opencode-swarm 7.114.7 → 7.114.9

package/.opencode/skills/ci-fix-monitor/SKILL.md

@@ -5,21 +5,8 @@ description: >
   Monitor CI on a PR, diagnose failures, fix them, and re-push until green.
   Covers reading CI logs, classifying failure types (check-title, package-check,
   test failures, lint), determining the correct fix, and re-pushing.
-triggers:
-  - ci check failure
-  - fix ci
-  - monitor ci
-generated_from_knowledge: []
-source_knowledge_ids: []
-generated_at: 2026-07-02T02:35:49.945Z
-confidence: 0.60
-status: active
-version: 6
-skill_origin: generated
 ---
 
-<!-- generated by opencode-swarm skill-generator. Do not edit by hand; edits will be preserved on regeneration only with controlled update mode. -->
-
 # CI Fix & Monitor Protocol
 
 Activates when the user asks to monitor CI, fix CI failures, or resolve red
@@ -201,3 +188,11 @@ the stall state to the user rather than waiting indefinitely.
 Do NOT declare victory until ALL required checks pass. A check in `skipped`
 state is acceptable only if the same check was skipped on the base branch
 (i.e. the workflow gates on a path filter). Confirm this explicitly.
+
+## Standalone retry bound
+
+When this skill is invoked directly (not composed via `swarm-ci-monitor`'s
+own 5-iteration counter), cap fix-push cycles at 5 iterations. If the PR is
+still not green after 5 fix-push cycles, stop and escalate to the user with
+the last failing check and a short log excerpt rather than looping
+indefinitely.

package/.opencode/skills/commit-pr/SKILL.md

@@ -79,6 +79,8 @@ git status --short
 
 On Windows, prefer temporary save branches over `git stash`. If you must stash, use `git stash push --include-untracked` and verify the stash contents.
 
+If this changeset edited any SKILL.md file's wording, also run `file:.swarm/bundled-skills/skill-edit-validation/SKILL.md`'s content-assertion sweep before committing, to catch stale test assertions.
+
 ## Step 1 - Commit and PR titles
 
 Use `<type>(<scope>): <description>` exactly.
@@ -549,6 +551,8 @@ checks to rerun. Re-check before claiming final green or merge-readiness.
 
 ### Merge queue (current-base validation)
 
+Read `file:.swarm/bundled-skills/merge-queue-readiness/SKILL.md` for the full pre-queue merge-group CI simulation protocol.
+
 When `main` has a GitHub **merge queue** enabled, do not rebase or force-push a PR
 *solely because `main` advanced*. Once required checks and review are green, add the
 PR to the merge queue; GitHub re-runs the required workflows against the queued

package/.opencode/skills/engineering-conventions/SKILL.md

@@ -52,6 +52,39 @@ The OpenCode `test_runner` tool is for **targeted agent validation** with explic
 - For repo validation, run the shell commands in `contributing.md` / `TESTING.md` directly (per-file isolation loops + tier orchestration).
 - `scope: 'all'` is gated behind the `SWARM_ALLOW_FULL_SUITE=1` env var (intended for opt-in CI mirrors only); there is no `allow_full_suite` arg. Default to `files: [...]` instead.
 
+## Agent prompt strings — escaping pitfalls
+
+Agent prompts in `src/agents/*.ts` are large TypeScript template literals. They frequently contain characters that have special meaning inside template literals and cause silent parse errors if unescaped:
+
+| Character | Inside template literal | Correct escape |
+|-----------|------------------------|----------------|
+| Backtick `` ` `` | Terminates the literal | `` \` `` (single backslash — renders as `` ` `` in output) |
+| `${` | Starts an interpolation | `\${` (single backslash) |
+| Literal backslash `\` | Consumed by escape processing | `\\` (double backslash renders as `\` in output) |
+
+**The most common failure pattern:** A coder adds an inline code example containing backticks to an agent prompt string. The unescaped backtick silently terminates the template literal, producing a `SyntaxError: Unexpected identifier` or `Unexpected token` at the character *after* the backtick — which appears unrelated to the actual cause.
+
+```typescript
+// WRONG — unescaped backtick terminates the template literal
+const PROMPT = `
+Use `bun:test` for all tests.   // ← bare backtick before "bun" closes the literal
+`;
+
+// CORRECT — single backslash before each backtick; renders as Use `bun:test` in output
+const PROMPT = `
+Use \`bun:test\` for all tests.
+`;
+
+// OVER-ESCAPED (also wrong) — triple backslash produces literal \` in the rendered prompt
+const PROMPT = `
+Use \\\`bun:test\\\` for all tests.  // renders as: Use \`bun:test\` (backslashes visible)
+`;
+```
+
+**Detection:** If `bun run build` or `bun --smol test` reports a parse error at a line number that seems far from any recent change, search the surrounding lines for an unescaped backtick inside a template literal.
+
+**Prevention:** After adding any inline code example to an agent prompt, run `bun run build` immediately — the TypeScript compiler catches unescaped backticks as a syntax error before any tests run.
+
 ## The invariant-audit gate (PR-time)
 
 Every PR that touches a relevant area must include an `## Invariant audit` section in its description. The format is in `AGENTS.md` ("Invariant audit required in PRs"). The `commit-pr` skill enforces this gate before push/PR — load it before committing.

package/.opencode/skills/execute/SKILL.md

@@ -111,6 +111,8 @@ Treating pre_check_batch as a substitute for the active swarm's reviewer agent i
 
     When `council_mode` is OFF, the standard Stage B flow (steps 5j-5l: reviewer + test_engineer) runs as normal.
 
+    For set-dispatch reviewer/test_engineer verdict rows that must be attributed to plan tasks, read `file:.swarm/bundled-skills/gate-attribution/SKILL.md`. Before re-dispatching a coder for a task that already has a lane (any prior dispatch status), read `file:.swarm/bundled-skills/worktree-retry-cleanup/SKILL.md`.
+
     5j. the active swarm's reviewer agent - General review. REJECTED before the configured QA retry limit → coder retry. REJECTED at the configured QA retry limit → escalate.
     → REQUIRED: Print "reviewer: [APPROVED | REJECTED — reason]"
     5k. Security gate: if change matches TIER 3 criteria OR content contains SECURITY_KEYWORDS OR secretscan has ANY findings OR sast_scan has ANY findings at or above threshold → MUST delegate the active swarm's reviewer agent security-only review. REJECTED before the configured QA retry limit → coder retry. REJECTED at the configured QA retry limit → escalate to user.

package/.opencode/skills/swarm-ci-monitor/SKILL.md

@@ -241,6 +241,11 @@ already ran once in this invocation.
    directly per Step 5 as an "un-approval" terminal, do not loop back to
    Step 2.
 
+Optional pre-queue simulation: `file:.swarm/bundled-skills/merge-queue-readiness/SKILL.md`
+covers running `/swarm ci-simulate` before entering a merge queue. It is a
+fast local signal, not a substitute for this step's live re-checks above —
+run it in addition to, never instead of, Step 3.
+
 ## Step 4 — Merge
 
 ### 4a. Execute the merge

package/.opencode/skills/swarm-pr-feedback/SKILL.md

@@ -239,6 +239,8 @@ branches or prior work sessions.
 
 ## Batch Collection (mandatory before any fix)
 
+Read `file:.swarm/bundled-skills/ci-failure-batching/SKILL.md` for the full batch collection and fix protocol before proceeding.
+
 Issue #1746: 8+ push cycles where 3–4 would have sufficed with batching.
 The anti-pattern: iterating check-by-check, proposing a fix for one failure,
 pushing, waiting for CI, then discovering the next failure. Each cycle costs

package/.opencode/skills/writing-tests/SKILL.md

@@ -617,6 +617,8 @@ authority checks:
 
 `scripts/check-test-file-cap.sh` enforces the **500-line cap** per test file (FR-006) as a **diff-scoped ratchet**: new test files over 500 lines and existing over-cap files that grew fail the quality gate and block PR merge. Pre-existing over-cap files not touched by the PR are non-blocking. Escape hatch: `TEST_CAP_ENFORCE=0` soft-warns (use only for a deliberate growth PR).
 
+For the full splitting protocol (describe-block extraction, shared helper management, pure-function extraction, mock isolation verification, cascading-split detection), read `file:.swarm/bundled-skills/test-file-split/SKILL.md`.
+
 ### Checking file length
 
 ```bash

package/README.md

@@ -39,7 +39,7 @@ Most AI coding tools let one model write code and ask that same model whether th
 - 🔄 **Phase completion gates** — completion-verify and drift verifier gates enforced before phase completion
 - 🔁 **Resumable sessions** — all state saved to `.swarm/`; pick up any project any day
 - 🖥️ **PR Monitor** — GitHub PR subscription and background polling via `gh` CLI; delivers real-time CI, review, and merge status updates via the AutomationEventBus (FR-001, opt-in via `pr_monitor.enabled: true`). Subscribe with `/swarm pr subscribe <pr-url|owner/repo#N|N>`; unsubscribe with `/swarm pr unsubscribe <pr-url|owner/repo#N|N>`; check status with `/swarm pr status`. Enable `auto_pr_feedback: true` in `pr_monitor` config to inject `[MODE: PR_FEEDBACK pr="URL"]` on CI failures and merge conflicts automatically.
-- 🌐 **12 full language profiles** (TypeScript, Python, Go, Rust, Java, Kotlin, C/C++, C#, Ruby, Swift, Dart, PHP) with **tree-sitter parse validation across 20 grammars** (adds JavaScript, CSS, Bash, PowerShell, INI, Regex — and `.tsx` / `.c` aliases) — extending: see [docs/adding-a-language.md](docs/adding-a-language.md)
+- 🌐 **13 full language profiles** (TypeScript, JavaScript, Python, Go, Rust, Java, Kotlin, C/C++, C#, Ruby, Swift, Dart, PHP) with **tree-sitter parse validation across 20 grammars** (adds CSS, Bash, PowerShell, INI, Regex — and `.tsx` / `.c` aliases) — extending: see [docs/adding-a-language.md](docs/adding-a-language.md)
 - 🛡️ **Built-in security** — SAST, secrets scanning, dependency audit per task
 - 🔒 **Scope enforcement** — Validates write targets against declared scope with cross-process persistence, TTL expiry, and scope-aware destructive command blocking. **Handles both single-string and array-based path arguments** (`files[]`, `paths[]`, `targetFiles[]`) to prevent scope bypass via multi-file tool calls.
 - 📝 **Shell write detection** — Static analysis of POSIX/PowerShell/cmd commands to detect file writes (redirects, builtins, in-place editors, network downloads, archive extraction, git destructive ops) before execution
@@ -550,14 +550,14 @@ These quality gates run locally. No Docker is required. Config-gated features su
 
 ### Context Budget Guard
 
-The Context Budget Guard monitors how much context Swarm is injecting into the conversation. It helps prevent context overflow before it becomes a problem.
+The Context Budget Guard monitors how full the model's context window is getting across the whole conversation. It helps prevent context overflow before it becomes a problem.
 
 ### Default Behavior
 
 - **Enabled automatically** — No setup required. Swarm starts tracking context usage right away.
-- **What it measures** — Only the context that Swarm injects (plan, context, evidence, retrospectives). It does **not** count your chat history or the model's responses.
-- **Warning threshold (0.7 ratio)** — When swarm-injected context reaches ~2800 tokens (70% of 4000), the architect receives a one-time advisory warning. This is informational — execution continues normally.
-- **Critical threshold (0.9 ratio)** — When context reaches ~3600 tokens (90% of 4000), the architect receives a critical alert with a recommendation to run `/swarm handoff`. This is also one-time only.
+- **What it measures** — The estimated total tokens across **all** messages in the conversation (every text part of every message — your prompts, the model's responses, and injected content alike), divided by the model's context window. The window comes from `context_budget.model_limits` (default `128000`), resolved per model/provider. It does **not** measure only swarm-injected content, and it does **not** read `max_injection_tokens`.
+- **Warning threshold (0.7 ratio)** — When total conversation tokens reach 70% of the model context window (e.g. ~89,600 of 128,000), the architect receives a one-time advisory warning. This is informational — execution continues normally.
+- **Critical threshold (0.9 ratio)** — When total conversation tokens reach 90% of the model context window (e.g. ~115,200 of 128,000), the architect receives a critical alert with a recommendation to run `/swarm handoff`. This is also one-time only.
 - **Non-nagging** — Alerts fire once per session, not repeatedly. You won't be pestered every turn.
 - **Who sees warnings** — Only the architect receives these warnings. Other agents are unaware of the budget.
 
@@ -588,17 +588,18 @@ Swarm includes an intelligent skill propagation system that tracks, validates, a
 
 ```json
 {
-  "skill_propagation": {
+  "skillPropagation": {
     "enabled": true,
     "enforce": false,
-    "scoring": {
-      "threshold": 0.5,
-      "max_recommendations": 5
-    }
+    "audiences": []
   }
 }
 ```
 
+- **`enabled`** (boolean, default `true`) — turns skill-propagation scoring, recommendations, and warnings on or off. The mandatory explicit-skill-reference integrity check still runs even when this is `false`.
+- **`enforce`** (boolean, default `false`) — when `true`, blocks delegations that omit the `SKILLS:` field instead of only warning.
+- **`audiences`** (string array, default `[]`, max 16 entries, de-duplicated) — extra audience tokens to broaden which skills are considered in scope for this project, in addition to the active runner's own audience. Each entry must be a lowercase domain token matching `^[a-z0-9]+(?:[._-][a-z0-9]+)*$`; the reserved value `swarm-plugin` and any `runner:*` prefix are rejected.
+
 **Skill routing file format** (`.opencode/skill-routing.yaml`):
 
 ```yaml
@@ -695,9 +696,9 @@ Every candidate passes a 3-gate pipeline before entering quarantine:
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | `context_budget.enabled` | boolean | `true` | Enable or disable the context budget guard entirely |
-| `context_budget.max_injection_tokens` | number | `4000` | Token budget for swarm-injected context per turn. This is NOT the model's context window — it's the swarm plugin's own contribution |
-| `context_budget.warn_threshold` | number | `0.7` | Ratio (0.0-1.0) of `max_injection_tokens` that triggers a warning advisory |
-| `context_budget.critical_threshold` | number | `0.9` | Ratio (0.0-1.0) of `max_injection_tokens` that triggers a critical alert with handoff recommendation |
+| `context_budget.max_injection_tokens` | number | `4000` | Separate per-turn cap on system-enhancer injection. It is NOT the guard's budget — the guard measures total conversation tokens against `model_limits`, not this value |
+| `context_budget.warn_threshold` | number | `0.7` | Ratio (0.0-1.0) of the model context window (`model_limits`, default `128000`) at which total conversation tokens trigger a warning advisory |
+| `context_budget.critical_threshold` | number | `0.9` | Ratio (0.0-1.0) of the model context window (`model_limits`, default `128000`) at which total conversation tokens trigger a critical alert with handoff recommendation |
 | `context_budget.enforce` | boolean | `true` | When true, enforces budget limits and may trigger handoffs |
 | `context_budget.prune_target` | number | `0.7` | Ratio (0.0-1.0) of context to preserve when pruning occurs |
 | `context_budget.preserve_last_n_turns` | number | `4` | Number of recent turns to preserve when pruning |
@@ -847,7 +848,7 @@ Swarm uses file locking to protect shared state files from concurrent write corr
 
 ### Locking Implementation
 
-- **Library**: `proper-lockfile` with `retries: 0` (fail-fast — no polling retries)
+- **Library**: `proper-lockfile` with automatic retries (F-09): 5 retries with exponential backoff (10ms→500ms, factor 2); a held lock is treated as stale after `LOCK_TIMEOUT_MS` (5 minutes)
 - **Scope**: Each tool acquires an exclusive lock on the target file before writing
 - **Agents**: Lock is tagged with the current agent name and task context for diagnostics
 
@@ -1114,6 +1115,7 @@ Control how tool outputs are summarized for LLM context.
 | `/swarm issue <issue-url\|owner/repo#N\|N> [--plan] [--trace] [--no-repro]` | Ingest a GitHub issue for localization and resolution |
 | `/swarm pr-review <pr-url\|owner/repo#N\|N> [--council] [instructions...]` | Structured deep PR review with parallel lanes, reviewer confirmation, and critic challenge |
 | `/swarm pr-feedback [<pr-url\|owner/repo#N\|N>] [instructions...]` | Ingest and close known PR feedback (review comments, CI failures, conflicts) without a fresh review |
+| `/swarm ci-monitor <pr-url\|owner/repo#N\|N>` | Drive an already-reviewed, approved PR to green and merged (monitor CI, fix, merge; max 5 fix cycles) |
 | `/swarm pr subscribe <pr-url\|owner/repo#N\|N>` | Subscribe current session to PR monitoring (session-scoped); requires `pr_monitor.enabled: true` |
 | `/swarm pr unsubscribe <pr-url\|owner/repo#N\|N>` | Remove session's subscription to a PR |
 | `/swarm pr status` | List active PR subscriptions for current session with relative timestamps (the `bunx opencode-swarm run pr status` CLI has no session context, so it lists subscriptions across all sessions) |

package/dist/agents/template.d.ts

@@ -1,22 +1,29 @@
 /**
- * Agent prompt template renderer.
+ * Agent prompt template helpers.
  *
- * Replaces `{{KEY}}` placeholders in agent prompt strings with values from
- * a `ProjectContext` resolved at session-init time. Strict by design:
- * unknown placeholders raise (caught at build time by
- * `tests/unit/agents/template-substitution.test.ts`), so a typo never
- * leaks to the model.
+ * `{{KEY}}` placeholders in agent prompt strings are substituted with values
+ * from a `ProjectContext` resolved at session-init time by the hand-rolled
+ * `.replace()` chains in `src/agents/index.ts` (Chain B) and
+ * `src/agents/architect.ts` (Chain A). `assertNoUnresolvedPlaceholders` is the
+ * post-substitution safety net that guarantees a typo never leaks a raw
+ * `{{KEY}}` to the model — it runs over each agent's FINAL prompt inside the
+ * `createSwarmAgents` loop (`src/agents/index.ts`), after every substitution
+ * chain has run, before the agents are returned.
  *
- * Phase 4b of language-agnostic plugin work. Pinned call site is
- * `src/index.ts:initializeOpenCodeSwarm` immediately before
- * `getAgentConfigs(...)` — see the `withTimeout(2000ms)` wrapping there
- * to honor invariant 1 (plugin init bounded + fail-open).
+ * Invariant 1 (fail-open): the assertion itself throws (unit tests depend on
+ * it), but its production call site in `createSwarmAgents` wraps it in a
+ * try/catch that downgrades a leftover placeholder to a deferred warning and
+ * registers the agent anyway — a user-authored custom prompt may legitimately
+ * contain a literal `{{UPPER_KEY}}` in prose, and plugin init must never abort.
+ * Built-in-prompt regressions stay caught in CI by a test that drains the
+ * warning buffer after `getAgentConfigs()` over the default prompts.
+ *
+ * Phase 4b of language-agnostic plugin work.
  */
 /**
  * Variables available for substitution into agent prompts. Every prompt's
- * `{{KEY}}` placeholders must be a key of this interface; the renderer
- * rejects unknown placeholders. New variables go here AND in
- * `buildProjectContext` in `src/index.ts`.
+ * `{{KEY}}` placeholders must be a key of this interface. New variables go
+ * here AND in `buildProjectContext` in `src/index.ts`.
  */
 export interface ProjectContext {
     PROJECT_LANGUAGE: string;
@@ -68,15 +75,28 @@ export declare function emptyProjectContext(): ProjectContext;
  */
 export declare function escapeForTemplate(s: string): string;
 /**
- * Render `prompt` with `vars`. Replaces every `{{KEY}}` whose KEY is a
- * documented `ProjectContext` field. Unknown placeholders raise.
+ * Post-substitution safety net for the hand-rolled `.replace()` chains that
+ * assemble each agent's FINAL system prompt (Chain A in
+ * `src/agents/architect.ts` and Chain B in `src/agents/index.ts`). Neither
+ * chain validated for leftover placeholders, so a renamed, mistyped, or
+ * newly-added `{{KEY}}` could leak raw template text straight to the model
+ * with no error. This asserts — over the fully-substituted prompt — that no
+ * `{{KEY}}` survived, applied at the reachable production call site (see
+ * `src/agents/index.ts`, immediately before `getAgentConfigs`).
+ *
+ * The scan uses the character class `[A-Z_]+`. It MUST NOT be broadened to
+ * `[^}]+`, `.*?`, or similar: `src/agents/architect.ts` contains a literal
+ * `` `{{...}}` `` in instructional prose (teaching the architect what an
+ * unresolved field looks like). The dots in `...` are not in `[A-Z_]`, so this
+ * guard never matches that prose. A broader class WOULD match it and
+ * false-throw during agent init. The trailing `g` flag only enumerates every
+ * offender for the error message; it does not widen what counts as a
+ * placeholder.
  *
- * The renderer is intentionally simple — single-pass, no nesting, no
- * conditionals, no loops. Agent prompts that need conditional sections
- * should pre-compute a string variable in `buildProjectContext` and
- * substitute it as a single placeholder.
+ * @throws if any `{{KEY}}` placeholder remains, naming the offending key(s)
+ *   and the agent whose prompt they were found in.
  */
-export declare function renderPrompt(prompt: string, vars: ProjectContext): string;
+export declare function assertNoUnresolvedPlaceholders(prompt: string, agentName: string): void;
 /**
  * Convert an array of constraint strings into a bulleted block ready for
  * inclusion in an agent prompt via `{{CODER_CONSTRAINTS}}` etc.

package/dist/cli/{curator-qshyr2tc.js → curator-5xt89z05.js}

@@ -14,20 +14,20 @@ import {
   runCuratorInit,
   runCuratorPhase,
   writeCuratorSummary
-} from "./index-6ctejje2.js";
+} from "./index-typ408f4.js";
 import"./index-yfedche9.js";
 import"./index-c8s9a3zh.js";
 import"./index-9bsmzfk3.js";
 import"./index-a45jq4b7.js";
-import"./index-f6y341yk.js";
+import"./index-yrrqs4b0.js";
 import"./index-scww5b77.js";
 import"./index-ga4ta3cr.js";
 import"./index-80jkseqw.js";
-import"./index-vjvdvjd3.js";
-import"./index-qrnhvhmg.js";
-import"./index-7stsmndb.js";
-import"./index-kjbfry6m.js";
-import"./index-91qesget.js";
+import"./index-x12hvfpf.js";
+import"./index-n18yy0z1.js";
+import"./index-6f6y2rbp.js";
+import"./index-8f2270hc.js";
+import"./index-rk6qhyng.js";
 import"./index-bfwt3abw.js";
 import"./index-g40r5d08.js";
 import"./index-vxv732ex.js";

package/dist/cli/{curator-llm-factory-2xgznxyw.js → curator-llm-factory-pnhvf3s3.js}

@@ -1,20 +1,20 @@
 // @bun
 import {
   createCuratorLLMDelegate
-} from "./index-6ctejje2.js";
+} from "./index-typ408f4.js";
 import"./index-yfedche9.js";
 import"./index-c8s9a3zh.js";
 import"./index-9bsmzfk3.js";
 import"./index-a45jq4b7.js";
-import"./index-f6y341yk.js";
+import"./index-yrrqs4b0.js";
 import"./index-scww5b77.js";
 import"./index-ga4ta3cr.js";
 import"./index-80jkseqw.js";
-import"./index-vjvdvjd3.js";
-import"./index-qrnhvhmg.js";
-import"./index-7stsmndb.js";
-import"./index-kjbfry6m.js";
-import"./index-91qesget.js";
+import"./index-x12hvfpf.js";
+import"./index-n18yy0z1.js";
+import"./index-6f6y2rbp.js";
+import"./index-8f2270hc.js";
+import"./index-rk6qhyng.js";
 import"./index-bfwt3abw.js";
 import"./index-g40r5d08.js";
 import"./index-vxv732ex.js";

package/dist/cli/{evidence-summary-service-8g594znj.js → evidence-summary-service-fehwj116.js}

@@ -6,7 +6,7 @@ import {
   loadPlanJsonOnly,
   mergeDurableGateEntriesFromEvidence,
   readDurableGateEvidence
-} from "./index-f6y341yk.js";
+} from "./index-yrrqs4b0.js";
 import"./index-scww5b77.js";
 import"./index-q1exe2b3.js";
 import"./index-wh8949ef.js";

package/dist/cli/{guardrail-explain-4t8fnysh.js → guardrail-explain-7aztgtyh.js}

@@ -1,21 +1,21 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-gmjrwz34.js";
-import"./index-6ctejje2.js";
+} from "./index-m9m7p49w.js";
+import"./index-typ408f4.js";
 import"./index-yfedche9.js";
 import"./index-c8s9a3zh.js";
 import"./index-9bsmzfk3.js";
 import"./index-a45jq4b7.js";
-import"./index-f6y341yk.js";
+import"./index-yrrqs4b0.js";
 import"./index-scww5b77.js";
 import"./index-ga4ta3cr.js";
 import"./index-80jkseqw.js";
-import"./index-vjvdvjd3.js";
-import"./index-qrnhvhmg.js";
-import"./index-7stsmndb.js";
-import"./index-kjbfry6m.js";
-import"./index-91qesget.js";
+import"./index-x12hvfpf.js";
+import"./index-n18yy0z1.js";
+import"./index-6f6y2rbp.js";
+import"./index-8f2270hc.js";
+import"./index-rk6qhyng.js";
 import"./index-bfwt3abw.js";
 import"./index-g40r5d08.js";
 import"./index-vxv732ex.js";

package/dist/cli/{hive-promoter-5ngbmnrw.js → hive-promoter-q899q2m6.js}

@@ -6,20 +6,20 @@ import {
   isHiveEligible,
   promoteFromSwarm,
   promoteToHive
-} from "./index-6ctejje2.js";
+} from "./index-typ408f4.js";
 import"./index-yfedche9.js";
 import"./index-c8s9a3zh.js";
 import"./index-9bsmzfk3.js";
 import"./index-a45jq4b7.js";
-import"./index-f6y341yk.js";
+import"./index-yrrqs4b0.js";
 import"./index-scww5b77.js";
 import"./index-ga4ta3cr.js";
 import"./index-80jkseqw.js";
-import"./index-vjvdvjd3.js";
-import"./index-qrnhvhmg.js";
-import"./index-7stsmndb.js";
-import"./index-kjbfry6m.js";
-import"./index-91qesget.js";
+import"./index-x12hvfpf.js";
+import"./index-n18yy0z1.js";
+import"./index-6f6y2rbp.js";
+import"./index-8f2270hc.js";
+import"./index-rk6qhyng.js";
 import"./index-bfwt3abw.js";
 import"./index-g40r5d08.js";
 import"./index-vxv732ex.js";

package/dist/cli/{index-z01r5483.js → index-54sevh81.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-gmjrwz34.js";
+} from "./index-m9m7p49w.js";
 import {
   handleGuardrailLog
 } from "./index-7jmrbp68.js";
@@ -81,7 +81,7 @@ import {
   handleWriteRetroCommand,
   normalizeSwarmCommandInput,
   resolveCommand
-} from "./index-6ctejje2.js";
+} from "./index-typ408f4.js";
 import"./index-yfedche9.js";
 import"./index-c8s9a3zh.js";
 import"./index-9bsmzfk3.js";
@@ -90,15 +90,15 @@ import {
   ORCHESTRATOR_NAME,
   stripKnownSwarmPrefix
 } from "./index-a45jq4b7.js";
-import"./index-f6y341yk.js";
+import"./index-yrrqs4b0.js";
 import"./index-scww5b77.js";
 import"./index-ga4ta3cr.js";
 import"./index-80jkseqw.js";
-import"./index-vjvdvjd3.js";
-import"./index-qrnhvhmg.js";
-import"./index-7stsmndb.js";
-import"./index-kjbfry6m.js";
-import"./index-91qesget.js";
+import"./index-x12hvfpf.js";
+import"./index-n18yy0z1.js";
+import"./index-6f6y2rbp.js";
+import"./index-8f2270hc.js";
+import"./index-rk6qhyng.js";
 import"./index-bfwt3abw.js";
 import"./index-g40r5d08.js";
 import"./index-vxv732ex.js";

package/dist/cli/{index-7stsmndb.js → index-6f6y2rbp.js}

@@ -4,7 +4,7 @@ import {
   countEntryViolationsInWindow,
   readKnowledgeEvents,
   recordKnowledgeEvent
-} from "./index-kjbfry6m.js";
+} from "./index-8f2270hc.js";
 import {
   jaccardBigram,
   readKnowledge,
@@ -12,7 +12,7 @@ import {
   resolveSwarmKnowledgePath,
   transactKnowledge,
   wordBigrams
-} from "./index-91qesget.js";
+} from "./index-rk6qhyng.js";
 import {
   isActiveStatus
 } from "./index-bfwt3abw.js";
@@ -188,7 +188,7 @@ async function maybeQuarantineOnContradiction(directory, entryId, threshold, win
         alreadyInactive: true
       };
     }
-    const { quarantineEntry } = await import("./knowledge-validator-2knz0d2t.js");
+    const { quarantineEntry } = await import("./knowledge-validator-t9sym59g.js");
     await quarantineEntry(directory, entryId, `repeat_contradiction: ${count} contradicted events in ${windowDays}d`, "auto");
     return { quarantined: true, entryId, contradictionsInWindow: count };
   } catch {

package/dist/cli/{index-kjbfry6m.js → index-8f2270hc.js}

@@ -594,7 +594,7 @@ async function applyKnowledgeVerdictFeedback(directory, options) {
       deltas.push({ id, delta });
     }
     if (deltas.length > 0) {
-      const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-ksa1dr2z.js");
+      const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-9babt8rd.js");
       await bumpKnowledgeConfidenceBatch(directory, deltas, options?.floorOptions);
     }
     return {

package/dist/cli/{index-gmjrwz34.js → index-m9m7p49w.js}

@@ -12,7 +12,7 @@ import {
   detectPosixWrites,
   detectWindowsWrites,
   resolveWriteTargets
-} from "./index-6ctejje2.js";
+} from "./index-typ408f4.js";
 import {
   checkFileAuthority,
   classifyFile,

package/dist/cli/{index-qrnhvhmg.js → index-n18yy0z1.js}

@@ -6,7 +6,7 @@ import {
   resolveSwarmKnowledgePath,
   resolveSwarmRejectedPath,
   transactKnowledge
-} from "./index-91qesget.js";
+} from "./index-rk6qhyng.js";
 import {
   resolveKnowledgeStoreDir
 } from "./index-g40r5d08.js";
@@ -75,6 +75,25 @@ var INJECTION_PATTERNS = [
   /\bconstructor\[/,
   /\.prototype\[/
 ];
+function scanContentSafety(text) {
+  if (typeof text !== "string" || text.length === 0)
+    return null;
+  const normalized = text.normalize("NFKC").replace(INVISIBLE_FORMAT_CHARS, " ").replace(/\s+/g, " ").toLowerCase();
+  for (const pattern of DANGEROUS_COMMAND_ERROR_PATTERNS) {
+    if (pattern.test(normalized))
+      return "dangerous command pattern detected";
+  }
+  for (const pattern of SECURITY_DEGRADING_PATTERNS) {
+    if (pattern.test(normalized)) {
+      return "security-degrading instruction detected";
+    }
+  }
+  for (const pattern of INJECTION_PATTERNS) {
+    if (pattern.test(text))
+      return "injection pattern detected";
+  }
+  return null;
+}
 var VALID_CATEGORIES = new Set([
   "process",
   "architecture",
@@ -412,6 +431,11 @@ function validateActionableFields(fields) {
         errors.push(`${name} contains invalid string`);
         return;
       }
+      const unsafe = scanContentSafety(item);
+      if (unsafe) {
+        errors.push(`${name} contains unsafe content: ${unsafe}`);
+        return;
+      }
     }
   }
   function checkNameList(name, list) {
@@ -758,4 +782,4 @@ var _internals = {
   hasSignificantOverlap
 };
 
-export { DANGEROUS_COMMAND_ERROR_PATTERNS, DANGEROUS_COMMAND_WARNING_PATTERNS, DANGEROUS_COMMAND_PATTERNS, SECURITY_DEGRADING_PATTERNS, INVISIBLE_FORMAT_CHARS, INJECTION_PATTERNS, validateLesson, ACTIONABLE_STRING_MAX, ACTIONABLE_LIST_MAX, RETIRED_SKILL_HISTORY_MAX, ALLOWED_SKILL_PATH_PREFIXES, validateSkillPath, validateSkillCandidatePath, validateActionableFields, validateActionability, resolveUnactionablePath, appendUnactionable, auditEntryHealth, quarantineEntry, restoreEntry, unarchiveEntry, _internals };
+export { DANGEROUS_COMMAND_ERROR_PATTERNS, DANGEROUS_COMMAND_WARNING_PATTERNS, DANGEROUS_COMMAND_PATTERNS, SECURITY_DEGRADING_PATTERNS, INVISIBLE_FORMAT_CHARS, INJECTION_PATTERNS, scanContentSafety, validateLesson, ACTIONABLE_STRING_MAX, ACTIONABLE_LIST_MAX, RETIRED_SKILL_HISTORY_MAX, ALLOWED_SKILL_PATH_PREFIXES, validateSkillPath, validateSkillCandidatePath, validateActionableFields, validateActionability, resolveUnactionablePath, appendUnactionable, auditEntryHealth, quarantineEntry, restoreEntry, unarchiveEntry, _internals };

package/dist/cli/{index-91qesget.js → index-rk6qhyng.js}

@@ -595,7 +595,7 @@ async function applyConfidenceFloorAction(directory, touched, options) {
   const recovered = touched.filter((e) => e.confidence > CONFIDENCE_FLOOR + FLOOR_EPSILON && e.confidence_floor_demoted);
   if (atFloor.length === 0 && recovered.length === 0)
     return;
-  const { readKnowledgeCounterRollups, effectiveRetrievalOutcomes } = await import("./knowledge-events-k2xsz5bh.js");
+  const { readKnowledgeCounterRollups, effectiveRetrievalOutcomes } = await import("./knowledge-events-m304swh6.js");
   const rollups = await readKnowledgeCounterRollups(directory);
   const flagIds = new Set;
   for (const e of atFloor) {
@@ -662,7 +662,7 @@ async function applyConfidenceFloorAction(directory, touched, options) {
     });
   }
   if (action === "quarantine" && toQuarantine.length > 0) {
-    const { quarantineEntry } = await import("./knowledge-validator-2knz0d2t.js");
+    const { quarantineEntry } = await import("./knowledge-validator-t9sym59g.js");
     for (const { id } of toQuarantine) {
       await quarantineEntry(directory, id, "confidence_floor_negative_outcome", "auto").catch((err) => {
         log("[knowledge-store] confidence-floor quarantine failed (best-effort):", err instanceof Error ? err.message : String(err));