swarmdo 1.4.8 → 1.5.0

package/v3/@swarmdo/cli/dist/src/commands/release.js

@@ -0,0 +1,224 @@
+/**
+ * release.ts — `swarmdo release [patch|minor|major|x.y.z]`
+ *
+ * One command for the whole proven release train: bump the version trio +
+ * lockfile, sync doc version strings, commit+push, build + stage the
+ * self-contained @swarmdo/cli, publish both packages, verify the registry,
+ * tag, and cut a GitHub release with `swarmdo changelog` notes.
+ *
+ * DRY-RUN BY DEFAULT — prints the exact plan; `--confirm` executes it
+ * step-by-step and stops on the first failure.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { execFileSync } from 'node:child_process';
+import { output } from '../output.js';
+import { planRelease, renderStep } from '../release/release.js';
+function repoRootFrom(cwd) {
+    try {
+        return execFileSync('git', ['rev-parse', '--show-toplevel'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+function bumpJson(file, version) {
+    const d = JSON.parse(fs.readFileSync(file, 'utf8'));
+    d.version = version;
+    fs.writeFileSync(file, JSON.stringify(d, null, 2) + '\n');
+}
+function bumpLock(file, version) {
+    const d = JSON.parse(fs.readFileSync(file, 'utf8'));
+    d.version = version;
+    if (d.packages && d.packages[''])
+        d.packages[''].version = version;
+    fs.writeFileSync(file, JSON.stringify(d, null, 2) + '\n');
+}
+/** Replace the previous version's known doc occurrences with the next. */
+function syncDocs(root, files, current, next) {
+    const today = new Date().toISOString().slice(0, 10);
+    const touched = [];
+    for (const rel of files) {
+        const abs = path.join(root, rel);
+        if (!fs.existsSync(abs))
+            continue;
+        const before = fs.readFileSync(abs, 'utf8');
+        let after = before;
+        // exact patterns used by every release since 1.4.x
+        after = after.replaceAll(`**Swarmdo v${current}** (`, `**Swarmdo v${next}** (`);
+        after = after.replace(new RegExp(`\\*\\*Swarmdo v${next.replace(/\./g, '\\.')}\\*\\* \\(\\d{4}-\\d{2}-\\d{2}\\)`), `**Swarmdo v${next}** (${today})`);
+        after = after.replaceAll(`swarmdo@${current}\` (umbrella), \`@swarmdo/cli@${current}\`, \`swarmdo-bridge@${current}\``, `swarmdo@${next}\` (umbrella), \`@swarmdo/cli@${next}\`, \`swarmdo-bridge@${next}\``);
+        after = after.replaceAll(`npx%20swarmdo-v${current}-cb3837`, `npx%20swarmdo-v${next}-cb3837`);
+        after = after.replaceAll(`"softwareVersion":"${current}"`, `"softwareVersion":"${next}"`);
+        after = after.replaceAll(`<span class="ver">v${current} · MIT</span>`, `<span class="ver">v${next} · MIT</span>`);
+        after = after.replaceAll(`▊ Swarmdo V${current} `, `▊ Swarmdo V${next} `);
+        if (after !== before) {
+            fs.writeFileSync(abs, after);
+            touched.push(rel);
+        }
+    }
+    return touched;
+}
+async function executePlan(plan, root) {
+    const run = (s) => {
+        output.writeln(output.dim(`  $ ${s.cmd} ${s.args.join(' ')}   (${path.relative(root, s.cwd) || '.'})`));
+        execFileSync(s.cmd, s.args, { cwd: s.cwd, stdio: 'inherit' });
+    };
+    for (const [i, step] of plan.steps.entries()) {
+        output.writeln(output.bold(`[${i + 1}/${plan.steps.length}] ${renderStep(step)}`));
+        switch (step.kind) {
+            case 'bump-json':
+                bumpJson(path.join(root, step.file), step.version);
+                break;
+            case 'bump-lock':
+                bumpLock(path.join(root, step.file), step.version);
+                break;
+            case 'sync-docs': {
+                const touched = syncDocs(root, step.files, plan.current, plan.next);
+                output.writeln(output.dim(`  synced: ${touched.join(', ') || '(none)'}`));
+                break;
+            }
+            case 'exec':
+                run(step);
+                break;
+            case 'verify-npm': {
+                for (const pkg of step.packages) {
+                    let seen = '';
+                    for (let attempt = 0; attempt < 20; attempt++) {
+                        try {
+                            seen = execFileSync('npm', ['view', `${pkg}@latest`, 'version'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+                        }
+                        catch {
+                            seen = '';
+                        }
+                        if (seen === step.version)
+                            break;
+                        execFileSync('sleep', ['3']);
+                    }
+                    if (seen !== step.version) {
+                        output.printError(`${pkg}@latest is "${seen || '(unset)'}" — expected ${step.version}`);
+                        return { success: false, exitCode: 1 };
+                    }
+                    output.writeln(output.dim(`  ${pkg}@latest = ${seen} ✓`));
+                }
+                break;
+            }
+            case 'deploy-site': {
+                // user rule 2026-07-07: the live site ships with every release.
+                // Copy the working copy into the SwarmDo/swarmdo.com repo, push,
+                // and verify production actually serves the new version string.
+                const siteDir = fs.mkdtempSync(path.join(os.tmpdir(), 'swarmdo-site-'));
+                execFileSync('gh', ['repo', 'clone', 'SwarmDo/swarmdo.com', siteDir, '--', '-q'], { stdio: 'inherit' });
+                fs.copyFileSync(path.join(root, 'website', 'index.html'), path.join(siteDir, 'index.html'));
+                const smap = path.join(siteDir, 'sitemap.xml');
+                if (fs.existsSync(smap)) {
+                    const today = new Date().toISOString().slice(0, 10);
+                    fs.writeFileSync(smap, fs.readFileSync(smap, 'utf8').replace(/<lastmod>[^<]*<\/lastmod>/g, `<lastmod>${today}</lastmod>`));
+                }
+                const g = (args) => { execFileSync('git', args, { cwd: siteDir, stdio: 'inherit' }); };
+                g(['add', '-A']);
+                try {
+                    g(['commit', '-m', `release: sync site for v${plan.next}\n\nCo-Authored-By: Swarmdo <maintainers@swarmdo.com>`]);
+                }
+                catch {
+                    output.writeln(output.dim('  site already in sync — nothing to commit'));
+                    break;
+                }
+                g(['push', 'origin', 'main']);
+                // poll production (GitHub Pages deploys in ~1min)
+                let live = false;
+                for (let i = 0; i < 30; i++) {
+                    try {
+                        const body = execFileSync('curl', ['-s', 'https://swarmdo.com'], { encoding: 'utf8' });
+                        if (body.includes(`v${plan.next}`)) {
+                            live = true;
+                            break;
+                        }
+                    }
+                    catch { /* transient */ }
+                    execFileSync('sleep', ['10']);
+                }
+                if (!live) {
+                    output.printError(`swarmdo.com is not serving v${plan.next} after 5min — check the Pages build`);
+                    return { success: false, exitCode: 1 };
+                }
+                output.writeln(output.dim(`  swarmdo.com serves v${plan.next} ✓`));
+                break;
+            }
+            case 'gh-release': {
+                const notes = path.join(os.tmpdir(), `swarmdo-relnotes-${process.pid}.md`);
+                const { changelogCommand } = await import('./changelog.js');
+                const r = await changelogCommand.action({ args: [], flags: { from: step.notesFrom, version: plan.tag, out: notes }, cwd: root, interactive: false });
+                if (r && r.success === false)
+                    return { success: false, exitCode: 1 };
+                execFileSync('gh', ['release', 'create', plan.tag, '--title', `${plan.tag}`, '--notes-file', notes], { cwd: root, stdio: 'inherit' });
+                try {
+                    fs.rmSync(notes, { force: true });
+                }
+                catch { /* best-effort */ }
+                break;
+            }
+        }
+    }
+    output.printSuccess(`released ${plan.tag}`);
+    return { success: true, exitCode: 0 };
+}
+export const releaseCommand = {
+    name: 'release',
+    aliases: ['ship'],
+    description: 'Run the full release train: bump trio+docs, commit, build+stage, publish both npm packages, verify, tag, GitHub release — dry-run unless --confirm',
+    options: [
+        { name: 'confirm', type: 'boolean', description: 'actually execute (default: print the plan)', default: false },
+        { name: 'skip-publish', type: 'boolean', description: 'skip npm publish + registry verify steps', default: false },
+        { name: 'skip-gh-release', type: 'boolean', description: 'skip the GitHub release step', default: false },
+        { name: 'skip-site', type: 'boolean', description: 'skip the live-site deploy (docs-sync rule: only for zero-user-facing releases)', default: false },
+        { name: 'json', type: 'boolean', description: 'print the plan as JSON', default: false },
+    ],
+    examples: [
+        { command: 'swarmdo release', description: 'Plan a patch release (dry-run)' },
+        { command: 'swarmdo release minor --confirm', description: 'Execute a minor release end-to-end' },
+        { command: 'swarmdo release 2.0.0 --skip-publish --confirm', description: 'Bump/tag/release 2.0.0 without publishing to npm' },
+    ],
+    action: async (ctx) => {
+        const cwd = ctx.cwd || process.cwd();
+        const root = repoRootFrom(cwd);
+        if (!root) {
+            output.printError('not a git repository');
+            return { success: false, exitCode: 1 };
+        }
+        const trioHead = path.join(root, 'v3/@swarmdo/cli/package.json');
+        if (!fs.existsSync(trioHead)) {
+            output.printError('this does not look like the swarmdo repo (v3/@swarmdo/cli/package.json missing)');
+            return { success: false, exitCode: 1 };
+        }
+        const current = String(JSON.parse(fs.readFileSync(trioHead, 'utf8')).version ?? '');
+        let plan;
+        try {
+            plan = planRelease({
+                current,
+                bump: (ctx.args[0] || 'patch').toLowerCase(),
+                repoRoot: root,
+                skipPublish: ctx.flags['skip-publish'] === true,
+                skipGhRelease: ctx.flags['skip-gh-release'] === true,
+                skipSite: ctx.flags['skip-site'] === true,
+            });
+        }
+        catch (e) {
+            output.printError(e.message);
+            return { success: false, exitCode: 1 };
+        }
+        if (ctx.flags.json === true) {
+            output.printJson(plan);
+            return { success: true, data: plan };
+        }
+        if (ctx.flags.confirm !== true) {
+            output.writeln(output.bold(`Release plan  ${plan.current} → ${plan.next}`) + output.dim('  (dry-run — re-run with --confirm to execute)'));
+            plan.steps.forEach((s, i) => output.writeln(`  ${String(i + 1).padStart(2)}. ${renderStep(s)}`));
+            return { success: true, data: { dryRun: true, ...plan } };
+        }
+        return executePlan(plan, root);
+    },
+};
+export default releaseCommand;
+//# sourceMappingURL=release.js.map

package/v3/@swarmdo/cli/dist/src/commands/security.js

@@ -6,6 +6,7 @@
  */
 import { output } from '../output.js';
 import { execSync } from 'node:child_process';
+import { mkdirSync, writeFileSync } from 'node:fs';
 // Scan subcommand
 const scanCommand = {
     name: 'scan',
@@ -190,6 +191,19 @@ const scanCommand = {
                 scanCodeDir(path.resolve(target), scanDepth);
             }
             spinner.succeed('Scan complete');
+            // Persist the summary so the statusline (and future tooling) reflects
+            // real scans instead of the retired V3 CVE tracker (v1.4.17).
+            try {
+                const artifactDir = path.join(process.cwd(), '.swarmdo', 'security');
+                mkdirSync(artifactDir, { recursive: true });
+                writeFileSync(path.join(artifactDir, 'last-scan.json'), JSON.stringify({
+                    scannedAt: new Date().toISOString(),
+                    target, depth, type: scanType,
+                    critical: criticalCount, high: highCount, medium: mediumCount, low: lowCount,
+                    total: findings.length,
+                }, null, 2) + '\n');
+            }
+            catch { /* statusline signal is best-effort */ }
             // Display results
             output.writeln();
             if (findings.length > 0) {

package/v3/@swarmdo/cli/dist/src/commands/transcript.js

@@ -9,6 +9,7 @@
  * unit-tested; reuses the usage transcript infra).
  */
 import * as fs from 'node:fs';
+import { parseQuery, searchLines, rankMatches } from '../transcript/search.js';
 import { output } from '../output.js';
 import { listSessions, exportSession } from '../transcript/export.js';
 function fmtAge(mtimeMs, nowMs) {
@@ -108,11 +109,91 @@ const exportCommand = {
         return { success: true, data: { turns: res.turns, sessionId: res.sessionId } };
     },
 };
+// Full-text search across session transcripts ("which session did I discuss X in?")
+const searchCommand = {
+    name: 'search',
+    description: 'Search what you and Claude actually said across all session transcripts',
+    options: [
+        { name: 'limit', short: 'n', type: 'number', description: 'sessions to show', default: 10 },
+        { name: 'json', type: 'boolean', description: 'machine-readable output', default: false },
+    ],
+    examples: [
+        { command: 'swarmdo transcript search obsidian vault', description: 'Sessions mentioning both terms (AND)' },
+        { command: 'swarmdo tx search "npm publish" -n 5', description: 'Top 5 sessions about npm publish' },
+    ],
+    action: async (ctx) => {
+        const fs = await import('node:fs');
+        const { defaultClaudeProjectDirs, findTranscriptFiles } = await import('../usage/transcript-usage.js');
+        const { sessionIdFromFile } = await import('../transcript/export.js');
+        let terms;
+        try {
+            terms = parseQuery(ctx.args.slice(1).join(' '));
+        }
+        catch {
+            output.printError('usage: swarmdo transcript search <terms…>');
+            return { success: false, exitCode: 1 };
+        }
+        const matches = [];
+        let scanned = 0;
+        for (const dir of defaultClaudeProjectDirs()) {
+            for (const { file, project } of findTranscriptFiles(dir)) {
+                scanned++;
+                let raw;
+                try {
+                    raw = fs.readFileSync(file, 'utf8');
+                }
+                catch {
+                    continue;
+                }
+                const lines = raw.split('\n').flatMap((l) => {
+                    if (!l.trim())
+                        return [];
+                    try {
+                        return [JSON.parse(l)];
+                    }
+                    catch {
+                        return [];
+                    }
+                });
+                const { hits, snippets } = searchLines(lines, terms);
+                if (hits > 0) {
+                    let mtimeMs = 0;
+                    try {
+                        mtimeMs = fs.statSync(file).mtimeMs;
+                    }
+                    catch { /* keep 0 */ }
+                    matches.push({ sessionId: sessionIdFromFile(file), project, mtimeMs, hits, snippets });
+                }
+            }
+        }
+        const ranked = rankMatches(matches).slice(0, Number(ctx.flags.limit) || 10);
+        if (ctx.flags.json === true) {
+            output.printJson({ query: terms, scanned, matched: matches.length, sessions: ranked });
+            return { success: true, data: ranked };
+        }
+        if (ranked.length === 0) {
+            output.writeln(output.dim(`no sessions matched "${terms.join(' ')}" (${scanned} transcripts scanned)`));
+            return { success: true, exitCode: 0 };
+        }
+        output.writeln(output.bold(`${matches.length} session(s) match "${terms.join(' ')}"`) + output.dim(`  — ${scanned} transcripts scanned`));
+        for (const m of ranked) {
+            const when = m.mtimeMs ? new Date(m.mtimeMs).toISOString().slice(0, 16).replace('T', ' ') : '?';
+            output.writeln('');
+            output.writeln(`${output.info(m.sessionId.slice(0, 8))}  ${output.dim(when)}  ${m.hits} hit${m.hits === 1 ? '' : 's'}  ${output.dim(m.project)}`);
+            for (const sn of m.snippets) {
+                output.writeln(`   ${sn.role === 'user' ? '👤' : '🤖'} ${sn.snippet}`);
+            }
+        }
+        output.writeln('');
+        output.writeln(output.dim('open one:  swarmdo transcript export -s <id-prefix>'));
+        return { success: true, data: ranked };
+    },
+};
 export const transcriptCommand = {
     name: 'transcript',
     aliases: ['tx'],
     description: 'Export Claude Code sessions to readable Markdown (list/export)',
-    subcommands: [listCommand, exportCommand],
+    subcommands: [listCommand, exportCommand, searchCommand],
     options: [],
     examples: [
         { command: 'swarmdo transcript list', description: 'Recent sessions, newest first' },

package/v3/@swarmdo/cli/dist/src/commands/usage.js

@@ -17,6 +17,7 @@ import { aggregateBlocks, aggregateUsage, collectUsage, totalUsage, localDateKey
 import { collectToolErrors } from '../usage/transcript-errors.js';
 import { computeCacheStats } from '../usage/cache-stats.js';
 import { evaluateGuard } from '../usage/spend-guard.js';
+import { resolvePeriodPair, parseRange, diffPeriods, modelMovers } from '../usage/diff.js';
 const VIEWS = {
     daily: { dimension: 'day', label: 'Date' },
     monthly: { dimension: 'month', label: 'Month' },
@@ -232,6 +233,79 @@ function runCacheView(ctx, collection) {
     output.writeln(output.dim('"From cache" = share of input tokens served as cache reads (0.1x cost); higher is cheaper.'));
     return { success: true, exitCode: 0 };
 }
+/** Diff view — compare two periods (day|week|month presets or explicit
+ * --a/--b YYYY-MM-DD:YYYY-MM-DD ranges): totals, deltas, per-model movers. */
+function runDiffView(ctx, collection) {
+    const kind = (ctx.args[1] || 'week').toLowerCase();
+    let a;
+    let b;
+    try {
+        if (typeof ctx.flags.a === 'string' || typeof ctx.flags.b === 'string') {
+            if (typeof ctx.flags.a !== 'string' || typeof ctx.flags.b !== 'string') {
+                output.printError('explicit ranges need BOTH --a and --b (YYYY-MM-DD:YYYY-MM-DD)');
+                return { success: false, exitCode: 1 };
+            }
+            a = parseRange(ctx.flags.a, 'A');
+            b = parseRange(ctx.flags.b, 'B');
+        }
+        else {
+            ({ a, b } = resolvePeriodPair(kind, localDateKey(new Date())));
+        }
+    }
+    catch (e) {
+        output.printError(e.message);
+        return { success: false, exitCode: 1 };
+    }
+    const dayRows = aggregateUsage(collection.events, 'day').map((r) => ({ key: r.key, totals: r.totals }));
+    const report = diffPeriods(dayRows, a, b);
+    // per-(model, day) fold for the movers table
+    const md = new Map();
+    for (const e of collection.events) {
+        const k = `${e.model}\u0000${e.dateKey}`;
+        const row = md.get(k) ?? { key: e.model, day: e.dateKey, totals: { costUsd: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0, totalTokens: 0 } };
+        row.totals.costUsd += e.costUsd;
+        row.totals.totalTokens += e.inputTokens + e.outputTokens + e.cacheWriteTokens + e.cacheReadTokens;
+        md.set(k, row);
+    }
+    const movers = modelMovers([...md.values()], a, b);
+    if (ctx.flags.json === true) {
+        output.printJson({ ...report, movers });
+        return { success: true, data: { ...report, movers } };
+    }
+    const pct = (m) => (m.pct === null ? 'new' : `${m.pct >= 0 ? '+' : ''}${Math.round(m.pct * 100)}%`);
+    const sign = (n, f) => `${n >= 0 ? '+' : '−'}${f(Math.abs(n))}`;
+    output.writeln(output.bold(`Usage diff  ${a.label}  vs  ${b.label}`) + output.dim(`   (${a.from}..${a.to} vs ${b.from}..${b.to})`));
+    output.printTable({
+        columns: [
+            { key: 'metric', header: 'Metric', width: 14 },
+            { key: 'a', header: a.label.slice(0, 14), width: 14, align: 'right' },
+            { key: 'b', header: b.label.slice(0, 14), width: 14, align: 'right' },
+            { key: 'delta', header: 'Δ', width: 14, align: 'right' },
+            { key: 'pct', header: '%', width: 7, align: 'right' },
+        ],
+        data: [
+            { metric: 'Cost', a: fmtCost(report.cost.a), b: fmtCost(report.cost.b), delta: sign(report.cost.delta, fmtCost), pct: pct(report.cost) },
+            { metric: 'Tokens', a: fmtInt(report.totalTokens.a), b: fmtInt(report.totalTokens.b), delta: sign(report.totalTokens.delta, fmtInt), pct: pct(report.totalTokens) },
+            { metric: 'Output tok', a: fmtInt(report.outputTokens.a), b: fmtInt(report.outputTokens.b), delta: sign(report.outputTokens.delta, fmtInt), pct: pct(report.outputTokens) },
+            { metric: 'Cache reads', a: fmtInt(report.cacheReadTokens.a), b: fmtInt(report.cacheReadTokens.b), delta: sign(report.cacheReadTokens.delta, fmtInt), pct: pct(report.cacheReadTokens) },
+            { metric: 'Active days', a: String(report.activeDays.a), b: String(report.activeDays.b), delta: sign(report.activeDays.delta, String), pct: pct(report.activeDays) },
+        ],
+    });
+    if (movers.length > 0) {
+        output.writeln(output.bold('Model movers') + output.dim('  (by |Δ cost|)'));
+        output.printTable({
+            columns: [
+                { key: 'model', header: 'Model', width: 34 },
+                { key: 'a', header: 'A', width: 12, align: 'right' },
+                { key: 'b', header: 'B', width: 12, align: 'right' },
+                { key: 'delta', header: 'Δ', width: 12, align: 'right' },
+                { key: 'pct', header: '%', width: 7, align: 'right' },
+            ],
+            data: movers.map((m) => ({ model: m.model, a: fmtCost(m.cost.a), b: fmtCost(m.cost.b), delta: sign(m.cost.delta, fmtCost), pct: pct(m.cost) })),
+        });
+    }
+    return { success: true, data: { ...report, movers } };
+}
 /** Build a threshold from a --flag or its SWARMDO_GUARD_* env fallback. */
 function guardThreshold(ctx, flagKey, envKey, current, label, unit) {
     const raw = ctx.flags[flagKey] ?? process.env[envKey];
@@ -330,9 +404,14 @@ async function run(ctx) {
         const dirs = typeof dirFlag === 'string' ? [dirFlag] : Array.isArray(dirFlag) ? dirFlag.map(String) : undefined;
         return runGuardView(ctx, collectUsage({ dirs }));
     }
+    if (viewName === 'diff') {
+        const dirFlag = ctx.flags.dir;
+        const dirs = typeof dirFlag === 'string' ? [dirFlag] : Array.isArray(dirFlag) ? dirFlag.map(String) : undefined;
+        return runDiffView(ctx, collectUsage({ dirs }));
+    }
     const view = VIEWS[viewName];
     if (!view) {
-        output.writeln(output.error(`unknown view: ${viewName} (expected ${Object.keys(VIEWS).join('|')}|blocks|errors|cache|guard)`));
+        output.writeln(output.error(`unknown view: ${viewName} (expected ${Object.keys(VIEWS).join('|')}|blocks|errors|cache|guard|diff)`));
         return { success: false, exitCode: 1 };
     }
     const since = typeof ctx.flags.since === 'string' ? ctx.flags.since : undefined;

package/v3/@swarmdo/cli/dist/src/config-lint/lint.js

@@ -11,7 +11,8 @@
 const f = (file, severity, rule, message) => ({ file, severity, rule, message });
 export const TOPOLOGIES = ['hierarchical', 'mesh', 'hierarchical-mesh', 'ring', 'star', 'hybrid', 'adaptive'];
 export const MEMORY_BACKENDS = ['agentdb', 'sqlite', 'hybrid', 'memory'];
-export const KNOWN_CONFIG_KEYS = ['topology', 'maxAgents', 'strategy', 'consensus', 'memory', 'memoryBackend', 'hnsw', 'neural', 'embeddings', 'providers', 'mcp', 'logging', 'daemon', 'hooks', 'version', '$schema'];
+import { parseOpenRouterConfig } from '../providers/openrouter-config.js';
+export const KNOWN_CONFIG_KEYS = ['topology', 'maxAgents', 'strategy', 'consensus', 'memory', 'memoryBackend', 'hnsw', 'neural', 'embeddings', 'providers', 'mcp', 'logging', 'daemon', 'hooks', 'version', 'openrouter', '$schema'];
 export const HOOK_EVENTS = [
     'PreToolUse', 'PostToolUse', 'UserPromptSubmit', 'Notification', 'Stop', 'SubagentStop',
     'SessionStart', 'SessionEnd', 'PreCompact', 'TeammateIdle', 'TaskCompleted', 'PermissionDecision',
@@ -39,6 +40,15 @@ export function lintSwarmdoConfig(file, obj) {
     for (const key of Object.keys(c)) {
         if (!KNOWN_CONFIG_KEYS.includes(key))
             out.push(f(file, 'warn', 'unknown-key', `unknown key "${key}" (known: ${KNOWN_CONFIG_KEYS.filter(k => k !== '$schema').join(', ')})`));
+        if (key === 'openrouter') {
+            // reuse the runtime parser so lint findings and runtime behavior can't drift
+            const { config: orCfg, warnings } = parseOpenRouterConfig(c.openrouter);
+            for (const w of warnings)
+                out.push(f(file, 'warn', 'openrouter-config', w));
+            if (orCfg.enabled && orCfg.models.length === 0 && !orCfg.defaultModel) {
+                out.push(f(file, 'warn', 'openrouter-config', 'openrouter.enabled=true but no valid models[] or defaultModel — swarms have nothing to select from'));
+            }
+        }
     }
     if (c.topology !== undefined && !TOPOLOGIES.includes(String(c.topology))) {
         out.push(f(file, 'error', 'bad-topology', `topology "${String(c.topology)}" is not one of: ${TOPOLOGIES.join(', ')}`));

package/v3/@swarmdo/cli/dist/src/init/statusline-generator.js

@@ -384,7 +384,7 @@ function buildLocalFallback() {
   return applyLocalOverlays({
     user: { name: 'user', gitBranch: '', modelName: 'Claude Code' },
     v3Progress: { domainsCompleted: 0, totalDomains: 5, dddProgress: 0, patternsLearned: 0, sessionsCompleted: 0 },
-    security: { status: 'NONE', cvesFixed: 0, totalCves: 0 },
+    security: { status: 'NONE', critical: 0, high: 0, total: 0 },
     swarm: { activeAgents: 0, maxAgents: CONFIG.maxAgents, coordinationActive: false },
     system: { memoryMB: memMB, contextPct: 0, intelligencePct: 0, subAgents: 0 },
     lastUpdated: new Date().toISOString(),
@@ -652,9 +652,9 @@ function generateStatusline() {
   const intelligencePct = system.intelligencePct || 0;
   const memoryMB = system.memoryMB || 0;
   const subAgents = system.subAgents || 0;
-  const cvesFixed = security.cvesFixed || 0;
-  const totalCves = security.totalCves || 0;
+  const secCritHigh = (security.critical || 0) + (security.high || 0);
   const secStatus = security.status || 'NONE';
+  const secLabel = secStatus === 'VULN' ? 'sec ' + secCritHigh + '!' : secStatus === 'CLEAN' ? 'sec ✓' : secStatus === 'STALE' ? 'sec stale' : 'sec —';
   const adrCount = adrs.count || 0;
   const adrImpl = adrs.implemented || 0;
   const hooksEnabled = hooks.enabled || 0;
@@ -720,8 +720,8 @@ function generateStatusline() {
   // Line 2: Swarm + Hooks + CVE + Memory + Intelligence
   const swarmInd = coordinationActive ? c.brightGreen + '◉' + c.reset : c.dim + '○' + c.reset;
   const agentsColor = activeAgents > 0 ? c.brightGreen : c.red;
-  const secIcon = secStatus === 'CLEAN' ? '🟢' : (secStatus === 'IN_PROGRESS' || secStatus === 'STALE') ? '🟡' : (secStatus === 'NONE' ? '⚪' : '🔴');
-  const secColor = secStatus === 'CLEAN' ? c.brightGreen : (secStatus === 'IN_PROGRESS' || secStatus === 'STALE') ? c.brightYellow : (secStatus === 'NONE' ? c.dim : c.brightRed);
+  const secIcon = secStatus === 'CLEAN' ? '🟢' : secStatus === 'STALE' ? '🟡' : (secStatus === 'NONE' ? '⚪' : '🔴');
+  const secColor = secStatus === 'CLEAN' ? c.brightGreen : secStatus === 'STALE' ? c.brightYellow : (secStatus === 'NONE' ? c.dim : c.brightRed);
   const hooksColor = hooksEnabled > 0 ? c.brightGreen : c.dim;
   const intellColor = intelligencePct >= 80 ? c.brightGreen : intelligencePct >= 40 ? c.brightYellow : c.dim;
 
@@ -729,7 +729,7 @@ function generateStatusline() {
     c.brightYellow + '🤖 Swarm' + c.reset + '  ' + swarmInd + ' [' + agentsColor + String(activeAgents).padStart(2) + c.reset + '/' + c.brightWhite + maxAgents + c.reset + ']  ' +
     c.brightPurple + '👥 ' + subAgents + c.reset + '    ' +
     c.brightBlue + '🪝 ' + hooksColor + hooksEnabled + c.reset + '/' + c.brightWhite + hooksTotal + c.reset + '    ' +
-    secIcon + ' ' + secColor + 'CVE ' + cvesFixed + c.reset + '/' + c.brightWhite + totalCves + c.reset + '    ' +
+    secIcon + ' ' + secColor + secLabel + c.reset + '    ' +
     c.brightCyan + '💾 ' + memoryMB + 'MB' + c.reset + '    ' +
     intellColor + '🧠 ' + String(intelligencePct).padStart(3) + '%' + c.reset
   );

package/v3/@swarmdo/cli/dist/src/integrations/integrations.d.ts

@@ -0,0 +1,54 @@
+/**
+ * integrations.ts — wire swarmdo into agent CLIs beyond Claude Code.
+ *
+ * Targets: OpenAI Codex CLI, GitHub Copilot CLI, pi. Two standards do the
+ * heavy lifting: AGENTS.md (the cross-agent instructions file all three
+ * read) and MCP (swarmdo already ships a stdio server — `swarmdo mcp
+ * start`). Each merge below is PURE (string/JSON in → out), additive, and
+ * idempotent, so the whole surface is unit-testable and re-running install
+ * never duplicates or clobbers.
+ *
+ * INVARIANT (do-not-break-Claude): nothing in this module produces content
+ * for `.claude/**`, `.mcp.json`, or `CLAUDE.md` — the Claude Code surfaces
+ * are owned by init/mcp-generator and are only ever READ for status here.
+ */
+export declare const MCP_COMMAND = "npx";
+export declare const MCP_ARGS: string[];
+/** Codex CLI (~/.codex/config.toml): add the marked [mcp_servers.swarmdo]
+ * block when absent. Existing content — including a user's own hand-written
+ * swarmdo server — is left untouched. */
+export declare function mergeCodexToml(existing: string | null): {
+    content: string;
+    changed: boolean;
+};
+/** Copilot CLI (~/.copilot/mcp-config.json): same mcpServers schema Claude
+ * uses. Adds the swarmdo entry when absent; other servers preserved. */
+export declare function mergeCopilotMcpJson(existing: string | null): {
+    content: string;
+    changed: boolean;
+};
+/** Cross-agent AGENTS.md for projects that don't have one. Existing files
+ * are never rewritten (report-only) — teams own their AGENTS.md. */
+export declare function crossAgentAgentsMd(): string;
+/** .github/copilot-instructions.md — Copilot reads this per-repo. Kept as a
+ * thin pointer so AGENTS.md stays the single source of truth. */
+export declare function copilotInstructionsMd(): string;
+export type IntegrationTarget = 'codex' | 'copilot' | 'pi' | 'claude';
+export declare const INSTALLABLE: IntegrationTarget[];
+export interface TargetStatus {
+    target: IntegrationTarget;
+    ok: boolean;
+    details: string[];
+}
+/** Pure status evaluation over pre-read file contents (null = absent). */
+export declare function evaluateStatus(files: {
+    agentsMd: string | null;
+    codexToml: string | null;
+    copilotJson: string | null;
+    copilotInstructions: string | null;
+    claudeMcpJson: string | null;
+    /** ~/.claude.json — Claude Code's user-level config (claude mcp add) */
+    claudeUserJson?: string | null;
+    claudeDirExists: boolean;
+}): TargetStatus[];
+//# sourceMappingURL=integrations.d.ts.map