opencode-swarm 7.114.9 → 7.116.0

package/dist/mutation/engine.d.ts

@@ -1,6 +1,6 @@
 import { spawnSync } from 'node:child_process';
-type SpawnSyncFn = typeof spawnSync;
-export type MutationOutcome = 'killed' | 'survived' | 'timeout' | 'error' | 'equivalent' | 'skipped';
+import { resolveExecutableFromPath, runExternalTool } from '../utils/external-tool-runner.js';
+export type MutationOutcome = 'killed' | 'survived' | 'timeout' | 'cancelled' | 'error' | 'equivalent' | 'skipped';
 /**
  * Known test runner executables permitted as the first element of testCommand.
  * Validated as the basename (without extension) to support platform-specific
@@ -35,6 +35,7 @@ export interface MutationReport {
     killed: number;
     survived: number;
     timeout: number;
+    cancelled: number;
     equivalent: number;
     skipped: number;
     errors: number;
@@ -55,13 +56,36 @@ export interface MutationReport {
     timestamp: string;
 }
 export declare const MAX_MUTATIONS_PER_FUNCTION = 10;
+type LegacySpawnSyncFn = typeof spawnSync;
+export type MutationCommandResult = {
+    status: 'completed' | 'timeout' | 'cancelled' | 'spawn-error';
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+    message?: string;
+};
+export type MutationCommandRunner = (args: {
+    executable: string;
+    args: string[];
+    cwd: string;
+    timeoutMs: number;
+    abortSignal?: AbortSignal;
+}) => Promise<MutationCommandResult>;
+export type MutationExecutionOptions = {
+    abortSignal?: AbortSignal;
+    runner?: MutationCommandRunner;
+};
+export declare const runMutationCommand: MutationCommandRunner;
 export declare const _internals: {
     executeMutation: typeof executeMutation;
     computeReport: typeof computeReport;
     executeMutationSuite: typeof executeMutationSuite;
-    spawnSync: SpawnSyncFn;
+    spawnSync: LegacySpawnSyncFn;
+    runCommand: MutationCommandRunner;
+    runExternalTool: typeof runExternalTool;
+    resolveExecutableFromPath: typeof resolveExecutableFromPath;
 };
-export declare function executeMutation(patch: MutationPatch, testCommand: string[], testFiles: string[], workingDir: string): Promise<MutationResult>;
+export declare function executeMutation(patch: MutationPatch, testCommand: string[], testFiles: string[], workingDir: string, options?: MutationExecutionOptions): Promise<MutationResult>;
 export declare function computeReport(results: MutationResult[], durationMs: number, budgetMs?: number): MutationReport;
-export declare function executeMutationSuite(patches: MutationPatch[], testCommand: string[], testFiles: string[], workingDir: string, budgetMs?: number, onProgress?: (completed: number, total: number, result: MutationResult) => void, sourceFiles?: Map<string, string>): Promise<MutationReport>;
+export declare function executeMutationSuite(patches: MutationPatch[], testCommand: string[], testFiles: string[], workingDir: string, budgetMs?: number, onProgress?: (completed: number, total: number, result: MutationResult) => void, sourceFiles?: Map<string, string>, options?: MutationExecutionOptions): Promise<MutationReport>;
 export {};

package/dist/telemetry.d.ts

@@ -1,5 +1,14 @@
 import type { DelegationCostFields } from './services/cost-accounting.js';
-export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activated' | 'delegation_begin' | 'delegation_end' | 'task_state_changed' | 'gate_passed' | 'gate_failed' | 'gate_parse_error' | 'phase_changed' | 'budget_updated' | 'model_fallback' | 'hard_limit_hit' | 'revision_limit_hit' | 'loop_detected' | 'scope_violation' | 'qa_skip_violation' | 'heartbeat' | 'turbo_mode_changed' | 'auto_oversight_escalation' | 'environment_detected' | 'evidence_lock_acquired' | 'evidence_lock_contended' | 'evidence_lock_stale_recovered' | 'plan_ledger_cas_retry' | 'plan_md_write_failed' | 'snapshot_failed' | 'prm_pattern_detected' | 'prm_course_correction_injected' | 'prm_escalation_triggered' | 'prm_hard_stop';
+export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activated' | 'delegation_begin' | 'delegation_end' | 'task_state_changed' | 'gate_passed' | 'gate_failed' | 'gate_parse_error' | 'reviewer_gate_decision' | 'phase_changed' | 'budget_updated' | 'model_fallback' | 'hard_limit_hit' | 'revision_limit_hit' | 'loop_detected' | 'scope_violation' | 'qa_skip_violation' | 'heartbeat' | 'turbo_mode_changed' | 'auto_oversight_escalation' | 'environment_detected' | 'evidence_lock_acquired' | 'evidence_lock_contended' | 'evidence_lock_stale_recovered' | 'plan_ledger_cas_retry' | 'plan_md_write_failed' | 'snapshot_failed' | 'prm_pattern_detected' | 'prm_course_correction_injected' | 'prm_escalation_triggered' | 'prm_hard_stop';
+/** Stable classification for how a reviewer-gate decision was established. */
+export type ReviewerGateEvidenceKind = 'genuine' | 'fallback' | 'data_quality' | 'block';
+/**
+ * Stable reason codes for reviewer-gate decision telemetry.
+ *
+ * These values are persisted in telemetry.jsonl and consumed by offline gate
+ * analytics, so additions are allowed but existing values must not be renamed.
+ */
+export type ReviewerGateReasonCode = 'lean_turbo_completed_lane' | 'standard_turbo_non_tier3' | 'durable_evidence_complete' | 'workflow_state_complete' | 'stage_b_parallel_complete' | 'no_active_sessions' | 'zero_valid_sessions' | 'restart_recovery_complete' | 'scoped_delegation_complete' | 'unscoped_delegation_complete' | 'corrupt_evidence' | 'required_gates_missing' | 'inspection_error';
 export type TelemetryListener = (event: TelemetryEvent, data: Record<string, unknown>) => void;
 /**
  * Number of emits between rotation checks. 50 keeps the overhead at one
@@ -48,6 +57,7 @@ export declare const telemetry: {
     gatePassed(sessionId: string, gate: string, taskId: string): void;
     gateParseError(taskId: string, error: Error): void;
     gateFailed(sessionId: string, gate: string, taskId: string, reason: string): void;
+    reviewerGateDecision(sessionId: string, taskId: string, blocked: boolean, reasonCode: ReviewerGateReasonCode, evidenceKind: ReviewerGateEvidenceKind): void;
     phaseChanged(sessionId: string, oldPhase: number, newPhase: number): void;
     budgetUpdated(sessionId: string, budgetPct: number, agentName: string): void;
     modelFallback(sessionId: string, agentName: string, fromModel: string, toModel: string, reason: string): void;

package/dist/tools/apply-patch.d.ts

@@ -7,6 +7,17 @@
  * Pure TypeScript, no shell/git/external binaries, standard node:fs sync I/O.
  */
 import type { ToolDefinition } from '@opencode-ai/plugin/tool';
+import { loadPluginConfigWithMeta } from '../config';
+/**
+ * DI seam for hermetic config-load substitution in tests (AGENTS.md invariant 7).
+ * Mirrors the pattern at `src/tools/context-status.ts:81-88`. Tests override
+ * `_internals.loadPluginConfigWithMeta` and restore it in `afterEach` instead
+ * of writing real config files or using `mock.module` (which leaks across
+ * test files in Bun's shared runner).
+ */
+export declare const _internals: {
+    loadPluginConfigWithMeta: typeof loadPluginConfigWithMeta;
+};
 /** Per-file error detail in the structured output. */
 export interface ApplyPatchFileError {
     hunkIndex: number;
@@ -45,6 +56,16 @@ export interface ApplyPatchArgs {
     allowCreates?: boolean;
     allowDeletes?: boolean;
 }
+/**
+ * Opt-in fuzzy-matching options threaded from `execute` → `processFileDiff`
+ * → `applyHunks`. Both flags default false (exact-match-only, B3 decision).
+ */
+export interface ApplyHunksOptions {
+    /** Enable fuzzy fallback (strategies 1-8) on exact-match failure. */
+    fuzzyMatch: boolean;
+    /** Additionally enable strategy 9 (context_aware). Only effective with fuzzyMatch. */
+    fuzzyMatchContextAware: boolean;
+}
 /**
  * Swarm unified-diff patch tool (formerly registered as apply_patch).
  * Renamed to swarm_apply_patch so it no longer shadows the native opencode

package/dist/tools/plugin-registration.d.ts

@@ -11,6 +11,7 @@
 import type { ToolDefinition } from '@opencode-ai/plugin/tool';
 import type { AgentDefinition } from '../agents/index.js';
 import type { PluginConfig } from '../config/index.js';
+import type { EvaluationModelDispatcher } from '../evaluation/model-dispatcher.js';
 /**
  * Construct the plugin tool object: one handler per manifest entry, with
  * `swarm_command` overridden by its dependency-injected instance.
@@ -21,4 +22,4 @@ import type { PluginConfig } from '../config/index.js';
  *
  * Knowledge tools are conditionally excluded when config.knowledge.enabled = false.
  */
-export declare function buildPluginToolObject(agents: Record<string, AgentDefinition>, config?: PluginConfig): Record<string, ToolDefinition>;
+export declare function buildPluginToolObject(agents: Record<string, AgentDefinition>, config?: PluginConfig, evaluationModelDispatcher?: EvaluationModelDispatcher): Record<string, ToolDefinition>;

package/dist/tools/sast-scan.d.ts

@@ -5,9 +5,16 @@
 import type { ToolDefinition } from '@opencode-ai/plugin/tool';
 import type { PluginConfig } from '../config';
 import type { EvidenceVerdict } from '../config/evidence-schema';
+import { isSemgrepAvailable, runSemgrep } from '../sast/semgrep';
 export interface SastScanInput {
     /** List of files to scan */
     changed_files: string[];
+    /**
+     * Restrict execution to built-in Tier A rules. This is used by isolated,
+     * reproducible evaluation runs where PATH discovery and Semgrep execution
+     * (including remote `--config=auto`) are forbidden.
+     */
+    offline_only?: boolean;
     /** Minimum severity that causes failure (default: 'medium') */
     severity_threshold?: 'low' | 'medium' | 'high' | 'critical';
     /**
@@ -94,4 +101,6 @@ export declare const sast_scan: ToolDefinition;
 export declare const _internals: {
     sastScan: typeof sastScan;
     sast_scan: typeof sast_scan;
+    isSemgrepAvailable: typeof isSemgrepAvailable;
+    runSemgrep: typeof runSemgrep;
 };

package/dist/tools/swarm-command.d.ts

@@ -1,4 +1,5 @@
 import type { AgentDefinition } from '../agents/index.js';
+import type { EvaluationModelDispatcher } from '../evaluation/model-dispatcher.js';
 import { createSwarmTool } from './create-tool.js';
-export declare function createSwarmCommandTool(agents: Record<string, AgentDefinition>): ReturnType<typeof createSwarmTool>;
+export declare function createSwarmCommandTool(agents: Record<string, AgentDefinition>, evaluationModelDispatcher?: EvaluationModelDispatcher): ReturnType<typeof createSwarmTool>;
 export declare const swarm_command: ReturnType<typeof createSwarmTool>;

package/dist/tools/update-task-status.d.ts

@@ -3,8 +3,12 @@
  * Allows agents to mark tasks as pending, in_progress, completed, or blocked.
  */
 import type { ToolContext, ToolDefinition } from '@opencode-ai/plugin/tool';
+import { readTaskEvidenceRaw } from '../gate-evidence.js';
 import { tryAcquireLock } from '../parallel/file-locks.js';
 import { loadPlan, updateTaskStatus } from '../plan/manager';
+import { hasActiveLeanTurbo, hasActiveTurboMode } from '../state';
+import { type ReviewerGateEvidenceKind, type ReviewerGateReasonCode } from '../telemetry.js';
+import { verifyLeanTurboTaskCompletion } from '../turbo/lean/task-completion';
 import { resolveWorkingDirectory } from './resolve-working-directory';
 /**
  * Internal seams for test injection.
@@ -12,10 +16,16 @@ import { resolveWorkingDirectory } from './resolve-working-directory';
  * module-scope vi.mock, which leaks across files in Bun's shared test runner.
  */
 export declare const _internals: {
-    readonly tryAcquireLock: typeof tryAcquireLock;
-    readonly updateTaskStatus: typeof updateTaskStatus;
-    readonly resolveWorkingDirectory: typeof resolveWorkingDirectory;
-    readonly loadPlan: typeof loadPlan;
+    tryAcquireLock: typeof tryAcquireLock;
+    updateTaskStatus: typeof updateTaskStatus;
+    resolveWorkingDirectory: typeof resolveWorkingDirectory;
+    loadPlan: typeof loadPlan;
+    readTaskEvidenceRaw: typeof readTaskEvidenceRaw;
+    hasActiveLeanTurbo: typeof hasActiveLeanTurbo;
+    hasActiveTurboMode: typeof hasActiveTurboMode;
+    verifyLeanTurboTaskCompletion: typeof verifyLeanTurboTaskCompletion;
+    hasPassedDurableGateEvidence: typeof hasPassedDurableGateEvidence;
+    emitReviewerGateDecision: (sessionId: string, taskId: string, blocked: boolean, reasonCode: ReviewerGateReasonCode, evidenceKind: ReviewerGateEvidenceKind) => void;
 };
 /**
  * Arguments for the update_task_status tool
@@ -58,6 +68,7 @@ export interface ReviewerGateResult {
     blocked: boolean;
     reason: string;
 }
+declare function hasPassedDurableGateEvidence(workingDirectory: string, taskId: string): boolean;
 /**
  * Check if a task has passed required QA gates using the state machine.
  * Requires the task to be in 'tests_run' or 'complete' state, which means
@@ -138,3 +149,4 @@ export declare function executeUpdateTaskStatus(args: UpdateTaskStatusArgs, fall
  * Tool definition for update_task_status
  */
 export declare const update_task_status: ToolDefinition;
+export {};

package/dist/utils/external-tool-runner.d.ts

@@ -7,9 +7,10 @@ export interface ExternalToolRunOptions {
     maxStdoutBytes: number;
     maxStderrBytes: number;
     env?: Record<string, string | undefined>;
+    abortSignal?: AbortSignal;
 }
 export interface ExternalToolRunResult {
-    status: 'completed' | 'timeout' | 'spawn-error';
+    status: 'completed' | 'timeout' | 'cancelled' | 'spawn-error';
     exitCode: number | null;
     stdout: string;
     stderr: string;

package/dist/utils/fuzzy-match.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Fuzzy text-matching engine — faithful TypeScript port of hermes-agent's
+ * `tools/fuzzy_match.py` (issue #1718).
+ *
+ * Implements a 9-strategy matching chain that finds and replaces text,
+ * tolerating the whitespace, indentation, escape-sequence, and Unicode
+ * drift common in LLM-generated patches. Integrated into `apply-patch`
+ * as an **opt-in fallback** (default off) gated by the `apply_patch.fuzzy_match`
+ * and `apply_patch.fuzzy_match_context_aware` config flags.
+ *
+ * Porting conventions:
+ * - Operates on **UTF-16 code units** consistently (`s[i]`, `s.length`).
+ *   Matches `src/utils/sequence-matcher.ts`. Round-trip safe.
+ * - Per-line stripping uses JS `String.prototype.trim()`, which strips the
+ *   Unicode WhiteSpace + LineTerminator set. Coincides with Python
+ *   `str.strip()` for the ASCII/BMP content in the test suite; minor
+ *   divergence on exotic whitespace categories is acceptable.
+ * - Strategy 9 (`contextAware`) is opt-in via the `includeContextAware`
+ *   option to `fuzzyFindAndReplace`. It is the loosest, most-false-positive-
+ *   prone strategy and is separately gated in apply-patch by
+ *   `apply_patch.fuzzy_match_context_aware`.
+ */
+/** A `[start, end)` character span in the content string. */
+type Span = [number, number];
+/** Result of {@link fuzzyFindAndReplace}. */
+export interface FuzzyResult {
+    /** Modified content on success; original content on failure. */
+    content: string;
+    /** Number of replacements made (0 on failure). */
+    matchCount: number;
+    /** Name of the strategy that matched, or `null` on failure. */
+    strategy: string | null;
+    /** `null` on success; an error description on failure. */
+    error: string | null;
+}
+/** Options for {@link fuzzyFindAndReplace}. */
+export interface FuzzyOptions {
+    /**
+     * When true (default at the utility level), the `context_aware` strategy
+     * (9) is included in the chain. Strategy 9 is the loosest/most-false-
+     * positive-prone strategy (requires 50% of lines to reach 0.80 per-line
+     * similarity) and has quadratic cost, so it is bounded by an internal
+     * cell-count cap.
+     *
+     * **Default divergence (intentional):** the utility defaults this to
+     * `true` so the byte-faithful ported hermes test suite passes unmodified
+     * (strategy 9 is a legitimate part of the matching chain and some test
+     * cases depend on it). The `apply-patch` integration — the only consumer
+     * today — explicitly passes `false` unless the separate
+     * `apply_patch.fuzzy_match_context_aware` config flag is set, honoring
+     * issue #1718's Non-Goal "do not port strategy 9 as default-on" at the
+     * integration layer. New callers should pass `false` unless they
+     * specifically want strategy 9.
+     */
+    includeContextAware?: boolean;
+}
+/**
+ * Maps Unicode typographic characters to their ASCII equivalents.
+ * Some replacements EXPAND a single code point into multiple ASCII chars
+ * (em-dash → "--", ellipsis → "..."); the position-remap helpers handle the
+ * resulting offset divergence.
+ */
+export declare const UNICODE_MAP: Record<string, string>;
+/** Normalize Unicode typographic characters to ASCII equivalents. */
+export declare function unicodeNormalize(text: string): string;
+/**
+ * Find and replace text using a chain of increasingly fuzzy strategies.
+ *
+ * Strategies are tried in order; the first that yields matches wins. On a
+ * unique match (or when `replaceAll` is true), the replacement is applied.
+ * On failure, returns the original content with an error description.
+ *
+ * Guards (ported verbatim from hermes):
+ * - Ambiguity: `>1 match && !replaceAll` → fail with a helpful message.
+ * - Escape-drift: `\'`/`\"` present in both old+new but absent from the
+ *   matched file region → block (transport serialization artifact).
+ * - Selective unescape: `\t`/`\r` in new_string → real bytes only when the
+ *   matched file region contains the corresponding control char. `\n` excluded.
+ * - Unicode preservation: under strategy 7, unchanged spans keep the file's
+ *   original Unicode characters rather than the ASCII-normalized equivalents.
+ */
+export declare function fuzzyFindAndReplace(content: string, oldString: string, newString: string, replaceAll?: boolean, options?: FuzzyOptions): FuzzyResult;
+/** Strategy 1: exact string match, non-overlapping. */
+export declare function strategyExact(content: string, pattern: string): Span[];
+/** Strategy 2: per-line `.trim()` + block equality. */
+export declare function strategyLineTrimmed(content: string, pattern: string): Span[];
+/** Strategy 3: collapse `[ \t]+` → single space, preserve newlines. */
+export declare function strategyWhitespaceNormalized(content: string, pattern: string): Span[];
+/** Strategy 4: strip all leading whitespace per line (lstrip). */
+export declare function strategyIndentationFlexible(content: string, pattern: string): Span[];
+/** Strategy 5: unescape `\n`/`\t`/`\r` literals → bytes, then exact match. */
+export declare function strategyEscapeNormalized(content: string, pattern: string): Span[];
+/** Strategy 6: trim only first and last lines, sliding window. */
+export declare function strategyTrimmedBoundary(content: string, pattern: string): Span[];
+/** Strategy 7: Unicode normalization (smart quotes, em/en dash, ellipsis, NBSP). */
+export declare function strategyUnicodeNormalized(content: string, pattern: string): Span[];
+/** Strategy 8: anchor on first+last lines, similarity for the middle. */
+export declare function strategyBlockAnchor(content: string, pattern: string): Span[];
+export declare function strategyContextAware(content: string, pattern: string): Span[];
+/**
+ * Find lines in `content` most similar to `oldString` for "did you mean?" feedback.
+ *
+ * Returns a formatted string showing the closest matching lines with context
+ * and line numbers, or `''` if no useful match is found.
+ */
+export declare function findClosestLines(oldString: string, content: string, contextLines?: number, maxResults?: number): string;
+/**
+ * Return a "Did you mean..." snippet for plain no-match errors.
+ *
+ * Gated so the hint only fires for actual "old_string not found" failures.
+ * Ambiguous-match, escape-drift, and identical-strings errors all have
+ * `matchCount === 0` but a did-you-mean snippet would be misleading.
+ */
+export declare function formatNoMatchHint(error: string | null, matchCount: number, oldString: string, content: string): string;
+export {};

package/dist/utils/sequence-matcher.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Faithful TypeScript port of CPython's `difflib.SequenceMatcher`.
+ *
+ * Implements the Ratcliff/Obershelp pattern-matching algorithm with the
+ * "popular element" (autojunk) guard, so that `.ratio()` produces values
+ * identical to CPython 3.x for the BMP character content used by the
+ * fuzzy-match strategies. The thresholds in `src/utils/fuzzy-match.ts`
+ * (0.50 / 0.70 / 0.80) were tuned against CPython's exact `2*M/T` ratio
+ * formula, so substituting a Levenshtein-based library would silently
+ * break those thresholds.
+ *
+ * Porting notes:
+ * - Operates on **UTF-16 code units** (`s[i]`, `s.length`, `s.charCodeAt(i)`)
+ *   consistently throughout. CPython operates on Unicode code points; for
+ *   ASCII/BMP content the two coincide. Astral-plane characters (emoji)
+ *   consume two UTF-16 units, so ratios for emoji-heavy input may differ
+ *   marginally from CPython. This is acceptable for the fuzzy-match use
+ *   case (source-code patches) and is round-trip-safe — no index mixing,
+ *   no file corruption.
+ * - `autojunk` defaults to `true`, matching CPython. When `b.length >= 200`
+ *   and an element appears more than 1% of the time in `b`, it is treated
+ *   as "popular" and excluded as an anchor candidate in `find_longest_match`.
+ *   This is essential for ratio fidelity on real file sections.
+ */
+export interface Match {
+    /** Start index in sequence `a`. */
+    a: number;
+    /** Start index in sequence `b`. */
+    b: number;
+    /** Length of the matching block. */
+    size: number;
+}
+export type OpcodeTag = 'equal' | 'replace' | 'delete' | 'insert';
+export interface Opcode {
+    tag: OpcodeTag;
+    i1: number;
+    i2: number;
+    j1: number;
+    j2: number;
+}
+/** A predicate that marks a character as "junk" (never a sync point). */
+export type IsJunk = ((ch: string) => boolean) | null;
+/**
+ * Difflib-compatible sequence matcher. Construct with two strings, then
+ * call `.ratio()`, `.get_matching_blocks()`, or `.get_opcodes()`.
+ */
+export declare class SequenceMatcher {
+    private a;
+    private b;
+    private isJunk;
+    private autoJunk;
+    private b2j;
+    private popularSet;
+    private matchingBlocks;
+    constructor(isJunk: IsJunk, a: string, b: string, autoJunk?: boolean);
+    /** Allow changing the input sequences (mirrors CPython `set_seqs`/`set_seq2`). */
+    setSeqs(a: string, b: string): void;
+    /** Precompute the `b` index map and the popular-element set. */
+    private chainB;
+    /**
+     * Find the longest matching block in `a[alo:ahi]` and `b[blo:bhi]`.
+     *
+     * Returns `{ a, b, size }` where `size` is maximal; ties are broken by
+     * smallest `a`, then smallest `b` (CPython canonical tiebreak).
+     *
+     * A "match" means `a[i] === b[j]` and the run extends as far as possible.
+     * Elements in the popular set are only used as anchor candidates when no
+     * non-popular match exists (CPython behavior: popular elements are
+     * excluded from `b2j`, so they only match opportunistically via the
+     * extending run after a non-popular anchor).
+     */
+    findLongestMatch(alo: number, ahi: number, blo: number, bhi: number): Match;
+    /** Recursively compute the list of matching blocks (descending order). */
+    getMatchingBlocks(): Match[];
+    /**
+     * Return a float in [0, 1]: `2*M / T`, where `M` is the total matched
+     * characters and `T` is the sum of the two sequence lengths.
+     * Returns `1.0` when both sequences are empty (matches CPython).
+     */
+    ratio(): number;
+    /** Compute the opcodes describing how to turn `a` into `b`. */
+    getOpcodes(): Opcode[];
+}

package/evaluation-fixtures/tier1/boundary-error/environment/baseline.ts

@@ -0,0 +1,3 @@
+export function validPort(port: number): boolean {
+	return port >= 1 && port <= 65_535;
+}

package/evaluation-fixtures/tier1/boundary-error/environment/defect.test.ts

@@ -0,0 +1,3 @@
+import { expect, test } from 'bun:test';
+import { validPort } from './defect';
+test('rejects the first invalid port', () => expect(validPort(65_536)).toBe(false));

package/evaluation-fixtures/tier1/boundary-error/environment/defect.ts

@@ -0,0 +1,3 @@
+export function validPort(port: number): boolean {
+	return port >= 1 && port <= 65_536;
+}

package/evaluation-fixtures/tier1/boundary-error/instruction.md

@@ -0,0 +1 @@
+Inspect the upper-bound validation in `environment/defect.ts` and identify the invalid value it permits.

package/evaluation-fixtures/tier1/boundary-error/manifest.json

@@ -0,0 +1 @@
+{"v":1,"id":"boundary-error","source":"curated","split":"train","category":"boundary-error","protected":true,"instructionPath":"instruction.md","environment":{"kind":"fixture","path":"environment"},"scorer":{"kind":"builtin","argv":["tier1-defect"],"timeoutMs":30000,"scoreRange":[0,1]},"provenance":{"origin":"opencode-swarm#1820","license":"MIT"},"contentHash":"ac9cd9f603d86640900fe3af16e7373a322eb5deff009b72bdf4239df13661b8"}

package/evaluation-fixtures/tier1/branch-swap/environment/baseline.ts

@@ -0,0 +1,3 @@
+export function accessLabel(admin: boolean): string {
+	return admin ? 'admin' : 'user';
+}

package/evaluation-fixtures/tier1/branch-swap/environment/defect.test.ts

@@ -0,0 +1,3 @@
+import { expect, test } from 'bun:test';
+import { accessLabel } from './defect';
+test('labels administrators', () => expect(accessLabel(true)).toBe('admin'));

package/evaluation-fixtures/tier1/branch-swap/environment/defect.ts

@@ -0,0 +1,3 @@
+export function accessLabel(admin: boolean): string {
+	return admin ? 'user' : 'admin';
+}

package/evaluation-fixtures/tier1/branch-swap/instruction.md

@@ -0,0 +1 @@
+Inspect `environment/defect.ts` for swapped conditional branches and report the incorrect results.

package/evaluation-fixtures/tier1/branch-swap/manifest.json

@@ -0,0 +1 @@
+{"v":1,"id":"branch-swap","source":"curated","split":"train","category":"branch-swap","protected":false,"instructionPath":"instruction.md","environment":{"kind":"fixture","path":"environment"},"scorer":{"kind":"builtin","argv":["tier1-defect"],"timeoutMs":30000,"scoreRange":[0,1]},"provenance":{"origin":"opencode-swarm#1820","license":"MIT"},"contentHash":"f9b09fb7fa980fd94e1603a0e26e1ef43cd30a1d91211a195933913847943f23"}

package/evaluation-fixtures/tier1/curated-off-by-one/environment/baseline.ts

@@ -0,0 +1,3 @@
+export function pageStart(page: number, size: number): number {
+	return page * size;
+}

package/evaluation-fixtures/tier1/curated-off-by-one/environment/defect.test.ts

@@ -0,0 +1,3 @@
+import { expect, test } from 'bun:test';
+import { pageStart } from './defect';
+test('first page begins at zero', () => expect(pageStart(0, 20)).toBe(0));

package/evaluation-fixtures/tier1/curated-off-by-one/environment/defect.ts

@@ -0,0 +1,3 @@
+export function pageStart(page: number, size: number): number {
+	return page * size + 1;
+}

package/evaluation-fixtures/tier1/curated-off-by-one/instruction.md

@@ -0,0 +1 @@
+Review the pagination boundary in `environment/defect.ts` and identify the page that is skipped.

package/evaluation-fixtures/tier1/curated-off-by-one/manifest.json

@@ -0,0 +1 @@
+{"v":1,"id":"curated-off-by-one","source":"curated","split":"train","category":"curated-off-by-one","protected":true,"instructionPath":"instruction.md","environment":{"kind":"fixture","path":"environment"},"scorer":{"kind":"builtin","argv":["tier1-defect"],"timeoutMs":30000,"scoreRange":[0,1]},"provenance":{"origin":"opencode-swarm#1820","license":"MIT"},"contentHash":"2894129b530e0624dc1739ee7910839d261728a8655474b0103b8c98a7ea9f81"}

package/evaluation-fixtures/tier1/guard-removal/environment/baseline.ts

@@ -0,0 +1,3 @@
+export function normalized(value: string | undefined): string {
+	return value?.trim().toLowerCase() ?? '';
+}

package/evaluation-fixtures/tier1/guard-removal/environment/defect.test.ts

@@ -0,0 +1,3 @@
+import { expect, test } from 'bun:test';
+import { normalized } from './defect';
+test('handles missing input', () => expect(normalized(undefined)).toBe(''));

package/evaluation-fixtures/tier1/guard-removal/environment/defect.ts

@@ -0,0 +1,3 @@
+export function normalized(value: string | undefined): string {
+	return value!.trim().toLowerCase();
+}

package/evaluation-fixtures/tier1/guard-removal/instruction.md

@@ -0,0 +1 @@
+Find the removed input guard in `environment/defect.ts` and state which input now fails.

package/evaluation-fixtures/tier1/guard-removal/manifest.json

@@ -0,0 +1 @@
+{"v":1,"id":"guard-removal","source":"curated","split":"train","category":"guard-removal","protected":true,"instructionPath":"instruction.md","environment":{"kind":"fixture","path":"environment"},"scorer":{"kind":"builtin","argv":["tier1-defect"],"timeoutMs":30000,"scoreRange":[0,1]},"provenance":{"origin":"opencode-swarm#1820","license":"MIT"},"contentHash":"7943c549ab0c9ce6503ca8df45a9430ae0a431094b4e358be43da1cfb63a1f7d"}

package/evaluation-fixtures/tier1/injection-prone-string/environment/baseline.ts

@@ -0,0 +1,3 @@
+export function shellCommand(filename: string): string {
+	return `cat -- ${filename.replace(/[^A-Za-z0-9._-]/g, '')}`;
+}

package/evaluation-fixtures/tier1/injection-prone-string/environment/defect.test.ts

@@ -0,0 +1,3 @@
+import { expect, test } from 'bun:test';
+import { shellCommand } from './defect';
+test('does not interpolate shell syntax', () => expect(shellCommand('a; rm -rf x')).not.toContain(';'));

package/evaluation-fixtures/tier1/injection-prone-string/environment/defect.ts

@@ -0,0 +1,3 @@
+export function shellCommand(filename: string): string {
+	return `cat ${filename}`;
+}

package/evaluation-fixtures/tier1/injection-prone-string/instruction.md

@@ -0,0 +1 @@
+Find the injection-prone command construction in `environment/defect.ts` and identify the unsafe input boundary.

package/evaluation-fixtures/tier1/injection-prone-string/manifest.json

@@ -0,0 +1 @@
+{"v":1,"id":"injection-prone-string","source":"curated","split":"train","category":"injection-prone-string","protected":true,"instructionPath":"instruction.md","environment":{"kind":"fixture","path":"environment"},"scorer":{"kind":"builtin","argv":["tier1-defect"],"timeoutMs":30000,"scoreRange":[0,1]},"provenance":{"origin":"opencode-swarm#1820","license":"MIT"},"contentHash":"0f45604dbdd251aaec2af3f82afeec10b2242b16a88d86087994918796a657f4"}

package/evaluation-fixtures/tier1/missing-auth-check/environment/baseline.ts

@@ -0,0 +1,4 @@
+export function deleteAccount(actorRole: string, accountId: string): string {
+	if (actorRole !== 'admin') throw new Error('forbidden');
+	return `deleted:${accountId}`;
+}

package/evaluation-fixtures/tier1/missing-auth-check/environment/defect.test.ts

@@ -0,0 +1,3 @@
+import { expect, test } from 'bun:test';
+import { deleteAccount } from './defect';
+test('blocks ordinary users', () => expect(() => deleteAccount('user', '42')).toThrow());

package/evaluation-fixtures/tier1/missing-auth-check/environment/defect.ts

@@ -0,0 +1,3 @@
+export function deleteAccount(_actorRole: string, accountId: string): string {
+	return `deleted:${accountId}`;
+}

package/evaluation-fixtures/tier1/missing-auth-check/instruction.md

@@ -0,0 +1 @@
+Review `environment/defect.ts` for a missing authorization check and state who can perform the protected action.

package/evaluation-fixtures/tier1/missing-auth-check/manifest.json

@@ -0,0 +1 @@
+{"v":1,"id":"missing-auth-check","source":"curated","split":"train","category":"missing-auth-check","protected":true,"instructionPath":"instruction.md","environment":{"kind":"fixture","path":"environment"},"scorer":{"kind":"builtin","argv":["tier1-defect"],"timeoutMs":30000,"scoreRange":[0,1]},"provenance":{"origin":"opencode-swarm#1820","license":"MIT"},"contentHash":"9b6d8ff362df8aad25d3c579b10e0fa202e923a0565cf5d18d4c4d1da75af482"}

package/evaluation-fixtures/tier1/missing-await/environment/baseline.ts

@@ -0,0 +1,7 @@
+export async function saveThenRead(
+	save: () => Promise<void>,
+	read: () => string,
+): Promise<string> {
+	await save();
+	return read();
+}

package/evaluation-fixtures/tier1/missing-await/environment/defect.test.ts

@@ -0,0 +1,3 @@
+import { expect, test } from 'bun:test';
+import { saveThenRead } from './defect';
+test('waits for save', async () => { let value = ''; expect(await saveThenRead(async () => { await Promise.resolve(); value = 'saved'; }, () => value)).toBe('saved'); });

package/evaluation-fixtures/tier1/missing-await/environment/defect.ts

@@ -0,0 +1,4 @@
+export async function saveThenRead(save: () => Promise<void>, read: () => string): Promise<string> {
+	save();
+	return read();
+}

package/evaluation-fixtures/tier1/missing-await/instruction.md

@@ -0,0 +1 @@
+Find the missing await in `environment/defect.ts` and explain the ordering failure.

package/evaluation-fixtures/tier1/missing-await/manifest.json

@@ -0,0 +1 @@
+{"v":1,"id":"missing-await","source":"curated","split":"train","category":"missing-await","protected":true,"instructionPath":"instruction.md","environment":{"kind":"fixture","path":"environment"},"scorer":{"kind":"builtin","argv":["tier1-defect"],"timeoutMs":30000,"scoreRange":[0,1]},"provenance":{"origin":"opencode-swarm#1820","license":"MIT"},"contentHash":"d444592ce7d955882de61601bfe414be54c616f6c441ea735450e6716bc837fd"}

package/evaluation-fixtures/tier1/mutation-off-by-one/environment/baseline.ts

@@ -0,0 +1,3 @@
+export function last<T>(items: T[]): T | undefined {
+	return items[items.length - 1];
+}

package/evaluation-fixtures/tier1/mutation-off-by-one/environment/defect.test.ts

@@ -0,0 +1,3 @@
+import { expect, test } from 'bun:test';
+import { last } from './defect';
+test('returns the final item', () => expect(last([1, 2])).toBe(2));

package/evaluation-fixtures/tier1/mutation-off-by-one/environment/defect.ts

@@ -0,0 +1,3 @@
+export function last<T>(items: T[]): T | undefined {
+	return items[items.length];
+}

package/evaluation-fixtures/tier1/mutation-off-by-one/instruction.md

@@ -0,0 +1 @@
+Find the boundary defect in `environment/defect.ts`. Report whether the implementation is safe and explain the exact failing case.

package/evaluation-fixtures/tier1/mutation-off-by-one/manifest.json

@@ -0,0 +1 @@
+{"v":1,"id":"mutation-off-by-one","source":"curated","split":"train","category":"mutation-off-by-one","protected":true,"instructionPath":"instruction.md","environment":{"kind":"fixture","path":"environment"},"scorer":{"kind":"builtin","argv":["tier1-defect"],"timeoutMs":30000,"scoreRange":[0,1]},"provenance":{"origin":"opencode-swarm#1820","license":"MIT"},"contentHash":"9cec6a89ff87b1b85691313a2430916e3ebf393d532644b3f82faa10fe0203cd"}

package/evaluation-fixtures/tier1/null-substitution/environment/baseline.ts

@@ -0,0 +1,3 @@
+export function displayName(name: string | null): string {
+	return name === null ? '' : name;
+}