opencode-swarm 7.136.2 → 7.136.3

package/dist/memory/schema.d.ts

@@ -46,9 +46,9 @@ export declare const MemorySourceSchema: z.ZodObject<{
     type: z.ZodEnum<{
         file: "file";
         agent: "agent";
+        tool: "tool";
         manual: "manual";
         test: "test";
-        tool: "tool";
         commit: "commit";
         user: "user";
         repo: "repo";
@@ -107,9 +107,9 @@ export declare const MemoryRecordSchema: z.ZodObject<{
         type: z.ZodEnum<{
             file: "file";
             agent: "agent";
+            tool: "tool";
             manual: "manual";
             test: "test";
-            tool: "tool";
             commit: "commit";
             user: "user";
             repo: "repo";
@@ -195,9 +195,9 @@ export declare const MemoryProposalSchema: z.ZodObject<{
             type: z.ZodEnum<{
                 file: "file";
                 agent: "agent";
+                tool: "tool";
                 manual: "manual";
                 test: "test";
-                tool: "tool";
                 commit: "commit";
                 user: "user";
                 repo: "repo";

package/dist/prm/index.d.ts

@@ -74,6 +74,8 @@ interface ResettablePrmSessionState {
     prmEscalationLevel?: number;
     prmLastPatternDetected?: unknown;
     prmHardStopPending?: boolean;
+    /** Issue #2063 C2 — twin one-shot token; reset with its deny counterpart. */
+    prmHardStopInjectPending?: boolean;
     prmTrajectoryStep?: number;
     prmInjectedAdvisoryKeys?: Set<string>;
     replayArtifactPath?: string | null;

package/dist/state.d.ts

@@ -397,6 +397,22 @@ export interface AgentSessionState {
     prmTrajectoryStep: number;
     /** Whether a hard stop has been triggered */
     prmHardStopPending: boolean;
+    /**
+     * Issue #2063 C2 — second, independent one-shot token for the PRM hard stop.
+     *
+     * `prmHardStopPending` is the DENY token: guardrails `toolBefore` consumes it
+     * by throwing the HARD STOP denial once. `prmHardStopInjectPending` is the
+     * INJECT token: `messagesTransform` consumes it by prepending the
+     * `[HARD STOP]` block into the next completion. They are deliberately
+     * separate because either consumer can run first, and a single shared flag
+     * meant whichever ran first disarmed the other — so the escalation was either
+     * denied without ever being explained, or explained without ever being
+     * denied.
+     *
+     * Optional: ~25 existing test/session literals enumerate the required PRM
+     * fields, and this one is additive.
+     */
+    prmHardStopInjectPending?: boolean;
     /** Per-session escalation tracker instance (set lazily by PRM hook) */
     prmEscalationTracker?: EscalationTracker;
     /** Cross-turn set of already-injected PRM advisory dedupe keys
@@ -406,6 +422,22 @@ export interface AgentSessionState {
      *  pattern's count advances escalation. Bounded by distinct (pattern, level)
      *  pairs — at most (numPatterns × 3 levels). */
     prmInjectedAdvisoryKeys: Set<string>;
+    /**
+     * Issue #2063 B3/B5 — whether an "execution episode" is currently armed for
+     * this session.
+     *
+     * An episode arms when the session actually attempts execution work (a `Task`
+     * dispatch to a mutating/verifying role, or an `update_task_status(...,
+     * in_progress)` that succeeds) and disarms on episode lapse. Consumers read
+     * it through {@link isExecutionEpisodeArmed} in
+     * `src/hooks/guardrails/execution-episode.ts` rather than touching the field,
+     * so the arming policy has exactly one owner.
+     *
+     * Deliberately reset on rehydrate (see `src/session/snapshot-reader.ts`): a
+     * stale `in_progress` task left over from a previous session must NOT arm a
+     * fresh one.
+     */
+    executionEpisodeArmed?: boolean;
     /** Active PR subscriptions for the background poller, keyed by `${repoFullName}::${prNumber}` */
     prSubscriptions: Map<string, PrSubscriptionState>;
     /**

package/dist/telemetry.d.ts

@@ -1,5 +1,31 @@
 import type { DelegationCostFields } from './services/cost-accounting.js';
-export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activated' | 'delegation_begin' | 'delegation_end' | 'task_state_changed' | 'gate_passed' | 'gate_failed' | 'gate_parse_error' | 'reviewer_gate_decision' | 'phase_changed' | 'budget_updated' | 'model_fallback' | 'hard_limit_hit' | 'revision_limit_hit' | 'loop_detected' | 'scope_violation' | 'qa_skip_violation' | 'heartbeat' | 'turbo_mode_changed' | 'auto_oversight_escalation' | 'environment_detected' | 'evidence_lock_acquired' | 'evidence_lock_contended' | 'evidence_lock_stale_recovered' | 'plan_ledger_cas_retry' | 'plan_md_write_failed' | 'snapshot_failed' | 'prm_pattern_detected' | 'prm_course_correction_injected' | 'prm_escalation_triggered' | 'prm_hard_stop';
+export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activated' | 'delegation_begin' | 'delegation_end' | 'task_state_changed' | 'gate_passed' | 'gate_failed' | 'gate_parse_error' | 'reviewer_gate_decision' | 'phase_changed' | 'budget_updated' | 'model_fallback' | 'hard_limit_hit' | 'revision_limit_hit' | 'loop_detected' | 'no_op_strong_warning' | 'scope_violation' | 'qa_skip_violation' | 'heartbeat' | 'turbo_mode_changed' | 'auto_oversight_escalation' | 'environment_detected' | 'evidence_lock_acquired' | 'evidence_lock_contended' | 'evidence_lock_stale_recovered' | 'plan_ledger_cas_retry' | 'plan_md_write_failed' | 'snapshot_failed' | 'gate_denial_loop'
+/**
+ * Issue #2063 B5 — an ARMED execution episode reached the advisory rung:
+ * `execution_stall_warn_calls` tool calls with no delegation completion, no
+ * file write, no `update_task_status`, and no workspace change. Emitted once
+ * per non-progress streak.
+ */
+ | 'execution_stall_warning'
+/**
+ * Issue #2063 B5 — the same episode reached `execution_stall_stop_calls` and
+ * a non-productive tool (read/glob/grep/bash/shell) was hard-denied. Emitted
+ * once per non-progress streak; the denial itself repeats until a progress
+ * event clears the rung.
+ */
+ | 'execution_stall_denied'
+/**
+ * Issue #2063 B4 — a read/glob/grep/bash call resolved to a path inside the
+ * INSTALLED opencode-swarm package and was denied. `target` is relative to
+ * the package root so no user home path is written to the ledger.
+ */
+ | 'swarm_internals_read_denied' | 'prm_pattern_detected' | 'prm_course_correction_injected' | 'prm_escalation_triggered' | 'prm_hard_stop'
+/**
+ * Issue #2063 C2 — DELIVERY of a PRM hard stop, as distinct from the
+ * `prm_hard_stop` TRIGGER emitted by `src/prm/escalation.ts`. A trigger with
+ * no matching delivery means the containment never reached the agent.
+ */
+ | 'prm_hard_stop_delivered';
 /** Stable classification for how a reviewer-gate decision was established. */
 export type ReviewerGateEvidenceKind = 'genuine' | 'fallback' | 'data_quality' | 'block';
 /**
@@ -68,6 +94,37 @@ export declare const telemetry: {
     hardLimitHit(sessionId: string, agentName: string, limitType: string, value: number): void;
     revisionLimitHit(sessionId: string, agentName: string): void;
     loopDetected(sessionId: string, agentName: string, loopType: string): void;
+    /**
+     * Issue #2063 B2 — stage 2 of the no-op ladder fired: the session has made
+     * `count` consecutive tool calls with no file write and no subagent dispatch,
+     * at or beyond 2× `no_op_warning_threshold`.
+     */
+    noOpStrongWarning(sessionId: string, agentName: string, count: number, threshold: number): void;
+    /**
+     * Issue #2063 B1 — a fail-closed `tool.execute.before` denial streak reached
+     * the hard rung: `count` consecutive denials with the same classification
+     * (`code`) for the same tool in the same session. Emitted from
+     * `src/hooks/gate-denial-tracker.ts` at every denial at or past the rung, so
+     * the ledger shows how long the model kept retrying after being told to stop.
+     */
+    gateDenialLoop(sessionId: string, tool: string, code: string, count: number): void;
+    /**
+     * Issue #2063 B5 — advisory rung of the execution-stall ladder. Emitted from
+     * `src/hooks/guardrails/execution-stall.ts` once per non-progress streak, so
+     * a warning with no matching `execution_stall_denied` means the agent
+     * recovered on its own.
+     */
+    executionStallWarning(sessionId: string, count: number, threshold: number): void;
+    /**
+     * Issue #2063 B5 — hard rung of the execution-stall ladder. `tool` is the
+     * normalized name of the denied non-productive tool.
+     */
+    executionStallDenied(sessionId: string, tool: string, count: number, threshold: number): void;
+    /**
+     * Issue #2063 B4 — a call targeting the installed plugin package was denied.
+     * `target` is package-root-relative (never an absolute user path).
+     */
+    swarmInternalsReadDenied(sessionId: string, tool: string, target: string): void;
     scopeViolation(sessionId: string, agentName: string, file: string, reason: string): void;
     qaSkipViolation(sessionId: string, agentName: string, skipCount: number): void;
     heartbeat(sessionId: string): void;
@@ -78,6 +135,14 @@ export declare const telemetry: {
     prmCourseCorrectionInjected(sessionId: string, pattern: string, level: number): void;
     prmEscalationTriggered(sessionId: string, pattern: string, level: number, occurrenceCount: number): void;
     prmHardStop(sessionId: string, pattern: string, level: number, occurrenceCount: number): void;
+    /**
+     * Issue #2063 C2 — the PRM hard-stop DENIAL was actually delivered to the
+     * agent (thrown by the guardrails `toolBefore` consumer). `prm_hard_stop`
+     * above records the TRIGGER and is emitted solely by
+     * `src/prm/escalation.ts`; a trigger without a matching delivery means the
+     * containment armed but never reached the model.
+     */
+    prmHardStopDelivered(sessionId: string, pattern: string, level: number, occurrenceCount: number): void;
 };
 /**
  * Test-only dependency-injection seam. Production code calls

package/dist/types/events.d.ts

@@ -142,4 +142,17 @@ export interface PrmHardStopEvent {
     level: number;
     occurrenceCount: number;
 }
-export type V619Event = SoundingBoardConsultedEvent | ArchitectLoopDetectedEvent | PrecedentManipulationDetectedEvent | CoderSelfAuditEvent | CoderRetryCircuitBreakerEvent | AgentConflictDetectedEvent | AuthorityHandoffResolvedEvent | SpecStaleDetectedEvent | SpecDriftAcknowledgedEvent | TaskRemovedEvent | PrmPatternDetectedEvent | PrmCourseCorrectionInjectedEvent | PrmEscalationTriggeredEvent | PrmHardStopEvent;
+/**
+ * Issue #2063 C2 — the hard stop was DELIVERED (denial thrown at the agent),
+ * as opposed to {@link PrmHardStopEvent} which records that it was TRIGGERED.
+ * The pair makes "armed but never reached the model" observable.
+ */
+export interface PrmHardStopDeliveredEvent {
+    type: 'prm_hard_stop_delivered';
+    timestamp: string;
+    sessionId: string;
+    pattern: string;
+    level: number;
+    occurrenceCount: number;
+}
+export type V619Event = SoundingBoardConsultedEvent | ArchitectLoopDetectedEvent | PrecedentManipulationDetectedEvent | CoderSelfAuditEvent | CoderRetryCircuitBreakerEvent | AgentConflictDetectedEvent | AuthorityHandoffResolvedEvent | SpecStaleDetectedEvent | SpecDriftAcknowledgedEvent | TaskRemovedEvent | PrmPatternDetectedEvent | PrmCourseCorrectionInjectedEvent | PrmEscalationTriggeredEvent | PrmHardStopEvent | PrmHardStopDeliveredEvent;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.136.2",
+	"version": "7.136.3",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -94,6 +94,7 @@
 		"lint:ci": "biome ci .",
 		"test:unit:ci": "bun scripts/ci/run-unit-tests-local.ts",
 		"drift:check": "bun run scripts/drift-check.ts",
+		"check:runtime-src-refs": "bun run scripts/check-runtime-src-refs.ts",
 		"drift:fix": "bun run scripts/drift-check.ts --fix --confirm",
 		"skills:sync": "bun run scripts/sync-qa-gate-skills.ts",
 		"format": "biome format . --write",