opencode-swarm 7.184.16 → 7.185.0

package/dist/cli/{worktree-isolation-9x2vs2ym.js → worktree-isolation-52529c62.js}

@@ -21,63 +21,63 @@ import {
   sanitizeWorktreeTaskId,
   standardWorktreeByCallID,
   standardWorktreeSerializationSessions
-} from "./index-2fc9ecr0.js";
-import"./index-df845cwk.js";
-import"./index-fzen7z3b.js";
-import"./index-tzrbeas0.js";
+} from "./index-zkm995wa.js";
+import"./index-gxjy9y0t.js";
+import"./index-vfr3z9rv.js";
+import"./index-tmd5j8kh.js";
 import"./index-7bxssqaf.js";
-import"./index-mfqge140.js";
-import"./index-jtg0zsnx.js";
+import"./index-sz755xt1.js";
+import"./index-62z1vsvf.js";
 import"./index-txdagbh7.js";
-import"./index-6h55yp6c.js";
+import"./index-erv39311.js";
 import"./index-rdec0y3z.js";
-import"./index-6drqsy4n.js";
-import"./index-gvnsfcj0.js";
-import"./index-8y9aq9f6.js";
-import"./index-a9cajj7y.js";
-import"./index-m1pqenq9.js";
-import"./index-tyzmjw2s.js";
+import"./index-n0wyd905.js";
+import"./index-2tv5zp9x.js";
+import"./index-359w27b1.js";
+import"./index-cah5ffkh.js";
+import"./index-3fnpjy4g.js";
+import"./index-qqjqpmhj.js";
 import"./index-cjapb4hy.js";
-import"./index-yydv4jfy.js";
+import"./index-yg15df3b.js";
 import"./index-pt7h91zc.js";
 import"./index-q7sjgr1y.js";
-import"./index-r2nr4qxg.js";
-import"./index-8pmx61z1.js";
+import"./index-rcx4kb02.js";
+import"./index-6wy9m25t.js";
 import"./index-6b295cas.js";
 import"./index-9nyqt3kb.js";
-import"./index-9grg5gr3.js";
+import"./index-s0c1wxtt.js";
 import"./index-zsrtt42s.js";
-import"./index-rmr36a5k.js";
-import"./index-jns2mnbz.js";
-import"./index-v2v8gdvy.js";
+import"./index-fmxty2h3.js";
+import"./index-qccnny3g.js";
+import"./index-zxm9h19f.js";
 import"./index-g4fs6z4e.js";
-import"./index-6dgghy8n.js";
-import"./index-g4d1d91p.js";
-import"./index-dftztz4y.js";
+import"./index-2e7h9yw5.js";
+import"./index-rp0pyywc.js";
+import"./index-t9jr6zc7.js";
 import"./index-2s7dvzff.js";
-import"./index-v9ynrcst.js";
-import"./index-fxf3zhtq.js";
+import"./index-4ysdy8sx.js";
+import"./index-97nbaxye.js";
 import"./index-rtry5xyf.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-mdkydrnr.js";
+} from "./index-v5k5jw0r.js";
 import"./index-frcemc0b.js";
 import"./index-0725jpp7.js";
-import"./index-8gxb2xxe.js";
-import"./index-rnqfz57d.js";
-import"./index-7rzgdcvc.js";
-import"./index-7r3pkgma.js";
-import"./index-cftva3pa.js";
-import"./index-pwcbtbhd.js";
+import"./index-m7g4dsr4.js";
+import"./index-hx9vyvx0.js";
+import"./index-gemq38en.js";
+import"./index-1zpgtnhp.js";
+import"./index-7jqnckzg.js";
+import"./index-s5xmvt3k.js";
 import"./index-ry16d01s.js";
 import"./index-rdm3px0g.js";
 import"./index-7pmbnjvj.js";
-import"./index-yx5z4200.js";
-import"./index-n5z3d8nc.js";
+import"./index-p544ppcp.js";
+import"./index-9am1ry6w.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
-import"./index-4g4sr4ah.js";
-import"./index-2y9b45jj.js";
+import"./index-zyz0xp2b.js";
+import"./index-h5f5q60s.js";
 import"./index-6cjpmvpa.js";
 import"./index-t7hmqgjy.js";
 import"./index-w6w6ny06.js";
@@ -85,11 +85,11 @@ import"./index-mc72pk74.js";
 import"./index-c1ggtmpm.js";
 import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
-import"./index-bntwj2tp.js";
+import"./index-580t912d.js";
 import"./index-gx2vp8gx.js";
-import"./index-ctd0xa67.js";
+import"./index-djen6c7q.js";
 import"./index-zxdawwc7.js";
-import"./index-b3q241ze.js";
+import"./index-w7sftxdy.js";
 import"./index-48jvqqfa.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";

package/dist/commands/_shared/url-security.d.ts

@@ -1,4 +1,7 @@
 import * as child_process from 'node:child_process';
+import { type ForgeContext } from '../../providers/forge-provider.js';
+import { containsControlCharacters, isIPv4ZeroNetwork, isIpv4MappedPrivateHost, isPrivateHost } from '../../providers/host-guards.js';
+export { containsControlCharacters, isIPv4ZeroNetwork, isIpv4MappedPrivateHost, isPrivateHost, };
 export declare const MAX_URL_LEN = 2048;
 export type ValidationResult = {
     sanitized: string;
@@ -28,16 +31,20 @@ export declare function sanitizeUrl(raw: string): string;
  * Strip control characters from user-visible error echoes and bound the result.
  */
 export declare function sanitizeErrorEcho(raw: string, maxLength?: number): string;
-export declare function containsControlCharacters(value: string): boolean;
-export declare function isIpv4MappedPrivateHost(inner: string): boolean;
 /**
- * Blocklist of private/localhost hostnames and IP ranges.
+ * Validate and sanitize a forge resource URL for a specific resource kind.
+ *
+ * Provider-aware since issue #2733: accepts GitHub issue/PR URLs
+ * (`https://github.com/owner/repo/issues|pull/N`) and GitLab issue/MR URLs
+ * (`https://<gitlab-host>/owner/repo/-/issues|merge_requests/N`, where the
+ * owner may be a nested namespace path and the host is gitlab.com or any
+ * `gitlab.`-prefixed self-hosted instance). Every security control applies
+ * identically to both providers and to every origin: HTTPS-only, IDN
+ * (non-ASCII) host rejection, private/localhost host rejection, credential
+ * stripping, bounded URL length, and control-character sanitization — the
+ * shared guards in src/providers/host-guards.ts.
  */
-export declare function isPrivateHost(url: URL): boolean;
-/**
- * Validate and sanitize a GitHub URL for a specific resource kind.
- */
-export declare function validateAndSanitizeGithubUrl(rawUrl: string, resource: 'issues' | 'pull'): ValidationResult;
+export declare function validateAndSanitizeGithubUrl(rawUrl: string, resource: 'issues' | 'pull', configured?: ForgeContext): ValidationResult;
 /**
  * Detect the `origin` remote URL from git config.
  * @param cwd - Optional working directory
@@ -46,9 +53,13 @@ export declare function validateAndSanitizeGithubUrl(rawUrl: string, resource: '
 export declare function detectGitRemote(cwd?: string, laneEnv?: Record<string, string>): string | null;
 /**
  * Parse owner/repo from a git remote URL.
+ *
+ * GitHub-specific HTTPS/SSH forms plus an any-host path fallback (the
+ * fallback preserves the documented GHE/proxy bare-number resolution). For
+ * host-aware parsing that preserves the instance host and GitLab nested
+ * namespaces, use `parseForgeRemoteUrl` in src/providers/forge-provider.ts.
  */
 export declare function parseGitRemoteUrl(remoteUrl: string): {
     owner: string;
     repo: string;
 } | null;
-export declare function isIPv4ZeroNetwork(host: string): boolean;

package/dist/commands/pr-ref.d.ts

@@ -1,17 +1,27 @@
 /**
- * Shared GitHub PR-reference parsing and sanitization for the
+ * Shared forge PR-reference parsing and sanitization for the
  * `/swarm pr-review` and `/swarm pr-feedback` commands.
  *
- * Both commands accept a PR reference in three formats (full URL,
+ * Both commands accept a PR/MR reference in three formats (full URL,
  * `owner/repo#N`, or a bare PR number resolved against the `origin` remote)
  * and may be followed by free-text instructions that are forwarded to the
  * architect in the emitted `[MODE: ...]` signal. All parsing here is hardened
  * against prompt injection: rival `[MODE: ...]` headers, query strings,
  * fragments, and embedded credentials are stripped before the value is ever
  * placed back into a signal string.
+ *
+ * Provider-aware since issue #2733: GitLab merge-request URLs
+ * (`https://<gitlab-host>/owner/repo/-/merge_requests/N`, owner may be a
+ * nested namespace path) resolve through the same three formats, and the
+ * canonical URL is rebuilt with the matched provider's shape via
+ * `src/providers/forge-provider.ts`. GitHub behavior is byte-identical to the
+ * pre-provider implementation, including the any-host path fallback used for
+ * GHE/proxy bare-number resolution.
  */
+import { type ForgeContext } from '../providers/forge-provider.js';
 import { _internals, detectGitRemote, parseGitRemoteUrl, sanitizeUrl, type ValidationResult } from './_shared/url-security.js';
 export { _internals, detectGitRemote, parseGitRemoteUrl, sanitizeUrl };
+export type { ValidationResult };
 /**
  * Sanitize free-text instructions so they cannot forge a competing MODE
  * header, inject control sequences, or break out of the signal line.
@@ -19,17 +29,31 @@ export { _internals, detectGitRemote, parseGitRemoteUrl, sanitizeUrl };
  * headers, and truncates to a bounded length.
  */
 export declare function sanitizeInstructions(raw: string): string;
-export declare function validateAndSanitizeUrl(rawUrl: string): ValidationResult;
+export declare function validateAndSanitizeUrl(rawUrl: string, configured?: ForgeContext): ValidationResult;
 export interface ParsedPr {
     owner: string;
     repo: string;
     number: number;
 }
+/** Parsed PR plus the provider context the reference resolved to. */
+export interface ResolvedPrRef extends ParsedPr {
+    context: ForgeContext;
+}
 /**
- * Parse a PR reference from three formats:
- * 1. Full URL: https://github.com/owner/repo/pull/N
- * 2. Shorthand: owner/repo#N
- * 3. Bare number: N (resolved against the `origin` git remote in `cwd`)
+ * Resolve a PR/MR reference from three formats, preserving the provider
+ * context needed to rebuild the canonical URL:
+ * 1. Full URL: https://github.com/owner/repo/pull/N or
+ *    https://<gitlab-host>/owner/repo/-/merge_requests/N
+ * 2. Shorthand: owner/repo#N (GitHub-shaped; namespace shorthands are
+ *    ambiguous without a configured provider, so they stay GitHub)
+ * 3. Bare number: N (resolved against the `origin` git remote in `cwd`,
+ *    provider-aware when the remote is GitLab-indicating)
+ */
+export declare function resolvePrRef(input: string, cwd?: string): ResolvedPrRef | null;
+/**
+ * Parse a PR reference from three formats (see `resolvePrRef`). Public API
+ * unchanged since the pre-provider implementation: returns owner/repo/number
+ * only — the GitLab owner may be a multi-segment namespace path.
  */
 export declare function parsePrRef(input: string, cwd?: string): ParsedPr | null;
 /**
@@ -42,9 +66,21 @@ export declare function parsePrRef(input: string, cwd?: string): ParsedPr | null
  * instructions" (forward them).
  */
 export declare function looksLikePrRef(token: string): boolean;
+/**
+ * Resolve a PR reference to its canonical URL plus parsed fields — the
+ * provider-aware construction shared by subscribe/unsubscribe and the review
+ * commands. GitHub output is byte-identical to the previous hardcoded
+ * `https://github.com/...` template.
+ */
+export declare function resolveCanonicalPrUrl(input: string, cwd?: string): {
+    prUrl: string;
+    owner: string;
+    repo: string;
+    number: number;
+} | null;
 /**
  * Resolve the leading token of a PR command's positional args into a validated
- * GitHub PR URL, and collect any trailing tokens as free-text instructions.
+ * forge PR URL, and collect any trailing tokens as free-text instructions.
  *
  * `rest` is the positional token list AFTER flag parsing (e.g. `--council`
  * already removed). The first token is the PR reference; everything after it

package/dist/commands/pr-subscribe.d.ts

@@ -20,14 +20,6 @@
  */
 import { subscribe } from '../background/pr-subscriptions.js';
 import { loadPluginConfig } from '../config/loader.js';
-/**
- * Subscribe the current session to PR monitoring notifications.
- *
- * Requires a PR reference argument (no bare invocation). The subscription is
- * idempotent — if an active subscription with the same composite key
- * (`sessionID::repoFullName::prNumber`) already exists, the existing record
- * is returned without duplication.
- */
 export declare function handlePrSubscribeCommand(directory: string, args: string[], sessionID: string): Promise<string>;
 export declare const _internals: {
     loadPluginConfig: typeof loadPluginConfig;

package/dist/commands/pr-unsubscribe.d.ts

@@ -15,7 +15,7 @@
  * and /swarm pr subscribe via ./pr-ref.ts.
  */
 import { buildCorrelationId, unsubscribe } from '../background/pr-subscriptions.js';
-import { looksLikePrRef, parsePrRef } from './pr-ref.js';
+import { looksLikePrRef, parsePrRef, resolveCanonicalPrUrl } from './pr-ref.js';
 /**
  * Unsubscribe the current session from PR monitoring notifications.
  *
@@ -28,5 +28,6 @@ export declare const _internals: {
     unsubscribe: typeof unsubscribe;
     buildCorrelationId: typeof buildCorrelationId;
     parsePrRef: typeof parsePrRef;
+    resolveCanonicalPrUrl: typeof resolveCanonicalPrUrl;
     looksLikePrRef: typeof looksLikePrRef;
 };

package/dist/config/schema.d.ts

@@ -949,6 +949,15 @@ export declare const ObservabilityConfigSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type ObservabilityConfig = z.infer<typeof ObservabilityConfigSchema>;
+export declare const ForgeConfigSchema: z.ZodObject<{
+    provider: z.ZodDefault<z.ZodEnum<{
+        auto: "auto";
+        github: "github";
+        gitlab: "gitlab";
+    }>>;
+    base_url: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ForgeConfig = z.infer<typeof ForgeConfigSchema>;
 export declare const MemoryConfigSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     provider: z.ZodDefault<z.ZodEnum<{
@@ -2691,6 +2700,14 @@ export declare const PluginConfigSchema: z.ZodObject<{
             latencyBudgetMs: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    forge: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodEnum<{
+            auto: "auto";
+            github: "github";
+            gitlab: "gitlab";
+        }>>;
+        base_url: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
     observability: z.ZodOptional<z.ZodObject<{
         export: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;

package/dist/config/skill-contract-digest.d.ts

@@ -0,0 +1,20 @@
+export declare const SKILL_CONTRACT_DIGEST_KEY = "swarm-contract-digest";
+/**
+ * Split a SKILL.md into its frontmatter block (fences included) and body.
+ * A file without a well-formed opening/closing fence pair has no frontmatter.
+ */
+export declare function splitSkillFrontmatter(content: string): {
+    frontmatter: string;
+    body: string;
+};
+/**
+ * 12-hex content digest of a skill BODY (frontmatter excluded, line endings
+ * normalized) — stable across platforms regardless of checkout EOL settings.
+ */
+export declare function skillContractDigest(body: string): string;
+/**
+ * Read the stamped contract digest from a frontmatter block, if present.
+ * String.match rather than RegExp.exec: the SAST callee-binding classifier
+ * (issue #2300) flags an unresolved .exec member call as exec-like.
+ */
+export declare function readSkillContractStamp(frontmatter: string): string | undefined;

package/dist/hooks/delegation-gate.d.ts

@@ -5,6 +5,7 @@
  * Uses experimental.chat.messages.transform to provide non-blocking guidance.
  */
 import type { BackgroundDelegationRecord } from '../background/pending-delegations.js';
+import { deleteStageBDispatchBindings, readStageBDispatchBindings, recordStageBDispatchBindings } from '../background/stage-b-dispatch-binding-store.js';
 import type { PluginConfig } from '../config';
 import { type Plan } from '../config/plan-schema';
 import { type QaGates } from '../db/qa-gate-profile.js';
@@ -517,6 +518,9 @@ declare function resolveEvidenceTaskId(args: Record<string, unknown> | undefined
  * that test mutations on this object propagate to the extracted module.
  */
 export declare const _internals: {
+    recordStageBDispatchBindings: typeof recordStageBDispatchBindings;
+    readStageBDispatchBindings: typeof readStageBDispatchBindings;
+    deleteStageBDispatchBindings: typeof deleteStageBDispatchBindings;
     resolveEvidenceTaskId: typeof resolveEvidenceTaskId;
     resolveDelegatedPlanTaskId: typeof resolveDelegatedPlanTaskId;
     describeCoderScopeFailure: typeof describeCoderScopeFailure;
@@ -573,5 +577,5 @@ export declare function createDelegationGateHook(config: PluginConfig, directory
     }) => Promise<void>;
     sessionEnded: (sessionID: string, includeOwnedChildren?: boolean) => void;
     backgroundCompletionClaimed: (record: BackgroundDelegationRecord) => void;
-    abortDeniedSettlementForCall: (callID: string) => Promise<void>;
+    abortDeniedSettlementForCall: (callID: string, sessionID?: string) => Promise<void>;
 };

package/dist/hooks/pr-auto-subscribe.d.ts

@@ -37,10 +37,11 @@ export declare const _internals: {
     log: typeof log;
 };
 /**
- * Extract `{ repoFullName, prNumber, prUrl }` from the first GitHub PR URL
- * in the given text, or null when none is present. The returned prUrl is
- * re-canonicalized from the captures so it always satisfies the
- * subscription store's strict URL schema.
+ * Extract `{ repoFullName, prNumber, prUrl }` from the first GitHub PR or
+ * GitLab MR URL in the given text, or null when none is present. The returned
+ * prUrl is re-canonicalized from the captures (provider-aware: github
+ * `/pull/N`, gitlab `/-/merge_requests/N` with the matched host) so it always
+ * satisfies the subscription store's URL schema.
  */
 export declare function extractPrUrl(text: string): {
     repoFullName: string;