opencode-swarm 7.91.0 → 7.91.1

package/.opencode/skills/commit-pr/SKILL.md

@@ -146,11 +146,11 @@ node --input-type=module -e "await import('./dist/index.js'); console.log('dist
 
 ### Tier 1 - quality
 
-Run both linter AND formatter — e.g., `bunx biome check --write .` or equivalent — because CI quality gates reject code that passes tests but fails style validation.
+Run both linter AND formatter — e.g., `bunx @biomejs/biome@<version> check --write .` or equivalent — because CI quality gates reject code that passes tests but fails style validation. **Pin the tool version** to match the version in `package.json` (`@biomejs/biome`); unversioned `bunx biome` resolves to a different version than the CI gate uses.
 
 ```bash
 bun run typecheck
-bunx biome ci .
+bunx @biomejs/biome@<version> ci .
 ```
 
 ### Tier 2 - unit tests
@@ -392,6 +392,26 @@ $issueCommentPath = Join-Path ([System.IO.Path]::GetTempPath()) "issue-comment.t
 gh issue comment <issue-number> --body-file $issueCommentPath
 ````
 
+## Commit messages
+
+`git commit -m "..."` with parens, brackets, backticks, or dollar-signs in the message fails on PowerShell because the shell parses them as expressions. Write the commit message to a UTF-8 (no BOM) file first and use `git commit -F <file>`.
+
+PowerShell-safe pattern:
+
+```powershell
+$msg = @"
+<type>(<scope>): <description>
+
+<optional body — note this is for the git commit message, NOT the PR body>
+"@
+$utf8NoBom = New-Object -TypeName System.Text.UTF8Encoding -ArgumentList $false
+$commitMsgPath = Join-Path ([System.IO.Path]::GetTempPath()) "commit-msg.txt"
+[System.IO.File]::WriteAllText($commitMsgPath, $msg, $utf8NoBom)
+git commit -F $commitMsgPath
+```
+
+Apply this pattern for any commit message containing special characters, multi-paragraph bodies, or code blocks. The plain `git commit -m "..."` form remains fine for short single-line messages with no special characters.
+
 If the PR merged before this was done, post the missing issue comment immediately.
 
 ## Step 7 - Existing PR follow-up and closeout

package/.opencode/skills/engineering-conventions/SKILL.md

@@ -55,3 +55,15 @@ The OpenCode `test_runner` tool is for **targeted agent validation** with explic
 Every PR that touches a relevant area must include an `## Invariant audit` section in its description. The format is in `AGENTS.md` ("Invariant audit required in PRs"). The `commit-pr` skill enforces this gate before push/PR — load it before committing.
 
 If you cannot prove a touched invariant from source and test output, **do not push**.
+
+## Tool version parity (local vs CI)
+
+**Tool versions must match CI.** When `package.json` pins a tool version (e.g., `@biomejs/biome@2.3.14`, `@biomejs/biome@^2`, or any other versioned dev dependency), invoke it **with the pinned version** during local validation. Unversioned `bunx biome` resolves to a different version than the CI gate uses, and a CI-blocking failure can be invisible to local pre-commit validation.
+
+Examples:
+- Pinned biome: `bunx @biomejs/biome@<version> ci .` (substitute `<version>` from `package.json`).
+- Unversioned `bunx biome ci .` resolves to whatever Bun's `bunx` registry returns at run time — historically 0.3.x vs the pinned 2.x.
+
+The `commit-pr` skill Tier 1 - quality section pins the biome command to the package.json version; this is the canonical pattern for any tool where local and CI versions could diverge. Apply the same discipline to ESLint, Prettier, TypeScript, and any other versioned dev dependency.
+
+**Why this matters:** PR #1503 (telemetry rotation fix) had a biome 2.3.14 `organizeImports` failure on the `./telemetry` import block that was invisible to local `bunx biome` (which resolved to 0.3.3 with no equivalent rule). The reviewer caught it from CI logs, not local validation. Pin tool versions to close the local/CI parity gap.

package/.opencode/skills/swarm-pr-feedback/SKILL.md

@@ -167,6 +167,16 @@ branches or prior work sessions.
 
 *Reference: Caught during PR #1472 Round 1 closure.*
 
+## Pre-flight: Scope Discipline
+
+`declare_scope({ taskId, files })` enforces that the delegated coder agent may only modify the declared files. The enforcement requires an active `.swarm/plan.json` — calling `declare_scope` in a feedback-closure run (which does not go through `save_plan`) rejects with "No plan found."
+
+**When to use `declare_scope` (preferred):** any feedback round that touches 2+ files, OR any feedback round where the file scope is not 100% obvious from the prompt. Before delegating, save a minimal plan via `save_plan` with a single phase containing the feedback-closure tasks, then call `declare_scope` per task with the exact file list.
+
+**Carve-out for direct Task delegation:** 1-file, single-function changes where the file path appears verbatim in the coder's prompt may use direct `Task(subagent_type="paid_coder", ...)` delegation without `declare_scope`. This is a narrow exception; the orchestrator is responsible for verifying the scope is unambiguous.
+
+**Anti-pattern:** do not use `Task` delegation for multi-file feedback fixes just to skip `save_plan` — the loss of scope discipline is not worth the saved ceremony.
+
 ## Intake Surfaces
 
 Build a complete feedback ledger before editing. Include every available source:

package/.opencode/skills/swarm-pr-review/SKILL.md

@@ -741,9 +741,15 @@ The critic must challenge:
 Critic output format:
 
 ```text
-[CRITIC] | finding_id | UPHELD / DOWNGRADED / DISPROVED / NEEDS_MORE_EVIDENCE | final_severity | reason | required_report_change
+[CRITIC] | finding_id | UPHELD/DOWNGRADED/DISPROVED/NEEDS_MORE_EVIDENCE | final_severity | reason | required_report_change
 ```
 
+## Verdict row contract
+
+The `[CRITIC]` row in the format above is **mandatory contract**, not advisory output. A critic response that does not end with that exact row format is treated as a planning preamble, not a verdict, and must be re-dispatched. Do not proceed past Phase 8 join barrier until each dispatched critic lane has produced a parseable `[CRITIC]` row.
+
+**Re-dispatch trigger:** when a critic lane response is missing the verdict row, the orchestrator must automatically re-dispatch that lane with the explicit instruction: "Your final line MUST be exactly the Phase 8 contract row: `[CRITIC] | finding_id | UPHELD/DOWNGRADED/DISPROVED/NEEDS_MORE_EVIDENCE | final_severity | reason | required_report_change`. A response without that exact row will be treated as a planning message and re-dispatched." Do not synthesize findings from the planning preamble; only from the re-dispatched verdict.
+
 Refuted findings become `DISPROVED` or `ADVISORY`, depending on critic rationale. Downgrades must be listed in the final validation provenance.
 
 ---
@@ -1371,6 +1377,11 @@ For each finding, challenge:
 
 Return:
 [CRITIC] | finding_id | UPHELD/DOWNGRADED/DISPROVED/NEEDS_MORE_EVIDENCE | final_severity | reason | required_report_change
+
+REQUIRED FINAL LINE — your final line MUST be exactly the row above (no variations, no labeled fields, no placeholders):
+[CRITIC] | finding_id | UPHELD/DOWNGRADED/DISPROVED/NEEDS_MORE_EVIDENCE | final_severity | reason | required_report_change
+
+A response without this exact row is treated as a planning preamble and re-dispatched. Do not output only a planning or investigation message.
 ```
 
 ---

package/dist/cli/{guardrail-explain-0ephhnjq.js → guardrail-explain-h2007ev1.js}

@@ -1,8 +1,8 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-wtyysb1n.js";
-import"./index-e9tp9p2w.js";
+} from "./index-sxm9y9a5.js";
+import"./index-h1cjgz2r.js";
 import"./index-6tnmt41c.js";
 import"./index-bm4f0nme.js";
 import"./index-5hrexm02.js";

package/dist/cli/{index-gpkbg9p4.js → index-07qr9he0.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-wtyysb1n.js";
+} from "./index-sxm9y9a5.js";
 import {
   handleGuardrailLog
 } from "./index-gg589mfw.js";
@@ -78,7 +78,7 @@ import {
   handleWriteRetroCommand,
   normalizeSwarmCommandInput,
   resolveCommand
-} from "./index-e9tp9p2w.js";
+} from "./index-h1cjgz2r.js";
 import"./index-6tnmt41c.js";
 import"./index-bm4f0nme.js";
 import"./index-5hrexm02.js";

package/dist/cli/{index-e9tp9p2w.js → index-h1cjgz2r.js}

@@ -906,7 +906,7 @@ var init_executor = __esm(() => {
 // package.json
 var package_default = {
   name: "opencode-swarm",
-  version: "7.91.0",
+  version: "7.91.1",
   description: "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -30387,7 +30387,7 @@ function buildDetailedHelp(commandName, entry) {
 async function handleHelpCommand(ctx) {
   const targetCommand = ctx.args.join(" ");
   if (!targetCommand) {
-    const { buildHelpText } = await import("./index-gpkbg9p4.js");
+    const { buildHelpText } = await import("./index-07qr9he0.js");
     return buildHelpText();
   }
   const tokens = targetCommand.split(/\s+/);
@@ -30396,7 +30396,7 @@ async function handleHelpCommand(ctx) {
     return _internals45.buildDetailedHelp(resolved.key, resolved.entry);
   }
   const similar = _internals45.findSimilarCommands(targetCommand);
-  const { buildHelpText: fullHelp } = await import("./index-gpkbg9p4.js");
+  const { buildHelpText: fullHelp } = await import("./index-07qr9he0.js");
   if (similar.length > 0) {
     return `Command '/swarm ${targetCommand}' not found.
 
@@ -30529,7 +30529,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-0ephhnjq.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-h2007ev1.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",

package/dist/cli/{index-wtyysb1n.js → index-sxm9y9a5.js}

@@ -12,7 +12,7 @@ import {
   detectPosixWrites,
   detectWindowsWrites,
   resolveWriteTargets
-} from "./index-e9tp9p2w.js";
+} from "./index-h1cjgz2r.js";
 import {
   checkFileAuthority,
   classifyFile,

package/dist/cli/index.js

@@ -7,7 +7,7 @@ import {
   getPluginLockFilePaths,
   package_default,
   resolveCommand
-} from "./index-e9tp9p2w.js";
+} from "./index-h1cjgz2r.js";
 import"./index-6tnmt41c.js";
 import"./index-bm4f0nme.js";
 import"./index-5hrexm02.js";

package/dist/index.js

@@ -69,7 +69,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "opencode-swarm",
-    version: "7.91.0",
+    version: "7.91.1",
     description: "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
     main: "dist/index.js",
     types: "dist/index.d.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.91.0",
+	"version": "7.91.1",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",