opencode-swarm 7.174.0 → 7.175.0

package/dist/pr-review/types.d.ts

@@ -155,6 +155,14 @@ export type PrReviewEvent = {
     semanticEnvelopeDigest: string;
     outcome: 'CLEAN' | 'FINDINGS' | 'INCOMPLETE';
     existingReceiptDigest?: string | undefined;
+    /**
+     * Provenance marker on the reducer event. Currently no consumer reads
+     * this field — the durable provenance record is the receipt-side
+     * `submittedBy` / `submittedByParentSessionId` (see
+     * `PrReviewResultReceiptSchema`). Kept for ledger parity with the
+     * receipt.
+     */
+    submittedBy?: 'workflow_parent' | undefined;
 } | {
     type: 'circuit_advance_requested';
     nowMs: number;

package/dist/tools/dispatch-lanes.d.ts

@@ -364,6 +364,7 @@ export declare const _internals: {
 };
 export declare const _test_exports: {
     validatePrReviewMicroDispatch: typeof validatePrReviewMicroDispatch;
+    resolveCollectExpectedWorkflowIdentity: typeof resolveCollectExpectedWorkflowIdentity;
     applyCommonPrompt: typeof applyCommonPrompt;
     applyExplorerFormatSuffix: typeof applyExplorerFormatSuffix;
     applyPrWorkflowPromptContract: typeof applyPrWorkflowPromptContract;
@@ -526,6 +527,34 @@ type LaneDiagnostics = Map<string, Set<string>>;
  */
 declare function assembleCollectionDiagnostics(hostTimeouts: ReadonlySet<string>, settleFailureLogs: LaneDiagnostics, collectionResourceFailures: LaneDiagnostics): string[];
 declare function addLaneDiagnostic(diagnostics: LaneDiagnostics, laneLabel: string, message: string): void;
+/**
+ * Issue #2585 live-proof defect (found by AC11 case-01 against the real host,
+ * present byte-identically on main 3ea01cbc7): the collect-time discovery
+ * validation built its `expected` WITHOUT the workflow identity triple, so
+ * `validateExactStructuredReceiptCoverage` rejected EVERY child-submitted
+ * structured receipt with `missing live workflow instance/revision/base
+ * identity` — deterministic, prompt-insensitive, unrepairable from the
+ * orchestrator — and every base dimension settled as a contract failure
+ * (NO_COVERAGE → forced INCOMPLETE). The dispatch-side record carries the
+ * instance (jobId binding) and revision (workflowGeneration); the live gate
+ * state of the dispatching parent carries the merge-base. Derive the triple
+ * from those two authoritative sources instead of leaving it undefined.
+ *
+ * Pure: exported through `_test_exports` for the regression test. Returns
+ * undefined whenever any leg is missing — callers then keep the validator's
+ * explicit missing-identity rejection (today's behavior) rather than guessing.
+ */
+/** Minimal structural slice of the PR_REVIEW gate state the identity needs. */
+interface PrReviewCollectParentStateSlice {
+    mode?: string;
+    workflowInstanceId?: string;
+    prReviewBaseSha?: string;
+}
+export declare function resolveCollectExpectedWorkflowIdentity(record: BackgroundDelegationRecord, parentState: PrReviewCollectParentStateSlice | null): {
+    workflowInstanceId: string;
+    workflowRevision: number;
+    baseSha: string;
+} | undefined;
 declare function consumePrReviewReceiptAppendFailureLog(loggedFailures: Set<string>, parentSessionId: string, correlationId: string): boolean;
 declare function startAsyncLanePrompt(args: {
     session: SessionOps;

package/dist/workflow/coder-settlement.d.ts

@@ -114,6 +114,13 @@ export interface CoderSettlementWalState {
     ownedInProcess: boolean;
     /** A different, still-alive host process owns the dispatch. Never force-releasable from here. */
     ownedByLiveForeignPid: boolean;
+    /**
+     * Generation fence the dispatch declared on its WAL (issue #2665): the
+     * workflow generation the owning transition expected to CAS against.
+     * Retained through recovery status so a stale-generation receipt is
+     * visible without re-reading the WAL bytes.
+     */
+    expectedGeneration?: number;
 }
 /**
  * Bounded inventory of durable coder-settlement WALs for diagnostics and

package/dist/workflow/recovery-invocation.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Static recovery-invocation guidance (issue #2665).
+ *
+ * One shell-correct form per supported shell for the recovery entry points,
+ * plus the category glossary and the deterministic-repair boundary text the
+ * operator runbook publishes. Everything here is a module constant: this
+ * module MUST NOT read environment variables or the host platform, or any
+ * environment signal to choose an invocation string — the contract is
+ * documented per shell, never sniffed (issue #2665 AC3: "without introducing
+ * a new heuristic path detector"; the anti-detection source scan lives in
+ * tests/unit/workflow/task-recovery-status.test.ts).
+ */
+/** The compact operator runbook that carries the full guidance. */
+export declare const RECOVERY_RUNBOOK_DOC_PATH = "docs/troubleshooting/recovery-runbook.md";
+export interface RecoveryInvocationForm {
+    /** Shell or entry surface the form is correct for. */
+    surface: 'host' | 'powershell' | 'git-bash' | 'cli';
+    /** Shell-correct invocation string (placeholders in angle brackets). */
+    invocation: string;
+    /** One-line explanation, including the known friction where relevant. */
+    note: string;
+}
+/**
+ * Shell-correct invocations for `/swarm recover <task_id>`.
+ *
+ * The Git Bash form doubles the leading slash of the `/swarm ...` message
+ * argument: MSYS path conversion rewrites a single leading-slash argument to
+ * a path under the Git install root (`C:/Program Files/Git/swarm ...`) before
+ * the host ever sees it. Setting `MSYS_NO_PATHCONV=1` for the whole
+ * invocation is NOT shell-correct because `--dir /c/...` arguments then stop
+ * converting too.
+ */
+export declare const RECOVERY_INVOCATIONS: readonly RecoveryInvocationForm[];
+/** One-line per-shell quick forms for operator-facing output surfaces. */
+export declare function renderRecoveryInvocationQuickForms(docPath?: string): string;

package/dist/workflow/stage-a-repair.d.ts

@@ -1,3 +1,4 @@
+import { type TaskRecoveryStatus } from './task-recovery-status.js';
 export type StageARepairOutcome = {
     taskId: string;
     outcome: 'repaired';
@@ -26,6 +27,22 @@ export type PreCheckGreennessResult = {
     green: false;
     reason: 'no_pre_check_bundles' | 'pre_check_failed_or_stale';
 };
+export interface StageAScanResult {
+    /** One entry per enumerated task, classified in the shared #2665 vocabulary. */
+    results: TaskRecoveryStatus[];
+    truncated: boolean;
+}
+/**
+ * Read-only wedge scan (issue #2665): classifies every enumerated task via
+ * the shared recovery vocabulary WITHOUT emitting transitions, writing
+ * evidence, or appending events. Tasks whose evidence cannot be read are
+ * skipped (their failure surfaces through the repair path's per-task error
+ * outcomes and the diagnose evidence checks). `repairAllowed` is true only
+ * for the `live_wedge` category with green post-settlement pre-check proof.
+ */
+export declare function scanWedgedStageA(directory: string, options?: {
+    taskIds?: string[];
+}): Promise<StageAScanResult>;
 /**
  * Repair path for tasks already wedged at `coder_delegated`
  * (TASK_WORKFLOW_STAGE_A_REQUIRED post-reset wedge). For each flat task

package/dist/workflow/task-recovery-status.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Task recovery status classification (issue #2665).
+ *
+ * Pure classification over facts the durable receipts already carry: the
+ * coder-settlement WAL inventory (`CoderSettlementWalState`), the per-task
+ * evidence workflow snapshot, and (for the wedge class) the Stage A scan.
+ * This module never reads the filesystem, never writes state, and never
+ * repairs anything — it is the "task/generation-specific missing explanation"
+ * that connects status and repair to the same transition receipts
+ * (`transitionId` + `generation`), per the issue's scope quote: add the
+ * explanation, not another recovery engine.
+ */
+import type { TaskEvidence, TaskWorkflowSnapshot } from '../gate-evidence.js';
+import type { CoderSettlementWalState } from './coder-settlement.js';
+export type TaskRecoveryCategory = 'healthy' | 'missing' | 'stale' | 'ambiguous' | 'corrupt' | 'live_wedge';
+export interface TaskRecoveryStatus {
+    taskId: string;
+    category: TaskRecoveryCategory;
+    /** Workflow generation from the durable evidence snapshot, when one exists. */
+    generation?: number;
+    /** Owning transition id from the settlement WAL / evidence chain tip. */
+    transitionId?: string;
+    /** Deterministic repair allowed without an operator assertion? */
+    repairAllowed: boolean;
+    /** An external (process/provider) effect may still be in flight or unresolved. */
+    uncertainExternalEffect: boolean;
+    explanation: string;
+    /** Host-command-path form; per-shell forms live in recovery-invocation.ts. */
+    suggestedNextCommand: string;
+}
+/**
+ * Classify one settlement-WAL entry against the task's workflow snapshot.
+ *
+ * Category mapping (issue #2665 AC1 vocabulary):
+ * - `unreadable` → corrupt (facts corrupt; recovery refuses, never rewrites)
+ * - owned in this process / by a live foreign pid → ambiguous (external
+ *   effect stays uncertain; never force a foreign owner)
+ * - `DISPATCHED`/`PREPARED` with a dead owner → stale (deterministic repair)
+ * - terminal → healthy
+ *
+ * When the WAL records an `expectedGeneration` that disagrees with the
+ * workflow snapshot's generation, the stale explanation names the generation
+ * conflict explicitly — the settle path's CAS already refuses stale and
+ * foreign receipts; this makes that refusal visible in status.
+ */
+export declare function classifySettlementWalState(entry: CoderSettlementWalState, workflow: TaskWorkflowSnapshot | null): TaskRecoveryStatus;
+/**
+ * Classify a task's evidence-workflow state for recovery purposes. The
+ * `live_wedge` class is the "live-shaped task wedge" of issue #2665 AC2:
+ * the workflow sits at `coder_delegated` with no pre_check gate proof —
+ * deterministically repairable by the Stage A repair (which never re-runs
+ * the coder and never edits evidence speculatively) when green
+ * post-settlement pre-check proof exists.
+ */
+export declare function classifyEvidenceRecoveryTask(taskId: string, evidence: TaskEvidence | null, greenPreCheck: boolean | null): TaskRecoveryStatus;
+/**
+ * One diagnose-detail line per non-healthy task. Healthy tasks are rendered
+ * by their COUNT only (never a per-task line) so no category token can
+ * attach to a healthy task id (plan-critic B1).
+ */
+export declare function renderTaskRecoveryLine(status: TaskRecoveryStatus): string;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.174.0",
+	"version": "7.175.0",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -111,6 +111,7 @@
 		"package:smoke": "node scripts/package-smoke.mjs",
 		"prepare": "bun run build",
 		"repro:704": "node scripts/repro-704.mjs",
+		"repro:2669": "node scripts/repro-2669.mjs",
 		"repro:1144": "bun scripts/repro-1144.mjs",
 		"repro:1873": "bun build scripts/repro-1873-entry.ts --outdir dist-build-test/repro-1873 --target node --format esm && node scripts/repro-1873.mjs",
 		"repro:2487": "bun build scripts/repro-2487-parity-entry.ts --outdir dist-build-test/repro-2487 --target node --format esm && node scripts/repro-2487-parity.mjs",