@heretek-ai/epistemic-swarm 0.7.21 → 0.7.23

package/plugins/opencode/tui.js

@@ -26,7 +26,8 @@ import {
   saveConfig,
   validateConfig,
 } from './config-io.js';
-import { OPENCODE_COMMANDS, SettingsRpc } from './index.js';
+import { gatePreCommit } from './hook-bus.js';
+import { OPENCODE_COMMANDS, SettingsRpc, hookBus as sharedHookBus } from './index.js';
 
 const PLUGIN_ID = 'heretek.iumbtems.epistemic-swarm.tui';
 const REFRESH_MS = 5000;
@@ -100,6 +101,70 @@ export function subscribeSettingsChanged(api, onChanged) {
   }
 }
 
+/**
+ * Phase 01-hook-bus-spec fix round (QA-B FAIL 1): `pre-commit` gate for the
+ * TUI direct-fs fallback leg (`saveConfig(draft, baseDir, guard)` in
+ * `openSettingsWizard`). The RPC leg already gates in
+ * `createSettingsHandlers().set`; without this the fallback wrote with zero
+ * `pre-commit` emit and zero audit entry.
+ *
+ * Emits `pre-commit` through the bus and maps the verdict per the tier table
+ * (deny blocks, bus faults fail open). The stale-write guard is NOT replaced
+ * — the caller still passes `guard` to `saveConfig`, which enforces
+ * `CONFIG_STALE` downstream. On RPC-null hosts the bus remains the
+ * enforcement point: pass `opts.hookBus` (or a host carrying the adopted
+ * `host.iumbtemsHookBus`); a null bus fails open with `{ allowed: true }`.
+ * The emit itself audit-logs the decision, so a denied fallback write always
+ * leaves an audit entry. Never throws.
+ *
+ * Narrow fix round (qa-b bypass): the shipped TUI path previously called
+ * `openSettingsWizard(api, root)` with no opts on an api that carried no
+ * `iumbtemsHookBus`, so the fallback gate resolved null and failed open past
+ * a denying pre-commit handler. `resolveHookBus` closes that wiring gap: the
+ * shared bus (`hookBus` from `index.js`, same instance the settings-RPC leg
+ * gates on [VERIFIED: sha256:52ac5b4d26062cfc6093440faa415ab152f8acd0d18c4496eb0087ed18a27d76])
+ * is the final fallback, so the shipped configuration never resolves a null
+ * bus. Fail-open remains only for genuine bus faults (null/non-emit bus
+ * passed EXPLICITLY to `gateDirectFsPreCommit`), not for missing wiring.
+ */
+export async function gateDirectFsPreCommit(bus, { draft, baseDir, guard } = {}) {
+  try {
+    if (!bus || typeof bus.emit !== 'function') return { allowed: true };
+    const expected = guard?.expected_hash ?? guard?.expectedHash ?? null;
+    return await gatePreCommit(bus, {
+      updates: draft ?? {},
+      root: baseDir ?? null,
+      ...(expected !== null && expected !== undefined ? { expected_hash: expected } : {}),
+    });
+  } catch {
+    return { allowed: true };
+  }
+}
+
+/**
+ * Resolve the pre-commit bus for the wizard fallback leg. Precedence:
+ * explicit `opts.hookBus` > adopted `host.iumbtemsHookBus` > shared bus.
+ * The shared-bus fallback is what keeps the shipped TUI path (slash command
+ * + palette, both RPC-null) from resolving a null bus. Never throws.
+ */
+export function resolveHookBus(host, opts) {
+  try {
+    const explicit = opts && opts.hookBus;
+    if (explicit && typeof explicit.emit === 'function') return explicit;
+    const adopted = host && host.iumbtemsHookBus;
+    if (adopted && typeof adopted.emit === 'function') return adopted;
+    if (sharedHookBus && typeof sharedHookBus.emit === 'function') return sharedHookBus;
+    return null;
+  } catch {
+    try {
+      if (sharedHookBus && typeof sharedHookBus.emit === 'function') return sharedHookBus;
+    } catch {
+      /* fall through */
+    }
+    return null;
+  }
+}
+
 /** Read UI-only prefs ({} when the host has no TUI storage). Never throws. */
 export function readUiPrefs(api) {
   try {
@@ -426,7 +491,7 @@ function SwarmKeymapLayer(api) {
         'Edit IUMBTEMS settings in a dialog wizard (validates input, writes atomically)',
       group: 'IUMBTEMS',
       palette: true,
-      run: () => openSettingsWizard(api, resolveRoot(api)),
+      run: () => openSettingsWizard(api, resolveRoot(api), { hookBus: resolveHookBus(api, null) }),
     },
     {
       id: SETTINGS_PANEL_COMMAND_ID,
@@ -504,9 +569,98 @@ const WIZARD_KEEP_VALUE = '__iumbtems_keep__';
 
 function wizardToast(host, title, message) {
   try {
-    host?.ui?.toast?.show?.({ title, message, variant: 'info', duration: 6000 });
+    const toast = host?.ui?.toast;
+    const show = toast?.show;
+    if (typeof show !== 'function') return false;
+    show.call(toast, { title, message, variant: 'info', duration: 6000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Phase 07 (H8): keyed advisory dedup window for the repeating R4 advisories.
+//
+// Editing an env-shadowed or deprecated row fires its advisory on EVERY edit,
+// so a multi-edit wizard session spams one toast per row visit. `warnOnce`
+// collapses repeats of the SAME advisory key inside a TTL window: the first
+// shows, repeats within the window are suppressed (counted), expiry re-shows
+// (annotated with the suppressed count), and distinct keys stay independent.
+//
+// SAFETY: only the two repeating R4 advisories route here. Degraded-path,
+// malformed-config, validation-error, stale, and save-failure toasts call
+// `wizardToast` directly and are NEVER deduped (missed-action safety).
+// Durations are preserved: wizard advisories stay 6000ms via `wizardToast`
+// (the 4000ms keymap usage toast is untouched).
+// ---------------------------------------------------------------------------
+
+/** Dedup window for repeating R4 advisories, in ms. Exported for tests. */
+export const ADVISORY_DEDUP_MS = 30000;
+
+/** key -> { ts, suppressed }: last show time + repeats collapsed since. */
+const advisorySeen = new Map();
+
+/**
+ * Show a keyed advisory toast at most once per `ttlMs` window.
+ * Returns true when a toast was actually delivered, false when collapsed
+ * or when delivery failed (failed deliveries never arm the window).
+ * `opts.now` injects the clock (tests); `opts.ttlMs` overrides the window.
+ * Session scope: each `openSettingsWizard` call resets the window (fresh
+ * wizard session always warns at least once); repeats within one session
+ * still collapse. Never throws.
+ */
+export function warnOnce(host, key, title, message, opts = {}) {
+  try {
+    const ttl =
+      opts && opts.ttlMs !== undefined && opts.ttlMs !== null
+        ? Number(opts.ttlMs)
+        : ADVISORY_DEDUP_MS;
+    const now =
+      opts && opts.now !== undefined && opts.now !== null
+        ? Number(opts.now)
+        : Date.now();
+    const entry = advisorySeen.get(key);
+    if (entry && Number.isFinite(ttl) && ttl > 0) {
+      const dt = now - entry.ts;
+      if (Number.isFinite(dt) && dt >= 0 && dt < ttl) {
+        entry.suppressed += 1;
+        return false;
+      }
+      // dt < 0 (clock moved backwards) or dt >= ttl (expiry) fall through
+      // to reshow — a backwards clock must never suppress indefinitely.
+    }
+    let text = message;
+    if (entry && entry.suppressed > 0) {
+      text += ` (repeated ${entry.suppressed + 1}× since last notice)`;
+    }
+    // Arm the window ONLY on actual delivery: a failed toast (missing/broken
+    // host) leaves state untouched so the next real warning still delivers.
+    const delivered = wizardToast(host, title, text);
+    if (!delivered) return false;
+    advisorySeen.set(key, { ts: now, suppressed: 0 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Test hook: forget all dedup state. Never throws. */
+export function _resetAdvisoryDedup() {
+  try {
+    advisorySeen.clear();
+  } catch {
+    /* never throw */
+  }
+}
+
+/** Test hook: suppressed-repeat count pending for `key`. Never throws. */
+export function _advisorySuppressed(key) {
+  try {
+    const entry = advisorySeen.get(key);
+    return entry ? entry.suppressed : 0;
   } catch {
-    /* toast is best-effort */
+    return 0;
   }
 }
 
@@ -715,23 +869,29 @@ async function editRow(dialog, host, draft, row) {
   try {
     const sub = row.schema || {};
     // R4 advisories (never block the edit; the write still proceeds):
-    // an env-shadowed value has no runtime effect until the override is
-    // unset, and a deprecated key is display-only.
+    // an env-shadowed value is not effective while the override is set, and
+    // a deprecated key is ignored at runtime. Both route through the keyed
+    // dedup window (per-key repeats collapse); every other toast stays
+    // un-deduped so no error or degraded-path notice is ever swallowed.
     if (row.source === 'env-override') {
-      wizardToast(
+      warnOnce(
         host,
+        `env:${row.key}`,
         'Environment override',
-        `The environment shadows '${row.key}' — editing the file value has ` +
-          'no runtime effect until the override is unset. The stored value is ' +
-          'still saved on confirm.'
+        `The environment shadows '${row.key}' — the file value is not ` +
+          'effective while the override is set and has no runtime effect ' +
+          'until the override is unset. The edited value is still stored ' +
+          'on save (cancel writes nothing).'
       );
     }
     if (row.deprecated) {
-      wizardToast(
+      warnOnce(
         host,
+        `deprecated:${row.key}`,
         'Deprecated field',
-        `'${row.key}' is deprecated and display-only — it never selects the ` +
-          'workspace. The stored value is still saved on confirm.'
+        `'${row.key}' is deprecated and ignored — it has no runtime ` +
+          'effect. The edited value is still stored on save for reference, ' +
+          'but changes nothing (cancel writes nothing).'
       );
     }
     const types = Array.isArray(sub.type) ? sub.type : [sub.type];
@@ -999,6 +1159,15 @@ async function editAgentsRow(dialog, host, draft, row) {
  */
 export async function openSettingsWizard(host, root, opts = {}) {
   try {
+    // R1 session scope: a fresh wizard session always warns at least once.
+    // The keyed R4 window collapses repeats WITHIN one session only; reset
+    // the boundary here so a prior session (same key, <30s ago) never leaks
+    // into the new session. Never throws.
+    try {
+      advisorySeen.clear();
+    } catch {
+      /* dedup reset is best-effort */
+    }
     const dialog = dialogOf(host);
     const baseDir = researchDirOf(host, root);
     const env = (opts && opts.env) || process.env;
@@ -1164,6 +1333,32 @@ export async function openSettingsWizard(host, root, opts = {}) {
           opts && (opts.expected_hash !== undefined || opts.expectedHash !== undefined)
             ? { expected_hash: opts.expected_hash, expectedHash: opts.expectedHash }
             : { expectedHash: startHash };
+        // Phase 01-hook-bus-spec fix round (QA-B FAIL 1): the direct-fs
+        // fallback is gated by `pre-commit` too — a tier-table deny blocks
+        // the write (toast + `{ ok: false, reason: 'pre-commit-denied' }`,
+        // nothing written, decision audit-logged on the bus). Bus faults
+        // fail open; the stale-write guard below (`saveConfig` raising
+        // `CONFIG_STALE`) is preserved unchanged.
+        try {
+          // Narrow fix round (qa-b bypass): resolve via the shared-bus
+          // fallback so the shipped RPC-null path never gates on null.
+          const fsBus = resolveHookBus(host, opts);
+          const fsGate = await gateDirectFsPreCommit(fsBus, {
+            draft,
+            baseDir,
+            guard,
+          });
+          if (fsGate && fsGate.allowed === false) {
+            wizardToast(
+              host,
+              'IUMBTEMS settings',
+              'Save denied by pre-commit hook — nothing was written.'
+            );
+            return { ok: false, reason: 'pre-commit-denied', written: false };
+          }
+        } catch {
+          /* gate faults fail open; the write below still runs */
+        }
         try {
           const res = saveConfig(draft, baseDir, guard);
           wizardToast(
@@ -1248,7 +1443,7 @@ export async function openSettingsPanel(host, root, opts = {}) {
  * without `command.transform` there is nothing to register (the palette
  * entries from the keymap layer still work). Never throws.
  */
-export async function registerWizardSlashCommand(api) {
+export async function registerWizardSlashCommand(api, opts = {}) {
   try {
     if (typeof api?.command?.transform !== 'function') return null;
     let existing = new Set();
@@ -1270,7 +1465,13 @@ export async function registerWizardSlashCommand(api) {
             'Inspect or update Epistemic Swarm parameters in a dialog wizard (validates + writes atomically)',
           execute: async () => {
             try {
-              await openSettingsWizard(api, resolveRoot(api));
+              // Narrow fix round (qa-b bypass): thread the bus on the shipped
+              // path — explicit opt > adopted host bus > shared bus — so the
+              // fallback gate never resolves null here.
+              await openSettingsWizard(api, resolveRoot(api), {
+                ...(opts || {}),
+                hookBus: resolveHookBus(api, opts),
+              });
             } catch {
               /* the wizard never throws into the host */
             }
@@ -1292,8 +1493,20 @@ export async function registerWizardSlashCommand(api) {
 }
 
 /** TUI setup: sidebar slot + palette command. Never throws. */
-export function setupTui(api) {
+export function setupTui(api, opts = {}) {
   try {
+    // Narrow fix round (qa-b bypass): adopt the shared bus onto the TUI api
+    // so `opts.hookBus || host.iumbtemsHookBus` never resolves null on the
+    // shipped path. Best-effort; never throws. The shared instance is the
+    // same one the settings-RPC leg gates on.
+    try {
+      if (api && typeof api === 'object' && !(api.iumbtemsHookBus && typeof api.iumbtemsHookBus.emit === 'function')) {
+        const bus = (opts && opts.hookBus) || sharedHookBus || null;
+        if (bus && typeof bus.emit === 'function') api.iumbtemsHookBus = bus;
+      }
+    } catch {
+      /* host attach is best-effort */
+    }
     const root = resolveRoot(api);
     const offSidebar = registerSlot(api, 'sidebar.content', () =>
       SwarmSidebar(api, root)
@@ -1304,7 +1517,7 @@ export function setupTui(api) {
     // setup stays synchronous; the handle lands when the host resolves it.
     let slashRegistration = null;
     try {
-      Promise.resolve(registerWizardSlashCommand(api))
+      Promise.resolve(registerWizardSlashCommand(api, opts))
         .then((reg) => {
           slashRegistration = reg;
         })

package/plugins/opencode/weight-baseline.json

@@ -0,0 +1,16 @@
+{
+  "$comment": "Phase 04-coverage-treeshake-signals bundle baseline: measured once at build (esbuild metafile:true, write:false — measure, never emit) over the plugin host surface. Deltas compute against `bytes`. Refresh is an explicit user-confirmed step — NEVER automatic (a stale baseline annotates `stale-baseline` and still allows).",
+  "entry": "plugins/opencode/index.js",
+  "bytes": 182262,
+  "files": 6,
+  "topHeaviest": [
+    { "file": "plugins/opencode/index.js", "bytes": 119966 },
+    { "file": "plugins/opencode/config-io.js", "bytes": 60042 },
+    { "file": "plugins/opencode/dep-health.js", "bytes": 40199 },
+    { "file": "plugins/opencode/weight-signals.js", "bytes": 29350 },
+    { "file": "plugins/opencode/analysis-bridge.js", "bytes": 20953 }
+  ],
+  "measuredAt": "2026-10-03T00:00:00.000Z",
+  "measuredBy": "esbuild 0.28.2 (pinned devDep; bundle:true, metafile:true, write:false, platform:node, format:esm, external:[esbuild])",
+  "phase": "04-coverage-treeshake-signals"
+}