@ra3orblade/swarm 0.8.0 → 0.10.0

package/README.md

@@ -221,4 +221,11 @@ bun run dev      # daemon with hot reload
 bun run test     # the suite CI runs
 ```
 
-Apache-2.0.
+Apache-2.0 — everything that runs on one machine: daemon, dashboard, CLI, MCP server, hooks, all
+agent adapters. No telemetry, no account, and that never changes.
+
+The one exception is [`packages/team`](packages/team) — the self-hosted **team daemon** (multi-machine,
+paid tier), which is source-available under
+[FSL-1.1-ALv2](packages/team/LICENSE.md): free for internal use, education, research and
+professional services, converting to Apache-2.0 two years after each release. The boundary is
+simple ([OQ-15](docs/07-open-questions.md)): one machine free, a second person is the product.

package/dist/swarm-hook.js

@@ -77,7 +77,9 @@ var AUDIT_TYPES = new Set([
   "permission.resolved",
   "incident.opened",
   "incident.acked",
-  "run.result"
+  "run.result",
+  "workflow.started",
+  "workflow.finished"
 ]);
 var AUDIT_TYPES_SQL = [...AUDIT_TYPES].map((t) => `'${t}'`).join(", ");
 // packages/core/src/budget.ts
@@ -230,6 +232,8 @@ function guardWrite(target, current, claims, modes = DEFAULT_MODES, kind = "file
 }
 // packages/core/src/ledger.ts
 var EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+// packages/core/src/outcomes.ts
+var DEFAULT_BRANCHES = new Set(["main", "master", "develop", "trunk"]);
 // packages/core/src/policy.ts
 import { createHash } from "crypto";
 var POLICY_CACHE_VERSION = 1;

package/dist/swarm-mcp.js

@@ -19952,15 +19952,44 @@ ${lines.join(`
     return ok(`asked as question #${r.question?.id}. A human will see it on the dashboard; the answer arrives as [swarm] context on a later tool call, or via swarm_inbox. Continue with what doesn't depend on it, or stop and say you're waiting.`, r.question);
   });
   server.registerTool("swarm_inbox", {
-    title: "Answers waiting for you",
-    description: "Answers a human has given to your swarm_ask questions that you haven't received yet.",
+    title: "What's waiting for you",
+    description: "Answers to your swarm_ask questions and messages other agents or the human sent you (swarm_send) that you haven't received yet.",
     inputSchema: {}
   }, async () => {
     const qs = await api2(`/v1/inbox?session=${encodeURIComponent(SESSION ?? "")}`);
-    if (!qs.length)
-      return ok("no new answers", []);
-    return ok(qs.map((q) => `#${q.id} "${q.text}" \u2192 ${q.answeredBy ?? "a human"}: ${q.answer}`).join(`
-`), qs);
+    const ms = await api2(`/v1/messages/inbox?session=${encodeURIComponent(SESSION ?? "")}`);
+    if (!qs.length && !ms.length)
+      return ok("nothing new", []);
+    const lines = [
+      ...qs.map((q) => `answer #${q.id} "${q.text}" \u2192 ${q.answeredBy ?? "a human"}: ${q.answer}`),
+      ...ms.map((m) => `message #${m.id} from ${m.from ?? "unknown"}${m.task ? ` (re ${m.task})` : ""}: ${m.text}`)
+    ];
+    return ok(lines.join(`
+`), { answers: qs, messages: ms });
+  });
+  server.registerTool("swarm_send", {
+    title: "Message another agent (or the human)",
+    description: `Send a short message to another session (session id), to whoever holds a task (task id), or to "lead" \u2014 the human's interactive session in this project. Delivery is on their next tool call (or immediately to a spawned run); replies come back via swarm_inbox.`,
+    inputSchema: {
+      to: exports_external.string().describe('session id, task id, or "lead"'),
+      text: exports_external.string().max(4000)
+    }
+  }, async ({ to, text }) => {
+    const pid = await projectId();
+    const r = await api2("/v1/messages", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        projectId: pid,
+        to,
+        text,
+        sessionId: SESSION,
+        from: OWNER === "agent" && SESSION ? `agent ${SESSION.slice(0, 8)}` : OWNER
+      })
+    });
+    if (!r.ok)
+      return fail(r.error ?? "send failed");
+    return ok(`sent #${r.message?.id}${r.message?.sessionId ? "" : " (queued until the target appears)"}`, r.message);
   });
   server.registerTool("swarm_dispatch", {
     title: "Dispatch tasks to spawned agents",

package/dist/swarm.js

@@ -2,7 +2,15 @@
 // @bun
 
 // packages/cli/src/bin.ts
-import { resolve as resolve3 } from "path";
+import {
+  copyFileSync,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync3,
+  readdirSync,
+  unlinkSync,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { join as join5, resolve as resolve3 } from "path";
 
 // packages/client/src/daemon.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
@@ -189,7 +197,9 @@ var AUDIT_TYPES = new Set([
   "permission.resolved",
   "incident.opened",
   "incident.acked",
-  "run.result"
+  "run.result",
+  "workflow.started",
+  "workflow.finished"
 ]);
 var AUDIT_TYPES_SQL = [...AUDIT_TYPES].map((t) => `'${t}'`).join(", ");
 var DEFAULT_PRIVACY = {
@@ -202,14 +212,65 @@ var BUDGET_ASK_TOOLS = new Set(["Bash", "Edit", "Write", "MultiEdit", "NotebookE
 // packages/core/src/config.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
 import { join as join2 } from "path";
+
+// packages/core/src/workflows.ts
+var NAME_RE = /^[a-z0-9][a-z0-9_.-]{0,39}$/i;
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function parseWorkflows(raw) {
+  const out = {};
+  if (!Array.isArray(raw))
+    return out;
+  for (const w of raw) {
+    if (!isRecord(w) || typeof w.name !== "string" || !NAME_RE.test(w.name))
+      continue;
+    if (!Array.isArray(w.steps) || !w.steps.length)
+      continue;
+    const prompts = isRecord(w.prompts) ? w.prompts : {};
+    const steps = [];
+    for (const s of w.steps) {
+      if (typeof s !== "string" || !s.trim()) {
+        steps.length = 0;
+        break;
+      }
+      const t = s.trim();
+      if (t === "pr")
+        steps.push({ kind: "pr" });
+      else if (t.startsWith("gate:")) {
+        const gate = t.slice(5);
+        if (!NAME_RE.test(gate)) {
+          steps.length = 0;
+          break;
+        }
+        steps.push({ kind: "gate", gate });
+      } else if (NAME_RE.test(t)) {
+        const p = prompts[t];
+        steps.push({
+          kind: "run",
+          name: t,
+          prompt: typeof p === "string" && p.trim() ? p.trim() : null
+        });
+      } else {
+        steps.length = 0;
+        break;
+      }
+    }
+    if (steps.length)
+      out[w.name] = { name: w.name, steps };
+  }
+  return out;
+}
+
+// packages/core/src/config.ts
 var DEFAULT_GATE_TIMEOUT_S = 900;
 var AUTO_MODES = ["session-end", "stop", "off"];
 function parseGateDefs(gates) {
   const out = {};
-  if (!isRecord(gates))
+  if (!isRecord2(gates))
     return out;
   for (const [name, v] of Object.entries(gates)) {
-    if (!isRecord(v))
+    if (!isRecord2(v))
       continue;
     const builtin = v.builtin === "review" ? "review" : null;
     const cmd = typeof v.cmd === "string" ? v.cmd.trim() : "";
@@ -232,7 +293,11 @@ var DEFAULT_CONFIG = {
   daemon: { port: 7777, auth: "loopback-optional" },
   tasks: { source: null, labels: [], team: null },
   gates: { required: [], auto: "session-end", defs: {} },
+  workflows: {},
   budget: { daily: null, weekly: null, warn_at: 0.8, on_exceed: "warn" },
+  models: { allow: [] },
+  notify: { webhook: null },
+  team: { url: null, forward: ["ledger", "cost"], interval: 5 },
   events: { retain_days: 30 },
   audit: { retain_days: 0 },
   privacy: DEFAULT_PRIVACY,
@@ -256,11 +321,11 @@ var DEFAULT_CONFIG = {
   }
 };
 var MODES = ["ask", "deny", "off"];
-function isRecord(v) {
+function isRecord2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function merge(a, b) {
-  if (!isRecord(a) || !isRecord(b))
+  if (!isRecord2(a) || !isRecord2(b))
     return b === undefined ? a : b;
   const out = { ...a };
   for (const [k, v] of Object.entries(b))
@@ -327,6 +392,27 @@ function validate(c) {
       warn_at: Number.isFinite(warnAt) && warnAt > 0 && warnAt < 1 ? warnAt : 0.8,
       on_exceed: b.on_exceed === "ask" || b.on_exceed === "stop" ? b.on_exceed : "warn"
     },
+    workflows: parseWorkflows(c.workflows),
+    notify: {
+      webhook: (() => {
+        const w = c.notify?.webhook;
+        return typeof w === "string" && /^https?:\/\//.test(w.trim()) ? w.trim() : null;
+      })()
+    },
+    models: {
+      allow: Array.isArray(c.models?.allow) ? c.models.allow.filter((m) => typeof m === "string" && m.trim() !== "") : []
+    },
+    team: (() => {
+      const t = c.team ?? {};
+      const url = typeof t.url === "string" && /^https?:\/\//.test(t.url.trim()) ? t.url.trim().replace(/\/+$/, "") : null;
+      const iv = Number(t.interval);
+      const KINDS = ["ledger", "cost", "transcripts"];
+      return {
+        url,
+        forward: Array.isArray(t.forward) ? t.forward.filter((k) => typeof k === "string" && KINDS.includes(k)) : ["ledger", "cost"],
+        interval: Number.isFinite(iv) && iv >= 1 && iv <= 300 ? Math.round(iv) : 5
+      };
+    })(),
     events: {
       retain_days: days(c.events?.retain_days, 30)
     },
@@ -366,7 +452,7 @@ function validate(c) {
   };
 }
 function leafPaths(v, prefix = "") {
-  if (!isRecord(v))
+  if (!isRecord2(v))
     return prefix ? [prefix] : [];
   const keys = Object.keys(v);
   if (keys.length === 0)
@@ -376,7 +462,7 @@ function leafPaths(v, prefix = "") {
 function getPath(v, path) {
   let cur = v;
   for (const seg of path.split(".")) {
-    if (!isRecord(cur))
+    if (!isRecord2(cur))
       return;
     cur = cur[seg];
   }
@@ -386,7 +472,7 @@ function setPath(obj, path, value) {
   const segs = path.split(".");
   let cur = obj;
   for (const seg of segs.slice(0, -1)) {
-    if (!isRecord(cur[seg]))
+    if (!isRecord2(cur[seg]))
       cur[seg] = {};
     cur = cur[seg];
   }
@@ -446,6 +532,8 @@ var LIVE_WINDOW_MS = 10 * 60000;
 var WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
 // packages/core/src/ledger.ts
 var EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+// packages/core/src/outcomes.ts
+var DEFAULT_BRANCHES = new Set(["main", "master", "develop", "trunk"]);
 // packages/core/src/policy.ts
 var HOOK_MARK = "swarm-hook";
 var hookIsOurs = (h) => typeof h.command === "string" && (h.command.includes(HOOK_MARK) || h.command.includes("/packages/hook/src/bin.ts"));
@@ -702,6 +790,26 @@ function status() {
     otherAgents
   };
 }
+function setTeamUrl(home, url) {
+  const path = join3(home, "config.toml");
+  const text = existsSync4(path) ? readFileSync3(path, "utf8") : "";
+  let out;
+  const section = text.match(/(^|\n)\[team\]([\s\S]*?)(?=\n\[|$)/);
+  if (section) {
+    const body = section[2] ?? "";
+    const newBody = /^\s*url\s*=/m.test(body) ? body.replace(/^\s*url\s*=.*$/m, `url = "${url}"`) : `
+url = "${url}"${body}`;
+    out = text.replace(section[0], `${section[1]}[team]${newBody}`);
+  } else {
+    out = `${text}${text && !text.endsWith(`
+`) ? `
+` : ""}
+[team]
+url = "${url}"
+`;
+  }
+  writeFileSync2(path, out);
+}
 
 // packages/cli/src/procs.ts
 import { mkdirSync as mkdirSync2, openSync } from "fs";
@@ -818,7 +926,7 @@ var help = `swarm \u2014 control plane for AI-agent development
   setup              start the daemon, install hooks, open the dashboard (do this first)
   start | stop | restart   manage the background daemon
   status [-p]        live sessions (whole machine, or one project)
-  doctor             check everything and print the fix for each gap
+  doctor [--migrate] check everything and print the fix for each gap (--migrate: apply pending db migrations)
 
   add <path> [--name n]   register (pin) a project
   ls                 list projects
@@ -851,9 +959,15 @@ var help = `swarm \u2014 control plane for AI-agent development
   stats [-p] [--json]     all-time totals, streak, records (the dashboard's Stats view)
   search <query\u2026> [-p] [--kind handoff|incident|gate|session] [--json]   memory over Swarm's own data (handoffs, incidents, gates, what sessions said)
   rules dryrun [--set rule=mode,\u2026] [--limit n] [--json]   replay this repo's history under rule modes; shows what would fire + flaky signals
+  workflow <name> <task> | workflow ls | workflow stop <task>   run a [[workflows]] sequence on a task (M7.8)
+  msg send <to> <text\u2026> [-p]    message a session id, a task's holder, or "lead" (M7.6)
+  msg ls [-p] [--json]          recent messages
+  demo                    open a seeded demo dashboard (own home + port; your real data is untouched)
   audit export [--since 30d|ISO] [-p] [--type claim.acquired] [--format jsonl|csv|json] [--limit n]   the audit log (ledger changes + decisions, with actor) to stdout
+  login [url] [--token t]   log in to the team daemon ([team].url) and register this machine (M8.3c)
+  backup [dest] | restore <src>   snapshot ~/.swarm (VACUUM INTO, zero downtime) / restore it (daemon stopped)
 
-  install | uninstall     add/remove Swarm hooks in ~/.claude/settings.json
+  install [--config-url <team url>] | uninstall     add/remove Swarm hooks in ~/.claude/settings.json (--config-url also points this machine at a team daemon)
 
 Env: SWARM_URL, SWARM_PORT (default 7777), SWARM_HOME (~/.swarm)`;
 async function api(path, init) {
@@ -915,6 +1029,15 @@ Open the dashboard: ${base}`);
     case "install": {
       const evs = install();
       console.log(`installed hooks for ${evs.length} events in ${status().path}`);
+      const cuIdx = rest.indexOf("--config-url");
+      const configUrl = cuIdx >= 0 ? rest[cuIdx + 1] : null;
+      if (configUrl) {
+        if (!/^https?:\/\//.test(configUrl))
+          throw new Error("--config-url must be an http(s) URL to the team daemon");
+        setTeamUrl(swarmHome(), configUrl.replace(/\/+$/, ""));
+        console.log(`[team] url = "${configUrl}" written to ${join5(swarmHome(), "config.toml")}`);
+        console.log("next: swarm login \u2014 to register this machine and pin the org policy key");
+      }
       console.log("restart any running claude session for it to report in.");
       break;
     }
@@ -922,6 +1045,8 @@ Open the dashboard: ${base}`);
       console.log(`removed ${uninstall()} hook entries`);
       break;
     case "doctor": {
+      if (rest.includes("--migrate"))
+        await ensureDaemon({ quiet: true });
       const st = status();
       const bun = Bun.which("bun");
       const claude = Bun.which("claude");
@@ -961,6 +1086,13 @@ Open the dashboard: ${base}`);
       };
       forge2("gh", ["auth", "status", "--active", "-h", "github.com"]);
       forge2("glab", ["auth", "status"]);
+      if (running) {
+        const t = await api("/v1/team").catch(() => null);
+        if (t?.configured) {
+          const lag = t.pending ? `${t.pending} pending${t.oldest ? ` since ${t.oldest}` : ""}` : "in sync";
+          line(!t.lastError, `team forwarding \u2192 ${t.url} (${lag})`, `last error: ${t.lastError} \u2014 check the team daemon and [team].url`);
+        }
+      }
       if (process.env.GITLAB_TOKEN)
         console.log("\xB7 glab uses GITLAB_TOKEN from this shell \u2014 a daemon started by the desktop app won't see it; run `glab auth login` to store it instead");
       if (!running)
@@ -1660,6 +1792,191 @@ ${flag("--body") ?? d.body}`);
          session ${h.sessionId}` : ""}`);
       break;
     }
+    case "workflow": {
+      await ensureDaemon({ quiet: true });
+      const proj = await api("/v1/projects", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ path: resolve3(".") })
+      });
+      if (rest[0] === "ls" || !rest[0]) {
+        const w = await api(`/v1/workflows?project=${proj.id}`);
+        const names = Object.keys(w.defs);
+        console.log(names.length ? `declared: ${names.join(", ")}` : "no [[workflows]] declared in .swarm.toml");
+        for (const r2 of w.runs.slice(0, 20))
+          console.log(`#${r2.id} ${r2.task} \xB7 ${r2.workflow} \xB7 ${r2.state === "running" ? `${r2.stepLabel} (${r2.step + 1}/${r2.steps.length})` : r2.state}${r2.detail ? ` \u2014 ${r2.detail.slice(0, 80)}` : ""}`);
+        break;
+      }
+      if (rest[0] === "stop") {
+        const task2 = rest[1];
+        if (!task2)
+          throw new Error("usage: swarm workflow stop <task>");
+        const r2 = await api("/v1/workflows/stop", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ projectId: proj.id, task: task2 })
+        });
+        if (!r2.ok)
+          throw new Error(r2.error ?? "stop failed");
+        console.log(`stopped the workflow on ${task2}`);
+        break;
+      }
+      const [name, task] = rest;
+      if (!name || !task)
+        throw new Error("usage: swarm workflow <name> <task>");
+      const r = await api("/v1/workflows", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          projectId: proj.id,
+          task,
+          workflow: name,
+          owner: process.env.USER ?? "cli"
+        })
+      });
+      if (!r.ok)
+        throw new Error(r.error ?? "workflow failed to start");
+      console.log(`workflow ${name} started on ${task} (#${r.id}) \u2014 watch the Board`);
+      break;
+    }
+    case "msg": {
+      await ensureDaemon({ quiet: true });
+      const proj = await api("/v1/projects", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ path: resolve3(".") })
+      });
+      if (rest[0] === "send") {
+        const [to, ...words] = rest.slice(1).filter((a) => a !== "-p");
+        if (!to || !words.length)
+          throw new Error('usage: swarm msg send <session|task|"lead"> <text\u2026>');
+        const r = await api("/v1/messages", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            projectId: proj.id,
+            to,
+            text: words.join(" "),
+            from: process.env.USER ?? "me"
+          })
+        });
+        if (!r.ok)
+          throw new Error(r.error ?? "send failed");
+        console.log(`sent #${r.message?.id}${r.message?.sessionId ? "" : " (queued until the target appears)"}`);
+        break;
+      }
+      if (rest[0] === "ls" || !rest[0]) {
+        const ms = await api(`/v1/messages?project=${proj.id}&limit=50`);
+        if (rest.includes("--json")) {
+          console.log(JSON.stringify(ms, null, 2));
+          break;
+        }
+        if (!ms.length) {
+          console.log("no messages");
+          break;
+        }
+        for (const m of ms)
+          console.log(`#${m.id} ${m.deliveredAt ? "\u2713" : "\xB7"} ${m.from ?? "?"} \u2192 ${m.task ?? m.toKind}: ${m.text.slice(0, 100)}`);
+        break;
+      }
+      throw new Error("usage: swarm msg send <to> <text\u2026> | swarm msg ls");
+    }
+    case "backup": {
+      await ensureDaemon({ quiet: true });
+      const dest = resolve3(arg() ?? join5(swarmHome(), "backups", new Date().toISOString().slice(0, 10)));
+      const r = await api("/v1/backup", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ dest })
+      });
+      console.log(`backed up ${r.files.join(", ")} \u2192 ${r.dest}`);
+      console.log(`restore on any machine with: swarm restore ${r.dest} (daemon stopped)`);
+      break;
+    }
+    case "restore": {
+      const src = arg();
+      if (!src)
+        throw new Error("usage: swarm restore <backup dir>  (with the daemon stopped)");
+      if (await daemonRunning())
+        throw new Error("the daemon is running \u2014 stop it first: swarm stop");
+      const home = swarmHome();
+      mkdirSync3(home, { recursive: true });
+      let n = 0;
+      for (const f of readdirSync(resolve3(src))) {
+        if (f === "daemon.json")
+          continue;
+        copyFileSync(join5(resolve3(src), f), join5(home, f));
+        n++;
+      }
+      for (const suffix of ["-wal", "-shm"]) {
+        const p = join5(home, `swarm.db${suffix}`);
+        if (existsSync5(p))
+          unlinkSync(p);
+      }
+      console.log(`restored ${n} files into ${home} \u2014 run: swarm start`);
+      break;
+    }
+    case "login": {
+      await ensureDaemon({ quiet: true });
+      const t = await api("/v1/team");
+      const teamUrl = (arg() ?? t.url)?.replace(/\/+$/, "");
+      if (!teamUrl)
+        throw new Error("no team daemon configured \u2014 set [team] url or run: swarm login <url>");
+      const cfg = await (await authedFetch(`${teamUrl}/t1/auth/config`)).json();
+      const tokIdx = rest.indexOf("--token");
+      let human = null;
+      if (cfg.mode === "oidc") {
+        const flow = await (await authedFetch(`${teamUrl}/t1/auth/device`, { method: "POST" })).json();
+        if (!flow.handle)
+          throw new Error(`login failed: ${flow.error ?? "no device flow"}`);
+        console.log(`visit ${flow.verificationUriComplete ?? flow.verificationUri} and enter code: ${flow.userCode}`);
+        for (;; ) {
+          await new Promise((r) => setTimeout(r, (flow.interval ?? 5) * 1000));
+          const poll = await (await authedFetch(`${teamUrl}/t1/auth/token`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ handle: flow.handle })
+          })).json();
+          if (poll.status === "pending")
+            continue;
+          if (poll.status !== "ok" || !poll.token)
+            throw new Error(`login failed: ${poll.error ?? "denied"}`);
+          human = poll.token;
+          writeFileSync3(join5(swarmHome(), "team-token"), JSON.stringify({
+            url: teamUrl,
+            token: poll.token,
+            subject: poll.subject,
+            role: poll.role
+          }), { mode: 384 });
+          console.log(`logged in as ${poll.subject} (${poll.role})`);
+          break;
+        }
+      } else if (cfg.mode === "token") {
+        human = tokIdx >= 0 ? rest[tokIdx + 1] ?? null : null;
+        if (!human)
+          throw new Error("this team daemon uses a shared token \u2014 run: swarm login --token <secret>");
+      } else {
+        console.log("team daemon runs open (no auth configured) \u2014 registering machine directly");
+      }
+      const reg = await (await authedFetch(`${teamUrl}/t1/machines/register`, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          ...human ? { authorization: `Bearer ${human}` } : {}
+        },
+        body: JSON.stringify({ id: t.machine.id, name: t.machine.name })
+      })).json();
+      const machineToken = reg.token ?? (cfg.mode === "token" ? human : null);
+      if (!machineToken)
+        throw new Error(`machine registration failed: ${reg.error ?? "unknown"}`);
+      await api("/v1/team/credentials", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ token: machineToken, policyPublicKey: cfg.policyPublicKey })
+      });
+      console.log(`machine ${t.machine.name} (${t.machine.id.slice(0, 8)}) registered \u2014 forwarding is authed`);
+      break;
+    }
     case "audit": {
       if (rest[0] !== "export")
         throw new Error("usage: swarm audit export [--since 30d] [-p] [--type t] [--format jsonl|csv|json] [--limit n]");
@@ -2004,6 +2321,33 @@ would have fired (newest last):`);
       }
       break;
     }
+    case "demo": {
+      const home = join5(swarmHome(), "demo");
+      const port = "7799";
+      const [cmd2, ...args] = daemonCommand();
+      if (!cmd2)
+        throw new Error("could not resolve the daemon command");
+      const env = { ...process.env, SWARM_HOME: home, SWARM_PORT: port, SWARM_DEMO: "1" };
+      const up = await authedFetch(`http://127.0.0.1:${port}/v1/health`).then((r) => r.ok).catch(() => false);
+      if (!up) {
+        Bun.spawn([cmd2, ...args], {
+          stdin: "ignore",
+          stdout: "ignore",
+          stderr: "ignore",
+          env
+        }).unref();
+        for (let i = 0;i < 40; i++) {
+          await new Promise((r) => setTimeout(r, 250));
+          if (await authedFetch(`http://127.0.0.1:${port}/v1/health`).then((r) => r.ok).catch(() => false))
+            break;
+        }
+      }
+      const tok = readToken(home);
+      const url = `http://127.0.0.1:${port}/${tok ? `?token=${tok}` : ""}`;
+      Bun.spawn(["open", url]).unref?.();
+      console.log(`demo dashboard: http://127.0.0.1:${port} (home ${home} \u2014 delete it to reset)`);
+      break;
+    }
     case "ui": {
       const base = await ensureDaemon();
       const tok = readToken();