opencode-swarm 7.125.0 → 7.125.1

package/dist/cli/{schema-2418eqy3.js → schema-y2d7j2jk.js}

@@ -88,7 +88,7 @@ import {
   resolveGeneratedAgentRole,
   resolveGuardrailsConfig,
   stripKnownSwarmPrefix
-} from "./index-xattnmyb.js";
+} from "./index-8yvqkbw7.js";
 import"./index-bk5tah7q.js";
 import"./index-zjygnfay.js";
 import"./index-bpmtbmy9.js";

package/dist/cli/{skill-generator-zggy797r.js → skill-generator-3gkxx98d.js}

@@ -33,12 +33,12 @@ import {
   sanitizeSlug,
   selectCandidateEntries,
   writeEvalStub
-} from "./index-vtwqjr4z.js";
-import"./index-dx2c2wjt.js";
-import"./index-67hqr2zv.js";
+} from "./index-tn3shyqj.js";
+import"./index-ghteqdy1.js";
+import"./index-kvrk3h8p.js";
 import"./index-rtry5xyf.js";
-import"./index-yt1v62pv.js";
-import"./index-n6chz2g8.js";
+import"./index-mwdcvh0e.js";
+import"./index-83rwq7pb.js";
 import"./index-ae75rja9.js";
 import"./index-q27bajqb.js";
 import"./index-bk5tah7q.js";

package/dist/commands/close.d.ts

@@ -134,8 +134,10 @@ export declare function runFinalizeStage(ctx: CloseStageContext): Promise<void>;
 export declare function runArchiveStage(ctx: CloseStageContext): Promise<void>;
 /**
  * Runs the evidence-retention sub-logic of STAGE 2 (ARCHIVE).
- * Reads max_age_days / max_bundles from config.evidence (FR-016) and
- * calls archiveEvidence. Fail-open: pushes a warning on error but never throws.
+ * Reads max_age_days / max_bundles / cache_max_bytes / cache_max_records from
+ * config.evidence (FR-016, issue #1184) and calls archiveEvidence. The report
+ * overload is used so the documents-cache prune runs when cache caps are set.
+ * Fail-open: pushes a warning on error but never throws.
  */
 export declare function runArchiveEvidenceRetention(ctx: ArchiveStageContext): Promise<void>;
 /**

package/dist/config/schema.d.ts

@@ -262,6 +262,8 @@ export declare const EvidenceConfigSchema: z.ZodObject<{
     max_age_days: z.ZodDefault<z.ZodNumber>;
     max_bundles: z.ZodDefault<z.ZodNumber>;
     auto_archive: z.ZodDefault<z.ZodBoolean>;
+    cache_max_bytes: z.ZodOptional<z.ZodNumber>;
+    cache_max_records: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type EvidenceConfig = z.infer<typeof EvidenceConfigSchema>;
 export declare const GateFeatureSchema: z.ZodObject<{
@@ -1805,6 +1807,8 @@ export declare const PluginConfigSchema: z.ZodObject<{
         max_age_days: z.ZodDefault<z.ZodNumber>;
         max_bundles: z.ZodDefault<z.ZodNumber>;
         auto_archive: z.ZodDefault<z.ZodBoolean>;
+        cache_max_bytes: z.ZodOptional<z.ZodNumber>;
+        cache_max_records: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
     summaries: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;

package/dist/evidence/documents-retention.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Retention for the web_search / web_fetch documents cache at
+ * `.swarm/evidence-cache/documents.jsonl`.
+ *
+ * Background (issue #1184): `writeEvidenceDocuments` in `./documents.ts` is
+ * purely append-only. Without this module the cache grows without bound.
+ * This module provides a bounded, project-root-contained, atomic-rewrite
+ * prune that is invoked only via `/swarm archive` and `/swarm finalize`
+ * (never on the plugin init path — AGENTS.md invariant #1).
+ *
+ * Design contract (mirrors `archiveEvaluationArtifacts` in
+ * `../evaluation/retention.ts` where applicable):
+ *   - Optional byte cap and optional record-count cap. When both are unset the
+ *     prune is a no-op (current append-only behavior preserved exactly).
+ *   - Corrupt rows (failed `JSON.parse`) are dropped from the rewrite and
+ *     reported via `corrupt` count. They are NOT relocated to a sidecar —
+ *     matches the "report, don't relocate" precedent in
+ *     `archiveEvaluationArtifacts` (retention.ts:246-254), while still
+ *     preserving the bounded-growth contract (a corrupt row otherwise counts
+ *     toward caps forever).
+ *   - Atomic rewrite via temp file + fsync + rename. NOT under
+ *     `withEvidenceLock`: web_search/web_fetch are hot paths and forcing a
+ *     lockfile round-trip on every capture is an unjustified latency tax
+ *     (issue-tracer critic item #2). The append-vs-rewrite race is a known,
+ *     accepted data-loss window: a concurrent `appendFile` whose write is in
+ *     flight when the prune renames the temp over the target will, on POSIX,
+ *     complete against the now-unlinked old inode (the appended row is
+ *     silently lost from the cache). This is accepted because refs are
+ *     content-addressed (`evd_<sha256[:16]>`) so a lost row's ref
+ *     re-materializes on the next capture of the same content, and because
+ *     the prune runs only via explicit `/swarm archive` / `/swarm finalize`,
+ *     not on every write.
+ *   - Read is streamed line-by-line via `node:readline` with a hard 100 MiB
+ *     cap. On cap breach the prune aborts, writes nothing, and leaves the
+ *     file byte-identical.
+ *   - Windows-safe rename: `EPERM`/`EBUSY`/`ENOTEMPTY`/`EACCES` are retried
+ *     with bounded backoff (5× / 10ms). On final failure the temp file is
+ *     removed and the original is left untouched (fail-safe).
+ *
+ * Memory tradeoff (L6-002): valid rows are parsed into a `ParsedRow[]` and
+ * retained in memory (raw string + parsed object per row) before selection.
+ * The 100 MiB read cap bounds input bytes, but the in-process heap footprint
+ * is higher (V8 string + object overhead). This is an accepted tradeoff: the
+ * prune runs once per explicit `/swarm archive` / `/swarm finalize` (never on
+ * a hot path), the input is bounded, and a streaming rewrite would be a
+ * materially larger refactor. If the cache ever needs to scale beyond the
+ * current cap, switch `readCacheRows` + `selectSurvivors` to a streaming
+ * selection (single pass, write survivors directly to the temp file).
+ */
+import * as fs from 'node:fs';
+export interface DocumentsRetentionResult {
+    /** Total valid (parseable) rows read before pruning. Excludes corrupt rows. */
+    inventory: number;
+    /** Rows marked for deletion by the policy (same as `inventory - surviving`). */
+    selected: number;
+    /** Rows actually removed from the file. Always 0 when `dryRun` or `aborted`. */
+    archived: number;
+    /** Unparseable rows dropped from the rewrite (count only; not preserved). */
+    corrupt: number;
+    /** File size in bytes before the prune (0 if the file did not exist). */
+    bytesBefore: number;
+    /** File size in bytes after the prune. Equal to `bytesBefore` on no-op. */
+    bytesAfter: number;
+    /** True when the prune produced no file mutation. */
+    dryRun: boolean;
+    /**
+     * True when the read cap (`MAX_READ_BYTES`) was exceeded. On abort the file
+     * is left byte-identical — no temp file, no rewrite, no sidecar.
+     */
+    aborted: boolean;
+}
+export interface PruneEvidenceDocumentsArgs {
+    directory: string;
+    /** Optional byte cap. When omitted, no byte-based pruning. */
+    maxBytes?: number;
+    /** Optional record-count cap. When omitted, no count-based pruning. */
+    maxRecords?: number;
+    /** When true, compute the plan but write nothing. */
+    dryRun?: boolean;
+}
+/** Internal DI seam (AGENTS.md invariant #7 — preferred over mock.module). */
+export declare const _internals: {
+    stat: (path: string) => Promise<fs.Stats>;
+    createReadStream: (path: string, options: {
+        encoding: BufferEncoding;
+        highWaterMark: number;
+    }) => fs.ReadStream;
+    openSync: (path: string, flags: fs.OpenMode) => number;
+    writeSync: (fd: number, data: string, position?: number | null) => number;
+    fsyncSync: (fd: number) => void;
+    closeSync: (fd: number) => void;
+    renameWithRetry: (src: string, dst: string) => Promise<void>;
+    unlink: (path: string) => Promise<void>;
+};
+/**
+ * Atomic rename with bounded retry for Windows.
+ *
+ * On Windows, `fs.rename` over an existing file can fail with `EPERM` when
+ * another handle (e.g. a concurrent `appendFile` from web_search) holds the
+ * target. We retry the rename a bounded number of times with a short backoff
+ * (the `readSwarmFileAsync` precedent in `hooks/utils.ts:263` uses the same
+ * 5× / 10ms shape for the macOS rename-visibility race). On final failure we
+ * rethrow — the caller is responsible for cleaning up the temp file.
+ *
+ * The optional `renameFn` is a test seam (defaults to `fsp.rename`) so the
+ * retry loop can be exercised deterministically on non-Windows hosts.
+ */
+export declare function atomicRenameWithRetry(src: string, dst: string, renameFn?: (s: string, d: string) => Promise<void>): Promise<void>;
+/**
+ * Apply the configured byte/count retention policy to the documents cache.
+ *
+ * Safe to call on a missing file (returns an idempotent zeroed result) and
+ * safe to call with both caps unset (no-op). Never throws for routine cases;
+ * surfaces unexpected I/O errors to the caller (archive command fails open).
+ */
+export declare function pruneEvidenceDocuments(args: PruneEvidenceDocumentsArgs): Promise<DocumentsRetentionResult>;

package/dist/evidence/manager.d.ts

@@ -1,5 +1,6 @@
 import { type BuildEvidence, type Evidence, type EvidenceBundle, type PlaceholderEvidence, type QualityBudgetEvidence, type SastEvidence, type SbomEvidence, type SecretscanEvidence, type SyntaxEvidence } from '../config/evidence-schema';
 import { type EvaluationRetentionResult } from '../evaluation/retention.js';
+import { type DocumentsRetentionResult, pruneEvidenceDocuments } from './documents-retention.js';
 /**
  * Discriminated union returned by loadEvidence.
  * - 'found': file exists and passed Zod schema validation
@@ -101,11 +102,26 @@ export type EvidenceArchiveReport = {
     archivedEvidence: string[];
     failedEvidence: string[];
     evaluation: EvaluationRetentionResult;
+    /**
+     * Documents-cache retention result (issue #1184). Always present in the
+     * report shape — a zeroed result ({ inventory: 0, selected: 0, ... })
+     * indicates the cache was not pruned (no caps configured, file missing,
+     * or prune disabled).
+     */
+    documentsCache: DocumentsRetentionResult;
 };
 export type EvidenceArchiveReportOptions = {
     report: true;
     dryRun?: boolean;
     now?: Date;
+    /**
+     * Optional documents-cache retention caps (issue #1184). When either is a
+     * positive number, `archiveEvidence` also prunes
+     * `.swarm/evidence-cache/documents.jsonl` after the bundle/evaluation
+     * sweep. When both are unset, the cache is left untouched (append-only).
+     */
+    cacheMaxBytes?: number;
+    cacheMaxRecords?: number;
 };
 export declare function archiveEvidence(directory: string, maxAgeDays: number, maxBundles?: number): Promise<string[]>;
 export declare function archiveEvidence(directory: string, maxAgeDays: number, maxBundles: number | undefined, options: EvidenceArchiveReportOptions): Promise<EvidenceArchiveReport>;
@@ -125,6 +141,7 @@ export declare const _internals: {
     validateEvidence: typeof validateEvidence;
     saveEvidence: typeof saveEvidence;
     deleteEvidence: typeof deleteEvidence;
+    pruneEvidenceDocuments: typeof pruneEvidenceDocuments;
     now: () => Date;
 };
 export {};