@ra3orblade/swarm 0.4.1 → 0.5.0

package/dist/swarmd.js

@@ -328,6 +328,7 @@ import { join as join2 } from "path";
 var DEFAULT_CONFIG = {
   daemon: { port: 7777 },
   tasks: { source: null },
+  gates: { required: [] },
   rules: {
     shared_tree: "ask",
     destructive_git: "ask",
@@ -459,6 +460,49 @@ function normalizeGitlab(raw, repo) {
     };
   });
 }
+// packages/core/src/gates.ts
+var NAME_RE = /^[a-z0-9][a-z0-9_.-]{0,39}$/i;
+function validateGateRun(input) {
+  if (!input.task?.trim())
+    return { ok: false, reason: "task is required" };
+  if (!NAME_RE.test(input.gate ?? ""))
+    return { ok: false, reason: "gate must be a short name (letters, digits, _ . -)" };
+  if (input.verdict !== "pass" && input.verdict !== "fail")
+    return { ok: false, reason: 'verdict must be "pass" or "fail"' };
+  const rubric = input.rubric?.trim() ?? "";
+  if (rubric.length < 8)
+    return {
+      ok: false,
+      reason: 'rubric is required: say what was checked (e.g. "tests green, no TODOs, reviewed error paths"). A verdict without a rubric is rejected.'
+    };
+  return { ok: true };
+}
+function gateStatus(runs, declared = []) {
+  const byGate = new Map;
+  for (const r of runs) {
+    const list = byGate.get(r.gate) ?? [];
+    list.push(r);
+    byGate.set(r.gate, list);
+  }
+  const names = [...new Set([...declared, ...byGate.keys()])];
+  return names.map((gate) => {
+    const list = (byGate.get(gate) ?? []).sort((a, b) => a.createdAt === b.createdAt ? b.id - a.id : a.createdAt < b.createdAt ? 1 : -1);
+    const latest = list[0] ?? null;
+    return {
+      gate,
+      verdict: latest?.verdict ?? null,
+      latest,
+      runs: list.length,
+      fails: list.filter((r) => r.verdict === "fail").length
+    };
+  });
+}
+function gatesSatisfied(runs, declared) {
+  if (!declared.length)
+    return true;
+  const st = gateStatus(runs, declared);
+  return declared.every((g) => st.find((s) => s.gate === g)?.verdict === "pass");
+}
 // packages/core/src/ledger.ts
 var DEFAULT_LEASE_MINUTES = 45;
 function isExpired(claim, now) {
@@ -495,12 +539,43 @@ function reapAction(claim, now, worktreeExists, work) {
     return "keep-orphaned";
   return "reap";
 }
+function shouldAutoRenew(claim, now, leaseMinutes = DEFAULT_LEASE_MINUTES) {
+  if (claim.state !== "held")
+    return false;
+  const left = new Date(claim.expiresAt).getTime() - now;
+  if (left <= 0)
+    return false;
+  return left < leaseMinutes * 60000 / 2;
+}
 function claimRefusalMessage(d, task) {
   return `${task} is held by ${d.heldBy} until ${d.until}. ` + "Pick another task or coordinate with the holder \u2014 claims fail closed on purpose.";
 }
 function releaseRefusalMessage(d, worktree) {
   return d.reason === "dirty" ? `${worktree} has uncommitted changes. Commit and push them, or re-run with --force to discard.` : `${worktree} has unpushed commits. Push them, or re-run with --force to discard the worktree.`;
 }
+function validateHandoff(h) {
+  if (!h.task?.trim())
+    return { ok: false, reason: "task is required" };
+  if (!h.done?.trim() || !h.remaining?.trim())
+    return {
+      ok: false,
+      reason: "a handoff needs both `done` (what was finished) and `remaining` (what is left, in order)"
+    };
+  return { ok: true };
+}
+function formatHandoff(h) {
+  const lines = [
+    `[swarm] handoff on ${h.task}${h.by ? ` from ${h.by}` : ""} (${h.createdAt.slice(0, 16).replace("T", " ")}):`,
+    `  done: ${h.done.trim()}`,
+    `  remaining: ${h.remaining.trim()}`
+  ];
+  if (h.files.length)
+    lines.push(`  files: ${h.files.join(", ")}`);
+  if (h.verify)
+    lines.push(`  verify: ${h.verify.trim()}`);
+  return lines.join(`
+`);
+}
 // packages/core/src/pricing.ts
 var PRICES = {
   "claude-opus-4": { input: 15, output: 75, cacheWrite: 18.75, cacheWrite1h: 30, cacheRead: 1.5 },
@@ -873,7 +948,7 @@ function taskBoard(tasks, activeClaims) {
 // packages/daemon/src/app.ts
 import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync4, realpathSync as realpathSync3 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname2, join as join6 } from "path";
+import { dirname as dirname2, join as join7 } from "path";
 import { fileURLToPath } from "url";
 
 // node_modules/.bun/hono@4.13.3/node_modules/hono/dist/compose.js
@@ -2507,7 +2582,7 @@ var EXTRA_BIN_DIRS = [
 function findBin(name) {
   if (!name)
     return null;
-  const onPath = Bun.which(name);
+  const onPath = Bun.which(name, { PATH: process.env.PATH ?? "" });
   if (onPath)
     return onPath;
   for (const d of EXTRA_BIN_DIRS) {
@@ -2600,13 +2675,326 @@ class ForgeService {
   }
 }
 
+// packages/daemon/src/runner.ts
+import { appendFileSync, mkdirSync as mkdirSync2, openSync } from "fs";
+import { join as join4 } from "path";
+var PERMISSION_MODES = [
+  "acceptEdits",
+  "auto",
+  "bypassPermissions",
+  "manual",
+  "dontAsk",
+  "plan"
+];
+
+class Runner {
+  store;
+  home;
+  live = new Map;
+  constructor(store, home) {
+    this.store = store;
+    this.home = home;
+  }
+  list(projectId) {
+    return [...this.live.values()].map((x) => x.run).filter((r) => !projectId || r.projectId === projectId);
+  }
+  get(idOrTask) {
+    for (const { run: run2 } of this.live.values())
+      if (run2.id === idOrTask || run2.sessionId === idOrTask || run2.task === idOrTask)
+        return run2;
+    return null;
+  }
+  async start(input) {
+    const bin = findBin("claude");
+    if (!bin)
+      return { ok: false, reason: "claude CLI not found \u2014 install Claude Code first" };
+    const project = this.store.project(input.projectId);
+    if (!project)
+      return { ok: false, reason: "unknown project" };
+    if (!input.prompt.trim())
+      return { ok: false, reason: "prompt is required" };
+    if (input.permissionMode && !PERMISSION_MODES.includes(input.permissionMode))
+      return { ok: false, reason: `permission mode must be one of ${PERMISSION_MODES.join(", ")}` };
+    if (this.get(input.task)?.projectId === input.projectId)
+      return {
+        ok: false,
+        reason: `a run on ${input.task} is already live \u2014 stop it or send it input`
+      };
+    const held = this.store.claims(input.projectId).find((c) => c.task === input.task && c.state === "held" && c.owner === input.owner);
+    let worktree = held?.worktree ?? "";
+    if (!worktree) {
+      const c = this.store.claim(input.projectId, input.task, input.owner);
+      if (!c.ok)
+        return { ok: false, reason: c.error };
+      worktree = c.worktree;
+    }
+    const sessionId = crypto.randomUUID();
+    const id = sessionId.slice(0, 8);
+    const logDir = join4(this.home, "logs", project.id);
+    mkdirSync2(logDir, { recursive: true });
+    const log = join4(logDir, `run-${input.task.replace(/[^a-zA-Z0-9_.-]+/g, "-")}-${id}.log`);
+    const logFd = openSync(log, "a");
+    const args = [
+      bin,
+      "-p",
+      "--output-format",
+      "stream-json",
+      "--input-format",
+      "stream-json",
+      "--verbose",
+      "--session-id",
+      sessionId,
+      "--permission-prompt-tool",
+      "stdio"
+    ];
+    if (input.model)
+      args.push("--model", input.model);
+    if (input.permissionMode)
+      args.push("--permission-mode", input.permissionMode);
+    if (input.allowedTools?.length)
+      args.push("--allowedTools", ...input.allowedTools);
+    if (input.maxTurns)
+      args.push("--max-turns", String(input.maxTurns));
+    this.store.preregisterSpawnedSession(sessionId, project.id, worktree, input.task);
+    const proc = Bun.spawn(args, {
+      cwd: worktree,
+      env: { ...process.env, SWARM_RUN_ID: id, SWARM_OWNER: input.owner },
+      stdin: "pipe",
+      stdout: "pipe",
+      stderr: logFd
+    });
+    const run2 = {
+      id,
+      sessionId,
+      projectId: project.id,
+      task: input.task,
+      worktree,
+      pid: proc.pid,
+      owner: input.owner,
+      model: input.model ?? null,
+      permissionMode: input.permissionMode ?? null,
+      prompt: input.prompt,
+      log,
+      startedAt: new Date().toISOString(),
+      endedAt: null,
+      exitCode: null,
+      result: null,
+      pending: []
+    };
+    this.live.set(id, { run: run2, proc });
+    this.store.registerProcess({
+      pid: proc.pid,
+      projectId: project.id,
+      sessionId,
+      kind: "proc",
+      name: `run:${input.task}`,
+      cwd: worktree,
+      cmd: `claude -p (run ${id})`,
+      owner: input.owner,
+      log
+    });
+    this.store.append({
+      ts: run2.startedAt,
+      type: "session.started",
+      projectId: project.id,
+      sessionId,
+      payload: { kind: "spawned", task: input.task, runId: id, summary: `swarm run ${input.task}` }
+    });
+    this.pump(id, proc);
+    this.send(id, input.prompt);
+    return { ok: true, run: run2 };
+  }
+  async pump(id, proc) {
+    const entry = this.live.get(id);
+    if (!entry || !proc.stdout || typeof proc.stdout === "number")
+      return;
+    const reader = proc.stdout.getReader();
+    const dec = new TextDecoder;
+    let buf = "";
+    try {
+      while (true) {
+        const { value, done } = await reader.read();
+        if (done)
+          break;
+        buf += dec.decode(value, { stream: true });
+        let nl = buf.indexOf(`
+`);
+        while (nl >= 0) {
+          const line = buf.slice(0, nl);
+          buf = buf.slice(nl + 1);
+          try {
+            appendFileSync(entry.run.log, `${line}
+`);
+          } catch {}
+          this.onLine(entry.run, line);
+          nl = buf.indexOf(`
+`);
+        }
+      }
+    } catch (e) {
+      console.error("swarm run: stdout pump failed:", e.message);
+    }
+    const code = await proc.exited;
+    entry.run.endedAt = new Date().toISOString();
+    entry.run.exitCode = code;
+    this.store.append({
+      ts: entry.run.endedAt,
+      type: "run.result",
+      projectId: entry.run.projectId,
+      sessionId: entry.run.sessionId,
+      payload: {
+        runId: id,
+        task: entry.run.task,
+        exitCode: code,
+        final: true,
+        ...entry.run.result ?? {},
+        summary: `run ${entry.run.task} exited ${code}`
+      }
+    });
+    this.store.endSpawnedSession(entry.run.sessionId);
+    this.live.delete(id);
+  }
+  onLine(run2, line) {
+    if (!line.startsWith("{"))
+      return;
+    let j;
+    try {
+      j = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (j.type === "control_request" && j.request?.subtype === "can_use_tool") {
+      this.onPermissionRequest(run2, j.request_id, j.request.tool_name ?? "", j.request.input ?? {});
+      return;
+    }
+    if (j.type !== "result")
+      return;
+    run2.result = {
+      costUsd: Number(j.total_cost_usd ?? 0),
+      turns: Number(j.num_turns ?? 0),
+      isError: Boolean(j.is_error),
+      at: new Date().toISOString()
+    };
+    this.store.append({
+      ts: run2.result.at,
+      type: "run.result",
+      projectId: run2.projectId,
+      sessionId: run2.sessionId,
+      payload: {
+        runId: run2.id,
+        task: run2.task,
+        ...run2.result,
+        summary: `turn done \xB7 $${run2.result.costUsd.toFixed(2)} \xB7 ${run2.result.turns} turns${run2.result.isError ? " \xB7 error" : ""}`
+      }
+    });
+  }
+  onPermissionRequest(run2, requestId, tool, input) {
+    const { decision, display } = this.store.evaluateTool(tool, input, run2.sessionId, run2.worktree, true);
+    if (decision.action === "deny") {
+      this.answerPermission(run2.id, requestId, false, `[swarm] ${decision.reason}`);
+      return;
+    }
+    if (decision.action === "allow") {
+      this.answerPermission(run2.id, requestId, true);
+      return;
+    }
+    run2.pending.push({
+      requestId,
+      tool,
+      input,
+      display,
+      reason: decision.reason,
+      askedAt: new Date().toISOString()
+    });
+    this.store.append({
+      ts: new Date().toISOString(),
+      type: "permission.requested",
+      projectId: run2.projectId,
+      sessionId: run2.sessionId,
+      payload: {
+        runId: run2.id,
+        requestId,
+        tool,
+        display: display.slice(0, 300),
+        reason: decision.reason,
+        summary: `permission: ${tool} \u2014 waiting`
+      }
+    });
+    this.store.touch();
+  }
+  answerPermission(runId, requestId, allow, message) {
+    const entry = this.live.get(runId);
+    if (!entry)
+      return { ok: false, reason: "no live run" };
+    const stdin = entry.proc.stdin;
+    if (!stdin || typeof stdin === "number")
+      return { ok: false, reason: "stdin not available" };
+    const pend = entry.run.pending.find((p) => p.requestId === requestId);
+    const response = allow ? { behavior: "allow", updatedInput: pend?.input ?? {} } : { behavior: "deny", message: message ?? "Denied from the Swarm dashboard" };
+    stdin.write(`${JSON.stringify({ type: "control_response", response: { subtype: "success", request_id: requestId, response } })}
+`);
+    stdin.flush();
+    entry.run.pending = entry.run.pending.filter((p) => p.requestId !== requestId);
+    if (pend)
+      this.store.append({
+        ts: new Date().toISOString(),
+        type: "permission.resolved",
+        projectId: entry.run.projectId,
+        sessionId: entry.run.sessionId,
+        payload: {
+          runId,
+          requestId,
+          tool: pend.tool,
+          allow,
+          summary: `permission: ${pend.tool} \u2014 ${allow ? "allowed" : "denied"}`
+        }
+      });
+    this.store.touch();
+    return { ok: true };
+  }
+  send(id, text) {
+    const entry = this.live.get(id) ?? [...this.live.values()].find((x) => x.run.task === id || x.run.sessionId === id);
+    if (!entry)
+      return { ok: false, reason: "no live run" };
+    const stdin = entry.proc.stdin;
+    if (!stdin || typeof stdin === "number")
+      return { ok: false, reason: "stdin not available" };
+    stdin.write(`${JSON.stringify({ type: "user", message: { role: "user", content: text } })}
+`);
+    stdin.flush();
+    this.store.append({
+      ts: new Date().toISOString(),
+      type: "prompt.submitted",
+      projectId: entry.run.projectId,
+      sessionId: entry.run.sessionId,
+      payload: { prompt: text.slice(0, 400), via: "swarm run send", summary: text.slice(0, 120) }
+    });
+    return { ok: true };
+  }
+  async stop(id) {
+    const run2 = this.get(id);
+    if (!run2)
+      return { ok: false, reason: "no live run" };
+    const entry = this.live.get(run2.id);
+    try {
+      const stdin = entry?.proc.stdin;
+      if (stdin && typeof stdin !== "number")
+        stdin.end();
+    } catch {}
+    return this.store.stopProcess(run2.pid, run2.projectId, 5000);
+  }
+  async stopAll() {
+    await Promise.all([...this.live.keys()].map((id) => this.stop(id)));
+  }
+}
+
 // packages/daemon/src/store.ts
 import { Database } from "bun:sqlite";
 import {
   closeSync,
   existsSync as existsSync4,
-  mkdirSync as mkdirSync2,
-  openSync,
+  mkdirSync as mkdirSync3,
+  openSync as openSync2,
   readdirSync,
   readFileSync as readFileSync3,
   readSync,
@@ -2616,11 +3004,11 @@ import {
   writeFileSync as writeFileSync2
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename, dirname, join as join5 } from "path";
+import { basename, dirname, join as join6 } from "path";
 
 // packages/daemon/src/git.ts
 import { realpathSync } from "fs";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 function git(cwd, args) {
   try {
     const r = Bun.spawnSync(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore" });
@@ -2634,7 +3022,7 @@ function gitCommonDir(cwd) {
   if (!out)
     return null;
   try {
-    return realpathSync(out.startsWith("/") ? out : join4(cwd, out));
+    return realpathSync(out.startsWith("/") ? out : join5(cwd, out));
   } catch {
     return null;
   }
@@ -2789,6 +3177,16 @@ CREATE TABLE IF NOT EXISTS processes (
   cwd TEXT, cmd TEXT, owner TEXT, log TEXT, started_at TEXT, ended_at TEXT
 );
 CREATE INDEX IF NOT EXISTS processes_live ON processes(ended_at, project_id);
+CREATE TABLE IF NOT EXISTS gates (
+  id INTEGER PRIMARY KEY AUTOINCREMENT, project_id TEXT, task TEXT, gate TEXT, verdict TEXT,
+  rubric TEXT, evidence TEXT, session_id TEXT, created_at TEXT
+);
+CREATE INDEX IF NOT EXISTS gates_task ON gates(project_id, task, created_at);
+CREATE TABLE IF NOT EXISTS handoffs (
+  id INTEGER PRIMARY KEY AUTOINCREMENT, project_id TEXT, task TEXT, done TEXT, remaining TEXT,
+  files TEXT, verify TEXT, by TEXT, session_id TEXT, created_at TEXT
+);
+CREATE INDEX IF NOT EXISTS handoffs_task ON handoffs(project_id, task, created_at);
 CREATE TABLE IF NOT EXISTS claims (
   project_id TEXT, task TEXT, owner TEXT, worktree TEXT, branch TEXT,
   acquired_at TEXT, expires_at TEXT, released_at TEXT, state TEXT,
@@ -2809,15 +3207,15 @@ class Store {
   gen = 0;
   memo = new Map;
   constructor(home = swarmHome()) {
-    mkdirSync2(home, { recursive: true });
+    mkdirSync3(home, { recursive: true });
     this.home = home;
-    this.db = new Database(join5(home, "swarm.db"));
+    this.db = new Database(join6(home, "swarm.db"));
     this.loadPricing();
     this.db.exec("PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL; PRAGMA mmap_size=268435456; PRAGMA cache_size=-32000;");
     this.db.exec(SCHEMA);
     this.ensureColumn("sessions", "agent", "TEXT DEFAULT 'claude-code'");
     this.ensureColumn("projects", "sort_order", "INTEGER");
-    this.migrateProjectsJson(join5(home, "projects.json"));
+    this.migrateProjectsJson(join6(home, "projects.json"));
     this.reconcileMovedProjects();
     this.slimExistingEvents();
     this.retypeNotificationIncidents();
@@ -2919,17 +3317,186 @@ class Store {
     return v;
   }
   rulesCache = new Map;
+  preregisterSpawnedSession(id, projectId, cwd, task) {
+    const now = new Date().toISOString();
+    this.db.query(`INSERT INTO sessions (id, project_id, kind, cwd, started_at, last_seen_at, last, last_type, state, title)
+         VALUES (?, ?, 'spawned', ?, ?, ?, ?, 'session.started', 'active', ?)
+         ON CONFLICT(id) DO UPDATE SET kind = 'spawned', project_id = excluded.project_id, cwd = excluded.cwd`).run(id, projectId, cwd, now, now, `swarm run ${task}`, `run: ${task}`);
+    this.touch();
+  }
+  endSpawnedSession(id) {
+    const now = new Date().toISOString();
+    this.db.query("UPDATE sessions SET state = 'ended', ended_at = COALESCE(ended_at, ?), last_seen_at = ? WHERE id = ?").run(now, now, id);
+    this.touch();
+  }
+  recordHandoff(projectId, h) {
+    if (!this.project(projectId))
+      return { ok: false, reason: "unknown project" };
+    const v = validateHandoff(h);
+    if (!v.ok)
+      return v;
+    const handoff = {
+      task: h.task.trim(),
+      done: h.done.trim(),
+      remaining: h.remaining.trim(),
+      files: (h.files ?? []).map((f) => f.trim()).filter(Boolean).slice(0, 50),
+      verify: h.verify?.trim() || null,
+      by: h.by?.trim() || null,
+      createdAt: new Date().toISOString()
+    };
+    const sessionId = this.knownSession(h.sessionId);
+    this.db.query(`INSERT INTO handoffs (project_id, task, done, remaining, files, verify, by, session_id, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(projectId, handoff.task, handoff.done, handoff.remaining, JSON.stringify(handoff.files), handoff.verify, handoff.by, sessionId, handoff.createdAt);
+    this.append({
+      ts: handoff.createdAt,
+      type: "handoff.recorded",
+      projectId,
+      sessionId,
+      payload: { task: handoff.task, by: handoff.by, summary: `handoff on ${handoff.task}` }
+    });
+    this.touch();
+    return { ok: true, handoff };
+  }
+  latestHandoff(projectId, task) {
+    const r = this.db.query("SELECT * FROM handoffs WHERE project_id = ? AND task = ? ORDER BY id DESC LIMIT 1").get(projectId, task);
+    if (!r)
+      return null;
+    return {
+      task: r.task,
+      done: r.done,
+      remaining: r.remaining,
+      files: JSON.parse(r.files || "[]"),
+      verify: r.verify ?? null,
+      by: r.by ?? null,
+      createdAt: r.created_at
+    };
+  }
+  handoffs(projectId, limit = 50) {
+    return this.db.query("SELECT * FROM handoffs WHERE project_id = ? ORDER BY id DESC LIMIT ?").all(projectId, limit).map((r) => ({
+      task: r.task,
+      done: r.done,
+      remaining: r.remaining,
+      files: JSON.parse(r.files || "[]"),
+      verify: r.verify ?? null,
+      by: r.by ?? null,
+      createdAt: r.created_at,
+      sessionId: r.session_id ?? null
+    }));
+  }
+  sessionContext(cwd) {
+    if (!cwd || !existsSync4(cwd))
+      return null;
+    const toplevel = this.toplevel(cwd);
+    const project = this.resolveProject(cwd);
+    const lines = [];
+    const held = this.heldClaimsWithWorktree().find((c) => isInside(cwd, c.worktree));
+    if (held) {
+      const left = Math.max(0, Math.round((new Date(held.expiresAt).getTime() - Date.now()) / 60000));
+      lines.push(`[swarm] you hold ${held.task} (${left}m left, renews while you work) in ${held.worktree}`);
+      const h = this.latestHandoff(held.projectId, held.task);
+      if (h)
+        lines.push(formatHandoff(h));
+      const required = this.requiredGates(held.projectId);
+      if (required.length) {
+        const st = gateStatus(this.gateRuns(held.projectId, held.task), required);
+        lines.push(`[swarm] gates on ${held.task}: ${st.map((g) => `${g.gate} ${g.verdict ?? "not run"}`).join(", ")} \u2014 record with swarm_gate_record (rubric required)`);
+      }
+    } else if (project) {
+      const active = this.claimRows(project.id).filter((c) => isActive(c, Date.now()));
+      if (active.length)
+        lines.push(`[swarm] ${project.name}: held by others \u2014 ${active.map((c) => `${c.task} (${c.owner})`).join(", ")}. Claim a task (swarm_claim) to get your own worktree.`);
+    }
+    const res = this.resources(project?.id).filter((r) => !r.released);
+    if (res.length)
+      lines.push(`[swarm] resources held: ${res.map((r) => `${r.name}${r.port ? `:${r.port}` : ""} (${r.owner})`).join(", ")} \u2014 their ports are protected; don't kill them`);
+    const modes = this.rulesFor(toplevel);
+    const on = [
+      "shared_tree",
+      "destructive_git",
+      "pattern_kill",
+      "protected_ports",
+      "no_foreign_worktree",
+      "claim_required_to_write"
+    ].filter((k) => modes[k] !== "off").map((k) => `${k}=${modes[k]}`);
+    if (on.length && (lines.length || on.some((x) => x.endsWith("=deny"))))
+      lines.push(`[swarm] rules: ${on.join(" ")}`);
+    return lines.length ? lines.join(`
+`) : null;
+  }
+  rowToGate(r) {
+    return {
+      id: r.id,
+      projectId: r.project_id,
+      task: r.task,
+      gate: r.gate,
+      verdict: r.verdict,
+      rubric: r.rubric,
+      evidence: r.evidence ?? null,
+      sessionId: r.session_id ?? null,
+      createdAt: r.created_at
+    };
+  }
+  gateRuns(projectId, task, limit = 200) {
+    const rows = task ? this.db.query("SELECT * FROM gates WHERE project_id = ? AND task = ? ORDER BY created_at DESC, id DESC LIMIT ?").all(projectId, task, limit) : this.db.query("SELECT * FROM gates WHERE project_id = ? ORDER BY created_at DESC, id DESC LIMIT ?").all(projectId, limit);
+    return rows.map((r) => this.rowToGate(r));
+  }
+  gateStatusFor(runs, required) {
+    return gateStatus(runs, required);
+  }
+  requiredGates(projectId) {
+    const p = this.project(projectId);
+    return p ? loadConfig({ repoRoot: p.root, home: this.home }).gates.required : [];
+  }
+  recordGate(projectId, input) {
+    if (!this.project(projectId))
+      return { ok: false, reason: "unknown project" };
+    const v = validateGateRun(input);
+    if (!v.ok)
+      return v;
+    const createdAt = new Date().toISOString();
+    const sessionId = this.knownSession(input.sessionId);
+    const r = this.db.query(`INSERT INTO gates (project_id, task, gate, verdict, rubric, evidence, session_id, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(projectId, input.task.trim(), input.gate, input.verdict, input.rubric.trim(), input.evidence?.trim() || null, sessionId, createdAt);
+    const run2 = this.rowToGate(this.db.query("SELECT * FROM gates WHERE id = ?").get(Number(r.lastInsertRowid)));
+    this.append({
+      ts: createdAt,
+      type: "gate.recorded",
+      projectId,
+      sessionId,
+      payload: {
+        task: run2.task,
+        gate: run2.gate,
+        verdict: run2.verdict,
+        summary: `gate ${run2.gate} ${run2.verdict} on ${run2.task}`
+      }
+    });
+    if (run2.verdict === "fail")
+      this.append({
+        ts: createdAt,
+        type: "incident.opened",
+        projectId,
+        sessionId,
+        payload: {
+          rule: "gate_failed",
+          action: "failed",
+          command: `${run2.task} \xB7 ${run2.gate}`,
+          reason: `${run2.rubric}${run2.evidence ? ` \u2014 ${run2.evidence.slice(0, 200)}` : ""}`
+        }
+      });
+    this.touch();
+    return { ok: true, run: run2 };
+  }
   taskCache = new Map;
   tasks(projectId) {
     const p = this.project(projectId);
     if (!p)
       return null;
-    const source = loadConfig({ repoRoot: p.root }).tasks.source;
+    const source = loadConfig({ repoRoot: p.root, home: this.home }).tasks.source;
     if (!source)
       return null;
-    const path = join5(p.root, source);
+    const path = join6(p.root, source);
     if (!existsSync4(path))
-      return { source, tasks: [] };
+      return { source, required: this.requiredGates(projectId), tasks: [] };
     const mtime = statSync(path).mtimeMs;
     let hit = this.taskCache.get(projectId);
     if (!hit || hit.path !== path || hit.mtime !== mtime) {
@@ -2938,17 +3505,80 @@ class Store {
     }
     const now = Date.now();
     const active = this.claimRows(projectId).filter((c) => isActive(c, now));
-    return { source, tasks: taskBoard(hit.tasks, active) };
+    const required = this.requiredGates(projectId);
+    const runs = this.gateRuns(projectId, undefined, 2000);
+    const byTask = new Map;
+    for (const r of runs)
+      byTask.set(r.task, [...byTask.get(r.task) ?? [], r]);
+    const board = taskBoard(hit.tasks, active).map((t) => {
+      const tr = byTask.get(t.id) ?? [];
+      return {
+        ...t,
+        gates: gateStatus(tr, required).map((g) => ({
+          gate: g.gate,
+          verdict: g.verdict,
+          fails: g.fails,
+          runs: g.runs
+        })),
+        gated: gatesSatisfied(tr, required)
+      };
+    });
+    return { source, required, tasks: board };
   }
   rulesFor(repoRoot) {
     const key = repoRoot ?? "";
     const hit = this.rulesCache.get(key);
     if (hit && Date.now() - hit.at < 30000)
       return hit.rules;
-    const rules2 = loadConfig({ repoRoot }).rules;
+    const rules2 = loadConfig({ repoRoot, home: this.home }).rules;
     this.rulesCache.set(key, { at: Date.now(), rules: rules2 });
     return rules2;
   }
+  evaluateTool(tool, input, sessionId, cwd, recordIncident = true) {
+    const isWrite = WRITE_TOOLS.has(tool) && typeof input.file_path === "string";
+    const cmd = tool === "Bash" ? input.command : undefined;
+    const current = { id: sessionId, cwd, toplevel: this.toplevel(cwd) };
+    const modes = this.rulesFor(current.toplevel);
+    if (isWrite && (modes.no_foreign_worktree !== "off" || modes.claim_required_to_write !== "off")) {
+      const target = absolutePath(input.file_path, cwd);
+      const w = guardWrite(target, current, this.heldWorktrees(), modes, "file");
+      if (w.action !== "allow") {
+        if (recordIncident)
+          this.openIncident(w, cwd, sessionId, `${tool} ${target}`);
+        return { decision: w, display: `${tool} ${target}` };
+      }
+    }
+    if (cmd) {
+      if (modes.no_foreign_worktree !== "off" || modes.claim_required_to_write !== "off") {
+        const w = guardWrite(cwd, current, this.heldWorktrees(), modes, "bash");
+        if (w.action !== "allow") {
+          if (recordIncident)
+            this.openIncident(w, cwd, sessionId, cmd);
+          return { decision: w, display: cmd };
+        }
+      }
+      const d = guardBash(cmd, current, this.liveSessions(), Date.now(), {
+        ...modes,
+        protected: { ports: [...new Set([...modes.protected.ports, ...this.heldPorts()])] }
+      });
+      if (d.action !== "allow" && recordIncident)
+        this.openIncident(d, cwd, sessionId, cmd);
+      return { decision: d, display: cmd };
+    }
+    return {
+      decision: { action: "allow" },
+      display: isWrite ? `${tool} ${input.file_path}` : tool
+    };
+  }
+  liveSessions() {
+    const rows = this.db.query("SELECT id, cwd, last_seen_at, state FROM sessions WHERE state != 'ended' AND last_seen_at > ?").all(new Date(Date.now() - LIVE_WINDOW_MS - 1e4).toISOString());
+    return rows.map((r) => ({
+      id: r.id,
+      toplevel: this.toplevel(r.cwd),
+      lastSeenAt: r.last_seen_at,
+      state: r.state
+    }));
+  }
   guardHook(raw2) {
     const tool = typeof raw2.tool_name === "string" ? raw2.tool_name : "";
     const input = raw2.tool_input ?? {};
@@ -3005,7 +3635,7 @@ class Store {
   loadPricing() {
     this.prices = { ...PRICES };
     for (const f of ["pricing.litellm.json", "pricing.json"]) {
-      const p = join5(this.home, f);
+      const p = join6(this.home, f);
       if (!existsSync4(p))
         continue;
       try {
@@ -3021,7 +3651,7 @@ class Store {
       throw new Error(`pricing fetch ${r.status}`);
     const j = await r.json();
     const slim = Object.fromEntries(Object.entries(j).filter(([k, v]) => typeof v.input_cost_per_token === "number" && !k.includes("/")));
-    writeFileSync2(join5(this.home, "pricing.litellm.json"), JSON.stringify(slim, null, 1));
+    writeFileSync2(join6(this.home, "pricing.litellm.json"), JSON.stringify(slim, null, 1));
     this.loadPricing();
     this.reprice();
   }
@@ -3160,6 +3790,8 @@ class Store {
     return n;
   }
   ingestHook(event, raw2) {
+    if (typeof raw2.cwd === "string")
+      this.autoRenewFor(typeof raw2.session_id === "string" ? raw2.session_id : null, raw2.cwd);
     const cwd = typeof raw2.cwd === "string" ? raw2.cwd : process.cwd();
     const project = existsSync4(cwd) ? this.resolveProject(cwd) : null;
     const e = this.append(normalizeHook(event, raw2, project?.id ?? "p_unknown"));
@@ -3173,8 +3805,24 @@ class Store {
     }
     return e;
   }
+  static LEDGER_EVENTS = new Set([
+    "process.started",
+    "process.exited",
+    "resource.acquired",
+    "resource.released",
+    "resource.reaped",
+    "claim.acquired",
+    "claim.renewed",
+    "claim.released",
+    "claim.orphaned",
+    "gate.recorded",
+    "handoff.recorded",
+    "incident.opened",
+    "incident.acked",
+    "run.result"
+  ]);
   projectSession(e) {
-    if (!e.sessionId)
+    if (!e.sessionId || Store.LEDGER_EVENTS.has(e.type))
       return;
     const p = e.payload;
     const row = this.db.query("SELECT id, tool_counts FROM sessions WHERE id = ?").get(e.sessionId);
@@ -3198,7 +3846,7 @@ class Store {
       const size = statSync(path).size;
       if (size <= offset)
         return null;
-      const fd = openSync(path, "r");
+      const fd = openSync2(path, "r");
       const buf = Buffer.alloc(size - offset);
       readSync(fd, buf, 0, buf.length, offset);
       closeSync(fd);
@@ -3239,6 +3887,10 @@ class Store {
     const lastText = [...d.turns].reverse().find((t) => t.text && !t.sidechain)?.text ?? null;
     const lastModel = [...d.turns].reverse().find((t) => !t.sidechain)?.model ?? null;
     this.db.query("UPDATE sessions SET title = COALESCE(?, title), model = COALESCE(?, model), version = COALESCE(?, version), last_text = COALESCE(?, last_text), branch = COALESCE(branch, ?), last_seen_at = MAX(COALESCE(last_seen_at, ''), ?) WHERE id = ?").run(d.title, agentId ? null : lastModel, d.version, agentId ? null : lastText, d.branch, new Date().toISOString(), sessionId);
+    if (d.turns.length) {
+      const cwdRow = this.db.query("SELECT cwd FROM sessions WHERE id = ?").get(sessionId);
+      this.autoRenewFor(sessionId, cwdRow?.cwd);
+    }
     this.db.query("INSERT INTO tails (path, session_id, agent_id, offset) VALUES (?, ?, ?, ?) ON CONFLICT(path) DO UPDATE SET offset = excluded.offset").run(path, sessionId, agentId, r.next);
     return d.turns.length;
   }
@@ -3247,9 +3899,9 @@ class Store {
     if (!s?.transcript_path || !existsSync4(s.transcript_path))
       return 0;
     let n = this.tailFile(s.transcript_path, sessionId, null);
-    const subDir = join5(dirname(s.transcript_path), basename(s.transcript_path, ".jsonl"), "subagents");
+    const subDir = join6(dirname(s.transcript_path), basename(s.transcript_path, ".jsonl"), "subagents");
     for (const f of this.subagentFiles(subDir)) {
-      n += this.tailFile(join5(subDir, f), sessionId, f.replace(/^agent-|\.jsonl$/g, ""));
+      n += this.tailFile(join6(subDir, f), sessionId, f.replace(/^agent-|\.jsonl$/g, ""));
     }
     return n;
   }
@@ -3281,7 +3933,7 @@ class Store {
     return n;
   }
   codexRoot() {
-    return process.env.SWARM_CODEX_DIR ?? join5(homedir3(), ".codex", "sessions");
+    return process.env.SWARM_CODEX_DIR ?? join6(homedir3(), ".codex", "sessions");
   }
   codexRolloutFiles(sinceMs) {
     const root = this.codexRoot();
@@ -3296,18 +3948,18 @@ class Store {
     for (const y of ls(root)) {
       if (!/^\d{4}$/.test(y))
         continue;
-      for (const m of ls(join5(root, y))) {
+      for (const m of ls(join6(root, y))) {
         if (!/^\d\d$/.test(m))
           continue;
-        for (const day of ls(join5(root, y, m))) {
+        for (const day of ls(join6(root, y, m))) {
           if (!/^\d\d$/.test(day))
             continue;
           if (Date.parse(`${y}-${m}-${day}T23:59:59Z`) < sinceMs)
             continue;
-          const dir = join5(root, y, m, day);
+          const dir = join6(root, y, m, day);
           for (const f of ls(dir)) {
             if (f.startsWith("rollout-") && f.endsWith(".jsonl"))
-              out.push(join5(dir, f));
+              out.push(join6(dir, f));
           }
         }
       }
@@ -3324,7 +3976,7 @@ class Store {
     return n;
   }
   grokRoot() {
-    return process.env.SWARM_GROK_DIR ?? join5(homedir3(), ".grok", "sessions");
+    return process.env.SWARM_GROK_DIR ?? join6(homedir3(), ".grok", "sessions");
   }
   grokSummary = new Map;
   tailGrok(windowMs = 3 * 24 * 60 * 60000) {
@@ -3349,9 +4001,9 @@ class Store {
       } catch {
         cwd = enc;
       }
-      const cwdDir = join5(root, enc);
+      const cwdDir = join6(root, enc);
       for (const sid of ls(cwdDir)) {
-        const path = join5(cwdDir, sid, "updates.jsonl");
+        const path = join6(cwdDir, sid, "updates.jsonl");
         if (!existsSync4(path))
           continue;
         try {
@@ -3360,7 +4012,7 @@ class Store {
         } catch {
           continue;
         }
-        const sumPath = join5(cwdDir, sid, "summary.json");
+        const sumPath = join6(cwdDir, sid, "summary.json");
         let title;
         let fresh = false;
         try {
@@ -3447,7 +4099,7 @@ class Store {
   worktreePath(projectId, task) {
     const slug = (x) => x.replace(/[^a-zA-Z0-9._-]+/g, "-").toLowerCase();
     const p = this.project(projectId);
-    return join5(this.home, "worktrees", slug(p?.name ?? projectId), slug(task));
+    return join6(this.home, "worktrees", slug(p?.name ?? projectId), slug(task));
   }
   claim(projectId, task, owner, baseRef = "HEAD") {
     const p = this.project(projectId);
@@ -3461,7 +4113,7 @@ class Store {
     const worktree = this.worktreePath(projectId, task);
     if (existsSync4(worktree))
       return { ok: false, error: `${worktree} already exists; release ${task} first` };
-    mkdirSync2(dirname(worktree), { recursive: true });
+    mkdirSync3(dirname(worktree), { recursive: true });
     const created = worktreeAdd(p.root, worktree, branch, baseRef);
     if (!created)
       return { ok: false, error: `git worktree add failed for ${task}` };
@@ -3481,6 +4133,82 @@ class Store {
     });
     return { ok: true, task, owner, worktree: created, branch, expiresAt };
   }
+  autoRenewAt = new Map;
+  autoRenewFor(sessionId, cwd) {
+    if (!cwd)
+      return;
+    const key = sessionId ?? cwd;
+    const last = this.autoRenewAt.get(key) ?? 0;
+    const now = Date.now();
+    if (now - last < 60000)
+      return;
+    this.autoRenewAt.set(key, now);
+    for (const c of this.heldClaimsWithWorktree()) {
+      if (!isInside(cwd, c.worktree))
+        continue;
+      if (!shouldAutoRenew({ state: "held", expiresAt: c.expiresAt }, now))
+        continue;
+      const expiresAt = nextExpiry(now);
+      this.db.query("UPDATE claims SET expires_at = ? WHERE project_id = ? AND task = ? AND state = 'held'").run(expiresAt, c.projectId, c.task);
+      this.append({
+        ts: new Date(now).toISOString(),
+        type: "claim.renewed",
+        projectId: c.projectId,
+        sessionId: this.knownSession(sessionId),
+        payload: { task: c.task, expiresAt, auto: true, summary: `auto-renew ${c.task}` }
+      });
+    }
+  }
+  heldClaimsWithWorktree() {
+    return this.db.query("SELECT project_id, task, worktree, expires_at FROM claims WHERE state = 'held' AND worktree != ''").all().map((r) => ({
+      projectId: r.project_id,
+      task: r.task,
+      worktree: r.worktree,
+      expiresAt: r.expires_at
+    }));
+  }
+  sweepOrphans() {
+    const now = Date.now();
+    let n = 0;
+    for (const p of this.projects()) {
+      for (const c of this.claimRows(p.id)) {
+        if (c.state !== "held" || isActive(c, now))
+          continue;
+        const exists = c.worktree ? existsSync4(c.worktree) : false;
+        const work = exists ? heldWork(c.worktree) : null;
+        if (reapAction(c, now, exists, work) !== "keep-orphaned")
+          continue;
+        this.db.query("UPDATE claims SET state = 'orphaned' WHERE project_id = ? AND task = ?").run(p.id, c.task);
+        const ts = new Date(now).toISOString();
+        this.append({
+          ts,
+          type: "claim.orphaned",
+          projectId: p.id,
+          sessionId: null,
+          payload: {
+            task: c.task,
+            worktree: c.worktree,
+            summary: `orphaned ${c.task} (holds work)`
+          }
+        });
+        this.append({
+          ts,
+          type: "incident.opened",
+          projectId: p.id,
+          sessionId: null,
+          payload: {
+            rule: "orphaned_claim",
+            action: "orphaned",
+            command: `${c.task} \u2192 ${c.worktree}`,
+            reason: `The lease on "${c.task}" (held by ${c.owner}) expired while its worktree still holds ${work?.dirty ? "uncommitted" : "unpushed"} work. Nothing was removed: renew it, finish and push, or force-release to discard.`
+          }
+        });
+        this.touch();
+        n++;
+      }
+    }
+    return n;
+  }
   renew(projectId, task) {
     const row = this.db.query("SELECT state FROM claims WHERE project_id = ? AND task = ?").get(projectId, task);
     if (!row)
@@ -4190,13 +4918,13 @@ function rowToEvent(r) {
 }
 
 // packages/daemon/src/app.ts
-var VERSION = "0.4.1";
+var VERSION = "0.5.0";
 var WEB_DIR = (() => {
   if (process.env.SWARM_WEB_DIR)
     return process.env.SWARM_WEB_DIR;
   const here = dirname2(fileURLToPath(import.meta.url));
-  const dev = join6(here, "../../web/public");
-  return existsSync5(join6(dev, "index.html")) ? dev : join6(here, "../web");
+  const dev = join7(here, "../../web/public");
+  return existsSync5(join7(dev, "index.html")) ? dev : join7(here, "../web");
 })();
 var REPLAY_TAIL = 200;
 var wireCache = new WeakMap;
@@ -4211,6 +4939,7 @@ function wireJson(e) {
 function createApp(store = new Store) {
   const app = new Hono2;
   const forge2 = new ForgeService(store);
+  const runner = new Runner(store, store.home);
   app.get("/v1/health", (c) => c.json({ ok: true, version: VERSION }));
   app.get("/v1/projects", (c) => c.json(store.snapshot().projects));
   app.post("/v1/projects", async (c) => {
@@ -4244,7 +4973,7 @@ function createApp(store = new Store) {
       dir = homedir4();
     }
     try {
-      const entries = readdirSync2(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, repo: existsSync5(join6(dir, e.name, ".git")) })).sort((a, b) => a.name.localeCompare(b.name));
+      const entries = readdirSync2(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, repo: existsSync5(join7(dir, e.name, ".git")) })).sort((a, b) => a.name.localeCompare(b.name));
       const parent = dirname2(dir);
       return c.json({ path: dir, parent: parent === dir ? null : parent, entries });
     } catch (e) {
@@ -4318,6 +5047,92 @@ function createApp(store = new Store) {
     const r = await store.stopProcess(pid, c.req.query("project") || null);
     return r.ok ? c.json(r) : c.json({ ok: false, error: r.reason }, 404);
   });
+  app.get("/v1/runs", (c) => c.json(runner.list(c.req.query("project") || undefined)));
+  app.post("/v1/runs", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    if (!b.projectId || !b.task || !b.prompt)
+      return c.json({ ok: false, error: "projectId, task and prompt required" }, 400);
+    const r = await runner.start({
+      projectId: b.projectId,
+      task: b.task,
+      prompt: b.prompt,
+      owner: b.owner ?? "dashboard",
+      model: b.model,
+      permissionMode: b.permissionMode,
+      allowedTools: b.allowedTools,
+      maxTurns: b.maxTurns
+    });
+    return r.ok ? c.json(r, 201) : c.json({ ok: false, error: r.reason }, 409);
+  });
+  app.post("/v1/runs/:id/send", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    if (!b.text?.trim())
+      return c.json({ ok: false, error: "text required" }, 400);
+    const r = runner.send(c.req.param("id"), b.text);
+    return r.ok ? c.json(r) : c.json({ ok: false, error: r.reason }, 404);
+  });
+  app.post("/v1/runs/:id/permissions/:reqId", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    const r = runner.answerPermission(c.req.param("id"), c.req.param("reqId"), b.allow === true, b.message);
+    return r.ok ? c.json(r) : c.json({ ok: false, error: r.reason }, 404);
+  });
+  app.delete("/v1/runs/:id", async (c) => {
+    const r = await runner.stop(c.req.param("id"));
+    return r.ok ? c.json(r) : c.json({ ok: false, error: r.reason }, 404);
+  });
+  app.get("/v1/handoffs", (c) => {
+    const project = c.req.query("project");
+    if (!project)
+      return c.json({ error: "project required" }, 400);
+    const task = c.req.query("task");
+    if (task) {
+      const h = store.latestHandoff(project, task);
+      return h ? c.json({ handoff: h, text: formatHandoff(h) }) : c.json({ handoff: null, text: null }, 404);
+    }
+    return c.json(store.handoffs(project));
+  });
+  app.post("/v1/handoffs", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    if (!b.projectId || !b.task)
+      return c.json({ ok: false, error: "projectId and task required" }, 400);
+    const r = store.recordHandoff(b.projectId, {
+      task: b.task,
+      done: b.done ?? "",
+      remaining: b.remaining ?? "",
+      files: Array.isArray(b.files) ? b.files : [],
+      verify: b.verify ?? null,
+      by: b.by ?? null,
+      sessionId: b.sessionId ?? null
+    });
+    return r.ok ? c.json(r, 201) : c.json({ ok: false, error: r.reason }, 400);
+  });
+  app.get("/v1/gates", (c) => {
+    const project = c.req.query("project");
+    if (!project)
+      return c.json({ error: "project required" }, 400);
+    const task = c.req.query("task") || undefined;
+    const runs = store.gateRuns(project, task);
+    const required = store.requiredGates(project);
+    return c.json({
+      required,
+      runs,
+      status: task ? store.gateStatusFor(runs, required) : undefined
+    });
+  });
+  app.post("/v1/gates", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    if (!b.projectId)
+      return c.json({ ok: false, error: "projectId required" }, 400);
+    const r = store.recordGate(b.projectId, {
+      task: b.task ?? "",
+      gate: b.gate ?? "",
+      verdict: b.verdict,
+      rubric: b.rubric,
+      evidence: b.evidence,
+      sessionId: b.sessionId ?? null
+    });
+    return r.ok ? c.json(r, 201) : c.json({ ok: false, error: r.reason }, 400);
+  });
   app.get("/v1/tasks", (c) => {
     const project = c.req.query("project");
     if (!project)
@@ -4376,6 +5191,14 @@ function createApp(store = new Store) {
     const event = c.req.param("event");
     const raw2 = await c.req.json().catch(() => ({}));
     store.ingestHook(event, raw2);
+    if (event === "SessionStart" && typeof raw2.cwd === "string") {
+      const ctx = store.sessionContext(raw2.cwd);
+      if (ctx)
+        return c.json({
+          additionalContext: ctx,
+          hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: ctx }
+        });
+    }
     if (event === "PreToolUse" && process.env.SWARM_GUARD !== "off") {
       const guard = store.guardHook(raw2);
       if (guard) {
@@ -4416,23 +5239,23 @@ function createApp(store = new Store) {
       });
     });
   });
-  app.get("/", (c) => c.html(readFileSync4(join6(WEB_DIR, "index.html"), "utf8")));
+  app.get("/", (c) => c.html(readFileSync4(join7(WEB_DIR, "index.html"), "utf8")));
   const MIME = { js: "text/javascript", css: "text/css" };
   app.get("/:file{[a-z0-9-]+\\.(js|css)}", (c) => {
     const f = c.req.param("file");
-    const p = join6(WEB_DIR, f);
+    const p = join7(WEB_DIR, f);
     if (!existsSync5(p))
       return c.text(`${f} not built \u2014 run: bun run build:web`, 404);
     return c.body(readFileSync4(p, "utf8"), 200, {
       "content-type": MIME[f.split(".").pop() ?? ""] ?? "text/plain"
     });
   });
-  return { app, store, forge: forge2 };
+  return { app, store, forge: forge2, runner };
 }
 
 // packages/daemon/src/bin.ts
 var DEFAULT_PORT2 = process.env.SWARM_PORT ? DEFAULT_PORT : loadConfig().daemon.port;
-var { app, store } = createApp();
+var { app, store, runner } = createApp();
 function serve() {
   const bind = (p) => Bun.serve({ port: p, hostname: "127.0.0.1", idleTimeout: 0, fetch: app.fetch });
   try {
@@ -4461,6 +5284,8 @@ var tailer = setInterval(() => {
   }
   store.reapResources();
   store.reapProcesses();
+  if (tick % 12 === 0)
+    store.sweepOrphans();
 }, 5000);
 store.refreshAllWorktrees();
 var wtRefresh = setInterval(() => void store.refreshAllWorktrees(), 15000);
@@ -4469,11 +5294,16 @@ var pruner = setInterval(() => store.prune(), 24 * 60 * 60000);
 if (process.env.SWARM_OFFLINE !== "1")
   store.refreshPricing().catch(() => {});
 console.log(`swarmd ${VERSION} listening on http://127.0.0.1:${port}`);
-function shutdown() {
+var stopping = false;
+async function shutdown() {
+  if (stopping)
+    return;
+  stopping = true;
   clearInterval(tailer);
   clearInterval(wtRefresh);
   clearInterval(pruner);
   clearDaemonInfo();
+  await Promise.race([runner.stopAll(), Bun.sleep(6000)]);
   server.stop(true);
   process.exit(0);
 }