opencode-swarm 7.135.2 → 7.135.4

package/dist/cli/{index-dg1njnms.js → index-6mjf4vr1.js}

@@ -338,7 +338,7 @@ TASK: CURATOR_POSTMORTEM [plan_id]
 PLAN_SUMMARY: [plan phases, task counts, completion status]
 CURATOR_DIGESTS: [running digest from curator_phase across all phases]
 KNOWLEDGE_ENTRIES: [JSON array of existing entries with UUIDs]
-KNOWLEDGE_EVENTS_SUMMARY: [aggregated violation/applied/ignored counts per entry]
+KNOWLEDGE_EVENTS_SUMMARY: [aggregated violation/applied/ignored/unacknowledged counts per entry \u2014 "unacknowledged" means a delegate was shown the directive and filed no ack; it is an audit-only delivery signal, NEVER negative evidence: do not treat it as ignored/violated or count it toward never-applied archival reasoning]
 PENDING_PROPOSALS: [skill/motif proposals awaiting triage]
 UNACTIONABLE_QUARANTINE: [entries flagged unactionable with retry status]
 DRIFT_REPORTS: [per-phase alignment/drift scores if available]

package/dist/cli/{index-9c3gf2wd.js → index-ajehqzvn.js}

@@ -1,18 +1,20 @@
 // @bun
 import {
-  DEFAULT_WORKTREE_ISOLATION_CONFIG,
   ExternalSkillsConfigSchema,
   GATE_CONFIG_KNOWN_SECTION_KEYS,
   GateConfigSchema,
   PluginConfigSchema,
-  init_constants,
   init_schema,
   resolveExternalSkillsConfig
-} from "./index-j0kte6gd.js";
+} from "./index-cg413zhk.js";
 import {
   advisoryWarn,
   init_warning_buffer
 } from "./index-4rhhvd1a.js";
+import {
+  DEFAULT_WORKTREE_ISOLATION_CONFIG,
+  init_constants
+} from "./index-3jcyn8g6.js";
 import {
   MAX_MERGE_DEPTH,
   deepMerge,
@@ -715,4 +717,4 @@ function resolveWorktreeIsolationConfig(config) {
 // src/config/index.ts
 var _internals = { loadPluginConfigWithMeta };
 
-export { loadPluginConfig, loadPluginConfigWithMeta, getSafeDefaultConfigLoadResult, loadPluginConfigWithMetaAsync, loadAgentPrompt, exports_loader, init_loader, resolveWorktreeIsolationConfig, _internals };
+export { resolveWorktreeIsolationConfig, loadPluginConfig, loadPluginConfigWithMeta, getSafeDefaultConfigLoadResult, loadPluginConfigWithMetaAsync, loadAgentPrompt, exports_loader, init_loader, _internals };

package/dist/cli/{index-2pxk6qg4.js → index-b34vbxmx.js}

@@ -1,9 +1,11 @@
 // @bun
 import {
-  init_constants,
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-j0kte6gd.js";
+} from "./index-cg413zhk.js";
+import {
+  init_constants
+} from "./index-3jcyn8g6.js";
 import {
   init_logger,
   warn

package/dist/cli/{index-d5psymdk.js → index-c9ddxv4k.js}

@@ -4,21 +4,68 @@ import {
   init_warning_buffer
 } from "./index-4rhhvd1a.js";
 import {
-  log
-} from "./index-zgwm4ryv.js";
+  SWARM_WORKTREE_DIR_NAME,
+  init_constants
+} from "./index-3jcyn8g6.js";
 import {
   bunSpawn
 } from "./index-y111zefa.js";
+import {
+  log
+} from "./index-zgwm4ryv.js";
 import {
   __require
 } from "./index-a76rekgs.js";
 
 // src/worktree/core.ts
-init_warning_buffer();
+init_constants();
 import * as fs from "fs";
 import * as fsPromises from "fs/promises";
 import * as os from "os";
 import * as path from "path";
+
+// src/config/swarm-branch.ts
+init_constants();
+var SWARM_WORKTREE_BRANCH_PREFIXES = ["swarm/", "swarm-lane/"];
+var SESSION_ID_PATTERN = /^ses_[A-Za-z0-9]+$/;
+function isPlainSegment(segment) {
+  return typeof segment === "string" && segment.length > 0 && segment !== "." && segment !== "..";
+}
+function buildSwarmBranchName(sessionId, id, purpose, legacyLane) {
+  const [standardPrefix, legacyLanePrefix] = SWARM_WORKTREE_BRANCH_PREFIXES;
+  return legacyLane ? `${legacyLanePrefix}${sessionId}/${id}` : `${standardPrefix}${purpose}/${sessionId}/${id}`;
+}
+function matchSwarmLaneBranch(branch) {
+  if (typeof branch !== "string" || branch === "")
+    return;
+  const segments = branch.split("/");
+  if (segments[0] === "swarm-lane") {
+    if (segments.length !== 3)
+      return;
+    const [, sessionId, id] = segments;
+    if (!SESSION_ID_PATTERN.test(sessionId ?? ""))
+      return;
+    if (!isPlainSegment(id))
+      return;
+    return { purpose: "lane", sessionId, id, style: "legacy-lane" };
+  }
+  if (segments[0] === "swarm") {
+    if (segments.length !== 4)
+      return;
+    const [, purpose, sessionId, id] = segments;
+    if (!isPlainSegment(purpose))
+      return;
+    if (!SESSION_ID_PATTERN.test(sessionId ?? ""))
+      return;
+    if (!isPlainSegment(id))
+      return;
+    return { purpose, sessionId, id, style: "purpose" };
+  }
+  return;
+}
+
+// src/worktree/core.ts
+init_warning_buffer();
 var _internals = {
   bunSpawn,
   platform: process.platform,
@@ -162,13 +209,10 @@ function shortenWorktreePath(_directory, sessionId, laneId) {
   return path.join(tmp, "swwt", sessionId, laneId);
 }
 function makeWorktreeBranchName(sessionId, id, options) {
-  if (options.branchStyle === "legacy-lane" && options.purpose === "lane") {
-    return `swarm-lane/${sessionId}/${id}`;
-  }
-  return `swarm/${options.purpose}/${sessionId}/${id}`;
+  return buildSwarmBranchName(sessionId, id, options.purpose, options.branchStyle === "legacy-lane" && options.purpose === "lane");
 }
 function resolveWorktreeBaseDir(directory, worktreeDir) {
-  return worktreeDir ? path.resolve(directory, worktreeDir) : path.resolve(path.dirname(directory), ".swarm-worktrees");
+  return worktreeDir ? path.resolve(directory, worktreeDir) : path.resolve(path.dirname(directory), SWARM_WORKTREE_DIR_NAME);
 }
 function isPathUnderSwarmWorktreeBase(targetPath, directory, worktreeDirOverrides = []) {
   const caseInsensitive = process.platform === "win32";
@@ -199,6 +243,11 @@ function isPathUnderSwarmWorktreeBase(targetPath, directory, worktreeDirOverride
 }
 async function provisionWorktree(directory, id, sessionId, options) {
   const branchName = makeWorktreeBranchName(sessionId, id, options);
+  if (!matchSwarmLaneBranch(branchName)) {
+    return {
+      error: `Refusing to provision worktree: branch "${branchName}" does not match the swarm lane grammar, so lane permission scoping could not recognise it and the lane would hang on the first external-directory prompt. This is almost always an invalid sessionId ("${sessionId}"); it must look like "ses_" followed by letters/digits, and the execution-unit id ("${id}") must be a single path segment.`
+    };
+  }
   let worktreePath = path.resolve(resolveWorktreeBaseDir(directory, options.worktreeDir), sessionId, id);
   const budgetResult = await checkPathBudget(worktreePath, directory);
   if (budgetResult.ok === false) {