opencode-swarm 7.139.3 → 7.139.5

package/dist/cli/{index-6mvbjqbt.js → index-33skgk1a.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   atomicWriteFile
-} from "./index-2eet124q.js";
+} from "./index-6r522srn.js";
 import {
   init_logger,
   warn

package/dist/cli/{index-xsxrhakg.js → index-41hkt36g.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   simpleGlobToRegex
-} from "./index-z6xqpmqg.js";
+} from "./index-ee3x66a5.js";
 import {
   bunSpawnSync
 } from "./index-4nt52yr9.js";

package/dist/cli/{index-xzzcfwwm.js → index-5z2xps64.js}

@@ -3,10 +3,10 @@ import {
   atomicWriteFile,
   taskEvidencePath,
   withTaskEvidenceLock
-} from "./index-2eet124q.js";
+} from "./index-6r522srn.js";
 import {
   telemetry
-} from "./index-a5eba0t8.js";
+} from "./index-rsrx77fg.js";
 import {
   exports_external,
   init_zod

package/dist/cli/{index-4fr94329.js → index-6nzmp937.js}

@@ -3,28 +3,10 @@ import {
   EvaluationRunV1Schema,
   GateAuditResultV1Schema,
   getProtectedEvaluationRunIds
-} from "./index-hckq2r5m.js";
+} from "./index-nrx08gcr.js";
 import {
   readEffectiveSpecSync
 } from "./index-9ss2m4rs.js";
-import {
-  isValidTaskId,
-  readTaskEvidence,
-  readTaskEvidenceRaw,
-  sanitizeTaskId
-} from "./index-xzzcfwwm.js";
-import {
-  EVIDENCE_MAX_JSON_BYTES,
-  EvidenceBundleSchema,
-  EvidenceSchema
-} from "./index-gprxjmm7.js";
-import {
-  _internals,
-  buildDefaultPolicy,
-  execute,
-  init_runner_client,
-  probe
-} from "./index-q1exe2b3.js";
 import {
   LedgerStaleWriterError,
   appendLedgerEvent,
@@ -40,42 +22,61 @@ import {
   replayFromLedgerWithStatus,
   takeSnapshotEvent,
   takeSnapshotWithRetry
-} from "./index-4xbyy6aw.js";
-import {
-  PlanSchema
-} from "./index-1kz6da87.js";
+} from "./index-6rxgb5r9.js";
 import {
   getWorktreeMergeFailure
 } from "./index-b8zgtz81.js";
 import {
   readSwarmFileAsync,
   validateSwarmPath
-} from "./index-k87hs2ff.js";
+} from "./index-k46me75h.js";
+import {
+  isValidTaskId,
+  readTaskEvidence,
+  readTaskEvidenceRaw,
+  sanitizeTaskId
+} from "./index-5z2xps64.js";
+import {
+  _internals,
+  buildDefaultPolicy,
+  execute,
+  init_runner_client,
+  probe
+} from "./index-q1exe2b3.js";
 import {
   invalidateCachedArtifact,
   readCachedParsedFile
 } from "./index-ed5ykebp.js";
 import {
+  assertProjectRoot,
   withEvidenceLock
-} from "./index-5j6chvj8.js";
-import {
-  emit
-} from "./index-a5eba0t8.js";
-import {
-  ZodError,
-  init_zod
-} from "./index-bpmtbmy9.js";
+} from "./index-s0qc4gj6.js";
 import {
   bunHash,
   bunWrite,
   mergeEnvForChild
 } from "./index-4nt52yr9.js";
+import {
+  EVIDENCE_MAX_JSON_BYTES,
+  EvidenceBundleSchema,
+  EvidenceSchema
+} from "./index-gprxjmm7.js";
+import {
+  PlanSchema
+} from "./index-1kz6da87.js";
 import {
   criticalWarn,
   error,
   init_logger,
   warn
 } from "./index-zgwm4ryv.js";
+import {
+  emit
+} from "./index-rsrx77fg.js";
+import {
+  ZodError,
+  init_zod
+} from "./index-bpmtbmy9.js";
 import {
   __esm,
   __export,
@@ -2659,6 +2660,7 @@ async function isPlanMdInSync(directory, plan, cache) {
   return false;
 }
 async function regeneratePlanMarkdown(directory, plan) {
+  assertProjectRoot(directory);
   const swarmDir = path8.resolve(directory, ".swarm");
   const contentHash = computePlanContentHash(plan);
   const markdown = derivePlanMarkdown(plan);
@@ -2771,6 +2773,7 @@ async function loadPlan(directory, cache) {
               const preserving = await isObligationPreserving(directory);
               if (!preserving) {
                 try {
+                  assertProjectRoot(directory);
                   const diffInfo = computeSpecDiff(directory);
                   const specStalenessPath = path8.join(directory, ".swarm", "spec-staleness.json");
                   await fsPromises.writeFile(specStalenessPath, JSON.stringify({
@@ -2787,6 +2790,7 @@ async function loadPlan(directory, cache) {
                   invalidateCachedArtifact(specStalenessPath);
                 } catch {}
                 try {
+                  assertProjectRoot(directory);
                   const eventsPath = path8.join(directory, ".swarm", "events.jsonl");
                   const event = {
                     type: "spec_stale_detected",
@@ -2942,6 +2946,7 @@ async function savePlan(directory, plan, options) {
   if (directory === null || directory === undefined || typeof directory !== "string" || directory.trim().length === 0) {
     throw new Error(`Invalid directory: directory must be a non-empty string`);
   }
+  assertProjectRoot(directory);
   const validated = PlanSchema.parse(plan);
   if (options?.preserveCompletedStatuses !== false) {
     try {
@@ -3254,6 +3259,7 @@ ${markdown}`;
   } catch {}
 }
 async function rebuildPlan(directory, plan, options) {
+  assertProjectRoot(directory);
   const targetPlan = plan ?? await replayFromLedger(directory);
   if (!targetPlan)
     return null;
@@ -3324,6 +3330,7 @@ ${markdown}`;
   return targetPlan;
 }
 async function closePlanTerminalState(directory, plan, options) {
+  assertProjectRoot(directory);
   const planId = derivePlanId(plan);
   const validated = PlanSchema.parse(plan);
   const hashAfter = computePlanHash(validated);
@@ -3684,7 +3691,6 @@ import {
   statSync as statSync2
 } from "fs";
 import * as fs7 from "fs/promises";
-import * as os4 from "os";
 import * as path10 from "path";
 
 // src/evaluation/retention.ts
@@ -3793,6 +3799,7 @@ var _retentionInternals = {
   removeCandidate
 };
 async function archiveEvaluationArtifacts(args) {
+  assertProjectRoot(args.directory);
   return withEvidenceLock(args.directory, path9.join("evolution", "retention-index"), "evaluation-retention", "archive", async () => {
     const inventory = await retentionCandidates(args.directory);
     let protectedKeys = await _retentionInternals.protectedArtifacts(args.directory);
@@ -3993,6 +4000,7 @@ async function rewriteAtomic(filePath, survivors) {
   return Buffer.byteLength(payload, "utf8");
 }
 async function pruneEvidenceDocuments(args) {
+  assertProjectRoot(args.directory);
   const dryRun = args.dryRun === true;
   const capsUnset = (typeof args.maxBytes !== "number" || args.maxBytes <= 0) && (typeof args.maxRecords !== "number" || args.maxRecords <= 0);
   const filePath = validateSwarmPath(args.directory, EVIDENCE_CACHE_FILE);
@@ -4097,82 +4105,11 @@ function isValidEvidenceType(type) {
   return VALID_EVIDENCE_TYPES.includes(type);
 }
 var sanitizeTaskId2 = sanitizeTaskId;
-var MAX_DEPTH = 20;
-var PROJECT_INDICATORS = [
-  "package.json",
-  ".git",
-  ".opencode",
-  "Cargo.toml",
-  "go.mod",
-  "pyproject.toml",
-  "Gemfile",
-  "composer.json",
-  "pom.xml",
-  "build.gradle",
-  "CMakeLists.txt"
-];
-function isWeakConfigContainerRoot(directory) {
-  try {
-    const resolved = realpathSync(directory);
-    return resolved === realpathSync(os4.tmpdir()) || resolved === realpathSync(os4.homedir());
-  } catch {
-    const resolved = path10.resolve(directory);
-    return resolved === path10.resolve(os4.tmpdir()) || resolved === path10.resolve(os4.homedir());
-  }
-}
-function hasAccessibleProjectIndicator(directory, options = {}) {
-  const allowConfigOnly = options.allowConfigOnly ?? true;
-  for (const indicator of PROJECT_INDICATORS) {
-    if (!allowConfigOnly && indicator === ".opencode") {
-      continue;
-    }
-    try {
-      const indicatorStat = statSync2(path10.join(directory, indicator));
-      if (indicatorStat.isFile() || indicatorStat.isDirectory()) {
-        return true;
-      }
-    } catch {}
-  }
-  return false;
-}
 function validateProjectRoot(directory) {
-  let resolved;
-  try {
-    resolved = realpathSync(directory);
-  } catch {
-    warn(`[evidence] Cannot canonicalize directory "${directory}" \u2014 failing closed`);
-    throw new Error(`Cannot verify project root for "${directory}" \u2014 directory may not exist or is inaccessible`);
-  }
-  let current = resolved;
-  let depth = 0;
-  while (true) {
-    if (depth >= MAX_DEPTH)
-      break;
-    depth++;
-    const parent = path10.dirname(current);
-    if (parent === current)
-      break;
-    if (path10.dirname(parent) === parent) {
-      current = parent;
-      continue;
-    }
-    const parentSwarm = path10.join(parent, ".swarm");
-    try {
-      if (statSync2(parentSwarm).isDirectory()) {
-        if (hasAccessibleProjectIndicator(parent, {
-          allowConfigOnly: !isWeakConfigContainerRoot(parent)
-        })) {
-          warn(`[evidence] Rejecting write to subdirectory "${resolved}" \u2014 parent "${parent}" already contains .swarm/`);
-          throw new Error(`Cannot write evidence in "${resolved}" \u2014 parent directory "${parent}" already contains a .swarm/ folder. Evidence must be written to the project root.`);
-        }
-      }
-    } catch (error2) {
-      if (error2 instanceof Error && error2.message.startsWith("Cannot write evidence")) {
-        throw error2;
-      }
-    }
-    current = parent;
-  }
+  assertProjectRoot(directory, {
+    realpathSync: _internals11.realpathSync,
+    statSync: _internals11.statSync
+  }, "evidence");
 }
 async function saveEvidence(directory, taskId, evidence, abortSignal) {
   abortSignal?.throwIfAborted();
@@ -4297,6 +4234,7 @@ async function loadEvidence(directory, taskId, options) {
         return { status: "found", bundle: validated };
       }
       try {
+        validateProjectRoot(directory);
         await withEvidenceLock(directory, relativePath, "evidence-loader", sanitizedTaskId, async () => {
           const evidenceDir = path10.dirname(evidencePath);
           const bundleJson = JSON.stringify(validated);
@@ -4364,6 +4302,11 @@ async function listEvidenceTaskIds(directory) {
 }
 async function deleteEvidence(directory, taskId) {
   const sanitizedTaskId = sanitizeTaskId2(taskId);
+  try {
+    validateProjectRoot(directory);
+  } catch {
+    return false;
+  }
   const relativePath = path10.join("evidence", sanitizedTaskId);
   const evidenceDir = validateSwarmPath(directory, relativePath);
   try {
@@ -4494,6 +4437,8 @@ var _internals11 = {
   saveEvidence,
   deleteEvidence,
   pruneEvidenceDocuments,
+  realpathSync,
+  statSync: statSync2,
   now: () => new Date
 };
 

package/dist/cli/{index-2eet124q.js → index-6r522srn.js}

@@ -4,7 +4,7 @@ import {
 } from "./index-ed5ykebp.js";
 import {
   withEvidenceLock
-} from "./index-5j6chvj8.js";
+} from "./index-s0qc4gj6.js";
 import {
   bunWrite
 } from "./index-4nt52yr9.js";

package/dist/cli/{index-4xbyy6aw.js → index-6rxgb5r9.js}

@@ -1,20 +1,21 @@
 // @bun
+import {
+  assertProjectRoot,
+  withEvidenceLock
+} from "./index-s0qc4gj6.js";
 import {
   ExecutionProfileSchema,
   PlanSchema,
   TaskStatusSchema
 } from "./index-1kz6da87.js";
-import {
-  withEvidenceLock
-} from "./index-5j6chvj8.js";
-import {
-  emit
-} from "./index-a5eba0t8.js";
 import {
   criticalWarn,
   init_logger,
   log
 } from "./index-zgwm4ryv.js";
+import {
+  emit
+} from "./index-rsrx77fg.js";
 
 // src/plan/utils.ts
 function derivePlanId(plan) {
@@ -180,6 +181,7 @@ async function readLedgerEvents(directory) {
   }
 }
 async function initLedger(directory, planId, initialPlanHash, initialPlan) {
+  assertProjectRoot(directory);
   const ledgerPath = getLedgerPath(directory);
   const planJsonPath = getPlanJsonPath(directory);
   if (fs.existsSync(ledgerPath)) {
@@ -217,6 +219,7 @@ async function initLedger(directory, planId, initialPlanHash, initialPlan) {
   writeFileFsyncedThenRename(tempPath, ledgerPath, line);
 }
 async function appendLedgerEvent(directory, eventInput, options) {
+  assertProjectRoot(directory);
   return withEvidenceLock(directory, LEDGER_LOCK_PATH, "plan-ledger", "append-ledger-event", async () => {
     const ledgerPath = getLedgerPath(directory);
     const latestSeq = await getLatestLedgerSeq(directory);
@@ -484,6 +487,7 @@ async function quarantineLedgerSuffix(directory, badSuffix) {
     } catch {}
   }
   try {
+    assertProjectRoot(directory);
     const hash = crypto.createHash("sha256").update(badSuffix, "utf8").digest("hex").slice(0, 12);
     const swarmDir = path.join(directory, ".swarm");
     try {

package/dist/cli/{index-gen82t10.js → index-6z0a940s.js}

@@ -1,18 +1,18 @@
 // @bun
+import {
+  bunSpawn
+} from "./index-4nt52yr9.js";
 import {
   advisoryWarn,
   init_warning_buffer
 } from "./index-4rhhvd1a.js";
+import {
+  log
+} from "./index-zgwm4ryv.js";
 import {
   SWARM_WORKTREE_DIR_NAME,
   init_constants
 } from "./index-4wjk296r.js";
-import {
-  bunSpawn
-} from "./index-4nt52yr9.js";
-import {
-  log
-} from "./index-zgwm4ryv.js";
 import {
   __require
 } from "./index-a76rekgs.js";
@@ -86,7 +86,7 @@ var _internals = {
     symlinkSync: fs.symlinkSync
   },
   writeScopeToDisk: async (directory, taskId, files) => {
-    const { writeScopeToDisk: realWrite } = await import("./scope-persistence-wy65zyha.js");
+    const { writeScopeToDisk: realWrite } = await import("./scope-persistence-tj6qway9.js");
     return realWrite(directory, taskId, files);
   },
   writeLaneProfileToDisk: async (_worktreePath, _laneIndex, _envOverrides) => {

package/dist/cli/{index-bcwx1335.js → index-9jr92bff.js}

@@ -2,7 +2,7 @@
 import {
   redactPath,
   redactShellCommand
-} from "./index-0mzz46we.js";
+} from "./index-w9tezcdd.js";
 
 // src/services/guardrail-log-service.ts
 import * as fs from "fs/promises";

package/dist/cli/{index-z6qe8wft.js → index-9rbwfydj.js}

@@ -6,14 +6,10 @@ import {
 } from "./index-ae75rja9.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-6mvbjqbt.js";
+} from "./index-33skgk1a.js";
 import {
   atomicWriteFile
-} from "./index-2eet124q.js";
-import {
-  init_knowledge_types,
-  isActiveStatus
-} from "./index-bk5tah7q.js";
+} from "./index-6r522srn.js";
 import {
   readCachedParsedFile
 } from "./index-ed5ykebp.js";
@@ -24,6 +20,10 @@ import {
   init_logger,
   log
 } from "./index-zgwm4ryv.js";
+import {
+  init_knowledge_types,
+  isActiveStatus
+} from "./index-bk5tah7q.js";
 import {
   __require,
   __toESM
@@ -702,7 +702,7 @@ async function applyConfidenceFloorAction(directory, touched, options) {
   const recovered = touched.filter((e) => e.confidence > CONFIDENCE_FLOOR + FLOOR_EPSILON && e.confidence_floor_demoted);
   if (atFloor.length === 0 && recovered.length === 0)
     return;
-  const { readKnowledgeCounterRollups, effectiveRetrievalOutcomes } = await import("./knowledge-events-jbw9j94n.js");
+  const { readKnowledgeCounterRollups, effectiveRetrievalOutcomes } = await import("./knowledge-events-yjkszs87.js");
   const rollups = await readKnowledgeCounterRollups(directory);
   const flagIds = new Set;
   for (const e of atFloor) {
@@ -769,11 +769,11 @@ async function applyConfidenceFloorAction(directory, touched, options) {
     });
   }
   if (action === "quarantine" && toQuarantine.length > 0) {
-    const { quarantineEntry } = await import("./knowledge-validator-rqj7kech.js");
-    const { KnowledgeConfigSchema } = await import("./schema-g7rs20c6.js");
+    const { quarantineEntry } = await import("./knowledge-validator-rwptbkpz.js");
+    const { KnowledgeConfigSchema } = await import("./schema-9v8wgmxf.js");
     let config;
     try {
-      const { loadPluginConfigWithMeta } = await import("./index-v7g8dnyh.js");
+      const { loadPluginConfigWithMeta } = await import("./index-hhgbbceq.js");
       const { config: loadedConfig } = loadPluginConfigWithMeta(directory);
       config = KnowledgeConfigSchema.parse(loadedConfig.knowledge ?? {});
     } catch {

package/dist/cli/{index-mzck763x.js → index-9xczz1yh.js}

@@ -12,14 +12,14 @@ import {
   detectPosixWrites,
   detectWindowsWrites,
   resolveWriteTargets
-} from "./index-tkg6rapy.js";
+} from "./index-2ga0zt4s.js";
 import {
   checkFileAuthority,
   classifyFile,
   isInDeclaredScope,
   redactPath,
   redactShellCommand
-} from "./index-0mzz46we.js";
+} from "./index-w9tezcdd.js";
 
 // src/services/guardrail-explain-service.ts
 import path from "path";

package/dist/cli/{index-yawwwhmc.js → index-fb11cwqr.js}

@@ -1,4 +1,8 @@
 // @bun
+import {
+  advisoryWarn,
+  init_warning_buffer
+} from "./index-4rhhvd1a.js";
 import {
   ExternalSkillsConfigSchema,
   GATE_CONFIG_KNOWN_SECTION_KEYS,
@@ -6,11 +10,7 @@ import {
   PluginConfigSchema,
   init_schema,
   resolveExternalSkillsConfig
-} from "./index-kyz7259r.js";
-import {
-  advisoryWarn,
-  init_warning_buffer
-} from "./index-4rhhvd1a.js";
+} from "./index-z0tt5j2s.js";
 import {
   DEFAULT_WORKTREE_ISOLATION_CONFIG,
   init_constants
@@ -717,4 +717,4 @@ function resolveWorktreeIsolationConfig(config) {
 // src/config/index.ts
 var _internals = { loadPluginConfigWithMeta };
 
-export { resolveWorktreeIsolationConfig, loadPluginConfig, loadPluginConfigWithMeta, getSafeDefaultConfigLoadResult, loadPluginConfigWithMetaAsync, loadAgentPrompt, exports_loader, init_loader, _internals };
+export { loadPluginConfig, loadPluginConfigWithMeta, getSafeDefaultConfigLoadResult, loadPluginConfigWithMetaAsync, loadAgentPrompt, exports_loader, init_loader, resolveWorktreeIsolationConfig, _internals };

package/dist/cli/{index-ba5e5e3n.js → index-gee0y2d8.js}

@@ -2,18 +2,18 @@
 import {
   readKnowledge,
   transactKnowledge
-} from "./index-z6qe8wft.js";
+} from "./index-9rbwfydj.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-6mvbjqbt.js";
-import {
-  init_knowledge_types,
-  isActiveStatus
-} from "./index-bk5tah7q.js";
+} from "./index-33skgk1a.js";
 import {
   init_logger,
   log
 } from "./index-zgwm4ryv.js";
+import {
+  init_knowledge_types,
+  isActiveStatus
+} from "./index-bk5tah7q.js";
 import {
   __require,
   __toESM

package/dist/cli/{index-1yd38ajy.js → index-h2zm446q.js}

@@ -1,4 +1,7 @@
 // @bun
+import {
+  log
+} from "./index-zgwm4ryv.js";
 import {
   FALLBACK_MODELS_MAX,
   GATE_CONFIG_KNOWN_SECTION_KEYS,
@@ -6,14 +9,11 @@ import {
   PluginConfigSchema,
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-kyz7259r.js";
+} from "./index-z0tt5j2s.js";
 import {
   ALL_AGENT_NAMES,
   init_constants
 } from "./index-4wjk296r.js";
-import {
-  log
-} from "./index-zgwm4ryv.js";
 
 // src/services/config-doctor.ts
 init_constants();

package/dist/cli/{index-v7g8dnyh.js → index-hhgbbceq.js}

@@ -7,7 +7,7 @@ import {
   loadPluginConfigWithMeta,
   loadPluginConfigWithMetaAsync,
   resolveWorktreeIsolationConfig
-} from "./index-yawwwhmc.js";
+} from "./index-fb11cwqr.js";
 import {
   ApprovalEvidenceSchema,
   BaseEvidenceSchema,
@@ -33,6 +33,17 @@ import {
   SwarmSpecSchema,
   validateSpecContent
 } from "./index-n832052r.js";
+import {
+  MigrationStatusSchema,
+  PhaseSchema,
+  PhaseStatusSchema,
+  PlanSchema,
+  TaskSchema,
+  TaskSizeSchema,
+  TaskStatusSchema
+} from "./index-1kz6da87.js";
+import"./index-4rhhvd1a.js";
+import"./index-zgwm4ryv.js";
 import {
   AUTO_REVIEW_V8_BURN_IN_DECISION,
   AgentOverrideConfigSchema,
@@ -54,18 +65,7 @@ import {
   TurboConfigSchema,
   WorktreeIsolationConfigSchema,
   resolveAutoReviewConfig
-} from "./index-kyz7259r.js";
-import"./index-bk5tah7q.js";
-import {
-  MigrationStatusSchema,
-  PhaseSchema,
-  PhaseStatusSchema,
-  PlanSchema,
-  TaskSchema,
-  TaskSizeSchema,
-  TaskStatusSchema
-} from "./index-1kz6da87.js";
-import"./index-4rhhvd1a.js";
+} from "./index-z0tt5j2s.js";
 import {
   ALL_AGENT_NAMES,
   ALL_SUBAGENT_NAMES,
@@ -76,9 +76,9 @@ import {
   isQAAgent,
   isSubagent
 } from "./index-4wjk296r.js";
-import"./index-bpmtbmy9.js";
 import"./index-zjygnfay.js";
-import"./index-zgwm4ryv.js";
+import"./index-bk5tah7q.js";
+import"./index-bpmtbmy9.js";
 import"./index-a76rekgs.js";
 export {
   validateSpecContent,

package/dist/cli/{index-mv0czd9c.js → index-j77frjq8.js}

@@ -1,14 +1,10 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-k87hs2ff.js";
+} from "./index-k46me75h.js";
 import {
   withEvidenceLock
-} from "./index-5j6chvj8.js";
-import {
-  exports_external,
-  init_zod
-} from "./index-bpmtbmy9.js";
+} from "./index-s0qc4gj6.js";
 import {
   bunWrite
 } from "./index-4nt52yr9.js";
@@ -16,6 +12,10 @@ import {
   init_logger,
   warn
 } from "./index-zgwm4ryv.js";
+import {
+  exports_external,
+  init_zod
+} from "./index-bpmtbmy9.js";
 
 // src/background/pending-delegations.ts
 init_zod();