bullswarm 0.8.0 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # bullswarm changelog
 
+## 0.10.0 — battle-tested advisory orchestration and agent activity
+
+- Made `maxAgents` and `maxWorkflowSeconds` advisory planning targets instead
+  of hard stops. Workflows can exceed them to finish required implementation
+  and verification; structural graph-growth limits remain enforced.
+- Removed implicit connector and generated-goal wall-clock timeouts. Delegates
+  wait for natural completion unless an operator explicitly supplies a timeout,
+  requests cancellation, or a definitive auth/quota failure is observed.
+- Added compatibility migration for generated 0.9.0 goals carrying Bullswarm's
+  former 900-second planner/action timeout defaults.
+- Fixed adaptive completion policy, current-action metadata, provider routing
+  history, usage aggregation, latest-worker verification, and truthful partial
+  token/cost accounting found during the Kipwise battle test.
+- Added connector-owned native JSONL event adapters for Codex, Claude, Grok,
+  Command Code, and OpenCode. Workflows now retain and display the latest three
+  semantic shell/read/edit/write/response actions for every active agent.
+- Added conservative stall evidence: ten minutes without transport, parsed
+  event, or semantic action activity is labeled `suspected_stalled` but never
+  causes an automatic kill.
+- Added a low-noise `workflow watch <id>` progress stream with semantic-change
+  updates, heartbeats, last-three agent actions, and terminal per-attempt timing.
+- Added optional durable `workflow steer <id> --message ...` guidance delivered
+  only at the next planning checkpoint, never injected into an active worker.
+- Captured runtime model IDs declared in provider event streams for more complete
+  model/cost attribution, preserved Grok tool kinds across name-less updates,
+  and enabled Claude's supported forwarded-subagent text stream.
+- Taught planners to reuse clean full-suite evidence and isolate mutation/pre-fix
+  experiments instead of redundantly or concurrently testing a changing tree.
+- Expanded the offline suite to 224 tests. Real bounded CLI probes confirmed
+  all five provider event formats, and an exact packaged OpenCode watch smoke
+  passed argument injection, action normalization, final-output extraction,
+  and the content gate together.
+
+## 0.9.0 — resilient dynamic workflow routing
+
+- Added cooperative `SIGTERM`/`SIGINT` handling, durable `interrupted` states,
+  dead/stale owner reconciliation, and clean resume after interruption.
+- Added capability-context filtering for model recommendations plus an explicit
+  `strategy apply --yes` approval gate and TTL-based automatic refresh.
+- Added setup-time worktree policy and strategy-autopilot choices.
+- Added per-attempt routing reasons/candidate surplus to durable events, state,
+  decision logs, and the printable workflow tree.
+- Added top-level `runs` and `--version` aliases, complete `workflow goal`
+  budget help, and correct phase/terminal display for completed runs.
+
 ## 0.8.0 — autonomous goals, model strategy, and auditable usage
 
 - Added `workflow goal` for bounded observe-plan-execute loops without an

package/README.md

@@ -31,7 +31,7 @@ npm install -g bullswarm   # or: node bin/bullswarm.js directly from a checkout
 bullswarm          # first run: interactive setup wizard
 bullswarm setup    # re-run or repair
 bullswarm pools    # meter state, pace position, quarantine status
-bullswarm strategy refresh  # discover local models and refresh tier suggestions
+bullswarm strategy refresh --apply --yes  # approve capability-aware tier autopilot
 bullswarm run --lane analyze --add-dir ~/some-repo --task-file /tmp/t.md --json
 bullswarm workflow goal "Fix the failing tests and verify the change" --cwd ~/some-repo
 bullswarm health   # re-judge saved outputs; catch gate failures
@@ -57,18 +57,25 @@ connector-declared, dated pricing/benchmark metadata with live quota surplus:
 ```bash
 bullswarm strategy refresh
 bullswarm strategy show --json
+bullswarm strategy apply --yes --refresh-hours 24
+bullswarm strategy auto status
 bullswarm strategy set-subscription command-code \
   --plan GOAT --monthly-usd 10 --included-usd 70 --quota-window monthly
 bullswarm strategy assign high --pool claude-code --model claude-opus-4-6
 bullswarm run --effort high --lane analyze --task-file /tmp/task.md --json
 ```
 
-Setup recommends an initial refresh; run `strategy refresh` whenever a CLI's
-catalog or subscription changes. Discovery commands, model argument syntax,
-pricing, and benchmark declarations remain connector-owned. Unknown license
-value, prices, and benchmarks stay `null` rather than being guessed. An
-assignment is only a preference: quarantine, exhaustion, burst gates, and
-capability checks still win.
+Interactive setup asks whether to enable strategy autopilot; non-interactive
+setup requires the explicit `setup --yes --strategy` flag. Recommendations are
+context-filtered before ranking: high requires analysis plus workflow-planning,
+medium requires build/edit capabilities, and low targets bounded chores. An
+approved policy refreshes stale discovery before later runs and re-applies the
+best eligible models on its configured interval. Disable it with
+`strategy auto off --yes`. Discovery commands, model argument syntax, pricing,
+and benchmark declarations remain connector-owned. Unknown license value,
+prices, and benchmarks stay `null` rather than being guessed. An assignment is
+only a preference: quarantine, exhaustion, burst gates, and capability checks
+still win.
 
 Every run and workflow attempt reports its selected agent/model and estimated
 usage. When a delegate does not expose counters, Bullswarm labels its UTF-8
@@ -94,8 +101,9 @@ bullswarm workflow goal \
   --cwd ~/some-repo --detach --json
 ```
 
-Bullswarm selects an eligible `workflow-planning` orchestrator by live quota
-surplus. The orchestrator observes durable evidence, proposes bounded actions,
+Bullswarm first honors an approved high-tier provider/model assignment when it
+remains eligible, otherwise it selects an eligible `workflow-planning`
+orchestrator by live quota surplus. The orchestrator observes durable evidence, proposes bounded actions,
 and decides when another expansion or verification is necessary. Bullswarm
 validates the proposal, owns agent/process selection, routes workers, and calls
 the orchestrator again until completion, cancellation, failure, approval, or a
@@ -106,6 +114,7 @@ The detached response includes a short ID and exact observation commands:
 
 ```bash
 bullswarm workflow runs show <shortId>
+bullswarm workflow watch <shortId>        # low-noise live progress + terminal timing
 bullswarm workflow tui <shortId>          # printable phase/action/attempt tree
 bullswarm workflow tui --json <shortId>
 bullswarm workflow events --json <shortId> --after 0
@@ -121,7 +130,9 @@ bullswarm workflow goal --resume <shortId> --json
 `--orchestrator <pool>` exists for controlled testing; ordinary use should
 leave selection on `auto`. Hard limits can be adjusted with `--max-agents`,
 `--max-expansion-rounds`, `--max-actions`, `--max-items-per-expansion`, and
-`--max-workflow-seconds`.
+`--max-workflow-seconds`. Interactive setup also records a worktree-isolation
+preference (`agent-decides`, `off`, or `required`); Bullswarm communicates that
+policy to the orchestrator without imposing repository topology itself.
 
 ## Building a workflow from the shell
 
@@ -164,6 +175,7 @@ bullswarm workflow runs --historical       # only historical
 bullswarm workflow runs --name audit-code  # filter by workflow
 bullswarm workflow runs --limit 20         # cap the result count
 bullswarm workflow runs show <shortId>     # state + report + summary
+bullswarm runs show <shortId>              # top-level shorthand
 bullswarm workflow runs delete <shortId> --yes    # remove the run dir
 
 # Resume by shortId — runs the same logic as the full runId
@@ -172,6 +184,18 @@ bullswarm workflow run audit-code --resume <shortId>
 
 ### Live workflow dashboard
 
+For ordinary observation, use the non-interactive watcher. It prints only when
+the phase, step, agent action, routing, or status changes, plus a 60-second
+heartbeat while otherwise quiet. Terminal output includes every attempt's
+agent/model, elapsed time, outcome, and tokens, so a slow test is distinguishable
+from a stalled process without writing a polling script.
+
+```bash
+bullswarm workflow watch <shortId>
+bullswarm workflow watch <shortId> --jsonl       # automation-friendly stream
+bullswarm workflow watch <shortId> --once        # one current/terminal snapshot
+```
+
 `workflow tui` is the interactive, Claude-style `/workflows` view. It watches
 ongoing runs from disk and supports `j`/`k` or arrow-key selection, Enter for
 details, `c` to request a cooperative stop, `r` to refresh, and `q` to quit.
@@ -191,17 +215,62 @@ bullswarm workflow tui --json --cancel <id>   # request cooperative stop
 bullswarm workflow capabilities --json       # pools, lanes, models, meters, limits
 bullswarm workflow inspect <file-or-name>     # workflow shape and semantics
 bullswarm workflow events --json <id> --after 20
+bullswarm workflow steer <id> --message "Prefer focused tests before another full suite"
 bullswarm workflow action show --json <id> <actionId>
 bullswarm workflow approval approve --json <id>  # then resume the run
 ```
 
 Cancellation is persisted as `cancelling`, terminates an active child process,
 records its termination signal and latency evidence, then commits `cancelled`.
+`SIGTERM` and `SIGINT` use the same cooperative child termination path but
+commit a distinct resumable `interrupted` state. On every workflow command,
+active states with a dead/stale owner are automatically reconciled to
+`interrupted` instead of remaining falsely `running`.
+
+`workflow steer` is optional operator guidance, not hot-patching. It appends a
+durable instruction that is delivered only to the next not-yet-started
+`decide` checkpoint; the active worker continues unchanged. Steering remains
+inside the original goal and authorization boundary and cannot bypass runtime
+validation or required verification. Static workflows and terminal runs reject
+steering because they have no future orchestration checkpoint.
+Live attempts record the last stdout/stderr activity time and observed byte
+count separately from the runner heartbeat. This makes a silent process
+visible without treating elapsed wall time alone as proof that it is hung.
+Supported coding-agent connectors also enable their native JSONL event mode and
+declaratively map provider events into a common semantic action record:
+
+```json
+{"id":"provider-action-id","at":"...","kind":"shell_command|read_file|edit|response","status":"running|completed|failed","summary":"safe scalar preview"}
+```
+
+The live workflow pane retains the latest three logical actions per agent.
+Repeated updates for the same tool call replace its status, and streaming text
+chunks coalesce into one response action. Heartbeats, token/thought deltas,
+usage messages, hooks, and unparsed output remain liveness evidence but do not
+occupy the action pane. Connector-specific flags, paths, and mappings live in
+`connectors/*.json` under `eventStream`; core contains no provider event names.
+
+After ten minutes without transport, parsed-event, or semantic-action evidence,
+an active child is labeled `suspected_stalled`. This is an inspection signal,
+not a death verdict and never an automatic kill: buffered CLIs can be silent
+while working. Process exit, a fatal auth/quota signature, explicit operator
+cancellation, or an opt-in timeout remain the terminal signals.
+
+Each attempt records the phase/action, selected pool and model, effort tier,
+routing reason, all eligible candidates with quota surplus, timestamps,
+artifact paths, outcome, and reported-or-estimated token/cost/quota usage.
+`workflow tui <id>` renders this breakdown for completed runs as well as live
+ones; `workflow tui --json <id>` exposes the durable audit document.
+When a provider event stream reports the actual model, Bullswarm records that
+runtime value and uses its matching connector rate metadata for the attempt's
+cost estimate. Unknown or provider-hidden model identity remains explicitly
+unknown.
 
 ### Adaptive workflows
 
 Static workflows remain zero-extra-LLM orchestration. An adaptive workflow adds
-an explicit `decide` step and hard limits:
+an explicit `decide` step, advisory resource targets, and structural expansion
+limits:
 
 ```json
 {
@@ -228,6 +297,13 @@ an explicit `decide` step and hard limits:
 }
 ```
 
+`maxAgents` and `maxWorkflowSeconds` are advisory inputs to the orchestrator.
+Crossing either target is recorded in durable state but never stops a worker,
+skips verification, or fails a run. `maxExpansionRounds`, `maxActions`, and
+`maxItemsPerExpansion` remain hard graph-growth safeguards. Delegates have no
+implicit wall-clock timeout; set a step's `timeoutSec` (or direct-run
+`--timeout`) only when an operator explicitly wants a hard termination timer.
+
 The planner returns versioned JSON. It may propose `needs_more_work` with
 bounded `run`, inline-`fanout`, or `verify` actions. The deterministic runtime
 validates IDs, dependencies, operation types, capabilities, and budgets before

package/connectors/_schema.json

@@ -12,9 +12,35 @@
   "authSignatures": ["strings in output that mean auth/throttle failure"],
   "outputExtraction": {
     "$comment": "how to get the real answer out of stdout+stderr+files",
-    "strategy": "stdout|stdout-tail|json-field|file",
+    "strategy": "stdout|stdout-tail|json-field|file|event-stream",
     "field": "optional json field path or file glob"
   },
+  "eventStream": {
+    "$comment": "Optional declarative JSONL adapter. Provider quirks stay here; core emits normalized semantic actions.",
+    "format": "jsonl",
+    "args": ["CLI flags that enable machine-readable streaming"],
+    "modelPaths": ["provider model-id paths in priority order"],
+    "silenceThresholdSec": 600,
+    "rules": [{
+      "rootMatch": {"path": "provider.event.type", "equals": "tool_started"},
+      "forEach": "optional.array.path",
+      "match": {"path": "nested.type", "equals": "tool_use"},
+      "idPaths": ["provider action id paths in priority order"],
+      "kindPaths": ["tool or response kind paths"],
+      "summaryPaths": ["safe command/path/text scalar paths"],
+      "status": "queued|running|streaming|completed|failed",
+      "statusPath": "optional provider status path",
+      "statusMap": {"provider-status": "normalized-status"},
+      "aggregate": "consecutive",
+      "summaryMode": "replace|concat"
+    }],
+    "output": [{
+      "match": {"path": "provider.event.type", "equals": "final"},
+      "path": "provider final response scalar path",
+      "mode": "last|concat",
+      "separator": "optional separator"
+    }]
+  },
   "meter": {
     "$comment": "none | declared (manual) | reader (programmatic)",
     "type": "none|declared|reader",
@@ -50,5 +76,5 @@
     "stealth": false,
     "$comment-stealth": "stealth=true: prompts/completions retained by an anonymous provider — opt-in only, never a default"
   },
-  "timeoutSec": 900
+  "$comment-timeout": "Delegates have no implicit wall-clock timeout; use direct --timeout or workflow step.timeoutSec as an explicit opt-in"
 }

package/connectors/claude-code.json

@@ -23,7 +23,21 @@
     "please run /login"
   ],
   "outputExtraction": {
-    "strategy": "stdout"
+    "strategy": "event-stream"
+  },
+  "eventStream": {
+    "format": "jsonl",
+    "args": ["--output-format", "stream-json", "--verbose", "--forward-subagent-text"],
+    "modelPaths": ["model", "message.model"],
+    "silenceThresholdSec": 600,
+    "rules": [
+      { "rootMatch": { "path": "type", "equals": "assistant" }, "forEach": "message.content", "match": { "path": "type", "equals": "tool_use" }, "idPaths": ["id"], "kindPaths": ["name"], "summaryPaths": ["input.command", "input.file_path", "input.path", "input.pattern"], "status": "running" },
+      { "rootMatch": { "path": "type", "equals": "user" }, "forEach": "message.content", "match": { "path": "type", "equals": "tool_result" }, "idPaths": ["tool_use_id"], "kind": "tool", "statusPath": "is_error", "statusMap": { "true": "failed", "false": "completed" }, "defaultStatus": "completed" },
+      { "rootMatch": { "path": "type", "equals": "assistant" }, "forEach": "message.content", "match": { "path": "type", "equals": "text" }, "kind": "response", "summaryPaths": ["text"], "status": "completed" }
+    ],
+    "output": [
+      { "match": { "path": "type", "equals": "result" }, "path": "result", "mode": "last" }
+    ]
   },
   "$comment-meter": "the CALLER pool \u2014 competes in analyze/build, wins only when no delegate can take the lane",
   "meter": {
@@ -51,5 +65,5 @@
     "stealth": false,
     "isCaller": true
   },
-  "timeoutSec": 900
+  "$comment-timeout": "No implicit wall-clock timeout; callers may opt in with --timeout or workflow step.timeoutSec"
 }

package/connectors/codex.json

@@ -22,7 +22,19 @@
     "invalid api key"
   ],
   "outputExtraction": {
-    "strategy": "stdout"
+    "strategy": "event-stream"
+  },
+  "eventStream": {
+    "format": "jsonl",
+    "args": ["--json"],
+    "silenceThresholdSec": 600,
+    "rules": [
+      { "rootMatch": { "path": "type", "equals": "item.started" }, "idPaths": ["item.id"], "kindPaths": ["item.type"], "kindMap": { "agent_message": "response" }, "summaryPaths": ["item.command", "item.text"], "status": "running" },
+      { "rootMatch": { "path": "type", "equals": "item.completed" }, "idPaths": ["item.id"], "kindPaths": ["item.type"], "kindMap": { "agent_message": "response" }, "summaryPaths": ["item.command", "item.text"], "status": "completed" }
+    ],
+    "output": [
+      { "match": { "path": "type", "equals": "item.completed" }, "path": "item.text", "mode": "last" }
+    ]
   },
   "meter": {
     "type": "reader",
@@ -49,5 +61,5 @@
   "flags": {
     "stealth": false
   },
-  "timeoutSec": 900
+  "$comment-timeout": "No implicit wall-clock timeout; callers may opt in with --timeout or workflow step.timeoutSec"
 }

package/connectors/command-code.json

@@ -22,7 +22,23 @@
     "cmd login"
   ],
   "outputExtraction": {
-    "strategy": "stdout"
+    "strategy": "event-stream"
+  },
+  "eventStream": {
+    "format": "jsonl",
+    "args": ["--output-format", "json"],
+    "modelPaths": ["event.model", "model"],
+    "silenceThresholdSec": 600,
+    "rules": [
+      { "rootMatch": { "path": "event.type", "equals": "tool_queued" }, "idPaths": ["event.toolCallId"], "kindPaths": ["event.toolName"], "summaryPaths": ["event.input.command", "event.input.file_path", "event.input.path"], "status": "queued" },
+      { "rootMatch": { "path": "event.type", "equals": "tool_running" }, "idPaths": ["event.toolCallId"], "kindPaths": ["event.toolName"], "summaryPaths": ["event.description"], "status": "running" },
+      { "rootMatch": { "path": "event.type", "equals": "tool_completed" }, "idPaths": ["event.toolCallId"], "kindPaths": ["event.toolName"], "status": "completed" },
+      { "rootMatch": { "path": "event.type", "equals": "message_end" }, "forEach": "event.content", "match": { "path": "type", "equals": "text" }, "kind": "response", "summaryPaths": ["text"], "status": "completed" }
+    ],
+    "output": [
+      { "match": { "path": "type", "equals": "result" }, "path": "finalText", "mode": "last" },
+      { "match": { "path": "event.type", "equals": "run_end" }, "path": "event.result.finalText", "mode": "last" }
+    ]
   },
   "meter": {
     "type": "reader",
@@ -53,5 +69,5 @@
   "flags": {
     "stealth": false
   },
-  "timeoutSec": 900
+  "$comment-timeout": "No implicit wall-clock timeout; callers may opt in with --timeout or workflow step.timeoutSec"
 }

package/connectors/echo-worker.mjs

@@ -8,7 +8,14 @@
 import { readFileSync } from 'node:fs';
 
 const task = readFileSync(process.argv[2], 'utf8');
+const sleepMatch = task.match(/SLEEP_MS:(\d+)/);
+if (sleepMatch) await new Promise((resolve) => setTimeout(resolve, Number(sleepMatch[1])));
 
+if (task.includes('FAIL:auth-hang')) {
+  console.log('Authentication failed: quota exhausted; waiting process should be terminated.');
+  await new Promise((resolve) => setTimeout(resolve, 5000));
+  process.exit(0);
+}
 if (task.includes('FAIL:auth')) {
   console.log('Authentication failed: no credentials found in keychain.');
   process.exit(0);

package/connectors/echo.json

@@ -24,5 +24,5 @@
     "pricingUpdatedAt": "2026-08-27"
   }],
   "flags": { "stealth": false },
-  "timeoutSec": 120
+  "$comment-timeout": "No implicit wall-clock timeout; callers may opt in with --timeout or workflow step.timeoutSec"
 }

package/connectors/grok.json

@@ -18,7 +18,20 @@
     "invalid api key"
   ],
   "outputExtraction": {
-    "strategy": "stdout"
+    "strategy": "event-stream"
+  },
+  "eventStream": {
+    "format": "jsonl",
+    "args": ["--output-format", "streaming-json"],
+    "silenceThresholdSec": 600,
+    "rules": [
+      { "rootMatch": { "path": "type", "equals": "tool_call" }, "idPaths": ["toolCallId"], "kindPaths": ["toolName", "title"], "summaryPaths": ["rawInput.command", "rawInput.file_path", "rawInput.path", "title"], "statusPath": "status" },
+      { "rootMatch": { "path": "type", "equals": "tool_call_update" }, "idPaths": ["toolCallId"], "kindPaths": ["toolName"], "summaryPaths": ["rawOutput.command"], "statusPath": "status" },
+      { "rootMatch": { "path": "type", "equals": "text" }, "kind": "response", "summaryPaths": ["data"], "status": "streaming", "aggregate": "consecutive", "summaryMode": "concat" }
+    ],
+    "output": [
+      { "match": { "path": "type", "equals": "text" }, "path": "data", "mode": "concat" }
+    ]
   },
   "meter": {
     "type": "reader",
@@ -43,6 +56,6 @@
   "flags": {
     "stealth": false
   },
-  "timeoutSec": 900,
+  "$comment-timeout": "No implicit wall-clock timeout; callers may opt in with --timeout or workflow step.timeoutSec",
   "$comment-meter": "weekly shared credit pool via billing endpoint; no 5h window exists on unified-billing accounts"
 }

package/connectors/opencode2.json

@@ -8,7 +8,19 @@
     "$comment-cwdMode": "QUIRK: resolves its project from $PWD, not the spawn cwd. The watcher MUST set env.PWD and spawn with cwd inside the target repo, or it will silently analyse the wrong repository and answer confidently about it."
   },
   "authSignatures": ["No cookie auth credentials found", "unauthorized"],
-  "outputExtraction": { "strategy": "stdout" },
+  "outputExtraction": { "strategy": "event-stream" },
+  "eventStream": {
+    "format": "jsonl",
+    "args": ["--format", "json"],
+    "silenceThresholdSec": 600,
+    "rules": [
+      { "rootMatch": { "path": "type", "equals": "tool_use" }, "idPaths": ["part.callID", "part.id"], "kindPaths": ["part.tool"], "summaryPaths": ["part.state.input.command", "part.state.input.file_path", "part.state.input.path", "part.state.title"], "statusPath": "part.state.status" },
+      { "rootMatch": { "path": "type", "equals": "text" }, "idPaths": ["part.id"], "kind": "response", "summaryPaths": ["part.text"], "status": "completed" }
+    ],
+    "output": [
+      { "match": { "path": "type", "equals": "text" }, "path": "part.text", "mode": "concat", "separator": "\n" }
+    ]
+  },
   "$comment-auto": "--auto is required for headless workflow dispatch: task files live under ~/.bullswarm, outside the target repo, and OpenCode otherwise pauses for an interactive permission approval. --model pins the QA/runtime pool to Luna instead of the CLI default.",
   "$comment-exit1": "known failure mode: writes a complete correct answer, then dies with a Console-sync auth error and exit 1. The verdict sets contentUsableDespiteExit instead of discarding the work.",
   "meter": { "type": "none" },
@@ -24,5 +36,5 @@
   ],
   "subscription": { "plan": null, "monthlyPriceUsd": null, "includedValueUsd": null, "quotaWindow": null },
   "flags": { "stealth": false },
-  "timeoutSec": 900
+  "$comment-timeout": "No implicit wall-clock timeout; callers may opt in with --timeout or workflow step.timeoutSec"
 }