opencode-swarm 6.38.0 → 6.40.1

package/dist/services/compaction-service.d.ts

@@ -21,8 +21,8 @@ export interface CompactionServiceHook {
     }) => Promise<void>;
 }
 export declare function createCompactionService(config: CompactionConfig, directory: string, injectMessage: (sessionId: string, message: string) => void): CompactionServiceHook;
-export declare function getCompactionMetrics(): {
+export declare function getCompactionMetrics(sessionId?: string): {
     compactionCount: number;
     lastSnapshotAt: string | null;
 };
-export declare function resetCompactionState(): void;
+export declare function resetCompactionState(sessionId?: string): void;

package/dist/session/snapshot-reader.d.ts

@@ -4,6 +4,14 @@
  */
 import type { AgentSessionState } from '../state';
 import type { SerializedAgentSession, SnapshotData } from './snapshot-writer';
+/**
+ * Transient session fields that must be reset on rehydration.
+ * Centralised here to keep the reset logic DRY and auditable.
+ */
+export declare const TRANSIENT_SESSION_FIELDS: ReadonlyArray<{
+    name: string;
+    resetValue: unknown;
+}>;
 /**
  * Deserialize a SerializedAgentSession back to AgentSessionState.
  * Handles Map/Set conversion and migration safety defaults.

package/dist/tools/lint.d.ts

@@ -24,8 +24,7 @@ export interface LintErrorResult {
     message?: string;
 }
 export type LintResult = LintSuccessResult | LintErrorResult;
-export declare function containsPathTraversal(str: string): boolean;
-export declare function containsControlChars(str: string): boolean;
+export { containsControlChars, containsPathTraversal, } from '../utils/path-security';
 export declare function validateArgs(args: unknown): args is {
     mode: 'fix' | 'check';
 };

package/dist/tools/save-plan.d.ts

@@ -32,6 +32,7 @@ export interface SavePlanResult {
     phases_count?: number;
     tasks_count?: number;
     errors?: string[];
+    warnings?: string[];
     recovery_guidance?: string;
 }
 /**

package/dist/tools/tool-names.d.ts

@@ -3,7 +3,7 @@
  * Used for constants and agent setup references.
  */
 /** Union type of all valid tool names */
-export type ToolName = 'diff' | 'syntax_check' | 'placeholder_scan' | 'imports' | 'lint' | 'secretscan' | 'sast_scan' | 'build_check' | 'pre_check_batch' | 'quality_budget' | 'symbols' | 'complexity_hotspots' | 'schema_drift' | 'todo_extract' | 'evidence_check' | 'check_gate_status' | 'completion_verify' | 'sbom_generate' | 'checkpoint' | 'pkg_audit' | 'test_runner' | 'detect_domains' | 'gitingest' | 'retrieve_summary' | 'extract_code_blocks' | 'phase_complete' | 'save_plan' | 'update_task_status' | 'write_retro' | 'declare_scope' | 'knowledge_query';
+export type ToolName = 'diff' | 'syntax_check' | 'placeholder_scan' | 'imports' | 'lint' | 'secretscan' | 'sast_scan' | 'build_check' | 'pre_check_batch' | 'quality_budget' | 'symbols' | 'complexity_hotspots' | 'schema_drift' | 'todo_extract' | 'evidence_check' | 'check_gate_status' | 'completion_verify' | 'sbom_generate' | 'checkpoint' | 'pkg_audit' | 'test_runner' | 'detect_domains' | 'gitingest' | 'retrieve_summary' | 'extract_code_blocks' | 'phase_complete' | 'save_plan' | 'update_task_status' | 'write_retro' | 'declare_scope' | 'knowledge_query' | 'doc_scan' | 'doc_extract' | 'curator_analyze' | 'knowledgeAdd' | 'knowledgeRecall' | 'knowledgeRemove';
 /** Readonly array of all tool names */
 export declare const TOOL_NAMES: readonly ToolName[];
 /** Set for O(1) tool name validation */

package/dist/utils/path-security.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Canonical path security utilities.
+ * Consolidated from 6+ local implementations across the codebase.
+ * Use these instead of defining local copies.
+ */
+/**
+ * Check if a string contains path traversal patterns.
+ * Based on the most comprehensive implementation (test-runner.ts).
+ * Checks: basic ../, isolated double dots, URL-encoded traversal,
+ * double-encoded traversal, Unicode homoglyphs, and encoded separators.
+ */
+export declare function containsPathTraversal(str: string): boolean;
+/**
+ * Check if a string contains control characters that could be used
+ * for injection attacks. Matches null byte, tab, carriage return, and newline.
+ */
+export declare function containsControlChars(str: string): boolean;
+/**
+ * Validate a directory path for safety.
+ * Rejects empty paths, paths with traversal, control characters, and absolute paths.
+ * Throws an Error if the directory is invalid.
+ *
+ * @param directory - The directory string to validate
+ * @throws Error if directory is invalid
+ */
+export declare function validateDirectory(directory: string): void;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "6.38.0",
+	"version": "6.40.1",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -8,6 +8,9 @@
 		"opencode-swarm": "./dist/cli/index.js"
 	},
 	"type": "module",
+	"engines": {
+		"bun": ">=1.0.0"
+	},
 	"license": "MIT",
 	"repository": {
 		"type": "git",