swarmdo 1.37.0 → 1.45.0

package/v3/@swarmdo/cli/dist/src/mcp-tools/index.d.ts

@@ -22,6 +22,7 @@ export { envTools } from './env-tools.js';
 export { licenseTools } from './license-tools.js';
 export { applyTools } from './apply-tools.js';
 export { hotspotsTools } from './hotspots-tools.js';
+export { couplingTools } from './coupling-tools.js';
 export { affectedTools } from './affected-tools.js';
 export { cyclesTools } from './cycles-tools.js';
 export { testreportTools } from './testreport-tools.js';

package/v3/@swarmdo/cli/dist/src/mcp-tools/index.js

@@ -21,6 +21,7 @@ export { envTools } from './env-tools.js';
 export { licenseTools } from './license-tools.js';
 export { applyTools } from './apply-tools.js';
 export { hotspotsTools } from './hotspots-tools.js';
+export { couplingTools } from './coupling-tools.js';
 export { affectedTools } from './affected-tools.js';
 export { cyclesTools } from './cycles-tools.js';
 export { testreportTools } from './testreport-tools.js';

package/v3/@swarmdo/cli/dist/src/mcp-tools/profiles.js

@@ -27,6 +27,7 @@ const LEAN_GROUPS = [
     'env', // env_check — env-var drift (missing/unused/undocumented)
     'apply', // apply_patch — fuzzy unified-diff applier for agent edits
     'hotspots', // hotspots — git-history change-risk ranking ("where's the debt?")
+    'coupling', // coupling — files that change together (temporal co-change), complements affected
     'affected', // affected — impacted files/tests from a change via the import graph
     'cycles', // cycles — circular-import detection via the import graph
     'testreport', // testreport — JUnit/TAP → structured failure digest (pairs w/ repair)

package/v3/@swarmdo/cli/dist/src/mcp-tools/task-deps.d.ts

@@ -42,6 +42,41 @@ export declare function readyTasks(store: TaskStore): TaskRecord[];
 export declare function blockedTasks(store: TaskStore): BlockedInfo[];
 /** Tasks that became ready exactly because `completedTaskId` completed. */
 export declare function unblockedBy(store: TaskStore, completedTaskId: string): TaskRecord[];
+export interface DeadBlock {
+    task: TaskRecord;
+    /**
+     * The terminal-dead dependency ids in this task's dependency closure — the
+     * failed, cancelled, or missing tasks that make it permanently unreachable
+     * until a human retries/cancels/creates them. Deterministic (sorted).
+     */
+    rootCause: string[];
+}
+export interface TaskDagHealth {
+    /** pending tasks whose unmet deps can STILL complete — a transient wait */
+    liveBlocked: TaskRecord[];
+    /** pending tasks that can NEVER become ready without human intervention */
+    deadBlocked: DeadBlock[];
+    /**
+     * true when pending work exists but nothing is ready AND nothing is
+     * in_progress — the DAG cannot advance on its own. A coordinator looping on
+     * `task dispatch` would otherwise spin forever doing nothing.
+     */
+    deadlocked: boolean;
+}
+/**
+ * Classify every blocked task as live- vs dead-blocked and report a global
+ * deadlock verdict. Pure.
+ *
+ * This is Apache Airflow's `upstream_failed` state + DAG-deadlock detection,
+ * ported onto the beads-style task DAG (see the module header): a dependency
+ * that failed / was cancelled / is missing NEVER satisfies (only 'completed'
+ * does), so every task transitively downstream is permanently stuck until a
+ * human intervenes. `blockedTasks()` reports the wait but can't tell a
+ * transient wait from a permanent one — the dispatcher then skips a
+ * failed-dep block every pass, indistinguishable from a normal wait, and the
+ * DAG quietly wedges. This turns that silent stall into a named diagnostic.
+ */
+export declare function taskDagHealth(store: TaskStore): TaskDagHealth;
 /**
  * Flat dependency view: one line per task, dependencies inline with their
  * states. A DAG has no single tree; a flat annotated list stays honest for

package/v3/@swarmdo/cli/dist/src/mcp-tools/task-deps.js

@@ -94,6 +94,93 @@ export function blockedTasks(store) {
 export function unblockedBy(store, completedTaskId) {
     return Object.values(store.tasks).filter((t) => t.status === 'pending' && (t.dependsOn ?? []).includes(completedTaskId) && isReady(store, t));
 }
+/**
+ * Classify every blocked task as live- vs dead-blocked and report a global
+ * deadlock verdict. Pure.
+ *
+ * This is Apache Airflow's `upstream_failed` state + DAG-deadlock detection,
+ * ported onto the beads-style task DAG (see the module header): a dependency
+ * that failed / was cancelled / is missing NEVER satisfies (only 'completed'
+ * does), so every task transitively downstream is permanently stuck until a
+ * human intervenes. `blockedTasks()` reports the wait but can't tell a
+ * transient wait from a permanent one — the dispatcher then skips a
+ * failed-dep block every pass, indistinguishable from a normal wait, and the
+ * DAG quietly wedges. This turns that silent stall into a named diagnostic.
+ */
+export function taskDagHealth(store) {
+    // canComplete(id): can this task ever reach status 'completed'?
+    //   completed → yes; failed/cancelled/missing → no; pending/in_progress →
+    //   only if EVERY dependency can complete. Memoized; a cycle (the store is
+    //   acyclic by invariant, but guard anyway) resolves to false.
+    const memo = new Map();
+    const visiting = new Set();
+    const canComplete = (id) => {
+        const cached = memo.get(id);
+        if (cached !== undefined)
+            return cached;
+        const task = store.tasks[id];
+        if (!task)
+            return false; // missing id — blocks forever
+        if (task.status === 'completed')
+            return true;
+        if (task.status === 'failed' || task.status === 'cancelled')
+            return false;
+        if (visiting.has(id))
+            return false; // cycle guard
+        visiting.add(id);
+        const ok = (task.dependsOn ?? []).every((d) => canComplete(d));
+        visiting.delete(id);
+        memo.set(id, ok);
+        return ok;
+    };
+    // The terminal-dead ids (failed/cancelled/missing) reachable from a task,
+    // descending THROUGH still-pending intermediates to name the real culprit.
+    const deadRoots = (task) => {
+        const found = new Set();
+        const seen = new Set();
+        const stack = [...(task.dependsOn ?? [])];
+        while (stack.length) {
+            const id = stack.pop();
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            const dep = store.tasks[id];
+            if (!dep) {
+                found.add(id);
+                continue;
+            } // missing
+            if (dep.status === 'failed' || dep.status === 'cancelled') {
+                found.add(id);
+                continue;
+            }
+            if (dep.status === 'completed')
+                continue; // satisfied — not a culprit
+            for (const d of dep.dependsOn ?? [])
+                stack.push(d); // pending/in_progress → descend
+        }
+        return [...found].sort();
+    };
+    const liveBlocked = [];
+    const deadBlocked = [];
+    for (const task of Object.values(store.tasks)) {
+        if (task.status !== 'pending')
+            continue;
+        const deps = task.dependsOn ?? [];
+        if (deps.length === 0)
+            continue; // ready (dep-free), not blocked
+        if (deps.every((id) => satisfies(store.tasks[id])))
+            continue; // ready, not blocked
+        if (deps.every((id) => canComplete(id)))
+            liveBlocked.push(task);
+        else
+            deadBlocked.push({ task, rootCause: deadRoots(task) });
+    }
+    const all = Object.values(store.tasks);
+    const anyPending = all.some((t) => t.status === 'pending');
+    const anyInProgress = all.some((t) => t.status === 'in_progress');
+    const deadlocked = anyPending && readyTasks(store).length === 0 && !anyInProgress;
+    return { liveBlocked, deadBlocked, deadlocked };
+}
 const STATUS_MARK = {
     completed: '✔',
     in_progress: '▶',

package/v3/@swarmdo/cli/dist/src/redact/redact.js

@@ -44,25 +44,37 @@ export const RULES = [
  * Keyword set mirrors gitleaks' reference `generic-api-key` rule (adds bare
  * `key`, `credential`, `creds` so `PRIVATE_KEY=`/`ENCRYPTION_KEY=`/`DB_CREDENTIAL=`
  * secrets reach the entropy check). The `[:=]` immediately after the keyword
- * anchors it, so `keyboard=`/`monkey_val=` don't match; the entropy + length
- * gates keep low-entropy values (paths, short flags) from being flagged. The
- * value class also stops at the URL/query delimiters `&`, `?`, `#` (absent from
- * base64/base64url/hex token alphabets): otherwise a query-string secret like
- * `client_secret=…&api_key=…` over-captures past the `&` into the next secret,
- * and that inflated span — overlapping a range the high-confidence RULES pass
- * already claimed — gets dropped entirely, leaving the first secret unredacted.
+ * anchors it, so `keyboard=`/`monkey_val=` don't match. A `(?<![A-Za-z])` guard
+ * requires the keyword NOT be glued to a preceding letter, so a common word that
+ * merely ENDS in a keyword — `monkey=`/`donkey=`/`whiskey=`/`turkey=` (end in
+ * `key`), `compass=`/`bypass=` (end in `pass`) — is no longer flagged as a
+ * secret, while a `_`/`-`-separated name (`PRIVATE_KEY`, `x-api-key`) still
+ * matches (`_`/`-` aren't letters). The entropy + length gates keep low-entropy
+ * values (paths, short flags) out. The value class also stops at the URL/query
+ * delimiters `&`, `?`, `#` (absent from base64/base64url/hex token alphabets):
+ * otherwise a query-string secret like `client_secret=…&api_key=…` over-captures
+ * past the `&` into the next secret, and that inflated span — overlapping a range
+ * the high-confidence RULES pass already claimed — gets dropped entirely, leaving
+ * the first secret unredacted.
  */
-const ASSIGNMENT_RE = /(?:pass(?:word|phrase|wd)?|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|auth[_-]?token|client[_-]?secret|credential|creds|key)["']?\s*[:=]\s*["']?([^\s"'`,;&?#]{8,})/gi;
+const ASSIGNMENT_RE = /(?<![A-Za-z])(?:pass(?:word|phrase|wd)?|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|auth[_-]?token|client[_-]?secret|credential|creds|key)["']?\s*[:=]\s*["']?([^\s"'`,;&?#]{8,})/gi;
 /** Shannon entropy in bits/char. Pure; used by the assignment fallback. */
 export function shannonEntropy(s) {
     if (!s)
         return 0;
+    // Iterate AND normalize by code points, not UTF-16 code units. `for..of` /
+    // spread yield one symbol per code point, but `s.length` counts an astral
+    // char (emoji, CJK Ext-B, math alphanumerics) as 2 units — so dividing the
+    // per-symbol counts by s.length made the probabilities sum to <1 and
+    // under-counted entropy up to ~2×, letting a high-entropy secret with astral
+    // chars fall under the threshold and pass through UN-redacted (#95).
+    const cps = [...s];
     const freq = new Map();
-    for (const ch of s)
+    for (const ch of cps)
         freq.set(ch, (freq.get(ch) ?? 0) + 1);
     let bits = 0;
     for (const n of freq.values()) {
-        const p = n / s.length;
+        const p = n / cps.length;
         bits -= p * Math.log2(p);
     }
     return bits;

package/v3/@swarmdo/cli/dist/src/redact/sarif.d.ts

@@ -0,0 +1,28 @@
+/**
+ * sarif.ts — render redact secret-scan findings as a SARIF 2.1.0 document.
+ *
+ * SARIF (Static Analysis Results Interchange Format) is a ratified OASIS
+ * standard that GitHub code-scanning ingests via `github/codeql-action/
+ * upload-sarif`. Emit it from `redact --scan` in CI and leaked-secret findings
+ * surface as alerts in the Security tab + PR annotations instead of dying in
+ * the build log — the same thing gitleaks/trufflehog/ggshield do with their
+ * `--report-format sarif`.
+ *
+ * Pure + deterministic: findings in, JSON string out. No fs/network.
+ */
+import type { Finding } from './redact.js';
+export interface SarifOptions {
+    /** SARIF tool.driver.name (default 'swarmdo-redact') */
+    toolName?: string;
+    /** SARIF tool.driver.version — omitted from the document when not given */
+    toolVersion?: string;
+    /**
+     * URI for the artifact each finding lives in. `redact --scan` reads a STREAM
+     * (stdin / wrapped output), so there is no committed file by default; pass
+     * this (e.g. from `--source <path>`) to anchor the alerts onto a repo path.
+     */
+    artifactUri?: string;
+}
+/** Render `findings` as a SARIF 2.1.0 document string. Pure + deterministic. */
+export declare function toSarif(findings: Finding[], opts?: SarifOptions): string;
+//# sourceMappingURL=sarif.d.ts.map

package/v3/@swarmdo/cli/dist/src/redact/sarif.js

@@ -0,0 +1,53 @@
+/**
+ * sarif.ts — render redact secret-scan findings as a SARIF 2.1.0 document.
+ *
+ * SARIF (Static Analysis Results Interchange Format) is a ratified OASIS
+ * standard that GitHub code-scanning ingests via `github/codeql-action/
+ * upload-sarif`. Emit it from `redact --scan` in CI and leaked-secret findings
+ * surface as alerts in the Security tab + PR annotations instead of dying in
+ * the build log — the same thing gitleaks/trufflehog/ggshield do with their
+ * `--report-format sarif`.
+ *
+ * Pure + deterministic: findings in, JSON string out. No fs/network.
+ */
+const SARIF_SCHEMA = 'https://json.schemastore.org/sarif-2.1.0.json';
+const INFO_URI = 'the upstream project (see NOTICE)';
+/** Render `findings` as a SARIF 2.1.0 document string. Pure + deterministic. */
+export function toSarif(findings, opts = {}) {
+    const toolName = opts.toolName ?? 'swarmdo-redact';
+    // One rule descriptor per distinct ruleId, in first-seen order. Findings
+    // carry their own description, so the entropy fallback (not in RULES) is
+    // covered too — every result.ruleId is guaranteed to appear in rules[].
+    const ruleIndex = new Map();
+    const rules = [];
+    for (const f of findings) {
+        if (ruleIndex.has(f.ruleId))
+            continue;
+        ruleIndex.set(f.ruleId, rules.length);
+        rules.push({ id: f.ruleId, name: f.ruleId, shortDescription: { text: f.description } });
+    }
+    const results = findings.map((f) => {
+        const physicalLocation = {
+            region: { startLine: f.line, startColumn: f.column },
+        };
+        if (opts.artifactUri)
+            physicalLocation.artifactLocation = { uri: opts.artifactUri };
+        return {
+            ruleId: f.ruleId,
+            ruleIndex: ruleIndex.get(f.ruleId),
+            level: 'error',
+            message: { text: `Possible secret: ${f.description}` },
+            locations: [{ physicalLocation }],
+        };
+    });
+    const driver = { name: toolName, informationUri: INFO_URI, rules };
+    if (opts.toolVersion)
+        driver.version = opts.toolVersion;
+    const doc = {
+        $schema: SARIF_SCHEMA,
+        version: '2.1.0',
+        runs: [{ tool: { driver }, results }],
+    };
+    return JSON.stringify(doc, null, 2);
+}
+//# sourceMappingURL=sarif.js.map

package/v3/@swarmdo/cli/dist/src/release/release.d.ts

@@ -69,4 +69,23 @@ export declare const DOC_FILES: string[];
 export declare function planRelease(input: ReleaseInput): ReleasePlan;
 /** One-line human rendering of a step (for the dry-run plan). */
 export declare function renderStep(s: ReleaseStep): string;
+export interface SiteIdentity {
+    name: string;
+    email: string;
+}
+/**
+ * Resolve the committer identity for the throwaway swarmdo.com clone. That
+ * clone inherits no identity, and a machine may have only a *local* (per-repo)
+ * git user — so `git commit` there dies with "Author identity unknown" unless
+ * we inject one. Prefer the operator's configured identity; fall back to the
+ * Swarmdo bot so the site deploy never fails on a missing global git config.
+ * `readConfig` is injected (real: `git -C <root> config <key>`) so this stays
+ * pure and unit-testable.
+ */
+export declare function resolveSiteIdentity(readConfig: (key: string) => string | undefined): SiteIdentity;
+/**
+ * `git commit` argv for the site sync — injects the identity via `-c` so the
+ * commit succeeds without a global git user, and keeps the bot co-author trailer.
+ */
+export declare function siteCommitArgs(version: string, id: SiteIdentity): string[];
 //# sourceMappingURL=release.d.ts.map

package/v3/@swarmdo/cli/dist/src/release/release.js

@@ -83,4 +83,32 @@ export function renderStep(s) {
         case 'deploy-site': return `deploy website → SwarmDo/swarmdo.com (copy working copy, push, curl-verify swarmdo.com serves ${s.version})`;
     }
 }
+/**
+ * Resolve the committer identity for the throwaway swarmdo.com clone. That
+ * clone inherits no identity, and a machine may have only a *local* (per-repo)
+ * git user — so `git commit` there dies with "Author identity unknown" unless
+ * we inject one. Prefer the operator's configured identity; fall back to the
+ * Swarmdo bot so the site deploy never fails on a missing global git config.
+ * `readConfig` is injected (real: `git -C <root> config <key>`) so this stays
+ * pure and unit-testable.
+ */
+export function resolveSiteIdentity(readConfig) {
+    const name = (readConfig('user.name') || '').trim();
+    const email = (readConfig('user.email') || '').trim();
+    return {
+        name: name || 'Swarmdo',
+        email: email || 'maintainers@swarmdo.com',
+    };
+}
+/**
+ * `git commit` argv for the site sync — injects the identity via `-c` so the
+ * commit succeeds without a global git user, and keeps the bot co-author trailer.
+ */
+export function siteCommitArgs(version, id) {
+    return [
+        '-c', `user.name=${id.name}`,
+        '-c', `user.email=${id.email}`,
+        'commit', '-m', `release: sync site for v${version}\n\nCo-Authored-By: Swarmdo <maintainers@swarmdo.com>`,
+    ];
+}
 //# sourceMappingURL=release.js.map

package/v3/@swarmdo/cli/dist/src/usage/reflect.d.ts

@@ -90,7 +90,15 @@ export declare function nextDay(iso: string): string;
  * Pure. Used to derive a `--period 1m|3m|…` window start from today.
  */
 export declare function monthsBefore(iso: string, n: number): string;
-/** Inclusive whole-day span between two ISO dates (from <= to). Pure. */
+/**
+ * Inclusive whole-day span between two ISO dates (from <= to). Pure.
+ *
+ * Counts on the UTC timeline (`Date.UTC`), NOT local midnights: a local
+ * `new Date('…T00:00:00')` is DST-sensitive, so a range crossing a spring-forward
+ * day (only 23h long) would floor-divide to one day short — e.g. under
+ * TZ=America/New_York a full March would read 30. UTC calendar midnights are
+ * always an exact 86.4M ms apart, so this is correct in every process timezone.
+ */
 export declare function spanDays(from: string, to: string): number;
 /** Longest run of consecutive calendar days present in the set. Pure. */
 export declare function longestStreakOf(days: string[]): number;

package/v3/@swarmdo/cli/dist/src/usage/reflect.js

@@ -40,11 +40,21 @@ export function monthsBefore(iso, n) {
     const dd = String(dt.getDate()).padStart(2, '0');
     return `${yy}-${mm}-${dd}`;
 }
-/** Inclusive whole-day span between two ISO dates (from <= to). Pure. */
+/**
+ * Inclusive whole-day span between two ISO dates (from <= to). Pure.
+ *
+ * Counts on the UTC timeline (`Date.UTC`), NOT local midnights: a local
+ * `new Date('…T00:00:00')` is DST-sensitive, so a range crossing a spring-forward
+ * day (only 23h long) would floor-divide to one day short — e.g. under
+ * TZ=America/New_York a full March would read 30. UTC calendar midnights are
+ * always an exact 86.4M ms apart, so this is correct in every process timezone.
+ */
 export function spanDays(from, to) {
-    const a = new Date(from + 'T00:00:00');
-    const b = new Date(to + 'T00:00:00');
-    return Math.floor((b.getTime() - a.getTime()) / 86_400_000) + 1;
+    const [ay, am, ad] = from.split('-').map(Number);
+    const [by, bm, bd] = to.split('-').map(Number);
+    const a = Date.UTC(ay, am - 1, ad);
+    const b = Date.UTC(by, bm - 1, bd);
+    return Math.round((b - a) / 86_400_000) + 1;
 }
 /** Longest run of consecutive calendar days present in the set. Pure. */
 export function longestStreakOf(days) {

package/v3/@swarmdo/cli/dist/src/util/since.d.ts

@@ -0,0 +1,13 @@
+/**
+ * since.ts — normalize compact age windows for `git log --since`.
+ *
+ * git's approxidate parser does NOT understand the bare compact form `90d`
+ * (it silently matches nothing — `git log --since=90d` returns zero commits),
+ * yet `hotspots`/`coupling` document `--since 90d`. This maps the compact forms
+ * (`90d`, `6mo`, `2w`, `1y`, `3h`) to the spelled-out `"90 days ago"` git DOES
+ * understand. Anything already spelled out (`"3 months ago"`), an ISO date, or
+ * an unrecognized token passes through unchanged. Pure + unit-tested.
+ */
+/** Convert `90d`→`90 days ago`, `6mo`→`6 months ago`, etc. Passthrough otherwise. */
+export declare function normalizeSince(since: string): string;
+//# sourceMappingURL=since.d.ts.map

package/v3/@swarmdo/cli/dist/src/util/since.js

@@ -0,0 +1,21 @@
+/**
+ * since.ts — normalize compact age windows for `git log --since`.
+ *
+ * git's approxidate parser does NOT understand the bare compact form `90d`
+ * (it silently matches nothing — `git log --since=90d` returns zero commits),
+ * yet `hotspots`/`coupling` document `--since 90d`. This maps the compact forms
+ * (`90d`, `6mo`, `2w`, `1y`, `3h`) to the spelled-out `"90 days ago"` git DOES
+ * understand. Anything already spelled out (`"3 months ago"`), an ISO date, or
+ * an unrecognized token passes through unchanged. Pure + unit-tested.
+ */
+const COMPACT = /^\s*(\d+)\s*(d|days?|w|wks?|weeks?|mo|mons?|months?|y|yrs?|years?|h|hrs?|hours?)\s*$/i;
+/** Convert `90d`→`90 days ago`, `6mo`→`6 months ago`, etc. Passthrough otherwise. */
+export function normalizeSince(since) {
+    const m = COMPACT.exec(since);
+    if (!m)
+        return since;
+    const c0 = m[2][0].toLowerCase(); // the allowed units are uniquely keyed by first letter
+    const unit = c0 === 'd' ? 'days' : c0 === 'w' ? 'weeks' : c0 === 'y' ? 'years' : c0 === 'h' ? 'hours' : 'months';
+    return `${m[1]} ${unit} ago`;
+}
+//# sourceMappingURL=since.js.map

package/v3/@swarmdo/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmdo/cli",
-  "version": "1.37.0",
+  "version": "1.45.0",
   "type": "module",
   "description": "Swarmdo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",