opencode-swarm 7.187.3 → 7.188.0

package/dist/commands/destructive-purge.d.ts

@@ -1,30 +1,3 @@
-/**
- * Issue #2527 / #2508: the shared two-step destructive-purge confirmation
- * primitive (preview + confirm_token → exact-token execution).
- *
- * Contract (frozen by check C8 and the destructive-purge-2527 unit suite):
- *  - `previewDestructivePurge` is a side-effect-free preview (counts, exact
- *    option label, the confirmation the operator must echo);
- *  - `issueConfirmToken` records a single-slot pending purge keyed by a
- *    digest over the candidate SET (sorted absolute paths + kind) and
- *    returns the confirm token (15-minute TTL);
- *  - `executeDestructivePurge` re-derives the CURRENT scope digest and
- *    passes only on exact token match AND digest match AND fresh TTL — so
- *    replay after the candidate set changes (a lane added, removed, or the
- *    scope re-derived differently) is rejected by construction, and the
- *    token is single-use (the pending record is consumed on execution; a
- *    second execution is rejected with "no pending purge").
- *  - TTL expiry: an expired pending record is treated as absent on read
- *    (silent); every new issuance overwrites the single slot — the
- *    overwritten token can never execute (it is rejected with "confirm
- *    token mismatch"; a single-slot store cannot distinguish generations,
- *    but rejection is guaranteed either way).
- *  - Scope-of-execution: the executor deletes ONLY the recorded candidate
- *    paths. The primitive confirms operator intent; CALLERS own scoping —
- *    `/swarm reset-session` (and #2508's `/swarm close` when it adopts
- *    this) must only construct candidate sets from ownership-gated,
- *    base-scoped directories.
- */
 import { randomBytes } from 'node:crypto';
 import * as fs from 'node:fs';
 import { atomicWriteSwarmFileSync } from '../utils/atomic-write';
@@ -54,6 +27,61 @@ export declare const _internals: {
     now: () => number;
     randomBytes: typeof randomBytes;
     scopeDigest: typeof scopeDigest;
+    runGitStatus: typeof runGitStatusSync;
+};
+/**
+ * Shared argv for every tracked-dirty measurement (issue #2953): the close
+ * gate and the pre-destruction re-check run the identical status command and
+ * feed the same parser, so the two measurements parse identically. (The two
+ * reads still go through separate spawn wrappers; equivalence is by
+ * convention + review, not a single shared call site.)
+ */
+export declare const GIT_STATUS_ARGS: readonly ["status", "--porcelain"];
+/** Default bounded status read (invariant 3: array form, cwd, timeout, ignore
+ * stdin, bounded stdout, windowsHide). Exposed via `_internals` for tests. */
+declare function runGitStatusSync(args: readonly string[], cwd: string): string | null;
+/**
+ * Parse `git status --porcelain` (newline) output into repo-relative
+ * tracked-dirty paths: untracked (`??`) entries are skipped (they survive the
+ * align reset), surrounding quotes are stripped, and rename/copy records are
+ * split into BOTH sides. R/C may appear in EITHER status column (`R  old ->
+ * new` staged, ` R old -> new` worktree renames via `git add -N`) — both
+ * columns are tested, never just the first (the codebase porcelain-parser
+ * rule from the #2976 rollback-gate review). Sibling module
+ * `src/commands/rollback-gate.ts` exports a same-named parser for
+ * NUL-terminated `--porcelain -z` output (J1/#2946); the two are deliberately
+ * not consolidated in this PR.
+ */
+export declare function parseTrackedDirtyPaths(statusOutput: string): string[];
+/**
+ * Shared tracked-dirty read (issue #2953): GIT_STATUS_ARGS + the shared
+ * parser around the default runner (test seam: `_internals.runGitStatus`).
+ * The close gate composes the same argv + parser directly through its own
+ * long-standing `_closeGateInternals.runGit` seam rather than calling this
+ * helper, so its existing #2508 fail-closed tests keep their injection point.
+ */
+export declare function readTrackedDirtyPaths(directory: string): {
+    ok: true;
+    dirtyPaths: string[];
+} | {
+    ok: false;
+};
+/**
+ * Issue #2953 TOCTOU re-check: re-measure the tracked-dirty set immediately
+ * before a destructive reset and compare it to the set the operator actually
+ * confirmed (or the empty clean-tree set). Fail-closed in both directions
+ * that matter: ANY newly-dirty tracked path refuses, and an unreadable
+ * status refuses (a measurement that cannot be taken must never read as
+ * "unchanged"). A file that got cleaner passes — strictly less destruction
+ * than confirmed.
+ */
+export declare function recheckBeforeDestructive(directory: string, expectedDirtyPaths: readonly string[]): {
+    ok: true;
+    dirtyPaths: string[];
+} | {
+    ok: false;
+    reason: string;
+    newDirtyPaths: string[];
 };
 declare function scopeDigest(kind: string, candidates: PurgeCandidate[]): string;
 /**

package/dist/commands/registry.d.ts

@@ -730,7 +730,7 @@ export declare const COMMAND_REGISTRY: {
     readonly finalize: {
         readonly handler: (ctx: CommandContext) => Promise<string>;
         readonly description: "Use /swarm finalize to finalize the swarm project and archive evidence";
-        readonly details: "Idempotent 4-stage terminal finalization: (1) finalize writes retrospectives for in-progress phases, (2) archive creates timestamped bundle of swarm artifacts and evidence, (3) clean removes active-state files for a clean slate, (4) align performs aggressive git reset --hard to the default remote branch, discarding uncommitted changes and gitignored build artifacts (user-created untracked files are preserved); falls back to a cautious reset that preserves uncommitted changes when the aggressive path cannot proceed. WARNING: alignment discards local changes and gitignored files. Resets agent sessions, delegation chains, and active-agent mappings. Reads .swarm/close-lessons.md for explicit lessons and runs curation. Cleanup: knowledge.jsonl is preserved; plan.json, plan.md, events.jsonl, handoff.*, run-memory.jsonl, and summaries/ are removed. Use --skill-review to run the quota-bounded skill_improver in proposal mode. Use --dry-run to preview what finalize would archive, clean, and align without taking the lock or changing anything.";
+        readonly details: "Idempotent 4-stage terminal finalization: (1) finalize writes retrospectives for in-progress phases, (2) archive creates timestamped bundle of swarm artifacts and evidence, (3) clean removes active-state files for a clean slate, (4) align performs aggressive git reset --hard to the default remote branch, discarding uncommitted changes and gitignored build artifacts (user-created untracked files are preserved); falls back to a cautious reset that preserves uncommitted changes when the aggressive path cannot proceed. Alignment re-verifies the tracked tree immediately before its destructive reset and aborts fail-closed (leaving alignment undone) when tracked files changed after the close gate was verified or the status cannot be re-read (#2953). WARNING: alignment discards local changes and gitignored files. Resets agent sessions, delegation chains, and active-agent mappings. Reads .swarm/close-lessons.md for explicit lessons and runs curation. Cleanup: knowledge.jsonl is preserved; plan.json, plan.md, events.jsonl, handoff.*, run-memory.jsonl, and summaries/ are removed. Use --skill-review to run the quota-bounded skill_improver in proposal mode. Use --dry-run to preview what finalize would archive, clean, and align without taking the lock or changing anything.";
         readonly args: "--prune-branches, --skill-review, --dry-run";
         readonly category: "core";
         readonly toolPolicy: "none";

package/dist/hooks/knowledge-validator.d.ts

@@ -121,6 +121,23 @@ export interface EntryHealthResult {
     concern?: string;
 }
 export declare function auditEntryHealth(entry: KnowledgeEntryBase): EntryHealthResult;
+/**
+ * #2950: what `quarantineEntry` actually did inside the lock. Callers that
+ * need to report truthfully (the knowledge_archive tool) switch on this
+ * instead of assuming the mutation happened; value-discarding callers are
+ * unaffected.
+ */
+export type QuarantineEntryOutcome = {
+    status: 'quarantined';
+} | {
+    status: 'denied';
+    basis: string;
+    detail: string;
+} | {
+    status: 'not_found';
+} | {
+    status: 'invalid_input';
+};
 export declare function quarantineEntry(directory: string, entryId: string, reason: string, reportedBy: 'architect' | 'user' | 'auto', 
 /** #1848: cohort-safe curation context. When provided, the quarantine is
  * authorized through the shared curation policy BEFORE mutating; an
@@ -130,7 +147,7 @@ export declare function quarantineEntry(directory: string, entryId: string, reas
 curationContext?: {
     input: CurationAuthorizationInput;
     context: CurationContext;
-}): Promise<void>;
+}): Promise<QuarantineEntryOutcome>;
 export declare function restoreEntry(directory: string, entryId: string, 
 /** #1848 §2: cohort-safe curation context (optional). When provided, the
  * restore is authorized through the shared policy before mutating. */