opencode-swarm 7.195.0 → 7.196.0

package/dist/sbom/detectors/index.d.ts

@@ -51,3 +51,18 @@ export declare function findDetectorsForFile(filePath: string): Detector[];
  * Detect components from a file using appropriate detectors
  */
 export declare function detectComponents(filePath: string, content: string): SbomComponent[];
+/**
+ * Merge lockfile-sourced and manifest-sourced component lists into one
+ * deduplicated set (issue #2956).
+ *
+ * Lockfile-resolved entries take precedence over manifest declared-base
+ * entries of the same package identity — a `package.json` declaring
+ * `express@^4.18.0` resolves to `express@4.18.2` in the lockfile, and the
+ * declared-base twin is dropped. Identity is name + ecosystem (the purl
+ * type): an npm lockfile entry must not suppress a same-named Cargo or PyPI
+ * package from a polyglot repo. Components without a usable purl fall back
+ * to name-only suppression (the issue's literal rule). Exact purls then
+ * dedupe (falling back to `name@version` when a component carries no purl),
+ * preserving first-occurrence order.
+ */
+export declare function dedupeSbomComponents(lockfileComponents: SbomComponent[], manifestComponents: SbomComponent[]): SbomComponent[];

package/dist/tools/sbom-generate.d.ts

@@ -22,7 +22,7 @@ export interface SbomGenerateInput {
     changed_files?: string[];
 }
 export interface SbomGenerateResult {
-    /** Verdict: 'pass' if SBOM generated successfully, 'skip' if no manifests found */
+    /** Verdict: 'pass' if SBOM generated successfully, 'skip' if no manifests were found or none could be read */
     verdict: 'pass' | 'skip';
     /** Array of manifest/lock file paths discovered */
     files: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.195.0",
+	"version": "7.196.0",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",