opencode-swarm 7.138.2 → 7.138.4

package/dist/cli/{index-d01d4102.js → index-tjwz5tct.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   authorizeCuration
-} from "./index-ze4we97d.js";
+} from "./index-m40ea3zk.js";
 import {
   findNearDuplicate,
   inferTags,
@@ -9,7 +9,7 @@ import {
   resolveSwarmKnowledgePath,
   resolveSwarmRejectedPath,
   transactKnowledge
-} from "./index-49ygvqvm.js";
+} from "./index-1g6xpjk3.js";
 import {
   resolveKnowledgeStoreDir
 } from "./index-en4fb04r.js";

package/dist/cli/{index-j0xx9wpj.js → index-y28n2wmq.js}

@@ -86,7 +86,7 @@ var _internals = {
     symlinkSync: fs.symlinkSync
   },
   writeScopeToDisk: async (directory, taskId, files) => {
-    const { writeScopeToDisk: realWrite } = await import("./scope-persistence-n1bryhzf.js");
+    const { writeScopeToDisk: realWrite } = await import("./scope-persistence-w7zen2wz.js");
     return realWrite(directory, taskId, files);
   },
   writeLaneProfileToDisk: async (_worktreePath, _laneIndex, _envOverrides) => {

package/dist/cli/index.js

@@ -6,49 +6,50 @@ import {
   getPluginConfigDir,
   getPluginLockFilePaths,
   resolveCommand
-} from "./index-89dwrz8n.js";
+} from "./index-a18hk2fw.js";
 import"./index-vm4xw9z3.js";
 import"./index-rrxcfxrd.js";
-import"./index-qt3jjjw9.js";
-import"./index-da98750t.js";
-import"./index-y06a43sk.js";
+import"./index-gm3pjfhb.js";
+import"./index-m8txs2a9.js";
+import"./index-mycqmsz5.js";
 import"./index-ngqxzkqm.js";
 import"./index-y8552snf.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
-import"./index-qg5smxv9.js";
-import"./index-xm07cqy2.js";
-import"./index-yxswbd1t.js";
+import"./index-jbge0dyh.js";
+import"./index-50mwt8fx.js";
+import"./index-c60whfgh.js";
 import"./index-6mjf4vr1.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
 import"./index-wsdnttf4.js";
 import"./index-39k6y018.js";
-import"./index-d01d4102.js";
-import"./index-ze4we97d.js";
+import"./index-tjwz5tct.js";
+import"./index-m40ea3zk.js";
 import"./index-rtry5xyf.js";
-import"./index-49ygvqvm.js";
-import"./index-r9pn41rj.js";
+import"./index-1g6xpjk3.js";
+import"./index-57stye65.js";
 import"./index-ae75rja9.js";
 import"./index-en4fb04r.js";
 import"./index-tqshdzaw.js";
-import"./index-k6cq9wwh.js";
+import"./index-m1pwkwfe.js";
 import"./index-gprxjmm7.js";
 import"./index-n832052r.js";
 import {
   init_package,
   package_default
-} from "./index-exq36v6w.js";
+} from "./index-5q009kc4.js";
 import"./index-bk5tah7q.js";
 import"./index-8fwhhayc.js";
 import"./index-q1exe2b3.js";
 import"./index-z7jgvm9b.js";
-import"./index-2y4jy0de.js";
+import"./index-smsy2p8n.js";
+import"./index-556ja8an.js";
 import"./index-4fmztnrq.js";
 import"./index-1kz6da87.js";
 import"./index-x20cgr2q.js";
 import"./index-b8zgtz81.js";
-import"./index-j0xx9wpj.js";
+import"./index-y28n2wmq.js";
 import"./index-4rhhvd1a.js";
 import {
   DEFAULT_AGENT_CONFIGS,

package/dist/cli/{knowledge-escalator-qmpfh5yz.js → knowledge-escalator-s6z1x65b.js}

@@ -8,9 +8,9 @@ import {
   maybeEscalateOnViolation,
   maybeQuarantineOnContradiction,
   readRecentEscalations
-} from "./index-xm07cqy2.js";
-import"./index-49ygvqvm.js";
-import"./index-r9pn41rj.js";
+} from "./index-50mwt8fx.js";
+import"./index-1g6xpjk3.js";
+import"./index-57stye65.js";
 import"./index-ae75rja9.js";
 import"./index-en4fb04r.js";
 import"./index-tqshdzaw.js";

package/dist/cli/{knowledge-events-7neg8x0p.js → knowledge-events-nnyn6hst.js}

@@ -28,7 +28,7 @@ import {
   resolveKnowledgeCounterBaselinePath,
   resolveKnowledgeEventsPath,
   resolveLegacyApplicationLogPath
-} from "./index-r9pn41rj.js";
+} from "./index-57stye65.js";
 import"./index-ae75rja9.js";
 import"./index-en4fb04r.js";
 import"./index-tqshdzaw.js";

package/dist/cli/{knowledge-store-a6d4625r.js → knowledge-store-x4yfc7v3.js}

@@ -41,7 +41,7 @@ import {
   transactKnowledge,
   transactKnowledgeWithCas,
   wordBigrams
-} from "./index-49ygvqvm.js";
+} from "./index-1g6xpjk3.js";
 import {
   resolveHiveDataDir
 } from "./index-ae75rja9.js";

package/dist/cli/{knowledge-validator-q1qrdyvx.js → knowledge-validator-1v047gsa.js}

@@ -23,11 +23,11 @@ import {
   validateLesson,
   validateSkillCandidatePath,
   validateSkillPath
-} from "./index-d01d4102.js";
-import"./index-ze4we97d.js";
+} from "./index-tjwz5tct.js";
+import"./index-m40ea3zk.js";
 import"./index-rtry5xyf.js";
-import"./index-49ygvqvm.js";
-import"./index-r9pn41rj.js";
+import"./index-1g6xpjk3.js";
+import"./index-57stye65.js";
 import"./index-ae75rja9.js";
 import"./index-en4fb04r.js";
 import"./index-tqshdzaw.js";

package/dist/cli/{scan-cursor-3tqshkb2.js → scan-cursor-jxajj6s7.js}

@@ -4,8 +4,8 @@ import {
   alreadyCuratedThisGeneration,
   claimNextScanBatch,
   getScanStatus
-} from "./index-yxswbd1t.js";
-import"./index-49ygvqvm.js";
+} from "./index-c60whfgh.js";
+import"./index-1g6xpjk3.js";
 import"./index-ae75rja9.js";
 import"./index-en4fb04r.js";
 import"./index-tqshdzaw.js";

package/dist/cli/{schema-mtyaeh18.js → schema-fj32eyae.js}

@@ -95,7 +95,7 @@ import {
   resolveGeneratedAgentRole,
   resolveGuardrailsConfig,
   stripKnownSwarmPrefix
-} from "./index-exq36v6w.js";
+} from "./index-5q009kc4.js";
 import"./index-bk5tah7q.js";
 import"./index-3jcyn8g6.js";
 import"./index-bpmtbmy9.js";

package/dist/cli/{scope-persistence-n1bryhzf.js → scope-persistence-w7zen2wz.js}

@@ -1,18 +1,30 @@
 // @bun
 import {
+  _scopePersistenceInternals,
+  claimScopeBindingForChildDurably,
   clearAllScopes,
   clearScopeBindingFromDisk,
   clearScopeForTask,
+  flushScopeBindingMaintenance,
+  persistAndRegisterScopeBinding,
+  pruneScopeBindingTombstones,
   readPlanScope,
   readScopeBindingFromDisk,
   readScopeFromDisk,
+  refreshScopeBindingLease,
+  replaceExistingScopeDeclaration,
   resolveAuthorizedPrFeedbackScopeBindingFromDisk,
   resolveAuthorizedScopeBinding,
+  resolveAuthorizedScopeBindingDetailed,
   resolveAuthorizedScopeBindingForSession,
+  resolveAuthorizedScopeBindingForSessionDetailed,
+  resolveScopeBindingFromDisk,
   resolveScopeWithFallbacks,
+  tombstoneScopeBinding,
   writeScopeBindingToDisk,
   writeScopeToDisk
-} from "./index-2y4jy0de.js";
+} from "./index-smsy2p8n.js";
+import"./index-556ja8an.js";
 import"./index-4fmztnrq.js";
 import"./index-1kz6da87.js";
 import"./index-xybtaph7.js";
@@ -25,14 +37,25 @@ import"./index-a76rekgs.js";
 export {
   writeScopeToDisk,
   writeScopeBindingToDisk,
+  tombstoneScopeBinding,
   resolveScopeWithFallbacks,
+  resolveScopeBindingFromDisk,
+  resolveAuthorizedScopeBindingForSessionDetailed,
   resolveAuthorizedScopeBindingForSession,
+  resolveAuthorizedScopeBindingDetailed,
   resolveAuthorizedScopeBinding,
   resolveAuthorizedPrFeedbackScopeBindingFromDisk,
+  replaceExistingScopeDeclaration,
+  refreshScopeBindingLease,
   readScopeFromDisk,
   readScopeBindingFromDisk,
   readPlanScope,
+  pruneScopeBindingTombstones,
+  persistAndRegisterScopeBinding,
+  flushScopeBindingMaintenance,
   clearScopeForTask,
   clearScopeBindingFromDisk,
-  clearAllScopes
+  clearAllScopes,
+  claimScopeBindingForChildDurably,
+  _scopePersistenceInternals
 };

package/dist/cli/{skill-generator-t3m5qajm.js → skill-generator-rt0jqcsa.js}

@@ -33,12 +33,12 @@ import {
   sanitizeSlug,
   selectCandidateEntries,
   writeEvalStub
-} from "./index-qg5smxv9.js";
-import"./index-d01d4102.js";
-import"./index-ze4we97d.js";
+} from "./index-jbge0dyh.js";
+import"./index-tjwz5tct.js";
+import"./index-m40ea3zk.js";
 import"./index-rtry5xyf.js";
-import"./index-49ygvqvm.js";
-import"./index-r9pn41rj.js";
+import"./index-1g6xpjk3.js";
+import"./index-57stye65.js";
 import"./index-ae75rja9.js";
 import"./index-en4fb04r.js";
 import"./index-tqshdzaw.js";

package/dist/hooks/guardrails/destructive-command.d.ts

@@ -58,6 +58,13 @@ export declare function dcUnwrapWrappers(cmd: string): string;
  * Returns array of trimmed non-empty segments.
  */
 export declare function dcSplitSegments(cmd: string): string[];
+/**
+ * Extract targets from an `rm` command whose leading option set requests
+ * recursive or forced deletion. Accepts stacked short flags and long flags in
+ * any leading order. Quoted targets remain one token. Returns null when the
+ * segment is not a destructive rm form.
+ */
+export declare function dcExtractRecursiveRmTargets(segment: string): string[] | null;
 /**
  * Returns true if a path string contains unexpanded environment variable
  * references that we cannot resolve at check time.
@@ -87,6 +94,34 @@ export declare function dcLstatAncestorWalk(targetPath: string, cwd: string): st
  * Returns a block reason string or null if targets are acceptable.
  */
 export declare function dcValidateTargets(targets: string[], cwd: string): string | null;
+export interface DcVerifiedScope {
+    bindingId: string;
+    generationId: string;
+    files: string[];
+}
+export type DcRecursiveDeleteDecision = {
+    allowed: true;
+    kind: 'bare-safe-artifact' | 'scoped-nested-safe-artifact';
+    targets: string[];
+} | {
+    allowed: false;
+    code: 'DESTRUCTIVE_TARGET_INVALID' | 'DESTRUCTIVE_TARGET_PROTECTED' | 'DESTRUCTIVE_TARGET_OUTSIDE_WORKSPACE' | 'DESTRUCTIVE_TARGET_NOT_SAFE_ARTIFACT' | 'DESTRUCTIVE_TARGET_SCOPE_REQUIRED' | 'DESTRUCTIVE_TARGET_OUT_OF_SCOPE';
+    reason: string;
+};
+/**
+ * Evaluate recursive-delete targets as one atomic set.
+ *
+ * Bare safe artifact names remain statically allowable after common target
+ * validation. Nested targets require an allowlisted final component and a
+ * resolver-produced active binding identity covering the target. Arbitrary
+ * in-scope directories are never exempt, and `.git`/`.swarm` are protected at
+ * every depth.
+ */
+export declare function dcEvaluateRecursiveDeleteTargets(input: {
+    targets: string[];
+    cwd: string;
+    verifiedScope?: DcVerifiedScope;
+}): DcRecursiveDeleteDecision;
 /**
  * Detect Windows junction or symlink CREATION commands.
  * Junction creation followed by recursive deletion of the junction is the

package/dist/hooks/guardrails/file-authority.d.ts

@@ -11,6 +11,7 @@
 import * as path from 'node:path';
 import { type AuthorityConfig } from '../../config/schema';
 import { type FileZone } from '../../context/zone-classifier';
+import { type PathFlavor } from '../../scope/path-identity';
 /**
  * Hashes tool arguments for repetition detection.
  *
@@ -106,6 +107,39 @@ export type AgentRule = {
     allowedGlobs?: string[];
     allowedCaseSensitiveGlobs?: string[];
 };
+export type AuthorityRoleCapability = 'native' | 'direct-write' | 'read-only' | 'dedicated-tool-only';
+/**
+ * Exhaustive classification for every swarm role. Dedicated-tool roles may
+ * mutate state only through their purpose-built tools, never raw file writes.
+ */
+export declare const AUTHORITY_ROLE_CAPABILITIES: {
+    readonly architect: "direct-write";
+    readonly coder: "direct-write";
+    readonly reviewer: "direct-write";
+    readonly critic: "direct-write";
+    readonly critic_oversight: "dedicated-tool-only";
+    readonly critic_finding_validator: "dedicated-tool-only";
+    readonly explorer: "read-only";
+    readonly sme: "read-only";
+    readonly researcher: "read-only";
+    readonly test_engineer: "direct-write";
+    readonly docs: "direct-write";
+    readonly docs_design: "direct-write";
+    readonly designer: "direct-write";
+    readonly critic_sounding_board: "read-only";
+    readonly critic_drift_verifier: "read-only";
+    readonly critic_hallucination_verifier: "read-only";
+    readonly critic_architecture_supervisor: "read-only";
+    readonly curator_init: "dedicated-tool-only";
+    readonly curator_phase: "dedicated-tool-only";
+    readonly curator_postmortem: "dedicated-tool-only";
+    readonly curator_consolidation: "dedicated-tool-only";
+    readonly council_generalist: "read-only";
+    readonly council_skeptic: "read-only";
+    readonly council_domain_expert: "read-only";
+    readonly skill_improver: "dedicated-tool-only";
+    readonly spec_writer: "dedicated-tool-only";
+};
 export declare const DEFAULT_AGENT_AUTHORITY_RULES: Record<string, AgentRule>;
 /**
  * Checks whether a write target path (or any ancestor strictly inside cwd)
@@ -126,6 +160,13 @@ export declare const DEFAULT_AGENT_AUTHORITY_RULES: Record<string, AgentRule>;
  * @returns A block reason string if a symlink is detected, null if all clear.
  */
 export declare function checkWriteTargetForSymlink(targetPath: string, cwd: string): string | null;
+/**
+ * Match configured authority prefixes using normalized lexical-prefix
+ * semantics. Thus `.env` covers `.env.local`; resolving both operands against
+ * one workspace root prevents sibling-workspace string collisions. Windows
+ * comparisons case-fold while POSIX comparisons remain case-sensitive.
+ */
+export declare function matchesAuthorityDenyPrefix(candidate: string, prefix: string, cwd: string, flavor?: PathFlavor): boolean;
 /**
  * Builds the effective rules map by merging user-configured rules with defaults.
  * User overrides take precedence for each field.
@@ -144,38 +185,42 @@ export declare function buildEffectiveRules(authorityConfig?: AuthorityConfig):
  * pass `path.win32` / `path.posix` directly.
  */
 export declare function isOnDifferentFilesystemRoot(targetAbsolute: string, cwdAbsolute: string, pathLib?: Pick<typeof path, 'parse'>): boolean;
-/**
- * Checks file path authority against a pre-computed rules map.
- * Implements DENY-first evaluation order:
- * 1. readOnly - blocks all writes
- * 2. blockedExact - exact path matches (fast path)
- * 3. blockedGlobs - glob pattern matches
- * 4. allowedExact - explicit allow for exact paths
- * 5. blockedZones - zone-based blocking (runs before allowedGlobs so that generated
- *    output dirs like dist/ and build/ cannot be bypassed by a glob pattern match)
- * 6. allowedGlobs - explicit allow for glob patterns (overrides blockedPrefix/allowedPrefix
- *    but NOT blockedZones, which is already decided in Step 5)
- * 7. blockedPrefix - prefix-based blocking (takes priority over allowedPrefix)
- * 8. allowedPrefix - prefix-based allow (whitelist)
- */
-export declare function checkFileAuthorityWithRules(agentName: string, filePath: string, cwd: string, effectiveRules: Record<string, AgentRule>, options?: {
-    declaredScope?: string[] | null;
-}): {
+export declare const BUILT_IN_VERIFIER_CONFIG_GLOBS: readonly ["**/oxlintrc*", "**/.oxlintrc*", "**/.eslintrc*", "**/eslint.config.*", "**/.prettierrc*", "**/prettier.config.*", "**/biome.json", "**/biome.jsonc", "**/tsconfig*.json", "**/.secretscanignore", "**/.golangci*"];
+export type AuthorityDecisionCode = 'AUTHORITY_INVALID_PATH' | 'AUTHORITY_ROOT_ESCAPE' | 'AUTHORITY_UNIVERSAL_DENY' | 'AUTHORITY_PROTECTED_PATH' | 'AUTHORITY_VERIFIER_CONFIG' | 'AUTHORITY_ROLE_READ_ONLY' | 'AUTHORITY_UNKNOWN_AGENT' | 'AUTHORITY_POLICY_DENY';
+export type AuthorityDecisionLayer = 'path-validation' | 'containment' | 'universal-deny' | 'protected-path' | 'role-capability' | 'declared-scope' | 'role-policy';
+export type AuthorityRecoveryAction = 'declare_scope' | 'save_plan';
+export type AuthorityDecision = {
     allowed: true;
+    layer: AuthorityDecisionLayer;
+    path: string;
+    agent: string;
 } | {
     allowed: false;
+    code: AuthorityDecisionCode;
+    layer: AuthorityDecisionLayer;
+    rule: string;
+    path: string;
+    agent: string;
     reason: string;
+    recovery?: AuthorityRecoveryAction;
     zone?: FileZone;
 };
+export interface AuthorityEvaluationOptions {
+    declaredScope?: string[] | null;
+    authorityEnabled?: boolean;
+    universalDenyPrefixes?: readonly string[];
+    verifierConfigPaths?: readonly string[];
+}
+/**
+ * Checks file path authority against a pre-computed rules map. Evaluation is
+ * staged: safe path + workspace containment; universal and protected denies;
+ * immutable role capability; exact declared coder scope; then configurable
+ * role policy. Scope can therefore authorize config/generated deliverables but
+ * can never authorize `.swarm`, verifier config, universal denies, root escape,
+ * or raw writes from read-only/dedicated-tool roles.
+ */
+export declare function checkFileAuthorityWithRules(agentName: string, filePath: string, cwd: string, effectiveRules: Record<string, AgentRule>, options?: AuthorityEvaluationOptions): AuthorityDecision;
 /**
  * Checks whether the given agent is authorised to write to the given file path.
  */
-export declare function checkFileAuthority(agentName: string, filePath: string, cwd: string, authorityConfig?: AuthorityConfig, options?: {
-    declaredScope?: string[] | null;
-}): {
-    allowed: true;
-} | {
-    allowed: false;
-    reason: string;
-    zone?: FileZone;
-};
+export declare function checkFileAuthority(agentName: string, filePath: string, cwd: string, authorityConfig?: AuthorityConfig, options?: AuthorityEvaluationOptions): AuthorityDecision;

package/dist/hooks/guardrails/index.d.ts

@@ -8,6 +8,7 @@
  */
 import { extractSwarmIdFromAgentName, getSwarmAgents, resolveFallbackModel } from '../../agents/index';
 import { type AuthorityConfig, type GuardrailsConfig } from '../../config/schema';
+import { getExecutor } from '../../sandbox/executor';
 import { dcCheckJunctionCreation } from './destructive-command';
 import { getMostRecentAssistantText, getProviderFailureFingerprint, isTransientProviderFailureText } from './messages-transform';
 export declare const _internals: {
@@ -19,6 +20,7 @@ export declare const _internals: {
     resolveFallbackModel: typeof resolveFallbackModel;
     dcCheckJunctionCreation: typeof dcCheckJunctionCreation;
     extractErrorSignal: typeof extractErrorSignal;
+    getSandboxExecutor: typeof getExecutor;
     /**
      * Test/inspection seams for the no-op detector's bounded session state
      * (invariant 8). Production code does not call these; they exist so the

package/dist/hooks/guardrails/tool-before.d.ts

@@ -9,6 +9,7 @@
  * target checks, and circuit breaker limits.
  */
 import { type AuthorityConfig, type GuardrailsConfig } from '../../config/schema';
+import type { ScopeLeaseCandidateInput } from '../../scope/scope-lease-renewal';
 import type { AgentRule } from './file-authority';
 /**
  * Shared context passed from createGuardrailsHooks to the toolBefore factory.
@@ -37,6 +38,8 @@ export interface ToolBeforeContext {
      * trusted roots when exempting `git worktree remove --force` (issue #1708).
      */
     worktreeBaseDirOverrides?: string[];
+    /** Sandbox executor getter seam for tests and platform-specific overrides. */
+    getSandboxExecutor: typeof import('../../sandbox/executor').getExecutor;
     /** Hold exact child-write provenance until the matching after-hook succeeds. */
     rememberReviewerScopeWrite?: (input: {
         callID: string;
@@ -45,6 +48,8 @@ export interface ToolBeforeContext {
         coderCallID: string;
         file: string;
     }) => void;
+    /** Snapshot an exact authorized write for success-only lease renewal. */
+    rememberScopeLeaseCandidate?: (input: ScopeLeaseCandidateInput) => void;
 }
 /**
  * Creates a toolBefore handler with the given shared context.

package/dist/hooks/scope-guard.d.ts

@@ -9,7 +9,7 @@
  * outside its Task-correlated scope, blocks the call and injects an advisory.
  */
 import { describeScopeWorkspaceMismatch, getAuthorizedPrFeedbackScopeBinding } from '../scope/scope-binding';
-import { resolveAuthorizedPrFeedbackScopeBindingFromDisk, resolveAuthorizedScopeBinding, resolveAuthorizedScopeBindingForSession } from '../scope/scope-persistence';
+import { resolveAuthorizedPrFeedbackScopeBindingFromDisk, resolveAuthorizedScopeBinding, resolveAuthorizedScopeBindingDetailed, resolveAuthorizedScopeBindingForSession, resolveAuthorizedScopeBindingForSessionDetailed } from '../scope/scope-persistence';
 import { type AgentSessionState, resolveSessionWorkspaceDirectory } from '../state';
 import { validatePrFeedbackScopeBinding } from './pr-workflow-gate';
 import { resolveWriteTargets } from './write-target-resolver';
@@ -74,6 +74,8 @@ declare function sanitizePath(raw: string): string;
 export declare const _internals: {
     sanitizePath: typeof sanitizePath;
     resolveWriteTargets: typeof resolveWriteTargets;
+    resolveAuthorizedScopeBindingDetailed: typeof resolveAuthorizedScopeBindingDetailed;
+    resolveAuthorizedScopeBindingForSessionDetailed: typeof resolveAuthorizedScopeBindingForSessionDetailed;
     resolveAuthorizedScopeBinding: typeof resolveAuthorizedScopeBinding;
     resolveAuthorizedScopeBindingForSession: typeof resolveAuthorizedScopeBindingForSession;
     getAuthorizedPrFeedbackScopeBinding: typeof getAuthorizedPrFeedbackScopeBinding;