opencode-swarm 7.135.2 → 7.135.3

package/dist/config/swarm-branch.d.ts

@@ -0,0 +1,130 @@
+/**
+ * The swarm worktree BRANCH GRAMMAR — single source of truth for both building
+ * and recognising the branch names that identify a swarm-owned worktree.
+ *
+ * ## Why a grammar and not a prefix
+ *
+ * Lane detection (`src/config/lane-context.ts`) uses the branch name as its
+ * ownership signal because, unlike the worktree's path, it is invariant across
+ * all three provisioning layouts (default `.swarm-worktrees`, a configured
+ * `worktree.worktree_dir`, and the Windows path-budget fallback that relocates
+ * a lane to `<os.tmpdir()>/swwt/...`).
+ *
+ * Matching a bare `swarm/` PREFIX is not safe. A user running
+ * `git worktree add -b swarm/my-own-experiment ../scratch` would be classified
+ * as a lane, and their ordinary interactive session would then have
+ * `external_directory: { "*": "deny", ... }` injected. That is strictly worse
+ * than the hang this subsystem exists to fix, because the host's
+ * `Permission.ask` short-circuits on a deny before it ever creates a deferred:
+ *
+ * ```js
+ * // opencode 1.18.10, Permission.ask
+ * if (W.action === "deny") return yield* new U.DeniedError({ ... });
+ * ```
+ *
+ * — so no prompt is raised and "Allow always" can never be reached. The user
+ * has no in-session recovery.
+ *
+ * The grammar below therefore matches the COMPLETE shape
+ * `makeWorktreeBranchName` emits, including a session segment constrained to
+ * OpenCode's `ses_`-prefixed identifier form. `tests/unit/config/swarm-branch.test.ts`
+ * holds a round-trip property test over the producer and a negative corpus of
+ * plausible human-authored branch names.
+ *
+ * @module config/swarm-branch
+ */
+/**
+ * True when `sessionId` is a session identifier the lane grammar can encode.
+ *
+ * Tool arguments are LLM-supplied (`sessionID: z.string()`) and the host's own
+ * `SessionID` brand is only `isStartsWith("ses")`, so a value like `ses-run-1`
+ * passes the host but yields a branch the recogniser cannot match — a lane that
+ * silently skips permission scoping and hangs. Callers that accept a session id
+ * from outside should check this before provisioning.
+ */
+export declare function isSwarmSessionId(sessionId: unknown): sessionId is string;
+/**
+ * Builds the branch name for a swarm worktree.
+ *
+ * The ONLY producer of these names. `makeWorktreeBranchName` in
+ * `src/worktree/core.ts` delegates here so the producer and
+ * {@link matchSwarmLaneBranch} cannot drift.
+ *
+ * @param sessionId    - Parent session identifier.
+ * @param id           - Execution-unit identifier (task or lane id).
+ * @param purpose      - Worktree purpose (e.g. `lane`).
+ * @param legacyLane   - Use Lean Turbo's `swarm-lane/<sessionId>/<id>` style.
+ */
+export declare function buildSwarmBranchName(sessionId: string, id: string, purpose: string, legacyLane: boolean): string;
+/**
+ * Recognises the DEFAULT lane PATH shape,
+ * `<base>/.swarm-worktrees/<sessionId>/<id>`.
+ *
+ * This is the fallback ownership signal for a worktree whose HEAD is detached
+ * or unreadable, so its branch cannot be consulted. It must be as tight as the
+ * branch grammar: matching "any path containing a `.swarm-worktrees` segment"
+ * captures a user's own `git worktree add -b my-feature ../.swarm-worktrees/manual-user-wt`,
+ * which then has an unrecoverable deny-by-default injected into an ordinary
+ * interactive session.
+ *
+ * `provisionWorktree` builds this path as
+ * `path.resolve(resolveWorktreeBaseDir(directory), sessionId, id)`, i.e. exactly
+ * two segments after the base, so the shape check requires exactly that — with
+ * the session segment held to the SAME `ses_…` constraint the branch grammar
+ * uses. The directory name comes from the same `SWARM_WORKTREE_DIR_NAME`
+ * constant `resolveWorktreeBaseDir` builds with, so the three definitions
+ * cannot drift.
+ *
+ * KNOWN RESIDUAL (accepted, not a defect to chase): a worktree the USER created
+ * at exactly `<base>/.swarm-worktrees/ses_<alnum>/<id>` on a non-swarm branch
+ * still classifies as a lane. Reaching it requires deliberately creating a
+ * directory literally named `ses_<alnum>` under a `.swarm-worktrees` base, and
+ * the same leniency is what keeps a REAL lane detected after someone checks out
+ * a different branch inside it. Narrowing further would trade a far more likely
+ * false negative (a real lane silently unscoped, i.e. the original hang) for a
+ * far less likely false positive.
+ *
+ * Note this recognises only the DEFAULT layout. A `worktree_dir` override or
+ * the Windows path-budget fallback produces a different path, and a lane in
+ * those layouts with a detached HEAD is a false NEGATIVE — no permission
+ * changes, i.e. today's behaviour. That is the safe direction.
+ *
+ * @param lanePath - An already-resolved absolute path.
+ */
+export declare function matchSwarmLanePath(lanePath: string): {
+    sessionId: string;
+    id: string;
+} | undefined;
+/** A branch name recognised as a swarm worktree lane. */
+export interface SwarmLaneBranch {
+    /** Worktree purpose. `'lane'` for the legacy style, which encodes no purpose. */
+    purpose: string;
+    sessionId: string;
+    id: string;
+    style: 'purpose' | 'legacy-lane';
+}
+/**
+ * Recognises a branch name produced by {@link buildSwarmBranchName}.
+ *
+ * Matches the complete grammar and nothing wider:
+ *   - `swarm/<purpose>/<sessionId>/<id>`   — exactly 4 segments
+ *   - `swarm-lane/<sessionId>/<id>`        — exactly 3 segments
+ *
+ * with `<sessionId>` matching `ses_[A-Za-z0-9]+` and `<purpose>` / `<id>` each
+ * a single non-empty, non-dot segment. Anything else — including a bare
+ * `swarm/my-own-experiment`, or a real lane name with extra trailing segments —
+ * returns `undefined`, which classifies the worktree as NOT swarm-owned and
+ * leaves it completely untouched.
+ *
+ * @returns The parsed branch, or `undefined` when the name is not a swarm lane.
+ */
+export declare function matchSwarmLaneBranch(branch: string): SwarmLaneBranch | undefined;
+/**
+ * Tier-0 test seam (writing-tests skill). The prefix list is an implementation
+ * detail of the grammar — production code goes through
+ * {@link buildSwarmBranchName} / {@link matchSwarmLaneBranch} — but the branch
+ * tests assert that both documented styles are actually exercised.
+ */
+export declare const _test_exports: {
+    SWARM_WORKTREE_BRANCH_PREFIXES: readonly ["swarm/", "swarm-lane/"];
+};

package/dist/hooks/delegation-gate.d.ts

@@ -265,11 +265,50 @@ interface MessageWithParts {
     info: MessageInfo;
     parts: MessagePart[];
 }
+declare function extractPlanCriticVerdict(output: unknown): 'APPROVED' | 'NEEDS_REVISION' | 'REJECTED' | null;
 /**
  * Returns whether the plan in the given directory has a valid plan-critic
  * approval. Does not throw — returns `false` for any failure (fail-closed).
  */
 export declare function isPlanCriticApproved(directory: string): Promise<boolean>;
+/**
+ * Escape hatch for the ratchet-tighter `critic_pre_plan` gate (issue #2012).
+ *
+ * When the critic returns APPROVED but the mechanical snapshot recorder
+ * ({@link recordPlanCriticApprovalSnapshotIfApplicable}) fails to persist it
+ * (verdict-format mismatch, dispatch-signal miss, or a plan.json read race),
+ * the gate permanently blocks ALL coder delegations because `critic_pre_plan`
+ * defaults to `true` and cannot be disabled (ratchet-tighter). This records a
+ * manual `plan_critic_gate` approval snapshot so the gate unblocks, with a
+ * distinct `method: 'manual_override'` audit marker so a human or downstream
+ * review can distinguish a manual approval from a mechanical critic approval.
+ *
+ * This mirrors the established escape-hatch pattern (PR_REVIEW gate #1898:
+ * `abortPrWorkflow` + `/swarm abort-pr-workflow` + `abort_pr_workflow` tool).
+ *
+ * Fail-closed preconditions:
+ * - The session must be an active **architect** session. The escape hatch is an
+ *   escalation; non-architect callers are rejected so a coder/reviewer cannot
+ *   self-unblock.
+ * - A plan.json must exist; you cannot approve a non-existent plan.
+ *
+ * @param directory - Project root containing `.swarm/`
+ * @param sessionID - The caller's session id (must be an architect session)
+ * @param options.reason - Optional human/agent-supplied reason (audited)
+ * @param options.userConfirmed - `true` only when invoked via the restricted
+ *   `/swarm approve-plan-critic` command (human-run); `false` when invoked via
+ *   the `approve_plan_critic` tool (agent-initiated). Recorded in the audit so a
+ *   self-approve is visible.
+ */
+export declare function forceRecordPlanCriticApproval(directory: string, sessionID: string, options?: {
+    reason?: string;
+    userConfirmed?: boolean;
+}): Promise<{
+    planId: string;
+    recordedAt: string;
+    reason?: string;
+    userConfirmed: boolean;
+}>;
 export declare function resolveDelegatedPlanTaskId(args: Record<string, unknown>, knownPlanTaskIds?: ReadonlySet<string>): string | null;
 /**
  * Builds a cause-specific diagnostic for `prepareCoderScope`'s SCOPE_NOT_DECLARED
@@ -332,7 +371,9 @@ export declare const _internals: {
     bindBackgroundCoderReservationForDispatch: typeof import("../background/pending-delegations.js").bindBackgroundCoderReservation;
     releaseBackgroundCoderReservationForDispatch: typeof import("../background/pending-delegations.js").releaseBackgroundCoderReservation;
     resetStandardWorktreeIsolationState: typeof resetStandardWorktreeIsolationState;
-    PLAN_CRITIC_TASK_SIGNALS: readonly ["critic-gate", "plan critic", "review plan", "review the plan", "plan.md", "approve the plan", "plan approval"];
+    PLAN_CRITIC_TASK_SIGNALS: readonly ["critic-gate", "plan critic", "review plan", "review the plan", "plan.md", "approve the plan", "plan approval", "pre-implementation review", "evaluate this plan", "evaluate the plan", "assess this plan", "assess the plan", "plan soundness", "before implementation", "review the plan below"];
+    extractPlanCriticVerdict: typeof extractPlanCriticVerdict;
+    forceRecordPlanCriticApproval: typeof forceRecordPlanCriticApproval;
     provisionWorktree: typeof _wtiInternals.provisionWorktree;
     removeWorktree: typeof _wtiInternals.removeWorktree;
     attemptMergeBackFromDirty: typeof _wtiInternals.attemptMergeBackFromDirty;

package/dist/hooks/skill-propagation-gate.d.ts

@@ -29,6 +29,16 @@ import { appendSkillUsageEntry, readSkillUsageEntries, readSkillUsageEntriesTail
 export declare function loadRoutingSkills(directory: string, targetAgent: string): string[];
 /** Agents that should receive skill context in delegations. */
 export declare const SKILL_CAPABLE_AGENTS: Set<string>;
+/**
+ * Skill root directories to scan for SKILL.md files.
+ *
+ * Exported because `src/config/lane-permissions.ts` resolves these same
+ * project-relative roots to absolute directories when building the
+ * `external_directory` allowlist for a worktree-lane instance. Keeping one
+ * definition means a new skill root cannot be added here and silently become
+ * an unanswerable permission prompt inside a lane.
+ */
+export declare const SKILL_SEARCH_ROOTS: string[];
 /**
  * Maximum number of session-scoped skill-usage tail entries to process for
  * skill scoring. This applies to the bounded tail-read window only.