opencode-swarm 7.132.0 → 7.132.2

package/dist/hooks/guardrails/index.d.ts

@@ -19,6 +19,13 @@ export declare const _internals: {
     resolveFallbackModel: typeof resolveFallbackModel;
     dcCheckJunctionCreation: typeof dcCheckJunctionCreation;
     extractErrorSignal: typeof extractErrorSignal;
+    /**
+     * Test/inspection seams for the no-op detector's bounded session state
+     * (invariant 8). Production code does not call these; they exist so the
+     * eviction bound can be asserted without exporting the maps themselves.
+     */
+    noOpStateSize: () => number;
+    hasNoOpState: (sessionID: string) => boolean;
 };
 /**
  * Issue #853 Layer B: tools that are structurally blocked while
@@ -36,6 +43,31 @@ export declare function enforceSpecDriftGate(directory: string | undefined, tool
  * Extracts bounded provider/error signal from unknown hook error payloads.
  */
 declare function extractErrorSignal(errorContent: unknown): string;
+/**
+ * v6.33.1: No-op work detector state.
+ *
+ * AGENTS.md invariant 8: module-level, session-keyed state must have an explicit
+ * eviction strategy. Both containers below are keyed by `sessionID` and were
+ * previously unbounded — they grew for the lifetime of the plugin process, since
+ * nothing removed a key when a session ended. `noOpWarningIssued` was only ever
+ * `delete`d on a reset, and `toolCallsSinceLastWrite` never shrank at all.
+ *
+ * Bounded LRU, evicting the LEAST-RECENTLY-TOUCHED session.
+ *
+ * Plain insertion-order (FIFO) eviction is wrong here and actively harmful.
+ * `Map.set()` on an EXISTING key does not move it, so the first session created
+ * in the process stays permanently at the front of the iteration order. In an
+ * OpenCode plugin process that first session is the architect — the very session
+ * this detector exists to watch — making it the guaranteed first eviction victim
+ * while a session touched once and abandoned later survives. Measured: with a
+ * FIFO bound, an architect climbing toward the threshold had its counter evicted
+ * and reset mid-climb, and its 15th consecutive no-write call produced ZERO
+ * warnings. A bound must not silence the detector it was added to protect.
+ *
+ * {@link touchNoOpSession} therefore deletes before setting, moving the key to
+ * the back on every touch, so eviction genuinely targets quiet sessions.
+ */
+export declare const MAX_TRACKED_NO_OP_SESSIONS = 200;
 /**
  * Redacts sensitive values from a shell command string before audit logging.
  * Single-sourced from ./helpers (which additionally redacts home paths).

package/dist/hooks/guardrails/messages-transform.d.ts

@@ -32,6 +32,13 @@ type ChatMessageLike = {
         text?: unknown;
     }>;
 };
+/**
+ * Shared by the runaway-output advisory's TEXT and its once-per-drain dedupe
+ * predicate, so the two can never drift apart again. They previously did: the
+ * predicate tested for the string 'runaway output', which the pushed message
+ * never contained, making the guard permanently inert.
+ */
+export declare const RUNAWAY_OUTPUT_ADVISORY_MARKER = "Model is generating analysis without taking action";
 export declare function getMostRecentAssistantText(messages: ChatMessageLike[]): string;
 export declare function isTransientProviderFailureText(text: string): boolean;
 export declare function getProviderFailureFingerprint(text: string): string;

package/dist/hooks/guardrails.d.ts

@@ -10,5 +10,5 @@
  * - Layer 2 (Hard Block @ 100%): Throws error in toolBefore to block further calls, injects STOP message
  */
 export { type AgentRule, type AttestationRecord, buildEffectiveRules, checkFileAuthority, checkFileAuthorityWithRules, checkWriteTargetForSymlink, clearGuardrailsCaches, DEFAULT_AGENT_AUTHORITY_RULES, getGlobMatcher, hashArgs, isOnDifferentFilesystemRoot, normalizePathWithCache, recordAttestation, validateAndRecordAttestation, validateAttestation, } from './guardrails/file-authority';
-export { _internals, createGuardrailsHooks, enforceSpecDriftGate, redactShellCommand, SPEC_DRIFT_BLOCKED_TOOLS, } from './guardrails/index';
+export { _internals, createGuardrailsHooks, enforceSpecDriftGate, MAX_TRACKED_NO_OP_SESSIONS, redactShellCommand, SPEC_DRIFT_BLOCKED_TOOLS, } from './guardrails/index';
 export { deleteStoredInputArgs, getStoredInputArgs, setStoredInputArgs, } from './guardrails/stored-input-args';

package/dist/hooks/pr-workflow-gate.d.ts

@@ -354,6 +354,7 @@ export declare const _test_exports: {
     resolveRemoteRefsContainingHeadAsync: typeof resolveRemoteRefsContainingHeadAsync;
     parseCriticVerdict: typeof parseCriticVerdict;
     isProcessAlive: typeof isProcessAlive;
+    isSafeStandaloneGitCommit: typeof isSafeStandaloneGitCommit;
     rename: typeof fsp.rename;
     nowMs: () => number;
 };
@@ -366,6 +367,7 @@ export declare function normalizePrWorkflowShellCommand(command: string): {
     normalized: string;
     strippedCdPrefix: boolean;
 };
+declare function isSafeStandaloneGitCommit(command: string): boolean;
 /** Require at least one real discovery row or a lane-bound CLEAN attestation. */
 export declare function prReviewDiscoveryArtifactCoversLane(text: string, expectedWorkflowLane: string): boolean;
 declare function parseCriticVerdict(text: string, itemId: string, reviewerSeverity?: string): {

package/dist/hooks/pr-workflow-response-gate.d.ts

@@ -26,26 +26,38 @@ export declare const DEFAULT_MAX_CONSECUTIVE_UNPRODUCTIVE_WAKES = 5;
  */
 export declare const DEFAULT_WAKE_COOLDOWN_MS = 30000;
 /**
- * Minimum time between FULL workflow banners prepended to a single session's
- * completed text parts. The textComplete hook prepends a banner to every
- * architect text part while the durable gate exists; without a cooldown a
- * burst of reasoning parts repeats the full multi-line banner many times
- * (field report: ~8 repeats between two model thoughts). Within the cooldown a
- * short one-line marker is prepended instead; the full banner (and its
- * suspension/interruption recovery notices) returns once the cooldown elapses.
+ * Minimum time between FULL workflow banners for a single session. The banner
+ * is injected at most once per assistant MESSAGE (see the `banneredMessages`
+ * map in {@link createPrWorkflowResponseGate}); this cooldown only chooses
+ * whether that one injection is the full multi-line banner or the short
+ * one-line marker.
  *
- * The input event exposes only `{ sessionID }` — there is NO message/part ID —
- * so this dedupe is necessarily a per-session cooldown, not a per-message one.
- *
- * Suspended and user-interrupted states BYPASS the cooldown entirely: those are
- * invariant-10 operational notices that must appear in full on every part.
+ * Suspended and user-interrupted states BYPASS the cooldown: those are
+ * invariant-10 operational notices that must not be downgraded to the short
+ * marker. They are still subject to the per-message dedupe — "always visible"
+ * means visible on every user-facing turn, not repeated on every part of it.
  * Overridable via `createPrWorkflowResponseGate({ bannerCooldownMs })`.
  */
 export declare const DEFAULT_BANNER_COOLDOWN_MS = 20000;
+/**
+ * Absolute per-session injection ceiling used ONLY when the host does not
+ * supply `messageID`. The pinned host contract
+ * (`@opencode-ai/plugin` `index.d.ts`: `experimental.text.complete` receives
+ * `{ sessionID, messageID, partID }`, all required) always supplies it, so this
+ * path is defensive. Without a ceiling, a host that omitted `messageID` would
+ * fall back to the wall-clock window alone — which is exactly the behavior that
+ * produced the measured flood (968 marker-only lines, 55.3% of a real review
+ * transcript), because a cooldown only downgrades an injection, it never
+ * suppresses one.
+ */
+export declare const MAX_FALLBACK_BANNER_INJECTIONS_PER_SESSION = 20;
 /**
  * Bounded FIFO map of tracked wake budgets. Invariant 8 (session/global
- * state): module-level state must have an explicit eviction strategy. The
- * banner-stamp map (last full-banner instant per session) shares this bound.
+ * state): module-level state must have an explicit eviction strategy. Three
+ * further per-session maps share this same bound and the same FIFO discipline:
+ * `bannerStamps` (instant of the last full banner), `banneredMessages` (the
+ * assistant message already carrying a banner), and `fallbackInjections` (the
+ * injection count on the messageID-less path).
  */
 export declare const MAX_TRACKED_WAKE_SESSIONS = 200;
 interface PrWorkflowResponseGateClient {
@@ -59,19 +71,23 @@ interface WakeBudget {
 }
 /**
  * Prevent an architect from masquerading a premature text output as a terminal
- * verdict. The text-complete hook prepends a workflow-active banner to
- * architect-session text parts while the durable gate exists; the model's
- * original text is preserved below the banner. To avoid spamming the full
- * multi-line banner across a burst of reasoning parts, the full banner is
- * throttled per session (see DEFAULT_BANNER_COOLDOWN_MS) — within the cooldown a
- * short one-line marker is prepended instead. session.idle then mechanically
- * resumes that session.
+ * verdict. The text-complete hook prepends a workflow-active banner to the
+ * FIRST substantive text part of each architect message while the durable gate
+ * exists; the model's original text is preserved below the banner.
+ *
+ * Injection is bounded on three independent axes, because a banner that is
+ * merely throttled is still injected on every part:
+ *   1. blank parts are never decorated (a banner labelling no content is noise);
+ *   2. a part that already opens with a banner is never re-decorated;
+ *   3. at most ONE injection per assistant `messageID`.
+ * The wall-clock cooldown (see DEFAULT_BANNER_COOLDOWN_MS) then only chooses
+ * whether that single injection is the full banner or the short marker.
  *
- * The resume loop is bounded (see DEFAULT_MAX_CONSECUTIVE_UNPRODUCTIVE_WAKES)
- * so a session that cannot make progress suspends instead of spinning
- * forever. Suspended and user-interrupted parts bypass the cooldown and always
- * carry the full suspension/interruption recovery notices so the user-visible
- * surface always names the recovery path.
+ * session.idle mechanically resumes a gated session. The resume loop is bounded
+ * (see DEFAULT_MAX_CONSECUTIVE_UNPRODUCTIVE_WAKES) so a session that cannot make
+ * progress suspends instead of spinning forever. Suspended and user-interrupted
+ * messages bypass the cooldown so their recovery notices are never downgraded to
+ * the short marker.
  */
 export declare function createPrWorkflowResponseGate(options: {
     directory: string;
@@ -86,6 +102,8 @@ export declare function createPrWorkflowResponseGate(options: {
     }) => Promise<void>;
     textComplete: (input: {
         sessionID?: string;
+        messageID?: string;
+        partID?: string;
     }, output: {
         text: string;
     }) => Promise<void>;

package/dist/index.d.ts

@@ -26,6 +26,19 @@ export declare function overrideIndexInternalsForTest(overrides: {
     ensureSwarmGitExcluded?: typeof ensureSwarmGitExcluded;
 }): () => void;
 export declare function schedulePostResolutionTasksForTest(tasks: readonly PostResolutionTask[]): void;
+/**
+ * Compute the effective set of tools eligible for line-based truncation.
+ *
+ * SUMMARIZER_EXEMPT_TOOL_NAMES is applied as an unconditional floor
+ * subtraction against BOTH the default allowlist and any operator-configured
+ * `tool_output.truncation_tools` override (finding R6). Line-truncating a
+ * lane/retrieval tool's payload destroys the `output_ref` rows a caller needs
+ * to recover the full content — the same unrecoverable-payload defect class
+ * the summarizer/context-budget floor already guards against — so operator
+ * config must never be able to reintroduce it via this separate rewriting
+ * layer.
+ */
+export declare function computeEffectiveTruncatableTools(defaultTools: ReadonlySet<string>, configuredTools: readonly string[] | undefined): Set<string>;
 declare const _default: {
     id: "opencode-swarm";
     server: Plugin;