opencode-swarm 7.138.4 → 7.139.1

package/dist/cli/{index-mycqmsz5.js → index-0wp67gqj.js}

@@ -3,7 +3,7 @@ import {
   EvaluationRunV1Schema,
   GateAuditResultV1Schema,
   getProtectedEvaluationRunIds
-} from "./index-ngqxzkqm.js";
+} from "./index-s608d3hw.js";
 import {
   readEffectiveSpecSync
 } from "./index-9ss2m4rs.js";
@@ -12,7 +12,7 @@ import {
   readTaskEvidence,
   readTaskEvidenceRaw,
   sanitizeTaskId
-} from "./index-39k6y018.js";
+} from "./index-5w7ekpy3.js";
 import {
   EVIDENCE_MAX_JSON_BYTES,
   EvidenceBundleSchema,
@@ -40,7 +40,7 @@ import {
   replayFromLedgerWithStatus,
   takeSnapshotEvent,
   takeSnapshotWithRetry
-} from "./index-4fmztnrq.js";
+} from "./index-4xbyy6aw.js";
 import {
   PlanSchema
 } from "./index-1kz6da87.js";
@@ -50,16 +50,17 @@ import {
 import {
   readSwarmFileAsync,
   validateSwarmPath
-} from "./index-4qzeef9h.js";
+} from "./index-x9q4bbhd.js";
 import {
+  invalidateCachedArtifact,
   readCachedParsedFile
-} from "./index-fsrp8wp3.js";
+} from "./index-ed5ykebp.js";
 import {
   withEvidenceLock
-} from "./index-xybtaph7.js";
+} from "./index-5j6chvj8.js";
 import {
   emit
-} from "./index-10mz5js6.js";
+} from "./index-a5eba0t8.js";
 import {
   ZodError,
   init_zod
@@ -980,7 +981,7 @@ import {
   writeFileSync as writeFileSync4
 } from "fs";
 import * as fsPromises from "fs/promises";
-import * as path7 from "path";
+import * as path8 from "path";
 
 // src/git/branch.ts
 init_executor();
@@ -1586,18 +1587,299 @@ var _internals5 = {
   readLaneEnvFileFromDiskSync
 };
 
-// src/turbo/epic/state.ts
+// src/services/run-memory.ts
+import * as crypto2 from "crypto";
+import * as fs2 from "fs/promises";
+
+// src/hooks/context-sanitizer.ts
+function sanitizeContextText(text) {
+  return text.split("").filter((char) => {
+    const code = char.charCodeAt(0);
+    return code === 9 || code === 10 || code === 13 || code > 31 && code !== 127;
+  }).join("").replace(/[\u00AD\u200B-\u200F\u2060-\u2064\uFEFF]/g, "").replace(/[\u202A-\u202E\u2066-\u2069]/g, "").replace(/```/g, "` ` `").replace(/^system\s*:/gim, "[BLOCKED]:").replace(/<system\b[^>]*>/gi, "[BLOCKED-TAG]").replace(/<\/system>/gi, "[/BLOCKED-TAG]").replace(/<tool_call\b[^>]*>/gi, "[BLOCKED-TOOL]").replace(/<\/tool_call>/gi, "[/BLOCKED-TOOL]").replace(/<\/\w+>/g, "[/BLOCKED-TAG]");
+}
+
+// src/services/run-memory.ts
 init_logger();
-import * as fs2 from "fs";
+
+// src/utils/path-security.ts
 import * as path5 from "path";
+function containsPathTraversal(str) {
+  if (/\.\.[/\\]/.test(str))
+    return true;
+  if (/(?:^|[/\\])\.\.(?:[/\\]|$)/.test(str))
+    return true;
+  if (/%2e%2e/i.test(str))
+    return true;
+  if (/%2e\./i.test(str))
+    return true;
+  if (/%2e/i.test(str) && /\.\./.test(str))
+    return true;
+  if (/%252e%252e/i.test(str))
+    return true;
+  if (/\uff0e/.test(str))
+    return true;
+  if (/\u3002/.test(str))
+    return true;
+  if (/\uff65/.test(str))
+    return true;
+  if (/%2f/i.test(str))
+    return true;
+  if (/%5c/i.test(str))
+    return true;
+  return false;
+}
+function containsControlChars(str) {
+  for (const ch of str) {
+    const code = ch.codePointAt(0);
+    if (code === undefined)
+      continue;
+    if (code <= 31 || code >= 127 && code <= 159)
+      return true;
+    if (code >= 8234 && code <= 8238)
+      return true;
+    if (code >= 8294 && code <= 8297)
+      return true;
+  }
+  return false;
+}
+function validateWorkspaceRoot(directory) {
+  validateProjectDirectory(directory);
+}
+function validateProjectDirectory(directory) {
+  if (!directory || directory.trim() === "") {
+    throw new Error("Invalid project directory: empty");
+  }
+  if (containsPathTraversal(directory)) {
+    throw new Error("Invalid project directory: path traversal detected");
+  }
+  if (containsControlChars(directory)) {
+    throw new Error("Invalid project directory: control characters detected");
+  }
+  if (!path5.isAbsolute(directory) && !/^[A-Za-z]:[/\\]/.test(directory)) {
+    throw new Error("Invalid project directory: must be an absolute path");
+  }
+  assertNotSystemLocation(directory);
+}
+var DENIED_ROOT_SUBTREES = new Set([
+  "etc",
+  "usr",
+  "bin",
+  "sbin",
+  "lib",
+  "lib64",
+  "boot",
+  "dev",
+  "proc",
+  "sys",
+  "windows",
+  "winnt",
+  "program files",
+  "program files (x86)",
+  "programdata",
+  "system volume information"
+]);
+var DENIED_EXACT_ROOT_CHILDREN = new Set(["users", "home", "root"]);
+function assertNotSystemLocation(directory) {
+  for (const parser of [path5.win32, path5.posix]) {
+    if (!parser.isAbsolute(directory))
+      continue;
+    const normalized = parser.normalize(directory);
+    const { root } = parser.parse(normalized);
+    const segments = normalized.slice(root.length).split(/[/\\]/).filter((segment) => segment.length > 0);
+    if (segments.length === 0) {
+      throw new Error(`Invalid project directory: filesystem root is not a project root (${directory})`);
+    }
+    const first = (segments[0] ?? "").toLowerCase();
+    if (DENIED_ROOT_SUBTREES.has(first) || segments.length === 1 && DENIED_EXACT_ROOT_CHILDREN.has(first)) {
+      throw new Error(`Invalid project directory: system location is not a project root (${directory})`);
+    }
+  }
+}
+
+// src/services/run-memory.ts
+var RUN_MEMORY_FILENAME = "run-memory.jsonl";
+var MAX_SUMMARY_TOKENS = 500;
+function generateTaskFingerprint(taskId, fileTargets) {
+  const sortedFiles = [...fileTargets].sort().join(",");
+  const hash = crypto2.createHash("sha256").update(taskId + sortedFiles).digest("hex");
+  return hash.slice(0, 8);
+}
+async function recordOutcome(directory, entry) {
+  validateWorkspaceRoot(directory);
+  const resolvedPath = validateSwarmPath(directory, RUN_MEMORY_FILENAME);
+  const line = `${JSON.stringify(entry)}
+`;
+  await fs2.appendFile(resolvedPath, line, { encoding: "utf-8" });
+}
+async function getTaskHistory(directory, taskId) {
+  validateWorkspaceRoot(directory);
+  const content = await readSwarmFileAsync(directory, RUN_MEMORY_FILENAME);
+  if (!content) {
+    return [];
+  }
+  const entries = [];
+  const lines = content.split(`
+`);
+  for (const line of lines) {
+    if (!line.trim())
+      continue;
+    try {
+      const entry = JSON.parse(line);
+      if (entry.taskId === taskId) {
+        entries.push(entry);
+      }
+    } catch {}
+  }
+  return entries;
+}
+async function recordTaskAttempt(directory, input) {
+  try {
+    let history = [];
+    try {
+      history = await _internals6.getTaskHistory(directory, input.taskId);
+    } catch (err) {
+      warn(`[run-memory] history read for task ${input.taskId} failed; recording with attemptNumber 1: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const entry = {
+      timestamp: new Date().toISOString(),
+      taskId: input.taskId,
+      taskFingerprint: _internals6.generateTaskFingerprint(input.taskId, input.fileTargets ?? []),
+      agent: input.agent,
+      outcome: input.outcome,
+      attemptNumber: history.length + 1
+    };
+    if (input.failureReason) {
+      entry.failureReason = input.failureReason;
+    }
+    if (input.fileTargets && input.fileTargets.length > 0) {
+      entry.filesModified = input.fileTargets;
+    }
+    if (typeof input.durationMs === "number") {
+      entry.durationMs = input.durationMs;
+    }
+    await _internals6.recordOutcome(directory, entry);
+  } catch (err) {
+    warn(`[run-memory] failed to record ${input.outcome} for task ${input.taskId}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function groupByTaskId(entries) {
+  const groups = new Map;
+  for (const entry of entries) {
+    const existing = groups.get(entry.taskId) || [];
+    existing.push(entry);
+    groups.set(entry.taskId, existing);
+  }
+  return groups;
+}
+function summarizeTask(taskId, entries) {
+  let lastFailure;
+  let lastFailureIndex = -1;
+  let lastPassIndex = -1;
+  let lastPass;
+  let failCount = 0;
+  entries.forEach((entry, index) => {
+    if (entry.outcome === "fail" || entry.outcome === "retry") {
+      failCount++;
+      lastFailure = entry;
+      lastFailureIndex = index;
+    } else if (entry.outcome === "pass") {
+      lastPass = entry;
+      lastPassIndex = index;
+    }
+  });
+  if (!lastFailure) {
+    return null;
+  }
+  const passResolvesFailure = lastPassIndex > lastFailureIndex;
+  if (lastPass && passResolvesFailure) {
+    const passAttempt = lastPass.attemptNumber;
+    const failAttempt = lastFailure.attemptNumber;
+    const reason = sanitizeContextText(lastFailure.failureReason || "unknown");
+    return `Task ${taskId}: FAILED attempt ${failAttempt} \u2014 ${reason}. Passed on attempt ${passAttempt}.`;
+  } else {
+    const reason = sanitizeContextText(lastFailure.failureReason || "unknown");
+    return `Task ${taskId}: FAILED ${failCount} times \u2014 last: ${reason}. Still failing.`;
+  }
+}
+async function getRunMemorySummary(directory) {
+  validateWorkspaceRoot(directory);
+  const content = await readSwarmFileAsync(directory, RUN_MEMORY_FILENAME);
+  if (!content) {
+    return null;
+  }
+  const entries = [];
+  const lines = content.split(`
+`);
+  for (const line of lines) {
+    if (!line.trim())
+      continue;
+    try {
+      const entry = JSON.parse(line);
+      entries.push(entry);
+    } catch {}
+  }
+  if (entries.length === 0) {
+    return null;
+  }
+  const groups = _internals6.groupByTaskId(entries);
+  const summaries = [];
+  for (const [taskId, taskEntries] of groups) {
+    const summary = _internals6.summarizeTask(taskId, taskEntries);
+    if (summary) {
+      summaries.push(summary);
+    }
+  }
+  if (summaries.length === 0) {
+    return null;
+  }
+  const prefix = `[FOR: architect, coder]
+## RUN MEMORY \u2014 Previous Task Outcomes
+`;
+  const suffix = `
+Use this data to avoid repeating known failure patterns.`;
+  let summaryText = summaries.join(`
+`);
+  const estimateTokens = (text) => {
+    return Math.ceil(text.length * 0.33);
+  };
+  const totalText = prefix + summaryText + suffix;
+  const estimatedTokens = estimateTokens(totalText);
+  if (estimatedTokens > MAX_SUMMARY_TOKENS) {
+    const prefixTokens = estimateTokens(prefix);
+    const suffixTokens = estimateTokens(suffix);
+    const availableContentTokens = MAX_SUMMARY_TOKENS - prefixTokens - suffixTokens;
+    if (availableContentTokens > 0) {
+      const maxContentChars = Math.floor(availableContentTokens / 0.33);
+      summaryText = summaryText.slice(0, maxContentChars);
+    } else {
+      summaryText = "";
+    }
+  }
+  return prefix + summaryText + suffix;
+}
+var _internals6 = {
+  generateTaskFingerprint,
+  recordOutcome,
+  recordTaskAttempt,
+  getTaskHistory,
+  getRunMemorySummary,
+  groupByTaskId,
+  summarizeTask
+};
+
+// src/turbo/epic/state.ts
+init_logger();
+import * as fs3 from "fs";
+import * as path6 from "path";
 var STATE_FILE = "epic-state.json";
 function nowISO() {
   return new Date().toISOString();
 }
 function ensureSwarmDir(directory) {
-  const swarmDir = path5.resolve(directory, ".swarm");
-  if (!fs2.existsSync(swarmDir)) {
-    fs2.mkdirSync(swarmDir, { recursive: true });
+  const swarmDir = path6.resolve(directory, ".swarm");
+  if (!fs3.existsSync(swarmDir)) {
+    fs3.mkdirSync(swarmDir, { recursive: true });
   }
   return swarmDir;
 }
@@ -1617,17 +1899,17 @@ function markStateUnreadable(directory, reason) {
 }
 function readPersisted(directory) {
   try {
-    const filePath = path5.join(directory, ".swarm", STATE_FILE);
-    if (!fs2.existsSync(filePath)) {
+    const filePath = path6.join(directory, ".swarm", STATE_FILE);
+    if (!fs3.existsSync(filePath)) {
       const seed = emptyPersisted();
       try {
         ensureSwarmDir(directory);
-        fs2.writeFileSync(filePath, `${JSON.stringify(seed, null, 2)}
+        fs3.writeFileSync(filePath, `${JSON.stringify(seed, null, 2)}
 `, "utf-8");
       } catch {}
       return seed;
     }
-    const raw = fs2.readFileSync(filePath, "utf-8");
+    const raw = fs3.readFileSync(filePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || parsed.version !== 1 || !parsed.sessions || typeof parsed.sessions !== "object" || Array.isArray(parsed.sessions)) {
       markStateUnreadable(directory, `malformed shape (version=${parsed?.version}, sessions type=${Array.isArray(parsed?.sessions) ? "array" : typeof parsed?.sessions})`);
@@ -1653,7 +1935,7 @@ function writePersisted(directory, persisted) {
   let payload;
   try {
     ensureSwarmDir(directory);
-    filePath = path5.join(directory, ".swarm", STATE_FILE);
+    filePath = path6.join(directory, ".swarm", STATE_FILE);
     tmpPath = `${filePath}.tmp.${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     persisted.updatedAt = nowISO();
     payload = `${JSON.stringify(persisted, null, 2)}
@@ -1664,14 +1946,14 @@ function writePersisted(directory, persisted) {
     throw new Error(`Epic state persistence prepare failed: ${msg}`);
   }
   try {
-    fs2.writeFileSync(tmpPath, payload, "utf-8");
-    fs2.renameSync(tmpPath, filePath);
+    fs3.writeFileSync(tmpPath, payload, "utf-8");
+    fs3.renameSync(tmpPath, filePath);
   } catch (error2) {
     const msg = error2 instanceof Error ? error2.message : String(error2);
     error(`[turbo/epic/state] Failed to persist ${STATE_FILE} atomically: ${msg}`);
     try {
-      if (fs2.existsSync(tmpPath))
-        fs2.unlinkSync(tmpPath);
+      if (fs3.existsSync(tmpPath))
+        fs3.unlinkSync(tmpPath);
     } catch {}
     throw new Error(`Epic state persistence failed: ${msg}`);
   }
@@ -1702,7 +1984,7 @@ function isEpicModeActive(directory, sessionID) {
 function isEpicModeActiveForProject(directory) {
   if (stateUnreadableMap.get(directory))
     return false;
-  if (!fs2.existsSync(path5.join(directory, ".swarm", STATE_FILE))) {
+  if (!fs3.existsSync(path6.join(directory, ".swarm", STATE_FILE))) {
     return false;
   }
   const persisted = readPersisted(directory);
@@ -1753,11 +2035,11 @@ function isLockContentionError(err) {
   return INDEX_LOCK_ERROR_RE.test(msg);
 }
 async function commitTaskCompletion(directory, taskId, description, scopePaths) {
-  if (!_internals6.isGitRepo(directory)) {
+  if (!_internals7.isGitRepo(directory)) {
     return { committed: false, reason: "no-git" };
   }
   try {
-    if (_internals6.hasExistingTaskCommit(directory, taskId)) {
+    if (_internals7.hasExistingTaskCommit(directory, taskId)) {
       return { committed: true, reason: "idempotent-skip" };
     }
   } catch {}
@@ -1778,15 +2060,15 @@ async function commitTaskCompletion(directory, taskId, description, scopePaths)
   for (let attempt = 0;attempt <= INDEX_LOCK_BACKOFF_MS.length; attempt++) {
     try {
       if (paths.length > 0) {
-        _internals6.stageScopedPaths(directory, paths);
+        _internals7.stageScopedPaths(directory, paths);
       }
-      _internals6.commitAllowEmpty(directory, message);
-      const sha = _internals6.gitHeadSha(directory);
+      _internals7.commitAllowEmpty(directory, message);
+      const sha = _internals7.gitHeadSha(directory);
       return { committed: true, reason: "success", sha };
     } catch (err) {
       lastError = err;
       if (attempt < INDEX_LOCK_BACKOFF_MS.length && isLockContentionError(err)) {
-        await _internals6.sleep(INDEX_LOCK_BACKOFF_MS[attempt]);
+        await _internals7.sleep(INDEX_LOCK_BACKOFF_MS[attempt]);
         continue;
       }
       break;
@@ -1796,7 +2078,7 @@ async function commitTaskCompletion(directory, taskId, description, scopePaths)
   criticalWarn(`[epic:task-commit] commit for task ${taskId} failed (non-fatal): ${msg}`);
   return { committed: false, reason: "commit-failed", error: msg };
 }
-var _internals6 = {
+var _internals7 = {
   isGitRepo: (cwd) => isGitRepo(cwd),
   stageScopedPaths: (cwd, paths) => {
     const CHUNK = 200;
@@ -1811,7 +2093,7 @@ var _internals6 = {
   gitHeadSha: (cwd) => {
     return _internals5.gitExec(["rev-parse", "HEAD"], cwd).trim();
   },
-  sleep: (ms) => new Promise((resolve2) => setTimeout(resolve2, ms)),
+  sleep: (ms) => new Promise((resolve3) => setTimeout(resolve3, ms)),
   hasExistingTaskCommit: (cwd, taskId) => {
     const safeId = scrubTaskIdForGitSubject(taskId);
     const escaped = safeId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1828,8 +2110,8 @@ var _internals6 = {
 };
 
 // src/turbo/lean/conflicts.ts
-import * as fs3 from "fs";
-import * as path6 from "path";
+import * as fs4 from "fs";
+import * as path7 from "path";
 
 // src/utils/path.ts
 function normalizePath(p) {
@@ -1957,12 +2239,12 @@ function isProtectedPath(normalizedPath) {
   return false;
 }
 function readTaskScopes(directory, taskId) {
-  const scopePath = path6.join(directory, ".swarm", "scopes", `scope-${taskId}.json`);
+  const scopePath = path7.join(directory, ".swarm", "scopes", `scope-${taskId}.json`);
   try {
-    if (!fs3.existsSync(scopePath)) {
+    if (!fs4.existsSync(scopePath)) {
       return null;
     }
-    const raw = fs3.readFileSync(scopePath, "utf-8");
+    const raw = fs4.readFileSync(scopePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || !Array.isArray(parsed.files)) {
       return null;
@@ -1974,17 +2256,17 @@ function readTaskScopes(directory, taskId) {
 }
 
 // src/utils/spec-hash.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import * as fsSync2 from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 async function computeSpecHash(directory) {
-  const spec = _internals7.readEffectiveSpecSync(directory);
+  const spec = _internals8.readEffectiveSpecSync(directory);
   if (!spec)
     return null;
-  return createHash("sha256").update(spec.content, "utf-8").digest("hex");
+  return createHash2("sha256").update(spec.content, "utf-8").digest("hex");
 }
 async function isSpecStale(directory, plan) {
-  const currentHash = await _internals7.computeSpecHash(directory);
+  const currentHash = await _internals8.computeSpecHash(directory);
   if (!plan.specHash) {
     return { stale: false };
   }
@@ -2005,7 +2287,7 @@ async function isSpecStale(directory, plan) {
   return { stale: false };
 }
 function isObligationPreserving(directory) {
-  const snapshotPath = join5(directory, ".swarm", "spec-snapshot.md");
+  const snapshotPath = join6(directory, ".swarm", "spec-snapshot.md");
   try {
     let recordedContent;
     try {
@@ -2013,15 +2295,15 @@ function isObligationPreserving(directory) {
     } catch {
       return false;
     }
-    const currentResult = _internals7.readEffectiveSpecSync(directory);
+    const currentResult = _internals8.readEffectiveSpecSync(directory);
     if (!currentResult || !currentResult.content) {
       return false;
     }
     const currentContent = currentResult.content;
-    const normalize = (text) => text.replace(/\r\n/g, `
+    const normalize2 = (text) => text.replace(/\r\n/g, `
 `);
-    const recordedNorm = normalize(recordedContent);
-    const currentNorm = normalize(currentContent);
+    const recordedNorm = normalize2(recordedContent);
+    const currentNorm = normalize2(currentContent);
     const splitParagraphs = (text) => text.split(/\n\s*\n/).map((p) => p.trim()).filter((p) => p.length > 0);
     const recordedParagraphs = splitParagraphs(recordedNorm);
     const currentParagraphs = splitParagraphs(currentNorm);
@@ -2043,7 +2325,7 @@ function isObligationPreserving(directory) {
     return false;
   }
 }
-var _internals7 = {
+var _internals8 = {
   computeSpecDiff,
   computeSpecHash,
   isObligationPreserving,
@@ -2051,7 +2333,7 @@ var _internals7 = {
   readEffectiveSpecSync
 };
 function computeSpecDiff(directory) {
-  const snapshotPath = join5(directory, ".swarm", "spec-snapshot.md");
+  const snapshotPath = join6(directory, ".swarm", "spec-snapshot.md");
   let recordedContent;
   try {
     const snapshotSize = fsSync2.statSync(snapshotPath).size;
@@ -2063,16 +2345,16 @@ function computeSpecDiff(directory) {
   } catch {
     return null;
   }
-  const spec = _internals7.readEffectiveSpecSync(directory);
+  const spec = _internals8.readEffectiveSpecSync(directory);
   if (!spec) {
     return null;
   }
   const currentContent = spec.content;
-  const normalize = (text) => text.replace(/\r\n/g, `
+  const normalize2 = (text) => text.replace(/\r\n/g, `
 `);
-  const recordedLines = normalize(recordedContent).split(`
+  const recordedLines = normalize2(recordedContent).split(`
 `);
-  const currentLines = normalize(currentContent).split(`
+  const currentLines = normalize2(currentContent).split(`
 `);
   const diffLines = computeLcsDiff(recordedLines, currentLines);
   const MAX_DIFF_LINES = 300;
@@ -2157,7 +2439,7 @@ var startupLedgerCheckedWorkspaces = new Set;
 var ledgerStaleWorkspaces = new Set;
 var recoveryMutexes = new Map;
 var PLAN_JSON_CACHE_NAMESPACE = "plan-json:validated:v1";
-var _internals8 = {
+var _internals9 = {
   loadPlan,
   loadPlanJsonOnly,
   regeneratePlanMarkdown,
@@ -2165,7 +2447,8 @@ var _internals8 = {
   isEpicModeActiveForProject,
   readTaskScopes,
   commitTaskCompletion,
-  getWorktreeMergeFailure
+  getWorktreeMergeFailure,
+  recordTaskAttempt
 };
 var CAS_BACKOFF_START_MS = 5;
 var CAS_BACKOFF_CAP_MS = 250;
@@ -2254,7 +2537,7 @@ async function retryCasWithBackoff(directory, eventInput, options) {
         expectedHashPrefix: currentExpected.slice(0, 8),
         delayMs
       });
-      await new Promise((resolve3) => setTimeout(resolve3, delayMs));
+      await new Promise((resolve4) => setTimeout(resolve4, delayMs));
       if (options.verifyValid) {
         const stillValid = await options.verifyValid();
         if (!stillValid)
@@ -2297,7 +2580,7 @@ async function getLatestLedgerHash(directory) {
   }
 }
 async function surfaceLedgerStaleIfPersisted(directory, plan) {
-  const resolvedWorkspace = path7.resolve(directory);
+  const resolvedWorkspace = path8.resolve(directory);
   if (!ledgerStaleWorkspaces.has(resolvedWorkspace)) {
     return plan;
   }
@@ -2316,7 +2599,7 @@ async function surfaceLedgerStaleIfPersisted(directory, plan) {
   return plan;
 }
 async function parsePlanJsonCached(directory) {
-  const planJsonPath = path7.resolve(directory, ".swarm", "plan.json");
+  const planJsonPath = path8.resolve(directory, ".swarm", "plan.json");
   return readCachedParsedFile(planJsonPath, PLAN_JSON_CACHE_NAMESPACE, () => readSwarmFileAsync(directory, "plan.json"), (planJsonContent) => {
     if (planJsonContent.includes("\x00") || planJsonContent.includes("\uFFFD")) {
       throw new Error("Plan rejected: .swarm/plan.json contains null bytes or invalid encoding");
@@ -2376,13 +2659,13 @@ async function isPlanMdInSync(directory, plan, cache) {
   return false;
 }
 async function regeneratePlanMarkdown(directory, plan) {
-  const swarmDir = path7.resolve(directory, ".swarm");
+  const swarmDir = path8.resolve(directory, ".swarm");
   const contentHash = computePlanContentHash(plan);
   const markdown = derivePlanMarkdown(plan);
   const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-  const mdPath = path7.join(swarmDir, "plan.md");
-  const mdTempPath = path7.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const mdPath = path8.join(swarmDir, "plan.md");
+  const mdTempPath = path8.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   try {
     await bunWrite(mdTempPath, markdownWithHash);
     renameSync2(mdTempPath, mdPath);
@@ -2391,6 +2674,7 @@ ${markdown}`;
       unlinkSync2(mdTempPath);
     } catch {}
   }
+  invalidateCachedArtifact(mdPath);
 }
 async function loadPlan(directory, cache) {
   const planJsonContent = await readSwarmFileAsync(directory, "plan.json", cache);
@@ -2406,7 +2690,7 @@ async function loadPlan(directory, cache) {
           const inSync = await isPlanMdInSync(directory, validated, cache);
           if (!inSync) {
             try {
-              await _internals8.regeneratePlanMarkdown(directory, validated);
+              await _internals9.regeneratePlanMarkdown(directory, validated);
             } catch (regenError) {
               warn(`Failed to regenerate plan.md: ${regenError instanceof Error ? regenError.message : String(regenError)}. Proceeding with plan.json only.`);
             }
@@ -2414,7 +2698,7 @@ async function loadPlan(directory, cache) {
           if (await ledgerExists(directory)) {
             const planHash = computePlanHash(validated);
             const ledgerHash = await getLatestLedgerHash(directory);
-            const resolvedWorkspace = path7.resolve(directory);
+            const resolvedWorkspace = path8.resolve(directory);
             if (!startupLedgerCheckedWorkspaces.has(resolvedWorkspace)) {
               startupLedgerCheckedWorkspaces.add(resolvedWorkspace);
               if (ledgerHash !== "" && planHash !== ledgerHash) {
@@ -2488,7 +2772,7 @@ async function loadPlan(directory, cache) {
               if (!preserving) {
                 try {
                   const diffInfo = computeSpecDiff(directory);
-                  const specStalenessPath = path7.join(directory, ".swarm", "spec-staleness.json");
+                  const specStalenessPath = path8.join(directory, ".swarm", "spec-staleness.json");
                   await fsPromises.writeFile(specStalenessPath, JSON.stringify({
                     type: "spec_stale_detected",
                     timestamp: new Date().toISOString(),
@@ -2500,9 +2784,10 @@ async function loadPlan(directory, cache) {
                     diff: diffInfo?.diff ?? null,
                     changedSections: diffInfo?.changedSections ?? []
                   }, null, 2), "utf-8");
+                  invalidateCachedArtifact(specStalenessPath);
                 } catch {}
                 try {
-                  const eventsPath = path7.join(directory, ".swarm", "events.jsonl");
+                  const eventsPath = path8.join(directory, ".swarm", "events.jsonl");
                   const event = {
                     type: "spec_stale_detected",
                     timestamp: new Date().toISOString(),
@@ -2568,11 +2853,11 @@ async function loadPlan(directory, cache) {
     return migrated;
   }
   if (await ledgerExists(directory)) {
-    const resolvedDir = path7.resolve(directory);
+    const resolvedDir = path8.resolve(directory);
     const existingMutex = recoveryMutexes.get(resolvedDir);
     if (existingMutex) {
       await existingMutex;
-      const postRecoveryPlan = await _internals8.loadPlanJsonOnly(directory);
+      const postRecoveryPlan = await _internals9.loadPlanJsonOnly(directory);
       if (postRecoveryPlan)
         return postRecoveryPlan;
     }
@@ -2632,7 +2917,7 @@ async function loadPlan(directory, cache) {
   return null;
 }
 async function savePlanWithAutoAcknowledgedRemovals(directory, plan, source, reason, options) {
-  const existing = await _internals8.loadPlanJsonOnly(directory);
+  const existing = await _internals9.loadPlanJsonOnly(directory);
   const newIds = new Set;
   for (const phase of plan.phases) {
     for (const task of phase.tasks)
@@ -2660,7 +2945,7 @@ async function savePlan(directory, plan, options) {
   const validated = PlanSchema.parse(plan);
   if (options?.preserveCompletedStatuses !== false) {
     try {
-      const currentPlan2 = await _internals8.loadPlanJsonOnly(directory);
+      const currentPlan2 = await _internals9.loadPlanJsonOnly(directory);
       if (currentPlan2) {
         const completedTaskIds = new Set;
         for (const phase of currentPlan2.phases) {
@@ -2682,7 +2967,7 @@ async function savePlan(directory, plan, options) {
     } catch {}
   }
   derivePhaseStatusesInPlace(validated);
-  const currentPlan = await _internals8.loadPlanJsonOnly(directory);
+  const currentPlan = await _internals9.loadPlanJsonOnly(directory);
   const planId = derivePlanId(validated);
   const planHashForInit = computePlanHash(validated);
   if (!await ledgerExists(directory)) {
@@ -2697,9 +2982,9 @@ async function savePlan(directory, plan, options) {
   } else {
     const existingEvents = await readLedgerEvents(directory);
     if (existingEvents.length > 0 && existingEvents[0].plan_id !== planId) {
-      const swarmDir2 = path7.resolve(directory, ".swarm");
-      const oldLedgerPath = path7.join(swarmDir2, "plan-ledger.jsonl");
-      const oldLedgerBackupPath = path7.join(swarmDir2, `plan-ledger.backup-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
+      const swarmDir2 = path8.resolve(directory, ".swarm");
+      const oldLedgerPath = path8.join(swarmDir2, "plan-ledger.jsonl");
+      const oldLedgerBackupPath = path8.join(swarmDir2, `plan-ledger.backup-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
       let backupExists = false;
       if (existsSync3(oldLedgerPath)) {
         try {
@@ -2737,7 +3022,7 @@ async function savePlan(directory, plan, options) {
         }
       }
       if (initSucceeded && backupExists) {
-        const archivePath = path7.join(swarmDir2, `plan-ledger.archived-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
+        const archivePath = path8.join(swarmDir2, `plan-ledger.archived-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
         try {
           renameSync2(oldLedgerBackupPath, archivePath);
           warn(`[savePlan] Ledger identity mismatch (was "${existingEvents[0].plan_id}", now "${planId}") \u2014 archived old ledger to ${archivePath} and reinitializing.`);
@@ -2762,7 +3047,7 @@ async function savePlan(directory, plan, options) {
           const toRemove = archivedSiblings.slice(0, archivedSiblings.length - MAX_ARCHIVED_SIBLINGS);
           for (const file of toRemove) {
             try {
-              unlinkSync2(path7.join(swarmDir2, file));
+              unlinkSync2(path8.join(swarmDir2, file));
             } catch {}
           }
         }
@@ -2827,7 +3112,7 @@ async function savePlan(directory, plan, options) {
             expectedHash: currentHash,
             planHashAfter: hashAfter,
             verifyValid: async () => {
-              const onDisk = await _internals8.loadPlanJsonOnly(directory);
+              const onDisk = await _internals9.loadPlanJsonOnly(directory);
               if (!onDisk)
                 return true;
               for (const p of onDisk.phases) {
@@ -2865,7 +3150,7 @@ async function savePlan(directory, plan, options) {
               expectedHash: currentHash,
               planHashAfter: hashAfter,
               verifyValid: async () => {
-                const onDisk = await _internals8.loadPlanJsonOnly(directory);
+                const onDisk = await _internals9.loadPlanJsonOnly(directory);
                 if (!onDisk)
                   return true;
                 for (const p of onDisk.phases) {
@@ -2905,9 +3190,9 @@ async function savePlan(directory, plan, options) {
       source: "savePlan_manager"
     });
   }
-  const swarmDir = path7.resolve(directory, ".swarm");
-  const planPath = path7.join(swarmDir, "plan.json");
-  const tempPath = path7.join(swarmDir, `plan.json.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const swarmDir = path8.resolve(directory, ".swarm");
+  const planPath = path8.join(swarmDir, "plan.json");
+  const tempPath = path8.join(swarmDir, `plan.json.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   try {
     await bunWrite(tempPath, JSON.stringify(projectedPlan, null, 2));
     renameSync2(tempPath, planPath);
@@ -2916,8 +3201,9 @@ async function savePlan(directory, plan, options) {
       unlinkSync2(tempPath);
     } catch {}
   }
+  invalidateCachedArtifact(planPath);
   try {
-    const markerPath = path7.join(swarmDir, ".plan-write-marker");
+    const markerPath = path8.join(swarmDir, ".plan-write-marker");
     const inProgressMarker = JSON.stringify({
       source: "plan_manager",
       timestamp: new Date().toISOString(),
@@ -2932,8 +3218,8 @@ async function savePlan(directory, plan, options) {
     const markdown = derivePlanMarkdown(projectedPlan);
     const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-    const mdPath = path7.join(swarmDir, "plan.md");
-    const mdTempPath = path7.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+    const mdPath = path8.join(swarmDir, "plan.md");
+    const mdTempPath = path8.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
     try {
       await bunWrite(mdTempPath, markdownWithHash);
       renameSync2(mdTempPath, mdPath);
@@ -2942,6 +3228,7 @@ ${markdown}`;
         unlinkSync2(mdTempPath);
       } catch {}
     }
+    invalidateCachedArtifact(mdPath);
   } catch (mdError) {
     const message = mdError instanceof Error ? mdError.message : String(mdError);
     warn(`[savePlan] plan.md write failed (non-fatal, plan.json is authoritative): ${message}`);
@@ -2954,7 +3241,7 @@ ${markdown}`;
     } catch {}
   }
   try {
-    const markerPath = path7.join(swarmDir, ".plan-write-marker");
+    const markerPath = path8.join(swarmDir, ".plan-write-marker");
     const tasksCount = projectedPlan.phases.reduce((sum, phase) => sum + phase.tasks.length, 0);
     const marker = JSON.stringify({
       source: "plan_manager",
@@ -2970,11 +3257,11 @@ async function rebuildPlan(directory, plan, options) {
   const targetPlan = plan ?? await replayFromLedger(directory);
   if (!targetPlan)
     return null;
-  const swarmDir = path7.join(directory, ".swarm");
-  const planPath = path7.join(swarmDir, "plan.json");
-  const mdPath = path7.join(swarmDir, "plan.md");
+  const swarmDir = path8.join(directory, ".swarm");
+  const planPath = path8.join(swarmDir, "plan.json");
+  const mdPath = path8.join(swarmDir, "plan.md");
   mkdirSync3(swarmDir, { recursive: true });
-  const tempPlanPath = path7.join(swarmDir, `plan.json.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const tempPlanPath = path8.join(swarmDir, `plan.json.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   {
     const fd = openSync(tempPlanPath, "w");
     try {
@@ -2985,8 +3272,9 @@ async function rebuildPlan(directory, plan, options) {
     }
   }
   renameSync2(tempPlanPath, planPath);
+  invalidateCachedArtifact(planPath);
   try {
-    const markerPath = path7.join(swarmDir, ".plan-write-marker");
+    const markerPath = path8.join(swarmDir, ".plan-write-marker");
     const inProgressMarker = JSON.stringify({
       source: "plan_manager",
       timestamp: new Date().toISOString(),
@@ -3001,12 +3289,13 @@ async function rebuildPlan(directory, plan, options) {
     const markdown = derivePlanMarkdown(targetPlan);
     const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-    const tempMdPath = path7.join(swarmDir, `plan.md.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+    const tempMdPath = path8.join(swarmDir, `plan.md.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
     await bunWrite(tempMdPath, markdownWithHash);
     renameSync2(tempMdPath, mdPath);
+    invalidateCachedArtifact(mdPath);
   } finally {
     try {
-      const markerPath = path7.join(swarmDir, ".plan-write-marker");
+      const markerPath = path8.join(swarmDir, ".plan-write-marker");
       const tasksCount = targetPlan.phases.reduce((sum, phase) => sum + phase.tasks.length, 0);
       const marker = JSON.stringify({
         source: "plan_manager",
@@ -3069,13 +3358,14 @@ async function closePlanTerminalState(directory, plan, options) {
     planHashAfter: hashAfter,
     source: "close_terminal"
   });
-  const swarmDir = path7.join(directory, ".swarm");
-  const planPath = path7.join(swarmDir, "plan.json");
-  const tempPlanPath = path7.join(swarmDir, `plan.json.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const swarmDir = path8.join(directory, ".swarm");
+  const planPath = path8.join(swarmDir, "plan.json");
+  const tempPlanPath = path8.join(swarmDir, `plan.json.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   await bunWrite(tempPlanPath, JSON.stringify(validated, null, 2));
   renameSync2(tempPlanPath, planPath);
+  invalidateCachedArtifact(planPath);
   try {
-    const markerPath = path7.join(swarmDir, ".plan-write-marker");
+    const markerPath = path8.join(swarmDir, ".plan-write-marker");
     const inProgressMarker = JSON.stringify({
       source: "plan_manager_close",
       timestamp: new Date().toISOString(),
@@ -3086,17 +3376,18 @@ async function closePlanTerminalState(directory, plan, options) {
     await bunWrite(markerPath, inProgressMarker);
   } catch {}
   try {
-    const mdPath = path7.join(swarmDir, "plan.md");
+    const mdPath = path8.join(swarmDir, "plan.md");
     const contentHash = computePlanContentHash(validated);
     const markdown = derivePlanMarkdown(validated);
     const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-    const mdTempPath = path7.join(swarmDir, `plan.md.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+    const mdTempPath = path8.join(swarmDir, `plan.md.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
     await bunWrite(mdTempPath, markdownWithHash);
     renameSync2(mdTempPath, mdPath);
+    invalidateCachedArtifact(mdPath);
   } finally {
     try {
-      const markerPath = path7.join(swarmDir, ".plan-write-marker");
+      const markerPath = path8.join(swarmDir, ".plan-write-marker");
       const tasksCount = validated.phases.reduce((sum, phase) => sum + phase.tasks.length, 0);
       const marker = JSON.stringify({
         source: "plan_manager_close",
@@ -3391,13 +3682,13 @@ import {
   rmSync,
   statSync as statSync2
 } from "fs";
-import * as fs6 from "fs/promises";
+import * as fs7 from "fs/promises";
 import * as os4 from "os";
-import * as path9 from "path";
+import * as path10 from "path";
 
 // src/evaluation/retention.ts
-import * as fs4 from "fs/promises";
-import * as path8 from "path";
+import * as fs5 from "fs/promises";
+import * as path9 from "path";
 function artifactKey(artifact) {
   return `${artifact.namespace}/${artifact.id}`;
 }
@@ -3405,10 +3696,10 @@ function validId(value) {
   return /^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$/.test(value);
 }
 async function evaluationRunCandidates(directory) {
-  const root = path8.join(directory, ".swarm", "evolution", "runs");
+  const root = path9.join(directory, ".swarm", "evolution", "runs");
   let entries = [];
   try {
-    entries = await fs4.readdir(root, { withFileTypes: true });
+    entries = await fs5.readdir(root, { withFileTypes: true });
   } catch (error2) {
     if (error2.code === "ENOENT") {
       return { candidates: [], corrupt: [] };
@@ -3424,9 +3715,9 @@ async function evaluationRunCandidates(directory) {
     if (!validId(id))
       continue;
     const artifact = { namespace: "evaluation-run", id };
-    const target = path8.join(root, entry.name);
+    const target = path9.join(root, entry.name);
     try {
-      const run = EvaluationRunV1Schema.parse(JSON.parse(await fs4.readFile(target, "utf8")));
+      const run = EvaluationRunV1Schema.parse(JSON.parse(await fs5.readFile(target, "utf8")));
       if (run.runId !== id)
         throw new Error("run id/path mismatch");
       candidates.push({
@@ -3442,10 +3733,10 @@ async function evaluationRunCandidates(directory) {
   return { candidates, corrupt };
 }
 async function gateAuditCandidates(directory) {
-  const root = path8.join(directory, ".swarm", "evidence", "gate-audit");
+  const root = path9.join(directory, ".swarm", "evidence", "gate-audit");
   let entries = [];
   try {
-    entries = await fs4.readdir(root, { withFileTypes: true });
+    entries = await fs5.readdir(root, { withFileTypes: true });
   } catch (error2) {
     if (error2.code === "ENOENT") {
       return { candidates: [], corrupt: [] };
@@ -3458,9 +3749,9 @@ async function gateAuditCandidates(directory) {
     if (!entry.isDirectory() || !validId(entry.name))
       continue;
     const artifact = { namespace: "gate-audit", id: entry.name };
-    const target = path8.join(root, entry.name);
+    const target = path9.join(root, entry.name);
     try {
-      const result = GateAuditResultV1Schema.parse(JSON.parse(await fs4.readFile(path8.join(target, "results.json"), "utf8")));
+      const result = GateAuditResultV1Schema.parse(JSON.parse(await fs5.readFile(path9.join(target, "results.json"), "utf8")));
       if (result.runId !== entry.name)
         throw new Error("run id/path mismatch");
       candidates.push({
@@ -3491,17 +3782,17 @@ async function protectedArtifacts(directory) {
 }
 async function removeCandidate(candidate) {
   if (candidate.kind === "directory") {
-    await fs4.rm(candidate.target, { recursive: true, force: true });
+    await fs5.rm(candidate.target, { recursive: true, force: true });
     return;
   }
-  await fs4.unlink(candidate.target);
+  await fs5.unlink(candidate.target);
 }
 var _retentionInternals = {
   protectedArtifacts,
   removeCandidate
 };
 async function archiveEvaluationArtifacts(args) {
-  return withEvidenceLock(args.directory, path8.join("evolution", "retention-index"), "evaluation-retention", "archive", async () => {
+  return withEvidenceLock(args.directory, path9.join("evolution", "retention-index"), "evaluation-retention", "archive", async () => {
     const inventory = await retentionCandidates(args.directory);
     let protectedKeys = await _retentionInternals.protectedArtifacts(args.directory);
     const protectedRefs = inventory.candidates.filter((candidate) => protectedKeys.has(artifactKey(candidate.artifact))).map((candidate) => candidate.artifact);
@@ -3550,7 +3841,7 @@ async function archiveEvaluationArtifacts(args) {
 }
 
 // src/evidence/documents-retention.ts
-import * as fs5 from "fs";
+import * as fs6 from "fs";
 import * as fsp from "fs/promises";
 import * as readline from "readline";
 var EVIDENCE_CACHE_FILE = "evidence-cache/documents.jsonl";
@@ -3558,13 +3849,13 @@ var MAX_READ_BYTES = 100 * 1024 * 1024;
 var RENAME_MAX_ATTEMPTS = 5;
 var RENAME_BACKOFF_MS = 10;
 var RENAME_RETRY_CODES = new Set(["EPERM", "EBUSY", "ENOTEMPTY", "EACCES"]);
-var _internals9 = {
+var _internals10 = {
   stat: (p) => fsp.stat(p),
-  createReadStream: (p, options) => fs5.createReadStream(p, options),
-  openSync: (p, flags) => fs5.openSync(p, flags),
-  writeSync: (fd, data, position) => fs5.writeSync(fd, data, position),
-  fsyncSync: (fd) => fs5.fsyncSync(fd),
-  closeSync: (fd) => fs5.closeSync(fd),
+  createReadStream: (p, options) => fs6.createReadStream(p, options),
+  openSync: (p, flags) => fs6.openSync(p, flags),
+  writeSync: (fd, data, position) => fs6.writeSync(fd, data, position),
+  fsyncSync: (fd) => fs6.fsyncSync(fd),
+  closeSync: (fd) => fs6.closeSync(fd),
   renameWithRetry: atomicRenameWithRetry,
   unlink: (p) => fsp.unlink(p)
 };
@@ -3581,7 +3872,7 @@ async function atomicRenameWithRetry(src, dst, renameFn = fsp.rename) {
         throw err;
       }
       if (attempt < RENAME_MAX_ATTEMPTS - 1) {
-        await new Promise((resolve3) => setTimeout(resolve3, RENAME_BACKOFF_MS));
+        await new Promise((resolve4) => setTimeout(resolve4, RENAME_BACKOFF_MS));
       }
     }
   }
@@ -3600,9 +3891,9 @@ function emptyResult(dryRun) {
   };
 }
 async function readCacheRows(filePath) {
-  const stat2 = await _internals9.stat(filePath);
+  const stat2 = await _internals10.stat(filePath);
   const bytesBefore = stat2.size;
-  const stream = _internals9.createReadStream(filePath, {
+  const stream = _internals10.createReadStream(filePath, {
     encoding: "utf8",
     highWaterMark: 64 * 1024
   });
@@ -3678,23 +3969,23 @@ async function rewriteAtomic(filePath, survivors) {
 `)}
 ` : "";
   let succeeded = false;
-  const fd = _internals9.openSync(tmpPath, "w");
+  const fd = _internals10.openSync(tmpPath, "w");
   try {
-    _internals9.writeSync(fd, payload, 0);
-    _internals9.fsyncSync(fd);
-    _internals9.closeSync(fd);
-    await _internals9.renameWithRetry(tmpPath, filePath);
+    _internals10.writeSync(fd, payload, 0);
+    _internals10.fsyncSync(fd);
+    _internals10.closeSync(fd);
+    await _internals10.renameWithRetry(tmpPath, filePath);
     succeeded = true;
   } catch (err) {
     try {
-      _internals9.closeSync(fd);
+      _internals10.closeSync(fd);
     } catch {}
     const msg = err instanceof Error ? err.message : String(err);
     throw new Error(`documents-cache rewrite failed: ${msg}`);
   } finally {
     if (!succeeded) {
       try {
-        await _internals9.unlink(tmpPath);
+        await _internals10.unlink(tmpPath);
       } catch {}
     }
   }
@@ -3706,7 +3997,7 @@ async function pruneEvidenceDocuments(args) {
   const filePath = validateSwarmPath(args.directory, EVIDENCE_CACHE_FILE);
   let stat2;
   try {
-    stat2 = await _internals9.stat(filePath);
+    stat2 = await _internals10.stat(filePath);
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT")
@@ -3824,8 +4115,8 @@ function isWeakConfigContainerRoot(directory) {
     const resolved = realpathSync(directory);
     return resolved === realpathSync(os4.tmpdir()) || resolved === realpathSync(os4.homedir());
   } catch {
-    const resolved = path9.resolve(directory);
-    return resolved === path9.resolve(os4.tmpdir()) || resolved === path9.resolve(os4.homedir());
+    const resolved = path10.resolve(directory);
+    return resolved === path10.resolve(os4.tmpdir()) || resolved === path10.resolve(os4.homedir());
   }
 }
 function hasAccessibleProjectIndicator(directory, options = {}) {
@@ -3835,7 +4126,7 @@ function hasAccessibleProjectIndicator(directory, options = {}) {
       continue;
     }
     try {
-      const indicatorStat = statSync2(path9.join(directory, indicator));
+      const indicatorStat = statSync2(path10.join(directory, indicator));
       if (indicatorStat.isFile() || indicatorStat.isDirectory()) {
         return true;
       }
@@ -3857,14 +4148,14 @@ function validateProjectRoot(directory) {
     if (depth >= MAX_DEPTH)
       break;
     depth++;
-    const parent = path9.dirname(current);
+    const parent = path10.dirname(current);
     if (parent === current)
       break;
-    if (path9.dirname(parent) === parent) {
+    if (path10.dirname(parent) === parent) {
       current = parent;
       continue;
     }
-    const parentSwarm = path9.join(parent, ".swarm");
+    const parentSwarm = path10.join(parent, ".swarm");
     try {
       if (statSync2(parentSwarm).isDirectory()) {
         if (hasAccessibleProjectIndicator(parent, {
@@ -3883,14 +4174,14 @@ function validateProjectRoot(directory) {
   }
 }
 async function saveEvidence(directory, taskId, evidence) {
-  _internals10.validateProjectRoot(directory);
+  _internals11.validateProjectRoot(directory);
   const sanitizedTaskId = sanitizeTaskId2(taskId);
-  const relativePath = path9.join("evidence", sanitizedTaskId, "evidence.json");
+  const relativePath = path10.join("evidence", sanitizedTaskId, "evidence.json");
   validateSwarmPath(directory, relativePath);
-  _internals10.validateEvidence(evidence);
+  _internals11.validateEvidence(evidence);
   return withEvidenceLock(directory, relativePath, "evidence-manager", sanitizedTaskId, async () => {
     const evidencePath = validateSwarmPath(directory, relativePath);
-    const evidenceDir = path9.dirname(evidencePath);
+    const evidenceDir = path10.dirname(evidencePath);
     let bundle;
     const existingContent = await readSwarmFileAsync(directory, relativePath);
     if (existingContent !== null) {
@@ -3933,16 +4224,17 @@ async function saveEvidence(directory, taskId, evidence) {
       throw new Error(`Evidence bundle size (${bundleJson.length} bytes) exceeds maximum (${EVIDENCE_MAX_JSON_BYTES} bytes)`);
     }
     mkdirSync4(evidenceDir, { recursive: true });
-    const tempPath = path9.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
+    const tempPath = path10.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
     try {
       await bunWrite(tempPath, bundleJson);
-      await fs6.rename(tempPath, evidencePath);
+      await fs7.rename(tempPath, evidencePath);
     } catch (error2) {
       try {
         rmSync(tempPath, { force: true });
       } catch {}
       throw error2;
     }
+    invalidateCachedArtifact(evidencePath);
     return updatedBundle;
   });
 }
@@ -3977,7 +4269,7 @@ function wrapFlatRetrospective(flatEntry, taskId) {
 }
 async function loadEvidence(directory, taskId, options) {
   const sanitizedTaskId = sanitizeTaskId2(taskId);
-  const relativePath = path9.join("evidence", sanitizedTaskId, "evidence.json");
+  const relativePath = path10.join("evidence", sanitizedTaskId, "evidence.json");
   if (relativePath.length > 4096) {
     return { status: "not_found" };
   }
@@ -3993,7 +4285,7 @@ async function loadEvidence(directory, taskId, options) {
     return { status: "invalid_schema", errors: ["Invalid JSON"] };
   }
   if (isFlatRetrospective(parsed)) {
-    const wrappedBundle = _internals10.wrapFlatRetrospective(parsed, sanitizedTaskId);
+    const wrappedBundle = _internals11.wrapFlatRetrospective(parsed, sanitizedTaskId);
     try {
       const validated = EvidenceBundleSchema.parse(wrappedBundle);
       if (options?.migrate === false) {
@@ -4001,12 +4293,13 @@ async function loadEvidence(directory, taskId, options) {
       }
       try {
         await withEvidenceLock(directory, relativePath, "evidence-loader", sanitizedTaskId, async () => {
-          const evidenceDir = path9.dirname(evidencePath);
+          const evidenceDir = path10.dirname(evidencePath);
           const bundleJson = JSON.stringify(validated);
-          const tempPath = path9.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
+          const tempPath = path10.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
           try {
             await bunWrite(tempPath, bundleJson);
-            await fs6.rename(tempPath, evidencePath);
+            await fs7.rename(tempPath, evidencePath);
+            invalidateCachedArtifact(evidencePath);
           } catch (writeError) {
             try {
               rmSync(tempPath, { force: true });
@@ -4048,7 +4341,7 @@ async function listEvidenceTaskIds(directory) {
   }
   const taskIds = [];
   for (const entry of entries) {
-    const entryPath = path9.join(evidenceBasePath, entry);
+    const entryPath = path10.join(evidenceBasePath, entry);
     try {
       const stats = statSync2(entryPath);
       if (!stats.isDirectory()) {
@@ -4066,7 +4359,7 @@ async function listEvidenceTaskIds(directory) {
 }
 async function deleteEvidence(directory, taskId) {
   const sanitizedTaskId = sanitizeTaskId2(taskId);
-  const relativePath = path9.join("evidence", sanitizedTaskId);
+  const relativePath = path10.join("evidence", sanitizedTaskId);
   const evidenceDir = validateSwarmPath(directory, relativePath);
   try {
     statSync2(evidenceDir);
@@ -4082,18 +4375,18 @@ async function deleteEvidence(directory, taskId) {
   }
 }
 async function checkRequirementCoverage(phase, directory) {
-  const relativePath = path9.join("evidence", `req-coverage-phase-${phase}.json`);
-  const absolutePath = path9.resolve(directory, ".swarm", relativePath);
+  const relativePath = path10.join("evidence", `req-coverage-phase-${phase}.json`);
+  const absolutePath = path10.resolve(directory, ".swarm", relativePath);
   try {
-    await fs6.access(absolutePath);
+    await fs7.access(absolutePath);
     return { exists: true, path: absolutePath };
   } catch {
     return { exists: false, path: absolutePath };
   }
 }
 async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
-  const taskIds = await _internals10.listEvidenceTaskIds(directory);
-  const cutoffDate = options?.now ? new Date(options.now) : _internals10.now();
+  const taskIds = await _internals11.listEvidenceTaskIds(directory);
+  const cutoffDate = options?.now ? new Date(options.now) : _internals11.now();
   cutoffDate.setDate(cutoffDate.getDate() - maxAgeDays);
   const cutoffIso = cutoffDate.toISOString();
   const selected = new Set;
@@ -4105,7 +4398,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   for (const taskId of taskIds) {
     let result;
     try {
-      result = await _internals10.loadEvidence(directory, taskId);
+      result = await _internals11.loadEvidence(directory, taskId);
     } catch {
       warn("archive: skipping corrupt or unreadable evidence for task", taskId);
       continue;
@@ -4133,7 +4426,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   }
   if (!options?.dryRun) {
     for (const taskId of [...selected].sort()) {
-      const deleted = await _internals10.deleteEvidence(directory, taskId);
+      const deleted = await _internals11.deleteEvidence(directory, taskId);
       if (deleted)
         archived.push(taskId);
       else
@@ -4159,7 +4452,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   };
   if (typeof options?.cacheMaxBytes === "number" && options.cacheMaxBytes > 0 || typeof options?.cacheMaxRecords === "number" && options.cacheMaxRecords > 0) {
     try {
-      documentsCache = await _internals10.pruneEvidenceDocuments({
+      documentsCache = await _internals11.pruneEvidenceDocuments({
         directory,
         maxBytes: options?.cacheMaxBytes,
         maxRecords: options?.cacheMaxRecords,
@@ -4187,7 +4480,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
 function validateEvidence(evidence) {
   return EvidenceSchema.parse(evidence);
 }
-var _internals10 = {
+var _internals11 = {
   wrapFlatRetrospective,
   loadEvidence,
   listEvidenceTaskIds,
@@ -4309,4 +4602,4 @@ function mergeDurableGateEntriesFromEvidence(taskId, entries, evidence) {
   return merged;
 }
 
-export { getExecutor, init_executor, MAX_TRANSIENT_RETRIES, isTransientSpawnError, transientBackoff, getGitRepositoryStatus, isGitRepo, getDefaultBaseBranch, resetToRemoteBranch, resetToMainAfterMerge, isStateUnreadable, loadEpicSessionState, isEpicModeActive, enableEpicMode, disableEpicMode, normalizePath, pathsConflict, isGlobalFile, isProtectedPath, readTaskScopes, computeSpecHash, loadPlanJsonOnly, loadPlan, savePlan, closePlanTerminalState, derivePlanMarkdown, isValidEvidenceType, sanitizeTaskId2 as sanitizeTaskId, validateProjectRoot, saveEvidence, loadEvidence, listEvidenceTaskIds, checkRequirementCoverage, archiveEvidence, readDurableGateEvidence, getDurableGateEvidenceStatus, getDurableGateEvidenceStatusForTask, mergeDurableGateEntriesFromEvidence };
+export { getExecutor, init_executor, MAX_TRANSIENT_RETRIES, isTransientSpawnError, transientBackoff, getGitRepositoryStatus, isGitRepo, getDefaultBaseBranch, resetToRemoteBranch, resetToMainAfterMerge, containsPathTraversal, containsControlChars, isStateUnreadable, loadEpicSessionState, isEpicModeActive, enableEpicMode, disableEpicMode, normalizePath, pathsConflict, isGlobalFile, isProtectedPath, readTaskScopes, computeSpecHash, loadPlanJsonOnly, loadPlan, savePlan, closePlanTerminalState, derivePlanMarkdown, isValidEvidenceType, sanitizeTaskId2 as sanitizeTaskId, validateProjectRoot, saveEvidence, loadEvidence, listEvidenceTaskIds, checkRequirementCoverage, archiveEvidence, readDurableGateEvidence, getDurableGateEvidenceStatus, getDurableGateEvidenceStatusForTask, mergeDurableGateEntriesFromEvidence };