env.SWARM_PORT ?? 7777);
+});
+
+// packages/client/src/index.ts
+var init_src = __esm(() => {
+  init_daemon();
+  init_bins();
+  init_daemon();
+});
 // packages/core/src/actor.ts
-var HUMAN_ALIASES = new Set(["cli", "dashboard", "me", "desktop", "human"]);
-var DAEMON_ALIASES = new Set(["daemon", "system", "swarm"]);
-// packages/core/src/art.ts
-var ROBOT = [
-  "                        MM                     MM                        ",
-  "                        LL                     LL                        ",
-  "                        LL                     LL                        ",
-  "                        LM                     MM                        ",
-  "                        MD                     MS                        ",
-  "                        LE                     LE                        ",
-  "                        ME                     ME                        ",
-  "                        MS                     MS                        ",
-  "                        KK                     KK                        ",
-  "                   SSDDDSDDDDDDDDDDDDDDDDDDDDDDDDDDDDS                   ",
-  "                   SSDSDDDDDDDDDDDDDDDDDDDDDDDDDDDDDSS                   ",
-  "                   SSDOOOOOOOOOOOOOOOOOOOOOOOOOOOOOKSS                   ",
-  "                   SSOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMOSS                   ",
-  "                   DDKMMLLLMLLMMMMMMMMMMMMMMMMMMMMMODD                   ",
-  "                   DDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
-  "              SSSSODDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSSSS              ",
-  "              SSSSODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSSSS              ",
-  "             SMMMMODDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSMMMS             ",
-  "             DMSSSODDOMMMMOOOOOOMMMMMMMMMOOOOOOMMMMODDOSSSED             ",
-  "             DSSSSODDOMMMMODDDDDMMMMMMMMMODDDDDMMMMODDOSSSSK             ",
-  "             DSMMSODDOMMMMDDDDDDMMMMMMMMMKDDDDDMMMMODDOSMMSK             ",
-  "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDOSSSSK             ",
-  "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSK             ",
-  "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSK             ",
-  "             DSSSKODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSD             ",
-  "             OKKKKODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOKKKKO             ",
-  "              KKKKODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOOKKK              ",
-  "              KKKOODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOOKKK              ",
-  "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
-  "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
-  "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
-  "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
-  "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
-  "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
-  "                   DDDOOOOOOOOOOOOOOOOOOOOOOOOOOOOOKDD                   ",
-  "                   DDDDDDDDDDDDDDDDDDDDDDDDDDDDDKDDDDD                   ",
-  "                   DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD                   ",
-  "                               OOOOOOOOOOO                               ",
-  "                               OODDDDDKKOO                               ",
-  "                               DSMMMMMMSDD                               ",
-  "                               OOOOOOOOOOO                               ",
-  "                              KDSMMMMMESSKK                              ",
-  "                   MMMMMMSSKOOKDSMMMMMSSSDKOODSEMMMMMM                   ",
-  "         SSSSDO   MMMMMMSSKKOOOOOOOOOOOOOOOOOKSSSMMMMMM   ODSSSS         ",
-  "        EEESSSSOOLLLLMMMMMESSSSSSSSSSSSSSSSSSSSMMMMMLLLLOOSSSSMME        ",
-  "       SMMSSSSKOEELLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLEEOOSSSSEMS       ",
-  "      DSSSSSSSOOSEEKSMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMSOEEDOOSSSSSSSK      ",
-  "      DSSSSSSDOOSEOSKEMMMMMMMMMMMMMMMMMMMMMMMMMMMMMEOSDEDOODSSSSSSK      ",
-  "      KSSSSSSKOODSSOSEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEESOEEDOOKSSSSSSK      ",
-  "      DKSSSSKKOODSMEEMLLLLLLLLLLLLLLLLLLLLLLLLLLLLLMSEMSDOOKKSSSSDK      ",
-  "      OKDDKDKKOOKSMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMSKOOKKKKKKKO      ",
-  "      OOOOOKKKOOKSMMMMESSSSSSSSSSSSSMMMMEEEEEESSSSEMMMMSKOOKKKOOOOO      ",
-  "      OOOOOOKKOOKSMMMSSKKKKKKKKKKKKKKMMMDKOOOOOOOODDMMMSKOOKKOOOOOO      ",
-  "      OKSSKOOOOOKSMMMKKMLLLLLLLLLLLMKMMMDDSSSSSSSSDDMMMSKOOOOODSSKO      ",
-  "      SDOKKK    KSMMMKDLLLLLLLLLLLLLKMMMKDKKKDDKKKDKMMMSK    KKKKDS      ",
-  "     DMLLMKO    KSMMMKDLLLLLLLLLLLLLKMMMDDDDDDDDDSKDMMMSK    ODMLLMD     ",
-  "     DELLMSD    KSMMMKKMLLLLLLLLLLLLKMMMDKKKKKKKKKDDMMMSK    DSMLLEO     ",
-  "    KSKKKKDO    KSMMMEDDDDKKDDDKKKDKSMMMDDDDDDDDDSDDMMMSK    ODDKKKSK    ",
-  "    EMLLMDO     KSMMMMLLLLLLLLLLLLLLLMMMDOOOOOOOOODDMMMSK     ODMLLME    ",
-  "    KMLLMSD     KSMMMMMMMMMMMMMMMMMMMMMMDDSSDDSSSSDDMMMSK     SSMLLEK    ",
-  "   KSKKKKSO     KSMMMMMOOMMOOMKOEMOOMMMMDOOOOOOOOODDMMMSK     OSKKKKSO   ",
-  "   SMLLMDO      KSMMMMMKKMMKKMDKEMKKMMMMKDDDDSSSSDDDMMMSK      ODMLLMS   ",
-  "   SMMMMSD      KSMMMMMEEMMEEMEEMMEEMMMMDSOOOOOOOODDMMSSK      DSMMMMD   ",
-  "   OOOOOOO      KSSMMMMMMMMMMMMMMMMMMMMMDDDDDDDDDDDDMSSSK      OOOOOOO   ",
-  " KSMLLLMMSKO    KSSSSMMMMMMMMMMMMMMMMMMMSOOOOOOOOOOSSSSSK    OKSMLLLLMSO ",
-  " DSMMMEEESKK    KSSKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSOSSK    KDSMMMMMESD ",
-  " DSMMMMMESKK    KSOOKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSOOKSK    KKSMMMMMMSD ",
-  " DSMMMMMESKK    OKSKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSDSKO    KDSMMMMMMSD ",
-  " KDDDDDDDDKK      KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK      KKDDDDDDDDO ",
-  " OOOOOOOOOOO         OOOOOOOOO             OOOOOOOOO         OOOOOOOOOOO ",
-  "DSDO     OSSO        ODKKKKKKK             OKKKKKKKO        KEDO     ODEK",
-  "SMDO     OSMD        KDSSSSSSK             KDSSSSSKO        SMDO     ODMS",
-  "DEKO     OOED         OOKKKOOO             OOOKKOOO         SSOO     OKMS",
-  "DEKO     OOED         SEMMMMSK             OSMMMMED         SSKO     OKES",
-  "DSSO     OESK         SEMMMMSK             OSMMMMED         KSSO     OSSK",
-  "KSMS     EEDO         OOKKKKKO             OOKKKKKO         OSEE     EMSO",
-  " DSS     SSK          OSEEESDO             ODSEEESO          KSS     SSD ",
-  " OOO     OO           SEMMMMSK             OSMMMMED           OO     OOO ",
-  "                      KSSSSSDO             OKSSESSK                      ",
-  "                   DKKDDDDDDKKDK         KDKDDDDDDDKDK                   ",
-  "                  SSMLLMMMMMMLMSK       DSSMMMMMMMLLMSS                  ",
-  "                  SMLMMMMMMMMLLED       SEMMMMMMMMMMLMS                  ",
-  "                 DMMMMMMMMMMMMMMD       SMMMMMMMMMMMMMSK                 ",
-  "                ODSSSSSSSSSSSSSSDO     ODSSSSSSSSSSSSSSKO                ",
-  "                OOOOOOOOOOOOOOOOO       OOOOOOOOOOOOOOOOO                ",
-  "                OKSSSSSSSSSSSSSSK       KSSSSSSSSSSSSSSKO                ",
-  "                OKDDDDDDDDDDDDDDK       KDDDDDDDDDDDDDDOO                "
-];
-var HEAD = ROBOT.slice(0, 37);
-// packages/core/src/audit.ts
-var AUDIT_TYPES = new Set([
-  "session.started",
-  "session.ended",
-  "tool.denied",
-  "claim.acquired",
-  "claim.renewed",
-  "claim.released",
-  "claim.expired",
-  "claim.orphaned",
-  "claim.denied",
-  "rules.changed",
-  "worktree.reclaimed",
-  "worktree.created",
-  "worktree.removed",
-  "worktree.bootstrapped",
-  "pr.opened",
-  "question.asked",
-  "question.answered",
-  "dispatch.queued",
-  "dispatch.started",
-  "dispatch.finished",
-  "resource.acquired",
-  "resource.released",
-  "resource.reaped",
-  "process.started",
-  "process.exited",
-  "gate.recorded",
-  "handoff.recorded",
-  "permission.requested",
-  "permission.resolved",
-  "incident.opened",
-  "incident.acked",
-  "run.result",
-  "workflow.started",
-  "workflow.finished"
-]);
-var AUDIT_TYPES_SQL = [...AUDIT_TYPES].map((t) => `'${t}'`).join(", ");
-// packages/core/src/budget.ts
-var BUDGET_ASK_TOOLS = new Set(["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit"]);
+var HUMAN_ALIASES, DAEMON_ALIASES;
+var init_actor = __esm(() => {
+  HUMAN_ALIASES = new Set(["cli", "dashboard", "me", "desktop", "human"]);
+  DAEMON_ALIASES = new Set(["daemon", "system", "swarm"]);
+});
+
+// packages/core/src/adapters/aider/history.ts
+var init_history = () => {};
+// packages/core/src/adapters/claude-code/adapter.ts
+var init_adapter = () => {};
+
+// packages/core/src/adapters/codex/rollout.ts
+var init_rollout = () => {};
+
+// packages/core/src/adapters/gemini/chats.ts
+var init_chats = () => {};
+
+// packages/core/src/adapters/grok/updates.ts
+var init_updates = () => {};
+
+// packages/core/src/adapters/opencode/db.ts
+var init_db = () => {};
+// packages/core/src/adapters/index.ts
+var init_adapters = __esm(() => {
+  init_history();
+  init_adapter();
+  init_rollout();
+  init_chats();
+  init_updates();
+  init_db();
+  init_history();
+  init_adapter();
+  init_rollout();
+  init_chats();
+  init_updates();
+  init_db();
+});
+// packages/core/src/prompt.ts
+var init_prompt = () => {};
+
+// packages/core/src/adapters/claude-code/hooks.ts
+var OWN_SUMMARY;
+var init_hooks = __esm(() => {
+  init_prompt();
+  OWN_SUMMARY = new Set([
+    "Bash",
+    "Read",
+    "Edit",
+    "Write",
+    "MultiEdit",
+    "NotebookEdit",
+    "Glob",
+    "Grep",
+    "Agent",
+    "Task",
+    "WebFetch",
+    "WebSearch",
+    "AskUserQuestion"
+  ]);
+});
+
+// packages/core/src/guards.ts
+function expandHome(s, home) {
+  return s.replace(/(^|[\s="'`:])(?:~|\$HOME|\$\{HOME\})(?=\/|$|[\s"'`])/g, `$1${home}`);
+}
+function segments(cmd) {
+  return cmd.split(/\s*(?:&&|\|\||;|\n)\s*/).map((s) => s.trim()).filter(Boolean);
+}
+function words(seg) {
+  return (seg.match(/"[^"]*"|'[^']*'|\S+/g) ?? []).map((w) => w.replace(/^["']|["']$/g, ""));
+}
+function dangerousTarget(target, home, toplevel) {
+  if (/^\$\{?\w+\}?(\/|$)/.test(target) && !target.startsWith(home))
+    return `starts with ${target.match(/^\$\{?\w+\}?/)?.[0]} \u2014 if that is ever unset, it is /`;
+  const t = trimSlash(target.replace(/\/\*$/, "/").replace(/\/\.$/, "/"));
+  if (t === "*" || target === "/*")
+    return "removes everything the glob matches, from the top";
+  if (t === "." || t === ".." || t.startsWith("../"))
+    return "removes the working directory or its parent";
+  if (t === home || t === trimSlash(home))
+    return "removes the home directory";
+  if (!t.startsWith("/"))
+    return null;
+  if (SYSTEM_DIRS.includes(t))
+    return `removes ${t}`;
+  if (t.split("/").length <= 3 && /^\/(Users|home)\//.test(t))
+    return `removes the home directory ${t}`;
+  if (SCRATCH.test(t))
+    return null;
+  if (toplevel && !(t === toplevel || t.startsWith(`${trimSlash(toplevel)}/`)))
+    return `removes ${t}, outside this repository`;
+  return null;
+}
+function destructiveFs(cmd, home, toplevel) {
+  const c = expandHome(cmd, home);
+  for (const seg of segments(c)) {
+    const w = words(seg.replace(/^sudo\s+/, ""));
+    if (w[0] === "rm") {
+      const flags = w.filter((x) => x.startsWith("-"));
+      const recursive = flags.some((f) => /^-[a-zA-Z]*[rR]/.test(f) || f === "--recursive");
+      if (!recursive)
+        continue;
+      for (const target of w.slice(1).filter((x) => !x.startsWith("-"))) {
+        const why = dangerousTarget(target, home, toplevel);
+        if (why)
+          return { what: `\`rm -r ${target}\` ${why}` };
+      }
+    }
+    if (w[0] === "find" && (w.includes("-delete") || /-exec\s+rm\b/.test(seg))) {
+      const root = w[1] ?? ".";
+      const why = dangerousTarget(root, home, toplevel);
+      if (why && root !== ".")
+        return { what: `\`find ${root} \u2026 -delete\` ${why}` };
+    }
+    if (/^(mkfs(\.\w+)?|newfs\w*|wipefs)$/.test(w[0] ?? ""))
+      return { what: `\`${w[0]}\` formats a disk` };
+    if (w[0] === "dd" && w.some((x) => /^of=\/dev\//.test(x)))
+      return { what: "`dd` writes over a device" };
+    if (w[0] === "diskutil" && /^(erase|zero|secureErase|reformat)/i.test(w[1] ?? ""))
+      return { what: `\`diskutil ${w[1]}\` erases a disk` };
+    if ((w[0] === "chmod" || w[0] === "chown") && w.some((x) => /^-[a-zA-Z]*R/.test(x))) {
+      const target = w[w.length - 1] ?? "";
+      if (target.startsWith("/") || target === home) {
+        const why = dangerousTarget(target, home, toplevel);
+        if (why)
+          return { what: `\`${w[0]} -R ${target}\` ${why.replace(/^removes/, "changes")}` };
+      }
+    }
+  }
+  return null;
+}
+function destructiveInfra(cmd) {
+  for (const r of INFRA)
+    if (r.re.test(cmd) && (!r.needs || r.needs.test(cmd)))
+      return { what: r.what };
+  return null;
+}
+function pipeToShell(cmd) {
+  if (new RegExp(`${FETCHER}[^|;&]*\\|\\s*(${INTERP})\\b`).test(cmd))
+    return { what: "pipes a downloaded script straight into an interpreter" };
+  if (/\b((ba|z)?sh|source|\.)\s+<\(\s*(curl|wget)\b/.test(cmd))
+    return { what: "runs a downloaded script via process substitution" };
+  if (/\b(ba|z)?sh\s+-c\s+["']?\$\(\s*(curl|wget)\b/.test(cmd))
+    return { what: "runs a downloaded script via command substitution" };
+  return null;
+}
+function secretFileIn(text) {
+  return SECRET_FILES.find((s) => s.re.test(text))?.what ?? null;
+}
+function secretCommand(cmd) {
+  if (/\bsecurity\s+find-(generic|internet)-password\b[^|;&]*\s-[a-z]*w/.test(cmd))
+    return { what: "prints a password from the macOS keychain" };
+  if (/\b(printenv|env)\s*(\||>|$)/.test(cmd) && /\|\s*(curl|nc|ncat)\b/.test(cmd))
+    return { what: "sends the environment over the network" };
+  for (const seg of segments(cmd)) {
+    if (!READERS.test(seg))
+      continue;
+    const w = words(seg);
+    const copy = /^(cp|scp|rsync)$/.test(w[0] ?? "");
+    const text = copy ? w.slice(1, -1).filter((x) => !x.startsWith("-")).join(" ") : seg;
+    const what = secretFileIn(text);
+    if (what)
+      return { what: `${copy ? "copies" : "reads"} ${what}` };
+  }
+  return null;
+}
+function secretFile(tool, path) {
+  const what = secretFileIn(path);
+  if (!what)
+    return null;
+  if (tool === "Read")
+    return { what: `reads ${what}` };
+  if (/\.env(\.[\w-]+)?$|\.(pem|p12|pfx|key)$/i.test(path))
+    return { what: `writes ${what}` };
+  return null;
+}
+function guardConfigFile(path, home) {
+  const p = expandHome(path, home);
+  const h = trimSlash(home);
+  if (/(^|\/)\.claude\/settings(\.local)?\.json$/.test(p))
+    return "Claude Code settings (hooks and permissions)";
+  if (p === `${h}/.claude.json`)
+    return "Claude Code's MCP registration";
+  if (p.startsWith(`${h}/.swarm/`) || p === `${h}/.swarm`)
+    return "Swarm's config and ledger";
+  if (/(^|\/)\.swarm\.toml$/.test(p))
+    return "this repo's Swarm rules";
+  if (p === `${h}/.codex/config.toml` || p === `${h}/.gemini/settings.json` || p === `${h}/.cursor/hooks.json`)
+    return "another agent's hook config";
+  return null;
+}
+function configTamperCommand(cmd, home) {
+  if (/(^|[\s;&|])swarm\s+uninstall\b/.test(cmd))
+    return { what: "uninstalls Swarm's hooks" };
+  for (const seg of segments(expandHome(cmd, home))) {
+    if (!WRITERS.test(seg))
+      continue;
+    for (const w of words(seg)) {
+      const target = w.replace(/^>+/, "");
+      if (!target.includes("/") && !target.startsWith("."))
+        continue;
+      const what = guardConfigFile(target, home);
+      if (what)
+        return { what: `changes ${what} (${target})` };
+    }
+  }
+  return null;
+}
+var trimSlash = (p) => p.length > 1 ? p.replace(/\/+$/, "") : p, SYSTEM_DIRS, SCRATCH, DB_CLIENT, INFRA, FETCHER, INTERP, SECRET_FILES, READERS, WRITERS;
+var init_guards = __esm(() => {
+  SYSTEM_DIRS = [
+    "/",
+    "/bin",
+    "/boot",
+    "/dev",
+    "/etc",
+    "/home",
+    "/lib",
+    "/opt",
+    "/private",
+    "/root",
+    "/sbin",
+    "/System",
+    "/Library",
+    "/Applications",
+    "/Users",
+    "/usr",
+    "/var"
+  ];
+  SCRATCH = /^(\/tmp|\/private\/tmp|\/var\/folders|\/private\/var\/folders)(\/|$)/;
+  DB_CLIENT = /\b(psql|mysql|mariadb|sqlite3|sqlcmd|clickhouse(-client)?|cockroach|mongo(sh)?|duckdb)\b/i;
+  INFRA = [
+    {
+      what: "`terraform destroy` tears the stack down",
+      re: /\b(terraform|tofu)\s+(\S+\s+)*destroy\b/
+    },
+    { what: "`terraform state rm` forgets live resources", re: /\b(terraform|tofu)\s+state\s+rm\b/ },
+    {
+      what: "`kubectl delete` of a namespace or everything",
+      re: /\bkubectl\s+(\S+\s+)*delete\s+(\S+\s+)*(ns|namespaces?|pvc?|persistentvolume(claim)?s?|--all\b|-A\b|--all-namespaces\b)/
+    },
+    { what: "`kubectl drain` evicts a node's workloads", re: /\bkubectl\s+(\S+\s+)*drain\b/ },
+    { what: "`helm uninstall` removes a release", re: /\bhelm\s+(\S+\s+)*(uninstall|delete)\b/ },
+    {
+      what: "`aws s3 rm --recursive` empties a bucket path",
+      re: /\baws\s+s3\s+rm\b[^|;&]*--recursive/
+    },
+    { what: "`aws s3 rb` deletes a bucket", re: /\baws\s+s3\s+rb\b/ },
+    {
+      what: "an AWS delete / terminate call",
+      re: /\baws\s+[\w-]+\s+(terminate-instances|delete-(db-instance|db-cluster|stack|table|bucket|cluster|function|user|role|repository))\b/
+    },
+    { what: "a `gcloud \u2026 delete`", re: /\bgcloud\s+(\S+\s+)+delete\b/ },
+    { what: "an `az \u2026 delete`", re: /\baz\s+(\S+\s+)+delete\b/ },
+    {
+      what: "`docker system prune` removes images and volumes",
+      re: /\bdocker\s+system\s+prune\b[^|;&]*(-a\b|--all\b|--volumes\b)/
+    },
+    { what: "`docker volume rm/prune` deletes data volumes", re: /\bdocker\s+volume\s+(rm|prune)\b/ },
+    { what: "a SQL `DROP`", re: /\bdrop\s+(database|schema|table)\b/i, needs: DB_CLIENT },
+    { what: "a SQL `TRUNCATE`", re: /\btruncate\s+(table\s+)?\w/i, needs: DB_CLIENT },
+    {
+      what: "an unbounded SQL `DELETE`",
+      re: /\bdelete\s+from\s+[\w."]+\s*(;|"|'|$)/i,
+      needs: DB_CLIENT
+    },
+    { what: "`dropdb` deletes a database", re: /(^|[\s;&|])dropdb\s/ },
+    {
+      what: "a database reset",
+      re: /\b(prisma\s+migrate\s+reset|rails\s+db:(drop|reset)|rake\s+db:(drop|reset)|supabase\s+db\s+reset)\b/
+    },
+    {
+      what: "`redis-cli FLUSHALL/FLUSHDB` wipes the store",
+      re: /\bredis-cli\b[^|;&]*\bflush(all|db)\b/i
+    },
+    { what: "`dropDatabase()` in the Mongo shell", re: /\bdropDatabase\s*\(/, needs: DB_CLIENT }
+  ];
+  FETCHER = String.raw`\b(curl|wget|fetch|http|xh)\b`;
+  INTERP = String.raw`(sudo\s+(-\S+\s+)*)?(env\s+(\w+=\S+\s+)*)?(ba|z|k|da|fi)?sh|python[0-9.]*|node|perl|ruby|php|iex`;
+  SECRET_FILES = [
+    {
+      what: "a .env file",
+      re: /(^|[/\s"'`=@])\.env(\.(?!example\b|sample\b|template\b|dist\b|defaults?\b)[\w-]+)?(?=$|[\s"'`;|&)])/
+    },
+    {
+      what: "an SSH private key",
+      re: /(^|[/\s"'`])(id_rsa|id_ed25519|id_ecdsa|id_dsa)(?=$|[\s"'`;|&)])/
+    },
+    { what: "AWS credentials", re: /\.aws\/credentials\b/ },
+    { what: "an npm token file", re: /(^|[/\s"'`])\.npmrc\b/ },
+    { what: "a kubeconfig", re: /\.kube\/config\b/ },
+    { what: "Google Cloud credentials", re: /gcloud\/[\w-]*credential/i },
+    { what: "a private key file", re: /[\w-]\.(pem|p12|pfx|key)(?=$|[\s"'`;|&)])/i },
+    { what: "a netrc", re: /(^|[/\s"'`])\.netrc\b/ }
+  ];
+  READERS = /(^|[\s;&|(])(cat|less|more|head|tail|bat|strings|base64|xxd|od|hexdump|grep|egrep|rg|ag|awk|nl|tac|cp|scp|rsync|openssl|gpg|pbcopy)\b|curl\b[^|;&]*(-d|--data[\w-]*|-F|--form|-T|--upload-file)\s*@/;
+  WRITERS = /(^|[\s;&|(])(>>?|tee|rm|mv|cp|truncate|ln|chmod|chown|unlink|shred)\b|>>?\s*\S|\bsed\s+(-[a-zA-Z]*\s+)*-i|\bperl\s+-[a-zA-Z]*i|\bsqlite3\b[^|;&]*\b(delete|update|drop|insert)\b/i;
+});
+
 // packages/core/src/rules.ts
-var LIVE_WINDOW_MS = 10 * 60000;
 function otherLiveInSameTree(current, sessions, now, withinMs = LIVE_WINDOW_MS) {
   if (!current.toplevel)
     return null;
@@ -196,7 +379,6 @@ function otherLiveInSameTree(current, sessions, now, withinMs = LIVE_WINDOW_MS)
   }
   return null;
 }
-var GIT_GLOBAL_OPTS = "(?:\\s+(?:-C\\s+\\S+|-c\\s+\\S+|--git-dir(?:=|\\s+)\\S+|--work-tree(?:=|\\s+)\\S+|--namespace(?:=|\\s+)\\S+|--no-pager|--paginate|--bare|--literal-pathspecs|--exec-path(?:=\\S+)?))*";
 function gitVerb(verb, tail) {
   return new RegExp(`\\bgit${GIT_GLOBAL_OPTS}\\s+${verb}${tail}`);
 }
@@ -230,21 +412,149 @@ function killedPorts(cmd) {
     ports.add(Number(m[1]));
   return [...ports];
 }
-var DEFAULT_MODES = {
-  shared_tree: "ask",
-  destructive_git: "ask",
-  pattern_kill: "ask",
-  protected_ports: "ask",
-  no_foreign_worktree: "ask",
-  claim_required_to_write: "off",
-  protected: { ports: [] }
-};
-function guardBash(cmd, current, sessions, now, modes = DEFAULT_MODES) {
+function familyHitsBash(cmd, home, toplevel) {
+  const out = [];
+  const add = (rule, h) => h && out.push({ rule, what: h.what });
+  add("destructive_fs", destructiveFs(cmd, home, toplevel));
+  add("destructive_infra", destructiveInfra(cmd));
+  add("pipe_to_shell", pipeToShell(cmd));
+  add("secrets", secretCommand(cmd));
+  add("config_tamper", configTamperCommand(cmd, home));
+  return out;
+}
+function familyHitsFile(tool, path, home) {
+  const out = [];
+  const secret = secretFile(tool, path);
+  if (secret)
+    out.push({ rule: "secrets", what: secret.what });
+  if (WRITE_TOOLS.has(tool)) {
+    const what = guardConfigFile(path, home);
+    if (what)
+      out.push({ rule: "config_tamper", what: `changes ${what} (${path})` });
+  }
+  return out;
+}
+function familyDecision(hits, modes) {
+  for (const h of hits) {
+    const mode = modes[h.rule] ?? "off";
+    if (mode !== "off")
+      return { action: mode, rule: h.rule, reason: FAMILY_REASON[h.rule](h.what) };
+  }
+  return null;
+}
+function guardFile(tool, path, modes = DEFAULT_MODES, home = process.env.HOME ?? "") {
+  if ((modes.secrets ?? "off") === "off" && (modes.config_tamper ?? "off") === "off")
+    return { action: "allow" };
+  return familyDecision(familyHitsFile(tool, path, home), modes) ?? { action: "allow" };
+}
+function isSingleCommand(cmd) {
+  return !/[&|;<>`\n]/.test(cmd) && !cmd.includes("$(");
+}
+function stripFlagsOutsideQuotes(cmd, flags) {
+  let out = "";
+  let quote = null;
+  let i = 0;
+  while (i < cmd.length) {
+    const ch = cmd[i];
+    if (quote) {
+      out += ch;
+      if (ch === quote && cmd[i - 1] !== "\\")
+        quote = null;
+      i++;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      out += ch;
+      i++;
+      continue;
+    }
+    const rest = cmd.slice(i);
+    const hit = flags.find((f) => rest.startsWith(f) && /^(\s|$)/.test(rest.slice(f.length)));
+    if (hit) {
+      out = out.replace(/[ \t]+$/, "");
+      i += hit.length;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+function rewriteNoVerify(cmd) {
+  if (!isSingleCommand(cmd) || !/^\s*git\s/.test(cmd))
+    return null;
+  if (!/--no-(verify|gpg-sign)\b/.test(cmd))
+    return null;
+  const out = stripFlagsOutsideQuotes(cmd, ["--no-verify", "--no-gpg-sign"]);
+  return out === cmd ? null : out;
+}
+function rewriteDryRun(cmd) {
+  if (!isSingleCommand(cmd))
+    return null;
+  const key = cmd.replace(/\s+/g, " ").trim();
+  if (/^\s*terraform\s+apply\b/.test(cmd)) {
+    const tail = cmd.replace(/^\s*terraform\s+apply\b/, "").trim();
+    if (tail.length > 0 && tail.split(/\s+/).some((a) => !a.startsWith("-")))
+      return null;
+    return {
+      key,
+      command: cmd.replace(/^(\s*)terraform\s+apply\b/, "$1terraform plan").replace(/\s+-auto-approve\b/g, "").replace(/ {2,}/g, " ").trimEnd()
+    };
+  }
+  if (/^\s*kubectl\s+delete\b/.test(cmd) && !/--dry-run\b/.test(cmd))
+    return { key, command: `${cmd.trimEnd()} --dry-run=client` };
+  if (/^\s*helm\s+(uninstall|delete)\b/.test(cmd) && !/--dry-run\b/.test(cmd))
+    return { key, command: `${cmd.trimEnd()} --dry-run` };
+  return null;
+}
+function compiled(rule) {
+  const hit = customRe.get(rule);
+  if (hit !== undefined)
+    return hit;
+  let re = null;
+  try {
+    re = new RegExp(rule.match, rule.action === "rewrite" ? "g" : "");
+  } catch {
+    re = null;
+  }
+  customRe.set(rule, re);
+  return re;
+}
+function applyCustomRule(rule, cmd) {
+  const re = compiled(rule);
+  if (!re)
+    return null;
+  if (rule.action === "off" || !re.test(cmd))
+    return null;
+  const id = `custom:${rule.name}`;
+  const reason = rule.reason ?? `matches custom rule "${rule.name}" (${rule.match})`;
+  if (rule.action !== "rewrite")
+    return { action: rule.action, rule: id, reason };
+  if (!isSingleCommand(cmd))
+    return {
+      action: "ask",
+      rule: id,
+      reason: `${reason} \u2014 not rewritten: the command chains or redirects`
+    };
+  re.lastIndex = 0;
+  const out = cmd.replace(re, rule.replace ?? "").trim();
+  return out === cmd ? null : { action: "rewrite", rule: id, reason, command: out };
+}
+function guardBash(cmd, current, sessions, now, modes = DEFAULT_MODES, ctx = {}) {
   const other = () => otherLiveInSameTree(current, sessions, now);
   const hit = (rule, reason) => {
     const mode = modes[rule];
     return mode === "off" ? { action: "allow" } : { action: mode, rule, reason };
   };
+  const fix = (rule, reason, command, key) => {
+    const mode = modes[rule] ?? "off";
+    if (mode === "off")
+      return { action: "allow" };
+    if (mode === "rewrite")
+      return { action: "rewrite", rule, reason, command, ...key ? { key } : {} };
+    return { action: mode, rule, reason };
+  };
   if (modes.protected_ports !== "off" && modes.protected.ports.length) {
     const target = killedPorts(cmd).filter((p) => modes.protected.ports.includes(p));
     if (target.length) {
@@ -261,7 +571,7 @@ function guardBash(cmd, current, sessions, now, modes = DEFAULT_MODES) {
   if (modes.shared_tree !== "off" && isBroadStage(cmd)) {
     const o = other();
     if (o) {
-      const d = hit("shared_tree", `Another session (${o.id.slice(0, 8)}) is active in this same checkout. \`git add -A\` / \`git commit -a\` will sweep its uncommitted changes into your commit. Stage explicit paths (\`git add <path>\`), or give each session its own git worktree.`);
+      const d = hit("shared_tree", sharedTreeReason(o.id));
       if (d.action !== "allow")
         return d;
     }
@@ -274,6 +584,28 @@ function guardBash(cmd, current, sessions, now, modes = DEFAULT_MODES) {
         return d;
     }
   }
+  if (FAMILY_RULES.some((r) => (modes[r] ?? "off") !== "off")) {
+    const d = familyDecision(familyHitsBash(cmd, ctx.home ?? process.env.HOME ?? "", current.toplevel), modes);
+    if (d)
+      return d;
+  }
+  for (const rule of modes.custom ?? []) {
+    const d = applyCustomRule(rule, cmd);
+    if (d)
+      return d;
+  }
+  const nv = rewriteNoVerify(cmd);
+  if (nv) {
+    const d = fix("no_verify", NO_VERIFY_REASON, nv);
+    if (d.action !== "allow")
+      return d;
+  }
+  const dr = rewriteDryRun(cmd);
+  if (dr && !ctx.rewritesDone?.has(dr.key)) {
+    const d = fix("dry_run_first", `The first \`${dr.key}\` in a session runs as a dry run so you can read what it would change; run the real one next.`, dr.command, dr.key);
+    if (d.action !== "allow")
+      return d;
+  }
   return { action: "allow" };
 }
 function norm(p) {
@@ -302,7 +634,6 @@ function absolutePath(path, cwd) {
     return path;
   return `${cwd.replace(/\/+$/, "")}/${path}`;
 }
-var WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
 function guardWrite(target, current, claims, modes = DEFAULT_MODES, kind = "file") {
   const hit = (rule, reason) => {
     const mode = modes[rule];
@@ -328,22 +659,47 @@ function guardWrite(target, current, claims, modes = DEFAULT_MODES, kind = "file
   }
   return { action: "allow" };
 }
-// packages/core/src/hygiene.ts
-var HYGIENE_DEFAULTS = {
-  staleDays: 2,
-  abandonedDays: 30,
-  hungryRssKb: 1024 * 1024,
-  heavyKb: 2 * 1024 * 1024
-};
-// packages/core/src/ledger.ts
-var EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
-// packages/core/src/outcomes.ts
-var DEFAULT_BRANCHES = new Set(["main", "master", "develop", "trunk"]);
+var LIVE_WINDOW_MS, GIT_GLOBAL_OPTS = "(?:\\s+(?:-C\\s+\\S+|-c\\s+\\S+|--git-dir(?:=|\\s+)\\S+|--work-tree(?:=|\\s+)\\S+|--namespace(?:=|\\s+)\\S+|--no-pager|--paginate|--bare|--literal-pathspecs|--exec-path(?:=\\S+)?))*", DEFAULT_MODES, FAMILY_RULES, FAMILY_REASON, customRe, sharedTreeReason = (sessionId) => `Another session (${sessionId.slice(0, 8)}) is active in this same checkout. \`git add -A\` / \`git commit -a\` will sweep its uncommitted changes into your commit. Stage explicit paths (\`git add <path>\`), or give each session its own git worktree.`, NO_VERIFY_REASON = "Hooks and signing exist for a reason: `--no-verify` / `--no-gpg-sign` was dropped. If a hook is wrong, fix the hook.", WRITE_TOOLS;
+var init_rules = __esm(() => {
+  init_guards();
+  LIVE_WINDOW_MS = 10 * 60000;
+  DEFAULT_MODES = {
+    shared_tree: "ask",
+    destructive_git: "ask",
+    pattern_kill: "ask",
+    protected_ports: "ask",
+    no_foreign_worktree: "ask",
+    claim_required_to_write: "off",
+    no_verify: "off",
+    dry_run_first: "off",
+    custom: [],
+    destructive_fs: "off",
+    destructive_infra: "off",
+    pipe_to_shell: "off",
+    secrets: "off",
+    config_tamper: "off",
+    protected: { ports: [] }
+  };
+  FAMILY_RULES = [
+    "destructive_fs",
+    "destructive_infra",
+    "pipe_to_shell",
+    "secrets",
+    "config_tamper"
+  ];
+  FAMILY_REASON = {
+    destructive_fs: (w) => `This ${w}. Nothing gets that back \u2014 name the exact paths you mean, inside this repository.`,
+    destructive_infra: (w) => `This is ${w} \u2014 outside this checkout, and not something git can undo. Confirm with the owner first.`,
+    pipe_to_shell: (w) => `This ${w}. Download it to a file, read it, then run it.`,
+    secrets: (w) => `This ${w}. Credentials stay out of the transcript: use the variable by name, or ask the owner.`,
+    config_tamper: (w) => `This ${w} \u2014 the settings that decide what agents may do. Ask the owner to change them.`
+  };
+  customRe = new WeakMap;
+  WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
+});
+
 // packages/core/src/policy.ts
 import { createHash } from "crypto";
-var POLICY_CACHE_VERSION = 1;
-var POLICY_CACHE_FILE = "policy.cache.json";
-var digest = (body) => createHash("sha256").update(JSON.stringify(body)).digest("hex");
 function verifyPolicyCache(raw) {
   if (!raw || typeof raw !== "object")
     return null;
@@ -362,10 +718,15 @@ function evaluateOffline(cache, raw, toplevel, now = Date.now()) {
   const cwd = typeof raw.cwd === "string" ? raw.cwd : "";
   const isWrite = WRITE_TOOLS.has(tool) && typeof input.file_path === "string";
   const cmd = tool === "Bash" && typeof input.command === "string" ? input.command : null;
+  const modes = cache.modes;
+  if (typeof input.file_path === "string" && (isWrite || tool === "Read")) {
+    const f = guardFile(tool, absolutePath(input.file_path, cwd), modes);
+    if (f.action !== "allow")
+      return f;
+  }
   if (!isWrite && !cmd)
     return { action: "allow" };
   const current = { id, cwd, toplevel: toplevel(cwd) };
-  const modes = cache.modes;
   if (modes.no_foreign_worktree !== "off" || modes.claim_required_to_write !== "off") {
     const target = isWrite ? absolutePath(input.file_path, cwd) : cwd;
     const w = guardWrite(target, current, cache.worktrees, modes, isWrite ? "file" : "bash");
@@ -376,10 +737,617 @@ function evaluateOffline(cache, raw, toplevel, now = Date.now()) {
     return { action: "allow" };
   return guardBash(cmd, current, cache.sessions, now, modes);
 }
+var POLICY_CACHE_VERSION = 1, POLICY_CACHE_FILE = "policy.cache.json", digest = (body) => createHash("sha256").update(JSON.stringify(body)).digest("hex");
+var init_policy = __esm(() => {
+  init_hooks();
+  init_rules();
+});
+
+// packages/core/src/agenthooks.ts
+function detectAgent(raw) {
+  if (typeof raw.cursor_version === "string" || typeof raw.conversation_id === "string")
+    return "cursor";
+  if (raw.hook_event_name === "BeforeTool")
+    return "gemini";
+  if (typeof raw.turn_id === "string")
+    return "codex";
+  return "claude-code";
+}
+function patchPaths(patch) {
+  const out = [];
+  for (const m of patch.matchAll(/^\*\*\* (?:Add File|Update File|Delete File|Move to): (.+)$/gm)) {
+    const p = m[1]?.trim();
+    if (p && !out.includes(p))
+      out.push(p);
+  }
+  return out;
+}
+function toToolRequests(agent, raw) {
+  const input = raw.tool_input && typeof raw.tool_input === "object" ? raw.tool_input : {};
+  const tool = str(raw.tool_name) ?? "";
+  const cwd = str(raw.cwd) ?? "";
+  const sessionId = str(raw.session_id) ?? str(raw.conversation_id) ?? "";
+  const req = (t, i, at = cwd) => ({
+    tool: t,
+    input: i,
+    sessionId,
+    cwd: at
+  });
+  switch (agent) {
+    case "claude-code": {
+      const command = str(input.command);
+      const file_path = str(input.file_path);
+      return [req(tool, { ...command ? { command } : {}, ...file_path ? { file_path } : {} })];
+    }
+    case "codex": {
+      const command = str(input.command);
+      if (tool === "Bash" && command)
+        return [req("Bash", { command })];
+      if (tool === "apply_patch" && command)
+        return patchPaths(command).map((p) => req("Write", { file_path: p }));
+      return [];
+    }
+    case "gemini": {
+      const shell = str(input.command);
+      if (tool === "run_shell_command" && shell)
+        return [req("Bash", { command: shell }, str(input.dir_path) ?? cwd)];
+      const fp = str(input.file_path);
+      if (!fp)
+        return [];
+      if (tool === "read_file")
+        return [req("Read", { file_path: fp })];
+      if (tool === "write_file" || tool === "replace")
+        return [req("Write", { file_path: fp })];
+      return [];
+    }
+    case "cursor": {
+      const shell = str(input.command);
+      if (tool === "Shell" && shell)
+        return [req("Bash", { command: shell }, str(input.working_directory) ?? cwd)];
+      const fp = str(input.file_path) ?? str(input.path) ?? str(input.target_file);
+      if (!fp)
+        return [];
+      if (tool === "Read")
+        return [req("Read", { file_path: fp })];
+      if (tool === "Write" || tool === "Delete")
+        return [req("Write", { file_path: fp })];
+      return [];
+    }
+  }
+}
+function effectiveDecision(agent, d) {
+  if (d.action === "ask" && !CAN_ASK.has(agent))
+    return {
+      ...d,
+      action: "deny",
+      reason: `${d.reason ?? ""} (Swarm would ask the user here; ${AGENT_LABEL[agent]}'s hooks cannot ask, so the call is refused \u2014 ask the user to run it, or to turn the rule off.)`.trim()
+    };
+  if (d.action === "rewrite" && agent !== "claude-code")
+    return {
+      ...d,
+      action: "deny",
+      reason: `${d.reason ?? ""} Run this instead: ${d.command ?? ""}`.trim()
+    };
+  return d;
+}
+function renderAgentDecision(agent, d) {
+  const e = effectiveDecision(agent, d);
+  if (e.action === "allow")
+    return "{}";
+  const reason = `[swarm] ${e.reason ?? ""}`.trim();
+  if (agent === "gemini")
+    return JSON.stringify({ decision: "deny", reason });
+  return JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: e.action === "ask" ? "ask" : "deny",
+      permissionDecisionReason: reason
+    }
+  });
+}
+var AGENT_LABEL, CAN_ASK, str = (v) => typeof v === "string" && v ? v : undefined;
+var init_agenthooks = __esm(() => {
+  init_policy();
+  AGENT_LABEL = {
+    "claude-code": "Claude Code",
+    codex: "Codex",
+    gemini: "Gemini CLI",
+    cursor: "Cursor"
+  };
+  CAN_ASK = new Set(["claude-code"]);
+});
+
+// packages/core/src/art.ts
+var ROBOT, HEAD;
+var init_art = __esm(() => {
+  ROBOT = [
+    "                        MM                     MM                        ",
+    "                        LL                     LL                        ",
+    "                        LL                     LL                        ",
+    "                        LM                     MM                        ",
+    "                        MD                     MS                        ",
+    "                        LE                     LE                        ",
+    "                        ME                     ME                        ",
+    "                        MS                     MS                        ",
+    "                        KK                     KK                        ",
+    "                   SSDDDSDDDDDDDDDDDDDDDDDDDDDDDDDDDDS                   ",
+    "                   SSDSDDDDDDDDDDDDDDDDDDDDDDDDDDDDDSS                   ",
+    "                   SSDOOOOOOOOOOOOOOOOOOOOOOOOOOOOOKSS                   ",
+    "                   SSOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMOSS                   ",
+    "                   DDKMMLLLMLLMMMMMMMMMMMMMMMMMMMMMODD                   ",
+    "                   DDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
+    "              SSSSODDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSSSS              ",
+    "              SSSSODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSSSS              ",
+    "             SMMMMODDOMMLMMMMMMMMMMMMMMMMMMMMMMMMMMODDOSMMMS             ",
+    "             DMSSSODDOMMMMOOOOOOMMMMMMMMMOOOOOOMMMMODDOSSSED             ",
+    "             DSSSSODDOMMMMODDDDDMMMMMMMMMODDDDDMMMMODDOSSSSK             ",
+    "             DSMMSODDOMMMMDDDDDDMMMMMMMMMKDDDDDMMMMODDOSMMSK             ",
+    "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDOSSSSK             ",
+    "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSK             ",
+    "             DSSSSODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSK             ",
+    "             DSSSKODDOMMMMDDDDDDMMMMMMMMMDDDDDDMMMMODDODSSSD             ",
+    "             OKKKKODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOKKKKO             ",
+    "              KKKKODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOOKKK              ",
+    "              KKKOODDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODDOOKKK              ",
+    "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
+    "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
+    "                   DDOMMMMDDDDDDDDDDDDDDDDDDDDDMMMMODD                   ",
+    "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
+    "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
+    "                   DDOMMMMMMMMMMMMMMMMMMMMMMMMMMMMMODD                   ",
+    "                   DDDOOOOOOOOOOOOOOOOOOOOOOOOOOOOOKDD                   ",
+    "                   DDDDDDDDDDDDDDDDDDDDDDDDDDDDDKDDDDD                   ",
+    "                   DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD                   ",
+    "                               OOOOOOOOOOO                               ",
+    "                               OODDDDDKKOO                               ",
+    "                               DSMMMMMMSDD                               ",
+    "                               OOOOOOOOOOO                               ",
+    "                              KDSMMMMMESSKK                              ",
+    "                   MMMMMMSSKOOKDSMMMMMSSSDKOODSEMMMMMM                   ",
+    "         SSSSDO   MMMMMMSSKKOOOOOOOOOOOOOOOOOKSSSMMMMMM   ODSSSS         ",
+    "        EEESSSSOOLLLLMMMMMESSSSSSSSSSSSSSSSSSSSMMMMMLLLLOOSSSSMME        ",
+    "       SMMSSSSKOEELLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLEEOOSSSSEMS       ",
+    "      DSSSSSSSOOSEEKSMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMSOEEDOOSSSSSSSK      ",
+    "      DSSSSSSDOOSEOSKEMMMMMMMMMMMMMMMMMMMMMMMMMMMMMEOSDEDOODSSSSSSK      ",
+    "      KSSSSSSKOODSSOSEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEESOEEDOOKSSSSSSK      ",
+    "      DKSSSSKKOODSMEEMLLLLLLLLLLLLLLLLLLLLLLLLLLLLLMSEMSDOOKKSSSSDK      ",
+    "      OKDDKDKKOOKSMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMSKOOKKKKKKKO      ",
+    "      OOOOOKKKOOKSMMMMESSSSSSSSSSSSSMMMMEEEEEESSSSEMMMMSKOOKKKOOOOO      ",
+    "      OOOOOOKKOOKSMMMSSKKKKKKKKKKKKKKMMMDKOOOOOOOODDMMMSKOOKKOOOOOO      ",
+    "      OKSSKOOOOOKSMMMKKMLLLLLLLLLLLMKMMMDDSSSSSSSSDDMMMSKOOOOODSSKO      ",
+    "      SDOKKK    KSMMMKDLLLLLLLLLLLLLKMMMKDKKKDDKKKDKMMMSK    KKKKDS      ",
+    "     DMLLMKO    KSMMMKDLLLLLLLLLLLLLKMMMDDDDDDDDDSKDMMMSK    ODMLLMD     ",
+    "     DELLMSD    KSMMMKKMLLLLLLLLLLLLKMMMDKKKKKKKKKDDMMMSK    DSMLLEO     ",
+    "    KSKKKKDO    KSMMMEDDDDKKDDDKKKDKSMMMDDDDDDDDDSDDMMMSK    ODDKKKSK    ",
+    "    EMLLMDO     KSMMMMLLLLLLLLLLLLLLLMMMDOOOOOOOOODDMMMSK     ODMLLME    ",
+    "    KMLLMSD     KSMMMMMMMMMMMMMMMMMMMMMMDDSSDDSSSSDDMMMSK     SSMLLEK    ",
+    "   KSKKKKSO     KSMMMMMOOMMOOMKOEMOOMMMMDOOOOOOOOODDMMMSK     OSKKKKSO   ",
+    "   SMLLMDO      KSMMMMMKKMMKKMDKEMKKMMMMKDDDDSSSSDDDMMMSK      ODMLLMS   ",
+    "   SMMMMSD      KSMMMMMEEMMEEMEEMMEEMMMMDSOOOOOOOODDMMSSK      DSMMMMD   ",
+    "   OOOOOOO      KSSMMMMMMMMMMMMMMMMMMMMMDDDDDDDDDDDDMSSSK      OOOOOOO   ",
+    " KSMLLLMMSKO    KSSSSMMMMMMMMMMMMMMMMMMMSOOOOOOOOOOSSSSSK    OKSMLLLLMSO ",
+    " DSMMMEEESKK    KSSKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSOSSK    KDSMMMMMESD ",
+    " DSMMMMMESKK    KSOOKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSOOKSK    KKSMMMMMMSD ",
+    " DSMMMMMESKK    OKSKSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSDSKO    KDSMMMMMMSD ",
+    " KDDDDDDDDKK      KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK      KKDDDDDDDDO ",
+    " OOOOOOOOOOO         OOOOOOOOO             OOOOOOOOO         OOOOOOOOOOO ",
+    "DSDO     OSSO        ODKKKKKKK             OKKKKKKKO        KEDO     ODEK",
+    "SMDO     OSMD        KDSSSSSSK             KDSSSSSKO        SMDO     ODMS",
+    "DEKO     OOED         OOKKKOOO             OOOKKOOO         SSOO     OKMS",
+    "DEKO     OOED         SEMMMMSK             OSMMMMED         SSKO     OKES",
+    "DSSO     OESK         SEMMMMSK             OSMMMMED         KSSO     OSSK",
+    "KSMS     EEDO         OOKKKKKO             OOKKKKKO         OSEE     EMSO",
+    " DSS     SSK          OSEEESDO             ODSEEESO          KSS     SSD ",
+    " OOO     OO           SEMMMMSK             OSMMMMED           OO     OOO ",
+    "                      KSSSSSDO             OKSSESSK                      ",
+    "                   DKKDDDDDDKKDK         KDKDDDDDDDKDK                   ",
+    "                  SSMLLMMMMMMLMSK       DSSMMMMMMMLLMSS                  ",
+    "                  SMLMMMMMMMMLLED       SEMMMMMMMMMMLMS                  ",
+    "                 DMMMMMMMMMMMMMMD       SMMMMMMMMMMMMMSK                 ",
+    "                ODSSSSSSSSSSSSSSDO     ODSSSSSSSSSSSSSSKO                ",
+    "                OOOOOOOOOOOOOOOOO       OOOOOOOOOOOOOOOOO                ",
+    "                OKSSSSSSSSSSSSSSK       KSSSSSSSSSSSSSSKO                ",
+    "                OKDDDDDDDDDDDDDDK       KDDDDDDDDDDDDDDOO                "
+  ];
+  HEAD = ROBOT.slice(0, 37);
+});
+
+// packages/core/src/audit.ts
+var AUDIT_TYPES, AUDIT_TYPES_SQL;
+var init_audit = __esm(() => {
+  AUDIT_TYPES = new Set([
+    "session.started",
+    "session.ended",
+    "tool.denied",
+    "claim.acquired",
+    "claim.renewed",
+    "claim.released",
+    "claim.expired",
+    "claim.orphaned",
+    "claim.denied",
+    "rules.changed",
+    "worktree.reclaimed",
+    "worktree.created",
+    "worktree.removed",
+    "worktree.bootstrapped",
+    "pr.opened",
+    "question.asked",
+    "question.answered",
+    "dispatch.queued",
+    "dispatch.started",
+    "dispatch.finished",
+    "resource.acquired",
+    "resource.released",
+    "resource.reaped",
+    "process.started",
+    "process.exited",
+    "gate.recorded",
+    "gate.blocked",
+    "codify.applied",
+    "handoff.recorded",
+    "permission.requested",
+    "permission.resolved",
+    "incident.opened",
+    "incident.acked",
+    "run.result",
+    "workflow.started",
+    "workflow.finished"
+  ]);
+  AUDIT_TYPES_SQL = [...AUDIT_TYPES].map((t) => `'${t}'`).join(", ");
+});
+
+// packages/core/src/budget.ts
+var BUDGET_ASK_TOOLS;
+var init_budget = __esm(() => {
+  BUDGET_ASK_TOOLS = new Set(["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit"]);
+});
+// packages/core/src/workflows.ts
+var init_workflows = () => {};
+
+// packages/core/src/config.ts
+var init_config = __esm(() => {
+  init_audit();
+  init_workflows();
+});
+
+// packages/core/src/context.ts
+var init_context = () => {};
+
+// packages/core/src/dag.ts
+var init_dag = () => {};
+// packages/core/src/dryrun.ts
+var init_dryrun = __esm(() => {
+  init_rules();
+});
+// packages/core/src/gatehealth.ts
+var init_gatehealth = () => {};
+
+// packages/core/src/gates.ts
+var init_gates = () => {};
+
+// packages/core/src/graphs.ts
+var init_graphs = __esm(() => {
+  init_rules();
+});
+
+// packages/core/src/heat.ts
+var init_heat = __esm(() => {
+  init_rules();
+});
+
+// packages/core/src/worktree.ts
+var init_worktree = __esm(() => {
+  init_config();
+});
+
+// packages/core/src/hygiene.ts
+var HYGIENE_DEFAULTS;
+var init_hygiene = __esm(() => {
+  init_worktree();
+  HYGIENE_DEFAULTS = {
+    staleDays: 2,
+    abandonedDays: 30,
+    hungryRssKb: 1024 * 1024,
+    heavyKb: 2 * 1024 * 1024
+  };
+});
+
+// packages/core/src/ledger.ts
+var EDIT_TOOLS;
+var init_ledger = __esm(() => {
+  init_prompt();
+  EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+});
+// packages/core/src/lessons-apply.ts
+var init_lessons_apply = () => {};
+
+// packages/core/src/lineage.ts
+var init_lineage = __esm(() => {
+  init_dag();
+});
+
+// packages/core/src/mcphealth.ts
+var init_mcphealth = __esm(() => {
+  init_gatehealth();
+});
+// packages/core/src/memory.ts
+var init_memory = () => {};
+// packages/core/src/otel.ts
+var init_otel = () => {};
+
+// packages/core/src/outcomes.ts
+var DEFAULT_BRANCHES;
+var init_outcomes = __esm(() => {
+  DEFAULT_BRANCHES = new Set(["main", "master", "develop", "trunk"]);
+});
+
+// packages/core/src/pricing.ts
+var init_pricing = () => {};
+// packages/core/src/provenance.ts
+var init_provenance = () => {};
+// packages/core/src/quota.ts
+var BURN_MIN_SPAN_MS, BURN_LOOKBACK_MS;
+var init_quota = __esm(() => {
+  BURN_MIN_SPAN_MS = 10 * 60000;
+  BURN_LOOKBACK_MS = 60 * 60000;
+});
+// packages/core/src/security.ts
+var init_security = __esm(() => {
+  init_rules();
+});
+
+// packages/core/src/stall.ts
+var init_stall = () => {};
+
+// packages/core/src/statusline.ts
+function parseStatuslinePayload(text) {
+  try {
+    const v = JSON.parse(text);
+    return v && typeof v === "object" && !Array.isArray(v) ? v : null;
+  } catch {
+    return null;
+  }
+}
+function pct(color, label, value) {
+  const s = `${label} ${Math.round(value)}%`;
+  if (value >= 90)
+    return red(color, s);
+  if (value >= 70)
+    return yellow(color, s);
+  return s;
+}
+function money(usd) {
+  return usd >= 10 ? `$${usd.toFixed(0)}` : `$${usd.toFixed(2)}`;
+}
+function renderStatusline(payload, state, opts = {}) {
+  const color = opts.color ?? false;
+  const local = [];
+  const model = payload.model?.display_name ?? payload.model?.id;
+  if (model)
+    local.push(bold(color, model));
+  const ctx = payload.context_window?.used_percentage;
+  if (typeof ctx === "number")
+    local.push(pct(color, "ctx", ctx));
+  const cost = payload.cost?.total_cost_usd;
+  if (typeof cost === "number")
+    local.push(money(cost));
+  const five = payload.rate_limits?.five_hour?.used_percentage;
+  if (typeof five === "number")
+    local.push(pct(color, "5h", five));
+  const week = payload.rate_limits?.seven_day?.used_percentage;
+  if (typeof week === "number")
+    local.push(pct(color, "7d", week));
+  const swarm = [];
+  if (state) {
+    if (state.task)
+      swarm.push(`${state.task.id} ${dim(color, `${state.task.leftMin}m`)}`);
+    if (state.budget && state.budget.level !== "ok")
+      swarm.push((state.budget.level === "exceeded" ? red : yellow)(color, `budget ${state.budget.level} ${Math.round(state.budget.pct * 100)}%`));
+    if (state.incidents > 0)
+      swarm.push(yellow(color, `${state.incidents} incident${state.incidents === 1 ? "" : "s"}`));
+    if (state.waitingOn > 0)
+      swarm.push(red(color, `waiting on you${state.waitingOn > 1 ? ` \xD7${state.waitingOn}` : ""}`));
+    if (state.inbox > 0)
+      swarm.push(`inbox ${state.inbox}`);
+    if (state.quota) {
+      const short = { five_hour: "5h", seven_day: "7d", spend_limit: "spend" }[state.quota.window];
+      const h = state.quota.hoursToLimit;
+      if (h == null)
+        swarm.push(red(color, `${short} limit reached`));
+      else {
+        const s = `${short} limit in ${h < 1 ? `${Math.max(1, Math.round(h * 60))}m` : `${Math.round(h)}h`}`;
+        swarm.push(h < 1 ? red(color, s) : h < 3 ? yellow(color, s) : s);
+      }
+    }
+  }
+  const sep = dim(color, " \xB7 ");
+  const bar = dim(color, " \u2502 ");
+  const left = local.join(sep);
+  if (!swarm.length)
+    return left;
+  const right = swarm.join(sep);
+  return left ? `${left}${bar}${right}` : right;
+}
+var ESC = "\x1B[", paint = (color, code, s) => color ? `${ESC}${code}m${s}${ESC}0m` : s, dim = (c, s) => paint(c, "2", s), yellow = (c, s) => paint(c, "33", s), red = (c, s) => paint(c, "31", s), bold = (c, s) => paint(c, "1", s);
+
+// packages/core/src/tasks.ts
+var init_tasks = () => {};
+
+// packages/core/src/team.ts
+var init_team = () => {};
+
+// packages/core/src/teamsetup.ts
+var init_teamsetup = () => {};
+
+// packages/core/src/transitions.ts
+var init_transitions = () => {};
+
+// packages/core/src/types.ts
+var init_types = () => {};
+
+// packages/core/src/waiting.ts
+var init_waiting = () => {};
+
+// packages/core/src/index.ts
+var init_src2 = __esm(() => {
+  init_actor();
+  init_adapters();
+  init_hooks();
+  init_agenthooks();
+  init_art();
+  init_audit();
+  init_budget();
+  init_config();
+  init_context();
+  init_dag();
+  init_dryrun();
+  init_gatehealth();
+  init_gates();
+  init_graphs();
+  init_heat();
+  init_hygiene();
+  init_ledger();
+  init_lessons_apply();
+  init_lineage();
+  init_mcphealth();
+  init_memory();
+  init_otel();
+  init_outcomes();
+  init_policy();
+  init_pricing();
+  init_prompt();
+  init_provenance();
+  init_quota();
+  init_rules();
+  init_security();
+  init_stall();
+  init_tasks();
+  init_team();
+  init_teamsetup();
+  init_transitions();
+  init_types();
+  init_waiting();
+  init_workflows();
+  init_worktree();
+});
+
+// packages/hook/src/wait.ts
+async function waitForWake(sessionId, opts = {}) {
+  const maxMs = opts.maxMs ?? 55 * 60000;
+  const pollMs = opts.pollMs ?? 11 * 60000;
+  const started = Date.now();
+  let base = opts.baseUrl ?? resolveBaseUrl();
+  const fallback = `http://127.0.0.1:${DEFAULT_PORT}`;
+  while (Date.now() - started < maxMs) {
+    let body = null;
+    try {
+      const r = await authedFetch(`${base}/v1/wake`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ session_id: sessionId }),
+        signal: AbortSignal.timeout(pollMs)
+      });
+      if (r.ok)
+        body = await r.json();
+    } catch {
+      if (base !== fallback && !opts.baseUrl) {
+        base = fallback;
+        continue;
+      }
+      return { exit: 0, reason: "daemon unreachable" };
+    }
+    if (!body)
+      return { exit: 0, reason: "daemon refused" };
+    if (body.wake && body.text)
+      return { exit: 2, text: body.text };
+    if (body.reason && body.reason !== "timeout")
+      return { exit: 0, reason: body.reason };
+  }
+  return { exit: 0, reason: "gave up" };
+}
+var init_wait = __esm(() => {
+  init_src();
+});
+
+// packages/hook/src/statusline.ts
+async function fetchStatuslineState(payload, opts = {}) {
+  const timeout = opts.timeoutMs ?? Number(process.env.SWARM_HOOK_TIMEOUT_MS ?? 400);
+  const post = async (base) => {
+    const r = await authedFetch(`${base}/v1/statusline`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(timeout)
+    });
+    return r.ok ? await r.json() : null;
+  };
+  const base = opts.baseUrl ?? resolveBaseUrl();
+  const fallback = `http://127.0.0.1:${DEFAULT_PORT}`;
+  try {
+    const s = await post(base);
+    if (s)
+      return s;
+  } catch {}
+  if (base !== fallback && !opts.baseUrl) {
+    try {
+      return await post(fallback);
+    } catch {}
+  }
+  return null;
+}
+async function runStatusline(input, opts = {}) {
+  const payload = parseStatuslinePayload(input) ?? {};
+  const state = await fetchStatuslineState(payload, opts);
+  const color = opts.color ?? !process.env.NO_COLOR;
+  return renderStatusline(payload, state, { color });
+}
+var init_statusline = __esm(() => {
+  init_src();
+  init_src2();
+});
+
 // packages/hook/src/bin.ts
+init_src();
+init_src2();
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { dirname, join as join2 } from "path";
 var event = process.argv[2] ?? "Unknown";
 var input = await Bun.stdin.text();
-var timeout = Number(process.env.SWARM_HOOK_TIMEOUT_MS ?? 400);
+if (event === "wait") {
+  await Promise.resolve().then(() => init_wait());
+  let sid = "";
+  try {
+    sid = String(JSON.parse(input || "{}").session_id ?? "");
+  } catch {}
+  if (!sid)
+    process.exit(0);
+  const out = await waitForWake(sid);
+  if (out.exit === 2)
+    process.stderr.write(`${out.text}
+`);
+  process.exit(out.exit);
+}
+if (event === "statusline") {
+  await Promise.resolve().then(() => init_statusline());
+  process.stdout.write(`${await runStatusline(input)}
+`);
+  process.exit(0);
+}
+var fast = Number(process.env.SWARM_HOOK_TIMEOUT_MS ?? 400);
+async function repairArmed() {
+  try {
+    const cwd = String(JSON.parse(input || "{}").cwd ?? "");
+    if (!cwd)
+      return false;
+    const r = await authedFetch(`${resolveBaseUrl()}/v1/repair?cwd=${encodeURIComponent(cwd)}`, {
+      signal: AbortSignal.timeout(fast)
+    });
+    return r.ok && (await r.json()).block === true;
+  } catch {
+    return false;
+  }
+}
+var timeout = event === "Stop" ? await repairArmed() ? Number(process.env.SWARM_STOP_TIMEOUT_MS ?? 330000) : fast : event === "PermissionRequest" ? Number(process.env.SWARM_PERMISSION_TIMEOUT_MS ?? 130000) : fast;
 var post = async (base) => {
   const r = await authedFetch(`${base}/v1/hook/${event}`, {
     method: "POST",
@@ -400,7 +1368,7 @@ if (out === null && base !== fallback) {
     out = await post(fallback);
   } catch {}
 }
-if (out === null && event === "PreToolUse")
+if (out === null && (event === "PreToolUse" || event === "BeforeTool"))
   out = offline();
 process.stdout.write(`${out ?? "{}"}
 `);
@@ -413,6 +1381,18 @@ function offline() {
     if (!cache)
       return null;
     const raw = input ? JSON.parse(input) : {};
+    const agent = detectAgent(raw);
+    if (agent !== "claude-code") {
+      for (const r of toToolRequests(agent, raw)) {
+        const d = evaluateOffline(cache, { tool_name: r.tool, tool_input: r.input, session_id: r.sessionId, cwd: r.cwd }, gitToplevel);
+        if (d.action !== "allow")
+          return renderAgentDecision(agent, {
+            ...d,
+            reason: `(daemon unreachable, policy-locked rule) ${d.reason}`
+          });
+      }
+      return null;
+    }
     const d = evaluateOffline(cache, raw, gitToplevel);
     if (d.action === "allow")
       return null;