opencode-swarm 7.164.3 → 7.164.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/{coder-settlement-m918n7qj.js → coder-settlement-x9wbqx46.js} +11 -11
- package/dist/cli/{config-doctor-5kytbwbx.js → config-doctor-axd9d6hs.js} +2 -2
- package/dist/cli/{core-anw5khk2.js → core-f1a1fk13.js} +1 -1
- package/dist/cli/{curation-policy-7pnmnfct.js → curation-policy-2cy7wejw.js} +6 -6
- package/dist/cli/{curator-yq6raqgs.js → curator-b104f7a7.js} +34 -34
- package/dist/cli/{curator-drift-ykrdf08r.js → curator-drift-3s3q4wsy.js} +4 -4
- package/dist/cli/curator-llm-factory-cv7ft0mb.js +66 -0
- package/dist/cli/{evidence-summary-service-8sbxvt2x.js → evidence-summary-service-5xsjs3x3.js} +15 -15
- package/dist/cli/{gate-evidence-53v7e938.js → gate-evidence-ypja4156.js} +7 -7
- package/dist/cli/guardrail-explain-cvha7b9p.js +67 -0
- package/dist/cli/{guardrail-log-q5sj7zby.js → guardrail-log-6t4e2j5f.js} +7 -7
- package/dist/cli/{guardrail-reset-dw45p5zc.js → guardrail-reset-es0bg976.js} +34 -34
- package/dist/cli/{hive-promoter-0axzw0h5.js → hive-promoter-yzv5g7jy.js} +34 -34
- package/dist/cli/{index-95hhrw1d.js → index-0trtcm9n.js} +9 -9
- package/dist/cli/{index-hcn69kp0.js → index-0zbze3n6.js} +1 -1
- package/dist/cli/{index-ac39znep.js → index-164m995b.js} +2 -2
- package/dist/cli/{index-bzd67m2j.js → index-1dz8hv7p.js} +4 -4
- package/dist/cli/{index-y2f5s2cf.js → index-1f4nandk.js} +1 -1
- package/dist/cli/{index-aty2dfmt.js → index-1q2dwv69.js} +1 -1
- package/dist/cli/{index-2xj34nkh.js → index-25jze7sf.js} +1 -1
- package/dist/cli/{index-5d7bzpfn.js → index-25z5qwkk.js} +1 -1
- package/dist/cli/{index-ehf0vjhx.js → index-3gb7bw7h.js} +88 -77
- package/dist/cli/{index-11st3tgy.js → index-3rrc5x4v.js} +2 -2
- package/dist/cli/{index-zs1jrsta.js → index-4emx8hhh.js} +2 -2
- package/dist/cli/{index-j98116cx.js → index-4jmtdtm9.js} +2 -2
- package/dist/cli/{index-w5jpjaqe.js → index-4krjn1gn.js} +2 -2
- package/dist/cli/{index-0145kpjr.js → index-50s9q4c1.js} +2 -2
- package/dist/cli/{index-4wneygfx.js → index-553veay1.js} +75 -23
- package/dist/cli/{index-88g6q52x.js → index-7rat6nyh.js} +4 -4
- package/dist/cli/{index-sn2vm710.js → index-8h9nng7f.js} +5 -5
- package/dist/cli/{index-xkqja15t.js → index-aaqbhn9h.js} +2 -2
- package/dist/cli/{index-5pxdtskj.js → index-aper29nf.js} +1 -1
- package/dist/cli/{index-8t11vcf5.js → index-ea7sehgy.js} +3 -3
- package/dist/cli/{index-kyayzfxp.js → index-er8ba9be.js} +4 -4
- package/dist/cli/{index-9pwa798m.js → index-fwebva1m.js} +7 -7
- package/dist/cli/{index-yep24wn4.js → index-fxxja498.js} +1 -1
- package/dist/cli/{index-sb4eanpv.js → index-hnjkpk57.js} +1 -1
- package/dist/cli/{index-kn0y788q.js → index-j9a4fsxg.js} +1 -1
- package/dist/cli/{index-493mxwj5.js → index-maxz22c1.js} +21 -21
- package/dist/cli/{index-0e34njnm.js → index-q0gtgwyr.js} +7 -7
- package/dist/cli/{index-fc153g7b.js → index-rc6hec4j.js} +4 -4
- package/dist/cli/{index-v56mhyhs.js → index-rz87mx1c.js} +1 -1
- package/dist/cli/{index-rhdwrfgc.js → index-s09b63xg.js} +5 -5
- package/dist/cli/{index-aaqzcnb9.js → index-ssb67ff6.js} +36 -36
- package/dist/cli/{index-f9nfknjg.js → index-tfa2p4y4.js} +3 -3
- package/dist/cli/{index-jwc2v92w.js → index-wbnyc50b.js} +5 -5
- package/dist/cli/{index-qbr05tbw.js → index-xj4kbtdw.js} +2 -2
- package/dist/cli/{index-yhpbcrdk.js → index-xm7dc14y.js} +13 -13
- package/dist/cli/{index-c8k4cs94.js → index-y42pra05.js} +5 -5
- package/dist/cli/{index-84qah5h6.js → index-yrsag0vs.js} +31 -52
- package/dist/cli/{index-3fpqmms2.js → index-ywtcznk2.js} +12 -4
- package/dist/cli/index.js +34 -34
- package/dist/cli/{knowledge-escalator-atn5tfy2.js → knowledge-escalator-evjd8g7y.js} +13 -13
- package/dist/cli/{knowledge-events-58ha93tx.js → knowledge-events-q46z1wy6.js} +11 -11
- package/dist/cli/{knowledge-link-2gh1cnk3.js → knowledge-link-ffmzf72f.js} +5 -5
- package/dist/cli/{knowledge-store-2vkn4qyy.js → knowledge-store-z82f5x9k.js} +6 -6
- package/dist/cli/{knowledge-validator-gcbfq9er.js → knowledge-validator-19gbnxx2.js} +8 -8
- package/dist/cli/{pending-delegations-esp3gpac.js → pending-delegations-t4cqk5ha.js} +6 -6
- package/dist/cli/{pr-subscriptions-sdv0n59c.js → pr-subscriptions-3enjtq0k.js} +6 -6
- package/dist/cli/{pr-workflow-gate-v5wh09wz.js → pr-workflow-gate-3ecgfsge.js} +34 -34
- package/dist/cli/{runner-m95v9d47.js → runner-wqy2hbxn.js} +6 -6
- package/dist/cli/{scan-cursor-6x0sqjer.js → scan-cursor-8wcy0dvf.js} +7 -7
- package/dist/cli/{schema-mgpsycrr.js → schema-hsw9r2tm.js} +5 -1
- package/dist/cli/{scope-persistence-pwqshfyr.js → scope-persistence-mbwt4grd.js} +9 -9
- package/dist/cli/{skill-generator-bywdfza0.js → skill-generator-kg32a5jy.js} +15 -15
- package/dist/cli/{telemetry-c4j18da8.js → telemetry-j14cj552.js} +1 -1
- package/dist/cli/{worktree-collision-ownership-71x5pqfz.js → worktree-collision-ownership-0rfw6kp3.js} +7 -7
- package/dist/cli/{worktree-isolation-e6tym281.js → worktree-isolation-qcwt09ve.js} +34 -34
- package/dist/config/index.d.ts +3 -3
- package/dist/config/loader.d.ts +34 -1
- package/dist/config/plan-schema.d.ts +1 -1
- package/dist/config/schema.d.ts +61 -7
- package/dist/council/council-review-identity.d.ts +1 -1
- package/dist/index.js +69 -69
- package/dist/plan/ledger.d.ts +56 -29
- package/dist/services/skill-optimizer/store.d.ts +1 -1
- package/dist/tools/build-check.d.ts +8 -0
- package/dist/tools/placeholder-scan.d.ts +10 -1
- package/dist/tools/pre-check-batch.d.ts +20 -8
- package/dist/tools/quality-budget.d.ts +2 -0
- package/dist/tools/sast-scan.d.ts +10 -2
- package/dist/tools/sbom-generate.d.ts +14 -0
- package/dist/tools/syntax-check.d.ts +11 -3
- package/package.json +1 -1
- package/dist/cli/curator-llm-factory-6swjnnb1.js +0 -66
- package/dist/cli/guardrail-explain-jhsqdzxr.js +0 -67
package/dist/plan/ledger.d.ts
CHANGED
|
@@ -111,44 +111,68 @@ declare function getPlanJsonPath(directory: string): string;
|
|
|
111
111
|
declare function writeFileFsyncedThenRename(tempPath: string, targetPath: string, data: string | Uint8Array): void;
|
|
112
112
|
declare function fsyncRecoveryDirectory(directory: string): void;
|
|
113
113
|
/**
|
|
114
|
-
* Compute a SHA-256
|
|
114
|
+
* Compute a SHA-256 digest of the FULL plan state for the ledger hash chain.
|
|
115
115
|
* Uses deterministic JSON serialization for consistent hashing.
|
|
116
116
|
*
|
|
117
|
+
* This is the LEDGER digest, not an approval-baseline hash. It deliberately
|
|
118
|
+
* INCLUDES `phase.status` and `task.status` because `plan_hash_after` pins the
|
|
119
|
+
* exact persisted ledger state, execution progress included. Its output is
|
|
120
|
+
* persisted on-disk (`plan_hash_after`, plan-epoch identity, snapshot
|
|
121
|
+
* integrity, staleness detection), so its byte output must NEVER change.
|
|
122
|
+
* For drift-baseline comparisons use {@link computePlanStructureHash}.
|
|
123
|
+
*
|
|
117
124
|
* IMPORTANT: Intentionally excludes `specMtime` and `specHash` fields.
|
|
118
125
|
* These fields track changes to spec.md but do not affect plan execution or structure.
|
|
119
126
|
* Including them would cause the plan hash to change whenever spec metadata changes,
|
|
120
127
|
* invalidating cached plan state unnecessarily. Spec changes are tracked separately
|
|
121
128
|
* in the ledger via `spec_updated` and acknowledgment events.
|
|
122
129
|
*
|
|
130
|
+
* Renamed in issue #2523 (retiring the old generic name) so that exactly one
|
|
131
|
+
* name (`computePlanStructureHash`) identifies the plan-structure hash. The
|
|
132
|
+
* rename is byte-identical — the normalization below is unchanged.
|
|
133
|
+
*
|
|
123
134
|
* @param plan - The plan to hash
|
|
124
135
|
* @returns Hex-encoded SHA-256 hash
|
|
125
136
|
*/
|
|
126
|
-
export declare function
|
|
127
|
-
/**
|
|
128
|
-
* Compute a SHA-256 hash of the plan's STRUCTURE
|
|
129
|
-
*
|
|
130
|
-
*
|
|
131
|
-
*
|
|
132
|
-
*
|
|
133
|
-
* plan
|
|
134
|
-
*
|
|
135
|
-
*
|
|
136
|
-
*
|
|
137
|
-
*
|
|
138
|
-
*
|
|
139
|
-
*
|
|
140
|
-
*
|
|
141
|
-
*
|
|
142
|
-
*
|
|
143
|
-
*
|
|
144
|
-
*
|
|
137
|
+
export declare function computePlanLedgerHash(plan: Plan): string;
|
|
138
|
+
/**
|
|
139
|
+
* Compute a SHA-256 hash of the plan's STRUCTURE — THE single approval-baseline
|
|
140
|
+
* hash (issue #2523). Excludes the transient execution-progress fields
|
|
141
|
+
* (`phase.status` and `task.status`).
|
|
142
|
+
*
|
|
143
|
+
* DECISION (documented per issue #2523): task/phase status does NOT belong in
|
|
144
|
+
* the baseline hash. The baseline exists to detect *plan edits* — content,
|
|
145
|
+
* scope, dependencies, files — not execution progress. Every writer and reader
|
|
146
|
+
* of an approval-baseline `payload_hash` uses this function:
|
|
147
|
+
* - `takeSnapshotEvent` stores it as the `payload_hash` of every
|
|
148
|
+
* `source === 'critic_approved'` snapshot (the gate recorders in
|
|
149
|
+
* `src/hooks/delegation-gate.ts` and the drift-verifier approval in
|
|
150
|
+
* `src/tools/write-drift-evidence.ts`).
|
|
151
|
+
* - `get_approved_plan` compares it against that stored hash to compute
|
|
152
|
+
* `drift_detected`.
|
|
153
|
+
* - The scope/participation bindings persist it as `planStructureHash` and
|
|
154
|
+
* re-derive it with the same function at verification time.
|
|
155
|
+
* A status-only change (e.g. `update_task_status` flipping a task to
|
|
156
|
+
* `in_progress`/`completed`) must therefore NEVER trip a baseline comparison;
|
|
157
|
+
* any structural change (description, acceptance, dependencies, files, added
|
|
158
|
+
* or removed tasks/phases) always must.
|
|
159
|
+
*
|
|
160
|
+
* This mirrors {@link computePlanLedgerHash}'s normalization byte-for-byte
|
|
161
|
+
* EXCEPT it omits the two status fields from the hashed payload. The two
|
|
162
|
+
* functions are deliberately distinct: {@link computePlanLedgerHash} is
|
|
163
|
+
* load-bearing for ledger replay and staleness/integrity detection (its
|
|
164
|
+
* output is persisted on-disk as `plan_hash_after`), so its byte output must
|
|
165
|
+
* never change. Do NOT collapse these two into a shared normalizer.
|
|
145
166
|
*
|
|
146
167
|
* @param plan - The plan to hash
|
|
147
168
|
* @returns Hex-encoded SHA-256 hash of the status-excluded structure
|
|
148
169
|
*/
|
|
149
170
|
export declare function computePlanStructureHash(plan: Plan): string;
|
|
150
171
|
/**
|
|
151
|
-
* Read the current plan.json and compute its
|
|
172
|
+
* Read the current plan.json and compute its LEDGER digest (the
|
|
173
|
+
* status-inclusive {@link computePlanLedgerHash}, not the approval-baseline
|
|
174
|
+
* structure hash). Used for hash-chain bookkeeping (`plan_hash_before`,
|
|
175
|
+
* concurrency-token refresh), never for drift baselines.
|
|
152
176
|
*
|
|
153
177
|
* @param directory - The working directory
|
|
154
178
|
* @returns Hash of current plan.json, or empty string if not found
|
|
@@ -286,13 +310,16 @@ export declare function takeSnapshotWithRetry(directory: string, plan: Plan, opt
|
|
|
286
310
|
* snapshot payload (e.g. phase number, verdict, summary) so that
|
|
287
311
|
* downstream readers can filter without decoding prompts.
|
|
288
312
|
* - payloadHashOverride: when supplied, stored as the snapshot payload's
|
|
289
|
-
* `payload_hash` INSTEAD of the default
|
|
290
|
-
*
|
|
291
|
-
* (`computePlanStructureHash`)
|
|
292
|
-
*
|
|
293
|
-
*
|
|
294
|
-
*
|
|
295
|
-
*
|
|
313
|
+
* `payload_hash` INSTEAD of the source-derived default. The default for a
|
|
314
|
+
* `source === 'critic_approved'` snapshot is the status-excluded structure
|
|
315
|
+
* hash (`computePlanStructureHash`) — an approval baseline is, by
|
|
316
|
+
* definition (issue #2523), the plan's structure, so this is enforced here
|
|
317
|
+
* at the single write choke point and every approval-snapshot writer gets
|
|
318
|
+
* it without having to remember an override. Every other source defaults
|
|
319
|
+
* to the status-inclusive ledger digest (`computePlanLedgerHash`).
|
|
320
|
+
* Note this only changes the embedded snapshot `payload_hash`; the ledger
|
|
321
|
+
* event's hash-chain field `plan_hash_after` is unaffected (still governed
|
|
322
|
+
* by `planHashAfter` / on-disk plan.json), preserving replay integrity.
|
|
296
323
|
* @returns The LedgerEvent that was written
|
|
297
324
|
*/
|
|
298
325
|
export declare function takeSnapshotEvent(directory: string, plan: Plan, options?: {
|
|
@@ -524,7 +551,7 @@ export declare function loadLastApprovedPlan(directory: string, expectedPlanId?:
|
|
|
524
551
|
*/
|
|
525
552
|
export declare function loadLastPlanCriticApprovedSnapshot(directory: string, expectedPlanId?: string): Promise<ApprovedSnapshotInfo | null>;
|
|
526
553
|
export declare const _internals: {
|
|
527
|
-
|
|
554
|
+
computePlanLedgerHash: typeof computePlanLedgerHash;
|
|
528
555
|
computePlanStructureHash: typeof computePlanStructureHash;
|
|
529
556
|
computeCurrentPlanHash: typeof computeCurrentPlanHash;
|
|
530
557
|
ledgerExists: typeof ledgerExists;
|
|
@@ -101,7 +101,7 @@ export declare function replayCandidate(directory: string, skillSlug: string, ca
|
|
|
101
101
|
* Quarantine a corrupt ledger suffix. Writes the bad suffix to a unique side
|
|
102
102
|
* file under `.swarm/evolution/skills/`. NEVER rewrites or truncates the
|
|
103
103
|
* canonical `lifecycle.jsonl`. Mirrors `quarantineLedgerSuffix` in
|
|
104
|
-
* `src/plan/ledger.ts:
|
|
104
|
+
* `src/plan/ledger.ts:1849`.
|
|
105
105
|
*/
|
|
106
106
|
export declare function quarantineSuffix(directory: string, skillSlug: string, badSuffix: string): string;
|
|
107
107
|
/**
|
|
@@ -5,7 +5,15 @@
|
|
|
5
5
|
*/
|
|
6
6
|
import type { tool } from '@opencode-ai/plugin';
|
|
7
7
|
import { type BuildDiscoverySkip } from '../build/discovery';
|
|
8
|
+
import { loadGateOverrides } from '../config';
|
|
8
9
|
import type { EvidenceVerdict } from '../config/evidence-schema';
|
|
10
|
+
/**
|
|
11
|
+
* DI seam (issue #2524): the tool boundary self-loads the user's gate
|
|
12
|
+
* overrides; tests substitute this instead of touching the config loader.
|
|
13
|
+
*/
|
|
14
|
+
export declare const _internals: {
|
|
15
|
+
loadGateOverrides: typeof loadGateOverrides;
|
|
16
|
+
};
|
|
9
17
|
export declare const DEFAULT_TIMEOUT_MS = 300000;
|
|
10
18
|
export declare const MAX_OUTPUT_BYTES: number;
|
|
11
19
|
export declare const MAX_OUTPUT_LINES = 100;
|
|
@@ -1,4 +1,6 @@
|
|
|
1
1
|
import type { tool } from '@opencode-ai/plugin';
|
|
2
|
+
import type { GateConfigOverrides } from '../config';
|
|
3
|
+
import { loadGateOverrides } from '../config';
|
|
2
4
|
import type { EvidenceVerdict } from '../config/evidence-schema';
|
|
3
5
|
import { saveEvidence } from '../evidence/manager';
|
|
4
6
|
export interface PlaceholderScanInput {
|
|
@@ -35,6 +37,12 @@ export interface PlaceholderScanResult {
|
|
|
35
37
|
files_scanned: number;
|
|
36
38
|
findings_count: number;
|
|
37
39
|
files_with_findings: number;
|
|
40
|
+
/**
|
|
41
|
+
* Present only when the gate was skipped via
|
|
42
|
+
* `gates.placeholder_scan.enabled: false` (issue #2524) — distinguishes
|
|
43
|
+
* a config-disabled run from a genuinely clean scan.
|
|
44
|
+
*/
|
|
45
|
+
disabled_reason?: string;
|
|
38
46
|
};
|
|
39
47
|
}
|
|
40
48
|
/**
|
|
@@ -92,7 +100,7 @@ declare function collectNonStubBodyLines(rootNode: any): Set<number>;
|
|
|
92
100
|
/**
|
|
93
101
|
* Scan files for placeholder content (TODO/FIXME comments, stub implementations, etc.)
|
|
94
102
|
*/
|
|
95
|
-
export declare function placeholderScan(input: PlaceholderScanInput, directory: string): Promise<PlaceholderScanResult>;
|
|
103
|
+
export declare function placeholderScan(input: PlaceholderScanInput, directory: string, gateOverrides?: GateConfigOverrides['placeholder_scan']): Promise<PlaceholderScanResult>;
|
|
96
104
|
export declare const placeholder_scan: ReturnType<typeof tool>;
|
|
97
105
|
/**
|
|
98
106
|
* Internal seam for direct testing of the body-shape walker without
|
|
@@ -105,5 +113,6 @@ export declare const _internals: {
|
|
|
105
113
|
isStubSkeletonFunction: typeof isStubSkeletonFunction;
|
|
106
114
|
isConstantLiteralNode: typeof isConstantLiteralNode;
|
|
107
115
|
saveEvidence: typeof saveEvidence;
|
|
116
|
+
loadGateOverrides: typeof loadGateOverrides;
|
|
108
117
|
};
|
|
109
118
|
export {};
|
|
@@ -4,7 +4,8 @@
|
|
|
4
4
|
* Returns unified result with gates_passed status
|
|
5
5
|
*/
|
|
6
6
|
import type { tool } from '@opencode-ai/plugin';
|
|
7
|
-
import type { PluginConfig } from '../config';
|
|
7
|
+
import type { GateConfigOverrides, PluginConfig } from '../config';
|
|
8
|
+
import { loadGateOverrides } from '../config';
|
|
8
9
|
import { saveEvidence } from '../evidence/manager.js';
|
|
9
10
|
import { runExternalTool } from '../utils/external-tool-runner';
|
|
10
11
|
import type { LintResult, ResolvedLinterCommand } from './lint';
|
|
@@ -30,6 +31,7 @@ export declare const _internals: {
|
|
|
30
31
|
serializePreCheckResult: typeof serializePreCheckResult;
|
|
31
32
|
resolveGatePreamble: typeof resolveGatePreamble;
|
|
32
33
|
runPreCheckBatch: typeof runPreCheckBatch;
|
|
34
|
+
loadGateOverrides: typeof loadGateOverrides;
|
|
33
35
|
MAX_COMBINED_BYTES: number;
|
|
34
36
|
};
|
|
35
37
|
export interface PreCheckBatchInput {
|
|
@@ -39,12 +41,22 @@ export interface PreCheckBatchInput {
|
|
|
39
41
|
directory: string;
|
|
40
42
|
/** SAST severity threshold (default: medium) */
|
|
41
43
|
sast_threshold?: 'low' | 'medium' | 'high' | 'critical';
|
|
42
|
-
/**
|
|
44
|
+
/**
|
|
45
|
+
* Optional legacy plugin-config carrier for the gates slices. The public
|
|
46
|
+
* tool boundary no longer populates it (agents cannot pass config); direct
|
|
47
|
+
* callers/tests may. `gates` below takes precedence.
|
|
48
|
+
* @deprecated prefer the `gates` field (issue #2524).
|
|
49
|
+
*/
|
|
43
50
|
config?: PluginConfig;
|
|
51
|
+
/**
|
|
52
|
+
* User-written gate overrides (issue #2524) — loaded from the project/user
|
|
53
|
+
* config files by the public tool boundary via `loadGateOverrides`.
|
|
54
|
+
*/
|
|
55
|
+
gates?: GateConfigOverrides;
|
|
44
56
|
/**
|
|
45
57
|
* Current phase number (positive integer >= 1).
|
|
46
|
-
* When provided, enables SAST baseline diffing: only findings absent from
|
|
47
|
-
* phase-scoped baseline (.swarm/evidence/{phase}/sast-baseline.json) drive the
|
|
58
|
+
* When provided, enables SAST baseline diffing: only findings absent from
|
|
59
|
+
* the phase-scoped baseline (.swarm/evidence/{phase}/sast-baseline.json) drive the
|
|
48
60
|
* fail verdict. Capture the baseline before first coder delegation via sast_scan
|
|
49
61
|
* with capture_baseline:true.
|
|
50
62
|
*/
|
|
@@ -103,7 +115,7 @@ declare function runWithTimeout<T>(operation: (abortSignal: AbortSignal) => Prom
|
|
|
103
115
|
/**
|
|
104
116
|
* Run lint with detection and timeout
|
|
105
117
|
*/
|
|
106
|
-
declare function runLintWrapped(files: string[] | undefined, directory: string,
|
|
118
|
+
declare function runLintWrapped(files: string[] | undefined, directory: string, _gates?: GateConfigOverrides, abortSignal?: AbortSignal): Promise<ToolResult<LintResult>>;
|
|
107
119
|
/**
|
|
108
120
|
* Run lint on specific files only
|
|
109
121
|
*/
|
|
@@ -111,15 +123,15 @@ declare function runLintOnFiles(resolvedLinter: ResolvedLinterCommand, files: st
|
|
|
111
123
|
/**
|
|
112
124
|
* Run secretscan with timeout
|
|
113
125
|
*/
|
|
114
|
-
declare function runSecretscanWrapped(files: string[] | undefined, directory: string,
|
|
126
|
+
declare function runSecretscanWrapped(files: string[] | undefined, directory: string, _gates?: GateConfigOverrides, abortSignal?: AbortSignal): Promise<ToolResult<SecretscanResult | SecretscanErrorResult>>;
|
|
115
127
|
/**
|
|
116
128
|
* Run SAST scan with timeout
|
|
117
129
|
*/
|
|
118
|
-
declare function runSastScanWrapped(changedFiles: string[], directory: string, severityThreshold: 'low' | 'medium' | 'high' | 'critical',
|
|
130
|
+
declare function runSastScanWrapped(changedFiles: string[], directory: string, severityThreshold: 'low' | 'medium' | 'high' | 'critical', gates?: GateConfigOverrides, phase?: number, abortSignal?: AbortSignal): Promise<ToolResult<SastScanResult>>;
|
|
119
131
|
/**
|
|
120
132
|
* Run quality budget with timeout
|
|
121
133
|
*/
|
|
122
|
-
declare function runQualityBudgetWrapped(changedFiles: string[], directory: string,
|
|
134
|
+
declare function runQualityBudgetWrapped(changedFiles: string[], directory: string, gates?: GateConfigOverrides, abortSignal?: AbortSignal): Promise<ToolResult<QualityBudgetResult>>;
|
|
123
135
|
/**
|
|
124
136
|
* Parse unified diff output (with -U0) to extract added/modified line numbers per file.
|
|
125
137
|
* Returns a Map from normalised file path → Set of changed line numbers.
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import type { tool } from '@opencode-ai/plugin';
|
|
2
|
+
import { loadGateOverrides } from '../config';
|
|
2
3
|
import type { QualityBudgetConfig } from '../config/schema';
|
|
3
4
|
import { computeQualityMetrics, type QualityMetrics, type QualityViolation } from '../quality/metrics';
|
|
4
5
|
export interface QualityBudgetInput {
|
|
@@ -31,4 +32,5 @@ export declare const quality_budget: ReturnType<typeof tool>;
|
|
|
31
32
|
export declare const _internals: {
|
|
32
33
|
qualityBudget: typeof qualityBudget;
|
|
33
34
|
computeQualityMetrics: typeof computeQualityMetrics;
|
|
35
|
+
loadGateOverrides: typeof loadGateOverrides;
|
|
34
36
|
};
|
|
@@ -3,7 +3,8 @@
|
|
|
3
3
|
* Integrates Tier A rules (offline) and optional Semgrep (Tier B)
|
|
4
4
|
*/
|
|
5
5
|
import type { ToolDefinition } from '@opencode-ai/plugin/tool';
|
|
6
|
-
import type {
|
|
6
|
+
import type { GateConfigOverrides } from '../config';
|
|
7
|
+
import { loadGateOverrides } from '../config';
|
|
7
8
|
import type { EvidenceVerdict } from '../config/evidence-schema';
|
|
8
9
|
import { checkSemgrepAvailable, isSemgrepAvailable, runSemgrep } from '../sast/semgrep';
|
|
9
10
|
export interface SastScanInput {
|
|
@@ -56,6 +57,12 @@ export interface SastScanResult {
|
|
|
56
57
|
findings: SastScanFinding[];
|
|
57
58
|
/** Summary information */
|
|
58
59
|
summary: {
|
|
60
|
+
/**
|
|
61
|
+
* Present only when the gate was skipped via
|
|
62
|
+
* `gates.sast_scan.enabled: false` (issue #2524) — distinguishes a
|
|
63
|
+
* config-disabled run from a genuinely clean scan.
|
|
64
|
+
*/
|
|
65
|
+
disabled_reason?: string;
|
|
59
66
|
/** Engine used for scanning */
|
|
60
67
|
engine: 'tier_a' | 'tier_a+tier_b';
|
|
61
68
|
/** Number of files scanned */
|
|
@@ -121,7 +128,7 @@ export interface SastScanFinding {
|
|
|
121
128
|
* - Tier A: Built-in pattern-based rules (always runs)
|
|
122
129
|
* - Tier B: Semgrep (optional, if available on PATH)
|
|
123
130
|
*/
|
|
124
|
-
export declare function sastScan(input: SastScanInput, directory: string,
|
|
131
|
+
export declare function sastScan(input: SastScanInput, directory: string, gates?: GateConfigOverrides): Promise<SastScanResult>;
|
|
125
132
|
/**
|
|
126
133
|
* SAST Scan tool - Static Application Security Testing
|
|
127
134
|
* Scans changed files for security vulnerabilities using:
|
|
@@ -139,4 +146,5 @@ export declare const _internals: {
|
|
|
139
146
|
checkSemgrepAvailable: typeof checkSemgrepAvailable;
|
|
140
147
|
isSemgrepAvailable: typeof isSemgrepAvailable;
|
|
141
148
|
runSemgrep: typeof runSemgrep;
|
|
149
|
+
loadGateOverrides: typeof loadGateOverrides;
|
|
142
150
|
};
|
|
@@ -5,6 +5,14 @@
|
|
|
5
5
|
* for manifest/lock files and generating CycloneDX format output.
|
|
6
6
|
*/
|
|
7
7
|
import type { tool } from '@opencode-ai/plugin';
|
|
8
|
+
import { loadGateOverrides } from '../config';
|
|
9
|
+
/**
|
|
10
|
+
* DI seam (issue #2524): the tool boundary self-loads the user's gate
|
|
11
|
+
* overrides; tests substitute this instead of touching the config loader.
|
|
12
|
+
*/
|
|
13
|
+
export declare const _internals: {
|
|
14
|
+
loadGateOverrides: typeof loadGateOverrides;
|
|
15
|
+
};
|
|
8
16
|
export interface SbomGenerateInput {
|
|
9
17
|
/** Scope of the scan: 'changed' for modified files only, 'all' for entire project */
|
|
10
18
|
scope: 'changed' | 'all';
|
|
@@ -22,5 +30,11 @@ export interface SbomGenerateResult {
|
|
|
22
30
|
components_count: number;
|
|
23
31
|
/** Path to the generated SBOM file */
|
|
24
32
|
output_path: string;
|
|
33
|
+
/**
|
|
34
|
+
* Present only when the gate was skipped because the user disabled it via
|
|
35
|
+
* `gates.sbom_generate.enabled: false` (issue #2524) — distinguishes a
|
|
36
|
+
* config skip from "no manifests found".
|
|
37
|
+
*/
|
|
38
|
+
disabled_reason?: string;
|
|
25
39
|
}
|
|
26
40
|
export declare const sbom_generate: ReturnType<typeof tool>;
|
|
@@ -1,6 +1,14 @@
|
|
|
1
1
|
import type { tool } from '@opencode-ai/plugin';
|
|
2
|
-
import type {
|
|
2
|
+
import type { GateConfigOverrides } from '../config';
|
|
3
|
+
import { loadGateOverrides } from '../config';
|
|
3
4
|
import type { EvidenceVerdict } from '../config/evidence-schema';
|
|
5
|
+
/**
|
|
6
|
+
* DI seam (issue #2524): the tool boundary self-loads the user's gate
|
|
7
|
+
* overrides; tests substitute this instead of touching the config loader.
|
|
8
|
+
*/
|
|
9
|
+
export declare const _internals: {
|
|
10
|
+
loadGateOverrides: typeof loadGateOverrides;
|
|
11
|
+
};
|
|
4
12
|
export interface SyntaxCheckInput {
|
|
5
13
|
/** Files to check (from diff gate) */
|
|
6
14
|
changed_files: Array<{
|
|
@@ -31,7 +39,7 @@ export interface SyntaxCheckResult {
|
|
|
31
39
|
/**
|
|
32
40
|
* Run syntax check on changed files
|
|
33
41
|
*
|
|
34
|
-
* Respects
|
|
42
|
+
* Respects gates.syntax_check.enabled - returns skipped if disabled
|
|
35
43
|
*/
|
|
36
|
-
export declare function syntaxCheck(input: SyntaxCheckInput, directory: string,
|
|
44
|
+
export declare function syntaxCheck(input: SyntaxCheckInput, directory: string, gates?: GateConfigOverrides): Promise<SyntaxCheckResult>;
|
|
37
45
|
export declare const syntax_check: ReturnType<typeof tool>;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "opencode-swarm",
|
|
3
|
-
"version": "7.164.
|
|
3
|
+
"version": "7.164.5",
|
|
4
4
|
"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -1,66 +0,0 @@
|
|
|
1
|
-
// @bun
|
|
2
|
-
import {
|
|
3
|
-
createCuratorLLMDelegate
|
|
4
|
-
} from "./index-ehf0vjhx.js";
|
|
5
|
-
import"./index-2xj34nkh.js";
|
|
6
|
-
import"./index-8t11vcf5.js";
|
|
7
|
-
import"./index-aty2dfmt.js";
|
|
8
|
-
import"./index-493mxwj5.js";
|
|
9
|
-
import"./index-w5jpjaqe.js";
|
|
10
|
-
import"./index-txdagbh7.js";
|
|
11
|
-
import"./index-3146wmgv.js";
|
|
12
|
-
import"./index-88g6q52x.js";
|
|
13
|
-
import"./index-rhdwrfgc.js";
|
|
14
|
-
import"./index-xkqja15t.js";
|
|
15
|
-
import"./index-70ha9e09.js";
|
|
16
|
-
import"./index-y2f5s2cf.js";
|
|
17
|
-
import"./index-hcn69kp0.js";
|
|
18
|
-
import"./index-zaab1wz9.js";
|
|
19
|
-
import"./index-c8k4cs94.js";
|
|
20
|
-
import"./index-zsrtt42s.js";
|
|
21
|
-
import"./index-9pwa798m.js";
|
|
22
|
-
import"./index-3f7hqtgg.js";
|
|
23
|
-
import"./index-qbr05tbw.js";
|
|
24
|
-
import"./index-fc153g7b.js";
|
|
25
|
-
import"./index-sb4eanpv.js";
|
|
26
|
-
import"./index-rtry5xyf.js";
|
|
27
|
-
import"./index-jwc2v92w.js";
|
|
28
|
-
import"./index-kn0y788q.js";
|
|
29
|
-
import"./index-kyayzfxp.js";
|
|
30
|
-
import"./index-ddszzne4.js";
|
|
31
|
-
import"./index-sn2vm710.js";
|
|
32
|
-
import"./index-yhpbcrdk.js";
|
|
33
|
-
import"./index-0145kpjr.js";
|
|
34
|
-
import"./index-556ja8an.js";
|
|
35
|
-
import"./index-4fwbbad3.js";
|
|
36
|
-
import"./index-b43rt5ph.js";
|
|
37
|
-
import"./index-q7sjgr1y.js";
|
|
38
|
-
import"./index-0e34njnm.js";
|
|
39
|
-
import"./index-95hhrw1d.js";
|
|
40
|
-
import"./index-j98116cx.js";
|
|
41
|
-
import"./index-zg9d392c.js";
|
|
42
|
-
import"./index-n832052r.js";
|
|
43
|
-
import"./index-v56mhyhs.js";
|
|
44
|
-
import"./index-z6xqpmqg.js";
|
|
45
|
-
import"./index-r3mvsbtq.js";
|
|
46
|
-
import"./index-4wneygfx.js";
|
|
47
|
-
import"./index-84qah5h6.js";
|
|
48
|
-
import"./index-9e6fdz2h.js";
|
|
49
|
-
import"./index-4rhhvd1a.js";
|
|
50
|
-
import"./index-ac39znep.js";
|
|
51
|
-
import"./index-m1nrd3yd.js";
|
|
52
|
-
import"./index-zjygnfay.js";
|
|
53
|
-
import"./index-ae75rja9.js";
|
|
54
|
-
import"./index-5d7bzpfn.js";
|
|
55
|
-
import"./index-zs1jrsta.js";
|
|
56
|
-
import"./index-bk5tah7q.js";
|
|
57
|
-
import"./index-yep24wn4.js";
|
|
58
|
-
import"./index-f9nfknjg.js";
|
|
59
|
-
import"./index-bzd67m2j.js";
|
|
60
|
-
import"./index-7g4c7s5r.js";
|
|
61
|
-
import"./index-bpmtbmy9.js";
|
|
62
|
-
import"./index-zgwm4ryv.js";
|
|
63
|
-
import"./index-a76rekgs.js";
|
|
64
|
-
export {
|
|
65
|
-
createCuratorLLMDelegate
|
|
66
|
-
};
|
|
@@ -1,67 +0,0 @@
|
|
|
1
|
-
// @bun
|
|
2
|
-
import {
|
|
3
|
-
handleGuardrailExplain
|
|
4
|
-
} from "./index-11st3tgy.js";
|
|
5
|
-
import"./index-ehf0vjhx.js";
|
|
6
|
-
import"./index-2xj34nkh.js";
|
|
7
|
-
import"./index-8t11vcf5.js";
|
|
8
|
-
import"./index-aty2dfmt.js";
|
|
9
|
-
import"./index-493mxwj5.js";
|
|
10
|
-
import"./index-w5jpjaqe.js";
|
|
11
|
-
import"./index-txdagbh7.js";
|
|
12
|
-
import"./index-3146wmgv.js";
|
|
13
|
-
import"./index-88g6q52x.js";
|
|
14
|
-
import"./index-rhdwrfgc.js";
|
|
15
|
-
import"./index-xkqja15t.js";
|
|
16
|
-
import"./index-70ha9e09.js";
|
|
17
|
-
import"./index-y2f5s2cf.js";
|
|
18
|
-
import"./index-hcn69kp0.js";
|
|
19
|
-
import"./index-zaab1wz9.js";
|
|
20
|
-
import"./index-c8k4cs94.js";
|
|
21
|
-
import"./index-zsrtt42s.js";
|
|
22
|
-
import"./index-9pwa798m.js";
|
|
23
|
-
import"./index-3f7hqtgg.js";
|
|
24
|
-
import"./index-qbr05tbw.js";
|
|
25
|
-
import"./index-fc153g7b.js";
|
|
26
|
-
import"./index-sb4eanpv.js";
|
|
27
|
-
import"./index-rtry5xyf.js";
|
|
28
|
-
import"./index-jwc2v92w.js";
|
|
29
|
-
import"./index-kn0y788q.js";
|
|
30
|
-
import"./index-kyayzfxp.js";
|
|
31
|
-
import"./index-ddszzne4.js";
|
|
32
|
-
import"./index-sn2vm710.js";
|
|
33
|
-
import"./index-yhpbcrdk.js";
|
|
34
|
-
import"./index-0145kpjr.js";
|
|
35
|
-
import"./index-556ja8an.js";
|
|
36
|
-
import"./index-4fwbbad3.js";
|
|
37
|
-
import"./index-b43rt5ph.js";
|
|
38
|
-
import"./index-q7sjgr1y.js";
|
|
39
|
-
import"./index-0e34njnm.js";
|
|
40
|
-
import"./index-95hhrw1d.js";
|
|
41
|
-
import"./index-j98116cx.js";
|
|
42
|
-
import"./index-zg9d392c.js";
|
|
43
|
-
import"./index-n832052r.js";
|
|
44
|
-
import"./index-v56mhyhs.js";
|
|
45
|
-
import"./index-z6xqpmqg.js";
|
|
46
|
-
import"./index-r3mvsbtq.js";
|
|
47
|
-
import"./index-4wneygfx.js";
|
|
48
|
-
import"./index-84qah5h6.js";
|
|
49
|
-
import"./index-9e6fdz2h.js";
|
|
50
|
-
import"./index-4rhhvd1a.js";
|
|
51
|
-
import"./index-ac39znep.js";
|
|
52
|
-
import"./index-m1nrd3yd.js";
|
|
53
|
-
import"./index-zjygnfay.js";
|
|
54
|
-
import"./index-ae75rja9.js";
|
|
55
|
-
import"./index-5d7bzpfn.js";
|
|
56
|
-
import"./index-zs1jrsta.js";
|
|
57
|
-
import"./index-bk5tah7q.js";
|
|
58
|
-
import"./index-yep24wn4.js";
|
|
59
|
-
import"./index-f9nfknjg.js";
|
|
60
|
-
import"./index-bzd67m2j.js";
|
|
61
|
-
import"./index-7g4c7s5r.js";
|
|
62
|
-
import"./index-bpmtbmy9.js";
|
|
63
|
-
import"./index-zgwm4ryv.js";
|
|
64
|
-
import"./index-a76rekgs.js";
|
|
65
|
-
export {
|
|
66
|
-
handleGuardrailExplain
|
|
67
|
-
};
|