swarmdo 1.13.0 → 1.15.0

package/.claude/helpers/statusline.cjs

@@ -515,7 +515,7 @@ function getCostFromStdin() {
 // misses, the displayed version is meaningful (matches what the user
 // installed), not a stale hard-coded string.
 function getPkgVersion() {
-  let ver = '1.13.0';
+  let ver = '1.15.0';
   try {
     const home = os.homedir();
     const pkgPaths = [

package/README.md

@@ -2,7 +2,7 @@
 
 [![swarmdo](swarmdo/assets/brand/logo-full.svg)](https://swarmdo.com)
 
-[![npm version (swarmdo)](https://img.shields.io/badge/npx%20swarmdo-v1.13.0-cb3837?style=for-the-badge&logo=npm&logoColor=white)](https://github.com/SwarmDo/swarmdo/releases)
+[![npm version (swarmdo)](https://img.shields.io/badge/npx%20swarmdo-v1.15.0-cb3837?style=for-the-badge&logo=npm&logoColor=white)](https://github.com/SwarmDo/swarmdo/releases)
 [![MIT License](https://img.shields.io/badge/License-MIT-yellow?style=for-the-badge)](https://github.com/SwarmDo/swarmdo/blob/main/LICENSE)
 [![Website](https://img.shields.io/badge/swarmdo.com-e2a33c?style=for-the-badge&logoColor=black)](https://swarmdo.com)
 [![Star on GitHub](https://img.shields.io/github/stars/SwarmDo/swarmdo?style=for-the-badge&logo=github&color=gold)](https://github.com/SwarmDo/swarmdo)
@@ -282,6 +282,8 @@ The recent release train added a full day-to-day operations layer around the swa
 | `swarmdo pack` | **Bundle a repo into one AI-context blob** — walk the tree (respects `.gitignore` + glob `--include`/`--exclude`, skips binaries/node_modules), emit markdown/xml/json/plain with a directory tree and per-file + total token estimates. `swarmdo pack --tokens` for a budget breakdown; `--redact` masks secrets first. Deterministic |
 | `swarmdo env` | **Catch env-var drift before deploy** — statically scan code for `process.env.X` / `import.meta.env.X` / `Deno.env.get` / `os.getenv` references and reconcile against `.env` and `.env.example`: reports **missing** (used but undeclared), **unused**, and **undocumented**. `--ci` exits 1 on missing vars. Also an MCP tool (`env_check`). Deterministic |
 | `swarmdo license` | **Audit dependency licenses** — walk `node_modules`, resolve each package's SPDX license, and gate on an allow/deny policy so a GPL or unknown license can't slip into a permissive tree. `--allow MIT,Apache-2.0 --ci` fails the build; distinct from `security` (CVEs). Also an MCP tool (`license_check`). Deterministic |
+| `swarmdo sbom` | **Software Bill of Materials from the lockfile** — emit a CycloneDX (default) or SPDX JSON manifest of every dependency with version, purl, license, and integrity hash, for compliance/vuln tooling. `--spec spdx`, `-o sbom.json`, `--production`. Completes the env/license/sbom supply-chain trio. Deterministic |
+| `swarmdo apply` | **A forgiving `git apply`** — apply a unified diff with fuzzy context matching, so an agent's patch lands even when line numbers have drifted or a context line is slightly off, and reports exactly which hunks couldn't. `--dry-run` to preview, `--fuzz N` to tolerate more drift. Also an MCP tool (`apply_patch`). Deterministic |
 | `swarmdo integrations` (alias `integrate`) | **Use swarmdo from Codex CLI, GitHub Copilot CLI, and pi** — one command wires AGENTS.md + each CLI's MCP config (idempotent, dry-run first, never touches your Claude Code setup) |
 | OpenRouter model pool | **Let swarms pick from any models you configure** — declare tier-mapped OpenRouter models in `swarmdo.config.json`; the router Thompson-samples among them per task and the execution layer dispatches the winner |
 | `swarmdo changelog` (alias `notes`) | **Release notes from conventional commits** — `--out NOTES.md` feeds `gh release create --notes-file` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "swarmdo",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "description": "Swarmdo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@swarmdo/cli/dist/src/apply/apply.d.ts

@@ -0,0 +1,50 @@
+/**
+ * apply.ts — apply a unified diff to source text with FUZZY context matching.
+ *
+ * LLM/agent-produced diffs frequently fail `git apply`: the model's context
+ * lines drift by a few lines, or whitespace differs, and git rejects the whole
+ * patch. This applier locates each hunk by searching for its context near the
+ * declared line (not only AT it), tolerates leading/trailing context drift up
+ * to a fuzz factor, and reports precisely which hunks couldn't land — instead
+ * of an all-or-nothing failure.
+ *
+ * Pure + deterministic: text in, text (or rejects) out. The fs read/write lives
+ * in ../commands/apply.ts.
+ */
+export interface HunkLine {
+    /** ' ' context, '-' removal, '+' addition */
+    type: ' ' | '-' | '+';
+    content: string;
+}
+export interface Hunk {
+    oldStart: number;
+    newStart: number;
+    lines: HunkLine[];
+}
+export interface FilePatch {
+    oldPath: string;
+    newPath: string;
+    hunks: Hunk[];
+}
+/** Parse a unified diff into per-file patches. Pure. Tolerates `a/`+`b/` prefixes. */
+export declare function parsePatch(text: string): FilePatch[];
+export interface ApplyOptions {
+    /** max leading/trailing context lines to drop when the full block won't match (default 2) */
+    fuzz?: number;
+}
+export interface HunkResult {
+    hunk: Hunk;
+    applied: boolean;
+    /** 0-based line where it landed (if applied) */
+    at?: number;
+    /** how many context lines were trimmed to make it fit */
+    fuzzUsed?: number;
+}
+export interface ApplyResult {
+    ok: boolean;
+    result: string;
+    hunks: HunkResult[];
+}
+/** Apply one file's hunks to `source`. Pure. Hunks are applied top-to-bottom with offset tracking. */
+export declare function applyPatch(source: string, patch: FilePatch, opts?: ApplyOptions): ApplyResult;
+//# sourceMappingURL=apply.d.ts.map

package/v3/@swarmdo/cli/dist/src/apply/apply.js

@@ -0,0 +1,186 @@
+/**
+ * apply.ts — apply a unified diff to source text with FUZZY context matching.
+ *
+ * LLM/agent-produced diffs frequently fail `git apply`: the model's context
+ * lines drift by a few lines, or whitespace differs, and git rejects the whole
+ * patch. This applier locates each hunk by searching for its context near the
+ * declared line (not only AT it), tolerates leading/trailing context drift up
+ * to a fuzz factor, and reports precisely which hunks couldn't land — instead
+ * of an all-or-nothing failure.
+ *
+ * Pure + deterministic: text in, text (or rejects) out. The fs read/write lives
+ * in ../commands/apply.ts.
+ */
+/** Parse a unified diff into per-file patches. Pure. Tolerates `a/`+`b/` prefixes. */
+export function parsePatch(text) {
+    const files = [];
+    const lines = text.split('\n');
+    let cur = null;
+    let hunk = null;
+    const stripPrefix = (p) => p.replace(/^[ab]\//, '').replace(/\t.*$/, '').trim();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line.startsWith('diff --git')) {
+            cur = null;
+            hunk = null;
+            continue;
+        }
+        if (line.startsWith('--- ')) {
+            const old = stripPrefix(line.slice(4));
+            const next = lines[i + 1] ?? '';
+            const neu = next.startsWith('+++ ') ? stripPrefix(next.slice(4)) : old;
+            cur = { oldPath: old === '/dev/null' ? neu : old, newPath: neu === '/dev/null' ? old : neu, hunks: [] };
+            files.push(cur);
+            hunk = null;
+            i++; // consume the +++ line
+            continue;
+        }
+        if (line.startsWith('@@')) {
+            const m = line.match(/@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
+            if (m && cur) {
+                hunk = { oldStart: parseInt(m[1], 10), newStart: parseInt(m[2], 10), lines: [] };
+                cur.hunks.push(hunk);
+            }
+            continue;
+        }
+        if (hunk) {
+            if (line === '' && i === lines.length - 1)
+                continue; // trailing newline artifact
+            const t = line[0];
+            if (t === ' ' || t === '+' || t === '-') {
+                hunk.lines.push({ type: t, content: line.slice(1) });
+            }
+            else if (line === '') {
+                hunk.lines.push({ type: ' ', content: '' }); // blank context line written without the leading space
+            }
+            else if (line.startsWith('\\')) {
+                // "" — ignore
+            }
+            else {
+                hunk = null; // end of hunk block
+            }
+        }
+    }
+    return files;
+}
+/** The lines a hunk expects to find (context + removals), and produces (context + additions). */
+function hunkBlocks(hunk) {
+    const oldBlock = [];
+    const newBlock = [];
+    for (const l of hunk.lines) {
+        if (l.type === ' ') {
+            oldBlock.push(l.content);
+            newBlock.push(l.content);
+        }
+        else if (l.type === '-')
+            oldBlock.push(l.content);
+        else
+            newBlock.push(l.content);
+    }
+    return { oldBlock, newBlock };
+}
+function blockMatchesAt(source, at, block) {
+    if (at < 0 || at + block.length > source.length)
+        return false;
+    for (let i = 0; i < block.length; i++)
+        if (source[at + i] !== block[i])
+            return false;
+    return true;
+}
+/**
+ * Find where `block` occurs in `source`, preferring the position nearest
+ * `expected` (0-based). Returns -1 if not found. Deterministic: on ties the
+ * lower index wins.
+ */
+function findBlock(source, block, expected) {
+    if (block.length === 0)
+        return Math.max(0, Math.min(expected, source.length));
+    if (blockMatchesAt(source, expected, block))
+        return expected;
+    let best = -1;
+    let bestDist = Infinity;
+    for (let i = 0; i + block.length <= source.length; i++) {
+        if (!blockMatchesAt(source, i, block))
+            continue;
+        const dist = Math.abs(i - expected);
+        if (dist < bestDist) {
+            bestDist = dist;
+            best = i;
+        }
+    }
+    return best;
+}
+/** Apply one file's hunks to `source`. Pure. Hunks are applied top-to-bottom with offset tracking. */
+export function applyPatch(source, patch, opts = {}) {
+    const fuzz = opts.fuzz ?? 2;
+    const trailingNewline = source.endsWith('\n');
+    const lines = source.split('\n');
+    if (trailingNewline)
+        lines.pop(); // drop the empty element from a trailing \n
+    let offset = 0;
+    const results = [];
+    for (const hunk of patch.hunks) {
+        const { oldBlock, newBlock } = hunkBlocks(hunk);
+        const expected = hunk.oldStart - 1 + offset;
+        // Try the full block, then progressively trim up to `fuzz` context lines
+        // off each end (patch fuzz) to tolerate drift.
+        let placed = -1;
+        let usedFuzz = 0;
+        let trimLead = 0;
+        let trimTail = 0;
+        outer: for (let f = 0; f <= fuzz; f++) {
+            for (let lead = 0; lead <= f; lead++) {
+                const tail = f - lead;
+                const leadTrimmable = countLeadingContext(hunk);
+                const tailTrimmable = countTrailingContext(hunk);
+                if (lead > leadTrimmable || tail > tailTrimmable)
+                    continue;
+                const trimmed = oldBlock.slice(lead, oldBlock.length - tail);
+                const at = findBlock(lines, trimmed, expected + lead);
+                if (at >= 0) {
+                    placed = at - lead;
+                    usedFuzz = f;
+                    trimLead = lead;
+                    trimTail = tail;
+                    break outer;
+                }
+            }
+        }
+        if (placed < 0) {
+            results.push({ hunk, applied: false });
+            continue;
+        }
+        // Splice: remove oldBlock.length lines at `placed`, insert newBlock.
+        // (trimLead/trimTail only affected *matching*, not what we replace.)
+        void trimLead;
+        void trimTail;
+        lines.splice(placed, oldBlock.length, ...newBlock);
+        offset += newBlock.length - oldBlock.length;
+        results.push({ hunk, applied: true, at: placed, fuzzUsed: usedFuzz });
+    }
+    let result = lines.join('\n');
+    if (trailingNewline)
+        result += '\n';
+    return { ok: results.every((r) => r.applied), result, hunks: results };
+}
+function countLeadingContext(hunk) {
+    let n = 0;
+    for (const l of hunk.lines) {
+        if (l.type === ' ')
+            n++;
+        else
+            break;
+    }
+    return n;
+}
+function countTrailingContext(hunk) {
+    let n = 0;
+    for (let i = hunk.lines.length - 1; i >= 0; i--) {
+        if (hunk.lines[i].type === ' ')
+            n++;
+        else
+            break;
+    }
+    return n;
+}
+//# sourceMappingURL=apply.js.map

package/v3/@swarmdo/cli/dist/src/commands/apply.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `swarmdo apply` — apply a unified diff to the working tree with fuzzy context
+ * matching. The forgiving counterpart to `git apply`: when an agent's diff has
+ * drifted line numbers or a slightly-off context line, this still lands the
+ * hunks it can and reports exactly which it couldn't, instead of rejecting the
+ * whole patch.
+ *
+ *   swarmdo apply changes.patch          # apply a patch file
+ *   agent-output | swarmdo apply         # apply a patch from stdin
+ *   swarmdo apply --dry-run changes.patch # preview: what would apply/reject
+ *   swarmdo apply --fuzz 3 changes.patch  # tolerate more context drift
+ *
+ * Engine (../apply/apply.ts) is pure + tested; this reads/writes files.
+ */
+import type { Command } from '../types.js';
+export declare const applyCommand: Command;
+export default applyCommand;
+//# sourceMappingURL=apply.d.ts.map

package/v3/@swarmdo/cli/dist/src/commands/apply.js

@@ -0,0 +1,118 @@
+/**
+ * `swarmdo apply` — apply a unified diff to the working tree with fuzzy context
+ * matching. The forgiving counterpart to `git apply`: when an agent's diff has
+ * drifted line numbers or a slightly-off context line, this still lands the
+ * hunks it can and reports exactly which it couldn't, instead of rejecting the
+ * whole patch.
+ *
+ *   swarmdo apply changes.patch          # apply a patch file
+ *   agent-output | swarmdo apply         # apply a patch from stdin
+ *   swarmdo apply --dry-run changes.patch # preview: what would apply/reject
+ *   swarmdo apply --fuzz 3 changes.patch  # tolerate more context drift
+ *
+ * Engine (../apply/apply.ts) is pure + tested; this reads/writes files.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { output } from '../output.js';
+import { parsePatch, applyPatch } from '../apply/apply.js';
+function readStdin() {
+    return new Promise((resolve) => {
+        const chunks = [];
+        process.stdin.on('data', (c) => chunks.push(Buffer.from(c)));
+        process.stdin.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        process.stdin.on('error', () => resolve(Buffer.concat(chunks).toString('utf8')));
+    });
+}
+/** Resolve the file a patch targets, preferring the new path, then the old. */
+function targetFile(root, fp) {
+    return path.resolve(root, fp.newPath && fp.newPath !== '/dev/null' ? fp.newPath : fp.oldPath);
+}
+async function run(ctx) {
+    const root = ctx.cwd || process.cwd();
+    const dryRun = ctx.flags['dry-run'] === true;
+    const partial = ctx.flags.partial === true;
+    const fuzz = typeof ctx.flags.fuzz === 'string' ? parseInt(ctx.flags.fuzz, 10) : 2;
+    // Read the patch: a file arg, or stdin.
+    let patchText;
+    if (ctx.args[0]) {
+        try {
+            patchText = fs.readFileSync(path.resolve(root, ctx.args[0]), 'utf8');
+        }
+        catch {
+            output.printError(`could not read patch file ${ctx.args[0]}`);
+            return { success: false, exitCode: 1 };
+        }
+    }
+    else {
+        if (process.stdin.isTTY) {
+            output.writeln(output.error('Usage: swarmdo apply <patch-file>   OR   <patch> | swarmdo apply'));
+            return { success: false, exitCode: 1 };
+        }
+        patchText = await readStdin();
+    }
+    const patches = parsePatch(patchText);
+    if (patches.length === 0) {
+        output.printError('no file patches found — is this a unified diff?');
+        return { success: false, exitCode: 1 };
+    }
+    let totalApplied = 0;
+    let totalRejected = 0;
+    const writes = [];
+    for (const fp of patches) {
+        const file = targetFile(root, fp);
+        const rel = path.relative(root, file);
+        let source;
+        try {
+            source = fs.readFileSync(file, 'utf8');
+        }
+        catch {
+            // New-file patch (--- /dev/null): treat missing source as empty.
+            if (fp.oldPath === '/dev/null' || !fs.existsSync(file))
+                source = '';
+            else {
+                output.printError(`cannot read ${rel}`);
+                totalRejected += fp.hunks.length;
+                continue;
+            }
+        }
+        const res = applyPatch(source, fp, { fuzz });
+        const applied = res.hunks.filter((h) => h.applied).length;
+        const rejected = res.hunks.length - applied;
+        totalApplied += applied;
+        totalRejected += rejected;
+        const fuzzy = res.hunks.filter((h) => h.applied && (h.fuzzUsed ?? 0) > 0).length;
+        const tag = rejected === 0 ? output.dim('ok') : output.bold(`${rejected} rejected`);
+        output.writeln(`${rel}  ${applied}/${res.hunks.length} hunks${fuzzy ? output.dim(` (${fuzzy} fuzzy)`) : ''}  ${tag}`);
+        if (rejected === 0 || partial) {
+            if (res.result !== source)
+                writes.push({ file, content: res.result });
+        }
+    }
+    if (!dryRun) {
+        for (const w of writes)
+            fs.writeFileSync(w.file, w.content);
+    }
+    const verb = dryRun ? 'would apply' : 'applied';
+    output.writeln(output.dim(`${verb} ${totalApplied} hunks, ${totalRejected} rejected${dryRun ? ' (dry run)' : ''}`));
+    // Exit 1 if anything was rejected — a CI/agent can branch on it.
+    const code = totalRejected > 0 ? 1 : 0;
+    return { success: code === 0, exitCode: code };
+}
+export const applyCommand = {
+    name: 'apply',
+    description: 'Apply a unified diff to the working tree with fuzzy context matching — a forgiving `git apply` for agent-produced patches',
+    options: [
+        { name: 'dry-run', description: 'report what would apply/reject without writing', type: 'boolean' },
+        { name: 'fuzz', description: 'max context lines to drop when matching a drifted hunk (default 2)', type: 'string' },
+        { name: 'partial', description: 'write files even when some of their hunks are rejected', type: 'boolean' },
+    ],
+    examples: [
+        { command: 'swarmdo apply changes.patch', description: 'Apply a patch file' },
+        { command: 'cat out.diff | swarmdo apply --dry-run', description: 'Preview a patch from stdin' },
+        { command: 'swarmdo apply --fuzz 3 changes.patch', description: 'Tolerate more context drift' },
+    ],
+    action: run,
+};
+export default applyCommand;
+//# sourceMappingURL=apply.js.map

package/v3/@swarmdo/cli/dist/src/commands/compact.js

@@ -13,6 +13,7 @@
 import { spawnSync } from 'node:child_process';
 import { output } from '../output.js';
 import { compactOutput, formatSavings } from '../compact/compact.js';
+import { writeStdout } from '../util/stdout.js';
 /**
  * Read all of stdin as UTF-8. A stream read (not readFileSync(0)) — the
  * synchronous form throws EAGAIN on a non-blocking pipe on macOS/Linux.
@@ -61,7 +62,7 @@ async function run(ctx) {
         }
         const combined = (r.stdout || '') + (r.stderr || '');
         const { text, stats } = compactOutput(combined, opts);
-        process.stdout.write(text);
+        await writeStdout(text);
         if (!quiet)
             process.stderr.write(formatSavings(stats) + '\n');
         // Propagate the wrapped command's exit code verbatim.
@@ -81,7 +82,7 @@ async function run(ctx) {
     else if (!quiet) {
         process.stderr.write(formatSavings(stats) + '\n');
     }
-    process.stdout.write(text);
+    await writeStdout(text);
     return { success: true, exitCode: 0 };
 }
 export const compactCommand = {

package/v3/@swarmdo/cli/dist/src/commands/index.js

@@ -35,6 +35,12 @@ const commandLoaders = {
     // GPL/unknown licenses in the tree, fail CI on a forbidden one.
     license: () => import('./license.js'),
     licenses: () => import('./license.js'), // alias via loader key
+    // Software Bill of Materials from the lockfile (syft/cyclonedx demand) —
+    // CycloneDX/SPDX JSON; completes the env/license/sbom supply-chain trio.
+    sbom: () => import('./sbom.js'),
+    // Fuzzy unified-diff applier (agent-diff pain) — a forgiving `git apply` that
+    // lands hunks despite context drift and reports what it couldn't.
+    apply: () => import('./apply.js'),
     // Queryable exported-symbol index (codegraph demand) — where things are
     // defined without grep+read round-trips.
     codegraph: () => import('./codegraph.js'),
@@ -268,7 +274,7 @@ export async function getCommandsByCategory() {
     // three slots from 'statusline' onward (completionsCmd received the
     // statusline module, analyzeCmd received completions, …), scrambling the
     // categorized help. Every load now has a named slot.
-    const [daemonCmd, doctorCmd, embeddingsCmd, neuralCmd, performanceCmd, securityCmd, swarmvectorCmd, hiveMindCmd, configCmd, statuslineCmd, compressCmd, efficiencyCmd, completionsCmd, migrateCmd, workflowCmd, analyzeCmd, routeCmd, progressCmd, providersCmd, pluginsCmd, deploymentCmd, claimsCmd, issuesCmd, updateCmd, processCmd, guidanceCmd, applianceCmd, cleanupCmd, autopilotCmd, demoCmd, usageCmd, repairCmd, hudCmd, compactCmd, codegraphCmd, redactCmd, packCmd, envCmd, licenseCmd,] = await Promise.all([
+    const [daemonCmd, doctorCmd, embeddingsCmd, neuralCmd, performanceCmd, securityCmd, swarmvectorCmd, hiveMindCmd, configCmd, statuslineCmd, compressCmd, efficiencyCmd, completionsCmd, migrateCmd, workflowCmd, analyzeCmd, routeCmd, progressCmd, providersCmd, pluginsCmd, deploymentCmd, claimsCmd, issuesCmd, updateCmd, processCmd, guidanceCmd, applianceCmd, cleanupCmd, autopilotCmd, demoCmd, usageCmd, repairCmd, hudCmd, compactCmd, codegraphCmd, redactCmd, packCmd, envCmd, licenseCmd, sbomCmd, applyCmd,] = await Promise.all([
         loadCommand('daemon'), loadCommand('doctor'), loadCommand('embeddings'), loadCommand('neural'),
         loadCommand('performance'), loadCommand('security'), loadCommand('swarmvector'), loadCommand('hive-mind'),
         loadCommand('config'), loadCommand('statusline'), loadCommand('compress'), loadCommand('efficiency'),
@@ -276,7 +282,7 @@ export async function getCommandsByCategory() {
         loadCommand('analyze'), loadCommand('route'), loadCommand('progress'), loadCommand('providers'),
         loadCommand('plugins'), loadCommand('deployment'), loadCommand('claims'), loadCommand('issues'),
         loadCommand('update'), loadCommand('process'), loadCommand('guidance'), loadCommand('appliance'),
-        loadCommand('cleanup'), loadCommand('autopilot'), loadCommand('demo'), loadCommand('usage'), loadCommand('repair'), loadCommand('hud'), loadCommand('compact'), loadCommand('codegraph'), loadCommand('redact'), loadCommand('pack'), loadCommand('env'), loadCommand('license'),
+        loadCommand('cleanup'), loadCommand('autopilot'), loadCommand('demo'), loadCommand('usage'), loadCommand('repair'), loadCommand('hud'), loadCommand('compact'), loadCommand('codegraph'), loadCommand('redact'), loadCommand('pack'), loadCommand('env'), loadCommand('license'), loadCommand('sbom'), loadCommand('apply'),
     ]);
     return {
         primary: [
@@ -292,7 +298,7 @@ export async function getCommandsByCategory() {
         utility: [
             configCmd, doctorCmd, daemonCmd, completionsCmd,
             migrateCmd, workflowCmd, demoCmd,
-            statuslineCmd, compressCmd, compactCmd, redactCmd, packCmd, envCmd, licenseCmd, efficiencyCmd,
+            statuslineCmd, compressCmd, compactCmd, redactCmd, packCmd, envCmd, licenseCmd, sbomCmd, applyCmd, efficiencyCmd,
         ].filter(Boolean),
         analysis: [
             analyzeCmd, routeCmd, progressCmd, usageCmd, hudCmd, codegraphCmd,

package/v3/@swarmdo/cli/dist/src/commands/pack.js

@@ -17,6 +17,7 @@ import * as path from 'node:path';
 import { output } from '../output.js';
 import { packFiles, makeIgnoreMatcher } from '../pack/pack.js';
 import { redactText } from '../redact/redact.js';
+import { writeStdout } from '../util/stdout.js';
 const SKIP_DIRS = new Set([
     'node_modules', '.git', '.swarm', 'dist', 'dist-standalone', 'build',
     'coverage', '.next', '.turbo', 'out', 'vendor', '.cache',
@@ -151,8 +152,7 @@ async function run(ctx) {
         output.printSuccess(`packed ${stats.files} files (~${stats.tokens} tokens) → ${outFile}`);
     }
     else {
-        process.stdout.write(bundle);
-        if (!process.stdout.isTTY) { /* piped: keep stdout clean */ }
+        await writeStdout(bundle);
         process.stderr.write(output.dim(`packed ${stats.files} files (~${stats.tokens} tokens)\n`));
     }
     return { success: true, exitCode: 0 };

package/v3/@swarmdo/cli/dist/src/commands/redact.js

@@ -15,6 +15,7 @@
 import { spawnSync } from 'node:child_process';
 import { output } from '../output.js';
 import { redactText, scanText, formatFindingsSummary } from '../redact/redact.js';
+import { writeStdout } from '../util/stdout.js';
 function readStdin() {
     return new Promise((resolve) => {
         const chunks = [];
@@ -93,7 +94,7 @@ async function run(ctx) {
     }
     // Redact mode: rewrite and emit.
     const { output: redacted, findings } = redactText(input, opts);
-    process.stdout.write(redacted);
+    await writeStdout(redacted);
     if (asJson) {
         process.stderr.write(JSON.stringify({ count: findings.length, findings }, null, 2) + '\n');
     }

package/v3/@swarmdo/cli/dist/src/commands/sbom.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `swarmdo sbom` — emit a Software Bill of Materials from the npm lockfile.
+ *
+ *   swarmdo sbom                       # CycloneDX JSON → stdout
+ *   swarmdo sbom -f spdx -o sbom.json  # SPDX 2.3 JSON → file
+ *   swarmdo sbom --production          # exclude dev-only dependencies
+ *
+ * Completes the supply-chain trio (env / license / sbom). Engine
+ * (../sbom/sbom.ts) is pure + tested; this reads package-lock.json.
+ */
+import type { Command } from '../types.js';
+export declare const sbomCommand: Command;
+export default sbomCommand;
+//# sourceMappingURL=sbom.d.ts.map

package/v3/@swarmdo/cli/dist/src/commands/sbom.js

@@ -0,0 +1,73 @@
+/**
+ * `swarmdo sbom` — emit a Software Bill of Materials from the npm lockfile.
+ *
+ *   swarmdo sbom                       # CycloneDX JSON → stdout
+ *   swarmdo sbom -f spdx -o sbom.json  # SPDX 2.3 JSON → file
+ *   swarmdo sbom --production          # exclude dev-only dependencies
+ *
+ * Completes the supply-chain trio (env / license / sbom). Engine
+ * (../sbom/sbom.ts) is pure + tested; this reads package-lock.json.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { output } from '../output.js';
+import { componentsFromNpmLock, buildSbom } from '../sbom/sbom.js';
+import { writeStdout } from '../util/stdout.js';
+async function run(ctx) {
+    const repoRoot = ctx.cwd || process.cwd();
+    const lockPath = path.resolve(repoRoot, ctx.args[0] ?? (typeof ctx.flags.lockfile === 'string' ? ctx.flags.lockfile : 'package-lock.json'));
+    let lock;
+    try {
+        lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+    }
+    catch {
+        output.printError(`could not read a JSON lockfile at ${path.relative(repoRoot, lockPath) || lockPath} (npm package-lock.json; pnpm/yaml unsupported)`);
+        return { success: false, exitCode: 1 };
+    }
+    if (!lock.packages) {
+        output.printError('lockfile has no `packages` map — needs npm lockfileVersion 2 or 3');
+        return { success: false, exitCode: 1 };
+    }
+    // NB: use --spec, not --format — the global --format flag is choices-validated
+    // to text|json|table and rejects 'spdx'/'cyclonedx' before this command runs.
+    const raw = typeof ctx.flags.spec === 'string' ? ctx.flags.spec : 'cyclonedx';
+    if (raw !== 'cyclonedx' && raw !== 'spdx') {
+        output.printError(`unknown --spec '${raw}' (use cyclonedx|spdx)`);
+        return { success: false, exitCode: 1 };
+    }
+    const format = raw;
+    const components = componentsFromNpmLock(lock, {
+        productionOnly: ctx.flags.production === true,
+    });
+    // Prefer the lockfile's own project name/version; fall back to the repo dir.
+    const meta = { name: lock.name ?? path.basename(repoRoot), version: lock.version ?? '0.0.0' };
+    const bom = buildSbom(components, meta, format);
+    const serialized = JSON.stringify(bom, null, 2);
+    const outFile = (typeof ctx.flags.output === 'string' && ctx.flags.output) || (typeof ctx.flags.o === 'string' && ctx.flags.o);
+    if (outFile) {
+        fs.writeFileSync(path.resolve(repoRoot, outFile), serialized + '\n');
+        output.printSuccess(`${format} SBOM: ${components.length} components → ${outFile}`);
+    }
+    else {
+        await writeStdout(serialized + '\n');
+        process.stderr.write(output.dim(`${format} SBOM: ${components.length} components\n`));
+    }
+    return { success: true, exitCode: 0 };
+}
+export const sbomCommand = {
+    name: 'sbom',
+    description: 'Generate a Software Bill of Materials (CycloneDX or SPDX JSON) from the npm lockfile',
+    options: [
+        { name: 'spec', description: 'BOM spec: cyclonedx (default) or spdx', type: 'string' },
+        { name: 'output', short: 'o', description: 'write the SBOM to a file instead of stdout', type: 'string' },
+        { name: 'lockfile', description: 'path to the lockfile (default package-lock.json)', type: 'string' },
+        { name: 'production', description: 'exclude dev-only dependencies', type: 'boolean' },
+    ],
+    examples: [
+        { command: 'swarmdo sbom -o sbom.json', description: 'Write a CycloneDX SBOM' },
+        { command: 'swarmdo sbom --spec spdx --production', description: 'SPDX SBOM, production deps only' },
+    ],
+    action: run,
+};
+export default sbomCommand;
+//# sourceMappingURL=sbom.js.map

package/v3/@swarmdo/cli/dist/src/mcp-client.js

@@ -23,6 +23,7 @@ import { codegraphTools } from './mcp-tools/codegraph-tools.js';
 import { redactTools } from './mcp-tools/redact-tools.js';
 import { envTools } from './mcp-tools/env-tools.js';
 import { licenseTools } from './mcp-tools/license-tools.js';
+import { applyTools } from './mcp-tools/apply-tools.js';
 import { progressTools } from './mcp-tools/progress-tools.js';
 import { embeddingsTools } from './mcp-tools/embeddings-tools.js';
 import { claimsTools } from './mcp-tools/claims-tools.js';
@@ -110,6 +111,7 @@ const TOOL_GROUPS = {
     redact: () => redactTools,
     env: () => envTools,
     license: () => licenseTools,
+    apply: () => applyTools,
     progress: () => progressTools,
     embeddings: () => embeddingsTools,
     claims: () => claimsTools,

package/v3/@swarmdo/cli/dist/src/mcp-tools/apply-tools.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Apply MCP Tool
+ *
+ * Let an agent apply its own unified diff to a piece of source with fuzzy
+ * context matching — landing hunks even when line numbers drift — and get back
+ * the patched text plus exactly which hunks were rejected. String-in/string-out
+ * and deterministic; shares the pure engine in ../apply/apply.ts with the CLI.
+ */
+import type { MCPTool } from './types.js';
+export declare const applyTools: MCPTool[];
+//# sourceMappingURL=apply-tools.d.ts.map

package/v3/@swarmdo/cli/dist/src/mcp-tools/apply-tools.js

@@ -0,0 +1,44 @@
+/**
+ * Apply MCP Tool
+ *
+ * Let an agent apply its own unified diff to a piece of source with fuzzy
+ * context matching — landing hunks even when line numbers drift — and get back
+ * the patched text plus exactly which hunks were rejected. String-in/string-out
+ * and deterministic; shares the pure engine in ../apply/apply.ts with the CLI.
+ */
+import { parsePatch, applyPatch } from '../apply/apply.js';
+const applyPatchTool = {
+    name: 'apply_patch',
+    description: 'Apply a unified diff to a source string with fuzzy context matching (a forgiving `git apply`). Returns the patched text and per-hunk results — use this when a diff you produced might have drifted line numbers or slightly-off context, instead of hand-editing. Deterministic; pass the file content and the diff for a single file.',
+    category: 'apply',
+    tags: ['patch', 'diff', 'apply', 'edit'],
+    inputSchema: {
+        type: 'object',
+        properties: {
+            source: { type: 'string', description: 'the current file content the diff applies to' },
+            patch: { type: 'string', description: 'a unified diff (one file); a/ b/ prefixes are tolerated' },
+            fuzz: { type: 'number', description: 'max context lines to drop when matching a drifted hunk (default 2)', default: 2 },
+        },
+        required: ['source', 'patch'],
+    },
+    handler: async (params) => {
+        if (typeof params.source !== 'string')
+            return { error: true, message: 'source (string) is required' };
+        if (typeof params.patch !== 'string')
+            return { error: true, message: 'patch (string) is required' };
+        const patches = parsePatch(params.patch);
+        if (patches.length === 0)
+            return { error: true, message: 'no file patch found — is this a unified diff?' };
+        const fuzz = typeof params.fuzz === 'number' ? params.fuzz : 2;
+        const res = applyPatch(params.source, patches[0], { fuzz });
+        return {
+            ok: res.ok,
+            result: res.result,
+            applied: res.hunks.filter((h) => h.applied).length,
+            rejected: res.hunks.filter((h) => !h.applied).length,
+            hunks: res.hunks.map((h) => ({ applied: h.applied, at: h.at, fuzzUsed: h.fuzzUsed, oldStart: h.hunk.oldStart })),
+        };
+    },
+};
+export const applyTools = [applyPatchTool];
+//# sourceMappingURL=apply-tools.js.map

package/v3/@swarmdo/cli/dist/src/mcp-tools/index.d.ts

@@ -19,6 +19,7 @@ export { codegraphTools } from './codegraph-tools.js';
 export { redactTools } from './redact-tools.js';
 export { envTools } from './env-tools.js';
 export { licenseTools } from './license-tools.js';
+export { applyTools } from './apply-tools.js';
 export { progressTools } from './progress-tools.js';
 export { transferTools } from './transfer-tools.js';
 export { securityTools } from './security-tools.js';

package/v3/@swarmdo/cli/dist/src/mcp-tools/index.js

@@ -18,6 +18,7 @@ export { codegraphTools } from './codegraph-tools.js';
 export { redactTools } from './redact-tools.js';
 export { envTools } from './env-tools.js';
 export { licenseTools } from './license-tools.js';
+export { applyTools } from './apply-tools.js';
 export { progressTools } from './progress-tools.js';
 export { transferTools } from './transfer-tools.js';
 export { securityTools } from './security-tools.js';

package/v3/@swarmdo/cli/dist/src/mcp-tools/profiles.js

@@ -25,6 +25,7 @@ const LEAN_GROUPS = [
     'codegraph', // codegraph_query / file / index — "where is X defined?"
     'redact', // redact_text / redact_scan — secret guard on the data path
     'env', // env_check — env-var drift (missing/unused/undocumented)
+    'apply', // apply_patch — fuzzy unified-diff applier for agent edits
 ];
 /** Balanced = lean + orchestration/session/system the average user reaches for. */
 const BALANCED_EXTRA = [

package/v3/@swarmdo/cli/dist/src/sbom/sbom.d.ts

@@ -0,0 +1,64 @@
+/**
+ * sbom.ts — generate a Software Bill of Materials from an npm lockfile.
+ *
+ * Completes the supply-chain trio with `env` (config drift) and `license`
+ * (license policy): `sbom` emits the standardized dependency manifest —
+ * CycloneDX or SPDX JSON — that compliance, vuln scanners, and regulators
+ * (US EO 14028, EU CRA) consume. Distinct from `pack` (repo→AI-context prose)
+ * and `license` (policy gate): this is a machine artifact, not a check.
+ *
+ * Pure + deterministic (lockfile object → BOM object, no timestamps/IO), so
+ * output is golden-testable. The file read lives in ../commands/sbom.ts.
+ */
+export interface Component {
+    name: string;
+    version: string;
+    purl: string;
+    license?: string;
+    /** hex-encoded integrity, with its algorithm */
+    hash?: {
+        alg: string;
+        content: string;
+    };
+    dev?: boolean;
+}
+interface NpmLockEntry {
+    version?: string;
+    resolved?: string;
+    integrity?: string;
+    license?: unknown;
+    dev?: boolean;
+    optional?: boolean;
+}
+interface NpmLock {
+    name?: string;
+    version?: string;
+    lockfileVersion?: number;
+    packages?: Record<string, NpmLockEntry>;
+}
+/** Package URL for an npm component. Scope `@` is percent-encoded per the purl spec. */
+export declare function purlFor(name: string, version: string): string;
+/** Convert an SRI integrity string (`sha512-<base64>`) to `{alg, content(hex)}`. Deterministic. */
+export declare function integrityToHash(integrity: string): {
+    alg: string;
+    content: string;
+} | undefined;
+export interface ComponentOptions {
+    /** exclude dev-only dependencies */
+    productionOnly?: boolean;
+}
+/** Extract components from a parsed npm lockfile (v2/v3 `packages` map). Pure. */
+export declare function componentsFromNpmLock(lock: NpmLock, opts?: ComponentOptions): Component[];
+export interface BomMeta {
+    name: string;
+    version: string;
+}
+/** Build a CycloneDX 1.5 BOM object (no timestamp → deterministic). Pure. */
+export declare function buildCycloneDX(components: Component[], meta: BomMeta): Record<string, unknown>;
+/** Build a minimal SPDX 2.3 JSON document (no created timestamp → deterministic). Pure. */
+export declare function buildSpdx(components: Component[], meta: BomMeta): Record<string, unknown>;
+export type SbomFormat = 'cyclonedx' | 'spdx';
+/** Build a BOM in the requested format. Pure. */
+export declare function buildSbom(components: Component[], meta: BomMeta, format: SbomFormat): Record<string, unknown>;
+export {};
+//# sourceMappingURL=sbom.d.ts.map

package/v3/@swarmdo/cli/dist/src/sbom/sbom.js

@@ -0,0 +1,130 @@
+/**
+ * sbom.ts — generate a Software Bill of Materials from an npm lockfile.
+ *
+ * Completes the supply-chain trio with `env` (config drift) and `license`
+ * (license policy): `sbom` emits the standardized dependency manifest —
+ * CycloneDX or SPDX JSON — that compliance, vuln scanners, and regulators
+ * (US EO 14028, EU CRA) consume. Distinct from `pack` (repo→AI-context prose)
+ * and `license` (policy gate): this is a machine artifact, not a check.
+ *
+ * Pure + deterministic (lockfile object → BOM object, no timestamps/IO), so
+ * output is golden-testable. The file read lives in ../commands/sbom.ts.
+ */
+/** Derive the package name from a lockfile `packages` key (last node_modules segment, scope-aware). */
+function nameFromKey(key) {
+    const idx = key.lastIndexOf('node_modules/');
+    const tail = idx >= 0 ? key.slice(idx + 'node_modules/'.length) : key;
+    return tail; // already includes @scope/name because we split on the LAST node_modules/
+}
+/** Package URL for an npm component. Scope `@` is percent-encoded per the purl spec. */
+export function purlFor(name, version) {
+    const enc = name.startsWith('@') ? '%40' + name.slice(1) : name;
+    return `pkg:npm/${enc}@${version}`;
+}
+/** Convert an SRI integrity string (`sha512-<base64>`) to `{alg, content(hex)}`. Deterministic. */
+export function integrityToHash(integrity) {
+    const m = integrity.match(/^(sha\d+)-(.+)$/);
+    if (!m)
+        return undefined;
+    const algMap = { sha1: 'SHA-1', sha256: 'SHA-256', sha384: 'SHA-384', sha512: 'SHA-512' };
+    const alg = algMap[m[1]];
+    if (!alg)
+        return undefined;
+    let hex;
+    try {
+        // base64 → hex, dependency-free and deterministic
+        hex = Buffer.from(m[2], 'base64').toString('hex');
+    }
+    catch {
+        return undefined;
+    }
+    return { alg, content: hex };
+}
+function licenseOf(entry) {
+    const l = entry.license;
+    if (typeof l === 'string' && l.trim())
+        return l.trim();
+    if (l && typeof l === 'object' && typeof l.type === 'string')
+        return l.type;
+    return undefined;
+}
+/** Extract components from a parsed npm lockfile (v2/v3 `packages` map). Pure. */
+export function componentsFromNpmLock(lock, opts = {}) {
+    const packages = lock.packages ?? {};
+    const out = [];
+    const seen = new Set();
+    for (const [key, entry] of Object.entries(packages)) {
+        if (!key)
+            continue; // the root project entry
+        if (!key.includes('node_modules/'))
+            continue;
+        if (opts.productionOnly && entry.dev)
+            continue;
+        const name = nameFromKey(key);
+        const version = entry.version ?? '0.0.0';
+        const id = `${name}@${version}`;
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        const comp = { name, version, purl: purlFor(name, version) };
+        const license = licenseOf(entry);
+        if (license)
+            comp.license = license;
+        if (entry.integrity) {
+            const h = integrityToHash(entry.integrity);
+            if (h)
+                comp.hash = h;
+        }
+        if (entry.dev)
+            comp.dev = true;
+        out.push(comp);
+    }
+    out.sort((a, b) => (a.name === b.name ? a.version.localeCompare(b.version) : a.name.localeCompare(b.name)));
+    return out;
+}
+/** Build a CycloneDX 1.5 BOM object (no timestamp → deterministic). Pure. */
+export function buildCycloneDX(components, meta) {
+    return {
+        bomFormat: 'CycloneDX',
+        specVersion: '1.5',
+        version: 1,
+        metadata: {
+            component: { type: 'application', name: meta.name, version: meta.version },
+        },
+        components: components.map((c) => {
+            const comp = { type: 'library', name: c.name, version: c.version, purl: c.purl };
+            if (c.hash)
+                comp.hashes = [{ alg: c.hash.alg, content: c.hash.content }];
+            if (c.license)
+                comp.licenses = [{ license: { id: c.license } }];
+            return comp;
+        }),
+    };
+}
+/** Build a minimal SPDX 2.3 JSON document (no created timestamp → deterministic). Pure. */
+export function buildSpdx(components, meta) {
+    const safe = (s) => s.replace(/[^A-Za-z0-9.-]/g, '-');
+    return {
+        spdxVersion: 'SPDX-2.3',
+        dataLicense: 'CC0-1.0',
+        SPDXID: 'SPDXRef-DOCUMENT',
+        name: meta.name,
+        documentNamespace: `https://swarmdo/spdx/${safe(meta.name)}-${meta.version}`,
+        packages: [
+            { SPDXID: 'SPDXRef-Package-root', name: meta.name, versionInfo: meta.version, downloadLocation: 'NOASSERTION' },
+            ...components.map((c) => ({
+                SPDXID: `SPDXRef-Package-${safe(c.name)}-${safe(c.version)}`,
+                name: c.name,
+                versionInfo: c.version,
+                downloadLocation: 'NOASSERTION',
+                licenseConcluded: c.license ?? 'NOASSERTION',
+                externalRefs: [{ referenceCategory: 'PACKAGE-MANAGER', referenceType: 'purl', referenceLocator: c.purl }],
+            })),
+        ],
+    };
+}
+/** Build a BOM in the requested format. Pure. */
+export function buildSbom(components, meta, format) {
+    return format === 'spdx' ? buildSpdx(components, meta) : buildCycloneDX(components, meta);
+}
+//# sourceMappingURL=sbom.js.map

package/v3/@swarmdo/cli/dist/src/util/stdout.d.ts

@@ -0,0 +1,12 @@
+/**
+ * writeStdout — write to stdout and RESOLVE ONLY WHEN THE CHUNK IS FLUSHED.
+ *
+ * process.stdout on a pipe is asynchronous: write() buffers in JS and returns
+ * immediately. If the command then returns and the CLI harness calls
+ * process.exit(), any unflushed bytes are discarded — large piped output
+ * (`swarmdo sbom | …`, `pack`, `compact`, `redact`) truncates at the ~64 KiB
+ * pipe buffer. Awaiting the write callback guarantees the data reached the OS
+ * before we hand control back. For a TTY (synchronous) this is a no-op await.
+ */
+export declare function writeStdout(data: string): Promise<void>;
+//# sourceMappingURL=stdout.d.ts.map

package/v3/@swarmdo/cli/dist/src/util/stdout.js

@@ -0,0 +1,16 @@
+/**
+ * writeStdout — write to stdout and RESOLVE ONLY WHEN THE CHUNK IS FLUSHED.
+ *
+ * process.stdout on a pipe is asynchronous: write() buffers in JS and returns
+ * immediately. If the command then returns and the CLI harness calls
+ * process.exit(), any unflushed bytes are discarded — large piped output
+ * (`swarmdo sbom | …`, `pack`, `compact`, `redact`) truncates at the ~64 KiB
+ * pipe buffer. Awaiting the write callback guarantees the data reached the OS
+ * before we hand control back. For a TTY (synchronous) this is a no-op await.
+ */
+export function writeStdout(data) {
+    return new Promise((resolve, reject) => {
+        process.stdout.write(data, (err) => (err ? reject(err) : resolve()));
+    });
+}
+//# sourceMappingURL=stdout.js.map

package/v3/@swarmdo/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmdo/cli",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "type": "module",
   "description": "Swarmdo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",