opencode-swarm 7.136.1 → 7.136.3

package/dist/services/skill-optimizer/smoke.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Skill smoke validator — the `smoke_validated` transition (issue #1822).
+ *
+ * Composes existing primitives rather than duplicating them:
+ *   - `validateSkillPath` (path containment — knowledge-validator.ts);
+ *   - symlink/reparse denial (deny escape; mirrors bundled-skills.ts pattern);
+ *   - frontmatter schema check (YAML parse + required keys);
+ *   - the phrase-eval gate (`evaluateSkillChange` / `isRejectedSkillContent`
+ *     from skill-evaluator.ts) — refuses content the rejection ledger already
+ *     rejected;
+ *   - a bounded subprocess check via `spawnAsync` if the skill declares a
+ *     check command (cwd explicit, stdin ignored, timeout, kill, 512KB cap).
+ */
+import { validateSkillPath } from '../../hooks/knowledge-validator.js';
+import { spawnAsync } from '../../hooks/spawn-helper.js';
+import { evaluateSkillChange, isRejectedSkillContent } from '../skill-evaluator.js';
+export interface SmokeInput {
+    directory: string;
+    skillSlug: string;
+    /** Candidate SKILL.md content (not yet written to the skill root). */
+    candidateContent: string;
+    /** Incumbent SKILL.md content (current). Empty string if no incumbent. */
+    incumbentContent: string;
+    /** Optional check command the skill declares (e.g. `["bun", "test"]`). */
+    checkCommand?: string[];
+    /** Timeout for the optional check command. */
+    checkTimeoutMs?: number;
+}
+export interface SmokeResult {
+    ok: boolean;
+    verdict: 'COMPLIANT' | 'VIOLATED';
+    notes: string[];
+}
+export declare const _internals: {
+    validateSkillPath: typeof validateSkillPath;
+    isSymbolicLink: (p: string) => boolean;
+    escapedRoot: (root: string, target: string) => boolean;
+    realpath: (p: string) => string;
+    evaluateSkillChange: typeof evaluateSkillChange;
+    isRejectedSkillContent: typeof isRejectedSkillContent;
+    spawnAsync: typeof spawnAsync;
+};
+/** Validate a candidate skill before the validation-running transition. */
+export declare function validateSkillSmoke(input: SmokeInput): Promise<SmokeResult>;
+/** Read the incumbent SKILL.md content, or return empty string if absent. */
+export declare function readIncumbentContent(directory: string, skillSlug: string): string;

package/dist/services/skill-optimizer/store.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Append-only lifecycle store for the governed skill optimizer (issue #1822).
+ *
+ * Storage layout (all under `.swarm/`, AGENTS.md invariant #4):
+ *   .swarm/evolution/skills/<skillSlug>/<candidateId>/lifecycle.jsonl   (authoritative)
+ *   .swarm/evolution/skills/<skillSlug>/<candidateId>/state.json        (derived projection)
+ *   .swarm/evolution/skills/<skillSlug>/<candidateId>/baseline.md       (frozen baseline snapshot)
+ *   .swarm/evolution/skills/<skillSlug>/<candidateId>/candidate.md      (drafted candidate)
+ *   .swarm/evolution/skills/<skillSlug>/<candidateId>/diff.patch        (computed diff)
+ *   .swarm/evolution/skills/<skillSlug>/<candidateId>/rollback.md       (pre-activation snapshot)
+ *   .swarm/evolution/skills/lifecycle-quarantine.<ts>.<hash>            (corrupt-tail salvage)
+ *
+ * Integrity model mirrors `src/plan/ledger.ts`:
+ *   - fsync+rename atomic append, gated by an evidence lock;
+ *   - replay stops at the first unparseable line, sets `truncated`, captures
+ *     the bad suffix, and quarantines it WITHOUT rewriting the canonical ledger;
+ *   - hash-before/hash-after chain (reuses the plan-ledger field semantics —
+ *     no parallel "previousStateHash");
+ *   - partial/corrupt writes never count as acceptance (replay-after-write
+ *     verification in `recordTransition`, lifecycle.ts).
+ *
+ * IDs are collision-resistant and filesystem-safe (`crypto.randomUUID()`).
+ */
+import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { withEvidenceLock } from '../../evidence/lock.js';
+/** Lifecycle states (issue #1822 durable lifecycle). */
+export type SkillOptState = 'discovered' | 'drafted' | 'smoke_validated' | 'validation_running' | 'accepted_pending_approval' | 'rejected' | 'inconclusive' | 'activated' | 'expired' | 'rolled_back';
+/** A single append-only lifecycle event. Hash chain reuses plan-ledger semantics. */
+export interface SkillOptEvent {
+    seq: number;
+    timestamp: string;
+    candidateId: string;
+    skillSlug: string;
+    eventType: string;
+    fromState: SkillOptState | null;
+    toState: SkillOptState;
+    actor: string;
+    origin: string;
+    contentHashBefore: string | null;
+    contentHashAfter: string | null;
+    hashBefore: string;
+    hashAfter: string;
+    reason: string;
+    evidenceRefs: string[];
+    payload?: Record<string, unknown>;
+}
+export interface ReplayResult {
+    events: SkillOptEvent[];
+    state: SkillOptState | null;
+    truncated: boolean;
+    badSuffix: string | null;
+    /** Sequence number of the last complete (hash-verified) event. */
+    lastCompleteSeq: number;
+}
+/** SHA-256 over canonical JSON of an arbitrary value. */
+export declare function computeStateHash(value: unknown): string;
+/** SHA-256 of raw text content (a SKILL.md body). */
+export declare function computeContentHash(content: string): string;
+export declare function isValidSkillSlug(slug: string): boolean;
+/** Validate a candidate ID is filesystem-safe (uuid or equivalent). */
+export declare function isValidCandidateId(id: string): boolean;
+/** Mint a fresh collision-resistant candidate ID. */
+export declare function mintCandidateId(): string;
+/**
+ * Fsync-then-rename atomic write (mirrors `writeFileFsyncedThenRename` in
+ * `src/plan/ledger.ts:169`). fsync guarantees the bytes hit durable storage
+ * before the rename makes the file visible.
+ */
+declare function writeFileFsyncedThenRename(tempPath: string, targetPath: string, data: string): void;
+/** DI seam for test injection (AGENTS.md invariant #7 — preferred over mock.module). */
+export declare const _internals: {
+    withEvidenceLock: typeof withEvidenceLock;
+    writeFileFsyncedThenRename: typeof writeFileFsyncedThenRename;
+    writeFileSync: typeof writeFileSync;
+    readFileSync: typeof readFileSync;
+    renameSync: typeof renameSync;
+    unlinkSync: typeof unlinkSync;
+    existsSync: typeof existsSync;
+    statSync: import("node:fs").StatSyncFn;
+};
+/**
+ * Append a lifecycle event atomically. Computes the hash chain from the
+ * current replayed state, fsync+rename under an evidence lock, then verifies
+ * the append by re-reading. Returns the persisted event.
+ *
+ * Throws if the post-write replay does not contain the appended event at the
+ * expected seq — a partial/corrupt write never counts as a successful
+ * transition.
+ */
+export declare function appendEvent(directory: string, eventInput: Omit<SkillOptEvent, 'seq' | 'timestamp' | 'hashBefore' | 'hashAfter'> & {
+    timestamp?: string;
+}): Promise<SkillOptEvent>;
+/**
+ * Replay a candidate's lifecycle ledger. Mirrors `readLedgerEventsWithIntegrity`
+ * in `src/plan/ledger.ts:1105`: stops at the first unparseable line, marks the
+ * replay `truncated`, and surfaces the bad suffix for quarantine. The canonical
+ * ledger is NEVER rewritten or truncated by this read.
+ */
+export declare function replayCandidate(directory: string, skillSlug: string, candidateId: string): ReplayResult;
+/**
+ * Quarantine a corrupt ledger suffix. Writes the bad suffix to a unique side
+ * file under `.swarm/evolution/skills/`. NEVER rewrites or truncates the
+ * canonical `lifecycle.jsonl`. Mirrors `quarantineLedgerSuffix` in
+ * `src/plan/ledger.ts:1188`.
+ */
+export declare function quarantineSuffix(directory: string, skillSlug: string, badSuffix: string): string;
+/**
+ * Derive the projection `state.json` from the ledger replay. Derived, not
+ * authoritative — callers must always re-derive from the ledger rather than
+ * trust a stale projection. Writes atomically (temp+rename).
+ */
+export declare function writeStateProjection(directory: string, skillSlug: string, candidateId: string, replay: ReplayResult): void;
+/** Snapshot a text file (baseline/candidate/rollback) atomically. */
+export declare function writeArtifact(directory: string, skillSlug: string, candidateId: string, fileName: string, content: string): string;
+/** Read a snapshot artifact, returning null if absent. */
+export declare function readArtifact(directory: string, skillSlug: string, candidateId: string, fileName: string): string | null;
+export declare const SKILL_OPT_STORE_SCHEMA_VERSION = "1";
+export {};

package/dist/state.d.ts

@@ -397,6 +397,22 @@ export interface AgentSessionState {
     prmTrajectoryStep: number;
     /** Whether a hard stop has been triggered */
     prmHardStopPending: boolean;
+    /**
+     * Issue #2063 C2 — second, independent one-shot token for the PRM hard stop.
+     *
+     * `prmHardStopPending` is the DENY token: guardrails `toolBefore` consumes it
+     * by throwing the HARD STOP denial once. `prmHardStopInjectPending` is the
+     * INJECT token: `messagesTransform` consumes it by prepending the
+     * `[HARD STOP]` block into the next completion. They are deliberately
+     * separate because either consumer can run first, and a single shared flag
+     * meant whichever ran first disarmed the other — so the escalation was either
+     * denied without ever being explained, or explained without ever being
+     * denied.
+     *
+     * Optional: ~25 existing test/session literals enumerate the required PRM
+     * fields, and this one is additive.
+     */
+    prmHardStopInjectPending?: boolean;
     /** Per-session escalation tracker instance (set lazily by PRM hook) */
     prmEscalationTracker?: EscalationTracker;
     /** Cross-turn set of already-injected PRM advisory dedupe keys
@@ -406,6 +422,22 @@ export interface AgentSessionState {
      *  pattern's count advances escalation. Bounded by distinct (pattern, level)
      *  pairs — at most (numPatterns × 3 levels). */
     prmInjectedAdvisoryKeys: Set<string>;
+    /**
+     * Issue #2063 B3/B5 — whether an "execution episode" is currently armed for
+     * this session.
+     *
+     * An episode arms when the session actually attempts execution work (a `Task`
+     * dispatch to a mutating/verifying role, or an `update_task_status(...,
+     * in_progress)` that succeeds) and disarms on episode lapse. Consumers read
+     * it through {@link isExecutionEpisodeArmed} in
+     * `src/hooks/guardrails/execution-episode.ts` rather than touching the field,
+     * so the arming policy has exactly one owner.
+     *
+     * Deliberately reset on rehydrate (see `src/session/snapshot-reader.ts`): a
+     * stale `in_progress` task left over from a previous session must NOT arm a
+     * fresh one.
+     */
+    executionEpisodeArmed?: boolean;
     /** Active PR subscriptions for the background poller, keyed by `${repoFullName}::${prNumber}` */
     prSubscriptions: Map<string, PrSubscriptionState>;
     /**

package/dist/telemetry.d.ts

@@ -1,5 +1,31 @@
 import type { DelegationCostFields } from './services/cost-accounting.js';
-export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activated' | 'delegation_begin' | 'delegation_end' | 'task_state_changed' | 'gate_passed' | 'gate_failed' | 'gate_parse_error' | 'reviewer_gate_decision' | 'phase_changed' | 'budget_updated' | 'model_fallback' | 'hard_limit_hit' | 'revision_limit_hit' | 'loop_detected' | 'scope_violation' | 'qa_skip_violation' | 'heartbeat' | 'turbo_mode_changed' | 'auto_oversight_escalation' | 'environment_detected' | 'evidence_lock_acquired' | 'evidence_lock_contended' | 'evidence_lock_stale_recovered' | 'plan_ledger_cas_retry' | 'plan_md_write_failed' | 'snapshot_failed' | 'prm_pattern_detected' | 'prm_course_correction_injected' | 'prm_escalation_triggered' | 'prm_hard_stop';
+export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activated' | 'delegation_begin' | 'delegation_end' | 'task_state_changed' | 'gate_passed' | 'gate_failed' | 'gate_parse_error' | 'reviewer_gate_decision' | 'phase_changed' | 'budget_updated' | 'model_fallback' | 'hard_limit_hit' | 'revision_limit_hit' | 'loop_detected' | 'no_op_strong_warning' | 'scope_violation' | 'qa_skip_violation' | 'heartbeat' | 'turbo_mode_changed' | 'auto_oversight_escalation' | 'environment_detected' | 'evidence_lock_acquired' | 'evidence_lock_contended' | 'evidence_lock_stale_recovered' | 'plan_ledger_cas_retry' | 'plan_md_write_failed' | 'snapshot_failed' | 'gate_denial_loop'
+/**
+ * Issue #2063 B5 — an ARMED execution episode reached the advisory rung:
+ * `execution_stall_warn_calls` tool calls with no delegation completion, no
+ * file write, no `update_task_status`, and no workspace change. Emitted once
+ * per non-progress streak.
+ */
+ | 'execution_stall_warning'
+/**
+ * Issue #2063 B5 — the same episode reached `execution_stall_stop_calls` and
+ * a non-productive tool (read/glob/grep/bash/shell) was hard-denied. Emitted
+ * once per non-progress streak; the denial itself repeats until a progress
+ * event clears the rung.
+ */
+ | 'execution_stall_denied'
+/**
+ * Issue #2063 B4 — a read/glob/grep/bash call resolved to a path inside the
+ * INSTALLED opencode-swarm package and was denied. `target` is relative to
+ * the package root so no user home path is written to the ledger.
+ */
+ | 'swarm_internals_read_denied' | 'prm_pattern_detected' | 'prm_course_correction_injected' | 'prm_escalation_triggered' | 'prm_hard_stop'
+/**
+ * Issue #2063 C2 — DELIVERY of a PRM hard stop, as distinct from the
+ * `prm_hard_stop` TRIGGER emitted by `src/prm/escalation.ts`. A trigger with
+ * no matching delivery means the containment never reached the agent.
+ */
+ | 'prm_hard_stop_delivered';
 /** Stable classification for how a reviewer-gate decision was established. */
 export type ReviewerGateEvidenceKind = 'genuine' | 'fallback' | 'data_quality' | 'block';
 /**
@@ -68,6 +94,37 @@ export declare const telemetry: {
     hardLimitHit(sessionId: string, agentName: string, limitType: string, value: number): void;
     revisionLimitHit(sessionId: string, agentName: string): void;
     loopDetected(sessionId: string, agentName: string, loopType: string): void;
+    /**
+     * Issue #2063 B2 — stage 2 of the no-op ladder fired: the session has made
+     * `count` consecutive tool calls with no file write and no subagent dispatch,
+     * at or beyond 2× `no_op_warning_threshold`.
+     */
+    noOpStrongWarning(sessionId: string, agentName: string, count: number, threshold: number): void;
+    /**
+     * Issue #2063 B1 — a fail-closed `tool.execute.before` denial streak reached
+     * the hard rung: `count` consecutive denials with the same classification
+     * (`code`) for the same tool in the same session. Emitted from
+     * `src/hooks/gate-denial-tracker.ts` at every denial at or past the rung, so
+     * the ledger shows how long the model kept retrying after being told to stop.
+     */
+    gateDenialLoop(sessionId: string, tool: string, code: string, count: number): void;
+    /**
+     * Issue #2063 B5 — advisory rung of the execution-stall ladder. Emitted from
+     * `src/hooks/guardrails/execution-stall.ts` once per non-progress streak, so
+     * a warning with no matching `execution_stall_denied` means the agent
+     * recovered on its own.
+     */
+    executionStallWarning(sessionId: string, count: number, threshold: number): void;
+    /**
+     * Issue #2063 B5 — hard rung of the execution-stall ladder. `tool` is the
+     * normalized name of the denied non-productive tool.
+     */
+    executionStallDenied(sessionId: string, tool: string, count: number, threshold: number): void;
+    /**
+     * Issue #2063 B4 — a call targeting the installed plugin package was denied.
+     * `target` is package-root-relative (never an absolute user path).
+     */
+    swarmInternalsReadDenied(sessionId: string, tool: string, target: string): void;
     scopeViolation(sessionId: string, agentName: string, file: string, reason: string): void;
     qaSkipViolation(sessionId: string, agentName: string, skipCount: number): void;
     heartbeat(sessionId: string): void;
@@ -78,6 +135,14 @@ export declare const telemetry: {
     prmCourseCorrectionInjected(sessionId: string, pattern: string, level: number): void;
     prmEscalationTriggered(sessionId: string, pattern: string, level: number, occurrenceCount: number): void;
     prmHardStop(sessionId: string, pattern: string, level: number, occurrenceCount: number): void;
+    /**
+     * Issue #2063 C2 — the PRM hard-stop DENIAL was actually delivered to the
+     * agent (thrown by the guardrails `toolBefore` consumer). `prm_hard_stop`
+     * above records the TRIGGER and is emitted solely by
+     * `src/prm/escalation.ts`; a trigger without a matching delivery means the
+     * containment armed but never reached the model.
+     */
+    prmHardStopDelivered(sessionId: string, pattern: string, level: number, occurrenceCount: number): void;
 };
 /**
  * Test-only dependency-injection seam. Production code calls

package/dist/tools/write-pr-review-trigger-eval.d.ts

@@ -1,9 +1,10 @@
 import { z } from 'zod';
-import { resolveExactMergeBase, resolvePrWorkflowRevisionDigest } from '../background/workspace-snapshot.js';
+import { resolveExactMergeBase, resolvePrWorkflowRevisionDigest, resolvePrWorkflowRevisionDigestAsync } from '../background/workspace-snapshot.js';
 import { createSwarmTool } from './create-tool';
 export { PR_REVIEW_TRIGGER_DEFINITIONS } from '../background/pr-review-trigger-contract.js';
 export declare const _internals: {
     resolvePrWorkflowRevisionDigest: typeof resolvePrWorkflowRevisionDigest;
+    resolvePrWorkflowRevisionDigestAsync: typeof resolvePrWorkflowRevisionDigestAsync;
     resolveMergeBase: typeof resolveExactMergeBase;
 };
 declare const WritePrReviewTriggerEvalArgsSchema: z.ZodObject<{

package/dist/types/events.d.ts

@@ -142,4 +142,17 @@ export interface PrmHardStopEvent {
     level: number;
     occurrenceCount: number;
 }
-export type V619Event = SoundingBoardConsultedEvent | ArchitectLoopDetectedEvent | PrecedentManipulationDetectedEvent | CoderSelfAuditEvent | CoderRetryCircuitBreakerEvent | AgentConflictDetectedEvent | AuthorityHandoffResolvedEvent | SpecStaleDetectedEvent | SpecDriftAcknowledgedEvent | TaskRemovedEvent | PrmPatternDetectedEvent | PrmCourseCorrectionInjectedEvent | PrmEscalationTriggeredEvent | PrmHardStopEvent;
+/**
+ * Issue #2063 C2 — the hard stop was DELIVERED (denial thrown at the agent),
+ * as opposed to {@link PrmHardStopEvent} which records that it was TRIGGERED.
+ * The pair makes "armed but never reached the model" observable.
+ */
+export interface PrmHardStopDeliveredEvent {
+    type: 'prm_hard_stop_delivered';
+    timestamp: string;
+    sessionId: string;
+    pattern: string;
+    level: number;
+    occurrenceCount: number;
+}
+export type V619Event = SoundingBoardConsultedEvent | ArchitectLoopDetectedEvent | PrecedentManipulationDetectedEvent | CoderSelfAuditEvent | CoderRetryCircuitBreakerEvent | AgentConflictDetectedEvent | AuthorityHandoffResolvedEvent | SpecStaleDetectedEvent | SpecDriftAcknowledgedEvent | TaskRemovedEvent | PrmPatternDetectedEvent | PrmCourseCorrectionInjectedEvent | PrmEscalationTriggeredEvent | PrmHardStopEvent | PrmHardStopDeliveredEvent;

package/dist/utils/stable-stringify.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Stable JSON serialization helpers.
+ *
+ * # Why this exists
+ *
+ * Several subsystems hash tool-call arguments for repetition / spiral
+ * detection. Two requirements make naive `JSON.stringify(value)` incorrect:
+ *
+ * 1. **Key-order independence.** Two semantically identical objects whose
+ *    keys were inserted in different order (`{a:1,b:2}` vs `{b:2,a:1}`) must
+ *    hash equally, otherwise a genuine repetition loop whose args happen to
+ *    be built with reordered keys is missed.
+ *
+ * 2. **No nested-key loss.** A `JSON.stringify(value, sortedKeysArray)`
+ *    property-list replacer looks like it sorts keys — and it does, but only
+ *    for the top level. At every deeper object it acts as a *filter*,
+ *    dropping any key not present in the (top-level-derived) list. For nested
+ *    args like `{todos:[{content,status}]}` every todo collapses to `{}`,
+ *    re-introducing the exact false-collision class this is meant to prevent.
+ *
+ * `stableCanonicalStringify` rebuilds each object with sorted keys at every
+ * depth (no filtering) and serializes arrays element-wise, producing a stable
+ * canonical string suitable for hashing.
+ *
+ * Originally introduced for the adversarial-detector spiral hash
+ * (issue #2060) and shared with `file-authority.hashArgs` so both code paths
+ * use one correct implementation.
+ */
+/**
+ * Recursively produces a canonical JSON string with object keys sorted at
+ * EVERY depth (not just the top level). Arrays are serialized element-wise in
+ * index order.
+ *
+ * Why not `JSON.stringify(value, sortedKeysArray)`: a property-list replacer
+ * array acts as a KEY FILTER at every object depth, not just the top level, so
+ * any key not in the (top-level-derived) list is silently dropped from nested
+ * objects. For tool args like `{todos:[{content,status}]}`, that collapses
+ * every todo to `{}`, re-introducing the exact false-collision class this
+ * function exists to eliminate. Sorting must be done by rebuilding each object
+ * with sorted keys before serialization.
+ *
+ * Throws on cyclic structures (infinite recursion) and on values that
+ * `JSON.stringify` cannot represent (BigInt); callers should wrap in try/catch
+ * and fall back to a stable coarse hash.
+ */
+export declare function stableCanonicalStringify(value: unknown): string;

package/evaluation-fixtures/skill-eval/scoring/score-skill-eval.cjs

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+/*
+ * Skill-eval project scorer wrapper (issue #1822 — D1, critic C1).
+ *
+ * The evaluation substrate invokes `kind:'project'` scorers as isolated
+ * subprocesses (runner.ts:175-228), passing:
+ *   - SWARM_EVAL_TASK_ID, SWARM_EVAL_CANDIDATE_ID, SWARM_EVAL_SEED
+ *   - SWARM_EVAL_ARTIFACT_DIR (contains model-output.json with the candidate's
+ *     generated text under { v: 1, text: "..." })
+ *   - argv: [<this-script>, <phrase-spec-path>]
+ *
+ * The scorer reads the candidate text from model-output.json, reads the phrase
+ * spec (required_phrases / forbidden_phrases), and emits a ScorerOutputV1 line:
+ *   { "v": 1, "score": <0..1>, "cost": { "source": "unavailable" } }
+ *
+ * The scoring arithmetic is the SAME as `scoreSkillPhrases` in
+ * src/services/skill-evaluator.ts (the source of truth). A parity test
+ * (tests/unit/services/skill-evaluator-refactor.test.ts) proves the two agree,
+ * so there is no duplicate scorer — one authoritative function, one thin
+ * subprocess mirror that must match.
+ *
+ * Score = requiredHits / max(1, required.length), minus a 1-point penalty if
+ * any forbidden phrase is present, clamped to >= 0. Phrase matching is
+ * case-insensitive substring.
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+function readArtifact() {
+	const dir = process.env.SWARM_EVAL_ARTIFACT_DIR;
+	if (!dir) throw new Error('missing SWARM_EVAL_ARTIFACT_DIR');
+	const file = path.join(dir, 'model-output.json');
+	const raw = fs.readFileSync(file, 'utf8');
+	const parsed = JSON.parse(raw);
+	if (!parsed || typeof parsed.text !== 'string') {
+		throw new Error('model-output.json missing text field');
+	}
+	return parsed.text;
+}
+
+function readPhraseSpec(specPath) {
+	if (!specPath || !fs.existsSync(specPath)) {
+		return { required: [], forbidden: [] };
+	}
+	const parsed = JSON.parse(fs.readFileSync(specPath, 'utf8'));
+	return {
+		required: Array.isArray(parsed.required_phrases) ? parsed.required_phrases : [],
+		forbidden: Array.isArray(parsed.forbidden_phrases) ? parsed.forbidden_phrases : [],
+	};
+}
+
+function includesPhrase(content, phrase) {
+	return content.toLowerCase().includes(String(phrase).toLowerCase());
+}
+
+function scoreSkillPhrases(content, spec) {
+	const required = spec.required;
+	const forbidden = spec.forbidden;
+	let requiredHits = 0;
+	for (const phrase of required) {
+		if (includesPhrase(content, phrase)) requiredHits++;
+	}
+	const requiredScore = required.length === 0 ? 1 : requiredHits / Math.max(1, required.length);
+	const forbiddenPenalty = forbidden.some((p) => includesPhrase(content, p)) ? 1 : 0;
+	return Math.max(0, requiredScore - forbiddenPenalty);
+}
+
+function main() {
+	const specPath = process.argv[2];
+	const content = readArtifact();
+	const spec = readPhraseSpec(specPath);
+	const score = scoreSkillPhrases(content, spec);
+	process.stdout.write(
+		JSON.stringify({ v: 1, score, cost: { source: 'unavailable' } }) + '\n',
+	);
+}
+
+try {
+	main();
+} catch (err) {
+	// ScorerFailure 'malformed' — the runner treats non-zero exit / bad JSON as a
+	// task failure rather than a candidate score. Emit a zero-score with a
+	// metadata reason so the run records the failure deterministically.
+	process.stderr.write(`score-skill-eval failed: ${err && err.message ? err.message : String(err)}\n`);
+	process.stdout.write(
+		JSON.stringify({
+			v: 1,
+			score: 0,
+			cost: { source: 'unavailable' },
+			metadata: { failure: 'scorer-error', reason: String(err && err.message ? err.message : err).slice(0, 200) },
+		}) + '\n',
+	);
+	process.exitCode = 0;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.136.1",
+	"version": "7.136.3",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -94,6 +94,7 @@
 		"lint:ci": "biome ci .",
 		"test:unit:ci": "bun scripts/ci/run-unit-tests-local.ts",
 		"drift:check": "bun run scripts/drift-check.ts",
+		"check:runtime-src-refs": "bun run scripts/check-runtime-src-refs.ts",
 		"drift:fix": "bun run scripts/drift-check.ts --fix --confirm",
 		"skills:sync": "bun run scripts/sync-qa-gate-skills.ts",
 		"format": "biome format . --write",