opencode-swarm 7.138.3 → 7.138.4

package/dist/cli/{index-99af5gvd.js → index-a18hk2fw.js}

@@ -16,13 +16,13 @@ import {
 } from "./index-rrxcfxrd.js";
 import {
   stableCanonicalStringify
-} from "./index-31vfewmn.js";
+} from "./index-gm3pjfhb.js";
 import {
   detectStraySwarmDirs,
   readDoctorArtifact,
   removeStraySwarmDir,
   runConfigDoctor
-} from "./index-btx8j39p.js";
+} from "./index-m8txs2a9.js";
 import {
   MAX_TRANSIENT_RETRIES,
   archiveEvidence,
@@ -59,7 +59,7 @@ import {
   savePlan,
   transientBackoff,
   validateProjectRoot
-} from "./index-y06a43sk.js";
+} from "./index-mycqmsz5.js";
 import {
   EvaluationTaskV1Schema,
   GateAuditManifestV1Schema,
@@ -114,15 +114,15 @@ import {
   retireSkill,
   selectCandidateEntries,
   syncBundledProjectSkillsIfMissingAsync
-} from "./index-jhb8kjc5.js";
+} from "./index-jbge0dyh.js";
 import {
   readRecentEscalations
-} from "./index-adde7nm2.js";
+} from "./index-50mwt8fx.js";
 import {
   alreadyCuratedThisGeneration,
   claimNextScanBatch,
   resolveCohortId
-} from "./index-rjratees.js";
+} from "./index-c60whfgh.js";
 import {
   CURATOR_INIT_PROMPT,
   CURATOR_PHASE_PROMPT,
@@ -175,11 +175,11 @@ import {
   validateActionableFields,
   validateLesson,
   validateSkillPath
-} from "./index-tc61fybd.js";
+} from "./index-tjwz5tct.js";
 import {
   authorizeCuration,
   buildConfigFingerprintInput
-} from "./index-wqg74mwj.js";
+} from "./index-m40ea3zk.js";
 import {
   cohortConfigFingerprint
 } from "./index-rtry5xyf.js";
@@ -212,7 +212,7 @@ import {
   transactFile,
   transactKnowledge,
   wordBigrams
-} from "./index-1djv5684.js";
+} from "./index-1g6xpjk3.js";
 import {
   MAX_EVENT_LOG_ENTRIES,
   _internals,
@@ -222,7 +222,7 @@ import {
   recordHiveKnowledgeEvent,
   recordKnowledgeEvent,
   resolveKnowledgeEventsPath
-} from "./index-93ky909v.js";
+} from "./index-57stye65.js";
 import {
   resolveHiveDataDir,
   resolveHiveEventsPath,
@@ -247,7 +247,7 @@ import {
   init_loader,
   loadPluginConfig,
   loadPluginConfigWithMeta
-} from "./index-y6dvs5tt.js";
+} from "./index-m1pwkwfe.js";
 import {
   RetrospectiveEvidenceSchema
 } from "./index-gprxjmm7.js";
@@ -263,7 +263,7 @@ import {
   package_default,
   resolveAutoReviewConfig,
   stripKnownSwarmPrefix
-} from "./index-ab57h0yq.js";
+} from "./index-5q009kc4.js";
 import {
   KNOWLEDGE_SCHEMA_VERSION,
   OUTCOME_BLOCK_THRESHOLD,
@@ -285,7 +285,7 @@ import {
   clearAllScopes,
   clearScopeBindingFromDisk,
   clearScopeBindings
-} from "./index-2y4jy0de.js";
+} from "./index-smsy2p8n.js";
 import {
   appendLedgerEvent,
   computePlanHash,
@@ -5714,8 +5714,7 @@ function resetSwarmState() {
   for (const binding of clearScopeBindings()) {
     clearScopeBindingFromDisk({
       directory: binding.workspaceIdentity,
-      taskId: binding.taskId,
-      ownerSessionId: binding.ownerSessionId
+      binding
     });
   }
   resetStandardWorktreeIsolationState();
@@ -5907,8 +5906,7 @@ function endAgentSession(sessionId) {
   for (const binding of removedBindings) {
     clearScopeBindingFromDisk({
       directory: binding.workspaceIdentity,
-      taskId: binding.taskId,
-      ownerSessionId: binding.ownerSessionId
+      binding
     });
   }
   swarmState.agentSessions.delete(sessionId);
@@ -11396,6 +11394,14 @@ async function buildRetrievalRecency(provider, nowMs) {
 // src/hooks/guardrails/index.ts
 init_constants();
 init_schema();
+init_executor();
+
+// src/scope/scope-lease-renewal.ts
+var MAX_HASH_BYTES = 4 * 1024 * 1024;
+var MAX_AGGREGATE_HASH_BYTES = 8 * 1024 * 1024;
+var CANDIDATE_TTL_MS = 10 * 60 * 1000;
+
+// src/hooks/guardrails/index.ts
 init_logger();
 
 // src/utils/provider-error-classification.ts
@@ -11497,7 +11503,6 @@ import * as path17 from "path";
 var DC_MAX_UNWRAP_DEPTH = 5;
 var DC_SAFE_TARGETS = new Set([
   "node_modules",
-  ".git",
   "dist",
   "build",
   "coverage",
@@ -11662,6 +11667,30 @@ function dcSplitSegments(cmd) {
     segments.push(current.trim());
   return segments.filter((s) => s.length > 0);
 }
+function dcExtractRecursiveRmTargets(segment) {
+  const tokens = segment.match(/"(?:[^"\\]|\\.)*"|'[^']*'|\S+/g) ?? [];
+  if (tokens.length < 2 || tokens[0] !== "rm")
+    return null;
+  let destructive = false;
+  let index = 1;
+  for (;index < tokens.length; index++) {
+    const token = tokens[index];
+    if (token === "--") {
+      index++;
+      break;
+    }
+    if (!token.startsWith("-") || token === "-")
+      break;
+    if (token === "--recursive" || token === "--force")
+      destructive = true;
+    if (!token.startsWith("--") && /[rRfF]/.test(token.slice(1))) {
+      destructive = true;
+    }
+  }
+  if (!destructive)
+    return null;
+  return tokens.slice(index).map((target) => target.replace(/^(["'])|(["'])$/g, ""));
+}
 function dcHasUnresolvableVars(p) {
   return /(%[A-Za-z_][A-Za-z0-9_]*%|\$\{?[A-Za-z_]|\$env:)/i.test(p);
 }
@@ -11674,13 +11703,15 @@ function dcLstatAncestorWalk(targetPath, cwd) {
   const ancestors = [];
   let current = normalizedTarget;
   while (true) {
+    const rel = path17.relative(normalizedCwd, current);
+    if (rel === ".." || rel.startsWith(`..${path17.sep}`) || path17.isAbsolute(rel))
+      break;
     ancestors.push(current);
+    if (rel === "")
+      break;
     const parent = path17.dirname(current);
     if (parent === current)
       break;
-    const rel = path17.relative(normalizedCwd, current);
-    if (rel === "" || rel.startsWith(".."))
-      break;
     current = parent;
   }
   for (const ancestor of ancestors) {
@@ -11690,7 +11721,7 @@ function dcLstatAncestorWalk(targetPath, cwd) {
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
-        break;
+        continue;
       }
       return `lstat failed on "${ancestor}": ${String(err)} \u2014 refusing to allow destructive operation on unverifiable path`;
     }
@@ -11714,11 +11745,12 @@ function dcValidateTargets(targets, cwd) {
     if (/^\\\\/.test(t)) {
       return `BLOCKED: Destructive command targets UNC path "${t}" \u2014 UNC paths in destructive operations are not allowed.`;
     }
-    const lstatBlock = dcLstatAncestorWalk(t, cwd);
+    const filesystemTarget = t.replace(/[\\/]+/g, path17.sep);
+    const lstatBlock = dcLstatAncestorWalk(filesystemTarget, cwd);
     if (lstatBlock)
       return lstatBlock;
-    const basename3 = path17.basename(t);
-    if (t === basename3 && DC_SAFE_TARGETS.has(t)) {
+    const basename3 = path17.basename(filesystemTarget);
+    if (dcPathComponents(t).length === 1 && DC_SAFE_TARGETS.has(basename3)) {
       continue;
     }
     if (DC_FS_ROOTS.has(t) || DC_FS_ROOTS.has(t.replace(/\//g, "\\"))) {
@@ -11734,6 +11766,111 @@ function dcValidateTargets(targets, cwd) {
   }
   return null;
 }
+function dcIsUntrustedCodePoint(codePoint) {
+  return codePoint <= 31 || codePoint >= 127 && codePoint <= 159 || codePoint >= 8234 && codePoint <= 8238 || codePoint >= 8294 && codePoint <= 8297;
+}
+function dcHasUntrustedText(value) {
+  return Array.from(value).some((character) => dcIsUntrustedCodePoint(character.codePointAt(0) ?? 0));
+}
+function dcSafeDiagnosticValue(value) {
+  return value.split("").map((character) => dcIsUntrustedCodePoint(character.codePointAt(0) ?? 0) ? "?" : character).join("").slice(0, 512);
+}
+function dcPathComponents(value) {
+  return value.replace(/\\/g, "/").split("/").filter(Boolean);
+}
+function dcComponentEquals(left, right) {
+  return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
+function dcScopeContains(scopeEntry, target) {
+  const normalize3 = (value) => {
+    const normalized = path17.posix.normalize(value.replace(/\\/g, "/")).replace(/^\.\//, "").replace(/\/$/, "");
+    return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+  };
+  const scope = normalize3(scopeEntry);
+  const candidate = normalize3(target);
+  return candidate === scope || candidate.startsWith(`${scope}/`);
+}
+function dcEvaluateRecursiveDeleteTargets(input) {
+  if (input.targets.length === 0) {
+    return {
+      allowed: false,
+      code: "DESTRUCTIVE_TARGET_INVALID",
+      reason: "BLOCKED: Recursive delete has no statically verifiable target."
+    };
+  }
+  const commonBlock = dcValidateTargets(input.targets, input.cwd);
+  if (commonBlock) {
+    return {
+      allowed: false,
+      code: "DESTRUCTIVE_TARGET_INVALID",
+      reason: commonBlock
+    };
+  }
+  const normalizedTargets = [];
+  let hasNested = false;
+  for (const raw of input.targets) {
+    const target = raw.trim().replace(/^['"]|['"]$/g, "");
+    const safeTarget = dcSafeDiagnosticValue(target);
+    if (!target || target === "." || dcHasUntrustedText(target) || dcPathComponents(target).includes("..")) {
+      return {
+        allowed: false,
+        code: "DESTRUCTIVE_TARGET_INVALID",
+        reason: `BLOCKED: Recursive delete target "${safeTarget}" is empty, the workspace root, contains traversal, or contains control characters.`
+      };
+    }
+    const components = dcPathComponents(target);
+    if (components.some((component) => dcComponentEquals(component, ".git") || dcComponentEquals(component, ".swarm"))) {
+      return {
+        allowed: false,
+        code: "DESTRUCTIVE_TARGET_PROTECTED",
+        reason: `BLOCKED: Recursive delete target "${safeTarget}" contains protected .git or .swarm state.`
+      };
+    }
+    const filesystemTarget = target.replace(/[\\/]+/g, path17.sep);
+    const resolved = path17.resolve(input.cwd, filesystemTarget);
+    const relative3 = path17.relative(path17.resolve(input.cwd), resolved);
+    if (relative3 === "" || relative3 === ".." || relative3.startsWith(`..${path17.sep}`) || path17.isAbsolute(relative3)) {
+      return {
+        allowed: false,
+        code: "DESTRUCTIVE_TARGET_OUTSIDE_WORKSPACE",
+        reason: `BLOCKED: Recursive delete target "${safeTarget}" is not strictly contained by the workspace.`
+      };
+    }
+    const basename3 = path17.basename(resolved);
+    if (!DC_SAFE_TARGETS.has(basename3)) {
+      return {
+        allowed: false,
+        code: "DESTRUCTIVE_TARGET_NOT_SAFE_ARTIFACT",
+        reason: `BLOCKED: Recursive delete target "${safeTarget}" is not an allowlisted build/cache artifact.`
+      };
+    }
+    const normalizedRelative = relative3.replace(/\\/g, "/");
+    const isBare = components.length === 1;
+    if (!isBare) {
+      hasNested = true;
+      if (!input.verifiedScope?.bindingId || !input.verifiedScope.generationId) {
+        return {
+          allowed: false,
+          code: "DESTRUCTIVE_TARGET_SCOPE_REQUIRED",
+          reason: `BLOCKED: Nested safe artifact "${safeTarget}" requires a verified active coder scope binding.`
+        };
+      }
+      if (!input.verifiedScope.files.some((entry) => dcScopeContains(entry, normalizedRelative))) {
+        return {
+          allowed: false,
+          code: "DESTRUCTIVE_TARGET_OUT_OF_SCOPE",
+          reason: `BLOCKED: Nested safe artifact "${safeTarget}" is outside the verified active coder scope.`
+        };
+      }
+    }
+    normalizedTargets.push(normalizedRelative);
+  }
+  return {
+    allowed: true,
+    kind: hasNested ? "scoped-nested-safe-artifact" : "bare-safe-artifact",
+    targets: normalizedTargets
+  };
+}
 function dcCheckJunctionCreation(segment, cwd) {
   const mklinkMatch = /^mklink(?:\.exe)?\s+\/[JjDd]\s+"?([^"\s]+)"?\s+"?([^"\s]+)"?/i.exec(segment);
   if (mklinkMatch) {
@@ -13148,7 +13285,6 @@ function classifySwarmCommandChatFallbackUse(resolved) {
 // src/hooks/guardrails/tool-before.ts
 init_constants();
 init_schema();
-init_executor();
 
 // src/hooks/shell-write-detect.ts
 import * as path19 from "path";
@@ -18881,7 +19017,7 @@ function planMerges(active, threshold, maxComparisons, maxMerges) {
   };
 }
 async function sweepActiveNearDuplicates(directory, options = {}) {
-  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-1v89yst3.js");
+  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-a9xny52r.js");
   const { config } = loadPluginConfigWithMeta2(directory);
   const sweepConfig = config.learning?.dedup_sweep;
   if (sweepConfig?.enabled === false)
@@ -20474,7 +20610,7 @@ async function runCuratorPhase(directory, phase, agentsDispatched, config, knowl
     }
     if (config.skill_generation_enabled === true && skillCandidates.length > 0) {
       try {
-        const skillModule = await import("./skill-generator-arvwfdfh.js");
+        const skillModule = await import("./skill-generator-rt0jqcsa.js");
         for (const cand of skillCandidates) {
           if (cand.confidence < (config.min_skill_confidence ?? DEFAULT_SKILL_MIN_CONFIDENCE)) {
             continue;
@@ -20934,7 +21070,7 @@ async function applyCuratorKnowledgeUpdates(directory, recommendations, knowledg
     } catch {}
   }
   if (contradictedEntries.length > 0 && knowledgeConfig.contradiction_threshold_action === "quarantine") {
-    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-7n384ys1.js");
+    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-s6z1x65b.js");
     for (const { id } of contradictedEntries) {
       try {
         await maybeQuarantineOnContradiction(directory, id, knowledgeConfig.contradiction_quarantine_threshold, knowledgeConfig.contradiction_quarantine_window_days);
@@ -21753,7 +21889,7 @@ async function runCuratorPostMortem(directory, options = {}) {
       warnings.push("Failed to collect knowledge summary.");
     }
     try {
-      const { getScanStatus } = await import("./scan-cursor-9y9msabt.js");
+      const { getScanStatus } = await import("./scan-cursor-jxajj6s7.js");
       const scanStatus = await getScanStatus(directory);
       if (scanStatus.remaining_estimate > 0) {
         warnings.push(`Fair scan: reviewed ${knowledgeSummary.length} entries this sweep (generation ${scanStatus.generation}); ${scanStatus.remaining_estimate} more eligible entries will be visited in future curation sweeps.`);
@@ -21925,9 +22061,9 @@ var _internals24 = {
   verifyPostMortemKnowledgeActions,
   repairPostMortemActions,
   loadDefaultKnowledgeConfig: async (directory) => {
-    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-xg5f11md.js");
+    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-fj32eyae.js");
     try {
-      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-1v89yst3.js");
+      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-a9xny52r.js");
       const loaded = loadPluginConfigWithMeta2(directory);
       return KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
     } catch {
@@ -21935,11 +22071,11 @@ var _internals24 = {
     }
   },
   applyCuratorKnowledgeUpdates: async (directory, recommendations, knowledgeConfig, generation) => {
-    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-jjtp9hn2.js");
+    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-54n1y4j8.js");
     return applyCuratorKnowledgeUpdates2(directory, recommendations, knowledgeConfig, generation);
   },
   checkHivePromotions: async (entries, knowledgeConfig, directory) => {
-    const { checkHivePromotions } = await import("./hive-promoter-xvq8jzbs.js");
+    const { checkHivePromotions } = await import("./hive-promoter-es2x2b0e.js");
     return checkHivePromotions(entries, knowledgeConfig, directory);
   },
   applyProposalTriage: async (directory, triage) => {
@@ -21948,7 +22084,7 @@ var _internals24 = {
       activateProposal,
       listSkills: listSkills2,
       sanitizeSlug
-    } = await import("./skill-generator-arvwfdfh.js");
+    } = await import("./skill-generator-rt0jqcsa.js");
     const result = {
       approved: [],
       rejected: [],
@@ -24575,9 +24711,9 @@ function hashContent(content) {
   return createHash9("sha1").update(content).digest("hex");
 }
 async function loadConfigForPolicyCurator(directory) {
-  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-xg5f11md.js");
+  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-fj32eyae.js");
   try {
-    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-1v89yst3.js");
+    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-a9xny52r.js");
     const { config: loadedConfig } = loadPluginConfigWithMeta2(directory);
     return KnowledgeConfigSchema2.parse(loadedConfig.knowledge ?? {});
   } catch {
@@ -27849,8 +27985,8 @@ function safeRemoveTemp(tempPath) {
   } catch {}
 }
 function buildVacuumIntoSql(destPath) {
-  const posix5 = destPath.replace(/\\/g, "/");
-  const escaped = posix5.replace(/'/g, "''");
+  const posix6 = destPath.replace(/\\/g, "/");
+  const escaped = posix6.replace(/'/g, "''");
   return `VACUUM INTO '${escaped}'`;
 }
 function rowString(row, col) {
@@ -28537,7 +28673,7 @@ async function runFinalizeStage(ctx) {
     }
   }
   try {
-    const { CuratorConfigSchema: CCS } = await import("./schema-xg5f11md.js");
+    const { CuratorConfigSchema: CCS } = await import("./schema-fj32eyae.js");
     const { config: pmLoadedConfig } = _internals36.loadPluginConfigWithMeta(ctx.directory);
     const curatorCfg = CCS.parse(pmLoadedConfig.curator ?? {});
     if (curatorCfg.enabled && curatorCfg.postmortem_enabled) {
@@ -30808,9 +30944,9 @@ var _internals41 = {
   loadPluginConfigWithMeta,
   loadCuratorDeps: async () => {
     const [{ CuratorConfigSchema }, curator, { createCuratorLLMDelegate: createCuratorLLMDelegate2 }] = await Promise.all([
-      import("./schema-xg5f11md.js"),
-      import("./curator-jjtp9hn2.js"),
-      import("./curator-llm-factory-wkjme59b.js")
+      import("./schema-fj32eyae.js"),
+      import("./curator-54n1y4j8.js"),
+      import("./curator-llm-factory-wm27ra25.js")
     ]);
     return { CuratorConfigSchema, curator, createCuratorLLMDelegate: createCuratorLLMDelegate2 };
   }
@@ -31715,7 +31851,7 @@ async function computeCurationDiagnostics(directory, entries) {
   let scanCompleted = false;
   let scanRemaining = 0;
   try {
-    const { getScanStatus } = await import("./scan-cursor-9y9msabt.js");
+    const { getScanStatus } = await import("./scan-cursor-jxajj6s7.js");
     const status = await getScanStatus(directory);
     scanGeneration = status.generation;
     scanCompleted = status.completed;
@@ -31725,17 +31861,17 @@ async function computeCurationDiagnostics(directory, entries) {
   try {
     const { isLinked: isLinked2 } = await import("./knowledge-link-xc6yhxmz.js");
     if (isLinked2(directory)) {
-      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-xg5f11md.js");
+      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-fj32eyae.js");
       let config;
       try {
-        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-1v89yst3.js");
+        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-a9xny52r.js");
         const loaded = loadPluginConfigWithMeta2(directory);
         config = KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
       } catch {
         config = KnowledgeConfigSchema2.parse({});
       }
       const { cohortConfigFingerprint: cohortConfigFingerprint2 } = await import("./config-fingerprint-v22xh5a2.js");
-      const { buildConfigFingerprintInput: buildConfigFingerprintInput2, readCohortConfigFingerprint } = await import("./curation-policy-5dqexw5j.js");
+      const { buildConfigFingerprintInput: buildConfigFingerprintInput2, readCohortConfigFingerprint } = await import("./curation-policy-hs9pc1rp.js");
       const currentFp = cohortConfigFingerprint2(buildConfigFingerprintInput2(config));
       const cohortFp = await readCohortConfigFingerprint(directory);
       configMatch = cohortFp === null ? null : currentFp === cohortFp;
@@ -32946,7 +33082,7 @@ async function handleDoctorCommand(directory, args) {
   const result = runConfigDoctor(config, directory);
   let output;
   if (enableAutoFix && result.hasAutoFixableIssues) {
-    const { runConfigDoctorWithFixes } = await import("./config-doctor-2mwgdbsn.js");
+    const { runConfigDoctorWithFixes } = await import("./config-doctor-31yppse4.js");
     const fixResult = await runConfigDoctorWithFixes(directory, config, true, {
       applyLossy: true
     });
@@ -33783,7 +33919,7 @@ async function handleEvidenceCommand(directory, args) {
   return formatTaskEvidenceMarkdown(evidenceData);
 }
 async function handleEvidenceSummaryCommand(directory) {
-  const { buildEvidenceSummary } = await import("./evidence-summary-service-6cttrkzw.js");
+  const { buildEvidenceSummary } = await import("./evidence-summary-service-hrxcf29a.js");
   const artifact = await buildEvidenceSummary(directory);
   if (!artifact) {
     return "No plan found. Run `/swarm plan` to check plan status.";
@@ -56089,7 +56225,7 @@ function buildDetailedHelp(commandName, entry) {
 async function handleHelpCommand(ctx) {
   const targetCommand = ctx.args.join(" ");
   if (!targetCommand) {
-    const { buildHelpText } = await import("./index-xgmx9had.js");
+    const { buildHelpText } = await import("./index-k27a4e5g.js");
     return buildHelpText();
   }
   const tokens = targetCommand.split(/\s+/);
@@ -56098,7 +56234,7 @@ async function handleHelpCommand(ctx) {
     return _internals14.buildDetailedHelp(resolved.key, resolved.entry);
   }
   const similar = _internals14.findSimilarCommands(targetCommand);
-  const { buildHelpText: fullHelp } = await import("./index-xgmx9had.js");
+  const { buildHelpText: fullHelp } = await import("./index-k27a4e5g.js");
   if (similar.length > 0) {
     return `Command '/swarm ${targetCommand}' not found.
 
@@ -56275,7 +56411,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-xppwfnxr.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-1729nse8.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -56285,7 +56421,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-xppwfnxr.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-1729nse8.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -56295,7 +56431,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-log": {
     handler: async (ctx) => {
-      const { handleGuardrailLog } = await import("./guardrail-log-swet7rch.js");
+      const { handleGuardrailLog } = await import("./guardrail-log-yjj5srkw.js");
       return handleGuardrailLog(ctx.directory, ctx.args);
     },
     description: "Read the guardrail decision log (use --blocks-only for blocks)",
@@ -57430,12 +57566,16 @@ CODER'S TOOLS: write, edit, patch, apply_patch, swarm_apply_patch, create_file,
 If a tool modifies a file, it is a CODER tool. Delegate.
 <!-- BEHAVIORAL_GUIDANCE_START -->
 1a. SCOPE DISCIPLINE \u2014 call declare_scope BEFORE every coder delegation AND before any test_engineer delegation that will write new test files.
-  - Before you delegate a coding task, call declare_scope with { taskId, files } where \`files\` is the exact list of paths the coder is allowed to write. Bundle any generated/lockfile paths that the change will produce (e.g. package-lock.json, Cargo.lock, dist/*).
-  - Before you delegate to test_engineer with an instruction to CREATE or MODIFY test files, call declare_scope with { taskId, files } listing the exact test file path(s) (e.g. src/auth/login.test.ts, tests/unit/foo.spec.ts) the test_engineer is expected to write.
-  - If coder or test_engineer returns "WRITE BLOCKED" for a path outside the declared list: call declare_scope again with the missing path added. Do NOT instruct the coder to use bash, sed, echo, cat, tee, dd, or any interpreter eval (python -c, node -e, bun -e, ruby -e) to bypass the block. Alternate mechanisms cannot create write authority and violate scope discipline.
+  - Before you delegate a coding task, call declare_scope with { taskId, files, replace_existing: true } where \`files\` is the exact list of paths the coder is allowed to write. Bundle any generated/lockfile paths that the change will produce (e.g. package-lock.json, Cargo.lock, dist/*). Replacement is safe for the first declaration and required for every retry/re-dispatch.
+  - Before you delegate to test_engineer with an instruction to CREATE or MODIFY test files, call declare_scope with { taskId, files, replace_existing: true } listing the exact test file path(s) (e.g. src/auth/login.test.ts, tests/unit/foo.spec.ts) the test_engineer is expected to write.
+  - If coder or test_engineer returns "WRITE BLOCKED" for a path outside the declared list: call declare_scope again with the missing path added and \`replace_existing: true\`. Do NOT instruct the coder to use bash, sed, echo, cat, tee, dd, or any interpreter eval (python -c, node -e, bun -e, ruby -e) to bypass the block. Alternate mechanisms cannot create write authority and violate scope discipline.
   - Never wrap a file write in eval, bash -c, sh -c, a subshell, or a heredoc-to-file redirect as a workaround. Shell and interpreter targets are scope-checked when they can be proven, and unverifiable write payloads fail closed.
   - Do NOT use mv, Move-Item, move, ren, Rename-Item, or cp-then-rm chains to relocate, rename, or delete files under \`.swarm/\` as a workaround for blocked destructive commands. Those are file-move shell bypasses and are banned. Use the tool's dedicated tools (\`.swarm/\` file management or evidence manager tools) instead.
   - If you cannot enumerate files up front (e.g. a broad refactor), declare the containing directories \u2014 declare_scope accepts directory entries and grants containment.
+  - Author task scope durably: every coding task passed to save_plan SHOULD include a non-empty \`files_touched\` list of normalized project-relative paths. On plan revision, omitting \`files_touched\` preserves that task's prior scope; passing \`[]\` clears it intentionally.
+  - Scope-source precedence is exact and fail-closed: the active \`declare_scope\` binding is authoritative, otherwise plan \`files_touched\`, otherwise complete \`FILE:\` directives. Every lower-precedence source that is present must be a subset of the authoritative source.
+  - \`SCOPE_CONFLICT\` recovery: inspect the named source lists, correct stale plan scope with save_plan and/or correct the delegation's \`FILE:\` lines, then call \`declare_scope({ taskId, files: <the reconciled list>, replace_existing: true, working_directory: <active lane root> })\` before retrying. Do not widen scope merely to silence the conflict.
+  - \`SCOPE_BINDING_EXPIRED\` or \`SCOPE_BINDING_AMBIGUOUS\` recovery: re-read the current task scope, then call \`declare_scope\` with the intended exact files and \`replace_existing: true\` before retrying. \`SCOPE_WORKSPACE_MISMATCH\` recovery: use the diagnostic's active lane/worktree root as \`working_directory\` and keep every declared path relative to that root. \`SCOPE_ROOT_ESCAPE\` recovery: retry the intended operation relative to the active root only when the diagnostic supplies a safe relative path; never authorize the outside absolute path.
   - Rationale: coder Task preflight binds scope to the exact workspace, plan generation, task, parent session, and Task call. Missing or malformed scope blocks delegation with SCOPE_NOT_DECLARED; conflicting lower-precedence FILE:/plan paths block with SCOPE_CONFLICT before the coder starts.
 <!-- BEHAVIORAL_GUIDANCE_END -->
 2. ONE agent per message. Send, STOP, wait for response.
@@ -57445,8 +57585,8 @@ If a tool modifies a file, it is a CODER tool. Delegate.
     > **WORKTREE ISOLATION IS BASELINE.** Standard parallel coders use isolated git worktrees by default; this is governed by the top-level \`worktree.policy\` setting (default \`auto\`) in \`PluginConfig\` \u2014 a sibling of \`parallelization:\`, not nested under it \u2014 and is active whenever the plan's \`parallelization_enabled=true\`. \`turbo.lean.worktree_isolation\` is a separate, Lean-Turbo-internal flag (default \`false\`); it is one possible SOURCE but NOT the recommended one. Do NOT recommend Lean Turbo (or Epic) SOLELY to obtain worktree isolation; recommend them only for what they add beyond baseline (Lean Turbo: lane planning, file locks, phase reviewer, integrated diff; Epic: co-change awareness + auto-decide). Lean Turbo users can also enable isolation via \`turbo.lean.worktree_isolation: true\`, but this is the secondary/legacy path \u2014 the recommended path is \`worktree.policy\`.
    Read-only advisory-lane exception (NON-BLOCKING; distinct from both exceptions above): the "Send, STOP, wait" rule governs MUTATION delegations (coder, and the test_engineer/reviewer Stage B completion gates). It does NOT govern read-only advisory exploration/review lanes. When you dispatch read-only advisory lanes \u2014 \`{{AGENT_PREFIX}}explorer\`, \`{{AGENT_PREFIX}}sme\`, \`{{AGENT_PREFIX}}researcher\`, the council members (\`council_generalist\`/\`council_skeptic\`/\`council_domain_expert\`), or an advisory \`{{AGENT_PREFIX}}critic\` lane \u2014 use the NON-BLOCKING path so you keep working while they run. Dispatch PROMPTLY: emit the \`dispatch_lanes_async\` call EARLY with compact lane prompts \u2014 do not accumulate long planning prose or build oversized inline prompts first, or the tool call can be truncated out of your message and the lanes never launch (a real failure mode on smaller models). The lane mechanism is a SINGLE \`dispatch_lanes_async\` call carrying all lane specs \u2014 NOT a per-agent Task/run-in-background pattern. Call \`dispatch_lanes_async\` with all lane specs in one call, record the returned \`batch_id\`, then IMMEDIATELY continue non-dependent architect work (refine the plan/obligation ledger, inspect metadata, prepare the synthesis/reviewer structure, run deterministic read-only tools). Poll incrementally with \`collect_lane_results\` without \`wait\` (or with \`wait: false\`) to harvest lanes as they settle; process completed lane output immediately while other lanes remain pending/running, then continue independent work between polls. Do NOT sit idle waiting on running lanes, and do NOT synthesize findings from still-running lanes. Join later by calling \`collect_lane_results\` with \`wait: true\` as the explicit barrier immediately before you synthesize. Use blocking \`dispatch_lanes\` only when \`dispatch_lanes_async\`/promptAsync is unavailable. A settled lane's inline \`output\` is delivered only once: if you poll the same lane again after already receiving its output, the repeat poll returns \`output_omitted_repeat: true\` with no \`output\` (not a sign the result was lost) \u2014 use the accompanying \`output_ref\` with \`retrieve_lane_output\` if you need the text again, and do not re-dispatch the lane. Keep each lane prompt compact: send large shared context (PR diff, ledger, scope) ONCE via the \`common_prompt\` field, or have lanes read it from a file by absolute path, instead of inlining the same blob into every lane prompt \u2014 inlining large context into many lanes is what produces malformed or truncated tool-call JSON and forces clumsy file workarounds. This non-blocking exception applies ONLY to read-only advisory lanes; it NEVER applies to coder delegations, to the test_engineer/reviewer Stage B completion gates, or to the critic PLAN-review gate, which all still follow "Send, STOP, wait" (or the Stage B parallel-dispatch exception above).
 3. ONE task per {{AGENT_PREFIX}}coder call. Never batch.
-3a. PRE-DELEGATION SCOPE CALL (required): BEFORE every {{AGENT_PREFIX}}coder delegation, you MUST call \`declare_scope\` with { taskId, files } listing the exact file(s) this task will modify (including generated/lockfile paths). No \`declare_scope\` call \u2192 no coder delegation. See Rule 1a.
-3b. PRE-DELEGATION SCOPE CALL (test_engineer): BEFORE any {{AGENT_PREFIX}}test_engineer delegation that will CREATE or MODIFY test files, you MUST call \`declare_scope\` with { taskId, files } listing the exact test file path(s) to write. Omitting this call leaves the write scope undeclared and will block the write. See Rule 1a.
+3a. PRE-DELEGATION SCOPE CALL (required): BEFORE every {{AGENT_PREFIX}}coder delegation, you MUST call \`declare_scope\` with { taskId, files, replace_existing: true } listing the exact file(s) this task will modify (including generated/lockfile paths). No \`declare_scope\` call \u2192 no coder delegation. See Rule 1a.
+3b. PRE-DELEGATION SCOPE CALL (test_engineer): BEFORE any {{AGENT_PREFIX}}test_engineer delegation that will CREATE or MODIFY test files, you MUST call \`declare_scope\` with { taskId, files, replace_existing: true } listing the exact test file path(s) to write. Omitting this call leaves the write scope undeclared and will block the write. See Rule 1a.
 <!-- BEHAVIORAL_GUIDANCE_START -->
 BATCHING DETECTION \u2014 you are batching if your coder delegation contains ANY of:
     - The word "and" connecting two actions ("update X AND add Y")
@@ -57845,7 +57985,7 @@ INPUT: Building a SwiftUI app with offline-first sync
 OUTPUT: Recommended patterns, frameworks, gotchas
 SKILLS: none
 
-PRE-STEP (required): call \`declare_scope({ taskId, files })\` BEFORE writing any {{AGENT_PREFIX}}coder delegation. See Rule 1a.
+PRE-STEP (required): call \`declare_scope({ taskId, files, replace_existing: true })\` BEFORE writing any {{AGENT_PREFIX}}coder delegation. See Rule 1a.
 
 {{AGENT_PREFIX}}coder
 TASK: Add input validation to login
@@ -58258,7 +58398,15 @@ ACTION: Load skill ${bundledProjectSkillFileReference("plan")} immediately. Foll
 HARD CONSTRAINTS (apply regardless of skill load success):
 - Before drafting or saving a plan, offer the loaded skill's General Council advisory option when \`council.general.enabled\` is true and a search API key is configured. If the user accepts, use the council output as context before calling \`save_plan\` and before any critic pre-plan review.
 - Use the \`save_plan\` tool as the primary plan writer. Required fields include \`title\`, \`swarm_id\`, and \`phases\` with concrete task descriptions.
-- Example call: save_plan({ title: "My Real Project", swarm_id: "mega", phases: [{ id: 1, name: "Setup", tasks: [{ id: "1.1", description: "Install dependencies and configure TypeScript", size: "small" }] }] })
+- Every coding task SHOULD include \`files_touched\` with the exact normalized project-relative files or directories it may modify; include generated outputs and lockfiles.
+- Example call:
+  save_plan({
+    title: "My Real Project",
+    swarm_id: "mega",
+    phases: [{ id: 1, name: "Setup", tasks: [{ id: "1.1", description: "Install dependencies and configure TypeScript", size: "small", files_touched: ["tsconfig.json", "package.json", "bun.lock"] }] }]
+  })
+
+- On a plan revision, omitting a task's \`files_touched\` preserves its prior scope; passing \`files_touched: []\` explicitly clears it. Never rely on the derived plan.md as the source of this field.
 
 - If \`save_plan\` is unavailable, delegate plan writing only after \`declare_scope\` covers \`.swarm/plan.md\`; the delegated output must be exact plan content.
 - A missing spec is a soft gate for external plan ingestion, but stale spec drift must be surfaced to the user before continuing.
@@ -58308,7 +58456,7 @@ ACTION: Load skill ${bundledProjectSkillFileReference("execute")} immediately. F
 
 HARD CONSTRAINTS (apply regardless of skill load success):
 - For each task, respect dependencies and delegate implementation to \`{{AGENT_PREFIX}}coder\`; do not self-fix ordinary gate failures.
-- Before coder implementation or retry, call \`declare_scope({ taskId, files })\` with the exact files the coder may touch.
+- Before coder implementation or retry, call \`declare_scope({ taskId, files, replace_existing: true })\` with the exact files the coder may touch.
 - On any gate failure, return to \`{{AGENT_PREFIX}}coder\` with structured rejection: \`GATE FAILED: [gate name] | REASON: [details] | REQUIRED FIX: [specific action required]\`.
 - Required per-task gates include automated checks, reviewer gates, verification tests, regression sweep, test drift, TODO scan, and coverage guidance as detailed in the loaded skill.
 - Pre-commit constraint: do not commit or push unless reviewer, test_engineer, pre_check_batch, diff, regression-sweep, and test-drift have actually run or skipped according to the loaded protocol.
@@ -59872,4 +60020,4 @@ function createCuratorLLMDelegate(directory, mode = "init", sessionId) {
   };
 }
 
-export { handleAcknowledgeSpecDriftCommand, handleAgentsCommand, handleAnalyzeCommand, DC_SAFE_TARGETS, dcNormalizeCommand, dcUnwrapWrappers, dcSplitSegments, dcValidateTargets, dcCheckJunctionCreation, dcExtractWindowsCmdTargets, dcExtractPowerShellTargets, normalizeSwarmCommandInput, canonicalCommandKey, formatCommandNotFound, executeSwarmCommand, SWARM_COMMAND_TOOL_COMMANDS, SWARM_COMMAND_TOOL_ALLOWLIST, HUMAN_ONLY_SWARM_COMMANDS, classifySwarmCommandToolUse, classifySwarmCommandChatFallbackUse, detectPosixWrites, detectWindowsWrites, resolveWriteTargets, handleArchiveCommand, handleAutoProceedCommand, handleBenchmarkCommand, handleBrainstormCommand, handleCheckpointCommand, handleCiSimulateCommand, handleClarifyCommand, createCuratorLLMDelegate, _internals23 as _internals, normalizeRecommendationEntryIdToken, parseKnowledgeRecommendations, parseKnowledgeRecommendationsWithDiagnostics, parseStructuredCuratorBlocks, readCuratorSummary, writeCuratorSummary, appendCuratorRecommendation, mergeCuratorPhaseSummary, filterPhaseEvents, checkPhaseCompliance, runCuratorInit, runCuratorPhase, applyCuratorKnowledgeUpdates, isHiveEligible, countDistinctProjects, checkHivePromotions, _internals26 as _internals1, createHivePromoterHook, promoteToHive, promoteFromSwarm, handleCloseCommand, handleCodebaseReviewCommand, handleConcurrencyCommand, handleConfigCommand, handleConsolidateCommand, handleCostsCommand, handleCouncilCommand, handleCurateCommand, handleDarkMatterCommand, handleDeepDiveCommand, handleDeepResearchCommand, getPluginConfigDir, getPluginCachePaths, getPluginLockFilePaths, handleDiagnoseCommand, handleDoctorCommand, handleEvidenceCommand, handleEvidenceSummaryCommand, handleExportCommand, handleFullAutoCommand, handleGateAuditCommand, handleGateStatsCommand, handleHandoffCommand, handleHistoryCommand, handleKnowledgeQuarantineCommand, handleKnowledgeRestoreCommand, handleKnowledgeMigrateCommand, handleKnowledgeListCommand, handleKnowledgeUnactionableCommand, handleKnowledgeRetryHardeningCommand, handleLearningCommand, handleLinkCommand, handleMemoryCommand, handleMemoryStatusCommand, handleMemoryValueLogCommand, handleMemoryMigrateCommand, handleMemoryImportCommand, handleMemoryExportCommand, handlePlanCommand, handlePreflightCommand, handlePromoteCommand, handleQaGatesCommand, handleResetCommand, handleResetSessionCommand, handleRetrieveCommand, handleReviewCommand, handleRollbackCommand, handleSddStatusCommand, handleSddValidateCommand, handleSddProjectCommand, handleSddCommand, handleSimulateCommand, handleSpecifyCommand, handleStatusCommand, handleSyncPlanCommand, handleTurboCommand, handleUnlinkCommand, handleWriteRetroCommand, handleHelpCommand, COMMAND_REGISTRY, VALID_COMMANDS, _internals14 as _internals2, resolveCommand };
+export { handleAcknowledgeSpecDriftCommand, handleAgentsCommand, handleAnalyzeCommand, dcNormalizeCommand, dcUnwrapWrappers, dcSplitSegments, dcExtractRecursiveRmTargets, dcEvaluateRecursiveDeleteTargets, dcCheckJunctionCreation, dcExtractWindowsCmdTargets, dcExtractPowerShellTargets, normalizeSwarmCommandInput, canonicalCommandKey, formatCommandNotFound, executeSwarmCommand, SWARM_COMMAND_TOOL_COMMANDS, SWARM_COMMAND_TOOL_ALLOWLIST, HUMAN_ONLY_SWARM_COMMANDS, classifySwarmCommandToolUse, classifySwarmCommandChatFallbackUse, detectPosixWrites, detectWindowsWrites, resolveWriteTargets, handleArchiveCommand, handleAutoProceedCommand, handleBenchmarkCommand, handleBrainstormCommand, handleCheckpointCommand, handleCiSimulateCommand, handleClarifyCommand, createCuratorLLMDelegate, _internals23 as _internals, normalizeRecommendationEntryIdToken, parseKnowledgeRecommendations, parseKnowledgeRecommendationsWithDiagnostics, parseStructuredCuratorBlocks, readCuratorSummary, writeCuratorSummary, appendCuratorRecommendation, mergeCuratorPhaseSummary, filterPhaseEvents, checkPhaseCompliance, runCuratorInit, runCuratorPhase, applyCuratorKnowledgeUpdates, isHiveEligible, countDistinctProjects, checkHivePromotions, _internals26 as _internals1, createHivePromoterHook, promoteToHive, promoteFromSwarm, handleCloseCommand, handleCodebaseReviewCommand, handleConcurrencyCommand, handleConfigCommand, handleConsolidateCommand, handleCostsCommand, handleCouncilCommand, handleCurateCommand, handleDarkMatterCommand, handleDeepDiveCommand, handleDeepResearchCommand, getPluginConfigDir, getPluginCachePaths, getPluginLockFilePaths, handleDiagnoseCommand, handleDoctorCommand, handleEvidenceCommand, handleEvidenceSummaryCommand, handleExportCommand, handleFullAutoCommand, handleGateAuditCommand, handleGateStatsCommand, handleHandoffCommand, handleHistoryCommand, handleKnowledgeQuarantineCommand, handleKnowledgeRestoreCommand, handleKnowledgeMigrateCommand, handleKnowledgeListCommand, handleKnowledgeUnactionableCommand, handleKnowledgeRetryHardeningCommand, handleLearningCommand, handleLinkCommand, handleMemoryCommand, handleMemoryStatusCommand, handleMemoryValueLogCommand, handleMemoryMigrateCommand, handleMemoryImportCommand, handleMemoryExportCommand, handlePlanCommand, handlePreflightCommand, handlePromoteCommand, handleQaGatesCommand, handleResetCommand, handleResetSessionCommand, handleRetrieveCommand, handleReviewCommand, handleRollbackCommand, handleSddStatusCommand, handleSddValidateCommand, handleSddProjectCommand, handleSddCommand, handleSimulateCommand, handleSpecifyCommand, handleStatusCommand, handleSyncPlanCommand, handleTurboCommand, handleUnlinkCommand, handleWriteRetroCommand, handleHelpCommand, COMMAND_REGISTRY, VALID_COMMANDS, _internals14 as _internals2, resolveCommand };

package/dist/cli/{index-1v89yst3.js → index-a9xny52r.js}

@@ -7,7 +7,7 @@ import {
   loadPluginConfigWithMeta,
   loadPluginConfigWithMetaAsync,
   resolveWorktreeIsolationConfig
-} from "./index-y6dvs5tt.js";
+} from "./index-m1pwkwfe.js";
 import {
   ApprovalEvidenceSchema,
   BaseEvidenceSchema,
@@ -54,7 +54,7 @@ import {
   TurboConfigSchema,
   WorktreeIsolationConfigSchema,
   resolveAutoReviewConfig
-} from "./index-ab57h0yq.js";
+} from "./index-5q009kc4.js";
 import"./index-bk5tah7q.js";
 import {
   MigrationStatusSchema,

package/dist/cli/{index-rjratees.js → index-c60whfgh.js}

@@ -2,7 +2,7 @@
 import {
   readKnowledge,
   transactKnowledge
-} from "./index-1djv5684.js";
+} from "./index-1g6xpjk3.js";
 import {
   resolveKnowledgeStoreDir
 } from "./index-en4fb04r.js";