opencode-swarm 7.107.5 → 7.108.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (87) hide show
  1. package/.opencode/skills/codebase-review-swarm/SKILL.md +15 -0
  2. package/.opencode/skills/codebase-review-swarm/references/review-protocol-v8.2.md +15 -0
  3. package/.opencode/skills/engineering-conventions/SKILL.md +1 -1
  4. package/.opencode/skills/execute/SKILL.md +2 -0
  5. package/.opencode/skills/phase-wrap/SKILL.md +6 -1
  6. package/.opencode/skills/swarm-implement/SKILL.md +161 -0
  7. package/.opencode/skills/swarm-pr-feedback/SKILL.md +5 -2
  8. package/.opencode/skills/swarm-pr-review/SKILL.md +61 -0
  9. package/.opencode/skills/writing-tests/SKILL.md +7 -0
  10. package/dist/cli/{capability-probe-wsjzcp48.js → capability-probe-sh9bwh39.js} +2 -1
  11. package/dist/cli/{config-doctor-kdq3vae4.js → config-doctor-q354tb2w.js} +2 -2
  12. package/dist/cli/core-vev13ej2.js +34 -0
  13. package/dist/cli/{curator-drift-ed7p5mfy.js → curator-drift-fdfgj9qf.js} +3 -3
  14. package/dist/cli/{curator-k9swkynp.js → curator-js92gc8a.js} +24 -20
  15. package/dist/cli/curator-llm-factory-n70bxf40.js +40 -0
  16. package/dist/cli/{dispatch-anmxxhen.js → dispatch-zr1xja4t.js} +2 -2
  17. package/dist/cli/{evidence-summary-service-6zsgw7x7.js → evidence-summary-service-bjhr75v0.js} +9 -7
  18. package/dist/cli/{gate-evidence-pgr7d942.js → gate-evidence-v6ds8rcp.js} +5 -4
  19. package/dist/cli/guardrail-explain-sn2a4pb7.js +41 -0
  20. package/dist/cli/{guardrail-log-fjypsmek.js → guardrail-log-8mqqsssq.js} +4 -4
  21. package/dist/cli/hive-promoter-3hh8ph4a.js +48 -0
  22. package/dist/cli/{index-9b7qp18e.js → index-1cn967sa.js} +2 -2
  23. package/dist/cli/{index-vzq4h90s.js → index-1emhz3zb.js} +1380 -2013
  24. package/dist/cli/{index-n1sptn1w.js → index-2nt4mq9n.js} +1 -1
  25. package/dist/cli/{index-6h82c2h0.js → index-48mc4d48.js} +1056 -192
  26. package/dist/cli/{index-bq8kd9r9.js → index-5gnp8fyw.js} +3 -3
  27. package/dist/cli/index-5mkc2f9z.js +154 -0
  28. package/dist/cli/{index-0kxc7t16.js → index-6jng9c8t.js} +1 -1
  29. package/dist/cli/{index-jrka8jd4.js → index-7jyndvsy.js} +2 -2
  30. package/dist/cli/{index-b9v501fr.js → index-7xgqky26.js} +33 -5
  31. package/dist/cli/{index-4r5z8sgw.js → index-85bacexr.js} +2 -2
  32. package/dist/cli/{index-bpgqbwmf.js → index-9qxntjtx.js} +6 -6
  33. package/dist/cli/index-f1qyj61w.js +418 -0
  34. package/dist/cli/{index-wvxhynxq.js → index-fm7xz1ne.js} +1 -1
  35. package/dist/cli/{index-dfdg4ws5.js → index-fz1jgbvw.js} +6 -6
  36. package/dist/cli/{index-pchpahdf.js → index-h4c4rrwx.js} +20 -3
  37. package/dist/cli/{index-kxm3bdjh.js → index-mmny81g1.js} +6 -6
  38. package/dist/cli/{index-v4fcn4tr.js → index-q1exe2b3.js} +2 -198
  39. package/dist/cli/{index-57ymmh7h.js → index-r3j3458j.js} +4 -4
  40. package/dist/cli/{index-3naa2ajc.js → index-vvk2g744.js} +10 -156
  41. package/dist/cli/{index-zej8cy0j.js → index-vx76tcxe.js} +1 -1
  42. package/dist/cli/{index-xmarctsf.js → index-wg0665ft.js} +7 -7
  43. package/dist/cli/{index-4vsgp5a8.js → index-wj4jeavn.js} +1 -1
  44. package/dist/cli/index-wvrj16f0.js +206 -0
  45. package/dist/cli/{index-w1tvqh4x.js → index-x06d2qqm.js} +28 -24
  46. package/dist/cli/index-x2q0gnt8.js +254 -0
  47. package/dist/cli/{index-xg18az81.js → index-yw8qpf51.js} +1 -1
  48. package/dist/cli/index.js +24 -20
  49. package/dist/cli/{knowledge-escalator-3sgwrgy9.js → knowledge-escalator-6v7sjprx.js} +8 -7
  50. package/dist/cli/{knowledge-events-kfc6xmkw.js → knowledge-events-6n3x3he2.js} +6 -5
  51. package/dist/cli/{knowledge-store-kyacem71.js → knowledge-store-exkw6yb1.js} +6 -5
  52. package/dist/cli/{knowledge-validator-ez3ws8ef.js → knowledge-validator-exymfcb9.js} +7 -6
  53. package/dist/cli/{pending-delegations-vfnpm8zt.js → pending-delegations-yyz3fcfn.js} +5 -4
  54. package/dist/cli/{pr-subscriptions-bpvazmsw.js → pr-subscriptions-vv8byxe6.js} +6 -5
  55. package/dist/cli/{schema-x0ekqzvs.js → schema-x17zmd03.js} +1 -1
  56. package/dist/cli/scope-persistence-6m5nsp1r.js +20 -0
  57. package/dist/cli/{skill-generator-x83re96d.js → skill-generator-mx9br4ty.js} +9 -8
  58. package/dist/commands/_shared/url-security.d.ts +13 -3
  59. package/dist/commands/close.d.ts +11 -0
  60. package/dist/commands/lanes.d.ts +35 -0
  61. package/dist/commands/registry.d.ts +7 -0
  62. package/dist/config/bundled-skills.d.ts +1 -1
  63. package/dist/config/schema.d.ts +102 -0
  64. package/dist/config/skill-mirrors.d.ts +1 -1
  65. package/dist/git/branch.d.ts +53 -7
  66. package/dist/git/index.d.ts +5 -1
  67. package/dist/git/pr.d.ts +35 -2
  68. package/dist/hooks/delegation-gate/worktree-isolation.d.ts +118 -2
  69. package/dist/hooks/delegation-gate/worktree-merge-status.d.ts +17 -0
  70. package/dist/hooks/init-orphan-recovery-advisory.d.ts +58 -0
  71. package/dist/hooks/init-orphan-recovery.d.ts +65 -0
  72. package/dist/index.js +427 -416
  73. package/dist/sandbox/executor.d.ts +11 -1
  74. package/dist/sandbox/linux/bubblewrap-executor.d.ts +3 -1
  75. package/dist/sandbox/macos/sandbox-exec-executor.d.ts +3 -1
  76. package/dist/sandbox/win32/native-sandbox-executor.d.ts +1 -1
  77. package/dist/sandbox/win32/restricted-environment-executor.d.ts +4 -1
  78. package/dist/turbo/lean/runner.d.ts +11 -20
  79. package/dist/turbo/lean/worktree.d.ts +9 -3
  80. package/dist/utils/bun-compat.d.ts +30 -0
  81. package/dist/worktree/core.d.ts +55 -0
  82. package/dist/worktree/merge.d.ts +5 -1
  83. package/dist/worktree/types.d.ts +38 -0
  84. package/package.json +2 -1
  85. package/dist/cli/curator-llm-factory-ed67kywr.js +0 -36
  86. package/dist/cli/guardrail-explain-vd6da30t.js +0 -37
  87. package/dist/cli/hive-promoter-gh0nva5c.js +0 -44
@@ -5,8 +5,7 @@ import {
5
5
  } from "./index-zgwm4ryv.js";
6
6
  import {
7
7
  __esm,
8
- __export,
9
- __toCommonJS
8
+ __export
10
9
  } from "./index-a76rekgs.js";
11
10
 
12
11
  // src/sandbox/win32/runner-client.ts
@@ -254,199 +253,4 @@ var init_runner_client = __esm(() => {
254
253
  };
255
254
  });
256
255
 
257
- // src/sandbox/capability-probe.ts
258
- import { execFile, spawnSync as spawnSync2 } from "child_process";
259
- import * as os2 from "os";
260
- function withProbeTimeout(cmd, args, ms) {
261
- return new Promise((resolve2, reject) => {
262
- const controller = new AbortController;
263
- const timer = setTimeout(() => {
264
- controller.abort();
265
- proc?.kill();
266
- }, ms);
267
- const unref = timer.unref;
268
- if (typeof unref === "function") {
269
- unref.call(timer);
270
- }
271
- let proc;
272
- try {
273
- proc = execFile(cmd, args, {
274
- signal: controller.signal,
275
- timeout: ms,
276
- windowsHide: true,
277
- cwd: os2.tmpdir()
278
- }, (error, stdout, _stderr) => {
279
- clearTimeout(timer);
280
- if (error) {
281
- const exc = error;
282
- if (exc.code === "ENOENT" || exc.code === "ENOTFOUND") {
283
- reject(new Error("binary not found"));
284
- } else {
285
- reject(error);
286
- }
287
- return;
288
- }
289
- resolve2(stdout?.trim() ?? "");
290
- });
291
- } catch (spawnError) {
292
- clearTimeout(timer);
293
- reject(spawnError);
294
- }
295
- });
296
- }
297
- async function probeLinux() {
298
- try {
299
- const output = await withProbeTimeout("bwrap", ["--version"], 2000);
300
- if (output.length > 0) {
301
- return {
302
- status: "enabled",
303
- mechanism: "Bubblewrap",
304
- platform: "linux"
305
- };
306
- }
307
- return {
308
- status: "disabled",
309
- mechanism: "Bubblewrap",
310
- platform: "linux",
311
- error: "binary returned empty version"
312
- };
313
- } catch (err) {
314
- const msg = err instanceof Error ? err.message : String(err);
315
- if (msg === "binary not found") {
316
- return {
317
- status: "unsupported",
318
- mechanism: "Bubblewrap",
319
- platform: "linux",
320
- error: msg
321
- };
322
- }
323
- return {
324
- status: "disabled",
325
- mechanism: "Bubblewrap",
326
- platform: "linux",
327
- error: msg
328
- };
329
- }
330
- }
331
- async function probeMacOS() {
332
- try {
333
- const output = await withProbeTimeout("sandbox-exec", ["--version"], 2000);
334
- if (output.length > 0) {
335
- return {
336
- status: "enabled",
337
- mechanism: "sandbox-exec",
338
- platform: "darwin"
339
- };
340
- }
341
- return {
342
- status: "disabled",
343
- mechanism: "sandbox-exec",
344
- platform: "darwin",
345
- error: "binary returned empty version"
346
- };
347
- } catch (err) {
348
- const msg = err instanceof Error ? err.message : String(err);
349
- if (msg === "binary not found") {
350
- return {
351
- status: "unsupported",
352
- mechanism: "sandbox-exec",
353
- platform: "darwin",
354
- error: msg
355
- };
356
- }
357
- return {
358
- status: "disabled",
359
- mechanism: "sandbox-exec",
360
- platform: "darwin",
361
- error: msg
362
- };
363
- }
364
- }
365
- function probeWindows() {
366
- try {
367
- const { probe: runnerProbe } = (init_runner_client(), __toCommonJS(exports_runner_client));
368
- const result = runnerProbe();
369
- if (result.available) {
370
- return {
371
- status: "enabled",
372
- platform: "win32",
373
- mechanism: `native-runner/${result.mode}`
374
- };
375
- }
376
- } catch {}
377
- try {
378
- const result = spawnSync2("cmd", ["/c", "echo", "ok"], {
379
- windowsHide: true,
380
- encoding: "utf-8",
381
- timeout: 5000,
382
- stdio: ["ignore", "pipe", "ignore"]
383
- });
384
- if (result.error) {
385
- return {
386
- status: "disabled",
387
- platform: "win32",
388
- mechanism: "PowerShell wrapper",
389
- error: `cmd.exe probe failed: ${result.error.code}`
390
- };
391
- }
392
- return result.status === 0 ? {
393
- status: "enabled",
394
- platform: "win32",
395
- mechanism: "PowerShell wrapper"
396
- } : {
397
- status: "disabled",
398
- platform: "win32",
399
- mechanism: "PowerShell wrapper",
400
- error: "cmd.exe probe returned non-zero"
401
- };
402
- } catch (err) {
403
- return {
404
- status: "disabled",
405
- platform: "win32",
406
- mechanism: "PowerShell wrapper",
407
- error: String(err)
408
- };
409
- }
410
- }
411
- function isBubblewrapAvailable() {
412
- return _cached?.status === "enabled" && _cached?.platform === "linux";
413
- }
414
- function isSandboxExecAvailable() {
415
- return _cached?.status === "enabled" && _cached?.platform === "darwin";
416
- }
417
- function isWindowsSandboxAvailable() {
418
- return _cached?.status === "enabled" && _cached?.platform === "win32";
419
- }
420
-
421
- class SandboxCapabilityProbe {
422
- async detect() {
423
- if (_cached !== undefined) {
424
- return _cached;
425
- }
426
- const platform = process.platform;
427
- switch (platform) {
428
- case "linux":
429
- _cached = await probeLinux();
430
- break;
431
- case "darwin":
432
- _cached = await probeMacOS();
433
- break;
434
- case "win32":
435
- _cached = probeWindows();
436
- break;
437
- default: {
438
- _cached = {
439
- status: "unsupported",
440
- mechanism: "unknown",
441
- platform,
442
- error: `unsupported platform: ${platform}`
443
- };
444
- }
445
- }
446
- return _cached;
447
- }
448
- }
449
- var _cached;
450
- var init_capability_probe = () => {};
451
-
452
- export { _internals, probe, execute, buildDefaultPolicy, init_runner_client, isBubblewrapAvailable, isSandboxExecAvailable, isWindowsSandboxAvailable, SandboxCapabilityProbe, init_capability_probe };
256
+ export { _internals, probe, execute, buildDefaultPolicy, exports_runner_client, init_runner_client };
@@ -1,16 +1,16 @@
1
1
  // @bun
2
- import {
3
- SwarmError
4
- } from "./index-5e4e2hvv.js";
5
2
  import {
6
3
  readCachedTextFile
7
4
  } from "./index-jtqkh8jf.js";
5
+ import {
6
+ SwarmError
7
+ } from "./index-5e4e2hvv.js";
8
8
  import {
9
9
  warn
10
10
  } from "./index-zgwm4ryv.js";
11
11
  import {
12
12
  bunFile
13
- } from "./index-b9v501fr.js";
13
+ } from "./index-7xgqky26.js";
14
14
 
15
15
  // src/hooks/utils.ts
16
16
  import * as fs from "fs";
@@ -1,11 +1,7 @@
1
1
  // @bun
2
- import {
3
- emit
4
- } from "./index-vn263hqt.js";
5
2
  import {
6
3
  __commonJS,
7
- __require,
8
- __toESM
4
+ __require
9
5
  } from "./index-a76rekgs.js";
10
6
 
11
7
  // node_modules/graceful-fs/polyfills.js
@@ -1081,7 +1077,7 @@ var require_signal_exit = __commonJS((exports, module) => {
1081
1077
  emitter.count -= 1;
1082
1078
  };
1083
1079
  module.exports.unload = unload;
1084
- emit2 = function emit3(event, code, signal) {
1080
+ emit = function emit2(event, code, signal) {
1085
1081
  if (emitter.emitted[event]) {
1086
1082
  return;
1087
1083
  }
@@ -1097,8 +1093,8 @@ var require_signal_exit = __commonJS((exports, module) => {
1097
1093
  var listeners = process2.listeners(sig);
1098
1094
  if (listeners.length === emitter.count) {
1099
1095
  unload();
1100
- emit2("exit", null, sig);
1101
- emit2("afterexit", null, sig);
1096
+ emit("exit", null, sig);
1097
+ emit("afterexit", null, sig);
1102
1098
  if (isWin && sig === "SIGHUP") {
1103
1099
  sig = "SIGINT";
1104
1100
  }
@@ -1134,8 +1130,8 @@ var require_signal_exit = __commonJS((exports, module) => {
1134
1130
  return;
1135
1131
  }
1136
1132
  process2.exitCode = code || 0;
1137
- emit2("exit", process2.exitCode, null);
1138
- emit2("afterexit", process2.exitCode, null);
1133
+ emit("exit", process2.exitCode, null);
1134
+ emit("afterexit", process2.exitCode, null);
1139
1135
  originalProcessReallyExit.call(process2, process2.exitCode);
1140
1136
  };
1141
1137
  originalProcessEmit = process2.emit;
@@ -1145,8 +1141,8 @@ var require_signal_exit = __commonJS((exports, module) => {
1145
1141
  process2.exitCode = arg;
1146
1142
  }
1147
1143
  var ret = originalProcessEmit.apply(this, arguments);
1148
- emit2("exit", process2.exitCode, null);
1149
- emit2("afterexit", process2.exitCode, null);
1144
+ emit("exit", process2.exitCode, null);
1145
+ emit("afterexit", process2.exitCode, null);
1150
1146
  return ret;
1151
1147
  } else {
1152
1148
  return originalProcessEmit.apply(this, arguments);
@@ -1159,7 +1155,7 @@ var require_signal_exit = __commonJS((exports, module) => {
1159
1155
  var EE;
1160
1156
  var emitter;
1161
1157
  var unload;
1162
- var emit2;
1158
+ var emit;
1163
1159
  var sigListeners;
1164
1160
  var loaded;
1165
1161
  var load;
@@ -1528,146 +1524,4 @@ var require_proper_lockfile = __commonJS((exports, module) => {
1528
1524
  module.exports.checkSync = checkSync;
1529
1525
  });
1530
1526
 
1531
- // src/parallel/file-locks.ts
1532
- var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
1533
- import * as fs from "fs";
1534
- import * as path from "path";
1535
- var LOCKS_DIR = ".swarm/locks";
1536
- var LOCK_TIMEOUT_MS = 5 * 60 * 1000;
1537
- var _internals = {
1538
- tryAcquireLock,
1539
- writeFile: fs.promises.writeFile
1540
- };
1541
- function getLockFilePath(directory, filePath) {
1542
- const normalized = path.resolve(directory, filePath);
1543
- const baseDir = path.resolve(directory) + path.sep;
1544
- const pathOk = process.platform === "win32" ? normalized.toLowerCase().startsWith(baseDir.toLowerCase()) : normalized.startsWith(baseDir);
1545
- if (!pathOk) {
1546
- throw new Error("Invalid file path: path traversal not allowed");
1547
- }
1548
- const pathForHash = process.platform === "win32" ? normalized.toLowerCase() : normalized;
1549
- const hash = Buffer.from(pathForHash).toString("base64").replace(/[/+=]/g, "_");
1550
- const lockPath = path.join(directory, LOCKS_DIR, `${hash}.lock`);
1551
- if (process.platform === "win32") {
1552
- const oldHash = Buffer.from(normalized).toString("base64").replace(/[/+=]/g, "_");
1553
- const oldLockPath = path.join(directory, LOCKS_DIR, `${oldHash}.lock`);
1554
- if (fs.existsSync(oldLockPath)) {
1555
- return oldLockPath;
1556
- }
1557
- }
1558
- return lockPath;
1559
- }
1560
- async function tryAcquireLock(directory, filePath, agent, taskId) {
1561
- const lockPath = getLockFilePath(directory, filePath);
1562
- const locksDir = path.dirname(lockPath);
1563
- if (!fs.existsSync(locksDir)) {
1564
- fs.mkdirSync(locksDir, { recursive: true });
1565
- }
1566
- if (!fs.existsSync(lockPath)) {
1567
- fs.writeFileSync(lockPath, "", "utf-8");
1568
- }
1569
- let release;
1570
- try {
1571
- release = await import_proper_lockfile.default.lock(lockPath, {
1572
- stale: LOCK_TIMEOUT_MS,
1573
- retries: {
1574
- retries: 5,
1575
- minTimeout: 10,
1576
- maxTimeout: 500,
1577
- factor: 2
1578
- },
1579
- realpath: false
1580
- });
1581
- } catch (err) {
1582
- const code = err.code;
1583
- if (code === "ELOCKED" || code === "EEXIST") {
1584
- return { acquired: false };
1585
- }
1586
- throw err;
1587
- }
1588
- const lock = {
1589
- filePath,
1590
- agent,
1591
- taskId,
1592
- timestamp: new Date().toISOString(),
1593
- expiresAt: Date.now() + LOCK_TIMEOUT_MS,
1594
- _release: release
1595
- };
1596
- return { acquired: true, lock };
1597
- }
1598
-
1599
- // src/evidence/lock.ts
1600
- class EvidenceLockTimeoutError extends Error {
1601
- directory;
1602
- evidencePath;
1603
- agent;
1604
- taskId;
1605
- constructor(directory, evidencePath, agent, taskId, timeoutMs) {
1606
- super(`Evidence lock timeout after ${timeoutMs}ms for ${evidencePath} (agent=${agent}, task=${taskId})`);
1607
- this.name = "EvidenceLockTimeoutError";
1608
- this.directory = directory;
1609
- this.evidencePath = evidencePath;
1610
- this.agent = agent;
1611
- this.taskId = taskId;
1612
- }
1613
- }
1614
- var BACKOFF_START_MS = 50;
1615
- var BACKOFF_MAX_MS = 2000;
1616
- var BACKOFF_JITTER_RATIO = 0.25;
1617
- function backoffMs(attempt) {
1618
- const base = Math.min(BACKOFF_START_MS * 2 ** attempt, BACKOFF_MAX_MS);
1619
- const jitter = base * BACKOFF_JITTER_RATIO * (Math.random() * 2 - 1);
1620
- return Math.max(1, Math.round(base + jitter));
1621
- }
1622
- async function withEvidenceLock(directory, evidencePath, agent, taskId, fn, timeoutMs = 60000) {
1623
- const deadline = Date.now() + timeoutMs;
1624
- let attempt = 0;
1625
- while (true) {
1626
- const result = await tryAcquireLock(directory, evidencePath, agent, taskId);
1627
- if (result.acquired) {
1628
- const lock = result.lock;
1629
- if (attempt > 0) {
1630
- emit("evidence_lock_stale_recovered", {
1631
- directory,
1632
- evidencePath,
1633
- agent,
1634
- taskId,
1635
- attempt
1636
- });
1637
- }
1638
- emit("evidence_lock_acquired", {
1639
- directory,
1640
- evidencePath,
1641
- agent,
1642
- taskId,
1643
- attempt
1644
- });
1645
- try {
1646
- return await fn();
1647
- } finally {
1648
- if (lock._release) {
1649
- try {
1650
- await lock._release();
1651
- } catch {}
1652
- }
1653
- }
1654
- }
1655
- if (Date.now() >= deadline) {
1656
- throw new EvidenceLockTimeoutError(directory, evidencePath, agent, taskId, timeoutMs);
1657
- }
1658
- emit("evidence_lock_contended", {
1659
- directory,
1660
- evidencePath,
1661
- agent,
1662
- taskId,
1663
- attempt
1664
- });
1665
- const delay = Math.min(backoffMs(attempt), deadline - Date.now());
1666
- if (delay > 0) {
1667
- await new Promise((resolve2) => setTimeout(resolve2, delay));
1668
- }
1669
- attempt++;
1670
- }
1671
- }
1672
-
1673
- export { require_proper_lockfile, tryAcquireLock, withEvidenceLock };
1527
+ export { require_proper_lockfile };
@@ -2,7 +2,7 @@
2
2
  import {
3
3
  redactPath,
4
4
  redactShellCommand
5
- } from "./index-4vsgp5a8.js";
5
+ } from "./index-wj4jeavn.js";
6
6
 
7
7
  // src/services/guardrail-log-service.ts
8
8
  import * as fs from "fs/promises";
@@ -1,19 +1,19 @@
1
1
  // @bun
2
2
  import {
3
3
  resolveKnowledgeStoreDir
4
- } from "./index-n1sptn1w.js";
4
+ } from "./index-2nt4mq9n.js";
5
5
  import {
6
6
  isActiveStatus
7
7
  } from "./index-bfwt3abw.js";
8
- import {
9
- atomicWriteFile
10
- } from "./index-9b7qp18e.js";
11
8
  import {
12
9
  readCachedParsedFile
13
10
  } from "./index-jtqkh8jf.js";
11
+ import {
12
+ atomicWriteFile
13
+ } from "./index-1cn967sa.js";
14
14
  import {
15
15
  require_proper_lockfile
16
- } from "./index-3naa2ajc.js";
16
+ } from "./index-vvk2g744.js";
17
17
  import {
18
18
  __require,
19
19
  __toESM
@@ -525,7 +525,7 @@ async function applyConfidenceFloorAction(directory, touched, options) {
525
525
  const recovered = touched.filter((e) => e.confidence > CONFIDENCE_FLOOR + FLOOR_EPSILON && e.confidence_floor_demoted);
526
526
  if (atFloor.length === 0 && recovered.length === 0)
527
527
  return;
528
- const { readKnowledgeCounterRollups, effectiveRetrievalOutcomes } = await import("./knowledge-events-kfc6xmkw.js");
528
+ const { readKnowledgeCounterRollups, effectiveRetrievalOutcomes } = await import("./knowledge-events-6n3x3he2.js");
529
529
  const rollups = await readKnowledgeCounterRollups(directory);
530
530
  const flagIds = new Set;
531
531
  for (const e of atFloor) {
@@ -592,7 +592,7 @@ async function applyConfidenceFloorAction(directory, touched, options) {
592
592
  });
593
593
  }
594
594
  if (action === "quarantine" && toQuarantine.length > 0) {
595
- const { quarantineEntry } = await import("./knowledge-validator-ez3ws8ef.js");
595
+ const { quarantineEntry } = await import("./knowledge-validator-exymfcb9.js");
596
596
  for (const { id } of toQuarantine) {
597
597
  await quarantineEntry(directory, id, "confidence_floor_negative_outcome", "auto").catch((err) => {
598
598
  console.warn("[knowledge-store] confidence-floor quarantine failed (best-effort):", err instanceof Error ? err.message : String(err));
@@ -1,7 +1,7 @@
1
1
  // @bun
2
2
  import {
3
3
  stripKnownSwarmPrefix
4
- } from "./index-pchpahdf.js";
4
+ } from "./index-h4c4rrwx.js";
5
5
  import {
6
6
  init_logger,
7
7
  warn
@@ -0,0 +1,206 @@
1
+ // @bun
2
+ import {
3
+ exports_runner_client,
4
+ init_runner_client
5
+ } from "./index-q1exe2b3.js";
6
+ import {
7
+ __esm,
8
+ __toCommonJS
9
+ } from "./index-a76rekgs.js";
10
+
11
+ // src/sandbox/capability-probe.ts
12
+ import { execFile, spawnSync } from "child_process";
13
+ import * as os from "os";
14
+ function withProbeTimeout(cmd, args, ms) {
15
+ return new Promise((resolve, reject) => {
16
+ const controller = new AbortController;
17
+ const timer = setTimeout(() => {
18
+ controller.abort();
19
+ proc?.kill();
20
+ }, ms);
21
+ const unref = timer.unref;
22
+ if (typeof unref === "function") {
23
+ unref.call(timer);
24
+ }
25
+ let proc;
26
+ try {
27
+ proc = execFile(cmd, args, {
28
+ signal: controller.signal,
29
+ timeout: ms,
30
+ windowsHide: true,
31
+ cwd: os.tmpdir()
32
+ }, (error, stdout, _stderr) => {
33
+ clearTimeout(timer);
34
+ if (error) {
35
+ const exc = error;
36
+ if (exc.code === "ENOENT" || exc.code === "ENOTFOUND") {
37
+ reject(new Error("binary not found"));
38
+ } else {
39
+ reject(error);
40
+ }
41
+ return;
42
+ }
43
+ resolve(stdout?.trim() ?? "");
44
+ });
45
+ } catch (spawnError) {
46
+ clearTimeout(timer);
47
+ reject(spawnError);
48
+ }
49
+ });
50
+ }
51
+ async function probeLinux() {
52
+ try {
53
+ const output = await withProbeTimeout("bwrap", ["--version"], 2000);
54
+ if (output.length > 0) {
55
+ return {
56
+ status: "enabled",
57
+ mechanism: "Bubblewrap",
58
+ platform: "linux"
59
+ };
60
+ }
61
+ return {
62
+ status: "disabled",
63
+ mechanism: "Bubblewrap",
64
+ platform: "linux",
65
+ error: "binary returned empty version"
66
+ };
67
+ } catch (err) {
68
+ const msg = err instanceof Error ? err.message : String(err);
69
+ if (msg === "binary not found") {
70
+ return {
71
+ status: "unsupported",
72
+ mechanism: "Bubblewrap",
73
+ platform: "linux",
74
+ error: msg
75
+ };
76
+ }
77
+ return {
78
+ status: "disabled",
79
+ mechanism: "Bubblewrap",
80
+ platform: "linux",
81
+ error: msg
82
+ };
83
+ }
84
+ }
85
+ async function probeMacOS() {
86
+ try {
87
+ const output = await withProbeTimeout("sandbox-exec", ["--version"], 2000);
88
+ if (output.length > 0) {
89
+ return {
90
+ status: "enabled",
91
+ mechanism: "sandbox-exec",
92
+ platform: "darwin"
93
+ };
94
+ }
95
+ return {
96
+ status: "disabled",
97
+ mechanism: "sandbox-exec",
98
+ platform: "darwin",
99
+ error: "binary returned empty version"
100
+ };
101
+ } catch (err) {
102
+ const msg = err instanceof Error ? err.message : String(err);
103
+ if (msg === "binary not found") {
104
+ return {
105
+ status: "unsupported",
106
+ mechanism: "sandbox-exec",
107
+ platform: "darwin",
108
+ error: msg
109
+ };
110
+ }
111
+ return {
112
+ status: "disabled",
113
+ mechanism: "sandbox-exec",
114
+ platform: "darwin",
115
+ error: msg
116
+ };
117
+ }
118
+ }
119
+ function probeWindows() {
120
+ try {
121
+ const { probe: runnerProbe } = (init_runner_client(), __toCommonJS(exports_runner_client));
122
+ const result = runnerProbe();
123
+ if (result.available) {
124
+ return {
125
+ status: "enabled",
126
+ platform: "win32",
127
+ mechanism: `native-runner/${result.mode}`
128
+ };
129
+ }
130
+ } catch {}
131
+ try {
132
+ const result = spawnSync("cmd", ["/c", "echo", "ok"], {
133
+ windowsHide: true,
134
+ encoding: "utf-8",
135
+ timeout: 5000,
136
+ stdio: ["ignore", "pipe", "ignore"]
137
+ });
138
+ if (result.error) {
139
+ return {
140
+ status: "disabled",
141
+ platform: "win32",
142
+ mechanism: "PowerShell wrapper",
143
+ error: `cmd.exe probe failed: ${result.error.code}`
144
+ };
145
+ }
146
+ return result.status === 0 ? {
147
+ status: "enabled",
148
+ platform: "win32",
149
+ mechanism: "PowerShell wrapper"
150
+ } : {
151
+ status: "disabled",
152
+ platform: "win32",
153
+ mechanism: "PowerShell wrapper",
154
+ error: "cmd.exe probe returned non-zero"
155
+ };
156
+ } catch (err) {
157
+ return {
158
+ status: "disabled",
159
+ platform: "win32",
160
+ mechanism: "PowerShell wrapper",
161
+ error: String(err)
162
+ };
163
+ }
164
+ }
165
+ function isBubblewrapAvailable() {
166
+ return _cached?.status === "enabled" && _cached?.platform === "linux";
167
+ }
168
+ function isSandboxExecAvailable() {
169
+ return _cached?.status === "enabled" && _cached?.platform === "darwin";
170
+ }
171
+ function isWindowsSandboxAvailable() {
172
+ return _cached?.status === "enabled" && _cached?.platform === "win32";
173
+ }
174
+
175
+ class SandboxCapabilityProbe {
176
+ async detect() {
177
+ if (_cached !== undefined) {
178
+ return _cached;
179
+ }
180
+ const platform = process.platform;
181
+ switch (platform) {
182
+ case "linux":
183
+ _cached = await probeLinux();
184
+ break;
185
+ case "darwin":
186
+ _cached = await probeMacOS();
187
+ break;
188
+ case "win32":
189
+ _cached = probeWindows();
190
+ break;
191
+ default: {
192
+ _cached = {
193
+ status: "unsupported",
194
+ mechanism: "unknown",
195
+ platform,
196
+ error: `unsupported platform: ${platform}`
197
+ };
198
+ }
199
+ }
200
+ return _cached;
201
+ }
202
+ }
203
+ var _cached;
204
+ var init_capability_probe = () => {};
205
+
206
+ export { isBubblewrapAvailable, isSandboxExecAvailable, isWindowsSandboxAvailable, SandboxCapabilityProbe, init_capability_probe };