opencode-swarm 7.200.1 → 7.200.3

package/dist/host/v2/agents-commands.d.ts

@@ -8,14 +8,19 @@
  * zero extraction from src/index.ts (the v1 TUI shortcut block stays
  * byte-pinned). DELTA: the lane-permission mutations the v1 hook writes into
  * the config object (applyLanePermissions) have no v2 destination here and
- * are dropped - external-directory lane scoping is a #2910 follow-up row in
- * docs/host/v2-hook-inventory.md.
+ * are dropped - external-directory lane scoping is tracked on #2910 (open)
+ * with its disclosure in docs/host/v2-hook-inventory.md row 4.
  *
  * Mappings (docs/host/v2-hook-inventory.md rows 4-5):
  *   - v1 AgentConfig → v2 Agent.Info: `prompt`→`system`, `mode` preserved
  *     (multi-swarm `*_architect` primary semantics — AGENTS.md invariant 11),
- *     `model` string 'provider/model' → Model.Ref, `tools` allowlist →
- *     per-tool allow permission rules (best-effort; see inventory).
+ *     `model` string 'provider/model' → Model.Ref, and the v1 `permission`
+ *     block → v2 permission rules through the HOST's own v1→v2 migration
+ *     (normalizeV2PermissionAction + preserve-and-append merge; #2910 W2).
+ *     The legacy `tools` allowlist branch is GONE: getAgentConfigs deletes
+ *     `sdkConfig.tools` at the emit site (src/agents/index.ts, issue #2528),
+ *     so nothing can ever feed it — the permission block is the only
+ *     enforceable tool-gating channel.
  *   - Entries the v1 hook marks `disable: true` (auto-select disabling the
  *     `build`/`plan` built-ins) are REMOVED on the v2 agent editor.
  *   - v1 command entries `{template, description}` → v2 CommandDefinition
@@ -34,18 +39,139 @@ import type { V1HooksSubset, V2AgentInfo, V2PluginContext, V2Registration } from
 export declare const _internals: {
     dispatchTimeoutMs: number;
 };
+/** Fresh registration tables a rebuild source produces (#2910 W3). */
+export interface V2RegistrationTables {
+    agentTable: Record<string, unknown>;
+    commandTable: Record<string, unknown>;
+}
+type V2ConfigRebuild = (directory: string) => Promise<V2RegistrationTables>;
+/**
+ * Quiet gate for {@link deferredV2WarnOperator}. Writes attach to the
+ * CURRENTLY-RESOLVED owner's entry (ambient when no setup owner is live) —
+ * setup.ts's startup preflight calls this AFTER openCodeSwarmV2Setup made its
+ * per-instance token current, so the value lands on that instance's entry.
+ */
+export declare function setV2OperatorQuiet(quiet: boolean): void;
+/**
+ * Owner-scoped quiet gate (#2910 W5): writes the given owner's entry and
+ * makes it the current owner. `undefined` detaches the owner's quiet value
+ * (setup cleanup; the entry drops when it holds nothing else).
+ */
+export declare function setV2OperatorQuietForOwner(token: string, quiet: boolean | undefined): void;
+/**
+ * Clear the operator-warning dedup state and the ambient quiet entry (direct
+ * test calls). NOT part of setup cleanup anymore (review PRR-002): the dedup
+ * map is bounded FIFO with explicit eviction (the invariant-8 strategy) and a
+ * per-cleanup global clear would wipe a concurrent live instance's dedup
+ * state; per-owner quiet entries are unregistered only by their own
+ * instance's cleanup (owner isolation, #2910 W5).
+ */
+export declare function resetV2OperatorWarningState(): void;
+/**
+ * Release one owner's registration snapshot (#2910 W3 / review PRR-004):
+ * setup cleanup calls this after detaching rebuild + quiet so a torn-down
+ * instance's entry DROPS instead of staying immortal in `v2OwnerStates`
+ * (unbounded across re-setups, and a dead-but-resolvable owner shadows the
+ * fallback resolution for surviving instances).
+ */
+export declare function clearV2OwnerRegistrationSnapshot(ownerToken: string): void;
+/**
+ * Remove the ctx→owner-token binding recorded at registration (#2910 W3/W5 /
+ * review PRR-003): setup cleanup detaches its ctx so a later dispatch through
+ * a re-used host ctx object cannot resolve a torn-down instance's state.
+ */
+export declare function clearV2CtxOwnerBinding(ctx: V2PluginContext): void;
+/**
+ * Test-only bounded-state proof (review PRR-004): number of live owner
+ * entries. Production never calls this; tests assert a setup's cleanup drops
+ * its own entry (snapshot released) and a rejected setup leaks none.
+ */
+export declare function countV2OwnerStatesForTests(): number;
 interface V1AgentConfigLike {
     mode?: unknown;
     prompt?: unknown;
     description?: unknown;
     model?: unknown;
-    tools?: unknown;
     disable?: unknown;
+    /** v1 permission block: name -> effect ('allow'|'deny'|'ask') or { [resourceGlob]: effect }. */
+    permission?: unknown;
 }
+/**
+ * Host v1→v2 permission-action normalization — the EXACT host migration
+ * table, captured verbatim from sst/opencode v2.0.29
+ * packages/core/src/v1/config/migrate.ts `normalizeAction` (local mirror:
+ * .agents/issue-traces/2910-v2-dual-host-plugin-port/probe-v2sdk/migrate-v2.0.29.ts):
+ *
+ *   write | patch -> edit
+ *   task          -> subagent
+ *   bash          -> shell
+ *   anything else -> VERBATIM (edit stays edit; apply_patch stays
+ *     apply_patch — migrate.ts has NO rewrite for it; plugin tool names stay
+ *     themselves). There is NO 'tool' catch-all anywhere in the host
+ *     migration.
+ *
+ * Shared by the agent permission port (#2910 W2) and the permission-bridge
+ * assert routing (#3351 / #2910 W4).
+ */
+export declare function normalizeV2PermissionAction(action: string): string;
 /** Map one v1 AgentConfig entry to a v2 Agent.Info. */
 export declare function mapV1AgentToV2(name: string, config: V1AgentConfigLike): V2AgentInfo;
 /** Expand a v1 TUI template for a v2 command execution. */
 export declare function expandV1Template(template: string, argumentsText: string): string;
-/** Register agents + commands via the synthetic config-hook run. */
-export declare function registerV2AgentsAndCommands(ctx: V2PluginContext, hooks: V1HooksSubset, directory: string, registrations: V2Registration[]): Promise<void>;
+/**
+ * Strip one leading `/swarm` (or bare `swarm`) token from a command
+ * invocation's raw prompt text (#3318 AC7). The v2 host hands the command's
+ * OWN prompt surface text to `execute` — on some hosts that text still
+ * carries the leading command token, which the registry handler would then
+ * double (`/swarm /swarm status` → "Command not found"). Exactly ONE token
+ * equal to `/swarm` or `swarm` is dropped, and only when followed by
+ * whitespace or end-of-text; every other shape (near-misses like
+ * `swarmish`, other commands, bare arguments) passes through unchanged.
+ */
+export declare function normalizeV2CommandArguments(text: string): string;
+/**
+ * Register agents + commands via the synthetic config-hook run.
+ *
+ * `ownerToken` (#2910 W3/W5 / review PRR-003): the setup instance's token —
+ * binds the ctx (WeakMap) to that instance and stores the registration
+ * snapshot on ITS entry, so a dispatch-driven refresh through this ctx
+ * resolves this instance's rebuild source and snapshot even after a newer
+ * setup registered later. Omitted (direct/test calls): the ambient
+ * current-owner resolution, unchanged from the pre-PRR-003 contract.
+ */
+export declare function registerV2AgentsAndCommands(ctx: V2PluginContext, hooks: V1HooksSubset, directory: string, registrations: V2Registration[], ownerToken?: string): Promise<void>;
+/**
+ * Register the AMBIENT owner's config rebuild source (#2910 W3, frozen C5
+ * surface): the current-truth table builder a config-writing command path
+ * installs. `undefined` detaches it. Setup instances register through
+ * {@link registerV2ConfigRebuildSourceForOwner} under their own token.
+ */
+export declare function registerV2ConfigRebuildSource(rebuild: V2ConfigRebuild | undefined): void;
+/**
+ * Owner-scoped rebuild-source registration (#2910 W3/W5): attaches the given
+ * owner token's rebuild source and makes it the current owner; `undefined`
+ * detaches only that owner's source (setup cleanup — a concurrent live
+ * instance's entry is never touched).
+ */
+export declare function registerV2ConfigRebuildSourceForOwner(token: string, rebuild: V2ConfigRebuild | undefined): void;
+/**
+ * Refresh the v2 registration tables from the REGISTERED rebuild source
+ * (#2910 W3 / frozen C5). `hooks.config` is deliberately NOT re-consulted —
+ * the production closure is stale by construction (captured at setup time);
+ * the rebuild source is the only current-truth channel. No source or a
+ * rejecting source: deferred warning, no reloads, no throw. Unchanged
+ * tables: no reloads (idempotent refresh). Changed tables: the snapshot
+ * holder is updated FIRST (so the host's post-reload re-run of the
+ * registered transforms replays the fresh tables), then feature-detected
+ * `ctx.agent.reload()` + `ctx.command.reload()` fire; a failed reload marks
+ * its domain dirty for the next refresh.
+ *
+ * #2910 W3/W5 / review PRR-003: the OWNING instance is resolved through the
+ * dispatching ctx's bound owner token (`ownerTokenByCtx`, recorded by
+ * registerV2AgentsAndCommands under the setup instance's token), falling
+ * back to the ambient current-owner chain when the ctx was never bound
+ * (direct/test calls — the frozen C5 arms). Rebuild source, snapshot and the
+ * quiet gate all resolve through the SAME token.
+ */
+export declare function deferredV2RefreshRegistrations(ctx: V2PluginContext, hooks: V1HooksSubset, directory: string, registrations?: V2Registration[]): Promise<void>;
 export {};

package/dist/host/v2/hook-budget.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Budget for the OpenCode 2 `tool.execute.before` guard chain (#3446).
+ *
+ * The v2 adapter wraps the whole v1 before-chain in one timeout. The chain is
+ * normally instant, but while Full-Auto is running it can contain an LLM
+ * oversight dispatch whose own deadline (`full_auto.oversight.total_timeout_ms`,
+ * default 120 s, up to 300 s) is LONGER than the fixed 60 s the adapter used.
+ * The host then reported "tool.execute.before exceeded budget" at 60 s while the
+ * critic kept running to its own deadline, and the run paused.
+ *
+ * Resolution order:
+ *   1. `full_auto.oversight.hook_timeout_ms` when set (explicit, always applies);
+ *   2. else, while a Full-Auto run is active for the session:
+ *      `oversight.total_timeout_ms + 30 s` (never below the base);
+ *   3. else the 60 s base.
+ *
+ * Settings are keyed by project directory (one plugin process can host several
+ * projects, each with its own config); a call without a directory, or for an
+ * unknown one, uses the default slot, then the module defaults.
+ */
+export declare const V2_TOOL_BEFORE_BASE_MS = 60000;
+export declare const V2_TOOL_BEFORE_MARGIN_MS = 30000;
+export declare const V2_TOOL_BEFORE_MAX_MS = 900000;
+/** Max distinct project directories retained (invariant 8: bounded state). */
+export declare const V2_TOOL_BEFORE_BUDGET_MAX_ENTRIES = 64;
+/**
+ * Record the relevant `full_auto.oversight` settings for a project directory
+ * (call at setup; omit `directory` to set the default slot).
+ */
+export declare function configureV2ToolBeforeBudget(fullAuto: unknown, directory?: string): void;
+/** Budget, in ms, for one `tool.execute.before` chain. */
+export declare function resolveV2ToolBeforeBudgetMs(fullAutoActive: boolean, directory?: string): number;
+/**
+ * Restore defaults for one project directory (setup failure path), or for
+ * everything when called without an argument (test seam).
+ */
+export declare function resetV2ToolBeforeBudget(directory?: string): void;

package/dist/host/v2/hooks.d.ts

@@ -40,6 +40,15 @@ import type { V1HooksSubset, V2PluginContext, V2Registration } from './types';
 /** Mirrors `isTaskToolId`'s shape (dotted SDK form OR normalized base name).
  * Exported for the event pump's progress-event gating (issue #3401). */
 export declare function isV2SubagentToolId(toolName: string | null | undefined): boolean;
+/**
+ * True for the host's Code Mode wrapper (#3446): the host-owned `execute`
+ * tool whose input is a JS program. The host id is matched exactly (no
+ * namespace stripping), and the call must carry a string `code` program.
+ */
+export declare function isV2CodeModeWrapper(event: {
+    readonly tool: string;
+    readonly input?: unknown;
+}): boolean;
 /**
  * Any recognized v2 subagent id (bare, namespace-prefixed, or dotted) is handed
  * to the v1 chain as the bare v1 id `task`. The v1 host reports the native tool
@@ -50,7 +59,21 @@ export declare function isV2SubagentToolId(toolName: string | null | undefined):
 /** Plain-object shape guard (arrays/instances rejected); exported for the
  * event pump's progress-metadata validation (issue #3401 / PR #3402). */
 export declare function isPlainObject(value: unknown): value is Record<string, unknown>;
-/** Register the tool hooks (execute.before/after). */
+/**
+ * Register the tool hooks (execute.before/after).
+ *
+ * #3352: BOTH registrations of the pair are attempted independently — a
+ * rejection of the first never skips its sibling. Each failure records a
+ * deferred warning naming the hook + error; the function resolves when at
+ * least one registration landed and rejects only if both failed (setup's
+ * runRegistration wrapper isolates that rejection with its own warning).
+ */
 export declare function registerV2ToolHooks(ctx: V2PluginContext, hooks: V1HooksSubset, directory: string, registrations: V2Registration[]): Promise<void>;
-/** Register the compaction + prompt session hooks. */
+/**
+ * Register the compaction + prompt session hooks.
+ *
+ * #3352: same pair-independence contract as registerV2ToolHooks — a
+ * rejecting 'compaction' registration still attempts 'prompt', each failure
+ * warns, and only a double failure rejects.
+ */
 export declare function registerV2SessionHooks(ctx: V2PluginContext, hooks: V1HooksSubset, directory: string, registrations: V2Registration[]): Promise<void>;

package/dist/host/v2/model-apply.d.ts

@@ -17,19 +17,29 @@
  *
  * Everything here is fail-open: with no registered surface (v1 hosts, or a v2
  * host without the agent domain) the apply is a logged no-op.
+ *
+ * #3352 / #2910 W5: the surface is OWNER-TOKEN-KEYED (see the registry
+ * comment below) — setup.ts passes its per-instance token on register and on
+ * owner-scoped clear, so concurrent live setups own disjoint surfaces.
  */
 import type { V2PluginContext } from './types';
 /**
  * Remember the v2 agent transform surface for later model rewrites. Called
- * once from setup after agent registration; cleared on cleanup.
+ * once from setup after agent registration (with the setup's owner token);
+ * a no-argument call registers the legacy '__default__' owner. Cleared on
+ * cleanup via `clearV2AgentTransformSurface(token)`.
  */
-export declare function registerV2AgentTransformSurface(ctx: V2PluginContext): void;
+export declare function registerV2AgentTransformSurface(ctx: V2PluginContext, token?: string): void;
 /**
- * Drop the registered surface and dispose every held apply registration
- * (v2 cleanup). Best-effort: disposal failure is logged, never thrown.
+ * Drop a registered surface and dispose every held apply registration.
+ * WITH token: clears/disposes ONLY that owner's surface + held registrations
+ * (v2 setup cleanup — a concurrent live instance is untouched). WITHOUT
+ * token: LEGACY ADMINISTRATIVE clear-all (kept for the pre-W5 test seams
+ * model-apply-3022 / setup-wiring-3022 / review-followup-3029). Best-effort:
+ * disposal failure is logged, never thrown.
  */
-export declare function clearV2AgentTransformSurface(): void;
-/** True when a v2 apply surface is registered (test/diagnostic seam). */
+export declare function clearV2AgentTransformSurface(token?: string): void;
+/** True when any live owner carries a v2 apply surface (test/diagnostic seam). */
 export declare function hasV2AgentTransformSurface(): boolean;
 /**
  * Rewrite one registered agent's model to `modelString` ('provider/model').

package/dist/host/v2/setup.d.ts

@@ -1,8 +1,45 @@
+/**
+ * Read `full_auto.oversight` once and size the v2 tool.execute.before budget
+ * for this project directory from it (#3446). Bounded and fail-open: on any
+ * error this project's entry is dropped and the module defaults apply (60 s
+ * base; 150 s while a Full-Auto run is active, i.e. the default 120 s
+ * oversight deadline + 30 s) and an operator-visible warning is queued,
+ * because a custom `hook_timeout_ms` / `total_timeout_ms` would not apply.
+ */
+declare function deferredV2ConfigureToolBeforeBudget(directory: string, loadConfig?: typeof loadPluginConfigWithMetaAsync): Promise<void>;
+import { loadPluginConfigWithMetaAsync } from '../../config/loader';
 import type { V1HooksSubset, V2PluginContext } from './types';
+/**
+ * Test seam (#3350 AC4 declared seam, frozen checks
+ * setup-registration-budget-fakeclock-3327 / setup-preflight-timeout-3327):
+ * the registration-stage budget, the preflight config budget, the preflight
+ * loader and the deferred tool.execute.before budget configurator are read
+ * through this object AT CALL TIME so tests can pin them without patching
+ * global timers (AGENTS.md invariant 7; precedent: PRR-002 dispatchTimeoutMs
+ * in agents-commands.ts). Production never mutates it.
+ */
+export declare const _internals: {
+    registrationTimeoutMs: number;
+    preflightConfigTimeoutMs: number;
+    loadConfig: typeof loadPluginConfigWithMetaAsync;
+    configureToolBeforeBudget: typeof deferredV2ConfigureToolBeforeBudget;
+};
 /** Dependencies injected from src/index.ts (avoids an index↔host cycle). */
 export interface V2SetupDependencies {
     /** The shared server-initialization wrapper (begin-interval → init core → schedule deferred → end-interval). */
     runInit: (input: unknown) => Promise<V1HooksSubset>;
+    /**
+     * Fresh registration-table builder (#2910 W3): a FRESH config read plus
+     * `getAgentConfigs` + the shared command-table builder — no
+     * side-effecting init re-run. Registered as this setup instance's config
+     * rebuild source so a successful `config doctor --fix` dispatch can
+     * refresh the registration tables. `undefined` -> the adapter registers
+     * no rebuild source (registration refresh stays a no-op).
+     */
+    buildV2RegistrationTables?: (directory: string) => Promise<{
+        agentTable: Record<string, unknown>;
+        commandTable: Record<string, unknown>;
+    }>;
 }
 /** Normalize a v2 agent reference (Agent.Info object or bare string) to a name. */
 export declare function normalizeV2AgentRef(agent: unknown): string | undefined;
@@ -24,3 +61,4 @@ export declare function seedV1SessionState(sessionID: string | undefined, agentR
  * be synchronous and cheap).
  */
 export declare function v2ToolInputSchema(args: unknown): unknown;
+export {};

package/dist/host/v2/types.d.ts

@@ -12,7 +12,7 @@
  * `{ field: Body["field"] }` records; they are vendored here as plain optional fields of the
  * same types (e.g. `SessionCreateInput` is all-optional in the published form).
  *
- * Drift guard: DEFERRED to the #2910 follow-up PR (a check-host-contract v2 digest leg over this corpus, plus the dual-host CI lane); until it lands, type truth rests on this provenance pin (now 2.0.26) and the live-host smoke. See docs/host/v2-hook-inventory.md for the full v1-to-v2 map.
+ * Drift guard: SHIPPED with the #2910 dual-host work — the check-host-contract-v2 digest leg and the dual-host CI lane landed, and the weekly digest plus the vendored-pin freshness detector (scripts/drift-check.ts, reading this header's pin) now guard this corpus. See docs/host/v2-hook-inventory.md for the full v1-to-v2 map.
  *
  * Host-tolerance contract for the session/worktree method surface (issue #3169):
  * the members below are REQUIRED to mirror the published `SessionDomain`/`WorktreeDomain`.
@@ -475,9 +475,33 @@ export interface V2EventEnvelope {
 export interface V2EventDomain {
     readonly subscribe?: (...args: unknown[]) => AsyncIterable<V2EventEnvelope> | Promise<AsyncIterable<V2EventEnvelope>>;
 }
-/** v2 `PermissionDomain` (only used for the v1 ask() bridge, best-effort). */
+/**
+ * v2 `PermissionDomain` (only used for the v1 ask() bridge, best-effort).
+ * `assert` is documented in `@opencode/plugin@2.0.29`
+ * `dist/promise/permission.d.ts` and ABSENT at the 2.0.26 vendored pin —
+ * feature-detected (`typeof === 'function'`) at the call site
+ * (src/host/v2/tools.ts buildPermissionBridge, #3351).
+ */
 export interface V2PermissionDomain {
-    readonly reply?: (input: unknown) => Promise<unknown>;
+    /**
+     * Ask-side permission assertion (2.0.29+): input
+     * `{ sessionID: string; agent: string; action: string; resources: string[] }`;
+     * a resolution grants the request, a rejection denies it.
+     */
+    assert?: (input: {
+        sessionID: string;
+        agent: string;
+        action: string;
+        resources: string[];
+    }) => Promise<unknown>;
+    /**
+     * Answer-side RPC `{ requestID, reply, message }` — the host's channel for
+     * ANSWERING a permission request, not for raising one. The bridge never
+     * interprets a resolved reply value as a grant (fail-closed; #3351
+     * decision — grant shapes stay uninterpreted pending live-host
+     * observation).
+     */
+    reply?: (input: unknown) => Promise<unknown>;
     readonly list?: () => Promise<unknown[]>;
     readonly hook?: (name: 'evaluate', callback: (input: unknown) => Promise<void> | void) => Promise<V2Registration>;
 }

package/dist/index.d.ts

@@ -83,6 +83,21 @@ type PendingCostCorrection = {
     version: number;
     currentFields: DelegationCostFields;
 };
+/**
+ * Fresh registration-table builder for the v2 host path (#2910 W3 / AC5).
+ * Injected into `openCodeSwarmV2Setup` as the per-instance config rebuild
+ * source: a FRESH config read through the async loader (never the init-time
+ * closure), the same release-aware auto-review resolution, project context
+ * and lane-permission application the v1 init path feeds
+ * `getAgentConfigs`, and the SAME shared table builder — no
+ * side-effecting init re-run (no snapshot / repo-graph / bundled-skill
+ * work). Invoked only from the user-triggered registration refresh, never
+ * from plugin init.
+ */
+export declare function buildV2RegistrationTables(directory: string): Promise<{
+    agentTable: Record<string, unknown>;
+    commandTable: Record<string, unknown>;
+}>;
 declare const _default: {
     id: "opencode-swarm";
     server: Plugin;