opencode-swarm 7.99.2 → 7.99.4

package/dist/plan/manager.d.ts

@@ -91,6 +91,12 @@ export declare function retryCasWithBackoff(directory: string, eventInput: Ledge
  * Use this when you want to check for structured plans without triggering migration.
  */
 export declare function loadPlanJsonOnly(directory: string): Promise<Plan | null>;
+/**
+ * Check if plan.md is derived from the given plan by comparing content hashes.
+ * Returns true if plan.md exists and matches the plan's content hash.
+ * This avoids timestamp comparison issues by using a deterministic hash.
+ */
+export declare function isPlanMdInSync(directory: string, plan: Plan, cache?: Map<string, Promise<string | null>>): Promise<boolean>;
 /**
  * Regenerate plan.md from valid plan.json (auto-heal case 1).
  */

package/dist/services/version-check.d.ts

@@ -1,3 +1,7 @@
+/**
+ * Returns true if `value` is a strictly-valid semver string. Pure; never throws.
+ */
+export declare function isStrictSemver(value: unknown): value is string;
 interface VersionCheckCache {
     checkedAt: number;
     npmLatest: string | null;
@@ -8,6 +12,34 @@ export declare function readVersionCache(): VersionCheckCache | null;
  * 0 if equal. Treats prerelease tags as lower than the release. Pure function.
  */
 export declare function compareVersions(a: string, b: string): number;
+/**
+ * Fetch the latest published version from the npm registry with strict,
+ * fail-safe validation (issue #1270-4):
+ *   (a) HTTP status must be ok.
+ *   (b) Content-Type must look like JSON — a mislabeled HTML error page or
+ *       proxy interstitial is rejected rather than parsed.
+ *   (c) The body is length-bounded both by the advertised Content-Length and
+ *       by the actual decoded length, so a hostile endpoint cannot make us
+ *       buffer an unbounded response.
+ *   (d) The `version` field must be a STRICT semver string before it is
+ *       returned (and thus before it is cached, compared, or surfaced).
+ *
+ * Any validation failure returns null. This function NEVER throws into its
+ * caller — staleness checking must never disrupt plugin startup.
+ *
+ * Exported so tests can exercise the validation directly via the
+ * `_internals.fetch` seam (mocking the global `fetch` would leak across files
+ * in Bun's shared test process).
+ */
+export declare function fetchLatestVersion(signal: AbortSignal): Promise<string | null>;
+/**
+ * Test-only dependency-injection seam. Production reads `_internals.fetch(...)`
+ * at the call site so tests can replace it without `mock.module` (which leaks
+ * across files in Bun's shared test-runner process). Restore in `afterEach`.
+ */
+export declare const _internals: {
+    fetch: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+};
 /**
  * Schedule a one-shot, fully detached version check. Returns immediately.
  * Emits a deferred warning via `emitWarning` when a newer version is found.

package/dist/state.d.ts

@@ -380,6 +380,41 @@ export declare function resetSwarmState(): void;
  * propagate to caller (no try/catch wrapper).
  */
 export declare function resetSwarmStatePreservingSingletons(): void;
+/**
+ * Evict every agent session whose last tool activity is older than
+ * staleDurationMs, and drop the delegation chain keyed by that same sessionID
+ * (delegationChains is keyed by sessionID — see delegation-tracker.ts, which
+ * does `delegationChains.set(input.sessionID, ...)`). This is the single
+ * eviction loop reused by BOTH startAgentSession (eager, on new session start)
+ * and maybeSweepStaleSessions (opportunistic, on the hot path) so the logic is
+ * never duplicated.
+ *
+ * @param staleDurationMs - Age threshold in ms (default 2h)
+ * @param now - Current time in ms (injectable for deterministic tests)
+ * @returns The list of evicted session IDs
+ */
+export declare function sweepStaleSessions(staleDurationMs?: number, now?: number): string[];
+/**
+ * Opportunistic, cooldown-guarded wrapper around sweepStaleSessions, intended
+ * to be called from a frequently-hit code path (per-tool-call accounting in
+ * ensureAgentSession). This reclaims accumulated session state even when no
+ * new session is ever started — closing the gap where eager eviction only ran
+ * inside startAgentSession, so a long-lived host that stopped creating
+ * sessions never reclaimed old ones.
+ *
+ * Bounded work (invariant 8): the O(n) scan runs at most once per
+ * IDLE_SWEEP_COOLDOWN_MS. The cooldown timestamp advances whenever the cooldown
+ * has elapsed — even when zero sessions are evicted — so an idle/empty map does
+ * not re-scan on every call.
+ *
+ * No timers, no init-path work (invariant 1): this only runs when a hook
+ * actively calls it on the hot path; it never schedules background work.
+ *
+ * @param staleDurationMs - Age threshold in ms (default 2h)
+ * @param now - Current time in ms (injectable for deterministic tests)
+ * @returns Evicted session IDs ([] when the cooldown blocks this run)
+ */
+export declare function maybeSweepStaleSessions(staleDurationMs?: number, now?: number): string[];
 /**
  * Start a new agent session with initialized guardrail state.
  * Also removes any stale sessions older than staleDurationMs.

package/dist/tools/update-task-status.d.ts

@@ -4,7 +4,7 @@
  */
 import type { ToolContext, ToolDefinition } from '@opencode-ai/plugin/tool';
 import { tryAcquireLock } from '../parallel/file-locks.js';
-import { updateTaskStatus } from '../plan/manager';
+import { loadPlan, updateTaskStatus } from '../plan/manager';
 import { resolveWorkingDirectory } from './resolve-working-directory';
 /**
  * Internal seams for test injection.
@@ -15,6 +15,7 @@ export declare const _internals: {
     readonly tryAcquireLock: typeof tryAcquireLock;
     readonly updateTaskStatus: typeof updateTaskStatus;
     readonly resolveWorkingDirectory: typeof resolveWorkingDirectory;
+    readonly loadPlan: typeof loadPlan;
 };
 /**
  * Arguments for the update_task_status tool

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.99.2",
+	"version": "7.99.4",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",