swarmdo 1.30.0 → 1.45.0

package/v3/@swarmdo/cli/dist/src/commands/config.js

@@ -400,7 +400,7 @@ const importCommand = {
 const lintCommand = {
     name: 'lint',
     aliases: ['validate'],
-    description: 'Statically validate swarmdo.config.json, .claude/settings*.json hooks, .mcp.json, and the post-1.4 sDo layout',
+    description: 'Statically validate swarmdo.config.json, .claude/settings*.json hooks, .mcp.json, .claude/agents/*.md subagents, and the post-1.4 sDo layout',
     options: [
         { name: 'json', type: 'boolean', description: 'machine-readable findings', default: false },
         { name: 'strict', type: 'boolean', description: 'exit 1 on warnings too (default: errors only)', default: false },
@@ -433,12 +433,18 @@ const lintCommand = {
         const configRel = process.env.SWARMDO_CONFIG && !path.isAbsolute(process.env.SWARMDO_CONFIG)
             ? process.env.SWARMDO_CONFIG.replace(/^\.\//, '')
             : 'swarmdo.config.json';
+        const agentFiles = list('.claude/agents')
+            .filter((n) => n.endsWith('.md'))
+            .map((n) => read(`.claude/agents/${n}`))
+            .filter((x) => x.raw !== null);
         const report = lintAll({
             swarmdoConfig: read(configRel),
             settingsFiles: [read('.claude/settings.json'), read('.claude/settings.local.json')],
             mcpConfig: read('.mcp.json'),
             commandsRoot: list('.claude/commands'),
+            sdoCommands: list('.claude/commands/sDo'),
             skills: list('.claude/skills'),
+            agentFiles,
         });
         const failed = report.errors > 0 || (ctx.flags.strict === true && report.warnings > 0);
         if (ctx.flags.json === true) {

package/v3/@swarmdo/cli/dist/src/commands/coupling.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `swarmdo coupling` — temporal (co-change) coupling mined from git history.
+ *
+ *   swarmdo coupling                          # top co-changing file pairs
+ *   swarmdo coupling --since 90d --min-shared 3
+ *   swarmdo coupling --file src/auth.ts       # what changes WITH auth.ts?
+ *   swarmdo coupling --format json | --csv
+ *
+ * The EMPIRICAL complement to `affected` (which walks the static import graph):
+ * files that keep landing in the same commit are coupled in practice even with
+ * no import edge. Engine (../coupling/coupling.ts) is pure + tested; this
+ * captures the git log (the same `--numstat` dump `hotspots` uses).
+ */
+import type { Command } from '../types.js';
+export declare const couplingCommand: Command;
+export default couplingCommand;
+//# sourceMappingURL=coupling.d.ts.map

package/v3/@swarmdo/cli/dist/src/commands/coupling.js

@@ -0,0 +1,85 @@
+/**
+ * `swarmdo coupling` — temporal (co-change) coupling mined from git history.
+ *
+ *   swarmdo coupling                          # top co-changing file pairs
+ *   swarmdo coupling --since 90d --min-shared 3
+ *   swarmdo coupling --file src/auth.ts       # what changes WITH auth.ts?
+ *   swarmdo coupling --format json | --csv
+ *
+ * The EMPIRICAL complement to `affected` (which walks the static import graph):
+ * files that keep landing in the same commit are coupled in practice even with
+ * no import edge. Engine (../coupling/coupling.ts) is pure + tested; this
+ * captures the git log (the same `--numstat` dump `hotspots` uses).
+ */
+import { execFileSync } from 'node:child_process';
+import { output } from '../output.js';
+import { parseGitLog } from '../hotspots/hotspots.js';
+import { computeCoupling, formatCoupling, couplingToCsv } from '../coupling/coupling.js';
+import { normalizeSince } from '../util/since.js';
+/** Read a numeric flag that the parser may deliver as a number OR a string. */
+function numFlag(v, def) {
+    const n = typeof v === 'number' ? v : typeof v === 'string' ? parseInt(v, 10) : NaN;
+    return Number.isFinite(n) ? n : def;
+}
+async function run(ctx) {
+    const root = ctx.cwd || process.cwd();
+    const since = typeof ctx.flags.since === 'string' ? ctx.flags.since : '1 year ago';
+    const top = numFlag(ctx.flags.top, 30);
+    const minShared = numFlag(ctx.flags['min-shared'], 2);
+    const maxFiles = numFlag(ctx.flags['max-files'], 30);
+    const focus = typeof ctx.flags.file === 'string' ? ctx.flags.file : (ctx.args[0] || undefined);
+    const asJson = ctx.flags.format === 'json';
+    const asCsv = ctx.flags.csv === true;
+    // NOTE: unlike `hotspots`, we do NOT pathspec-filter the log to `focus` — that
+    // would strip the co-changed files out of each commit's numstat. We capture
+    // the full history and filter PAIRS in the engine (opts.focus) instead.
+    const args = ['log', '--no-merges', '--numstat', `--since=${normalizeSince(since)}`, '--format=format:%x01%H%x1f%aN%x1f%aI'];
+    let raw;
+    try {
+        raw = execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 128 * 1024 * 1024 });
+    }
+    catch {
+        output.printError('git log failed — is this a git repository?');
+        return { success: false, exitCode: 1 };
+    }
+    const pairs = computeCoupling(parseGitLog(raw), {
+        minShared,
+        maxFiles,
+        top: top > 0 ? top : undefined,
+        focus,
+    });
+    if (asCsv) {
+        process.stdout.write(couplingToCsv(pairs) + '\n');
+    }
+    else if (asJson) {
+        process.stdout.write(JSON.stringify({ generated: new Date().toISOString(), since, minShared, count: pairs.length, coupling: pairs }, null, 2) + '\n');
+    }
+    else if (pairs.length === 0) {
+        output.writeln(output.dim(`no co-change coupling found${focus ? ` for ${focus}` : ''} — raise --since or lower --min-shared`));
+    }
+    else {
+        output.writeln(output.bold(`Co-change coupling${focus ? ` for ${focus}` : ''} (since ${since}, min-shared ${minShared})`));
+        output.writeln(formatCoupling(pairs));
+    }
+    return { success: true, exitCode: 0 };
+}
+export const couplingCommand = {
+    name: 'coupling',
+    description: 'Rank file pairs that change together in git history (temporal/co-change coupling) — the empirical complement to `affected`',
+    options: [
+        { name: 'since', description: 'history window, e.g. 90d or "3 months ago" (default 1 year)', type: 'string' },
+        { name: 'min-shared', description: 'drop pairs sharing fewer than N commits (default 2)', type: 'string' },
+        { name: 'max-files', description: 'skip commits touching more than N files (default 30; 0 = no cap)', type: 'string' },
+        { name: 'file', description: 'show only pairs involving this path ("what changes with X?")', type: 'string' },
+        { name: 'top', description: 'keep only the top N pairs (default 30; 0 = all)', type: 'string' },
+        { name: 'csv', description: 'export the ranking as CSV (for spreadsheets)', type: 'boolean' },
+    ],
+    examples: [
+        { command: 'swarmdo coupling --since 6mo --min-shared 3', description: 'Strongly co-changing pairs in the last 6 months' },
+        { command: 'swarmdo coupling --file src/auth.ts', description: 'What tends to change together with auth.ts?' },
+        { command: 'swarmdo coupling --csv > coupling.csv', description: 'Export the coupling ranking to CSV' },
+    ],
+    action: run,
+};
+export default couplingCommand;
+//# sourceMappingURL=coupling.js.map

package/v3/@swarmdo/cli/dist/src/commands/hooks.js

@@ -8,6 +8,9 @@ import { callMCPTool, MCPClientError } from '../mcp-client.js';
 import { storeCommand } from './transfer-store.js';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
+import { bridgeSearchEntries } from '../memory/memory-bridge.js';
+import { selectInjectionMemories, mapSearchResultsToCandidates, extractPromptFromPayload, } from '../memory-inject/select.js';
+import { classifyCommand, extractBashCommand, denyOutput } from '../hooks-recipe/command-guard.js';
 /**
  * #1686 — `?? 0` only defaults null/undefined; NaN slips through and
  * surfaces as `"NaN"` (or earlier crashed `.toFixed`) in the metrics
@@ -731,6 +734,174 @@ const routeCommand = {
         }
     }
 };
+/**
+ * Read a Claude Code hook payload from stdin (JSON on UserPromptSubmit), with a
+ * short timeout so it never hangs when stdin isn't closed (a known Windows
+ * failure mode). Returns '' for a TTY or on any error — the caller then simply
+ * injects nothing.
+ */
+async function readHookStdin(timeoutMs = 1500) {
+    if (process.stdin.isTTY)
+        return '';
+    return new Promise((resolve) => {
+        let data = '';
+        const finish = (v) => {
+            try {
+                process.stdin.pause();
+            }
+            catch { /* noop */ }
+            resolve(v);
+        };
+        const timer = setTimeout(() => finish(data), timeoutMs);
+        try {
+            process.stdin.setEncoding('utf8');
+            process.stdin.on('data', (c) => { data += c; });
+            process.stdin.on('end', () => { clearTimeout(timer); finish(data); });
+            process.stdin.on('error', () => { clearTimeout(timer); finish(data); });
+            process.stdin.resume();
+        }
+        catch {
+            clearTimeout(timer);
+            finish('');
+        }
+    });
+}
+const DEFAULT_INJECT_NAMESPACES = ['claude-memories', 'auto-memory', 'patterns'];
+/**
+ * memory-inject — the #43 prompt-time semantic memory injection hook. Embeds the
+ * submitted prompt, vector-searches AgentDB across the memory namespaces, and
+ * emits the most relevant stored memories as UserPromptSubmit `additionalContext`
+ * under a strict token budget. Wired for the hook path: it NEVER errors out
+ * (that would break the user's prompt) and stays silent when nothing is relevant.
+ */
+const memoryInjectCommand = {
+    name: 'memory-inject',
+    description: 'Inject relevant stored memories into the prompt (UserPromptSubmit hook)',
+    options: [
+        { name: 'prompt', short: 'p', description: 'Prompt text (else read the hook JSON from stdin)', type: 'string' },
+        { name: 'namespaces', description: 'Comma-separated namespaces to search', type: 'string', default: DEFAULT_INJECT_NAMESPACES.join(',') },
+        { name: 'budget', description: 'Max tokens of injected context', type: 'number', default: 800 },
+        { name: 'min-relevance', description: 'Minimum relevance score (0..1)', type: 'number', default: 0.35 },
+        { name: 'top-k', short: 'K', description: 'Max memories to inject', type: 'number', default: 5 },
+        { name: 'limit', description: 'Max search results to rank', type: 'number', default: 20 },
+        { name: 'preview', description: 'Print the block for humans instead of emitting hook JSON', type: 'boolean' },
+        { name: 'db', description: 'Path to the memory database', type: 'string' },
+    ],
+    examples: [
+        { command: 'swarmdo hooks memory-inject -p "refactor the auth module" --preview', description: 'Preview relevant memories for a prompt' },
+        { command: "echo '{\"prompt\":\"fix bug\"}' | swarmdo hooks memory-inject", description: 'Run as a UserPromptSubmit hook' },
+    ],
+    action: async (ctx) => {
+        const preview = Boolean(ctx.flags.preview);
+        // A hook must NEVER break the user's prompt: swallow every error and emit nothing.
+        try {
+            if (process.env.SWARMDO_MEMORY_INJECT_DISABLE === '1')
+                return { success: true };
+            let prompt = (ctx.flags.prompt || ctx.args.join(' ')).trim();
+            if (!prompt)
+                prompt = extractPromptFromPayload(await readHookStdin());
+            if (!prompt)
+                return { success: true }; // nothing to search on
+            const namespaces = String(ctx.flags.namespaces ?? DEFAULT_INJECT_NAMESPACES.join(','))
+                .split(',').map((s) => s.trim()).filter(Boolean);
+            const minRelevance = ctx.flags.minRelevance ?? 0.35;
+            const topK = ctx.flags.topK ?? 5;
+            const limit = Math.max(ctx.flags.limit ?? 20, topK);
+            const search = await bridgeSearchEntries({
+                query: prompt,
+                namespace: 'all',
+                limit,
+                threshold: minRelevance,
+                fullContent: true,
+                dbPath: ctx.flags.db,
+            });
+            const rows = (search && search.success ? search.results : []);
+            const candidates = mapSearchResultsToCandidates(rows, namespaces);
+            const result = selectInjectionMemories(candidates, {
+                budgetTokens: ctx.flags.budget ?? 800,
+                minRelevance,
+                topK,
+            });
+            if (preview) {
+                if (!result.block) {
+                    output.printInfo('No relevant memories to inject.');
+                }
+                else {
+                    output.writeln(result.block);
+                    output.writeln();
+                    output.printInfo(`Injected ${result.used.length} memor${result.used.length === 1 ? 'y' : 'ies'} ` +
+                        `(~${result.tokensUsed} tokens${result.skipped ? `, ${result.skipped} skipped` : ''}).`);
+                }
+                return { success: true, data: { used: result.used.length, skipped: result.skipped, tokensUsed: result.tokensUsed } };
+            }
+            // Hook mode: emit additionalContext JSON ONLY when there's something to add,
+            // so an irrelevant prompt leaves Claude's context untouched.
+            if (result.block) {
+                process.stdout.write(JSON.stringify({
+                    hookSpecificOutput: { hookEventName: 'UserPromptSubmit', additionalContext: result.block },
+                }) + '\n');
+            }
+            return { success: true };
+        }
+        catch (err) {
+            if (preview)
+                output.printError(`Memory injection failed: ${String(err)}`);
+            return { success: true }; // never fail the hook
+        }
+    },
+};
+/**
+ * guard-bash — the #83 PreToolUse/Bash guardrail. Reads the hook payload from
+ * stdin (or --command), classifies the bash command against a conservative
+ * destructive-command denylist, and on a match emits Claude Code's
+ * `permissionDecision: "deny"` to hard-block it. This is the only safety net
+ * that still fires under headless `claude -p --dangerously-skip-permissions`.
+ * Hook-safe: it NEVER errors and stays silent (allow) for anything not on the
+ * denylist, so it can't break a legitimate command.
+ */
+const guardBashCommand = {
+    name: 'guard-bash',
+    description: 'Block dangerous bash commands (PreToolUse hook): emits permissionDecision:deny on a destructive-command denylist',
+    options: [
+        { name: 'command', short: 'c', description: 'Command to classify (else read the hook JSON from stdin)', type: 'string' },
+        { name: 'preview', description: 'Print the human-readable verdict instead of emitting hook JSON', type: 'boolean' },
+    ],
+    examples: [
+        { command: 'swarmdo hooks guard-bash -c "rm -rf /" --preview', description: 'Check whether a command would be blocked' },
+        { command: 'echo \'{"tool_input":{"command":"rm -rf /"}}\' | swarmdo hooks guard-bash', description: 'Run as a PreToolUse/Bash hook' },
+    ],
+    action: async (ctx) => {
+        const preview = Boolean(ctx.flags.preview);
+        // A hook must NEVER break a tool call by crashing: swallow everything, default to allow.
+        try {
+            if (process.env.SWARMDO_GUARD_BASH_DISABLE === '1')
+                return { success: true };
+            let command = (ctx.flags.command || ctx.args.join(' ')).trim();
+            if (!command)
+                command = extractBashCommand(await readHookStdin());
+            if (!command)
+                return { success: true }; // nothing to classify → allow
+            const verdict = classifyCommand(command);
+            if (preview) {
+                if (verdict.block)
+                    output.printError(`BLOCK: ${verdict.reason} [${verdict.rule}]`);
+                else
+                    output.printSuccess('allow — no destructive pattern matched');
+                return { success: true, data: verdict };
+            }
+            // Hook mode: emit the deny JSON only on a block; silence = allow.
+            if (verdict.block) {
+                process.stdout.write(JSON.stringify(denyOutput(verdict.reason)) + '\n');
+            }
+            return { success: true };
+        }
+        catch (err) {
+            if (preview)
+                output.printError(`guard-bash failed: ${String(err)}`);
+            return { success: true }; // never fail the hook (fail-open: a broken guard must not block work)
+        }
+    },
+};
 // Explain subcommand
 const explainCommand = {
     name: 'explain',
@@ -4447,7 +4618,7 @@ const notifyCommand = {
 const recipeCommand = {
     name: 'recipe',
     aliases: ['recipes'],
-    description: 'Install ready-made Claude Code hook recipes (desktop notify) into settings — dry-run unless --apply',
+    description: 'Install ready-made Claude Code hook recipes (desktop notify, memory injection) into settings — dry-run unless --apply',
     options: [
         { name: 'apply', type: 'boolean', description: 'write the change (default: preview only)', default: false },
         { name: 'shared', type: 'boolean', description: 'target .claude/settings.json (shared/committed) instead of settings.local.json', default: false },
@@ -4553,6 +4724,8 @@ export const hooksCommand = {
         sessionEndCommand,
         sessionRestoreCommand,
         routeCommand,
+        memoryInjectCommand,
+        guardBashCommand,
         explainCommand,
         pretrainCommand,
         buildAgentsCommand,
@@ -4610,6 +4783,8 @@ export const hooksCommand = {
             `${output.highlight('session-end')}     - End current session and persist state`,
             `${output.highlight('session-restore')} - Restore a previous session`,
             `${output.highlight('route')}           - Route tasks to optimal agents`,
+            `${output.highlight('memory-inject')}   - Inject relevant memories into the prompt (UserPromptSubmit)`,
+            `${output.highlight('guard-bash')}      - Block dangerous bash commands (PreToolUse deny)`,
             `${output.highlight('explain')}         - Explain routing decisions`,
             `${output.highlight('pretrain')}        - Bootstrap intelligence from repository`,
             `${output.highlight('build-agents')}    - Generate optimized agent configs`,

package/v3/@swarmdo/cli/dist/src/commands/hotspots.js

@@ -13,7 +13,8 @@
  */
 import { execFileSync } from 'node:child_process';
 import { output } from '../output.js';
-import { parseGitLog, computeHotspots, formatHotspots } from '../hotspots/hotspots.js';
+import { parseGitLog, computeHotspots, formatHotspots, hotspotsToCsv } from '../hotspots/hotspots.js';
+import { normalizeSince } from '../util/since.js';
 const SORT_KEYS = ['risk', 'churn', 'commits', 'authors'];
 /** Read a numeric flag that the parser may deliver as a number OR a string. */
 function numFlag(v, def) {
@@ -33,11 +34,12 @@ async function run(ctx) {
     }
     // Global --format (text|json|table); text and table both render the table.
     const asJson = ctx.flags.format === 'json';
+    const asCsv = ctx.flags.csv === true; // dedicated flag (global --format has no csv choice)
     // Capture history: SOH-delimited header + numstat, no merges. `%aN` (not
     // `%an`) resolves author names through `.mailmap`, so name/email variants of
     // the same person fold into one identity — otherwise the author-spread factor
     // in the risk score is silently inflated. Identical to `%an` when no .mailmap.
-    const args = ['log', '--no-merges', '--numstat', `--since=${since}`, '--format=format:%x01%H%x1f%aN%x1f%aI'];
+    const args = ['log', '--no-merges', '--numstat', `--since=${normalizeSince(since)}`, '--format=format:%x01%H%x1f%aN%x1f%aI'];
     if (pathArg)
         args.push('--', pathArg);
     let raw;
@@ -50,7 +52,10 @@ async function run(ctx) {
     }
     const now = Date.now();
     const spots = computeHotspots(parseGitLog(raw), now, { by, top: top > 0 ? top : undefined, minCommits });
-    if (asJson) {
+    if (asCsv) {
+        process.stdout.write(hotspotsToCsv(spots) + '\n');
+    }
+    else if (asJson) {
         process.stdout.write(JSON.stringify({ generated: new Date(now).toISOString(), by, count: spots.length, hotspots: spots }, null, 2) + '\n');
     }
     else {
@@ -72,10 +77,12 @@ export const hotspotsCommand = {
         { name: 'top', description: 'keep only the top N files (default 20; 0 = all)', type: 'string' },
         { name: 'min-commits', description: 'drop files with fewer than N commits (default 1)', type: 'string' },
         { name: 'by', description: `sort key: ${SORT_KEYS.join('|')} (default risk)`, type: 'string' },
+        { name: 'csv', description: 'export the ranking as CSV (for spreadsheets)', type: 'boolean' },
     ],
     examples: [
         { command: 'swarmdo hotspots src --since 90d', description: 'Risk hotspots under src/ in the last 90 days' },
         { command: 'swarmdo hotspots --by churn --top 10 --format json', description: 'Top-10 by churn as JSON' },
+        { command: 'swarmdo hotspots --csv > hotspots.csv', description: 'Export the risk ranking to CSV' },
     ],
     action: run,
 };

package/v3/@swarmdo/cli/dist/src/commands/index.js

@@ -51,6 +51,9 @@ const commandLoaders = {
     // Circular-import detector (madge --circular demand) — SCC scan over
     // codegraph's import graph; catches TDZ/undefined-export bugs.
     cycles: () => import('./cycles.js'),
+    // Temporal (co-change) coupling from git history (code-maat demand) — file
+    // pairs that change together; the empirical complement to `affected`.
+    coupling: () => import('./coupling.js'),
     // JUnit/TAP test-result parser (dorny/test-reporter demand) — raw results →
     // failing test + file:line + message; the front-half of the test→fix loop.
     testreport: () => import('./testreport.js'),
@@ -100,6 +103,12 @@ const commandLoaders = {
     // Isolated git worktrees for parallel work (claude-squad/vibe-kanban demand)
     worktree: () => import('./worktree.js'),
     wt: () => import('./worktree.js'), // alias via loader key
+    // Cross-session agent mailbox (multiplayer swarms — dorsa_rohani demand)
+    comms: () => import('./comms.js'),
+    mailbox: () => import('./comms.js'), // alias via loader key
+    // Static audit of Claude Code permission rules (conflicts / dead / over-broad)
+    permissions: () => import('./permissions.js'),
+    perms: () => import('./permissions.js'), // alias via loader key
     // Export Claude Code sessions to Markdown (conversation-exporter demand)
     transcript: () => import('./transcript.js'),
     tx: () => import('./transcript.js'), // alias via loader key
@@ -287,7 +296,7 @@ export async function getCommandsByCategory() {
     // three slots from 'statusline' onward (completionsCmd received the
     // statusline module, analyzeCmd received completions, …), scrambling the
     // categorized help. Every load now has a named slot.
-    const [daemonCmd, doctorCmd, embeddingsCmd, neuralCmd, performanceCmd, securityCmd, swarmvectorCmd, hiveMindCmd, configCmd, statuslineCmd, compressCmd, efficiencyCmd, completionsCmd, migrateCmd, workflowCmd, analyzeCmd, routeCmd, progressCmd, providersCmd, pluginsCmd, deploymentCmd, claimsCmd, issuesCmd, updateCmd, processCmd, guidanceCmd, applianceCmd, cleanupCmd, autopilotCmd, demoCmd, usageCmd, repairCmd, hudCmd, compactCmd, codegraphCmd, redactCmd, packCmd, envCmd, licenseCmd, sbomCmd, applyCmd, hotspotsCmd, affectedCmd, cyclesCmd, testreportCmd, compactSnapshotCmd,] = await Promise.all([
+    const [daemonCmd, doctorCmd, embeddingsCmd, neuralCmd, performanceCmd, securityCmd, swarmvectorCmd, hiveMindCmd, configCmd, statuslineCmd, compressCmd, efficiencyCmd, completionsCmd, migrateCmd, workflowCmd, analyzeCmd, routeCmd, progressCmd, providersCmd, pluginsCmd, deploymentCmd, claimsCmd, issuesCmd, updateCmd, processCmd, guidanceCmd, applianceCmd, cleanupCmd, autopilotCmd, demoCmd, usageCmd, repairCmd, hudCmd, compactCmd, codegraphCmd, redactCmd, packCmd, envCmd, licenseCmd, sbomCmd, applyCmd, hotspotsCmd, affectedCmd, cyclesCmd, couplingCmd, testreportCmd, compactSnapshotCmd,] = await Promise.all([
         loadCommand('daemon'), loadCommand('doctor'), loadCommand('embeddings'), loadCommand('neural'),
         loadCommand('performance'), loadCommand('security'), loadCommand('swarmvector'), loadCommand('hive-mind'),
         loadCommand('config'), loadCommand('statusline'), loadCommand('compress'), loadCommand('efficiency'),
@@ -295,7 +304,7 @@ export async function getCommandsByCategory() {
         loadCommand('analyze'), loadCommand('route'), loadCommand('progress'), loadCommand('providers'),
         loadCommand('plugins'), loadCommand('deployment'), loadCommand('claims'), loadCommand('issues'),
         loadCommand('update'), loadCommand('process'), loadCommand('guidance'), loadCommand('appliance'),
-        loadCommand('cleanup'), loadCommand('autopilot'), loadCommand('demo'), loadCommand('usage'), loadCommand('repair'), loadCommand('hud'), loadCommand('compact'), loadCommand('codegraph'), loadCommand('redact'), loadCommand('pack'), loadCommand('env'), loadCommand('license'), loadCommand('sbom'), loadCommand('apply'), loadCommand('hotspots'), loadCommand('affected'), loadCommand('cycles'), loadCommand('testreport'), loadCommand('compact-snapshot'),
+        loadCommand('cleanup'), loadCommand('autopilot'), loadCommand('demo'), loadCommand('usage'), loadCommand('repair'), loadCommand('hud'), loadCommand('compact'), loadCommand('codegraph'), loadCommand('redact'), loadCommand('pack'), loadCommand('env'), loadCommand('license'), loadCommand('sbom'), loadCommand('apply'), loadCommand('hotspots'), loadCommand('affected'), loadCommand('cycles'), loadCommand('coupling'), loadCommand('testreport'), loadCommand('compact-snapshot'),
     ]);
     return {
         primary: [
@@ -311,7 +320,7 @@ export async function getCommandsByCategory() {
         utility: [
             configCmd, doctorCmd, daemonCmd, completionsCmd,
             migrateCmd, workflowCmd, demoCmd,
-            statuslineCmd, compressCmd, compactCmd, redactCmd, packCmd, envCmd, licenseCmd, sbomCmd, applyCmd, hotspotsCmd, affectedCmd, cyclesCmd, testreportCmd, compactSnapshotCmd, efficiencyCmd,
+            statuslineCmd, compressCmd, compactCmd, redactCmd, packCmd, envCmd, licenseCmd, sbomCmd, applyCmd, hotspotsCmd, affectedCmd, cyclesCmd, couplingCmd, testreportCmd, compactSnapshotCmd, efficiencyCmd,
         ].filter(Boolean),
         analysis: [
             analyzeCmd, routeCmd, progressCmd, usageCmd, hudCmd, codegraphCmd,

package/v3/@swarmdo/cli/dist/src/commands/permissions.d.ts

@@ -0,0 +1,14 @@
+/**
+ * permissions.ts — `swarmdo permissions` (alias `perms`) — audit Claude Code
+ * permission rules for conflicts, dead/shadowed rules, and over-broad grants.
+ *
+ * Complements `config lint` (which validates the hooks block): this reads the
+ * `permissions.allow` / `deny` / `ask` arrays from `.claude/settings.json` +
+ * `settings.local.json` (+ `~/.claude/settings.json` with `--global`), merges
+ * them into the effective ruleset Claude Code enforces, and runs the pure
+ * permissions/audit.ts analyzer. Read-only — never edits settings.
+ */
+import type { Command } from '../types.js';
+export declare const permissionsCommand: Command;
+export default permissionsCommand;
+//# sourceMappingURL=permissions.d.ts.map

package/v3/@swarmdo/cli/dist/src/commands/permissions.js

@@ -0,0 +1,92 @@
+/**
+ * permissions.ts — `swarmdo permissions` (alias `perms`) — audit Claude Code
+ * permission rules for conflicts, dead/shadowed rules, and over-broad grants.
+ *
+ * Complements `config lint` (which validates the hooks block): this reads the
+ * `permissions.allow` / `deny` / `ask` arrays from `.claude/settings.json` +
+ * `settings.local.json` (+ `~/.claude/settings.json` with `--global`), merges
+ * them into the effective ruleset Claude Code enforces, and runs the pure
+ * permissions/audit.ts analyzer. Read-only — never edits settings.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { output } from '../output.js';
+import { auditPermissions } from '../permissions/audit.js';
+const strArray = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []);
+/** Extract permissions.allow/deny/ask from a settings file, or null if none. */
+function readPerms(file) {
+    try {
+        if (!existsSync(file))
+            return null;
+        const obj = JSON.parse(readFileSync(file, 'utf8'));
+        const perm = obj?.permissions;
+        if (!perm || typeof perm !== 'object')
+            return null;
+        const sets = { allow: strArray(perm.allow), deny: strArray(perm.deny), ask: strArray(perm.ask) };
+        return sets.allow.length + sets.deny.length + sets.ask.length > 0 ? sets : null;
+    }
+    catch {
+        return null;
+    }
+}
+export const permissionsCommand = {
+    name: 'permissions',
+    aliases: ['perms'],
+    description: 'Audit Claude Code permission rules (allow/deny/ask) for conflicts, dead/shadowed rules, and over-broad grants',
+    options: [
+        { name: 'global', description: 'Also include ~/.claude/settings.json', type: 'boolean' },
+        { name: 'strict', description: 'Exit 1 if any error-severity finding (CI gate)', type: 'boolean' },
+        { name: 'json', description: 'Machine-readable output', type: 'boolean' },
+    ],
+    examples: [
+        { command: 'swarmdo permissions', description: "Audit this project's permission rules" },
+        { command: 'swarmdo permissions --global --strict', description: 'Include user-global settings; fail on conflicts' },
+    ],
+    action: async (ctx) => {
+        const cwd = ctx.cwd || process.cwd();
+        const files = [join(cwd, '.claude', 'settings.json'), join(cwd, '.claude', 'settings.local.json')];
+        if (ctx.flags.global === true)
+            files.push(join(homedir(), '.claude', 'settings.json'));
+        const used = [];
+        const merged = { allow: [], deny: [], ask: [] };
+        for (const file of files) {
+            const p = readPerms(file);
+            if (!p)
+                continue;
+            used.push(file);
+            merged.allow.push(...(p.allow ?? []));
+            merged.deny.push(...(p.deny ?? []));
+            merged.ask.push(...(p.ask ?? []));
+        }
+        const totalRules = merged.allow.length + merged.deny.length + merged.ask.length;
+        if (used.length === 0) {
+            if (ctx.flags.json === true)
+                output.printJson({ files: [], rules: 0, findings: [] });
+            else
+                output.printInfo('No permission rules found in .claude/settings*.json.');
+            return { success: true };
+        }
+        const findings = auditPermissions(merged);
+        const errors = findings.filter((f) => f.severity === 'error').length;
+        const warns = findings.filter((f) => f.severity === 'warn').length;
+        if (ctx.flags.json === true) {
+            output.printJson({ files: used, rules: totalRules, findings });
+        }
+        else if (findings.length === 0) {
+            output.printSuccess(`permissions audit: ${totalRules} rule(s) across ${used.length} file(s) — no issues`);
+        }
+        else {
+            const icon = (s) => (s === 'error' ? '✖' : s === 'warn' ? '⚠' : '·');
+            output.writeln(output.bold('Permission audit') + output.dim(`  (${totalRules} rules, ${used.length} file${used.length === 1 ? '' : 's'})`));
+            for (const x of findings)
+                output.writeln(`  ${icon(x.severity)} ${output.dim(`[${x.rule}]`)} ${x.message}`);
+            output.writeln('');
+            output.writeln(`${errors} error${errors === 1 ? '' : 's'}, ${warns} warning${warns === 1 ? '' : 's'}, ${findings.length - errors - warns} info`);
+        }
+        const failed = ctx.flags.strict === true && errors > 0;
+        return { success: !failed, exitCode: failed ? 1 : 0, data: { rules: totalRules, findings } };
+    },
+};
+export default permissionsCommand;
+//# sourceMappingURL=permissions.js.map

package/v3/@swarmdo/cli/dist/src/commands/redact.js

@@ -15,6 +15,7 @@
 import { spawnSync } from 'node:child_process';
 import { output } from '../output.js';
 import { redactText, scanText, formatFindingsSummary } from '../redact/redact.js';
+import { toSarif } from '../redact/sarif.js';
 import { writeStdout } from '../util/stdout.js';
 function readStdin() {
     return new Promise((resolve) => {
@@ -74,6 +75,14 @@ async function run(ctx) {
     // Scan mode: report findings, never rewrite; exit non-zero if any secret.
     if (scanMode) {
         const findings = scanText(input, opts);
+        if (ctx.flags.sarif === true) {
+            const source = typeof ctx.flags.source === 'string' ? ctx.flags.source : undefined;
+            process.stdout.write(toSarif(findings, { artifactUri: source }) + '\n');
+            // Same gate as text --scan: exit 1 on any secret (a CI author piping to
+            // upload-sarif adds `|| true` so the upload step still runs).
+            const code = findings.length > 0 ? 1 : wrappedCode;
+            return { success: code === 0, exitCode: code };
+        }
         if (asJson) {
             process.stdout.write(JSON.stringify({ count: findings.length, findings }, null, 2) + '\n');
         }
@@ -110,6 +119,8 @@ export const redactCommand = {
     options: [
         { name: 'scan', description: 'scan only: report findings and exit 1 if any secret is present (CI gate), never rewrite', type: 'boolean' },
         { name: 'json', description: 'emit findings as JSON', type: 'boolean' },
+        { name: 'sarif', description: 'scan only: emit findings as a SARIF 2.1.0 report (pipe to github/codeql-action/upload-sarif for code-scanning alerts)', type: 'boolean' },
+        { name: 'source', description: 'with --sarif: artifact URI/path the findings are anchored to (a stream has no file by default)', type: 'string' },
         { name: 'keep', description: 'keep this many leading chars of each secret (default 3; 0 = full mask)', type: 'string' },
         { name: 'token', description: 'replacement token after the kept prefix (default [REDACTED])', type: 'string' },
         { name: 'no-entropy', description: 'disable the high-entropy keyword=value fallback', type: 'boolean' },

package/v3/@swarmdo/cli/dist/src/commands/release.js

@@ -14,7 +14,7 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { execFileSync } from 'node:child_process';
 import { output } from '../output.js';
-import { planRelease, renderStep } from '../release/release.js';
+import { planRelease, renderStep, resolveSiteIdentity, siteCommitArgs } from '../release/release.js';
 /** Escape every regex metacharacter (incl. backslash) so a value is a literal in `new RegExp`. */
 function escapeRegExp(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -125,13 +125,35 @@ async function executePlan(plan, root) {
                 }
                 const g = (args) => { execFileSync('git', args, { cwd: siteDir, stdio: 'inherit' }); };
                 g(['add', '-A']);
-                try {
-                    g(['commit', '-m', `release: sync site for v${plan.next}\n\nCo-Authored-By: Swarmdo <maintainers@swarmdo.com>`]);
-                }
-                catch {
+                // Only a genuinely empty index is the benign "in sync" case. Detect it
+                // explicitly — `git diff --cached --quiet` exits 0 iff nothing is staged
+                // — instead of treating EVERY commit failure (a missing git identity, a
+                // rejected hook) as a no-op, which silently skipped the whole deploy. (#82)
+                const nothingStaged = (() => {
+                    try {
+                        execFileSync('git', ['diff', '--cached', '--quiet'], { cwd: siteDir, stdio: ['ignore', 'pipe', 'pipe'] });
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                })();
+                if (nothingStaged) {
                     output.writeln(output.dim('  site already in sync — nothing to commit'));
                     break;
                 }
+                // The throwaway clone inherits no git identity; inject the operator's
+                // (falling back to the Swarmdo bot) so the commit doesn't die on a
+                // machine whose git user is configured only per-repo, not globally. (#82)
+                const readCfg = (key) => {
+                    try {
+                        return execFileSync('git', ['-C', root, 'config', key], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+                    }
+                    catch {
+                        return '';
+                    }
+                };
+                g(siteCommitArgs(plan.next, resolveSiteIdentity(readCfg)));
                 g(['push', 'origin', 'main']);
                 // poll production (GitHub Pages deploys in ~1min)
                 let live = false;