opencode-swarm 7.191.0 → 7.191.2

package/dist/sandbox/executor.d.ts

@@ -66,7 +66,22 @@ export interface SandboxPolicyOptions {
     network_mode?: 'off' | 'on';
     network_allowlist?: readonly string[];
     writable_roots?: readonly string[];
+    /**
+     * Absolute roots the sandboxed command may READ but not write, mounted
+     * before the writable scope paths so a scope path inside one of them
+     * stays writable. The guardrails hook passes the session workspace here:
+     * without it a Linux coder sandbox contained only its declared scope, so
+     * `node tests/x.test.js` could not even load `../src/x.js`. Executors
+     * whose containment is write-only (macOS sandbox-exec) ignore it.
+     */
+    readonly_roots?: readonly string[];
 }
+/**
+ * The policy fields that come from configuration and take part in the
+ * enforcement assessment and its cache key. `readonly_roots` is derived per
+ * call from the session workspace and is deliberately not part of it.
+ */
+export type SandboxConfigPolicy = Omit<SandboxPolicyOptions, 'readonly_roots'>;
 declare function detectSandboxCapability(): Promise<SandboxCapabilityV1>;
 export declare const _internals: {
     detectSandboxCapability: typeof detectSandboxCapability;
@@ -74,7 +89,7 @@ export declare const _internals: {
 export interface SandboxEnforcementAssessment {
     capability: SandboxCapabilityV1;
     requirements: Required<SandboxRequirements>;
-    policy: Required<SandboxPolicyOptions>;
+    policy: Required<SandboxConfigPolicy>;
     satisfied: boolean;
     missing: string[];
     supported: boolean;

package/dist/sandbox/linux/bubblewrap-executor.d.ts

@@ -6,7 +6,7 @@
  * for essential read-only system paths. Drops all capabilities via --cap-drop ALL
  * for defense-in-depth within the user namespace.
  */
-import { type SandboxExecutor } from '../executor';
+import { type SandboxExecutor, type SandboxPolicyOptions } from '../executor';
 /**
  * Resolve the bwrap binary: absolute base-OS path when present, bare-name
  * (PATH resolution) fallback otherwise. Never throws.
@@ -32,7 +32,12 @@ export declare const _internals: {
  *
  * Instantiated with scope paths and an optional temp directory override.
  * wrapCommand() returns a bwrap-wrapped command string that:
- *   - bind-mounts each scope path read-write
+ *   - bind-mounts each policy.readonly_roots path read-only (the session
+ *     workspace), FIRST, so the command can read the project it is working in
+ *   - bind-mounts each scope path read-write, after the read-only roots so a
+ *     scope path inside the workspace is writable (bwrap mounts in argument
+ *     order and a later bind sits on top of an earlier one; the reverse order
+ *     would leave the scope path read-only)
  *   - mounts a tmpfs at /tmp (writable temporary storage)
  *   - bind-mounts essential system paths read-only
  *   - spawns the raw command via `bash -c '<command>'`
@@ -75,9 +80,7 @@ export declare class BubblewrapSandboxExecutor implements SandboxExecutor {
      * @returns A bwrap-wrapped command string ready for shell execution,
      *          or the raw command string when the sandbox is unavailable (passthrough mode)
      */
-    wrapCommand(command: string, scopePaths: string[], tempDir?: string, envOverrides?: Record<string, string | null>, policy?: {
-        network_mode?: 'off' | 'on';
-    }): string;
+    wrapCommand(command: string, scopePaths: string[], tempDir?: string, envOverrides?: Record<string, string | null>, policy?: Pick<SandboxPolicyOptions, 'network_mode' | 'readonly_roots'>): string;
     /**
      * Return environment variable overrides required for the bubblewrap sandbox.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.191.0",
+	"version": "7.191.2",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",