opencode-swarm 7.135.0 → 7.135.2

package/dist/scope/scope-binding.d.ts

@@ -83,6 +83,66 @@ export declare function getAuthorizedScopeBindingByPlanIdentity(input: {
     taskId: string;
     activeSessionId: string;
 }): ScopeBinding | null;
+/**
+ * Issue #2002 recurrence guardrail (detection half).
+ *
+ * The defect class is: *a hook constructed once with the plugin-root
+ * `ctx.directory` applies that root to sessions that actually execute in a
+ * different root.* Its signature failure is silent — a binding for this exact
+ * session exists and is otherwise valid, but `workspaceIdentity` (filter
+ * condition #1 in `getAuthorizedScopeBindingByPlanIdentity`) never matches, so
+ * the lookup returns null and the caller reports a generic
+ * `SCOPE_NOT_DECLARED` that names neither root.
+ *
+ * This turns that silence into a precise, self-describing diagnostic at the one
+ * user-visible failure site (`src/hooks/scope-guard.ts`). It catches the class
+ * at ANY call site that resolves a binding with the wrong root — present or
+ * future — rather than only at the two gates fixed for this issue.
+ *
+ * Diagnostic-only: never grants or denies authorization. Callers still fall
+ * back to the ordinary `SCOPE_NOT_DECLARED` denial whenever this returns null.
+ *
+ * The candidate filter mirrors every non-workspace correlation clause
+ * `getAuthorizedScopeBindingByPlanIdentity` requires for an otherwise-valid
+ * Task-scoped authorization — dispatch correlation (`dispatchCallId` present
+ * and equal to `ownerMessageId`/`parentCallId`) plus a genuine parent/child
+ * session split — so a stale or malformed "active" leftover that never went
+ * through the real claim/derive path cannot be mislabeled as a workspace
+ * mismatch just because it happens to share session + task + `activation`.
+ * `pr_feedback` bindings are excluded outright: they resolve through an
+ * entirely separate authorization path
+ * (`getAuthorizedPrFeedbackScopeBinding` / `resolveAuthorizedPrFeedbackScopeBindingFromDisk`)
+ * that the caller already attempted before falling into this diagnostic, and
+ * a live `pr_feedback` binding otherwise satisfies every correlation clause
+ * above.
+ *
+ * `planId`/`planStructureHash` are deliberately NOT compared here: a
+ * plan-drifted binding at the SAME root is already excluded by the
+ * `workspaceIdentity` clause below (it would never have reached this
+ * diagnostic branch in the first place — the ordinary lookup would have
+ * rejected it on plan identity, not returned null for lack of a match at
+ * all). Reading the plan at `input.directory` to compare identities would
+ * also be unreliable here: `input.directory` is, by construction, the root
+ * this diagnostic suspects is wrong, so its `.swarm/plan.json` may not exist
+ * or may belong to an unrelated project — silently disabling the guardrail
+ * exactly where it matters most.
+ *
+ * Returns null (no mismatch claim) whenever `input.directory` itself cannot
+ * be resolved to a canonical identity (e.g. a deleted lane directory) —
+ * otherwise every active binding for the session would trivially satisfy
+ * `workspaceIdentity !== null`, misreporting a missing-directory failure as a
+ * wrong-root failure.
+ *
+ * @param input.directory - The root the caller resolved against
+ * @param input.activeSessionId - The session attempting the write
+ * @param input.taskId - Optional task filter
+ * @returns A human-readable mismatch description, or null
+ */
+export declare function describeScopeWorkspaceMismatch(input: {
+    directory: string;
+    activeSessionId: string;
+    taskId?: string | null;
+}): string | null;
 export declare function clearScopeBindings(predicate?: (binding: ScopeBinding) => boolean): ScopeBinding[];
 /**
  * Atomically claim the pending scope for the exact Task call whose upstream
@@ -103,6 +163,14 @@ export declare function deriveChildScopeBinding(parent: ScopeBinding, input: {
     childSessionId: string;
     parentCallId: string;
 }): ScopeBinding;
+/**
+ * Containment predicate shared by every scope consumer: a candidate path is
+ * covered by a scope entry when it is that entry or lives beneath it. Exported
+ * so authority-minting callers (e.g. the Lean Turbo lane publisher) narrow a
+ * candidate file set against plan authority using the *same* semantics the
+ * write gates later enforce, instead of re-implementing containment.
+ */
+export declare function scopeContains(scope: readonly string[], candidate: string): boolean;
 export declare function resolveCoderScopeSources(input: {
     explicitFiles: readonly string[] | null | undefined;
     planFiles: readonly string[] | null | undefined;

package/dist/session/snapshot-reader.d.ts

@@ -7,6 +7,12 @@ import type { SerializedAgentSession, SnapshotData } from './snapshot-writer';
 /**
  * Transient session fields that must be reset on rehydration.
  * Centralised here to keep the reset logic DRY and auditable.
+ *
+ * `workspaceDirectory` (issue #2002) deliberately does NOT belong in this
+ * list: it is never part of `SerializedAgentSession` in the first place (see
+ * the TRUST BOUNDARY / DELIBERATELY NOT SNAPSHOTTED comment at its field
+ * declaration in `src/state.ts`), so `deserializeAgentSession` never restores
+ * it and there is nothing here to reset.
  */
 export declare const TRANSIENT_SESSION_FIELDS: ReadonlyArray<{
     name: string;

package/dist/state.d.ts

@@ -226,6 +226,72 @@ export interface AgentSessionState {
     } | null;
     /** Declared file scope for current coder task (null = no scope declared) */
     declaredCoderScope: string[] | null;
+    /**
+     * Issue #2002: the root this session actually EXECUTES in, when it differs
+     * from the plugin-root `ctx.directory`.
+     *
+     * Worktree-isolated coder children are created with
+     * `session.create({ query: { directory: <lane> } })`, and their scope binding
+     * is derived and published against that lane. The write gates are constructed
+     * once at plugin init with `ctx.directory` and would otherwise resolve every
+     * session's binding, containment, and `.swarm/` reads against the project
+     * root — which can never match a lane-rooted binding.
+     *
+     * TRUST BOUNDARY: written ONLY by `recordSessionWorkspaceRoot`, whose single
+     * closed allowlist of production callers each pass `provisionWorktree`'s own
+     * output. `ensureAgentSession`'s `directory` argument (which can carry an
+     * agent-supplied `working_directory`, e.g. via `declare_scope`) must NEVER
+     * write this field.
+     *
+     * DELIBERATELY NOT SNAPSHOTTED (issue #2002 follow-up). `serializeAgentSession`
+     * (`src/session/snapshot-writer.ts`) intentionally omits this field, and it
+     * MUST stay omitted. The reason is trust, not oversight: `.swarm/session/state.json`
+     * lives under the project-root `.swarm/` directory, which the architect agent
+     * can write, so a restored string in that file is not a trusted resolution
+     * root — a tampered or stale snapshot could install an arbitrary root, or
+     * re-point a session at a *different* lane it never owned (cross-lane
+     * containment re-rooting). Persisting it would only be safe if rehydrate could
+     * revalidate the restored value against a durable, plugin-owned record of
+     * provisioned lanes, and no such record exists:
+     *   - `worktree-provisioning-owner.ts`'s durable marker
+     *     (`recordWorktreeProvisioningOwner`) stores no `worktreePath` at all, and
+     *     its `worktreeSessionId` field is always the *parent* session id
+     *     (`worktree-isolation.ts` passes `args.parentSessionID`, confirmed by
+     *     every production and test call site) — it cannot answer "does child
+     *     session X own lane path Y".
+     *   - `background-delegations.jsonl` (`src/background/pending-delegations.ts`)
+     *     does carry a `worktree.worktreePath` keyed by the child session id, but
+     *     it is written only inside the `isBackgroundTrue(...)` branch of
+     *     `delegation-gate.ts` (~line 3157) — i.e. only for `background: true` Task
+     *     dispatches. It is never written for the ordinary synchronous worktree
+     *     dispatch in `worktree-isolation.ts`, nor for the Lean Turbo dispatch in
+     *     `src/turbo/lean/lane-scope.ts`, which are the two actual
+     *     `recordSessionWorkspaceRoot` callers. It does not cover the field it
+     *     would need to validate.
+     *   - Re-deriving the expected path from `provisionWorktree`'s own naming
+     *     scheme (`resolveWorktreeBaseDir(directory, worktreeDir)/parentSessionId/taskId`,
+     *     or the `os.tmpdir()/swwt/...` Windows-shortened form) does not close the
+     *     gap either: it requires the child's *parent* session id, which is only
+     *     available from `delegationChains` in the very same untrusted snapshot —
+     *     validating one untrusted field with another untrusted field is circular,
+     *     not a validation. It would also require spawning `git worktree list` per
+     *     restored session inside `loadSnapshot`, which runs on the plugin-init
+     *     path under a bounded timeout (AGENTS.md invariant 1 / repro-704).
+     * Net effect: a plugin restart mid-lane loses the recorded root, and
+     * `resolveSessionWorkspaceDirectory` falls back to the plugin-root directory —
+     * fail-closed, byte-identical to pre-#2002 behaviour, never a widened
+     * authority (see its own doc comment). The lane coder is blocked with
+     * `SCOPE_NOT_DECLARED` (`src/hooks/scope-guard.ts`,
+     * `src/hooks/guardrails/tool-before.ts`) until a human/architect re-dispatches
+     * it, exactly like the pre-fix bug — not worse. `rehydrateState` (which would
+     * apply a restored value) only runs from `loadSnapshot`, itself only called at
+     * plugin init (`src/index.ts`), so this window is a real process restart, not
+     * something that can strip a live in-session lane coder of its root.
+     * Do NOT add this field to `TRANSIENT_SESSION_FIELDS`
+     * (`src/session/snapshot-reader.ts`) either — it is never restored in the
+     * first place, so there is nothing to reset.
+     */
+    workspaceDirectory?: string;
     /** Last scope violation message (null = no violation) */
     lastScopeViolation: string | null;
     /** Flag for one-shot scope violation warning injection in messagesTransform */
@@ -720,6 +786,58 @@ export declare function getAgentSession(sessionId: string): AgentSessionState |
  * @returns The AgentSessionState
  */
 export declare function ensureAgentSession(sessionId: string, agentName?: string, directory?: string): AgentSessionState;
+/**
+ * Issue #2002 — record the root a session actually EXECUTES in, when it
+ * differs from the plugin-root `ctx.directory`.
+ *
+ * TRUST BOUNDARY (security-critical): this function performs NO path
+ * validation. `laneRoot` is trusted purely because of WHO calls it, not
+ * because of its shape — `provisionWorktree` can legitimately relocate a lane
+ * outside the swarm worktree base (e.g. a `os.tmpdir()`-shortened path on
+ * Windows when the path-budget check trips), so a shape predicate would
+ * refuse a legitimately provisioned lane and silently reintroduce the bug
+ * this closes.
+ *
+ * The only thing standing between this setter and a privilege-escalation bug
+ * is a closed allowlist of production callers, each of which passes
+ * `provisionWorktree`'s own return value — never a tool argument, never
+ * `ensureAgentSession`'s `directory` parameter (which CAN carry an
+ * agent-supplied `working_directory`, e.g. via `declare_scope`). That
+ * allowlist is mechanically enforced by
+ * `tests/unit/state/session-workspace-root-trusted-callers.test.ts`. Adding a
+ * new call site is a privilege-escalation review, not a formality: the
+ * reviewer must confirm the new caller passes `provisionWorktree` output
+ * before adding it to that test's allowlist.
+ *
+ * A blank or whitespace-only `laneRoot` is ignored (treated as unset) rather
+ * than being recorded and later resolving to `path.resolve('')` (cwd).
+ *
+ * ORDERING IS PART OF THE CONTRACT. This never creates the session — callers
+ * MUST register it with its real agent name (`ensureAgentSession(sessionId,
+ * 'coder', laneRoot)`) FIRST. Calling this on an unregistered session is a
+ * deliberate no-op, so resolution falls back to the plugin root and the write
+ * is blocked. Creating the session here instead would register
+ * `swarmState.activeAgent` as 'unknown', which fails OPEN rather than closed —
+ * see the inline comment in the body for the full chain.
+ *
+ * @param sessionId - The session identifier
+ * @param laneRoot - `provisionWorktree`'s own output; never agent-supplied
+ */
+export declare function recordSessionWorkspaceRoot(sessionId: string, laneRoot: string): void;
+/**
+ * Issue #2002 — resolve the root a write gate should evaluate path
+ * containment and scope-binding lookups against for a given session.
+ *
+ * Fail-closed: returns `fallbackDirectory` (the plugin-root `ctx.directory`)
+ * whenever no root was recorded for this session, or the recorded value is
+ * blank/unset — i.e. byte-identical to pre-#2002 behaviour for every session
+ * that was never lane-rooted.
+ *
+ * @param sessionId - The session identifier
+ * @param fallbackDirectory - The plugin-root directory to fall back to
+ * @returns the session's recorded workspace root, or `fallbackDirectory`
+ */
+export declare function resolveSessionWorkspaceDirectory(sessionId: string, fallbackDirectory: string): string;
 /**
  * Update only the agent event timestamp (for stale detection).
  * Does NOT change agent name or reset guardrail state.

package/dist/tools/convene-council.d.ts

@@ -36,10 +36,10 @@ export declare const ArgsSchema: z.ZodObject<{
         confidence: z.ZodNumber;
         findings: z.ZodArray<z.ZodObject<{
             severity: z.ZodEnum<{
-                CRITICAL: "CRITICAL";
-                HIGH: "HIGH";
-                MEDIUM: "MEDIUM";
                 LOW: "LOW";
+                MEDIUM: "MEDIUM";
+                HIGH: "HIGH";
+                CRITICAL: "CRITICAL";
             }>;
             category: z.ZodString;
             location: z.ZodString;

package/dist/tools/dispatch-lanes.d.ts

@@ -48,11 +48,39 @@ declare const DispatchLanesAsyncArgsSchema: z.ZodObject<{
     base_sha: z.ZodOptional<z.ZodString>;
     base_ref: z.ZodOptional<z.ZodString>;
     scope: z.ZodOptional<z.ZodString>;
-    trigger_evaluation: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        trigger_id: z.ZodString;
+    trigger_evaluation: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        trigger_id: z.ZodEnum<{
+            "auth-identity-secrets": "auth-identity-secrets";
+            "untrusted-input-boundaries": "untrusted-input-boundaries";
+            "subprocess-platform": "subprocess-platform";
+            "concurrency-state": "concurrency-state";
+            "dependencies-build-release": "dependencies-build-release";
+            "api-schema-migrations": "api-schema-migrations";
+            "test-infrastructure": "test-infrastructure";
+            "ui-accessibility-i18n": "ui-accessibility-i18n";
+            "privacy-observability": "privacy-observability";
+            "generated-provenance": "generated-provenance";
+            "unclassified-risk": "unclassified-risk";
+        }>;
         result: z.ZodLiteral<"MATCHED">;
         evidence: z.ZodString;
-    }, z.core.$strict>>>;
+    }, z.core.$strict>, z.ZodObject<{
+        trigger_id: z.ZodEnum<{
+            "auth-identity-secrets": "auth-identity-secrets";
+            "untrusted-input-boundaries": "untrusted-input-boundaries";
+            "subprocess-platform": "subprocess-platform";
+            "concurrency-state": "concurrency-state";
+            "dependencies-build-release": "dependencies-build-release";
+            "api-schema-migrations": "api-schema-migrations";
+            "test-infrastructure": "test-infrastructure";
+            "ui-accessibility-i18n": "ui-accessibility-i18n";
+            "privacy-observability": "privacy-observability";
+            "generated-provenance": "generated-provenance";
+            "unclassified-risk": "unclassified-risk";
+        }>;
+        result: z.ZodLiteral<"NOT_TRIGGERED">;
+        evidence: z.ZodString;
+    }, z.core.$strict>], "result">>>;
     feedback_inventory: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 declare const CollectLaneResultsArgsSchema: z.ZodObject<{
@@ -297,11 +325,39 @@ export declare const _test_exports: {
         base_sha: z.ZodOptional<z.ZodString>;
         base_ref: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
-        trigger_evaluation: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            trigger_id: z.ZodString;
+        trigger_evaluation: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            trigger_id: z.ZodEnum<{
+                "auth-identity-secrets": "auth-identity-secrets";
+                "untrusted-input-boundaries": "untrusted-input-boundaries";
+                "subprocess-platform": "subprocess-platform";
+                "concurrency-state": "concurrency-state";
+                "dependencies-build-release": "dependencies-build-release";
+                "api-schema-migrations": "api-schema-migrations";
+                "test-infrastructure": "test-infrastructure";
+                "ui-accessibility-i18n": "ui-accessibility-i18n";
+                "privacy-observability": "privacy-observability";
+                "generated-provenance": "generated-provenance";
+                "unclassified-risk": "unclassified-risk";
+            }>;
             result: z.ZodLiteral<"MATCHED">;
             evidence: z.ZodString;
-        }, z.core.$strict>>>;
+        }, z.core.$strict>, z.ZodObject<{
+            trigger_id: z.ZodEnum<{
+                "auth-identity-secrets": "auth-identity-secrets";
+                "untrusted-input-boundaries": "untrusted-input-boundaries";
+                "subprocess-platform": "subprocess-platform";
+                "concurrency-state": "concurrency-state";
+                "dependencies-build-release": "dependencies-build-release";
+                "api-schema-migrations": "api-schema-migrations";
+                "test-infrastructure": "test-infrastructure";
+                "ui-accessibility-i18n": "ui-accessibility-i18n";
+                "privacy-observability": "privacy-observability";
+                "generated-provenance": "generated-provenance";
+                "unclassified-risk": "unclassified-risk";
+            }>;
+            result: z.ZodLiteral<"NOT_TRIGGERED">;
+            evidence: z.ZodString;
+        }, z.core.$strict>], "result">>>;
         feedback_inventory: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>;
     DEFAULT_TIMEOUT_MS: number;
@@ -363,7 +419,9 @@ type ApplyCommonPromptResult = {
  * prompts when it is. Callers may treat the returned array as their own.
  */
 declare function applyCommonPrompt(lanes: DispatchLaneSpec[], commonPrompt: string | undefined): ApplyCommonPromptResult;
-declare function applyExplorerFormatSuffix(lanes: DispatchLaneSpec[]): DispatchLaneSpec[];
+declare function applyExplorerFormatSuffix(lanes: DispatchLaneSpec[], options?: {
+    failClosed?: boolean;
+}): ApplyCommonPromptResult;
 declare function applyPrWorkflowPromptContract(lanes: DispatchLaneSpec[], options: {
     mode?: string;
     prHeadSha?: string;

package/dist/tools/repo-graph/builder.d.ts

@@ -34,6 +34,24 @@ export declare const _internals: {
     computeUsedSymbols: typeof computeUsedSymbols;
     extractFileSymbols: typeof extractFileSymbols;
 };
+/**
+ * Whether `p` is a scannable source file — i.e. one of the extensions the
+ * walker turns into a graph node. This is the SINGLE source of truth for "is
+ * this a graph-node-able file" (issue #1985, defect A2): the write hook and
+ * the incremental updater both route through it so the allowlist can never
+ * drift from the builder's `LANGUAGE_REGISTRY`-derived set.
+ */
+export declare function isScannableSourcePath(p: string): boolean;
+/**
+ * Whether an edge's resolved target is an asset (a real file that never
+ * becomes a graph node, e.g. JSON/CSS) rather than a node. Uses the explicit
+ * `targetKind` tag on schema >= 1.3.0 graphs and falls back to an extension
+ * check on older graphs whose edges are untagged (issue #1985, defect A1).
+ * Asset edges only require their source node to exist during incremental
+ * validation and are excluded from in-degree ranking / importer / dependent
+ * queries.
+ */
+export declare function isAssetEdge(edge: GraphEdge): boolean;
 /**
  * Add or update a node in the graph.
  * @param graph - The graph to modify
@@ -156,7 +174,7 @@ export interface AsyncScanResult {
  * @param maxFileSize - Maximum file size in bytes
  * @returns ScanResult with node and edges
  */
-export declare function scanFile(filePath: string, absoluteRoot: string, maxFileSize: number): ScanResult;
+export declare function scanFile(filePath: string, absoluteRoot: string, maxFileSize: number, hasManifest?: (relDir: string) => boolean): ScanResult;
 /**
  * Async variant of scanFile that uses tree-sitter symbol extraction
  * (extractFileSymbols) to populate exportRanges and symbolEdges.
@@ -173,7 +191,7 @@ export declare function scanFile(filePath: string, absoluteRoot: string, maxFile
  * @param maxFileSize - Maximum file size in bytes
  * @returns AsyncScanResult with node, edges, and symbolEdges
  */
-export declare function scanFileAsync(filePath: string, absoluteRoot: string, maxFileSize: number): Promise<AsyncScanResult>;
+export declare function scanFileAsync(filePath: string, absoluteRoot: string, maxFileSize: number, hasManifest?: (relDir: string) => boolean): Promise<AsyncScanResult>;
 /**
  * Build a complete dependency graph for a workspace by scanning all source files.
  *

package/dist/tools/repo-graph/incremental.d.ts

@@ -5,8 +5,25 @@
  * their nodes and edges in the existing graph, and saves the result. It
  * includes an optimistic concurrency check (mtime comparison) so that
  * concurrent sessions do not overwrite each other's updates — when a race
- * is detected the function falls back to a full rebuild.
+ * is detected the function reloads the freshest on-disk graph and replays
+ * the update once before falling back to a full rebuild.
+ *
+ * Asset edges (issue #1985, defect A1): an edge whose target is a real file
+ * that never becomes a graph node (e.g. `import data from './data.json'`) is
+ * tagged `targetKind: 'asset'`. Such edges only require their SOURCE node to
+ * exist during validation, so a single asset import no longer forces a full
+ * rebuild on every incremental update.
+ */
+import { type Stats } from 'node:fs';
+/**
+ * DI seam for the optimistic-concurrency stat check (defect A4). Tests override
+ * `stat` to inject deterministic mtime shifts between load and the pre-save
+ * re-check, exercising the reload-and-replay branch without races. Defaults to
+ * the real `fsPromises.stat`. Restore in afterEach.
  */
+export declare const _internals: {
+    stat: (path: string) => Promise<Stats>;
+};
 import type { RepoGraph } from './types';
 /**
  * Incrementally update the graph for a set of changed files.

package/dist/tools/repo-graph/ontology.d.ts

@@ -6,5 +6,13 @@ export interface ExtractFileOntologyInput {
     language: string;
     exports: string[];
     imports: string[];
+    /**
+     * Optional callback returning true when a workspace-relative directory
+     * contains a package manifest (`package.json`, `Cargo.toml`,
+     * `pyproject.toml`, `go.mod`). When provided, the package-boundary rule
+     * becomes manifest-driven; otherwise it falls back to the static segment
+     * rules (issue #1985, defect A8). The extractor stays pure — no fs I/O.
+     */
+    hasManifest?: (relDir: string) => boolean;
 }
 export declare function extractFileOntology(input: ExtractFileOntologyInput): FileOntology;

package/dist/tools/repo-graph/types.d.ts

@@ -23,11 +23,20 @@ export declare const REPO_GRAPH_FILENAME = "repo-graph.json";
  * still load without corruption. New queries may use these fields to provide
  * more precise context-packing and symbol-level navigation.
  *
+ * 1.3.0 adds the optional per-edge `targetKind` field (`'node' | 'asset'`)
+ * that distinguishes edges whose resolved target is a scannable source file
+ * (a graph node) from edges whose target is an asset (JSON/CSS/etc. — a real
+ * file that never becomes a node). The field is optional, so 1.0.0–1.2.0
+ * graphs still load; `storage.ts` only checks that a version string is
+ * present, and feature gating is per-query via {@link isSchemaVersionAtLeast}.
+ * For pre-1.3.0 graphs the loader/queries fall back to an extension check
+ * (`isScannableSourcePath`) to classify an untagged edge's target kind.
+ *
  * Diagnostics are additive and optional on all schema versions. Old graphs
  * without diagnostics remain readable; graph-health queries surface empty
  * diagnostics with an explicit rebuild note.
  */
-export declare const GRAPH_SCHEMA_VERSION = "1.2.0";
+export declare const GRAPH_SCHEMA_VERSION = "1.3.0";
 /**
  * Compare dotted numeric version strings (e.g. '1.1.0' >= '1.1.0').
  * Missing/non-numeric segments are treated as 0. Returns true when `version`
@@ -150,6 +159,16 @@ export interface GraphEdge {
      * imports, where individual symbol usage is not statically resolvable.
      */
     usedSymbols?: string[];
+    /**
+     * Whether the resolved target is a graph node or an asset. `'node'` targets
+     * are scannable source files that become graph nodes; `'asset'` targets are
+     * real files (JSON/CSS/etc.) that never become nodes (schema >= 1.3.0).
+     * Absent on older graphs — callers fall back to `isScannableSourcePath` on
+     * the target path. Asset edges only require their source node to exist
+     * during incremental validation, and are excluded from in-degree ranking /
+     * importer / dependent queries.
+     */
+    targetKind?: 'node' | 'asset';
 }
 export interface FileReference {
     file: string;
@@ -269,6 +288,20 @@ export interface RepoGraphDiagnostics {
     binaryFiles?: string[];
     unreadableFiles?: string[];
     lowConfidenceEdgeCount?: number;
+    /**
+     * True when the last workspace walk was truncated by the file cap or wall-
+     * clock budget (issue #1985, defect A7). Additive/optional on all schema
+     * versions — old graphs without it read as `false`.
+     */
+    walkTruncated?: boolean;
+    /** Why the walk truncated: hit the wall-clock `'budget'` or the `'cap'`. */
+    walkTruncationReason?: 'budget' | 'cap';
+    /**
+     * Count of incremental-update passes that fell back to a full rebuild
+     * (issue #1985, defect A1). Accumulated across incremental runs; reset on
+     * a fresh full build.
+     */
+    incrementalFallbacks?: number;
 }
 export interface GraphHealthResult {
     schemaVersion: string | null;
@@ -281,6 +314,9 @@ export interface GraphHealthResult {
     binaryFiles: string[];
     unreadableFiles: string[];
     lowConfidenceEdgeCount: number;
+    walkTruncated: boolean;
+    walkTruncationReason: 'budget' | 'cap' | null;
+    incrementalFallbacks: number;
     notes: string[];
 }
 export interface BlastRadiusResult {
@@ -359,6 +395,31 @@ export interface BuildWorkspaceGraphOptions {
  * This ensures the same file produces the same key on Windows, macOS, and Linux.
  */
 export declare function normalizeGraphPath(filePath: string): string;
+/**
+ * Infer the package boundary for a module name using the generic rule shared
+ * by ontology extraction and the query-side no-ontology fallback (issue #1985,
+ * defect A8). Pure / dependency-free / no fs I/O so it can live in this
+ * foundation module and stay callable from both `ontology.ts` and `query.ts`.
+ *
+ * Rules (in order):
+ *  - empty → `'.'`
+ *  - segment 0 ∈ {packages, crates, apps, libs, services} with ≥2 segments → `<seg0>/<seg1>`
+ *  - segment 0 === `src` with ≥2 segments → `src/<seg1>`
+ *  - segment 0 === `tests` with ≥2 segments → `tests/<seg1>`
+ *  - when `hasManifest` is provided and either `<seg0>` or `<seg0>/<seg1>` is a
+ *    manifest-bearing directory (with ≥2 segments) → `<seg0>/<seg1>`
+ *  - otherwise → segment 0 (or `'.'` when there are no segments)
+ *
+ * The previous `src/tools/repo-graph` special case is intentionally removed:
+ * user repos should not inherit this project's internal layout.
+ *
+ * @param moduleName - Workspace-relative module name (forward slashes).
+ * @param hasManifest - Optional callback returning true when a workspace-
+ *   relative directory contains a package manifest (`package.json`,
+ *   `Cargo.toml`, `pyproject.toml`, `go.mod`). When omitted, only the static
+ *   segment rules apply.
+ */
+export declare function inferPackageBoundary(moduleName: string, hasManifest?: (relDir: string) => boolean): string;
 /**
  * Create an empty graph for a workspace.
  * @param workspaceRoot - The workspace root directory

package/dist/tools/repo-graph.d.ts

@@ -15,7 +15,7 @@
  * All existing imports of this module continue to work unchanged.
  */
 export type { ScanResult } from './repo-graph/builder';
-export { addEdge, buildWorkspaceGraph, buildWorkspaceGraphAsync, resolveModuleSpecifier, upsertNode, } from './repo-graph/builder';
+export { addEdge, buildWorkspaceGraph, buildWorkspaceGraphAsync, isScannableSourcePath, resolveModuleSpecifier, upsertNode, } from './repo-graph/builder';
 export { clearCache, getCachedGraph, getCachedMtime, isDirty, markDirty, setCachedGraph, } from './repo-graph/cache';
 export { updateGraphForFiles } from './repo-graph/incremental';
 export type { ExtractFileOntologyInput } from './repo-graph/ontology';

package/dist/tools/submit-phase-council-verdicts.d.ts

@@ -22,10 +22,10 @@ export declare const ArgsSchema: z.ZodObject<{
         confidence: z.ZodNumber;
         findings: z.ZodArray<z.ZodObject<{
             severity: z.ZodEnum<{
-                CRITICAL: "CRITICAL";
-                HIGH: "HIGH";
-                MEDIUM: "MEDIUM";
                 LOW: "LOW";
+                MEDIUM: "MEDIUM";
+                HIGH: "HIGH";
+                CRITICAL: "CRITICAL";
             }>;
             category: z.ZodString;
             location: z.ZodString;

package/dist/tools/write-final-council-evidence.d.ts

@@ -28,10 +28,10 @@ export declare const ArgsSchema: z.ZodObject<{
         confidence: z.ZodNumber;
         findings: z.ZodArray<z.ZodObject<{
             severity: z.ZodEnum<{
-                CRITICAL: "CRITICAL";
-                HIGH: "HIGH";
-                MEDIUM: "MEDIUM";
                 LOW: "LOW";
+                MEDIUM: "MEDIUM";
+                HIGH: "HIGH";
+                CRITICAL: "CRITICAL";
             }>;
             category: z.ZodString;
             location: z.ZodString;