opencode-swarm 7.144.4 → 7.144.5

package/.opencode/skills/swarm-pr-review/references/prompt-templates.md

@@ -65,7 +65,7 @@ Use this template when dispatching a base explorer:
 ```text
 You are a base explorer. Optimize for recall, not final judgment.
 Return candidates only. Do not use CONFIRMED, DISPROVED, or PRE_EXISTING.
-Do not narrate progress or repeat the prompt. Keep the complete final response at or below 12,000 characters; spend that budget on evidence-bearing rows and the minimum prose needed to make them auditable.
+Do not narrate progress or repeat the prompt. Keep the complete final response at or below 12,000 characters; spend that budget on evidence-bearing rows and the minimum prose needed to make them auditable. When the controller-appended contract declares a per-lane final_response_char_budget, that number is authoritative over this template default.
 
 Lane:
 Scope:
@@ -106,7 +106,7 @@ Use this template when dispatching a micro-lane or council explorer:
 ```text
 You are a micro-lane or council explorer. Optimize for recall, not final judgment.
 Return candidates only. Do not use CONFIRMED, DISPROVED, or PRE_EXISTING.
-Do not narrate progress or repeat the prompt. Keep the complete final response at or below 12,000 characters; spend that budget on evidence-bearing rows and the minimum prose needed to make them auditable.
+Do not narrate progress or repeat the prompt. Keep the complete final response at or below 12,000 characters; spend that budget on evidence-bearing rows and the minimum prose needed to make them auditable. When the controller-appended contract declares a per-lane final_response_char_budget, that number is authoritative over this template default.
 
 Micro/council lane:
 Scope:

package/dist/background/workspace-snapshot.d.ts

@@ -1,5 +1,6 @@
 import * as child_process from 'node:child_process';
 import { bunSpawn } from '../utils/bun-compat.js';
+import { resolveGitExecutable } from '../utils/git-executable.js';
 import type { BackgroundWorkspaceSnapshot } from './pending-delegations.js';
 type SpawnSync = typeof child_process.spawnSync;
 interface CaptureWorkspaceSnapshotOptions {
@@ -202,6 +203,12 @@ export declare function digest(text: string): string;
 export declare const _internals: {
     spawnSync: SpawnSync;
     bunSpawn: typeof bunSpawn;
+    /**
+     * Test seam for git binary resolution (issue #2236 hardening, lane C1b) —
+     * see `src/utils/git-executable.ts`. Allows tests to stub a deterministic
+     * value instead of exercising the real filesystem-probing resolver.
+     */
+    resolveGitExecutable: typeof resolveGitExecutable;
     gitTimeoutMs: number;
     yieldControl: () => Promise<void>;
     parsePorcelainV2Snapshot: typeof parsePorcelainV2Snapshot;

package/dist/cli/{capability-probe-f1paszww.js → capability-probe-976tt4ba.js}

@@ -1,12 +1,14 @@
 // @bun
 import {
   SandboxCapabilityProbe,
+  _internals,
+  _resetCapabilityCache,
   init_capability_probe,
   isBubblewrapAvailable,
   isSandboxExecAvailable,
   isWindowsSandboxAvailable
-} from "./index-8fwhhayc.js";
-import"./index-q1exe2b3.js";
+} from "./index-b44qqqt2.js";
+import"./index-zy7f84cs.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 init_capability_probe();
@@ -15,5 +17,7 @@ export {
   isWindowsSandboxAvailable,
   isSandboxExecAvailable,
   isBubblewrapAvailable,
+  _resetCapabilityCache,
+  _internals,
   SandboxCapabilityProbe
 };

package/dist/cli/{config-doctor-rw9zrjk6.js → config-doctor-m005xfdt.js}

@@ -12,9 +12,9 @@ import {
   shouldRunOnStartup,
   writeBackupArtifact,
   writeDoctorArtifact
-} from "./index-h98t1m88.js";
+} from "./index-dc04v786.js";
 import"./index-z6xqpmqg.js";
-import"./index-y8j8ehc8.js";
+import"./index-kdak6s63.js";
 import"./index-v3y3qg48.js";
 import"./index-zjygnfay.js";
 import"./index-bk5tah7q.js";

package/dist/cli/{core-zjx9aqaf.js → core-6vdtfb8s.js}

@@ -14,12 +14,13 @@ import {
   resolveWorktreeBaseDir,
   shortenWorktreePath,
   writeLaneProfileToDiskReal
-} from "./index-8j0va7jp.js";
+} from "./index-855hseq4.js";
 import"./index-z6xqpmqg.js";
-import"./index-4rhhvd1a.js";
 import"./index-v3y3qg48.js";
+import"./index-9e6fdz2h.js";
+import"./index-4rhhvd1a.js";
 import"./index-zjygnfay.js";
-import"./index-4nt52yr9.js";
+import"./index-zj6t9zgx.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {

package/dist/cli/{curation-policy-0wbrh11c.js → curation-policy-a511r0qz.js}

@@ -4,16 +4,16 @@ import {
   authorizeCuration,
   buildConfigFingerprintInput,
   readCohortConfigFingerprint
-} from "./index-dty5qgk2.js";
+} from "./index-vdha477y.js";
 import"./index-rtry5xyf.js";
-import"./index-ywn7vtxp.js";
-import"./index-mazgg5s2.js";
+import"./index-h1p08s3n.js";
+import"./index-9s8drsf9.js";
 import"./index-ed5ykebp.js";
 import"./index-f9vvg5xb.js";
 import"./index-1jsmmx7y.js";
 import"./index-7g4c7s5r.js";
 import"./index-bpmtbmy9.js";
-import"./index-4nt52yr9.js";
+import"./index-zj6t9zgx.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {

package/dist/cli/{curator-g54a7wv0.js → curator-0t87anp5.js}

@@ -14,60 +14,61 @@ import {
   runCuratorInit,
   runCuratorPhase,
   writeCuratorSummary
-} from "./index-q4ed1jk7.js";
-import"./index-d12jd5mn.js";
-import"./index-h98t1m88.js";
-import"./index-az8etqpp.js";
+} from "./index-wmsehjq6.js";
+import"./index-dtbzyr3s.js";
+import"./index-dc04v786.js";
+import"./index-kh0jt9pg.js";
 import"./index-134d35c1.js";
-import"./index-b6e016tv.js";
-import"./index-1csyxv0f.js";
-import"./index-fqcjragy.js";
+import"./index-abtrcs16.js";
+import"./index-6z5jtf7d.js";
+import"./index-wknz5c8q.js";
 import"./index-y8552snf.js";
-import"./index-nckg4gxb.js";
+import"./index-63tgh0cn.js";
 import"./index-70ha9e09.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
-import"./index-74hpm6sh.js";
-import"./index-bt9aa01f.js";
-import"./index-zb0xcz9t.js";
-import"./index-x6tp0hfr.js";
-import"./index-yts89pqg.js";
-import"./index-dty5qgk2.js";
+import"./index-f36ybbsv.js";
+import"./index-hkdgkkhb.js";
+import"./index-wm6f7t7w.js";
+import"./index-ea09xax6.js";
+import"./index-rnyt30tm.js";
+import"./index-vdha477y.js";
 import"./index-rtry5xyf.js";
 import"./index-zsrtt42s.js";
-import"./index-jabkn643.js";
-import"./index-k3cxyk66.js";
-import"./index-cz25e8xp.js";
-import"./index-8j0va7jp.js";
-import"./index-pw83zgny.js";
-import"./index-z6v7kwpa.js";
+import"./index-n4hwcsbd.js";
+import"./index-cwtpqm5f.js";
+import"./index-a1hxejxc.js";
+import"./index-855hseq4.js";
+import"./index-mkmcz6x8.js";
+import"./index-7e4q41nb.js";
 import"./index-556ja8an.js";
 import"./index-7sy3aa9m.js";
 import"./index-wx8zdh4a.js";
-import"./index-8fwhhayc.js";
-import"./index-q1exe2b3.js";
-import"./index-03pv47h2.js";
-import"./index-4w5qdbk7.js";
-import"./index-psvxq93b.js";
+import"./index-b44qqqt2.js";
+import"./index-zy7f84cs.js";
+import"./index-641yjpk8.js";
+import"./index-wbrqvm2g.js";
+import"./index-1pxqkvvq.js";
 import"./index-gprxjmm7.js";
 import"./index-n832052r.js";
-import"./index-rn0eq85g.js";
+import"./index-fv0s19g9.js";
 import"./index-z6xqpmqg.js";
-import"./index-9qq7c18c.js";
-import"./index-y8j8ehc8.js";
-import"./index-4rhhvd1a.js";
+import"./index-58cvm3dw.js";
+import"./index-kdak6s63.js";
 import"./index-v3y3qg48.js";
+import"./index-9e6fdz2h.js";
+import"./index-4rhhvd1a.js";
 import"./index-zjygnfay.js";
 import"./index-ae75rja9.js";
-import"./index-ywn7vtxp.js";
-import"./index-mazgg5s2.js";
+import"./index-h1p08s3n.js";
+import"./index-9s8drsf9.js";
 import"./index-ed5ykebp.js";
 import"./index-bk5tah7q.js";
 import"./index-f9vvg5xb.js";
 import"./index-1jsmmx7y.js";
 import"./index-7g4c7s5r.js";
 import"./index-bpmtbmy9.js";
-import"./index-4nt52yr9.js";
+import"./index-zj6t9zgx.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {

package/dist/cli/{curator-drift-2jbjv03a.js → curator-drift-ckjm272w.js}

@@ -9,7 +9,7 @@ import"./index-n832052r.js";
 import {
   readSwarmFileAsync,
   validateSwarmPath
-} from "./index-rn0eq85g.js";
+} from "./index-fv0s19g9.js";
 import"./index-z6xqpmqg.js";
 import"./index-4rhhvd1a.js";
 import"./index-zjygnfay.js";
@@ -17,7 +17,7 @@ import {
   invalidateCachedArtifact
 } from "./index-ed5ykebp.js";
 import"./index-bpmtbmy9.js";
-import"./index-4nt52yr9.js";
+import"./index-zj6t9zgx.js";
 import {
   init_logger,
   warn

package/dist/cli/curator-llm-factory-j8tk9rxm.js

@@ -0,0 +1,63 @@
+// @bun
+import {
+  createCuratorLLMDelegate
+} from "./index-wmsehjq6.js";
+import"./index-dtbzyr3s.js";
+import"./index-dc04v786.js";
+import"./index-kh0jt9pg.js";
+import"./index-134d35c1.js";
+import"./index-abtrcs16.js";
+import"./index-6z5jtf7d.js";
+import"./index-wknz5c8q.js";
+import"./index-y8552snf.js";
+import"./index-63tgh0cn.js";
+import"./index-70ha9e09.js";
+import"./index-c8s9a3zh.js";
+import"./index-9ss2m4rs.js";
+import"./index-f36ybbsv.js";
+import"./index-hkdgkkhb.js";
+import"./index-wm6f7t7w.js";
+import"./index-ea09xax6.js";
+import"./index-rnyt30tm.js";
+import"./index-vdha477y.js";
+import"./index-rtry5xyf.js";
+import"./index-zsrtt42s.js";
+import"./index-n4hwcsbd.js";
+import"./index-cwtpqm5f.js";
+import"./index-a1hxejxc.js";
+import"./index-855hseq4.js";
+import"./index-mkmcz6x8.js";
+import"./index-7e4q41nb.js";
+import"./index-556ja8an.js";
+import"./index-7sy3aa9m.js";
+import"./index-wx8zdh4a.js";
+import"./index-b44qqqt2.js";
+import"./index-zy7f84cs.js";
+import"./index-641yjpk8.js";
+import"./index-wbrqvm2g.js";
+import"./index-1pxqkvvq.js";
+import"./index-gprxjmm7.js";
+import"./index-n832052r.js";
+import"./index-fv0s19g9.js";
+import"./index-z6xqpmqg.js";
+import"./index-58cvm3dw.js";
+import"./index-kdak6s63.js";
+import"./index-v3y3qg48.js";
+import"./index-9e6fdz2h.js";
+import"./index-4rhhvd1a.js";
+import"./index-zjygnfay.js";
+import"./index-ae75rja9.js";
+import"./index-h1p08s3n.js";
+import"./index-9s8drsf9.js";
+import"./index-ed5ykebp.js";
+import"./index-bk5tah7q.js";
+import"./index-f9vvg5xb.js";
+import"./index-1jsmmx7y.js";
+import"./index-7g4c7s5r.js";
+import"./index-bpmtbmy9.js";
+import"./index-zj6t9zgx.js";
+import"./index-zgwm4ryv.js";
+import"./index-a76rekgs.js";
+export {
+  createCuratorLLMDelegate
+};

package/dist/cli/{dispatch-1y1rnv1h.js → dispatch-ndxbsk98.js}

@@ -11,10 +11,10 @@ import {
   defaultTestFilesFor,
   detectProjectLanguages,
   tokenizeCommand
-} from "./index-b6e016tv.js";
+} from "./index-abtrcs16.js";
 import"./index-z6xqpmqg.js";
 import"./index-zjygnfay.js";
-import"./index-4nt52yr9.js";
+import"./index-zj6t9zgx.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 

package/dist/cli/{evidence-summary-service-fnr5y54e.js → evidence-summary-service-c22gahjc.js}

@@ -6,34 +6,35 @@ import {
   loadPlanJsonOnly,
   mergeDurableGateEntriesFromEvidence,
   readDurableGateEvidence
-} from "./index-az8etqpp.js";
+} from "./index-kh0jt9pg.js";
 import"./index-134d35c1.js";
-import"./index-fqcjragy.js";
+import"./index-wknz5c8q.js";
 import"./index-y8552snf.js";
 import"./index-9ss2m4rs.js";
 import"./index-zsrtt42s.js";
-import"./index-cz25e8xp.js";
-import"./index-8j0va7jp.js";
-import"./index-z6v7kwpa.js";
+import"./index-a1hxejxc.js";
+import"./index-855hseq4.js";
+import"./index-7e4q41nb.js";
 import"./index-556ja8an.js";
-import"./index-q1exe2b3.js";
+import"./index-zy7f84cs.js";
 import"./index-gprxjmm7.js";
 import"./index-n832052r.js";
-import"./index-rn0eq85g.js";
+import"./index-fv0s19g9.js";
 import"./index-z6xqpmqg.js";
-import"./index-9qq7c18c.js";
-import"./index-y8j8ehc8.js";
-import"./index-4rhhvd1a.js";
+import"./index-58cvm3dw.js";
+import"./index-kdak6s63.js";
 import"./index-v3y3qg48.js";
+import"./index-9e6fdz2h.js";
+import"./index-4rhhvd1a.js";
 import"./index-zjygnfay.js";
-import"./index-mazgg5s2.js";
+import"./index-9s8drsf9.js";
 import"./index-ed5ykebp.js";
 import"./index-bk5tah7q.js";
 import"./index-f9vvg5xb.js";
 import"./index-1jsmmx7y.js";
 import"./index-7g4c7s5r.js";
 import"./index-bpmtbmy9.js";
-import"./index-4nt52yr9.js";
+import"./index-zj6t9zgx.js";
 import {
   log
 } from "./index-zgwm4ryv.js";

package/dist/cli/{gate-evidence-2xt1x07r.js → gate-evidence-hh8kc9wt.js}

@@ -17,21 +17,22 @@ import {
   reduceTaskWorkflowSnapshot,
   transitionTaskWorkflowEvidence,
   withTaskEvidenceTransaction
-} from "./index-cz25e8xp.js";
-import"./index-8j0va7jp.js";
+} from "./index-a1hxejxc.js";
+import"./index-855hseq4.js";
 import"./index-556ja8an.js";
-import"./index-rn0eq85g.js";
+import"./index-fv0s19g9.js";
 import"./index-z6xqpmqg.js";
-import"./index-4rhhvd1a.js";
 import"./index-v3y3qg48.js";
+import"./index-9e6fdz2h.js";
+import"./index-4rhhvd1a.js";
 import"./index-zjygnfay.js";
-import"./index-mazgg5s2.js";
+import"./index-9s8drsf9.js";
 import"./index-ed5ykebp.js";
 import"./index-f9vvg5xb.js";
 import"./index-1jsmmx7y.js";
 import"./index-7g4c7s5r.js";
 import"./index-bpmtbmy9.js";
-import"./index-4nt52yr9.js";
+import"./index-zj6t9zgx.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {

package/dist/cli/guardrail-explain-9gjw2dsd.js

@@ -0,0 +1,64 @@
+// @bun
+import {
+  handleGuardrailExplain
+} from "./index-rdgtfj74.js";
+import"./index-wmsehjq6.js";
+import"./index-dtbzyr3s.js";
+import"./index-dc04v786.js";
+import"./index-kh0jt9pg.js";
+import"./index-134d35c1.js";
+import"./index-abtrcs16.js";
+import"./index-6z5jtf7d.js";
+import"./index-wknz5c8q.js";
+import"./index-y8552snf.js";
+import"./index-63tgh0cn.js";
+import"./index-70ha9e09.js";
+import"./index-c8s9a3zh.js";
+import"./index-9ss2m4rs.js";
+import"./index-f36ybbsv.js";
+import"./index-hkdgkkhb.js";
+import"./index-wm6f7t7w.js";
+import"./index-ea09xax6.js";
+import"./index-rnyt30tm.js";
+import"./index-vdha477y.js";
+import"./index-rtry5xyf.js";
+import"./index-zsrtt42s.js";
+import"./index-n4hwcsbd.js";
+import"./index-cwtpqm5f.js";
+import"./index-a1hxejxc.js";
+import"./index-855hseq4.js";
+import"./index-mkmcz6x8.js";
+import"./index-7e4q41nb.js";
+import"./index-556ja8an.js";
+import"./index-7sy3aa9m.js";
+import"./index-wx8zdh4a.js";
+import"./index-b44qqqt2.js";
+import"./index-zy7f84cs.js";
+import"./index-641yjpk8.js";
+import"./index-wbrqvm2g.js";
+import"./index-1pxqkvvq.js";
+import"./index-gprxjmm7.js";
+import"./index-n832052r.js";
+import"./index-fv0s19g9.js";
+import"./index-z6xqpmqg.js";
+import"./index-58cvm3dw.js";
+import"./index-kdak6s63.js";
+import"./index-v3y3qg48.js";
+import"./index-9e6fdz2h.js";
+import"./index-4rhhvd1a.js";
+import"./index-zjygnfay.js";
+import"./index-ae75rja9.js";
+import"./index-h1p08s3n.js";
+import"./index-9s8drsf9.js";
+import"./index-ed5ykebp.js";
+import"./index-bk5tah7q.js";
+import"./index-f9vvg5xb.js";
+import"./index-1jsmmx7y.js";
+import"./index-7g4c7s5r.js";
+import"./index-bpmtbmy9.js";
+import"./index-zj6t9zgx.js";
+import"./index-zgwm4ryv.js";
+import"./index-a76rekgs.js";
+export {
+  handleGuardrailExplain
+};

package/dist/cli/{guardrail-log-5w4b9zrw.js → guardrail-log-ejf5zjac.js}

@@ -1,16 +1,16 @@
 // @bun
 import {
   handleGuardrailLog
-} from "./index-q67jb94n.js";
-import"./index-d12jd5mn.js";
+} from "./index-3qdzpv91.js";
+import"./index-dtbzyr3s.js";
 import"./index-556ja8an.js";
 import"./index-z6xqpmqg.js";
-import"./index-y8j8ehc8.js";
+import"./index-kdak6s63.js";
 import"./index-v3y3qg48.js";
 import"./index-zjygnfay.js";
 import"./index-bk5tah7q.js";
 import"./index-bpmtbmy9.js";
-import"./index-4nt52yr9.js";
+import"./index-zj6t9zgx.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {

package/dist/cli/{hive-promoter-x63ehffd.js → hive-promoter-gkbfpdtv.js}

@@ -7,62 +7,63 @@ import {
   isHiveEligible,
   promoteFromSwarm,
   promoteToHive
-} from "./index-q4ed1jk7.js";
-import"./index-d12jd5mn.js";
-import"./index-h98t1m88.js";
-import"./index-az8etqpp.js";
+} from "./index-wmsehjq6.js";
+import"./index-dtbzyr3s.js";
+import"./index-dc04v786.js";
+import"./index-kh0jt9pg.js";
 import"./index-134d35c1.js";
-import"./index-b6e016tv.js";
-import"./index-1csyxv0f.js";
-import"./index-fqcjragy.js";
+import"./index-abtrcs16.js";
+import"./index-6z5jtf7d.js";
+import"./index-wknz5c8q.js";
 import"./index-y8552snf.js";
-import"./index-nckg4gxb.js";
+import"./index-63tgh0cn.js";
 import"./index-70ha9e09.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
-import"./index-74hpm6sh.js";
-import"./index-bt9aa01f.js";
-import"./index-zb0xcz9t.js";
-import"./index-x6tp0hfr.js";
-import"./index-yts89pqg.js";
-import"./index-dty5qgk2.js";
+import"./index-f36ybbsv.js";
+import"./index-hkdgkkhb.js";
+import"./index-wm6f7t7w.js";
+import"./index-ea09xax6.js";
+import"./index-rnyt30tm.js";
+import"./index-vdha477y.js";
 import"./index-rtry5xyf.js";
 import"./index-zsrtt42s.js";
-import"./index-jabkn643.js";
-import"./index-k3cxyk66.js";
-import"./index-cz25e8xp.js";
-import"./index-8j0va7jp.js";
-import"./index-pw83zgny.js";
-import"./index-z6v7kwpa.js";
+import"./index-n4hwcsbd.js";
+import"./index-cwtpqm5f.js";
+import"./index-a1hxejxc.js";
+import"./index-855hseq4.js";
+import"./index-mkmcz6x8.js";
+import"./index-7e4q41nb.js";
 import"./index-556ja8an.js";
 import"./index-7sy3aa9m.js";
 import"./index-wx8zdh4a.js";
-import"./index-8fwhhayc.js";
-import"./index-q1exe2b3.js";
+import"./index-b44qqqt2.js";
+import"./index-zy7f84cs.js";
 import {
   resolveHiveKnowledgePath
-} from "./index-03pv47h2.js";
-import"./index-4w5qdbk7.js";
-import"./index-psvxq93b.js";
+} from "./index-641yjpk8.js";
+import"./index-wbrqvm2g.js";
+import"./index-1pxqkvvq.js";
 import"./index-gprxjmm7.js";
 import"./index-n832052r.js";
-import"./index-rn0eq85g.js";
+import"./index-fv0s19g9.js";
 import"./index-z6xqpmqg.js";
-import"./index-9qq7c18c.js";
-import"./index-y8j8ehc8.js";
-import"./index-4rhhvd1a.js";
+import"./index-58cvm3dw.js";
+import"./index-kdak6s63.js";
 import"./index-v3y3qg48.js";
+import"./index-9e6fdz2h.js";
+import"./index-4rhhvd1a.js";
 import"./index-zjygnfay.js";
 import"./index-ae75rja9.js";
-import"./index-ywn7vtxp.js";
-import"./index-mazgg5s2.js";
+import"./index-h1p08s3n.js";
+import"./index-9s8drsf9.js";
 import"./index-ed5ykebp.js";
 import"./index-bk5tah7q.js";
 import"./index-f9vvg5xb.js";
 import"./index-1jsmmx7y.js";
 import"./index-7g4c7s5r.js";
 import"./index-bpmtbmy9.js";
-import"./index-4nt52yr9.js";
+import"./index-zj6t9zgx.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {

package/dist/cli/{index-psvxq93b.js → index-1pxqkvvq.js}

@@ -2,10 +2,10 @@
 import {
   init_loader,
   loadPluginConfigWithMeta
-} from "./index-9qq7c18c.js";
+} from "./index-58cvm3dw.js";
 import {
   init_schema
-} from "./index-y8j8ehc8.js";
+} from "./index-kdak6s63.js";
 import {
   DEFAULT_WORKTREE_ISOLATION_CONFIG,
   init_constants

package/dist/cli/{index-q67jb94n.js → index-3qdzpv91.js}

@@ -2,7 +2,7 @@
 import {
   redactPath,
   redactShellCommand
-} from "./index-d12jd5mn.js";
+} from "./index-dtbzyr3s.js";
 
 // src/services/guardrail-log-service.ts
 import * as fs from "fs/promises";

package/dist/cli/{index-9qq7c18c.js → index-58cvm3dw.js}

@@ -6,7 +6,11 @@ import {
   PluginConfigSchema,
   init_schema,
   resolveExternalSkillsConfig
-} from "./index-y8j8ehc8.js";
+} from "./index-kdak6s63.js";
+import {
+  GIT_BINARY_ENV_VAR,
+  init_git_executable
+} from "./index-9e6fdz2h.js";
 import {
   advisoryWarn,
   init_warning_buffer
@@ -437,11 +441,41 @@ function rawFullAutoLocked(raw) {
   }
   return fullAuto.locked === true;
 }
+function exposedGitBinary(raw) {
+  if (!raw || typeof raw !== "object")
+    return;
+  const git = raw.git;
+  if (!git || typeof git !== "object" || Array.isArray(git))
+    return;
+  return git.binary;
+}
+function enforceGitBinaryProvenance(mergedRaw, rawUserConfig) {
+  const userBinary = exposedGitBinary(rawUserConfig);
+  const exposedBinary = exposedGitBinary(mergedRaw);
+  if (Object.is(exposedBinary, userBinary))
+    return mergedRaw;
+  advisoryWarn(`[opencode-swarm] \u26A0\uFE0F SECURITY: Ignoring "git.binary" supplied by the project config (.opencode/${CONFIG_FILENAME}). ` + 'That file lives inside the repository, so it is untrusted content, and "git.binary" selects the executable this plugin spawns for every git command. ' + `Set it in your user config (<config dir>/opencode/${CONFIG_FILENAME}) or the ${GIT_BINARY_ENV_VAR} environment variable instead.`);
+  const exposedGit = mergedRaw.git;
+  const nextGit = exposedGit && typeof exposedGit === "object" && !Array.isArray(exposedGit) ? { ...exposedGit } : {};
+  const rebuilt = { ...mergedRaw };
+  if (userBinary === undefined) {
+    delete nextGit.binary;
+    if (Object.keys(nextGit).length === 0) {
+      delete rebuilt.git;
+      return rebuilt;
+    }
+  } else {
+    nextGit.binary = userBinary;
+  }
+  rebuilt.git = nextGit;
+  return rebuilt;
+}
 function buildConfigWithMeta(rawUserConfig, rawProjectConfig, loadedFromFile, configHadErrors) {
   let mergedRaw = rawUserConfig ?? {};
   if (rawProjectConfig) {
     mergedRaw = deepMerge(mergedRaw, rawProjectConfig);
   }
+  mergedRaw = enforceGitBinaryProvenance(mergedRaw, rawUserConfig);
   if (rawFullAutoLocked(rawUserConfig) || rawFullAutoLocked(rawProjectConfig)) {
     const fa = mergedRaw.full_auto && typeof mergedRaw.full_auto === "object" && !Array.isArray(mergedRaw.full_auto) ? mergedRaw.full_auto : {};
     mergedRaw = { ...mergedRaw, full_auto: { ...fa, locked: true } };
@@ -682,6 +716,7 @@ function loadAgentPrompt(agentName) {
 var CONFIG_FILENAME = "opencode-swarm.json", PROMPTS_DIR_NAME = "opencode-swarm", MAX_CONFIG_FILE_BYTES = 102400;
 var init_loader = __esm(() => {
   init_warning_buffer();
+  init_git_executable();
   init_sanitize_malformed_values();
   init_schema();
   init_merge();