opencode-swarm 7.199.6 → 7.200.1

package/dist/gate-evidence.d.ts

@@ -16,6 +16,7 @@
  * authorization against a process with arbitrary same-user workspace access;
  * that requires a protected trust root outside the project workspace.
  */
+import { z } from 'zod';
 import { appendTaskGateRequirementsReceiptIfNeeded } from './evidence/task-gate-requirements.js';
 import type { ReviewRouteEvidence } from './review/routing-enforcement.js';
 import type { TaskWorkflowState } from './state';
@@ -28,7 +29,7 @@ export interface GateEvidence {
     agent: string;
 }
 export declare const TASK_WORKFLOW_SCHEMA_MARKER: "exact-task-v1";
-declare const TASK_WORKFLOW_OUTCOMES: readonly ["none", "dispatch_attempted", "dispatch_no_mutation", "accepted_mutation", "accepted_mutation_failed", "stage_a_passed", "stage_a_failed", "stage_b_completed", "stage_b_failed", "gate_recorded", "task_completed", "task_blocked", "task_closed", "repair_idle"];
+declare const TASK_WORKFLOW_OUTCOMES: readonly ["none", "dispatch_attempted", "dispatch_no_mutation", "accepted_mutation", "accepted_mutation_failed", "stage_a_passed", "stage_a_failed", "stage_b_completed", "stage_b_failed", "gate_recorded", "task_completed", "task_blocked", "task_closed", "repair_idle", "external_evidence_attested", "external_evidence_revoked"];
 export type TaskWorkflowTransitionOutcome = (typeof TASK_WORKFLOW_OUTCOMES)[number];
 export interface TaskWorkflowMetadata {
     schema: typeof TASK_WORKFLOW_SCHEMA_MARKER;
@@ -95,6 +96,17 @@ export interface TaskWorkflowMetadata {
         transitionId: string;
         declaredFiles: string[];
     };
+    /**
+     * Pinned external evidence bundle (issue #3422): the read-only git proof
+     * for a task declared `evidence_class: 'external_git'`, attested while the
+     * workflow is idle and preserved through the terminal task_completed write
+     * so a duplicate completion can re-validate the same current proof. Cleared
+     * by a new coder attribution window (dispatch_attempted /
+     * dispatch_no_mutation / accepted_mutation), by repair_idle's fresh
+     * generation, and by the declaration-change revoke; terminal states are
+     * never revoked (06-critic-review.md R4F1).
+     */
+    externalEvidence?: ExternalEvidenceBundle;
 }
 export interface TaskWorkflowSnapshot extends TaskWorkflowMetadata {
     authoritative: boolean;
@@ -237,6 +249,13 @@ export type TaskWorkflowTransitionEvent = {
     qaExempt?: boolean;
     /** Durable, non-forced completion of a trusted empty-scope settlement. */
     readOnlyNoMutation?: boolean;
+    /**
+     * Issue #3422: the caller proved the external bundle current via
+     * externalProofCurrent / isExternalEvidenceInitialCompletionEligible
+     * before forwarding the terminal event; the reducer still requires the
+     * durable bundle to exist and fully match before admitting it.
+     */
+    externalEvidence?: boolean;
     expectedGeneration: number;
     transitionId?: string;
 } | {
@@ -251,6 +270,27 @@ export type TaskWorkflowTransitionEvent = {
     type: 'repair_idle';
     expectedGeneration: number;
     transitionId?: string;
+} | {
+    /**
+     * Issue #3422: pin the attest producer's validated read-only git bundle
+     * as durable workflow metadata. State-preserving (the gate_recorded
+     * precedent) and admitted from idle only — an external task never
+     * enters the coder QA lifecycle.
+     */
+    type: 'external_evidence_attested';
+    bundle: ExternalEvidenceBundle;
+    expectedGeneration: number;
+    transitionId?: string;
+} | {
+    /**
+     * Issue #3422: the plan declaration changed under a nonterminal task, so
+     * the pinned bundle no longer describes the declared work. Terminal
+     * states are never revoked (06-critic-review.md R4F1).
+     */
+    type: 'external_evidence_revoked';
+    reason: 'declaration_changed';
+    expectedGeneration: number;
+    transitionId?: string;
 };
 export interface TaskEvidenceTransaction {
     taskId: string;
@@ -277,6 +317,29 @@ export interface TaskEvidenceTransaction {
      */
     save?(nextEvidence: TaskEvidence): Promise<TaskEvidence>;
 }
+/**
+ * Durable external-evidence bundle (issue #3422): the pinned read-only git
+ * proof for a task whose deliverable is verified outside the coder QA
+ * lifecycle. The attest producer validates the bundle (digest recompute, all
+ * anchors matched, bounds) before publishing it through the
+ * `external_evidence_attested` transition; this schema is the persistence
+ * boundary that refuses anything malformed after the fact.
+ */
+export declare const ExternalEvidenceBundleSchema: z.ZodObject<{
+    class: z.ZodLiteral<"external_git">;
+    transitionId: z.ZodString;
+    declarationDigest: z.ZodString;
+    anchors: z.ZodArray<z.ZodObject<{
+        command: z.ZodString;
+        expect: z.ZodOptional<z.ZodString>;
+        expect_prefix: z.ZodOptional<z.ZodString>;
+        matched: z.ZodBoolean;
+        exit_code: z.ZodNumber;
+        stdout: z.ZodString;
+    }, z.core.$strip>>;
+    attestedAt: z.ZodString;
+}, z.core.$strip>;
+export type ExternalEvidenceBundle = z.infer<typeof ExternalEvidenceBundleSchema>;
 export declare function parseTaskEvidence(raw: string, expectedTaskId: string): TaskEvidence;
 export declare const DEFAULT_REQUIRED_GATES: string[];
 export interface GateDerivationContext {
@@ -308,6 +371,80 @@ export declare function deriveApplicableGateSet(evidence: TaskEvidence | null |
 export declare function isReadOnlyNoMutationEligible(evidence: TaskEvidence | null | undefined, options?: {
     currentDeclaredFiles?: readonly string[] | null;
 }): boolean;
+/**
+ * Inputs to the external-evidence declaration digest (issue #3422,
+ * 05-fix-plan.md §3): the exact task declaration plus the plan identity and
+ * evidence generation the digest binds.
+ */
+export interface ExternalDeclarationInput {
+    taskId: string;
+    evidence_class: 'external_git';
+    evidence_anchors: ReadonlyArray<{
+        command: string;
+        expect?: string;
+        expect_prefix?: string;
+    }>;
+    plan_title: string;
+    plan_swarm: string;
+    generation: number;
+}
+/**
+ * Compute the declaration digest bound into an external evidence bundle:
+ * sha256 hex over the canonical JSON of `{taskId, evidence_class,
+ * evidence_anchors (ordered definitions only), plan_title, plan_swarm,
+ * generation}`.
+ *
+ * Deliberately CURSOR-FREE (issue #3422, 05-fix-plan.md §3): the whole-plan
+ * structure hash includes `current_phase`, which advances during the terminal
+ * plan write. Binding the digest to it would self-invalidate the proof in
+ * the crash window after plan.json advances and before the evidence
+ * transaction applies. Every revalidation recomputes this digest from the
+ * CURRENT plan task and CURRENT generation instead — no whole-plan hash is
+ * ever consulted.
+ */
+export declare function computeExternalDeclarationDigest(input: ExternalDeclarationInput): string;
+/** Plan identity inputs to the external declaration digest (issue #3422). */
+export interface ExternalPlanIdentity {
+    title: string;
+    swarm: string;
+}
+/**
+ * The subset of a plan task the external-evidence predicates consult: the
+ * declaration fields save_plan validated (issue #3422).
+ */
+export interface ExternalPlanTaskRef {
+    id: string;
+    evidence_class?: string;
+    evidence_anchors?: ReadonlyArray<{
+        command: string;
+        expect?: string;
+        expect_prefix?: string;
+    }> | undefined;
+}
+/**
+ * Proof-currency predicate (issue #3422, 05-fix-plan.md §4c / R3F1): true iff
+ * the task declares `external_git`, a bundle exists with at least one anchor,
+ * every anchor matched, and the bundle's declarationDigest equals the digest
+ * recomputed from the CURRENT plan declaration + CURRENT generation. There is
+ * NO workflow-state condition — this is the "proof is current" predicate
+ * usable in ANY state (mirroring isNoMutationSettlementMetadata's
+ * idle || complete acceptance), so duplicate completion, committed-WAL
+ * idempotent replay, terminal recovery, and check_gate_status on a completed
+ * task all re-validate the same way.
+ */
+export declare function externalProofCurrent(plan: ExternalPlanIdentity, planTask: ExternalPlanTaskRef, evidence: TaskEvidence | null | undefined): boolean;
+/**
+ * Initial-completion eligibility (issue #3422, 05-fix-plan.md §4c / R3F1):
+ * `externalProofCurrent` AND the authoritative workflow state is exactly
+ * `idle` (blocked removed — a blocked task reopens via the audited
+ * blocked → in_progress plan transition first). This is the R3F1 split's
+ * other half: the FIRST completion requires idle, while DUPLICATE
+ * completions and terminal recovery use `externalProofCurrent` and accept
+ * `complete`. Consults the authoritative snapshot (the
+ * isNoMutationSettlementMetadata pattern) so non-authoritative legacy
+ * metadata never admits an external completion.
+ */
+export declare function isExternalEvidenceInitialCompletionEligible(plan: ExternalPlanIdentity, planTask: ExternalPlanTaskRef, evidence: TaskEvidence | null | undefined): boolean;
 export declare function reduceTaskWorkflowSnapshot(current: TaskWorkflowSnapshot, event: TaskWorkflowTransitionEvent, context: {
     requiredGates: string[];
     gates: Record<string, GateEvidence>;

package/dist/git/branch.d.ts

@@ -7,6 +7,13 @@ export type GitRepositoryStatus = {
     reason: 'not_git_repo' | 'git_unavailable' | 'git_error';
     message: string;
 };
+/**
+ * Repo-detection vocabulary shared with the async detailed reader
+ * (`src/commands/git-status-read.ts`, #3427): the same case-folded phrases
+ * classify a nonzero `rev-parse` exit as `not_git_repo` on the sync and
+ * async probe paths alike, so the two probes cannot drift apart.
+ */
+export declare function isNotGitRepositoryMessage(message: string): boolean;
 /**
  * Seam that calls child_process.spawnSync dynamically.
  * Uses getChildProcessSpawnSync() to resolve at call time, allowing
@@ -71,6 +78,21 @@ declare const __spawnSyncSeam: {
  * looks sufficient but is not — that gap is exactly what #2263 reported.
  */
 export declare function readLaneEnvFileFromDiskSync(worktreePath: string, laneIndex: number): Record<string, string>;
+/**
+ * Issue #2236 F5: builds the *actionable* "git is not available" message.
+ *
+ * `describeGitResolution()` (src/utils/git-executable.ts) is the production
+ * source of truth for what the resolver actually tried — every candidate path,
+ * its source (`override`/`platform`/`path`), and why each was rejected. A bare
+ * "git executable is not available on PATH" is what sent the original report
+ * down a four-day PATH investigation while git was present the whole time, so
+ * the thrown message names the candidates and the override escape hatch.
+ *
+ * `cwd` is named too: reaching this function means the cwd was positively
+ * classified as present-and-a-directory, which is the fact that rules the
+ * #2236 misdiagnosis out rather than leaving it implied.
+ */
+export declare function gitBinaryMissingMessage(cwd: string): string;
 declare function gitExec(args: string[], cwd: string, laneEnv?: Record<string, string>, laneIndex?: number): string;
 export declare function getGitRepositoryStatus(cwd: string): GitRepositoryStatus;
 /**