opencode-swarm 7.0.0-beta.1 → 7.0.0

package/dist/hooks/message-priority.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Message Priority Classifier Hook
+ *
+ * Provides zero-cost message priority classification to enable intelligent
+ * context pruning. Messages are tagged with priority tiers (0-4) so that
+ * low-priority messages are removed first during context budget pressure.
+ *
+ * Priority tiers:
+ * - CRITICAL (0): System prompt, plan state, active instructions
+ * - HIGH (1): User messages, current task context, tool definitions
+ * - MEDIUM (2): Recent assistant responses, recent tool results
+ * - LOW (3): Old assistant responses, old tool results, confirmations
+ * - DISPOSABLE (4): Duplicate reads, superseded writes, stale errors
+ */
+/**
+ * Message priority tiers for context pruning decisions.
+ * Lower values = higher priority (kept longer during pruning).
+ */
+export declare const MessagePriority: {
+    /** System prompt, plan state, active instructions - never prune */
+    readonly CRITICAL: 0;
+    /** User messages, current task context, tool definitions */
+    readonly HIGH: 1;
+    /** Recent assistant responses, recent tool results (within recentWindowSize) */
+    readonly MEDIUM: 2;
+    /** Old assistant responses, old tool results */
+    readonly LOW: 3;
+    /** Duplicate reads, superseded writes, stale errors - prune first */
+    readonly DISPOSABLE: 4;
+};
+export type MessagePriorityType = (typeof MessagePriority)[keyof typeof MessagePriority];
+/** Message structure matching the format from context-budget.ts */
+interface MessageInfo {
+    role?: string;
+    agent?: string;
+    sessionID?: string;
+    modelID?: string;
+    providerID?: string;
+    toolName?: string;
+    toolArgs?: unknown;
+    [key: string]: unknown;
+}
+interface MessagePart {
+    type?: string;
+    text?: string;
+    [key: string]: unknown;
+}
+export interface MessageWithParts {
+    info?: MessageInfo;
+    parts?: MessagePart[];
+}
+/**
+ * Checks if text contains .swarm/plan or .swarm/context references
+ * indicating swarm state that should be preserved.
+ *
+ * @param text - The text content to check
+ * @returns true if the text contains plan/context references
+ */
+export declare function containsPlanContent(text: string): boolean;
+/**
+ * Checks if a message is a tool result (assistant message with tool call).
+ *
+ * @param message - The message to check
+ * @returns true if the message appears to be a tool result
+ */
+export declare function isToolResult(message: MessageWithParts): boolean;
+/**
+ * Checks if two consecutive tool read calls are duplicates
+ * (same tool with same first argument).
+ *
+ * @param current - The current message
+ * @param previous - The previous message
+ * @returns true if this is a duplicate tool read
+ */
+export declare function isDuplicateToolRead(current: MessageWithParts, previous: MessageWithParts): boolean;
+/**
+ * Checks if a message contains an error pattern and is stale
+ * (more than the specified number of turns old).
+ *
+ * @param text - The message text to check
+ * @param turnsAgo - How many turns ago the message was sent
+ * @returns true if the message is a stale error
+ */
+export declare function isStaleError(text: string, turnsAgo: number): boolean;
+/**
+ * Classifies a message by priority tier for intelligent pruning.
+ *
+ * @param message - The message to classify
+ * @param index - Position in messages array (0-indexed)
+ * @param totalMessages - Total number of messages
+ * @param recentWindowSize - Number of recent messages to consider MEDIUM (default 10)
+ * @returns Priority tier (0=CRITICAL, 1=HIGH, 2=MEDIUM, 3=LOW, 4=DISPOSABLE)
+ */
+export declare function classifyMessage(message: MessageWithParts, index: number, totalMessages: number, recentWindowSize?: number): MessagePriorityType;
+/**
+ * Classifies a batch of messages with duplicate detection.
+ * This function should be called in order (oldest to newest) to properly
+ * detect consecutive duplicate tool reads.
+ *
+ * @param messages - Array of messages to classify
+ * @param recentWindowSize - Number of recent messages to consider MEDIUM (default 10)
+ * @returns Array of priority classifications matching message order
+ */
+export declare function classifyMessages(messages: MessageWithParts[], recentWindowSize?: number): MessagePriorityType[];
+export {};

package/dist/hooks/messages-transform.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Consolidates multiple system messages into a single system message at index 0.
+ *
+ * Note: Merged content order matches original insertion order (OpenCode base prompt
+ * first, then swarm agent prompt) - this assumes sequential message construction.
+ */
+type Message = {
+    role: string;
+    content: unknown;
+    [key: string]: unknown;
+};
+export declare function consolidateSystemMessages(messages: Message[]): Message[];
+export {};

package/dist/hooks/model-limits.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Provider-Aware Model Limit Resolution
+ *
+ * Resolves context window limits based on the model and provider platform.
+ * The same model has different context limits depending on the provider:
+ * - Claude Sonnet 4.6: 200k native, 128k on Copilot
+ * - GPT-5: 400k native, 128k on Copilot
+ * - Copilot caps ALL models at 128k prompt, regardless of native limit
+ */
+/**
+ * Native model context limits (in tokens) when used on their native platform.
+ */
+export declare const NATIVE_MODEL_LIMITS: Record<string, number>;
+/**
+ * Provider-specific context caps that override native limits.
+ * These are typically lower than native limits (e.g., Copilot caps at 128k).
+ */
+export declare const PROVIDER_CAPS: Record<string, number>;
+/**
+ * Message structure from experimental.chat.messages.transform hook.
+ */
+interface MessageInfo {
+    role: string;
+    agent?: string;
+    sessionID?: string;
+    modelID?: string;
+    providerID?: string;
+    [key: string]: unknown;
+}
+interface MessagePart {
+    type: string;
+    text?: string;
+    [key: string]: unknown;
+}
+interface MessageWithParts {
+    info: MessageInfo;
+    parts: MessagePart[];
+}
+/**
+ * Extracts modelID and providerID from the most recent assistant message.
+ *
+ * @param messages - Array of messages from experimental.chat.messages.transform hook
+ * @returns Object containing modelID and/or providerID if found
+ *
+ * @example
+ * const info = extractModelInfo(messages);
+ * // Returns: { modelID: 'claude-sonnet-4-6', providerID: 'anthropic' }
+ * // Or: {} if no assistant messages or fields not found
+ */
+export declare function extractModelInfo(messages: MessageWithParts[]): {
+    modelID?: string;
+    providerID?: string;
+};
+/**
+ * Resolves the context limit for a given model/provider combination.
+ *
+ * Resolution order (first match wins):
+ * 1. Check configOverrides["provider/model"] (e.g., "copilot/claude-sonnet-4-6": 200000)
+ * 2. Check configOverrides[modelID] (e.g., "claude-sonnet-4-6": 200000)
+ * 3. Check PROVIDER_CAPS[providerID] (e.g., copilot → 128000)
+ * 4. Check NATIVE_MODEL_LIMITS with prefix matching (e.g., "claude-sonnet-4" matches "claude-sonnet-4-6-20260301")
+ * 5. Check configOverrides.default
+ * 6. Fall back to 128000
+ *
+ * @param modelID - The model identifier (e.g., "claude-sonnet-4-6", "gpt-5")
+ * @param providerID - The provider identifier (e.g., "copilot", "anthropic")
+ * @param configOverrides - User configuration overrides
+ * @returns The resolved context limit in tokens
+ *
+ * @example
+ * // Provider cap (copilot)
+ * resolveModelLimit("claude-sonnet-4-6", "copilot", {})
+ * // Returns: 128000
+ *
+ * @example
+ * // Native limit (anthropic)
+ * resolveModelLimit("claude-sonnet-4-6", "anthropic", {})
+ * // Returns: 200000
+ *
+ * @example
+ * // Override beats cap
+ * resolveModelLimit("gpt-5", "copilot", { "copilot/gpt-5": 200000 })
+ * // Returns: 200000
+ *
+ * @example
+ * // Prefix match for model variants
+ * resolveModelLimit("claude-sonnet-4-6-20260301", "anthropic", {})
+ * // Returns: 200000
+ *
+ * @example
+ * // Full fallback
+ * resolveModelLimit(undefined, undefined, {})
+ * // Returns: 128000
+ */
+export declare function resolveModelLimit(modelID?: string, providerID?: string, configOverrides?: Record<string, number>): number;
+export {};

package/dist/hooks/normalize-tool-name.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Canonical tool-name normalization helpers
+ *
+ * Strip namespace prefixes (e.g., "mega:write", "mega.search") to get the base tool name.
+ */
+/**
+ * Strip namespace prefix from a tool name.
+ *
+ * Examples:
+ *   "opencode:write" → "write"
+ *   "opencode.bash" → "bash"
+ *   "write" → "write"
+ *   undefined/null → undefined
+ */
+export declare function normalizeToolName(toolName: string): string;
+export declare function normalizeToolName(toolName: null | undefined): string | undefined;
+/**
+ * Strip namespace prefix and lowercase the result.
+ *
+ * Examples:
+ *   "opencode:WRITE" → "write"
+ *   "opencode.bash" → "bash"
+ *   "write" → "write"
+ */
+export declare function normalizeToolNameLowerCase(toolName: string): string;

package/dist/hooks/phase-monitor.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Phase Monitor Hook
+ *
+ * Detects phase transitions by reading plan state on each system prompt transform.
+ * When a phase change is detected, triggers preflight via PreflightTriggerManager.
+ * Wrapped in safeHook — errors must never propagate.
+ */
+import type { PreflightTriggerManager } from '../background/trigger';
+import { type CuratorLLMDelegate } from './curator';
+import type { CuratorConfig, CuratorInitResult } from './curator-types';
+/** Injectable curator runner type — allows test injection without module mocking. */
+export type CuratorInitRunner = (directory: string, config: CuratorConfig, llmDelegate?: CuratorLLMDelegate) => Promise<CuratorInitResult>;
+/** Factory that creates a CuratorLLMDelegate for a given session — enables session-aware resolution. */
+export type CuratorDelegateFactory = (sessionId?: string) => CuratorLLMDelegate | undefined;
+/**
+ * Creates a hook that monitors plan phase transitions and triggers preflight.
+ *
+ * @param directory - Project directory (where .swarm/ lives)
+ * @param preflightManager - Optional PreflightTriggerManager to call on phase change.
+ *   When undefined, preflight checks are skipped but curator initialization still runs
+ *   at session start (useful when knowledge.enabled but phase_preflight is disabled).
+ * @param curatorRunner - Optional curator init runner (defaults to runCuratorInit; injectable for tests)
+ * @param delegateFactory - Optional factory that creates a CuratorLLMDelegate for the calling session.
+ *   Called lazily at hook invocation time with the session ID extracted from the hook input,
+ *   enabling correct multi-swarm curator resolution. For test injection of a pre-built delegate,
+ *   pass `() => myDelegate`.
+ * @returns A safeHook-wrapped system.transform handler
+ */
+export declare function createPhaseMonitorHook(directory: string, preflightManager?: PreflightTriggerManager, curatorRunner?: CuratorInitRunner, delegateFactory?: CuratorDelegateFactory): (input: unknown, output: unknown) => Promise<void>;

package/dist/hooks/pipeline-tracker.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Pipeline Tracker Hook
+ *
+ * Injects phase reminders into messages to keep the Architect on track.
+ * Uses experimental.chat.messages.transform so it doesn't show in UI.
+ *
+ * Research: "LLMs Get Lost In Multi-Turn Conversation" shows ~40% compliance
+ * drop after 2-3 turns without reminders.
+ */
+import type { PluginConfig } from '../config';
+/**
+ * Build dynamic phase reminder with compliance escalation based on phase number.
+ * Counteracts temporal compliance decay discovered during field testing.
+ */
+export declare function buildPhaseReminder(phaseNumber: number | null): string;
+interface MessageInfo {
+    role: string;
+    agent?: string;
+    sessionID?: string;
+}
+interface MessagePart {
+    type: string;
+    text?: string;
+    [key: string]: unknown;
+}
+interface MessageWithParts {
+    info: MessageInfo;
+    parts: MessagePart[];
+}
+/**
+ * Creates the experimental.chat.messages.transform hook for pipeline tracking.
+ * Only injects for the architect agent.
+ */
+export declare function createPipelineTrackerHook(config: PluginConfig, directory?: string): {
+    'experimental.chat.messages.transform'?: undefined;
+} | {
+    'experimental.chat.messages.transform': (input: Record<string, never>, output: {
+        messages?: MessageWithParts[];
+    }) => Promise<void>;
+};
+export {};

package/dist/hooks/repo-graph-builder.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Repo Graph Builder Hook
+ *
+ * Startup hook that builds or refreshes the repo dependency graph when a session starts.
+ * Write-trigger hook that incrementally updates the graph when write tools are called.
+ * Wrapped in try/catch — failures are logged but never block plugin initialization.
+ */
+import { type RepoGraph } from '../tools/repo-graph';
+export interface RepoGraphBuilderHook {
+    init(): Promise<void>;
+    toolAfter(input: {
+        tool: string;
+        sessionID: string;
+        args?: unknown;
+    }, output: {
+        output?: unknown;
+        args?: unknown;
+    }): Promise<void>;
+}
+export interface RepoGraphDeps {
+    buildWorkspaceGraph: (workspace: string, options?: {
+        maxFileSizeBytes?: number;
+        maxFiles?: number;
+    }) => RepoGraph;
+    saveGraph: (workspace: string, graph: RepoGraph, options?: {
+        createAtomic?: boolean;
+    }) => Promise<void>;
+    updateGraphForFiles: (workspace: string, files: string[], options?: {
+        forceRebuild?: boolean;
+    }) => Promise<RepoGraph>;
+}
+export declare function createRepoGraphBuilderHook(workspaceRoot: string, deps?: Partial<RepoGraphDeps>): RepoGraphBuilderHook;

package/dist/hooks/repo-graph-injection.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Repo graph context injection for the system-enhancer hook.
+ *
+ * Produces compact text blocks that surface structural information
+ * (importers, dependents, blast radius) for the file the agent is about
+ * to edit. Designed to fit within the system-enhancer's per-block budget
+ * (~300-500 chars).
+ *
+ * Failure mode: silent. If no graph exists (`.swarm/repo-graph.json`
+ * absent or invalid), this module returns `null` for every helper —
+ * the agent simply doesn't get the extra context. The graph is built
+ * on-demand by the agent calling `repo_map` with action="build".
+ *
+ * Caching: the loaded graph is cached per-directory in module scope to
+ * avoid re-reading the JSON on every system prompt construction. The
+ * cache is bypassed if the file's mtime advances.
+ */
+import { type RepoGraph } from '../graph';
+/**
+ * Load the repo graph for `directory`, using a per-directory cache that
+ * invalidates on file mtime change. Returns null if no graph exists.
+ *
+ * Exported only for tests; production callers use the buildXxxBlock helpers below.
+ */
+export declare function getCachedGraph(directory: string): RepoGraph | null;
+/** Test-only: clear the per-directory cache. */
+export declare function resetGraphInjectionCache(): void;
+/**
+ * Build a localization block for a target file. Used by the coder agent
+ * to surface importers/dependencies/blast-radius before editing.
+ *
+ * Returns null when:
+ *   - No graph exists.
+ *   - The target isn't tracked in the graph (file too new, language unsupported).
+ */
+export declare function buildCoderLocalizationBlock(directory: string, targetFile: string): string | null;
+/**
+ * Build a blast-radius block for a list of changed files. Used by the
+ * reviewer agent to spot-check whether unseen consumers might break.
+ *
+ * Returns null when no graph exists or when none of the files are in the
+ * graph. The result is bounded to the top 8 dependents to stay within
+ * the per-block context budget.
+ */
+export declare function buildReviewerBlastRadiusBlock(directory: string, changedFiles: string[]): string | null;

package/dist/hooks/review-receipt.d.ts

@@ -0,0 +1,189 @@
+/**
+ * Review receipt persistence for opencode-swarm.
+ *
+ * Persists reviewer and curator review receipts to disk so that future
+ * re-reviews and drift verification have durable evidence of prior judgments.
+ *
+ * Two receipt types:
+ *   RejectedReviewReceipt  — full-detail artifact with blocking findings,
+ *                             exact evidence refs, scope fingerprint/hash,
+ *                             and re-review pass conditions.
+ *   ApprovedReviewReceipt  — compact artifact with what was checked, claims
+ *                             validated, scope fingerprint, and caveats.
+ *
+ * Storage: .swarm/review-receipts/<YYYY-MM-DD>-<id>.json (one file per receipt)
+ *          .swarm/review-receipts/index.json              (manifest for fast lookup)
+ *
+ * Staleness: receipts are invalidated when the scope fingerprint changes
+ *            materially (any character-level change to the canonical diff/hash).
+ *            Consumers MUST check isScopeStale() before trusting an approved receipt.
+ *
+ * Critic drift verification can consume prior receipts as supporting context
+ * but MUST NOT blindly trust them — staleness check is mandatory.
+ */
+export type ReceiptVerdict = 'rejected' | 'approved';
+/** Identity of the reviewer/curator that produced the receipt. */
+export interface ReviewerIdentity {
+    /** Agent name (e.g. 'reviewer', 'critic', 'curator') */
+    agent: string;
+    /** Optional session ID for traceability */
+    session_id?: string;
+}
+/** A canonical fingerprint/hash of the reviewed scope or diff. */
+export interface ScopeFingerprint {
+    /** SHA-256 hex digest of the canonical scope content */
+    hash: string;
+    /** Short description of what was hashed (e.g. 'git-diff', 'file-content', 'spec-md') */
+    scope_description: string;
+    /** Length of the original content in characters */
+    content_length: number;
+}
+/** A blocking finding recorded in a rejected review. */
+export interface BlockingFinding {
+    /** File path (relative) or identifier */
+    location: string;
+    /** One-line summary of the finding */
+    summary: string;
+    /** Line number if applicable */
+    line?: number;
+    /** Severity: 'critical' | 'high' | 'medium' */
+    severity: 'critical' | 'high' | 'medium';
+}
+/**
+ * Rejected review receipt.
+ * Full-detail artifact. Persisted for re-review reference.
+ */
+export interface RejectedReviewReceipt {
+    schema_version: 1;
+    id: string;
+    receipt_type: 'rejected';
+    verdict: 'rejected';
+    /** Reviewer/curator that produced this receipt */
+    reviewer: ReviewerIdentity;
+    /** ISO 8601 timestamp */
+    reviewed_at: string;
+    /** Fingerprint of the reviewed scope */
+    scope_fingerprint: ScopeFingerprint;
+    /** Blocking findings that caused rejection */
+    blocking_findings: BlockingFinding[];
+    /** Exact evidence references (file paths, line numbers, etc.) */
+    evidence_references: string[];
+    /** Conditions that must be met for a re-review to pass */
+    pass_conditions: string[];
+    /** Optional free-text summary */
+    summary?: string;
+}
+/**
+ * Approved review receipt.
+ * Compact artifact. Supporting evidence, not durable proof.
+ */
+export interface ApprovedReviewReceipt {
+    schema_version: 1;
+    id: string;
+    receipt_type: 'approved';
+    verdict: 'approved';
+    /** Reviewer/curator that produced this receipt */
+    reviewer: ReviewerIdentity;
+    /** ISO 8601 timestamp */
+    reviewed_at: string;
+    /** Fingerprint of the reviewed scope */
+    scope_fingerprint: ScopeFingerprint;
+    /** What aspects were checked (e.g. ['security', 'correctness', 'test coverage']) */
+    checked_aspects: string[];
+    /** Claims that were validated during review */
+    validated_claims: string[];
+    /** Residual risk or caveats */
+    caveats?: string[];
+}
+export type ReviewReceipt = RejectedReviewReceipt | ApprovedReviewReceipt;
+/** Index entry for fast lookup without reading every receipt file. */
+export interface ReceiptIndexEntry {
+    id: string;
+    verdict: ReceiptVerdict;
+    reviewed_at: string;
+    scope_hash: string;
+    agent: string;
+    filename: string;
+}
+/** Receipt index manifest stored in .swarm/review-receipts/index.json */
+export interface ReceiptIndex {
+    schema_version: 1;
+    entries: ReceiptIndexEntry[];
+}
+/** Returns the .swarm/review-receipts/ directory path. */
+export declare function resolveReceiptsDir(directory: string): string;
+/** Returns the index file path. */
+export declare function resolveReceiptIndexPath(directory: string): string;
+/**
+ * Compute a SHA-256 scope fingerprint for a given content string.
+ * The hash is deterministic: same content → same hash.
+ */
+export declare function computeScopeFingerprint(content: string, scopeDescription: string): ScopeFingerprint;
+/**
+ * Returns true if the current scope content is materially different from
+ * the fingerprint recorded in the receipt. Any character-level change to the
+ * canonical content (same scopeDescription) invalidates the receipt.
+ *
+ * If `currentContent` is undefined (scope no longer available), the receipt
+ * is treated as stale (conservative: assume the scope has changed).
+ */
+export declare function isScopeStale(receipt: ReviewReceipt, currentContent: string | undefined): boolean;
+/**
+ * Persist a review receipt (rejected or approved) to disk.
+ * Creates .swarm/review-receipts/<date>-<id>.json and updates the index.
+ * Returns the absolute path of the written receipt file.
+ */
+export declare function persistReviewReceipt(directory: string, receipt: ReviewReceipt): Promise<string>;
+/**
+ * Read a single receipt by ID. Returns null if not found or unreadable.
+ */
+export declare function readReceiptById(directory: string, receiptId: string): Promise<ReviewReceipt | null>;
+/**
+ * Read all receipts for a given scope hash (latest first).
+ * Useful for drift verification to find prior reviews of the same scope.
+ */
+export declare function readReceiptsByScopeHash(directory: string, scopeHash: string): Promise<ReviewReceipt[]>;
+/**
+ * Read all receipts from the index (all verdicts, latest first).
+ * Useful for drift verification context.
+ */
+export declare function readAllReceipts(directory: string): Promise<ReviewReceipt[]>;
+/**
+ * Build a RejectedReviewReceipt.
+ * `scopeContent` is hashed to produce the fingerprint.
+ */
+export declare function buildRejectedReceipt(opts: {
+    agent: string;
+    sessionId?: string;
+    scopeContent: string;
+    scopeDescription: string;
+    blockingFindings: BlockingFinding[];
+    evidenceReferences: string[];
+    passConditions: string[];
+    summary?: string;
+}): RejectedReviewReceipt;
+/**
+ * Build an ApprovedReviewReceipt.
+ * `scopeContent` is hashed to produce the fingerprint.
+ */
+export declare function buildApprovedReceipt(opts: {
+    agent: string;
+    sessionId?: string;
+    scopeContent: string;
+    scopeDescription: string;
+    checkedAspects: string[];
+    validatedClaims: string[];
+    caveats?: string[];
+}): ApprovedReviewReceipt;
+/**
+ * Build a structured context summary of prior receipts for critic drift
+ * verification. Returns a compact string that can be injected into context.
+ *
+ * Approved receipts that are scope-stale are flagged explicitly so the critic
+ * knows they are supporting evidence only, not proof of current state.
+ *
+ * @param receipts - Array of prior receipts (from readAllReceipts or readReceiptsByScopeHash)
+ * @param currentScopeContent - Optional current scope content for staleness check
+ * @param maxChars - Maximum output length (default 1000)
+ */
+export declare function buildReceiptContextForDrift(receipts: ReviewReceipt[], currentScopeContent?: string, maxChars?: number): string;

package/dist/hooks/scope-guard-throw-behavior.test.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Smoke test: documents the confirmed behavior that tool.execute.before hook
+ * throws propagate as tool rejection, not session crash.
+ *
+ * VERIFIED from src/hooks/guardrails.ts existing patterns:
+ *   - Loop circuit breaker (count >= 5): throw new Error('CIRCUIT BREAKER...')
+ *   - Full test suite block: throw new Error('BLOCKED: Full test suite...')
+ *   - Plan state violation: throw new Error('PLAN STATE VIOLATION...')
+ * All throw in toolBefore, and the plugin propagates as tool rejection.
+ *
+ * SAFE MECHANISM for scope-guard.ts:
+ *   throw new Error(`SCOPE VIOLATION: [agent] attempted to modify [file] not in task [id] scope`)
+ * This is the CORRECT blocking pattern. DO NOT use return-value signals.
+ */
+export {};

package/dist/hooks/scope-guard.adversarial.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hooks/scope-guard.d.ts

@@ -0,0 +1,43 @@
+/**
+ * SCOPE GUARD (v6.31 Task 3.1)
+ *
+ * CONFIRMED THROW MECHANISM: throwing in tool.execute.before propagates as tool rejection,
+ * NOT as session crash. Verified from guardrails.ts multiple existing throw sites.
+ * Safe blocking pattern: throw new Error(`SCOPE VIOLATION: ...`)
+ *
+ * Fires BEFORE write/edit tools execute. When a non-architect agent attempts to
+ * modify a file outside the declared task scope, blocks the call and injects an advisory.
+ */
+/**
+ * Configuration for scope guard behavior.
+ */
+export interface ScopeGuardConfig {
+    /** Whether scope guard is enabled (default: true) */
+    enabled: boolean;
+    /** Whether to skip in turbo mode (default: false — NOT skippable by design) */
+    skip_in_turbo: boolean;
+}
+/**
+ * Creates the scope-guard hook that blocks out-of-scope writes.
+ * @param config - ScopeGuardConfig (enabled, skip_in_turbo)
+ * @param _directory - The workspace directory (reserved for future use)
+ * @param injectAdvisory - Optional callback to push advisory to architect session
+ */
+export declare function createScopeGuardHook(config: Partial<ScopeGuardConfig>, directory: string, injectAdvisory?: (sessionId: string, message: string) => void): {
+    toolBefore: (input: {
+        tool: string;
+        sessionID: string;
+        callID: string;
+    }, output: {
+        args: unknown;
+    }) => Promise<void>;
+};
+/**
+ * Check if a file path is within declared scope entries.
+ * Handles exact match and directory containment.
+ *
+ * @param filePath - The file path to check
+ * @param scopeEntries - Array of declared scope entries (files or directories)
+ * @returns true if the file is within scope, false otherwise
+ */
+export declare function isFileInScope(filePath: string, scopeEntries: string[], directory?: string): boolean;

package/dist/hooks/scope-guard.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * scope-guard.test.ts
+ *
+ * Tests for scope-guard hook (Task 3.1):
+ * 1. Returns early (no throw) when guard is disabled (config.enabled = false)
+ * 2. Returns early when tool is not in WRITE_TOOLS set (e.g., 'read')
+ * 3. Returns early when session is the architect (agentName = 'Architect')
+ * 4. Returns early when declaredCoderScope is null (no scope declared)
+ * 5. Throws 'SCOPE VIOLATION' when non-architect writes file outside declared scope
+ * 6. Does NOT throw when non-architect writes file INSIDE declared scope
+ * 7. Sanitizes path with \r\n to prevent log injection (SEC-1 fix)
+ * 8. isFileInScope correctly handles exact match and directory containment
+ */
+export {};

package/dist/hooks/self-review.d.ts

@@ -0,0 +1,14 @@
+export interface SelfReviewConfig {
+    enabled: boolean;
+    skip_in_turbo: boolean;
+}
+export declare function createSelfReviewHook(config: Partial<SelfReviewConfig>, injectAdvisory: (sessionId: string, message: string) => void): {
+    toolAfter: (input: {
+        tool: string;
+        sessionID: string;
+        callID: string;
+    }, output: {
+        args?: Record<string, unknown>;
+        output?: unknown;
+    }) => Promise<void>;
+};