@desplega.ai/agent-swarm 2.4.0 → 2.4.2

package/src/be/db/tasks/read.ts

@@ -436,6 +436,118 @@ export async function getChildTasks(parentTaskId: string): Promise<AgentTask[]>
   return rows.map(rowToAgentTask);
 }
 
+/** Caps for {@link getTaskLineage}: a fan-out of thousands still answers in one bounded read. */
+export const TASK_LINEAGE_LIMITS = { maxNodes: 500, maxDepth: 30, maxAncestors: 50 } as const;
+
+/** One task in a lineage tree: the slim list row plus the workflow run it belongs to. */
+type TaskLineageNode = AgentTaskSummary & { workflowRunId?: string };
+
+interface TaskLineage {
+  /** The topmost ancestor reached (the session root unless `truncated`). */
+  rootTaskId: string;
+  /** Root first, then descendants; always holds the path root → `taskId`. */
+  tasks: TaskLineageNode[];
+  /** True when some ancestor or descendant is missing from `tasks`. */
+  truncated: boolean;
+}
+
+const LINEAGE_COLUMNS = `${LIST_COLUMNS.slim}, agent_tasks.workflowRunId,
+  (SELECT SUM(totalCostUsd) FROM session_costs WHERE session_costs.taskId = agent_tasks.id) AS totalCostUsd`;
+
+type TaskLineageRow = AgentTaskSummaryRow & { workflowRunId: string | null };
+
+function rowToTaskLineageNode(row: TaskLineageRow): TaskLineageNode {
+  return { ...rowToAgentTaskSummary(row), workflowRunId: row.workflowRunId ?? undefined };
+}
+
+/**
+ * The whole tree `taskId` belongs to, following `parentTaskId`: up to the
+ * topmost ancestor, then every descendant of that root breadth-first. The
+ * descendants of `taskId` itself are walked first, so a wide tree cut at
+ * `maxNodes` still shows the task's own subtree. Read-only and bounded: at
+ * most `maxAncestors` hops up, `maxDepth` levels down and about `2 * maxNodes`
+ * rows. Null when the task does not exist.
+ */
+export async function getTaskLineage(
+  taskId: string,
+  limits: { maxNodes?: number; maxDepth?: number; maxAncestors?: number } = {},
+): Promise<TaskLineage | null> {
+  const maxNodes = limits.maxNodes ?? TASK_LINEAGE_LIMITS.maxNodes;
+  const maxDepth = limits.maxDepth ?? TASK_LINEAGE_LIMITS.maxDepth;
+  const maxAncestors = limits.maxAncestors ?? TASK_LINEAGE_LIMITS.maxAncestors;
+  const db = getDbClient();
+  // Hops are counted, so a parentTaskId cycle stops at the cap instead of looping.
+  const path = await db.query<{ id: string; parentTaskId: string | null; hops: number }>(
+    `WITH RECURSIVE up(id, parentTaskId, hops) AS (
+         SELECT id, parentTaskId, 0 FROM agent_tasks WHERE id = ?
+         UNION ALL
+         SELECT t.id, t.parentTaskId, up.hops + 1 FROM agent_tasks t
+         JOIN up ON t.id = up.parentTaskId
+         WHERE up.hops < ?
+       )
+       SELECT id, parentTaskId, hops FROM up ORDER BY hops`,
+    [taskId, maxAncestors],
+  );
+  if (path.length === 0) return null;
+  const top = path[path.length - 1]!;
+  // A parent that no longer exists ends the walk like a root; a cap does not.
+  let truncated = top.hops === maxAncestors && top.parentTaskId !== null;
+
+  // LIMIT inside the recursive CTE stops the walk itself, not just the output.
+  const descendants = (startId: string) =>
+    db.query<TaskLineageRow>(
+      `WITH RECURSIVE down(id, depth) AS (
+           SELECT ?, 0
+           UNION ALL
+           SELECT t.id, down.depth + 1 FROM down
+           JOIN agent_tasks t ON t.parentTaskId = down.id
+           WHERE down.depth < ?
+           ORDER BY 2
+           LIMIT ?
+         )
+         SELECT ${LINEAGE_COLUMNS} FROM down
+         CROSS JOIN agent_tasks ON agent_tasks.id = down.id
+         ORDER BY down.depth, agent_tasks.createdAt, agent_tasks.rowid`,
+      [startId, maxDepth, maxNodes + 1],
+    );
+
+  const byId = new Map<string, TaskLineageNode>();
+  const add = (rows: TaskLineageRow[]) => {
+    for (const row of rows) {
+      if (!byId.has(row.id)) byId.set(row.id, rowToTaskLineageNode(row));
+    }
+  };
+  const ownSubtree = await descendants(taskId);
+  const fromRoot = top.id === taskId ? ownSubtree : await descendants(top.id);
+  add(fromRoot.slice(0, maxNodes));
+  add(ownSubtree.slice(0, maxNodes));
+
+  // The path root → task is always present, even past the depth or node cap.
+  const missing = path.map((row) => row.id).filter((id) => !byId.has(id));
+  if (missing.length > 0) {
+    add(
+      await db.query<TaskLineageRow>(
+        `SELECT ${LINEAGE_COLUMNS} FROM agent_tasks WHERE id IN (${missing.map(() => "?").join(", ")})`,
+        missing,
+      ),
+    );
+  }
+
+  // The caps cut the walk at many points (depth, node count, either walk), so
+  // ask the table directly: is any child of a returned task not returned?
+  if (!truncated) {
+    const ids = [...byId.keys()];
+    const list = ids.map(() => "?").join(", ");
+    const omitted = await db.get(
+      `SELECT 1 FROM agent_tasks WHERE parentTaskId IN (${list}) AND id NOT IN (${list}) LIMIT 1`,
+      [...ids, ...ids],
+    );
+    truncated = omitted !== undefined && omitted !== null;
+  }
+
+  return { rootTaskId: top.id, tasks: [...byId.values()], truncated };
+}
+
 /**
  * Returns true if `parentId` has at least one non-terminal child task with
  * `taskType = 'resume'`. Used by the heartbeat sweep as an idempotency guard:

package/src/be/db.ts

@@ -10,7 +10,7 @@ import {
 import { realtimeBus } from "../realtime/bus";
 import { slackChannelFromContextKey } from "../tasks/slack-routing";
 import { _resolveIntegrationType, emitIntegrationConnected, telemetry } from "../telemetry";
-import { scheduleOrgDomainRecompute } from "../telemetry-identity";
+import { invalidateTelemetryUserRole, scheduleOrgDomainRecompute } from "../telemetry-identity";
 import {
   emitTaskTelemetry,
   type TaskTelemetryEvent,
@@ -327,6 +327,7 @@ export {
   getSupersededTasksWithoutResume,
   getSupersededTasksWithUnsettledDependents,
   getTaskById,
+  getTaskLineage,
   getTaskStats,
   getTasksByAgentId,
   getTasksByStatus,
@@ -346,6 +347,7 @@ export {
   recordChatRelayError,
   resetTasksNotified,
   SUPERSEDED_RESUME_REPAIR_WINDOW_MS,
+  TASK_LINEAGE_LIMITS,
   type TaskFilters,
 } from "./db/tasks/read";
 
@@ -12354,7 +12356,7 @@ export async function updateUser(
   id: string,
   data: Partial<{
     name: string;
-    email: string;
+    email: string | null;
     role: string;
     notes: string;
     emailAliases: string[];
@@ -12419,7 +12421,12 @@ export async function updateUser(
     `UPDATE users SET ${sets.join(", ")} WHERE id = ? RETURNING *`,
     params,
   );
-  if (row) getDbClient().afterCommit(scheduleOrgDomainRecompute);
+  if (row) {
+    getDbClient().afterCommit(() => {
+      invalidateTelemetryUserRole(id);
+      scheduleOrgDomainRecompute();
+    });
+  }
   return row ? rowToUser(row) : null;
 }
 
@@ -12556,7 +12563,12 @@ export async function deleteUser(id: string, replacementUserId?: string): Promis
     await reclassifyTaskHumanFree(reclassifySeedIds);
 
     const result = await tx.run("DELETE FROM users WHERE id = ?", [id]);
-    if (result.changes > 0) getDbClient().afterCommit(scheduleOrgDomainRecompute);
+    if (result.changes > 0) {
+      getDbClient().afterCommit(() => {
+        invalidateTelemetryUserRole(id);
+        scheduleOrgDomainRecompute();
+      });
+    }
     return result.changes > 0;
   });
 }

package/src/be/fleet-benchmark-stats.ts

@@ -5,15 +5,20 @@
  * registered agent count (the same count `org.snapshot` reports as
  * `agents_total`).
  *
- * Null when that start is unknown: no accepted event is recorded yet, or the
- * earliest one is inside the window.
+ * Comparisons require a known ingest start. With telemetry off, callers can
+ * use the local 30-day window without an ingest anchor.
  */
-import { fleetCountStart, type LocalFleetStats } from "../fleet-benchmark";
+import { FLEET_WINDOW_DAYS, fleetCountStart, type LocalFleetStats } from "../fleet-benchmark";
 import { getDbClient } from "./db/runtime";
 import { getTelemetryIngestAnchor } from "./telemetry-ingest-anchor";
 
-export async function getLocalFleetStats(now = new Date()): Promise<LocalFleetStats | null> {
-  const start = fleetCountStart(await getTelemetryIngestAnchor(), now);
+export async function getLocalFleetStats(
+  now = new Date(),
+  { requireIngestAnchor = true } = {},
+): Promise<LocalFleetStats | null> {
+  const start = requireIngestAnchor
+    ? fleetCountStart(await getTelemetryIngestAnchor(), now)
+    : new Date(now.getTime() - FLEET_WINDOW_DAYS * 86_400_000);
   if (!start) return null;
   const since = start.toISOString();
   const client = getDbClient();

package/src/be/models-catalog.ts

@@ -27,6 +27,10 @@ export const CATALOG_PROVIDER_IDS = [
   "openai",
   "amazon-bedrock",
   "opencode",
+  // OpenCode Go is opencode's first-party subscription provider, a sibling of
+  // its Zen section (`opencode`). models.dev lists it, so projecting it gives
+  // `opencode-go/<model>` ids their context window and reasoning facts.
+  "opencode-go",
   ...openAICompatibleProviderIds(),
 ] as const;
 

package/src/be/onboarding.ts

@@ -498,6 +498,12 @@ function deriveState(
   if (state.steps.connect.status !== "done") {
     changed = completeStep(state, "connect", "api_key", true, events) || changed;
   }
+  // A name saved anywhere (setup, the org-name popup, Settings, the API) names
+  // the swarm. The old setup default "Your Swarm" does not count.
+  const orgName = process.env.SWARM_ORG_NAME?.trim();
+  if (state.steps.name.status !== "done" && orgName && orgName !== "Your Swarm") {
+    changed = completeStep(state, "name", "custom_name", true, events) || changed;
+  }
   if (
     state.steps.ai.status !== "done" &&
     signals.providers.some((entry) => entry.state === "verified")

package/src/be/scripts/typecheck.ts

@@ -419,6 +419,19 @@ export interface SwarmSdk {
     query: string;
     params?: Record<string, string | number | boolean>;
   }): Promise<unknown>;
+  app_rows_list(args: {
+    appId: string;
+    model: string;
+    equals?: Record<string, string | number | boolean>;
+    sort?: \`\${string}:asc\` | \`\${string}:desc\`;
+    limit?: number;
+  }): Promise<unknown>;
+  app_row_get(args: { appId: string; model: string; rowId: string }): Promise<unknown>;
+  app_row_create(args: { appId: string; model: string; values: Record<string, unknown> }): Promise<unknown>;
+  app_rows_create(args: { appId: string; model: string; rows: Record<string, unknown>[] }): Promise<unknown>;
+  app_row_patch(args: { appId: string; model: string; rowId: string; values: Record<string, unknown> }): Promise<unknown>;
+  app_row_delete(args: { appId: string; model: string; rowId: string }): Promise<unknown>;
+  app_rows_delete(args: { appId: string; model: string; equals: Record<string, string | number | boolean>; limit?: number }): Promise<unknown>;
   app_rollback(args: {
     appId: string;
     version: number;

package/src/be/swarm-config-guard.ts

@@ -4,6 +4,11 @@ import { validateQuickJSPoolSize } from "../scripts-runtime/executors/quickjs-po
 import { normalizeSlackReactionShortcode } from "../slack/reaction-shortcode";
 import { ProviderNameSchema } from "../types";
 import { API_DRAIN_MAX_MS_LIMIT } from "../utils/api-drain";
+import {
+  COMPANY_ACQUISITION_SOURCES,
+  COMPANY_TEAM_SIZES,
+  COMPANY_USE_CASES,
+} from "../utils/company-profile";
 import { envExportRestrictedError, isEnvExportRestrictedKey } from "../utils/config-env-export";
 import { validateEgressAllowlist } from "../utils/egress-guard";
 import { parseEnabledTools } from "../utils/enabled-tools";
@@ -134,6 +139,16 @@ export const DB_RETENTION_TUNING_BOUNDS = {
   DB_RETENTION_MAX_STATEMENT_MS: { min: 25, max: 5_000 },
 } as const;
 
+/**
+ * Bounds for the Swarm Apps json column size cap (`APPS_JSON_COLUMN_MAX_BYTES`).
+ *
+ * `src/apps/definition.ts` reads the knob against exactly these at call time
+ * and falls back to its 256 KB default outside them; VALIDATED_KEYS below
+ * rejects out-of-range writes with the same numbers, so the config API cannot
+ * accept a cap the row store would silently ignore.
+ */
+export const APPS_JSON_COLUMN_MAX_BYTES_BOUNDS = { min: 1_024, max: 16_777_216 } as const;
+
 /** Build `{ KEY: validator }` entries accepting only boolean literals. */
 function booleanValidators(keys: string[]): Record<string, ConfigValidator> {
   const message = (key: string) =>
@@ -151,7 +166,8 @@ function booleanValidators(keys: string[]): Record<string, ConfigValidator> {
 
 /** Build a single `{ KEY: validator }` entry restricted to `options`. */
 function enumValidator(key: string, options: string[]): Record<string, ConfigValidator> {
-  const message = `Invalid ${key} value (must be one of: ${options.join(", ")})`;
+  const listed = options.filter(Boolean).join(", ");
+  const message = `Invalid ${key} value (must be one of: ${listed}${options.includes("") ? ", or empty" : ""})`;
   return {
     [key]: (value: unknown) => {
       if (typeof value !== "string") return message;
@@ -423,6 +439,9 @@ const VALIDATED_KEYS: Record<string, ConfigValidator> = {
       ? null
       : "Invalid SWARM_ORG_WEBSITE (must be a public hostname such as example.com, without scheme, www, path or port)";
   },
+  ...enumValidator("SWARM_ORG_TEAM_SIZE", ["", ...COMPANY_TEAM_SIZES]),
+  ...enumValidator("SWARM_ORG_USE_CASE", ["", ...COMPANY_USE_CASES]),
+  ...enumValidator("SWARM_ORG_ACQUISITION_SOURCE", ["", ...COMPANY_ACQUISITION_SOURCES]),
   ...booleanValidators([
     "SWARM_USED_BY_CONSENT",
     "PUBLIC_RANKING_ENABLED",
@@ -518,6 +537,11 @@ const VALIDATED_KEYS: Record<string, ConfigValidator> = {
   // an operator could save a 500ms tick budget, see it accepted, and have the
   // sweep keep running for the default 30000ms.
   ...boundedIntegerValidatorsFor(DB_RETENTION_TUNING_BOUNDS),
+  ...boundedIntegerValidators(
+    ["APPS_JSON_COLUMN_MAX_BYTES"],
+    APPS_JSON_COLUMN_MAX_BYTES_BOUNDS.min,
+    APPS_JSON_COLUMN_MAX_BYTES_BOUNDS.max,
+  ),
   ...boundedIntegerValidators(
     [
       "SESSION_LOG_RETENTION_DAYS",

package/src/be/telemetry-enable.ts

@@ -13,7 +13,7 @@ import { telemetryIngestRecorder } from "./telemetry-ingest-anchor";
 
 type GetConfig = (key: string) => Promise<string | undefined>;
 type SetConfig = (key: string, value: string) => Promise<void>;
-export type TelemetryEnabledVia = "banner" | "settings" | "env";
+export type TelemetryEnabledVia = "banner" | "settings" | "benchmark" | "env";
 
 let accessors: { getConfig: GetConfig; setConfig: SetConfig } | null = null;
 let lastEnabled = false;

package/src/commands/provider-credentials.ts

@@ -155,8 +155,13 @@ export const CREDENTIAL_PROVIDER_CHECKERS: Record<SupportedProvider, CredentialC
   devin: (env) => checkDevinCredentials(env),
   opencode: (env, opts) => checkOpencodeCredentials(env, opts),
   pi: async (env, opts) => {
-    const { checkPiMonoCredentials } = await import("../providers/pi-mono-adapter");
-    return checkPiMonoCredentials(env, opts);
+    const { checkPiMonoCredentials, listPiOpencodeGoModelIds } = await import(
+      "../providers/pi-mono-adapter"
+    );
+    return {
+      ...(await checkPiMonoCredentials(env, opts)),
+      opencodeGoModels: listPiOpencodeGoModelIds(),
+    };
   },
   acp: (env) => {
     const target = env.ACP_TARGET ?? "custom";
@@ -662,6 +667,10 @@ export async function buildCredStatusReport(
           error: presence.ready ? undefined : (presence.hint ?? undefined),
         }
       : null;
+  const opencodeGo: AgentCredStatus["opencodeGo"] =
+    presence.opencodeGoModels !== undefined
+      ? { probedAt: Date.now(), models: presence.opencodeGoModels }
+      : null;
   return {
     ready: presence.ready,
     missing: presence.missing ?? [],
@@ -672,6 +681,7 @@ export async function buildCredStatusReport(
     reportedAt: Date.now(),
     reportKind: kind,
     bedrock,
+    opencodeGo,
     acp: null,
   };
 }

package/src/commands/runner.ts

@@ -1233,6 +1233,9 @@ export const RELOADABLE_ENV_KEYS: ReadonlySet<string> = new Set([
   // turning the setting off stops it on running workers.
   "SWARM_ORG_WEBSITE",
   "PUBLIC_RANKING_ENABLED",
+  "SWARM_ORG_TEAM_SIZE",
+  "SWARM_ORG_USE_CASE",
+  "SWARM_ORG_ACQUISITION_SOURCE",
   // pi reads these from process.env for its traits and its session.
   "PI_TOOL_DEFERRAL",
   "PI_CODEMODE",

package/src/heartbeat/heartbeat.ts

@@ -76,7 +76,7 @@ import {
   REBOOT_RETRY_PIN_TAG,
   resolveLeadOnlyRecoveryAssignment,
 } from "../tasks/worker-follow-up";
-import { type AgentTask, TERMINAL_TASK_STATUSES } from "../types";
+import { type AgentTask, SUPERSEDED_WORKFLOW_TASK_REASON, TERMINAL_TASK_STATUSES } from "../types";
 import { isEnvFlagEnabled } from "../utils/env-flag";
 import { isMultiRuntimeEnabled } from "../utils/multi-runtime";
 import { DEFAULT_OPENROUTER_BASE_URL, getOpenRouterBaseUrl } from "../utils/openrouter-base-url";
@@ -679,7 +679,7 @@ function isRemediationAction(value: unknown): value is RemediationAction {
 
 function decideRemediation(task: AgentTask, facts: RemediationFacts): RemediationDecision {
   if (task.workflowRunStepId != null) {
-    return { action: "fail", reason: "superseded_workflow_task" };
+    return { action: "fail", reason: SUPERSEDED_WORKFLOW_TASK_REASON };
   }
   if (facts.skipAutoResume || facts.alreadyResumed) {
     return { action: "fail", reason: facts.legacyFailReason };

package/src/hooks/codex-hook.ts

@@ -35,6 +35,7 @@ import { getApiKey } from "../utils/api-key";
 import { getMcpBaseUrl } from "../utils/constants";
 import { isSteeringEnabled } from "../utils/steering-enabled";
 import { guardGhPrBody, type PrBodyGuardDeps } from "./pr-body-guard";
+import { guardGhPrRoom, type PrRoomGuardDeps } from "./pr-room-guard";
 
 const FETCH_TIMEOUT_MS = 5_000;
 
@@ -169,13 +170,16 @@ export async function handleCodexHookEvent(
   };
 }
 
-/** PreToolUse: the PR body leak guard's block reason, or null to allow the call. */
+/** PreToolUse: return the first PR guard block reason, or null to allow the call. */
 export async function codexPreToolUseBlock(
   msg: CodexHookMessage,
   deps?: PrBodyGuardDeps,
+  roomDeps?: PrRoomGuardDeps,
 ): Promise<string | null> {
   if (msg.hook_event_name !== "PreToolUse") return null;
-  return guardGhPrBody(msg.tool_input, msg.cwd ?? process.cwd(), deps);
+  const cwd = msg.cwd ?? process.cwd();
+  const block = await guardGhPrBody(msg.tool_input, cwd, deps);
+  return block ?? (await guardGhPrRoom(msg.tool_input, cwd, roomDeps));
 }
 
 /** stdin/stdout entry point used by the `codex-hook` CLI command. */

package/src/hooks/hook.ts

@@ -24,6 +24,7 @@ import { getMcpBaseUrl, MAX_PROFILE_FILE_LENGTH } from "../utils/constants";
 import { summarizeSession as runSummarize } from "../utils/internal-ai";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { guardGhPrBody } from "./pr-body-guard";
+import { guardGhPrRoom } from "./pr-room-guard";
 import { checkToolLoop, clearToolHistory } from "./tool-loop-detection";
 
 const SERVER_NAME = pkg.config?.name ?? "agent-swarm";
@@ -1189,6 +1190,12 @@ export async function handleHook(): Promise<void> {
           process.exitCode = 2;
           return;
         }
+        const prRoomBlock = await guardGhPrRoom(msg.tool_input, msg.cwd ?? process.cwd());
+        if (prRoomBlock) {
+          console.error(prRoomBlock);
+          process.exitCode = 2;
+          return;
+        }
       }
 
       // Emitted last, so a later block stays the only stdout of the event.

package/src/hooks/pr-body-guard.ts

@@ -40,22 +40,29 @@ import { isAbsolute, resolve } from "node:path";
 import { findPrBodyLeaks, type LeakCategory } from "../utils/pr-body-leaks";
 
 export type GhPrInvocation = {
+  action: "create" | "edit";
   /** Working directory of the `gh` call after any `cd`; null when a `cd` target could not be resolved. */
   cwd: string | null;
   /** Explicit target repos: `--repo` / `-R`, a PR URL, or `GH_REPO`. Empty means the checkout at `cwd`. */
   repos: string[];
+  /** Expanded targets for workflow guards. Null means an unknown shell value. */
+  resolvedRepos: Array<string | null>;
   /** Also check the checkout: `GH_REPO` was assigned without `export`, so gh may not see it. */
   alsoCheckout: boolean;
   /** The `gh pr edit` target could not be classified (unset variable, `$(...)`, non-PR URL), so the PR's repo is unknown. */
   unknownTarget: boolean;
   /** Literal public text: `--title` and `--body` values, heredoc or here-string stdin. */
   texts: string[];
+  /** Expanded body values and stdin, excluding the title. Null means an unknown shell value. */
+  bodyTexts: Array<string | null>;
   /** Files that become the body, expanded: `--body-file PATH`, or `--body-file -` with `< PATH`. */
   bodyFiles: string[];
   /** Body file paths whose variables could not be resolved, as written. They count as unreadable. */
   unresolvedBodyFiles: string[];
   /** The body text could not be isolated (piped stdin, unquoted `$(...)`); scan the whole command. */
   opaqueBody: boolean;
+  /** gh may build or change the body from a source the parser cannot read: `--fill*`, `--template`, `--editor`, `--web`, `--recover`. */
+  externalBody: boolean;
 };
 
 export type PrBodyGuardDeps = {
@@ -282,6 +289,9 @@ const SHORT_FLAGS: Record<string, string> = {
   p: "project",
   r: "reviewer",
   T: "template",
+  e: "editor",
+  f: "fill",
+  w: "web",
 };
 
 type ParsedArgs = {
@@ -826,11 +836,14 @@ function parseWithState(
       else bodyFiles.push(expanded);
     }
     found.push({
+      action,
       cwd: wrapperFlags || dirUnknown ? null : state.dir,
       repos: [...new Set(repos)],
+      resolvedRepos: repos.map(expand),
       alsoCheckout,
       unknownTarget,
       texts: [...inline, ...(fromStdin ? stdin : [])],
+      bodyTexts: [...values("body"), ...(fromStdin ? stdin : [])].map(expand),
       bodyFiles,
       unresolvedBodyFiles,
       // An unquoted `$(` splits at the paren, leaving a value that ends in `$`.
@@ -839,6 +852,9 @@ function parseWithState(
         inline.some((value) => value.endsWith("$")) ||
         (action === "edit" && target?.endsWith("$") === true) ||
         (fromStdin && stdin.length === 0 && args.stdinFile === undefined),
+      externalBody:
+        values("fill", "fill-first", "fill-verbose", "template", "editor", "web", "recover")
+          .length > 0,
     });
   };
 
@@ -861,6 +877,25 @@ function parseWithState(
 const BLOCK_ADVICE =
   "Paraphrase the motivation ('a maintainer asked for X') and link only public sources (Fixes #N, a public PR or issue). Task, session, agent-fs and Slack permalinks go only under '## Swarm provenance'. Bare Slack ids, ts values and private-chat quotes are blocked everywhere.";
 
+/** Read body files relative to the parsed checkout and retain the first unreadable path. */
+export async function readGhPrBodyFiles(
+  call: GhPrInvocation,
+  readFile: PrBodyGuardDeps["readFile"],
+): Promise<{ texts: string[]; unreadable: string | undefined }> {
+  const texts: string[] = [];
+  let unreadable = call.unresolvedBodyFiles[0];
+  for (const bodyFile of call.bodyFiles) {
+    try {
+      const base = isAbsolute(bodyFile) ? "/" : call.cwd;
+      if (base === null) throw new Error("unknown working directory");
+      texts.push(await readFile(resolve(base, bodyFile)));
+    } catch {
+      unreadable ??= bodyFile;
+    }
+  }
+  return { texts, unreadable };
+}
+
 /** Check a shell command. Returns a block reason, or null to allow. */
 export async function checkGhPrCommand(
   command: string,
@@ -873,17 +908,9 @@ export async function checkGhPrCommand(
     for (const text of call.opaqueBody ? [...call.texts, command] : call.texts) {
       for (const leak of findPrBodyLeaks(text)) leaks.add(leak);
     }
-    let unreadable: string | undefined = call.unresolvedBodyFiles[0];
-    for (const bodyFile of call.bodyFiles) {
-      try {
-        const base = isAbsolute(bodyFile) ? "/" : call.cwd;
-        if (base === null) throw new Error("unknown working directory");
-        for (const leak of findPrBodyLeaks(await deps.readFile(resolve(base, bodyFile)))) {
-          leaks.add(leak);
-        }
-      } catch {
-        unreadable ??= bodyFile;
-      }
+    const { texts, unreadable } = await readGhPrBodyFiles(call, deps.readFile);
+    for (const text of texts) {
+      for (const leak of findPrBodyLeaks(text)) leaks.add(leak);
     }
     if (leaks.size === 0 && unreadable === undefined) continue;
 

package/src/hooks/pr-room-guard.ts

@@ -0,0 +1,88 @@
+import { parseGhPrCommands, readGhPrBodyFiles, shellCommandOf } from "./pr-body-guard";
+
+export type PrRoomGuardDeps = {
+  env: Record<string, string | undefined>;
+  readFile: (path: string) => Promise<string>;
+  remoteOrigin: (cwd: string) => Promise<string>;
+};
+
+const BLOCK_REASON =
+  'This repo uses PR rooms. Create the room first with the pr-room skill (app action createRoom). Then pass the returned prBody with --body-file. The body must contain the line "PR room: prr-...".';
+const ROOM_LINE = /^PR room: prr-[a-z2-7]{10}\b/m;
+const REMOTE_LOOKUP_TIMEOUT_MS = 5_000;
+
+/** Read the `remote.origin.url` of a checkout. A lookup that does not finish in `timeoutMs` is killed and rejects. */
+export async function gitRemoteOrigin(
+  cwd: string,
+  timeoutMs = REMOTE_LOOKUP_TIMEOUT_MS,
+): Promise<string> {
+  const proc = Bun.spawn(["git", "-C", cwd, "config", "--get", "remote.origin.url"], {
+    stdout: "pipe",
+    stderr: "ignore",
+    stdin: "ignore",
+    timeout: timeoutMs,
+    killSignal: "SIGKILL",
+  });
+  const [out, code] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+  if (code !== 0) throw new Error("Cannot resolve checkout remote");
+  return out.trim();
+}
+
+const defaultDeps = (): PrRoomGuardDeps => ({
+  env: process.env,
+  readFile: (path) => Bun.file(path).text(),
+  remoteOrigin: (cwd) => gitRemoteOrigin(cwd),
+});
+
+/** Extract owner/repo from an HTTPS, SSH URL, or SCP-style SSH remote. */
+function repoFromRemote(remote: string): string | undefined {
+  const match =
+    /^(?:https?:\/\/[^/]+\/|ssh:\/\/[^/]+\/|[^\s/@:]+@[^\s/:]+:)([^/\s]+)\/([^/\s]+?)\/?$/.exec(
+      remote.trim(),
+    );
+  return match ? `${match[1]}/${match[2]?.replace(/\.git$/, "")}`.toLowerCase() : undefined;
+}
+
+/** Require a room marker for configured repositories. Unresolved or ambiguous inputs allow the command. */
+export async function guardGhPrRoom(
+  toolInput: unknown,
+  cwd: string,
+  deps: PrRoomGuardDeps = defaultDeps(),
+): Promise<string | null> {
+  try {
+    const repos = new Set(
+      (deps.env.PR_ROOM_REPOS ?? "")
+        .split(",")
+        .map((repo) => repo.trim().toLowerCase())
+        .filter(Boolean),
+    );
+    if (repos.size === 0) return null;
+    const command = shellCommandOf(toolInput);
+    if (command === null) return null;
+    for (const call of parseGhPrCommands(command, cwd, deps.env)) {
+      if (call.action !== "create" || call.unknownTarget || call.cwd === null) continue;
+      // The body comes from a pipe, a command substitution, gh itself, or an unknown variable.
+      if (call.opaqueBody || call.externalBody || call.bodyTexts.includes(null)) continue;
+      const targets = [...call.resolvedRepos];
+      if (targets.includes(null)) continue;
+      if (targets.length === 0 || call.alsoCheckout) {
+        try {
+          const repo = repoFromRemote(await deps.remoteOrigin(call.cwd));
+          if (!repo) continue;
+          targets.push(repo);
+        } catch {
+          continue;
+        }
+      }
+      // An unexported `GH_REPO=x` may not reach gh: block only when every candidate is listed.
+      if (!targets.every((repo) => repo !== null && repos.has(repo.trim().toLowerCase()))) continue;
+      const body = await readGhPrBodyFiles(call, deps.readFile);
+      if (body.unreadable !== undefined) continue;
+      const texts = [...call.bodyTexts, ...body.texts];
+      if (!texts.some((text) => text !== null && ROOM_LINE.test(text))) return BLOCK_REASON;
+    }
+  } catch {
+    // A workflow reminder must not prevent commands when resolution fails.
+  }
+  return null;
+}

package/src/http/agents.ts

@@ -1502,6 +1502,7 @@ export async function handleAgentsRest(
         reportedAt: parsed.body.latest_model?.reportedAt ?? parsed.body.acp!.reportedAt,
         reportKind: "post_task" as const,
         bedrock: null,
+        opencodeGo: null,
         acp: null,
       };
       finalAgent =