opencode-swarm 7.148.4 → 7.149.0

package/dist/observability/catalog.d.ts

@@ -1,8 +1,8 @@
 /**
  * The event catalog (issue #2029).
  *
- * Exactly 47 entries, matching the `TelemetryEvent` union at
- * `src/telemetry.ts:15-109`. Thirty-eight predate the #2029 contract; the 39th is
+ * Exactly 48 entries, matching the `TelemetryEvent` union at
+ * `src/telemetry.ts:15-125`. Thirty-eight predate the #2029 contract; the 39th is
  * `agent_conflict_detected` (previously emitted through a force-cast past the
  * type system), the 40th is `close_archive_result` (issue #2030 — the
  * structured close/archive result event), the 41st is the bounded diagnostic
@@ -12,11 +12,13 @@
  * mutation audit, the 44th is the bounded `residue_health` atomic-write
  * residue audit (issue #2035), the 46th is the bounded
  * `context_telemetry_health` storage audit for the issue-#2037
- * `.swarm/context-telemetry.jsonl` store, and the 47th is the counts-only
+ * `.swarm/context-telemetry.jsonl` store, the 47th is the counts-only
  * `skill_usage_health` storage audit for the issue-#2038
- * `.swarm/skill-usage.jsonl` store and its authoritative pending sidecar. These late additions are instances of
- * the defect class this contract exists to close: an event kind entering the
- * stream with no registration.
+ * `.swarm/skill-usage.jsonl` store and its authoritative pending sidecar,
+ * and the 48th is the bounded `core_events_health` storage audit for the
+ * issue-#2039 `.swarm/events.jsonl` store. These late additions are instances
+ * of the defect class this contract exists to close: an event kind entering
+ * the stream with no registration.
  *
  * Every entry names a real producer `file:line`, a retention owner issue at or
  * above #2030 — every entry today cites the #2030-#2051 programme, but only the
@@ -69,7 +71,7 @@ export interface CatalogEntry {
     /**
      * Whether an event of this kind must carry `trace.parentSpanId`.
      *
-     * `false` for all 47 entries today, and that is a truthful statement about
+     * `false` for all 48 entries today, and that is a truthful statement about
      * the current system rather than a placeholder: no producer supplies a
      * parent span, so `createObservation` never sets one. Setting this to `true`
      * for a kind whose producer cannot supply a parent would make every

package/dist/sast/rules/javascript-call-classifier.d.ts

@@ -0,0 +1,4 @@
+import type { SastContext, SastMatch } from './index';
+export type JavascriptCallFamily = 'eval' | 'function-constructor' | 'exec' | 'timer-string' | 'document-write' | 'postmessage';
+export type JavascriptCallDisposition = 'confirmed' | 'safe' | 'ambiguous' | 'none';
+export declare function classifyJavascriptCall(match: SastMatch, context: SastContext, family: JavascriptCallFamily): JavascriptCallDisposition;

package/dist/services/spec-drift-recovery.d.ts

@@ -73,8 +73,15 @@ declare function verifySnapshot(snapshotPath: string, currentSpec: {
     content: string;
 } | null): Promise<void>;
 declare function ensureSnapshotEvent(directory: string, plan: NonNullable<Awaited<ReturnType<typeof loadPlanJsonOnly>>>, transitionId: string): Promise<void>;
-declare function appendEvent(eventsPath: string, event: SpecDriftAcknowledgedEvent | SpecDriftRepairedEvent): Promise<void>;
-declare function verifyEventPresence(eventsPath: string, eventType: 'spec_drift_acknowledged' | 'spec_drift_repaired', transitionId: string): Promise<boolean>;
+/**
+ * Issue #2039: audit events append through the core event seam with the
+ * authority-key dedupe restoring the old pre-check (lock-scoped, at-most-once),
+ * and presence verification reads the authoritative index — never the whole
+ * file. Fail-closed semantics are preserved: a corrupt authority index throws
+ * (previously a malformed events.jsonl line threw).
+ */
+declare function appendEvent(directory: string, event: SpecDriftAcknowledgedEvent | SpecDriftRepairedEvent): Promise<void>;
+declare function verifyEventPresence(directory: string, eventType: 'spec_drift_acknowledged' | 'spec_drift_repaired', transitionId: string): Promise<boolean>;
 export declare function reconcileSpecDrift(directory: string, options: {
     mode: RecoveryMode;
     actor: RecoveryActor;

package/dist/telemetry.d.ts

@@ -32,7 +32,7 @@ export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activa
  * `prm_hard_stop` TRIGGER emitted by `src/prm/escalation.ts`. A trigger with
  * no matching delivery means the containment never reached the agent.
  */
- | 'prm_hard_stop_delivered' | 'agent_conflict_detected' | 'close_archive_result' | 'knowledge_receipt_transition' | 'knowledge_maintenance' | 'residue_health' | 'context_telemetry_health' | 'skill_usage_health';
+ | 'prm_hard_stop_delivered' | 'agent_conflict_detected' | 'close_archive_result' | 'knowledge_receipt_transition' | 'knowledge_maintenance' | 'residue_health' | 'context_telemetry_health' | 'skill_usage_health' | 'core_events_health';
 /** Stable classification for how a reviewer-gate decision was established. */
 export type ReviewerGateEvidenceKind = 'genuine' | 'fallback' | 'data_quality' | 'block';
 /**
@@ -291,6 +291,29 @@ export declare const telemetry: {
         newest_timestamp: string | null;
         coverage: boolean;
     }): void;
+    /**
+     * Core event store health (issue #2039): emitted on compaction and close
+     * for the bounded `.swarm/events.jsonl` store. Counts ONLY — no event
+     * content and no filesystem paths, matching the observability contract's
+     * no-content-in-metrics rule. `authority_index_count` /
+     * `authority_evicted_count` disclose the authoritative partition's size
+     * and FIFO-eviction total (eviction is the only reachable
+     * absent-after-compaction case for authority lookups).
+     */
+    coreEventsHealth(data: {
+        trigger: "compaction" | "close";
+        accepted_count: number;
+        compacted_count: number;
+        retained_count: number;
+        dropped_count: number;
+        corrupt_count: number;
+        authority_index_count: number;
+        authority_evicted_count: number;
+        oldest_timestamp: string | null;
+        newest_timestamp: string | null;
+        bytes: number;
+        limit_bytes: number;
+    }): void;
     /**
      * Issue #2063 C2 — the PRM hard-stop DENIAL was actually delivered to the
      * agent (thrown by the guardrails `toolBefore` consumer). `prm_hard_stop`

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.148.4",
+	"version": "7.149.0",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -109,6 +109,7 @@
 		"repro:1873": "bun build scripts/repro-1873-entry.ts --outdir dist-build-test/repro-1873 --target node --format esm && node scripts/repro-1873.mjs",
 		"check:events": "bun run scripts/check-event-contract.ts",
 		"check:retention": "bun run scripts/check-retention-registry.ts",
+		"check:core-events": "bun run scripts/check-core-events-usage.ts",
 		"check:test-file-cap": "bun run scripts/check-test-file-cap.ts",
 		"check:pending-fragment": "bun run scripts/check-pending-fragment.ts",
 		"check:gate-portability": "bun run scripts/check-gate-portability.ts",

package/dist/cli/{curator-drift-fv4rttf4.js → curator-drift-2h1d2fnq.js}

@@ -6,13 +6,13 @@ import {
   readEffectiveSpecSync
 } from "./index-9ss2m4rs.js";
 import"./index-n832052r.js";
-import"./index-4rhhvd1a.js";
 import {
   readSwarmFileAsync,
   validateSwarmPath
 } from "./index-4cgee5vh.js";
 import"./index-z6xqpmqg.js";
 import"./index-r3mvsbtq.js";
+import"./index-4rhhvd1a.js";
 import"./index-zjygnfay.js";
 import"./index-bpmtbmy9.js";
 import {

package/dist/cli/{index-g8wwj0sz.js → index-vnn7qq8c.js}

@@ -1,11 +1,11 @@
 // @bun
+import {
+  bunSpawn
+} from "./index-r3mvsbtq.js";
 import {
   init_git_executable,
   resolveGitExecutable
 } from "./index-9e6fdz2h.js";
-import {
-  bunSpawn
-} from "./index-r3mvsbtq.js";
 
 // src/background/workspace-snapshot.ts
 import * as child_process from "child_process";