swarmdo 1.58.6 → 1.58.15

package/.claude/commands/sDo/security.md

@@ -0,0 +1,44 @@
+---
+description: Scan this project's security and refresh the statusline Security segment
+argument-hint: "[scan|full|cve|audit|report] (default: scan)"
+allowed-tools: Bash(npx swarmdo security:*), Bash(node v3/@swarmdo/cli/bin/cli.js security:*)
+---
+
+# /security — scan security posture + refresh the statusline
+
+Run the swarmdo security scanner and refresh the `Security` element of the
+statusline. The statusline reads the cached result from
+`.swarmdo/security/last-scan.json`; a scan rewrites it with a fresh `scannedAt`
+plus current counts, so the `Security ●…` indicator stops showing `STALE` and
+reflects reality (`●CLEAN` when clean, `●VULN` when critical/high are present).
+
+Resolve the swarmdo CLI as `npx swarmdo` if installed, else
+`node v3/@swarmdo/cli/bin/cli.js` (this repo). Call it `$CLI` below.
+
+## Input
+
+`$ARGUMENTS`
+
+## Behavior
+
+Pick the mode from the first argument (default `scan` when empty):
+
+- `scan` (default) — run `$CLI security scan` (standard depth).
+- `full` — run `$CLI security scan --depth full` for the complete finding list.
+- `cve` — run `$CLI security cve` (dependency-CVE audit only).
+- `audit` — run `$CLI security audit`.
+- `report` — run `$CLI security report` (summarize the last scan, no re-scan).
+
+Then:
+
+1. Report the summary counts — critical / high / medium / total — from the
+   scanner output.
+2. Confirm the statusline `Security` element refreshed: it now shows `●CLEAN`
+   (no critical/high) or `●VULN` (critical/high present) and no longer `●STALE`.
+   The change lands on the next statusline render — no regeneration needed.
+3. If any critical or high findings exist, list the top few (severity, package,
+   short description) and point at `$CLI security scan --depth full` for the rest.
+
+`.swarmdo/security/last-scan.json` is per-project, so run this in each project
+whose statusline you want current. This command only scans and reports — it does
+not modify code or dependencies.

package/.claude/helpers/statusline.cjs

@@ -84,6 +84,43 @@ function resolveSegments() {
 const SEGMENTS = resolveSegments();
 function seg(name) { return SEGMENTS.has(name); }
 
+// ─── Cost slot: plan-aware mode + account display ────────────────────────────
+// Resolution mirrors resolveSegments: env → project config → global config →
+// default. mode: auto|dollars|limits|off (auto → limits for a subscription
+// account, dollars otherwise); showAccount prefixes the account label.
+function resolveCostOptions() {
+  let mode = null;
+  let showAccount = null;
+  const envMode = (process.env.SWARMDO_STATUSLINE_COST_MODE || '').trim().toLowerCase();
+  if (envMode === 'auto' || envMode === 'dollars' || envMode === 'limits' || envMode === 'off') mode = envMode;
+  const envShow = (process.env.SWARMDO_STATUSLINE_SHOW_ACCOUNT || '').trim();
+  if (/^(1|true|yes|on)$/i.test(envShow)) showAccount = true;
+  else if (/^(0|false|no|off)$/i.test(envShow)) showAccount = false;
+  if (mode === null || showAccount === null) {
+    const files = [
+      path.join(CWD, '.swarmdo', 'statusline.json'),
+      path.join(os.homedir(), '.swarmdo', 'statusline.json'),
+    ];
+    for (const f of files) {
+      try {
+        const j = JSON.parse(fs.readFileSync(f, 'utf8'));
+        const cost = j && j.cost;
+        if (cost && typeof cost === 'object') {
+          if (mode === null && typeof cost.mode === 'string') {
+            const m = cost.mode.trim().toLowerCase();
+            if (m === 'auto' || m === 'dollars' || m === 'limits' || m === 'off') mode = m;
+          }
+          if (showAccount === null && typeof cost.showAccount === 'boolean') showAccount = cost.showAccount;
+        }
+      } catch (e) { /* absent/invalid — keep looking */ }
+      if (mode !== null && showAccount !== null) break;
+    }
+  }
+  if (CONFIG.hideCost) mode = 'off'; // legacy SWARMDO_STATUSLINE_HIDE_COST
+  return { mode: mode || 'auto', showAccount: showAccount === true };
+}
+const COST_OPTS = resolveCostOptions();
+
 // #2337: resolve an already-installed @swarmdo/cli (or swarmdo) bin so we
 // can invoke it directly via `node`. The previous version called
 // `npx --yes @swarmdo/cli@latest` on every uncached render, which forces
@@ -516,13 +553,96 @@ function getCostFromStdin() {
   return null;
 }
 
+// ── Account plan + rate-limit windows (for the plan-aware cost slot) ──────────
+// ~/.claude.json holds only the CURRENTLY active account (overwritten on switch),
+// so we read it live each render — that makes the slot correct across account
+// switches without any stored state. We read a few plan fields, never tokens.
+function readClaudeAccount() {
+  try {
+    const j = JSON.parse(fs.readFileSync(path.join(os.homedir(), '.claude.json'), 'utf8'));
+    const a = j && j.oauthAccount;
+    if (a && typeof a === 'object') {
+      return { billingType: a.billingType, organizationType: a.organizationType, displayName: a.displayName, organizationName: a.organizationName };
+    }
+  } catch (e) { /* not logged in / unreadable */ }
+  return null;
+}
+function detectPlan(a) {
+  if (!a || typeof a !== 'object') return 'unknown';
+  const b = typeof a.billingType === 'string' ? a.billingType : '';
+  const o = typeof a.organizationType === 'string' ? a.organizationType : '';
+  if (/subscription/i.test(b) || /claude_(max|team|enterprise|pro)/i.test(o)) return 'subscription';
+  if (b) return 'payg';
+  return 'unknown';
+}
+function accountLabel(a) {
+  if (!a) return '';
+  let raw = (typeof a.displayName === 'string' && a.displayName) || (typeof a.organizationName === 'string' && a.organizationName) || '';
+  raw = String(raw).trim();
+  if (!raw) return '';
+  return raw.length > 16 ? raw.slice(0, 15) + '…' : raw;
+}
+function rlToEpochMs(v) {
+  if (typeof v === 'number' && isFinite(v)) return v < 1e12 ? v * 1000 : v;
+  if (typeof v === 'string') { const t = Date.parse(v); return isNaN(t) ? null : t; }
+  return null;
+}
+function rlPickWindow(obj, windowMs, label) {
+  if (!obj || typeof obj !== 'object') return null;
+  const used = (obj.used_percentage != null ? obj.used_percentage : obj.usedPercentage);
+  const resetsAtMs = rlToEpochMs(obj.resets_at != null ? obj.resets_at : obj.resetsAt);
+  if (typeof used !== 'number' || !isFinite(used) || resetsAtMs === null) return null;
+  return { label: label, used: Math.max(0, Math.min(100, used)), windowMs: windowMs, resetsAtMs: resetsAtMs };
+}
+function getRateLimitWindows() {
+  const data = getStdinData();
+  if (!data) return [];
+  const rl = data.rate_limits || data.rateLimits || data;
+  if (!rl || typeof rl !== 'object') return [];
+  const out = [];
+  const w5 = rlPickWindow(rl.five_hour || rl.fiveHour, 5 * 60 * 60 * 1000, '5h');
+  const w7 = rlPickWindow(rl.seven_day || rl.sevenDay, 7 * 24 * 60 * 60 * 1000, '7d');
+  if (w5) out.push(w5);
+  if (w7) out.push(w7);
+  return out;
+}
+function rlWindowStatus(w, nowMs) {
+  if (w.used >= 100) return 'over';
+  const windowStart = w.resetsAtMs - w.windowMs;
+  const elapsed = nowMs - windowStart;
+  let willExhaust = false;
+  if (w.used > 0 && elapsed > 0) {
+    const msTo100 = ((100 - w.used) * elapsed) / w.used;
+    willExhaust = (nowMs + msTo100) <= w.resetsAtMs;
+  }
+  return (willExhaust || w.used >= 80) ? 'warn' : 'ok';
+}
+// { text, color } for the rate-limit cost slot, or null when Claude Code sent
+// no rate_limits payload (older CC / non-subscription session).
+function renderRateLimitSlot() {
+  const wins = getRateLimitWindows();
+  if (wins.length === 0) return null;
+  const now = Date.now();
+  let worst = 'ok';
+  const parts = [];
+  for (const w of wins) {
+    const st = rlWindowStatus(w, now);
+    if (st === 'over') worst = 'over';
+    else if (st === 'warn' && worst !== 'over') worst = 'warn';
+    const mark = st === 'over' ? '!' : st === 'warn' ? '⚠' : '';
+    parts.push(w.label + ' ' + Math.round(w.used) + '%' + mark);
+  }
+  const color = worst === 'over' ? c.brightRed : worst === 'warn' ? c.brightYellow : c.brightGreen;
+  return { text: parts.join(' · '), color: color };
+}
+
 // Read package version from the first package.json we find. The fallback
 // (`BAKED_CLI_VERSION`) is the version of @swarmdo/cli that generated THIS
 // statusline.cjs at `swarmdo init` time — so even when every probe below
 // misses, the displayed version is meaningful (matches what the user
 // installed), not a stale hard-coded string.
 function getPkgVersion() {
-  let ver = '1.58.4';
+  let ver = '1.58.9';
   try {
     const home = os.homedir();
     const pkgPaths = [
@@ -636,8 +756,24 @@ function generateStatusline() {
     const ctxColor = ctxInfo.usedPct >= 90 ? c.brightRed : ctxInfo.usedPct >= 70 ? c.brightYellow : c.brightGreen;
     header += '  ' + c.dim + '│' + c.reset + '  ' + ctxColor + '● ' + ctxInfo.usedPct + '% ctx' + c.reset;
   }
-  if (seg('cost') && !CONFIG.hideCost && costInfo && costInfo.costUsd > 0) {
-    header += '  ' + c.dim + '│' + c.reset + '  ' + c.brightYellow + CONFIG.costSymbol + costInfo.costUsd.toFixed(2) + c.reset;
+  if (seg('cost') && COST_OPTS.mode !== 'off') {
+    const acct = readClaudeAccount();
+    let eff = COST_OPTS.mode;
+    if (eff === 'auto') eff = detectPlan(acct) === 'subscription' ? 'limits' : 'dollars';
+    let slotText = null;
+    let slotColor = c.brightYellow;
+    if (eff === 'limits') {
+      const rl = renderRateLimitSlot();
+      if (rl) { slotText = rl.text; slotColor = rl.color; }
+      else if (costInfo && costInfo.costUsd > 0) { slotText = CONFIG.costSymbol + costInfo.costUsd.toFixed(2); } // no payload → $ fallback
+    } else if (costInfo && costInfo.costUsd > 0) {
+      slotText = CONFIG.costSymbol + costInfo.costUsd.toFixed(2);
+    }
+    if (slotText) {
+      let prefix = '';
+      if (COST_OPTS.showAccount) { const lbl = accountLabel(acct); if (lbl) prefix = c.dim + lbl + ' · ' + c.reset; }
+      header += '  ' + c.dim + '│' + c.reset + '  ' + prefix + slotColor + slotText + c.reset;
+    }
   }
   if (header) lines.push(header);
 

package/README.md

@@ -2,7 +2,7 @@
 
 [![swarmdo](swarmdo/assets/brand/logo-full.svg)](https://swarmdo.com)
 
-[![npm version (swarmdo)](https://img.shields.io/badge/npx%20swarmdo-v1.58.6-cb3837?style=for-the-badge&logo=npm&logoColor=white)](https://github.com/SwarmDo/swarmdo/releases)
+[![npm version (swarmdo)](https://img.shields.io/badge/npx%20swarmdo-v1.58.15-cb3837?style=for-the-badge&logo=npm&logoColor=white)](https://github.com/SwarmDo/swarmdo/releases)
 [![MIT License](https://img.shields.io/badge/License-MIT-yellow?style=for-the-badge)](https://github.com/SwarmDo/swarmdo/blob/main/LICENSE)
 [![Website](https://img.shields.io/badge/swarmdo.com-e2a33c?style=for-the-badge&logoColor=black)](https://swarmdo.com)
 [![Star on GitHub](https://img.shields.io/github/stars/SwarmDo/swarmdo?style=for-the-badge&logo=github&color=gold)](https://github.com/SwarmDo/swarmdo)
@@ -476,7 +476,7 @@ Four docs for four audiences:
 | **[Status](docs/STATUS.md)** | See what currently works — capability counts, test baselines, recent fixes, what's next. The *is-it-ready* doc. |
 | **[User Guide](docs/USERGUIDE.md)** | Daily reference — every command, every config flag, every plugin. The *how-do-I* doc. |
 | **[MetaHarness Guide](docs/metaharness-user-guide.md)** | How to grade your agent setup, scan tool configs for security, detect changes between runs, and eject a project into a standalone agent toolkit. The *audit-my-setup* doc. |
-| **[Benchmarks](https://gist.the upstream project (see NOTICE))** | v3.8.0 SOTA matrix vs LangGraph / AutoGen / CrewAI on darwin-arm64 + linux-x64. swarmdo wins cold start, single turn, RSS by 1.3×–1953×. The *is-it-fast* doc. |
+| **[Benchmarks](https://gist.the upstream project (see NOTICE))** | SOTA matrix vs LangGraph / AutoGen / CrewAI on darwin-arm64 + linux-x64. swarmdo wins cold start, single turn, RSS by 1.3×–1953×. The *is-it-fast* doc. |
 | **[Verification](verification.md)** | Cryptographically prove your installed bytes match the signed witness — `swarmdo verify`. The *trust-but-verify* doc. |
 | **[Team Gateway Checklist](docs/TEAM-GATEWAY-CHECKLIST.md)** | Before-merge gates, dual-mode handoff, memory namespace sharing, and witness manifest entry per merge. The *safer-team-workflows* doc. |
 
@@ -493,6 +493,7 @@ User Guide section index:
 | [Security](docs/USERGUIDE.md#%EF%B8%8F-security) | AIDefence, CVE remediation, validation |
 | [Ecosystem](docs/USERGUIDE.md#-ecosystem--integrations) | SwarmVector, agentic-flow, Flow Nexus |
 | [Configuration](docs/USERGUIDE.md#%EF%B8%8F-configuration--reference) | Environment variables, config schema |
+| [Slash Commands & Statusline](docs/USERGUIDE.md#-slash-command-reference) | Every `/sDo:` command + `/sdo-` skill, and every statusline item ([live on swarmdo.com](https://swarmdo.com/#commands)) |
 | [Plugin Marketplace](https://upstream.github.io/swarmdo) | Browse and install plugins |
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "swarmdo",
-  "version": "1.58.6",
+  "version": "1.58.15",
   "description": "Swarmdo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "dist/index.js",
   "type": "module",

package/v3/@swarmdo/cli/.claude/commands/sDo/agents/README.md

@@ -1,6 +1,6 @@
 # Agents Commands
 
-Complete agent management commands for Swarmdo V3.
+Complete agent management commands for Swarmdo.
 
 ## Available Commands
 

package/v3/@swarmdo/cli/.claude/commands/sDo/agents/agent-capabilities.md

@@ -6,7 +6,7 @@ type: reference
 
 # Agent Capabilities Reference
 
-Matrix of agent capabilities and their specializations for Swarmdo V3.
+Matrix of agent capabilities and their specializations for Swarmdo.
 
 ## Capability Matrix
 

package/v3/@swarmdo/cli/.claude/commands/sDo/agents/agent-types.md

@@ -1,12 +1,12 @@
 ---
 name: agent-types
-description: Complete guide to all 87 available agent types in Swarmdo V3
+description: Complete guide to all 87 available agent types in Swarmdo
 type: reference
 ---
 
 # Agent Types Reference
 
-Complete guide to all 87 available agent types in Swarmdo V3.
+Complete guide to all 87 available agent types in Swarmdo.
 
 ## Core Development (5)
 

package/v3/@swarmdo/cli/.claude/commands/sDo/security.md

@@ -0,0 +1,44 @@
+---
+description: Scan this project's security and refresh the statusline Security segment
+argument-hint: "[scan|full|cve|audit|report] (default: scan)"
+allowed-tools: Bash(npx swarmdo security:*), Bash(node v3/@swarmdo/cli/bin/cli.js security:*)
+---
+
+# /security — scan security posture + refresh the statusline
+
+Run the swarmdo security scanner and refresh the `Security` element of the
+statusline. The statusline reads the cached result from
+`.swarmdo/security/last-scan.json`; a scan rewrites it with a fresh `scannedAt`
+plus current counts, so the `Security ●…` indicator stops showing `STALE` and
+reflects reality (`●CLEAN` when clean, `●VULN` when critical/high are present).
+
+Resolve the swarmdo CLI as `npx swarmdo` if installed, else
+`node v3/@swarmdo/cli/bin/cli.js` (this repo). Call it `$CLI` below.
+
+## Input
+
+`$ARGUMENTS`
+
+## Behavior
+
+Pick the mode from the first argument (default `scan` when empty):
+
+- `scan` (default) — run `$CLI security scan` (standard depth).
+- `full` — run `$CLI security scan --depth full` for the complete finding list.
+- `cve` — run `$CLI security cve` (dependency-CVE audit only).
+- `audit` — run `$CLI security audit`.
+- `report` — run `$CLI security report` (summarize the last scan, no re-scan).
+
+Then:
+
+1. Report the summary counts — critical / high / medium / total — from the
+   scanner output.
+2. Confirm the statusline `Security` element refreshed: it now shows `●CLEAN`
+   (no critical/high) or `●VULN` (critical/high present) and no longer `●STALE`.
+   The change lands on the next statusline render — no regeneration needed.
+3. If any critical or high findings exist, list the top few (severity, package,
+   short description) and point at `$CLI security scan --depth full` for the rest.
+
+`.swarmdo/security/last-scan.json` is per-project, so run this in each project
+whose statusline you want current. This command only scans and reports — it does
+not modify code or dependencies.

package/v3/@swarmdo/cli/.claude/commands/sDo/swarm/swarm.md

@@ -1,6 +1,6 @@
 # /swarm
 
-Main swarm orchestration command for Swarmdo V3.
+Main swarm orchestration command for Swarmdo.
 
 ## 🚨 CRITICAL: Background Execution Pattern