swarmdo 1.13.0 → 1.14.0

package/.claude/helpers/statusline.cjs

@@ -515,7 +515,7 @@ function getCostFromStdin() {
 // misses, the displayed version is meaningful (matches what the user
 // installed), not a stale hard-coded string.
 function getPkgVersion() {
-  let ver = '1.13.0';
+  let ver = '1.14.0';
   try {
     const home = os.homedir();
     const pkgPaths = [

package/README.md

@@ -2,7 +2,7 @@
 
 [![swarmdo](swarmdo/assets/brand/logo-full.svg)](https://swarmdo.com)
 
-[![npm version (swarmdo)](https://img.shields.io/badge/npx%20swarmdo-v1.13.0-cb3837?style=for-the-badge&logo=npm&logoColor=white)](https://github.com/SwarmDo/swarmdo/releases)
+[![npm version (swarmdo)](https://img.shields.io/badge/npx%20swarmdo-v1.14.0-cb3837?style=for-the-badge&logo=npm&logoColor=white)](https://github.com/SwarmDo/swarmdo/releases)
 [![MIT License](https://img.shields.io/badge/License-MIT-yellow?style=for-the-badge)](https://github.com/SwarmDo/swarmdo/blob/main/LICENSE)
 [![Website](https://img.shields.io/badge/swarmdo.com-e2a33c?style=for-the-badge&logoColor=black)](https://swarmdo.com)
 [![Star on GitHub](https://img.shields.io/github/stars/SwarmDo/swarmdo?style=for-the-badge&logo=github&color=gold)](https://github.com/SwarmDo/swarmdo)
@@ -282,6 +282,7 @@ The recent release train added a full day-to-day operations layer around the swa
 | `swarmdo pack` | **Bundle a repo into one AI-context blob** — walk the tree (respects `.gitignore` + glob `--include`/`--exclude`, skips binaries/node_modules), emit markdown/xml/json/plain with a directory tree and per-file + total token estimates. `swarmdo pack --tokens` for a budget breakdown; `--redact` masks secrets first. Deterministic |
 | `swarmdo env` | **Catch env-var drift before deploy** — statically scan code for `process.env.X` / `import.meta.env.X` / `Deno.env.get` / `os.getenv` references and reconcile against `.env` and `.env.example`: reports **missing** (used but undeclared), **unused**, and **undocumented**. `--ci` exits 1 on missing vars. Also an MCP tool (`env_check`). Deterministic |
 | `swarmdo license` | **Audit dependency licenses** — walk `node_modules`, resolve each package's SPDX license, and gate on an allow/deny policy so a GPL or unknown license can't slip into a permissive tree. `--allow MIT,Apache-2.0 --ci` fails the build; distinct from `security` (CVEs). Also an MCP tool (`license_check`). Deterministic |
+| `swarmdo sbom` | **Software Bill of Materials from the lockfile** — emit a CycloneDX (default) or SPDX JSON manifest of every dependency with version, purl, license, and integrity hash, for compliance/vuln tooling. `--spec spdx`, `-o sbom.json`, `--production`. Completes the env/license/sbom supply-chain trio. Deterministic |
 | `swarmdo integrations` (alias `integrate`) | **Use swarmdo from Codex CLI, GitHub Copilot CLI, and pi** — one command wires AGENTS.md + each CLI's MCP config (idempotent, dry-run first, never touches your Claude Code setup) |
 | OpenRouter model pool | **Let swarms pick from any models you configure** — declare tier-mapped OpenRouter models in `swarmdo.config.json`; the router Thompson-samples among them per task and the execution layer dispatches the winner |
 | `swarmdo changelog` (alias `notes`) | **Release notes from conventional commits** — `--out NOTES.md` feeds `gh release create --notes-file` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "swarmdo",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "Swarmdo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@swarmdo/cli/dist/src/commands/compact.js

@@ -13,6 +13,7 @@
 import { spawnSync } from 'node:child_process';
 import { output } from '../output.js';
 import { compactOutput, formatSavings } from '../compact/compact.js';
+import { writeStdout } from '../util/stdout.js';
 /**
  * Read all of stdin as UTF-8. A stream read (not readFileSync(0)) — the
  * synchronous form throws EAGAIN on a non-blocking pipe on macOS/Linux.
@@ -61,7 +62,7 @@ async function run(ctx) {
         }
         const combined = (r.stdout || '') + (r.stderr || '');
         const { text, stats } = compactOutput(combined, opts);
-        process.stdout.write(text);
+        await writeStdout(text);
         if (!quiet)
             process.stderr.write(formatSavings(stats) + '\n');
         // Propagate the wrapped command's exit code verbatim.
@@ -81,7 +82,7 @@ async function run(ctx) {
     else if (!quiet) {
         process.stderr.write(formatSavings(stats) + '\n');
     }
-    process.stdout.write(text);
+    await writeStdout(text);
     return { success: true, exitCode: 0 };
 }
 export const compactCommand = {

package/v3/@swarmdo/cli/dist/src/commands/index.js

@@ -35,6 +35,9 @@ const commandLoaders = {
     // GPL/unknown licenses in the tree, fail CI on a forbidden one.
     license: () => import('./license.js'),
     licenses: () => import('./license.js'), // alias via loader key
+    // Software Bill of Materials from the lockfile (syft/cyclonedx demand) —
+    // CycloneDX/SPDX JSON; completes the env/license/sbom supply-chain trio.
+    sbom: () => import('./sbom.js'),
     // Queryable exported-symbol index (codegraph demand) — where things are
     // defined without grep+read round-trips.
     codegraph: () => import('./codegraph.js'),
@@ -268,7 +271,7 @@ export async function getCommandsByCategory() {
     // three slots from 'statusline' onward (completionsCmd received the
     // statusline module, analyzeCmd received completions, …), scrambling the
     // categorized help. Every load now has a named slot.
-    const [daemonCmd, doctorCmd, embeddingsCmd, neuralCmd, performanceCmd, securityCmd, swarmvectorCmd, hiveMindCmd, configCmd, statuslineCmd, compressCmd, efficiencyCmd, completionsCmd, migrateCmd, workflowCmd, analyzeCmd, routeCmd, progressCmd, providersCmd, pluginsCmd, deploymentCmd, claimsCmd, issuesCmd, updateCmd, processCmd, guidanceCmd, applianceCmd, cleanupCmd, autopilotCmd, demoCmd, usageCmd, repairCmd, hudCmd, compactCmd, codegraphCmd, redactCmd, packCmd, envCmd, licenseCmd,] = await Promise.all([
+    const [daemonCmd, doctorCmd, embeddingsCmd, neuralCmd, performanceCmd, securityCmd, swarmvectorCmd, hiveMindCmd, configCmd, statuslineCmd, compressCmd, efficiencyCmd, completionsCmd, migrateCmd, workflowCmd, analyzeCmd, routeCmd, progressCmd, providersCmd, pluginsCmd, deploymentCmd, claimsCmd, issuesCmd, updateCmd, processCmd, guidanceCmd, applianceCmd, cleanupCmd, autopilotCmd, demoCmd, usageCmd, repairCmd, hudCmd, compactCmd, codegraphCmd, redactCmd, packCmd, envCmd, licenseCmd, sbomCmd,] = await Promise.all([
         loadCommand('daemon'), loadCommand('doctor'), loadCommand('embeddings'), loadCommand('neural'),
         loadCommand('performance'), loadCommand('security'), loadCommand('swarmvector'), loadCommand('hive-mind'),
         loadCommand('config'), loadCommand('statusline'), loadCommand('compress'), loadCommand('efficiency'),
@@ -276,7 +279,7 @@ export async function getCommandsByCategory() {
         loadCommand('analyze'), loadCommand('route'), loadCommand('progress'), loadCommand('providers'),
         loadCommand('plugins'), loadCommand('deployment'), loadCommand('claims'), loadCommand('issues'),
         loadCommand('update'), loadCommand('process'), loadCommand('guidance'), loadCommand('appliance'),
-        loadCommand('cleanup'), loadCommand('autopilot'), loadCommand('demo'), loadCommand('usage'), loadCommand('repair'), loadCommand('hud'), loadCommand('compact'), loadCommand('codegraph'), loadCommand('redact'), loadCommand('pack'), loadCommand('env'), loadCommand('license'),
+        loadCommand('cleanup'), loadCommand('autopilot'), loadCommand('demo'), loadCommand('usage'), loadCommand('repair'), loadCommand('hud'), loadCommand('compact'), loadCommand('codegraph'), loadCommand('redact'), loadCommand('pack'), loadCommand('env'), loadCommand('license'), loadCommand('sbom'),
     ]);
     return {
         primary: [
@@ -292,7 +295,7 @@ export async function getCommandsByCategory() {
         utility: [
             configCmd, doctorCmd, daemonCmd, completionsCmd,
             migrateCmd, workflowCmd, demoCmd,
-            statuslineCmd, compressCmd, compactCmd, redactCmd, packCmd, envCmd, licenseCmd, efficiencyCmd,
+            statuslineCmd, compressCmd, compactCmd, redactCmd, packCmd, envCmd, licenseCmd, sbomCmd, efficiencyCmd,
         ].filter(Boolean),
         analysis: [
             analyzeCmd, routeCmd, progressCmd, usageCmd, hudCmd, codegraphCmd,

package/v3/@swarmdo/cli/dist/src/commands/pack.js

@@ -17,6 +17,7 @@ import * as path from 'node:path';
 import { output } from '../output.js';
 import { packFiles, makeIgnoreMatcher } from '../pack/pack.js';
 import { redactText } from '../redact/redact.js';
+import { writeStdout } from '../util/stdout.js';
 const SKIP_DIRS = new Set([
     'node_modules', '.git', '.swarm', 'dist', 'dist-standalone', 'build',
     'coverage', '.next', '.turbo', 'out', 'vendor', '.cache',
@@ -151,8 +152,7 @@ async function run(ctx) {
         output.printSuccess(`packed ${stats.files} files (~${stats.tokens} tokens) → ${outFile}`);
     }
     else {
-        process.stdout.write(bundle);
-        if (!process.stdout.isTTY) { /* piped: keep stdout clean */ }
+        await writeStdout(bundle);
         process.stderr.write(output.dim(`packed ${stats.files} files (~${stats.tokens} tokens)\n`));
     }
     return { success: true, exitCode: 0 };

package/v3/@swarmdo/cli/dist/src/commands/redact.js

@@ -15,6 +15,7 @@
 import { spawnSync } from 'node:child_process';
 import { output } from '../output.js';
 import { redactText, scanText, formatFindingsSummary } from '../redact/redact.js';
+import { writeStdout } from '../util/stdout.js';
 function readStdin() {
     return new Promise((resolve) => {
         const chunks = [];
@@ -93,7 +94,7 @@ async function run(ctx) {
     }
     // Redact mode: rewrite and emit.
     const { output: redacted, findings } = redactText(input, opts);
-    process.stdout.write(redacted);
+    await writeStdout(redacted);
     if (asJson) {
         process.stderr.write(JSON.stringify({ count: findings.length, findings }, null, 2) + '\n');
     }

package/v3/@swarmdo/cli/dist/src/commands/sbom.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `swarmdo sbom` — emit a Software Bill of Materials from the npm lockfile.
+ *
+ *   swarmdo sbom                       # CycloneDX JSON → stdout
+ *   swarmdo sbom -f spdx -o sbom.json  # SPDX 2.3 JSON → file
+ *   swarmdo sbom --production          # exclude dev-only dependencies
+ *
+ * Completes the supply-chain trio (env / license / sbom). Engine
+ * (../sbom/sbom.ts) is pure + tested; this reads package-lock.json.
+ */
+import type { Command } from '../types.js';
+export declare const sbomCommand: Command;
+export default sbomCommand;
+//# sourceMappingURL=sbom.d.ts.map

package/v3/@swarmdo/cli/dist/src/commands/sbom.js

@@ -0,0 +1,73 @@
+/**
+ * `swarmdo sbom` — emit a Software Bill of Materials from the npm lockfile.
+ *
+ *   swarmdo sbom                       # CycloneDX JSON → stdout
+ *   swarmdo sbom -f spdx -o sbom.json  # SPDX 2.3 JSON → file
+ *   swarmdo sbom --production          # exclude dev-only dependencies
+ *
+ * Completes the supply-chain trio (env / license / sbom). Engine
+ * (../sbom/sbom.ts) is pure + tested; this reads package-lock.json.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { output } from '../output.js';
+import { componentsFromNpmLock, buildSbom } from '../sbom/sbom.js';
+import { writeStdout } from '../util/stdout.js';
+async function run(ctx) {
+    const repoRoot = ctx.cwd || process.cwd();
+    const lockPath = path.resolve(repoRoot, ctx.args[0] ?? (typeof ctx.flags.lockfile === 'string' ? ctx.flags.lockfile : 'package-lock.json'));
+    let lock;
+    try {
+        lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+    }
+    catch {
+        output.printError(`could not read a JSON lockfile at ${path.relative(repoRoot, lockPath) || lockPath} (npm package-lock.json; pnpm/yaml unsupported)`);
+        return { success: false, exitCode: 1 };
+    }
+    if (!lock.packages) {
+        output.printError('lockfile has no `packages` map — needs npm lockfileVersion 2 or 3');
+        return { success: false, exitCode: 1 };
+    }
+    // NB: use --spec, not --format — the global --format flag is choices-validated
+    // to text|json|table and rejects 'spdx'/'cyclonedx' before this command runs.
+    const raw = typeof ctx.flags.spec === 'string' ? ctx.flags.spec : 'cyclonedx';
+    if (raw !== 'cyclonedx' && raw !== 'spdx') {
+        output.printError(`unknown --spec '${raw}' (use cyclonedx|spdx)`);
+        return { success: false, exitCode: 1 };
+    }
+    const format = raw;
+    const components = componentsFromNpmLock(lock, {
+        productionOnly: ctx.flags.production === true,
+    });
+    // Prefer the lockfile's own project name/version; fall back to the repo dir.
+    const meta = { name: lock.name ?? path.basename(repoRoot), version: lock.version ?? '0.0.0' };
+    const bom = buildSbom(components, meta, format);
+    const serialized = JSON.stringify(bom, null, 2);
+    const outFile = (typeof ctx.flags.output === 'string' && ctx.flags.output) || (typeof ctx.flags.o === 'string' && ctx.flags.o);
+    if (outFile) {
+        fs.writeFileSync(path.resolve(repoRoot, outFile), serialized + '\n');
+        output.printSuccess(`${format} SBOM: ${components.length} components → ${outFile}`);
+    }
+    else {
+        await writeStdout(serialized + '\n');
+        process.stderr.write(output.dim(`${format} SBOM: ${components.length} components\n`));
+    }
+    return { success: true, exitCode: 0 };
+}
+export const sbomCommand = {
+    name: 'sbom',
+    description: 'Generate a Software Bill of Materials (CycloneDX or SPDX JSON) from the npm lockfile',
+    options: [
+        { name: 'spec', description: 'BOM spec: cyclonedx (default) or spdx', type: 'string' },
+        { name: 'output', short: 'o', description: 'write the SBOM to a file instead of stdout', type: 'string' },
+        { name: 'lockfile', description: 'path to the lockfile (default package-lock.json)', type: 'string' },
+        { name: 'production', description: 'exclude dev-only dependencies', type: 'boolean' },
+    ],
+    examples: [
+        { command: 'swarmdo sbom -o sbom.json', description: 'Write a CycloneDX SBOM' },
+        { command: 'swarmdo sbom --spec spdx --production', description: 'SPDX SBOM, production deps only' },
+    ],
+    action: run,
+};
+export default sbomCommand;
+//# sourceMappingURL=sbom.js.map

package/v3/@swarmdo/cli/dist/src/sbom/sbom.d.ts

@@ -0,0 +1,64 @@
+/**
+ * sbom.ts — generate a Software Bill of Materials from an npm lockfile.
+ *
+ * Completes the supply-chain trio with `env` (config drift) and `license`
+ * (license policy): `sbom` emits the standardized dependency manifest —
+ * CycloneDX or SPDX JSON — that compliance, vuln scanners, and regulators
+ * (US EO 14028, EU CRA) consume. Distinct from `pack` (repo→AI-context prose)
+ * and `license` (policy gate): this is a machine artifact, not a check.
+ *
+ * Pure + deterministic (lockfile object → BOM object, no timestamps/IO), so
+ * output is golden-testable. The file read lives in ../commands/sbom.ts.
+ */
+export interface Component {
+    name: string;
+    version: string;
+    purl: string;
+    license?: string;
+    /** hex-encoded integrity, with its algorithm */
+    hash?: {
+        alg: string;
+        content: string;
+    };
+    dev?: boolean;
+}
+interface NpmLockEntry {
+    version?: string;
+    resolved?: string;
+    integrity?: string;
+    license?: unknown;
+    dev?: boolean;
+    optional?: boolean;
+}
+interface NpmLock {
+    name?: string;
+    version?: string;
+    lockfileVersion?: number;
+    packages?: Record<string, NpmLockEntry>;
+}
+/** Package URL for an npm component. Scope `@` is percent-encoded per the purl spec. */
+export declare function purlFor(name: string, version: string): string;
+/** Convert an SRI integrity string (`sha512-<base64>`) to `{alg, content(hex)}`. Deterministic. */
+export declare function integrityToHash(integrity: string): {
+    alg: string;
+    content: string;
+} | undefined;
+export interface ComponentOptions {
+    /** exclude dev-only dependencies */
+    productionOnly?: boolean;
+}
+/** Extract components from a parsed npm lockfile (v2/v3 `packages` map). Pure. */
+export declare function componentsFromNpmLock(lock: NpmLock, opts?: ComponentOptions): Component[];
+export interface BomMeta {
+    name: string;
+    version: string;
+}
+/** Build a CycloneDX 1.5 BOM object (no timestamp → deterministic). Pure. */
+export declare function buildCycloneDX(components: Component[], meta: BomMeta): Record<string, unknown>;
+/** Build a minimal SPDX 2.3 JSON document (no created timestamp → deterministic). Pure. */
+export declare function buildSpdx(components: Component[], meta: BomMeta): Record<string, unknown>;
+export type SbomFormat = 'cyclonedx' | 'spdx';
+/** Build a BOM in the requested format. Pure. */
+export declare function buildSbom(components: Component[], meta: BomMeta, format: SbomFormat): Record<string, unknown>;
+export {};
+//# sourceMappingURL=sbom.d.ts.map

package/v3/@swarmdo/cli/dist/src/sbom/sbom.js

@@ -0,0 +1,130 @@
+/**
+ * sbom.ts — generate a Software Bill of Materials from an npm lockfile.
+ *
+ * Completes the supply-chain trio with `env` (config drift) and `license`
+ * (license policy): `sbom` emits the standardized dependency manifest —
+ * CycloneDX or SPDX JSON — that compliance, vuln scanners, and regulators
+ * (US EO 14028, EU CRA) consume. Distinct from `pack` (repo→AI-context prose)
+ * and `license` (policy gate): this is a machine artifact, not a check.
+ *
+ * Pure + deterministic (lockfile object → BOM object, no timestamps/IO), so
+ * output is golden-testable. The file read lives in ../commands/sbom.ts.
+ */
+/** Derive the package name from a lockfile `packages` key (last node_modules segment, scope-aware). */
+function nameFromKey(key) {
+    const idx = key.lastIndexOf('node_modules/');
+    const tail = idx >= 0 ? key.slice(idx + 'node_modules/'.length) : key;
+    return tail; // already includes @scope/name because we split on the LAST node_modules/
+}
+/** Package URL for an npm component. Scope `@` is percent-encoded per the purl spec. */
+export function purlFor(name, version) {
+    const enc = name.startsWith('@') ? '%40' + name.slice(1) : name;
+    return `pkg:npm/${enc}@${version}`;
+}
+/** Convert an SRI integrity string (`sha512-<base64>`) to `{alg, content(hex)}`. Deterministic. */
+export function integrityToHash(integrity) {
+    const m = integrity.match(/^(sha\d+)-(.+)$/);
+    if (!m)
+        return undefined;
+    const algMap = { sha1: 'SHA-1', sha256: 'SHA-256', sha384: 'SHA-384', sha512: 'SHA-512' };
+    const alg = algMap[m[1]];
+    if (!alg)
+        return undefined;
+    let hex;
+    try {
+        // base64 → hex, dependency-free and deterministic
+        hex = Buffer.from(m[2], 'base64').toString('hex');
+    }
+    catch {
+        return undefined;
+    }
+    return { alg, content: hex };
+}
+function licenseOf(entry) {
+    const l = entry.license;
+    if (typeof l === 'string' && l.trim())
+        return l.trim();
+    if (l && typeof l === 'object' && typeof l.type === 'string')
+        return l.type;
+    return undefined;
+}
+/** Extract components from a parsed npm lockfile (v2/v3 `packages` map). Pure. */
+export function componentsFromNpmLock(lock, opts = {}) {
+    const packages = lock.packages ?? {};
+    const out = [];
+    const seen = new Set();
+    for (const [key, entry] of Object.entries(packages)) {
+        if (!key)
+            continue; // the root project entry
+        if (!key.includes('node_modules/'))
+            continue;
+        if (opts.productionOnly && entry.dev)
+            continue;
+        const name = nameFromKey(key);
+        const version = entry.version ?? '0.0.0';
+        const id = `${name}@${version}`;
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        const comp = { name, version, purl: purlFor(name, version) };
+        const license = licenseOf(entry);
+        if (license)
+            comp.license = license;
+        if (entry.integrity) {
+            const h = integrityToHash(entry.integrity);
+            if (h)
+                comp.hash = h;
+        }
+        if (entry.dev)
+            comp.dev = true;
+        out.push(comp);
+    }
+    out.sort((a, b) => (a.name === b.name ? a.version.localeCompare(b.version) : a.name.localeCompare(b.name)));
+    return out;
+}
+/** Build a CycloneDX 1.5 BOM object (no timestamp → deterministic). Pure. */
+export function buildCycloneDX(components, meta) {
+    return {
+        bomFormat: 'CycloneDX',
+        specVersion: '1.5',
+        version: 1,
+        metadata: {
+            component: { type: 'application', name: meta.name, version: meta.version },
+        },
+        components: components.map((c) => {
+            const comp = { type: 'library', name: c.name, version: c.version, purl: c.purl };
+            if (c.hash)
+                comp.hashes = [{ alg: c.hash.alg, content: c.hash.content }];
+            if (c.license)
+                comp.licenses = [{ license: { id: c.license } }];
+            return comp;
+        }),
+    };
+}
+/** Build a minimal SPDX 2.3 JSON document (no created timestamp → deterministic). Pure. */
+export function buildSpdx(components, meta) {
+    const safe = (s) => s.replace(/[^A-Za-z0-9.-]/g, '-');
+    return {
+        spdxVersion: 'SPDX-2.3',
+        dataLicense: 'CC0-1.0',
+        SPDXID: 'SPDXRef-DOCUMENT',
+        name: meta.name,
+        documentNamespace: `https://swarmdo/spdx/${safe(meta.name)}-${meta.version}`,
+        packages: [
+            { SPDXID: 'SPDXRef-Package-root', name: meta.name, versionInfo: meta.version, downloadLocation: 'NOASSERTION' },
+            ...components.map((c) => ({
+                SPDXID: `SPDXRef-Package-${safe(c.name)}-${safe(c.version)}`,
+                name: c.name,
+                versionInfo: c.version,
+                downloadLocation: 'NOASSERTION',
+                licenseConcluded: c.license ?? 'NOASSERTION',
+                externalRefs: [{ referenceCategory: 'PACKAGE-MANAGER', referenceType: 'purl', referenceLocator: c.purl }],
+            })),
+        ],
+    };
+}
+/** Build a BOM in the requested format. Pure. */
+export function buildSbom(components, meta, format) {
+    return format === 'spdx' ? buildSpdx(components, meta) : buildCycloneDX(components, meta);
+}
+//# sourceMappingURL=sbom.js.map

package/v3/@swarmdo/cli/dist/src/util/stdout.d.ts

@@ -0,0 +1,12 @@
+/**
+ * writeStdout — write to stdout and RESOLVE ONLY WHEN THE CHUNK IS FLUSHED.
+ *
+ * process.stdout on a pipe is asynchronous: write() buffers in JS and returns
+ * immediately. If the command then returns and the CLI harness calls
+ * process.exit(), any unflushed bytes are discarded — large piped output
+ * (`swarmdo sbom | …`, `pack`, `compact`, `redact`) truncates at the ~64 KiB
+ * pipe buffer. Awaiting the write callback guarantees the data reached the OS
+ * before we hand control back. For a TTY (synchronous) this is a no-op await.
+ */
+export declare function writeStdout(data: string): Promise<void>;
+//# sourceMappingURL=stdout.d.ts.map

package/v3/@swarmdo/cli/dist/src/util/stdout.js

@@ -0,0 +1,16 @@
+/**
+ * writeStdout — write to stdout and RESOLVE ONLY WHEN THE CHUNK IS FLUSHED.
+ *
+ * process.stdout on a pipe is asynchronous: write() buffers in JS and returns
+ * immediately. If the command then returns and the CLI harness calls
+ * process.exit(), any unflushed bytes are discarded — large piped output
+ * (`swarmdo sbom | …`, `pack`, `compact`, `redact`) truncates at the ~64 KiB
+ * pipe buffer. Awaiting the write callback guarantees the data reached the OS
+ * before we hand control back. For a TTY (synchronous) this is a no-op await.
+ */
+export function writeStdout(data) {
+    return new Promise((resolve, reject) => {
+        process.stdout.write(data, (err) => (err ? reject(err) : resolve()));
+    });
+}
+//# sourceMappingURL=stdout.js.map

package/v3/@swarmdo/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmdo/cli",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "type": "module",
   "description": "Swarmdo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",