opencode-swarm 7.184.17 → 7.185.1

package/dist/cli/{worktree-isolation-bmzkxa64.js → worktree-isolation-kaxkr61t.js}

@@ -21,63 +21,63 @@ import {
   sanitizeWorktreeTaskId,
   standardWorktreeByCallID,
   standardWorktreeSerializationSessions
-} from "./index-pak3x772.js";
-import"./index-dky6qwrk.js";
-import"./index-wxr5me67.js";
-import"./index-4v60grax.js";
+} from "./index-hgfkcb1q.js";
+import"./index-ss6b8jpz.js";
+import"./index-9h93zjm3.js";
+import"./index-pa6fzbms.js";
 import"./index-7bxssqaf.js";
-import"./index-mfqge140.js";
-import"./index-jtg0zsnx.js";
+import"./index-1fc5aj26.js";
+import"./index-62akgg9d.js";
 import"./index-txdagbh7.js";
-import"./index-pef8ay7c.js";
+import"./index-smwybqka.js";
 import"./index-rdec0y3z.js";
-import"./index-ww747mdg.js";
-import"./index-naxrpyb0.js";
-import"./index-e708d35g.js";
-import"./index-y0534tfs.js";
-import"./index-m1pqenq9.js";
-import"./index-tyzmjw2s.js";
+import"./index-s7va6n84.js";
+import"./index-ek5gvpvm.js";
+import"./index-dz5cbkrm.js";
+import"./index-5n08z6qj.js";
+import"./index-s68z4a39.js";
+import"./index-cp2nerjd.js";
 import"./index-cjapb4hy.js";
-import"./index-yydv4jfy.js";
+import"./index-vqz0avr4.js";
 import"./index-pt7h91zc.js";
 import"./index-q7sjgr1y.js";
-import"./index-hx4jkj05.js";
-import"./index-gx03v1y5.js";
+import"./index-nhw5rt5x.js";
+import"./index-pppjg0ct.js";
 import"./index-6b295cas.js";
 import"./index-9nyqt3kb.js";
-import"./index-denfahc5.js";
+import"./index-2b3bgm20.js";
 import"./index-zsrtt42s.js";
-import"./index-50q314wd.js";
-import"./index-m8342y3n.js";
-import"./index-7n1pfpnj.js";
+import"./index-zt3taseq.js";
+import"./index-cnbpht7m.js";
+import"./index-2c6e1p7j.js";
 import"./index-g4fs6z4e.js";
-import"./index-cyn2cb6k.js";
-import"./index-48we80k1.js";
-import"./index-dftztz4y.js";
+import"./index-nw16apxs.js";
+import"./index-ppj5bjaq.js";
+import"./index-afmyp3kt.js";
 import"./index-2s7dvzff.js";
-import"./index-0zjg4kt5.js";
-import"./index-fxf3zhtq.js";
+import"./index-ycqsnfd1.js";
+import"./index-8nsjefpc.js";
 import"./index-rtry5xyf.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-bktc2g9n.js";
+} from "./index-7jt24hpz.js";
 import"./index-frcemc0b.js";
 import"./index-0725jpp7.js";
-import"./index-sfsydeh8.js";
-import"./index-a7y29h92.js";
-import"./index-7rzgdcvc.js";
-import"./index-7r3pkgma.js";
-import"./index-cftva3pa.js";
-import"./index-pwcbtbhd.js";
+import"./index-6wqv8f7d.js";
+import"./index-dryhmaft.js";
+import"./index-373880cv.js";
+import"./index-9g61bfj9.js";
+import"./index-nen885g8.js";
+import"./index-74yxwf8y.js";
 import"./index-ry16d01s.js";
 import"./index-rdm3px0g.js";
 import"./index-7pmbnjvj.js";
-import"./index-yx5z4200.js";
-import"./index-y8gxcmnj.js";
+import"./index-xgdypzch.js";
+import"./index-7n3h39h9.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
-import"./index-4g4sr4ah.js";
-import"./index-2y9b45jj.js";
+import"./index-zxck9sr7.js";
+import"./index-6sffjy74.js";
 import"./index-6cjpmvpa.js";
 import"./index-t7hmqgjy.js";
 import"./index-w6w6ny06.js";
@@ -85,11 +85,11 @@ import"./index-mc72pk74.js";
 import"./index-c1ggtmpm.js";
 import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
-import"./index-bntwj2tp.js";
+import"./index-yj7etak0.js";
 import"./index-gx2vp8gx.js";
-import"./index-kxacpqwf.js";
+import"./index-ekyg4p8b.js";
 import"./index-zxdawwc7.js";
-import"./index-0pvvktht.js";
+import"./index-rr1dggfe.js";
 import"./index-48jvqqfa.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";

package/dist/commands/_shared/url-security.d.ts

@@ -1,4 +1,7 @@
 import * as child_process from 'node:child_process';
+import { type ForgeContext } from '../../providers/forge-provider.js';
+import { containsControlCharacters, isIPv4ZeroNetwork, isIpv4MappedPrivateHost, isPrivateHost } from '../../providers/host-guards.js';
+export { containsControlCharacters, isIPv4ZeroNetwork, isIpv4MappedPrivateHost, isPrivateHost, };
 export declare const MAX_URL_LEN = 2048;
 export type ValidationResult = {
     sanitized: string;
@@ -28,16 +31,20 @@ export declare function sanitizeUrl(raw: string): string;
  * Strip control characters from user-visible error echoes and bound the result.
  */
 export declare function sanitizeErrorEcho(raw: string, maxLength?: number): string;
-export declare function containsControlCharacters(value: string): boolean;
-export declare function isIpv4MappedPrivateHost(inner: string): boolean;
 /**
- * Blocklist of private/localhost hostnames and IP ranges.
+ * Validate and sanitize a forge resource URL for a specific resource kind.
+ *
+ * Provider-aware since issue #2733: accepts GitHub issue/PR URLs
+ * (`https://github.com/owner/repo/issues|pull/N`) and GitLab issue/MR URLs
+ * (`https://<gitlab-host>/owner/repo/-/issues|merge_requests/N`, where the
+ * owner may be a nested namespace path and the host is gitlab.com or any
+ * `gitlab.`-prefixed self-hosted instance). Every security control applies
+ * identically to both providers and to every origin: HTTPS-only, IDN
+ * (non-ASCII) host rejection, private/localhost host rejection, credential
+ * stripping, bounded URL length, and control-character sanitization — the
+ * shared guards in src/providers/host-guards.ts.
  */
-export declare function isPrivateHost(url: URL): boolean;
-/**
- * Validate and sanitize a GitHub URL for a specific resource kind.
- */
-export declare function validateAndSanitizeGithubUrl(rawUrl: string, resource: 'issues' | 'pull'): ValidationResult;
+export declare function validateAndSanitizeGithubUrl(rawUrl: string, resource: 'issues' | 'pull', configured?: ForgeContext): ValidationResult;
 /**
  * Detect the `origin` remote URL from git config.
  * @param cwd - Optional working directory
@@ -46,9 +53,13 @@ export declare function validateAndSanitizeGithubUrl(rawUrl: string, resource: '
 export declare function detectGitRemote(cwd?: string, laneEnv?: Record<string, string>): string | null;
 /**
  * Parse owner/repo from a git remote URL.
+ *
+ * GitHub-specific HTTPS/SSH forms plus an any-host path fallback (the
+ * fallback preserves the documented GHE/proxy bare-number resolution). For
+ * host-aware parsing that preserves the instance host and GitLab nested
+ * namespaces, use `parseForgeRemoteUrl` in src/providers/forge-provider.ts.
  */
 export declare function parseGitRemoteUrl(remoteUrl: string): {
     owner: string;
     repo: string;
 } | null;
-export declare function isIPv4ZeroNetwork(host: string): boolean;

package/dist/commands/pr-ref.d.ts

@@ -1,17 +1,27 @@
 /**
- * Shared GitHub PR-reference parsing and sanitization for the
+ * Shared forge PR-reference parsing and sanitization for the
  * `/swarm pr-review` and `/swarm pr-feedback` commands.
  *
- * Both commands accept a PR reference in three formats (full URL,
+ * Both commands accept a PR/MR reference in three formats (full URL,
  * `owner/repo#N`, or a bare PR number resolved against the `origin` remote)
  * and may be followed by free-text instructions that are forwarded to the
  * architect in the emitted `[MODE: ...]` signal. All parsing here is hardened
  * against prompt injection: rival `[MODE: ...]` headers, query strings,
  * fragments, and embedded credentials are stripped before the value is ever
  * placed back into a signal string.
+ *
+ * Provider-aware since issue #2733: GitLab merge-request URLs
+ * (`https://<gitlab-host>/owner/repo/-/merge_requests/N`, owner may be a
+ * nested namespace path) resolve through the same three formats, and the
+ * canonical URL is rebuilt with the matched provider's shape via
+ * `src/providers/forge-provider.ts`. GitHub behavior is byte-identical to the
+ * pre-provider implementation, including the any-host path fallback used for
+ * GHE/proxy bare-number resolution.
  */
+import { type ForgeContext } from '../providers/forge-provider.js';
 import { _internals, detectGitRemote, parseGitRemoteUrl, sanitizeUrl, type ValidationResult } from './_shared/url-security.js';
 export { _internals, detectGitRemote, parseGitRemoteUrl, sanitizeUrl };
+export type { ValidationResult };
 /**
  * Sanitize free-text instructions so they cannot forge a competing MODE
  * header, inject control sequences, or break out of the signal line.
@@ -19,17 +29,31 @@ export { _internals, detectGitRemote, parseGitRemoteUrl, sanitizeUrl };
  * headers, and truncates to a bounded length.
  */
 export declare function sanitizeInstructions(raw: string): string;
-export declare function validateAndSanitizeUrl(rawUrl: string): ValidationResult;
+export declare function validateAndSanitizeUrl(rawUrl: string, configured?: ForgeContext): ValidationResult;
 export interface ParsedPr {
     owner: string;
     repo: string;
     number: number;
 }
+/** Parsed PR plus the provider context the reference resolved to. */
+export interface ResolvedPrRef extends ParsedPr {
+    context: ForgeContext;
+}
 /**
- * Parse a PR reference from three formats:
- * 1. Full URL: https://github.com/owner/repo/pull/N
- * 2. Shorthand: owner/repo#N
- * 3. Bare number: N (resolved against the `origin` git remote in `cwd`)
+ * Resolve a PR/MR reference from three formats, preserving the provider
+ * context needed to rebuild the canonical URL:
+ * 1. Full URL: https://github.com/owner/repo/pull/N or
+ *    https://<gitlab-host>/owner/repo/-/merge_requests/N
+ * 2. Shorthand: owner/repo#N (GitHub-shaped; namespace shorthands are
+ *    ambiguous without a configured provider, so they stay GitHub)
+ * 3. Bare number: N (resolved against the `origin` git remote in `cwd`,
+ *    provider-aware when the remote is GitLab-indicating)
+ */
+export declare function resolvePrRef(input: string, cwd?: string): ResolvedPrRef | null;
+/**
+ * Parse a PR reference from three formats (see `resolvePrRef`). Public API
+ * unchanged since the pre-provider implementation: returns owner/repo/number
+ * only — the GitLab owner may be a multi-segment namespace path.
  */
 export declare function parsePrRef(input: string, cwd?: string): ParsedPr | null;
 /**
@@ -42,9 +66,21 @@ export declare function parsePrRef(input: string, cwd?: string): ParsedPr | null
  * instructions" (forward them).
  */
 export declare function looksLikePrRef(token: string): boolean;
+/**
+ * Resolve a PR reference to its canonical URL plus parsed fields — the
+ * provider-aware construction shared by subscribe/unsubscribe and the review
+ * commands. GitHub output is byte-identical to the previous hardcoded
+ * `https://github.com/...` template.
+ */
+export declare function resolveCanonicalPrUrl(input: string, cwd?: string): {
+    prUrl: string;
+    owner: string;
+    repo: string;
+    number: number;
+} | null;
 /**
  * Resolve the leading token of a PR command's positional args into a validated
- * GitHub PR URL, and collect any trailing tokens as free-text instructions.
+ * forge PR URL, and collect any trailing tokens as free-text instructions.
  *
  * `rest` is the positional token list AFTER flag parsing (e.g. `--council`
  * already removed). The first token is the PR reference; everything after it

package/dist/commands/pr-subscribe.d.ts

@@ -20,14 +20,6 @@
  */
 import { subscribe } from '../background/pr-subscriptions.js';
 import { loadPluginConfig } from '../config/loader.js';
-/**
- * Subscribe the current session to PR monitoring notifications.
- *
- * Requires a PR reference argument (no bare invocation). The subscription is
- * idempotent — if an active subscription with the same composite key
- * (`sessionID::repoFullName::prNumber`) already exists, the existing record
- * is returned without duplication.
- */
 export declare function handlePrSubscribeCommand(directory: string, args: string[], sessionID: string): Promise<string>;
 export declare const _internals: {
     loadPluginConfig: typeof loadPluginConfig;

package/dist/commands/pr-unsubscribe.d.ts

@@ -15,7 +15,7 @@
  * and /swarm pr subscribe via ./pr-ref.ts.
  */
 import { buildCorrelationId, unsubscribe } from '../background/pr-subscriptions.js';
-import { looksLikePrRef, parsePrRef } from './pr-ref.js';
+import { looksLikePrRef, parsePrRef, resolveCanonicalPrUrl } from './pr-ref.js';
 /**
  * Unsubscribe the current session from PR monitoring notifications.
  *
@@ -28,5 +28,6 @@ export declare const _internals: {
     unsubscribe: typeof unsubscribe;
     buildCorrelationId: typeof buildCorrelationId;
     parsePrRef: typeof parsePrRef;
+    resolveCanonicalPrUrl: typeof resolveCanonicalPrUrl;
     looksLikePrRef: typeof looksLikePrRef;
 };

package/dist/config/schema.d.ts

@@ -949,6 +949,15 @@ export declare const ObservabilityConfigSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type ObservabilityConfig = z.infer<typeof ObservabilityConfigSchema>;
+export declare const ForgeConfigSchema: z.ZodObject<{
+    provider: z.ZodDefault<z.ZodEnum<{
+        auto: "auto";
+        github: "github";
+        gitlab: "gitlab";
+    }>>;
+    base_url: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ForgeConfig = z.infer<typeof ForgeConfigSchema>;
 export declare const MemoryConfigSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     provider: z.ZodDefault<z.ZodEnum<{
@@ -2691,6 +2700,14 @@ export declare const PluginConfigSchema: z.ZodObject<{
             latencyBudgetMs: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    forge: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodEnum<{
+            auto: "auto";
+            github: "github";
+            gitlab: "gitlab";
+        }>>;
+        base_url: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
     observability: z.ZodOptional<z.ZodObject<{
         export: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;

package/dist/hooks/delegation-gate.d.ts

@@ -5,6 +5,7 @@
  * Uses experimental.chat.messages.transform to provide non-blocking guidance.
  */
 import type { BackgroundDelegationRecord } from '../background/pending-delegations.js';
+import { deleteStageBDispatchBindings, readStageBDispatchBindings, recordStageBDispatchBindings } from '../background/stage-b-dispatch-binding-store.js';
 import type { PluginConfig } from '../config';
 import { type Plan } from '../config/plan-schema';
 import { type QaGates } from '../db/qa-gate-profile.js';
@@ -517,6 +518,9 @@ declare function resolveEvidenceTaskId(args: Record<string, unknown> | undefined
  * that test mutations on this object propagate to the extracted module.
  */
 export declare const _internals: {
+    recordStageBDispatchBindings: typeof recordStageBDispatchBindings;
+    readStageBDispatchBindings: typeof readStageBDispatchBindings;
+    deleteStageBDispatchBindings: typeof deleteStageBDispatchBindings;
     resolveEvidenceTaskId: typeof resolveEvidenceTaskId;
     resolveDelegatedPlanTaskId: typeof resolveDelegatedPlanTaskId;
     describeCoderScopeFailure: typeof describeCoderScopeFailure;
@@ -573,5 +577,5 @@ export declare function createDelegationGateHook(config: PluginConfig, directory
     }) => Promise<void>;
     sessionEnded: (sessionID: string, includeOwnedChildren?: boolean) => void;
     backgroundCompletionClaimed: (record: BackgroundDelegationRecord) => void;
-    abortDeniedSettlementForCall: (callID: string) => Promise<void>;
+    abortDeniedSettlementForCall: (callID: string, sessionID?: string) => Promise<void>;
 };

package/dist/hooks/extractors.d.ts

@@ -7,10 +7,17 @@ import { type Plan } from '../config/plan-schema';
  */
 /**
  * Extracts the current phase information from plan content.
+ *
+ * #2841: plan.md is user-writeable content and this one-liner feeds the
+ * `[SWARM CONTEXT] Phase:` architect-context injection, so it MUST pass the
+ * shared sanitizer (input-side, the same pattern as `extractPlanCursor`).
  */
 export declare function extractCurrentPhase(planContent: string): string | null;
 /**
  * Extracts the first incomplete task from the current IN PROGRESS phase.
+ *
+ * #2841: feeds the `[SWARM CONTEXT] Current task:` injection — sanitized
+ * input-side like its siblings.
  */
 export declare function extractCurrentTask(planContent: string): string | null;
 /**
@@ -24,14 +31,28 @@ export declare function extractCurrentTask(planContent: string): string | null;
  *   indented sub-bullets are filtered out here).
  * - Lines are reproduced verbatim from `raw` — bullet prefix, markers
  *   (✅ / [timestamps]) and all — then joined, trimmed and truncated.
+ *
+ * #2886: context.md is agent-written after consuming untrusted task/issue
+ * text and this return feeds the compaction `SWARM DECISIONS` LLM-context
+ * fact, so it MUST pass the shared sanitizer input-side (the same pattern as
+ * `extractCurrentPhase`); the system-enhancer wraps of this output become
+ * idempotent no-ops.
  */
 export declare function extractDecisions(contextContent: string, maxChars?: number): string | null;
 /**
  * Extracts incomplete tasks from plan content under the current IN PROGRESS phase.
+ *
+ * #2841: feeds the `SWARM TASKS` compaction fact (LLM-context injection) —
+ * sanitized input-side like its siblings.
  */
 export declare function extractIncompleteTasks(planContent: string, maxChars?: number): string | null;
 /**
  * Extracts patterns section from context content.
+ *
+ * #2886: context.md is agent-written after consuming untrusted task/issue
+ * text and this return feeds the compaction `SWARM PATTERNS` LLM-context
+ * fact, so it MUST pass the shared sanitizer input-side (the same pattern as
+ * `extractCurrentPhase`).
  */
 export declare function extractPatterns(contextContent: string, maxChars?: number): string | null;
 /**
@@ -44,6 +65,9 @@ export declare function extractPatterns(contextContent: string, maxChars?: numbe
 export declare function extractCurrentPhaseFromPlan(plan: Plan): string | null;
 /**
  * Extracts the first incomplete task from the current phase of a Plan object.
+ *
+ * #2841: task fields feed the `[SWARM CONTEXT] Current task:` injection —
+ * the composed line must pass the shared sanitizer before it is returned.
  */
 export declare function extractCurrentTaskFromPlan(plan: Plan): string | null;
 /**

package/dist/hooks/pr-auto-subscribe.d.ts

@@ -37,10 +37,11 @@ export declare const _internals: {
     log: typeof log;
 };
 /**
- * Extract `{ repoFullName, prNumber, prUrl }` from the first GitHub PR URL
- * in the given text, or null when none is present. The returned prUrl is
- * re-canonicalized from the captures so it always satisfies the
- * subscription store's strict URL schema.
+ * Extract `{ repoFullName, prNumber, prUrl }` from the first GitHub PR or
+ * GitLab MR URL in the given text, or null when none is present. The returned
+ * prUrl is re-canonicalized from the captures (provider-aware: github
+ * `/pull/N`, gitlab `/-/merge_requests/N` with the matched host) so it always
+ * satisfies the subscription store's URL schema.
  */
 export declare function extractPrUrl(text: string): {
     repoFullName: string;