opencode-swarm 7.137.2 → 7.137.4

package/dist/commands/archive-sqlite.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Transactionally-consistent SQLite snapshot for `/swarm close` archival.
+ *
+ * Why this exists (issue #2030): the legacy `copySqliteSafe` in `close.ts`
+ * copied ONLY the main `swarm.db` file, either via an external `sqlite3` CLI
+ * (forbidden external dependency — AGENTS.md invariant 2/3) or, when that CLI
+ * was absent (common on Windows), via a raw `fs.copyFile` of the main file with
+ * NO checkpoint at all. For a WAL-mode database (`PRAGMA journal_mode = WAL`,
+ * set in `src/db/project-db.ts`), committed rows live in `swarm.db-wal` while
+ * the main file is a stale shell — so the archived copy silently lost every
+ * committed row.
+ *
+ * The fix is an in-process `VACUUM INTO` snapshot taken from a dedicated
+ * connection created through the shared, runtime-portable loader
+ * (`src/db/sqlite-loader.ts`). Verified under both Bun — native bun:sqlite —
+ * and Node — the loader's node:sqlite `DatabaseSync` adapter — by the issue #2030
+ * spike (`.zcode/issue-traces/2030/spike-vacuum-into.mjs`): the destination is
+ * a single self-contained file (journal_mode=delete, no WAL sidecars) that
+ * contains ALL committed rows and EXCLUDES a concurrent uncommitted writer's
+ * row, with `PRAGMA integrity_check = ok`.
+ *
+ * Contract: the source `main`/`wal`/`shm` are preserved on EVERY failure path.
+ * This function never deletes the source. `source_disposition` is `retained`
+ * (or `absent` when the source does not exist); the `'removed'` disposition is
+ * reserved for the clean stage's archive-first guard, which is the only place
+ * authorized to delete an archived source.
+ */
+import type { Database } from 'bun:sqlite';
+import * as fsSync from 'node:fs';
+export type ArchiveSqliteMethod = 'vacuum_into';
+export type ArchiveSqliteReasonCode = 'ok' | 'source_absent' | 'source_over_budget' | 'snapshot_failed' | 'validation_failed' | 'schema_mismatch' | 'publish_failed';
+/**
+ * Domain row counts captured during validation. Counts ONLY — no row content
+ * is ever read into memory or logged, per issue #2030 item 4 ("without logging
+ * row content"). A missing domain table (legacy schema) reports count 0 rather
+ * than failing validation, because integrity + schema_migrations presence is the
+ * real health signal.
+ */
+export interface SqliteRowCounts {
+    schema_migrations_max_version: number | null;
+    project_constraints: number;
+    qa_gate_profile: number;
+}
+export interface ArchiveSqliteOptions {
+    /** Absolute path to the live source DB, e.g. `.swarm/swarm.db`. */
+    sourcePath: string;
+    /** Absolute path to the archive bundle directory (must exist). */
+    destDir: string;
+    /** Filename to publish in the bundle, e.g. `swarm.db`. */
+    destName: string;
+    /**
+     * Hard byte-budget preflight: sum of source `main` + `wal` + `shm` sizes.
+     * If exceeded, the snapshot is not attempted (no expensive work). The
+     * default 2 GiB ceiling is generous for project DBs while still catching
+     * the pathological "archived the wrong 66 GB host DB" failure mode.
+     */
+    maxSourceBytes?: number;
+    /** `PRAGMA busy_timeout` on the snapshot connection. Default 5000 ms. */
+    busyTimeoutMs?: number;
+}
+export interface ArchiveSqliteResult {
+    requiredness: 'required';
+    attempt: 'not_attempted' | 'succeeded' | 'failed';
+    validation: 'not_applicable' | 'passed' | 'failed';
+    source_disposition: 'absent' | 'retained';
+    method: ArchiveSqliteMethod | 'none';
+    reason_code: ArchiveSqliteReasonCode;
+    /** Absolute, only on success. */
+    destPath?: string;
+    /** Counts only, present when validation runs. */
+    rowCounts?: SqliteRowCounts;
+    /** Non-sensitive diagnostic (errno / short message). No row content. */
+    detail?: string;
+}
+/**
+ * Test-only dependency-injection seam. `loadDatabaseCtor` is imported directly
+ * (it is a stable public API) and is NOT part of this seam. The fields here are
+ * only those tests genuinely substitute: `DatabaseCtor` lets a failure-injection
+ * test swap the constructor without touching the real loader; the fs/time
+ * helpers let deterministic tests control temp-path generation and filesystem
+ * behavior. Mutate this object in `beforeEach` and restore in `afterEach`
+ * (AGENTS.md invariant 7 — prefer `_internals` DI over `mock.module`).
+ */
+export declare const _internals: {
+    existsSync: typeof fsSync.existsSync;
+    statSync: typeof fsSync.statSync;
+    renameSync: typeof fsSync.renameSync;
+    rmSync: typeof fsSync.rmSync;
+    now: () => number;
+    randomSuffix: () => string;
+    /**
+     * When non-null, overrides `loadDatabaseCtor()` for failure injection
+     * (e.g. a fake ctor whose `VACUUM INTO` throws). Leave null in production
+     * and in tests that exercise the real driver.
+     */
+    DatabaseCtor: typeof Database | null;
+};
+/**
+ * Produce a transactionally-consistent single-file snapshot of the source WAL
+ * database via in-process `VACUUM INTO`, validate it read-only through the
+ * shared loader, then atomically publish it into the archive bundle.
+ *
+ * Non-destructive: on every error path the source `main`/`wal`/`shm` are left
+ * untouched and `source_disposition` is `retained` (or `absent`).
+ */
+export declare function archiveSqliteSnapshot(opts: ArchiveSqliteOptions): Promise<ArchiveSqliteResult>;

package/dist/commands/close.d.ts

@@ -1,4 +1,3 @@
-import * as child_process from 'node:child_process';
 import { loadPluginConfigWithMeta } from '../config';
 import { type KnowledgeConfig, type PluginConfig } from '../config/schema';
 import { archiveEvidence } from '../evidence/manager';
@@ -11,6 +10,7 @@ import { runFinalizeRewardSweep } from '../memory/finalize-reward-sweep';
 import { closePlanTerminalState } from '../plan/manager';
 import { type SessionReflectionResult } from '../services/session-reflection';
 import { endAgentSession, resetSwarmStatePreservingSingletons } from '../state';
+import { type SqliteRowCounts } from './archive-sqlite';
 interface PlanPhase {
     id: number;
     name: string;
@@ -38,6 +38,23 @@ interface CurationCounts {
 interface CloseKnowledgeEntry {
     created_at?: string;
 }
+export type ArchiveRequiredness = 'required' | 'optional';
+export type ArchiveAttempt = 'not_attempted' | 'succeeded' | 'failed';
+export type ArchiveValidation = 'not_applicable' | 'passed' | 'failed';
+export type ArchiveSourceDisposition = 'absent' | 'retained' | 'removed';
+export interface ArtifactArchiveResult {
+    artifact: string;
+    requiredness: ArchiveRequiredness;
+    attempt: ArchiveAttempt;
+    validation: ArchiveValidation;
+    source_disposition: ArchiveSourceDisposition;
+    method: string;
+    reason_code: string;
+    /** Counts only (no row content), present for validated sqlite snapshots. */
+    row_counts?: SqliteRowCounts;
+    /** Non-sensitive diagnostic. */
+    detail?: string;
+}
 export interface ArchiveStageContext {
     directory: string;
     swarmDir: string;
@@ -83,6 +100,10 @@ export interface CloseStageContext {
     archivedActiveStateFiles: Set<string>;
     archivedActiveStateDirs: Set<string>;
     archiveFailureReasons: Map<string, string>;
+    /** Structured per-artifact results — single source of truth (issue #2030). */
+    archiveResults: ArtifactArchiveResult[];
+    /** True when the archive STAGE threw wholesale (e.g. mkdir EACCES/ENOSPC). */
+    archiveStageFailed: boolean;
     timestamp: string;
     archiveDir: string;
     archiveSuffix: string;
@@ -114,6 +135,16 @@ export interface CleanStageResult {
     swarmPlanFilesRemoved: number;
     tmpFilesRemoved: number;
 }
+/**
+ * Emit the single `close_archive_result` telemetry event whose payload is the
+ * SAME `ctx.archiveResults` array the user-facing prose derives from, so the
+ * two cannot disagree (issue #2030 item 6). Called AFTER `runCleanStage` so
+ * `source_disposition` can be finalized truthfully: artifacts that were
+ * successfully archived AND then unlinked by the clean stage report `'removed'`;
+ * artifacts preserved (absent, or failed/retained) keep their archive-time
+ * disposition. Counts only — no row content (issue items 4/9).
+ */
+export declare function emitCloseArchiveResult(ctx: CloseStageContext, cleanResult: CleanStageResult): void;
 /**
  * STAGE 1: FINALIZE
  *
@@ -215,15 +246,6 @@ export declare const _internals: {
     archiveEvidence: typeof archiveEvidence;
     closePlanTerminalState: typeof closePlanTerminalState;
     endAgentSession: typeof endAgentSession;
-    spawnSync: (cmd: string, args: string[], options?: {
-        cwd?: string;
-        encoding?: BufferEncoding;
-        timeout?: number;
-        maxBuffer?: number;
-        windowsHide?: boolean;
-        stdio?: "pipe" | "ignore" | "inherit" | Array<"pipe" | "ignore" | "inherit">;
-        env?: Record<string, string | undefined>;
-        envOverrides?: Record<string, string | null>;
-    }) => child_process.SpawnSyncReturns<string | NonSharedBuffer>;
+    flushAndDrainTelemetry: () => Promise<void>;
 };
 export {};

package/dist/context/role-filter.d.ts

@@ -10,6 +10,10 @@ export interface ContextEntry {
     content: string;
     name?: string;
 }
+export interface FilterByRoleOptions {
+    /** Allow valid leading [FOR: ...] tags to route otherwise-protected system entries. */
+    filterTaggedSystem?: boolean;
+}
 /**
  * Filter context entries based on target role and [FOR: ...] tags.
  *
@@ -21,7 +25,22 @@ export interface ContextEntry {
  *
  * @param entries - Array of context entries to filter
  * @param targetRole - The target agent role to filter for
- * @param directory - Optional project directory for metrics logging (defaults to cwd)
+ * @param directory - Optional project directory for metrics logging
+ * @param options - Optional routing behavior; defaults preserve historical semantics
  * @returns Filtered array of context entries
  */
-export declare function filterByRole(entries: ContextEntry[], targetRole: string, directory?: string): ContextEntry[];
+export declare function filterByRole(entries: ContextEntry[], targetRole: string, directory?: string, options?: FilterByRoleOptions): ContextEntry[];
+/**
+ * Create the production adapter for role-scoped system fragments.
+ *
+ * The adapter intentionally has no directory parameter: chat-system filtering
+ * must stay free of synchronous metrics I/O. Missing session or agent identity
+ * fails open so critical system context is never dropped speculatively.
+ */
+export declare function createRoleFilterSystemHook(getActiveAgentName: (sessionID: string) => string | undefined): {
+    'experimental.chat.system.transform': (input: {
+        sessionID?: string;
+    }, output: {
+        system?: string[];
+    }) => Promise<void>;
+};

package/dist/db/project-db.d.ts

@@ -30,7 +30,9 @@ export declare function projectDbExists(directory: string): boolean;
 export declare function getProjectDb(directory: string): Database;
 /**
  * Close and remove the cached project database for the given directory.
- * Test-only.
+ * Called by the `/swarm close` clean stage before unlinking `swarm.db` (so a
+ * long-lived WAL-mode connection releases its file lock and Windows `unlink`
+ * does not fail with EBUSY), and from tests.
  */
 export declare function closeProjectDb(directory: string): void;
 /**

package/dist/index.d.ts

@@ -47,6 +47,7 @@ declare const _default: {
 };
 export default _default;
 export type { AgentDefinition } from './agents';
+export { archiveSqliteSnapshot } from './commands/archive-sqlite.js';
 export type { AgentName, AutomationCapabilities, AutomationConfig, AutomationMode, PipelineAgentName, PluginConfig, QAAgentName, } from './config';
 export { loadTier1EvaluationTasks } from './evaluation/fixtures.js';
 export { recordTestImpactGateGroundTruth } from './evaluation/gate-ground-truth.js';