swarmdo 1.12.0 → 1.13.0

package/.claude/helpers/statusline.cjs

@@ -515,7 +515,7 @@ function getCostFromStdin() {
 // misses, the displayed version is meaningful (matches what the user
 // installed), not a stale hard-coded string.
 function getPkgVersion() {
-  let ver = '1.12.0';
+  let ver = '1.13.0';
   try {
     const home = os.homedir();
     const pkgPaths = [

package/README.md

@@ -2,7 +2,7 @@
 
 [![swarmdo](swarmdo/assets/brand/logo-full.svg)](https://swarmdo.com)
 
-[![npm version (swarmdo)](https://img.shields.io/badge/npx%20swarmdo-v1.12.0-cb3837?style=for-the-badge&logo=npm&logoColor=white)](https://github.com/SwarmDo/swarmdo/releases)
+[![npm version (swarmdo)](https://img.shields.io/badge/npx%20swarmdo-v1.13.0-cb3837?style=for-the-badge&logo=npm&logoColor=white)](https://github.com/SwarmDo/swarmdo/releases)
 [![MIT License](https://img.shields.io/badge/License-MIT-yellow?style=for-the-badge)](https://github.com/SwarmDo/swarmdo/blob/main/LICENSE)
 [![Website](https://img.shields.io/badge/swarmdo.com-e2a33c?style=for-the-badge&logoColor=black)](https://swarmdo.com)
 [![Star on GitHub](https://img.shields.io/github/stars/SwarmDo/swarmdo?style=for-the-badge&logo=github&color=gold)](https://github.com/SwarmDo/swarmdo)
@@ -281,6 +281,7 @@ The recent release train added a full day-to-day operations layer around the swa
 | `swarmdo redact` | **Mask secrets before they reach an LLM/log/memory** — detect API keys, tokens, and private keys (gitleaks-style rule catalog + Shannon-entropy fallback) and redact them. Stdin filter (`cat deploy.log \| swarmdo redact`), command-wrap (`swarmdo redact -- npm run deploy`), or `--scan` to fail CI on any secret. Also MCP tools (`redact_text`/`redact_scan`). Deterministic, zero tokens |
 | `swarmdo pack` | **Bundle a repo into one AI-context blob** — walk the tree (respects `.gitignore` + glob `--include`/`--exclude`, skips binaries/node_modules), emit markdown/xml/json/plain with a directory tree and per-file + total token estimates. `swarmdo pack --tokens` for a budget breakdown; `--redact` masks secrets first. Deterministic |
 | `swarmdo env` | **Catch env-var drift before deploy** — statically scan code for `process.env.X` / `import.meta.env.X` / `Deno.env.get` / `os.getenv` references and reconcile against `.env` and `.env.example`: reports **missing** (used but undeclared), **unused**, and **undocumented**. `--ci` exits 1 on missing vars. Also an MCP tool (`env_check`). Deterministic |
+| `swarmdo license` | **Audit dependency licenses** — walk `node_modules`, resolve each package's SPDX license, and gate on an allow/deny policy so a GPL or unknown license can't slip into a permissive tree. `--allow MIT,Apache-2.0 --ci` fails the build; distinct from `security` (CVEs). Also an MCP tool (`license_check`). Deterministic |
 | `swarmdo integrations` (alias `integrate`) | **Use swarmdo from Codex CLI, GitHub Copilot CLI, and pi** — one command wires AGENTS.md + each CLI's MCP config (idempotent, dry-run first, never touches your Claude Code setup) |
 | OpenRouter model pool | **Let swarms pick from any models you configure** — declare tier-mapped OpenRouter models in `swarmdo.config.json`; the router Thompson-samples among them per task and the execution layer dispatches the winner |
 | `swarmdo changelog` (alias `notes`) | **Release notes from conventional commits** — `--out NOTES.md` feeds `gh release create --notes-file` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "swarmdo",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "Swarmdo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@swarmdo/cli/dist/src/commands/index.js

@@ -31,6 +31,10 @@ const commandLoaders = {
     // Env-var drift checker (dotenv-safe/dotenv-scan demand) — reconcile code
     // references against .env / .env.example (missing/unused/undocumented).
     env: () => import('./env.js'),
+    // Dependency license audit + policy gate (license-checker demand) — catch
+    // GPL/unknown licenses in the tree, fail CI on a forbidden one.
+    license: () => import('./license.js'),
+    licenses: () => import('./license.js'), // alias via loader key
     // Queryable exported-symbol index (codegraph demand) — where things are
     // defined without grep+read round-trips.
     codegraph: () => import('./codegraph.js'),
@@ -264,7 +268,7 @@ export async function getCommandsByCategory() {
     // three slots from 'statusline' onward (completionsCmd received the
     // statusline module, analyzeCmd received completions, …), scrambling the
     // categorized help. Every load now has a named slot.
-    const [daemonCmd, doctorCmd, embeddingsCmd, neuralCmd, performanceCmd, securityCmd, swarmvectorCmd, hiveMindCmd, configCmd, statuslineCmd, compressCmd, efficiencyCmd, completionsCmd, migrateCmd, workflowCmd, analyzeCmd, routeCmd, progressCmd, providersCmd, pluginsCmd, deploymentCmd, claimsCmd, issuesCmd, updateCmd, processCmd, guidanceCmd, applianceCmd, cleanupCmd, autopilotCmd, demoCmd, usageCmd, repairCmd, hudCmd, compactCmd, codegraphCmd, redactCmd, packCmd, envCmd,] = await Promise.all([
+    const [daemonCmd, doctorCmd, embeddingsCmd, neuralCmd, performanceCmd, securityCmd, swarmvectorCmd, hiveMindCmd, configCmd, statuslineCmd, compressCmd, efficiencyCmd, completionsCmd, migrateCmd, workflowCmd, analyzeCmd, routeCmd, progressCmd, providersCmd, pluginsCmd, deploymentCmd, claimsCmd, issuesCmd, updateCmd, processCmd, guidanceCmd, applianceCmd, cleanupCmd, autopilotCmd, demoCmd, usageCmd, repairCmd, hudCmd, compactCmd, codegraphCmd, redactCmd, packCmd, envCmd, licenseCmd,] = await Promise.all([
         loadCommand('daemon'), loadCommand('doctor'), loadCommand('embeddings'), loadCommand('neural'),
         loadCommand('performance'), loadCommand('security'), loadCommand('swarmvector'), loadCommand('hive-mind'),
         loadCommand('config'), loadCommand('statusline'), loadCommand('compress'), loadCommand('efficiency'),
@@ -272,7 +276,7 @@ export async function getCommandsByCategory() {
         loadCommand('analyze'), loadCommand('route'), loadCommand('progress'), loadCommand('providers'),
         loadCommand('plugins'), loadCommand('deployment'), loadCommand('claims'), loadCommand('issues'),
         loadCommand('update'), loadCommand('process'), loadCommand('guidance'), loadCommand('appliance'),
-        loadCommand('cleanup'), loadCommand('autopilot'), loadCommand('demo'), loadCommand('usage'), loadCommand('repair'), loadCommand('hud'), loadCommand('compact'), loadCommand('codegraph'), loadCommand('redact'), loadCommand('pack'), loadCommand('env'),
+        loadCommand('cleanup'), loadCommand('autopilot'), loadCommand('demo'), loadCommand('usage'), loadCommand('repair'), loadCommand('hud'), loadCommand('compact'), loadCommand('codegraph'), loadCommand('redact'), loadCommand('pack'), loadCommand('env'), loadCommand('license'),
     ]);
     return {
         primary: [
@@ -288,7 +292,7 @@ export async function getCommandsByCategory() {
         utility: [
             configCmd, doctorCmd, daemonCmd, completionsCmd,
             migrateCmd, workflowCmd, demoCmd,
-            statuslineCmd, compressCmd, compactCmd, redactCmd, packCmd, envCmd, efficiencyCmd,
+            statuslineCmd, compressCmd, compactCmd, redactCmd, packCmd, envCmd, licenseCmd, efficiencyCmd,
         ].filter(Boolean),
         analysis: [
             analyzeCmd, routeCmd, progressCmd, usageCmd, hudCmd, codegraphCmd,

package/v3/@swarmdo/cli/dist/src/commands/license.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `swarmdo license` — audit installed dependency licenses against an allow/deny
+ * policy. Reads each package's own package.json under node_modules and checks
+ * the SPDX license, so a GPL or unknown license in a permissive tree is caught
+ * (and can fail CI) before it ships.
+ *
+ *   swarmdo license                              # list licenses in the tree
+ *   swarmdo license --allow MIT,Apache-2.0,ISC   # fail on anything else
+ *   swarmdo license --deny GPL-3.0 --ci          # exit 1 on a forbidden license
+ *
+ * Engine (../license/license.ts) is pure + tested; this walks node_modules.
+ */
+import type { Command } from '../types.js';
+export declare const licenseCommand: Command;
+export default licenseCommand;
+//# sourceMappingURL=license.d.ts.map

package/v3/@swarmdo/cli/dist/src/commands/license.js

@@ -0,0 +1,124 @@
+/**
+ * `swarmdo license` — audit installed dependency licenses against an allow/deny
+ * policy. Reads each package's own package.json under node_modules and checks
+ * the SPDX license, so a GPL or unknown license in a permissive tree is caught
+ * (and can fail CI) before it ships.
+ *
+ *   swarmdo license                              # list licenses in the tree
+ *   swarmdo license --allow MIT,Apache-2.0,ISC   # fail on anything else
+ *   swarmdo license --deny GPL-3.0 --ci          # exit 1 on a forbidden license
+ *
+ * Engine (../license/license.ts) is pure + tested; this walks node_modules.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { output } from '../output.js';
+import { classifyLicense, auditLicenses, formatLicenseSummary } from '../license/license.js';
+/** Collect installed packages from a node_modules dir (incl. one level of @scope). */
+function collectDeps(nodeModules) {
+    const deps = [];
+    const seen = new Set();
+    let top;
+    try {
+        top = fs.readdirSync(nodeModules, { withFileTypes: true });
+    }
+    catch {
+        return deps;
+    }
+    const pkgDirs = [];
+    for (const e of top) {
+        if (!e.isDirectory() || e.name === '.bin' || e.name === '.cache')
+            continue;
+        if (e.name.startsWith('@')) {
+            // scoped: descend one level
+            let scoped;
+            try {
+                scoped = fs.readdirSync(path.join(nodeModules, e.name), { withFileTypes: true });
+            }
+            catch {
+                continue;
+            }
+            for (const s of scoped)
+                if (s.isDirectory())
+                    pkgDirs.push(path.join(nodeModules, e.name, s.name));
+        }
+        else {
+            pkgDirs.push(path.join(nodeModules, e.name));
+        }
+    }
+    for (const dir of pkgDirs) {
+        let pkg;
+        try {
+            pkg = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+        }
+        catch {
+            continue;
+        }
+        const name = pkg.name ?? path.basename(dir);
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        deps.push({ name, version: pkg.version ?? '0.0.0', license: classifyLicense(pkg) });
+    }
+    return deps.sort((a, b) => a.name.localeCompare(b.name));
+}
+function csv(v) {
+    if (typeof v !== 'string' || !v)
+        return undefined;
+    return v.split(',').map((s) => s.trim()).filter(Boolean);
+}
+async function run(ctx) {
+    const repoRoot = ctx.cwd || process.cwd();
+    const nodeModules = path.resolve(repoRoot, ctx.args[0] ?? 'node_modules');
+    if (!fs.existsSync(nodeModules)) {
+        output.printError(`no node_modules at ${path.relative(repoRoot, nodeModules) || nodeModules} (install deps first, or pass a path)`);
+        return { success: false, exitCode: 1 };
+    }
+    const deps = collectDeps(nodeModules);
+    if (deps.length === 0) {
+        output.printError('no packages found under node_modules');
+        return { success: false, exitCode: 1 };
+    }
+    const policy = {
+        allow: csv(ctx.flags.allow),
+        deny: csv(ctx.flags.deny),
+        allowUnknown: ctx.flags['allow-unknown'] === true,
+    };
+    const report = auditLicenses(deps, policy);
+    if (ctx.flags.json === true) {
+        output.printJson(report);
+    }
+    else {
+        if (report.violations.length > 0) {
+            output.writeln(output.bold(`Violations (${report.violations.length})`));
+            output.printList(report.violations.map((v) => `${v.name}@${v.version}  ${output.dim(`[${v.license}]`)}  ${v.reason}`));
+        }
+        // license breakdown, most common first
+        output.writeln(output.bold('Licenses'));
+        output.printList(Object.entries(report.byLicense).sort((a, b) => b[1] - a[1]).map(([lic, n]) => `${lic}: ${n}`));
+        output.writeln(output.dim(formatLicenseSummary(report)));
+    }
+    const gate = ctx.flags.ci === true || policy.allow || policy.deny;
+    const code = gate && report.violations.length > 0 ? 1 : 0;
+    return { success: code === 0, exitCode: code };
+}
+export const licenseCommand = {
+    name: 'license',
+    aliases: ['licenses'],
+    description: 'Audit dependency licenses against an allow/deny policy — catch GPL/unknown licenses before they ship',
+    options: [
+        { name: 'allow', description: 'comma-separated SPDX allowlist; anything else is a violation', type: 'string' },
+        { name: 'deny', description: 'comma-separated SPDX denylist; any match is a violation', type: 'string' },
+        { name: 'allow-unknown', description: 'treat UNKNOWN licenses as allowed (default: violation under an allowlist)', type: 'boolean' },
+        { name: 'ci', description: 'exit 1 if there are any violations', type: 'boolean' },
+        { name: 'json', description: 'machine-readable report', type: 'boolean' },
+    ],
+    examples: [
+        { command: 'swarmdo license', description: 'List the licenses present in node_modules' },
+        { command: 'swarmdo license --allow MIT,Apache-2.0,ISC,BSD-3-Clause --ci', description: 'Fail CI on any non-permissive license' },
+        { command: 'swarmdo license --deny GPL-3.0,AGPL-3.0', description: 'Fail on specific copyleft licenses' },
+    ],
+    action: run,
+};
+export default licenseCommand;
+//# sourceMappingURL=license.js.map

package/v3/@swarmdo/cli/dist/src/license/license.d.ts

@@ -0,0 +1,55 @@
+/**
+ * license.ts — audit dependency licenses against an allow/deny policy. Supply-
+ * chain hygiene for agent-built projects: catch a copyleft (GPL) or unknown
+ * license slipping into a tree that must stay permissive, and fail CI on it.
+ *
+ * Distinct from `security` (CVE/vulnerability scanning) — this is license
+ * COMPLIANCE. Pure + deterministic: the engine takes a list of
+ * {name, version, license} plus a policy and returns violations. The fs walk
+ * over node_modules lives in ../commands/license.ts.
+ */
+export interface DepLicense {
+    name: string;
+    version: string;
+    /** SPDX id/expression, or 'UNKNOWN' */
+    license: string;
+}
+export interface LicensePolicy {
+    /** if non-empty, a dep must match at least one to pass */
+    allow?: string[];
+    /** any match fails the dep */
+    deny?: string[];
+    /** treat UNKNOWN as a pass even when an allowlist is set (default false) */
+    allowUnknown?: boolean;
+}
+export type ViolationReason = 'denied' | 'not-allowed' | 'unknown';
+export interface Violation {
+    name: string;
+    version: string;
+    license: string;
+    reason: ViolationReason;
+}
+export interface LicenseReport {
+    total: number;
+    violations: Violation[];
+    /** license id → count across all deps */
+    byLicense: Record<string, number>;
+}
+/**
+ * Normalize a package.json `license`/`licenses` field to an SPDX string.
+ * Handles the modern string, the legacy `{type}` object, and the legacy
+ * `licenses: [{type}]` array (→ `A OR B`). Missing → 'UNKNOWN'.
+ */
+export declare function classifyLicense(pkg: {
+    license?: unknown;
+    licenses?: unknown;
+}): string;
+/** Split an SPDX expression into its atomic license ids (strips OR/AND/WITH/parens/+). */
+export declare function spdxComponents(expr: string): string[];
+/** Evaluate one dep against the policy; null if it passes. Pure. */
+export declare function evaluateDep(dep: DepLicense, policy: LicensePolicy): Violation | null;
+/** Audit a dependency set against a policy. Pure. */
+export declare function auditLicenses(deps: DepLicense[], policy?: LicensePolicy): LicenseReport;
+/** One-line human summary. */
+export declare function formatLicenseSummary(r: LicenseReport): string;
+//# sourceMappingURL=license.d.ts.map

package/v3/@swarmdo/cli/dist/src/license/license.js

@@ -0,0 +1,81 @@
+/**
+ * license.ts — audit dependency licenses against an allow/deny policy. Supply-
+ * chain hygiene for agent-built projects: catch a copyleft (GPL) or unknown
+ * license slipping into a tree that must stay permissive, and fail CI on it.
+ *
+ * Distinct from `security` (CVE/vulnerability scanning) — this is license
+ * COMPLIANCE. Pure + deterministic: the engine takes a list of
+ * {name, version, license} plus a policy and returns violations. The fs walk
+ * over node_modules lives in ../commands/license.ts.
+ */
+/**
+ * Normalize a package.json `license`/`licenses` field to an SPDX string.
+ * Handles the modern string, the legacy `{type}` object, and the legacy
+ * `licenses: [{type}]` array (→ `A OR B`). Missing → 'UNKNOWN'.
+ */
+export function classifyLicense(pkg) {
+    const l = pkg.license;
+    if (typeof l === 'string' && l.trim())
+        return l.trim();
+    if (l && typeof l === 'object' && typeof l.type === 'string') {
+        return l.type.trim() || 'UNKNOWN';
+    }
+    const arr = pkg.licenses;
+    if (Array.isArray(arr) && arr.length) {
+        const types = arr
+            .map((e) => (typeof e === 'string' ? e : e?.type))
+            .filter((t) => typeof t === 'string' && !!t.trim());
+        if (types.length)
+            return types.join(' OR ');
+    }
+    return 'UNKNOWN';
+}
+/** Split an SPDX expression into its atomic license ids (strips OR/AND/WITH/parens/+). */
+export function spdxComponents(expr) {
+    return expr
+        .replace(/[()]/g, ' ')
+        .split(/\s+(?:OR|AND|WITH)\s+/i)
+        .map((s) => s.trim().replace(/\+$/, ''))
+        .filter(Boolean);
+}
+/** Evaluate one dep against the policy; null if it passes. Pure. */
+export function evaluateDep(dep, policy) {
+    const allow = new Set(policy.allow ?? []);
+    const deny = new Set(policy.deny ?? []);
+    const isUnknown = dep.license === 'UNKNOWN' || !dep.license;
+    const components = isUnknown ? [] : spdxComponents(dep.license);
+    if (components.some((c) => deny.has(c))) {
+        return { name: dep.name, version: dep.version, license: dep.license, reason: 'denied' };
+    }
+    if (isUnknown) {
+        if (allow.size > 0 && !policy.allowUnknown) {
+            return { name: dep.name, version: dep.version, license: 'UNKNOWN', reason: 'unknown' };
+        }
+        return null;
+    }
+    if (allow.size > 0 && !components.some((c) => allow.has(c))) {
+        return { name: dep.name, version: dep.version, license: dep.license, reason: 'not-allowed' };
+    }
+    return null;
+}
+/** Audit a dependency set against a policy. Pure. */
+export function auditLicenses(deps, policy = {}) {
+    const violations = [];
+    const byLicense = {};
+    for (const dep of deps) {
+        const lic = dep.license || 'UNKNOWN';
+        byLicense[lic] = (byLicense[lic] ?? 0) + 1;
+        const v = evaluateDep(dep, policy);
+        if (v)
+            violations.push(v);
+    }
+    violations.sort((a, b) => a.name.localeCompare(b.name));
+    return { total: deps.length, violations, byLicense };
+}
+/** One-line human summary. */
+export function formatLicenseSummary(r) {
+    if (r.violations.length === 0)
+        return `license: ${r.total} deps, 0 violations`;
+    return `license: ${r.violations.length} violation${r.violations.length === 1 ? '' : 's'} across ${r.total} deps`;
+}
+//# sourceMappingURL=license.js.map

package/v3/@swarmdo/cli/dist/src/mcp-client.js

@@ -22,6 +22,7 @@ import { analyzeTools } from './mcp-tools/analyze-tools.js';
 import { codegraphTools } from './mcp-tools/codegraph-tools.js';
 import { redactTools } from './mcp-tools/redact-tools.js';
 import { envTools } from './mcp-tools/env-tools.js';
+import { licenseTools } from './mcp-tools/license-tools.js';
 import { progressTools } from './mcp-tools/progress-tools.js';
 import { embeddingsTools } from './mcp-tools/embeddings-tools.js';
 import { claimsTools } from './mcp-tools/claims-tools.js';
@@ -108,6 +109,7 @@ const TOOL_GROUPS = {
     codegraph: () => codegraphTools,
     redact: () => redactTools,
     env: () => envTools,
+    license: () => licenseTools,
     progress: () => progressTools,
     embeddings: () => embeddingsTools,
     claims: () => claimsTools,

package/v3/@swarmdo/cli/dist/src/mcp-tools/index.d.ts

@@ -18,6 +18,7 @@ export { analyzeTools } from './analyze-tools.js';
 export { codegraphTools } from './codegraph-tools.js';
 export { redactTools } from './redact-tools.js';
 export { envTools } from './env-tools.js';
+export { licenseTools } from './license-tools.js';
 export { progressTools } from './progress-tools.js';
 export { transferTools } from './transfer-tools.js';
 export { securityTools } from './security-tools.js';

package/v3/@swarmdo/cli/dist/src/mcp-tools/index.js

@@ -17,6 +17,7 @@ export { analyzeTools } from './analyze-tools.js';
 export { codegraphTools } from './codegraph-tools.js';
 export { redactTools } from './redact-tools.js';
 export { envTools } from './env-tools.js';
+export { licenseTools } from './license-tools.js';
 export { progressTools } from './progress-tools.js';
 export { transferTools } from './transfer-tools.js';
 export { securityTools } from './security-tools.js';

package/v3/@swarmdo/cli/dist/src/mcp-tools/license-tools.d.ts

@@ -0,0 +1,11 @@
+/**
+ * License MCP Tool
+ *
+ * Let an agent audit dependency licenses in-session — e.g. before adding a
+ * package or approving a release — against an allow/deny policy. Deterministic;
+ * shares the pure engine in ../license/license.ts with the CLI command. The
+ * caller passes the dependency list (name/version/license), so no fs access.
+ */
+import type { MCPTool } from './types.js';
+export declare const licenseTools: MCPTool[];
+//# sourceMappingURL=license-tools.d.ts.map

package/v3/@swarmdo/cli/dist/src/mcp-tools/license-tools.js

@@ -0,0 +1,57 @@
+/**
+ * License MCP Tool
+ *
+ * Let an agent audit dependency licenses in-session — e.g. before adding a
+ * package or approving a release — against an allow/deny policy. Deterministic;
+ * shares the pure engine in ../license/license.ts with the CLI command. The
+ * caller passes the dependency list (name/version/license), so no fs access.
+ */
+import { auditLicenses } from '../license/license.js';
+const licenseCheckTool = {
+    name: 'license_check',
+    description: 'Audit a dependency list against a license allow/deny policy. Returns violations (denied, not-allowed, or unknown license) plus a license breakdown. Use before adding a dependency or approving a release to keep a permissive tree clean. Deterministic; pass the deps directly.',
+    category: 'license',
+    tags: ['license', 'compliance', 'supply-chain', 'ci'],
+    inputSchema: {
+        type: 'object',
+        properties: {
+            deps: {
+                type: 'array',
+                description: 'dependencies to audit',
+                items: {
+                    type: 'object',
+                    properties: {
+                        name: { type: 'string' },
+                        version: { type: 'string' },
+                        license: { type: 'string', description: 'SPDX id/expression (e.g. MIT, "(MIT OR Apache-2.0)", or UNKNOWN)' },
+                    },
+                    required: ['name', 'license'],
+                },
+            },
+            allow: { type: 'array', items: { type: 'string' }, description: 'SPDX allowlist; a dep must match at least one' },
+            deny: { type: 'array', items: { type: 'string' }, description: 'SPDX denylist; any match is a violation' },
+            allowUnknown: { type: 'boolean', description: 'treat UNKNOWN as allowed even under an allowlist', default: false },
+        },
+        required: ['deps'],
+    },
+    handler: async (params) => {
+        if (!Array.isArray(params.deps))
+            return { error: true, message: 'deps[] is required' };
+        const deps = params.deps
+            .filter((d) => !!d && typeof d === 'object')
+            .map((d) => ({
+            name: String(d.name ?? '?'),
+            version: String(d.version ?? '0.0.0'),
+            license: String(d.license ?? 'UNKNOWN'),
+        }));
+        const policy = {
+            allow: Array.isArray(params.allow) ? params.allow.filter((x) => typeof x === 'string') : undefined,
+            deny: Array.isArray(params.deny) ? params.deny.filter((x) => typeof x === 'string') : undefined,
+            allowUnknown: params.allowUnknown === true,
+        };
+        const report = auditLicenses(deps, policy);
+        return { clean: report.violations.length === 0, total: report.total, violations: report.violations, byLicense: report.byLicense };
+    },
+};
+export const licenseTools = [licenseCheckTool];
+//# sourceMappingURL=license-tools.js.map

package/v3/@swarmdo/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmdo/cli",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "type": "module",
   "description": "Swarmdo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",