opencode-swarm 6.19.3 → 6.19.5

package/README.md

@@ -2,6 +2,8 @@
 
 **Your AI writes the code. Swarm makes sure it actually works.**
 
+https://swarmai.site/
+
 OpenCode Swarm is a plugin for [OpenCode](https://opencode.ai) that turns a single AI coding agent into a team of nine. One agent writes the code. A different agent reviews it. Another writes and runs tests. Another catches security issues. Nothing ships until every check passes. Your project state is saved to disk, so you can close your laptop, come back tomorrow, and pick up exactly where you left off.
 
 ```bash
@@ -321,6 +323,39 @@ Every completed task writes structured evidence to `.swarm/evidence/`:
 
 </details>
 
+<details>
+<summary><strong>Save Plan Tool: Target Workspace Requirement</strong></summary>
+
+The `save_plan` tool requires an explicit target workspace path. It does **not** fall back to `process.cwd()`.
+
+### Explicit Workspace Requirement
+
+- The `working_directory` parameter must be provided
+- Providing no value or relying on implicit directory resolution will result in deterministic failure
+
+### Failure Conditions
+
+| Condition | Behavior |
+|-----------|----------|
+| Missing (`undefined` / `null`) | Fails with: "Target workspace is required" |
+| Empty or whitespace-only | Fails with: "Target workspace cannot be empty or whitespace" |
+| Path traversal (`..`) | Fails with: "Target workspace cannot contain path traversal" |
+
+### Usage Contract
+
+When using `save_plan`, always pass a valid `working_directory`:
+
+```typescript
+save_plan({
+  title: "My Project",
+  swarm_id: "mega",
+  phases: [{ id: 1, name: "Setup", tasks: [{ id: "1.1", description: "Initialize project" }] }],
+  working_directory: "/path/to/project"  // Required - no fallback
+})
+```
+
+</details>
+
 <details>
 <summary><strong>Guardrails and Circuit Breakers</strong></summary>
 

package/dist/cli/index.js

@@ -16160,6 +16160,9 @@ async function loadPlan(directory) {
   return null;
 }
 async function savePlan(directory, plan) {
+  if (directory === null || directory === undefined || typeof directory !== "string" || directory.trim().length === 0) {
+    throw new Error(`Invalid directory: directory must be a non-empty string`);
+  }
   const validated = PlanSchema.parse(plan);
   const swarmDir = path6.resolve(directory, ".swarm");
   const planPath = path6.join(swarmDir, "plan.json");
@@ -31634,14 +31637,14 @@ function parseContextMd(content) {
 function splitIntoSections(content) {
   const sections = [];
   const headingRegex = /^(#{1,3})\s+(.+)/gm;
-  const lastIndex = 0;
-  let match;
   const matches = [];
-  while ((match = headingRegex.exec(content)) !== null) {
+  let match = headingRegex.exec(content);
+  while (match !== null) {
     matches.push({
       index: match.index,
       heading: match[0]
     });
+    match = headingRegex.exec(content);
   }
   for (let i = 0;i < matches.length; i++) {
     const current = matches[i];
@@ -31691,7 +31694,7 @@ function inferCategoryFromText(text) {
 function truncateLesson(text) {
   if (text.length <= 280)
     return text;
-  return text.slice(0, 277) + "...";
+  return `${text.slice(0, 277)}...`;
 }
 function inferProjectName(directory) {
   const packageJsonPath = path8.join(directory, "package.json");

package/dist/index.js

@@ -14700,6 +14700,9 @@ async function loadPlan(directory) {
   return null;
 }
 async function savePlan(directory, plan) {
+  if (directory === null || directory === undefined || typeof directory !== "string" || directory.trim().length === 0) {
+    throw new Error(`Invalid directory: directory must be a non-empty string`);
+  }
   const validated = PlanSchema.parse(plan);
   const swarmDir = path4.resolve(directory, ".swarm");
   const planPath = path4.join(swarmDir, "plan.json");
@@ -43139,14 +43142,14 @@ function parseContextMd(content) {
 function splitIntoSections(content) {
   const sections = [];
   const headingRegex = /^(#{1,3})\s+(.+)/gm;
-  const lastIndex = 0;
-  let match;
   const matches = [];
-  while ((match = headingRegex.exec(content)) !== null) {
+  let match = headingRegex.exec(content);
+  while (match !== null) {
     matches.push({
       index: match.index,
       heading: match[0]
     });
+    match = headingRegex.exec(content);
   }
   for (let i2 = 0;i2 < matches.length; i2++) {
     const current = matches[i2];
@@ -43196,7 +43199,7 @@ function inferCategoryFromText(text) {
 function truncateLesson(text) {
   if (text.length <= 280)
     return text;
-  return text.slice(0, 277) + "...";
+  return `${text.slice(0, 277)}...`;
 }
 function inferProjectName(directory) {
   const packageJsonPath = path12.join(directory, "package.json");
@@ -45795,11 +45798,10 @@ function createGuardrailsHooks(directory, config3) {
             const patchPathPattern = /\*\*\*\s+(?:Update|Add|Delete)\s+File:\s*(.+)/gi;
             const diffPathPattern = /\+\+\+\s+b\/(.+)/gm;
             const paths = new Set;
-            let match;
-            while ((match = patchPathPattern.exec(patchText)) !== null) {
+            for (const match of patchText.matchAll(patchPathPattern)) {
               paths.add(match[1].trim());
             }
-            while ((match = diffPathPattern.exec(patchText)) !== null) {
+            for (const match of patchText.matchAll(diffPathPattern)) {
               const p = match[1].trim();
               if (p !== "/dev/null")
                 paths.add(p);
@@ -48356,7 +48358,10 @@ function formatStars(confidence) {
   return "\u2605\u2606\u2606";
 }
 function sanitizeLessonForContext(text) {
-  return text.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, "").replace(/[\u200B-\u200D\uFEFF]/g, "").replace(/[\u202A-\u202E\u2066-\u2069]/g, "").replace(/```/g, "` ` `").replace(/^system\s*:/gim, "[BLOCKED]:");
+  return text.split("").filter((char) => {
+    const code = char.charCodeAt(0);
+    return code === 9 || code === 10 || code === 13 || code > 31 && code !== 127;
+  }).join("").replace(/[\u200B-\u200D\uFEFF]/g, "").replace(/[\u202A-\u202E\u2066-\u2069]/g, "").replace(/```/g, "` ` `").replace(/^system\s*:/gim, "[BLOCKED]:");
 }
 function isOrchestratorAgent(agentName) {
   const stripped = stripKnownSwarmPrefix(agentName);
@@ -50549,25 +50554,50 @@ import * as path30 from "path";
 init_manager();
 init_utils2();
 init_create_tool();
-function getDelegationsSince(sessionID, sinceTimestamp) {
-  const chain = swarmState.delegationChains.get(sessionID);
-  if (!chain) {
-    return [];
-  }
-  if (sinceTimestamp === 0) {
-    return chain;
-  }
-  return chain.filter((entry) => entry.timestamp > sinceTimestamp);
-}
-function normalizeAgentsFromDelegations(delegations) {
+function collectCrossSessionDispatchedAgents(phaseReferenceTimestamp, callerSessionId) {
   const agents = new Set;
-  for (const delegation of delegations) {
-    const normalizedFrom = stripKnownSwarmPrefix(delegation.from);
-    const normalizedTo = stripKnownSwarmPrefix(delegation.to);
-    agents.add(normalizedFrom);
-    agents.add(normalizedTo);
+  const contributorSessionIds = [];
+  const callerSession = swarmState.agentSessions.get(callerSessionId);
+  if (callerSession) {
+    contributorSessionIds.push(callerSessionId);
+    if (callerSession.phaseAgentsDispatched) {
+      for (const agent of callerSession.phaseAgentsDispatched) {
+        agents.add(agent);
+      }
+    }
+    const callerDelegations = swarmState.delegationChains.get(callerSessionId);
+    if (callerDelegations) {
+      for (const delegation of callerDelegations) {
+        agents.add(stripKnownSwarmPrefix(delegation.from));
+        agents.add(stripKnownSwarmPrefix(delegation.to));
+      }
+    }
   }
-  return agents;
+  for (const [sessionId, session] of swarmState.agentSessions) {
+    if (sessionId === callerSessionId) {
+      continue;
+    }
+    const hasRecentToolCalls = session.lastToolCallTime >= phaseReferenceTimestamp;
+    const delegations = swarmState.delegationChains.get(sessionId);
+    const hasRecentDelegations = delegations?.some((d) => d.timestamp >= phaseReferenceTimestamp) ?? false;
+    const hasActivity = hasRecentToolCalls || hasRecentDelegations;
+    if (hasActivity) {
+      contributorSessionIds.push(sessionId);
+      if (session.phaseAgentsDispatched) {
+        for (const agent of session.phaseAgentsDispatched) {
+          agents.add(agent);
+        }
+      }
+      const delegations2 = swarmState.delegationChains.get(sessionId);
+      if (delegations2) {
+        for (const delegation of delegations2) {
+          agents.add(stripKnownSwarmPrefix(delegation.from));
+          agents.add(stripKnownSwarmPrefix(delegation.to));
+        }
+      }
+    }
+  }
+  return { agents, contributorSessionIds };
 }
 function isValidRetroEntry(entry, phase) {
   return entry.type === "retrospective" && "phase_number" in entry && entry.phase_number === phase && "verdict" in entry && entry.verdict === "pass";
@@ -50597,12 +50627,9 @@ async function executePhaseComplete(args2, workingDirectory) {
     }, null, 2);
   }
   const session = ensureAgentSession(sessionID);
-  const lastCompletionTimestamp = session.lastPhaseCompleteTimestamp ?? 0;
-  const recentDelegations = getDelegationsSince(sessionID, lastCompletionTimestamp);
-  const delegationAgents = normalizeAgentsFromDelegations(recentDelegations);
-  const trackedAgents = session.phaseAgentsDispatched ?? new Set;
-  const allAgents = new Set([...delegationAgents, ...trackedAgents]);
-  const agentsDispatched = Array.from(allAgents).sort();
+  const phaseReferenceTimestamp = session.lastPhaseCompleteTimestamp ?? 0;
+  const crossSessionResult = collectCrossSessionDispatchedAgents(phaseReferenceTimestamp, sessionID);
+  const agentsDispatched = Array.from(crossSessionResult.agents).sort();
   const dir = workingDirectory ?? process.cwd();
   const { config: config3 } = loadPluginConfigWithMeta(dir);
   let phaseCompleteConfig;
@@ -50668,7 +50695,7 @@ async function executePhaseComplete(args2, workingDirectory) {
       status: "blocked",
       reason: "RETROSPECTIVE_MISSING",
       message: `Phase ${phase} cannot be completed: no valid retrospective evidence found.${schemaErrorDetail} Write a retrospective bundle at .swarm/evidence/retro-${phase}/evidence.json before calling phase_complete.`,
-      agentsDispatched: [],
+      agentsDispatched,
       agentsMissing: [],
       warnings: [
         `Retrospective missing for phase ${phase}.${schemaErrorDetail} Use this template:`,
@@ -50731,7 +50758,7 @@ async function executePhaseComplete(args2, workingDirectory) {
   if (phaseCompleteConfig.require_docs && !effectiveRequired.includes("docs")) {
     effectiveRequired.push("docs");
   }
-  const agentsMissing = effectiveRequired.filter((req) => !allAgents.has(req));
+  const agentsMissing = effectiveRequired.filter((req) => !crossSessionResult.agents.has(req));
   const warnings = [];
   let success3 = true;
   let status = "success";
@@ -50748,7 +50775,7 @@ async function executePhaseComplete(args2, workingDirectory) {
     }
   }
   const now = Date.now();
-  const durationMs = now - lastCompletionTimestamp;
+  const durationMs = now - phaseReferenceTimestamp;
   const event = {
     event: "phase_complete",
     phase,
@@ -50766,9 +50793,14 @@ async function executePhaseComplete(args2, workingDirectory) {
     warnings.push(`Warning: failed to write phase complete event: ${writeError instanceof Error ? writeError.message : String(writeError)}`);
   }
   if (success3) {
-    session.phaseAgentsDispatched = new Set;
-    session.lastPhaseCompleteTimestamp = now;
-    session.lastPhaseCompletePhase = phase;
+    for (const contributorSessionId of crossSessionResult.contributorSessionIds) {
+      const contributorSession = swarmState.agentSessions.get(contributorSessionId);
+      if (contributorSession) {
+        contributorSession.phaseAgentsDispatched = new Set;
+        contributorSession.lastPhaseCompleteTimestamp = now;
+        contributorSession.lastPhaseCompletePhase = phase;
+      }
+    }
   }
   const result = {
     success: success3,
@@ -54175,6 +54207,20 @@ function detectPlaceholderContent(args2) {
   }
   return issues;
 }
+function validateTargetWorkspace(target, source) {
+  if (target === undefined || target === null) {
+    return `Target workspace is required: ${source} not provided`;
+  }
+  const trimmed = target.trim();
+  if (trimmed.length === 0) {
+    return `Target workspace cannot be empty or whitespace: ${source}`;
+  }
+  const normalized = trimmed.replace(/\\/g, "/");
+  if (normalized.includes("..")) {
+    return `Target workspace cannot contain path traversal: ${source} contains ".."`;
+  }
+  return;
+}
 async function executeSavePlan(args2, fallbackDir) {
   const placeholderIssues = detectPlaceholderContent(args2);
   if (placeholderIssues.length > 0) {
@@ -54184,6 +54230,15 @@ async function executeSavePlan(args2, fallbackDir) {
       errors: placeholderIssues
     };
   }
+  const targetWorkspace = args2.working_directory ?? fallbackDir;
+  const workspaceError = validateTargetWorkspace(targetWorkspace, args2.working_directory ? "working_directory" : "fallbackDir");
+  if (workspaceError) {
+    return {
+      success: false,
+      message: "Target workspace validation failed",
+      errors: [workspaceError]
+    };
+  }
   const plan = {
     schema_version: "1.0.0",
     title: args2.title,
@@ -54211,7 +54266,7 @@ async function executeSavePlan(args2, fallbackDir) {
     })
   };
   const tasksCount = plan.phases.reduce((acc, phase) => acc + phase.tasks.length, 0);
-  const dir = args2.working_directory ?? fallbackDir ?? process.cwd();
+  const dir = targetWorkspace;
   try {
     await savePlan(dir, plan);
     return {
@@ -54245,7 +54300,7 @@ var save_plan = createSwarmTool({
         acceptance: tool.schema.string().optional().describe("Acceptance criteria for this task")
       })).min(1).describe("Tasks in this phase")
     })).min(1).describe("Implementation phases"),
-    working_directory: tool.schema.string().optional().describe("Working directory (defaults to process.cwd())")
+    working_directory: tool.schema.string().optional().describe("Working directory (explicit path, required - no fallback)")
   },
   execute: async (args2, _directory) => {
     return JSON.stringify(await executeSavePlan(args2, _directory), null, 2);

package/dist/tools/save-plan.d.ts

@@ -41,6 +41,14 @@ export interface SavePlanResult {
  * @returns Array of issue strings describing found placeholders
  */
 export declare function detectPlaceholderContent(args: SavePlanArgs): string[];
+/**
+ * Validate target workspace path.
+ * Rejects missing, empty, whitespace-only, and traversal-style paths.
+ * @param target - The target workspace path to validate
+ * @param source - Description of the source (for error messages)
+ * @returns Error message if invalid, undefined if valid
+ */
+export declare function validateTargetWorkspace(target: string | undefined, source: string): string | undefined;
 /**
  * Execute the save_plan tool.
  * Validates for placeholder content, builds a Plan object, and saves to disk.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "6.19.3",
+	"version": "6.19.5",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",