opencode-swarm 7.138.2 → 7.138.4

package/.opencode/skills/execute/SKILL.md

@@ -12,6 +12,15 @@ This protocol is loaded on demand by the architect runtime. The architect prompt
 ### MODE: EXECUTE
 For each task (respecting dependencies):
 
+SCOPE SOURCE AND RECOVERY CONTRACT:
+- Resolve scope in this exact precedence: active `declare_scope` binding > plan task `files_touched` > complete one-path-per-line `FILE:` directives. Every present lower-precedence source must be a subset of the authoritative source; precedence never means silently ignoring disagreement.
+- Prefer the durable plan scope authored by `save_plan`. Before dispatch, copy that exact scope into both the delegation's `FILE:` lines and `declare_scope`; include generated outputs and lockfiles.
+- `SCOPE_CONFLICT`: read the diagnostic's named source sets, repair stale plan scope with `save_plan` and/or repair the `FILE:` lines, then call `declare_scope({ taskId, files: <reconciled exact list>, replace_existing: true, working_directory: <active lane root> })`. Do not widen scope just to make the sets agree.
+- `SCOPE_BINDING_EXPIRED` or `SCOPE_BINDING_AMBIGUOUS`: re-read the current task and call `declare_scope` with its intended exact files plus `replace_existing: true`, then retry the delegation once.
+- `SCOPE_WORKSPACE_MISMATCH`: use the diagnostic's active lane/worktree root as `working_directory`; all scope entries and `FILE:` lines remain project-relative to that root. Never reuse a parent/root-worktree binding in a child lane.
+- `SCOPE_ROOT_ESCAPE`: retry the intended operation relative to the active root only if the diagnostic identifies a safe relative path. Never add the outside absolute path to scope. If no safe relative path is supplied, stop and correct the command or lane root.
+- `SCOPE_NOT_DECLARED`: call `declare_scope` with `replace_existing: true` before retrying. A verifier-config or effective-authority denial is not repaired by redeclaration; change the task/role or request the appropriate reviewer-owned operation.
+
 RETRY PROTOCOL — when returning to coder after any gate failure:
 1. Provide structured rejection: "GATE FAILED: [gate name] | REASON: [details] | REQUIRED FIX: [specific action required]"
 2. Re-enter at step 5b (the active swarm's coder agent) with full failure context
@@ -32,7 +41,7 @@ WRONG responses to gate failure:
 
 RIGHT response to gate failure:
 ✓ Print "GATE FAILED: [gate name] | REASON: [details]"
-✓ BEFORE the retry delegation: call `declare_scope` with the file list the retry will touch. Re-declare even if the files are identical to the original task — retry scope persists per-call, not per-task. See Rule 1a.
+✓ BEFORE the retry delegation: call `declare_scope` with the file list the retry will touch and `replace_existing: true`. Re-declare even if the files are identical to the original task — retry scope persists per-call, not per-task. See Rule 1a.
 ✓ Delegate to the active swarm's coder agent with:
 TASK: Fix [gate name] failure
 FILE: [affected file(s)]
@@ -51,7 +60,7 @@ All other gates: failure → return to coder. No self-fixes. No workarounds.
 
 5a-bis. **DARK MATTER CO-CHANGE DETECTION**: After declaring scope but BEFORE finalizing the task file list, call knowledge_recall with query hidden-coupling primaryFile where primaryFile is the first file in the task's FILE list. Extract primaryFile from the task's FILE list (first file = primary). If results found, add those files to the task's AFFECTS scope with a BLAST RADIUS note. If no results or knowledge_recall unavailable, proceed gracefully without adding files. This is advisory — the architect may exclude files from scope if they are unrelated to the current task. Delegate to the active swarm's coder agent only after scope is declared.
 
-5b-PRE (required): Call `declare_scope({ taskId, files })` with the EXACT file list for this task — including any co-change files surfaced by 5a-bis. Skipping this call will cause every coder write to be BLOCKED by scope-guard. No `declare_scope` → no 5b delegation. See Rule 1a.
+5b-PRE (required): Call `declare_scope({ taskId, files, replace_existing: true })` with the EXACT file list for this task — including any co-change files surfaced by 5a-bis. Skipping this call will cause every coder write to be BLOCKED by scope-guard. No `declare_scope` → no 5b delegation. See Rule 1a.
     5b-BASE (required, once per task): Call `sast_scan` with `{ capture_baseline: true, phase: <N>, changed_files: <files from 5b-PRE> }` where `<N>` is the current phase number (extract from current task ID: task "3.2" → phase 3, task "1.5" → phase 1). The tool maintains `.swarm/evidence/{phase}/sast-baseline.json` as a phase-scoped, incrementally merged baseline of pre-existing SAST findings. Calling twice for the same files is safe (idempotent merge). Do NOT re-capture mid-task.
     → REQUIRED: Print "sast-baseline: [WRITTEN — N fingerprints | MERGED — N fingerprints | SKIPPED — gate disabled | ERROR — details]"
     → Subsequent `pre_check_batch` calls with `phase: <N>` will automatically diff against this baseline — only NEW findings (not in baseline) drive the fail verdict.

package/.opencode/skills/swarm-implement/SKILL.md

@@ -115,7 +115,7 @@ whether reviewer and critic passes are required.
 
 Implement in coherent, reviewable chunks. Follow existing repository patterns.
 
-**`declare_scope` discipline.** Before every coder or test-engineer delegation (and before every retry of one), call `declare_scope({ taskId, files })` with the exact file list the delegated agent is allowed to modify — including generated/lockfile paths the change will produce (e.g. `dist/*`, `package-lock.json`, `bun.lock`). Scope is enforced at the Edit/Write/Patch tool layer only — bash-based writes (`sed -i`, `echo >`, `cat > <<HEREDOC`, heredoc-to-file redirects) bypass the check (see issue #520), so do not rely on `declare_scope` to bound shell-redirect writes. If the file list is not 100% obvious from the prompt, declare the containing directories instead. Repeat the declaration before every retry, even when files appear unchanged — scope state is per-attempt, not per-task.
+**`declare_scope` discipline.** Before every coder or test-engineer delegation (and before every retry), call `declare_scope({ taskId, files, replace_existing: true })` with the exact workspace-relative file list the delegated agent may modify — including generated or lockfile paths the change will produce (for example, `dist/*`, `package-lock.json`, or `bun.lock`). Direct and shell writes are both scope-enforced. If the file list is not completely obvious, declare the containing workspace-relative directories instead. Treat `SCOPE_CONFLICT`, `SCOPE_BINDING_EXPIRED`, `SCOPE_BINDING_AMBIGUOUS`, and `SCOPE_WORKSPACE_MISMATCH` as architect-owned recovery signals: reconcile the named scope sources or lane root, replace the declaration, then redispatch. Never instruct the delegated agent to bypass the gate or switch write mechanisms.
 
 If the project exposes `sast_scan` with `capture_baseline`, capture the
 phase-scoped SAST baseline before first coder delegation so later scans fail only

package/.opencode/skills/swarm-pr-review/SKILL.md

@@ -1057,7 +1057,11 @@ the complete ledger with `write_pr_review_trigger_eval`; its rows use the stable
 trigger IDs below. Every `MATCHED` row includes its returned `source_batch_id`
 and `source_lane_id`; every `NOT_TRIGGERED` row must omit both fields. Missing,
 extra, duplicate, malformed, or incorrectly provenanced rows make persistence
-fail and Phase 4 BLOCKED. The tool atomically writes
+fail and Phase 4 BLOCKED. Evidence is frozen by the first micro dispatch and is
+authoritative thereafter. The final writer may omit its duplicate `evidence`
+fields; if it includes reworded evidence, the writer ignores that copy and
+persists the frozen values. It still requires the exact frozen classifications,
+plus provenance for every `MATCHED` row. The tool atomically writes
 `.swarm/pr-review/<run_id>/trigger-eval.json`, separate from `findings.jsonl`;
 pass the exact reviewed merge-base as `base_sha`, the exact live base branch
 tip/ref used to compute it as `base_ref`, and the same `pr_head_sha` to the

package/dist/background/pr-review-trigger-contract.d.ts

@@ -125,8 +125,44 @@ export declare const PrReviewPersistedInputRowSchema: z.ZodDiscriminatedUnion<[z
     result: z.ZodLiteral<"NOT_TRIGGERED">;
     evidence: z.ZodString;
 }, z.core.$strict>], "result">;
+export declare const PrReviewWriterInputRowSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    trigger_id: z.ZodEnum<{
+        "auth-identity-secrets": "auth-identity-secrets";
+        "untrusted-input-boundaries": "untrusted-input-boundaries";
+        "subprocess-platform": "subprocess-platform";
+        "concurrency-state": "concurrency-state";
+        "dependencies-build-release": "dependencies-build-release";
+        "api-schema-migrations": "api-schema-migrations";
+        "test-infrastructure": "test-infrastructure";
+        "ui-accessibility-i18n": "ui-accessibility-i18n";
+        "privacy-observability": "privacy-observability";
+        "generated-provenance": "generated-provenance";
+        "unclassified-risk": "unclassified-risk";
+    }>;
+    result: z.ZodLiteral<"MATCHED">;
+    evidence: z.ZodOptional<z.ZodString>;
+    source_batch_id: z.ZodString;
+    source_lane_id: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    trigger_id: z.ZodEnum<{
+        "auth-identity-secrets": "auth-identity-secrets";
+        "untrusted-input-boundaries": "untrusted-input-boundaries";
+        "subprocess-platform": "subprocess-platform";
+        "concurrency-state": "concurrency-state";
+        "dependencies-build-release": "dependencies-build-release";
+        "api-schema-migrations": "api-schema-migrations";
+        "test-infrastructure": "test-infrastructure";
+        "ui-accessibility-i18n": "ui-accessibility-i18n";
+        "privacy-observability": "privacy-observability";
+        "generated-provenance": "generated-provenance";
+        "unclassified-risk": "unclassified-risk";
+    }>;
+    result: z.ZodLiteral<"NOT_TRIGGERED">;
+    evidence: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>], "result">;
 export type PrReviewInlineTriggerRow = z.infer<typeof PrReviewInlineTriggerRowSchema>;
 export type PrReviewPersistedInputRow = z.infer<typeof PrReviewPersistedInputRowSchema>;
+export type PrReviewWriterInputRow = z.infer<typeof PrReviewWriterInputRowSchema>;
 interface ValidatedTriggerLedger<TRow> {
     rows: TRow[];
     matchedIds: PrReviewTriggerId[];
@@ -134,6 +170,7 @@ interface ValidatedTriggerLedger<TRow> {
 }
 export declare function validatePrReviewInlineTriggerLedger(input: unknown): ValidatedTriggerLedger<PrReviewInlineTriggerRow>;
 export declare function validatePrReviewPersistedInputLedger(input: unknown): ValidatedTriggerLedger<PrReviewPersistedInputRow>;
+export declare function validatePrReviewWriterInputLedger(input: unknown): ValidatedTriggerLedger<PrReviewWriterInputRow>;
 export interface BuildPrReviewTriggerReceiptV2Args {
     run_id: string;
     pr_head_sha: string;
@@ -184,7 +221,7 @@ export interface ParsedPrReviewTriggerReceipt {
     }>[];
 }
 /**
- * Bind every micro dispatch and the final receipt to one semantic ledger.
+ * Bind every micro dispatch to one semantic ledger at bind time.
  * Callers pass rows after exact-set validation; the tuple representation makes
  * the identity stable and independent of post-dispatch provenance fields.
  */

package/dist/cli/{config-doctor-hzb0bck9.js → config-doctor-31yppse4.js}

@@ -12,8 +12,8 @@ import {
   shouldRunOnStartup,
   writeBackupArtifact,
   writeDoctorArtifact
-} from "./index-da98750t.js";
-import"./index-exq36v6w.js";
+} from "./index-m8txs2a9.js";
+import"./index-5q009kc4.js";
 import"./index-bk5tah7q.js";
 import"./index-3jcyn8g6.js";
 import"./index-bpmtbmy9.js";

package/dist/cli/{core-v6bte964.js → core-65c7rvqf.js}

@@ -14,7 +14,7 @@ import {
   resolveWorktreeBaseDir,
   shortenWorktreePath,
   writeLaneProfileToDiskReal
-} from "./index-j0xx9wpj.js";
+} from "./index-y28n2wmq.js";
 import"./index-4rhhvd1a.js";
 import"./index-3jcyn8g6.js";
 import"./index-z6xqpmqg.js";

package/dist/cli/{curation-policy-aj37yvz8.js → curation-policy-hs9pc1rp.js}

@@ -4,9 +4,9 @@ import {
   authorizeCuration,
   buildConfigFingerprintInput,
   readCohortConfigFingerprint
-} from "./index-ze4we97d.js";
+} from "./index-m40ea3zk.js";
 import"./index-rtry5xyf.js";
-import"./index-r9pn41rj.js";
+import"./index-57stye65.js";
 import"./index-ae75rja9.js";
 import"./index-en4fb04r.js";
 import"./index-tqshdzaw.js";

package/dist/cli/{curator-jt6dza8y.js → curator-54n1y4j8.js}

@@ -14,46 +14,47 @@ import {
   runCuratorInit,
   runCuratorPhase,
   writeCuratorSummary
-} from "./index-89dwrz8n.js";
+} from "./index-a18hk2fw.js";
 import"./index-vm4xw9z3.js";
 import"./index-rrxcfxrd.js";
-import"./index-qt3jjjw9.js";
-import"./index-da98750t.js";
-import"./index-y06a43sk.js";
+import"./index-gm3pjfhb.js";
+import"./index-m8txs2a9.js";
+import"./index-mycqmsz5.js";
 import"./index-ngqxzkqm.js";
 import"./index-y8552snf.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
-import"./index-qg5smxv9.js";
-import"./index-xm07cqy2.js";
-import"./index-yxswbd1t.js";
+import"./index-jbge0dyh.js";
+import"./index-50mwt8fx.js";
+import"./index-c60whfgh.js";
 import"./index-6mjf4vr1.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
 import"./index-wsdnttf4.js";
 import"./index-39k6y018.js";
-import"./index-d01d4102.js";
-import"./index-ze4we97d.js";
+import"./index-tjwz5tct.js";
+import"./index-m40ea3zk.js";
 import"./index-rtry5xyf.js";
-import"./index-49ygvqvm.js";
-import"./index-r9pn41rj.js";
+import"./index-1g6xpjk3.js";
+import"./index-57stye65.js";
 import"./index-ae75rja9.js";
 import"./index-en4fb04r.js";
 import"./index-tqshdzaw.js";
-import"./index-k6cq9wwh.js";
+import"./index-m1pwkwfe.js";
 import"./index-gprxjmm7.js";
 import"./index-n832052r.js";
-import"./index-exq36v6w.js";
+import"./index-5q009kc4.js";
 import"./index-bk5tah7q.js";
 import"./index-8fwhhayc.js";
 import"./index-q1exe2b3.js";
 import"./index-z7jgvm9b.js";
-import"./index-2y4jy0de.js";
+import"./index-smsy2p8n.js";
+import"./index-556ja8an.js";
 import"./index-4fmztnrq.js";
 import"./index-1kz6da87.js";
 import"./index-x20cgr2q.js";
 import"./index-b8zgtz81.js";
-import"./index-j0xx9wpj.js";
+import"./index-y28n2wmq.js";
 import"./index-4rhhvd1a.js";
 import"./index-3jcyn8g6.js";
 import"./index-q344kj84.js";

package/dist/cli/{curator-llm-factory-m9f4h8t4.js → curator-llm-factory-wm27ra25.js}

@@ -1,46 +1,47 @@
 // @bun
 import {
   createCuratorLLMDelegate
-} from "./index-89dwrz8n.js";
+} from "./index-a18hk2fw.js";
 import"./index-vm4xw9z3.js";
 import"./index-rrxcfxrd.js";
-import"./index-qt3jjjw9.js";
-import"./index-da98750t.js";
-import"./index-y06a43sk.js";
+import"./index-gm3pjfhb.js";
+import"./index-m8txs2a9.js";
+import"./index-mycqmsz5.js";
 import"./index-ngqxzkqm.js";
 import"./index-y8552snf.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
-import"./index-qg5smxv9.js";
-import"./index-xm07cqy2.js";
-import"./index-yxswbd1t.js";
+import"./index-jbge0dyh.js";
+import"./index-50mwt8fx.js";
+import"./index-c60whfgh.js";
 import"./index-6mjf4vr1.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
 import"./index-wsdnttf4.js";
 import"./index-39k6y018.js";
-import"./index-d01d4102.js";
-import"./index-ze4we97d.js";
+import"./index-tjwz5tct.js";
+import"./index-m40ea3zk.js";
 import"./index-rtry5xyf.js";
-import"./index-49ygvqvm.js";
-import"./index-r9pn41rj.js";
+import"./index-1g6xpjk3.js";
+import"./index-57stye65.js";
 import"./index-ae75rja9.js";
 import"./index-en4fb04r.js";
 import"./index-tqshdzaw.js";
-import"./index-k6cq9wwh.js";
+import"./index-m1pwkwfe.js";
 import"./index-gprxjmm7.js";
 import"./index-n832052r.js";
-import"./index-exq36v6w.js";
+import"./index-5q009kc4.js";
 import"./index-bk5tah7q.js";
 import"./index-8fwhhayc.js";
 import"./index-q1exe2b3.js";
 import"./index-z7jgvm9b.js";
-import"./index-2y4jy0de.js";
+import"./index-smsy2p8n.js";
+import"./index-556ja8an.js";
 import"./index-4fmztnrq.js";
 import"./index-1kz6da87.js";
 import"./index-x20cgr2q.js";
 import"./index-b8zgtz81.js";
-import"./index-j0xx9wpj.js";
+import"./index-y28n2wmq.js";
 import"./index-4rhhvd1a.js";
 import"./index-3jcyn8g6.js";
 import"./index-q344kj84.js";

package/dist/cli/{evidence-summary-service-6cttrkzw.js → evidence-summary-service-hrxcf29a.js}

@@ -6,7 +6,7 @@ import {
   loadPlanJsonOnly,
   mergeDurableGateEntriesFromEvidence,
   readDurableGateEvidence
-} from "./index-y06a43sk.js";
+} from "./index-mycqmsz5.js";
 import"./index-ngqxzkqm.js";
 import"./index-y8552snf.js";
 import"./index-9ss2m4rs.js";

package/dist/cli/{guardrail-explain-rks41rpx.js → guardrail-explain-1729nse8.js}

@@ -1,47 +1,48 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-gpxg7wx8.js";
-import"./index-89dwrz8n.js";
+} from "./index-e1kgxchq.js";
+import"./index-a18hk2fw.js";
 import"./index-vm4xw9z3.js";
 import"./index-rrxcfxrd.js";
-import"./index-qt3jjjw9.js";
-import"./index-da98750t.js";
-import"./index-y06a43sk.js";
+import"./index-gm3pjfhb.js";
+import"./index-m8txs2a9.js";
+import"./index-mycqmsz5.js";
 import"./index-ngqxzkqm.js";
 import"./index-y8552snf.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
-import"./index-qg5smxv9.js";
-import"./index-xm07cqy2.js";
-import"./index-yxswbd1t.js";
+import"./index-jbge0dyh.js";
+import"./index-50mwt8fx.js";
+import"./index-c60whfgh.js";
 import"./index-6mjf4vr1.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
 import"./index-wsdnttf4.js";
 import"./index-39k6y018.js";
-import"./index-d01d4102.js";
-import"./index-ze4we97d.js";
+import"./index-tjwz5tct.js";
+import"./index-m40ea3zk.js";
 import"./index-rtry5xyf.js";
-import"./index-49ygvqvm.js";
-import"./index-r9pn41rj.js";
+import"./index-1g6xpjk3.js";
+import"./index-57stye65.js";
 import"./index-ae75rja9.js";
 import"./index-en4fb04r.js";
 import"./index-tqshdzaw.js";
-import"./index-k6cq9wwh.js";
+import"./index-m1pwkwfe.js";
 import"./index-gprxjmm7.js";
 import"./index-n832052r.js";
-import"./index-exq36v6w.js";
+import"./index-5q009kc4.js";
 import"./index-bk5tah7q.js";
 import"./index-8fwhhayc.js";
 import"./index-q1exe2b3.js";
 import"./index-z7jgvm9b.js";
-import"./index-2y4jy0de.js";
+import"./index-smsy2p8n.js";
+import"./index-556ja8an.js";
 import"./index-4fmztnrq.js";
 import"./index-1kz6da87.js";
 import"./index-x20cgr2q.js";
 import"./index-b8zgtz81.js";
-import"./index-j0xx9wpj.js";
+import"./index-y28n2wmq.js";
 import"./index-4rhhvd1a.js";
 import"./index-3jcyn8g6.js";
 import"./index-q344kj84.js";

package/dist/cli/{guardrail-log-h39jxftx.js → guardrail-log-yjj5srkw.js}

@@ -1,10 +1,11 @@
 // @bun
 import {
   handleGuardrailLog
-} from "./index-bakfqtye.js";
-import"./index-qt3jjjw9.js";
-import"./index-exq36v6w.js";
+} from "./index-33q2gmgd.js";
+import"./index-gm3pjfhb.js";
+import"./index-5q009kc4.js";
 import"./index-bk5tah7q.js";
+import"./index-556ja8an.js";
 import"./index-3jcyn8g6.js";
 import"./index-bpmtbmy9.js";
 import"./index-z6xqpmqg.js";

package/dist/cli/{hive-promoter-34y2x4vt.js → hive-promoter-es2x2b0e.js}

@@ -7,48 +7,49 @@ import {
   isHiveEligible,
   promoteFromSwarm,
   promoteToHive
-} from "./index-89dwrz8n.js";
+} from "./index-a18hk2fw.js";
 import"./index-vm4xw9z3.js";
 import"./index-rrxcfxrd.js";
-import"./index-qt3jjjw9.js";
-import"./index-da98750t.js";
-import"./index-y06a43sk.js";
+import"./index-gm3pjfhb.js";
+import"./index-m8txs2a9.js";
+import"./index-mycqmsz5.js";
 import"./index-ngqxzkqm.js";
 import"./index-y8552snf.js";
 import"./index-4905hd2m.js";
 import"./index-134d35c1.js";
-import"./index-qg5smxv9.js";
-import"./index-xm07cqy2.js";
-import"./index-yxswbd1t.js";
+import"./index-jbge0dyh.js";
+import"./index-50mwt8fx.js";
+import"./index-c60whfgh.js";
 import"./index-6mjf4vr1.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
 import"./index-wsdnttf4.js";
 import"./index-39k6y018.js";
-import"./index-d01d4102.js";
-import"./index-ze4we97d.js";
+import"./index-tjwz5tct.js";
+import"./index-m40ea3zk.js";
 import"./index-rtry5xyf.js";
 import {
   resolveHiveKnowledgePath
-} from "./index-49ygvqvm.js";
-import"./index-r9pn41rj.js";
+} from "./index-1g6xpjk3.js";
+import"./index-57stye65.js";
 import"./index-ae75rja9.js";
 import"./index-en4fb04r.js";
 import"./index-tqshdzaw.js";
-import"./index-k6cq9wwh.js";
+import"./index-m1pwkwfe.js";
 import"./index-gprxjmm7.js";
 import"./index-n832052r.js";
-import"./index-exq36v6w.js";
+import"./index-5q009kc4.js";
 import"./index-bk5tah7q.js";
 import"./index-8fwhhayc.js";
 import"./index-q1exe2b3.js";
 import"./index-z7jgvm9b.js";
-import"./index-2y4jy0de.js";
+import"./index-smsy2p8n.js";
+import"./index-556ja8an.js";
 import"./index-4fmztnrq.js";
 import"./index-1kz6da87.js";
 import"./index-x20cgr2q.js";
 import"./index-b8zgtz81.js";
-import"./index-j0xx9wpj.js";
+import"./index-y28n2wmq.js";
 import"./index-4rhhvd1a.js";
 import"./index-3jcyn8g6.js";
 import"./index-q344kj84.js";

package/dist/cli/{index-49ygvqvm.js → index-1g6xpjk3.js}

@@ -702,7 +702,7 @@ async function applyConfidenceFloorAction(directory, touched, options) {
   const recovered = touched.filter((e) => e.confidence > CONFIDENCE_FLOOR + FLOOR_EPSILON && e.confidence_floor_demoted);
   if (atFloor.length === 0 && recovered.length === 0)
     return;
-  const { readKnowledgeCounterRollups, effectiveRetrievalOutcomes } = await import("./knowledge-events-7neg8x0p.js");
+  const { readKnowledgeCounterRollups, effectiveRetrievalOutcomes } = await import("./knowledge-events-nnyn6hst.js");
   const rollups = await readKnowledgeCounterRollups(directory);
   const flagIds = new Set;
   for (const e of atFloor) {
@@ -769,11 +769,11 @@ async function applyConfidenceFloorAction(directory, touched, options) {
     });
   }
   if (action === "quarantine" && toQuarantine.length > 0) {
-    const { quarantineEntry } = await import("./knowledge-validator-q1qrdyvx.js");
-    const { KnowledgeConfigSchema } = await import("./schema-mtyaeh18.js");
+    const { quarantineEntry } = await import("./knowledge-validator-1v047gsa.js");
+    const { KnowledgeConfigSchema } = await import("./schema-fj32eyae.js");
     let config;
     try {
-      const { loadPluginConfigWithMeta } = await import("./index-8emf08eb.js");
+      const { loadPluginConfigWithMeta } = await import("./index-a9xny52r.js");
       const { config: loadedConfig } = loadPluginConfigWithMeta(directory);
       config = KnowledgeConfigSchema.parse(loadedConfig.knowledge ?? {});
     } catch {

package/dist/cli/{index-bakfqtye.js → index-33q2gmgd.js}

@@ -2,7 +2,7 @@
 import {
   redactPath,
   redactShellCommand
-} from "./index-qt3jjjw9.js";
+} from "./index-gm3pjfhb.js";
 
 // src/services/guardrail-log-service.ts
 import * as fs from "fs/promises";

package/dist/cli/{index-xm07cqy2.js → index-50mwt8fx.js}

@@ -6,13 +6,13 @@ import {
   resolveSwarmKnowledgePath,
   transactKnowledge,
   wordBigrams
-} from "./index-49ygvqvm.js";
+} from "./index-1g6xpjk3.js";
 import {
   countEntryContradictionsInWindow,
   countEntryViolationsInWindow,
   readKnowledgeEvents,
   recordKnowledgeEvent
-} from "./index-r9pn41rj.js";
+} from "./index-57stye65.js";
 import {
   init_knowledge_types,
   isActiveStatus
@@ -190,11 +190,11 @@ async function maybeQuarantineOnContradiction(directory, entryId, threshold, win
         alreadyInactive: true
       };
     }
-    const { quarantineEntry } = await import("./knowledge-validator-q1qrdyvx.js");
+    const { quarantineEntry } = await import("./knowledge-validator-1v047gsa.js");
     let policyConfig;
     try {
-      const { KnowledgeConfigSchema } = await import("./schema-mtyaeh18.js");
-      const { loadPluginConfigWithMeta } = await import("./index-8emf08eb.js");
+      const { KnowledgeConfigSchema } = await import("./schema-fj32eyae.js");
+      const { loadPluginConfigWithMeta } = await import("./index-a9xny52r.js");
       const { config: loadedConfig } = loadPluginConfigWithMeta(directory);
       policyConfig = KnowledgeConfigSchema.parse(loadedConfig.knowledge ?? {});
     } catch {

package/dist/cli/index-556ja8an.js

@@ -0,0 +1,62 @@
+// @bun
+// src/scope/path-identity.ts
+import * as path from "path";
+var BIDI_CONTROL_CHARACTERS = /[\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
+function isControlCharacter(character) {
+  const codePoint = character.codePointAt(0) ?? 0;
+  return codePoint <= 31 || codePoint >= 127 && codePoint <= 159;
+}
+function isBidiControlCharacter(character) {
+  return BIDI_CONTROL_CHARACTERS.test(character);
+}
+function getPathFlavor(pathLib = path) {
+  return pathLib.sep === "\\" ? "win32" : "posix";
+}
+function pathImplementation(flavor) {
+  return flavor === "win32" ? path.win32 : path.posix;
+}
+function normalizePathIdentity(value, flavor = getPathFlavor()) {
+  const pathImpl = pathImplementation(flavor);
+  const normalized = pathImpl.normalize(flavor === "win32" ? value.replace(/\//g, "\\") : value);
+  return flavor === "win32" ? normalized.toLowerCase() : normalized;
+}
+function pathIdentitiesEqual(a, b, flavor = getPathFlavor()) {
+  return normalizePathIdentity(a, flavor) === normalizePathIdentity(b, flavor);
+}
+function isPathIdentityWithin(target, container, flavor = getPathFlavor()) {
+  const pathImpl = pathImplementation(flavor);
+  const targetIdentity = normalizePathIdentity(target, flavor);
+  const containerIdentity = normalizePathIdentity(container, flavor);
+  if (targetIdentity === containerIdentity)
+    return true;
+  const relative = pathImpl.relative(containerIdentity, targetIdentity);
+  return relative.length > 0 && relative !== ".." && !relative.startsWith(`..${pathImpl.sep}`) && !pathImpl.isAbsolute(relative);
+}
+function isPathWithinDeclaredScope(filePath, scopeEntries, cwd = process.cwd(), flavor = getPathFlavor()) {
+  const pathImpl = pathImplementation(flavor);
+  const resolvedFile = pathImpl.resolve(cwd, filePath);
+  return scopeEntries.some((scope) => isPathIdentityWithin(resolvedFile, pathImpl.resolve(cwd, scope), flavor));
+}
+function isOnDifferentPathRoot(target, cwd, flavor = getPathFlavor()) {
+  const pathImpl = pathImplementation(flavor);
+  const targetRoot = pathImpl.parse(pathImpl.normalize(target)).root;
+  const cwdRoot = pathImpl.parse(pathImpl.normalize(cwd)).root;
+  return !pathIdentitiesEqual(targetRoot, cwdRoot, flavor);
+}
+function unsafePathTextReason(value) {
+  if ([...value].some(isControlCharacter)) {
+    return "control characters are not allowed in paths";
+  }
+  if ([...value].some(isBidiControlCharacter)) {
+    return "bidirectional control characters are not allowed in paths";
+  }
+  return null;
+}
+function sanitizeDiagnosticText(value, maxLength = 256) {
+  const rendered = String(value).split("").map((character) => isControlCharacter(character) || isBidiControlCharacter(character) ? "?" : character).join("").replace(/\s+/gu, " ").trim();
+  if (rendered.length <= maxLength)
+    return rendered;
+  return `${rendered.slice(0, Math.max(0, maxLength - 1))}\u2026`;
+}
+
+export { getPathFlavor, pathIdentitiesEqual, isPathIdentityWithin, isPathWithinDeclaredScope, isOnDifferentPathRoot, unsafePathTextReason, sanitizeDiagnosticText };

package/dist/cli/{index-r9pn41rj.js → index-57stye65.js}

@@ -625,7 +625,7 @@ async function applyKnowledgeVerdictFeedback(directory, options) {
       deltas.push({ id, delta });
     }
     if (deltas.length > 0) {
-      const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-a6d4625r.js");
+      const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-x4yfc7v3.js");
       await bumpKnowledgeConfidenceBatch(directory, deltas, options?.floorOptions);
     }
     return {

package/dist/cli/{index-exq36v6w.js → index-5q009kc4.js}

@@ -21,7 +21,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "opencode-swarm",
-    version: "7.138.2",
+    version: "7.138.4",
     description: "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
     main: "dist/index.js",
     types: "dist/index.d.ts",