opencode-swarm 7.125.2 → 7.125.3

package/dist/services/config-doctor.d.ts

@@ -38,6 +38,14 @@ export interface ConfigFix {
     description: string;
     /** Risk level - only 'low' is auto-fixable */
     risk: 'low' | 'medium' | 'high';
+    /**
+     * When true, the fix loses user-authored data (e.g. trimming an over-length
+     * array). Lossy fixes are applied ONLY when the caller explicitly opts in via
+     * `applySafeAutoFixes(..., { applyLossy: true })` — the interactive
+     * `/swarm config doctor --fix` command does; the passive startup autofix path
+     * never does. This keeps a lossy repair from being applied silently (#1886).
+     */
+    lossy?: boolean;
 }
 /** Result of running the config doctor */
 export interface ConfigDoctorResult {
@@ -98,7 +106,9 @@ export declare function runConfigDoctor(config: PluginConfig, directory: string)
  * Apply safe auto-fixes to config
  * Only applies low-risk, non-destructive fixes
  */
-export declare function applySafeAutoFixes(directory: string, result: ConfigDoctorResult): {
+export declare function applySafeAutoFixes(directory: string, result: ConfigDoctorResult, options?: {
+    applyLossy?: boolean;
+}): {
     appliedFixes: ConfigFix[];
     updatedConfigPath: string | null;
 };
@@ -131,7 +141,9 @@ export declare function shouldRunOnStartup(automationConfig: {
 /**
  * Full config doctor run with backup and fix application
  */
-export declare function runConfigDoctorWithFixes(directory: string, config: PluginConfig, autoFix?: boolean): Promise<{
+export declare function runConfigDoctorWithFixes(directory: string, config: PluginConfig, autoFix?: boolean, options?: {
+    applyLossy?: boolean;
+}): Promise<{
     result: ConfigDoctorResult;
     backupPath: string | null;
     appliedFixes: ConfigFix[];

package/dist/services/warning-buffer.d.ts

@@ -1,14 +1,33 @@
+/**
+ * Buffer a warning for `/swarm diagnose`. This is the single write boundary
+ * for `deferredWarnings` — `advisoryWarn` funnels through it, and roughly a
+ * dozen call sites across `src/index.ts` and `src/agents/index.ts` call it
+ * directly with hand-composed messages. Several of those interpolate
+ * repo-controlled config content (agent names from `agents: z.record(...)`,
+ * the `auto_select_architect` string, …) that flows straight from an
+ * auto-loaded, attacker-editable `.opencode/opencode-swarm.json`.
+ *
+ * Sanitizing HERE — not in `advisoryWarn` — is what actually closes the class:
+ * every path into the buffer passes through this one function, so a future
+ * direct caller can't reintroduce the terminal-control-character /
+ * markdown-bullet-breaking class this guards against (security review,
+ * issue #1886 follow-up; an earlier revision of this fix sanitized only
+ * inside `advisoryWarn` and missed every direct caller).
+ */
 export declare function addDeferredWarning(warning: string): void;
 /**
  * Operational advisory: a non-fatal, operator-actionable condition reached on
  * a path that can run while the host TUI owns the terminal (plugin init,
- * /swarm command handlers, tool execution, chat/tool hooks). Routes the message
- * to BOTH delivery channels:
+ * /swarm command handlers, tool execution, chat/tool hooks). Routes to BOTH
+ * delivery channels:
  *
  * 1. `addDeferredWarning` — buffers it for `/swarm diagnose`, so the operator
- *    can discover the condition without it polluting the live display.
- * 2. `log` — the debug-gated logger, so it also shows under
- *    `OPENCODE_SWARM_DEBUG=1` for live debugging.
+ *    can discover the condition without it polluting the live display. The
+ *    optional `data` is folded into the buffered entry (rendered compact +
+ *    single-line) so actionable detail is visible in `/swarm diagnose`, not
+ *    only under debug (issue #1886: config-validation detail was silently lost).
+ * 2. `log` — the debug-gated logger, so the message AND the structured `data`
+ *    also show under `OPENCODE_SWARM_DEBUG=1` for live debugging.
  *
  * This NEVER writes raw stderr/stdout. It is the safe replacement for the raw
  * `console.warn` calls that corrupt the bubbletea TUI (issue #1249 class, and

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.125.2",
+	"version": "7.125.3",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",

package/dist/cli/index-gacm5s2n.js

@@ -1,34 +0,0 @@
-// @bun
-import {
-  init_logger,
-  log
-} from "./index-zgwm4ryv.js";
-import {
-  __esm
-} from "./index-a76rekgs.js";
-
-// src/services/warning-buffer.ts
-function addDeferredWarning(warning) {
-  if (deferredWarnings.length < MAX_DEFERRED_WARNINGS - 1) {
-    deferredWarnings.push(warning);
-    return;
-  }
-  if (!deferredWarningsTruncated) {
-    deferredWarnings.push(`[opencode-swarm] ${MAX_DEFERRED_WARNINGS - 1} deferred warnings buffered; additional advisories were dropped (cap reached). Run with OPENCODE_SWARM_DEBUG=1 to see all advisories in the debug log.`);
-    deferredWarningsTruncated = true;
-  }
-}
-function advisoryWarn(message, data) {
-  addDeferredWarning(message);
-  log(message, data);
-}
-function getDeferredWarnings() {
-  return [...deferredWarnings];
-}
-var deferredWarnings, MAX_DEFERRED_WARNINGS = 50, deferredWarningsTruncated = false;
-var init_warning_buffer = __esm(() => {
-  init_logger();
-  deferredWarnings = [];
-});
-
-export { advisoryWarn, getDeferredWarnings, init_warning_buffer };