@ra3orblade/swarm 0.9.0 → 0.10.0

package/README.md

@@ -221,4 +221,11 @@ bun run dev      # daemon with hot reload
 bun run test     # the suite CI runs
 ```
 
-Apache-2.0.
+Apache-2.0 — everything that runs on one machine: daemon, dashboard, CLI, MCP server, hooks, all
+agent adapters. No telemetry, no account, and that never changes.
+
+The one exception is [`packages/team`](packages/team) — the self-hosted **team daemon** (multi-machine,
+paid tier), which is source-available under
+[FSL-1.1-ALv2](packages/team/LICENSE.md): free for internal use, education, research and
+professional services, converting to Apache-2.0 two years after each release. The boundary is
+simple ([OQ-15](docs/07-open-questions.md)): one machine free, a second person is the product.

package/dist/swarm-hook.js

@@ -232,6 +232,8 @@ function guardWrite(target, current, claims, modes = DEFAULT_MODES, kind = "file
 }
 // packages/core/src/ledger.ts
 var EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+// packages/core/src/outcomes.ts
+var DEFAULT_BRANCHES = new Set(["main", "master", "develop", "trunk"]);
 // packages/core/src/policy.ts
 import { createHash } from "crypto";
 var POLICY_CACHE_VERSION = 1;

package/dist/swarm.js

@@ -2,6 +2,14 @@
 // @bun
 
 // packages/cli/src/bin.ts
+import {
+  copyFileSync,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync3,
+  readdirSync,
+  unlinkSync,
+  writeFileSync as writeFileSync3
+} from "fs";
 import { join as join5, resolve as resolve3 } from "path";
 
 // packages/client/src/daemon.ts
@@ -287,6 +295,9 @@ var DEFAULT_CONFIG = {
   gates: { required: [], auto: "session-end", defs: {} },
   workflows: {},
   budget: { daily: null, weekly: null, warn_at: 0.8, on_exceed: "warn" },
+  models: { allow: [] },
+  notify: { webhook: null },
+  team: { url: null, forward: ["ledger", "cost"], interval: 5 },
   events: { retain_days: 30 },
   audit: { retain_days: 0 },
   privacy: DEFAULT_PRIVACY,
@@ -382,6 +393,26 @@ function validate(c) {
       on_exceed: b.on_exceed === "ask" || b.on_exceed === "stop" ? b.on_exceed : "warn"
     },
     workflows: parseWorkflows(c.workflows),
+    notify: {
+      webhook: (() => {
+        const w = c.notify?.webhook;
+        return typeof w === "string" && /^https?:\/\//.test(w.trim()) ? w.trim() : null;
+      })()
+    },
+    models: {
+      allow: Array.isArray(c.models?.allow) ? c.models.allow.filter((m) => typeof m === "string" && m.trim() !== "") : []
+    },
+    team: (() => {
+      const t = c.team ?? {};
+      const url = typeof t.url === "string" && /^https?:\/\//.test(t.url.trim()) ? t.url.trim().replace(/\/+$/, "") : null;
+      const iv = Number(t.interval);
+      const KINDS = ["ledger", "cost", "transcripts"];
+      return {
+        url,
+        forward: Array.isArray(t.forward) ? t.forward.filter((k) => typeof k === "string" && KINDS.includes(k)) : ["ledger", "cost"],
+        interval: Number.isFinite(iv) && iv >= 1 && iv <= 300 ? Math.round(iv) : 5
+      };
+    })(),
     events: {
       retain_days: days(c.events?.retain_days, 30)
     },
@@ -501,6 +532,8 @@ var LIVE_WINDOW_MS = 10 * 60000;
 var WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
 // packages/core/src/ledger.ts
 var EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+// packages/core/src/outcomes.ts
+var DEFAULT_BRANCHES = new Set(["main", "master", "develop", "trunk"]);
 // packages/core/src/policy.ts
 var HOOK_MARK = "swarm-hook";
 var hookIsOurs = (h) => typeof h.command === "string" && (h.command.includes(HOOK_MARK) || h.command.includes("/packages/hook/src/bin.ts"));
@@ -757,6 +790,26 @@ function status() {
     otherAgents
   };
 }
+function setTeamUrl(home, url) {
+  const path = join3(home, "config.toml");
+  const text = existsSync4(path) ? readFileSync3(path, "utf8") : "";
+  let out;
+  const section = text.match(/(^|\n)\[team\]([\s\S]*?)(?=\n\[|$)/);
+  if (section) {
+    const body = section[2] ?? "";
+    const newBody = /^\s*url\s*=/m.test(body) ? body.replace(/^\s*url\s*=.*$/m, `url = "${url}"`) : `
+url = "${url}"${body}`;
+    out = text.replace(section[0], `${section[1]}[team]${newBody}`);
+  } else {
+    out = `${text}${text && !text.endsWith(`
+`) ? `
+` : ""}
+[team]
+url = "${url}"
+`;
+  }
+  writeFileSync2(path, out);
+}
 
 // packages/cli/src/procs.ts
 import { mkdirSync as mkdirSync2, openSync } from "fs";
@@ -873,7 +926,7 @@ var help = `swarm \u2014 control plane for AI-agent development
   setup              start the daemon, install hooks, open the dashboard (do this first)
   start | stop | restart   manage the background daemon
   status [-p]        live sessions (whole machine, or one project)
-  doctor             check everything and print the fix for each gap
+  doctor [--migrate] check everything and print the fix for each gap (--migrate: apply pending db migrations)
 
   add <path> [--name n]   register (pin) a project
   ls                 list projects
@@ -911,8 +964,10 @@ var help = `swarm \u2014 control plane for AI-agent development
   msg ls [-p] [--json]          recent messages
   demo                    open a seeded demo dashboard (own home + port; your real data is untouched)
   audit export [--since 30d|ISO] [-p] [--type claim.acquired] [--format jsonl|csv|json] [--limit n]   the audit log (ledger changes + decisions, with actor) to stdout
+  login [url] [--token t]   log in to the team daemon ([team].url) and register this machine (M8.3c)
+  backup [dest] | restore <src>   snapshot ~/.swarm (VACUUM INTO, zero downtime) / restore it (daemon stopped)
 
-  install | uninstall     add/remove Swarm hooks in ~/.claude/settings.json
+  install [--config-url <team url>] | uninstall     add/remove Swarm hooks in ~/.claude/settings.json (--config-url also points this machine at a team daemon)
 
 Env: SWARM_URL, SWARM_PORT (default 7777), SWARM_HOME (~/.swarm)`;
 async function api(path, init) {
@@ -974,6 +1029,15 @@ Open the dashboard: ${base}`);
     case "install": {
       const evs = install();
       console.log(`installed hooks for ${evs.length} events in ${status().path}`);
+      const cuIdx = rest.indexOf("--config-url");
+      const configUrl = cuIdx >= 0 ? rest[cuIdx + 1] : null;
+      if (configUrl) {
+        if (!/^https?:\/\//.test(configUrl))
+          throw new Error("--config-url must be an http(s) URL to the team daemon");
+        setTeamUrl(swarmHome(), configUrl.replace(/\/+$/, ""));
+        console.log(`[team] url = "${configUrl}" written to ${join5(swarmHome(), "config.toml")}`);
+        console.log("next: swarm login \u2014 to register this machine and pin the org policy key");
+      }
       console.log("restart any running claude session for it to report in.");
       break;
     }
@@ -981,6 +1045,8 @@ Open the dashboard: ${base}`);
       console.log(`removed ${uninstall()} hook entries`);
       break;
     case "doctor": {
+      if (rest.includes("--migrate"))
+        await ensureDaemon({ quiet: true });
       const st = status();
       const bun = Bun.which("bun");
       const claude = Bun.which("claude");
@@ -1020,6 +1086,13 @@ Open the dashboard: ${base}`);
       };
       forge2("gh", ["auth", "status", "--active", "-h", "github.com"]);
       forge2("glab", ["auth", "status"]);
+      if (running) {
+        const t = await api("/v1/team").catch(() => null);
+        if (t?.configured) {
+          const lag = t.pending ? `${t.pending} pending${t.oldest ? ` since ${t.oldest}` : ""}` : "in sync";
+          line(!t.lastError, `team forwarding \u2192 ${t.url} (${lag})`, `last error: ${t.lastError} \u2014 check the team daemon and [team].url`);
+        }
+      }
       if (process.env.GITLAB_TOKEN)
         console.log("\xB7 glab uses GITLAB_TOKEN from this shell \u2014 a daemon started by the desktop app won't see it; run `glab auth login` to store it instead");
       if (!running)
@@ -1808,6 +1881,102 @@ ${flag("--body") ?? d.body}`);
       }
       throw new Error("usage: swarm msg send <to> <text\u2026> | swarm msg ls");
     }
+    case "backup": {
+      await ensureDaemon({ quiet: true });
+      const dest = resolve3(arg() ?? join5(swarmHome(), "backups", new Date().toISOString().slice(0, 10)));
+      const r = await api("/v1/backup", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ dest })
+      });
+      console.log(`backed up ${r.files.join(", ")} \u2192 ${r.dest}`);
+      console.log(`restore on any machine with: swarm restore ${r.dest} (daemon stopped)`);
+      break;
+    }
+    case "restore": {
+      const src = arg();
+      if (!src)
+        throw new Error("usage: swarm restore <backup dir>  (with the daemon stopped)");
+      if (await daemonRunning())
+        throw new Error("the daemon is running \u2014 stop it first: swarm stop");
+      const home = swarmHome();
+      mkdirSync3(home, { recursive: true });
+      let n = 0;
+      for (const f of readdirSync(resolve3(src))) {
+        if (f === "daemon.json")
+          continue;
+        copyFileSync(join5(resolve3(src), f), join5(home, f));
+        n++;
+      }
+      for (const suffix of ["-wal", "-shm"]) {
+        const p = join5(home, `swarm.db${suffix}`);
+        if (existsSync5(p))
+          unlinkSync(p);
+      }
+      console.log(`restored ${n} files into ${home} \u2014 run: swarm start`);
+      break;
+    }
+    case "login": {
+      await ensureDaemon({ quiet: true });
+      const t = await api("/v1/team");
+      const teamUrl = (arg() ?? t.url)?.replace(/\/+$/, "");
+      if (!teamUrl)
+        throw new Error("no team daemon configured \u2014 set [team] url or run: swarm login <url>");
+      const cfg = await (await authedFetch(`${teamUrl}/t1/auth/config`)).json();
+      const tokIdx = rest.indexOf("--token");
+      let human = null;
+      if (cfg.mode === "oidc") {
+        const flow = await (await authedFetch(`${teamUrl}/t1/auth/device`, { method: "POST" })).json();
+        if (!flow.handle)
+          throw new Error(`login failed: ${flow.error ?? "no device flow"}`);
+        console.log(`visit ${flow.verificationUriComplete ?? flow.verificationUri} and enter code: ${flow.userCode}`);
+        for (;; ) {
+          await new Promise((r) => setTimeout(r, (flow.interval ?? 5) * 1000));
+          const poll = await (await authedFetch(`${teamUrl}/t1/auth/token`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ handle: flow.handle })
+          })).json();
+          if (poll.status === "pending")
+            continue;
+          if (poll.status !== "ok" || !poll.token)
+            throw new Error(`login failed: ${poll.error ?? "denied"}`);
+          human = poll.token;
+          writeFileSync3(join5(swarmHome(), "team-token"), JSON.stringify({
+            url: teamUrl,
+            token: poll.token,
+            subject: poll.subject,
+            role: poll.role
+          }), { mode: 384 });
+          console.log(`logged in as ${poll.subject} (${poll.role})`);
+          break;
+        }
+      } else if (cfg.mode === "token") {
+        human = tokIdx >= 0 ? rest[tokIdx + 1] ?? null : null;
+        if (!human)
+          throw new Error("this team daemon uses a shared token \u2014 run: swarm login --token <secret>");
+      } else {
+        console.log("team daemon runs open (no auth configured) \u2014 registering machine directly");
+      }
+      const reg = await (await authedFetch(`${teamUrl}/t1/machines/register`, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          ...human ? { authorization: `Bearer ${human}` } : {}
+        },
+        body: JSON.stringify({ id: t.machine.id, name: t.machine.name })
+      })).json();
+      const machineToken = reg.token ?? (cfg.mode === "token" ? human : null);
+      if (!machineToken)
+        throw new Error(`machine registration failed: ${reg.error ?? "unknown"}`);
+      await api("/v1/team/credentials", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ token: machineToken, policyPublicKey: cfg.policyPublicKey })
+      });
+      console.log(`machine ${t.machine.name} (${t.machine.id.slice(0, 8)}) registered \u2014 forwarding is authed`);
+      break;
+    }
     case "audit": {
       if (rest[0] !== "export")
         throw new Error("usage: swarm audit export [--since 30d] [-p] [--type t] [--format jsonl|csv|json] [--limit n]");