opencode-swarm 7.145.0 → 7.145.2

package/dist/cli/{index-s6cwsnrw.js → index-n55a28zr.js}

@@ -2,18 +2,11 @@
 import {
   autoCommitDirty,
   cleanUntrackedFiles
-} from "./index-6hqhyb0f.js";
+} from "./index-rk80jhef.js";
 import {
   isPathWithinDeclaredScope,
   unsafePathTextReason
 } from "./index-556ja8an.js";
-import {
-  validateSwarmPath
-} from "./index-w8pgjr75.js";
-import {
-  bunSpawn,
-  classifySpawnFailure
-} from "./index-zj6t9zgx.js";
 import {
   init_git_executable,
   resolveGitExecutable
@@ -22,14 +15,24 @@ import {
   advisoryWarn,
   init_warning_buffer
 } from "./index-4rhhvd1a.js";
+import {
+  validateSwarmPath
+} from "./index-w8pgjr75.js";
+import {
+  bunSpawn,
+  classifySpawnFailure
+} from "./index-zj6t9zgx.js";
 import {
   atomicWriteFile,
   taskEvidencePath,
   withTaskEvidenceLock
-} from "./index-6q3agdmr.js";
+} from "./index-j20fzn0w.js";
+import {
+  assertProjectRoot
+} from "./index-bghwrr59.js";
 import {
   telemetry
-} from "./index-zz5qsjd1.js";
+} from "./index-qyvjp0bq.js";
 import {
   exports_external,
   init_zod
@@ -40,8 +43,214 @@ import {
 
 // src/gate-evidence.ts
 init_zod();
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, realpathSync } from "fs";
-import * as path2 from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, realpathSync as realpathSync2 } from "fs";
+import * as path3 from "path";
+
+// src/evidence/task-gate-requirements.ts
+init_zod();
+import { createHash } from "crypto";
+import * as fs from "fs";
+import * as path from "path";
+var MAX_TASK_GATE_REQUIREMENTS_BYTES = 256 * 1024;
+var TaskGateRequirementsReceiptSchema = exports_external.object({
+  schemaVersion: exports_external.literal(1),
+  taskId: exports_external.string().min(1).max(120),
+  generation: exports_external.number().int().min(0),
+  normalizedRole: exports_external.string().min(1).max(120),
+  testEngineerExempt: exports_external.boolean().nullable(),
+  requiredGates: exports_external.array(exports_external.string()).min(1).max(16),
+  sourceEvent: exports_external.string().min(1).max(120),
+  sourceTransitionId: exports_external.string().min(1).max(200).nullable(),
+  recordedAt: exports_external.string().min(1).max(128),
+  previousChainHash: exports_external.string().regex(/^[a-f0-9]{64}$/).nullable(),
+  chainHash: exports_external.string().regex(/^[a-f0-9]{64}$/)
+}).strict();
+function samePath(left, right) {
+  const normalize = (value) => process.platform === "win32" ? path.resolve(value).toLowerCase() : path.resolve(value);
+  return normalize(left) === normalize(right);
+}
+function assertSafeRequirementsParent(directory, create) {
+  assertProjectRoot(directory, undefined, "task gate requirements");
+  const rootStat = fs.lstatSync(directory);
+  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+    throw new Error("TASK_GATE_REQUIREMENTS_UNREADABLE: project root is not a regular directory");
+  }
+  const canonicalRoot = fs.realpathSync(directory);
+  const segments = [".swarm", "evidence", "task-gate-requirements"];
+  let current = canonicalRoot;
+  for (const segment of segments) {
+    current = path.join(current, segment);
+    let info;
+    try {
+      info = fs.lstatSync(current);
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        if (!create)
+          return current;
+        try {
+          fs.mkdirSync(current);
+        } catch (mkdirError) {
+          if (mkdirError.code !== "EEXIST") {
+            throw mkdirError;
+          }
+        }
+        info = fs.lstatSync(current);
+      } else {
+        throw error;
+      }
+    }
+    if (info.isSymbolicLink() || !info.isDirectory()) {
+      throw new Error("TASK_GATE_REQUIREMENTS_UNREADABLE: receipt parent is redirected or not a directory");
+    }
+    const canonicalCurrent = fs.realpathSync(current);
+    if (!samePath(canonicalCurrent, current)) {
+      throw new Error("TASK_GATE_REQUIREMENTS_UNREADABLE: receipt parent escaped the project root");
+    }
+  }
+  return current;
+}
+function safeTaskGateRequirementsReceiptPath(directory, taskId, createParent) {
+  const parent = assertSafeRequirementsParent(directory, createParent);
+  return path.join(parent, `${taskId}.jsonl`);
+}
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function canonicalReceiptPayload(receipt) {
+  return JSON.stringify({
+    ...receipt,
+    requiredGates: [...receipt.requiredGates]
+  });
+}
+function computeChainHash(receipt) {
+  return sha256(canonicalReceiptPayload(receipt));
+}
+function readBoundedTextFile(filePath) {
+  let pathStat;
+  try {
+    pathStat = fs.lstatSync(filePath);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    throw error;
+  }
+  if (pathStat.isSymbolicLink() || !pathStat.isFile()) {
+    throw new Error("TASK_GATE_REQUIREMENTS_UNREADABLE: receipt path is not a regular file");
+  }
+  if (pathStat.size > MAX_TASK_GATE_REQUIREMENTS_BYTES) {
+    throw new Error(`TASK_GATE_REQUIREMENTS_OVERSIZED: ${pathStat.size} bytes exceeds ${MAX_TASK_GATE_REQUIREMENTS_BYTES}`);
+  }
+  const descriptor = fs.openSync(filePath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+  try {
+    const openedStat = fs.fstatSync(descriptor);
+    if (!openedStat.isFile() || openedStat.dev !== pathStat.dev || openedStat.ino !== pathStat.ino) {
+      throw new Error("TASK_GATE_REQUIREMENTS_UNREADABLE: receipt changed while being opened");
+    }
+    if (openedStat.size > MAX_TASK_GATE_REQUIREMENTS_BYTES) {
+      throw new Error(`TASK_GATE_REQUIREMENTS_OVERSIZED: ${openedStat.size} bytes exceeds ${MAX_TASK_GATE_REQUIREMENTS_BYTES}`);
+    }
+    return fs.readFileSync(descriptor, "utf-8");
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+async function readTaskGateRequirementsReceipts(directory, taskId) {
+  const filePath = safeTaskGateRequirementsReceiptPath(directory, taskId, false);
+  const text = readBoundedTextFile(filePath);
+  if (text === null)
+    return [];
+  const receipts = [];
+  for (const line of text.split(`
+`)) {
+    if (!line.trim())
+      continue;
+    const parsed = TaskGateRequirementsReceiptSchema.parse(JSON.parse(line));
+    if (parsed.taskId !== taskId) {
+      throw new Error(`TASK_GATE_REQUIREMENTS_IDENTITY_MISMATCH: expected ${taskId}, found ${parsed.taskId}`);
+    }
+    const { chainHash, ...withoutChainHash } = parsed;
+    const expectedHash = computeChainHash(withoutChainHash);
+    if (expectedHash !== chainHash) {
+      throw new Error(`TASK_GATE_REQUIREMENTS_CHAIN_MISMATCH: receipt for ${taskId} failed hash validation`);
+    }
+    const previousChainHash = receipts.at(-1)?.chainHash ?? null;
+    if (parsed.previousChainHash !== previousChainHash) {
+      throw new Error(`TASK_GATE_REQUIREMENTS_CHAIN_MISMATCH: receipt for ${taskId} failed linkage validation`);
+    }
+    receipts.push(parsed);
+  }
+  return receipts;
+}
+function deriveReceiptRole(event) {
+  switch (event.type) {
+    case "accepted_mutation":
+    case "dispatch_attempted":
+    case "dispatch_no_mutation":
+      if (typeof event.agentType === "string" && event.agentType.trim().length > 0) {
+        return {
+          normalizedRole: event.agentType.trim(),
+          testEngineerExempt: event.agentType === "coder" ? event.context?.testEngineerExempt === true : null
+        };
+      }
+      return null;
+    case "stage_b_completed":
+    case "gate_recorded":
+      return {
+        normalizedRole: event.gate,
+        testEngineerExempt: null
+      };
+    default:
+      return null;
+  }
+}
+function shouldAppendReceipt(current, next, role) {
+  if (next.required_gates.length === 0)
+    return false;
+  const currentGeneration = current?.workflow?.generation ?? -1;
+  const nextGeneration = next.workflow?.generation ?? -1;
+  if (current === null)
+    return true;
+  if (JSON.stringify(current.required_gates) !== JSON.stringify(next.required_gates)) {
+    return true;
+  }
+  if ((current.test_engineer_exempt ?? null) !== role.testEngineerExempt) {
+    return true;
+  }
+  return currentGeneration !== nextGeneration;
+}
+async function appendTaskGateRequirementsReceiptIfNeeded(directory, taskId, current, next, event) {
+  const role = deriveReceiptRole(event);
+  if (!role || !shouldAppendReceipt(current, next, role))
+    return;
+  const filePath = safeTaskGateRequirementsReceiptPath(directory, taskId, true);
+  const receipts = await readTaskGateRequirementsReceipts(directory, taskId);
+  const latest = receipts.at(-1);
+  const baseReceipt = {
+    schemaVersion: 1,
+    taskId,
+    generation: next.workflow?.generation ?? 0,
+    normalizedRole: role.normalizedRole,
+    testEngineerExempt: role.testEngineerExempt,
+    requiredGates: [...next.required_gates],
+    sourceEvent: event.type,
+    sourceTransitionId: event.transitionId ?? null,
+    recordedAt: new Date().toISOString(),
+    previousChainHash: latest?.chainHash ?? null
+  };
+  const receipt = {
+    ...baseReceipt,
+    chainHash: computeChainHash(baseReceipt)
+  };
+  if (latest && latest.generation === receipt.generation && latest.normalizedRole === receipt.normalizedRole && latest.testEngineerExempt === receipt.testEngineerExempt && JSON.stringify(latest.requiredGates) === JSON.stringify(receipt.requiredGates) && latest.sourceTransitionId === receipt.sourceTransitionId) {
+    return;
+  }
+  const lines = [...receipts, receipt].map((entry) => JSON.stringify(entry));
+  assertSafeRequirementsParent(directory, false);
+  await atomicWriteFile(filePath, `${lines.join(`
+`)}
+`);
+  assertSafeRequirementsParent(directory, false);
+}
 
 // src/validation/task-id.ts
 var STRICT_TASK_ID_PATTERN = /^\d+\.\d+(\.\d+)*$/;
@@ -90,7 +299,7 @@ function sanitizeTaskId(taskId) {
 }
 
 // src/workflow/workflow-wal-file.ts
-import * as fs2 from "fs";
+import * as fs3 from "fs";
 import { mkdir, open } from "fs/promises";
 import { dirname } from "path";
 
@@ -98,11 +307,11 @@ import { dirname } from "path";
 init_warning_buffer();
 
 // src/turbo/lean/recovery.ts
-import * as fs from "fs";
-import * as path from "path";
+import * as fs2 from "fs";
+import * as path2 from "path";
 var RECOVERY_DIR_NAME = "recovery";
 function recoveryDir(directory) {
-  return path.join(directory, ".swarm", RECOVERY_DIR_NAME);
+  return path2.join(directory, ".swarm", RECOVERY_DIR_NAME);
 }
 function isRecoveryRecord(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -116,11 +325,11 @@ function readRecoveryRecords(directory) {
   const dir = recoveryDir(directory);
   let entries;
   try {
-    entries = fs.readdirSync(dir, { withFileTypes: true });
+    entries = fs2.readdirSync(dir, { withFileTypes: true });
   } catch {
     return {
       records: [],
-      errored: fs.existsSync(dir)
+      errored: fs2.existsSync(dir)
     };
   }
   const records = [];
@@ -128,9 +337,9 @@ function readRecoveryRecords(directory) {
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".json"))
       continue;
-    const full = path.join(dir, entry.name);
+    const full = path2.join(dir, entry.name);
     try {
-      const parsed = JSON.parse(fs.readFileSync(full, "utf-8"));
+      const parsed = JSON.parse(fs2.readFileSync(full, "utf-8"));
       if (isRecoveryRecord(parsed)) {
         records.push(parsed);
       } else {
@@ -189,7 +398,7 @@ init_git_executable();
 var _internals = {
   bunSpawn,
   platform: process.platform,
-  sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  sleep: (ms) => new Promise((resolve2) => setTimeout(resolve2, ms)),
   cleanupOrphanedBranches,
   startupOrphanRecovery,
   extractSessionId,
@@ -763,9 +972,9 @@ var SMALL_WORKFLOW_WAL_MAX_BYTES = 1024 * 1024;
 var CHUNK_BYTES = 64 * 1024;
 var _internals2 = {
   openFile: open,
-  openFileSync: fs2.openSync,
-  readFileSync: fs2.readSync,
-  closeFileSync: fs2.closeSync
+  openFileSync: fs3.openSync,
+  readFileSync: fs3.readSync,
+  closeFileSync: fs3.closeSync
 };
 function maxBytesFor(kind) {
   return kind === "coder-settlement" ? CODER_SETTLEMENT_MAX_BYTES : SMALL_WORKFLOW_WAL_MAX_BYTES;
@@ -1017,8 +1226,14 @@ var TaskEvidenceSchema = exports_external.object({
   required_gates: exports_external.array(exports_external.string()).default([]),
   gates: exports_external.record(exports_external.string(), GateEvidenceSchema),
   turbo: exports_external.boolean().optional(),
+  requirements_state: exports_external.enum(["known", "unknown"]).optional(),
   test_engineer_exempt: exports_external.boolean().optional(),
-  workflow: TaskWorkflowMetadataSchema.optional()
+  workflow: TaskWorkflowMetadataSchema.optional(),
+  repair_provenance: exports_external.object({
+    source_sha256: exports_external.string().regex(/^[a-f0-9]{64}$/).nullable(),
+    source_generation: exports_external.number().int().min(0).nullable(),
+    requirements_receipt_hash: exports_external.string().regex(/^[a-f0-9]{64}$/).nullable()
+  }).optional()
 });
 function parseTaskEvidence(raw, expectedTaskId) {
   const parsed = TaskEvidenceSchema.parse(JSON.parse(raw));
@@ -1259,18 +1474,18 @@ function reduceTaskWorkflowSnapshot(current, event, context) {
   }
 }
 function getEvidenceDir(directory) {
-  const swarmDir = path2.resolve(directory, ".swarm");
-  const evidenceDir = path2.join(swarmDir, "evidence");
-  mkdirSync2(evidenceDir, { recursive: true });
+  const swarmDir = path3.resolve(directory, ".swarm");
+  const evidenceDir = path3.join(swarmDir, "evidence");
+  mkdirSync3(evidenceDir, { recursive: true });
   let resolvedSwarmDir;
   let resolvedEvidenceDir;
   try {
-    resolvedSwarmDir = path2.normalize(realpathSync(swarmDir));
-    resolvedEvidenceDir = path2.normalize(realpathSync(evidenceDir));
+    resolvedSwarmDir = path3.normalize(realpathSync2(swarmDir));
+    resolvedEvidenceDir = path3.normalize(realpathSync2(evidenceDir));
   } catch (error) {
     throw new Error(`Unable to resolve evidence directory: ${error.message}`);
   }
-  const swarmPrefix = `${resolvedSwarmDir}${path2.sep}`;
+  const swarmPrefix = `${resolvedSwarmDir}${path3.sep}`;
   const withinSwarmBoundary = process.platform === "win32" ? resolvedEvidenceDir.toLowerCase().startsWith(swarmPrefix.toLowerCase()) : resolvedEvidenceDir.startsWith(swarmPrefix);
   if (!withinSwarmBoundary) {
     throw new Error(`Evidence path escapes .swarm boundary: ${resolvedEvidenceDir}`);
@@ -1283,7 +1498,7 @@ function getEvidencePath(directory, taskId) {
 }
 function readExisting(evidencePath, taskId) {
   try {
-    const raw = readFileSync2(evidencePath, "utf-8");
+    const raw = readFileSync3(evidencePath, "utf-8");
     return parseTaskEvidence(raw, taskId);
   } catch (error) {
     if (error.code === "ENOENT")
@@ -1399,7 +1614,7 @@ async function withTaskEvidenceTransaction(directory, taskId, agent, callback) {
   assertValidTaskId(taskId);
   return withTaskEvidenceLock(directory, taskId, agent, async () => {
     const resolvedEvidenceDir = getEvidenceDir(directory);
-    const evidencePath = path2.join(resolvedEvidenceDir, `${taskId}.json`);
+    const evidencePath = path3.join(resolvedEvidenceDir, `${taskId}.json`);
     let current = null;
     try {
       current = readExisting(evidencePath, taskId);
@@ -1407,12 +1622,15 @@ async function withTaskEvidenceTransaction(directory, taskId, agent, callback) {
       telemetry.gateParseError(taskId, error);
       throw error;
     }
-    const persist = async (nextEvidence) => {
+    const persist = async (nextEvidence, event) => {
       const validated = TaskEvidenceSchema.parse({
         ...nextEvidence,
         taskId
       });
       await atomicWriteFile(evidencePath, JSON.stringify(validated, null, 2));
+      if (event) {
+        await appendTaskGateRequirementsReceiptIfNeeded(directory, taskId, current, validated, event);
+      }
       current = validated;
       return validated;
     };
@@ -1423,7 +1641,7 @@ async function withTaskEvidenceTransaction(directory, taskId, agent, callback) {
         assertTaskEvidenceWriteAllowed(directory, taskId, event);
         const nextEvidence = updateEvidenceForTransition(current, event);
         nextEvidence.taskId = taskId;
-        return persist(nextEvidence);
+        return persist(nextEvidence, event);
       }
     });
   });
@@ -1480,7 +1698,7 @@ function readTaskEvidenceRaw(directory, taskId) {
   assertValidTaskId(taskId);
   const evidencePath = getEvidencePath(directory, taskId);
   try {
-    const raw = readFileSync2(evidencePath, "utf-8");
+    const raw = readFileSync3(evidencePath, "utf-8");
     return parseTaskEvidence(raw, taskId);
   } catch (error) {
     const code = error.code;

package/dist/cli/{index-b3xret0a.js → index-ncfjxz9n.js}

@@ -6,12 +6,12 @@ import {
   resolveSwarmKnowledgePath,
   transactKnowledge,
   wordBigrams
-} from "./index-qfawexc8.js";
+} from "./index-6wf75rcm.js";
 import {
   queryHistoricalOutcomes,
   readKnowledgeEvents,
   recordKnowledgeEvent
-} from "./index-c13ttmak.js";
+} from "./index-cxn95n7q.js";
 import {
   init_knowledge_types,
   isActiveStatus
@@ -224,11 +224,11 @@ async function maybeQuarantineOnContradiction(directory, entryId, threshold, win
         alreadyInactive: true
       };
     }
-    const { quarantineEntry } = await import("./knowledge-validator-91ym56e0.js");
+    const { quarantineEntry } = await import("./knowledge-validator-g8ne80v6.js");
     let policyConfig;
     try {
-      const { KnowledgeConfigSchema } = await import("./schema-nq9tcz87.js");
-      const { loadPluginConfigWithMeta } = await import("./index-kp87kr1a.js");
+      const { KnowledgeConfigSchema } = await import("./schema-mpcm7nje.js");
+      const { loadPluginConfigWithMeta } = await import("./index-9gt8g2qj.js");
       const { config: loadedConfig } = loadPluginConfigWithMeta(directory);
       policyConfig = KnowledgeConfigSchema.parse(loadedConfig.knowledge ?? {});
     } catch {

package/dist/cli/{index-e00wbqw5.js → index-np4ytvvv.js}

@@ -2,14 +2,14 @@
 import {
   readKnowledge,
   transactKnowledge
-} from "./index-qfawexc8.js";
+} from "./index-6wf75rcm.js";
 import {
   init_git_executable,
   resolveGitExecutableAsync
 } from "./index-9e6fdz2h.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-s72naw1j.js";
+} from "./index-x8pm918t.js";
 import {
   init_knowledge_types,
   isActiveStatus

package/dist/cli/{index-jy9bwa9k.js → index-nsr5b69r.js}

@@ -9,11 +9,11 @@ import {
 } from "./index-y8552snf.js";
 import {
   atomicWriteFile
-} from "./index-6q3agdmr.js";
+} from "./index-j20fzn0w.js";
 import {
   assertProjectRoot,
   withEvidenceLock
-} from "./index-pa86tpgt.js";
+} from "./index-bghwrr59.js";
 import {
   exports_external,
   init_zod