opencode-swarm 7.138.3 → 7.139.0

package/dist/cli/{index-y06a43sk.js → index-4ft523nb.js}

@@ -3,7 +3,7 @@ import {
   EvaluationRunV1Schema,
   GateAuditResultV1Schema,
   getProtectedEvaluationRunIds
-} from "./index-ngqxzkqm.js";
+} from "./index-z1tkxzq4.js";
 import {
   readEffectiveSpecSync
 } from "./index-9ss2m4rs.js";
@@ -12,7 +12,7 @@ import {
   readTaskEvidence,
   readTaskEvidenceRaw,
   sanitizeTaskId
-} from "./index-39k6y018.js";
+} from "./index-tcdcj1g2.js";
 import {
   EVIDENCE_MAX_JSON_BYTES,
   EvidenceBundleSchema,
@@ -40,7 +40,7 @@ import {
   replayFromLedgerWithStatus,
   takeSnapshotEvent,
   takeSnapshotWithRetry
-} from "./index-4fmztnrq.js";
+} from "./index-p2dz85tv.js";
 import {
   PlanSchema
 } from "./index-1kz6da87.js";
@@ -56,10 +56,10 @@ import {
 } from "./index-fsrp8wp3.js";
 import {
   withEvidenceLock
-} from "./index-xybtaph7.js";
+} from "./index-a614s16f.js";
 import {
   emit
-} from "./index-10mz5js6.js";
+} from "./index-chvqee1j.js";
 import {
   ZodError,
   init_zod
@@ -1586,9 +1586,247 @@ var _internals5 = {
   readLaneEnvFileFromDiskSync
 };
 
+// src/services/run-memory.ts
+import * as crypto2 from "crypto";
+import * as fs2 from "fs/promises";
+
+// src/hooks/context-sanitizer.ts
+function sanitizeContextText(text) {
+  return text.split("").filter((char) => {
+    const code = char.charCodeAt(0);
+    return code === 9 || code === 10 || code === 13 || code > 31 && code !== 127;
+  }).join("").replace(/[\u00AD\u200B-\u200F\u2060-\u2064\uFEFF]/g, "").replace(/[\u202A-\u202E\u2066-\u2069]/g, "").replace(/```/g, "` ` `").replace(/^system\s*:/gim, "[BLOCKED]:").replace(/<system\b[^>]*>/gi, "[BLOCKED-TAG]").replace(/<\/system>/gi, "[/BLOCKED-TAG]").replace(/<tool_call\b[^>]*>/gi, "[BLOCKED-TOOL]").replace(/<\/tool_call>/gi, "[/BLOCKED-TOOL]").replace(/<\/\w+>/g, "[/BLOCKED-TAG]");
+}
+
+// src/services/run-memory.ts
+init_logger();
+
+// src/utils/path-security.ts
+function containsPathTraversal(str) {
+  if (/\.\.[/\\]/.test(str))
+    return true;
+  if (/(?:^|[/\\])\.\.(?:[/\\]|$)/.test(str))
+    return true;
+  if (/%2e%2e/i.test(str))
+    return true;
+  if (/%2e\./i.test(str))
+    return true;
+  if (/%2e/i.test(str) && /\.\./.test(str))
+    return true;
+  if (/%252e%252e/i.test(str))
+    return true;
+  if (/\uff0e/.test(str))
+    return true;
+  if (/\u3002/.test(str))
+    return true;
+  if (/\uff65/.test(str))
+    return true;
+  if (/%2f/i.test(str))
+    return true;
+  if (/%5c/i.test(str))
+    return true;
+  return false;
+}
+function containsControlChars(str) {
+  for (const ch of str) {
+    const code = ch.codePointAt(0);
+    if (code === undefined)
+      continue;
+    if (code <= 31 || code >= 127 && code <= 159)
+      return true;
+    if (code >= 8234 && code <= 8238)
+      return true;
+    if (code >= 8294 && code <= 8297)
+      return true;
+  }
+  return false;
+}
+function validateWorkspaceRoot(directory) {
+  if (!directory || directory.trim() === "") {
+    throw new Error("Invalid directory: empty");
+  }
+  if (containsPathTraversal(directory)) {
+    throw new Error("Invalid directory: path traversal detected");
+  }
+  if (containsControlChars(directory)) {
+    throw new Error("Invalid directory: control characters detected");
+  }
+}
+
+// src/services/run-memory.ts
+var RUN_MEMORY_FILENAME = "run-memory.jsonl";
+var MAX_SUMMARY_TOKENS = 500;
+function generateTaskFingerprint(taskId, fileTargets) {
+  const sortedFiles = [...fileTargets].sort().join(",");
+  const hash = crypto2.createHash("sha256").update(taskId + sortedFiles).digest("hex");
+  return hash.slice(0, 8);
+}
+async function recordOutcome(directory, entry) {
+  validateWorkspaceRoot(directory);
+  const resolvedPath = validateSwarmPath(directory, RUN_MEMORY_FILENAME);
+  const line = `${JSON.stringify(entry)}
+`;
+  await fs2.appendFile(resolvedPath, line, { encoding: "utf-8" });
+}
+async function getTaskHistory(directory, taskId) {
+  validateWorkspaceRoot(directory);
+  const content = await readSwarmFileAsync(directory, RUN_MEMORY_FILENAME);
+  if (!content) {
+    return [];
+  }
+  const entries = [];
+  const lines = content.split(`
+`);
+  for (const line of lines) {
+    if (!line.trim())
+      continue;
+    try {
+      const entry = JSON.parse(line);
+      if (entry.taskId === taskId) {
+        entries.push(entry);
+      }
+    } catch {}
+  }
+  return entries;
+}
+async function recordTaskAttempt(directory, input) {
+  try {
+    let history = [];
+    try {
+      history = await _internals6.getTaskHistory(directory, input.taskId);
+    } catch (err) {
+      warn(`[run-memory] history read for task ${input.taskId} failed; recording with attemptNumber 1: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const entry = {
+      timestamp: new Date().toISOString(),
+      taskId: input.taskId,
+      taskFingerprint: _internals6.generateTaskFingerprint(input.taskId, input.fileTargets ?? []),
+      agent: input.agent,
+      outcome: input.outcome,
+      attemptNumber: history.length + 1
+    };
+    if (input.failureReason) {
+      entry.failureReason = input.failureReason;
+    }
+    if (input.fileTargets && input.fileTargets.length > 0) {
+      entry.filesModified = input.fileTargets;
+    }
+    if (typeof input.durationMs === "number") {
+      entry.durationMs = input.durationMs;
+    }
+    await _internals6.recordOutcome(directory, entry);
+  } catch (err) {
+    warn(`[run-memory] failed to record ${input.outcome} for task ${input.taskId}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function groupByTaskId(entries) {
+  const groups = new Map;
+  for (const entry of entries) {
+    const existing = groups.get(entry.taskId) || [];
+    existing.push(entry);
+    groups.set(entry.taskId, existing);
+  }
+  return groups;
+}
+function summarizeTask(taskId, entries) {
+  let lastFailure;
+  let lastFailureIndex = -1;
+  let lastPassIndex = -1;
+  let lastPass;
+  let failCount = 0;
+  entries.forEach((entry, index) => {
+    if (entry.outcome === "fail" || entry.outcome === "retry") {
+      failCount++;
+      lastFailure = entry;
+      lastFailureIndex = index;
+    } else if (entry.outcome === "pass") {
+      lastPass = entry;
+      lastPassIndex = index;
+    }
+  });
+  if (!lastFailure) {
+    return null;
+  }
+  const passResolvesFailure = lastPassIndex > lastFailureIndex;
+  if (lastPass && passResolvesFailure) {
+    const passAttempt = lastPass.attemptNumber;
+    const failAttempt = lastFailure.attemptNumber;
+    const reason = sanitizeContextText(lastFailure.failureReason || "unknown");
+    return `Task ${taskId}: FAILED attempt ${failAttempt} \u2014 ${reason}. Passed on attempt ${passAttempt}.`;
+  } else {
+    const reason = sanitizeContextText(lastFailure.failureReason || "unknown");
+    return `Task ${taskId}: FAILED ${failCount} times \u2014 last: ${reason}. Still failing.`;
+  }
+}
+async function getRunMemorySummary(directory) {
+  validateWorkspaceRoot(directory);
+  const content = await readSwarmFileAsync(directory, RUN_MEMORY_FILENAME);
+  if (!content) {
+    return null;
+  }
+  const entries = [];
+  const lines = content.split(`
+`);
+  for (const line of lines) {
+    if (!line.trim())
+      continue;
+    try {
+      const entry = JSON.parse(line);
+      entries.push(entry);
+    } catch {}
+  }
+  if (entries.length === 0) {
+    return null;
+  }
+  const groups = _internals6.groupByTaskId(entries);
+  const summaries = [];
+  for (const [taskId, taskEntries] of groups) {
+    const summary = _internals6.summarizeTask(taskId, taskEntries);
+    if (summary) {
+      summaries.push(summary);
+    }
+  }
+  if (summaries.length === 0) {
+    return null;
+  }
+  const prefix = `[FOR: architect, coder]
+## RUN MEMORY \u2014 Previous Task Outcomes
+`;
+  const suffix = `
+Use this data to avoid repeating known failure patterns.`;
+  let summaryText = summaries.join(`
+`);
+  const estimateTokens = (text) => {
+    return Math.ceil(text.length * 0.33);
+  };
+  const totalText = prefix + summaryText + suffix;
+  const estimatedTokens = estimateTokens(totalText);
+  if (estimatedTokens > MAX_SUMMARY_TOKENS) {
+    const prefixTokens = estimateTokens(prefix);
+    const suffixTokens = estimateTokens(suffix);
+    const availableContentTokens = MAX_SUMMARY_TOKENS - prefixTokens - suffixTokens;
+    if (availableContentTokens > 0) {
+      const maxContentChars = Math.floor(availableContentTokens / 0.33);
+      summaryText = summaryText.slice(0, maxContentChars);
+    } else {
+      summaryText = "";
+    }
+  }
+  return prefix + summaryText + suffix;
+}
+var _internals6 = {
+  generateTaskFingerprint,
+  recordOutcome,
+  recordTaskAttempt,
+  getTaskHistory,
+  getRunMemorySummary,
+  groupByTaskId,
+  summarizeTask
+};
+
 // src/turbo/epic/state.ts
 init_logger();
-import * as fs2 from "fs";
+import * as fs3 from "fs";
 import * as path5 from "path";
 var STATE_FILE = "epic-state.json";
 function nowISO() {
@@ -1596,8 +1834,8 @@ function nowISO() {
 }
 function ensureSwarmDir(directory) {
   const swarmDir = path5.resolve(directory, ".swarm");
-  if (!fs2.existsSync(swarmDir)) {
-    fs2.mkdirSync(swarmDir, { recursive: true });
+  if (!fs3.existsSync(swarmDir)) {
+    fs3.mkdirSync(swarmDir, { recursive: true });
   }
   return swarmDir;
 }
@@ -1618,16 +1856,16 @@ function markStateUnreadable(directory, reason) {
 function readPersisted(directory) {
   try {
     const filePath = path5.join(directory, ".swarm", STATE_FILE);
-    if (!fs2.existsSync(filePath)) {
+    if (!fs3.existsSync(filePath)) {
       const seed = emptyPersisted();
       try {
         ensureSwarmDir(directory);
-        fs2.writeFileSync(filePath, `${JSON.stringify(seed, null, 2)}
+        fs3.writeFileSync(filePath, `${JSON.stringify(seed, null, 2)}
 `, "utf-8");
       } catch {}
       return seed;
     }
-    const raw = fs2.readFileSync(filePath, "utf-8");
+    const raw = fs3.readFileSync(filePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || parsed.version !== 1 || !parsed.sessions || typeof parsed.sessions !== "object" || Array.isArray(parsed.sessions)) {
       markStateUnreadable(directory, `malformed shape (version=${parsed?.version}, sessions type=${Array.isArray(parsed?.sessions) ? "array" : typeof parsed?.sessions})`);
@@ -1664,14 +1902,14 @@ function writePersisted(directory, persisted) {
     throw new Error(`Epic state persistence prepare failed: ${msg}`);
   }
   try {
-    fs2.writeFileSync(tmpPath, payload, "utf-8");
-    fs2.renameSync(tmpPath, filePath);
+    fs3.writeFileSync(tmpPath, payload, "utf-8");
+    fs3.renameSync(tmpPath, filePath);
   } catch (error2) {
     const msg = error2 instanceof Error ? error2.message : String(error2);
     error(`[turbo/epic/state] Failed to persist ${STATE_FILE} atomically: ${msg}`);
     try {
-      if (fs2.existsSync(tmpPath))
-        fs2.unlinkSync(tmpPath);
+      if (fs3.existsSync(tmpPath))
+        fs3.unlinkSync(tmpPath);
     } catch {}
     throw new Error(`Epic state persistence failed: ${msg}`);
   }
@@ -1702,7 +1940,7 @@ function isEpicModeActive(directory, sessionID) {
 function isEpicModeActiveForProject(directory) {
   if (stateUnreadableMap.get(directory))
     return false;
-  if (!fs2.existsSync(path5.join(directory, ".swarm", STATE_FILE))) {
+  if (!fs3.existsSync(path5.join(directory, ".swarm", STATE_FILE))) {
     return false;
   }
   const persisted = readPersisted(directory);
@@ -1753,11 +1991,11 @@ function isLockContentionError(err) {
   return INDEX_LOCK_ERROR_RE.test(msg);
 }
 async function commitTaskCompletion(directory, taskId, description, scopePaths) {
-  if (!_internals6.isGitRepo(directory)) {
+  if (!_internals7.isGitRepo(directory)) {
     return { committed: false, reason: "no-git" };
   }
   try {
-    if (_internals6.hasExistingTaskCommit(directory, taskId)) {
+    if (_internals7.hasExistingTaskCommit(directory, taskId)) {
       return { committed: true, reason: "idempotent-skip" };
     }
   } catch {}
@@ -1778,15 +2016,15 @@ async function commitTaskCompletion(directory, taskId, description, scopePaths)
   for (let attempt = 0;attempt <= INDEX_LOCK_BACKOFF_MS.length; attempt++) {
     try {
       if (paths.length > 0) {
-        _internals6.stageScopedPaths(directory, paths);
+        _internals7.stageScopedPaths(directory, paths);
       }
-      _internals6.commitAllowEmpty(directory, message);
-      const sha = _internals6.gitHeadSha(directory);
+      _internals7.commitAllowEmpty(directory, message);
+      const sha = _internals7.gitHeadSha(directory);
       return { committed: true, reason: "success", sha };
     } catch (err) {
       lastError = err;
       if (attempt < INDEX_LOCK_BACKOFF_MS.length && isLockContentionError(err)) {
-        await _internals6.sleep(INDEX_LOCK_BACKOFF_MS[attempt]);
+        await _internals7.sleep(INDEX_LOCK_BACKOFF_MS[attempt]);
         continue;
       }
       break;
@@ -1796,7 +2034,7 @@ async function commitTaskCompletion(directory, taskId, description, scopePaths)
   criticalWarn(`[epic:task-commit] commit for task ${taskId} failed (non-fatal): ${msg}`);
   return { committed: false, reason: "commit-failed", error: msg };
 }
-var _internals6 = {
+var _internals7 = {
   isGitRepo: (cwd) => isGitRepo(cwd),
   stageScopedPaths: (cwd, paths) => {
     const CHUNK = 200;
@@ -1828,7 +2066,7 @@ var _internals6 = {
 };
 
 // src/turbo/lean/conflicts.ts
-import * as fs3 from "fs";
+import * as fs4 from "fs";
 import * as path6 from "path";
 
 // src/utils/path.ts
@@ -1959,10 +2197,10 @@ function isProtectedPath(normalizedPath) {
 function readTaskScopes(directory, taskId) {
   const scopePath = path6.join(directory, ".swarm", "scopes", `scope-${taskId}.json`);
   try {
-    if (!fs3.existsSync(scopePath)) {
+    if (!fs4.existsSync(scopePath)) {
       return null;
     }
-    const raw = fs3.readFileSync(scopePath, "utf-8");
+    const raw = fs4.readFileSync(scopePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || !Array.isArray(parsed.files)) {
       return null;
@@ -1974,17 +2212,17 @@ function readTaskScopes(directory, taskId) {
 }
 
 // src/utils/spec-hash.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import * as fsSync2 from "fs";
 import { join as join5 } from "path";
 async function computeSpecHash(directory) {
-  const spec = _internals7.readEffectiveSpecSync(directory);
+  const spec = _internals8.readEffectiveSpecSync(directory);
   if (!spec)
     return null;
-  return createHash("sha256").update(spec.content, "utf-8").digest("hex");
+  return createHash2("sha256").update(spec.content, "utf-8").digest("hex");
 }
 async function isSpecStale(directory, plan) {
-  const currentHash = await _internals7.computeSpecHash(directory);
+  const currentHash = await _internals8.computeSpecHash(directory);
   if (!plan.specHash) {
     return { stale: false };
   }
@@ -2013,7 +2251,7 @@ function isObligationPreserving(directory) {
     } catch {
       return false;
     }
-    const currentResult = _internals7.readEffectiveSpecSync(directory);
+    const currentResult = _internals8.readEffectiveSpecSync(directory);
     if (!currentResult || !currentResult.content) {
       return false;
     }
@@ -2043,7 +2281,7 @@ function isObligationPreserving(directory) {
     return false;
   }
 }
-var _internals7 = {
+var _internals8 = {
   computeSpecDiff,
   computeSpecHash,
   isObligationPreserving,
@@ -2063,7 +2301,7 @@ function computeSpecDiff(directory) {
   } catch {
     return null;
   }
-  const spec = _internals7.readEffectiveSpecSync(directory);
+  const spec = _internals8.readEffectiveSpecSync(directory);
   if (!spec) {
     return null;
   }
@@ -2157,7 +2395,7 @@ var startupLedgerCheckedWorkspaces = new Set;
 var ledgerStaleWorkspaces = new Set;
 var recoveryMutexes = new Map;
 var PLAN_JSON_CACHE_NAMESPACE = "plan-json:validated:v1";
-var _internals8 = {
+var _internals9 = {
   loadPlan,
   loadPlanJsonOnly,
   regeneratePlanMarkdown,
@@ -2165,7 +2403,8 @@ var _internals8 = {
   isEpicModeActiveForProject,
   readTaskScopes,
   commitTaskCompletion,
-  getWorktreeMergeFailure
+  getWorktreeMergeFailure,
+  recordTaskAttempt
 };
 var CAS_BACKOFF_START_MS = 5;
 var CAS_BACKOFF_CAP_MS = 250;
@@ -2406,7 +2645,7 @@ async function loadPlan(directory, cache) {
           const inSync = await isPlanMdInSync(directory, validated, cache);
           if (!inSync) {
             try {
-              await _internals8.regeneratePlanMarkdown(directory, validated);
+              await _internals9.regeneratePlanMarkdown(directory, validated);
             } catch (regenError) {
               warn(`Failed to regenerate plan.md: ${regenError instanceof Error ? regenError.message : String(regenError)}. Proceeding with plan.json only.`);
             }
@@ -2572,7 +2811,7 @@ async function loadPlan(directory, cache) {
     const existingMutex = recoveryMutexes.get(resolvedDir);
     if (existingMutex) {
       await existingMutex;
-      const postRecoveryPlan = await _internals8.loadPlanJsonOnly(directory);
+      const postRecoveryPlan = await _internals9.loadPlanJsonOnly(directory);
       if (postRecoveryPlan)
         return postRecoveryPlan;
     }
@@ -2632,7 +2871,7 @@ async function loadPlan(directory, cache) {
   return null;
 }
 async function savePlanWithAutoAcknowledgedRemovals(directory, plan, source, reason, options) {
-  const existing = await _internals8.loadPlanJsonOnly(directory);
+  const existing = await _internals9.loadPlanJsonOnly(directory);
   const newIds = new Set;
   for (const phase of plan.phases) {
     for (const task of phase.tasks)
@@ -2660,7 +2899,7 @@ async function savePlan(directory, plan, options) {
   const validated = PlanSchema.parse(plan);
   if (options?.preserveCompletedStatuses !== false) {
     try {
-      const currentPlan2 = await _internals8.loadPlanJsonOnly(directory);
+      const currentPlan2 = await _internals9.loadPlanJsonOnly(directory);
       if (currentPlan2) {
         const completedTaskIds = new Set;
         for (const phase of currentPlan2.phases) {
@@ -2682,7 +2921,7 @@ async function savePlan(directory, plan, options) {
     } catch {}
   }
   derivePhaseStatusesInPlace(validated);
-  const currentPlan = await _internals8.loadPlanJsonOnly(directory);
+  const currentPlan = await _internals9.loadPlanJsonOnly(directory);
   const planId = derivePlanId(validated);
   const planHashForInit = computePlanHash(validated);
   if (!await ledgerExists(directory)) {
@@ -2827,7 +3066,7 @@ async function savePlan(directory, plan, options) {
             expectedHash: currentHash,
             planHashAfter: hashAfter,
             verifyValid: async () => {
-              const onDisk = await _internals8.loadPlanJsonOnly(directory);
+              const onDisk = await _internals9.loadPlanJsonOnly(directory);
               if (!onDisk)
                 return true;
               for (const p of onDisk.phases) {
@@ -2865,7 +3104,7 @@ async function savePlan(directory, plan, options) {
               expectedHash: currentHash,
               planHashAfter: hashAfter,
               verifyValid: async () => {
-                const onDisk = await _internals8.loadPlanJsonOnly(directory);
+                const onDisk = await _internals9.loadPlanJsonOnly(directory);
                 if (!onDisk)
                   return true;
                 for (const p of onDisk.phases) {
@@ -3151,6 +3390,10 @@ Phase: ${currentPhase} [${phaseStatus}] | Updated: ${now}
         const sortedDepends = [...task.depends].sort();
         suffix += ` (depends: ${sortedDepends.join(", ")})`;
       }
+      if (task.files_touched.length > 0) {
+        const sortedFiles = [...task.files_touched].sort();
+        suffix += ` (files_touched: ${JSON.stringify(sortedFiles)})`;
+      }
       if (phase.id === plan.current_phase && task.status === "in_progress" && !currentTaskMarked) {
         suffix += " \u2190 CURRENT";
         currentTaskMarked = true;
@@ -3387,12 +3630,12 @@ import {
   rmSync,
   statSync as statSync2
 } from "fs";
-import * as fs6 from "fs/promises";
+import * as fs7 from "fs/promises";
 import * as os4 from "os";
 import * as path9 from "path";
 
 // src/evaluation/retention.ts
-import * as fs4 from "fs/promises";
+import * as fs5 from "fs/promises";
 import * as path8 from "path";
 function artifactKey(artifact) {
   return `${artifact.namespace}/${artifact.id}`;
@@ -3404,7 +3647,7 @@ async function evaluationRunCandidates(directory) {
   const root = path8.join(directory, ".swarm", "evolution", "runs");
   let entries = [];
   try {
-    entries = await fs4.readdir(root, { withFileTypes: true });
+    entries = await fs5.readdir(root, { withFileTypes: true });
   } catch (error2) {
     if (error2.code === "ENOENT") {
       return { candidates: [], corrupt: [] };
@@ -3422,7 +3665,7 @@ async function evaluationRunCandidates(directory) {
     const artifact = { namespace: "evaluation-run", id };
     const target = path8.join(root, entry.name);
     try {
-      const run = EvaluationRunV1Schema.parse(JSON.parse(await fs4.readFile(target, "utf8")));
+      const run = EvaluationRunV1Schema.parse(JSON.parse(await fs5.readFile(target, "utf8")));
       if (run.runId !== id)
         throw new Error("run id/path mismatch");
       candidates.push({
@@ -3441,7 +3684,7 @@ async function gateAuditCandidates(directory) {
   const root = path8.join(directory, ".swarm", "evidence", "gate-audit");
   let entries = [];
   try {
-    entries = await fs4.readdir(root, { withFileTypes: true });
+    entries = await fs5.readdir(root, { withFileTypes: true });
   } catch (error2) {
     if (error2.code === "ENOENT") {
       return { candidates: [], corrupt: [] };
@@ -3456,7 +3699,7 @@ async function gateAuditCandidates(directory) {
     const artifact = { namespace: "gate-audit", id: entry.name };
     const target = path8.join(root, entry.name);
     try {
-      const result = GateAuditResultV1Schema.parse(JSON.parse(await fs4.readFile(path8.join(target, "results.json"), "utf8")));
+      const result = GateAuditResultV1Schema.parse(JSON.parse(await fs5.readFile(path8.join(target, "results.json"), "utf8")));
       if (result.runId !== entry.name)
         throw new Error("run id/path mismatch");
       candidates.push({
@@ -3487,10 +3730,10 @@ async function protectedArtifacts(directory) {
 }
 async function removeCandidate(candidate) {
   if (candidate.kind === "directory") {
-    await fs4.rm(candidate.target, { recursive: true, force: true });
+    await fs5.rm(candidate.target, { recursive: true, force: true });
     return;
   }
-  await fs4.unlink(candidate.target);
+  await fs5.unlink(candidate.target);
 }
 var _retentionInternals = {
   protectedArtifacts,
@@ -3546,7 +3789,7 @@ async function archiveEvaluationArtifacts(args) {
 }
 
 // src/evidence/documents-retention.ts
-import * as fs5 from "fs";
+import * as fs6 from "fs";
 import * as fsp from "fs/promises";
 import * as readline from "readline";
 var EVIDENCE_CACHE_FILE = "evidence-cache/documents.jsonl";
@@ -3554,13 +3797,13 @@ var MAX_READ_BYTES = 100 * 1024 * 1024;
 var RENAME_MAX_ATTEMPTS = 5;
 var RENAME_BACKOFF_MS = 10;
 var RENAME_RETRY_CODES = new Set(["EPERM", "EBUSY", "ENOTEMPTY", "EACCES"]);
-var _internals9 = {
+var _internals10 = {
   stat: (p) => fsp.stat(p),
-  createReadStream: (p, options) => fs5.createReadStream(p, options),
-  openSync: (p, flags) => fs5.openSync(p, flags),
-  writeSync: (fd, data, position) => fs5.writeSync(fd, data, position),
-  fsyncSync: (fd) => fs5.fsyncSync(fd),
-  closeSync: (fd) => fs5.closeSync(fd),
+  createReadStream: (p, options) => fs6.createReadStream(p, options),
+  openSync: (p, flags) => fs6.openSync(p, flags),
+  writeSync: (fd, data, position) => fs6.writeSync(fd, data, position),
+  fsyncSync: (fd) => fs6.fsyncSync(fd),
+  closeSync: (fd) => fs6.closeSync(fd),
   renameWithRetry: atomicRenameWithRetry,
   unlink: (p) => fsp.unlink(p)
 };
@@ -3596,9 +3839,9 @@ function emptyResult(dryRun) {
   };
 }
 async function readCacheRows(filePath) {
-  const stat2 = await _internals9.stat(filePath);
+  const stat2 = await _internals10.stat(filePath);
   const bytesBefore = stat2.size;
-  const stream = _internals9.createReadStream(filePath, {
+  const stream = _internals10.createReadStream(filePath, {
     encoding: "utf8",
     highWaterMark: 64 * 1024
   });
@@ -3674,23 +3917,23 @@ async function rewriteAtomic(filePath, survivors) {
 `)}
 ` : "";
   let succeeded = false;
-  const fd = _internals9.openSync(tmpPath, "w");
+  const fd = _internals10.openSync(tmpPath, "w");
   try {
-    _internals9.writeSync(fd, payload, 0);
-    _internals9.fsyncSync(fd);
-    _internals9.closeSync(fd);
-    await _internals9.renameWithRetry(tmpPath, filePath);
+    _internals10.writeSync(fd, payload, 0);
+    _internals10.fsyncSync(fd);
+    _internals10.closeSync(fd);
+    await _internals10.renameWithRetry(tmpPath, filePath);
     succeeded = true;
   } catch (err) {
     try {
-      _internals9.closeSync(fd);
+      _internals10.closeSync(fd);
     } catch {}
     const msg = err instanceof Error ? err.message : String(err);
     throw new Error(`documents-cache rewrite failed: ${msg}`);
   } finally {
     if (!succeeded) {
       try {
-        await _internals9.unlink(tmpPath);
+        await _internals10.unlink(tmpPath);
       } catch {}
     }
   }
@@ -3702,7 +3945,7 @@ async function pruneEvidenceDocuments(args) {
   const filePath = validateSwarmPath(args.directory, EVIDENCE_CACHE_FILE);
   let stat2;
   try {
-    stat2 = await _internals9.stat(filePath);
+    stat2 = await _internals10.stat(filePath);
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT")
@@ -3879,11 +4122,11 @@ function validateProjectRoot(directory) {
   }
 }
 async function saveEvidence(directory, taskId, evidence) {
-  _internals10.validateProjectRoot(directory);
+  _internals11.validateProjectRoot(directory);
   const sanitizedTaskId = sanitizeTaskId2(taskId);
   const relativePath = path9.join("evidence", sanitizedTaskId, "evidence.json");
   validateSwarmPath(directory, relativePath);
-  _internals10.validateEvidence(evidence);
+  _internals11.validateEvidence(evidence);
   return withEvidenceLock(directory, relativePath, "evidence-manager", sanitizedTaskId, async () => {
     const evidencePath = validateSwarmPath(directory, relativePath);
     const evidenceDir = path9.dirname(evidencePath);
@@ -3932,7 +4175,7 @@ async function saveEvidence(directory, taskId, evidence) {
     const tempPath = path9.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
     try {
       await bunWrite(tempPath, bundleJson);
-      await fs6.rename(tempPath, evidencePath);
+      await fs7.rename(tempPath, evidencePath);
     } catch (error2) {
       try {
         rmSync(tempPath, { force: true });
@@ -3989,7 +4232,7 @@ async function loadEvidence(directory, taskId, options) {
     return { status: "invalid_schema", errors: ["Invalid JSON"] };
   }
   if (isFlatRetrospective(parsed)) {
-    const wrappedBundle = _internals10.wrapFlatRetrospective(parsed, sanitizedTaskId);
+    const wrappedBundle = _internals11.wrapFlatRetrospective(parsed, sanitizedTaskId);
     try {
       const validated = EvidenceBundleSchema.parse(wrappedBundle);
       if (options?.migrate === false) {
@@ -4002,7 +4245,7 @@ async function loadEvidence(directory, taskId, options) {
           const tempPath = path9.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
           try {
             await bunWrite(tempPath, bundleJson);
-            await fs6.rename(tempPath, evidencePath);
+            await fs7.rename(tempPath, evidencePath);
           } catch (writeError) {
             try {
               rmSync(tempPath, { force: true });
@@ -4081,15 +4324,15 @@ async function checkRequirementCoverage(phase, directory) {
   const relativePath = path9.join("evidence", `req-coverage-phase-${phase}.json`);
   const absolutePath = path9.resolve(directory, ".swarm", relativePath);
   try {
-    await fs6.access(absolutePath);
+    await fs7.access(absolutePath);
     return { exists: true, path: absolutePath };
   } catch {
     return { exists: false, path: absolutePath };
   }
 }
 async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
-  const taskIds = await _internals10.listEvidenceTaskIds(directory);
-  const cutoffDate = options?.now ? new Date(options.now) : _internals10.now();
+  const taskIds = await _internals11.listEvidenceTaskIds(directory);
+  const cutoffDate = options?.now ? new Date(options.now) : _internals11.now();
   cutoffDate.setDate(cutoffDate.getDate() - maxAgeDays);
   const cutoffIso = cutoffDate.toISOString();
   const selected = new Set;
@@ -4101,7 +4344,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   for (const taskId of taskIds) {
     let result;
     try {
-      result = await _internals10.loadEvidence(directory, taskId);
+      result = await _internals11.loadEvidence(directory, taskId);
     } catch {
       warn("archive: skipping corrupt or unreadable evidence for task", taskId);
       continue;
@@ -4129,7 +4372,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   }
   if (!options?.dryRun) {
     for (const taskId of [...selected].sort()) {
-      const deleted = await _internals10.deleteEvidence(directory, taskId);
+      const deleted = await _internals11.deleteEvidence(directory, taskId);
       if (deleted)
         archived.push(taskId);
       else
@@ -4155,7 +4398,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   };
   if (typeof options?.cacheMaxBytes === "number" && options.cacheMaxBytes > 0 || typeof options?.cacheMaxRecords === "number" && options.cacheMaxRecords > 0) {
     try {
-      documentsCache = await _internals10.pruneEvidenceDocuments({
+      documentsCache = await _internals11.pruneEvidenceDocuments({
         directory,
         maxBytes: options?.cacheMaxBytes,
         maxRecords: options?.cacheMaxRecords,
@@ -4183,7 +4426,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
 function validateEvidence(evidence) {
   return EvidenceSchema.parse(evidence);
 }
-var _internals10 = {
+var _internals11 = {
   wrapFlatRetrospective,
   loadEvidence,
   listEvidenceTaskIds,
@@ -4305,4 +4548,4 @@ function mergeDurableGateEntriesFromEvidence(taskId, entries, evidence) {
   return merged;
 }
 
-export { getExecutor, init_executor, MAX_TRANSIENT_RETRIES, isTransientSpawnError, transientBackoff, getGitRepositoryStatus, isGitRepo, getDefaultBaseBranch, resetToRemoteBranch, resetToMainAfterMerge, isStateUnreadable, loadEpicSessionState, isEpicModeActive, enableEpicMode, disableEpicMode, normalizePath, pathsConflict, isGlobalFile, isProtectedPath, readTaskScopes, computeSpecHash, loadPlanJsonOnly, loadPlan, savePlan, closePlanTerminalState, derivePlanMarkdown, isValidEvidenceType, sanitizeTaskId2 as sanitizeTaskId, validateProjectRoot, saveEvidence, loadEvidence, listEvidenceTaskIds, checkRequirementCoverage, archiveEvidence, readDurableGateEvidence, getDurableGateEvidenceStatus, getDurableGateEvidenceStatusForTask, mergeDurableGateEntriesFromEvidence };
+export { getExecutor, init_executor, MAX_TRANSIENT_RETRIES, isTransientSpawnError, transientBackoff, getGitRepositoryStatus, isGitRepo, getDefaultBaseBranch, resetToRemoteBranch, resetToMainAfterMerge, containsPathTraversal, containsControlChars, isStateUnreadable, loadEpicSessionState, isEpicModeActive, enableEpicMode, disableEpicMode, normalizePath, pathsConflict, isGlobalFile, isProtectedPath, readTaskScopes, computeSpecHash, loadPlanJsonOnly, loadPlan, savePlan, closePlanTerminalState, derivePlanMarkdown, isValidEvidenceType, sanitizeTaskId2 as sanitizeTaskId, validateProjectRoot, saveEvidence, loadEvidence, listEvidenceTaskIds, checkRequirementCoverage, archiveEvidence, readDurableGateEvidence, getDurableGateEvidenceStatus, getDurableGateEvidenceStatusForTask, mergeDurableGateEntriesFromEvidence };