opencode-swarm 7.172.3 → 7.173.0

package/dist/hooks/guardrails/index.d.ts

@@ -26,6 +26,8 @@ export declare const _internals: {
     allowUncorrelatedGateReceipts: boolean;
     MAX_PENDING_GATE_RECEIPTS_PER_SESSION: number;
     MAX_PENDING_GATE_RECEIPT_SESSIONS: number;
+    MAX_PENDING_GATE_ROUTES_PER_SESSION: number;
+    MAX_PENDING_GATE_ROUTE_SESSIONS: number;
     /**
      * Test/inspection seams for the no-op detector's bounded session state
      * (invariant 8). Production code does not call these; they exist so the

package/dist/hooks/guardrails/stage-a-route.d.ts

@@ -0,0 +1,45 @@
+import { appendCoreEventSync } from '../../events/core-events.js';
+/**
+ * Stage A attribution route events (issue #2664).
+ *
+ * MANDATORY lifecycle bookkeeping: every completed gate-tool call outcome is
+ * recorded as ONE bounded event in the core event store, in BOTH guardrails
+ * modes. Optional enforcement (`guardrails.enabled=false`) removes policy
+ * denials only — it never suppresses these receipts.
+ *
+ * Bounded by construction: route is a member of the closed vocabulary, IDs
+ * are sanitized and sliced, and the serialized line stays far under both the
+ * frozen 2048-byte contract bound and the store's 256 KiB maxLineBytes, so
+ * the store's typed CORE_EVENT_LINE_TOO_LARGE / CORE_EVENT_LOCKED failures
+ * are practically unreachable. The catch exists so a locked-store storm can
+ * never turn a logged route event into a thrown exception inside the
+ * lifecycle hook (plan-critic R1-F1).
+ */
+export type StageAGateRoute = 'valid_pass' | 'pre_check_failed' | 'invalid_result' | 'no_task_correlation' | 'attribution_ambiguous' | 'late_result' | 'duplicate_result';
+export declare const STAGE_A_ROUTES: readonly StageAGateRoute[];
+export declare const STAGE_A_ROUTE_EVENT_TYPE = "stage_a_gate_route";
+/** Sanitize an identifier for event emission: printable, bounded. */
+declare function boundedId(value: string | null | undefined): string | null;
+export interface StageAGateRouteEventInput {
+    route: StageAGateRoute;
+    sessionID: string;
+    callID: string;
+    /** Attributed task, or null when no single task is attributable. */
+    taskId: string | null;
+    guardrailsEnabled: boolean;
+}
+declare function buildEvent(input: StageAGateRouteEventInput): Record<string, unknown>;
+/**
+ * Record one Stage A route event. Fail-open for the hook: append failures
+ * (typed CORE_EVENT_LOCKED / CORE_EVENT_LINE_TOO_LARGE) are logged warn-only
+ * and never propagate into the lifecycle path. The exactly-one-event
+ * contract holds under a healthy store; the warn line is the disclosure for
+ * the exceptional window.
+ */
+export declare function recordStageAGateRoute(directory: string, input: StageAGateRouteEventInput): void;
+export declare const _internals: {
+    buildEvent: typeof buildEvent;
+    boundedId: typeof boundedId;
+    append: typeof appendCoreEventSync;
+};
+export {};

package/dist/hooks/guardrails/tool-before.d.ts

@@ -50,6 +50,16 @@ export interface ToolBeforeContext {
     }) => void;
     /** Snapshot an exact authorized write for success-only lease renewal. */
     rememberScopeLeaseCandidate?: (input: ScopeLeaseCandidateInput) => void;
+    /**
+     * Issue #2664: whether OPTIONAL policy enforcement is active. When false
+     * (guardrails.enabled=false), every policy denial below is skipped while
+     * all mandatory lifecycle bookkeeping (gate correlation in the wrapper,
+     * lease candidates, modified-file/reviewer-scope tracking) keeps running.
+     * Defaults to true — direct unit callers are unchanged. Structural
+     * fail-closed bounds (the 1 MiB patch-payload guard) stay active in both
+     * modes.
+     */
+    enforcePolicy?: boolean;
 }
 /** @internal test seam */
 export declare function _resetSandboxUnavailableWarningState(): void;