@ra3orblade/swarm 0.7.0 → 0.9.0

package/README.md

@@ -32,7 +32,7 @@ It runs entirely on your machine. No account, no telemetry, works offline. Nothi
 bunx @ra3orblade/swarm setup
 ```
 
-> Status: early, but real — observability, task claims, runtime resources, configurable rules, incidents and a cross-forge merge queue are built and dogfooded daily. Spawned agents and verification gates are on the [roadmap](ROADMAP.md).
+> Status: early, but real — observability, task claims in isolated worktrees, runtime resources, configurable rules, incidents, a cross-forge merge queue, spawned agents (`swarm run` / `swarm dispatch`), executed verification gates, handoffs, session replay, search and spend budgets are built and dogfooded daily — Swarm dispatches its own tasks. Agent-to-agent messaging, declarative workflows and a built-in review gate are next on the [roadmap](ROADMAP.md).
 
 ---
 
@@ -40,23 +40,31 @@ bunx @ra3orblade/swarm setup
 
 **Fleet** — every session across every project, live: agent, title, branch, what it's doing right now, model, a trend sparkline, output tokens, context size, cost, age. Filter by agent (Claude Code, Codex, Grok).
 
-**Session** — an agent's reasoning and tool calls as a live stream, with cost per turn, cache hit rate, thinking share, tool histogram and the transcript path.
+**Session** — an agent's reasoning and tool calls as a live stream, with cost per turn, cache hit rate, thinking share, tool histogram and the transcript path. **Replay** steps through its tool calls one at a time with full input and output; an ended session gets **Resume where it died**, which spawns a run from what it left behind; a session inside a worktree shows its **Diff**.
 
 <p align="center"><img src="docs/art/screens/session.png" alt="Session view — live reasoning stream with a stats panel" width="100%"></p>
 
-**Board** — the coordination ledger for a project: task **claims** (each in an isolated git worktree), **worktrees** with branch, dirty/unpushed state and which session is inside, **runtime resources** (ports, dev servers, databases held as named singletons), and **incidents** — every command the rules asked about or denied, with the rule and the command.
+**Board** — the coordination ledger for a project: **tasks** from your backlog (a markdown file, GitHub Issues or Linear) with a ✓ / ✗ per gate and **Run** / **Dispatch** actions, task **claims** (each in an isolated git worktree), **worktrees** with branch, drift, dirty/unpushed state and which session is inside — plus **Diff**, **PR** (push + open a pull/merge request prefilled from the task and handoff), **Open** and **Remove** per row — **runtime resources** (ports, dev servers, databases held as named singletons), **dispatch** status, recent **gates**, and **incidents** — every command the rules asked about or denied, with the rule and the command, and a **Codify** action that turns one into a `.swarm.toml` rule and a `CLAUDE.md` lesson.
 
 <p align="center"><img src="docs/art/screens/board.png" alt="Board view — worktrees and incidents" width="100%"></p>
 
 **Rules** — guardrails on the Bash commands a Claude Code session runs: `shared_tree`, `destructive_git`, `pattern_kill`, `protected_ports`, plus `no_foreign_worktree` and the opt-in `claim_required_to_write` on file writes; each `ask | deny | off` per repo in `.swarm.toml`. A `deny` is returned to Claude Code as a real permission denial. Ports held as resources are protected automatically. Guardrails against accidents, not a sandbox — see [what rules are and aren't](https://getswarm.vercel.app/docs/03-rules-and-config#what-rules-are--and-arent).
 
+**Run & Dispatch** — start an agent from Swarm: `swarm run --task X` (or **Run** on a task row) claims the task and spawns `claude -p` in its worktree; steer it by stdin, stop it by pid. Its permission prompts go through the same rules as your interactive sessions — `deny` auto-denies, `ask` becomes an **Allow / Deny** card on the session, nothing else blocks. `swarm dispatch --ready` hands every claimable task to its own run, N at a time; when a run ends Swarm re-runs the gates and looks for the PR, and reports done / gates-failed / no-pr / crashed. Run profiles (`full | no-edits | read-only`) narrow what a spawned agent may do.
+
+**Gates & handoffs** — `.swarm.toml` declares the gates every task must pass; a gate with a `cmd` is executed in the task's worktree (exit 0 passes, the output tail is the evidence) — on demand, from the agent, or automatically when a session in a held worktree ends. The latest run decides, failed runs are never deleted. Every session that pauses leaves an auto-handoff (files edited, last verification command, last request); the next session in that worktree gets it, the lease left, gate status and held resources injected at start.
+
+**Ask the human** — an agent that hits a decision only you can make calls `swarm_ask`; the question shows on the session page with the options as buttons, Fleet shows an **Asking** badge, a desktop notification fires, and the answer reaches the agent on its own.
+
 **PRs** — one merge queue across GitHub and GitLab, read through your already-authenticated `gh` / `glab`. Merge from the dashboard when checks and review are clear. No tokens stored.
 
 **Timeline** — session lanes per project, coloured by agent, 3–72 h.
 
 <p align="center"><img src="docs/art/screens/timeline.png" alt="Timeline view — session lanes per project" width="100%"></p>
 
-**Spend & Stats** — cost by project, model and agent, today and all-time; plus the fun numbers: tokens, turns, streaks, activity calendar, words written, what it adds up to in novels and coffee.
+**Spend & Stats** — cost by project, model, agent and **task**, today and all-time, with a context-budget table that ranks sessions by how much context they re-read; per-repo **budgets** (`daily` / `weekly` ceilings that warn, ask or stop); plus the fun numbers: tokens, turns, streaks, activity calendar, words written, what it adds up to in novels and coffee.
+
+**Search** — full-text memory over everything Swarm remembers: handoffs, incidents, gate runs and what sessions said. **Dry-run rules** replays a project's history under rule modes you pick before switching anything on.
 
 <p align="center"><img src="docs/art/screens/stats.png" alt="Stats view" width="100%"></p>
 
@@ -93,9 +101,27 @@ claim_required_to_write = "off"  # opt-in: writes to the shared checkout need a
 
 [rules.protected]
 ports = [5432]
+
+[gates]                      # what every task must pass; a gate with a cmd is executed, not vouched for
+required = ["tests", "review"]
+[gates.tests]
+cmd = "bun test"
+
+[worktree]                   # start every new worktree warm
+copy  = [".env.local"]
+setup = "bun install"
+
+[tasks]                      # the backlog the Board, `swarm tasks` and dispatch read
+source = "docs/plan.md"      # or "github" / "linear"
+
+[budget]                     # USD ceilings; on_exceed = "warn" | "ask" | "stop"
+daily = 25
+
+[dispatch]
+max_parallel = 2
 ```
 
-Every `ask` and `deny` is recorded as an incident on the Board. Reference: [Rules and configuration](https://getswarm.vercel.app/docs/03-rules-and-config).
+Every `ask` and `deny` is recorded as an incident on the Board. Reference: [Rules and configuration](https://getswarm.vercel.app/docs/03-rules-and-config) · full [`docs/13-config.md`](docs/13-config.md).
 
 ## CLI
 
@@ -107,22 +133,45 @@ swarm doctor                   # check setup, print the fix for each gap
 swarm add <path> · ls · ui     # pin a project · list projects · open the dashboard
 swarm tail                     # follow the live event stream
 
+swarm tasks [--ready]          # the repo's task source; --ready = claimable now
 swarm claim <task> [--owner n] # claim a task in a fresh isolated worktree (fail-closed)
 swarm renew | release <task>   # extend the lease · release + remove the worktree
 swarm claims · reap            # list claims · release abandoned ones (keeps those holding work)
+swarm handoff <task> --done "…" --remaining "…"   # leave notes for the next holder · resume <task> reads them
+swarm gate run <task> [gate…]  # execute the repo's [gates.<name>] cmd gates in the worktree and record them
+swarm gate record <task> <gate> pass|fail --rubric "…"   # record a verification run by hand · gate ls
+swarm wt [ls|create|open|diff|rm|gc]   # first-class worktrees: task-less ones, drift, diff, collect stale
+swarm pr open <task>           # push the branch and open a PR/MR prefilled from task, handoff, gates, files
+
+swarm run --task <id> --prompt "…" [--profile no-edits|read-only]   # spawn claude -p in the task's worktree
+swarm run ls | send <task> "…" | stop <task>   # steer (stdin) or stop a spawned run — by pid, never pattern
+swarm run resume <session-id>  # pick up where a dead session stopped (its handoff + tail)
+swarm dispatch --ready | <task…> · status · clear   # claim + spawn a run per task, max_parallel at a time
+swarm questions · answer <id> <text>   # what agents are waiting on a human for
+
 swarm res ls | acquire <name> [--pid n] [--port n] | release <name> [--force]
+swarm serve start [--name web] -- <cmd>   # dev server: port allocated, PORT set, pid tracked, port protected
+swarm proc start [--name n] -- <cmd>      # same, for workers without a port · serve/proc ls | stop
 swarm stats [--json]           # all-time totals, streak, records
+swarm search <query>           # memory over handoffs, incidents, gates, what sessions said
+swarm rules dryrun [--set rule=mode,…]    # replay history under rule modes; shows what would fire
 
-swarm install | uninstall      # add/remove Swarm hooks in ~/.claude/settings.json
+swarm install | uninstall      # add/remove Swarm hooks in ~/.claude/settings.json + the MCP server
 ```
 
 ## For agents (MCP)
 
-`swarm setup` registers an MCP server, so an agent can coordinate itself instead of you running the CLI:
+`swarm setup` registers an MCP server with Claude Code (and with Codex CLI and Gemini CLI when installed), so an agent can coordinate itself instead of you running the CLI:
 
-- `swarm_status` — what's claimed, who's live, what's held in this project
-- `swarm_claim` / `swarm_renew` / `swarm_release` / `swarm_reap` — task claims in isolated worktrees (fail-closed)
+- `swarm_status` / `swarm_context` — what's claimed, who's live, what's held; what Swarm told this session at start, current as of now
+- `swarm_next_task` / `swarm_claim` / `swarm_renew` / `swarm_release` / `swarm_reap` — the backlog and task claims in isolated worktrees (fail-closed)
+- `swarm_handoff` / `swarm_resume` — leave notes for the next holder, read the last ones
+- `swarm_gates` / `swarm_gate_run` / `swarm_gate_record` — see, execute or record verification gates
+- `swarm_pr_open` — push the branch and open a PR/MR prefilled from the task and handoff
+- `swarm_dispatch` — a lead agent hands ready tasks to autonomous runs in their own worktrees
+- `swarm_ask` / `swarm_inbox` — ask the human a question (with options); the answer arrives on its own
 - `swarm_acquire_resource` / `swarm_release_resource` / `swarm_resources` — hold a port, dev server or database as a named singleton; held ports are protected from other agents automatically
+- `swarm_search` — memory over handoffs, incidents, gates and what sessions said
 
 ## How it works
 
@@ -132,13 +181,17 @@ swarm install | uninstall      # add/remove Swarm hooks in ~/.claude/settings.js
                         transcripts (JSONL) ──────┼──▶ swarmd ──▶ SQLite (~/.swarm)
  Codex CLI  ─── ~/.codex rollout logs ────────────┤      │
  Grok       ─── ACP updates.jsonl ────────────────┘      └──▶ SSE ──▶ dashboard · CLI · MCP
-                                                  ▼
+                                                  ▼               ▲
                                        rules engine (ask / deny → incidents)
+                                       ledger: claims · worktrees · gates · handoffs · resources · budgets
+                                                  │
+                                       swarm run / dispatch ──▶ claude -p in a claimed worktree ──┘
 ```
 
 - **Identity** is the git common dir, so every worktree of a repo maps to one project.
 - **State** lives in `~/.swarm/` — never in your repositories. Uninstalling leaves your repos untouched.
 - **Hooks** are installed once at the Claude Code user level, so every session on the machine reports in. The hook fails open: if the daemon is down, nothing blocks your work.
+- **Spawned runs** are stopped by pid from the process registry, never by command pattern; a run that ends short of done keeps its claim and opens an incident rather than cleaning up behind your back.
 
 Design docs (architecture, data model, protocol, interface, roadmap) are rendered at [getswarm.vercel.app/docs/design](https://getswarm.vercel.app/docs/design/) and live in [`docs/`](docs/00-index.md).
 

package/dist/swarm-hook.js

@@ -1,6 +1,10 @@
 #!/usr/bin/env bun
 // @bun
 
+// packages/hook/src/bin.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { dirname, join as join2 } from "path";
+
 // packages/client/src/daemon.ts
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { homedir } from "os";
@@ -20,16 +24,257 @@ function readDaemonInfo() {
     return null;
   }
 }
+var tokenFile = (home = swarmHome()) => join(home, "token");
+function readToken(home = swarmHome()) {
+  try {
+    const t = readFileSync(tokenFile(home), "utf8").trim();
+    return /^[a-f0-9]{64}$/.test(t) ? t : null;
+  } catch {
+    return null;
+  }
+}
+var authedFetch = (input, init) => {
+  const h = new Headers(init?.headers);
+  const t = readToken();
+  if (t && !h.has("authorization"))
+    h.set("authorization", `Bearer ${t}`);
+  return fetch(input, { ...init, headers: h });
+};
 function resolveBaseUrl(explicit) {
   const raw = explicit ?? process.env.SWARM_URL ?? readDaemonInfo()?.url ?? `http://127.0.0.1:${DEFAULT_PORT}`;
   return raw.replace(/\/$/, "");
 }
+// packages/core/src/actor.ts
+var HUMAN_ALIASES = new Set(["cli", "dashboard", "me", "desktop", "human"]);
+var DAEMON_ALIASES = new Set(["daemon", "system", "swarm"]);
+// packages/core/src/audit.ts
+var AUDIT_TYPES = new Set([
+  "session.started",
+  "session.ended",
+  "tool.denied",
+  "claim.acquired",
+  "claim.renewed",
+  "claim.released",
+  "claim.expired",
+  "claim.orphaned",
+  "worktree.created",
+  "worktree.removed",
+  "worktree.bootstrapped",
+  "pr.opened",
+  "question.asked",
+  "question.answered",
+  "dispatch.queued",
+  "dispatch.started",
+  "dispatch.finished",
+  "resource.acquired",
+  "resource.released",
+  "resource.reaped",
+  "process.started",
+  "process.exited",
+  "gate.recorded",
+  "handoff.recorded",
+  "permission.requested",
+  "permission.resolved",
+  "incident.opened",
+  "incident.acked",
+  "run.result",
+  "workflow.started",
+  "workflow.finished"
+]);
+var AUDIT_TYPES_SQL = [...AUDIT_TYPES].map((t) => `'${t}'`).join(", ");
+// packages/core/src/budget.ts
+var BUDGET_ASK_TOOLS = new Set(["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit"]);
+// packages/core/src/rules.ts
+var LIVE_WINDOW_MS = 10 * 60000;
+function otherLiveInSameTree(current, sessions, now, withinMs = LIVE_WINDOW_MS) {
+  if (!current.toplevel)
+    return null;
+  for (const s of sessions) {
+    if (s.id === current.id)
+      continue;
+    if (s.state === "ended")
+      continue;
+    if (s.toplevel !== current.toplevel)
+      continue;
+    if (now - new Date(s.lastSeenAt).getTime() > withinMs)
+      continue;
+    return s;
+  }
+  return null;
+}
+function isBroadStage(cmd) {
+  const c = cmd.trim();
+  if (/\bgit\s+add\s+(-A\b|--all\b|\.(\s|$))/.test(c))
+    return true;
+  if (/\bgit\s+commit\b[^|&;]*\s-[a-zA-Z]*a/.test(c))
+    return true;
+  if (/\bgit\s+add\s*$/.test(c))
+    return true;
+  return false;
+}
+function isDestructiveGit(cmd) {
+  const c = cmd.trim();
+  return /\bgit\s+reset\s+[^|&;]*--hard\b/.test(c) || /\bgit\s+checkout\s+(--\s+)?\.(\s|$)/.test(c) || /\bgit\s+checkout\s+-f\b/.test(c) || /\bgit\s+restore\s+(--\s+)?\.(\s|$)/.test(c) || /\bgit\s+clean\s+[^|&;]*-[a-zA-Z]*f/.test(c) || /\bgit\s+stash\s+(drop|clear)\b/.test(c) || /\bgit\s+branch\s+[^|&;]*-[a-zA-Z]*D/.test(c);
+}
+function isPatternKill(cmd) {
+  return /\bpkill\s+-f\b/.test(cmd) || /\bpgrep\s+-f\b[^|]*\|\s*[^|]*\bkill\b/.test(cmd);
+}
+function killedPorts(cmd) {
+  const ports = new Set;
+  const killy = /\b(kill|fuser\s+-[a-z]*k|kill-port)\b/.test(cmd);
+  if (!killy)
+    return [];
+  for (const m of cmd.matchAll(/(?:-i\s*:?|:)(\d{2,5})\b/g))
+    ports.add(Number(m[1]));
+  for (const m of cmd.matchAll(/\bkill-port\s+(\d{2,5})/g))
+    ports.add(Number(m[1]));
+  for (const m of cmd.matchAll(/\bfuser\s+-[a-z]*k\s+(\d{2,5})/g))
+    ports.add(Number(m[1]));
+  return [...ports];
+}
+var DEFAULT_MODES = {
+  shared_tree: "ask",
+  destructive_git: "ask",
+  pattern_kill: "ask",
+  protected_ports: "ask",
+  no_foreign_worktree: "ask",
+  claim_required_to_write: "off",
+  protected: { ports: [] }
+};
+function guardBash(cmd, current, sessions, now, modes = DEFAULT_MODES) {
+  const other = () => otherLiveInSameTree(current, sessions, now);
+  const hit = (rule, reason) => {
+    const mode = modes[rule];
+    return mode === "off" ? { action: "allow" } : { action: mode, rule, reason };
+  };
+  if (modes.protected_ports !== "off" && modes.protected.ports.length) {
+    const target = killedPorts(cmd).filter((p) => modes.protected.ports.includes(p));
+    if (target.length) {
+      const d = hit("protected_ports", `Port${target.length > 1 ? "s" : ""} ${target.join(", ")} ${target.length > 1 ? "are" : "is"} protected in the Swarm config \u2014 something the owner relies on is listening there. Don't kill it.`);
+      if (d.action !== "allow")
+        return d;
+    }
+  }
+  if (modes.pattern_kill !== "off" && isPatternKill(cmd)) {
+    const d = hit("pattern_kill", "This kills processes by command pattern \u2014 it will match every process on the machine that fits, including other agents' or the owner's. Kill by pid instead.");
+    if (d.action !== "allow")
+      return d;
+  }
+  if (modes.shared_tree !== "off" && isBroadStage(cmd)) {
+    const o = other();
+    if (o) {
+      const d = hit("shared_tree", `Another session (${o.id.slice(0, 8)}) is active in this same checkout. \`git add -A\` / \`git commit -a\` will sweep its uncommitted changes into your commit. Stage explicit paths (\`git add <path>\`), or give each session its own git worktree.`);
+      if (d.action !== "allow")
+        return d;
+    }
+  }
+  if (modes.destructive_git !== "off" && isDestructiveGit(cmd)) {
+    const o = other();
+    if (o) {
+      const d = hit("destructive_git", `Another session (${o.id.slice(0, 8)}) is active in this same checkout and may have uncommitted work. This command can discard it. Coordinate, or use a separate git worktree.`);
+      if (d.action !== "allow")
+        return d;
+    }
+  }
+  return { action: "allow" };
+}
+function norm(p) {
+  const parts = [];
+  for (const seg of p.split("/")) {
+    if (seg === "" || seg === ".")
+      continue;
+    if (seg === "..")
+      parts.pop();
+    else
+      parts.push(seg);
+  }
+  return `/${parts.join("/")}`;
+}
+function isInside(path, dir) {
+  if (!path || !dir)
+    return false;
+  const a = norm(path);
+  const d = norm(dir);
+  return a === d || a.startsWith(`${d}/`);
+}
+function absolutePath(path, cwd) {
+  if (path.startsWith("/"))
+    return path;
+  if (path.startsWith("~/"))
+    return path;
+  return `${cwd.replace(/\/+$/, "")}/${path}`;
+}
+var WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
+function guardWrite(target, current, claims, modes = DEFAULT_MODES, kind = "file") {
+  const hit = (rule, reason) => {
+    const mode = modes[rule];
+    return mode === "off" ? { action: "allow" } : { action: mode, rule, reason };
+  };
+  const held = claims.filter((c) => c.worktree);
+  const mine = held.find((c) => isInside(current.cwd, c.worktree)) ?? null;
+  if (modes.no_foreign_worktree !== "off") {
+    const foreign = held.find((c) => isInside(target, c.worktree) && c !== mine);
+    if (foreign) {
+      const d = hit("no_foreign_worktree", kind === "bash" ? `This command runs inside the worktree for "${foreign.task}", held by ${foreign.owner}. Never touch a worktree you don't hold \u2014 work in your own checkout, or claim the task.` : `${target} is inside the worktree for "${foreign.task}", held by ${foreign.owner}. Never touch a worktree you don't hold \u2014 edit your own checkout, or claim the task.`);
+      if (d.action !== "allow")
+        return d;
+    }
+  }
+  if (modes.claim_required_to_write !== "off" && kind === "file" && current.toplevel && !mine) {
+    const inShared = isInside(target, current.toplevel) && !held.some((c) => isInside(target, c.worktree));
+    if (inShared) {
+      const d = hit("claim_required_to_write", `This repo requires a claim before writing to its shared checkout. Run \`swarm claim <task>\` (or the swarm_claim MCP tool) and work in the worktree it creates.`);
+      if (d.action !== "allow")
+        return d;
+    }
+  }
+  return { action: "allow" };
+}
+// packages/core/src/ledger.ts
+var EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+// packages/core/src/policy.ts
+import { createHash } from "crypto";
+var POLICY_CACHE_VERSION = 1;
+var POLICY_CACHE_FILE = "policy.cache.json";
+var digest = (body) => createHash("sha256").update(JSON.stringify(body)).digest("hex");
+function verifyPolicyCache(raw) {
+  if (!raw || typeof raw !== "object")
+    return null;
+  const c = raw;
+  if (c.version !== POLICY_CACHE_VERSION || typeof c.sha256 !== "string")
+    return null;
+  const { sha256, ...body } = c;
+  if (!body.modes || !Array.isArray(body.sessions) || !Array.isArray(body.worktrees))
+    return null;
+  return digest(body) === sha256 ? c : null;
+}
+function evaluateOffline(cache, raw, toplevel, now = Date.now()) {
+  const tool = typeof raw.tool_name === "string" ? raw.tool_name : "";
+  const input = raw.tool_input ?? {};
+  const id = typeof raw.session_id === "string" ? raw.session_id : "";
+  const cwd = typeof raw.cwd === "string" ? raw.cwd : "";
+  const isWrite = WRITE_TOOLS.has(tool) && typeof input.file_path === "string";
+  const cmd = tool === "Bash" && typeof input.command === "string" ? input.command : null;
+  if (!isWrite && !cmd)
+    return { action: "allow" };
+  const current = { id, cwd, toplevel: toplevel(cwd) };
+  const modes = cache.modes;
+  if (modes.no_foreign_worktree !== "off" || modes.claim_required_to_write !== "off") {
+    const target = isWrite ? absolutePath(input.file_path, cwd) : cwd;
+    const w = guardWrite(target, current, cache.worktrees, modes, isWrite ? "file" : "bash");
+    if (w.action !== "allow")
+      return w;
+  }
+  if (!cmd)
+    return { action: "allow" };
+  return guardBash(cmd, current, cache.sessions, now, modes);
+}
 // packages/hook/src/bin.ts
 var event = process.argv[2] ?? "Unknown";
 var input = await Bun.stdin.text();
 var timeout = Number(process.env.SWARM_HOOK_TIMEOUT_MS ?? 400);
 var post = async (base) => {
-  const r = await fetch(`${base}/v1/hook/${event}`, {
+  const r = await authedFetch(`${base}/v1/hook/${event}`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: input || "{}",
@@ -48,5 +293,42 @@ if (out === null && base !== fallback) {
     out = await post(fallback);
   } catch {}
 }
+if (out === null && event === "PreToolUse")
+  out = offline();
 process.stdout.write(`${out ?? "{}"}
 `);
+function offline() {
+  try {
+    const file = join2(swarmHome(), POLICY_CACHE_FILE);
+    if (!existsSync2(file))
+      return null;
+    const cache = verifyPolicyCache(JSON.parse(readFileSync2(file, "utf8")));
+    if (!cache)
+      return null;
+    const raw = input ? JSON.parse(input) : {};
+    const d = evaluateOffline(cache, raw, gitToplevel);
+    if (d.action === "allow")
+      return null;
+    return JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: d.action,
+        permissionDecisionReason: `[swarm \xB7 daemon unreachable, policy-locked rule] ${d.reason}`
+      }
+    });
+  } catch {
+    return null;
+  }
+}
+function gitToplevel(cwd) {
+  let dir = cwd;
+  while (dir) {
+    if (existsSync2(join2(dir, ".git")))
+      return dir;
+    const up = dirname(dir);
+    if (up === dir)
+      return null;
+    dir = up;
+  }
+  return null;
+}

package/dist/swarm-mcp.js

@@ -19670,6 +19670,22 @@ function readDaemonInfo() {
     return null;
   }
 }
+var tokenFile = (home = swarmHome()) => join(home, "token");
+function readToken(home = swarmHome()) {
+  try {
+    const t = readFileSync(tokenFile(home), "utf8").trim();
+    return /^[a-f0-9]{64}$/.test(t) ? t : null;
+  } catch {
+    return null;
+  }
+}
+var authedFetch = (input, init) => {
+  const h = new Headers(init?.headers);
+  const t = readToken();
+  if (t && !h.has("authorization"))
+    h.set("authorization", `Bearer ${t}`);
+  return fetch(input, { ...init, headers: h });
+};
 function alive(pid) {
   try {
     process.kill(pid, 0);
@@ -19726,7 +19742,7 @@ var OWNER = process.env.SWARM_OWNER ?? "agent";
 var SESSION = process.env.CLAUDE_SESSION_ID ?? null;
 async function api2(path, init) {
   const base = await ensureDaemon({ quiet: true }).catch(() => resolveBaseUrl());
-  const r = await fetch(`${base}${path}`, init);
+  const r = await authedFetch(`${base}${path}`, init);
   return await r.json().catch(() => ({}));
 }
 async function projectId() {
@@ -19936,15 +19952,44 @@ ${lines.join(`
     return ok(`asked as question #${r.question?.id}. A human will see it on the dashboard; the answer arrives as [swarm] context on a later tool call, or via swarm_inbox. Continue with what doesn't depend on it, or stop and say you're waiting.`, r.question);
   });
   server.registerTool("swarm_inbox", {
-    title: "Answers waiting for you",
-    description: "Answers a human has given to your swarm_ask questions that you haven't received yet.",
+    title: "What's waiting for you",
+    description: "Answers to your swarm_ask questions and messages other agents or the human sent you (swarm_send) that you haven't received yet.",
     inputSchema: {}
   }, async () => {
     const qs = await api2(`/v1/inbox?session=${encodeURIComponent(SESSION ?? "")}`);
-    if (!qs.length)
-      return ok("no new answers", []);
-    return ok(qs.map((q) => `#${q.id} "${q.text}" \u2192 ${q.answeredBy ?? "a human"}: ${q.answer}`).join(`
-`), qs);
+    const ms = await api2(`/v1/messages/inbox?session=${encodeURIComponent(SESSION ?? "")}`);
+    if (!qs.length && !ms.length)
+      return ok("nothing new", []);
+    const lines = [
+      ...qs.map((q) => `answer #${q.id} "${q.text}" \u2192 ${q.answeredBy ?? "a human"}: ${q.answer}`),
+      ...ms.map((m) => `message #${m.id} from ${m.from ?? "unknown"}${m.task ? ` (re ${m.task})` : ""}: ${m.text}`)
+    ];
+    return ok(lines.join(`
+`), { answers: qs, messages: ms });
+  });
+  server.registerTool("swarm_send", {
+    title: "Message another agent (or the human)",
+    description: `Send a short message to another session (session id), to whoever holds a task (task id), or to "lead" \u2014 the human's interactive session in this project. Delivery is on their next tool call (or immediately to a spawned run); replies come back via swarm_inbox.`,
+    inputSchema: {
+      to: exports_external.string().describe('session id, task id, or "lead"'),
+      text: exports_external.string().max(4000)
+    }
+  }, async ({ to, text }) => {
+    const pid = await projectId();
+    const r = await api2("/v1/messages", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        projectId: pid,
+        to,
+        text,
+        sessionId: SESSION,
+        from: OWNER === "agent" && SESSION ? `agent ${SESSION.slice(0, 8)}` : OWNER
+      })
+    });
+    if (!r.ok)
+      return fail(r.error ?? "send failed");
+    return ok(`sent #${r.message?.id}${r.message?.sessionId ? "" : " (queued until the target appears)"}`, r.message);
   });
   server.registerTool("swarm_dispatch", {
     title: "Dispatch tasks to spawned agents",
@@ -20025,7 +20070,7 @@ ${body}`, g);
     const r = await api2("/v1/claims", {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ projectId: pid, task, owner: owner ?? OWNER })
+      body: JSON.stringify({ projectId: pid, task, owner: owner ?? OWNER, sessionId: SESSION })
     });
     if (!r.ok)
       return fail(`REFUSED: ${r.error}`);