opencode-swarm 6.41.1 → 6.41.2

package/dist/cli/index.js

@@ -32643,7 +32643,7 @@ async function executeWriteRetro(args, directory) {
 var write_retro = createSwarmTool({
   description: "Write a retrospective evidence bundle for a completed phase. " + "Accepts flat retro fields and writes a correctly-wrapped EvidenceBundle to " + ".swarm/evidence/retro-{phase}/evidence.json. " + "Use this instead of manually writing retro JSON to avoid schema validation failures in phase_complete.",
   args: {
-    phase: tool.schema.number().int().positive().max(99).describe("The phase number being completed (e.g., 1, 2, 3)"),
+    phase: tool.schema.number().int().min(1).max(99).describe("The phase number being completed (e.g., 1, 2, 3)"),
     summary: tool.schema.string().describe("Human-readable summary of the phase"),
     task_count: tool.schema.number().int().min(1).max(9999).describe("Count of tasks completed in this phase"),
     task_complexity: tool.schema.enum(["trivial", "simple", "moderate", "complex"]).describe("Complexity level of the completed tasks"),

package/dist/index.js

@@ -47074,7 +47074,7 @@ async function executeWriteRetro(args2, directory) {
 var write_retro = createSwarmTool({
   description: "Write a retrospective evidence bundle for a completed phase. " + "Accepts flat retro fields and writes a correctly-wrapped EvidenceBundle to " + ".swarm/evidence/retro-{phase}/evidence.json. " + "Use this instead of manually writing retro JSON to avoid schema validation failures in phase_complete.",
   args: {
-    phase: tool.schema.number().int().positive().max(99).describe("The phase number being completed (e.g., 1, 2, 3)"),
+    phase: tool.schema.number().int().min(1).max(99).describe("The phase number being completed (e.g., 1, 2, 3)"),
     summary: tool.schema.string().describe("Human-readable summary of the phase"),
     task_count: tool.schema.number().int().min(1).max(9999).describe("Count of tasks completed in this phase"),
     task_complexity: tool.schema.enum(["trivial", "simple", "moderate", "complex"]).describe("Complexity level of the completed tasks"),
@@ -57676,6 +57676,19 @@ function parseFilePaths(description, filesTouched) {
   }
   return filePaths;
 }
+function buildVerifySummary(tasksChecked, tasksSkipped, tasksBlocked) {
+  if (tasksBlocked > 0) {
+    return `Blocked: ${tasksBlocked} task(s) with missing identifiers`;
+  }
+  const verified = tasksChecked - tasksSkipped;
+  if (tasksSkipped === tasksChecked) {
+    return `All ${tasksChecked} completed task(s) skipped \u2014 research/inventory tasks`;
+  }
+  if (tasksSkipped > 0) {
+    return `${verified} task(s) verified, ${tasksSkipped} skipped (research tasks)`;
+  }
+  return `All ${tasksChecked} completed tasks verified successfully`;
+}
 async function executeCompletionVerify(args2, directory) {
   const phase = Number(args2.phase);
   if (Number.isNaN(phase) || phase < 1 || !Number.isFinite(phase)) {
@@ -57737,7 +57750,7 @@ async function executeCompletionVerify(args2, directory) {
     return JSON.stringify(result2, null, 2);
   }
   let tasksChecked = 0;
-  const tasksSkipped = 0;
+  let tasksSkipped = 0;
   let tasksBlocked = 0;
   const blockedTasks = [];
   for (const task of targetPhase.tasks) {
@@ -57748,13 +57761,7 @@ async function executeCompletionVerify(args2, directory) {
     const fileTargets = parseFilePaths(task.description, task.files_touched);
     const identifiers = parseIdentifiers(task.description);
     if (fileTargets.length === 0) {
-      blockedTasks.push({
-        task_id: task.id,
-        identifier: "",
-        file_path: "",
-        reason: "No file targets \u2014 cannot verify completion without files_touched"
-      });
-      tasksBlocked++;
+      tasksSkipped++;
       continue;
     }
     if (identifiers.length === 0) {
@@ -57772,6 +57779,19 @@ async function executeCompletionVerify(args2, directory) {
     for (const filePath of fileTargets) {
       const normalizedPath = filePath.replace(/\\/g, "/");
       const resolvedPath = path45.resolve(directory, normalizedPath);
+      const projectRoot = path45.resolve(directory);
+      const relative6 = path45.relative(projectRoot, resolvedPath);
+      const withinProject = relative6 === "" || !relative6.startsWith("..") && !path45.isAbsolute(relative6);
+      if (!withinProject) {
+        blockedTasks.push({
+          task_id: task.id,
+          identifier: "",
+          file_path: filePath,
+          reason: `File path '${filePath}' escapes the project directory \u2014 cannot verify completion`
+        });
+        hasFileReadFailure = true;
+        continue;
+      }
       let fileContent;
       try {
         fileContent = fs33.readFileSync(resolvedPath, "utf-8");
@@ -57830,7 +57850,7 @@ async function executeCompletionVerify(args2, directory) {
           timestamp: now,
           agent: "completion_verify",
           verdict: tasksBlocked === 0 ? "pass" : "fail",
-          summary: tasksBlocked === 0 ? `All ${tasksChecked} completed tasks verified successfully` : `Blocked: ${tasksBlocked} task(s) with missing identifiers`,
+          summary: buildVerifySummary(tasksChecked, tasksSkipped, tasksBlocked),
           phase,
           tasks_checked: tasksChecked,
           tasks_skipped: tasksSkipped,
@@ -61509,7 +61529,7 @@ async function executePhaseComplete(args2, workingDirectory, directory) {
 var phase_complete = createSwarmTool({
   description: "Mark a phase as complete and track which agents were dispatched. Used for phase completion gating and tracking. Accepts phase number and optional summary. Returns list of agents that were dispatched.",
   args: {
-    phase: tool.schema.number().describe("The phase number being completed (e.g., 1, 2, 3)"),
+    phase: tool.schema.number().int().min(1).describe("The phase number being completed \u2014 a positive integer (e.g., 1, 2, 3)"),
     summary: tool.schema.string().optional().describe("Optional summary of what was accomplished in this phase"),
     sessionID: tool.schema.string().optional().describe("Session ID for tracking state (auto-provided by plugin context)")
   },
@@ -64047,13 +64067,13 @@ function validatePath(inputPath, baseDir, workspaceDir) {
     resolved = path56.resolve(baseDir, inputPath);
   }
   const workspaceResolved = path56.resolve(workspaceDir);
-  let relative7;
+  let relative8;
   if (isWinAbs) {
-    relative7 = path56.win32.relative(workspaceResolved, resolved);
+    relative8 = path56.win32.relative(workspaceResolved, resolved);
   } else {
-    relative7 = path56.relative(workspaceResolved, resolved);
+    relative8 = path56.relative(workspaceResolved, resolved);
   }
-  if (relative7.startsWith("..")) {
+  if (relative8.startsWith("..")) {
     return "path traversal detected";
   }
   return null;
@@ -64962,7 +64982,7 @@ async function executeSavePlan(args2, fallbackDir) {
       success: false,
       message: "Plan rejected: invalid phase or task IDs",
       errors: validationErrors,
-      recovery_guidance: "Use save_plan with corrected inputs to create or restructure plans. Never write .swarm/plan.json or .swarm/plan.md directly."
+      recovery_guidance: "Phase IDs must be positive integers: 1, 2, 3 (not 0, -1, or decimals). " + 'Task IDs must use N.M format: "1.1", "2.3", "3.1". ' + "Call save_plan again with corrected ids. " + "Never write .swarm/plan.json or .swarm/plan.md directly."
     };
   }
   const placeholderIssues = detectPlaceholderContent(args2);
@@ -65075,7 +65095,7 @@ var save_plan = createSwarmTool({
     title: tool.schema.string().min(1).describe("Plan title \u2014 the REAL project name from the spec. NOT a placeholder like [Project]."),
     swarm_id: tool.schema.string().min(1).describe('Swarm identifier (e.g. "mega")'),
     phases: tool.schema.array(tool.schema.object({
-      id: tool.schema.number().int().positive().describe("Phase number, starting at 1"),
+      id: tool.schema.number().int().min(1).describe("Phase number \u2014 a positive integer starting at 1. Use 1, 2, 3, etc."),
       name: tool.schema.string().min(1).describe("Descriptive phase name derived from the spec"),
       tasks: tool.schema.array(tool.schema.object({
         id: tool.schema.string().min(1).regex(/^\d+\.\d+(\.\d+)*$/, 'Task ID must be in N.M format, e.g. "1.1"').describe('Task ID in N.M format, e.g. "1.1", "2.3"'),
@@ -67658,7 +67678,7 @@ async function executeWriteDriftEvidence(args2, directory) {
 var write_drift_evidence = createSwarmTool({
   description: "Write drift verification evidence for a completed phase. " + "Normalizes verdict (APPROVED->approved, NEEDS_REVISION->rejected) and writes " + "a gate-contract formatted EvidenceBundle to .swarm/evidence/{phase}/drift-verifier.json. " + "Use this after critic_drift_verifier delegation to persist the verification result.",
   args: {
-    phase: tool.schema.number().int().positive().describe("The phase number for the drift verification"),
+    phase: tool.schema.number().int().min(1).describe("The phase number for the drift verification (e.g., 1, 2, 3)"),
     verdict: tool.schema.enum(["APPROVED", "NEEDS_REVISION"]).describe("Verdict of the drift verification: 'APPROVED' or 'NEEDS_REVISION'"),
     summary: tool.schema.string().describe("Human-readable summary of the drift verification")
   },

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "6.41.1",
+	"version": "6.41.2",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",