opencode-swarm 7.138.0 → 7.138.1

package/dist/cli/{index-sp7s1vk3.js → index-mnw8g9bs.js}

@@ -16,13 +16,13 @@ import {
 } from "./index-rrxcfxrd.js";
 import {
   stableCanonicalStringify
-} from "./index-xz0zjrdr.js";
+} from "./index-e2eedz1b.js";
 import {
   detectStraySwarmDirs,
   readDoctorArtifact,
   removeStraySwarmDir,
   runConfigDoctor
-} from "./index-ca6qmxd8.js";
+} from "./index-vp3mwsd1.js";
 import {
   MAX_TRANSIENT_RETRIES,
   archiveEvidence,
@@ -59,7 +59,7 @@ import {
   savePlan,
   transientBackoff,
   validateProjectRoot
-} from "./index-fmh15wxb.js";
+} from "./index-y06a43sk.js";
 import {
   EvaluationTaskV1Schema,
   GateAuditManifestV1Schema,
@@ -114,15 +114,15 @@ import {
   retireSkill,
   selectCandidateEntries,
   syncBundledProjectSkillsIfMissingAsync
-} from "./index-4xs9e82s.js";
+} from "./index-mzqgtzxq.js";
 import {
   readRecentEscalations
-} from "./index-hmapndcz.js";
+} from "./index-navw2ezf.js";
 import {
   alreadyCuratedThisGeneration,
   claimNextScanBatch,
   resolveCohortId
-} from "./index-whf5ecbw.js";
+} from "./index-aeyktf9q.js";
 import {
   CURATOR_INIT_PROMPT,
   CURATOR_PHASE_PROMPT,
@@ -175,11 +175,11 @@ import {
   validateActionableFields,
   validateLesson,
   validateSkillPath
-} from "./index-z55s5719.js";
+} from "./index-d4t92fa3.js";
 import {
   authorizeCuration,
   buildConfigFingerprintInput
-} from "./index-7kgfvt3h.js";
+} from "./index-9vvskh03.js";
 import {
   cohortConfigFingerprint
 } from "./index-rtry5xyf.js";
@@ -212,7 +212,7 @@ import {
   transactFile,
   transactKnowledge,
   wordBigrams
-} from "./index-7wzyf4dr.js";
+} from "./index-8xqnp3gw.js";
 import {
   MAX_EVENT_LOG_ENTRIES,
   _internals,
@@ -222,7 +222,7 @@ import {
   recordHiveKnowledgeEvent,
   recordKnowledgeEvent,
   resolveKnowledgeEventsPath
-} from "./index-cdx3aqj5.js";
+} from "./index-kqzzdxc1.js";
 import {
   resolveHiveDataDir,
   resolveHiveEventsPath,
@@ -247,10 +247,10 @@ import {
   init_loader,
   loadPluginConfig,
   loadPluginConfigWithMeta
-} from "./index-npgjk6vc.js";
+} from "./index-p7fn5byt.js";
 import {
   RetrospectiveEvidenceSchema
-} from "./index-k5jrywpr.js";
+} from "./index-gprxjmm7.js";
 import {
   DEFAULT_SKILL_OPT_CONFIG,
   FALLBACK_MODELS_MAX,
@@ -263,7 +263,7 @@ import {
   package_default,
   resolveAutoReviewConfig,
   stripKnownSwarmPrefix
-} from "./index-6nenabrm.js";
+} from "./index-e78pqbkj.js";
 import {
   KNOWLEDGE_SCHEMA_VERSION,
   OUTCOME_BLOCK_THRESHOLD,
@@ -18784,7 +18784,7 @@ function planMerges(active, threshold, maxComparisons, maxMerges) {
   };
 }
 async function sweepActiveNearDuplicates(directory, options = {}) {
-  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-2vzgvscz.js");
+  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-vmff7b40.js");
   const { config } = loadPluginConfigWithMeta2(directory);
   const sweepConfig = config.learning?.dedup_sweep;
   if (sweepConfig?.enabled === false)
@@ -20377,7 +20377,7 @@ async function runCuratorPhase(directory, phase, agentsDispatched, config, knowl
     }
     if (config.skill_generation_enabled === true && skillCandidates.length > 0) {
       try {
-        const skillModule = await import("./skill-generator-r19a1zje.js");
+        const skillModule = await import("./skill-generator-kns0dae2.js");
         for (const cand of skillCandidates) {
           if (cand.confidence < (config.min_skill_confidence ?? DEFAULT_SKILL_MIN_CONFIDENCE)) {
             continue;
@@ -20837,7 +20837,7 @@ async function applyCuratorKnowledgeUpdates(directory, recommendations, knowledg
     } catch {}
   }
   if (contradictedEntries.length > 0 && knowledgeConfig.contradiction_threshold_action === "quarantine") {
-    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-pqskjp6y.js");
+    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-6y5x8vat.js");
     for (const { id } of contradictedEntries) {
       try {
         await maybeQuarantineOnContradiction(directory, id, knowledgeConfig.contradiction_quarantine_threshold, knowledgeConfig.contradiction_quarantine_window_days);
@@ -21656,7 +21656,7 @@ async function runCuratorPostMortem(directory, options = {}) {
       warnings.push("Failed to collect knowledge summary.");
     }
     try {
-      const { getScanStatus } = await import("./scan-cursor-ngykkd7f.js");
+      const { getScanStatus } = await import("./scan-cursor-we0561wc.js");
       const scanStatus = await getScanStatus(directory);
       if (scanStatus.remaining_estimate > 0) {
         warnings.push(`Fair scan: reviewed ${knowledgeSummary.length} entries this sweep (generation ${scanStatus.generation}); ${scanStatus.remaining_estimate} more eligible entries will be visited in future curation sweeps.`);
@@ -21828,9 +21828,9 @@ var _internals24 = {
   verifyPostMortemKnowledgeActions,
   repairPostMortemActions,
   loadDefaultKnowledgeConfig: async (directory) => {
-    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-p82ntfy9.js");
+    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-1xtxr4d9.js");
     try {
-      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-2vzgvscz.js");
+      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-vmff7b40.js");
       const loaded = loadPluginConfigWithMeta2(directory);
       return KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
     } catch {
@@ -21838,11 +21838,11 @@ var _internals24 = {
     }
   },
   applyCuratorKnowledgeUpdates: async (directory, recommendations, knowledgeConfig, generation) => {
-    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-b9ascpbh.js");
+    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-jjf5x6bn.js");
     return applyCuratorKnowledgeUpdates2(directory, recommendations, knowledgeConfig, generation);
   },
   checkHivePromotions: async (entries, knowledgeConfig, directory) => {
-    const { checkHivePromotions } = await import("./hive-promoter-7x2zzhb7.js");
+    const { checkHivePromotions } = await import("./hive-promoter-zkay2ffy.js");
     return checkHivePromotions(entries, knowledgeConfig, directory);
   },
   applyProposalTriage: async (directory, triage) => {
@@ -21851,7 +21851,7 @@ var _internals24 = {
       activateProposal,
       listSkills: listSkills2,
       sanitizeSlug
-    } = await import("./skill-generator-r19a1zje.js");
+    } = await import("./skill-generator-kns0dae2.js");
     const result = {
       approved: [],
       rejected: [],
@@ -24478,9 +24478,9 @@ function hashContent(content) {
   return createHash9("sha1").update(content).digest("hex");
 }
 async function loadConfigForPolicyCurator(directory) {
-  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-p82ntfy9.js");
+  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-1xtxr4d9.js");
   try {
-    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-2vzgvscz.js");
+    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-vmff7b40.js");
     const { config: loadedConfig } = loadPluginConfigWithMeta2(directory);
     return KnowledgeConfigSchema2.parse(loadedConfig.knowledge ?? {});
   } catch {
@@ -28440,7 +28440,7 @@ async function runFinalizeStage(ctx) {
     }
   }
   try {
-    const { CuratorConfigSchema: CCS } = await import("./schema-p82ntfy9.js");
+    const { CuratorConfigSchema: CCS } = await import("./schema-1xtxr4d9.js");
     const { config: pmLoadedConfig } = _internals36.loadPluginConfigWithMeta(ctx.directory);
     const curatorCfg = CCS.parse(pmLoadedConfig.curator ?? {});
     if (curatorCfg.enabled && curatorCfg.postmortem_enabled) {
@@ -30711,9 +30711,9 @@ var _internals41 = {
   loadPluginConfigWithMeta,
   loadCuratorDeps: async () => {
     const [{ CuratorConfigSchema }, curator, { createCuratorLLMDelegate: createCuratorLLMDelegate2 }] = await Promise.all([
-      import("./schema-p82ntfy9.js"),
-      import("./curator-b9ascpbh.js"),
-      import("./curator-llm-factory-r47q1hbd.js")
+      import("./schema-1xtxr4d9.js"),
+      import("./curator-jjf5x6bn.js"),
+      import("./curator-llm-factory-sprc6pm3.js")
     ]);
     return { CuratorConfigSchema, curator, createCuratorLLMDelegate: createCuratorLLMDelegate2 };
   }
@@ -31618,7 +31618,7 @@ async function computeCurationDiagnostics(directory, entries) {
   let scanCompleted = false;
   let scanRemaining = 0;
   try {
-    const { getScanStatus } = await import("./scan-cursor-ngykkd7f.js");
+    const { getScanStatus } = await import("./scan-cursor-we0561wc.js");
     const status = await getScanStatus(directory);
     scanGeneration = status.generation;
     scanCompleted = status.completed;
@@ -31628,17 +31628,17 @@ async function computeCurationDiagnostics(directory, entries) {
   try {
     const { isLinked: isLinked2 } = await import("./knowledge-link-xc6yhxmz.js");
     if (isLinked2(directory)) {
-      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-p82ntfy9.js");
+      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-1xtxr4d9.js");
       let config;
       try {
-        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-2vzgvscz.js");
+        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-vmff7b40.js");
         const loaded = loadPluginConfigWithMeta2(directory);
         config = KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
       } catch {
         config = KnowledgeConfigSchema2.parse({});
       }
       const { cohortConfigFingerprint: cohortConfigFingerprint2 } = await import("./config-fingerprint-v22xh5a2.js");
-      const { buildConfigFingerprintInput: buildConfigFingerprintInput2, readCohortConfigFingerprint } = await import("./curation-policy-qx23sc8b.js");
+      const { buildConfigFingerprintInput: buildConfigFingerprintInput2, readCohortConfigFingerprint } = await import("./curation-policy-dkx4s5va.js");
       const currentFp = cohortConfigFingerprint2(buildConfigFingerprintInput2(config));
       const cohortFp = await readCohortConfigFingerprint(directory);
       configMatch = cohortFp === null ? null : currentFp === cohortFp;
@@ -32849,7 +32849,7 @@ async function handleDoctorCommand(directory, args) {
   const result = runConfigDoctor(config, directory);
   let output;
   if (enableAutoFix && result.hasAutoFixableIssues) {
-    const { runConfigDoctorWithFixes } = await import("./config-doctor-mb81xytp.js");
+    const { runConfigDoctorWithFixes } = await import("./config-doctor-m79sx8b2.js");
     const fixResult = await runConfigDoctorWithFixes(directory, config, true, {
       applyLossy: true
     });
@@ -33686,7 +33686,7 @@ async function handleEvidenceCommand(directory, args) {
   return formatTaskEvidenceMarkdown(evidenceData);
 }
 async function handleEvidenceSummaryCommand(directory) {
-  const { buildEvidenceSummary } = await import("./evidence-summary-service-1azhyeft.js");
+  const { buildEvidenceSummary } = await import("./evidence-summary-service-6cttrkzw.js");
   const artifact = await buildEvidenceSummary(directory);
   if (!artifact) {
     return "No plan found. Run `/swarm plan` to check plan status.";
@@ -43362,10 +43362,14 @@ import * as path77 from "path";
 var MAX_FILE_PATH_LENGTH = 500;
 var MAX_FILE_SIZE_BYTES3 = 512 * 1024;
 var MAX_FILES_SCANNED2 = 1000;
+var MAX_EXPLICIT_FILES_SCANNED = 100;
 var MAX_FINDINGS2 = 100;
 var MAX_OUTPUT_BYTES3 = 512000;
-var MAX_LINE_LENGTH = 1e4;
-var MAX_CONTENT_BYTES = 50 * 1024;
+var MAX_CONTEXT_CHARS = 1000;
+var MAX_LONG_LINE_CHARS = 1e4;
+var MAX_INCOMPLETE_PATHS = 25;
+var MAX_DISCOVERY_DIRECTORIES = 1e4;
+var SCAN_TIME_BUDGET_MS = 55000;
 var BINARY_SIGNATURES = [
   0,
   2303741511,
@@ -43413,6 +43417,7 @@ var DEFAULT_EXCLUDE_EXTENSIONS = new Set([
   ".gz",
   ".rar",
   ".7z",
+  ".wasm",
   ".exe",
   ".dll",
   ".so",
@@ -43651,9 +43656,6 @@ function isBinaryFile(filePath, buffer) {
 }
 function scanLineForSecrets(line, _lineNum) {
   const results = [];
-  if (line.length > MAX_LINE_LENGTH) {
-    return results;
-  }
   for (const pattern of SECRET_PATTERNS2) {
     pattern.regex.lastIndex = 0;
     for (let match = pattern.regex.exec(line);match !== null; match = pattern.regex.exec(line)) {
@@ -43672,8 +43674,8 @@ function scanLineForSecrets(line, _lineNum) {
       }
     }
   }
-  const valueMatch = line.match(/(?:secret|key|token|password|cred|credential)\s*[=:]\s*["']?([a-zA-Z0-9+/=_-]{20,100})["']?/i);
-  if (valueMatch && isHighEntropyString(valueMatch[1])) {
+  const valueMatch = line.match(/((?:secret|key|token|password|cred|credential))\s*[=:]\s*["']?([a-zA-Z0-9+/=_-]{20,100})["']?/i);
+  if (valueMatch && isHighEntropyString(valueMatch[2])) {
     const matchStart = valueMatch.index || 0;
     const matchEnd = matchStart + valueMatch[0].length;
     const hasOverlap = results.some((r) => !(r.matchEnd <= matchStart || r.matchStart >= matchEnd));
@@ -43682,7 +43684,7 @@ function scanLineForSecrets(line, _lineNum) {
         type: "high_entropy",
         confidence: "low",
         severity: "medium",
-        redacted: `${valueMatch[0].split("=")[0].trim()}=[HIGH_ENTROPY]`,
+        redacted: `${valueMatch[1]}=[HIGH_ENTROPY]`,
         matchStart,
         matchEnd
       });
@@ -43692,42 +43694,95 @@ function scanLineForSecrets(line, _lineNum) {
 }
 function createRedactedContext(line, findings) {
   if (findings.length === 0)
-    return line;
+    return "";
   const sorted = [...findings].sort((a, b) => a.matchStart - b.matchStart);
   let result = "";
   let lastEnd = 0;
   for (const finding of sorted) {
-    result += line.slice(lastEnd, finding.matchStart);
-    result += finding.redacted;
-    lastEnd = finding.matchEnd;
+    if (finding.matchEnd <= lastEnd)
+      continue;
+    if (finding.matchStart >= lastEnd) {
+      result += line.slice(lastEnd, finding.matchStart);
+      result += "[REDACTED]";
+    }
+    lastEnd = Math.max(lastEnd, finding.matchEnd);
   }
   result += line.slice(lastEnd);
-  return result;
+  if (result.length <= MAX_CONTEXT_CHARS)
+    return result;
+  const truncationMarker = "...[context truncated]...";
+  const edgeLength = Math.floor((MAX_CONTEXT_CHARS - truncationMarker.length) / 2);
+  const remaining = MAX_CONTEXT_CHARS - truncationMarker.length - edgeLength;
+  return `${result.slice(0, edgeLength)}${truncationMarker}${result.slice(-remaining)}`;
 }
 var O_NOFOLLOW = process.platform !== "win32" ? fs31.constants.O_NOFOLLOW : undefined;
-function scanFileForSecrets(filePath) {
+function readBoundedFile(filePath) {
+  let fd;
+  try {
+    const flags = fs31.constants.O_RDONLY | (O_NOFOLLOW !== undefined ? O_NOFOLLOW : 0);
+    fd = _internals64.openFile(filePath, flags);
+  } catch {
+    return { status: "incomplete", reason: "read_error" };
+  }
+  let outcome;
+  try {
+    const stat6 = _internals64.fstatFile(fd);
+    const initialSize = stat6.size;
+    if (!stat6.isFile()) {
+      outcome = { status: "incomplete", reason: "non_file" };
+    } else {
+      const bufferLength = Math.min(initialSize + 1, MAX_FILE_SIZE_BYTES3 + 1);
+      const buffer = Buffer.allocUnsafe(bufferLength);
+      let bytesRead = 0;
+      while (bytesRead < buffer.length) {
+        const count = _internals64.readFileChunk(fd, buffer, bytesRead, buffer.length - bytesRead, null);
+        if (count === 0)
+          break;
+        bytesRead += count;
+      }
+      const postStat = _internals64.fstatFile(fd);
+      if (postStat.size !== initialSize) {
+        outcome = {
+          status: "incomplete",
+          reason: postStat.size > MAX_FILE_SIZE_BYTES3 ? "oversized" : "read_error"
+        };
+      } else {
+        outcome = {
+          status: "ok",
+          buffer: buffer.subarray(0, bytesRead),
+          truncated: initialSize > MAX_FILE_SIZE_BYTES3
+        };
+      }
+    }
+  } catch {
+    outcome = { status: "incomplete", reason: "read_error" };
+  }
+  try {
+    _internals64.closeFile(fd);
+  } catch {
+    return { status: "incomplete", reason: "read_error" };
+  }
+  return outcome;
+}
+function scanFileForSecrets(filePath, mode) {
   const findings = [];
   try {
     const lstat3 = fs31.lstatSync(filePath);
     if (lstat3.isSymbolicLink()) {
-      return findings;
+      return mode === "explicit" ? { status: "incomplete", reason: "symlink" } : { status: "skipped", reason: "symlink" };
     }
-    if (lstat3.size > MAX_FILE_SIZE_BYTES3) {
-      return findings;
-    }
-    let buffer;
-    if (O_NOFOLLOW !== undefined) {
-      const fd = fs31.openSync(filePath, "r", O_NOFOLLOW);
-      try {
-        buffer = fs31.readFileSync(fd);
-      } finally {
-        fs31.closeSync(fd);
-      }
-    } else {
-      buffer = fs31.readFileSync(filePath);
+    if (!lstat3.isFile()) {
+      return { status: "incomplete", reason: "non_file" };
     }
+    const readOutcome = readBoundedFile(filePath);
+    if (readOutcome.status === "incomplete")
+      return readOutcome;
+    const { buffer, truncated } = readOutcome;
     if (isBinaryFile(filePath, buffer)) {
-      return findings;
+      return { status: "skipped", reason: "binary" };
+    }
+    if (truncated) {
+      return { status: "incomplete", reason: "oversized" };
     }
     let content;
     if (buffer.length >= 3 && buffer[0] === 239 && buffer[1] === 187 && buffer[2] === 191) {
@@ -43736,13 +43791,16 @@ function scanFileForSecrets(filePath) {
       content = buffer.toString("utf-8");
     }
     if (content.includes("\x00")) {
-      return findings;
+      return { status: "skipped", reason: "binary" };
     }
-    const scanContent = content.slice(0, MAX_CONTENT_BYTES);
-    const lines = scanContent.split(`
+    const lines = content.split(`
 `);
     for (let i = 0;i < lines.length; i++) {
+      if (mode === "standalone" && lines[i].length > MAX_LONG_LINE_CHARS) {
+        continue;
+      }
       const lineResults = scanLineForSecrets(lines[i], i + 1);
+      const context = createRedactedContext(lines[i], lineResults);
       for (const result of lineResults) {
         findings.push({
           path: filePath,
@@ -43751,12 +43809,43 @@ function scanFileForSecrets(filePath) {
           confidence: result.confidence,
           severity: result.severity,
           redacted: result.redacted,
-          context: createRedactedContext(lines[i], [result])
+          context
         });
       }
     }
-  } catch {}
-  return findings;
+    return { status: "scanned", findings };
+  } catch {
+    return { status: "incomplete", reason: "read_error" };
+  }
+}
+function assertNever(value) {
+  throw new Error(`Unhandled secretscan outcome: ${String(value)}`);
+}
+async function yieldToEventLoop() {
+  await new Promise((resolve24) => setImmediate(resolve24));
+}
+function serializeSecretscanResult(result) {
+  let findings = result.findings;
+  let candidate = result;
+  let json = JSON.stringify(candidate, null, 2);
+  while (Buffer.byteLength(json, "utf8") > MAX_OUTPUT_BYTES3 && findings.length > 0) {
+    findings = findings.slice(0, Math.floor(findings.length / 2));
+    candidate = {
+      ...result,
+      findings,
+      message: "Output truncated due to size limits."
+    };
+    json = JSON.stringify(candidate, null, 2);
+  }
+  if (Buffer.byteLength(json, "utf8") > MAX_OUTPUT_BYTES3) {
+    candidate = {
+      ...result,
+      findings: [],
+      message: "Output truncated due to size limits."
+    };
+    json = JSON.stringify(candidate, null, 2);
+  }
+  return json;
 }
 function isSymlinkLoop(realPath, visited) {
   if (visited.has(realPath)) {
@@ -43770,75 +43859,168 @@ function isPathWithinScope(realPath, scanDir) {
   const resolvedRealPath = path77.resolve(realPath);
   return resolvedRealPath === resolvedScanDir || resolvedRealPath.startsWith(resolvedScanDir + path77.sep) || resolvedRealPath.startsWith(`${resolvedScanDir}/`) || resolvedRealPath.startsWith(`${resolvedScanDir}\\`);
 }
-function findScannableFiles(dir, excludeExact, excludeGlobs, scanDir, visited, stats = {
-  skippedDirs: 0,
-  skippedFiles: 0,
-  fileErrors: 0,
-  symlinkSkipped: 0
-}) {
-  const files = [];
-  let entries;
-  try {
-    entries = fs31.readdirSync(dir);
-  } catch {
-    stats.fileErrors++;
-    return files;
-  }
-  entries.sort((a, b) => {
-    const aLower = a.toLowerCase();
-    const bLower = b.toLowerCase();
-    if (aLower < bLower)
-      return -1;
-    if (aLower > bLower)
-      return 1;
-    return a.localeCompare(b);
-  });
-  for (const entry of entries) {
-    const fullPath = path77.join(dir, entry);
-    const relPath = path77.relative(scanDir, fullPath).replace(/\\/g, "/");
-    if (isExcluded(entry, relPath, excludeExact, excludeGlobs)) {
-      stats.skippedDirs++;
-      continue;
+var DISCOVERY_YIELD_INTERVAL = 100;
+function toSafeRelativePath(rootDir, targetPath) {
+  const relative10 = path77.relative(rootDir, targetPath).replace(/\\/g, "/");
+  if (!relative10 || relative10 === ".")
+    return ".";
+  if (relative10.startsWith("..") || path77.isAbsolute(relative10)) {
+    const basename15 = path77.basename(targetPath).replace(/\\/g, "/");
+    return basename15 || ".";
+  }
+  return relative10;
+}
+function recordIncompletePath(target, rootDir, targetPath, reason) {
+  if (target.length >= MAX_INCOMPLETE_PATHS) {
+    target[MAX_INCOMPLETE_PATHS - 1] = { path: ".", reason: "truncated" };
+    return;
+  }
+  target.push({ path: toSafeRelativePath(rootDir, targetPath), reason });
+}
+function compareFilePaths(a, b) {
+  const aLower = a.toLowerCase();
+  const bLower = b.toLowerCase();
+  if (aLower < bLower)
+    return -1;
+  if (aLower > bLower)
+    return 1;
+  if (a < b)
+    return -1;
+  if (a > b)
+    return 1;
+  return 0;
+}
+function addBoundedCandidate(state, filePath) {
+  state.totalCandidates++;
+  const heap = state.files;
+  if (heap.length < MAX_FILES_SCANNED2) {
+    heap.push(filePath);
+    let index2 = heap.length - 1;
+    while (index2 > 0) {
+      const parent = Math.floor((index2 - 1) / 2);
+      if (compareFilePaths(heap[parent], heap[index2]) >= 0)
+        break;
+      [heap[parent], heap[index2]] = [heap[index2], heap[parent]];
+      index2 = parent;
+    }
+    return;
+  }
+  if (compareFilePaths(filePath, heap[0]) >= 0)
+    return;
+  heap[0] = filePath;
+  let index = 0;
+  while (true) {
+    const left = index * 2 + 1;
+    const right = left + 1;
+    let largest = index;
+    if (left < heap.length && compareFilePaths(heap[left], heap[largest]) > 0) {
+      largest = left;
+    }
+    if (right < heap.length && compareFilePaths(heap[right], heap[largest]) > 0) {
+      largest = right;
     }
-    let lstat3;
+    if (largest === index)
+      break;
+    [heap[index], heap[largest]] = [heap[largest], heap[index]];
+    index = largest;
+  }
+}
+async function collectScannableFiles(dir, excludeExact, excludeGlobs, scanDir, visited, stats, state) {
+  const pending = [dir];
+  while (pending.length > 0) {
+    if (state.deadlineExceeded || state.cleanupFailed)
+      return;
+    const currentDir = pending.pop();
+    if (!currentDir)
+      continue;
+    let directory;
     try {
-      lstat3 = fs31.lstatSync(fullPath);
+      directory = fs31.opendirSync(currentDir);
     } catch {
       stats.fileErrors++;
+      recordIncompletePath(state.incompletePaths, scanDir, currentDir, "read_error");
       continue;
     }
-    if (lstat3.isSymbolicLink()) {
-      stats.symlinkSkipped++;
-      continue;
-    }
-    if (lstat3.isDirectory()) {
-      let realPath;
-      try {
-        realPath = fs31.realpathSync(fullPath);
-      } catch {
-        stats.fileErrors++;
-        continue;
-      }
-      if (isSymlinkLoop(realPath, visited)) {
-        stats.symlinkSkipped++;
-        continue;
-      }
-      if (!isPathWithinScope(realPath, scanDir)) {
-        stats.symlinkSkipped++;
-        continue;
+    let stoppedEarly = false;
+    try {
+      while (true) {
+        if (state.entriesSinceYield >= DISCOVERY_YIELD_INTERVAL) {
+          state.entriesSinceYield = 0;
+          await _internals64.yieldToEventLoop();
+          if (_internals64.now() >= state.deadline) {
+            state.deadlineExceeded = true;
+            recordIncompletePath(state.incompletePaths, scanDir, currentDir, "deadline");
+            stoppedEarly = true;
+            break;
+          }
+        }
+        const entry = directory.readSync();
+        if (!entry)
+          break;
+        state.entriesSinceYield++;
+        const fullPath = path77.join(currentDir, entry.name);
+        const relPath = path77.relative(scanDir, fullPath).replace(/\\/g, "/");
+        if (isExcluded(entry.name, relPath, excludeExact, excludeGlobs)) {
+          stats.skippedDirs++;
+          continue;
+        }
+        let lstat3;
+        try {
+          lstat3 = fs31.lstatSync(fullPath);
+        } catch {
+          stats.fileErrors++;
+          recordIncompletePath(state.incompletePaths, scanDir, fullPath, "read_error");
+          continue;
+        }
+        if (lstat3.isSymbolicLink()) {
+          stats.symlinkSkipped++;
+          continue;
+        }
+        if (lstat3.isDirectory()) {
+          if (state.directoriesQueued >= MAX_DISCOVERY_DIRECTORIES) {
+            state.unexaminedDirectories++;
+            recordIncompletePath(state.incompletePaths, scanDir, fullPath, "directory_limit");
+            continue;
+          }
+          let realPath;
+          try {
+            realPath = fs31.realpathSync(fullPath);
+          } catch {
+            stats.fileErrors++;
+            recordIncompletePath(state.incompletePaths, scanDir, fullPath, "read_error");
+            continue;
+          }
+          if (isSymlinkLoop(realPath, visited) || !isPathWithinScope(realPath, scanDir)) {
+            stats.symlinkSkipped++;
+            continue;
+          }
+          pending.push(fullPath);
+          state.directoriesQueued++;
+        } else if (lstat3.isFile()) {
+          const ext = path77.extname(fullPath).toLowerCase();
+          if (!DEFAULT_EXCLUDE_EXTENSIONS.has(ext)) {
+            addBoundedCandidate(state, fullPath);
+          } else {
+            stats.skippedFiles++;
+          }
+        } else {
+          stats.fileErrors++;
+          recordIncompletePath(state.incompletePaths, scanDir, fullPath, "non_file");
+        }
       }
-      const subFiles = findScannableFiles(fullPath, excludeExact, excludeGlobs, scanDir, visited, stats);
-      files.push(...subFiles);
-    } else if (lstat3.isFile()) {
-      const ext = path77.extname(fullPath).toLowerCase();
-      if (!DEFAULT_EXCLUDE_EXTENSIONS.has(ext)) {
-        files.push(fullPath);
-      } else {
-        stats.skippedFiles++;
+    } finally {
+      try {
+        _internals64.closeDirectory(directory);
+      } catch (error2) {
+        if (error2.code !== "ERR_DIR_CLOSED") {
+          state.cleanupFailed = true;
+          recordIncompletePath(state.incompletePaths, scanDir, currentDir, "cleanup_failed");
+        }
       }
     }
+    if (stoppedEarly)
+      break;
   }
-  return files;
 }
 var secretscan = createSwarmTool({
   description: "Scan directory for potential secrets (API keys, tokens, passwords) using regex patterns and entropy heuristics. Returns metadata-only findings with redacted previews - NEVER returns raw secrets. Excludes common directories (node_modules, .git, dist, etc.) by default. Supports glob patterns (e.g. **/.svelte-kit/**, **/*.test.ts) and reads .secretscanignore at the scan root.",
@@ -43896,17 +44078,21 @@ var secretscan = createSwarmTool({
       }
     }
     try {
-      const _scanDirRaw = path77.resolve(directory);
+      const scanDirRaw = path77.resolve(directory);
       const scanDir = (() => {
         try {
-          return fs31.realpathSync(_scanDirRaw);
+          return fs31.realpathSync(scanDirRaw);
         } catch {
-          return _scanDirRaw;
+          return scanDirRaw;
         }
       })();
-      if (!fs31.existsSync(scanDir)) {
+      let dirStat;
+      try {
+        dirStat = fs31.lstatSync(scanDir);
+      } catch (error2) {
+        const err = error2;
         const errorResult = {
-          error: "directory not found",
+          error: err.code === "ENOENT" ? "directory not found" : `scan failed: ${err.message || "unable to inspect directory"}`,
           scan_dir: directory,
           findings: [],
           count: 0,
@@ -43915,7 +44101,6 @@ var secretscan = createSwarmTool({
         };
         return JSON.stringify(errorResult, null, 2);
       }
-      const dirStat = fs31.statSync(scanDir);
       if (!dirStat.isDirectory()) {
         const errorResult = {
           error: "target must be a directory, not a file",
@@ -43947,36 +44132,74 @@ var secretscan = createSwarmTool({
         symlinkSkipped: 0
       };
       const visited = new Set;
-      const files = findScannableFiles(scanDir, excludeExact, excludeGlobs, scanDir, visited, stats);
-      files.sort((a, b) => {
-        const aLower = a.toLowerCase();
-        const bLower = b.toLowerCase();
-        if (aLower < bLower)
-          return -1;
-        if (aLower > bLower)
-          return 1;
-        return a.localeCompare(b);
-      });
-      const filesToScan = files.slice(0, MAX_FILES_SCANNED2);
+      const deadline = _internals64.now() + SCAN_TIME_BUDGET_MS;
+      const discovery = {
+        files: [],
+        totalCandidates: 0,
+        deadline,
+        deadlineExceeded: false,
+        cleanupFailed: false,
+        entriesSinceYield: 0,
+        incompletePaths: [],
+        directoriesQueued: 1,
+        unexaminedDirectories: 0
+      };
+      await _internals64.yieldToEventLoop();
+      await collectScannableFiles(scanDir, excludeExact, excludeGlobs, scanDir, visited, stats, discovery);
+      const files = discovery.files;
+      files.sort(compareFilePaths);
+      const filesToScan = files;
+      if (discovery.totalCandidates > filesToScan.length) {
+        recordIncompletePath(discovery.incompletePaths, scanDir, scanDir, "max_files");
+      }
+      if (discovery.deadlineExceeded) {
+        recordIncompletePath(discovery.incompletePaths, scanDir, scanDir, "deadline");
+      }
+      if (discovery.cleanupFailed) {
+        recordIncompletePath(discovery.incompletePaths, scanDir, scanDir, "cleanup_failed");
+      }
       const allFindings = [];
       let filesScanned = 0;
       let skippedFiles = stats.skippedFiles;
-      for (const filePath of filesToScan) {
-        if (allFindings.length >= MAX_FINDINGS2)
+      let incompleteFiles = stats.fileErrors + Math.max(0, discovery.totalCandidates - filesToScan.length) + (discovery.deadlineExceeded || discovery.cleanupFailed ? 1 : 0) + discovery.unexaminedDirectories;
+      for (let index = 0;index < filesToScan.length; index++) {
+        if (_internals64.now() >= deadline) {
+          for (const remaining of filesToScan.slice(index)) {
+            recordIncompletePath(discovery.incompletePaths, scanDir, remaining, "deadline");
+          }
+          incompleteFiles += filesToScan.length - index;
           break;
-        const fileFindings = scanFileForSecrets(filePath);
-        try {
-          const stat6 = fs31.statSync(filePath);
-          if (stat6.size > MAX_FILE_SIZE_BYTES3) {
+        }
+        if (allFindings.length >= MAX_FINDINGS2) {
+          recordIncompletePath(discovery.incompletePaths, scanDir, scanDir, "truncated");
+          incompleteFiles += filesToScan.length - index;
+          break;
+        }
+        const outcome = scanFileForSecrets(filesToScan[index], "standalone");
+        switch (outcome.status) {
+          case "scanned":
+            filesScanned++;
+            break;
+          case "skipped":
             skippedFiles++;
-            continue;
-          }
-        } catch {}
-        filesScanned++;
-        for (const finding of fileFindings) {
-          if (allFindings.length >= MAX_FINDINGS2)
             break;
-          allFindings.push(finding);
+          case "incomplete":
+            skippedFiles++;
+            incompleteFiles++;
+            recordIncompletePath(discovery.incompletePaths, scanDir, filesToScan[index], outcome.reason);
+            break;
+          default:
+            assertNever(outcome);
+        }
+        if (outcome.status === "scanned") {
+          for (const finding of outcome.findings) {
+            if (allFindings.length >= MAX_FINDINGS2)
+              break;
+            allFindings.push(finding);
+          }
+        }
+        if (index + 1 < filesToScan.length) {
+          await _internals64.yieldToEventLoop();
         }
       }
       allFindings.sort((a, b) => {
@@ -43997,31 +44220,33 @@ var secretscan = createSwarmTool({
         findings: allFindings,
         count: allFindings.length,
         files_scanned: filesScanned,
-        skipped_files: skippedFiles + stats.fileErrors + stats.symlinkSkipped
+        skipped_files: skippedFiles + stats.fileErrors + stats.symlinkSkipped,
+        incomplete_files: incompleteFiles,
+        incomplete_paths: discovery.incompletePaths
       };
       const parts = [];
-      if (files.length > MAX_FILES_SCANNED2) {
-        parts.push(`Found ${files.length} files, scanned ${MAX_FILES_SCANNED2}`);
+      if (discovery.totalCandidates > MAX_FILES_SCANNED2) {
+        parts.push(`Found ${discovery.totalCandidates} files, selected ${MAX_FILES_SCANNED2}`);
+      }
+      if (discovery.deadlineExceeded) {
+        parts.push("Discovery stopped at the scan deadline");
+      }
+      if (discovery.cleanupFailed) {
+        parts.push("Discovery directory cleanup failed");
       }
       if (allFindings.length >= MAX_FINDINGS2) {
         parts.push(`Results limited to ${MAX_FINDINGS2} findings`);
       }
+      if (incompleteFiles > 0) {
+        parts.push(`${incompleteFiles} files were not completely scanned`);
+      }
       if (skippedFiles > 0 || stats.fileErrors > 0 || stats.symlinkSkipped > 0) {
         parts.push(`${skippedFiles + stats.fileErrors + stats.symlinkSkipped} files skipped (binary/oversized/symlinks/errors)`);
       }
       if (parts.length > 0) {
         result.message = `${parts.join("; ")}.`;
       }
-      let jsonOutput = JSON.stringify(result, null, 2);
-      if (jsonOutput.length > MAX_OUTPUT_BYTES3) {
-        const truncatedResult = {
-          ...result,
-          findings: result.findings.slice(0, Math.floor(MAX_OUTPUT_BYTES3 * 0.8 / 200)),
-          message: "Output truncated due to size limits."
-        };
-        jsonOutput = JSON.stringify(truncatedResult, null, 2);
-      }
-      return jsonOutput;
+      return serializeSecretscanResult(result);
     } catch (e) {
       const errorResult = {
         error: e instanceof Error ? `scan failed: ${e.message || "internal error"}` : "scan failed: unknown error",
@@ -44057,14 +44282,89 @@ async function runSecretscanOnFiles(files, directory) {
     const findings = [];
     let filesScanned = 0;
     let skippedFiles = 0;
-    for (const file of files) {
+    const incompletePaths = [];
+    const rawRoot = path77.resolve(directory);
+    const canonicalRoot = (() => {
+      try {
+        return fs31.realpathSync(rawRoot);
+      } catch {
+        return rawRoot;
+      }
+    })();
+    let rootStat;
+    try {
+      rootStat = fs31.lstatSync(canonicalRoot);
+    } catch (error2) {
+      const err = error2;
+      return {
+        error: err.code === "ENOENT" ? "directory not found" : `scan failed: ${err.message || "unable to inspect directory"}`,
+        scan_dir: directory,
+        findings: [],
+        count: 0,
+        files_scanned: 0,
+        skipped_files: 0
+      };
+    }
+    if (!rootStat.isDirectory()) {
+      throw new Error("target must be a directory");
+    }
+    const filesToScan = files.slice(0, MAX_EXPLICIT_FILES_SCANNED);
+    let incompleteFiles = Math.max(0, files.length - filesToScan.length);
+    if (files.length > filesToScan.length) {
+      recordIncompletePath(incompletePaths, canonicalRoot, canonicalRoot, "max_files");
+    }
+    const deadline = _internals64.now() + SCAN_TIME_BUDGET_MS;
+    await _internals64.yieldToEventLoop();
+    for (let index = 0;index < filesToScan.length; index++) {
+      if (_internals64.now() >= deadline) {
+        for (const remaining of filesToScan.slice(index)) {
+          const remainingPath = path77.isAbsolute(remaining) ? path77.resolve(remaining) : path77.resolve(rawRoot, remaining);
+          recordIncompletePath(incompletePaths, canonicalRoot, remainingPath, "deadline");
+        }
+        incompleteFiles += filesToScan.length - index;
+        break;
+      }
+      if (findings.length >= MAX_FINDINGS2) {
+        recordIncompletePath(incompletePaths, canonicalRoot, canonicalRoot, "truncated");
+        incompleteFiles += filesToScan.length - index;
+        break;
+      }
+      const file = filesToScan[index];
       if (typeof file !== "string") {
         skippedFiles++;
         continue;
       }
-      const resolvedPath = path77.isAbsolute(file) ? path77.resolve(file) : path77.resolve(directory, file);
-      if (!isPathWithinScope(resolvedPath, directory)) {
+      const resolvedPath = path77.isAbsolute(file) ? path77.resolve(file) : path77.resolve(rawRoot, file);
+      if (!isPathWithinScope(resolvedPath, rawRoot)) {
+        skippedFiles++;
+        incompleteFiles++;
+        recordIncompletePath(incompletePaths, canonicalRoot, resolvedPath, "scope_escape");
+        continue;
+      }
+      let lstat3;
+      try {
+        lstat3 = _internals64.lstatFile(resolvedPath);
+      } catch (error2) {
+        const err = error2;
+        if (err.code === "ENOENT") {
+          skippedFiles++;
+          continue;
+        }
+        skippedFiles++;
+        incompleteFiles++;
+        recordIncompletePath(incompletePaths, canonicalRoot, resolvedPath, "read_error");
+        continue;
+      }
+      if (lstat3.isSymbolicLink()) {
         skippedFiles++;
+        incompleteFiles++;
+        recordIncompletePath(incompletePaths, canonicalRoot, resolvedPath, "symlink");
+        continue;
+      }
+      if (!lstat3.isFile()) {
+        skippedFiles++;
+        incompleteFiles++;
+        recordIncompletePath(incompletePaths, canonicalRoot, resolvedPath, "non_file");
         continue;
       }
       const ext = path77.extname(resolvedPath).toLowerCase();
@@ -44072,16 +44372,47 @@ async function runSecretscanOnFiles(files, directory) {
         skippedFiles++;
         continue;
       }
-      if (!fs31.existsSync(resolvedPath)) {
+      let scanPath = resolvedPath;
+      try {
+        scanPath = fs31.realpathSync(resolvedPath);
+      } catch (error2) {
+        const err = error2;
+        if (err.code === "ENOENT") {
+          skippedFiles++;
+          continue;
+        }
         skippedFiles++;
+        incompleteFiles++;
+        recordIncompletePath(incompletePaths, canonicalRoot, resolvedPath, "read_error");
         continue;
       }
-      const fileFindings = scanFileForSecrets(resolvedPath);
-      filesScanned++;
-      findings.push(...fileFindings);
-      if (findings.length >= MAX_FINDINGS2) {
-        findings.length = MAX_FINDINGS2;
-        break;
+      if (!isPathWithinScope(scanPath, canonicalRoot)) {
+        skippedFiles++;
+        incompleteFiles++;
+        recordIncompletePath(incompletePaths, canonicalRoot, scanPath, "scope_escape");
+        continue;
+      }
+      const outcome = scanFileForSecrets(scanPath, "explicit");
+      switch (outcome.status) {
+        case "scanned":
+          filesScanned++;
+          findings.push(...outcome.findings);
+          if (findings.length > MAX_FINDINGS2)
+            findings.length = MAX_FINDINGS2;
+          break;
+        case "skipped":
+          skippedFiles++;
+          break;
+        case "incomplete":
+          skippedFiles++;
+          incompleteFiles++;
+          recordIncompletePath(incompletePaths, canonicalRoot, scanPath, outcome.reason);
+          break;
+        default:
+          assertNever(outcome);
+      }
+      if (index + 1 < filesToScan.length) {
+        await _internals64.yieldToEventLoop();
       }
     }
     findings.sort((a, b) => {
@@ -44096,7 +44427,9 @@ async function runSecretscanOnFiles(files, directory) {
       findings,
       count: findings.length,
       files_scanned: filesScanned,
-      skipped_files: skippedFiles
+      skipped_files: skippedFiles,
+      incomplete_files: incompleteFiles,
+      incomplete_paths: incompletePaths
     };
   } catch (e) {
     return {
@@ -44113,7 +44446,15 @@ var _internals64 = {
   secretscan,
   runSecretscan,
   runSecretscanOnFiles,
-  SECRET_PATTERNS: SECRET_PATTERNS2
+  SECRET_PATTERNS: SECRET_PATTERNS2,
+  now: Date.now,
+  yieldToEventLoop,
+  openFile: fs31.openSync,
+  fstatFile: fs31.fstatSync,
+  readFileChunk: fs31.readSync,
+  closeFile: fs31.closeSync,
+  lstatFile: fs31.lstatSync,
+  closeDirectory: (directory) => directory.closeSync()
 };
 
 // src/tools/test-runner.ts
@@ -45362,21 +45703,21 @@ function hasCompoundTestExtension(filename) {
   const lower = filename.toLowerCase();
   return COMPOUND_TEST_EXTENSIONS.some((ext) => lower.endsWith(ext));
 }
-function isLanguageSpecificTestFile(basename15) {
-  const lower = basename15.toLowerCase();
+function isLanguageSpecificTestFile(basename16) {
+  const lower = basename16.toLowerCase();
   if (lower.endsWith("_test.go"))
     return true;
   if (lower.endsWith(".py") && (lower.startsWith("test_") || lower.endsWith("_test.py")))
     return true;
   if (lower.endsWith("_spec.rb"))
     return true;
-  if (lower.endsWith(".java") && (/^Test[A-Z]/.test(basename15) || basename15.endsWith("Test.java") || basename15.endsWith("Tests.java") || lower.endsWith("it.java")))
+  if (lower.endsWith(".java") && (/^Test[A-Z]/.test(basename16) || basename16.endsWith("Test.java") || basename16.endsWith("Tests.java") || lower.endsWith("it.java")))
     return true;
   if (lower.endsWith(".cs") && (lower.endsWith("test.cs") || lower.endsWith("tests.cs")))
     return true;
-  if (lower.endsWith(".kt") && (/^Test[A-Z]/.test(basename15) || lower.endsWith("test.kt") || lower.endsWith("tests.kt")))
+  if (lower.endsWith(".kt") && (/^Test[A-Z]/.test(basename16) || lower.endsWith("test.kt") || lower.endsWith("tests.kt")))
     return true;
-  if (lower.endsWith(".php") && (/^Test[A-Z]/.test(basename15) || basename15.endsWith("Test.php") || basename15.endsWith("Tests.php")))
+  if (lower.endsWith(".php") && (/^Test[A-Z]/.test(basename16) || basename16.endsWith("Test.php") || basename16.endsWith("Tests.php")))
     return true;
   if (lower.endsWith(".tests.ps1"))
     return true;
@@ -45384,23 +45725,23 @@ function isLanguageSpecificTestFile(basename15) {
 }
 function isConventionTestFilePath(filePath) {
   const normalizedPath = filePath.replace(/\\/g, "/");
-  const basename15 = path81.basename(filePath);
-  return hasCompoundTestExtension(basename15) || basename15.includes(".spec.") || basename15.includes(".test.") || isLanguageSpecificTestFile(basename15) || isTestDirectoryPath(normalizedPath);
+  const basename16 = path81.basename(filePath);
+  return hasCompoundTestExtension(basename16) || basename16.includes(".spec.") || basename16.includes(".test.") || isLanguageSpecificTestFile(basename16) || isTestDirectoryPath(normalizedPath);
 }
 function getTestFilesFromConvention(sourceFiles, workingDir = process.cwd()) {
   const testFiles = [];
   for (const file of sourceFiles) {
     const absoluteFile = resolveWorkspacePath(file, workingDir);
     const relativeFile = path81.relative(workingDir, absoluteFile);
-    const basename15 = path81.basename(absoluteFile);
+    const basename16 = path81.basename(absoluteFile);
     const dirname30 = path81.dirname(absoluteFile);
     const preferRelativeOutput = !path81.isAbsolute(file);
     if (isConventionTestFilePath(relativeFile) || isConventionTestFilePath(file)) {
       dedupePush(testFiles, toWorkspaceOutputPath(absoluteFile, workingDir, preferRelativeOutput));
       continue;
     }
-    const nameWithoutExt = basename15.replace(/\.[^.]+$/, "");
-    const ext = path81.extname(basename15);
+    const nameWithoutExt = basename16.replace(/\.[^.]+$/, "");
+    const ext = path81.extname(basename16);
     const genericTestNames = [
       `${nameWithoutExt}.spec${ext}`,
       `${nameWithoutExt}.test${ext}`
@@ -45411,7 +45752,7 @@ function getTestFilesFromConvention(sourceFiles, workingDir = process.cwd()) {
       ...languageSpecificTestNames
     ].map((candidateName) => path81.join(dirname30, candidateName));
     const testDirectoryNames = [
-      basename15,
+      basename16,
       ...genericTestNames,
       ...languageSpecificTestNames
     ];
@@ -46782,6 +47123,13 @@ var DEFAULT_CONFIG = {
   testScope: "convention",
   linter: "biome"
 };
+function formatSecretscanIncompletePaths(incompletePaths, maxEntries = 3) {
+  const visible = incompletePaths.slice(0, maxEntries).map((entry) => {
+    return `${entry.path} (${entry.reason})`;
+  });
+  const suffix = incompletePaths.length > maxEntries ? ` (+${incompletePaths.length - maxEntries} more)` : "";
+  return `${visible.join("; ")}${suffix}`;
+}
 function validateDirectoryPath(dir) {
   if (!dir || typeof dir !== "string") {
     throw new Error("Directory path is required");
@@ -47045,28 +47393,72 @@ async function runTestsCheck(_dir, scope, timeoutMs) {
 async function runSecretsCheck(dir, timeoutMs) {
   const startTime = Date.now();
   try {
-    const secretsPromise = runSecretscan(dir);
+    const secretsPromise = _internals68.runSecretscan(dir);
     const timeoutPromise = new Promise((_, reject) => {
       setTimeout(() => {
         reject(new Error(`Secrets check timed out after ${timeoutMs}ms`));
       }, timeoutMs);
     });
-    const result = await Promise.race([
-      secretsPromise,
-      timeoutPromise
-    ]);
-    if (result.findings && result.findings.length > 0) {
+    const result = await Promise.race([secretsPromise, timeoutPromise]);
+    if ("error" in result) {
+      return {
+        type: "secrets",
+        status: "fail",
+        message: `Secrets check failed: ${result.error}`,
+        details: {
+          error: result.error,
+          filesScanned: result.files_scanned,
+          incompleteFiles: 0,
+          incompletePaths: []
+        },
+        durationMs: Date.now() - startTime
+      };
+    }
+    const findingsCount = Math.max(result.count, result.findings.length);
+    if (typeof result.incomplete_files !== "number" || !Array.isArray(result.incomplete_paths)) {
+      return {
+        type: "secrets",
+        status: "fail",
+        message: "Secrets check failed: scanner returned incomplete coverage metadata",
+        details: { filesScanned: result.files_scanned },
+        durationMs: Date.now() - startTime
+      };
+    }
+    const incompleteFiles = result.incomplete_files;
+    const incompletePaths = result.incomplete_paths;
+    const hasCountMismatch = result.count !== result.findings.length;
+    const hasIncompleteCoverage = incompleteFiles > 0 || incompletePaths.length > 0;
+    const hasZeroCoverage = result.files_scanned === 0;
+    const failures = [];
+    if (findingsCount > 0) {
       const critical = result.findings.filter((f) => f.severity === "critical").length;
       const high = result.findings.filter((f) => f.severity === "high").length;
+      failures.push(`Found ${findingsCount} secret(s): ${critical} critical, ${high} high`);
+    }
+    if (hasIncompleteCoverage) {
+      const incompleteSummary = incompletePaths.length > 0 ? `; incomplete paths: ${formatSecretscanIncompletePaths(incompletePaths)}` : "";
+      failures.push(`${incompleteFiles} incomplete file(s)${incompleteSummary}`);
+    }
+    if (hasCountMismatch) {
+      failures.push(`findings/count mismatch (reported ${result.count}, actual ${result.findings.length})`);
+    }
+    if (hasZeroCoverage) {
+      failures.push("zero requested files scanned");
+    }
+    if (failures.length > 0) {
       return {
         type: "secrets",
         status: "fail",
-        message: `Found ${result.findings.length} secret(s): ${critical} critical, ${high} high`,
+        message: `Secrets check failed: ${failures.join("; ")}`,
         details: {
-          count: result.count,
-          critical,
-          high,
-          filesScanned: result.files_scanned
+          count: findingsCount,
+          reportedCount: result.count,
+          critical: result.findings.filter((f) => f.severity === "critical").length,
+          high: result.findings.filter((f) => f.severity === "high").length,
+          filesScanned: result.files_scanned,
+          skippedFiles: result.skipped_files,
+          incompleteFiles,
+          incompletePaths
         },
         durationMs: Date.now() - startTime
       };
@@ -47076,7 +47468,10 @@ async function runSecretsCheck(dir, timeoutMs) {
       status: "pass",
       message: "No secrets detected",
       details: {
-        filesScanned: result.files_scanned
+        filesScanned: result.files_scanned,
+        skippedFiles: result.skipped_files,
+        incompleteFiles,
+        incompletePaths
       },
       durationMs: Date.now() - startTime
     };
@@ -47404,6 +47799,7 @@ var _internals68 = {
   runVersionCheck,
   runLintCheck,
   runTestsCheck,
+  runSecretscan,
   runSecretsCheck,
   runEvidenceCheck,
   runRequirementCoverageCheck
@@ -52403,7 +52799,7 @@ import {
   openSync as openSync12,
   readFileSync as readFileSync39,
   renameSync as renameSync18,
-  statSync as statSync16,
+  statSync as statSync15,
   unlinkSync as unlinkSync20,
   writeFileSync as writeFileSync17,
   writeFileSync as writeFileSyncAsync
@@ -52493,7 +52889,7 @@ var _internals78 = {
   renameSync: renameSync18,
   unlinkSync: unlinkSync20,
   existsSync: existsSync53,
-  statSync: statSync16
+  statSync: statSync15
 };
 async function appendEvent(directory, eventInput) {
   if (!isValidSkillSlug(eventInput.skillSlug)) {
@@ -55596,7 +55992,7 @@ function buildDetailedHelp(commandName, entry) {
 async function handleHelpCommand(ctx) {
   const targetCommand = ctx.args.join(" ");
   if (!targetCommand) {
-    const { buildHelpText } = await import("./index-ag7ppc40.js");
+    const { buildHelpText } = await import("./index-6f6nt0c9.js");
     return buildHelpText();
   }
   const tokens = targetCommand.split(/\s+/);
@@ -55605,7 +56001,7 @@ async function handleHelpCommand(ctx) {
     return _internals14.buildDetailedHelp(resolved.key, resolved.entry);
   }
   const similar = _internals14.findSimilarCommands(targetCommand);
-  const { buildHelpText: fullHelp } = await import("./index-ag7ppc40.js");
+  const { buildHelpText: fullHelp } = await import("./index-6f6nt0c9.js");
   if (similar.length > 0) {
     return `Command '/swarm ${targetCommand}' not found.
 
@@ -55782,7 +56178,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-ph1n3ryc.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-zs3hq02c.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -55792,7 +56188,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-ph1n3ryc.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-zs3hq02c.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -55802,7 +56198,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-log": {
     handler: async (ctx) => {
-      const { handleGuardrailLog } = await import("./guardrail-log-ghgqaw3w.js");
+      const { handleGuardrailLog } = await import("./guardrail-log-90dnv508.js");
       return handleGuardrailLog(ctx.directory, ctx.args);
     },
     description: "Read the guardrail decision log (use --blocks-only for blocks)",