opencode-swarm 7.138.4 → 7.139.1

package/dist/config/context-window.d.ts

@@ -0,0 +1,210 @@
+/**
+ * Context-window denominator resolution — the SINGLE derivation.
+ *
+ * Every "how many tokens does this model's context window hold?" question in
+ * the plugin resolves here: the context-budget denominator (`budgetTokens` in
+ * `src/hooks/system-enhancer.ts` Path A and Path B), the hard-enforcement
+ * threshold in `src/hooks/context-budget.ts`, the knowledge-injector headroom
+ * gate, the `context_status` tool, and the `/swarm status` render.
+ *
+ * ## Why this exists
+ *
+ * The denominator used to be a hardcoded 128 000. That number is stale:
+ * current frontier and mid-tier models ship 200k–1M windows, and 256k is
+ * common even for locally-hosted models. A budget that reports "87 % used"
+ * against a window that is really 1M does not just emit a spurious advisory —
+ * `context-budget.ts` HARD-PRUNES messages at `critical_threshold × limit`, so
+ * a too-small denominator silently deletes context the model still needed.
+ *
+ * The authoritative value is already in the host's hands. The
+ * `experimental.chat.system.transform` hook input carries
+ * `model: Model` (`@opencode-ai/plugin`), and `Model.limit.context`
+ * (`@opencode-ai/sdk`) is the live window for THAT provider's entry of THAT
+ * model. Provider-specific caps are already baked in, because the host's model
+ * catalog is keyed `providers[providerID].models[modelID]` — verified against
+ * the on-disk catalog, where `github-copilot`'s `claude-sonnet-4.5` and
+ * `anthropic`'s `claude-sonnet-4-5` carry DIFFERENT `limit.context` values.
+ * A user's `provider.<id>.models.<id>.limit.context` override in
+ * `opencode.json` is merged into the same object before it reaches the hook.
+ *
+ * ## Resolution order (first usable value wins)
+ *
+ *   1. `context_budget.model_limits["<providerID>/<modelID>"]`
+ *   2. `context_budget.model_limits["<modelID>"]`
+ *   3. `context_budget.model_limits.default`
+ *   4. the LIVE `model.limit.context` from the hook input
+ *   5. the static fallback table (`src/hooks/model-limits.ts`), injected as
+ *      `fallbackLookup` — reachable only when no live value is available
+ *   6. `DEFAULT_MODEL_CONTEXT_TOKENS`
+ *
+ * Steps 1–3 are ABOVE the live value on purpose: a user who writes a
+ * `model_limits` entry is asking for a smaller *working* budget than the
+ * physical window, and that intent must not be overridden by the hardware.
+ * This is why `context_budget.model_limits` no longer carries a zod
+ * `.default({ default: … })` — a schema-injected value is not user intent, and
+ * would have shadowed the live window for every user who has a
+ * `context_budget` block at all. See `ContextBudgetConfigSchema` in
+ * `./schema.ts`.
+ *
+ * Steps 5–6 are last resorts, NOT a cap on step 4. The hand-maintained table
+ * is stale in the downward direction (it claims Copilot caps everything at
+ * 128 000; the live catalog shows Copilot Claude entries at 200 000 and
+ * 1 000 000), so min-capping the live value against it would reintroduce
+ * exactly the too-small denominator this module exists to remove.
+ */
+/**
+ * LAST-RESORT context-budget denominator (tokens) — rung 6 above.
+ *
+ * Declared HERE rather than imported from `./schema`, deliberately: this module
+ * is loaded transitively by `src/hooks/model-limits.ts` and therefore by every
+ * `messages.transform` consumer, and several test files replace
+ * `src/config/schema` with a non-spreading `mock.module` factory. Importing a
+ * symbol from schema here would make Bun throw
+ * `SyntaxError: Export named 'DEFAULT_MODEL_CONTEXT_TOKENS' not found` in those
+ * files at import time (see the "mock.module() Export Completeness" section of
+ * the writing-tests skill). Keeping this module dependency-free removes the
+ * whole class. `./schema` re-exports the constant, so every existing importer
+ * is unaffected.
+ *
+ * It is reached only when the user configured no `model_limits` entry, the host
+ * supplied no usable `model.limit.context`, and the static fallback table in
+ * `src/hooks/model-limits.ts` had no opinion either. It is deliberately NOT the
+ * primary source: 128 000 is stale for current models, which routinely ship
+ * 200k–1M windows.
+ *
+ * Historical note: `budgetTokens` used to be derived from
+ * `context_budget.model_limits.default` in `src/hooks/system-enhancer.ts`, but
+ * `context_budget` is schema-OPTIONAL, so a user with no block fell back to
+ * `DEFAULT_CONTEXT_BUDGET_CONFIG.budgetTokens` in
+ * `src/services/context-budget-service.ts` instead. Those two numbers had
+ * drifted (128000 vs 40000), so the unconfigured default measured the swarm's
+ * architect system prompt — approximately 34.5k estimated tokens — against a
+ * 40k denominator and reported ~86% on turn one (34500/40000 = 86.25%; an
+ * earlier revision of this comment said 87%) — enough to fire the budget
+ * warning, the `CONTEXT PRESSURE`
+ * advisory (src/index.ts) and the compaction EMERGENCY tier
+ * (`observation/reflection/emergency` = 40/60/80) immediately.
+ */
+export declare const DEFAULT_MODEL_CONTEXT_TOKENS = 128000;
+/**
+ * Smallest context window this module will accept from an untrusted source.
+ *
+ * Mirrors the `z.number().min(1000)` floor that `ContextBudgetConfigSchema`
+ * already enforces on user-authored `model_limits` values, so live catalog data
+ * and user config are held to one standard. This is not theoretical: a survey
+ * of the host's on-disk model catalog (`~/.cache/opencode/models.json`, ~6.2k
+ * entries; the file is a per-machine, auto-refreshing artifact, so the exact
+ * total moves) found 124 entries with `limit.context: 0`. Dividing by that
+ * yields `Infinity` percent and would fire the EMERGENCY compaction tier on
+ * turn one.
+ */
+export declare const MIN_PLAUSIBLE_CONTEXT_TOKENS = 1000;
+/** Which rung of the resolution order produced the value. */
+export type ContextWindowSource = 'user_provider_model' | 'user_model' | 'user_default' | 'live_model_limit' | 'static_table' | 'static_default';
+export interface ContextWindowResolution {
+    /**
+     * The resolved denominator, in tokens. Always a finite integer ≥ 1, so it is
+     * never a divide-by-zero. Through a PARSED config it is additionally ≥ 1000:
+     * every rung except the user rungs is gated on
+     * {@link isUsableContextWindow} (≥ {@link MIN_PLAUSIBLE_CONTEXT_TOKENS}), and
+     * the user rungs are themselves floored at 1000 by
+     * `ContextBudgetConfigSchema`. A direct programmatic call may still supply a
+     * user value between 1 and 999 and get it back — that is deliberate
+     * (honouring explicit intent), and it is why the guarantee stated here is
+     * ≥ 1 rather than ≥ 1000.
+     */
+    tokens: number;
+    /** Which rung produced `tokens` — surfaced in debug logs and tests. */
+    source: ContextWindowSource;
+}
+export interface ContextWindowInputs {
+    /**
+     * `config.context_budget?.model_limits` exactly as the user authored it.
+     * Pass `undefined` when the user has no `context_budget` block.
+     */
+    userLimits?: Record<string, number> | undefined;
+    /** Model identifier, when known (e.g. `claude-sonnet-4-6`). */
+    modelID?: string | undefined;
+    /** Provider identifier, when known (e.g. `github-copilot`). */
+    providerID?: string | undefined;
+    /**
+     * The live `model.limit.context` for this turn. Deliberately `unknown`:
+     * it crosses the plugin-host boundary, and the survey above shows the
+     * catalog really does ship `0` for some entries.
+     */
+    liveContextLimit?: unknown;
+    /**
+     * Last-resort static lookup. Injected rather than imported so this module
+     * stays free of any dependency on `src/hooks/`. Returning `undefined` means
+     * "no opinion" and falls through to `DEFAULT_MODEL_CONTEXT_TOKENS`.
+     */
+    fallbackLookup?: ((modelID?: string, providerID?: string) => number | undefined) | undefined;
+}
+/**
+ * True when `value` can be used as a divisor at all: a finite number strictly
+ * greater than zero.
+ *
+ * This is the bar applied to USER-AUTHORED `model_limits` values. It is
+ * deliberately weaker than {@link isUsableContextWindow}: `ContextBudgetConfigSchema`
+ * already enforces `z.number().min(1000)` on that record, so anything smaller
+ * cannot reach here through a parsed config — and silently DISCARDING a value a
+ * user explicitly wrote would be worse than honouring it. What this does reject
+ * is the set that breaks arithmetic outright (`NaN`, `±Infinity`, `0`,
+ * negatives, non-numbers), which a direct programmatic call can still supply.
+ *
+ * The bar is `>= 1`, not `> 0` (#1619 review round 4). `resolveContextWindow`
+ * applies `Math.floor` to whatever this admits, so a fractional value in
+ * `(0, 1)` — e.g. `{ default: 0.5 }` from a programmatic caller — passed a
+ * `> 0` test and then floored to a **zero denominator**, producing the exact
+ * `Infinity %` this guard exists to prevent. `>= 1` closes that without
+ * discarding any value a user could author through a parsed config (the schema
+ * floor is 1000) and without changing the verdict for any previously-accepted
+ * integer.
+ */
+export declare function isUsableConfiguredWindow(value: unknown): value is number;
+/**
+ * True when `value` is a plausible context-window size reported by an
+ * UNTRUSTED source: a finite number at or above
+ * {@link MIN_PLAUSIBLE_CONTEXT_TOKENS}.
+ *
+ * Applied to the live `model.limit.context` and to the static fallback table.
+ * Stricter than {@link isUsableConfiguredWindow} because nothing validates the
+ * host's model catalog on the way in and no real model ships a sub-1000-token
+ * window — so a small value there is corrupt data, not intent. Rejects, by
+ * construction, `undefined`, `null`, non-numbers, `NaN`, `Infinity`,
+ * `-Infinity`, `0` and every negative: the shapes that turn a percentage into
+ * `NaN` / `Infinity` and drive spurious EMERGENCY compaction directives.
+ */
+export declare function isUsableContextWindow(value: unknown): value is number;
+/**
+ * Safely read `model.limit.context` off the `experimental.chat.system.transform`
+ * hook input's `model` object.
+ *
+ * Typed as `unknown` on purpose. The plugin `.d.ts` declares `model: Model`
+ * (non-optional), but this hook runs inside the host's transform chain: a throw
+ * here takes down ALL system enhancement for the turn, so the read never
+ * assumes the declared shape actually arrived.
+ *
+ * @returns the raw value, or `undefined` when the path is absent.
+ */
+export declare function readModelContextLimit(model: unknown): unknown;
+/**
+ * Safely read `model.id` / `model.providerID` off the hook input's `model`.
+ *
+ * Same defensive posture as {@link readModelContextLimit}: the declared type
+ * says these are strings, but this runs on the host boundary. Empty strings are
+ * normalised to `undefined` so a blank identity never becomes a config-lookup
+ * key like `"/"`.
+ */
+export declare function readModelIdentity(model: unknown, key: 'id' | 'providerID'): string | undefined;
+/**
+ * Resolve the context-window denominator and report which rung produced it.
+ *
+ * @see the module header for the full resolution order and its rationale.
+ */
+export declare function resolveContextWindow(inputs: ContextWindowInputs): ContextWindowResolution;
+/**
+ * Convenience wrapper around {@link resolveContextWindow} for call sites that
+ * only need the number.
+ */
+export declare function resolveContextWindowTokens(inputs: ContextWindowInputs): number;

package/dist/config/schema.d.ts

@@ -220,6 +220,24 @@ export declare const ScoringConfigSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type ScoringConfig = z.infer<typeof ScoringConfigSchema>;
+/**
+ * LAST-RESORT context-budget denominator (tokens), used only when nothing
+ * better is available — rung 6 of the resolution order.
+ *
+ * DEFINED in `./context-window.ts` and re-exported here for the existing
+ * importers. It cannot live in this file: `context-window.ts` is loaded
+ * transitively by every context-budget consumer, and several test files replace
+ * `src/config/schema` with a non-spreading `mock.module` factory, so an import
+ * edge from `context-window.ts` into this module would make Bun throw
+ * `SyntaxError: Export named 'DEFAULT_MODEL_CONTEXT_TOKENS' not found` at
+ * import time. See the constant's own doc comment for the full history.
+ *
+ * A hardcoded denominator is wrong for any model whose window is not 128k. The
+ * budget denominator is derived from the live `model.limit.context` the host
+ * hands to `experimental.chat.system.transform`; this constant survives only as
+ * the no-information floor.
+ */
+export { DEFAULT_MODEL_CONTEXT_TOKENS } from './context-window';
 export declare const ContextBudgetConfigSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     warn_threshold: z.ZodDefault<z.ZodNumber>;

package/dist/evaluation/ephemeral-agent-dispatcher.d.ts

@@ -4,6 +4,14 @@ import { log } from '../utils/logger.js';
 import type { ModelOverride } from '../utils/model-dispatch-fallback.js';
 export declare const DEFAULT_EPHEMERAL_TIMEOUT_MS = 120000;
 export declare const DEFAULT_EPHEMERAL_CLEANUP_TIMEOUT_MS = 500;
+/**
+ * Bounded timeout for the graceful `session.abort()` step that precedes delete
+ * in the ephemeral teardown (#2123). opencode's `SessionProcessor.cleanup` can
+ * take up to ~250 ms under interruption (it awaits each pending tool-call
+ * deferred with a 250 ms timeout), so this must stay well above that or the
+ * abort would give up before the final part/message flush lands.
+ */
+export declare const DEFAULT_EPHEMERAL_ABORT_TIMEOUT_MS = 5000;
 export declare const DEFAULT_EPHEMERAL_PROMPT_BYTE_LIMIT: number;
 export declare const MAX_EPHEMERAL_PROMPT_BYTE_LIMIT: number;
 export declare const DEFAULT_EPHEMERAL_RESPONSE_BYTE_LIMIT: number;
@@ -48,8 +56,18 @@ export type EphemeralAgentDispatchResult = {
     responseBytes: number;
     costFields?: DelegationCostFields;
 };
+/**
+ * Bounded graceful abort of an ephemeral session. opencode's
+ * `POST /session/{id}/abort` resolves only after `Fiber.interrupt` on the
+ * run-loop fiber — which runs `SessionProcessor.cleanup` (the final
+ * `updatePart`/`updateMessage` flush) as a finalizer. Awaiting this BEFORE the
+ * delete is what closes the FOREIGN KEY constraint race (#2123). If the session
+ * is already idle, abort is a fast no-op. Best-effort: never throws.
+ */
+export declare function boundedAbortEphemeralSession(client: OpencodeClient, sessionId: string, timeoutMs?: number): Promise<void>;
 export declare function boundedDeleteEphemeralSession(client: OpencodeClient, sessionId: string, timeoutMs?: number): Promise<void>;
 export declare const _internals: {
+    boundedAbort: typeof boundedAbortEphemeralSession;
     boundedDelete: typeof boundedDeleteEphemeralSession;
     log: typeof log;
 };

package/dist/evaluation/model-dispatcher.d.ts

@@ -48,6 +48,7 @@ export declare function resolveEvaluationAgentName(agents: readonly Pick<Agent,
  * primitive remains the single owner of cleanup and logging behavior.
  */
 export declare const _internals: {
+    boundedAbort: typeof ephemeralDispatcherInternals.boundedAbort;
     boundedDelete: typeof ephemeralDispatcherInternals.boundedDelete;
     log: typeof ephemeralDispatcherInternals.log;
 };

package/dist/hooks/delegate-ack-collector.d.ts

@@ -7,7 +7,7 @@
  * prompt) against the ack markers in the subagent's transcript:
  *
  *   - For every ack whose ID was actually shown, emit a receipt event of the
- *     matching type (applied / ignored / violated / n_a). Acks for IDs that were
+ *     matching type (applied / ignored / contradicted / violated / n_a). Acks for IDs that were
  *     never shown are DROPPED (anti-spoofing).
  *   - For every CRITICAL directive that was shown but never acknowledged, emit a
  *     `violated` event with reason `unacknowledged` and append an audit line to

package/dist/hooks/delegation-gate/worktree-collision-ownership.d.ts

@@ -1,3 +1,10 @@
+import * as fs from 'node:fs';
+import { removeWorktreeProvisioningOwner } from './worktree-provisioning-owner';
+/** File-operation seam for deterministic fail-closed recovery tests. */
+export declare const _internals: {
+    statSync: fs.StatSyncFn;
+    removeWorktreeProvisioningOwner: typeof removeWorktreeProvisioningOwner;
+};
 export interface StandardWorktreeCollisionIdentity {
     directory: string;
     parentSessionId: string;

package/dist/hooks/delegation-gate/worktree-isolation.d.ts

@@ -12,7 +12,7 @@ import type { PluginConfig, WorktreeIsolationConfig } from '../../config';
 import { tryAcquireLock } from '../../parallel/file-locks';
 import { bunSpawn } from '../../utils/bun-compat';
 import type { WorktreeHandle } from '../../worktree';
-import { attemptMergeBackFromDirty, cleanupOrphanedBranches, postMergeCleanup, provisionWorktree, removeWorktree, startupOrphanRecovery } from '../../worktree';
+import { attemptMergeBackFromDirty, cleanupOrphanedBranches, postMergeCleanup, provisionWorktree, pruneStaleWorktreeMetadata, removeWorktree, startupOrphanRecovery } from '../../worktree';
 import type { DirtyMergeOptions, MergeOperationProvenance } from '../../worktree/merge';
 import { recordWorktreeProvisioningOwner, removeWorktreeProvisioningOwner } from './worktree-provisioning-owner';
 /**
@@ -301,6 +301,7 @@ export declare const _internals: {
     removeWorktree: typeof removeWorktree;
     attemptMergeBackFromDirty: typeof attemptMergeBackFromDirty;
     postMergeCleanup: typeof postMergeCleanup;
+    pruneStaleWorktreeMetadata: typeof pruneStaleWorktreeMetadata;
     /** FR-201: read lane runtime profile from disk for spawn injection. */
     readLaneEnvFileFromDisk: typeof readLaneEnvFileFromDisk;
     /** FR-104: exposes serializationStateBySessionID for test setup (SC-111/SC-112/SC-113). */

package/dist/hooks/delegation-gate/worktree-provisioning-owner.d.ts

@@ -1,3 +1,9 @@
+/**
+ * A provisional marker covers the bounded gap before `git worktree add`
+ * materializes the exact lane path. Once that path exists, path liveness wins
+ * and the marker remains protected regardless of age.
+ */
+export declare const WORKTREE_PROVISIONING_OWNER_LEASE_MS: number;
 export declare const WORKTREE_LIFECYCLE_LOCK_FILE = ".swarm/locks/init-orphan-recovery.lock";
 export interface WorktreeProvisioningOwner {
     schemaVersion: 1 | 2;

package/dist/hooks/index.d.ts

@@ -11,8 +11,8 @@ export { extractCurrentPhase, extractCurrentPhaseFromPlan, extractCurrentTask, e
 export { createFullAutoInterceptHook } from './full-auto-intercept';
 export { checkFileAuthority, createGuardrailsHooks, DEFAULT_AGENT_AUTHORITY_RULES, } from './guardrails';
 export { classifyMessage, classifyMessages, containsPlanContent, getCompletedToolOutputs, getToolNames, getToolParts, isDuplicateToolRead, isStaleError, isToolResult, MessagePriority, type MessagePriorityType, type MessageWithParts, } from './message-priority';
-export { consolidateSystemMessages } from './messages-transform';
-export { extractModelInfo, NATIVE_MODEL_LIMITS, PROVIDER_CAPS, resolveModelLimit, } from './model-limits';
+export { consolidateSystemMessages, consolidateSystemMessagesInPlace, } from './messages-transform';
+export { extractModelInfo, extractSessionId, lookupStaticModelLimit, NATIVE_MODEL_LIMITS, PROVIDER_CAPS, resolveModelLimit, } from './model-limits';
 export { type CuratorDelegateFactory, createPhaseMonitorHook, } from './phase-monitor';
 export { createPipelineTrackerHook } from './pipeline-tracker';
 export { createRepoGraphBuilderHook, type RepoGraphBuilderHook, } from './repo-graph-builder';

package/dist/hooks/init-orphan-recovery.d.ts

@@ -18,8 +18,9 @@ import * as fs from 'node:fs';
 import { scanDelegationFallbacksForRecovery, scanDelegationsForRecovery } from '../background/pending-delegations.js';
 import { isLocked, listActiveLocks, tryAcquireLock } from '../parallel/file-locks';
 import { removeWorktree } from '../worktree/core';
+import { scanRegisteredWorktreeLiveness } from '../worktree/merge';
 import { scanWorktreeMergeFailuresForRecovery } from './delegation-gate/worktree-merge-status';
-import { scanWorktreeProvisioningOwnersForRecovery } from './delegation-gate/worktree-provisioning-owner';
+import { removeWorktreeProvisioningOwner, scanWorktreeProvisioningOwnersForRecovery } from './delegation-gate/worktree-provisioning-owner';
 type OwnershipTagSessionScan = {
     status: 'ok';
     sessionIds: string[];
@@ -49,6 +50,8 @@ export declare const _internals: {
     scanDelegationFallbacksForRecovery: typeof scanDelegationFallbacksForRecovery;
     scanWorktreeMergeFailuresForRecovery: typeof scanWorktreeMergeFailuresForRecovery;
     scanWorktreeProvisioningOwnersForRecovery: typeof scanWorktreeProvisioningOwnersForRecovery;
+    scanRegisteredWorktreeLiveness: typeof scanRegisteredWorktreeLiveness;
+    removeWorktreeProvisioningOwner: typeof removeWorktreeProvisioningOwner;
 };
 export interface InitOrphanRecoveryResult {
     attempted: boolean;

package/dist/hooks/knowledge-application-gate.d.ts

@@ -4,7 +4,8 @@
  * Two integration points:
  *
  *   1. `experimental.chat.messages.transform` — scans the latest
- *      architect-authored message for `KNOWLEDGE_APPLIED|IGNORED|VIOLATED`
+ *      architect-authored message for
+ *      `KNOWLEDGE_APPLIED|IGNORED|CONTRADICTED|VIOLATED`
  *      markers and records them via `recordAcknowledgmentDeduped`. This
  *      runs BEFORE the architect's next tool call so the toolBefore gate
  *      sees the ack.

package/dist/hooks/knowledge-application.d.ts

@@ -1,6 +1,6 @@
 /**
  * Knowledge application tracking — distinguishes shown / acknowledged / applied
- * / ignored / violated outcomes for injected knowledge directives.
+ * / ignored / contradicted / violated outcomes for injected knowledge directives.
  *
  * Writes one JSONL line per outcome to `.swarm/knowledge-application.jsonl`,
  * and updates per-entry retrieval-outcome counters on the source knowledge file.
@@ -13,12 +13,13 @@ export declare const MAX_LEGACY_APPLICATION_LOG_ENTRIES = 5000;
  * Recognised forms (case-insensitive, line-anchored or inline):
  *   KNOWLEDGE_APPLIED: <id>
  *   KNOWLEDGE_IGNORED: <id> reason=<reason>
+ *   KNOWLEDGE_CONTRADICTED: <id> reason=<observable conflict>
  *   KNOWLEDGE_VIOLATED: <id> reason=<reason>
  *   KNOWLEDGE_N_A: <id> reason=<reason>   (delegate contract, Change 1)
  */
 export interface ParsedAcknowledgment {
     id: string;
-    result: 'applied' | 'ignored' | 'violated' | 'n_a';
+    result: 'applied' | 'ignored' | 'contradicted' | 'violated' | 'n_a';
     reason?: string;
 }
 export declare function parseAcknowledgments(text: string): ParsedAcknowledgment[];
@@ -32,7 +33,7 @@ export interface RecordContext {
 }
 /** Record one or more knowledge IDs as "shown" (injected into context). */
 export declare function recordKnowledgeShown(directory: string, ids: string[], ctx: RecordContext): Promise<void>;
-/** Record an explicit acknowledgment outcome (applied / ignored / violated).
+/** Record an explicit acknowledgment outcome (applied / ignored / contradicted / violated).
  *  Per-(sessionId, knowledgeId, result) dedup is enforced by the
  *  caller via swarmState.knowledgeAckDedup; this fn always records when
  *  invoked, so test code can trigger duplicates if needed. The runtime
@@ -57,7 +58,7 @@ export interface ShownNotAppliedQuery {
 }
 /**
  * Returns the subset of `knowledgeIds` that have at least one "shown" record
- * in the audit log without a subsequent "applied"/"ignored"/"violated" record
+ * in the audit log without a subsequent "applied"/"ignored"/"contradicted"/"violated" record
  * in the same task or phase scope.
  */
 export declare function getShownButNotAcknowledged(directory: string, q: ShownNotAppliedQuery): Promise<string[]>;

package/dist/hooks/knowledge-injector.d.ts

@@ -92,6 +92,10 @@ export declare function defaultExpectedToolsForAgent(agentName: string): string[
  * are stripped on both sides so `mega_coder` matches a bare `coder`.
  */
 export declare function matchesDelegateScope(entry: Pick<RankedEntry, 'applies_to_agents' | 'applies_to_tools'>, role: string, expectedTools: readonly string[]): boolean;
+/** Inserts the knowledge block just before the last user message (recency position). */
+declare function injectKnowledgeMessage(output: {
+    messages?: MessageWithParts[];
+}, text: string): void;
 /**
  * Creates a knowledge injection hook that injects relevant knowledge into the
  * architect's message context at phase start. Supports caching for re-injection
@@ -114,3 +118,15 @@ export declare const _internals: {
     recordLessonsShown: typeof recordLessonsShown;
     confirmEntriesPhase: typeof confirmEntriesPhase;
 };
+/**
+ * Tier-0 test seam (see `.opencode/skills/writing-tests/SKILL.md`). Exposes the
+ * real injection primitive and its sentinel so the
+ * `consolidateSystemMessages` interaction test (issue #1619) exercises the
+ * production splice position and message shape instead of a hand-copied fixture
+ * that could silently drift from this module.
+ */
+export declare const _test_exports: {
+    injectKnowledgeMessage: typeof injectKnowledgeMessage;
+    INJECTION_SENTINEL: string;
+};
+export {};

package/dist/hooks/knowledge-types.d.ts

@@ -549,7 +549,7 @@ export interface KnowledgeRetrievalContext {
     planConstraints?: string[];
     mode?: RetrievalMode;
 }
-export type KnowledgeApplicationResult = 'shown' | 'acknowledged' | 'applied' | 'ignored' | 'violated';
+export type KnowledgeApplicationResult = 'shown' | 'acknowledged' | 'applied' | 'ignored' | 'contradicted' | 'violated';
 /** One line of .swarm/knowledge-application.jsonl. */
 export interface KnowledgeApplicationRecord {
     timestamp: string;

package/dist/hooks/messages-transform.d.ts

@@ -31,4 +31,22 @@ type PartsMessage = {
 };
 export type Message = FlatMessage | PartsMessage;
 export declare function consolidateSystemMessages(messages: Message[]): Message[];
+/**
+ * In-place variant of {@link consolidateSystemMessages} for use inside an
+ * `experimental.chat.messages.transform` handler.
+ *
+ * The OpenCode host invokes each plugin hook as `M(input, output)`, **discards
+ * the handler's return value**, and afterwards reads its OWN local message
+ * array (host binary offset ~100,667,665:
+ * `yield* d.trigger("experimental.chat.messages.transform",{},{messages:C})`
+ * followed by `Me.toModelMessagesEffect(C,Z)`). Therefore
+ * `output.messages = consolidateSystemMessages(output.messages)` is a *rebind*
+ * that the host never observes — it silently did nothing in production from the
+ * day it was written until issue #1619. Only mutating the array the host handed
+ * us is observable.
+ *
+ * The consolidated result is computed BEFORE the array is cleared, because
+ * `consolidateSystemMessages` reads the same array it is passed.
+ */
+export declare function consolidateSystemMessagesInPlace(messages: Message[]): void;
 export {};

package/dist/hooks/model-limits.d.ts

@@ -1,19 +1,41 @@
 /**
- * Provider-Aware Model Limit Resolution
+ * Provider-Aware Model Limit Resolution — STATIC FALLBACK ONLY.
  *
- * Resolves context window limits based on the model and provider platform.
- * The same model has different context limits depending on the provider:
- * - Claude Sonnet 4.6: 200k native, 128k on Copilot
- * - GPT-5: 400k native, 128k on Copilot
- * - Copilot caps ALL models at 128k prompt, regardless of native limit
+ * > **The two tables below are a last resort, not the source of truth.**
+ * > The authoritative context window is the live `model.limit.context` the host
+ * > hands to `experimental.chat.system.transform`, resolved through
+ * > `src/config/context-window.ts`. That value is already provider-specific:
+ * > the host's model catalog is keyed `providers[providerID].models[modelID]`,
+ * > and the on-disk catalog shows `github-copilot`'s `claude-sonnet-4.5` and
+ * > `anthropic`'s `claude-sonnet-4-5` carrying different `limit.context`
+ * > values. These tables are consulted only when no live value reached the
+ * > call site (the `experimental.chat.messages.transform` paths on the very
+ * > first turn of a session, before any `system.transform` has run).
+ *
+ * **These tables are known-stale and are deliberately NOT used to cap the live
+ * value.** `PROVIDER_CAPS` claims Copilot caps everything at 128 000; the live
+ * catalog shows Copilot Claude entries at 200 000 (`claude-sonnet-4.5`,
+ * `claude-sonnet-4.6`) and 1 000 000 (`claude-fable-5`), with only `gpt-4.1`
+ * actually at 128 000. Min-capping a correct live value against that would
+ * reintroduce the too-small denominator the live derivation exists to remove.
+ * `NATIVE_MODEL_LIMITS` is stale in the same direction (`claude-sonnet-4` is
+ * listed at 200 000; the catalog reports 216 000).
+ *
+ * Do not "refresh" these tables by hand — that is the maintenance treadmill the
+ * live derivation replaced. They exist so a first-turn `messages.transform`
+ * consumer degrades to a plausible number instead of the flat 128 000 floor.
  */
 /**
  * Native model context limits (in tokens) when used on their native platform.
+ *
+ * Static fallback only — see the module header.
  */
 export declare const NATIVE_MODEL_LIMITS: Record<string, number>;
 /**
  * Provider-specific context caps that override native limits.
- * These are typically lower than native limits (e.g., Copilot caps at 128k).
+ *
+ * Static fallback only, and known-stale — see the module header. This is NOT
+ * applied as a ceiling over the live `model.limit.context`.
  */
 export declare const PROVIDER_CAPS: Record<string, number>;
 /**
@@ -51,46 +73,82 @@ export declare function extractModelInfo(messages: MessageWithParts[]): {
     modelID?: string;
     providerID?: string;
 };
+/**
+ * Extracts the sessionID from a `experimental.chat.messages.transform` message
+ * array, scanning newest-first.
+ *
+ * The messages hooks receive no `input.sessionID` (the plugin type declares
+ * `input: {}`), but every message's `info` carries one. This is the key used to
+ * look up the live `model.limit.context` that the `system.transform` hook
+ * recorded for the session — see `getLiveContextWindow` in `src/state.ts`.
+ *
+ * @returns the sessionID, or `undefined` when no message carries one.
+ */
+export declare function extractSessionId(messages: MessageWithParts[] | undefined): string | undefined;
+/**
+ * Static-table lookup used as `fallbackLookup` for
+ * {@link resolveContextWindow}. Preserves the historical precedence of
+ * the two tables relative to each other (provider cap first, then a
+ * longest-prefix native match), and is reachable only when no live
+ * `model.limit.context` was available.
+ */
+export declare function lookupStaticModelLimit(modelID?: string, providerID?: string): number | undefined;
 /**
  * Resolves the context limit for a given model/provider combination.
  *
- * Resolution order (first match wins):
- * 1. Check configOverrides["provider/model"] (e.g., "copilot/claude-sonnet-4-6": 200000)
- * 2. Check configOverrides[modelID] (e.g., "claude-sonnet-4-6": 200000)
- * 3. Check PROVIDER_CAPS[providerID] (e.g., copilot → 128000)
- * 4. Check NATIVE_MODEL_LIMITS with prefix matching (e.g., "claude-sonnet-4" matches "claude-sonnet-4-6-20260301")
- * 5. Check configOverrides.default
- * 6. Fall back to 128000
+ * Thin adapter over the single derivation in `src/config/context-window.ts` —
+ * this function exists so the `experimental.chat.messages.transform` consumers
+ * (`context-budget.ts`, `knowledge-injector.ts`, `tools/context-status.ts`)
+ * keep their existing `(modelID, providerID, overrides)` call shape. All
+ * ordering logic lives in the shared resolver; see its module header.
+ *
+ * Resolution order (first usable value wins):
+ * 1. `configOverrides["<providerID>/<modelID>"]`
+ * 2. `configOverrides["<modelID>"]`
+ * 3. `configOverrides.default`
+ * 4. `liveContextLimit` — the host's live `model.limit.context` for this session
+ * 5. `PROVIDER_CAPS[providerID]`, else a longest-prefix `NATIVE_MODEL_LIMITS`
+ *    match (both known-stale; see the module header)
+ * 6. `DEFAULT_MODEL_CONTEXT_TOKENS` (128000)
+ *
+ * Two ordering changes vs. the pre-#1619 implementation, both deliberate:
+ * - `configOverrides.default` moved from below the static tables to above
+ *   them. An explicitly authored user value losing to a hardcoded table was a
+ *   defect; it is now consistent with the compound and model-only keys, which
+ *   already outranked the tables.
+ * - The live `model.limit.context` was inserted above both tables, which is
+ *   the entire point of this change.
+ *
+ * Any value that is not a finite number ≥ 1000 is skipped rather than used, so
+ * a malformed override or a catalog entry with `limit.context: 0` can never
+ * produce a `NaN` / `Infinity` percentage.
  *
  * @param modelID - The model identifier (e.g., "claude-sonnet-4-6", "gpt-5")
- * @param providerID - The provider identifier (e.g., "copilot", "anthropic")
- * @param configOverrides - User configuration overrides
+ * @param providerID - The provider identifier (e.g., "github-copilot", "anthropic")
+ * @param configOverrides - User configuration overrides (`context_budget.model_limits`)
+ * @param liveContextLimit - The live `model.limit.context` recorded for this
+ *   session by the `system.transform` hook, when one has been seen
  * @returns The resolved context limit in tokens
  *
  * @example
- * // Provider cap (copilot)
- * resolveModelLimit("claude-sonnet-4-6", "copilot", {})
- * // Returns: 128000
- *
- * @example
- * // Native limit (anthropic)
- * resolveModelLimit("claude-sonnet-4-6", "anthropic", {})
+ * // Live value wins over the stale static tables
+ * resolveModelLimit("claude-sonnet-4-6", "github-copilot", {}, 200000)
  * // Returns: 200000
  *
  * @example
- * // Override beats cap
- * resolveModelLimit("gpt-5", "copilot", { "copilot/gpt-5": 200000 })
- * // Returns: 200000
+ * // Explicit user override beats the live value
+ * resolveModelLimit("gpt-5", "github-copilot", { "github-copilot/gpt-5": 60000 }, 400000)
+ * // Returns: 60000
  *
  * @example
- * // Prefix match for model variants
+ * // No live value: falls back to the static table (prefix match)
  * resolveModelLimit("claude-sonnet-4-6-20260301", "anthropic", {})
  * // Returns: 200000
  *
  * @example
- * // Full fallback
- * resolveModelLimit(undefined, undefined, {})
+ * // Malformed live value is ignored, not divided by
+ * resolveModelLimit(undefined, undefined, {}, 0)
  * // Returns: 128000
  */
-export declare function resolveModelLimit(modelID?: string, providerID?: string, configOverrides?: Record<string, number>): number;
+export declare function resolveModelLimit(modelID?: string, providerID?: string, configOverrides?: Record<string, number>, liveContextLimit?: unknown): number;
 export {};