@synergenius/flow-weaver-pack-weaver 0.9.138 → 0.9.142

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (79) hide show
  1. package/dist/bot/assistant-tools.d.ts.map +1 -1
  2. package/dist/bot/assistant-tools.js +5 -11
  3. package/dist/bot/assistant-tools.js.map +1 -1
  4. package/dist/bot/capability-registry.d.ts.map +1 -1
  5. package/dist/bot/capability-registry.js +185 -15
  6. package/dist/bot/capability-registry.js.map +1 -1
  7. package/dist/bot/dashboard.js +3 -3
  8. package/dist/bot/dashboard.js.map +1 -1
  9. package/dist/bot/hierarchy-event-log.d.ts +37 -0
  10. package/dist/bot/hierarchy-event-log.d.ts.map +1 -0
  11. package/dist/bot/hierarchy-event-log.js +58 -0
  12. package/dist/bot/hierarchy-event-log.js.map +1 -0
  13. package/dist/bot/operations.d.ts +2 -0
  14. package/dist/bot/operations.d.ts.map +1 -1
  15. package/dist/bot/operations.js +5 -0
  16. package/dist/bot/operations.js.map +1 -1
  17. package/dist/bot/profile-store.d.ts.map +1 -1
  18. package/dist/bot/profile-store.js +39 -0
  19. package/dist/bot/profile-store.js.map +1 -1
  20. package/dist/bot/runner.d.ts.map +1 -1
  21. package/dist/bot/runner.js +7 -2
  22. package/dist/bot/runner.js.map +1 -1
  23. package/dist/bot/step-executor.d.ts.map +1 -1
  24. package/dist/bot/step-executor.js +33 -1
  25. package/dist/bot/step-executor.js.map +1 -1
  26. package/dist/bot/swarm-controller.d.ts +1 -0
  27. package/dist/bot/swarm-controller.d.ts.map +1 -1
  28. package/dist/bot/swarm-controller.js +59 -5
  29. package/dist/bot/swarm-controller.js.map +1 -1
  30. package/dist/bot/task-store.d.ts +1 -1
  31. package/dist/bot/task-store.d.ts.map +1 -1
  32. package/dist/bot/task-store.js +25 -37
  33. package/dist/bot/task-store.js.map +1 -1
  34. package/dist/bot/task-types.d.ts +5 -1
  35. package/dist/bot/task-types.d.ts.map +1 -1
  36. package/dist/node-types/bot-report.d.ts +2 -1
  37. package/dist/node-types/bot-report.d.ts.map +1 -1
  38. package/dist/node-types/bot-report.js +9 -4
  39. package/dist/node-types/bot-report.js.map +1 -1
  40. package/dist/node-types/build-context.d.ts.map +1 -1
  41. package/dist/node-types/build-context.js +32 -0
  42. package/dist/node-types/build-context.js.map +1 -1
  43. package/dist/node-types/plan-task.d.ts.map +1 -1
  44. package/dist/node-types/plan-task.js +5 -1
  45. package/dist/node-types/plan-task.js.map +1 -1
  46. package/dist/node-types/report.d.ts +1 -1
  47. package/dist/node-types/report.d.ts.map +1 -1
  48. package/dist/node-types/report.js +58 -8
  49. package/dist/node-types/report.js.map +1 -1
  50. package/dist/ui/capability-editor.js +184 -15
  51. package/dist/ui/profile-editor.js +184 -15
  52. package/dist/ui/swarm-dashboard.js +244 -44
  53. package/dist/ui/task-detail-view.js +60 -29
  54. package/dist/ui/use-stream-timeline.d.ts.map +1 -1
  55. package/dist/ui/use-stream-timeline.js +69 -29
  56. package/dist/ui/use-stream-timeline.js.map +1 -1
  57. package/dist/workflows/weaver-bot.d.ts +1 -0
  58. package/dist/workflows/weaver-bot.d.ts.map +1 -1
  59. package/dist/workflows/weaver-bot.js +239 -4
  60. package/dist/workflows/weaver-bot.js.map +1 -1
  61. package/flowweaver.manifest.json +1 -1
  62. package/package.json +1 -1
  63. package/src/bot/assistant-tools.ts +5 -11
  64. package/src/bot/capability-registry.ts +196 -18
  65. package/src/bot/dashboard.ts +3 -3
  66. package/src/bot/hierarchy-event-log.ts +64 -0
  67. package/src/bot/operations.ts +7 -0
  68. package/src/bot/profile-store.ts +39 -0
  69. package/src/bot/runner.ts +8 -4
  70. package/src/bot/step-executor.ts +29 -1
  71. package/src/bot/swarm-controller.ts +62 -5
  72. package/src/bot/task-store.ts +26 -39
  73. package/src/bot/task-types.ts +7 -1
  74. package/src/node-types/bot-report.ts +8 -3
  75. package/src/node-types/build-context.ts +32 -0
  76. package/src/node-types/plan-task.ts +5 -1
  77. package/src/node-types/report.ts +56 -8
  78. package/src/ui/use-stream-timeline.ts +73 -33
  79. package/src/workflows/weaver-bot.ts +398 -3
@@ -217,6 +217,8 @@ var OP_VALIDATE = "validate";
217
217
  var OP_TSC_CHECK = "tsc_check";
218
218
  var OP_RUN_TESTS = "run_tests";
219
219
  var OP_TASK_CREATE = "task_create";
220
+ var OP_REMEMBER = "remember";
221
+ var OP_RECALL = "recall";
220
222
 
221
223
  // src/bot/capability-registry.ts
222
224
  var CAP_CORE = {
@@ -266,13 +268,31 @@ Use run_shell for running tests (npx vitest), validation (flow-weaver validate),
266
268
  };
267
269
  var CAP_TASK_MGMT = {
268
270
  name: "task-mgmt",
269
- description: "Create and manage swarm subtasks for parallel execution.",
271
+ description: "Create and manage swarm subtasks for parallel execution, with decomposition and review nudges.",
270
272
  tools: [OP_TASK_CREATE],
271
- prompt: `## Task Management
272
- - task_create: Create swarm subtasks for parallel execution. args: { title, description, complexity, subtasks[] }
273
- - task_list, task_get, task_update: Query and update existing tasks
273
+ prompt: `## Task Management & Decomposition
274
274
 
275
- Use task_create to decompose complex work into smaller, independent subtasks that other bots can execute in parallel.`
275
+ - task_create: Create swarm subtasks. args: { title, description, complexity, subtasks[], dependsOn[], assignedProfile? }
276
+
277
+ ### Decomposition
278
+ When you encounter a broad objective (multi-file, multi-concern), decompose into subtasks:
279
+ - If the task is bigger than a single file change, create subtasks instead of doing it all yourself.
280
+ - Minimize dependencies between subtasks to maximize parallel execution.
281
+ - Set complexity per subtask: trivial | simple | moderate | complex.
282
+ - Use dependsOn to express blocking relationships (e.g., setup before code, code before tests).
283
+
284
+ ### Review Task Creation
285
+ After creating or modifying multiple files, create a review task:
286
+ - title: "Review: [what was changed]"
287
+ - description: List the files modified and what to check
288
+ - assignedProfile: "reviewer"
289
+ - complexity: "simple"
290
+ Skip review for trivial single-file tasks.
291
+
292
+ ### Dependency Guidelines
293
+ - BAD: A \u2192 B \u2192 C \u2192 D (serial, slow)
294
+ - GOOD: A \u2192 [B + C + D] (A blocks all, but B/C/D run in parallel)
295
+ Structure as: setup \u2192 independent implementations \u2192 integration/testing.`
276
296
  };
277
297
  var CAP_FW_GRAMMAR = {
278
298
  name: "fw-grammar",
@@ -350,17 +370,41 @@ Note: compile, validate, modify, diff, diagram, and describe operations are avai
350
370
  };
351
371
  var CAP_CODE_REVIEW = {
352
372
  name: "code-review",
353
- description: "Code review guidelines, quality checklist, and security review patterns.",
354
- prompt: `## Code Review
373
+ description: "Comprehensive code review with correctness, security, style, testing, and performance checks.",
374
+ tools: [OP_READ_FILE, OP_PATCH_FILE, OP_RUN_SHELL],
375
+ prompt: `## Code Review Checklist
376
+
377
+ ### 1. Correctness
378
+ - Does the code do what the task asked?
379
+ - Edge cases handled (empty input, null, invalid types)?
380
+ - Error paths covered (try/catch, validation)?
381
+ - Return types match function signature?
355
382
 
356
- When reviewing code, check for:
357
- 1. Correctness: Does the code do what the task asked?
358
- 2. Security: No hardcoded secrets, no injection vulnerabilities, no exposed APIs
359
- 3. Style: Consistent with project conventions, proper naming, no dead code
360
- 4. Testing: Are there tests? Do they cover edge cases?
361
- 5. Performance: No unnecessary loops, no blocking calls in async code
383
+ ### 2. Security
384
+ - NO hardcoded API keys, passwords, or tokens (use env vars)
385
+ - NO shell: true in child_process (command injection risk)
386
+ - NO eval() or Function() with untrusted input
387
+ - User input validated and sanitized before use
388
+ - File paths validated (no ../ traversal)
362
389
 
363
- Report concerns with specific file:line references and suggested fixes.`
390
+ ### 3. Style
391
+ - Naming is clear and consistent with project conventions
392
+ - No dead code (unused variables, unreachable branches)
393
+ - No debug statements left in (console.log, debugger)
394
+ - Imports organized, no duplicates
395
+
396
+ ### 4. Testing
397
+ - Unit tests exist for new/changed functions
398
+ - Tests cover happy path AND edge cases
399
+ - Error cases have tests
400
+ - Code coverage adequate (aim for 80%+ of changed code)
401
+
402
+ ### 5. Performance
403
+ - No O(n\xB2) loops where O(n) is possible
404
+ - No blocking I/O in async code
405
+ - No memory leaks (listeners removed, timers cleared)
406
+
407
+ Report findings as: FILE:LINE | SEVERITY (critical/high/medium/low) | ISSUE \u2192 Fix suggestion`
364
408
  };
365
409
  var CAP_WEB = {
366
410
  name: "web",
@@ -377,6 +421,123 @@ var CAP_CONTEXT = {
377
421
  Use list_files to understand the project structure before making changes.
378
422
  The context bundle (when available) provides a snapshot of the workspace.`
379
423
  };
424
+ var CAP_VERIFICATION = {
425
+ name: "verification",
426
+ description: "Post-write verification: run tsc and tests to catch errors before delivery.",
427
+ tools: [OP_RUN_SHELL],
428
+ prompt: `## Verification
429
+
430
+ After writing or patching code, ALWAYS verify your work:
431
+ 1. Run \`npx tsc --noEmit\` in the project root to catch TypeScript errors
432
+ 2. If package.json has a "test" script, run \`npm test\` to validate functionality
433
+ 3. If verification fails, read the errors, fix the code, and re-verify
434
+
435
+ Include verification as explicit steps in your plan. Verification is NOT optional.
436
+ Do NOT deliver code that hasn't been verified.`
437
+ };
438
+ var CAP_CROSS_FILE_CHECK = {
439
+ name: "cross-file-check",
440
+ description: "Verify imports, exports, module paths, and cross-file dependencies.",
441
+ tools: [OP_READ_FILE, OP_LIST_FILES, OP_RUN_SHELL],
442
+ prompt: `## Cross-File Dependency Checks
443
+
444
+ When modifying code that affects multiple files:
445
+ 1. If you rename an export, grep for all imports of it and update them
446
+ 2. Verify relative import paths resolve correctly (../types vs ./types)
447
+ 3. Check for circular dependencies (A imports B imports A)
448
+ 4. If you change a function signature, update all callers
449
+ 5. Use \`run_shell\` with grep to search: grep -r "functionName" src/
450
+
451
+ Do NOT move or rename exports without verifying all dependents.`
452
+ };
453
+ var CAP_PROJECT_SETUP = {
454
+ name: "project-setup",
455
+ description: "Initialize new projects with correct structure, config, and dependencies.",
456
+ tools: [OP_WRITE_FILE, OP_RUN_SHELL],
457
+ prompt: `## Project Setup
458
+
459
+ When initializing a project:
460
+ 1. Create package.json with name, type: "module", main, scripts (build, test)
461
+ 2. Create tsconfig.json with strict: true, module: "esnext", target: "ES2020"
462
+ 3. Create standard directories: src/, tests/
463
+ 4. Install dependencies with run_shell: npm install <deps>
464
+ 5. Create .gitignore excluding node_modules/, dist/
465
+ 6. Verify setup: run tsc --noEmit to ensure TypeScript compiles`
466
+ };
467
+ var CAP_SECURITY = {
468
+ name: "security",
469
+ description: "Audit code for vulnerabilities, secrets, and security best practices.",
470
+ tools: [OP_READ_FILE, OP_LIST_FILES, OP_RUN_SHELL],
471
+ prompt: `## Security Audit
472
+
473
+ Check for:
474
+ 1. **Secrets**: NO hardcoded API keys, passwords, tokens. Use env vars.
475
+ grep -r "password\\|secret\\|apiKey\\|token" src/ to find leaks.
476
+ 2. **Injection**: NO string concatenation in SQL. NO shell: true in child_process. NO eval().
477
+ 3. **Dependencies**: Run npm audit to check for known CVEs.
478
+ 4. **File paths**: Validate paths to prevent ../ traversal attacks.
479
+ 5. **Data handling**: Validate user input (type, length, format). Sanitize before logging.
480
+
481
+ Report findings with severity: critical | high | medium | low.`
482
+ };
483
+ var CAP_DECOMPOSITION = {
484
+ name: "decomposition",
485
+ description: "Break complex objectives into subtask DAGs with dependencies for parallel execution.",
486
+ tools: [OP_TASK_CREATE],
487
+ prompt: `## Task Decomposition
488
+
489
+ When given a large objective, break it into smaller subtasks:
490
+ 1. Identify all work items (files, features, tests)
491
+ 2. Group by dependency: what must happen first?
492
+ 3. Create subtasks with task_create, each focused on one responsibility
493
+ 4. Set dependencies with dependsOn to model blocking relationships
494
+ 5. Minimize dependencies to maximize parallel execution
495
+ 6. Estimate complexity per subtask: trivial | simple | moderate | complex
496
+
497
+ Example: "Implement auth module"
498
+ - Task A: Extract shared auth types (simple)
499
+ - Task B: Rewrite login endpoint (moderate, depends on A)
500
+ - Task C: Add login tests (moderate, depends on B)
501
+ - Task D: Update auth docs (simple, independent \u2014 runs in parallel with B)
502
+
503
+ Assign profiles: code tasks \u2192 developer, review tasks \u2192 reviewer, infra \u2192 ops.`
504
+ };
505
+ var CAP_ROUTING = {
506
+ name: "routing",
507
+ description: "Route tasks to appropriate bot profiles based on capabilities and complexity.",
508
+ tools: [OP_TASK_CREATE],
509
+ prompt: `## Task Routing
510
+
511
+ When creating subtasks, assign the right profile:
512
+ - Code writing, file creation, bug fixes \u2192 developer profile
513
+ - Code review, quality checks \u2192 reviewer profile
514
+ - Shell commands, project setup, infrastructure \u2192 ops profile
515
+ - Leave assignedProfile empty for auto-triage when unsure
516
+
517
+ Match complexity to profile capabilities:
518
+ - trivial/simple tasks: any profile (prefer cheapest)
519
+ - moderate tasks: specialist profiles
520
+ - complex tasks: profiles with full capability sets`
521
+ };
522
+ var CAP_MEMORY = {
523
+ name: "memory",
524
+ description: "Remember and recall project conventions for continuity across sessions.",
525
+ tools: [OP_REMEMBER, OP_RECALL],
526
+ prompt: `## Project Memory
527
+
528
+ Persist project conventions for future sessions:
529
+ - remember: Save a convention. args: { key: "naming", value: "kebab-case for files" }
530
+ - recall: Load all saved conventions. args: {} \u2014 returns project memory.
531
+
532
+ What to remember:
533
+ - Naming conventions (file names, variable names)
534
+ - Architecture decisions (Result pattern, Zod for validation)
535
+ - Test patterns (where tests go, what framework)
536
+ - Common dependencies and their usage
537
+
538
+ Before planning, recall project memory to follow established patterns.
539
+ When you discover a new convention, remember it for future bots.`
540
+ };
380
541
  var BUILT_IN_CAPABILITIES = [
381
542
  CAP_CORE,
382
543
  CAP_FILE_OPS,
@@ -388,7 +549,15 @@ var BUILT_IN_CAPABILITIES = [
388
549
  CAP_FW_CLI,
389
550
  CAP_CODE_REVIEW,
390
551
  CAP_WEB,
391
- CAP_CONTEXT
552
+ CAP_CONTEXT,
553
+ // Swarm improvement capabilities
554
+ CAP_VERIFICATION,
555
+ CAP_CROSS_FILE_CHECK,
556
+ CAP_PROJECT_SETUP,
557
+ CAP_SECURITY,
558
+ CAP_DECOMPOSITION,
559
+ CAP_ROUTING,
560
+ CAP_MEMORY
392
561
  ];
393
562
  var capabilityMap = new Map(
394
563
  BUILT_IN_CAPABILITIES.map((c) => [c.name, c])
@@ -556,6 +556,7 @@ function useStreamTimeline(events, isDone) {
556
556
  const entries = [];
557
557
  const nodeEntryIndex = /* @__PURE__ */ new Map();
558
558
  const nodeStarts = /* @__PURE__ */ new Map();
559
+ const completedNodes = /* @__PURE__ */ new Set();
559
560
  let idCounter = 0;
560
561
  for (const event of events) {
561
562
  const d = event.data ?? {};
@@ -572,6 +573,11 @@ function useStreamTimeline(events, isDone) {
572
573
  case "node-start": {
573
574
  const nodeId = d.nodeId;
574
575
  if (nodeId) nodeStarts.set(nodeId, event.timestamp);
576
+ const existingStartIdx = nodeEntryIndex.get(nodeId);
577
+ if (existingStartIdx != null && entries[existingStartIdx]?.type === "node-started") {
578
+ break;
579
+ }
580
+ completedNodes.delete(nodeId);
575
581
  const idx = entries.length;
576
582
  nodeEntryIndex.set(nodeId, idx);
577
583
  entries.push({
@@ -587,54 +593,79 @@ function useStreamTimeline(events, isDone) {
587
593
  }
588
594
  case "node-complete": {
589
595
  const nodeId = d.nodeId;
596
+ if (completedNodes.has(nodeId)) break;
590
597
  const startTs = nodeStarts.get(nodeId);
591
598
  const duration = d.durationMs ?? (startTs ? event.timestamp - startTs : void 0);
592
599
  if (nodeId) nodeStarts.delete(nodeId);
593
- const rawOutputs = d.outputs;
594
- const completed = {
595
- id: `s-${idCounter++}`,
596
- timestamp: new Date(startTs ?? event.timestamp),
597
- type: "node-completed",
598
- nodeId,
599
- label: d.label ?? d.nodeType ?? nodeId ?? "Node",
600
- duration,
601
- color: d.color,
602
- icon: d.icon,
603
- outputs: rawOutputs && rawOutputs.length > 0 ? rawOutputs : void 0
604
- };
600
+ completedNodes.add(nodeId);
605
601
  const existingIdx = nodeEntryIndex.get(nodeId);
606
602
  if (existingIdx != null && entries[existingIdx]) {
607
- entries[existingIdx] = completed;
603
+ const rawOutputs = d.outputs;
604
+ entries[existingIdx] = {
605
+ id: entries[existingIdx].id,
606
+ timestamp: new Date(startTs ?? event.timestamp),
607
+ type: "node-completed",
608
+ nodeId,
609
+ label: d.label ?? d.nodeType ?? nodeId ?? "Node",
610
+ duration,
611
+ color: d.color,
612
+ icon: d.icon,
613
+ outputs: rawOutputs && rawOutputs.length > 0 ? rawOutputs : void 0
614
+ };
608
615
  nodeEntryIndex.delete(nodeId);
609
616
  } else {
610
- entries.push(completed);
617
+ const rawOutputs = d.outputs;
618
+ entries.push({
619
+ id: `s-${idCounter++}`,
620
+ timestamp: new Date(startTs ?? event.timestamp),
621
+ type: "node-completed",
622
+ nodeId,
623
+ label: d.label ?? d.nodeType ?? nodeId ?? "Node",
624
+ duration,
625
+ color: d.color,
626
+ icon: d.icon,
627
+ outputs: rawOutputs && rawOutputs.length > 0 ? rawOutputs : void 0
628
+ });
611
629
  }
612
630
  break;
613
631
  }
614
632
  case "node-error": {
615
633
  const nodeId = d.nodeId;
634
+ if (completedNodes.has(nodeId)) break;
616
635
  const startTs = nodeStarts.get(nodeId);
617
636
  const duration = d.durationMs ?? (startTs ? event.timestamp - startTs : void 0);
618
637
  if (nodeId) nodeStarts.delete(nodeId);
619
- const rawOutputs = d.outputs;
620
- const failed = {
621
- id: `s-${idCounter++}`,
622
- timestamp: new Date(startTs ?? event.timestamp),
623
- type: "node-failed",
624
- nodeId,
625
- label: d.label ?? d.nodeType ?? nodeId ?? "Node",
626
- detail: d.error,
627
- duration,
628
- color: d.color,
629
- icon: d.icon,
630
- outputs: rawOutputs && rawOutputs.length > 0 ? rawOutputs : void 0
631
- };
638
+ completedNodes.add(nodeId);
632
639
  const existingIdx = nodeEntryIndex.get(nodeId);
633
640
  if (existingIdx != null && entries[existingIdx]) {
634
- entries[existingIdx] = failed;
641
+ const rawOutputs = d.outputs;
642
+ entries[existingIdx] = {
643
+ id: entries[existingIdx].id,
644
+ timestamp: new Date(startTs ?? event.timestamp),
645
+ type: "node-failed",
646
+ nodeId,
647
+ label: d.label ?? d.nodeType ?? nodeId ?? "Node",
648
+ detail: d.error,
649
+ duration,
650
+ color: d.color,
651
+ icon: d.icon,
652
+ outputs: rawOutputs && rawOutputs.length > 0 ? rawOutputs : void 0
653
+ };
635
654
  nodeEntryIndex.delete(nodeId);
636
655
  } else {
637
- entries.push(failed);
656
+ const rawOutputs = d.outputs;
657
+ entries.push({
658
+ id: `s-${idCounter++}`,
659
+ timestamp: new Date(startTs ?? event.timestamp),
660
+ type: "node-failed",
661
+ nodeId,
662
+ label: d.label ?? d.nodeType ?? nodeId ?? "Node",
663
+ detail: d.error,
664
+ duration,
665
+ color: d.color,
666
+ icon: d.icon,
667
+ outputs: rawOutputs && rawOutputs.length > 0 ? rawOutputs : void 0
668
+ });
638
669
  }
639
670
  break;
640
671
  }
@@ -2672,6 +2703,8 @@ var OP_VALIDATE = "validate";
2672
2703
  var OP_TSC_CHECK = "tsc_check";
2673
2704
  var OP_RUN_TESTS = "run_tests";
2674
2705
  var OP_TASK_CREATE = "task_create";
2706
+ var OP_REMEMBER = "remember";
2707
+ var OP_RECALL = "recall";
2675
2708
 
2676
2709
  // src/bot/capability-registry.ts
2677
2710
  var CAP_CORE = {
@@ -2721,13 +2754,31 @@ Use run_shell for running tests (npx vitest), validation (flow-weaver validate),
2721
2754
  };
2722
2755
  var CAP_TASK_MGMT = {
2723
2756
  name: "task-mgmt",
2724
- description: "Create and manage swarm subtasks for parallel execution.",
2757
+ description: "Create and manage swarm subtasks for parallel execution, with decomposition and review nudges.",
2725
2758
  tools: [OP_TASK_CREATE],
2726
- prompt: `## Task Management
2727
- - task_create: Create swarm subtasks for parallel execution. args: { title, description, complexity, subtasks[] }
2728
- - task_list, task_get, task_update: Query and update existing tasks
2759
+ prompt: `## Task Management & Decomposition
2760
+
2761
+ - task_create: Create swarm subtasks. args: { title, description, complexity, subtasks[], dependsOn[], assignedProfile? }
2729
2762
 
2730
- Use task_create to decompose complex work into smaller, independent subtasks that other bots can execute in parallel.`
2763
+ ### Decomposition
2764
+ When you encounter a broad objective (multi-file, multi-concern), decompose into subtasks:
2765
+ - If the task is bigger than a single file change, create subtasks instead of doing it all yourself.
2766
+ - Minimize dependencies between subtasks to maximize parallel execution.
2767
+ - Set complexity per subtask: trivial | simple | moderate | complex.
2768
+ - Use dependsOn to express blocking relationships (e.g., setup before code, code before tests).
2769
+
2770
+ ### Review Task Creation
2771
+ After creating or modifying multiple files, create a review task:
2772
+ - title: "Review: [what was changed]"
2773
+ - description: List the files modified and what to check
2774
+ - assignedProfile: "reviewer"
2775
+ - complexity: "simple"
2776
+ Skip review for trivial single-file tasks.
2777
+
2778
+ ### Dependency Guidelines
2779
+ - BAD: A \u2192 B \u2192 C \u2192 D (serial, slow)
2780
+ - GOOD: A \u2192 [B + C + D] (A blocks all, but B/C/D run in parallel)
2781
+ Structure as: setup \u2192 independent implementations \u2192 integration/testing.`
2731
2782
  };
2732
2783
  var CAP_FW_GRAMMAR = {
2733
2784
  name: "fw-grammar",
@@ -2805,17 +2856,41 @@ Note: compile, validate, modify, diff, diagram, and describe operations are avai
2805
2856
  };
2806
2857
  var CAP_CODE_REVIEW = {
2807
2858
  name: "code-review",
2808
- description: "Code review guidelines, quality checklist, and security review patterns.",
2809
- prompt: `## Code Review
2859
+ description: "Comprehensive code review with correctness, security, style, testing, and performance checks.",
2860
+ tools: [OP_READ_FILE, OP_PATCH_FILE, OP_RUN_SHELL],
2861
+ prompt: `## Code Review Checklist
2862
+
2863
+ ### 1. Correctness
2864
+ - Does the code do what the task asked?
2865
+ - Edge cases handled (empty input, null, invalid types)?
2866
+ - Error paths covered (try/catch, validation)?
2867
+ - Return types match function signature?
2810
2868
 
2811
- When reviewing code, check for:
2812
- 1. Correctness: Does the code do what the task asked?
2813
- 2. Security: No hardcoded secrets, no injection vulnerabilities, no exposed APIs
2814
- 3. Style: Consistent with project conventions, proper naming, no dead code
2815
- 4. Testing: Are there tests? Do they cover edge cases?
2816
- 5. Performance: No unnecessary loops, no blocking calls in async code
2869
+ ### 2. Security
2870
+ - NO hardcoded API keys, passwords, or tokens (use env vars)
2871
+ - NO shell: true in child_process (command injection risk)
2872
+ - NO eval() or Function() with untrusted input
2873
+ - User input validated and sanitized before use
2874
+ - File paths validated (no ../ traversal)
2817
2875
 
2818
- Report concerns with specific file:line references and suggested fixes.`
2876
+ ### 3. Style
2877
+ - Naming is clear and consistent with project conventions
2878
+ - No dead code (unused variables, unreachable branches)
2879
+ - No debug statements left in (console.log, debugger)
2880
+ - Imports organized, no duplicates
2881
+
2882
+ ### 4. Testing
2883
+ - Unit tests exist for new/changed functions
2884
+ - Tests cover happy path AND edge cases
2885
+ - Error cases have tests
2886
+ - Code coverage adequate (aim for 80%+ of changed code)
2887
+
2888
+ ### 5. Performance
2889
+ - No O(n\xB2) loops where O(n) is possible
2890
+ - No blocking I/O in async code
2891
+ - No memory leaks (listeners removed, timers cleared)
2892
+
2893
+ Report findings as: FILE:LINE | SEVERITY (critical/high/medium/low) | ISSUE \u2192 Fix suggestion`
2819
2894
  };
2820
2895
  var CAP_WEB = {
2821
2896
  name: "web",
@@ -2832,6 +2907,123 @@ var CAP_CONTEXT = {
2832
2907
  Use list_files to understand the project structure before making changes.
2833
2908
  The context bundle (when available) provides a snapshot of the workspace.`
2834
2909
  };
2910
+ var CAP_VERIFICATION = {
2911
+ name: "verification",
2912
+ description: "Post-write verification: run tsc and tests to catch errors before delivery.",
2913
+ tools: [OP_RUN_SHELL],
2914
+ prompt: `## Verification
2915
+
2916
+ After writing or patching code, ALWAYS verify your work:
2917
+ 1. Run \`npx tsc --noEmit\` in the project root to catch TypeScript errors
2918
+ 2. If package.json has a "test" script, run \`npm test\` to validate functionality
2919
+ 3. If verification fails, read the errors, fix the code, and re-verify
2920
+
2921
+ Include verification as explicit steps in your plan. Verification is NOT optional.
2922
+ Do NOT deliver code that hasn't been verified.`
2923
+ };
2924
+ var CAP_CROSS_FILE_CHECK = {
2925
+ name: "cross-file-check",
2926
+ description: "Verify imports, exports, module paths, and cross-file dependencies.",
2927
+ tools: [OP_READ_FILE, OP_LIST_FILES, OP_RUN_SHELL],
2928
+ prompt: `## Cross-File Dependency Checks
2929
+
2930
+ When modifying code that affects multiple files:
2931
+ 1. If you rename an export, grep for all imports of it and update them
2932
+ 2. Verify relative import paths resolve correctly (../types vs ./types)
2933
+ 3. Check for circular dependencies (A imports B imports A)
2934
+ 4. If you change a function signature, update all callers
2935
+ 5. Use \`run_shell\` with grep to search: grep -r "functionName" src/
2936
+
2937
+ Do NOT move or rename exports without verifying all dependents.`
2938
+ };
2939
+ var CAP_PROJECT_SETUP = {
2940
+ name: "project-setup",
2941
+ description: "Initialize new projects with correct structure, config, and dependencies.",
2942
+ tools: [OP_WRITE_FILE, OP_RUN_SHELL],
2943
+ prompt: `## Project Setup
2944
+
2945
+ When initializing a project:
2946
+ 1. Create package.json with name, type: "module", main, scripts (build, test)
2947
+ 2. Create tsconfig.json with strict: true, module: "esnext", target: "ES2020"
2948
+ 3. Create standard directories: src/, tests/
2949
+ 4. Install dependencies with run_shell: npm install <deps>
2950
+ 5. Create .gitignore excluding node_modules/, dist/
2951
+ 6. Verify setup: run tsc --noEmit to ensure TypeScript compiles`
2952
+ };
2953
+ var CAP_SECURITY = {
2954
+ name: "security",
2955
+ description: "Audit code for vulnerabilities, secrets, and security best practices.",
2956
+ tools: [OP_READ_FILE, OP_LIST_FILES, OP_RUN_SHELL],
2957
+ prompt: `## Security Audit
2958
+
2959
+ Check for:
2960
+ 1. **Secrets**: NO hardcoded API keys, passwords, tokens. Use env vars.
2961
+ grep -r "password\\|secret\\|apiKey\\|token" src/ to find leaks.
2962
+ 2. **Injection**: NO string concatenation in SQL. NO shell: true in child_process. NO eval().
2963
+ 3. **Dependencies**: Run npm audit to check for known CVEs.
2964
+ 4. **File paths**: Validate paths to prevent ../ traversal attacks.
2965
+ 5. **Data handling**: Validate user input (type, length, format). Sanitize before logging.
2966
+
2967
+ Report findings with severity: critical | high | medium | low.`
2968
+ };
2969
+ var CAP_DECOMPOSITION = {
2970
+ name: "decomposition",
2971
+ description: "Break complex objectives into subtask DAGs with dependencies for parallel execution.",
2972
+ tools: [OP_TASK_CREATE],
2973
+ prompt: `## Task Decomposition
2974
+
2975
+ When given a large objective, break it into smaller subtasks:
2976
+ 1. Identify all work items (files, features, tests)
2977
+ 2. Group by dependency: what must happen first?
2978
+ 3. Create subtasks with task_create, each focused on one responsibility
2979
+ 4. Set dependencies with dependsOn to model blocking relationships
2980
+ 5. Minimize dependencies to maximize parallel execution
2981
+ 6. Estimate complexity per subtask: trivial | simple | moderate | complex
2982
+
2983
+ Example: "Implement auth module"
2984
+ - Task A: Extract shared auth types (simple)
2985
+ - Task B: Rewrite login endpoint (moderate, depends on A)
2986
+ - Task C: Add login tests (moderate, depends on B)
2987
+ - Task D: Update auth docs (simple, independent \u2014 runs in parallel with B)
2988
+
2989
+ Assign profiles: code tasks \u2192 developer, review tasks \u2192 reviewer, infra \u2192 ops.`
2990
+ };
2991
+ var CAP_ROUTING = {
2992
+ name: "routing",
2993
+ description: "Route tasks to appropriate bot profiles based on capabilities and complexity.",
2994
+ tools: [OP_TASK_CREATE],
2995
+ prompt: `## Task Routing
2996
+
2997
+ When creating subtasks, assign the right profile:
2998
+ - Code writing, file creation, bug fixes \u2192 developer profile
2999
+ - Code review, quality checks \u2192 reviewer profile
3000
+ - Shell commands, project setup, infrastructure \u2192 ops profile
3001
+ - Leave assignedProfile empty for auto-triage when unsure
3002
+
3003
+ Match complexity to profile capabilities:
3004
+ - trivial/simple tasks: any profile (prefer cheapest)
3005
+ - moderate tasks: specialist profiles
3006
+ - complex tasks: profiles with full capability sets`
3007
+ };
3008
+ var CAP_MEMORY = {
3009
+ name: "memory",
3010
+ description: "Remember and recall project conventions for continuity across sessions.",
3011
+ tools: [OP_REMEMBER, OP_RECALL],
3012
+ prompt: `## Project Memory
3013
+
3014
+ Persist project conventions for future sessions:
3015
+ - remember: Save a convention. args: { key: "naming", value: "kebab-case for files" }
3016
+ - recall: Load all saved conventions. args: {} \u2014 returns project memory.
3017
+
3018
+ What to remember:
3019
+ - Naming conventions (file names, variable names)
3020
+ - Architecture decisions (Result pattern, Zod for validation)
3021
+ - Test patterns (where tests go, what framework)
3022
+ - Common dependencies and their usage
3023
+
3024
+ Before planning, recall project memory to follow established patterns.
3025
+ When you discover a new convention, remember it for future bots.`
3026
+ };
2835
3027
  var BUILT_IN_CAPABILITIES = [
2836
3028
  CAP_CORE,
2837
3029
  CAP_FILE_OPS,
@@ -2843,7 +3035,15 @@ var BUILT_IN_CAPABILITIES = [
2843
3035
  CAP_FW_CLI,
2844
3036
  CAP_CODE_REVIEW,
2845
3037
  CAP_WEB,
2846
- CAP_CONTEXT
3038
+ CAP_CONTEXT,
3039
+ // Swarm improvement capabilities
3040
+ CAP_VERIFICATION,
3041
+ CAP_CROSS_FILE_CHECK,
3042
+ CAP_PROJECT_SETUP,
3043
+ CAP_SECURITY,
3044
+ CAP_DECOMPOSITION,
3045
+ CAP_ROUTING,
3046
+ CAP_MEMORY
2847
3047
  ];
2848
3048
  var capabilityMap = new Map(
2849
3049
  BUILT_IN_CAPABILITIES.map((c) => [c.name, c])