opencode-swarm 7.112.2 → 7.113.0

package/dist/cli/{index-w84stmkx.js → index-r9fjzr3k.js}

@@ -2,7 +2,7 @@
 import {
   redactPath,
   redactShellCommand
-} from "./index-npxmfj48.js";
+} from "./index-8f256d7t.js";
 
 // src/services/guardrail-log-service.ts
 import * as fs from "fs/promises";

package/dist/cli/{index-9fjpecax.js → index-v96kmbkw.js}

@@ -12,14 +12,14 @@ import {
   detectPosixWrites,
   detectWindowsWrites,
   resolveWriteTargets
-} from "./index-snmfqhez.js";
+} from "./index-bsvwnzh7.js";
 import {
   checkFileAuthority,
   classifyFile,
   isInDeclaredScope,
   redactPath,
   redactShellCommand
-} from "./index-npxmfj48.js";
+} from "./index-8f256d7t.js";
 
 // src/services/guardrail-explain-service.ts
 import path from "path";

package/dist/cli/index.js

@@ -7,18 +7,18 @@ import {
   getPluginLockFilePaths,
   package_default,
   resolveCommand
-} from "./index-snmfqhez.js";
-import"./index-npxmfj48.js";
+} from "./index-bsvwnzh7.js";
+import"./index-8f256d7t.js";
 import"./index-c8s9a3zh.js";
-import"./index-xehrmy76.js";
+import"./index-0gf6de8b.js";
 import {
   DEFAULT_AGENT_CONFIGS
-} from "./index-cq2hgvd2.js";
+} from "./index-1ey3dxq7.js";
 import"./index-d0w40jm3.js";
 import"./index-scww5b77.js";
 import"./index-9fxs0rm1.js";
 import"./index-q1jaeynn.js";
-import"./index-82v0d72f.js";
+import"./index-h88ktb5r.js";
 import"./index-30ejh1tx.js";
 import"./index-t6wfwdm1.js";
 import"./index-hpp2r0sd.js";

package/dist/cli/{schema-2p15yrvn.js → schema-qb313fyy.js}

@@ -86,7 +86,7 @@ import {
   resolveGeneratedAgentRole,
   resolveGuardrailsConfig,
   stripKnownSwarmPrefix
-} from "./index-cq2hgvd2.js";
+} from "./index-1ey3dxq7.js";
 import"./index-bfwt3abw.js";
 import"./index-p0arc26j.js";
 import"./index-293f68mj.js";

package/dist/cli/{skill-generator-fe6q8xgm.js → skill-generator-0my4jrx6.js}

@@ -33,7 +33,7 @@ import {
   sanitizeSlug,
   selectCandidateEntries,
   writeEvalStub
-} from "./index-82v0d72f.js";
+} from "./index-h88ktb5r.js";
 import"./index-30ejh1tx.js";
 import"./index-hpp2r0sd.js";
 import"./index-32bx4kch.js";

package/dist/commands/loop.d.ts

@@ -3,7 +3,7 @@
  *
  * Sanitizes the objective input, parses flags, and emits a [MODE: LOOP ...]
  * signal. The architect picks up the signal and loads
- * `.opencode/skills/loop/SKILL.md`, which runs the compound-engineering loop:
+ * `.swarm/bundled-skills/loop/SKILL.md`, which runs the compound-engineering loop:
  * brainstorm → plan → build → review → improve, iterating under
  * defense-in-depth stop conditions until the objective is met or a budget is
  * exhausted.

package/dist/commands/registry.d.ts

@@ -477,7 +477,7 @@ export declare const COMMAND_REGISTRY: {
         readonly handler: (ctx: CommandContext) => CommandResult;
         readonly description: "Enter architect MODE: LOOP — compound-engineering loop: brainstorm → plan → build → review → improve, iterating until done [objective]";
         readonly args: "<objective> [--max-cycles 1..5] [--autonomy checkpoint|auto] [--depth standard|exhaustive] [--resume]";
-        readonly details: "Triggers the architect to run the compound-engineering loop defined in .opencode/skills/loop/SKILL.md: BRAINSTORM (requirements) → PLAN (+ critic gate) → BUILD (execute) → REVIEW (independent reviewer + critic on the diff, report-only) → IMPROVE (phase-wrap retrospective + compounding learning capture), then evaluate stop conditions and loop for another improvement cycle if the objective is unmet and budget remains. Generator and reviewer/critic run in separate contexts; failing assertions must be fixed at the root cause, never weakened, mocked, or skipped. Defense-in-depth stop conditions: objective met, --max-cycles budget (default 3), no-progress/plateau, oscillation, unrecoverable error, or explicit user stop. --autonomy auto (default) runs unattended with hard stops still enforced; --autonomy checkpoint pauses at phase gates for user approval. --depth exhaustive widens exploration. --resume continues an existing loop run from durable .swarm/loop/ state. Distinct from full-auto (autonomous cross-phase oversight) and turbo (parallel lanes within a phase): loop is a user-initiated, gated, compounding workflow.";
+        readonly details: "Triggers the architect to run the compound-engineering loop defined in .swarm/bundled-skills/loop/SKILL.md: BRAINSTORM (requirements) → PLAN (+ critic gate) → BUILD (execute) → REVIEW (independent reviewer + critic on the diff, report-only) → IMPROVE (phase-wrap retrospective + compounding learning capture), then evaluate stop conditions and loop for another improvement cycle if the objective is unmet and budget remains. Generator and reviewer/critic run in separate contexts; failing assertions must be fixed at the root cause, never weakened, mocked, or skipped. Defense-in-depth stop conditions: objective met, --max-cycles budget (default 3), no-progress/plateau, oscillation, unrecoverable error, or explicit user stop. --autonomy auto (default) runs unattended with hard stops still enforced; --autonomy checkpoint pauses at phase gates for user approval. --depth exhaustive widens exploration. --resume continues an existing loop run from durable .swarm/loop/ state. Distinct from full-auto (autonomous cross-phase oversight) and turbo (parallel lanes within a phase): loop is a user-initiated, gated, compounding workflow.";
         readonly category: "agent";
         readonly toolPolicy: "none";
     };

package/dist/config/bundled-skills.d.ts

@@ -1,4 +1,12 @@
-export declare const BUNDLED_PROJECT_SKILLS: readonly ["brainstorm", "specify", "clarify-spec", "resume", "clarify", "discover", "consult", "pre-phase-briefing", "council", "deep-dive", "deep-research", "codebase-review-swarm", "swarm-implement", "design-docs", "swarm-pr-review", "swarm", "swarm-pr-feedback", "swarm-pr-subscribe", "swarm-ci-monitor", "issue-ingest", "plan", "critic-gate", "execute", "phase-wrap", "loop", "writing-tests", "running-tests", "engineering-conventions", "commit-pr", "ci-failure-batching", "gate-attribution", "merge-queue-readiness", "skill-edit-validation", "worktree-retry-cleanup"];
+export declare const BUNDLED_PROJECT_SKILLS: readonly ["brainstorm", "specify", "clarify-spec", "resume", "clarify", "discover", "consult", "pre-phase-briefing", "council", "deep-dive", "deep-research", "codebase-review-swarm", "swarm-implement", "design-docs", "swarm-pr-review", "swarm", "swarm-pr-feedback", "swarm-pr-subscribe", "swarm-ci-monitor", "issue-ingest", "plan", "critic-gate", "execute", "phase-wrap", "loop", "writing-tests", "running-tests", "engineering-conventions", "commit-pr", "ci-failure-batching", "gate-attribution", "merge-queue-readiness", "skill-edit-validation", "worktree-retry-cleanup", "test-file-split", "fork-pr-operations", "parallel-work-check", "ci-fix-monitor"];
+export type BundledProjectSkill = (typeof BUNDLED_PROJECT_SKILLS)[number];
+/**
+ * Project-private runtime location for plugin-owned skills. Repository-native
+ * skill roots (`.opencode/skills`, `.claude/skills`, and `.agents/skills`) are
+ * user-owned and must never be used as materialization destinations.
+ */
+export declare const BUNDLED_PROJECT_SKILL_ROOT = ".swarm/bundled-skills";
+export declare function bundledProjectSkillFileReference(slug: BundledProjectSkill): string;
 interface CopyState {
     files: number;
     bytes: number;
@@ -7,10 +15,11 @@ interface BundledSkillFile {
     relativePath: string;
 }
 declare function collectBundledSkillFilesBoundedAsync(sourceDir: string, state: CopyState, relativeDir?: string): Promise<BundledSkillFile[]>;
+declare function copyBundledDirectoryBoundedAsync(sourceDir: string, destDir: string): Promise<void>;
 /**
- * Materialize missing built-in mode skills into the target project so architect
- * MODE dispatch can load SKILL.md files in repositories that do not already
- * vendor the latest opencode-swarm skill tree.
+ * Materialize built-in mode skills into the target project's private runtime
+ * tree so architect MODE dispatch never collides with repository-owned skills
+ * that happen to use the same slug.
  *
  * Async, bounded, and fail-open: safe to `await withTimeout(...)` on the
  * plugin-init path (AGENTS.md Invariant 1). Runs at plugin init so the
@@ -24,6 +33,7 @@ declare function collectBundledSkillFilesBoundedAsync(sourceDir: string, state:
 export declare function syncBundledProjectSkillsIfMissingAsync(projectDirectory: string, packageRoot: string, quiet?: boolean): Promise<void>;
 export declare const _test_exports: {
     collectBundledSkillFilesBoundedAsync: typeof collectBundledSkillFilesBoundedAsync;
-    resetBundledProjectSkillSyncCache: () => undefined;
+    copyBundledDirectoryBoundedAsync: typeof copyBundledDirectoryBoundedAsync;
+    resetBundledProjectSkillSyncCache: () => void;
 };
 export {};

package/dist/config/schema.d.ts

@@ -818,6 +818,7 @@ export type KnowledgeApplicationConfig = z.infer<typeof KnowledgeApplicationConf
 export declare const SkillPropagationConfigSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     enforce: z.ZodDefault<z.ZodBoolean>;
+    audiences: z.ZodDefault<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
 }, z.core.$strip>;
 export type SkillPropagationConfig = z.infer<typeof SkillPropagationConfigSchema>;
 export declare const SkillImproverConfigSchema: z.ZodObject<{
@@ -2110,6 +2111,7 @@ export declare const PluginConfigSchema: z.ZodObject<{
     skillPropagation: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         enforce: z.ZodDefault<z.ZodBoolean>;
+        audiences: z.ZodDefault<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
     }, z.core.$strip>>;
     skill_improver: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;

package/dist/hooks/skill-propagation-gate.d.ts

@@ -8,9 +8,10 @@
  *      tool to a skill-capable agent (coder, reviewer, test_engineer, sme,
  *      docs, designer) and the SKILLS field is missing or "none" while
  *      skills exist in the project, appends a warning event to
- *      `.swarm/events.jsonl`. This is a SOFT WARNING — it NEVER blocks
- *      tool execution. Also records skill delegation entries to
- *      `.swarm/skill-usage.jsonl` for auditability.
+ *      `.swarm/events.jsonl`. Missing skills are a soft warning by default;
+ *      malformed, escaping, unreadable, or audience-ineligible explicit
+ *      `SKILLS:` references always block. Also records skill delegation entries
+ *      to `.swarm/skill-usage.jsonl` for auditability.
  *
  *   2. `experimental.chat.messages.transform` — scans reviewer output
  *      for SKILL_COMPLIANCE verdicts and records compliance outcomes
@@ -18,7 +19,7 @@
  */
 import * as fs from 'node:fs';
 import type { MessageWithParts } from './knowledge-types.js';
-import { computeSkillRelevanceScore, formatSkillIndexWithContext, readSkillMetadata } from './skill-scoring.js';
+import { computeSkillRelevanceScore, formatSkillIndexWithContext, readSkillMetadata, type SkillAudienceContext, type SkillMetadata } from './skill-scoring.js';
 import { appendSkillUsageEntry, readSkillUsageEntries, readSkillUsageEntriesTail } from './skill-usage-log.js';
 /**
  * Load routing skills from .opencode/skill-routing.yaml for a target agent.
@@ -43,11 +44,14 @@ export interface SkillPropagationConfig {
     enabled: boolean;
     /** When true, blocks delegations missing SKILLS field instead of warning. */
     enforce?: boolean;
+    /** Project/domain audience tokens accepted by this repository. */
+    audiences?: readonly string[];
 }
 export declare const _internals: {
     readdirSync: typeof fs.readdirSync;
     existsSync: typeof fs.existsSync;
     statSync: typeof fs.statSync;
+    realpathSync: typeof fs.realpathSync;
     mkdirSync: typeof fs.mkdirSync;
     appendFileSync: typeof fs.appendFileSync;
     readFileSync: typeof fs.readFileSync;
@@ -63,6 +67,8 @@ export declare const _internals: {
     readSkillUsageEntries: typeof readSkillUsageEntries;
     readSkillUsageEntriesTail: typeof readSkillUsageEntriesTail;
     parseSkillPaths: typeof parseSkillPaths;
+    extractFileSkillReferences: typeof extractFileSkillReferences;
+    validateSkillReference: typeof validateSkillReference;
     extractTaskIdFromPrompt: typeof extractTaskIdFromPrompt;
     extractSkillsFieldFromPrompt: typeof extractSkillsFieldFromPrompt;
     computeSkillRelevanceScore: typeof computeSkillRelevanceScore;
@@ -106,6 +112,39 @@ export declare function writeWarnEvent(directory: string, record: Record<string,
  * Returns empty array for empty, "none", or unparseable values.
  */
 export declare function parseSkillPaths(fieldValue: string): string[];
+/** Return only authoritative file references; all other content is inline. */
+export declare function extractFileSkillReferences(fieldValue: string): string[];
+/** Bound synchronous filesystem validation driven by model-authored fields. */
+export declare const MAX_EXPLICIT_SKILL_REFERENCES = 16;
+export declare const MAX_PROVENANCE_SKILL_REFERENCES_PER_TRANSFORM = 64;
+interface SkillReferenceValidation {
+    valid: boolean;
+    reason: string | null;
+    skillPath?: string;
+    metadata?: SkillMetadata;
+}
+/** Build the OpenCode plugin's active audience context. */
+export declare function resolveSkillAudienceContext(config: SkillPropagationConfig): SkillAudienceContext;
+/**
+ * Validate a repo-relative skill reference without trusting its frontmatter.
+ * Explicit and discovered loads require a real, readable SKILL.md. Legacy
+ * frontmatter-less skills remain compatible and have match-all audience;
+ * malformed or unreadable frontmatter fails closed.
+ */
+export declare function validateSkillReference(directory: string, reference: string, context: SkillAudienceContext, options: {
+    enforceAudience: boolean;
+    requireFilePrefix?: boolean;
+}): SkillReferenceValidation;
+/**
+ * Mandatory explicit-reference integrity gate. This is intentionally separate
+ * from optional recommendation/scoring behavior and must run even when
+ * `skillPropagation.enabled` is false.
+ */
+export declare function validateExplicitSkillReferencesBefore(directory: string, input: SkillGateInput, config: SkillPropagationConfig): Promise<{
+    blocked: boolean;
+    reason: string | null;
+    validatedSkillPaths?: string[];
+}>;
 /**
  * Extract a task ID from a delegation prompt string.
  * Looks for patterns like "taskId: <id>" or "TASK: <id>" (case-insensitive).
@@ -146,4 +185,5 @@ export declare function skillPropagationGateBefore(directory: string, input: Ski
  */
 export declare function skillPropagationTransformScan(directory: string, output: {
     messages?: MessageWithParts[];
-}, sessionID?: string): Promise<void>;
+}, sessionID?: string, config?: SkillPropagationConfig): Promise<void>;
+export {};

package/dist/hooks/skill-scoring.d.ts

@@ -33,10 +33,23 @@ export interface SkillStats {
         count: number;
     }>;
 }
+export type SkillRunner = 'opencode' | 'claude' | 'codex';
+/** Parsed state of an explicit (or absent) top-level audience declaration. */
+export interface SkillAudienceMetadata {
+    status: 'absent' | 'valid' | 'invalid';
+    values: string[];
+}
+/** Active runner and project-domain audiences accepted by a skill loader. */
+export interface SkillAudienceContext {
+    runner: SkillRunner;
+    audiences: readonly string[];
+}
 /** Metadata extracted from a SKILL.md frontmatter block. */
 export interface SkillMetadata {
     /** Repo-relative path to the skill file. */
     path: string;
+    /** Whether frontmatter was readable and structurally present. */
+    frontmatterStatus?: 'valid' | 'absent' | 'invalid' | 'unavailable';
     /** Human-readable skill name. */
     name: string;
     /** Short description from frontmatter, or a fallback when absent. */
@@ -45,6 +58,8 @@ export interface SkillMetadata {
     skillType?: 'directive' | 'workflow';
     /** Literal trigger phrases from frontmatter. */
     triggers?: string[];
+    /** Bounded, top-level audience declaration and its parse status. */
+    audience?: SkillAudienceMetadata;
 }
 export declare const _internals: {
     computeSkillRelevanceScore: typeof computeSkillRelevanceScore;
@@ -63,6 +78,12 @@ export declare const _internals: {
  * E.g. `.claude/skills/writing-tests/SKILL.md` → `writing-tests`
  */
 declare function extractSkillName(skillPath: string): string;
+/**
+ * Match parsed skill audience metadata against the active project and runner.
+ * Domain tokens are ORed with domains, runner tokens are ORed with runners,
+ * and the two dimensions are ANDed together.
+ */
+export declare function isSkillAudienceMatch(metadata: Pick<SkillMetadata, 'audience'>, context: SkillAudienceContext): boolean;
 /**
  * Parse the YAML-like frontmatter from a SKILL.md file. This intentionally
  * supports only the small subset skills use today: scalar `name` and scalar,
@@ -152,5 +173,5 @@ export declare function getSkillStats(skillPath: string, directory: string): Ski
  * @param directory - Project root directory.
  * @returns Multi-line formatted string, one line per skill.
  */
-export declare function formatSkillIndexWithContext(skills: string[], directory: string): string;
+export declare function formatSkillIndexWithContext(skills: string[], directory: string, metadataBySkillPath?: ReadonlyMap<string, SkillMetadata>): string;
 export {};