opencode-swarm 7.181.0 → 7.181.2

package/dist/session/restart-reconciliation.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Owner-named restart reconciliation (issue #2668).
+ *
+ * At the rehydrate boundary, ephemeral execution authority expires by design
+ * (`delegationActive` and friends are reset in
+ * `TRANSIENT_SESSION_FIELDS`) — but the expiry must not be silent. When a
+ * serialized session arrives with in-flight authority, the boundary records a
+ * bounded, owner-named reconciliation outcome so an operator (and the
+ * resumed session) can tell "interrupted mid-execution, outcome UNKNOWN"
+ * from "was idle": absence must never read as success.
+ *
+ * Two surfaces, written together inside the rehydrate populate loop (after
+ * the transient reset, before the caller proceeds to the projection write):
+ *
+ * 1. The durable artifact `.swarm/session/restart-reconciliation.json` — a
+ *    bounded list (cap {@link MAX_RESTART_RECONCILIATION_ENTRIES}, FIFO
+ *    overflow) deduped by `(sessionId, taskId)` so a repeated restart
+ *    refreshes the entry instead of duplicating it.
+ * 2. A one-shot advisory string pushed into the rehydrated session's
+ *    `pendingAdvisoryMessages` (per-restart; the next rehydrate re-derives
+ *    it).
+ *
+ * The record deliberately COMPOSES the shipped recovery surfaces instead of
+ * duplicating them: guidance points operators at `/swarm recover` (stale
+ * coder-settlement WALs) and `/swarm status` (uncertain provider effects),
+ * and the #2665 `stale`/`ambiguous`/`live_wedge` classification for
+ * coder settlements remains owned by those stores.
+ */
+/** Relative to the project root's `.swarm/` directory. */
+export declare const RESTART_RECONCILIATION_FILE = "session/restart-reconciliation.json";
+export declare const MAX_RESTART_RECONCILIATION_ENTRIES = 50;
+export type RestartReconciliationClassification = 'interrupted';
+export interface RestartReconciliationEntry {
+    sessionId: string;
+    agentName: string;
+    /** The task the interrupted execution was driving ('(unknown)' when the snapshot carried none). */
+    taskId: string;
+    classification: RestartReconciliationClassification;
+    observedAt: string;
+    guidance: string;
+}
+export interface RestartReconciliationFile {
+    version: 1;
+    entries: RestartReconciliationEntry[];
+}
+export declare const RESTART_RECONCILIATION_GUIDANCE = "outcome UNKNOWN \u2014 do not assume success; inspect /swarm status for uncertain provider effects; /swarm recover settles stale coder-settlement WALs; a human must resolve external effects (pushed commits, published PRs) manually";
+/**
+ * Read the reconciliation artifact fail-closed: absent, corrupt, partial, or
+ * oversized files read as an empty list — the boundary then re-records what
+ * it observes and the artifact heals on the next append.
+ */
+export declare function readRestartReconciliation(directory: string): RestartReconciliationFile;
+/**
+ * Append (or refresh, keyed by `(sessionId, taskId)`) a reconciliation entry
+ * and persist the bounded list atomically. Fail-open: a write error is
+ * logged and swallowed — the reconciliation record must never fail the
+ * rehydrate that produces it.
+ */
+export declare function recordInterruptedExecution(directory: string, entry: {
+    sessionId: string;
+    agentName: string;
+    taskId: string;
+    observedAt?: string;
+    guidance?: string;
+}): Promise<RestartReconciliationEntry>;
+/**
+ * The one-shot session advisory naming the owner of the interrupted effect.
+ * Pushed into `pendingAdvisoryMessages` AFTER the transient-field reset so
+ * it survives the rehydrate that produced it.
+ */
+export declare function buildInterruptedAdvisoryDedupeKey(entry: Pick<RestartReconciliationEntry, 'sessionId' | 'taskId'>): string;
+export declare function buildInterruptedAdvisoryMessage(entry: Pick<RestartReconciliationEntry, 'sessionId' | 'agentName' | 'taskId'> & {
+    guidance?: string;
+}): string;

package/dist/state.d.ts

@@ -417,9 +417,12 @@ export interface AgentSessionState {
     autoProceedNudgeDone?: boolean;
     /** Session-level QA gate overrides layered on top of the spec-level profile.
      *  Overrides can only enable gates (true); false values are ignored by
-     *  getEffectiveGates. Cleared on session reset. Optional for backwards
-     *  compatibility with pre-existing session state fixtures; consumers
-     *  should read via `session.qaGateSessionOverrides ?? {}`. */
+     *  getEffectiveGates. Durable runtime policy (#2668): the authoritative copy
+     *  lives in the project DB (qa_gate_session_override), written durable-first
+     *  by `/swarm qa-gates override`, restored by rehydrateState, and deleted in
+     *  lockstep with the session (end/stale-eviction/reset). Optional for
+     *  backwards compatibility with pre-existing session state fixtures;
+     *  consumers should read via `session.qaGateSessionOverrides ?? {}`. */
     qaGateSessionOverrides?: Partial<QaGates>;
     /** Session-scoped Full Auto flag for autonomous multi-agent oversight */
     fullAutoMode: boolean;

package/dist/tools/get-qa-gate-profile.d.ts

@@ -3,12 +3,15 @@
  *
  * Read-only: uses plan.json identity when available or an explicit exact
  * swarm/title pair before plan creation, then looks up the profile in the
- * per-project DB. Returns the spec-level profile gates, lock state, and profile
- * hash. Callers layering session overrides should combine with
- * `getEffectiveGates` themselves — this tool intentionally returns the
- * persisted/locked spec-level view.
+ * per-project DB. Returns the spec-level profile gates, lock state, and
+ * profile hash, plus — when the caller carries a session context (#2668) —
+ * the session's ratchet-tighter overrides and the EFFECTIVE gates (profile
+ * merged with those overrides) so an agent can inspect the effective
+ * runtime policy after a restart. The live session's override cache is
+ * authoritative when present; the durable `qa_gate_session_override` row is
+ * the restart authority consulted when the live session is absent.
  */
-import type { tool } from '@opencode-ai/plugin';
+import type { ToolContext, tool } from '@opencode-ai/plugin';
 import { type QaGatePlanIdentityArgs } from './qa-gate-plan-identity.js';
 export type GetQaGateProfileArgs = QaGatePlanIdentityArgs;
 interface GetQaGateProfileResult {
@@ -25,7 +28,11 @@ interface GetQaGateProfileResult {
         created_at: string;
         profile_hash: string;
     };
+    /** Calling session's ratchet-tighter overrides (empty when no session context or none set). */
+    session_overrides?: Record<string, boolean>;
+    /** Effective gates: profile merged with the calling session's overrides (#2668). */
+    effective_gates?: Record<string, boolean>;
 }
-export declare function executeGetQaGateProfile(args: GetQaGateProfileArgs, directory: string): Promise<GetQaGateProfileResult>;
+export declare function executeGetQaGateProfile(args: GetQaGateProfileArgs, directory: string, ctx?: ToolContext): Promise<GetQaGateProfileResult>;
 export declare const get_qa_gate_profile: ReturnType<typeof tool>;
 export {};

package/dist/tools/index.d.ts

@@ -123,6 +123,7 @@ export { executeRecordImplementationReview, record_implementation_review, } from
 export { executeRecordIssuePublication, record_issue_publication, } from './record-issue-publication';
 export { executeRecordIssueReproduction, record_issue_reproduction, } from './record-issue-reproduction';
 export { executeRecordRecurrenceSweep, record_recurrence_sweep, } from './record-recurrence-sweep';
+export { executeRecoverReworkTask, recover_rework_task, } from './recover-rework-task';
 export { executeRunPrFeedbackStageA, run_pr_feedback_stage_a, } from './run-pr-feedback-stage-a';
 export { symbols } from './symbols';
 export { type SyntaxCheckFileResult, type SyntaxCheckInput, type SyntaxCheckResult, syntax_check, syntaxCheck, } from './syntax-check';

package/dist/tools/manifest.d.ts

@@ -48,6 +48,7 @@ export declare const TOOL_MANIFEST: {
     submit_pr_review_result: () => ToolDefinition;
     approve_plan_critic: () => ToolDefinition;
     approve_retry_sounding_board: () => ToolDefinition;
+    recover_rework_task: () => ToolDefinition;
     prepare_pr_workflow_checkout: () => ToolDefinition;
     record_implementation_review: () => ToolDefinition;
     record_issue_publication: () => ToolDefinition;

package/dist/tools/recover-rework-task.d.ts

@@ -0,0 +1,5 @@
+import { createSwarmTool } from './create-tool.js';
+export declare function executeRecoverReworkTask(args: unknown, directory: string, context?: {
+    sessionID?: string;
+}): Promise<string>;
+export declare const recover_rework_task: ReturnType<typeof createSwarmTool>;

package/dist/tools/tool-metadata.d.ts

@@ -177,6 +177,10 @@ export declare const TOOL_METADATA: {
         description: string;
         agents: "architect"[];
     };
+    recover_rework_task: {
+        description: string;
+        agents: "architect"[];
+    };
     prepare_pr_workflow_checkout: {
         description: string;
         agents: "architect"[];

package/dist/workflow/rework-recovery.d.ts

@@ -0,0 +1,38 @@
+export interface ReworkRecoverySummary {
+    taskId: string;
+    generation: number;
+    state: string;
+    transitionId: string;
+    recordedAt: string;
+    /**
+     * Whether the stage_a_repair audit event actually landed in
+     * `.swarm/events.jsonl`. The durable transition is authoritative regardless;
+     * this surfaces the best-effort append honestly instead of asserting an
+     * audit record that may not exist (issue #2755 review, FB-001).
+     */
+    auditEventRecorded: boolean;
+}
+/**
+ * Architect-supervised recovery from `rework_required` (issue #2755).
+ *
+ * The mechanical `stage_a_passed` transition deliberately fails closed from
+ * `rework_required` (`TASK_WORKFLOW_CODER_MUTATION_REQUIRED`): a genuine code
+ * defect must go back through the coder. But a Stage B verdict that failed
+ * WITHOUT a code defect (e.g. a tool-argument mistake scored as a verdict —
+ * sibling issue #2756) strands a task whose code is correct, reviewed, and
+ * green on Stage A checks, with no agent-legal exit; the only other remedy
+ * ever offered is the human-only `/swarm recover`, whose repair leg skips
+ * this state entirely.
+ *
+ * This is the audited escape hatch the #2703 precedent
+ * (`approve_retry_sounding_board`) established for exactly this class: it
+ * writes the SAME durable transition the mechanical path would have written,
+ * admitted ONLY by the `supervisedRecovery` flag the reducer accepts from
+ * `rework_required`, and records a distinguishable `stage_a_repair` audit
+ * event (action `rework_recovered`). Every precondition fails closed; the
+ * mechanical path and the `/swarm recover` auto-scan are untouched.
+ */
+export declare function forceRecoverReworkTask(directory: string, sessionID: string, options: {
+    taskId: string;
+    reason?: string;
+}): Promise<ReworkRecoverySummary>;

package/dist/workflow/stage-a-repair.d.ts

@@ -21,12 +21,54 @@ export interface StageARepairResult {
     results: StageARepairOutcome[];
     truncated: boolean;
 }
+/**
+ * Appends a stage_a_repair lifecycle event to `.swarm/events.jsonl`.
+ * Mirrors coder-settlement's appendSettlementEvent contract: best-effort,
+ * never throws, appended through the canonical `appendCoreEventSync` seam
+ * (which owns `.swarm` creation, lock retry, and torn-tail framing — its
+ * single atomic append replaces the former EBUSY/EPERM one-retry), final
+ * failure surfaced via criticalWarn so a silently missing audit line is
+ * visible. Returns whether the audit line actually landed, so callers on
+ * supervised-write paths can surface audit honesty instead of asserting it
+ * (issue #2755 review: the recover_rework_task tool must not claim an audit
+ * record exists when the append failed).
+ */
+export declare function appendStageARepairEvent(directory: string, payload: Record<string, unknown>): Promise<boolean>;
 export type PreCheckGreennessResult = {
     green: true;
 } | {
     green: false;
     reason: 'no_pre_check_bundles' | 'pre_check_failed_or_stale';
 };
+/**
+ * Decides whether durable post-settlement Stage A proof exists for a wedged
+ * task. "Green" REQUIRES BOTH a secretscan evidence bundle whose latest entry
+ * is pass/approved/info with full coverage and zero findings, AND a sast_scan
+ * evidence bundle whose latest entry is pass/approved/info. Also requires
+ * every considered entry to be newer than the settlement commit when
+ * `settledAfterMs` is supplied (a scan taken before the coder's mutation
+ * proves nothing about it).
+ *
+ * Deliberately more conservative than `pre_check_batch`'s own default bar in
+ * two edge cases it cannot reproduce from persisted evidence alone: (1) a
+ * degraded-but-tolerated SAST run (Semgrep process failure with zero
+ * findings) persists an ordinary `verdict: 'fail'` entry structurally
+ * indistinguishable from a genuine failure — `failure_kind` is only present
+ * on the tool's transient return value, not the persisted bundle — so this
+ * function treats it as failing rather than risk silently waving through a
+ * scan that never actually completed; (2) a project running with SAST
+ * disabled (`sast_enabled: false`) never persists a `sast_scan` bundle at
+ * all, so a wedged task from such a project cannot be auto-repaired via this
+ * path and needs manual attention. Both are intentional fail-closed
+ * trade-offs for a security-relevant repair tool, not bugs — see PR #2316
+ * review finding ST-001/UIB-004 for why an absent-SAST-is-fine policy was
+ * removed in the first place.
+ *
+ * Evidence bucket names vs. entry type tags differ for SAST: the scanner
+ * persists its bundle under bucket `sast_scan` (see `src/tools/sast-scan.ts`)
+ * with individual entries tagged `type: 'sast'`.
+ */
+export declare function hasGreenPostSettlementPreCheck(directory: string, settledAfterMs: number | null): Promise<PreCheckGreennessResult>;
 export interface StageAScanResult {
     /** One entry per enumerated task, classified in the shared #2665 vocabulary. */
     results: TaskRecoveryStatus[];

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.181.0",
+	"version": "7.181.2",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",