opencode-swarm 7.144.4 → 7.144.6

package/dist/utils/git-executable.d.ts

@@ -0,0 +1,179 @@
+/**
+ * Single source of truth for "what absolute path do we invoke for git."
+ *
+ * Issue #2236 hardening (F1/F4/F5) — this module is NOT the fix for #2236
+ * (that was a stale worktree `cwd`, fixed elsewhere). It closes a real
+ * latent defect class the issue also asked for: `gitExec()`-style call
+ * sites spawn the slash-less name `git` while passing an explicit `env`
+ * object, and on POSIX there is no absolute-path candidate that would make
+ * PATH resolution unnecessary. See
+ * `.agents/issue-traces/2236-gitexec-enoent-posix-spawn/07-approved-plan.md`
+ * sections F1, F4, F5.
+ *
+ * Candidate order (built as ONE list and probed in a single pass — do NOT
+ * rely on a first-match-only PATH scan to order anything; on a darwin host
+ * with `PATH=/usr/bin:/bin` that would return the xcode-select
+ * `/usr/bin/git` shim before the homebrew candidates that exist precisely
+ * to avoid it):
+ *
+ *   1. explicit override — `OPENCODE_SWARM_GIT_BINARY` env var, else the
+ *      value registered via `setGitBinaryOverride` (the USER-LEVEL config
+ *      `git.binary`; a project/repo-supplied value is refused before it ever
+ *      reaches this module — see `enforceGitBinaryProvenance` in
+ *      `src/config/loader.ts`);
+ *   2. platform absolute candidates (darwin/linux/win32 — see
+ *      `platformCandidates`);
+ *   3. ALL PATH matches for `git` (every PATH entry is scanned, not just
+ *      the first hit);
+ *   4. bare `'git'` LAST, as an unprobed terminal fallback so a host that
+ *      works today via plain PATH resolution does not regress.
+ *
+ * Each non-bare candidate is validated once with `git --version` (bounded
+ * timeout, explicit cwd) before being accepted — this rejects a macOS
+ * `/usr/bin/git` xcode-select shim that exists on disk but fails with
+ * `xcrun: error: invalid active developer path`, and it compensates for
+ * `isExecutableFile`'s missing `X_OK` check
+ * (`src/utils/external-tool-runner.ts`). Exit 0 alone does NOT accept a
+ * candidate: the output must match git's own `git version <n>.<n>` format
+ * (`GIT_VERSION_PATTERN`), so a non-git program that merely exits 0 is not
+ * mistaken for git BY ACCIDENT. That format check is not an anti-tampering
+ * control — see `GIT_VERSION_PATTERN` below for what it can and cannot do;
+ * the control over which binaries may be NAMED at all is
+ * `enforceGitBinaryProvenance` in `src/config/loader.ts`.
+ *
+ * Bounded probing (AGENTS.md invariant 1 — plugin init is fast and
+ * side-effect-minimal): per-probe timeout 250ms, total first-resolution
+ * budget 1000ms.
+ *
+ * This resolver NEVER throws. Both non-accepting outcomes — "the budget was
+ * exhausted before every candidate had been tried" and "every candidate we
+ * could enumerate was probed and rejected" — return the bare name `'git'`
+ * (candidate 4 above), unprobed.
+ *
+ * An earlier revision threw `GitBinaryMissingError` on the all-rejected
+ * outcome, justified by "a bare `'git'` spawn would hit the exact same PATH
+ * entries and fail identically." That justification is refuted by this
+ * issue's own root-cause analysis: a slash-less spawn does NOT resolve
+ * against the PATH this module enumerates. `pathCandidates()` reads
+ * `_internals.env().PATH`, whereas the runtime resolves a bare name against
+ * libuv's `_PATH_DEFPATH` (`/usr/bin:/bin`) when the child env carries no
+ * PATH, and under Bun against a snapshot taken at PROCESS START rather than
+ * the live `process.env` (oven-sh/bun#29237). The two sets genuinely differ,
+ * so throwing reintroduced issue #2236's own defect class — reporting git as
+ * unavailable on a host where git works — precisely in the degraded-PATH
+ * state #2236 nominates as the reporter's candidate trigger. Measured:
+ * platform `linux` with `PATH=/usr/bin:/bin` threw after ZERO probes (all
+ * three POSIX candidates stat-reject in microseconds, so the budget never
+ * trips) and stayed cached for 60s.
+ *
+ * The actionable diagnostic is not lost by falling through — it moves one
+ * layer up, to the caller that actually observes a failed spawn:
+ * `gitExec()` (`src/git/branch.ts`) renders `describeGitResolution()` into
+ * the `GitBinaryMissingError` it throws when the spawn itself fails.
+ *
+ * Caching: a successful resolution is memoized for the process lifetime. A
+ * bare-fallback outcome is memoized with a 60s TTL, then re-probed. Without
+ * any negative cache a git-less host would pay the full probe budget on
+ * every call; a permanent negative cache would mean a host that installs
+ * git mid-session stays broken until restart.
+ */
+import { spawnSync } from 'node:child_process';
+/** Env var escape hatch — a blocked user can set this without editing files. */
+export declare const GIT_BINARY_ENV_VAR = "OPENCODE_SWARM_GIT_BINARY";
+export type GitResolutionCandidateSource = 'override' | 'platform' | 'path';
+export interface GitResolutionAttempt {
+    source: GitResolutionCandidateSource;
+    candidate: string;
+    accepted: boolean;
+    /** Rejection reason; absent when `accepted` is true. */
+    reason?: string;
+}
+export interface GitResolutionDescription {
+    /**
+     * Whether the most recent probe cycle produced a VALIDATED ABSOLUTE PATH.
+     *
+     * This is deliberately narrower than "resolution returned something
+     * usable": `resolveGitExecutable()` returns the unprobed bare `'git'` on
+     * the fallback path, and `resolved` stays `false` there because nothing was
+     * validated. Consumers rendering a diagnostic want exactly that
+     * distinction — `resolvedPath` is likewise `undefined` on the fallback.
+     */
+    resolved: boolean;
+    resolvedPath?: string;
+    attempts: GitResolutionAttempt[];
+    overrideValue?: string;
+    overrideSource?: 'env' | 'config';
+}
+/**
+ * Resolve the git executable to invoke. Lazy and memoized on first call —
+ * nothing is probed at module load. Synchronous; bounded by
+ * `TOTAL_BUDGET_MS`. Prefer `resolveGitExecutableAsync()` on any path that
+ * runs before plugin init resolves (AGENTS.md invariant 1).
+ */
+export declare function resolveGitExecutable(): string;
+/**
+ * Async counterpart. Shares one in-flight resolution across concurrent
+ * callers (the `semgrepAvailabilityProbe` precedent in
+ * `src/sast/semgrep.ts`) and yields to the event loop between candidate
+ * probes so a slow probe budget never blocks the event loop for the full
+ * 1000ms in one tick.
+ */
+export declare function resolveGitExecutableAsync(): Promise<string>;
+/**
+ * Exported for tests and called by `setGitBinaryOverride` on change.
+ *
+ * Bumping `cacheGeneration` is load-bearing, not bookkeeping: clearing
+ * `inFlightAsync` detaches an in-flight async probe but cannot cancel it, so
+ * without the bump that abandoned probe still commits its pre-reset result
+ * over the state this reset just established.
+ */
+export declare function resetGitExecutableCache(): void;
+/**
+ * TEST-ONLY seam (issue #2236 FR-006 ratchet fix) — NOT a production API, do
+ * not call from `src/`. Pre-seeds the resolver cache with an explicit
+ * "success" entry so `resolveGitExecutable()` / `resolveGitExecutableAsync()`
+ * return `value` immediately with zero probe spawns. Used exclusively by
+ * `tests/preload/executable-resolver-pin.ts` so pre-existing test files that
+ * assert `cmd[0] === 'git'` (or mock `node:child_process` to assert exact
+ * spawnSync call counts/args) do not need a per-file resolver stub. A test
+ * that needs the REAL probing behavior calls `resetGitExecutableCache()`
+ * first — that clears this seed exactly like any other cache entry, since it
+ * is stored in the same `cache` variable.
+ */
+export declare function __seedGitExecutableForTests(value: string): void;
+/**
+ * Registers the config-sourced override (`git.binary`). The environment
+ * variable `OPENCODE_SWARM_GIT_BINARY` always takes precedence when set —
+ * this only registers the config fallback. Resets the cache ONLY when the
+ * value actually changes, so a repeat/multi-swarm init does not discard an
+ * already-memoized good resolution.
+ *
+ * SECURITY: callers must pass only a USER-LEVEL value. `git.binary` selects
+ * an executable this process spawns, so a value read from a repository's
+ * `.opencode/opencode-swarm.json` would be attacker-controlled code
+ * selection (CWE-427). The config loader strips a project-supplied value
+ * before the merged config is built (`enforceGitBinaryProvenance` in
+ * `src/config/loader.ts`), which is why the sole production caller
+ * (`src/index.ts`) can pass `config.git?.binary` directly.
+ */
+export declare function setGitBinaryOverride(value?: string): void;
+/**
+ * Diagnostic surface: which candidates were tried in the most recent probe
+ * cycle and why each was rejected. Safe to call before any resolution has
+ * happened (returns an empty attempts list) — it never triggers a probe
+ * itself.
+ */
+export declare function describeGitResolution(): GitResolutionDescription;
+/**
+ * DI seam for testability (repo convention — see `src/sast/semgrep.ts`).
+ * `platform`/`env` let tests drive every platform branch regardless of the
+ * host OS running the test. `now`/`yieldToEventLoop` make the TTL, budget,
+ * and async-yield behavior deterministically testable without real sleeps.
+ */
+export declare const _internals: {
+    spawnSync: typeof spawnSync;
+    platform: () => NodeJS.Platform;
+    env: () => NodeJS.ProcessEnv;
+    now: () => number;
+    yieldToEventLoop: () => Promise<void>;
+};

package/dist/utils/gitignore-warning.d.ts

@@ -1,4 +1,5 @@
 import { bunSpawn } from './bun-compat';
+import { resolveGitExecutableAsync } from './git-executable.js';
 /**
  * Test-only dependency-injection seam. Production code calls
  * `_internals.bunSpawn(...)` so tests can replace the function on this object
@@ -9,6 +10,15 @@ import { bunSpawn } from './bun-compat';
  */
 export declare const _internals: {
     bunSpawn: typeof bunSpawn;
+    /**
+     * Test seam for async git binary resolution (issue #2236 hardening, lane
+     * C1b) — see `src/utils/git-executable.ts`. `ensureSwarmGitExcluded` runs
+     * on the plugin init path (AGENTS.md invariant 1), so it MUST use the
+     * async resolver, never the synchronous one — a synchronous probe loop
+     * here would be exactly the kind of unbounded-feeling init-path work the
+     * invariant forbids.
+     */
+    resolveGitExecutableAsync: typeof resolveGitExecutableAsync;
 };
 /**
  * Module-level flag so the warning fires at most once per process.

package/dist/workflow/coder-settlement.d.ts

@@ -61,6 +61,15 @@ export declare function recordCoderMergeProvenance(options: {
     provenance: MergeOperationProvenance;
     observedFiles: string[];
 }): Promise<void>;
+/**
+ * Does the lane branch still exist in the primary repository?
+ *
+ * Throws rather than guessing when git cannot answer: an INDETERMINATE result
+ * must never be read as "gone". The #2236 self-heal decides whether to mark a
+ * settlement terminal on this answer, and marking terminal while the branch
+ * survives strands the coder's commits on an orphan branch.
+ */
+declare function probeBranchExists(directory: string, branchName: string): boolean;
 export declare function completeCoderSettlementCleanup(directory: string, taskId: string, transitionId: string): Promise<void>;
 export declare function recoverCoderSettlement(directory: string, taskId: string): Promise<CoderSettlementResult | null>;
 export declare function releaseCoderDispatchOwnership(directory: string, taskId: string, transitionId: string): void;
@@ -139,5 +148,14 @@ export declare function recoverStaleCoderSettlements(directory: string, options?
 }>;
 export declare const _internals: {
     liveDispatches: Set<string>;
+    /**
+     * Test seam for the lane-branch existence probe. Production reads it here,
+     * so the #2236 fail-closed invariants — never mark a WAL terminal while the
+     * branch exists, and never mark it terminal on an INDETERMINATE answer —
+     * are drivable without a second git fixture whose `.git` is unusable (which
+     * would break every other git call and never reach the guard).
+     */
+    branchExists: typeof probeBranchExists;
     recoverCoderSettlement: typeof recoverCoderSettlement;
 };
+export {};

package/dist/worktree/core.d.ts

@@ -11,6 +11,7 @@
 import * as fs from 'node:fs';
 import * as fsPromises from 'node:fs/promises';
 import { bunSpawn } from '../utils/bun-compat';
+import { resolveGitExecutable } from '../utils/git-executable.js';
 import type { WorktreeHandle, WorktreeOptions, WorktreeProvisionResult } from './types';
 /**
  * Test-only dependency-injection seam. Production code calls
@@ -58,6 +59,13 @@ export declare const _internals: {
     removeLaneProfileFromDisk: (worktreePath: string, laneIndex: number) => Promise<void>;
     /** Test seam for removeWorktree — allows tests to intercept worktree removal calls. */
     removeWorktree: typeof removeWorktree;
+    /**
+     * Test seam for the git binary resolution (issue #2236 hardening, lane
+     * C1b) — see `src/utils/git-executable.ts`. Allows tests to stub a
+     * deterministic value instead of exercising the real filesystem-probing
+     * resolver against a mocked `bunSpawn`.
+     */
+    resolveGitExecutable: typeof resolveGitExecutable;
 };
 /**
  * FR-201 SC-124: Writes the lane runtime profile as `.swarm/lanes/{laneIndex}.env`.

package/dist/worktree/merge.d.ts

@@ -10,6 +10,7 @@
  * @module merge-back
  */
 import { bunSpawn } from '../utils/bun-compat';
+import { resolveGitExecutable } from '../utils/git-executable.js';
 import type { MergeStrategy } from './types';
 /**
  * Test-only dependency-injection seam. Production code calls
@@ -31,7 +32,39 @@ export declare const _internals: {
     startupOrphanRecovery: typeof startupOrphanRecovery;
     /** FR-001b: exposes extractSessionId for lane ownership validation. */
     extractSessionId: typeof extractSessionId;
+    /**
+     * Issue #2236 hardening (F1/F4/F5) — resolves the absolute git executable
+     * path instead of spawning the bare `'git'` name. Exposed for test
+     * injection following the `src/worktree/core.ts` convention.
+     */
+    resolveGitExecutable: typeof resolveGitExecutable;
 };
+/**
+ * Why a git child process never started (issue #2236).
+ *
+ * `cwd-missing` is the reported bug: a lane worktree path read from durable
+ * WAL state whose directory has already been torn down. `cwd-unreadable` is
+ * the deliberate third state — "cannot tell" must never be treated as "gone",
+ * because the recovery path decides whether to discard a branch on it.
+ */
+export type GitSpawnFailureKind = 'cwd-missing' | 'cwd-unreadable' | 'spawn-failed';
+export interface GitSpawnFailure {
+    kind: GitSpawnFailureKind;
+    cwd: string;
+    message: string;
+}
+/**
+ * Stage reported when the lane worktree directory is gone AND the lane branch
+ * no longer exists — nothing is recoverable. The coder-settlement recovery
+ * path keys its self-heal on this stage, then re-verifies branch absence
+ * itself before touching the WAL.
+ */
+export declare const SOURCE_WORKTREE_GONE_STAGE = "source-worktree-gone";
+/**
+ * Stage reported when the lane worktree directory is gone but branch existence
+ * could not be determined. Fails closed: callers must never self-heal on it.
+ */
+export declare const SOURCE_WORKTREE_UNCERTAIN_STAGE = "source-worktree-uncertain";
 export interface MergeSuccess {
     merged: true;
     strategy: string;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.144.4",
+	"version": "7.144.6",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -109,7 +109,8 @@
 		"repro:1873": "bun build scripts/repro-1873-entry.ts --outdir dist-build-test/repro-1873 --target node --format esm && node scripts/repro-1873.mjs",
 		"check:events": "bun run scripts/check-event-contract.ts",
 		"check:test-file-cap": "bun run scripts/check-test-file-cap.ts",
-		"check:gate-portability": "bun run scripts/check-gate-portability.ts"
+		"check:gate-portability": "bun run scripts/check-gate-portability.ts",
+		"check:bare-spawn": "bun run scripts/check-bare-executable-spawn.ts"
 	},
 	"dependencies": {
 		"@opencode-ai/plugin": "^1.18.3",

package/dist/cli/curator-llm-factory-xgb4pxmm.js

@@ -1,62 +0,0 @@
-// @bun
-import {
-  createCuratorLLMDelegate
-} from "./index-q4ed1jk7.js";
-import"./index-d12jd5mn.js";
-import"./index-h98t1m88.js";
-import"./index-az8etqpp.js";
-import"./index-134d35c1.js";
-import"./index-b6e016tv.js";
-import"./index-1csyxv0f.js";
-import"./index-fqcjragy.js";
-import"./index-y8552snf.js";
-import"./index-nckg4gxb.js";
-import"./index-70ha9e09.js";
-import"./index-c8s9a3zh.js";
-import"./index-9ss2m4rs.js";
-import"./index-74hpm6sh.js";
-import"./index-bt9aa01f.js";
-import"./index-zb0xcz9t.js";
-import"./index-x6tp0hfr.js";
-import"./index-yts89pqg.js";
-import"./index-dty5qgk2.js";
-import"./index-rtry5xyf.js";
-import"./index-zsrtt42s.js";
-import"./index-jabkn643.js";
-import"./index-k3cxyk66.js";
-import"./index-cz25e8xp.js";
-import"./index-8j0va7jp.js";
-import"./index-pw83zgny.js";
-import"./index-z6v7kwpa.js";
-import"./index-556ja8an.js";
-import"./index-7sy3aa9m.js";
-import"./index-wx8zdh4a.js";
-import"./index-8fwhhayc.js";
-import"./index-q1exe2b3.js";
-import"./index-03pv47h2.js";
-import"./index-4w5qdbk7.js";
-import"./index-psvxq93b.js";
-import"./index-gprxjmm7.js";
-import"./index-n832052r.js";
-import"./index-rn0eq85g.js";
-import"./index-z6xqpmqg.js";
-import"./index-9qq7c18c.js";
-import"./index-y8j8ehc8.js";
-import"./index-4rhhvd1a.js";
-import"./index-v3y3qg48.js";
-import"./index-zjygnfay.js";
-import"./index-ae75rja9.js";
-import"./index-ywn7vtxp.js";
-import"./index-mazgg5s2.js";
-import"./index-ed5ykebp.js";
-import"./index-bk5tah7q.js";
-import"./index-f9vvg5xb.js";
-import"./index-1jsmmx7y.js";
-import"./index-7g4c7s5r.js";
-import"./index-bpmtbmy9.js";
-import"./index-4nt52yr9.js";
-import"./index-zgwm4ryv.js";
-import"./index-a76rekgs.js";
-export {
-  createCuratorLLMDelegate
-};

package/dist/cli/guardrail-explain-6wcgr9tz.js

@@ -1,63 +0,0 @@
-// @bun
-import {
-  handleGuardrailExplain
-} from "./index-2m7mavaz.js";
-import"./index-q4ed1jk7.js";
-import"./index-d12jd5mn.js";
-import"./index-h98t1m88.js";
-import"./index-az8etqpp.js";
-import"./index-134d35c1.js";
-import"./index-b6e016tv.js";
-import"./index-1csyxv0f.js";
-import"./index-fqcjragy.js";
-import"./index-y8552snf.js";
-import"./index-nckg4gxb.js";
-import"./index-70ha9e09.js";
-import"./index-c8s9a3zh.js";
-import"./index-9ss2m4rs.js";
-import"./index-74hpm6sh.js";
-import"./index-bt9aa01f.js";
-import"./index-zb0xcz9t.js";
-import"./index-x6tp0hfr.js";
-import"./index-yts89pqg.js";
-import"./index-dty5qgk2.js";
-import"./index-rtry5xyf.js";
-import"./index-zsrtt42s.js";
-import"./index-jabkn643.js";
-import"./index-k3cxyk66.js";
-import"./index-cz25e8xp.js";
-import"./index-8j0va7jp.js";
-import"./index-pw83zgny.js";
-import"./index-z6v7kwpa.js";
-import"./index-556ja8an.js";
-import"./index-7sy3aa9m.js";
-import"./index-wx8zdh4a.js";
-import"./index-8fwhhayc.js";
-import"./index-q1exe2b3.js";
-import"./index-03pv47h2.js";
-import"./index-4w5qdbk7.js";
-import"./index-psvxq93b.js";
-import"./index-gprxjmm7.js";
-import"./index-n832052r.js";
-import"./index-rn0eq85g.js";
-import"./index-z6xqpmqg.js";
-import"./index-9qq7c18c.js";
-import"./index-y8j8ehc8.js";
-import"./index-4rhhvd1a.js";
-import"./index-v3y3qg48.js";
-import"./index-zjygnfay.js";
-import"./index-ae75rja9.js";
-import"./index-ywn7vtxp.js";
-import"./index-mazgg5s2.js";
-import"./index-ed5ykebp.js";
-import"./index-bk5tah7q.js";
-import"./index-f9vvg5xb.js";
-import"./index-1jsmmx7y.js";
-import"./index-7g4c7s5r.js";
-import"./index-bpmtbmy9.js";
-import"./index-4nt52yr9.js";
-import"./index-zgwm4ryv.js";
-import"./index-a76rekgs.js";
-export {
-  handleGuardrailExplain
-};