opencode-swarm 7.123.0 → 7.124.0

package/dist/memory/sqlite-provider.d.ts

@@ -18,6 +18,14 @@ export interface SQLiteJsonlImportResult {
 export declare class SQLiteMemoryProvider implements MemoryProvider, MemoryProposalStore {
     readonly name = "sqlite";
     private readonly rootDirectory;
+    /**
+     * #1850: when set, the provider serves a cohort-shared store rather than
+     * the worktree-local `.swarm/memory`. Cohort roots live under the platform
+     * data dir (`<dataDir>/links/<linkId>/memory`) and bypass
+     * `validateSwarmPath` by construction (the resolver sanitizes the linkId).
+     * `null` for local-root providers (today's behavior, still validated).
+     */
+    private readonly cohortRoot;
     private readonly config;
     private initialized;
     private initPromise;
@@ -32,7 +40,24 @@ export declare class SQLiteMemoryProvider implements MemoryProvider, MemoryPropo
     private lastAutomaticJsonlMigration;
     private recallCountSinceLastCompaction;
     private isCompacting;
-    constructor(rootDirectory: string, config?: Partial<MemoryConfig>);
+    constructor(rootDirectory: string, config?: Partial<MemoryConfig>, 
+    /**
+     * #1850: optional cohort root. When provided, the provider opens the DB
+     * at `<cohortRoot>/memory.db` and bypasses `validateSwarmPath` (the
+     * cohort root is resolver-constructed from a sanitized linkId, not a
+     * user-supplied path). When omitted, the provider uses the worktree
+     * `.swarm` path with full `validateSwarmPath` enforcement (today's
+     * behavior).
+     */
+    vettedCohortRoot?: string | null);
+    /**
+     * #1850 (critic GAP-5): explicit cohort-root path branch.
+     * - cohort root → `<cohortRoot>/memory.db` (NO validateSwarmPath — the
+     *   cohort root is a platform-data-dir path constructed by the resolver
+     *   from a sanitized linkId, never from user input).
+     * - local root → existing behavior: strip `.swarm/` prefix, pass through
+     *   `validateSwarmPath` to enforce `.swarm` containment.
+     */
     private databasePath;
     initialize(): Promise<void>;
     private doInitialize;
@@ -57,6 +82,23 @@ export declare class SQLiteMemoryProvider implements MemoryProvider, MemoryPropo
     }): Promise<MemoryProposal[]>;
     applyCuratorDecision(decision: ResolvedCuratorMemoryDecision): Promise<AppliedMemoryChange>;
     close(): void;
+    /**
+     * #1850 (critic CONCERN-3): checkpoint the WAL into the main DB, then
+     * close the handle. Used by the memory family migration engine before it
+     * copies the DB file, so the copy reflects all committed writes and is not
+     * mid-checkpoint. After this call, the provider is closed and must be
+     * re-opened (the migration engine re-creates it via the pool).
+     *
+     * Returns the absolute paths to copy: `memory.db` plus any non-empty
+     * `-wal`/`-shm` sidecars (after a TRUNCATE checkpoint the WAL is typically
+     * empty; if it is not, copying it alongside the DB is still correct because
+     * SQLite recovers from WAL on next open).
+     */
+    checkpointCloseSnapshot(): {
+        dbPath: string;
+        walPath: string | null;
+        shmPath: string | null;
+    };
     /**
      * Re-embed all durable memory records with the current embedding provider
      * model, update the stored global model_version, and clear the embedding
@@ -94,6 +136,21 @@ export declare class SQLiteMemoryProvider implements MemoryProvider, MemoryPropo
     private loadMemories;
     private loadProposals;
     private writeMemory;
+    /**
+     * #1850: write a monotonic generation marker so siblings re-open their
+     * in-memory mirror. Fire-and-forget; failures are non-fatal (peers simply
+     * revalidate on the next pointer-stat change or TTL expiry).
+     */
+    private bumpCohortGeneration;
+    /**
+     * #1850 (reviewer important fix): read `memory-cohort-config.json` and fail
+     * closed if the stored provider/embedding/redaction fingerprint disagrees
+     * with this worktree's config (acceptance #10). Absent file = first link
+     * (permissive — the linker writes it immediately after migration). A
+     * malformed file is also permissive (fail-open never strands memory, but
+     * a mismatch is a hard error).
+     */
+    private assertCohortConfigFingerprint;
     private writeMemoryFts;
     private writeMemoryVec;
     private deleteMemoryFts;

package/dist/memory/storage-root.d.ts

@@ -0,0 +1,93 @@
+/**
+ * #1850 Linked Knowledge 5/5: vetted memory storage-root capability.
+ *
+ * Problem: when cohort memory sharing is opted in, the memory provider must
+ * open a database at a cohort-scoped root (under the platform data dir), not
+ * the worktree's `.swarm/memory`. But accepting an arbitrary external path
+ * would violate `validateSwarmPath` and `.swarm` containment (AGENTS.md
+ * invariant #4, issue #1850 acceptance #3).
+ *
+ * Resolution: a narrow discriminated union `VettedMemoryRoot` that can only
+ * represent one of two validated shapes:
+ *   - `{kind:'local'}`  — the worktree's `.swarm/memory` root (today's path,
+ *     still gated by `validateSwarmPath` in the provider constructors).
+ *   - `{kind:'cohort'}` — a cohort root derived from the #1846 cohort
+ *     identity via the sanitized linkId. Constructed only by
+ *     `resolveVettedMemoryRoot` from the memory-link pointer; there is no
+ *     public `openMemoryAt(arbitraryPath)` entry.
+ *
+ * Cohort roots live under `<dataDir>/links/<linkId>/memory/` — the SAME shared
+ * store directory used by knowledge linking, namespaced under `memory/`. The
+ * `validateSwarmPath` invariant is preserved by construction: cohort roots are
+ * never passed through it (they are platform-data-dir paths, not `.swarm`
+ * paths), and local roots continue to flow through the existing validation.
+ *
+ * This module is sync-only and side-effect-free (a pointer read) so it is safe
+ * to call from the lazy gateway constructor on the plugin hot path.
+ */
+import type { MemoryConfig } from './config.js';
+import { type MemoryLinkPointer } from './memory-link.js';
+/**
+ * The vetted root. `directory` is always the worktree's project root (so
+ * providers can still derive auxiliary per-worktree paths when needed); `root`
+ * is the resolved storage root (worktree `.swarm` for local, cohort dir for
+ * cohort).
+ */
+export type VettedMemoryRoot = {
+    kind: 'local';
+    /** Resolved worktree `.swarm` directory (parent of `storageDir`). */
+    root: string;
+    /** Original worktree project root (ctx.directory). */
+    directory: string;
+} | {
+    kind: 'cohort';
+    /** Cohort memory root: `<dataDir>/links/<linkId>/memory`. */
+    cohortRoot: string;
+    /** Canonical cohort id from #1846 (shared by all sibling worktrees). */
+    cohortId: string;
+    /** Monotonic link generation (bumped on link/unlink; aids revalidation). */
+    generation: number;
+    /** Sanitized linkId (the cohort directory segment). */
+    linkId: string;
+    /** Original worktree project root (ctx.directory). */
+    directory: string;
+};
+/**
+ * Resolve the vetted memory root for a worktree. Sync, side-effect-free.
+ *
+ * Decision tree:
+ *  1. If `config.link?.enabled !== true` → local (today's behavior).
+ *  2. Read the memory-link pointer. If absent or malformed → local.
+ *  3. If the pointer resolves to a cohort store → cohort root under
+ *     `<resolveMemoryStoreDir(directory)>/memory`. `resolveMemoryStoreDir`
+ *     already canonicalizes via `path.resolve` and revalidates the pointer
+ *     stat on cache hits (mirrors `resolveKnowledgeStoreDir` in
+ *     `src/hooks/knowledge-link.ts:396`).
+ *
+ * The cohort memory root is `<resolveMemoryStoreDir(directory)>/memory` — a
+ * `memory/` subdirectory of the shared link dir, sibling to the knowledge
+ * family files. This keeps knowledge and memory in the same cohort container
+ * without colliding filenames.
+ */
+export declare function resolveVettedMemoryRoot(directory: string, config: Pick<MemoryConfig, 'link'> | Partial<Pick<MemoryConfig, 'link'>>): VettedMemoryRoot;
+/**
+ * Backward-compat shim: wraps a raw directory into a local vetted root. Emits
+ * a debug log so incomplete wiring (a caller that should have resolved a vetted
+ * root itself) is visible during development (critic CONCERN-5).
+ */
+export declare function wrapLocalRoot(directory: string): VettedMemoryRoot;
+/** Type guard for the cohort branch. */
+export declare function isCohortRoot(root: VettedMemoryRoot): root is Extract<VettedMemoryRoot, {
+    kind: 'cohort';
+}>;
+/** Type guard for the local branch. */
+export declare function isLocalRoot(root: VettedMemoryRoot): root is Extract<VettedMemoryRoot, {
+    kind: 'local';
+}>;
+/** Return the resolved storage path for a given root (no validation). */
+export declare function rootStoragePath(root: VettedMemoryRoot): string;
+export declare const _internals: {
+    resolveVettedMemoryRoot: typeof resolveVettedMemoryRoot;
+    wrapLocalRoot: typeof wrapLocalRoot;
+};
+export type { MemoryLinkPointer };

package/dist/memory/types.d.ts

@@ -1,4 +1,4 @@
-export type MemoryScopeType = 'global_user' | 'workspace' | 'project' | 'repository' | 'run' | 'agent';
+export type MemoryScopeType = 'global_user' | 'workspace' | 'project' | 'repository' | 'run' | 'agent' | 'cohort';
 export interface MemoryScopeRef {
     type: MemoryScopeType;
     userId?: string;
@@ -8,6 +8,10 @@ export interface MemoryScopeRef {
     repoRoot?: string;
     runId?: string;
     agentId?: string;
+    /** Canonical cohort id from `resolveCohortId` (#1850). Set when
+     * `type === 'cohort'`. Required for cohort-scoped records so the scope key
+     * and recall filters distinguish different cohorts. */
+    cohortId?: string;
 }
 export type MemoryKind = 'user_preference' | 'project_fact' | 'architecture_decision' | 'repo_convention' | 'api_finding' | 'code_pattern' | 'test_pattern' | 'failure_pattern' | 'security_note' | 'evidence' | 'todo' | 'scratch';
 export interface MemorySource {
@@ -35,6 +39,21 @@ export interface MemoryRecord {
     supersededBy?: string;
     contentHash: string;
     metadata: Record<string, unknown>;
+    /** Canonical cohort id the record belongs to. Matches `scope.cohortId`
+     * when `scope.type === 'cohort'`. */
+    cohortId?: string;
+    /** Session id of the producer (when policy permits retention). */
+    producerSessionId?: string;
+    /** Agent role of the producer. */
+    producerAgentRole?: string;
+    /** Redaction policy version at write time (from REDACTION_POLICY_VERSION). */
+    redactionPolicyVersion?: number;
+    /** Memory schema version at write time. */
+    schemaVersion?: number;
+    /** Provider name at write time (`'sqlite'` | `'local-jsonl'`). */
+    providerVersion?: string;
+    /** Source git revision of the producer, when available. */
+    sourceRevision?: string;
 }
 export interface MemoryProposal {
     id: string;

package/dist/services/knowledge-diagnostics.d.ts

@@ -132,6 +132,31 @@ export interface KnowledgeDebugMeta {
          */
         pending_proposals: number;
     };
+    /**
+     * #1850: memory cohort link health. Distinct from the knowledge `cohort`
+     * block so diagnostics can report knowledge-link and memory-link
+     * independently. Carries provider/config fingerprint agreement so an
+     * operator can detect cohort divergence. No record text is emitted here
+     * (diagnostics-no-leakage discipline, acceptance #13).
+     */
+    memory: {
+        linked: boolean;
+        pointer_version: 1 | 2 | null;
+        link_id: string | null;
+        cohort_id: string | null;
+        identity_source: 'remote' | 'git-common-dir' | 'path' | null;
+        degraded: boolean;
+        shared_root: string | null;
+        generation: number | null;
+        /** Provider name from config ('sqlite' | 'local-jsonl'). */
+        provider: string | null;
+        /**
+         * #1850 (KC-002): config fingerprint agreement — true when this
+         * worktree's config matches the cohort's stored fingerprint, false on
+         * mismatch, null when not checked (unlinked or file absent).
+         */
+        config_fingerprint_match: boolean | null;
+    };
 }
 /**
  * Compute the debug-metadata block for the knowledge system. Best-effort: never

package/dist/services/status-service.d.ts

@@ -91,6 +91,22 @@ export interface StatusData {
         sharedRoot?: string;
         generation?: number;
     };
+    /**
+     * #1850: memory cohort link status. Distinct from `cohort` (knowledge link)
+     * so status can distinguish knowledge-linked from memory-linked (acceptance
+     * #2). Carries provider/config/privacy health fields.
+     */
+    memoryCohort?: {
+        linked: boolean;
+        linkId?: string;
+        cohortId?: string;
+        identitySource?: 'remote' | 'git-common-dir' | 'path';
+        degraded?: boolean;
+        sharedRoot?: string;
+        generation?: number;
+        provider?: string;
+        configFingerprintMatch?: boolean;
+    };
 }
 /**
  * Get status data from the swarm directory.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.123.0",
+	"version": "7.124.0",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",

package/dist/cli/curator-llm-factory-mfvd4sqx.js

@@ -1,52 +0,0 @@
-// @bun
-import {
-  createCuratorLLMDelegate
-} from "./index-jyrhy4ww.js";
-import"./index-19zn67q6.js";
-import"./index-det5jwfk.js";
-import"./index-7cspygmb.js";
-import"./index-4905hd2m.js";
-import"./index-nprawcc0.js";
-import"./index-q00e4s1s.js";
-import"./index-j9kxwshw.js";
-import"./index-hns7xjm7.js";
-import"./index-vxv732ex.js";
-import"./index-c8s9a3zh.js";
-import"./index-816rkp4y.js";
-import"./index-22e127jw.js";
-import"./index-m0bmh3w0.js";
-import"./index-cqsak7bf.js";
-import"./index-rtry5xyf.js";
-import"./index-n2712byd.js";
-import"./index-dywekeen.js";
-import"./index-ae75rja9.js";
-import"./index-q27bajqb.js";
-import"./index-3rr0ese8.js";
-import"./index-vcgfqd8f.js";
-import"./index-gnp9x6se.js";
-import"./index-wr8qgpz5.js";
-import"./index-4rhcth7a.js";
-import"./index-8fwhhayc.js";
-import"./index-q1exe2b3.js";
-import"./index-d6h5hq91.js";
-import"./index-ctpgsj84.js";
-import"./index-m1abzg93.js";
-import"./index-gw3m5fw0.js";
-import"./index-ye3fndsw.js";
-import"./index-kzj3fp7c.js";
-import"./index-5e4e2hvv.js";
-import"./index-p0arc26j.js";
-import"./index-zgwm4ryv.js";
-import"./index-dqh3zhhc.js";
-import"./index-6xnxz6z0.js";
-import"./index-7mkpsw6g.js";
-import"./index-fsrp8wp3.js";
-import"./index-76kvm9z5.js";
-import"./index-q2rrv0cy.js";
-import"./index-293f68mj.js";
-import"./index-7g4c7s5r.js";
-import"./index-qe3v54nb.js";
-import"./index-a76rekgs.js";
-export {
-  createCuratorLLMDelegate
-};

package/dist/cli/guardrail-explain-4vytbchb.js

@@ -1,53 +0,0 @@
-// @bun
-import {
-  handleGuardrailExplain
-} from "./index-6sgqnvpw.js";
-import"./index-jyrhy4ww.js";
-import"./index-19zn67q6.js";
-import"./index-det5jwfk.js";
-import"./index-7cspygmb.js";
-import"./index-4905hd2m.js";
-import"./index-nprawcc0.js";
-import"./index-q00e4s1s.js";
-import"./index-j9kxwshw.js";
-import"./index-hns7xjm7.js";
-import"./index-vxv732ex.js";
-import"./index-c8s9a3zh.js";
-import"./index-816rkp4y.js";
-import"./index-22e127jw.js";
-import"./index-m0bmh3w0.js";
-import"./index-cqsak7bf.js";
-import"./index-rtry5xyf.js";
-import"./index-n2712byd.js";
-import"./index-dywekeen.js";
-import"./index-ae75rja9.js";
-import"./index-q27bajqb.js";
-import"./index-3rr0ese8.js";
-import"./index-vcgfqd8f.js";
-import"./index-gnp9x6se.js";
-import"./index-wr8qgpz5.js";
-import"./index-4rhcth7a.js";
-import"./index-8fwhhayc.js";
-import"./index-q1exe2b3.js";
-import"./index-d6h5hq91.js";
-import"./index-ctpgsj84.js";
-import"./index-m1abzg93.js";
-import"./index-gw3m5fw0.js";
-import"./index-ye3fndsw.js";
-import"./index-kzj3fp7c.js";
-import"./index-5e4e2hvv.js";
-import"./index-p0arc26j.js";
-import"./index-zgwm4ryv.js";
-import"./index-dqh3zhhc.js";
-import"./index-6xnxz6z0.js";
-import"./index-7mkpsw6g.js";
-import"./index-fsrp8wp3.js";
-import"./index-76kvm9z5.js";
-import"./index-q2rrv0cy.js";
-import"./index-293f68mj.js";
-import"./index-7g4c7s5r.js";
-import"./index-qe3v54nb.js";
-import"./index-a76rekgs.js";
-export {
-  handleGuardrailExplain
-};

package/dist/cli/guardrail-log-z291m4gw.js

@@ -1,16 +0,0 @@
-// @bun
-import {
-  handleGuardrailLog
-} from "./index-17eybc3z.js";
-import"./index-19zn67q6.js";
-import"./index-wr8qgpz5.js";
-import"./index-4rhcth7a.js";
-import"./index-5e4e2hvv.js";
-import"./index-p0arc26j.js";
-import"./index-zgwm4ryv.js";
-import"./index-293f68mj.js";
-import"./index-qe3v54nb.js";
-import"./index-a76rekgs.js";
-export {
-  handleGuardrailLog
-};

package/dist/cli/index-4rhcth7a.js

@@ -1,14 +0,0 @@
-// @bun
-// src/hooks/knowledge-types.ts
-var KNOWLEDGE_SCHEMA_VERSION = 3;
-var INACTIVE_STATUSES = new Set([
-  "archived",
-  "quarantined",
-  "quarantined_unactionable"
-]);
-var OUTCOME_BLOCK_THRESHOLD = -0.3;
-function isActiveStatus(status) {
-  return !INACTIVE_STATUSES.has(status ?? "");
-}
-
-export { KNOWLEDGE_SCHEMA_VERSION, OUTCOME_BLOCK_THRESHOLD, isActiveStatus };