opencode-swarm 7.167.1 → 7.168.0

package/dist/dispatch/token-bucket.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Token-bucket dispatch rate limiting for native task delegations
+ * (issue #2507 / ADR 0002 G3 — reimplemented, no upstream code ported).
+ *
+ * Pacing, never denial: an empty bucket awaits until a token refills, so
+ * dispatch rate is bounded WITHOUT blocking diagnosis or recovery (only the
+ * `task` tool acquires tokens; read/diagnose/repair/rescope/abort controls
+ * never wait).
+ *
+ * Restart-state integration: the per-PROJECT bucket level and refill
+ * timestamp persist as one row in the existing `coordination_state` table
+ * under namespace `dispatch.token-bucket` (entity `project`), written when
+ * tokens are consumed. A fresh process rehydrates from that row and refills
+ * by elapsed wall time — an exhausted bucket does not grant a fresh burst
+ * after restart. Write failures fail OPEN (debug log, never break
+ * dispatch): the in-memory bucket stays authoritative for the process
+ * lifetime, and a restart after persistent write failure sees no row and
+ * grants a fresh burst (documented limitation — the limiter's purpose is
+ * runaway containment within a process).
+ */
+export declare const TOKEN_BUCKET_NAMESPACE = "dispatch.token-bucket";
+export declare const TOKEN_BUCKET_ENTITY_KEY = "project";
+/**
+ * Acquire one dispatch token, awaiting until one is available (paced, never
+ * denied). `ratePerSecond === 0` disables the limiter entirely.
+ *
+ * Persistence is debounced to the acquires that matter for restart
+ * semantics: only a PACED acquire (one that had to wait for a refill)
+ * writes the coordination row. Immediate burst consumption is
+ * reconstructible within the documented one-burst over-permission bound,
+ * and skipping those writes keeps the common fast path free of SQLite I/O
+ * (composing gates run under tight timing windows).
+ */
+export declare function acquireDispatchToken(input: {
+    directory: string;
+    ratePerSecond: number;
+    burstCapacity: number;
+}): Promise<void>;
+/** Test seam: forget all in-memory buckets (does not touch persisted rows). */
+export declare function _resetDispatchTokenBuckets(): void;
+export declare const _internals: {
+    now: () => number;
+    sleep: (ms: number) => Promise<void>;
+    readState: (directory: string) => import("../db/coordination-store.js").CoordinationState | null;
+    onPersistError: (err: unknown) => void;
+};

package/dist/hooks/delegation-gate/dead-lane-reclaim.d.ts

@@ -0,0 +1,61 @@
+import { closeProjectDb } from '../../db/project-db';
+import { atomicWriteSwarmFileSync } from '../../utils/atomic-write';
+import { bunSpawn } from '../../utils/bun-compat';
+import { canonicalRootKeyFresh } from '../../utils/canonical-root';
+import { resolveGitExecutable } from '../../utils/git-executable.js';
+import { removeWorktree } from '../../worktree/core';
+export interface DeadLaneReclaimEntry {
+    lanePath: string;
+    branchName: string;
+    parentSessionId: string;
+    taskId: string;
+    /** The removal error that stranded the lane (e.g. `EBUSY: ...`). */
+    reason: string;
+    recordedAt: number;
+}
+export interface ReclaimDeadLanesContext {
+    /**
+     * Session ids that still own live state (#2527 interplay: a lane whose
+     * parent session is active, or whose path is protected by recovery/
+     * ownership machinery, is NOT reclaimable — it is not dead).
+     */
+    activeSessionIds?: Iterable<string>;
+    protectedWorktreePaths?: Iterable<string>;
+}
+export interface ReclaimDeadLanesResult {
+    reclaimed: string[];
+    retained: Array<{
+        lanePath: string;
+        reason: string;
+    }>;
+}
+/** Record a dead lane for next-start reclaim. Dedupes by lanePath. */
+export declare function recordDeadLaneReclaim(directory: string, entry: Omit<DeadLaneReclaimEntry, 'recordedAt'>): void;
+/** Read-only view for diagnostics and tests. */
+export declare function listDeadLaneReclaims(directory: string): DeadLaneReclaimEntry[];
+declare function isLaneOwnedByActiveSession(lanePath: string, activeSessionIds: Set<string>, parentSessionId?: string): boolean;
+/**
+ * Dirty-lane gate (#2508 interplay): a lane with uncommitted changes is NEVER
+ * purged without the shared confirmation primitive — fail closed. Any git
+ * error also counts as dirty: an unknowable state is not a purgeable state.
+ */
+declare function isLaneDirty(lanePath: string): Promise<boolean>;
+/**
+ * Reclaim every recorded dead lane whose gates pass. Runs inside the bounded,
+ * fail-open next-start init task (`runInitOrphanRecovery`), so it never throws
+ * and never blocks init: per-lane failures retain the entry for the next start.
+ */
+export declare function reclaimDeadLanes(directory: string, context?: ReclaimDeadLanesContext): Promise<ReclaimDeadLanesResult>;
+declare function pathExists(target: string): Promise<boolean>;
+export declare const _internals: {
+    removeWorktree: typeof removeWorktree;
+    closeProjectDb: typeof closeProjectDb;
+    isLaneOwnedByActiveSession: typeof isLaneOwnedByActiveSession;
+    isLaneDirty: typeof isLaneDirty;
+    pathExists: typeof pathExists;
+    bunSpawn: typeof bunSpawn;
+    resolveGitExecutable: typeof resolveGitExecutable;
+    atomicWriteSwarmFileSync: typeof atomicWriteSwarmFileSync;
+    canonicalRootKeyFresh: typeof canonicalRootKeyFresh;
+};
+export {};

package/dist/hooks/delegation-gate/worktree-isolation.d.ts

@@ -146,6 +146,16 @@ interface SessionSerializationState {
      */
     successfulDispatchesSince: number;
 }
+/**
+ * Issue #2599: bounded lane session.create with deterministic late-settle
+ * handling. The create promise's outcome is captured exactly once into a
+ * derived settle-state promise — never a mutable flag read across async
+ * continuations — so a create that settles after the deadline reaches
+ * `onLateResolve` (verified teardown of the late child) under EVERY
+ * microtask interleaving, and only after the settle (or this grace bound)
+ * does the caller's lane cleanup begin.
+ */
+declare function createSessionWithinBudget<T>(promise: Promise<T>, label: string, onLateResolve?: (result: T) => Promise<void> | void, timeoutMs?: number): Promise<T>;
 interface CleanupStandardWorktreeResult {
     removedWorktree: boolean;
     cleanedBranch: boolean;
@@ -384,6 +394,18 @@ export declare const _internals: {
     preserveDirtyWorktreeAtPath: typeof preserveDirtyWorktreeAtPath;
     /** Bounded lane session.create timeout (tests may override). */
     worktreeSessionCreateTimeoutMs: number;
+    /**
+     * Issue #2599 AC4: bound on how long the deadline path waits for the
+     * create promise to settle before proceeding to lane cleanup. Tests
+     * override this to keep never-settling-create cases fast.
+     */
+    worktreeSessionCreateSettleGraceMs: number;
+    /**
+     * Issue #2599: the settle-state-machine budget wrapper, exposed so tests
+     * can drive both late-settle interleavings directly with controlled
+     * promises (no racy shared flag is involved).
+     */
+    createSessionWithinBudget: typeof createSessionWithinBudget;
     /** FR-001a: abort entry point for in-flight dispatches. */
     abortStandardWorktreeDispatch: typeof abortStandardWorktreeDispatch;
     standardWorktreeByCallID: Map<string, StandardWorktreeDispatch>;

package/dist/hooks/issue-trace.d.ts

@@ -15,6 +15,7 @@
  * advanced, so the next cycle recomputes and retries — a lost directive can
  * no longer be permanently suppressed by idempotency while state advances.
  */
+import { getPlanLedgerStateReadOnly } from '../plan/ledger-sqlite';
 import { error as _logErrorImpl } from '../utils/logger.js';
 import { isPlanCriticApproved } from './delegation-gate';
 import { implementationReviewReceiptExists, publicationReceiptExists, readIssueReference, readPlanPhaseStatus, readSpecIssueNumber, readTraceState, recurrenceSweepReceiptExists, reproductionReceiptExists, specExists, writeTraceState } from './issue-trace-state';
@@ -30,7 +31,9 @@ export declare const _internals: {
     recurrenceSweepReceiptExists: typeof recurrenceSweepReceiptExists;
     implementationReviewReceiptExists: typeof implementationReviewReceiptExists;
     isPlanCriticApproved: typeof isPlanCriticApproved;
+    getPlanLedgerState: typeof getPlanLedgerStateReadOnly;
     logError: typeof _logErrorImpl;
+    boundedApprovalCheck: (directory: string, timeoutMs: number) => Promise<boolean>;
 };
 export declare function createIssueTraceHook(_config: unknown, directory: string, approvalTimeoutMs?: number): {
     messagesTransform: (input: unknown, output: unknown) => Promise<void>;

package/dist/hooks/utils.d.ts

@@ -76,7 +76,7 @@ export declare function composeBlockingHandlers<I, O>(...fns: Array<HookHandler<
  * @throws Error if the filename is invalid or attempts path traversal
  */
 export declare function validateSwarmPath(directory: string, filename: string): string;
-export declare function readSwarmFileAsync(directory: string, filename: string, cache?: Map<string, Promise<string | null>>): Promise<string | null>;
+export declare function readSwarmFileAsync(directory: string, filename: string, cache?: Map<string, Promise<string | null>>, reader?: (resolvedPath: string) => Promise<string | null>, useArtifactCache?: boolean): Promise<string | null>;
 /**
  * Estimate tokens from a character count using the canonical heuristic.
  * This is the single sanctioned numeric form (issue #2107 §1).