opencode-swarm 6.39.0 → 6.40.1

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2025
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2025
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -27,7 +27,7 @@ Most AI coding tools let one model write code and ask that same model whether th
 ### Key Features
 
 - 🏗️ **11 specialized agents** — architect, coder, reviewer, test engineer, critic, critic_sounding_board, critic_drift_verifier, explorer, SME, docs, designer
-- 🔒 **Gated pipeline** — code never ships without reviewer + test engineer approval
+- 🔒 **Gated pipeline** — code never ships without reviewer + test engineer approval (bypassed in turbo mode)
 - 🔄 **Phase completion gates** — completion-verify and drift verifier gates enforced before phase completion (bypassed in turbo mode)
 - 🔁 **Resumable sessions** — all state saved to `.swarm/`; pick up any project any day
 - 🌐 **11 languages** — TypeScript, Python, Go, Rust, Java, Kotlin, C#, C/C++, Swift, Dart, Ruby

package/dist/cli/index.js

@@ -5,25 +5,43 @@ var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
 var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
   for (let key of __getOwnPropNames(mod))
     if (!__hasOwnProp.call(to, key))
       __defProp(to, key, {
-        get: () => mod[key],
+        get: __accessProp.bind(mod, key),
         enumerable: true
       });
+  if (canCache)
+    cache.set(mod, to);
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: (newValue) => all[name] = () => newValue
+      set: __exportSetter.bind(all, name)
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -14572,7 +14590,8 @@ var init_plan_schema = __esm(() => {
     id: exports_external.number().int().min(1),
     name: exports_external.string().min(1),
     status: PhaseStatusSchema.default("pending"),
-    tasks: exports_external.array(TaskSchema).default([])
+    tasks: exports_external.array(TaskSchema).default([]),
+    required_agents: exports_external.array(exports_external.string()).optional()
   });
   PlanSchema = exports_external.object({
     schema_version: exports_external.literal("1.0.0"),
@@ -17301,8 +17320,8 @@ function getTaskBlockers(task, summary, status) {
   }
   return blockers;
 }
-async function buildTaskSummary(task, taskId) {
-  const result = await loadEvidence(".", taskId);
+async function buildTaskSummary(directory, task, taskId) {
+  const result = await loadEvidence(directory, taskId);
   const bundle = result.status === "found" ? result.bundle : null;
   const phase = task?.phase ?? 0;
   const status = getTaskStatus(task, bundle);
@@ -17331,18 +17350,18 @@ async function buildTaskSummary(task, taskId) {
     lastEvidenceTimestamp: lastTimestamp
   };
 }
-async function buildPhaseSummary(phase) {
-  const taskIds = await listEvidenceTaskIds(".");
+async function buildPhaseSummary(directory, phase) {
+  const taskIds = await listEvidenceTaskIds(directory);
   const phaseTaskIds = new Set(phase.tasks.map((t) => t.id));
   const taskSummaries = [];
   const _taskMap = new Map(phase.tasks.map((t) => [t.id, t]));
   for (const task of phase.tasks) {
-    const summary = await buildTaskSummary(task, task.id);
+    const summary = await buildTaskSummary(directory, task, task.id);
     taskSummaries.push(summary);
   }
   const extraTaskIds = taskIds.filter((id) => !phaseTaskIds.has(id));
   for (const taskId of extraTaskIds) {
-    const summary = await buildTaskSummary(undefined, taskId);
+    const summary = await buildTaskSummary(directory, undefined, taskId);
     if (summary.phase === phase.id) {
       taskSummaries.push(summary);
     }
@@ -17443,7 +17462,7 @@ async function buildEvidenceSummary(directory, currentPhase) {
   let totalTasks = 0;
   let completedTasks = 0;
   for (const phase of phasesToProcess) {
-    const summary = await buildPhaseSummary(phase);
+    const summary = await buildPhaseSummary(directory, phase);
     phaseSummaries.push(summary);
     totalTasks += summary.totalTasks;
     completedTasks += summary.completedTasks;
@@ -18161,8 +18180,8 @@ var PlanCursorConfigSchema = exports_external.object({
 });
 var CheckpointConfigSchema = exports_external.object({
   enabled: exports_external.boolean().default(true),
-  auto_checkpoint_threshold: exports_external.number().min(1).max(20).default(3)
-});
+  auto_checkpoint_threshold: exports_external.number().int().min(1).max(20).default(3)
+}).strict();
 var AutomationModeSchema = exports_external.enum(["manual", "hybrid", "auto"]);
 var AutomationCapabilitiesSchema = exports_external.object({
   plan_sync: exports_external.boolean().default(true),
@@ -18282,7 +18301,8 @@ var PluginConfigSchema = exports_external.object({
     block_on_threshold: exports_external.boolean().default(false).describe("If true, block phase completion when threshold exceeded. Default: advisory only.")
   }).optional(),
   incremental_verify: IncrementalVerifyConfigSchema.optional(),
-  compaction_service: CompactionConfigSchema.optional()
+  compaction_service: CompactionConfigSchema.optional(),
+  turbo_mode: exports_external.boolean().default(false).optional()
 });
 
 // src/config/loader.ts
@@ -18385,6 +18405,15 @@ function loadPluginConfig(directory) {
   }
   return result.data;
 }
+function loadPluginConfigWithMeta(directory) {
+  const userConfigPath = path.join(getUserConfigDir(), "opencode", CONFIG_FILENAME);
+  const projectConfigPath = path.join(directory, ".opencode", CONFIG_FILENAME);
+  const userResult = loadRawConfigFromPath(userConfigPath);
+  const projectResult = loadRawConfigFromPath(projectConfigPath);
+  const loadedFromFile = userResult.fileExisted || projectResult.fileExisted;
+  const config2 = loadPluginConfig(directory);
+  return { config: config2, loadedFromFile };
+}
 
 // src/commands/archive.ts
 init_manager();
@@ -18807,6 +18836,9 @@ async function handleBenchmarkCommand(directory, args) {
 `);
 }
 
+// src/commands/checkpoint.ts
+init_zod();
+
 // src/tools/checkpoint.ts
 import { spawnSync } from "child_process";
 import * as fs3 from "fs";
@@ -31132,6 +31164,10 @@ function tool(input) {
   return input;
 }
 tool.schema = exports_external2;
+
+// src/config/index.ts
+init_evidence_schema();
+init_plan_schema();
 // src/tools/create-tool.ts
 function createSwarmTool(opts) {
   return tool({
@@ -31256,6 +31292,11 @@ function isGitRepo() {
 }
 function handleSave(label, directory) {
   try {
+    let maxCheckpoints = 20;
+    try {
+      const { config: config3 } = loadPluginConfigWithMeta(directory);
+      maxCheckpoints = config3.checkpoint?.auto_checkpoint_threshold ?? maxCheckpoints;
+    } catch {}
     const log2 = readCheckpointLog(directory);
     const existingCheckpoint = log2.checkpoints.find((c) => c.label === label);
     if (existingCheckpoint) {
@@ -31375,7 +31416,7 @@ var checkpoint = createSwarmTool({
     let label;
     try {
       action = String(args.action);
-      label = args.label !== undefined ? String(args.label) : undefined;
+      label = args.label !== undefined && args.label !== null ? String(args.label) : undefined;
     } catch {
       return JSON.stringify({
         action: "unknown",
@@ -31428,6 +31469,22 @@ var checkpoint = createSwarmTool({
 });
 
 // src/commands/checkpoint.ts
+var CheckpointResultSchema = exports_external.object({
+  action: exports_external.string().optional(),
+  success: exports_external.boolean(),
+  error: exports_external.string().optional(),
+  checkpoints: exports_external.array(exports_external.unknown()).optional()
+}).passthrough();
+function safeParseResult(result) {
+  const parsed = CheckpointResultSchema.safeParse(JSON.parse(result));
+  if (!parsed.success) {
+    return {
+      success: false,
+      error: `Invalid response: ${parsed.error.message}`
+    };
+  }
+  return parsed.data;
+}
 async function handleCheckpointCommand(directory, args) {
   const subcommand = args[0] || "list";
   const label = args[1];
@@ -31450,7 +31507,7 @@ async function handleSave2(directory, label) {
     const result = await checkpoint.execute({ action: "save", label }, {
       directory
     });
-    const parsed = JSON.parse(result);
+    const parsed = safeParseResult(result);
     if (parsed.success) {
       return `\u2713 Checkpoint saved: "${label}"`;
     } else {
@@ -31469,7 +31526,7 @@ async function handleRestore2(directory, label) {
     const result = await checkpoint.execute({ action: "restore", label }, {
       directory
     });
-    const parsed = JSON.parse(result);
+    const parsed = safeParseResult(result);
     if (parsed.success) {
       return `\u2713 Restored to checkpoint: "${label}"`;
     } else {
@@ -31488,7 +31545,7 @@ async function handleDelete2(directory, label) {
     const result = await checkpoint.execute({ action: "delete", label }, {
       directory
     });
-    const parsed = JSON.parse(result);
+    const parsed = safeParseResult(result);
     if (parsed.success) {
       return `\u2713 Checkpoint deleted: "${label}"`;
     } else {
@@ -31504,7 +31561,7 @@ async function handleList2(directory) {
     const result = await checkpoint.execute({ action: "list" }, {
       directory
     });
-    const parsed = JSON.parse(result);
+    const parsed = safeParseResult(result);
     if (!parsed.success) {
       return `Error: ${parsed.error || "Failed to list checkpoints"}`;
     }
@@ -34202,7 +34259,8 @@ async function extractFromLegacy(directory) {
       mappedStatus = "complete";
     else if (status === "IN PROGRESS")
       mappedStatus = "in_progress";
-    const headerLineIndex = lines.indexOf(match[0]);
+    const headerLineIndex = planContent.substring(0, match.index).split(`
+`).length - 1;
     let completed = 0;
     let total = 0;
     if (headerLineIndex !== -1) {
@@ -34597,9 +34655,9 @@ async function getPlanData(directory, phaseArg) {
       return {
         hasPlan: true,
         fullMarkdown,
-        requestedPhase: NaN,
+        requestedPhase: null,
         phaseMarkdown: null,
-        errorMessage: null,
+        errorMessage: `Invalid phase number: "${phaseArg}"`,
         isLegacy: false
       };
     }
@@ -34650,9 +34708,9 @@ async function getPlanData(directory, phaseArg) {
     return {
       hasPlan: true,
       fullMarkdown: planContent,
-      requestedPhase: NaN,
+      requestedPhase: null,
       phaseMarkdown: null,
-      errorMessage: null,
+      errorMessage: `Invalid phase number: "${phaseArg}"`,
       isLegacy: true
     };
   }
@@ -35591,6 +35649,59 @@ LANGUAGE_REGISTRY.register({
     ]
   }
 });
+LANGUAGE_REGISTRY.register({
+  id: "php",
+  displayName: "PHP",
+  tier: 3,
+  extensions: [".php", ".phtml"],
+  treeSitter: { grammarId: "php", wasmFile: "tree-sitter-php.wasm" },
+  build: {
+    detectFiles: ["composer.json"],
+    commands: []
+  },
+  test: {
+    detectFiles: ["phpunit.xml", "phpunit.xml.dist"],
+    frameworks: [
+      {
+        name: "PHPUnit",
+        detect: "phpunit.xml",
+        cmd: "vendor/bin/phpunit",
+        priority: 1
+      }
+    ]
+  },
+  lint: {
+    detectFiles: [".php-cs-fixer.php", "phpcs.xml"],
+    linters: [
+      {
+        name: "PHP-CS-Fixer",
+        detect: ".php-cs-fixer.php",
+        cmd: "vendor/bin/php-cs-fixer fix --dry-run --diff",
+        priority: 1
+      }
+    ]
+  },
+  audit: {
+    detectFiles: ["composer.lock"],
+    command: "composer audit --format=json",
+    outputFormat: "json"
+  },
+  sast: { nativeRuleSet: "php", semgrepSupport: "ga" },
+  prompts: {
+    coderConstraints: [
+      "Follow PSR-12 coding standards",
+      "Use strict types declaration: declare(strict_types=1)",
+      "Prefer type hints and return type declarations on all functions",
+      "Use dependency injection over static methods and singletons"
+    ],
+    reviewerChecklist: [
+      "Verify no user input reaches SQL queries without parameterised binding",
+      "Check for XSS \u2014 all output must be escaped with htmlspecialchars()",
+      "Confirm no eval(), exec(), or shell_exec() with user-controlled input",
+      "Validate proper error handling \u2014 no bare catch blocks that swallow errors"
+    ]
+  }
+});
 
 // src/lang/detector.ts
 async function detectProjectLanguages(projectDir) {
@@ -36174,7 +36285,7 @@ async function detectAvailableLinter(directory) {
 async function _detectAvailableLinter(_projectDir, biomeBin, eslintBin) {
   const DETECT_TIMEOUT = 2000;
   try {
-    const biomeProc = Bun.spawn(["npx", "biome", "--version"], {
+    const biomeProc = Bun.spawn([biomeBin, "--version"], {
       stdout: "pipe",
       stderr: "pipe"
     });
@@ -36188,7 +36299,7 @@ async function _detectAvailableLinter(_projectDir, biomeBin, eslintBin) {
     }
   } catch {}
   try {
-    const eslintProc = Bun.spawn(["npx", "eslint", "--version"], {
+    const eslintProc = Bun.spawn([eslintBin, "--version"], {
       stdout: "pipe",
       stderr: "pipe"
     });
@@ -38205,12 +38316,13 @@ async function runLintCheck(dir, linter, timeoutMs) {
   const startTime = Date.now();
   try {
     const lintPromise = runLint(linter, "check", dir);
+    let timeoutId;
     const timeoutPromise = new Promise((_, reject) => {
-      setTimeout(() => {
+      timeoutId = setTimeout(() => {
         reject(new Error(`Lint check timed out after ${timeoutMs}ms`));
       }, timeoutMs);
     });
-    const result = await Promise.race([lintPromise, timeoutPromise]);
+    const result = await Promise.race([lintPromise, timeoutPromise]).finally(() => clearTimeout(timeoutId));
     if (!result.success) {
       return {
         type: "lint",
@@ -39720,12 +39832,32 @@ function makeInitialState() {
     lastSnapshotAt: null
   };
 }
-var state = makeInitialState();
-function getCompactionMetrics() {
-  return {
-    compactionCount: state.observationCount + state.reflectionCount + state.emergencyCount,
-    lastSnapshotAt: state.lastSnapshotAt
-  };
+var sessionStates = new Map;
+function getSessionState(sessionId) {
+  let state = sessionStates.get(sessionId);
+  if (!state) {
+    state = makeInitialState();
+    sessionStates.set(sessionId, state);
+  }
+  return state;
+}
+function getCompactionMetrics(sessionId) {
+  if (sessionId) {
+    const state = getSessionState(sessionId);
+    return {
+      compactionCount: state.observationCount + state.reflectionCount + state.emergencyCount,
+      lastSnapshotAt: state.lastSnapshotAt
+    };
+  }
+  let total = 0;
+  let lastSnapshot = null;
+  for (const state of sessionStates.values()) {
+    total += state.observationCount + state.reflectionCount + state.emergencyCount;
+    if (state.lastSnapshotAt && (!lastSnapshot || state.lastSnapshotAt > lastSnapshot)) {
+      lastSnapshot = state.lastSnapshotAt;
+    }
+  }
+  return { compactionCount: total, lastSnapshotAt: lastSnapshot };
 }
 
 // src/services/context-budget-service.ts
@@ -39888,6 +40020,7 @@ async function handleTurboCommand(_directory, args, sessionID) {
 }
 
 // src/tools/write-retro.ts
+init_evidence_schema();
 init_manager();
 async function executeWriteRetro(args, directory) {
   const phase = args.phase;
@@ -40121,8 +40254,9 @@ async function executeWriteRetro(args, directory) {
   };
   const taxonomy = [];
   try {
-    for (const taskSuffix of ["1", "2", "3", "4", "5"]) {
-      const phaseTaskId = `${phase}.${taskSuffix}`;
+    const allTaskIds = await listEvidenceTaskIds(directory);
+    const phaseTaskIds = allTaskIds.filter((id) => id.startsWith(`${phase}.`));
+    for (const phaseTaskId of phaseTaskIds) {
       const result = await loadEvidence(directory, phaseTaskId);
       if (result.status !== "found")
         continue;
@@ -40156,6 +40290,13 @@ async function executeWriteRetro(args, directory) {
     }
   } catch {}
   retroEntry.error_taxonomy = [...new Set(taxonomy)];
+  const validationResult = RetrospectiveEvidenceSchema.safeParse(retroEntry);
+  if (!validationResult.success) {
+    return JSON.stringify({
+      success: false,
+      error: `Retrospective entry failed validation: ${validationResult.error.message}`
+    }, null, 2);
+  }
   try {
     await saveEvidence(directory, taskId, retroEntry);
     return JSON.stringify({
@@ -40220,7 +40361,7 @@ var write_retro = createSwarmTool({
   }
 });
 
-// src/commands/write_retro.ts
+// src/commands/write-retro.ts
 async function handleWriteRetroCommand(directory, args) {
   if (args.length === 0 || !args[0] || args[0].trim() === "") {
     return `## Usage: /swarm write-retro <json>

package/dist/commands/index.d.ts

@@ -29,7 +29,7 @@ export { handleSpecifyCommand } from './specify';
 export { handleStatusCommand } from './status';
 export { handleSyncPlanCommand } from './sync-plan';
 export { handleTurboCommand } from './turbo';
-export { handleWriteRetroCommand } from './write_retro';
+export { handleWriteRetroCommand } from './write-retro';
 /**
  * Creates a command.execute.before handler for /swarm commands.
  * Uses factory pattern to close over directory and agents.

package/dist/config/plan-schema.d.ts

@@ -91,6 +91,7 @@ export declare const PhaseSchema: z.ZodObject<{
         evidence_path: z.ZodOptional<z.ZodString>;
         blocked_reason: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
+    required_agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 export type Phase = z.infer<typeof PhaseSchema>;
 export declare const PlanSchema: z.ZodObject<{
@@ -129,6 +130,7 @@ export declare const PlanSchema: z.ZodObject<{
             evidence_path: z.ZodOptional<z.ZodString>;
             blocked_reason: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>>;
+        required_agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
     migration_status: z.ZodOptional<z.ZodEnum<{
         native: "native";

package/dist/config/schema.d.ts

@@ -375,7 +375,7 @@ export type PlanCursorConfig = z.infer<typeof PlanCursorConfigSchema>;
 export declare const CheckpointConfigSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     auto_checkpoint_threshold: z.ZodDefault<z.ZodNumber>;
-}, z.core.$strip>;
+}, z.core.$strict>;
 export type CheckpointConfig = z.infer<typeof CheckpointConfigSchema>;
 export declare const AutomationModeSchema: z.ZodEnum<{
     auto: "auto";
@@ -699,7 +699,7 @@ export declare const PluginConfigSchema: z.ZodObject<{
     checkpoint: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         auto_checkpoint_threshold: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip>>;
+    }, z.core.$strict>>;
     automation: z.ZodOptional<z.ZodType<{
         mode: "auto" | "manual" | "hybrid";
         capabilities: {
@@ -785,6 +785,7 @@ export declare const PluginConfigSchema: z.ZodObject<{
         emergencyThreshold: z.ZodDefault<z.ZodNumber>;
         preserveLastNTurns: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
+    turbo_mode: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
 }, z.core.$strip>;
 export type PluginConfig = z.infer<typeof PluginConfigSchema>;
 export type { AgentName, PipelineAgentName, QAAgentName, } from './constants';