opencode-swarm 7.171.2 → 7.172.1

package/dist/mcp/adapters/knowledge-memory.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Knowledge + memory adapters for the read-only MCP surface (#2499).
+ *
+ * `knowledge_recall` calls `searchKnowledge` — the exact retrieval core the
+ * registered `knowledge_recall` tool uses — with `skipLedgerGenesis` so a
+ * query never performs the receipt ledger's one-time `runLocked` genesis.
+ * `swarm_memory_recall` calls the registered tool's compute core with
+ * `{recordUsage: false}` (identical retrieval, no telemetry write) — but ONLY
+ * after read-only probes confirm the feature is enabled AND the configured
+ * provider's store artifact already exists, so no `.swarm/` state (sqlite
+ * `memory.db` genesis, WAL/SHM files, migration reports) is ever materialized
+ * by a query.
+ */
+import type { McpReadTool } from '../registry.js';
+export declare const knowledgeRecallAdapter: McpReadTool;
+export declare const swarmMemoryRecallAdapter: McpReadTool;

package/dist/mcp/adapters/scope-repo.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Scope/repo adapters for the read-only MCP surface (#2499).
+ *
+ * `plan_conflict_check` validates declared-scope disjointness (the
+ * scope-validation capability) via `executePlanConflictCheck` — the same
+ * exported core the registered tool calls; it reads `.swarm/plan.json` and
+ * `.swarm/scopes/` fail-open and writes nothing. `diff` and `symbols` go
+ * through the registered production tools (pure reads; `diff` guards
+ * non-git roots).
+ */
+import type { McpReadTool } from '../registry.js';
+export declare const planConflictCheckAdapter: McpReadTool;
+export declare const diffAdapter: McpReadTool;
+export declare const symbolsAdapter: McpReadTool;

package/dist/mcp/adapters/verification.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Verification adapters for the read-only MCP surface (#2499).
+ *
+ * Each adapter calls the SAME registered production implementation the
+ * in-session tool uses — the persistence-free compute cores exported by the
+ * tool modules (`computeSyntaxCheck`, `computePlaceholderScan`,
+ * `computeSastScan`, `computeQualityBudget`) and the registered
+ * `evidence_check` tool (a pure filesystem read). No parallel
+ * reimplementation of any verification logic lives here.
+ */
+import type { ToolContext } from '@opencode-ai/plugin';
+import type { McpReadTool } from '../registry.js';
+/** Synthetic tool context pinning the MCP server's single configured root. */
+export declare function mcpToolContext(root: string): ToolContext;
+export declare function safeParseJson(text: string): unknown;
+export declare const syntaxCheckAdapter: McpReadTool;
+export declare const placeholderScanAdapter: McpReadTool;
+export declare const sastScanAdapter: McpReadTool;
+export declare const qualityBudgetAdapter: McpReadTool;
+export declare const evidenceCheckAdapter: McpReadTool;

package/dist/mcp/pipeline.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Response pipeline for the read-only MCP verification surface (#2499).
+ *
+ * Every tool response leaving the MCP server passes through
+ * `applyResponsePipeline`: secrets are redacted FIRST (redacting before
+ * bounding matters — truncating first can split a secret pattern in half and
+ * defeat redaction), then the serialized payload is bounded so a large
+ * corpus can never produce an unbounded MCP response.
+ */
+/** Frozen acceptance cap (repro/check-mcp-bounded-output.sh, C8): the
+ * JSON-serialized pipeline output may never exceed this many characters. */
+export declare const MCP_MAX_RESPONSE_CHARS = 65536;
+export interface ResponsePipelineResult {
+    /** The bounded, redacted serialized form actually sent to the client. */
+    text: string;
+    /** True when the serialized form was cut to fit the cap. */
+    truncated: boolean;
+}
+/**
+ * Redact every string in the payload (top-level and nested, including MCP
+ * `content` arrays), then bound the serialized output to
+ * {@link MCP_MAX_RESPONSE_CHARS} characters. The RETURN VALUE itself is
+ * bounded — the full (unbounded) redacted payload never leaves the pipeline.
+ */
+export declare function applyResponsePipeline(payload: unknown): ResponsePipelineResult;

package/dist/mcp/registry.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Tool registry for the read-only MCP verification surface (#2499).
+ *
+ * `buildMcpToolRegistry` composes the read-only tool set for ONE configured
+ * project root. Descriptions are sourced from `TOOL_METADATA` — the same
+ * registry the plugin host uses — so MCP tool names are a subset of
+ * registered tool names with exact description parity (frozen by
+ * repro/check-mcp-registry-capability-coverage.sh, C2).
+ *
+ * The write boundary is fail-closed (frozen by
+ * repro/check-mcp-readonly-default-no-writes.sh, C6): every tool name is
+ * validated against a write-capable denylist and a match THROWS — with or
+ * without `allowWrite`. Phase 1 ships zero write tools; `allowWrite` is the
+ * documented forward-compat seam for the #2500 write surface and adds
+ * nothing today.
+ */
+import type { z } from 'zod';
+/** Write-capable tool-name shapes. Mirrors the frozen C6 denylist. */
+export declare const WRITE_TOOL_NAME_PATTERN: RegExp;
+export interface McpReadTool {
+    /** Registered plugin tool name (a TOOL_METADATA key). */
+    name: string;
+    /** Exact TOOL_METADATA description (parity assigned at build time). */
+    description: string;
+    kind: 'read';
+    /** Argument field names carrying file-path values (containment-checked). */
+    pathFields: string[];
+    /** MCP input schema (mirrors the registered tool's zod args). */
+    inputSchema: z.ZodObject<z.ZodRawShape>;
+    execute(args: Record<string, unknown>, root: string): Promise<unknown>;
+}
+export interface McpToolRegistry {
+    tools: McpReadTool[];
+}
+export interface BuildMcpToolRegistryOptions {
+    /** The single configured project root (one server = one root). */
+    root: string;
+    /** Alias for `root` (accepted for harness compatibility). */
+    directory?: string;
+    /**
+     * Forward-compat seam for the #2500 explicitly-authorized write surface.
+     * Phase 1 has no write tools, so this flag never adds anything; the
+     * write-name denylist stays fail-closed either way.
+     */
+    allowWrite?: boolean;
+}
+export declare function buildMcpToolRegistry(options: BuildMcpToolRegistryOptions): McpToolRegistry;

package/dist/mcp/server.d.ts

@@ -0,0 +1,35 @@
+/**
+ * MCP stdio server for the read-only verification surface (#2499).
+ *
+ * One server instance = one configured project root. Every tool call is
+ * containment-checked (path arguments must resolve inside the canonical
+ * root, including symlink/junction escapes), executed through the registered
+ * production implementations, and the response is redacted-then-bounded by
+ * the response pipeline before it leaves the server.
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/** Containment rejection carried as a tool-level error result. */
+export declare class McpContainmentError extends Error {
+    readonly field: string;
+    readonly value: string;
+    readonly root: string;
+    constructor(field: string, value: string, root: string);
+}
+/** Walk a declared path field's value shape and validate every path. */
+export declare function validatePathField(field: string, value: unknown, root: string): void;
+export interface RunMcpServerOptions {
+    root: string;
+    allowWrite?: boolean;
+    /** Test seam: inject transports instead of stdio (InMemoryTransport pair). */
+    transport?: {
+        connect(server: unknown): Promise<void>;
+    } | undefined;
+    version?: string;
+}
+/**
+ * Build the MCP server (tools registered, containment + pipeline wired).
+ * Exported for unit tests that drive the server over in-memory transports.
+ */
+export declare function createMcpServer(options: RunMcpServerOptions): McpServer;
+/** Serve the read-only verification surface over stdio until stdin closes. */
+export declare function runMcpServer(options: RunMcpServerOptions): Promise<number>;

package/dist/memory/gateway.d.ts

@@ -24,6 +24,14 @@ export interface ProposeMemoryInput {
     rationale: string;
     evidenceRefs?: string[];
 }
+/**
+ * Recall options for read-only surfaces. `recordUsage: false` skips the
+ * recall-usage telemetry write (the sqlite/jsonl `recordRecallUsage` insert)
+ * while keeping the identical retrieval path (#2499).
+ */
+export interface RecallUsageOptions {
+    recordUsage?: boolean;
+}
 export interface RecallMemoryInput {
     query: string;
     task?: string;
@@ -54,7 +62,7 @@ export declare class MemoryGateway {
     isEnabled(): boolean;
     dispose(): Promise<void>;
     deriveAllowedScopes(): MemoryScopeRef[];
-    recall(input: RecallMemoryInput): Promise<RecallBundle>;
+    recall(input: RecallMemoryInput, options?: RecallUsageOptions): Promise<RecallBundle>;
     propose(input: ProposeMemoryInput): Promise<MemoryProposal>;
     /**
      * Read-only passthroughs used by the consolidation engine. They assert the

package/dist/observability/catalog.d.ts

@@ -1,7 +1,7 @@
 /**
  * The event catalog (issue #2029).
  *
- * Exactly 62 entries, matching the `TelemetryEvent` union at
+ * Exactly 63 entries, matching the `TelemetryEvent` union at
  * `src/telemetry.ts:20-172`. Thirty-eight predate the #2029 contract; the 39th is
  * `agent_conflict_detected` (previously emitted through a force-cast past the
  * type system), the 40th is `close_archive_result` (issue #2030 — the
@@ -32,7 +32,8 @@
  * `context_source_attribution` and the 61st is `verdict_row_pipe_recovery` and the 62nd is `training_vault_health`
  * (issue #2482 — D3: honest savings attribution with the omit-when-unknown
  * rule, and the #2184 verdict-row pipe-recovery fidelity class in the event
- * lifecycle). These late
+ * lifecycle). The 63rd is `delegation_read_uncertain` (issue #2511 —
+ * bounded advisory-reader uncertainty signal). These late
  * additions are instances
  * of the defect class this contract exists to close: an event kind entering
  * the stream with no registration.
@@ -88,7 +89,7 @@ export interface CatalogEntry {
     /**
      * Whether an event of this kind must carry `trace.parentSpanId`.
      *
-     * `false` for all 62 entries today, and that is a truthful statement about
+     * `false` for all 63 entries today, and that is a truthful statement about
      * the current system rather than a placeholder: no producer supplies a
      * parent span, so `createObservation` never sets one. Setting this to `true`
      * for a kind whose producer cannot supply a parent would make every

package/dist/plan/index.d.ts

@@ -1,2 +1,3 @@
+export type { PlanSaveDurability } from './manager';
 export { derivePlanMarkdown, loadPlan, migrateLegacyPlan, savePlan, updateTaskStatus, } from './manager';
 export { derivePlanId } from './utils';

package/dist/plan/ledger.d.ts

@@ -463,6 +463,16 @@ export interface LedgerIntegrityResult {
  * Read ledger events with integrity checking.
  * Stops at the first malformed/unparseable line and returns the remainder for quarantine.
  *
+ * Residual fail-open callers (accepted, do not silently grow this list):
+ * the terminal-recovery `replayFromLedgerWithStatus` trio (`close-terminal.ts`,
+ * `task-terminal.ts`, `task-repair.ts` — see `readLedgerEventsForEpoch`'s
+ * docblock for that caller analysis) and the two loadPlan recovery identity
+ * anchors in `manager.ts` (validation-failure catch path and Step 3). In the
+ * manager.ts sites a fail-closed throw would escape the surrounding recovery
+ * catch/try as a hard loadPlan failure, so the default fail-open behavior is
+ * the accepted residual: an unreadable ledger degrades the rung
+ * (replay skipped / rung refused) — availability-only, never integrity loss.
+ *
  * @param directory - The working directory
  * @returns LedgerIntegrityResult with events, truncated flag, and bad suffix
  */

package/dist/plan/manager.d.ts

@@ -45,7 +45,7 @@ import { recordTaskAttempt } from '../services/run-memory.js';
 import { isEpicModeActiveForProject } from '../turbo/epic/state.js';
 import { commitTaskCompletion } from '../turbo/epic/task-commit.js';
 import { readTaskScopes } from '../turbo/lean/conflicts.js';
-import { type LedgerEvent, type LedgerEventInput, takeSnapshotWithRetry } from './ledger';
+import { type LedgerEvent, type LedgerEventInput, ledgerExists, loadLastApprovedPlan, readLedgerEventsWithIntegrity, replayFromLedger, takeSnapshotWithRetry } from './ledger';
 /** Reset the startup ledger check flag. For testing only. */
 export declare function resetStartupLedgerCheck(): void;
 /**
@@ -61,6 +61,11 @@ export declare const _internals: {
     loadPlanJsonOnly: typeof loadPlanJsonOnly;
     readPlanJsonUtf8: typeof readPlanJsonUtf8;
     readPlanFileUtf8: typeof readPlanFileUtf8;
+    verifyWrittenPlanJson: typeof verifyWrittenPlanJson;
+    ledgerExists: typeof ledgerExists;
+    replayFromLedger: typeof replayFromLedger;
+    loadLastApprovedPlan: typeof loadLastApprovedPlan;
+    readLedgerEventsWithIntegrity: typeof readLedgerEventsWithIntegrity;
     regeneratePlanMarkdown: typeof regeneratePlanMarkdown;
     isGitRepo: typeof isGitRepo;
     isEpicModeActiveForProject: typeof isEpicModeActiveForProject;
@@ -159,6 +164,37 @@ export declare function withPlanLifecycleLock<T>(directory: string, taskId: stri
  * Validate against PlanSchema (throw on invalid), write to .swarm/plan.json via atomic temp+rename pattern,
  * then derive and write .swarm/plan.md
  */
+/**
+ * #2531 (AC5): explicit durability outcome of a savePlan call. `complete` means
+ * every projection write was performed and the canonical plan.json projection
+ * was read-back verified; `incomplete` means an advisory surface (plan.md)
+ * failed to write — the save still succeeded for the authoritative pair
+ * (ledger + plan.json), and the failure is disclosed here and via the
+ * `plan_md_write_failed` telemetry event instead of being silently swallowed.
+ */
+export interface PlanSaveDurability {
+    durability: 'complete' | 'incomplete';
+    degraded_surfaces: string[];
+    md_write_error?: string;
+}
+/**
+ * #2531 (AC5): thrown when the freshly persisted plan.json cannot be read back
+ * or does not match the projected plan — a save that cannot verify its written
+ * state reports failure instead of claiming successful readable state.
+ */
+export declare class PlanWriteVerificationError extends Error {
+    constructor(message: string);
+}
+/**
+ * #2531 (AC5): read the freshly persisted canonical plan.json projection back
+ * and verify it parses as UTF-8 that round-trips to exactly the projected
+ * plan. Routed through the shared retry-aware reader
+ * (`readSwarmFileAsync`) so transient Windows AV/indexer locks and macOS
+ * rename-visibility races are retried before the save is declared failed.
+ * Exposed via `_internals` for fault-injecting tests (AGENTS.md invariant 7 DI
+ * convention — no mock.module).
+ */
+declare function verifyWrittenPlanJson(directory: string, expected: Plan): Promise<void>;
 export declare function savePlan(directory: string, plan: Plan, options?: {
     preserveCompletedStatuses?: boolean;
     acknowledged_removals?: AcknowledgedRemovals;
@@ -181,7 +217,7 @@ export declare function savePlan(directory: string, plan: Plan, options?: {
      * between the final check and the atomic filesystem operation.
      */
     preCommitCheck?: () => void;
-}): Promise<void>;
+}): Promise<PlanSaveDurability>;
 /**
  * Rebuild plan from ledger events.
  * Replays the ledger to reconstruct plan state, then writes the result.

package/dist/pr-review/completion.d.ts

@@ -201,6 +201,12 @@ export interface PrReviewTerminalCoverageSettlement {
     unresolvedDimensions: PrReviewUnresolvedDimensionRecord[];
     /** False while any dimension still has a live (in-flight) lane. */
     allLaunchedTerminal: boolean;
+    /**
+     * Issue #2511: present when a dispatched-set batch read stayed uncertain.
+     * Dimensions whose launch evidence is UNKNOWN are carried in
+     * `liveDimensions` (blocking settlement) — never labeled NOT_LAUNCHED.
+     */
+    delegationReadUncertain?: string;
 }
 /** Per-dimension explicit cancellation, written by armed recovery (issue #2383). */
 export interface PrReviewDimensionCancellationRecord {
@@ -291,6 +297,12 @@ export interface PrReviewBaseDimensionAttempts {
     dedicatedSuccessful: Set<string>;
     /** Dimensions whose recorded lane ran to a terminal, non-successful end. */
     terminallyFailed: Set<string>;
+    /**
+     * Issue #2511: present when a batch's delegation read stayed uncertain.
+     * The affected lanes' dimensions are carried in `inFlight` (UNKNOWN, not
+     * settled and not absent) so no consumer reads them as dispatchable.
+     */
+    delegationReadUncertain?: string;
 }
 /**
  * Per-dimension success/failure across every recorded base batch.

package/dist/telemetry.d.ts

@@ -1,7 +1,7 @@
 import type { ObservabilityEvent } from './observability/envelope.js';
 import { canonicalLineContent, createObservation, toLegacyTelemetryLine } from './observability/index.js';
 import type { DelegationCostFields } from './services/cost-accounting.js';
-export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activated' | 'delegation_begin' | 'delegation_end' | 'delegation_cost_correction' | 'delegation_cost_binding' | 'delegation_cost_join' | 'task_state_changed' | 'gate_passed' | 'gate_failed' | 'gate_parse_error' | 'reviewer_gate_decision' | 'phase_changed' | 'budget_updated' | 'context_pruned' | 'retrieval_routed' | 'model_fallback'
+export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activated' | 'delegation_begin' | 'delegation_end' | 'delegation_read_uncertain' | 'delegation_cost_correction' | 'delegation_cost_binding' | 'delegation_cost_join' | 'task_state_changed' | 'gate_passed' | 'gate_failed' | 'gate_parse_error' | 'reviewer_gate_decision' | 'phase_changed' | 'budget_updated' | 'context_pruned' | 'retrieval_routed' | 'model_fallback'
 /**
  * Issue #2271 bug 4 — a configured agent model id was POSITIVELY confirmed
  * unresolvable against the live provider catalog (distinct from a runtime
@@ -170,6 +170,16 @@ export declare const telemetry: {
     agentActivated(sessionId: string, agentName: string, oldName?: string): void;
     delegationBegin(sessionId: string, agentName: string, taskId: string): void;
     delegationEnd(sessionId: string, agentName: string, taskId: string, result: string, costFields?: Partial<DelegationCostFields>): void;
+    /**
+     * Issue #2511: bounded, content-free signal that an advisory delegation
+     * store read stayed uncertain after its one bounded retry. Payload is
+     * redaction-by-omission: no paths, no raw reason text, no session content.
+     */
+    delegationReadUncertain(event: {
+        attempt: number;
+        reasonCode: string;
+        source: string;
+    }): void;
     taskStateChanged(sessionId: string, taskId: string, newState: string, oldState?: string): void;
     gatePassed(sessionId: string, gate: string, taskId: string): void;
     gateParseError(taskId: string, error: Error): void;

package/dist/tools/dispatch-lanes.d.ts

@@ -193,7 +193,11 @@ export interface DispatchLanesAsyncResult {
 }
 export interface CollectLaneResultsResult {
     success: boolean;
-    failure_class?: 'invalid_args' | 'not_found' | 'no_client';
+    /**
+     * 'store_unreadable' (issue #2511) is distinct from 'not_found': the
+     * delegation store could not be read, so the batch is UNKNOWN, not absent.
+     */
+    failure_class?: 'invalid_args' | 'not_found' | 'no_client' | 'store_unreadable';
     message?: string;
     batch_id: string;
     total: number;

package/dist/tools/phase-complete.d.ts

@@ -64,7 +64,7 @@ export declare const phaseCompleteCommitInternals: {
             expectedLedgerHash: string;
         };
         preCommitCheck?: () => void;
-    } | undefined) => Promise<void>;
+    } | undefined) => Promise<import("../plan").PlanSaveDurability>;
 };
 /** Injectable observational gates for aggregate-preflight regression tests. */
 export declare const phaseCompletePreflightInternals: {

package/dist/tools/placeholder-scan.d.ts

@@ -101,6 +101,16 @@ declare function collectNonStubBodyLines(rootNode: any): Set<number>;
  * Scan files for placeholder content (TODO/FIXME comments, stub implementations, etc.)
  */
 export declare function placeholderScan(input: PlaceholderScanInput, directory: string, gateOverrides?: GateConfigOverrides['placeholder_scan']): Promise<PlaceholderScanResult>;
+/**
+ * Persistence-free compute core of the placeholder scan (#2499).
+ *
+ * Never persists evidence unless `persistEvidence: true` is passed, so
+ * read-only surfaces (the MCP verification server) can run the exact same
+ * analysis without writing `.swarm/` state.
+ */
+export declare function computePlaceholderScan(input: PlaceholderScanInput, directory: string, gateOverrides?: GateConfigOverrides['placeholder_scan'], options?: {
+    persistEvidence?: boolean;
+}): Promise<PlaceholderScanResult>;
 export declare const placeholder_scan: ReturnType<typeof tool>;
 /**
  * Internal seam for direct testing of the body-shape walker without

package/dist/tools/pr-workflow-status.d.ts

@@ -1,6 +1,9 @@
+import { readDelegationsDetailed } from '../background/pending-delegations';
 import { resolveCurrentGitHeadAsync, resolveIsWorkingTreeCleanAsync } from '../background/workspace-snapshot';
 import { classifyPrWorkflowGitState } from '../git/pr-workflow-state';
+import { isPrWorkflowAutoWakeSuppressed } from '../hooks/pr-workflow-auto-wake';
 import { readPrWorkflowGateStateForRecovery } from '../hooks/pr-workflow-gate';
+import { resolvePrWorkflowControllerSession } from '../hooks/pr-workflow-session-resolver';
 import { createSwarmTool } from './create-tool';
 /**
  * Truncate to an exact UTF-8 byte budget. `String.prototype.length`/`.slice`
@@ -22,6 +25,9 @@ export declare const pr_workflow_status: ReturnType<typeof createSwarmTool>;
 /** Test seam mirroring gh-evidence's `_internals` (issue #507 DI convention). */
 export declare const _internals: {
     readPrWorkflowGateStateForRecovery: typeof readPrWorkflowGateStateForRecovery;
+    readDelegationsDetailed: typeof readDelegationsDetailed;
+    isPrWorkflowAutoWakeSuppressed: typeof isPrWorkflowAutoWakeSuppressed;
+    resolvePrWorkflowControllerSession: typeof resolvePrWorkflowControllerSession;
     resolveCurrentGitHeadAsync: typeof resolveCurrentGitHeadAsync;
     resolveIsWorkingTreeCleanAsync: typeof resolveIsWorkingTreeCleanAsync;
     runGitCapture: typeof runGitCapture;

package/dist/tools/quality-budget.d.ts

@@ -24,6 +24,16 @@ export interface QualityBudgetResult {
  * and compares against configured thresholds to ensure code quality.
  */
 export declare function qualityBudget(input: QualityBudgetInput, directory: string, abortSignal?: AbortSignal): Promise<QualityBudgetResult>;
+/**
+ * Persistence-free compute core of the quality budget check (#2499).
+ *
+ * Never persists evidence unless `persistEvidence: true` is passed, so
+ * read-only surfaces (the MCP verification server) can run the exact same
+ * analysis without writing `.swarm/` state.
+ */
+export declare function computeQualityBudget(input: QualityBudgetInput, directory: string, abortSignal?: AbortSignal, options?: {
+    persistEvidence?: boolean;
+}): Promise<QualityBudgetResult>;
 export declare const quality_budget: ReturnType<typeof tool>;
 /**
  * DI seam for testability. Contains all test-mocked exports.

package/dist/tools/repo-map.d.ts

@@ -12,6 +12,11 @@ export declare const _internals: {
         agentActivated(sessionId: string, agentName: string, oldName?: string): void;
         delegationBegin(sessionId: string, agentName: string, taskId: string): void;
         delegationEnd(sessionId: string, agentName: string, taskId: string, result: string, costFields?: Partial<import("../services/cost-accounting").DelegationCostFields>): void;
+        delegationReadUncertain(event: {
+            attempt: number;
+            reasonCode: string;
+            source: string;
+        }): void;
         taskStateChanged(sessionId: string, taskId: string, newState: string, oldState?: string): void;
         gatePassed(sessionId: string, gate: string, taskId: string): void;
         gateParseError(taskId: string, error: Error): void;

package/dist/tools/sast-scan.d.ts

@@ -129,6 +129,17 @@ export interface SastScanFinding {
  * - Tier B: Semgrep (optional, if available on PATH)
  */
 export declare function sastScan(input: SastScanInput, directory: string, gates?: GateConfigOverrides): Promise<SastScanResult>;
+/**
+ * Persistence-free compute core of the SAST scan (#2499).
+ *
+ * Never persists evidence unless `persistEvidence: true` is passed, so
+ * read-only surfaces (the MCP verification server) can run the exact same
+ * analysis without writing `.swarm/` state. The MCP adapter also forces
+ * `offline_only: true` so no Semgrep subprocess is ever spawned.
+ */
+export declare function computeSastScan(input: SastScanInput, directory: string, gates?: GateConfigOverrides, options?: {
+    persistEvidence?: boolean;
+}): Promise<SastScanResult>;
 /**
  * SAST Scan tool - Static Application Security Testing
  * Scans changed files for security vulnerabilities using:

package/dist/tools/swarm-memory-recall.d.ts

@@ -3,6 +3,18 @@ import { createMemoryGateway } from '../memory';
 import { getAgentSession } from '../state';
 import { createSwarmTool } from './create-tool';
 export declare const swarm_memory_recall: ReturnType<typeof createSwarmTool>;
+/**
+ * Compute core for `swarm_memory_recall` (#2499). The registered tool wraps
+ * this with default options so its behavior is byte-identical; the read-only
+ * MCP surface calls it with `{recordUsage: false}` so a query performs the
+ * identical retrieval without the recall-usage telemetry write.
+ */
+export declare function computeSwarmMemoryRecall(args: unknown, directory: string, ctx: {
+    sessionID?: string;
+    agent?: unknown;
+} | undefined, options?: {
+    recordUsage?: boolean;
+}): Promise<string>;
 export declare const _internals: {
     loadPluginConfigWithMeta: typeof loadPluginConfigWithMeta;
     createMemoryGateway: typeof createMemoryGateway;

package/dist/tools/syntax-check.d.ts

@@ -39,7 +39,18 @@ export interface SyntaxCheckResult {
 /**
  * Run syntax check on changed files
  *
- * Respects gates.syntax_check.enabled - returns skipped if disabled
+ * Respects gates.syntax_check.enabled - returns skipped if disabled.
+ * Persists evidence (the registered tool's contract).
  */
 export declare function syntaxCheck(input: SyntaxCheckInput, directory: string, gates?: GateConfigOverrides): Promise<SyntaxCheckResult>;
+/**
+ * Persistence-free compute core of the syntax check (#2499).
+ *
+ * Never persists evidence unless `persistEvidence: true` is passed, so
+ * read-only surfaces (the MCP verification server) can run the exact same
+ * analysis without writing `.swarm/` state.
+ */
+export declare function computeSyntaxCheck(input: SyntaxCheckInput, directory: string, gates?: GateConfigOverrides, options?: {
+    persistEvidence?: boolean;
+}): Promise<SyntaxCheckResult>;
 export declare const syntax_check: ReturnType<typeof tool>;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.171.2",
+	"version": "7.172.1",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -137,6 +137,7 @@
 		"check:retrieval-quality": "bun run scripts/retrieval-quality-regression.ts"
 	},
 	"dependencies": {
+		"@modelcontextprotocol/sdk": "^1.30.0",
 		"@opencode-ai/plugin": "^1.18.3",
 		"@opencode-ai/sdk": "^1.18.3",
 		"@vscode/tree-sitter-wasm": "^0.3.0",

package/dist/cli/curator-llm-factory-nshzhgs4.js

@@ -1,72 +0,0 @@
-// @bun
-import {
-  createCuratorLLMDelegate
-} from "./index-f1rj1j8t.js";
-import"./index-5400m33a.js";
-import"./index-er6sk4e6.js";
-import"./index-dsgc303n.js";
-import"./index-kb66he4e.js";
-import"./index-qdy4a48x.js";
-import"./index-vqb65csb.js";
-import"./index-3jcp3zb6.js";
-import"./index-txdagbh7.js";
-import"./index-9br68j86.js";
-import"./index-cw912re7.js";
-import"./index-d79q2f8z.js";
-import"./index-0yffa3np.js";
-import"./index-04ph4jp2.js";
-import"./index-fyfbpz4f.js";
-import"./index-7qqwx64h.js";
-import"./index-0hgmsyfp.js";
-import"./index-zsrtt42s.js";
-import"./index-gq2zdxep.js";
-import"./index-fhh02gwx.js";
-import"./index-nyn01yrz.js";
-import"./index-b43rt5ph.js";
-import"./index-q7sjgr1y.js";
-import"./index-rrc08h4q.js";
-import"./index-mazy938h.js";
-import"./index-qcy7eg6z.js";
-import"./index-9txyxbqc.js";
-import"./index-b3pmzbh1.js";
-import"./index-2s7dvzff.js";
-import"./index-wfh89qct.js";
-import"./index-0caqxnby.js";
-import"./index-rtry5xyf.js";
-import"./index-e7yv4xw1.js";
-import"./index-3qf1vxtb.js";
-import"./index-n832052r.js";
-import"./index-j6rq132j.js";
-import"./index-2ryy0cwt.js";
-import"./index-6k5aq7b9.js";
-import"./index-aa2eyfvr.js";
-import"./index-g6nen3gt.js";
-import"./index-yqbnsmmv.js";
-import"./index-rdm3px0g.js";
-import"./index-ry16d01s.js";
-import"./index-nfs78aqj.js";
-import"./index-r60cw2jt.js";
-import"./index-vzm6zre7.js";
-import"./index-ae75rja9.js";
-import"./index-95e3a9en.js";
-import"./index-evxd1art.js";
-import"./index-7g4c7s5r.js";
-import"./index-9dz2ee2g.js";
-import"./index-nbdmdyke.js";
-import"./index-1xnse449.js";
-import"./index-ee6ydtfe.js";
-import"./index-5a8q4qr5.js";
-import"./index-0mhftbpp.js";
-import"./index-a1w58b47.js";
-import"./index-q2yk70rs.js";
-import"./index-sxt7fgcw.js";
-import"./index-bk5tah7q.js";
-import"./index-bpmtbmy9.js";
-import"./index-zpsr8rpc.js";
-import"./index-76qm2c2y.js";
-import"./index-yzjaj53h.js";
-import"./index-zgwm4ryv.js";
-import"./index-a76rekgs.js";
-export {
-  createCuratorLLMDelegate
-};