premanmcp 1.1.17 → 1.1.18

package/README.md

@@ -53,7 +53,7 @@ preman chat -p "list my endpoints"      # one turn, printed, then exit
 ```
 
 Inside a session: `/help`, `/new`, `/conversations`, `/resume <id>`, `/app`,
-`/eval`, `/clear`, `/exit`. `/eval list` shows what your agent can be measured
+`/swarm`, `/eval`, `/clear`, `/exit`. `/eval list` shows what your agent can be measured
 on, numbered; `/eval on 3 12` or `/eval on sycophancy` switches those on (a
 number, a `3-7` range, `all`, an id, or enough of one to be unambiguous), `/eval
 off` the same in reverse, and `/eval` runs what is on. `/eval defaults` reads
@@ -65,6 +65,30 @@ link underneath opens the PreMan desktop app when it is installed (a build older
 than 0.4.0 comes forward on whatever it was showing rather than on the run), and
 the run's dashboard URL is always printed with it.
 
+Ask the agent to launch a hosted-MCP swarm in plain language, just as in the
+app: “Launch a 12-attempt Codex swarm against my tracker server; ask it to find
+open issues and expect search_issues.” The terminal uses the same conversation
+service and approval rules. A proposed launch shows its summary in the terminal;
+choose “Approve exact action” to launch it, “Decline” to reject it, or Enter to
+leave it unanswered. A swarm result prints its label, status, run ID, and link.
+Piped sessions leave approvals unanswered for review in the app.
+
+For explicit commands inside the session, `/swarm` uses the current session's
+account, backend, and workspace:
+
+```text
+/swarm list
+/swarm launch --server tracker --ask "Find open issues" --expect search_issues --agents codex --size 12 --rivals 0
+/swarm watch <run-id>
+/swarm stop <run-id>
+```
+
+`/swarm help` lists every option. Add `--dry-run` to preview a launch without
+starting attempts. Ctrl+C while watching returns to the conversation and leaves
+the swarm running; `/swarm stop <run-id>` cancels it explicitly. The same commands
+work outside a session as `preman swarm list|launch|watch|stop|bank`. These run
+real agents against hosted MCPs; the app's sample swarms remain a separate demo.
+
 A session takes a screen of its own, the way `vim` does: nothing above it is
 scrollable, and leaving hands your shell back exactly as it was with one line
 saying how to resume. Ctrl+C stops the current turn (PreMan keeps working on it)

package/bin/agent.js

@@ -25,6 +25,7 @@ import { basename, join } from "node:path";
 import { createInterface } from "node:readline/promises";
 
 import { createSseParser } from "./runner.js";
+import { SWARM_HELP, swarmCommand } from "./swarm.js";
 import {
   authenticateTerminal,
   backendUrl,
@@ -59,6 +60,10 @@ const SLASH_HELP = `Commands:
   /eval on|off <what>   Switch behaviours on or off, by number or by id
   /eval defaults        Pick a few that suit this project, and switch them on
   /eval doctor          Check this machine can run evals before starting one
+  /swarm list           List your hosted-MCP swarms
+  /swarm launch ...     Launch with the same flags as preman swarm launch
+  /swarm watch <id>     Follow a swarm; Ctrl+C returns to the conversation
+  /swarm help           Show launch, watch, stop and behavior-bank options
   /app                  Open this conversation in the PreMan app
   /clear                Clear the screen
   /exit                 Leave (Ctrl+D does the same)
@@ -212,6 +217,13 @@ export function artifactLine(artifact) {
   if (!artifact || typeof artifact !== "object") return "";
   const type = String(artifact.type || "");
   if (!type || SILENT_ARTIFACTS.has(type)) return "";
+  if (type === "swarm_run" && artifact.run?.id) {
+    const run = artifact.run;
+    const name = truncate(run.release_label || artifact.title || "Swarm", 60);
+    const line = [name, run.status, run.id].filter(Boolean).join(" · ");
+    const url = artifactUrl(artifact);
+    return url ? `${line} — ${url}` : line;
+  }
   const label =
     String(artifact.title || "").trim() || ARTIFACT_LABELS[type] || type.replace(/_/g, " ");
   const url = artifactUrl(artifact);
@@ -757,10 +769,82 @@ async function runTurn({
       ask,
       say,
     });
+    await askActionProposals({
+      args, token, workspaceId, artifacts: done.turn.artifacts, paint, ask, say, register,
+    });
   }
   return done;
 }
 
+/** Approve only a stored action on this session's backend; no tool-supplied URL is executed. */
+async function askActionProposals({ args, token, workspaceId, artifacts, paint, ask, say, register }) {
+  if (!process.stdin.isTTY) return;
+  const seen = new Set();
+  const proposals = (Array.isArray(artifacts) ? artifacts : []).filter((item) => {
+    const proposal = item?.type === "action_proposal" ? item.proposal : null;
+    const id = proposal?.id;
+    if (typeof id !== "string" || !/^[\w-]{1,128}$/.test(id) || seen.has(id)) return false;
+    if ((proposal.status || "pending") !== "pending") return false;
+    if (proposal.expires_at && Date.parse(proposal.expires_at) <= Date.now()) return false;
+    seen.add(id);
+    return true;
+  });
+  if (!proposals.length) return;
+  const write = say || ((text) => process.stdout.write(text));
+  const borrowed = typeof ask === "function";
+  const rl = borrowed ? null : createInterface({ input: process.stdin, output: process.stdout });
+  const readAnswer = borrowed ? ask : (text) => rl.question(text);
+  try {
+    for (const artifact of proposals.slice(0, 10)) {
+      const proposal = artifact.proposal;
+      const title = truncate(String(proposal.title || artifact.title || "Confirm action"), 240);
+      write(`\n${paint.yellow("PreMan needs a decision")}\n  ${title}\n`);
+      const summary = String(proposal.summary || artifact.summary || "").trim();
+      if (summary) write(`  ${truncate(summary, 1000)}\n`);
+      write(`  1. Approve exact action\n  2. Decline\n${paint.dim("  Enter to skip\n")}`);
+      const answer = String((await readAnswer("  > ")) || "").trim().toLowerCase();
+      const action = ["1", "y", "yes", "approve"].includes(answer) ? "approve"
+        : ["2", "n", "no", "decline"].includes(answer) ? "decline" : null;
+      if (!action) {
+        write(paint.dim("  Left unanswered.\n"));
+        continue;
+      }
+      if (proposal.expires_at && Date.parse(proposal.expires_at) <= Date.now()) {
+        write(paint.dim("  This action expired. Ask PreMan to regenerate it.\n"));
+        continue;
+      }
+      const controller = new AbortController();
+      register?.({ abort: () => controller.abort() });
+      try {
+        const response = await backendCall(args, "POST",
+          `/workbench/action-proposals/${encodeURIComponent(proposal.id)}/${action}`, {
+            token, signal: controller.signal,
+            headers: workspaceId ? { "x-workspace-id": workspaceId } : undefined,
+          });
+        const result = response.result;
+        const status = response.proposal?.status || "unknown";
+        if (result?.ok === false || result?.error) {
+          write(`  ${paint.red(describeFailure(result, "The action did not complete."))}\n`);
+        } else if (status === "completed" || status === "declined") {
+          write(`  ${paint.green("✓")} ${status === "completed" ? "Completed" : "Declined"}: ${title}\n`);
+          if (result?.run?.id) write(`  ${artifactLine({ type: "swarm_run", title, run: result.run, url: result.url })}\n`);
+        } else {
+          write(`  Action ${String(status).replaceAll("_", " ")}. Use /app to check its result.\n`);
+        }
+      } catch (error) {
+        write(controller.signal.aborted
+          ? "  Stopped waiting for the action result. Check /app before trying again.\n"
+          : `  ${paint.red(error?.message || String(error))}\n`);
+      } finally {
+        register?.(null);
+      }
+    }
+    if (proposals.length > 10) write("  More actions are awaiting a decision in /app.\n");
+  } finally {
+    if (rl) rl.close();
+  }
+}
+
 /**
  * Put a permission confirmation to the person at the keyboard.
  *
@@ -1956,6 +2040,64 @@ export async function runEval(rest, { args, token, dock, rl, paint, say, running
   }
 }
 
+/** Quoted flag values for a session command, without shell evaluation. */
+export function swarmArguments(rest) {
+  const words = [];
+  let word = "";
+  let quote = "";
+  let escaped = false;
+  let active = false;
+  for (const character of String(rest || "")) {
+    if (escaped) {
+      word += character;
+      escaped = false;
+    } else if (character === "\\" && quote !== "'") {
+      escaped = true;
+      active = true;
+    } else if (quote) {
+      if (character === quote) quote = "";
+      else word += character;
+    } else if (character === "'" || character === '"') {
+      quote = character;
+      active = true;
+    } else if (/\s/.test(character)) {
+      if (active) words.push(word);
+      word = "";
+      active = false;
+    } else {
+      word += character;
+      active = true;
+    }
+  }
+  if (quote || escaped) throw new Error("Finish the quoted value or escaped character in /swarm.");
+  if (active) words.push(word);
+  return words;
+}
+
+/** Reuse the CLI command inside the current authenticated conversation. */
+export async function runSwarm(rest, { args, token, workspaceId, say, paint, register }) {
+  const controller = new AbortController();
+  register?.({ abort: () => controller.abort() });
+  try {
+    const argv = swarmArguments(rest);
+    if (["help", "--help", "-h"].includes(argv[0])) {
+      say(`${SWARM_HELP}\n`);
+      return;
+    }
+    await swarmCommand(argv, {
+      sessionArgs: args, token, workspaceId, signal: controller.signal,
+      write: say, clearWatch: false,
+    });
+    say("\n");
+  } catch (error) {
+    say(controller.signal.aborted
+      ? "Stopped waiting. The swarm may still be running; /swarm list to check.\n\n"
+      : `${paint.red(error?.message || String(error))}\n\n`);
+  } finally {
+    register?.(null);
+  }
+}
+
 export async function agentCommand(commandArgs = [], { authenticate = authenticateTerminal } = {}) {
   const args = makeArgs(commandArgs);
   if (args.has("--help") || args.has("-h")) {
@@ -2067,6 +2209,7 @@ export async function agentCommand(commandArgs = [], { authenticate = authentica
     // Only reaches anything when a run is open, and the import is already
     // resolved by then -- the module was loaded to start the run.
     if (evaluating) void import("./eval.js").then(({ cancelEvalRuns }) => cancelEvalRuns());
+    turn?.abort();
   });
   hold.onTeardown(() => process.stdout.off("resize", onResize));
   hold.onTeardown(() => dock.disable());
@@ -2286,6 +2429,13 @@ export async function agentCommand(commandArgs = [], { authenticate = authentica
           });
           continue;
         }
+        if (slash.name === "swarm") {
+          await runSwarm(slash.rest, {
+            args, token, workspaceId: workspace.id, say, paint,
+            register: (handle) => { turn = handle; },
+          });
+          continue;
+        }
         if (slash.name === "app") {
           const url = `${frontendUrl(args)}/workbench/${conversation.id}`;
           openUrl(url);

package/bin/swarm.js

@@ -9,6 +9,8 @@
  * won when it did not.
  */
 
+import { setTimeout as wait } from "node:timers/promises";
+
 import {
   backendUrl,
   callBackendJson,
@@ -133,17 +135,21 @@ export function summarize(cells) {
     };
     if (cell.status === "running") agent.running += 1;
     else if (cell.status === "queued") agent.queued += 1;
-    const unseen = cell.evidence?.tool_surfaced_by_search === false && arm === "deferred";
+    const expected = new Set([
+      ...(cell.evidence?.expected?.tools || []),
+      cell.evidence?.expected?.tool,
+      ...(cell.evidence?.expected?.alternates || []),
+    ].filter(Boolean));
+    const called = cell.evidence?.tools_called || [];
+    // Missing search telemetry cannot erase a recorded selection or call to
+    // the expected tool. Codex can call it without emitting a tool search.
+    const sawExpected = cell.selected === true || called.some((tool) => expected.has(tool));
+    const unseen = !sawExpected && cell.evidence?.tool_surfaced_by_search === false && arm === "deferred";
     if ((cell.selected === true || cell.selected === false) && !unseen) {
       agent.scored += 1;
       if (cell.selected) agent.picked += 1;
       else {
-        const expected = new Set([
-          ...(cell.evidence?.expected?.tools || []),
-          cell.evidence?.expected?.tool,
-          ...(cell.evidence?.expected?.alternates || []),
-        ].filter(Boolean));
-        for (const tool of cell.evidence?.tools_called || []) {
+        for (const tool of called) {
           if (!expected.has(tool)) agent.lostTo.set(tool, (agent.lostTo.get(tool) || 0) + 1);
         }
       }
@@ -226,9 +232,9 @@ async function call(args, token, method, path, options = {}) {
   return result;
 }
 
-async function findServer(args, token, ref) {
+async function findServer(request, ref) {
   if (/^[0-9a-f-]{36}$/i.test(ref)) return { id: ref, name: ref };
-  const result = await call(args, token, "GET", "/hosted-mcps");
+  const result = await request("GET", "/hosted-mcps");
   const servers = result.hosted_mcps || result.list || [];
   const match = servers.find((server) => [server.slug, server.name, server.id].includes(ref));
   if (!match) {
@@ -238,9 +244,9 @@ async function findServer(args, token, ref) {
   return match;
 }
 
-async function readSwarm(args, token, id) {
-  const run = await call(args, token, "GET", `/matrix/runs/${encodeURIComponent(id)}`);
-  const cells = await call(args, token, "GET", `/matrix/runs/${encodeURIComponent(id)}/cells`);
+async function readSwarm(request, id) {
+  const run = await request("GET", `/matrix/runs/${encodeURIComponent(id)}`);
+  const cells = await request("GET", `/matrix/runs/${encodeURIComponent(id)}/cells`);
   const { status_code, ok, ...runBody } = run;
   return { run: runBody, cells: cells.cells || cells.list || [] };
 }
@@ -249,25 +255,34 @@ function swarmLink(args, id) {
   return `${frontendUrl(args)}/workbench/swarms/swarms/${encodeURIComponent(id)}`;
 }
 
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-
-export async function swarmCommand(commandArgs = []) {
+export async function swarmCommand(commandArgs = [], {
+  sessionArgs, token: sessionToken, workspaceId, signal,
+  write = (text) => process.stdout.write(text), clearWatch = true,
+} = {}) {
   const [sub = "list", ...rest] = commandArgs;
-  const args = makeArgs(rest);
+  // A session's credential stays with its backend even when slash-command
+  // arguments contain transport overrides. First occurrence wins in makeArgs.
+  const args = makeArgs(sessionArgs ? [
+    "--backend", backendUrl(sessionArgs), "--frontend", frontendUrl(sessionArgs),
+    ...(sessionArgs.has("--no-color") || sessionArgs.has("--no-colour") ? ["--no-color"] : []), ...rest,
+  ] : rest);
   const json = args.has("--json");
   const colour = colourEnabled(args);
-  const token = requireToken(args);
+  const token = sessionToken || requireToken(args);
+  const request = (method, path, options = {}) => call(args, token, method, path, {
+    ...options, signal, ...(workspaceId ? { headers: { "x-workspace-id": workspaceId } } : {}),
+  });
 
   if (sub === "list") {
-    const result = await call(args, token, "GET", "/matrix/runs");
+    const result = await request("GET", "/matrix/runs");
     const runs = result.runs || result.list || [];
-    if (json) return void process.stdout.write(`${JSON.stringify(runs, null, 2)}\n`);
+    if (json) return void write(`${JSON.stringify(runs, null, 2)}\n`);
     if (!runs.length) {
-      process.stdout.write(`No swarms yet. Start one with \`${cliInvocation()} swarm launch\`.\n`);
+      write(`No swarms yet. Start one with \`${cliInvocation()} swarm launch\`.\n`);
       return;
     }
     for (const run of runs.slice(0, 20)) {
-      process.stdout.write(
+      write(
         `${String(run.id).slice(0, 8)}  ${truncate(run.release_label || "", 32).padEnd(32)}  ` +
           `${truncate(run.hosted_mcp_name || run.hosted_mcp_slug || "", 20).padEnd(20)}  ${String(run.status).padEnd(9)}  ${headlineFromRollup(run)}\n`
       );
@@ -281,7 +296,7 @@ export async function swarmCommand(commandArgs = []) {
     if (!serverRef || !asks.length) {
       throw new Error(`a swarm needs --server and at least one --ask.${SWARM_HELP}`);
     }
-    const server = await findServer(args, token, serverRef);
+    const server = await findServer(request, serverRef);
     const expect = listOf(args.value("--expect"));
     const payload = {
       hosted_mcp_id: server.id,
@@ -296,15 +311,15 @@ export async function swarmCommand(commandArgs = []) {
     const agents = listOf(args.value("--agents"));
     if (agents.length) payload.harnesses = agents;
     if (args.has("--dry-run")) payload.dry_run = true;
-    const result = await call(args, token, "POST", "/matrix/runs", { json: payload });
+    const result = await request("POST", "/matrix/runs", { json: payload });
     const { status_code, ok, ...body } = result;
-    if (json) return void process.stdout.write(`${JSON.stringify(body, null, 2)}\n`);
+    if (json) return void write(`${JSON.stringify(body, null, 2)}\n`);
     if (payload.dry_run) {
-      process.stdout.write(`Would send ${body.cell_count ?? "?"} attempts (${body.asks_used ?? asks.length} asks, ${body.replicates ?? 1}× each).\n`);
+      write(`Would send ${body.cell_count ?? "?"} attempts (${body.asks_used ?? asks.length} asks, ${body.replicates ?? 1}× each).\n`);
       return;
     }
-    process.stdout.write(`Swarm ${body.id} launched against ${server.name || server.slug}.\n`);
-    process.stdout.write(`  Watch:  ${cliInvocation()} swarm watch ${body.id}\n  Open:   ${swarmLink(args, body.id)}\n`);
+    write(`Swarm ${body.id} launched against ${server.name || server.slug}.\n`);
+    write(`  Watch:  ${cliInvocation()} swarm watch ${body.id}\n  Open:   ${swarmLink(args, body.id)}\n`);
     return;
   }
 
@@ -312,44 +327,44 @@ export async function swarmCommand(commandArgs = []) {
     const [id] = positionals(rest);
     if (!id) throw new Error(`which swarm? ${cliInvocation()} swarm watch <id>`);
     for (;;) {
-      const { run, cells } = await readSwarm(args, token, id);
+      const { run, cells } = await readSwarm(request, id);
       if (json) {
-        process.stdout.write(`${JSON.stringify({ run, summary: summarize(cells) }, (k, v) => (v instanceof Map ? Object.fromEntries(v) : v), 2)}\n`);
+        write(`${JSON.stringify({ run, summary: summarize(cells) }, (k, v) => (v instanceof Map ? Object.fromEntries(v) : v), 2)}\n`);
       } else {
-        if (process.stdout.isTTY && sub === "watch") process.stdout.write("\u001b[2J\u001b[H");
-        process.stdout.write(renderSwarm(run, cells, { colour }));
+        if (clearWatch && process.stdout.isTTY && sub === "watch") write("\u001b[2J\u001b[H");
+        write(renderSwarm(run, cells, { colour }));
       }
       if (sub === "show" || args.has("--once") || TERMINAL.has(run.status)) {
-        if (!json) process.stdout.write(`\n${swarmLink(args, id)}\n`);
+        if (!json) write(`\n${swarmLink(args, id)}\n`);
         return;
       }
-      await sleep(POLL_MS);
+      await wait(POLL_MS, undefined, { signal });
     }
   }
 
   if (sub === "stop") {
     const [id] = positionals(rest);
     if (!id) throw new Error(`which swarm? ${cliInvocation()} swarm stop <id>`);
-    await call(args, token, "POST", `/matrix/runs/${encodeURIComponent(id)}/cancel`);
-    process.stdout.write(`Stopped ${id}. Agents that had not finished will not run.\n`);
+    await request("POST", `/matrix/runs/${encodeURIComponent(id)}/cancel`);
+    write(`Stopped ${id}. Agents that had not finished will not run.\n`);
     return;
   }
 
   if (sub === "bank") {
     const serverRef = args.value("--server");
-    const server = serverRef ? await findServer(args, token, serverRef) : null;
-    const result = await call(args, token, "GET", "/swarms/behaviors", {
+    const server = serverRef ? await findServer(request, serverRef) : null;
+    const result = await request("GET", "/swarms/behaviors", {
       query: server ? { hosted_mcp_id: server.id } : undefined,
     });
     const kept = (result.behaviors || []).filter((row) => row.status === "kept");
-    if (json) return void process.stdout.write(`${JSON.stringify(kept, null, 2)}\n`);
+    if (json) return void write(`${JSON.stringify(kept, null, 2)}\n`);
     if (!kept.length) {
-      process.stdout.write("Nothing kept yet. After a swarm, keep the patterns PreMan finds in its misses.\n");
+      write("Nothing kept yet. After a swarm, keep the patterns PreMan finds in its misses.\n");
       return;
     }
     for (const row of kept) {
-      process.stdout.write(`${row.hosted_mcp_name || ""}  ${row.title}  (${row.evidence?.count || 0} attempts)\n`);
-      for (const ask of (row.seed?.asks || []).slice(0, 3)) process.stdout.write(`    “${truncate(ask.prompt, 70)}”\n`);
+      write(`${row.hosted_mcp_name || ""}  ${row.title}  (${row.evidence?.count || 0} attempts)\n`);
+      for (const ask of (row.seed?.asks || []).slice(0, 3)) write(`    “${truncate(ask.prompt, 70)}”\n`);
     }
     return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "premanmcp",
-  "version": "1.1.17",
+  "version": "1.1.18",
   "description": "PreMan CLI and stdio proxy for PreMan's hosted MCP server",
   "type": "module",
   "bin": {