swarmdo 1.18.0 → 1.27.0

package/v3/@swarmdo/cli/dist/src/pack/pack.js

@@ -80,7 +80,15 @@ function renderMarkdown(files, opts) {
     return parts.join('\n');
 }
 function escapeXml(s) {
-    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+    // All five predefined XML entities — the quote escapes matter because this
+    // value is also interpolated into a double-quoted `path="…"` attribute, where
+    // an unescaped `"` in a file path would break out of the attribute.
+    return s
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
 }
 function renderXml(files, opts) {
     const parts = ['<repository>'];
@@ -138,11 +146,42 @@ export function packFiles(input, opts = {}) {
         },
     };
 }
+/**
+ * Convert a .gitignore glob body to a regex source (no anchors). Handles a
+ * double-star with correct gitignore(5) depth semantics: a double-star path
+ * segment matches zero or more directories (so `a/[star][star]/b` matches
+ * `a/b`, `a/x/b`, `a/x/y/b`); a leading one matches in any directory; a
+ * trailing one matches everything below. Single `*`/`?` stay within one path
+ * segment; other consecutive asterisks degrade to regular stars, per the spec.
+ * Pure.
+ */
+function globToRegExp(body) {
+    const esc = (s) => s.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]');
+    const parts = body.split('/');
+    let re = '';
+    for (let i = 0; i < parts.length; i++) {
+        const last = i === parts.length - 1;
+        if (parts[i] === '**') {
+            if (last) {
+                re += '.*';
+            } // trailing /** — everything below
+            else {
+                re += '(?:[^/]*/)*';
+                continue;
+            } // absorbs the following slash → zero-or-more dirs
+        }
+        else {
+            re += esc(parts[i]);
+        }
+        if (!last)
+            re += '/';
+    }
+    return re;
+}
 /**
  * Minimal .gitignore-style matcher. Handles the common cases — plain names,
- * `dir/`, `*.ext` globs, leading `/` anchors, and `!` negation — not the full
- * spec (no `**` depth semantics beyond substring, no nested ignore files).
- * Good enough to keep obvious noise out; full semantics is a follow-up.
+ * `dir/`, `*.ext` globs, `**` depth globs (gitignore(5) semantics), leading `/`
+ * anchors, and `!` negation. Not the full spec (no nested ignore files).
  */
 export function makeIgnoreMatcher(patterns) {
     const rules = patterns
@@ -157,22 +196,39 @@ export function makeIgnoreMatcher(patterns) {
         const anchored = body.startsWith('/');
         if (anchored)
             body = body.slice(1);
-        const re = new RegExp('^' +
-            body
-                .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-                .replace(/\*/g, '[^/]*')
-                .replace(/\?/g, '[^/]') +
-            (dirOnly ? '(/|$)' : '($|/)'));
+        const re = new RegExp('^' + globToRegExp(body) + (dirOnly ? '(/|$)' : '($|/)'));
         return { negate, anchored, re };
     });
-    return (relPath) => {
+    // Ignored status of a single path (last-match-wins over the ordered rules).
+    const ruleVerdict = (path) => {
         let ignored = false;
         for (const r of rules) {
-            const candidates = r.anchored ? [relPath] : [relPath, ...relPath.split('/').map((_, i, a) => a.slice(i).join('/'))];
+            const candidates = r.anchored ? [path] : [path, ...path.split('/').map((_, i, a) => a.slice(i).join('/'))];
             if (candidates.some((c) => r.re.test(c)))
                 ignored = !r.negate;
         }
         return ignored;
     };
+    return (relPath) => {
+        // Walk ancestor dirs top-down: once a parent directory is excluded, the file
+        // stays excluded — a negation cannot re-include under an excluded parent
+        // (gitignore(5): "not possible to re-include a file if a parent directory of
+        // that file is excluded").
+        const parts = relPath.split('/').filter(Boolean);
+        let parentIgnored = false;
+        for (let i = 0; i < parts.length; i++) {
+            const isLast = i === parts.length - 1;
+            if (parentIgnored) {
+                if (isLast)
+                    return true;
+                continue; // excluded ancestor carries down
+            }
+            const verdict = ruleVerdict(parts.slice(0, i + 1).join('/'));
+            if (isLast)
+                return verdict;
+            parentIgnored = verdict; // this directory prefix carries forward
+        }
+        return false;
+    };
 }
 //# sourceMappingURL=pack.js.map

package/v3/@swarmdo/cli/dist/src/redact/redact.js

@@ -26,6 +26,7 @@ export const RULES = [
     { id: 'anthropic-key', description: 'Anthropic API key', regex: /\bsk-ant-[0-9A-Za-z-]{16,}\b/g },
     { id: 'openai-key', description: 'OpenAI API key', regex: /\bsk-(?:proj-)?[0-9A-Za-z]{20,}\b/g },
     { id: 'google-api-key', description: 'Google API key', regex: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    { id: 'google-oauth-token', description: 'Google OAuth access token', regex: /\bya29\.[0-9A-Za-z_-]{20,}/g },
     { id: 'slack-token', description: 'Slack token', regex: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g },
     { id: 'slack-webhook', description: 'Slack incoming webhook', regex: /https:\/\/hooks\.slack\.com\/services\/T[0-9A-Za-z_]+\/B[0-9A-Za-z_]+\/[0-9A-Za-z_]+/g },
     { id: 'stripe-key', description: 'Stripe secret/restricted key', regex: /\b(?:sk|rk)_live_[0-9A-Za-z]{24,}\b/g },
@@ -33,9 +34,20 @@ export const RULES = [
     { id: 'twilio-key', description: 'Twilio API key SID', regex: /\bSK[0-9a-fA-F]{32}\b/g },
     { id: 'npm-token', description: 'npm access token', regex: /\bnpm_[0-9A-Za-z]{36}\b/g },
     { id: 'jwt', description: 'JSON Web Token', regex: /\beyJ[0-9A-Za-z_-]{10,}\.eyJ[0-9A-Za-z_-]{10,}\.[0-9A-Za-z_-]{10,}\b/g },
+    // RFC 6750 Bearer credential. Last (most generic): specific token rules above
+    // claim their range first. 16+ b64token chars keeps prose ("Bearer document")
+    // from matching; only the token (group 1) is masked, not the `Bearer ` prefix.
+    { id: 'bearer-token', description: 'HTTP Bearer token (RFC 6750)', regex: /\bBearer\s+([A-Za-z0-9\-._~+/]{16,}=*)/g, group: 1 },
 ];
-/** Keyword-prefixed assignment, e.g. `api_key = "..."` — the value is group 1. */
-const ASSIGNMENT_RE = /(?:pass(?:word|wd)?|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|auth[_-]?token|client[_-]?secret)["']?\s*[:=]\s*["']?([^\s"'`,;]{8,})/gi;
+/**
+ * Keyword-prefixed assignment, e.g. `api_key = "..."` — the value is group 1.
+ * Keyword set mirrors gitleaks' reference `generic-api-key` rule (adds bare
+ * `key`, `credential`, `creds` so `PRIVATE_KEY=`/`ENCRYPTION_KEY=`/`DB_CREDENTIAL=`
+ * secrets reach the entropy check). The `[:=]` immediately after the keyword
+ * anchors it, so `keyboard=`/`monkey_val=` don't match; the entropy + length
+ * gates keep low-entropy values (paths, short flags) from being flagged.
+ */
+const ASSIGNMENT_RE = /(?:pass(?:word|wd)?|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|auth[_-]?token|client[_-]?secret|credential|creds|key)["']?\s*[:=]\s*["']?([^\s"'`,;]{8,})/gi;
 /** Shannon entropy in bits/char. Pure; used by the assignment fallback. */
 export function shannonEntropy(s) {
     if (!s)

package/v3/@swarmdo/cli/dist/src/sbom/sbom.d.ts

@@ -21,6 +21,7 @@ export interface Component {
         content: string;
     };
     dev?: boolean;
+    optional?: boolean;
 }
 interface NpmLockEntry {
     version?: string;
@@ -53,6 +54,21 @@ export interface BomMeta {
     name: string;
     version: string;
 }
+/**
+ * Is this npm `license` string an SPDX *expression* (compound), rather than a
+ * single license identifier? npm permits expressions like `(MIT OR Apache-2.0)`
+ * or `Apache-2.0 WITH LLVM-exception` for dual/multi-licensed packages. SPDX
+ * operators are uppercase and space-delimited, so a single ID (`MIT`,
+ * `BSD-3-Clause`, `CC-BY-SA-4.0`) never matches. Pure.
+ */
+export declare function isSpdxExpression(license: string): boolean;
+/**
+ * A CycloneDX `licenses[]` entry for a license string. CycloneDX requires
+ * `license.id` to be a single valid SPDX identifier, so an expression must use
+ * the sibling `expression` field instead — otherwise strict validators and
+ * scanners (Dependency-Track, Grype) reject or mis-parse the component. Pure.
+ */
+export declare function cdxLicenseEntry(license: string): Record<string, unknown>;
 /** Build a CycloneDX 1.5 BOM object (no timestamp → deterministic). Pure. */
 export declare function buildCycloneDX(components: Component[], meta: BomMeta): Record<string, unknown>;
 /** Build a minimal SPDX 2.3 JSON document (no created timestamp → deterministic). Pure. */

package/v3/@swarmdo/cli/dist/src/sbom/sbom.js

@@ -77,11 +77,32 @@ export function componentsFromNpmLock(lock, opts = {}) {
         }
         if (entry.dev)
             comp.dev = true;
+        if (entry.optional)
+            comp.optional = true;
         out.push(comp);
     }
     out.sort((a, b) => (a.name === b.name ? a.version.localeCompare(b.version) : a.name.localeCompare(b.name)));
     return out;
 }
+/**
+ * Is this npm `license` string an SPDX *expression* (compound), rather than a
+ * single license identifier? npm permits expressions like `(MIT OR Apache-2.0)`
+ * or `Apache-2.0 WITH LLVM-exception` for dual/multi-licensed packages. SPDX
+ * operators are uppercase and space-delimited, so a single ID (`MIT`,
+ * `BSD-3-Clause`, `CC-BY-SA-4.0`) never matches. Pure.
+ */
+export function isSpdxExpression(license) {
+    return / (OR|AND|WITH) /.test(license) || license.includes('(');
+}
+/**
+ * A CycloneDX `licenses[]` entry for a license string. CycloneDX requires
+ * `license.id` to be a single valid SPDX identifier, so an expression must use
+ * the sibling `expression` field instead — otherwise strict validators and
+ * scanners (Dependency-Track, Grype) reject or mis-parse the component. Pure.
+ */
+export function cdxLicenseEntry(license) {
+    return isSpdxExpression(license) ? { expression: license } : { license: { id: license } };
+}
 /** Build a CycloneDX 1.5 BOM object (no timestamp → deterministic). Pure. */
 export function buildCycloneDX(components, meta) {
     return {
@@ -93,10 +114,16 @@ export function buildCycloneDX(components, meta) {
         },
         components: components.map((c) => {
             const comp = { type: 'library', name: c.name, version: c.version, purl: c.purl };
+            // CycloneDX 1.5 `scope`: dev-only deps are `excluded` (not shipped),
+            // optional deps are `optional`; a required runtime dep omits it (implicit
+            // `required`), keeping the common case clean. dev wins over optional.
+            const scope = c.dev ? 'excluded' : c.optional ? 'optional' : undefined;
+            if (scope)
+                comp.scope = scope;
             if (c.hash)
                 comp.hashes = [{ alg: c.hash.alg, content: c.hash.content }];
             if (c.license)
-                comp.licenses = [{ license: { id: c.license } }];
+                comp.licenses = [cdxLicenseEntry(c.license)];
             return comp;
         }),
     };

package/v3/@swarmdo/cli/dist/src/testreport/testreport.d.ts

@@ -0,0 +1,65 @@
+/**
+ * testreport.ts — parse JUnit-XML / TAP test results into a compact failure
+ * digest. The missing front-half of the test→fix loop: an agent runs the suite,
+ * points this at the results, and gets exactly the failing test names + file:line
+ * + assertion message — instead of re-reading hundreds of log lines — then feeds
+ * that into `repair`. Inspired by dorny/test-reporter, action-junit-report,
+ * gotestsum.
+ *
+ * Pure + deterministic: a results string in, a normalized summary out. The file
+ * read / glob lives in ../commands/testreport.ts, so this is fixture-testable.
+ * No XML dependency — well-formed JUnit escapes <>& in attribute values, so a
+ * focused tokenizer over <testcase>/<failure> is safe.
+ */
+export type TestStatus = 'passed' | 'failed' | 'skipped';
+export type TestFormat = 'junit' | 'tap';
+export interface TestFailure {
+    suite: string;
+    name: string;
+    file?: string;
+    line?: number;
+    message?: string;
+    type?: string;
+}
+export interface TestSummary {
+    passed: number;
+    failed: number;
+    skipped: number;
+    total: number;
+    durationMs: number;
+    failures: TestFailure[];
+    /**
+     * TAP `# TODO` tests — "not expected to succeed" per the TAP spec, so a
+     * `not ok … # TODO` is a KNOWN-incomplete stub, counted here as a success,
+     * never a failure. Absent (0) for JUnit and TODO-free TAP.
+     */
+    todo?: number;
+    /**
+     * True if a TAP `Bail out!` line aborted the run. The counts are then
+     * INCOMPLETE — the suite stopped early, so a "0 failed" here does NOT mean
+     * the suite passed. Callers/CI must treat this as a failure.
+     */
+    bailedOut?: boolean;
+    /** Optional reason text following `Bail out!`. */
+    bailReason?: string;
+}
+/** Pull a `file:line` out of a stack-trace / assertion message. Pure. */
+export declare function extractFileLine(text: string): {
+    file?: string;
+    line?: number;
+};
+/** Parse JUnit XML (testsuites/testsuite/testcase). Pure. */
+export declare function parseJUnit(xml: string): TestSummary;
+/** Parse TAP (Test Anything Protocol) output. Pure. */
+export declare function parseTAP(text: string): TestSummary;
+/** Sniff the format from a path extension, then content. Pure. */
+export declare function detectFormat(content: string, path?: string): TestFormat;
+/** Parse by explicit or detected format. Pure. */
+export declare function parseTestReport(content: string, format: TestFormat): TestSummary;
+/** Merge several summaries (multi-file globs). Pure. */
+export declare function mergeSummaries(list: TestSummary[]): TestSummary;
+/** Human-readable digest. Pure. */
+export declare function formatSummary(s: TestSummary, opts?: {
+    top?: number;
+}): string;
+//# sourceMappingURL=testreport.d.ts.map

package/v3/@swarmdo/cli/dist/src/testreport/testreport.js

@@ -0,0 +1,246 @@
+/**
+ * testreport.ts — parse JUnit-XML / TAP test results into a compact failure
+ * digest. The missing front-half of the test→fix loop: an agent runs the suite,
+ * points this at the results, and gets exactly the failing test names + file:line
+ * + assertion message — instead of re-reading hundreds of log lines — then feeds
+ * that into `repair`. Inspired by dorny/test-reporter, action-junit-report,
+ * gotestsum.
+ *
+ * Pure + deterministic: a results string in, a normalized summary out. The file
+ * read / glob lives in ../commands/testreport.ts, so this is fixture-testable.
+ * No XML dependency — well-formed JUnit escapes <>& in attribute values, so a
+ * focused tokenizer over <testcase>/<failure> is safe.
+ */
+/** Decode the five predefined XML entities. Pure. */
+function decodeXml(s) {
+    return s
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        .replace(/&quot;/g, '"')
+        .replace(/&apos;/g, "'")
+        .replace(/&#(\d+);/g, (_, d) => String.fromCharCode(parseInt(d, 10)))
+        .replace(/&amp;/g, '&'); // last, so &amp;lt; → &lt; not <
+}
+/**
+ * Decode an element's text content, honoring CDATA sections. Text OUTSIDE
+ * `<![CDATA[ … ]]>` is entity-decoded; text INSIDE is taken literally (per the
+ * XML spec, CDATA content is never entity-expanded). Maven Surefire/Failsafe
+ * wrap `<failure>`/`<error>` stack traces in CDATA, so without this the raw
+ * `<![CDATA[`/`]]>` markers leak into the failure message. Pure.
+ */
+function decodeXmlContent(s) {
+    const OPEN = '<![CDATA[';
+    const CLOSE = ']]>';
+    if (!s.includes(OPEN))
+        return decodeXml(s);
+    let out = '';
+    let i = 0;
+    while (i < s.length) {
+        const start = s.indexOf(OPEN, i);
+        if (start < 0) {
+            out += decodeXml(s.slice(i));
+            break;
+        }
+        out += decodeXml(s.slice(i, start));
+        const end = s.indexOf(CLOSE, start + OPEN.length);
+        if (end < 0) {
+            out += s.slice(start + OPEN.length);
+            break;
+        } // unterminated → rest is literal
+        out += s.slice(start + OPEN.length, end);
+        i = end + CLOSE.length;
+    }
+    return out;
+}
+/** Extract key="value" / key='value' attributes from a tag's attribute text. Pure. */
+function parseAttrs(attrText) {
+    const out = {};
+    const re = /([\w:.-]+)\s*=\s*("([^"]*)"|'([^']*)')/g;
+    let m;
+    while ((m = re.exec(attrText)) !== null) {
+        out[m[1]] = decodeXml(m[3] ?? m[4] ?? '');
+    }
+    return out;
+}
+/** Pull a `file:line` out of a stack-trace / assertion message. Pure. */
+export function extractFileLine(text) {
+    if (!text)
+        return {};
+    // Prefer a parenthesised frame `(path:line:col)`, else a bare `path:line`.
+    const paren = text.match(/\(([^()\s]+?):(\d+):(?:\d+)\)/);
+    if (paren)
+        return { file: paren[1], line: parseInt(paren[2], 10) };
+    const bare = text.match(/([\w./\\-]+\.[a-zA-Z]{1,5}):(\d+)(?::\d+)?/);
+    if (bare)
+        return { file: bare[1], line: parseInt(bare[2], 10) };
+    return {};
+}
+/** Parse JUnit XML (testsuites/testsuite/testcase). Pure. */
+export function parseJUnit(xml) {
+    const failures = [];
+    let passed = 0, failed = 0, skipped = 0, durationMs = 0;
+    const caseRe = /<testcase\b([^>]*?)(?:\/>|>([\s\S]*?)<\/testcase>)/g;
+    let c;
+    while ((c = caseRe.exec(xml)) !== null) {
+        const attrs = parseAttrs(c[1]);
+        const body = c[2] ?? '';
+        const name = attrs.name ?? '(unnamed)';
+        const suite = attrs.classname ?? attrs.suite ?? '';
+        if (attrs.time)
+            durationMs += Math.round(parseFloat(attrs.time) * 1000) || 0;
+        const fail = body.match(/<(failure|error)\b([^>]*?)(?:\/>|>([\s\S]*?)<\/\1>)/);
+        const isSkipped = /<skipped\b[^>]*\/?>/.test(body);
+        if (fail) {
+            failed++;
+            const fAttrs = parseAttrs(fail[2]);
+            const inner = decodeXmlContent(fail[3] ?? '').trim();
+            const message = fAttrs.message || inner.split('\n')[0] || undefined;
+            // Prefer explicit file/line attrs (pytest, some emitters), else sniff the trace.
+            const loc = attrs.file
+                ? { file: attrs.file, line: attrs.line ? parseInt(attrs.line, 10) : undefined }
+                : extractFileLine(inner || fAttrs.message || '');
+            failures.push({ suite, name, message, type: fAttrs.type, ...loc });
+        }
+        else if (isSkipped) {
+            skipped++;
+        }
+        else {
+            passed++;
+        }
+    }
+    return { passed, failed, skipped, total: passed + failed + skipped, durationMs, failures };
+}
+/** Parse TAP (Test Anything Protocol) output. Pure. */
+export function parseTAP(text) {
+    const failures = [];
+    let passed = 0, failed = 0, skipped = 0, todo = 0;
+    let bailedOut = false;
+    let bailReason;
+    const lines = text.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // `Bail out!` (column 1, per the TAP spec) aborts the run — stop parsing;
+        // anything after it is not a valid result.
+        const bail = line.match(/^Bail out!(?:\s+(.*))?$/);
+        if (bail) {
+            bailedOut = true;
+            bailReason = bail[1]?.trim() || undefined;
+            break;
+        }
+        const m = line.match(/^(ok|not ok)\b\s*(\d+)?\s*-?\s*(.*)$/);
+        if (!m)
+            continue;
+        const ok = m[1] === 'ok';
+        let desc = m[3].trim();
+        const directive = desc.match(/#\s*(SKIP|TODO)\b(.*)$/i);
+        if (directive)
+            desc = desc.slice(0, directive.index).trim();
+        if (directive && /skip/i.test(directive[1])) {
+            skipped++;
+            continue;
+        }
+        // TODO tests are "not expected to succeed" — a `not ok … # TODO` is a known
+        // stub, not a real failure (TAP spec). Count it as todo, never a failure.
+        if (directive && /todo/i.test(directive[1])) {
+            todo++;
+            continue;
+        }
+        if (ok) {
+            passed++;
+        }
+        else {
+            failed++;
+            // Look ahead for an indented YAML diagnostic block for message/file/line.
+            let message;
+            let file;
+            let lineNo;
+            for (let j = i + 1; j < lines.length; j++) {
+                const d = lines[j];
+                if (!/^\s/.test(d) && d.trim() !== '')
+                    break; // dedented → block ended
+                const mm = d.match(/^\s*message:\s*(.+)$/);
+                if (mm)
+                    message = mm[1].replace(/^["']|["']$/g, '').trim();
+                const fm = d.match(/^\s*(?:file|at):\s*(.+)$/);
+                if (fm) {
+                    const fl = extractFileLine(fm[1]);
+                    if (fl.file) {
+                        file = fl.file;
+                        lineNo = fl.line;
+                    }
+                }
+                const lm = d.match(/^\s*line:\s*(\d+)/);
+                if (lm)
+                    lineNo = parseInt(lm[1], 10);
+                if (/^\s*\.\.\.\s*$/.test(d))
+                    break; // end of YAML block
+            }
+            failures.push({ suite: '', name: desc || '(unnamed)', message, file, line: lineNo });
+        }
+    }
+    return { passed, failed, skipped, total: passed + failed + skipped + todo, durationMs: 0, failures, ...(todo && { todo }), ...(bailedOut && { bailedOut, bailReason }) };
+}
+/** Sniff the format from a path extension, then content. Pure. */
+export function detectFormat(content, path) {
+    if (path) {
+        if (/\.tap$/i.test(path))
+            return 'tap';
+        if (/\.xml$/i.test(path))
+            return 'junit';
+    }
+    if (/<testsuite|<testcase/i.test(content))
+        return 'junit';
+    if (/^\s*(TAP version|1\.\.\d|ok\b|not ok\b)/m.test(content))
+        return 'tap';
+    return 'junit';
+}
+/** Parse by explicit or detected format. Pure. */
+export function parseTestReport(content, format) {
+    return format === 'tap' ? parseTAP(content) : parseJUnit(content);
+}
+/** Merge several summaries (multi-file globs). Pure. */
+export function mergeSummaries(list) {
+    const merged = list.reduce((acc, s) => ({
+        passed: acc.passed + s.passed,
+        failed: acc.failed + s.failed,
+        skipped: acc.skipped + s.skipped,
+        total: acc.total + s.total,
+        durationMs: acc.durationMs + s.durationMs,
+        failures: acc.failures.concat(s.failures),
+    }), { passed: 0, failed: 0, skipped: 0, total: 0, durationMs: 0, failures: [] });
+    const todoSum = list.reduce((n, s) => n + (s.todo ?? 0), 0);
+    if (todoSum > 0)
+        merged.todo = todoSum;
+    // Any bailed file taints the whole run; keep the first reason seen.
+    const bailed = list.find((s) => s.bailedOut);
+    if (bailed) {
+        merged.bailedOut = true;
+        merged.bailReason = bailed.bailReason;
+    }
+    return merged;
+}
+/** Human-readable digest. Pure. */
+export function formatSummary(s, opts = {}) {
+    const todoSeg = s.todo ? ` · ${s.todo} todo` : '';
+    const head = `${s.passed} passed · ${s.failed} failed · ${s.skipped} skipped${todoSeg} (${s.total} total, ${s.durationMs}ms)`;
+    const bailLine = s.bailedOut
+        ? `⚠ suite ABORTED (Bail out!${s.bailReason ? `: ${s.bailReason}` : ''}) — results incomplete`
+        : '';
+    if (s.failures.length === 0) {
+        if (s.bailedOut)
+            return `${bailLine}\n${head}`;
+        return head + (s.failed === 0 ? ' ✓' : '');
+    }
+    const shown = opts.top && opts.top > 0 ? s.failures.slice(0, opts.top) : s.failures;
+    const lines = s.bailedOut ? [bailLine, head, ''] : [head, ''];
+    for (const f of shown) {
+        const where = f.file ? `${f.file}${f.line ? `:${f.line}` : ''}` : '';
+        lines.push(`✗ ${f.suite ? f.suite + ' › ' : ''}${f.name}${where ? `  (${where})` : ''}`);
+        if (f.message)
+            lines.push(`    ${f.message.split('\n')[0]}`);
+    }
+    if (shown.length < s.failures.length)
+        lines.push(`… and ${s.failures.length - shown.length} more`);
+    return lines.join('\n');
+}
+//# sourceMappingURL=testreport.js.map

package/v3/@swarmdo/cli/dist/src/usage/claude-pricing.d.ts

@@ -16,7 +16,10 @@
 export interface TranscriptModelPrice {
     in: number;
     out: number;
+    /** 5-minute-TTL cache write (1.25× base input) */
     cacheWrite: number;
+    /** 1-hour-TTL cache write (2× base input) */
+    cacheWrite1h: number;
     cacheRead: number;
 }
 /**
@@ -32,7 +35,10 @@ export declare function resolveTranscriptPrice(rawModelId: string): TranscriptMo
 export interface TokenBundle {
     inputTokens: number;
     outputTokens: number;
+    /** TOTAL cache-write tokens (5-min + 1-hour). */
     cacheWriteTokens: number;
+    /** The 1-hour-TTL SUBSET of cacheWriteTokens (≤ cacheWriteTokens). Default 0 → all writes priced at the 5-min rate. */
+    cacheWrite1hTokens?: number;
     cacheReadTokens: number;
 }
 /** USD for one response at the given rates. */

package/v3/@swarmdo/cli/dist/src/usage/claude-pricing.js

@@ -20,14 +20,14 @@
  * publishes rates — absent means "unpriced", never "guessed".
  */
 const PRICE_FAMILIES = {
-    'claude-opus-4': { in: 15, out: 75, cacheWrite: 18.75, cacheRead: 1.5 },
-    'claude-sonnet-4': { in: 3, out: 15, cacheWrite: 3.75, cacheRead: 0.3 },
-    'claude-haiku-4': { in: 1, out: 5, cacheWrite: 1.25, cacheRead: 0.1 },
-    'claude-3-7-sonnet': { in: 3, out: 15, cacheWrite: 3.75, cacheRead: 0.3 },
-    'claude-3-5-sonnet': { in: 3, out: 15, cacheWrite: 3.75, cacheRead: 0.3 },
-    'claude-3-5-haiku': { in: 0.8, out: 4, cacheWrite: 1, cacheRead: 0.08 },
-    'claude-3-opus': { in: 15, out: 75, cacheWrite: 18.75, cacheRead: 1.5 },
-    'claude-3-haiku': { in: 0.25, out: 1.25, cacheWrite: 0.3, cacheRead: 0.03 },
+    'claude-opus-4': { in: 15, out: 75, cacheWrite: 18.75, cacheWrite1h: 30, cacheRead: 1.5 },
+    'claude-sonnet-4': { in: 3, out: 15, cacheWrite: 3.75, cacheWrite1h: 6, cacheRead: 0.3 },
+    'claude-haiku-4': { in: 1, out: 5, cacheWrite: 1.25, cacheWrite1h: 2, cacheRead: 0.1 },
+    'claude-3-7-sonnet': { in: 3, out: 15, cacheWrite: 3.75, cacheWrite1h: 6, cacheRead: 0.3 },
+    'claude-3-5-sonnet': { in: 3, out: 15, cacheWrite: 3.75, cacheWrite1h: 6, cacheRead: 0.3 },
+    'claude-3-5-haiku': { in: 0.8, out: 4, cacheWrite: 1, cacheWrite1h: 1.6, cacheRead: 0.08 },
+    'claude-3-opus': { in: 15, out: 75, cacheWrite: 18.75, cacheWrite1h: 30, cacheRead: 1.5 },
+    'claude-3-haiku': { in: 0.25, out: 1.25, cacheWrite: 0.3, cacheWrite1h: 0.5, cacheRead: 0.03 },
 };
 /**
  * Reduce a transcript/gateway model id to the bare Anthropic id:
@@ -62,9 +62,12 @@ export function resolveTranscriptPrice(rawModelId) {
 }
 /** USD for one response at the given rates. */
 export function transcriptCostUsd(price, t) {
+    const cacheWrite1h = t.cacheWrite1hTokens ?? 0;
+    const cacheWrite5m = Math.max(0, t.cacheWriteTokens - cacheWrite1h);
     return ((t.inputTokens * price.in +
         t.outputTokens * price.out +
-        t.cacheWriteTokens * price.cacheWrite +
+        cacheWrite5m * price.cacheWrite +
+        cacheWrite1h * price.cacheWrite1h +
         t.cacheReadTokens * price.cacheRead) / 1_000_000);
 }
 //# sourceMappingURL=claude-pricing.js.map

package/v3/@swarmdo/cli/dist/src/usage/transcript-usage.js

@@ -177,6 +177,9 @@ function toUsageEvent(line, project, seen, unpriced) {
         cacheWriteTokens: usage.cache_creation_input_tokens ?? 0,
         cacheReadTokens: usage.cache_read_input_tokens ?? 0,
     };
+    // 1-hour-TTL cache writes cost 2× base input, not the 1.25× 5-min rate. Recent
+    // transcripts split them in `cache_creation`; older ones don't (→ all 5-min).
+    const cacheWrite1hTokens = usage.cache_creation?.ephemeral_1h_input_tokens ?? 0;
     let costUsd;
     let costSource;
     const price = resolveTranscriptPrice(model);
@@ -185,7 +188,7 @@ function toUsageEvent(line, project, seen, unpriced) {
         costSource = 'transcript';
     }
     else if (price) {
-        costUsd = transcriptCostUsd(price, tokens);
+        costUsd = transcriptCostUsd(price, { ...tokens, cacheWrite1hTokens });
         costSource = 'computed';
     }
     else {

package/v3/@swarmdo/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmdo/cli",
-  "version": "1.18.0",
+  "version": "1.27.0",
   "type": "module",
   "description": "Swarmdo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",