opencode-swarm 7.126.2 → 7.126.4

package/.opencode/skills/engineering-conventions/SKILL.md

@@ -35,7 +35,7 @@ If you are not sure whether you are touching one of these, you are touching one
 The full list of 12 invariants is in `AGENTS.md`. The four that have caused the most recent production regressions:
 
 1. **Plugin initialization is bounded and fail-open.** Every awaited operation on the plugin-init path must be wrapped in `withTimeout(...)` and degrade non-fatally on timeout. Issue #704 (v7.0.3) and the v7.3.3 git-hygiene regression both stem from violating this. The OpenCode plugin host silently drops a plugin whose entry never resolves; users see "no agents in TUI / GUI" with no error.
-   - **Bounded is not free:** `withTimeout` only prevents an *unbounded* hang — the awaited work's latency still counts toward the ~400 ms repro-704 init deadline. Defer non-trivial init I/O via `queueMicrotask` when nothing downstream needs it before `server()` resolves.
+   - **Bounded is not free:** `withTimeout` only prevents an *unbounded* hang — the awaited work's latency still counts toward the ~400 ms repro-704 init deadline. Register non-trivial init I/O in the wrapper-owned post-resolution task queue when nothing downstream needs it before `server()` resolves. Do not use `queueMicrotask` inside the initializer: it can run during a later `await` while `server()` is still unresolved.
 2. **Subprocesses are bounded, non-interactive, and killable.** Every `bunSpawn(['<bin>', ...])` call must pass `cwd`, `stdin: 'ignore'` (unless intentionally interactive), `timeout: <ms>`, bounded stdio, and call `proc.kill()` in a `finally`. An outer `withTimeout` is not enough — it lets the awaiter proceed but does not abort the child.
 3. **Runtime portability — Node-ESM-loadable + v1 plugin shape.** No top-level `bun:` imports in `dist/index.js`. Default export is `{ id, server }`. All `Bun.*` calls go through `src/utils/bun-compat.ts`. v6.86.8 / v6.86.9 are the cautionary tales.
 4. **Test mock isolation.** `mock.module(...)` leaks across files in Bun's shared test-runner process. Prefer, in order: (a) `_test_exports` for pure function testing with zero mocks, (b) `_internals` dependency-injection seam for within-module mocking (see `src/utils/gitignore-warning.ts:_internals` and `src/hooks/diff-scope.ts:_internals`), (c) `mock.module` only when unavoidable. Restore in `afterEach`. The writing-tests skill covers all three tiers in detail; load it before modifying tests.

package/.opencode/skills/issue-tracer/scripts/trace-init.sh

@@ -15,6 +15,22 @@ set -eu
 # strict ASCII-only ranges regardless of the invoking environment.
 export LC_ALL=C
 
+# Native Git for Windows prints drive-qualified paths (C:/...) even when it is
+# invoked from MSYS/Git Bash. Coreutils do not consistently interpret that form
+# as absolute in restricted/non-login shells, so normalize Git-reported paths
+# before passing them to cd, mkdir, or redirection. POSIX hosts are unchanged.
+to_shell_path() {
+  case "$(uname -s 2>/dev/null || true)" in
+    MINGW* | MSYS* | CYGWIN*)
+      if command -v cygpath >/dev/null 2>&1; then
+        cygpath -u "$1"
+        return
+      fi
+      ;;
+  esac
+  printf '%s\n' "$1"
+}
+
 slug="${1:-}"
 if [ -z "$slug" ]; then
   echo "usage: trace-init.sh <issue-slug>" >&2
@@ -37,6 +53,7 @@ root="$(git rev-parse --show-toplevel 2>/dev/null)" || {
   echo "trace-init: not inside a git work tree — run this from within the target repository" >&2
   exit 2
 }
+root="$(to_shell_path "$root")"
 root_real="$(cd "$root" && pwd -P)"
 trace_dir="$root/.agents/issue-traces/$slug"
 
@@ -88,10 +105,13 @@ if [ -z "$git_dir" ]; then
     echo "trace-init: could not resolve the git directory" >&2
     exit 2
   }
+  git_dir="$(to_shell_path "$git_dir")"
   case "$git_dir" in
     /*) ;; # already absolute
     *) git_dir="$(pwd)/$git_dir" ;;
   esac
+else
+  git_dir="$(to_shell_path "$git_dir")"
 fi
 exclude_file="$git_dir/info/exclude"
 entry='.agents/issue-traces/'

package/.opencode/skills/swarm-pr-feedback/SKILL.md

@@ -144,7 +144,7 @@ tree:
   tracked path. It creates an auditable, path-scoped stash and returns its
   recovery command. Do not issue `git stash` through shell. The controller never
   stashes untracked files; move or remove those manually, or abort the checkout.
-- **Check out the head branch locally.** Feedback verification reads the working-tree
+- **Check out the head branch locally before dispatching feedback lanes.** Feedback verification reads the working-tree
   filesystem (`Read`/`Glob`/`Grep`), and fixes must land on the PR branch — without a
   checkout you would verify and patch the base branch's code instead. Record the
   exact `merge_base...head_ref` range for diff-scoped inspection.
@@ -159,6 +159,15 @@ tree:
   the upstream of an existing local branch with
   `git branch --set-upstream-to=<remote>/<remote-branch> <local-branch>`).
   Branch creation/tracking is blocked after the immutable head is bound.
+- `gh pr checkout` is permitted only in its non-force, non-submodule form with
+  the PR number/URL and optional `--repo` or `--branch` flags. Never use
+  `--force`, `--recurse-submodules`, or detached checkout during this
+  transition.
+- Before the first feedback verification dispatch binds the head, prove that
+  `git rev-parse HEAD` equals the authoritative full `pr_head_sha`,
+  `git status --porcelain` is empty, and the current branch tracks the intended
+  PR head remote/branch. A detached checkout is valid for review, not feedback
+  publication.
 
 When a verification lane result includes `output_ref`, treat `output` as a
 preview and call `retrieve_lane_output` before using it to classify, resolve,
@@ -733,8 +742,10 @@ the independently approved digest, the exact approved commit remains current,
 its bound upstream remote-tracking ref points to that exact commit, every
 feedback ID has exact-provenance evidence, and no PR-workflow lanes remain
 open. While the gate remains active, the runtime replaces architect
-final-response text with a mechanical blocked notice and re-wakes an idle
-parent session.
+final-response text with a mechanical blocked notice and normally re-wakes an
+idle parent session. A user interruption pauses automatic wakes until a later
+explicit user turn settles; the durable gate remains available to continue or
+abort.
 
 Report:
 

package/.opencode/skills/swarm-pr-review/SKILL.md

@@ -134,9 +134,26 @@ If scope cannot be determined, review the narrowest safe scope available and sta
 
 ### Pre-flight git ref availability
 
-Before launching explorers (Phase 3), confirm the PR branch refs are available:
-- If `head_ref` is a remote branch that is not checked out locally, fetch it via `git fetch origin <head_ref>`
-- **Check out the head branch locally.** Explorer agents read files from the working tree, not from git history — passing the commit range in the delegation prompt is not sufficient because `Read` / `Glob` / `Grep` tools operate on the filesystem. Without a checkout, explorers silently read the base branch's version of changed files and produce invalid candidates. **Before checking out, verify the working tree is clean (`git status --porcelain`). If tracked changes exist, call `prepare_pr_workflow_checkout` with every explicit dirty tracked path. It creates an auditable, path-scoped stash and returns its recovery command. Do not issue `git stash` through shell. The controller never stashes untracked files; move or remove those manually, or abort the checkout.**
+Before launching explorers (Phase 3), perform this exact standalone sequence:
+
+1. Resolve and retain the authoritative full `pr_head_sha` from PR metadata.
+2. Verify the working tree is clean with `git status --porcelain`. If tracked
+   changes exist, call `prepare_pr_workflow_checkout` with every explicit dirty
+   tracked path. Do not issue `git stash` through shell. The controller never
+   stashes untracked files; move or remove those manually, or abort.
+3. Fetch the PR head as one standalone command, for example
+   `git fetch origin refs/pull/<N>/head`. Do not compose fetch and checkout.
+4. Prove the full commit exists locally with
+   `git cat-file -e <full_pr_head_sha>^{commit}`.
+5. Check out the exact PR filesystem with
+   `git switch --detach <full_pr_head_sha>`. Do not use `--track FETCH_HEAD`:
+   `FETCH_HEAD` is not a remote-tracking branch.
+6. Confirm `git rev-parse HEAD` equals the full `pr_head_sha`, bind that exact
+   head through the first PR-review controller call, and finish this before dispatching explorer lanes.
+
+Explorer agents read files from the working tree, not from git history. Passing
+the commit range in a prompt cannot substitute for this checkout because
+`Read` / `Glob` / `Grep` operate on the filesystem.
 - Explicitly pass the verified merge-base range (`base_sha...pr_head_sha`) in every explorer delegation so explorers inspect exactly the controller-bound PR diff. Include `base_ref` only as the live ref used to recompute `base_sha`; do not substitute a two-dot branch-tip range.
 
 If refs cannot be fetched or checked out, state the limitation in the context pack.
@@ -1405,7 +1422,9 @@ the same exact
 `pr_head_sha`. The tool refuses to clear the session gate while required base,
 trigger, declared reviewer/critic, or open-lane obligations remain incomplete.
 While the gate remains active, the runtime replaces architect final-response
-text with a mechanical blocked notice and re-wakes an idle parent session. Only
+text with a mechanical blocked notice and re-wakes an idle parent session. A
+user interruption pauses every automatic wake path until a later explicit user
+turn settles; the durable gate remains available to continue or abort. Only
 emit the final report after the completion tool confirms that the gate cleared.
 
 ## Aborting an unrecoverable review
@@ -1419,9 +1438,11 @@ the merge-base bind can never verify. In that state the response gate
 suspends further auto-resumes after a small number of consecutive
 unproductive wakes, and the only exits are:
 
-1. **Diagnose and retry as two separate standalone commands.** First run
-   `git fetch origin refs/pull/<N>/head:pr-<N>-head` (single command), then
-   `git checkout pr-<N>-head` (single command). Then recompute the exact
+1. **Diagnose and retry the canonical standalone sequence.** Run
+   `git fetch origin refs/pull/<N>/head`, verify
+   `git cat-file -e <full_pr_head_sha>^{commit}`, then run
+   `git switch --detach <full_pr_head_sha>`. Do not use `--track FETCH_HEAD`.
+   Confirm `git rev-parse HEAD` equals the authoritative PR head, then recompute the exact
    merge base with `git merge-base -- <base_ref> <pr_head_sha>` (single
    command) and retry the `swarm-pr-review:base` dispatch with the exact
    `pr_head_sha`, `base_sha`, and `base_ref`.

package/dist/background/pr-event-delivery.d.ts

@@ -89,7 +89,7 @@ export declare function buildWakeMessage(events: FormattedPrEvent[]): string;
  * clients that lack it. Bounded by withTimeout; returns false on any
  * failure or timeout. Never throws.
  */
-declare function sendWakePrompt(sessionID: string, events: FormattedPrEvent[]): Promise<boolean>;
+declare function sendWakePrompt(sessionID: string, events: FormattedPrEvent[], messageID: string): Promise<boolean>;
 export declare const _internals: {
     sendWakePrompt: typeof sendWakePrompt;
     withTimeout: typeof withTimeout;

package/dist/cli/{config-doctor-mfx27331.js → config-doctor-2admdwc2.js}

@@ -12,8 +12,8 @@ import {
   shouldRunOnStartup,
   writeBackupArtifact,
   writeDoctorArtifact
-} from "./index-3xd9a2g7.js";
-import"./index-vcqwhe9d.js";
+} from "./index-cpssctv1.js";
+import"./index-7ttstfv6.js";
 import"./index-bk5tah7q.js";
 import"./index-z6xqpmqg.js";
 import"./index-zjygnfay.js";

package/dist/cli/{curation-policy-n944aq62.js → curation-policy-s2wydhda.js}

@@ -4,9 +4,9 @@ import {
   authorizeCuration,
   buildConfigFingerprintInput,
   readCohortConfigFingerprint
-} from "./index-gwss5btk.js";
+} from "./index-4scxzpbz.js";
 import"./index-rtry5xyf.js";
-import"./index-nqp13m5a.js";
+import"./index-360anpk0.js";
 import"./index-ae75rja9.js";
 import"./index-q27bajqb.js";
 import"./index-zgwm4ryv.js";

package/dist/cli/{curator-qfh9xty4.js → curator-4tp297kp.js}

@@ -14,31 +14,31 @@ import {
   runCuratorInit,
   runCuratorPhase,
   writeCuratorSummary
-} from "./index-d88y17ht.js";
-import"./index-gxw20m1d.js";
-import"./index-3xd9a2g7.js";
+} from "./index-yvgmsepb.js";
+import"./index-v4n224r1.js";
+import"./index-cpssctv1.js";
 import"./index-kk1scggc.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
 import"./index-6n2jpz7x.js";
-import"./index-7bxw3v5w.js";
-import"./index-f97dm6tz.js";
-import"./index-pf3xae4s.js";
+import"./index-ypy3dhbg.js";
+import"./index-vbk29hmf.js";
+import"./index-r3f1z043.js";
 import"./index-vxv732ex.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
 import"./index-23zsx7dm.js";
-import"./index-88dt7c9z.js";
-import"./index-gwss5btk.js";
+import"./index-swgsq1ds.js";
+import"./index-4scxzpbz.js";
 import"./index-rtry5xyf.js";
-import"./index-pb8ag9vg.js";
-import"./index-nqp13m5a.js";
+import"./index-mgdcrhkg.js";
+import"./index-360anpk0.js";
 import"./index-ae75rja9.js";
 import"./index-q27bajqb.js";
-import"./index-gf9cxvp0.js";
+import"./index-v3gw3sc5.js";
 import"./index-k5jrywpr.js";
 import"./index-n832052r.js";
-import"./index-vcqwhe9d.js";
+import"./index-7ttstfv6.js";
 import"./index-bk5tah7q.js";
 import"./index-8fwhhayc.js";
 import"./index-q1exe2b3.js";

package/dist/cli/{curator-llm-factory-0rf29gfq.js → curator-llm-factory-caf8jqyb.js}

@@ -1,31 +1,31 @@
 // @bun
 import {
   createCuratorLLMDelegate
-} from "./index-d88y17ht.js";
-import"./index-gxw20m1d.js";
-import"./index-3xd9a2g7.js";
+} from "./index-yvgmsepb.js";
+import"./index-v4n224r1.js";
+import"./index-cpssctv1.js";
 import"./index-kk1scggc.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
 import"./index-6n2jpz7x.js";
-import"./index-7bxw3v5w.js";
-import"./index-f97dm6tz.js";
-import"./index-pf3xae4s.js";
+import"./index-ypy3dhbg.js";
+import"./index-vbk29hmf.js";
+import"./index-r3f1z043.js";
 import"./index-vxv732ex.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
 import"./index-23zsx7dm.js";
-import"./index-88dt7c9z.js";
-import"./index-gwss5btk.js";
+import"./index-swgsq1ds.js";
+import"./index-4scxzpbz.js";
 import"./index-rtry5xyf.js";
-import"./index-pb8ag9vg.js";
-import"./index-nqp13m5a.js";
+import"./index-mgdcrhkg.js";
+import"./index-360anpk0.js";
 import"./index-ae75rja9.js";
 import"./index-q27bajqb.js";
-import"./index-gf9cxvp0.js";
+import"./index-v3gw3sc5.js";
 import"./index-k5jrywpr.js";
 import"./index-n832052r.js";
-import"./index-vcqwhe9d.js";
+import"./index-7ttstfv6.js";
 import"./index-bk5tah7q.js";
 import"./index-8fwhhayc.js";
 import"./index-q1exe2b3.js";

package/dist/cli/{guardrail-explain-jsrjqps1.js → guardrail-explain-yjzbs0fq.js}

@@ -1,32 +1,32 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-z8ftpav0.js";
-import"./index-d88y17ht.js";
-import"./index-gxw20m1d.js";
-import"./index-3xd9a2g7.js";
+} from "./index-cxtnbjwn.js";
+import"./index-yvgmsepb.js";
+import"./index-v4n224r1.js";
+import"./index-cpssctv1.js";
 import"./index-kk1scggc.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
 import"./index-6n2jpz7x.js";
-import"./index-7bxw3v5w.js";
-import"./index-f97dm6tz.js";
-import"./index-pf3xae4s.js";
+import"./index-ypy3dhbg.js";
+import"./index-vbk29hmf.js";
+import"./index-r3f1z043.js";
 import"./index-vxv732ex.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
 import"./index-23zsx7dm.js";
-import"./index-88dt7c9z.js";
-import"./index-gwss5btk.js";
+import"./index-swgsq1ds.js";
+import"./index-4scxzpbz.js";
 import"./index-rtry5xyf.js";
-import"./index-pb8ag9vg.js";
-import"./index-nqp13m5a.js";
+import"./index-mgdcrhkg.js";
+import"./index-360anpk0.js";
 import"./index-ae75rja9.js";
 import"./index-q27bajqb.js";
-import"./index-gf9cxvp0.js";
+import"./index-v3gw3sc5.js";
 import"./index-k5jrywpr.js";
 import"./index-n832052r.js";
-import"./index-vcqwhe9d.js";
+import"./index-7ttstfv6.js";
 import"./index-bk5tah7q.js";
 import"./index-8fwhhayc.js";
 import"./index-q1exe2b3.js";

package/dist/cli/{guardrail-log-61gya05m.js → guardrail-log-7cychbgs.js}

@@ -1,9 +1,9 @@
 // @bun
 import {
   handleGuardrailLog
-} from "./index-bf76q8q7.js";
-import"./index-gxw20m1d.js";
-import"./index-vcqwhe9d.js";
+} from "./index-8etcyr9r.js";
+import"./index-v4n224r1.js";
+import"./index-7ttstfv6.js";
 import"./index-bk5tah7q.js";
 import"./index-z6xqpmqg.js";
 import"./index-zjygnfay.js";

package/dist/cli/{hive-promoter-ktt17fyf.js → hive-promoter-er83aqka.js}

@@ -7,33 +7,33 @@ import {
   isHiveEligible,
   promoteFromSwarm,
   promoteToHive
-} from "./index-d88y17ht.js";
-import"./index-gxw20m1d.js";
-import"./index-3xd9a2g7.js";
+} from "./index-yvgmsepb.js";
+import"./index-v4n224r1.js";
+import"./index-cpssctv1.js";
 import"./index-kk1scggc.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
 import"./index-6n2jpz7x.js";
-import"./index-7bxw3v5w.js";
-import"./index-f97dm6tz.js";
-import"./index-pf3xae4s.js";
+import"./index-ypy3dhbg.js";
+import"./index-vbk29hmf.js";
+import"./index-r3f1z043.js";
 import"./index-vxv732ex.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
 import"./index-23zsx7dm.js";
-import"./index-88dt7c9z.js";
-import"./index-gwss5btk.js";
+import"./index-swgsq1ds.js";
+import"./index-4scxzpbz.js";
 import"./index-rtry5xyf.js";
 import {
   resolveHiveKnowledgePath
-} from "./index-pb8ag9vg.js";
-import"./index-nqp13m5a.js";
+} from "./index-mgdcrhkg.js";
+import"./index-360anpk0.js";
 import"./index-ae75rja9.js";
 import"./index-q27bajqb.js";
-import"./index-gf9cxvp0.js";
+import"./index-v3gw3sc5.js";
 import"./index-k5jrywpr.js";
 import"./index-n832052r.js";
-import"./index-vcqwhe9d.js";
+import"./index-7ttstfv6.js";
 import"./index-bk5tah7q.js";
 import"./index-8fwhhayc.js";
 import"./index-q1exe2b3.js";

package/dist/cli/{index-nqp13m5a.js → index-360anpk0.js}

@@ -608,7 +608,7 @@ async function applyKnowledgeVerdictFeedback(directory, options) {
       deltas.push({ id, delta });
     }
     if (deltas.length > 0) {
-      const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-efvtng9t.js");
+      const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-mv7qjf4s.js");
       await bumpKnowledgeConfidenceBatch(directory, deltas, options?.floorOptions);
     }
     return {

package/dist/cli/{index-5nq8dp63.js → index-46xgqgd5.js}

@@ -1,10 +1,10 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-z8ftpav0.js";
+} from "./index-cxtnbjwn.js";
 import {
   handleGuardrailLog
-} from "./index-bf76q8q7.js";
+} from "./index-8etcyr9r.js";
 import {
   COMMAND_REGISTRY,
   SWARM_COMMAND_TOOL_ALLOWLIST,
@@ -83,28 +83,28 @@ import {
   handleWriteRetroCommand,
   normalizeSwarmCommandInput,
   resolveCommand
-} from "./index-d88y17ht.js";
-import"./index-gxw20m1d.js";
-import"./index-3xd9a2g7.js";
+} from "./index-yvgmsepb.js";
+import"./index-v4n224r1.js";
+import"./index-cpssctv1.js";
 import"./index-kk1scggc.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
 import"./index-6n2jpz7x.js";
-import"./index-7bxw3v5w.js";
-import"./index-f97dm6tz.js";
-import"./index-pf3xae4s.js";
+import"./index-ypy3dhbg.js";
+import"./index-vbk29hmf.js";
+import"./index-r3f1z043.js";
 import"./index-vxv732ex.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
 import"./index-23zsx7dm.js";
-import"./index-88dt7c9z.js";
-import"./index-gwss5btk.js";
+import"./index-swgsq1ds.js";
+import"./index-4scxzpbz.js";
 import"./index-rtry5xyf.js";
-import"./index-pb8ag9vg.js";
-import"./index-nqp13m5a.js";
+import"./index-mgdcrhkg.js";
+import"./index-360anpk0.js";
 import"./index-ae75rja9.js";
 import"./index-q27bajqb.js";
-import"./index-gf9cxvp0.js";
+import"./index-v3gw3sc5.js";
 import"./index-k5jrywpr.js";
 import"./index-n832052r.js";
 import {
@@ -113,7 +113,7 @@ import {
   init_constants,
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-vcqwhe9d.js";
+} from "./index-7ttstfv6.js";
 import"./index-bk5tah7q.js";
 import"./index-8fwhhayc.js";
 import"./index-q1exe2b3.js";

package/dist/cli/{index-gwss5btk.js → index-4scxzpbz.js}

@@ -4,7 +4,7 @@ import {
 } from "./index-rtry5xyf.js";
 import {
   readKnowledgeEvents
-} from "./index-nqp13m5a.js";
+} from "./index-360anpk0.js";
 import {
   isLinked,
   readLinkPointer,

package/dist/cli/{index-c48dvb6j.js → index-6mfcg9ws.js}

@@ -6,7 +6,7 @@ import {
   loadPluginConfigWithMeta,
   loadPluginConfigWithMetaAsync,
   resolveWorktreeIsolationConfig
-} from "./index-gf9cxvp0.js";
+} from "./index-v3gw3sc5.js";
 import {
   ApprovalEvidenceSchema,
   BaseEvidenceSchema,
@@ -58,7 +58,7 @@ import {
   WorktreeIsolationConfigSchema,
   isQAAgent,
   isSubagent
-} from "./index-vcqwhe9d.js";
+} from "./index-7ttstfv6.js";
 import"./index-bk5tah7q.js";
 import {
   MigrationStatusSchema,

package/dist/cli/{index-vcqwhe9d.js → index-7ttstfv6.js}

@@ -1199,6 +1199,23 @@ function resolveGuardrailsConfig(config, agentName) {
   };
   return resolved;
 }
+function rejectCheckpointPrototypePollution(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    return raw;
+  try {
+    if (Object.getPrototypeOf(raw) !== Object.prototype) {
+      return { [INVALID_CHECKPOINT_PROTO_FIELD]: true };
+    }
+    for (const key of Reflect.ownKeys(raw)) {
+      if (typeof key === "string" && FORBIDDEN_CHECKPOINT_CONFIG_KEYS.has(key)) {
+        return { [INVALID_CHECKPOINT_PROTO_FIELD]: true };
+      }
+    }
+  } catch {
+    return { [INVALID_CHECKPOINT_PROTO_FIELD]: true };
+  }
+  return raw;
+}
 function resolveExternalSkillsConfig(input) {
   if (input === undefined || input === null || typeof input !== "object" || Array.isArray(input)) {
     return { ...DEFAULT_EXTERNAL_SKILLS_CONFIG };
@@ -1218,7 +1235,7 @@ function resolveExternalSkillsConfig(input) {
   };
   return merged;
 }
-var _internals, SEPARATORS, CANONICAL_ROLES_LONGEST_FIRST, CANONICAL_ROLES_SET, AgentReasoningConfigSchema, AgentThinkingConfigSchema, FALLBACK_MODELS_MAX = 3, AgentOverrideConfigSchema, SwarmConfigSchema, ModelPricingConfigSchema, PricingConfigSchema, HooksConfigSchema, ScoringWeightsSchema, DecisionDecaySchema, TokenRatiosSchema, ScoringConfigSchema, ContextBudgetConfigSchema, EvidenceConfigSchema, GateFeatureSchema, PlaceholderScanConfigSchema, QualityBudgetConfigSchema, GATE_CONFIG_KNOWN_SECTION_KEYS, GateConfigSchema, PipelineConfigSchema, PhaseCompleteConfigSchema, SummaryConfigSchema, ReviewPassesConfigSchema, AutoReviewConfigSchema, AdversarialDetectionConfigSchema, AdversarialTestingConfigSchemaBase, AdversarialTestingConfigSchema, IntegrationAnalysisConfigSchema, DocsConfigSchema, DesignDocsConfigSchema, UIReviewConfigSchema, CompactionAdvisoryConfigSchema, LintConfigSchema, SecretscanConfigSchema, GuardrailsProfileSchema, DEFAULT_AGENT_PROFILES, DEFAULT_ARCHITECT_PROFILE, GuardrailsConfigSchema, WatchdogConfigSchema, SelfReviewConfigSchema, ToolFilterConfigSchema, PlanCursorConfigSchema, ContextMapConfigSchema, RepoGraphConfigSchema, CheckpointConfigSchema, ApplyPatchConfigSchema, AutomationModeSchema, AutomationCapabilitiesSchema, AutomationConfigSchemaBase, AutomationConfigSchema, KnowledgeConfigSchema, MemoryConfigSchema, CuratorConfigSchema, ArchitecturalSupervisionConfigSchema, KnowledgeApplicationConfigSchema, SkillPropagationAudienceSchema, SkillPropagationConfigSchema, SkillImproverConfigSchema, SkillsConfigSchema, SpecWriterConfigSchema, SlopDetectorConfigSchema, IncrementalVerifyConfigSchema, CompactionConfigSchema, PrmConfigSchema, AgentAuthorityRuleSchema, AuthorityConfigSchema, GeneralCouncilMemberConfigSchema, GeneralCouncilConfigSchema, CouncilConfigSchema, PrMonitorConfigSchema, ParallelizationConfigSchema, WorktreeIsolationConfigSchema, LeanTurboConfigSchema, EpicConfigSchema, StandardTurboConfigSchema, LeanTurboStrategyConfigSchema, TurboConfigSchema, ExternalSkillCandidateSourceTypeSchema, ExternalSkillCandidateEvaluationVerdictSchema, DiscoverySourceSchema, ExternalSkillCandidateSchema, ExternalSkillsConfigSchema, DEFAULT_EXTERNAL_SKILLS_CONFIG, DEFAULT_SKILLS_CONFIG, PluginConfigSchema;
+var _internals, SEPARATORS, CANONICAL_ROLES_LONGEST_FIRST, CANONICAL_ROLES_SET, AgentReasoningConfigSchema, AgentThinkingConfigSchema, FALLBACK_MODELS_MAX = 3, AgentOverrideConfigSchema, SwarmConfigSchema, ModelPricingConfigSchema, PricingConfigSchema, HooksConfigSchema, ScoringWeightsSchema, DecisionDecaySchema, TokenRatiosSchema, ScoringConfigSchema, ContextBudgetConfigSchema, EvidenceConfigSchema, GateFeatureSchema, PlaceholderScanConfigSchema, QualityBudgetConfigSchema, GATE_CONFIG_KNOWN_SECTION_KEYS, GateConfigSchema, PipelineConfigSchema, PhaseCompleteConfigSchema, SummaryConfigSchema, ReviewPassesConfigSchema, AutoReviewConfigSchema, AdversarialDetectionConfigSchema, AdversarialTestingConfigSchemaBase, AdversarialTestingConfigSchema, IntegrationAnalysisConfigSchema, DocsConfigSchema, DesignDocsConfigSchema, UIReviewConfigSchema, CompactionAdvisoryConfigSchema, LintConfigSchema, SecretscanConfigSchema, GuardrailsProfileSchema, DEFAULT_AGENT_PROFILES, DEFAULT_ARCHITECT_PROFILE, GuardrailsConfigSchema, WatchdogConfigSchema, SelfReviewConfigSchema, ToolFilterConfigSchema, PlanCursorConfigSchema, ContextMapConfigSchema, RepoGraphConfigSchema, INVALID_CHECKPOINT_PROTO_FIELD = "__swarm_invalid_checkpoint_proto__", FORBIDDEN_CHECKPOINT_CONFIG_KEYS, CheckpointConfigSchema, ApplyPatchConfigSchema, AutomationModeSchema, AutomationCapabilitiesSchema, AutomationConfigSchemaBase, AutomationConfigSchema, KnowledgeConfigSchema, MemoryConfigSchema, CuratorConfigSchema, ArchitecturalSupervisionConfigSchema, KnowledgeApplicationConfigSchema, SkillPropagationAudienceSchema, SkillPropagationConfigSchema, SkillImproverConfigSchema, SkillsConfigSchema, SpecWriterConfigSchema, SlopDetectorConfigSchema, IncrementalVerifyConfigSchema, CompactionConfigSchema, PrmConfigSchema, AgentAuthorityRuleSchema, AuthorityConfigSchema, GeneralCouncilMemberConfigSchema, GeneralCouncilConfigSchema, CouncilConfigSchema, PrMonitorConfigSchema, ParallelizationConfigSchema, WorktreeIsolationConfigSchema, LeanTurboConfigSchema, EpicConfigSchema, StandardTurboConfigSchema, LeanTurboStrategyConfigSchema, TurboConfigSchema, ExternalSkillCandidateSourceTypeSchema, ExternalSkillCandidateEvaluationVerdictSchema, DiscoverySourceSchema, ExternalSkillCandidateSchema, ExternalSkillsConfigSchema, DEFAULT_EXTERNAL_SKILLS_CONFIG, DEFAULT_SKILLS_CONFIG, PluginConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   init_knowledge_types();
@@ -1689,11 +1706,16 @@ var init_schema = __esm(() => {
   RepoGraphConfigSchema = exports_external.object({
     exclude_dirs: exports_external.array(exports_external.string().trim().min(1)).default([])
   });
-  CheckpointConfigSchema = exports_external.object({
+  FORBIDDEN_CHECKPOINT_CONFIG_KEYS = new Set([
+    "__proto__",
+    "prototype",
+    "constructor"
+  ]);
+  CheckpointConfigSchema = exports_external.preprocess(rejectCheckpointPrototypePollution, exports_external.object({
     enabled: exports_external.boolean().default(true),
     auto_checkpoint_threshold: exports_external.number().int().min(1).max(20).default(3),
     allow_empty_commits: exports_external.boolean().default(false)
-  }).strict();
+  }).strict());
   ApplyPatchConfigSchema = exports_external.object({
     fuzzy_match: exports_external.boolean().default(false),
     fuzzy_match_context_aware: exports_external.boolean().default(false)

package/dist/cli/{index-bf76q8q7.js → index-8etcyr9r.js}

@@ -2,7 +2,7 @@
 import {
   redactPath,
   redactShellCommand
-} from "./index-gxw20m1d.js";
+} from "./index-v4n224r1.js";
 
 // src/services/guardrail-log-service.ts
 import * as fs from "fs/promises";

package/dist/cli/{index-3xd9a2g7.js → index-cpssctv1.js}

@@ -8,7 +8,7 @@ import {
   init_constants,
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-vcqwhe9d.js";
+} from "./index-7ttstfv6.js";
 import {
   log
 } from "./index-zgwm4ryv.js";

package/dist/cli/{index-z8ftpav0.js → index-cxtnbjwn.js}

@@ -12,14 +12,14 @@ import {
   detectPosixWrites,
   detectWindowsWrites,
   resolveWriteTargets
-} from "./index-d88y17ht.js";
+} from "./index-yvgmsepb.js";
 import {
   checkFileAuthority,
   classifyFile,
   isInDeclaredScope,
   redactPath,
   redactShellCommand
-} from "./index-gxw20m1d.js";
+} from "./index-v4n224r1.js";
 
 // src/services/guardrail-explain-service.ts
 import path from "path";

package/dist/cli/{index-pb8ag9vg.js → index-mgdcrhkg.js}

@@ -650,7 +650,7 @@ async function applyConfidenceFloorAction(directory, touched, options) {
   const recovered = touched.filter((e) => e.confidence > CONFIDENCE_FLOOR + FLOOR_EPSILON && e.confidence_floor_demoted);
   if (atFloor.length === 0 && recovered.length === 0)
     return;
-  const { readKnowledgeCounterRollups, effectiveRetrievalOutcomes } = await import("./knowledge-events-7k82xk36.js");
+  const { readKnowledgeCounterRollups, effectiveRetrievalOutcomes } = await import("./knowledge-events-v0cp1a8d.js");
   const rollups = await readKnowledgeCounterRollups(directory);
   const flagIds = new Set;
   for (const e of atFloor) {
@@ -717,11 +717,11 @@ async function applyConfidenceFloorAction(directory, touched, options) {
     });
   }
   if (action === "quarantine" && toQuarantine.length > 0) {
-    const { quarantineEntry } = await import("./knowledge-validator-jh93eagj.js");
-    const { KnowledgeConfigSchema } = await import("./schema-fa033pqw.js");
+    const { quarantineEntry } = await import("./knowledge-validator-g05g6qrt.js");
+    const { KnowledgeConfigSchema } = await import("./schema-2x7wsb0n.js");
     let config;
     try {
-      const { loadPluginConfigWithMeta } = await import("./index-c48dvb6j.js");
+      const { loadPluginConfigWithMeta } = await import("./index-6mfcg9ws.js");
       const { config: loadedConfig } = loadPluginConfigWithMeta(directory);
       config = KnowledgeConfigSchema.parse(loadedConfig.knowledge ?? {});
     } catch {

package/dist/cli/{index-pf3xae4s.js → index-r3f1z043.js}

@@ -2,7 +2,7 @@
 import {
   readKnowledge,
   transactKnowledge
-} from "./index-pb8ag9vg.js";
+} from "./index-mgdcrhkg.js";
 import {
   resolveKnowledgeStoreDir
 } from "./index-q27bajqb.js";

package/dist/cli/{index-88dt7c9z.js → index-swgsq1ds.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   authorizeCuration
-} from "./index-gwss5btk.js";
+} from "./index-4scxzpbz.js";
 import {
   findNearDuplicate,
   inferTags,
@@ -9,7 +9,7 @@ import {
   resolveSwarmKnowledgePath,
   resolveSwarmRejectedPath,
   transactKnowledge
-} from "./index-pb8ag9vg.js";
+} from "./index-mgdcrhkg.js";
 import {
   resolveKnowledgeStoreDir
 } from "./index-q27bajqb.js";