swarmdo 1.54.1 → 1.58.1

package/v3/@swarmdo/cli/dist/src/init/statusline-generator.js

@@ -166,7 +166,7 @@ function resolveCliBin() {
     ];
     try {
       const binDir = path.dirname(process.execPath);
-      const globalModuleDirs = [path.join(binDir, '..', 'lib', 'node_modules'), path.join(binDir, 'node_modules')];
+      const globalModuleDirs = [path.join(binDir, '..', 'lib', 'node_modules'), path.join(binDir, 'node_modules'), '/opt/homebrew/lib/node_modules', '/usr/local/lib/node_modules'];
       for (const prefix of [process.env.npm_config_prefix, process.env.PREFIX, path.join(home, '.npm-global')]) {
         if (prefix) globalModuleDirs.push(path.join(prefix, 'lib', 'node_modules'));
       }
@@ -209,6 +209,13 @@ function writeCache(data) {
  * and only counted ADRs in v3/implementation/adrs/ (missed v3/docs/adr/).
  */
 function getStatuslineData() {
+  // SWARMDO_STATUSLINE_NO_CLI: skip the CLI-delegation fork and render from local
+  // reads + stdin only. A cold render otherwise forks the hooks-statusline CLI
+  // (now more reachable via the global-node_modules probes below), and that fork
+  // can disturb the stdin cost payload; skipping it keeps renders fast, hermetic,
+  // and subprocess-free. Set by the statusline tests; usable by anyone who wants
+  // a no-fork statusline.
+  if (process.env.SWARMDO_STATUSLINE_NO_CLI) return buildLocalFallback();
   const cached = readCache();
   if (cached) return cached;
 
@@ -592,7 +599,7 @@ function getPkgVersion() {
     // (bin/node_modules) layouts.
     try {
       const binDir = path.dirname(process.execPath);
-      const globalModuleDirs = [path.join(binDir, '..', 'lib', 'node_modules'), path.join(binDir, 'node_modules')];
+      const globalModuleDirs = [path.join(binDir, '..', 'lib', 'node_modules'), path.join(binDir, 'node_modules'), '/opt/homebrew/lib/node_modules', '/usr/local/lib/node_modules'];
       // #2221 follow-up: a custom npm prefix (e.g. ~/.npm-global) is decoupled from
       // the node binary location, so the binDir-derived probes above all miss. Also
       // probe the npm prefix from the environment and the common ~/.npm-global default.

package/v3/@swarmdo/cli/dist/src/integrations/integrations.js

@@ -63,23 +63,34 @@ export function crossAgentAgentsMd() {
 ## What swarmdo gives you
 
 This project is wired to **swarmdo** — agent orchestration with persistent
-vector memory, swarm coordination, and 300+ MCP tools.
+vector memory, swarm coordination, cross-agent messaging, and 300+ MCP tools.
+Everything below works the same from Codex, Copilot, pi, or a plain shell —
+not just Claude Code.
 
-- **MCP server**: \`swarmdo mcp start\` (stdio). If your CLI supports MCP,
-  \`swarmdo integrations install <your-cli>\` wires it; key tools:
-  \`memory_search\`, \`memory_store\`, \`swarm_init\`, \`agent_spawn\`.
+- **MCP server**: \`swarmdo mcp start\` (stdio; serves every tool by default).
+  If your CLI supports MCP, \`swarmdo integrations install <your-cli>\` wires
+  it. Key tools: \`memory_search\`, \`memory_store\`, \`swarm_init\`,
+  \`agent_spawn\`, \`comms_send\` / \`comms_inbox\` (message other agents),
+  \`hotspots\` / \`coupling\` / \`ownership\` (git-history analysis).
 - **CLI**: \`npx swarmdo@latest <command>\` — \`memory search -q "topic"\`,
-  \`usage\`, \`task\`, \`hud\`, \`security scan\`, \`config lint\`.
+  \`comms send\` / \`comms inbox\`, \`standup\`, \`hotspots\`, \`coupling\`,
+  \`ownership\`, \`hidden-coupling\`, \`task\`, \`hud\`.
 
 ## Working agreement (any agent)
 
 1. **Search memory BEFORE starting**: \`memory_search(query="task keywords")\`
    — patterns with score > 0.7 are load-bearing precedent.
-2. **You are the executor** — swarmdo coordinates and remembers; it never
+2. **Coordinate through the cross-tool mailbox**: announce the files you're
+   about to change with \`comms_send(to="all", message="…")\` and check
+   \`comms_inbox\` before overlapping work. Non-Claude agents: set a stable
+   identity with \`export SWARMDO_AGENT=<your-name>\` (or pass \`from\` /
+   \`--self\`) so replies address you — without it every agent on this host
+   shares the hostname identity.
+3. **You are the executor** — swarmdo coordinates and remembers; it never
    writes your code for you.
-3. **Store what worked AFTER success**:
+4. **Store what worked AFTER success**:
    \`memory_store(key="pattern-…", value="what worked", namespace="patterns")\`.
-4. Claude Code users: the same surfaces are namespaced under \`/sDo:\`
+5. Claude Code users: the same surfaces are namespaced under \`/sDo:\`
    commands and \`/sdo-\` skills.
 
 ## Do not

package/v3/@swarmdo/cli/dist/src/mcp-tools/comms-tools.js

@@ -12,7 +12,7 @@ import { loadMailbox, saveMailbox, resolveSelf, newMessageId, RETENTION } from '
 export const commsTools = [
     {
         name: 'comms_send',
-        description: 'Send a message to another Claude Code session working on the same repo (cross-session mailbox). Address "all" to broadcast to every session. Use for multi-session/"multiplayer" coordination; delivery is via a shared file, not the network.',
+        description: 'Send a message to another agent session — Claude Code, Codex, Copilot, pi, or any tool on the same repo (a cross-session/cross-tool mailbox). Address "all" to broadcast to every session. Use for multi-agent "multiplayer" coordination; delivery is via a shared file, not the network.',
         category: 'comms',
         inputSchema: {
             type: 'object',
@@ -20,7 +20,7 @@ export const commsTools = [
                 to: { type: 'string', description: 'Recipient session name, or "all" to broadcast' },
                 message: { type: 'string', description: 'Message body' },
                 subject: { type: 'string', description: 'Optional subject line' },
-                from: { type: 'string', description: 'Sender name (default: this session — $SWARMDO_SESSION or hostname)' },
+                from: { type: 'string', description: 'Sender name. Default: this session ($SWARMDO_SESSION, else $SWARMDO_AGENT, else hostname). Non-Claude agents should pass this (or export $SWARMDO_AGENT) so replies address them, not the shared hostname.' },
             },
             required: ['to', 'message'],
         },
@@ -49,12 +49,12 @@ export const commsTools = [
     },
     {
         name: 'comms_inbox',
-        description: 'List messages other sessions have sent to this session (cross-session mailbox), newest first. Includes "all" broadcasts. Set markRead to acknowledge them.',
+        description: 'List messages other agent sessions (Claude Code, Codex, Copilot, pi, …) have sent to this one — a cross-session/cross-tool mailbox — newest first. Includes "all" broadcasts. Set markRead to acknowledge them.',
         category: 'comms',
         inputSchema: {
             type: 'object',
             properties: {
-                to: { type: 'string', description: 'Whose inbox (default: this session)' },
+                to: { type: 'string', description: 'Whose inbox (default: this session — $SWARMDO_SESSION, else $SWARMDO_AGENT, else hostname)' },
                 unreadOnly: { type: 'boolean', description: 'Only unread messages' },
                 from: { type: 'string', description: 'Only messages from this sender' },
                 since: { type: 'string', description: 'Only messages after this ISO-8601 timestamp' },

package/v3/@swarmdo/cli/dist/src/usage/transcript-friction.d.ts

@@ -0,0 +1,77 @@
+/**
+ * transcript-friction.ts — interruption + error-category analytics over the same
+ * Claude Code transcripts the `usage` command already reads. `usage errors`
+ * answers "which tools fail"; this answers "where does Claude waste my turns" —
+ * how often you interrupt it (ESC mid-turn), which tool was running when you did,
+ * and what KIND of errors dominate (NotFound/Permission/Timeout/Network/Syntax).
+ * The interruption axis + human-meaningful error categories are the sniffly
+ * (chiphuyen, 1.2k★) headline signals `usage errors` left on the table (#102).
+ *
+ * The fold is pure and unit-tested; only collectFriction touches the filesystem.
+ * Reuses blockText / ParsedLine (transcript-errors) + the transcript plumbing.
+ */
+import { type ParsedLine } from './transcript-errors.js';
+export type ErrorCategory = 'NotFound' | 'Permission' | 'Timeout' | 'Network' | 'Syntax' | 'Other';
+export declare const ERROR_CATEGORIES: ErrorCategory[];
+export interface ToolInterruptions {
+    /** tool name that was running when interrupted, or '(idle)' when none was */
+    tool: string;
+    interruptions: number;
+}
+export interface CategoryShare {
+    category: ErrorCategory;
+    count: number;
+    /** count / totalErrors, 0..1 (0 when no errors) */
+    share: number;
+}
+export interface FrictionReport {
+    interruptions: number;
+    assistantTurns: number;
+    /** interruptions / assistantTurns, 0 when no turns (never divides by zero) */
+    interruptionRate: number;
+    byTool: ToolInterruptions[];
+    categories: CategoryShare[];
+    totalErrors: number;
+    filesScanned: number;
+}
+/** Bucket used when an interruption happened outside any running tool. */
+export declare const IDLE_CONTEXT = "(idle)";
+/**
+ * Does a user-role text block read as an ESC interruption sentinel? Matches the
+ * whole family at the START of the text (real transcripts show "[Request
+ * interrupted by user]", "… for tool use]", "…]", and bare "Request
+ * interrupted") — anchored so an incidental mid-sentence mention doesn't count.
+ */
+export declare function isInterruptionText(text: string): boolean;
+/**
+ * Map a tool-error message to a human-meaningful category. Order matters:
+ * specific buckets come before the broad Syntax catch so e.g. "no such file"
+ * lands in NotFound, not Syntax. Everything unmatched is Other. Pure.
+ */
+export declare function classifyError(raw: string): ErrorCategory;
+export interface FrictionAccum {
+    interruptions: number;
+    assistantTurns: number;
+    byTool: Map<string, number>;
+    categories: Map<ErrorCategory, number>;
+    totalErrors: number;
+    /** open tool_use id → name; cleared on its result, or on an interruption */
+    openTools: Map<string, string>;
+    /** most recent tool_use name (open or already-resolved); reset per turn on an
+     * interruption. Used to attribute a "…for tool use]" sentinel even after the
+     * interrupted tool's (often synthetic) result already landed. */
+    lastToolName: string | null;
+}
+export declare function newFrictionAccum(): FrictionAccum;
+/** Fold one parsed transcript line into the accumulator. Pure (no fs). */
+export declare function foldFriction(acc: FrictionAccum, line: ParsedLine): void;
+export declare function finalizeFriction(acc: FrictionAccum, filesScanned: number): FrictionReport;
+export interface CollectFrictionOptions {
+    dirs?: string[];
+    since?: string;
+    until?: string;
+}
+/** Walk transcripts and produce the friction report. Malformed lines and
+ * unreadable files are skipped, never fatal (same discipline as collectUsage). */
+export declare function collectFriction(opts?: CollectFrictionOptions): FrictionReport;
+//# sourceMappingURL=transcript-friction.d.ts.map

package/v3/@swarmdo/cli/dist/src/usage/transcript-friction.js

@@ -0,0 +1,151 @@
+/**
+ * transcript-friction.ts — interruption + error-category analytics over the same
+ * Claude Code transcripts the `usage` command already reads. `usage errors`
+ * answers "which tools fail"; this answers "where does Claude waste my turns" —
+ * how often you interrupt it (ESC mid-turn), which tool was running when you did,
+ * and what KIND of errors dominate (NotFound/Permission/Timeout/Network/Syntax).
+ * The interruption axis + human-meaningful error categories are the sniffly
+ * (chiphuyen, 1.2k★) headline signals `usage errors` left on the table (#102).
+ *
+ * The fold is pure and unit-tested; only collectFriction touches the filesystem.
+ * Reuses blockText / ParsedLine (transcript-errors) + the transcript plumbing.
+ */
+import * as fs from 'node:fs';
+import { defaultClaudeProjectDirs, findTranscriptFiles, normalizeDateBound } from './transcript-usage.js';
+import { blockText } from './transcript-errors.js';
+export const ERROR_CATEGORIES = ['NotFound', 'Permission', 'Timeout', 'Network', 'Syntax', 'Other'];
+/** Bucket used when an interruption happened outside any running tool. */
+export const IDLE_CONTEXT = '(idle)';
+/**
+ * Does a user-role text block read as an ESC interruption sentinel? Matches the
+ * whole family at the START of the text (real transcripts show "[Request
+ * interrupted by user]", "… for tool use]", "…]", and bare "Request
+ * interrupted") — anchored so an incidental mid-sentence mention doesn't count.
+ */
+export function isInterruptionText(text) {
+    return /^\s*\[?\s*request interrupted/i.test(text);
+}
+/**
+ * Map a tool-error message to a human-meaningful category. Order matters:
+ * specific buckets come before the broad Syntax catch so e.g. "no such file"
+ * lands in NotFound, not Syntax. Everything unmatched is Other. Pure.
+ */
+export function classifyError(raw) {
+    const s = raw.toLowerCase();
+    if (/\bnot found\b|no such file|enoent|does not exist|cannot find|doesn'?t exist|\b404\b/.test(s))
+        return 'NotFound';
+    if (/permission denied|\beacces\b|\beperm\b|not permitted|unauthori[sz]ed|forbidden|\b403\b/.test(s))
+        return 'Permission';
+    if (/timed ?out|\betimedout\b|timeout|deadline exceeded/.test(s))
+        return 'Timeout';
+    if (/econnrefused|econnreset|enotfound|network|socket hang|getaddrinfo|fetch failed|\bdns\b/.test(s))
+        return 'Network';
+    if (/syntax|parse error|unexpected token|invalid |compil|typeerror|referenceerror|cannot read propert/.test(s))
+        return 'Syntax';
+    return 'Other';
+}
+export function newFrictionAccum() {
+    return { interruptions: 0, assistantTurns: 0, byTool: new Map(), categories: new Map(), totalErrors: 0, openTools: new Map(), lastToolName: null };
+}
+/** Fold one parsed transcript line into the accumulator. Pure (no fs). */
+export function foldFriction(acc, line) {
+    const role = line.message?.role;
+    if (role === 'assistant')
+        acc.assistantTurns++;
+    const content = line.message?.content;
+    if (!Array.isArray(content))
+        return;
+    for (const b of content) {
+        if (!b || typeof b !== 'object')
+            continue;
+        if (b.type === 'tool_use' && b.id && b.name) {
+            acc.openTools.set(b.id, b.name);
+            acc.lastToolName = b.name;
+        }
+        else if (b.type === 'tool_result') {
+            if (b.tool_use_id)
+                acc.openTools.delete(b.tool_use_id);
+            if (b.is_error) {
+                acc.totalErrors++;
+                const cat = classifyError(blockText(b.content));
+                acc.categories.set(cat, (acc.categories.get(cat) ?? 0) + 1);
+            }
+        }
+        else if (b.type === 'text' && role === 'user' && typeof b.text === 'string' && isInterruptionText(b.text)) {
+            acc.interruptions++;
+            // Attribute to: a still-open tool (interrupted mid-execution) → else, when
+            // the sentinel says "for tool use", the last tool used even if its
+            // (synthetic) result already landed → else idle.
+            const open = [...acc.openTools.values()];
+            const tool = open.length > 0
+                ? open[open.length - 1]
+                : /for tool use/i.test(b.text) && acc.lastToolName
+                    ? acc.lastToolName
+                    : IDLE_CONTEXT;
+            acc.byTool.set(tool, (acc.byTool.get(tool) ?? 0) + 1);
+            acc.openTools.clear(); // an interrupt ends the pending turn
+            acc.lastToolName = null;
+        }
+    }
+}
+export function finalizeFriction(acc, filesScanned) {
+    const byTool = [...acc.byTool.entries()]
+        .map(([tool, interruptions]) => ({ tool, interruptions }))
+        .sort((a, b) => b.interruptions - a.interruptions || a.tool.localeCompare(b.tool));
+    const categories = [...acc.categories.entries()]
+        .map(([category, count]) => ({ category, count, share: acc.totalErrors > 0 ? count / acc.totalErrors : 0 }))
+        .sort((a, b) => b.count - a.count || a.category.localeCompare(b.category));
+    return {
+        interruptions: acc.interruptions,
+        assistantTurns: acc.assistantTurns,
+        interruptionRate: acc.assistantTurns > 0 ? acc.interruptions / acc.assistantTurns : 0,
+        byTool,
+        categories,
+        totalErrors: acc.totalErrors,
+        filesScanned,
+    };
+}
+/** Walk transcripts and produce the friction report. Malformed lines and
+ * unreadable files are skipped, never fatal (same discipline as collectUsage). */
+export function collectFriction(opts = {}) {
+    const dirs = opts.dirs && opts.dirs.length > 0 ? opts.dirs : defaultClaudeProjectDirs();
+    const since = normalizeDateBound(opts.since);
+    const until = normalizeDateBound(opts.until);
+    const acc = newFrictionAccum();
+    let filesScanned = 0;
+    for (const dir of dirs) {
+        for (const { file } of findTranscriptFiles(dir)) {
+            filesScanned++;
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf8');
+            }
+            catch {
+                continue;
+            }
+            for (const raw of content.split('\n')) {
+                if (!raw.trim())
+                    continue;
+                let line;
+                try {
+                    line = JSON.parse(raw);
+                }
+                catch {
+                    continue;
+                }
+                if (since || until) {
+                    const day = line.timestamp ? line.timestamp.slice(0, 10) : '';
+                    if (day) {
+                        if (since && day < since)
+                            continue;
+                        if (until && day > until)
+                            continue;
+                    }
+                }
+                foldFriction(acc, line);
+            }
+        }
+    }
+    return finalizeFriction(acc, filesScanned);
+}
+//# sourceMappingURL=transcript-friction.js.map

package/v3/@swarmdo/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swarmdo/cli",
-  "version": "1.54.1",
+  "version": "1.58.1",
   "type": "module",
   "description": "Swarmdo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code",
   "main": "dist/src/index.js",

package/v3/@swarmdo/cli-core/dist/src/index.js

@@ -103,7 +103,7 @@ Storage:
 Programmatic use:
   import { JsonMemoryBackend, runMemoryCommand } from '@swarmdo/cli-core';
 
-Track progress: https://github.com/ruvnet/swarmdo/issues/1760`);
+Track progress: the upstream project (see NOTICE)`);
         process.exit(0);
     }
     console.error(`@swarmdo/cli-core: command "${args[0]}" not yet wired into cli-core.

package/v3/@swarmdo/hooks/dist/statusline/index.d.ts

@@ -5,7 +5,7 @@
  * Provides real-time progress, metrics, and status information.
  *
  * Format matches the working .claude/statusline.sh output:
- * ▊ Swarmdo V3 ● ruvnet  │  ⎇ v3  │  Opus 4.5
+ * ▊ Swarmdo V3 ● upstream  │  ⎇ v3  │  Opus 4.5
  * ─────────────────────────────────────────────────────
  * 🏗️  DDD Domains    [●●●●●]  5/5    ⚡ 1.0x → 2.49x-7.47x
  * 🤖 Swarm  ◉ [58/15]  👥 0    🟢 CVE 3/3    💾 22282MB    📂  47%    🧠  10%
@@ -76,7 +76,7 @@ export declare class StatuslineGenerator {
      * This avoids the multi-line collision bug where Claude Code's internal status
      * (written at absolute terminal coordinates ~cols 15-25) bleeds into conversation
      *
-     * @see https://github.com/ruvnet/claude-flow/issues/985
+     * @see the upstream project (see NOTICE)
      */
     generateSingleLine(): string;
     /**
@@ -84,7 +84,7 @@ export declare class StatuslineGenerator {
      * The collision zone is columns 15-25 on the SECOND-TO-LAST line
      * We restructure output so that line has minimal/no content in that zone
      *
-     * @see https://github.com/ruvnet/claude-flow/issues/985
+     * @see the upstream project (see NOTICE)
      */
     generateSafeStatusline(): string;
     /**

package/v3/@swarmdo/hooks/dist/statusline/index.js

@@ -5,7 +5,7 @@
  * Provides real-time progress, metrics, and status information.
  *
  * Format matches the working .claude/statusline.sh output:
- * ▊ Swarmdo V3 ● ruvnet  │  ⎇ v3  │  Opus 4.5
+ * ▊ Swarmdo V3 ● upstream  │  ⎇ v3  │  Opus 4.5
  * ─────────────────────────────────────────────────────
  * 🏗️  DDD Domains    [●●●●●]  5/5    ⚡ 1.0x → 2.49x-7.47x
  * 🤖 Swarm  ◉ [58/15]  👥 0    🟢 CVE 3/3    💾 22282MB    📂  47%    🧠  10%
@@ -189,7 +189,7 @@ export class StatuslineGenerator {
      * This avoids the multi-line collision bug where Claude Code's internal status
      * (written at absolute terminal coordinates ~cols 15-25) bleeds into conversation
      *
-     * @see https://github.com/ruvnet/claude-flow/issues/985
+     * @see the upstream project (see NOTICE)
      */
     generateSingleLine() {
         if (!this.config.enabled) {
@@ -212,7 +212,7 @@ export class StatuslineGenerator {
      * The collision zone is columns 15-25 on the SECOND-TO-LAST line
      * We restructure output so that line has minimal/no content in that zone
      *
-     * @see https://github.com/ruvnet/claude-flow/issues/985
+     * @see the upstream project (see NOTICE)
      */
     generateSafeStatusline() {
         if (!this.config.enabled) {

package/v3/@swarmdo/integration/dist/__tests__/agentic-flow-agent.test.js

@@ -55,7 +55,10 @@ describe('AgenticFlowAgent', () => {
             });
             expect(result.success).toBe(true);
             expect(result.taskId).toBe('task-1');
-            expect(result.duration).toBeGreaterThan(0);
+            // ≥0, not >0: a mocked task can complete inside one Date.now() tick on
+            // fast runners — the intent is "duration was measured", not "took time"
+            expect(result.duration).toBeGreaterThanOrEqual(0);
+            expect(typeof result.duration).toBe('number');
             expect(agent.metrics?.tasksCompleted).toBe(1);
         });
         it('should update status during task execution', async () => {

package/v3/@swarmdo/neural/dist/flash-attention.d.ts

@@ -12,7 +12,7 @@
  *
  * Target: 2-5x speedup on CPU vs naive attention
  *
- * Created with love by ruv.io
+ * Created with love by swarmdo.com
  */
 export interface FlashAttentionConfig {
     /** Block size for tiling (32-64 optimal for CPU L1 cache) */

package/v3/@swarmdo/neural/dist/flash-attention.js

@@ -12,7 +12,7 @@
  *
  * Target: 2-5x speedup on CPU vs naive attention
  *
- * Created with love by ruv.io
+ * Created with love by swarmdo.com
  */
 // ============================================================================
 // Flash Attention Implementation

package/v3/@swarmdo/plugin-agent-federation/dist/plugin.js

@@ -20,7 +20,7 @@ import { PolicyEngine } from './application/policy-engine.js';
 import { getTrustLevelLabel } from './domain/entities/trust-level.js';
 // ADR-104: real wire transport via agentic-flow loader pattern.
 // ADR-120: midstream-aware loader wraps the agentic-flow loader so
-// when `midstreamer` (ruvnet/midstream) ships its production QUIC
+// when `midstreamer` (upstream/midstream) ships its production QUIC
 // build (Step 1 of ADR-120) and operators opt in with
 // MIDSTREAMER_QUIC_NATIVE=1, the federation transport auto-upgrades.
 // Until then, the wrapper transparently defers to the agentic-flow

package/v3/@swarmdo/plugin-agent-federation/dist/transport/midstream-aware-loader.js

@@ -83,7 +83,7 @@ async function probeMidstreamerTransport(config) {
     try {
         // Lazy + indirect so bundlers don't try to resolve at compile time.
         // Prefer the `midstreamer/quic` sub-path (added in midstreamer@0.3.1
-        // per upstream ruvnet/midstream#81) which exposes
+        // per upstream upstream/midstream#81) which exposes
         // `loadQuicTransport` directly without WASM init. Fall back to the
         // root `midstreamer` package for older versions that put the QUIC
         // surface on the default export.
@@ -112,7 +112,7 @@ async function probeMidstreamerTransport(config) {
     // QuicMultistream as a counter-tracking stub with no real UDP, TLS,
     // or protocol — using it would silently downgrade the federation
     // path. midstreamer@0.3.1+ ships a real QUIC transport via
-    // `midstreamer/quic` (ADR-120, Step 1 — upstream PR ruvnet/midstream#81)
+    // `midstreamer/quic` (ADR-120, Step 1 — upstream PR upstream/midstream#81)
     // and reports `isNative() === true`. Older versions either expose
     // `isStub()` returning true or omit both probes.
     if (typeof surface.isStub === 'function' && surface.isStub()) {

package/v3/@swarmdo/providers/dist/swarmvector-provider.d.ts

@@ -34,7 +34,7 @@ export declare class SwarmVectorProvider extends BaseProvider {
     protected doHealthCheck(): Promise<HealthCheckResult>;
     /**
      * Build swarmLLM native API query format
-     * See: https://github.com/ruvnet/swarmvector/tree/main/examples/swarmLLM
+     * See: the upstream project (see NOTICE)
      */
     private buildSwarmvectorQuery;
     private buildRequest;

package/v3/@swarmdo/providers/dist/swarmvector-provider.js

@@ -410,7 +410,7 @@ export class SwarmVectorProvider extends BaseProvider {
     }
     /**
      * Build swarmLLM native API query format
-     * See: https://github.com/ruvnet/swarmvector/tree/main/examples/swarmLLM
+     * See: the upstream project (see NOTICE)
      */
     buildSwarmvectorQuery(request) {
         // swarmLLM uses simple query format, not OpenAI-compatible

package/v3/@swarmdo/security/dist/input-validator.d.ts

@@ -159,14 +159,14 @@ export declare const SpawnAgentSchema: z.ZodObject<{
     timeout: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     type: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    id?: string | undefined;
     config?: Record<string, unknown> | undefined;
     timeout?: number | undefined;
+    id?: string | undefined;
 }, {
     type: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    id?: string | undefined;
     config?: Record<string, unknown> | undefined;
     timeout?: number | undefined;
+    id?: string | undefined;
 }>;
 /**
  * Task input schema
@@ -181,13 +181,13 @@ export declare const TaskInputSchema: z.ZodObject<{
     taskId: string;
     content: string;
     agentType: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    priority?: "low" | "medium" | "high" | "critical" | undefined;
+    priority?: "critical" | "high" | "medium" | "low" | undefined;
     metadata?: Record<string, unknown> | undefined;
 }, {
     taskId: string;
     content: string;
     agentType: "coder" | "reviewer" | "tester" | "planner" | "researcher" | "security-architect" | "security-auditor" | "memory-specialist" | "swarm-specialist" | "integration-architect" | "performance-engineer" | "core-architect" | "test-architect" | "queen-coordinator" | "project-coordinator";
-    priority?: "low" | "medium" | "high" | "critical" | undefined;
+    priority?: "critical" | "high" | "medium" | "low" | undefined;
     metadata?: Record<string, unknown> | undefined;
 }>;
 /**
@@ -234,16 +234,16 @@ export declare const ExecutorConfigSchema: z.ZodObject<{
     cwd: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>;
     allowSudo: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    timeout: number;
     allowedCommands: string[];
+    timeout: number;
     maxBuffer: number;
     allowSudo: boolean;
     blockedPatterns?: string[] | undefined;
     cwd?: string | undefined;
 }, {
     allowedCommands: string[];
-    timeout?: number | undefined;
     blockedPatterns?: string[] | undefined;
+    timeout?: number | undefined;
     maxBuffer?: number | undefined;
     cwd?: string | undefined;
     allowSudo?: boolean | undefined;

package/v3/@swarmdo/shared/dist/hooks/safety/git-commit.js

@@ -135,7 +135,7 @@ export class GitCommitHook {
         const result = await this.processCommitMessage(message, branchName);
         // Modify the command with the new message
         if (result.success && result.modifiedMessage !== message) {
-            const modifiedCommand = command.replace(/-m\s+["'][^"']+["']/, `-m "${result.modifiedMessage.replace(/"/g, '\\"')}"`);
+            const modifiedCommand = command.replace(/-m\s+["'][^"']+["']/, `-m "${result.modifiedMessage.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`);
             return {
                 ...result,
                 data: {

package/v3/@swarmdo/shared/dist/mcp/transport/http.js

@@ -161,7 +161,14 @@ export class HttpTransport extends EventEmitter {
     setupMiddleware() {
         // Security headers
         this.app.use(helmet({
-            contentSecurityPolicy: false, // Allow for flexibility
+            // JSON-RPC API serves no HTML, so a strict CSP is inert for responses but
+            // satisfies js/insecure-helmet-configuration (disabling CSP is flagged).
+            contentSecurityPolicy: {
+                directives: {
+                    defaultSrc: ["'none'"],
+                    frameAncestors: ["'none'"],
+                },
+            },
         }));
         // CORS - Secure defaults (no wildcard in production)
         if (this.config.corsEnabled !== false) {

package/.claude/settings.local.json

@@ -1,7 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(gh run *)"
-    ]
-  }
-}

package/v3/@swarmdo/plugin-iot-cognitum/dist/application/index.d.ts

@@ -1,2 +0,0 @@
-export { IoTCoordinator, type IoTCoordinatorConfig, type IoTCoordinatorCallbacks, } from './iot-coordinator.js';
-//# sourceMappingURL=index.d.ts.map

package/v3/@swarmdo/plugin-iot-cognitum/dist/application/index.js

@@ -1,2 +0,0 @@
-export { IoTCoordinator, } from './iot-coordinator.js';
-//# sourceMappingURL=index.js.map