opencode-swarm 7.126.0 → 7.126.2

package/dist/hooks/pr-workflow-gate.d.ts

@@ -1,3 +1,4 @@
+import * as fsp from 'node:fs/promises';
 import { resolveCommitCountSince, resolveCurrentGitHead, resolveCurrentUpstreamPushTarget, resolveCurrentUpstreamRemoteRef, resolveExactRemoteBranchHead, resolveIsExactSingleChildCommit, resolveIsWorkingTreeClean, resolvePrWorkflowRevisionDigest, resolveRemoteRefsContainingHead } from '../background/workspace-snapshot.js';
 export declare const PR_REVIEW_BASE_DIMENSION_IDS: readonly ["intent-architecture", "correctness-state", "tests-falsifiability", "security-trust", "reliability-performance", "compatibility-delivery"];
 export declare const PR_REVIEW_REQUIRED_MICRO_LANE_IDS: readonly ["auth-identity-secrets", "untrusted-input-boundaries", "subprocess-platform", "concurrency-state", "dependencies-build-release", "api-schema-migrations", "test-infrastructure", "ui-accessibility-i18n", "privacy-observability", "generated-provenance", "unclassified-risk"];
@@ -79,6 +80,20 @@ interface PrFeedbackReadyToPublishRecord {
 }
 export type PrWorkflowCompletionStatus = 'completed' | 'ready-to-publish';
 export type PrReviewValidationPhase = 'council' | 'reviewer' | 'critic';
+export type PrReviewArtifactBoundary = 'post_explorer' | 'post_reviewer' | 'post_critic';
+type PrReviewArtifactRecord = {
+    finding_id: string;
+    status: 'PENDING' | 'CONFIRMED' | 'DISPROVED' | 'PRE_EXISTING';
+    next_action: 'route_to_reviewer' | 'route_to_critic' | 'report' | 'suppress_with_reason' | 'handoff_to_feedback';
+    severity?: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
+};
+interface PrFeedbackScopeDeclarationRecord {
+    taskId: string;
+    files: string[];
+    revisionDigest: string;
+    declaredAt: string;
+    consumedByCallId?: string;
+}
 interface PrReviewValidationBatchRecord {
     batchId: string;
     phase: PrReviewValidationPhase;
@@ -105,6 +120,11 @@ export interface PrWorkflowGateState {
     prReviewBaseDispatch?: PrReviewBaseDispatchRecord;
     prReviewTriggerEvalPath?: string;
     prReviewValidationBatches?: PrReviewValidationBatchRecord[];
+    prReviewArtifactRunId?: string;
+    prReviewFindingsPath?: string;
+    prReviewArtifactBoundaries?: PrReviewArtifactBoundary[];
+    prReviewHandoffPath?: string;
+    prReviewHandoffRequired?: boolean;
     prFeedbackInventory?: string[];
     prFeedbackVerifications?: PrFeedbackVerificationRecord[];
     /** @deprecated Compatibility projection of the most recent verification dispatch. */
@@ -112,11 +132,21 @@ export interface PrWorkflowGateState {
     prFeedbackStageA?: PrFeedbackStageARecord;
     prFeedbackGateBatches?: PrFeedbackGateBatchRecord[];
     prFeedbackReadyToPublish?: PrFeedbackReadyToPublishRecord;
+    prFeedbackScopes?: PrFeedbackScopeDeclarationRecord[];
 }
 export declare function activatePrWorkflow(directory: string, sessionID: string, mode: PrWorkflowMode, options?: {
     prHeadSha?: string;
 }): Promise<PrWorkflowGateState>;
 export declare function readPrWorkflowGateState(directory: string, sessionID: string): Promise<PrWorkflowGateState | null>;
+/**
+ * Serialize a pre-bind checkout-preservation controller with every terminal
+ * PR-workflow transition for the raw parent session. The caller's action may
+ * perform the fixed Git preservation command while holding this lock; abort,
+ * bind, and a same-session reactivation cannot clear or replace the gate until
+ * it settles. The state passed to the action is schema-validated durable state,
+ * never a caller-supplied projection.
+ */
+export declare function withPrWorkflowCheckoutPreparationLock<T>(directory: string, sessionID: string, action: (state: PrWorkflowGateState) => Promise<T>): Promise<T>;
 export declare function clearPrWorkflowGateState(directory: string, sessionID: string, expectedRevision?: number): Promise<void>;
 /**
  * Abort an active PR workflow gate without reaching terminal completion.
@@ -210,6 +240,25 @@ export declare function assertPrFeedbackGatePhaseSettled(directory: string, sess
 /** Require every ordered feedback gate on one unchanged revision. */
 export declare function assertPrFeedbackReadyToPublish(directory: string, sessionID: string): Promise<PrWorkflowGateState>;
 export declare function markPrReviewTriggerEvaluationComplete(directory: string, sessionID: string, artifactPath: string): Promise<PrWorkflowGateState>;
+export declare function assertPrReviewArtifactBoundary(directory: string, sessionID: string, runId: string, boundary: PrReviewArtifactBoundary, findingIds: string[]): Promise<PrWorkflowGateState>;
+/**
+ * Artifact records are a projection of lane receipts, never a caller-controlled
+ * replacement for them. Keep their workflow status/action aligned with the
+ * reviewer and critic rows that the gate already authenticated.
+ */
+export declare function assertPrReviewArtifactRecordsMatchAuthoritativeVerdicts(directory: string, sessionID: string, boundary: PrReviewArtifactBoundary, records: readonly PrReviewArtifactRecord[]): Promise<void>;
+export declare function markPrReviewArtifactBoundary(directory: string, sessionID: string, runId: string, boundary: PrReviewArtifactBoundary, artifactPath: string, findingIds: string[], handoffRequired: boolean): Promise<PrWorkflowGateState>;
+export declare function markPrReviewHandoffComplete(directory: string, sessionID: string, runId: string, artifactPath: string): Promise<PrWorkflowGateState>;
+export declare function declarePrFeedbackScope(directory: string, sessionID: string, taskId: string, files: string[]): Promise<PrWorkflowGateState>;
+export declare function resolvePrFeedbackScopeDeclaration(directory: string, sessionID: string, taskId: string): Promise<PrFeedbackScopeDeclarationRecord | null>;
+export declare function consumePrFeedbackScopeDeclaration(directory: string, sessionID: string, taskId: string, callID: string): Promise<PrFeedbackScopeDeclarationRecord | null>;
+export declare function validatePrFeedbackScopeBinding(directory: string, binding: {
+    taskId: string;
+    files: string[];
+    dispatchCallId?: string;
+    workflowSessionId?: string;
+    workflowRevisionDigest?: string;
+}): Promise<boolean>;
 export declare function enforcePrWorkflowToolBefore(directory: string, sessionID: string, toolName: string, args: Record<string, unknown> | undefined, generatedAgentNames?: readonly string[]): Promise<void>;
 /** Validate the terminal PR workflow contract before removing its durable gate. */
 export declare function completePrWorkflow(directory: string, sessionID: string, expectedMode: PrWorkflowMode, prHeadSha: string): Promise<PrWorkflowCompletionStatus>;
@@ -229,6 +278,7 @@ export declare const _test_exports: {
     resolveRemoteRefsContainingHead: typeof resolveRemoteRefsContainingHead;
     parseCriticVerdict: typeof parseCriticVerdict;
     isProcessAlive: typeof isProcessAlive;
+    rename: typeof fsp.rename;
     nowMs: () => number;
 };
 /** Require at least one real discovery row or a lane-bound CLEAN attestation. */
@@ -240,4 +290,11 @@ declare function parseCriticVerdict(text: string, itemId: string, reviewerSeveri
 declare function isProcessAlive(pid: number): boolean;
 declare function workflowGateStateLockRelativePath(sessionID: string): string;
 declare function workflowGateStateRelativePath(sessionID: string): string;
+export declare function prWorkflowSessionFileStem(sessionID: string): string;
+/**
+ * Write a PR-workflow artifact with the gate's Windows-safe atomic persistence
+ * contract. Checkout-preparation receipts must survive the same transient
+ * rename contention as canonical gate state.
+ */
+export declare function writePrWorkflowAtomicJson(filePath: string, value: unknown): Promise<void>;
 export {};

package/dist/hooks/scope-guard.d.ts

@@ -8,8 +8,10 @@
  * Fires BEFORE write/edit tools execute. When a coder attempts to modify a file
  * outside its Task-correlated scope, blocks the call and injects an advisory.
  */
-import { resolveAuthorizedScopeBinding, resolveAuthorizedScopeBindingForSession } from '../scope/scope-persistence';
+import { getAuthorizedPrFeedbackScopeBinding } from '../scope/scope-binding';
+import { resolveAuthorizedPrFeedbackScopeBindingFromDisk, resolveAuthorizedScopeBinding, resolveAuthorizedScopeBindingForSession } from '../scope/scope-persistence';
 import { type AgentSessionState } from '../state';
+import { validatePrFeedbackScopeBinding } from './pr-workflow-gate';
 import { resolveWriteTargets } from './write-target-resolver';
 /**
  * Configuration for scope guard behavior.
@@ -69,6 +71,9 @@ export declare const _internals: {
     resolveWriteTargets: typeof resolveWriteTargets;
     resolveAuthorizedScopeBinding: typeof resolveAuthorizedScopeBinding;
     resolveAuthorizedScopeBindingForSession: typeof resolveAuthorizedScopeBindingForSession;
+    getAuthorizedPrFeedbackScopeBinding: typeof getAuthorizedPrFeedbackScopeBinding;
+    resolveAuthorizedPrFeedbackScopeBindingFromDisk: typeof resolveAuthorizedPrFeedbackScopeBindingFromDisk;
+    validatePrFeedbackScopeBinding: typeof validatePrFeedbackScopeBinding;
     resolveTaskId: (session: AgentSessionState | undefined) => string | null;
 };
 export {};