@ra3orblade/swarm 0.6.0 → 0.8.0

package/dist/swarm.js

@@ -50,6 +50,22 @@ function readDaemonInfo() {
     return null;
   }
 }
+var tokenFile = (home = swarmHome()) => join(home, "token");
+function readToken(home = swarmHome()) {
+  try {
+    const t = readFileSync(tokenFile(home), "utf8").trim();
+    return /^[a-f0-9]{64}$/.test(t) ? t : null;
+  } catch {
+    return null;
+  }
+}
+var authedFetch = (input, init) => {
+  const h = new Headers(init?.headers);
+  const t = readToken();
+  if (t && !h.has("authorization"))
+    h.set("authorization", `Bearer ${t}`);
+  return fetch(input, { ...init, headers: h });
+};
 function alive(pid) {
   try {
     process.kill(pid, 0);
@@ -108,7 +124,7 @@ class SwarmClient {
   f;
   constructor(opts = {}) {
     this.baseUrl = resolveBaseUrl(opts.baseUrl);
-    this.f = opts.fetch ?? fetch;
+    this.f = opts.fetch ?? authedFetch;
   }
   async health() {
     const r = await this.f(`${this.baseUrl}/v1/health`);
@@ -127,10 +143,9 @@ class SwarmClient {
   }
 }
 
-// packages/cli/src/install.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
+// packages/core/src/actor.ts
+var HUMAN_ALIASES = new Set(["cli", "dashboard", "me", "desktop", "human"]);
+var DAEMON_ALIASES = new Set(["daemon", "system", "swarm"]);
 // packages/core/src/adapters/claude-code/hooks.ts
 var HOOK_EVENTS = [
   "SessionStart",
@@ -144,22 +159,327 @@ var HOOK_EVENTS = [
   "Notification",
   "PreCompact"
 ];
+// packages/core/src/audit.ts
+var AUDIT_TYPES = new Set([
+  "session.started",
+  "session.ended",
+  "tool.denied",
+  "claim.acquired",
+  "claim.renewed",
+  "claim.released",
+  "claim.expired",
+  "claim.orphaned",
+  "worktree.created",
+  "worktree.removed",
+  "worktree.bootstrapped",
+  "pr.opened",
+  "question.asked",
+  "question.answered",
+  "dispatch.queued",
+  "dispatch.started",
+  "dispatch.finished",
+  "resource.acquired",
+  "resource.released",
+  "resource.reaped",
+  "process.started",
+  "process.exited",
+  "gate.recorded",
+  "handoff.recorded",
+  "permission.requested",
+  "permission.resolved",
+  "incident.opened",
+  "incident.acked",
+  "run.result"
+]);
+var AUDIT_TYPES_SQL = [...AUDIT_TYPES].map((t) => `'${t}'`).join(", ");
+var DEFAULT_PRIVACY = {
+  store_prompts: true,
+  store_reasoning: true,
+  redact: []
+};
+// packages/core/src/budget.ts
+var BUDGET_ASK_TOOLS = new Set(["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit"]);
+// packages/core/src/config.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+var DEFAULT_GATE_TIMEOUT_S = 900;
+var AUTO_MODES = ["session-end", "stop", "off"];
+function parseGateDefs(gates) {
+  const out = {};
+  if (!isRecord(gates))
+    return out;
+  for (const [name, v] of Object.entries(gates)) {
+    if (!isRecord(v))
+      continue;
+    const builtin = v.builtin === "review" ? "review" : null;
+    const cmd = typeof v.cmd === "string" ? v.cmd.trim() : "";
+    if (!cmd && !builtin)
+      continue;
+    if (!/^[a-z0-9][a-z0-9_.-]{0,39}$/i.test(name))
+      continue;
+    const t = Number(v.timeout);
+    out[name] = {
+      cmd: builtin ? "" : cmd,
+      timeout: Number.isFinite(t) && t > 0 ? Math.min(t, 86400) : builtin ? 600 : DEFAULT_GATE_TIMEOUT_S,
+      cwd: isRepoRelative(v.cwd) ? v.cwd.trim() : null,
+      builtin,
+      model: typeof v.model === "string" && v.model.trim() ? v.model.trim() : null
+    };
+  }
+  return out;
+}
+var DEFAULT_CONFIG = {
+  daemon: { port: 7777, auth: "loopback-optional" },
+  tasks: { source: null, labels: [], team: null },
+  gates: { required: [], auto: "session-end", defs: {} },
+  budget: { daily: null, weekly: null, warn_at: 0.8, on_exceed: "warn" },
+  events: { retain_days: 30 },
+  audit: { retain_days: 0 },
+  privacy: DEFAULT_PRIVACY,
+  dispatch: {
+    max_parallel: 2,
+    permission_mode: null,
+    model: null,
+    max_turns: null,
+    require_pr: true,
+    profile: null
+  },
+  worktree: { setup: null, copy: [], open: null },
+  rules: {
+    shared_tree: "ask",
+    destructive_git: "ask",
+    pattern_kill: "ask",
+    protected_ports: "ask",
+    no_foreign_worktree: "ask",
+    claim_required_to_write: "off",
+    protected: { ports: [] }
+  }
+};
+var MODES = ["ask", "deny", "off"];
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function merge(a, b) {
+  if (!isRecord(a) || !isRecord(b))
+    return b === undefined ? a : b;
+  const out = { ...a };
+  for (const [k, v] of Object.entries(b))
+    out[k] = merge(a[k], v);
+  return out;
+}
+function parseToml(text, source) {
+  try {
+    return Bun.TOML.parse(text) ?? {};
+  } catch (e) {
+    console.error(`swarm: ignoring invalid TOML in ${source}: ${e.message}`);
+    return {};
+  }
+}
+function isRepoRelative(f) {
+  if (typeof f !== "string")
+    return false;
+  const t = f.trim();
+  if (!t || t.startsWith("/") || t.startsWith("\\") || /^[a-zA-Z]:/.test(t))
+    return false;
+  return !t.split(/[/\\]/).some((seg) => seg === "..");
+}
+var days = (v, fallback) => {
+  const n = Number(v);
+  return Number.isInteger(n) && n >= 0 ? Math.min(n, 3650) : fallback;
+};
+function validate(c) {
+  const mode = (v, fallback) => MODES.includes(v) ? v : fallback;
+  const port = Number(c.daemon?.port);
+  const source = c.tasks?.source;
+  const setup = c.worktree?.setup;
+  const opener = c.worktree?.open;
+  const rawGates = c.gates;
+  const d = c.dispatch ?? {};
+  const mp = Number(d.max_parallel);
+  const mt = Number(d.max_turns);
+  const str = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
+  const b = c.budget ?? {};
+  const usd = (v) => {
+    const n = Number(v);
+    return Number.isFinite(n) && n > 0 ? n : null;
+  };
+  const warnAt = Number(b.warn_at);
+  const auto = rawGates?.auto;
+  return {
+    ...c,
+    daemon: {
+      port: Number.isInteger(port) && port > 0 && port < 65536 ? port : 7777,
+      auth: c.daemon?.auth === "required" ? "required" : "loopback-optional"
+    },
+    tasks: {
+      source: typeof source === "string" && source.trim() && !source.startsWith("/") ? source.trim() : null,
+      labels: Array.isArray(c.tasks?.labels) ? c.tasks.labels.filter((l) => typeof l === "string" && l.trim() !== "") : [],
+      team: typeof c.tasks?.team === "string" && c.tasks.team.trim() ? c.tasks.team.trim() : null
+    },
+    gates: {
+      required: Array.isArray(rawGates?.required) ? rawGates.required.filter((g) => typeof g === "string" && g.trim() !== "") : [],
+      auto: AUTO_MODES.includes(auto) ? auto : "session-end",
+      defs: parseGateDefs(rawGates)
+    },
+    budget: {
+      daily: usd(b.daily),
+      weekly: usd(b.weekly),
+      warn_at: Number.isFinite(warnAt) && warnAt > 0 && warnAt < 1 ? warnAt : 0.8,
+      on_exceed: b.on_exceed === "ask" || b.on_exceed === "stop" ? b.on_exceed : "warn"
+    },
+    events: {
+      retain_days: days(c.events?.retain_days, 30)
+    },
+    audit: {
+      retain_days: days(c.audit?.retain_days, 0)
+    },
+    privacy: {
+      store_prompts: c.privacy?.store_prompts !== false,
+      store_reasoning: c.privacy?.store_reasoning !== false,
+      redact: Array.isArray(c.privacy?.redact) ? c.privacy.redact.filter((r) => typeof r === "string" && r.length > 0) : []
+    },
+    dispatch: {
+      max_parallel: Number.isInteger(mp) && mp > 0 ? Math.min(mp, 16) : 2,
+      permission_mode: str(d.permission_mode),
+      model: str(d.model),
+      max_turns: Number.isInteger(mt) && mt > 0 ? mt : null,
+      require_pr: d.require_pr === undefined ? true : d.require_pr === true,
+      profile: ["full", "no-edits", "read-only"].includes(String(d.profile)) ? String(d.profile) : null
+    },
+    worktree: {
+      setup: typeof setup === "string" && setup.trim() ? setup.trim() : null,
+      copy: Array.isArray(c.worktree?.copy) ? c.worktree.copy.filter((f) => isRepoRelative(f)) : [],
+      open: typeof opener === "string" && opener.trim() ? opener.trim() : null
+    },
+    rules: {
+      ...c.rules,
+      shared_tree: mode(c.rules?.shared_tree, "ask"),
+      destructive_git: mode(c.rules?.destructive_git, "ask"),
+      pattern_kill: mode(c.rules?.pattern_kill, "ask"),
+      protected_ports: mode(c.rules?.protected_ports, "ask"),
+      no_foreign_worktree: mode(c.rules?.no_foreign_worktree, "ask"),
+      claim_required_to_write: mode(c.rules?.claim_required_to_write, "off"),
+      protected: {
+        ports: Array.isArray(c.rules?.protected?.ports) ? c.rules.protected.ports.filter((p) => Number.isInteger(p) && p > 0 && p < 65536) : []
+      }
+    }
+  };
+}
+function leafPaths(v, prefix = "") {
+  if (!isRecord(v))
+    return prefix ? [prefix] : [];
+  const keys = Object.keys(v);
+  if (keys.length === 0)
+    return prefix ? [prefix] : [];
+  return keys.flatMap((k) => leafPaths(v[k], prefix ? `${prefix}.${k}` : k));
+}
+function getPath(v, path) {
+  let cur = v;
+  for (const seg of path.split(".")) {
+    if (!isRecord(cur))
+      return;
+    cur = cur[seg];
+  }
+  return cur;
+}
+function setPath(obj, path, value) {
+  const segs = path.split(".");
+  let cur = obj;
+  for (const seg of segs.slice(0, -1)) {
+    if (!isRecord(cur[seg]))
+      cur[seg] = {};
+    cur = cur[seg];
+  }
+  cur[segs[segs.length - 1]] = value;
+}
+var isLockedBy = (path, lock) => path === lock || path.startsWith(`${lock}.`);
+function readLayer(path) {
+  return existsSync3(path) ? parseToml(readFileSync2(path, "utf8"), path) : null;
+}
+function loadConfigDetailed(opts = {}) {
+  const home = opts.home ?? process.env.SWARM_HOME ?? join2(process.env.HOME ?? "", ".swarm");
+  const policyPath = opts.policy ?? process.env.SWARM_POLICY ?? join2(home, "policy.toml");
+  const policyRaw = readLayer(policyPath);
+  const locked = Array.isArray(policyRaw?.locked) ? policyRaw.locked.filter((k) => typeof k === "string" && /^[a-z0-9_.-]+$/i.test(k)) : [];
+  const policy = { ...policyRaw ?? {} };
+  delete policy.locked;
+  const layers = [
+    ["policy", policyRaw ? policy : null],
+    ["global", readLayer(join2(home, "config.toml"))],
+    ["repo", opts.repoRoot ? readLayer(join2(opts.repoRoot, ".swarm.toml")) : null]
+  ];
+  const provenance = {};
+  for (const p of leafPaths(DEFAULT_CONFIG))
+    provenance[p] = "default";
+  const overridden = [];
+  let cfg = DEFAULT_CONFIG;
+  for (const [layer, raw] of layers) {
+    if (!raw)
+      continue;
+    for (const p of leafPaths(raw)) {
+      const lock = layer !== "policy" && locked.find((l) => isLockedBy(p, l));
+      if (lock)
+        overridden.push({ key: p, layer, attempted: getPath(raw, p) });
+      else
+        provenance[p] = layer;
+    }
+    cfg = merge(cfg, raw);
+  }
+  if (overridden.length) {
+    const out = structuredClone(cfg);
+    for (const { key } of overridden) {
+      const fromPolicy = getPath(policy, key);
+      setPath(out, key, fromPolicy === undefined ? getPath(DEFAULT_CONFIG, key) : fromPolicy);
+      provenance[key] = fromPolicy === undefined ? "default" : "policy";
+    }
+    cfg = out;
+  }
+  return {
+    config: validate(cfg),
+    provenance,
+    overridden,
+    policy: { path: policyRaw ? policyPath : null, locked }
+  };
+}
 // packages/core/src/rules.ts
 var LIVE_WINDOW_MS = 10 * 60000;
 var WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
 // packages/core/src/ledger.ts
 var EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+// packages/core/src/policy.ts
+var HOOK_MARK = "swarm-hook";
+var hookIsOurs = (h) => typeof h.command === "string" && (h.command.includes(HOOK_MARK) || h.command.includes("/packages/hook/src/bin.ts"));
+var MIN_HOOK_TIMEOUT_S = 5;
+function hookCoverage(settings) {
+  const hooks = settings && typeof settings === "object" && !Array.isArray(settings) ? settings.hooks : undefined;
+  const missing = [];
+  const short = [];
+  for (const ev of HOOK_EVENTS) {
+    const groups = Array.isArray(hooks?.[ev]) ? hooks?.[ev] : [];
+    const ours = groups.flatMap((g) => {
+      const list = g?.hooks;
+      return Array.isArray(list) ? list.filter((h) => hookIsOurs(h)) : [];
+    });
+    if (!ours.length)
+      missing.push(ev);
+    else if (ours.every((h) => typeof h.timeout === "number" && h.timeout < MIN_HOOK_TIMEOUT_S))
+      short.push(ev);
+  }
+  return { missing, short, complete: !missing.length && !short.length };
+}
 // packages/cli/src/install.ts
-var MARK = "swarm-hook";
-var isOurs = (h) => h.command.includes(MARK) || h.command.includes("/packages/hook/src/bin.ts");
-var settingsPath = () => process.env.CLAUDE_SETTINGS ?? join2(homedir2(), ".claude", "settings.json");
-var claudeJsonPath = () => process.env.CLAUDE_JSON ?? join2(homedir2(), ".claude.json");
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+var isOurs = hookIsOurs;
+var settingsPath = () => process.env.CLAUDE_SETTINGS ?? join3(homedir2(), ".claude", "settings.json");
+var claudeJsonPath = () => process.env.CLAUDE_JSON ?? join3(homedir2(), ".claude.json");
 function loadClaudeJson() {
   const p = claudeJsonPath();
-  if (!existsSync3(p))
+  if (!existsSync4(p))
     return {};
   try {
-    return JSON.parse(readFileSync2(p, "utf8"));
+    return JSON.parse(readFileSync3(p, "utf8"));
   } catch {
     return {};
   }
@@ -192,6 +512,95 @@ function mcpRegistered() {
   const c = loadClaudeJson();
   return Boolean(c.mcpServers?.swarm);
 }
+var codexConfigPath = () => process.env.CODEX_CONFIG ?? join3(homedir2(), ".codex", "config.toml");
+var geminiSettingsPath = () => process.env.GEMINI_SETTINGS ?? join3(homedir2(), ".gemini", "settings.json");
+function codexBlock() {
+  const { command, args } = mcpServerConfig();
+  return `[mcp_servers.swarm]
+command = ${JSON.stringify(command)}
+args = ${JSON.stringify(args)}
+`;
+}
+var CODEX_BLOCK_RE = /\[mcp_servers\.swarm\]\n(?:(?!\[)[^\n]*\n?)*/;
+function registerCodex() {
+  const p = codexConfigPath();
+  if (!existsSync4(join3(p, "..")))
+    return false;
+  const cur = existsSync4(p) ? readFileSync3(p, "utf8") : "";
+  const next = CODEX_BLOCK_RE.test(cur) ? cur.replace(CODEX_BLOCK_RE, codexBlock()) : `${cur.trimEnd()}${cur.trim() ? `
+
+` : ""}${codexBlock()}`;
+  if (next !== cur)
+    writeFileSync2(p, next);
+  return true;
+}
+function unregisterCodex() {
+  const p = codexConfigPath();
+  if (!existsSync4(p))
+    return false;
+  const cur = readFileSync3(p, "utf8");
+  if (!CODEX_BLOCK_RE.test(cur))
+    return false;
+  writeFileSync2(p, cur.replace(CODEX_BLOCK_RE, "").replace(/\n{3,}/g, `
+
+`).trimEnd().concat(`
+`));
+  return true;
+}
+function registerGemini() {
+  const p = geminiSettingsPath();
+  if (!existsSync4(join3(p, "..")))
+    return false;
+  let c = {};
+  try {
+    c = existsSync4(p) ? JSON.parse(readFileSync3(p, "utf8")) : {};
+  } catch {
+    return false;
+  }
+  const mcp = c.mcpServers ?? {};
+  mcp.swarm = mcpServerConfig();
+  c.mcpServers = mcp;
+  writeFileSync2(p, `${JSON.stringify(c, null, 2)}
+`);
+  return true;
+}
+function unregisterGemini() {
+  const p = geminiSettingsPath();
+  if (!existsSync4(p))
+    return false;
+  try {
+    const c = JSON.parse(readFileSync3(p, "utf8"));
+    const mcp = c.mcpServers ?? {};
+    if (!mcp.swarm)
+      return false;
+    delete mcp.swarm;
+    if (Object.keys(mcp).length)
+      c.mcpServers = mcp;
+    else
+      delete c.mcpServers;
+    writeFileSync2(p, `${JSON.stringify(c, null, 2)}
+`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function registerOtherAgents() {
+  const out = [];
+  if (registerCodex())
+    out.push("codex");
+  if (registerGemini())
+    out.push("gemini");
+  return out;
+}
+function unregisterOtherAgents() {
+  const out = [];
+  if (unregisterCodex())
+    out.push("codex");
+  if (unregisterGemini())
+    out.push("gemini");
+  return out;
+}
 var hookCommand = (event) => `${binCommand("swarm-hook")} ${event}`;
 var shimPath = () => resolveBin("swarm-hook").at(-1);
 function mcpServerConfig() {
@@ -200,7 +609,7 @@ function mcpServerConfig() {
 }
 function load() {
   const p = settingsPath();
-  return existsSync3(p) ? JSON.parse(readFileSync2(p, "utf8")) : {};
+  return existsSync4(p) ? JSON.parse(readFileSync3(p, "utf8")) : {};
 }
 function save(s) {
   writeFileSync2(settingsPath(), `${JSON.stringify(s, null, 2)}
@@ -230,6 +639,7 @@ function install() {
   }
   save(s);
   registerMcp();
+  registerOtherAgents();
   return added;
 }
 function uninstall() {
@@ -267,20 +677,37 @@ function uninstall() {
   save(s);
   if (unregisterMcp())
     removed++;
+  removed += unregisterOtherAgents().length;
   return removed;
 }
 function status() {
   const s = load();
   const hooks2 = s.hooks ?? {};
   const installed = Object.values(hooks2).some((l) => l.some((g) => g.hooks.some(isOurs)));
-  return { installed, mcp: mcpRegistered(), path: settingsPath(), shim: shimPath() };
+  const otherAgents = [];
+  const cp = codexConfigPath();
+  if (existsSync4(cp) && CODEX_BLOCK_RE.test(readFileSync3(cp, "utf8")))
+    otherAgents.push("codex");
+  const gp = geminiSettingsPath();
+  try {
+    if (existsSync4(gp) && JSON.parse(readFileSync3(gp, "utf8")).mcpServers?.swarm)
+      otherAgents.push("gemini");
+  } catch {}
+  return {
+    installed,
+    coverage: hookCoverage(s),
+    mcp: mcpRegistered(),
+    path: settingsPath(),
+    shim: shimPath(),
+    otherAgents
+  };
 }
 
 // packages/cli/src/procs.ts
 import { mkdirSync as mkdirSync2, openSync } from "fs";
-import { join as join3, resolve as resolve2 } from "path";
+import { join as join4, resolve as resolve2 } from "path";
 async function call(path, init) {
-  const r = await fetch(`${new SwarmClient().baseUrl}${path}`, init);
+  const r = await authedFetch(`${new SwarmClient().baseUrl}${path}`, init);
   return await r.json();
 }
 var post = (path, body) => call(path, {
@@ -308,9 +735,9 @@ async function start(opts) {
       port = a.port;
     }
   }
-  const logDir = join3(swarmHome(), "logs", slug(pid));
+  const logDir = join4(swarmHome(), "logs", slug(pid));
   mkdirSync2(logDir, { recursive: true });
-  const log = join3(logDir, `${slug(opts.name)}.log`);
+  const log = join4(logDir, `${slug(opts.name)}.log`);
   const fd = openSync(log, "a");
   const cmdline = opts.cmd.join(" ");
   const child = Bun.spawn(["sh", "-c", cmdline], {
@@ -375,6 +802,14 @@ function fmt(r) {
 }
 
 // packages/cli/src/bin.ts
+function gitToplevel() {
+  const r = Bun.spawnSync(["git", "rev-parse", "--show-toplevel"], {
+    stdout: "pipe",
+    stderr: "ignore"
+  });
+  const out = r.exitCode === 0 ? r.stdout.toString().trim() : "";
+  return out || null;
+}
 var [cmd = "help", ...rest] = process.argv.slice(2);
 var json = rest.includes("--json");
 var arg = () => rest.find((a) => !a.startsWith("--"));
@@ -391,12 +826,17 @@ var help = `swarm \u2014 control plane for AI-agent development
   tail [--project p] [--session id]   follow the live event stream
 
   claim <task> [--owner n]   claim a task in a fresh isolated git worktree (fail-closed)
+  gate run <task> [gate\u2026]    execute the repo's [gates.<name>] cmd gates in the task's worktree and record them
+  wt [ls|create|open|diff|rm|gc]  first-class worktrees: create task-less ones, open, diff, remove, collect stale
+  pr open <task|worktree>    push the branch and open a PR/MR prefilled from the task, handoff, gates and files
+  questions [--all]          questions agents are waiting on a human for (this repo); answer <id> <text\u2026>
+  dispatch --ready | <task\u2026> claim + spawn a run per task, [dispatch] max_parallel at a time; status | clear
   renew <task>            extend the lease;  release <task> [--force]   release + remove worktree
   claims                  list claims;  reap   release abandoned claims (keeps ones holding work)
   tasks [--ready] [--json] the repo's task source (.swarm.toml [tasks] source); --ready = claimable now
   gate record <task> <gate> pass|fail --rubric "\u2026" [--evidence "\u2026"]   record a verification run (rubric required)
   gate ls [task]          latest verdict per gate (and the run history for one task)
-  run --task <id> (--prompt "\u2026" | --prompt-file f) [--model m] [--permission-mode m] [--allowed-tools a,b] [--max-turns n]
+  run --task <id> (--prompt "\u2026" | --prompt-file f) [--model m] [--permission-mode m] [--profile full|no-edits|read-only] [--allowed-tools a,b] [--max-turns n]
                           claim the task and spawn claude -p in its worktree; the session shows in Fleet
   run ls | send <task|id> "text" | stop <task|id>   steer (stdin) or stop a spawned run, by pid never pattern
   run resume <session-id> [--model m] [--permission-mode m]   spawn a run that picks up where a dead session stopped (its handoff + tail)
@@ -411,13 +851,14 @@ var help = `swarm \u2014 control plane for AI-agent development
   stats [-p] [--json]     all-time totals, streak, records (the dashboard's Stats view)
   search <query\u2026> [-p] [--kind handoff|incident|gate|session] [--json]   memory over Swarm's own data (handoffs, incidents, gates, what sessions said)
   rules dryrun [--set rule=mode,\u2026] [--limit n] [--json]   replay this repo's history under rule modes; shows what would fire + flaky signals
+  audit export [--since 30d|ISO] [-p] [--type claim.acquired] [--format jsonl|csv|json] [--limit n]   the audit log (ledger changes + decisions, with actor) to stdout
 
   install | uninstall     add/remove Swarm hooks in ~/.claude/settings.json
 
 Env: SWARM_URL, SWARM_PORT (default 7777), SWARM_HOME (~/.swarm)`;
 async function api(path, init) {
   const base = new SwarmClient().baseUrl;
-  const r = await fetch(`${base}${path}`, init);
+  const r = await authedFetch(`${base}${path}`, init);
   if (!r.ok)
     throw new Error(`${path}: ${r.status} ${await r.text()}`);
   return r.status === 204 ? null : r.json();
@@ -447,7 +888,7 @@ try {
       const base = await ensureDaemon();
       const evs = install();
       console.log(`\u2713 daemon running at ${base}`);
-      console.log(`\u2713 installed hooks for ${evs.length} events + MCP server (${status().path})`);
+      console.log(`\u2713 installed hooks for ${evs.length} events + MCP server (${status().path})${status().otherAgents.length ? ` \xB7 MCP also for ${status().otherAgents.join(", ")}` : ""}`);
       console.log("\u2713 any Claude session you start now will appear in Swarm");
       Bun.spawn(["open", base]).unref?.();
       console.log(`
@@ -490,8 +931,27 @@ Open the dashboard: ${base}`);
       line(Boolean(bun), `bun ${bun ? `(${bun})` : ""}`, "install bun: https://bun.sh");
       line(Boolean(claude), "claude CLI on PATH", "install Claude Code: https://claude.com/claude-code");
       line(running, `daemon ${info ? `(pid ${info.pid}, ${info.url})` : ""}`, "run: swarm start");
+      if (running) {
+        const h = await authedFetch(`${resolveBaseUrl()}/v1/health`).then((r) => r.json()).catch(() => null);
+        if (h)
+          console.log(`\xB7 daemon v${h.version ?? "?"} \xB7 schema v${h.schema ?? 0}`);
+      }
       line(st.installed, "hooks installed", "run: swarm install");
+      if (st.installed && !st.coverage.complete) {
+        if (st.coverage.missing.length)
+          line(false, `hooks missing: ${st.coverage.missing.join(", ")}`, "run: swarm install");
+        if (st.coverage.short.length)
+          line(false, `hook timeout too short: ${st.coverage.short.join(", ")}`, "run: swarm install");
+      }
+      const pol = loadConfigDetailed({ repoRoot: gitToplevel() });
+      if (pol.policy.path) {
+        line(true, `policy ${pol.policy.path} (locked: ${pol.policy.locked.join(", ") || "nothing"})`, "");
+        for (const o of pol.overridden)
+          line(false, `${o.layer} config overrides locked ${o.key}`, `remove it \u2014 policy value stays in effect`);
+      }
       line(st.mcp, "MCP server registered", "run: swarm install");
+      if (st.otherAgents.length)
+        console.log(`\u2713 MCP server also registered for ${st.otherAgents.join(", ")} (swarm_* tools in those CLIs too)`);
       const forge2 = (bin, auth) => {
         const path = Bun.which(bin);
         if (!path)
@@ -536,7 +996,7 @@ url: ${resolveBaseUrl()}`);
         headers: { "content-type": "application/json" },
         body: JSON.stringify({ path: resolve3(".") })
       });
-      const r = await fetch(`${new SwarmClient().baseUrl}/v1/claims`, {
+      const r = await authedFetch(`${new SwarmClient().baseUrl}/v1/claims`, {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify({ projectId: proj.id, task, owner })
@@ -545,7 +1005,8 @@ url: ${resolveBaseUrl()}`);
         console.log(JSON.stringify(r));
       else if (r.ok)
         console.log(`claimed ${task} \u2192 ${r.worktree}
-  cd ${r.worktree}`);
+  cd ${r.worktree}${r.bootstrap ? `
+  bootstrapping in the background (setup log: ${r.bootstrap})` : ""}`);
       else {
         console.error(`REFUSED: ${r.error}`);
         process.exit(1);
@@ -563,7 +1024,7 @@ url: ${resolveBaseUrl()}`);
         headers: { "content-type": "application/json" },
         body: JSON.stringify({ path: resolve3(".") })
       });
-      const r = await fetch(`${new SwarmClient().baseUrl}/v1/claims/${cmd}`, {
+      const r = await authedFetch(`${new SwarmClient().baseUrl}/v1/claims/${cmd}`, {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify({ projectId: proj.id, task, force: rest.includes("--force") })
@@ -578,6 +1039,317 @@ url: ${resolveBaseUrl()}`);
       }
       break;
     }
+    case "wt": {
+      await ensureDaemon({ quiet: true });
+      const sub = arg();
+      const proj = await api("/v1/projects", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ path: resolve3(".") })
+      });
+      const post2 = (path, body) => authedFetch(`${new SwarmClient().baseUrl}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ projectId: proj.id, ...body })
+      }).then((x) => x.json());
+      const refuse = (r) => {
+        if (json)
+          console.log(JSON.stringify(r));
+        else if (!r.ok) {
+          console.error(`REFUSED: ${r.error}`);
+          process.exit(1);
+        }
+        return !r.ok;
+      };
+      const flag = (n) => {
+        const i = rest.indexOf(n);
+        return i >= 0 ? rest[i + 1] : undefined;
+      };
+      const VALUE_FLAGS = ["--base", "--branch"];
+      const positional = rest.filter((a, i) => !a.startsWith("--") && !VALUE_FLAGS.includes(rest[i - 1] ?? ""));
+      const target = positional[1];
+      switch (sub) {
+        case "create": {
+          if (!target)
+            throw new Error("usage: swarm wt create <name> [--base ref] [--branch name]");
+          const r = await post2("/v1/worktrees", {
+            name: target,
+            baseRef: flag("--base"),
+            branch: flag("--branch")
+          });
+          if (refuse(r) || json)
+            break;
+          console.log(`created ${r.name} \u2192 ${r.worktree} (branch ${r.branch})
+  cd ${r.worktree}${r.bootstrap ? `
+  bootstrapping in the background (setup log: ${r.bootstrap})` : ""}`);
+          break;
+        }
+        case "ls":
+        case undefined: {
+          const wts = await api(`/v1/worktrees?project=${proj.id}`);
+          if (json)
+            console.log(JSON.stringify(wts));
+          else {
+            for (const w of wts) {
+              const st = w.main ? "main" : [
+                w.dirty > 0 ? `${w.dirty} dirty` : "",
+                w.ahead > 0 ? `${w.ahead} unpushed` : "",
+                w.behind > 0 ? `${w.behind} behind` : "",
+                w.merged ? "merged" : ""
+              ].filter(Boolean).join(", ") || "clean";
+              console.log(`${(w.branch ?? "(detached)").padEnd(32)} ${w.head}  ${st.padEnd(24)} ${w.path}`);
+            }
+            if (!wts.length)
+              console.log("no worktrees");
+          }
+          break;
+        }
+        case "open": {
+          if (!target)
+            throw new Error("usage: swarm wt open <name|path>");
+          const r = await post2("/v1/worktrees/open", { worktree: target });
+          if (refuse(r) || json)
+            break;
+          console.log(`opened ${r.worktree}`);
+          break;
+        }
+        case "rm": {
+          if (!target)
+            throw new Error("usage: swarm wt rm <name|path> [--force]");
+          const r = await post2("/v1/worktrees/remove", {
+            worktree: target,
+            force: rest.includes("--force")
+          });
+          if (refuse(r) || json)
+            break;
+          console.log(`removed ${r.worktree}`);
+          break;
+        }
+        case "diff": {
+          if (!target)
+            throw new Error("usage: swarm wt diff <name|path|task> [--file f] [--patch]");
+          const q = new URLSearchParams({ project: proj.id, worktree: target });
+          const file = flag("--file");
+          if (file)
+            q.set("file", file);
+          if (rest.includes("--patch"))
+            q.set("patch", "1");
+          const d = await api(`/v1/worktrees/diff?${q}`);
+          if (d.error) {
+            console.error(`REFUSED: ${d.error}`);
+            process.exit(1);
+          }
+          if (json)
+            console.log(JSON.stringify(d));
+          else if (d.patch !== undefined)
+            console.log(d.patch);
+          else {
+            console.log(`vs ${d.baseRef ?? "HEAD"} \xB7 ${d.commits.length} commit${d.commits.length === 1 ? "" : "s"} \xB7 ${d.files.length} file${d.files.length === 1 ? "" : "s"}${d.dirty ? " \xB7 dirty" : ""}`);
+            for (const c of d.commits)
+              console.log(`  ${c}`);
+            for (const f of d.files)
+              console.log(`${f.status} ${f.added >= 0 ? `+${f.added}`.padStart(6) : "   bin"} ${f.deleted >= 0 ? `-${f.deleted}`.padStart(6) : "      "}  ${f.path}`);
+          }
+          break;
+        }
+        case "gc": {
+          const r = await post2("/v1/worktrees/gc", { apply: rest.includes("--apply") });
+          if (json)
+            console.log(JSON.stringify(r));
+          else if (!r.candidates.length)
+            console.log("nothing to collect");
+          else {
+            for (const x of r.candidates)
+              console.log(`${r.removed.includes(x.path) ? "removed " : x.removable ? "removable" : `blocked (${x.blocker})`}  ${x.why.padEnd(15)} ${x.branch ?? "(detached)"}  ${x.path}`);
+            if (!rest.includes("--apply") && r.candidates.some((x) => x.removable))
+              console.log("\nrun `swarm wt gc --apply` to remove the removable ones");
+          }
+          break;
+        }
+        default:
+          throw new Error("usage: swarm wt [ls] | create <name> | open <ref> | rm <ref> [--force] | gc [--apply]");
+      }
+      break;
+    }
+    case "questions":
+    case "answer": {
+      await ensureDaemon({ quiet: true });
+      if (cmd === "questions") {
+        const q = new URLSearchParams;
+        if (!rest.includes("--all"))
+          q.set("open", "1");
+        if (!rest.includes("--everywhere")) {
+          const proj = await api("/v1/projects", {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ path: resolve3(".") })
+          });
+          q.set("project", proj.id);
+        }
+        const qs = await api(`/v1/questions?${q}`);
+        if (json)
+          console.log(JSON.stringify(qs));
+        else if (!qs.length)
+          console.log("no open questions");
+        else
+          for (const x of qs)
+            console.log(`#${x.id}  ${x.createdAt.slice(0, 16).replace("T", " ")}  ${x.task ? `[${x.task}] ` : ""}${x.text}${x.options.length ? `
+      options: ${x.options.join(" | ")}` : ""}${x.answer ? `
+      answered by ${x.answeredBy}: ${x.answer}` : ""}`);
+        break;
+      }
+      const [idRaw, ...words] = rest.filter((a) => !a.startsWith("--"));
+      const id = Number(idRaw);
+      const text = words.join(" ");
+      if (!id || !text)
+        throw new Error("usage: swarm answer <id> <text\u2026>");
+      const r = await authedFetch(`${new SwarmClient().baseUrl}/v1/questions/${id}/answer`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ text, by: process.env.USER ?? "cli" })
+      }).then((x) => x.json());
+      if (json)
+        console.log(JSON.stringify(r));
+      else if (r.ok)
+        console.log(`answered #${id}`);
+      else {
+        console.error(`REFUSED: ${r.error}`);
+        process.exit(1);
+      }
+      break;
+    }
+    case "dispatch": {
+      await ensureDaemon({ quiet: true });
+      const proj = await api("/v1/projects", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ path: resolve3(".") })
+      });
+      const VALUE_FLAGS = [
+        "--max",
+        "--parallel",
+        "--model",
+        "--permission-mode",
+        "--max-turns",
+        "--profile"
+      ];
+      const positional = rest.filter((a, i) => !a.startsWith("--") && !VALUE_FLAGS.includes(rest[i - 1] ?? ""));
+      const flag = (n) => {
+        const i = rest.indexOf(n);
+        return i >= 0 ? rest[i + 1] : undefined;
+      };
+      const num = (n) => {
+        const v = flag(n);
+        return v ? Number(v) : undefined;
+      };
+      const sub = positional[0];
+      if (sub === "status" || !sub && !rest.includes("--ready")) {
+        const d = await api(`/v1/dispatch?project=${proj.id}`);
+        if (json)
+          console.log(JSON.stringify(d));
+        else if (!d.entries.length)
+          console.log(`nothing dispatched (max_parallel ${d.config.max_parallel}); swarm dispatch --ready | <task\u2026>`);
+        else
+          for (const e of d.entries)
+            console.log(`${(e.state === "finished" ? e.outcome ?? "?" : e.state).padEnd(13)} ${e.task.padEnd(10)} ${e.runId ? `run ${e.runId} ` : ""}${e.costUsd != null ? `$${e.costUsd.toFixed(2)} ` : ""}${e.detail ?? ""}`);
+        break;
+      }
+      if (sub === "clear") {
+        const r2 = await authedFetch(`${new SwarmClient().baseUrl}/v1/dispatch`, {
+          method: "DELETE",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ projectId: proj.id, task: positional[1] })
+        }).then((x) => x.json());
+        console.log(json ? JSON.stringify(r2) : `cleared ${r2.cleared}`);
+        break;
+      }
+      const r = await authedFetch(`${new SwarmClient().baseUrl}/v1/dispatch`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          projectId: proj.id,
+          ready: rest.includes("--ready"),
+          tasks: positional,
+          max: num("--max"),
+          maxParallel: num("--parallel"),
+          model: flag("--model"),
+          permissionMode: flag("--permission-mode"),
+          maxTurns: num("--max-turns"),
+          profile: flag("--profile"),
+          owner: process.env.USER ?? "cli"
+        })
+      }).then((x) => x.json());
+      if (json)
+        console.log(JSON.stringify(r));
+      else if (!r.ok) {
+        console.error(`REFUSED: ${r.error}`);
+        process.exit(1);
+      } else {
+        for (const t of r.started)
+          console.log(`started   ${t}`);
+        for (const t of r.queued)
+          console.log(`queued    ${t}`);
+        for (const x of r.rejected)
+          console.log(`rejected  ${x.id} \u2014 ${x.reason}`);
+        if (!r.started.length && !r.queued.length)
+          console.log("nothing to dispatch");
+        else
+          console.log(`
+watch: swarm dispatch status \xB7 swarm run ls \xB7 the Board`);
+      }
+      break;
+    }
+    case "pr": {
+      await ensureDaemon({ quiet: true });
+      const sub = arg();
+      const VALUE_FLAGS = ["--title", "--body"];
+      const positional = rest.filter((a, i) => !a.startsWith("--") && !VALUE_FLAGS.includes(rest[i - 1] ?? ""));
+      const flag = (n) => {
+        const i = rest.indexOf(n);
+        return i >= 0 ? rest[i + 1] : undefined;
+      };
+      const target = positional[1];
+      if (sub !== "open" || !target)
+        throw new Error("usage: swarm pr open <task|worktree> [--title t] [--body b] [--draft] [--dry-run]");
+      const proj = await api("/v1/projects", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ path: resolve3(".") })
+      });
+      if (rest.includes("--dry-run")) {
+        const d = await api(`/v1/prs/draft?project=${proj.id}&worktree=${encodeURIComponent(target)}`);
+        if (json)
+          console.log(JSON.stringify(d));
+        else if (!d.ok) {
+          console.error(`REFUSED: ${d.error}`);
+          process.exit(1);
+        } else
+          console.log(`${flag("--title") ?? d.title}
+
+${flag("--body") ?? d.body}`);
+        break;
+      }
+      const r = await authedFetch(`${new SwarmClient().baseUrl}/v1/prs/open`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          projectId: proj.id,
+          worktree: target,
+          title: flag("--title"),
+          body: flag("--body"),
+          draft: rest.includes("--draft")
+        })
+      }).then((x) => x.json());
+      if (json)
+        console.log(JSON.stringify(r));
+      else if (r.ok)
+        console.log(`opened ${r.url}`);
+      else {
+        console.error(`REFUSED: ${r.error}`);
+        process.exit(1);
+      }
+      break;
+    }
     case "reap": {
       await ensureDaemon({ quiet: true });
       const r = await api("/v1/claims/reap", { method: "POST" });
@@ -618,7 +1390,8 @@ url: ${resolveBaseUrl()}`);
         "--permission-mode",
         "--allowed-tools",
         "--max-turns",
-        "--owner"
+        "--owner",
+        "--profile"
       ]);
       const positionals = [];
       for (let i = 0;i < rest.length; i++) {
@@ -648,11 +1421,11 @@ url: ${resolveBaseUrl()}`);
         const target = positionals[1];
         if (!target)
           throw new Error(`usage: swarm run ${sub} <task|id>${sub === "send" ? ' "text"' : ""}`);
-        const r2 = sub === "send" ? await fetch(`${base}/v1/runs/${encodeURIComponent(target)}/send`, {
+        const r2 = sub === "send" ? await authedFetch(`${base}/v1/runs/${encodeURIComponent(target)}/send`, {
           method: "POST",
           headers: { "content-type": "application/json" },
           body: JSON.stringify({ text: positionals.slice(2).join(" ") })
-        }) : await fetch(`${base}/v1/runs/${encodeURIComponent(target)}`, { method: "DELETE" });
+        }) : await authedFetch(`${base}/v1/runs/${encodeURIComponent(target)}`, { method: "DELETE" });
         const j = await r2.json();
         if (json)
           console.log(JSON.stringify(j));
@@ -673,8 +1446,8 @@ url: ${resolveBaseUrl()}`);
       if (!prompt && pf)
         prompt = await Bun.file(resolve3(pf)).text();
       if (!task || !prompt)
-        throw new Error('usage: swarm run --task <id> --prompt "\u2026" | --prompt-file f  [--model] [--permission-mode] [--allowed-tools a,b] [--max-turns n]');
-      const r = await fetch(resumeFrom ? `${base}/v1/sessions/${encodeURIComponent(resumeFrom)}/resume` : `${base}/v1/runs`, {
+        throw new Error('usage: swarm run --task <id> --prompt "\u2026" | --prompt-file f  [--model] [--permission-mode] [--profile p] [--allowed-tools a,b] [--max-turns n]');
+      const r = await authedFetch(resumeFrom ? `${base}/v1/sessions/${encodeURIComponent(resumeFrom)}/resume` : `${base}/v1/runs`, {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify({
@@ -685,7 +1458,8 @@ url: ${resolveBaseUrl()}`);
           model: flag("--model"),
           permissionMode: flag("--permission-mode"),
           allowedTools: flag("--allowed-tools")?.split(",").map((t) => t.trim()).filter(Boolean),
-          maxTurns: flag("--max-turns") ? Number(flag("--max-turns")) : undefined
+          maxTurns: flag("--max-turns") ? Number(flag("--max-turns")) : undefined,
+          profile: flag("--profile")
         })
       }).then((x) => x.json());
       if (json)
@@ -714,7 +1488,7 @@ url: ${resolveBaseUrl()}`);
         body: JSON.stringify({ path: resolve3(".") })
       });
       if (cmd === "resume") {
-        const r2 = await fetch(`${new SwarmClient().baseUrl}/v1/handoffs?project=${proj.id}&task=${encodeURIComponent(task)}`);
+        const r2 = await authedFetch(`${new SwarmClient().baseUrl}/v1/handoffs?project=${proj.id}&task=${encodeURIComponent(task)}`);
         const j = await r2.json();
         if (json)
           console.log(JSON.stringify(j.handoff));
@@ -726,7 +1500,7 @@ url: ${resolveBaseUrl()}`);
         const i = rest.indexOf(n);
         return i >= 0 ? rest[i + 1] : undefined;
       };
-      const r = await fetch(`${new SwarmClient().baseUrl}/v1/handoffs`, {
+      const r = await authedFetch(`${new SwarmClient().baseUrl}/v1/handoffs`, {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify({
@@ -775,7 +1549,7 @@ url: ${resolveBaseUrl()}`);
         const [, task, gate, verdict] = positionals;
         if (!task || !gate || !verdict)
           throw new Error('usage: swarm gate record <task> <gate> pass|fail --rubric "what was checked" [--evidence "\u2026"]');
-        const r = await fetch(`${new SwarmClient().baseUrl}/v1/gates`, {
+        const r = await authedFetch(`${new SwarmClient().baseUrl}/v1/gates`, {
           method: "POST",
           headers: { "content-type": "application/json" },
           body: JSON.stringify({
@@ -798,6 +1572,34 @@ url: ${resolveBaseUrl()}`);
         }
         break;
       }
+      if (sub === "run") {
+        const [, task, ...gates2] = positionals;
+        if (!task)
+          throw new Error("usage: swarm gate run <task> [gate\u2026]   (default: the required gates that have a cmd)");
+        const r = await authedFetch(`${new SwarmClient().baseUrl}/v1/gates/run`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            projectId: proj.id,
+            task,
+            gates: gates2,
+            sessionId: process.env.CLAUDE_SESSION_ID ?? null
+          })
+        }).then((x) => x.json());
+        if (json)
+          console.log(JSON.stringify(r));
+        else {
+          for (const x of r.runs ?? [])
+            console.log(`${x.verdict === "pass" ? "\u2713" : "\u2717"} ${x.gate.padEnd(12)} ${x.rubric}`);
+          for (const x of r.skipped ?? [])
+            console.log(`\u2013 ${x.gate.padEnd(12)} skipped: ${x.reason}`);
+          if (r.error && !r.started?.length)
+            console.error(`REFUSED: ${r.error}`);
+        }
+        if (!r.ok)
+          process.exit(1);
+        break;
+      }
       if (sub === "ls") {
         const task = positionals[1];
         const q = new URLSearchParams({ project: proj.id });
@@ -858,6 +1660,36 @@ url: ${resolveBaseUrl()}`);
          session ${h.sessionId}` : ""}`);
       break;
     }
+    case "audit": {
+      if (rest[0] !== "export")
+        throw new Error("usage: swarm audit export [--since 30d] [-p] [--type t] [--format jsonl|csv|json] [--limit n]");
+      await ensureDaemon({ quiet: true });
+      const q = new URLSearchParams;
+      const val = (n) => {
+        const i = rest.indexOf(n);
+        return i >= 0 ? rest[i + 1] : undefined;
+      };
+      if (val("--since"))
+        q.set("since", val("--since"));
+      if (val("--type"))
+        q.set("type", val("--type"));
+      if (val("--limit"))
+        q.set("limit", val("--limit"));
+      q.set("format", val("--format") ?? "jsonl");
+      if (rest.includes("-p")) {
+        const proj = await api("/v1/projects", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ path: resolve3(".") })
+        });
+        q.set("project", proj.id);
+      }
+      const r = await authedFetch(`${new SwarmClient().baseUrl}/v1/audit?${q}`);
+      if (!r.ok)
+        throw new Error((await r.json()).error ?? `audit: ${r.status}`);
+      process.stdout.write(await r.text());
+      break;
+    }
     case "rules": {
       if (rest[0] !== "dryrun")
         throw new Error("usage: swarm rules dryrun [--set rule=mode,\u2026] [--limit n]");
@@ -1088,7 +1920,7 @@ would have fired (newest last):`);
           headers: { "content-type": "application/json" },
           body: JSON.stringify({ path: resolve3(".") })
         });
-        const r = await fetch(`${new SwarmClient().baseUrl}/v1/resources`, {
+        const r = await authedFetch(`${new SwarmClient().baseUrl}/v1/resources`, {
           method: "POST",
           headers: { "content-type": "application/json" },
           body: JSON.stringify({
@@ -1124,7 +1956,7 @@ would have fired (newest last):`);
         });
         if (rest.includes("--force"))
           q.set("force", "1");
-        const r = await fetch(`${new SwarmClient().baseUrl}/v1/resources/${encodeURIComponent(name)}?${q}`, { method: "DELETE" }).then((x) => x.json());
+        const r = await authedFetch(`${new SwarmClient().baseUrl}/v1/resources/${encodeURIComponent(name)}?${q}`, { method: "DELETE" }).then((x) => x.json());
         if (json)
           console.log(JSON.stringify(r));
         else if (r.ok)
@@ -1142,7 +1974,7 @@ would have fired (newest last):`);
       const base = new SwarmClient().baseUrl;
       const pIdx = rest.indexOf("--session");
       const wantSession = pIdx >= 0 ? rest[pIdx + 1] : undefined;
-      const res = await fetch(`${base}/v1/events?since=0`);
+      const res = await authedFetch(`${base}/v1/events?since=0`);
       const reader = res.body?.getReader();
       if (!reader)
         throw new Error("no stream");
@@ -1174,7 +2006,8 @@ would have fired (newest last):`);
     }
     case "ui": {
       const base = await ensureDaemon();
-      Bun.spawn(["open", base]).unref?.();
+      const tok = readToken();
+      Bun.spawn(["open", tok ? `${base}/?token=${tok}` : base]).unref?.();
       console.log(base);
       break;
     }