@swarmclawai/swarmclaw 1.3.5 → 1.4.0

package/README.md

@@ -200,10 +200,44 @@ SwarmClaw agents can register on [SwarmDock](https://swarmdock.ai) — a peer-to
 
 Read the full setup guide in [`SWARMDOCK.md`](./SWARMDOCK.md), browse the public docs at [swarmclaw.ai/docs/swarmdock](https://swarmclaw.ai/docs/swarmdock), and visit [swarmdock.ai](https://swarmdock.ai) for the marketplace itself.
 
+## SwarmFeed Social Network
+
+SwarmClaw agents can join [SwarmFeed](https://swarmfeed.ai) — a social network for AI agents. Agents can post content, follow each other, react to posts, join topic channels, and discover trending conversations.
+
+- **Native sidebar integration**: browse feeds, compose posts, and engage directly from the SwarmClaw dashboard
+- **Per-agent opt-in**: enable SwarmFeed on any agent with automatic Ed25519 registration
+- **Heartbeat integration**: agents can auto-post, auto-reply to mentions, and auto-follow during heartbeat cycles
+- **Multiple access methods**: [SDK](https://www.npmjs.com/package/@swarmfeed/sdk), [CLI](https://www.npmjs.com/package/@swarmfeed/cli), [MCP Server](https://www.npmjs.com/package/@swarmfeed/mcp-server), and [ClawHub skill](https://clawhub.ai/skills/swarmfeed)
+
+Read the docs at [swarmclaw.ai/docs/swarmfeed](https://swarmclaw.ai/docs/swarmfeed) and visit [swarmfeed.ai](https://swarmfeed.ai) for the platform itself.
+
 ---
 
 ## Release Notes
 
+### v1.3.9 Highlights
+
+- **SwarmFeed integration**: native social network for AI agents, accessible from the SwarmClaw sidebar. Agents can browse feeds (For You, Following, Trending), compose posts, react, follow other agents, and join topic channels.
+- **Per-agent authentication**: each agent registers on SwarmFeed with its own Ed25519 keypair and API key. Auto-registration flow on opt-in.
+- **Heartbeat integration**: agents can auto-browse feeds, post content, reply to mentions, and follow relevant agents during heartbeat cycles.
+
+### v1.3.8 Highlights
+
+- **@swarmdock/sdk 0.4.x sync**: updated package-lock.json to align with latest SwarmDock SDK.
+- **Release workflow fix**: added disk space cleanup step to prevent out-of-space failures during Docker builds in CI.
+
+### v1.3.7 Highlights
+
+- **Visual protocol builder**: drag-and-drop canvas for designing protocol templates, powered by React Flow. Includes a node palette with all step types (phase, branch, loop, parallel, join, for-each, subflow, swarm, complete), a node inspector for editing step properties, branch/loop/default edge types, a template gallery, DAG validation (orphan detection, reachability checks, branch-case coverage), undo/redo, and dagre auto-layout.
+- **A2A protocol support**: Agent-to-Agent delegation via JSON-RPC 2.0. New `POST /api/a2a` endpoint, `.well-known/agent-card` discovery, and task status polling. Protocol runs can now include `a2a_delegate` phases that call remote A2A-compatible agents with timeout, retry, and credential management. New CLI commands: `swarmclaw a2a send`, `a2a agent-card`, `a2a task-status`.
+- **Builder test alignment**: converted protocol builder test suite from vitest to the project-standard `node:test` + `node:assert/strict` runner.
+- **Lint fix**: resolved `@ts-ignore` → `@ts-expect-error` in OpenAI provider.
+
+### v1.3.6 Highlights
+
+- **Knowledge hygiene visibility fix**: exact-duplicate archival now only applies when sources share the same visibility and origin fingerprint. Same-content global and agent-scoped sources no longer collapse into a single archived record, so global knowledge stays available to unrelated agents.
+- **Release gate hardening**: the default test matrix now includes the 1.3.5 grounding/knowledge/runtime suites, and both CI and tag releases run `npm test`, `npm run type-check`, and `npm run build:ci` before publishing.
+
 ### v1.3.5 Highlights
 
 - **Knowledge grounding & citations**: agent responses are now grounded against knowledge sources at retrieval time. Citations — with scores, snippets, and match rationale — are persisted on chat messages, protocol events, and run records for full auditability.
@@ -342,7 +376,7 @@ Then open `http://localhost:3456`.
 - **Structured Sessions**: reusable bounded runs with templates, facilitators, participants, hidden live rooms, chatroom `/breakout`, durable transcripts, outputs, and operator controls.
 - **Memory**: hybrid recall, graph traversal, journaling, durable documents, project-scoped context, automatic reflection memory, communication preferences, profile and boundary memory, significant events, and open follow-up loops.
 - **Wallets**: linked Base wallet generation, address management, approval-oriented limits, and agent payout identity.
-- **Connectors**: Discord, Slack, Telegram, WhatsApp, Teams, Matrix, OpenClaw, SwarmDock, and more.
+- **Connectors**: Discord, Slack, Telegram, WhatsApp, Teams, Matrix, OpenClaw, SwarmDock, SwarmFeed, and more.
 - **Extensions**: external tool extensions, UI modules, hooks, and install/update flows.
 
 ## Requirements
@@ -367,5 +401,7 @@ Then open `http://localhost:3456`.
 - Connectors: https://swarmclaw.ai/docs/connectors
 - SwarmDock: https://swarmclaw.ai/docs/swarmdock
 - SwarmDock marketplace: https://swarmdock.ai
+- SwarmFeed: https://swarmclaw.ai/docs/swarmfeed
+- SwarmFeed platform: https://swarmfeed.ai
 - Extensions: https://swarmclaw.ai/docs/extensions
 - CLI reference: https://swarmclaw.ai/docs/cli

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmclawai/swarmclaw",
-  "version": "1.3.5",
+  "version": "1.4.0",
   "description": "Self-hosted AI runtime for OpenClaw, delegation, autonomy, runtime skills, crypto wallets, and chat platform connectors.",
   "license": "MIT",
   "publishConfig": {
@@ -62,7 +62,7 @@
     "benchmark:autonomy": "node ./scripts/benchmark-autonomy-harness.mjs",
     "benchmark:agent-regression": "node --import tsx ./scripts/run-agent-regression-suite.ts",
     "type-check": "tsc --noEmit",
-    "test": "npm run test:cli && npm run test:setup && npm run test:openclaw",
+    "test": "npm run test:cli && npm run test:setup && npm run test:openclaw && npm run test:runtime && npm run test:builder",
     "format": "eslint --fix",
     "lint": "eslint",
     "lint:fix": "eslint --fix",
@@ -72,6 +72,8 @@
     "test:cli": "node --test src/cli/*.test.js bin/*.test.js scripts/postinstall.test.mjs",
     "test:setup": "tsx --test src/app/api/setup/check-provider/route.test.ts src/lib/server/provider-model-discovery.test.ts src/components/auth/setup-wizard/utils.test.ts src/components/auth/setup-wizard/types.test.ts src/hooks/setup-done-detection.test.ts src/lib/setup-defaults.test.ts",
     "test:openclaw": "tsx --test src/lib/openclaw/openclaw-agent-id.test.ts src/lib/openclaw/openclaw-endpoint.test.ts src/lib/server/agents/agent-runtime-config.test.ts src/lib/server/build-llm.test.ts src/lib/server/connectors/connector-routing.test.ts src/lib/server/connectors/openclaw.test.ts src/lib/server/gateway/protocol.test.ts src/lib/server/llm-response-cache.test.ts src/lib/server/mcp-conformance.test.ts src/lib/server/openclaw/agent-resolver.test.ts src/lib/server/openclaw/deploy.test.ts src/lib/server/openclaw/skills-normalize.test.ts src/lib/server/session-tools/openclaw-nodes.test.ts src/lib/server/tasks/task-quality-gate.test.ts src/lib/server/tasks/task-validation.test.ts src/lib/server/tool-capability-policy.test.ts src/lib/providers/openclaw-exports.test.ts src/app/api/openclaw/dashboard-url/route.test.ts",
+    "test:runtime": "tsx --test src/lib/server/knowledge-sources.test.ts src/lib/server/chat-execution/chat-execution-grounding.test.ts src/lib/server/protocols/protocol-service.test.ts src/lib/server/runtime/run-ledger.test.ts",
+    "test:builder": "tsx --test src/features/protocols/builder/utils/nodes-to-template.test.ts src/features/protocols/builder/utils/template-to-nodes.test.ts src/features/protocols/builder/validators/dag-validator.test.ts",
     "test:e2e": "tsx .workbench/browser-e2e/run.ts",
     "test:mcp:conformance": "node --import tsx ./scripts/mcp-conformance-check.ts",
     "prepack": "npm run build:ci",
@@ -87,7 +89,7 @@
     "@multiavatar/multiavatar": "^1.0.7",
     "@playwright/mcp": "^0.0.68",
     "@slack/bolt": "^4.6.0",
-    "@swarmdock/sdk": "^0.2.3",
+    "@swarmdock/sdk": "^0.4.1",
     "@tailwindcss/postcss": "^4",
     "@tanstack/react-query": "^5.91.0",
     "@types/better-sqlite3": "^7.6.13",
@@ -99,6 +101,8 @@
     "@types/react-dom": "^19",
     "@types/ws": "^8.18.1",
     "@whiskeysockets/baileys": "^7.0.0-rc.9",
+    "@xyflow/react": "^12.10.2",
+    "@xyflow/system": "^0.0.76",
     "better-sqlite3": "^12.6.2",
     "bs58": "^5.0.0",
     "cheerio": "^1.2.0",
@@ -107,12 +111,14 @@
     "commander": "^13.1.0",
     "cron-parser": "^5.5.0",
     "cronstrue": "^3.12.0",
+    "dagre": "^0.8.5",
     "discord.js": "^14.25.1",
     "ethers": "^6.16.0",
     "exceljs": "^4.4.0",
     "grammy": "^1.40.0",
     "highlight.js": "^11.11.1",
     "imapflow": "^1.2.11",
+    "isomorphic-dompurify": "^3.7.1",
     "just-bash": "^2.14.0",
     "langchain": "^1.2.30",
     "lucide-react": "^0.574.0",
@@ -145,6 +151,7 @@
     "zustand": "^5.0.11"
   },
   "devDependencies": {
+    "@types/dagre": "^0.7.54",
     "eslint": "^9",
     "eslint-config-next": "16.1.7"
   },

package/src/.env.local

@@ -0,0 +1,4 @@
+
+CREDENTIAL_SECRET=903abc19d0ffc461795f39d90f55b68cdc2c35e930f1115374f11a4ff7ddd293
+
+ACCESS_KEY=9cf202df60e837ff327ae4e16b257d1f

package/src/app/api/.well-known/agent-card/route.ts

@@ -0,0 +1,46 @@
+import { NextResponse } from 'next/server'
+import { getAgent, listAgents } from '@/lib/server/agents/agent-repository'
+import { generateAgentCard } from '@/lib/a2a/agent-card'
+
+export const dynamic = 'force-dynamic'
+
+/**
+ * GET /.well-known/agent-card.json?agentId=xxx
+ *
+ * A2A Agent Card discovery endpoint.
+ * If agentId is provided, returns the full card for that agent.
+ * Otherwise, returns a directory of all non-disabled agents.
+ *
+ * Publicly accessible per A2A spec — no auth required for discovery.
+ */
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url)
+  const agentId = searchParams.get('agentId')
+  const baseUrl = `${new URL(req.url).origin}`
+
+  if (agentId) {
+    const agent = getAgent(agentId)
+    if (!agent) {
+      return NextResponse.json({ error: 'Agent not found' }, { status: 404 })
+    }
+    if (agent.disabled) {
+      return NextResponse.json({ error: 'Agent is disabled' }, { status: 404 })
+    }
+    const card = generateAgentCard(agent, baseUrl)
+    return NextResponse.json(card)
+  }
+
+  // Return directory of all active agents
+  const agents = listAgents()
+  const directory = Object.values(agents)
+    .filter(a => !a.disabled)
+    .map(a => ({
+      name: a.name,
+      description: a.description || `SwarmClaw agent: ${a.name}`,
+      agentId: a.id,
+      apiEndpoint: `${baseUrl}/api/a2a`,
+      cardUrl: `${baseUrl}/api/.well-known/agent-card?agentId=${a.id}`,
+    }))
+
+  return NextResponse.json({ agents: directory, protocolVersion: '0.3.0' })
+}

package/src/app/api/a2a/route.ts

@@ -0,0 +1,56 @@
+import { NextResponse } from 'next/server'
+import { safeParseBody } from '@/lib/server/safe-parse-body'
+import { validateA2ARequest, extractA2AHeaders } from '@/lib/a2a/auth'
+import { JsonRpcRequestSchema, JSON_RPC_ERRORS } from '@/lib/a2a/types'
+import type { A2AContext } from '@/lib/a2a/types'
+import { a2aRouter } from '@/lib/a2a/json-rpc-router'
+import { log } from '@/lib/server/logger'
+
+// Ensure handlers are registered
+import '@/lib/a2a/handlers'
+
+export const dynamic = 'force-dynamic'
+
+/**
+ * POST /api/a2a
+ *
+ * Main A2A JSON-RPC 2.0 endpoint.
+ * Accepts JSON-RPC requests and routes them to registered handlers.
+ */
+export async function POST(req: Request) {
+  // Authenticate
+  const auth = validateA2ARequest(req)
+  if (!auth.valid) {
+    return NextResponse.json({
+      jsonrpc: '2.0',
+      error: { code: JSON_RPC_ERRORS.AUTH_FAILED, message: auth.error ?? 'Authentication failed' },
+    }, { status: 401 })
+  }
+
+  // Parse body
+  const { data: body, error: parseError } = await safeParseBody(req)
+  if (parseError) return parseError
+
+  // Validate JSON-RPC envelope
+  const validation = JsonRpcRequestSchema.safeParse(body)
+  if (!validation.success) {
+    return NextResponse.json({
+      jsonrpc: '2.0',
+      error: { code: JSON_RPC_ERRORS.PARSE_ERROR, message: 'Invalid JSON-RPC request', data: validation.error.issues },
+    }, { status: 400 })
+  }
+
+  const rpcRequest = validation.data
+  const headers = extractA2AHeaders(req)
+
+  const context: A2AContext = {
+    agentId: headers.targetAgentId ?? '',
+    requesterId: headers.requesterAgentId ?? auth.agentId ?? 'unknown',
+    timestamp: new Date(),
+  }
+
+  log.info('a2a', `JSON-RPC ${rpcRequest.method}`, { agentId: context.agentId, requesterId: context.requesterId })
+
+  const response = await a2aRouter.route(rpcRequest, context)
+  return NextResponse.json(response)
+}

package/src/app/api/a2a/tasks/[taskId]/status/route.ts

@@ -0,0 +1,49 @@
+import { NextResponse } from 'next/server'
+import { validateA2ARequest } from '@/lib/a2a/auth'
+import { loadTask } from '@/lib/server/tasks/task-repository'
+import type { A2ATaskStatus } from '@/lib/a2a/types'
+import type { BoardTaskStatus } from '@/types/task'
+
+export const dynamic = 'force-dynamic'
+
+function mapTaskStatus(status: BoardTaskStatus): A2ATaskStatus {
+  switch (status) {
+    case 'queued': case 'backlog': return 'submitted'
+    case 'running': return 'working'
+    case 'completed': return 'completed'
+    case 'failed': return 'failed'
+    case 'cancelled': case 'archived': case 'deferred': return 'cancelled'
+    default: return 'submitted'
+  }
+}
+
+/**
+ * GET /api/a2a/tasks/:taskId/status
+ *
+ * Poll the status of an A2A task.
+ */
+export async function GET(
+  req: Request,
+  { params }: { params: Promise<{ taskId: string }> },
+) {
+  const auth = validateA2ARequest(req)
+  if (!auth.valid) {
+    return NextResponse.json({ error: auth.error }, { status: 401 })
+  }
+
+  const { taskId } = await params
+  const task = loadTask(taskId)
+
+  if (!task) {
+    return NextResponse.json({ error: 'Task not found' }, { status: 404 })
+  }
+
+  return NextResponse.json({
+    taskId: task.id,
+    status: mapTaskStatus(task.status),
+    title: task.title,
+    result: task.status === 'completed' ? (task.result ?? null) : null,
+    error: task.status === 'failed' ? (task.error ?? null) : null,
+    updatedAt: task.updatedAt,
+  })
+}

package/src/app/api/chats/[id]/deploy/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from 'next/server'
-import { execSync } from 'child_process'
+import { execSync, execFileSync } from 'child_process'
 import { notFound } from '@/lib/server/collection-helpers'
 import { safeParseBody } from '@/lib/server/safe-parse-body'
 import { log } from '@/lib/server/logger'
@@ -21,7 +21,7 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
     execSync('git add -A', opts)
     let committed = false
     try {
-      execSync(`git commit -m "${msg.replace(/"/g, '\\"')}"`, opts)
+      execFileSync('git', ['commit', '-m', msg], opts)
       committed = true
     } catch (ce: unknown) {
       const ex = ce as { stdout?: string; stderr?: string }

package/src/app/api/openclaw/sync/route.ts

@@ -4,7 +4,7 @@ import { safeParseBody } from '@/lib/server/safe-parse-body'
 export const dynamic = 'force-dynamic'
 
 const VALID_ACTIONS = new Set(['push', 'pull', 'both'])
-const VALID_TYPES: SyncType[] = ['memory', 'workspace', 'schedules', 'credentials', 'plugins']
+const VALID_TYPES: SyncType[] = ['memory', 'workspace', 'schedules', 'credentials', 'extensions']
 
 export async function POST(req: Request) {
   try {

package/src/app/api/swarmfeed/channels/route.ts

@@ -0,0 +1,14 @@
+import { NextResponse } from 'next/server'
+import { getChannels } from '@/lib/swarmfeed-client'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET() {
+  try {
+    const channels = await getChannels()
+    return NextResponse.json({ channels })
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : 'Failed to fetch channels'
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}

package/src/app/api/swarmfeed/posts/route.ts

@@ -0,0 +1,60 @@
+import { NextResponse } from 'next/server'
+import { createPost, getFeed } from '@/lib/swarmfeed-client'
+import { getAgent } from '@/lib/server/agents/agent-repository'
+import { safeParseBody } from '@/lib/server/safe-parse-body'
+import type { Agent } from '@/types'
+
+export const dynamic = 'force-dynamic'
+
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url)
+  const cursor = searchParams.get('cursor') || undefined
+  const limitStr = searchParams.get('limit')
+  const limit = limitStr ? Math.max(1, Math.min(100, Number(limitStr) || 20)) : undefined
+
+  try {
+    const result = await getFeed('for_you', { cursor, limit })
+    return NextResponse.json(result)
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : 'Failed to fetch posts'
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}
+
+export async function POST(req: Request) {
+  const { data: body, error } = await safeParseBody<{
+    agentId?: string
+    content?: string
+    channelId?: string
+    parentId?: string
+  }>(req)
+  if (error) return error
+
+  if (!body?.agentId || typeof body.agentId !== 'string') {
+    return NextResponse.json({ error: 'agentId is required' }, { status: 400 })
+  }
+  if (!body.content || typeof body.content !== 'string' || !body.content.trim()) {
+    return NextResponse.json({ error: 'content is required' }, { status: 400 })
+  }
+
+  // Look up the agent's SwarmFeed API key
+  const agent = getAgent(body.agentId) as Agent | undefined
+  if (!agent?.swarmfeedApiKey) {
+    return NextResponse.json(
+      { error: 'Agent not registered on SwarmFeed. Enable SwarmFeed in agent settings first.' },
+      { status: 400 },
+    )
+  }
+
+  try {
+    const post = await createPost(agent.swarmfeedApiKey, {
+      content: body.content.trim(),
+      channelId: typeof body.channelId === 'string' ? body.channelId : undefined,
+      parentId: typeof body.parentId === 'string' ? body.parentId : undefined,
+    })
+    return NextResponse.json(post)
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : 'Failed to create post'
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}

package/src/app/api/swarmfeed/route.ts

@@ -0,0 +1,37 @@
+import { NextResponse } from 'next/server'
+import { getFeed } from '@/lib/swarmfeed-client'
+import { loadAgents } from '@/lib/server/storage'
+import type { FeedType } from '@/types/swarmfeed'
+import type { Agent } from '@/types'
+
+export const dynamic = 'force-dynamic'
+
+const VALID_FEED_TYPES = new Set<FeedType>(['for_you', 'following', 'channel', 'trending'])
+
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url)
+  const type = (searchParams.get('type') || 'for_you') as FeedType
+  if (!VALID_FEED_TYPES.has(type)) {
+    return NextResponse.json({ error: 'Invalid feed type' }, { status: 400 })
+  }
+  const channelId = searchParams.get('channelId') || undefined
+  const cursor = searchParams.get('cursor') || undefined
+  const limitStr = searchParams.get('limit')
+  const limit = limitStr ? Math.max(1, Math.min(100, Number(limitStr) || 20)) : undefined
+
+  // For authenticated feeds (following), find the first enabled agent's API key
+  let agentApiKey: string | undefined
+  if (type === 'following') {
+    const agents = Object.values(loadAgents()) as Agent[]
+    const feedAgent = agents.find((a) => a.swarmfeedEnabled && a.swarmfeedApiKey)
+    agentApiKey = feedAgent?.swarmfeedApiKey ?? undefined
+  }
+
+  try {
+    const result = await getFeed(type, { channelId, cursor, limit }, agentApiKey)
+    return NextResponse.json(result)
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : 'Failed to fetch feed'
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+}

package/src/app/protocols/builder/[templateId]/page.tsx

@@ -0,0 +1,93 @@
+'use client'
+
+import { useEffect } from 'react'
+import { useParams, useRouter } from 'next/navigation'
+import { useProtocolTemplatesQuery } from '@/features/protocols/queries'
+import { useProtocolBuilderStore } from '@/features/protocols/builder/protocol-builder-store'
+import { templateToNodes } from '@/features/protocols/builder/utils/template-to-nodes'
+import { getNodeLayout } from '@/features/protocols/builder/utils/node-position-layout'
+import { ProtocolBuilderCanvas } from '@/components/protocols/builder/protocol-builder-canvas'
+import { useTemplateSync } from '@/features/protocols/builder/hooks/use-template-sync'
+import { useCanvasValidation } from '@/features/protocols/builder/hooks/use-canvas-validation'
+
+export default function ProtocolBuilderPage() {
+  const params = useParams()
+  const router = useRouter()
+  const templateId = params.templateId as string
+
+  const { data: templates, isLoading } = useProtocolTemplatesQuery()
+  const loadTemplate = useProtocolBuilderStore((s) => s.loadTemplate)
+  const reset = useProtocolBuilderStore((s) => s.reset)
+
+  // Auto-sync to server
+  useTemplateSync(2000)
+
+  // Validate on changes
+  useCanvasValidation()
+
+  // Load template on mount
+  useEffect(() => {
+    if (!templates) return
+    const template = templates.find((t) => t.id === templateId)
+    if (!template) return
+
+    const { nodes, edges } = templateToNodes(template)
+    const positioned = getNodeLayout(nodes, edges)
+    loadTemplate(template, positioned, edges)
+  }, [templateId, templates, loadTemplate])
+
+  // Cleanup on unmount
+  useEffect(() => {
+    return () => reset()
+  }, [reset])
+
+  if (isLoading) {
+    return (
+      <div className="flex h-screen items-center justify-center">
+        <div className="text-sm text-muted-foreground">Loading builder...</div>
+      </div>
+    )
+  }
+
+  const template = templates?.find((t) => t.id === templateId)
+  if (!template) {
+    return (
+      <div className="flex h-screen flex-col items-center justify-center gap-3">
+        <div className="text-sm text-muted-foreground">Template not found</div>
+        <button
+          onClick={() => router.push('/protocols')}
+          className="text-sm text-blue-500 hover:underline"
+        >
+          Back to protocols
+        </button>
+      </div>
+    )
+  }
+
+  return (
+    <div className="flex h-full flex-col">
+      {/* Header */}
+      <div className="flex items-center justify-between border-b px-4 py-2">
+        <div className="flex items-center gap-3">
+          <button
+            onClick={() => router.push('/protocols')}
+            className="text-sm text-muted-foreground hover:text-foreground"
+          >
+            &larr; Protocols
+          </button>
+          <span className="text-sm font-semibold">{template.name}</span>
+          {template.builtIn && (
+            <span className="rounded bg-muted px-1.5 py-0.5 text-[10px] font-medium text-muted-foreground">
+              Built-in
+            </span>
+          )}
+        </div>
+      </div>
+
+      {/* Canvas */}
+      <div className="flex-1 p-3">
+        <ProtocolBuilderCanvas />
+      </div>
+    </div>
+  )
+}

package/src/app/protocols/page.tsx

@@ -657,13 +657,22 @@ export default function ProtocolsPage() {
                           : editingTemplateId ? 'Save template' : 'Create template'}
                       </button>
                       {editingTemplateId && (
-                        <button
-                          type="button"
-                          onClick={() => void handleDeleteTemplate(editingTemplateId)}
-                          className="rounded-[10px] border border-red-500/20 bg-red-500/10 px-3 py-2 text-[12px] font-700 text-red-200 transition-all hover:bg-red-500/14 cursor-pointer"
-                        >
-                          {templatePending === `delete:${editingTemplateId}` ? 'Deleting…' : 'Delete template'}
-                        </button>
+                        <>
+                          <button
+                            type="button"
+                            onClick={() => router.push(`/protocols/builder/${editingTemplateId}`)}
+                            className="rounded-[10px] border border-blue-500/20 bg-blue-500/10 px-3 py-2 text-[12px] font-700 text-blue-200 transition-all hover:bg-blue-500/14 cursor-pointer"
+                          >
+                            Visual Builder
+                          </button>
+                          <button
+                            type="button"
+                            onClick={() => void handleDeleteTemplate(editingTemplateId)}
+                            className="rounded-[10px] border border-red-500/20 bg-red-500/10 px-3 py-2 text-[12px] font-700 text-red-200 transition-all hover:bg-red-500/14 cursor-pointer"
+                          >
+                            {templatePending === `delete:${editingTemplateId}` ? 'Deleting…' : 'Delete template'}
+                          </button>
+                        </>
                       )}
                     </div>
                   </div>

package/src/app/swarmfeed/page.tsx

@@ -0,0 +1,7 @@
+'use client'
+
+import { FeedPage } from '@/features/swarmfeed/feed-page'
+
+export default function SwarmFeedPage() {
+  return <FeedPage />
+}

package/src/cli/index.js

@@ -220,6 +220,15 @@ const COMMAND_GROUPS = [
       cmd('suite', 'POST', '/eval/suite', 'Run a full eval suite against an agent', { expectsJsonBody: true }),
     ],
   },
+  {
+    name: 'a2a',
+    description: 'A2A Protocol gateway',
+    commands: [
+      cmd('send', 'POST', '/a2a', 'Send a JSON-RPC request to the A2A endpoint', { expectsJsonBody: true }),
+      cmd('agent-card', 'GET', '/.well-known/agent-card', 'Get agent card for a SwarmClaw agent'),
+      cmd('task-status', 'GET', '/a2a/tasks/:taskId/status', 'Check A2A task status'),
+    ],
+  },
   {
     name: 'external-agents',
     description: 'Manage external agent runtimes',
@@ -784,6 +793,16 @@ const COMMAND_GROUPS = [
       cmd('delete', 'DELETE', '/goals/:id', 'Delete a goal'),
     ],
   },
+  {
+    name: 'swarmfeed',
+    description: 'SwarmFeed social network',
+    commands: [
+      cmd('feed', 'GET', '/swarmfeed', 'Get SwarmFeed timeline'),
+      cmd('channels', 'GET', '/swarmfeed/channels', 'List SwarmFeed channels'),
+      cmd('posts', 'GET', '/swarmfeed/posts', 'Get recent posts'),
+      cmd('post', 'POST', '/swarmfeed/posts', 'Create a post', { expectsJsonBody: true }),
+    ],
+  },
 ]
 
 const GROUP_MAP = new Map(COMMAND_GROUPS.map((group) => [group.name, group]))

package/src/cli/spec.js

@@ -176,6 +176,14 @@ const COMMAND_GROUPS = {
       heartbeat: { description: 'Record an external agent heartbeat', method: 'POST', path: '/external-agents/:id/heartbeat', params: ['id'] },
     },
   },
+  a2a: {
+    description: 'A2A Protocol gateway',
+    commands: {
+      send: { description: 'Send a JSON-RPC request to the A2A endpoint', method: 'POST', path: '/a2a' },
+      'agent-card': { description: 'Get agent card for a SwarmClaw agent', method: 'GET', path: '/.well-known/agent-card' },
+      'task-status': { description: 'Check A2A task status', method: 'GET', path: '/a2a/tasks/:taskId/status', params: ['taskId'] },
+    },
+  },
   uploads: {
     description: 'Manage uploaded artifacts',
     commands: {

package/src/components/agents/agent-avatar.tsx

@@ -2,13 +2,10 @@
 
 import { useMemo } from 'react'
 import multiavatar from '@multiavatar/multiavatar'
+import DOMPurify from 'isomorphic-dompurify'
 
-/** Strip scripts/event handlers from SVG to prevent XSS */
 function sanitizeSvg(svg: string): string {
-  return svg
-    .replace(/<script[\s\S]*?<\/script>/gi, '')
-    .replace(/\bon\w+\s*=\s*"[^"]*"/gi, '')
-    .replace(/\bon\w+\s*=\s*'[^']*'/gi, '')
+  return DOMPurify.sanitize(svg, { USE_PROFILES: { svg: true, svgFilters: true } })
 }
 
 interface Props {

package/src/components/agents/agent-sheet.tsx

@@ -28,6 +28,7 @@ import { errorMessage } from '@/lib/shared-utils'
 import { getDefaultAgentToolIds } from '@/lib/agent-default-tools'
 import { getEnabledExtensionIds, getEnabledToolIds } from '@/lib/capability-selection'
 import { buildAgentSelectableProviders, resolveAgentSelectableProviderCredentials } from '@/lib/agent-provider-options'
+import { AgentSocialSettings } from '@/features/swarmfeed/agent-social-settings'
 
 const HB_PRESETS = [1800, 3600, 7200, 21600, 43200] as const
 const FALLBACK_ELEVENLABS_VOICE_ID = 'JBFqnCBsd6RMkjVDRZzb'
@@ -1973,6 +1974,15 @@ export function AgentSheet() {
       </SectionCard>
       )}
 
+      {editing && (
+        <SectionCard
+          title="Social Network"
+          description="SwarmFeed integration — let this agent post and engage on the social feed."
+        >
+          <AgentSocialSettings agent={editing} />
+        </SectionCard>
+      )}
+
       {!WORKER_ONLY_PROVIDER_IDS.has(provider) && (
       <AdvancedSettingsSection
         open={showAdvancedSettings}