opencode-swarm 7.29.3 → 7.29.4

package/dist/cli/index.js

@@ -34,7 +34,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "opencode-swarm",
-    version: "7.29.3",
+    version: "7.29.4",
     description: "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
     main: "dist/index.js",
     types: "dist/index.d.ts",
@@ -19857,15 +19857,36 @@ function validateProjectRoot(directory) {
     throw new Error(`Cannot verify project root for "${directory}" \u2014 directory may not exist or is inaccessible`);
   }
   let current = resolved;
+  let depth = 0;
   while (true) {
+    if (depth >= MAX_DEPTH)
+      break;
+    depth++;
     const parent = path7.dirname(current);
     if (parent === current)
       break;
     const parentSwarm = path7.join(parent, ".swarm");
     try {
       if (statSync4(parentSwarm).isDirectory()) {
-        warn(`[evidence] Rejecting write to subdirectory "${resolved}" \u2014 parent "${parent}" already contains .swarm/`);
-        throw new Error(`Cannot write evidence in "${resolved}" \u2014 parent directory "${parent}" already contains a .swarm/ folder. Evidence must be written to the project root.`);
+        let hasProjectIndicator = false;
+        for (const indicator of PROJECT_INDICATORS) {
+          try {
+            const indicatorStat = statSync4(path7.join(parent, indicator));
+            if (indicatorStat.isFile() || indicatorStat.isDirectory()) {
+              hasProjectIndicator = true;
+              break;
+            }
+          } catch (error49) {
+            if (error49 instanceof Error && "code" in error49 && error49.code === "ENOENT") {} else {
+              hasProjectIndicator = true;
+              break;
+            }
+          }
+        }
+        if (hasProjectIndicator) {
+          warn(`[evidence] Rejecting write to subdirectory "${resolved}" \u2014 parent "${parent}" already contains .swarm/`);
+          throw new Error(`Cannot write evidence in "${resolved}" \u2014 parent directory "${parent}" already contains a .swarm/ folder. Evidence must be written to the project root.`);
+        }
       }
     } catch (error49) {
       if (error49 instanceof Error && error49.message.startsWith("Cannot write evidence")) {
@@ -20108,7 +20129,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles) {
   }
   return archived;
 }
-var VALID_EVIDENCE_TYPES, sanitizeTaskId2, LEGACY_TASK_COMPLEXITY_MAP, _internals5;
+var VALID_EVIDENCE_TYPES, sanitizeTaskId2, MAX_DEPTH = 20, PROJECT_INDICATORS, LEGACY_TASK_COMPLEXITY_MAP, _internals5;
 var init_manager2 = __esm(() => {
   init_zod();
   init_evidence_schema();
@@ -20133,6 +20154,19 @@ var init_manager2 = __esm(() => {
     "secretscan"
   ];
   sanitizeTaskId2 = sanitizeTaskId;
+  PROJECT_INDICATORS = [
+    "package.json",
+    ".git",
+    ".opencode",
+    "Cargo.toml",
+    "go.mod",
+    "pyproject.toml",
+    "Gemfile",
+    "composer.json",
+    "pom.xml",
+    "build.gradle",
+    "CMakeLists.txt"
+  ];
   LEGACY_TASK_COMPLEXITY_MAP = {
     low: "simple",
     medium: "moderate",
@@ -40693,10 +40727,10 @@ function detectStraySwarmDirs(projectRoot) {
     "__pycache__",
     ".tox"
   ]);
-  const MAX_DEPTH = 10;
+  const MAX_DEPTH2 = 10;
   const MAX_CONTENTS_ENTRIES = 20;
   function walk(dir, depth) {
-    if (depth > MAX_DEPTH)
+    if (depth > MAX_DEPTH2)
       return;
     let entries;
     try {

package/dist/evidence/manager.d.ts

@@ -38,11 +38,17 @@ export declare function isQualityBudgetEvidence(evidence: Evidence): evidence is
 export declare function isSecretscanEvidence(evidence: Evidence): evidence is SecretscanEvidence;
 import { sanitizeTaskId as _sanitizeTaskId } from '../validation/task-id';
 export declare const sanitizeTaskId: typeof _sanitizeTaskId;
+/** Maximum depth to walk up the directory tree before stopping (fail-open). */
+export declare const MAX_DEPTH = 20;
+/** File/directory names that indicate a real project root. */
+export declare const PROJECT_INDICATORS: readonly ["package.json", ".git", ".opencode", "Cargo.toml", "go.mod", "pyproject.toml", "Gemfile", "composer.json", "pom.xml", "build.gradle", "CMakeLists.txt"];
 /**
  * Defense-in-depth: verify that `directory` is the project root and not a subdirectory
  * of a project that already has a .swarm/ at its root.
- * Walks up the directory tree to filesystem root looking for a parent .swarm/ directory.
- * @throws Error if a parent directory contains .swarm/
+ * Walks up the directory tree (bounded by MAX_DEPTH) looking for a parent .swarm/ directory.
+ * When .swarm/ is found, checks for at least one PROJECT_INDICATORS entry to distinguish
+ * real projects from stray artifacts (e.g. `C:\.swarm`).
+ * @throws Error if a parent directory contains both .swarm/ and a project indicator
  */
 export declare function validateProjectRoot(directory: string): void;
 /**

package/dist/index.js

@@ -48,7 +48,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "opencode-swarm",
-    version: "7.29.3",
+    version: "7.29.4",
     description: "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
     main: "dist/index.js",
     types: "dist/index.d.ts",
@@ -20692,15 +20692,36 @@ function validateProjectRoot(directory) {
     throw new Error(`Cannot verify project root for "${directory}" — directory may not exist or is inaccessible`);
   }
   let current = resolved;
+  let depth = 0;
   while (true) {
+    if (depth >= MAX_DEPTH)
+      break;
+    depth++;
     const parent = path8.dirname(current);
     if (parent === current)
       break;
     const parentSwarm = path8.join(parent, ".swarm");
     try {
       if (statSync5(parentSwarm).isDirectory()) {
-        warn(`[evidence] Rejecting write to subdirectory "${resolved}" — parent "${parent}" already contains .swarm/`);
-        throw new Error(`Cannot write evidence in "${resolved}" — parent directory "${parent}" already contains a .swarm/ folder. Evidence must be written to the project root.`);
+        let hasProjectIndicator = false;
+        for (const indicator of PROJECT_INDICATORS) {
+          try {
+            const indicatorStat = statSync5(path8.join(parent, indicator));
+            if (indicatorStat.isFile() || indicatorStat.isDirectory()) {
+              hasProjectIndicator = true;
+              break;
+            }
+          } catch (error49) {
+            if (error49 instanceof Error && "code" in error49 && error49.code === "ENOENT") {} else {
+              hasProjectIndicator = true;
+              break;
+            }
+          }
+        }
+        if (hasProjectIndicator) {
+          warn(`[evidence] Rejecting write to subdirectory "${resolved}" — parent "${parent}" already contains .swarm/`);
+          throw new Error(`Cannot write evidence in "${resolved}" — parent directory "${parent}" already contains a .swarm/ folder. Evidence must be written to the project root.`);
+        }
       }
     } catch (error49) {
       if (error49 instanceof Error && error49.message.startsWith("Cannot write evidence")) {
@@ -20943,7 +20964,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles) {
   }
   return archived;
 }
-var VALID_EVIDENCE_TYPES, sanitizeTaskId2, LEGACY_TASK_COMPLEXITY_MAP, _internals8;
+var VALID_EVIDENCE_TYPES, sanitizeTaskId2, MAX_DEPTH = 20, PROJECT_INDICATORS, LEGACY_TASK_COMPLEXITY_MAP, _internals8;
 var init_manager2 = __esm(() => {
   init_zod();
   init_evidence_schema();
@@ -20968,6 +20989,19 @@ var init_manager2 = __esm(() => {
     "secretscan"
   ];
   sanitizeTaskId2 = sanitizeTaskId;
+  PROJECT_INDICATORS = [
+    "package.json",
+    ".git",
+    ".opencode",
+    "Cargo.toml",
+    "go.mod",
+    "pyproject.toml",
+    "Gemfile",
+    "composer.json",
+    "pom.xml",
+    "build.gradle",
+    "CMakeLists.txt"
+  ];
   LEGACY_TASK_COMPLEXITY_MAP = {
     low: "simple",
     medium: "moderate",
@@ -61619,10 +61653,10 @@ function detectStraySwarmDirs(projectRoot) {
     "__pycache__",
     ".tox"
   ]);
-  const MAX_DEPTH = 10;
+  const MAX_DEPTH2 = 10;
   const MAX_CONTENTS_ENTRIES = 20;
   function walk(dir, depth) {
-    if (depth > MAX_DEPTH)
+    if (depth > MAX_DEPTH2)
       return;
     let entries;
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.29.3",
+	"version": "7.29.4",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",