opencode-swarm 6.39.0 → 6.40.1

package/dist/index.js

@@ -4,25 +4,43 @@ var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
 var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
   for (let key of __getOwnPropNames(mod))
     if (!__hasOwnProp.call(to, key))
       __defProp(to, key, {
-        get: () => mod[key],
+        get: __accessProp.bind(mod, key),
         enumerable: true
       });
+  if (canCache)
+    cache.set(mod, to);
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __returnValue = (v) => v;
+function __exportSetter(name2, newValue) {
+  this[name2] = __returnValue.bind(null, newValue);
+}
 var __export = (target, all) => {
   for (var name2 in all)
     __defProp(target, name2, {
       get: all[name2],
       enumerable: true,
       configurable: true,
-      set: (newValue) => all[name2] = () => newValue
+      set: __exportSetter.bind(all, name2)
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -14892,8 +14910,8 @@ var init_schema = __esm(() => {
   });
   CheckpointConfigSchema = exports_external.object({
     enabled: exports_external.boolean().default(true),
-    auto_checkpoint_threshold: exports_external.number().min(1).max(20).default(3)
-  });
+    auto_checkpoint_threshold: exports_external.number().int().min(1).max(20).default(3)
+  }).strict();
   AutomationModeSchema = exports_external.enum(["manual", "hybrid", "auto"]);
   AutomationCapabilitiesSchema = exports_external.object({
     plan_sync: exports_external.boolean().default(true),
@@ -15013,7 +15031,8 @@ var init_schema = __esm(() => {
       block_on_threshold: exports_external.boolean().default(false).describe("If true, block phase completion when threshold exceeded. Default: advisory only.")
     }).optional(),
     incremental_verify: IncrementalVerifyConfigSchema.optional(),
-    compaction_service: CompactionConfigSchema.optional()
+    compaction_service: CompactionConfigSchema.optional(),
+    turbo_mode: exports_external.boolean().default(false).optional()
   });
 });
 
@@ -15192,7 +15211,8 @@ var init_plan_schema = __esm(() => {
     id: exports_external.number().int().min(1),
     name: exports_external.string().min(1),
     status: PhaseStatusSchema.default("pending"),
-    tasks: exports_external.array(TaskSchema).default([])
+    tasks: exports_external.array(TaskSchema).default([]),
+    required_agents: exports_external.array(exports_external.string()).optional()
   });
   PlanSchema = exports_external.object({
     schema_version: exports_external.literal("1.0.0"),
@@ -16100,7 +16120,7 @@ async function updateTaskStatus(directory, taskId, status) {
     throw new Error(`Task not found: ${taskId}`);
   }
   const updatedPlan = { ...plan, phases: updatedPhases };
-  await savePlan(directory, updatedPlan, { preserveCompletedStatuses: false });
+  await savePlan(directory, updatedPlan, { preserveCompletedStatuses: true });
   return updatedPlan;
 }
 function derivePlanMarkdown(plan) {
@@ -16456,8 +16476,8 @@ function getTaskBlockers(task, summary, status) {
   }
   return blockers;
 }
-async function buildTaskSummary(task, taskId) {
-  const result = await loadEvidence(".", taskId);
+async function buildTaskSummary(directory, task, taskId) {
+  const result = await loadEvidence(directory, taskId);
   const bundle = result.status === "found" ? result.bundle : null;
   const phase = task?.phase ?? 0;
   const status = getTaskStatus(task, bundle);
@@ -16486,18 +16506,18 @@ async function buildTaskSummary(task, taskId) {
     lastEvidenceTimestamp: lastTimestamp
   };
 }
-async function buildPhaseSummary(phase) {
-  const taskIds = await listEvidenceTaskIds(".");
+async function buildPhaseSummary(directory, phase) {
+  const taskIds = await listEvidenceTaskIds(directory);
   const phaseTaskIds = new Set(phase.tasks.map((t) => t.id));
   const taskSummaries = [];
   const _taskMap = new Map(phase.tasks.map((t) => [t.id, t]));
   for (const task of phase.tasks) {
-    const summary = await buildTaskSummary(task, task.id);
+    const summary = await buildTaskSummary(directory, task, task.id);
     taskSummaries.push(summary);
   }
   const extraTaskIds = taskIds.filter((id) => !phaseTaskIds.has(id));
   for (const taskId of extraTaskIds) {
-    const summary = await buildTaskSummary(undefined, taskId);
+    const summary = await buildTaskSummary(directory, undefined, taskId);
     if (summary.phase === phase.id) {
       taskSummaries.push(summary);
     }
@@ -16598,7 +16618,7 @@ async function buildEvidenceSummary(directory, currentPhase) {
   let totalTasks = 0;
   let completedTasks = 0;
   for (const phase of phasesToProcess) {
-    const summary = await buildPhaseSummary(phase);
+    const summary = await buildPhaseSummary(directory, phase);
     phaseSummaries.push(summary);
     totalTasks += summary.totalTasks;
     completedTasks += summary.completedTasks;
@@ -30176,6 +30196,11 @@ function isGitRepo() {
 }
 function handleSave(label, directory) {
   try {
+    let maxCheckpoints = 20;
+    try {
+      const { config: config3 } = loadPluginConfigWithMeta(directory);
+      maxCheckpoints = config3.checkpoint?.auto_checkpoint_threshold ?? maxCheckpoints;
+    } catch {}
     const log2 = readCheckpointLog(directory);
     const existingCheckpoint = log2.checkpoints.find((c) => c.label === label);
     if (existingCheckpoint) {
@@ -30280,6 +30305,7 @@ function handleDelete(label, directory) {
 var CHECKPOINT_LOG_PATH = ".swarm/checkpoints.json", MAX_LABEL_LENGTH = 100, GIT_TIMEOUT_MS = 30000, SHELL_METACHARACTERS, SAFE_LABEL_PATTERN, CONTROL_CHAR_PATTERN, NON_ASCII_PATTERN, checkpoint;
 var init_checkpoint = __esm(() => {
   init_tool();
+  init_config();
   init_create_tool();
   SHELL_METACHARACTERS = /[;|&$`(){}<>!'"]/;
   SAFE_LABEL_PATTERN = /^[a-zA-Z0-9_ -]+$/;
@@ -30303,7 +30329,7 @@ var init_checkpoint = __esm(() => {
       let label;
       try {
         action = String(args2.action);
-        label = args2.label !== undefined ? String(args2.label) : undefined;
+        label = args2.label !== undefined && args2.label !== null ? String(args2.label) : undefined;
       } catch {
         return JSON.stringify({
           action: "unknown",
@@ -33518,6 +33544,59 @@ var init_profiles = __esm(() => {
       ]
     }
   });
+  LANGUAGE_REGISTRY.register({
+    id: "php",
+    displayName: "PHP",
+    tier: 3,
+    extensions: [".php", ".phtml"],
+    treeSitter: { grammarId: "php", wasmFile: "tree-sitter-php.wasm" },
+    build: {
+      detectFiles: ["composer.json"],
+      commands: []
+    },
+    test: {
+      detectFiles: ["phpunit.xml", "phpunit.xml.dist"],
+      frameworks: [
+        {
+          name: "PHPUnit",
+          detect: "phpunit.xml",
+          cmd: "vendor/bin/phpunit",
+          priority: 1
+        }
+      ]
+    },
+    lint: {
+      detectFiles: [".php-cs-fixer.php", "phpcs.xml"],
+      linters: [
+        {
+          name: "PHP-CS-Fixer",
+          detect: ".php-cs-fixer.php",
+          cmd: "vendor/bin/php-cs-fixer fix --dry-run --diff",
+          priority: 1
+        }
+      ]
+    },
+    audit: {
+      detectFiles: ["composer.lock"],
+      command: "composer audit --format=json",
+      outputFormat: "json"
+    },
+    sast: { nativeRuleSet: "php", semgrepSupport: "ga" },
+    prompts: {
+      coderConstraints: [
+        "Follow PSR-12 coding standards",
+        "Use strict types declaration: declare(strict_types=1)",
+        "Prefer type hints and return type declarations on all functions",
+        "Use dependency injection over static methods and singletons"
+      ],
+      reviewerChecklist: [
+        "Verify no user input reaches SQL queries without parameterised binding",
+        "Check for XSS \u2014 all output must be escaped with htmlspecialchars()",
+        "Confirm no eval(), exec(), or shell_exec() with user-controlled input",
+        "Validate proper error handling \u2014 no bare catch blocks that swallow errors"
+      ]
+    }
+  });
 });
 
 // src/lang/detector.ts
@@ -34135,7 +34214,7 @@ async function detectAvailableLinter(directory) {
 async function _detectAvailableLinter(_projectDir, biomeBin, eslintBin) {
   const DETECT_TIMEOUT = 2000;
   try {
-    const biomeProc = Bun.spawn(["npx", "biome", "--version"], {
+    const biomeProc = Bun.spawn([biomeBin, "--version"], {
       stdout: "pipe",
       stderr: "pipe"
     });
@@ -34149,7 +34228,7 @@ async function _detectAvailableLinter(_projectDir, biomeBin, eslintBin) {
     }
   } catch {}
   try {
-    const eslintProc = Bun.spawn(["npx", "eslint", "--version"], {
+    const eslintProc = Bun.spawn([eslintBin, "--version"], {
       stdout: "pipe",
       stderr: "pipe"
     });
@@ -36161,12 +36240,13 @@ async function runLintCheck(dir, linter, timeoutMs) {
   const startTime = Date.now();
   try {
     const lintPromise = runLint(linter, "check", dir);
+    let timeoutId;
     const timeoutPromise = new Promise((_, reject) => {
-      setTimeout(() => {
+      timeoutId = setTimeout(() => {
         reject(new Error(`Lint check timed out after ${timeoutMs}ms`));
       }, timeoutMs);
     });
-    const result = await Promise.race([lintPromise, timeoutPromise]);
+    const result = await Promise.race([lintPromise, timeoutPromise]).finally(() => clearTimeout(timeoutId));
     if (!result.success) {
       return {
         type: "lint",
@@ -36658,7 +36738,7 @@ function deriveRequiredGates(agentType) {
 }
 function expandRequiredGates(existingGates, newAgentType) {
   const newGates = deriveRequiredGates(newAgentType);
-  const combined = [...new Set([...existingGates, ...newGates])];
+  const combined = [...new Set([...existingGates ?? [], ...newGates])];
   return combined.sort();
 }
 function getEvidenceDir(directory) {
@@ -36793,10 +36873,10 @@ function createPreflightIntegration(config3) {
     });
     const report = await runPreflight(directory, request.currentPhase, preflightConfig);
     if (statusArtifact) {
-      const state2 = report.overall === "pass" ? "success" : "failure";
-      statusArtifact.recordOutcome(state2, request.currentPhase, report.message);
+      const state = report.overall === "pass" ? "success" : "failure";
+      statusArtifact.recordOutcome(state, request.currentPhase, report.message);
       console.log("[PreflightIntegration] Status artifact updated", {
-        state: state2,
+        state,
         phase: request.currentPhase,
         message: report.message
       });
@@ -37238,7 +37318,7 @@ async function readPriorDriftReports(directory) {
       continue;
     try {
       const report = JSON.parse(content);
-      if (typeof report.phase !== "number" || typeof report.alignment !== "string") {
+      if (typeof report.phase !== "number" || typeof report.alignment !== "string" || typeof report.timestamp !== "string" || typeof report.drift_score !== "number" || typeof report.schema_version !== "number" || !Array.isArray(report.compounding_effects)) {
         console.warn(`[curator-drift] Skipping corrupt drift report: ${filename}`);
         continue;
       }
@@ -40635,8 +40715,8 @@ async function loadGrammar(languageId) {
   const wasmFileName = getWasmFileName(normalizedId);
   const grammarsPath = getGrammarsPath();
   const wasmPath = fileURLToPath(new URL(`${grammarsPath}${wasmFileName}`, import.meta.url));
-  const { existsSync: existsSync27 } = await import("fs");
-  if (!existsSync27(wasmPath)) {
+  const { existsSync: existsSync28 } = await import("fs");
+  if (!existsSync28(wasmPath)) {
     throw new Error(`Grammar file not found for ${languageId}: ${wasmPath}
 Make sure to run 'bun run build' to copy grammar files to dist/lang/grammars/`);
   }
@@ -40666,8 +40746,6 @@ var init_runtime = __esm(() => {
     c: "tree-sitter-cpp.wasm",
     csharp: "tree-sitter-c-sharp.wasm",
     css: "tree-sitter-css.wasm",
-    html: "tree-sitter-html.wasm",
-    json: "tree-sitter-json.wasm",
     bash: "tree-sitter-bash.wasm",
     ruby: "tree-sitter-ruby.wasm",
     php: "tree-sitter-php.wasm",
@@ -40760,7 +40838,9 @@ function startAgentSession(sessionId, agentName, staleDurationMs = 7200000, dire
   applyRehydrationCache(sessionState);
   if (directory) {
     let rehydrationPromise;
-    rehydrationPromise = rehydrateSessionFromDisk(directory, sessionState).catch(() => {}).finally(() => {
+    rehydrationPromise = rehydrateSessionFromDisk(directory, sessionState).catch((err2) => {
+      console.warn("[state] Rehydration failed:", err2 instanceof Error ? err2.message : String(err2));
+    }).finally(() => {
       swarmState.pendingRehydrations.delete(rehydrationPromise);
     });
     swarmState.pendingRehydrations.add(rehydrationPromise);
@@ -45154,7 +45234,24 @@ async function handleBenchmarkCommand(directory, args2) {
 }
 
 // src/commands/checkpoint.ts
+init_zod();
 init_checkpoint();
+var CheckpointResultSchema = exports_external.object({
+  action: exports_external.string().optional(),
+  success: exports_external.boolean(),
+  error: exports_external.string().optional(),
+  checkpoints: exports_external.array(exports_external.unknown()).optional()
+}).passthrough();
+function safeParseResult(result) {
+  const parsed = CheckpointResultSchema.safeParse(JSON.parse(result));
+  if (!parsed.success) {
+    return {
+      success: false,
+      error: `Invalid response: ${parsed.error.message}`
+    };
+  }
+  return parsed.data;
+}
 async function handleCheckpointCommand(directory, args2) {
   const subcommand = args2[0] || "list";
   const label = args2[1];
@@ -45177,7 +45274,7 @@ async function handleSave2(directory, label) {
     const result = await checkpoint.execute({ action: "save", label }, {
       directory
     });
-    const parsed = JSON.parse(result);
+    const parsed = safeParseResult(result);
     if (parsed.success) {
       return `\u2713 Checkpoint saved: "${label}"`;
     } else {
@@ -45196,7 +45293,7 @@ async function handleRestore2(directory, label) {
     const result = await checkpoint.execute({ action: "restore", label }, {
       directory
     });
-    const parsed = JSON.parse(result);
+    const parsed = safeParseResult(result);
     if (parsed.success) {
       return `\u2713 Restored to checkpoint: "${label}"`;
     } else {
@@ -45215,7 +45312,7 @@ async function handleDelete2(directory, label) {
     const result = await checkpoint.execute({ action: "delete", label }, {
       directory
     });
-    const parsed = JSON.parse(result);
+    const parsed = safeParseResult(result);
     if (parsed.success) {
       return `\u2713 Checkpoint deleted: "${label}"`;
     } else {
@@ -45231,7 +45328,7 @@ async function handleList2(directory) {
     const result = await checkpoint.execute({ action: "list" }, {
       directory
     });
-    const parsed = JSON.parse(result);
+    const parsed = safeParseResult(result);
     if (!parsed.success) {
       return `Error: ${parsed.error || "Failed to list checkpoints"}`;
     }
@@ -48287,7 +48384,8 @@ async function extractFromLegacy(directory) {
       mappedStatus = "complete";
     else if (status === "IN PROGRESS")
       mappedStatus = "in_progress";
-    const headerLineIndex = lines.indexOf(match[0]);
+    const headerLineIndex = planContent.substring(0, match.index).split(`
+`).length - 1;
     let completed = 0;
     let total = 0;
     if (headerLineIndex !== -1) {
@@ -48687,9 +48785,9 @@ async function getPlanData(directory, phaseArg) {
       return {
         hasPlan: true,
         fullMarkdown,
-        requestedPhase: NaN,
+        requestedPhase: null,
         phaseMarkdown: null,
-        errorMessage: null,
+        errorMessage: `Invalid phase number: "${phaseArg}"`,
         isLegacy: false
       };
     }
@@ -48740,9 +48838,9 @@ async function getPlanData(directory, phaseArg) {
     return {
       hasPlan: true,
       fullMarkdown: planContent,
-      requestedPhase: NaN,
+      requestedPhase: null,
       phaseMarkdown: null,
-      errorMessage: null,
+      errorMessage: `Invalid phase number: "${phaseArg}"`,
       isLegacy: true
     };
   }
@@ -48982,9 +49080,16 @@ function sanitizeSummaryId(id) {
 }
 async function storeSummary(directory, id, fullOutput, summaryText, maxStoredBytes) {
   const sanitizedId = sanitizeSummaryId(id);
-  const outputBytes = Buffer.byteLength(fullOutput, "utf8");
-  if (outputBytes > maxStoredBytes) {
-    throw new Error(`Summary fullOutput size (${outputBytes} bytes) exceeds maximum (${maxStoredBytes} bytes)`);
+  const preCheckEntry = {
+    id: sanitizedId,
+    summaryText,
+    fullOutput,
+    timestamp: Date.now(),
+    originalBytes: Buffer.byteLength(fullOutput, "utf8")
+  };
+  const serializedSize = Buffer.byteLength(JSON.stringify(preCheckEntry), "utf8");
+  if (serializedSize > maxStoredBytes) {
+    throw new Error(`Summary entry size (${serializedSize} bytes) exceeds maximum (${maxStoredBytes} bytes)`);
   }
   const relativePath = path27.join("summaries", `${sanitizedId}.json`);
   const summaryPath = validateSwarmPath(directory, relativePath);
@@ -48994,7 +49099,7 @@ async function storeSummary(directory, id, fullOutput, summaryText, maxStoredByt
     summaryText,
     fullOutput,
     timestamp: Date.now(),
-    originalBytes: outputBytes
+    originalBytes: Buffer.byteLength(fullOutput, "utf8")
   };
   const entryJson = JSON.stringify(entry);
   mkdirSync9(summaryDir, { recursive: true });
@@ -49560,7 +49665,15 @@ function makeInitialState() {
     lastSnapshotAt: null
   };
 }
-var state = makeInitialState();
+var sessionStates = new Map;
+function getSessionState(sessionId) {
+  let state = sessionStates.get(sessionId);
+  if (!state) {
+    state = makeInitialState();
+    sessionStates.set(sessionId, state);
+  }
+  return state;
+}
 function appendSnapshot(directory, tier, budgetPct, message) {
   try {
     const snapshotPath = path29.join(directory, ".swarm", "context-snapshot.md");
@@ -49599,6 +49712,7 @@ function createCompactionService(config3, directory, injectMessage) {
       if (budgetPct <= 0)
         return;
       const sessionId = _input.sessionID;
+      const state = getSessionState(sessionId);
       try {
         if (budgetPct >= config3.emergencyThreshold && budgetPct > state.lastEmergencyAt + 5) {
           state.lastEmergencyAt = budgetPct;
@@ -49630,11 +49744,23 @@ function createCompactionService(config3, directory, injectMessage) {
     }
   };
 }
-function getCompactionMetrics() {
-  return {
-    compactionCount: state.observationCount + state.reflectionCount + state.emergencyCount,
-    lastSnapshotAt: state.lastSnapshotAt
-  };
+function getCompactionMetrics(sessionId) {
+  if (sessionId) {
+    const state = getSessionState(sessionId);
+    return {
+      compactionCount: state.observationCount + state.reflectionCount + state.emergencyCount,
+      lastSnapshotAt: state.lastSnapshotAt
+    };
+  }
+  let total = 0;
+  let lastSnapshot = null;
+  for (const state of sessionStates.values()) {
+    total += state.observationCount + state.reflectionCount + state.emergencyCount;
+    if (state.lastSnapshotAt && (!lastSnapshot || state.lastSnapshotAt > lastSnapshot)) {
+      lastSnapshot = state.lastSnapshotAt;
+    }
+  }
+  return { compactionCount: total, lastSnapshotAt: lastSnapshot };
 }
 
 // src/services/context-budget-service.ts
@@ -49665,10 +49791,14 @@ async function readBudgetState(directory) {
     return null;
   }
 }
-async function writeBudgetState(directory, state2) {
-  const resolvedPath = validateSwarmPath(directory, "session/budget-state.json");
-  const content = JSON.stringify(state2, null, 2);
-  await Bun.write(resolvedPath, content);
+async function writeBudgetState(directory, state) {
+  try {
+    const resolvedPath = validateSwarmPath(directory, "session/budget-state.json");
+    const content = JSON.stringify(state, null, 2);
+    await Bun.write(resolvedPath, content);
+  } catch (error93) {
+    console.warn("[context-budget] Failed to write budget state:", error93 instanceof Error ? error93.message : String(error93));
+  }
 }
 async function countEvents(directory) {
   const content = await readSwarmFileAsync(directory, "events.jsonl");
@@ -49756,25 +49886,25 @@ async function formatBudgetWarning(report, directory, config3) {
     return formatWarningMessage(report);
   }
   const budgetState = await readBudgetState(directory);
-  const state2 = budgetState || {
+  const state = budgetState || {
     warningFiredAtTurn: null,
     criticalFiredAtTurn: null,
     lastInjectedAtTurn: null
   };
   const currentTurn = report.estimatedTurnCount;
   if (report.status === "warning") {
-    if (config3.warningMode === "once" && state2.warningFiredAtTurn !== null) {
+    if (config3.warningMode === "once" && state.warningFiredAtTurn !== null) {
       return null;
     }
-    if (config3.warningMode === "interval" && state2.warningFiredAtTurn !== null && currentTurn - state2.warningFiredAtTurn < config3.warningIntervalTurns) {
+    if (config3.warningMode === "interval" && state.warningFiredAtTurn !== null && currentTurn - state.warningFiredAtTurn < config3.warningIntervalTurns) {
       return null;
     }
-    state2.warningFiredAtTurn = currentTurn;
-    state2.lastInjectedAtTurn = currentTurn;
-    await writeBudgetState(directory, state2);
+    state.warningFiredAtTurn = currentTurn;
+    state.lastInjectedAtTurn = currentTurn;
+    await writeBudgetState(directory, state);
   } else if (report.status === "critical") {
-    state2.criticalFiredAtTurn = currentTurn;
-    state2.lastInjectedAtTurn = currentTurn;
+    state.criticalFiredAtTurn = currentTurn;
+    state.lastInjectedAtTurn = currentTurn;
   }
   return formatWarningMessage(report);
 }
@@ -49938,6 +50068,7 @@ async function handleTurboCommand(_directory, args2, sessionID) {
 
 // src/tools/write-retro.ts
 init_tool();
+init_evidence_schema();
 init_manager();
 init_create_tool();
 async function executeWriteRetro(args2, directory) {
@@ -50172,8 +50303,9 @@ async function executeWriteRetro(args2, directory) {
   };
   const taxonomy = [];
   try {
-    for (const taskSuffix of ["1", "2", "3", "4", "5"]) {
-      const phaseTaskId = `${phase}.${taskSuffix}`;
+    const allTaskIds = await listEvidenceTaskIds(directory);
+    const phaseTaskIds = allTaskIds.filter((id) => id.startsWith(`${phase}.`));
+    for (const phaseTaskId of phaseTaskIds) {
       const result = await loadEvidence(directory, phaseTaskId);
       if (result.status !== "found")
         continue;
@@ -50207,6 +50339,13 @@ async function executeWriteRetro(args2, directory) {
     }
   } catch {}
   retroEntry.error_taxonomy = [...new Set(taxonomy)];
+  const validationResult = RetrospectiveEvidenceSchema.safeParse(retroEntry);
+  if (!validationResult.success) {
+    return JSON.stringify({
+      success: false,
+      error: `Retrospective entry failed validation: ${validationResult.error.message}`
+    }, null, 2);
+  }
   try {
     await saveEvidence(directory, taskId, retroEntry);
     return JSON.stringify({
@@ -50271,7 +50410,7 @@ var write_retro = createSwarmTool({
   }
 });
 
-// src/commands/write_retro.ts
+// src/commands/write-retro.ts
 async function handleWriteRetroCommand(directory, args2) {
   if (args2.length === 0 || !args2[0] || args2[0].trim() === "") {
     return `## Usage: /swarm write-retro <json>
@@ -50537,6 +50676,7 @@ init_schema();
 
 // src/hooks/agent-activity.ts
 import { renameSync as renameSync8, unlinkSync as unlinkSync4 } from "fs";
+import * as nodePath2 from "path";
 init_utils();
 init_utils2();
 function createAgentActivityHooks(config3, directory) {
@@ -50561,7 +50701,7 @@ function createAgentActivityHooks(config3, directory) {
         return;
       swarmState.activeToolCalls.delete(input.callID);
       const duration5 = Date.now() - entry.startTime;
-      const success3 = output.output != null;
+      const success3 = output.success === true;
       const key = entry.tool;
       const existing = swarmState.toolAggregates.get(key) ?? {
         tool: key,
@@ -50606,7 +50746,7 @@ async function doFlush(directory) {
     const activitySection = renderActivitySection();
     const updated = replaceOrAppendSection(existing, "## Agent Activity", activitySection);
     const flushedCount = swarmState.pendingEvents;
-    const path30 = `${directory}/.swarm/context.md`;
+    const path30 = nodePath2.join(directory, ".swarm", "context.md");
     const tempPath = `${path30}.tmp`;
     try {
       await Bun.write(tempPath, updated);
@@ -50660,7 +50800,7 @@ ${content.substring(endIndex + 1)}`;
 // src/hooks/compaction-customizer.ts
 init_manager2();
 import * as fs20 from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 init_utils2();
 function createCompactionCustomizerHook(config3, directory) {
   const enabled = config3.hooks?.compaction !== false;
@@ -50706,7 +50846,7 @@ function createCompactionCustomizerHook(config3, directory) {
         }
       }
       try {
-        const summariesDir = join26(directory, ".swarm", "summaries");
+        const summariesDir = join27(directory, ".swarm", "summaries");
         const files = await fs20.promises.readdir(summariesDir);
         if (files.length > 0) {
           const count = files.length;
@@ -51262,6 +51402,67 @@ init_telemetry();
 import * as path30 from "path";
 init_constants();
 init_schema();
+
+// src/context/zone-classifier.ts
+function classifyFile(filePath) {
+  const normalized = filePath.toLowerCase().replace(/\\/g, "/");
+  if (normalized.endsWith(".wasm") || normalized.includes("/dist/") || normalized.includes("/build/") || normalized.includes(".swarm/checkpoints/")) {
+    return {
+      filePath,
+      zone: "generated",
+      confidence: "high",
+      reason: "path matches generated file patterns"
+    };
+  }
+  if (normalized.includes("/test/") || normalized.includes("/tests/") || normalized.includes("/__tests__/") || normalized.includes(".test.") || normalized.includes(".spec.") || normalized.includes("/mocks/")) {
+    return {
+      filePath,
+      zone: "test",
+      confidence: "high",
+      reason: "path matches test/**, tests/**, __tests__/**, *.test.*, *.spec.*, or **/mocks/**"
+    };
+  }
+  if (normalized.includes("/scripts/") || normalized.includes("makefile") || normalized.includes("dockerfile") || normalized.includes(".github/")) {
+    return {
+      filePath,
+      zone: "build",
+      confidence: "high",
+      reason: "path matches build scripts or CI configuration"
+    };
+  }
+  if (normalized.endsWith(".json") && !normalized.includes(".github/") || normalized.endsWith(".yaml") && !normalized.includes(".github/") || normalized.endsWith(".yml") && !normalized.includes(".github/") || normalized.endsWith(".toml") || normalized.includes(".env") || normalized.endsWith("biome.json") || normalized.endsWith("tsconfig.json")) {
+    return {
+      filePath,
+      zone: "config",
+      confidence: "high",
+      reason: "extension is config file type"
+    };
+  }
+  if (normalized.includes("/docs/") || normalized.endsWith(".md") && !normalized.includes("/") || normalized.includes("readme") || normalized.includes("changelog") || normalized.includes("license")) {
+    return {
+      filePath,
+      zone: "docs",
+      confidence: "high",
+      reason: "path matches docs/** or documentation files"
+    };
+  }
+  if (normalized.includes("/src/") || normalized.includes("/lib/")) {
+    return {
+      filePath,
+      zone: "production",
+      confidence: "high",
+      reason: "path matches src/** or lib/**"
+    };
+  }
+  return {
+    filePath,
+    zone: "production",
+    confidence: "medium",
+    reason: "default classification"
+  };
+}
+
+// src/hooks/guardrails.ts
 init_manager2();
 init_telemetry();
 init_utils();
@@ -51551,6 +51752,12 @@ function createGuardrailsHooks(directory, directoryOrConfig, config3) {
           const delegArgs = output.args;
           const delegTargetPath = delegArgs?.filePath ?? delegArgs?.path ?? delegArgs?.file ?? delegArgs?.target;
           if (typeof delegTargetPath === "string" && delegTargetPath.length > 0) {
+            const agentName2 = swarmState.activeAgent.get(input.sessionID) ?? "unknown";
+            const cwd = directory ?? process.cwd();
+            const authorityCheck = checkFileAuthority(agentName2, delegTargetPath, cwd);
+            if (!authorityCheck.allowed) {
+              throw new Error(`WRITE BLOCKED: Agent "${agentName2}" is not authorised to write "${delegTargetPath}". Reason: ${authorityCheck.reason}`);
+            }
             if (!currentSession.modifiedFilesThisCoderTask.includes(delegTargetPath)) {
               currentSession.modifiedFilesThisCoderTask.push(delegTargetPath);
             }
@@ -51859,7 +52066,7 @@ function createGuardrailsHooks(directory, directoryOrConfig, config3) {
           session.partialGateWarningsIssuedForTask?.delete(session.currentTaskId);
           if (session.declaredCoderScope !== null) {
             const undeclaredFiles = session.modifiedFilesThisCoderTask.map((f) => f.replace(/[\r\n\t]/g, "_")).filter((f) => !isInDeclaredScope(f, session.declaredCoderScope));
-            if (undeclaredFiles.length > 2) {
+            if (undeclaredFiles.length >= 1) {
               const safeTaskId = String(session.currentTaskId ?? "").replace(/[\r\n\t]/g, "_");
               session.lastScopeViolation = `Scope violation for task ${safeTaskId}: ` + `${undeclaredFiles.length} undeclared files modified: ` + undeclaredFiles.join(", ");
               session.scopeViolationDetected = true;
@@ -52245,6 +52452,98 @@ function hashArgs(args2) {
     return 0;
   }
 }
+var AGENT_AUTHORITY_RULES = {
+  architect: {
+    blockedExact: [".swarm/plan.md", ".swarm/plan.json"],
+    blockedZones: ["generated"]
+  },
+  coder: {
+    blockedPrefix: [".swarm/"],
+    allowedPrefix: ["src/", "tests/", "docs/", "scripts/"],
+    blockedZones: ["generated", "config"]
+  },
+  reviewer: {
+    blockedExact: [".swarm/plan.md", ".swarm/plan.json"],
+    blockedPrefix: ["src/"],
+    allowedPrefix: [".swarm/evidence/", ".swarm/outputs/"],
+    blockedZones: ["generated"]
+  },
+  explorer: {
+    readOnly: true
+  },
+  sme: {
+    readOnly: true
+  },
+  test_engineer: {
+    blockedExact: [".swarm/plan.md", ".swarm/plan.json"],
+    blockedPrefix: ["src/"],
+    allowedPrefix: ["tests/", ".swarm/evidence/"],
+    blockedZones: ["generated"]
+  },
+  docs: {
+    allowedPrefix: ["docs/", ".swarm/outputs/"],
+    blockedZones: ["generated"]
+  },
+  designer: {
+    allowedPrefix: ["docs/", ".swarm/outputs/"],
+    blockedZones: ["generated"]
+  },
+  critic: {
+    allowedPrefix: [".swarm/evidence/"],
+    blockedZones: ["generated"]
+  }
+};
+function checkFileAuthority(agentName, filePath, _cwd) {
+  const normalizedAgent = agentName.toLowerCase();
+  const normalizedPath = filePath.replace(/\\/g, "/");
+  const rules = AGENT_AUTHORITY_RULES[normalizedAgent];
+  if (!rules) {
+    return { allowed: false, reason: `Unknown agent: ${agentName}` };
+  }
+  if (rules.readOnly) {
+    return {
+      allowed: false,
+      reason: `Path blocked: ${normalizedPath} (agent ${normalizedAgent} is read-only)`
+    };
+  }
+  if (rules.blockedExact) {
+    for (const blocked of rules.blockedExact) {
+      if (normalizedPath === blocked) {
+        return { allowed: false, reason: `Path blocked: ${normalizedPath}` };
+      }
+    }
+  }
+  if (rules.blockedPrefix) {
+    for (const prefix of rules.blockedPrefix) {
+      if (normalizedPath.startsWith(prefix)) {
+        return {
+          allowed: false,
+          reason: `Path blocked: ${normalizedPath} is under ${prefix}`
+        };
+      }
+    }
+  }
+  if (rules.allowedPrefix && rules.allowedPrefix.length > 0) {
+    const isAllowed = rules.allowedPrefix.some((prefix) => normalizedPath.startsWith(prefix));
+    if (!isAllowed) {
+      return {
+        allowed: false,
+        reason: `Path ${normalizedPath} not in allowed list for ${normalizedAgent}`
+      };
+    }
+  }
+  if (rules.blockedZones && rules.blockedZones.length > 0) {
+    const { zone } = classifyFile(normalizedPath);
+    if (rules.blockedZones.includes(zone)) {
+      return {
+        allowed: false,
+        reason: `Path blocked: ${normalizedPath} is in ${zone} zone`,
+        zone
+      };
+    }
+  }
+  return { allowed: true };
+}
 
 // src/hooks/delegation-gate.ts
 init_utils2();
@@ -52349,8 +52648,8 @@ function createDelegationGateHook(config3, directory) {
     const session = swarmState.agentSessions.get(input.sessionID);
     if (!session || !session.taskWorkflowStates)
       return;
-    for (const [taskId, state2] of session.taskWorkflowStates) {
-      if (state2 !== "coder_delegated")
+    for (const [taskId, state] of session.taskWorkflowStates) {
+      if (state !== "coder_delegated")
         continue;
       const turbo = hasActiveTurboMode(input.sessionID);
       if (turbo) {
@@ -52381,23 +52680,23 @@ function createDelegationGateHook(config3, directory) {
         if (targetAgent === "test_engineer")
           hasTestEngineer = true;
         if (targetAgent === "reviewer" && session.taskWorkflowStates) {
-          for (const [taskId, state2] of session.taskWorkflowStates) {
-            if (state2 === "coder_delegated" || state2 === "pre_check_passed") {
+          for (const [taskId, state] of session.taskWorkflowStates) {
+            if (state === "coder_delegated" || state === "pre_check_passed") {
               try {
                 advanceTaskState(session, taskId, "reviewer_run");
               } catch (err2) {
-                console.warn(`[delegation-gate] toolAfter: could not advance ${taskId} (${state2}) \u2192 reviewer_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
+                console.warn(`[delegation-gate] toolAfter: could not advance ${taskId} (${state}) \u2192 reviewer_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
               }
             }
           }
         }
         if (targetAgent === "test_engineer" && session.taskWorkflowStates) {
-          for (const [taskId, state2] of session.taskWorkflowStates) {
-            if (state2 === "reviewer_run") {
+          for (const [taskId, state] of session.taskWorkflowStates) {
+            if (state === "reviewer_run") {
               try {
                 advanceTaskState(session, taskId, "tests_run");
               } catch (err2) {
-                console.warn(`[delegation-gate] toolAfter: could not advance ${taskId} (${state2}) \u2192 tests_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
+                console.warn(`[delegation-gate] toolAfter: could not advance ${taskId} (${state}) \u2192 tests_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
               }
             }
           }
@@ -52413,12 +52712,12 @@ function createDelegationGateHook(config3, directory) {
               if (seedTaskId && !otherSession.taskWorkflowStates.has(seedTaskId)) {
                 otherSession.taskWorkflowStates.set(seedTaskId, "coder_delegated");
               }
-              for (const [taskId, state2] of otherSession.taskWorkflowStates) {
-                if (state2 === "coder_delegated" || state2 === "pre_check_passed") {
+              for (const [taskId, state] of otherSession.taskWorkflowStates) {
+                if (state === "coder_delegated" || state === "pre_check_passed") {
                   try {
                     advanceTaskState(otherSession, taskId, "reviewer_run");
                   } catch (err2) {
-                    console.warn(`[delegation-gate] toolAfter cross-session: could not advance ${taskId} (${state2}) \u2192 reviewer_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
+                    console.warn(`[delegation-gate] toolAfter cross-session: could not advance ${taskId} (${state}) \u2192 reviewer_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
                   }
                 }
               }
@@ -52428,12 +52727,12 @@ function createDelegationGateHook(config3, directory) {
               if (seedTaskId && !otherSession.taskWorkflowStates.has(seedTaskId)) {
                 otherSession.taskWorkflowStates.set(seedTaskId, "reviewer_run");
               }
-              for (const [taskId, state2] of otherSession.taskWorkflowStates) {
-                if (state2 === "reviewer_run") {
+              for (const [taskId, state] of otherSession.taskWorkflowStates) {
+                if (state === "reviewer_run") {
                   try {
                     advanceTaskState(otherSession, taskId, "tests_run");
                   } catch (err2) {
-                    console.warn(`[delegation-gate] toolAfter cross-session: could not advance ${taskId} (${state2}) \u2192 tests_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
+                    console.warn(`[delegation-gate] toolAfter cross-session: could not advance ${taskId} (${state}) \u2192 tests_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
                   }
                 }
               }
@@ -52497,23 +52796,23 @@ function createDelegationGateHook(config3, directory) {
             session.qaSkipTaskIds = [];
           }
           if (lastCoderIndex !== -1 && hasReviewer && session.taskWorkflowStates) {
-            for (const [taskId, state2] of session.taskWorkflowStates) {
-              if (state2 === "coder_delegated" || state2 === "pre_check_passed") {
+            for (const [taskId, state] of session.taskWorkflowStates) {
+              if (state === "coder_delegated" || state === "pre_check_passed") {
                 try {
                   advanceTaskState(session, taskId, "reviewer_run");
                 } catch (err2) {
-                  console.warn(`[delegation-gate] fallback: could not advance ${taskId} (${state2}) \u2192 reviewer_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
+                  console.warn(`[delegation-gate] fallback: could not advance ${taskId} (${state}) \u2192 reviewer_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
                 }
               }
             }
           }
           if (lastCoderIndex !== -1 && hasReviewer && hasTestEngineer && session.taskWorkflowStates) {
-            for (const [taskId, state2] of session.taskWorkflowStates) {
-              if (state2 === "reviewer_run") {
+            for (const [taskId, state] of session.taskWorkflowStates) {
+              if (state === "reviewer_run") {
                 try {
                   advanceTaskState(session, taskId, "tests_run");
                 } catch (err2) {
-                  console.warn(`[delegation-gate] fallback: could not advance ${taskId} (${state2}) \u2192 tests_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
+                  console.warn(`[delegation-gate] fallback: could not advance ${taskId} (${state}) \u2192 tests_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
                 }
               }
             }
@@ -52528,12 +52827,12 @@ function createDelegationGateHook(config3, directory) {
               if (seedTaskId && !otherSession.taskWorkflowStates.has(seedTaskId)) {
                 otherSession.taskWorkflowStates.set(seedTaskId, "coder_delegated");
               }
-              for (const [taskId, state2] of otherSession.taskWorkflowStates) {
-                if (state2 === "coder_delegated" || state2 === "pre_check_passed") {
+              for (const [taskId, state] of otherSession.taskWorkflowStates) {
+                if (state === "coder_delegated" || state === "pre_check_passed") {
                   try {
                     advanceTaskState(otherSession, taskId, "reviewer_run");
                   } catch (err2) {
-                    console.warn(`[delegation-gate] fallback cross-session: could not advance ${taskId} (${state2}) \u2192 reviewer_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
+                    console.warn(`[delegation-gate] fallback cross-session: could not advance ${taskId} (${state}) \u2192 reviewer_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
                   }
                 }
               }
@@ -52549,12 +52848,12 @@ function createDelegationGateHook(config3, directory) {
               if (seedTaskId && !otherSession.taskWorkflowStates.has(seedTaskId)) {
                 otherSession.taskWorkflowStates.set(seedTaskId, "reviewer_run");
               }
-              for (const [taskId, state2] of otherSession.taskWorkflowStates) {
-                if (state2 === "reviewer_run") {
+              for (const [taskId, state] of otherSession.taskWorkflowStates) {
+                if (state === "reviewer_run") {
                   try {
                     advanceTaskState(otherSession, taskId, "tests_run");
                   } catch (err2) {
-                    console.warn(`[delegation-gate] fallback cross-session: could not advance ${taskId} (${state2}) \u2192 tests_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
+                    console.warn(`[delegation-gate] fallback cross-session: could not advance ${taskId} (${state}) \u2192 tests_run: ${err2 instanceof Error ? err2.message : String(err2)}`);
                   }
                 }
               }
@@ -55295,7 +55594,7 @@ ${errorSummary}`);
 
 // src/hooks/knowledge-reader.ts
 init_knowledge_store();
-import { existsSync as existsSync22 } from "fs";
+import { existsSync as existsSync23 } from "fs";
 import { mkdir as mkdir6, readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
 import * as path38 from "path";
 var JACCARD_THRESHOLD = 0.6;
@@ -55348,7 +55647,7 @@ async function recordLessonsShown(directory, lessonIds, currentPhase) {
   const shownFile = path38.join(directory, ".swarm", ".knowledge-shown.json");
   try {
     let shownData = {};
-    if (existsSync22(shownFile)) {
+    if (existsSync23(shownFile)) {
       const content = await readFile6(shownFile, "utf-8");
       shownData = JSON.parse(content);
     }
@@ -55452,7 +55751,7 @@ async function readMergedKnowledge(directory, config3, context) {
 async function updateRetrievalOutcome(directory, phaseInfo, phaseSucceeded) {
   const shownFile = path38.join(directory, ".swarm", ".knowledge-shown.json");
   try {
-    if (!existsSync22(shownFile)) {
+    if (!existsSync23(shownFile)) {
       return;
     }
     const content = await readFile6(shownFile, "utf-8");
@@ -55917,7 +56216,7 @@ Use this data to avoid repeating known failure patterns.`;
     const availableContentTokens = MAX_SUMMARY_TOKENS - prefixTokens - suffixTokens;
     if (availableContentTokens > 0) {
       const maxContentChars = Math.floor(availableContentTokens / 0.33);
-      summaryText = summaryText.slice(-maxContentChars);
+      summaryText = summaryText.slice(0, maxContentChars);
     } else {
       summaryText = "";
     }
@@ -56466,6 +56765,19 @@ init_config_doctor();
 
 // src/session/snapshot-reader.ts
 init_utils2();
+var TRANSIENT_SESSION_FIELDS = [
+  { name: "revisionLimitHit", resetValue: false },
+  { name: "coderRevisions", resetValue: 0 },
+  { name: "selfFixAttempted", resetValue: false },
+  { name: "lastGateFailure", resetValue: null },
+  { name: "architectWriteCount", resetValue: 0 },
+  { name: "selfCodingWarnedAtCount", resetValue: 0 },
+  { name: "pendingAdvisoryMessages", resetValue: [] },
+  { name: "model_fallback_index", resetValue: 0 },
+  { name: "modelFallbackExhausted", resetValue: false },
+  { name: "scopeViolationDetected", resetValue: false },
+  { name: "delegationActive", resetValue: false }
+];
 var VALID_TASK_WORKFLOW_STATES = [
   "idle",
   "coder_delegated",
@@ -56612,17 +56924,9 @@ async function rehydrateState(snapshot) {
           window2.warningReason = "";
         }
       }
-      session.revisionLimitHit = false;
-      session.coderRevisions = 0;
-      session.selfFixAttempted = false;
-      session.lastGateFailure = null;
-      session.architectWriteCount = 0;
-      session.selfCodingWarnedAtCount = 0;
-      session.pendingAdvisoryMessages = [];
-      session.model_fallback_index = 0;
-      session.modelFallbackExhausted = false;
-      session.scopeViolationDetected = false;
-      session.delegationActive = false;
+      for (const field of TRANSIENT_SESSION_FIELDS) {
+        session[field.name] = field.resetValue;
+      }
       swarmState.agentSessions.set(sessionId, session);
     }
   }
@@ -57106,7 +57410,7 @@ async function executeCompletionVerify(args2, directory) {
     return JSON.stringify(result2, null, 2);
   }
   let tasksChecked = 0;
-  let tasksSkipped = 0;
+  const tasksSkipped = 0;
   let tasksBlocked = 0;
   const blockedTasks = [];
   for (const task of targetPhase.tasks) {
@@ -57117,17 +57421,30 @@ async function executeCompletionVerify(args2, directory) {
     const fileTargets = parseFilePaths(task.description, task.files_touched);
     const identifiers = parseIdentifiers(task.description);
     if (fileTargets.length === 0) {
-      tasksSkipped++;
+      blockedTasks.push({
+        task_id: task.id,
+        identifier: "",
+        file_path: "",
+        reason: "No file targets \u2014 cannot verify completion without files_touched"
+      });
+      tasksBlocked++;
       continue;
     }
     if (identifiers.length === 0) {
-      tasksSkipped++;
+      blockedTasks.push({
+        task_id: task.id,
+        identifier: "",
+        file_path: "",
+        reason: "No identifiers \u2014 cannot verify completion without identifiers"
+      });
+      tasksBlocked++;
       continue;
     }
-    let foundCount = 0;
+    const foundIdentifiers = new Set;
     let hasFileReadFailure = false;
     for (const filePath of fileTargets) {
-      const resolvedPath = path43.resolve(directory, filePath);
+      const normalizedPath = filePath.replace(/\\/g, "/");
+      const resolvedPath = path43.resolve(directory, normalizedPath);
       let fileContent;
       try {
         fileContent = fs32.readFileSync(resolvedPath, "utf-8");
@@ -57143,11 +57460,11 @@ async function executeCompletionVerify(args2, directory) {
       }
       for (const identifier of identifiers) {
         if (fileContent.includes(identifier)) {
-          foundCount++;
-          break;
+          foundIdentifiers.add(identifier);
         }
       }
     }
+    const foundCount = foundIdentifiers.size;
     if (hasFileReadFailure || foundCount === 0) {
       if (!hasFileReadFailure) {
         blockedTasks.push({
@@ -57810,6 +58127,11 @@ var languageDefinitions = [
     id: "rust",
     extensions: [".rs"],
     commentNodes: ["line_comment", "block_comment"]
+  },
+  {
+    id: "php",
+    extensions: [".php", ".phtml"],
+    commentNodes: ["comment"]
   }
 ];
 var extensionMap = new Map;
@@ -57873,10 +58195,16 @@ async function computeASTDiff(filePath, oldContent, newContent) {
     };
   }
   try {
+    let timeoutId;
     const parser = await Promise.race([
       loadGrammar(language.id),
-      new Promise((_, reject) => setTimeout(() => reject(new Error("AST_TIMEOUT")), AST_TIMEOUT_MS))
-    ]);
+      new Promise((_, reject) => {
+        timeoutId = setTimeout(() => reject(new Error("AST_TIMEOUT")), AST_TIMEOUT_MS);
+      })
+    ]).finally(() => {
+      if (timeoutId)
+        clearTimeout(timeoutId);
+    });
     const oldTree = parser.parse(oldContent);
     const newTree = parser.parse(newContent);
     if (!oldTree || !newTree) {
@@ -59063,7 +59391,7 @@ function findSourceFiles(dir, files = [], stats = { skippedDirs: [], skippedFile
   return files;
 }
 var imports = createSwarmTool({
-  description: "Find all consumers that import from a given file. Returns JSON with file path, line numbers, and import metadata for each consumer. Useful for understanding dependency relationships.",
+  description: "Find all reverse dependencies (consumers) that import from a given file. Returns JSON with file path, line numbers, and import metadata for each consumer. Use this to understand who depends on a module before refactoring.",
   args: {
     file: tool.schema.string().describe('Source file path to find importers for (e.g., "./src/utils.ts")'),
     symbol: tool.schema.string().optional().describe('Optional specific symbol to filter imports (e.g., "MyClass")')
@@ -59218,7 +59546,9 @@ var imports = createSwarmTool({
 });
 // src/tools/knowledge-add.ts
 init_dist();
+init_config();
 init_knowledge_store();
+import { randomUUID as randomUUID4 } from "crypto";
 init_manager2();
 init_create_tool();
 var VALID_CATEGORIES2 = [
@@ -59293,7 +59623,7 @@ var knowledgeAdd = createSwarmTool({
       project_name = plan?.title ?? "";
     } catch {}
     const entry = {
-      id: crypto.randomUUID(),
+      id: randomUUID4(),
       tier: "swarm",
       lesson,
       category,
@@ -59314,6 +59644,22 @@ var knowledgeAdd = createSwarmTool({
       auto_generated: true,
       hive_eligible: false
     };
+    try {
+      const { config: config3 } = loadPluginConfigWithMeta(directory);
+      if (config3.knowledge?.validation_enabled !== false) {
+        const validation = validateLesson(lesson, [], {
+          category,
+          scope,
+          confidence: 0.5
+        });
+        if (!validation.valid) {
+          return JSON.stringify({
+            success: false,
+            error: `Validation failed: ${validation.reason}`
+          });
+        }
+      }
+    } catch {}
     try {
       await appendKnowledge(resolveSwarmKnowledgePath(directory), entry);
     } catch (err2) {
@@ -59332,9 +59678,10 @@ var knowledgeAdd = createSwarmTool({
 });
 // src/tools/knowledge-query.ts
 init_dist();
+init_config();
 init_knowledge_store();
 init_create_tool();
-import { existsSync as existsSync30 } from "fs";
+import { existsSync as existsSync31 } from "fs";
 var DEFAULT_LIMIT = 10;
 var MAX_LESSON_LENGTH = 200;
 var VALID_CATEGORIES3 = [
@@ -59403,19 +59750,19 @@ function validateLimit(limit) {
 }
 async function readSwarmKnowledge(directory) {
   const swarmPath = resolveSwarmKnowledgePath(directory);
-  if (!existsSync30(swarmPath)) {
+  if (!existsSync31(swarmPath)) {
     return [];
   }
   return readKnowledge(swarmPath);
 }
 async function readHiveKnowledge() {
   const hivePath = resolveHiveKnowledgePath();
-  if (!existsSync30(hivePath)) {
+  if (!existsSync31(hivePath)) {
     return [];
   }
   return readKnowledge(hivePath);
 }
-function filterSwarmEntries(entries, filters) {
+function filterSwarmEntries(entries, filters, scopeFilter) {
   return entries.filter((entry) => {
     if (filters.status && entry.status !== filters.status) {
       return false;
@@ -59426,6 +59773,12 @@ function filterSwarmEntries(entries, filters) {
     if (filters.minScore !== undefined && entry.confidence < filters.minScore) {
       return false;
     }
+    if (scopeFilter && scopeFilter.length > 0) {
+      const entryScope = entry.scope ?? "global";
+      if (!scopeFilter.some((pattern) => entryScope === pattern)) {
+        return false;
+      }
+    }
     return true;
   });
 }
@@ -59510,9 +59863,14 @@ var knowledge_query = createSwarmTool({
       minScore: minScore ?? undefined
     };
     const results = [];
+    let scopeFilter;
+    try {
+      const { config: config3 } = loadPluginConfigWithMeta(directory);
+      scopeFilter = config3.knowledge?.scope_filter;
+    } catch {}
     if (tier === "swarm" || tier === "all") {
       const swarmEntries = await readSwarmKnowledge(directory);
-      const filtered = filterSwarmEntries(swarmEntries, filters);
+      const filtered = filterSwarmEntries(swarmEntries, filters, scopeFilter);
       for (const entry of filtered) {
         results.push({ entry, tier: "swarm" });
       }
@@ -60042,7 +60400,14 @@ async function executePhaseComplete(args2, workingDirectory, directory) {
   if (retroFound && retroEntry?.lessons_learned && retroEntry.lessons_learned.length > 0) {
     try {
       const projectName = path49.basename(dir);
-      await curateAndStoreSwarm(retroEntry.lessons_learned, projectName, { phase_number: phase }, dir, knowledgeConfig);
+      const curationResult = await curateAndStoreSwarm(retroEntry.lessons_learned, projectName, { phase_number: phase }, dir, knowledgeConfig);
+      if (curationResult) {
+        const sessionState = swarmState.agentSessions.get(sessionID);
+        if (sessionState) {
+          sessionState.pendingAdvisoryMessages ??= [];
+          sessionState.pendingAdvisoryMessages.push(`[CURATOR] Knowledge curation: ${curationResult.stored} stored, ${curationResult.skipped} skipped, ${curationResult.rejected} rejected.`);
+        }
+      }
     } catch (error93) {
       safeWarn("[phase_complete] Failed to curate lessons from retrospective:", error93);
     }
@@ -60076,7 +60441,17 @@ async function executePhaseComplete(args2, workingDirectory, directory) {
   } catch (curatorError) {
     safeWarn("[phase_complete] Curator pipeline error (non-blocking):", curatorError);
   }
-  const effectiveRequired = [...phaseCompleteConfig.required_agents];
+  let phaseRequiredAgents;
+  try {
+    const planPath = validateSwarmPath(dir, "plan.json");
+    const planRaw = fs38.readFileSync(planPath, "utf-8");
+    const plan = JSON.parse(planRaw);
+    const phaseObj = plan.phases.find((p) => p.id === phase);
+    phaseRequiredAgents = phaseObj?.required_agents;
+  } catch {}
+  const effectiveRequired = [
+    ...phaseRequiredAgents ?? phaseCompleteConfig.required_agents
+  ];
   if (phaseCompleteConfig.require_docs && !effectiveRequired.includes("docs")) {
     effectiveRequired.push("docs");
   }
@@ -62541,7 +62916,7 @@ var javascriptRules = [
     languages: ["javascript", "typescript"],
     description: "Potential command injection via child_process.exec() with unsanitized input",
     remediation: "Never pass user input directly to exec(). Use execFile() with arguments array or sanitize input thoroughly.",
-    pattern: /exec\s*\(\s*[`'"]/,
+    pattern: /exec\s*\(\s*(?:[`'"]|\w)/,
     validate: (_match, _context) => {
       return true;
     }
@@ -62864,9 +63239,7 @@ function executeRulesSync(filePath, content, language) {
 }
 
 // src/sast/semgrep.ts
-import { execFile as execFile2, execFileSync as execFileSync2, spawn as spawn2 } from "child_process";
-import { promisify as promisify2 } from "util";
-var _execFileAsync = promisify2(execFile2);
+import { execFileSync as execFileSync2, spawn as spawn2 } from "child_process";
 var semgrepAvailableCache = null;
 var DEFAULT_RULES_DIR = ".swarm/semgrep-rules";
 var DEFAULT_TIMEOUT_MS3 = 30000;
@@ -62891,7 +63264,12 @@ function parseSemgrepResults(semgrepOutput) {
   try {
     const parsed = JSON.parse(semgrepOutput);
     const results = parsed.results || parsed;
+    if (!Array.isArray(results)) {
+      return [];
+    }
     for (const result of results) {
+      if (!result || typeof result !== "object")
+        continue;
       const severity = mapSemgrepSeverity(result.extra?.severity || result.severity);
       findings.push({
         rule_id: result.check_id || result.rule_id || "unknown",
@@ -64041,10 +64419,11 @@ import * as path54 from "path";
 var LOCKS_DIR = ".swarm/locks";
 var LOCK_TIMEOUT_MS = 5 * 60 * 1000;
 function getLockFilePath(directory, filePath) {
-  if (filePath.includes("..")) {
+  const normalized = path54.resolve(directory, filePath);
+  if (!normalized.startsWith(path54.resolve(directory))) {
     throw new Error("Invalid file path: path traversal not allowed");
   }
-  const hash3 = Buffer.from(filePath).toString("base64").replace(/[/+=]/g, "_");
+  const hash3 = Buffer.from(normalized).toString("base64").replace(/[/+=]/g, "_");
   return path54.join(directory, LOCKS_DIR, `${hash3}.lock`);
 }
 function tryAcquireLock(directory, filePath, agent, taskId) {
@@ -64224,12 +64603,24 @@ async function executeSavePlan(args2, fallbackDir) {
         });
         await fs44.promises.writeFile(markerPath, marker, "utf8");
       } catch {}
+      const warnings = [];
+      let criticReviewFound = false;
+      for (const [, session] of swarmState.agentSessions) {
+        if (session.phaseAgentsDispatched?.has("critic") || session.lastCompletedPhaseAgentsDispatched?.has("critic")) {
+          criticReviewFound = true;
+          break;
+        }
+      }
+      if (!criticReviewFound) {
+        warnings.push("No critic review detected before plan save. Consider delegating to critic for plan validation.");
+      }
       return {
         success: true,
         message: "Plan saved successfully",
         plan_path: path55.join(dir, ".swarm", "plan.json"),
         phases_count: plan.phases.length,
-        tasks_count: tasksCount
+        tasks_count: tasksCount,
+        ...warnings.length > 0 ? { warnings } : {}
       };
     } finally {
       releaseLock(dir, planFilePath, lockTaskId);
@@ -64699,7 +65090,7 @@ function parseYarnLock(content) {
   const components = [];
   const blocks = content.split(/^(?=@?[\w-]+@)/m);
   for (const block of blocks) {
-    const pkgMatch = block.match(/^(@?[\w-]+)@([\d.]+)/m);
+    const pkgMatch = block.match(/^(@?[\w-]+)@(\d+\.\d+\.\d+(?:-[\w.]+)?)/m);
     if (!pkgMatch)
       continue;
     const name2 = pkgMatch[1];
@@ -64963,8 +65354,8 @@ function parsePackageResolved(content) {
     const pins = resolved.pins || [];
     for (const pin of pins) {
       const identity = pin.identity || pin.package || "";
-      const state2 = pin.state || {};
-      const version3 = state2.version || state2.revision || "";
+      const state = pin.state || {};
+      const version3 = state.version || state.revision || "";
       let org = "";
       const location = pin.location || "";
       const orgMatch = location.match(/github\.com\/([^/]+)\//);
@@ -65050,7 +65441,9 @@ function detectComponents(filePath, content) {
       if (components.length > 0) {
         return components;
       }
-    } catch {}
+    } catch (error93) {
+      console.warn(`[sbom] Detector failed for ${filePath}:`, error93 instanceof Error ? error93.message : String(error93));
+    }
   }
   return [];
 }
@@ -66439,8 +66832,8 @@ function checkReviewerGate(taskId, workingDirectory) {
         continue;
       }
       validSessionCount++;
-      const state2 = getTaskState(session, taskId);
-      if (state2 === "tests_run" || state2 === "complete") {
+      const state = getTaskState(session, taskId);
+      if (state === "tests_run" || state === "complete") {
         return { blocked: false, reason: "" };
       }
     }
@@ -66451,8 +66844,8 @@ function checkReviewerGate(taskId, workingDirectory) {
     for (const [sessionId, session] of swarmState.agentSessions) {
       if (!(session.taskWorkflowStates instanceof Map))
         continue;
-      const state2 = getTaskState(session, taskId);
-      stateEntries.push(`${sessionId}: ${state2}`);
+      const state = getTaskState(session, taskId);
+      stateEntries.push(`${sessionId}: ${state}`);
     }
     try {
       const resolvedDir2 = workingDirectory;
@@ -66675,19 +67068,35 @@ async function executeUpdateTaskStatus(args2, fallbackDir) {
     }
   } else {
     if (!fallbackDir) {
-      console.warn("[update-task-status] fallbackDir is undefined");
+      return {
+        success: false,
+        message: "No working_directory provided and fallbackDir is undefined",
+        errors: ["Cannot resolve directory for task status update"]
+      };
     }
     directory = fallbackDir;
   }
   if (args2.status === "completed") {
     recoverTaskStateFromDelegations(args2.task_id);
-    const reviewerCheck = await checkReviewerGateWithScope(args2.task_id, directory);
-    if (reviewerCheck.blocked) {
-      return {
-        success: false,
-        message: "Gate check failed: reviewer delegation required before marking task as completed",
-        errors: [reviewerCheck.reason]
-      };
+    let phaseRequiresReviewer = true;
+    try {
+      const planPath = path61.join(directory, ".swarm", "plan.json");
+      const planRaw = fs50.readFileSync(planPath, "utf-8");
+      const plan = JSON.parse(planRaw);
+      const taskPhase = plan.phases.find((p) => p.tasks.some((t) => t.id === args2.task_id));
+      if (taskPhase?.required_agents && !taskPhase.required_agents.includes("reviewer")) {
+        phaseRequiresReviewer = false;
+      }
+    } catch {}
+    if (phaseRequiresReviewer) {
+      const reviewerCheck = await checkReviewerGateWithScope(args2.task_id, directory);
+      if (reviewerCheck.blocked) {
+        return {
+          success: false,
+          message: "Gate check failed: reviewer delegation required before marking task as completed",
+          errors: [reviewerCheck.reason]
+        };
+      }
     }
   }
   try {