opencode-swarm 7.141.2 → 7.142.1

package/dist/knowledge/hive-quarantine.d.ts

@@ -0,0 +1,156 @@
+/**
+ * Human-only exact-ID quarantine for the machine-global hive knowledge store (issue #2033).
+ *
+ * Problem: the hive store (`shared-learnings.jsonl`, resolved by
+ * `src/knowledge/hive-paths.ts`) has been polluted by leaked test fixtures, and no safe
+ * remediation existed: `quarantineEntry` is swarm-tier only, `knowledge_archive` refuses
+ * hive-tier quarantine, and bulk text scrubbing would destroy legitimate lessons (a real
+ * store may legitimately contain test-like text). Parent #1823: never bulk delete.
+ *
+ * This module implements the adjudicated exact-ID flow:
+ *   preview   — read-only snapshot of exact candidate IDs, per-entry hashes/provenance, a
+ *               store fingerprint, and a confirmation token bound to preview + store +
+ *               plugin version (TTL-bounded) AND HMAC-signed with a per-install secret
+ *               (not derivable from store contents — PR #2200 review CC-1).
+ *   commit    — a validated backup + manifest written and hash-verified BEFORE any
+ *               mutation (outside the hive lock, keeping the locked closure fast per
+ *               hive-transaction's contract), then ONE `transactHiveStore` transaction
+ *               that re-verifies the live file hash against the backup under lock (any
+ *               drift — including duplicate-id ambiguity — aborts with no mutation;
+ *               clean aborts clean up the orphaned backup dir), quarantines EXACTLY the
+ *               selected IDs with audit + sidecar records staged under the lock, and
+ *               verifies counts afterwards with an HONEST auto-restore report (a failed
+ *               restore is never claimed as success).
+ *   rollback  — idempotent restore of the EXACT original line bytes from the manifest's
+ *               backup, aborting on collision (an id re-promoted with different content).
+ *               Backup lookup resolves symlinks/reparse points on BOTH sides — a lexical
+ *               prefix compare alone is dead code against a planted link (review CC-4).
+ *
+ * Selection is EXACT-ID only: no text, substring, "test-looking phrase", cohort, age, or
+ * blacklist matching exists anywhere in this module, and there is no bulk operation.
+ *
+ * Byte-fidelity note: restored ids are written through the transaction's
+ * `rawLineOverrides` channel as the EXACT original line bytes, and every restore is
+ * verified against the manifest's `raw_line_sha256` (hex sha256 of the line bytes
+ * INCLUDING the trailing newline) before success is reported. Two standing-transaction
+ * disclosures apply to everything EXCEPT the selected ids: unselected entries may be
+ * re-serialized by the normalize-on-read pipeline, and unparseable (corrupt) lines are
+ * DROPPED by any commit rewrite — they survive only in the hash-verified backup copy,
+ * from which they can be recovered manually.
+ *
+ * The module holds no module-level mutable state (invariant 8) and performs no work on
+ * the plugin-init path (invariant 1) — it is loaded only by the human-only
+ * `knowledge hive-quarantine` command dispatch.
+ */
+import { chmod, copyFile, mkdir, readdir, readFile, realpath, rm, stat, writeFile } from 'node:fs/promises';
+import { transactHiveStore } from '../hooks/hive-transaction.js';
+import { emit } from '../telemetry.js';
+import { resolveHiveDataDir, resolveHiveKnowledgePath } from './hive-paths.js';
+/** Confirmation token TTL (freshness window). */
+export declare const HIVE_QUARANTINE_TOKEN_TTL_MS: number;
+/** Upper bound of exact IDs per operation (tokens embed per-id hashes). */
+export declare const MAX_IDS_PER_OPERATION = 200;
+/** Quarantine sidecar living beside the store in the hive data dir. */
+export declare const HIVE_QUARANTINE_SIDECAR = "shared-learnings-quarantined.jsonl";
+/** Backup directory root inside the hive data dir. */
+export declare const HIVE_QUARANTINE_BACKUP_DIR = "quarantine-backups";
+export type HiveQuarantineAbortCode = 'invalid_ids' | 'id_not_found' | 'duplicate_id' | 'duplicate_id_in_store' | 'too_many_ids' | 'invalid_token' | 'token_expired' | 'store_drift' | 'id_changed' | 'id_missing' | 'version_changed' | 'backup_failed' | 'backup_corrupt' | 'backup_not_found' | 'rollback_collision' | 'ambiguous_backup' | 'transaction_failed';
+export interface HiveQuarantinePreviewRecord {
+    id: string;
+    tier: string;
+    status: string;
+    confidence: number;
+    category: string;
+    source_project?: string;
+    lineage_actor?: string;
+    created_at: string;
+    updated_at: string;
+    content_hash?: string;
+    raw_line_sha256: string;
+}
+export interface HiveQuarantinePreview {
+    records: HiveQuarantinePreviewRecord[];
+    store_entry_count: number;
+    store_file_sha256: string;
+    plugin_version: string;
+    issued_at: string;
+    expires_at: string;
+    token: string;
+}
+export interface HiveQuarantineCommitResult {
+    quarantinedIds: string[];
+    storeEntriesBefore: number;
+    storeEntriesAfter: number;
+    backupDir: string;
+    backupBytes: number;
+    verified: boolean;
+}
+export interface HiveQuarantineRollbackResult {
+    restoredIds: string[];
+    alreadyPresentIds: string[];
+    storeEntriesAfter: number;
+    verified: boolean;
+}
+type Abort = {
+    ok: false;
+    code: HiveQuarantineAbortCode;
+    error: string;
+};
+/**
+ * Canonical JSON: `JSON.stringify` with recursively sorted object keys. Used for BOTH the
+ * preview token construction and the under-lock reconstruction so key order can never
+ * produce a false drift signal.
+ */
+export declare function canonicalJson(value: unknown): string;
+declare function readQuarantineSecret(): Promise<string>;
+/**
+ * Read-only preview of exact candidate IDs. Errors list missing ids; selection never
+ * falls back to prefix or text matching.
+ */
+export declare function previewHiveQuarantine(ids: string[]): Promise<{
+    ok: true;
+    preview: HiveQuarantinePreview;
+} | Abort>;
+export declare function commitHiveQuarantine(input: {
+    token: string;
+    reason?: string;
+}): Promise<{
+    ok: true;
+    result: HiveQuarantineCommitResult;
+} | Abort>;
+/**
+ * Idempotent rollback: restores the EXACT original line bytes for the manifest's ids.
+ * Ids already present with identical bytes are skipped (safe replay); an id present with
+ * DIFFERENT bytes aborts the whole operation with no mutation (collision).
+ */
+export declare function rollbackHiveQuarantine(input: {
+    ref: string;
+}): Promise<{
+    ok: true;
+    result: HiveQuarantineRollbackResult;
+} | Abort>;
+/** Read-only listing of quarantine backups (for the `status` subcommand). */
+export declare function listHiveQuarantineBackups(): Promise<{
+    token12: string;
+    committed_at: string;
+    idCount: number;
+    reason: string;
+}[]>;
+/** Test-only DI seam (AGENTS.md invariant 7). */
+export declare const _internals: {
+    emit: typeof emit;
+    readFile: typeof readFile;
+    writeFile: typeof writeFile;
+    copyFile: typeof copyFile;
+    mkdir: typeof mkdir;
+    stat: typeof stat;
+    readdir: typeof readdir;
+    resolveHiveDataDir: typeof resolveHiveDataDir;
+    resolveHiveKnowledgePath: typeof resolveHiveKnowledgePath;
+    transactHiveStore: typeof transactHiveStore;
+    realpath: typeof realpath;
+    rm: typeof rm;
+    chmod: typeof chmod;
+    readQuarantineSecret: typeof readQuarantineSecret;
+};
+export {};

package/dist/observability/catalog.d.ts

@@ -1,7 +1,7 @@
 /**
  * The event catalog (issue #2029).
  *
- * Exactly 41 entries, matching the `TelemetryEvent` union at
+ * Exactly 42 entries, matching the `TelemetryEvent` union at
  * `src/telemetry.ts:15-91`. Thirty-eight predate the #2029 contract; the 39th is
  * `agent_conflict_detected` (previously emitted through a force-cast past the
  * type system), and the 40th is `close_archive_result` (issue #2030 — the
@@ -62,7 +62,7 @@ export interface CatalogEntry {
     /**
      * Whether an event of this kind must carry `trace.parentSpanId`.
      *
-     * `false` for all 41 entries today, and that is a truthful statement about
+     * `false` for all 42 entries today, and that is a truthful statement about
      * the current system rather than a placeholder: no producer supplies a
      * parent span, so `createObservation` never sets one. Setting this to `true`
      * for a kind whose producer cannot supply a parent would make every

package/dist/plan/ledger.d.ts

@@ -62,6 +62,16 @@ export type LedgerEventInput = Omit<LedgerEvent, 'seq' | 'timestamp' | 'plan_has
 export interface SnapshotEventPayload {
     plan: Plan;
     payload_hash: string;
+    plan_epoch?: string;
+    root_event_hash?: string;
+}
+export interface PlanEpochIdentity {
+    planId: string;
+    planIdentityHash: string;
+    planEpoch: string;
+    rootEventHash: string;
+    payloadHash: string;
+    source: 'root' | 'plan_epoch_adopted';
 }
 /**
  * Error thrown when a writer attempts to append to the ledger with stale state.
@@ -173,6 +183,23 @@ export declare function readLedgerEvents(directory: string): Promise<LedgerEvent
  * @param planId - Unique identifier for the plan
  */
 export declare function initLedger(directory: string, planId: string, initialPlanHash?: string, initialPlan?: Plan): Promise<void>;
+/**
+ * Read and validate the current plan epoch identity without creating,
+ * adopting, or appending any ledger state.
+ *
+ * Returns null when the ledger is absent or when a legacy ledger has not yet
+ * adopted an epoch. Invalid or conflicting epoch metadata still fails closed.
+ */
+export declare function readPlanEpochIdentity(directory: string, authoritativePlan: Plan): Promise<PlanEpochIdentity | null>;
+/**
+ * Return the persisted plan epoch for the authoritative ledger root, adopting
+ * one backward-readable snapshot when a legacy root predates the epoch field.
+ *
+ * The caller is expected to already hold the higher-level plan lock. This
+ * helper acquires only the ledger append lock so concurrent adopters serialize
+ * to one adoption snapshot.
+ */
+export declare function getOrAdoptPlanEpochUnderLock(directory: string, authoritativePlan: Plan): Promise<PlanEpochIdentity>;
 /**
  * Append a new event to the ledger.
  * Uses atomic write: write to temp file then rename.
@@ -390,7 +417,9 @@ export interface LedgerIntegrityResult {
  * @param directory - The working directory
  * @returns LedgerIntegrityResult with events, truncated flag, and bad suffix
  */
-export declare function readLedgerEventsWithIntegrity(directory: string): Promise<LedgerIntegrityResult>;
+export declare function readLedgerEventsWithIntegrity(directory: string, options?: {
+    failClosedOnReadError?: boolean;
+}): Promise<LedgerIntegrityResult>;
 /**
  * Result of a {@link quarantineLedgerSuffix} call.
  */
@@ -516,5 +545,6 @@ export declare const _internals: {
     getPlanJsonPath: typeof getPlanJsonPath;
     writeFileFsyncedThenRename: typeof writeFileFsyncedThenRename;
     fsyncRecoveryDirectory: typeof fsyncRecoveryDirectory;
+    randomUUID: () => `${string}-${string}-${string}-${string}-${string}`;
 };
 export {};

package/dist/plan/manager.d.ts

@@ -214,6 +214,7 @@ export declare function isTaskSettled(directory: string, taskId: string): Promis
 export declare function updateTaskStatus(directory: string, taskId: string, status: TaskStatus, options?: {
     force?: boolean;
     planLockAlreadyHeld?: boolean;
+    terminalReconciliation?: boolean;
 }): Promise<Plan>;
 /**
  * Generate deterministic markdown view from plan object.

package/dist/state.d.ts

@@ -64,7 +64,7 @@ export interface PrSubscriptionState {
  * Per-task workflow state for gate progression tracking.
  * Transitions must be forward-only: idle → coder_delegated → pre_check_passed → reviewer_run → tests_run → complete
  */
-export type TaskWorkflowState = 'idle' | 'coder_delegated' | 'pre_check_passed' | 'reviewer_run' | 'tests_run' | 'rework_required' | 'complete' | 'blocked';
+export type TaskWorkflowState = 'idle' | 'coder_delegated' | 'pre_check_passed' | 'reviewer_run' | 'tests_run' | 'rework_required' | 'complete' | 'blocked' | 'closed';
 export interface TaskWorkflowCacheEntry {
     generation: number;
     retryCount: number;

package/dist/telemetry.d.ts

@@ -26,7 +26,7 @@ export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activa
  * `prm_hard_stop` TRIGGER emitted by `src/prm/escalation.ts`. A trigger with
  * no matching delivery means the containment never reached the agent.
  */
- | 'prm_hard_stop_delivered' | 'agent_conflict_detected' | 'close_archive_result' | 'knowledge_receipt_transition';
+ | 'prm_hard_stop_delivered' | 'agent_conflict_detected' | 'close_archive_result' | 'knowledge_receipt_transition' | 'knowledge_maintenance';
 /** Stable classification for how a reviewer-gate decision was established. */
 export type ReviewerGateEvidenceKind = 'genuine' | 'fallback' | 'data_quality' | 'block';
 /**

package/dist/workflow/close-terminal.d.ts

@@ -0,0 +1,22 @@
+import type { Plan } from '../config/plan-schema.js';
+export interface CloseTerminalResult {
+    plan: Plan;
+    closedTaskIds: string[];
+    preservedCompletedTaskIds: string[];
+    closedPhaseIds: number[];
+    /**
+     * Tasks whose terminal state was settled as a QA-exempt forced completion — either
+     * recorded as such by this reconciliation, or already carrying `forcedCompletion`
+     * in durable evidence from an earlier one. Surfaced so `/swarm close` can report
+     * that these tasks did not pass the normal gates; without it a forced completion is
+     * indistinguishable from a genuinely reviewed and tested one.
+     */
+    forcedCompletionTaskIds: string[];
+}
+/** Reconcile `/swarm close` intent with exact-task workflow authority. */
+export declare function reconcileCloseTerminalState(directory: string, targetPlan: Plan, options: {
+    actor: string;
+    requestedClosedTaskIds: string[];
+    closedPhaseIds: number[];
+    originalStatuses?: Map<string, string>;
+}): Promise<CloseTerminalResult>;

package/dist/workflow/coder-settlement.d.ts

@@ -1,32 +1,11 @@
 import type { BackgroundTaskChangeContext, BackgroundWorktreeDescriptor } from '../background/pending-delegations.js';
 import { type TaskEvidence } from '../gate-evidence.js';
 import type { MergeOperationProvenance } from '../worktree/merge.js';
-type CoderSettlementState = 'ABORTED' | 'COMMITTED' | 'DISPATCHED' | 'PREPARED';
-interface CoderSettlementWal {
-    version: 1;
-    state: CoderSettlementState;
-    taskId: string;
-    transitionId: string;
-    actor: string;
-    processId: number;
-    runtimeId: string;
-    expectedGeneration: number;
-    context: BackgroundTaskChangeContext;
-    worktree?: BackgroundWorktreeDescriptor;
-    observedFiles?: string[];
-    mergeProvenance?: MergeOperationProvenance;
-    accepted?: boolean;
-    testEngineerExempt?: boolean;
-    settlementFailed?: boolean;
-    cleanupComplete?: boolean;
-    recordedAt: string;
-}
 export interface CoderSettlementResult {
     evidence: TaskEvidence;
     accepted: boolean;
     alreadyApplied: boolean;
 }
-declare function parseWal(raw: string): CoderSettlementWal;
 export declare function beginCoderSettlement(options: {
     directory: string;
     taskId: string;
@@ -56,7 +35,5 @@ export declare function recoverCoderSettlement(directory: string, taskId: string
 export declare function releaseCoderDispatchOwnership(directory: string, taskId: string, transitionId: string): void;
 export declare function assertNoUnsettledCoderDispatch(directory: string, taskId: string): Promise<void>;
 export declare const _internals: {
-    parseWal: typeof parseWal;
     liveDispatches: Set<string>;
 };
-export {};

package/dist/workflow/task-repair.d.ts

@@ -10,6 +10,7 @@ export interface TaskRepairResult<TPlan> {
  * the task. This reads only the exact per-task WAL path; it never scans.
  */
 export declare function recoverPreparedTaskRepair(directory: string, taskId: string, actor: string): Promise<TaskRepairResult<NonNullable<Awaited<ReturnType<typeof loadPlanJsonOnly>>>> | null>;
+export declare function recoverPreparedTaskRepairUnderPlanLock(directory: string, taskId: string, actor: string, currentPlan: NonNullable<Awaited<ReturnType<typeof loadPlanJsonOnly>>>): Promise<TaskRepairResult<NonNullable<Awaited<ReturnType<typeof loadPlanJsonOnly>>>> | null>;
 /**
  * Execute or lazily finish one exact-task repair while the caller holds the
  * plan lock. Lock ordering is therefore always plan -> exact task evidence.

package/dist/workflow/task-terminal.d.ts

@@ -1,28 +1,12 @@
 import type { Plan } from '../config/plan-schema.js';
 import { type TaskEvidence, withTaskEvidenceTransaction } from '../gate-evidence.js';
-import type { TaskWorkflowState } from '../state.js';
-type TerminalPlanStatus = 'blocked' | 'completed';
-type TerminalWorkflowState = 'blocked' | 'complete';
-type TerminalWalState = 'ABORTED' | 'COMMITTED' | 'PREPARED';
-interface TaskTerminalWal {
-    version: 1;
-    state: TerminalWalState;
-    taskId: string;
-    transitionId: string;
-    actor: string;
-    oldPlanStatus: string;
-    newPlanStatus: TerminalPlanStatus;
-    oldWorkflowState: TaskWorkflowState;
-    newWorkflowState: TerminalWorkflowState;
-    generation: number;
-    qaExempt: boolean;
-    recordedAt: string;
-}
+import type { TaskTerminalWal, TerminalPlanStatus } from './workflow-wal-schema.js';
 export interface TaskTerminalResult<TPlan> {
     plan: TPlan;
     evidence: TaskEvidence;
     alreadyApplied: boolean;
     transitionId: string;
+    targetStatus: TerminalPlanStatus;
 }
 declare function applyTerminalEvidence(transaction: Parameters<Parameters<typeof withTaskEvidenceTransaction>[3]>[0], wal: TaskTerminalWal): Promise<TaskEvidence>;
 /** Narrow dependency-injection seam for crash-window failure tests. */
@@ -30,12 +14,16 @@ export declare const _internals: {
     applyTerminalEvidence: typeof applyTerminalEvidence;
 };
 /**
- * Lazily close the only recoverable terminal crash window: the plan was
- * persisted to completed/blocked after PREPARED, but exact-task evidence was
- * not. A PREPARED record whose plan and evidence are both still old is safely
- * aborted rather than executing an abandoned status request.
+ * Lazily close a recoverable terminal crash window: the WAL is PREPARED but the
+ * plan/evidence pair it describes has not settled. A v1 record whose plan and
+ * evidence are both still old is safely aborted rather than executing an
+ * abandoned completed/blocked request. A v2 (close) record is instead
+ * force-forwarded even from old plan and old evidence — its plan-epoch identity
+ * is re-verified first, and abandoning it would leave a task the caller already
+ * closed silently open.
  */
 export declare function recoverPreparedTaskTerminal(directory: string, taskId: string, actor: string): Promise<TaskTerminalResult<Plan> | null>;
+export declare function recoverPreparedTaskTerminalUnderPlanLock(directory: string, taskId: string, actor: string, currentPlan: Plan): Promise<TaskTerminalResult<Plan> | null>;
 /** Commit a terminal plan/evidence transition while the caller holds plan.json. */
 export declare function commitTaskTerminalUnderPlanLock<TPlan>(options: {
     directory: string;
@@ -45,8 +33,15 @@ export declare function commitTaskTerminalUnderPlanLock<TPlan>(options: {
     currentPlanStatus: string;
     targetStatus: TerminalPlanStatus;
     qaExempt: boolean;
+    resolveTerminal?: (evidence: TaskEvidence | null) => {
+        targetStatus: TerminalPlanStatus;
+        qaExempt: boolean;
+        preserveEvidence?: boolean;
+    };
+    planIdentityHash?: string;
+    planEpoch?: string;
     currentPlan: TPlan;
     validateEvidence?: (evidence: TaskEvidence | null) => Promise<void> | void;
-    updatePlan: () => Promise<TPlan>;
+    updatePlan: (targetStatus: TerminalPlanStatus) => Promise<TPlan>;
 }): Promise<TaskTerminalResult<TPlan>>;
 export {};

package/dist/workflow/workflow-wal-file.d.ts

@@ -0,0 +1,20 @@
+import * as fs from 'node:fs';
+import { type FileHandle } from 'node:fs/promises';
+import { type CoderSettlementWal, type TaskRepairWal, type TaskTerminalWal } from './workflow-wal-schema.js';
+type WorkflowWalKind = 'coder-settlement' | 'task-repair' | 'task-terminal';
+type WorkflowWalByKind = {
+    'coder-settlement': CoderSettlementWal;
+    'task-repair': TaskRepairWal;
+    'task-terminal': TaskTerminalWal;
+};
+type OpenFile = (filePath: string, flags: string) => Promise<FileHandle>;
+export declare const _internals: {
+    openFile: OpenFile;
+    openFileSync: typeof fs.openSync;
+    readFileSync: typeof fs.readSync;
+    closeFileSync: typeof fs.closeSync;
+};
+export declare function readWorkflowWalFile<K extends WorkflowWalKind>(kind: K, filePath: string, expectedTaskId: string): Promise<WorkflowWalByKind[K] | null>;
+export declare function readWorkflowWalFileSync<K extends WorkflowWalKind>(kind: K, filePath: string, expectedTaskId: string): WorkflowWalByKind[K] | null;
+export declare function writeWorkflowWalFile(kind: WorkflowWalKind, filePath: string, wal: CoderSettlementWal | TaskRepairWal | TaskTerminalWal): Promise<void>;
+export {};

package/dist/workflow/workflow-wal-schema.d.ts

@@ -0,0 +1,67 @@
+import type { BackgroundTaskChangeContext, BackgroundWorktreeDescriptor } from '../background/pending-delegations.js';
+import type { TaskWorkflowState } from '../state.js';
+import { type MergeOperationProvenance } from '../worktree/merge.js';
+export type CoderSettlementState = 'ABORTED' | 'COMMITTED' | 'DISPATCHED' | 'PREPARED';
+export interface CoderSettlementWal {
+    version: 1;
+    state: CoderSettlementState;
+    taskId: string;
+    transitionId: string;
+    actor: string;
+    processId: number;
+    runtimeId: string;
+    expectedGeneration: number;
+    context: BackgroundTaskChangeContext;
+    worktree?: BackgroundWorktreeDescriptor;
+    observedFiles?: string[];
+    mergeProvenance?: MergeOperationProvenance;
+    accepted?: boolean;
+    testEngineerExempt?: boolean;
+    settlementFailed?: boolean;
+    cleanupComplete?: boolean;
+    recordedAt: string;
+}
+export type RepairWalState = 'ABORTED' | 'COMMITTED' | 'PREPARED';
+export interface TaskRepairWal {
+    version: 1;
+    state: RepairWalState;
+    taskId: string;
+    transitionId: string;
+    reason: string;
+    actor: string;
+    oldPlanStatus: string;
+    newPlanStatus: 'in_progress';
+    oldWorkflowState: string;
+    newWorkflowState: 'idle';
+    oldGeneration: number;
+    generation: number;
+    recordedAt: string;
+}
+export type TerminalWalState = 'ABORTED' | 'COMMITTED' | 'PREPARED';
+export type TerminalPlanStatus = 'blocked' | 'closed' | 'completed';
+export type TerminalWorkflowState = 'blocked' | 'closed' | 'complete';
+export interface TaskTerminalWalV1 {
+    version: 1;
+    state: TerminalWalState;
+    taskId: string;
+    transitionId: string;
+    actor: string;
+    oldPlanStatus: string;
+    newPlanStatus: 'blocked' | 'completed';
+    oldWorkflowState: TaskWorkflowState;
+    newWorkflowState: 'blocked' | 'complete';
+    generation: number;
+    qaExempt: boolean;
+    recordedAt: string;
+}
+export interface TaskTerminalWalV2 extends Omit<TaskTerminalWalV1, 'version' | 'newPlanStatus' | 'newWorkflowState'> {
+    version: 2;
+    newPlanStatus: 'closed' | 'completed';
+    newWorkflowState: 'closed' | 'complete';
+    planIdentityHash: string;
+    planEpoch: string;
+}
+export type TaskTerminalWal = TaskTerminalWalV1 | TaskTerminalWalV2;
+export declare function parseCoderSettlementWal(raw: string, filePath: string, expectedTaskId?: string): CoderSettlementWal;
+export declare function parseTaskRepairWal(raw: string, filePath: string, expectedTaskId?: string): TaskRepairWal;
+export declare function parseTaskTerminalWal(raw: string, filePath: string, expectedTaskId?: string): TaskTerminalWal;

package/dist/worktree/merge.d.ts

@@ -99,6 +99,23 @@ export interface MergeOperationProvenance {
     branchName: string;
     strategy: MergeStrategy;
 }
+/**
+ * Git object ids as written by `git rev-parse HEAD`: sha1 (40) today, sha256 (64)
+ * under the sha256 object format. Abbreviated ids are deliberately rejected —
+ * nothing in this codebase persists them. Constraining the shape also makes a
+ * leading `-` structurally impossible for values later passed to git as
+ * revisions, which matters because neither sink below passes a separator that
+ * would protect one today: the `git log` call's `--` sits after the range and
+ * separates pathspecs rather than options, and the
+ * `git merge-base --is-ancestor` call passes the revision bare. (Both commands
+ * would accept `--`/`--end-of-options` before the operand, so sink-side
+ * hardening is also available; this pattern guards the value itself.)
+ *
+ * Owned here beside `MergeOperationProvenance` because this module defines the
+ * struct whose head fields reach git argv; `workflow-wal-schema.ts` re-imports
+ * it so the two validation surfaces for the same values cannot drift apart.
+ */
+export declare const GIT_OBJECT_ID_PATTERN: RegExp;
 export type MergeReconciliationResult = {
     landed: true;
     method: 'ancestry' | 'cherry-pick-trailer';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.141.2",
+	"version": "7.142.1",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",