opencode-swarm 7.150.0 → 7.151.1

package/dist/cli/index-2xfffkk0.js

@@ -0,0 +1,149 @@
+// @bun
+import {
+  getShellAuditFoldedSummary,
+  readShellAuditTail,
+  redactPath,
+  redactShellCommand
+} from "./index-1z7kx41f.js";
+
+// src/services/guardrail-log-service.ts
+var BLOCK_TYPES = new Set([
+  "file_write",
+  "scope_violation",
+  "destructive_block"
+]);
+var MAX_RENDERED_ENTRIES = 200;
+var MAX_RENDERED_LINE_CHARS = 512;
+function isBlockEntry(entry) {
+  if (entry.type === null || entry.type === undefined)
+    return false;
+  return BLOCK_TYPES.has(entry.type);
+}
+function redactSummary(entry) {
+  if (entry.type === "file_write" || entry.type === "scope_violation") {
+    const raw = entry.path ?? "";
+    return redactPath(raw);
+  }
+  if (entry.type === "destructive_block" || entry.type === "sandbox_wrap" || entry.type === "sandbox_skip" || entry.type === "shell" || entry.type === null || entry.type === undefined) {
+    const raw = entry.command ?? "";
+    return redactShellCommand(raw);
+  }
+  return "";
+}
+function sanitizeDisplayText(value) {
+  return value.replace(/\u001b\[[0-9;?]*[ -/]*[@-~]/g, "").replace(/[\u0000-\u0008\u000a-\u001f\u007f-\u009f]/g, "").replace(/[\u202a-\u202e\u2066-\u2069]/g, "").replace(/[\u200e\u200f\u200b-\u200d\u2060-\u2064\ufeff]/g, "");
+}
+function formatEntry(entry) {
+  const decisionType = entry.type ?? "shell";
+  const summary = redactSummary(entry);
+  let line = `- [${sanitizeDisplayText(entry.ts)}] ${sanitizeDisplayText(decisionType)} | agent: ${sanitizeDisplayText(entry.agent)} | ${sanitizeDisplayText(summary)}`;
+  if (entry.commandHash !== undefined) {
+    line += ` \xB7 fp:${sanitizeDisplayText(entry.commandHash)}`;
+  }
+  return line.length > MAX_RENDERED_LINE_CHARS ? `${line.slice(0, MAX_RENDERED_LINE_CHARS)}\u2026` : line;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && (value.constructor === Object || Object.getPrototypeOf(value) === null);
+}
+function parseEntries(raw) {
+  const lines = raw.split(/\r?\n/);
+  const entries = [];
+  for (const line of lines) {
+    if (line.trim().length === 0)
+      continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!isPlainObject(parsed))
+      continue;
+    if (typeof parsed.ts !== "string")
+      continue;
+    if (typeof parsed.sessionID !== "string")
+      continue;
+    if (typeof parsed.agent !== "string")
+      continue;
+    if (typeof parsed.tool !== "string")
+      continue;
+    const entry = {
+      ts: parsed.ts,
+      sessionID: parsed.sessionID,
+      agent: parsed.agent,
+      tool: parsed.tool
+    };
+    if (typeof parsed.type === "string") {
+      entry.type = parsed.type;
+    }
+    if (typeof parsed.command === "string") {
+      entry.command = parsed.command;
+    }
+    if (typeof parsed.path === "string") {
+      entry.path = parsed.path;
+    }
+    if (typeof parsed.commandHash === "string") {
+      entry.commandHash = parsed.commandHash;
+    }
+    entries.push(entry);
+  }
+  return entries;
+}
+async function handleGuardrailLog(directory, args) {
+  const window = readShellAuditTail(directory);
+  const entries = parseEntries(window.text);
+  const blocksOnly = args.includes("--blocks-only");
+  if (entries.length === 0) {
+    const folded2 = getShellAuditFoldedSummary(directory);
+    if (folded2 !== null && folded2.totalDecisions > 0) {
+      const note = `${folded2.totalDecisions} earlier decision(s) compacted into the audit manifest.`;
+      return blocksOnly ? `No guardrail block decisions in the read window; ${note}` : `No guardrail decisions in the read window; ${note}`;
+    }
+    return blocksOnly ? "No guardrail block decisions recorded yet." : "No guardrail decisions recorded yet.";
+  }
+  const filtered = blocksOnly ? entries.filter(isBlockEntry) : entries;
+  if (filtered.length === 0) {
+    const folded2 = getShellAuditFoldedSummary(directory);
+    if (blocksOnly && folded2 !== null) {
+      const foldedBlocks = [...BLOCK_TYPES].reduce((sum, type) => sum + (folded2.byType[type] ?? 0), 0);
+      if (foldedBlocks > 0) {
+        return `No guardrail block decisions in the read window; ${foldedBlocks} earlier block decision(s) compacted into the audit manifest.`;
+      }
+    }
+    if (blocksOnly) {
+      return "No guardrail block decisions recorded yet.";
+    }
+    return "No guardrail decisions recorded yet.";
+  }
+  filtered.sort((a, b) => {
+    const diff = b.ts.localeCompare(a.ts);
+    return diff === 0 ? 0 : diff;
+  });
+  const rendered = filtered.slice(0, MAX_RENDERED_ENTRIES);
+  const header = blocksOnly ? "# Guardrail Block Log (most-recent-first)" : "# Guardrail Decision Log (most-recent-first)";
+  const body = rendered.map(formatEntry).join(`
+`);
+  const notes = [];
+  if (rendered.length < filtered.length) {
+    notes.push(`showing ${rendered.length} most recent of ${filtered.length} matching entries in the read window`);
+  }
+  if (window.truncated || window.coverage === "truncated") {
+    notes.push(`read window truncated to the newest bounded tail (older decisions may exist beyond it)`);
+  }
+  const folded = getShellAuditFoldedSummary(directory);
+  if (folded !== null && folded.totalDecisions > 0) {
+    notes.push(`${folded.totalDecisions} earlier decision(s) already compacted into the audit manifest (lifetime total)`);
+  }
+  if (notes.length === 0) {
+    return `${header}
+
+${body}`;
+  }
+  return `${header}
+
+${body}
+
+---
+${notes.join("; ")}.`;
+}
+export { handleGuardrailLog };

package/dist/cli/{index-mef0trex.js → index-4y7n76bn.js}

@@ -21,7 +21,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "opencode-swarm",
-    version: "7.150.0",
+    version: "7.151.1",
     description: "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
     main: "dist/index.js",
     types: "dist/index.d.ts",
@@ -131,6 +131,7 @@ var init_package = __esm(() => {
       "check:events": "bun run scripts/check-event-contract.ts",
       "check:retention": "bun run scripts/check-retention-registry.ts",
       "check:core-events": "bun run scripts/check-core-events-usage.ts",
+      "check:shell-audit": "bun run scripts/check-shell-audit-usage.ts",
       "check:test-file-cap": "bun run scripts/check-test-file-cap.ts",
       "check:pending-fragment": "bun run scripts/check-pending-fragment.ts",
       "check:gate-portability": "bun run scripts/check-gate-portability.ts",

package/dist/cli/{index-htqs4p52.js → index-5jwbepcr.js}

@@ -6,7 +6,7 @@ import {
   PluginConfigSchema,
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-mef0trex.js";
+} from "./index-4y7n76bn.js";
 import {
   ALL_AGENT_NAMES,
   init_constants

package/dist/cli/{index-1wmd5wn1.js → index-5sh0kqf5.js}

@@ -2,7 +2,7 @@
 import {
   autoCommitDirty,
   cleanUntrackedFiles
-} from "./index-1rpjd5na.js";
+} from "./index-twhhwe74.js";
 import {
   isPathWithinDeclaredScope,
   unsafePathTextReason
@@ -26,13 +26,13 @@ import {
   atomicWriteFile,
   taskEvidencePath,
   withTaskEvidenceLock
-} from "./index-apwcvfjt.js";
+} from "./index-frp2hwdg.js";
 import {
   assertProjectRoot
-} from "./index-m8dn0qnm.js";
+} from "./index-txbd25bc.js";
 import {
   telemetry
-} from "./index-xggpmtfx.js";
+} from "./index-aw492hpn.js";
 import {
   exports_external,
   init_zod

package/dist/cli/{index-exn0ztsv.js → index-6zkm4p7p.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   telemetry
-} from "./index-xggpmtfx.js";
+} from "./index-aw492hpn.js";
 import {
   init_logger,
   warn

package/dist/cli/{index-x3pt7d0b.js → index-7w2b1z4j.js}

@@ -12,14 +12,14 @@ import {
   detectPosixWrites,
   detectWindowsWrites,
   resolveWriteTargets
-} from "./index-qqs44wcp.js";
+} from "./index-kzdv0g9e.js";
 import {
   checkFileAuthority,
   classifyFile,
   isInDeclaredScope,
   redactPath,
   redactShellCommand
-} from "./index-bhg6brtw.js";
+} from "./index-1z7kx41f.js";
 
 // src/services/guardrail-explain-service.ts
 import path from "path";

package/dist/cli/{index-s0xz2520.js → index-9d9p7bv2.js}

@@ -2,7 +2,7 @@
 import {
   _internals,
   resolveWorktreeIsolationConfig
-} from "./index-w9pb72vg.js";
+} from "./index-qmwed766.js";
 import {
   ApprovalEvidenceSchema,
   BaseEvidenceSchema,
@@ -42,7 +42,7 @@ import {
   loadPluginConfig,
   loadPluginConfigWithMeta,
   loadPluginConfigWithMetaAsync
-} from "./index-t54jt9cs.js";
+} from "./index-a2phfdsv.js";
 import {
   AUTO_REVIEW_V8_BURN_IN_DECISION,
   AgentOverrideConfigSchema,
@@ -64,7 +64,7 @@ import {
   TurboConfigSchema,
   WorktreeIsolationConfigSchema,
   resolveAutoReviewConfig
-} from "./index-mef0trex.js";
+} from "./index-4y7n76bn.js";
 import {
   ALL_AGENT_NAMES,
   ALL_SUBAGENT_NAMES,

package/dist/cli/{index-prxrmc3b.js → index-9wpr1p2g.js}

@@ -9,11 +9,11 @@ import {
 } from "./index-y8552snf.js";
 import {
   atomicWriteFile
-} from "./index-apwcvfjt.js";
+} from "./index-frp2hwdg.js";
 import {
   assertProjectRoot,
   withEvidenceLock
-} from "./index-m8dn0qnm.js";
+} from "./index-txbd25bc.js";
 import {
   exports_external,
   init_zod

package/dist/cli/{index-t54jt9cs.js → index-a2phfdsv.js}

@@ -6,7 +6,7 @@ import {
   PluginConfigSchema,
   init_schema,
   resolveExternalSkillsConfig
-} from "./index-mef0trex.js";
+} from "./index-4y7n76bn.js";
 import {
   GIT_BINARY_ENV_VAR,
   init_git_executable

package/dist/cli/{index-an922xj4.js → index-akef15kb.js}

@@ -3,7 +3,7 @@ import {
   EvaluationRunV1Schema,
   GateAuditResultV1Schema,
   getProtectedEvaluationRunIds
-} from "./index-prxrmc3b.js";
+} from "./index-9wpr1p2g.js";
 import {
   loadDatabaseCtor
 } from "./index-134d35c1.js";
@@ -23,7 +23,7 @@ import {
   readTaskEvidence,
   readTaskEvidenceRaw,
   sanitizeTaskId
-} from "./index-1wmd5wn1.js";
+} from "./index-5sh0kqf5.js";
 import {
   LedgerStaleWriterError,
   appendLedgerEvent,
@@ -43,10 +43,10 @@ import {
   replayFromLedgerWithStatus,
   takeSnapshotEvent,
   takeSnapshotWithRetry
-} from "./index-zyv56em5.js";
+} from "./index-gqss5zbr.js";
 import {
   appendCoreEventSync
-} from "./index-exn0ztsv.js";
+} from "./index-6zkm4p7p.js";
 import {
   init_executor,
   isUntrustedEnvKey,
@@ -68,7 +68,7 @@ import {
 } from "./index-r3mvsbtq.js";
 import {
   PlanSchema
-} from "./index-t54jt9cs.js";
+} from "./index-a2phfdsv.js";
 import {
   GIT_BINARY_ENV_VAR,
   describeGitResolution,
@@ -79,10 +79,10 @@ import {
   assertProjectRoot,
   tryAcquireLock,
   withEvidenceLock
-} from "./index-m8dn0qnm.js";
+} from "./index-txbd25bc.js";
 import {
   emit
-} from "./index-xggpmtfx.js";
+} from "./index-aw492hpn.js";
 import {
   ZodError,
   init_zod