opencode-swarm 7.168.1 → 7.170.0

package/dist/tools/repo-graph/types.d.ts

@@ -14,8 +14,7 @@ export declare const REPO_GRAPH_FILENAME = "repo-graph.json";
  * the importing file) and per-node `exportLines`, enabling the `callers` and
  * `dead_exports` queries. Both fields are optional, so graphs written by older
  * versions (1.0.0) still load — but `dead_exports` requires >= 1.1.0 data and
- * self-gates via {@link isSchemaVersionAtLeast} rather than relying on the
- * loader (which only checks that a version string is present, not its value).
+ * self-gates via {@link isSchemaVersionAtLeast}.
  *
  * 1.2.0 adds per-node `exportRanges` (1-based inclusive line spans keyed by
  * symbol name — exported symbols for every grammar, plus non-exported member
@@ -29,8 +28,8 @@ export declare const REPO_GRAPH_FILENAME = "repo-graph.json";
  * that distinguishes edges whose resolved target is a scannable source file
  * (a graph node) from edges whose target is an asset (JSON/CSS/etc. — a real
  * file that never becomes a node). The field is optional, so 1.0.0–1.2.0
- * graphs still load; `storage.ts` only checks that a version string is
- * present, and feature gating is per-query via {@link isSchemaVersionAtLeast}.
+ * graphs still load; feature gating is per-query via
+ * {@link isSchemaVersionAtLeast}.
  * For pre-1.3.0 graphs the loader/queries fall back to an extension check
  * (`isScannableSourcePath`) to classify an untagged edge's target kind.
  *
@@ -65,6 +64,8 @@ export declare const REPO_GRAPH_FILENAME = "repo-graph.json";
  * notes instead of failing (issue #1536).
  */
 export declare const GRAPH_SCHEMA_VERSION = "1.7.0";
+/** The oldest graph schema whose persisted shape this build can interpret. */
+export declare const MIN_SUPPORTED_GRAPH_SCHEMA_VERSION = "1.0.0";
 /**
  * Default per-file source-size ceiling shared by graph construction and
  * query-time source reads. The builder treats this as the default value of
@@ -80,6 +81,14 @@ export declare const DEFAULT_MAX_SOURCE_BYTES: number;
  * is greater than or equal to `minimum`.
  */
 export declare function isSchemaVersionAtLeast(version: string | undefined, minimum: string): boolean;
+/**
+ * Return whether a persisted graph schema is a canonical numeric semver in
+ * the supported compatibility window. This is deliberately stricter than
+ * {@link isSchemaVersionAtLeast}: feature gates may tolerate malformed input
+ * by treating missing components as zero, but a persistence boundary must
+ * never trust an unknown or future graph shape.
+ */
+export declare function isGraphSchemaVersionCompatible(version: unknown): version is string;
 export declare const FILE_ROLE_VALUES: readonly ["api_route", "middleware", "service_module", "data_module", "swarm_tool", "agent", "hook", "config", "schema", "test_file", "cli_command", "documentation", "source_module"];
 export type FileRole = (typeof FILE_ROLE_VALUES)[number];
 export declare const ROUTE_METHOD_VALUES: readonly ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD", "ALL"];

package/dist/utils/bun-compat.d.ts

@@ -98,6 +98,14 @@ export interface BunCompatSpawnOptions {
     stdout?: 'inherit' | 'ignore' | 'pipe';
     stderr?: 'inherit' | 'ignore' | 'pipe';
     timeout?: number;
+    /**
+     * Maximum bytes retained for each buffered stdout/stderr stream. Invalid
+     * values fall back to `DEFAULT_BUN_SPAWN_MAX_BUFFER_BYTES` so asynchronous
+     * `bunSpawn` keeps its no-throw compatibility contract. Synchronous
+     * `bunSpawnSync` delegates to the host synchronous API and does not apply
+     * this asynchronous stream-capture option.
+     */
+    maxBuffer?: number;
     /** Preserve the caller's exact Windows argv quoting (required for cmd.exe /c). */
     windowsVerbatimArguments?: boolean;
     /**
@@ -111,6 +119,18 @@ export interface BunCompatSpawnOptions {
      */
     killProcessTree?: boolean;
 }
+/**
+ * Default bounded capture for unclaimed subprocess pipes. Five MiB matches
+ * the established Git subprocess limit while remaining finite by default.
+ */
+export declare const DEFAULT_BUN_SPAWN_MAX_BUFFER_BYTES: number;
+/** Raised when either buffered pipe exceeds its configured output limit. */
+export declare class BunCompatOutputLimitError extends Error {
+    readonly limit: number;
+    readonly captured: number;
+    readonly total: number;
+    constructor(limit: number, captured: number, total: number);
+}
 export interface BunCompatStream {
     text(): Promise<string>;
     bytes(): Promise<Uint8Array>;

package/dist/utils/gitignore-warning.d.ts

@@ -87,8 +87,11 @@ export declare const ENSURE_SWARM_GIT_EXCLUDED_PER_CALL_TIMEOUT_MS = 1500;
  * Steps:
  * 1. Resolve git root via `git rev-parse --show-toplevel`
  * 2. Resolve local exclude path via `git rev-parse --git-path info/exclude`
- * 3. Check if `.swarm/` is already ignored via `git check-ignore -q`
- * 4. If not ignored: append `.swarm/` to the local exclude file (idempotent)
+ * 3. Check if `.swarm/` AND `.swarm-worktrees/` are already ignored via two
+ *    independent `git check-ignore -q` probes (they are distinct patterns —
+ *    `.swarm/` does not cover `.swarm-worktrees/`, #2527)
+ * 4. For whichever pattern is not ignored: append it to the local exclude
+ *    file (idempotent, per-pattern)
  * 5. Detect tracked `.swarm/` files via `git ls-files -- .swarm`
  * 6. If tracked: emit an unsuppressed remediation warning
  *

package/dist/worktree/base-migration.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Issue #2527 (F4): one-time migration of the LEGACY parent-level shared
+ * worktree base (`<project-parent>/.swarm-worktrees`, shared by every
+ * sibling checkout — the root of the cross-project destruction class) into
+ * the project-internal default base (`<project>/.swarm-worktrees`).
+ *
+ * Ordering contract (plan-critic round 2, item 3): migration runs AFTER the
+ * recovery lock, AFTER the live-lane-owner scan (it needs the liveness
+ * answer), and AFTER the existing fail-closed uncertainty guards — mutating
+ * gitdir pointers under uncertain project state is not acceptable — and
+ * BEFORE enumeration-for-deletion.
+ *
+ * Safety contract: migration NEVER deletes anything. Owned + not-live
+ * registered worktrees are MOVED with `git worktree move` (the primitive
+ * that rewrites both gitdir pointers atomically; same-volume moves are an
+ * internal rename — empirically verified on Windows with a git-excluded
+ * target and dirty content). Foreign-owned lanes, live-owned lanes, and
+ * ownership-unprovable `.git`-less remnants are LEFT AT THEIR LEGACY PATHS
+ * (their owning checkouts migrate them; a bounded advisory line surfaces
+ * them). The legacy base directory itself is removed only when EMPTY (plain
+ * rmdir, never rm -rf). Timeout or per-lane failure ⇒ leave in place,
+ * retry next start; N bounded by the lane-owner store caps and the pass's
+ * withTimeout budget.
+ */
+import * as fs from 'node:fs';
+import { resolveWorktreeRepoOwnership } from '../config/lane-context';
+import type { LiveLaneOwnerEntry } from '../parallel/lane-owners';
+import { bunSpawn } from '../utils/bun-compat';
+import { resolveGitExecutable } from '../utils/git-executable.js';
+export interface BaseMigrationResult {
+    attempted: boolean;
+    legacyBaseExists: boolean;
+    moved: string[];
+    retained: Array<{
+        lanePath: string;
+        reason: string;
+    }>;
+    legacyBaseRemoved: boolean;
+}
+export declare const _internals: {
+    resolveWorktreeRepoOwnership: typeof resolveWorktreeRepoOwnership;
+    bunSpawn: typeof bunSpawn;
+    resolveGitExecutable: typeof resolveGitExecutable;
+    readdirSync: typeof fs.readdirSync;
+    existsSync: typeof fs.existsSync;
+    mkdirSync: typeof fs.mkdirSync;
+    rmdirSync: typeof fs.rmdirSync;
+    realpathSync: typeof fs.realpathSync;
+};
+/**
+ * Migrate owned, non-live lanes from the legacy parent-level base into the
+ * project-internal default base. Fail-open and non-throwing by contract
+ * (runs inside the bounded init-orphan-recovery pass).
+ */
+export declare function migrateLegacyWorktreeBase(directory: string, liveOwners: LiveLaneOwnerEntry[]): Promise<BaseMigrationResult>;

package/dist/worktree/core.d.ts

@@ -10,6 +10,7 @@
  */
 import * as fs from 'node:fs';
 import * as fsPromises from 'node:fs/promises';
+import { clearLiveLaneOwner } from '../parallel/lane-owners';
 import { bunSpawn } from '../utils/bun-compat';
 import { resolveGitExecutable } from '../utils/git-executable.js';
 import type { WorktreeHandle, WorktreeOptions, WorktreeProvisionResult } from './types';
@@ -23,6 +24,11 @@ import type { WorktreeHandle, WorktreeOptions, WorktreeProvisionResult } from '.
  */
 export declare const _internals: {
     bunSpawn: typeof bunSpawn;
+    /**
+     * Issue #2527 F3: clear the durable live-lane-owner record when this
+     * module removes a worktree (seam so tests can observe the clear).
+     */
+    clearLiveLaneOwner: typeof clearLiveLaneOwner;
     /** Test seam for process.platform — allows non-Windows CIs to exercise Windows paths. */
     platform: string;
     /** Test seam for sleep — allows tests to skip real delays. */
@@ -190,15 +196,18 @@ export declare function makeWorktreeBranchName(sessionId: string, id: string, op
  */
 /**
  * Resolves the swarm-managed worktree base directory: `directory/worktreeDir`
- * when an override is configured, otherwise the DD-6 default
- * `<project-parent>/.swarm-worktrees`. Shared by `provisionWorktree` (path
- * construction) and the destructive-command guard / removeWorktree force
- * fallback (containment checks) so both sides agree on what counts as
- * "swarm-managed".
+ * when an override is configured, otherwise the project-INTERNAL default
+ * `<project>/.swarm-worktrees` (issue #2527 root fix — the pre-#2527 default
+ * was the project's PARENT, so every sibling checkout shared one base and
+ * reclamation in one project could destroy another project's lanes).
+ * Shared by `provisionWorktree` (path construction) and the
+ * destructive-command guard / removeWorktree force fallback (containment
+ * checks) so both sides agree on what counts as "swarm-managed". The legacy
+ * parent-level base is migrated by `base-migration.ts`, never deleted.
  *
  * @param directory   - Project root (an absolute path to the git working tree).
  * @param worktreeDir - Optional worktree-dir override (relative to `directory`
- *                      or absolute). When absent, the DD-6 default base is used.
+ *                      or absolute). When absent, the default base is used.
  * @returns The absolute worktree base directory.
  */
 export declare function resolveWorktreeBaseDir(directory: string, worktreeDir?: string): string;

package/dist/worktree/ownership.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Issue #2527: the single ownership-gated worktree-directory reclamation
+ * path.
+ *
+ * Every deletion of a worktree-base directory reachable from plugin init
+ * (init orphan recovery) or `/swarm reset-session` routes through
+ * `removeOwnedWorktreeDir`. The contract, frozen by the #2527 acceptance
+ * checks (C1/C2/C5/C7/C10) and pinned by the C7 leg-B source-scan ratchet:
+ *
+ *  1. A `.git`-bearing candidate is deletable ONLY when the existing
+ *     commondir-based primitive (`resolveWorktreeRepoOwnership` on
+ *     `readLinkedWorktreeGitDir` + `resolveMainWorktree`) proves this
+ *     repository owns it.
+ *  2. A `git worktree remove` refusal is a STOP — never an escalation to
+ *     `rmSync`. The refusal text ("is not a working tree", "contains
+ *     modified or untracked files") is itself the safety signal: the first
+ *     is git saying this repo does not own the path; the second is git
+ *     refusing to destroy uncommitted work. Both must preserve the
+ *     candidate.
+ *  3. A `.git`-less directory is deletable ONLY when it sits inside this
+ *     project's own default worktree base (ours by construction, per F1).
+ *     Anywhere else — the legacy parent-level shared base, or a configured
+ *     `worktree_dir` override that may point anywhere — the ownership of a
+ *     bare directory cannot be proven and it is skipped and reported.
+ *     Review-round hardening: the marker probe is errno-discriminating —
+ *     an unreadable-but-present `.git` classifies as `uncertain`, never as
+ *     "gitless".
+ *
+ * The entry files (`src/hooks/init-orphan-recovery.ts`,
+ * `src/commands/reset-session.ts`) must not call `rmSync` on base-derived
+ * paths themselves — the C7 ratchet enforces it.
+ */
+import * as fs from 'node:fs';
+import { resolveWorktreeRepoOwnership } from '../config/lane-context';
+import { isPathUnderSwarmWorktreeBase, removeWorktree } from './core';
+export type OwnedRemovalOutcome = {
+    status: 'removed';
+} | {
+    status: 'skipped';
+    reason: string;
+} | {
+    status: 'refused';
+    reason: string;
+};
+export type GitMarkerProbe = 'gitless' | 'present' | 'uncertain';
+export declare const _internals: {
+    resolveWorktreeRepoOwnership: typeof resolveWorktreeRepoOwnership;
+    isPathUnderSwarmWorktreeBase: typeof isPathUnderSwarmWorktreeBase;
+    removeWorktree: typeof removeWorktree;
+    rmSync: typeof fs.rmSync;
+    statSync: any;
+};
+/**
+ * Errno-discriminating `.git` marker probe. A bare `existsSync` collapses
+ * every I/O error (EPERM/EBUSY/EMFILE on a transiently-unreadable marker)
+ * into "gitless", which would route an ownership-unprovable path into
+ * removal. Only a proven-absent marker is "gitless"; any other error is
+ * "uncertain" and the caller must retain the candidate.
+ */
+export declare function probeGitMarker(dotGitPath: string): GitMarkerProbe;
+/**
+ * Attempt to reclaim one worktree-base directory, gated by repo ownership.
+ * NEVER throws: every failure is a returned outcome so callers can report
+ * and continue with the next candidate.
+ */
+export declare function removeOwnedWorktreeDir(worktreePath: string, projectRoot: string): Promise<OwnedRemovalOutcome>;

package/opencode-swarm.schema.json

@@ -3082,6 +3082,103 @@
         }
       }
     },
+    "observability": {
+      "description": "Observability options — remote OTLP/OpenInference export is opt-in and disabled by default (issue #2485).",
+      "type": "object",
+      "properties": {
+        "export": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "default": false,
+              "type": "boolean"
+            },
+            "endpoint": {
+              "default": "",
+              "type": "string",
+              "minLength": 1
+            },
+            "convention": {
+              "default": "genai",
+              "type": "string",
+              "enum": [
+                "genai",
+                "openinference"
+              ]
+            },
+            "headers": {
+              "type": "object",
+              "propertyNames": {
+                "type": "string"
+              },
+              "additionalProperties": {
+                "type": "string"
+              }
+            },
+            "batchSize": {
+              "default": 64,
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 512
+            },
+            "flushIntervalMs": {
+              "default": 5000,
+              "type": "integer",
+              "minimum": 250,
+              "maximum": 300000
+            },
+            "requestTimeoutMs": {
+              "default": 5000,
+              "type": "integer",
+              "minimum": 250,
+              "maximum": 60000
+            },
+            "spoolMaxBytes": {
+              "default": 1048576,
+              "type": "integer",
+              "minimum": 16384,
+              "maximum": 16777216
+            },
+            "spoolMaxAgeMs": {
+              "default": 86400000,
+              "type": "integer",
+              "minimum": 60000,
+              "maximum": 2592000000
+            },
+            "maxRetries": {
+              "default": 3,
+              "type": "integer",
+              "minimum": 0,
+              "maximum": 10
+            },
+            "backoffBaseMs": {
+              "default": 200,
+              "type": "integer",
+              "minimum": 10,
+              "maximum": 10000
+            },
+            "backoffMaxMs": {
+              "default": 30000,
+              "type": "integer",
+              "minimum": 100,
+              "maximum": 300000
+            },
+            "circuitThreshold": {
+              "default": 5,
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 50
+            },
+            "circuitCooldownMs": {
+              "default": 60000,
+              "type": "integer",
+              "minimum": 1000,
+              "maximum": 600000
+            }
+          }
+        }
+      }
+    },
     "learning": {
       "description": "Learning subsystem: real-time admission, PRM persistence, dedup sweep (issue #1821).",
       "type": "object",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.168.1",
+	"version": "7.170.0",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -85,6 +85,7 @@
 		".opencode/skills/orchestrating-subagents",
 		".opencode/skills/durable-session-state",
 		"tests/fixtures/memory-recall",
+		"tests/fixtures/memory-recall-heldout",
 		"opencode-swarm.schema.json",
 		"README.md",
 		"LICENSE"
@@ -131,7 +132,8 @@
 		"check:error-channel-discard": "bun run scripts/check-error-channel-discard.ts",
 		"check:path-identity": "bun run scripts/check-path-identity.ts",
 		"check:registry-citations": "bun run scripts/check-registry-citations.ts",
-		"check:memory-recall": "bun run scripts/memory-recall-regression.ts"
+		"check:memory-recall": "bun run scripts/memory-recall-regression.ts",
+		"check:retrieval-quality": "bun run scripts/retrieval-quality-regression.ts"
 	},
 	"dependencies": {
 		"@opencode-ai/plugin": "^1.18.3",