@swarmdo/cli 1.37.0 → 1.50.0

package/dist/src/commands/hidden-coupling.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `swarmdo hidden-coupling` — files that CHANGE TOGETHER but have no import edge.
+ *
+ *   swarmdo hidden-coupling                       # co-change pairs the code doesn't explain
+ *   swarmdo hidden-coupling --since 6mo --min-shared 3
+ *   swarmdo hidden-coupling --format json | --csv
+ *
+ * "Logical coupling minus structural coupling": pairs with a high co-change
+ * `degree` (from `coupling`) yet NO import edge connecting them (from
+ * `codegraph`). A dependency real enough to move two files in lockstep but
+ * invisible in the code — the co-edit an agent following imports would miss, or
+ * a missing abstraction a reviewer should question. Composes the two capture
+ * paths verbatim: git-log + `computeCoupling`, and the codegraph index load.
+ * Engine (../coupling/hidden.ts) is pure + tested.
+ */
+import type { Command } from '../types.js';
+export declare const hiddenCouplingCommand: Command;
+export default hiddenCouplingCommand;
+//# sourceMappingURL=hidden-coupling.d.ts.map

package/dist/src/commands/hidden-coupling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hidden-coupling.d.ts","sourceRoot":"","sources":["../../../src/commands/hidden-coupling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAiC,MAAM,aAAa,CAAC;AA8D1E,eAAO,MAAM,qBAAqB,EAAE,OAenC,CAAC;AAEF,eAAe,qBAAqB,CAAC"}

package/dist/src/commands/hidden-coupling.js

@@ -0,0 +1,92 @@
+/**
+ * `swarmdo hidden-coupling` — files that CHANGE TOGETHER but have no import edge.
+ *
+ *   swarmdo hidden-coupling                       # co-change pairs the code doesn't explain
+ *   swarmdo hidden-coupling --since 6mo --min-shared 3
+ *   swarmdo hidden-coupling --format json | --csv
+ *
+ * "Logical coupling minus structural coupling": pairs with a high co-change
+ * `degree` (from `coupling`) yet NO import edge connecting them (from
+ * `codegraph`). A dependency real enough to move two files in lockstep but
+ * invisible in the code — the co-edit an agent following imports would miss, or
+ * a missing abstraction a reviewer should question. Composes the two capture
+ * paths verbatim: git-log + `computeCoupling`, and the codegraph index load.
+ * Engine (../coupling/hidden.ts) is pure + tested.
+ */
+import { execFileSync } from 'node:child_process';
+import { output } from '../output.js';
+import { parseGitLog } from '../hotspots/hotspots.js';
+import { computeCoupling } from '../coupling/coupling.js';
+import { computeHiddenCoupling, formatHiddenCoupling, hiddenCouplingToCsv } from '../coupling/hidden.js';
+import { loadIndex, scanRepo, saveIndex } from '../codegraph/store.js';
+import { normalizeSince } from '../util/since.js';
+/** Read a numeric flag that the parser may deliver as a number OR a string. */
+function numFlag(v, def) {
+    const n = typeof v === 'number' ? v : typeof v === 'string' ? parseInt(v, 10) : NaN;
+    return Number.isFinite(n) ? n : def;
+}
+async function run(ctx) {
+    const root = ctx.cwd || process.cwd();
+    const since = typeof ctx.flags.since === 'string' ? ctx.flags.since : '1 year ago';
+    const top = numFlag(ctx.flags.top, 30);
+    const minShared = numFlag(ctx.flags['min-shared'], 2);
+    const maxFiles = numFlag(ctx.flags['max-files'], 30);
+    const asJson = ctx.flags.format === 'json';
+    const asCsv = ctx.flags.csv === true;
+    // Capture 1: the full co-change history (same `--numstat` dump `coupling` uses;
+    // NO pathspec filter — that would strip co-changed files from each commit).
+    const args = ['log', '--no-merges', '--numstat', `--since=${normalizeSince(since)}`, '--format=format:%x01%H%x1f%aN%x1f%aI'];
+    let raw;
+    try {
+        raw = execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 128 * 1024 * 1024 });
+    }
+    catch {
+        output.printError('git log failed — is this a git repository?');
+        return { success: false, exitCode: 1 };
+    }
+    // Rank ALL coupling pairs (no top yet — we cap the HIDDEN set after filtering).
+    const pairs = computeCoupling(parseGitLog(raw), { minShared, maxFiles });
+    // Capture 2: the static import graph (prefer a saved index; build one if absent).
+    let index = loadIndex(root);
+    if (!index) {
+        index = scanRepo(root);
+        try {
+            saveIndex(root, index);
+        }
+        catch { /* read-only fs — in-memory is fine */ }
+    }
+    const hidden = computeHiddenCoupling(pairs, index.imports, { top: top > 0 ? top : undefined });
+    if (asCsv) {
+        process.stdout.write(hiddenCouplingToCsv(hidden) + '\n');
+    }
+    else if (asJson) {
+        process.stdout.write(JSON.stringify({ generated: new Date().toISOString(), since, minShared, coupled: pairs.length, count: hidden.length, hidden }, null, 2) + '\n');
+    }
+    else if (hidden.length === 0) {
+        output.writeln(output.dim(`no hidden coupling found — every co-change pair has an import edge (or none met --min-shared ${minShared} / --since ${since})`));
+    }
+    else {
+        output.writeln(output.bold(`Hidden coupling (co-change with NO import edge, since ${since}, min-shared ${minShared})`));
+        output.writeln(formatHiddenCoupling(hidden));
+        output.writeln(output.dim(`${hidden.length} hidden of ${pairs.length} coupled pair(s) — these move together but nothing in the code links them`));
+    }
+    return { success: true, exitCode: 0 };
+}
+export const hiddenCouplingCommand = {
+    name: 'hidden-coupling',
+    description: 'Rank file pairs that change together in git history but have NO import edge (logical minus structural coupling) — the co-edit `affected` can\'t see',
+    options: [
+        { name: 'since', description: 'history window, e.g. 90d or "3 months ago" (default 1 year)', type: 'string' },
+        { name: 'min-shared', description: 'drop pairs sharing fewer than N commits (default 2)', type: 'string' },
+        { name: 'max-files', description: 'skip commits touching more than N files (default 30; 0 = no cap)', type: 'string' },
+        { name: 'top', description: 'keep only the top N hidden pairs (default 30; 0 = all)', type: 'string' },
+        { name: 'csv', description: 'export the ranking as CSV (for spreadsheets)', type: 'boolean' },
+    ],
+    examples: [
+        { command: 'swarmdo hidden-coupling --since 6mo --min-shared 3', description: 'Strong co-change pairs with no code link, last 6 months' },
+        { command: 'swarmdo hidden-coupling --format json', description: 'Machine-readable hidden-coupling report' },
+    ],
+    action: run,
+};
+export default hiddenCouplingCommand;
+//# sourceMappingURL=hidden-coupling.js.map

package/dist/src/commands/hidden-coupling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hidden-coupling.js","sourceRoot":"","sources":["../../../src/commands/hidden-coupling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACzG,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,+EAA+E;AAC/E,SAAS,OAAO,CAAC,CAAU,EAAE,GAAW;IACtC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACpF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,GAAmB;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;IACnF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC;IAErC,gFAAgF;IAChF,4EAA4E;IAC5E,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,sCAAsC,CAAC,CAAC;IAC7H,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IACpI,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,UAAU,CAAC,4CAA4C,CAAC,CAAC;QAChE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzC,CAAC;IACD,gFAAgF;IAChF,MAAM,KAAK,GAAG,eAAe,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEzE,kFAAkF;IAClF,IAAI,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC;YAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAE/F,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAC/I,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,gGAAgG,SAAS,cAAc,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9J,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,KAAK,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC;QACxH,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,cAAc,KAAK,CAAC,MAAM,2EAA2E,CAAC,CAAC,CAAC;IACpJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAY;IAC5C,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,qJAAqJ;IAClK,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,6DAA6D,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC7G,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,qDAAqD,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC1G,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,kEAAkE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACtH,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,wDAAwD,EAAE,IAAI,EAAE,QAAQ,EAAE;QACtG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,8CAA8C,EAAE,IAAI,EAAE,SAAS,EAAE;KAC9F;IACD,QAAQ,EAAE;QACR,EAAE,OAAO,EAAE,oDAAoD,EAAE,WAAW,EAAE,yDAAyD,EAAE;QACzI,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,yCAAyC,EAAE;KAC7G;IACD,MAAM,EAAE,GAAG;CACZ,CAAC;AAEF,eAAe,qBAAqB,CAAC"}

package/dist/src/commands/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../../src/commands/hooks.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAiC,MAAM,aAAa,CAAC;AAk2K1E,eAAO,MAAM,YAAY,EAAE,OA6G1B,CAAC;AAEF,eAAe,YAAY,CAAC"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../../src/commands/hooks.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAiC,MAAM,aAAa,CAAC;AAq5K1E,eAAO,MAAM,YAAY,EAAE,OA+G1B,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/dist/src/commands/hooks.js

@@ -10,6 +10,7 @@ import { existsSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { bridgeSearchEntries } from '../memory/memory-bridge.js';
 import { selectInjectionMemories, mapSearchResultsToCandidates, extractPromptFromPayload, } from '../memory-inject/select.js';
+import { classifyCommand, extractBashCommand, denyOutput } from '../hooks-recipe/command-guard.js';
 /**
  * #1686 — `?? 0` only defaults null/undefined; NaN slips through and
  * surfaces as `"NaN"` (or earlier crashed `.toFixed`) in the metrics
@@ -849,6 +850,58 @@ const memoryInjectCommand = {
         }
     },
 };
+/**
+ * guard-bash — the #83 PreToolUse/Bash guardrail. Reads the hook payload from
+ * stdin (or --command), classifies the bash command against a conservative
+ * destructive-command denylist, and on a match emits Claude Code's
+ * `permissionDecision: "deny"` to hard-block it. This is the only safety net
+ * that still fires under headless `claude -p --dangerously-skip-permissions`.
+ * Hook-safe: it NEVER errors and stays silent (allow) for anything not on the
+ * denylist, so it can't break a legitimate command.
+ */
+const guardBashCommand = {
+    name: 'guard-bash',
+    description: 'Block dangerous bash commands (PreToolUse hook): emits permissionDecision:deny on a destructive-command denylist',
+    options: [
+        { name: 'command', short: 'c', description: 'Command to classify (else read the hook JSON from stdin)', type: 'string' },
+        { name: 'preview', description: 'Print the human-readable verdict instead of emitting hook JSON', type: 'boolean' },
+    ],
+    examples: [
+        { command: 'swarmdo hooks guard-bash -c "rm -rf /" --preview', description: 'Check whether a command would be blocked' },
+        { command: 'echo \'{"tool_input":{"command":"rm -rf /"}}\' | swarmdo hooks guard-bash', description: 'Run as a PreToolUse/Bash hook' },
+    ],
+    action: async (ctx) => {
+        const preview = Boolean(ctx.flags.preview);
+        // A hook must NEVER break a tool call by crashing: swallow everything, default to allow.
+        try {
+            if (process.env.SWARMDO_GUARD_BASH_DISABLE === '1')
+                return { success: true };
+            let command = (ctx.flags.command || ctx.args.join(' ')).trim();
+            if (!command)
+                command = extractBashCommand(await readHookStdin());
+            if (!command)
+                return { success: true }; // nothing to classify → allow
+            const verdict = classifyCommand(command);
+            if (preview) {
+                if (verdict.block)
+                    output.printError(`BLOCK: ${verdict.reason} [${verdict.rule}]`);
+                else
+                    output.printSuccess('allow — no destructive pattern matched');
+                return { success: true, data: verdict };
+            }
+            // Hook mode: emit the deny JSON only on a block; silence = allow.
+            if (verdict.block) {
+                process.stdout.write(JSON.stringify(denyOutput(verdict.reason)) + '\n');
+            }
+            return { success: true };
+        }
+        catch (err) {
+            if (preview)
+                output.printError(`guard-bash failed: ${String(err)}`);
+            return { success: true }; // never fail the hook (fail-open: a broken guard must not block work)
+        }
+    },
+};
 // Explain subcommand
 const explainCommand = {
     name: 'explain',
@@ -4672,6 +4725,7 @@ export const hooksCommand = {
         sessionRestoreCommand,
         routeCommand,
         memoryInjectCommand,
+        guardBashCommand,
         explainCommand,
         pretrainCommand,
         buildAgentsCommand,
@@ -4730,6 +4784,7 @@ export const hooksCommand = {
             `${output.highlight('session-restore')} - Restore a previous session`,
             `${output.highlight('route')}           - Route tasks to optimal agents`,
             `${output.highlight('memory-inject')}   - Inject relevant memories into the prompt (UserPromptSubmit)`,
+            `${output.highlight('guard-bash')}      - Block dangerous bash commands (PreToolUse deny)`,
             `${output.highlight('explain')}         - Explain routing decisions`,
             `${output.highlight('pretrain')}        - Bootstrap intelligence from repository`,
             `${output.highlight('build-agents')}    - Generate optimized agent configs`,