opencode-swarm 7.132.2 → 7.133.0

package/dist/consensus/contracts.d.ts

@@ -68,9 +68,9 @@ export declare const ConsensusMineRequestSchema: z.ZodObject<{
 declare const ConsensusProposedTargetSchema: z.ZodEnum<{
     tooling: "tooling";
     none: "none";
+    orchestration: "orchestration";
     prompt: "prompt";
     skill: "skill";
-    orchestration: "orchestration";
 }>;
 export type ConsensusProposedTarget = z.infer<typeof ConsensusProposedTargetSchema>;
 /**
@@ -151,9 +151,9 @@ export declare const ConsensusAttributeV1Schema: z.ZodObject<{
     proposedTarget: z.ZodEnum<{
         tooling: "tooling";
         none: "none";
+        orchestration: "orchestration";
         prompt: "prompt";
         skill: "skill";
-        orchestration: "orchestration";
     }>;
 }, z.core.$strict>;
 /**
@@ -390,9 +390,9 @@ export declare const ConsensusReportV1Schema: z.ZodObject<{
         proposedTarget: z.ZodEnum<{
             tooling: "tooling";
             none: "none";
+            orchestration: "orchestration";
             prompt: "prompt";
             skill: "skill";
-            orchestration: "orchestration";
         }>;
     }, z.core.$strict>>;
     proposals: z.ZodArray<z.ZodObject<{

package/dist/evaluation/contracts.d.ts

@@ -278,9 +278,9 @@ export declare const PromotionDecisionV1Schema: z.ZodObject<{
     runId: z.ZodString;
     decidedAt: z.ZodISODateTime;
     status: z.ZodEnum<{
+        reject: "reject";
         inconclusive: "inconclusive";
         accept: "accept";
-        reject: "reject";
     }>;
     reasons: z.ZodArray<z.ZodString>;
     baseline: z.ZodObject<{

package/dist/evaluation/ephemeral-agent-dispatcher.d.ts

@@ -0,0 +1,64 @@
+import type { OpencodeClient } from '@opencode-ai/sdk';
+import type { DelegationCostFields } from '../services/cost-accounting.js';
+import { log } from '../utils/logger.js';
+import type { ModelOverride } from '../utils/model-dispatch-fallback.js';
+export declare const DEFAULT_EPHEMERAL_TIMEOUT_MS = 120000;
+export declare const DEFAULT_EPHEMERAL_CLEANUP_TIMEOUT_MS = 500;
+export declare const DEFAULT_EPHEMERAL_PROMPT_BYTE_LIMIT: number;
+export declare const MAX_EPHEMERAL_PROMPT_BYTE_LIMIT: number;
+export declare const DEFAULT_EPHEMERAL_RESPONSE_BYTE_LIMIT: number;
+export type ReadOnlyToolDenials = Readonly<Record<string, false>>;
+/**
+ * Fail-closed tool policy for isolated review/evaluation agents.
+ *
+ * OpenCode merges this request map with the selected agent's configured tools,
+ * so omitting a registered plugin tool leaves it enabled. Deny every canonical
+ * plugin tool (including deceptively mutable tools such as lint and recursive
+ * tools such as swarm_command) plus built-in mutation/dispatch escape hatches.
+ * Upstream read-only discovery tools remain available.
+ */
+export declare const DEFAULT_READ_ONLY_TOOLS: ReadOnlyToolDenials;
+export type EphemeralAgentDispatchRequest = {
+    client: OpencodeClient;
+    directory: string;
+    parentSessionId?: string;
+    /** Already-resolved OpenCode agent name. Agent lookup belongs to the caller. */
+    agentName: string;
+    model?: ModelOverride;
+    /** Optional system prompt for this isolated session. */
+    system?: string;
+    prompt: string;
+    /** Explicit false-only tool map. The primitive never grants tools implicitly. */
+    readOnlyTools: ReadOnlyToolDenials;
+    title?: string;
+    timeoutMs: number;
+    cleanupTimeoutMs?: number;
+    promptByteLimit?: number;
+    responseByteLimit?: number;
+    abortSignal?: AbortSignal;
+};
+export type EphemeralAgentDispatchResult = {
+    status: 'completed' | 'timeout' | 'cancelled' | 'error';
+    agentName: string;
+    modelId?: string;
+    text: string;
+    error?: string;
+    durationMs: number;
+    promptBytes: number;
+    responseBytes: number;
+    costFields?: DelegationCostFields;
+};
+export declare function boundedDeleteEphemeralSession(client: OpencodeClient, sessionId: string, timeoutMs?: number): Promise<void>;
+export declare const _internals: {
+    boundedDelete: typeof boundedDeleteEphemeralSession;
+    log: typeof log;
+};
+/**
+ * Dispatch one read-only agent in a fresh, parent-bound session.
+ *
+ * This is deliberately policy-free: callers resolve the agent and model, provide
+ * the replacement system prompt, and own retry/fallback policy. The primitive
+ * owns only bounded session creation/prompting, transcript caps, accounting, and
+ * awaited best-effort cleanup.
+ */
+export declare function dispatchEphemeralAgent(request: EphemeralAgentDispatchRequest): Promise<EphemeralAgentDispatchResult>;

package/dist/evaluation/model-dispatcher.d.ts

@@ -1,5 +1,6 @@
 import type { Agent, OpencodeClient } from '@opencode-ai/sdk';
-import { log } from '../utils/logger.js';
+import type { DelegationCostFields } from '../services/cost-accounting.js';
+import { _internals as ephemeralDispatcherInternals } from './ephemeral-agent-dispatcher.js';
 export type EvaluationModelDispatchRequest = {
     directory: string;
     agentName: string;
@@ -18,13 +19,18 @@ export type EvaluationModelDispatchResult = {
     text: string;
     durationMs: number;
     error?: string;
+    promptBytes?: number;
+    responseBytes?: number;
+    costFields?: DelegationCostFields;
 };
 export type EvaluationModelDispatcher = (request: EvaluationModelDispatchRequest) => Promise<EvaluationModelDispatchResult>;
 export declare function resolveEvaluationAgentName(agents: readonly Pick<Agent, 'name'>[], logicalName: string, preferredSwarm?: string): string;
-declare function boundedDelete(client: OpencodeClient, sessionId: string, timeoutMs?: number): Promise<void>;
+/**
+ * Compatibility proxy for the existing evaluation test seam. The shared
+ * primitive remains the single owner of cleanup and logging behavior.
+ */
 export declare const _internals: {
-    boundedDelete: typeof boundedDelete;
-    log: typeof log;
+    boundedDelete: typeof ephemeralDispatcherInternals.boundedDelete;
+    log: typeof ephemeralDispatcherInternals.log;
 };
 export declare function createEvaluationModelDispatcher(client: OpencodeClient): EvaluationModelDispatcher;
-export {};

package/dist/evaluation/public-api.d.ts

@@ -31,7 +31,7 @@ export declare const evaluationV1: ((options: EvaluateCandidateV1Options) => Pro
         decisionId: string;
         runId: string;
         decidedAt: string;
-        status: "inconclusive" | "accept" | "reject";
+        status: "reject" | "inconclusive" | "accept";
         reasons: string[];
         baseline: {
             baselineRunId: string;

package/dist/hooks/auto-review.d.ts

@@ -1,90 +1,55 @@
 /**
- * Auto-review hook (auto-review machinery, piece B) — opt-in.
+ * Automatic task-completion review hook.
  *
- * When `auto_review.enabled` is true, completing a task
- * (`update_task_status` → status 'completed') and/or a phase
- * (`phase_complete`) automatically dispatches the registered reviewer agent
- * over a fresh ephemeral session to review the current execution diff —
- * the same "second model reviews the work in a clean context" pattern used
- * by Claude Code's auto-review and Codex's review model. The reviewer agent
- * carries its own configured model (`agents.reviewer.model`), so the review
- * model is independently configurable from the coder/architect models.
- *
- * The pass is ADVISORY and fully fail-open:
- *   - fire-and-forget from `tool.execute.after` (never blocks the tool)
- *   - verdicts are persisted as durable review receipts
- *     (`.swarm/review-receipts/`, scope-fingerprinted over the diff) and an
- *     `auto_review` event is appended to `.swarm/events.jsonl`
- *   - a REJECTED or unparseable verdict injects a `[AUTO-REVIEW]` advisory
- *     into the architect's next prompt; APPROVED stays silent
- *
- * Bounds (AGENTS.md invariants 3 and 8): the diff subprocess uses execFile
- * with cwd/timeout/maxBuffer and ignored stdin; dispatches are guarded by a
- * per-session in-flight set plus a 60s cooldown in a bounded FIFO map.
- *
- * #1896 / #1905: on a transient/quota dispatch error the reviewer fails over to
- * a configured `fallback_models` entry via the shared `dispatchWithModelFallback`
- * helper, instead of immediately writing a `verdict: 'error'` event (a quota
- * blip previously dropped the review pass with no recovery). The SDK error
- * envelope is preserved in the thrown message so the classifier sees the quota
- * token on the dominant SDK error shape.
+ * Phase/plan review is owned by the phase_complete tool body so it can await a
+ * durable artifact before the evidence-only gate runs. This hook therefore owns
+ * only task-completion review, remains fire-and-forget, and delegates every
+ * model/diff/persistence decision to the shared review engine.
  */
 import { type AutoReviewConfig } from '../config/schema.js';
-import { type ModelOverride } from '../utils/model-dispatch-fallback.js';
-/** Test-only: clear module-level dispatch tracking. */
-export declare function resetAutoReviewTracking(): void;
-export type ExecutionDiffResult = {
-    status: 'ok';
-    diff: string;
-} | {
-    status: 'clean';
-} | {
-    status: 'error';
-    reason: string;
-};
-/**
- * Collect the execution diff for review: `git diff HEAD` (tracked changes)
- * plus a porcelain summary of untracked files. Distinguishes a clean working
- * tree from collection failures (git missing, timeout, diff exceeding the
- * 2× maxBuffer cap) so events report honestly. Output is truncated to
- * `maxBytes`.
- */
-declare function computeExecutionDiff(directory: string, maxBytes: number): Promise<ExecutionDiffResult>;
-declare function dispatchReviewer(directory: string, prompt: string, agentName: string, timeoutMs: number, parentSessionId: string, model?: ModelOverride): Promise<string>;
+import type { ReviewModelDispatcher } from '../review/contracts.js';
+import { type ReviewEngineResult, runReviewEngine } from '../review/engine.js';
+import { type ReviewAgentModelRegistry } from '../review/runtime.js';
 export interface AutoReviewRunInput {
     directory: string;
     sessionID: string;
-    trigger: 'task_completion' | 'phase_boundary';
+    trigger: 'task_completion';
     taskId?: string;
-    phase?: number;
-    config: Required<Pick<AutoReviewConfig, 'timeout_ms' | 'max_diff_kb'>>;
+    config: AutoReviewConfig;
+    dispatcher?: ReviewModelDispatcher;
+    generatedAgentNames?: Iterable<string>;
+    activeAgentName?: string;
+    agentModelRegistry?: ReviewAgentModelRegistry;
     injectAdvisory: (sessionId: string, message: string) => void;
 }
-/**
- * Execute one auto-review pass: collect diff → dispatch reviewer over an
- * ephemeral session → persist receipt + event → advisory on REJECTED or
- * unparseable output. Fully fail-open; never throws.
- */
-export declare function runAutoReview(input: AutoReviewRunInput): Promise<void>;
+export declare function runAutoReview(input: AutoReviewRunInput): Promise<ReviewEngineResult | undefined>;
 export interface AutoReviewHookOptions {
     config: AutoReviewConfig;
     directory: string;
+    dispatcher?: ReviewModelDispatcher;
+    generatedAgentNames?: Iterable<string>;
+    agentModelRegistry?: ReviewAgentModelRegistry;
+    getActiveAgentName?: (sessionID: string) => string | undefined;
     injectAdvisory: (sessionId: string, message: string) => void;
 }
+export interface AutoReviewToolAfterContext {
+    /**
+     * Arguments recovered from the callID snapshot. The OpenCode SDK's
+     * `tool.execute.after` output does not carry the original tool arguments.
+     */
+    args: Record<string, unknown> | null;
+}
 export declare function createAutoReviewHook(options: AutoReviewHookOptions): {
     toolAfter: (input: {
         tool: string;
         sessionID: string;
         callID?: string;
-    }, output: {
-        args?: unknown;
-        output?: unknown;
-    }) => Promise<void>;
+    }, context: AutoReviewToolAfterContext) => Promise<void>;
+    /** Instance-local test/lifecycle seam; never affects another plugin instance. */
+    resetTracking: () => void;
 };
 export declare const _internals: {
-    computeExecutionDiff: typeof computeExecutionDiff;
-    dispatchReviewer: typeof dispatchReviewer;
+    runReviewEngine: typeof runReviewEngine;
     runAutoReview: typeof runAutoReview;
     now: () => number;
 };
-export {};

package/dist/hooks/delegation-gate.d.ts

@@ -268,7 +268,7 @@ interface MessageWithParts {
  * approval. Does not throw — returns `false` for any failure (fail-closed).
  */
 export declare function isPlanCriticApproved(directory: string): Promise<boolean>;
-declare function resolveDelegatedPlanTaskId(args: Record<string, unknown>, knownPlanTaskIds?: ReadonlySet<string>): string | null;
+export declare function resolveDelegatedPlanTaskId(args: Record<string, unknown>, knownPlanTaskIds?: ReadonlySet<string>): string | null;
 /**
  * Builds a cause-specific diagnostic for `prepareCoderScope`'s SCOPE_NOT_DECLARED
  * throw when `resolveDelegatedPlanTaskId` returns null. Re-runs extraction with

package/dist/hooks/guardrails/tool-before.d.ts

@@ -37,6 +37,14 @@ export interface ToolBeforeContext {
      * trusted roots when exempting `git worktree remove --force` (issue #1708).
      */
     worktreeBaseDirOverrides?: string[];
+    /** Hold exact child-write provenance until the matching after-hook succeeds. */
+    rememberReviewerScopeWrite?: (input: {
+        callID: string;
+        parentSessionID: string;
+        taskId: string;
+        coderCallID: string;
+        file: string;
+    }) => void;
 }
 /**
  * Creates a toolBefore handler with the given shared context.

package/dist/hooks/review-receipt-collector.d.ts

@@ -4,8 +4,8 @@
  * Parses the mandated reviewer OUTPUT FORMAT (`VERDICT:` / `RISK:` /
  * `ISSUES:` / `FIXES:`) from a returning reviewer Task delegation and
  * persists it as a durable review receipt under `.swarm/review-receipts/`
- * via the existing receipt store (scope-fingerprinted over the delegation
- * prompt, which defines the reviewed scope).
+ * via the existing receipt store. Scope is derived from guardrails-observed
+ * modified files and their current content, never architect-authored prose.
  *
  * Before this collector, reviewer verdicts existed only as free text inside
  * the architect's context — re-reviews and drift verification had no durable
@@ -15,7 +15,14 @@
  *
  * Fail-open: parsing or persistence failures never block tool execution.
  */
-export type ParsedReviewSeverity = 'critical' | 'high' | 'medium';
+import { type ReviewFinding } from '../agents/agent-output-schema.js';
+import { type AutoReviewConfig } from '../config/schema.js';
+import type { ReviewModelDispatcher } from '../review/contracts.js';
+import { type FindingValidationScheduler } from '../review/finding-validator.js';
+import { type ReviewAgentModelRegistry } from '../review/runtime.js';
+import { persistReviewReceipt, type ReviewFindingSeverity, updateReviewReceiptValidations } from './review-receipt.js';
+import { buildReviewerTaskScope, resolveReviewerTaskScope } from './review-receipt-scope.js';
+export type ParsedReviewSeverity = ReviewFindingSeverity;
 export interface ParsedReviewIssue {
     /** Raw issue line (trimmed, bullet stripped) */
     text: string;
@@ -23,6 +30,8 @@ export interface ParsedReviewIssue {
     severity: ParsedReviewSeverity;
     /** `path:line` reference when one appears in the line */
     location?: string;
+    /** Machine-readable source finding, when structured output parsed. */
+    finding?: ReviewFinding;
 }
 export interface ParsedReviewerOutput {
     verdict: 'approved' | 'rejected';
@@ -32,30 +41,64 @@ export interface ParsedReviewerOutput {
     issues: ParsedReviewIssue[];
     /** Required-change lines from the FIXES section */
     fixes: string[];
+    outputMode: 'structured' | 'legacy';
+    overallConfidence?: number;
+    structuredFindings?: ReviewFinding[];
 }
 /**
  * Parse the reviewer agent's mandated output block. Returns null when no
- * unambiguous line-anchored `VERDICT: APPROVED|REJECTED` is present —
- * including when multiple anchored verdict lines DISAGREE (ambiguous output
- * fails toward "no machine-readable verdict", never toward approval).
+ * single unambiguous line-anchored `VERDICT: APPROVED|REJECTED` is present,
+ * including missing, duplicate, or contradictory verdict lines. A structured
+ * verdict must match that single legacy line so ambiguous output fails toward
+ * "no machine-readable verdict", never toward approval.
  */
-export declare function parseReviewerOutput(text: string): ParsedReviewerOutput | null;
+export declare function parseReviewerOutput(text: string, options?: {
+    structured?: boolean;
+}): ParsedReviewerOutput | null;
 export interface ReviewerReceiptInput {
     tool: unknown;
     args?: unknown;
     sessionID?: unknown;
+    callID?: unknown;
 }
 export interface ReviewerReceiptOutput {
     output?: unknown;
+    state?: unknown;
+    status?: unknown;
+    error?: unknown;
+    errors?: unknown;
+    metadata?: unknown;
+    result?: unknown;
 }
 export interface ReviewerReceiptTranscriptInput {
     targetAgent?: string;
-    prompt: string;
+    prompt?: string;
     transcript: string;
     sessionID?: string;
     sessionId?: string;
+    taskId?: string;
+    reviewerCallID?: string;
+    /** Production collectors consume the exact claimed coder generation. */
+    consumeHandoff?: boolean;
 }
-export declare function collectReviewerReceiptFromTranscript(directory: string, input: ReviewerReceiptTranscriptInput): Promise<string | null>;
+export interface ReviewerReceiptValidationOptions {
+    dispatcher?: ReviewModelDispatcher;
+    config?: AutoReviewConfig;
+    generatedAgentNames?: Iterable<string>;
+    agentModelRegistry?: ReviewAgentModelRegistry;
+    injectAdvisory?: (sessionID: string, message: string) => void;
+    /** Shared only within the owning plugin instance. */
+    validationScheduler?: FindingValidationScheduler;
+}
+/** Test seam for the otherwise process-global telemetry sink. */
+export declare const _internals: {
+    delegationEnd: (sessionId: string, agentName: string, taskId: string, result: string, costFields?: Partial<import("../services/cost-accounting.js").DelegationCostFields>) => void;
+    resolveReviewerTaskScope: typeof resolveReviewerTaskScope;
+    buildReviewerTaskScope: typeof buildReviewerTaskScope;
+    persistReviewReceipt: typeof persistReviewReceipt;
+    updateReviewReceiptValidations: typeof updateReviewReceiptValidations;
+};
+export declare function collectReviewerReceiptFromTranscript(directory: string, input: ReviewerReceiptTranscriptInput, validationOptions?: ReviewerReceiptValidationOptions): Promise<string | null>;
 /**
  * `tool.execute.after` collector. When a reviewer Task returns, parse its
  * verdict block and persist a durable review receipt. No-op for non-reviewer
@@ -63,4 +106,4 @@ export declare function collectReviewerReceiptFromTranscript(directory: string,
  *
  * Returns the persisted receipt path (for tests/telemetry) or null.
  */
-export declare function collectReviewerReceiptAfter(directory: string, input: ReviewerReceiptInput, output: ReviewerReceiptOutput): Promise<string | null>;
+export declare function collectReviewerReceiptAfter(directory: string, input: ReviewerReceiptInput, output: ReviewerReceiptOutput, validationOptions?: ReviewerReceiptValidationOptions): Promise<string | null>;

package/dist/hooks/review-receipt-scope.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Canonical scope construction for Stage-B reviewer receipts.
+ *
+ * The architect-authored reviewer prompt is not authoritative scope: it can
+ * omit files that the coder actually changed. Guardrails records every
+ * write-tool target in `modifiedFilesThisCoderTask`, so receipts fingerprint a
+ * bounded manifest of repository HEAD, those paths, and their current byte
+ * content instead. A base change therefore invalidates the receipt even when
+ * the working-file bytes happen to remain identical.
+ *
+ * Any missing session state, unsafe path, symlink/reparse point, concurrent
+ * mutation, or size overflow fails toward no receipt. A durable receipt must
+ * never claim a scope the harness could not reconstruct exactly.
+ */
+import * as child_process from 'node:child_process';
+import * as fs from 'node:fs';
+export declare const REVIEWER_TASK_SCOPE_DESCRIPTION = "reviewer-task-files-v1";
+export interface ReviewerTaskScope {
+    content: string;
+    description: typeof REVIEWER_TASK_SCOPE_DESCRIPTION;
+    files: string[];
+    headSha: string;
+    taskId?: string;
+    coderCallID?: string;
+    generation?: number;
+    sessionIncarnation?: string;
+}
+export interface ReviewerTaskScopeProvenance {
+    taskId: string;
+    coderCallID: string;
+    generation: number;
+    sessionIncarnation: string;
+}
+export interface ResolveReviewerTaskScopeOptions {
+    /** Consume the completed coder's one-shot scope instead of the live list. */
+    consumeHandoff?: boolean;
+    /** Exact task expected by the returning reviewer/background record. */
+    expectedTaskId?: string;
+    /** Exact reviewer Task call that claimed the generation. */
+    reviewerCallID?: string;
+    /** Injectable clock used only for deterministic expiry tests. */
+    now?: number;
+}
+/**
+ * Resolve the exact known plan task carried by reviewer/coder Task arguments.
+ *
+ * This deliberately reuses delegation-gate's canonical extractor so lifecycle
+ * identity cannot drift from scope authorization. It checks all supported Task
+ * text fields, prefers an unambiguous TASK line, rejects ambiguity, and filters
+ * numeric-dot tokens against the current plan.
+ */
+export declare function resolveReviewerScopeTaskId(directory: string, args: unknown): Promise<string | null>;
+/**
+ * Test-only dependency-injection seam. Keeping the spawn binding local avoids
+ * process-global `mock.module()` pollution while allowing tests to prove that
+ * the production call really creates a child with ignored stdin.
+ */
+export declare const _internals: {
+    spawn: typeof child_process.spawn;
+    realpath: typeof fs.promises.realpath;
+    lstatBigInt: (path: fs.PathLike) => Promise<fs.BigIntStats>;
+    open: typeof fs.promises.open;
+    fileHandleStatBigInt: (handle: fs.promises.FileHandle) => Promise<fs.BigIntStats>;
+};
+/**
+ * Build the exact scope fingerprint input for a guardrails-observed file list.
+ */
+export declare function buildReviewerTaskScope(directory: string, modifiedFiles: readonly string[], maxBytes?: number, provenance?: ReviewerTaskScopeProvenance): Promise<ReviewerTaskScope | null>;
+/**
+ * Resolve scope only from the architect session's guardrails-owned task state.
+ * Receipt collection consumes the completed coder handoff exactly once; direct
+ * callers retain the legacy live-list view for diagnostics and drift probes.
+ */
+export declare function resolveReviewerTaskScope(directory: string, sessionID: string, maxBytes?: number, options?: ResolveReviewerTaskScopeOptions): Promise<ReviewerTaskScope | null>;