opencode-swarm 7.113.2 → 7.113.4

package/dist/sandbox/capability-probe.d.ts

@@ -11,10 +11,24 @@
  */
 /** Possible sandbox status values. */
 export type SandboxStatus = 'enabled' | 'disabled' | 'unsupported';
+/**
+ * Enforcement strength of an available sandbox mechanism.
+ * - `strong`: real kernel-level enforcement (bubblewrap, sandbox-exec, the
+ *   Windows native runner).
+ * - `advisory`: best-effort, non-kernel restriction (the Windows PowerShell
+ *   environment-scrub fallback). Must NEVER be reported as real containment
+ *   (issue #1778 H2).
+ */
+export type SandboxStrength = 'strong' | 'advisory';
 /** Result of a sandbox capability probe. */
 export interface SandboxCapability {
     /** Whether the sandbox mechanism is available. */
     status: SandboxStatus;
+    /**
+     * Enforcement strength when `status === 'enabled'`. Absent for
+     * disabled/unsupported results.
+     */
+    strength?: SandboxStrength;
     /** Human-readable mechanism name, e.g. "Bubblewrap". */
     mechanism: string;
     /** Current process.platform value. */

package/dist/sandbox/macos/sandbox-exec-executor.d.ts

@@ -23,7 +23,12 @@ declare function probeSandboxExec(): boolean;
  */
 export declare const _internals: {
     probeSandboxExec: typeof probeSandboxExec;
+    buildSandboxProfile: typeof buildSandboxProfile;
 };
+/**
+ * Build a sandbox-exec profile string for the given scope paths, temp dir, and optional env overrides.
+ */
+declare function buildSandboxProfile(scopePaths: string[], tempDir: string, envOverrides?: Record<string, string | null>): string;
 /**
  * macOS sandbox-exec sandbox executor.
  */

package/dist/tools/tool-metadata.d.ts

@@ -165,7 +165,7 @@ export declare const TOOL_METADATA: {
     };
     extract_code_blocks: {
         description: string;
-        agents: ("reviewer" | "test_engineer" | "coder" | "docs" | "designer" | "explorer" | "sme" | "architect" | "docs_design" | "spec_writer")[];
+        agents: ("test_engineer" | "coder" | "docs" | "designer" | "docs_design" | "spec_writer")[];
     };
     phase_complete: {
         description: string;

package/dist/utils/path-security.d.ts

@@ -34,6 +34,32 @@ export declare function validateDirectory(directory: string): void;
  * @throws Error if the resolved target escapes the root boundary
  */
 export declare function validateSymlinkBoundary(targetPath: string, rootPath: string): void;
+/**
+ * Verify that a target path canonically resolves inside a root directory.
+ * For targets that do not exist yet (e.g. new-file creation), resolves the
+ * nearest existing ancestor instead, so a symlinked intermediate directory
+ * cannot be used to escape the root. Mirrors the containment used by
+ * swarm_apply_patch (the correct template for write tools).
+ *
+ * @param targetPath - absolute path to validate
+ * @param rootPath - absolute root boundary
+ * @returns true if the canonical target is within the canonical root
+ */
+export declare function isCanonicalPathWithinRoot(targetPath: string, rootPath: string): boolean;
+/**
+ * Validate that a caller-supplied path stays within an allowed root directory.
+ * Rejects empty paths, absolute paths (POSIX + Windows drive), traversal,
+ * control characters, lexical escape, and symlink/junction escape.
+ * Returns a human-readable reason string on rejection, or null when valid.
+ *
+ * This is the shared containment primitive for write-capable tools whose
+ * target path is derived from untrusted input (e.g. extract_code_blocks'
+ * output_dir and `# filename:` comments).
+ *
+ * @param filePath - the caller-supplied path (relative to root, or absolute-rejected)
+ * @param root - the absolute root boundary (workspace directory)
+ */
+export declare function validateTargetWithinRoot(filePath: string, root: string): string | null;
 /**
  * DI seam for testability. Contains all test-mocked exports.
  * Internal calls should use _internals.fn() instead of fn() directly.
@@ -43,4 +69,6 @@ export declare const _internals: {
     containsControlChars: typeof containsControlChars;
     validateDirectory: typeof validateDirectory;
     validateSymlinkBoundary: typeof validateSymlinkBoundary;
+    isCanonicalPathWithinRoot: typeof isCanonicalPathWithinRoot;
+    validateTargetWithinRoot: typeof validateTargetWithinRoot;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.113.2",
+	"version": "7.113.4",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -40,6 +40,7 @@
 	"files": [
 		"dist",
 		"dist/lang/grammars",
+		"binaries",
 		".opencode/skills/brainstorm",
 		".opencode/skills/specify",
 		".opencode/skills/clarify-spec",

package/dist/cli/curator-llm-factory-dwvk7rh0.js

@@ -1,41 +0,0 @@
-// @bun
-import {
-  createCuratorLLMDelegate
-} from "./index-54dgk0bv.js";
-import"./index-8f256d7t.js";
-import"./index-c8s9a3zh.js";
-import"./index-0gf6de8b.js";
-import"./index-1ey3dxq7.js";
-import"./index-afgh75zg.js";
-import"./index-scww5b77.js";
-import"./index-9fxs0rm1.js";
-import"./index-q1jaeynn.js";
-import"./index-h389ed8y.js";
-import"./index-30ejh1tx.js";
-import"./index-t6wfwdm1.js";
-import"./index-hpp2r0sd.js";
-import"./index-32bx4kch.js";
-import"./index-bfwt3abw.js";
-import"./index-db1fh1fv.js";
-import"./index-jt58s751.js";
-import"./index-wvrj16f0.js";
-import"./index-q1exe2b3.js";
-import"./index-g55nzpwn.js";
-import"./index-fhmw7evd.js";
-import"./index-1rga1vvb.js";
-import"./index-jtqkh8jf.js";
-import"./index-5e4e2hvv.js";
-import"./index-p0arc26j.js";
-import"./index-zgwm4ryv.js";
-import"./index-dqh3zhhc.js";
-import"./index-x5g7et24.js";
-import"./index-0dab9w37.js";
-import"./index-293f68mj.js";
-import"./index-5mkc2f9z.js";
-import"./index-vn263hqt.js";
-import"./index-vvk2g744.js";
-import"./index-h91bv3hy.js";
-import"./index-a76rekgs.js";
-export {
-  createCuratorLLMDelegate
-};

package/dist/cli/guardrail-explain-2k271yh4.js

@@ -1,42 +0,0 @@
-// @bun
-import {
-  handleGuardrailExplain
-} from "./index-n7rd2rkj.js";
-import"./index-54dgk0bv.js";
-import"./index-8f256d7t.js";
-import"./index-c8s9a3zh.js";
-import"./index-0gf6de8b.js";
-import"./index-1ey3dxq7.js";
-import"./index-afgh75zg.js";
-import"./index-scww5b77.js";
-import"./index-9fxs0rm1.js";
-import"./index-q1jaeynn.js";
-import"./index-h389ed8y.js";
-import"./index-30ejh1tx.js";
-import"./index-t6wfwdm1.js";
-import"./index-hpp2r0sd.js";
-import"./index-32bx4kch.js";
-import"./index-bfwt3abw.js";
-import"./index-db1fh1fv.js";
-import"./index-jt58s751.js";
-import"./index-wvrj16f0.js";
-import"./index-q1exe2b3.js";
-import"./index-g55nzpwn.js";
-import"./index-fhmw7evd.js";
-import"./index-1rga1vvb.js";
-import"./index-jtqkh8jf.js";
-import"./index-5e4e2hvv.js";
-import"./index-p0arc26j.js";
-import"./index-zgwm4ryv.js";
-import"./index-dqh3zhhc.js";
-import"./index-x5g7et24.js";
-import"./index-0dab9w37.js";
-import"./index-293f68mj.js";
-import"./index-5mkc2f9z.js";
-import"./index-vn263hqt.js";
-import"./index-vvk2g744.js";
-import"./index-h91bv3hy.js";
-import"./index-a76rekgs.js";
-export {
-  handleGuardrailExplain
-};

package/dist/cli/hive-promoter-0y4pnft4.js

@@ -1,49 +0,0 @@
-// @bun
-import {
-  checkHivePromotions,
-  createHivePromoterHook,
-  isHiveEligible,
-  promoteFromSwarm,
-  promoteToHive
-} from "./index-54dgk0bv.js";
-import"./index-8f256d7t.js";
-import"./index-c8s9a3zh.js";
-import"./index-0gf6de8b.js";
-import"./index-1ey3dxq7.js";
-import"./index-afgh75zg.js";
-import"./index-scww5b77.js";
-import"./index-9fxs0rm1.js";
-import"./index-q1jaeynn.js";
-import"./index-h389ed8y.js";
-import"./index-30ejh1tx.js";
-import"./index-t6wfwdm1.js";
-import"./index-hpp2r0sd.js";
-import"./index-32bx4kch.js";
-import"./index-bfwt3abw.js";
-import"./index-db1fh1fv.js";
-import"./index-jt58s751.js";
-import"./index-wvrj16f0.js";
-import"./index-q1exe2b3.js";
-import"./index-g55nzpwn.js";
-import"./index-fhmw7evd.js";
-import"./index-1rga1vvb.js";
-import"./index-jtqkh8jf.js";
-import"./index-5e4e2hvv.js";
-import"./index-p0arc26j.js";
-import"./index-zgwm4ryv.js";
-import"./index-dqh3zhhc.js";
-import"./index-x5g7et24.js";
-import"./index-0dab9w37.js";
-import"./index-293f68mj.js";
-import"./index-5mkc2f9z.js";
-import"./index-vn263hqt.js";
-import"./index-vvk2g744.js";
-import"./index-h91bv3hy.js";
-import"./index-a76rekgs.js";
-export {
-  promoteToHive,
-  promoteFromSwarm,
-  isHiveEligible,
-  createHivePromoterHook,
-  checkHivePromotions
-};