opencode-swarm 6.59.0 → 6.60.1

package/README.md

@@ -759,14 +759,17 @@ Use glob patterns for complex path matching:
 - `?` — Match single character: `test?.js` matches `test1.js`, `testa.js`
 - Uses [picomatch](https://github.com/micromatch/picomatch) for cross-platform compatibility
 
+**Path Normalization and Symlinks:**
+Paths are resolved via `realpathSync` before matching, which resolves symlinks and prevents path-traversal escapes. However, if a symlink's target does not exist, `realpathSync` throws and the fallback returns the symlink's own path (unresolved). A dangling symlink inside an `allowedPrefix` directory will therefore pass prefix-based checks even if its intended target is outside the project. Use `blockedExact` or `blockedGlobs` to deny known dangling-symlink paths explicitly.
+
 **Evaluation Order:**
 1. `readOnly` check (if true, deny all writes)
 2. `blockedExact` (exact path matches, highest priority)
 3. `blockedGlobs` (glob pattern matches)
 4. `allowedExact` (exact path matches, overrides prefix/glob restrictions)
 5. `allowedGlobs` (glob pattern matches)
-6. `allowedPrefix` (prefix matches)
-7. `blockedPrefix` (prefix matches)
+6. `blockedPrefix` (prefix matches)
+7. `allowedPrefix` (prefix matches)
 8. `blockedZones` (zone classification)
 
 </details>

package/dist/cli/index.js

@@ -18296,7 +18296,7 @@ ${warnings.map((w) => `  - ${w}`).join(`
 `)}` : "";
   const cautionMessage = `
 
-\u26A0\uFE0F  Caution: Spec drift was acknowledged \u2014 verify that the implementation still matches the spec before proceeding.`;
+\u26A0\uFE0F  Warning: Spec drift was acknowledged \u2014 verify that the implementation still matches the spec before proceeding.`;
   return baseMessage + warningMessage + cautionMessage;
 }
 
@@ -18564,7 +18564,8 @@ var AGENT_TOOL_MAP = {
     "imports",
     "retrieve_summary",
     "symbols",
-    "knowledge_recall"
+    "knowledge_recall",
+    "req_coverage"
   ],
   critic_drift_verifier: [
     "complexity_hotspots",
@@ -18968,7 +18969,8 @@ var GuardrailsConfigSchema = exports_external.object({
     ]),
     require_reviewer_test_engineer: exports_external.boolean().default(true)
   }).optional(),
-  profiles: exports_external.record(exports_external.string(), GuardrailsProfileSchema).optional()
+  profiles: exports_external.record(exports_external.string(), GuardrailsProfileSchema).optional(),
+  block_destructive_commands: exports_external.boolean().default(true)
 });
 var WatchdogConfigSchema = exports_external.object({
   scope_guard: exports_external.boolean().default(true),
@@ -32067,7 +32069,7 @@ var DeltaSpecSchema = exports_external.union([
 ]);
 // src/tools/create-tool.ts
 function classifyToolError(error93) {
-  const msg = (error93 instanceof Error ? error93.message : String(error93)).toLowerCase();
+  const msg = (error93 instanceof Error ? error93.message ?? "" : String(error93)).toLowerCase();
   if (msg.includes("not registered") || msg.includes("unknown tool"))
     return "not_registered";
   if (msg.includes("not whitelisted") || msg.includes("not allowed"))
@@ -36802,6 +36804,10 @@ async function discoverBuildCommands(workingDir, options) {
   const skipped = [...profileSkipped];
   for (const ecosystem of ECOSYSTEMS) {
     if (coveredEcosystems.has(ecosystem.ecosystem)) {
+      skipped.push({
+        ecosystem: ecosystem.ecosystem,
+        reason: `Covered by profile detection`
+      });
       continue;
     }
     if (!checkToolchain(ecosystem.toolchainCommands)) {

package/dist/config/schema.d.ts

@@ -330,6 +330,7 @@ export declare const GuardrailsConfigSchema: z.ZodObject<{
         warning_threshold: z.ZodOptional<z.ZodNumber>;
         idle_timeout_minutes: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>>;
+    block_destructive_commands: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;
 export type GuardrailsConfig = z.infer<typeof GuardrailsConfigSchema>;
 export declare const WatchdogConfigSchema: z.ZodObject<{
@@ -655,6 +656,7 @@ export declare const PluginConfigSchema: z.ZodObject<{
             warning_threshold: z.ZodOptional<z.ZodNumber>;
             idle_timeout_minutes: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strip>>>;
+        block_destructive_commands: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
     watchdog: z.ZodOptional<z.ZodObject<{
         scope_guard: z.ZodDefault<z.ZodBoolean>;

package/dist/hooks/guardrails.d.ts

@@ -103,6 +103,11 @@ export declare function validateAndRecordAttestation(dir: string, findingId: str
     valid: false;
     reason: string;
 }>;
+/**
+ * Clears all guardrails caches.
+ * Use this for test isolation or when guardrails config reloads at runtime.
+ */
+export declare function clearGuardrailsCaches(): void;
 type AgentRule = {
     readOnly?: boolean;
     blockedExact?: string[];

package/dist/index.js

@@ -297,7 +297,8 @@ var init_constants = __esm(() => {
       "imports",
       "retrieve_summary",
       "symbols",
-      "knowledge_recall"
+      "knowledge_recall",
+      "req_coverage"
     ],
     critic_drift_verifier: [
       "complexity_hotspots",
@@ -14990,7 +14991,8 @@ var init_schema = __esm(() => {
       ]),
       require_reviewer_test_engineer: exports_external.boolean().default(true)
     }).optional(),
-    profiles: exports_external.record(exports_external.string(), GuardrailsProfileSchema).optional()
+    profiles: exports_external.record(exports_external.string(), GuardrailsProfileSchema).optional(),
+    block_destructive_commands: exports_external.boolean().default(true)
   });
   WatchdogConfigSchema = exports_external.object({
     scope_guard: exports_external.boolean().default(true),
@@ -30654,7 +30656,7 @@ var init_dist = __esm(() => {
 
 // src/tools/create-tool.ts
 function classifyToolError(error93) {
-  const msg = (error93 instanceof Error ? error93.message : String(error93)).toLowerCase();
+  const msg = (error93 instanceof Error ? error93.message ?? "" : String(error93)).toLowerCase();
   if (msg.includes("not registered") || msg.includes("unknown tool"))
     return "not_registered";
   if (msg.includes("not whitelisted") || msg.includes("not allowed"))
@@ -34920,6 +34922,10 @@ async function discoverBuildCommands(workingDir, options) {
   const skipped = [...profileSkipped];
   for (const ecosystem of ECOSYSTEMS) {
     if (coveredEcosystems.has(ecosystem.ecosystem)) {
+      skipped.push({
+        ecosystem: ecosystem.ecosystem,
+        reason: `Covered by profile detection`
+      });
       continue;
     }
     if (!checkToolchain(ecosystem.toolchainCommands)) {
@@ -41619,6 +41625,98 @@ var init_doc_scan = __esm(() => {
   });
 });
 
+// src/tools/knowledge-recall.ts
+var exports_knowledge_recall = {};
+__export(exports_knowledge_recall, {
+  knowledge_recall: () => knowledge_recall
+});
+var knowledge_recall;
+var init_knowledge_recall = __esm(() => {
+  init_dist();
+  init_knowledge_store();
+  init_create_tool();
+  knowledge_recall = createSwarmTool({
+    description: "Search the knowledge base for relevant past decisions, patterns, and lessons learned. Returns ranked results by semantic similarity.",
+    args: {
+      query: tool.schema.string().min(3).describe("Natural language search query"),
+      top_n: tool.schema.number().int().min(1).max(20).optional().describe("Maximum results to return (default: 5)"),
+      tier: tool.schema.enum(["all", "swarm", "hive"]).optional().describe("Knowledge tier to search (default: 'all')")
+    },
+    execute: async (args2, directory) => {
+      let queryInput;
+      let topNInput;
+      let tierInput;
+      try {
+        if (args2 && typeof args2 === "object") {
+          const obj = args2;
+          queryInput = obj.query;
+          topNInput = obj.top_n;
+          tierInput = obj.tier;
+        }
+      } catch {}
+      if (typeof queryInput !== "string" || queryInput.length < 3) {
+        return JSON.stringify({
+          results: [],
+          total: 0,
+          error: "query must be a string with at least 3 characters"
+        });
+      }
+      let topN = 5;
+      if (topNInput !== undefined) {
+        if (typeof topNInput === "number" && Number.isInteger(topNInput)) {
+          topN = Math.max(1, Math.min(20, topNInput));
+        }
+      }
+      let tier = "all";
+      if (tierInput !== undefined && typeof tierInput === "string") {
+        if (tierInput === "swarm" || tierInput === "hive") {
+          tier = tierInput;
+        }
+      }
+      const swarmPath = resolveSwarmKnowledgePath(directory);
+      const hivePath = resolveHiveKnowledgePath();
+      const [swarmEntries, hiveEntries] = await Promise.all([
+        readKnowledge(swarmPath),
+        readKnowledge(hivePath)
+      ]);
+      let entries = [];
+      if (tier === "all" || tier === "swarm") {
+        entries = entries.concat(swarmEntries);
+      }
+      if (tier === "all" || tier === "hive") {
+        entries = entries.concat(hiveEntries);
+      }
+      if (entries.length === 0) {
+        const result2 = { results: [], total: 0 };
+        return JSON.stringify(result2);
+      }
+      const normalizedQuery = normalize2(queryInput);
+      const queryBigrams = wordBigrams(normalizedQuery);
+      const scoredEntries = entries.map((entry) => {
+        const entryText = `${entry.lesson} ${entry.tags.join(" ")} ${entry.category}`;
+        const entryBigrams = wordBigrams(entryText);
+        const textScore = jaccardBigram(queryBigrams, entryBigrams);
+        const boost = entry.status === "established" ? 0.1 : entry.status === "promoted" ? 0.05 : 0;
+        const finalScore = textScore + boost;
+        return {
+          id: entry.id,
+          confidence: entry.confidence,
+          category: entry.category,
+          lesson: entry.lesson,
+          score: finalScore
+        };
+      });
+      scoredEntries.sort((a, b) => b.score - a.score);
+      const topResults = scoredEntries.slice(0, topN);
+      const result = {
+        results: topResults,
+        total: topResults.length
+      };
+      return JSON.stringify(result);
+    }
+  });
+});
+
 // src/environment/prompt-renderer.ts
 var exports_prompt_renderer = {};
 __export(exports_prompt_renderer, {
@@ -45263,7 +45361,7 @@ ${warnings.map((w) => `  - ${w}`).join(`
 `)}` : "";
   const cautionMessage = `
 
-\u26A0\uFE0F  Caution: Spec drift was acknowledged \u2014 verify that the implementation still matches the spec before proceeding.`;
+\u26A0\uFE0F  Warning: Spec drift was acknowledged \u2014 verify that the implementation still matches the spec before proceeding.`;
   return baseMessage + warningMessage + cautionMessage;
 }
 
@@ -48051,42 +48149,73 @@ init_utils2();
 var DEFAULT_CURATOR_LLM_TIMEOUT_MS = 300000;
 function parseKnowledgeRecommendations(llmOutput) {
   const recommendations = [];
-  const section = llmOutput.match(/OBSERVATIONS:\s*\n([\s\S]*?)(?:\n\n|\n[A-Z_]+:|$)/);
-  if (!section)
-    return recommendations;
-  const lines = section[1].split(`
+  const UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+  const obsSection = llmOutput.match(/OBSERVATIONS:\s*\n([\s\S]*?)(?:\n\n|\n[A-Z_]+:|$)/);
+  if (obsSection) {
+    const lines = obsSection[1].split(`
 `);
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (!trimmed.startsWith("-"))
-      continue;
-    const match = trimmed.match(/^-\s+entry\s+(\S+)\s+\(([^)]+)\):\s+(.+)$/i);
-    if (!match)
-      continue;
-    const uuid8 = match[1];
-    const parenthetical = match[2];
-    const text = match[3].trim().replace(/\s+\([^)]+\)$/, "");
-    const UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-    const entryId = uuid8 === "new" || !UUID_V4.test(uuid8) ? undefined : uuid8;
-    let action = "rewrite";
-    const lowerParenthetical = parenthetical.toLowerCase();
-    if (lowerParenthetical.includes("suggests boost confidence") || lowerParenthetical.includes("mark hive_eligible") || lowerParenthetical.includes("appears high-confidence")) {
-      action = "promote";
-    } else if (lowerParenthetical.includes("suggests archive") || lowerParenthetical.includes("appears stale")) {
-      action = "archive";
-    } else if (lowerParenthetical.includes("contradicts project state")) {
-      action = "flag_contradiction";
-    } else if (lowerParenthetical.includes("suggests rewrite") || lowerParenthetical.includes("could be tighter")) {
-      action = "rewrite";
-    } else if (lowerParenthetical.includes("new candidate")) {
-      action = "promote";
-    }
-    recommendations.push({
-      action,
-      entry_id: entryId,
-      lesson: text,
-      reason: text
-    });
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed.startsWith("-"))
+        continue;
+      const match = trimmed.match(/^-\s+entry\s+(\S+)\s+\(([^)]+)\):\s+(.+)$/i);
+      if (!match)
+        continue;
+      const uuid8 = match[1];
+      const parenthetical = match[2];
+      const text = match[3].trim().replace(/\s+\([^)]+\)$/, "");
+      const entryId = uuid8 === "new" || !UUID_V4.test(uuid8) ? undefined : uuid8;
+      let action = "rewrite";
+      const lowerParenthetical = parenthetical.toLowerCase();
+      if (lowerParenthetical.includes("suggests boost confidence") || lowerParenthetical.includes("mark hive_eligible") || lowerParenthetical.includes("appears high-confidence")) {
+        action = "promote";
+      } else if (lowerParenthetical.includes("suggests archive") || lowerParenthetical.includes("appears stale")) {
+        action = "archive";
+      } else if (lowerParenthetical.includes("contradicts project state")) {
+        action = "flag_contradiction";
+      } else if (lowerParenthetical.includes("suggests rewrite") || lowerParenthetical.includes("could be tighter")) {
+        action = "rewrite";
+      } else if (lowerParenthetical.includes("new candidate")) {
+        action = "promote";
+      }
+      recommendations.push({
+        action,
+        entry_id: entryId,
+        lesson: text,
+        reason: text
+      });
+    }
+  }
+  const updatesSection = llmOutput.match(/KNOWLEDGE_UPDATES:\s*\n([\s\S]*?)(?:\n\n|\n[A-Z_]+:|$)/);
+  if (updatesSection) {
+    const validActions = new Set([
+      "promote",
+      "archive",
+      "rewrite",
+      "flag_contradiction"
+    ]);
+    const lines = updatesSection[1].split(`
+`);
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed.startsWith("-"))
+        continue;
+      const match = trimmed.match(/^-\s+(\S+)\s+(\S+):\s+(.+)$/);
+      if (!match)
+        continue;
+      const action = match[1].toLowerCase();
+      if (!validActions.has(action))
+        continue;
+      const id = match[2];
+      const text = match[3].trim();
+      const entryId = UUID_V4.test(id) ? id : undefined;
+      recommendations.push({
+        action,
+        entry_id: entryId,
+        lesson: text,
+        reason: text
+      });
+    }
   }
   return recommendations;
 }
@@ -56198,7 +56327,7 @@ class PlanSyncWorker {
       const planJsonPath = path36.join(swarmDir, "plan.json");
       const markerPath = path36.join(swarmDir, ".plan-write-marker");
       const planStats = fs24.statSync(planJsonPath);
-      const planMtimeMs = planStats.mtimeMs;
+      const planMtimeMs = Math.floor(planStats.mtimeMs);
       const markerContent = fs24.readFileSync(markerPath, "utf8");
       const marker = JSON.parse(markerContent);
       const markerTimestampMs = new Date(marker.timestamp).getTime();
@@ -57676,6 +57805,54 @@ function createGuardrailsHooks(directory, directoryOrConfig, config3, authorityC
     "pre_check_batch"
   ];
   const requireReviewerAndTestEngineer = cfg.qa_gates?.require_reviewer_test_engineer ?? true;
+  function checkDestructiveCommand(tool3, args2) {
+    if (tool3 !== "bash" && tool3 !== "shell")
+      return;
+    if (cfg.block_destructive_commands === false)
+      return;
+    const toolArgs = args2;
+    const command = typeof toolArgs?.command === "string" ? toolArgs.command.trim() : "";
+    if (!command)
+      return;
+    if (/:\s*\(\s*\)\s*\{[^}]*\|[^}]*:/.test(command)) {
+      throw new Error(`BLOCKED: Potentially destructive shell command detected: fork bomb pattern`);
+    }
+    const rmFlagPattern = /^rm\s+(-r\s+-f|-f\s+-r|-rf|-fr)\s+(.+)$/;
+    const rmMatch = rmFlagPattern.exec(command);
+    if (rmMatch) {
+      const targetPart = rmMatch[2].trim();
+      const targets = targetPart.split(/\s+/);
+      const safeTargets = /^(node_modules|\.git)$/;
+      const allSafe = targets.every((t) => safeTargets.test(t));
+      if (!allSafe) {
+        throw new Error(`BLOCKED: Potentially destructive shell command: rm -rf on unsafe path(s): ${targetPart}`);
+      }
+    }
+    if (/^git\s+push\b.*?(--force|-f)\b/.test(command)) {
+      throw new Error(`BLOCKED: Force push detected \u2014 git push --force is not allowed`);
+    }
+    if (/^git\s+reset\s+--hard/.test(command)) {
+      throw new Error(`BLOCKED: "git reset --hard" detected \u2014 use --soft or --mixed with caution`);
+    }
+    if (/^git\s+reset\s+--mixed\s+\S+/.test(command)) {
+      throw new Error(`BLOCKED: "git reset --mixed" with a target branch/commit is not allowed`);
+    }
+    if (/^kubectl\s+delete\b/.test(command)) {
+      throw new Error(`BLOCKED: "kubectl delete" detected \u2014 destructive cluster operation`);
+    }
+    if (/^docker\s+system\s+prune\b/.test(command)) {
+      throw new Error(`BLOCKED: "docker system prune" detected \u2014 destructive container operation`);
+    }
+    if (/^\s*DROP\s+(TABLE|DATABASE|SCHEMA)\b/i.test(command)) {
+      throw new Error(`BLOCKED: SQL DROP command detected \u2014 destructive database operation`);
+    }
+    if (/^\s*TRUNCATE\s+TABLE\b/i.test(command)) {
+      throw new Error(`BLOCKED: SQL TRUNCATE command detected \u2014 destructive database operation`);
+    }
+    if (/^mkfs[./]/.test(command)) {
+      throw new Error(`BLOCKED: Disk format command (mkfs) detected \u2014 disk formatting operation`);
+    }
+  }
   async function checkGateLimits(params) {
     const { sessionID, window: window2, agentConfig, elapsedMinutes, repetitionCount } = params;
     if (agentConfig.max_tool_calls > 0 && window2.toolCalls >= agentConfig.max_tool_calls) {
@@ -58025,6 +58202,7 @@ function createGuardrailsHooks(directory, directoryOrConfig, config3, authorityC
       handleDelegatedWriteTracking(input.sessionID, input.tool, output.args);
       handleLoopDetection(input.sessionID, input.tool, output.args);
       handleTestSuiteBlocking(input.tool, output.args);
+      checkDestructiveCommand(input.tool, output.args);
       if (isArchitect(input.sessionID) && isWriteTool(input.tool)) {
         handlePlanAndScopeProtection(input.sessionID, input.tool, output.args);
         const toolArgs = output.args;
@@ -58205,18 +58383,18 @@ function createGuardrailsHooks(directory, directoryOrConfig, config3, authorityC
             const fallbackModels = swarmAgents?.[baseAgentName]?.fallback_models;
             session.modelFallbackExhausted = !fallbackModels || session.model_fallback_index > fallbackModels.length;
             const fallbackModel = resolveFallbackModel(baseAgentName, session.model_fallback_index, swarmAgents);
+            const primaryModel = swarmAgents?.[baseAgentName]?.model ?? "default";
             if (fallbackModel) {
-              const primaryModel = swarmAgents?.[baseAgentName]?.model ?? "default";
               if (swarmAgents?.[baseAgentName]) {
                 swarmAgents[baseAgentName].model = fallbackModel;
               }
-              telemetry.modelFallback(input.sessionID, session.agentName, primaryModel, fallbackModel, "transient_model_error");
               session.pendingAdvisoryMessages ??= [];
               session.pendingAdvisoryMessages.push(`MODEL FALLBACK: Applied fallback model "${fallbackModel}" (attempt ${session.model_fallback_index}). ` + `Using /swarm handoff to reset to primary model.`);
             } else {
               session.pendingAdvisoryMessages ??= [];
               session.pendingAdvisoryMessages.push(`MODEL FALLBACK: Transient model error detected (attempt ${session.model_fallback_index}). ` + `No fallback models configured for this agent. Add "fallback_models": ["model-a", "model-b"] ` + `to the agent's config in opencode-swarm.json.`);
             }
+            telemetry.modelFallback(input.sessionID, session.agentName, primaryModel, fallbackModel ?? "none", "transient_model_error");
             swarmState.pendingEvents++;
           }
         }
@@ -58589,17 +58767,22 @@ function normalizePathWithCache(filePath, cwd) {
     return fallback;
   }
 }
-function getGlobMatcher(pattern) {
+function getGlobMatcher(pattern, caseInsensitive = process.platform === "win32" || process.platform === "darwin") {
   const cached3 = globMatcherCache.get(pattern);
   if (cached3 !== undefined) {
     return cached3;
   }
-  const matcher = import_picomatch.default(pattern, {
-    dot: true,
-    nocase: process.platform === "win32"
-  });
-  globMatcherCache.set(pattern, matcher);
-  return matcher;
+  try {
+    const matcher = import_picomatch.default(pattern, {
+      dot: true,
+      nocase: caseInsensitive
+    });
+    globMatcherCache.set(pattern, matcher);
+    return matcher;
+  } catch (err2) {
+    warn(`picomatch error for pattern "${pattern}": ${err2}`);
+    return () => false;
+  }
 }
 var DEFAULT_AGENT_AUTHORITY_RULES = {
   architect: {
@@ -58677,7 +58860,7 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules) {
   const dir = cwd || process.cwd();
   let normalizedPath;
   try {
-    const normalizedWithSymlinks = normalizePathWithCache(filePath, cwd);
+    const normalizedWithSymlinks = normalizePathWithCache(filePath, dir);
     const resolved = path38.resolve(dir, normalizedWithSymlinks);
     normalizedPath = path38.relative(dir, resolved).replace(/\\/g, "/");
   } catch {
@@ -58730,6 +58913,16 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules) {
       return { allowed: true };
     }
   }
+  if (rules.blockedPrefix && rules.blockedPrefix.length > 0) {
+    for (const prefix of rules.blockedPrefix) {
+      if (normalizedPath.startsWith(prefix)) {
+        return {
+          allowed: false,
+          reason: `Path blocked: ${normalizedPath} is under ${prefix}`
+        };
+      }
+    }
+  }
   if (rules.allowedPrefix != null && rules.allowedPrefix.length > 0) {
     const isAllowed = rules.allowedPrefix.some((prefix) => normalizedPath.startsWith(prefix));
     if (!isAllowed) {
@@ -58744,16 +58937,6 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules) {
       reason: `Path ${normalizedPath} not in allowed list for ${normalizedAgent}`
     };
   }
-  if (rules.blockedPrefix && rules.blockedPrefix.length > 0) {
-    for (const prefix of rules.blockedPrefix) {
-      if (normalizedPath.startsWith(prefix)) {
-        return {
-          allowed: false,
-          reason: `Path blocked: ${normalizedPath} is under ${prefix}`
-        };
-      }
-    }
-  }
   if (rules.blockedZones && rules.blockedZones.length > 0) {
     const { zone } = classifyFile(normalizedPath);
     if (rules.blockedZones.includes(zone)) {
@@ -59526,7 +59709,9 @@ var END_OF_SENTENCE_QUESTION_PATTERN = /\?\s*$/;
 var PHASE_COMPLETION_PATTERNS = [
   /Ready for Phase (?:\d+|\[?N\+1\]?)\??/i,
   /phase.{0,20}(?:complete|finish|done|wrap)/i,
-  /move(?:d?)?\s+(?:on\s+)?to\s+(?:the\s+)?(?:next\s+)?phase/i
+  /move(?:d?)?\s+(?:on\s+)?to\s+(?:the\s+)?(?:next\s+)?phase/i,
+  /(?:proceed|move)\s+to\s+the\s+next\s+phase/i,
+  /what would you like.{0,20}(?:next|do next)/i
 ];
 var QUESTION_ESCALATION_PATTERNS = [
   /escalat/i,
@@ -61431,6 +61616,47 @@ ${handoffBlock}`);
               }
             } catch {}
           }
+          if (baseRole === "coder") {
+            const sessionId_ccp = _input.sessionID ?? "";
+            const ccpSession = swarmState.agentSessions.get(sessionId_ccp);
+            try {
+              const coderScope = ccpSession?.declaredCoderScope;
+              const primaryFile = coderScope?.[0] ?? "";
+              if (primaryFile.length > 0) {
+                const { knowledge_recall: knowledge_recall2 } = await Promise.resolve().then(() => (init_knowledge_recall(), exports_knowledge_recall));
+                const rawResult = await knowledge_recall2.execute({ query: primaryFile }, { directory });
+                if (rawResult && typeof rawResult === "string") {
+                  const parsed = JSON.parse(rawResult);
+                  if (parsed.results.length > 0) {
+                    const lines = parsed.results.map((r) => {
+                      const lesson = r.lesson.length > 200 ? `${r.lesson.slice(0, 200)}...` : r.lesson;
+                      return `- [${r.category}] ${lesson}`;
+                    });
+                    tryInject(`## CONTEXT FROM KNOWLEDGE BASE
+${lines.join(`
+`)}`);
+                  }
+                }
+              }
+            } catch {}
+            try {
+              const taskId_ccp = ccpSession?.currentTaskId;
+              if (taskId_ccp && !taskId_ccp.includes("..") && !taskId_ccp.includes("/") && !taskId_ccp.includes("\\") && !taskId_ccp.includes("\x00")) {
+                const evidencePath = path47.join(directory, ".swarm", "evidence", `${taskId_ccp}.json`);
+                if (fs35.existsSync(evidencePath)) {
+                  const evidenceContent = fs35.readFileSync(evidencePath, "utf-8");
+                  const evidenceData = JSON.parse(evidenceContent);
+                  const rejections = (evidenceData.bundle?.entries ?? []).filter((e) => e.type === "gate" && e.gate_type === "reviewer" && e.verdict === "reject");
+                  if (rejections.length > 0) {
+                    const lines = rejections.map((r) => `- ${r.reason ?? "No reason provided"}`);
+                    tryInject(`## PRIOR REJECTIONS
+${lines.join(`
+`)}`);
+                  }
+                }
+              }
+            } catch {}
+          }
           if (baseRole === "coder") {
             const taskText_lang_a = plan2 && plan2.migration_status !== "migration_failed" ? extractCurrentTaskFromPlan(plan2) : null;
             const langConstraints_a = buildLanguageCoderConstraints(taskText_lang_a);
@@ -67760,90 +67986,10 @@ var knowledge_query = createSwarmTool({
 `);
   }
 });
-// src/tools/knowledge-recall.ts
-init_dist();
-init_knowledge_store();
-init_create_tool();
-var knowledge_recall = createSwarmTool({
-  description: "Search the knowledge base for relevant past decisions, patterns, and lessons learned. Returns ranked results by semantic similarity.",
-  args: {
-    query: tool.schema.string().min(3).describe("Natural language search query"),
-    top_n: tool.schema.number().int().min(1).max(20).optional().describe("Maximum results to return (default: 5)"),
-    tier: tool.schema.enum(["all", "swarm", "hive"]).optional().describe("Knowledge tier to search (default: 'all')")
-  },
-  execute: async (args2, directory) => {
-    let queryInput;
-    let topNInput;
-    let tierInput;
-    try {
-      if (args2 && typeof args2 === "object") {
-        const obj = args2;
-        queryInput = obj.query;
-        topNInput = obj.top_n;
-        tierInput = obj.tier;
-      }
-    } catch {}
-    if (typeof queryInput !== "string" || queryInput.length < 3) {
-      return JSON.stringify({
-        results: [],
-        total: 0,
-        error: "query must be a string with at least 3 characters"
-      });
-    }
-    let topN = 5;
-    if (topNInput !== undefined) {
-      if (typeof topNInput === "number" && Number.isInteger(topNInput)) {
-        topN = Math.max(1, Math.min(20, topNInput));
-      }
-    }
-    let tier = "all";
-    if (tierInput !== undefined && typeof tierInput === "string") {
-      if (tierInput === "swarm" || tierInput === "hive") {
-        tier = tierInput;
-      }
-    }
-    const swarmPath = resolveSwarmKnowledgePath(directory);
-    const hivePath = resolveHiveKnowledgePath();
-    const [swarmEntries, hiveEntries] = await Promise.all([
-      readKnowledge(swarmPath),
-      readKnowledge(hivePath)
-    ]);
-    let entries = [];
-    if (tier === "all" || tier === "swarm") {
-      entries = entries.concat(swarmEntries);
-    }
-    if (tier === "all" || tier === "hive") {
-      entries = entries.concat(hiveEntries);
-    }
-    if (entries.length === 0) {
-      const result2 = { results: [], total: 0 };
-      return JSON.stringify(result2);
-    }
-    const normalizedQuery = normalize2(queryInput);
-    const queryBigrams = wordBigrams(normalizedQuery);
-    const scoredEntries = entries.map((entry) => {
-      const entryText = `${entry.lesson} ${entry.tags.join(" ")} ${entry.category}`;
-      const entryBigrams = wordBigrams(entryText);
-      const textScore = jaccardBigram(queryBigrams, entryBigrams);
-      const boost = entry.status === "established" ? 0.1 : entry.status === "promoted" ? 0.05 : 0;
-      const finalScore = textScore + boost;
-      return {
-        id: entry.id,
-        confidence: entry.confidence,
-        category: entry.category,
-        lesson: entry.lesson,
-        score: finalScore
-      };
-    });
-    scoredEntries.sort((a, b) => b.score - a.score);
-    const topResults = scoredEntries.slice(0, topN);
-    const result = {
-      results: topResults,
-      total: topResults.length
-    };
-    return JSON.stringify(result);
-  }
-});
+
+// src/tools/index.ts
+init_knowledge_recall();
+
 // src/tools/knowledge-remove.ts
 init_dist();
 init_knowledge_store();
@@ -76173,7 +76319,7 @@ async function executeUpdateTaskStatus(args2, fallbackDir) {
         message: "Invalid working_directory: null bytes are not allowed"
       };
     }
-    if (process.platform === "win32") {
+    {
       const devicePathPattern = /^\\\\|^(NUL|CON|AUX|COM[1-9]|LPT[1-9])(\..*)?$/i;
       if (devicePathPattern.test(args2.working_directory)) {
         return {
@@ -76329,7 +76475,7 @@ async function executeUpdateTaskStatus(args2, fallbackDir) {
       errors: [error93 instanceof Error ? error93.message : String(error93)]
     };
   } finally {
-    if (lockResult && lockResult.acquired && lockResult.lock._release) {
+    if (lockResult?.acquired && lockResult.lock._release) {
       try {
         await lockResult.lock._release();
       } catch (releaseError) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "6.59.0",
+	"version": "6.60.1",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",