@ra3orblade/swarm 0.5.0 → 0.7.0

package/dist/swarmd.js

@@ -322,13 +322,96 @@ function normalizeHook(event, raw, projectId, ts = new Date().toISOString()) {
     payload.prompt = raw.prompt;
   return { ts, type, projectId, sessionId: raw.session_id ?? null, payload, raw };
 }
+// packages/core/src/budget.ts
+function budgetStatus(spent, cfg) {
+  const part = (s, l) => ({
+    spent: s,
+    limit: l,
+    pct: l && l > 0 ? s / l : 0
+  });
+  const daily = part(spent.today, cfg.daily);
+  const weekly = part(spent.week, cfg.weekly);
+  const candidates = [
+    ["daily", daily],
+    ["weekly", weekly]
+  ];
+  let kind = null;
+  let top = { spent: 0, limit: null, pct: 0 };
+  for (const [k, v] of candidates)
+    if (v.limit && v.pct >= top.pct)
+      ({ kind, top } = { kind: k, top: v });
+  const level = !kind ? "ok" : top.pct >= 1 ? "exceeded" : top.pct >= cfg.warn_at ? "warn" : "ok";
+  return { level, kind, spent: top.spent, limit: top.limit, pct: top.pct, daily, weekly };
+}
+var BUDGET_ASK_TOOLS = new Set(["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit"]);
+function budgetMessage(s, project) {
+  const usd = (n) => `$${n.toFixed(2)}`;
+  if (s.level === "ok" || !s.limit)
+    return `${project}: within budget`;
+  return `${project} has spent ${usd(s.spent)} of its ${usd(s.limit)} ${s.kind} budget (${Math.round(s.pct * 100)}%)`;
+}
+var RUN_PROFILES = {
+  full: {
+    name: "full",
+    description: "every tool, rules still apply",
+    disallowedTools: [],
+    allowedTools: []
+  },
+  "no-edits": {
+    name: "no-edits",
+    description: "may run commands, may not edit files (review, triage, test runs)",
+    disallowedTools: ["Edit", "Write", "MultiEdit", "NotebookEdit"],
+    allowedTools: []
+  },
+  "read-only": {
+    name: "read-only",
+    description: "read and search only \u2014 no edits, no shell",
+    disallowedTools: ["Edit", "Write", "MultiEdit", "NotebookEdit", "Bash"],
+    allowedTools: ["Read", "Grep", "Glob", "LS", "WebFetch", "WebSearch"]
+  }
+};
+function runProfile(name) {
+  if (!name)
+    return null;
+  return RUN_PROFILES[name] ?? null;
+}
 // packages/core/src/config.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { join as join2 } from "path";
+var DEFAULT_GATE_TIMEOUT_S = 900;
+var AUTO_MODES = ["session-end", "stop", "off"];
+function parseGateDefs(gates) {
+  const out = {};
+  if (!isRecord(gates))
+    return out;
+  for (const [name, v] of Object.entries(gates)) {
+    if (!isRecord(v) || typeof v.cmd !== "string" || !v.cmd.trim())
+      continue;
+    if (!/^[a-z0-9][a-z0-9_.-]{0,39}$/i.test(name))
+      continue;
+    const t = Number(v.timeout);
+    out[name] = {
+      cmd: v.cmd.trim(),
+      timeout: Number.isFinite(t) && t > 0 ? Math.min(t, 86400) : DEFAULT_GATE_TIMEOUT_S,
+      cwd: isRepoRelative(v.cwd) ? v.cwd.trim() : null
+    };
+  }
+  return out;
+}
 var DEFAULT_CONFIG = {
   daemon: { port: 7777 },
-  tasks: { source: null },
-  gates: { required: [] },
+  tasks: { source: null, labels: [], team: null },
+  gates: { required: [], auto: "session-end", defs: {} },
+  budget: { daily: null, weekly: null, warn_at: 0.8, on_exceed: "warn" },
+  dispatch: {
+    max_parallel: 2,
+    permission_mode: null,
+    model: null,
+    max_turns: null,
+    require_pr: true,
+    profile: null
+  },
+  worktree: { setup: null, copy: [], open: null },
   rules: {
     shared_tree: "ask",
     destructive_git: "ask",
@@ -359,15 +442,63 @@ function parseToml(text, source) {
     return {};
   }
 }
+function isRepoRelative(f) {
+  if (typeof f !== "string")
+    return false;
+  const t = f.trim();
+  if (!t || t.startsWith("/") || t.startsWith("\\") || /^[a-zA-Z]:/.test(t))
+    return false;
+  return !t.split(/[/\\]/).some((seg) => seg === "..");
+}
 function validate(c) {
   const mode = (v, fallback) => MODES.includes(v) ? v : fallback;
   const port = Number(c.daemon?.port);
   const source = c.tasks?.source;
+  const setup = c.worktree?.setup;
+  const opener = c.worktree?.open;
+  const rawGates = c.gates;
+  const d = c.dispatch ?? {};
+  const mp = Number(d.max_parallel);
+  const mt = Number(d.max_turns);
+  const str = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
+  const b = c.budget ?? {};
+  const usd = (v) => {
+    const n = Number(v);
+    return Number.isFinite(n) && n > 0 ? n : null;
+  };
+  const warnAt = Number(b.warn_at);
+  const auto = rawGates?.auto;
   return {
     ...c,
     daemon: { port: Number.isInteger(port) && port > 0 && port < 65536 ? port : 7777 },
     tasks: {
-      source: typeof source === "string" && source.trim() && !source.startsWith("/") ? source.trim() : null
+      source: typeof source === "string" && source.trim() && !source.startsWith("/") ? source.trim() : null,
+      labels: Array.isArray(c.tasks?.labels) ? c.tasks.labels.filter((l) => typeof l === "string" && l.trim() !== "") : [],
+      team: typeof c.tasks?.team === "string" && c.tasks.team.trim() ? c.tasks.team.trim() : null
+    },
+    gates: {
+      required: Array.isArray(rawGates?.required) ? rawGates.required.filter((g) => typeof g === "string" && g.trim() !== "") : [],
+      auto: AUTO_MODES.includes(auto) ? auto : "session-end",
+      defs: parseGateDefs(rawGates)
+    },
+    budget: {
+      daily: usd(b.daily),
+      weekly: usd(b.weekly),
+      warn_at: Number.isFinite(warnAt) && warnAt > 0 && warnAt < 1 ? warnAt : 0.8,
+      on_exceed: b.on_exceed === "ask" || b.on_exceed === "stop" ? b.on_exceed : "warn"
+    },
+    dispatch: {
+      max_parallel: Number.isInteger(mp) && mp > 0 ? Math.min(mp, 16) : 2,
+      permission_mode: str(d.permission_mode),
+      model: str(d.model),
+      max_turns: Number.isInteger(mt) && mt > 0 ? mt : null,
+      require_pr: d.require_pr === undefined ? true : d.require_pr === true,
+      profile: ["full", "no-edits", "read-only"].includes(String(d.profile)) ? String(d.profile) : null
+    },
+    worktree: {
+      setup: typeof setup === "string" && setup.trim() ? setup.trim() : null,
+      copy: Array.isArray(c.worktree?.copy) ? c.worktree.copy.filter((f) => isRepoRelative(f)) : [],
+      open: typeof opener === "string" && opener.trim() ? opener.trim() : null
     },
     rules: {
       ...c.rules,
@@ -396,6 +527,315 @@ function loadConfig(opts = {}) {
   }
   return validate(cfg);
 }
+// packages/core/src/dispatch.ts
+function planDispatch(tasks, wanted, opts) {
+  const byId = new Map(tasks.map((t) => [t.id, t]));
+  const queued = new Set(opts.alreadyQueued ?? []);
+  const rejected = [];
+  const picked = [];
+  const ids = wanted === "ready" ? tasks.filter((t) => t.ready).map((t) => t.id) : wanted;
+  for (const id of ids) {
+    const t = byId.get(id);
+    if (!t)
+      rejected.push({ id, reason: "not in the task source" });
+    else if (queued.has(id))
+      rejected.push({ id, reason: "already queued" });
+    else if (t.claimedBy)
+      rejected.push({ id, reason: `held by ${t.claimedBy}` });
+    else if (t.status === "done")
+      rejected.push({ id, reason: "already done" });
+    else if (!t.ready)
+      rejected.push({
+        id,
+        reason: t.status === "active" ? "in progress" : "blocked by dependencies"
+      });
+    else if (picked.some((p) => p.id === id))
+      rejected.push({ id, reason: "listed twice" });
+    else
+      picked.push(t);
+  }
+  const limit = opts.max && opts.max > 0 ? picked.slice(0, opts.max) : picked;
+  for (const t of picked.slice(limit.length))
+    rejected.push({ id: t.id, reason: `beyond --max ${opts.max}` });
+  const slots = Math.max(0, opts.maxParallel - opts.running);
+  return { start: limit.slice(0, slots), queued: limit.slice(slots), rejected };
+}
+function taskPrompt(task, ctx = {
+  requiredGates: [],
+  executableGates: [],
+  openPr: true
+}) {
+  const manual = ctx.requiredGates.filter((g) => !ctx.executableGates.includes(g));
+  const exec = ctx.requiredGates.filter((g) => ctx.executableGates.includes(g));
+  const steps = [
+    "Work only inside this worktree; never touch the main checkout or another worktree.",
+    "Commit as you go with clear messages. Do not edit the task list or flip the task's status \u2014 Swarm derives it.",
+    exec.length ? `Run the executable gates with swarm_gate_run (${exec.join(", ")}) and fix what fails.` : null,
+    manual.length ? `Record the remaining required gates with swarm_gate_record and an honest rubric (${manual.join(", ")}).` : null,
+    "Call swarm_handoff with what was done, what remains, the files touched and how to verify.",
+    ctx.openPr ? "Then push and open the pull request with swarm_pr_open." : "Push the branch.",
+    "If you are blocked on a decision only a human can make, say so in the handoff and stop."
+  ].filter(Boolean);
+  return `Task ${task.id}: ${task.title}
+
+${steps.map((s, i) => `${i + 1}. ${s}`).join(`
+`)}`;
+}
+function dispatchOutcome(facts) {
+  if (facts.stopped)
+    return "stopped";
+  if (facts.exitCode !== 0 || facts.isError)
+    return "crashed";
+  if (!facts.gatesSatisfied)
+    return "gates-failed";
+  if (facts.requirePr && !facts.prOpen)
+    return "no-pr";
+  return "done";
+}
+// packages/core/src/rules.ts
+var LIVE_WINDOW_MS = 10 * 60000;
+function otherLiveInSameTree(current, sessions, now, withinMs = LIVE_WINDOW_MS) {
+  if (!current.toplevel)
+    return null;
+  for (const s of sessions) {
+    if (s.id === current.id)
+      continue;
+    if (s.state === "ended")
+      continue;
+    if (s.toplevel !== current.toplevel)
+      continue;
+    if (now - new Date(s.lastSeenAt).getTime() > withinMs)
+      continue;
+    return s;
+  }
+  return null;
+}
+function isBroadStage(cmd) {
+  const c = cmd.trim();
+  if (/\bgit\s+add\s+(-A\b|--all\b|\.(\s|$))/.test(c))
+    return true;
+  if (/\bgit\s+commit\b[^|&;]*\s-[a-zA-Z]*a/.test(c))
+    return true;
+  if (/\bgit\s+add\s*$/.test(c))
+    return true;
+  return false;
+}
+function isDestructiveGit(cmd) {
+  const c = cmd.trim();
+  return /\bgit\s+reset\s+[^|&;]*--hard\b/.test(c) || /\bgit\s+checkout\s+(--\s+)?\.(\s|$)/.test(c) || /\bgit\s+checkout\s+-f\b/.test(c) || /\bgit\s+restore\s+(--\s+)?\.(\s|$)/.test(c) || /\bgit\s+clean\s+[^|&;]*-[a-zA-Z]*f/.test(c) || /\bgit\s+stash\s+(drop|clear)\b/.test(c) || /\bgit\s+branch\s+[^|&;]*-[a-zA-Z]*D/.test(c);
+}
+function isPatternKill(cmd) {
+  return /\bpkill\s+-f\b/.test(cmd) || /\bpgrep\s+-f\b[^|]*\|\s*[^|]*\bkill\b/.test(cmd);
+}
+function killedPorts(cmd) {
+  const ports = new Set;
+  const killy = /\b(kill|fuser\s+-[a-z]*k|kill-port)\b/.test(cmd);
+  if (!killy)
+    return [];
+  for (const m of cmd.matchAll(/(?:-i\s*:?|:)(\d{2,5})\b/g))
+    ports.add(Number(m[1]));
+  for (const m of cmd.matchAll(/\bkill-port\s+(\d{2,5})/g))
+    ports.add(Number(m[1]));
+  for (const m of cmd.matchAll(/\bfuser\s+-[a-z]*k\s+(\d{2,5})/g))
+    ports.add(Number(m[1]));
+  return [...ports];
+}
+var DEFAULT_MODES = {
+  shared_tree: "ask",
+  destructive_git: "ask",
+  pattern_kill: "ask",
+  protected_ports: "ask",
+  no_foreign_worktree: "ask",
+  claim_required_to_write: "off",
+  protected: { ports: [] }
+};
+function guardBash(cmd, current, sessions, now, modes = DEFAULT_MODES) {
+  const other = () => otherLiveInSameTree(current, sessions, now);
+  const hit = (rule, reason) => {
+    const mode = modes[rule];
+    return mode === "off" ? { action: "allow" } : { action: mode, rule, reason };
+  };
+  if (modes.protected_ports !== "off" && modes.protected.ports.length) {
+    const target = killedPorts(cmd).filter((p) => modes.protected.ports.includes(p));
+    if (target.length) {
+      const d = hit("protected_ports", `Port${target.length > 1 ? "s" : ""} ${target.join(", ")} ${target.length > 1 ? "are" : "is"} protected in the Swarm config \u2014 something the owner relies on is listening there. Don't kill it.`);
+      if (d.action !== "allow")
+        return d;
+    }
+  }
+  if (modes.pattern_kill !== "off" && isPatternKill(cmd)) {
+    const d = hit("pattern_kill", "This kills processes by command pattern \u2014 it will match every process on the machine that fits, including other agents' or the owner's. Kill by pid instead.");
+    if (d.action !== "allow")
+      return d;
+  }
+  if (modes.shared_tree !== "off" && isBroadStage(cmd)) {
+    const o = other();
+    if (o) {
+      const d = hit("shared_tree", `Another session (${o.id.slice(0, 8)}) is active in this same checkout. \`git add -A\` / \`git commit -a\` will sweep its uncommitted changes into your commit. Stage explicit paths (\`git add <path>\`), or give each session its own git worktree.`);
+      if (d.action !== "allow")
+        return d;
+    }
+  }
+  if (modes.destructive_git !== "off" && isDestructiveGit(cmd)) {
+    const o = other();
+    if (o) {
+      const d = hit("destructive_git", `Another session (${o.id.slice(0, 8)}) is active in this same checkout and may have uncommitted work. This command can discard it. Coordinate, or use a separate git worktree.`);
+      if (d.action !== "allow")
+        return d;
+    }
+  }
+  return { action: "allow" };
+}
+function norm(p) {
+  const parts = [];
+  for (const seg of p.split("/")) {
+    if (seg === "" || seg === ".")
+      continue;
+    if (seg === "..")
+      parts.pop();
+    else
+      parts.push(seg);
+  }
+  return `/${parts.join("/")}`;
+}
+function isInside(path, dir) {
+  if (!path || !dir)
+    return false;
+  const a = norm(path);
+  const d = norm(dir);
+  return a === d || a.startsWith(`${d}/`);
+}
+function absolutePath(path, cwd) {
+  if (path.startsWith("/"))
+    return path;
+  if (path.startsWith("~/"))
+    return path;
+  return `${cwd.replace(/\/+$/, "")}/${path}`;
+}
+var WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
+function guardWrite(target, current, claims, modes = DEFAULT_MODES, kind = "file") {
+  const hit = (rule, reason) => {
+    const mode = modes[rule];
+    return mode === "off" ? { action: "allow" } : { action: mode, rule, reason };
+  };
+  const held = claims.filter((c) => c.worktree);
+  const mine = held.find((c) => isInside(current.cwd, c.worktree)) ?? null;
+  if (modes.no_foreign_worktree !== "off") {
+    const foreign = held.find((c) => isInside(target, c.worktree) && c !== mine);
+    if (foreign) {
+      const d = hit("no_foreign_worktree", kind === "bash" ? `This command runs inside the worktree for "${foreign.task}", held by ${foreign.owner}. Never touch a worktree you don't hold \u2014 work in your own checkout, or claim the task.` : `${target} is inside the worktree for "${foreign.task}", held by ${foreign.owner}. Never touch a worktree you don't hold \u2014 edit your own checkout, or claim the task.`);
+      if (d.action !== "allow")
+        return d;
+    }
+  }
+  if (modes.claim_required_to_write !== "off" && kind === "file" && current.toplevel && !mine) {
+    const inShared = isInside(target, current.toplevel) && !held.some((c) => isInside(target, c.worktree));
+    if (inShared) {
+      const d = hit("claim_required_to_write", `This repo requires a claim before writing to its shared checkout. Run \`swarm claim <task>\` (or the swarm_claim MCP tool) and work in the worktree it creates.`);
+      if (d.action !== "allow")
+        return d;
+    }
+  }
+  return { action: "allow" };
+}
+
+// packages/core/src/dryrun.ts
+var RULE_IDS = [
+  "pattern_kill",
+  "shared_tree",
+  "destructive_git",
+  "protected_ports",
+  "no_foreign_worktree",
+  "claim_required_to_write"
+];
+function normalizeDisplay(s) {
+  return s.replace(/\s+/g, " ").trim().slice(0, 160);
+}
+function dryRunRules(calls, modes, ctx) {
+  const claims = ctx.claims ?? [];
+  const minRepeat = ctx.minRepeat ?? 3;
+  const maxHits = ctx.maxHits ?? 200;
+  const live = new Map;
+  const byRule = Object.fromEntries(RULE_IDS.map((r) => [r, { ask: 0, deny: 0 }]));
+  const hits = [];
+  const groups = new Map;
+  let evaluated = 0;
+  const sorted = [...calls].sort((a, b) => a.ts < b.ts ? -1 : a.ts > b.ts ? 1 : 0);
+  const writeRules = modes.no_foreign_worktree !== "off" || modes.claim_required_to_write !== "off";
+  for (const c of sorted) {
+    const toplevel = ctx.toplevel(c.cwd);
+    live.set(c.sessionId, { id: c.sessionId, toplevel, lastSeenAt: c.ts, state: "active" });
+    const now = new Date(c.ts).getTime();
+    const current = { id: c.sessionId, cwd: c.cwd, toplevel };
+    let d = { action: "allow" };
+    let display = c.tool;
+    const isWrite = WRITE_TOOLS.has(c.tool) && typeof c.filePath === "string";
+    if (isWrite) {
+      const target = absolutePath(c.filePath, c.cwd);
+      display = `${c.tool} ${target}`;
+      evaluated++;
+      if (writeRules)
+        d = guardWrite(target, current, claims, modes, "file");
+    } else if (c.tool === "Bash" && c.command) {
+      display = c.command;
+      evaluated++;
+      if (writeRules)
+        d = guardWrite(c.cwd, current, claims, modes, "bash");
+      if (d.action === "allow") {
+        const sessions = [...live.values()].filter((s) => now - new Date(s.lastSeenAt).getTime() <= LIVE_WINDOW_MS);
+        d = guardBash(c.command, current, sessions, now, modes);
+      }
+    } else
+      continue;
+    if (d.action === "allow")
+      continue;
+    byRule[d.rule][d.action]++;
+    const norm2 = normalizeDisplay(display);
+    if (hits.length < maxHits)
+      hits.push({
+        ts: c.ts,
+        sessionId: c.sessionId,
+        rule: d.rule,
+        action: d.action,
+        display: norm2,
+        completed: c.completed
+      });
+    const key = `${d.rule} ${norm2}`;
+    const g = groups.get(key) ?? {
+      rule: d.rule,
+      display: norm2,
+      fires: 0,
+      completedRatio: 0,
+      sessions: 0,
+      suggestion: "",
+      done: 0,
+      sids: new Set
+    };
+    g.fires++;
+    if (c.completed)
+      g.done++;
+    g.sids.add(c.sessionId);
+    groups.set(key, g);
+  }
+  const flaky = [];
+  for (const g of groups.values()) {
+    if (g.fires < minRepeat)
+      continue;
+    const ratio = g.done / g.fires;
+    if (ratio < 0.8)
+      continue;
+    flaky.push({
+      rule: g.rule,
+      display: g.display,
+      fires: g.fires,
+      completedRatio: Math.round(ratio * 100) / 100,
+      sessions: g.sids.size,
+      suggestion: modes[g.rule] === "deny" ? `${g.rule} denies this but it ran ${g.done}/${g.fires} times anyway \u2014 the rule is being bypassed; check the hook is installed, or turn it off here.` : `${g.rule} asked ${g.fires} times on this and it was allowed ${g.done} times \u2014 pure friction here. Turn it off for this repo, or make it deny so it stops asking.`
+    });
+  }
+  flaky.sort((a, b) => b.fires - a.fires);
+  return { calls: calls.length, evaluated, hits, byRule, flaky };
+}
 // packages/core/src/forge.ts
 function parseRemote(url) {
   const m = url.match(/^(?:ssh:\/\/)?git@([^:/]+)[:/](.+?)(?:\.git)?$/) ?? url.match(/^https?:\/\/([^/]+)\/(.+?)(?:\.git)?\/?$/);
@@ -460,6 +900,68 @@ function normalizeGitlab(raw, repo) {
     };
   });
 }
+function parseNumstat(numstat, nameStatus = "") {
+  const status = new Map;
+  for (const line of nameStatus.split(`
+`)) {
+    const [st, ...rest] = line.split("\t");
+    if (!st || !rest.length)
+      continue;
+    status.set(rest[rest.length - 1], st[0]);
+  }
+  const out = [];
+  for (const line of numstat.split(`
+`)) {
+    const [a, d, ...rest] = line.split("\t");
+    if (a === undefined || d === undefined || !rest.length)
+      continue;
+    const raw = rest.join("\t");
+    const path = raw.includes(" => ") ? raw.replace(/\{?([^{}]*) => ([^{}]*)\}?/, "$2") : raw;
+    out.push({
+      path,
+      added: a === "-" ? -1 : Number(a),
+      deleted: d === "-" ? -1 : Number(d),
+      status: status.get(path) ?? "M"
+    });
+  }
+  return out;
+}
+function prDraft(i) {
+  const title = ((i.title?.trim()) ? `${i.task}: ${i.title.trim()}` : i.task).slice(0, 120);
+  const b = [];
+  b.push("## Summary");
+  if (i.handoff?.done.trim())
+    b.push(i.handoff.done.trim());
+  else if (i.commits?.length)
+    b.push(i.commits.map((c) => `- ${c}`).join(`
+`));
+  else
+    b.push(`Work on ${i.task}.`);
+  if (i.handoff?.remaining.trim() && !/^(nothing|none|\u2014|-)\.?$/i.test(i.handoff.remaining.trim()))
+    b.push(`
+## Remaining
+${i.handoff.remaining.trim()}`);
+  if (i.gates?.length) {
+    b.push(`
+## Gates`);
+    b.push(i.gates.map((g) => `- ${g.verdict === "pass" ? "[x]" : "[ ]"} ${g.gate}${g.verdict === "fail" ? " \u2014 failed" : g.verdict ? "" : " \u2014 not run"}`).join(`
+`));
+  }
+  if (i.handoff?.verify?.trim())
+    b.push(`
+## Verify
+${i.handoff.verify.trim()}`);
+  if (i.files?.length) {
+    const shown = i.files.slice(0, 30);
+    b.push(`
+## Files (${i.files.length})
+${shown.map((f) => `- \`${f.path}\`${f.added >= 0 ? ` +${f.added} \u2212${f.deleted}` : " (binary)"}`).join(`
+`)}${i.files.length > shown.length ? `
+- \u2026 ${i.files.length - shown.length} more` : ""}`);
+  }
+  return { title, body: b.join(`
+`) };
+}
 // packages/core/src/gates.ts
 var NAME_RE = /^[a-z0-9][a-z0-9_.-]{0,39}$/i;
 function validateGateRun(input) {
@@ -503,6 +1005,25 @@ function gatesSatisfied(runs, declared) {
   const st = gateStatus(runs, declared);
   return declared.every((g) => st.find((s) => s.gate === g)?.verdict === "pass");
 }
+function evidenceTail(output, max = 2000) {
+  const t = output.trimEnd();
+  if (t.length <= max)
+    return t;
+  const cut = t.slice(-max);
+  const nl = cut.indexOf(`
+`);
+  return `\u2026${nl >= 0 && nl < 200 ? cut.slice(nl + 1) : cut}`;
+}
+function executedGateInput(task, gate, cmd, outcome) {
+  const how = outcome.timedOut === true ? "timed out" : outcome.exitCode === null ? "could not start" : `exit ${outcome.exitCode}`;
+  return {
+    task,
+    gate,
+    verdict: outcome.exitCode === 0 && !outcome.timedOut ? "pass" : "fail",
+    rubric: `ran \`${cmd}\` \u2014 ${how} in ${(outcome.durationMs / 1000).toFixed(1)}s`,
+    evidence: evidenceTail(outcome.output) || null
+  };
+}
 // packages/core/src/ledger.ts
 var DEFAULT_LEASE_MINUTES = 45;
 function isExpired(claim, now) {
@@ -576,51 +1097,282 @@ function formatHandoff(h) {
   return lines.join(`
 `);
 }
-// packages/core/src/pricing.ts
-var PRICES = {
-  "claude-opus-4": { input: 15, output: 75, cacheWrite: 18.75, cacheWrite1h: 30, cacheRead: 1.5 },
-  "claude-opus-4-5": { input: 5, output: 25, cacheWrite: 6.25, cacheWrite1h: 10, cacheRead: 0.5 },
-  "claude-opus-4-6": { input: 5, output: 25, cacheWrite: 6.25, cacheWrite1h: 10, cacheRead: 0.5 },
-  "claude-sonnet-4": { input: 3, output: 15, cacheWrite: 3.75, cacheWrite1h: 6, cacheRead: 0.3 },
-  "claude-haiku-4-5": { input: 1, output: 5, cacheWrite: 1.25, cacheWrite1h: 2, cacheRead: 0.1 },
-  "claude-3-5-haiku": { input: 0.8, output: 4, cacheWrite: 1, cacheWrite1h: 1.6, cacheRead: 0.08 },
-  "claude-opus-5": { input: 5, output: 25, cacheWrite: 6.25, cacheWrite1h: 10, cacheRead: 0.5 },
-  "claude-sonnet-5": { input: 2, output: 10, cacheWrite: 2.5, cacheWrite1h: 4, cacheRead: 0.2 },
-  "claude-fable-5": { input: 10, output: 50, cacheWrite: 12.5, cacheWrite1h: 20, cacheRead: 1 },
-  "gpt-4o": { input: 2.5, output: 10, cacheWrite: 2.5, cacheRead: 1.25 },
-  "gpt-4o-mini": { input: 0.15, output: 0.6, cacheWrite: 0.15, cacheRead: 0.075 },
-  "gpt-4.1": { input: 2, output: 8, cacheWrite: 2, cacheRead: 0.5 },
-  "gpt-4.1-mini": { input: 0.4, output: 1.6, cacheWrite: 0.4, cacheRead: 0.1 },
-  "gpt-5": { input: 1.25, output: 10, cacheWrite: 1.25, cacheRead: 0.125 },
-  o3: { input: 2, output: 8, cacheWrite: 2, cacheRead: 0.5 },
-  "o4-mini": { input: 1.1, output: 4.4, cacheWrite: 1.1, cacheRead: 0.275 },
-  "gemini-2.5-pro": { input: 1.25, output: 10, cacheWrite: 1.25, cacheRead: 0.31 },
-  "gemini-2.5-flash": { input: 0.3, output: 2.5, cacheWrite: 0.3, cacheRead: 0.075 },
-  "deepseek-chat": { input: 0.27, output: 1.1, cacheWrite: 0.27, cacheRead: 0.07 },
-  "deepseek-reasoner": { input: 0.55, output: 2.19, cacheWrite: 0.55, cacheRead: 0.14 },
-  "grok-4": { input: 3, output: 15, cacheWrite: 3, cacheRead: 0.75 },
-  "grok-3": { input: 3, output: 15, cacheWrite: 3, cacheRead: 0.75 },
-  "grok-code-fast": { input: 0.2, output: 1.5, cacheWrite: 0.2, cacheRead: 0.02 },
-  "grok-composer": { input: 0.2, output: 1.5, cacheWrite: 0.2, cacheRead: 0.02 }
-};
-function priceFor(model, table = PRICES) {
-  if (!model)
-    return null;
-  const m = model.toLowerCase();
-  let best = null;
-  for (const k of Object.keys(table)) {
-    if (m.startsWith(k) && (!best || k.length > best.length))
-      best = k;
+var EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+var VERIFY_RE = /\b(test|tests|typecheck|tsc|lint|biome|eslint|check|build|smoke|pytest|cargo (test|check|build)|go (test|vet|build)|make)\b/;
+function deriveHandoff(task, ev, opts = {}) {
+  const files = [];
+  let verify = null;
+  let lastPrompt = null;
+  for (const e of ev) {
+    const p = e.payload ?? {};
+    if (e.type === "tool.requested" && p.tool) {
+      const arg = (p.summary ?? "").slice(p.tool.length).trim();
+      if (EDIT_TOOLS.has(p.tool) && arg && !files.includes(arg))
+        files.push(arg);
+      if (p.tool === "Bash") {
+        if (arg && VERIFY_RE.test(arg))
+          verify = arg;
+      }
+    } else if (p.hook === "UserPromptSubmit" && (p.prompt ?? p.summary)) {
+      lastPrompt = (p.prompt ?? p.summary ?? "").trim().split(`
+`)[0]?.slice(0, 200) ?? null;
+    }
   }
-  return best ? table[best] ?? null : null;
-}
-function costUsd(model, u, table = PRICES) {
-  const p = priceFor(model, table);
-  if (!p)
+  const said = (opts.lastText ?? "").trim().replace(/\s+/g, " ").slice(0, 600);
+  if (!files.length && !said)
     return null;
-  const w5 = u.cacheWrite - (u.cacheWrite1h ?? 0);
-  return (u.input * p.input + u.output * p.output + w5 * p.cacheWrite + (u.cacheWrite1h ?? 0) * (p.cacheWrite1h ?? p.cacheWrite) + u.cacheRead * p.cacheRead) / 1e6;
-}
+  const done = said || `edited ${files.length} file${files.length === 1 ? "" : "s"} (no summary)`;
+  const remaining = lastPrompt ? `unverified \u2014 session stopped without a manual handoff; last request: "${lastPrompt}". Re-read the files below, run verify, then continue.` : "unverified \u2014 session stopped without a manual handoff. Re-read the files below, run verify, then continue.";
+  return {
+    task,
+    done,
+    remaining,
+    files: files.slice(-30),
+    verify,
+    by: `auto${opts.sessionId ? `:${opts.sessionId.slice(0, 8)}` : ""}`,
+    createdAt: opts.now ?? new Date().toISOString()
+  };
+}
+function isAutoHandoff(h) {
+  return h.by === "auto" || (h.by?.startsWith("auto:") ?? false);
+}
+function formatResumePrompt(h, tail) {
+  const out = [
+    `You are resuming ${h.task}; the previous session on it stopped without finishing.`,
+    "",
+    formatHandoff(h)
+  ];
+  if (tail.length)
+    out.push("", "Its last actions, oldest first:", ...tail.map((t) => `  - ${t}`));
+  out.push("", "Start by reading the files listed, run the verify step if there is one, then continue with `remaining`. Work only inside this worktree; when done commit, push, and call swarm_handoff.");
+  return out.join(`
+`);
+}
+// packages/core/src/lessons.ts
+function portsIn(cmd) {
+  const ports = new Set;
+  for (const m of cmd.matchAll(/(?::|-i\s*:?|kill-port\s+|fuser\s+-[a-z]*k\s+)(\d{2,5})\b/g))
+    ports.add(Number(m[1]));
+  return [...ports];
+}
+var RECURRING = 3;
+function suggestFromIncident(inc) {
+  const n = inc.count ?? 1;
+  switch (inc.rule) {
+    case "protected_ports": {
+      const ports = portsIn(inc.command);
+      return {
+        title: ports.length ? `Protect port${ports.length > 1 ? "s" : ""} ${ports.join(", ")} for good` : "Protect this port",
+        toml: ports.length ? `[rules]
+protected_ports = "deny"
+
+[rules.protected]
+ports = [${ports.join(", ")}]` : null,
+        lesson: `Never kill the process on port ${ports.join("/") || "the dev server's port"} \u2014 it's someone's running service. Ask them, or use \`swarm serve\` so the port is tracked.`
+      };
+    }
+    case "pattern_kill":
+      return {
+        title: n >= RECURRING ? "Deny pattern kills (recurring)" : "Discourage pattern kills",
+        toml: `[rules]
+pattern_kill = "${n >= RECURRING ? "deny" : "ask"}"`,
+        lesson: "Kill processes by pid, never by command pattern (`pkill -f`) \u2014 pattern kills hit every matching process, including other agents' and the owner's."
+      };
+    case "shared_tree":
+      return {
+        title: "Deny broad staging in a shared checkout",
+        toml: `[rules]
+shared_tree = "deny"`,
+        lesson: "Don't `git add -A` / `git commit -a` while another session shares the checkout \u2014 stage explicit paths, or work in your own worktree via `swarm claim`."
+      };
+    case "destructive_git":
+      return {
+        title: "Deny destructive git in a shared checkout",
+        toml: `[rules]
+destructive_git = "deny"`,
+        lesson: "Never run `git reset --hard` / `checkout .` / `clean -f` in a checkout another session shares \u2014 coordinate, or use a separate worktree."
+      };
+    case "no_foreign_worktree":
+      return {
+        title: "Deny writes into others' worktrees",
+        toml: `[rules]
+no_foreign_worktree = "deny"`,
+        lesson: "Never edit inside a worktree you don't hold \u2014 work in your own checkout, or claim the task first."
+      };
+    case "claim_required_to_write":
+      return {
+        title: "Require a claim before writing",
+        toml: `[rules]
+claim_required_to_write = "deny"`,
+        lesson: "Claim a task (`swarm claim`) and work in the worktree it creates before editing this repo."
+      };
+    case "orphaned_claim":
+      return {
+        title: "A claim expired with unfinished work",
+        toml: null,
+        lesson: "Finish and push, or `swarm handoff`, before a lease expires \u2014 an orphaned worktree still holds work nobody owns."
+      };
+    case "gate_failed":
+      return {
+        title: "A verification gate failed",
+        toml: null,
+        lesson: `A gate failed here \u2014 ${inc.reason.slice(0, 120)}. Fix it and re-record the gate before marking the task done.`
+      };
+    default:
+      return {
+        title: `Codify the ${inc.rule} intent`,
+        toml: null,
+        lesson: inc.reason.slice(0, 160)
+      };
+  }
+}
+function incidentKey(inc) {
+  if (inc.rule === "protected_ports")
+    return `protected_ports:${portsIn(inc.command).join(",")}`;
+  return inc.rule;
+}
+// packages/core/src/memory.ts
+var MEMORY_KINDS = ["handoff", "incident", "gate", "session"];
+function handoffDoc(projectId, id, h, sessionId) {
+  return {
+    kind: "handoff",
+    ref: String(id),
+    projectId,
+    task: h.task,
+    sessionId,
+    ts: h.createdAt,
+    title: `handoff on ${h.task}${h.by ? ` by ${h.by}` : ""}`,
+    text: [
+      `done: ${h.done}`,
+      `remaining: ${h.remaining}`,
+      h.files.length ? `files: ${h.files.join(" ")}` : "",
+      h.verify ? `verify: ${h.verify}` : ""
+    ].filter(Boolean).join(`
+`)
+  };
+}
+function incidentDoc(projectId, seq, p, ts, sessionId) {
+  return {
+    kind: "incident",
+    ref: String(seq),
+    projectId,
+    task: null,
+    sessionId,
+    ts,
+    title: `${p.action ?? "ask"} \xB7 ${p.rule ?? "rule"}`,
+    text: [p.command ? `command: ${p.command}` : "", p.reason ? `reason: ${p.reason}` : ""].filter(Boolean).join(`
+`)
+  };
+}
+function gateDoc(projectId, id, g, sessionId) {
+  return {
+    kind: "gate",
+    ref: String(id),
+    projectId,
+    task: g.task,
+    sessionId,
+    ts: g.createdAt,
+    title: `${g.gate} ${g.verdict} on ${g.task}`,
+    text: [`rubric: ${g.rubric}`, g.evidence ? `evidence: ${g.evidence}` : ""].filter(Boolean).join(`
+`)
+  };
+}
+function sessionDoc(projectId, s) {
+  const text = (s.lastText ?? "").trim();
+  if (!text)
+    return null;
+  return {
+    kind: "session",
+    ref: s.id,
+    projectId,
+    task: s.task ?? null,
+    sessionId: s.id,
+    ts: s.ts,
+    title: s.title?.trim() || `session ${s.id.slice(0, 8)}`,
+    text: text.slice(0, 4000)
+  };
+}
+function parseMemoryQuery(q) {
+  let kind = null;
+  let task = null;
+  const terms = [];
+  const re = /"([^"]+)"|(\S+)/g;
+  for (const m of q.matchAll(re)) {
+    if (m[1] !== undefined) {
+      const phrase = m[1].replace(/"/g, "").trim();
+      if (phrase)
+        terms.push(`"${phrase}"`);
+      continue;
+    }
+    const w = m[2] ?? "";
+    const k = /^kind:(\w+)$/i.exec(w);
+    if (k) {
+      const v = (k[1] ?? "").toLowerCase();
+      if (MEMORY_KINDS.includes(v))
+        kind = v;
+      continue;
+    }
+    const t = /^task:(\S+)$/i.exec(w);
+    if (t) {
+      task = t[1] ?? null;
+      continue;
+    }
+    const clean = w.replace(/"/g, "").replace(/^\*+|\*+$/g, "");
+    if (clean)
+      terms.push(`"${clean}"`);
+  }
+  if (terms.length) {
+    const last = terms[terms.length - 1];
+    if (!/\s/.test(last) && !q.trim().endsWith('"'))
+      terms[terms.length - 1] = `${last}*`;
+  }
+  return { match: terms.join(" "), kind, task };
+}
+// packages/core/src/pricing.ts
+var PRICES = {
+  "claude-opus-4": { input: 15, output: 75, cacheWrite: 18.75, cacheWrite1h: 30, cacheRead: 1.5 },
+  "claude-opus-4-5": { input: 5, output: 25, cacheWrite: 6.25, cacheWrite1h: 10, cacheRead: 0.5 },
+  "claude-opus-4-6": { input: 5, output: 25, cacheWrite: 6.25, cacheWrite1h: 10, cacheRead: 0.5 },
+  "claude-sonnet-4": { input: 3, output: 15, cacheWrite: 3.75, cacheWrite1h: 6, cacheRead: 0.3 },
+  "claude-haiku-4-5": { input: 1, output: 5, cacheWrite: 1.25, cacheWrite1h: 2, cacheRead: 0.1 },
+  "claude-3-5-haiku": { input: 0.8, output: 4, cacheWrite: 1, cacheWrite1h: 1.6, cacheRead: 0.08 },
+  "claude-opus-5": { input: 5, output: 25, cacheWrite: 6.25, cacheWrite1h: 10, cacheRead: 0.5 },
+  "claude-sonnet-5": { input: 2, output: 10, cacheWrite: 2.5, cacheWrite1h: 4, cacheRead: 0.2 },
+  "claude-fable-5": { input: 10, output: 50, cacheWrite: 12.5, cacheWrite1h: 20, cacheRead: 1 },
+  "gpt-4o": { input: 2.5, output: 10, cacheWrite: 2.5, cacheRead: 1.25 },
+  "gpt-4o-mini": { input: 0.15, output: 0.6, cacheWrite: 0.15, cacheRead: 0.075 },
+  "gpt-4.1": { input: 2, output: 8, cacheWrite: 2, cacheRead: 0.5 },
+  "gpt-4.1-mini": { input: 0.4, output: 1.6, cacheWrite: 0.4, cacheRead: 0.1 },
+  "gpt-5": { input: 1.25, output: 10, cacheWrite: 1.25, cacheRead: 0.125 },
+  o3: { input: 2, output: 8, cacheWrite: 2, cacheRead: 0.5 },
+  "o4-mini": { input: 1.1, output: 4.4, cacheWrite: 1.1, cacheRead: 0.275 },
+  "gemini-2.5-pro": { input: 1.25, output: 10, cacheWrite: 1.25, cacheRead: 0.31 },
+  "gemini-2.5-flash": { input: 0.3, output: 2.5, cacheWrite: 0.3, cacheRead: 0.075 },
+  "deepseek-chat": { input: 0.27, output: 1.1, cacheWrite: 0.27, cacheRead: 0.07 },
+  "deepseek-reasoner": { input: 0.55, output: 2.19, cacheWrite: 0.55, cacheRead: 0.14 },
+  "grok-4": { input: 3, output: 15, cacheWrite: 3, cacheRead: 0.75 },
+  "grok-3": { input: 3, output: 15, cacheWrite: 3, cacheRead: 0.75 },
+  "grok-code-fast": { input: 0.2, output: 1.5, cacheWrite: 0.2, cacheRead: 0.02 },
+  "grok-composer": { input: 0.2, output: 1.5, cacheWrite: 0.2, cacheRead: 0.02 }
+};
+function priceFor(model, table = PRICES) {
+  if (!model)
+    return null;
+  const m = model.toLowerCase();
+  let best = null;
+  for (const k of Object.keys(table)) {
+    if (m.startsWith(k) && (!best || k.length > best.length))
+      best = k;
+  }
+  return best ? table[best] ?? null : null;
+}
+function costUsd(model, u, table = PRICES) {
+  const p = priceFor(model, table);
+  if (!p)
+    return null;
+  const w5 = u.cacheWrite - (u.cacheWrite1h ?? 0);
+  return (u.input * p.input + u.output * p.output + w5 * p.cacheWrite + (u.cacheWrite1h ?? 0) * (p.cacheWrite1h ?? p.cacheWrite) + u.cacheRead * p.cacheRead) / 1e6;
+}
 function fromLiteLLM(json) {
   const out = {};
   for (const [k, v] of Object.entries(json)) {
@@ -674,6 +1426,29 @@ function projectIdentity(opts) {
   const name = parts[parts.length - 1] ?? opts.root;
   return { id: `p_${fnv1a(key)}`, root: opts.root, commonDir: opts.commonDir, name };
 }
+// packages/core/src/questions.ts
+function validateQuestion(text, options) {
+  const t = typeof text === "string" ? text.trim() : "";
+  if (t.length < 5)
+    return { ok: false, reason: "a question needs at least a few words" };
+  if (t.length > 4000)
+    return { ok: false, reason: "keep the question under 4000 characters" };
+  const opts = Array.isArray(options) ? options.filter((o) => typeof o === "string" && o.trim() !== "").map((o) => o.trim()).slice(0, 8) : [];
+  return { ok: true, text: t, options: opts };
+}
+function formatAnswers(qs) {
+  const answered = qs.filter((q) => q.answer !== null);
+  if (!answered.length)
+    return null;
+  return answered.map((q) => `[swarm] answer from ${q.answeredBy ?? "a human"} to your question "${q.text.slice(0, 200)}": ${q.answer}`).join(`
+`);
+}
+function formatOpenQuestions(qs) {
+  const open = qs.filter((q) => q.answer === null);
+  if (!open.length)
+    return null;
+  return `[swarm] waiting on a human for: ${open.map((q) => `#${q.id} "${q.text.slice(0, 120)}"`).join("; ")} \u2014 the answer arrives as context on a later tool call, or via swarm_inbox`;
+}
 // packages/core/src/resources.ts
 var DEFAULT_RESOURCE_LEASE_MINUTES = 60;
 function isTrackedPid(pid) {
@@ -699,152 +1474,6 @@ function acquireRefusalMessage(holder) {
   const via = isTrackedPid(holder.pid) ? `pid ${holder.pid}` : holder.expiresAt ? `lease until ${holder.expiresAt}` : "unbounded";
   return `Resource "${holder.name}" is held by ${holder.owner} (${via}).` + ` Pick another name, coordinate with the holder, or wait for release/reap.`;
 }
-// packages/core/src/rules.ts
-var LIVE_WINDOW_MS = 10 * 60000;
-function otherLiveInSameTree(current, sessions, now, withinMs = LIVE_WINDOW_MS) {
-  if (!current.toplevel)
-    return null;
-  for (const s of sessions) {
-    if (s.id === current.id)
-      continue;
-    if (s.state === "ended")
-      continue;
-    if (s.toplevel !== current.toplevel)
-      continue;
-    if (now - new Date(s.lastSeenAt).getTime() > withinMs)
-      continue;
-    return s;
-  }
-  return null;
-}
-function isBroadStage(cmd) {
-  const c = cmd.trim();
-  if (/\bgit\s+add\s+(-A\b|--all\b|\.(\s|$))/.test(c))
-    return true;
-  if (/\bgit\s+commit\b[^|&;]*\s-[a-zA-Z]*a/.test(c))
-    return true;
-  if (/\bgit\s+add\s*$/.test(c))
-    return true;
-  return false;
-}
-function isDestructiveGit(cmd) {
-  const c = cmd.trim();
-  return /\bgit\s+reset\s+[^|&;]*--hard\b/.test(c) || /\bgit\s+checkout\s+(--\s+)?\.(\s|$)/.test(c) || /\bgit\s+checkout\s+-f\b/.test(c) || /\bgit\s+restore\s+(--\s+)?\.(\s|$)/.test(c) || /\bgit\s+clean\s+[^|&;]*-[a-zA-Z]*f/.test(c) || /\bgit\s+stash\s+(drop|clear)\b/.test(c) || /\bgit\s+branch\s+[^|&;]*-[a-zA-Z]*D/.test(c);
-}
-function isPatternKill(cmd) {
-  return /\bpkill\s+-f\b/.test(cmd) || /\bpgrep\s+-f\b[^|]*\|\s*[^|]*\bkill\b/.test(cmd);
-}
-function killedPorts(cmd) {
-  const ports = new Set;
-  const killy = /\b(kill|fuser\s+-[a-z]*k|kill-port)\b/.test(cmd);
-  if (!killy)
-    return [];
-  for (const m of cmd.matchAll(/(?:-i\s*:?|:)(\d{2,5})\b/g))
-    ports.add(Number(m[1]));
-  for (const m of cmd.matchAll(/\bkill-port\s+(\d{2,5})/g))
-    ports.add(Number(m[1]));
-  for (const m of cmd.matchAll(/\bfuser\s+-[a-z]*k\s+(\d{2,5})/g))
-    ports.add(Number(m[1]));
-  return [...ports];
-}
-var DEFAULT_MODES = {
-  shared_tree: "ask",
-  destructive_git: "ask",
-  pattern_kill: "ask",
-  protected_ports: "ask",
-  no_foreign_worktree: "ask",
-  claim_required_to_write: "off",
-  protected: { ports: [] }
-};
-function guardBash(cmd, current, sessions, now, modes = DEFAULT_MODES) {
-  const other = () => otherLiveInSameTree(current, sessions, now);
-  const hit = (rule, reason) => {
-    const mode = modes[rule];
-    return mode === "off" ? { action: "allow" } : { action: mode, rule, reason };
-  };
-  if (modes.protected_ports !== "off" && modes.protected.ports.length) {
-    const target = killedPorts(cmd).filter((p) => modes.protected.ports.includes(p));
-    if (target.length) {
-      const d = hit("protected_ports", `Port${target.length > 1 ? "s" : ""} ${target.join(", ")} ${target.length > 1 ? "are" : "is"} protected in the Swarm config \u2014 something the owner relies on is listening there. Don't kill it.`);
-      if (d.action !== "allow")
-        return d;
-    }
-  }
-  if (modes.pattern_kill !== "off" && isPatternKill(cmd)) {
-    const d = hit("pattern_kill", "This kills processes by command pattern \u2014 it will match every process on the machine that fits, including other agents' or the owner's. Kill by pid instead.");
-    if (d.action !== "allow")
-      return d;
-  }
-  if (modes.shared_tree !== "off" && isBroadStage(cmd)) {
-    const o = other();
-    if (o) {
-      const d = hit("shared_tree", `Another session (${o.id.slice(0, 8)}) is active in this same checkout. \`git add -A\` / \`git commit -a\` will sweep its uncommitted changes into your commit. Stage explicit paths (\`git add <path>\`), or give each session its own git worktree.`);
-      if (d.action !== "allow")
-        return d;
-    }
-  }
-  if (modes.destructive_git !== "off" && isDestructiveGit(cmd)) {
-    const o = other();
-    if (o) {
-      const d = hit("destructive_git", `Another session (${o.id.slice(0, 8)}) is active in this same checkout and may have uncommitted work. This command can discard it. Coordinate, or use a separate git worktree.`);
-      if (d.action !== "allow")
-        return d;
-    }
-  }
-  return { action: "allow" };
-}
-function norm(p) {
-  const parts = [];
-  for (const seg of p.split("/")) {
-    if (seg === "" || seg === ".")
-      continue;
-    if (seg === "..")
-      parts.pop();
-    else
-      parts.push(seg);
-  }
-  return `/${parts.join("/")}`;
-}
-function isInside(path, dir) {
-  if (!path || !dir)
-    return false;
-  const a = norm(path);
-  const d = norm(dir);
-  return a === d || a.startsWith(`${d}/`);
-}
-function absolutePath(path, cwd) {
-  if (path.startsWith("/"))
-    return path;
-  if (path.startsWith("~/"))
-    return path;
-  return `${cwd.replace(/\/+$/, "")}/${path}`;
-}
-var WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
-function guardWrite(target, current, claims, modes = DEFAULT_MODES, kind = "file") {
-  const hit = (rule, reason) => {
-    const mode = modes[rule];
-    return mode === "off" ? { action: "allow" } : { action: mode, rule, reason };
-  };
-  const held = claims.filter((c) => c.worktree);
-  const mine = held.find((c) => isInside(current.cwd, c.worktree)) ?? null;
-  if (modes.no_foreign_worktree !== "off") {
-    const foreign = held.find((c) => isInside(target, c.worktree) && c !== mine);
-    if (foreign) {
-      const d = hit("no_foreign_worktree", kind === "bash" ? `This command runs inside the worktree for "${foreign.task}", held by ${foreign.owner}. Never touch a worktree you don't hold \u2014 work in your own checkout, or claim the task.` : `${target} is inside the worktree for "${foreign.task}", held by ${foreign.owner}. Never touch a worktree you don't hold \u2014 edit your own checkout, or claim the task.`);
-      if (d.action !== "allow")
-        return d;
-    }
-  }
-  if (modes.claim_required_to_write !== "off" && kind === "file" && current.toplevel && !mine) {
-    const inShared = isInside(target, current.toplevel) && !held.some((c) => isInside(target, c.worktree));
-    if (inShared) {
-      const d = hit("claim_required_to_write", `This repo requires a claim before writing to its shared checkout. Run \`swarm claim <task>\` (or the swarm_claim MCP tool) and work in the worktree it creates.`);
-      if (d.action !== "allow")
-        return d;
-    }
-  }
-  return { action: "allow" };
-}
 // packages/core/src/tasks.ts
 var ID_RE = /^[A-Za-z][A-Za-z0-9_-]*\d[\w.-]*$/;
 var DEP_RE = /[A-Za-z][A-Za-z0-9_-]*\d[\w.]*/g;
@@ -945,18 +1574,150 @@ function taskBoard(tasks, activeClaims) {
     };
   });
 }
-// packages/daemon/src/app.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync4, realpathSync as realpathSync3 } from "fs";
+var TASK_SOURCE_KINDS = ["github", "linear"];
+function taskSourceKind(source) {
+  if (!source)
+    return null;
+  return TASK_SOURCE_KINDS.includes(source) ? source : "markdown";
+}
+var ACTIVE_LABEL_RE = /^(in[- ]progress|wip|doing|active|started)$/i;
+var GH_DEP_RE = /\b(?:depends on|blocked by|after|requires)\b[^\n.]*?((?:#\d+[,\s]*(?:and)?\s*)+)/gi;
+function normalizeGithubIssues(issues) {
+  return issues.filter((i) => Number.isInteger(i.number) && typeof i.title === "string").sort((a, b) => a.number - b.number).map((i) => {
+    const labels = (i.labels ?? []).map((l) => l.name);
+    const closed = (i.state ?? "").toUpperCase() === "CLOSED";
+    const active = !closed && labels.some((l) => ACTIVE_LABEL_RE.test(l));
+    const depends = [];
+    for (const m of (i.body ?? "").matchAll(GH_DEP_RE))
+      for (const n of (m[1] ?? "").matchAll(/#(\d+)/g)) {
+        const id = `GH-${n[1]}`;
+        if (!depends.includes(id))
+          depends.push(id);
+      }
+    const statusText = closed ? "closed" : active ? `in progress${i.assignees?.length ? ` (${i.assignees.map((a) => a.login).join(", ")})` : ""}` : labels.length ? labels.join(", ") : "open";
+    return {
+      id: `GH-${i.number}`,
+      title: i.title,
+      depends,
+      status: closed ? "done" : active ? "active" : "todo",
+      statusText,
+      milestone: i.milestone?.title ?? null
+    };
+  });
+}
+function normalizeLinearIssues(issues) {
+  return issues.filter((i) => typeof i.identifier === "string" && typeof i.title === "string").map((i) => {
+    const type = i.state?.type ?? "unstarted";
+    const done = type === "completed" || type === "canceled";
+    const active = type === "started";
+    const depends = (i.inverseRelations?.nodes ?? []).filter((r) => r.type === "blocks").map((r) => r.issue.identifier);
+    const statusText = `${i.state?.name ?? type}${active && i.assignee ? ` (${i.assignee.name})` : ""}`;
+    return {
+      id: i.identifier,
+      title: i.title,
+      depends: [...new Set(depends)],
+      status: done ? "done" : active ? "active" : "todo",
+      statusText,
+      milestone: i.cycle?.name ?? (i.cycle ? `Cycle ${i.cycle.number}` : i.project?.name ?? null)
+    };
+  });
+}
+function linearIssuesQuery(teamKey, first = 200) {
+  const filter = teamKey ? `, filter: { team: { key: { eq: "${teamKey.replace(/"/g, "")}" } } }` : "";
+  return `{ issues(first: ${first}, orderBy: createdAt${filter}) { nodes {
+    identifier title sortOrder
+    state { name type }
+    assignee { name }
+    project { name }
+    cycle { name number }
+    inverseRelations { nodes { type issue { identifier } } }
+  } } }`;
+}
+// packages/core/src/worktree.ts
+import { join as join3 } from "path";
+function planBootstrap(cfg, repoRoot, worktree) {
+  const seen = new Set;
+  const copies = [];
+  for (const raw of cfg.worktree.copy) {
+    if (!isRepoRelative(raw))
+      continue;
+    const rel = raw.trim().replace(/^\.\//, "");
+    if (seen.has(rel))
+      continue;
+    seen.add(rel);
+    copies.push({ rel, from: join3(repoRoot, rel), to: join3(worktree, rel) });
+  }
+  return { copies, setup: cfg.worktree.setup };
+}
+var needsBootstrap = (plan) => plan.copies.length > 0 || plan.setup !== null;
+function summarizeBootstrap(o) {
+  const parts = [];
+  if (o.copied.length)
+    parts.push(`copied ${o.copied.join(", ")}`);
+  if (o.skipped.length)
+    parts.push(`skipped ${o.skipped.join(", ")} (missing)`);
+  if (o.setup)
+    parts.push(`${o.setup.command} \u2192 ${o.setup.exitCode === 0 ? "ok" : `exit ${o.setup.exitCode}`} in ${(o.setup.durationMs / 1000).toFixed(1)}s`);
+  return parts.join("; ") || "nothing to do";
+}
+function canRemoveWorktree(w, heldByClaim, force) {
+  if (w.main)
+    return { ok: false, reason: "main" };
+  if (heldByClaim)
+    return { ok: false, reason: "held" };
+  if (force)
+    return { ok: true };
+  if (w.dirty > 0)
+    return { ok: false, reason: "dirty" };
+  if (w.ahead > 0)
+    return { ok: false, reason: "unpushed" };
+  return { ok: true };
+}
+function removeRefusalMessage(reason, path, task) {
+  switch (reason) {
+    case "main":
+      return `${path} is the main checkout \u2014 it is never removed`;
+    case "held":
+      return `${path} is held by claim ${task ?? "?"} \u2014 release the claim instead`;
+    case "dirty":
+      return `${path} has uncommitted changes \u2014 commit or stash them, or --force to discard`;
+    case "unpushed":
+      return `${path} has unpushed commits \u2014 push them, or --force to discard`;
+  }
+}
+function planGc(worktrees, claims) {
+  const held = new Map(claims.filter((c) => c.state === "held").map((c) => [c.worktree, c.task]));
+  const stale = new Set(claims.filter((c) => c.state !== "held").map((c) => c.worktree));
+  const out = [];
+  for (const w of worktrees) {
+    if (w.main || held.has(w.path))
+      continue;
+    const why = w.merged ? "merged" : stale.has(w.path) ? "released-claim" : null;
+    if (!why)
+      continue;
+    const can = canRemoveWorktree(w, null, false);
+    out.push({
+      path: w.path,
+      branch: w.branch,
+      why,
+      removable: can.ok,
+      blocker: can.ok ? null : can.reason
+    });
+  }
+  return out;
+}
+// packages/daemon/src/app.ts
+import { existsSync as existsSync6, readdirSync as readdirSync2, readFileSync as readFileSync4, realpathSync as realpathSync3 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname2, join as join7 } from "path";
+import { dirname as dirname3, join as join9 } from "path";
 import { fileURLToPath } from "url";
 
 // node_modules/.bun/hono@4.13.3/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
   return (context, next) => {
     let index = -1;
-    return dispatch(0);
-    async function dispatch(i) {
+    return dispatch2(0);
+    async function dispatch2(i) {
       if (i <= index) {
         throw new Error("next() called multiple times");
       }
@@ -972,7 +1733,7 @@ var compose = (middleware, onError, onNotFound) => {
       }
       if (handler) {
         try {
-          res = await handler(context, () => dispatch(i + 1));
+          res = await handler(context, () => dispatch2(i + 1));
         } catch (err) {
           if (err instanceof Error && onError) {
             context.error = err;
@@ -2568,16 +3329,269 @@ var streamSSE = (c, cb, onError) => {
   return c.newResponse(stream.responseReadable);
 };
 
+// packages/daemon/src/dispatcher.ts
+class Dispatcher {
+  store;
+  runner;
+  forge;
+  entries = new Map;
+  opts = new Map;
+  constructor(store, runner, forge2) {
+    this.store = store;
+    this.runner = runner;
+    this.forge = forge2;
+    runner.onEnd((run2) => void this.onRunEnd(run2));
+  }
+  project(projectId) {
+    let m = this.entries.get(projectId);
+    if (!m) {
+      m = new Map;
+      this.entries.set(projectId, m);
+    }
+    return m;
+  }
+  status(projectId) {
+    return [...this.entries.get(projectId)?.values() ?? []];
+  }
+  async dispatch(projectId, wanted, o = {}) {
+    const board = this.store.tasks(projectId);
+    if (!board)
+      return {
+        ok: false,
+        error: "this repo has no task source ([tasks] source in .swarm.toml)"
+      };
+    if (board.error)
+      return { ok: false, error: `task source: ${board.error}` };
+    const cfg = this.store.config(projectId).dispatch;
+    const opts = {
+      owner: o.owner ?? "dispatch",
+      ...o,
+      maxParallel: o.maxParallel ?? cfg.max_parallel
+    };
+    this.opts.set(projectId, opts);
+    const m = this.project(projectId);
+    const running = [...m.values()].filter((e) => e.state === "running").length;
+    const plan = planDispatch(board.tasks, wanted, {
+      maxParallel: opts.maxParallel,
+      running,
+      max: o.max,
+      alreadyQueued: [...m.values()].filter((e) => e.state !== "finished").map((e) => e.task)
+    });
+    const now = new Date().toISOString();
+    for (const t of [...plan.start, ...plan.queued]) {
+      m.set(t.id, {
+        task: t.id,
+        title: t.title,
+        state: "queued",
+        runId: null,
+        sessionId: null,
+        queuedAt: now,
+        startedAt: null,
+        endedAt: null,
+        outcome: null,
+        detail: null,
+        costUsd: null
+      });
+    }
+    if (plan.start.length || plan.queued.length)
+      this.store.append({
+        ts: now,
+        type: "dispatch.queued",
+        projectId,
+        sessionId: null,
+        payload: {
+          tasks: [...plan.start, ...plan.queued].map((t) => t.id),
+          maxParallel: opts.maxParallel,
+          summary: `dispatch ${[...plan.start, ...plan.queued].map((t) => t.id).join(", ")}`
+        }
+      });
+    const started = [];
+    const failed = [];
+    for (const t of plan.start) {
+      const r = await this.startOne(projectId, t);
+      if (r.ok)
+        started.push(t.id);
+      else
+        failed.push({ id: t.id, reason: r.reason });
+    }
+    await this.fill(projectId);
+    return {
+      ok: true,
+      started,
+      queued: plan.queued.map((t) => t.id).filter((id) => m.get(id)?.state === "queued"),
+      rejected: [...plan.rejected, ...failed]
+    };
+  }
+  async startOne(projectId, t) {
+    const m = this.project(projectId);
+    const e = m.get(t.id);
+    const opts = this.opts.get(projectId) ?? { owner: "dispatch" };
+    const cfg = this.store.config(projectId);
+    const gates2 = cfg.gates;
+    const prompt = taskPrompt(t, {
+      requiredGates: gates2.required,
+      executableGates: gates2.required.filter((g) => gates2.defs[g]),
+      openPr: cfg.dispatch.require_pr
+    });
+    const r = await this.runner.start({
+      projectId,
+      task: t.id,
+      prompt,
+      owner: opts.owner,
+      permissionMode: opts.permissionMode ?? cfg.dispatch.permission_mode ?? "acceptEdits",
+      model: opts.model ?? cfg.dispatch.model ?? undefined,
+      maxTurns: opts.maxTurns ?? cfg.dispatch.max_turns ?? undefined,
+      profile: opts.profile ?? cfg.dispatch.profile ?? undefined
+    });
+    if (!r.ok) {
+      if (e) {
+        e.state = "finished";
+        e.endedAt = new Date().toISOString();
+        e.outcome = "crashed";
+        e.detail = r.reason;
+      }
+      this.store.append({
+        ts: new Date().toISOString(),
+        type: "dispatch.finished",
+        projectId,
+        sessionId: null,
+        payload: {
+          task: t.id,
+          outcome: "crashed",
+          detail: r.reason,
+          summary: `dispatch ${t.id}: could not start \u2014 ${r.reason}`
+        }
+      });
+      return { ok: false, reason: r.reason };
+    }
+    if (e) {
+      e.state = "running";
+      e.runId = r.run.id;
+      e.sessionId = r.run.sessionId;
+      e.startedAt = r.run.startedAt;
+    }
+    this.store.append({
+      ts: r.run.startedAt,
+      type: "dispatch.started",
+      projectId,
+      sessionId: r.run.sessionId,
+      payload: {
+        task: t.id,
+        runId: r.run.id,
+        worktree: r.run.worktree,
+        summary: `dispatch ${t.id} \u2192 run ${r.run.id}`
+      }
+    });
+    return { ok: true };
+  }
+  async fill(projectId) {
+    const m = this.project(projectId);
+    const cap = this.opts.get(projectId)?.maxParallel ?? this.store.config(projectId).dispatch.max_parallel;
+    for (const e of m.values()) {
+      const running = [...m.values()].filter((x) => x.state === "running").length;
+      if (running >= cap)
+        return;
+      if (e.state !== "queued")
+        continue;
+      await this.startOne(projectId, { id: e.task, title: e.title });
+    }
+  }
+  async onRunEnd(run2) {
+    const m = this.entries.get(run2.projectId);
+    const e = m?.get(run2.task);
+    if (!e || e.runId !== run2.id)
+      return;
+    const cfg = this.store.config(run2.projectId);
+    const required = cfg.gates.required;
+    let runs = this.store.gateRuns(run2.projectId, run2.task);
+    const status = this.store.gateStatusFor(runs, required);
+    const missing = required.filter((g) => cfg.gates.defs[g] && status.find((s) => s.gate === g)?.verdict !== "pass");
+    if (missing.length && !run2.stopped) {
+      await this.store.runGates(run2.projectId, run2.task, missing, {
+        sessionId: run2.sessionId,
+        owner: "dispatch"
+      });
+      runs = this.store.gateRuns(run2.projectId, run2.task);
+    }
+    const satisfied = gatesSatisfied(runs, required);
+    await this.forge.refresh(0).catch(() => {});
+    const branch = `task/${run2.task}`;
+    const pr = this.forge.prs().find((p) => p.projectId === run2.projectId && p.branch === branch);
+    const outcome = dispatchOutcome({
+      exitCode: run2.exitCode,
+      isError: run2.result?.isError ?? false,
+      gatesSatisfied: satisfied,
+      prOpen: Boolean(pr),
+      requirePr: cfg.dispatch.require_pr,
+      stopped: run2.stopped ?? false
+    });
+    const verdicts = this.store.gateStatusFor(runs, required).map((s) => `${s.gate} ${s.verdict ?? "\u2014"}`).join(", ");
+    const detail = [
+      `exit ${run2.exitCode}${run2.result?.isError ? " (error)" : ""}`,
+      required.length ? `gates: ${verdicts}` : null,
+      pr ? `PR ${pr.url}` : cfg.dispatch.require_pr ? "no PR" : null
+    ].filter(Boolean).join(" \xB7 ");
+    e.state = "finished";
+    e.endedAt = run2.endedAt;
+    e.outcome = outcome;
+    e.detail = detail;
+    e.costUsd = run2.result?.costUsd ?? null;
+    const ts = run2.endedAt ?? new Date().toISOString();
+    this.store.append({
+      ts,
+      type: "dispatch.finished",
+      projectId: run2.projectId,
+      sessionId: run2.sessionId,
+      payload: {
+        task: run2.task,
+        runId: run2.id,
+        outcome,
+        detail,
+        costUsd: e.costUsd,
+        summary: `dispatch ${run2.task}: ${outcome} \u2014 ${detail}`
+      }
+    });
+    if (outcome !== "done" && outcome !== "stopped")
+      this.store.append({
+        ts,
+        type: "incident.opened",
+        projectId: run2.projectId,
+        sessionId: run2.sessionId,
+        payload: {
+          rule: "dispatch_failed",
+          action: outcome,
+          command: run2.task,
+          reason: `dispatched run on ${run2.task} ended ${outcome}: ${detail}. The worktree and claim are kept; resume it from the session page or release it.`
+        }
+      });
+    this.store.touch();
+    await this.fill(run2.projectId);
+  }
+  clear(projectId, task) {
+    const m = this.project(projectId);
+    let n = 0;
+    for (const [id, e] of m) {
+      if (task && id !== task)
+        continue;
+      if (e.state === "queued" || e.state === "finished" && !task) {
+        m.delete(id);
+        n++;
+      }
+    }
+    return n;
+  }
+}
+
 // packages/daemon/src/forge.ts
 import { existsSync as existsSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var EXTRA_BIN_DIRS = [
   "/opt/homebrew/bin",
   "/usr/local/bin",
   "/home/linuxbrew/.linuxbrew/bin",
-  join3(homedir2(), ".local", "bin"),
-  join3(homedir2(), "bin")
+  join4(homedir2(), ".local", "bin"),
+  join4(homedir2(), "bin")
 ];
 function findBin(name) {
   if (!name)
@@ -2586,7 +3600,7 @@ function findBin(name) {
   if (onPath)
     return onPath;
   for (const d of EXTRA_BIN_DIRS) {
-    const p = join3(d, name);
+    const p = join4(d, name);
     if (existsSync3(p))
       return p;
   }
@@ -2653,31 +3667,301 @@ class ForgeService {
       if (out)
         prs = normalizeGitlab(JSON.parse(out), remote.repo);
     }
-    return prs.map((pr) => ({ ...pr, projectId, projectRoot: root }));
+    return prs.map((pr) => ({ ...pr, projectId, projectRoot: root }));
+  }
+  async openPR(projectId, worktree2, draft) {
+    const p = this.store.projects().find((x) => x.id === projectId);
+    if (!p)
+      return { ok: false, error: "unknown project" };
+    if (worktree2.main)
+      return { ok: false, error: "that is the main checkout \u2014 open the PR from a task worktree" };
+    if (!worktree2.branch)
+      return { ok: false, error: "detached HEAD \u2014 check out a branch first" };
+    if (worktree2.dirty > 0)
+      return {
+        ok: false,
+        error: `${worktree2.path} has uncommitted changes \u2014 commit them first (Swarm never commits for you)`
+      };
+    const remote = this.remote(p.root);
+    if (!remote)
+      return { ok: false, error: "no GitHub/GitLab remote on origin" };
+    const cli = remote.forge === "github" ? "gh" : "glab";
+    const bin = findBin(cli);
+    if (!bin)
+      return { ok: false, error: `${cli} is not installed` };
+    const sh = async (cmd2, cwd) => {
+      const proc = Bun.spawn(cmd2, { cwd, stdout: "pipe", stderr: "pipe" });
+      const out = await new Response(proc.stdout).text() + await new Response(proc.stderr).text();
+      return { ok: await proc.exited === 0, out: out.trim() };
+    };
+    const push = await sh(["git", "push", "-u", "origin", worktree2.branch], worktree2.path);
+    if (!push.ok)
+      return { ok: false, error: `git push failed: ${push.out.slice(0, 400)}` };
+    const existing = this.prs().find((x) => x.projectId === projectId && x.branch === worktree2.branch);
+    if (existing)
+      return { ok: true, url: existing.url, number: existing.number };
+    const cmd = remote.forge === "github" ? [
+      bin,
+      "pr",
+      "create",
+      "--head",
+      worktree2.branch,
+      "--title",
+      draft.title,
+      "--body",
+      draft.body,
+      ...draft.isDraft ? ["--draft"] : []
+    ] : [
+      bin,
+      "mr",
+      "create",
+      "--source-branch",
+      worktree2.branch,
+      "--title",
+      draft.title,
+      "--description",
+      draft.body,
+      "--yes",
+      ...draft.isDraft ? ["--draft"] : []
+    ];
+    const r = await sh(cmd, worktree2.path);
+    if (!r.ok)
+      return { ok: false, error: `${cli} failed: ${r.out.slice(0, 400)}` };
+    const url = r.out.match(/https?:\/\/\S+/)?.[0] ?? r.out;
+    const num = Number(url.match(/\/(\d+)\s*$/)?.[1]);
+    this.cache.delete(projectId);
+    return { ok: true, url, number: Number.isFinite(num) ? num : null };
+  }
+  async merge(projectId, number) {
+    const p = this.store.projects().find((x) => x.id === projectId);
+    if (!p)
+      return { ok: false, output: "unknown project" };
+    const remote = this.remote(p.root);
+    if (!remote)
+      return { ok: false, output: "no forge remote" };
+    const cmd = remote.forge === "github" ? ["gh", "pr", "merge", String(number), "--squash"] : ["glab", "mr", "merge", String(number), "--squash", "--yes"];
+    const bin = findBin(cmd[0]);
+    if (!bin)
+      return { ok: false, output: `${cmd[0] ?? "forge CLI"} is not installed` };
+    const proc = Bun.spawn([bin, ...cmd.slice(1)], { cwd: p.root, stdout: "pipe", stderr: "pipe" });
+    const out = await new Response(proc.stdout).text() + await new Response(proc.stderr).text();
+    const ok = await proc.exited === 0;
+    if (ok)
+      this.cache.delete(projectId);
+    return { ok, output: out.trim().slice(0, 800) };
+  }
+}
+
+// packages/daemon/src/git.ts
+import { realpathSync } from "fs";
+import { join as join5 } from "path";
+function git(cwd, args) {
+  try {
+    const r = Bun.spawnSync(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore" });
+    return r.exitCode === 0 ? r.stdout.toString() : null;
+  } catch {
+    return null;
+  }
+}
+function gitCommonDir(cwd) {
+  const out = git(cwd, ["rev-parse", "--git-common-dir"])?.trim();
+  if (!out)
+    return null;
+  try {
+    return realpathSync(out.startsWith("/") ? out : join5(cwd, out));
+  } catch {
+    return null;
+  }
+}
+function gitToplevel(cwd) {
+  const out = git(cwd, ["rev-parse", "--show-toplevel"])?.trim();
+  if (!out)
+    return null;
+  try {
+    return realpathSync(out);
+  } catch {
+    return null;
+  }
+}
+function parseWorktreeList(out) {
+  const wts = [];
+  let cur = null;
+  const flush = () => {
+    if (cur?.path) {
+      wts.push({
+        path: cur.path,
+        branch: cur.branch ?? null,
+        head: (cur.head ?? "").slice(0, 7),
+        main: wts.length === 0,
+        dirty: -1,
+        ahead: -1,
+        behind: -1,
+        merged: false
+      });
+    }
+    cur = null;
+  };
+  for (const line of out.split(`
+`)) {
+    if (line.startsWith("worktree ")) {
+      flush();
+      cur = { path: line.slice(9) };
+    } else if (line.startsWith("HEAD ") && cur)
+      cur.head = line.slice(5);
+    else if (line.startsWith("branch ") && cur)
+      cur.branch = line.slice(7).replace(/^refs\/heads\//, "");
+    else if (line === "")
+      flush();
+  }
+  flush();
+  return wts;
+}
+function applyStatus(w, st, ah) {
+  w.dirty = st === null ? -1 : st.split(`
+`).filter(Boolean).length;
+  const a = ah?.trim();
+  w.ahead = a === undefined || a === "" ? -1 : Number(a);
+}
+function applyDrift(w, behind, ancestor, firstParents) {
+  const b = behind?.trim();
+  w.behind = b === undefined || b === "" ? -1 : Number(b);
+  const onLine = firstParents?.split(`
+`).some((sha) => sha.startsWith(w.head)) ?? true;
+  w.merged = ancestor && !onLine;
+}
+var FIRST_PARENT_DEPTH = "5000";
+var baseOf = (wts) => wts[0]?.main ? wts[0].branch : null;
+async function gitAsync(cwd, args) {
+  try {
+    const p = Bun.spawn(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore" });
+    const [out, code] = await Promise.all([new Response(p.stdout).text(), p.exited]);
+    return code === 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+async function listWorktreesAsync(root) {
+  const out = await gitAsync(root, ["worktree", "list", "--porcelain"]);
+  if (!out)
+    return [];
+  const wts = parseWorktreeList(out);
+  const base = baseOf(wts);
+  const line = base ? await gitAsync(root, ["rev-list", "--first-parent", "-n", FIRST_PARENT_DEPTH, base]) : null;
+  await Promise.all(wts.map(async (w) => {
+    const drift = base && !w.main;
+    const [st, ah, be, mg] = await Promise.all([
+      gitAsync(w.path, ["status", "--porcelain", "--untracked-files=no"]),
+      gitAsync(w.path, ["rev-list", "--count", "@{upstream}..HEAD"]),
+      drift ? gitAsync(w.path, ["rev-list", "--count", `HEAD..${base}`]) : null,
+      drift ? gitAsync(w.path, ["merge-base", "--is-ancestor", "HEAD", base]) : null
+    ]);
+    applyStatus(w, st, ah);
+    if (drift)
+      applyDrift(w, be, mg !== null, line);
+  }));
+  return wts;
+}
+var branchCache = new Map;
+function currentBranch(cwd) {
+  const hit = branchCache.get(cwd);
+  const now = Date.now();
+  if (hit && now - hit.t < 5000)
+    return hit.v;
+  const v = git(cwd, ["rev-parse", "--abbrev-ref", "HEAD"])?.trim() ?? null;
+  branchCache.set(cwd, { v: v === "HEAD" ? "(detached)" : v, t: now });
+  return branchCache.get(cwd)?.v ?? null;
+}
+function worktreeAdd(repoRoot, path, branch, baseRef = "HEAD") {
+  const branchExists = git(repoRoot, ["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`]) !== null;
+  const args = branchExists ? ["worktree", "add", path, branch] : ["worktree", "add", "-b", branch, path, baseRef];
+  if (git(repoRoot, args) === null)
+    return null;
+  try {
+    return realpathSync(path);
+  } catch {
+    return path;
+  }
+}
+function worktreeRemove(repoRoot, path, force) {
+  const args = ["worktree", "remove", path];
+  if (force)
+    args.push("--force");
+  return git(repoRoot, args) !== null;
+}
+function heldWork(path) {
+  const status = git(path, ["status", "--porcelain"]);
+  const dirty = status !== null && status.trim().length > 0;
+  const count = (args) => {
+    const out = git(path, ["rev-list", "--count", ...args])?.trim();
+    return out !== undefined && out !== "" ? Number(out) : 0;
+  };
+  let unpushed;
+  if (git(path, ["rev-parse", "--verify", "--quiet", "@{upstream}"]) !== null) {
+    unpushed = count(["@{upstream}..HEAD"]) > 0;
+  } else {
+    const baselines = ["--remotes"];
+    for (const b of ["main", "master"]) {
+      if (git(path, ["rev-parse", "--verify", "--quiet", `refs/heads/${b}`]) !== null)
+        baselines.push(b);
+    }
+    unpushed = baselines.length > 1 ? count(["HEAD", "--not", ...baselines]) > 0 : false;
+  }
+  return { dirty, unpushed };
+}
+async function worktreeDiff(root, path) {
+  const wts = parseWorktreeList(await gitAsync(root, ["worktree", "list", "--porcelain"]) ?? "");
+  const baseRef = wts[0]?.path === realpathOr(root) || wts[0]?.main ? wts[0]?.branch ?? null : null;
+  const isMain = wts[0]?.path === path;
+  const mb = baseRef && !isMain ? (await gitAsync(path, ["merge-base", baseRef, "HEAD"]))?.trim() : null;
+  const from = mb || "HEAD";
+  const [numstat, names, log, status] = await Promise.all([
+    gitAsync(path, ["diff", "--numstat", from]),
+    gitAsync(path, ["diff", "--name-status", from]),
+    mb ? gitAsync(path, ["log", "--format=%s", `${mb}..HEAD`]) : Promise.resolve(""),
+    gitAsync(path, ["status", "--porcelain"])
+  ]);
+  const files = parseNumstat(numstat ?? "", names ?? "");
+  for (const line of (status ?? "").split(`
+`)) {
+    if (line.startsWith("?? "))
+      files.push({ path: line.slice(3), added: -1, deleted: -1, status: "?" });
+  }
+  return {
+    base: mb ?? null,
+    baseRef,
+    files,
+    commits: (log ?? "").split(`
+`).filter(Boolean),
+    dirty: (status ?? "").trim().length > 0
+  };
+}
+async function worktreePatch(path, base, file) {
+  const from = base ?? "HEAD";
+  if (file) {
+    const tracked = await gitAsync(path, ["ls-files", "--error-unmatch", "--", file]) !== null;
+    if (!tracked) {
+      const p = Bun.spawn(["git", "-C", path, "diff", "--no-index", "--", "/dev/null", file], {
+        stdout: "pipe",
+        stderr: "ignore"
+      });
+      const [out] = await Promise.all([new Response(p.stdout).text(), p.exited]);
+      return out;
+    }
+    return await gitAsync(path, ["diff", from, "--", file]) ?? "";
   }
-  async merge(projectId, number) {
-    const p = this.store.projects().find((x) => x.id === projectId);
-    if (!p)
-      return { ok: false, output: "unknown project" };
-    const remote = this.remote(p.root);
-    if (!remote)
-      return { ok: false, output: "no forge remote" };
-    const cmd = remote.forge === "github" ? ["gh", "pr", "merge", String(number), "--squash"] : ["glab", "mr", "merge", String(number), "--squash", "--yes"];
-    const bin = findBin(cmd[0]);
-    if (!bin)
-      return { ok: false, output: `${cmd[0] ?? "forge CLI"} is not installed` };
-    const proc = Bun.spawn([bin, ...cmd.slice(1)], { cwd: p.root, stdout: "pipe", stderr: "pipe" });
-    const out = await new Response(proc.stdout).text() + await new Response(proc.stderr).text();
-    const ok = await proc.exited === 0;
-    if (ok)
-      this.cache.delete(projectId);
-    return { ok, output: out.trim().slice(0, 800) };
+  return await gitAsync(path, ["diff", from]) ?? "";
+}
+function realpathOr(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
   }
 }
 
 // packages/daemon/src/runner.ts
 import { appendFileSync, mkdirSync as mkdirSync2, openSync } from "fs";
-import { join as join4 } from "path";
+import { join as join6 } from "path";
 var PERMISSION_MODES = [
   "acceptEdits",
   "auto",
@@ -2691,6 +3975,11 @@ class Runner {
   store;
   home;
   live = new Map;
+  endListeners = new Set;
+  onEnd(fn) {
+    this.endListeners.add(fn);
+    return () => this.endListeners.delete(fn);
+  }
   constructor(store, home) {
     this.store = store;
     this.home = home;
@@ -2721,18 +4010,19 @@ class Runner {
         reason: `a run on ${input.task} is already live \u2014 stop it or send it input`
       };
     const held = this.store.claims(input.projectId).find((c) => c.task === input.task && c.state === "held" && c.owner === input.owner);
-    let worktree = held?.worktree ?? "";
-    if (!worktree) {
+    let worktree2 = held?.worktree ?? "";
+    if (!worktree2) {
       const c = this.store.claim(input.projectId, input.task, input.owner);
       if (!c.ok)
         return { ok: false, reason: c.error };
-      worktree = c.worktree;
+      worktree2 = c.worktree;
     }
+    await this.store.awaitBootstrap(worktree2);
     const sessionId = crypto.randomUUID();
     const id = sessionId.slice(0, 8);
-    const logDir = join4(this.home, "logs", project.id);
+    const logDir = join6(this.home, "logs", project.id);
     mkdirSync2(logDir, { recursive: true });
-    const log = join4(logDir, `run-${input.task.replace(/[^a-zA-Z0-9_.-]+/g, "-")}-${id}.log`);
+    const log = join6(logDir, `run-${input.task.replace(/[^a-zA-Z0-9_.-]+/g, "-")}-${id}.log`);
     const logFd = openSync(log, "a");
     const args = [
       bin,
@@ -2751,13 +4041,22 @@ class Runner {
       args.push("--model", input.model);
     if (input.permissionMode)
       args.push("--permission-mode", input.permissionMode);
-    if (input.allowedTools?.length)
-      args.push("--allowedTools", ...input.allowedTools);
+    const profile = runProfile(input.profile);
+    if (input.profile && !profile)
+      return {
+        ok: false,
+        reason: `unknown profile ${input.profile} \u2014 one of ${Object.keys(RUN_PROFILES).join(", ")}`
+      };
+    const allowed = [...input.allowedTools ?? [], ...profile?.allowedTools ?? []];
+    if (allowed.length)
+      args.push("--allowedTools", ...allowed);
+    if (profile?.disallowedTools.length)
+      args.push("--disallowedTools", ...profile.disallowedTools);
     if (input.maxTurns)
       args.push("--max-turns", String(input.maxTurns));
-    this.store.preregisterSpawnedSession(sessionId, project.id, worktree, input.task);
+    this.store.preregisterSpawnedSession(sessionId, project.id, worktree2, input.task);
     const proc = Bun.spawn(args, {
-      cwd: worktree,
+      cwd: worktree2,
       env: { ...process.env, SWARM_RUN_ID: id, SWARM_OWNER: input.owner },
       stdin: "pipe",
       stdout: "pipe",
@@ -2768,11 +4067,12 @@ class Runner {
       sessionId,
       projectId: project.id,
       task: input.task,
-      worktree,
+      worktree: worktree2,
       pid: proc.pid,
       owner: input.owner,
       model: input.model ?? null,
       permissionMode: input.permissionMode ?? null,
+      profile: input.profile ?? null,
       prompt: input.prompt,
       log,
       startedAt: new Date().toISOString(),
@@ -2788,7 +4088,7 @@ class Runner {
       sessionId,
       kind: "proc",
       name: `run:${input.task}`,
-      cwd: worktree,
+      cwd: worktree2,
       cmd: `claude -p (run ${id})`,
       owner: input.owner,
       log
@@ -2853,6 +4153,13 @@ class Runner {
     });
     this.store.endSpawnedSession(entry.run.sessionId);
     this.live.delete(id);
+    for (const fn of this.endListeners) {
+      try {
+        fn(entry.run);
+      } catch (e) {
+        console.error("swarm run: onEnd listener failed:", e.message);
+      }
+    }
   }
   onLine(run2, line) {
     if (!line.startsWith("{"))
@@ -2976,6 +4283,7 @@ class Runner {
     if (!run2)
       return { ok: false, reason: "no live run" };
     const entry = this.live.get(run2.id);
+    run2.stopped = true;
     try {
       const stdin = entry?.proc.stdin;
       if (stdin && typeof stdin !== "number")
@@ -2992,9 +4300,9 @@ class Runner {
 import { Database } from "bun:sqlite";
 import {
   closeSync,
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync3,
-  openSync as openSync2,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync4,
+  openSync as openSync3,
   readdirSync,
   readFileSync as readFileSync3,
   readSync,
@@ -3004,145 +4312,131 @@ import {
   writeFileSync as writeFileSync2
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename, dirname, join as join6 } from "path";
+import { basename, dirname as dirname2, join as join8 } from "path";
 
-// packages/daemon/src/git.ts
-import { realpathSync } from "fs";
-import { join as join5 } from "path";
-function git(cwd, args) {
-  try {
-    const r = Bun.spawnSync(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore" });
-    return r.exitCode === 0 ? r.stdout.toString() : null;
-  } catch {
-    return null;
-  }
-}
-function gitCommonDir(cwd) {
-  const out = git(cwd, ["rev-parse", "--git-common-dir"])?.trim();
-  if (!out)
-    return null;
-  try {
-    return realpathSync(out.startsWith("/") ? out : join5(cwd, out));
-  } catch {
-    return null;
-  }
-}
-function gitToplevel(cwd) {
-  const out = git(cwd, ["rev-parse", "--show-toplevel"])?.trim();
-  if (!out)
-    return null;
-  try {
-    return realpathSync(out);
-  } catch {
-    return null;
+// packages/daemon/src/bootstrap.ts
+import { cpSync, existsSync as existsSync4, mkdirSync as mkdirSync3, openSync as openSync2 } from "fs";
+import { dirname, join as join7 } from "path";
+function runBootstrap(plan, opts) {
+  const logDir = join7(opts.home, "logs", opts.projectId);
+  mkdirSync3(logDir, { recursive: true });
+  const log = join7(logDir, `bootstrap-${opts.task.replace(/[^a-zA-Z0-9_.-]+/g, "-")}.log`);
+  const copied = [];
+  const skipped = [];
+  for (const c of plan.copies) {
+    if (!existsSync4(c.from)) {
+      skipped.push(c.rel);
+      continue;
+    }
+    try {
+      mkdirSync3(dirname(c.to), { recursive: true });
+      cpSync(c.from, c.to, { recursive: true, force: true });
+      copied.push(c.rel);
+    } catch (e) {
+      skipped.push(`${c.rel} (${e.message})`);
+    }
   }
-}
-function parseWorktreeList(out) {
-  const wts = [];
-  let cur = null;
-  const flush = () => {
-    if (cur?.path) {
-      wts.push({
-        path: cur.path,
-        branch: cur.branch ?? null,
-        head: (cur.head ?? "").slice(0, 7),
-        main: wts.length === 0,
-        dirty: -1,
-        ahead: -1
+  const done = (async () => {
+    if (!plan.setup)
+      return { copied, skipped, setup: null };
+    const command = plan.setup;
+    const started = Date.now();
+    let exitCode = -1;
+    try {
+      const fd = openSync2(log, "a");
+      const proc = Bun.spawn(["sh", "-c", command], {
+        cwd: opts.worktree,
+        stdin: "ignore",
+        stdout: fd,
+        stderr: fd,
+        env: { ...process.env, SWARM_WORKTREE: opts.worktree, SWARM_TASK: opts.task }
       });
+      exitCode = await proc.exited;
+    } catch (e) {
+      exitCode = -1;
+      await Bun.write(log, `swarm: could not start setup: ${e.message}
+`);
     }
-    cur = null;
-  };
-  for (const line of out.split(`
-`)) {
-    if (line.startsWith("worktree ")) {
-      flush();
-      cur = { path: line.slice(9) };
-    } else if (line.startsWith("HEAD ") && cur)
-      cur.head = line.slice(5);
-    else if (line.startsWith("branch ") && cur)
-      cur.branch = line.slice(7).replace(/^refs\/heads\//, "");
-    else if (line === "")
-      flush();
-  }
-  flush();
-  return wts;
+    return { copied, skipped, setup: { command, exitCode, durationMs: Date.now() - started } };
+  })();
+  return { log, done };
 }
-function applyStatus(w, st, ah) {
-  w.dirty = st === null ? -1 : st.split(`
-`).filter(Boolean).length;
-  const a = ah?.trim();
-  w.ahead = a === undefined || a === "" ? -1 : Number(a);
-}
-async function gitAsync(cwd, args) {
-  try {
-    const p = Bun.spawn(["git", "-C", cwd, ...args], { stdout: "pipe", stderr: "ignore" });
-    const [out, code] = await Promise.all([new Response(p.stdout).text(), p.exited]);
-    return code === 0 ? out : null;
-  } catch {
-    return null;
+
+// packages/daemon/src/task-sources.ts
+class TaskSources {
+  env;
+  cache = new Map;
+  inflight = new Set;
+  constructor(env = process.env) {
+    this.env = env;
+  }
+  get(projectId, kind, root, opts, ttlMs = 60000) {
+    const hit = this.cache.get(projectId);
+    if (!hit || Date.now() - hit.at >= ttlMs)
+      this.refresh(projectId, kind, root, opts);
+    return hit ?? { at: 0, tasks: [], error: null };
+  }
+  async refresh(projectId, kind, root, opts) {
+    if (this.inflight.has(projectId))
+      return this.cache.get(projectId) ?? { at: 0, tasks: [], error: null };
+    this.inflight.add(projectId);
+    const prev = this.cache.get(projectId);
+    let entry;
+    try {
+      const tasks2 = kind === "github" ? await this.github(root, opts.labels) : await this.linear(opts.team);
+      entry = { at: Date.now(), tasks: tasks2, error: null };
+    } catch (e) {
+      entry = { at: Date.now(), tasks: prev?.tasks ?? [], error: e.message };
+    } finally {
+      this.inflight.delete(projectId);
+    }
+    this.cache.set(projectId, entry);
+    return entry;
   }
-}
-async function listWorktreesAsync(root) {
-  const out = await gitAsync(root, ["worktree", "list", "--porcelain"]);
-  if (!out)
-    return [];
-  const wts = parseWorktreeList(out);
-  await Promise.all(wts.map(async (w) => {
-    const [st, ah] = await Promise.all([
-      gitAsync(w.path, ["status", "--porcelain", "--untracked-files=no"]),
-      gitAsync(w.path, ["rev-list", "--count", "@{upstream}..HEAD"])
+  async github(root, labels) {
+    const bin = findBin("gh");
+    if (!bin)
+      throw new Error("gh not installed \u2014 GitHub Issues need the gh CLI (brew install gh)");
+    const args = [
+      bin,
+      "issue",
+      "list",
+      "--state",
+      "all",
+      "--limit",
+      "300",
+      "--json",
+      "number,title,state,labels,body,assignees,milestone"
+    ];
+    for (const l of labels)
+      args.push("--label", l);
+    const proc = Bun.spawn(args, { cwd: root, stdout: "pipe", stderr: "pipe" });
+    const [out, err, code] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited
     ]);
-    applyStatus(w, st, ah);
-  }));
-  return wts;
-}
-var branchCache = new Map;
-function currentBranch(cwd) {
-  const hit = branchCache.get(cwd);
-  const now = Date.now();
-  if (hit && now - hit.t < 5000)
-    return hit.v;
-  const v = git(cwd, ["rev-parse", "--abbrev-ref", "HEAD"])?.trim() ?? null;
-  branchCache.set(cwd, { v: v === "HEAD" ? "(detached)" : v, t: now });
-  return branchCache.get(cwd)?.v ?? null;
-}
-function worktreeAdd(repoRoot, path, branch, baseRef = "HEAD") {
-  const branchExists = git(repoRoot, ["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`]) !== null;
-  const args = branchExists ? ["worktree", "add", path, branch] : ["worktree", "add", "-b", branch, path, baseRef];
-  if (git(repoRoot, args) === null)
-    return null;
-  try {
-    return realpathSync(path);
-  } catch {
-    return path;
-  }
-}
-function worktreeRemove(repoRoot, path, force) {
-  const args = ["worktree", "remove", path];
-  if (force)
-    args.push("--force");
-  return git(repoRoot, args) !== null;
-}
-function heldWork(path) {
-  const status = git(path, ["status", "--porcelain"]);
-  const dirty = status !== null && status.trim().length > 0;
-  const count = (args) => {
-    const out = git(path, ["rev-list", "--count", ...args])?.trim();
-    return out !== undefined && out !== "" ? Number(out) : 0;
-  };
-  let unpushed;
-  if (git(path, ["rev-parse", "--verify", "--quiet", "@{upstream}"]) !== null) {
-    unpushed = count(["@{upstream}..HEAD"]) > 0;
-  } else {
-    const baselines = ["--remotes"];
-    for (const b of ["main", "master"]) {
-      if (git(path, ["rev-parse", "--verify", "--quiet", `refs/heads/${b}`]) !== null)
-        baselines.push(b);
-    }
-    unpushed = baselines.length > 1 ? count(["HEAD", "--not", ...baselines]) > 0 : false;
+    if (code !== 0)
+      throw new Error(`gh issue list failed: ${err.trim().split(`
+`)[0] ?? code}`);
+    return normalizeGithubIssues(JSON.parse(out));
+  }
+  async linear(team) {
+    const key = this.env.LINEAR_API_KEY;
+    if (!key)
+      throw new Error("LINEAR_API_KEY not set \u2014 export it in the environment swarmd starts from (never stored)");
+    const r = await fetch("https://api.linear.app/graphql", {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: key },
+      body: JSON.stringify({ query: linearIssuesQuery(team) })
+    });
+    if (!r.ok)
+      throw new Error(`Linear API ${r.status}`);
+    const j = await r.json();
+    if (j.errors?.length)
+      throw new Error(`Linear: ${j.errors[0]?.message}`);
+    return normalizeLinearIssues(j.data?.issues?.nodes ?? []);
   }
-  return { dirty, unpushed };
 }
 
 // packages/daemon/src/store.ts
@@ -3171,6 +4465,10 @@ CREATE TABLE IF NOT EXISTS resources (
   PRIMARY KEY (name, project_id)
 );
 CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, value TEXT);
+CREATE VIRTUAL TABLE IF NOT EXISTS memory USING fts5(
+  kind UNINDEXED, ref UNINDEXED, project_id UNINDEXED, task, session_id UNINDEXED, ts UNINDEXED,
+  title, text, tokenize = 'unicode61 remove_diacritics 2'
+);
 CREATE TABLE IF NOT EXISTS incident_acks (seq INTEGER PRIMARY KEY, acked_at TEXT);
 CREATE TABLE IF NOT EXISTS processes (
   pid INTEGER, start_time TEXT, project_id TEXT, session_id TEXT, kind TEXT, name TEXT, port INTEGER,
@@ -3187,6 +4485,12 @@ CREATE TABLE IF NOT EXISTS handoffs (
   files TEXT, verify TEXT, by TEXT, session_id TEXT, created_at TEXT
 );
 CREATE INDEX IF NOT EXISTS handoffs_task ON handoffs(project_id, task, created_at);
+CREATE TABLE IF NOT EXISTS messages (
+  id INTEGER PRIMARY KEY AUTOINCREMENT, project_id TEXT, session_id TEXT, task TEXT, kind TEXT,
+  text TEXT, options TEXT, asked_by TEXT, created_at TEXT,
+  answer TEXT, answered_by TEXT, answered_at TEXT, delivered_at TEXT
+);
+CREATE INDEX IF NOT EXISTS messages_open ON messages(project_id, answered_at, delivered_at);
 CREATE TABLE IF NOT EXISTS claims (
   project_id TEXT, task TEXT, owner TEXT, worktree TEXT, branch TEXT,
   acquired_at TEXT, expires_at TEXT, released_at TEXT, state TEXT,
@@ -3207,18 +4511,19 @@ class Store {
   gen = 0;
   memo = new Map;
   constructor(home = swarmHome()) {
-    mkdirSync3(home, { recursive: true });
+    mkdirSync4(home, { recursive: true });
     this.home = home;
-    this.db = new Database(join6(home, "swarm.db"));
+    this.db = new Database(join8(home, "swarm.db"));
     this.loadPricing();
     this.db.exec("PRAGMA journal_mode=WAL; PRAGMA synchronous=NORMAL; PRAGMA mmap_size=268435456; PRAGMA cache_size=-32000;");
     this.db.exec(SCHEMA);
     this.ensureColumn("sessions", "agent", "TEXT DEFAULT 'claude-code'");
     this.ensureColumn("projects", "sort_order", "INTEGER");
-    this.migrateProjectsJson(join6(home, "projects.json"));
+    this.migrateProjectsJson(join8(home, "projects.json"));
     this.reconcileMovedProjects();
     this.slimExistingEvents();
     this.retypeNotificationIncidents();
+    this.backfillMemory();
   }
   retypeNotificationIncidents() {
     if (this.meta("notifications_retyped") === "1")
@@ -3262,9 +4567,9 @@ class Store {
   reconcileMovedProjects() {
     const all = this.projects();
     for (const stale of all) {
-      if (existsSync4(stale.root))
+      if (existsSync5(stale.root))
         continue;
-      const live = all.filter((p) => p.id !== stale.id && p.name === stale.name && existsSync4(p.root));
+      const live = all.filter((p) => p.id !== stale.id && p.name === stale.name && existsSync5(p.root));
       if (live.length !== 1)
         continue;
       this.mergeProject(stale.id, live[0].id);
@@ -3297,7 +4602,7 @@ class Store {
     }
   }
   migrateProjectsJson(file) {
-    if (!existsSync4(file))
+    if (!existsSync5(file))
       return;
     try {
       const list = JSON.parse(readFileSync3(file, "utf8"));
@@ -3312,7 +4617,7 @@ class Store {
     const hit = this.topCache.get(cwd);
     if (hit && Date.now() - hit.t < 1e4)
       return hit.v;
-    const v = cwd && existsSync4(cwd) ? gitToplevel(cwd) : null;
+    const v = cwd && existsSync5(cwd) ? gitToplevel(cwd) : null;
     this.topCache.set(cwd, { v, t: Date.now() });
     return v;
   }
@@ -3345,8 +4650,9 @@ class Store {
       createdAt: new Date().toISOString()
     };
     const sessionId = this.knownSession(h.sessionId);
-    this.db.query(`INSERT INTO handoffs (project_id, task, done, remaining, files, verify, by, session_id, created_at)
+    const ins = this.db.query(`INSERT INTO handoffs (project_id, task, done, remaining, files, verify, by, session_id, created_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(projectId, handoff.task, handoff.done, handoff.remaining, JSON.stringify(handoff.files), handoff.verify, handoff.by, sessionId, handoff.createdAt);
+    this.remember(handoffDoc(projectId, Number(ins.lastInsertRowid), handoff, sessionId));
     this.append({
       ts: handoff.createdAt,
       type: "handoff.recorded",
@@ -3383,8 +4689,140 @@ class Store {
       sessionId: r.session_id ?? null
     }));
   }
+  autoHandoff(sessionId, cwd) {
+    const held = this.heldClaimsWithWorktree().find((c) => isInside(cwd, c.worktree));
+    if (!held)
+      return null;
+    const manual = this.db.query("SELECT id, by FROM handoffs WHERE project_id = ? AND task = ? AND session_id = ?").all(held.projectId, held.task, sessionId);
+    if (manual.some((h2) => !isAutoHandoff(h2)))
+      return null;
+    const row = this.db.query("SELECT last_text FROM sessions WHERE id = ?").get(sessionId);
+    const h = deriveHandoff(held.task, this.sessionEvents(sessionId, 2000), { lastText: row?.last_text ?? null, sessionId });
+    if (!h)
+      return null;
+    this.db.query("DELETE FROM handoffs WHERE project_id = ? AND task = ? AND session_id = ? AND by LIKE 'auto%'").run(held.projectId, held.task, sessionId);
+    const ins = this.db.query(`INSERT INTO handoffs (project_id, task, done, remaining, files, verify, by, session_id, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(held.projectId, held.task, h.done, h.remaining, JSON.stringify(h.files), h.verify, h.by, sessionId, h.createdAt);
+    this.remember(handoffDoc(held.projectId, Number(ins.lastInsertRowid), h, sessionId));
+    this.touch();
+    return h;
+  }
+  resumePlan(sessionId) {
+    const s = this.db.query("SELECT project_id, cwd, last_text FROM sessions WHERE id = ?").get(sessionId);
+    if (!s)
+      return { ok: false, reason: "unknown session" };
+    const byHandoff = this.db.query("SELECT project_id, task FROM handoffs WHERE session_id = ? ORDER BY id DESC LIMIT 1").get(sessionId);
+    const claim = this.claimRows(s.project_id).find((c) => c.worktree && s.cwd && isInside(s.cwd, c.worktree));
+    const task = byHandoff?.task ?? claim?.task;
+    const projectId = byHandoff?.project_id ?? s.project_id;
+    if (!task)
+      return { ok: false, reason: "this session was not working on a claimed task" };
+    const ev = this.sessionEvents(sessionId, 2000);
+    let handoff = this.latestHandoff(projectId, task);
+    if (!handoff)
+      handoff = deriveHandoff(task, ev, {
+        lastText: s.last_text,
+        sessionId
+      });
+    if (!handoff)
+      return { ok: false, reason: "nothing to resume \u2014 the session left no trail" };
+    const tail = ev.filter((e) => e.type === "tool.requested" || e.type === "prompt.submitted").slice(-12).map((e) => (e.payload.summary ?? e.type).slice(0, 160));
+    const owner = claim && claim.state === "held" ? claim.owner : null;
+    return { ok: true, projectId, task, owner, prompt: formatResumePrompt(handoff, tail), handoff };
+  }
+  remember(doc) {
+    if (!doc)
+      return;
+    this.db.query("DELETE FROM memory WHERE kind = ? AND ref = ?").run(doc.kind, doc.ref);
+    this.db.query("INSERT INTO memory (kind, ref, project_id, task, session_id, ts, title, text) VALUES (?, ?, ?, ?, ?, ?, ?, ?)").run(doc.kind, doc.ref, doc.projectId, doc.task, doc.sessionId, doc.ts, doc.title, doc.text);
+  }
+  rememberSession(sessionId) {
+    const r = this.db.query("SELECT id, project_id, title, last_text, last_seen_at, cwd FROM sessions WHERE id = ?").get(sessionId);
+    if (!r)
+      return;
+    const held = r.cwd ? this.heldClaimsWithWorktree().find((c) => isInside(r.cwd, c.worktree)) : null;
+    this.remember(sessionDoc(r.project_id, {
+      id: r.id,
+      title: r.title,
+      lastText: r.last_text,
+      ts: r.last_seen_at,
+      task: held?.task ?? null
+    }));
+  }
+  backfillMemory() {
+    if (this.db.query("SELECT value FROM meta WHERE key = 'memory_backfilled'").get())
+      return;
+    const tx = this.db.transaction(() => {
+      for (const r of this.db.query("SELECT * FROM handoffs").all())
+        this.remember(handoffDoc(r.project_id, r.id, {
+          task: r.task,
+          done: r.done,
+          remaining: r.remaining,
+          files: JSON.parse(r.files || "[]"),
+          verify: r.verify ?? null,
+          by: r.by ?? null,
+          createdAt: r.created_at
+        }, r.session_id ?? null));
+      for (const r of this.db.query("SELECT * FROM gates").all())
+        this.remember(gateDoc(r.project_id, r.id, this.rowToGate(r), r.session_id ?? null));
+      for (const r of this.db.query("SELECT seq, ts, project_id, session_id, payload FROM events WHERE type = 'incident.opened'").all()) {
+        let p = {};
+        try {
+          p = JSON.parse(r.payload || "{}");
+        } catch {}
+        this.remember(incidentDoc(r.project_id, r.seq, p, r.ts, r.session_id ?? null));
+      }
+      for (const r of this.db.query("SELECT id, project_id, title, last_text, last_seen_at FROM sessions WHERE last_text IS NOT NULL AND last_text != ''").all())
+        this.remember(sessionDoc(r.project_id, {
+          id: r.id,
+          title: r.title ?? null,
+          lastText: r.last_text,
+          ts: r.last_seen_at
+        }));
+      this.db.query("INSERT OR REPLACE INTO meta (key, value) VALUES ('memory_backfilled', ?)").run(new Date().toISOString());
+    });
+    tx();
+  }
+  memorySearch(q, opts = {}) {
+    const parsed = parseMemoryQuery(q);
+    if (!parsed.match)
+      return [];
+    const kind = opts.kind ?? parsed.kind;
+    const task = opts.task ?? parsed.task;
+    const where = ["memory MATCH ?"];
+    const args = [parsed.match];
+    if (opts.projectId) {
+      where.push("project_id = ?");
+      args.push(opts.projectId);
+    }
+    if (kind) {
+      where.push("kind = ?");
+      args.push(kind);
+    }
+    if (task) {
+      where.push("task = ?");
+      args.push(task);
+    }
+    args.push(Math.min(200, Math.max(1, opts.limit ?? 30)));
+    const rows = this.db.query(`SELECT kind, ref, project_id, task, session_id, ts, title, text,
+                bm25(memory, 0, 0, 0, 2.0, 0, 0, 4.0, 1.0) AS score,
+                snippet(memory, 7, '\x01', '\x02', ' \u2026 ', 24) AS snippet
+           FROM memory WHERE ${where.join(" AND ")} ORDER BY score LIMIT ?`).all(...args);
+    return rows.map((r) => ({
+      kind: r.kind,
+      ref: r.ref,
+      projectId: r.project_id,
+      task: r.task ?? null,
+      sessionId: r.session_id ?? null,
+      ts: r.ts,
+      title: r.title,
+      text: r.text,
+      score: -r.score,
+      snippet: r.snippet
+    }));
+  }
   sessionContext(cwd) {
-    if (!cwd || !existsSync4(cwd))
+    if (!cwd || !existsSync5(cwd))
       return null;
     const toplevel = this.toplevel(cwd);
     const project = this.resolveProject(cwd);
@@ -3396,6 +4834,9 @@ class Store {
       const h = this.latestHandoff(held.projectId, held.task);
       if (h)
         lines.push(formatHandoff(h));
+      const qc = this.questionContext(held.task, held.projectId);
+      if (qc)
+        lines.push(qc);
       const required = this.requiredGates(held.projectId);
       if (required.length) {
         const st = gateStatus(this.gateRuns(held.projectId, held.task), required);
@@ -3422,6 +4863,131 @@ class Store {
       lines.push(`[swarm] rules: ${on.join(" ")}`);
     return lines.length ? lines.join(`
 `) : null;
+  }
+  rowToQuestion(r) {
+    return {
+      id: r.id,
+      projectId: r.project_id,
+      sessionId: r.session_id ?? null,
+      task: r.task ?? null,
+      text: r.text,
+      options: JSON.parse(r.options || "[]"),
+      askedBy: r.asked_by ?? null,
+      createdAt: r.created_at,
+      answer: r.answer ?? null,
+      answeredBy: r.answered_by ?? null,
+      answeredAt: r.answered_at ?? null,
+      deliveredAt: r.delivered_at ?? null
+    };
+  }
+  questions(opts = {}) {
+    const where = ["kind = 'question'"];
+    const args = [];
+    if (opts.projectId) {
+      where.push("project_id = ?");
+      args.push(opts.projectId);
+    }
+    if (opts.sessionId) {
+      where.push("session_id = ?");
+      args.push(opts.sessionId);
+    }
+    if (opts.open)
+      where.push("answered_at IS NULL");
+    args.push(opts.limit ?? 100);
+    return this.db.query(`SELECT * FROM messages WHERE ${where.join(" AND ")} ORDER BY id DESC LIMIT ?`).all(...args).map((r) => this.rowToQuestion(r));
+  }
+  question(id) {
+    const r = this.db.query("SELECT * FROM messages WHERE id = ? AND kind = 'question'").get(id);
+    return r ? this.rowToQuestion(r) : null;
+  }
+  ask(projectId, input) {
+    if (!this.project(projectId))
+      return { ok: false, error: "unknown project" };
+    const v = validateQuestion(input.text, input.options);
+    if (!v.ok)
+      return { ok: false, error: v.reason };
+    const sessionId = this.knownSession(input.sessionId ?? null);
+    const task = (input.cwd ? this.heldClaimsWithWorktree().find((c) => isInside(input.cwd, c.worktree))?.task : null) ?? null;
+    const createdAt = new Date().toISOString();
+    const r = this.db.query(`INSERT INTO messages (project_id, session_id, task, kind, text, options, asked_by, created_at)
+         VALUES (?, ?, ?, 'question', ?, ?, ?, ?)`).run(projectId, sessionId, task, v.text, JSON.stringify(v.options), input.askedBy ?? null, createdAt);
+    const q = this.question(Number(r.lastInsertRowid));
+    this.append({
+      ts: createdAt,
+      type: "question.asked",
+      projectId,
+      sessionId,
+      payload: {
+        id: q.id,
+        task,
+        text: v.text,
+        options: v.options,
+        summary: `question #${q.id}: ${v.text.slice(0, 120)}`
+      }
+    });
+    this.touch();
+    return { ok: true, question: q };
+  }
+  answer(id, text, by) {
+    const q = this.question(id);
+    if (!q)
+      return { ok: false, error: `no question #${id}` };
+    if (q.answer !== null)
+      return {
+        ok: false,
+        error: `#${id} was already answered by ${q.answeredBy ?? "someone"}`
+      };
+    const a = typeof text === "string" ? text.trim() : "";
+    if (!a)
+      return { ok: false, error: "an answer is required" };
+    const at = new Date().toISOString();
+    this.db.query("UPDATE messages SET answer = ?, answered_by = ?, answered_at = ? WHERE id = ?").run(a, by, at, id);
+    this.append({
+      ts: at,
+      type: "question.answered",
+      projectId: q.projectId,
+      sessionId: q.sessionId,
+      payload: { id, task: q.task, answer: a, by, summary: `answer to #${id}: ${a.slice(0, 120)}` }
+    });
+    this.touch();
+    return { ok: true, question: this.question(id) };
+  }
+  inbox(sessionId, opts = {}) {
+    if (!sessionId)
+      return [];
+    const rows = this.db.query("SELECT * FROM messages WHERE kind = 'question' AND session_id = ? AND answered_at IS NOT NULL AND delivered_at IS NULL ORDER BY id").all(sessionId);
+    const qs = rows.map((r) => this.rowToQuestion(r));
+    if (qs.length && !opts.peek)
+      this.db.query(`UPDATE messages SET delivered_at = ? WHERE id IN (${qs.map(() => "?").join(",")})`).run(new Date().toISOString(), ...qs.map((q) => q.id));
+    return qs;
+  }
+  answerContext(sessionId) {
+    return formatAnswers(this.inbox(sessionId));
+  }
+  questionContext(task, projectId) {
+    if (!task)
+      return null;
+    const qs = this.db.query("SELECT * FROM messages WHERE kind = 'question' AND project_id = ? AND task = ? AND (answered_at IS NULL OR delivered_at IS NULL) ORDER BY id").all(projectId, task);
+    const list = qs.map((r) => this.rowToQuestion(r));
+    const parts = [formatAnswers(list), formatOpenQuestions(list)].filter(Boolean);
+    if (list.some((q) => q.answer !== null))
+      this.db.query("UPDATE messages SET delivered_at = ? WHERE kind = 'question' AND project_id = ? AND task = ? AND answered_at IS NOT NULL AND delivered_at IS NULL").run(new Date().toISOString(), projectId, task);
+    return parts.length ? parts.join(`
+`) : null;
+  }
+  contextFor(cwd, sessionId) {
+    const parts = [];
+    const base = this.sessionContext(cwd);
+    if (base)
+      parts.push(base);
+    const answers = this.answerContext(sessionId);
+    if (answers)
+      parts.push(answers);
+    const open = formatOpenQuestions(this.questions({ sessionId: sessionId ?? undefined, open: true }));
+    if (open && !base?.includes(open))
+      parts.push(open);
+    return { text: parts.length ? parts.join(`
+`) : null, parts };
   }
   rowToGate(r) {
     return {
@@ -3443,6 +5009,187 @@ class Store {
   gateStatusFor(runs, required) {
     return gateStatus(runs, required);
   }
+  config(projectId) {
+    const p = this.project(projectId);
+    return loadConfig({ repoRoot: p?.root ?? null, home: this.home });
+  }
+  gateDefs(projectId) {
+    const p = this.project(projectId);
+    return p ? loadConfig({ repoRoot: p.root, home: this.home }).gates : null;
+  }
+  gateJobs = new Map;
+  gateBatches = new Map;
+  async awaitGates(projectId, task) {
+    const prefix = `${projectId}:${task}:`;
+    await Promise.all([
+      ...[...this.gateJobs].filter(([k]) => k.startsWith(prefix)).map(([, v]) => v),
+      ...this.gateBatches.get(`${projectId}:${task}`) ?? []
+    ]);
+  }
+  runGate(projectId, task, gate, opts = {}) {
+    const p = this.project(projectId);
+    if (!p)
+      return { ok: false, reason: "unknown project" };
+    const cfg = this.gateDefs(projectId);
+    const def = cfg?.defs[gate];
+    if (!def)
+      return {
+        ok: false,
+        reason: `gate ${gate} has no command \u2014 add [gates.${gate}] cmd = "\u2026" to .swarm.toml, or record it with swarm gate record`
+      };
+    const claim = this.claims(projectId).find((c) => c.task === task && c.state === "held");
+    const worktree2 = claim?.worktree;
+    if (!worktree2 || !existsSync5(worktree2))
+      return {
+        ok: false,
+        reason: `${task} has no held worktree to run ${gate} in \u2014 claim it first`
+      };
+    const cwd = def.cwd ? join8(worktree2, def.cwd) : worktree2;
+    if (!existsSync5(cwd))
+      return { ok: false, reason: `gate cwd ${cwd} does not exist` };
+    const key = `${projectId}:${task}:${gate}`;
+    if (this.gateJobs.has(key))
+      return { ok: false, reason: `${gate} is already running on ${task}` };
+    const slug = (x) => x.replace(/[^a-zA-Z0-9_.-]+/g, "-");
+    const logDir = join8(this.home, "logs", projectId);
+    mkdirSync4(logDir, { recursive: true });
+    const log = join8(logDir, `gate-${slug(task)}-${slug(gate)}.log`);
+    writeFileSync2(log, `$ ${def.cmd}
+# cwd ${cwd} \xB7 ${new Date().toISOString()}
+`);
+    const fd = openSync3(log, "a");
+    let proc;
+    try {
+      proc = Bun.spawn(["sh", "-c", def.cmd], {
+        cwd,
+        stdin: "ignore",
+        stdout: fd,
+        stderr: fd,
+        env: {
+          ...process.env,
+          SWARM_WORKTREE: worktree2,
+          SWARM_TASK: task,
+          SWARM_GATE: gate,
+          CI: process.env.CI ?? "1"
+        }
+      });
+    } catch (e) {
+      closeSync(fd);
+      const run2 = this.recordGate(projectId, {
+        ...executedGateInput(task, gate, def.cmd, {
+          exitCode: null,
+          durationMs: 0,
+          output: e.message
+        }),
+        sessionId: opts.sessionId ?? null
+      });
+      return { ok: true, pid: 0, log, done: Promise.resolve(run2.ok ? run2.run : null) };
+    }
+    const started = Date.now();
+    const reg = this.registerProcess({
+      pid: proc.pid,
+      projectId,
+      sessionId: opts.sessionId ?? null,
+      kind: "gate",
+      name: `gate:${task}:${gate}`,
+      cwd,
+      cmd: def.cmd,
+      owner: opts.owner ?? "daemon",
+      log
+    });
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try {
+        proc.kill("SIGTERM");
+        setTimeout(() => {
+          try {
+            proc.kill("SIGKILL");
+          } catch {}
+        }, 5000).unref();
+      } catch {}
+    }, def.timeout * 1000);
+    const done = proc.exited.then((code) => {
+      clearTimeout(timer);
+      closeSync(fd);
+      let output = "";
+      try {
+        output = readFileSync3(log, "utf8");
+      } catch {}
+      const input = executedGateInput(task, gate, def.cmd, {
+        exitCode: timedOut ? null : code,
+        timedOut,
+        durationMs: Date.now() - started,
+        output
+      });
+      const run2 = this.recordGate(projectId, { ...input, sessionId: opts.sessionId ?? null });
+      if (reg.ok)
+        this.processes(projectId);
+      return run2.ok ? run2.run : null;
+    }).finally(() => {
+      this.gateJobs.delete(key);
+      this.touch();
+    });
+    this.gateJobs.set(key, done);
+    return { ok: true, pid: proc.pid, log, done };
+  }
+  async runGates(projectId, task, gates2, opts = {}) {
+    const cfg = this.gateDefs(projectId);
+    const names = gates2?.length ? gates2 : (cfg?.required ?? []).filter((g) => cfg?.defs[g]);
+    const key = `${projectId}:${task}`;
+    const batch = (async () => {
+      const started = [];
+      const skipped = [];
+      const runs = [];
+      for (const g of names) {
+        const r = this.runGate(projectId, task, g, opts);
+        if (!r.ok) {
+          skipped.push({ gate: g, reason: r.reason });
+          continue;
+        }
+        started.push(g);
+        const run2 = await r.done;
+        if (run2)
+          runs.push(run2);
+      }
+      return { started, skipped, runs };
+    })();
+    const set = this.gateBatches.get(key) ?? new Set;
+    set.add(batch);
+    this.gateBatches.set(key, set);
+    try {
+      return await batch;
+    } finally {
+      set.delete(batch);
+      if (!set.size)
+        this.gateBatches.delete(key);
+    }
+  }
+  autoGateAt = new Map;
+  autoGate(event, sessionId, cwd) {
+    const held = this.heldClaimsWithWorktree().find((c) => isInside(cwd, c.worktree));
+    if (!held)
+      return;
+    const cfg = this.gateDefs(held.projectId);
+    if (!cfg || cfg.auto === "off")
+      return;
+    if (cfg.auto === "session-end" && event !== "SessionEnd")
+      return;
+    if (!cfg.required.some((g) => cfg.defs[g]))
+      return;
+    const key = `${held.projectId}:${held.task}`;
+    const now = Date.now();
+    if (event === "Stop" && now - (this.autoGateAt.get(key) ?? 0) < 120000)
+      return;
+    this.autoGateAt.set(key, now);
+    this.runGates(held.projectId, held.task, undefined, { sessionId, owner: "auto" }).then((r) => {
+      if (!r.runs.length)
+        return;
+      const line = r.runs.map((x) => `${x.gate} ${x.verdict === "pass" ? "\u2713" : "\u2717"} (${x.rubric})`).join("; ");
+      this.db.query("UPDATE handoffs SET verify = ? WHERE project_id = ? AND task = ? AND session_id = ? AND by LIKE 'auto%'").run(`auto-gates: ${line}`, held.projectId, held.task, sessionId);
+      this.touch();
+    });
+  }
   requiredGates(projectId) {
     const p = this.project(projectId);
     return p ? loadConfig({ repoRoot: p.root, home: this.home }).gates.required : [];
@@ -3458,6 +5205,7 @@ class Store {
     const r = this.db.query(`INSERT INTO gates (project_id, task, gate, verdict, rubric, evidence, session_id, created_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(projectId, input.task.trim(), input.gate, input.verdict, input.rubric.trim(), input.evidence?.trim() || null, sessionId, createdAt);
     const run2 = this.rowToGate(this.db.query("SELECT * FROM gates WHERE id = ?").get(Number(r.lastInsertRowid)));
+    this.remember(gateDoc(projectId, run2.id, run2, sessionId));
     this.append({
       ts: createdAt,
       type: "gate.recorded",
@@ -3487,21 +5235,36 @@ class Store {
     return { ok: true, run: run2 };
   }
   taskCache = new Map;
+  taskSources = new TaskSources;
   tasks(projectId) {
     const p = this.project(projectId);
     if (!p)
       return null;
-    const source = loadConfig({ repoRoot: p.root, home: this.home }).tasks.source;
+    const cfg = loadConfig({ repoRoot: p.root, home: this.home }).tasks;
+    const source = cfg.source;
     if (!source)
       return null;
-    const path = join6(p.root, source);
-    if (!existsSync4(path))
-      return { source, required: this.requiredGates(projectId), tasks: [] };
-    const mtime = statSync(path).mtimeMs;
-    let hit = this.taskCache.get(projectId);
-    if (!hit || hit.path !== path || hit.mtime !== mtime) {
-      hit = { path, mtime, tasks: parseMarkdownTasks(readFileSync3(path, "utf8")) };
-      this.taskCache.set(projectId, hit);
+    let hit;
+    let error = null;
+    const kind = taskSourceKind(source);
+    if (kind === "github" || kind === "linear") {
+      const e = this.taskSources.get(projectId, kind, p.root, {
+        labels: cfg.labels,
+        team: cfg.team
+      });
+      hit = { tasks: e.tasks };
+      error = e.error;
+    } else {
+      const path = join8(p.root, source);
+      if (!existsSync5(path))
+        return { source, required: this.requiredGates(projectId), tasks: [] };
+      const mtime = statSync(path).mtimeMs;
+      let md = this.taskCache.get(projectId);
+      if (!md || md.path !== path || md.mtime !== mtime) {
+        md = { path, mtime, tasks: parseMarkdownTasks(readFileSync3(path, "utf8")) };
+        this.taskCache.set(projectId, md);
+      }
+      hit = md;
     }
     const now = Date.now();
     const active = this.claimRows(projectId).filter((c) => isActive(c, now));
@@ -3523,7 +5286,7 @@ class Store {
         gated: gatesSatisfied(tr, required)
       };
     });
-    return { source, required, tasks: board };
+    return { source, required, tasks: board, error };
   }
   rulesFor(repoRoot) {
     const key = repoRoot ?? "";
@@ -3535,6 +5298,18 @@ class Store {
     return rules2;
   }
   evaluateTool(tool, input, sessionId, cwd, recordIncident = true) {
+    if (BUDGET_ASK_TOOLS.has(tool) && cwd && existsSync5(cwd)) {
+      const project = this.resolveProject(cwd);
+      const b = this.budgetFor(project.id);
+      if (b && b.status.level === "exceeded" && b.config.on_exceed === "ask") {
+        const d = {
+          action: "ask",
+          rule: "budget",
+          reason: `${budgetMessage(b.status, project.name)} \u2014 [budget] on_exceed = "ask": confirm each change, or raise the ceiling in .swarm.toml`
+        };
+        return { decision: d, display: input.command ?? input.file_path ?? tool };
+      }
+    }
     const isWrite = WRITE_TOOLS.has(tool) && typeof input.file_path === "string";
     const cmd = tool === "Bash" ? input.command : undefined;
     const current = { id: sessionId, cwd, toplevel: this.toplevel(cwd) };
@@ -3614,7 +5389,7 @@ class Store {
     return this.openIncident(d, cwd, id, cmd);
   }
   openIncident(d, cwd, sessionId, command) {
-    const project = cwd && existsSync4(cwd) ? this.resolveProject(cwd) : null;
+    const project = cwd && existsSync5(cwd) ? this.resolveProject(cwd) : null;
     this.append({
       ts: new Date().toISOString(),
       type: "incident.opened",
@@ -3625,6 +5400,51 @@ class Store {
     return d;
   }
   heldWorktreesCache = null;
+  dryRun(projectId, overrides = {}, limit = 5000) {
+    const project = this.project(projectId);
+    const modes = { ...this.rulesFor(project?.root ?? null), ...overrides };
+    const rows = this.db.query(`SELECT * FROM (SELECT seq, ts, type, session_id, payload FROM events
+           WHERE project_id = ? AND type IN ('tool.requested', 'tool.completed')
+           ORDER BY seq DESC LIMIT ?) ORDER BY seq`).all(projectId, limit);
+    const calls = [];
+    const pending = new Map;
+    for (const r of rows) {
+      let p;
+      try {
+        p = JSON.parse(r.payload);
+      } catch {
+        continue;
+      }
+      if (!p.tool || !r.session_id)
+        continue;
+      const key = `${r.session_id} ${p.summary ?? p.tool}`;
+      if (r.type === "tool.requested") {
+        const input = p.toolInput ?? {};
+        const call = {
+          ts: r.ts,
+          sessionId: r.session_id,
+          cwd: p.cwd ?? "",
+          tool: p.tool,
+          command: typeof input.command === "string" ? input.command : undefined,
+          filePath: typeof input.file_path === "string" ? input.file_path : undefined,
+          completed: false
+        };
+        calls.push(call);
+        pending.set(key, call);
+      } else {
+        const c = pending.get(key);
+        if (c) {
+          c.completed = true;
+          pending.delete(key);
+        }
+      }
+    }
+    const report = dryRunRules(calls, modes, {
+      toplevel: (cwd) => cwd && existsSync5(cwd) ? this.toplevel(cwd) : null,
+      claims: this.heldWorktrees()
+    });
+    return { ...report, modes };
+  }
   heldWorktrees() {
     if (this.heldWorktreesCache && Date.now() - this.heldWorktreesCache.at < 2000)
       return this.heldWorktreesCache.v;
@@ -3635,8 +5455,8 @@ class Store {
   loadPricing() {
     this.prices = { ...PRICES };
     for (const f of ["pricing.litellm.json", "pricing.json"]) {
-      const p = join6(this.home, f);
-      if (!existsSync4(p))
+      const p = join8(this.home, f);
+      if (!existsSync5(p))
         continue;
       try {
         const j = JSON.parse(readFileSync3(p, "utf8"));
@@ -3651,7 +5471,7 @@ class Store {
       throw new Error(`pricing fetch ${r.status}`);
     const j = await r.json();
     const slim = Object.fromEntries(Object.entries(j).filter(([k, v]) => typeof v.input_cost_per_token === "number" && !k.includes("/")));
-    writeFileSync2(join6(this.home, "pricing.litellm.json"), JSON.stringify(slim, null, 1));
+    writeFileSync2(join8(this.home, "pricing.litellm.json"), JSON.stringify(slim, null, 1));
     this.loadPricing();
     this.reprice();
   }
@@ -3773,6 +5593,8 @@ class Store {
     const slim = slimForStorage(e);
     const r = this.db.query("INSERT INTO events (ts, type, project_id, session_id, payload, raw) VALUES (?, ?, ?, ?, ?, ?)").run(e.ts, e.type, e.projectId, e.sessionId, JSON.stringify(slim.payload ?? null), slim.raw === undefined ? null : JSON.stringify(slim.raw));
     const stored = { ...e, seq: Number(r.lastInsertRowid) };
+    if (stored.type === "incident.opened")
+      this.remember(incidentDoc(stored.projectId, stored.seq, stored.payload, stored.ts, stored.sessionId));
     this.projectSession(stored);
     this.touch();
     const wire = toWire(stored);
@@ -3793,8 +5615,15 @@ class Store {
     if (typeof raw2.cwd === "string")
       this.autoRenewFor(typeof raw2.session_id === "string" ? raw2.session_id : null, raw2.cwd);
     const cwd = typeof raw2.cwd === "string" ? raw2.cwd : process.cwd();
-    const project = existsSync4(cwd) ? this.resolveProject(cwd) : null;
+    const project = existsSync5(cwd) ? this.resolveProject(cwd) : null;
     const e = this.append(normalizeHook(event, raw2, project?.id ?? "p_unknown"));
+    if ((event === "Stop" || event === "SessionEnd") && e.sessionId) {
+      if (existsSync5(cwd)) {
+        this.autoHandoff(e.sessionId, cwd);
+        this.autoGate(event, e.sessionId, cwd);
+      }
+      this.rememberSession(e.sessionId);
+    }
     if (e.sessionId && typeof raw2.transcript_path === "string") {
       this.db.query("UPDATE sessions SET transcript_path = ? WHERE id = ? AND transcript_path IS NULL").run(raw2.transcript_path, e.sessionId);
       const last = this.lastTail.get(e.sessionId) ?? 0;
@@ -3815,6 +5644,15 @@ class Store {
     "claim.renewed",
     "claim.released",
     "claim.orphaned",
+    "worktree.bootstrapped",
+    "worktree.created",
+    "worktree.removed",
+    "pr.opened",
+    "question.asked",
+    "question.answered",
+    "dispatch.queued",
+    "dispatch.started",
+    "dispatch.finished",
     "gate.recorded",
     "handoff.recorded",
     "incident.opened",
@@ -3826,7 +5664,7 @@ class Store {
       return;
     const p = e.payload;
     const row = this.db.query("SELECT id, tool_counts FROM sessions WHERE id = ?").get(e.sessionId);
-    const branch = p.cwd && existsSync4(p.cwd) ? currentBranch(p.cwd) : null;
+    const branch = p.cwd && existsSync5(p.cwd) ? currentBranch(p.cwd) : null;
     if (!row) {
       this.db.query("INSERT INTO sessions (id, project_id, kind, cwd, branch, started_at, last_seen_at, last, last_type, state) VALUES (?, ?, 'interactive', ?, ?, ?, ?, ?, ?, 'active')").run(e.sessionId, e.projectId, p.cwd ?? "", branch, e.ts, e.ts, p.summary ?? e.type, e.type);
     }
@@ -3846,7 +5684,7 @@ class Store {
       const size = statSync(path).size;
       if (size <= offset)
         return null;
-      const fd = openSync2(path, "r");
+      const fd = openSync3(path, "r");
       const buf = Buffer.alloc(size - offset);
       readSync(fd, buf, 0, buf.length, offset);
       closeSync(fd);
@@ -3896,12 +5734,12 @@ class Store {
   }
   tailSession(sessionId) {
     const s = this.db.query("SELECT transcript_path FROM sessions WHERE id = ?").get(sessionId);
-    if (!s?.transcript_path || !existsSync4(s.transcript_path))
+    if (!s?.transcript_path || !existsSync5(s.transcript_path))
       return 0;
     let n = this.tailFile(s.transcript_path, sessionId, null);
-    const subDir = join6(dirname(s.transcript_path), basename(s.transcript_path, ".jsonl"), "subagents");
+    const subDir = join8(dirname2(s.transcript_path), basename(s.transcript_path, ".jsonl"), "subagents");
     for (const f of this.subagentFiles(subDir)) {
-      n += this.tailFile(join6(subDir, f), sessionId, f.replace(/^agent-|\.jsonl$/g, ""));
+      n += this.tailFile(join8(subDir, f), sessionId, f.replace(/^agent-|\.jsonl$/g, ""));
     }
     return n;
   }
@@ -3933,7 +5771,7 @@ class Store {
     return n;
   }
   codexRoot() {
-    return process.env.SWARM_CODEX_DIR ?? join6(homedir3(), ".codex", "sessions");
+    return process.env.SWARM_CODEX_DIR ?? join8(homedir3(), ".codex", "sessions");
   }
   codexRolloutFiles(sinceMs) {
     const root = this.codexRoot();
@@ -3948,18 +5786,18 @@ class Store {
     for (const y of ls(root)) {
       if (!/^\d{4}$/.test(y))
         continue;
-      for (const m of ls(join6(root, y))) {
+      for (const m of ls(join8(root, y))) {
         if (!/^\d\d$/.test(m))
           continue;
-        for (const day of ls(join6(root, y, m))) {
+        for (const day of ls(join8(root, y, m))) {
           if (!/^\d\d$/.test(day))
             continue;
           if (Date.parse(`${y}-${m}-${day}T23:59:59Z`) < sinceMs)
             continue;
-          const dir = join6(root, y, m, day);
+          const dir = join8(root, y, m, day);
           for (const f of ls(dir)) {
             if (f.startsWith("rollout-") && f.endsWith(".jsonl"))
-              out.push(join6(dir, f));
+              out.push(join8(dir, f));
           }
         }
       }
@@ -3967,7 +5805,7 @@ class Store {
     return out;
   }
   tailCodex(windowMs = 3 * 24 * 60 * 60000) {
-    if (!existsSync4(this.codexRoot()))
+    if (!existsSync5(this.codexRoot()))
       return 0;
     let n = 0;
     for (const path of this.codexRolloutFiles(Date.now() - windowMs)) {
@@ -3976,12 +5814,12 @@ class Store {
     return n;
   }
   grokRoot() {
-    return process.env.SWARM_GROK_DIR ?? join6(homedir3(), ".grok", "sessions");
+    return process.env.SWARM_GROK_DIR ?? join8(homedir3(), ".grok", "sessions");
   }
   grokSummary = new Map;
   tailGrok(windowMs = 3 * 24 * 60 * 60000) {
     const root = this.grokRoot();
-    if (!existsSync4(root))
+    if (!existsSync5(root))
       return 0;
     const since = Date.now() - windowMs;
     const ls = (p) => {
@@ -4001,10 +5839,10 @@ class Store {
       } catch {
         cwd = enc;
       }
-      const cwdDir = join6(root, enc);
+      const cwdDir = join8(root, enc);
       for (const sid of ls(cwdDir)) {
-        const path = join6(cwdDir, sid, "updates.jsonl");
-        if (!existsSync4(path))
+        const path = join8(cwdDir, sid, "updates.jsonl");
+        if (!existsSync5(path))
           continue;
         try {
           if (statSync(path).mtimeMs < since)
@@ -4012,7 +5850,7 @@ class Store {
         } catch {
           continue;
         }
-        const sumPath = join6(cwdDir, sid, "summary.json");
+        const sumPath = join8(cwdDir, sid, "summary.json");
         let title;
         let fresh = false;
         try {
@@ -4063,9 +5901,9 @@ class Store {
   ensureAgentSession(sid, agent, cwd, mtime) {
     if (this.db.query("SELECT 1 FROM sessions WHERE id = ?").get(sid))
       return;
-    const project = cwd && existsSync4(cwd) ? this.resolveProject(cwd) : null;
+    const project = cwd && existsSync5(cwd) ? this.resolveProject(cwd) : null;
     const ts = new Date(mtime).toISOString();
-    this.db.query("INSERT INTO sessions (id, project_id, kind, agent, cwd, branch, started_at, last_seen_at, last, last_type, state) VALUES (?, ?, 'interactive', ?, ?, ?, ?, ?, '', '', 'active')").run(sid, project?.id ?? "p_unknown", agent, cwd, cwd && existsSync4(cwd) ? currentBranch(cwd) : null, ts, ts);
+    this.db.query("INSERT INTO sessions (id, project_id, kind, agent, cwd, branch, started_at, last_seen_at, last, last_type, state) VALUES (?, ?, 'interactive', ?, ?, ?, ?, ?, '', '', 'active')").run(sid, project?.id ?? "p_unknown", agent, cwd, cwd && existsSync5(cwd) ? currentBranch(cwd) : null, ts, ts);
   }
   claimRows(projectId) {
     return this.db.query("SELECT * FROM claims WHERE project_id = ?").all(projectId).map((r) => ({
@@ -4099,7 +5937,7 @@ class Store {
   worktreePath(projectId, task) {
     const slug = (x) => x.replace(/[^a-zA-Z0-9._-]+/g, "-").toLowerCase();
     const p = this.project(projectId);
-    return join6(this.home, "worktrees", slug(p?.name ?? projectId), slug(task));
+    return join8(this.home, "worktrees", slug(p?.name ?? projectId), slug(task));
   }
   claim(projectId, task, owner, baseRef = "HEAD") {
     const p = this.project(projectId);
@@ -4110,11 +5948,11 @@ class Store {
     if (!decision.ok)
       return { ok: false, error: claimRefusalMessage(decision, task) };
     const branch = `task/${task}`;
-    const worktree = this.worktreePath(projectId, task);
-    if (existsSync4(worktree))
-      return { ok: false, error: `${worktree} already exists; release ${task} first` };
-    mkdirSync3(dirname(worktree), { recursive: true });
-    const created = worktreeAdd(p.root, worktree, branch, baseRef);
+    const worktree2 = this.worktreePath(projectId, task);
+    if (existsSync5(worktree2))
+      return { ok: false, error: `${worktree2} already exists; release ${task} first` };
+    mkdirSync4(dirname2(worktree2), { recursive: true });
+    const created = worktreeAdd(p.root, worktree2, branch, baseRef);
     if (!created)
       return { ok: false, error: `git worktree add failed for ${task}` };
     this.invalidateWorktrees(projectId);
@@ -4131,7 +5969,54 @@ class Store {
       sessionId: null,
       payload: { task, owner, worktree: created, branch, summary: `claim ${task} by ${owner}` }
     });
-    return { ok: true, task, owner, worktree: created, branch, expiresAt };
+    const bootstrap = this.bootstrapWorktree(projectId, task, p.root, created);
+    return { ok: true, task, owner, worktree: created, branch, expiresAt, bootstrap };
+  }
+  bootstraps = new Map;
+  bootstrapWorktree(projectId, task, repoRoot, worktree2) {
+    const plan = planBootstrap(loadConfig({ repoRoot, home: this.home }), repoRoot, worktree2);
+    if (!needsBootstrap(plan))
+      return null;
+    const job = runBootstrap(plan, { worktree: worktree2, home: this.home, projectId, task });
+    const done = job.done.then((o) => {
+      this.bootstraps.delete(worktree2);
+      const ts = new Date().toISOString();
+      const ok = !o.setup || o.setup.exitCode === 0;
+      this.append({
+        ts,
+        type: "worktree.bootstrapped",
+        projectId,
+        sessionId: null,
+        payload: {
+          task,
+          worktree: worktree2,
+          ok,
+          log: job.log,
+          ...o,
+          summary: `bootstrap ${task}: ${summarizeBootstrap(o)}`
+        }
+      });
+      if (!ok)
+        this.append({
+          ts,
+          type: "incident.opened",
+          projectId,
+          sessionId: null,
+          payload: {
+            rule: "bootstrap_failed",
+            action: "failed",
+            command: o.setup?.command ?? "",
+            reason: `worktree setup for ${task} exited ${o.setup?.exitCode} \u2014 see ${job.log}`
+          }
+        });
+      this.touch();
+      return o;
+    });
+    this.bootstraps.set(worktree2, done);
+    return job.log;
+  }
+  awaitBootstrap(worktree2) {
+    return this.bootstraps.get(worktree2) ?? Promise.resolve();
   }
   autoRenewAt = new Map;
   autoRenewFor(sessionId, cwd) {
@@ -4174,7 +6059,7 @@ class Store {
       for (const c of this.claimRows(p.id)) {
         if (c.state !== "held" || isActive(c, now))
           continue;
-        const exists = c.worktree ? existsSync4(c.worktree) : false;
+        const exists = c.worktree ? existsSync5(c.worktree) : false;
         const work = exists ? heldWork(c.worktree) : null;
         if (reapAction(c, now, exists, work) !== "keep-orphaned")
           continue;
@@ -4229,18 +6114,18 @@ class Store {
     const row = this.db.query("SELECT * FROM claims WHERE project_id = ? AND task = ?").get(projectId, task);
     if (!row)
       return { ok: false, error: `no claim on ${task}` };
-    const worktree = row.worktree ?? "";
-    if (worktree && existsSync4(worktree)) {
-      const work = heldWork(worktree);
+    const worktree2 = row.worktree ?? "";
+    if (worktree2 && existsSync5(worktree2)) {
+      const work = heldWork(worktree2);
       const can = canRelease(work, force);
       if (!can.ok)
         return {
           ok: false,
-          error: releaseRefusalMessage(can, worktree),
+          error: releaseRefusalMessage(can, worktree2),
           refused: can.reason
         };
-      if (p && !worktreeRemove(p.root, worktree, force))
-        return { ok: false, error: `git worktree remove failed for ${worktree}` };
+      if (p && !worktreeRemove(p.root, worktree2, force))
+        return { ok: false, error: `git worktree remove failed for ${worktree2}` };
       this.invalidateWorktrees(projectId);
     }
     const releasedAt = new Date().toISOString();
@@ -4265,7 +6150,7 @@ class Store {
           continue;
         if (isActive({ ...c, state: "held" }, now))
           continue;
-        const exists = c.worktree ? existsSync4(c.worktree) : false;
+        const exists = c.worktree ? existsSync5(c.worktree) : false;
         const work = exists ? heldWork(c.worktree) : null;
         const action = reapAction({ ...c, state: "held" }, now, exists, work);
         if (action === "not-expired")
@@ -4356,6 +6241,141 @@ class Store {
     this.wtInflight.set(projectId, run2);
     return run2;
   }
+  createWorktree(projectId, name, baseRef = "HEAD", branch) {
+    const p = this.project(projectId);
+    if (!p)
+      return { ok: false, error: "unknown project" };
+    const slug = name.replace(/[^a-zA-Z0-9._-]+/g, "-").toLowerCase();
+    if (!slug || slug === "." || slug === "..")
+      return { ok: false, error: "bad worktree name" };
+    const path = this.worktreePath(projectId, slug);
+    if (existsSync5(path))
+      return { ok: false, error: `${path} already exists` };
+    mkdirSync4(dirname2(path), { recursive: true });
+    const br = branch?.trim() || `wt/${slug}`;
+    const created = worktreeAdd(p.root, path, br, baseRef);
+    if (!created)
+      return { ok: false, error: `git worktree add failed for ${name}` };
+    this.invalidateWorktrees(projectId);
+    this.append({
+      ts: new Date().toISOString(),
+      type: "worktree.created",
+      projectId,
+      sessionId: null,
+      payload: { name: slug, worktree: created, branch: br, summary: `worktree ${slug} created` }
+    });
+    const bootstrap = this.bootstrapWorktree(projectId, slug, p.root, created);
+    return { ok: true, name: slug, worktree: created, branch: br, bootstrap };
+  }
+  findWorktree(projectId, ref) {
+    const wts = this.wtCache.get(projectId)?.v ?? [];
+    const abs = ref.startsWith("/") ? ref.replace(/\/+$/, "") : null;
+    return wts.find((w) => w.path === abs) ?? wts.find((w) => !w.main && basename(w.path) === ref) ?? wts.find((w) => w.branch === ref) ?? null;
+  }
+  async removeWorktree(projectId, ref, force = false) {
+    const p = this.project(projectId);
+    if (!p)
+      return { ok: false, error: "unknown project" };
+    await this.refreshWorktrees(projectId);
+    const w = this.findWorktree(projectId, ref);
+    if (!w)
+      return { ok: false, error: `no worktree ${ref} in ${p.name}` };
+    const held = this.claims(projectId).find((c) => c.state === "held" && c.worktree === w.path);
+    const can = canRemoveWorktree(w, held?.task ?? null, force);
+    if (!can.ok)
+      return {
+        ok: false,
+        error: removeRefusalMessage(can.reason, w.path, held?.task),
+        refused: can.reason
+      };
+    if (!worktreeRemove(p.root, w.path, force))
+      return { ok: false, error: `git worktree remove failed for ${w.path}` };
+    this.invalidateWorktrees(projectId);
+    this.append({
+      ts: new Date().toISOString(),
+      type: "worktree.removed",
+      projectId,
+      sessionId: null,
+      payload: {
+        worktree: w.path,
+        branch: w.branch,
+        force,
+        summary: `worktree ${basename(w.path)} removed`
+      }
+    });
+    return { ok: true, worktree: w.path };
+  }
+  async gcWorktrees(projectId, apply = false) {
+    await this.refreshWorktrees(projectId);
+    const plan = planGc(this.wtCache.get(projectId)?.v ?? [], this.claims(projectId));
+    const removed = [];
+    if (apply)
+      for (const c of plan) {
+        if (!c.removable)
+          continue;
+        const r = await this.removeWorktree(projectId, c.path, false);
+        if (r.ok)
+          removed.push(c.path);
+      }
+    return { candidates: plan, removed };
+  }
+  openWorktree(projectId, ref) {
+    const p = this.project(projectId);
+    if (!p)
+      return { ok: false, error: "unknown project" };
+    const w = this.findWorktree(projectId, ref);
+    if (!w)
+      return { ok: false, error: `no worktree ${ref}` };
+    const cfg = loadConfig({ repoRoot: p.root, home: this.home }).worktree.open;
+    const cmd = cfg ? ["sh", "-c", cfg.replace(/\{path\}/g, `'${w.path.replace(/'/g, "'\\''")}'`)] : [
+      process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open",
+      w.path
+    ];
+    try {
+      Bun.spawn(cmd, { stdin: "ignore", stdout: "ignore", stderr: "ignore" }).unref();
+      return { ok: true, worktree: w.path, command: cmd.join(" ") };
+    } catch (e) {
+      return { ok: false, error: e.message };
+    }
+  }
+  async prDraftFor(projectId, ref) {
+    const p = this.project(projectId);
+    if (!p)
+      return { ok: false, error: "unknown project" };
+    await this.refreshWorktrees(projectId);
+    const claim = this.claims(projectId).find((c) => c.task === ref && c.state === "held");
+    const w = this.findWorktree(projectId, claim?.worktree ?? ref);
+    if (!w)
+      return { ok: false, error: `no worktree or held task ${ref}` };
+    const task = claim?.task ?? this.claims(projectId).find((c) => c.state === "held" && c.worktree === w.path)?.task ?? (w.branch?.startsWith("task/") ? w.branch.slice(5) : null) ?? basename(w.path);
+    const taskRow = this.tasks(projectId)?.tasks.find((t) => t.id === task) ?? null;
+    const handoff = this.latestHandoff(projectId, task);
+    const required = this.requiredGates(projectId);
+    const gates2 = required.length ? this.gateStatusFor(this.gateRuns(projectId, task), required).map((g) => ({
+      gate: g.gate,
+      verdict: g.verdict
+    })) : [];
+    const diff = await worktreeDiff(p.root, w.path);
+    const d = prDraft({
+      task,
+      title: taskRow?.title ?? null,
+      handoff,
+      gates: gates2,
+      files: diff.files,
+      commits: diff.commits
+    });
+    return { ok: true, task, worktree: w, ...d, diff };
+  }
+  recordPrOpened(projectId, task, worktree2, url) {
+    this.append({
+      ts: new Date().toISOString(),
+      type: "pr.opened",
+      projectId,
+      sessionId: null,
+      payload: { task, worktree: worktree2, url, summary: `PR opened for ${task}: ${url}` }
+    });
+    this.touch();
+  }
   invalidateWorktrees(projectId) {
     if (projectId)
       this.wtCache.delete(projectId);
@@ -4425,6 +6445,56 @@ class Store {
       };
     });
   }
+  projectSpend(projectId) {
+    const dayStart = new Date;
+    dayStart.setHours(0, 0, 0, 0);
+    const weekStart = new Date(Date.now() - 7 * 86400000).toISOString();
+    const q = (since) => this.db.query("SELECT COALESCE(SUM(t.cost_usd), 0) AS cost FROM turns t JOIN sessions s ON s.id = t.session_id WHERE s.project_id = ? AND t.ts >= ?").get(projectId, since).cost;
+    return { today: q(dayStart.toISOString()), week: q(weekStart) };
+  }
+  budgetFor(projectId) {
+    const cfg = this.config(projectId).budget;
+    if (!cfg.daily && !cfg.weekly)
+      return null;
+    return { status: budgetStatus(this.projectSpend(projectId), cfg), config: cfg };
+  }
+  budgetNotified = new Map;
+  budgetListeners = new Set;
+  onBudgetStop(fn) {
+    this.budgetListeners.add(fn);
+  }
+  checkBudgets() {
+    const day = new Date().toDateString();
+    const out = [];
+    for (const p of this.projects()) {
+      const b = this.budgetFor(p.id);
+      if (!b || b.status.level === "ok")
+        continue;
+      out.push({ projectId: p.id, status: b.status });
+      const key = `${day}:${b.status.level}`;
+      if (this.budgetNotified.get(p.id) === key)
+        continue;
+      this.budgetNotified.set(p.id, key);
+      const msg = budgetMessage(b.status, p.name);
+      this.append({
+        ts: new Date().toISOString(),
+        type: "incident.opened",
+        projectId: p.id,
+        sessionId: null,
+        payload: {
+          rule: "budget",
+          action: b.status.level === "exceeded" ? b.config.on_exceed : "warn",
+          command: `${b.status.kind} budget`,
+          reason: b.status.level === "exceeded" ? `${msg}. ${b.config.on_exceed === "stop" ? "Spawned runs were stopped and the dispatch queue cleared." : b.config.on_exceed === "ask" ? "Every Bash/Edit/Write now asks first." : "Raise [budget] in .swarm.toml or wait for the next day."}` : `${msg} \u2014 approaching the ceiling`
+        }
+      });
+      if (b.status.level === "exceeded" && b.config.on_exceed === "stop")
+        for (const fn of this.budgetListeners)
+          fn(p.id, b.status);
+      this.touch();
+    }
+    return out;
+  }
   spend() {
     const dayStart = new Date;
     dayStart.setHours(0, 0, 0, 0);
@@ -4448,6 +6518,23 @@ class Store {
       daily
     };
   }
+  attribution(projectId) {
+    const claims = this.db.query("SELECT task, owner, worktree, state FROM claims WHERE project_id = ? AND worktree != ''").all(projectId);
+    const byTask = claims.map((c) => {
+      const r = this.db.query(`SELECT COALESCE(SUM(t.cost_usd),0) AS cost, COALESCE(SUM(t.output),0) AS output, COUNT(*) AS turns,
+                    COUNT(DISTINCT s.id) AS sessions
+             FROM sessions s JOIN turns t ON t.session_id = s.id
+             WHERE s.cwd = ? OR s.cwd LIKE ?`).get(c.worktree, `${c.worktree}/%`);
+      return { task: c.task, owner: c.owner, state: c.state, worktree: c.worktree, ...r };
+    }).filter((t) => t.turns > 0).sort((a, b) => b.cost - a.cost);
+    const contextBudget = this.db.query(`SELECT s.id, s.title, s.project_id AS projectId,
+                  COALESCE(SUM(t.cache_read),0) AS cacheRead,
+                  COALESCE(SUM(t.input + t.cache_write + t.cache_read),0) AS input,
+                  COALESCE(SUM(t.cost_usd),0) AS cost, COUNT(*) AS turns
+           FROM sessions s JOIN turns t ON t.session_id = s.id
+           WHERE s.project_id = ? GROUP BY s.id HAVING turns > 3 ORDER BY cacheRead DESC LIMIT 12`).all(projectId).map((r) => ({ ...r, reuse: r.input ? r.cacheRead / r.input : 0 }));
+    return { byTask, contextBudget };
+  }
   stats(projectId) {
     const scope = projectId ? "s.project_id = ?" : "? IS NULL";
     const arg = projectId ?? null;
@@ -4522,7 +6609,7 @@ class Store {
     args.push(limit);
     const rows = this.db.query(`SELECT e.seq, e.ts, e.project_id, e.session_id, e.payload, a.acked_at FROM events e
          LEFT JOIN incident_acks a ON a.seq = e.seq WHERE ${where.join(" AND ")} ORDER BY e.seq DESC LIMIT ?`).all(...args);
-    return rows.map((r) => ({
+    const list = rows.map((r) => ({
       seq: r.seq,
       ts: r.ts,
       projectId: r.project_id,
@@ -4530,6 +6617,25 @@ class Store {
       acked: r.acked_at,
       ...JSON.parse(r.payload || "{}")
     }));
+    const counts = new Map;
+    for (const i of list) {
+      const key = incidentKey(i);
+      counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    return list.map((i) => {
+      const incident = i;
+      if (!incident.rule)
+        return i;
+      const key = incidentKey(incident);
+      const suggestion = suggestFromIncident({
+        rule: incident.rule,
+        action: incident.action ?? "",
+        command: incident.command ?? "",
+        reason: incident.reason ?? "",
+        count: counts.get(key) ?? 1
+      });
+      return { ...i, count: counts.get(key) ?? 1, suggestion };
+    });
   }
   openIncidents(projectId) {
     const r = this.db.query(`SELECT COUNT(*) AS n FROM events e LEFT JOIN incident_acks a ON a.seq = e.seq
@@ -4843,6 +6949,7 @@ class Store {
       processes: this.memoised("processes", 5000, () => this.processes()),
       incidents: this.memoised("incidents", 30000, () => this.incidents(20, { open: true })),
       openIncidents: this.memoised("openIncidents", 30000, () => this.openIncidents()),
+      questions: this.questions({ open: true, limit: 50 }),
       resources: this.resources(),
       seq: this.seq()
     };
@@ -4918,13 +7025,13 @@ function rowToEvent(r) {
 }
 
 // packages/daemon/src/app.ts
-var VERSION = "0.5.0";
+var VERSION = "0.7.0";
 var WEB_DIR = (() => {
   if (process.env.SWARM_WEB_DIR)
     return process.env.SWARM_WEB_DIR;
-  const here = dirname2(fileURLToPath(import.meta.url));
-  const dev = join7(here, "../../web/public");
-  return existsSync5(join7(dev, "index.html")) ? dev : join7(here, "../web");
+  const here = dirname3(fileURLToPath(import.meta.url));
+  const dev = join9(here, "../../web/public");
+  return existsSync6(join9(dev, "index.html")) ? dev : join9(here, "../web");
 })();
 var REPLAY_TAIL = 200;
 var wireCache = new WeakMap;
@@ -4940,6 +7047,12 @@ function createApp(store = new Store) {
   const app = new Hono2;
   const forge2 = new ForgeService(store);
   const runner = new Runner(store, store.home);
+  const dispatcher = new Dispatcher(store, runner, forge2);
+  store.onBudgetStop((projectId) => {
+    dispatcher.clear(projectId);
+    for (const run2 of runner.list(projectId))
+      runner.stop(run2.id);
+  });
   app.get("/v1/health", (c) => c.json({ ok: true, version: VERSION }));
   app.get("/v1/projects", (c) => c.json(store.snapshot().projects));
   app.post("/v1/projects", async (c) => {
@@ -4968,13 +7081,13 @@ function createApp(store = new Store) {
     const q = c.req.query("path");
     let dir;
     try {
-      dir = realpathSync3(q && existsSync5(q) ? q : homedir4());
+      dir = realpathSync3(q && existsSync6(q) ? q : homedir4());
     } catch {
       dir = homedir4();
     }
     try {
-      const entries = readdirSync2(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, repo: existsSync5(join7(dir, e.name, ".git")) })).sort((a, b) => a.name.localeCompare(b.name));
-      const parent = dirname2(dir);
+      const entries = readdirSync2(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => ({ name: e.name, repo: existsSync6(join9(dir, e.name, ".git")) })).sort((a, b) => a.name.localeCompare(b.name));
+      const parent = dirname3(dir);
       return c.json({ path: dir, parent: parent === dir ? null : parent, entries });
     } catch (e) {
       return c.json({ error: e.message, path: dir }, 400);
@@ -4986,6 +7099,30 @@ function createApp(store = new Store) {
     open: c.req.query("open") === "1",
     projectId: c.req.query("project") || undefined
   })));
+  app.get("/v1/memory", (c) => {
+    const q = c.req.query("q") ?? "";
+    const kind = c.req.query("kind");
+    return c.json({
+      q,
+      hits: store.memorySearch(q, {
+        projectId: c.req.query("project") || null,
+        kind: MEMORY_KINDS.includes(kind) ? kind : null,
+        task: c.req.query("task") || null,
+        limit: Number(c.req.query("limit")) || 30
+      })
+    });
+  });
+  app.get("/v1/rules/dryrun", (c) => {
+    const projectId = c.req.query("project");
+    if (!projectId)
+      return c.json({ ok: false, error: "project required" }, 400);
+    const overrides = {};
+    for (const [k, v] of Object.entries(c.req.query()))
+      if (RULE_IDS.includes(k) && ["ask", "deny", "off"].includes(v))
+        overrides[k] = v;
+    const limit = Math.min(20000, Math.max(100, Number(c.req.query("limit")) || 5000));
+    return c.json(store.dryRun(projectId, overrides, limit));
+  });
   app.post("/v1/incidents/ack", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     return c.json({ ok: true, acked: store.ackAllIncidents(body.project || undefined) });
@@ -5060,10 +7197,84 @@ function createApp(store = new Store) {
       model: b.model,
       permissionMode: b.permissionMode,
       allowedTools: b.allowedTools,
-      maxTurns: b.maxTurns
+      maxTurns: b.maxTurns,
+      profile: b.profile
     });
     return r.ok ? c.json(r, 201) : c.json({ ok: false, error: r.reason }, 409);
   });
+  app.get("/v1/budget", (c) => {
+    const project = c.req.query("project");
+    if (!project)
+      return c.json({ error: "project required" }, 400);
+    return c.json(store.budgetFor(project) ?? { status: null, config: store.config(project).budget });
+  });
+  app.get("/v1/context", (c) => {
+    const cwd = c.req.query("cwd");
+    if (!cwd)
+      return c.json({ error: "cwd required" }, 400);
+    return c.json(store.contextFor(cwd, c.req.query("session") || null));
+  });
+  app.get("/v1/questions", (c) => c.json(store.questions({
+    projectId: c.req.query("project") || undefined,
+    sessionId: c.req.query("session") || undefined,
+    open: c.req.query("open") === "1"
+  })));
+  app.post("/v1/questions", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    if (!b.projectId)
+      return c.json({ ok: false, error: "projectId required" }, 400);
+    const r = store.ask(b.projectId, {
+      sessionId: b.sessionId ?? null,
+      text: b.text,
+      options: b.options,
+      askedBy: b.askedBy ?? null,
+      cwd: b.cwd ?? null
+    });
+    return c.json(r, r.ok ? 201 : 400);
+  });
+  app.post("/v1/questions/:id/answer", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    const r = store.answer(Number(c.req.param("id")), b.text, b.by ?? null);
+    if (r.ok && r.question.sessionId) {
+      const run2 = runner.get(r.question.sessionId);
+      if (run2 && run2.sessionId === r.question.sessionId) {
+        const sent = runner.send(run2.id, `[swarm] answer from ${b.by ?? "a human"} to your question "${r.question.text.slice(0, 200)}": ${r.question.answer}`);
+        if (sent.ok)
+          store.inbox(r.question.sessionId);
+      }
+    }
+    return c.json(r, r.ok ? 200 : 409);
+  });
+  app.get("/v1/inbox", (c) => c.json(store.inbox(c.req.query("session") || null, { peek: c.req.query("peek") === "1" })));
+  app.get("/v1/dispatch", (c) => {
+    const project = c.req.query("project");
+    if (!project)
+      return c.json({ error: "project required" }, 400);
+    return c.json({ entries: dispatcher.status(project), config: store.config(project).dispatch });
+  });
+  app.post("/v1/dispatch", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    if (!b.projectId)
+      return c.json({ ok: false, error: "projectId required" }, 400);
+    if (!b.ready && !b.tasks?.length)
+      return c.json({ ok: false, error: "tasks or ready:true required" }, 400);
+    const r = await dispatcher.dispatch(b.projectId, b.ready ? "ready" : b.tasks, {
+      owner: b.owner ?? "dispatch",
+      max: b.max,
+      maxParallel: b.maxParallel,
+      permissionMode: b.permissionMode,
+      model: b.model,
+      maxTurns: b.maxTurns,
+      profile: b.profile
+    });
+    return c.json(r, r.ok ? 202 : 409);
+  });
+  app.delete("/v1/dispatch", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    if (!b.projectId)
+      return c.json({ ok: false, error: "projectId required" }, 400);
+    return c.json({ ok: true, cleared: dispatcher.clear(b.projectId, b.task) });
+  });
   app.post("/v1/runs/:id/send", async (c) => {
     const b = await c.req.json().catch(() => ({}));
     if (!b.text?.trim())
@@ -5115,10 +7326,31 @@ function createApp(store = new Store) {
     const required = store.requiredGates(project);
     return c.json({
       required,
+      executable: Object.keys(store.gateDefs(project)?.defs ?? {}),
       runs,
       status: task ? store.gateStatusFor(runs, required) : undefined
     });
   });
+  app.post("/v1/gates/run", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    if (!b.projectId || !b.task)
+      return c.json({ ok: false, error: "projectId and task required" }, 400);
+    const opts = { sessionId: b.sessionId ?? null, owner: "cli" };
+    if (b.wait === false) {
+      const projectId = b.projectId;
+      const cfg = store.gateDefs(projectId);
+      const names = b.gates?.length ? b.gates : (cfg?.required ?? []).filter((g) => cfg?.defs[g]);
+      store.runGates(projectId, b.task, names, opts);
+      return c.json({ ok: true, started: names, runs: [] }, 202);
+    }
+    const r = await store.runGates(b.projectId, b.task, b.gates, opts);
+    const ok = r.started.length > 0 && r.runs.every((x) => x.verdict === "pass");
+    return c.json({
+      ok,
+      ...r,
+      error: r.started.length ? undefined : r.skipped[0]?.reason ?? "no executable gates"
+    }, r.started.length ? 200 : 409);
+  });
   app.post("/v1/gates", async (c) => {
     const b = await c.req.json().catch(() => ({}));
     if (!b.projectId)
@@ -5158,6 +7390,81 @@ function createApp(store = new Store) {
     const r = store.release(b.projectId ?? "", b.task ?? "", b.force ?? false);
     return c.json(r, r.ok ? 200 : 409);
   });
+  app.get("/v1/worktrees", async (c) => {
+    const project = c.req.query("project");
+    if (!project)
+      return c.json({ error: "project required" }, 400);
+    return c.json(await store.refreshWorktrees(project));
+  });
+  app.post("/v1/worktrees", async (c) => {
+    const b = await c.req.json();
+    if (!b.projectId || !b.name)
+      return c.json({ error: "projectId and name required" }, 400);
+    const r = store.createWorktree(b.projectId, b.name, b.baseRef, b.branch);
+    return c.json(r, r.ok ? 201 : 409);
+  });
+  app.post("/v1/worktrees/remove", async (c) => {
+    const b = await c.req.json();
+    if (!b.projectId || !b.worktree)
+      return c.json({ error: "projectId and worktree required" }, 400);
+    const r = await store.removeWorktree(b.projectId, b.worktree, b.force ?? false);
+    return c.json(r, r.ok ? 200 : 409);
+  });
+  app.post("/v1/worktrees/open", async (c) => {
+    const b = await c.req.json();
+    if (!b.projectId || !b.worktree)
+      return c.json({ error: "projectId and worktree required" }, 400);
+    await store.refreshWorktrees(b.projectId);
+    const r = store.openWorktree(b.projectId, b.worktree);
+    return c.json(r, r.ok ? 200 : 404);
+  });
+  app.get("/v1/worktrees/diff", async (c) => {
+    const project = c.req.query("project");
+    const ref = c.req.query("worktree");
+    if (!project || !ref)
+      return c.json({ error: "project and worktree required" }, 400);
+    await store.refreshWorktrees(project);
+    const w = store.findWorktree(project, ref);
+    const p = store.project(project);
+    if (!w || !p)
+      return c.json({ error: `no worktree ${ref}` }, 404);
+    const file = c.req.query("file") || undefined;
+    const d = await worktreeDiff(p.root, w.path);
+    if (file || c.req.query("patch") === "1")
+      return c.json({ ...d, worktree: w.path, patch: await worktreePatch(w.path, d.base, file) });
+    return c.json({ ...d, worktree: w.path });
+  });
+  app.get("/v1/prs/draft", async (c) => {
+    const project = c.req.query("project");
+    const ref = c.req.query("worktree") || c.req.query("task");
+    if (!project || !ref)
+      return c.json({ error: "project and worktree|task required" }, 400);
+    const r = await store.prDraftFor(project, ref);
+    return c.json(r, r.ok ? 200 : 404);
+  });
+  app.post("/v1/prs/open", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    const ref = b.worktree || b.task;
+    if (!b.projectId || !ref)
+      return c.json({ ok: false, error: "projectId and worktree|task required" }, 400);
+    const d = await store.prDraftFor(b.projectId, ref);
+    if (!d.ok)
+      return c.json(d, 404);
+    const r = await forge2.openPR(b.projectId, d.worktree, {
+      title: b.title?.trim() || d.title,
+      body: b.body ?? d.body,
+      isDraft: b.draft ?? false
+    });
+    if (r.ok)
+      store.recordPrOpened(b.projectId, d.task, d.worktree.path, r.url);
+    return c.json(r, r.ok ? 201 : 409);
+  });
+  app.post("/v1/worktrees/gc", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    if (!b.projectId)
+      return c.json({ error: "projectId required" }, 400);
+    return c.json(await store.gcWorktrees(b.projectId, b.apply ?? false));
+  });
   app.post("/v1/claims/reap", async (c) => {
     const b = await c.req.json().catch(() => ({}));
     return c.json({ reaped: store.reap(b.projectId) });
@@ -5177,6 +7484,10 @@ function createApp(store = new Store) {
     return e ? c.json(e) : c.json({ error: "not found" }, 404);
   });
   app.get("/v1/spend", (c) => c.json(store.spend()));
+  app.get("/v1/attribution", (c) => {
+    const project = c.req.query("project");
+    return project ? c.json(store.attribution(project)) : c.json({ error: "project required" }, 400);
+  });
   app.post("/v1/pricing/refresh", async (c) => {
     try {
       await store.refreshPricing();
@@ -5186,6 +7497,27 @@ function createApp(store = new Store) {
     }
   });
   app.get("/v1/pricing", (c) => c.json(store.prices));
+  app.get("/v1/sessions/:id/resume", (c) => {
+    const r = store.resumePlan(c.req.param("id"));
+    return r.ok ? c.json(r) : c.json({ ok: false, error: r.reason }, 404);
+  });
+  app.post("/v1/sessions/:id/resume", async (c) => {
+    const b = await c.req.json().catch(() => ({}));
+    const plan = store.resumePlan(c.req.param("id"));
+    if (!plan.ok)
+      return c.json({ ok: false, error: plan.reason }, 404);
+    const r = await runner.start({
+      projectId: plan.projectId,
+      task: plan.task,
+      prompt: plan.prompt,
+      owner: b.owner ?? plan.owner ?? "dashboard",
+      model: b.model,
+      permissionMode: b.permissionMode,
+      allowedTools: b.allowedTools,
+      maxTurns: b.maxTurns
+    });
+    return r.ok ? c.json({ ...r, resumedFrom: c.req.param("id") }, 201) : c.json({ ok: false, error: r.reason }, 409);
+  });
   app.post("/v1/sessions/:id/tail", (c) => c.json({ turns: store.tailSession(c.req.param("id")) }));
   app.post("/v1/hook/:event", async (c) => {
     const event = c.req.param("event");
@@ -5199,6 +7531,8 @@ function createApp(store = new Store) {
           hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: ctx }
         });
     }
+    const sid = typeof raw2.session_id === "string" ? raw2.session_id : null;
+    const answers = event === "UserPromptSubmit" || event === "PreToolUse" || event === "PostToolUse" ? store.answerContext(sid) : null;
     if (event === "PreToolUse" && process.env.SWARM_GUARD !== "off") {
       const guard = store.guardHook(raw2);
       if (guard) {
@@ -5206,11 +7540,17 @@ function createApp(store = new Store) {
           hookSpecificOutput: {
             hookEventName: "PreToolUse",
             permissionDecision: guard.action,
-            permissionDecisionReason: `[swarm] ${guard.reason}`
+            permissionDecisionReason: `[swarm] ${guard.reason}`,
+            ...answers ? { additionalContext: answers } : {}
           }
         });
       }
     }
+    if (answers)
+      return c.json({
+        additionalContext: answers,
+        hookSpecificOutput: { hookEventName: event, additionalContext: answers }
+      });
     return c.json({});
   });
   app.post("/v1/events", async (c) => {
@@ -5239,18 +7579,18 @@ function createApp(store = new Store) {
       });
     });
   });
-  app.get("/", (c) => c.html(readFileSync4(join7(WEB_DIR, "index.html"), "utf8")));
+  app.get("/", (c) => c.html(readFileSync4(join9(WEB_DIR, "index.html"), "utf8")));
   const MIME = { js: "text/javascript", css: "text/css" };
   app.get("/:file{[a-z0-9-]+\\.(js|css)}", (c) => {
     const f = c.req.param("file");
-    const p = join7(WEB_DIR, f);
-    if (!existsSync5(p))
+    const p = join9(WEB_DIR, f);
+    if (!existsSync6(p))
       return c.text(`${f} not built \u2014 run: bun run build:web`, 404);
     return c.body(readFileSync4(p, "utf8"), 200, {
       "content-type": MIME[f.split(".").pop() ?? ""] ?? "text/plain"
     });
   });
-  return { app, store, forge: forge2, runner };
+  return { app, store, forge: forge2, runner, dispatcher };
 }
 
 // packages/daemon/src/bin.ts
@@ -5286,6 +7626,8 @@ var tailer = setInterval(() => {
   store.reapProcesses();
   if (tick % 12 === 0)
     store.sweepOrphans();
+  if (tick % 6 === 0)
+    store.checkBudgets();
 }, 5000);
 store.refreshAllWorktrees();
 var wtRefresh = setInterval(() => void store.refreshAllWorktrees(), 15000);