opencode-swarm 7.135.1 → 7.135.3

package/dist/hooks/pr-workflow-gate.d.ts

@@ -1,8 +1,9 @@
 import * as fsp from 'node:fs/promises';
+import { type PrReviewInlineTriggerRow } from '../background/pr-review-trigger-contract.js';
 import { resolveCommitCountSince, resolveCommitCountSinceAsync, resolveCurrentGitHead, resolveCurrentGitHeadAsync, resolveCurrentUpstreamPushTarget, resolveCurrentUpstreamPushTargetAsync, resolveCurrentUpstreamRemoteRef, resolveExactRemoteBranchHead, resolveExactRemoteBranchHeadAsync, resolveIsExactSingleChildCommit, resolveIsExactSingleChildCommitAsync, resolveIsWorkingTreeClean, resolveIsWorkingTreeCleanAsync, resolvePrReviewDiffStats, resolvePrReviewDiffStatsAsync, resolvePrWorkflowRevisionDigest, resolveRemoteRefsContainingHead, resolveRemoteRefsContainingHeadAsync } from '../background/workspace-snapshot.js';
 import { type PrWorkflowGitState } from '../git/pr-workflow-state.js';
 export declare const PR_REVIEW_BASE_DIMENSION_IDS: readonly ["intent-architecture", "correctness-state", "tests-falsifiability", "security-trust", "reliability-performance", "compatibility-delivery"];
-export declare const PR_REVIEW_REQUIRED_MICRO_LANE_IDS: readonly ["auth-identity-secrets", "untrusted-input-boundaries", "subprocess-platform", "concurrency-state", "dependencies-build-release", "api-schema-migrations", "test-infrastructure", "ui-accessibility-i18n", "privacy-observability", "generated-provenance", "unclassified-risk"];
+export declare const PR_REVIEW_REQUIRED_MICRO_LANE_IDS: ("auth-identity-secrets" | "untrusted-input-boundaries" | "subprocess-platform" | "concurrency-state" | "dependencies-build-release" | "api-schema-migrations" | "test-infrastructure" | "ui-accessibility-i18n" | "privacy-observability" | "generated-provenance" | "unclassified-risk")[];
 export type PrReviewBaseDimensionId = (typeof PR_REVIEW_BASE_DIMENSION_IDS)[number];
 export type PrWorkflowMode = 'PR_REVIEW' | 'PR_FEEDBACK';
 export interface PrWorkflowCheckoutRecoveryRecord {
@@ -194,6 +195,8 @@ export interface PrWorkflowGateState {
     prReviewBaseDispatches?: PrReviewBaseDispatchRecord[];
     /** @deprecated Compatibility projection of the most recent base dispatch. */
     prReviewBaseDispatch?: PrReviewBaseDispatchRecord;
+    /** Canonical ordered semantic ledger frozen by the first micro dispatch. */
+    prReviewTriggerLedger?: PrReviewInlineTriggerRow[];
     prReviewTriggerEvalPath?: string;
     prReviewValidationBatches?: PrReviewValidationBatchRecord[];
     prReviewArtifactRunId?: string;
@@ -284,7 +287,7 @@ export declare function bindPrReviewBase(directory: string, sessionID: string, o
  * exact remediation command so callers can self-diagnose instead of
  * cascading into fictional root causes.
  */
-export declare function assertCurrentCheckoutHead(directory: string, expectedHead: string): Promise<string>;
+export declare function assertCurrentCheckoutHead(directory: string, expectedHead: string, mode?: PrWorkflowMode): Promise<string>;
 /** Prove that every PR-review lane reads the immutable checked-out PR tree. */
 export declare function assertPrReviewCleanCheckout(directory: string, mode?: PrWorkflowMode): Promise<void>;
 export declare function enforcePrWorkflowDispatchLanesAsync(directory: string, sessionID: string, toolName: string): Promise<PrWorkflowGateState | null>;
@@ -335,6 +338,8 @@ export declare function assertPrFeedbackGatePhaseSettled(directory: string, sess
 /** Require every ordered feedback gate on one unchanged revision. */
 export declare function assertPrFeedbackReadyToPublish(directory: string, sessionID: string): Promise<PrWorkflowGateState>;
 export declare function markPrReviewTriggerEvaluationComplete(directory: string, sessionID: string, artifactPath: string): Promise<PrWorkflowGateState>;
+/** Freeze one exact inline trigger ledger across every micro dispatch. */
+export declare function bindPrReviewTriggerLedger(directory: string, sessionID: string, input: unknown): Promise<PrWorkflowGateState>;
 export declare function assertPrReviewArtifactBoundary(directory: string, sessionID: string, runId: string, boundary: PrReviewArtifactBoundary, findingIds: string[]): Promise<PrWorkflowGateState>;
 /**
  * Artifact records are a projection of lane receipts, never a caller-controlled
@@ -365,14 +370,23 @@ export declare function completePrWorkflow(directory: string, sessionID: string,
 export declare const _test_exports: {
     workflowGateStateRelativePath: typeof workflowGateStateRelativePath;
     workflowGateStateLockRelativePath: typeof workflowGateStateLockRelativePath;
+    workflowCheckoutMutationLockRelativePath: typeof workflowCheckoutMutationLockRelativePath;
+    withPrWorkflowCheckoutMutationLock: typeof withPrWorkflowCheckoutMutationLock;
     resetTrackedStateCache: () => void;
     beforeTerminalClear: (() => Promise<void>) | undefined;
     beforePrFeedbackTransitionLock: (() => Promise<void>) | undefined;
+    beforePrFeedbackTrackingSwitch: (() => Promise<void>) | undefined;
+    afterPrFeedbackTrackingSwitch: (() => Promise<void>) | undefined;
+    beforePrFeedbackTrackingPersist: (() => Promise<void>) | undefined;
     beforeBoundedSwarmFileOpen: (() => Promise<void>) | undefined;
     beforeSessionStateLockWrite: (() => Promise<void>) | undefined;
+    beforeCheckoutLockWrite: (() => Promise<void>) | undefined;
     beforeSafeDirectoryCreate: ((parentPath: string, nextPath: string) => Promise<void>) | undefined;
     beforeAtomicTempWrite: (() => Promise<void>) | undefined;
     beforeAtomicRename: (() => Promise<void>) | undefined;
+    openCheckoutLock: typeof openCheckoutLockFile;
+    removeCheckoutLock: typeof removeCheckoutLockFile;
+    checkoutMutationActionTimeoutMs: number;
     resolveCurrentGitHead: typeof resolveCurrentGitHead;
     resolveCurrentGitHeadAsync: typeof resolveCurrentGitHeadAsync;
     resolveCurrentUpstreamPushTarget: typeof resolveCurrentUpstreamPushTarget;
@@ -407,12 +421,24 @@ export declare function normalizePrWorkflowShellCommand(command: string): {
     strippedCdPrefix: boolean;
 };
 declare function isSafeStandaloneGitCommit(command: string): boolean;
-/** Require at least one real discovery row or a lane-bound CLEAN attestation. */
-export declare function prReviewDiscoveryArtifactCoversLane(text: string, expectedWorkflowLane: string): boolean;
+/** Require at least one semantically valid discovery row or CLEAN attestation. */
+export declare function prReviewDiscoveryArtifactCoversLane(text: string, expectedWorkflowLane: string, ownedWorkflowLanes?: readonly string[]): boolean;
 declare function parseCriticVerdict(text: string, itemId: string, reviewerSeverity?: string): {
     status: string;
     severity: string;
 } | null;
+declare function workflowCheckoutMutationLockRelativePath(): string;
+declare function openCheckoutLockFile(lockPath: string): Promise<fsp.FileHandle>;
+declare function removeCheckoutLockFile(lockPath: string): Promise<void>;
+/** A bounded checkout-mutation refusal that never permits unsafe late overlap. */
+export declare class PrWorkflowCheckoutMutationTimeoutError extends Error {
+    readonly phase: 'queue' | 'action';
+    readonly code: "PR_WORKFLOW_CHECKOUT_MUTATION_TIMEOUT";
+    readonly retryable: false;
+    constructor(phase: 'queue' | 'action');
+}
+/** Serialize project-wide checkout mutations before any session state lock. */
+export declare function withPrWorkflowCheckoutMutationLock<T>(directory: string, action: () => Promise<T>): Promise<T>;
 declare function isProcessAlive(pid: number): boolean;
 declare function workflowGateStateLockRelativePath(sessionID: string): string;
 declare function workflowGateStateRelativePath(sessionID: string): string;

package/dist/hooks/repo-graph-builder.d.ts

@@ -44,6 +44,24 @@ export interface RepoGraphDeps {
     }) => Promise<RepoGraph>;
     safeRealpathSync?: typeof safeRealpathSync;
 }
+/**
+ * Rebase a realpath'd file onto the lexical workspace root so the incremental
+ * update keys the same node the walk produced (issue #1985, defect A5). Exported
+ * for direct unit testing of the symlink-root rebase logic.
+ *
+ * The walk keys nodes lexically relative to `workspaceRoot` (realpath is used
+ * only as a cycle-break key). When the workspace root itself is a symlink
+ * (`workspaceRoot` → `realWorkspace`), a realpath'd file (`realFilePath`) lives
+ * under `realWorkspace` and would key a DIFFERENT node than the lexical path the
+ * walker would have produced — causing a duplicate node.
+ *
+ * If `realFilePath` is under `realWorkspace`, rebase its workspace-relative tail
+ * onto the lexical `workspaceRoot` (reconstructing the lexical absolute path the
+ * walker used). Otherwise (case-insensitive aliasing without a symlinked root,
+ * or an unexpected layout) return `realFilePath` so the case-folding benefit of
+ * the realpath is preserved.
+ */
+export declare function rebaseOntoWorkspace(realFilePath: string, realWorkspace: string, workspaceRoot: string): string;
 export declare function createRepoGraphBuilderHook(workspaceRoot: string, deps?: Partial<RepoGraphDeps>, options?: {
     excludeDirs?: readonly string[];
 }): RepoGraphBuilderHook;

package/dist/hooks/skill-propagation-gate.d.ts

@@ -29,6 +29,16 @@ import { appendSkillUsageEntry, readSkillUsageEntries, readSkillUsageEntriesTail
 export declare function loadRoutingSkills(directory: string, targetAgent: string): string[];
 /** Agents that should receive skill context in delegations. */
 export declare const SKILL_CAPABLE_AGENTS: Set<string>;
+/**
+ * Skill root directories to scan for SKILL.md files.
+ *
+ * Exported because `src/config/lane-permissions.ts` resolves these same
+ * project-relative roots to absolute directories when building the
+ * `external_directory` allowlist for a worktree-lane instance. Keeping one
+ * definition means a new skill root cannot be added here and silently become
+ * an unanswerable permission prompt inside a lane.
+ */
+export declare const SKILL_SEARCH_ROOTS: string[];
 /**
  * Maximum number of session-scoped skill-usage tail entries to process for
  * skill scoring. This applies to the bounded tail-read window only.