opencode-swarm 7.139.2 → 7.139.3

package/dist/sast/semgrep.d.ts

@@ -2,6 +2,7 @@
  * Semgrep Integration for Tier B SAST Enhancement
  * Provides optional Semgrep detection and invocation for advanced static analysis
  */
+import { resolveExecutableFromPath, runExternalTool } from '../utils/external-tool-runner';
 import type { SastFinding } from './rules/index.js';
 /**
  * Semgrep CLI options
@@ -19,6 +20,8 @@ export interface SemgrepOptions {
     lang?: string;
     /** When true, use --config auto instead of local rulesDir (for profile-driven languages) */
     useAutoConfig?: boolean;
+    /** Host/tool cancellation propagated to the shared subprocess runner. */
+    abortSignal?: AbortSignal;
 }
 /**
  * Result from Semgrep execution
@@ -33,6 +36,8 @@ export interface SemgrepResult {
     /** Engine label for the findings */
     engine: 'tier_a' | 'tier_a+tier_b';
 }
+declare function resolveSemgrepBinary(): string | null;
+declare function getAvailabilityProbeCwd(): string;
 export declare const _internals: {
     isSemgrepAvailable: typeof isSemgrepAvailable;
     checkSemgrepAvailable: typeof checkSemgrepAvailable;
@@ -40,48 +45,26 @@ export declare const _internals: {
     runSemgrep: typeof runSemgrep;
     getRulesDirectory: typeof getRulesDirectory;
     hasBundledRules: typeof hasBundledRules;
-    executeWithTimeout: typeof executeWithTimeout;
+    resolveExecutableFromPath: typeof resolveExecutableFromPath;
+    resolveSemgrepBinary: typeof resolveSemgrepBinary;
+    runExternalTool: typeof runExternalTool;
+    getAvailabilityProbeCwd: typeof getAvailabilityProbeCwd;
 };
 /**
- * Check if Semgrep CLI is available on the system
- * Uses caching to avoid shelling out on every check
- * @returns true if Semgrep is available, false otherwise
+ * Synchronous compatibility surface.
+ * Returns the last confirmed async availability result when cached; otherwise
+ * falls back to a pure PATH-resolution heuristic without spawning.
  */
 export declare function isSemgrepAvailable(): boolean;
 /**
- * Check if Semgrep is available (async version for consistency)
- * @returns Promise resolving to availability status
+ * Bounded async availability probe used by the live batch path.
+ * Caches only the result of the real shared-runner probe.
  */
-export declare function checkSemgrepAvailable(): Promise<boolean>;
+export declare function checkSemgrepAvailable(cwd?: string, abortSignal?: AbortSignal): Promise<boolean>;
 /**
  * Reset the Semgrep availability cache (useful for testing)
  */
 export declare function resetSemgrepCache(): void;
-/**
- * Execute a command with timeout
- * @param command - Command to execute
- * @param args - Command arguments (safe array, no shell injection)
- * @param options - Execution options including timeout
- * @returns Promise resolving to command output
- */
-declare function executeWithTimeout(command: string, args: string[], options: {
-    cwd?: string;
-    timeoutMs: number;
-    maxOutputBytes?: number;
-    /**
-     * Test-only hook invoked once with the spawned child's pid, immediately
-     * after `spawn()` returns. Lets tests assert the child is actually
-     * reaped (not just that a placeholder exit code was set) without
-     * mocking `node:child_process` (which would leak across test files —
-     * AGENTS.md invariant 7). No production caller passes this.
-     */
-    onSpawn?: (pid: number | undefined) => void;
-}): Promise<{
-    stdout: string;
-    stderr: string;
-    exitCode: number;
-    truncated: boolean;
-}>;
 /**
  * Run Semgrep on specified files
  * @param options - Semgrep options

package/dist/services/compaction-service.d.ts

@@ -7,11 +7,13 @@
  *  - Reflection  (default 60%): re-summarise into tighter format
  *  - Emergency   (default 80%): hard truncation to system + current task + last N turns
  *
- * Consumes `swarmState.lastBudgetPct` (set by system-enhancer.ts after each budget calc).
+ * Consumes the per-session budget pct recorded by system-enhancer.ts after
+ * each budget calc (`getSessionBudgetPct`).
  * Never throws. Advisory system message injection via callback.
  */
 import type { CompactionConfig } from '../config/schema';
 export type { CompactionConfig };
+export declare const MAX_TRACKED_COMPACTION_SESSIONS = 500;
 export interface CompactionServiceHook {
     toolAfter: (input: {
         tool: string;

package/dist/session/snapshot-writer.d.ts

@@ -30,6 +30,7 @@ export interface SerializedAgentSession {
         tool: string;
         taskId: string;
         timestamp: number;
+        code?: string;
     } | null;
     partialGateWarningsIssuedForTask: string[];
     completionGateWarnedForTask: string[];

package/dist/state.d.ts

@@ -166,6 +166,7 @@ export interface AgentSessionState {
         tool: string;
         taskId: string;
         timestamp: number;
+        code?: string;
     } | null;
     /** Task IDs for which partial gate warning has already been issued (prevents per-task spam) */
     partialGateWarningsIssuedForTask: Set<string>;
@@ -596,26 +597,44 @@ export declare const swarmState: {
      * matching). Populated by `src/index.ts` after `createAgents`.
      */
     generatedAgentNames: string[];
-    /** Last known context budget percentage (0-100), updated by system-enhancer */
-    lastBudgetPct: number;
     /**
-     * The DENOMINATOR `lastBudgetPct` was computed against, in tokens. Written
-     * by system-enhancer at the same two statements that write `lastBudgetPct`,
-     * because a percentage without its denominator cannot be turned back into a
-     * token estimate. `/swarm status` used to reconstruct the estimate from a
-     * hardcoded constant, so a user whose real denominator differed saw a token
-     * figure that did not match the percentage next to it. 0 means "no budget
-     * report has run yet".
+     * Last known context budget per session — keyed by sessionID.
+     *
+     * `pct` is the budget percentage (0-100); `tokens` is the DENOMINATOR it was
+     * computed against. They are stored together because a percentage without
+     * its denominator cannot be turned back into a token estimate, and
+     * `/swarm status` renders both — reading them from different sources would
+     * show a token figure that does not match the percentage beside it.
+     *
+     * Keyed rather than global (AGENTS.md invariant 8). These were two bare
+     * module-level scalars, which was harmless only while the budget check threw
+     * on every call and left them pinned at 0. Now that the check runs, a bare
+     * global leaks across sessions: a busy session reporting 85% would trip the
+     * default-on compaction service's emergency tier — and the `>= 50%` CONTEXT
+     * PRESSURE advisory — inside an unrelated small session. compaction-service
+     * keys its *hysteresis* per session, so the wrong session's state machine
+     * would advance on another session's number.
+     *
+     * Write via `setSessionBudget`, read via `getSessionBudgetPct` /
+     * `getSessionBudgetTokens`; `/swarm status` uses `getDisplayBudget`.
      */
-    lastBudgetTokens: number;
+    lastBudgetBySession: Map<string, {
+        pct: number;
+        tokens: number;
+    }>;
     /**
-     * Live `model.limit.context` per session — keyed by sessionID, recorded by
-     * the `experimental.chat.system.transform` hook (the only hook the host
+     * Live `model.limit.context` per session — keyed by sessionID and bound to
+     * the reporting model/provider identity. Recorded by the
+     * `experimental.chat.system.transform` hook (the only hook the host
      * gives a `Model` to) and read by the `experimental.chat.messages.transform`
      * consumers, which receive messages but no model object. Bounded via
      * {@link setLiveContextWindow} (AGENTS.md invariant 8).
      */
-    liveContextWindows: Map<string, number>;
+    liveContextWindows: Map<string, {
+        tokens?: number;
+        modelID?: string;
+        providerID?: string;
+    }>;
     /** Per-session guardrail state — keyed by sessionID */
     agentSessions: Map<string, AgentSessionState>;
     /** In-flight rehydration promises — awaited by rehydrateState before clearing agentSessions */
@@ -1157,13 +1176,15 @@ export declare function getResolvedAutoProceed(session: AgentSessionState, planA
 export declare function setSessionEnvironment(sessionId: string, profile: EnvironmentProfile): void;
 export declare function getSessionEnvironment(sessionId: string): EnvironmentProfile | undefined;
 export declare function ensureSessionEnvironment(sessionId: string): EnvironmentProfile;
+export declare const MAX_TRACKED_BUDGET_SESSIONS = 500;
 export declare const MAX_TRACKED_CRITICAL_SHOWN = 500;
 export declare const MAX_TRACKED_KNOWLEDGE_ACKS = 5000;
 export declare const MAX_TRACKED_GATE_DENIALS = 500;
 export declare const MAX_TRACKED_CONTEXT_WINDOWS = 500;
 /**
  * Record the live `model.limit.context` the host reported for `sessionID`,
- * FIFO-evicting the oldest entry past {@link MAX_TRACKED_CONTEXT_WINDOWS}.
+ * bound to the reporting model/provider identity and FIFO-evicting the oldest
+ * entry past {@link MAX_TRACKED_CONTEXT_WINDOWS}.
  *
  * Only accepts a finite number ≥ 1 — the caller (`src/config/context-window.ts`
  * `isUsableContextWindow`) applies the real plausibility floor, and storing a
@@ -1171,14 +1192,44 @@ export declare const MAX_TRACKED_CONTEXT_WINDOWS = 500;
  * rejected value leaves any previously recorded window in place rather than
  * clobbering it, so one malformed turn does not blank a good reading.
  */
-export declare function setLiveContextWindow(sessionID: string | undefined, tokens: unknown): void;
+export declare function setLiveContextWindow(sessionID: string | undefined, tokens: unknown, identity?: {
+    modelID?: string;
+    providerID?: string;
+}): void;
 /**
  * Read the live context window recorded for `sessionID`, or `undefined` when
- * no `system.transform` has run for it yet (first turn of a session, or a
- * consumer that never sees a sessionID). Callers must degrade to the static
- * resolution rungs rather than assume a value.
+ * no `system.transform` has run for it yet or the requested model/provider
+ * identity does not exactly match the reporter. Callers must degrade to the
+ * static resolution rungs rather than reuse a stale handoff denominator.
  */
-export declare function getLiveContextWindow(sessionID: string | undefined): number | undefined;
+export declare function getLiveContextWindow(sessionID: string | undefined, identity?: {
+    modelID?: string;
+    providerID?: string;
+}): number | undefined;
+export declare function getLiveContextModelIdentity(sessionID: string | undefined): {
+    modelID?: string;
+    providerID?: string;
+} | undefined;
+/** Record this session's budget percentage and the denominator it was computed
+ *  against, FIFO-evicting the oldest entry if the cap is exceeded. The two are
+ *  written together so `/swarm status` can never pair a pct from one report
+ *  with a denominator from another. */
+export declare function setSessionBudget(sessionID: string, pct: number, tokens: number): void;
+/** This session's last budget percentage, or 0 if it has not been measured.
+ *  Consumers that ACT on a session (compaction, the context-pressure advisory)
+ *  MUST use this rather than any cross-session aggregate. */
+export declare function getSessionBudgetPct(sessionID: string | undefined): number;
+/** The denominator this session's percentage was computed against, or 0. */
+export declare function getSessionBudgetTokens(sessionID: string | undefined): number;
+/** The most-pressured session's budget snapshot, for process-wide DISPLAY only
+ *  (`/swarm status` has no single session in scope). Returns the pct and its
+ *  OWN denominator as a pair, so the two figures shown side by side always come
+ *  from the same report. Null when nothing has been measured yet. Never use
+ *  this to decide whether to act on a particular session. */
+export declare function getDisplayBudget(): {
+    pct: number;
+    tokens: number;
+} | null;
 /** Set the critical shown ids for a session, FIFO-evicting the oldest entry
  * if the cap is exceeded. Re-setting an existing key keeps insertion order
  * fresh for that key (delete-then-set). */

package/dist/tools/context-status.d.ts

@@ -83,7 +83,10 @@ export declare const _internals: {
  *   by the system.transform hook; `undefined` when none has been seen yet
  * @returns Context status with token usage, limit, and threshold state
  */
-declare function computeContextHeadroom(messages: ContextMessage[], warnThreshold?: number, criticalThreshold?: number, modelLimitsConfig?: Record<string, number>, liveContextLimit?: unknown): ContextStatusResult;
+declare function computeContextHeadroom(messages: ContextMessage[], warnThreshold?: number, criticalThreshold?: number, modelLimitsConfig?: Record<string, number>, liveContextLimit?: unknown, modelIdentity?: {
+    modelID?: string;
+    providerID?: string;
+}): ContextStatusResult;
 /**
  * context_status tool — read-only context window headroom report.
  *

package/dist/tools/lint.d.ts

@@ -1,8 +1,19 @@
+import * as fs from 'node:fs';
 import type { tool } from '@opencode-ai/plugin';
+import { isCommandAvailable } from '../build/discovery';
+import { type ExternalToolRunOptions, type ExternalToolRunResult } from '../utils/external-tool-runner';
 export declare const MAX_OUTPUT_BYTES = 512000;
 export declare const MAX_COMMAND_LENGTH = 500;
 export declare const SUPPORTED_LINTERS: readonly ["biome", "eslint"];
 export type SupportedLinter = (typeof SUPPORTED_LINTERS)[number];
+type ResolvedLinterSource = 'local-native' | 'local-shim' | 'safe-package-bin' | 'path-native' | 'path-shim' | 'legacy-test-probe';
+export interface ResolvedLinterCommand {
+    linter: SupportedLinter;
+    executable: string;
+    argsPrefix: string[];
+    displayPrefix: string[];
+    source: ResolvedLinterSource;
+}
 export type AdditionalLinter = 'ruff' | 'clippy' | 'golangci-lint' | 'checkstyle' | 'ktlint' | 'dotnet-format' | 'cppcheck' | 'swiftlint' | 'dart-analyze' | 'rubocop' | 'phpstan' | 'pint' | 'php-cs-fixer' | 'phpcs';
 export interface LintSuccessResult {
     success: true;
@@ -28,46 +39,61 @@ export { containsControlChars, containsPathTraversal, } from '../utils/path-secu
 export declare function validateArgs(args: unknown): args is {
     mode: 'fix' | 'check';
 };
+export declare function getBiomeBinPath(directory: string): string;
+export declare function getEslintBinPath(directory: string): string;
 export declare function getLinterCommand(linter: SupportedLinter, mode: 'fix' | 'check', projectDir: string): string[];
-/**
- * Build the shell command for an additional (non-JS/TS) linter.
- * cppcheck has no --fix mode; csharp and some others behave differently.
- */
-export declare function getAdditionalLinterCommand(linter: AdditionalLinter, mode: 'fix' | 'check', cwd: string): string[];
+export declare function resolveLinterBinPath(linter: SupportedLinter, projectDir: string): string;
+export declare function resolveLinterCommand(linter: SupportedLinter, directory: string): Promise<ResolvedLinterCommand | null>;
+export declare function detectResolvedLinter(directory?: string, abortSignal?: AbortSignal): Promise<ResolvedLinterCommand | null>;
 /**
  * Detect the first available additional (non-JS/TS) linter for the current project.
  * Returns null when no additional linter is detected or its binary is unavailable.
  */
 export declare function detectAdditionalLinter(cwd: string): 'ruff' | 'clippy' | 'golangci-lint' | 'checkstyle' | 'ktlint' | 'dotnet-format' | 'cppcheck' | 'swiftlint' | 'dart-analyze' | 'rubocop' | 'phpstan' | 'pint' | 'php-cs-fixer' | 'phpcs' | null;
-/** Compute the local biome binary path for a given project directory. */
-export declare function getBiomeBinPath(directory: string): string;
-/**
- * Resolve the binary path for a linter, using the same hierarchy as detectAvailableLinter:
- * 1. Local node_modules/.bin
- * 2. Ancestor node_modules/.bin (monorepo)
- * 3. process.env.PATH scan
- * 4. Local path as fallback (may not exist)
- */
-export declare function resolveLinterBinPath(linter: SupportedLinter, projectDir: string): string;
-/** Compute the local eslint binary path for a given project directory. */
-export declare function getEslintBinPath(directory: string): string;
 export declare function detectAvailableLinter(directory?: string): Promise<SupportedLinter | null>;
 /** Internal implementation — accepts pre-computed binary paths for testability. */
-export declare function _detectAvailableLinter(_projectDir: string, biomeBin: string, eslintBin: string): Promise<SupportedLinter | null>;
-export declare function runLint(linter: SupportedLinter, mode: 'fix' | 'check', directory: string): Promise<LintResult>;
+export declare function _detectAvailableLinter(projectDir: string, biomeBin: string, eslintBin: string): Promise<SupportedLinter | null>;
+declare function runResolvedLint(command: ResolvedLinterCommand, mode: 'fix' | 'check', directory: string, abortSignal?: AbortSignal): Promise<LintResult>;
+/**
+ * Build the shell command for an additional (non-JS/TS) linter.
+ * cppcheck has no --fix mode; csharp and some others behave differently.
+ */
+export declare function getAdditionalLinterCommand(linter: AdditionalLinter, mode: 'fix' | 'check', cwd: string): string[] | null;
+export declare function runLint(linter: SupportedLinter, mode: 'fix' | 'check', directory: string, abortSignal?: AbortSignal): Promise<LintResult>;
 /**
  * Run an additional (non-JS/TS) linter.
  * Follows the same structure as runLint() but uses getAdditionalLinterCommand().
  */
-export declare function runAdditionalLint(linter: AdditionalLinter, mode: 'fix' | 'check', cwd: string): Promise<LintResult>;
+export declare function runAdditionalLint(linter: AdditionalLinter, mode: 'fix' | 'check', cwd: string, abortSignal?: AbortSignal): Promise<LintResult>;
 export declare const lint: ReturnType<typeof tool>;
 /**
  * DI seam for testability. Contains all test-mocked exports.
  * Internal calls should use _internals.fn() instead of fn() directly.
  */
 export declare const _internals: {
-    detectAvailableLinter: typeof detectAvailableLinter;
-    runLint: typeof runLint;
+    MAX_PACKAGE_MANIFEST_BYTES: number;
+    MAX_PATH_SHIM_BYTES: number;
+    arch: () => string;
+    closeSync: typeof fs.closeSync;
+    comSpec: () => string | undefined;
     detectAdditionalLinter: typeof detectAdditionalLinter;
+    detectAvailableLinter: typeof detectAvailableLinter;
+    detectResolvedLinter: typeof detectResolvedLinter;
+    execPath: () => string;
+    existsSync: typeof fs.existsSync;
+    fstatSync: typeof fs.fstatSync;
+    isCommandAvailable: typeof isCommandAvailable;
+    openSync: typeof fs.openSync;
+    pathEnv: () => string;
+    platform: () => NodeJS.Platform;
+    readFileSync: typeof fs.readFileSync;
+    readSync: typeof fs.readSync;
+    readdirSync: typeof fs.readdirSync;
+    realpathSync: typeof fs.realpathSync;
+    resolveLinterCommand: typeof resolveLinterCommand;
     runAdditionalLint: typeof runAdditionalLint;
+    runExternalTool: (options: ExternalToolRunOptions) => Promise<ExternalToolRunResult>;
+    runLint: typeof runLint;
+    runResolvedLint: typeof runResolvedLint;
+    statSync: typeof fs.statSync;
 };

package/dist/tools/pre-check-batch.d.ts

@@ -6,7 +6,9 @@
 import type { tool } from '@opencode-ai/plugin';
 import type { PluginConfig } from '../config';
 import { saveEvidence } from '../evidence/manager.js';
-import type { LintResult } from './lint';
+import { runExternalTool } from '../utils/external-tool-runner';
+import type { LintResult, ResolvedLinterCommand } from './lint';
+import { detectResolvedLinter } from './lint';
 import type { QualityBudgetResult } from './quality-budget';
 import { qualityBudget } from './quality-budget';
 import type { SastScanFinding, SastScanResult } from './sast-scan';
@@ -17,8 +19,15 @@ export declare const _internals: {
     runSecretscanWrapped: typeof runSecretscanWrapped;
     runSastScanWrapped: typeof runSastScanWrapped;
     runQualityBudgetWrapped: typeof runQualityBudgetWrapped;
+    runWithTimeout: typeof runWithTimeout;
     getChangedLineRanges: typeof getChangedLineRanges;
     saveEvidence: typeof saveEvidence;
+    runExternalTool: typeof runExternalTool;
+    detectResolvedLinter: typeof detectResolvedLinter;
+    runLintOnFiles: typeof runLintOnFiles;
+    platform: () => NodeJS.Platform;
+    serializePreCheckResult: typeof serializePreCheckResult;
+    MAX_COMBINED_BYTES: number;
 };
 export interface PreCheckBatchInput {
     /** List of specific files to check (optional) */
@@ -45,10 +54,14 @@ export interface ToolResult<T> {
     result?: T;
     /** Error message if failed */
     error?: string;
+    /** Successful result payload was omitted from a compact serialized response. */
+    result_omitted?: boolean;
     /** Duration in milliseconds */
     duration_ms: number;
 }
 export interface PreCheckBatchResult {
+    /** Structured producer status. Optional only for legacy serialized results. */
+    batch_status?: 'completed' | 'skipped' | 'invalid';
     /** Overall gate status: true if all security gates pass */
     gates_passed: boolean;
     /** Lint tool result */
@@ -64,36 +77,47 @@ export interface PreCheckBatchResult {
     /** Pre-existing SAST findings on unchanged lines, requiring reviewer triage */
     sast_preexisting_findings?: SastScanFinding[];
 }
+/**
+ * Serialize the public result below the decoder's stricter byte ceiling. When
+ * detailed diagnostics exceed the aggregate budget, preserve every control
+ * field and replace optional payloads with bounded, UTF-8-safe summaries.
+ */
+declare function serializePreCheckResult(result: PreCheckBatchResult): string;
+/**
+ * Run a function with timeout
+ */
+declare function runWithTimeout<T>(operation: (abortSignal: AbortSignal) => Promise<T>, timeoutMs: number, parentSignal?: AbortSignal, waitForCancellationSettlement?: boolean): Promise<T>;
 /**
  * Run lint with detection and timeout
  */
-declare function runLintWrapped(files: string[] | undefined, directory: string, _config?: PluginConfig): Promise<ToolResult<LintResult>>;
+declare function runLintWrapped(files: string[] | undefined, directory: string, _config?: PluginConfig, abortSignal?: AbortSignal): Promise<ToolResult<LintResult>>;
+/**
+ * Run lint on specific files only
+ */
+declare function runLintOnFiles(resolvedLinter: ResolvedLinterCommand, files: string[], workspaceDir: string, abortSignal?: AbortSignal): Promise<LintResult>;
 /**
  * Run secretscan with timeout
  */
-declare function runSecretscanWrapped(files: string[] | undefined, directory: string, _config?: PluginConfig): Promise<ToolResult<SecretscanResult | SecretscanErrorResult>>;
+declare function runSecretscanWrapped(files: string[] | undefined, directory: string, _config?: PluginConfig, abortSignal?: AbortSignal): Promise<ToolResult<SecretscanResult | SecretscanErrorResult>>;
 /**
  * Run SAST scan with timeout
  */
-declare function runSastScanWrapped(changedFiles: string[], directory: string, severityThreshold: 'low' | 'medium' | 'high' | 'critical', config?: PluginConfig, phase?: number): Promise<ToolResult<SastScanResult>>;
+declare function runSastScanWrapped(changedFiles: string[], directory: string, severityThreshold: 'low' | 'medium' | 'high' | 'critical', config?: PluginConfig, phase?: number, abortSignal?: AbortSignal): Promise<ToolResult<SastScanResult>>;
 /**
  * Run quality budget with timeout
  */
-declare function runQualityBudgetWrapped(changedFiles: string[], directory: string, config?: PluginConfig): Promise<ToolResult<QualityBudgetResult>>;
+declare function runQualityBudgetWrapped(changedFiles: string[], directory: string, config?: PluginConfig, abortSignal?: AbortSignal): Promise<ToolResult<QualityBudgetResult>>;
 /**
  * Parse unified diff output (with -U0) to extract added/modified line numbers per file.
  * Returns a Map from normalised file path → Set of changed line numbers.
  */
 export declare function parseDiffLineRanges(diffOutput: string): Map<string, Set<number>>;
 /**
- * Get changed line ranges for the current branch vs its base.
- * Tries three strategies in order:
- * 1. merge-base diff against main/master (captures all branch changes, works after commit)
- * 2. HEAD~1 (single-commit diff, works after commit)
- * 3. HEAD (unstaged/staged changes, works before commit)
- * Returns null if git is unavailable or no changes found.
+ * Get the union of committed, staged, unstaged, and untracked changed lines.
+ * A known empty union is authoritative; null means a required Git source was
+ * unavailable or malformed and callers must classify findings fail-closed.
  */
-export declare function getChangedLineRanges(directory: string): Promise<Map<string, Set<number>> | null>;
+export declare function getChangedLineRanges(directory: string, abortSignal?: AbortSignal, requestedFiles?: string[]): Promise<Map<string, Set<number>> | null>;
 /**
  * Classify SAST findings as "new" (on changed lines) or "pre-existing" (unchanged lines).
  * A finding is "new" if its file+line intersects the changed line ranges from git diff.
@@ -108,7 +132,7 @@ export declare function classifySastFindings(findings: SastScanFinding[], change
  * @param input - The pre-check batch input
  * @param workspaceDir - Optional workspace directory for traversal validation (injected project root from createSwarmTool, or input.directory)
  */
-export declare function runPreCheckBatch(input: PreCheckBatchInput, workspaceDir?: string, contextDir?: string): Promise<PreCheckBatchResult>;
+export declare function runPreCheckBatch(input: PreCheckBatchInput, workspaceDir?: string, contextDir?: string, abortSignal?: AbortSignal): Promise<PreCheckBatchResult>;
 /**
  * Pre-check batch tool - runs 4 verification tools in parallel
  * Returns unified result with gates_passed status

package/dist/tools/quality-budget.d.ts

@@ -1,6 +1,6 @@
 import type { tool } from '@opencode-ai/plugin';
 import type { QualityBudgetConfig } from '../config/schema';
-import { type QualityMetrics, type QualityViolation } from '../quality/metrics';
+import { computeQualityMetrics, type QualityMetrics, type QualityViolation } from '../quality/metrics';
 export interface QualityBudgetInput {
     changed_files: string[];
     config?: Partial<QualityBudgetConfig>;
@@ -22,7 +22,7 @@ export interface QualityBudgetResult {
  * Computes quality metrics (complexity, API, duplication, test ratio)
  * and compares against configured thresholds to ensure code quality.
  */
-export declare function qualityBudget(input: QualityBudgetInput, directory: string): Promise<QualityBudgetResult>;
+export declare function qualityBudget(input: QualityBudgetInput, directory: string, abortSignal?: AbortSignal): Promise<QualityBudgetResult>;
 export declare const quality_budget: ReturnType<typeof tool>;
 /**
  * DI seam for testability. Contains all test-mocked exports.
@@ -30,4 +30,5 @@ export declare const quality_budget: ReturnType<typeof tool>;
  */
 export declare const _internals: {
     qualityBudget: typeof qualityBudget;
+    computeQualityMetrics: typeof computeQualityMetrics;
 };

package/dist/tools/sast-baseline.d.ts

@@ -116,6 +116,7 @@ export declare function assignOccurrenceIndices(findings: SastScanFinding[], dir
  */
 export declare function captureOrMergeBaseline(directory: string, phase: number, findings: SastScanFinding[], engine: 'tier_a' | 'tier_a+tier_b', scannedFiles: string[], opts?: {
     force?: boolean;
+    abortSignal?: AbortSignal;
 }): Promise<CaptureResult>;
 /**
  * Load the SAST baseline for a given phase.

package/dist/tools/sast-scan.d.ts

@@ -5,7 +5,7 @@
 import type { ToolDefinition } from '@opencode-ai/plugin/tool';
 import type { PluginConfig } from '../config';
 import type { EvidenceVerdict } from '../config/evidence-schema';
-import { isSemgrepAvailable, runSemgrep } from '../sast/semgrep';
+import { checkSemgrepAvailable, isSemgrepAvailable, runSemgrep } from '../sast/semgrep';
 export interface SastScanInput {
     /** List of files to scan */
     changed_files: string[];
@@ -32,6 +32,8 @@ export interface SastScanInput {
      * baseline diff mode: only findings absent from the phase baseline fail.
      */
     phase?: number;
+    /** Host/tool cancellation propagated to optional external scanners. */
+    abort_signal?: AbortSignal;
 }
 export interface SastScanResult {
     /** Overall verdict: pass if no findings above threshold, fail otherwise */
@@ -101,6 +103,7 @@ export declare const sast_scan: ToolDefinition;
 export declare const _internals: {
     sastScan: typeof sastScan;
     sast_scan: typeof sast_scan;
+    checkSemgrepAvailable: typeof checkSemgrepAvailable;
     isSemgrepAvailable: typeof isSemgrepAvailable;
     runSemgrep: typeof runSemgrep;
 };

package/dist/tools/secretscan.d.ts

@@ -67,10 +67,10 @@ export declare const _internals: {
     now: () => number;
     yieldToEventLoop: typeof yieldToEventLoop;
     openFile: typeof fs.openSync;
-    fstatFile: typeof fs.fstatSync;
+    fstatFile: (fd: number) => fs.BigIntStats;
     readFileChunk: typeof fs.readSync;
     closeFile: typeof fs.closeSync;
-    lstatFile: typeof fs.lstatSync;
+    lstatFile: (path: fs.PathLike) => fs.BigIntStats;
     closeDirectory: (directory: fs.Dir) => void;
 };
 export {};

package/dist/tools/set-qa-gates.d.ts

@@ -2,11 +2,12 @@
  * Tool to configure the QA gate profile for the current plan.
  *
  * Architect-only: invoked during the QA GATE SELECTION phase of brainstorm
- * mode (or equivalent). Ratchet-tighter only — cannot disable gates that are
- * already enabled. Rejects all writes once the profile is locked.
+ * mode (or equivalent). The initial selection may override defaults; after a
+ * profile exists, updates are ratchet-tighter and cannot disable enabled gates.
+ * Rejects all writes once the profile is locked.
  *
- * Creates the profile with defaults if missing, then applies the requested
- * partial update.
+ * Creates the profile with defaults plus the initial selection if missing,
+ * then always applies the requested partial update through the normal ratchet.
  */
 import type { tool } from '@opencode-ai/plugin';
 export interface SetQaGatesArgs {

package/dist/utils/bun-compat.d.ts

@@ -24,6 +24,7 @@
  *   - `bunHash` uses Node's `xxhash` via `Bun.hash`'s default algorithm when
  *     present and falls back to a stable djb2-derived 32-bit hash on Node.
  */
+import { spawn as nodeSpawn } from 'node:child_process';
 /**
  * Whether the current runtime is Bun. Cached at first call — every subsequent
  * call is a single property access.
@@ -86,6 +87,8 @@ export interface BunCompatSpawnOptions {
     stdout?: 'inherit' | 'ignore' | 'pipe';
     stderr?: 'inherit' | 'ignore' | 'pipe';
     timeout?: number;
+    /** Preserve the caller's exact Windows argv quoting (required for cmd.exe /c). */
+    windowsVerbatimArguments?: boolean;
     /**
      * When true, spawn the child as its own process-group leader (Node path:
      * `detached`) and kill the entire descendant tree on `kill()`/timeout
@@ -113,8 +116,24 @@ export interface BunCompatSubprocess {
     readonly stderr: BunCompatStream;
     readonly exited: Promise<number>;
     exitCode: number | null;
+    readonly signalCode?: NodeJS.Signals | null;
+    /**
+     * Asynchronous process-creation failure reported by Node's ChildProcess
+     * `error` event (for example ENOENT). Bun reports equivalent failures by
+     * throwing from `Bun.spawn`, so this is populated only by the Node fallback.
+     */
+    readonly spawnError?: Error | null;
     kill(signal?: NodeJS.Signals | number): void;
+    /** Awaitable best-effort descendant-tree termination for bounded runners. */
+    killTree?(signal?: NodeJS.Signals | number): Promise<void>;
 }
+declare function createProcessTreeKiller(pid: number | undefined, directKill: (signal?: NodeJS.Signals | number) => void, wasDetached: boolean): (signal?: NodeJS.Signals | number) => Promise<void>;
+export declare const _internals: {
+    platform: () => NodeJS.Platform;
+    cwd: () => string;
+    spawnTaskkill: (args: string[], options: Parameters<typeof nodeSpawn>[2]) => import("node:child_process").ChildProcess;
+    createProcessTreeKiller: typeof createProcessTreeKiller;
+};
 /**
  * Merges `envOverrides` into the base env (or `process.env` if no base env
  * is given) and returns the resulting record.
@@ -150,3 +169,4 @@ export declare function bunSpawnSync(cmd: string[] | {
     stdin?: string | Uint8Array;
     timeout?: number;
 }, options?: BunCompatSpawnOptions): BunCompatSyncResult;
+export {};

package/dist/utils/external-tool-runner.d.ts

@@ -8,6 +8,8 @@ export interface ExternalToolRunOptions {
     maxStderrBytes: number;
     env?: Record<string, string | undefined>;
     abortSignal?: AbortSignal;
+    /** Preserve an already-quoted Windows command line, such as constrained cmd.exe /c. */
+    windowsVerbatimArguments?: boolean;
 }
 export interface ExternalToolRunResult {
     status: 'completed' | 'timeout' | 'cancelled' | 'spawn-error';
@@ -19,8 +21,16 @@ export interface ExternalToolRunResult {
     message?: string;
 }
 export declare function resolveExecutableFromPath(names: string[], envPath?: string, platform?: NodeJS.Platform): string | null;
+declare function clampTimeoutMs(timeoutMs: number): number;
+declare function computeSpawnTimeoutMs(timeoutMs: number): number;
 export declare function runExternalTool(options: ExternalToolRunOptions): Promise<ExternalToolRunResult>;
 export declare const _internals: {
     bunSpawn: typeof bunSpawn;
     platform: () => NodeJS.Platform;
+    now: () => number;
+    setTimeout: typeof setTimeout;
+    clearTimeout: typeof clearTimeout;
+    clampTimeoutMs: typeof clampTimeoutMs;
+    computeSpawnTimeoutMs: typeof computeSpawnTimeoutMs;
 };
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.139.2",
+	"version": "7.139.3",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",