opencode-swarm 7.0.0-beta.1 → 7.0.0

package/dist/sbom/cyclonedx.d.ts

@@ -0,0 +1,101 @@
+/**
+ * CycloneDX SBOM Emitter
+ *
+ * Generates CycloneDX BOM format (v1.5 spec)
+ */
+import type { SbomComponent } from './detectors/index.js';
+import { type Ecosystem } from './detectors/index.js';
+/**
+ * CycloneDX Component
+ * Corresponds to a software dependency
+ */
+export interface CycloneDXComponent {
+    /** Component type */
+    type: 'library' | 'framework' | 'application';
+    /** Package name */
+    name: string;
+    /** Package version */
+    version: string;
+    /** Package URL (PURL) */
+    purl?: string;
+    /** License information */
+    licenses?: [{
+        license: {
+            id?: string;
+            name?: string;
+        };
+    }];
+}
+/**
+ * CycloneDX Metadata
+ */
+export interface CycloneDXMetadata {
+    /** ISO 8601 timestamp */
+    timestamp: string;
+    /** Tools used to create the BOM */
+    tools: [
+        {
+            /** Tool vendor */
+            vendor: string;
+            /** Tool name */
+            name: string;
+            /** Tool version */
+            version: string;
+        }
+    ];
+}
+/**
+ * CycloneDX BOM Document
+ * Conforms to CycloneDX v1.5 specification
+ */
+export interface CycloneDXBom {
+    /** BOM format identifier */
+    bomFormat: 'CycloneDX';
+    /** CycloneDX specification version */
+    specVersion: '1.5';
+    /** Incremental BOM version */
+    version: number;
+    /** BOM metadata */
+    metadata: CycloneDXMetadata;
+    /** List of components */
+    components: CycloneDXComponent[];
+}
+/**
+ * Options for generating CycloneDX BOM
+ */
+export interface CycloneDXOptions {
+    /** Custom tool name (default: 'sbom_generate') */
+    toolName?: string;
+    /** Custom tool version (default: '6.9.0') */
+    toolVersion?: string;
+    /** BOM version number (default: 1) */
+    bomVersion?: number;
+}
+/**
+ * Generate a CycloneDX BOM from SBOM components
+ *
+ * @param components - List of SBOM components
+ * @param options - Optional configuration
+ * @returns CycloneDX BOM object
+ */
+export declare function generateCycloneDX(components: SbomComponent[], options?: CycloneDXOptions): CycloneDXBom;
+/**
+ * Serialize a CycloneDX BOM to a JSON string
+ *
+ * @param bom - CycloneDX BOM object
+ * @returns JSON string representation
+ */
+export declare function serializeCycloneDX(bom: CycloneDXBom): string;
+/**
+ * Generate PURL for a component based on its ecosystem
+ * This is a convenience function that can be used externally
+ *
+ * @param ecosystem - The package ecosystem
+ * @param name - Package name
+ * @param version - Package version
+ * @param namespace - Optional namespace (for golang, maven, swift)
+ * @returns Package URL
+ */
+export declare function generateComponentPurl(ecosystem: Ecosystem, name: string, version: string, namespace?: string): string;
+export type { Ecosystem, SbomComponent } from './detectors/index.js';
+export { generatePurl } from './detectors/index.js';

package/dist/sbom/detectors/dart.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Dart/Flutter Detector
+ *
+ * Supports: pubspec.yaml, pubspec.lock
+ */
+import type { Detector } from './index.js';
+export declare const dartDetectors: Detector[];

package/dist/sbom/detectors/dotnet.d.ts

@@ -0,0 +1,7 @@
+/**
+ * .NET Detector
+ *
+ * Supports: packages.lock.json, paket.lock
+ */
+import type { Detector } from './index.js';
+export declare const dotnetDetectors: Detector[];

package/dist/sbom/detectors/go.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Go Detector
+ *
+ * Supports: go.mod, go.sum
+ */
+import type { Detector } from './index.js';
+export declare const goDetectors: Detector[];

package/dist/sbom/detectors/index.d.ts

@@ -0,0 +1,53 @@
+/**
+ * SBOM Detector Registry and Common Types
+ *
+ * Provides detectors for extracting dependency information from
+ * manifest and lock files across 8 ecosystems.
+ */
+export interface SbomComponent {
+    /** Package name */
+    name: string;
+    /** Package version */
+    version: string;
+    /** Component type */
+    type: 'library' | 'framework' | 'application';
+    /** Package URL (PURL) per SPDX spec */
+    purl?: string;
+    /** Detected license (best effort) */
+    license?: string;
+}
+/** Detector interface for parsing manifest/lock files */
+export interface Detector {
+    /** Human-readable detector name */
+    name: string;
+    /** File glob patterns this detector handles */
+    patterns: string[];
+    /** Parse a file and extract components */
+    detect: (filePath: string, content: string) => SbomComponent[];
+}
+/** Ecosystem identifiers */
+export type Ecosystem = 'npm' | 'pypi' | 'cargo' | 'golang' | 'maven' | 'nuget' | 'swift' | 'pub';
+/** Map of ecosystem to its detectors */
+export interface EcosystemDetector {
+    ecosystem: Ecosystem;
+    detectors: Detector[];
+}
+/**
+ * Generate a Package URL (PURL) per SPDX specification
+ * Format: pkg:<type>/<namespace>/<name>@<version>
+ */
+export declare function generatePurl(ecosystem: Ecosystem, name: string, version: string, namespace?: string): string;
+/**
+ * Detect ecosystem from file path
+ */
+export declare function detectEcosystemFromPath(filePath: string): Ecosystem | null;
+/** All registered detectors */
+export declare const allDetectors: Detector[];
+/**
+ * Find detectors matching a file path
+ */
+export declare function findDetectorsForFile(filePath: string): Detector[];
+/**
+ * Detect components from a file using appropriate detectors
+ */
+export declare function detectComponents(filePath: string, content: string): SbomComponent[];

package/dist/sbom/detectors/java.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Java Detector
+ *
+ * Supports: pom.xml, gradle.lockfile
+ */
+import type { Detector } from './index.js';
+export declare const javaDetectors: Detector[];

package/dist/sbom/detectors/nodejs.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Node.js Detector
+ *
+ * Supports: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml
+ */
+import type { Detector } from './index.js';
+export declare const nodejsDetectors: Detector[];

package/dist/sbom/detectors/python.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Python Detector
+ *
+ * Supports: requirements.txt, poetry.lock, Pipfile.lock
+ */
+import type { Detector } from './index.js';
+export declare const pythonDetectors: Detector[];

package/dist/sbom/detectors/rust.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Rust Detector
+ *
+ * Supports: Cargo.toml, Cargo.lock
+ */
+import type { Detector } from './index.js';
+export declare const rustDetectors: Detector[];

package/dist/sbom/detectors/swift.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Swift Detector
+ *
+ * Supports: Package.resolved
+ */
+import type { Detector } from './index.js';
+export declare const swiftDetectors: Detector[];

package/dist/scope/scope-persistence.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Scope persistence for #519 (v6.71.1 hotfix).
+ *
+ * Persists declared coder scope to `.swarm/scopes/scope-{taskId}.json` so that
+ * scope survives cross-process delegation — in-memory `session.declaredCoderScope`
+ * is lost when a coder session starts in a separate process (#496 root cause B).
+ *
+ * Also exposes a fallback reader that reads `plan.json:phases[].tasks[].files_touched`
+ * for the active task, so architect-authored plans become a durable scope source
+ * even when `declare_scope` was never called (#496 root cause C mitigation).
+ *
+ * Read/write contract:
+ *   - Atomic write via temp + rename (POSIX atomic on same filesystem).
+ *   - File lock via proper-lockfile while writing.
+ *   - Schema versioning: readers fail closed on unknown version.
+ *   - TTL: default 24h from declaredAt; expired scopes return null.
+ *   - Symlink guards (defence in depth):
+ *       * realpath containment check on `.swarm/scopes/` (closes parent-dir attack)
+ *       * O_NOFOLLOW on both write-create and read-fd (closes leaf-file TOCTOU)
+ *       * taskId-in-file must match the filename (closes cross-pollination)
+ *       * declaredAt must be <= now (closes future-timestamp attack)
+ *       * files array capped at MAX_FILES_PER_SCOPE (DoS cap)
+ *       * plan.json size capped at MAX_PLAN_BYTES (DoS cap)
+ *       * Windows reserved device names rejected (CON, NUL, LPT1, …)
+ *
+ * RESIDUAL RISKS — explicitly accepted (#520 tracks full syscall-layer remediation):
+ *   1. Bash / interpreter writes bypass the tool-layer authority check. This
+ *      module does not protect against a coder process running `sed -i`,
+ *      `echo >`, `python -c`, etc. Mitigation is prompt-only (see coder.ts
+ *      WRITE BLOCKED PROTOCOL) until #520 lands.
+ *   2. Platform-portability of symlink guards:
+ *        - realpath resolves POSIX symlinks and Windows junctions, but the
+ *          Windows behaviour is not covered by CI (Linux-only test matrix).
+ *        - O_NOFOLLOW is a no-op on Windows (falls back to 0). The realpath
+ *          containment check on `.swarm/scopes/` remains the primary guard
+ *          on that platform; leaf-file TOCTOU on Windows is not closed.
+ *   3. Stale lockfile DoS: a crashed writer leaves a lock for up to
+ *      LOCK_STALE_MS (30s). During that window, concurrent `declare_scope`
+ *      calls fail silently and the architect relies on in-memory state.
+ *      Acceptable because in-memory state remains authoritative inside the
+ *      live process; disk is a fallback.
+ *   4. Temp-file leak: a crash between `Bun.write(tmp)` and `renameSync`
+ *      leaves `scope-{id}.json.tmp.{ts}.{rand}` files. No sweeper runs today;
+ *      accumulation is bounded by `/swarm close` (which rm -rf's .swarm/scopes/).
+ *
+ * NOT a security boundary. Bash remains unguarded at the write-authority layer.
+ * The durable fix lives at the syscall layer (#520). This module closes the
+ * cross-process gap and the plan-as-scope gap, both of which are mitigations.
+ */
+declare const SCOPE_SCHEMA_VERSION: 1;
+export interface PersistedScope {
+    version: typeof SCOPE_SCHEMA_VERSION;
+    taskId: string;
+    declaredAt: number;
+    expiresAt: number;
+    files: string[];
+}
+/**
+ * Write declared scope to `.swarm/scopes/scope-{taskId}.json` atomically.
+ * Safe to call concurrently — proper-lockfile serialises writers per-file.
+ *
+ * Silent on I/O failure: scope persistence is a defense-in-depth layer, not a
+ * hard requirement. In-memory state remains authoritative for the live process.
+ */
+export declare function writeScopeToDisk(directory: string, taskId: string, files: string[], ttlMs?: number): Promise<void>;
+/**
+ * Read persisted scope for a task. Returns null on:
+ *   - file missing
+ *   - file is a symlink (lstat guard — prevents hostile repo pre-seeding)
+ *   - unknown schema version (fail-closed)
+ *   - expired TTL
+ *   - malformed JSON
+ *   - invalid taskId
+ */
+export declare function readScopeFromDisk(directory: string, taskId: string): string[] | null;
+/**
+ * Read declared scope for a task from `.swarm/plan.json:phases[].tasks[].files_touched`.
+ * Mirrors the logic in src/hooks/diff-scope.ts:15-47 but kept independent so a
+ * future diff-scope refactor doesn't ripple into authority-layer reads.
+ *
+ * Returns null on missing plan, task not found, no files_touched, or parse error.
+ */
+export declare function readPlanScope(directory: string, taskId: string): string[] | null;
+/**
+ * Remove scope file for a single task. Called when a task transitions to
+ * completed/closed so stale scope doesn't leak into later tasks with the same id.
+ */
+export declare function clearScopeForTask(directory: string, taskId: string): void;
+/**
+ * Remove the entire `.swarm/scopes/` directory. Called by /swarm close so the
+ * next session starts without inherited scope.
+ */
+export declare function clearAllScopes(directory: string): void;
+/**
+ * Resolve scope for a task with the full fallback chain:
+ *   1. in-memory session.declaredCoderScope (fast path; live process)
+ *   2. `.swarm/scopes/scope-{taskId}.json` (cross-process durable)
+ *   3. `.swarm/plan.json:phases[].tasks[].files_touched` (architect-authored)
+ *   4. caller-supplied pending-map fallback (delegation-gate module map)
+ *
+ * Any null/empty result falls through to the next layer. First non-empty wins.
+ */
+export declare function resolveScopeWithFallbacks(input: {
+    directory: string;
+    taskId: string | null | undefined;
+    inMemoryScope: string[] | null | undefined;
+    pendingMapScope: string[] | null | undefined;
+}): string[] | null;
+export {};

package/dist/scope/scope-persistence.test.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Tests for scope-persistence (#519 v6.71.1).
+ *
+ * Covers:
+ *   - Atomic write + read round-trip
+ *   - Schema-version fail-closed on unknown version
+ *   - TTL expiry returns null
+ *   - lstat symlink guard
+ *   - Plan.json fallback (files_touched) for active task
+ *   - Resolve chain order: memory → disk → plan.json → pending-map
+ *   - Invalid taskId rejection
+ */
+export {};

package/dist/services/compaction-service.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Compaction service — monitors context budget and triggers graduated compaction
+ * when usage crosses configured thresholds.
+ *
+ * Three tiers (all thresholds as percentages 0-100):
+ *  - Observation (default 40%): summarise older turns, preserve key decisions
+ *  - Reflection  (default 60%): re-summarise into tighter format
+ *  - Emergency   (default 80%): hard truncation to system + current task + last N turns
+ *
+ * Consumes `swarmState.lastBudgetPct` (set by system-enhancer.ts after each budget calc).
+ * Never throws. Advisory system message injection via callback.
+ */
+import type { CompactionConfig } from '../config/schema';
+export type { CompactionConfig };
+export interface CompactionServiceHook {
+    toolAfter: (input: {
+        tool: string;
+        sessionID: string;
+    }, output: {
+        output?: unknown;
+    }) => Promise<void>;
+}
+export declare function createCompactionService(config: CompactionConfig, directory: string, injectMessage: (sessionId: string, message: string) => void): CompactionServiceHook;
+export declare function getCompactionMetrics(sessionId?: string): {
+    compactionCount: number;
+    lastSnapshotAt: string | null;
+};
+export declare function resetCompactionState(sessionId?: string): void;

package/dist/services/compaction-service.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/config-doctor.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Config Doctor Service
+ *
+ * Validates opencode-swarm config shape, detects stale/invalid settings,
+ * classifies findings by severity, and proposes safe auto-fixes.
+ */
+import type { PluginConfig } from '../config/schema';
+/** Severity levels for config findings */
+export type FindingSeverity = 'info' | 'warn' | 'error';
+/** A single config finding */
+export interface ConfigFinding {
+    /** Unique identifier for this finding type */
+    id: string;
+    /** Human-readable title */
+    title: string;
+    /** Detailed description */
+    description: string;
+    /** Severity level */
+    severity: FindingSeverity;
+    /** Path to the config key (dot notation) */
+    path: string;
+    /** Current invalid/stale value */
+    currentValue?: unknown;
+    /** Proposed safe fix (if available) */
+    proposedFix?: ConfigFix;
+    /** Whether this is auto-fixable (safe, non-destructive) */
+    autoFixable: boolean;
+}
+/** A proposed config fix */
+export interface ConfigFix {
+    /** Type of fix */
+    type: 'remove' | 'update' | 'add';
+    /** Path to the config key (dot notation) */
+    path: string;
+    /** Value to set (for update/add) */
+    value?: unknown;
+    /** Description of what the fix does */
+    description: string;
+    /** Risk level - only 'low' is auto-fixable */
+    risk: 'low' | 'medium' | 'high';
+}
+/** Result of running the config doctor */
+export interface ConfigDoctorResult {
+    /** All findings from the doctor run */
+    findings: ConfigFinding[];
+    /** Findings by severity */
+    summary: {
+        info: number;
+        warn: number;
+        error: number;
+    };
+    /** Whether any auto-fixable issues were found */
+    hasAutoFixableIssues: boolean;
+    /** Timestamp of the run */
+    timestamp: number;
+    /** The config that was analyzed */
+    configSource: string;
+}
+/** Backup artifact for rollback */
+export interface ConfigBackup {
+    /** When the backup was created */
+    createdAt: number;
+    /** The backed up config content */
+    configPath: string;
+    /** The raw config content */
+    content: string;
+    /** Hash of content for integrity verification */
+    contentHash: string;
+}
+/**
+ * Get config file paths
+ */
+export declare function getConfigPaths(directory: string): {
+    userConfigPath: string;
+    projectConfigPath: string;
+};
+/**
+ * Create a backup of the current config
+ */
+export declare function createConfigBackup(directory: string): ConfigBackup | null;
+/**
+ * Write a backup artifact to .swarm directory
+ * Persists full backup content to support rollback/restore
+ */
+export declare function writeBackupArtifact(directory: string, backup: ConfigBackup): string;
+/**
+ * Restore config from a backup artifact
+ * @param backupPath - Path to the backup artifact file
+ * @param directory - The working directory (for validating config paths)
+ * @returns the path to the restored config file, or null if restore failed
+ */
+export declare function restoreFromBackup(backupPath: string, directory: string): string | null;
+/**
+ * Run the config doctor on a loaded config
+ */
+export declare function runConfigDoctor(config: PluginConfig, directory: string): ConfigDoctorResult;
+/**
+ * Apply safe auto-fixes to config
+ * Only applies low-risk, non-destructive fixes
+ */
+export declare function applySafeAutoFixes(directory: string, result: ConfigDoctorResult): {
+    appliedFixes: ConfigFix[];
+    updatedConfigPath: string | null;
+};
+/**
+ * Write doctor result to .swarm directory for GUI consumption
+ */
+export declare function writeDoctorArtifact(directory: string, result: ConfigDoctorResult): string;
+/**
+ * Check if config doctor should run on startup
+ */
+export declare function shouldRunOnStartup(automationConfig: {
+    mode: string;
+    capabilities?: Record<string, boolean>;
+} | undefined): boolean;
+/**
+ * Full config doctor run with backup and fix application
+ */
+export declare function runConfigDoctorWithFixes(directory: string, config: PluginConfig, autoFix?: boolean): Promise<{
+    result: ConfigDoctorResult;
+    backupPath: string | null;
+    appliedFixes: ConfigFix[];
+    updatedConfigPath: string | null;
+    artifactPath: string | null;
+}>;

package/dist/services/config-doctor.security.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/config-doctor.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/context-budget-service.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Context Budget Service
+ *
+ * Provides context budget monitoring for swarm sessions.
+ * Tracks token usage across all context components and provides
+ * warnings when approaching budget limits.
+ */
+/**
+ * Context budget report with detailed token breakdown
+ */
+export interface ContextBudgetReport {
+    /** ISO timestamp when the report was generated */
+    timestamp: string;
+    /** Tokens used for the assembled system prompt */
+    systemPromptTokens: number;
+    /** Tokens used for the plan cursor */
+    planCursorTokens: number;
+    /** Tokens used for knowledge entries */
+    knowledgeTokens: number;
+    /** Tokens used for run memory */
+    runMemoryTokens: number;
+    /** Tokens used for handoff content */
+    handoffTokens: number;
+    /** Tokens used for context.md */
+    contextMdTokens: number;
+    /** Total swarm context tokens (sum of all components) */
+    swarmTotalTokens: number;
+    /** Estimated number of turns in this session */
+    estimatedTurnCount: number;
+    /** Estimated total tokens for the session */
+    estimatedSessionTokens: number;
+    /** Budget usage percentage */
+    budgetPct: number;
+    /** Current budget status */
+    status: 'ok' | 'warning' | 'critical';
+    /** Recommendation message if any */
+    recommendation: string | null;
+}
+/**
+ * Configuration for context budget monitoring
+ */
+export interface ContextBudgetConfig {
+    /** Enable or disable budget monitoring */
+    enabled: boolean;
+    /** Maximum token budget (default: 40000) */
+    budgetTokens: number;
+    /** Warning threshold percentage (default: 70) */
+    warningPct: number;
+    /** Critical threshold percentage (default: 90) */
+    criticalPct: number;
+    /** Warning mode: 'once', 'every', or 'interval' */
+    warningMode: 'once' | 'every' | 'interval';
+    /** Interval for warning mode (default: 20 turns) */
+    warningIntervalTurns: number;
+}
+/**
+ * Budget state for tracking warning suppression
+ */
+export interface BudgetState {
+    /** Turn number when warning was last fired */
+    warningFiredAtTurn: number | null;
+    /** Turn number when critical was last fired */
+    criticalFiredAtTurn: number | null;
+    /** Turn number when context was last injected */
+    lastInjectedAtTurn: number | null;
+}
+/**
+ * Default context budget configuration
+ */
+export declare const DEFAULT_CONTEXT_BUDGET_CONFIG: ContextBudgetConfig;
+/**
+ * Estimate token count for text using character-based approximation
+ *
+ * @param text - The text to estimate tokens for
+ * @returns Estimated token count (ceiling of chars / 3.5)
+ */
+export declare function estimateTokens(text: string): number;
+/**
+ * Get context budget report with detailed token breakdown
+ *
+ * @param directory - The swarm workspace directory
+ * @param assembledSystemPrompt - The fully assembled system prompt
+ * @param config - Budget configuration
+ * @returns Context budget report
+ */
+export declare function getContextBudgetReport(directory: string, assembledSystemPrompt: string, config: ContextBudgetConfig): Promise<ContextBudgetReport>;
+/**
+ * Format budget warning message based on report
+ *
+ * @param report - The context budget report
+ * @param directory - Directory for state persistence (required for suppression logic)
+ * @param config - Budget configuration for warning mode settings
+ * @returns Warning message string or null if suppressed/ok
+ */
+export declare function formatBudgetWarning(report: ContextBudgetReport, directory: string, config: ContextBudgetConfig): Promise<string | null>;
+/**
+ * Get default context budget config
+ *
+ * @returns Default configuration
+ */
+export declare function getDefaultConfig(): ContextBudgetConfig;