opencode-swarm 7.138.3 → 7.139.0

package/dist/cli/index-556ja8an.js

@@ -0,0 +1,62 @@
+// @bun
+// src/scope/path-identity.ts
+import * as path from "path";
+var BIDI_CONTROL_CHARACTERS = /[\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
+function isControlCharacter(character) {
+  const codePoint = character.codePointAt(0) ?? 0;
+  return codePoint <= 31 || codePoint >= 127 && codePoint <= 159;
+}
+function isBidiControlCharacter(character) {
+  return BIDI_CONTROL_CHARACTERS.test(character);
+}
+function getPathFlavor(pathLib = path) {
+  return pathLib.sep === "\\" ? "win32" : "posix";
+}
+function pathImplementation(flavor) {
+  return flavor === "win32" ? path.win32 : path.posix;
+}
+function normalizePathIdentity(value, flavor = getPathFlavor()) {
+  const pathImpl = pathImplementation(flavor);
+  const normalized = pathImpl.normalize(flavor === "win32" ? value.replace(/\//g, "\\") : value);
+  return flavor === "win32" ? normalized.toLowerCase() : normalized;
+}
+function pathIdentitiesEqual(a, b, flavor = getPathFlavor()) {
+  return normalizePathIdentity(a, flavor) === normalizePathIdentity(b, flavor);
+}
+function isPathIdentityWithin(target, container, flavor = getPathFlavor()) {
+  const pathImpl = pathImplementation(flavor);
+  const targetIdentity = normalizePathIdentity(target, flavor);
+  const containerIdentity = normalizePathIdentity(container, flavor);
+  if (targetIdentity === containerIdentity)
+    return true;
+  const relative = pathImpl.relative(containerIdentity, targetIdentity);
+  return relative.length > 0 && relative !== ".." && !relative.startsWith(`..${pathImpl.sep}`) && !pathImpl.isAbsolute(relative);
+}
+function isPathWithinDeclaredScope(filePath, scopeEntries, cwd = process.cwd(), flavor = getPathFlavor()) {
+  const pathImpl = pathImplementation(flavor);
+  const resolvedFile = pathImpl.resolve(cwd, filePath);
+  return scopeEntries.some((scope) => isPathIdentityWithin(resolvedFile, pathImpl.resolve(cwd, scope), flavor));
+}
+function isOnDifferentPathRoot(target, cwd, flavor = getPathFlavor()) {
+  const pathImpl = pathImplementation(flavor);
+  const targetRoot = pathImpl.parse(pathImpl.normalize(target)).root;
+  const cwdRoot = pathImpl.parse(pathImpl.normalize(cwd)).root;
+  return !pathIdentitiesEqual(targetRoot, cwdRoot, flavor);
+}
+function unsafePathTextReason(value) {
+  if ([...value].some(isControlCharacter)) {
+    return "control characters are not allowed in paths";
+  }
+  if ([...value].some(isBidiControlCharacter)) {
+    return "bidirectional control characters are not allowed in paths";
+  }
+  return null;
+}
+function sanitizeDiagnosticText(value, maxLength = 256) {
+  const rendered = String(value).split("").map((character) => isControlCharacter(character) || isBidiControlCharacter(character) ? "?" : character).join("").replace(/\s+/gu, " ").trim();
+  if (rendered.length <= maxLength)
+    return rendered;
+  return `${rendered.slice(0, Math.max(0, maxLength - 1))}\u2026`;
+}
+
+export { getPathFlavor, pathIdentitiesEqual, isPathIdentityWithin, isPathWithinDeclaredScope, isOnDifferentPathRoot, unsafePathTextReason, sanitizeDiagnosticText };

package/dist/cli/{index-31vfewmn.js → index-5bkpyvdf.js}

@@ -2,7 +2,16 @@
 import {
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-ab57h0yq.js";
+} from "./index-rtetrxxq.js";
+import {
+  getPathFlavor,
+  isOnDifferentPathRoot,
+  isPathIdentityWithin,
+  isPathWithinDeclaredScope,
+  pathIdentitiesEqual,
+  sanitizeDiagnosticText,
+  unsafePathTextReason
+} from "./index-556ja8an.js";
 import {
   init_constants
 } from "./index-3jcyn8g6.js";
@@ -2095,11 +2104,41 @@ function getGlobMatcher(pattern, caseInsensitive = true) {
     return () => false;
   }
 }
+var AUTHORITY_ROLE_CAPABILITIES = {
+  architect: "direct-write",
+  coder: "direct-write",
+  reviewer: "direct-write",
+  critic: "direct-write",
+  critic_oversight: "dedicated-tool-only",
+  critic_finding_validator: "dedicated-tool-only",
+  explorer: "read-only",
+  sme: "read-only",
+  researcher: "read-only",
+  test_engineer: "direct-write",
+  docs: "direct-write",
+  docs_design: "direct-write",
+  designer: "direct-write",
+  critic_sounding_board: "read-only",
+  critic_drift_verifier: "read-only",
+  critic_hallucination_verifier: "read-only",
+  critic_architecture_supervisor: "read-only",
+  curator_init: "dedicated-tool-only",
+  curator_phase: "dedicated-tool-only",
+  curator_postmortem: "dedicated-tool-only",
+  curator_consolidation: "dedicated-tool-only",
+  council_generalist: "read-only",
+  council_skeptic: "read-only",
+  council_domain_expert: "read-only",
+  skill_improver: "dedicated-tool-only",
+  spec_writer: "dedicated-tool-only"
+};
+var NON_WRITING_SWARM_RULES = Object.fromEntries(Object.entries(AUTHORITY_ROLE_CAPABILITIES).filter(([, capability]) => capability === "read-only" || capability === "dedicated-tool-only").map(([agent]) => [agent, { readOnly: true }]));
 var DEFAULT_AGENT_AUTHORITY_RULES = {
   build: {},
   plan: {},
   general: {},
   explore: {},
+  ...NON_WRITING_SWARM_RULES,
   architect: {
     blockedExact: [".swarm/plan.md", ".swarm/plan.json"],
     blockedZones: ["generated", "config"],
@@ -2189,6 +2228,22 @@ var DEFAULT_AGENT_AUTHORITY_RULES = {
     blockedZones: ["generated"]
   }
 };
+function matchesAuthorityDenyPrefix(candidate, prefix, cwd, flavor = getPathFlavor()) {
+  const pathImpl = flavor === "win32" ? path.win32 : path.posix;
+  const normalizeInput = (value) => flavor === "win32" ? value.replace(/\//g, "\\") : value;
+  const normalizedPrefixInput = normalizeInput(prefix);
+  const requiresComponentBoundary = normalizedPrefixInput.endsWith(pathImpl.sep);
+  const root = pathImpl.resolve(normalizeInput(cwd));
+  const target = pathImpl.resolve(root, normalizeInput(candidate));
+  const denied = pathImpl.resolve(root, normalizedPrefixInput);
+  if (!isPathIdentityWithin(target, root, flavor) || !isPathIdentityWithin(denied, root, flavor)) {
+    return false;
+  }
+  const identity = (value) => flavor === "win32" ? value.toLowerCase() : value;
+  const targetIdentity = identity(target);
+  const deniedIdentity = identity(denied);
+  return requiresComponentBoundary ? targetIdentity === deniedIdentity || targetIdentity.startsWith(`${deniedIdentity}${pathImpl.sep}`) : targetIdentity.startsWith(deniedIdentity);
+}
 function buildEffectiveRules(authorityConfig) {
   if (authorityConfig?.enabled === false || !authorityConfig?.rules) {
     return { ...DEFAULT_AGENT_AUTHORITY_RULES };
@@ -2220,21 +2275,37 @@ function buildEffectiveRules(authorityConfig) {
   return merged;
 }
 function isOnDifferentFilesystemRoot(targetAbsolute, cwdAbsolute, pathLib = path) {
-  return pathLib.parse(targetAbsolute).root !== pathLib.parse(cwdAbsolute).root;
+  const flavor = pathLib === path.win32 || pathLib.parse("C:\\probe").root !== "" ? "win32" : "posix";
+  return isOnDifferentPathRoot(targetAbsolute, cwdAbsolute, flavor);
 }
-function isInDeclaredScope(filePath, scopeEntries, cwd) {
-  const dir = cwd ?? process.cwd();
-  const caseInsensitive = process.platform === "win32";
-  const resolvedFileRaw = path.resolve(dir, filePath);
-  const resolvedFile = caseInsensitive ? resolvedFileRaw.toLowerCase() : resolvedFileRaw;
-  return scopeEntries.some((scope) => {
-    const resolvedScopeRaw = path.resolve(dir, scope);
-    const resolvedScope = caseInsensitive ? resolvedScopeRaw.toLowerCase() : resolvedScopeRaw;
-    if (resolvedFile === resolvedScope)
-      return true;
-    const rel = path.relative(resolvedScope, resolvedFile);
-    return rel.length > 0 && !rel.startsWith("..") && !path.isAbsolute(rel);
-  });
+var BUILT_IN_VERIFIER_CONFIG_GLOBS = [
+  "**/oxlintrc*",
+  "**/.oxlintrc*",
+  "**/.eslintrc*",
+  "**/eslint.config.*",
+  "**/.prettierrc*",
+  "**/prettier.config.*",
+  "**/biome.json",
+  "**/biome.jsonc",
+  "**/tsconfig*.json",
+  "**/.secretscanignore",
+  "**/.golangci*"
+];
+function denyAuthority(agent, normalizedPath, input) {
+  const safeAgent = sanitizeDiagnosticText(agent, 96);
+  const safePath = sanitizeDiagnosticText(normalizedPath, 320);
+  const safeDetail = sanitizeDiagnosticText(input.detail, 640);
+  return {
+    allowed: false,
+    code: input.code,
+    layer: input.layer,
+    rule: sanitizeDiagnosticText(input.rule, 128),
+    path: safePath,
+    agent: safeAgent,
+    reason: sanitizeDiagnosticText(`${input.code}: Path blocked: ${safeDetail} [agent=${safeAgent}; path=${safePath}]`, 1024),
+    recovery: input.recovery,
+    zone: input.zone
+  };
 }
 var MAX_ALLOWED_HINT_ENTRIES = 20;
 function formatAllowedHints(rules) {
@@ -2258,10 +2329,19 @@ function formatAllowedHints(rules) {
   parts.push("Block rules (blocked zones/prefixes/globs/exact) and universal deny paths still apply.");
   return parts.join(" ");
 }
-function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, options) {
+function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, options = {}) {
   const normalizedAgent = agentName.toLowerCase();
   const strippedAgent = stripKnownSwarmPrefix(agentName).toLowerCase();
   const dir = cwd || process.cwd();
+  const unsafePathReason = unsafePathTextReason(filePath);
+  if (unsafePathReason) {
+    return denyAuthority(agentName, filePath, {
+      code: "AUTHORITY_INVALID_PATH",
+      layer: "path-validation",
+      rule: "safe-path-text",
+      detail: unsafePathReason
+    });
+  }
   let normalizedPath;
   let resolvedTarget;
   try {
@@ -2273,71 +2353,160 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
     normalizedPath = path.relative(dir, resolvedTarget).replace(/\\/g, "/");
   }
   if (isOnDifferentFilesystemRoot(resolvedTarget, dir)) {
-    return {
-      allowed: false,
-      reason: `Path blocked: ${filePath} is on a different drive/root than the working directory`
-    };
+    return denyAuthority(agentName, normalizedPath, {
+      code: "AUTHORITY_ROOT_ESCAPE",
+      layer: "containment",
+      rule: "same-filesystem-root",
+      detail: "target is on a different drive or filesystem root"
+    });
   }
   if (normalizedPath === ".." || normalizedPath.startsWith("../")) {
-    return {
-      allowed: false,
-      reason: `Path blocked: ${normalizedPath} resolves outside the working directory`
-    };
+    return denyAuthority(agentName, normalizedPath, {
+      code: "AUTHORITY_ROOT_ESCAPE",
+      layer: "containment",
+      rule: "workspace-containment",
+      detail: "target resolves outside the working directory"
+    });
   }
   const rules = effectiveRules[normalizedAgent] ?? effectiveRules[strippedAgent];
   if (!rules) {
-    return { allowed: false, reason: `Unknown agent: ${agentName}` };
+    return denyAuthority(agentName, normalizedPath, {
+      code: "AUTHORITY_UNKNOWN_AGENT",
+      layer: "role-capability",
+      rule: "known-agent-role",
+      detail: "Unknown agent: no authority classification exists"
+    });
+  }
+  const flavor = getPathFlavor();
+  const matchesPathPrefix = (candidate, prefix) => isPathIdentityWithin(path.resolve(dir, candidate), path.resolve(dir, prefix), flavor);
+  const matchesGlob = (glob) => getGlobMatcher(glob)(normalizedPath);
+  for (const prefix of options.universalDenyPrefixes ?? []) {
+    if (matchesAuthorityDenyPrefix(normalizedPath, prefix, dir, flavor)) {
+      return denyAuthority(agentName, normalizedPath, {
+        code: "AUTHORITY_UNIVERSAL_DENY",
+        layer: "universal-deny",
+        rule: `universal:${prefix}`,
+        detail: `target is under universal deny prefix ${prefix}`
+      });
+    }
+  }
+  const isCoderAgent = normalizedAgent === "coder" || strippedAgent === "coder";
+  if (isCoderAgent && matchesPathPrefix(normalizedPath, ".swarm")) {
+    return denyAuthority(agentName, normalizedPath, {
+      code: "AUTHORITY_PROTECTED_PATH",
+      layer: "protected-path",
+      rule: "coder-swarm-state-protection",
+      detail: "coder writes to .swarm are always protected"
+    });
+  }
+  const isSwarmRole = Object.hasOwn(AUTHORITY_ROLE_CAPABILITIES, strippedAgent);
+  if (isSwarmRole) {
+    const matchedVerifier = [
+      ...BUILT_IN_VERIFIER_CONFIG_GLOBS,
+      ...options.verifierConfigPaths ?? []
+    ].find(matchesGlob);
+    if (matchedVerifier) {
+      return denyAuthority(agentName, normalizedPath, {
+        code: "AUTHORITY_VERIFIER_CONFIG",
+        layer: "protected-path",
+        rule: `verifier-config:${matchedVerifier}`,
+        detail: `Path blocked (glob ${matchedVerifier}): swarm roles cannot write verifier-owned configuration in the config zone`
+      });
+    }
+  }
+  const canonicalCapability = AUTHORITY_ROLE_CAPABILITIES[strippedAgent];
+  if (canonicalCapability === "read-only" || canonicalCapability === "dedicated-tool-only") {
+    return denyAuthority(agentName, normalizedPath, {
+      code: "AUTHORITY_ROLE_READ_ONLY",
+      layer: "role-capability",
+      rule: `role-capability:${canonicalCapability}`,
+      detail: canonicalCapability === "dedicated-tool-only" ? "role may mutate state only through dedicated tools" : "agent role is read-only"
+    });
   }
   if (rules.readOnly) {
+    return denyAuthority(agentName, normalizedPath, {
+      code: "AUTHORITY_ROLE_READ_ONLY",
+      layer: "role-capability",
+      rule: "role-policy:read-only",
+      detail: "agent role is read-only"
+    });
+  }
+  const pathIsInDeclaredScope = isCoderAgent && options.declaredScope != null && options.declaredScope.length > 0 && isPathWithinDeclaredScope(normalizedPath, options.declaredScope, dir);
+  if (pathIsInDeclaredScope) {
     return {
-      allowed: false,
-      reason: `Path blocked: ${normalizedPath} (agent ${normalizedAgent} is read-only)`
+      allowed: true,
+      layer: "declared-scope",
+      path: sanitizeDiagnosticText(normalizedPath, 320),
+      agent: sanitizeDiagnosticText(agentName, 96)
+    };
+  }
+  if (options.authorityEnabled === false) {
+    return {
+      allowed: true,
+      layer: "role-policy",
+      path: sanitizeDiagnosticText(normalizedPath, 320),
+      agent: sanitizeDiagnosticText(agentName, 96)
     };
   }
   if (rules.blockedExact) {
     for (const blocked of rules.blockedExact) {
-      if (normalizedPath === blocked) {
-        return {
-          allowed: false,
-          reason: `Path blocked (exact): ${normalizedPath}`
-        };
+      if (pathIdentitiesEqual(normalizedPath, blocked, flavor)) {
+        return denyAuthority(agentName, normalizedPath, {
+          code: "AUTHORITY_POLICY_DENY",
+          layer: "role-policy",
+          rule: `blockedExact:${blocked}`,
+          detail: `path is blocked by exact role policy ${blocked}`,
+          recovery: isCoderAgent ? "declare_scope" : undefined
+        });
       }
     }
   }
   if (rules.blockedGlobs && rules.blockedGlobs.length > 0) {
     for (const glob of rules.blockedGlobs) {
-      const matcher = getGlobMatcher(glob);
-      if (matcher(normalizedPath)) {
-        return {
-          allowed: false,
-          reason: `Path blocked (glob ${glob}): ${normalizedPath}`
-        };
+      if (matchesGlob(glob)) {
+        return denyAuthority(agentName, normalizedPath, {
+          code: "AUTHORITY_POLICY_DENY",
+          layer: "role-policy",
+          rule: `blockedGlob:${glob}`,
+          detail: `Path blocked (glob ${glob}) by role policy`,
+          recovery: isCoderAgent ? "declare_scope" : undefined
+        });
       }
     }
   }
   if (rules.allowedExact && rules.allowedExact.length > 0) {
-    const isExplicitlyAllowed = rules.allowedExact.some((allowed) => normalizedPath === allowed);
+    const isExplicitlyAllowed = rules.allowedExact.some((allowed) => pathIdentitiesEqual(normalizedPath, allowed, flavor));
     if (isExplicitlyAllowed) {
-      return { allowed: true };
+      return {
+        allowed: true,
+        layer: "role-policy",
+        path: normalizedPath,
+        agent: agentName
+      };
     }
   }
   if (rules.blockedZones && rules.blockedZones.length > 0) {
     const { zone } = classifyFile(normalizedPath);
     if (rules.blockedZones.includes(zone)) {
-      return {
-        allowed: false,
-        reason: `Path blocked: ${normalizedPath} is in ${zone} zone`,
+      return denyAuthority(agentName, normalizedPath, {
+        code: "AUTHORITY_POLICY_DENY",
+        layer: "role-policy",
+        rule: `blockedZone:${zone}`,
+        detail: `path is in ${zone} zone`,
+        recovery: isCoderAgent ? "declare_scope" : undefined,
         zone
-      };
+      });
     }
   }
   if (rules.allowedGlobs && rules.allowedGlobs.length > 0) {
-    const isGlobAllowed = rules.allowedGlobs.some((glob) => {
-      const matcher = getGlobMatcher(glob);
-      return matcher(normalizedPath);
-    });
+    const isGlobAllowed = rules.allowedGlobs.some(matchesGlob);
     if (isGlobAllowed) {
-      return { allowed: true };
+      return {
+        allowed: true,
+        layer: "role-policy",
+        path: normalizedPath,
+        agent: agentName
+      };
     }
   }
   if (rules.allowedCaseSensitiveGlobs && rules.allowedCaseSensitiveGlobs.length > 0) {
@@ -2346,59 +2515,67 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
       return matcher(normalizedPath);
     });
     if (isCaseSensitiveGlobAllowed) {
-      return { allowed: true };
+      return {
+        allowed: true,
+        layer: "role-policy",
+        path: normalizedPath,
+        agent: agentName
+      };
     }
   }
   if (rules.blockedPrefix && rules.blockedPrefix.length > 0) {
     for (const prefix of rules.blockedPrefix) {
-      if (normalizedPath.startsWith(prefix)) {
-        return {
-          allowed: false,
-          reason: `Path blocked: ${normalizedPath} is under ${prefix}`
-        };
-      }
-    }
-  }
-  const isCoderAgent = normalizedAgent === "coder" || strippedAgent === "coder";
-  const pathIsInDeclaredScope = isCoderAgent && options?.declaredScope != null && options.declaredScope.length > 0 && isInDeclaredScope(normalizedPath, options.declaredScope, dir);
-  if (!pathIsInDeclaredScope) {
-    if (rules.allowedPrefix != null && rules.allowedPrefix.length > 0) {
-      const isAllowed = rules.allowedPrefix.some((prefix) => normalizedPath.startsWith(prefix));
-      if (!isAllowed) {
-        return {
-          allowed: false,
-          reason: `Path ${normalizedPath} not in allowed list for ${normalizedAgent}. ${formatAllowedHints(rules)}`
-        };
-      }
-    } else if (rules.allowedPrefix != null && rules.allowedPrefix.length === 0) {
-      return {
-        allowed: false,
-        reason: `Path ${normalizedPath} not in allowed list for ${normalizedAgent}. ${formatAllowedHints(rules)}`
-      };
+      if (matchesPathPrefix(normalizedPath, prefix)) {
+        return denyAuthority(agentName, normalizedPath, {
+          code: "AUTHORITY_POLICY_DENY",
+          layer: "role-policy",
+          rule: `blockedPrefix:${prefix}`,
+          detail: `path is under blocked role prefix ${prefix}`,
+          recovery: isCoderAgent ? "declare_scope" : undefined
+        });
+      }
+    }
+  }
+  if (rules.allowedPrefix != null && rules.allowedPrefix.length > 0) {
+    const isAllowed = rules.allowedPrefix.some((prefix) => matchesPathPrefix(normalizedPath, prefix));
+    if (!isAllowed) {
+      return denyAuthority(agentName, normalizedPath, {
+        code: "AUTHORITY_POLICY_DENY",
+        layer: "role-policy",
+        rule: "allowedPrefix",
+        detail: `path is not in allowed list for this role. ${formatAllowedHints(rules)}`,
+        recovery: isCoderAgent ? "declare_scope" : undefined
+      });
     }
+  } else if (rules.allowedPrefix != null && rules.allowedPrefix.length === 0) {
+    return denyAuthority(agentName, normalizedPath, {
+      code: "AUTHORITY_POLICY_DENY",
+      layer: "role-policy",
+      rule: "allowedPrefix:empty",
+      detail: `path is not in allowed list because the role allowlist is empty. ${formatAllowedHints(rules)}`,
+      recovery: isCoderAgent ? "declare_scope" : undefined
+    });
   }
-  return { allowed: true };
+  return {
+    allowed: true,
+    layer: "role-policy",
+    path: normalizedPath,
+    agent: agentName
+  };
 }
-function checkFileAuthority(agentName, filePath, cwd, authorityConfig, options) {
-  return checkFileAuthorityWithRules(agentName, filePath, cwd, buildEffectiveRules(authorityConfig), options);
+function checkFileAuthority(agentName, filePath, cwd, authorityConfig, options = {}) {
+  return checkFileAuthorityWithRules(agentName, filePath, cwd, buildEffectiveRules(authorityConfig), {
+    ...options,
+    authorityEnabled: authorityConfig?.enabled ?? options.authorityEnabled,
+    universalDenyPrefixes: authorityConfig?.universal_deny_prefixes ?? options.universalDenyPrefixes,
+    verifierConfigPaths: authorityConfig?.verifier_config_paths ?? options.verifierConfigPaths
+  });
 }
 
 // src/hooks/guardrails/helpers.ts
 init_constants();
-import * as path2 from "path";
-function isInDeclaredScope2(filePath, scopeEntries, cwd) {
-  const dir = cwd ?? process.cwd();
-  const caseInsensitive = process.platform === "win32";
-  const resolvedFileRaw = path2.resolve(dir, filePath);
-  const resolvedFile = caseInsensitive ? resolvedFileRaw.toLowerCase() : resolvedFileRaw;
-  return scopeEntries.some((scope) => {
-    const resolvedScopeRaw = path2.resolve(dir, scope);
-    const resolvedScope = caseInsensitive ? resolvedScopeRaw.toLowerCase() : resolvedScopeRaw;
-    if (resolvedFile === resolvedScope)
-      return true;
-    const rel = path2.relative(resolvedScope, resolvedFile);
-    return rel.length > 0 && !rel.startsWith("..") && !path2.isAbsolute(rel);
-  });
+function isInDeclaredScope(filePath, scopeEntries, cwd) {
+  return isPathWithinDeclaredScope(filePath, scopeEntries, cwd);
 }
 function redactShellCommand(cmd) {
   if (typeof cmd !== "string")
@@ -2414,7 +2591,7 @@ function redactShellCommand(cmd) {
 
 // src/hooks/guardrails/audit-log.ts
 init_logger();
-import * as path3 from "path";
+import * as path2 from "path";
 function redactPath(filePath) {
   if (typeof filePath !== "string" || filePath.length === 0)
     return filePath;
@@ -2426,7 +2603,7 @@ function redactPath(filePath) {
   if (rawMacHomeMatch) {
     return `~${rawMacHomeMatch[2]}`;
   }
-  const normalized = path3.normalize(filePath);
+  const normalized = path2.normalize(filePath);
   const windowsHomeMatch = normalized.match(/^([A-Za-z]:\\Users\\[^\\]+)(\\.*)$/);
   if (windowsHomeMatch) {
     return `~\\${windowsHomeMatch[2]}`;
@@ -2438,4 +2615,4 @@ function redactPath(filePath) {
   return normalized;
 }
 
-export { stableCanonicalStringify, classifyFile, checkFileAuthority, isInDeclaredScope2 as isInDeclaredScope, redactShellCommand, redactPath };
+export { stableCanonicalStringify, classifyFile, checkFileAuthority, isInDeclaredScope, redactShellCommand, redactPath };

package/dist/cli/{index-wqg74mwj.js → index-67yqywan.js}

@@ -4,13 +4,13 @@ import {
 } from "./index-rtry5xyf.js";
 import {
   readKnowledgeEvents
-} from "./index-93ky909v.js";
+} from "./index-kv36s0x0.js";
 import {
   isLinked,
   readLinkPointer,
   resolveKnowledgeStoreDir,
   resolveLinkDir
-} from "./index-en4fb04r.js";
+} from "./index-tyh0p5e8.js";
 
 // src/knowledge/curation-policy.ts
 import { appendFile, mkdir as mkdir2, readFile as readFile2 } from "fs/promises";