opencode-swarm 7.21.0 → 7.21.2

package/dist/cli/index.js

@@ -34,7 +34,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "opencode-swarm",
-    version: "7.21.0",
+    version: "7.21.2",
     description: "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
     main: "dist/index.js",
     types: "dist/index.d.ts",

package/dist/index.js

@@ -33,7 +33,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "opencode-swarm",
-    version: "7.21.0",
+    version: "7.21.2",
     description: "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
     main: "dist/index.js",
     types: "dist/index.d.ts",
@@ -24922,6 +24922,46 @@ function createGuardrailsHooks(directory, directoryOrConfig, config2, authorityC
       if (/^mkfs[./]/.test(seg)) {
         throw new Error(`BLOCKED: Disk format command (mkfs) detected — disk formatting operation`);
       }
+      if (/^\\?mv\s/i.test(seg)) {
+        const mvMatch = seg.match(/^\\?mv\s+(.+)$/i);
+        if (mvMatch) {
+          const argsStr = mvMatch[1];
+          const strippedArgs = argsStr.replace(/["']/g, "");
+          if (/\.swarm(?:[\x5c/\s]|$)/.test(strippedArgs)) {
+            throw new Error(`BLOCKED: "mv" targeting .swarm/ detected — move operations under .swarm/ are not allowed from shell commands`);
+          }
+        }
+      }
+      if (/^\\?(?:move|ren)(?:\.exe)?\s/i.test(seg)) {
+        const moveMatch = seg.match(/^\\?(?:move|ren)(?:\.exe)?\s+(.+)$/i);
+        if (moveMatch) {
+          const argsStr = moveMatch[1].replace(/["']/g, "");
+          if (/\.swarm(?:[\x5c/\s]|$)/i.test(argsStr)) {
+            throw new Error(`BLOCKED: "move" or "ren" targeting .swarm/ detected — move/rename operations under .swarm/ are not allowed from shell commands`);
+          }
+        }
+      }
+      if (/^\\?(?:Move-Item|Rename-Item|move|mi|mv|ren|rni)\b.*\.swarm(?:[\x5c/\s]|$)/i.test(seg)) {
+        throw new Error(`BLOCKED: PowerShell Move-Item or Rename-Item targeting .swarm/ detected — move/rename operations under .swarm/ are not allowed from shell commands`);
+      }
+      if (/^\\?rm\b/i.test(seg) && !/^\\?rm\s+(?:-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)\b/i.test(seg) && /\.swarm(?:[\x5c/\s]|$)/i.test(seg)) {
+        throw new Error(`BLOCKED: "rm" targeting .swarm/ detected — deleting files under .swarm/ is not allowed from shell commands`);
+      }
+      if (/\bcp\b.*\.swarm(?:[\x5c/\s]|$)/i.test(seg) && /\brm\b.*\.swarm(?:[\x5c/\s]|$)/i.test(seg)) {
+        throw new Error(`BLOCKED: "cp" of .swarm/ file followed by "rm" of .swarm/ source detected — copy-and-delete bypass is not allowed`);
+      }
+      if (/^rsync\b.*--remove-source-files\b/i.test(seg) && /\.swarm(?:[\x5c/\s]|$)/i.test(seg)) {
+        throw new Error(`BLOCKED: "rsync" with delete-source flag targeting .swarm/ detected — archive with source deletion under .swarm/ is not allowed`);
+      }
+      if (/^tar\b.*--remove-files\b/i.test(seg) && /\.swarm(?:[\x5c/\s]|$)/i.test(seg)) {
+        throw new Error(`BLOCKED: "tar" with delete-source flag targeting .swarm/ detected — archive with source deletion under .swarm/ is not allowed`);
+      }
+      if (/^zip\b.*\s-m\b/i.test(seg) && /\.swarm(?:[\x5c/\s]|$)/i.test(seg)) {
+        throw new Error(`BLOCKED: "zip" with delete-source flag targeting .swarm/ detected — archive with source deletion under .swarm/ is not allowed`);
+      }
+      if (/^7z\b.*\s-sdel\b/i.test(seg) && /\.swarm(?:[\x5c/\s]|$)/i.test(seg)) {
+        throw new Error(`BLOCKED: "7z" with delete-source flag targeting .swarm/ detected — archive with source deletion under .swarm/ is not allowed`);
+      }
     }
   }
   async function checkGateLimits(params) {
@@ -62574,6 +62614,7 @@ If a tool modifies a file, it is a CODER tool. Delegate.
   - Before you delegate a coding task, call declare_scope with { taskId, files } where \`files\` is the exact list of paths the coder is allowed to write. Bundle any generated/lockfile paths that the change will produce (e.g. package-lock.json, Cargo.lock, dist/*).
   - If coder returns "WRITE BLOCKED" for a path outside the declared list: call declare_scope again with the missing path added. Do NOT instruct the coder to use bash, sed, echo, cat, tee, dd, or any interpreter eval (python -c, node -e, bun -e, ruby -e) to bypass the block. Those routes bypass the authority check and violate scope discipline.
   - Never wrap a file write in eval, bash -c, sh -c, a subshell, or a heredoc-to-file redirect. Those are bash workarounds and are banned even when scope appears to permit them — the write-authority guard is tool-scoped; bash is unguarded and must not be used as a write path.
+  - Do NOT use mv, Move-Item, move, ren, Rename-Item, or cp-then-rm chains to relocate, rename, or delete files under \`.swarm/\` as a workaround for blocked destructive commands. Those are file-move shell bypasses and are banned. Use the tool's dedicated tools (\`.swarm/\` file management or evidence manager tools) instead.
   - If you cannot enumerate files up front (e.g. a broad refactor), declare the containing directories — declare_scope accepts directory entries and grants containment.
   - Rationale: declare_scope persists the allowed set to disk (.swarm/scopes/scope-\${taskId}.json) so it survives cross-process delegation. Without a call, the coder process reads an empty scope and every Edit/Write is denied.
 <!-- BEHAVIORAL_GUIDANCE_END -->
@@ -90226,6 +90267,7 @@ function phaseIsExplicitlyNonCode(directory, phase) {
 }
 
 // src/tools/phase-complete.ts
+init_gate_evidence();
 init_curator();
 init_knowledge_curator();
 init_knowledge_reader();
@@ -90761,6 +90803,23 @@ function safeWarn(message, error93) {
     warn(message, error93 instanceof Error ? error93.message : String(error93));
   } catch {}
 }
+var TASK_GATE_INFERABLE_AGENTS = new Set([
+  "coder",
+  "reviewer",
+  "test_engineer"
+]);
+function canInferMissingAgentsFromTaskGates(agentsMissing) {
+  return agentsMissing.every((agent) => TASK_GATE_INFERABLE_AGENTS.has(agent));
+}
+async function allCompletedTasksHavePassedGateEvidence(directory, tasks) {
+  for (const task of tasks) {
+    if (task.status !== "completed")
+      return false;
+    if (!await hasPassedAllGates(directory, task.id))
+      return false;
+  }
+  return tasks.length > 0;
+}
 function collectCrossSessionDispatchedAgents(phaseReferenceTimestamp, callerSessionId) {
   const agents = new Set;
   const contributorSessionIds = [];
@@ -90772,12 +90831,9 @@ function collectCrossSessionDispatchedAgents(phaseReferenceTimestamp, callerSess
         agents.add(agent);
       }
     }
-    const callerDelegations = swarmState.delegationChains.get(callerSessionId);
-    if (callerDelegations) {
-      for (const delegation of callerDelegations) {
-        agents.add(stripKnownSwarmPrefix(delegation.from));
-        agents.add(stripKnownSwarmPrefix(delegation.to));
-      }
+    for (const delegation of _getDelegationsSince(callerSessionId, phaseReferenceTimestamp)) {
+      agents.add(stripKnownSwarmPrefix(delegation.from));
+      agents.add(stripKnownSwarmPrefix(delegation.to));
     }
   }
   for (const [sessionId, session] of swarmState.agentSessions) {
@@ -90796,17 +90852,24 @@ function collectCrossSessionDispatchedAgents(phaseReferenceTimestamp, callerSess
           agents.add(agent);
         }
       }
-      const delegations2 = swarmState.delegationChains.get(sessionId);
-      if (delegations2) {
-        for (const delegation of delegations2) {
-          agents.add(stripKnownSwarmPrefix(delegation.from));
-          agents.add(stripKnownSwarmPrefix(delegation.to));
-        }
+      for (const delegation of _getDelegationsSince(sessionId, phaseReferenceTimestamp)) {
+        agents.add(stripKnownSwarmPrefix(delegation.from));
+        agents.add(stripKnownSwarmPrefix(delegation.to));
       }
     }
   }
   return { agents, contributorSessionIds };
 }
+function _getDelegationsSince(sessionID, sinceTimestamp) {
+  const chain = swarmState.delegationChains.get(sessionID);
+  if (!chain) {
+    return [];
+  }
+  if (sinceTimestamp === 0) {
+    return chain;
+  }
+  return chain.filter((entry) => entry.timestamp > sinceTimestamp);
+}
 function isValidRetroEntry(entry, phase) {
   return entry.type === "retrospective" && "phase_number" in entry && entry.phase_number === phase && "verdict" in entry && entry.verdict === "pass";
 }
@@ -91752,8 +91815,8 @@ Advisory notes: ${advisoryNotes.join("; ")}` : "";
       const planRaw = fs84.readFileSync(planPath, "utf-8");
       const plan = JSON.parse(planRaw);
       const targetPhase = plan.phases.find((p) => p.id === phase);
-      if (targetPhase && targetPhase.tasks.length > 0 && targetPhase.tasks.every((t) => t.status === "completed")) {
-        warnings.push(`Agent dispatch fallback: all ${targetPhase.tasks.length} tasks in phase ${phase} are completed in plan.json. Clearing missing agents: ${agentsMissing.join(", ")}.`);
+      if (targetPhase && targetPhase.tasks.length > 0 && canInferMissingAgentsFromTaskGates(agentsMissing) && await allCompletedTasksHavePassedGateEvidence(dir, targetPhase.tasks)) {
+        warnings.push(`Agent dispatch fallback: all ${targetPhase.tasks.length} tasks in phase ${phase} are completed in plan.json and durable gate evidence passed. Clearing missing agents: ${agentsMissing.join(", ")}.`);
         agentsMissing = [];
       }
     } catch {}
@@ -103343,6 +103406,13 @@ function matchesTier3Pattern2(files) {
   }
   return false;
 }
+function hasPassedDurableGateEvidence(workingDirectory, taskId) {
+  const evidence = readTaskEvidenceRaw(workingDirectory, taskId);
+  if (!evidence || !Array.isArray(evidence.required_gates) || evidence.required_gates.length === 0) {
+    return false;
+  }
+  return evidence.required_gates.every((gate) => evidence.gates?.[gate] != null);
+}
 function checkReviewerGate(taskId, workingDirectory, stageBParallelEnabled = false, sessionID) {
   try {
     let skipStandardTurboBypass = false;
@@ -103389,12 +103459,11 @@ function checkReviewerGate(taskId, workingDirectory, stageBParallelEnabled = fal
     try {
       const evidence = readTaskEvidenceRaw(resolvedDir, taskId);
       if (evidence === null) {} else if (evidence.required_gates && Array.isArray(evidence.required_gates) && evidence.gates) {
-        const allGatesMet = evidence.required_gates.every((gate) => evidence.gates[gate] != null);
-        if (allGatesMet) {
+        if (evidence.required_gates.length > 0 && evidence.required_gates.every((gate) => evidence.gates[gate] != null)) {
           return { blocked: false, reason: "" };
         }
         const missingGates = evidence.required_gates.filter((gate) => evidence.gates[gate] == null);
-        evidenceIncompleteReason = `Task ${taskId} is missing required gates: [${missingGates.join(", ")}]. ` + `Required: [${evidence.required_gates.join(", ")}]. ` + `Completed: [${Object.keys(evidence.gates).join(", ")}]. ` + `Delegate the missing gate agents before marking task as completed.`;
+        evidenceIncompleteReason = evidence.required_gates.length === 0 ? `Task ${taskId} has an evidence file with no required gates. Delegate reviewer and test_engineer before marking task as completed.` : `Task ${taskId} is missing required gates: [${missingGates.join(", ")}]. ` + `Required: [${evidence.required_gates.join(", ")}]. ` + `Completed: [${Object.keys(evidence.gates).join(", ")}]. ` + `Delegate the missing gate agents before marking task as completed.`;
       }
     } catch (error93) {
       console.warn(`[gate-evidence] Evidence file for task ${taskId} is corrupt or unreadable:`, error93 instanceof Error ? error93.message : String(error93));
@@ -103404,7 +103473,7 @@ function checkReviewerGate(taskId, workingDirectory, stageBParallelEnabled = fal
         reason: `Evidence file for task ${taskId} is corrupt or unreadable. ` + `Fix the file at .swarm/evidence/${taskId}.json or delete it to fall through to session state.`
       };
     }
-    if (swarmState.agentSessions.size === 0) {
+    if (swarmState.agentSessions.size === 0 && !evidenceIncompleteReason) {
       return { blocked: false, reason: "" };
     }
     let validSessionCount = 0;
@@ -103421,7 +103490,7 @@ function checkReviewerGate(taskId, workingDirectory, stageBParallelEnabled = fal
         return { blocked: false, reason: "" };
       }
     }
-    if (validSessionCount === 0) {
+    if (validSessionCount === 0 && !evidenceIncompleteReason) {
       return { blocked: false, reason: "" };
     }
     const stateEntries = [];
@@ -103438,7 +103507,7 @@ function checkReviewerGate(taskId, workingDirectory, stageBParallelEnabled = fal
       const plan = JSON.parse(planRaw);
       for (const planPhase of plan.phases ?? []) {
         for (const task of planPhase.tasks ?? []) {
-          if (task.id === taskId && task.status === "completed") {
+          if (task.id === taskId && task.status === "completed" && hasPassedDurableGateEvidence(resolvedDir2, taskId)) {
             return { blocked: false, reason: "" };
           }
         }
@@ -103459,26 +103528,6 @@ function checkReviewerGate(taskId, workingDirectory, stageBParallelEnabled = fal
           }
         }
       }
-      if (!hasReviewer && !hasTestEngineer) {
-        for (const [, chain] of swarmState.delegationChains) {
-          let lastCoderIndex = -1;
-          for (let i2 = chain.length - 1;i2 >= 0; i2--) {
-            const target = stripKnownSwarmPrefix(chain[i2].to);
-            if (target === "coder") {
-              lastCoderIndex = i2;
-              break;
-            }
-          }
-          const searchStart = lastCoderIndex === -1 ? 0 : lastCoderIndex + 1;
-          for (let i2 = searchStart;i2 < chain.length; i2++) {
-            const target = stripKnownSwarmPrefix(chain[i2].to);
-            if (target === "reviewer")
-              hasReviewer = true;
-            if (target === "test_engineer")
-              hasTestEngineer = true;
-          }
-        }
-      }
       if (hasReviewer && hasTestEngineer) {
         return { blocked: false, reason: "" };
       }
@@ -103521,26 +103570,6 @@ function recoverTaskStateFromDelegations(taskId) {
       }
     }
   }
-  if (!hasReviewer && !hasTestEngineer) {
-    for (const [, chain] of swarmState.delegationChains) {
-      let lastCoderIndex = -1;
-      for (let i2 = chain.length - 1;i2 >= 0; i2--) {
-        const target = stripKnownSwarmPrefix(chain[i2].to);
-        if (target === "coder") {
-          lastCoderIndex = i2;
-          break;
-        }
-      }
-      const searchStart = lastCoderIndex === -1 ? 0 : lastCoderIndex + 1;
-      for (let i2 = searchStart;i2 < chain.length; i2++) {
-        const target = stripKnownSwarmPrefix(chain[i2].to);
-        if (target === "reviewer")
-          hasReviewer = true;
-        if (target === "test_engineer")
-          hasTestEngineer = true;
-      }
-    }
-  }
   if (!hasReviewer && !hasTestEngineer)
     return;
   for (const [, session] of swarmState.agentSessions) {

package/dist/tools/update-task-status.d.ts

@@ -66,11 +66,10 @@ export declare function checkReviewerGate(taskId: string, workingDirectory?: str
 export declare function checkReviewerGateWithScope(taskId: string, workingDirectory?: string, sessionID?: string): Promise<ReviewerGateResult>;
 /**
  * Recovery mechanism: reconcile task state with delegation history.
- * When reviewer/test_engineer delegations occurred but the state machine
- * was not advanced (e.g., toolAfter didn't fire, subagent_type missing,
- * cross-session gaps, or pure verification tasks without coder delegation),
- * this function walks all delegation chains and advances the task state
- * so that checkReviewerGate can make an accurate decision.
+ * When task-scoped reviewer/test_engineer delegations occurred but the state
+ * machine was not advanced (e.g., toolAfter didn't fire or subagent_type was
+ * missing), this function advances the task state so that checkReviewerGate can
+ * make an accurate decision without attributing unrelated delegation activity.
  *
  * @param taskId - The task ID to recover state for
  */

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.21.0",
+	"version": "7.21.2",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",