opencode-swarm 7.139.2 → 7.139.4

package/dist/cli/index-s0qc4gj6.js

@@ -0,0 +1,298 @@
+// @bun
+import {
+  require_proper_lockfile
+} from "./index-7g4c7s5r.js";
+import {
+  init_logger,
+  warn
+} from "./index-zgwm4ryv.js";
+import {
+  emit
+} from "./index-rsrx77fg.js";
+import {
+  __toESM
+} from "./index-a76rekgs.js";
+
+// src/utils/project-boundary.ts
+init_logger();
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+var MAX_PROJECT_ROOT_DEPTH = 20;
+var PROJECT_ROOT_INDICATORS = [
+  "package.json",
+  ".git",
+  ".opencode",
+  "Cargo.toml",
+  "go.mod",
+  "pyproject.toml",
+  "Gemfile",
+  "composer.json",
+  "pom.xml",
+  "build.gradle",
+  "CMakeLists.txt"
+];
+var PROJECT_BOUNDARY_MARKERS = [
+  {
+    name: ".git",
+    accepts: (stat) => stat.isFile() || stat.isDirectory()
+  },
+  { name: ".opencode", accepts: (stat) => stat.isDirectory() }
+];
+function isAbsoluteDirectoryInput(value) {
+  return typeof value === "string" && value.trim().length > 0 && path.isAbsolute(value);
+}
+function hasExplicitProjectBoundary(directory) {
+  if (!isAbsoluteDirectoryInput(directory))
+    return false;
+  for (const marker of PROJECT_BOUNDARY_MARKERS) {
+    try {
+      const stat = _internals.lstatSync(path.join(directory, marker.name));
+      if (!stat.isSymbolicLink() && marker.accepts(stat))
+        return true;
+    } catch {}
+  }
+  return false;
+}
+function isStrictPathDescendant(candidate, root) {
+  if (!isAbsoluteDirectoryInput(candidate) || !isAbsoluteDirectoryInput(root)) {
+    return false;
+  }
+  const relative2 = path.relative(root, candidate);
+  return relative2 !== "" && relative2 !== ".." && !relative2.startsWith(`..${path.sep}`) && !path.isAbsolute(relative2);
+}
+function isMissingPathError(error) {
+  const code = error?.code;
+  return code === "ENOENT" || code === "ENOTDIR";
+}
+function isWeakConfigContainerRoot(directory, dependencies) {
+  try {
+    const resolved = dependencies.realpathSync(directory);
+    return resolved === dependencies.realpathSync(os.tmpdir()) || resolved === dependencies.realpathSync(os.homedir());
+  } catch {
+    const resolved = path.resolve(directory);
+    return resolved === path.resolve(os.tmpdir()) || resolved === path.resolve(os.homedir());
+  }
+}
+function projectIndicatorState(directory, dependencies, options = {}) {
+  const allowConfigOnly = options.allowConfigOnly ?? true;
+  for (const indicator of PROJECT_ROOT_INDICATORS) {
+    if (!allowConfigOnly && indicator === ".opencode")
+      continue;
+    try {
+      const indicatorStat = dependencies.statSync(path.join(directory, indicator));
+      if (indicatorStat.isFile() || indicatorStat.isDirectory())
+        return "present";
+    } catch (error) {
+      if (!isMissingPathError(error))
+        return "inaccessible";
+    }
+  }
+  return "absent";
+}
+function assertProjectRoot(directory, dependencies = fs, artifactLabel = "runtime state") {
+  let resolved;
+  try {
+    resolved = dependencies.realpathSync(directory);
+  } catch {
+    warn(`[project-boundary] Cannot canonicalize directory "${directory}" \u2014 failing closed`);
+    throw new Error(`Cannot verify project root for "${directory}" \u2014 directory may not exist or is inaccessible`);
+  }
+  if (hasExplicitProjectBoundary(resolved))
+    return;
+  let current = resolved;
+  let depth = 0;
+  while (true) {
+    if (depth >= MAX_PROJECT_ROOT_DEPTH) {
+      warn(`[project-boundary] Ancestor search exceeded ${MAX_PROJECT_ROOT_DEPTH} levels for "${resolved}" \u2014 failing closed`);
+      throw new Error(`Cannot verify project root for "${resolved}" \u2014 ancestor search exceeded ${MAX_PROJECT_ROOT_DEPTH} levels`);
+    }
+    depth++;
+    const parent = path.dirname(current);
+    if (parent === current)
+      break;
+    if (path.dirname(parent) === parent) {
+      current = parent;
+      continue;
+    }
+    const parentSwarm = path.join(parent, ".swarm");
+    let parentSwarmStat;
+    try {
+      parentSwarmStat = dependencies.statSync(parentSwarm);
+    } catch (error) {
+      if (isMissingPathError(error)) {
+        current = parent;
+        continue;
+      }
+      warn(`[project-boundary] Cannot inspect ancestor state "${parentSwarm}" \u2014 failing closed`);
+      throw new Error(`Cannot verify project root for "${resolved}" \u2014 ancestor state "${parentSwarm}" is inaccessible`);
+    }
+    if (parentSwarmStat.isDirectory()) {
+      const indicatorState = projectIndicatorState(parent, dependencies, {
+        allowConfigOnly: !isWeakConfigContainerRoot(parent, dependencies)
+      });
+      if (indicatorState === "inaccessible") {
+        warn(`[project-boundary] Cannot inspect project indicators in ancestor "${parent}" \u2014 failing closed`);
+        throw new Error(`Cannot verify project root for "${resolved}" \u2014 project indicators in ancestor "${parent}" are inaccessible`);
+      }
+      if (indicatorState === "present") {
+        warn(`[project-boundary] Rejecting write to subdirectory "${resolved}" \u2014 parent "${parent}" already contains .swarm/`);
+        throw new Error(`Cannot write ${artifactLabel} in "${resolved}" \u2014 parent directory "${parent}" already contains a .swarm/ folder. Runtime state must be written to the project root.`);
+      }
+    }
+    current = parent;
+  }
+}
+var _internals = {
+  lstatSync: fs.lstatSync
+};
+
+// src/parallel/file-locks.ts
+var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
+import * as crypto from "crypto";
+import * as fs2 from "fs";
+import * as path2 from "path";
+var LOCKS_DIR = ".swarm/locks";
+var LOCK_TIMEOUT_MS = 5 * 60 * 1000;
+var _internals2 = {
+  tryAcquireLock,
+  writeFile: fs2.promises.writeFile
+};
+function getLockFilePath(directory, filePath) {
+  const normalized = path2.resolve(directory, filePath);
+  const baseDir = path2.resolve(directory) + path2.sep;
+  const pathOk = process.platform === "win32" ? normalized.toLowerCase().startsWith(baseDir.toLowerCase()) : normalized.startsWith(baseDir);
+  if (!pathOk) {
+    throw new Error("Invalid file path: path traversal not allowed");
+  }
+  const pathForHash = process.platform === "win32" ? normalized.toLowerCase() : normalized;
+  const hash = crypto.createHash("sha256").update(pathForHash).digest("hex");
+  const lockPath = path2.join(directory, LOCKS_DIR, `${hash}.lock`);
+  const legacyPaths = [pathForHash];
+  if (process.platform === "win32" && normalized !== pathForHash) {
+    legacyPaths.push(normalized);
+  }
+  for (const legacyPath of legacyPaths) {
+    const oldHash = Buffer.from(legacyPath).toString("base64").replace(/[/+=]/g, "_");
+    const oldLockPath = path2.join(directory, LOCKS_DIR, `${oldHash}.lock`);
+    if (fs2.existsSync(oldLockPath)) {
+      return oldLockPath;
+    }
+  }
+  return lockPath;
+}
+async function tryAcquireLock(directory, filePath, agent, taskId) {
+  const lockPath = getLockFilePath(directory, filePath);
+  const locksDir = path2.dirname(lockPath);
+  if (!fs2.existsSync(locksDir)) {
+    fs2.mkdirSync(locksDir, { recursive: true });
+  }
+  if (!fs2.existsSync(lockPath)) {
+    fs2.writeFileSync(lockPath, "", "utf-8");
+  }
+  let release;
+  try {
+    release = await import_proper_lockfile.default.lock(lockPath, {
+      stale: LOCK_TIMEOUT_MS,
+      retries: {
+        retries: 5,
+        minTimeout: 10,
+        maxTimeout: 500,
+        factor: 2
+      },
+      realpath: false
+    });
+  } catch (err) {
+    const code = err.code;
+    if (code === "ELOCKED" || code === "EEXIST") {
+      return { acquired: false };
+    }
+    throw err;
+  }
+  const lock = {
+    filePath,
+    agent,
+    taskId,
+    timestamp: new Date().toISOString(),
+    expiresAt: Date.now() + LOCK_TIMEOUT_MS,
+    _release: release
+  };
+  return { acquired: true, lock };
+}
+
+// src/evidence/lock.ts
+class EvidenceLockTimeoutError extends Error {
+  directory;
+  evidencePath;
+  agent;
+  taskId;
+  constructor(directory, evidencePath, agent, taskId, timeoutMs) {
+    super(`Evidence lock timeout after ${timeoutMs}ms for ${evidencePath} (agent=${agent}, task=${taskId})`);
+    this.name = "EvidenceLockTimeoutError";
+    this.directory = directory;
+    this.evidencePath = evidencePath;
+    this.agent = agent;
+    this.taskId = taskId;
+  }
+}
+var BACKOFF_START_MS = 50;
+var BACKOFF_MAX_MS = 2000;
+var BACKOFF_JITTER_RATIO = 0.25;
+function backoffMs(attempt) {
+  const base = Math.min(BACKOFF_START_MS * 2 ** attempt, BACKOFF_MAX_MS);
+  const jitter = base * BACKOFF_JITTER_RATIO * (Math.random() * 2 - 1);
+  return Math.max(1, Math.round(base + jitter));
+}
+async function withEvidenceLock(directory, evidencePath, agent, taskId, fn, timeoutMs = 60000) {
+  assertProjectRoot(directory);
+  const deadline = Date.now() + timeoutMs;
+  let attempt = 0;
+  while (true) {
+    const result = await tryAcquireLock(directory, evidencePath, agent, taskId);
+    if (result.acquired) {
+      const lock = result.lock;
+      if (attempt > 0) {
+        emit("evidence_lock_stale_recovered", {
+          directory,
+          evidencePath,
+          agent,
+          taskId,
+          attempt
+        });
+      }
+      emit("evidence_lock_acquired", {
+        directory,
+        evidencePath,
+        agent,
+        taskId,
+        attempt
+      });
+      try {
+        return await fn();
+      } finally {
+        if (lock._release) {
+          try {
+            await lock._release();
+          } catch {}
+        }
+      }
+    }
+    if (Date.now() >= deadline) {
+      throw new EvidenceLockTimeoutError(directory, evidencePath, agent, taskId, timeoutMs);
+    }
+    emit("evidence_lock_contended", {
+      directory,
+      evidencePath,
+      agent,
+      taskId,
+      attempt
+    });
+    const delay = Math.min(backoffMs(attempt), deadline - Date.now());
+    if (delay > 0) {
+      await new Promise((resolve3) => setTimeout(resolve3, delay));
+    }
+    attempt++;
+  }
+}
+
+export { tryAcquireLock, hasExplicitProjectBoundary, isStrictPathDescendant, assertProjectRoot, withEvidenceLock };

package/dist/cli/{index-q11t5erh.js → index-s58vghgj.js}

@@ -1,4 +1,8 @@
 // @bun
+import {
+  advisoryWarn,
+  init_warning_buffer
+} from "./index-4rhhvd1a.js";
 import {
   ExternalSkillsConfigSchema,
   GATE_CONFIG_KNOWN_SECTION_KEYS,
@@ -6,15 +10,11 @@ import {
   PluginConfigSchema,
   init_schema,
   resolveExternalSkillsConfig
-} from "./index-8p9pasnp.js";
-import {
-  advisoryWarn,
-  init_warning_buffer
-} from "./index-4rhhvd1a.js";
+} from "./index-5s23pfsy.js";
 import {
   DEFAULT_WORKTREE_ISOLATION_CONFIG,
   init_constants
-} from "./index-3jcyn8g6.js";
+} from "./index-4wjk296r.js";
 import {
   MAX_MERGE_DEPTH,
   deepMerge,
@@ -717,4 +717,4 @@ function resolveWorktreeIsolationConfig(config) {
 // src/config/index.ts
 var _internals = { loadPluginConfigWithMeta };
 
-export { resolveWorktreeIsolationConfig, loadPluginConfig, loadPluginConfigWithMeta, getSafeDefaultConfigLoadResult, loadPluginConfigWithMetaAsync, loadAgentPrompt, exports_loader, init_loader, _internals };
+export { loadPluginConfig, loadPluginConfigWithMeta, getSafeDefaultConfigLoadResult, loadPluginConfigWithMetaAsync, loadAgentPrompt, exports_loader, init_loader, resolveWorktreeIsolationConfig, _internals };

package/dist/cli/{index-se8xc78k.js → index-sa15nfgg.js}

@@ -1,10 +1,10 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-6c5f309q.js";
+} from "./index-gfmrw2f5.js";
 import {
   handleGuardrailLog
-} from "./index-8gftfvpp.js";
+} from "./index-xb1zq933.js";
 import {
   COMMAND_REGISTRY,
   SWARM_COMMAND_TOOL_ALLOWLIST,
@@ -84,67 +84,67 @@ import {
   handleWriteRetroCommand,
   normalizeSwarmCommandInput,
   resolveCommand
-} from "./index-a7nh382r.js";
-import"./index-vm4xw9z3.js";
-import"./index-wrt6m5ze.js";
-import"./index-y64jv2pe.js";
-import"./index-y47dwge1.js";
-import"./index-0wp67gqj.js";
-import"./index-s608d3hw.js";
+} from "./index-vyqd1hzm.js";
+import"./index-41hkt36g.js";
+import"./index-sd657fkp.js";
+import"./index-ejbcpbzp.js";
+import"./index-e1k9vpqn.js";
+import"./index-6nzmp937.js";
+import"./index-nrx08gcr.js";
 import"./index-y8552snf.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
-import"./index-ktagrqxw.js";
-import"./index-w71cq27a.js";
-import"./index-6w1re1qn.js";
+import"./index-pg84msyc.js";
+import"./index-0e95eck5.js";
+import"./index-9cdj4020.js";
 import"./index-6mjf4vr1.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
-import"./index-wsdnttf4.js";
-import"./index-5w7ekpy3.js";
-import"./index-ffpmqx30.js";
-import"./index-3radty3f.js";
+import"./index-0xkjhgrf.js";
+import"./index-xmhhhjjw.js";
+import"./index-556ja8an.js";
+import"./index-6rxgb5r9.js";
+import"./index-1kyex7z2.js";
+import"./index-b8zgtz81.js";
+import"./index-6z0a940s.js";
+import"./index-j77frjq8.js";
+import"./index-k46me75h.js";
+import"./index-ee3x66a5.js";
+import"./index-74hpm6sh.js";
+import"./index-5z2xps64.js";
+import"./index-8fwhhayc.js";
+import"./index-q1exe2b3.js";
+import"./index-jnfyxeap.js";
+import"./index-5azdnaty.js";
 import"./index-rtry5xyf.js";
-import"./index-cyw81ngh.js";
-import"./index-e9tx99ds.js";
+import"./index-6vh6vrnk.js";
+import"./index-k41dn8me.js";
 import"./index-ae75rja9.js";
-import"./index-668dpw5e.js";
-import"./index-gvhvz176.js";
-import"./index-q11t5erh.js";
+import"./index-33skgk1a.js";
+import"./index-6r522srn.js";
+import"./index-ed5ykebp.js";
+import"./index-s0qc4gj6.js";
+import"./index-7g4c7s5r.js";
+import"./index-4nt52yr9.js";
+import"./index-s58vghgj.js";
 import"./index-gprxjmm7.js";
 import"./index-n832052r.js";
+import"./index-1kz6da87.js";
+import"./index-4rhhvd1a.js";
+import"./index-zgwm4ryv.js";
 import {
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-8p9pasnp.js";
-import"./index-bk5tah7q.js";
-import"./index-8fwhhayc.js";
-import"./index-q1exe2b3.js";
-import"./index-5zyk8qgv.js";
-import"./index-3eddtgxt.js";
-import"./index-556ja8an.js";
-import"./index-4xbyy6aw.js";
-import"./index-1kz6da87.js";
-import"./index-q7ezzgwq.js";
-import"./index-b8zgtz81.js";
-import"./index-a12906mj.js";
-import"./index-4rhhvd1a.js";
+} from "./index-5s23pfsy.js";
 import {
   AGENT_TOOL_MAP,
   ORCHESTRATOR_NAME,
   init_constants
-} from "./index-3jcyn8g6.js";
-import"./index-prmb5qfp.js";
-import"./index-x9q4bbhd.js";
-import"./index-ed5ykebp.js";
-import"./index-5j6chvj8.js";
-import"./index-7g4c7s5r.js";
-import"./index-a5eba0t8.js";
-import"./index-bpmtbmy9.js";
-import"./index-z6xqpmqg.js";
+} from "./index-4wjk296r.js";
 import"./index-zjygnfay.js";
-import"./index-y111zefa.js";
-import"./index-zgwm4ryv.js";
+import"./index-bk5tah7q.js";
+import"./index-rsrx77fg.js";
+import"./index-bpmtbmy9.js";
 import"./index-a76rekgs.js";
 
 // src/commands/index.ts