opencode-swarm 7.122.0 → 7.122.1

package/dist/sandbox/win32/restricted-environment-executor.d.ts

@@ -71,7 +71,7 @@ export declare class WindowsSandboxExecutor implements SandboxExecutor {
      *
      * The wrapper:
      *   - Sets scoped temp directory (%TEMP%, %TMP%)
-     *   - Restricts PATH to safe system paths only
+     *   - Preserves syntactically safe local PATH entries after system paths
      *   - Removes dangerous environment variables that could be used to bypass restrictions
      *   - Applies per-call envOverrides (set or unset)
      *   - Executes PowerShell-native cmdlets (filesystem cmdlets only) via Invoke-Expression,
@@ -99,7 +99,8 @@ export declare class WindowsSandboxExecutor implements SandboxExecutor {
      * Return environment variable overrides required for the Windows sandbox.
      *
      * Security measures:
-     *   - PATH is restricted to essential Windows system directories only
+     *   - PATH starts with essential Windows system directories, then retains
+     *     syntactically safe local inherited tool directories
      *   - TEMP/TMP are set to null (will be set to scoped temp at runtime via wrapCommand)
      *   - Dangerous variables that don't apply to Windows are cleared for completeness
      */

package/dist/scope/scope-binding.d.ts

@@ -0,0 +1,89 @@
+import type { Plan } from '../config/plan-schema';
+export declare const MAX_PENDING_SCOPE_BINDINGS = 256;
+export type ScopeBindingSource = 'declare_scope' | 'plan' | 'file_directive' | 'worktree_derived';
+export interface ScopeBinding {
+    version: 2;
+    workspaceIdentity: string;
+    planId: string;
+    planStructureHash: string;
+    taskId: string;
+    ownerSessionId: string;
+    ownerMessageId: string;
+    /** Exact Task tool call that activated this binding. Declarations omit it. */
+    dispatchCallId?: string;
+    activation: 'declaration' | 'pending_child' | 'active';
+    parentOwnerSessionId?: string;
+    parentCallId?: string;
+    source: ScopeBindingSource;
+    files: string[];
+    declaredAt: number;
+    expiresAt: number;
+}
+export declare function canonicalWorkspaceIdentity(directory: string): string | null;
+export declare function normalizeScopeFiles(files: readonly string[]): string[] | null;
+export declare function createScopeBinding(input: {
+    directory: string;
+    plan: Plan;
+    taskId: string;
+    files: readonly string[];
+    ownerSessionId: string;
+    ownerMessageId: string;
+    source: Exclude<ScopeBindingSource, 'worktree_derived'>;
+    dispatchCallId?: string;
+    activation?: ScopeBinding['activation'];
+    ttlMs?: number;
+}): ScopeBinding | null;
+export declare function registerScopeBinding(binding: ScopeBinding): void;
+export declare function getScopeBinding(input: {
+    directory: string;
+    plan: Plan;
+    taskId: string;
+    ownerSessionId: string;
+    ownerMessageId?: string;
+}): ScopeBinding | null;
+/** Resolve the one Task-correlated authorization for an executing coder. */
+export declare function getAuthorizedScopeBinding(input: {
+    directory: string;
+    plan: Plan;
+    taskId: string;
+    activeSessionId: string;
+}): ScopeBinding | null;
+export declare function getAuthorizedScopeBindingByPlanIdentity(input: {
+    directory: string;
+    planId: string;
+    planStructureHash: string;
+    taskId: string;
+    activeSessionId: string;
+}): ScopeBinding | null;
+export declare function clearScopeBindings(predicate?: (binding: ScopeBinding) => boolean): ScopeBinding[];
+/**
+ * Atomically claim the pending scope for the exact Task call whose upstream
+ * metadata identified the actual OpenCode child session. The call id is part of
+ * the authorization identity; parent-session FIFO guessing is never used.
+ */
+export declare function claimScopeBindingForChild(input: {
+    directory: string;
+    parentSessionId: string;
+    childSessionId: string;
+    dispatchCallId: string;
+}): {
+    previous: ScopeBinding;
+    claimed: ScopeBinding;
+} | null;
+export declare function deriveChildScopeBinding(parent: ScopeBinding, input: {
+    childDirectory: string;
+    childSessionId: string;
+    parentCallId: string;
+}): ScopeBinding;
+export declare function resolveCoderScopeSources(input: {
+    explicitFiles: readonly string[] | null | undefined;
+    planFiles: readonly string[] | null | undefined;
+    fileDirectiveFiles: readonly string[] | null | undefined;
+}): {
+    ok: true;
+    files: string[];
+    source: 'declare_scope' | 'plan' | 'file_directive';
+} | {
+    ok: false;
+    code: 'SCOPE_NOT_DECLARED' | 'SCOPE_CONFLICT';
+};

package/dist/scope/scope-persistence.d.ts

@@ -23,31 +23,35 @@
  *       * plan.json size capped at MAX_PLAN_BYTES (DoS cap)
  *       * Windows reserved device names rejected (CON, NUL, LPT1, …)
  *
- * RESIDUAL RISKS — explicitly accepted (#520 tracks full syscall-layer remediation):
- *   1. Bash / interpreter writes bypass the tool-layer authority check. This
- *      module does not protect against a coder process running `sed -i`,
- *      `echo >`, `python -c`, etc. Mitigation is prompt-only (see coder.ts
- *      WRITE BLOCKED PROTOCOL) until #520 lands.
- *   2. Platform-portability of symlink guards:
+ * AUTHORITY BOUNDARY:
+ *   - Direct-write tools and statically detected shell/interpreter write targets
+ *     resolve through the same active Task-correlated binding.
+ *   - A coder write with no binding or an unverifiable target fails closed with
+ *     SCOPE_NOT_DECLARED/SCOPE_VIOLATION. Shell syntax is not an authority bypass.
+ *   - This is command-level containment, not an operating-system syscall sandbox.
+ *
+ * RESIDUAL RISKS:
+ *   1. Platform-portability of symlink guards:
  *        - realpath resolves POSIX symlinks and Windows junctions, but the
  *          Windows behaviour is not covered by CI (Linux-only test matrix).
  *        - O_NOFOLLOW is a no-op on Windows (falls back to 0). The realpath
  *          containment check on `.swarm/scopes/` remains the primary guard
  *          on that platform; leaf-file TOCTOU on Windows is not closed.
- *   3. Stale lockfile DoS: a crashed writer leaves a lock for up to
+ *   2. Stale lockfile DoS: a crashed writer leaves a lock for up to
  *      LOCK_STALE_MS (30s). During that window, concurrent `declare_scope`
  *      calls fail silently and the architect relies on in-memory state.
  *      Acceptable because in-memory state remains authoritative inside the
  *      live process; disk is a fallback.
- *   4. Temp-file leak: a crash between `Bun.write(tmp)` and `renameSync`
+ *   3. Temp-file leak: a crash between `Bun.write(tmp)` and `renameSync`
  *      leaves `scope-{id}.json.tmp.{ts}.{rand}` files. No sweeper runs today;
  *      accumulation is bounded by `/swarm close` (which rm -rf's .swarm/scopes/).
  *
- * NOT a standalone security boundary. Tool-layer write interception is now
- * implemented in shell-write-detect.ts (Phases 1-2). This module closes the
- * cross-process gap and the plan-as-scope gap. The syscall-layer fix (#520)
- * remains the durable long-term boundary.
+ * NOT a standalone syscall security boundary. Shell-write detection and the
+ * central write-target resolver provide command-level interception; this module
+ * supplies the durable, identity-bound authority they consume.
  */
+import { type Plan } from '../config/plan-schema';
+import { type ScopeBinding } from './scope-binding';
 declare const SCOPE_SCHEMA_VERSION: 1;
 export interface PersistedScope {
     version: typeof SCOPE_SCHEMA_VERSION;
@@ -56,6 +60,7 @@ export interface PersistedScope {
     expiresAt: number;
     files: string[];
 }
+export type PersistedScopeBinding = ScopeBinding;
 /**
  * Write declared scope to `.swarm/scopes/scope-{taskId}.json` atomically.
  * Safe to call concurrently — proper-lockfile serialises writers per-file.
@@ -64,6 +69,42 @@ export interface PersistedScope {
  * hard requirement. In-memory state remains authoritative for the live process.
  */
 export declare function writeScopeToDisk(directory: string, taskId: string, files: string[], ttlMs?: number): Promise<void>;
+/**
+ * Persist an identity-bound v2 authorization record. The v1 writer remains for
+ * compatibility with older non-authorization consumers, but strict Task
+ * preflight and declare_scope use only this schema.
+ */
+export declare function writeScopeBindingToDisk(directory: string, binding: ScopeBinding): Promise<void>;
+/** Read and fully validate a v2 binding; v1 records never authorize here. */
+export declare function readScopeBindingFromDisk(input: {
+    directory: string;
+    taskId: string;
+    plan: Plan;
+    ownerSessionId: string;
+    parentCallId?: string;
+    requireDispatchCorrelation?: boolean;
+    requireDeclaration?: boolean;
+}): ScopeBinding | null;
+/** Remove one identity-bound authorization without disturbing sibling sessions. */
+export declare function clearScopeBindingFromDisk(input: {
+    directory: string;
+    taskId: string;
+    ownerSessionId: string;
+}): void;
+export declare function resolveAuthorizedScopeBinding(input: {
+    directory: string;
+    taskId: string;
+    activeSessionId: string;
+}): ScopeBinding | null;
+/**
+ * Recover one unambiguous child binding after an in-memory session restart.
+ * Every candidate is still checked against current plan identity, exact child
+ * session ownership, Task-call correlation, TTL, and active state.
+ */
+export declare function resolveAuthorizedScopeBindingForSession(input: {
+    directory: string;
+    activeSessionId: string;
+}): ScopeBinding | null;
 /**
  * Read persisted scope for a task. Returns null on:
  *   - file missing

package/dist/state.d.ts

@@ -86,6 +86,13 @@ export interface AgentSessionState {
     lastInvocationIdByAgent: Record<string, number>;
     /** Active invocation windows keyed by "${agentName}:${invId}" */
     windows: Record<string, InvocationWindow>;
+    /**
+     * In-memory only circuit for known non-transient tool failures. Deliberately
+     * omitted from snapshots so a restarted host never inherits a stale stop.
+     */
+    nonTransientCircuit?: NonTransientCircuitState;
+    /** Bounded in-memory correlation for original commands replaced by wrappers. */
+    pendingToolExecutions?: Map<string, PendingToolExecution>;
     /** Last tool-call threshold at which a compaction hint was issued */
     lastCompactionHint: number;
     /** Count of architect direct writes to non-.swarm/ files */
@@ -265,6 +272,22 @@ export interface AgentSessionState {
      */
     cachedCohortId?: string;
 }
+export type NonTransientErrorCategory = 'shell_parse_error' | 'command_not_found' | 'sandbox_wrapper_failure' | 'general_permanent';
+export interface NonTransientCircuitState {
+    ownerAgent: string;
+    ownerInvocationId: number;
+    category: NonTransientErrorCategory | null;
+    sameCategoryCount: number;
+    hardStop: boolean;
+    lastSignal: string | null;
+}
+export interface PendingToolExecution {
+    tool: string;
+    originalCommand: string;
+    sandboxWrapped: boolean;
+    ownerAgent: string;
+    ownerInvocationId: number;
+}
 /**
  * Represents a single agent invocation window with isolated guardrail budgets.
  * Each time the architect delegates to an agent, a new window is created.
@@ -475,7 +498,8 @@ export declare function updateAgentEventTime(sessionId: string): void;
 /**
  * Begin a new invocation window for the given agent.
  * Increments invocation ID, creates fresh budget counters.
- * Returns null for architect (unlimited, no window).
+ * Returns null for architect (unlimited, no budget window), while still
+ * advancing the invocation identity and clearing invocation-local safety state.
  *
  * @param sessionId - Session identifier
  * @param agentName - Agent name (with or without swarm prefix)

package/dist/tools/declare-scope.d.ts

@@ -43,7 +43,11 @@ export declare function validateFiles(files: string[]): string[];
  * @param fallbackDir - Fallback directory for plan lookup
  * @returns DeclareScopeResult with success status and details
  */
-export declare function executeDeclareScope(args: DeclareScopeArgs, fallbackDir?: string): Promise<DeclareScopeResult>;
+export declare function executeDeclareScope(args: DeclareScopeArgs, fallbackDir?: string, owner?: {
+    sessionID: string;
+    messageID: string;
+    agentName?: string;
+}): Promise<DeclareScopeResult>;
 /**
  * Tool definition for declare_scope
  */

package/dist/tools/file-extractor-planner.d.ts

@@ -0,0 +1,31 @@
+export interface ExtractCodeBlocksArgs {
+    content?: string;
+    output_dir?: string;
+    prefix?: string;
+}
+export interface PlannedExtractFile {
+    filename: string;
+    absolutePath: string;
+    relativePath: string;
+    code: string;
+}
+export type ExtractCodeBlocksPlan = {
+    status: 'ready';
+    targetDir: string;
+    files: PlannedExtractFile[];
+} | {
+    status: 'noop';
+    reason: 'content-required' | 'no-code-blocks';
+} | {
+    status: 'invalid';
+    reason: string;
+};
+/** Extract a deterministic filename from code content or context. */
+export declare function extractFilename(code: string, language: string, index: number): string;
+export declare function planExtractCodeBlocks(args: ExtractCodeBlocksArgs, directory: string): ExtractCodeBlocksPlan;
+/**
+ * Plan once per tool-argument object so every pre-execution guard and the tool
+ * execution itself use the exact same collision-resolved targets.
+ */
+export declare function getOrPlanExtractCodeBlocks(args: ExtractCodeBlocksArgs, directory: string): ExtractCodeBlocksPlan;
+export declare function consumeExtractCodeBlocksPlan(args: ExtractCodeBlocksArgs, directory: string): ExtractCodeBlocksPlan;

package/dist/tools/file-extractor.d.ts

@@ -1,9 +1,4 @@
 import type { ToolDefinition } from '@opencode-ai/plugin/tool';
-/**
- * Extract filename from code content or context
- */
-export declare function extractFilename(code: string, language: string, index: number): string;
-/**
- * Extract code blocks from content and save to files
- */
+export { extractFilename } from './file-extractor-planner';
+/** Extract code blocks from content and save them as one atomic write set. */
 export declare const extract_code_blocks: ToolDefinition;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.122.0",
+	"version": "7.122.1",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",

package/dist/cli/index-51gg9947.js

@@ -1,254 +0,0 @@
-// @bun
-import {
-  require_proper_lockfile
-} from "./index-7g4c7s5r.js";
-import {
-  bunWrite
-} from "./index-qe3v54nb.js";
-import {
-  __toESM
-} from "./index-a76rekgs.js";
-
-// src/scope/scope-persistence.ts
-var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
-import * as fs from "fs";
-import * as path from "path";
-var SCOPE_SCHEMA_VERSION = 1;
-var DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
-var LOCK_STALE_MS = 30 * 1000;
-var SCOPES_DIR = ".swarm/scopes";
-var MAX_FILES_PER_SCOPE = 1e4;
-var MAX_PLAN_BYTES = 10 * 1024 * 1024;
-var MAX_SCOPE_BYTES = 2 * 1024 * 1024;
-var WINDOWS_RESERVED = new Set([
-  "CON",
-  "PRN",
-  "AUX",
-  "NUL",
-  "COM1",
-  "COM2",
-  "COM3",
-  "COM4",
-  "COM5",
-  "COM6",
-  "COM7",
-  "COM8",
-  "COM9",
-  "LPT1",
-  "LPT2",
-  "LPT3",
-  "LPT4",
-  "LPT5",
-  "LPT6",
-  "LPT7",
-  "LPT8",
-  "LPT9"
-]);
-function getScopesDir(directory) {
-  return path.join(directory, SCOPES_DIR);
-}
-function isSafeTaskId(taskId) {
-  if (typeof taskId !== "string")
-    return false;
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(taskId))
-    return false;
-  const head = taskId.replace(/\.+$/, "").split(".")[0].toUpperCase();
-  if (WINDOWS_RESERVED.has(head))
-    return false;
-  return true;
-}
-function isScopesDirSafe(directory, scopesDir) {
-  try {
-    const resolvedWorkspace = fs.realpathSync(directory);
-    const resolvedScopes = fs.realpathSync(scopesDir);
-    const rel = path.relative(resolvedWorkspace, resolvedScopes);
-    return rel.length > 0 && !rel.startsWith("..") && !path.isAbsolute(rel);
-  } catch {
-    return false;
-  }
-}
-function getScopeFilePath(directory, taskId) {
-  if (!isSafeTaskId(taskId)) {
-    throw new Error(`Invalid taskId for scope persistence: ${taskId}`);
-  }
-  return path.join(getScopesDir(directory), `scope-${taskId}.json`);
-}
-async function writeScopeToDisk(directory, taskId, files, ttlMs = DEFAULT_TTL_MS) {
-  if (!isSafeTaskId(taskId))
-    return;
-  if (!Array.isArray(files) || files.length === 0)
-    return;
-  if (files.length > MAX_FILES_PER_SCOPE)
-    return;
-  const scopesDir = getScopesDir(directory);
-  const scopePath = getScopeFilePath(directory, taskId);
-  try {
-    fs.mkdirSync(scopesDir, { recursive: true });
-  } catch {
-    return;
-  }
-  if (!isScopesDirSafe(directory, scopesDir))
-    return;
-  const now = Date.now();
-  const payload = {
-    version: SCOPE_SCHEMA_VERSION,
-    taskId,
-    declaredAt: now,
-    expiresAt: now + ttlMs,
-    files: [...files]
-  };
-  const content = JSON.stringify(payload, null, 2);
-  try {
-    const flags = fs.constants.O_WRONLY | fs.constants.O_CREAT;
-    const nofollow = fs.constants.O_NOFOLLOW ?? 0;
-    const fd = fs.openSync(scopePath, flags | nofollow);
-    fs.closeSync(fd);
-  } catch {
-    return;
-  }
-  let release;
-  try {
-    release = await import_proper_lockfile.default.lock(scopePath, {
-      stale: LOCK_STALE_MS,
-      retries: { retries: 3, minTimeout: 50, maxTimeout: 200 },
-      realpath: false
-    });
-    await atomicWrite(scopePath, content);
-  } catch {} finally {
-    if (release) {
-      try {
-        await release();
-      } catch {}
-    }
-  }
-}
-async function atomicWrite(targetPath, content) {
-  const tempPath = `${targetPath}.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`;
-  try {
-    await bunWrite(tempPath, content);
-    fs.renameSync(tempPath, targetPath);
-  } finally {
-    try {
-      fs.unlinkSync(tempPath);
-    } catch {}
-  }
-}
-function readScopeFromDisk(directory, taskId) {
-  if (!isSafeTaskId(taskId))
-    return null;
-  const scopesDir = getScopesDir(directory);
-  if (!isScopesDirSafe(directory, scopesDir))
-    return null;
-  const scopePath = getScopeFilePath(directory, taskId);
-  const nofollow = fs.constants.O_NOFOLLOW ?? 0;
-  let fd;
-  try {
-    fd = fs.openSync(scopePath, fs.constants.O_RDONLY | nofollow);
-  } catch {
-    return null;
-  }
-  let raw;
-  try {
-    const stat = fs.fstatSync(fd);
-    if (!stat.isFile())
-      return null;
-    if (stat.size > MAX_SCOPE_BYTES)
-      return null;
-    const buf = Buffer.alloc(stat.size);
-    fs.readSync(fd, buf, 0, stat.size, 0);
-    raw = buf.toString("utf-8");
-  } catch {
-    return null;
-  } finally {
-    try {
-      fs.closeSync(fd);
-    } catch {}
-  }
-  if (!raw.trim())
-    return null;
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (parsed.version !== SCOPE_SCHEMA_VERSION)
-    return null;
-  if (parsed.taskId !== taskId)
-    return null;
-  const now = Date.now();
-  if (typeof parsed.declaredAt !== "number" || parsed.declaredAt > now) {
-    return null;
-  }
-  if (typeof parsed.expiresAt !== "number" || now >= parsed.expiresAt) {
-    return null;
-  }
-  if (!Array.isArray(parsed.files))
-    return null;
-  if (parsed.files.length > MAX_FILES_PER_SCOPE)
-    return null;
-  const files = parsed.files.filter((f) => typeof f === "string");
-  return files.length > 0 ? files : null;
-}
-function readPlanScope(directory, taskId) {
-  if (!isSafeTaskId(taskId))
-    return null;
-  try {
-    const planPath = path.join(directory, ".swarm", "plan.json");
-    const stat = fs.statSync(planPath);
-    if (!stat.isFile())
-      return null;
-    if (stat.size > MAX_PLAN_BYTES)
-      return null;
-    const raw = fs.readFileSync(planPath, "utf-8");
-    const plan = JSON.parse(raw);
-    for (const phase of plan.phases ?? []) {
-      for (const task of phase.tasks ?? []) {
-        if (task.id !== taskId)
-          continue;
-        const ft = task.files_touched;
-        if (Array.isArray(ft) && ft.length > 0) {
-          if (ft.length > MAX_FILES_PER_SCOPE)
-            return null;
-          return ft.filter((f) => typeof f === "string");
-        }
-        if (typeof ft === "string" && ft.length > 0)
-          return [ft];
-        return null;
-      }
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function clearScopeForTask(directory, taskId) {
-  if (!isSafeTaskId(taskId))
-    return;
-  try {
-    fs.unlinkSync(getScopeFilePath(directory, taskId));
-  } catch {}
-}
-function clearAllScopes(directory) {
-  try {
-    fs.rmSync(getScopesDir(directory), { recursive: true, force: true });
-  } catch {}
-}
-function resolveScopeWithFallbacks(input) {
-  const { directory, taskId, inMemoryScope, pendingMapScope } = input;
-  if (inMemoryScope && inMemoryScope.length > 0)
-    return inMemoryScope;
-  if (taskId) {
-    const disk = readScopeFromDisk(directory, taskId);
-    if (disk && disk.length > 0)
-      return disk;
-    const plan = readPlanScope(directory, taskId);
-    if (plan && plan.length > 0)
-      return plan;
-  }
-  if (pendingMapScope && pendingMapScope.length > 0)
-    return pendingMapScope;
-  return null;
-}
-
-export { writeScopeToDisk, readScopeFromDisk, readPlanScope, clearScopeForTask, clearAllScopes, resolveScopeWithFallbacks };

package/dist/cli/scope-persistence-mfr36yc9.js

@@ -1,20 +0,0 @@
-// @bun
-import {
-  clearAllScopes,
-  clearScopeForTask,
-  readPlanScope,
-  readScopeFromDisk,
-  resolveScopeWithFallbacks,
-  writeScopeToDisk
-} from "./index-51gg9947.js";
-import"./index-7g4c7s5r.js";
-import"./index-qe3v54nb.js";
-import"./index-a76rekgs.js";
-export {
-  writeScopeToDisk,
-  resolveScopeWithFallbacks,
-  readScopeFromDisk,
-  readPlanScope,
-  clearScopeForTask,
-  clearAllScopes
-};

package/dist/cli/{index-h07wn84h.js → index-7mkpsw6g.js}

@@ -1,10 +1,10 @@
 // @bun
-import {
-  withEvidenceLock
-} from "./index-76kvm9z5.js";
 import {
   invalidateCachedArtifact
 } from "./index-fsrp8wp3.js";
+import {
+  withEvidenceLock
+} from "./index-76kvm9z5.js";
 import {
   bunWrite
 } from "./index-qe3v54nb.js";

package/dist/cli/{pending-delegations-0z3znsec.js → pending-delegations-68cbaqv2.js}

@@ -8,10 +8,10 @@ import {
   init_logger,
   warn
 } from "./index-zgwm4ryv.js";
+import"./index-fsrp8wp3.js";
 import {
   withEvidenceLock
 } from "./index-76kvm9z5.js";
-import"./index-fsrp8wp3.js";
 import"./index-q2rrv0cy.js";
 import {
   exports_external