swarmdo 1.12.0 → 1.14.0

package/.claude/helpers/statusline.cjs

@@ -515,7 +515,7 @@ function getCostFromStdin() {
 // misses, the displayed version is meaningful (matches what the user
 // installed), not a stale hard-coded string.
 function getPkgVersion() {
-  let ver = '1.12.0';
+  let ver = '1.14.0';
   try {
     const home = os.homedir();
     const pkgPaths = [

package/README.md

@@ -2,7 +2,7 @@
 
 [![swarmdo](swarmdo/assets/brand/logo-full.svg)](https://swarmdo.com)
 
-[![npm version (swarmdo)](https://img.shields.io/badge/npx%20swarmdo-v1.12.0-cb3837?style=for-the-badge&logo=npm&logoColor=white)](https://github.com/SwarmDo/swarmdo/releases)
+[![npm version (swarmdo)](https://img.shields.io/badge/npx%20swarmdo-v1.14.0-cb3837?style=for-the-badge&logo=npm&logoColor=white)](https://github.com/SwarmDo/swarmdo/releases)
 [![MIT License](https://img.shields.io/badge/License-MIT-yellow?style=for-the-badge)](https://github.com/SwarmDo/swarmdo/blob/main/LICENSE)
 [![Website](https://img.shields.io/badge/swarmdo.com-e2a33c?style=for-the-badge&logoColor=black)](https://swarmdo.com)
 [![Star on GitHub](https://img.shields.io/github/stars/SwarmDo/swarmdo?style=for-the-badge&logo=github&color=gold)](https://github.com/SwarmDo/swarmdo)
@@ -281,6 +281,8 @@ The recent release train added a full day-to-day operations layer around the swa
 | `swarmdo redact` | **Mask secrets before they reach an LLM/log/memory** — detect API keys, tokens, and private keys (gitleaks-style rule catalog + Shannon-entropy fallback) and redact them. Stdin filter (`cat deploy.log \| swarmdo redact`), command-wrap (`swarmdo redact -- npm run deploy`), or `--scan` to fail CI on any secret. Also MCP tools (`redact_text`/`redact_scan`). Deterministic, zero tokens |
 | `swarmdo pack` | **Bundle a repo into one AI-context blob** — walk the tree (respects `.gitignore` + glob `--include`/`--exclude`, skips binaries/node_modules), emit markdown/xml/json/plain with a directory tree and per-file + total token estimates. `swarmdo pack --tokens` for a budget breakdown; `--redact` masks secrets first. Deterministic |
 | `swarmdo env` | **Catch env-var drift before deploy** — statically scan code for `process.env.X` / `import.meta.env.X` / `Deno.env.get` / `os.getenv` references and reconcile against `.env` and `.env.example`: reports **missing** (used but undeclared), **unused**, and **undocumented**. `--ci` exits 1 on missing vars. Also an MCP tool (`env_check`). Deterministic |
+| `swarmdo license` | **Audit dependency licenses** — walk `node_modules`, resolve each package's SPDX license, and gate on an allow/deny policy so a GPL or unknown license can't slip into a permissive tree. `--allow MIT,Apache-2.0 --ci` fails the build; distinct from `security` (CVEs). Also an MCP tool (`license_check`). Deterministic |
+| `swarmdo sbom` | **Software Bill of Materials from the lockfile** — emit a CycloneDX (default) or SPDX JSON manifest of every dependency with version, purl, license, and integrity hash, for compliance/vuln tooling. `--spec spdx`, `-o sbom.json`, `--production`. Completes the env/license/sbom supply-chain trio. Deterministic |
 | `swarmdo integrations` (alias `integrate`) | **Use swarmdo from Codex CLI, GitHub Copilot CLI, and pi** — one command wires AGENTS.md + each CLI's MCP config (idempotent, dry-run first, never touches your Claude Code setup) |
 | OpenRouter model pool | **Let swarms pick from any models you configure** — declare tier-mapped OpenRouter models in `swarmdo.config.json`; the router Thompson-samples among them per task and the execution layer dispatches the winner |
 | `swarmdo changelog` (alias `notes`) | **Release notes from conventional commits** — `--out NOTES.md` feeds `gh release create --notes-file` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "swarmdo",
-  "version": "1.12.0",
+  "version": "1.14.0",
   "description": "Swarmdo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@swarmdo/cli/dist/src/commands/compact.js

@@ -13,6 +13,7 @@
 import { spawnSync } from 'node:child_process';
 import { output } from '../output.js';
 import { compactOutput, formatSavings } from '../compact/compact.js';
+import { writeStdout } from '../util/stdout.js';
 /**
  * Read all of stdin as UTF-8. A stream read (not readFileSync(0)) — the
  * synchronous form throws EAGAIN on a non-blocking pipe on macOS/Linux.
@@ -61,7 +62,7 @@ async function run(ctx) {
         }
         const combined = (r.stdout || '') + (r.stderr || '');
         const { text, stats } = compactOutput(combined, opts);
-        process.stdout.write(text);
+        await writeStdout(text);
         if (!quiet)
             process.stderr.write(formatSavings(stats) + '\n');
         // Propagate the wrapped command's exit code verbatim.
@@ -81,7 +82,7 @@ async function run(ctx) {
     else if (!quiet) {
         process.stderr.write(formatSavings(stats) + '\n');
     }
-    process.stdout.write(text);
+    await writeStdout(text);
     return { success: true, exitCode: 0 };
 }
 export const compactCommand = {

package/v3/@swarmdo/cli/dist/src/commands/index.js

@@ -31,6 +31,13 @@ const commandLoaders = {
     // Env-var drift checker (dotenv-safe/dotenv-scan demand) — reconcile code
     // references against .env / .env.example (missing/unused/undocumented).
     env: () => import('./env.js'),
+    // Dependency license audit + policy gate (license-checker demand) — catch
+    // GPL/unknown licenses in the tree, fail CI on a forbidden one.
+    license: () => import('./license.js'),
+    licenses: () => import('./license.js'), // alias via loader key
+    // Software Bill of Materials from the lockfile (syft/cyclonedx demand) —
+    // CycloneDX/SPDX JSON; completes the env/license/sbom supply-chain trio.
+    sbom: () => import('./sbom.js'),
     // Queryable exported-symbol index (codegraph demand) — where things are
     // defined without grep+read round-trips.
     codegraph: () => import('./codegraph.js'),
@@ -264,7 +271,7 @@ export async function getCommandsByCategory() {
     // three slots from 'statusline' onward (completionsCmd received the
     // statusline module, analyzeCmd received completions, …), scrambling the
     // categorized help. Every load now has a named slot.
-    const [daemonCmd, doctorCmd, embeddingsCmd, neuralCmd, performanceCmd, securityCmd, swarmvectorCmd, hiveMindCmd, configCmd, statuslineCmd, compressCmd, efficiencyCmd, completionsCmd, migrateCmd, workflowCmd, analyzeCmd, routeCmd, progressCmd, providersCmd, pluginsCmd, deploymentCmd, claimsCmd, issuesCmd, updateCmd, processCmd, guidanceCmd, applianceCmd, cleanupCmd, autopilotCmd, demoCmd, usageCmd, repairCmd, hudCmd, compactCmd, codegraphCmd, redactCmd, packCmd, envCmd,] = await Promise.all([
+    const [daemonCmd, doctorCmd, embeddingsCmd, neuralCmd, performanceCmd, securityCmd, swarmvectorCmd, hiveMindCmd, configCmd, statuslineCmd, compressCmd, efficiencyCmd, completionsCmd, migrateCmd, workflowCmd, analyzeCmd, routeCmd, progressCmd, providersCmd, pluginsCmd, deploymentCmd, claimsCmd, issuesCmd, updateCmd, processCmd, guidanceCmd, applianceCmd, cleanupCmd, autopilotCmd, demoCmd, usageCmd, repairCmd, hudCmd, compactCmd, codegraphCmd, redactCmd, packCmd, envCmd, licenseCmd, sbomCmd,] = await Promise.all([
         loadCommand('daemon'), loadCommand('doctor'), loadCommand('embeddings'), loadCommand('neural'),
         loadCommand('performance'), loadCommand('security'), loadCommand('swarmvector'), loadCommand('hive-mind'),
         loadCommand('config'), loadCommand('statusline'), loadCommand('compress'), loadCommand('efficiency'),
@@ -272,7 +279,7 @@ export async function getCommandsByCategory() {
         loadCommand('analyze'), loadCommand('route'), loadCommand('progress'), loadCommand('providers'),
         loadCommand('plugins'), loadCommand('deployment'), loadCommand('claims'), loadCommand('issues'),
         loadCommand('update'), loadCommand('process'), loadCommand('guidance'), loadCommand('appliance'),
-        loadCommand('cleanup'), loadCommand('autopilot'), loadCommand('demo'), loadCommand('usage'), loadCommand('repair'), loadCommand('hud'), loadCommand('compact'), loadCommand('codegraph'), loadCommand('redact'), loadCommand('pack'), loadCommand('env'),
+        loadCommand('cleanup'), loadCommand('autopilot'), loadCommand('demo'), loadCommand('usage'), loadCommand('repair'), loadCommand('hud'), loadCommand('compact'), loadCommand('codegraph'), loadCommand('redact'), loadCommand('pack'), loadCommand('env'), loadCommand('license'), loadCommand('sbom'),
     ]);
     return {
         primary: [
@@ -288,7 +295,7 @@ export async function getCommandsByCategory() {
         utility: [
             configCmd, doctorCmd, daemonCmd, completionsCmd,
             migrateCmd, workflowCmd, demoCmd,
-            statuslineCmd, compressCmd, compactCmd, redactCmd, packCmd, envCmd, efficiencyCmd,
+            statuslineCmd, compressCmd, compactCmd, redactCmd, packCmd, envCmd, licenseCmd, sbomCmd, efficiencyCmd,
         ].filter(Boolean),
         analysis: [
             analyzeCmd, routeCmd, progressCmd, usageCmd, hudCmd, codegraphCmd,

package/v3/@swarmdo/cli/dist/src/commands/license.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `swarmdo license` — audit installed dependency licenses against an allow/deny
+ * policy. Reads each package's own package.json under node_modules and checks
+ * the SPDX license, so a GPL or unknown license in a permissive tree is caught
+ * (and can fail CI) before it ships.
+ *
+ *   swarmdo license                              # list licenses in the tree
+ *   swarmdo license --allow MIT,Apache-2.0,ISC   # fail on anything else
+ *   swarmdo license --deny GPL-3.0 --ci          # exit 1 on a forbidden license
+ *
+ * Engine (../license/license.ts) is pure + tested; this walks node_modules.
+ */
+import type { Command } from '../types.js';
+export declare const licenseCommand: Command;
+export default licenseCommand;
+//# sourceMappingURL=license.d.ts.map

package/v3/@swarmdo/cli/dist/src/commands/license.js

@@ -0,0 +1,124 @@
+/**
+ * `swarmdo license` — audit installed dependency licenses against an allow/deny
+ * policy. Reads each package's own package.json under node_modules and checks
+ * the SPDX license, so a GPL or unknown license in a permissive tree is caught
+ * (and can fail CI) before it ships.
+ *
+ *   swarmdo license                              # list licenses in the tree
+ *   swarmdo license --allow MIT,Apache-2.0,ISC   # fail on anything else
+ *   swarmdo license --deny GPL-3.0 --ci          # exit 1 on a forbidden license
+ *
+ * Engine (../license/license.ts) is pure + tested; this walks node_modules.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { output } from '../output.js';
+import { classifyLicense, auditLicenses, formatLicenseSummary } from '../license/license.js';
+/** Collect installed packages from a node_modules dir (incl. one level of @scope). */
+function collectDeps(nodeModules) {
+    const deps = [];
+    const seen = new Set();
+    let top;
+    try {
+        top = fs.readdirSync(nodeModules, { withFileTypes: true });
+    }
+    catch {
+        return deps;
+    }
+    const pkgDirs = [];
+    for (const e of top) {
+        if (!e.isDirectory() || e.name === '.bin' || e.name === '.cache')
+            continue;
+        if (e.name.startsWith('@')) {
+            // scoped: descend one level
+            let scoped;
+            try {
+                scoped = fs.readdirSync(path.join(nodeModules, e.name), { withFileTypes: true });
+            }
+            catch {
+                continue;
+            }
+            for (const s of scoped)
+                if (s.isDirectory())
+                    pkgDirs.push(path.join(nodeModules, e.name, s.name));
+        }
+        else {
+            pkgDirs.push(path.join(nodeModules, e.name));
+        }
+    }
+    for (const dir of pkgDirs) {
+        let pkg;
+        try {
+            pkg = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+        }
+        catch {
+            continue;
+        }
+        const name = pkg.name ?? path.basename(dir);
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        deps.push({ name, version: pkg.version ?? '0.0.0', license: classifyLicense(pkg) });
+    }
+    return deps.sort((a, b) => a.name.localeCompare(b.name));
+}
+function csv(v) {
+    if (typeof v !== 'string' || !v)
+        return undefined;
+    return v.split(',').map((s) => s.trim()).filter(Boolean);
+}
+async function run(ctx) {
+    const repoRoot = ctx.cwd || process.cwd();
+    const nodeModules = path.resolve(repoRoot, ctx.args[0] ?? 'node_modules');
+    if (!fs.existsSync(nodeModules)) {
+        output.printError(`no node_modules at ${path.relative(repoRoot, nodeModules) || nodeModules} (install deps first, or pass a path)`);
+        return { success: false, exitCode: 1 };
+    }
+    const deps = collectDeps(nodeModules);
+    if (deps.length === 0) {
+        output.printError('no packages found under node_modules');
+        return { success: false, exitCode: 1 };
+    }
+    const policy = {
+        allow: csv(ctx.flags.allow),
+        deny: csv(ctx.flags.deny),
+        allowUnknown: ctx.flags['allow-unknown'] === true,
+    };
+    const report = auditLicenses(deps, policy);
+    if (ctx.flags.json === true) {
+        output.printJson(report);
+    }
+    else {
+        if (report.violations.length > 0) {
+            output.writeln(output.bold(`Violations (${report.violations.length})`));
+            output.printList(report.violations.map((v) => `${v.name}@${v.version}  ${output.dim(`[${v.license}]`)}  ${v.reason}`));
+        }
+        // license breakdown, most common first
+        output.writeln(output.bold('Licenses'));
+        output.printList(Object.entries(report.byLicense).sort((a, b) => b[1] - a[1]).map(([lic, n]) => `${lic}: ${n}`));
+        output.writeln(output.dim(formatLicenseSummary(report)));
+    }
+    const gate = ctx.flags.ci === true || policy.allow || policy.deny;
+    const code = gate && report.violations.length > 0 ? 1 : 0;
+    return { success: code === 0, exitCode: code };
+}
+export const licenseCommand = {
+    name: 'license',
+    aliases: ['licenses'],
+    description: 'Audit dependency licenses against an allow/deny policy — catch GPL/unknown licenses before they ship',
+    options: [
+        { name: 'allow', description: 'comma-separated SPDX allowlist; anything else is a violation', type: 'string' },
+        { name: 'deny', description: 'comma-separated SPDX denylist; any match is a violation', type: 'string' },
+        { name: 'allow-unknown', description: 'treat UNKNOWN licenses as allowed (default: violation under an allowlist)', type: 'boolean' },
+        { name: 'ci', description: 'exit 1 if there are any violations', type: 'boolean' },
+        { name: 'json', description: 'machine-readable report', type: 'boolean' },
+    ],
+    examples: [
+        { command: 'swarmdo license', description: 'List the licenses present in node_modules' },
+        { command: 'swarmdo license --allow MIT,Apache-2.0,ISC,BSD-3-Clause --ci', description: 'Fail CI on any non-permissive license' },
+        { command: 'swarmdo license --deny GPL-3.0,AGPL-3.0', description: 'Fail on specific copyleft licenses' },
+    ],
+    action: run,
+};
+export default licenseCommand;
+//# sourceMappingURL=license.js.map

package/v3/@swarmdo/cli/dist/src/commands/pack.js

@@ -17,6 +17,7 @@ import * as path from 'node:path';
 import { output } from '../output.js';
 import { packFiles, makeIgnoreMatcher } from '../pack/pack.js';
 import { redactText } from '../redact/redact.js';
+import { writeStdout } from '../util/stdout.js';
 const SKIP_DIRS = new Set([
     'node_modules', '.git', '.swarm', 'dist', 'dist-standalone', 'build',
     'coverage', '.next', '.turbo', 'out', 'vendor', '.cache',
@@ -151,8 +152,7 @@ async function run(ctx) {
         output.printSuccess(`packed ${stats.files} files (~${stats.tokens} tokens) → ${outFile}`);
     }
     else {
-        process.stdout.write(bundle);
-        if (!process.stdout.isTTY) { /* piped: keep stdout clean */ }
+        await writeStdout(bundle);
         process.stderr.write(output.dim(`packed ${stats.files} files (~${stats.tokens} tokens)\n`));
     }
     return { success: true, exitCode: 0 };

package/v3/@swarmdo/cli/dist/src/commands/redact.js

@@ -15,6 +15,7 @@
 import { spawnSync } from 'node:child_process';
 import { output } from '../output.js';
 import { redactText, scanText, formatFindingsSummary } from '../redact/redact.js';
+import { writeStdout } from '../util/stdout.js';
 function readStdin() {
     return new Promise((resolve) => {
         const chunks = [];
@@ -93,7 +94,7 @@ async function run(ctx) {
     }
     // Redact mode: rewrite and emit.
     const { output: redacted, findings } = redactText(input, opts);
-    process.stdout.write(redacted);
+    await writeStdout(redacted);
     if (asJson) {
         process.stderr.write(JSON.stringify({ count: findings.length, findings }, null, 2) + '\n');
     }

package/v3/@swarmdo/cli/dist/src/commands/sbom.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `swarmdo sbom` — emit a Software Bill of Materials from the npm lockfile.
+ *
+ *   swarmdo sbom                       # CycloneDX JSON → stdout
+ *   swarmdo sbom -f spdx -o sbom.json  # SPDX 2.3 JSON → file
+ *   swarmdo sbom --production          # exclude dev-only dependencies
+ *
+ * Completes the supply-chain trio (env / license / sbom). Engine
+ * (../sbom/sbom.ts) is pure + tested; this reads package-lock.json.
+ */
+import type { Command } from '../types.js';
+export declare const sbomCommand: Command;
+export default sbomCommand;
+//# sourceMappingURL=sbom.d.ts.map

package/v3/@swarmdo/cli/dist/src/commands/sbom.js

@@ -0,0 +1,73 @@
+/**
+ * `swarmdo sbom` — emit a Software Bill of Materials from the npm lockfile.
+ *
+ *   swarmdo sbom                       # CycloneDX JSON → stdout
+ *   swarmdo sbom -f spdx -o sbom.json  # SPDX 2.3 JSON → file
+ *   swarmdo sbom --production          # exclude dev-only dependencies
+ *
+ * Completes the supply-chain trio (env / license / sbom). Engine
+ * (../sbom/sbom.ts) is pure + tested; this reads package-lock.json.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { output } from '../output.js';
+import { componentsFromNpmLock, buildSbom } from '../sbom/sbom.js';
+import { writeStdout } from '../util/stdout.js';
+async function run(ctx) {
+    const repoRoot = ctx.cwd || process.cwd();
+    const lockPath = path.resolve(repoRoot, ctx.args[0] ?? (typeof ctx.flags.lockfile === 'string' ? ctx.flags.lockfile : 'package-lock.json'));
+    let lock;
+    try {
+        lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+    }
+    catch {
+        output.printError(`could not read a JSON lockfile at ${path.relative(repoRoot, lockPath) || lockPath} (npm package-lock.json; pnpm/yaml unsupported)`);
+        return { success: false, exitCode: 1 };
+    }
+    if (!lock.packages) {
+        output.printError('lockfile has no `packages` map — needs npm lockfileVersion 2 or 3');
+        return { success: false, exitCode: 1 };
+    }
+    // NB: use --spec, not --format — the global --format flag is choices-validated
+    // to text|json|table and rejects 'spdx'/'cyclonedx' before this command runs.
+    const raw = typeof ctx.flags.spec === 'string' ? ctx.flags.spec : 'cyclonedx';
+    if (raw !== 'cyclonedx' && raw !== 'spdx') {
+        output.printError(`unknown --spec '${raw}' (use cyclonedx|spdx)`);
+        return { success: false, exitCode: 1 };
+    }
+    const format = raw;
+    const components = componentsFromNpmLock(lock, {
+        productionOnly: ctx.flags.production === true,
+    });
+    // Prefer the lockfile's own project name/version; fall back to the repo dir.
+    const meta = { name: lock.name ?? path.basename(repoRoot), version: lock.version ?? '0.0.0' };
+    const bom = buildSbom(components, meta, format);
+    const serialized = JSON.stringify(bom, null, 2);
+    const outFile = (typeof ctx.flags.output === 'string' && ctx.flags.output) || (typeof ctx.flags.o === 'string' && ctx.flags.o);
+    if (outFile) {
+        fs.writeFileSync(path.resolve(repoRoot, outFile), serialized + '\n');
+        output.printSuccess(`${format} SBOM: ${components.length} components → ${outFile}`);
+    }
+    else {
+        await writeStdout(serialized + '\n');
+        process.stderr.write(output.dim(`${format} SBOM: ${components.length} components\n`));
+    }
+    return { success: true, exitCode: 0 };
+}
+export const sbomCommand = {
+    name: 'sbom',
+    description: 'Generate a Software Bill of Materials (CycloneDX or SPDX JSON) from the npm lockfile',
+    options: [
+        { name: 'spec', description: 'BOM spec: cyclonedx (default) or spdx', type: 'string' },
+        { name: 'output', short: 'o', description: 'write the SBOM to a file instead of stdout', type: 'string' },
+        { name: 'lockfile', description: 'path to the lockfile (default package-lock.json)', type: 'string' },
+        { name: 'production', description: 'exclude dev-only dependencies', type: 'boolean' },
+    ],
+    examples: [
+        { command: 'swarmdo sbom -o sbom.json', description: 'Write a CycloneDX SBOM' },
+        { command: 'swarmdo sbom --spec spdx --production', description: 'SPDX SBOM, production deps only' },
+    ],
+    action: run,
+};
+export default sbomCommand;
+//# sourceMappingURL=sbom.js.map

package/v3/@swarmdo/cli/dist/src/license/license.d.ts

@@ -0,0 +1,55 @@
+/**
+ * license.ts — audit dependency licenses against an allow/deny policy. Supply-
+ * chain hygiene for agent-built projects: catch a copyleft (GPL) or unknown
+ * license slipping into a tree that must stay permissive, and fail CI on it.
+ *
+ * Distinct from `security` (CVE/vulnerability scanning) — this is license
+ * COMPLIANCE. Pure + deterministic: the engine takes a list of
+ * {name, version, license} plus a policy and returns violations. The fs walk
+ * over node_modules lives in ../commands/license.ts.
+ */
+export interface DepLicense {
+    name: string;
+    version: string;
+    /** SPDX id/expression, or 'UNKNOWN' */
+    license: string;
+}
+export interface LicensePolicy {
+    /** if non-empty, a dep must match at least one to pass */
+    allow?: string[];
+    /** any match fails the dep */
+    deny?: string[];
+    /** treat UNKNOWN as a pass even when an allowlist is set (default false) */
+    allowUnknown?: boolean;
+}
+export type ViolationReason = 'denied' | 'not-allowed' | 'unknown';
+export interface Violation {
+    name: string;
+    version: string;
+    license: string;
+    reason: ViolationReason;
+}
+export interface LicenseReport {
+    total: number;
+    violations: Violation[];
+    /** license id → count across all deps */
+    byLicense: Record<string, number>;
+}
+/**
+ * Normalize a package.json `license`/`licenses` field to an SPDX string.
+ * Handles the modern string, the legacy `{type}` object, and the legacy
+ * `licenses: [{type}]` array (→ `A OR B`). Missing → 'UNKNOWN'.
+ */
+export declare function classifyLicense(pkg: {
+    license?: unknown;
+    licenses?: unknown;
+}): string;
+/** Split an SPDX expression into its atomic license ids (strips OR/AND/WITH/parens/+). */
+export declare function spdxComponents(expr: string): string[];
+/** Evaluate one dep against the policy; null if it passes. Pure. */
+export declare function evaluateDep(dep: DepLicense, policy: LicensePolicy): Violation | null;
+/** Audit a dependency set against a policy. Pure. */
+export declare function auditLicenses(deps: DepLicense[], policy?: LicensePolicy): LicenseReport;
+/** One-line human summary. */
+export declare function formatLicenseSummary(r: LicenseReport): string;
+//# sourceMappingURL=license.d.ts.map

package/v3/@swarmdo/cli/dist/src/license/license.js

@@ -0,0 +1,81 @@
+/**
+ * license.ts — audit dependency licenses against an allow/deny policy. Supply-
+ * chain hygiene for agent-built projects: catch a copyleft (GPL) or unknown
+ * license slipping into a tree that must stay permissive, and fail CI on it.
+ *
+ * Distinct from `security` (CVE/vulnerability scanning) — this is license
+ * COMPLIANCE. Pure + deterministic: the engine takes a list of
+ * {name, version, license} plus a policy and returns violations. The fs walk
+ * over node_modules lives in ../commands/license.ts.
+ */
+/**
+ * Normalize a package.json `license`/`licenses` field to an SPDX string.
+ * Handles the modern string, the legacy `{type}` object, and the legacy
+ * `licenses: [{type}]` array (→ `A OR B`). Missing → 'UNKNOWN'.
+ */
+export function classifyLicense(pkg) {
+    const l = pkg.license;
+    if (typeof l === 'string' && l.trim())
+        return l.trim();
+    if (l && typeof l === 'object' && typeof l.type === 'string') {
+        return l.type.trim() || 'UNKNOWN';
+    }
+    const arr = pkg.licenses;
+    if (Array.isArray(arr) && arr.length) {
+        const types = arr
+            .map((e) => (typeof e === 'string' ? e : e?.type))
+            .filter((t) => typeof t === 'string' && !!t.trim());
+        if (types.length)
+            return types.join(' OR ');
+    }
+    return 'UNKNOWN';
+}
+/** Split an SPDX expression into its atomic license ids (strips OR/AND/WITH/parens/+). */
+export function spdxComponents(expr) {
+    return expr
+        .replace(/[()]/g, ' ')
+        .split(/\s+(?:OR|AND|WITH)\s+/i)
+        .map((s) => s.trim().replace(/\+$/, ''))
+        .filter(Boolean);
+}
+/** Evaluate one dep against the policy; null if it passes. Pure. */
+export function evaluateDep(dep, policy) {
+    const allow = new Set(policy.allow ?? []);
+    const deny = new Set(policy.deny ?? []);
+    const isUnknown = dep.license === 'UNKNOWN' || !dep.license;
+    const components = isUnknown ? [] : spdxComponents(dep.license);
+    if (components.some((c) => deny.has(c))) {
+        return { name: dep.name, version: dep.version, license: dep.license, reason: 'denied' };
+    }
+    if (isUnknown) {
+        if (allow.size > 0 && !policy.allowUnknown) {
+            return { name: dep.name, version: dep.version, license: 'UNKNOWN', reason: 'unknown' };
+        }
+        return null;
+    }
+    if (allow.size > 0 && !components.some((c) => allow.has(c))) {
+        return { name: dep.name, version: dep.version, license: dep.license, reason: 'not-allowed' };
+    }
+    return null;
+}
+/** Audit a dependency set against a policy. Pure. */
+export function auditLicenses(deps, policy = {}) {
+    const violations = [];
+    const byLicense = {};
+    for (const dep of deps) {
+        const lic = dep.license || 'UNKNOWN';
+        byLicense[lic] = (byLicense[lic] ?? 0) + 1;
+        const v = evaluateDep(dep, policy);
+        if (v)
+            violations.push(v);
+    }
+    violations.sort((a, b) => a.name.localeCompare(b.name));
+    return { total: deps.length, violations, byLicense };
+}
+/** One-line human summary. */
+export function formatLicenseSummary(r) {
+    if (r.violations.length === 0)
+        return `license: ${r.total} deps, 0 violations`;
+    return `license: ${r.violations.length} violation${r.violations.length === 1 ? '' : 's'} across ${r.total} deps`;
+}
+//# sourceMappingURL=license.js.map

package/v3/@swarmdo/cli/dist/src/mcp-client.js

@@ -22,6 +22,7 @@ import { analyzeTools } from './mcp-tools/analyze-tools.js';
 import { codegraphTools } from './mcp-tools/codegraph-tools.js';
 import { redactTools } from './mcp-tools/redact-tools.js';
 import { envTools } from './mcp-tools/env-tools.js';
+import { licenseTools } from './mcp-tools/license-tools.js';
 import { progressTools } from './mcp-tools/progress-tools.js';
 import { embeddingsTools } from './mcp-tools/embeddings-tools.js';
 import { claimsTools } from './mcp-tools/claims-tools.js';
@@ -108,6 +109,7 @@ const TOOL_GROUPS = {
     codegraph: () => codegraphTools,
     redact: () => redactTools,
     env: () => envTools,
+    license: () => licenseTools,
     progress: () => progressTools,
     embeddings: () => embeddingsTools,
     claims: () => claimsTools,

package/v3/@swarmdo/cli/dist/src/mcp-tools/index.d.ts

@@ -18,6 +18,7 @@ export { analyzeTools } from './analyze-tools.js';
 export { codegraphTools } from './codegraph-tools.js';
 export { redactTools } from './redact-tools.js';
 export { envTools } from './env-tools.js';
+export { licenseTools } from './license-tools.js';
 export { progressTools } from './progress-tools.js';
 export { transferTools } from './transfer-tools.js';
 export { securityTools } from './security-tools.js';

package/v3/@swarmdo/cli/dist/src/mcp-tools/index.js

@@ -17,6 +17,7 @@ export { analyzeTools } from './analyze-tools.js';
 export { codegraphTools } from './codegraph-tools.js';
 export { redactTools } from './redact-tools.js';
 export { envTools } from './env-tools.js';
+export { licenseTools } from './license-tools.js';
 export { progressTools } from './progress-tools.js';
 export { transferTools } from './transfer-tools.js';
 export { securityTools } from './security-tools.js';

package/v3/@swarmdo/cli/dist/src/mcp-tools/license-tools.d.ts

@@ -0,0 +1,11 @@
+/**
+ * License MCP Tool
+ *
+ * Let an agent audit dependency licenses in-session — e.g. before adding a
+ * package or approving a release — against an allow/deny policy. Deterministic;
+ * shares the pure engine in ../license/license.ts with the CLI command. The
+ * caller passes the dependency list (name/version/license), so no fs access.
+ */
+import type { MCPTool } from './types.js';
+export declare const licenseTools: MCPTool[];
+//# sourceMappingURL=license-tools.d.ts.map

package/v3/@swarmdo/cli/dist/src/mcp-tools/license-tools.js

@@ -0,0 +1,57 @@
+/**
+ * License MCP Tool
+ *
+ * Let an agent audit dependency licenses in-session — e.g. before adding a
+ * package or approving a release — against an allow/deny policy. Deterministic;
+ * shares the pure engine in ../license/license.ts with the CLI command. The
+ * caller passes the dependency list (name/version/license), so no fs access.
+ */
+import { auditLicenses } from '../license/license.js';
+const licenseCheckTool = {
+    name: 'license_check',
+    description: 'Audit a dependency list against a license allow/deny policy. Returns violations (denied, not-allowed, or unknown license) plus a license breakdown. Use before adding a dependency or approving a release to keep a permissive tree clean. Deterministic; pass the deps directly.',
+    category: 'license',
+    tags: ['license', 'compliance', 'supply-chain', 'ci'],
+    inputSchema: {
+        type: 'object',
+        properties: {
+            deps: {
+                type: 'array',
+                description: 'dependencies to audit',
+                items: {
+                    type: 'object',
+                    properties: {
+                        name: { type: 'string' },
+                        version: { type: 'string' },
+                        license: { type: 'string', description: 'SPDX id/expression (e.g. MIT, "(MIT OR Apache-2.0)", or UNKNOWN)' },
+                    },
+                    required: ['name', 'license'],
+                },
+            },
+            allow: { type: 'array', items: { type: 'string' }, description: 'SPDX allowlist; a dep must match at least one' },
+            deny: { type: 'array', items: { type: 'string' }, description: 'SPDX denylist; any match is a violation' },
+            allowUnknown: { type: 'boolean', description: 'treat UNKNOWN as allowed even under an allowlist', default: false },
+        },
+        required: ['deps'],
+    },
+    handler: async (params) => {
+        if (!Array.isArray(params.deps))
+            return { error: true, message: 'deps[] is required' };
+        const deps = params.deps
+            .filter((d) => !!d && typeof d === 'object')
+            .map((d) => ({
+            name: String(d.name ?? '?'),
+            version: String(d.version ?? '0.0.0'),
+            license: String(d.license ?? 'UNKNOWN'),
+        }));
+        const policy = {
+            allow: Array.isArray(params.allow) ? params.allow.filter((x) => typeof x === 'string') : undefined,
+            deny: Array.isArray(params.deny) ? params.deny.filter((x) => typeof x === 'string') : undefined,
+            allowUnknown: params.allowUnknown === true,
+        };
+        const report = auditLicenses(deps, policy);
+        return { clean: report.violations.length === 0, total: report.total, violations: report.violations, byLicense: report.byLicense };
+    },
+};
+export const licenseTools = [licenseCheckTool];
+//# sourceMappingURL=license-tools.js.map

package/v3/@swarmdo/cli/dist/src/sbom/sbom.d.ts

@@ -0,0 +1,64 @@
+/**
+ * sbom.ts — generate a Software Bill of Materials from an npm lockfile.
+ *
+ * Completes the supply-chain trio with `env` (config drift) and `license`
+ * (license policy): `sbom` emits the standardized dependency manifest —
+ * CycloneDX or SPDX JSON — that compliance, vuln scanners, and regulators
+ * (US EO 14028, EU CRA) consume. Distinct from `pack` (repo→AI-context prose)
+ * and `license` (policy gate): this is a machine artifact, not a check.
+ *
+ * Pure + deterministic (lockfile object → BOM object, no timestamps/IO), so
+ * output is golden-testable. The file read lives in ../commands/sbom.ts.
+ */
+export interface Component {
+    name: string;
+    version: string;
+    purl: string;
+    license?: string;
+    /** hex-encoded integrity, with its algorithm */
+    hash?: {
+        alg: string;
+        content: string;
+    };
+    dev?: boolean;
+}
+interface NpmLockEntry {
+    version?: string;
+    resolved?: string;
+    integrity?: string;
+    license?: unknown;
+    dev?: boolean;
+    optional?: boolean;
+}
+interface NpmLock {
+    name?: string;
+    version?: string;
+    lockfileVersion?: number;
+    packages?: Record<string, NpmLockEntry>;
+}
+/** Package URL for an npm component. Scope `@` is percent-encoded per the purl spec. */
+export declare function purlFor(name: string, version: string): string;
+/** Convert an SRI integrity string (`sha512-<base64>`) to `{alg, content(hex)}`. Deterministic. */
+export declare function integrityToHash(integrity: string): {
+    alg: string;
+    content: string;
+} | undefined;
+export interface ComponentOptions {
+    /** exclude dev-only dependencies */
+    productionOnly?: boolean;
+}
+/** Extract components from a parsed npm lockfile (v2/v3 `packages` map). Pure. */
+export declare function componentsFromNpmLock(lock: NpmLock, opts?: ComponentOptions): Component[];
+export interface BomMeta {
+    name: string;
+    version: string;
+}
+/** Build a CycloneDX 1.5 BOM object (no timestamp → deterministic). Pure. */
+export declare function buildCycloneDX(components: Component[], meta: BomMeta): Record<string, unknown>;
+/** Build a minimal SPDX 2.3 JSON document (no created timestamp → deterministic). Pure. */
+export declare function buildSpdx(components: Component[], meta: BomMeta): Record<string, unknown>;
+export type SbomFormat = 'cyclonedx' | 'spdx';
+/** Build a BOM in the requested format. Pure. */
+export declare function buildSbom(components: Component[], meta: BomMeta, format: SbomFormat): Record<string, unknown>;
+export {};
+//# sourceMappingURL=sbom.d.ts.map

package/v3/@swarmdo/cli/dist/src/sbom/sbom.js

@@ -0,0 +1,130 @@
+/**
+ * sbom.ts — generate a Software Bill of Materials from an npm lockfile.
+ *
+ * Completes the supply-chain trio with `env` (config drift) and `license`
+ * (license policy): `sbom` emits the standardized dependency manifest —
+ * CycloneDX or SPDX JSON — that compliance, vuln scanners, and regulators
+ * (US EO 14028, EU CRA) consume. Distinct from `pack` (repo→AI-context prose)
+ * and `license` (policy gate): this is a machine artifact, not a check.
+ *
+ * Pure + deterministic (lockfile object → BOM object, no timestamps/IO), so
+ * output is golden-testable. The file read lives in ../commands/sbom.ts.
+ */
+/** Derive the package name from a lockfile `packages` key (last node_modules segment, scope-aware). */
+function nameFromKey(key) {
+    const idx = key.lastIndexOf('node_modules/');
+    const tail = idx >= 0 ? key.slice(idx + 'node_modules/'.length) : key;
+    return tail; // already includes @scope/name because we split on the LAST node_modules/
+}
+/** Package URL for an npm component. Scope `@` is percent-encoded per the purl spec. */
+export function purlFor(name, version) {
+    const enc = name.startsWith('@') ? '%40' + name.slice(1) : name;
+    return `pkg:npm/${enc}@${version}`;
+}
+/** Convert an SRI integrity string (`sha512-<base64>`) to `{alg, content(hex)}`. Deterministic. */
+export function integrityToHash(integrity) {
+    const m = integrity.match(/^(sha\d+)-(.+)$/);
+    if (!m)
+        return undefined;
+    const algMap = { sha1: 'SHA-1', sha256: 'SHA-256', sha384: 'SHA-384', sha512: 'SHA-512' };
+    const alg = algMap[m[1]];
+    if (!alg)
+        return undefined;
+    let hex;
+    try {
+        // base64 → hex, dependency-free and deterministic
+        hex = Buffer.from(m[2], 'base64').toString('hex');
+    }
+    catch {
+        return undefined;
+    }
+    return { alg, content: hex };
+}
+function licenseOf(entry) {
+    const l = entry.license;
+    if (typeof l === 'string' && l.trim())
+        return l.trim();
+    if (l && typeof l === 'object' && typeof l.type === 'string')
+        return l.type;
+    return undefined;
+}
+/** Extract components from a parsed npm lockfile (v2/v3 `packages` map). Pure. */
+export function componentsFromNpmLock(lock, opts = {}) {
+    const packages = lock.packages ?? {};
+    const out = [];
+    const seen = new Set();
+    for (const [key, entry] of Object.entries(packages)) {
+        if (!key)
+            continue; // the root project entry
+        if (!key.includes('node_modules/'))
+            continue;
+        if (opts.productionOnly && entry.dev)
+            continue;
+        const name = nameFromKey(key);
+        const version = entry.version ?? '0.0.0';
+        const id = `${name}@${version}`;
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        const comp = { name, version, purl: purlFor(name, version) };
+        const license = licenseOf(entry);
+        if (license)
+            comp.license = license;
+        if (entry.integrity) {
+            const h = integrityToHash(entry.integrity);
+            if (h)
+                comp.hash = h;
+        }
+        if (entry.dev)
+            comp.dev = true;
+        out.push(comp);
+    }
+    out.sort((a, b) => (a.name === b.name ? a.version.localeCompare(b.version) : a.name.localeCompare(b.name)));
+    return out;
+}
+/** Build a CycloneDX 1.5 BOM object (no timestamp → deterministic). Pure. */
+export function buildCycloneDX(components, meta) {
+    return {
+        bomFormat: 'CycloneDX',
+        specVersion: '1.5',
+        version: 1,
+        metadata: {
+            component: { type: 'application', name: meta.name, version: meta.version },
+        },
+        components: components.map((c) => {
+            const comp = { type: 'library', name: c.name, version: c.version, purl: c.purl };
+            if (c.hash)
+                comp.hashes = [{ alg: c.hash.alg, content: c.hash.content }];
+            if (c.license)
+                comp.licenses = [{ license: { id: c.license } }];
+            return comp;
+        }),
+    };
+}
+/** Build a minimal SPDX 2.3 JSON document (no created timestamp → deterministic). Pure. */
+export function buildSpdx(components, meta) {
+    const safe = (s) => s.replace(/[^A-Za-z0-9.-]/g, '-');
+    return {
+        spdxVersion: 'SPDX-2.3',
+        dataLicense: 'CC0-1.0',
+        SPDXID: 'SPDXRef-DOCUMENT',
+        name: meta.name,
+        documentNamespace: `https://swarmdo/spdx/${safe(meta.name)}-${meta.version}`,
+        packages: [
+            { SPDXID: 'SPDXRef-Package-root', name: meta.name, versionInfo: meta.version, downloadLocation: 'NOASSERTION' },
+            ...components.map((c) => ({
+                SPDXID: `SPDXRef-Package-${safe(c.name)}-${safe(c.version)}`,
+                name: c.name,
+                versionInfo: c.version,
+                downloadLocation: 'NOASSERTION',
+                licenseConcluded: c.license ?? 'NOASSERTION',
+                externalRefs: [{ referenceCategory: 'PACKAGE-MANAGER', referenceType: 'purl', referenceLocator: c.purl }],
+            })),
+        ],
+    };
+}
+/** Build a BOM in the requested format. Pure. */
+export function buildSbom(components, meta, format) {
+    return format === 'spdx' ? buildSpdx(components, meta) : buildCycloneDX(components, meta);
+}
+//# sourceMappingURL=sbom.js.map

package/v3/@swarmdo/cli/dist/src/util/stdout.d.ts

@@ -0,0 +1,12 @@
+/**
+ * writeStdout — write to stdout and RESOLVE ONLY WHEN THE CHUNK IS FLUSHED.
+ *
+ * process.stdout on a pipe is asynchronous: write() buffers in JS and returns
+ * immediately. If the command then returns and the CLI harness calls
+ * process.exit(), any unflushed bytes are discarded — large piped output
+ * (`swarmdo sbom | …`, `pack`, `compact`, `redact`) truncates at the ~64 KiB
+ * pipe buffer. Awaiting the write callback guarantees the data reached the OS
+ * before we hand control back. For a TTY (synchronous) this is a no-op await.
+ */
+export declare function writeStdout(data: string): Promise<void>;
+//# sourceMappingURL=stdout.d.ts.map

package/v3/@swarmdo/cli/dist/src/util/stdout.js

@@ -0,0 +1,16 @@
+/**
+ * writeStdout — write to stdout and RESOLVE ONLY WHEN THE CHUNK IS FLUSHED.
+ *
+ * process.stdout on a pipe is asynchronous: write() buffers in JS and returns
+ * immediately. If the command then returns and the CLI harness calls
+ * process.exit(), any unflushed bytes are discarded — large piped output
+ * (`swarmdo sbom | …`, `pack`, `compact`, `redact`) truncates at the ~64 KiB
+ * pipe buffer. Awaiting the write callback guarantees the data reached the OS
+ * before we hand control back. For a TTY (synchronous) this is a no-op await.
+ */
+export function writeStdout(data) {
+    return new Promise((resolve, reject) => {
+        process.stdout.write(data, (err) => (err ? reject(err) : resolve()));
+    });
+}
+//# sourceMappingURL=stdout.js.map

package/v3/@swarmdo/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmdo/cli",
-  "version": "1.12.0",
+  "version": "1.14.0",
   "type": "module",
   "description": "Swarmdo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",