@desplega.ai/agent-swarm 2.3.0 → 2.4.1

package/src/be/session-shares.ts

@@ -0,0 +1,244 @@
+import { getDbClient } from "./db";
+
+/**
+ * Session sharing store. A session is a root task (`parentTaskId IS NULL`) and
+ * its descendants; its owner is the root's `requestedByUserId`.
+ *
+ * Rows in `session_shares` are never deleted. Revoking sets `revokedAt`, and an
+ * access change revokes the active row and inserts a new one in the same
+ * transaction, so the rows for a root are its full share history.
+ */
+
+export type SessionShareAccess = "read" | "write";
+export type SessionAccess = "owner" | SessionShareAccess | "none";
+export type SessionEveryoneAccess = SessionShareAccess | "none";
+
+export type SessionShareRow = {
+  id: string;
+  rootTaskId: string;
+  /** NULL = everyone. */
+  userId: string | null;
+  access: SessionShareAccess;
+  createdAt: string;
+  revokedAt: string | null;
+  revokedBy: string | null;
+};
+
+export type SessionRoot = { id: string; requestedByUserId: string | null };
+
+export type SessionSharesState = {
+  everyone: SessionEveryoneAccess;
+  users: { userId: string; access: SessionShareAccess; createdAt: string }[];
+};
+
+export type DesiredSessionShares = {
+  everyone: SessionEveryoneAccess;
+  users: { userId: string; access: SessionShareAccess }[];
+};
+
+const RANK: Record<SessionAccess, number> = { none: 0, read: 1, write: 2, owner: 3 };
+
+/** True when `access` grants at least `needed`. */
+export function hasSessionAccess(access: SessionAccess, needed: SessionAccess): boolean {
+  return RANK[access] >= RANK[needed];
+}
+
+/**
+ * The session root of any task: walk `parentTaskId` up to the topmost task
+ * that still exists. No depth cap, so a chain of any length resolves to its
+ * actual root; a corrupt parent cycle has no top and resolves to null.
+ */
+export async function getSessionRoot(taskId: string): Promise<SessionRoot | null> {
+  return (await getSessionRoots([taskId])).get(taskId) ?? null;
+}
+
+const ROOT_LOOKUP_CHUNK = 500;
+
+type AncestorRow = { id: string; parentTaskId: string | null; requestedByUserId: string | null };
+
+/** `getSessionRoot` for many tasks; unknown tasks and tasks in a cycle are absent. */
+export async function getSessionRoots(taskIds: string[]): Promise<Map<string, SessionRoot>> {
+  const ids = [...new Set(taskIds)];
+  // Every ancestor once (`UNION` drops revisits, which also ends a cycle),
+  // then resolve each chain in memory: linear in the tasks involved.
+  const tasks = new Map<string, AncestorRow>();
+  for (let start = 0; start < ids.length; start += ROOT_LOOKUP_CHUNK) {
+    const chunk = ids.slice(start, start + ROOT_LOOKUP_CHUNK).filter((id) => !tasks.has(id));
+    if (chunk.length === 0) continue;
+    const rows = await getDbClient().query<AncestorRow>(
+      `WITH RECURSIVE up(id) AS (
+           SELECT id FROM agent_tasks WHERE id IN (${chunk.map(() => "?").join(", ")})
+           UNION
+           SELECT t.parentTaskId FROM agent_tasks t JOIN up ON t.id = up.id
+           WHERE t.parentTaskId IS NOT NULL
+         )
+         SELECT t.id, t.parentTaskId, t.requestedByUserId
+         FROM up CROSS JOIN agent_tasks t ON t.id = up.id`,
+      chunk,
+    );
+    for (const row of rows) tasks.set(row.id, row);
+  }
+
+  const resolved = new Map<string, SessionRoot | null>();
+  const rootOf = (taskId: string): SessionRoot | null => {
+    const path: string[] = [];
+    const onPath = new Set<string>();
+    let current = tasks.get(taskId);
+    let root: SessionRoot | null = null;
+    while (current) {
+      const known = resolved.get(current.id);
+      if (known !== undefined) {
+        root = known;
+        break;
+      }
+      if (onPath.has(current.id)) break;
+      path.push(current.id);
+      onPath.add(current.id);
+      const parent = current.parentTaskId ? tasks.get(current.parentTaskId) : undefined;
+      if (!parent) {
+        root = { id: current.id, requestedByUserId: current.requestedByUserId };
+        break;
+      }
+      current = parent;
+    }
+    for (const id of path) resolved.set(id, root);
+    return root;
+  };
+
+  const roots = new Map<string, SessionRoot>();
+  for (const id of ids) {
+    const root = rootOf(id);
+    if (root) roots.set(id, root);
+  }
+  return roots;
+}
+
+/**
+ * What `actingUserId` may do in the session rooted at `root`.
+ *
+ * - `owner` for the root's requester, and for every user when the root has no
+ *   owner (Slack and schedule sessions stay open, as before sharing existed).
+ * - Otherwise the best active share naming the user or everyone; `none` when
+ *   there is none. A root with no rows is private to its owner.
+ *
+ * A null `actingUserId` is a viewer with no user (a guest page session): it
+ * gets ownerless roots and everyone shares only. Callers that act for no user
+ * (agents, operator-key calls with no picked dashboard user) skip this check
+ * entirely; see `resolveSessionActor`.
+ */
+export async function sessionAccessForRoot(
+  actingUserId: string | null,
+  root: SessionRoot,
+): Promise<SessionAccess> {
+  if (!root.requestedByUserId) return "owner";
+  if (actingUserId && root.requestedByUserId === actingUserId) return "owner";
+  const rows = await getDbClient().query<{ access: SessionShareAccess }>(
+    `SELECT access FROM session_shares
+     WHERE rootTaskId = ? AND revokedAt IS NULL AND (userId IS NULL OR userId = ?)`,
+    [root.id, actingUserId],
+  );
+  if (rows.some((row) => row.access === "write")) return "write";
+  return rows.length > 0 ? "read" : "none";
+}
+
+/** `sessionAccessForRoot` for any task in the session; `none` for an unknown task. */
+export async function sessionAccess(
+  actingUserId: string | null,
+  taskId: string,
+): Promise<SessionAccess> {
+  const root = await getSessionRoot(taskId);
+  return root ? sessionAccessForRoot(actingUserId, root) : "none";
+}
+
+export async function listActiveSessionShares(rootTaskId: string): Promise<SessionShareRow[]> {
+  return getDbClient().query<SessionShareRow>(
+    `SELECT id, rootTaskId, userId, access, createdAt, revokedAt, revokedBy
+     FROM session_shares
+     WHERE rootTaskId = ? AND revokedAt IS NULL
+     ORDER BY createdAt, rowid`,
+    [rootTaskId],
+  );
+}
+
+/** Every row for a root, revoked ones included, oldest first. */
+export async function listSessionShareHistory(rootTaskId: string): Promise<SessionShareRow[]> {
+  return getDbClient().query<SessionShareRow>(
+    `SELECT id, rootTaskId, userId, access, createdAt, revokedAt, revokedBy
+     FROM session_shares
+     WHERE rootTaskId = ?
+     ORDER BY createdAt, rowid`,
+    [rootTaskId],
+  );
+}
+
+export function toSessionSharesState(rows: SessionShareRow[]): SessionSharesState {
+  const everyone = rows.find((row) => row.userId === null);
+  return {
+    everyone: everyone?.access ?? "none",
+    users: rows
+      .filter((row) => row.userId !== null)
+      .map((row) => ({ userId: row.userId!, access: row.access, createdAt: row.createdAt })),
+  };
+}
+
+/**
+ * Make the active shares of `root` equal `desired`, in one write transaction.
+ * A target whose access changes has its active row revoked and a new row
+ * inserted; a target no longer listed is revoked; nothing is deleted or
+ * updated in place apart from revocation. The owner is never stored.
+ */
+export async function setSessionShares(
+  root: SessionRoot,
+  desired: DesiredSessionShares,
+  actorUserId: string | null,
+): Promise<SessionSharesState> {
+  const want = new Map<string, SessionShareAccess>();
+  if (desired.everyone !== "none") want.set("*", desired.everyone);
+  for (const user of desired.users) {
+    if (user.userId !== root.requestedByUserId) want.set(user.userId, user.access);
+  }
+
+  return getDbClient().transaction(async (tx) => {
+    const now = new Date().toISOString();
+    const active = await tx.query<SessionShareRow>(
+      `SELECT id, rootTaskId, userId, access, createdAt, revokedAt, revokedBy
+       FROM session_shares WHERE rootTaskId = ? AND revokedAt IS NULL`,
+      [root.id],
+    );
+    const kept = new Set<string>();
+    for (const row of active) {
+      const target = row.userId ?? "*";
+      if (want.get(target) === row.access) {
+        kept.add(target);
+        continue;
+      }
+      await tx.run(
+        "UPDATE session_shares SET revokedAt = ?, revokedBy = ?, updated_by = ? WHERE id = ?",
+        [now, actorUserId, actorUserId, row.id],
+      );
+    }
+    for (const [target, access] of want) {
+      if (kept.has(target)) continue;
+      await tx.run(
+        `INSERT INTO session_shares (id, rootTaskId, userId, access, createdAt, created_by, updated_by)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`,
+        [
+          crypto.randomUUID(),
+          root.id,
+          target === "*" ? null : target,
+          access,
+          now,
+          actorUserId,
+          actorUserId,
+        ],
+      );
+    }
+    const rows = await tx.query<SessionShareRow>(
+      `SELECT id, rootTaskId, userId, access, createdAt, revokedAt, revokedBy
+       FROM session_shares WHERE rootTaskId = ? AND revokedAt IS NULL
+       ORDER BY createdAt, rowid`,
+      [root.id],
+    );
+    return toSessionSharesState(rows);
+  });
+}

package/src/be/swarm-config-guard.ts

@@ -1,8 +1,14 @@
 import { validateChatSdkAdaptersValue } from "../integrations/chat-sdk/schema";
+import { parseTelemetryRanking, TELEMETRY_RANKING_KEY } from "../ranking/telemetry-ranking";
 import { validateQuickJSPoolSize } from "../scripts-runtime/executors/quickjs-pool-config";
 import { normalizeSlackReactionShortcode } from "../slack/reaction-shortcode";
 import { ProviderNameSchema } from "../types";
 import { API_DRAIN_MAX_MS_LIMIT } from "../utils/api-drain";
+import {
+  COMPANY_ACQUISITION_SOURCES,
+  COMPANY_TEAM_SIZES,
+  COMPANY_USE_CASES,
+} from "../utils/company-profile";
 import { envExportRestrictedError, isEnvExportRestrictedKey } from "../utils/config-env-export";
 import { validateEgressAllowlist } from "../utils/egress-guard";
 import { parseEnabledTools } from "../utils/enabled-tools";
@@ -69,15 +75,24 @@ export function isApiOnlyConfigKey(key: string): boolean {
 }
 
 /** Config rows owned by dedicated API surfaces, not the generic config API. */
-export const INTERNAL_CONFIG_KEYS = new Set(["onboarding_state", "runtime_owner_id"]);
+export const INTERNAL_CONFIG_KEYS = new Set([
+  "onboarding_state",
+  "runtime_owner_id",
+  TELEMETRY_RANKING_KEY,
+]);
 
 export function isInternalConfigKey(key: string): boolean {
   return INTERNAL_CONFIG_KEYS.has(key.toLowerCase());
 }
 
 export function internalConfigKeyError(key: string): Error {
+  const lower = key.toLowerCase();
   const owner =
-    key.toLowerCase() === "runtime_owner_id" ? "the runtime supervisor" : "/api/onboarding";
+    lower === "runtime_owner_id"
+      ? "the runtime supervisor"
+      : lower === TELEMETRY_RANKING_KEY
+        ? "/api/ranking"
+        : "/api/onboarding";
   return new Error(`Key '${key}' is managed by ${owner}`);
 }
 
@@ -141,7 +156,8 @@ function booleanValidators(keys: string[]): Record<string, ConfigValidator> {
 
 /** Build a single `{ KEY: validator }` entry restricted to `options`. */
 function enumValidator(key: string, options: string[]): Record<string, ConfigValidator> {
-  const message = `Invalid ${key} value (must be one of: ${options.join(", ")})`;
+  const listed = options.filter(Boolean).join(", ");
+  const message = `Invalid ${key} value (must be one of: ${listed}${options.includes("") ? ", or empty" : ""})`;
   return {
     [key]: (value: unknown) => {
       if (typeof value !== "string") return message;
@@ -301,6 +317,16 @@ const VALIDATED_KEYS: Record<string, ConfigValidator> = {
       return "Invalid TASK_TOOL_MANIFESTS (expected JSON with taskTypes and/or schedules maps, each selecting at most 16 known swarm tools)";
     }
   },
+  // Owned by /api/ranking (an internal key); parsed here as defense in depth.
+  [TELEMETRY_RANKING_KEY.toUpperCase()]: (value) => {
+    try {
+      if (typeof value !== "string") throw new Error("Expected JSON string");
+      parseTelemetryRanking(value);
+      return null;
+    } catch {
+      return "Invalid telemetry_ranking (expected the v1 ranking listing JSON)";
+    }
+  },
   // MCP tool allowlist: comma-separated names or a JSON array of strings.
   // Unknown names are accepted here and warned about at session init.
   SWARM_ENABLED_TOOLS: (value) => {
@@ -403,8 +429,12 @@ const VALIDATED_KEYS: Record<string, ConfigValidator> = {
       ? null
       : "Invalid SWARM_ORG_WEBSITE (must be a public hostname such as example.com, without scheme, www, path or port)";
   },
+  ...enumValidator("SWARM_ORG_TEAM_SIZE", ["", ...COMPANY_TEAM_SIZES]),
+  ...enumValidator("SWARM_ORG_USE_CASE", ["", ...COMPANY_USE_CASES]),
+  ...enumValidator("SWARM_ORG_ACQUISITION_SOURCE", ["", ...COMPANY_ACQUISITION_SOURCES]),
   ...booleanValidators([
     "SWARM_USED_BY_CONSENT",
+    "PUBLIC_RANKING_ENABLED",
     "SWARM_DEV_MODE",
     "MULTI_RUNTIME_ENABLED",
     "STEERING_ENABLED",

package/src/be/telemetry-enable.ts

@@ -13,7 +13,7 @@ import { telemetryIngestRecorder } from "./telemetry-ingest-anchor";
 
 type GetConfig = (key: string) => Promise<string | undefined>;
 type SetConfig = (key: string, value: string) => Promise<void>;
-export type TelemetryEnabledVia = "banner" | "settings" | "env";
+export type TelemetryEnabledVia = "banner" | "settings" | "benchmark" | "env";
 
 let accessors: { getConfig: GetConfig; setConfig: SetConfig } | null = null;
 let lastEnabled = false;

package/src/commands/provider-credentials.ts

@@ -155,8 +155,13 @@ export const CREDENTIAL_PROVIDER_CHECKERS: Record<SupportedProvider, CredentialC
   devin: (env) => checkDevinCredentials(env),
   opencode: (env, opts) => checkOpencodeCredentials(env, opts),
   pi: async (env, opts) => {
-    const { checkPiMonoCredentials } = await import("../providers/pi-mono-adapter");
-    return checkPiMonoCredentials(env, opts);
+    const { checkPiMonoCredentials, listPiOpencodeGoModelIds } = await import(
+      "../providers/pi-mono-adapter"
+    );
+    return {
+      ...(await checkPiMonoCredentials(env, opts)),
+      opencodeGoModels: listPiOpencodeGoModelIds(),
+    };
   },
   acp: (env) => {
     const target = env.ACP_TARGET ?? "custom";
@@ -662,6 +667,10 @@ export async function buildCredStatusReport(
           error: presence.ready ? undefined : (presence.hint ?? undefined),
         }
       : null;
+  const opencodeGo: AgentCredStatus["opencodeGo"] =
+    presence.opencodeGoModels !== undefined
+      ? { probedAt: Date.now(), models: presence.opencodeGoModels }
+      : null;
   return {
     ready: presence.ready,
     missing: presence.missing ?? [],
@@ -672,6 +681,7 @@ export async function buildCredStatusReport(
     reportedAt: Date.now(),
     reportKind: kind,
     bedrock,
+    opencodeGo,
     acp: null,
   };
 }

package/src/commands/runner.ts

@@ -55,6 +55,7 @@ import {
   skillFromToolArgs,
 } from "../providers/skill-invoke.ts";
 import type { SteerDeliveryResult } from "../providers/types.ts";
+import { rankingUsageProps } from "../ranking/usage.ts";
 import { WorkerRealtimeClient } from "../realtime/worker-client";
 import { resumedTaskModelSelection, type TaskModelPinFields } from "../tasks/model-pin.ts";
 import { initTelemetry, telemetry } from "../telemetry.ts";
@@ -1228,6 +1229,13 @@ export const RELOADABLE_ENV_KEYS: ReadonlySet<string> = new Set([
   "TEMPLATE_REGISTRY_URL",
   "SLACK_DISABLE",
   "SWARM_ORG_NAME",
+  // Gate the public-ranking `ranking.usage` emit, so clearing the website or
+  // turning the setting off stops it on running workers.
+  "SWARM_ORG_WEBSITE",
+  "PUBLIC_RANKING_ENABLED",
+  "SWARM_ORG_TEAM_SIZE",
+  "SWARM_ORG_USE_CASE",
+  "SWARM_ORG_ACQUISITION_SOURCE",
   // pi reads these from process.env for its traits and its session.
   "PI_TOOL_DEFERRAL",
   "PI_CODEMODE",
@@ -4923,6 +4931,12 @@ async function spawnProviderProcess(
             },
             { userId: opts.requestedByUserId ?? null },
           );
+          // Public ranking: token counts only, while the install is opted in.
+          const rankingUsage = rankingUsageProps(result.cost, {
+            model: result.cost.model,
+            provider: result.cost.provider ?? opts.harnessProvider,
+          });
+          if (rankingUsage) telemetry.ranking("usage", rankingUsage);
         }
 
         // Post completion context usage snapshot

package/src/heartbeat/heartbeat.ts

@@ -76,7 +76,7 @@ import {
   REBOOT_RETRY_PIN_TAG,
   resolveLeadOnlyRecoveryAssignment,
 } from "../tasks/worker-follow-up";
-import { type AgentTask, TERMINAL_TASK_STATUSES } from "../types";
+import { type AgentTask, SUPERSEDED_WORKFLOW_TASK_REASON, TERMINAL_TASK_STATUSES } from "../types";
 import { isEnvFlagEnabled } from "../utils/env-flag";
 import { isMultiRuntimeEnabled } from "../utils/multi-runtime";
 import { DEFAULT_OPENROUTER_BASE_URL, getOpenRouterBaseUrl } from "../utils/openrouter-base-url";
@@ -679,7 +679,7 @@ function isRemediationAction(value: unknown): value is RemediationAction {
 
 function decideRemediation(task: AgentTask, facts: RemediationFacts): RemediationDecision {
   if (task.workflowRunStepId != null) {
-    return { action: "fail", reason: "superseded_workflow_task" };
+    return { action: "fail", reason: SUPERSEDED_WORKFLOW_TASK_REASON };
   }
   if (facts.skipAutoResume || facts.alreadyResumed) {
     return { action: "fail", reason: facts.legacyFailReason };

package/src/hooks/codex-hook.ts

@@ -35,6 +35,7 @@ import { getApiKey } from "../utils/api-key";
 import { getMcpBaseUrl } from "../utils/constants";
 import { isSteeringEnabled } from "../utils/steering-enabled";
 import { guardGhPrBody, type PrBodyGuardDeps } from "./pr-body-guard";
+import { guardGhPrRoom, type PrRoomGuardDeps } from "./pr-room-guard";
 
 const FETCH_TIMEOUT_MS = 5_000;
 
@@ -169,13 +170,16 @@ export async function handleCodexHookEvent(
   };
 }
 
-/** PreToolUse: the PR body leak guard's block reason, or null to allow the call. */
+/** PreToolUse: return the first PR guard block reason, or null to allow the call. */
 export async function codexPreToolUseBlock(
   msg: CodexHookMessage,
   deps?: PrBodyGuardDeps,
+  roomDeps?: PrRoomGuardDeps,
 ): Promise<string | null> {
   if (msg.hook_event_name !== "PreToolUse") return null;
-  return guardGhPrBody(msg.tool_input, msg.cwd ?? process.cwd(), deps);
+  const cwd = msg.cwd ?? process.cwd();
+  const block = await guardGhPrBody(msg.tool_input, cwd, deps);
+  return block ?? (await guardGhPrRoom(msg.tool_input, cwd, roomDeps));
 }
 
 /** stdin/stdout entry point used by the `codex-hook` CLI command. */

package/src/hooks/hook.ts

@@ -24,6 +24,7 @@ import { getMcpBaseUrl, MAX_PROFILE_FILE_LENGTH } from "../utils/constants";
 import { summarizeSession as runSummarize } from "../utils/internal-ai";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { guardGhPrBody } from "./pr-body-guard";
+import { guardGhPrRoom } from "./pr-room-guard";
 import { checkToolLoop, clearToolHistory } from "./tool-loop-detection";
 
 const SERVER_NAME = pkg.config?.name ?? "agent-swarm";
@@ -1189,6 +1190,12 @@ export async function handleHook(): Promise<void> {
           process.exitCode = 2;
           return;
         }
+        const prRoomBlock = await guardGhPrRoom(msg.tool_input, msg.cwd ?? process.cwd());
+        if (prRoomBlock) {
+          console.error(prRoomBlock);
+          process.exitCode = 2;
+          return;
+        }
       }
 
       // Emitted last, so a later block stays the only stdout of the event.

package/src/hooks/pr-body-guard.ts

@@ -40,22 +40,29 @@ import { isAbsolute, resolve } from "node:path";
 import { findPrBodyLeaks, type LeakCategory } from "../utils/pr-body-leaks";
 
 export type GhPrInvocation = {
+  action: "create" | "edit";
   /** Working directory of the `gh` call after any `cd`; null when a `cd` target could not be resolved. */
   cwd: string | null;
   /** Explicit target repos: `--repo` / `-R`, a PR URL, or `GH_REPO`. Empty means the checkout at `cwd`. */
   repos: string[];
+  /** Expanded targets for workflow guards. Null means an unknown shell value. */
+  resolvedRepos: Array<string | null>;
   /** Also check the checkout: `GH_REPO` was assigned without `export`, so gh may not see it. */
   alsoCheckout: boolean;
   /** The `gh pr edit` target could not be classified (unset variable, `$(...)`, non-PR URL), so the PR's repo is unknown. */
   unknownTarget: boolean;
   /** Literal public text: `--title` and `--body` values, heredoc or here-string stdin. */
   texts: string[];
+  /** Expanded body values and stdin, excluding the title. Null means an unknown shell value. */
+  bodyTexts: Array<string | null>;
   /** Files that become the body, expanded: `--body-file PATH`, or `--body-file -` with `< PATH`. */
   bodyFiles: string[];
   /** Body file paths whose variables could not be resolved, as written. They count as unreadable. */
   unresolvedBodyFiles: string[];
   /** The body text could not be isolated (piped stdin, unquoted `$(...)`); scan the whole command. */
   opaqueBody: boolean;
+  /** gh may build or change the body from a source the parser cannot read: `--fill*`, `--template`, `--editor`, `--web`, `--recover`. */
+  externalBody: boolean;
 };
 
 export type PrBodyGuardDeps = {
@@ -282,6 +289,9 @@ const SHORT_FLAGS: Record<string, string> = {
   p: "project",
   r: "reviewer",
   T: "template",
+  e: "editor",
+  f: "fill",
+  w: "web",
 };
 
 type ParsedArgs = {
@@ -826,11 +836,14 @@ function parseWithState(
       else bodyFiles.push(expanded);
     }
     found.push({
+      action,
       cwd: wrapperFlags || dirUnknown ? null : state.dir,
       repos: [...new Set(repos)],
+      resolvedRepos: repos.map(expand),
       alsoCheckout,
       unknownTarget,
       texts: [...inline, ...(fromStdin ? stdin : [])],
+      bodyTexts: [...values("body"), ...(fromStdin ? stdin : [])].map(expand),
       bodyFiles,
       unresolvedBodyFiles,
       // An unquoted `$(` splits at the paren, leaving a value that ends in `$`.
@@ -839,6 +852,9 @@ function parseWithState(
         inline.some((value) => value.endsWith("$")) ||
         (action === "edit" && target?.endsWith("$") === true) ||
         (fromStdin && stdin.length === 0 && args.stdinFile === undefined),
+      externalBody:
+        values("fill", "fill-first", "fill-verbose", "template", "editor", "web", "recover")
+          .length > 0,
     });
   };
 
@@ -861,6 +877,25 @@ function parseWithState(
 const BLOCK_ADVICE =
   "Paraphrase the motivation ('a maintainer asked for X') and link only public sources (Fixes #N, a public PR or issue). Task, session, agent-fs and Slack permalinks go only under '## Swarm provenance'. Bare Slack ids, ts values and private-chat quotes are blocked everywhere.";
 
+/** Read body files relative to the parsed checkout and retain the first unreadable path. */
+export async function readGhPrBodyFiles(
+  call: GhPrInvocation,
+  readFile: PrBodyGuardDeps["readFile"],
+): Promise<{ texts: string[]; unreadable: string | undefined }> {
+  const texts: string[] = [];
+  let unreadable = call.unresolvedBodyFiles[0];
+  for (const bodyFile of call.bodyFiles) {
+    try {
+      const base = isAbsolute(bodyFile) ? "/" : call.cwd;
+      if (base === null) throw new Error("unknown working directory");
+      texts.push(await readFile(resolve(base, bodyFile)));
+    } catch {
+      unreadable ??= bodyFile;
+    }
+  }
+  return { texts, unreadable };
+}
+
 /** Check a shell command. Returns a block reason, or null to allow. */
 export async function checkGhPrCommand(
   command: string,
@@ -873,17 +908,9 @@ export async function checkGhPrCommand(
     for (const text of call.opaqueBody ? [...call.texts, command] : call.texts) {
       for (const leak of findPrBodyLeaks(text)) leaks.add(leak);
     }
-    let unreadable: string | undefined = call.unresolvedBodyFiles[0];
-    for (const bodyFile of call.bodyFiles) {
-      try {
-        const base = isAbsolute(bodyFile) ? "/" : call.cwd;
-        if (base === null) throw new Error("unknown working directory");
-        for (const leak of findPrBodyLeaks(await deps.readFile(resolve(base, bodyFile)))) {
-          leaks.add(leak);
-        }
-      } catch {
-        unreadable ??= bodyFile;
-      }
+    const { texts, unreadable } = await readGhPrBodyFiles(call, deps.readFile);
+    for (const text of texts) {
+      for (const leak of findPrBodyLeaks(text)) leaks.add(leak);
     }
     if (leaks.size === 0 && unreadable === undefined) continue;
 

package/src/hooks/pr-room-guard.ts

@@ -0,0 +1,88 @@
+import { parseGhPrCommands, readGhPrBodyFiles, shellCommandOf } from "./pr-body-guard";
+
+export type PrRoomGuardDeps = {
+  env: Record<string, string | undefined>;
+  readFile: (path: string) => Promise<string>;
+  remoteOrigin: (cwd: string) => Promise<string>;
+};
+
+const BLOCK_REASON =
+  'This repo uses PR rooms. Create the room first with the pr-room skill (app action createRoom). Then pass the returned prBody with --body-file. The body must contain the line "PR room: prr-...".';
+const ROOM_LINE = /^PR room: prr-[a-z2-7]{10}\b/m;
+const REMOTE_LOOKUP_TIMEOUT_MS = 5_000;
+
+/** Read the `remote.origin.url` of a checkout. A lookup that does not finish in `timeoutMs` is killed and rejects. */
+export async function gitRemoteOrigin(
+  cwd: string,
+  timeoutMs = REMOTE_LOOKUP_TIMEOUT_MS,
+): Promise<string> {
+  const proc = Bun.spawn(["git", "-C", cwd, "config", "--get", "remote.origin.url"], {
+    stdout: "pipe",
+    stderr: "ignore",
+    stdin: "ignore",
+    timeout: timeoutMs,
+    killSignal: "SIGKILL",
+  });
+  const [out, code] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+  if (code !== 0) throw new Error("Cannot resolve checkout remote");
+  return out.trim();
+}
+
+const defaultDeps = (): PrRoomGuardDeps => ({
+  env: process.env,
+  readFile: (path) => Bun.file(path).text(),
+  remoteOrigin: (cwd) => gitRemoteOrigin(cwd),
+});
+
+/** Extract owner/repo from an HTTPS, SSH URL, or SCP-style SSH remote. */
+function repoFromRemote(remote: string): string | undefined {
+  const match =
+    /^(?:https?:\/\/[^/]+\/|ssh:\/\/[^/]+\/|[^\s/@:]+@[^\s/:]+:)([^/\s]+)\/([^/\s]+?)\/?$/.exec(
+      remote.trim(),
+    );
+  return match ? `${match[1]}/${match[2]?.replace(/\.git$/, "")}`.toLowerCase() : undefined;
+}
+
+/** Require a room marker for configured repositories. Unresolved or ambiguous inputs allow the command. */
+export async function guardGhPrRoom(
+  toolInput: unknown,
+  cwd: string,
+  deps: PrRoomGuardDeps = defaultDeps(),
+): Promise<string | null> {
+  try {
+    const repos = new Set(
+      (deps.env.PR_ROOM_REPOS ?? "")
+        .split(",")
+        .map((repo) => repo.trim().toLowerCase())
+        .filter(Boolean),
+    );
+    if (repos.size === 0) return null;
+    const command = shellCommandOf(toolInput);
+    if (command === null) return null;
+    for (const call of parseGhPrCommands(command, cwd, deps.env)) {
+      if (call.action !== "create" || call.unknownTarget || call.cwd === null) continue;
+      // The body comes from a pipe, a command substitution, gh itself, or an unknown variable.
+      if (call.opaqueBody || call.externalBody || call.bodyTexts.includes(null)) continue;
+      const targets = [...call.resolvedRepos];
+      if (targets.includes(null)) continue;
+      if (targets.length === 0 || call.alsoCheckout) {
+        try {
+          const repo = repoFromRemote(await deps.remoteOrigin(call.cwd));
+          if (!repo) continue;
+          targets.push(repo);
+        } catch {
+          continue;
+        }
+      }
+      // An unexported `GH_REPO=x` may not reach gh: block only when every candidate is listed.
+      if (!targets.every((repo) => repo !== null && repos.has(repo.trim().toLowerCase()))) continue;
+      const body = await readGhPrBodyFiles(call, deps.readFile);
+      if (body.unreadable !== undefined) continue;
+      const texts = [...call.bodyTexts, ...body.texts];
+      if (!texts.some((text) => text !== null && ROOM_LINE.test(text))) return BLOCK_REASON;
+    }
+  } catch {
+    // A workflow reminder must not prevent commands when resolution fails.
+  }
+  return null;
+}