opencode-swarm 7.200.4 → 7.200.6

package/dist/hooks/knowledge-receipt-ledger.d.ts

@@ -173,6 +173,24 @@ export type ReceiptUnavailable = {
 export type ReceiptLedgerResult<T> = ({
     ok: true;
 } & T) | ReceiptUnavailable;
+/**
+ * #2965: permanent identity-conflict codes for the empty-trace immutability
+ * rule. The conflict itself stays legitimate — only its category changes: a
+ * deterministic policy rejection must never ride the retry-inviting
+ * `store_unavailable` store channel (AGENTS.md invariant 9).
+ */
+export type ReceiptEmptyTraceConflictCode = 'wrong_task' | 'wrong_phase' | 'duplicate_conflicting_terminal';
+/** #2965: typed rejection for a conflicting `'none'`-sentinel re-file. */
+export type ReceiptEmptyTraceConflict = {
+    ok: false;
+    code: ReceiptEmptyTraceConflictCode;
+    detail: string;
+};
+export type CommitEmptyRetrievalResult = {
+    ok: true;
+    event_id: string;
+    terminal_event_id: string;
+} | ReceiptEmptyTraceConflict | ReceiptUnavailable;
 declare function writeSnapshot(paths: ReceiptLedgerPaths, state: LedgerState): Promise<void>;
 export interface RepairKnowledgeReceiptLedgerInput {
     phase: string;
@@ -219,10 +237,7 @@ export declare function commitDisplayedMembership(directory: string, input: Comm
     event_id: string;
     memberships: ReceiptMembership[];
 }>>;
-export declare function commitEmptyRetrieval(directory: string, input: Omit<CommitDisplayedMembershipInput, 'entries'>): Promise<ReceiptLedgerResult<{
-    event_id: string;
-    terminal_event_id: string;
-}>>;
+export declare function commitEmptyRetrieval(directory: string, input: Omit<CommitDisplayedMembershipInput, 'entries'>): Promise<CommitEmptyRetrievalResult>;
 export interface TerminalBatchInput {
     trace_id: string;
     session_id: string;

package/dist/hooks/phase-complete-directive-gate.d.ts

@@ -16,8 +16,9 @@
  * `override` event with a written justification). Fail-CLOSED: any read error
  * surfaces as a block, never a silent pass.
  */
+import { type ReceiptUnavailable } from './knowledge-receipt-ledger.js';
 export type DirectiveBlockReason = 'no_verdict' | 'unremediated_violation';
-export type DirectiveGateFailureCode = 'RECEIPT_MISSING' | 'RECEIPT_CORRUPT' | 'RECEIPT_LOCK_TIMEOUT' | 'RECEIPT_WRONG_ROOT' | 'RECEIPT_PERMISSION' | 'RECEIPT_TRANSIENT' | 'RECEIPT_STORE_UNAVAILABLE';
+export type DirectiveGateFailureCode = 'RECEIPT_MISSING' | 'RECEIPT_CORRUPT' | 'RECEIPT_LOCK_TIMEOUT' | 'RECEIPT_WRONG_ROOT' | 'RECEIPT_PERMISSION' | 'RECEIPT_TRANSIENT' | 'RECEIPT_CONFLICT' | 'RECEIPT_STORE_UNAVAILABLE';
 export interface DirectiveGateResult {
     blocked: boolean;
     unresolved: Array<{
@@ -52,6 +53,7 @@ export interface DirectiveGateResult {
         action: 'knowledge_receipt' | 'phase_complete' | 'repair_knowledge_receipt_ledger';
     };
 }
+declare function classifyDirectiveGateFailure(error: unknown | ReceiptUnavailable): Pick<DirectiveGateResult, 'failure' | 'recovery'>;
 /**
  * Evaluate all critical directives shown during the phase. Fail-closed.
  *
@@ -83,3 +85,13 @@ export declare function evaluatePhaseCriticalDirectives(params: {
 export declare function recordDirectiveOverrides(directory: string, ids: string[], justification: string, sessionId: string | undefined, phaseLabel?: string, phaseId?: number): Promise<void>;
 /** Build a structured, human-readable block message for unresolved criticals. */
 export declare function formatDirectiveBlockMessage(unresolved: DirectiveGateResult['unresolved']): string;
+/**
+ * #2965: dependency-injection seam for the failure classifier. Tests drive
+ * `classifyDirectiveGateFailure` through this seam (per the repo's
+ * `_internals` convention); these are synthetic classifier tests, not
+ * end-to-end gate evidence.
+ */
+export declare const _internals: {
+    classifyDirectiveGateFailure: typeof classifyDirectiveGateFailure;
+};
+export {};

package/dist/hooks/shell-executor-context.d.ts

@@ -41,3 +41,20 @@ export declare const CMD_BUILTIN_PREFIX: RegExp;
 export declare const CMD_STRIP_PREFIX: RegExp;
 /** Strip pattern for a powershell/pwsh -Command/-c wrapper with switches. */
 export declare const PS_STRIP_PREFIX: RegExp;
+/** Record the host-reported shell for the `shell` tool (latest wins). */
+export declare function recordObservedHostShell(shell: string): void;
+/** The host-reported shell for the `shell` tool, when one has been observed. */
+export declare function getObservedHostShell(): string | undefined;
+/** Test seam: clear the observed host shell. */
+export declare function resetObservedHostShell(): void;
+/**
+ * Classify a host-reported shell path into the grammar family the write
+ * detectors should apply for the `shell` tool: a PowerShell-family binary
+ * (powershell/pwsh) or cmd.exe keeps a Windows grammar eligible; ANY other
+ * basename (bash, zsh, sh, dash, ksh, fish, nu, …) is a POSIX-family
+ * executor. Separator-independent basename: the host may report a Windows
+ * path while the gate evaluates under an injected POSIX platform (and vice
+ * versa), so `path.basename` — which is separator-bound to the host — is
+ * never used here (mirrors `basenameAnySep` in shell-write-detect.ts).
+ */
+export declare function hostShellGrammarFamily(hostShell: string): 'windows' | 'posix';

package/dist/hooks/shell-write-detect.d.ts

@@ -22,6 +22,29 @@ export interface WriteTarget {
     operator: string;
     /** The file path written to, or null when the path cannot be determined statically. */
     path: string | null;
+    /**
+     * Present ONLY on inspectable POSIX inline-code interpreter evals
+     * (`python -c`, `node -e`, `bash -c`, `eval`, … — the detectInterpreterEval
+     * sites). Marks a capability write whose target the gate routes through
+     * declared scope / file authority at the eval's working directory
+     * (#1902/#3347). The opaque interpreter_eval classes (PowerShell
+     * -EncodedCommand, nested script blocks, dynamic `&`/IEX invocation,
+     * unsafe-text parse failures) deliberately do NOT set it and keep the
+     * blanket block.
+     */
+    capability?: true;
+    /**
+     * Set only for a bare POSIX `rmdir <dir>`: no options, exactly one literal
+     * operand (no expansion, glob, brace or quote characters). rmdir(2) refuses
+     * a non-empty directory (ENOTEMPTY), so this form cannot destroy file data.
+     * The shell write-scope gate uses it to skip declared-scope membership for
+     * a target that resolves inside the workspace; every other check still
+     * applies. `rmdir -p` (removes parents) and all other forms never carry it,
+     * and neither does any write of a line that runs a command outside
+     * CWD_NEUTRAL_COMMANDS or holds a character outside PLAIN_COMMAND_LINE
+     * (see detectPosixWrites).
+     */
+    emptyDirectoryRemoval?: true;
 }
 /**
  * Result of analyzing a single shell command.
@@ -51,6 +74,13 @@ export interface ResolvedWriteTarget {
      * contains command substitution ($(cmd) or `cmd`).
      */
     resolved: boolean;
+    /**
+     * For capability interpreter-eval writes only: the working directory the
+     * eval runs at, tracked through subshell `cd` commands (the starting cwd
+     * when none precedes it). The gate authorizes the eval against this
+     * directory (#1902/#3347); absent for every other write kind.
+     */
+    evalDirectory?: string;
 }
 /**
  * Issue #3099 R2 (executor context): merge a POSIX analysis with a Windows
@@ -96,6 +126,14 @@ export declare function isPowerShellShaped(command: string): boolean;
  *     detectors cannot see) fails and the command stays blocked.
  */
 export declare function isPowerShellReadOnlyPipeline(command: string): boolean;
+/**
+ * Separator-independent basename: splits on BOTH `/` and `\` so a Windows
+ * path (`C:\Python311\python.exe`) yields the same leaf under any host
+ * platform, then strips a case-insensitive `.exe` suffix. Used by the
+ * interpreter-spelling normalizer (#3343) and the host-shell classifier
+ * (#3346) — never `path.basename`, which is separator-bound to the host.
+ */
+export declare function basenameAnySep(word: string): string;
 /**
  * Detect interactive/session tools that should be denied regardless of scope.
  *

package/dist/host/v2/hooks.d.ts

@@ -77,3 +77,23 @@ export declare function registerV2ToolHooks(ctx: V2PluginContext, hooks: V1Hooks
  * warns, and only a double failure rejects.
  */
 export declare function registerV2SessionHooks(ctx: V2PluginContext, hooks: V1HooksSubset, directory: string, registrations: V2Registration[]): Promise<void>;
+/**
+ * Register the shell-executor observer hook (#3346).
+ *
+ * The v2 host reports the shell a `shell`-tool command will actually execute
+ * through `ctx.shell` "create.before" (payload carries the resolved `shell`
+ * path). Recording it in the observed-host-shell store lets the write gate
+ * and `/swarm guardrail explain` key cmd/powershell grammar inheritance on
+ * the real executor instead of the platform — closing the Git-Bash-on-Windows
+ * false-positive class from #3323/#3346.
+ *
+ * Contract (mirrors registerV2SessionHooks' bounded registration, with a
+ * softer failure mode): a host without the shell domain (pre-2.0.29-era
+ * hosts; the vendored member is optional) is a SKIP, not a failure — the
+ * gate falls back to the platform-keyed interim, never wider than today. A
+ * present-but-REJECTING registration warns through the shared
+ * warnV2HookRegistrationFailure path and is likewise non-fatal; a successful
+ * registration lands in the disposal sink. Authoritative hook observations
+ * only — this module performs no environment probing (plan-critic r2).
+ */
+export declare function registerV2ShellHooks(ctx: V2PluginContext, registrations: V2Registration[]): Promise<void>;

package/dist/host/v2/types.d.ts

@@ -97,6 +97,24 @@ export interface V2ToolEditor {
         readonly description: string;
     }): void;
 }
+/**
+ * v2 `ShellCreateBefore` payload (dist/promise/shell.d.ts @2.0.29). The
+ * `shell` field is the resolved shell PATH the host will execute the
+ * command with (upstream `ShellSelect` resolution) — the authoritative
+ * executor report the write gate keys cmd/powershell grammar inheritance
+ * on (#3346).
+ */
+export interface V2ShellCreateBefore {
+    readonly command: string;
+    readonly cwd: string;
+    readonly timeout: number;
+    readonly shell: string;
+    readonly env: Record<string, string | undefined>;
+}
+/** v2 `ShellDomain` (dist/promise/shell.d.ts @2.0.29) — hook payloads inline. */
+export interface V2ShellDomain {
+    readonly hook: <K extends 'create.before'>(event: K, handler: (payload: V2ShellCreateBefore) => Promise<void> | void) => Promise<unknown> | unknown;
+}
 /** v2 `ToolDomain` (dist/promise/tool.d.ts) — hook payloads inline. */
 export interface V2ToolDomain {
     readonly transform: (callback: (editor: V2ToolEditor) => void) => Promise<V2Registration>;
@@ -522,6 +540,15 @@ export interface V2PluginContext {
     readonly permission?: V2PermissionDomain;
     /** Present on 2.0.26 hosts; no Phase 1 code path consumes it (issue #3169). */
     readonly worktree?: V2WorktreeDomain;
+    /**
+     * v2 `ShellDomain` (dist/promise/shell.d.ts @2.0.29; the
+     * `shell.create.before` hook was added upstream 2026-07-29 and is present
+     * across the vendored 2.0.26 pin). OPTIONAL: hosts predating the domain —
+     * and the structural-type discipline of this file — treat it as absent.
+     * Consumed by `registerV2ShellHooks` (src/host/v2/hooks.ts) to observe
+     * the shell the `shell` tool actually executes (#3346).
+     */
+    readonly shell?: V2ShellDomain;
     readonly [key: string]: unknown;
 }
 /** v2 `Cleanup` — the return of `setup`. */