opencode-swarm 7.139.0 → 7.139.2

package/dist/cli/{index-4ft523nb.js → index-0wp67gqj.js}

@@ -3,7 +3,7 @@ import {
   EvaluationRunV1Schema,
   GateAuditResultV1Schema,
   getProtectedEvaluationRunIds
-} from "./index-z1tkxzq4.js";
+} from "./index-s608d3hw.js";
 import {
   readEffectiveSpecSync
 } from "./index-9ss2m4rs.js";
@@ -12,7 +12,7 @@ import {
   readTaskEvidence,
   readTaskEvidenceRaw,
   sanitizeTaskId
-} from "./index-tcdcj1g2.js";
+} from "./index-5w7ekpy3.js";
 import {
   EVIDENCE_MAX_JSON_BYTES,
   EvidenceBundleSchema,
@@ -40,7 +40,7 @@ import {
   replayFromLedgerWithStatus,
   takeSnapshotEvent,
   takeSnapshotWithRetry
-} from "./index-p2dz85tv.js";
+} from "./index-4xbyy6aw.js";
 import {
   PlanSchema
 } from "./index-1kz6da87.js";
@@ -50,16 +50,17 @@ import {
 import {
   readSwarmFileAsync,
   validateSwarmPath
-} from "./index-4qzeef9h.js";
+} from "./index-x9q4bbhd.js";
 import {
+  invalidateCachedArtifact,
   readCachedParsedFile
-} from "./index-fsrp8wp3.js";
+} from "./index-ed5ykebp.js";
 import {
   withEvidenceLock
-} from "./index-a614s16f.js";
+} from "./index-5j6chvj8.js";
 import {
   emit
-} from "./index-chvqee1j.js";
+} from "./index-a5eba0t8.js";
 import {
   ZodError,
   init_zod
@@ -980,7 +981,7 @@ import {
   writeFileSync as writeFileSync4
 } from "fs";
 import * as fsPromises from "fs/promises";
-import * as path7 from "path";
+import * as path8 from "path";
 
 // src/git/branch.ts
 init_executor();
@@ -1602,6 +1603,7 @@ function sanitizeContextText(text) {
 init_logger();
 
 // src/utils/path-security.ts
+import * as path5 from "path";
 function containsPathTraversal(str) {
   if (/\.\.[/\\]/.test(str))
     return true;
@@ -1642,14 +1644,56 @@ function containsControlChars(str) {
   return false;
 }
 function validateWorkspaceRoot(directory) {
+  validateProjectDirectory(directory);
+}
+function validateProjectDirectory(directory) {
   if (!directory || directory.trim() === "") {
-    throw new Error("Invalid directory: empty");
+    throw new Error("Invalid project directory: empty");
   }
   if (containsPathTraversal(directory)) {
-    throw new Error("Invalid directory: path traversal detected");
+    throw new Error("Invalid project directory: path traversal detected");
   }
   if (containsControlChars(directory)) {
-    throw new Error("Invalid directory: control characters detected");
+    throw new Error("Invalid project directory: control characters detected");
+  }
+  if (!path5.isAbsolute(directory) && !/^[A-Za-z]:[/\\]/.test(directory)) {
+    throw new Error("Invalid project directory: must be an absolute path");
+  }
+  assertNotSystemLocation(directory);
+}
+var DENIED_ROOT_SUBTREES = new Set([
+  "etc",
+  "usr",
+  "bin",
+  "sbin",
+  "lib",
+  "lib64",
+  "boot",
+  "dev",
+  "proc",
+  "sys",
+  "windows",
+  "winnt",
+  "program files",
+  "program files (x86)",
+  "programdata",
+  "system volume information"
+]);
+var DENIED_EXACT_ROOT_CHILDREN = new Set(["users", "home", "root"]);
+function assertNotSystemLocation(directory) {
+  for (const parser of [path5.win32, path5.posix]) {
+    if (!parser.isAbsolute(directory))
+      continue;
+    const normalized = parser.normalize(directory);
+    const { root } = parser.parse(normalized);
+    const segments = normalized.slice(root.length).split(/[/\\]/).filter((segment) => segment.length > 0);
+    if (segments.length === 0) {
+      throw new Error(`Invalid project directory: filesystem root is not a project root (${directory})`);
+    }
+    const first = (segments[0] ?? "").toLowerCase();
+    if (DENIED_ROOT_SUBTREES.has(first) || segments.length === 1 && DENIED_EXACT_ROOT_CHILDREN.has(first)) {
+      throw new Error(`Invalid project directory: system location is not a project root (${directory})`);
+    }
   }
 }
 
@@ -1827,13 +1871,13 @@ var _internals6 = {
 // src/turbo/epic/state.ts
 init_logger();
 import * as fs3 from "fs";
-import * as path5 from "path";
+import * as path6 from "path";
 var STATE_FILE = "epic-state.json";
 function nowISO() {
   return new Date().toISOString();
 }
 function ensureSwarmDir(directory) {
-  const swarmDir = path5.resolve(directory, ".swarm");
+  const swarmDir = path6.resolve(directory, ".swarm");
   if (!fs3.existsSync(swarmDir)) {
     fs3.mkdirSync(swarmDir, { recursive: true });
   }
@@ -1855,7 +1899,7 @@ function markStateUnreadable(directory, reason) {
 }
 function readPersisted(directory) {
   try {
-    const filePath = path5.join(directory, ".swarm", STATE_FILE);
+    const filePath = path6.join(directory, ".swarm", STATE_FILE);
     if (!fs3.existsSync(filePath)) {
       const seed = emptyPersisted();
       try {
@@ -1891,7 +1935,7 @@ function writePersisted(directory, persisted) {
   let payload;
   try {
     ensureSwarmDir(directory);
-    filePath = path5.join(directory, ".swarm", STATE_FILE);
+    filePath = path6.join(directory, ".swarm", STATE_FILE);
     tmpPath = `${filePath}.tmp.${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     persisted.updatedAt = nowISO();
     payload = `${JSON.stringify(persisted, null, 2)}
@@ -1940,7 +1984,7 @@ function isEpicModeActive(directory, sessionID) {
 function isEpicModeActiveForProject(directory) {
   if (stateUnreadableMap.get(directory))
     return false;
-  if (!fs3.existsSync(path5.join(directory, ".swarm", STATE_FILE))) {
+  if (!fs3.existsSync(path6.join(directory, ".swarm", STATE_FILE))) {
     return false;
   }
   const persisted = readPersisted(directory);
@@ -2049,7 +2093,7 @@ var _internals7 = {
   gitHeadSha: (cwd) => {
     return _internals5.gitExec(["rev-parse", "HEAD"], cwd).trim();
   },
-  sleep: (ms) => new Promise((resolve2) => setTimeout(resolve2, ms)),
+  sleep: (ms) => new Promise((resolve3) => setTimeout(resolve3, ms)),
   hasExistingTaskCommit: (cwd, taskId) => {
     const safeId = scrubTaskIdForGitSubject(taskId);
     const escaped = safeId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -2067,7 +2111,7 @@ var _internals7 = {
 
 // src/turbo/lean/conflicts.ts
 import * as fs4 from "fs";
-import * as path6 from "path";
+import * as path7 from "path";
 
 // src/utils/path.ts
 function normalizePath(p) {
@@ -2195,7 +2239,7 @@ function isProtectedPath(normalizedPath) {
   return false;
 }
 function readTaskScopes(directory, taskId) {
-  const scopePath = path6.join(directory, ".swarm", "scopes", `scope-${taskId}.json`);
+  const scopePath = path7.join(directory, ".swarm", "scopes", `scope-${taskId}.json`);
   try {
     if (!fs4.existsSync(scopePath)) {
       return null;
@@ -2214,7 +2258,7 @@ function readTaskScopes(directory, taskId) {
 // src/utils/spec-hash.ts
 import { createHash as createHash2 } from "crypto";
 import * as fsSync2 from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 async function computeSpecHash(directory) {
   const spec = _internals8.readEffectiveSpecSync(directory);
   if (!spec)
@@ -2243,7 +2287,7 @@ async function isSpecStale(directory, plan) {
   return { stale: false };
 }
 function isObligationPreserving(directory) {
-  const snapshotPath = join5(directory, ".swarm", "spec-snapshot.md");
+  const snapshotPath = join6(directory, ".swarm", "spec-snapshot.md");
   try {
     let recordedContent;
     try {
@@ -2256,10 +2300,10 @@ function isObligationPreserving(directory) {
       return false;
     }
     const currentContent = currentResult.content;
-    const normalize = (text) => text.replace(/\r\n/g, `
+    const normalize2 = (text) => text.replace(/\r\n/g, `
 `);
-    const recordedNorm = normalize(recordedContent);
-    const currentNorm = normalize(currentContent);
+    const recordedNorm = normalize2(recordedContent);
+    const currentNorm = normalize2(currentContent);
     const splitParagraphs = (text) => text.split(/\n\s*\n/).map((p) => p.trim()).filter((p) => p.length > 0);
     const recordedParagraphs = splitParagraphs(recordedNorm);
     const currentParagraphs = splitParagraphs(currentNorm);
@@ -2289,7 +2333,7 @@ var _internals8 = {
   readEffectiveSpecSync
 };
 function computeSpecDiff(directory) {
-  const snapshotPath = join5(directory, ".swarm", "spec-snapshot.md");
+  const snapshotPath = join6(directory, ".swarm", "spec-snapshot.md");
   let recordedContent;
   try {
     const snapshotSize = fsSync2.statSync(snapshotPath).size;
@@ -2306,11 +2350,11 @@ function computeSpecDiff(directory) {
     return null;
   }
   const currentContent = spec.content;
-  const normalize = (text) => text.replace(/\r\n/g, `
+  const normalize2 = (text) => text.replace(/\r\n/g, `
 `);
-  const recordedLines = normalize(recordedContent).split(`
+  const recordedLines = normalize2(recordedContent).split(`
 `);
-  const currentLines = normalize(currentContent).split(`
+  const currentLines = normalize2(currentContent).split(`
 `);
   const diffLines = computeLcsDiff(recordedLines, currentLines);
   const MAX_DIFF_LINES = 300;
@@ -2493,7 +2537,7 @@ async function retryCasWithBackoff(directory, eventInput, options) {
         expectedHashPrefix: currentExpected.slice(0, 8),
         delayMs
       });
-      await new Promise((resolve3) => setTimeout(resolve3, delayMs));
+      await new Promise((resolve4) => setTimeout(resolve4, delayMs));
       if (options.verifyValid) {
         const stillValid = await options.verifyValid();
         if (!stillValid)
@@ -2536,7 +2580,7 @@ async function getLatestLedgerHash(directory) {
   }
 }
 async function surfaceLedgerStaleIfPersisted(directory, plan) {
-  const resolvedWorkspace = path7.resolve(directory);
+  const resolvedWorkspace = path8.resolve(directory);
   if (!ledgerStaleWorkspaces.has(resolvedWorkspace)) {
     return plan;
   }
@@ -2555,7 +2599,7 @@ async function surfaceLedgerStaleIfPersisted(directory, plan) {
   return plan;
 }
 async function parsePlanJsonCached(directory) {
-  const planJsonPath = path7.resolve(directory, ".swarm", "plan.json");
+  const planJsonPath = path8.resolve(directory, ".swarm", "plan.json");
   return readCachedParsedFile(planJsonPath, PLAN_JSON_CACHE_NAMESPACE, () => readSwarmFileAsync(directory, "plan.json"), (planJsonContent) => {
     if (planJsonContent.includes("\x00") || planJsonContent.includes("\uFFFD")) {
       throw new Error("Plan rejected: .swarm/plan.json contains null bytes or invalid encoding");
@@ -2615,13 +2659,13 @@ async function isPlanMdInSync(directory, plan, cache) {
   return false;
 }
 async function regeneratePlanMarkdown(directory, plan) {
-  const swarmDir = path7.resolve(directory, ".swarm");
+  const swarmDir = path8.resolve(directory, ".swarm");
   const contentHash = computePlanContentHash(plan);
   const markdown = derivePlanMarkdown(plan);
   const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-  const mdPath = path7.join(swarmDir, "plan.md");
-  const mdTempPath = path7.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const mdPath = path8.join(swarmDir, "plan.md");
+  const mdTempPath = path8.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   try {
     await bunWrite(mdTempPath, markdownWithHash);
     renameSync2(mdTempPath, mdPath);
@@ -2630,6 +2674,7 @@ ${markdown}`;
       unlinkSync2(mdTempPath);
     } catch {}
   }
+  invalidateCachedArtifact(mdPath);
 }
 async function loadPlan(directory, cache) {
   const planJsonContent = await readSwarmFileAsync(directory, "plan.json", cache);
@@ -2653,7 +2698,7 @@ async function loadPlan(directory, cache) {
           if (await ledgerExists(directory)) {
             const planHash = computePlanHash(validated);
             const ledgerHash = await getLatestLedgerHash(directory);
-            const resolvedWorkspace = path7.resolve(directory);
+            const resolvedWorkspace = path8.resolve(directory);
             if (!startupLedgerCheckedWorkspaces.has(resolvedWorkspace)) {
               startupLedgerCheckedWorkspaces.add(resolvedWorkspace);
               if (ledgerHash !== "" && planHash !== ledgerHash) {
@@ -2727,7 +2772,7 @@ async function loadPlan(directory, cache) {
               if (!preserving) {
                 try {
                   const diffInfo = computeSpecDiff(directory);
-                  const specStalenessPath = path7.join(directory, ".swarm", "spec-staleness.json");
+                  const specStalenessPath = path8.join(directory, ".swarm", "spec-staleness.json");
                   await fsPromises.writeFile(specStalenessPath, JSON.stringify({
                     type: "spec_stale_detected",
                     timestamp: new Date().toISOString(),
@@ -2739,9 +2784,10 @@ async function loadPlan(directory, cache) {
                     diff: diffInfo?.diff ?? null,
                     changedSections: diffInfo?.changedSections ?? []
                   }, null, 2), "utf-8");
+                  invalidateCachedArtifact(specStalenessPath);
                 } catch {}
                 try {
-                  const eventsPath = path7.join(directory, ".swarm", "events.jsonl");
+                  const eventsPath = path8.join(directory, ".swarm", "events.jsonl");
                   const event = {
                     type: "spec_stale_detected",
                     timestamp: new Date().toISOString(),
@@ -2807,7 +2853,7 @@ async function loadPlan(directory, cache) {
     return migrated;
   }
   if (await ledgerExists(directory)) {
-    const resolvedDir = path7.resolve(directory);
+    const resolvedDir = path8.resolve(directory);
     const existingMutex = recoveryMutexes.get(resolvedDir);
     if (existingMutex) {
       await existingMutex;
@@ -2936,9 +2982,9 @@ async function savePlan(directory, plan, options) {
   } else {
     const existingEvents = await readLedgerEvents(directory);
     if (existingEvents.length > 0 && existingEvents[0].plan_id !== planId) {
-      const swarmDir2 = path7.resolve(directory, ".swarm");
-      const oldLedgerPath = path7.join(swarmDir2, "plan-ledger.jsonl");
-      const oldLedgerBackupPath = path7.join(swarmDir2, `plan-ledger.backup-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
+      const swarmDir2 = path8.resolve(directory, ".swarm");
+      const oldLedgerPath = path8.join(swarmDir2, "plan-ledger.jsonl");
+      const oldLedgerBackupPath = path8.join(swarmDir2, `plan-ledger.backup-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
       let backupExists = false;
       if (existsSync3(oldLedgerPath)) {
         try {
@@ -2976,7 +3022,7 @@ async function savePlan(directory, plan, options) {
         }
       }
       if (initSucceeded && backupExists) {
-        const archivePath = path7.join(swarmDir2, `plan-ledger.archived-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
+        const archivePath = path8.join(swarmDir2, `plan-ledger.archived-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
         try {
           renameSync2(oldLedgerBackupPath, archivePath);
           warn(`[savePlan] Ledger identity mismatch (was "${existingEvents[0].plan_id}", now "${planId}") \u2014 archived old ledger to ${archivePath} and reinitializing.`);
@@ -3001,7 +3047,7 @@ async function savePlan(directory, plan, options) {
           const toRemove = archivedSiblings.slice(0, archivedSiblings.length - MAX_ARCHIVED_SIBLINGS);
           for (const file of toRemove) {
             try {
-              unlinkSync2(path7.join(swarmDir2, file));
+              unlinkSync2(path8.join(swarmDir2, file));
             } catch {}
           }
         }
@@ -3144,9 +3190,9 @@ async function savePlan(directory, plan, options) {
       source: "savePlan_manager"
     });
   }
-  const swarmDir = path7.resolve(directory, ".swarm");
-  const planPath = path7.join(swarmDir, "plan.json");
-  const tempPath = path7.join(swarmDir, `plan.json.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const swarmDir = path8.resolve(directory, ".swarm");
+  const planPath = path8.join(swarmDir, "plan.json");
+  const tempPath = path8.join(swarmDir, `plan.json.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   try {
     await bunWrite(tempPath, JSON.stringify(projectedPlan, null, 2));
     renameSync2(tempPath, planPath);
@@ -3155,8 +3201,9 @@ async function savePlan(directory, plan, options) {
       unlinkSync2(tempPath);
     } catch {}
   }
+  invalidateCachedArtifact(planPath);
   try {
-    const markerPath = path7.join(swarmDir, ".plan-write-marker");
+    const markerPath = path8.join(swarmDir, ".plan-write-marker");
     const inProgressMarker = JSON.stringify({
       source: "plan_manager",
       timestamp: new Date().toISOString(),
@@ -3171,8 +3218,8 @@ async function savePlan(directory, plan, options) {
     const markdown = derivePlanMarkdown(projectedPlan);
     const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-    const mdPath = path7.join(swarmDir, "plan.md");
-    const mdTempPath = path7.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+    const mdPath = path8.join(swarmDir, "plan.md");
+    const mdTempPath = path8.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
     try {
       await bunWrite(mdTempPath, markdownWithHash);
       renameSync2(mdTempPath, mdPath);
@@ -3181,6 +3228,7 @@ ${markdown}`;
         unlinkSync2(mdTempPath);
       } catch {}
     }
+    invalidateCachedArtifact(mdPath);
   } catch (mdError) {
     const message = mdError instanceof Error ? mdError.message : String(mdError);
     warn(`[savePlan] plan.md write failed (non-fatal, plan.json is authoritative): ${message}`);
@@ -3193,7 +3241,7 @@ ${markdown}`;
     } catch {}
   }
   try {
-    const markerPath = path7.join(swarmDir, ".plan-write-marker");
+    const markerPath = path8.join(swarmDir, ".plan-write-marker");
     const tasksCount = projectedPlan.phases.reduce((sum, phase) => sum + phase.tasks.length, 0);
     const marker = JSON.stringify({
       source: "plan_manager",
@@ -3209,11 +3257,11 @@ async function rebuildPlan(directory, plan, options) {
   const targetPlan = plan ?? await replayFromLedger(directory);
   if (!targetPlan)
     return null;
-  const swarmDir = path7.join(directory, ".swarm");
-  const planPath = path7.join(swarmDir, "plan.json");
-  const mdPath = path7.join(swarmDir, "plan.md");
+  const swarmDir = path8.join(directory, ".swarm");
+  const planPath = path8.join(swarmDir, "plan.json");
+  const mdPath = path8.join(swarmDir, "plan.md");
   mkdirSync3(swarmDir, { recursive: true });
-  const tempPlanPath = path7.join(swarmDir, `plan.json.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const tempPlanPath = path8.join(swarmDir, `plan.json.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   {
     const fd = openSync(tempPlanPath, "w");
     try {
@@ -3224,8 +3272,9 @@ async function rebuildPlan(directory, plan, options) {
     }
   }
   renameSync2(tempPlanPath, planPath);
+  invalidateCachedArtifact(planPath);
   try {
-    const markerPath = path7.join(swarmDir, ".plan-write-marker");
+    const markerPath = path8.join(swarmDir, ".plan-write-marker");
     const inProgressMarker = JSON.stringify({
       source: "plan_manager",
       timestamp: new Date().toISOString(),
@@ -3240,12 +3289,13 @@ async function rebuildPlan(directory, plan, options) {
     const markdown = derivePlanMarkdown(targetPlan);
     const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-    const tempMdPath = path7.join(swarmDir, `plan.md.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+    const tempMdPath = path8.join(swarmDir, `plan.md.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
     await bunWrite(tempMdPath, markdownWithHash);
     renameSync2(tempMdPath, mdPath);
+    invalidateCachedArtifact(mdPath);
   } finally {
     try {
-      const markerPath = path7.join(swarmDir, ".plan-write-marker");
+      const markerPath = path8.join(swarmDir, ".plan-write-marker");
       const tasksCount = targetPlan.phases.reduce((sum, phase) => sum + phase.tasks.length, 0);
       const marker = JSON.stringify({
         source: "plan_manager",
@@ -3308,13 +3358,14 @@ async function closePlanTerminalState(directory, plan, options) {
     planHashAfter: hashAfter,
     source: "close_terminal"
   });
-  const swarmDir = path7.join(directory, ".swarm");
-  const planPath = path7.join(swarmDir, "plan.json");
-  const tempPlanPath = path7.join(swarmDir, `plan.json.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const swarmDir = path8.join(directory, ".swarm");
+  const planPath = path8.join(swarmDir, "plan.json");
+  const tempPlanPath = path8.join(swarmDir, `plan.json.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   await bunWrite(tempPlanPath, JSON.stringify(validated, null, 2));
   renameSync2(tempPlanPath, planPath);
+  invalidateCachedArtifact(planPath);
   try {
-    const markerPath = path7.join(swarmDir, ".plan-write-marker");
+    const markerPath = path8.join(swarmDir, ".plan-write-marker");
     const inProgressMarker = JSON.stringify({
       source: "plan_manager_close",
       timestamp: new Date().toISOString(),
@@ -3325,17 +3376,18 @@ async function closePlanTerminalState(directory, plan, options) {
     await bunWrite(markerPath, inProgressMarker);
   } catch {}
   try {
-    const mdPath = path7.join(swarmDir, "plan.md");
+    const mdPath = path8.join(swarmDir, "plan.md");
     const contentHash = computePlanContentHash(validated);
     const markdown = derivePlanMarkdown(validated);
     const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-    const mdTempPath = path7.join(swarmDir, `plan.md.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+    const mdTempPath = path8.join(swarmDir, `plan.md.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
     await bunWrite(mdTempPath, markdownWithHash);
     renameSync2(mdTempPath, mdPath);
+    invalidateCachedArtifact(mdPath);
   } finally {
     try {
-      const markerPath = path7.join(swarmDir, ".plan-write-marker");
+      const markerPath = path8.join(swarmDir, ".plan-write-marker");
       const tasksCount = validated.phases.reduce((sum, phase) => sum + phase.tasks.length, 0);
       const marker = JSON.stringify({
         source: "plan_manager_close",
@@ -3632,11 +3684,11 @@ import {
 } from "fs";
 import * as fs7 from "fs/promises";
 import * as os4 from "os";
-import * as path9 from "path";
+import * as path10 from "path";
 
 // src/evaluation/retention.ts
 import * as fs5 from "fs/promises";
-import * as path8 from "path";
+import * as path9 from "path";
 function artifactKey(artifact) {
   return `${artifact.namespace}/${artifact.id}`;
 }
@@ -3644,7 +3696,7 @@ function validId(value) {
   return /^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$/.test(value);
 }
 async function evaluationRunCandidates(directory) {
-  const root = path8.join(directory, ".swarm", "evolution", "runs");
+  const root = path9.join(directory, ".swarm", "evolution", "runs");
   let entries = [];
   try {
     entries = await fs5.readdir(root, { withFileTypes: true });
@@ -3663,7 +3715,7 @@ async function evaluationRunCandidates(directory) {
     if (!validId(id))
       continue;
     const artifact = { namespace: "evaluation-run", id };
-    const target = path8.join(root, entry.name);
+    const target = path9.join(root, entry.name);
     try {
       const run = EvaluationRunV1Schema.parse(JSON.parse(await fs5.readFile(target, "utf8")));
       if (run.runId !== id)
@@ -3681,7 +3733,7 @@ async function evaluationRunCandidates(directory) {
   return { candidates, corrupt };
 }
 async function gateAuditCandidates(directory) {
-  const root = path8.join(directory, ".swarm", "evidence", "gate-audit");
+  const root = path9.join(directory, ".swarm", "evidence", "gate-audit");
   let entries = [];
   try {
     entries = await fs5.readdir(root, { withFileTypes: true });
@@ -3697,9 +3749,9 @@ async function gateAuditCandidates(directory) {
     if (!entry.isDirectory() || !validId(entry.name))
       continue;
     const artifact = { namespace: "gate-audit", id: entry.name };
-    const target = path8.join(root, entry.name);
+    const target = path9.join(root, entry.name);
     try {
-      const result = GateAuditResultV1Schema.parse(JSON.parse(await fs5.readFile(path8.join(target, "results.json"), "utf8")));
+      const result = GateAuditResultV1Schema.parse(JSON.parse(await fs5.readFile(path9.join(target, "results.json"), "utf8")));
       if (result.runId !== entry.name)
         throw new Error("run id/path mismatch");
       candidates.push({
@@ -3740,7 +3792,7 @@ var _retentionInternals = {
   removeCandidate
 };
 async function archiveEvaluationArtifacts(args) {
-  return withEvidenceLock(args.directory, path8.join("evolution", "retention-index"), "evaluation-retention", "archive", async () => {
+  return withEvidenceLock(args.directory, path9.join("evolution", "retention-index"), "evaluation-retention", "archive", async () => {
     const inventory = await retentionCandidates(args.directory);
     let protectedKeys = await _retentionInternals.protectedArtifacts(args.directory);
     const protectedRefs = inventory.candidates.filter((candidate) => protectedKeys.has(artifactKey(candidate.artifact))).map((candidate) => candidate.artifact);
@@ -3820,7 +3872,7 @@ async function atomicRenameWithRetry(src, dst, renameFn = fsp.rename) {
         throw err;
       }
       if (attempt < RENAME_MAX_ATTEMPTS - 1) {
-        await new Promise((resolve3) => setTimeout(resolve3, RENAME_BACKOFF_MS));
+        await new Promise((resolve4) => setTimeout(resolve4, RENAME_BACKOFF_MS));
       }
     }
   }
@@ -4063,8 +4115,8 @@ function isWeakConfigContainerRoot(directory) {
     const resolved = realpathSync(directory);
     return resolved === realpathSync(os4.tmpdir()) || resolved === realpathSync(os4.homedir());
   } catch {
-    const resolved = path9.resolve(directory);
-    return resolved === path9.resolve(os4.tmpdir()) || resolved === path9.resolve(os4.homedir());
+    const resolved = path10.resolve(directory);
+    return resolved === path10.resolve(os4.tmpdir()) || resolved === path10.resolve(os4.homedir());
   }
 }
 function hasAccessibleProjectIndicator(directory, options = {}) {
@@ -4074,7 +4126,7 @@ function hasAccessibleProjectIndicator(directory, options = {}) {
       continue;
     }
     try {
-      const indicatorStat = statSync2(path9.join(directory, indicator));
+      const indicatorStat = statSync2(path10.join(directory, indicator));
       if (indicatorStat.isFile() || indicatorStat.isDirectory()) {
         return true;
       }
@@ -4096,14 +4148,14 @@ function validateProjectRoot(directory) {
     if (depth >= MAX_DEPTH)
       break;
     depth++;
-    const parent = path9.dirname(current);
+    const parent = path10.dirname(current);
     if (parent === current)
       break;
-    if (path9.dirname(parent) === parent) {
+    if (path10.dirname(parent) === parent) {
       current = parent;
       continue;
     }
-    const parentSwarm = path9.join(parent, ".swarm");
+    const parentSwarm = path10.join(parent, ".swarm");
     try {
       if (statSync2(parentSwarm).isDirectory()) {
         if (hasAccessibleProjectIndicator(parent, {
@@ -4124,12 +4176,12 @@ function validateProjectRoot(directory) {
 async function saveEvidence(directory, taskId, evidence) {
   _internals11.validateProjectRoot(directory);
   const sanitizedTaskId = sanitizeTaskId2(taskId);
-  const relativePath = path9.join("evidence", sanitizedTaskId, "evidence.json");
+  const relativePath = path10.join("evidence", sanitizedTaskId, "evidence.json");
   validateSwarmPath(directory, relativePath);
   _internals11.validateEvidence(evidence);
   return withEvidenceLock(directory, relativePath, "evidence-manager", sanitizedTaskId, async () => {
     const evidencePath = validateSwarmPath(directory, relativePath);
-    const evidenceDir = path9.dirname(evidencePath);
+    const evidenceDir = path10.dirname(evidencePath);
     let bundle;
     const existingContent = await readSwarmFileAsync(directory, relativePath);
     if (existingContent !== null) {
@@ -4172,7 +4224,7 @@ async function saveEvidence(directory, taskId, evidence) {
       throw new Error(`Evidence bundle size (${bundleJson.length} bytes) exceeds maximum (${EVIDENCE_MAX_JSON_BYTES} bytes)`);
     }
     mkdirSync4(evidenceDir, { recursive: true });
-    const tempPath = path9.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
+    const tempPath = path10.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
     try {
       await bunWrite(tempPath, bundleJson);
       await fs7.rename(tempPath, evidencePath);
@@ -4182,6 +4234,7 @@ async function saveEvidence(directory, taskId, evidence) {
       } catch {}
       throw error2;
     }
+    invalidateCachedArtifact(evidencePath);
     return updatedBundle;
   });
 }
@@ -4216,7 +4269,7 @@ function wrapFlatRetrospective(flatEntry, taskId) {
 }
 async function loadEvidence(directory, taskId, options) {
   const sanitizedTaskId = sanitizeTaskId2(taskId);
-  const relativePath = path9.join("evidence", sanitizedTaskId, "evidence.json");
+  const relativePath = path10.join("evidence", sanitizedTaskId, "evidence.json");
   if (relativePath.length > 4096) {
     return { status: "not_found" };
   }
@@ -4240,12 +4293,13 @@ async function loadEvidence(directory, taskId, options) {
       }
       try {
         await withEvidenceLock(directory, relativePath, "evidence-loader", sanitizedTaskId, async () => {
-          const evidenceDir = path9.dirname(evidencePath);
+          const evidenceDir = path10.dirname(evidencePath);
           const bundleJson = JSON.stringify(validated);
-          const tempPath = path9.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
+          const tempPath = path10.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
           try {
             await bunWrite(tempPath, bundleJson);
             await fs7.rename(tempPath, evidencePath);
+            invalidateCachedArtifact(evidencePath);
           } catch (writeError) {
             try {
               rmSync(tempPath, { force: true });
@@ -4287,7 +4341,7 @@ async function listEvidenceTaskIds(directory) {
   }
   const taskIds = [];
   for (const entry of entries) {
-    const entryPath = path9.join(evidenceBasePath, entry);
+    const entryPath = path10.join(evidenceBasePath, entry);
     try {
       const stats = statSync2(entryPath);
       if (!stats.isDirectory()) {
@@ -4305,7 +4359,7 @@ async function listEvidenceTaskIds(directory) {
 }
 async function deleteEvidence(directory, taskId) {
   const sanitizedTaskId = sanitizeTaskId2(taskId);
-  const relativePath = path9.join("evidence", sanitizedTaskId);
+  const relativePath = path10.join("evidence", sanitizedTaskId);
   const evidenceDir = validateSwarmPath(directory, relativePath);
   try {
     statSync2(evidenceDir);
@@ -4321,8 +4375,8 @@ async function deleteEvidence(directory, taskId) {
   }
 }
 async function checkRequirementCoverage(phase, directory) {
-  const relativePath = path9.join("evidence", `req-coverage-phase-${phase}.json`);
-  const absolutePath = path9.resolve(directory, ".swarm", relativePath);
+  const relativePath = path10.join("evidence", `req-coverage-phase-${phase}.json`);
+  const absolutePath = path10.resolve(directory, ".swarm", relativePath);
   try {
     await fs7.access(absolutePath);
     return { exists: true, path: absolutePath };