opencode-swarm 7.164.4 → 7.164.6

package/dist/config/schema.d.ts

@@ -322,14 +322,44 @@ export declare const QualityBudgetConfigSchema: z.ZodObject<{
     exclude_globs: z.ZodDefault<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 export type QualityBudgetConfig = z.infer<typeof QualityBudgetConfigSchema>;
-export declare const GATE_CONFIG_KNOWN_SECTION_KEYS: {
-    readonly syntax_check: readonly ["enabled"];
-    readonly placeholder_scan: readonly ["enabled", "deny_patterns", "allow_globs", "max_allowed_findings"];
-    readonly sast_scan: readonly ["enabled"];
-    readonly sbom_generate: readonly ["enabled"];
-    readonly build_check: readonly ["enabled"];
-    readonly quality_budget: readonly ["enabled", "max_complexity_delta", "max_public_api_delta", "max_duplication_ratio", "min_test_to_code_ratio", "enforce_on_globs", "exclude_globs"];
+/**
+ * Single source of truth for gate sections (issue #2524): `GateConfigSchema` is
+ * built from this map and `GATE_CONFIG_KNOWN_SECTION_KEYS` is derived from it,
+ * so the loader's strip registry can never drift from the schema. The previous
+ * hand-maintained copy omitted `placeholder_scan.sentinel_allowlist`, which
+ * made the loader strip a real schema key as "unknown".
+ */
+export declare const GATE_SECTION_SCHEMAS: {
+    readonly syntax_check: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>;
+    readonly placeholder_scan: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        deny_patterns: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        allow_globs: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        max_allowed_findings: z.ZodDefault<z.ZodNumber>;
+        sentinel_allowlist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    readonly sast_scan: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>;
+    readonly sbom_generate: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>;
+    readonly build_check: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>;
+    readonly quality_budget: z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        max_complexity_delta: z.ZodDefault<z.ZodNumber>;
+        max_public_api_delta: z.ZodDefault<z.ZodNumber>;
+        max_duplication_ratio: z.ZodDefault<z.ZodNumber>;
+        min_test_to_code_ratio: z.ZodDefault<z.ZodNumber>;
+        enforce_on_globs: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        exclude_globs: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
 };
+export type GateSectionName = keyof typeof GATE_SECTION_SCHEMAS;
 export declare const GateConfigSchema: z.ZodObject<{
     syntax_check: z.ZodDefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -361,6 +391,30 @@ export declare const GateConfigSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type GateConfig = z.infer<typeof GateConfigSchema>;
+/**
+ * Per-section field keys, derived from `GATE_SECTION_SCHEMAS`. Consumed by
+ * `sanitizeGatesConfig` (config loader) and `collectRawGatesConfigFindings`
+ * (config doctor) to decide which `gates.*` keys are recognized.
+ */
+export declare const GATE_CONFIG_KNOWN_SECTION_KEYS: Record<GateSectionName, readonly string[]>;
+/**
+ * Only the gate keys a user actually wrote. Zod materializes every `.default()`
+ * on parse, so the parsed `config.gates` always carries full default lists once
+ * any `gates` object exists; tools must not mistake those for user intent
+ * (e.g. placeholder_scan treats any provided `deny_patterns` list as custom
+ * patterns and disables its built-in string/code scanning). The loader exposes
+ * the post-sanitize raw section as this shape — see `loadGateOverrides`.
+ */
+export type GateConfigOverrides = {
+    [K in GateSectionName]?: Partial<z.infer<(typeof GATE_SECTION_SCHEMAS)[K]>>;
+};
+/**
+ * Drift-check contract (issue #2524): every `GateConfigSchema` section must
+ * list the production modules that read it. `scripts/drift-check-gates-docs.ts`
+ * enforces key parity with the schema; the gates-config-wiring tests prove the
+ * wiring dynamically through the registered tool objects.
+ */
+export declare const GATE_CONFIG_READERS: Record<GateSectionName, readonly string[]>;
 export declare const PipelineConfigSchema: z.ZodObject<{
     parallel_precheck: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;

package/dist/hooks/delegation-gate.d.ts

@@ -476,7 +476,9 @@ declare function buildParallelExecutionGuidance(directory: string | undefined, s
  * agents are dispatched for different tasks from the same architect session.
  * Issue #970.
  */
-declare function resolveEvidenceTaskId(args: Record<string, unknown> | undefined, session: AgentSessionState, directory: string): Promise<string | null>;
+declare function resolveEvidenceTaskId(args: Record<string, unknown> | undefined, session: AgentSessionState, directory: string, options?: {
+    allowSessionFallback?: boolean;
+}): Promise<string | null>;
 /**
  * _internals export for testing — do not use in production code.
  * Exposes resolveEvidenceTaskId, resolveDelegatedPlanTaskId,

package/dist/hooks/pr-workflow-gate.d.ts

@@ -603,8 +603,8 @@ export type SubmitPrReviewResultOutcome = {
  * lock and terminalization takes the same inner lock.
  */
 export declare function submitPrReviewResult(directory: string, childSessionId: string, input: {
-    batchId: string;
-    laneId: string;
+    batchId?: string;
+    laneId?: string;
     revisionDigest: string;
     result: PrReviewLaneResultEnvelope;
 }): Promise<SubmitPrReviewResultOutcome>;
@@ -1272,6 +1272,14 @@ export declare function enforcePrWorkflowToolBefore(directory: string, sessionID
  * head-bound PR_REVIEW gate exists for the session.
  */
 export declare function readPrReviewReentryBindingContext(directory: string, sessionID: string): Promise<PrReviewReentryBindingContext | null>;
+/**
+ * Read-only admission check for direct PR-review re-entry. It deliberately
+ * does not consume the token: the delegation gate performs the one-use
+ * reservation only after its own Task acceptance checks have passed.
+ */
+export declare function hasActivePrReviewReentryAuthorization(directory: string, sessionID: string, request: {
+    role: PrReviewReentryRole;
+}): Promise<boolean>;
 /**
  * Sole production reservation/verification path for direct PR-review re-entry.
  * Lock order is fixed: workflow-session first, authorization store second. The