opencode-swarm 7.114.7 → 7.114.8

package/dist/cli/index.d.ts

@@ -15,6 +15,40 @@ export declare function isSafeCachePath(p: string): boolean;
  * grandparent structure validation to prevent misconfigured nested paths.
  */
 export declare function isSafeLockFilePath(p: string): boolean;
+/**
+ * Safety guard for the `uninstall --clean` deletion of PROMPTS_DIR
+ * (`<CONFIG_DIR>/opencode-swarm`, a DIRECTORY removed recursively).
+ *
+ * This is a SEPARATE guard from isSafeCachePath — it is NOT reused because
+ * isSafeCachePath's layer-4 requires parent ∈ {packages, node_modules} and
+ * grandparent === 'opencode', which the prompts directory (parent basename is
+ * the config dir's basename, typically 'opencode') does not satisfy, so
+ * isSafeCachePath would false-REJECT a legitimate PROMPTS_DIR.
+ *
+ * Defense in depth:
+ *   1. Canonicalize via safeRealpathSync (realpathSync with ENOENT→fallback)
+ *      so the path a symlinked leaf actually resolves to is what we validate.
+ *   2. Refuse root, home, or shorter-than-home paths.
+ *   3. Require ≥ 3 non-empty segments (rejects pathological
+ *      XDG_CONFIG_HOME='/' which yields '/opencode/opencode-swarm', 2 segments).
+ *   4. Require basename === 'opencode-swarm' AND the parent directory's
+ *      basename to equal the config dir's basename (canonical layout is
+ *      `<CONFIG_DIR>/opencode-swarm`).
+ */
+export declare function isSafePromptsDir(p: string): boolean;
+/**
+ * Safety guard for the `uninstall --clean` deletion of PLUGIN_CONFIG_PATH
+ * (`<CONFIG_DIR>/opencode-swarm.json`, a FILE removed with unlinkSync).
+ *
+ * File-oriented sibling of isSafePromptsDir. isSafePromptsDir would
+ * false-REJECT this path because the leaf here is the `.json` FILE, not the
+ * `opencode-swarm` directory — hence a dedicated guard.
+ *
+ * Defense in depth: canonicalize via safeRealpathSync; refuse root/home/
+ * shorter-than-home; require basename === 'opencode-swarm.json' AND the
+ * parent directory's basename to equal the config dir's basename.
+ */
+export declare function isSafePluginConfigPath(p: string): boolean;
 /**
  * Recursively delete every known opencode plugin cache location for
  * opencode-swarm. Returns paths actually cleared and paths that errored.

package/dist/cli/index.js

@@ -7,22 +7,22 @@ import {
   getPluginLockFilePaths,
   package_default,
   resolveCommand
-} from "./index-6ctejje2.js";
+} from "./index-cs5765s2.js";
 import"./index-yfedche9.js";
 import"./index-c8s9a3zh.js";
 import"./index-9bsmzfk3.js";
 import {
   DEFAULT_AGENT_CONFIGS
 } from "./index-a45jq4b7.js";
-import"./index-f6y341yk.js";
+import"./index-yrrqs4b0.js";
 import"./index-scww5b77.js";
 import"./index-ga4ta3cr.js";
 import"./index-80jkseqw.js";
-import"./index-vjvdvjd3.js";
-import"./index-qrnhvhmg.js";
-import"./index-7stsmndb.js";
-import"./index-kjbfry6m.js";
-import"./index-91qesget.js";
+import"./index-x12hvfpf.js";
+import"./index-n18yy0z1.js";
+import"./index-6f6y2rbp.js";
+import"./index-8f2270hc.js";
+import"./index-rk6qhyng.js";
 import"./index-bfwt3abw.js";
 import"./index-g40r5d08.js";
 import"./index-vxv732ex.js";
@@ -49,6 +49,21 @@ import"./index-a76rekgs.js";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
+
+// src/tools/repo-graph/safe-realpath.ts
+import { realpathSync } from "fs";
+function safeRealpathSync(targetPath, fallback, realpathResolver = realpathSync) {
+  try {
+    return realpathResolver(targetPath);
+  } catch (error) {
+    if (error instanceof Error && error.code === "ENOENT") {
+      return fallback;
+    }
+    return null;
+  }
+}
+
+// src/cli/index.ts
 var { version } = package_default;
 var CONFIG_DIR = getPluginConfigDir();
 var OPENCODE_CONFIG_PATH = path.join(CONFIG_DIR, "opencode.json");
@@ -56,14 +71,17 @@ var PLUGIN_CONFIG_PATH = path.join(CONFIG_DIR, "opencode-swarm.json");
 var PROMPTS_DIR = path.join(CONFIG_DIR, "opencode-swarm");
 var OPENCODE_PLUGIN_CACHE_PATHS = getPluginCachePaths();
 var OPENCODE_PLUGIN_LOCK_FILE_PATHS = getPluginLockFilePaths();
+function segmentDepthBelowRoot(resolved) {
+  const { root } = path.parse(resolved);
+  return resolved.slice(root.length).split(path.sep).filter((s) => s.length > 0).length;
+}
 function isSafeCachePath(p) {
   const resolved = path.resolve(p);
   const home = path.resolve(os.homedir());
   if (resolved === "/" || resolved === home || resolved.length <= home.length) {
     return false;
   }
-  const segments = resolved.split(path.sep).filter((s) => s.length > 0);
-  if (segments.length < 4) {
+  if (segmentDepthBelowRoot(resolved) < 4) {
     return false;
   }
   const leaf = path.basename(resolved);
@@ -86,8 +104,7 @@ function isSafeLockFilePath(p) {
   if (resolved === "/" || resolved === home || resolved.length <= home.length) {
     return false;
   }
-  const segments = resolved.split(path.sep).filter((s) => s.length > 0);
-  if (segments.length < 4) {
+  if (segmentDepthBelowRoot(resolved) < 4) {
     return false;
   }
   const leaf = path.basename(resolved);
@@ -104,6 +121,48 @@ function isSafeLockFilePath(p) {
   }
   return true;
 }
+function isSafePromptsDir(p) {
+  const canonical = safeRealpathSync(p, p);
+  if (canonical === null) {
+    return false;
+  }
+  const resolved = path.resolve(canonical);
+  const home = path.resolve(os.homedir());
+  if (resolved === "/" || resolved === home || resolved.length <= home.length) {
+    return false;
+  }
+  if (segmentDepthBelowRoot(resolved) < 3) {
+    return false;
+  }
+  if (path.basename(resolved) !== "opencode-swarm") {
+    return false;
+  }
+  if (path.basename(path.dirname(resolved)) !== path.basename(CONFIG_DIR)) {
+    return false;
+  }
+  return true;
+}
+function isSafePluginConfigPath(p) {
+  const canonical = safeRealpathSync(p, p);
+  if (canonical === null) {
+    return false;
+  }
+  const resolved = path.resolve(canonical);
+  const home = path.resolve(os.homedir());
+  if (resolved === "/" || resolved === home || resolved.length <= home.length) {
+    return false;
+  }
+  if (segmentDepthBelowRoot(resolved) < 3) {
+    return false;
+  }
+  if (path.basename(resolved) !== "opencode-swarm.json") {
+    return false;
+  }
+  if (path.basename(path.dirname(resolved)) !== path.basename(CONFIG_DIR)) {
+    return false;
+  }
+  return true;
+}
 function ensureDir(dir) {
   if (!fs.existsSync(dir)) {
     fs.mkdirSync(dir, { recursive: true });
@@ -270,15 +329,18 @@ function evictPluginCaches() {
   for (const cachePath of OPENCODE_PLUGIN_CACHE_PATHS) {
     if (!fs.existsSync(cachePath))
       continue;
-    if (!isSafeCachePath(cachePath)) {
-      failed.push(`${cachePath} (refused: failed safety check)`);
+    const canonical = safeRealpathSync(cachePath, cachePath);
+    if (canonical === null || !fs.existsSync(canonical))
+      continue;
+    if (!isSafeCachePath(canonical)) {
+      failed.push(`${canonical} (refused: failed safety check)`);
       continue;
     }
     try {
-      fs.rmSync(cachePath, { recursive: true, force: true });
-      cleared.push(cachePath);
+      fs.rmSync(canonical, { recursive: true, force: true });
+      cleared.push(canonical);
     } catch (err) {
-      failed.push(`${cachePath} (${err instanceof Error ? err.message : String(err)})`);
+      failed.push(`${canonical} (${err instanceof Error ? err.message : String(err)})`);
     }
   }
   return { cleared, failed };
@@ -289,19 +351,22 @@ function evictLockFiles() {
   for (const lockPath of OPENCODE_PLUGIN_LOCK_FILE_PATHS) {
     if (!fs.existsSync(lockPath))
       continue;
-    if (!isSafeLockFilePath(lockPath)) {
-      failed.push(`${lockPath} (refused: failed safety check)`);
+    const canonical = safeRealpathSync(lockPath, lockPath);
+    if (canonical === null || !fs.existsSync(canonical))
+      continue;
+    if (!isSafeLockFilePath(canonical)) {
+      failed.push(`${canonical} (refused: failed safety check)`);
       continue;
     }
     try {
-      fs.unlinkSync(lockPath);
-      cleared.push(lockPath);
+      fs.unlinkSync(canonical);
+      cleared.push(canonical);
     } catch (err) {
       const code = err?.code;
       if (code === "EISDIR") {
-        failed.push(`${lockPath} (path is a directory, not a file)`);
+        failed.push(`${canonical} (path is a directory, not a file)`);
       } else {
-        failed.push(`${lockPath} (${err instanceof Error ? err.message : String(err)})`);
+        failed.push(`${canonical} (${err instanceof Error ? err.message : String(err)})`);
       }
     }
   }
@@ -346,14 +411,24 @@ async function uninstall() {
     if (process.argv.includes("--clean")) {
       let cleaned = false;
       if (fs.existsSync(PLUGIN_CONFIG_PATH)) {
-        fs.unlinkSync(PLUGIN_CONFIG_PATH);
-        console.log(`\u2713 Removed plugin config: ${PLUGIN_CONFIG_PATH}`);
-        cleaned = true;
+        const canonical = safeRealpathSync(PLUGIN_CONFIG_PATH, PLUGIN_CONFIG_PATH);
+        if (canonical === null || !isSafePluginConfigPath(canonical)) {
+          console.log(`\u2717 Refused to remove plugin config (failed safety check): ${canonical ?? PLUGIN_CONFIG_PATH}`);
+        } else {
+          fs.unlinkSync(canonical);
+          console.log(`\u2713 Removed plugin config: ${canonical}`);
+          cleaned = true;
+        }
       }
       if (fs.existsSync(PROMPTS_DIR)) {
-        fs.rmSync(PROMPTS_DIR, { recursive: true });
-        console.log(`\u2713 Removed custom prompts: ${PROMPTS_DIR}`);
-        cleaned = true;
+        const canonical = safeRealpathSync(PROMPTS_DIR, PROMPTS_DIR);
+        if (canonical === null || !isSafePromptsDir(canonical)) {
+          console.log(`\u2717 Refused to remove custom prompts (failed safety check): ${canonical ?? PROMPTS_DIR}`);
+        } else {
+          fs.rmSync(canonical, { recursive: true });
+          console.log(`\u2713 Removed custom prompts: ${canonical}`);
+          cleaned = true;
+        }
       }
       if (!cleaned) {
         console.log("\u2713 No config files to clean up");
@@ -474,6 +549,8 @@ Valid commands: ${VALID_COMMANDS.join(", ")}`);
 }
 export {
   run,
+  isSafePromptsDir,
+  isSafePluginConfigPath,
   isSafeLockFilePath,
   isSafeCachePath,
   evictPluginCaches,

package/dist/cli/{knowledge-escalator-qn7ew687.js → knowledge-escalator-5gwp1ar8.js}

@@ -8,9 +8,9 @@ import {
   maybeEscalateOnViolation,
   maybeQuarantineOnContradiction,
   readRecentEscalations
-} from "./index-7stsmndb.js";
-import"./index-kjbfry6m.js";
-import"./index-91qesget.js";
+} from "./index-6f6y2rbp.js";
+import"./index-8f2270hc.js";
+import"./index-rk6qhyng.js";
 import"./index-bfwt3abw.js";
 import"./index-g40r5d08.js";
 import"./index-jtqkh8jf.js";

package/dist/cli/{knowledge-events-k2xsz5bh.js → knowledge-events-m304swh6.js}

@@ -25,7 +25,7 @@ import {
   resolveKnowledgeCounterBaselinePath,
   resolveKnowledgeEventsPath,
   resolveLegacyApplicationLogPath
-} from "./index-kjbfry6m.js";
+} from "./index-8f2270hc.js";
 import"./index-g40r5d08.js";
 import"./index-zgwm4ryv.js";
 import"./index-0p660a87.js";

package/dist/cli/{knowledge-store-ksa1dr2z.js → knowledge-store-9babt8rd.js}

@@ -34,7 +34,7 @@ import {
   transactFile,
   transactKnowledge,
   wordBigrams
-} from "./index-91qesget.js";
+} from "./index-rk6qhyng.js";
 import"./index-bfwt3abw.js";
 import"./index-g40r5d08.js";
 import"./index-jtqkh8jf.js";

package/dist/cli/{knowledge-validator-2knz0d2t.js → knowledge-validator-t9sym59g.js}

@@ -16,14 +16,15 @@ import {
   quarantineEntry,
   resolveUnactionablePath,
   restoreEntry,
+  scanContentSafety,
   unarchiveEntry,
   validateActionability,
   validateActionableFields,
   validateLesson,
   validateSkillCandidatePath,
   validateSkillPath
-} from "./index-qrnhvhmg.js";
-import"./index-91qesget.js";
+} from "./index-n18yy0z1.js";
+import"./index-rk6qhyng.js";
 import"./index-bfwt3abw.js";
 import"./index-g40r5d08.js";
 import"./index-jtqkh8jf.js";
@@ -41,6 +42,7 @@ export {
   validateActionableFields,
   validateActionability,
   unarchiveEntry,
+  scanContentSafety,
   restoreEntry,
   resolveUnactionablePath,
   quarantineEntry,

package/dist/cli/{skill-generator-w6qd9mde.js → skill-generator-tav44xpm.js}

@@ -33,10 +33,10 @@ import {
   sanitizeSlug,
   selectCandidateEntries,
   writeEvalStub
-} from "./index-vjvdvjd3.js";
-import"./index-qrnhvhmg.js";
-import"./index-kjbfry6m.js";
-import"./index-91qesget.js";
+} from "./index-x12hvfpf.js";
+import"./index-n18yy0z1.js";
+import"./index-8f2270hc.js";
+import"./index-rk6qhyng.js";
 import"./index-bfwt3abw.js";
 import"./index-g40r5d08.js";
 import"./index-jtqkh8jf.js";

package/dist/config/skill-mirrors.d.ts

@@ -88,6 +88,18 @@ export declare const ADDITIONAL_SKILL_MIRROR_CONTRACTS: Array<{
     kind: 'identical' | 'divergent' | 'opencode-only';
     canonical?: '.claude' | '.opencode';
     extraIdenticalPaths?: string[];
+    /**
+     * For `divergent` pairs only: a set of Markdown section headings that must be
+     * present in BOTH trees (`.opencode` and `.claude`). Divergence is still
+     * allowed for genuinely runtime-specific prose (title line, `effort:`
+     * frontmatter, "(Claude Code)" phrasing), but these designated safety
+     * sections are parity-enforced by scripts/drift-check.ts so a whole safety
+     * guard cannot silently exist in one tree and be absent from the other.
+     * Match is a substring test, so a heading may omit a trailing parenthetical.
+     * Fixes the M13 skill-mirror safety-drift defect: the divergent branch
+     * previously did existence-only checks with no content comparison.
+     */
+    sharedSafetyHeadings?: string[];
     reason: string;
 }>;
 /**

package/dist/hooks/adversarial-detector.d.ts

@@ -38,6 +38,12 @@ export declare function handleDebuggingSpiral(match: AdversarialPatternMatch, ta
     checkpointCreated: boolean;
     message: string;
 }>;
+/**
+ * Test seam: current number of distinct sessions tracked for spiral detection.
+ * Used by unit tests to assert the FIFO key-count cap holds; the map itself stays
+ * module-private so production callers cannot mutate it.
+ */
+export declare function recentToolCallSessionCount(): number;
 /**
  * Record a tool call for debugging spiral detection.
  * Call this from toolAfter to track repetitive patterns.

package/dist/hooks/delegation-gate.d.ts

@@ -68,6 +68,25 @@ interface ValidationContext {
  * Returns { valid: true } on success, or { valid: false; reason: string } on failure.
  */
 export declare function validateDelegationEnvelope(envelope: unknown, context: ValidationContext): EnvelopeValidationResult;
+/**
+ * M15 advisory-only delegation-envelope check. NON-BLOCKING by contract: it
+ * NEVER throws and NEVER rejects a delegation. It runs
+ * {@link validateDelegationEnvelope} (previously reachable only from tests) on a
+ * delegation prompt that ALREADY parses as a structured `DelegationEnvelope`,
+ * and on validation failure appends a concise advisory to
+ * `session.pendingAdvisoryMessages` — the existing non-blocking channel.
+ *
+ * A real, minimal free-text delegation (TASK:/FILE:/... with no structured
+ * envelope) is a no-op: {@link parseDelegationEnvelope} returns `null`, so no
+ * advisory is produced and nothing is rejected. The new optional `specCriteria`
+ * field is OPTIONAL in the validator — a missing field passes silently; only a
+ * populated-but-malformed field surfaces an advisory.
+ *
+ * @returns the validation result when an envelope was parsed, or `null` when the
+ *   prompt was not a structured envelope. Return value is for tests/telemetry;
+ *   the side effect (advisory push) is the production purpose.
+ */
+export declare function appendDelegationEnvelopeAdvisory(session: AgentSessionState, promptText: string, context: ValidationContext): EnvelopeValidationResult | null;
 interface MessageInfo {
     role: string;
     agent?: string;

package/dist/hooks/guardrails/index.d.ts

@@ -38,8 +38,9 @@ export declare function enforceSpecDriftGate(directory: string | undefined, tool
 declare function extractErrorSignal(errorContent: unknown): string;
 /**
  * Redacts sensitive values from a shell command string before audit logging.
+ * Single-sourced from ./helpers (which additionally redacts home paths).
  */
-export declare function redactShellCommand(cmd: string): string;
+export { redactShellCommand } from './helpers';
 /**
  * Creates guardrails hooks for circuit breaker protection
  * @param directory Working directory from plugin init context (required)
@@ -80,4 +81,3 @@ export declare function createGuardrailsHooks(directory: string, directoryOrConf
         }>;
     }) => Promise<void>;
 };
-export {};

package/dist/hooks/knowledge-validator.d.ts

@@ -12,6 +12,28 @@ export declare const DANGEROUS_COMMAND_PATTERNS: RegExp[];
 export declare const SECURITY_DEGRADING_PATTERNS: RegExp[];
 export declare const INVISIBLE_FORMAT_CHARS: RegExp;
 export declare const INJECTION_PATTERNS: RegExp[];
+/**
+ * Layer-2 content-safety scan for a single string value. Runs the same
+ * *blocking* pattern sets {@link validateLesson}'s Layer-2 block uses —
+ * dangerous-command errors, security-degrading instructions, and
+ * prompt-injection patterns — over an arbitrary short string (e.g. a
+ * directive-action field value such as `triggers` / `required_actions` /
+ * `forbidden_actions` / `verification_checks`).
+ *
+ * Returns a blocking reason string on the first match, or `null` when the value
+ * is content-safe. Mirrors validateLesson's normalization exactly: NFKC +
+ * invisible-format-char stripping + whitespace collapse + lowercase for the
+ * dangerous/security scans, and tests the RAW string for the injection patterns
+ * (normalization would strip the very control/invisible characters those
+ * patterns are meant to detect).
+ *
+ * The warning-severity dangerous-command patterns are intentionally NOT applied
+ * here: validateLesson treats them as non-blocking warnings (they match benign
+ * shell snippets like backticks and `$(...)` that legitimately appear in
+ * actionable directives), so promoting them to hard rejections on field values
+ * would create false positives without a corresponding safety gain.
+ */
+export declare function scanContentSafety(text: string): string | null;
 /**
  * Extract context words around each occurrence of a target word (single tokens within a window).
  * Context window is 3 words before and after, excluding the target word itself.

package/dist/index.d.ts

@@ -1,4 +1,11 @@
 import type { Plugin } from '@opencode-ai/plugin';
+/**
+ * FIFO-cap a session-keyed Map to at most `max` entries, evicting oldest first.
+ * Values tracked by these maps are plain data (timestamps/usage snapshots), never
+ * timer handles, so eviction requires no clearInterval/clearTimeout. Exported for
+ * unit testing of the cap invariant; used by the heartbeat throttle path below.
+ */
+export declare function capSessionMap<K, V>(map: Map<K, V>, max: number): void;
 declare const _default: {
     id: "opencode-swarm";
     server: Plugin;