BridgeSwarm/docs/living/STATUS.md

Status — what ships

Last reviewed: 2026-09-04.

Product

BridgeSwarm is a desktop-only MV3 extension + Bare native host that runs the real Hyperswarm / Hyper* / HRPC / capability stack and injects window.BridgeSwarm into pages. Pages never run UDX, Noise, or RocksDB themselves.

Surface	Path	Role
Page API	extension/api.js + discordjs.js	BridgeSwarm, connections, request, packs, DiscordJS
Content script	extension/content.js	Injects defaults + API + DiscordJS; bridges postMessage
Background	extension/background.js	Native port, swarm routing, dashboard, examples / QVAC / Discord toggles
Host	native-host/host.js	Swarm, Hyper*, HRPC, pack dispatch
Messenger	native-host/messenger.js	4-byte LE + JSON (NMH ~1 MB)
Packs	native-host/capabilities/	media, fs, sqlite, net, qvac, agent, discord
Examples	examples/ (source of truth)	Synced into extension + host

Completed this pass (were missing)

Item	Resolution
Planned fs / sqlite / net packs (called out in CAPABILITIES.md as “upcoming”)	Implemented and registered by default
Settings never reached the page (window.__BRIDGESWARM_DEFAULTS__ set in isolated content-script world)	defaults.js now injected into the page world with dataset defaults
Debug logs always on (debugMode = true + unguarded console.log in api.js)	Gated on Settings → Debug
Thin Hyper* surface vs Holepunch APIs	Added coreHas, coreUpdate, beeList, beePeek, driveEntry, driveExists, driveInfo, resourceList, resourceClose; coreGet honors wait/timeout; list commands cap results
Examples without READMEs	clip-studio, firewall-room, live-encode, media-demo, sync-demo, shared
No demo for local-power packs	examples/local-power/
Host test script was a no-op	npm test → scripts/test-host-units.js + Bare native-host/test-bare.js
Origin allowlist, QVAC pack, grok-class agent	Settings origins; BridgeSwarm.qvac / BridgeSwarm.agent; docs/QVAC.md + AGENT.md
QVAC multimodal image input	Catalog vision/mmproj; projectionModelSrc on load (Q8_0 or F16/BF16 fallback); attachments: [{ path }] jail under qvac/vision/
Live desktop still ingest	Ring buffer ≤5 FPS. Native apps: POST /v1/vision/frames. HTTPS pages (Pip): qvac.pushDesktopFrame over NMH. Injected on each complete, not JSONL
Agent loop quality	Parallel tools + path locks, unique search_replace, rg grep, LLM compaction, git sidecar, persistent allow/deny, MCP HTTP handshake, subagent resume
Living docs / continued-dev plan	This folder
discord.js 14 on Bare (BridgeSwarm.DiscordJS)	Vendored bare-discord-js; Settings → Enable Discord; examples/discord-bot/

Capability packs (default host)

Pack	Commands	Confine / policy
media	info, imageTransform, extractFrame, transcode, writeInput, readOutput, cancel, encode*	cap-jobs/
fs	write, read, list, mkdir, stat, exists, unlink, rename	files/
sqlite	open, close, list, exec, query, get, run	sqlite/ (or :memory:); no extensions
net	fetch	public http(s) only; private / loopback / metadata blocked; 2 MB body cap
qvac	detect, load, complete, chat, pushDesktopFrame, clearDesktop, embed, …	Off until Settings → Enable QVAC; $BRIDGE_SWARM_STORAGE/qvac/ (+ vision/); origin allowlist
agent	create, prompt (images, desktopVision), cancel, …	Same QVAC enable gate; host workspace under $BRIDGE_SWARM_STORAGE/agent/ unless hostWorkspace: false
discord	surface, construct, call, listen, destroy	Off until Settings → Enable Discord; tab-scoped Clients; tokens never logged

Page helpers: BridgeSwarm.media.*, BridgeSwarm.fs.*, BridgeSwarm.sqlite.*, BridgeSwarm.net.fetch, BridgeSwarm.qvac.*, BridgeSwarm.agent.*, BridgeSwarm.DiscordJS.

Dashboard Capabilities shows Vision (projector loaded) and Desktop (live / fps / stale).

Host request types

Swarm: init, join, leave, swarmKey, listConnections, setFirewall, banPeer, setAutoReplicate, destroy

Connection: write, destroyConnection, attachReplication, attachHrpc, hrpcInvoke

Background-only: registerSwarm (not a host command)

Data: coreOpen/Info/Append/Get/Has/Update, beeOpen/Get/Put/Del/List/Peek, driveOpen/Get/Put/List/Del/Entry/Exists/Info, autobaseOpen/Append/ViewGet/Info, hyperdbOpen/Get/Insert/Delete/FindToArray/Flush, resourceList, resourceClose

Control: examplesServer.start/stop/status, host.snapshot, capabilities.list/has, capability, plus pack.cmd shortcuts

Intentionally not done (see PLAN / GAPS)

• Sparse core.download / range streams over NMH
• Autobase addWriter / multi-writer apply customization from the page
• Encrypted Hypercores, Hyperbee batch, Hyperdrive watch / symlink / mirror
• In-page protomux-rpc bundle
• Automated integration tests against a live host
• Mobile (native messaging is desktop-only)
• Image / video / music generation (diffusion plugins never registered)
• Desktop capture, mouse, or keyboard computer-use (ingest only; a separate app or Pip feeds frames)