opencode-swarm 7.99.0 → 7.99.2

package/dist/cli/{index-wwnjw0fb.js → index-6wgwybzj.js}

@@ -8,7 +8,7 @@ import {
 import {
   readSwarmFileAsync,
   validateSwarmPath
-} from "./index-we94wkty.js";
+} from "./index-94qwbx11.js";
 import {
   readCachedParsedFile
 } from "./index-jtqkh8jf.js";
@@ -939,6 +939,26 @@ var _internals2 = {
 // src/turbo/lean/conflicts.ts
 import * as fs3 from "fs";
 import * as path3 from "path";
+
+// src/utils/path.ts
+function normalizePath(p) {
+  if (!p)
+    return "";
+  let result = p.replace(/\\/g, "/").replace(/\/+/g, "/").replace(/^\.\//, "").replace(/(?:^|\/)\.\//g, "/");
+  result = result.replace(/\/$/, "");
+  result = result.replace(/\/\.$/, "");
+  if (process.platform === "win32")
+    result = result.toLowerCase();
+  if (!result) {
+    const norm = p.replace(/\\/g, "/");
+    if (norm === "." || norm === "./")
+      return ".";
+    return "";
+  }
+  return result;
+}
+
+// src/turbo/lean/conflicts.ts
 var DEFAULT_GLOBAL_FILES = [
   "package.json",
   "package-lock.json",
@@ -997,18 +1017,6 @@ var BARREL_FILE_PATTERNS = [
   /\/exports\.ts$/,
   /\/types\.ts$/
 ];
-function normalizePath(filePath) {
-  if (filePath === "." || filePath === "./") {
-    return ".";
-  }
-  let result = filePath.replace(/\\/g, "/").replace(/\/+/g, "/").replace(/^\.\//, "").replace(/(?:^|\/)\.\//g, "/");
-  result = result.replace(/\/$/, "");
-  result = result.replace(/\/\.$/, "");
-  if (process.platform === "win32") {
-    result = result.toLowerCase();
-  }
-  return result;
-}
 function pathsConflict(path1, path22) {
   if (process.platform === "win32") {
     path1 = path1.toLowerCase();
@@ -3535,6 +3543,7 @@ async function saveEvidence(directory, taskId, evidence) {
   const sanitizedTaskId = sanitizeTaskId2(taskId);
   const relativePath = path7.join("evidence", sanitizedTaskId, "evidence.json");
   validateSwarmPath(directory, relativePath);
+  _internals5.validateEvidence(evidence);
   return withEvidenceLock(directory, relativePath, "evidence-manager", sanitizedTaskId, async () => {
     const evidencePath = validateSwarmPath(directory, relativePath);
     const evidenceDir = path7.dirname(evidencePath);
@@ -3771,11 +3780,15 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles) {
   }
   return archived;
 }
+function validateEvidence(evidence) {
+  return EvidenceSchema.parse(evidence);
+}
 var _internals5 = {
   wrapFlatRetrospective,
   loadEvidence,
   listEvidenceTaskIds,
-  validateProjectRoot
+  validateProjectRoot,
+  validateEvidence
 };
 
 // src/evidence/gate-bridge.ts

package/dist/cli/{index-we94wkty.js → index-94qwbx11.js}

@@ -13,6 +13,7 @@ import {
 } from "./index-b9v501fr.js";
 
 // src/hooks/utils.ts
+import * as fs from "fs";
 import * as path from "path";
 var _internals = {
   safeHook,
@@ -71,8 +72,55 @@ function validateSwarmPath(directory, filename) {
       throw new Error("Invalid filename: path escapes .swarm directory");
     }
   }
+  let realBaseDir;
+  try {
+    if (fs.lstatSync(baseDir).isSymbolicLink()) {
+      throw new Error("Invalid filename: path escapes .swarm directory");
+    }
+    realBaseDir = fs.realpathSync(baseDir);
+  } catch (error) {
+    if (error instanceof Error && error.message === "Invalid filename: path escapes .swarm directory") {
+      throw error;
+    }
+    if (error.code === "ENOENT") {
+      return resolved;
+    }
+    throw new Error("Invalid filename: failed to resolve .swarm directory");
+  }
+  let existingPath = resolved;
+  while (!fs.existsSync(existingPath)) {
+    const parent = path.dirname(existingPath);
+    if (parent === existingPath || !isPathWithin(parent, baseDir)) {
+      existingPath = baseDir;
+      break;
+    }
+    existingPath = parent;
+  }
+  let realExistingPath;
+  try {
+    realExistingPath = fs.realpathSync(existingPath);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      realExistingPath = realBaseDir;
+    } else {
+      throw new Error("Invalid filename: failed to resolve path");
+    }
+  }
+  if (!isPathWithin(realExistingPath, realBaseDir)) {
+    throw new Error("Invalid filename: path escapes .swarm directory");
+  }
   return resolved;
 }
+function isPathWithin(candidate, base) {
+  const normalizedCandidate = path.normalize(candidate);
+  const normalizedBase = path.normalize(base);
+  if (process.platform === "win32") {
+    const candidateLower = normalizedCandidate.toLowerCase();
+    const baseLower = normalizedBase.toLowerCase();
+    return candidateLower === baseLower || candidateLower.startsWith(`${baseLower}${path.sep}`);
+  }
+  return normalizedCandidate === normalizedBase || normalizedCandidate.startsWith(`${normalizedBase}${path.sep}`);
+}
 async function readSwarmFileAsync(directory, filename, cache) {
   if (cache !== undefined) {
     const key = `${directory}::${filename}`;

package/dist/cli/{index-4pt2py5p.js → index-ryns3fqt.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-ft4gehk1.js";
+} from "./index-y4stbk2f.js";
 import {
   handleGuardrailLog
 } from "./index-h9ptj4b1.js";
@@ -79,9 +79,9 @@ import {
   handleWriteRetroCommand,
   normalizeSwarmCommandInput,
   resolveCommand
-} from "./index-hw8r3e5p.js";
+} from "./index-62tmq1kc.js";
 import"./index-xsswhy6k.js";
-import"./index-2a6ppa65.js";
+import"./index-ydgy7vg5.js";
 import"./index-vwyjkzgs.js";
 import"./index-f7nma02k.js";
 import"./index-svf2zjxs.js";
@@ -90,13 +90,13 @@ import {
   ORCHESTRATOR_NAME,
   stripKnownSwarmPrefix
 } from "./index-7hnwnw5g.js";
-import"./index-wwnjw0fb.js";
+import"./index-6wgwybzj.js";
 import"./index-adz3nk9b.js";
 import"./index-v4fcn4tr.js";
 import"./index-r8f89sm9.js";
 import"./index-9b7qp18e.js";
-import"./index-5fxjagjt.js";
-import"./index-we94wkty.js";
+import"./index-s3esnz7m.js";
+import"./index-94qwbx11.js";
 import"./index-jtqkh8jf.js";
 import"./index-5e4e2hvv.js";
 import"./index-p0arc26j.js";

package/dist/cli/{index-5fxjagjt.js → index-s3esnz7m.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-we94wkty.js";
+} from "./index-94qwbx11.js";
 import {
   log
 } from "./index-zgwm4ryv.js";

package/dist/cli/{index-ft4gehk1.js → index-y4stbk2f.js}

@@ -12,7 +12,7 @@ import {
   detectPosixWrites,
   detectWindowsWrites,
   resolveWriteTargets
-} from "./index-hw8r3e5p.js";
+} from "./index-62tmq1kc.js";
 import {
   checkFileAuthority,
   classifyFile,

package/dist/cli/{index-2a6ppa65.js → index-ydgy7vg5.js}

@@ -1,4 +1,15 @@
 // @bun
+// src/agents/_prompt-helpers.ts
+function resolvePrompt(base, custom, append) {
+  if (custom)
+    return custom;
+  if (append)
+    return `${base}
+
+${append}`;
+  return base;
+}
+
 // src/agents/read-only-lane-guidance.ts
 var READ_ONLY_LANE_GUIDANCE = `## READ-ONLY ADVISORY LANE CONTEXT
 
@@ -379,13 +390,7 @@ OUTPUT FORMAT:
 `;
 function createExplorerAgent(model, customPrompt, customAppendPrompt) {
   let prompt = EXPLORER_PROMPT;
-  if (customPrompt) {
-    prompt = customPrompt;
-  } else if (customAppendPrompt) {
-    prompt = `${EXPLORER_PROMPT}
-
-${customAppendPrompt}`;
-  }
+  prompt = resolvePrompt(prompt, customPrompt, customAppendPrompt);
   return {
     name: "explorer",
     description: "Fast codebase discovery and analysis. Scans directory structure, identifies languages/frameworks, summarizes key files, and identifies areas where specialized domain knowledge may be beneficial.",

package/dist/cli/index.js

@@ -7,22 +7,22 @@ import {
   getPluginLockFilePaths,
   package_default,
   resolveCommand
-} from "./index-hw8r3e5p.js";
+} from "./index-62tmq1kc.js";
 import"./index-xsswhy6k.js";
-import"./index-2a6ppa65.js";
+import"./index-ydgy7vg5.js";
 import"./index-vwyjkzgs.js";
 import"./index-f7nma02k.js";
 import"./index-svf2zjxs.js";
 import {
   DEFAULT_AGENT_CONFIGS
 } from "./index-7hnwnw5g.js";
-import"./index-wwnjw0fb.js";
+import"./index-6wgwybzj.js";
 import"./index-adz3nk9b.js";
 import"./index-v4fcn4tr.js";
 import"./index-r8f89sm9.js";
 import"./index-9b7qp18e.js";
-import"./index-5fxjagjt.js";
-import"./index-we94wkty.js";
+import"./index-s3esnz7m.js";
+import"./index-94qwbx11.js";
 import"./index-jtqkh8jf.js";
 import"./index-5e4e2hvv.js";
 import"./index-p0arc26j.js";

package/dist/cli/{pending-delegations-c785p5n2.js → pending-delegations-vh2nae3n.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-we94wkty.js";
+} from "./index-94qwbx11.js";
 import"./index-jtqkh8jf.js";
 import"./index-5e4e2hvv.js";
 import"./index-p0arc26j.js";

package/dist/cli/{pr-subscriptions-fqrzm0tv.js → pr-subscriptions-d57tq0c0.js}

@@ -9,8 +9,8 @@ import {
   sweepStale,
   unsubscribe,
   updateSnapshot
-} from "./index-5fxjagjt.js";
-import"./index-we94wkty.js";
+} from "./index-s3esnz7m.js";
+import"./index-94qwbx11.js";
 import"./index-jtqkh8jf.js";
 import"./index-5e4e2hvv.js";
 import"./index-p0arc26j.js";

package/dist/commands/loop.d.ts

@@ -12,4 +12,9 @@
  * headers or newline-based control sequences (mirrors the brainstorm /
  * deep-dive handlers).
  */
+export declare const _internals: {
+    readLatestLoopState: (directory: string) => Promise<{
+        autonomy?: string;
+    } | null>;
+};
 export declare function handleLoopCommand(_directory: string, args: string[]): Promise<string>;

package/dist/commands/registry.d.ts

@@ -469,7 +469,7 @@ export declare const COMMAND_REGISTRY: {
         readonly handler: (ctx: CommandContext) => CommandResult;
         readonly description: "Enter architect MODE: LOOP — compound-engineering loop: brainstorm → plan → build → review → improve, iterating until done [objective]";
         readonly args: "<objective> [--max-cycles 1..5] [--autonomy checkpoint|auto] [--depth standard|exhaustive] [--resume]";
-        readonly details: "Triggers the architect to run the compound-engineering loop defined in .opencode/skills/loop/SKILL.md: BRAINSTORM (requirements) → PLAN (+ critic gate) → BUILD (execute) → REVIEW (independent reviewer + critic on the diff, report-only) → IMPROVE (phase-wrap retrospective + compounding learning capture), then evaluate stop conditions and loop for another improvement cycle if the objective is unmet and budget remains. Generator and reviewer/critic run in separate contexts; failing assertions must be fixed at the root cause, never weakened, mocked, or skipped. Defense-in-depth stop conditions: objective met, --max-cycles budget (default 3), no-progress/plateau, oscillation, unrecoverable error, or explicit user stop. --autonomy checkpoint (default) pauses at phase gates for user approval; --autonomy auto runs unattended with hard stops still enforced. --depth exhaustive widens exploration. --resume continues an existing loop run from durable .swarm/loop/ state. Distinct from full-auto (autonomous cross-phase oversight) and turbo (parallel lanes within a phase): loop is a user-initiated, gated, compounding workflow.";
+        readonly details: "Triggers the architect to run the compound-engineering loop defined in .opencode/skills/loop/SKILL.md: BRAINSTORM (requirements) → PLAN (+ critic gate) → BUILD (execute) → REVIEW (independent reviewer + critic on the diff, report-only) → IMPROVE (phase-wrap retrospective + compounding learning capture), then evaluate stop conditions and loop for another improvement cycle if the objective is unmet and budget remains. Generator and reviewer/critic run in separate contexts; failing assertions must be fixed at the root cause, never weakened, mocked, or skipped. Defense-in-depth stop conditions: objective met, --max-cycles budget (default 3), no-progress/plateau, oscillation, unrecoverable error, or explicit user stop. --autonomy auto (default) runs unattended with hard stops still enforced; --autonomy checkpoint pauses at phase gates for user approval. --depth exhaustive widens exploration. --resume continues an existing loop run from durable .swarm/loop/ state. Distinct from full-auto (autonomous cross-phase oversight) and turbo (parallel lanes within a phase): loop is a user-initiated, gated, compounding workflow.";
         readonly category: "agent";
         readonly toolPolicy: "none";
     };
@@ -895,7 +895,10 @@ export declare const VALID_COMMANDS: RegisteredCommand[];
  * Checks for:
  * - aliasOf pointing to an existing command
  * - circular alias chains (A → B → C → A)
- * - duplicate alias targets (multiple aliases for different commands) — logged as warning, not error
+ *
+ * Duplicate aliases to the same canonical command are intentional in this repo
+ * (for example, dash-joined TUI shortcuts and legacy compatibility names), so
+ * they are not reported as warnings.
  */
 export declare function validateAliases(): {
     valid: boolean;

package/dist/db/qa-gate-profile.d.ts

@@ -18,6 +18,7 @@ export declare const _internals: {
     setGates: typeof setGates;
     getEffectiveGates: typeof getEffectiveGates;
     computeProfileHash: typeof computeProfileHash;
+    hasAnyProfileWithEnabledGate: typeof hasAnyProfileWithEnabledGate;
 };
 /**
  * QA gate flags. All eleven gates are tracked explicitly.
@@ -62,6 +63,15 @@ export interface QaGateProfile {
  * `lockProfile`) continue to initialize the DB on demand.
  */
 export declare function getProfile(directory: string, planId: string): QaGateProfile | null;
+/**
+ * Return true if any existing QA gate profile has `gate` enabled.
+ *
+ * This is intentionally read-only and does not create the project DB. It is used
+ * by fail-closed gates when plan.json is unavailable, so they can still honor a
+ * previously persisted hard gate instead of silently passing because plan
+ * identity could not be derived.
+ */
+export declare function hasAnyProfileWithEnabledGate(directory: string, gate: keyof QaGates): boolean;
 /**
  * Return the existing profile for `planId`, or create a new one seeded with
  * `DEFAULT_QA_GATES` if none exists. Tolerates races on the UNIQUE index.

package/dist/evidence/manager.d.ts

@@ -93,6 +93,10 @@ export declare function checkRequirementCoverage(phase: number, directory: strin
  * Returns array of archived (deleted) task IDs.
  */
 export declare function archiveEvidence(directory: string, maxAgeDays: number, maxBundles?: number): Promise<string[]>;
+/**
+ * Validates evidence through Zod. Exposed via _internals for DI testing.
+ */
+declare function validateEvidence(evidence: Evidence): Evidence;
 /**
  * DI seam for testability. Contains all test-mocked exports.
  * Internal calls should use _internals.fn() instead of fn() directly.
@@ -102,5 +106,6 @@ export declare const _internals: {
     loadEvidence: typeof loadEvidence;
     listEvidenceTaskIds: typeof listEvidenceTaskIds;
     validateProjectRoot: typeof validateProjectRoot;
+    validateEvidence: typeof validateEvidence;
 };
 export {};

package/dist/hooks/auto-review.d.ts

@@ -42,7 +42,7 @@ export type ExecutionDiffResult = {
  * `maxBytes`.
  */
 declare function computeExecutionDiff(directory: string, maxBytes: number): Promise<ExecutionDiffResult>;
-declare function dispatchReviewer(directory: string, prompt: string, agentName: string, timeoutMs: number): Promise<string>;
+declare function dispatchReviewer(directory: string, prompt: string, agentName: string, timeoutMs: number, parentSessionId: string): Promise<string>;
 export interface AutoReviewRunInput {
     directory: string;
     sessionID: string;

package/dist/hooks/knowledge-migrator.d.ts

@@ -1,4 +1,6 @@
 /** One-time migration from .swarm/context.md → .swarm/knowledge.jsonl for existing projects. */
+import { existsSync, readFileSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { appendKnowledge } from './knowledge-store.js';
 import type { KnowledgeCategory, KnowledgeConfig } from './knowledge-types.js';
 export interface MigrationResult {
@@ -32,6 +34,11 @@ export declare const _internals: {
     inferProjectName: typeof inferProjectName;
     writeSentinel: typeof writeSentinel;
     resolveLegacyHiveKnowledgePath: typeof resolveLegacyHiveKnowledgePath;
+    existsSync: typeof existsSync;
+    readFileSync: typeof readFileSync;
+    readFile: typeof readFile;
+    mkdir: typeof mkdir;
+    writeFile: typeof writeFile;
 };
 export declare function migrateContextToKnowledge(directory: string, config: KnowledgeConfig): Promise<MigrationResult>;
 /**