opencode-swarm 7.136.3 → 7.136.5

package/dist/memory/index.d.ts

@@ -12,7 +12,7 @@ export { invalidateMemoryStoreDirCache, isMemoryLinked, MEMORY_LINK_POINTER_FILE
 export { buildRecallPromptBlock } from './prompt-block';
 export type { MemoryCompactOptions, MemoryCompactResult, MemoryProposalStore, MemoryProvider, MemoryRecallUsageEvent, MemoryRecallUsageFilter, } from './provider';
 export { buildMemoryRecallPlan, type MemoryRecallPlan, type MemoryRecallPlannerInput, } from './recall-planner';
-export { buildMemoryCohortFingerprintInput, computeMemoryCohortFingerprint, computeRedactionPolicyVersion, findSecrets, redactSecrets, } from './redaction';
+export { buildMemoryCohortFingerprintInput, computeMemoryCohortFingerprint, computeRedactionPolicyVersion, FINGERPRINT_ALGORITHM_VERSION, findSecrets, redactSecrets, } from './redaction';
 export { MEMORY_RECALL_PROFILES, type MemoryRecallProfile, normalizeMemoryAgentRole, resolveMemoryRecallProfile, } from './role-profiles';
 export { appendMemoryRunLog, sanitizeRunId } from './run-log';
 export { computeMemoryContentHash, createBundleId, createMemoryId, createProposalId, isExpired, normalizeMemoryText, validateCuratorMemoryDecision, validateMemoryProposal, validateMemoryRecordRules, } from './schema';

package/dist/memory/local-jsonl-provider.d.ts

@@ -55,7 +55,10 @@ export declare class LocalJsonlMemoryProvider implements MemoryProvider, MemoryP
     /**
      * #1850 (KC-001 fix): mirror the SQLite provider's fingerprint check. Reads
      * `memory-cohort-config.json` and throws on mismatch. Absent/malformed file
-     * is permissive (fail-open never strands memory).
+     * is permissive (fail-open never strands memory). #2062 F-012: a file whose
+     * `algorithm_version` is not the current one — or is present but
+     * uninterpretable — is also permissive, because the digests are not
+     * comparable; both warn with a re-link instruction.
      */
     private assertCohortConfigFingerprint;
     private activeMemory;

package/dist/memory/redaction.d.ts

@@ -20,6 +20,97 @@ export interface MemoryCohortFingerprintInput {
     embedding_dimension: number;
     embedding_version: string;
 }
+/**
+ * #2062 F-012: version of the cohort-fingerprint ALGORITHM (canonicalization +
+ * hash + truncation), persisted alongside the fingerprint in
+ * `memory-cohort-config.json` and read back by every consumer.
+ *
+ * Version 1 is the algorithm below (sorted-key canonical JSON -> sha256 -> first
+ * 12 hex chars). Files written before this field existed are treated as
+ * version 1, which is exactly correct: they were produced by this same
+ * algorithm, so they keep validating with no forced re-link.
+ *
+ * BUMP THIS whenever a change would alter the digest for an unchanged input —
+ * e.g. a different hash, a different truncation length, a change to
+ * `stableCanonicalStringify`'s output for a reachable input, or a change to the
+ * `MemoryCohortFingerprintInput` shape. Readers compare versions BEFORE
+ * comparing fingerprints, so a bump surfaces as "re-run `/swarm memory link`"
+ * instead of being misreported as a real provider/embedding config mismatch.
+ */
+export declare const FINGERPRINT_ALGORITHM_VERSION = 1;
+/**
+ * #2062 F-012 (R3 fix): the algorithm version implied by a persisted cohort
+ * config that has NO `algorithm_version` field. Every file written before the
+ * field existed was produced by algorithm version 1, so that is what an absent
+ * field means — permanently, whatever `FINGERPRINT_ALGORITHM_VERSION` later
+ * becomes.
+ *
+ * This MUST stay a standalone literal and must never be re-expressed in terms
+ * of `FINGERPRINT_ALGORITHM_VERSION`. If it tracked the current version, then
+ * the moment that constant is bumped every legacy file already on disk would
+ * report itself as current, the version gate could never fire for the very
+ * files it exists to protect, and a v1 digest would be byte-compared against a
+ * v2 expected value — which `SQLiteMemoryProvider` turns into a hard
+ * "config differs" throw. Defaulting to the current version is self-defeating
+ * at exactly the moment the mechanism is supposed to help.
+ *
+ * The explicit `: 1` literal type is the enforcement, not decoration — and it
+ * enforces only for as long as it is actually there. No runtime test can catch
+ * the aliasing refactor today (while `FINGERPRINT_ALGORITHM_VERSION` is still
+ * 1, an alias evaluates to 1 and every assertion passes), so the guard has to
+ * fire at the only moment the mistake becomes real: the bump.
+ *
+ * Both halves of that were measured against this repo with the constant
+ * temporarily set to 2, running `bunx tsc --noEmit`:
+ *
+ * - `LEGACY_…: 1 = FINGERPRINT_ALGORITHM_VERSION` (annotation KEPT)
+ *   -> exit 2, `TS2322: Type '2' is not assignable to type '1'`. Guard fires.
+ * - `LEGACY_… = FINGERPRINT_ALGORITHM_VERSION` (annotation DROPPED)
+ *   -> exit 0. Guard does NOT fire, and every legacy cohort file is stranded
+ *   silently.
+ *
+ * The second form is the one a refactorer actually types, so do NOT rely on
+ * `tsc` to catch removal of this annotation — the annotation is the thing
+ * being protected, not merely the mechanism. A legitimate bump that leaves
+ * this literal alone typechecks cleanly.
+ */
+export declare const LEGACY_FINGERPRINT_ALGORITHM_VERSION: 1;
+/**
+ * DI seam for testability (repo convention, cf. `src/utils/logger.ts`). Lets a
+ * test simulate a FUTURE bump of `FINGERPRINT_ALGORITHM_VERSION` without
+ * hand-editing the constant — the only way to exercise the legacy-file version
+ * gate before a real bump ever happens. Production code never mutates this.
+ */
+export declare const _internals: {
+    currentAlgorithmVersion: number;
+};
+/**
+ * Result of interpreting a persisted `algorithm_version` field:
+ * - `comparable` — stored digest was produced by the current algorithm, so a
+ *   byte comparison is meaningful.
+ * - `mismatch` — a known but different algorithm produced it; the digests are
+ *   not comparable, so callers skip the compare and fail OPEN with a re-link
+ *   instruction rather than reporting a config difference that does not exist.
+ * - `unknown` — the field is present but not a finite number, so the digest
+ *   cannot be attributed to any algorithm. Callers skip the compare too, but
+ *   must NOT assume it is current (that would byte-compare on a guess).
+ */
+export type StoredFingerprintAlgorithmVersion = {
+    status: 'comparable';
+} | {
+    status: 'mismatch';
+    storedVersion: number;
+    currentVersion: number;
+} | {
+    status: 'unknown';
+};
+/**
+ * Single source of truth for the version gate shared by all four readers
+ * (SQLite provider, local-jsonl provider, status service, knowledge
+ * diagnostics). Keeping it here means a future bump changes one file, and the
+ * absent-field semantics cannot silently drift apart across call sites.
+ */
+export declare function classifyStoredFingerprintAlgorithmVersion(rawStoredVersion: unknown, currentVersion?: number): StoredFingerprintAlgorithmVersion;
 export declare function computeMemoryCohortFingerprint(input: MemoryCohortFingerprintInput): string;
 /** Convenience: build the fingerprint input from a memory config subset. */
 export declare function buildMemoryCohortFingerprintInput(config: {

package/dist/memory/sqlite-provider.d.ts

@@ -148,7 +148,11 @@ export declare class SQLiteMemoryProvider implements MemoryProvider, MemoryPropo
      * with this worktree's config (acceptance #10). Absent file = first link
      * (permissive — the linker writes it immediately after migration). A
      * malformed file is also permissive (fail-open never strands memory, but
-     * a mismatch is a hard error).
+     * a mismatch is a hard error). #2062 F-012: a file whose `algorithm_version`
+     * is not the current one — or is present but uninterpretable — is permissive
+     * too, because cross-algorithm digests are not comparable. Both warn with a
+     * re-link instruction rather than reporting a config mismatch that does not
+     * exist.
      */
     private assertCohortConfigFingerprint;
     private writeMemoryFts;

package/dist/utils/arg-hash.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Shared primitives for hashing tool-call arguments (issue #2060 follow-ups
+ * F-009 / F-010).
+ *
+ * # Why this exists
+ *
+ * Two subsystems hash tool arguments to detect "the agent is repeating
+ * itself": `hashArgsForSpiral` in `hooks/adversarial-detector.ts` (spiral
+ * advisory) and `hashArgs` in `hooks/guardrails/file-authority.ts` (which
+ * feeds the consecutive-repetition circuit breaker in
+ * `hooks/guardrails/tool-before.ts` — a path that THROWS, not warns).
+ *
+ * Both need the same two primitives. They live here rather than as two inline
+ * copies for the same reason `src/utils/stable-stringify.ts` was extracted: a
+ * bug class that exists at two call sites must be fixed once, in one place,
+ * and tested once. Keep them here; do not re-inline a copy at a call site.
+ *
+ * The two call sites differ only in the OUTPUT SHAPE they need — the detector
+ * wants a compact base-36 string, file-authority wants a `number` — so
+ * `boundedBunHash` returns `bigint` (matching `bunHash`) and each caller
+ * formats it.
+ */
+/**
+ * Cap on the amount of input fed into `bunHash`.
+ *
+ * Both call sites run synchronously on a per-tool-call hot path, and payloads
+ * (patch bodies, file writes) can reach ~1 MB. Node's `bunHash` fallback
+ * (djb2, see `bun-compat.ts`) is genuinely reachable in production — the
+ * OpenCode plugin host and the Desktop sidecar can run under Node — and is
+ * O(n): ~141 ms for a 2 MB input versus ~5 ms for 64 KB. The threat model is
+ * "same tool, same args, repeatedly", not adversarial collision resistance,
+ * so bounding the hashed input keeps worst-case per-call cost flat.
+ *
+ * NOTE ON UNITS: this bounds `String.prototype.length`, i.e. UTF-16 code
+ * units, not encoded bytes. It is a cost bound, not a byte-exact limit; a
+ * non-BMP-heavy string can encode to more bytes than the name suggests. That
+ * is fine — the point is a fixed ceiling, and the ceiling is fixed.
+ */
+export declare const HASH_INPUT_CAP_BYTES: number;
+/**
+ * Reduces an arbitrarily long string to a bounded, length-prefixed
+ * head-and-tail sample suitable as hash input.
+ *
+ * ## Why not a bare prefix
+ *
+ * The obvious bound — `input.slice(0, CAP)` — makes every pair of inputs that
+ * share a `CAP`-length prefix hash identically. For the circuit-breaker call
+ * site that is a false-positive engine: ten consecutive large writes that
+ * share a boilerplate header but differ in their (appended) bodies look like
+ * ten identical calls and the breaker throws. Sampling the head AND the tail
+ * removes the whole append-collision class, and sampling the head removes the
+ * prepend-collision class, at exactly the same bounded cost.
+ *
+ * ## Why the length prefix is load-bearing
+ *
+ * It is not decoration. Without it the two branches below can collide across
+ * the cap boundary: an input of exactly `CAP` characters passes through
+ * untransformed, while a longer input produces a `CAP`-character head+tail
+ * concatenation — two different inputs, one identical hash input. Prefixing
+ * the true length separates the classes. It also makes the under-cap branch
+ * injective, so this transform adds ZERO collisions for inputs at or below
+ * the cap.
+ *
+ * ## Residual, accepted lossiness
+ *
+ * Two inputs longer than the cap collide only if they have the SAME total
+ * length AND the same first `CAP/2` characters AND the same last `CAP/2`
+ * characters, differing only in the discarded middle. That is unavoidable for
+ * any fixed-cost sampler and is the deliberate trade documented on
+ * `HASH_INPUT_CAP_BYTES`.
+ *
+ * Cannot throw: `String.prototype.slice` and template interpolation of a
+ * number are total.
+ */
+export declare function sampleForHash(input: string): string;
+/**
+ * `bunHash` over a bounded head+tail sample of `input`.
+ *
+ * Returns `bigint` (the `bunHash` shape) so each caller can format it for its
+ * own storage: the detector uses `.toString(36)`, file-authority uses
+ * `Number(...)`.
+ *
+ * Cannot throw for a string input: `sampleForHash` is total and `bunHash`
+ * on a string is `TextEncoder.encode` plus BigInt arithmetic (or `Bun.hash`)
+ * — no throwing path. Callers rely on this: both use it inside a `catch`
+ * block, where a second throw would escape into a hook.
+ */
+export declare function boundedBunHash(input: string): bigint;
+/**
+ * Shallow, non-recursive structural summary of a value's own enumerable keys,
+ * used only as a fallback discriminator when `stableCanonicalStringify`
+ * throws (issue #2060 follow-up F-009).
+ *
+ * Before this existed, both call sites answered an unstringifiable argument
+ * with a CONSTANT ('h:fallback' / `0`). That made every distinct-but-
+ * unserializable argument collide, so N consecutive calls with genuinely
+ * different arguments looked identical and fired a false positive — a spiral
+ * advisory in one case, a thrown circuit breaker in the other.
+ *
+ * Deliberately shallow (no recursion into nested values) so it cannot itself
+ * throw on the very inputs that broke `stableCanonicalStringify`: recursing
+ * into a cyclic reference would revisit the cycle, and BigInt values are
+ * handled fine by `typeof` / `String()` (unlike `JSON.stringify`, which
+ * throws on them). `Object.keys` and `typeof` cannot throw for ordinary
+ * objects; the outer try/catch guards only against exotic Proxy traps, and
+ * even then identical arguments still collide, so true-positive repetition
+ * detection is preserved.
+ *
+ * This is a DISCRIMINATOR, not an identity function. It is only ever used to
+ * break up false collisions on a detection path — never as a fail-closed
+ * identity (see the caller guidance on `stableCanonicalStringify`).
+ */
+export declare function coarseObjectDiscriminator(args: unknown): string;

package/dist/utils/stable-stringify.d.ts

@@ -25,6 +25,11 @@
  * Originally introduced for the adversarial-detector spiral hash
  * (issue #2060) and shared with `file-authority.hashArgs` so both code paths
  * use one correct implementation.
+ *
+ * This is a canonicalizer for HASH INPUT, not a drop-in `JSON.stringify`
+ * replacement — see the "Serialization limits" section on
+ * `stableCanonicalStringify` before using it anywhere the output is parsed or
+ * shown to a user.
  */
 /**
  * Recursively produces a canonical JSON string with object keys sorted at
@@ -39,8 +44,48 @@
  * function exists to eliminate. Sorting must be done by rebuilding each object
  * with sorted keys before serialization.
  *
+ * ## Serialization limits (#2062 F-008 — deliberate, verified, do not "fix"
+ * without re-reading this)
+ *
+ * - **No `toJSON` support.** `toJSON` is never consulted. A `Date` therefore
+ *   collapses to `{}` (it has no own enumerable keys) — a genuine divergence
+ *   from `JSON.stringify`, which emits the ISO string.
+ * - **`Map`/`Set` collapse to `{}`.** This MATCHES `JSON.stringify` (neither
+ *   exposes own enumerable string keys), so it is lossy for both rather than a
+ *   divergence between them.
+ * - **`undefined` serializes as `null`** in object-property AND array-element
+ *   position, so no bare `undefined` token or sparse-array hole is emitted for
+ *   it. `JSON.stringify` instead omits an `undefined`-valued property; keeping
+ *   the key here is deliberate — two objects differing only by a
+ *   present-but-undefined key must not hash equal. True sparse array *holes*
+ *   (`[1,,3]`) are NOT covered: `Array.prototype.map` skips holes, so they
+ *   still render as `[1,,3]`.
+ * - **Function and symbol values still emit a bare `undefined` token**, which
+ *   is not valid JSON. It is deterministic, so it is safe as hash input, but
+ *   the result is not always `JSON.parse`-able.
+ *
+ * These limits are safe at every current call site: the cohort fingerprint
+ * input is a flat all-primitive struct, and the hook call sites hash tool-call
+ * arguments that have already round-tripped through JSON transport, so
+ * `Date`/`Map`/`Set`/function values cannot reach them.
+ *
+ * ## Throwing, and how callers must (and must not) handle it
+ *
  * Throws on cyclic structures (infinite recursion) and on values that
- * `JSON.stringify` cannot represent (BigInt); callers should wrap in try/catch
- * and fall back to a stable coarse hash.
+ * `JSON.stringify` cannot represent (BigInt). Correct caller handling depends
+ * on what the hash is FOR:
+ *
+ * - **Repetition / spiral-detection callers** (`hashArgsForSpiral` in
+ *   `hooks/adversarial-detector.ts`, `hashArgs` in
+ *   `hooks/guardrails/file-authority.ts`) SHOULD wrap in try/catch and fall
+ *   back to a stable coarse hash. There, a fallback only degrades detection
+ *   sensitivity for the one call that failed.
+ * - **Identity / fail-closed comparison callers** (e.g.
+ *   `computeMemoryCohortFingerprint` in `memory/redaction.ts`) MUST NOT do
+ *   that. A constant fallback would collapse every failing input to the same
+ *   fingerprint, so two genuinely incompatible cohort members would compare
+ *   equal and the fail-closed coherence check would be silently defeated. Let
+ *   the throw propagate, or rethrow with added context — never return a
+ *   constant.
  */
 export declare function stableCanonicalStringify(value: unknown): string;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.136.3",
+	"version": "7.136.5",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",