opencode-swarm 7.144.0 → 7.144.2

package/dist/cli/{index-3v3dxf75.js → index-qpt8ahph.js}

@@ -15,7 +15,7 @@ import {
   readTaskEvidence,
   readTaskEvidenceRaw,
   sanitizeTaskId
-} from "./index-jvbfrwt2.js";
+} from "./index-d55crzd4.js";
 import {
   LedgerStaleWriterError,
   appendLedgerEvent,
@@ -35,7 +35,7 @@ import {
   replayFromLedgerWithStatus,
   takeSnapshotEvent,
   takeSnapshotWithRetry
-} from "./index-0ck3e366.js";
+} from "./index-g1c5fgaw.js";
 import {
   getWorktreeMergeFailure
 } from "./index-zsrtt42s.js";
@@ -53,7 +53,7 @@ import {
 } from "./index-gprxjmm7.js";
 import {
   PlanSchema
-} from "./index-d45d4zyq.js";
+} from "./index-y95nwsge.js";
 import {
   readSwarmFileAsync,
   validateSwarmPath
@@ -1934,7 +1934,7 @@ var _internals5 = {
 
 // src/services/run-memory.ts
 import * as crypto2 from "crypto";
-import * as fs2 from "fs/promises";
+import * as fs3 from "fs/promises";
 
 // src/hooks/context-sanitizer.ts
 function sanitizeContextText(text) {
@@ -1948,6 +1948,7 @@ function sanitizeContextText(text) {
 init_logger();
 
 // src/utils/path-security.ts
+import * as fs2 from "fs";
 import * as path5 from "path";
 function containsPathTraversal(str) {
   if (/\.\.[/\\]/.test(str))
@@ -1991,6 +1992,23 @@ function containsControlChars(str) {
 function validateWorkspaceRoot(directory) {
   validateProjectDirectory(directory);
 }
+function validateDirectory(directory) {
+  if (!directory || directory.trim() === "") {
+    throw new Error("Invalid directory: empty");
+  }
+  if (containsPathTraversal(directory)) {
+    throw new Error("Invalid directory: path traversal detected");
+  }
+  if (containsControlChars(directory)) {
+    throw new Error("Invalid directory: control characters detected");
+  }
+  if (directory.startsWith("/") || directory.startsWith("\\")) {
+    throw new Error("Invalid directory: absolute path");
+  }
+  if (/^[A-Za-z]:[/\\]/.test(directory)) {
+    throw new Error("Invalid directory: Windows absolute path");
+  }
+}
 function validateProjectDirectory(directory) {
   if (!directory || directory.trim() === "") {
     throw new Error("Invalid project directory: empty");
@@ -2041,6 +2059,91 @@ function assertNotSystemLocation(directory) {
     }
   }
 }
+function resolveNearestExistingCanonical(inputPath, resolver) {
+  try {
+    return resolver(inputPath);
+  } catch {}
+  const lexicallyResolved = path5.resolve(inputPath);
+  let probe2 = lexicallyResolved;
+  const tail = [];
+  for (let i = 0;i < 4096; i++) {
+    const parent = path5.dirname(probe2);
+    if (parent === probe2) {
+      return lexicallyResolved;
+    }
+    tail.unshift(path5.basename(probe2));
+    probe2 = parent;
+    try {
+      const canonicalAncestor = resolver(probe2);
+      return path5.normalize(path5.join(canonicalAncestor, ...tail));
+    } catch {}
+  }
+  return lexicallyResolved;
+}
+function validateSymlinkBoundary(targetPath, rootPath) {
+  const realTarget = resolveNearestExistingCanonical(targetPath, _internals6.realpathSync);
+  const realRoot = resolveNearestExistingCanonical(rootPath, _internals6.realpathSync);
+  const normalizedTarget = path5.normalize(realTarget);
+  const normalizedRoot = path5.normalize(realRoot);
+  if (!normalizedTarget.startsWith(normalizedRoot + path5.sep) && normalizedTarget !== normalizedRoot) {
+    throw new Error(`Symlink resolution escaped boundary: ${realTarget} is not within ${realRoot}`);
+  }
+}
+function isCanonicalPathWithinRoot(targetPath, rootPath) {
+  let canonicalRoot;
+  try {
+    canonicalRoot = fs2.realpathSync(rootPath);
+  } catch {
+    canonicalRoot = path5.normalize(rootPath);
+  }
+  let probe2 = path5.normalize(targetPath);
+  for (let i = 0;i < 4096; i++) {
+    try {
+      const canonicalProbe = fs2.realpathSync(probe2);
+      const relative2 = path5.relative(canonicalRoot, canonicalProbe);
+      return !relative2.startsWith("..") && !path5.isAbsolute(relative2);
+    } catch {
+      const parent = path5.dirname(probe2);
+      if (parent === probe2)
+        return false;
+      probe2 = parent;
+    }
+  }
+  return false;
+}
+function validateTargetWithinRoot(filePath, root) {
+  if (!filePath || filePath.trim() === "") {
+    return "Empty path";
+  }
+  if (path5.isAbsolute(filePath) || /^[A-Za-z]:[/\\]/.test(filePath)) {
+    return `Absolute path rejected: ${filePath}`;
+  }
+  if (containsPathTraversal(filePath)) {
+    return `Path traversal detected: ${filePath}`;
+  }
+  if (containsControlChars(filePath)) {
+    return `Control characters detected in path: ${filePath}`;
+  }
+  const resolved = path5.resolve(root, filePath);
+  const relative2 = path5.relative(root, resolved);
+  if (relative2.startsWith("..") || path5.isAbsolute(relative2)) {
+    return `Path escapes root: ${filePath}`;
+  }
+  if (!isCanonicalPathWithinRoot(resolved, root)) {
+    return `Path escapes root via symlink/junction: ${filePath}`;
+  }
+  return null;
+}
+var _internals6 = {
+  realpathSync: fs2.realpathSync,
+  containsPathTraversal,
+  containsControlChars,
+  validateDirectory,
+  validateProjectDirectory,
+  validateSymlinkBoundary,
+  isCanonicalPathWithinRoot,
+  validateTargetWithinRoot
+};
 
 // src/services/run-memory.ts
 var RUN_MEMORY_FILENAME = "run-memory.jsonl";
@@ -2055,7 +2158,7 @@ async function recordOutcome(directory, entry) {
   const resolvedPath = validateSwarmPath(directory, RUN_MEMORY_FILENAME);
   const line = `${JSON.stringify(entry)}
 `;
-  await fs2.appendFile(resolvedPath, line, { encoding: "utf-8" });
+  await fs3.appendFile(resolvedPath, line, { encoding: "utf-8" });
 }
 async function getTaskHistory(directory, taskId) {
   validateWorkspaceRoot(directory);
@@ -2082,14 +2185,14 @@ async function recordTaskAttempt(directory, input) {
   try {
     let history = [];
     try {
-      history = await _internals6.getTaskHistory(directory, input.taskId);
+      history = await _internals7.getTaskHistory(directory, input.taskId);
     } catch (err) {
       warn(`[run-memory] history read for task ${input.taskId} failed; recording with attemptNumber 1: ${err instanceof Error ? err.message : String(err)}`);
     }
     const entry = {
       timestamp: new Date().toISOString(),
       taskId: input.taskId,
-      taskFingerprint: _internals6.generateTaskFingerprint(input.taskId, input.fileTargets ?? []),
+      taskFingerprint: _internals7.generateTaskFingerprint(input.taskId, input.fileTargets ?? []),
       agent: input.agent,
       outcome: input.outcome,
       attemptNumber: history.length + 1
@@ -2103,7 +2206,7 @@ async function recordTaskAttempt(directory, input) {
     if (typeof input.durationMs === "number") {
       entry.durationMs = input.durationMs;
     }
-    await _internals6.recordOutcome(directory, entry);
+    await _internals7.recordOutcome(directory, entry);
   } catch (err) {
     warn(`[run-memory] failed to record ${input.outcome} for task ${input.taskId}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -2167,10 +2270,10 @@ async function getRunMemorySummary(directory) {
   if (entries.length === 0) {
     return null;
   }
-  const groups = _internals6.groupByTaskId(entries);
+  const groups = _internals7.groupByTaskId(entries);
   const summaries = [];
   for (const [taskId, taskEntries] of groups) {
-    const summary = _internals6.summarizeTask(taskId, taskEntries);
+    const summary = _internals7.summarizeTask(taskId, taskEntries);
     if (summary) {
       summaries.push(summary);
     }
@@ -2203,7 +2306,7 @@ Use this data to avoid repeating known failure patterns.`;
   }
   return prefix + summaryText + suffix;
 }
-var _internals6 = {
+var _internals7 = {
   generateTaskFingerprint,
   recordOutcome,
   recordTaskAttempt,
@@ -2215,7 +2318,7 @@ var _internals6 = {
 
 // src/turbo/epic/state.ts
 init_logger();
-import * as fs3 from "fs";
+import * as fs4 from "fs";
 import * as path6 from "path";
 var STATE_FILE = "epic-state.json";
 function nowISO() {
@@ -2223,8 +2326,8 @@ function nowISO() {
 }
 function ensureSwarmDir(directory) {
   const swarmDir = path6.resolve(directory, ".swarm");
-  if (!fs3.existsSync(swarmDir)) {
-    fs3.mkdirSync(swarmDir, { recursive: true });
+  if (!fs4.existsSync(swarmDir)) {
+    fs4.mkdirSync(swarmDir, { recursive: true });
   }
   return swarmDir;
 }
@@ -2245,16 +2348,16 @@ function markStateUnreadable(directory, reason) {
 function readPersisted(directory) {
   try {
     const filePath = path6.join(directory, ".swarm", STATE_FILE);
-    if (!fs3.existsSync(filePath)) {
+    if (!fs4.existsSync(filePath)) {
       const seed = emptyPersisted();
       try {
         ensureSwarmDir(directory);
-        fs3.writeFileSync(filePath, `${JSON.stringify(seed, null, 2)}
+        fs4.writeFileSync(filePath, `${JSON.stringify(seed, null, 2)}
 `, "utf-8");
       } catch {}
       return seed;
     }
-    const raw = fs3.readFileSync(filePath, "utf-8");
+    const raw = fs4.readFileSync(filePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || parsed.version !== 1 || !parsed.sessions || typeof parsed.sessions !== "object" || Array.isArray(parsed.sessions)) {
       markStateUnreadable(directory, `malformed shape (version=${parsed?.version}, sessions type=${Array.isArray(parsed?.sessions) ? "array" : typeof parsed?.sessions})`);
@@ -2291,14 +2394,14 @@ function writePersisted(directory, persisted) {
     throw new Error(`Epic state persistence prepare failed: ${msg}`);
   }
   try {
-    fs3.writeFileSync(tmpPath, payload, "utf-8");
-    fs3.renameSync(tmpPath, filePath);
+    fs4.writeFileSync(tmpPath, payload, "utf-8");
+    fs4.renameSync(tmpPath, filePath);
   } catch (error2) {
     const msg = error2 instanceof Error ? error2.message : String(error2);
     error(`[turbo/epic/state] Failed to persist ${STATE_FILE} atomically: ${msg}`);
     try {
-      if (fs3.existsSync(tmpPath))
-        fs3.unlinkSync(tmpPath);
+      if (fs4.existsSync(tmpPath))
+        fs4.unlinkSync(tmpPath);
     } catch {}
     throw new Error(`Epic state persistence failed: ${msg}`);
   }
@@ -2329,7 +2432,7 @@ function isEpicModeActive(directory, sessionID) {
 function isEpicModeActiveForProject(directory) {
   if (stateUnreadableMap.get(directory))
     return false;
-  if (!fs3.existsSync(path6.join(directory, ".swarm", STATE_FILE))) {
+  if (!fs4.existsSync(path6.join(directory, ".swarm", STATE_FILE))) {
     return false;
   }
   const persisted = readPersisted(directory);
@@ -2380,11 +2483,11 @@ function isLockContentionError(err) {
   return INDEX_LOCK_ERROR_RE.test(msg);
 }
 async function commitTaskCompletion(directory, taskId, description, scopePaths) {
-  if (!_internals7.isGitRepo(directory)) {
+  if (!_internals8.isGitRepo(directory)) {
     return { committed: false, reason: "no-git" };
   }
   try {
-    if (_internals7.hasExistingTaskCommit(directory, taskId)) {
+    if (_internals8.hasExistingTaskCommit(directory, taskId)) {
       return { committed: true, reason: "idempotent-skip" };
     }
   } catch {}
@@ -2405,15 +2508,15 @@ async function commitTaskCompletion(directory, taskId, description, scopePaths)
   for (let attempt = 0;attempt <= INDEX_LOCK_BACKOFF_MS.length; attempt++) {
     try {
       if (paths.length > 0) {
-        _internals7.stageScopedPaths(directory, paths);
+        _internals8.stageScopedPaths(directory, paths);
       }
-      _internals7.commitAllowEmpty(directory, message);
-      const sha = _internals7.gitHeadSha(directory);
+      _internals8.commitAllowEmpty(directory, message);
+      const sha = _internals8.gitHeadSha(directory);
       return { committed: true, reason: "success", sha };
     } catch (err) {
       lastError = err;
       if (attempt < INDEX_LOCK_BACKOFF_MS.length && isLockContentionError(err)) {
-        await _internals7.sleep(INDEX_LOCK_BACKOFF_MS[attempt]);
+        await _internals8.sleep(INDEX_LOCK_BACKOFF_MS[attempt]);
         continue;
       }
       break;
@@ -2423,7 +2526,7 @@ async function commitTaskCompletion(directory, taskId, description, scopePaths)
   criticalWarn(`[epic:task-commit] commit for task ${taskId} failed (non-fatal): ${msg}`);
   return { committed: false, reason: "commit-failed", error: msg };
 }
-var _internals7 = {
+var _internals8 = {
   isGitRepo: (cwd) => isGitRepo(cwd),
   stageScopedPaths: (cwd, paths) => {
     const CHUNK = 200;
@@ -2455,7 +2558,7 @@ var _internals7 = {
 };
 
 // src/turbo/lean/conflicts.ts
-import * as fs4 from "fs";
+import * as fs5 from "fs";
 import * as path7 from "path";
 
 // src/utils/path.ts
@@ -2586,10 +2689,10 @@ function isProtectedPath(normalizedPath) {
 function readTaskScopes(directory, taskId) {
   const scopePath = path7.join(directory, ".swarm", "scopes", `scope-${taskId}.json`);
   try {
-    if (!fs4.existsSync(scopePath)) {
+    if (!fs5.existsSync(scopePath)) {
       return null;
     }
-    const raw = fs4.readFileSync(scopePath, "utf-8");
+    const raw = fs5.readFileSync(scopePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || !Array.isArray(parsed.files)) {
       return null;
@@ -2605,13 +2708,13 @@ import { createHash as createHash3 } from "crypto";
 import * as fsSync2 from "fs";
 import { join as join7 } from "path";
 async function computeSpecHash(directory) {
-  const spec = _internals8.readEffectiveSpecSync(directory);
+  const spec = _internals9.readEffectiveSpecSync(directory);
   if (!spec)
     return null;
   return createHash3("sha256").update(spec.content, "utf-8").digest("hex");
 }
 async function isSpecStale(directory, plan) {
-  const currentHash = await _internals8.computeSpecHash(directory);
+  const currentHash = await _internals9.computeSpecHash(directory);
   if (!plan.specHash) {
     return { stale: false };
   }
@@ -2640,7 +2743,7 @@ function isObligationPreserving(directory) {
     } catch {
       return false;
     }
-    const currentResult = _internals8.readEffectiveSpecSync(directory);
+    const currentResult = _internals9.readEffectiveSpecSync(directory);
     if (!currentResult || !currentResult.content) {
       return false;
     }
@@ -2670,7 +2773,7 @@ function isObligationPreserving(directory) {
     return false;
   }
 }
-var _internals8 = {
+var _internals9 = {
   computeSpecDiff,
   computeSpecHash,
   isObligationPreserving,
@@ -2690,7 +2793,7 @@ function computeSpecDiff(directory) {
   } catch {
     return null;
   }
-  const spec = _internals8.readEffectiveSpecSync(directory);
+  const spec = _internals9.readEffectiveSpecSync(directory);
   if (!spec) {
     return null;
   }
@@ -2784,7 +2887,7 @@ var startupLedgerCheckedWorkspaces = new Set;
 var ledgerStaleWorkspaces = new Set;
 var recoveryMutexes = new Map;
 var PLAN_JSON_CACHE_NAMESPACE = "plan-json:validated:v1";
-var _internals9 = {
+var _internals10 = {
   loadPlan,
   loadPlanJsonOnly,
   regeneratePlanMarkdown,
@@ -3037,7 +3140,7 @@ async function loadPlan(directory, cache) {
           const inSync = await isPlanMdInSync(directory, validated, cache);
           if (!inSync) {
             try {
-              await _internals9.regeneratePlanMarkdown(directory, validated);
+              await _internals10.regeneratePlanMarkdown(directory, validated);
             } catch (regenError) {
               warn(`Failed to regenerate plan.md: ${regenError instanceof Error ? regenError.message : String(regenError)}. Proceeding with plan.json only.`);
             }
@@ -3206,7 +3309,7 @@ async function loadPlan(directory, cache) {
     const existingMutex = recoveryMutexes.get(resolvedDir);
     if (existingMutex) {
       await existingMutex;
-      const postRecoveryPlan = await _internals9.loadPlanJsonOnly(directory);
+      const postRecoveryPlan = await _internals10.loadPlanJsonOnly(directory);
       if (postRecoveryPlan)
         return postRecoveryPlan;
     }
@@ -3266,7 +3369,7 @@ async function loadPlan(directory, cache) {
   return null;
 }
 async function savePlanWithAutoAcknowledgedRemovals(directory, plan, source, reason, options) {
-  const existing = await _internals9.loadPlanJsonOnly(directory);
+  const existing = await _internals10.loadPlanJsonOnly(directory);
   const newIds = new Set;
   for (const phase of plan.phases) {
     for (const task of phase.tasks)
@@ -3316,7 +3419,7 @@ async function savePlan(directory, plan, options) {
   }
   if (options?.preserveCompletedStatuses !== false) {
     try {
-      const currentPlan2 = await _internals9.loadPlanJsonOnly(directory);
+      const currentPlan2 = await _internals10.loadPlanJsonOnly(directory);
       if (currentPlan2) {
         const completedTaskIds = new Set;
         for (const phase of currentPlan2.phases) {
@@ -3338,7 +3441,7 @@ async function savePlan(directory, plan, options) {
     } catch {}
   }
   derivePhaseStatusesInPlace(validated);
-  const currentPlan = await _internals9.loadPlanJsonOnly(directory);
+  const currentPlan = await _internals10.loadPlanJsonOnly(directory);
   const planId = derivePlanId(validated);
   const planHashForInit = computePlanHash(validated);
   if (!await ledgerExists(directory)) {
@@ -3520,7 +3623,7 @@ async function savePlan(directory, plan, options) {
             expectedHash: currentHash,
             planHashAfter: hashAfter,
             verifyValid: async () => {
-              const onDisk = await _internals9.loadPlanJsonOnly(directory);
+              const onDisk = await _internals10.loadPlanJsonOnly(directory);
               if (!onDisk)
                 return true;
               for (const p of onDisk.phases) {
@@ -3558,7 +3661,7 @@ async function savePlan(directory, plan, options) {
               expectedHash: currentHash,
               planHashAfter: hashAfter,
               verifyValid: async () => {
-                const onDisk = await _internals9.loadPlanJsonOnly(directory);
+                const onDisk = await _internals10.loadPlanJsonOnly(directory);
                 if (!onDisk)
                   return true;
                 for (const p of onDisk.phases) {
@@ -3856,7 +3959,7 @@ async function updateTaskStatus(directory, taskId, status, options) {
     return "pending";
   };
   {
-    const currentPlan = await _internals9.loadPlanJsonOnly(directory);
+    const currentPlan = await _internals10.loadPlanJsonOnly(directory);
     if (currentPlan) {
       const currentTask = currentPlan.phases.flatMap((p) => p.tasks).find((t) => t.id === taskId);
       const settled = currentTask && currentTask.status !== "pending" && currentTask.status !== "in_progress";
@@ -3869,7 +3972,7 @@ async function updateTaskStatus(directory, taskId, status, options) {
   }
   const MAX_OUTER_RETRIES = 1;
   for (let attempt = 0;attempt <= MAX_OUTER_RETRIES; attempt++) {
-    const plan = await _internals9.loadPlan(directory);
+    const plan = await _internals10.loadPlan(directory);
     if (plan === null) {
       throw new Error(`Plan not found in directory: ${directory}`);
     }
@@ -3900,7 +4003,7 @@ async function updateTaskStatus(directory, taskId, status, options) {
       if (status === "completed" || status === "blocked") {
         const recordedTask = updatedPlan.phases.flatMap((phase) => phase.tasks).find((candidate) => candidate.id === taskId);
         try {
-          await _internals9.recordTaskAttempt(directory, {
+          await _internals10.recordTaskAttempt(directory, {
             taskId,
             agent: "plan-status",
             outcome: status === "completed" ? "pass" : "fail",
@@ -3911,8 +4014,8 @@ async function updateTaskStatus(directory, taskId, status, options) {
           warn(`[plan/manager] run-memory record for ${taskId} failed: ${err instanceof Error ? err.message : String(err)}`);
         }
       }
-      if (status === "completed" && _internals9.isGitRepo(directory) && _internals9.isEpicModeActiveForProject(directory)) {
-        const mergeFailure = _internals9.getWorktreeMergeFailure(taskId);
+      if (status === "completed" && _internals10.isGitRepo(directory) && _internals10.isEpicModeActiveForProject(directory)) {
+        const mergeFailure = _internals10.getWorktreeMergeFailure(taskId);
         if (mergeFailure) {
           criticalWarn(`[plan/manager] Rule 2 auto-commit SKIPPED for ${taskId}: worktree merge-back ${mergeFailure.outcome} at stage '${mergeFailure.stage}'. The task's changes are NOT in the main tree, so no completion marker is written (Rule 3 must not treat this task as satisfied). Resolve the preserved worktree, then re-run the task. Detail: ${mergeFailure.message}`);
           return updatedPlan;
@@ -3926,8 +4029,8 @@ async function updateTaskStatus(directory, taskId, status, options) {
               break;
             }
           }
-          const canonicalScope = _internals9.readTaskScopes(directory, taskId);
-          await _internals9.commitTaskCompletion(directory, taskId, taskDescription, canonicalScope ?? undefined);
+          const canonicalScope = _internals10.readTaskScopes(directory, taskId);
+          await _internals10.commitTaskCompletion(directory, taskId, taskDescription, canonicalScope ?? undefined);
         } catch (commitErr) {
           criticalWarn(`[plan/manager] Rule 2 auto-commit for ${taskId} threw (non-fatal): ${commitErr instanceof Error ? commitErr.message : String(commitErr)}`);
         }
@@ -4242,16 +4345,16 @@ init_zod();
 import {
   mkdirSync as mkdirSync5,
   readdirSync as readdirSync2,
-  realpathSync,
+  realpathSync as realpathSync2,
   renameSync as renameSync3,
   rmSync,
   statSync as statSync2
 } from "fs";
-import * as fs7 from "fs/promises";
+import * as fs8 from "fs/promises";
 import * as path10 from "path";
 
 // src/evaluation/retention.ts
-import * as fs5 from "fs/promises";
+import * as fs6 from "fs/promises";
 import * as path9 from "path";
 function artifactKey(artifact) {
   return `${artifact.namespace}/${artifact.id}`;
@@ -4263,7 +4366,7 @@ async function evaluationRunCandidates(directory) {
   const root = path9.join(directory, ".swarm", "evolution", "runs");
   let entries = [];
   try {
-    entries = await fs5.readdir(root, { withFileTypes: true });
+    entries = await fs6.readdir(root, { withFileTypes: true });
   } catch (error2) {
     if (error2.code === "ENOENT") {
       return { candidates: [], corrupt: [] };
@@ -4281,7 +4384,7 @@ async function evaluationRunCandidates(directory) {
     const artifact = { namespace: "evaluation-run", id };
     const target = path9.join(root, entry.name);
     try {
-      const run = EvaluationRunV1Schema.parse(JSON.parse(await fs5.readFile(target, "utf8")));
+      const run = EvaluationRunV1Schema.parse(JSON.parse(await fs6.readFile(target, "utf8")));
       if (run.runId !== id)
         throw new Error("run id/path mismatch");
       candidates.push({
@@ -4300,7 +4403,7 @@ async function gateAuditCandidates(directory) {
   const root = path9.join(directory, ".swarm", "evidence", "gate-audit");
   let entries = [];
   try {
-    entries = await fs5.readdir(root, { withFileTypes: true });
+    entries = await fs6.readdir(root, { withFileTypes: true });
   } catch (error2) {
     if (error2.code === "ENOENT") {
       return { candidates: [], corrupt: [] };
@@ -4315,7 +4418,7 @@ async function gateAuditCandidates(directory) {
     const artifact = { namespace: "gate-audit", id: entry.name };
     const target = path9.join(root, entry.name);
     try {
-      const result = GateAuditResultV1Schema.parse(JSON.parse(await fs5.readFile(path9.join(target, "results.json"), "utf8")));
+      const result = GateAuditResultV1Schema.parse(JSON.parse(await fs6.readFile(path9.join(target, "results.json"), "utf8")));
       if (result.runId !== entry.name)
         throw new Error("run id/path mismatch");
       candidates.push({
@@ -4346,10 +4449,10 @@ async function protectedArtifacts(directory) {
 }
 async function removeCandidate(candidate) {
   if (candidate.kind === "directory") {
-    await fs5.rm(candidate.target, { recursive: true, force: true });
+    await fs6.rm(candidate.target, { recursive: true, force: true });
     return;
   }
-  await fs5.unlink(candidate.target);
+  await fs6.unlink(candidate.target);
 }
 var _retentionInternals = {
   protectedArtifacts,
@@ -4406,7 +4509,7 @@ async function archiveEvaluationArtifacts(args) {
 }
 
 // src/evidence/documents-retention.ts
-import * as fs6 from "fs";
+import * as fs7 from "fs";
 import * as fsp from "fs/promises";
 import * as readline from "readline";
 var EVIDENCE_CACHE_FILE = "evidence-cache/documents.jsonl";
@@ -4414,13 +4517,13 @@ var MAX_READ_BYTES = 100 * 1024 * 1024;
 var RENAME_MAX_ATTEMPTS = 5;
 var RENAME_BACKOFF_MS = 10;
 var RENAME_RETRY_CODES = new Set(["EPERM", "EBUSY", "ENOTEMPTY", "EACCES"]);
-var _internals10 = {
+var _internals11 = {
   stat: (p) => fsp.stat(p),
-  createReadStream: (p, options) => fs6.createReadStream(p, options),
-  openSync: (p, flags) => fs6.openSync(p, flags),
-  writeSync: (fd, data, position) => fs6.writeSync(fd, data, position),
-  fsyncSync: (fd) => fs6.fsyncSync(fd),
-  closeSync: (fd) => fs6.closeSync(fd),
+  createReadStream: (p, options) => fs7.createReadStream(p, options),
+  openSync: (p, flags) => fs7.openSync(p, flags),
+  writeSync: (fd, data, position) => fs7.writeSync(fd, data, position),
+  fsyncSync: (fd) => fs7.fsyncSync(fd),
+  closeSync: (fd) => fs7.closeSync(fd),
   renameWithRetry: atomicRenameWithRetry,
   unlink: (p) => fsp.unlink(p)
 };
@@ -4456,9 +4559,9 @@ function emptyResult(dryRun) {
   };
 }
 async function readCacheRows(filePath) {
-  const stat2 = await _internals10.stat(filePath);
+  const stat2 = await _internals11.stat(filePath);
   const bytesBefore = stat2.size;
-  const stream = _internals10.createReadStream(filePath, {
+  const stream = _internals11.createReadStream(filePath, {
     encoding: "utf8",
     highWaterMark: 64 * 1024
   });
@@ -4534,23 +4637,23 @@ async function rewriteAtomic(filePath, survivors) {
 `)}
 ` : "";
   let succeeded = false;
-  const fd = _internals10.openSync(tmpPath, "w");
+  const fd = _internals11.openSync(tmpPath, "w");
   try {
-    _internals10.writeSync(fd, payload, 0);
-    _internals10.fsyncSync(fd);
-    _internals10.closeSync(fd);
-    await _internals10.renameWithRetry(tmpPath, filePath);
+    _internals11.writeSync(fd, payload, 0);
+    _internals11.fsyncSync(fd);
+    _internals11.closeSync(fd);
+    await _internals11.renameWithRetry(tmpPath, filePath);
     succeeded = true;
   } catch (err) {
     try {
-      _internals10.closeSync(fd);
+      _internals11.closeSync(fd);
     } catch {}
     const msg = err instanceof Error ? err.message : String(err);
     throw new Error(`documents-cache rewrite failed: ${msg}`);
   } finally {
     if (!succeeded) {
       try {
-        await _internals10.unlink(tmpPath);
+        await _internals11.unlink(tmpPath);
       } catch {}
     }
   }
@@ -4563,7 +4666,7 @@ async function pruneEvidenceDocuments(args) {
   const filePath = validateSwarmPath(args.directory, EVIDENCE_CACHE_FILE);
   let stat2;
   try {
-    stat2 = await _internals10.stat(filePath);
+    stat2 = await _internals11.stat(filePath);
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT")
@@ -4664,17 +4767,17 @@ function isValidEvidenceType(type) {
 var sanitizeTaskId2 = sanitizeTaskId;
 function validateProjectRoot(directory) {
   assertProjectRoot(directory, {
-    realpathSync: _internals11.realpathSync,
-    statSync: _internals11.statSync
+    realpathSync: _internals12.realpathSync,
+    statSync: _internals12.statSync
   }, "evidence");
 }
 async function saveEvidence(directory, taskId, evidence, abortSignal) {
   abortSignal?.throwIfAborted();
-  _internals11.validateProjectRoot(directory);
+  _internals12.validateProjectRoot(directory);
   const sanitizedTaskId = sanitizeTaskId2(taskId);
   const relativePath = path10.join("evidence", sanitizedTaskId, "evidence.json");
   validateSwarmPath(directory, relativePath);
-  _internals11.validateEvidence(evidence);
+  _internals12.validateEvidence(evidence);
   return withEvidenceLock(directory, relativePath, "evidence-manager", sanitizedTaskId, async () => {
     abortSignal?.throwIfAborted();
     const evidencePath = validateSwarmPath(directory, relativePath);
@@ -4784,7 +4887,7 @@ async function loadEvidence(directory, taskId, options) {
     return { status: "invalid_schema", errors: ["Invalid JSON"] };
   }
   if (isFlatRetrospective(parsed)) {
-    const wrappedBundle = _internals11.wrapFlatRetrospective(parsed, sanitizedTaskId);
+    const wrappedBundle = _internals12.wrapFlatRetrospective(parsed, sanitizedTaskId);
     try {
       const validated = EvidenceBundleSchema.parse(wrappedBundle);
       if (options?.migrate === false) {
@@ -4798,7 +4901,7 @@ async function loadEvidence(directory, taskId, options) {
           const tempPath = path10.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
           try {
             await bunWrite(tempPath, bundleJson);
-            await fs7.rename(tempPath, evidencePath);
+            await fs8.rename(tempPath, evidencePath);
             invalidateCachedArtifact(evidencePath);
           } catch (writeError) {
             try {
@@ -4883,15 +4986,15 @@ async function checkRequirementCoverage(phase, directory) {
   const relativePath = path10.join("evidence", `req-coverage-phase-${phase}.json`);
   const absolutePath = path10.resolve(directory, ".swarm", relativePath);
   try {
-    await fs7.access(absolutePath);
+    await fs8.access(absolutePath);
     return { exists: true, path: absolutePath };
   } catch {
     return { exists: false, path: absolutePath };
   }
 }
 async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
-  const taskIds = await _internals11.listEvidenceTaskIds(directory);
-  const cutoffDate = options?.now ? new Date(options.now) : _internals11.now();
+  const taskIds = await _internals12.listEvidenceTaskIds(directory);
+  const cutoffDate = options?.now ? new Date(options.now) : _internals12.now();
   cutoffDate.setDate(cutoffDate.getDate() - maxAgeDays);
   const cutoffIso = cutoffDate.toISOString();
   const selected = new Set;
@@ -4903,7 +5006,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   for (const taskId of taskIds) {
     let result;
     try {
-      result = await _internals11.loadEvidence(directory, taskId);
+      result = await _internals12.loadEvidence(directory, taskId);
     } catch {
       warn("archive: skipping corrupt or unreadable evidence for task", taskId);
       continue;
@@ -4931,7 +5034,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   }
   if (!options?.dryRun) {
     for (const taskId of [...selected].sort()) {
-      const deleted = await _internals11.deleteEvidence(directory, taskId);
+      const deleted = await _internals12.deleteEvidence(directory, taskId);
       if (deleted)
         archived.push(taskId);
       else
@@ -4957,7 +5060,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   };
   if (typeof options?.cacheMaxBytes === "number" && options.cacheMaxBytes > 0 || typeof options?.cacheMaxRecords === "number" && options.cacheMaxRecords > 0) {
     try {
-      documentsCache = await _internals11.pruneEvidenceDocuments({
+      documentsCache = await _internals12.pruneEvidenceDocuments({
         directory,
         maxBytes: options?.cacheMaxBytes,
         maxRecords: options?.cacheMaxRecords,
@@ -4985,7 +5088,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
 function validateEvidence(evidence) {
   return EvidenceSchema.parse(evidence);
 }
-var _internals11 = {
+var _internals12 = {
   wrapFlatRetrospective,
   loadEvidence,
   listEvidenceTaskIds,
@@ -4994,7 +5097,7 @@ var _internals11 = {
   saveEvidence,
   deleteEvidence,
   pruneEvidenceDocuments,
-  realpathSync,
+  realpathSync: realpathSync2,
   statSync: statSync2,
   now: () => new Date
 };
@@ -5109,4 +5212,4 @@ function mergeDurableGateEntriesFromEvidence(taskId, entries, evidence) {
   return merged;
 }
 
-export { projectDbExists, getProjectDb, closeProjectDb, buildTaskCompletionDescriptor, ensureTaskCheckpointReceipt, updateTaskCheckpointReceipt, isValidEnvKey, getExecutor, init_executor, MAX_TRANSIENT_RETRIES, isTransientSpawnError, transientBackoff, getGitRepositoryStatus, isGitRepo, getDefaultBaseBranch, detectDefaultRemoteBranch, resetToRemoteBranch, resetToMainAfterMerge, containsPathTraversal, containsControlChars, isStateUnreadable, loadEpicSessionState, isEpicModeActive, enableEpicMode, disableEpicMode, normalizePath, pathsConflict, isGlobalFile, isProtectedPath, readTaskScopes, loadPlanJsonOnly, loadPlan, savePlan, closePlanTerminalState, updateTaskStatus, derivePlanMarkdown, isValidEvidenceType, sanitizeTaskId2 as sanitizeTaskId, validateProjectRoot, saveEvidence, loadEvidence, listEvidenceTaskIds, checkRequirementCoverage, archiveEvidence, readDurableGateEvidence, getDurableGateEvidenceStatus, getDurableGateEvidenceStatusForTask, mergeDurableGateEntriesFromEvidence };
+export { projectDbExists, getProjectDb, closeProjectDb, buildTaskCompletionDescriptor, ensureTaskCheckpointReceipt, updateTaskCheckpointReceipt, isValidEnvKey, getExecutor, init_executor, MAX_TRANSIENT_RETRIES, isTransientSpawnError, transientBackoff, getGitRepositoryStatus, isGitRepo, getDefaultBaseBranch, detectDefaultRemoteBranch, resetToRemoteBranch, resetToMainAfterMerge, containsPathTraversal, containsControlChars, validateSymlinkBoundary, isStateUnreadable, loadEpicSessionState, isEpicModeActive, enableEpicMode, disableEpicMode, normalizePath, pathsConflict, isGlobalFile, isProtectedPath, readTaskScopes, loadPlanJsonOnly, loadPlan, savePlan, closePlanTerminalState, updateTaskStatus, derivePlanMarkdown, isValidEvidenceType, sanitizeTaskId2 as sanitizeTaskId, validateProjectRoot, saveEvidence, loadEvidence, listEvidenceTaskIds, checkRequirementCoverage, archiveEvidence, readDurableGateEvidence, getDurableGateEvidenceStatus, getDurableGateEvidenceStatusForTask, mergeDurableGateEntriesFromEvidence };