opencode-swarm 7.125.6 → 7.126.1

package/dist/cli/{index-gnvg72y1.js → index-4ff0x4cg.js}

@@ -136,6 +136,7 @@ var SCOPES_DIR = ".swarm/scopes";
 var MAX_FILES_PER_SCOPE = 1e4;
 var MAX_PLAN_BYTES = 10 * 1024 * 1024;
 var MAX_SCOPE_BYTES = 2 * 1024 * 1024;
+var MAX_BINDING_FILES_TO_SCAN = 1e4;
 var WINDOWS_RESERVED = new Set([
   "CON",
   "PRN",
@@ -432,6 +433,83 @@ function resolveAuthorizedScopeBindingForSession(input) {
   }
   return matches[0] ?? null;
 }
+function readPrFeedbackBindingFile(directory, filePath, activeSessionId, taskId) {
+  try {
+    const leaf = fs2.lstatSync(filePath);
+    if (!leaf.isFile() || leaf.isSymbolicLink())
+      return null;
+    if (normalizePathForComparison(fs2.realpathSync(filePath)) !== normalizePathForComparison(filePath))
+      return null;
+  } catch {
+    return null;
+  }
+  const nofollow = fs2.constants.O_NOFOLLOW ?? 0;
+  let fd;
+  try {
+    fd = fs2.openSync(filePath, fs2.constants.O_RDONLY | nofollow);
+  } catch {
+    return null;
+  }
+  let raw = "";
+  try {
+    const stat = fs2.fstatSync(fd);
+    if (!stat.isFile() || stat.size > MAX_SCOPE_BYTES)
+      return null;
+    const buffer = Buffer.alloc(stat.size);
+    fs2.readSync(fd, buffer, 0, stat.size, 0);
+    raw = buffer.toString("utf8");
+  } catch {
+    return null;
+  } finally {
+    try {
+      fs2.closeSync(fd);
+    } catch {}
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const workspaceIdentity = canonicalWorkspaceIdentity(directory);
+  const files = Array.isArray(parsed.files) ? normalizeScopeFiles(parsed.files.filter((file) => typeof file === "string")) : null;
+  const now = Date.now();
+  if (parsed.version !== 2 || parsed.source !== "pr_feedback" || !workspaceIdentity || parsed.workspaceIdentity !== workspaceIdentity || !isSafeTaskId(parsed.taskId ?? "") || taskId !== undefined && parsed.taskId !== taskId || parsed.ownerSessionId !== activeSessionId || parsed.activation !== "active" || typeof parsed.dispatchCallId !== "string" || !parsed.dispatchCallId || parsed.ownerMessageId !== parsed.dispatchCallId || typeof parsed.parentOwnerSessionId !== "string" || !parsed.parentOwnerSessionId || parsed.ownerSessionId === parsed.parentOwnerSessionId || parsed.parentCallId !== parsed.dispatchCallId || parsed.workflowSessionId !== parsed.parentOwnerSessionId || typeof parsed.workflowRevisionDigest !== "string" || !parsed.workflowRevisionDigest || parsed.planId !== `pr-feedback:${parsed.workflowSessionId}` || parsed.planStructureHash !== parsed.workflowRevisionDigest || typeof parsed.declaredAt !== "number" || parsed.declaredAt > now || typeof parsed.expiresAt !== "number" || parsed.expiresAt <= now || !files)
+    return null;
+  const expectedPath = getBindingFilePath(directory, parsed.taskId, activeSessionId);
+  if (normalizePathForComparison(expectedPath) !== normalizePathForComparison(filePath))
+    return null;
+  return { ...parsed, files };
+}
+function resolveAuthorizedPrFeedbackScopeBindingFromDisk(input) {
+  if (!input.activeSessionId.trim())
+    return null;
+  const scopesDir = getScopesDir(input.directory);
+  if (!isScopesDirSafe(input.directory, scopesDir))
+    return null;
+  let candidates;
+  if (input.taskId) {
+    if (!isSafeTaskId(input.taskId))
+      return null;
+    candidates = [
+      getBindingFilePath(input.directory, input.taskId, input.activeSessionId)
+    ];
+  } else {
+    try {
+      const names = fs2.readdirSync(scopesDir);
+      if (names.length > MAX_BINDING_FILES_TO_SCAN)
+        return null;
+      candidates = names.filter((name) => name.startsWith("binding-") && name.endsWith(".json")).map((name) => path2.join(scopesDir, name));
+    } catch {
+      return null;
+    }
+  }
+  const matches = candidates.map((candidate) => readPrFeedbackBindingFile(input.directory, candidate, input.activeSessionId, input.taskId)).filter((binding) => binding !== null);
+  if (matches.length !== 1)
+    return null;
+  registerScopeBinding(matches[0]);
+  return matches[0];
+}
 async function atomicWrite(targetPath, content) {
   const tempPath = `${targetPath}.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`;
   try {
@@ -561,4 +639,4 @@ function resolveScopeWithFallbacks(input) {
   return null;
 }
 
-export { MAX_PENDING_SCOPE_BINDINGS, clearScopeBindings, writeScopeToDisk, writeScopeBindingToDisk, readScopeBindingFromDisk, clearScopeBindingFromDisk, resolveAuthorizedScopeBinding, resolveAuthorizedScopeBindingForSession, readScopeFromDisk, readPlanScope, clearScopeForTask, clearAllScopes, resolveScopeWithFallbacks };
+export { MAX_PENDING_SCOPE_BINDINGS, clearScopeBindings, writeScopeToDisk, writeScopeBindingToDisk, readScopeBindingFromDisk, clearScopeBindingFromDisk, resolveAuthorizedScopeBinding, resolveAuthorizedScopeBindingForSession, resolveAuthorizedPrFeedbackScopeBindingFromDisk, readScopeFromDisk, readPlanScope, clearScopeForTask, clearAllScopes, resolveScopeWithFallbacks };

package/dist/cli/{index-yq4s3q43.js → index-6j9p0c40.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   authorizeCuration
-} from "./index-1htanqp1.js";
+} from "./index-kx3533dm.js";
 import {
   findNearDuplicate,
   inferTags,
@@ -9,7 +9,7 @@ import {
   resolveSwarmKnowledgePath,
   resolveSwarmRejectedPath,
   transactKnowledge
-} from "./index-1012f47p.js";
+} from "./index-nmyg9b7v.js";
 import {
   resolveKnowledgeStoreDir
 } from "./index-q27bajqb.js";

package/dist/cli/{index-74xejn4v.js → index-abw10n3f.js}

@@ -8,7 +8,7 @@ import {
   init_constants,
   init_schema,
   resolveExternalSkillsConfig
-} from "./index-r1gdkn2d.js";
+} from "./index-c8sqc3nh.js";
 import {
   advisoryWarn,
   init_warning_buffer
@@ -100,30 +100,35 @@ function migratePresetsConfig(raw) {
 }
 function sanitizeExternalSkillsConfig(raw) {
   if (!("external_skills" in raw) || raw.external_skills === undefined) {
-    return raw;
+    return { result: raw, strippedKeys: [] };
   }
   const esResult = ExternalSkillsConfigSchema.safeParse(raw.external_skills);
   if (esResult.success) {
     return {
-      ...raw,
-      external_skills: resolveExternalSkillsConfig(esResult.data)
+      result: {
+        ...raw,
+        external_skills: resolveExternalSkillsConfig(esResult.data)
+      },
+      strippedKeys: []
     };
   }
   advisoryWarn("[opencode-swarm] external_skills config validation failed:", formatZodIssues(esResult.error));
   advisoryWarn("[opencode-swarm] External skills curation disabled due to invalid config. Fix the external_skills section to enable it.");
   const cleaned = { ...raw };
   delete cleaned.external_skills;
-  return cleaned;
+  return { result: cleaned, strippedKeys: ["external_skills"] };
 }
 function sanitizeGatesConfig(raw) {
+  const strippedKeys = [];
   if (!("gates" in raw) || raw.gates === undefined) {
-    return raw;
+    return { result: raw, strippedKeys };
   }
   if (typeof raw.gates !== "object" || raw.gates === null || Array.isArray(raw.gates)) {
     advisoryWarn("[opencode-swarm] gates config validation failed: expected an object. Quality gates will use defaults; other config sections remain active.");
     const cleaned2 = { ...raw };
     delete cleaned2.gates;
-    return cleaned2;
+    strippedKeys.push("gates");
+    return { result: cleaned2, strippedKeys };
   }
   const gateSchemas = GateConfigSchema.shape;
   const cleanedGates = { ...raw.gates };
@@ -132,6 +137,7 @@ function sanitizeGatesConfig(raw) {
     if (!schema) {
       advisoryWarn(`[opencode-swarm] Unknown gates config section "gates.${key}" ignored. Other config sections remain active.`);
       delete cleanedGates[key];
+      strippedKeys.push(`gates.${key}`);
       continue;
     }
     const knownFields = GATE_CONFIG_KNOWN_SECTION_KEYS[key];
@@ -143,6 +149,7 @@ function sanitizeGatesConfig(raw) {
         if (!knownFieldSet.has(fieldName)) {
           advisoryWarn(`[opencode-swarm] Unknown gates config key "gates.${key}.${fieldName}" ignored. Other config sections remain active.`);
           delete cleanedSection[fieldName];
+          strippedKeys.push(`gates.${key}.${fieldName}`);
         }
       }
       sectionValue = cleanedSection;
@@ -152,22 +159,30 @@ function sanitizeGatesConfig(raw) {
     if (!sectionResult.success) {
       advisoryWarn(`[opencode-swarm] gates.${key} config validation failed; that gate section will use defaults and other config sections remain active:`, formatZodIssues(sectionResult.error));
       delete cleanedGates[key];
+      if (!strippedKeys.includes(`gates.${key}`)) {
+        strippedKeys.push(`gates.${key}`);
+      }
     }
   }
   const gatesResult = GateConfigSchema.safeParse(cleanedGates);
   if (gatesResult.success) {
     return {
-      ...raw,
-      gates: gatesResult.data
+      result: { ...raw, gates: gatesResult.data },
+      strippedKeys
     };
   }
   advisoryWarn("[opencode-swarm] gates config validation failed after section cleanup; quality gates will use defaults and other config sections remain active:", formatZodIssues(gatesResult.error));
   const cleaned = { ...raw };
   delete cleaned.gates;
-  return cleaned;
+  if (!strippedKeys.includes("gates")) {
+    strippedKeys.push("gates");
+  }
+  return { result: cleaned, strippedKeys };
 }
 function sanitizeSectionConfigs(raw) {
-  return sanitizeGatesConfig(sanitizeExternalSkillsConfig(raw));
+  const { result: afterExternal, strippedKeys: externalStripped } = sanitizeExternalSkillsConfig(raw);
+  const { result, strippedKeys: gatesStripped } = sanitizeGatesConfig(afterExternal);
+  return { result, strippedKeys: [...externalStripped, ...gatesStripped] };
 }
 function formatZodIssues(error) {
   if (error.issues.length === 0)
@@ -205,87 +220,133 @@ function stripUnrecognizedKeys(raw, error) {
   }
   return { cleaned, removed };
 }
-function parseConfigWithFallback(mergedRaw, rawUserConfig, failedResult, loadedFromFile, configHadErrors) {
-  const result = failedResult;
-  const secure = (config) => loadedFromFile && configHadErrors ? PluginConfigSchema.parse({
-    ...config,
+function warningForRemovedKeys(removedKeys) {
+  return `Ignored ${removedKeys.length} invalid or unrecognized config key(s): ${removedKeys.join(", ")}. The rest of your configuration was preserved. Fix or remove these keys.`;
+}
+function rawFullAutoLocked(raw) {
+  if (!raw || typeof raw !== "object")
+    return false;
+  const fullAuto = raw.full_auto;
+  if (!fullAuto || typeof fullAuto !== "object" || Array.isArray(fullAuto)) {
+    return false;
+  }
+  return fullAuto.locked === true;
+}
+function buildConfigWithMeta(rawUserConfig, rawProjectConfig, loadedFromFile, configHadErrors) {
+  let mergedRaw = rawUserConfig ?? {};
+  if (rawProjectConfig) {
+    mergedRaw = deepMerge(mergedRaw, rawProjectConfig);
+  }
+  if (rawFullAutoLocked(rawUserConfig) || rawFullAutoLocked(rawProjectConfig)) {
+    const fa = mergedRaw.full_auto && typeof mergedRaw.full_auto === "object" && !Array.isArray(mergedRaw.full_auto) ? mergedRaw.full_auto : {};
+    mergedRaw = { ...mergedRaw, full_auto: { ...fa, locked: true } };
+  }
+  mergedRaw = migratePresetsConfig(mergedRaw);
+  const { result: sanitized, strippedKeys: gatesStripped } = sanitizeSectionConfigs(mergedRaw);
+  mergedRaw = sanitized;
+  const sanitizedWarning = gatesStripped.length > 0 ? warningForRemovedKeys(gatesStripped) : undefined;
+  const secure = (cfg) => loadedFromFile && configHadErrors ? PluginConfigSchema.parse({
+    ...cfg,
     guardrails: { enabled: true }
-  }) : config;
-  const { cleaned, removed } = stripUnrecognizedKeys(mergedRaw, result.error);
+  }) : cfg;
+  const firstResult = PluginConfigSchema.safeParse(mergedRaw);
+  if (firstResult.success) {
+    const config = secure(firstResult.data);
+    if (loadedFromFile && configHadErrors) {
+      const securityWarning = "\u26A0\uFE0F SECURITY: Falling back to conservative defaults with guardrails ENABLED. Fix the config file to restore custom configuration.";
+      advisoryWarn(`[opencode-swarm] ${securityWarning}`);
+      return {
+        config,
+        recovery: "guardrails_defaults",
+        removedKeys: [...gatesStripped],
+        warnings: [
+          ...sanitizedWarning ? [sanitizedWarning] : [],
+          securityWarning
+        ]
+      };
+    }
+    if (sanitizedWarning)
+      advisoryWarn(`[opencode-swarm] ${sanitizedWarning}`);
+    return {
+      config,
+      recovery: gatesStripped.length > 0 ? "stripped_keys" : "none",
+      removedKeys: [...gatesStripped],
+      warnings: sanitizedWarning ? [sanitizedWarning] : []
+    };
+  }
+  const { cleaned, removed } = stripUnrecognizedKeys(mergedRaw, firstResult.error);
   if (removed.length > 0) {
     const recovered = PluginConfigSchema.safeParse(cleaned);
     if (recovered.success) {
-      advisoryWarn(`[opencode-swarm] Ignored ${removed.length} unrecognized config key(s): ${removed.join(", ")}. The rest of your configuration was preserved. Fix or remove these keys.`);
-      return secure(recovered.data);
+      const removedKeys = [...gatesStripped, ...removed];
+      const warning = warningForRemovedKeys(removedKeys);
+      advisoryWarn(`[opencode-swarm] ${warning}`);
+      return {
+        config: secure(recovered.data),
+        recovery: "stripped_keys",
+        removedKeys,
+        warnings: [warning]
+      };
     }
   }
   if (rawUserConfig) {
-    const userSanitized = sanitizeSectionConfigs(rawUserConfig ?? {});
+    const { result: userSanitized, strippedKeys: userGatesStripped } = sanitizeSectionConfigs(rawUserConfig);
     const userParseResult = PluginConfigSchema.safeParse(userSanitized);
     if (userParseResult.success) {
       advisoryWarn("[opencode-swarm] Project config ignored due to validation errors. Using user config.");
-      return secure(userParseResult.data);
+      return {
+        config: secure(userParseResult.data),
+        recovery: "user_only",
+        removedKeys: [...gatesStripped, ...userGatesStripped],
+        warnings: [
+          "Project config ignored due to validation errors; using user config."
+        ]
+      };
     }
     const userStripped = stripUnrecognizedKeys(userSanitized, userParseResult.error);
     if (userStripped.removed.length > 0) {
       const userRecovered = PluginConfigSchema.safeParse(userStripped.cleaned);
       if (userRecovered.success) {
         advisoryWarn(`[opencode-swarm] Project config ignored; also ignored ${userStripped.removed.length} unrecognized user-config key(s): ${userStripped.removed.join(", ")}.`);
-        return secure(userRecovered.data);
+        return {
+          config: secure(userRecovered.data),
+          recovery: "user_only",
+          removedKeys: [
+            ...gatesStripped,
+            ...userGatesStripped,
+            ...userStripped.removed
+          ],
+          warnings: [
+            "Project config ignored due to validation errors; using user config."
+          ]
+        };
       }
     }
   }
-  const offending = stripUnrecognizedKeys(mergedRaw, result.error).removed;
+  const offending = stripUnrecognizedKeys(mergedRaw, firstResult.error).removed;
   if (offending.length > 0) {
     advisoryWarn(`[opencode-swarm] Merged config validation failed. Unrecognized key(s): ${offending.join(", ")}.`);
   } else {
-    advisoryWarn("[opencode-swarm] Merged config validation failed:", formatZodIssues(result.error));
+    advisoryWarn("[opencode-swarm] Merged config validation failed:", formatZodIssues(firstResult.error));
   }
   advisoryWarn("[opencode-swarm] \u26A0\uFE0F SECURITY: Falling back to conservative defaults with guardrails ENABLED. Fix the config file to restore custom configuration.");
-  return PluginConfigSchema.parse({ guardrails: { enabled: true } });
-}
-function rawFullAutoLocked(raw) {
-  if (!raw || typeof raw !== "object")
-    return false;
-  const fullAuto = raw.full_auto;
-  if (!fullAuto || typeof fullAuto !== "object" || Array.isArray(fullAuto)) {
-    return false;
-  }
-  return fullAuto.locked === true;
+  return {
+    config: PluginConfigSchema.parse({ guardrails: { enabled: true } }),
+    recovery: "guardrails_defaults",
+    removedKeys: [...gatesStripped],
+    warnings: [
+      "Config failed validation; using safe defaults with guardrails enabled."
+    ]
+  };
 }
 function loadPluginConfig(directory) {
   const userConfigPath = path.join(getUserConfigDir(), "opencode", CONFIG_FILENAME);
   const projectConfigPath = path.join(directory, ".opencode", CONFIG_FILENAME);
   const userResult = loadRawConfigFromPath(userConfigPath);
   const projectResult = loadRawConfigFromPath(projectConfigPath);
-  const rawUserConfig = userResult.config;
-  const rawProjectConfig = projectResult.config;
   const loadedFromFile = userResult.fileExisted || projectResult.fileExisted;
   const configHadErrors = userResult.hadError || projectResult.hadError;
-  let mergedRaw = rawUserConfig ?? {};
-  if (rawProjectConfig) {
-    mergedRaw = deepMerge(mergedRaw, rawProjectConfig);
-  }
-  if (rawFullAutoLocked(rawUserConfig) || rawFullAutoLocked(rawProjectConfig)) {
-    const fullAutoRaw = mergedRaw.full_auto && typeof mergedRaw.full_auto === "object" && !Array.isArray(mergedRaw.full_auto) ? mergedRaw.full_auto : {};
-    mergedRaw = {
-      ...mergedRaw,
-      full_auto: { ...fullAutoRaw, locked: true }
-    };
-  }
-  mergedRaw = migratePresetsConfig(mergedRaw);
-  mergedRaw = sanitizeSectionConfigs(mergedRaw);
-  const result = PluginConfigSchema.safeParse(mergedRaw);
-  if (result.success) {
-    if (loadedFromFile && configHadErrors) {
-      return PluginConfigSchema.parse({
-        ...mergedRaw,
-        guardrails: { enabled: true }
-      });
-    }
-    return result.data;
-  }
-  return parseConfigWithFallback(mergedRaw, rawUserConfig, result, loadedFromFile, configHadErrors);
+  return buildConfigWithMeta(userResult.config, projectResult.config, loadedFromFile, configHadErrors).config;
 }
 function loadPluginConfigWithMeta(directory) {
   const userConfigPath = path.join(getUserConfigDir(), "opencode", CONFIG_FILENAME);
@@ -294,8 +355,15 @@ function loadPluginConfigWithMeta(directory) {
   const projectResult = loadRawConfigFromPath(projectConfigPath);
   const loadedFromFile = userResult.fileExisted || projectResult.fileExisted;
   const configHadErrors = userResult.hadError || projectResult.hadError;
-  const config = loadPluginConfig(directory);
-  return { config, loadedFromFile, configHadErrors };
+  const { config, recovery, removedKeys, warnings } = buildConfigWithMeta(userResult.config, projectResult.config, loadedFromFile, configHadErrors);
+  return {
+    config,
+    loadedFromFile,
+    configHadErrors,
+    recovery,
+    removedKeys,
+    warnings
+  };
 }
 async function loadRawConfigFromPathAsync(configPath) {
   try {
@@ -335,25 +403,6 @@ async function loadRawConfigFromPathAsync(configPath) {
     return { config: null, fileExisted: true, hadError: true };
   }
 }
-function reduceParsedConfig(rawUserConfig, rawProjectConfig, loadedFromFile, configHadErrors) {
-  let mergedRaw = rawUserConfig ?? {};
-  if (rawProjectConfig) {
-    mergedRaw = deepMerge(mergedRaw, rawProjectConfig);
-  }
-  mergedRaw = migratePresetsConfig(mergedRaw);
-  mergedRaw = sanitizeSectionConfigs(mergedRaw);
-  const result = PluginConfigSchema.safeParse(mergedRaw);
-  if (result.success) {
-    if (loadedFromFile && configHadErrors) {
-      return PluginConfigSchema.parse({
-        ...mergedRaw,
-        guardrails: { enabled: true }
-      });
-    }
-    return result.data;
-  }
-  return parseConfigWithFallback(mergedRaw, rawUserConfig, result, loadedFromFile, configHadErrors);
-}
 async function loadPluginConfigWithMetaAsync(directory) {
   const userConfigPath = path.join(getUserConfigDir(), "opencode", CONFIG_FILENAME);
   const projectConfigPath = path.join(directory, ".opencode", CONFIG_FILENAME);
@@ -363,8 +412,15 @@ async function loadPluginConfigWithMetaAsync(directory) {
   ]);
   const loadedFromFile = userResult.fileExisted || projectResult.fileExisted;
   const configHadErrors = userResult.hadError || projectResult.hadError;
-  const config = reduceParsedConfig(userResult.config, projectResult.config, loadedFromFile, configHadErrors);
-  return { config, loadedFromFile, configHadErrors };
+  const { config, recovery, removedKeys, warnings } = buildConfigWithMeta(userResult.config, projectResult.config, loadedFromFile, configHadErrors);
+  return {
+    config,
+    loadedFromFile,
+    configHadErrors,
+    recovery,
+    removedKeys,
+    warnings
+  };
 }
 function loadAgentPrompt(agentName) {
   const promptsDir = path.join(getUserConfigDir(), "opencode", PROMPTS_DIR_NAME);