opencode-swarm 7.164.4 → 7.164.6

package/dist/pr-review/authorization.d.ts

@@ -82,9 +82,9 @@ declare function reentryAuthorizationFilePath(directory: string, sessionID: stri
 declare function renameWithRetryAsync(tempPath: string, targetPath: string): Promise<void>;
 declare function writeAuthorizationFile(filePath: string, file: AuthorizationFile): Promise<void>;
 /**
- * Drop expired records past the retention bound; keep newest first. A burst
- * of consumed records must never evict a still-live unconsumed authorization
- * before its TTL, so unconsumed records take priority within the cap.
+ * Drop expired records past the retention bound while preserving every live
+ * authorization. Consumed records are retained only as same-call replay
+ * evidence, so they fill the remaining bounded capacity after live records.
  */
 declare function pruneAuthorizations(records: readonly PrReviewReentryAuthorizationRecord[], nowMs: number): PrReviewReentryAuthorizationRecord[];
 /**
@@ -99,6 +99,15 @@ export declare function issuePrReviewReentryAuthorization(directory: string, ses
     role: PrReviewReentryRole;
 }): Promise<PrReviewReentryAuthorizationRecord>;
 declare function authorizationMatchesBinding(record: PrReviewReentryAuthorizationRecord, binding: PrReviewReentryBindingContext): boolean;
+/**
+ * Read-only admission check for the PR workflow hook. The workflow-session
+ * lock is held by the caller while this authorization-store lock is acquired,
+ * so the binding used for the check cannot change underneath the read. The
+ * token remains unconsumed until the delegation gate has accepted the Task.
+ */
+export declare function hasPrReviewReentryAuthorizationAgainstBinding(directory: string, sessionID: string, request: {
+    role: PrReviewReentryRole;
+}, binding: PrReviewReentryBindingContext): Promise<boolean>;
 /**
  * Reserve or verify one authorization against a binding whose owning workflow
  * lock is held by the caller. The authorization-file lock is always acquired
@@ -115,6 +124,7 @@ export declare const _internals: {
     reentryAuthorizationFilePath: typeof reentryAuthorizationFilePath;
     pruneAuthorizations: typeof pruneAuthorizations;
     authorizationMatchesBinding: typeof authorizationMatchesBinding;
+    hasPrReviewReentryAuthorizationAgainstBinding: typeof hasPrReviewReentryAuthorizationAgainstBinding;
     /** DI seam: the rename implementation (tests inject failure modes). */
     renameImpl: (from: string, to: string) => Promise<void>;
     /** DI seam: retry backoff schedule (tests shrink to avoid real sleeps). */

package/dist/tools/authorize-pr-review-reentry.d.ts

@@ -9,10 +9,11 @@ import { createSwarmTool } from './create-tool.js';
  * requirement; every other delegation gate stays authoritative. Bindings are
  * exact (session, workflow, run, head SHA, worktree revision digest, role,
  * gate generation): replay, cross-session use, wrong role, expiry, or any
- * workflow progress since issuance fails closed. A Task the delegation gate
- * later rejects for an unrelated reason still burns the authorization —
- * issue a fresh one before retrying. Issue immediately before the Task
- * dispatch — authorizations are not stockpilable.
+ * workflow progress since issuance fails closed. If a plan or task workflow
+ * state exists, the dispatch must identify the exact task; taskless dispatches
+ * are limited to plan-free standalone review. A later unrelated gate rejection
+ * still burns the authorization — issue a fresh one before retrying. Issue
+ * immediately before the Task dispatch — authorizations are not stockpilable.
  */
 export declare function executeAuthorizePrReviewReentry(args: unknown, directory: string, context?: {
     sessionID?: string;

package/dist/tools/build-check.d.ts

@@ -5,7 +5,15 @@
  */
 import type { tool } from '@opencode-ai/plugin';
 import { type BuildDiscoverySkip } from '../build/discovery';
+import { loadGateOverrides } from '../config';
 import type { EvidenceVerdict } from '../config/evidence-schema';
+/**
+ * DI seam (issue #2524): the tool boundary self-loads the user's gate
+ * overrides; tests substitute this instead of touching the config loader.
+ */
+export declare const _internals: {
+    loadGateOverrides: typeof loadGateOverrides;
+};
 export declare const DEFAULT_TIMEOUT_MS = 300000;
 export declare const MAX_OUTPUT_BYTES: number;
 export declare const MAX_OUTPUT_LINES = 100;

package/dist/tools/dispatch-lanes.d.ts

@@ -676,6 +676,7 @@ declare function applyExplorerFormatSuffix(lanes: DispatchLaneSpec[], options?:
 declare function prReviewLaneResponseBudgetChars(mode: string, lane: DispatchLaneSpec): number | undefined;
 declare function applyPrWorkflowPromptContract(lanes: DispatchLaneSpec[], options: {
     mode?: string;
+    batchId?: string;
     prHeadSha?: string;
     revisionDigest?: string;
     scope?: string;

package/dist/tools/placeholder-scan.d.ts

@@ -1,4 +1,6 @@
 import type { tool } from '@opencode-ai/plugin';
+import type { GateConfigOverrides } from '../config';
+import { loadGateOverrides } from '../config';
 import type { EvidenceVerdict } from '../config/evidence-schema';
 import { saveEvidence } from '../evidence/manager';
 export interface PlaceholderScanInput {
@@ -35,6 +37,12 @@ export interface PlaceholderScanResult {
         files_scanned: number;
         findings_count: number;
         files_with_findings: number;
+        /**
+         * Present only when the gate was skipped via
+         * `gates.placeholder_scan.enabled: false` (issue #2524) — distinguishes
+         * a config-disabled run from a genuinely clean scan.
+         */
+        disabled_reason?: string;
     };
 }
 /**
@@ -92,7 +100,7 @@ declare function collectNonStubBodyLines(rootNode: any): Set<number>;
 /**
  * Scan files for placeholder content (TODO/FIXME comments, stub implementations, etc.)
  */
-export declare function placeholderScan(input: PlaceholderScanInput, directory: string): Promise<PlaceholderScanResult>;
+export declare function placeholderScan(input: PlaceholderScanInput, directory: string, gateOverrides?: GateConfigOverrides['placeholder_scan']): Promise<PlaceholderScanResult>;
 export declare const placeholder_scan: ReturnType<typeof tool>;
 /**
  * Internal seam for direct testing of the body-shape walker without
@@ -105,5 +113,6 @@ export declare const _internals: {
     isStubSkeletonFunction: typeof isStubSkeletonFunction;
     isConstantLiteralNode: typeof isConstantLiteralNode;
     saveEvidence: typeof saveEvidence;
+    loadGateOverrides: typeof loadGateOverrides;
 };
 export {};

package/dist/tools/pr-workflow-status.d.ts

@@ -17,6 +17,7 @@ declare function truncateToByteBudget(value: string, maxBytes: number): string;
  * finally. Never runs a PR-controlled script — only fixed read verbs are passed.
  */
 declare function runGitCapture(directory: string, args: string[]): Promise<string | null>;
+declare function resolveWorkflowGateSession(directory: string, sessionID: string): Promise<string | null>;
 export declare const pr_workflow_status: ReturnType<typeof createSwarmTool>;
 /** Test seam mirroring gh-evidence's `_internals` (issue #507 DI convention). */
 export declare const _internals: {
@@ -26,5 +27,6 @@ export declare const _internals: {
     runGitCapture: typeof runGitCapture;
     classifyGitState: typeof classifyPrWorkflowGitState;
     truncateToByteBudget: typeof truncateToByteBudget;
+    resolveWorkflowGateSession: typeof resolveWorkflowGateSession;
 };
 export {};

package/dist/tools/pre-check-batch.d.ts

@@ -4,7 +4,8 @@
  * Returns unified result with gates_passed status
  */
 import type { tool } from '@opencode-ai/plugin';
-import type { PluginConfig } from '../config';
+import type { GateConfigOverrides, PluginConfig } from '../config';
+import { loadGateOverrides } from '../config';
 import { saveEvidence } from '../evidence/manager.js';
 import { runExternalTool } from '../utils/external-tool-runner';
 import type { LintResult, ResolvedLinterCommand } from './lint';
@@ -30,6 +31,7 @@ export declare const _internals: {
     serializePreCheckResult: typeof serializePreCheckResult;
     resolveGatePreamble: typeof resolveGatePreamble;
     runPreCheckBatch: typeof runPreCheckBatch;
+    loadGateOverrides: typeof loadGateOverrides;
     MAX_COMBINED_BYTES: number;
 };
 export interface PreCheckBatchInput {
@@ -39,12 +41,22 @@ export interface PreCheckBatchInput {
     directory: string;
     /** SAST severity threshold (default: medium) */
     sast_threshold?: 'low' | 'medium' | 'high' | 'critical';
-    /** Optional plugin config */
+    /**
+     * Optional legacy plugin-config carrier for the gates slices. The public
+     * tool boundary no longer populates it (agents cannot pass config); direct
+     * callers/tests may. `gates` below takes precedence.
+     * @deprecated prefer the `gates` field (issue #2524).
+     */
     config?: PluginConfig;
+    /**
+     * User-written gate overrides (issue #2524) — loaded from the project/user
+     * config files by the public tool boundary via `loadGateOverrides`.
+     */
+    gates?: GateConfigOverrides;
     /**
      * Current phase number (positive integer >= 1).
-     * When provided, enables SAST baseline diffing: only findings absent from the
-     * phase-scoped baseline (.swarm/evidence/{phase}/sast-baseline.json) drive the
+     * When provided, enables SAST baseline diffing: only findings absent from
+     * the phase-scoped baseline (.swarm/evidence/{phase}/sast-baseline.json) drive the
      * fail verdict. Capture the baseline before first coder delegation via sast_scan
      * with capture_baseline:true.
      */
@@ -103,7 +115,7 @@ declare function runWithTimeout<T>(operation: (abortSignal: AbortSignal) => Prom
 /**
  * Run lint with detection and timeout
  */
-declare function runLintWrapped(files: string[] | undefined, directory: string, _config?: PluginConfig, abortSignal?: AbortSignal): Promise<ToolResult<LintResult>>;
+declare function runLintWrapped(files: string[] | undefined, directory: string, _gates?: GateConfigOverrides, abortSignal?: AbortSignal): Promise<ToolResult<LintResult>>;
 /**
  * Run lint on specific files only
  */
@@ -111,15 +123,15 @@ declare function runLintOnFiles(resolvedLinter: ResolvedLinterCommand, files: st
 /**
  * Run secretscan with timeout
  */
-declare function runSecretscanWrapped(files: string[] | undefined, directory: string, _config?: PluginConfig, abortSignal?: AbortSignal): Promise<ToolResult<SecretscanResult | SecretscanErrorResult>>;
+declare function runSecretscanWrapped(files: string[] | undefined, directory: string, _gates?: GateConfigOverrides, abortSignal?: AbortSignal): Promise<ToolResult<SecretscanResult | SecretscanErrorResult>>;
 /**
  * Run SAST scan with timeout
  */
-declare function runSastScanWrapped(changedFiles: string[], directory: string, severityThreshold: 'low' | 'medium' | 'high' | 'critical', config?: PluginConfig, phase?: number, abortSignal?: AbortSignal): Promise<ToolResult<SastScanResult>>;
+declare function runSastScanWrapped(changedFiles: string[], directory: string, severityThreshold: 'low' | 'medium' | 'high' | 'critical', gates?: GateConfigOverrides, phase?: number, abortSignal?: AbortSignal): Promise<ToolResult<SastScanResult>>;
 /**
  * Run quality budget with timeout
  */
-declare function runQualityBudgetWrapped(changedFiles: string[], directory: string, config?: PluginConfig, abortSignal?: AbortSignal): Promise<ToolResult<QualityBudgetResult>>;
+declare function runQualityBudgetWrapped(changedFiles: string[], directory: string, gates?: GateConfigOverrides, abortSignal?: AbortSignal): Promise<ToolResult<QualityBudgetResult>>;
 /**
  * Parse unified diff output (with -U0) to extract added/modified line numbers per file.
  * Returns a Map from normalised file path → Set of changed line numbers.

package/dist/tools/quality-budget.d.ts

@@ -1,4 +1,5 @@
 import type { tool } from '@opencode-ai/plugin';
+import { loadGateOverrides } from '../config';
 import type { QualityBudgetConfig } from '../config/schema';
 import { computeQualityMetrics, type QualityMetrics, type QualityViolation } from '../quality/metrics';
 export interface QualityBudgetInput {
@@ -31,4 +32,5 @@ export declare const quality_budget: ReturnType<typeof tool>;
 export declare const _internals: {
     qualityBudget: typeof qualityBudget;
     computeQualityMetrics: typeof computeQualityMetrics;
+    loadGateOverrides: typeof loadGateOverrides;
 };

package/dist/tools/sast-scan.d.ts

@@ -3,7 +3,8 @@
  * Integrates Tier A rules (offline) and optional Semgrep (Tier B)
  */
 import type { ToolDefinition } from '@opencode-ai/plugin/tool';
-import type { PluginConfig } from '../config';
+import type { GateConfigOverrides } from '../config';
+import { loadGateOverrides } from '../config';
 import type { EvidenceVerdict } from '../config/evidence-schema';
 import { checkSemgrepAvailable, isSemgrepAvailable, runSemgrep } from '../sast/semgrep';
 export interface SastScanInput {
@@ -56,6 +57,12 @@ export interface SastScanResult {
     findings: SastScanFinding[];
     /** Summary information */
     summary: {
+        /**
+         * Present only when the gate was skipped via
+         * `gates.sast_scan.enabled: false` (issue #2524) — distinguishes a
+         * config-disabled run from a genuinely clean scan.
+         */
+        disabled_reason?: string;
         /** Engine used for scanning */
         engine: 'tier_a' | 'tier_a+tier_b';
         /** Number of files scanned */
@@ -121,7 +128,7 @@ export interface SastScanFinding {
  * - Tier A: Built-in pattern-based rules (always runs)
  * - Tier B: Semgrep (optional, if available on PATH)
  */
-export declare function sastScan(input: SastScanInput, directory: string, config?: PluginConfig): Promise<SastScanResult>;
+export declare function sastScan(input: SastScanInput, directory: string, gates?: GateConfigOverrides): Promise<SastScanResult>;
 /**
  * SAST Scan tool - Static Application Security Testing
  * Scans changed files for security vulnerabilities using:
@@ -139,4 +146,5 @@ export declare const _internals: {
     checkSemgrepAvailable: typeof checkSemgrepAvailable;
     isSemgrepAvailable: typeof isSemgrepAvailable;
     runSemgrep: typeof runSemgrep;
+    loadGateOverrides: typeof loadGateOverrides;
 };

package/dist/tools/sbom-generate.d.ts

@@ -5,6 +5,14 @@
  * for manifest/lock files and generating CycloneDX format output.
  */
 import type { tool } from '@opencode-ai/plugin';
+import { loadGateOverrides } from '../config';
+/**
+ * DI seam (issue #2524): the tool boundary self-loads the user's gate
+ * overrides; tests substitute this instead of touching the config loader.
+ */
+export declare const _internals: {
+    loadGateOverrides: typeof loadGateOverrides;
+};
 export interface SbomGenerateInput {
     /** Scope of the scan: 'changed' for modified files only, 'all' for entire project */
     scope: 'changed' | 'all';
@@ -22,5 +30,11 @@ export interface SbomGenerateResult {
     components_count: number;
     /** Path to the generated SBOM file */
     output_path: string;
+    /**
+     * Present only when the gate was skipped because the user disabled it via
+     * `gates.sbom_generate.enabled: false` (issue #2524) — distinguishes a
+     * config skip from "no manifests found".
+     */
+    disabled_reason?: string;
 }
 export declare const sbom_generate: ReturnType<typeof tool>;

package/dist/tools/syntax-check.d.ts

@@ -1,6 +1,14 @@
 import type { tool } from '@opencode-ai/plugin';
-import type { PluginConfig } from '../config';
+import type { GateConfigOverrides } from '../config';
+import { loadGateOverrides } from '../config';
 import type { EvidenceVerdict } from '../config/evidence-schema';
+/**
+ * DI seam (issue #2524): the tool boundary self-loads the user's gate
+ * overrides; tests substitute this instead of touching the config loader.
+ */
+export declare const _internals: {
+    loadGateOverrides: typeof loadGateOverrides;
+};
 export interface SyntaxCheckInput {
     /** Files to check (from diff gate) */
     changed_files: Array<{
@@ -31,7 +39,7 @@ export interface SyntaxCheckResult {
 /**
  * Run syntax check on changed files
  *
- * Respects config.gates.syntax_check.enabled - returns skipped if disabled
+ * Respects gates.syntax_check.enabled - returns skipped if disabled
  */
-export declare function syntaxCheck(input: SyntaxCheckInput, directory: string, config?: PluginConfig): Promise<SyntaxCheckResult>;
+export declare function syntaxCheck(input: SyntaxCheckInput, directory: string, gates?: GateConfigOverrides): Promise<SyntaxCheckResult>;
 export declare const syntax_check: ReturnType<typeof tool>;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.164.4",
+	"version": "7.164.6",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",

package/dist/cli/curator-llm-factory-q3t3r632.js

@@ -1,66 +0,0 @@
-// @bun
-import {
-  createCuratorLLMDelegate
-} from "./index-qkwx4rrc.js";
-import"./index-x9ayhkkx.js";
-import"./index-pztdbtgw.js";
-import"./index-k8vy89vm.js";
-import"./index-vzs3st30.js";
-import"./index-jba9jgse.js";
-import"./index-txdagbh7.js";
-import"./index-3146wmgv.js";
-import"./index-4tgtbptw.js";
-import"./index-xjw7j7et.js";
-import"./index-x63jqvj3.js";
-import"./index-70ha9e09.js";
-import"./index-1f4nandk.js";
-import"./index-0zbze3n6.js";
-import"./index-zaab1wz9.js";
-import"./index-tme2kjvq.js";
-import"./index-zsrtt42s.js";
-import"./index-08e6x59x.js";
-import"./index-3f7hqtgg.js";
-import"./index-xj4kbtdw.js";
-import"./index-t2tqbq62.js";
-import"./index-prammvxb.js";
-import"./index-rtry5xyf.js";
-import"./index-0m94jsss.js";
-import"./index-8fjx6k2s.js";
-import"./index-cf54ftj1.js";
-import"./index-ddszzne4.js";
-import"./index-q9yz8da4.js";
-import"./index-yx3xqb0w.js";
-import"./index-z408nj03.js";
-import"./index-556ja8an.js";
-import"./index-4fwbbad3.js";
-import"./index-b43rt5ph.js";
-import"./index-q7sjgr1y.js";
-import"./index-eh2k07pp.js";
-import"./index-7zbk1e24.js";
-import"./index-v7a8e7rv.js";
-import"./index-zg9d392c.js";
-import"./index-n832052r.js";
-import"./index-rz87mx1c.js";
-import"./index-z6xqpmqg.js";
-import"./index-r3mvsbtq.js";
-import"./index-vx28633q.js";
-import"./index-wzmchqry.js";
-import"./index-9e6fdz2h.js";
-import"./index-4rhhvd1a.js";
-import"./index-stj85yx1.js";
-import"./index-m1nrd3yd.js";
-import"./index-zjygnfay.js";
-import"./index-ae75rja9.js";
-import"./index-qfrrcdhj.js";
-import"./index-5k226hxp.js";
-import"./index-bk5tah7q.js";
-import"./index-gt6p21cs.js";
-import"./index-tfa2p4y4.js";
-import"./index-k1m9214q.js";
-import"./index-7g4c7s5r.js";
-import"./index-bpmtbmy9.js";
-import"./index-zgwm4ryv.js";
-import"./index-a76rekgs.js";
-export {
-  createCuratorLLMDelegate
-};

package/dist/cli/guardrail-explain-jjbnrcqn.js

@@ -1,67 +0,0 @@
-// @bun
-import {
-  handleGuardrailExplain
-} from "./index-ne38vr77.js";
-import"./index-qkwx4rrc.js";
-import"./index-x9ayhkkx.js";
-import"./index-pztdbtgw.js";
-import"./index-k8vy89vm.js";
-import"./index-vzs3st30.js";
-import"./index-jba9jgse.js";
-import"./index-txdagbh7.js";
-import"./index-3146wmgv.js";
-import"./index-4tgtbptw.js";
-import"./index-xjw7j7et.js";
-import"./index-x63jqvj3.js";
-import"./index-70ha9e09.js";
-import"./index-1f4nandk.js";
-import"./index-0zbze3n6.js";
-import"./index-zaab1wz9.js";
-import"./index-tme2kjvq.js";
-import"./index-zsrtt42s.js";
-import"./index-08e6x59x.js";
-import"./index-3f7hqtgg.js";
-import"./index-xj4kbtdw.js";
-import"./index-t2tqbq62.js";
-import"./index-prammvxb.js";
-import"./index-rtry5xyf.js";
-import"./index-0m94jsss.js";
-import"./index-8fjx6k2s.js";
-import"./index-cf54ftj1.js";
-import"./index-ddszzne4.js";
-import"./index-q9yz8da4.js";
-import"./index-yx3xqb0w.js";
-import"./index-z408nj03.js";
-import"./index-556ja8an.js";
-import"./index-4fwbbad3.js";
-import"./index-b43rt5ph.js";
-import"./index-q7sjgr1y.js";
-import"./index-eh2k07pp.js";
-import"./index-7zbk1e24.js";
-import"./index-v7a8e7rv.js";
-import"./index-zg9d392c.js";
-import"./index-n832052r.js";
-import"./index-rz87mx1c.js";
-import"./index-z6xqpmqg.js";
-import"./index-r3mvsbtq.js";
-import"./index-vx28633q.js";
-import"./index-wzmchqry.js";
-import"./index-9e6fdz2h.js";
-import"./index-4rhhvd1a.js";
-import"./index-stj85yx1.js";
-import"./index-m1nrd3yd.js";
-import"./index-zjygnfay.js";
-import"./index-ae75rja9.js";
-import"./index-qfrrcdhj.js";
-import"./index-5k226hxp.js";
-import"./index-bk5tah7q.js";
-import"./index-gt6p21cs.js";
-import"./index-tfa2p4y4.js";
-import"./index-k1m9214q.js";
-import"./index-7g4c7s5r.js";
-import"./index-bpmtbmy9.js";
-import"./index-zgwm4ryv.js";
-import"./index-a76rekgs.js";
-export {
-  handleGuardrailExplain
-};