opencode-swarm 6.70.0 → 6.71.0

package/dist/cli/index.js

@@ -19091,7 +19091,9 @@ var GuardrailsConfigSchema = exports_external.object({
     require_reviewer_test_engineer: exports_external.boolean().default(true)
   }).optional(),
   profiles: exports_external.record(exports_external.string(), GuardrailsProfileSchema).optional(),
-  block_destructive_commands: exports_external.boolean().default(true)
+  block_destructive_commands: exports_external.boolean().default(true),
+  interpreter_allowed_agents: exports_external.array(exports_external.string().min(1)).optional(),
+  shell_audit_log: exports_external.boolean().default(true)
 });
 var WatchdogConfigSchema = exports_external.object({
   scope_guard: exports_external.boolean().default(true),

package/dist/config/schema.d.ts

@@ -331,6 +331,8 @@ export declare const GuardrailsConfigSchema: z.ZodObject<{
         idle_timeout_minutes: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>>;
     block_destructive_commands: z.ZodDefault<z.ZodBoolean>;
+    interpreter_allowed_agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    shell_audit_log: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;
 export type GuardrailsConfig = z.infer<typeof GuardrailsConfigSchema>;
 export declare const WatchdogConfigSchema: z.ZodObject<{
@@ -667,6 +669,8 @@ export declare const PluginConfigSchema: z.ZodObject<{
             idle_timeout_minutes: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strip>>>;
         block_destructive_commands: z.ZodDefault<z.ZodBoolean>;
+        interpreter_allowed_agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        shell_audit_log: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
     watchdog: z.ZodOptional<z.ZodObject<{
         scope_guard: z.ZodDefault<z.ZodBoolean>;

package/dist/hooks/guardrails.d.ts

@@ -28,6 +28,13 @@ export declare function setStoredInputArgs(callID: string, args: unknown): void;
  * @param callID The callID to delete
  */
 export declare function deleteStoredInputArgs(callID: string): void;
+/**
+ * Redacts sensitive values from a shell command string before audit logging.
+ * Covers env-var assignments, CLI flags, Bearer/Basic auth, and -H header flags.
+ * Conservative: only redacts patterns with well-known secret-bearing names.
+ * Export allows unit testing without spinning up a full hooks factory.
+ */
+export declare function redactShellCommand(cmd: string): string;
 /**
  * Creates guardrails hooks for circuit breaker protection
  * @param directory Working directory from plugin init context (required)