opencode-swarm 7.99.1 → 7.99.2

package/dist/cli/{index-qcr60fgm.js → index-6wgwybzj.js}

@@ -8,7 +8,7 @@ import {
 import {
   readSwarmFileAsync,
   validateSwarmPath
-} from "./index-we94wkty.js";
+} from "./index-94qwbx11.js";
 import {
   readCachedParsedFile
 } from "./index-jtqkh8jf.js";

package/dist/cli/{index-we94wkty.js → index-94qwbx11.js}

@@ -13,6 +13,7 @@ import {
 } from "./index-b9v501fr.js";
 
 // src/hooks/utils.ts
+import * as fs from "fs";
 import * as path from "path";
 var _internals = {
   safeHook,
@@ -71,8 +72,55 @@ function validateSwarmPath(directory, filename) {
       throw new Error("Invalid filename: path escapes .swarm directory");
     }
   }
+  let realBaseDir;
+  try {
+    if (fs.lstatSync(baseDir).isSymbolicLink()) {
+      throw new Error("Invalid filename: path escapes .swarm directory");
+    }
+    realBaseDir = fs.realpathSync(baseDir);
+  } catch (error) {
+    if (error instanceof Error && error.message === "Invalid filename: path escapes .swarm directory") {
+      throw error;
+    }
+    if (error.code === "ENOENT") {
+      return resolved;
+    }
+    throw new Error("Invalid filename: failed to resolve .swarm directory");
+  }
+  let existingPath = resolved;
+  while (!fs.existsSync(existingPath)) {
+    const parent = path.dirname(existingPath);
+    if (parent === existingPath || !isPathWithin(parent, baseDir)) {
+      existingPath = baseDir;
+      break;
+    }
+    existingPath = parent;
+  }
+  let realExistingPath;
+  try {
+    realExistingPath = fs.realpathSync(existingPath);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      realExistingPath = realBaseDir;
+    } else {
+      throw new Error("Invalid filename: failed to resolve path");
+    }
+  }
+  if (!isPathWithin(realExistingPath, realBaseDir)) {
+    throw new Error("Invalid filename: path escapes .swarm directory");
+  }
   return resolved;
 }
+function isPathWithin(candidate, base) {
+  const normalizedCandidate = path.normalize(candidate);
+  const normalizedBase = path.normalize(base);
+  if (process.platform === "win32") {
+    const candidateLower = normalizedCandidate.toLowerCase();
+    const baseLower = normalizedBase.toLowerCase();
+    return candidateLower === baseLower || candidateLower.startsWith(`${baseLower}${path.sep}`);
+  }
+  return normalizedCandidate === normalizedBase || normalizedCandidate.startsWith(`${normalizedBase}${path.sep}`);
+}
 async function readSwarmFileAsync(directory, filename, cache) {
   if (cache !== undefined) {
     const key = `${directory}::${filename}`;

package/dist/cli/{index-xy3gw0rw.js → index-ryns3fqt.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-sy329dh4.js";
+} from "./index-y4stbk2f.js";
 import {
   handleGuardrailLog
 } from "./index-h9ptj4b1.js";
@@ -79,7 +79,7 @@ import {
   handleWriteRetroCommand,
   normalizeSwarmCommandInput,
   resolveCommand
-} from "./index-brpm7xs3.js";
+} from "./index-62tmq1kc.js";
 import"./index-xsswhy6k.js";
 import"./index-ydgy7vg5.js";
 import"./index-vwyjkzgs.js";
@@ -90,13 +90,13 @@ import {
   ORCHESTRATOR_NAME,
   stripKnownSwarmPrefix
 } from "./index-7hnwnw5g.js";
-import"./index-qcr60fgm.js";
+import"./index-6wgwybzj.js";
 import"./index-adz3nk9b.js";
 import"./index-v4fcn4tr.js";
 import"./index-r8f89sm9.js";
 import"./index-9b7qp18e.js";
-import"./index-5fxjagjt.js";
-import"./index-we94wkty.js";
+import"./index-s3esnz7m.js";
+import"./index-94qwbx11.js";
 import"./index-jtqkh8jf.js";
 import"./index-5e4e2hvv.js";
 import"./index-p0arc26j.js";

package/dist/cli/{index-5fxjagjt.js → index-s3esnz7m.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-we94wkty.js";
+} from "./index-94qwbx11.js";
 import {
   log
 } from "./index-zgwm4ryv.js";

package/dist/cli/{index-sy329dh4.js → index-y4stbk2f.js}

@@ -12,7 +12,7 @@ import {
   detectPosixWrites,
   detectWindowsWrites,
   resolveWriteTargets
-} from "./index-brpm7xs3.js";
+} from "./index-62tmq1kc.js";
 import {
   checkFileAuthority,
   classifyFile,

package/dist/cli/index.js

@@ -7,7 +7,7 @@ import {
   getPluginLockFilePaths,
   package_default,
   resolveCommand
-} from "./index-brpm7xs3.js";
+} from "./index-62tmq1kc.js";
 import"./index-xsswhy6k.js";
 import"./index-ydgy7vg5.js";
 import"./index-vwyjkzgs.js";
@@ -16,13 +16,13 @@ import"./index-svf2zjxs.js";
 import {
   DEFAULT_AGENT_CONFIGS
 } from "./index-7hnwnw5g.js";
-import"./index-qcr60fgm.js";
+import"./index-6wgwybzj.js";
 import"./index-adz3nk9b.js";
 import"./index-v4fcn4tr.js";
 import"./index-r8f89sm9.js";
 import"./index-9b7qp18e.js";
-import"./index-5fxjagjt.js";
-import"./index-we94wkty.js";
+import"./index-s3esnz7m.js";
+import"./index-94qwbx11.js";
 import"./index-jtqkh8jf.js";
 import"./index-5e4e2hvv.js";
 import"./index-p0arc26j.js";

package/dist/cli/{pending-delegations-c785p5n2.js → pending-delegations-vh2nae3n.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-we94wkty.js";
+} from "./index-94qwbx11.js";
 import"./index-jtqkh8jf.js";
 import"./index-5e4e2hvv.js";
 import"./index-p0arc26j.js";

package/dist/cli/{pr-subscriptions-fqrzm0tv.js → pr-subscriptions-d57tq0c0.js}

@@ -9,8 +9,8 @@ import {
   sweepStale,
   unsubscribe,
   updateSnapshot
-} from "./index-5fxjagjt.js";
-import"./index-we94wkty.js";
+} from "./index-s3esnz7m.js";
+import"./index-94qwbx11.js";
 import"./index-jtqkh8jf.js";
 import"./index-5e4e2hvv.js";
 import"./index-p0arc26j.js";

package/dist/commands/loop.d.ts

@@ -12,4 +12,9 @@
  * headers or newline-based control sequences (mirrors the brainstorm /
  * deep-dive handlers).
  */
+export declare const _internals: {
+    readLatestLoopState: (directory: string) => Promise<{
+        autonomy?: string;
+    } | null>;
+};
 export declare function handleLoopCommand(_directory: string, args: string[]): Promise<string>;

package/dist/commands/registry.d.ts

@@ -469,7 +469,7 @@ export declare const COMMAND_REGISTRY: {
         readonly handler: (ctx: CommandContext) => CommandResult;
         readonly description: "Enter architect MODE: LOOP — compound-engineering loop: brainstorm → plan → build → review → improve, iterating until done [objective]";
         readonly args: "<objective> [--max-cycles 1..5] [--autonomy checkpoint|auto] [--depth standard|exhaustive] [--resume]";
-        readonly details: "Triggers the architect to run the compound-engineering loop defined in .opencode/skills/loop/SKILL.md: BRAINSTORM (requirements) → PLAN (+ critic gate) → BUILD (execute) → REVIEW (independent reviewer + critic on the diff, report-only) → IMPROVE (phase-wrap retrospective + compounding learning capture), then evaluate stop conditions and loop for another improvement cycle if the objective is unmet and budget remains. Generator and reviewer/critic run in separate contexts; failing assertions must be fixed at the root cause, never weakened, mocked, or skipped. Defense-in-depth stop conditions: objective met, --max-cycles budget (default 3), no-progress/plateau, oscillation, unrecoverable error, or explicit user stop. --autonomy checkpoint (default) pauses at phase gates for user approval; --autonomy auto runs unattended with hard stops still enforced. --depth exhaustive widens exploration. --resume continues an existing loop run from durable .swarm/loop/ state. Distinct from full-auto (autonomous cross-phase oversight) and turbo (parallel lanes within a phase): loop is a user-initiated, gated, compounding workflow.";
+        readonly details: "Triggers the architect to run the compound-engineering loop defined in .opencode/skills/loop/SKILL.md: BRAINSTORM (requirements) → PLAN (+ critic gate) → BUILD (execute) → REVIEW (independent reviewer + critic on the diff, report-only) → IMPROVE (phase-wrap retrospective + compounding learning capture), then evaluate stop conditions and loop for another improvement cycle if the objective is unmet and budget remains. Generator and reviewer/critic run in separate contexts; failing assertions must be fixed at the root cause, never weakened, mocked, or skipped. Defense-in-depth stop conditions: objective met, --max-cycles budget (default 3), no-progress/plateau, oscillation, unrecoverable error, or explicit user stop. --autonomy auto (default) runs unattended with hard stops still enforced; --autonomy checkpoint pauses at phase gates for user approval. --depth exhaustive widens exploration. --resume continues an existing loop run from durable .swarm/loop/ state. Distinct from full-auto (autonomous cross-phase oversight) and turbo (parallel lanes within a phase): loop is a user-initiated, gated, compounding workflow.";
         readonly category: "agent";
         readonly toolPolicy: "none";
     };
@@ -895,7 +895,10 @@ export declare const VALID_COMMANDS: RegisteredCommand[];
  * Checks for:
  * - aliasOf pointing to an existing command
  * - circular alias chains (A → B → C → A)
- * - duplicate alias targets (multiple aliases for different commands) — logged as warning, not error
+ *
+ * Duplicate aliases to the same canonical command are intentional in this repo
+ * (for example, dash-joined TUI shortcuts and legacy compatibility names), so
+ * they are not reported as warnings.
  */
 export declare function validateAliases(): {
     valid: boolean;

package/dist/db/qa-gate-profile.d.ts

@@ -18,6 +18,7 @@ export declare const _internals: {
     setGates: typeof setGates;
     getEffectiveGates: typeof getEffectiveGates;
     computeProfileHash: typeof computeProfileHash;
+    hasAnyProfileWithEnabledGate: typeof hasAnyProfileWithEnabledGate;
 };
 /**
  * QA gate flags. All eleven gates are tracked explicitly.
@@ -62,6 +63,15 @@ export interface QaGateProfile {
  * `lockProfile`) continue to initialize the DB on demand.
  */
 export declare function getProfile(directory: string, planId: string): QaGateProfile | null;
+/**
+ * Return true if any existing QA gate profile has `gate` enabled.
+ *
+ * This is intentionally read-only and does not create the project DB. It is used
+ * by fail-closed gates when plan.json is unavailable, so they can still honor a
+ * previously persisted hard gate instead of silently passing because plan
+ * identity could not be derived.
+ */
+export declare function hasAnyProfileWithEnabledGate(directory: string, gate: keyof QaGates): boolean;
 /**
  * Return the existing profile for `planId`, or create a new one seeded with
  * `DEFAULT_QA_GATES` if none exists. Tolerates races on the UNIQUE index.

package/dist/hooks/auto-review.d.ts

@@ -42,7 +42,7 @@ export type ExecutionDiffResult = {
  * `maxBytes`.
  */
 declare function computeExecutionDiff(directory: string, maxBytes: number): Promise<ExecutionDiffResult>;
-declare function dispatchReviewer(directory: string, prompt: string, agentName: string, timeoutMs: number): Promise<string>;
+declare function dispatchReviewer(directory: string, prompt: string, agentName: string, timeoutMs: number, parentSessionId: string): Promise<string>;
 export interface AutoReviewRunInput {
     directory: string;
     sessionID: string;