opencode-swarm 7.166.0 → 7.166.1

package/dist/tools/co-change-analyzer.d.ts

@@ -1,5 +1,10 @@
+import * as child_process from 'node:child_process';
 import type { tool } from '@opencode-ai/plugin';
 import type { SwarmKnowledgeEntry } from '../hooks/knowledge-types.js';
+/** Lazy-bind so mock.module can intercept at call time (#330); all internal
+ * calls route through _internals.getExecFileAsync so tests can replace the
+ * seam directly (PRR-020). */
+declare function getExecFileAsync(): typeof child_process.execFile.__promisify__;
 export interface CoChangeEntry {
     fileA: string;
     fileB: string;
@@ -55,4 +60,6 @@ export declare const _internals: {
     detectDarkMatter: typeof detectDarkMatter;
     darkMatterToKnowledgeEntries: typeof darkMatterToKnowledgeEntries;
     formatDarkMatterOutput: typeof formatDarkMatterOutput;
+    getExecFileAsync: typeof getExecFileAsync;
 };
+export {};

package/dist/tools/gh-evidence.d.ts

@@ -1,18 +1,24 @@
 import type { ToolDefinition } from '@opencode-ai/plugin/tool';
 import { resolveExecutableFromPath, runExternalTool } from '../utils/external-tool-runner';
+import { resolveGhExecutable } from '../utils/gh-executable';
 interface GhBinaryCandidateOptions {
-    env?: Pick<NodeJS.ProcessEnv, 'ProgramFiles' | 'ProgramFiles(x86)' | 'LOCALAPPDATA'>;
+    env?: NodeJS.ProcessEnv;
     platform?: NodeJS.Platform;
 }
 export declare function resolveGhBinaryCandidates(options?: GhBinaryCandidateOptions): string[];
 /**
- * Resolve the `gh` binary to invoke. Exported (issue #2236 hardening, lane
- * C1b) so other call sites that need a `gh` executable — e.g. `src/git/pr.ts`,
- * `src/commands/pr-monitor-status.ts` — reuse this resolver instead of
- * spawning a bare `'gh'` literal or inventing a second gh resolver. Returns
- * `null` when no candidate is found; callers should fall back to the bare
- * `'gh'` literal (mirrors `resolveGitExecutable()`'s "never regress a working
- * host" fallback in `src/utils/git-executable.ts`).
+ * Resolve the `gh` binary for the gh_evidence tool. Exported (issue #2236
+ * hardening, lane C1b) so other call sites that need a `gh` executable — e.g.
+ * `src/git/pr.ts`, `src/commands/pr-monitor-status.ts` — reuse this resolver
+ * instead of spawning a bare `'gh'` literal or inventing a second gh resolver.
+ *
+ * Issue #2476 AC1: delegates to the hardened twin of the git resolver
+ * (`src/utils/gh-executable.ts`) — absolute-candidate-first ordering,
+ * absoluteness requirement, `gh --version` probe, bounded budget, caching.
+ * Returns `null` when nothing validated (the resolver's bare-`'gh'` terminal
+ * fallback maps here to null so the tool renders its gh-not-found guidance
+ * exactly as a scan-miss did before); callers that spawn directly should use
+ * `resolveGhExecutable()` instead, which never returns null.
  */
 export declare function resolveGhBinary(): string | null;
 /**
@@ -26,6 +32,7 @@ export declare const gh_evidence: ToolDefinition;
 export declare const _internals: {
     resolveGhBinaryCandidates: typeof resolveGhBinaryCandidates;
     resolveExecutableFromPath: typeof resolveExecutableFromPath;
+    resolveGhExecutable: typeof resolveGhExecutable;
     resolveGhBinary: typeof resolveGhBinary;
     runExternalTool: typeof runExternalTool;
 };

package/dist/tools/pkg-audit.d.ts

@@ -9,7 +9,30 @@ import { bunSpawn } from '../utils/bun-compat';
  * functions gate strictly on a non-zero exit and were dispositioned
  * SAFE-EXIT-CHECK by that sweep.
  */
+/**
+ * Resolve the spawn command prefix for a package-audit binary (issue #2476
+ * AC5). On POSIX (or when resolution fails) the bare name is returned -- the
+ * historical behavior, which works there. On win32 the absolute candidate is
+ * resolved via resolveExecutableFromPath (.exe/.cmd/.bat variants); a
+ * `.cmd`/`.bat` hit cannot be spawned directly by Node (EINVAL since the
+ * CVE-2024-27980 hardening), so it is routed through cmd.exe as
+ * `/d /s /c call "<resolved>"` -- everything after `/c` is cmd's own command
+ * line, the repo-documented windowsVerbatimArguments pattern. Empirically
+ * verified on Windows (node & Bun): a bare quoted tail `"<path>"` is mangled
+ * by cmd's /s quote-stripping (the last quote in the line is removed), while
+ * the `call` prefix keeps the quoted path intact for paths containing spaces
+ * such as C:\Program Files. Callers append their fixed literal arguments
+ * (`audit --json`) as separate argv elements; verbatim joining keeps them
+ * outside the quoted path. The only interpolated value is the resolved
+ * ABSOLUTE path, rejected when it contains any cmd metacharacter
+ * (`" & | < > ^ ! %`) so the verbatim command line degrades to the bare-name
+ * fallback rather than through any cmd re-interpretation; the remaining
+ * tokens are fixed literals.
+ */
+declare function resolveAuditCommandDefault(name: 'npm' | 'cargo'): string[];
 export declare const _internals: {
     bunSpawn: typeof bunSpawn;
+    resolveAuditCommand: typeof resolveAuditCommandDefault;
 };
 export declare const pkg_audit: ReturnType<typeof tool>;
+export {};

package/dist/utils/gh-executable.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Single source of truth for "what absolute path do we invoke for gh" — the
+ * gh twin of `resolveGitExecutable()` in `src/utils/git-executable.ts`
+ * (issue #2476 AC1 / source issue #2262).
+ *
+ * The pre-fix resolver (`resolveGhBinaryCandidates` in
+ * `src/tools/gh-evidence.ts` + `resolveExecutableFromPath`) put the bare
+ * name FIRST, so a full PATH scan for `gh` beat every ProgramFiles absolute
+ * candidate; accepted any stat-able regular file (a 20-byte text file named
+ * gh.exe passed); and had no `gh --version` behavioral probe, no budget, and
+ * no cache. That matters MORE than the git case: `gh` runs with the user's
+ * GitHub token, so a hijack is credential theft in addition to code
+ * execution.
+ *
+ * Contract (mirrors git-executable.ts; deviations called out inline):
+ *
+ *   1. explicit override — the `OPENCODE_SWARM_GH_BINARY` env var ONLY.
+ *      There is deliberately NO config-file `gh.binary` key: the config path
+ *      is the attack surface `enforceGitBinaryProvenance` exists to strip
+ *      for git, and gh never had one. Env-only keeps every override
+ *      user-controlled by construction.
+ *   2. platform absolute candidates (win32 ProgramFiles/LOCALAPPDATA — the
+ *      set `resolveGhBinaryCandidates` already knew — plus darwin/linux
+ *      install locations, which the old resolver lacked entirely);
+ *   3. ALL PATH matches for `gh` (win32: `.exe`/`.cmd`/`.bat` variants);
+ *   4. bare `'gh'` LAST, unprobed, so a host that works via plain PATH
+ *      lookup never regresses.
+ *
+ * Each non-bare candidate must be ABSOLUTE and is validated once with
+ * `gh --version` (bounded, explicit cwd) whose output must match
+ * GH_VERSION_PATTERN — exit 0 alone does not accept a candidate. NOT AN
+ * ANTI-TAMPERING CONTROL (a hostile program can print `gh version 2.x`); it
+ * stops ACCIDENTS — a non-gh that merely exits 0, a broken shim. The
+ * trust-boundary control is that no repository-controlled value can name a
+ * candidate at all (env-only override).
+ *
+ * Bounded probing (AGENTS.md invariant 1): per-probe timeout 250 ms, total
+ * first-resolution budget 1000 ms. gh resolution is LAZY (tool/ghExec call
+ * paths, never plugin init), so the sync API below is sufficient — there is
+ * no init-path need for an async variant.
+ *
+ * NEVER throws: both non-accepting outcomes (budget exhausted, every
+ * candidate rejected) return the bare `'gh'` fallback, memoized with a 60 s
+ * TTL so a host that installs gh mid-session recovers (same rationale as
+ * git-executable.ts — a slash-less spawn does not resolve against the PATH
+ * this module enumerates, so "gh is missing" is not a state this resolver
+ * may report).
+ */
+import { spawnSync } from 'node:child_process';
+/** Env var escape hatch — a blocked user can set this without editing files. */
+export declare const GH_BINARY_ENV_VAR = "OPENCODE_SWARM_GH_BINARY";
+/**
+ * `gh --version` prints `gh version 2.74.0 (2025-...)` — a fixed format
+ * string in gh's own root command. Same accident-not-attacker contract as
+ * `GIT_VERSION_PATTERN` (see git-executable.ts); anchored to the first line.
+ */
+export declare const GH_VERSION_PATTERN: RegExp;
+export type GhResolutionCandidateSource = 'override' | 'platform' | 'path';
+export interface GhResolutionAttempt {
+    source: GhResolutionCandidateSource;
+    candidate: string;
+    accepted: boolean;
+    /** Rejection reason; absent when `accepted` is true. */
+    reason?: string;
+}
+export interface GhResolutionDescription {
+    resolved: boolean;
+    resolvedPath?: string;
+    attempts: GhResolutionAttempt[];
+    overrideValue?: string;
+}
+/**
+ * Windows install locations, kept in one place so the legacy
+ * `resolveGhBinaryCandidates` export in gh-evidence.ts can share the set.
+ * Paths are built with native separators via path.join by the caller.
+ */
+export declare function windowsGhAbsoluteCandidates(env: NodeJS.ProcessEnv): string[];
+/**
+ * Resolve the gh executable to invoke. Lazy, memoized, bounded by
+ * TOTAL_BUDGET_MS, never throws. Returns a validated absolute path or the
+ * bare `'gh'` fallback.
+ */
+export declare function resolveGhExecutable(): string;
+/** Exported for tests; clears the memoized cache (and bumps the generation). */
+export declare function resetGhExecutableCache(): void;
+/**
+ * TEST-ONLY seam — NOT a production API, do not call from `src/`. Pre-seeds
+ * the resolver cache with an explicit "success" entry so
+ * `resolveGhExecutable()` returns `value` with zero probe spawns. Distinct
+ * from gh-evidence.ts's `__seedGhBinaryForTests` (which pins only that
+ * wrapper's legacy layer): neither bypasses the other.
+ */
+export declare function __seedGhExecutableForTests(value: string): void;
+/** Diagnostic surface: candidates tried in the most recent probe cycle. */
+export declare function describeGhResolution(): GhResolutionDescription;
+/**
+ * DI seam for testability (repo convention — see git-executable.ts).
+ * `platform`/`env` let tests drive every platform branch regardless of the
+ * host OS; `now` makes the TTL and budget deterministically testable.
+ */
+export declare const _internals: {
+    spawnSync: typeof spawnSync;
+    platform: () => NodeJS.Platform;
+    env: () => NodeJS.ProcessEnv;
+    now: () => number;
+};

package/dist/utils/merge.d.ts

@@ -1,5 +1,31 @@
 export declare const MAX_MERGE_DEPTH = 10;
+/**
+ * Keys that must never be merged, at any depth (issue #2476 AC2 / source
+ * issue #2264). `JSON.parse` creates `__proto__` as an OWN ENUMERABLE data
+ * property (CreateDataProperty, not [[Set]]), so `Object.keys(override)`
+ * yields it and the plain assignment below would invoke the
+ * `Object.prototype.__proto__` setter and reparent the merged object.
+ * `constructor`/`prototype` are the sibling prototype-pollution carriers.
+ * Only the OVERRIDE side is checked: that is the untrusted side at every
+ * production call site (repo-supplied project config over user config at
+ * `src/config/loader.ts`; user scoring config over defaults at
+ * `src/config/constants.ts`) — `base` is either caller-built defaults or an
+ * already-vetted earlier merge.
+ */
+export declare const DANGEROUS_MERGE_KEYS: ReadonlySet<string>;
+/** Typed, fail-closed rejection of a dangerous merge key (issue #2476 AC2). */
+export declare class DangerousMergeKeyError extends Error {
+    readonly key: string;
+    readonly path: string;
+    constructor(key: string, path: string);
+}
 /**
  * Deep merge two objects, with override values taking precedence.
+ *
+ * Throws `DangerousMergeKeyError` when the override object carries
+ * `__proto__`, `constructor`, or `prototype` at ANY depth (issue #2476 AC2).
+ * The config loader catches this at the repo-supplied project-config merge
+ * and continues with user-level config only; other callers get the typed
+ * throw as fail-closed semantics.
  */
 export declare function deepMerge<T extends Record<string, unknown>>(base?: T, override?: T): T | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.166.0",
+	"version": "7.166.1",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",

package/dist/cli/index-zjygnfay.js

@@ -1,33 +0,0 @@
-// @bun
-import {
-  __esm
-} from "./index-a76rekgs.js";
-
-// src/utils/merge.ts
-function deepMergeInternal(base, override, depth) {
-  if (depth >= MAX_MERGE_DEPTH) {
-    throw new Error(`deepMerge exceeded maximum depth of ${MAX_MERGE_DEPTH}`);
-  }
-  const result = { ...base };
-  for (const key of Object.keys(override)) {
-    const baseVal = base[key];
-    const overrideVal = override[key];
-    if (typeof baseVal === "object" && baseVal !== null && typeof overrideVal === "object" && overrideVal !== null && !Array.isArray(baseVal) && !Array.isArray(overrideVal)) {
-      result[key] = deepMergeInternal(baseVal, overrideVal, depth + 1);
-    } else {
-      result[key] = overrideVal;
-    }
-  }
-  return result;
-}
-function deepMerge(base, override) {
-  if (!base)
-    return override;
-  if (!override)
-    return base;
-  return deepMergeInternal(base, override, 0);
-}
-var MAX_MERGE_DEPTH = 10;
-var init_merge = () => {};
-
-export { MAX_MERGE_DEPTH, deepMerge, init_merge };