opencode-swarm 7.139.2 → 7.139.3

package/dist/cli/{index-a7nh382r.js → index-tkg6rapy.js}

@@ -5,7 +5,7 @@ import {
   getProfileForFile,
   isCommandAvailable,
   tool
-} from "./index-vm4xw9z3.js";
+} from "./index-xsxrhakg.js";
 import {
   captureWorkingTreeFingerprint,
   createModelEvaluationExecutor,
@@ -13,16 +13,16 @@ import {
   resolveExecutableFromPath,
   runEvaluation,
   runExternalTool
-} from "./index-wrt6m5ze.js";
+} from "./index-ajwmn8gp.js";
 import {
   stableCanonicalStringify
-} from "./index-y64jv2pe.js";
+} from "./index-0mzz46we.js";
 import {
   detectStraySwarmDirs,
   readDoctorArtifact,
   removeStraySwarmDir,
   runConfigDoctor
-} from "./index-y47dwge1.js";
+} from "./index-1yd38ajy.js";
 import {
   MAX_TRANSIENT_RETRIES,
   archiveEvidence,
@@ -61,7 +61,7 @@ import {
   savePlan,
   transientBackoff,
   validateProjectRoot
-} from "./index-0wp67gqj.js";
+} from "./index-4fr94329.js";
 import {
   EvaluationTaskV1Schema,
   GateAuditManifestV1Schema,
@@ -78,7 +78,7 @@ import {
   saveGateAuditResult,
   savePromotionDecision,
   saveTaskSetSnapshot
-} from "./index-s608d3hw.js";
+} from "./index-hckq2r5m.js";
 import {
   canonicalHash,
   canonicalJson,
@@ -116,15 +116,15 @@ import {
   retireSkill,
   selectCandidateEntries,
   syncBundledProjectSkillsIfMissingAsync
-} from "./index-ktagrqxw.js";
+} from "./index-6axm8q3s.js";
 import {
   readRecentEscalations
-} from "./index-w71cq27a.js";
+} from "./index-xeyr62x0.js";
 import {
   alreadyCuratedThisGeneration,
   claimNextScanBatch,
   resolveCohortId
-} from "./index-6w1re1qn.js";
+} from "./index-ba5e5e3n.js";
 import {
   CURATOR_INIT_PROMPT,
   CURATOR_PHASE_PROMPT,
@@ -166,7 +166,7 @@ import {
   resolveRemoteRefsContainingHead,
   resolveRemoteRefsContainingHeadAsync,
   switchPrFeedbackTrackingCandidateAsync
-} from "./index-wsdnttf4.js";
+} from "./index-74hpm6sh.js";
 import {
   appendUnactionable,
   quarantineEntry,
@@ -177,11 +177,11 @@ import {
   validateActionableFields,
   validateLesson,
   validateSkillPath
-} from "./index-ffpmqx30.js";
+} from "./index-1jbj7vzv.js";
 import {
   authorizeCuration,
   buildConfigFingerprintInput
-} from "./index-3radty3f.js";
+} from "./index-jqn332jx.js";
 import {
   cohortConfigFingerprint
 } from "./index-rtry5xyf.js";
@@ -214,7 +214,7 @@ import {
   transactFile,
   transactKnowledge,
   wordBigrams
-} from "./index-cyw81ngh.js";
+} from "./index-z6qe8wft.js";
 import {
   MAX_EVENT_LOG_ENTRIES,
   _internals,
@@ -224,7 +224,7 @@ import {
   recordHiveKnowledgeEvent,
   recordKnowledgeEvent,
   resolveKnowledgeEventsPath
-} from "./index-e9tx99ds.js";
+} from "./index-hwnpd4tw.js";
 import {
   resolveHiveDataDir,
   resolveHiveEventsPath,
@@ -240,16 +240,16 @@ import {
   resolveLinkDir,
   sanitizeLinkId,
   writeLinkPointer
-} from "./index-668dpw5e.js";
+} from "./index-6mvbjqbt.js";
 import {
   atomicWriteFile
-} from "./index-gvhvz176.js";
+} from "./index-2eet124q.js";
 import {
   exports_loader,
   init_loader,
   loadPluginConfig,
   loadPluginConfigWithMeta
-} from "./index-q11t5erh.js";
+} from "./index-yawwwhmc.js";
 import {
   RetrospectiveEvidenceSchema
 } from "./index-gprxjmm7.js";
@@ -266,7 +266,7 @@ import {
   package_default,
   resolveAutoReviewConfig,
   stripKnownSwarmPrefix
-} from "./index-8p9pasnp.js";
+} from "./index-kyz7259r.js";
 import {
   KNOWLEDGE_SCHEMA_VERSION,
   OUTCOME_BLOCK_THRESHOLD,
@@ -282,13 +282,13 @@ import {
   listActive,
   subscribe,
   unsubscribe
-} from "./index-5zyk8qgv.js";
+} from "./index-5syvwd8g.js";
 import {
   MAX_PENDING_SCOPE_BINDINGS,
   clearAllScopes,
   clearScopeBindingFromDisk,
   clearScopeBindings
-} from "./index-3eddtgxt.js";
+} from "./index-05mms0va.js";
 import {
   appendLedgerEvent,
   computePlanHash,
@@ -311,6 +311,7 @@ import {
 } from "./index-4rhhvd1a.js";
 import {
   AGENT_TOOL_MAP,
+  ALL_AGENT_NAMES,
   ALL_SUBAGENT_NAMES,
   ORCHESTRATOR_NAME,
   SWARM_WORKTREE_DIR_NAME,
@@ -319,16 +320,16 @@ import {
   init_agent_names,
   init_constants,
   init_tool_metadata
-} from "./index-3jcyn8g6.js";
+} from "./index-4wjk296r.js";
 import {
   findByBatchId,
   readDelegations
-} from "./index-prmb5qfp.js";
+} from "./index-mv0czd9c.js";
 import {
   readSwarmFileAsync,
   safeHook,
   validateSwarmPath
-} from "./index-x9q4bbhd.js";
+} from "./index-k87hs2ff.js";
 import {
   invalidateCachedArtifact,
   resetSwarmArtifactCache
@@ -353,7 +354,7 @@ import {
   bunSpawn,
   bunWrite,
   mergeEnvForChild
-} from "./index-y111zefa.js";
+} from "./index-4nt52yr9.js";
 import {
   criticalWarn,
   error,
@@ -367,6 +368,19 @@ import {
   __toESM
 } from "./index-a76rekgs.js";
 
+// src/config/agent-model.ts
+init_agent_names();
+init_constants();
+var CANONICAL_AGENT_NAMES = new Set(ALL_AGENT_NAMES);
+var KNOWN_EMBEDDED_VARIANTS = new Set([
+  "low",
+  "medium",
+  "high",
+  "max",
+  "xhigh",
+  "thinking"
+]);
+
 // src/agents/index.ts
 init_constants();
 init_schema();
@@ -4900,71 +4914,6 @@ import * as path20 from "path";
 init_agent_names();
 init_schema();
 
-// src/turbo/epic/cochange-conflict.ts
-function pathMatches(scopePath, cochangePath) {
-  if (scopePath === cochangePath)
-    return true;
-  return scopePath.endsWith(`/${cochangePath}`);
-}
-function epicPairConflict(scopeA, scopeB, cochangePairs, threshold) {
-  const normA = scopeA.map(normalizePath);
-  const normB = scopeB.map(normalizePath);
-  const pathPairs = [];
-  for (const a of normA) {
-    for (const b of normB) {
-      if (pathsConflict(a, b)) {
-        pathPairs.push([a, b]);
-      }
-    }
-  }
-  const pathConflict = pathPairs.length > 0;
-  const activePairs = cochangePairs.filter((e) => e.coChangeCount >= threshold.minCoChanges && e.npmi >= threshold.npmi);
-  const cochangeMatches = [];
-  for (const entry of activePairs) {
-    const fa = entry.fileA;
-    const fb = entry.fileB;
-    const aTouchesFa = normA.some((p) => pathMatches(p, fa));
-    const aTouchesFb = normA.some((p) => pathMatches(p, fb));
-    const bTouchesFa = normB.some((p) => pathMatches(p, fa));
-    const bTouchesFb = normB.some((p) => pathMatches(p, fb));
-    const aExclusivelyFa = aTouchesFa && !aTouchesFb;
-    const aExclusivelyFb = aTouchesFb && !aTouchesFa;
-    const bExclusivelyFa = bTouchesFa && !bTouchesFb;
-    const bExclusivelyFb = bTouchesFb && !bTouchesFa;
-    const crossCouple = aExclusivelyFa && bExclusivelyFb || aExclusivelyFb && bExclusivelyFa;
-    if (crossCouple) {
-      cochangeMatches.push({
-        a: fa,
-        b: fb,
-        npmi: entry.npmi,
-        coChangeCount: entry.coChangeCount
-      });
-    }
-  }
-  const cochangeConflict = cochangeMatches.length > 0;
-  let reason;
-  if (pathConflict && cochangeConflict)
-    reason = "both";
-  else if (pathConflict)
-    reason = "path";
-  else if (cochangeConflict)
-    reason = "cochange";
-  else
-    reason = "none";
-  return {
-    conflict: pathConflict || cochangeConflict,
-    reason,
-    evidence: { pathPairs, cochangePairs: cochangeMatches }
-  };
-}
-
-// src/state.ts
-init_constants();
-import { randomUUID as randomUUID2 } from "crypto";
-import * as fs2 from "fs/promises";
-import * as path7 from "path";
-init_schema();
-
 // src/db/qa-gate-profile.ts
 import { createHash as createHash3 } from "crypto";
 
@@ -5067,7 +5016,8 @@ var _internals5 = {
   setGates,
   getEffectiveGates,
   computeProfileHash,
-  hasAnyProfileWithEnabledGate
+  hasAnyProfileWithEnabledGate,
+  afterSetGatesRead: () => {}
 };
 var DEFAULT_QA_GATES = {
   reviewer: true,
@@ -5082,6 +5032,7 @@ var DEFAULT_QA_GATES = {
   drift_check: true,
   final_council: false
 };
+var qaGateProfileSavepointCounter = 0;
 function rowToProfile(row) {
   let parsed = {};
   try {
@@ -5100,7 +5051,7 @@ function rowToProfile(row) {
   const knownKeys = new Set(Object.keys(DEFAULT_QA_GATES));
   const filteredParsed = {};
   for (const key of Object.keys(parsed)) {
-    if (knownKeys.has(key)) {
+    if (knownKeys.has(key) && typeof parsed[key] === "boolean") {
       filteredParsed[key] = parsed[key];
     }
   }
@@ -5136,12 +5087,18 @@ function hasAnyProfileWithEnabledGate(directory, gate) {
   }
   return false;
 }
-function getOrCreateProfile(directory, planId, projectType) {
+function getOrCreateProfile(directory, planId, projectType, initialGates = {}) {
   const existing = _internals5.getProfile(directory, planId);
   if (existing)
     return existing;
   const db = getProjectDb(directory);
-  const gatesJson = JSON.stringify(DEFAULT_QA_GATES);
+  const seededGates = { ...DEFAULT_QA_GATES };
+  for (const key of Object.keys(DEFAULT_QA_GATES)) {
+    if (typeof initialGates[key] === "boolean") {
+      seededGates[key] = initialGates[key];
+    }
+  }
+  const gatesJson = JSON.stringify(seededGates);
   const insert = db.transaction(() => {
     db.run("INSERT INTO qa_gate_profile (plan_id, project_type, gates) VALUES (?, ?, ?)", [planId, projectType ?? null, gatesJson]);
   });
@@ -5160,35 +5117,51 @@ function getOrCreateProfile(directory, planId, projectType) {
   return after;
 }
 function setGates(directory, planId, gates) {
-  const current = _internals5.getProfile(directory, planId);
-  if (!current) {
-    throw new Error(`No QA gate profile found for plan_id=${planId} \u2014 call getOrCreateProfile first`);
-  }
-  if (current.locked_at !== null) {
-    throw new Error("Cannot modify gates: QA gate profile is locked after critic approval");
-  }
-  const merged = { ...current.gates };
-  for (const key of Object.keys(gates)) {
-    const incoming = gates[key];
-    if (incoming === undefined)
-      continue;
-    if (incoming === false && current.gates[key] === true) {
-      throw new Error(`Cannot disable gate '${key}': sessions can only ratchet tighter`);
+  const db = getProjectDb(directory);
+  const savepointName = `qa_gate_profile_set_${qaGateProfileSavepointCounter++}`;
+  const startedTransaction = !db.inTransaction;
+  db.run(startedTransaction ? "BEGIN IMMEDIATE" : `SAVEPOINT ${savepointName}`);
+  try {
+    const currentRow = db.query("SELECT * FROM qa_gate_profile WHERE plan_id = ?").get(planId);
+    if (!currentRow) {
+      throw new Error(`No QA gate profile found for plan_id=${planId} \u2014 call getOrCreateProfile first`);
+    }
+    const current = rowToProfile(currentRow);
+    if (current.locked_at !== null) {
+      throw new Error("Cannot modify gates: QA gate profile is locked after critic approval");
+    }
+    _internals5.afterSetGatesRead(current);
+    const merged = { ...current.gates };
+    for (const key of Object.keys(gates)) {
+      const incoming = gates[key];
+      if (incoming === undefined)
+        continue;
+      if (incoming === false && current.gates[key] === true) {
+        throw new Error(`Cannot disable gate '${key}': sessions can only ratchet tighter`);
+      }
+      if (incoming === true) {
+        merged[key] = true;
+      }
     }
-    if (incoming === true) {
-      merged[key] = true;
+    db.run("UPDATE qa_gate_profile SET gates = ? WHERE plan_id = ?", [
+      JSON.stringify(merged),
+      planId
+    ]);
+    const updatedRow = db.query("SELECT * FROM qa_gate_profile WHERE plan_id = ?").get(planId);
+    if (!updatedRow) {
+      throw new Error(`Failed to re-read QA gate profile after update for plan_id=${planId}`);
     }
+    db.run(startedTransaction ? "COMMIT" : `RELEASE ${savepointName}`);
+    return rowToProfile(updatedRow);
+  } catch (err) {
+    try {
+      db.run(startedTransaction ? "ROLLBACK" : `ROLLBACK TO ${savepointName}`);
+      if (!startedTransaction) {
+        db.run(`RELEASE ${savepointName}`);
+      }
+    } catch {}
+    throw err;
   }
-  const db = getProjectDb(directory);
-  db.run("UPDATE qa_gate_profile SET gates = ? WHERE plan_id = ?", [
-    JSON.stringify(merged),
-    planId
-  ]);
-  const updated = _internals5.getProfile(directory, planId);
-  if (!updated) {
-    throw new Error(`Failed to re-read QA gate profile after update for plan_id=${planId}`);
-  }
-  return updated;
 }
 function computeProfileHash(profile) {
   const payload = JSON.stringify({
@@ -5207,6 +5180,71 @@ function getEffectiveGates(profile, sessionOverrides) {
   return merged;
 }
 
+// src/turbo/epic/cochange-conflict.ts
+function pathMatches(scopePath, cochangePath) {
+  if (scopePath === cochangePath)
+    return true;
+  return scopePath.endsWith(`/${cochangePath}`);
+}
+function epicPairConflict(scopeA, scopeB, cochangePairs, threshold) {
+  const normA = scopeA.map(normalizePath);
+  const normB = scopeB.map(normalizePath);
+  const pathPairs = [];
+  for (const a of normA) {
+    for (const b of normB) {
+      if (pathsConflict(a, b)) {
+        pathPairs.push([a, b]);
+      }
+    }
+  }
+  const pathConflict = pathPairs.length > 0;
+  const activePairs = cochangePairs.filter((e) => e.coChangeCount >= threshold.minCoChanges && e.npmi >= threshold.npmi);
+  const cochangeMatches = [];
+  for (const entry of activePairs) {
+    const fa = entry.fileA;
+    const fb = entry.fileB;
+    const aTouchesFa = normA.some((p) => pathMatches(p, fa));
+    const aTouchesFb = normA.some((p) => pathMatches(p, fb));
+    const bTouchesFa = normB.some((p) => pathMatches(p, fa));
+    const bTouchesFb = normB.some((p) => pathMatches(p, fb));
+    const aExclusivelyFa = aTouchesFa && !aTouchesFb;
+    const aExclusivelyFb = aTouchesFb && !aTouchesFa;
+    const bExclusivelyFa = bTouchesFa && !bTouchesFb;
+    const bExclusivelyFb = bTouchesFb && !bTouchesFa;
+    const crossCouple = aExclusivelyFa && bExclusivelyFb || aExclusivelyFb && bExclusivelyFa;
+    if (crossCouple) {
+      cochangeMatches.push({
+        a: fa,
+        b: fb,
+        npmi: entry.npmi,
+        coChangeCount: entry.coChangeCount
+      });
+    }
+  }
+  const cochangeConflict = cochangeMatches.length > 0;
+  let reason;
+  if (pathConflict && cochangeConflict)
+    reason = "both";
+  else if (pathConflict)
+    reason = "path";
+  else if (cochangeConflict)
+    reason = "cochange";
+  else
+    reason = "none";
+  return {
+    conflict: pathConflict || cochangeConflict,
+    reason,
+    evidence: { pathPairs, cochangePairs: cochangeMatches }
+  };
+}
+
+// src/state.ts
+init_constants();
+import { randomUUID as randomUUID2 } from "crypto";
+import * as fs2 from "fs/promises";
+import * as path7 from "path";
+init_schema();
+
 // src/hooks/realtime-learning-nudge.ts
 var realtimeLearningNudgeBySession = new Map;
 function resetRealtimeLearningNudgeState() {
@@ -5686,8 +5724,7 @@ var swarmState = {
   knowledgeAckDedup: new Set,
   gateDenialCounts: new Map,
   generatedAgentNames: [],
-  lastBudgetPct: 0,
-  lastBudgetTokens: 0,
+  lastBudgetBySession: new Map,
   liveContextWindows: new Map,
   agentSessions: defaultRunContext.agentSessions,
   pendingRehydrations: new Set,
@@ -5700,8 +5737,7 @@ function resetSwarmState() {
   swarmState.activeAgent.clear();
   swarmState.delegationChains.clear();
   swarmState.pendingEvents = 0;
-  swarmState.lastBudgetPct = 0;
-  swarmState.lastBudgetTokens = 0;
+  swarmState.lastBudgetBySession.clear();
   swarmState.liveContextWindows.clear();
   swarmState.agentSessions.clear();
   _lastIdleSweepAtMs = 0;
@@ -6530,10 +6566,19 @@ function hasActiveEpicMode(sessionID) {
   }
   return false;
 }
+function getDisplayBudget() {
+  let best = null;
+  for (const entry of swarmState.lastBudgetBySession.values()) {
+    if (entry.pct > 0 && (best === null || entry.pct > best.pct)) {
+      best = entry;
+    }
+  }
+  return best;
+}
 async function rehydratePrSubscriptions(sessionID, directory) {
   const map = new Map;
   try {
-    const { listActive: listActive2 } = await import("./pr-subscriptions-hhx6yk24.js");
+    const { listActive: listActive2 } = await import("./pr-subscriptions-qdwfm1a8.js");
     const records = await listActive2(directory);
     for (const record of records) {
       if (record.sessionID !== sessionID)
@@ -18989,7 +19034,7 @@ function planMerges(active, threshold, maxComparisons, maxMerges) {
   };
 }
 async function sweepActiveNearDuplicates(directory, options = {}) {
-  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-yr6x707c.js");
+  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-v7g8dnyh.js");
   const { config } = loadPluginConfigWithMeta2(directory);
   const sweepConfig = config.learning?.dedup_sweep;
   if (sweepConfig?.enabled === false)
@@ -20584,7 +20629,7 @@ async function runCuratorPhase(directory, phase, agentsDispatched, config, knowl
     }
     if (config.skill_generation_enabled === true && skillCandidates.length > 0) {
       try {
-        const skillModule = await import("./skill-generator-hp7as46c.js");
+        const skillModule = await import("./skill-generator-2rv6ftre.js");
         for (const cand of skillCandidates) {
           if (cand.confidence < (config.min_skill_confidence ?? DEFAULT_SKILL_MIN_CONFIDENCE)) {
             continue;
@@ -21044,7 +21089,7 @@ async function applyCuratorKnowledgeUpdates(directory, recommendations, knowledg
     } catch {}
   }
   if (contradictedEntries.length > 0 && knowledgeConfig.contradiction_threshold_action === "quarantine") {
-    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-n9pmx4qr.js");
+    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-kkjsjtza.js");
     for (const { id } of contradictedEntries) {
       try {
         await maybeQuarantineOnContradiction(directory, id, knowledgeConfig.contradiction_quarantine_threshold, knowledgeConfig.contradiction_quarantine_window_days);
@@ -21863,7 +21908,7 @@ async function runCuratorPostMortem(directory, options = {}) {
       warnings.push("Failed to collect knowledge summary.");
     }
     try {
-      const { getScanStatus } = await import("./scan-cursor-ah5swtyh.js");
+      const { getScanStatus } = await import("./scan-cursor-8e6ryhjq.js");
       const scanStatus = await getScanStatus(directory);
       if (scanStatus.remaining_estimate > 0) {
         warnings.push(`Fair scan: reviewed ${knowledgeSummary.length} entries this sweep (generation ${scanStatus.generation}); ${scanStatus.remaining_estimate} more eligible entries will be visited in future curation sweeps.`);
@@ -22035,9 +22080,9 @@ var _internals24 = {
   verifyPostMortemKnowledgeActions,
   repairPostMortemActions,
   loadDefaultKnowledgeConfig: async (directory) => {
-    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-f7jgrtxj.js");
+    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-g7rs20c6.js");
     try {
-      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-yr6x707c.js");
+      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-v7g8dnyh.js");
       const loaded = loadPluginConfigWithMeta2(directory);
       return KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
     } catch {
@@ -22045,11 +22090,11 @@ var _internals24 = {
     }
   },
   applyCuratorKnowledgeUpdates: async (directory, recommendations, knowledgeConfig, generation) => {
-    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-vpcs1p1v.js");
+    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-m6mk2v1n.js");
     return applyCuratorKnowledgeUpdates2(directory, recommendations, knowledgeConfig, generation);
   },
   checkHivePromotions: async (entries, knowledgeConfig, directory) => {
-    const { checkHivePromotions } = await import("./hive-promoter-mpf0cfkk.js");
+    const { checkHivePromotions } = await import("./hive-promoter-v4w7cjvk.js");
     return checkHivePromotions(entries, knowledgeConfig, directory);
   },
   applyProposalTriage: async (directory, triage) => {
@@ -22058,7 +22103,7 @@ var _internals24 = {
       activateProposal,
       listSkills: listSkills2,
       sanitizeSlug
-    } = await import("./skill-generator-hp7as46c.js");
+    } = await import("./skill-generator-2rv6ftre.js");
     const result = {
       approved: [],
       rejected: [],
@@ -22100,7 +22145,7 @@ var _internals24 = {
     return result;
   },
   readPriorDriftReports: async (directory) => {
-    const { readPriorDriftReports } = await import("./curator-drift-vfh07mqy.js");
+    const { readPriorDriftReports } = await import("./curator-drift-r52hjskk.js");
     return readPriorDriftReports(directory);
   },
   readSwarmKnowledge: (directory) => readKnowledge(resolveSwarmKnowledgePath(directory))
@@ -24686,9 +24731,9 @@ function hashContent(content) {
   return createHash9("sha1").update(content).digest("hex");
 }
 async function loadConfigForPolicyCurator(directory) {
-  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-f7jgrtxj.js");
+  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-g7rs20c6.js");
   try {
-    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-yr6x707c.js");
+    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-v7g8dnyh.js");
     const { config: loadedConfig } = loadPluginConfigWithMeta2(directory);
     return KnowledgeConfigSchema2.parse(loadedConfig.knowledge ?? {});
   } catch {
@@ -28697,7 +28742,7 @@ async function runFinalizeStage(ctx) {
     }
   }
   try {
-    const { CuratorConfigSchema: CCS } = await import("./schema-f7jgrtxj.js");
+    const { CuratorConfigSchema: CCS } = await import("./schema-g7rs20c6.js");
     const { config: pmLoadedConfig } = _internals37.loadPluginConfigWithMeta(ctx.directory);
     const curatorCfg = CCS.parse(pmLoadedConfig.curator ?? {});
     if (curatorCfg.enabled && curatorCfg.postmortem_enabled) {
@@ -30970,9 +31015,9 @@ var _internals42 = {
   loadPluginConfigWithMeta,
   loadCuratorDeps: async () => {
     const [{ CuratorConfigSchema }, curator, { createCuratorLLMDelegate: createCuratorLLMDelegate2 }] = await Promise.all([
-      import("./schema-f7jgrtxj.js"),
-      import("./curator-vpcs1p1v.js"),
-      import("./curator-llm-factory-hvw13hmr.js")
+      import("./schema-g7rs20c6.js"),
+      import("./curator-m6mk2v1n.js"),
+      import("./curator-llm-factory-1r9vz0g2.js")
     ]);
     return { CuratorConfigSchema, curator, createCuratorLLMDelegate: createCuratorLLMDelegate2 };
   }
@@ -31877,7 +31922,7 @@ async function computeCurationDiagnostics(directory, entries) {
   let scanCompleted = false;
   let scanRemaining = 0;
   try {
-    const { getScanStatus } = await import("./scan-cursor-ah5swtyh.js");
+    const { getScanStatus } = await import("./scan-cursor-8e6ryhjq.js");
     const status = await getScanStatus(directory);
     scanGeneration = status.generation;
     scanCompleted = status.completed;
@@ -31885,19 +31930,19 @@ async function computeCurationDiagnostics(directory, entries) {
   } catch {}
   let configMatch = null;
   try {
-    const { isLinked: isLinked2 } = await import("./knowledge-link-3tq8w6gs.js");
+    const { isLinked: isLinked2 } = await import("./knowledge-link-f6akgbdn.js");
     if (isLinked2(directory)) {
-      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-f7jgrtxj.js");
+      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-g7rs20c6.js");
       let config;
       try {
-        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-yr6x707c.js");
+        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-v7g8dnyh.js");
         const loaded = loadPluginConfigWithMeta2(directory);
         config = KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
       } catch {
         config = KnowledgeConfigSchema2.parse({});
       }
       const { cohortConfigFingerprint: cohortConfigFingerprint2 } = await import("./config-fingerprint-v22xh5a2.js");
-      const { buildConfigFingerprintInput: buildConfigFingerprintInput2, readCohortConfigFingerprint } = await import("./curation-policy-4tp0mbcb.js");
+      const { buildConfigFingerprintInput: buildConfigFingerprintInput2, readCohortConfigFingerprint } = await import("./curation-policy-f46tf3dw.js");
       const currentFp = cohortConfigFingerprint2(buildConfigFingerprintInput2(config));
       const cohortFp = await readCohortConfigFingerprint(directory);
       configMatch = cohortFp === null ? null : currentFp === cohortFp;
@@ -33108,7 +33153,7 @@ async function handleDoctorCommand(directory, args) {
   const result = runConfigDoctor(config, directory);
   let output;
   if (enableAutoFix && result.hasAutoFixableIssues) {
-    const { runConfigDoctorWithFixes } = await import("./config-doctor-hrb61yqe.js");
+    const { runConfigDoctorWithFixes } = await import("./config-doctor-75qky762.js");
     const fixResult = await runConfigDoctorWithFixes(directory, config, true, {
       applyLossy: true
     });
@@ -33945,7 +33990,7 @@ async function handleEvidenceCommand(directory, args) {
   return formatTaskEvidenceMarkdown(evidenceData);
 }
 async function handleEvidenceSummaryCommand(directory) {
-  const { buildEvidenceSummary } = await import("./evidence-summary-service-kzxr71yd.js");
+  const { buildEvidenceSummary } = await import("./evidence-summary-service-sxcq5nrt.js");
   const artifact = await buildEvidenceSummary(directory);
   if (!artifact) {
     return "No plan found. Run `/swarm plan` to check plan status.";
@@ -35621,7 +35666,8 @@ function validateInput(input) {
   }
   return { valid: true };
 }
-async function qualityBudget(input, directory) {
+async function qualityBudget(input, directory, abortSignal) {
+  abortSignal?.throwIfAborted();
   const validation = validateInput(input);
   if (!validation.valid) {
     throw new Error(`Invalid input: ${validation.error}`);
@@ -35661,10 +35707,12 @@ async function qualityBudget(input, directory) {
       }
     };
   }
-  const metrics = await computeQualityMetrics(changedFiles, thresholds, directory);
+  const metrics = await _internals49.computeQualityMetrics(changedFiles, thresholds, directory);
+  abortSignal?.throwIfAborted();
   const errorsCount = metrics.violations.filter((v) => v.severity === "error").length;
   const warningsCount = metrics.violations.filter((v) => v.severity === "warning").length;
   const verdict = errorsCount > 0 ? "fail" : "pass";
+  abortSignal?.throwIfAborted();
   await saveEvidence(directory, "quality_budget", {
     task_id: "quality_budget",
     type: "quality_budget",
@@ -35691,7 +35739,8 @@ async function qualityBudget(input, directory) {
       files: v.files
     })),
     files_analyzed: metrics.files_analyzed
-  });
+  }, abortSignal);
+  abortSignal?.throwIfAborted();
   return {
     verdict,
     metrics,
@@ -35718,13 +35767,14 @@ var quality_budget = createSwarmTool({
       exclude_globs: exports_external.array(exports_external.string()).optional()
     }).optional().describe("Quality budget thresholds")
   },
-  async execute(args, directory) {
-    const result = await _internals49.qualityBudget(args, directory);
+  async execute(args, directory, ctx) {
+    const result = await _internals49.qualityBudget(args, directory, ctx?.abort);
     return JSON.stringify(result);
   }
 });
 var _internals49 = {
-  qualityBudget
+  qualityBudget,
+  computeQualityMetrics
 };
 
 // src/tools/sast-scan.ts
@@ -36583,15 +36633,75 @@ function executeRulesSync(filePath, content, language) {
 }
 
 // src/sast/semgrep.ts
-init_logger();
-import * as child_process6 from "child_process";
 import * as fs24 from "fs";
 import * as path61 from "path";
 var semgrepAvailableCache = null;
+var semgrepAvailabilityProbe = null;
+var semgrepAvailabilityGeneration = 0;
 var DEFAULT_RULES_DIR = ".swarm/semgrep-rules";
 var DEFAULT_TIMEOUT_MS2 = 30000;
+var SEMGREP_AVAILABILITY_TIMEOUT_MS = 5000;
+var SEMGREP_AVAILABILITY_MAX_STDOUT_BYTES = 16 * 1024;
+var SEMGREP_AVAILABILITY_MAX_STDERR_BYTES = 16 * 1024;
 var MAX_OUTPUT_BYTES = 10 * 1024 * 1024;
-var KILL_GRACE_MS = 2000;
+function resolveSemgrepBinary() {
+  return _internals50.resolveExecutableFromPath(process.platform === "win32" ? ["semgrep.exe"] : ["semgrep"]);
+}
+function getAvailabilityProbeCwd() {
+  try {
+    return fs24.realpathSync(process.cwd());
+  } catch {
+    return path61.resolve(process.cwd());
+  }
+}
+async function runSemgrepAvailabilityProbe(executable, cwd, generation) {
+  try {
+    const run = await _internals50.runExternalTool({
+      executable,
+      args: ["--version"],
+      cwd,
+      timeoutMs: SEMGREP_AVAILABILITY_TIMEOUT_MS,
+      maxStdoutBytes: SEMGREP_AVAILABILITY_MAX_STDOUT_BYTES,
+      maxStderrBytes: SEMGREP_AVAILABILITY_MAX_STDERR_BYTES
+    });
+    const available = run.status === "completed" && run.exitCode === 0 && !run.stdoutTruncated && !run.stderrTruncated;
+    if (available && generation === semgrepAvailabilityGeneration) {
+      semgrepAvailableCache = true;
+    }
+    return available;
+  } catch {
+    return false;
+  }
+}
+async function waitForAvailabilityProbe(probe, abortSignal) {
+  if (!abortSignal)
+    return probe;
+  if (abortSignal.aborted)
+    return false;
+  return new Promise((resolve18) => {
+    let settled = false;
+    const finish = (available) => {
+      if (settled)
+        return;
+      settled = true;
+      abortSignal.removeEventListener("abort", onAbort);
+      resolve18(available);
+    };
+    const onAbort = () => finish(false);
+    abortSignal.addEventListener("abort", onAbort, { once: true });
+    probe.then(finish, () => finish(false));
+  });
+}
+function describeExternalToolFailure(status) {
+  switch (status) {
+    case "timeout":
+      return "Semgrep process timed out";
+    case "cancelled":
+      return "Semgrep execution cancelled";
+    case "spawn-error":
+      return "Semgrep process failed to start or terminate safely";
+  }
+}
 var _internals50 = {
   isSemgrepAvailable,
   checkSemgrepAvailable,
@@ -36599,60 +36709,117 @@ var _internals50 = {
   runSemgrep,
   getRulesDirectory,
   hasBundledRules,
-  executeWithTimeout
+  resolveExecutableFromPath,
+  resolveSemgrepBinary,
+  runExternalTool,
+  getAvailabilityProbeCwd
 };
 function isSemgrepAvailable() {
   if (semgrepAvailableCache !== null) {
     return semgrepAvailableCache;
   }
-  try {
-    child_process6.execFileSync("semgrep", ["--version"], {
-      encoding: "utf-8",
-      stdio: "pipe"
-    });
-    semgrepAvailableCache = true;
-    return true;
-  } catch {
+  return _internals50.resolveSemgrepBinary() !== null;
+}
+async function checkSemgrepAvailable(cwd, abortSignal) {
+  if (abortSignal?.aborted)
+    return false;
+  if (semgrepAvailableCache !== null) {
+    return semgrepAvailableCache;
+  }
+  const executable = _internals50.resolveSemgrepBinary();
+  if (!executable) {
     semgrepAvailableCache = false;
     return false;
   }
-}
-async function checkSemgrepAvailable() {
-  return _internals50.isSemgrepAvailable();
+  if (!semgrepAvailabilityProbe) {
+    const generation = semgrepAvailabilityGeneration;
+    const probe = runSemgrepAvailabilityProbe(executable, cwd ?? _internals50.getAvailabilityProbeCwd(), generation);
+    semgrepAvailabilityProbe = probe;
+    probe.then(() => {
+      if (semgrepAvailabilityProbe === probe) {
+        semgrepAvailabilityProbe = null;
+      }
+    }, () => {
+      if (semgrepAvailabilityProbe === probe) {
+        semgrepAvailabilityProbe = null;
+      }
+    });
+  }
+  return waitForAvailabilityProbe(semgrepAvailabilityProbe, abortSignal);
 }
 function resetSemgrepCache() {
+  semgrepAvailabilityGeneration++;
   semgrepAvailableCache = null;
+  semgrepAvailabilityProbe = null;
 }
 function parseSemgrepResults(semgrepOutput) {
   const findings = [];
   try {
     const parsed = JSON.parse(semgrepOutput);
-    const results = parsed.results || parsed;
-    if (!Array.isArray(results)) {
-      return [];
+    let results;
+    if (Array.isArray(parsed)) {
+      results = parsed;
+    } else if (parsed && typeof parsed === "object") {
+      const output = parsed;
+      if (output.errors !== undefined && !Array.isArray(output.errors)) {
+        throw new Error("invalid Semgrep errors shape");
+      }
+      if (Array.isArray(output.errors) && output.errors.length > 0) {
+        throw new SemgrepScanError(`Semgrep reported ${output.errors.length} scan error${output.errors.length === 1 ? "" : "s"}`);
+      }
+      results = output.results;
     }
+    if (!Array.isArray(results))
+      throw new Error("invalid Semgrep result shape");
     for (const result of results) {
-      if (!result || typeof result !== "object")
-        continue;
-      const severity = mapSemgrepSeverity(result.extra?.severity || result.severity);
+      if (!result || typeof result !== "object" || Array.isArray(result)) {
+        throw new Error("invalid Semgrep result entry");
+      }
+      const entry = result;
+      const extra = entry.extra && typeof entry.extra === "object" && !Array.isArray(entry.extra) ? entry.extra : null;
+      const start = entry.start && typeof entry.start === "object" && !Array.isArray(entry.start) ? entry.start : null;
+      const ruleId = entry.check_id ?? entry.rule_id;
+      const file = entry.path ?? start?.filename ?? entry.file;
+      const line = start?.line ?? entry.line;
+      const column = start?.col ?? entry.column;
+      const severityValue = extra?.severity ?? entry.severity;
+      const message = extra?.message ?? entry.message;
+      const knownSeverities = new Set([
+        "error",
+        "critical",
+        "warning",
+        "high",
+        "medium",
+        "info",
+        "low"
+      ]);
+      if (typeof ruleId !== "string" || ruleId.length === 0 || typeof file !== "string" || file.length === 0 || file.includes("\x00") || typeof line !== "number" || !Number.isInteger(line) || line < 1 || column !== undefined && (typeof column !== "number" || !Number.isInteger(column) || column < 1) || typeof severityValue !== "string" || !knownSeverities.has(severityValue.toLowerCase()) || message !== undefined && typeof message !== "string" || extra?.fix !== undefined && typeof extra.fix !== "string" || extra?.lines !== undefined && typeof extra.lines !== "string" || entry.lines !== undefined && typeof entry.lines !== "string") {
+        throw new Error("invalid Semgrep result entry");
+      }
+      const severity = mapSemgrepSeverity(severityValue);
       findings.push({
-        rule_id: result.check_id || result.rule_id || "unknown",
+        rule_id: ruleId,
         severity,
-        message: result.extra?.message || result.message || "Security issue detected",
+        message: message ?? "Security issue detected",
         location: {
-          file: result.path || result.start?.filename || result.file || "unknown",
-          line: result.start?.line || result.line || 1,
-          column: result.start?.col || result.column
+          file,
+          line,
+          column
         },
-        remediation: result.extra?.fix,
-        excerpt: result.extra?.lines || result.lines || ""
+        remediation: extra?.fix,
+        excerpt: extra?.lines ?? entry.lines ?? ""
       });
     }
-  } catch {
-    return [];
+  } catch (error2) {
+    if (error2 instanceof SemgrepScanError)
+      throw error2;
+    throw new Error("Semgrep returned invalid JSON output", { cause: error2 });
   }
   return findings;
 }
+
+class SemgrepScanError extends Error {
+}
 function mapSemgrepSeverity(severity) {
   const severityLower = (severity || "").toLowerCase();
   switch (severityLower) {
@@ -36669,136 +36836,6 @@ function mapSemgrepSeverity(severity) {
       return "medium";
   }
 }
-async function executeWithTimeout(command, args, options) {
-  const maxOutputBytes = options.maxOutputBytes ?? MAX_OUTPUT_BYTES;
-  return new Promise((resolve18) => {
-    const child = child_process6.spawn(command, args, {
-      shell: false,
-      cwd: options.cwd,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    options.onSpawn?.(child.pid);
-    let stdout = "";
-    let stderr = "";
-    let stdoutBytes = 0;
-    let stderrBytes = 0;
-    let stdoutTruncated = false;
-    let stderrTruncated = false;
-    let settled = false;
-    let timeout;
-    let escalation;
-    const settle = (result) => {
-      if (settled)
-        return;
-      settled = true;
-      if (timeout)
-        clearTimeout(timeout);
-      if (escalation)
-        clearTimeout(escalation);
-      const truncated = stdoutTruncated || stderrTruncated;
-      if (child.exitCode === null && child.signalCode === null) {
-        try {
-          child.kill("SIGTERM");
-        } catch (e) {
-          if (e instanceof Error && !e.message.includes("ESRCH")) {
-            log("[semgrep] child.kill failed:", e.message);
-          }
-        }
-        escalation = setTimeout(() => {
-          try {
-            child.kill("SIGKILL");
-          } catch (e) {
-            if (e instanceof Error && !e.message.includes("ESRCH")) {
-              log("[semgrep] child.kill failed:", e.message);
-            }
-          }
-        }, KILL_GRACE_MS);
-        if (typeof escalation.unref === "function") {
-          escalation.unref();
-        }
-      }
-      resolve18({ ...result, truncated });
-    };
-    timeout = setTimeout(() => {
-      settle({
-        stdout,
-        stderr: "Process timed out",
-        exitCode: 124
-      });
-    }, options.timeoutMs);
-    if (typeof timeout.unref === "function") {
-      timeout.unref();
-    }
-    child.stdout?.on("data", (data) => {
-      if (stdoutTruncated)
-        return;
-      const chunk = data.toString();
-      const chunkBytes = Buffer.byteLength(chunk, "utf8");
-      if (stdoutBytes + chunkBytes > maxOutputBytes) {
-        const remaining = Math.max(0, maxOutputBytes - stdoutBytes);
-        stdout += Buffer.from(chunk, "utf8").subarray(0, remaining).toString("utf8");
-        stdoutBytes = maxOutputBytes;
-        stdoutTruncated = true;
-        settle({
-          stdout,
-          stderr,
-          exitCode: -1
-        });
-        try {
-          child.kill("SIGTERM");
-        } catch (e) {
-          if (e instanceof Error && !e.message.includes("ESRCH")) {
-            log("[semgrep] child.kill failed:", e.message);
-          }
-        }
-      } else {
-        stdout += chunk;
-        stdoutBytes += chunkBytes;
-      }
-    });
-    child.stderr?.on("data", (data) => {
-      if (stderrTruncated)
-        return;
-      const chunk = data.toString();
-      const chunkBytes = Buffer.byteLength(chunk, "utf8");
-      if (stderrBytes + chunkBytes > maxOutputBytes) {
-        const remaining = Math.max(0, maxOutputBytes - stderrBytes);
-        stderr += Buffer.from(chunk, "utf8").subarray(0, remaining).toString("utf8");
-        stderrBytes = maxOutputBytes;
-        stderrTruncated = true;
-        settle({
-          stdout,
-          stderr,
-          exitCode: -1
-        });
-        try {
-          child.kill("SIGTERM");
-        } catch (e) {
-          if (e instanceof Error && !e.message.includes("ESRCH")) {
-            log("[semgrep] child.kill failed:", e.message);
-          }
-        }
-      } else {
-        stderr += chunk;
-        stderrBytes += chunkBytes;
-      }
-    });
-    child.on("close", (code) => {
-      settle({
-        stdout,
-        stderr,
-        exitCode: code ?? 0
-      });
-    });
-    child.on("error", (err) => {
-      settle({
-        stdout,
-        stderr: err.message,
-        exitCode: 1
-      });
-    });
-  });
-}
 async function runSemgrep(options) {
   const files = options.files || [];
   const rulesDir = options.rulesDir || DEFAULT_RULES_DIR;
@@ -36810,7 +36847,24 @@ async function runSemgrep(options) {
       engine: "tier_a"
     };
   }
-  if (!_internals50.isSemgrepAvailable()) {
+  if (!await _internals50.checkSemgrepAvailable(options.cwd, options.abortSignal)) {
+    if (options.abortSignal?.aborted) {
+      return {
+        available: true,
+        findings: [],
+        error: "Semgrep execution cancelled",
+        engine: "tier_a"
+      };
+    }
+    return {
+      available: false,
+      findings: [],
+      error: "Semgrep is not installed or not available on PATH",
+      engine: "tier_a"
+    };
+  }
+  const executable = _internals50.resolveSemgrepBinary();
+  if (!executable) {
     return {
       available: false,
       findings: [],
@@ -36828,11 +36882,16 @@ async function runSemgrep(options) {
   }
   args.push(...files);
   try {
-    const result = await executeWithTimeout("semgrep", args, {
+    const result = await _internals50.runExternalTool({
+      executable,
+      args,
+      cwd: options.cwd ?? _internals50.getAvailabilityProbeCwd(),
       timeoutMs,
-      cwd: options.cwd
+      maxStdoutBytes: MAX_OUTPUT_BYTES,
+      maxStderrBytes: MAX_OUTPUT_BYTES,
+      abortSignal: options.abortSignal
     });
-    if (result.truncated) {
+    if (result.stdoutTruncated || result.stderrTruncated) {
       return {
         available: true,
         findings: [],
@@ -36840,6 +36899,14 @@ async function runSemgrep(options) {
         engine: "tier_a"
       };
     }
+    if (result.status !== "completed") {
+      return {
+        available: true,
+        findings: [],
+        error: describeExternalToolFailure(result.status),
+        engine: "tier_a"
+      };
+    }
     if (result.exitCode !== 0) {
       if (result.exitCode === 1 && result.stdout) {
         const findings2 = parseSemgrepResults(result.stdout);
@@ -36852,7 +36919,7 @@ async function runSemgrep(options) {
       return {
         available: true,
         findings: [],
-        error: result.stderr || `Semgrep exited with code ${result.exitCode}`,
+        error: `Semgrep exited with code ${result.exitCode}`,
         engine: "tier_a"
       };
     }
@@ -36863,11 +36930,11 @@ async function runSemgrep(options) {
       engine: "tier_a+tier_b"
     };
   } catch (error2) {
-    const errorMessage = error2 instanceof Error ? error2.message : "Unknown error running Semgrep";
+    const safeError = error2 instanceof SemgrepScanError || error2 instanceof Error && error2.message === "Semgrep returned invalid JSON output" ? error2.message : "Semgrep execution failed unexpectedly";
     return {
       available: true,
       findings: [],
-      error: errorMessage,
+      error: safeError,
       engine: "tier_a"
     };
   }
@@ -36981,8 +37048,30 @@ function assignOccurrenceIndices(findings, directory) {
     };
   });
 }
-async function acquireLock2(lockPath) {
+async function waitForLockRetry(delayMs, abortSignal) {
+  if (abortSignal?.aborted)
+    return false;
+  return await new Promise((resolve19) => {
+    let settled = false;
+    const finish = (value) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timeout);
+      abortSignal?.removeEventListener("abort", onAbort);
+      resolve19(value);
+    };
+    const onAbort = () => finish(false);
+    const timeout = setTimeout(() => finish(true), delayMs);
+    abortSignal?.addEventListener("abort", onAbort, { once: true });
+    if (abortSignal?.aborted)
+      onAbort();
+  });
+}
+async function acquireLock2(lockPath, abortSignal) {
   for (let attempt = 0;attempt <= LOCK_RETRY_DELAYS_MS.length; attempt++) {
+    if (abortSignal?.aborted)
+      return null;
     try {
       const fd = fs25.openSync(lockPath, "wx");
       fs25.closeSync(fd);
@@ -36994,7 +37083,9 @@ async function acquireLock2(lockPath) {
       };
     } catch {
       if (attempt < LOCK_RETRY_DELAYS_MS.length) {
-        await new Promise((resolve19) => setTimeout(resolve19, LOCK_RETRY_DELAYS_MS[attempt]));
+        if (!await waitForLockRetry(LOCK_RETRY_DELAYS_MS[attempt], abortSignal)) {
+          return null;
+        }
       }
     }
   }
@@ -37029,9 +37120,19 @@ async function captureOrMergeBaseline(directory, phase, findings, engine, scanne
       message: e instanceof Error ? e.message : "Path validation failed"
     };
   }
+  if (opts?.abortSignal?.aborted) {
+    return { status: "error", message: "SAST baseline capture cancelled" };
+  }
   fs25.mkdirSync(path62.dirname(baselinePath), { recursive: true });
   fs25.mkdirSync(path62.dirname(tempPath), { recursive: true });
-  const releaseLock = await acquireLock2(lockPath);
+  const releaseLock = await acquireLock2(lockPath, opts?.abortSignal);
+  if (!releaseLock) {
+    return { status: "error", message: "SAST baseline capture cancelled" };
+  }
+  if (opts?.abortSignal?.aborted) {
+    releaseLock();
+    return { status: "error", message: "SAST baseline capture cancelled" };
+  }
   try {
     let existing = null;
     try {
@@ -37095,7 +37196,14 @@ async function captureOrMergeBaseline(directory, phase, findings, engine, scanne
           message: `Baseline would exceed size cap (${json2.length} bytes > ${MAX_BASELINE_BYTES})`
         };
       }
+      if (opts?.abortSignal?.aborted) {
+        return { status: "error", message: "SAST baseline capture cancelled" };
+      }
       fs25.writeFileSync(tempPath, json2, "utf-8");
+      if (opts?.abortSignal?.aborted) {
+        fs25.rmSync(tempPath, { force: true });
+        return { status: "error", message: "SAST baseline capture cancelled" };
+      }
       fs25.renameSync(tempPath, baselinePath);
       invalidateCachedArtifact(baselinePath);
       return {
@@ -37128,7 +37236,14 @@ async function captureOrMergeBaseline(directory, phase, findings, engine, scanne
         message: `Baseline would exceed size cap (${json.length} bytes > ${MAX_BASELINE_BYTES})`
       };
     }
+    if (opts?.abortSignal?.aborted) {
+      return { status: "error", message: "SAST baseline capture cancelled" };
+    }
     fs25.writeFileSync(tempPath, json, "utf-8");
+    if (opts?.abortSignal?.aborted) {
+      fs25.rmSync(tempPath, { force: true });
+      return { status: "error", message: "SAST baseline capture cancelled" };
+    }
     fs25.renameSync(tempPath, baselinePath);
     invalidateCachedArtifact(baselinePath);
     return {
@@ -37250,6 +37365,36 @@ function countBySeverity(findings) {
   }
   return counts;
 }
+function safeSemgrepDiagnostic(message) {
+  const diagnostic = message.trim();
+  if (diagnostic === "Semgrep process timed out" || diagnostic === "Semgrep execution cancelled" || diagnostic === "Semgrep is not installed or not available on PATH" || diagnostic === "Semgrep returned invalid JSON output" || diagnostic === "Semgrep process failed to start or terminate safely" || diagnostic === "Semgrep execution failed unexpectedly") {
+    return diagnostic;
+  }
+  if (/^Semgrep exited with code -?\d+$/.test(diagnostic)) {
+    return diagnostic;
+  }
+  if (/^Semgrep reported \d+ scan errors?$/.test(diagnostic)) {
+    return diagnostic;
+  }
+  if (diagnostic.startsWith("Semgrep output exceeded")) {
+    return "Semgrep output exceeded its bounded limit; results incomplete";
+  }
+  return "Semgrep execution failed";
+}
+function cancelledScanResult(findings, filesScanned) {
+  const finalFindings = findings.slice(0, MAX_FINDINGS);
+  return {
+    verdict: "fail",
+    error: "SAST scan cancelled",
+    findings: finalFindings,
+    summary: {
+      engine: "tier_a",
+      files_scanned: filesScanned,
+      findings_count: finalFindings.length,
+      findings_by_severity: countBySeverity(finalFindings)
+    }
+  };
+}
 function scanFileWithTierA(filePath, language) {
   try {
     const content = fs26.readFileSync(filePath, "utf-8");
@@ -37275,7 +37420,8 @@ async function sastScan(input, directory, config) {
     severity_threshold = "medium",
     capture_baseline = false,
     phase,
-    offline_only = false
+    offline_only = false,
+    abort_signal
   } = input;
   if (config?.gates?.sast_scan?.enabled === false) {
     return {
@@ -37298,10 +37444,17 @@ async function sastScan(input, directory, config) {
   let filesScanned = 0;
   let _filesSkipped = 0;
   const scannedFilePaths = [];
-  const semgrepAvailable = !offline_only && _internals52.isSemgrepAvailable();
+  if (abort_signal?.aborted) {
+    return cancelledScanResult(allFindings, filesScanned);
+  }
+  const semgrepAvailable = !offline_only && await _internals52.checkSemgrepAvailable(directory, abort_signal);
   const engine = semgrepAvailable ? "tier_a+tier_b" : "tier_a";
   const filesByLanguage = new Map;
+  let semgrepError = abort_signal?.aborted ? "SAST scan cancelled" : undefined;
   for (const filePath of changed_files) {
+    if (abort_signal?.aborted) {
+      return cancelledScanResult(allFindings, filesScanned);
+    }
     if (typeof filePath !== "string" || !filePath) {
       _filesSkipped++;
       continue;
@@ -37356,6 +37509,10 @@ async function sastScan(input, directory, config) {
   if (semgrepAvailable && filesByLanguage.size > 0) {
     try {
       for (const [bucketKey, bucketFiles] of filesByLanguage.entries()) {
+        if (abort_signal?.aborted) {
+          semgrepError = "SAST scan cancelled";
+          break;
+        }
         if (bucketFiles.length === 0)
           continue;
         let semgrepResult;
@@ -37364,13 +37521,21 @@ async function sastScan(input, directory, config) {
           semgrepResult = await _internals52.runSemgrep({
             files: bucketFiles,
             lang,
-            useAutoConfig: true
+            useAutoConfig: true,
+            cwd: directory,
+            abortSignal: abort_signal
           });
         } else {
           semgrepResult = await _internals52.runSemgrep({
-            files: bucketFiles
+            files: bucketFiles,
+            cwd: directory,
+            abortSignal: abort_signal
           });
         }
+        if (semgrepResult.error) {
+          semgrepError = safeSemgrepDiagnostic(semgrepResult.error);
+          break;
+        }
         if (semgrepResult.findings.length > 0) {
           const semgrepFindings = semgrepResult.findings.map((f) => ({
             rule_id: f.rule_id,
@@ -37393,9 +37558,42 @@ async function sastScan(input, directory, config) {
           }
         }
       }
-    } catch (error2) {
-      warn(`SAST Scan: Semgrep failed, falling back to Tier A: ${error2}`);
+    } catch {
+      semgrepError = "Semgrep execution failed";
+    }
+  }
+  if (abort_signal?.aborted) {
+    return cancelledScanResult(allFindings, filesScanned);
+  }
+  if (semgrepError) {
+    const finalFindings2 = allFindings.slice(0, MAX_FINDINGS);
+    const summary2 = {
+      engine: "tier_a",
+      files_scanned: filesScanned,
+      findings_count: finalFindings2.length,
+      findings_by_severity: countBySeverity(finalFindings2)
+    };
+    warn(`SAST Scan: Semgrep execution failed closed: ${semgrepError}`);
+    if (abort_signal?.aborted) {
+      return cancelledScanResult(allFindings, filesScanned);
     }
+    await saveEvidence(directory, "sast_scan", {
+      task_id: "sast_scan",
+      type: "sast",
+      timestamp: new Date().toISOString(),
+      agent: "sast_scan",
+      verdict: "fail",
+      summary: `Semgrep execution failed: ${semgrepError}`,
+      ...summary2,
+      findings: finalFindings2,
+      baseline_used: false
+    }, abort_signal);
+    return {
+      verdict: "fail",
+      error: `Semgrep execution failed: ${semgrepError}`,
+      findings: finalFindings2,
+      summary: summary2
+    };
   }
   if (capture_baseline) {
     if (phase === undefined || !Number.isInteger(phase) || phase < 1) {
@@ -37426,7 +37624,10 @@ async function sastScan(input, directory, config) {
       };
     }
     const captureFindings = allFindings.slice(0, MAX_BASELINE_FINDINGS);
-    const captureResult = await captureOrMergeBaseline(directory, phase, captureFindings, engine, scannedFilePaths);
+    if (abort_signal?.aborted) {
+      return cancelledScanResult(allFindings, filesScanned);
+    }
+    const captureResult = await captureOrMergeBaseline(directory, phase, captureFindings, engine, scannedFilePaths, { abortSignal: abort_signal });
     const captureStatus = captureResult.status === "written" ? "baseline_captured" : captureResult.status === "merged" ? "baseline_merged" : undefined;
     if (captureResult.status === "error") {
       warn(`SAST Baseline: capture failed \u2014 ${captureResult.message}`);
@@ -37438,6 +37639,9 @@ async function sastScan(input, directory, config) {
       findings_count: finalFindings2.length,
       findings_by_severity: countBySeverity(finalFindings2)
     };
+    if (abort_signal?.aborted) {
+      return cancelledScanResult(allFindings, filesScanned);
+    }
     await saveEvidence(directory, "sast_scan", {
       task_id: "sast_scan",
       type: "sast",
@@ -37448,7 +37652,7 @@ async function sastScan(input, directory, config) {
       ...summary2,
       findings: finalFindings2,
       baseline_used: false
-    });
+    }, abort_signal);
     return {
       verdict: "pass",
       findings: finalFindings2,
@@ -37516,6 +37720,9 @@ async function sastScan(input, directory, config) {
     findings_count: finalFindings.length,
     findings_by_severity: findingsBySeverity
   };
+  if (abort_signal?.aborted) {
+    return cancelledScanResult(allFindings, filesScanned);
+  }
   await saveEvidence(directory, "sast_scan", {
     task_id: "sast_scan",
     type: "sast",
@@ -37530,7 +37737,7 @@ async function sastScan(input, directory, config) {
       pre_existing_findings: preExistingFindings,
       baseline_used: true
     }
-  });
+  }, abort_signal);
   const result = {
     verdict,
     findings: finalFindings,
@@ -37554,7 +37761,7 @@ var sast_scan = createSwarmTool({
     capture_baseline: exports_external.boolean().optional().describe("When true, capture/merge a phase-scoped baseline of pre-existing findings. Requires phase. Subsequent scans with phase only fail on NEW findings."),
     phase: exports_external.number().int().min(1).optional().describe("Current phase number (positive integer >= 1). Required with capture_baseline. Enables baseline diff when provided on non-capture scans.")
   },
-  execute: async (args, directory) => {
+  execute: async (args, directory, ctx) => {
     let safeArgs;
     try {
       if (args && typeof args === "object") {
@@ -37607,7 +37814,8 @@ var sast_scan = createSwarmTool({
       changed_files: safeArgs.changed_files ?? [],
       severity_threshold: safeArgs.severity_threshold ?? "medium",
       capture_baseline: safeArgs.capture_baseline,
-      phase: safeArgs.phase
+      phase: safeArgs.phase,
+      abort_signal: ctx?.abort
     };
     const result = await _internals52.sastScan(input, directory);
     return JSON.stringify(result, null, 2);
@@ -37616,6 +37824,7 @@ var sast_scan = createSwarmTool({
 var _internals52 = {
   sastScan,
   sast_scan,
+  checkSemgrepAvailable: (directory, abortSignal) => checkSemgrepAvailable(directory, abortSignal),
   isSemgrepAvailable: () => isSemgrepAvailable(),
   runSemgrep: (options) => runSemgrep(options)
 };
@@ -43167,6 +43376,22 @@ import * as fs30 from "fs";
 import * as path76 from "path";
 var MAX_OUTPUT_BYTES2 = 512000;
 var MAX_COMMAND_LENGTH = 500;
+var SUPPORTED_LINTERS = ["biome", "eslint"];
+var LINTER_DETECT_TIMEOUT_MS = 2000;
+var LINTER_RUN_TIMEOUT_MS = 30000;
+var OUTPUT_TRUNCATION_SUFFIX = `
+... (output truncated)`;
+var NODE_MODULES = "node_modules";
+var BIN_DIRECTORY = ".bin";
+var MAX_PACKAGE_MANIFEST_BYTES = 256 * 1024;
+var MAX_PATH_SHIM_BYTES = 64 * 1024;
+var UNSAFE_SHELL_WRAPPER_EXTENSIONS = new Set([".bat", ".cmd", ".ps1"]);
+var WINDOWS_BATCH_WRAPPER_EXTENSIONS = [".cmd", ".bat"];
+var WINDOWS_CMD_UNSAFE_TOKEN = /["%!^&|<>\r\n]/;
+var LINTER_PACKAGES = {
+  biome: "@biomejs/biome",
+  eslint: "eslint"
+};
 function validateArgs(args) {
   if (typeof args !== "object" || args === null)
     return false;
@@ -43175,112 +43400,533 @@ function validateArgs(args) {
     return false;
   return true;
 }
-function getLinterCommand(linter, mode, projectDir) {
-  const isWindows = process.platform === "win32";
-  const binDir = path76.join(projectDir, "node_modules", ".bin");
-  const biomeBin = isWindows ? path76.join(binDir, "biome.EXE") : path76.join(binDir, "biome");
-  const eslintBin = isWindows ? path76.join(binDir, "eslint.cmd") : path76.join(binDir, "eslint");
-  switch (linter) {
-    case "biome":
-      if (mode === "fix") {
-        return isWindows ? [biomeBin, "check", "--write", "."] : [biomeBin, "check", "--write", "."];
+function normalizeCaseForPlatform(value, platform) {
+  return platform === "win32" ? value.toLowerCase() : value;
+}
+function normalizeRelativePathForPlatform(value, platform) {
+  return normalizeCaseForPlatform(value.replaceAll("\\", "/").replace(/\/+/g, "/"), platform);
+}
+function isRegularFile(candidate) {
+  try {
+    return _internals64.statSync(candidate).isFile();
+  } catch {
+    return false;
+  }
+}
+function readTextFileBounded(filePath, maxBytes) {
+  let fd;
+  try {
+    fd = _internals64.openSync(filePath, "r");
+    const stats = _internals64.fstatSync(fd);
+    if (!stats.isFile() || !Number.isSafeInteger(stats.size) || stats.size < 0 || stats.size > maxBytes) {
+      return null;
+    }
+    const bytes = Buffer.alloc(stats.size);
+    let offset = 0;
+    while (offset < bytes.byteLength) {
+      const bytesRead = _internals64.readSync(fd, bytes, offset, bytes.byteLength - offset, null);
+      if (bytesRead === 0)
+        break;
+      offset += bytesRead;
+    }
+    const overflowProbe = Buffer.alloc(1);
+    if (_internals64.readSync(fd, overflowProbe, 0, 1, null) > 0)
+      return null;
+    return bytes.subarray(0, offset).toString("utf8");
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) {
+      try {
+        _internals64.closeSync(fd);
+      } catch {}
+    }
+  }
+}
+function toAbsoluteDirectory(directory) {
+  return path76.isAbsolute(directory) ? directory : path76.resolve(directory);
+}
+function getAncestorDirectories(directory) {
+  const resolved = path76.resolve(directory);
+  const roots = [];
+  let current = resolved;
+  for (;; ) {
+    roots.push(current);
+    const parent = path76.dirname(current);
+    if (parent === current)
+      break;
+    current = parent;
+  }
+  return roots;
+}
+function getTrustedShimNames(linter, platform = _internals64.platform()) {
+  const isWindows = platform === "win32";
+  if (linter === "biome") {
+    return isWindows ? ["biome.exe", "biome.cmd", "biome.ps1"] : ["biome"];
+  }
+  return isWindows ? ["eslint.exe", "eslint.cmd", "eslint.ps1"] : ["eslint"];
+}
+function getExpectedPackageBinRelativePath(linter) {
+  return linter === "biome" ? "bin/biome" : "bin/eslint.js";
+}
+function getPackageRootFromSearchRoot(searchRoot, linter) {
+  return path76.join(searchRoot, NODE_MODULES, ...LINTER_PACKAGES[linter].split("/"));
+}
+function getPackageManifestPath(searchRoot, linter) {
+  return path76.join(getPackageRootFromSearchRoot(searchRoot, linter), "package.json");
+}
+function getPackageDisplayPath(searchRoot, linter) {
+  return path76.join(searchRoot, NODE_MODULES, BIN_DIRECTORY, linter === "biome" ? _internals64.platform() === "win32" ? "biome.exe" : "biome" : _internals64.platform() === "win32" ? "eslint" : "eslint");
+}
+function getBiomeNativePackage(platform, arch) {
+  const archMap = platform === "darwin" ? { arm64: "@biomejs/cli-darwin-arm64", x64: "@biomejs/cli-darwin-x64" } : platform === "linux" ? {
+    arm64: "@biomejs/cli-linux-arm64",
+    arm: "@biomejs/cli-linux-arm",
+    x64: "@biomejs/cli-linux-x64"
+  } : platform === "win32" ? {
+    arm64: "@biomejs/cli-win32-arm64",
+    x64: "@biomejs/cli-win32-x64"
+  } : null;
+  if (!archMap)
+    return null;
+  return archMap[arch] ?? null;
+}
+function getBiomeNativeExecutable(searchRoot, platform = _internals64.platform(), arch = _internals64.arch()) {
+  const nativePackage = getBiomeNativePackage(platform, arch);
+  if (!nativePackage)
+    return null;
+  const executableName = platform === "win32" ? "biome.exe" : "biome";
+  const candidate = path76.join(searchRoot, NODE_MODULES, ...nativePackage.split("/"), executableName);
+  return isRegularFile(candidate) ? candidate : null;
+}
+function resolvePackageBinEntry(manifestPath, linter) {
+  try {
+    const contents = readTextFileBounded(manifestPath, MAX_PACKAGE_MANIFEST_BYTES);
+    if (contents === null)
+      return null;
+    const manifest = JSON.parse(contents);
+    if (typeof manifest.bin === "string") {
+      return manifest.bin;
+    }
+    if (manifest.bin && typeof manifest.bin === "object") {
+      const key = linter === "biome" ? "biome" : "eslint";
+      const entry = manifest.bin[key];
+      return typeof entry === "string" ? entry : null;
+    }
+  } catch {}
+  return null;
+}
+function resolveCanonicalPackageCommand(searchRoot, linter, source) {
+  const manifestPath = getPackageManifestPath(searchRoot, linter);
+  if (!isRegularFile(manifestPath))
+    return null;
+  const relativeBinPath = resolvePackageBinEntry(manifestPath, linter);
+  if (!relativeBinPath)
+    return null;
+  let canonicalPackageRoot;
+  let canonicalCandidate;
+  try {
+    const packageRoot = path76.dirname(manifestPath);
+    canonicalPackageRoot = _internals64.realpathSync(packageRoot);
+    canonicalCandidate = _internals64.realpathSync(path76.resolve(packageRoot, relativeBinPath));
+  } catch {
+    return null;
+  }
+  const relativeToPackage = path76.relative(canonicalPackageRoot, canonicalCandidate);
+  if (relativeToPackage === "" || relativeToPackage.startsWith("..") || path76.isAbsolute(relativeToPackage)) {
+    return null;
+  }
+  if (!isRegularFile(canonicalCandidate))
+    return null;
+  return {
+    linter,
+    executable: _internals64.execPath(),
+    argsPrefix: [canonicalCandidate],
+    displayPrefix: [getPackageDisplayPath(searchRoot, linter)],
+    source
+  };
+}
+function hasTrustedLocalShim(searchRoot, linter) {
+  const binRoot = path76.join(searchRoot, NODE_MODULES, BIN_DIRECTORY);
+  for (const name of getTrustedShimNames(linter)) {
+    if (isRegularFile(path76.join(binRoot, name))) {
+      return true;
+    }
+  }
+  return false;
+}
+function resolveLocalLinterCommand(linter, directory) {
+  const roots = getAncestorDirectories(directory);
+  for (const root of roots) {
+    if (linter === "biome") {
+      const nativeExecutable = getBiomeNativeExecutable(root);
+      if (nativeExecutable) {
+        return {
+          linter,
+          executable: nativeExecutable,
+          argsPrefix: [],
+          displayPrefix: [nativeExecutable],
+          source: "local-native"
+        };
       }
-      return isWindows ? [biomeBin, "check", "."] : [biomeBin, "check", "."];
-    case "eslint":
-      if (mode === "fix") {
-        return isWindows ? [eslintBin, ".", "--fix"] : [eslintBin, ".", "--fix"];
+    }
+    if (hasTrustedLocalShim(root, linter)) {
+      const resolvedFromShim = resolveCanonicalPackageCommand(root, linter, "local-shim");
+      if (resolvedFromShim)
+        return resolvedFromShim;
+    }
+    const resolvedPackage = resolveCanonicalPackageCommand(root, linter, "safe-package-bin");
+    if (resolvedPackage)
+      return resolvedPackage;
+  }
+  return null;
+}
+function findPathShimCandidate(linter, envPath = _internals64.pathEnv(), platform = _internals64.platform()) {
+  const entries = envPath.split(path76.delimiter).filter(Boolean);
+  const shimNames = getTrustedShimNames(linter, platform).filter((name) => name.endsWith(".cmd") || name.endsWith(".ps1") || platform !== "win32");
+  for (const entry of entries) {
+    for (const shimName of shimNames) {
+      const candidate = path76.join(entry, shimName);
+      if (isRegularFile(candidate)) {
+        return candidate;
       }
-      return isWindows ? [eslintBin, "."] : [eslintBin, "."];
+    }
   }
+  return null;
 }
-function getAdditionalLinterCommand(linter, mode, cwd) {
-  const gradlewName = process.platform === "win32" ? "gradlew.bat" : "gradlew";
-  const gradlew = fs30.existsSync(path76.join(cwd, gradlewName)) ? path76.join(cwd, gradlewName) : null;
-  switch (linter) {
-    case "ruff":
-      return mode === "fix" ? ["ruff", "check", "--fix", "."] : ["ruff", "check", "."];
-    case "clippy":
-      return mode === "fix" ? ["cargo", "clippy", "--fix", "--allow-dirty"] : ["cargo", "clippy"];
-    case "golangci-lint":
-      return mode === "fix" ? ["golangci-lint", "run", "--fix"] : ["golangci-lint", "run"];
-    case "checkstyle":
-      if (gradlew) {
-        return [gradlew, "checkstyleMain"];
+function getExpectedShimSuffixes(linter) {
+  const packageParts = LINTER_PACKAGES[linter].split("/");
+  const packageSuffix = path76.join("..", ...packageParts, ...getExpectedPackageBinRelativePath(linter).split("/"));
+  const nestedNodeModulesSuffix = path76.join("..", NODE_MODULES, ...packageParts, ...getExpectedPackageBinRelativePath(linter).split("/"));
+  const packageOnlySuffix = path76.join(...packageParts, ...getExpectedPackageBinRelativePath(linter).split("/"));
+  const nodeModulesPackageOnlySuffix = path76.join(NODE_MODULES, ...packageParts, ...getExpectedPackageBinRelativePath(linter).split("/"));
+  return [
+    normalizeRelativePathForPlatform(packageSuffix, "win32"),
+    normalizeRelativePathForPlatform(nestedNodeModulesSuffix, "win32"),
+    normalizeRelativePathForPlatform(packageOnlySuffix, "win32"),
+    normalizeRelativePathForPlatform(nodeModulesPackageOnlySuffix, "win32"),
+    normalizeRelativePathForPlatform(packageSuffix, "linux"),
+    normalizeRelativePathForPlatform(nestedNodeModulesSuffix, "linux"),
+    normalizeRelativePathForPlatform(packageOnlySuffix, "linux"),
+    normalizeRelativePathForPlatform(nodeModulesPackageOnlySuffix, "linux")
+  ];
+}
+function resolvePathShimTarget(shimPath, linter, platform = _internals64.platform()) {
+  const contents = readTextFileBounded(shimPath, MAX_PATH_SHIM_BYTES);
+  if (contents === null)
+    return null;
+  const ext = path76.extname(shimPath).toLowerCase();
+  let relativeTarget = null;
+  if (ext === ".cmd") {
+    const regex = /"%(?:dp0%|~dp0)(?<suffix>(?:\\[^"%]+)+)"/gi;
+    for (const match of contents.matchAll(regex)) {
+      const suffix = match.groups?.suffix;
+      if (!suffix)
+        continue;
+      const normalized = normalizeRelativePathForPlatform(suffix, "win32");
+      if (getExpectedShimSuffixes(linter).some((expected) => normalized.endsWith(expected))) {
+        relativeTarget = suffix;
+        break;
       }
-      if (isCommandAvailable("gradle")) {
-        return ["gradle", "checkstyleMain"];
+    }
+  } else if (ext === ".ps1") {
+    const regex = /"\$basedir(?:_win)?\/(?<suffix>\.\.\/[^"\r\n]+)"/gi;
+    for (const match of contents.matchAll(regex)) {
+      const suffix = match.groups?.suffix;
+      if (!suffix)
+        continue;
+      const normalized = normalizeRelativePathForPlatform(suffix, platform);
+      if (getExpectedShimSuffixes(linter).some((expected) => normalized.endsWith(expected))) {
+        relativeTarget = suffix;
+        break;
       }
-      return ["mvn", "checkstyle:check"];
-    case "ktlint":
-      return mode === "fix" ? ["ktlint", "--format"] : ["ktlint"];
-    case "dotnet-format":
-      return mode === "fix" ? ["dotnet", "format"] : ["dotnet", "format", "--verify-no-changes"];
-    case "cppcheck":
-      return ["cppcheck", "--enable=all", "."];
-    case "swiftlint":
-      return mode === "fix" ? ["swiftlint", "--fix"] : ["swiftlint"];
-    case "dart-analyze":
-      return mode === "fix" ? ["dart", "fix"] : ["dart", "analyze"];
-    case "rubocop": {
-      const useBundle = isCommandAvailable("bundle");
-      const base = useBundle ? ["bundle", "exec", "rubocop"] : ["rubocop"];
-      return mode === "fix" ? [...base, "-A"] : base;
-    }
-    case "phpstan":
-      return [phpVendorBin(cwd, "phpstan"), "analyse"];
-    case "pint":
-      return mode === "fix" ? [phpVendorBin(cwd, "pint")] : [phpVendorBin(cwd, "pint"), "--test"];
-    case "php-cs-fixer":
-      return mode === "fix" ? [phpVendorBin(cwd, "php-cs-fixer"), "fix"] : [phpVendorBin(cwd, "php-cs-fixer"), "fix", "--dry-run", "--diff"];
-    case "phpcs":
-      return [phpVendorBin(cwd, "phpcs")];
+    }
+  } else {
+    const regex = /"\$basedir(?:_win)?\/(?<suffix>\.\.\/[^"\r\n]+)"/gi;
+    for (const match of contents.matchAll(regex)) {
+      const suffix = match.groups?.suffix;
+      if (!suffix)
+        continue;
+      const normalized = normalizeRelativePathForPlatform(suffix, platform);
+      if (getExpectedShimSuffixes(linter).some((expected) => normalized.endsWith(expected))) {
+        relativeTarget = suffix;
+        break;
+      }
+    }
+  }
+  if (!relativeTarget)
+    return null;
+  let canonicalShimDir;
+  try {
+    canonicalShimDir = _internals64.realpathSync(path76.dirname(shimPath));
+  } catch {
+    return null;
+  }
+  const resolvedTarget = path76.resolve(canonicalShimDir, relativeTarget.replaceAll("\\", path76.sep).replace(/^[\\/]+/, ""));
+  if (!isRegularFile(resolvedTarget))
+    return null;
+  let canonicalTarget;
+  try {
+    canonicalTarget = _internals64.realpathSync(resolvedTarget);
+  } catch {
+    return null;
+  }
+  const targetPackageMarker = path76.join(NODE_MODULES, ...LINTER_PACKAGES[linter].split("/"));
+  if (!normalizeCaseForPlatform(canonicalTarget, platform).includes(normalizeCaseForPlatform(targetPackageMarker, platform))) {
+    return null;
+  }
+  let canonicalShimParent;
+  try {
+    canonicalShimParent = _internals64.realpathSync(path76.dirname(canonicalShimDir));
+  } catch {
+    return null;
+  }
+  const allowedRoots = [canonicalShimDir, canonicalShimParent];
+  const isContained2 = allowedRoots.some((root) => {
+    const relative10 = path76.relative(root, canonicalTarget);
+    return relative10 === "" || !relative10.startsWith("..") && !path76.isAbsolute(relative10);
+  });
+  if (!isContained2)
+    return null;
+  return canonicalTarget;
+}
+function resolvePathLinterCommand(linter, directory) {
+  const platform = _internals64.platform();
+  const envPath = _internals64.pathEnv();
+  const nativeNames = platform === "win32" ? linter === "biome" ? ["biome.exe"] : ["eslint.exe"] : linter === "biome" ? ["biome"] : ["eslint"];
+  const nativeExecutable = resolveExecutableFromPath(nativeNames, envPath, platform);
+  if (nativeExecutable) {
+    return {
+      linter,
+      executable: nativeExecutable,
+      argsPrefix: [],
+      displayPrefix: [nativeExecutable],
+      source: "path-native"
+    };
+  }
+  const shimCandidate = findPathShimCandidate(linter, envPath, platform);
+  if (!shimCandidate)
+    return null;
+  const shimTarget = resolvePathShimTarget(shimCandidate, linter, platform);
+  if (!shimTarget)
+    return null;
+  return {
+    linter,
+    executable: _internals64.execPath(),
+    argsPrefix: [shimTarget],
+    displayPrefix: [path76.join(directory, NODE_MODULES, BIN_DIRECTORY, linter)],
+    source: "path-shim"
+  };
+}
+function getLintModeArgs(linter, mode) {
+  if (linter === "biome") {
+    return mode === "fix" ? ["check", "--write", "."] : ["check", "."];
+  }
+  return mode === "fix" ? [".", "--fix"] : ["."];
+}
+function combineOutput(result) {
+  let output = result.stdout;
+  if (result.stderr) {
+    output += `${output ? `
+` : ""}${result.stderr}`;
+  }
+  const shouldTruncate = result.stdoutTruncated || result.stderrTruncated || output.length > MAX_OUTPUT_BYTES2;
+  if (!shouldTruncate)
+    return output;
+  const trimmed = output.slice(0, MAX_OUTPUT_BYTES2);
+  return `${trimmed}${OUTPUT_TRUNCATION_SUFFIX}`;
+}
+function buildExecutionError(mode, command, linter, result) {
+  const reason = result.message ?? (result.status === "timeout" ? "command timed out" : result.status === "cancelled" ? "command was cancelled" : "unknown error");
+  return {
+    success: false,
+    mode,
+    linter,
+    command,
+    exitCode: result.exitCode ?? undefined,
+    output: combineOutput(result),
+    error: `Execution failed: ${reason}`
+  };
+}
+async function probeResolvedCommand(command, cwd, abortSignal) {
+  const result = await _internals64.runExternalTool({
+    executable: command.executable,
+    args: [...command.argsPrefix, "--version"],
+    cwd,
+    timeoutMs: LINTER_DETECT_TIMEOUT_MS,
+    maxStdoutBytes: 4096,
+    maxStderrBytes: 4096,
+    abortSignal
+  });
+  return result.status === "completed" && result.exitCode === 0;
+}
+async function resolveLinterCommand(linter, directory) {
+  const cwd = toAbsoluteDirectory(directory);
+  return resolveLocalLinterCommand(linter, cwd) ?? resolvePathLinterCommand(linter, cwd);
+}
+async function detectResolvedLinter(directory, abortSignal) {
+  if (!directory)
+    return null;
+  if (!_internals64.existsSync(directory))
+    return null;
+  const cwd = toAbsoluteDirectory(directory);
+  for (const linter of SUPPORTED_LINTERS) {
+    const resolved = await resolveLinterCommand(linter, cwd);
+    if (!resolved)
+      continue;
+    if (await probeResolvedCommand(resolved, cwd, abortSignal)) {
+      return resolved;
+    }
   }
+  return null;
 }
 function detectRuff(cwd) {
-  if (fs30.existsSync(path76.join(cwd, "ruff.toml")))
-    return isCommandAvailable("ruff");
+  if (_internals64.existsSync(path76.join(cwd, "ruff.toml")))
+    return hasAdditionalCommand("ruff");
   try {
     const pyproject = path76.join(cwd, "pyproject.toml");
-    if (fs30.existsSync(pyproject)) {
-      const content = fs30.readFileSync(pyproject, "utf-8");
+    if (_internals64.existsSync(pyproject)) {
+      const content = _internals64.readFileSync(pyproject, "utf-8");
       if (content.includes("[tool.ruff]"))
-        return isCommandAvailable("ruff");
+        return hasAdditionalCommand("ruff");
     }
   } catch {}
   return false;
 }
 function detectClippy(cwd) {
-  return fs30.existsSync(path76.join(cwd, "Cargo.toml")) && isCommandAvailable("cargo");
+  return _internals64.existsSync(path76.join(cwd, "Cargo.toml")) && hasAdditionalCommand("cargo");
 }
 function detectGolangciLint(cwd) {
-  return fs30.existsSync(path76.join(cwd, "go.mod")) && isCommandAvailable("golangci-lint");
+  return _internals64.existsSync(path76.join(cwd, "go.mod")) && hasAdditionalCommand("golangci-lint");
 }
 function readTextFileSafe(filePath) {
   try {
-    return fs30.readFileSync(filePath, "utf-8");
+    return _internals64.readFileSync(filePath, "utf-8");
   } catch {
     return "";
   }
 }
-function phpVendorBin(_cwd, name) {
-  const fileName = process.platform === "win32" ? `${name}.bat` : name;
-  return path76.join("vendor", "bin", fileName);
+function resolveAdditionalExecutable(name) {
+  const platform = _internals64.platform();
+  if (platform !== "win32") {
+    return _internals64.isCommandAvailable(name) ? name : null;
+  }
+  return resolveExecutableFromPath([`${name}.exe`], _internals64.pathEnv(), platform);
+}
+function resolveWindowsCommandInterpreter() {
+  const candidate = _internals64.comSpec();
+  if (!candidate || !path76.isAbsolute(candidate) || path76.basename(candidate).toLowerCase() !== "cmd.exe" || !isRegularFile(candidate)) {
+    return null;
+  }
+  try {
+    const canonical = _internals64.realpathSync(candidate);
+    return path76.basename(canonical).toLowerCase() === "cmd.exe" ? canonical : null;
+  } catch {
+    return null;
+  }
+}
+function buildWindowsBatchCommand(wrapperPath, args) {
+  const interpreter = resolveWindowsCommandInterpreter();
+  if (!interpreter)
+    return null;
+  let canonicalWrapper;
+  try {
+    canonicalWrapper = _internals64.realpathSync(wrapperPath);
+  } catch {
+    return null;
+  }
+  if (!isRegularFile(canonicalWrapper) || !WINDOWS_BATCH_WRAPPER_EXTENSIONS.includes(path76.extname(canonicalWrapper).toLowerCase())) {
+    return null;
+  }
+  const tokens = [canonicalWrapper, ...args];
+  if (tokens.some((token) => WINDOWS_CMD_UNSAFE_TOKEN.test(token)))
+    return null;
+  const command = `call ${tokens.map((token) => `"${token}"`).join(" ")}`;
+  return [interpreter, "/d", "/s", "/v:off", "/c", command];
+}
+function resolveWindowsBatchCommandFromPath(name, args) {
+  if (_internals64.platform() !== "win32")
+    return null;
+  const wrapper = resolveExecutableFromPath(WINDOWS_BATCH_WRAPPER_EXTENSIONS.map((extension) => `${name}${extension}`), _internals64.pathEnv(), "win32");
+  return wrapper ? buildWindowsBatchCommand(wrapper, args) : null;
+}
+function resolveContainedWindowsBatchCommand(cwd, fileName, args) {
+  if (_internals64.platform() !== "win32")
+    return null;
+  const candidate = path76.join(cwd, fileName);
+  if (!isRegularFile(candidate))
+    return null;
+  let canonicalCwd;
+  let canonicalCandidate;
+  try {
+    canonicalCwd = _internals64.realpathSync(cwd);
+    canonicalCandidate = _internals64.realpathSync(candidate);
+  } catch {
+    return null;
+  }
+  const relative10 = path76.relative(canonicalCwd, canonicalCandidate);
+  if (relative10 === "" || relative10.startsWith("..") || path76.isAbsolute(relative10)) {
+    return null;
+  }
+  return buildWindowsBatchCommand(canonicalCandidate, args);
+}
+function buildAdditionalCommand(name, args) {
+  const executable = resolveAdditionalExecutable(name);
+  if (executable)
+    return [executable, ...args];
+  return resolveWindowsBatchCommandFromPath(name, args);
+}
+function hasAdditionalCommand(name) {
+  return buildAdditionalCommand(name, []) !== null;
+}
+function resolvePhpVendorCommand(cwd, name) {
+  const relativeProxy = path76.join("vendor", "bin", name);
+  if (!_internals64.existsSync(path76.join(cwd, relativeProxy)))
+    return null;
+  if (_internals64.platform() !== "win32")
+    return [relativeProxy];
+  const phpExecutable = resolveAdditionalExecutable("php");
+  return phpExecutable ? [phpExecutable, relativeProxy] : null;
+}
+function hasCheckstyleGradleSignal(cwd) {
+  const gradleFiles = ["build.gradle", "build.gradle.kts"].map((file) => path76.join(cwd, file)).filter((file) => _internals64.existsSync(file));
+  return _internals64.existsSync(path76.join(cwd, "checkstyle.xml")) || _internals64.existsSync(path76.join(cwd, "config", "checkstyle", "checkstyle.xml")) || gradleFiles.some((file) => /\bcheckstyle\b/i.test(readTextFileSafe(file)));
+}
+function resolveCheckstyleCommand(cwd) {
+  const hasMavenProject = _internals64.existsSync(path76.join(cwd, "pom.xml"));
+  const hasGradleSignal = hasCheckstyleGradleSignal(cwd);
+  if (hasGradleSignal) {
+    if (_internals64.platform() === "win32") {
+      const gradlew = resolveContainedWindowsBatchCommand(cwd, "gradlew.bat", [
+        "checkstyleMain"
+      ]);
+      if (gradlew)
+        return gradlew;
+    } else {
+      const gradlew = path76.join(cwd, "gradlew");
+      if (_internals64.existsSync(gradlew))
+        return [gradlew, "checkstyleMain"];
+    }
+    const gradle = buildAdditionalCommand("gradle", ["checkstyleMain"]);
+    if (gradle) {
+      return gradle;
+    }
+  }
+  const maven = buildAdditionalCommand("mvn", ["checkstyle:check"]);
+  if (hasMavenProject && maven) {
+    return maven;
+  }
+  return null;
 }
-function phpVendorBinExists(cwd, name) {
-  const local = path76.join(cwd, "vendor", "bin", name);
-  const localWin = path76.join(cwd, "vendor", "bin", `${name}.bat`);
-  return fs30.existsSync(local) || fs30.existsSync(localWin);
+function isUnsafeShellWrapperExecutable(executable, platform = _internals64.platform()) {
+  return platform === "win32" && UNSAFE_SHELL_WRAPPER_EXTENSIONS.has(path76.extname(executable).toLowerCase());
 }
 function detectCheckstyle(cwd) {
-  const hasMaven = fs30.existsSync(path76.join(cwd, "pom.xml"));
-  const gradleFiles = ["build.gradle", "build.gradle.kts"].map((file) => path76.join(cwd, file)).filter((file) => fs30.existsSync(file));
-  const hasGradleCheckstyleSignal = fs30.existsSync(path76.join(cwd, "checkstyle.xml")) || fs30.existsSync(path76.join(cwd, "config", "checkstyle", "checkstyle.xml")) || gradleFiles.some((file) => /\bcheckstyle\b/i.test(readTextFileSafe(file)));
-  const hasBinary = hasMaven && isCommandAvailable("mvn") || hasGradleCheckstyleSignal && (fs30.existsSync(path76.join(cwd, "gradlew")) || isCommandAvailable("gradle"));
-  return (hasMaven || hasGradleCheckstyleSignal) && hasBinary;
+  return resolveCheckstyleCommand(cwd) !== null;
 }
 function hasRootKotlinFile(cwd) {
   try {
-    return fs30.readdirSync(cwd).some((f) => f.endsWith(".kt") || f.endsWith(".kts"));
+    return _internals64.readdirSync(cwd).some((f) => f.endsWith(".kt") || f.endsWith(".kts"));
   } catch {
     return false;
   }
@@ -43290,59 +43936,59 @@ function buildGradleHasKotlinSignal(cwd) {
   return /\b(kotlin|org\.jetbrains\.kotlin|ktlint)\b/i.test(content);
 }
 function detectKtlint(cwd) {
-  const hasKotlin = fs30.existsSync(path76.join(cwd, "build.gradle.kts")) || fs30.existsSync(path76.join(cwd, "build.gradle")) && buildGradleHasKotlinSignal(cwd) || hasRootKotlinFile(cwd);
-  return hasKotlin && isCommandAvailable("ktlint");
+  const hasKotlin = _internals64.existsSync(path76.join(cwd, "build.gradle.kts")) || _internals64.existsSync(path76.join(cwd, "build.gradle")) && buildGradleHasKotlinSignal(cwd) || hasRootKotlinFile(cwd);
+  return hasKotlin && hasAdditionalCommand("ktlint");
 }
 function detectPhpLinter(cwd) {
-  if ((fs30.existsSync(path76.join(cwd, "phpstan.neon")) || fs30.existsSync(path76.join(cwd, "phpstan.neon.dist"))) && phpVendorBinExists(cwd, "phpstan")) {
+  if ((_internals64.existsSync(path76.join(cwd, "phpstan.neon")) || _internals64.existsSync(path76.join(cwd, "phpstan.neon.dist"))) && resolvePhpVendorCommand(cwd, "phpstan") !== null) {
     return "phpstan";
   }
-  if (fs30.existsSync(path76.join(cwd, "pint.json")) && phpVendorBinExists(cwd, "pint")) {
+  if (_internals64.existsSync(path76.join(cwd, "pint.json")) && resolvePhpVendorCommand(cwd, "pint") !== null) {
     return "pint";
   }
-  if (fs30.existsSync(path76.join(cwd, ".php-cs-fixer.php")) && phpVendorBinExists(cwd, "php-cs-fixer")) {
+  if (_internals64.existsSync(path76.join(cwd, ".php-cs-fixer.php")) && resolvePhpVendorCommand(cwd, "php-cs-fixer") !== null) {
     return "php-cs-fixer";
   }
-  if (fs30.existsSync(path76.join(cwd, "phpcs.xml")) && phpVendorBinExists(cwd, "phpcs")) {
+  if (_internals64.existsSync(path76.join(cwd, "phpcs.xml")) && resolvePhpVendorCommand(cwd, "phpcs") !== null) {
     return "phpcs";
   }
   return null;
 }
 function detectDotnetFormat(cwd) {
   try {
-    const files = fs30.readdirSync(cwd);
+    const files = _internals64.readdirSync(cwd);
     const hasCsproj = files.some((f) => f.endsWith(".csproj") || f.endsWith(".sln"));
-    return hasCsproj && isCommandAvailable("dotnet");
+    return hasCsproj && hasAdditionalCommand("dotnet");
   } catch {
     return false;
   }
 }
 function detectCppcheck(cwd) {
-  if (fs30.existsSync(path76.join(cwd, "CMakeLists.txt"))) {
-    return isCommandAvailable("cppcheck");
+  if (_internals64.existsSync(path76.join(cwd, "CMakeLists.txt"))) {
+    return hasAdditionalCommand("cppcheck");
   }
   try {
     const dirsToCheck = [cwd, path76.join(cwd, "src")];
     const hasCpp = dirsToCheck.some((dir) => {
       try {
-        return fs30.readdirSync(dir).some((f) => /\.(c|cpp|cc|cxx|h|hpp)$/.test(f));
+        return _internals64.readdirSync(dir).some((f) => /\.(c|cpp|cc|cxx|h|hpp)$/.test(f));
       } catch {
         return false;
       }
     });
-    return hasCpp && isCommandAvailable("cppcheck");
+    return hasCpp && hasAdditionalCommand("cppcheck");
   } catch {
     return false;
   }
 }
 function detectSwiftlint(cwd) {
-  return fs30.existsSync(path76.join(cwd, "Package.swift")) && isCommandAvailable("swiftlint");
+  return _internals64.existsSync(path76.join(cwd, "Package.swift")) && hasAdditionalCommand("swiftlint");
 }
 function detectDartAnalyze(cwd) {
-  return fs30.existsSync(path76.join(cwd, "pubspec.yaml")) && (isCommandAvailable("dart") || isCommandAvailable("flutter"));
+  return _internals64.existsSync(path76.join(cwd, "pubspec.yaml")) && hasAdditionalCommand("dart");
 }
 function detectRubocop(cwd) {
-  return (fs30.existsSync(path76.join(cwd, "Gemfile")) || fs30.existsSync(path76.join(cwd, "gems.rb")) || fs30.existsSync(path76.join(cwd, ".rubocop.yml"))) && (isCommandAvailable("rubocop") || isCommandAvailable("bundle"));
+  return (_internals64.existsSync(path76.join(cwd, "Gemfile")) || _internals64.existsSync(path76.join(cwd, "gems.rb")) || _internals64.existsSync(path76.join(cwd, ".rubocop.yml"))) && (hasAdditionalCommand("rubocop") || hasAdditionalCommand("bundle"));
 }
 function detectAdditionalLinter(cwd) {
   if (detectRuff(cwd))
@@ -43370,208 +44016,179 @@ function detectAdditionalLinter(cwd) {
     return "rubocop";
   return null;
 }
-function findBinInAncestors(startDir, binName) {
-  let dir = startDir;
-  while (true) {
-    const candidate = path76.join(dir, "node_modules", ".bin", binName);
-    if (fs30.existsSync(candidate))
-      return candidate;
-    const parent = path76.dirname(dir);
-    if (parent === dir)
-      break;
-    dir = parent;
-  }
-  return null;
-}
-function findBinInEnvPath(binName) {
-  const searchPath = process.env.PATH ?? "";
-  for (const dir of searchPath.split(path76.delimiter)) {
-    if (!dir)
-      continue;
-    const candidate = path76.join(dir, binName);
-    if (fs30.existsSync(candidate))
-      return candidate;
-  }
-  return null;
-}
 async function detectAvailableLinter(directory) {
-  if (!directory)
-    return null;
-  if (!fs30.existsSync(directory))
-    return null;
-  const projectDir = directory;
-  const isWindows = process.platform === "win32";
-  const biomeBin = isWindows ? path76.join(projectDir, "node_modules", ".bin", "biome.EXE") : path76.join(projectDir, "node_modules", ".bin", "biome");
-  const eslintBin = isWindows ? path76.join(projectDir, "node_modules", ".bin", "eslint.cmd") : path76.join(projectDir, "node_modules", ".bin", "eslint");
-  const localResult = await _detectAvailableLinter(projectDir, biomeBin, eslintBin);
-  if (localResult)
-    return localResult;
-  const biomeAncestor = findBinInAncestors(path76.dirname(projectDir), isWindows ? "biome.EXE" : "biome");
-  const eslintAncestor = findBinInAncestors(path76.dirname(projectDir), isWindows ? "eslint.cmd" : "eslint");
-  if (biomeAncestor || eslintAncestor) {
-    return _detectAvailableLinter(projectDir, biomeAncestor ?? biomeBin, eslintAncestor ?? eslintBin);
-  }
-  const pathBiome = findBinInEnvPath(isWindows ? "biome.EXE" : "biome");
-  const pathEslint = findBinInEnvPath(isWindows ? "eslint.cmd" : "eslint");
-  if (pathBiome || pathEslint) {
-    return _detectAvailableLinter(projectDir, pathBiome ?? biomeBin, pathEslint ?? eslintBin);
-  }
-  return null;
+  const resolved = await detectResolvedLinter(directory);
+  return resolved?.linter ?? null;
 }
-async function _detectAvailableLinter(_projectDir, biomeBin, eslintBin) {
-  const DETECT_TIMEOUT = 2000;
-  try {
-    const biomeProc = bunSpawn([biomeBin, "--version"], {
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    const biomeExit = biomeProc.exited;
-    const timeout = new Promise((resolve23) => setTimeout(() => resolve23("timeout"), DETECT_TIMEOUT));
-    const result = await Promise.race([biomeExit, timeout]);
-    if (result === "timeout") {
-      biomeProc.kill();
-    } else if (biomeProc.exitCode === 0 && fs30.existsSync(biomeBin)) {
-      return "biome";
-    }
-  } catch {}
-  try {
-    const eslintProc = bunSpawn([eslintBin, "--version"], {
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    const eslintExit = eslintProc.exited;
-    const timeout = new Promise((resolve23) => setTimeout(() => resolve23("timeout"), DETECT_TIMEOUT));
-    const result = await Promise.race([eslintExit, timeout]);
-    if (result === "timeout") {
-      eslintProc.kill();
-    } else if (eslintProc.exitCode === 0 && fs30.existsSync(eslintBin)) {
-      return "eslint";
-    }
-  } catch {}
-  return null;
-}
-async function runLint(linter, mode, directory) {
-  const command = getLinterCommand(linter, mode, directory);
-  const commandStr = command.join(" ");
+async function runResolvedLint(command, mode, directory, abortSignal) {
+  const lintArgs = getLintModeArgs(command.linter, mode);
+  const displayCommand = [...command.displayPrefix, ...lintArgs];
+  const commandStr = displayCommand.join(" ");
   if (commandStr.length > MAX_COMMAND_LENGTH) {
     return {
       success: false,
       mode,
-      linter,
-      command,
+      linter: command.linter,
+      command: displayCommand,
       error: "Command exceeds maximum allowed length"
     };
   }
-  try {
-    const proc = bunSpawn(command, {
-      stdout: "pipe",
-      stderr: "pipe",
-      cwd: directory
-    });
-    const [stdout, stderr] = await Promise.all([
-      proc.stdout.text(),
-      proc.stderr.text()
-    ]);
-    const exitCode = await proc.exited;
-    let output = stdout;
-    if (stderr) {
-      output += (output ? `
-` : "") + stderr;
+  const runResult = await _internals64.runExternalTool({
+    executable: command.executable,
+    args: [...command.argsPrefix, ...lintArgs],
+    cwd: toAbsoluteDirectory(directory),
+    timeoutMs: LINTER_RUN_TIMEOUT_MS,
+    maxStdoutBytes: MAX_OUTPUT_BYTES2,
+    maxStderrBytes: MAX_OUTPUT_BYTES2,
+    abortSignal
+  });
+  if (runResult.status !== "completed") {
+    return buildExecutionError(mode, displayCommand, command.linter, runResult);
+  }
+  const exitCode = runResult.exitCode ?? 0;
+  const result = {
+    success: true,
+    mode,
+    linter: command.linter,
+    command: displayCommand,
+    exitCode,
+    output: combineOutput(runResult)
+  };
+  if (exitCode === 0) {
+    result.message = `${command.linter} ${mode} completed successfully with no issues`;
+  } else if (mode === "fix") {
+    result.message = `${command.linter} fix completed with exit code ${exitCode}. Run check mode to see remaining issues.`;
+  } else {
+    result.message = `${command.linter} check found issues (exit code ${exitCode}).`;
+  }
+  return result;
+}
+function getAdditionalLinterCommand(linter, mode, cwd) {
+  switch (linter) {
+    case "ruff":
+      return buildAdditionalCommand("ruff", mode === "fix" ? ["check", "--fix", "."] : ["check", "."]);
+    case "clippy":
+      return buildAdditionalCommand("cargo", mode === "fix" ? ["clippy", "--fix", "--allow-dirty"] : ["clippy"]);
+    case "golangci-lint":
+      return buildAdditionalCommand("golangci-lint", mode === "fix" ? ["run", "--fix"] : ["run"]);
+    case "checkstyle":
+      return resolveCheckstyleCommand(cwd);
+    case "ktlint":
+      return buildAdditionalCommand("ktlint", mode === "fix" ? ["--format"] : []);
+    case "dotnet-format":
+      return buildAdditionalCommand("dotnet", mode === "fix" ? ["format"] : ["format", "--verify-no-changes"]);
+    case "cppcheck":
+      return buildAdditionalCommand("cppcheck", ["--enable=all", "."]);
+    case "swiftlint":
+      return buildAdditionalCommand("swiftlint", mode === "fix" ? ["--fix"] : []);
+    case "dart-analyze":
+      return buildAdditionalCommand("dart", mode === "fix" ? ["fix"] : ["analyze"]);
+    case "rubocop": {
+      const bundle = buildAdditionalCommand("bundle", [
+        "exec",
+        "rubocop",
+        ...mode === "fix" ? ["-A"] : []
+      ]);
+      if (bundle) {
+        return bundle;
+      }
+      return buildAdditionalCommand("rubocop", mode === "fix" ? ["-A"] : []);
     }
-    if (output.length > MAX_OUTPUT_BYTES2) {
-      output = `${output.slice(0, MAX_OUTPUT_BYTES2)}
-... (output truncated)`;
+    case "phpstan": {
+      const base = resolvePhpVendorCommand(cwd, "phpstan");
+      return base ? [...base, "analyse"] : null;
     }
-    const result = {
-      success: true,
-      mode,
-      linter,
-      command,
-      exitCode,
-      output
-    };
-    if (exitCode === 0) {
-      result.message = `${linter} ${mode} completed successfully with no issues`;
-    } else if (mode === "fix") {
-      result.message = `${linter} fix completed with exit code ${exitCode}. Run check mode to see remaining issues.`;
-    } else {
-      result.message = `${linter} check found issues (exit code ${exitCode}).`;
+    case "pint": {
+      const base = resolvePhpVendorCommand(cwd, "pint");
+      return base ? mode === "fix" ? base : [...base, "--test"] : null;
     }
-    return result;
-  } catch (error2) {
+    case "php-cs-fixer": {
+      const base = resolvePhpVendorCommand(cwd, "php-cs-fixer");
+      return base ? mode === "fix" ? [...base, "fix"] : [...base, "fix", "--dry-run", "--diff"] : null;
+    }
+    case "phpcs":
+      return resolvePhpVendorCommand(cwd, "phpcs");
+  }
+}
+async function runLint(linter, mode, directory, abortSignal) {
+  const resolved = await _internals64.resolveLinterCommand(linter, directory);
+  if (!resolved) {
     return {
       success: false,
       mode,
       linter,
-      command,
-      error: error2 instanceof Error ? `Execution failed: ${error2.message}` : "Execution failed: unknown error"
+      error: `No safely resolved ${linter} executable found`
     };
   }
+  return runResolvedLint(resolved, mode, directory, abortSignal);
 }
-async function runAdditionalLint(linter, mode, cwd) {
+async function runAdditionalLint(linter, mode, cwd, abortSignal) {
   const command = getAdditionalLinterCommand(linter, mode, cwd);
-  const commandStr = command.join(" ");
-  if (commandStr.length > MAX_COMMAND_LENGTH) {
+  if (!command) {
     return {
       success: false,
       mode,
       linter,
-      command,
-      error: "Command exceeds maximum allowed length"
+      error: `No safely executable ${linter} command found`
     };
   }
-  try {
-    const proc = bunSpawn(command, {
-      stdout: "pipe",
-      stderr: "pipe",
-      cwd
-    });
-    const [stdout, stderr] = await Promise.all([
-      proc.stdout.text(),
-      proc.stderr.text()
-    ]);
-    const exitCode = await proc.exited;
-    let output = stdout;
-    if (stderr) {
-      output += (output ? `
-` : "") + stderr;
-    }
-    if (output.length > MAX_OUTPUT_BYTES2) {
-      output = `${output.slice(0, MAX_OUTPUT_BYTES2)}
-... (output truncated)`;
-    }
-    const result = {
-      success: true,
+  const commandStr = command.join(" ");
+  if (commandStr.length > MAX_COMMAND_LENGTH) {
+    return {
+      success: false,
       mode,
       linter,
       command,
-      exitCode,
-      output
+      error: "Command exceeds maximum allowed length"
     };
-    if (exitCode === 0) {
-      result.message = `${linter} ${mode} completed successfully with no issues`;
-    } else if (mode === "fix") {
-      result.message = `${linter} fix completed with exit code ${exitCode}. Run check mode to see remaining issues.`;
-    } else {
-      result.message = `${linter} check found issues (exit code ${exitCode}).`;
-    }
-    return result;
-  } catch (error2) {
+  }
+  const [executable, ...args] = command;
+  if (isUnsafeShellWrapperExecutable(executable)) {
     return {
       success: false,
       mode,
       linter,
       command,
-      error: error2 instanceof Error ? `Execution failed: ${error2.message}` : "Execution failed: unknown error"
+      error: `No safely executable ${linter} command found`
     };
   }
+  const runResult = await _internals64.runExternalTool({
+    executable,
+    args,
+    cwd: toAbsoluteDirectory(cwd),
+    timeoutMs: LINTER_RUN_TIMEOUT_MS,
+    maxStdoutBytes: MAX_OUTPUT_BYTES2,
+    maxStderrBytes: MAX_OUTPUT_BYTES2,
+    abortSignal,
+    windowsVerbatimArguments: _internals64.platform() === "win32" && path76.basename(executable).toLowerCase() === "cmd.exe"
+  });
+  if (runResult.status !== "completed") {
+    return buildExecutionError(mode, command, linter, runResult);
+  }
+  const exitCode = runResult.exitCode ?? 0;
+  const result = {
+    success: true,
+    mode,
+    linter,
+    command,
+    exitCode,
+    output: combineOutput(runResult)
+  };
+  if (exitCode === 0) {
+    result.message = `${linter} ${mode} completed successfully with no issues`;
+  } else if (mode === "fix") {
+    result.message = `${linter} fix completed with exit code ${exitCode}. Run check mode to see remaining issues.`;
+  } else {
+    result.message = `${linter} check found issues (exit code ${exitCode}).`;
+  }
+  return result;
 }
 var lint = createSwarmTool({
   description: "Run project linter in check or fix mode. Supports biome, eslint (JS/TS), ruff (Python), clippy (Rust), golangci-lint (Go), checkstyle (Java), ktlint (Kotlin), dotnet-format (C#), cppcheck (C/C++), swiftlint (Swift), dart analyze (Dart), and rubocop (Ruby). Returns JSON with success status, exit code, and output for architect pre-reviewer gate. Use check mode for CI/linting and fix mode to automatically apply fixes.",
   args: {
     mode: exports_external.enum(["fix", "check"]).describe('Linting mode: "check" for read-only lint check, "fix" to automatically apply fixes')
   },
-  async execute(args, directory) {
+  async execute(args, directory, ctx) {
     if (!validateArgs(args)) {
       const errorResult2 = {
         success: false,
@@ -43590,15 +44207,15 @@ var lint = createSwarmTool({
     }
     const { mode } = args;
     const cwd = directory;
-    const linter = await _internals64.detectAvailableLinter(directory);
-    if (linter) {
-      const result = await _internals64.runLint(linter, mode, directory);
+    const resolvedLinter = await _internals64.detectResolvedLinter(directory, ctx?.abort);
+    if (resolvedLinter) {
+      const result = await _internals64.runResolvedLint(resolvedLinter, mode, directory, ctx?.abort);
       return JSON.stringify(result, null, 2);
     }
     const additionalLinter = _internals64.detectAdditionalLinter(cwd);
     if (additionalLinter) {
       warn(`[lint] Using ${additionalLinter} linter for this project`);
-      const result = await _internals64.runAdditionalLint(additionalLinter, mode, cwd);
+      const result = await _internals64.runAdditionalLint(additionalLinter, mode, cwd, ctx?.abort);
       return JSON.stringify(result, null, 2);
     }
     const errorResult = {
@@ -43613,10 +44230,31 @@ For Rust: rustup component add clippy`
   }
 });
 var _internals64 = {
+  MAX_PACKAGE_MANIFEST_BYTES,
+  MAX_PATH_SHIM_BYTES,
+  arch: () => process.arch,
+  closeSync: fs30.closeSync,
+  comSpec: () => process.env.ComSpec,
+  detectAdditionalLinter,
   detectAvailableLinter,
+  detectResolvedLinter,
+  execPath: () => process.execPath,
+  existsSync: fs30.existsSync,
+  fstatSync: fs30.fstatSync,
+  isCommandAvailable,
+  openSync: fs30.openSync,
+  pathEnv: () => process.env.PATH ?? "",
+  platform: () => process.platform,
+  readFileSync: fs30.readFileSync,
+  readSync: fs30.readSync,
+  readdirSync: fs30.readdirSync,
+  realpathSync: fs30.realpathSync,
+  resolveLinterCommand,
+  runAdditionalLint,
+  runExternalTool,
   runLint,
-  detectAdditionalLinter,
-  runAdditionalLint
+  runResolvedLint,
+  statSync: fs30.statSync
 };
 
 // src/tools/secretscan.ts
@@ -43980,8 +44618,19 @@ function createRedactedContext(line, findings) {
   return `${result.slice(0, edgeLength)}${truncationMarker}${result.slice(-remaining)}`;
 }
 var O_NOFOLLOW = process.platform !== "win32" ? fs31.constants.O_NOFOLLOW : undefined;
-function readBoundedFile(filePath) {
-  let fd;
+function getStableFileIdentity(stat6) {
+  const { dev, ino } = stat6;
+  if (dev < 0n || ino < 0n || dev === 0n && ino === 0n) {
+    return null;
+  }
+  return `${dev}:${ino}`;
+}
+function readBoundedFile(filePath, expectedPathStat) {
+  const expectedIdentity = getStableFileIdentity(expectedPathStat);
+  if (expectedIdentity === null) {
+    return { status: "incomplete", reason: "read_error" };
+  }
+  let fd = null;
   try {
     const flags = fs31.constants.O_RDONLY | (O_NOFOLLOW !== undefined ? O_NOFOLLOW : 0);
     fd = _internals65.openFile(filePath, flags);
@@ -43989,13 +44638,17 @@ function readBoundedFile(filePath) {
     return { status: "incomplete", reason: "read_error" };
   }
   let outcome;
+  let closeFailed = false;
   try {
     const stat6 = _internals65.fstatFile(fd);
+    const descriptorIdentity = getStableFileIdentity(stat6);
     const initialSize = stat6.size;
     if (!stat6.isFile()) {
       outcome = { status: "incomplete", reason: "non_file" };
+    } else if (descriptorIdentity === null || descriptorIdentity !== expectedIdentity) {
+      outcome = { status: "incomplete", reason: "read_error" };
     } else {
-      const bufferLength = Math.min(initialSize + 1, MAX_FILE_SIZE_BYTES3 + 1);
+      const bufferLength = initialSize >= BigInt(MAX_FILE_SIZE_BYTES3) ? MAX_FILE_SIZE_BYTES3 + 1 : Number(initialSize) + 1;
       const buffer = Buffer.allocUnsafe(bufferLength);
       let bytesRead = 0;
       while (bytesRead < buffer.length) {
@@ -44005,10 +44658,15 @@ function readBoundedFile(filePath) {
         bytesRead += count;
       }
       const postStat = _internals65.fstatFile(fd);
-      if (postStat.size !== initialSize) {
+      const postDescriptorIdentity = getStableFileIdentity(postStat);
+      const postPathStat = _internals65.lstatFile(filePath);
+      const postPathIdentity = getStableFileIdentity(postPathStat);
+      if (!postStat.isFile() || postDescriptorIdentity === null || postDescriptorIdentity !== descriptorIdentity || postPathStat.isSymbolicLink() || !postPathStat.isFile() || postPathIdentity === null || postPathIdentity !== descriptorIdentity) {
+        outcome = { status: "incomplete", reason: "read_error" };
+      } else if (postStat.size !== initialSize) {
         outcome = {
           status: "incomplete",
-          reason: postStat.size > MAX_FILE_SIZE_BYTES3 ? "oversized" : "read_error"
+          reason: postStat.size > BigInt(MAX_FILE_SIZE_BYTES3) ? "oversized" : "read_error"
         };
       } else {
         outcome = {
@@ -44020,25 +44678,30 @@ function readBoundedFile(filePath) {
     }
   } catch {
     outcome = { status: "incomplete", reason: "read_error" };
+  } finally {
+    if (fd !== null) {
+      try {
+        _internals65.closeFile(fd);
+      } catch {
+        closeFailed = true;
+      }
+    }
   }
-  try {
-    _internals65.closeFile(fd);
-  } catch {
+  if (closeFailed)
     return { status: "incomplete", reason: "read_error" };
-  }
   return outcome;
 }
 function scanFileForSecrets(filePath, mode) {
   const findings = [];
   try {
-    const lstat3 = fs31.lstatSync(filePath);
+    const lstat3 = _internals65.lstatFile(filePath);
     if (lstat3.isSymbolicLink()) {
       return mode === "explicit" ? { status: "incomplete", reason: "symlink" } : { status: "skipped", reason: "symlink" };
     }
     if (!lstat3.isFile()) {
       return { status: "incomplete", reason: "non_file" };
     }
-    const readOutcome = readBoundedFile(filePath);
+    const readOutcome = readBoundedFile(filePath, lstat3);
     if (readOutcome.status === "incomplete")
       return readOutcome;
     const { buffer, truncated } = readOutcome;
@@ -44086,7 +44749,7 @@ function assertNever(value) {
   throw new Error(`Unhandled secretscan outcome: ${String(value)}`);
 }
 async function yieldToEventLoop() {
-  await new Promise((resolve24) => setImmediate(resolve24));
+  await new Promise((resolve25) => setImmediate(resolve25));
 }
 function serializeSecretscanResult(result) {
   let findings = result.findings;
@@ -44125,14 +44788,14 @@ function isPathWithinScope(realPath, scanDir) {
 }
 var DISCOVERY_YIELD_INTERVAL = 100;
 function toSafeRelativePath(rootDir, targetPath) {
-  const relative10 = path77.relative(rootDir, targetPath).replace(/\\/g, "/");
-  if (!relative10 || relative10 === ".")
+  const relative11 = path77.relative(rootDir, targetPath).replace(/\\/g, "/");
+  if (!relative11 || relative11 === ".")
     return ".";
-  if (relative10.startsWith("..") || path77.isAbsolute(relative10)) {
-    const basename15 = path77.basename(targetPath).replace(/\\/g, "/");
-    return basename15 || ".";
+  if (relative11.startsWith("..") || path77.isAbsolute(relative11)) {
+    const basename16 = path77.basename(targetPath).replace(/\\/g, "/");
+    return basename16 || ".";
   }
-  return relative10;
+  return relative11;
 }
 function recordIncompletePath(target, rootDir, targetPath, reason) {
   if (target.length >= MAX_INCOMPLETE_PATHS) {
@@ -44714,10 +45377,10 @@ var _internals65 = {
   now: Date.now,
   yieldToEventLoop,
   openFile: fs31.openSync,
-  fstatFile: fs31.fstatSync,
+  fstatFile: (fd) => fs31.fstatSync(fd, { bigint: true }),
   readFileChunk: fs31.readSync,
   closeFile: fs31.closeSync,
-  lstatFile: fs31.lstatSync,
+  lstatFile: (path78) => fs31.lstatSync(path78, { bigint: true }),
   closeDirectory: (directory) => directory.closeSync()
 };
 
@@ -45721,7 +46384,7 @@ var DISPATCH_FRAMEWORK_MAP = {
 };
 async function detectTestFrameworkViaDispatch(cwd) {
   try {
-    const { pickBackend } = await import("./dispatch-b1fge4xk.js");
+    const { pickBackend } = await import("./dispatch-nbv0hezh.js");
     const backend = await pickBackend(cwd);
     if (!backend?.selectTestFramework)
       return "none";
@@ -45737,7 +46400,7 @@ async function buildTestCommandViaDispatch(framework, scope, files, coverage, ba
   if (framework === "none")
     return null;
   try {
-    const { pickBackend } = await import("./dispatch-b1fge4xk.js");
+    const { pickBackend } = await import("./dispatch-nbv0hezh.js");
     const backend = await pickBackend(baseDir);
     if (backend?.buildTestCommand) {
       const cmd = backend.buildTestCommand(framework, files, baseDir, {
@@ -45757,7 +46420,7 @@ async function parseTestOutputViaDispatch(framework, output, baseDir) {
   if (framework === "none")
     return null;
   try {
-    const { pickBackend } = await import("./dispatch-b1fge4xk.js");
+    const { pickBackend } = await import("./dispatch-nbv0hezh.js");
     const backend = await pickBackend(baseDir);
     if (!backend?.parseTestOutput)
       return null;
@@ -45967,21 +46630,21 @@ function hasCompoundTestExtension(filename) {
   const lower = filename.toLowerCase();
   return COMPOUND_TEST_EXTENSIONS.some((ext) => lower.endsWith(ext));
 }
-function isLanguageSpecificTestFile(basename16) {
-  const lower = basename16.toLowerCase();
+function isLanguageSpecificTestFile(basename17) {
+  const lower = basename17.toLowerCase();
   if (lower.endsWith("_test.go"))
     return true;
   if (lower.endsWith(".py") && (lower.startsWith("test_") || lower.endsWith("_test.py")))
     return true;
   if (lower.endsWith("_spec.rb"))
     return true;
-  if (lower.endsWith(".java") && (/^Test[A-Z]/.test(basename16) || basename16.endsWith("Test.java") || basename16.endsWith("Tests.java") || lower.endsWith("it.java")))
+  if (lower.endsWith(".java") && (/^Test[A-Z]/.test(basename17) || basename17.endsWith("Test.java") || basename17.endsWith("Tests.java") || lower.endsWith("it.java")))
     return true;
   if (lower.endsWith(".cs") && (lower.endsWith("test.cs") || lower.endsWith("tests.cs")))
     return true;
-  if (lower.endsWith(".kt") && (/^Test[A-Z]/.test(basename16) || lower.endsWith("test.kt") || lower.endsWith("tests.kt")))
+  if (lower.endsWith(".kt") && (/^Test[A-Z]/.test(basename17) || lower.endsWith("test.kt") || lower.endsWith("tests.kt")))
     return true;
-  if (lower.endsWith(".php") && (/^Test[A-Z]/.test(basename16) || basename16.endsWith("Test.php") || basename16.endsWith("Tests.php")))
+  if (lower.endsWith(".php") && (/^Test[A-Z]/.test(basename17) || basename17.endsWith("Test.php") || basename17.endsWith("Tests.php")))
     return true;
   if (lower.endsWith(".tests.ps1"))
     return true;
@@ -45989,23 +46652,23 @@ function isLanguageSpecificTestFile(basename16) {
 }
 function isConventionTestFilePath(filePath) {
   const normalizedPath = filePath.replace(/\\/g, "/");
-  const basename16 = path81.basename(filePath);
-  return hasCompoundTestExtension(basename16) || basename16.includes(".spec.") || basename16.includes(".test.") || isLanguageSpecificTestFile(basename16) || isTestDirectoryPath(normalizedPath);
+  const basename17 = path81.basename(filePath);
+  return hasCompoundTestExtension(basename17) || basename17.includes(".spec.") || basename17.includes(".test.") || isLanguageSpecificTestFile(basename17) || isTestDirectoryPath(normalizedPath);
 }
 function getTestFilesFromConvention(sourceFiles, workingDir = process.cwd()) {
   const testFiles = [];
   for (const file of sourceFiles) {
     const absoluteFile = resolveWorkspacePath(file, workingDir);
     const relativeFile = path81.relative(workingDir, absoluteFile);
-    const basename16 = path81.basename(absoluteFile);
+    const basename17 = path81.basename(absoluteFile);
     const dirname30 = path81.dirname(absoluteFile);
     const preferRelativeOutput = !path81.isAbsolute(file);
     if (isConventionTestFilePath(relativeFile) || isConventionTestFilePath(file)) {
       dedupePush(testFiles, toWorkspaceOutputPath(absoluteFile, workingDir, preferRelativeOutput));
       continue;
     }
-    const nameWithoutExt = basename16.replace(/\.[^.]+$/, "");
-    const ext = path81.extname(basename16);
+    const nameWithoutExt = basename17.replace(/\.[^.]+$/, "");
+    const ext = path81.extname(basename17);
     const genericTestNames = [
       `${nameWithoutExt}.spec${ext}`,
       `${nameWithoutExt}.test${ext}`
@@ -46016,7 +46679,7 @@ function getTestFilesFromConvention(sourceFiles, workingDir = process.cwd()) {
       ...languageSpecificTestNames
     ].map((candidateName) => path81.join(dirname30, candidateName));
     const testDirectoryNames = [
-      basename16,
+      basename17,
       ...genericTestNames,
       ...languageSpecificTestNames
     ];
@@ -46281,13 +46944,13 @@ function buildTestCommand(framework, scope, files, coverage, baseDir, bail) {
         'Dir.glob("test/**/*_test.rb").sort.each { |f| require_relative f }'
       ];
     case "pest": {
-      const args = [phpVendorBin2("pest")];
+      const args = [phpVendorBin("pest")];
       if (scope !== "all" && files.length > 0)
         args.push(...files);
       return args;
     }
     case "phpunit": {
-      const args = [phpVendorBin2("phpunit")];
+      const args = [phpVendorBin("phpunit")];
       if (scope !== "all" && files.length > 0)
         args.push(...files);
       return args;
@@ -46302,7 +46965,7 @@ function buildTestCommand(framework, scope, files, coverage, baseDir, bail) {
       return null;
   }
 }
-function phpVendorBin2(name) {
+function phpVendorBin(name) {
   return path81.join("vendor", "bin", process.platform === "win32" ? `${name}.bat` : name);
 }
 function mapFrameworkStatusToResult(status) {
@@ -46741,9 +47404,9 @@ async function runTests(framework, scope, files, coverage, timeout_ms, cwd, bail
       stderr: "pipe",
       cwd
     });
-    const timeoutPromise = new Promise((resolve26) => setTimeout(() => {
+    const timeoutPromise = new Promise((resolve27) => setTimeout(() => {
       proc.kill();
-      resolve26(-1);
+      resolve27(-1);
     }, timeout_ms));
     const [exitCode, stdoutResult, stderrResult] = await Promise.all([
       Promise.race([proc.exited, timeoutPromise]),
@@ -46901,11 +47564,11 @@ function normalizeHistoryTestFile(testFile, workingDir) {
   const normalized = testFile.replace(/\\/g, "/");
   if (!path81.isAbsolute(testFile))
     return normalized;
-  const relative11 = path81.relative(workingDir, testFile);
-  if (relative11.startsWith("..") || path81.isAbsolute(relative11)) {
+  const relative12 = path81.relative(workingDir, testFile);
+  if (relative12.startsWith("..") || path81.isAbsolute(relative12)) {
     return normalized;
   }
-  return relative11.replace(/\\/g, "/");
+  return relative12.replace(/\\/g, "/");
 }
 function combineAggregateResult(current, next) {
   if (current === "fail" || next === "fail")
@@ -48329,13 +48992,13 @@ class CircuitBreaker {
     if (this.config.callTimeoutMs <= 0) {
       return fn();
     }
-    return new Promise((resolve27, reject) => {
+    return new Promise((resolve28, reject) => {
       const timeout = setTimeout(() => {
         reject(new Error(`Call timeout after ${this.config.callTimeoutMs}ms`));
       }, this.config.callTimeoutMs);
       fn().then((result) => {
         clearTimeout(timeout);
-        resolve27(result);
+        resolve28(result);
       }).catch((error2) => {
         clearTimeout(timeout);
         reject(error2);
@@ -48634,7 +49297,7 @@ class AutomationQueue {
 
 // src/background/worker.ts
 function sleep(ms) {
-  return new Promise((resolve27) => setTimeout(resolve27, ms));
+  return new Promise((resolve28) => setTimeout(resolve28, ms));
 }
 
 class WorkerManager {
@@ -50584,7 +51247,7 @@ function resolveReviewFallbackModels(agentName, registry) {
 init_logger();
 
 // src/hooks/review-receipt-scope.ts
-import * as child_process7 from "child_process";
+import * as child_process6 from "child_process";
 import { createHash as createHash14 } from "crypto";
 import * as fs42 from "fs";
 import * as path89 from "path";
@@ -50596,7 +51259,7 @@ var HEAD_OUTPUT_BYTES = 256;
 var HEAD_SHA_PATTERN = /^[0-9a-f]{40,64}$/i;
 var REVIEWER_TASK_SCOPE_DESCRIPTION = "reviewer-task-files-v1";
 var _internals74 = {
-  spawn: child_process7.spawn,
+  spawn: child_process6.spawn,
   realpath: fs42.promises.realpath,
   lstatBigInt: (path90) => fs42.promises.lstat(path90, { bigint: true }),
   open: fs42.promises.open,
@@ -50611,8 +51274,8 @@ function hasControlCharacter2(value) {
   return false;
 }
 function isContained2(root, candidate) {
-  const relative14 = path89.relative(root, candidate);
-  return relative14.length > 0 && relative14 !== ".." && !relative14.startsWith(`..${path89.sep}`) && !path89.isAbsolute(relative14);
+  const relative15 = path89.relative(root, candidate);
+  return relative15.length > 0 && relative15 !== ".." && !relative15.startsWith(`..${path89.sep}`) && !path89.isAbsolute(relative15);
 }
 function canonicalPath(relativePath2) {
   return relativePath2.split(path89.sep).join("/");
@@ -50668,7 +51331,7 @@ async function resolveHeadSha(directory) {
       timeout: HEAD_TIMEOUT_MS,
       windowsHide: true
     });
-    return await new Promise((resolve30) => {
+    return await new Promise((resolve31) => {
       let settled = false;
       let stdoutBytes = 0;
       const stdoutChunks = [];
@@ -50678,7 +51341,7 @@ async function resolveHeadSha(directory) {
         settled = true;
         if (timeoutHandle !== undefined)
           clearTimeout(timeoutHandle);
-        resolve30(value);
+        resolve31(value);
       };
       const killAndFail = () => {
         try {
@@ -51398,8 +52061,8 @@ function normalizedRelativePath(file) {
   return normalized.replace(/^\.\//, "");
 }
 function isWithinRoot2(root, candidate) {
-  const relative16 = path91.relative(root, candidate);
-  return relative16.length > 0 && relative16 !== ".." && !relative16.startsWith(`..${path91.sep}`) && !path91.isAbsolute(relative16);
+  const relative17 = path91.relative(root, candidate);
+  return relative17.length > 0 && relative17 !== ".." && !relative17.startsWith(`..${path91.sep}`) && !path91.isAbsolute(relative17);
 }
 function rangesOverlap(start, end, ranges) {
   return ranges.some((range) => start <= range.end && end >= range.start);
@@ -51963,8 +52626,8 @@ function formatSelector(selector) {
   }
 }
 function isPathInside(parent, candidate) {
-  const relative17 = path92.relative(parent, candidate);
-  return relative17.length > 0 && relative17 !== ".." && !relative17.startsWith(`..${path92.sep}`) && !path92.isAbsolute(relative17);
+  const relative18 = path92.relative(parent, candidate);
+  return relative18.length > 0 && relative18 !== ".." && !relative18.startsWith(`..${path92.sep}`) && !path92.isAbsolute(relative18);
 }
 function sameFileSnapshot4(left, right) {
   return (left.dev !== 0n || left.ino !== 0n) && (right.dev !== 0n || right.ino !== 0n) && left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
@@ -53059,14 +53722,14 @@ import * as path96 from "path";
 // src/services/skill-optimizer/store.ts
 import { createHash as createHash15, randomUUID as randomUUID10 } from "crypto";
 import {
-  closeSync as closeSync12,
+  closeSync as closeSync13,
   existsSync as existsSync53,
   fsyncSync as fsyncSync3,
   mkdirSync as mkdirSync27,
-  openSync as openSync12,
+  openSync as openSync13,
   readFileSync as readFileSync39,
   renameSync as renameSync18,
-  statSync as statSync15,
+  statSync as statSync16,
   unlinkSync as unlinkSync20,
   writeFileSync as writeFileSync17,
   writeFileSync as writeFileSyncAsync
@@ -53132,12 +53795,12 @@ function ensureCandidateDir(directory, skillSlug, candidateId2) {
   return dir;
 }
 function writeFileFsyncedThenRename(tempPath, targetPath, data) {
-  const fd = openSync12(tempPath, "w");
+  const fd = openSync13(tempPath, "w");
   try {
     writeFileSync17(fd, data, "utf8");
     fsyncSync3(fd);
   } finally {
-    closeSync12(fd);
+    closeSync13(fd);
   }
   try {
     renameSync18(tempPath, targetPath);
@@ -53156,7 +53819,7 @@ var _internals79 = {
   renameSync: renameSync18,
   unlinkSync: unlinkSync20,
   existsSync: existsSync53,
-  statSync: statSync15
+  statSync: statSync16
 };
 async function appendEvent(directory, eventInput) {
   if (!isValidSkillSlug(eventInput.skillSlug)) {
@@ -53974,17 +54637,17 @@ async function deterministicSeed(input) {
 }
 
 // src/services/skill-optimizer/smoke.ts
-import { existsSync as existsSync55, lstatSync as lstatSync10, readFileSync as readFileSync41, realpathSync as realpathSync9 } from "fs";
+import { existsSync as existsSync55, lstatSync as lstatSync10, readFileSync as readFileSync41, realpathSync as realpathSync11 } from "fs";
 import * as path98 from "path";
 
 // src/hooks/spawn-helper.ts
-import * as child_process8 from "child_process";
+import * as child_process7 from "child_process";
 var WIN32_CMD_BINARIES = new Set(["npm", "npx", "pnpm", "yarn"]);
 var _internals82 = {
-  spawn: child_process8.spawn
+  spawn: child_process7.spawn
 };
 function spawnAsync(command, cwd, timeoutMs) {
-  return new Promise((resolve33) => {
+  return new Promise((resolve34) => {
     try {
       const [rawCmd, ...args] = command;
       const cmd = process.platform === "win32" && WIN32_CMD_BINARIES.has(rawCmd) && !rawCmd.includes(".") ? `${rawCmd}.cmd` : rawCmd;
@@ -54031,24 +54694,24 @@ function spawnAsync(command, cwd, timeoutMs) {
         try {
           proc.kill();
         } catch {}
-        resolve33(null);
+        resolve34(null);
       }, timeoutMs);
       proc.on("close", (code) => {
         if (done)
           return;
         done = true;
         clearTimeout(timer);
-        resolve33({ exitCode: code ?? 1, stdout, stderr });
+        resolve34({ exitCode: code ?? 1, stdout, stderr });
       });
       proc.on("error", () => {
         if (done)
           return;
         done = true;
         clearTimeout(timer);
-        resolve33(null);
+        resolve34(null);
       });
     } catch {
-      resolve33(null);
+      resolve34(null);
     }
   });
 }
@@ -54067,7 +54730,7 @@ var _internals83 = {
     const rel = path98.relative(path98.resolve(root), path98.resolve(target));
     return rel.startsWith("..") || path98.isAbsolute(rel);
   },
-  realpath: (p) => realpathSync9(p),
+  realpath: (p) => realpathSync11(p),
   evaluateSkillChange,
   isRejectedSkillContent,
   spawnAsync
@@ -54431,7 +55094,7 @@ async function runValidationWithTransientRetry(input, candidateContent, baseline
       if (!input.dispatcher) {
         throw new Error("no evaluation dispatcher available (cannot run validation)");
       }
-      const { createModelEvaluationExecutor: createModelEvaluationExecutor2 } = await import("./runner-w30gazew.js");
+      const { createModelEvaluationExecutor: createModelEvaluationExecutor2 } = await import("./runner-mzb3e2s6.js");
       const executor = createModelEvaluationExecutor2(input.dispatcher, input.sessionId);
       const result = await _internals84.evaluateCandidateV1({
         projectRoot: input.directory,
@@ -55304,11 +55967,18 @@ function makeInitialState() {
   };
 }
 var sessionStates = new Map;
+var MAX_TRACKED_COMPACTION_SESSIONS = 500;
 function getSessionState(sessionId) {
   let state = sessionStates.get(sessionId);
-  if (!state) {
-    state = makeInitialState();
-    sessionStates.set(sessionId, state);
+  if (state)
+    return state;
+  state = makeInitialState();
+  sessionStates.set(sessionId, state);
+  if (sessionStates.size > MAX_TRACKED_COMPACTION_SESSIONS) {
+    const oldest = sessionStates.keys().next().value;
+    if (oldest !== undefined && oldest !== sessionId) {
+      sessionStates.delete(oldest);
+    }
   }
   return state;
 }
@@ -55393,8 +56063,8 @@ async function getStatusData(directory, agents, sessionId) {
       agentCount,
       isLegacy: false,
       turboMode: hasActiveTurboMode(),
-      contextBudgetPct: swarmState.lastBudgetPct > 0 ? swarmState.lastBudgetPct : null,
-      contextBudgetTokens: swarmState.lastBudgetTokens > 0 ? swarmState.lastBudgetTokens : null,
+      contextBudgetPct: getDisplayBudget()?.pct ?? null,
+      contextBudgetTokens: getDisplayBudget()?.tokens ?? null,
       compactionCount: metrics.compactionCount,
       lastSnapshotAt: metrics.lastSnapshotAt
     };
@@ -55410,8 +56080,8 @@ async function getStatusData(directory, agents, sessionId) {
         agentCount: Object.keys(agents).length,
         isLegacy: true,
         turboMode: hasActiveTurboMode(),
-        contextBudgetPct: swarmState.lastBudgetPct > 0 ? swarmState.lastBudgetPct : null,
-        contextBudgetTokens: swarmState.lastBudgetTokens > 0 ? swarmState.lastBudgetTokens : null,
+        contextBudgetPct: getDisplayBudget()?.pct ?? null,
+        contextBudgetTokens: getDisplayBudget()?.tokens ?? null,
         compactionCount: metrics.compactionCount,
         lastSnapshotAt: metrics.lastSnapshotAt
       };
@@ -55430,8 +56100,8 @@ async function getStatusData(directory, agents, sessionId) {
         agentCount,
         isLegacy: true,
         turboMode: hasActiveTurboMode(),
-        contextBudgetPct: swarmState.lastBudgetPct > 0 ? swarmState.lastBudgetPct : null,
-        contextBudgetTokens: swarmState.lastBudgetTokens > 0 ? swarmState.lastBudgetTokens : null,
+        contextBudgetPct: getDisplayBudget()?.pct ?? null,
+        contextBudgetTokens: getDisplayBudget()?.tokens ?? null,
         compactionCount: metrics.compactionCount,
         lastSnapshotAt: metrics.lastSnapshotAt
       };
@@ -56255,7 +56925,7 @@ function buildDetailedHelp(commandName, entry) {
 async function handleHelpCommand(ctx) {
   const targetCommand = ctx.args.join(" ");
   if (!targetCommand) {
-    const { buildHelpText } = await import("./index-se8xc78k.js");
+    const { buildHelpText } = await import("./index-5hyq2mw6.js");
     return buildHelpText();
   }
   const tokens = targetCommand.split(/\s+/);
@@ -56264,7 +56934,7 @@ async function handleHelpCommand(ctx) {
     return _internals14.buildDetailedHelp(resolved.key, resolved.entry);
   }
   const similar = _internals14.findSimilarCommands(targetCommand);
-  const { buildHelpText: fullHelp } = await import("./index-se8xc78k.js");
+  const { buildHelpText: fullHelp } = await import("./index-5hyq2mw6.js");
   if (similar.length > 0) {
     return `Command '/swarm ${targetCommand}' not found.
 
@@ -56441,7 +57111,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-k62h3c92.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-y2wg00dp.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -56451,7 +57121,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-k62h3c92.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-y2wg00dp.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -56461,7 +57131,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-log": {
     handler: async (ctx) => {
-      const { handleGuardrailLog } = await import("./guardrail-log-2ftew0p3.js");
+      const { handleGuardrailLog } = await import("./guardrail-log-320grggj.js");
       return handleGuardrailLog(ctx.directory, ctx.args);
     },
     description: "Read the guardrail decision log (use --blocks-only for blocks)",
@@ -56915,7 +57585,7 @@ Subcommands:
     handler: (ctx) => handleApprovePlanCriticCommand(ctx.directory, ctx.args, ctx.sessionID),
     description: "Record a MANUAL plan-critic approval to unblock the critic_pre_plan execution gate [reason...]",
     args: "[reason...]",
-    details: 'Human-only escape hatch for the ratchet-tighter critic_pre_plan execution gate (issue #2012). When the critic already returned APPROVED but the mechanical snapshot recorder failed to persist it (verdict-format mismatch, dispatch-signal miss, or a plan.json read race), the gate permanently blocks ALL coder delegations because critic_pre_plan defaults to true and cannot be disabled. Running this records a manual plan_critic_gate approval snapshot so the gate unblocks, with a distinct method: "manual_override" audit marker. The agent itself cannot run this command; it must call the approve_plan_critic tool (or ask you to run this command). Both paths funnel into the same forceRecordPlanCriticApproval hook, which requires an active architect session. An audit event is appended to .swarm/events.jsonl. Prefer re-running MODE: CRITIC-GATE first; use this only as an escape hatch when a legitimate APPROVED was lost.',
+    details: 'Human-only escape hatch for the ratchet-tighter critic_pre_plan execution gate (issue #2012). When the critic already returned APPROVED but the mechanical snapshot recorder failed to persist it (verdict-format mismatch, dispatch-signal miss, or a plan.json read race), an enabled critic_pre_plan gate blocks coder delegation. Running this records a manual plan_critic_gate approval snapshot so the gate unblocks, with a distinct method: "manual_override" audit marker. The agent itself cannot run this command; it must call the approve_plan_critic tool (or ask you to run this command). Both paths funnel into the same forceRecordPlanCriticApproval hook, which requires an active architect session. An audit event is appended to .swarm/events.jsonl. Prefer re-running MODE: CRITIC-GATE first; use this only as an escape hatch when a legitimate APPROVED was lost.',
     category: "utility",
     toolPolicy: "restricted"
   },
@@ -59900,14 +60570,6 @@ function getSwarmAgents(swarmId) {
   const id = swarmId ?? "default";
   return _swarmAgentsMap.get(id);
 }
-var KNOWN_VARIANT_VALUES = new Set([
-  "low",
-  "medium",
-  "high",
-  "max",
-  "xhigh",
-  "thinking"
-]);
 
 // src/hooks/curator-llm-factory.ts
 init_schema();