@robzilla1738/agentswarm 0.5.0 → 0.7.0

package/dist/hub.js

@@ -43,6 +43,7 @@ const url_1 = require("url");
 const config_1 = require("./config");
 const control_1 = require("./control");
 const crawltools_1 = require("./crawltools");
+const webtools_1 = require("./webtools");
 const deepseek_1 = require("./deepseek");
 const providers_1 = require("./providers");
 const journal_1 = require("./journal");
@@ -83,9 +84,16 @@ function startHub(opts) {
 async function handle(req, res, opts) {
     const url = new url_1.URL(req.url || "/", `http://localhost:${opts.port}`);
     const p = url.pathname;
-    res.setHeader("access-control-allow-origin", "*");
-    res.setHeader("access-control-allow-methods", "GET, POST, DELETE, OPTIONS");
-    res.setHeader("access-control-allow-headers", "content-type");
+    // Localhost-only CORS. The hub launches runs and reads reports with the
+    // operator's keys — a random website's JS must never get a readable
+    // response. The dev UI on another localhost port is the one legitimate
+    // cross-origin client; everyone else gets no CORS headers at all.
+    const origin = String(req.headers.origin || "");
+    if (/^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/.test(origin)) {
+        res.setHeader("access-control-allow-origin", origin);
+        res.setHeader("access-control-allow-methods", "GET, POST, DELETE, OPTIONS");
+        res.setHeader("access-control-allow-headers", "content-type");
+    }
     if (req.method === "OPTIONS") {
         res.writeHead(204);
         res.end();
@@ -159,6 +167,49 @@ async function api(req, res, url, opts) {
         const r = await (0, sandbox_1.testSandbox)(cfg, kind);
         return sendJson(res, 200, { kind, ...r });
     }
+    // Settings diagnostics: prove the search engines / crawl backend actually
+    // work with the saved keys before a mission depends on them.
+    if (p === "/api/search/test" && method === "POST") {
+        const q = "open source vector database";
+        const probe = async (engine, fn) => {
+            try {
+                const hits = await fn();
+                return { engine, ok: hits.length > 0, detail: `${hits.length} result(s)` };
+            }
+            catch (e) {
+                return { engine, ok: false, detail: (0, util_1.errMsg)(e) };
+            }
+        };
+        const checks = (0, webtools_1.searchEngines)(cfg).map((e) => probe(e.name, () => e.search(q, 3)));
+        const engines = await Promise.all(checks);
+        return sendJson(res, 200, { ok: engines.some((e) => e.ok), engines });
+    }
+    if (p === "/api/crawl/test" && method === "POST") {
+        const backend = (0, crawltools_1.resolveCrawlBackend)(cfg);
+        if (!backend) {
+            return sendJson(res, 200, { ok: false, backend: null, detail: "no crawl backend configured — add a key first" });
+        }
+        try {
+            if ((0, crawltools_1.hasScrapeBackend)(cfg)) {
+                const text = await (0, crawltools_1.scrapeUrl)(cfg, "https://example.com/");
+                return sendJson(res, 200, {
+                    ok: Boolean(text && text.length > 50),
+                    backend,
+                    detail: text ? `scraped ${text.length} chars` : "empty scrape result",
+                });
+            }
+            // deepcrawl has no single-page scrape — smoke a 1-page crawl instead.
+            const out = await (0, crawltools_1.crawlSite)(cfg, { url: "https://example.com/", maxPages: 1 });
+            return sendJson(res, 200, {
+                ok: out.pages.length > 0,
+                backend,
+                detail: out.pages.length ? `crawled ${out.pages.length} page(s)` : out.warnings.join("; ") || "no pages",
+            });
+        }
+        catch (e) {
+            return sendJson(res, 200, { ok: false, backend, detail: (0, util_1.errMsg)(e) });
+        }
+    }
     if (p === "/api/models" && method === "GET") {
         try {
             const models = await (0, deepseek_1.listModels)(cfg);
@@ -297,6 +348,14 @@ async function api(req, res, url, opts) {
             res.end(fs.readFileSync(file));
             return;
         }
+        if (sub === "/plan" && method === "GET") {
+            const file = path.join((0, config_1.runDir)(id), "artifacts", "mission-plan.md");
+            if (!fs.existsSync(file))
+                return sendJson(res, 404, { error: "no plan yet" });
+            res.writeHead(200, { "content-type": "text/markdown; charset=utf-8" });
+            res.end(fs.readFileSync(file));
+            return;
+        }
         if (sub === "/artifacts" && method === "GET") {
             return sendJson(res, 200, { artifacts: listArtifactFiles(id) });
         }
@@ -429,6 +488,9 @@ function publicConfig(cfg) {
         reasoningEffort: cfg.reasoningEffort,
         safeMode: cfg.safeMode,
         contextTokenLimit: cfg.contextTokenLimit,
+        contextWindows: cfg.contextWindows,
+        cheapModel: cfg.cheapModel,
+        strongModel: cfg.strongModel,
         knownModels,
         pricing: cfg.pricing,
     };
@@ -482,6 +544,8 @@ function snapshot(state, id) {
         operatorNotes: state.operatorNotes,
         usageByModel: Object.fromEntries(state.usageByModel),
         cost: state.cost,
+        budgetSeries: state.budgetSeries,
+        planExcerpt: state.planExcerpt,
         finalSummary: state.finalSummary,
         finalReportPath: state.finalReportPath,
         live: (0, run_1.isRunLive)(id),

package/dist/journal.js

@@ -88,11 +88,14 @@ class Journal {
         }
         return ev;
     }
+    /** The chunk an async drain is writing right now — flushSync must see it. */
+    inFlight = "";
     async drain() {
         if (!this.buf)
             return;
         const chunk = this.buf;
         this.buf = "";
+        this.inFlight = chunk;
         try {
             await fs.promises.appendFile(this.file, chunk, "utf8");
             this.failures = 0;
@@ -107,16 +110,26 @@ class Journal {
                 process.stderr.write(`agentswarm: journal writes are failing (${String(e)}); run state is no longer durable\n`);
             }
         }
+        finally {
+            this.inFlight = "";
+        }
     }
     flush() {
         return this.chain.then(() => this.drain());
     }
-    /** Last-gasp synchronous flush for signal handlers and exit paths. */
+    /**
+     * Last-gasp synchronous flush for signal handlers and exit paths. Includes
+     * any chunk a pending async drain holds: process.exit would abandon that
+     * write, silently losing just-settled events. If the abandoned write did
+     * land first, the chunk appears twice — readers dedupe by seq.
+     */
     flushSync() {
-        if (!this.buf)
+        const pending = this.inFlight + this.buf;
+        if (!pending)
             return;
         try {
-            fs.appendFileSync(this.file, this.buf, "utf8");
+            fs.appendFileSync(this.file, pending, "utf8");
+            this.inFlight = "";
             this.buf = "";
         }
         catch {
@@ -136,7 +149,24 @@ function readEvents(runDirPath) {
     catch {
         return [];
     }
-    return parseLines(raw).events;
+    return dedupeBySeq(parseLines(raw).events);
+}
+/**
+ * Seq is strictly increasing in a healthy journal; a chunk can appear twice
+ * when a signal-handler flushSync raced an in-flight async append. Replays of
+ * already-seen seqs are dropped.
+ */
+function dedupeBySeq(events, lastSeq = 0) {
+    let max = lastSeq;
+    const out = [];
+    for (const ev of events) {
+        if (typeof ev.seq === "number" && ev.seq <= max)
+            continue;
+        if (typeof ev.seq === "number")
+            max = ev.seq;
+        out.push(ev);
+    }
+    return out;
 }
 function lastSeq(runDirPath) {
     const evs = readEvents(runDirPath);
@@ -155,6 +185,7 @@ function readNewEvents(file, state) {
         // Truncated/rewritten (should not happen) — start over.
         state.offset = 0;
         state.carry = "";
+        state.lastSeq = 0;
     }
     if (stat.size === state.offset)
         return [];
@@ -172,7 +203,10 @@ function readNewEvents(file, state) {
             const text = state.carry + buf.toString("utf8", 0, n);
             const parsed = parseLines(text, true);
             state.carry = parsed.carry;
-            out.push(...parsed.events);
+            const fresh = dedupeBySeq(parsed.events, state.lastSeq ?? 0);
+            if (fresh.length)
+                state.lastSeq = fresh[fresh.length - 1].seq;
+            out.push(...fresh);
         }
         state.offset += read;
         return out;

package/dist/memory.js

@@ -38,7 +38,6 @@ exports.loadMemory = loadMemory;
 exports.appendMemory = appendMemory;
 exports.memoryBlock = memoryBlock;
 const crypto = __importStar(require("crypto"));
-const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const config_1 = require("./config");
 const util_1 = require("./util");
@@ -48,20 +47,27 @@ function memoryFile(cwd) {
     return path.join((0, config_1.home)(), "memory", `${hash}.json`);
 }
 function loadMemory(cwd) {
-    try {
-        const raw = JSON.parse(fs.readFileSync(memoryFile(cwd), "utf8"));
-        return Array.isArray(raw?.entries) ? raw.entries : [];
-    }
-    catch {
+    const raw = (0, util_1.readJson)(memoryFile(cwd), {});
+    if (!Array.isArray(raw.entries))
         return [];
-    }
+    // Memory is best-effort and the file is user-editable: one malformed entry
+    // must degrade to "forgotten", never crash a run at startup.
+    return raw.entries.filter((e) => !!e &&
+        typeof e === "object" &&
+        typeof e.mission === "string" &&
+        typeof e.summary === "string" &&
+        typeof e.status === "string" &&
+        Number.isFinite(e.finishedAt) &&
+        Array.isArray(e.keyDecisions) &&
+        e.keyDecisions.every((d) => typeof d === "string"));
 }
 function appendMemory(cwd, entry) {
     try {
-        const file = memoryFile(cwd);
-        (0, util_1.ensureDir)(path.dirname(file));
-        const entries = [...loadMemory(cwd), entry].slice(-MAX_ENTRIES);
-        fs.writeFileSync(file, JSON.stringify({ cwd: path.resolve(cwd), entries }, null, 2), "utf8");
+        // Same-run entries replace (interim → final); writeJson is temp+rename so
+        // a crash mid-write never loses the prior history.
+        const prior = loadMemory(cwd).filter((e) => !(entry.runId && e.runId === entry.runId));
+        const entries = [...prior, entry].slice(-MAX_ENTRIES);
+        (0, util_1.writeJson)(memoryFile(cwd), { cwd: path.resolve(cwd), entries });
     }
     catch {
         /* memory is best-effort */

package/dist/pdftext.js

@@ -0,0 +1,211 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractPdfText = extractPdfText;
+const zlib = __importStar(require("zlib"));
+/**
+ * Minimal zero-dependency PDF text extraction: inflate FlateDecode content
+ * streams (Node's built-in zlib) and interpret the text-showing operators
+ * (Tj / TJ / ' / "). Good enough for most digitally-produced text PDFs;
+ * returns null for scanned, encrypted, or exotic-encoding documents so the
+ * caller can tell the agent to find an HTML source instead.
+ */
+function extractPdfText(buf) {
+    if (buf.subarray(0, 5).toString("latin1") !== "%PDF-")
+        return null;
+    // latin1 preserves bytes 1:1, so stream offsets in the string match the buffer.
+    const raw = buf.toString("latin1");
+    const pages = (raw.match(/\/Type\s*\/Pages?\b/g) || []).filter((m) => !/Pages/.test(m)).length || 1;
+    let text = "";
+    const streamRe = /<<([\s\S]{0,2000}?)>>\s*stream\r?\n/g;
+    let m;
+    while ((m = streamRe.exec(raw))) {
+        const dict = m[1];
+        const start = m.index + m[0].length;
+        const end = raw.indexOf("endstream", start);
+        if (end < 0)
+            continue;
+        streamRe.lastIndex = end;
+        // Only plain or Flate-compressed streams are supported.
+        if (/\/Filter/.test(dict) && !/FlateDecode/.test(dict))
+            continue;
+        let len = end;
+        while (len > start && (raw[len - 1] === "\n" || raw[len - 1] === "\r"))
+            len--;
+        let data = buf.subarray(start, len);
+        if (/FlateDecode/.test(dict)) {
+            try {
+                data = zlib.inflateSync(data);
+            }
+            catch {
+                continue;
+            }
+        }
+        const content = data.toString("latin1");
+        if (!/\bBT\b/.test(content))
+            continue; // not a text content stream
+        const extracted = extractFromContent(content);
+        if (extracted.trim())
+            text += extracted + "\n";
+    }
+    const cleaned = text
+        .replace(/[^\S\n]+/g, " ")
+        .replace(/ ?\n ?/g, "\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim();
+    // CID/Type0 fonts yield glyph-index garbage; require a body of real characters.
+    const printable = cleaned.replace(/[^\x20-\x7E\n -￿]/g, "");
+    if (printable.replace(/\s/g, "").length < 40)
+        return null;
+    return { text: printable, pages };
+}
+/** Walk a content stream, collecting strings shown by Tj/TJ/'/" with newline heuristics. */
+function extractFromContent(src) {
+    let out = "";
+    let pending = [];
+    const n = src.length;
+    let i = 0;
+    while (i < n) {
+        const ch = src[i];
+        if (ch === "(") {
+            const [s, next] = parseLiteralString(src, i);
+            pending.push(s);
+            i = next;
+        }
+        else if (ch === "<" && src[i + 1] !== "<") {
+            const close = src.indexOf(">", i + 1);
+            if (close < 0)
+                break;
+            pending.push(decodeHexString(src.slice(i + 1, close)));
+            i = close + 1;
+        }
+        else if (ch === "%") {
+            // comment to end of line
+            while (i < n && src[i] !== "\n" && src[i] !== "\r")
+                i++;
+        }
+        else if (/[A-Za-z'"*]/.test(ch)) {
+            let j = i;
+            while (j < n && /[A-Za-z'"*]/.test(src[j]))
+                j++;
+            const op = src.slice(i, j);
+            if (op === "Tj" || op === "TJ") {
+                out += pending.join("");
+            }
+            else if (op === "'" || op === '"') {
+                out += "\n" + pending.join("");
+            }
+            else if (op === "Td" || op === "TD" || op === "T*" || op === "Tm" || op === "ET") {
+                if (pending.length)
+                    out += pending.join("");
+                if (!out.endsWith("\n"))
+                    out += "\n";
+            }
+            pending = [];
+            i = j;
+        }
+        else if (ch === "-" || (ch >= "0" && ch <= "9") || ch === ".") {
+            let j = i + 1;
+            while (j < n && /[0-9.]/.test(src[j]))
+                j++;
+            // Large negative kerning inside a TJ array is a word gap.
+            const num = parseFloat(src.slice(i, j));
+            if (num <= -180 && pending.length && !pending[pending.length - 1].endsWith(" "))
+                pending.push(" ");
+            i = j;
+        }
+        else {
+            i++;
+        }
+    }
+    return out;
+}
+/** PDF literal string: balanced parens, backslash escapes, octal codes. */
+function parseLiteralString(src, start) {
+    let out = "";
+    let depth = 0;
+    let i = start;
+    for (; i < src.length; i++) {
+        const ch = src[i];
+        if (ch === "\\") {
+            const next = src[i + 1];
+            if (next >= "0" && next <= "7") {
+                let oct = "";
+                for (let k = 1; k <= 3 && src[i + k] >= "0" && src[i + k] <= "7"; k++)
+                    oct += src[i + k];
+                out += String.fromCharCode(parseInt(oct, 8));
+                i += oct.length;
+            }
+            else {
+                const map = { n: "\n", r: "\r", t: "\t", b: "\b", f: "\f", "(": "(", ")": ")", "\\": "\\" };
+                out += map[next] ?? next ?? "";
+                i++;
+            }
+        }
+        else if (ch === "(") {
+            depth++;
+            if (depth > 1)
+                out += ch;
+        }
+        else if (ch === ")") {
+            depth--;
+            if (depth === 0) {
+                i++;
+                break;
+            }
+            out += ch;
+        }
+        else {
+            out += ch;
+        }
+    }
+    return [out, i];
+}
+/** PDF hex string: byte pairs; a UTF-16BE BOM switches to two-byte chars. */
+function decodeHexString(hex) {
+    const clean = hex.replace(/[^0-9a-fA-F]/g, "");
+    const bytes = [];
+    for (let i = 0; i + 1 < clean.length; i += 2)
+        bytes.push(parseInt(clean.slice(i, i + 2), 16));
+    if (clean.length % 2)
+        bytes.push(parseInt(clean[clean.length - 1] + "0", 16));
+    if (bytes.length >= 2 && bytes[0] === 0xfe && bytes[1] === 0xff) {
+        let s = "";
+        for (let i = 2; i + 1 < bytes.length; i += 2)
+            s += String.fromCharCode((bytes[i] << 8) | bytes[i + 1]);
+        return s;
+    }
+    return bytes.map((b) => String.fromCharCode(b)).join("");
+}

package/dist/prompts.js

@@ -122,7 +122,7 @@ function taskTable(tasks) {
         return "(no tasks yet)";
     const line = (t) => {
         const deps = t.deps.length ? ` deps:[${t.deps.join(",")}]` : "";
-        const extra = t.status === "failed" && t.error ? ` — ${(0, util_1.clip)(t.error, 80)}` : "";
+        const extra = (t.status === "failed" || t.status === "blocked") && t.error ? ` — ${(0, util_1.clip)(t.error, 120)}` : "";
         return `${t.id} [${t.status}${t.attempt > 1 ? ` a${t.attempt}` : ""}] (${t.role})${deps} ${(0, util_1.clip)(t.title, 70)}${extra}`;
     };
     const settled = tasks.filter((t) => ["done", "failed", "blocked"].includes(t.status));
@@ -146,6 +146,13 @@ function taskTable(tasks) {
     }
     return out.join("\n");
 }
+function sourcesLine(t, max = 6) {
+    if (!t.sources?.length)
+        return "";
+    const shown = t.sources.slice(0, max).map((s) => s.url);
+    const more = t.sources.length > max ? ` (+${t.sources.length - max} more)` : "";
+    return `\nsources: ${shown.join(" · ")}${more}`;
+}
 function reportBlock(t) {
     const head = `── ${t.id} (${t.role}) "${(0, util_1.clip)(t.title, 60)}" → ${t.status.toUpperCase()}${t.attempt > 1 ? ` (attempt ${t.attempt})` : ""}`;
     const body = t.report ? (0, util_1.clip)(t.report, 1600) : t.error ? `error: ${(0, util_1.clip)(t.error, 400)}` : "(no report)";
@@ -154,7 +161,7 @@ function reportBlock(t) {
     const files = t.filesTouched?.length ? `\nfiles touched: ${t.filesTouched.join(", ")}` : "";
     const arts = t.artifacts.length ? `\nartifacts: ${t.artifacts.join(", ")}` : "";
     const fb = t.feedback ? `\nverifier: ${(0, util_1.clip)(t.feedback, 300)}` : "";
-    return `${head}\n${body}${facts}${open}${files}${arts}${fb}`;
+    return `${head}\n${body}${facts}${open}${files}${arts}${sourcesLine(t)}${fb}`;
 }
 /**
  * Compact dependency context for a downstream worker: structured handoff
@@ -168,11 +175,12 @@ function depReportBlock(t) {
     const arts = t.artifacts.length ? `\nartifacts: ${t.artifacts.join(", ")}` : "";
     const full = (t.report ?? "").length > 1200 ? `\n(excerpt — full text: read_report("${t.id}"))` : "";
     const body = t.report ? (0, util_1.clip)(t.report, 1200) : t.error ? `error: ${(0, util_1.clip)(t.error, 400)}` : "(no report)";
-    return `${head}\n${body}${facts}${files}${arts}${full}`;
+    return `${head}\n${body}${facts}${files}${arts}${sourcesLine(t)}${full}`;
 }
 // ============================================================ workers
 const ROLE_HINTS = {
-    researcher: "Research craft: be exhaustive. Run deep web_search (deep=true, high count) across several distinct phrasings — pull DOZENS of sources for your sub-question, not three. Triangulate across independent sources; prefer primary docs and official sources over blog spam; capture exact figures, dates, and URLs, and keep the quotable passages the search returns. Record key findings as blackboard notes (with the source URL) and save a structured markdown file of your sources+findings as an artifact so the synthesizer can build on it. " +
+    researcher: "Research craft: be exhaustive. Run deep web_search (deep=true, high count) across several distinct phrasings — pull DOZENS of sources for your sub-question, not three. Triangulate across independent sources; prefer primary docs and official sources over blog spam; capture exact figures, dates, and URLs, and keep the quotable passages the search returns. Record key findings as blackboard notes (with url=<source>) and save a structured markdown file of your sources+findings as an artifact so the synthesizer can build on it. " +
+        "A finding without a source is an opinion: list EVERY source your findings rest on in report(...)'s `sources` field (url + what it supports) — only sources reported there can be cited in the final deliverable. When independent sources disagree on a material fact, post note(kind:'conflict') naming both sources and the discrepancy — never silently pick one. For scientific or technical questions, also run academic_search (arXiv + Crossref) — peer-reviewed beats blog posts. " +
         "If a crawl_site tool is available, use it to ingest whole documentation sites or multi-page sources into local markdown files, then read the saved files — far cheaper and broader than fetching pages one by one.",
     coder: "Engineering craft: read existing code before changing it; match its conventions; build/run/test after every meaningful change and include the command + result in your report. Leave the tree compiling.",
     analyst: "Analysis craft: quantify wherever possible; state assumptions explicitly; separate observation from interpretation; sanity-check numbers twice.",
@@ -209,7 +217,7 @@ OPERATING PROTOCOL
 - You are fully autonomous. Never ask questions; decide and act.
 - Plan briefly, then act in small verified steps: after changing anything, prove it worked (run it, read it back, test it).
 - Evidence over assumption: read before you edit; check outputs; cite concrete paths, commands and numbers.
-- Be token-lean: targeted reads (line ranges, grep via shell) over wholesale dumps; don't re-read unchanged files.
+- Be token-lean: targeted reads (line ranges, grep_files) over wholesale dumps; don't re-read unchanged files. Several edits to one file → one replace_in_file call with edits[].
 - Post durable discoveries other agents will need to the blackboard with note(...) — facts only, used sparingly.
 - Editing files other tasks might also touch? First search_notes for claims, then post note(kind:"claim", key:"<path>") before editing. Claims are advisory — coordinate, don't fight.
 - Save deliverable files with save_artifact so the operator sees them. Pick the format that genuinely fits the deliverable — structured data as .csv/.json, polished documents as self-contained .html, code as runnable files — not everything is a markdown report.
@@ -217,7 +225,7 @@ OPERATING PROTOCOL
 - Genuinely impossible / missing prerequisite → report(status:"blocked", …) early instead of thrashing.
 - You have at most ${opts.maxSteps} tool steps. Budget them.
 - Dependency reports above are excerpts; use read_report(task_id) for full text, and search_notes(query) to find facts posted earlier in the run.
-- ALWAYS end by calling report(...). The conductor sees ONLY that report — it is the entire value of your work. Specific beats vague: what you did, what you verified, key findings, exact paths. Fill key_facts (standalone facts downstream tasks need), open_questions, and files_touched — they are handed verbatim to dependent tasks.
+- ALWAYS end by calling report(...). The conductor sees ONLY that report — it is the entire value of your work. Specific beats vague: what you did, what you verified, key findings, exact paths. Fill key_facts (standalone facts downstream tasks need), open_questions, and files_touched — they are handed verbatim to dependent tasks. If your work drew on the web, fill sources (url + what it supports): only sources reported there can be cited in the final deliverable.
 ${roleHint ? "\n" + roleHint : ""}`;
 }
 exports.WORKER_KICKOFF = "Begin now. Work the task to completion, then call report(...).";
@@ -227,7 +235,7 @@ function forcedFinal(reason) {
     return `${reason} Stop working and call your terminal tool RIGHT NOW with your best honest account: what you completed, what you verified, what remains.`;
 }
 // ============================================================ verifier
-function verifierSystem(meta, task) {
+function verifierSystem(meta, task, depReports = "") {
     return `You are an adversarial verification agent. A worker claims it completed this task — your job is to try to falsify that claim with evidence.
 
 MISSION (for context): ${(0, util_1.clip)(meta.mission, 400)}
@@ -238,18 +246,18 @@ ${task.context ? `Context: ${(0, util_1.clip)(task.context, 600)}` : ""}
 Worker's report:
 ${(0, util_1.clip)(task.report ?? "", 2400)}
 ${task.artifacts.length ? `Claimed artifacts: ${task.artifacts.join(", ")}` : ""}
-
+${depReports ? `\nUPSTREAM INPUTS (settled dependency reports — what this task had to build on; judge completeness against them):\n${depReports}\n` : ""}
 Working directory: ${meta.cwd}
 
 PROTOCOL
 - Do NOT trust the report. Verify concretely with tools: read the files it claims to have written, run the build/tests/commands, fetch the URLs, check the numbers. You see only the worker's CLAIMS — gather your own evidence; do not assume shared context.
 - RUBRIC — fail unless all hold:
-  1. Completeness: every part of the objective and its "Done when" criteria is addressed.
+  1. Completeness: every part of the objective and its "Done when" criteria is addressed${depReports ? " (including everything the upstream inputs handed over)" : ""}.
   2. Evidence: each substantive claim in the report is backed by something you verified yourself.
   3. Deliverables: claimed files/artifacts exist, are non-trivial (not stubs/placeholders), and match what the report says about them.
   4. Correctness: commands/builds/tests the task implies actually succeed when you run them.
 - Spot-check depth over exhaustive breadth; ~5-12 tool steps.
-- Then call verdict(pass, feedback). On fail, feedback must be actionable: exactly what is wrong and where. On pass, one line citing the evidence you checked.`;
+- Then call verdict(pass, feedback, issues). On fail, ALSO fill issues — one entry per concrete problem with the evidence you gathered and the exact change needed; the worker's retry sees them verbatim. On pass, feedback is one line citing the evidence you checked.`;
 }
 exports.VERIFIER_KICKOFF = "Verify now, then call verdict(...).";
 // ============================================================ synthesizer
@@ -265,13 +273,13 @@ Conductor's closing notes: ${opts.finishNotes || "(none)"}
 ALL TASK REPORTS
 ${opts.reports}
 
-${opts.blackboard ? `BLACKBOARD\n${opts.blackboard}\n` : ""}${opts.artifactList ? `ARTIFACTS ON DISK\n${opts.artifactList}\n` : ""}
+${opts.sources ? `SOURCES (numbered, deduplicated from the task reports — the only sources that exist)\n${opts.sources}\n\n` : ""}${opts.blackboard ? `BLACKBOARD\n${opts.blackboard}\n` : ""}${opts.artifactList ? `ARTIFACTS ON DISK\n${opts.artifactList}\n` : ""}
 Working directory: ${opts.meta.cwd}
 
 PROTOCOL
 - You may read files (read_file / list_dir) to confirm specifics before writing — verify key claims you repeat.
 - The mission's PRIMARY deliverable should exist in the format that serves it best, not only as prose. If the task reports produced data, comparisons, or rankings that the artifacts don't already capture in a structured form, save them now with save_artifact (e.g. data/results.csv, data/findings.json) before submitting. Don't duplicate artifacts that already exist — point to them.
-- Then call submit_final with:
+${opts.sources ? `- CITE YOUR SOURCES: where a claim rests on a numbered source, cite it inline as [n]. End report_markdown with a \`## Sources\` section listing each number you actually cited as a markdown link ([n] [title](url)). Never invent a source or cite a number not in the list. Where sources conflict, present both positions with their citations — do not silently pick one.\n` : ""}- Then call submit_final with:
   • report_markdown — the deliverable document. Structure: # title; **Outcome** first (did the mission succeed, headline results); then What was built/found with evidence and exact paths; How to use/run it (if applicable); Open issues & recommended next steps. Write for the operator: complete, concrete, zero filler. Use real markdown tables for tabular findings. (A styled HTML rendering is generated automatically — do not hand-write one.)
   • summary — ≤8 sentences for the console.
 - The report stands alone: a reader who saw nothing else must understand what happened and where everything is.`;
@@ -292,7 +300,7 @@ ${reports}
 
 Reply with EXACTLY "COMPLETE" if the mission's requirements are genuinely covered. Otherwise reply with a short numbered list of concrete gaps (max 5), each one actionable enough to become a task. Do not invent nice-to-haves — only true gaps against the stated mission.`;
 }
-function synthCheckPrompt(mission, reports, finalReport) {
+function synthCheckPrompt(mission, reports, finalReport, sources) {
     return `You are checking a final mission report for faithfulness before delivery. Compare it against the underlying task reports.
 
 MISSION
@@ -301,10 +309,10 @@ ${mission}
 TASK REPORTS (ground truth)
 ${reports}
 
-FINAL REPORT (to check)
+${sources ? `SOURCE LIST (the only citable sources)\n${sources}\n\n` : ""}FINAL REPORT (to check)
 ${finalReport}
 
-Reply with EXACTLY "OK" if the final report's claims are supported by the task reports and nothing material is misrepresented or fabricated. Otherwise list the specific discrepancies (max 5), each citing what the final report says vs what the task reports support.`;
+Reply with EXACTLY "OK" if the final report's claims are supported by the task reports and nothing material is misrepresented or fabricated${sources ? ", its inline [n] citations all reference numbers that exist in the source list, and no key web-derived factual claim is left uncited" : ""}. Otherwise list the specific discrepancies (max 5), each citing what the final report says vs what the task reports support.`;
 }
 // ============================================================ compaction
 function compactorPrompt(serialized) {

package/dist/report.js

@@ -11,8 +11,46 @@
  * broken markup.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.aggregateSources = aggregateSources;
+exports.sourcesBlock = sourcesBlock;
 exports.mdToHtml = mdToHtml;
 exports.renderFinalHtml = renderFinalHtml;
+const searchcore_1 = require("./searchcore");
+const util_1 = require("./util");
+/**
+ * Dedupe every task's reported sources (by canonical URL) into one numbered
+ * bibliography for the synthesizer. First occurrence wins the number; later
+ * tasks fill in missing titles/dates.
+ */
+function aggregateSources(tasks) {
+    const byKey = new Map();
+    for (const t of tasks) {
+        for (const s of t.sources ?? []) {
+            const key = (0, searchcore_1.canonicalizeUrl)(s.url);
+            const cur = byKey.get(key);
+            if (cur) {
+                if (!cur.taskIds.includes(t.id))
+                    cur.taskIds.push(t.id);
+                if (!cur.title && s.title)
+                    cur.title = s.title;
+                if (!cur.date && s.date)
+                    cur.date = s.date;
+                if (!cur.note && s.note)
+                    cur.note = s.note;
+            }
+            else {
+                byKey.set(key, { ...s, n: byKey.size + 1, taskIds: [t.id] });
+            }
+        }
+    }
+    return [...byKey.values()];
+}
+/** Render the numbered source list for prompts (one line per source). */
+function sourcesBlock(sources) {
+    return sources
+        .map((s) => `[${s.n}] ${s.title ? `${s.title} — ` : ""}${s.url}${s.date ? ` (${s.date})` : ""}${s.note ? ` — ${s.note}` : ""} [cited by ${s.taskIds.join(",")}]`)
+        .join("\n");
+}
 function esc(s) {
     return s
         .replace(/&/g, "&")
@@ -241,7 +279,7 @@ function renderFinalHtml(o) {
   <span class="badge ${o.status}">${o.status}</span>
   <span>run ${esc(o.runId)}</span>
   <span>${esc(date)}</span>
-  <span title="${esc(o.mission.slice(0, 600))}">mission: ${esc(o.mission.length > 90 ? o.mission.slice(0, 90) + "…" : o.mission)}</span>
+  <span title="${esc(o.mission.slice(0, 600))}">mission: ${esc((0, util_1.clip)(o.mission, 90))}</span>
 </header>
 <main>
 ${mdToHtml(o.markdown)}

package/dist/run.js

@@ -198,6 +198,14 @@ function listRuns(pricing) {
         s.pid = readPid(id);
         out.push(applyLiveness(s));
     }
+    // Deleted runs must not pin their reduced state in a long-lived hub forever.
+    const live = new Set(ids);
+    for (const key of summaryCache.keys())
+        if (!live.has(key))
+            summaryCache.delete(key);
+    for (const key of liveCache.keys())
+        if (!live.has(key))
+            liveCache.delete(key);
     out.sort((a, b) => b.createdAt - a.createdAt);
     return out;
 }