opencode-swarm 7.135.2 → 7.135.4

package/dist/cli/{pr-subscriptions-v5xd3j6d.js → pr-subscriptions-qhr41epq.js}

@@ -9,17 +9,17 @@ import {
   sweepStale,
   unsubscribe,
   updateSnapshot
-} from "./index-3xbx305x.js";
-import"./index-bfd4xfpp.js";
+} from "./index-tcn457d5.js";
+import"./index-4qzeef9h.js";
 import"./index-fsrp8wp3.js";
 import"./index-09b9zncg.js";
 import"./index-7g4c7s5r.js";
-import"./index-7a2hm51h.js";
 import"./index-bpmtbmy9.js";
+import"./index-7a2hm51h.js";
 import"./index-z6xqpmqg.js";
 import"./index-zjygnfay.js";
-import"./index-zgwm4ryv.js";
 import"./index-y111zefa.js";
+import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {
   updateSnapshot,

package/dist/cli/{scan-cursor-1q1zmt4b.js → scan-cursor-nk2rybhq.js}

@@ -4,8 +4,8 @@ import {
   alreadyCuratedThisGeneration,
   claimNextScanBatch,
   getScanStatus
-} from "./index-b0eva00y.js";
-import"./index-02cqjna3.js";
+} from "./index-vh39nxpx.js";
+import"./index-5s1q6xcw.js";
 import"./index-ae75rja9.js";
 import"./index-dzyjb33e.js";
 import"./index-ey29aap6.js";
@@ -14,8 +14,8 @@ import"./index-fsrp8wp3.js";
 import"./index-09b9zncg.js";
 import"./index-7g4c7s5r.js";
 import"./index-7a2hm51h.js";
-import"./index-zgwm4ryv.js";
 import"./index-y111zefa.js";
+import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {
   getScanStatus,

package/dist/cli/{schema-8mtsfspm.js → schema-th3tx32c.js}

@@ -93,8 +93,9 @@ import {
   resolveGeneratedAgentRole,
   resolveGuardrailsConfig,
   stripKnownSwarmPrefix
-} from "./index-j0kte6gd.js";
+} from "./index-cg413zhk.js";
 import"./index-bk5tah7q.js";
+import"./index-3jcyn8g6.js";
 import"./index-bpmtbmy9.js";
 import"./index-zjygnfay.js";
 import"./index-a76rekgs.js";

package/dist/cli/scope-persistence-h2fpgxww.js

@@ -17,10 +17,10 @@ import"./index-wxyxf0bd.js";
 import"./index-1kz6da87.js";
 import"./index-09b9zncg.js";
 import"./index-7g4c7s5r.js";
-import"./index-7a2hm51h.js";
 import"./index-bpmtbmy9.js";
-import"./index-zgwm4ryv.js";
+import"./index-7a2hm51h.js";
 import"./index-y111zefa.js";
+import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {
   writeScopeToDisk,

package/dist/cli/{skill-generator-54xbjgak.js → skill-generator-1947bbkn.js}

@@ -33,12 +33,12 @@ import {
   sanitizeSlug,
   selectCandidateEntries,
   writeEvalStub
-} from "./index-qqkw794p.js";
-import"./index-jgkjxpdh.js";
-import"./index-3m7kpnqf.js";
+} from "./index-g86vfxnk.js";
+import"./index-fx7bn93y.js";
+import"./index-jsp8r6f9.js";
 import"./index-rtry5xyf.js";
-import"./index-02cqjna3.js";
-import"./index-8gw8p7yh.js";
+import"./index-5s1q6xcw.js";
+import"./index-mysdsqtk.js";
 import"./index-ae75rja9.js";
 import"./index-dzyjb33e.js";
 import"./index-ey29aap6.js";
@@ -48,8 +48,8 @@ import"./index-fsrp8wp3.js";
 import"./index-09b9zncg.js";
 import"./index-7g4c7s5r.js";
 import"./index-7a2hm51h.js";
-import"./index-zgwm4ryv.js";
 import"./index-y111zefa.js";
+import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {
   writeEvalStub,

package/dist/cli/{worktree-collision-ownership-15hymf1y.js → worktree-collision-ownership-13btcj9g.js}

@@ -1,26 +1,26 @@
 // @bun
 import {
   scanWorktreeProvisioningOwnersForRecovery
-} from "./index-73dfyfhq.js";
+} from "./index-x20cgr2q.js";
 import {
   scanWorktreeMergeFailuresForRecovery
 } from "./index-b8zgtz81.js";
 import {
   scanDelegationFallbacksForRecovery,
   scanDelegationsForRecovery
-} from "./index-hdy2nd5h.js";
-import"./index-bfd4xfpp.js";
+} from "./index-45t7w06b.js";
+import"./index-4qzeef9h.js";
 import"./index-fsrp8wp3.js";
 import"./index-09b9zncg.js";
 import"./index-7g4c7s5r.js";
-import"./index-7a2hm51h.js";
 import"./index-bpmtbmy9.js";
+import"./index-7a2hm51h.js";
 import"./index-z6xqpmqg.js";
 import"./index-zjygnfay.js";
-import"./index-zgwm4ryv.js";
 import {
   bunSpawn
 } from "./index-y111zefa.js";
+import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 
 // src/hooks/delegation-gate/worktree-collision-ownership.ts

package/dist/commands/approve-plan-critic.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Handle /swarm approve-plan-critic command.
+ *
+ * Human-only escape hatch for the ratchet-tighter `critic_pre_plan` execution
+ * gate (issue #2012). When the critic returns APPROVED but the mechanical
+ * snapshot recorder fails to persist it (verdict-format mismatch, dispatch-
+ * signal miss, or a plan.json read race), the gate permanently blocks ALL
+ * coder delegations because `critic_pre_plan` defaults to `true` and cannot be
+ * disabled. This records a manual `plan_critic_gate` approval snapshot so the
+ * gate unblocks, with a distinct `method: 'manual_override'` audit marker.
+ *
+ * The command is `toolPolicy: 'restricted'` — the agent cannot run it via
+ * `swarm_command`; the agent must instead call the `approve_plan_critic` tool
+ * (or ask the user to run this command). Both paths funnel into
+ * `forceRecordPlanCriticApproval`. The command path sets `user_confirmed: true`
+ * (human-initiated); the tool path sets `user_confirmed: false`
+ * (agent-initiated) so a self-approve is visible in the audit trail.
+ *
+ * Mirrors the PR_REVIEW #1898 escape-hatch pattern (`/swarm abort-pr-workflow`).
+ */
+export declare function handleApprovePlanCriticCommand(directory: string, args: string[], sessionID: string): Promise<string>;

package/dist/commands/registry.d.ts

@@ -551,6 +551,14 @@ export declare const COMMAND_REGISTRY: {
         readonly category: "utility";
         readonly toolPolicy: "restricted";
     };
+    readonly 'approve-plan-critic': {
+        readonly handler: (ctx: CommandContext) => Promise<string>;
+        readonly description: "Record a MANUAL plan-critic approval to unblock the critic_pre_plan execution gate [reason...]";
+        readonly args: "[reason...]";
+        readonly details: "Human-only escape hatch for the ratchet-tighter critic_pre_plan execution gate (issue #2012). When the critic already returned APPROVED but the mechanical snapshot recorder failed to persist it (verdict-format mismatch, dispatch-signal miss, or a plan.json read race), the gate permanently blocks ALL coder delegations because critic_pre_plan defaults to true and cannot be disabled. Running this records a manual plan_critic_gate approval snapshot so the gate unblocks, with a distinct method: \"manual_override\" audit marker. The agent itself cannot run this command; it must call the approve_plan_critic tool (or ask you to run this command). Both paths funnel into the same forceRecordPlanCriticApproval hook, which requires an active architect session. An audit event is appended to .swarm/events.jsonl. Prefer re-running MODE: CRITIC-GATE first; use this only as an escape hatch when a legitimate APPROVED was lost.";
+        readonly category: "utility";
+        readonly toolPolicy: "restricted";
+    };
     readonly 'pr-review': {
         readonly handler: (ctx: CommandContext) => CommandResult;
         readonly description: "Launch deep PR review with multi-lane analysis [url] [--council]";

package/dist/config/cache-paths.d.ts

@@ -3,6 +3,54 @@
  * Mirrors CONFIG_DIR in src/cli/index.ts.
  */
 export declare function getPluginConfigDir(): string;
+/**
+ * The config directory the OpenCode HOST is actually using, honouring
+ * `OPENCODE_CONFIG_DIR`.
+ *
+ * Verbatim host precedence (`C:\OpenCode\opencode.exe`, opencode 1.18.10,
+ * offset 107379448):
+ *
+ * ```js
+ * function y(N={}){return{home:G.home,data:G.data,cache:G.cache,
+ *   config:e.OPENCODE_CONFIG_DIR??G.config, ...}}
+ * ```
+ *
+ * This is deliberately SEPARATE from {@link getPluginConfigDir}, which has
+ * shared semantics relied on by `src/cli/index.ts` and
+ * `src/services/diagnose-service.ts` for locating plugin caches and lock files.
+ * Changing that function's meaning would move those consumers too.
+ *
+ * Only the worktree-lane permission allowlist uses this: under
+ * `OPENCODE_CONFIG_DIR` the two directories differ, and allowlisting the wrong
+ * one grants a directory the host is not reading while denying the one it is.
+ */
+export declare function getHostConfigDir(): string;
+/**
+ * The data directory the OpenCode HOST uses.
+ *
+ * Verbatim host source (opencode 1.18.10, offset ~107378180):
+ *   `V = XDG_DATA_HOME || join(homedir(), ".local", "share")`
+ *   `U = join(V, "opencode")`   -> `Global.Path.data`
+ *
+ * Unlike `config`, the data path has no environment override: the `y()` service
+ * factory passes `data: G.data` straight through (offset 107379448).
+ *
+ * Used by the worktree-lane allowlist to re-grant `<data>/plans`, which the
+ * host natively allows to its `plan` agent.
+ */
+export declare function getHostDataDir(): string;
+/**
+ * Where OpenCode caches URL-sourced skills (`skills.urls`).
+ *
+ * Both discovery implementations agree on the root:
+ *   v1 (offset 102988349): `join(Global.Path.cache, "skills")`
+ *   v2 (offset 103375250): `resolve(cache, "skills", Bun.hash(url))` — a
+ *                          per-URL subdirectory of the same root.
+ *
+ * Pure path construction, no I/O and no network: the pull itself is the host's
+ * job, and the plugin only needs to know where the result lands.
+ */
+export declare function getHostSkillCacheDir(): string;
 /**
  * All known locations where OpenCode may cache the opencode-swarm plugin.
  * Order: newest/canonical first so status reporting shows the most relevant

package/dist/config/constants.d.ts

@@ -118,6 +118,24 @@ export declare const AUTO_PROCEED_BANNER = "## \u23ED\uFE0F AUTO-PROCEED STATUS\
  * Zod schema in schema.ts).
  */
 export declare const DEFAULT_LEAN_TURBO_CONFIG: LeanTurboConfig;
+/**
+ * Directory name of the DD-6 default swarm-managed worktree base, created as a
+ * SIBLING of the project root (`<project-parent>/.swarm-worktrees`).
+ *
+ * Single source of truth shared by `resolveWorktreeBaseDir` in
+ * `src/worktree/core.ts` (which BUILDS lane paths) and
+ * `src/config/lane-context.ts` (which RECOGNISES a lane path after the fact,
+ * from inside the lane's own OpenCode instance). Those two must never drift: if
+ * creation and recognition disagree, a lane instance silently fails to be
+ * identified as a lane and falls back to unscoped permission behaviour.
+ *
+ * It lives in this leaf constants module rather than in `src/worktree/core.ts`
+ * so that the init-path-safe lane modules can share it without pulling the
+ * worktree lifecycle module into the plugin entry's import graph
+ * (AGENTS.md invariant 1; enforced by
+ * `tests/unit/turbo/lean/init-safety.test.ts`).
+ */
+export declare const SWARM_WORKTREE_DIR_NAME = ".swarm-worktrees";
 export declare const DEFAULT_WORKTREE_ISOLATION_CONFIG: WorktreeIsolationConfig;
 export declare const LEAN_TURBO_BANNER = "## \uD83D\uDEE4\uFE0F LEAN TURBO ACTIVE\n\nLane-based parallel execution is enabled for this phase.\n\nBehavioral changes:\n- Tasks are partitioned into parallel lanes based on file-scope conflicts. Tasks in the same lane run sequentially; tasks in different lanes run concurrently (up to max_parallel_coders).\n- **Lane dispatch overrides the one-agent-per-message rule**: for lean lane dispatch only, you may send multiple Task tool calls concurrently (one per lane).\n- **Lane tasks skip per-task Stage B** (reviewer + test_engineer). Quality is enforced at phase-end via phase reviewer and critic gates instead.\n- **Degraded tasks** (global files, protected paths, high-risk patterns) and **serialized tasks** (lock-conflicted) run through standard serial workflow with full Stage B gates.\n- **Phase reviewer and critic are REQUIRED** before phase_complete when lean turbo is active \u2014 they serve as the holistic quality gate for all lane work.\n- **Full-Auto composition**: if Full-Auto is also active, lane dispatch is subject to Full-Auto delegation policy and phase approval.\n- Use the lean_turbo_run_phase tool to execute a phase with parallel lanes\n\nDo NOT skip phase reviewer/critic when configured. Degraded and serialized tasks MUST still go through full Stage B.\n";
 export declare const EPIC_MODE_BANNER = "## \uD83E\uDDED EPIC MODE ACTIVE\n\n**\u26D4 THE USER ALWAYS COMES FIRST \u2014 this overrides everything below.** The user can message you at ANY time, including mid-phase while coders are running or retrying. The instant a user message arrives \u2014 a question, a slash command, a comment, anything \u2014 STOP advancing the flow. Do not dispatch, do not retry, do not call another tool. Read what they said and respond to them directly, in plain conversation, first. Never keep executing the protocol and leave a user message unanswered \u2014 ignoring the user is the single worst failure mode in this mode. After you've answered, pick up where you left off. If you're mid-wave when they interrupt, tell them the state (\"3.1 and 3.2 are still running; I'll continue once I've answered you\") rather than going silent.\n\n**Activation \u2260 start.** Until the user asks for execution (\"start phase N\", \"run task X\", \"continue\"): do nothing. On `/swarm turbo epic`, `/swarm epic *` and any slash status/config command: call the named tool ONCE, surface its output VERBATIM, then stop. Don't infer intent \u2014 if unsure, ASK. This restraint applies ONLY before activation.\n\n**Talk to the user as you work** \u2014 like you naturally would. Once they ask you to run a phase, keep them in the loop with a sentence before each step about what you're doing and why (\"Declaring scopes for 3.1\u20133.3 so the planner can find parallelism\u2026\", \"Discrimination and calibration are independent, so I'll run 3.1 and 3.2 in parallel\u2026\"). This is normal conversation, not a form to fill in \u2014 the steps below tell you the key facts to share, but say them in your own voice. Don't go silent and tool-only through a phase.\n\nUse `epic_plan_waves` (NOT `lean_turbo_plan_lanes` or the deprecated `epic_run_phase`) for the wave plan. Do NOT call `lean_turbo_run_phase` directly.\n\n### Six-step flow (only when the user asks to run a phase)\n\n> Supersedes Rule 1a/3a: declare ALL pending scopes UP FRONT (step 1), BEFORE step 2. Just-in-time declaration breaks the wave planner.\n\n**1. `declare_scope` for every pending task** \u2014 one call per single `taskId` string (NOT ranges/arrays/globs). Tight, disjoint scopes; avoid shared files (`__init__.py`, barrels, registries) \u2014 they force serial waves. Declared scope is a CONTRACT; if a task needs more files mid-run, re-declare BEFORE dispatching.\n\n**2. `epic_decide_phase(directory, phase=N, sessionID)`** \u2014 returns:\n- `decided`+`promote` \u2192 step 3\n- `demoted` \u2192 step 6 (per-task serial)\n- `scopes-missing` \u2192 `declare_scope` each `missingScopes[]`, retry step 2\n- `no-phase` | `phase-empty` | `phase-already-complete` | `epic-state-unreadable` \u2192 fix per response `message`, retry. `phase-already-complete` means call step 2 with `phase=N+1` (NOT step 4 directly).\n- other \u2192 fix per `message`, retry\n\n**3. Surface the verdict to the user immediately, before any further action:**\n> Epic Mode: <PROMOTE|DEMOTE> (p=<value>) \u2014 <one-sentence rationale or top blocking reason>\n> Dependencies: <task_id> \u2190 <deps>; \u2026 (omit if none)\n\nThe verdict is the user's only visibility into what Epic is doing \u2014 silence here makes the mode invisible. If you're going to spend time on this phase, tell the user why up front. Phrase it naturally; the format above is a guide, not a script.\n\n**4. `epic_plan_waves(directory, phase=N)`** \u2014 returns `{ waves: [{ waveId, taskIds, files }], serializedTasks, degradedTasks, degradationSummary }`. Failure reasons mirror step 2; additionally: `git-failed` (retry), `planner-error` (check `errors[0]`).\n\n**4b. Surface the wave plan to the user, before dispatching any `Task`:**\n> Wave plan (<N> waves): Wave 1 \u2192 [<ids>] (parallel); Wave 2 \u2192 [<ids>]; \u2026 \u2014 serialized [<ids>], degraded [<ids>]\n\nWalk them through which tasks run in which wave and what's parallel \u2014 naturally, in your own words. If `waves.length` exceeds the distinct-dependency-layer count, also flag the over-split and its likely cause (typical: a shared file like a barrel/registry in multiple scopes forces serial waves), e.g. \"Wave N split into K single-task waves because every scope claims `<shared-file>` \u2014 re-declare those tasks without it to restore parallelism, then re-plan.\"\n\n`serializedTasks` causes (NOT `declare_scope`-fixable): cycle, `no-scope`, `invalid-scope`, cap-exhaustion. Fix dep graph or scope contents, re-plan.\n\n`degradedTasks[].reason` keys:\n- `global file conflict` / `protected path` \u2192 balanced mode, dispatch per-task after waves\n- `cross-batch upstream not committed (greenfield-smart Rule 3): <ids>` \u2192 commit named upstreams, re-plan\n- `unresolved in-batch dependency: <ids>` \u2192 fix upstream degrade/serialize, re-plan\n- `planning leftover (no identifiable blocker)` \u2192 surface as planner bug\n\n**5. Dispatch each wave: `wave.taskIds.length` SEPARATE `Task` calls in ONE assistant message.** Per wave in order:\n- One `Task(subagent_type=\"coder\", description=\"Phase N task <id>\", prompt=\"<scope + acceptance>\")` per `taskId`\n- ALL in same turn \u2192 concurrent\n- Wait for all in wave to reach `update_task_status(completed)` + `epic_record_divergence` before next wave\n\n\u26A0\uFE0F **Three defects:**\n1. **Bundling**: multiple ids in one Task call \u2192 kills 1:1 coder visibility\n2. **Splitting across messages**: serial execution, no parallelism\n3. **Skipping single-task waves**: still emit ONE Task, wait for completion+divergence\n\nThis is the only sanctioned dispatch path. Don't use `lean_turbo_run_phase`; don't bundle through other tools \u2014 visibility requires `Task`.\n\n`serializedTasks` + `degradedTasks` (after wave loop): ONE Task per assistant message each, never batched, wait for completion+divergence between.\n\n**6. After each `update_task_status(completed)`, call `epic_record_divergence(directory, taskId, sessionID)`** (feeds calibration). If `summary.isClean: false`:\n> Divergence: task `<id>` wrote <undeclaredCount> undeclared file(s) (ratio <ratio>)\n\n### Phase-complete + audit\n\nPhase reviewer + critic still required at `phase_complete` (Epic Mode doesn't change Stage B).\n\nAudit (no architect needed): `/swarm epic status | last | decide | calibration`.\n";

package/dist/config/host-path.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Faithful transcription of OpenCode's path-canonicalisation helpers.
+ *
+ * ## Why this must exist
+ *
+ * The host asks for `external_directory` permission with a pattern it has run
+ * through `Filesystem.normalizePathPattern` — for example
+ * `src/tools/…` (offset 100715012):
+ *
+ * ```js
+ * let u = G.normalizePathPattern(Hr.join(y, "*"));
+ * yield* o.ask({ permission: "external_directory", patterns: [u], always: [u], … });
+ * ```
+ *
+ * Rule patterns from config get NO such treatment: `Permission.fromConfig`
+ * applies only `~` / `$HOME` expansion. So for a rule to match, its text must
+ * already equal what the host will produce for the asked path.
+ *
+ * That matters because `normalizePathPattern` resolves symlinks via
+ * `realpathSync.native`. A lane reached through a Windows junction (or a macOS
+ * `/var` → `/private/var` symlink) is asked for under its REAL path, while an
+ * un-canonicalised rule names the link path — so the lane is denied access to
+ * its own granted directory.
+ *
+ * Verbatim host source (`C:\OpenCode\opencode.exe`, opencode 1.18.10,
+ * offsets 107196170-107196420; the minified names resolve via the chunk's own
+ * imports at offset 107192671: `ky`=`path.resolve`, `yy`=`path.join`,
+ * `ek`=`fs.realpathSync`):
+ *
+ * ```js
+ * function j(F){ let z=ky(X(F)); try{ return ek.native(z) }catch{ return z } }
+ * YW.normalizePath = j;
+ *
+ * function J(F){
+ *   if(F==="*") return F;
+ *   let z=F.match(/^(.*)[\\/]\*$/);
+ *   if(!z) return j(F);
+ *   let Z=/^[A-Za-z]:$/.test(z[1]) ? z[1]+"\\" : z[1];
+ *   return yy(j(Z),"*");
+ * }
+ * YW.normalizePathPattern = J;
+ *
+ * function X(F){ return F
+ *   .replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(z,Z)=>`${Z.toUpperCase()}:/`)
+ *   .replace(/^\/([a-zA-Z])(?:\/|$)/,(z,Z)=>`${Z.toUpperCase()}:/`)
+ *   .replace(/^\/cygdrive\/([a-zA-Z])(?:\/|$)/,(z,Z)=>`${Z.toUpperCase()}:/`)
+ *   .replace(/^\/mnt\/([a-zA-Z])(?:\/|$)/,(z,Z)=>`${Z.toUpperCase()}:/`) }
+ * YW.windowsPath = X;
+ * ```
+ *
+ * If a future OpenCode release changes these, lane rules stop matching. The
+ * shared-normaliser tests in `tests/unit/config/lane-permissions.test.ts` are
+ * the tripwire — re-extract before "fixing" them.
+ *
+ * @module config/host-path
+ */
+/**
+ * Test-only DI seam (AGENTS.md invariant 7). Lets tests simulate a symlink /
+ * junction without creating one, and assert the ENOENT degradation.
+ */
+export declare const _internals: {
+    realpathSyncNative: (p: string) => string;
+};
+/** Host `Filesystem.windowsPath`. */
+declare function hostWindowsPath(input: string): string;
+/**
+ * Host `Filesystem.normalizePath`: `realpathSync.native(path.resolve(windowsPath(p)))`,
+ * degrading to the un-realpath'd resolved form on ANY realpath failure.
+ *
+ * The host uses a bare `catch` here (not an ENOENT check), so a permission
+ * error degrades identically to a missing path. Transcribed as-is: diverging
+ * would make our rule text disagree with the host's asked text in exactly the
+ * cases where a lane is already having filesystem trouble.
+ */
+declare function hostNormalizePath(input: string): string;
+/**
+ * Host `Filesystem.normalizePathPattern`.
+ *
+ * Canonicalises the DIRECTORY part of a `<dir>/*` pattern and re-appends the
+ * wildcard, leaving the bare `*` catch-all untouched. Note the drive-root
+ * special case: for `C:/*` the captured directory is `C:` which
+ * `path.resolve` would turn into the process's current directory on that
+ * drive, so the host appends a separator first.
+ */
+export declare function hostNormalizePathPattern(pattern: string): string;
+/**
+ * Tier-0 test seam (writing-tests skill): pure transcriptions with no external
+ * dependency beyond the DI'd realpath. Only {@link hostNormalizePathPattern} is
+ * consumed by production code, so these stay internal.
+ */
+export declare const _test_exports: {
+    hostWindowsPath: typeof hostWindowsPath;
+    hostNormalizePath: typeof hostNormalizePath;
+};
+export {};

package/dist/config/lane-context.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Swarm worktree-lane context detection.
+ *
+ * ## Why this exists
+ *
+ * OpenCode partitions **all** permission state by *directory*. Every service
+ * that matters — `Permission.state`, `Agent.state`, `Plugin.state`,
+ * `ToolRegistry.state` — is built through the same directory-keyed
+ * `InstanceState` cache. When opencode-swarm creates a worktree-lane session
+ * bound to a new directory (`session.create({ query: { directory: lanePath } })`),
+ * that lane gets a brand-new permission universe: an empty `approved` list, so
+ * every prior "Allow always" is forgotten, and a private pending map. Because a
+ * lane instance has no TUI attached, an `external_directory` prompt raised there
+ * can never be answered and the lane hangs forever (the host's `Permission.ask`
+ * awaits its deferred with no timeout).
+ *
+ * The fix is to pre-resolve permissions for lane instances via the plugin
+ * `config` hook. That requires answering one question cheaply and reliably:
+ * **is this directory a swarm worktree lane, and if so, what project is it a
+ * worktree of?**
+ *
+ * ## Why there is no `git` subprocess here
+ *
+ * The obvious implementation is
+ * `git -C <lane> rev-parse --path-format=absolute --git-common-dir`. This module
+ * deliberately does not do that. `resolveLaneContext` is called from the plugin
+ * `config` hook, which the host runs inside `Plugin.state` initialisation —
+ * squarely on the plugin-init path that AGENTS.md invariant 1 governs, and that
+ * invariant names Git commands explicitly as forbidden there.
+ *
+ * Instead this module reads the two files git itself would consult:
+ *
+ *   - `<lane>/.git` — in a linked worktree this is a *file*, not a directory,
+ *     containing `gitdir: <main>/.git/worktrees/<name>`.
+ *   - `<main>/.git/worktrees/<name>/commondir` — a relative pointer back to the
+ *     shared `.git` directory (normally `../..`).
+ *
+ * That is the same information the subprocess would return, obtained with at
+ * most two small synchronous reads, no child process, no timeout to get wrong,
+ * and nothing to kill in a `finally`. It is strictly safer on the init path than
+ * a spawn would be, and it removes an entire class of invariant-3 exposure.
+ *
+ * @module config/lane-context
+ */
+import { addDeferredWarning } from '../services/warning-buffer';
+/**
+ * A resolved swarm worktree lane.
+ */
+export interface LaneContext {
+    /** Absolute, resolved path of the lane worktree itself. */
+    lanePath: string;
+    /**
+     * Absolute, resolved path of the project this lane is a git worktree of —
+     * i.e. the main working tree that owns the shared `.git` directory.
+     */
+    parentProjectPath: string;
+}
+/**
+ * Test-only dependency-injection seam (AGENTS.md invariant 7 — prefer
+ * `_internals` over `mock.module`, which leaks across files in Bun's shared
+ * test-runner process). Tests replace these to simulate unreadable `.git`
+ * files, malformed pointers, and permission errors. Restore in `afterEach`.
+ */
+export declare const _internals: {
+    readFileSync: (p: string, enc: BufferEncoding) => string;
+    statSync: (p: string) => {
+        isFile(): boolean;
+    };
+    addDeferredWarning: typeof addDeferredWarning;
+    /**
+     * Clears the detection cache. Test-only; production has no reason to call
+     * it because a directory's lane-ness cannot change while the process holds
+     * an OpenCode instance for that directory.
+     */
+    clearCache: () => void;
+};
+/**
+ * Decides whether `directory` is a swarm worktree lane and, if so, resolves the
+ * lane path and the parent project it is a worktree of.
+ *
+ * Detection requires two independent conditions, the second of which may be
+ * satisfied either way:
+ *
+ *  1. REQUIRED — the directory (or a bounded number of its ancestors) is a real
+ *     LINKED git worktree whose main working tree resolves. A main working tree
+ *     has a `.git` directory rather than a file and is never a lane.
+ *  2. REQUIRED — the worktree is swarm-OWNED, established by EITHER
+ *     (a) its branch matching the full grammar in `./swarm-branch.ts`
+ *         (`swarm/<purpose>/<sessionId>/<id>` or `swarm-lane/<sessionId>/<id>`,
+ *         with `<sessionId>` of the form `ses_…`) — the authoritative,
+ *         path-independent signal; OR
+ *     (b) the path sitting under a `.swarm-worktrees` base — the fallback for a
+ *         worktree whose HEAD is detached or unreadable, so its branch cannot
+ *         be consulted.
+ *
+ * (2a) is a full-grammar match rather than a `swarm/` prefix test on purpose: a
+ * user-authored `swarm/my-own-experiment` worktree must NOT be captured. A
+ * false positive is worse than a false negative here — see the module note in
+ * `./swarm-branch.ts`.
+ *
+ * A detached-HEAD swarm lane created OUTSIDE `.swarm-worktrees` (a
+ * `worktree_dir` override, or the Windows path-budget fallback) satisfies
+ * neither branch of (2) and is a false NEGATIVE: no permission changes, i.e.
+ * today's behaviour. That is the safe direction and is left as-is.
+ *
+ * NEVER throws. Any error — nonexistent directory, unreadable `.git`, malformed
+ * pointer, permission error, non-string input — yields `null` ("not a lane"),
+ * which preserves today's behaviour for ordinary sessions. That direction is
+ * the safe one: a false negative means "no permission changes at all", while a
+ * false positive would apply a deny-by-default ruleset to a normal project.
+ *
+ * @param directory - Directory to classify (typically the plugin's own
+ *                    `ctx.directory`, which under this host IS the instance
+ *                    directory).
+ * @returns The resolved lane context, or `null` when `directory` is not a lane.
+ */
+export declare function resolveLaneContext(directory: string): LaneContext | null;