opencode-swarm 7.137.5 → 7.138.1

package/dist/services/preflight-service.d.ts

@@ -11,6 +11,7 @@
  * Returns deterministic structured result with per-check status + overall verdict.
  * Callable by background flow (from preflight.requested events).
  */
+import { runSecretscan } from '../tools/secretscan';
 /** Preflight check types */
 export type PreflightCheckType = 'lint' | 'tests' | 'secrets' | 'evidence' | 'version' | 'req_coverage';
 /** Individual check status */
@@ -122,6 +123,7 @@ export declare const _internals: {
     runVersionCheck: typeof runVersionCheck;
     runLintCheck: typeof runLintCheck;
     runTestsCheck: typeof runTestsCheck;
+    runSecretscan: typeof runSecretscan;
     runSecretsCheck: typeof runSecretsCheck;
     runEvidenceCheck: typeof runEvidenceCheck;
     runRequirementCoverageCheck: typeof runRequirementCoverageCheck;

package/dist/services/session-reflection.d.ts

@@ -14,7 +14,9 @@
  * When no LLM client is available, phase 2 falls back to a deterministic
  * summary so finalize never blocks on missing infrastructure.
  */
+import { readKnowledge, readRejectedLessons } from '../hooks/knowledge-store';
 import { type SkillImproverLLMDelegate } from '../hooks/skill-improver-llm-factory';
+import { readSkillUsageEntriesTail } from '../hooks/skill-usage-log';
 import type { ToolAggregate } from '../state';
 export interface ToolProblem {
     tool: string;
@@ -33,6 +35,68 @@ export interface GateFailureSummary {
     taskId: string;
     count: number;
 }
+/**
+ * Knowledge-delta surface for the reflection report (issue #2077).
+ *
+ * `admitted` / `reinforcedRealtime` / `rejectedCurator` are recovered
+ * READ-ONLY from durable markers stamped by the realtime admission path
+ * (`src/learning/admission.ts`) and the curator rejected-lessons file —
+ * the in-memory `DrainSummary` is discarded at `src/index.ts` (issue
+ * #1821), but the outcomes it summarized persist on the entries
+ * themselves, so the counts are reconstructable here without any new
+ * writes. Realtime *rejections* (screened-out candidates that never
+ * reached the store) remain unobservable and are flagged in the report.
+ */
+export interface KnowledgeDelta {
+    /** Entries created this session (count, from countSessionKnowledgeEntries). */
+    sessionKnowledgeCreated: number;
+    /** FR-015 dedup: retro lessons dropped as already-known. */
+    dedupDropped: number;
+    /** False when the dedup read failed (fail-open) — distinguishes "0 deduped" from "dedup did not run". */
+    dedupAvailable: boolean;
+    /** Retro lessons that survived dedup and were curated. */
+    retroLessonTotal: number;
+    /** Close-time curation counts (finalize retro-lesson batch). */
+    curation?: {
+        stored: number;
+        reinforced: number;
+        skipped: number;
+        rejected: number;
+        quarantined: number;
+    };
+    /** Entries admitted this session (created_at >= sessionStart AND carry an `insight:` provenance marker). */
+    admitted?: number;
+    /** Pre-existing entries reinforced this session (some confirmed_by[].confirmed_at >= sessionStart). */
+    reinforcedRealtime?: number;
+    /** Curator-path rejections this session (rejected_at >= sessionStart, from .swarm/knowledge-rejected.jsonl). */
+    rejectedCurator?: number;
+}
+export interface SkillViolationSignal {
+    skillPath: string;
+    violations: number;
+    total: number;
+    /** Always true — the 64 KB tail may truncate the denominator. */
+    tailBounded: boolean;
+    /** 'session' when filtered by sessionID; 'all_sessions' when no sessionID was available. */
+    scope: 'session' | 'all_sessions';
+}
+export interface ContradictionCandidate {
+    newLesson: string;
+    newEntryId: string;
+    conflictsWithId: string;
+    conflictsWithLesson: string;
+    similarity: number;
+}
+export type ReflectionActionKind = 'supersede' | 'file_issue' | 'draft_skill';
+export interface ReflectionActionProposal {
+    kind: ReflectionActionKind;
+    /** Short human-readable label for the menu line. */
+    label: string;
+    /** Longer body (issue body, lesson text, etc.). */
+    detail: string;
+    /** Existing tool/command to route to, e.g. '/swarm curate'. */
+    routing: string;
+}
 export interface SessionReflectionData {
     timestamp: string;
     totalToolCalls: number;
@@ -42,11 +106,22 @@ export interface SessionReflectionData {
     gateFailures: GateFailureSummary[];
     lessonsFromRetros: string[];
     errorTaxonomy: Record<string, number>;
+    knowledgeDelta?: KnowledgeDelta;
+    skillViolations: SkillViolationSignal[];
+    contradictionCandidates: ContradictionCandidate[];
 }
 export interface SessionReflectionResult {
     data: SessionReflectionData;
     architectReport: string;
+    /**
+     * Always-rendered signals block (issue #2077). Surfaced UNCONDITIONALLY
+     * by close.ts (not gated by the narrative-report `hasSignals` check) so
+     * the "0 captured; N deduped" / NOOP line appears even in a clean
+     * session. Present on BOTH the llm and deterministic paths.
+     */
+    signalsReport: string;
     source: 'llm' | 'deterministic';
+    actionProposals: ReflectionActionProposal[];
 }
 declare function gatherToolProblems(toolAggregates: Map<string, ToolAggregate>): {
     problems: ToolProblem[];
@@ -63,7 +138,83 @@ declare function gatherRetroLessonsAndTaxonomy(directory: string): Promise<{
     taxonomy: Record<string, number>;
 }>;
 declare function gatherGateFailures(directory: string): Promise<GateFailureSummary[]>;
+/**
+ * Top skills by violation this session (issue #2077).
+ *
+ * Reads the bounded tail of `.swarm/skill-usage.jsonl`, groups by
+ * `skillPath`, and counts entries where the normalized compliance
+ * verdict is `'violated'`. Returns `[]` when `sessionId` is undefined:
+ * without a session filter the tail is cumulative cross-session data
+ * and MUST NOT be labeled "this session" (issue #2077 critic item 8).
+ * `tailBounded` is always true — the 64 KB tail may truncate the
+ * denominator.
+ */
+export declare function gatherSkillViolations(directory: string, sessionId?: string): SkillViolationSignal[];
+/**
+ * Contradiction candidates among session-created knowledge (issue #2077).
+ *
+ * IMPORTANT (issue #2077 critic item 3): the realtime admission and
+ * curator write paths dedup at `dedup_threshold` (default 0.6) BEFORE an
+ * entry becomes active, so two active entries with Jaccard similarity
+ * ≥ that threshold cannot coexist. A detector run at the dedup threshold
+ * would therefore return `[]` in every real session. Instead this looks
+ * in a sub-threshold band `[CONTRADICTION_LOWER, dedupThreshold)` AND
+ * requires negation-polarity divergence — the only shape that can occur
+ * in production. Uses the exported `wordBigrams`/`jaccardBigram`
+ * primitives directly so the score is available (the
+ * `findActiveSwarmNearDuplicate` helper returns only the entry, with no
+ * score and no self-exclusion). Detect-only: never writes, never
+ * auto-supersedes. Supersession is operationally deletion
+ * (`superseded_by IS NULL` read filter) and is surfaced only as a menu
+ * item the user opts into.
+ */
+export declare function gatherContradictionCandidates(directory: string, sessionStart?: string, dedupThreshold?: number): Promise<ContradictionCandidate[]>;
+/**
+ * Realtime admission counts recovered READ-ONLY from durable markers
+ * (issue #2077 critic item 4). The in-memory `DrainSummary` is
+ * discarded at `src/index.ts`, but the outcomes persist:
+ *   - admitted:   entries created this session with an `insight:` provenance marker
+ *     (stamped by `admitCandidate` via `unionSourceKnowledgeIds`).
+ *   - reinforced: pre-existing entries with a `confirmed_by` record
+ *     stamped this session (the realtime reinforce path).
+ *   - rejected:   curator-path rejections this session, from
+ *     `.swarm/knowledge-rejected.jsonl`.
+ * Returns `undefined` when `sessionStart` is undefined (counts are
+ * session-scoped). Realtime *rejections* (screened-out candidates that
+ * never reached the store) are NOT recoverable and are flagged in the
+ * report as tracked by #1821.
+ */
+export declare function gatherRealtimeAdmissionCounts(directory: string, sessionStart?: string): Promise<{
+    admitted: number;
+    reinforced: number;
+    rejected: number;
+} | undefined>;
 declare function buildReflectionDataSummary(data: SessionReflectionData): string;
+/**
+ * Always-rendered signals block (issue #2077). Rendered UNCONDITIONALLY
+ * by close.ts (not gated by the narrative-report `hasSignals` check) so
+ * the "0 captured; N deduped" / NOOP line appears even in a clean
+ * session. Surfaces all six signal classes: knowledge delta, skill
+ * violations, contradiction candidates, negatives, drafted issues.
+ */
+export declare function buildSignalsBlock(data: SessionReflectionData): string;
+/**
+ * Assemble a numbered action menu from reflection proposals (issue #2077
+ * Phase B). Advisory only — application happens in a later user turn via
+ * the named existing tools. Under full-auto the "reply with numbers"
+ * prompt is suppressed (reported-only) so the run is not blocked waiting
+ * on human input. Returns '' when there are no proposals.
+ */
+export declare function buildActionMenu(proposals: ReflectionActionProposal[], fullAuto: boolean): string;
+/**
+ * Build action proposals from gathered signals (issue #2077 Phase B).
+ * The `capture` kind is intentionally absent (issue #2077 critic item 7):
+ * aggregate curation counts cannot derive per-lesson outcomes, and
+ * re-proposing quarantined lessons would fail the actionability gate
+ * identically when applied. A menu item guaranteed to be rejected is
+ * worse than no menu item.
+ */
+export declare function buildActionProposals(data: SessionReflectionData): ReflectionActionProposal[];
 declare function buildDeterministicReport(data: SessionReflectionData): string;
 export interface SessionReflectionInput {
     directory: string;
@@ -72,6 +223,17 @@ export interface SessionReflectionInput {
     sessionId?: string;
     signal?: AbortSignal;
     delegate?: SkillImproverLLMDelegate;
+    /** Issue #2077: knowledge-delta surface (close-time curation counts + dedup state). */
+    knowledgeDelta?: KnowledgeDelta;
+    /** Issue #2077: session start (ISO), used to scope session-created entries. */
+    sessionStart?: string;
+    /**
+     * Issue #2077: configured dedup threshold (upper bound of the contradiction
+     * band). Read from `config.dedup_threshold` so a user-tuned threshold (e.g.
+     * 0.8) does not cause advisory false negatives for pairs in [0.6, 0.8) that
+     * can coexist in the active store. Defaults to 0.6 (the schema default).
+     */
+    dedupThreshold?: number;
 }
 export declare function runSessionReflection(input: SessionReflectionInput): Promise<SessionReflectionResult>;
 export declare function writeSessionReflection(directory: string, result: SessionReflectionResult): Promise<string>;
@@ -82,5 +244,14 @@ export declare const _internals: {
     gatherGateFailures: typeof gatherGateFailures;
     buildReflectionDataSummary: typeof buildReflectionDataSummary;
     buildDeterministicReport: typeof buildDeterministicReport;
+    gatherSkillViolations: typeof gatherSkillViolations;
+    gatherContradictionCandidates: typeof gatherContradictionCandidates;
+    gatherRealtimeAdmissionCounts: typeof gatherRealtimeAdmissionCounts;
+    buildSignalsBlock: typeof buildSignalsBlock;
+    buildActionMenu: typeof buildActionMenu;
+    buildActionProposals: typeof buildActionProposals;
+    readSkillUsageEntriesTail: typeof readSkillUsageEntriesTail;
+    readKnowledge: typeof readKnowledge;
+    readRejectedLessons: typeof readRejectedLessons;
 };
 export {};

package/dist/tools/pre-check-batch.d.ts

@@ -5,6 +5,7 @@
  */
 import type { tool } from '@opencode-ai/plugin';
 import type { PluginConfig } from '../config';
+import { saveEvidence } from '../evidence/manager.js';
 import type { LintResult } from './lint';
 import type { QualityBudgetResult } from './quality-budget';
 import { qualityBudget } from './quality-budget';
@@ -17,6 +18,7 @@ export declare const _internals: {
     runSastScanWrapped: typeof runSastScanWrapped;
     runQualityBudgetWrapped: typeof runQualityBudgetWrapped;
     getChangedLineRanges: typeof getChangedLineRanges;
+    saveEvidence: typeof saveEvidence;
 };
 export interface PreCheckBatchInput {
     /** List of specific files to check (optional) */

package/dist/tools/secretscan.d.ts

@@ -1,3 +1,4 @@
+import * as fs from 'node:fs';
 import { createSwarmTool } from './create-tool';
 type SecretType = 'api_key' | 'aws_access_key' | 'aws_secret_key' | 'private_key' | 'password' | 'secret_token' | 'bearer_token' | 'basic_auth' | 'database_url' | 'jwt' | 'github_token' | 'slack_token' | 'stripe_key' | 'sendgrid_key' | 'twilio_key' | 'generic_token' | 'high_entropy';
 type Confidence = 'high' | 'medium' | 'low';
@@ -17,8 +18,15 @@ export interface SecretscanResult {
     count: number;
     files_scanned: number;
     skipped_files: number;
+    /** Files requested or discovered but not completely examined. */
+    incomplete_files: number;
+    incomplete_paths: IncompletePath[];
     message?: string;
 }
+export interface IncompletePath {
+    path: string;
+    reason: 'cleanup_failed' | 'deadline' | 'directory_limit' | 'max_files' | 'non_file' | 'oversized' | 'read_error' | 'scope_escape' | 'symlink' | 'truncated';
+}
 export interface SecretscanErrorResult {
     error: string;
     scan_dir: string;
@@ -35,6 +43,7 @@ interface SecretPattern {
     redactTemplate: (match: string) => string;
 }
 declare const SECRET_PATTERNS: SecretPattern[];
+declare function yieldToEventLoop(): Promise<void>;
 export declare const secretscan: ReturnType<typeof createSwarmTool>;
 /**
  * Run secretscan programmatically
@@ -55,5 +64,13 @@ export declare const _internals: {
     runSecretscan: typeof runSecretscan;
     runSecretscanOnFiles: typeof runSecretscanOnFiles;
     SECRET_PATTERNS: typeof SECRET_PATTERNS;
+    now: () => number;
+    yieldToEventLoop: typeof yieldToEventLoop;
+    openFile: typeof fs.openSync;
+    fstatFile: typeof fs.fstatSync;
+    readFileChunk: typeof fs.readSync;
+    closeFile: typeof fs.closeSync;
+    lstatFile: typeof fs.lstatSync;
+    closeDirectory: (directory: fs.Dir) => void;
 };
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.137.5",
+	"version": "7.138.1",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",