opencode-swarm 7.129.4 → 7.130.1

package/.opencode/skills/swarm-pr-review/SKILL.md

@@ -198,12 +198,17 @@ If scope cannot be determined, review the narrowest safe scope available and sta
 Before launching explorers (Phase 3), perform this exact standalone sequence:
 
 1. Resolve and retain the authoritative full `pr_head_sha` from PR metadata.
-2. Verify the working tree is clean with `git status --porcelain`. If tracked
-   changes exist, call `prepare_pr_workflow_checkout` with every explicit dirty
-   tracked path (Profile A). Without the controller, do not blind-stash over
+2. Verify the working tree is clean with `git status --porcelain`. If it is
+   dirty at all — tracked changes, untracked files, or both — call
+   `prepare_pr_workflow_checkout` (Profile A). The tool supports
+   self-discovery: call it with no `paths` argument to auto-discover and
+   preserve every dirty path in one step, including untracked files; an
+   already-clean tree returns a no-op (nothing is stashed, no receipt is
+   written). Pass explicit `paths` only when you already have the exact,
+   bounded list of dirty tracked files and want the older exact-match
+   contract. Without the controller (Profiles B/C), do not blind-stash over
    dirty state: surface tracked changes to the user, or abort. Do not issue
-   `git stash` through shell. The controller never stashes untracked files;
-   move or remove those manually, or abort.
+   `git stash` through shell.
 3. Fetch the PR head as one standalone command, for example
    `git fetch origin refs/pull/<N>/head`. Do not compose fetch and checkout.
 4. Prove the full commit exists locally with
@@ -223,6 +228,29 @@ the commit range in a prompt cannot substitute for this checkout because
 
 If refs cannot be fetched or checked out, state the limitation in the context pack.
 
+### Shell rules under the PR_REVIEW gate
+
+The gate accepts one command per tool call — never compose commands with
+`&&`, `;`, `|`, redirects (`>`, `>>`, `<`), or `$(...)`/`` ` `` substitution.
+A single leading `cd <dir> &&` prefix and a trailing `2>&1` suffix are
+tolerated, but only on read-only commands. State-transition verbs — `git
+fetch`, `git checkout`, `git switch`, `git branch`, and `gh pr checkout` —
+must always run bare: no `cd` prefix, no `2>&1` suffix.
+
+Allowed read-only `git` subcommands: `status`, `log`, `show`, `diff`,
+`rev-parse`, `merge-base`, `ls-files`, `grep`, `blame`, `cat-file`,
+`for-each-ref`, `branch --list` (listing only — mutation flags are blocked),
+`remote -v`, and `config --get`.
+
+Prefer tools over raw shell for state that a single read-only command cannot
+cover cleanly:
+
+- `pr_workflow_status` — observe local HEAD, branch, dirty-file state,
+  remotes, and gate state in one read-only call.
+- `gh_evidence` — bounded PR/issue/run metadata without a shell round-trip.
+- If `gh` is not installed, the web fetch tool against the equivalent
+  `api.github.com` REST URL is the degraded read-only path.
+
 ## Phase 0A: Existing PR Signal Ingestion
 
 When reviewing a PR, ingest and triage every existing signal BEFORE starting
@@ -291,17 +319,20 @@ gh api --paginate repos/{owner}/{repo}/pulls/{PR_NUMBER}/comments
 
 # Review summaries (approve/request-changes/comment events)
 gh api --paginate repos/{owner}/{repo}/pulls/{PR_NUMBER}/reviews
-
-# Bot/automated reviews (Copilot, Codex, CodeRabbit, etc.)
-# Inline review comments — use REST API for reliable bot detection via user.type
-gh api --paginate repos/{owner}/{repo}/pulls/{PR_NUMBER}/comments --jq '.[] | select((.user.type // "") == "Bot" or (.user.login // "" | test("bot|copilot|coderabbit|codex"; "i")))'
 ```
 
-`--paginate` requests every REST page; with `--jq`, `gh` applies the filter to
-the combined page stream. Filter bot identities from the complete issue-comment
-result using the same predicate when needed. `gh pr view --json comments,reviews`
-is convenience-only because those fields have item caps; never use it as the
-authoritative “all signals” intake.
+`--paginate` requests every REST page. These three calls are gate-allowed as
+written; do not pipe any of them through `--jq`, `jq`, or another filter under
+the PR_REVIEW gate — piped commands are blocked (fail-closed on `|`). To
+separate bot/automated reviews (Copilot, Codex, CodeRabbit, etc.) from human
+ones, apply the same predicate in context to the JSON already returned above
+— `user.type == "Bot"` or a `user.login` match against
+`bot|copilot|coderabbit|codex` (case-insensitive) — instead of re-fetching
+with a shell-side `--jq` filter. `gh_evidence` with `target: "pr"` and
+`fields: "comments"` is the sanctioned read-only tool path for the same PR
+comment data when a tool call is preferred over a raw shell command. `gh pr
+view --json comments,reviews` is convenience-only because those fields have
+item caps; never use it as the authoritative "all signals" intake.
 
 ### Step 2 — Classify each comment
 
@@ -369,12 +400,15 @@ The response has two independent fields. Handle each:
 
 When the PR has merge conflicts:
 
-1. **Determine the PR's base branch and verify the state:**
-   ```bash
-   BASE_REF=$(gh pr view <PR_NUMBER> --json baseRefName --jq '.baseRefName')
-   git fetch origin $BASE_REF
-   gh pr view <PR_NUMBER> --json mergeable,mergeStateStatus,baseRefName,headRefName
-   ```
+1. **Determine the PR's base branch and verify the state**, as separate
+   standalone commands — never with `$(...)` command substitution, which the
+   PR_REVIEW gate blocks:
+   - Read the base ref: `gh pr view <PR_NUMBER> --json baseRefName` (or
+     `gh_evidence` with `target: "pr"`, `fields: "baseRefName"`).
+   - Fetch it by its literal value, substituted for `<base-ref>`:
+     `git fetch origin <base-ref>`.
+   - Re-check merge state: `gh pr view <PR_NUMBER> --json
+     mergeable,mergeStateStatus,baseRefName,headRefName`.
 
 2. **Capture the affected scope without changing the branch:**
    - List the files or subsystems implicated by the conflict if GitHub exposes them,
@@ -405,19 +439,34 @@ reviewer, or another swarm may have pushed commits while you were reviewing.
 This is still read-only: capture the remote state so the handoff artifact starts
 from the right branch facts.
 
-### Step 1 — Refetch and compare
+### Step 1 — Compare remote state (read-only, no post-bind fetch)
+
+Once the PR head is bound, the gate allows only the exact bound tracking
+fetch (when one is armed), and a detached review HEAD has no tracking branch
+to refetch against — `git fetch origin <pr-branch>` is blocked here. Compare
+state through the read-only API instead, as one standalone command:
 
 ```bash
-git fetch origin <pr-branch>
-git log HEAD..origin/<pr-branch> --oneline
+gh pr view <PR_NUMBER> --json headRefOid,commits
 ```
 
+or the equivalent `gh_evidence` call with `target: "pr"` and
+`fields: "headRefOid,commits"`. If the returned `headRefOid` differs from the
+`pr_head_sha` bound at the start of this review, the remote has moved; the
+`commits` field lists every commit's message and author to date, enough to
+judge relevance to the pending findings. (The legitimate place to `git fetch`
+is the pre-bind sequence under "Pre-flight git ref availability" above — this
+step never repeats that fetch post-bind.)
+
 ### Step 2 — Evaluate new commits
 
-For each new commit on the remote:
+For each new commit on the remote (identified by comparing `headRefOid` /
+`commits` above against the SHA bound at the start of the review):
 
-1. **Read the commit message and diff.** Use `git show <commit> --stat` to see
-   file scope, then `git show <commit> -- <file>` to see the actual changes.
+1. **Read the commit message from the `commits` field above.** For file
+   scope, use one standalone read-only call —
+   `gh api repos/{owner}/{repo}/commits/<sha>` — rather than a local
+   `git show`: the new commit's object is not fetched locally post-bind.
 2. **Compare against the pending handoff scope:**
    - Does the remote commit touch the same files as the validated findings?
    - Does the remote commit appear to already address a finding you planned to

package/dist/background/pr-monitor-worker.d.ts

@@ -47,6 +47,12 @@ export declare class PrMonitorWorker {
     private disposed;
     /** In-memory circuit-breaker state per PR correlationId. */
     private readonly circuitBreakerMap;
+    /** In-memory idle-backoff counter per PR correlationId (issue #1691).
+     *  Incremented when a poll cycle detects zero changes; reset on any change.
+     *  Used to skip polls for PRs that have been idle for many cycles. */
+    private readonly idlePollCountMap;
+    /** In-memory total poll cycle counter for deterministic skip scheduling. */
+    private pollCycleCount;
     /** In-memory review decision per PR correlationId (not persisted). */
     private readonly reviewStateMap;
     /** Accumulates merged/closed PR keys during the current poll cycle for sweep cleanup. */
@@ -128,6 +134,19 @@ export declare class PrMonitorWorker {
      * circuit-breaker suspension with exponential backoff.
      */
     private handlePollError;
+    /**
+     * Determine whether to skip polling a PR based on idle backoff (issue #1691).
+     *
+     * After N consecutive no-change polls, skip cycles deterministically:
+     *   idle 0-2:  poll every cycle (no skip)
+     *   idle 3-5:  poll every 2nd cycle (50% reduction)
+     *   idle 6-9:  poll every 3rd cycle (67% reduction)
+     *   idle 10+:  poll every 5th cycle (80% reduction)
+     *
+     * Uses pollCycleCount for deterministic scheduling (no random skips).
+     * Any detected change resets the counter to 0.
+     */
+    private shouldSkipIdlePoll;
     /**
      * Publish an event to the global event bus and optional callback.
      */

package/dist/cli/{config-doctor-2admdwc2.js → config-doctor-489wej17.js}

@@ -12,8 +12,8 @@ import {
   shouldRunOnStartup,
   writeBackupArtifact,
   writeDoctorArtifact
-} from "./index-cpssctv1.js";
-import"./index-7ttstfv6.js";
+} from "./index-p6qgjkbt.js";
+import"./index-5xxgeksy.js";
 import"./index-bk5tah7q.js";
 import"./index-z6xqpmqg.js";
 import"./index-zjygnfay.js";

package/dist/cli/{curation-policy-s08pg90f.js → curation-policy-aaz0hap6.js}

@@ -4,9 +4,9 @@ import {
   authorizeCuration,
   buildConfigFingerprintInput,
   readCohortConfigFingerprint
-} from "./index-nhexgq4a.js";
+} from "./index-xa29259t.js";
 import"./index-rtry5xyf.js";
-import"./index-bz814zsm.js";
+import"./index-jxha73tm.js";
 import"./index-ae75rja9.js";
 import"./index-q27bajqb.js";
 import"./index-zgwm4ryv.js";

package/dist/cli/{curator-6ggzktne.js → curator-by14m5fc.js}

@@ -14,31 +14,31 @@ import {
   runCuratorInit,
   runCuratorPhase,
   writeCuratorSummary
-} from "./index-jke1z4f2.js";
-import"./index-v4n224r1.js";
-import"./index-cpssctv1.js";
+} from "./index-4qrbvrz5.js";
+import"./index-hjar4crm.js";
+import"./index-p6qgjkbt.js";
 import"./index-kzvwb2se.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
 import"./index-9f71ye47.js";
-import"./index-8fy8q1px.js";
-import"./index-mgz9nm4a.js";
-import"./index-hbbj7ktj.js";
+import"./index-jvyn76xe.js";
+import"./index-3rnkyb60.js";
+import"./index-s8h2cedv.js";
 import"./index-vxv732ex.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
 import"./index-g4mnf3p5.js";
-import"./index-x7wt1g4w.js";
-import"./index-nhexgq4a.js";
+import"./index-wy3q73j2.js";
+import"./index-xa29259t.js";
 import"./index-rtry5xyf.js";
-import"./index-n08cksd6.js";
-import"./index-bz814zsm.js";
+import"./index-ts9wh1ba.js";
+import"./index-jxha73tm.js";
 import"./index-ae75rja9.js";
 import"./index-q27bajqb.js";
-import"./index-yxz0c97p.js";
+import"./index-nr5pr54q.js";
 import"./index-k5jrywpr.js";
 import"./index-n832052r.js";
-import"./index-7ttstfv6.js";
+import"./index-5xxgeksy.js";
 import"./index-bk5tah7q.js";
 import"./index-8fwhhayc.js";
 import"./index-q1exe2b3.js";

package/dist/cli/{curator-llm-factory-w6ep20tm.js → curator-llm-factory-7rz7mvcr.js}

@@ -1,31 +1,31 @@
 // @bun
 import {
   createCuratorLLMDelegate
-} from "./index-jke1z4f2.js";
-import"./index-v4n224r1.js";
-import"./index-cpssctv1.js";
+} from "./index-4qrbvrz5.js";
+import"./index-hjar4crm.js";
+import"./index-p6qgjkbt.js";
 import"./index-kzvwb2se.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
 import"./index-9f71ye47.js";
-import"./index-8fy8q1px.js";
-import"./index-mgz9nm4a.js";
-import"./index-hbbj7ktj.js";
+import"./index-jvyn76xe.js";
+import"./index-3rnkyb60.js";
+import"./index-s8h2cedv.js";
 import"./index-vxv732ex.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
 import"./index-g4mnf3p5.js";
-import"./index-x7wt1g4w.js";
-import"./index-nhexgq4a.js";
+import"./index-wy3q73j2.js";
+import"./index-xa29259t.js";
 import"./index-rtry5xyf.js";
-import"./index-n08cksd6.js";
-import"./index-bz814zsm.js";
+import"./index-ts9wh1ba.js";
+import"./index-jxha73tm.js";
 import"./index-ae75rja9.js";
 import"./index-q27bajqb.js";
-import"./index-yxz0c97p.js";
+import"./index-nr5pr54q.js";
 import"./index-k5jrywpr.js";
 import"./index-n832052r.js";
-import"./index-7ttstfv6.js";
+import"./index-5xxgeksy.js";
 import"./index-bk5tah7q.js";
 import"./index-8fwhhayc.js";
 import"./index-q1exe2b3.js";

package/dist/cli/{guardrail-explain-0gr9wkj0.js → guardrail-explain-mvct2n9f.js}

@@ -1,32 +1,32 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-hn1dxcr3.js";
-import"./index-jke1z4f2.js";
-import"./index-v4n224r1.js";
-import"./index-cpssctv1.js";
+} from "./index-j0py44fv.js";
+import"./index-4qrbvrz5.js";
+import"./index-hjar4crm.js";
+import"./index-p6qgjkbt.js";
 import"./index-kzvwb2se.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
 import"./index-9f71ye47.js";
-import"./index-8fy8q1px.js";
-import"./index-mgz9nm4a.js";
-import"./index-hbbj7ktj.js";
+import"./index-jvyn76xe.js";
+import"./index-3rnkyb60.js";
+import"./index-s8h2cedv.js";
 import"./index-vxv732ex.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
 import"./index-g4mnf3p5.js";
-import"./index-x7wt1g4w.js";
-import"./index-nhexgq4a.js";
+import"./index-wy3q73j2.js";
+import"./index-xa29259t.js";
 import"./index-rtry5xyf.js";
-import"./index-n08cksd6.js";
-import"./index-bz814zsm.js";
+import"./index-ts9wh1ba.js";
+import"./index-jxha73tm.js";
 import"./index-ae75rja9.js";
 import"./index-q27bajqb.js";
-import"./index-yxz0c97p.js";
+import"./index-nr5pr54q.js";
 import"./index-k5jrywpr.js";
 import"./index-n832052r.js";
-import"./index-7ttstfv6.js";
+import"./index-5xxgeksy.js";
 import"./index-bk5tah7q.js";
 import"./index-8fwhhayc.js";
 import"./index-q1exe2b3.js";

package/dist/cli/{guardrail-log-7cychbgs.js → guardrail-log-2cejc33f.js}

@@ -1,9 +1,9 @@
 // @bun
 import {
   handleGuardrailLog
-} from "./index-8etcyr9r.js";
-import"./index-v4n224r1.js";
-import"./index-7ttstfv6.js";
+} from "./index-zft4hp35.js";
+import"./index-hjar4crm.js";
+import"./index-5xxgeksy.js";
 import"./index-bk5tah7q.js";
 import"./index-z6xqpmqg.js";
 import"./index-zjygnfay.js";

package/dist/cli/{hive-promoter-4x3470c9.js → hive-promoter-trezcyrd.js}

@@ -7,33 +7,33 @@ import {
   isHiveEligible,
   promoteFromSwarm,
   promoteToHive
-} from "./index-jke1z4f2.js";
-import"./index-v4n224r1.js";
-import"./index-cpssctv1.js";
+} from "./index-4qrbvrz5.js";
+import"./index-hjar4crm.js";
+import"./index-p6qgjkbt.js";
 import"./index-kzvwb2se.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
 import"./index-9f71ye47.js";
-import"./index-8fy8q1px.js";
-import"./index-mgz9nm4a.js";
-import"./index-hbbj7ktj.js";
+import"./index-jvyn76xe.js";
+import"./index-3rnkyb60.js";
+import"./index-s8h2cedv.js";
 import"./index-vxv732ex.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
 import"./index-g4mnf3p5.js";
-import"./index-x7wt1g4w.js";
-import"./index-nhexgq4a.js";
+import"./index-wy3q73j2.js";
+import"./index-xa29259t.js";
 import"./index-rtry5xyf.js";
 import {
   resolveHiveKnowledgePath
-} from "./index-n08cksd6.js";
-import"./index-bz814zsm.js";
+} from "./index-ts9wh1ba.js";
+import"./index-jxha73tm.js";
 import"./index-ae75rja9.js";
 import"./index-q27bajqb.js";
-import"./index-yxz0c97p.js";
+import"./index-nr5pr54q.js";
 import"./index-k5jrywpr.js";
 import"./index-n832052r.js";
-import"./index-7ttstfv6.js";
+import"./index-5xxgeksy.js";
 import"./index-bk5tah7q.js";
 import"./index-8fwhhayc.js";
 import"./index-q1exe2b3.js";

package/dist/cli/{index-mgz9nm4a.js → index-3rnkyb60.js}

@@ -6,13 +6,13 @@ import {
   resolveSwarmKnowledgePath,
   transactKnowledge,
   wordBigrams
-} from "./index-n08cksd6.js";
+} from "./index-ts9wh1ba.js";
 import {
   countEntryContradictionsInWindow,
   countEntryViolationsInWindow,
   readKnowledgeEvents,
   recordKnowledgeEvent
-} from "./index-bz814zsm.js";
+} from "./index-jxha73tm.js";
 import {
   init_knowledge_types,
   isActiveStatus
@@ -190,11 +190,11 @@ async function maybeQuarantineOnContradiction(directory, entryId, threshold, win
         alreadyInactive: true
       };
     }
-    const { quarantineEntry } = await import("./knowledge-validator-rjwvafv3.js");
+    const { quarantineEntry } = await import("./knowledge-validator-sz9v1fdq.js");
     let policyConfig;
     try {
-      const { KnowledgeConfigSchema } = await import("./schema-2x7wsb0n.js");
-      const { loadPluginConfigWithMeta } = await import("./index-nbdge8b6.js");
+      const { KnowledgeConfigSchema } = await import("./schema-fkpn2r1s.js");
+      const { loadPluginConfigWithMeta } = await import("./index-agte9w1e.js");
       const { config: loadedConfig } = loadPluginConfigWithMeta(directory);
       policyConfig = KnowledgeConfigSchema.parse(loadedConfig.knowledge ?? {});
     } catch {