opencode-swarm 7.114.7 → 7.114.9

package/dist/hooks/delegation-gate.d.ts

@@ -68,6 +68,25 @@ interface ValidationContext {
  * Returns { valid: true } on success, or { valid: false; reason: string } on failure.
  */
 export declare function validateDelegationEnvelope(envelope: unknown, context: ValidationContext): EnvelopeValidationResult;
+/**
+ * M15 advisory-only delegation-envelope check. NON-BLOCKING by contract: it
+ * NEVER throws and NEVER rejects a delegation. It runs
+ * {@link validateDelegationEnvelope} (previously reachable only from tests) on a
+ * delegation prompt that ALREADY parses as a structured `DelegationEnvelope`,
+ * and on validation failure appends a concise advisory to
+ * `session.pendingAdvisoryMessages` — the existing non-blocking channel.
+ *
+ * A real, minimal free-text delegation (TASK:/FILE:/... with no structured
+ * envelope) is a no-op: {@link parseDelegationEnvelope} returns `null`, so no
+ * advisory is produced and nothing is rejected. The new optional `specCriteria`
+ * field is OPTIONAL in the validator — a missing field passes silently; only a
+ * populated-but-malformed field surfaces an advisory.
+ *
+ * @returns the validation result when an envelope was parsed, or `null` when the
+ *   prompt was not a structured envelope. Return value is for tests/telemetry;
+ *   the side effect (advisory push) is the production purpose.
+ */
+export declare function appendDelegationEnvelopeAdvisory(session: AgentSessionState, promptText: string, context: ValidationContext): EnvelopeValidationResult | null;
 interface MessageInfo {
     role: string;
     agent?: string;

package/dist/hooks/guardrails/index.d.ts

@@ -38,8 +38,9 @@ export declare function enforceSpecDriftGate(directory: string | undefined, tool
 declare function extractErrorSignal(errorContent: unknown): string;
 /**
  * Redacts sensitive values from a shell command string before audit logging.
+ * Single-sourced from ./helpers (which additionally redacts home paths).
  */
-export declare function redactShellCommand(cmd: string): string;
+export { redactShellCommand } from './helpers';
 /**
  * Creates guardrails hooks for circuit breaker protection
  * @param directory Working directory from plugin init context (required)
@@ -80,4 +81,3 @@ export declare function createGuardrailsHooks(directory: string, directoryOrConf
         }>;
     }) => Promise<void>;
 };
-export {};

package/dist/hooks/knowledge-validator.d.ts

@@ -12,6 +12,28 @@ export declare const DANGEROUS_COMMAND_PATTERNS: RegExp[];
 export declare const SECURITY_DEGRADING_PATTERNS: RegExp[];
 export declare const INVISIBLE_FORMAT_CHARS: RegExp;
 export declare const INJECTION_PATTERNS: RegExp[];
+/**
+ * Layer-2 content-safety scan for a single string value. Runs the same
+ * *blocking* pattern sets {@link validateLesson}'s Layer-2 block uses —
+ * dangerous-command errors, security-degrading instructions, and
+ * prompt-injection patterns — over an arbitrary short string (e.g. a
+ * directive-action field value such as `triggers` / `required_actions` /
+ * `forbidden_actions` / `verification_checks`).
+ *
+ * Returns a blocking reason string on the first match, or `null` when the value
+ * is content-safe. Mirrors validateLesson's normalization exactly: NFKC +
+ * invisible-format-char stripping + whitespace collapse + lowercase for the
+ * dangerous/security scans, and tests the RAW string for the injection patterns
+ * (normalization would strip the very control/invisible characters those
+ * patterns are meant to detect).
+ *
+ * The warning-severity dangerous-command patterns are intentionally NOT applied
+ * here: validateLesson treats them as non-blocking warnings (they match benign
+ * shell snippets like backticks and `$(...)` that legitimately appear in
+ * actionable directives), so promoting them to hard rejections on field values
+ * would create false positives without a corresponding safety gain.
+ */
+export declare function scanContentSafety(text: string): string | null;
 /**
  * Extract context words around each occurrence of a target word (single tokens within a window).
  * Context window is 3 words before and after, excluding the target word itself.

package/dist/index.d.ts

@@ -1,4 +1,11 @@
 import type { Plugin } from '@opencode-ai/plugin';
+/**
+ * FIFO-cap a session-keyed Map to at most `max` entries, evicting oldest first.
+ * Values tracked by these maps are plain data (timestamps/usage snapshots), never
+ * timer handles, so eviction requires no clearInterval/clearTimeout. Exported for
+ * unit testing of the cap invariant; used by the heartbeat throttle path below.
+ */
+export declare function capSessionMap<K, V>(map: Map<K, V>, max: number): void;
 declare const _default: {
     id: "opencode-swarm";
     server: Plugin;