opencode-swarm 7.163.1 → 7.164.1

package/dist/db/phase-report-store.d.ts

@@ -0,0 +1,45 @@
+/**
+ * swarm.db store for per-phase reports (issue #2480 D1 migration).
+ *
+ * Replaces two legacy file families with the entity/KV pattern — one row per
+ * (kind, phase), last-write-wins on a same-phase re-run:
+ * - `.swarm/drift-report-phase-{N}.json` (curator drift, kind
+ *   `curator_drift`) — written by `src/hooks/curator-drift.ts`, read back by
+ *   `readPriorDriftReports` and the curator postmortem.
+ * - `.swarm/doc-drift-phase-{N}.json` (design-doc drift, kind
+ *   `design_doc_drift`) — written by `src/hooks/design-doc-drift.ts` (whose
+ *   legacy bare `writeFile` was non-atomic; the store fixes that).
+ *
+ * Payloads are opaque serialized JSON strings; readers own validation
+ * (skip-corrupt on read, mirroring the legacy readers).
+ */
+export type PhaseReportKind = 'curator_drift' | 'design_doc_drift';
+/** Legacy filename prefixes, one per report kind. */
+export declare const PHASE_REPORT_LEGACY_PREFIXES: Readonly<Record<PhaseReportKind, string>>;
+/**
+ * One-time (per process, per canonical root) lazy import of both legacy
+ * report families. Never runs at plugin init.
+ */
+export declare function ensurePhaseReportsImported(directory: string): void;
+/**
+ * Upsert one phase report via the group-commit writer and await the flush.
+ * A same-phase re-run overwrites the row (the legacy file rewrite semantic)
+ * and `updated_at` moves.
+ */
+export declare function upsertPhaseReportDb(directory: string, kind: PhaseReportKind, phase: number, payload: string): Promise<void>;
+/**
+ * Read all reports of one kind, ascending by phase. Returns the raw payload
+ * strings; the caller validates (the curator drift reader keeps its
+ * skip-corrupt schema check).
+ */
+export declare function readPhaseReportsDb(directory: string, kind: PhaseReportKind): Array<{
+    phase: number;
+    payload: string;
+}>;
+/**
+ * Stable, human-readable locator for a stored report (event payloads and
+ * advisory text reference the DB-backed store instead of a file path).
+ */
+export declare function phaseReportLocator(kind: PhaseReportKind, phase: number): string;
+/** Test hook: reset the per-process import guards. */
+export declare function _resetPhaseReportImportGuards(): void;

package/dist/db/project-db.d.ts

@@ -1,16 +1,32 @@
 /**
  * Per-project SQLite database for opencode-swarm.
  *
- * Owns `.swarm/swarm.db` in each project directory. Stores per-project
- * constraints and QA gate profiles. One cached instance per normalized
- * directory path.
+ * Owns `.swarm/swarm.db` in each project directory: the single durable
+ * substrate of Workstream D (issue #2480). One cached instance per CANONICAL
+ * project identity (`canonical-project.ts`): case-varied Windows spellings,
+ * trailing separators, and symlinked roots of the same project share one
+ * connection. Open failures are typed (`db-errors.ts`), failed migrations are
+ * recorded for diagnosis and retried on the next open, and close runs a
+ * best-effort WAL checkpoint. The durability-class policy for every table
+ * lives in `durability.ts`.
  */
 import type { Database } from 'bun:sqlite';
+/** Number of currently cached project DB handles (tests / observability). */
+export declare function getOpenProjectDbCount(): number;
+/**
+ * Detect "another process applied this migration concurrently" failures:
+ * a UNIQUE constraint violation on schema_migrations.version, or an
+ * "already exists" DDL error (table/index/trigger created by the winner).
+ */
+export declare function isConcurrentMigrationApply(err: unknown): boolean;
 /**
  * Run all pending migrations on the provided database.
- * Idempotent: existing migrations are not re-applied.
+ * Idempotent: existing migrations are not re-applied. Each migration applies
+ * in its own transaction; a failure rolls back, is recorded for diagnosis
+ * (table row, or the marker fallback), and leaves the version un-bumped so
+ * the next open retries it.
  */
-export declare function runProjectMigrations(db: Database): void;
+export declare function runProjectMigrations(db: Database, markerDir?: string): void;
 /**
  * Return the absolute path to `.swarm/swarm.db` for the given directory.
  * Does not create the file or any parent directory.
@@ -26,13 +42,24 @@ export declare function projectDbExists(directory: string): boolean;
 /**
  * Return the cached project database for the given directory, opening it
  * if needed. Creates `.swarm/` if absent and enables WAL + foreign keys.
+ * The cache is keyed by canonical project identity, so case-varied Windows
+ * spellings, trailing separators, and symlinked roots share ONE handle.
+ * Open failures throw a typed `ProjectDbError` and never leave a
+ * half-open handle cached.
  */
 export declare function getProjectDb(directory: string): Database;
 /**
  * Close and remove the cached project database for the given directory.
- * Called by the `/swarm close` clean stage before unlinking `swarm.db` (so a
- * long-lived WAL-mode connection releases its file lock and Windows `unlink`
- * does not fail with EBUSY), and from tests.
+ * Runs a best-effort WAL checkpoint (TRUNCATE, PASSIVE fallback) first so the
+ * close leaves a self-contained DB file where possible. Called by the
+ * `/swarm close` clean stage before unlinking `swarm.db` (so a long-lived
+ * WAL-mode connection releases its file lock and Windows `unlink` does not
+ * fail with EBUSY), by the plugin dispose/exit close paths, and from tests.
+ *
+ * Callers that passed a different spelling of the same root (case variant on
+ * Windows, symlink) share the canonical handle: closing it invalidates every
+ * alias — which is the point (those aliases were previously silent duplicate
+ * writers on one file). Reopening via `getProjectDb` always works.
  */
 export declare function closeProjectDb(directory: string): void;
 /**

package/dist/db/qa-gate-profile.d.ts

@@ -31,6 +31,8 @@ export declare const _internals: {
         profileId: number;
         storagePlanId: string;
     }) => void) | undefined;
+    /** #2480 test probe: synchronous level observed during the last write txn. */
+    lastTxnSynchronous: number;
 };
 /**
  * QA gate flags. All eleven gates are tracked explicitly.

package/dist/hooks/curator-drift.d.ts

@@ -1,14 +1,18 @@
 import type { CriticDriftResult, CuratorConfig, CuratorPhaseResult, DriftReport } from './curator-types.js';
 /**
- * Read all prior drift reports from .swarm/drift-report-phase-*.json files.
+ * Read all prior drift reports (#2480: from the `phase_report` entity table
+ * in `.swarm/swarm.db`, kind `curator_drift`; the legacy
+ * `.swarm/drift-report-phase-*.json` files are imported once — idempotent,
+ * one-txn — and cold-archived `.json.imported`).
  * Returns reports sorted ascending by phase number.
- * Skips corrupt/unreadable files with a console.warn.
+ * Skips corrupt/unreadable payloads with a console.warn.
  */
 export declare function readPriorDriftReports(directory: string): Promise<DriftReport[]>;
 /**
- * Write a drift report to .swarm/drift-report-phase-{N}.json.
- * Creates .swarm/ if it doesn't exist.
- * Returns the absolute path of the written file.
+ * Write a drift report to the `phase_report` entity table (#2480: upsert via
+ * the group-commit writer — one txn per flush, atomic, replacing the legacy
+ * non-batched file rewrite). A same-phase re-run overwrites the row.
+ * Returns the DB-backed report locator.
  */
 export declare function writeDriftReport(directory: string, report: DriftReport): Promise<string>;
 export declare const _internals: {

package/dist/hooks/curator-types.d.ts

@@ -155,6 +155,7 @@ export interface SkillCandidate {
 export interface CriticDriftResult {
     phase: number;
     report: DriftReport;
+    /** #2480: DB-backed locator, e.g. `swarm.db:phase_report(curator_drift,3)`. */
     report_path: string;
     injection_text: string;
 }

package/dist/hooks/delegation-gate.d.ts

@@ -494,6 +494,7 @@ export declare const _internals: {
     PLAN_CRITIC_TASK_SIGNALS: readonly ["critic-gate", "plan critic", "review plan", "review the plan", "plan.md", "approve the plan", "plan approval", "pre-implementation review", "evaluate this plan", "evaluate the plan", "assess this plan", "assess the plan", "plan soundness", "before implementation", "review the plan below"];
     extractPlanCriticVerdict: typeof extractPlanCriticVerdict;
     forceRecordPlanCriticApproval: typeof forceRecordPlanCriticApproval;
+    beforePrFeedbackScopeConsume: (() => Promise<void>) | undefined;
     provisionWorktree: typeof _wtiInternals.provisionWorktree;
     removeWorktree: typeof _wtiInternals.removeWorktree;
     attemptMergeBackFromDirty: typeof _wtiInternals.attemptMergeBackFromDirty;

package/dist/hooks/knowledge-curator.d.ts

@@ -69,9 +69,11 @@ export declare function enrichLessonToV3(params: {
 /** Max insight candidates folded into the store per phase boundary. */
 export declare const MESO_INSIGHT_BATCH_LIMIT = 20;
 /**
- * Atomically consume up to `batchLimit` insight candidates from
- * `.swarm/insight-candidates.jsonl`, writing back the unconsumed tail under the
- * same lock so concurrent micro-reflection appends are never lost. Fail-open.
+ * Atomically consume up to `batchLimit` insight candidates from the durable
+ * `insight_candidate` stream in `.swarm/swarm.db` (issue #2480). The SELECT
+ * and the consumed_at UPDATE happen in ONE immediate transaction, so
+ * concurrent appends are never lost and a batch is never double-taken.
+ * Fail-open: returns [] on any DB error.
  */
 export declare function consumeInsightCandidates(directory: string, batchLimit?: number): Promise<InsightCandidate[]>;
 /** Build a SwarmKnowledgeEntry from an already-v3-actionable insight candidate. */

package/dist/hooks/micro-reflector.d.ts

@@ -123,14 +123,19 @@ export declare function classifyOutcome(transcript: string, trajectory: Trajecto
 /** Read a task's trajectory slice. Fail-open: [] when absent/corrupt. */
 export declare function readTaskTrajectory(directory: string, taskId: string): Promise<TrajectoryEntry[]>;
 export declare const INSIGHT_CANDIDATES_MAX_ENTRIES = 500;
-/** Append validated candidates to the insight queue (best-effort, fail-open).
- *  Uses transactFile for consistency with consumeInsightCandidates and enforces
- *  a FIFO cap to prevent unbounded growth between phase completions.
+/**
+ * Append validated candidates to the insight queue (best-effort, fail-open).
+ *
+ * #2480: the durable queue is the `insight_candidate` stream table in
+ * `.swarm/swarm.db` (group-commit writer, one txn per flush; FIFO cap 500 on
+ * the pending queue — same bound as before). The legacy
+ * `.swarm/insight-candidates.jsonl` is imported once (idempotent, one-txn)
+ * and cold-archived `.jsonl.imported`.
  *
- *  EXPORTED (#1821) so the PRM pattern producer can write the SAME durable
- *  crash backstop the micro-reflector writes. Any producer that only enqueues
- *  in memory loses its candidate on process death, on queue overflow, and on a
- *  drain failure — with no phase-boundary fold-in to recover it. */
+ * EXPORTED (#1821) so the PRM pattern producer can write the SAME durable
+ * crash backstop the micro-reflector writes. Any producer that only enqueues
+ * in memory loses its candidate on process death, on queue overflow, and on a
+ * drain failure — with no phase-boundary fold-in to recover it. */
 export declare function appendInsightCandidates(directory: string, candidates: InsightCandidate[]): Promise<void>;
 /** Build the bounded micro-reflection prompt (≤ MICRO_PROMPT_INPUT_CAP chars). */
 export declare function buildMicroPrompt(params: {

package/dist/hooks/pr-workflow-gate.d.ts

@@ -8,6 +8,7 @@ import { type PrReviewInlineTriggerRow } from '../background/pr-review-trigger-c
 import { type RevisionDigestResult, resolveCommitCountSince, resolveCommitCountSinceAsync, resolveCurrentGitHead, resolveCurrentGitHeadAsync, resolveCurrentLocalHeadRefAsync, resolveCurrentUpstreamPushTarget, resolveCurrentUpstreamPushTargetAsync, resolveCurrentUpstreamRemoteRef, resolveExactRemoteBranchHead, resolveExactRemoteBranchHeadAsync, resolveIsExactSingleChildCommit, resolveIsExactSingleChildCommitAsync, resolveIsWorkingTreeClean, resolveIsWorkingTreeCleanAsync, resolvePrReviewDiffStats, resolvePrReviewDiffStatsAsync, resolvePrWorkflowRevisionDigest, resolvePrWorkflowRevisionDigestDetailed, resolveRemoteRefsContainingHead, resolveRemoteRefsContainingHeadAsync, resolveRemoteUrlIdentity, resolveRemoteUrlIdentityAsync } from '../background/workspace-snapshot.js';
 import { type PrReviewResilienceConfig } from '../config/schema.js';
 import { classifyPrWorkflowGitState, type PrWorkflowGitState } from '../git/pr-workflow-state.js';
+import { type PrReviewReentryAuthorizationRecord, type PrReviewReentryBindingContext, type PrReviewReentryRole } from '../pr-review/authorization.js';
 import { classifyPrReviewCircuitSignal, type PrReviewCircuitLegacyRecord, type PrReviewCircuitRecordV2, type PrReviewResiliencePolicyRecord, resolvePrReviewResiliencePolicy } from '../pr-review/circuit.js';
 import { type PrReviewDimensionCancellationRecord, type PrReviewPartialBaseCoverageRecord, type PrReviewReportVerdict, type PrReviewTerminalCoverageSettlement } from '../pr-review/completion.js';
 import { type PrReviewComposablePhase, type PrReviewPhaseComposition, parseCriticVerdict } from '../pr-review/legacy-transcript-adapter.js';
@@ -1252,7 +1253,7 @@ export declare function transitionPrReviewToFeedback(directory: string, sessionI
 }): Promise<PrWorkflowGateState>;
 export declare function declarePrFeedbackScope(directory: string, sessionID: string, taskId: string, files: string[]): Promise<PrWorkflowGateState>;
 export declare function resolvePrFeedbackScopeDeclaration(directory: string, sessionID: string, taskId: string): Promise<PrFeedbackScopeDeclarationRecord | null>;
-export declare function consumePrFeedbackScopeDeclaration(directory: string, sessionID: string, taskId: string, callID: string): Promise<PrFeedbackScopeDeclarationRecord | null>;
+export declare function consumePrFeedbackScopeDeclaration(directory: string, sessionID: string, taskId: string, callID: string, expected: Pick<PrFeedbackScopeDeclarationRecord, 'declaredAt' | 'revisionDigest' | 'files'>): Promise<PrFeedbackScopeDeclarationRecord | null>;
 export declare function validatePrFeedbackScopeBinding(directory: string, binding: {
     taskId: string;
     files: string[];
@@ -1270,13 +1271,16 @@ export declare function enforcePrWorkflowToolBefore(directory: string, sessionID
  * revision), workflow instance id, and the active run id. Null when no active
  * head-bound PR_REVIEW gate exists for the session.
  */
-export declare function readPrReviewReentryBindingContext(directory: string, sessionID: string): Promise<{
-    prHeadSha: string;
-    revisionDigest: string;
-    generation: number;
-    workflowInstanceId?: string;
-    runId?: string;
-} | null>;
+export declare function readPrReviewReentryBindingContext(directory: string, sessionID: string): Promise<PrReviewReentryBindingContext | null>;
+/**
+ * Sole production reservation/verification path for direct PR-review re-entry.
+ * Lock order is fixed: workflow-session first, authorization store second. The
+ * active binding cannot change between its locked reread and reservation commit.
+ */
+export declare function reserveActivePrReviewReentryAuthorization(directory: string, sessionID: string, request: {
+    role: PrReviewReentryRole;
+    callID: string;
+}): Promise<PrReviewReentryAuthorizationRecord | null>;
 export declare function completePrWorkflow(directory: string, sessionID: string, expectedMode: PrWorkflowMode, prHeadSha: string, options?: {
     reportVerdict?: PrReviewReportVerdict;
 }): Promise<PrWorkflowCompletionStatus>;
@@ -1305,6 +1309,8 @@ export declare const _test_exports: {
     beforePrFeedbackTrackingSwitch: (() => Promise<void>) | undefined;
     afterPrFeedbackTrackingSwitch: (() => Promise<void>) | undefined;
     beforePrFeedbackTrackingPersist: (() => Promise<void>) | undefined;
+    /** Interleave point held inside the workflow-session lock before auth commit. */
+    beforePrReviewReentryReservation: (() => Promise<void>) | undefined;
     beforeBoundedSwarmFileOpen: (() => Promise<void>) | undefined;
     beforeSessionStateLockWrite: (() => Promise<void>) | undefined;
     beforeCheckoutLockWrite: (() => Promise<void>) | undefined;

package/dist/hooks/pr-workflow-response-gate.d.ts

@@ -1,3 +1,4 @@
+import { scanDelegationsForRecovery } from '../background/pending-delegations.js';
 import { claimPrFeedbackMonitorEvents, readPrFeedbackMonitorQueue } from '../background/pr-feedback-event-queue.js';
 import { observePrWorkflowAutoWakeEvent } from './pr-workflow-auto-wake.js';
 import { type PrReviewDepthTier, readPrWorkflowGateState } from './pr-workflow-gate.js';
@@ -10,22 +11,16 @@ export declare const _internals: {
     claimPrFeedbackMonitorEvents: typeof claimPrFeedbackMonitorEvents;
     readPrFeedbackMonitorQueue: typeof readPrFeedbackMonitorQueue;
     observePrWorkflowAutoWakeEvent: typeof observePrWorkflowAutoWakeEvent;
+    scanDelegationsForRecovery: typeof scanDelegationsForRecovery;
 };
 /**
  * Maximum number of consecutive unproductive auto-resumes per gated session
  * before the response gate suspends further wakes. "Unproductive" means the
- * durable gate's `revision` did not advance between wakes — i.e. no
- * state-mutating controller tool (dispatch_lanes_async,
- * write_pr_review_trigger_eval, complete_pr_workflow, recordPrReview*,
- * bindPrReviewBase, …) made durable progress. A healthy review bumps
- * `revision` on every successful state-mutating controller call, so the
- * consecutive counter resets on progress and never exhausts the budget.
- * Read-only tools (collect_lane_results polling, grep, read) intentionally do
- * NOT bump `revision` — an architect that only polls without ever dispatching
- * new lanes or recording trigger evaluations IS making progress on the
- * runtime's bookkeeping but is not advancing the durable gate, so the budget
- * treats long polling-only stretches conservatively. Only a genuinely stuck
- * session holds `revision` constant across many idle cycles.
+ * fixed-size digest of the durable gate plus its exact active delegation lanes
+ * did not change. Controller revisions, lane status transitions, terminal
+ * events, and structured receipt digests count as progress; repeated
+ * collect_lane_results polls do not. Strict-ledger uncertainty is sticky and
+ * never earns progress credit, including the first recovered snapshot.
  */
 export declare const DEFAULT_MAX_CONSECUTIVE_UNPRODUCTIVE_WAKES = 5;
 /**
@@ -102,6 +97,8 @@ interface WakeBudget {
     consecutiveUnproductive: number;
     lastWakeAt: number;
     lastSeenRevision?: number;
+    lastSeenProgressToken?: string;
+    progressUncertain: boolean;
     suspended: boolean;
     /** Total number of wake attempts recorded for this budget. NEVER reset by
      * revision progress — only the consecutive counter resets on progress; that