opencode-swarm 7.166.2 → 7.166.3

package/dist/commands/close.d.ts

@@ -157,6 +157,77 @@ declare function countSessionKnowledgeEntries(entries: CloseKnowledgeEntry[], se
  * Use copyDirRecursiveWithFailures when per-file failure tracking is needed.
  */
 declare function copyDirRecursive(src: string, dest: string): Promise<number>;
+/**
+ * Flat-file artifacts to include in the archive bundle.
+ * Each entry is a relative path under .swarm/.
+ *
+ * plan-ledger.jsonl is included so the archive bundle is a self-contained
+ * forensic snapshot of the session: the ledger holds the full audit trail of
+ * task state transitions and snapshot events that plan.json/plan.md don't
+ * preserve.
+ */
+export declare const ARCHIVE_ARTIFACTS: string[];
+/**
+ * Active-state flat files to clean after archiving so future swarms start clean.
+ *
+ * plan.json, plan.md, and plan-ledger.jsonl are all removed so the next /swarm
+ * session starts with a clean slate. The user's original ask for /swarm close
+ * was to "archive plan files so future swarms aren't confused" — leaving a
+ * terminal-state plan.json in place violates that invariant because the next
+ * session's loadPlan() would pick it up as if it were still active.
+ *
+ * CRITICAL: the ledger must also be removed. Without this, loadPlan()'s Step 4
+ * would see no plan.json but a surviving ledger, call replayFromLedger(), and
+ * materialize the CLOSED plan back into plan.json on the next session. The
+ * ledger is a second backing store for the same "terminal-state plan" and
+ * leaving it behind re-enables the exact bug this cleanup is meant to fix.
+ * The archive-first guard below ensures we only delete files we successfully
+ * copied to the archive bundle, so the audit trail is preserved in the bundle.
+ *
+ * knowledge-rejected.jsonl, repo-graph.json, doc-manifest.json,
+ * dark-matter.md, telemetry.jsonl, and swarm.db are
+ * session-generated artifacts that do not persist meaningfully across sessions —
+ * they are recreated on next session init and must be removed to avoid stale-state
+ * interference.
+ *
+ * The SQLite WAL sidecars swarm.db-shm and swarm.db-wal are deliberately NOT in
+ * either list (the archive-first guard would preserve them anyway): since #2483
+ * they are removed immediately AFTER the swarm.db unlink by
+ * removeSqliteSidecarsAfterClose, deliberately reversing #1692. Post-unlink the
+ * sidecar paths are meaningless for future opens (no new opener can attach),
+ * live processes keep their already-open fds so deleting the PATH cannot
+ * corrupt them, and a Windows open-handle collision yields EBUSY which the
+ * helper skips fail-open.
+ *
+ * Note: knowledge.jsonl is intentionally NOT cleaned because it contains cumulative
+ * project knowledge (lessons learned) that should persist across sessions and finalize
+ * cycles. The archive step still creates a backup for safety.
+ * close-summary.md is NOT cleaned because it is written as the final close output
+ * AFTER the clean stage runs. spec.md IS cleaned: it is single-session state coupled
+ * to the plan lifecycle (the plan it produced is removed above), so leaving it behind
+ * makes the next session pick up a stale spec via readEffectiveSpecSync and mis-route
+ * the architect into CLARIFY-SPEC/overwrite prompts. It is archived first (archive-first
+ * guard), so the forensic copy is preserved in the bundle. The earlier "spec.md may not
+ * exist" rationale was wrong — handoff.md is equally optional and is cleaned the same way.
+ * session-reflection.md is a single-session snapshot (not cumulative like
+ * knowledge.jsonl) so it IS cleaned to maintain the clean-slate invariant.
+ * spec-staleness.json and spec-snapshot.md are the same class of single-session
+ * spec-drift state as spec.md. spec-staleness.json is an existence-only gate
+ * checked unconditionally by enforceSpecDriftGate, which hard-blocks the core
+ * write tools (save_plan, update_task_status, phase_complete,
+ * lean_turbo_run_phase, lean_turbo_acquire_locks) with SPEC_DRIFT_BLOCK — a
+ * survivor would block the NEXT session against drift that no longer applies.
+ * spec-snapshot.md is its companion diff source, feeding the mismatch shown in
+ * the SPEC_DRIFT_BLOCK message. Both are archived first (archive-first guard),
+ * then cleaned so the next session starts drift-free.
+ */
+export declare const ACTIVE_STATE_TO_CLEAN: string[];
+/**
+ * Active-state directories to archive and clean after archiving.
+ * These contain session-generated data that must be removed so future
+ * swarms start clean. Each entry is a relative path under .swarm/.
+ */
+export declare const ACTIVE_STATE_DIRS_TO_CLEAN: string[];
 /**
  * Guarantee all phases and tasks in a plan are marked complete/closed.
  * Mutates planData in place. Returns actual IDs of newly closed phases and
@@ -226,6 +297,16 @@ export declare function runArchiveEvidenceRetention(ctx: ArchiveStageContext): P
  * 375 ms so `/swarm close` remains responsive.
  */
 declare function unlinkActiveStateFileWithRetry(filePath: string): Promise<void>;
+/**
+ * Remove the SQLite WAL sidecars (swarm.db-wal / swarm.db-shm) immediately
+ * after the clean stage unlinks swarm.db (#2483, deliberately reversing the
+ * #1692 preserve decision): once the main db is unlinked the sidecar paths
+ * are meaningless for future opens — no new opener can attach — and live
+ * processes keep their already-open fds, so deleting the PATH cannot corrupt
+ * them. Best-effort and per-file fail-open: ENOENT (already gone) and EBUSY
+ * (Windows open-handle collision) are skipped silently.
+ */
+export declare function removeSqliteSidecarsAfterClose(swarmDir: string): void;
 export declare function runCleanStage(ctx: CloseStageContext): Promise<CleanStageResult>;
 /**
  * STAGE 4: ALIGN
@@ -282,6 +363,7 @@ export declare const _internals: {
     closeRepoMemory: typeof closeRepoMemory;
     unlinkActiveStateFileWithRetry: typeof unlinkActiveStateFileWithRetry;
     unlink: typeof fsSync.promises.unlink;
+    unlinkSidecarSync: typeof fsSync.unlinkSync;
     sleep: typeof sleep;
     collectGarbageBestEffort: typeof collectGarbageBestEffort;
     ACTIVE_STATE_DIRS_TO_CLEAN: string[];

package/dist/config/schema.d.ts

@@ -445,6 +445,11 @@ export declare const SummaryConfigSchema: z.ZodObject<{
     exempt_tools: z.ZodDefault<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 export type SummaryConfig = z.infer<typeof SummaryConfigSchema>;
+export declare const RetentionConfigSchema: z.ZodPrefault<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    dry_run: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>>;
+export type RetentionConfig = z.infer<typeof RetentionConfigSchema>;
 export declare const ReviewPassesConfigSchema: z.ZodObject<{
     always_security_review: z.ZodDefault<z.ZodBoolean>;
     security_globs: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -2218,6 +2223,10 @@ export declare const PluginConfigSchema: z.ZodObject<{
         retention_days: z.ZodDefault<z.ZodNumber>;
         exempt_tools: z.ZodDefault<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
+    retention: z.ZodPrefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        dry_run: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
     review_passes: z.ZodOptional<z.ZodObject<{
         always_security_review: z.ZodDefault<z.ZodBoolean>;
         security_globs: z.ZodDefault<z.ZodArray<z.ZodString>>;

package/dist/context-map/capsule-persistence.d.ts

@@ -29,6 +29,7 @@ export declare const _internals: {
     readonly existsSync: typeof fs.existsSync;
     readonly mkdirSync: typeof fs.mkdirSync;
     readonly readdirSync: typeof fs.readdirSync;
+    readonly statSync: fs.StatSyncFn;
     readonly unlinkSync: typeof fs.unlinkSync;
     readonly renameSync: typeof fs.renameSync;
 };
@@ -50,17 +51,21 @@ export declare function saveCapsule(capsule: ContextCapsule, directory: string):
  */
 export declare function loadCapsule(taskId: string, directory: string): ContextCapsule | null;
 /**
- * Delete a capsule from `.swarm/capsules/{task_id}.json`.
- *
- * Returns `true` if the file was deleted, `false` if it didn't exist.
- * Never throws.
+ * Listing cap for `.swarm/capsules/` enumeration (issue #2483 §2, R12): the
+ * list returns NEWEST-first (mtime descending, code-unit filename
+ * tie-break — never localeCompare) and is capped, so every listing read is
+ * O(cap), not O(unbounded capsule history). The effective value resolves
+ * through `resolveRetentionCap` so the #2483 acceptance checks can shrink it.
  */
-export declare function deleteCapsule(taskId: string, directory: string): boolean;
+export declare const MAX_CAPSULES_LISTED = 500;
 /**
- * List all saved capsule task IDs in `.swarm/capsules/`.
+ * List saved capsule task IDs in `.swarm/capsules/`, newest-first.
  *
  * Returns an array of task IDs derived from filenames (stripping the
- * `.json` extension). Returns an empty array if the directory doesn't
- * exist. Never throws.
+ * `.json` extension), ordered by capsule file mtime descending (code-unit
+ * filename tie-break) and capped at {@link MAX_CAPSULES_LISTED} entries.
+ * A capsule whose file cannot be `stat`-ed sorts oldest (fail-open per
+ * entry). Returns an empty array if the directory doesn't exist. Never
+ * throws.
  */
 export declare function listCapsules(directory: string): string[];

package/dist/hooks/delegate-ack-collector.d.ts

@@ -39,6 +39,13 @@ export interface DelegateAckOutput {
 }
 /** Best-effort extraction of a task id from a delegation prompt envelope. */
 export declare function resolveDelegateAckTaskId(args: Record<string, unknown>, knownPlanTaskIds?: ReadonlySet<string>, planContextOverLimit?: boolean): string | undefined;
+/**
+ * Global FIFO cap on the unacknowledged-criticals audit stream (issue #2483
+ * §2). Enforcement resolves the effective value through `resolveRetentionCap`
+ * so the #2483 acceptance checks can shrink the cap below this default and
+ * prove the writer clamps.
+ */
+export declare const MAX_UNACKNOWLEDGED_CRITICALS = 500;
 export interface CollectDelegateAcksResult {
     emitted: Array<{
         id: string;

package/dist/hooks/knowledge-store.d.ts

@@ -29,6 +29,13 @@ export interface KnowledgeRetractionRecord {
     matched_swarm_ids: string[];
     matched_hive_ids: string[];
 }
+/**
+ * Global FIFO cap on the retraction audit stream (issue #2483 §2). Enforcement
+ * resolves the effective value through {@link resolveRetentionCap} so the
+ * #2483 acceptance checks can shrink the cap below this default and prove the
+ * writer clamps.
+ */
+export declare const MAX_RETRACTION_RECORDS = 500;
 export declare function readRetractionRecords(directory: string): Promise<KnowledgeRetractionRecord[]>;
 export declare function appendRetractionRecord(directory: string, record: KnowledgeRetractionRecord): Promise<void>;
 /**

package/dist/hooks/review-receipt.d.ts

@@ -224,6 +224,25 @@ export declare function persistReviewReceipt(directory: string, receipt: ReviewR
  * orphan file, never a dangling index entry that points at missing evidence.
  */
 export declare function removeReviewReceipt(directory: string, receiptPath: string, receiptId: string): Promise<void>;
+export interface PruneDanglingReceiptIndexEntriesOptions {
+    /** Count dangling entries without rewriting the index (sweep dry-run). */
+    dryRun?: boolean;
+}
+/**
+ * Drop index entries whose receipt file no longer exists (issue #2483).
+ *
+ * The retention sweep prunes receipt FILES by age/count; without this pass
+ * the manifest keeps naming pruned evidence forever. Entries whose
+ * `filename` is not a bare basename (the poisoned-entry class the read path
+ * already refuses) count as dangling and are dropped with the rest.
+ *
+ * The rewrite is atomic (temp+rename via {@link writeReceiptIndex}) under
+ * the same `_indexLockChain` as appends, so an interleaved append is never
+ * lost. Returns the number of entries dropped (or, with `dryRun`, the
+ * number that WOULD be dropped). A missing/unparseable index, or a receipts
+ * directory that does not exist, is a 0 — this helper never creates state.
+ */
+export declare function pruneDanglingReceiptIndexEntries(directory: string, options?: PruneDanglingReceiptIndexEntriesOptions): Promise<number>;
 /**
  * Atomically attach independent finding-validation results to an existing
  * receipt. The receipt identity and index entry remain unchanged.
@@ -238,9 +257,18 @@ export declare function readReceiptById(directory: string, receiptId: string): P
  * Useful for drift verification to find prior reviews of the same scope.
  */
 export declare function readReceiptsByScopeHash(directory: string, scopeHash: string): Promise<ReviewReceipt[]>;
+/**
+ * Read cap for the receipts index reader (issue #2483 §2, R12): the index is
+ * append-ordered (newest last), so bounding the read to the LAST
+ * {@link MAX_RECEIPTS_READ} entries keeps every read O(cap) while still
+ * returning the newest receipts. The effective value resolves through
+ * `resolveRetentionCap` so the #2483 acceptance checks can shrink it.
+ */
+export declare const MAX_RECEIPTS_READ = 1000;
 /**
  * Read all receipts from the index (all verdicts, latest first).
- * Useful for drift verification context.
+ * Useful for drift verification context. Bounded to the newest
+ * {@link MAX_RECEIPTS_READ} index entries (see the constant's docblock).
  */
 export declare function readAllReceipts(directory: string): Promise<ReviewReceipt[]>;
 /**