opencode-swarm 7.149.1 → 7.151.0

package/dist/lang/symbol-graph.d.ts

@@ -50,3 +50,18 @@ export interface FileSymbolFacts {
  * @returns FileSymbolFacts, or null on failure
  */
 export declare function extractFileSymbols(grammarId: string, source: string): Promise<FileSymbolFacts | null>;
+declare function parseDartImport(text: string): FileSymbolFacts['imports'][0] | FileSymbolFacts['imports'] | null;
+declare function parseRubyRequire(text: string): FileSymbolFacts['imports'][0] | null;
+declare function parsePhpUse(text: string): FileSymbolFacts['imports'][0] | null;
+/**
+ * DI seam for direct parser tests — the import parsers are module-private by
+ * design; tests exercise them through this seam instead of `mock.module`,
+ * which leaks across Bun's shared test-runner process (@see AGENTS.md
+ * invariant #7; PR #2361 review R10/PRR-017).
+ */
+export declare const _internals: {
+    parseDartImport: typeof parseDartImport;
+    parseRubyRequire: typeof parseRubyRequire;
+    parsePhpUse: typeof parsePhpUse;
+};
+export {};

package/dist/observability/catalog.d.ts

@@ -1,8 +1,8 @@
 /**
  * The event catalog (issue #2029).
  *
- * Exactly 48 entries, matching the `TelemetryEvent` union at
- * `src/telemetry.ts:15-125`. Thirty-eight predate the #2029 contract; the 39th is
+ * Exactly 49 entries, matching the `TelemetryEvent` union at
+ * `src/telemetry.ts:15-131`. Thirty-eight predate the #2029 contract; the 39th is
  * `agent_conflict_detected` (previously emitted through a force-cast past the
  * type system), the 40th is `close_archive_result` (issue #2030 — the
  * structured close/archive result event), the 41st is the bounded diagnostic
@@ -15,8 +15,10 @@
  * `.swarm/context-telemetry.jsonl` store, the 47th is the counts-only
  * `skill_usage_health` storage audit for the issue-#2038
  * `.swarm/skill-usage.jsonl` store and its authoritative pending sidecar,
- * and the 48th is the bounded `core_events_health` storage audit for the
- * issue-#2039 `.swarm/events.jsonl` store. These late additions are instances
+ * the 48th is the bounded `core_events_health` storage audit for the
+ * issue-#2039 `.swarm/events.jsonl` store, and the 49th is the bounded
+ * `shell_audit_health` storage audit for the issue-#2040
+ * `.swarm/session/shell-audit.jsonl` security-audit store. These late additions are instances
  * of the defect class this contract exists to close: an event kind entering
  * the stream with no registration.
  *
@@ -71,7 +73,7 @@ export interface CatalogEntry {
     /**
      * Whether an event of this kind must carry `trace.parentSpanId`.
      *
-     * `false` for all 48 entries today, and that is a truthful statement about
+     * `false` for all 49 entries today, and that is a truthful statement about
      * the current system rather than a placeholder: no producer supplies a
      * parent span, so `createObservation` never sets one. Setting this to `true`
      * for a kind whose producer cannot supply a parent would make every

package/dist/services/guardrail-log-service.d.ts

@@ -6,5 +6,9 @@ export interface GuardrailLogEntry {
     tool: string;
     command?: string;
     path?: string;
+    /** 16-hex sha256 fingerprint of the redacted command (typed entries only);
+     *  rendered as a correlation suffix so duplicate/related decisions can be
+     *  linked without repeating command content. */
+    commandHash?: string;
 }
 export declare function handleGuardrailLog(directory: string, args: string[]): Promise<string>;

package/dist/telemetry.d.ts

@@ -32,7 +32,7 @@ export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activa
  * `prm_hard_stop` TRIGGER emitted by `src/prm/escalation.ts`. A trigger with
  * no matching delivery means the containment never reached the agent.
  */
- | 'prm_hard_stop_delivered' | 'agent_conflict_detected' | 'close_archive_result' | 'knowledge_receipt_transition' | 'knowledge_maintenance' | 'residue_health' | 'context_telemetry_health' | 'skill_usage_health' | 'core_events_health';
+ | 'prm_hard_stop_delivered' | 'agent_conflict_detected' | 'close_archive_result' | 'knowledge_receipt_transition' | 'knowledge_maintenance' | 'residue_health' | 'context_telemetry_health' | 'skill_usage_health' | 'core_events_health' | 'shell_audit_health';
 /** Stable classification for how a reviewer-gate decision was established. */
 export type ReviewerGateEvidenceKind = 'genuine' | 'fallback' | 'data_quality' | 'block';
 /**
@@ -314,6 +314,27 @@ export declare const telemetry: {
         bytes: number;
         limit_bytes: number;
     }): void;
+    /**
+     * Shell-audit store health (issue #2040): emitted on compaction and close
+     * for the bounded `.swarm/session/shell-audit.jsonl` security-audit
+     * store. Counts ONLY — no command content, no filesystem paths, no agent
+     * or session identifiers, matching the observability contract's
+     * no-content-in-metrics rule (issue #2040 requirement 5). `dropped_count`
+     * discloses allowed-class decisions folded by the age ceiling;
+     * `compacted_count` budget folds (byte/count caps).
+     */
+    shellAuditHealth(data: {
+        trigger: "compaction" | "close";
+        accepted_count: number;
+        compacted_count: number;
+        retained_count: number;
+        dropped_count: number;
+        corrupt_count: number;
+        oldest_timestamp: string | null;
+        newest_timestamp: string | null;
+        bytes: number;
+        limit_bytes: number;
+    }): void;
     /**
      * Issue #2063 C2 — the PRM hard-stop DENIAL was actually delivered to the
      * agent (thrown by the guardrails `toolBefore` consumer). `prm_hard_stop`

package/dist/tools/repo-graph/builder.d.ts

@@ -11,7 +11,7 @@
  * used by both the builder and the incremental updater.
  */
 import { extractFileSymbols } from '../../lang/symbol-graph';
-import { extractGoSymbols, extractPythonSymbols, extractRustSymbols, extractTSSymbols } from '../symbols';
+import { extractDartSymbols, extractGoSymbols, extractPhpSymbols, extractPythonSymbols, extractRubySymbols, extractRustSymbols, extractTSSymbols } from '../symbols';
 import { extractFileOntology } from './ontology';
 import { safeRealpathSync } from './safe-realpath';
 import type { BuildWorkspaceGraphOptions, GraphEdge, GraphExtractorInputWitness, GraphNode, RepoGraph, RepoGraphDiagnostics, SymbolEdge } from './types';
@@ -28,7 +28,13 @@ export declare const _internals: {
     extractPythonSymbols: typeof extractPythonSymbols;
     extractRustSymbols: typeof extractRustSymbols;
     extractGoSymbols: typeof extractGoSymbols;
+    extractDartSymbols: typeof extractDartSymbols;
+    extractRubySymbols: typeof extractRubySymbols;
+    extractPhpSymbols: typeof extractPhpSymbols;
     parseFileImports: typeof parseFileImports;
+    parseDartFileImports: typeof parseDartFileImports;
+    parseRubyFileImports: typeof parseRubyFileImports;
+    parsePhpFileImports: typeof parsePhpFileImports;
     extractFileOntology: typeof extractFileOntology;
     stripComments: typeof stripComments;
     computeUsedSymbols: typeof computeUsedSymbols;
@@ -132,6 +138,26 @@ interface ParsedImport {
  */
 declare function stripComments(content: string): string;
 declare function parseFileImports(rawContent: string, sourceFile?: string, workspaceRoot?: string): ParsedImport[];
+/**
+ * Regex import fallback for Dart (see {@link parseCSharpFileImports}).
+ * `hide` clauses are intentionally unhandled — the import is still recorded
+ * as a namespace import (all symbols minus hidden ones), which is correct
+ * for graph purposes.
+ */
+declare function parseDartFileImports(rawContent: string): ParsedImport[];
+/**
+ * Regex import fallback for Ruby require/require_relative. `require_relative`
+ * resolves against the requiring file's directory, so the specifier is
+ * normalized to './name' when no explicit relative prefix is present.
+ */
+declare function parseRubyFileImports(rawContent: string): ParsedImport[];
+/**
+ * Regex import fallback for PHP `use` declarations. Grouped `use A\B, C\D;`
+ * forms are a known limitation (the whole group is skipped); FQN specifiers
+ * are recorded as-is — mapping them to workspace files requires composer
+ * PSR-4 awareness, which is out of scope (#1531 "where practical").
+ */
+declare function parsePhpFileImports(rawContent: string): ParsedImport[];
 /**
  * Conservatively determine which imported bindings are actually referenced in
  * the importing file's body.

package/dist/tools/symbols.d.ts

@@ -19,5 +19,40 @@ export declare function extractTSSymbols(filePath: string, cwd: string): SymbolI
 export declare function extractPythonSymbols(filePath: string, cwd: string): SymbolInfo[];
 export declare function extractRustSymbols(filePath: string, cwd: string): SymbolInfo[];
 export declare function extractGoSymbols(filePath: string, cwd: string): SymbolInfo[];
+/**
+ * Dart symbols: classes/mixins/enums/extensions and functions. Visibility is
+ * the `_`-prefix convention. Functions declared INSIDE a type body are
+ * emitted as qualified `TypeName.member` method symbols (mirroring the Swift
+ * extractor's naming) instead of being mislabeled as top-level functions;
+ * the qualification also keeps same-named members of different classes from
+ * collapsing in the name:kind dedup.
+ */
+export declare function extractDartSymbols(filePath: string, cwd: string): SymbolInfo[];
+/**
+ * Ruby symbols: modules, classes, constants, and `def` methods with
+ * `private`/`protected` section tracking. A nested class/module saves and
+ * restores the outer section (approximate `end`-balance tracking); targeted
+ * `private :sym` marks the named method. Singleton methods keep their `self.`
+ * qualification in the name. Dynamic constructs (`define_method`, `send`,
+ * metaprogramming) are invisible to this scanner by design.
+ */
+export declare function extractRubySymbols(filePath: string, cwd: string): SymbolInfo[];
+/**
+ * PHP symbols: namespaces, traits/interfaces/classes, functions and methods
+ * with visibility modifiers. Dynamic constructs (variable functions/classes,
+ * variable variables, Blade directives in `.blade.php`) are best-effort
+ * only — see docs/php-laravel.md.
+ */
+export declare function extractPhpSymbols(filePath: string, cwd: string): SymbolInfo[];
 export declare const symbols: ToolDefinition;
+/**
+ * DI seam for testability — tests substitute via `_internals.fn` rather than
+ * `mock.module`, which leaks across Bun's shared test-runner process.
+ * @see AGENTS.md invariant #7
+ */
+export declare const _internals: {
+    extractDartSymbols: typeof extractDartSymbols;
+    extractRubySymbols: typeof extractRubySymbols;
+    extractPhpSymbols: typeof extractPhpSymbols;
+};
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.149.1",
+	"version": "7.151.0",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -110,6 +110,7 @@
 		"check:events": "bun run scripts/check-event-contract.ts",
 		"check:retention": "bun run scripts/check-retention-registry.ts",
 		"check:core-events": "bun run scripts/check-core-events-usage.ts",
+		"check:shell-audit": "bun run scripts/check-shell-audit-usage.ts",
 		"check:test-file-cap": "bun run scripts/check-test-file-cap.ts",
 		"check:pending-fragment": "bun run scripts/check-pending-fragment.ts",
 		"check:gate-portability": "bun run scripts/check-gate-portability.ts",

package/dist/cli/index-eaq9b0qm.js

@@ -1,110 +0,0 @@
-// @bun
-import {
-  redactPath,
-  redactShellCommand
-} from "./index-cna8m7my.js";
-
-// src/services/guardrail-log-service.ts
-import * as fs from "fs/promises";
-import * as path from "path";
-var BLOCK_TYPES = new Set([
-  "file_write",
-  "scope_violation",
-  "destructive_block"
-]);
-function isBlockEntry(entry) {
-  if (entry.type === null || entry.type === undefined)
-    return false;
-  return BLOCK_TYPES.has(entry.type);
-}
-function redactSummary(entry) {
-  if (entry.type === "file_write" || entry.type === "scope_violation") {
-    const raw = entry.path ?? "";
-    return redactPath(raw);
-  }
-  if (entry.type === "destructive_block" || entry.type === "sandbox_wrap" || entry.type === "sandbox_skip" || entry.type === "shell" || entry.type === null || entry.type === undefined) {
-    const raw = entry.command ?? "";
-    return redactShellCommand(raw);
-  }
-  return "";
-}
-function formatEntry(entry) {
-  const decisionType = entry.type ?? "shell";
-  const summary = redactSummary(entry);
-  return `- [${entry.ts}] ${decisionType} | agent: ${entry.agent} | ${summary}`;
-}
-async function handleGuardrailLog(directory, args) {
-  const auditPath = path.join(directory, ".swarm", "session", "shell-audit.jsonl");
-  let raw;
-  try {
-    raw = await fs.readFile(auditPath, "utf-8");
-  } catch (error) {
-    if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
-      return "No guardrail decisions recorded yet.";
-    }
-    throw error;
-  }
-  const lines = raw.split(/\r?\n/);
-  const entries = [];
-  for (const line of lines) {
-    if (line.trim().length === 0)
-      continue;
-    let parsed;
-    try {
-      parsed = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    if (!isPlainObject(parsed))
-      continue;
-    if (typeof parsed.ts !== "string")
-      continue;
-    if (typeof parsed.sessionID !== "string")
-      continue;
-    if (typeof parsed.agent !== "string")
-      continue;
-    if (typeof parsed.tool !== "string")
-      continue;
-    const entry = {
-      ts: parsed.ts,
-      sessionID: parsed.sessionID,
-      agent: parsed.agent,
-      tool: parsed.tool
-    };
-    if (typeof parsed.type === "string") {
-      entry.type = parsed.type;
-    }
-    if (typeof parsed.command === "string") {
-      entry.command = parsed.command;
-    }
-    if (typeof parsed.path === "string") {
-      entry.path = parsed.path;
-    }
-    entries.push(entry);
-  }
-  if (entries.length === 0) {
-    return "No guardrail decisions recorded yet.";
-  }
-  const blocksOnly = args.includes("--blocks-only");
-  const filtered = blocksOnly ? entries.filter(isBlockEntry) : entries;
-  if (filtered.length === 0) {
-    if (blocksOnly) {
-      return "No guardrail block decisions recorded yet.";
-    }
-    return "No guardrail decisions recorded yet.";
-  }
-  filtered.sort((a, b) => {
-    const diff = b.ts.localeCompare(a.ts);
-    return diff === 0 ? 0 : diff;
-  });
-  const header = blocksOnly ? "# Guardrail Block Log (most-recent-first)" : "# Guardrail Decision Log (most-recent-first)";
-  const body = filtered.map(formatEntry).join(`
-`);
-  return `${header}
-
-${body}`;
-}
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && (value.constructor === Object || Object.getPrototypeOf(value) === null);
-}
-export { handleGuardrailLog };