opencode-swarm 7.109.0 → 7.109.2

package/.opencode/skills/critic-gate/SKILL.md

@@ -11,6 +11,7 @@ This protocol is loaded on demand by the architect stub in src/agents/architect.
 ### MODE: CRITIC-GATE
 Delegate plan to the active swarm's critic agent for review BEFORE any implementation begins.
 - Send the full plan.md content and codebase context summary
+- Explicitly reference "plan.md" or "critic-gate" in the dispatch prompt text. This lets the mechanical approval-recording gate reliably detect the review and record the critic's APPROVED verdict, which the EXECUTE-phase coder gate then requires.
 - **APPROVED** → Proceed to MODE: EXECUTE
 - **NEEDS_REVISION** → Revise the plan based on critic feedback, then resubmit (max 2 cycles)
 - **REJECTED** → Inform the user of fundamental issues and ask for guidance before proceeding
@@ -26,6 +27,7 @@ You MUST NOT proceed to MODE: EXECUTE without printing this checklist with fille
 CRITIC-GATE TRIGGER: Run ONCE when you first write the complete .swarm/plan.md.
 Do NOT re-run CRITIC-GATE before every project phase.
 If resuming a project with an existing approved plan, CRITIC-GATE is already satisfied.
+Caveat: this assumption breaks if the plan lacks a `plan_critic_gate`-tagged approval snapshot (e.g. a plan approved before this mechanical gate existed, or one where the recording heuristic didn't fire) — in that case the first coder dispatch will fail with `PLAN_CRITIC_GATE_VIOLATION`. If that happens, do not assume CRITIC-GATE is satisfied; re-run it and get a fresh APPROVED verdict.
 
 6j. SPEC-GATE (Execute BEFORE any save_plan call):
 - An effective spec exists iff `/swarm sdd status` reports a resolved spec (it reflects `readEffectiveSpecSync`, which returns null — NO effective spec — for no sources, multiple competing sources (openspec+specify), multi-feature Spec-Kit without a selected feature, or any unresolvable state). `save_plan` rejects (SPEC_REQUIRED) when `/swarm sdd status` reports no resolved spec. The gate is overridable via `SWARM_SKIP_SPEC_GATE=1`.

package/.opencode/skills/engineering-conventions/SKILL.md

@@ -127,3 +127,48 @@ When a sandbox executor (`src/sandbox/{linux,macos,win32}/*.ts`) interpolates en
 - Scope-materialization for lane-scoped resources.
 
 A divergence between primary and fallback that is not exercised by a parity test is a regression. The existing per-OS test files `tests/unit/sandbox/{linux,macos,win32}.test.ts` must continue to cover both the primary and fallback paths after every env-affecting change — extend these tests rather than relying on dedicated sandbox-envoverride test files that may or may not exist in your branch.
+
+## SAST baseline capturing (differential scanning)
+
+The `sast_scan` tool supports `capture_baseline: true` with a `phase` parameter
+to snapshot pre-existing findings. Subsequent scans with the same `phase` value
+perform differential checking — they only fail on **new** findings, not
+pre-existing ones.
+
+### When to capture a baseline
+
+- **Before Phase 1 code changes.** The baseline must reflect the state of the
+  codebase *before* any new work is done. This ensures the differential scan
+  catches findings introduced by the current session's changes.
+
+### Critical safety guard
+
+**NEVER capture a baseline after code changes have been made in a phase.**
+A baseline captured post-edit silently encodes the very bugs the scan is meant
+to catch as "pre-existing," suppressing them indefinitely. This turns the SAST
+gate into theater.
+
+### How to use it
+
+1. Identify the files to scan. In a phase, use the union of declared task-scope
+   files plus files the coder is expected to touch. Derive the list from
+   `declare_scope` outputs, `git diff --name-only`, or the phase's task specs.
+2. Before any coder delegation in Phase 1, capture the baseline:
+   ```
+   sast_scan(directory, changed_files=[...], capture_baseline=true, phase=1)
+   ```
+3. After coder work, scan the same file set:
+   ```
+   sast_scan(directory, changed_files=[...], phase=1)
+   ```
+   This returns only NEW findings (absent from the baseline).
+4. If a pre-existing finding is legitimately fixed, the baseline can be
+   re-captured at the start of the next phase with the updated file list.
+
+### Why this matters
+
+During PR #1704 review, SAST flagged `RegExp.prototype.exec()` as
+"command injection via child_process.exec()" — a false positive that blocked
+the gate. With a baseline captured before the phase, this pre-existing false
+positive would have been suppressed, and only genuinely new findings would
+surface.

package/.opencode/skills/execute/SKILL.md

@@ -55,6 +55,7 @@ All other gates: failure → return to coder. No self-fixes. No workarounds.
     → Subsequent `pre_check_batch` calls with `phase: <N>` will automatically diff against this baseline — only NEW findings (not in baseline) drive the fail verdict.
     -> PREFLIGHT CHECKLIST: Before first coder delegation, answer "SAST baseline captured before first coder delegation? yes/no/disabled/error". If the answer is no, do not delegate to coder; run 5b-BASE first. If disabled or error, record the exact tool result.
 5b. the active swarm's coder agent - Implement (if designer scaffold produced, include it as INPUT).
+    → If this dispatch fails with `PLAN_CRITIC_GATE_VIOLATION`: the plan has no current critic-approved snapshot (commonly a plan approved before this mechanical gate existed). Do NOT retry the coder dispatch as-is — re-run MODE: CRITIC-GATE to get a fresh critic `APPROVED` verdict, then retry this step.
 5b-bis. **CODER OUTPUT VERIFICATION**: After the coder reports completion, do NOT accept the self-report alone. Run `diff` (step 5c) and inspect at least one of the modified files yourself to confirm the change exists. The coder may report DONE without having produced any diff. A 30-second read of the changed file(s) catches this failure mode. This is NOT a separate explorer dispatch — the existing `diff` tool at step 5c is the verification mechanism; the key discipline is checking that `diff` returns actual changes before proceeding, rather than forwarding the coder's self-report to the next gate.
 5c. Run `diff` tool. If `hasContractChanges` → the active swarm's explorer agent integration analysis. If COMPATIBILITY SIGNALS=INCOMPATIBLE or MIGRATION_SURFACE=yes → coder retry. If COMPATIBILITY SIGNALS=COMPATIBLE and MIGRATION_SURFACE=no → proceed.
     → REQUIRED: Print "diff: [PASS | CONTRACT CHANGE — details]"

package/.opencode/skills/swarm-pr-feedback/SKILL.md

@@ -102,6 +102,53 @@ current branch before editing:
 - **Cache/state claims:** Test both relevant state orders when the behavior
   depends on cache priming, singleton state, or prior calls.
 
+### Automated Security Finding Verification
+
+Automated security bots (e.g., hermes-pr-review, CodeRabbit, Gemini) frequently
+produce findings rated CRITICAL or HIGH that are false positives. In a recent
+PR review cycle, 7/7 bot security findings were false positives upon source
+verification. Before acting on any bot security finding, perform these
+source-level checks:
+
+1. **`child_process.exec` vs `RegExp.exec`**: SAST rules pattern-match on
+   `.exec(` and cannot distinguish `child_process.exec(userInput)` (real
+   injection risk) from `/^pattern$/.exec(str)` (safe regex test). Read the
+   actual line to determine which `.exec` is called.
+
+2. **Schema validation already present**: Bots may flag "missing type
+   validation" without checking the Zod schema. Search for the field name in
+   `src/config/schema.ts` — `z.number().int()`, `z.string().min()`, etc. are
+   runtime validators that run before the code path the bot reviewed.
+
+3. **`Object.assign` mutation claims**: Bots may claim `Object.assign` mutates
+   the source object. Check whether the call is `Object.assign(target, source)`
+   (mutates target) vs `Object.assign({}, source)` or a manual copy loop into a
+   new `{}` (creates a new object, source is safe). Read the actual assignment.
+
+4. **Path containment for system-generated paths**: Bots may flag "path
+   traversal" on file paths. Check whether the path is user-controlled (real
+   risk) or system-generated from `provisionWorktree`, `mkdtempSync`, or
+   similar (no user input reaches the path). Trace the variable's origin.
+
+5. **Value validation vs key validation**: Bots may suggest validating env var
+   *values* for shell injection characters. Check whether the value is passed
+   through a sandbox executor that escapes arguments (e.g., `wrapCommand`
+   which returns a shell-quoted / `psStringEscape`-escaped string for the
+   `bunSpawn` array-form argv to consume). Value validation would break
+   legitimate env vars (PATH with `;`, URLs with `$`); escaping is the
+   sandbox's job — see `engineering-conventions` § "Sandbox env overrides"
+   for the full escape contract.
+
+6. **Deduplication for independent resources**: Bots may suggest deduplicating
+   cache redirects or env var entries. Check whether the entries map to
+   independent keys (different env var names) — independent keys cannot
+   "collide" and deduplication is nonsensical.
+
+**Rule:** For any bot finding rated CRITICAL or HIGH, read the actual source
+line AND its surrounding context (parent function, schema definition, type
+annotations) before accepting the finding. If the finding is disproved, record
+it in the closure ledger with the specific source evidence that disproves it.
+
 ## Operating Stance
 
 Treat every review comment, CI failure, bot summary, PR body claim, and pasted note

package/dist/cli/{core-vev13ej2.js → core-mbd2g302.js}

@@ -6,13 +6,15 @@ import {
   checkPathBudget,
   cleanUntrackedFiles,
   isCleanWorktree,
+  isPathUnderSwarmWorktreeBase,
   makeWorktreeBranchName,
   provisionWorktree,
   removeLaneProfileFromDiskReal,
   removeWorktree,
+  resolveWorktreeBaseDir,
   shortenWorktreePath,
   writeLaneProfileToDiskReal
-} from "./index-f1qyj61w.js";
+} from "./index-3yk9196e.js";
 import"./index-5e4e2hvv.js";
 import"./index-p0arc26j.js";
 import"./index-zgwm4ryv.js";
@@ -21,10 +23,12 @@ import"./index-a76rekgs.js";
 export {
   writeLaneProfileToDiskReal,
   shortenWorktreePath,
+  resolveWorktreeBaseDir,
   removeWorktree,
   removeLaneProfileFromDiskReal,
   provisionWorktree,
   makeWorktreeBranchName,
+  isPathUnderSwarmWorktreeBase,
   isCleanWorktree,
   cleanUntrackedFiles,
   checkPathBudget,

package/dist/cli/{curator-3efwdf9x.js → curator-6p9tpprq.js}

@@ -11,12 +11,12 @@ import {
   runCuratorInit,
   runCuratorPhase,
   writeCuratorSummary
-} from "./index-vb5t1kvs.js";
+} from "./index-cqbqynzp.js";
 import"./index-wj4jeavn.js";
 import"./index-5gnp8fyw.js";
 import"./index-c8s9a3zh.js";
 import"./index-fm7xz1ne.js";
-import"./index-wfq4r95s.js";
+import"./index-j2v3w1ds.js";
 import"./index-scww5b77.js";
 import"./index-yw8qpf51.js";
 import"./index-85bacexr.js";
@@ -31,7 +31,7 @@ import"./index-bfwt3abw.js";
 import"./index-wvrj16f0.js";
 import"./index-q1exe2b3.js";
 import"./index-x2q0gnt8.js";
-import"./index-f1qyj61w.js";
+import"./index-3yk9196e.js";
 import"./index-r3j3458j.js";
 import"./index-jtqkh8jf.js";
 import"./index-5e4e2hvv.js";

package/dist/cli/{curator-llm-factory-nttpcx4b.js → curator-llm-factory-wqbm9mwr.js}

@@ -1,12 +1,12 @@
 // @bun
 import {
   createCuratorLLMDelegate
-} from "./index-vb5t1kvs.js";
+} from "./index-cqbqynzp.js";
 import"./index-wj4jeavn.js";
 import"./index-5gnp8fyw.js";
 import"./index-c8s9a3zh.js";
 import"./index-fm7xz1ne.js";
-import"./index-wfq4r95s.js";
+import"./index-j2v3w1ds.js";
 import"./index-scww5b77.js";
 import"./index-yw8qpf51.js";
 import"./index-85bacexr.js";
@@ -21,7 +21,7 @@ import"./index-bfwt3abw.js";
 import"./index-wvrj16f0.js";
 import"./index-q1exe2b3.js";
 import"./index-x2q0gnt8.js";
-import"./index-f1qyj61w.js";
+import"./index-3yk9196e.js";
 import"./index-r3j3458j.js";
 import"./index-jtqkh8jf.js";
 import"./index-5e4e2hvv.js";

package/dist/cli/{evidence-summary-service-j7jwf20f.js → evidence-summary-service-8tasw2tt.js}

@@ -6,7 +6,7 @@ import {
   loadPlanJsonOnly,
   mergeDurableGateEntriesFromEvidence,
   readDurableGateEvidence
-} from "./index-wfq4r95s.js";
+} from "./index-j2v3w1ds.js";
 import"./index-scww5b77.js";
 import"./index-q1exe2b3.js";
 import"./index-r3j3458j.js";

package/dist/cli/{guardrail-explain-e85gbj0r.js → guardrail-explain-ynge4ww3.js}

@@ -1,13 +1,13 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-3e7jajwe.js";
-import"./index-vb5t1kvs.js";
+} from "./index-8a8b5wjf.js";
+import"./index-cqbqynzp.js";
 import"./index-wj4jeavn.js";
 import"./index-5gnp8fyw.js";
 import"./index-c8s9a3zh.js";
 import"./index-fm7xz1ne.js";
-import"./index-wfq4r95s.js";
+import"./index-j2v3w1ds.js";
 import"./index-scww5b77.js";
 import"./index-yw8qpf51.js";
 import"./index-85bacexr.js";
@@ -22,7 +22,7 @@ import"./index-bfwt3abw.js";
 import"./index-wvrj16f0.js";
 import"./index-q1exe2b3.js";
 import"./index-x2q0gnt8.js";
-import"./index-f1qyj61w.js";
+import"./index-3yk9196e.js";
 import"./index-r3j3458j.js";
 import"./index-jtqkh8jf.js";
 import"./index-5e4e2hvv.js";

package/dist/cli/{hive-promoter-rc6z2x8f.js → hive-promoter-qh2rh8x2.js}

@@ -5,12 +5,12 @@ import {
   isHiveEligible,
   promoteFromSwarm,
   promoteToHive
-} from "./index-vb5t1kvs.js";
+} from "./index-cqbqynzp.js";
 import"./index-wj4jeavn.js";
 import"./index-5gnp8fyw.js";
 import"./index-c8s9a3zh.js";
 import"./index-fm7xz1ne.js";
-import"./index-wfq4r95s.js";
+import"./index-j2v3w1ds.js";
 import"./index-scww5b77.js";
 import"./index-yw8qpf51.js";
 import"./index-85bacexr.js";
@@ -25,7 +25,7 @@ import"./index-bfwt3abw.js";
 import"./index-wvrj16f0.js";
 import"./index-q1exe2b3.js";
 import"./index-x2q0gnt8.js";
-import"./index-f1qyj61w.js";
+import"./index-3yk9196e.js";
 import"./index-r3j3458j.js";
 import"./index-jtqkh8jf.js";
 import"./index-5e4e2hvv.js";

package/dist/cli/{index-1mjzvkzj.js → index-3qwaydq1.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-3e7jajwe.js";
+} from "./index-8a8b5wjf.js";
 import {
   handleGuardrailLog
 } from "./index-vx76tcxe.js";
@@ -80,12 +80,12 @@ import {
   handleWriteRetroCommand,
   normalizeSwarmCommandInput,
   resolveCommand
-} from "./index-vb5t1kvs.js";
+} from "./index-cqbqynzp.js";
 import"./index-wj4jeavn.js";
 import"./index-5gnp8fyw.js";
 import"./index-c8s9a3zh.js";
 import"./index-fm7xz1ne.js";
-import"./index-wfq4r95s.js";
+import"./index-j2v3w1ds.js";
 import"./index-scww5b77.js";
 import"./index-yw8qpf51.js";
 import"./index-85bacexr.js";
@@ -104,7 +104,7 @@ import"./index-bfwt3abw.js";
 import"./index-wvrj16f0.js";
 import"./index-q1exe2b3.js";
 import"./index-x2q0gnt8.js";
-import"./index-f1qyj61w.js";
+import"./index-3yk9196e.js";
 import"./index-r3j3458j.js";
 import"./index-jtqkh8jf.js";
 import"./index-5e4e2hvv.js";

package/dist/cli/{index-f1qyj61w.js → index-3yk9196e.js}

@@ -162,9 +162,39 @@ function makeWorktreeBranchName(sessionId, id, options) {
   }
   return `swarm/${options.purpose}/${sessionId}/${id}`;
 }
+function resolveWorktreeBaseDir(directory, worktreeDir) {
+  return worktreeDir ? path.resolve(directory, worktreeDir) : path.resolve(path.dirname(directory), ".swarm-worktrees");
+}
+function isPathUnderSwarmWorktreeBase(targetPath, directory, worktreeDirOverrides = []) {
+  const caseInsensitive = process.platform === "win32";
+  let realTarget;
+  try {
+    realTarget = fs.realpathSync(path.resolve(directory, targetPath));
+  } catch {
+    return false;
+  }
+  const bases = [
+    resolveWorktreeBaseDir(directory),
+    ...worktreeDirOverrides.map((d) => resolveWorktreeBaseDir(directory, d))
+  ];
+  const cmpTarget = caseInsensitive ? realTarget.toLowerCase() : realTarget;
+  return bases.some((base) => {
+    let realBase;
+    try {
+      realBase = fs.realpathSync(base);
+    } catch {
+      realBase = path.resolve(base);
+    }
+    const cmpBase = caseInsensitive ? realBase.toLowerCase() : realBase;
+    if (cmpTarget === cmpBase)
+      return true;
+    const rel = path.relative(cmpBase, cmpTarget);
+    return rel.length > 0 && !rel.startsWith("..") && !path.isAbsolute(rel);
+  });
+}
 async function provisionWorktree(directory, id, sessionId, options) {
   const branchName = makeWorktreeBranchName(sessionId, id, options);
-  let worktreePath = options.worktreeDir ? path.resolve(directory, options.worktreeDir, sessionId, id) : path.resolve(path.dirname(directory), ".swarm-worktrees", sessionId, id);
+  let worktreePath = path.resolve(resolveWorktreeBaseDir(directory, options.worktreeDir), sessionId, id);
   const budgetResult = await checkPathBudget(worktreePath, directory);
   if (budgetResult.ok === false) {
     if (options.worktreeDir) {
@@ -285,7 +315,7 @@ async function provisionWorktree(directory, id, sessionId, options) {
     sessionId
   };
 }
-async function removeWorktree(worktreePath, projectRoot) {
+async function removeWorktree(worktreePath, projectRoot, options) {
   const isWindows = _internals.platform === "win32";
   const MAX_RETRIES = 4;
   const RETRY_DELAY_MS = 2000;
@@ -300,6 +330,13 @@ async function removeWorktree(worktreePath, projectRoot) {
       await _internals.sleep(RETRY_DELAY_MS);
       continue;
     }
+    if (options?.force && isPathUnderSwarmWorktreeBase(worktreePath, projectRoot, options.worktreeDir ? [options.worktreeDir] : [])) {
+      const forced = await runGit(["worktree", "remove", "--force", worktreePath], projectRoot);
+      if (forced.exitCode === 0) {
+        return { success: true };
+      }
+      return { error: forced.stderr.trim() || forced.stdout.trim() };
+    }
     return { error: lastError };
   }
   return { error: lastError };
@@ -415,4 +452,4 @@ async function assertCleanWorkingTree(directory) {
   return { clean: true };
 }
 
-export { _internals, writeLaneProfileToDiskReal, removeLaneProfileFromDiskReal, checkPathBudget, shortenWorktreePath, makeWorktreeBranchName, provisionWorktree, removeWorktree, isCleanWorktree, autoCommitDirty, cleanUntrackedFiles, assertCleanWorkingTree };
+export { _internals, writeLaneProfileToDiskReal, removeLaneProfileFromDiskReal, checkPathBudget, shortenWorktreePath, makeWorktreeBranchName, resolveWorktreeBaseDir, isPathUnderSwarmWorktreeBase, provisionWorktree, removeWorktree, isCleanWorktree, autoCommitDirty, cleanUntrackedFiles, assertCleanWorkingTree };

package/dist/cli/{index-3e7jajwe.js → index-8a8b5wjf.js}

@@ -12,7 +12,7 @@ import {
   detectPosixWrites,
   detectWindowsWrites,
   resolveWriteTargets
-} from "./index-vb5t1kvs.js";
+} from "./index-cqbqynzp.js";
 import {
   checkFileAuthority,
   classifyFile,

package/dist/cli/{index-vb5t1kvs.js → index-cqbqynzp.js}

@@ -54,7 +54,7 @@ import {
   savePlan,
   transientBackoff,
   validateProjectRoot
-} from "./index-wfq4r95s.js";
+} from "./index-j2v3w1ds.js";
 import {
   buildOpenSpecProjectionSync,
   detectSpeckit,
@@ -7203,11 +7203,11 @@ var _internals7 = {
     return KnowledgeConfigSchema2.parse({});
   },
   applyCuratorKnowledgeUpdates: async (directory, recommendations, knowledgeConfig) => {
-    const { applyCuratorKnowledgeUpdates } = await import("./curator-3efwdf9x.js");
+    const { applyCuratorKnowledgeUpdates } = await import("./curator-6p9tpprq.js");
     return applyCuratorKnowledgeUpdates(directory, recommendations, knowledgeConfig);
   },
   checkHivePromotions: async (entries, knowledgeConfig) => {
-    const { checkHivePromotions } = await import("./hive-promoter-rc6z2x8f.js");
+    const { checkHivePromotions } = await import("./hive-promoter-qh2rh8x2.js");
     return checkHivePromotions(entries, knowledgeConfig);
   },
   applyProposalTriage: async (directory, triage) => {
@@ -16499,8 +16499,8 @@ var _internals21 = {
   loadCuratorDeps: async () => {
     const [{ CuratorConfigSchema }, curator, { createCuratorLLMDelegate: createCuratorLLMDelegate2 }] = await Promise.all([
       import("./schema-x17zmd03.js"),
-      import("./curator-3efwdf9x.js"),
-      import("./curator-llm-factory-nttpcx4b.js")
+      import("./curator-6p9tpprq.js"),
+      import("./curator-llm-factory-wqbm9mwr.js")
     ]);
     return { CuratorConfigSchema, curator, createCuratorLLMDelegate: createCuratorLLMDelegate2 };
   }
@@ -16996,7 +16996,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "opencode-swarm",
-  version: "7.109.0",
+  version: "7.109.2",
   description: "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -19254,7 +19254,7 @@ async function handleEvidenceCommand(directory, args) {
   return formatTaskEvidenceMarkdown(evidenceData);
 }
 async function handleEvidenceSummaryCommand(directory) {
-  const { buildEvidenceSummary } = await import("./evidence-summary-service-j7jwf20f.js");
+  const { buildEvidenceSummary } = await import("./evidence-summary-service-8tasw2tt.js");
   const artifact = await buildEvidenceSummary(directory);
   if (!artifact) {
     return "No plan found. Run `/swarm plan` to check plan status.";
@@ -31714,7 +31714,7 @@ function buildDetailedHelp(commandName, entry) {
 async function handleHelpCommand(ctx) {
   const targetCommand = ctx.args.join(" ");
   if (!targetCommand) {
-    const { buildHelpText } = await import("./index-1mjzvkzj.js");
+    const { buildHelpText } = await import("./index-3qwaydq1.js");
     return buildHelpText();
   }
   const tokens = targetCommand.split(/\s+/);
@@ -31723,7 +31723,7 @@ async function handleHelpCommand(ctx) {
     return _internals46.buildDetailedHelp(resolved.key, resolved.entry);
   }
   const similar = _internals46.findSimilarCommands(targetCommand);
-  const { buildHelpText: fullHelp } = await import("./index-1mjzvkzj.js");
+  const { buildHelpText: fullHelp } = await import("./index-3qwaydq1.js");
   if (similar.length > 0) {
     return `Command '/swarm ${targetCommand}' not found.
 
@@ -31856,7 +31856,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-e85gbj0r.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-ynge4ww3.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",

package/dist/cli/{index-wfq4r95s.js → index-j2v3w1ds.js}

@@ -2339,7 +2339,7 @@ async function takeSnapshotWithRetry(directory, plan, options) {
   } catch {}
 }
 async function takeSnapshotEvent(directory, plan, options) {
-  const payloadHash = computePlanHash(plan);
+  const payloadHash = options?.payloadHashOverride ?? computePlanHash(plan);
   const snapshotPayload = {
     plan,
     payload_hash: payloadHash
@@ -2536,6 +2536,9 @@ async function quarantineLedgerSuffix(directory, badSuffix) {
 }
 async function loadLastApprovedPlan(directory, expectedPlanId) {
   const events = await readLedgerEvents(directory);
+  return findLastApprovedSnapshot(events, expectedPlanId);
+}
+function findLastApprovedSnapshot(events, expectedPlanId, extraFilter) {
   if (events.length === 0) {
     return null;
   }
@@ -2558,6 +2561,9 @@ async function loadLastApprovedPlan(directory, expectedPlanId) {
         continue;
       }
     }
+    if (extraFilter && !extraFilter(payload)) {
+      continue;
+    }
     return {
       plan: payload.plan,
       seq: event.seq,

package/dist/cli/index.js

@@ -7,12 +7,12 @@ import {
   getPluginLockFilePaths,
   package_default,
   resolveCommand
-} from "./index-vb5t1kvs.js";
+} from "./index-cqbqynzp.js";
 import"./index-wj4jeavn.js";
 import"./index-5gnp8fyw.js";
 import"./index-c8s9a3zh.js";
 import"./index-fm7xz1ne.js";
-import"./index-wfq4r95s.js";
+import"./index-j2v3w1ds.js";
 import"./index-scww5b77.js";
 import"./index-yw8qpf51.js";
 import"./index-85bacexr.js";
@@ -29,7 +29,7 @@ import"./index-bfwt3abw.js";
 import"./index-wvrj16f0.js";
 import"./index-q1exe2b3.js";
 import"./index-x2q0gnt8.js";
-import"./index-f1qyj61w.js";
+import"./index-3yk9196e.js";
 import"./index-r3j3458j.js";
 import"./index-jtqkh8jf.js";
 import"./index-5e4e2hvv.js";

package/dist/config/index.d.ts

@@ -22,3 +22,4 @@ export type { AgentOverrideConfig, AutomationCapabilities, AutomationConfig, Aut
 export { AgentOverrideConfigSchema, AutomationCapabilitiesSchema, AutomationConfigSchema, AutomationModeSchema, LeanTurboConfigSchema, MemoryConfigSchema, ModelPricingConfigSchema, PhaseCompleteConfigSchema, PipelineConfigSchema, PluginConfigSchema, PricingConfigSchema, RepoGraphConfigSchema, SkillPropagationConfigSchema, SwarmConfigSchema, TurboConfigSchema, WorktreeIsolationConfigSchema, } from './schema';
 export type { DeltaSpec, Obligation, SpecDelta, SpecRequirement, SpecScenario, SpecSection, SwarmSpec, } from './spec-schema';
 export { DeltaSpecSchema, ObligationSchema, SpecDeltaSchema, SpecRequirementSchema, SpecScenarioSchema, SpecSectionSchema, SwarmSpecSchema, validateSpecContent, } from './spec-schema';
+export { resolveWorktreeIsolationConfig } from './worktree-isolation-config';

package/dist/config/qa-gate-pipeline.d.ts

@@ -0,0 +1,67 @@
+export interface QaGatePipelineStep {
+    readonly id: string;
+    readonly docsLabel: string;
+    readonly protocolToken: string;
+}
+export declare const QA_GATE_PIPELINE_STEPS: readonly [{
+    readonly id: "diff";
+    readonly docsLabel: "`diff`";
+    readonly protocolToken: "diff";
+}, {
+    readonly id: "syntax_check";
+    readonly docsLabel: "`syntax_check`";
+    readonly protocolToken: "syntax_check";
+}, {
+    readonly id: "placeholder_scan";
+    readonly docsLabel: "`placeholder_scan`";
+    readonly protocolToken: "placeholder_scan";
+}, {
+    readonly id: "imports";
+    readonly docsLabel: "`imports`";
+    readonly protocolToken: "imports";
+}, {
+    readonly id: "lint_fix";
+    readonly docsLabel: "`lint fix`";
+    readonly protocolToken: "lint";
+}, {
+    readonly id: "build_check";
+    readonly docsLabel: "`build_check`";
+    readonly protocolToken: "build_check";
+}, {
+    readonly id: "pre_check_batch";
+    readonly docsLabel: "`pre_check_batch`";
+    readonly protocolToken: "pre_check_batch";
+}, {
+    readonly id: "reviewer";
+    readonly docsLabel: "`reviewer`";
+    readonly protocolToken: "reviewer";
+}, {
+    readonly id: "security_reviewer";
+    readonly docsLabel: "`security-reviewer`";
+    readonly protocolToken: "security-reviewer";
+}, {
+    readonly id: "test_engineer_verification";
+    readonly docsLabel: "`test_engineer verification`";
+    readonly protocolToken: "testengineer-verification";
+}, {
+    readonly id: "regression_sweep";
+    readonly docsLabel: "`regression-sweep`";
+    readonly protocolToken: "regression-sweep";
+}, {
+    readonly id: "test_drift";
+    readonly docsLabel: "`test-drift`";
+    readonly protocolToken: "test-drift";
+}, {
+    readonly id: "test_engineer_adversarial";
+    readonly docsLabel: "`test_engineer adversarial`";
+    readonly protocolToken: "ADVERSARIAL TEST STEP";
+}, {
+    readonly id: "coverage_check";
+    readonly docsLabel: "`coverage check`";
+    readonly protocolToken: "COVERAGE CHECK";
+}, {
+    readonly id: "pre_commit_checklist";
+    readonly docsLabel: "`pre-commit checklist`";
+    readonly protocolToken: "PRE-COMMIT RULE";
+}];
+export declare const QA_GATE_PIPELINE_STEP_COUNT: 15;

package/dist/config/worktree-isolation-config.d.ts

@@ -0,0 +1,10 @@
+import type { PluginConfig, WorktreeIsolationConfig } from './schema';
+/**
+ * Pure config helper that resolves the worktree-isolation configuration
+ * from a PluginConfig. Lives in this leaf module (no heavy imports) so
+ * the plugin entry (src/index.ts) can call it during init without
+ * pulling in the worktree lifecycle module.
+ *
+ * @see tests/unit/turbo/lean/init-safety.test.ts (static source check)
+ */
+export declare function resolveWorktreeIsolationConfig(config: PluginConfig): WorktreeIsolationConfig;

package/dist/hooks/delegation-gate/worktree-isolation.d.ts

@@ -58,6 +58,8 @@ export interface StandardWorktreeDispatch {
     mergeStrategy: 'merge' | 'rebase' | 'cherry-pick';
     /** FR-201: 0-based lane index for runtime profile derivation. */
     laneIndex: number;
+    /** Configured worktree-dir override, so cleanup trusts the same base. */
+    worktree_dir?: string;
 }
 export interface AwaitingMergeRecord {
     callID: string;
@@ -103,7 +105,8 @@ export declare function checkStandardWorktreeSerializationRelease(sessionID: str
  */
 declare function rememberStandardWorktreeSerializationSession(sessionID: string): boolean;
 export declare function sanitizeWorktreeTaskId(raw: string): string;
-export declare function resolveWorktreeIsolationConfig(config: PluginConfig): WorktreeIsolationConfig;
+import { resolveWorktreeIsolationConfig } from '../../config/worktree-isolation-config';
+export { resolveWorktreeIsolationConfig };
 export declare function precreateStandardWorktreeSession(args: {
     config: PluginConfig;
     directory: string;
@@ -163,4 +166,3 @@ export declare const _internals: {
     startupOrphanRecovery: typeof startupOrphanRecovery;
     cleanupOrphanedBranches: typeof cleanupOrphanedBranches;
 };
-export {};

package/dist/hooks/delegation-gate.d.ts

@@ -110,6 +110,7 @@ export declare const _internals: {
     buildParallelExecutionGuidance: typeof buildParallelExecutionGuidance;
     loadPlanJsonOnly: typeof loadPlanJsonOnly;
     resetStandardWorktreeIsolationState: typeof resetStandardWorktreeIsolationState;
+    PLAN_CRITIC_TASK_SIGNALS: readonly ["critic-gate", "plan critic", "review plan", "review the plan", "plan.md", "approve the plan", "plan approval"];
     provisionWorktree: typeof _wtiInternals.provisionWorktree;
     removeWorktree: typeof _wtiInternals.removeWorktree;
     attemptMergeBackFromDirty: typeof _wtiInternals.attemptMergeBackFromDirty;

package/dist/hooks/guardrails/index.d.ts

@@ -47,7 +47,7 @@ export declare function redactShellCommand(cmd: string): string;
  * @param config Guardrails configuration (optional)
  * @returns Tool before/after hooks and messages transform hook
  */
-export declare function createGuardrailsHooks(directory: string, directoryOrConfig?: string | GuardrailsConfig, config?: GuardrailsConfig, authorityConfig?: AuthorityConfig): {
+export declare function createGuardrailsHooks(directory: string, directoryOrConfig?: string | GuardrailsConfig, config?: GuardrailsConfig, authorityConfig?: AuthorityConfig, worktreeBaseDirOverrides?: string[]): {
     toolBefore: (input: {
         tool: string;
         sessionID: string;