opencode-swarm 7.114.6 → 7.114.8

package/dist/plan/ledger.d.ts

@@ -253,20 +253,63 @@ interface ReplayOptions {
     useSnapshot?: boolean;
 }
 /**
- * Replay ledger events to reconstruct plan state.
- * Loads plan.json as the base state and applies ledger events in sequence.
+ * Result of a status-aware ledger replay.
  *
- * NOTE: This function requires plan.json to exist as the base state.
- * The ledger only stores task_status_changed events, not the full plan payload.
- * If plan.json is missing, replay cannot proceed — this is a known limitation.
- * The fix would be to store the initial plan payload in the ledger, but that
- * is a larger architectural change beyond the current scope.
+ * Threads the integrity verdict OUT of replay so callers (notably `loadPlan`)
+ * can distinguish a full, clean reconstruction from a PREFIX-ONLY one produced
+ * after a poison line. Overwriting canonical plan.json with a prefix-only
+ * projection silently drops every durable event recorded after the corruption
+ * (the M1 silent-rollback defect); `truncated === true` is the signal that must
+ * gate any such overwrite.
+ */
+export interface ReplayStatusResult {
+    /** Reconstructed plan, or null when replay cannot proceed / plan was reset. */
+    plan: Plan | null;
+    /**
+     * True when a malformed ledger line stopped the read before the tail, so
+     * `plan` reflects only the events BEFORE the corruption. Never overwrite the
+     * canonical plan.json with `plan` when this is true.
+     */
+    truncated: boolean;
+    /** Raw corrupted suffix (first bad line through EOF), or null when clean. */
+    badSuffix: string | null;
+}
+/**
+ * Replay ledger events to reconstruct plan state (status-discarding wrapper).
+ *
+ * Delegates to {@link replayFromLedgerWithStatus} and returns only the plan.
+ * Retained as the stable, widely-called/mocked entry point; callers that must
+ * react to ledger truncation (to avoid the M1 silent-rollback) should use
+ * {@link replayFromLedgerWithStatus} instead.
  *
  * @param directory - The working directory
  * @param options - Optional replay options
  * @returns Reconstructed Plan from ledger events, or null if plan.json doesn't exist or ledger is empty
  */
-export declare function replayFromLedger(directory: string, _options?: ReplayOptions): Promise<Plan | null>;
+export declare function replayFromLedger(directory: string, options?: ReplayOptions): Promise<Plan | null>;
+/**
+ * Replay ledger events to reconstruct plan state, threading the integrity
+ * verdict back to the caller.
+ *
+ * This is the folded successor to the former `replayWithIntegrity`: it performs
+ * integrity-checked reading (stop-at-first-bad via
+ * {@link readLedgerEventsWithIntegrity}), quarantines any corrupted suffix to a
+ * UNIQUE non-overwriting side file (never rewriting/truncating the canonical
+ * ledger), and reconstructs the plan from the clean prefix.
+ *
+ * IMPORTANT semantics preserved from `replayFromLedger` (do NOT regress):
+ *  - The `plan_created` embedded-plan bootstrap branch (#444) is honored via
+ *    {@link reconstructPlanFromEvents}.
+ *  - `applyEventToPlan`'s "unhandled event type" throw is intentionally allowed
+ *    to PROPAGATE to the caller (loadPlan's catch → critic-approved snapshot
+ *    fallback). It is NOT swallowed into a null return here (that was
+ *    `replayWithIntegrity`'s bug — it hid genuine replay failures).
+ *
+ * @param directory - The working directory
+ * @param _options - Optional replay options (reserved)
+ * @returns {@link ReplayStatusResult} with plan, truncated flag, and bad suffix
+ */
+export declare function replayFromLedgerWithStatus(directory: string, _options?: ReplayOptions): Promise<ReplayStatusResult>;
 /**
  * Apply a single ledger event to the plan state.
  * Returns null if the event indicates a full reset (plan_reset).
@@ -296,22 +339,42 @@ export interface LedgerIntegrityResult {
  */
 export declare function readLedgerEventsWithIntegrity(directory: string): Promise<LedgerIntegrityResult>;
 /**
- * Quarantine a corrupted ledger suffix to a separate file.
- * Does NOT modify the ledger file itself.
- *
- * @param directory - The working directory
- * @param badSuffix - The corrupted content to quarantine
+ * Result of a {@link quarantineLedgerSuffix} call.
  */
-export declare function quarantineLedgerSuffix(directory: string, badSuffix: string): Promise<void>;
+export interface QuarantineResult {
+    /** Absolute path the suffix was written to, or null if the write failed. */
+    path: string | null;
+    /**
+     * Count of individually-parseable JSON lines salvaged from the bad suffix.
+     * The suffix is discarded from the active replay, but these lines were still
+     * well-formed events sitting behind the poison line — surfacing the count
+     * makes the size of the sacrificed tail observable rather than silent.
+     */
+    salvagedCount: number;
+}
 /**
- * Replay ledger events with integrity checking.
- * If corruption is detected, quarantines the bad suffix and falls back to snapshot+prefix replay.
- * Never throws — all errors return null.
+ * Quarantine a corrupted ledger suffix to a separate, UNIQUE side file.
+ *
+ * Does NOT modify, rewrite, or truncate the canonical ledger file — it only
+ * copies the bad suffix aside for forensic recovery.
+ *
+ * Uniqueness (M1 fix): the target filename embeds a timestamp AND a content
+ * hash of the suffix, so a SECOND corruption cannot clobber the file written by
+ * the FIRST. The previous fixed `plan-ledger.quarantine` path overwrote any
+ * prior quarantine, permanently losing the earlier corrupted tail.
+ *
+ * Salvage: before returning, each line of the suffix is probed with JSON.parse
+ * and the count of well-formed lines is reported. The suffix is still excluded
+ * from the active replay (it lives behind a poison line and cannot be trusted as
+ * a contiguous continuation), but the salvage count is logged and returned so
+ * the loss is visible.
  *
  * @param directory - The working directory
- * @returns Reconstructed Plan from ledger events, or null if replay fails
+ * @param badSuffix - The corrupted content to quarantine
+ * @returns {@link QuarantineResult} with the written path (or null) and the
+ *   number of parseable lines salvaged from the suffix
  */
-export declare function replayWithIntegrity(directory: string): Promise<Plan | null>;
+export declare function quarantineLedgerSuffix(directory: string, badSuffix: string): Promise<QuarantineResult>;
 /**
  * Metadata describing an approved snapshot recovered from the ledger.
  */
@@ -390,10 +453,10 @@ export declare const _internals: {
     appendLedgerEventWithRetry: typeof appendLedgerEventWithRetry;
     takeSnapshotEvent: typeof takeSnapshotEvent;
     replayFromLedger: typeof replayFromLedger;
+    replayFromLedgerWithStatus: typeof replayFromLedgerWithStatus;
     applyEventToPlan: typeof applyEventToPlan;
     readLedgerEventsWithIntegrity: typeof readLedgerEventsWithIntegrity;
     quarantineLedgerSuffix: typeof quarantineLedgerSuffix;
-    replayWithIntegrity: typeof replayWithIntegrity;
     loadLastApprovedPlan: typeof loadLastApprovedPlan;
     loadLastPlanCriticApprovedSnapshot: typeof loadLastPlanCriticApprovedSnapshot;
     getLedgerPath: typeof getLedgerPath;

package/dist/types/delegation.d.ts

@@ -2,6 +2,24 @@
  * Delegation Envelope Types
  * Interface for passing delegated tasks between agents
  */
+/**
+ * M15: OPTIONAL structured spec criteria carried with a delegation so a
+ * delegated coder receives spec-level acceptance / functional-requirement /
+ * success-criteria detail as structured data — not only architect free-text.
+ *
+ * Every member is optional. A MISSING `specCriteria` (or any missing member)
+ * is fully valid and MUST NOT trigger delegation rejection or advisory noise.
+ * Only a POPULATED-but-malformed value (a non-string[] member) is flagged, and
+ * even then advisory-only — never fail-closed.
+ */
+export interface DelegationSpecCriteria {
+    /** Functional requirements the change must satisfy (e.g. "FR-006"). */
+    fr?: string[];
+    /** Success criteria / measurable outcomes (e.g. "SC-111"). */
+    sc?: string[];
+    /** Acceptance criteria the implementation must meet. */
+    acceptance?: string[];
+}
 export interface DelegationEnvelope {
     taskId: string;
     targetAgent: string;
@@ -12,6 +30,12 @@ export interface DelegationEnvelope {
     technicalContext: string;
     errorStrategy?: 'FAIL_FAST' | 'BEST_EFFORT';
     platformNotes?: string;
+    /**
+     * M15: OPTIONAL structured acceptance/FR/SC criteria. See
+     * {@link DelegationSpecCriteria}. Optional by contract — a missing field is
+     * valid and never causes rejection or advisory output.
+     */
+    specCriteria?: DelegationSpecCriteria;
 }
 /**
  * Validation result types

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.114.6",
+	"version": "7.114.8",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",

package/dist/graph/graph-builder.d.ts

@@ -1,39 +0,0 @@
-import { type FileNode, type RepoGraph } from './types';
-/**
- * Build a full repository graph by walking the workspace, parsing source files
- * for imports and exported symbols, and assembling them into a `RepoGraph`.
- *
- * Performance:
- *   - File scanning skips well-known build/dep directories (node_modules, dist, .git, etc.)
- *   - Per-file parsing runs with a concurrency limit to avoid overwhelming I/O.
- *   - Files larger than `MAX_FILE_SIZE_BYTES` are skipped (would also fail downstream extractors).
- *
- * Targets ~5s for a 50k LOC repo (~500 files) on commodity hardware.
- */
-export interface BuildOptions {
-    /** Optional cap on file count to bound runtime on huge repos. */
-    maxFiles?: number;
-    /** Concurrency for per-file parsing. Defaults to 16. */
-    concurrency?: number;
-    /** Additional directory names to skip (merged with defaults). */
-    skipDirs?: string[];
-}
-/**
- * Hard upper bound on file count if the caller does not supply one. Protects
- * against unbounded memory growth on extremely large monorepos. Callers can
- * pass an explicit `maxFiles` (including a larger one) to override.
- */
-export declare const DEFAULT_MAX_FILES = 10000;
-/**
- * Walk the workspace and return absolute paths of all supported source files.
- * Cross-platform: emits absolute paths using the host's path separator.
- */
-export declare function findSourceFiles(workspaceRoot: string, skipDirs?: Set<string>): string[];
-/**
- * Build the repo graph from scratch.
- */
-export declare function buildRepoGraph(workspaceRoot: string, options?: BuildOptions): Promise<RepoGraph>;
-/**
- * Process a single file into a FileNode. Returns null if the file cannot be processed.
- */
-export declare function processFile(absoluteFilePath: string, workspaceRoot: string): Promise<FileNode | null>;

package/dist/graph/graph-query.d.ts

@@ -1,42 +0,0 @@
-import type { BlastRadiusResult, FileNode, FileReference, LocalizationBlock, RepoGraph, SymbolReference } from './types';
-/**
- * Query API for the repo graph.
- *
- * All functions accept normalized RELATIVE forward-slash paths and return the
- * same. Callers responsible for normalizing input paths (helper provided).
- */
-export declare function normalizeGraphPath(p: string): string;
-/**
- * Files that import the given file (direct dependents).
- */
-export declare function getImporters(graph: RepoGraph, filePath: string): FileReference[];
-/**
- * Files this file imports (direct dependencies, resolved targets only).
- */
-export declare function getDependencies(graph: RepoGraph, filePath: string): FileReference[];
-/**
- * Find all importers of a specific exported symbol from a file.
- */
-export declare function getSymbolConsumers(graph: RepoGraph, filePath: string, symbolName: string): SymbolReference[];
-/**
- * Compute the transitive blast radius of changing one or more files.
- *
- * Performs a BFS over the reverse-edge index up to `maxDepth` levels.
- */
-export declare function getBlastRadius(graph: RepoGraph, filePaths: string[], maxDepth?: number): BlastRadiusResult;
-/**
- * Top-N most-imported files (by in-degree) — useful for surfacing
- * architectural pillars.
- */
-export declare function getKeyFiles(graph: RepoGraph, topN?: number): FileNode[];
-/**
- * Build a compact localization block for a single file. This is the primary
- * payload injected into the coder agent's pre-edit context.
- */
-export declare function getLocalizationContext(graph: RepoGraph, filePath: string, options?: {
-    maxImporters?: number;
-    maxDeps?: number;
-    maxDepth?: number;
-}): LocalizationBlock;
-/** Reset the cached reverse index. Call this when a graph is mutated in place. */
-export declare function resetQueryCache(): void;

package/dist/graph/graph-store.d.ts

@@ -1,27 +0,0 @@
-import { type RepoGraph } from './types';
-export declare function getGraphPath(workspaceRoot: string): string;
-export declare function loadGraph(workspaceRoot: string): RepoGraph | null;
-export declare function saveGraph(workspaceRoot: string, graph: RepoGraph): void;
-/**
- * Build the graph from scratch and persist it.
- */
-export declare function buildAndSaveGraph(workspaceRoot: string): Promise<RepoGraph>;
-/**
- * Apply incremental updates for a list of changed (or potentially-changed) files.
- *
- * For each file:
- *   - If the file no longer exists, its node is removed.
- *   - Otherwise its node is re-parsed and replaced.
- *
- * Returns the updated graph (mutated in place AND returned for convenience).
- * Caller must call `saveGraph` to persist if desired.
- */
-export declare function updateGraphIncremental(workspaceRoot: string, changedRelativePaths: string[], graph: RepoGraph): Promise<RepoGraph>;
-/**
- * Determine if a stored graph is fresh enough to reuse.
- *
- * Default freshness window: 5 minutes. Files added/removed outside this
- * window are not detected without an explicit incremental update — callers
- * that care about up-to-the-second accuracy should rebuild.
- */
-export declare function isGraphFresh(graph: RepoGraph | null, maxAgeMs?: number): boolean;

package/dist/graph/import-extractor.d.ts

@@ -1,44 +0,0 @@
-import type { ImportEdge } from './types';
-/**
- * Extract import edges from a source file.
- *
- * Uses regex-based parsing (the same proven approach as `src/tools/imports.ts`
- * and `src/tools/co-change-analyzer.ts`). Tree-sitter is intentionally not used
- * here because:
- *   1. The existing regex patterns are battle-tested across the codebase.
- *   2. Import statements have stable, simple syntax that regex handles reliably.
- *   3. Avoiding the per-file Tree-sitter parse keeps full-graph builds fast
- *      enough to be interactive (target: <5s for 50k LOC).
- *
- * Supported languages:
- *   - TypeScript / JavaScript (.ts/.tsx/.js/.jsx/.mjs/.cjs) — ES modules + CJS require
- *   - Python (.py) — `import x` and `from x import y`
- *   - Go (.go) — `import "path"` and `import (...)` blocks
- *   - Rust (.rs) — `use path::module`
- *
- * Only RELATIVE imports are tracked as graph edges. External package imports
- * (e.g. 'react', 'fmt', 'std::fs') are skipped — they are not part of the
- * intra-repo dependency graph.
- */
-export interface ExtractImportsOptions {
-    /** Absolute path to the source file (used for relative resolution). */
-    absoluteFilePath: string;
-    /** Absolute workspace root (used for relative path computation). */
-    workspaceRoot: string;
-    /** Optional pre-read content; if omitted the file is read from disk. */
-    content?: string;
-}
-/** Source file extensions we know how to scan. */
-export declare const SOURCE_EXTENSIONS: readonly [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".pyw", ".go", ".rs"];
-export declare function getLanguageFromExtension(ext: string): string | null;
-/**
- * Extract import edges for a single file. Returns an empty array when the
- * language is unsupported or the file cannot be parsed.
- *
- * Resolution strategy for edge.target:
- *   - TS/JS: probe extensions (.ts, .tsx, .js, .jsx, .mjs, .cjs, /index.*).
- *   - Python: probe .py and /__init__.py for relative imports only.
- *   - Go/Rust: target left empty (intra-repo resolution requires module/crate
- *     metadata that is out of scope for Phase 1). The raw module is preserved.
- */
-export declare function extractImports(opts: ExtractImportsOptions): ImportEdge[];

package/dist/graph/index.d.ts

@@ -1,16 +0,0 @@
-/**
- * Repo graph: structural codebase awareness for swarm agents.
- *
- * Public surface:
- *   - Types (RepoGraph, FileNode, ImportEdge, ExportedSymbol, ...)
- *   - Builders (buildRepoGraph, processFile, findSourceFiles)
- *   - Store (loadGraph, saveGraph, buildAndSaveGraph, updateGraphIncremental, isGraphFresh, getGraphPath)
- *   - Query (getImporters, getDependencies, getSymbolConsumers, getBlastRadius,
- *            getKeyFiles, getLocalizationContext, normalizeGraphPath, resetQueryCache)
- */
-export { type BuildOptions, buildRepoGraph, findSourceFiles, processFile, } from './graph-builder';
-export { getBlastRadius, getDependencies, getImporters, getKeyFiles, getLocalizationContext, getSymbolConsumers, normalizeGraphPath, resetQueryCache, } from './graph-query';
-export { buildAndSaveGraph, getGraphPath, isGraphFresh, loadGraph, saveGraph, updateGraphIncremental, } from './graph-store';
-export { extractImports, getLanguageFromExtension, SOURCE_EXTENSIONS, } from './import-extractor';
-export { extractExportedSymbols } from './symbol-extractor';
-export * from './types';

package/dist/graph/symbol-extractor.d.ts

@@ -1,17 +0,0 @@
-import type { ExportedSymbol } from './types';
-/**
- * Extract exported symbols from a single file.
- *
- * Reuses the proven regex-based extractors from `src/tools/symbols.ts`
- * (`extractTSSymbols` / `extractPythonSymbols`) and maps their internal
- * SymbolInfo shape to our `ExportedSymbol` type.
- *
- * For Go and Rust, exported-symbol extraction is best-effort (out of scope
- * for Phase 1) — empty arrays are returned. The graph still tracks file-level
- * import edges for these languages.
- */
-/**
- * @param relativeFilePath - file path relative to workspace root (forward-slash)
- * @param workspaceRoot - absolute workspace root
- */
-export declare function extractExportedSymbols(relativeFilePath: string, workspaceRoot: string): ExportedSymbol[];

package/dist/graph/types.d.ts

@@ -1,84 +0,0 @@
-/**
- * Repo graph data structures.
- *
- * The graph captures structural relationships between source files
- * (imports/exports) so agents can reason about blast radius before editing.
- *
- * All paths are RELATIVE to the workspace root and FORWARD-SLASH normalized
- * for cross-platform comparison.
- */
-export type ImportType = 'named' | 'default' | 'namespace' | 'sideeffect' | 'require' | 'type';
-export interface ImportEdge {
-    /** Importing file (relative, forward-slash). */
-    source: string;
-    /** Resolved imported file (relative, forward-slash). May be empty for unresolved imports. */
-    target: string;
-    /** Raw module specifier as written in the source (e.g. '../utils/path-security'). */
-    rawModule: string;
-    /** Named imports brought in (empty for sideeffect/namespace/default). */
-    importedSymbols: string[];
-    /** What kind of import statement this is. */
-    importType: ImportType;
-    /** 1-indexed line number where the import appears. */
-    line: number;
-}
-export type SymbolKind = 'function' | 'class' | 'interface' | 'type' | 'enum' | 'const' | 'variable' | 'method' | 'property';
-export interface ExportedSymbol {
-    name: string;
-    kind: SymbolKind;
-    signature?: string;
-    line: number;
-}
-export interface FileNode {
-    /** Relative, forward-slash path. */
-    path: string;
-    /** Detected language id (e.g. 'typescript', 'python', 'go', 'rust'). */
-    language: string;
-    /** Symbols this file exports (or top-level definitions for languages without explicit exports). */
-    exports: ExportedSymbol[];
-    /** Outgoing import edges from this file. */
-    imports: ImportEdge[];
-    /** mtime of the source file (ms epoch) for incremental updates. */
-    mtimeMs: number;
-}
-export interface RepoGraph {
-    /** Schema version for migration. */
-    version: number;
-    /** ISO timestamp when this graph was built. */
-    buildTimestamp: string;
-    /** Workspace root used at build time (absolute, for diagnostics only). */
-    rootDir: string;
-    /** Files keyed by their relative forward-slash path. */
-    files: Record<string, FileNode>;
-}
-export interface FileReference {
-    file: string;
-    line?: number;
-    importType?: ImportType;
-}
-export interface SymbolReference {
-    file: string;
-    line: number;
-    importedAs: string;
-}
-export interface BlastRadiusResult {
-    target: string[];
-    directDependents: string[];
-    transitiveDependents: string[];
-    depthReached: number;
-    totalDependents: number;
-    riskLevel: 'low' | 'medium' | 'high' | 'critical';
-}
-export interface LocalizationBlock {
-    target: string;
-    importerCount: number;
-    importers: FileReference[];
-    dependencyCount: number;
-    dependencies: FileReference[];
-    exportedSymbolsUsedExternally: string[];
-    blastRadius: BlastRadiusResult;
-    /** Compact human/LLM-readable summary suitable for context injection. */
-    summary: string;
-}
-export declare const REPO_GRAPH_SCHEMA_VERSION = 1;
-export declare const REPO_GRAPH_FILENAME = "repo-graph.json";

package/dist/sandbox/win32/restricted-token-executor.d.ts

@@ -1,9 +0,0 @@
-/**
- * Backwards-compatibility re-export.
- *
- * The implementation has moved to restricted-environment-executor.ts to
- * clarify that this is environment scrubbing, not real token restriction.
- * The native sandbox runner (swarm-sandbox-runner.exe) provides true
- * OS-level isolation via runner-client.ts.
- */
-export { _internals, WindowsSandboxExecutor, } from './restricted-environment-executor';