opencode-swarm 7.144.4 → 7.144.6

package/dist/cli/{index-az8etqpp.js → index-fgdhf6a5.js}

@@ -6,7 +6,7 @@ import {
   EvaluationRunV1Schema,
   GateAuditResultV1Schema,
   getProtectedEvaluationRunIds
-} from "./index-fqcjragy.js";
+} from "./index-wknz5c8q.js";
 import {
   readEffectiveSpecSync
 } from "./index-9ss2m4rs.js";
@@ -14,11 +14,16 @@ import {
   getWorktreeMergeFailure
 } from "./index-zsrtt42s.js";
 import {
+  GitBinaryMissingError,
+  GitSpawnCwdError,
+  isGitBinaryMissing,
+  isSpawnCwdMissing,
+  isSpawnCwdUnreadable,
   isValidTaskId,
   readTaskEvidence,
   readTaskEvidenceRaw,
   sanitizeTaskId
-} from "./index-cz25e8xp.js";
+} from "./index-sqe3nqh5.js";
 import {
   LedgerStaleWriterError,
   appendLedgerEvent,
@@ -38,14 +43,11 @@ import {
   replayFromLedgerWithStatus,
   takeSnapshotEvent,
   takeSnapshotWithRetry
-} from "./index-z6v7kwpa.js";
+} from "./index-q6bhmyxb.js";
 import {
-  _internals,
-  buildDefaultPolicy,
-  execute,
-  init_runner_client,
-  probe
-} from "./index-q1exe2b3.js";
+  init_executor,
+  isValidEnvKey
+} from "./index-zy7f84cs.js";
 import {
   EVIDENCE_MAX_JSON_BYTES,
   EvidenceBundleSchema,
@@ -54,10 +56,16 @@ import {
 import {
   readSwarmFileAsync,
   validateSwarmPath
-} from "./index-rn0eq85g.js";
+} from "./index-fv0s19g9.js";
 import {
   PlanSchema
-} from "./index-9qq7c18c.js";
+} from "./index-ytzz6pq1.js";
+import {
+  GIT_BINARY_ENV_VAR,
+  describeGitResolution,
+  init_git_executable,
+  resolveGitExecutable
+} from "./index-9e6fdz2h.js";
 import {
   invalidateCachedArtifact,
   readCachedParsedFile
@@ -78,903 +86,13 @@ import {
   bunHash,
   bunWrite,
   mergeEnvForChild
-} from "./index-4nt52yr9.js";
+} from "./index-zj6t9zgx.js";
 import {
   criticalWarn,
   error,
   init_logger,
   warn
 } from "./index-zgwm4ryv.js";
-import {
-  __esm,
-  __export,
-  __require,
-  __toCommonJS
-} from "./index-a76rekgs.js";
-
-// src/sandbox/linux/bubblewrap-executor.ts
-import { spawnSync } from "child_process";
-function probeBwrap() {
-  try {
-    const result = spawnSync("bwrap", ["--version"], {
-      windowsHide: true,
-      encoding: "utf-8",
-      timeout: 5000,
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    if (result.error) {
-      const code = result.error.code;
-      if (code && BWRAP_UNAVAILABLE_CODES.has(code)) {
-        warn(`Sandbox disabled: bwrap error (${code}). Falling through to tool-layer enforcement.`);
-        return false;
-      }
-      warn(`Sandbox disabled: bwrap spawn error (${result.error.message}). Falling through to tool-layer enforcement.`);
-      return false;
-    }
-    return result.status === BWRAP_VERSION_EXIT && result.stdout.trim().length > 0;
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    warn(`Sandbox disabled: probe threw (${message}). Falling through to tool-layer enforcement.`);
-    return false;
-  }
-}
-function shellEscape(s) {
-  return s.replace(/'/g, "'\\''");
-}
-
-class BubblewrapSandboxExecutor {
-  mechanism = "Bubblewrap";
-  _scopePaths;
-  _tempDir;
-  _available;
-  _disabledReason;
-  constructor(scopePaths = [], tempDir) {
-    this._scopePaths = scopePaths;
-    this._tempDir = tempDir;
-    this._available = false;
-    this._disabledReason = null;
-    try {
-      if (!_internals2.probeBwrap()) {
-        this._disabledReason = "bwrap not available or not functional";
-        warn(`Sandbox disabled: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
-      } else {
-        this._available = true;
-      }
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this._disabledReason = `constructor threw: ${message}`;
-      this._available = false;
-      warn(`Sandbox disabled: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
-    }
-  }
-  isAvailable() {
-    return this._available;
-  }
-  disable(reason) {
-    this._available = false;
-    this._disabledReason = reason;
-    warn(`Sandbox disabled: ${reason}. Falling through to tool-layer enforcement.`);
-  }
-  wrapCommand(command, scopePaths, tempDir, envOverrides) {
-    if (!this._available) {
-      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
-    }
-    const temp = tempDir ?? this._tempDir ?? "/tmp";
-    const allScopes = [...this._scopePaths, ...scopePaths];
-    const bindArgs = allScopes.flatMap((p) => [
-      "--bind",
-      `'${shellEscape(p)}'`,
-      `'${shellEscape(p)}'`
-    ]);
-    const envArgs = [];
-    if (envOverrides) {
-      for (const [key, value] of Object.entries(envOverrides)) {
-        if (!isValidEnvKey(key)) {
-          continue;
-        }
-        if (value === null) {
-          envArgs.push("--unsetenv", key);
-        } else {
-          envArgs.push("--setenv", key, value);
-        }
-      }
-    }
-    const args = [
-      "--unshare-user",
-      "--unshare-net",
-      "--unshare-ipc",
-      "--die-with-parent",
-      "--new-session",
-      "--cap-drop",
-      "ALL",
-      ...bindArgs,
-      "--dev",
-      "/dev",
-      "--size",
-      String(TMPFS_SIZE_BYTES),
-      "--tmpfs",
-      `'${shellEscape(temp)}'`,
-      "--ro-bind",
-      "/etc",
-      "/etc",
-      "--ro-bind",
-      "/usr",
-      "/usr",
-      "--ro-bind",
-      "/lib",
-      "/lib",
-      "--ro-bind",
-      "/lib64",
-      "/lib64",
-      "--proc",
-      "/proc",
-      "--unshare-pid",
-      ...envArgs,
-      "--",
-      "bash",
-      "-c",
-      `'${shellEscape(command)}'`
-    ];
-    return `bwrap ${args.join(" ")}`;
-  }
-  getEnvOverrides() {
-    return {};
-  }
-}
-var BWRAP_VERSION_EXIT = 0, BWRAP_UNAVAILABLE_CODES, TMPFS_SIZE_BYTES = 524288000, _internals2;
-var init_bubblewrap_executor = __esm(() => {
-  init_logger();
-  init_executor();
-  BWRAP_UNAVAILABLE_CODES = new Set(["ENOENT", "EACCES", "ENOSPC"]);
-  _internals2 = {
-    probeBwrap
-  };
-});
-
-// src/sandbox/executors/bubblewrap.ts
-var exports_bubblewrap = {};
-__export(exports_bubblewrap, {
-  BubblewrapSandboxExecutor: () => BubblewrapSandboxExecutor
-});
-var init_bubblewrap = __esm(() => {
-  init_bubblewrap_executor();
-});
-
-// src/sandbox/macos/sandbox-exec-executor.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import { mkdtempSync, writeFileSync } from "fs";
-import * as os from "os";
-import * as path from "path";
-function probeSandboxExec() {
-  try {
-    const result = spawnSync2("sandbox-exec", ["--version"], {
-      windowsHide: true,
-      encoding: "utf-8",
-      timeout: 5000,
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    if (result.error) {
-      const code = result.error.code;
-      if (code && SANDBOX_UNAVAILABLE_CODES.has(code)) {
-        warn(`Sandbox disabled: sandbox-exec error (${code}). Falling through to tool-layer enforcement.`);
-        return false;
-      }
-      warn(`Sandbox disabled: spawn error (${result.error.message}). Falling through to tool-layer enforcement.`);
-      return false;
-    }
-    return result.status === 0;
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    warn(`Sandbox disabled: probe threw (${message}). Falling through to tool-layer enforcement.`);
-    return false;
-  }
-}
-function shellEscape2(s) {
-  return s.replace(/'/g, "'\\''");
-}
-function sbplEscapePath(path2) {
-  const withoutControlChars = path2.split("").filter((ch) => {
-    const cp = ch.codePointAt(0);
-    return cp >= 32 && cp !== 127;
-  }).join("");
-  return withoutControlChars.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
-}
-function buildSandboxProfile(scopePaths, tempDir, envOverrides) {
-  const rwPaths = [...scopePaths];
-  if (tempDir) {
-    rwPaths.push(tempDir);
-  }
-  const rwAllowLines = rwPaths.map((p) => `(allow file-write* (subpath "${sbplEscapePath(p)}"))`).join(`
-`);
-  const envLines = [];
-  if (envOverrides) {
-    for (const [key, value] of Object.entries(envOverrides)) {
-      if (!isValidEnvKey(key)) {
-        continue;
-      }
-      if (value === null) {
-        envLines.push(`(unsetenv ${key})`);
-      } else {
-        const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
-        envLines.push(`(setenv ${key} "${escaped}")`);
-      }
-    }
-  }
-  const profile = `(version 1)
-(allow default)
-(allow file-read* (subpath "/usr"))
-(allow file-read* (subpath "/bin"))
-(allow file-read* (subpath "/sbin"))
-(allow file-read* (subpath "/lib"))
-(allow file-read* (subpath "/lib64"))
-(deny file-write*)
-${rwAllowLines}
-${envLines.join(`
-`)}`;
-  return profile;
-}
-
-class MacOSSandboxExecutor {
-  mechanism = "sandbox-exec";
-  _scopePaths;
-  _tempDir;
-  _available;
-  _disabledReason;
-  constructor(scopePaths = [], tempDir) {
-    if (process.platform !== "darwin") {
-      throw new Error("MacOSSandboxExecutor not yet implemented");
-    }
-    this._scopePaths = scopePaths;
-    this._tempDir = tempDir;
-    this._available = false;
-    this._disabledReason = null;
-    try {
-      if (!_internals3.probeSandboxExec()) {
-        this._disabledReason = "sandbox-exec not available or not functional";
-        warn(`Sandbox disabled: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
-      } else {
-        this._available = true;
-      }
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this._disabledReason = `constructor threw: ${message}`;
-      this._available = false;
-      warn(`Sandbox disabled: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
-    }
-  }
-  isAvailable() {
-    return this._available;
-  }
-  disable(reason) {
-    this._disabledReason = reason;
-    this._available = false;
-    warn(`Sandbox disabled: ${reason}. Falling through to tool-layer enforcement.`);
-  }
-  wrapCommand(command, scopePaths, tempDir, envOverrides) {
-    if (!this._available) {
-      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
-    }
-    if (!_internals3.probeSandboxExec()) {
-      this._available = false;
-      this._disabledReason = "sandbox-exec became unavailable between calls";
-      warn(`Sandbox disabled: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
-      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
-    }
-    const temp = tempDir ?? this._tempDir ?? os.tmpdir();
-    const allScopes = [...this._scopePaths, ...scopePaths];
-    const profile = buildSandboxProfile(allScopes, temp, envOverrides);
-    let profilePath;
-    try {
-      const profileDir = mkdtempSync(path.join(os.tmpdir(), "sandbox-"));
-      profilePath = path.join(profileDir, `profile-${process.pid}-${Date.now()}.sb`);
-      writeFileSync(profilePath, profile, { mode: 384 });
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      warn(`Sandbox disabled: failed to write profile (${message}). Falling through to tool-layer enforcement.`);
-      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
-    }
-    const escapedCommand = shellEscape2(command);
-    const escapedProfilePath = shellEscape2(profilePath);
-    return `sandbox-exec -f '${escapedProfilePath}' bash -c '${escapedCommand}'`;
-  }
-  getEnvOverrides() {
-    return {
-      DYLD_INSERT_LIBRARIES: null,
-      DYLD_LIBRARY_PATH: null,
-      DYLD_FRAMEWORK_PATH: null,
-      DYLD_ROOT_PATH: null,
-      PATH: "/usr/bin:/bin:/usr/sbin:/sbin"
-    };
-  }
-}
-var SANDBOX_UNAVAILABLE_CODES, _internals3;
-var init_sandbox_exec_executor = __esm(() => {
-  init_logger();
-  init_executor();
-  SANDBOX_UNAVAILABLE_CODES = new Set(["ENOENT", "EACCES", "ENOSPC"]);
-  _internals3 = {
-    probeSandboxExec,
-    buildSandboxProfile
-  };
-});
-
-// src/sandbox/executors/macos.ts
-var exports_macos = {};
-__export(exports_macos, {
-  MacOSSandboxExecutor: () => MacOSSandboxExecutor
-});
-var init_macos = __esm(() => {
-  init_sandbox_exec_executor();
-});
-
-// src/sandbox/win32/edge-cases.ts
-function detectPowerShellEscape(command) {
-  if (process.platform !== "win32")
-    return false;
-  const encodedCommandPattern = /-EncodedCommand/i;
-  if (encodedCommandPattern.test(command)) {
-    return true;
-  }
-  const encodedBase64Pattern = /-Enc(odedCommand)?\s+[A-Za-z0-9+/=]+/i;
-  if (encodedBase64Pattern.test(command)) {
-    return true;
-  }
-  const psExePattern = /powershell\.exe?\s+.*-(?:e(?:n(?:c(?:odedCommand)?)?)?|wmi|remote)/i;
-  if (psExePattern.test(command)) {
-    return true;
-  }
-  const iexPattern = /\biex\b/i;
-  if (iexPattern.test(command)) {
-    return true;
-  }
-  const invokeExpressionPattern = /Invoke-Expression/i;
-  if (invokeExpressionPattern.test(command)) {
-    return true;
-  }
-  const invokeCommandRemotePattern = /Invoke-Command\s+.*-ComputerName/i;
-  if (invokeCommandRemotePattern.test(command)) {
-    return true;
-  }
-  const psCommandPattern = /powershell.*-Command\s+["'].*\$/i;
-  if (psCommandPattern.test(command)) {
-    return true;
-  }
-  const execPolicyPattern = /-ExecutionPolicy\s+(?:Bypass|RemoteSigned|Unrestricted)/i;
-  if (execPolicyPattern.test(command)) {
-    return true;
-  }
-  const noProfilePattern = /-NoProfile\s+-/i;
-  if (noProfilePattern.test(command)) {
-    return true;
-  }
-  const automationPattern = /New-Object\s+.*Management\.Automation/i;
-  if (automationPattern.test(command)) {
-    return true;
-  }
-  const downloadPattern = /\[System\.Net\.(?:WebClient|Http).*\]\.(?:DownloadString|DownloadFile)/i;
-  if (downloadPattern.test(command)) {
-    return true;
-  }
-  const hiddenWindowPattern = /-WindowStyle\s+Hidden/i;
-  if (hiddenWindowPattern.test(command)) {
-    return true;
-  }
-  const scriptInjectionPattern = /\$(?:env|input|host)\b.*\|/i;
-  if (scriptInjectionPattern.test(command)) {
-    return true;
-  }
-  const obfuscatedIexPattern = /IEX|i:eX/i;
-  if (obfuscatedIexPattern.test(command)) {
-    return true;
-  }
-  return false;
-}
-var init_edge_cases = () => {};
-
-// src/sandbox/win32/restricted-environment-executor.ts
-import { Buffer as Buffer2 } from "buffer";
-import { spawnSync as spawnSync3 } from "child_process";
-import * as os2 from "os";
-import * as path2 from "path";
-function containsUnsafePathSyntax(value) {
-  return [...value].some((character) => character.charCodeAt(0) < 32 || UNSAFE_PATH_CHARACTERS.has(character));
-}
-function getSafeSystemRoot() {
-  const raw = process.env.SystemRoot;
-  if (typeof raw !== "string" || !/^[A-Za-z]:[\\/]/.test(raw) || containsUnsafePathSyntax(raw.slice(2)) || raw.slice(3).split(/[\\/]+/).some((segment) => segment === "." || segment === "..")) {
-    return DEFAULT_SYSTEM_ROOT;
-  }
-  const normalized = path2.win32.normalize(raw);
-  return normalized.length > 3 ? normalized.replace(/\\+$/, "") : normalized;
-}
-function getWindowsExecutablePaths() {
-  const systemRoot = getSafeSystemRoot();
-  return {
-    systemRoot,
-    cmdExe: path2.win32.join(systemRoot, "System32", "cmd.exe"),
-    powerShellExe: path2.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
-  };
-}
-function probeWindowsSandbox() {
-  try {
-    const result = spawnSync3(getWindowsExecutablePaths().cmdExe, ["/d", "/s", "/c", "echo ok"], {
-      cwd: os2.tmpdir(),
-      windowsHide: true,
-      encoding: "utf-8",
-      timeout: 5000,
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    if (result.error) {
-      const code = result.error.code;
-      if (code && SANDBOX_UNAVAILABLE_CODES2.has(code)) {
-        warn(`Sandbox disabled: spawn error (${code}). Falling through to tool-layer enforcement.`);
-        return false;
-      }
-      warn(`Sandbox disabled: spawn error (${result.error.message}). Falling through to tool-layer enforcement.`);
-      return false;
-    }
-    return result.status === 0;
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    warn(`Sandbox disabled: probe threw (${message}). Falling through to tool-layer enforcement.`);
-    return false;
-  }
-}
-function psSingleQuoteEscape(s) {
-  return s.replace(/'/g, "''");
-}
-function normalizeInheritedPathEntry(rawEntry) {
-  const entry = rawEntry.trim();
-  if (!/^[A-Za-z]:[\\/]/.test(entry) || containsUnsafePathSyntax(entry.slice(2)) || entry.slice(3).split(/[\\/]+/).some((segment) => segment === "." || segment === "..")) {
-    return null;
-  }
-  const normalized = path2.win32.normalize(entry);
-  return normalized.length > 3 ? normalized.replace(/\\+$/, "") : normalized;
-}
-function getSafeWindowsPath() {
-  const { systemRoot } = getWindowsExecutablePaths();
-  const candidates = [
-    path2.win32.join(systemRoot, "System32"),
-    systemRoot,
-    ...(process.env.PATH ?? "").split(";")
-  ];
-  const seen = new Set;
-  const safeEntries = [];
-  for (const candidate of candidates) {
-    const normalized = normalizeInheritedPathEntry(candidate);
-    if (!normalized)
-      continue;
-    const identity = normalized.toLowerCase();
-    if (seen.has(identity))
-      continue;
-    seen.add(identity);
-    safeEntries.push(normalized);
-  }
-  return safeEntries.join(";");
-}
-function isPowerShellNativeCommand(command) {
-  return /^(?:Remove-Item|rm|del|erase|Copy-Item|cp|copy|Move-Item|mv|move|Rename-Item|ren|New-Item|ni|Get-Item|gi|Get-ChildItem|ls|dir|gci|Get-Content|cat|type|gc|Set-Content|sc|Add-Content|ac|Clear-Content|clc|Test-Path|Resolve-Path|Split-Path|Join-Path|Out-File|Get-Date)\b/i.test(command.trimStart());
-}
-function isSafePsCommandBody(command) {
-  return !/[;&|`$()\r\n]/.test(command);
-}
-function isPathInScopes(command, scopes) {
-  if (scopes.length === 0)
-    return true;
-  const pathPattern = /[A-Za-z]:(?:[^\\/:*?"<>|\r\n]+(?:\\[^\\/:*?"<>|\r\n]+)*)/g;
-  const paths = command.match(pathPattern) || [];
-  if (paths.length === 0)
-    return true;
-  const normalizedPaths = paths.map((p) => path2.win32.resolve(p));
-  const normalizedScopes = scopes.map((s) => s.toLowerCase().replace(/\\+$/, ""));
-  return normalizedPaths.every((p) => {
-    const lower = p.toLowerCase();
-    return normalizedScopes.some((scope) => lower.startsWith(scope));
-  });
-}
-
-class WindowsSandboxExecutor {
-  mechanism = "powershell-wrapper";
-  _scopePaths;
-  _tempDir;
-  _available;
-  _disabled;
-  _disabledReason;
-  constructor(scopePaths = [], tempDir) {
-    this._scopePaths = scopePaths;
-    this._tempDir = tempDir;
-    this._available = false;
-    this._disabled = false;
-    this._disabledReason = null;
-    try {
-      if (!_internals4.probeWindowsSandbox()) {
-        this._available = false;
-        this._disabledReason = "Windows sandbox not available or not functional";
-        warn(`Sandbox unavailable: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
-      } else {
-        this._available = true;
-      }
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this._available = false;
-      this._disabledReason = `constructor probe threw: ${message}`;
-      warn(`Sandbox unavailable: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
-    }
-  }
-  isAvailable() {
-    return this._available && !this._disabled;
-  }
-  disable(reason) {
-    this._disabled = true;
-    this._disabledReason = reason;
-    warn(`Sandbox disabled: ${reason}. Falling through to tool-layer enforcement.`);
-  }
-  wrapCommand(command, scopePaths, tempDir, envOverrides) {
-    if (!this.isAvailable()) {
-      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
-    }
-    if (!_internals4.probeWindowsSandbox()) {
-      this._available = false;
-      this._disabledReason = "Windows sandbox became unavailable between calls";
-      warn(`Sandbox disabled: ${this._disabledReason}. Falling through to tool-layer enforcement.`);
-      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
-    }
-    const temp = tempDir ?? this._tempDir ?? os2.tmpdir();
-    const _allScopes = [...this._scopePaths, ...scopePaths];
-    if (detectPowerShellEscape(command)) {
-      throw new SandboxError("Command contains PowerShell escape patterns", "DETECT_POWERSHELL_ESCAPE");
-    }
-    if (!isPathInScopes(command, _allScopes)) {
-      throw new SandboxError("Command targets paths outside authorized scopes", "PATH_ESCAPE_SCOPE");
-    }
-    if (isPowerShellNativeCommand(command) && !isSafePsCommandBody(command)) {
-      throw new SandboxError("PowerShell-native command body contains unsafe characters", "UNSAFE_PS_COMMAND");
-    }
-    const safePath = getSafeWindowsPath();
-    const { cmdExe, powerShellExe } = getWindowsExecutablePaths();
-    const commandBase64 = Buffer2.from(command, "utf8").toString("base64");
-    const escapedTemp = psSingleQuoteEscape(temp);
-    const escapedPath = psSingleQuoteEscape(safePath);
-    const escapedCmdExe = psSingleQuoteEscape(cmdExe);
-    const envOverrideLines = [];
-    if (envOverrides) {
-      for (const [key, value] of Object.entries(envOverrides)) {
-        if (!isValidEnvKey(key)) {
-          continue;
-        }
-        if (value === null) {
-          envOverrideLines.push(`Remove-Item Env:${key} -Force -ErrorAction SilentlyContinue;`);
-        } else {
-          const psEscaped = psSingleQuoteEscape(value);
-          envOverrideLines.push(`$env:${key} = '${psEscaped}';`);
-        }
-      }
-    }
-    const commandExec = isPowerShellNativeCommand(command) ? `Invoke-Expression $command;
-  exit 0;` : `$batchPath = $null;
-  $batchLocationPushed = $false;
-  try {
-    if ($command.Contains([char]13) -or $command.Contains([char]10)) {
-      $batchName = 'opencode-swarm-' + [Guid]::NewGuid().ToString('N') + '.cmd';
-      $batchPath = Join-Path $env:TEMP $batchName;
-      [IO.File]::WriteAllText($batchPath, $command, [Text.UTF8Encoding]::new($false));
-      Push-Location -LiteralPath $env:TEMP;
-      $batchLocationPushed = $true;
-      & '${escapedCmdExe}' /d /v:off /s /c ('call "' + $batchName + '"');
-    } else {
-      & '${escapedCmdExe}' /d /v:off /s /c $command;
-    }
-    $childExitCode = $LASTEXITCODE;
-  } finally {
-    if ($batchLocationPushed) {
-      Pop-Location;
-    }
-    if ($null -ne $batchPath) {
-      Remove-Item -LiteralPath $batchPath -Force -ErrorAction SilentlyContinue;
-    }
-  }
-  if ($null -eq $childExitCode) {
-    throw 'cmd.exe did not report an exit code';
-  }
-  exit [int]$childExitCode;`;
-    const envOverrideBlock = envOverrideLines.length > 0 ? `
-  ${envOverrideLines.join(`
-  `)}` : "";
-    const psScript = `
-$ErrorActionPreference = 'Stop';
-$ProgressPreference = 'SilentlyContinue';
-try {
-  $env:TEMP = '${escapedTemp}';
-  $env:TMP = '${escapedTemp}';
-
-  $env:PATH = '${escapedPath}';
-
-  $dangerousVars = @(
-    'LD_PRELOAD',
-    'DYLD_INSERT_LIBRARIES',
-    'DYLD_LIBRARY_PATH',
-    'DYLD_FRAMEWORK_PATH',
-    'DYLD_ROOT_PATH',
-    'DYLD_FORCE_FLAT_NAMESPACE'
-  );
-  foreach ($v in $dangerousVars) {
-    if (Test-Path Env:$v) {
-      Remove-Item Env:$v -Force -ErrorAction SilentlyContinue;
-    }
-  }
-  ${envOverrideBlock}
-
-  # Execute the command \u2014 PS-native cmdlets via Invoke-Expression, others via the standard command interpreter
-  $commandBytes = [Convert]::FromBase64String('${commandBase64}');
-  $command = [Text.Encoding]::UTF8.GetString($commandBytes);
-  ${commandExec};
-} catch {
-  [Console]::Error.WriteLine($_.Exception.Message);
-  exit 1;
-}`;
-    const encodedScript = Buffer2.from(psScript, "utf16le").toString("base64");
-    const escapedPowerShellExe = psSingleQuoteEscape(powerShellExe);
-    return `& '${escapedPowerShellExe}' -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand ${encodedScript}; exit $LASTEXITCODE`;
-  }
-  getEnvOverrides() {
-    return {
-      PATH: getSafeWindowsPath(),
-      TEMP: null,
-      TMP: null,
-      LD_PRELOAD: null,
-      DYLD_INSERT_LIBRARIES: null,
-      DYLD_LIBRARY_PATH: null,
-      DYLD_FRAMEWORK_PATH: null,
-      DYLD_ROOT_PATH: null,
-      DYLD_FORCE_FLAT_NAMESPACE: null
-    };
-  }
-}
-var SANDBOX_UNAVAILABLE_CODES2, DEFAULT_SYSTEM_ROOT = "C:\\Windows", UNSAFE_PATH_CHARACTERS, _internals4;
-var init_restricted_environment_executor = __esm(() => {
-  init_logger();
-  init_executor();
-  init_edge_cases();
-  SANDBOX_UNAVAILABLE_CODES2 = new Set([
-    "ENOENT",
-    "EACCES",
-    "EPERM",
-    "ENOSPC"
-  ]);
-  UNSAFE_PATH_CHARACTERS = new Set([
-    ":",
-    '"',
-    "'",
-    ";",
-    "&",
-    "|",
-    "<",
-    ">",
-    "^",
-    "%",
-    "!",
-    "?",
-    "*",
-    "`",
-    "$"
-  ]);
-  _internals4 = {
-    probeWindowsSandbox
-  };
-});
-
-// src/sandbox/win32/native-sandbox-executor.ts
-import * as crypto from "crypto";
-import * as fs from "fs";
-import * as os3 from "os";
-import * as path3 from "path";
-
-class NativeWindowsSandboxExecutor {
-  mechanism;
-  _probeResult;
-  _fallbackExecutor;
-  _strength;
-  _disabled;
-  _disabledReason;
-  constructor(scopePaths = [], tempDir) {
-    this._disabled = false;
-    this._disabledReason = null;
-    this._fallbackExecutor = new WindowsSandboxExecutor(scopePaths, tempDir);
-    this._probeResult = probe();
-    if (this._probeResult.available) {
-      this._strength = "strong";
-      this.mechanism = `native-runner/${this._probeResult.mode}`;
-    } else if (this._fallbackExecutor.isAvailable()) {
-      this._strength = "weak";
-      this.mechanism = "powershell-wrapper";
-      warn(`Native sandbox runner unavailable (${this._probeResult.error ?? "unknown"}); ` + "falling back to PowerShell environment restrictions (weak sandbox)");
-    } else {
-      this._strength = "none";
-      this.mechanism = "none";
-    }
-  }
-  get strength() {
-    if (this._disabled)
-      return "none";
-    return this._strength;
-  }
-  isAvailable() {
-    return !this._disabled && this._strength !== "none";
-  }
-  disable(reason) {
-    this._disabled = true;
-    this._disabledReason = reason;
-    warn(`Sandbox disabled: ${reason}. Falling through to tool-layer enforcement.`);
-  }
-  wrapCommand(command, scopePaths, tempDir, envOverrides) {
-    if (!this.isAvailable()) {
-      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
-    }
-    if (this._strength === "strong") {
-      return this._wrapWithRunner(command, scopePaths, tempDir, envOverrides);
-    }
-    return this._fallbackExecutor.wrapCommand(command, scopePaths, tempDir, envOverrides);
-  }
-  _wrapWithRunner(command, scopePaths, tempDir, _envOverrides) {
-    const binary = _internals.findRunnerBinary();
-    if (!binary) {
-      throw new SandboxError("Runner binary not found", "RUNNER_NOT_FOUND");
-    }
-    const workspaceRoot = scopePaths[0] ?? process.cwd();
-    const runId = `swarm-${crypto.randomUUID?.() ?? Date.now()}`;
-    const policy = buildDefaultPolicy(workspaceRoot, runId);
-    if (tempDir) {
-      policy.temp_root = tempDir;
-    }
-    policy.workspace_roots = scopePaths.length > 0 ? scopePaths : [workspaceRoot];
-    policy.writable_roots = policy.workspace_roots;
-    if (_envOverrides) {
-      for (const [key, value] of Object.entries(_envOverrides)) {
-        if (!isValidEnvKey(key))
-          continue;
-        if (typeof value === "string") {
-          policy.env_overrides[key] = value;
-        }
-      }
-    }
-    const policyJson = JSON.stringify(policy);
-    const policyDir = path3.join(os3.tmpdir(), "swarm-sandbox-policies");
-    try {
-      fs.mkdirSync(policyDir, { recursive: true });
-    } catch {}
-    const policyFile = path3.join(policyDir, `${runId}.json`);
-    fs.writeFileSync(policyFile, policyJson, "utf-8");
-    const mode = this._probeResult.mode === "none" ? "auto" : this._probeResult.mode;
-    const escapedBinary = binary.includes(" ") ? `"${binary}"` : binary;
-    const escapedPolicyFile = policyFile.includes(" ") ? `"${policyFile}"` : policyFile;
-    const escapedCommand = command.replace(/"/g, "\\\"");
-    return `cmd /c "type ${escapedPolicyFile} | ${escapedBinary} --policy-stdin --mode ${mode} -- ${escapedCommand} & del ${escapedPolicyFile} 2>nul"`;
-  }
-  getEnvOverrides() {
-    if (this._strength === "strong") {
-      return {
-        PATH: null,
-        TEMP: null,
-        TMP: null,
-        LD_PRELOAD: null,
-        DYLD_INSERT_LIBRARIES: null,
-        DYLD_LIBRARY_PATH: null,
-        DYLD_FRAMEWORK_PATH: null,
-        DYLD_ROOT_PATH: null,
-        DYLD_FORCE_FLAT_NAMESPACE: null
-      };
-    }
-    return this._fallbackExecutor.getEnvOverrides();
-  }
-  async executeNative(command, workspaceRoot, runId) {
-    if (this._strength !== "strong") {
-      throw new SandboxError("Native execution requires strong sandbox (runner binary)", "NATIVE_UNAVAILABLE");
-    }
-    const policy = buildDefaultPolicy(workspaceRoot, runId);
-    return execute(command, policy);
-  }
-  get hasNativeRunner() {
-    return this._strength === "strong";
-  }
-  get disabledReason() {
-    return this._disabledReason;
-  }
-  get probeResult() {
-    return this._probeResult;
-  }
-}
-var init_native_sandbox_executor = __esm(() => {
-  init_logger();
-  init_executor();
-  init_restricted_environment_executor();
-  init_runner_client();
-});
-
-// src/sandbox/executors/windows.ts
-var exports_windows = {};
-__export(exports_windows, {
-  WindowsSandboxExecutor: () => NativeWindowsSandboxExecutor,
-  LegacyWindowsSandboxExecutor: () => WindowsSandboxExecutor
-});
-var init_windows = __esm(() => {
-  init_native_sandbox_executor();
-  init_restricted_environment_executor();
-});
-
-// src/sandbox/executor.ts
-function isValidEnvKey(key) {
-  return /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(key);
-}
-async function getExecutor() {
-  if (_cachedExecutorPromise !== undefined) {
-    return _cachedExecutorPromise;
-  }
-  _cachedExecutorPromise = _createExecutor();
-  return _cachedExecutorPromise;
-}
-async function _createExecutor() {
-  const platform = process.platform;
-  if (platform === "linux") {
-    return _createLinuxExecutor();
-  }
-  if (platform === "darwin") {
-    return _createMacOSExecutor();
-  }
-  if (platform === "win32") {
-    return _createWindowsExecutor();
-  }
-  return null;
-}
-async function _createLinuxExecutor() {
-  const { SandboxCapabilityProbe, isBubblewrapAvailable } = await import("./capability-probe-f1paszww.js");
-  await new SandboxCapabilityProbe().detect();
-  if (!isBubblewrapAvailable()) {
-    return null;
-  }
-  try {
-    const { BubblewrapSandboxExecutor: BubblewrapSandboxExecutor2 } = (init_bubblewrap(), __toCommonJS(exports_bubblewrap));
-    return new BubblewrapSandboxExecutor2([]);
-  } catch {
-    return null;
-  }
-}
-async function _createMacOSExecutor() {
-  const { SandboxCapabilityProbe, isSandboxExecAvailable } = await import("./capability-probe-f1paszww.js");
-  await new SandboxCapabilityProbe().detect();
-  if (!isSandboxExecAvailable()) {
-    return null;
-  }
-  try {
-    const { MacOSSandboxExecutor: MacOSSandboxExecutor2 } = (init_macos(), __toCommonJS(exports_macos));
-    return new MacOSSandboxExecutor2([]);
-  } catch {
-    return null;
-  }
-}
-async function _createWindowsExecutor() {
-  const { SandboxCapabilityProbe, isWindowsSandboxAvailable } = await import("./capability-probe-f1paszww.js");
-  await new SandboxCapabilityProbe().detect();
-  if (!isWindowsSandboxAvailable()) {
-    return null;
-  }
-  try {
-    const { WindowsSandboxExecutor: WindowsSandboxExecutor2 } = (init_windows(), __toCommonJS(exports_windows));
-    return new WindowsSandboxExecutor2([]);
-  } catch {
-    return null;
-  }
-}
-var SandboxError, _cachedExecutorPromise;
-var init_executor = __esm(() => {
-  SandboxError = class SandboxError extends Error {
-    code;
-    constructor(message, code) {
-      super(message);
-      this.code = code;
-      this.name = "SandboxError";
-    }
-  };
-});
 
 // src/plan/manager.ts
 import {
@@ -982,22 +100,22 @@ import {
   copyFileSync,
   existsSync as existsSync4,
   fsyncSync,
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync3,
   openSync,
   readdirSync,
   renameSync as renameSync2,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync4
+  writeFileSync as writeFileSync2
 } from "fs";
 import * as fsPromises from "fs/promises";
-import * as path8 from "path";
+import * as path5 from "path";
 
 // src/db/task-checkpoint-receipt.ts
 import { createHash } from "crypto";
 
 // src/db/project-db.ts
-import { existsSync, mkdirSync as mkdirSync2 } from "fs";
-import { join as join3, resolve } from "path";
+import { existsSync, mkdirSync } from "fs";
+import { join, resolve } from "path";
 var MIGRATIONS = [
   {
     version: 1,
@@ -1151,7 +269,7 @@ function runProjectMigrations(db) {
   }
 }
 function projectDbPath(directory) {
-  return join3(resolve(directory), ".swarm", "swarm.db");
+  return join(resolve(directory), ".swarm", "swarm.db");
 }
 function projectDbExists(directory) {
   return existsSync(projectDbPath(directory));
@@ -1161,10 +279,10 @@ function getProjectDb(directory) {
   const existing = _projectDbs.get(key);
   if (existing)
     return existing;
-  const swarmDir = join3(key, ".swarm");
-  mkdirSync2(swarmDir, { recursive: true });
+  const swarmDir = join(key, ".swarm");
+  mkdirSync(swarmDir, { recursive: true });
   const Db = loadDatabaseCtor();
-  const db = new Db(join3(swarmDir, "swarm.db"));
+  const db = new Db(join(swarmDir, "swarm.db"));
   db.run("PRAGMA journal_mode = WAL;");
   db.run("PRAGMA synchronous = NORMAL;");
   db.run("PRAGMA busy_timeout = 5000;");
@@ -1332,20 +450,8 @@ function updateTaskCheckpointReceipt(directory, descriptor, state, sha) {
 init_executor();
 import * as child_process from "child_process";
 import * as fsSync from "fs";
-import path4 from "path";
-
-// src/utils/git-binary-missing-error.ts
-class GitBinaryMissingError extends Error {
-  name = "GitBinaryMissingError";
-  constructor(message = "git binary is not available", options) {
-    super(message, options);
-  }
-}
-function isGitBinaryMissing(err) {
-  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
-}
-
-// src/git/branch.ts
+import path from "path";
+init_git_executable();
 init_logger();
 
 // src/utils/transient-retry.ts
@@ -1370,23 +476,7 @@ function transientBackoff(attempt) {
 // src/git/branch.ts
 var GIT_TIMEOUT_MS = 30000;
 var GIT_MAX_BUFFER_BYTES = 5 * 1024 * 1024;
-function unique(values) {
-  return [...new Set(values.filter(Boolean))];
-}
-function windowsGitCandidates() {
-  if (process.platform !== "win32")
-    return ["git"];
-  const roots = unique([
-    process.env.ProgramFiles ?? "",
-    process.env["ProgramFiles(x86)"] ?? "",
-    process.env.LOCALAPPDATA ? path4.join(process.env.LOCALAPPDATA, "Programs") : ""
-  ]);
-  const installed = roots.flatMap((root) => [
-    path4.join(root, "Git", "cmd", "git.exe"),
-    path4.join(root, "Git", "bin", "git.exe")
-  ]);
-  return unique(["git", ...installed]);
-}
+var MAX_RENDERED_GIT_CANDIDATES = 10;
 function errorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -1407,7 +497,7 @@ var __spawnSyncSeam = {
   }
 };
 function readLaneEnvFileFromDiskSync(worktreePath, laneIndex) {
-  const envPath = path4.join(worktreePath, ".swarm", "lanes", `${laneIndex}.env`);
+  const envPath = path.join(worktreePath, ".swarm", "lanes", `${laneIndex}.env`);
   let content;
   try {
     content = fsSync.readFileSync(envPath, "utf-8");
@@ -1431,43 +521,71 @@ function readLaneEnvFileFromDiskSync(worktreePath, laneIndex) {
   }
   return result;
 }
+function gitBinaryMissingMessage(cwd) {
+  const resolution = describeGitResolution();
+  const lines = [
+    `git executable is not available: spawning "${resolution.resolvedPath ?? "git"}" failed, and the working directory ${cwd} exists and is a directory.`
+  ];
+  if (resolution.attempts.length > 0) {
+    lines.push("Candidates tried:");
+    const shown = resolution.attempts.slice(0, MAX_RENDERED_GIT_CANDIDATES);
+    for (const attempt of shown) {
+      lines.push(`  - [${attempt.source}] ${attempt.candidate}: ${attempt.accepted ? "accepted" : attempt.reason ?? "rejected"}`);
+    }
+    const omitted = resolution.attempts.length - shown.length;
+    if (omitted > 0)
+      lines.push(`  ... and ${omitted} more`);
+  } else {
+    lines.push("No candidate probe results are recorded for this process (the resolver was pre-seeded or has not probed yet).");
+  }
+  lines.push(resolution.overrideValue ? `The configured override (${resolution.overrideSource ?? "unknown"}) "${resolution.overrideValue}" did not work \u2014 point the ${GIT_BINARY_ENV_VAR} environment variable, or the "git.binary" value in your USER config (a project .opencode config is ignored for this key), at a working git executable.` : `No override is configured. Set the ${GIT_BINARY_ENV_VAR} environment variable, or the "git.binary" value in your USER config (a project .opencode config is ignored for this key), to point at a working git executable.`);
+  return lines.join(`
+`);
+}
 function gitExec(args, cwd, laneEnv, laneIndex) {
   const resolvedLaneEnv = laneEnv ?? (laneIndex !== undefined ? readLaneEnvFileFromDiskSync(cwd, laneIndex) : undefined);
-  let missingGitError;
   const subcommand = args[0];
   const hardenedArgs = subcommand === "commit" || subcommand === "tag" ? ["-c", "commit.gpgsign=false", "-c", "tag.gpgsign=false", ...args] : args;
-  for (const command of windowsGitCandidates()) {
-    for (let attempt = 0;attempt < MAX_TRANSIENT_RETRIES; attempt++) {
-      const result = _internals5.spawnSync(command, hardenedArgs, {
-        cwd,
-        encoding: "utf-8",
-        timeout: GIT_TIMEOUT_MS,
-        windowsHide: true,
-        maxBuffer: GIT_MAX_BUFFER_BYTES,
-        stdio: ["ignore", "pipe", "pipe"],
-        env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
-        envOverrides: resolvedLaneEnv
-      });
-      if (!result.error && result.status === 0) {
-        return result.stdout;
+  const command = _internals.resolveGitExecutable();
+  for (let attempt = 0;attempt < MAX_TRANSIENT_RETRIES; attempt++) {
+    const result = _internals.spawnSync(command, hardenedArgs, {
+      cwd,
+      encoding: "utf-8",
+      timeout: GIT_TIMEOUT_MS,
+      windowsHide: true,
+      maxBuffer: GIT_MAX_BUFFER_BYTES,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+      envOverrides: resolvedLaneEnv
+    });
+    if (!result.error && result.status === 0) {
+      return result.stdout;
+    }
+    if (result.error) {
+      if (isSpawnCwdMissing(result.error, cwd)) {
+        throw new GitSpawnCwdError(cwd, "missing", { cause: result.error });
       }
-      if (result.error) {
-        if (isGitBinaryMissing(result.error)) {
-          missingGitError ??= result.error;
-          break;
-        }
-        if (isTransientSpawnError(result.error) && attempt < MAX_TRANSIENT_RETRIES - 1) {
-          transientBackoff(attempt);
-          continue;
-        }
-        throw new Error(errorMessage(result.error));
+      if (isSpawnCwdUnreadable(result.error, cwd)) {
+        throw new GitSpawnCwdError(cwd, "unreadable", {
+          cause: result.error
+        });
       }
-      if (result.status !== 0) {
-        throw new Error(result.stderr || result.stdout || `git exited with ${result.status}`);
+      if (isGitBinaryMissing(result.error, cwd)) {
+        throw new GitBinaryMissingError(gitBinaryMissingMessage(cwd), {
+          cause: result.error
+        });
+      }
+      if (isTransientSpawnError(result.error) && attempt < MAX_TRANSIENT_RETRIES - 1) {
+        transientBackoff(attempt);
+        continue;
       }
+      throw new Error(errorMessage(result.error));
+    }
+    if (result.status !== 0) {
+      throw new Error(result.stderr || result.stdout || `git exited with ${result.status}`);
     }
   }
-  throw new GitBinaryMissingError(process.platform === "win32" ? "git executable is not available on PATH or common Windows install locations" : "git executable is not available on PATH", { cause: missingGitError });
+  throw new GitBinaryMissingError(process.platform === "win32" ? "git executable is not available on PATH or common Windows install locations" : "git executable is not available on PATH");
 }
 function getGitRepositoryStatus(cwd) {
   try {
@@ -1544,7 +662,7 @@ async function resetToRemoteBranch(cwd, options) {
   const prunedBranches = [];
   try {
     const currentBranch = getCurrentBranch(cwd);
-    const defaultRemoteBranch = _internals5.detectDefaultRemoteBranch(cwd);
+    const defaultRemoteBranch = _internals.detectDefaultRemoteBranch(cwd);
     if (!defaultRemoteBranch) {
       return {
         success: false,
@@ -1726,7 +844,7 @@ var GITIGNORED_BUILD_ARTIFACTS = ["dist"];
 async function resetToMainAfterMerge(cwd, options) {
   const warnings = [];
   try {
-    const defaultBranch = _internals5.detectDefaultRemoteBranch(cwd);
+    const defaultBranch = _internals.detectDefaultRemoteBranch(cwd);
     if (!defaultBranch) {
       return {
         success: false,
@@ -1753,7 +871,7 @@ async function resetToMainAfterMerge(cwd, options) {
     }
     if (currentBranch === defaultBranch) {
       try {
-        const logOutput = _internals5.gitExec(["log", `${targetBranch}..HEAD`, "--oneline"], cwd);
+        const logOutput = _internals.gitExec(["log", `${targetBranch}..HEAD`, "--oneline"], cwd);
         if (logOutput.trim().length > 0) {
           return {
             success: false,
@@ -1768,11 +886,11 @@ async function resetToMainAfterMerge(cwd, options) {
       } catch {}
     } else {
       try {
-        _internals5.gitExec(["rev-parse", "--abbrev-ref", `${currentBranch}@{upstream}`], cwd);
+        _internals.gitExec(["rev-parse", "--abbrev-ref", `${currentBranch}@{upstream}`], cwd);
       } catch {
         try {
-          const localSha = _internals5.gitExec(["rev-parse", "HEAD"], cwd).trim();
-          const remoteSha = _internals5.gitExec(["rev-parse", targetBranch], cwd).trim();
+          const localSha = _internals.gitExec(["rev-parse", "HEAD"], cwd).trim();
+          const remoteSha = _internals.gitExec(["rev-parse", targetBranch], cwd).trim();
           if (localSha !== remoteSha) {
             return {
               success: false,
@@ -1798,7 +916,7 @@ async function resetToMainAfterMerge(cwd, options) {
       }
     }
     try {
-      _internals5.gitExec(["fetch", "--prune", "origin"], cwd);
+      _internals.gitExec(["fetch", "--prune", "origin"], cwd);
     } catch (err) {
       return {
         success: false,
@@ -1814,7 +932,7 @@ async function resetToMainAfterMerge(cwd, options) {
     let switchedBranch = false;
     if (currentBranch !== defaultBranch) {
       try {
-        _internals5.gitExec(["checkout", defaultBranch], cwd);
+        _internals.gitExec(["checkout", defaultBranch], cwd);
         switchedBranch = true;
       } catch (err) {
         return {
@@ -1829,7 +947,7 @@ async function resetToMainAfterMerge(cwd, options) {
       }
     }
     try {
-      _internals5.gitExec(["reset", "--hard", targetBranch], cwd);
+      _internals.gitExec(["reset", "--hard", targetBranch], cwd);
     } catch (err) {
       return {
         success: false,
@@ -1849,7 +967,7 @@ async function resetToMainAfterMerge(cwd, options) {
           await new Promise((resolve2) => setTimeout(resolve2, 500));
         }
         try {
-          _internals5.gitExec(["checkout", "--", "."], cwd);
+          _internals.gitExec(["checkout", "--", "."], cwd);
           discardSucceeded = true;
           break;
         } catch {}
@@ -1860,18 +978,18 @@ async function resetToMainAfterMerge(cwd, options) {
       changesDiscarded = discardSucceeded;
     }
     try {
-      _internals5.gitExec(["clean", "-fdX", "--", ...GITIGNORED_BUILD_ARTIFACTS], cwd);
+      _internals.gitExec(["clean", "-fdX", "--", ...GITIGNORED_BUILD_ARTIFACTS], cwd);
     } catch {
       warnings.push("Could not clean build artifacts");
     }
     let branchDeleted = false;
     if (switchedBranch && previousBranch !== defaultBranch) {
       try {
-        const mergedOutput = _internals5.gitExec(["branch", "--merged", defaultBranch], cwd);
+        const mergedOutput = _internals.gitExec(["branch", "--merged", defaultBranch], cwd);
         const isMerged = mergedOutput.split(`
 `).some((line) => line.trim() === previousBranch || line.trim() === `* ${previousBranch}`);
         if (isMerged) {
-          _internals5.gitExec(["branch", "-d", previousBranch], cwd);
+          _internals.gitExec(["branch", "-d", previousBranch], cwd);
           branchDeleted = true;
         } else {
           warnings.push(`Branch ${previousBranch} is not merged into ${defaultBranch} \u2014 keeping it`);
@@ -1882,7 +1000,7 @@ async function resetToMainAfterMerge(cwd, options) {
     }
     if (options?.pruneBranches) {
       try {
-        const mergedOutput = _internals5.gitExec(["branch", "--merged", defaultBranch], cwd);
+        const mergedOutput = _internals.gitExec(["branch", "--merged", defaultBranch], cwd);
         const mergedLines = mergedOutput.split(`
 `);
         for (const line of mergedLines) {
@@ -1891,7 +1009,7 @@ async function resetToMainAfterMerge(cwd, options) {
             continue;
           }
           try {
-            _internals5.gitExec(["branch", "-d", trimmedLine], cwd);
+            _internals.gitExec(["branch", "-d", trimmedLine], cwd);
           } catch {
             warnings.push(`Could not prune branch: ${trimmedLine}`);
           }
@@ -1921,7 +1039,7 @@ async function resetToMainAfterMerge(cwd, options) {
     };
   }
 }
-var _internals5 = {
+var _internals = {
   gitExec,
   detectDefaultRemoteBranch,
   getDefaultBaseBranch,
@@ -1929,12 +1047,13 @@ var _internals5 = {
   resetToRemoteBranch,
   resetToMainAfterMerge,
   spawnSync: __spawnSyncSeam.spawnSync,
-  readLaneEnvFileFromDiskSync
+  readLaneEnvFileFromDiskSync,
+  resolveGitExecutable
 };
 
 // src/services/run-memory.ts
-import * as crypto2 from "crypto";
-import * as fs3 from "fs/promises";
+import * as crypto from "crypto";
+import * as fs2 from "fs/promises";
 
 // src/hooks/context-sanitizer.ts
 function sanitizeContextText(text) {
@@ -1948,8 +1067,8 @@ function sanitizeContextText(text) {
 init_logger();
 
 // src/utils/path-security.ts
-import * as fs2 from "fs";
-import * as path5 from "path";
+import * as fs from "fs";
+import * as path2 from "path";
 function containsPathTraversal(str) {
   if (/\.\.[/\\]/.test(str))
     return true;
@@ -2019,7 +1138,7 @@ function validateProjectDirectory(directory) {
   if (containsControlChars(directory)) {
     throw new Error("Invalid project directory: control characters detected");
   }
-  if (!path5.isAbsolute(directory) && !/^[A-Za-z]:[/\\]/.test(directory)) {
+  if (!path2.isAbsolute(directory) && !/^[A-Za-z]:[/\\]/.test(directory)) {
     throw new Error("Invalid project directory: must be an absolute path");
   }
   assertNotSystemLocation(directory);
@@ -2044,7 +1163,7 @@ var DENIED_ROOT_SUBTREES = new Set([
 ]);
 var DENIED_EXACT_ROOT_CHILDREN = new Set(["users", "home", "root"]);
 function assertNotSystemLocation(directory) {
-  for (const parser of [path5.win32, path5.posix]) {
+  for (const parser of [path2.win32, path2.posix]) {
     if (!parser.isAbsolute(directory))
       continue;
     const normalized = parser.normalize(directory);
@@ -2063,50 +1182,50 @@ function resolveNearestExistingCanonical(inputPath, resolver) {
   try {
     return resolver(inputPath);
   } catch {}
-  const lexicallyResolved = path5.resolve(inputPath);
-  let probe2 = lexicallyResolved;
+  const lexicallyResolved = path2.resolve(inputPath);
+  let probe = lexicallyResolved;
   const tail = [];
   for (let i = 0;i < 4096; i++) {
-    const parent = path5.dirname(probe2);
-    if (parent === probe2) {
+    const parent = path2.dirname(probe);
+    if (parent === probe) {
       return lexicallyResolved;
     }
-    tail.unshift(path5.basename(probe2));
-    probe2 = parent;
+    tail.unshift(path2.basename(probe));
+    probe = parent;
     try {
-      const canonicalAncestor = resolver(probe2);
-      return path5.normalize(path5.join(canonicalAncestor, ...tail));
+      const canonicalAncestor = resolver(probe);
+      return path2.normalize(path2.join(canonicalAncestor, ...tail));
     } catch {}
   }
   return lexicallyResolved;
 }
 function validateSymlinkBoundary(targetPath, rootPath) {
-  const realTarget = resolveNearestExistingCanonical(targetPath, _internals6.realpathSync);
-  const realRoot = resolveNearestExistingCanonical(rootPath, _internals6.realpathSync);
-  const normalizedTarget = path5.normalize(realTarget);
-  const normalizedRoot = path5.normalize(realRoot);
-  if (!normalizedTarget.startsWith(normalizedRoot + path5.sep) && normalizedTarget !== normalizedRoot) {
+  const realTarget = resolveNearestExistingCanonical(targetPath, _internals2.realpathSync);
+  const realRoot = resolveNearestExistingCanonical(rootPath, _internals2.realpathSync);
+  const normalizedTarget = path2.normalize(realTarget);
+  const normalizedRoot = path2.normalize(realRoot);
+  if (!normalizedTarget.startsWith(normalizedRoot + path2.sep) && normalizedTarget !== normalizedRoot) {
     throw new Error(`Symlink resolution escaped boundary: ${realTarget} is not within ${realRoot}`);
   }
 }
 function isCanonicalPathWithinRoot(targetPath, rootPath) {
   let canonicalRoot;
   try {
-    canonicalRoot = fs2.realpathSync(rootPath);
+    canonicalRoot = fs.realpathSync(rootPath);
   } catch {
-    canonicalRoot = path5.normalize(rootPath);
+    canonicalRoot = path2.normalize(rootPath);
   }
-  let probe2 = path5.normalize(targetPath);
+  let probe = path2.normalize(targetPath);
   for (let i = 0;i < 4096; i++) {
     try {
-      const canonicalProbe = fs2.realpathSync(probe2);
-      const relative2 = path5.relative(canonicalRoot, canonicalProbe);
-      return !relative2.startsWith("..") && !path5.isAbsolute(relative2);
+      const canonicalProbe = fs.realpathSync(probe);
+      const relative2 = path2.relative(canonicalRoot, canonicalProbe);
+      return !relative2.startsWith("..") && !path2.isAbsolute(relative2);
     } catch {
-      const parent = path5.dirname(probe2);
-      if (parent === probe2)
+      const parent = path2.dirname(probe);
+      if (parent === probe)
         return false;
-      probe2 = parent;
+      probe = parent;
     }
   }
   return false;
@@ -2115,7 +1234,7 @@ function validateTargetWithinRoot(filePath, root) {
   if (!filePath || filePath.trim() === "") {
     return "Empty path";
   }
-  if (path5.isAbsolute(filePath) || /^[A-Za-z]:[/\\]/.test(filePath)) {
+  if (path2.isAbsolute(filePath) || /^[A-Za-z]:[/\\]/.test(filePath)) {
     return `Absolute path rejected: ${filePath}`;
   }
   if (containsPathTraversal(filePath)) {
@@ -2124,9 +1243,9 @@ function validateTargetWithinRoot(filePath, root) {
   if (containsControlChars(filePath)) {
     return `Control characters detected in path: ${filePath}`;
   }
-  const resolved = path5.resolve(root, filePath);
-  const relative2 = path5.relative(root, resolved);
-  if (relative2.startsWith("..") || path5.isAbsolute(relative2)) {
+  const resolved = path2.resolve(root, filePath);
+  const relative2 = path2.relative(root, resolved);
+  if (relative2.startsWith("..") || path2.isAbsolute(relative2)) {
     return `Path escapes root: ${filePath}`;
   }
   if (!isCanonicalPathWithinRoot(resolved, root)) {
@@ -2134,8 +1253,8 @@ function validateTargetWithinRoot(filePath, root) {
   }
   return null;
 }
-var _internals6 = {
-  realpathSync: fs2.realpathSync,
+var _internals2 = {
+  realpathSync: fs.realpathSync,
   containsPathTraversal,
   containsControlChars,
   validateDirectory,
@@ -2150,7 +1269,7 @@ var RUN_MEMORY_FILENAME = "run-memory.jsonl";
 var MAX_SUMMARY_TOKENS = 500;
 function generateTaskFingerprint(taskId, fileTargets) {
   const sortedFiles = [...fileTargets].sort().join(",");
-  const hash = crypto2.createHash("sha256").update(taskId + sortedFiles).digest("hex");
+  const hash = crypto.createHash("sha256").update(taskId + sortedFiles).digest("hex");
   return hash.slice(0, 8);
 }
 async function recordOutcome(directory, entry) {
@@ -2158,7 +1277,7 @@ async function recordOutcome(directory, entry) {
   const resolvedPath = validateSwarmPath(directory, RUN_MEMORY_FILENAME);
   const line = `${JSON.stringify(entry)}
 `;
-  await fs3.appendFile(resolvedPath, line, { encoding: "utf-8" });
+  await fs2.appendFile(resolvedPath, line, { encoding: "utf-8" });
 }
 async function getTaskHistory(directory, taskId) {
   validateWorkspaceRoot(directory);
@@ -2185,14 +1304,14 @@ async function recordTaskAttempt(directory, input) {
   try {
     let history = [];
     try {
-      history = await _internals7.getTaskHistory(directory, input.taskId);
+      history = await _internals3.getTaskHistory(directory, input.taskId);
     } catch (err) {
       warn(`[run-memory] history read for task ${input.taskId} failed; recording with attemptNumber 1: ${err instanceof Error ? err.message : String(err)}`);
     }
     const entry = {
       timestamp: new Date().toISOString(),
       taskId: input.taskId,
-      taskFingerprint: _internals7.generateTaskFingerprint(input.taskId, input.fileTargets ?? []),
+      taskFingerprint: _internals3.generateTaskFingerprint(input.taskId, input.fileTargets ?? []),
       agent: input.agent,
       outcome: input.outcome,
       attemptNumber: history.length + 1
@@ -2206,7 +1325,7 @@ async function recordTaskAttempt(directory, input) {
     if (typeof input.durationMs === "number") {
       entry.durationMs = input.durationMs;
     }
-    await _internals7.recordOutcome(directory, entry);
+    await _internals3.recordOutcome(directory, entry);
   } catch (err) {
     warn(`[run-memory] failed to record ${input.outcome} for task ${input.taskId}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -2270,10 +1389,10 @@ async function getRunMemorySummary(directory) {
   if (entries.length === 0) {
     return null;
   }
-  const groups = _internals7.groupByTaskId(entries);
+  const groups = _internals3.groupByTaskId(entries);
   const summaries = [];
   for (const [taskId, taskEntries] of groups) {
-    const summary = _internals7.summarizeTask(taskId, taskEntries);
+    const summary = _internals3.summarizeTask(taskId, taskEntries);
     if (summary) {
       summaries.push(summary);
     }
@@ -2306,7 +1425,7 @@ Use this data to avoid repeating known failure patterns.`;
   }
   return prefix + summaryText + suffix;
 }
-var _internals7 = {
+var _internals3 = {
   generateTaskFingerprint,
   recordOutcome,
   recordTaskAttempt,
@@ -2318,16 +1437,16 @@ var _internals7 = {
 
 // src/turbo/epic/state.ts
 init_logger();
-import * as fs4 from "fs";
-import * as path6 from "path";
+import * as fs3 from "fs";
+import * as path3 from "path";
 var STATE_FILE = "epic-state.json";
 function nowISO() {
   return new Date().toISOString();
 }
 function ensureSwarmDir(directory) {
-  const swarmDir = path6.resolve(directory, ".swarm");
-  if (!fs4.existsSync(swarmDir)) {
-    fs4.mkdirSync(swarmDir, { recursive: true });
+  const swarmDir = path3.resolve(directory, ".swarm");
+  if (!fs3.existsSync(swarmDir)) {
+    fs3.mkdirSync(swarmDir, { recursive: true });
   }
   return swarmDir;
 }
@@ -2347,17 +1466,17 @@ function markStateUnreadable(directory, reason) {
 }
 function readPersisted(directory) {
   try {
-    const filePath = path6.join(directory, ".swarm", STATE_FILE);
-    if (!fs4.existsSync(filePath)) {
+    const filePath = path3.join(directory, ".swarm", STATE_FILE);
+    if (!fs3.existsSync(filePath)) {
       const seed = emptyPersisted();
       try {
         ensureSwarmDir(directory);
-        fs4.writeFileSync(filePath, `${JSON.stringify(seed, null, 2)}
+        fs3.writeFileSync(filePath, `${JSON.stringify(seed, null, 2)}
 `, "utf-8");
       } catch {}
       return seed;
     }
-    const raw = fs4.readFileSync(filePath, "utf-8");
+    const raw = fs3.readFileSync(filePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || parsed.version !== 1 || !parsed.sessions || typeof parsed.sessions !== "object" || Array.isArray(parsed.sessions)) {
       markStateUnreadable(directory, `malformed shape (version=${parsed?.version}, sessions type=${Array.isArray(parsed?.sessions) ? "array" : typeof parsed?.sessions})`);
@@ -2383,7 +1502,7 @@ function writePersisted(directory, persisted) {
   let payload;
   try {
     ensureSwarmDir(directory);
-    filePath = path6.join(directory, ".swarm", STATE_FILE);
+    filePath = path3.join(directory, ".swarm", STATE_FILE);
     tmpPath = `${filePath}.tmp.${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     persisted.updatedAt = nowISO();
     payload = `${JSON.stringify(persisted, null, 2)}
@@ -2394,14 +1513,14 @@ function writePersisted(directory, persisted) {
     throw new Error(`Epic state persistence prepare failed: ${msg}`);
   }
   try {
-    fs4.writeFileSync(tmpPath, payload, "utf-8");
-    fs4.renameSync(tmpPath, filePath);
+    fs3.writeFileSync(tmpPath, payload, "utf-8");
+    fs3.renameSync(tmpPath, filePath);
   } catch (error2) {
     const msg = error2 instanceof Error ? error2.message : String(error2);
     error(`[turbo/epic/state] Failed to persist ${STATE_FILE} atomically: ${msg}`);
     try {
-      if (fs4.existsSync(tmpPath))
-        fs4.unlinkSync(tmpPath);
+      if (fs3.existsSync(tmpPath))
+        fs3.unlinkSync(tmpPath);
     } catch {}
     throw new Error(`Epic state persistence failed: ${msg}`);
   }
@@ -2432,7 +1551,7 @@ function isEpicModeActive(directory, sessionID) {
 function isEpicModeActiveForProject(directory) {
   if (stateUnreadableMap.get(directory))
     return false;
-  if (!fs4.existsSync(path6.join(directory, ".swarm", STATE_FILE))) {
+  if (!fs3.existsSync(path3.join(directory, ".swarm", STATE_FILE))) {
     return false;
   }
   const persisted = readPersisted(directory);
@@ -2483,11 +1602,11 @@ function isLockContentionError(err) {
   return INDEX_LOCK_ERROR_RE.test(msg);
 }
 async function commitTaskCompletion(directory, taskId, description, scopePaths) {
-  if (!_internals8.isGitRepo(directory)) {
+  if (!_internals4.isGitRepo(directory)) {
     return { committed: false, reason: "no-git" };
   }
   try {
-    if (_internals8.hasExistingTaskCommit(directory, taskId)) {
+    if (_internals4.hasExistingTaskCommit(directory, taskId)) {
       return { committed: true, reason: "idempotent-skip" };
     }
   } catch {}
@@ -2508,15 +1627,15 @@ async function commitTaskCompletion(directory, taskId, description, scopePaths)
   for (let attempt = 0;attempt <= INDEX_LOCK_BACKOFF_MS.length; attempt++) {
     try {
       if (paths.length > 0) {
-        _internals8.stageScopedPaths(directory, paths);
+        _internals4.stageScopedPaths(directory, paths);
       }
-      _internals8.commitAllowEmpty(directory, message);
-      const sha = _internals8.gitHeadSha(directory);
+      _internals4.commitAllowEmpty(directory, message);
+      const sha = _internals4.gitHeadSha(directory);
       return { committed: true, reason: "success", sha };
     } catch (err) {
       lastError = err;
       if (attempt < INDEX_LOCK_BACKOFF_MS.length && isLockContentionError(err)) {
-        await _internals8.sleep(INDEX_LOCK_BACKOFF_MS[attempt]);
+        await _internals4.sleep(INDEX_LOCK_BACKOFF_MS[attempt]);
         continue;
       }
       break;
@@ -2526,26 +1645,26 @@ async function commitTaskCompletion(directory, taskId, description, scopePaths)
   criticalWarn(`[epic:task-commit] commit for task ${taskId} failed (non-fatal): ${msg}`);
   return { committed: false, reason: "commit-failed", error: msg };
 }
-var _internals8 = {
+var _internals4 = {
   isGitRepo: (cwd) => isGitRepo(cwd),
   stageScopedPaths: (cwd, paths) => {
     const CHUNK = 200;
     for (let i = 0;i < paths.length; i += CHUNK) {
       const chunk = paths.slice(i, i + CHUNK);
-      _internals5.gitExec(["add", "--", ...chunk, ":(exclude,glob)**/.swarm/**"], cwd);
+      _internals.gitExec(["add", "--", ...chunk, ":(exclude,glob)**/.swarm/**"], cwd);
     }
   },
   commitAllowEmpty: (cwd, message) => {
-    _internals5.gitExec(["commit", "--allow-empty", "--no-verify", "-m", message], cwd);
+    _internals.gitExec(["commit", "--allow-empty", "--no-verify", "-m", message], cwd);
   },
   gitHeadSha: (cwd) => {
-    return _internals5.gitExec(["rev-parse", "HEAD"], cwd).trim();
+    return _internals.gitExec(["rev-parse", "HEAD"], cwd).trim();
   },
   sleep: (ms) => new Promise((resolve4) => setTimeout(resolve4, ms)),
   hasExistingTaskCommit: (cwd, taskId) => {
     const safeId = scrubTaskIdForGitSubject(taskId);
     const escaped = safeId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const output = _internals5.gitExec([
+    const output = _internals.gitExec([
       "log",
       "--extended-regexp",
       `--grep=^swarm\\(task ${escaped}\\):`,
@@ -2558,8 +1677,8 @@ var _internals8 = {
 };
 
 // src/turbo/lean/conflicts.ts
-import * as fs5 from "fs";
-import * as path7 from "path";
+import * as fs4 from "fs";
+import * as path4 from "path";
 
 // src/utils/path.ts
 function normalizePath(p) {
@@ -2687,12 +1806,12 @@ function isProtectedPath(normalizedPath) {
   return false;
 }
 function readTaskScopes(directory, taskId) {
-  const scopePath = path7.join(directory, ".swarm", "scopes", `scope-${taskId}.json`);
+  const scopePath = path4.join(directory, ".swarm", "scopes", `scope-${taskId}.json`);
   try {
-    if (!fs5.existsSync(scopePath)) {
+    if (!fs4.existsSync(scopePath)) {
       return null;
     }
-    const raw = fs5.readFileSync(scopePath, "utf-8");
+    const raw = fs4.readFileSync(scopePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || !Array.isArray(parsed.files)) {
       return null;
@@ -2706,15 +1825,15 @@ function readTaskScopes(directory, taskId) {
 // src/utils/spec-hash.ts
 import { createHash as createHash3 } from "crypto";
 import * as fsSync2 from "fs";
-import { join as join7 } from "path";
+import { join as join5 } from "path";
 async function computeSpecHash(directory) {
-  const spec = _internals9.readEffectiveSpecSync(directory);
+  const spec = _internals5.readEffectiveSpecSync(directory);
   if (!spec)
     return null;
   return createHash3("sha256").update(spec.content, "utf-8").digest("hex");
 }
 async function isSpecStale(directory, plan) {
-  const currentHash = await _internals9.computeSpecHash(directory);
+  const currentHash = await _internals5.computeSpecHash(directory);
   if (!plan.specHash) {
     return { stale: false };
   }
@@ -2735,7 +1854,7 @@ async function isSpecStale(directory, plan) {
   return { stale: false };
 }
 function isObligationPreserving(directory) {
-  const snapshotPath = join7(directory, ".swarm", "spec-snapshot.md");
+  const snapshotPath = join5(directory, ".swarm", "spec-snapshot.md");
   try {
     let recordedContent;
     try {
@@ -2743,7 +1862,7 @@ function isObligationPreserving(directory) {
     } catch {
       return false;
     }
-    const currentResult = _internals9.readEffectiveSpecSync(directory);
+    const currentResult = _internals5.readEffectiveSpecSync(directory);
     if (!currentResult || !currentResult.content) {
       return false;
     }
@@ -2773,7 +1892,7 @@ function isObligationPreserving(directory) {
     return false;
   }
 }
-var _internals9 = {
+var _internals5 = {
   computeSpecDiff,
   computeSpecHash,
   isObligationPreserving,
@@ -2781,7 +1900,7 @@ var _internals9 = {
   readEffectiveSpecSync
 };
 function computeSpecDiff(directory) {
-  const snapshotPath = join7(directory, ".swarm", "spec-snapshot.md");
+  const snapshotPath = join5(directory, ".swarm", "spec-snapshot.md");
   let recordedContent;
   try {
     const snapshotSize = fsSync2.statSync(snapshotPath).size;
@@ -2793,7 +1912,7 @@ function computeSpecDiff(directory) {
   } catch {
     return null;
   }
-  const spec = _internals9.readEffectiveSpecSync(directory);
+  const spec = _internals5.readEffectiveSpecSync(directory);
   if (!spec) {
     return null;
   }
@@ -2887,7 +2006,7 @@ var startupLedgerCheckedWorkspaces = new Set;
 var ledgerStaleWorkspaces = new Set;
 var recoveryMutexes = new Map;
 var PLAN_JSON_CACHE_NAMESPACE = "plan-json:validated:v1";
-var _internals10 = {
+var _internals6 = {
   loadPlan,
   loadPlanJsonOnly,
   regeneratePlanMarkdown,
@@ -3028,7 +2147,7 @@ async function getLatestLedgerHash(directory) {
   }
 }
 async function surfaceLedgerStaleIfPersisted(directory, plan) {
-  const resolvedWorkspace = path8.resolve(directory);
+  const resolvedWorkspace = path5.resolve(directory);
   if (!ledgerStaleWorkspaces.has(resolvedWorkspace)) {
     return plan;
   }
@@ -3047,7 +2166,7 @@ async function surfaceLedgerStaleIfPersisted(directory, plan) {
   return plan;
 }
 async function parsePlanJsonCached(directory) {
-  const planJsonPath = path8.resolve(directory, ".swarm", "plan.json");
+  const planJsonPath = path5.resolve(directory, ".swarm", "plan.json");
   return readCachedParsedFile(planJsonPath, PLAN_JSON_CACHE_NAMESPACE, () => readSwarmFileAsync(directory, "plan.json"), (planJsonContent) => {
     if (planJsonContent.includes("\x00") || planJsonContent.includes("\uFFFD")) {
       throw new Error("Plan rejected: .swarm/plan.json contains null bytes or invalid encoding");
@@ -3109,13 +2228,13 @@ async function isPlanMdInSync(directory, plan, cache) {
 }
 async function regeneratePlanMarkdown(directory, plan) {
   assertProjectRoot(directory);
-  const swarmDir = path8.resolve(directory, ".swarm");
+  const swarmDir = path5.resolve(directory, ".swarm");
   const contentHash = computePlanContentHash(plan);
   const markdown = derivePlanMarkdown(plan);
   const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-  const mdPath = path8.join(swarmDir, "plan.md");
-  const mdTempPath = path8.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const mdPath = path5.join(swarmDir, "plan.md");
+  const mdTempPath = path5.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   try {
     await bunWrite(mdTempPath, markdownWithHash);
     renameSync2(mdTempPath, mdPath);
@@ -3140,7 +2259,7 @@ async function loadPlan(directory, cache) {
           const inSync = await isPlanMdInSync(directory, validated, cache);
           if (!inSync) {
             try {
-              await _internals10.regeneratePlanMarkdown(directory, validated);
+              await _internals6.regeneratePlanMarkdown(directory, validated);
             } catch (regenError) {
               warn(`Failed to regenerate plan.md: ${regenError instanceof Error ? regenError.message : String(regenError)}. Proceeding with plan.json only.`);
             }
@@ -3148,7 +2267,7 @@ async function loadPlan(directory, cache) {
           if (await ledgerExists(directory)) {
             const planHash = computePlanHash(validated);
             const ledgerHash = await getLatestLedgerHash(directory);
-            const resolvedWorkspace = path8.resolve(directory);
+            const resolvedWorkspace = path5.resolve(directory);
             if (!startupLedgerCheckedWorkspaces.has(resolvedWorkspace)) {
               startupLedgerCheckedWorkspaces.add(resolvedWorkspace);
               if (ledgerHash !== "" && planHash !== ledgerHash) {
@@ -3223,7 +2342,7 @@ async function loadPlan(directory, cache) {
                 try {
                   assertProjectRoot(directory);
                   const diffInfo = computeSpecDiff(directory);
-                  const specStalenessPath = path8.join(directory, ".swarm", "spec-staleness.json");
+                  const specStalenessPath = path5.join(directory, ".swarm", "spec-staleness.json");
                   await fsPromises.writeFile(specStalenessPath, JSON.stringify({
                     type: "spec_stale_detected",
                     timestamp: new Date().toISOString(),
@@ -3239,7 +2358,7 @@ async function loadPlan(directory, cache) {
                 } catch {}
                 try {
                   assertProjectRoot(directory);
-                  const eventsPath = path8.join(directory, ".swarm", "events.jsonl");
+                  const eventsPath = path5.join(directory, ".swarm", "events.jsonl");
                   const event = {
                     type: "spec_stale_detected",
                     timestamp: new Date().toISOString(),
@@ -3305,11 +2424,11 @@ async function loadPlan(directory, cache) {
     return migrated;
   }
   if (await ledgerExists(directory)) {
-    const resolvedDir = path8.resolve(directory);
+    const resolvedDir = path5.resolve(directory);
     const existingMutex = recoveryMutexes.get(resolvedDir);
     if (existingMutex) {
       await existingMutex;
-      const postRecoveryPlan = await _internals10.loadPlanJsonOnly(directory);
+      const postRecoveryPlan = await _internals6.loadPlanJsonOnly(directory);
       if (postRecoveryPlan)
         return postRecoveryPlan;
     }
@@ -3369,7 +2488,7 @@ async function loadPlan(directory, cache) {
   return null;
 }
 async function savePlanWithAutoAcknowledgedRemovals(directory, plan, source, reason, options) {
-  const existing = await _internals10.loadPlanJsonOnly(directory);
+  const existing = await _internals6.loadPlanJsonOnly(directory);
   const newIds = new Set;
   for (const phase of plan.phases) {
     for (const task of phase.tasks)
@@ -3419,7 +2538,7 @@ async function savePlan(directory, plan, options) {
   }
   if (options?.preserveCompletedStatuses !== false) {
     try {
-      const currentPlan2 = await _internals10.loadPlanJsonOnly(directory);
+      const currentPlan2 = await _internals6.loadPlanJsonOnly(directory);
       if (currentPlan2) {
         const completedTaskIds = new Set;
         for (const phase of currentPlan2.phases) {
@@ -3441,7 +2560,7 @@ async function savePlan(directory, plan, options) {
     } catch {}
   }
   derivePhaseStatusesInPlace(validated);
-  const currentPlan = await _internals10.loadPlanJsonOnly(directory);
+  const currentPlan = await _internals6.loadPlanJsonOnly(directory);
   const planId = derivePlanId(validated);
   const planHashForInit = computePlanHash(validated);
   if (!await ledgerExists(directory)) {
@@ -3456,9 +2575,9 @@ async function savePlan(directory, plan, options) {
   } else {
     const existingEvents = await readLedgerEvents(directory);
     if (existingEvents.length > 0 && existingEvents[0].plan_id !== planId) {
-      const swarmDir2 = path8.resolve(directory, ".swarm");
-      const oldLedgerPath = path8.join(swarmDir2, "plan-ledger.jsonl");
-      const oldLedgerBackupPath = path8.join(swarmDir2, `plan-ledger.backup-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
+      const swarmDir2 = path5.resolve(directory, ".swarm");
+      const oldLedgerPath = path5.join(swarmDir2, "plan-ledger.jsonl");
+      const oldLedgerBackupPath = path5.join(swarmDir2, `plan-ledger.backup-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
       let backupExists = false;
       if (existsSync4(oldLedgerPath)) {
         try {
@@ -3496,7 +2615,7 @@ async function savePlan(directory, plan, options) {
         }
       }
       if (initSucceeded && backupExists) {
-        const archivePath = path8.join(swarmDir2, `plan-ledger.archived-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
+        const archivePath = path5.join(swarmDir2, `plan-ledger.archived-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
         try {
           renameSync2(oldLedgerBackupPath, archivePath);
           warn(`[savePlan] Ledger identity mismatch (was "${existingEvents[0].plan_id}", now "${planId}") \u2014 archived old ledger to ${archivePath} and reinitializing.`);
@@ -3521,7 +2640,7 @@ async function savePlan(directory, plan, options) {
           const toRemove = archivedSiblings.slice(0, archivedSiblings.length - MAX_ARCHIVED_SIBLINGS);
           for (const file of toRemove) {
             try {
-              unlinkSync2(path8.join(swarmDir2, file));
+              unlinkSync2(path5.join(swarmDir2, file));
             } catch {}
           }
         }
@@ -3623,7 +2742,7 @@ async function savePlan(directory, plan, options) {
             expectedHash: currentHash,
             planHashAfter: hashAfter,
             verifyValid: async () => {
-              const onDisk = await _internals10.loadPlanJsonOnly(directory);
+              const onDisk = await _internals6.loadPlanJsonOnly(directory);
               if (!onDisk)
                 return true;
               for (const p of onDisk.phases) {
@@ -3661,7 +2780,7 @@ async function savePlan(directory, plan, options) {
               expectedHash: currentHash,
               planHashAfter: hashAfter,
               verifyValid: async () => {
-                const onDisk = await _internals10.loadPlanJsonOnly(directory);
+                const onDisk = await _internals6.loadPlanJsonOnly(directory);
                 if (!onDisk)
                   return true;
                 for (const p of onDisk.phases) {
@@ -3701,9 +2820,9 @@ async function savePlan(directory, plan, options) {
       source: "savePlan_manager"
     });
   }
-  const swarmDir = path8.resolve(directory, ".swarm");
-  const planPath = path8.join(swarmDir, "plan.json");
-  const tempPath = path8.join(swarmDir, `plan.json.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const swarmDir = path5.resolve(directory, ".swarm");
+  const planPath = path5.join(swarmDir, "plan.json");
+  const tempPath = path5.join(swarmDir, `plan.json.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   try {
     await bunWrite(tempPath, JSON.stringify(projectedPlan, null, 2));
     renameSync2(tempPath, planPath);
@@ -3714,7 +2833,7 @@ async function savePlan(directory, plan, options) {
   }
   invalidateCachedArtifact(planPath);
   try {
-    const markerPath = path8.join(swarmDir, ".plan-write-marker");
+    const markerPath = path5.join(swarmDir, ".plan-write-marker");
     const inProgressMarker = JSON.stringify({
       source: "plan_manager",
       timestamp: new Date().toISOString(),
@@ -3729,8 +2848,8 @@ async function savePlan(directory, plan, options) {
     const markdown = derivePlanMarkdown(projectedPlan);
     const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-    const mdPath = path8.join(swarmDir, "plan.md");
-    const mdTempPath = path8.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+    const mdPath = path5.join(swarmDir, "plan.md");
+    const mdTempPath = path5.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
     try {
       await bunWrite(mdTempPath, markdownWithHash);
       renameSync2(mdTempPath, mdPath);
@@ -3752,7 +2871,7 @@ ${markdown}`;
     } catch {}
   }
   try {
-    const markerPath = path8.join(swarmDir, ".plan-write-marker");
+    const markerPath = path5.join(swarmDir, ".plan-write-marker");
     const tasksCount = projectedPlan.phases.reduce((sum, phase) => sum + phase.tasks.length, 0);
     const marker = JSON.stringify({
       source: "plan_manager",
@@ -3800,15 +2919,15 @@ async function rebuildPlan(directory, plan, options) {
   const targetPlan = plan ?? await replayFromLedger(directory);
   if (!targetPlan)
     return null;
-  const swarmDir = path8.join(directory, ".swarm");
-  const planPath = path8.join(swarmDir, "plan.json");
-  const mdPath = path8.join(swarmDir, "plan.md");
-  mkdirSync4(swarmDir, { recursive: true });
-  const tempPlanPath = path8.join(swarmDir, `plan.json.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const swarmDir = path5.join(directory, ".swarm");
+  const planPath = path5.join(swarmDir, "plan.json");
+  const mdPath = path5.join(swarmDir, "plan.md");
+  mkdirSync3(swarmDir, { recursive: true });
+  const tempPlanPath = path5.join(swarmDir, `plan.json.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   {
     const fd = openSync(tempPlanPath, "w");
     try {
-      writeFileSync4(fd, JSON.stringify(targetPlan, null, 2), "utf8");
+      writeFileSync2(fd, JSON.stringify(targetPlan, null, 2), "utf8");
       fsyncSync(fd);
     } finally {
       closeSync(fd);
@@ -3817,7 +2936,7 @@ async function rebuildPlan(directory, plan, options) {
   renameSync2(tempPlanPath, planPath);
   invalidateCachedArtifact(planPath);
   try {
-    const markerPath = path8.join(swarmDir, ".plan-write-marker");
+    const markerPath = path5.join(swarmDir, ".plan-write-marker");
     const inProgressMarker = JSON.stringify({
       source: "plan_manager",
       timestamp: new Date().toISOString(),
@@ -3832,13 +2951,13 @@ async function rebuildPlan(directory, plan, options) {
     const markdown = derivePlanMarkdown(targetPlan);
     const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-    const tempMdPath = path8.join(swarmDir, `plan.md.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+    const tempMdPath = path5.join(swarmDir, `plan.md.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
     await bunWrite(tempMdPath, markdownWithHash);
     renameSync2(tempMdPath, mdPath);
     invalidateCachedArtifact(mdPath);
   } finally {
     try {
-      const markerPath = path8.join(swarmDir, ".plan-write-marker");
+      const markerPath = path5.join(swarmDir, ".plan-write-marker");
       const tasksCount = targetPlan.phases.reduce((sum, phase) => sum + phase.tasks.length, 0);
       const marker = JSON.stringify({
         source: "plan_manager",
@@ -3902,14 +3021,14 @@ async function closePlanTerminalState(directory, plan, options) {
     planHashAfter: hashAfter,
     source: "close_terminal"
   });
-  const swarmDir = path8.join(directory, ".swarm");
-  const planPath = path8.join(swarmDir, "plan.json");
-  const tempPlanPath = path8.join(swarmDir, `plan.json.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const swarmDir = path5.join(directory, ".swarm");
+  const planPath = path5.join(swarmDir, "plan.json");
+  const tempPlanPath = path5.join(swarmDir, `plan.json.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   await bunWrite(tempPlanPath, JSON.stringify(validated, null, 2));
   renameSync2(tempPlanPath, planPath);
   invalidateCachedArtifact(planPath);
   try {
-    const markerPath = path8.join(swarmDir, ".plan-write-marker");
+    const markerPath = path5.join(swarmDir, ".plan-write-marker");
     const inProgressMarker = JSON.stringify({
       source: "plan_manager_close",
       timestamp: new Date().toISOString(),
@@ -3920,18 +3039,18 @@ async function closePlanTerminalState(directory, plan, options) {
     await bunWrite(markerPath, inProgressMarker);
   } catch {}
   try {
-    const mdPath = path8.join(swarmDir, "plan.md");
+    const mdPath = path5.join(swarmDir, "plan.md");
     const contentHash = computePlanContentHash(validated);
     const markdown = derivePlanMarkdown(validated);
     const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-    const mdTempPath = path8.join(swarmDir, `plan.md.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+    const mdTempPath = path5.join(swarmDir, `plan.md.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
     await bunWrite(mdTempPath, markdownWithHash);
     renameSync2(mdTempPath, mdPath);
     invalidateCachedArtifact(mdPath);
   } finally {
     try {
-      const markerPath = path8.join(swarmDir, ".plan-write-marker");
+      const markerPath = path5.join(swarmDir, ".plan-write-marker");
       const tasksCount = validated.phases.reduce((sum, phase) => sum + phase.tasks.length, 0);
       const marker = JSON.stringify({
         source: "plan_manager_close",
@@ -3959,7 +3078,7 @@ async function updateTaskStatus(directory, taskId, status, options) {
     return "pending";
   };
   {
-    const currentPlan = await _internals10.loadPlanJsonOnly(directory);
+    const currentPlan = await _internals6.loadPlanJsonOnly(directory);
     if (currentPlan) {
       const currentTask = currentPlan.phases.flatMap((p) => p.tasks).find((t) => t.id === taskId);
       const settled = currentTask && currentTask.status !== "pending" && currentTask.status !== "in_progress";
@@ -3972,7 +3091,7 @@ async function updateTaskStatus(directory, taskId, status, options) {
   }
   const MAX_OUTER_RETRIES = 1;
   for (let attempt = 0;attempt <= MAX_OUTER_RETRIES; attempt++) {
-    const plan = await _internals10.loadPlan(directory);
+    const plan = await _internals6.loadPlan(directory);
     if (plan === null) {
       throw new Error(`Plan not found in directory: ${directory}`);
     }
@@ -4003,7 +3122,7 @@ async function updateTaskStatus(directory, taskId, status, options) {
       if (status === "completed" || status === "blocked") {
         const recordedTask = updatedPlan.phases.flatMap((phase) => phase.tasks).find((candidate) => candidate.id === taskId);
         try {
-          await _internals10.recordTaskAttempt(directory, {
+          await _internals6.recordTaskAttempt(directory, {
             taskId,
             agent: "plan-status",
             outcome: status === "completed" ? "pass" : "fail",
@@ -4014,8 +3133,8 @@ async function updateTaskStatus(directory, taskId, status, options) {
           warn(`[plan/manager] run-memory record for ${taskId} failed: ${err instanceof Error ? err.message : String(err)}`);
         }
       }
-      if (status === "completed" && _internals10.isGitRepo(directory) && _internals10.isEpicModeActiveForProject(directory)) {
-        const mergeFailure = _internals10.getWorktreeMergeFailure(taskId);
+      if (status === "completed" && _internals6.isGitRepo(directory) && _internals6.isEpicModeActiveForProject(directory)) {
+        const mergeFailure = _internals6.getWorktreeMergeFailure(taskId);
         if (mergeFailure) {
           criticalWarn(`[plan/manager] Rule 2 auto-commit SKIPPED for ${taskId}: worktree merge-back ${mergeFailure.outcome} at stage '${mergeFailure.stage}'. The task's changes are NOT in the main tree, so no completion marker is written (Rule 3 must not treat this task as satisfied). Resolve the preserved worktree, then re-run the task. Detail: ${mergeFailure.message}`);
           return updatedPlan;
@@ -4029,8 +3148,8 @@ async function updateTaskStatus(directory, taskId, status, options) {
               break;
             }
           }
-          const canonicalScope = _internals10.readTaskScopes(directory, taskId);
-          await _internals10.commitTaskCompletion(directory, taskId, taskDescription, canonicalScope ?? undefined);
+          const canonicalScope = _internals6.readTaskScopes(directory, taskId);
+          await _internals6.commitTaskCompletion(directory, taskId, taskDescription, canonicalScope ?? undefined);
         } catch (commitErr) {
           criticalWarn(`[plan/manager] Rule 2 auto-commit for ${taskId} threw (non-fatal): ${commitErr instanceof Error ? commitErr.message : String(commitErr)}`);
         }
@@ -4343,19 +3462,19 @@ function migrateLegacyPlan(planContent, swarmId) {
 // src/evidence/manager.ts
 init_zod();
 import {
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync4,
   readdirSync as readdirSync2,
   realpathSync as realpathSync2,
   renameSync as renameSync3,
   rmSync,
   statSync as statSync2
 } from "fs";
-import * as fs8 from "fs/promises";
-import * as path10 from "path";
+import * as fs7 from "fs/promises";
+import * as path7 from "path";
 
 // src/evaluation/retention.ts
-import * as fs6 from "fs/promises";
-import * as path9 from "path";
+import * as fs5 from "fs/promises";
+import * as path6 from "path";
 function artifactKey(artifact) {
   return `${artifact.namespace}/${artifact.id}`;
 }
@@ -4363,10 +3482,10 @@ function validId(value) {
   return /^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$/.test(value);
 }
 async function evaluationRunCandidates(directory) {
-  const root = path9.join(directory, ".swarm", "evolution", "runs");
+  const root = path6.join(directory, ".swarm", "evolution", "runs");
   let entries = [];
   try {
-    entries = await fs6.readdir(root, { withFileTypes: true });
+    entries = await fs5.readdir(root, { withFileTypes: true });
   } catch (error2) {
     if (error2.code === "ENOENT") {
       return { candidates: [], corrupt: [] };
@@ -4382,9 +3501,9 @@ async function evaluationRunCandidates(directory) {
     if (!validId(id))
       continue;
     const artifact = { namespace: "evaluation-run", id };
-    const target = path9.join(root, entry.name);
+    const target = path6.join(root, entry.name);
     try {
-      const run = EvaluationRunV1Schema.parse(JSON.parse(await fs6.readFile(target, "utf8")));
+      const run = EvaluationRunV1Schema.parse(JSON.parse(await fs5.readFile(target, "utf8")));
       if (run.runId !== id)
         throw new Error("run id/path mismatch");
       candidates.push({
@@ -4400,10 +3519,10 @@ async function evaluationRunCandidates(directory) {
   return { candidates, corrupt };
 }
 async function gateAuditCandidates(directory) {
-  const root = path9.join(directory, ".swarm", "evidence", "gate-audit");
+  const root = path6.join(directory, ".swarm", "evidence", "gate-audit");
   let entries = [];
   try {
-    entries = await fs6.readdir(root, { withFileTypes: true });
+    entries = await fs5.readdir(root, { withFileTypes: true });
   } catch (error2) {
     if (error2.code === "ENOENT") {
       return { candidates: [], corrupt: [] };
@@ -4416,9 +3535,9 @@ async function gateAuditCandidates(directory) {
     if (!entry.isDirectory() || !validId(entry.name))
       continue;
     const artifact = { namespace: "gate-audit", id: entry.name };
-    const target = path9.join(root, entry.name);
+    const target = path6.join(root, entry.name);
     try {
-      const result = GateAuditResultV1Schema.parse(JSON.parse(await fs6.readFile(path9.join(target, "results.json"), "utf8")));
+      const result = GateAuditResultV1Schema.parse(JSON.parse(await fs5.readFile(path6.join(target, "results.json"), "utf8")));
       if (result.runId !== entry.name)
         throw new Error("run id/path mismatch");
       candidates.push({
@@ -4449,10 +3568,10 @@ async function protectedArtifacts(directory) {
 }
 async function removeCandidate(candidate) {
   if (candidate.kind === "directory") {
-    await fs6.rm(candidate.target, { recursive: true, force: true });
+    await fs5.rm(candidate.target, { recursive: true, force: true });
     return;
   }
-  await fs6.unlink(candidate.target);
+  await fs5.unlink(candidate.target);
 }
 var _retentionInternals = {
   protectedArtifacts,
@@ -4460,7 +3579,7 @@ var _retentionInternals = {
 };
 async function archiveEvaluationArtifacts(args) {
   assertProjectRoot(args.directory);
-  return withEvidenceLock(args.directory, path9.join("evolution", "retention-index"), "evaluation-retention", "archive", async () => {
+  return withEvidenceLock(args.directory, path6.join("evolution", "retention-index"), "evaluation-retention", "archive", async () => {
     const inventory = await retentionCandidates(args.directory);
     let protectedKeys = await _retentionInternals.protectedArtifacts(args.directory);
     const protectedRefs = inventory.candidates.filter((candidate) => protectedKeys.has(artifactKey(candidate.artifact))).map((candidate) => candidate.artifact);
@@ -4509,7 +3628,7 @@ async function archiveEvaluationArtifacts(args) {
 }
 
 // src/evidence/documents-retention.ts
-import * as fs7 from "fs";
+import * as fs6 from "fs";
 import * as fsp from "fs/promises";
 import * as readline from "readline";
 var EVIDENCE_CACHE_FILE = "evidence-cache/documents.jsonl";
@@ -4517,13 +3636,13 @@ var MAX_READ_BYTES = 100 * 1024 * 1024;
 var RENAME_MAX_ATTEMPTS = 5;
 var RENAME_BACKOFF_MS = 10;
 var RENAME_RETRY_CODES = new Set(["EPERM", "EBUSY", "ENOTEMPTY", "EACCES"]);
-var _internals11 = {
+var _internals7 = {
   stat: (p) => fsp.stat(p),
-  createReadStream: (p, options) => fs7.createReadStream(p, options),
-  openSync: (p, flags) => fs7.openSync(p, flags),
-  writeSync: (fd, data, position) => fs7.writeSync(fd, data, position),
-  fsyncSync: (fd) => fs7.fsyncSync(fd),
-  closeSync: (fd) => fs7.closeSync(fd),
+  createReadStream: (p, options) => fs6.createReadStream(p, options),
+  openSync: (p, flags) => fs6.openSync(p, flags),
+  writeSync: (fd, data, position) => fs6.writeSync(fd, data, position),
+  fsyncSync: (fd) => fs6.fsyncSync(fd),
+  closeSync: (fd) => fs6.closeSync(fd),
   renameWithRetry: atomicRenameWithRetry,
   unlink: (p) => fsp.unlink(p)
 };
@@ -4559,9 +3678,9 @@ function emptyResult(dryRun) {
   };
 }
 async function readCacheRows(filePath) {
-  const stat2 = await _internals11.stat(filePath);
+  const stat2 = await _internals7.stat(filePath);
   const bytesBefore = stat2.size;
-  const stream = _internals11.createReadStream(filePath, {
+  const stream = _internals7.createReadStream(filePath, {
     encoding: "utf8",
     highWaterMark: 64 * 1024
   });
@@ -4637,23 +3756,23 @@ async function rewriteAtomic(filePath, survivors) {
 `)}
 ` : "";
   let succeeded = false;
-  const fd = _internals11.openSync(tmpPath, "w");
+  const fd = _internals7.openSync(tmpPath, "w");
   try {
-    _internals11.writeSync(fd, payload, 0);
-    _internals11.fsyncSync(fd);
-    _internals11.closeSync(fd);
-    await _internals11.renameWithRetry(tmpPath, filePath);
+    _internals7.writeSync(fd, payload, 0);
+    _internals7.fsyncSync(fd);
+    _internals7.closeSync(fd);
+    await _internals7.renameWithRetry(tmpPath, filePath);
     succeeded = true;
   } catch (err) {
     try {
-      _internals11.closeSync(fd);
+      _internals7.closeSync(fd);
     } catch {}
     const msg = err instanceof Error ? err.message : String(err);
     throw new Error(`documents-cache rewrite failed: ${msg}`);
   } finally {
     if (!succeeded) {
       try {
-        await _internals11.unlink(tmpPath);
+        await _internals7.unlink(tmpPath);
       } catch {}
     }
   }
@@ -4666,7 +3785,7 @@ async function pruneEvidenceDocuments(args) {
   const filePath = validateSwarmPath(args.directory, EVIDENCE_CACHE_FILE);
   let stat2;
   try {
-    stat2 = await _internals11.stat(filePath);
+    stat2 = await _internals7.stat(filePath);
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT")
@@ -4767,21 +3886,21 @@ function isValidEvidenceType(type) {
 var sanitizeTaskId2 = sanitizeTaskId;
 function validateProjectRoot(directory) {
   assertProjectRoot(directory, {
-    realpathSync: _internals12.realpathSync,
-    statSync: _internals12.statSync
+    realpathSync: _internals8.realpathSync,
+    statSync: _internals8.statSync
   }, "evidence");
 }
 async function saveEvidence(directory, taskId, evidence, abortSignal) {
   abortSignal?.throwIfAborted();
-  _internals12.validateProjectRoot(directory);
+  _internals8.validateProjectRoot(directory);
   const sanitizedTaskId = sanitizeTaskId2(taskId);
-  const relativePath = path10.join("evidence", sanitizedTaskId, "evidence.json");
+  const relativePath = path7.join("evidence", sanitizedTaskId, "evidence.json");
   validateSwarmPath(directory, relativePath);
-  _internals12.validateEvidence(evidence);
+  _internals8.validateEvidence(evidence);
   return withEvidenceLock(directory, relativePath, "evidence-manager", sanitizedTaskId, async () => {
     abortSignal?.throwIfAborted();
     const evidencePath = validateSwarmPath(directory, relativePath);
-    const evidenceDir = path10.dirname(evidencePath);
+    const evidenceDir = path7.dirname(evidencePath);
     let bundle;
     const existingContent = await readSwarmFileAsync(directory, relativePath);
     abortSignal?.throwIfAborted();
@@ -4824,8 +3943,8 @@ async function saveEvidence(directory, taskId, evidence, abortSignal) {
     if (bundleJson.length > EVIDENCE_MAX_JSON_BYTES) {
       throw new Error(`Evidence bundle size (${bundleJson.length} bytes) exceeds maximum (${EVIDENCE_MAX_JSON_BYTES} bytes)`);
     }
-    mkdirSync5(evidenceDir, { recursive: true });
-    const tempPath = path10.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
+    mkdirSync4(evidenceDir, { recursive: true });
+    const tempPath = path7.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
     try {
       await bunWrite(tempPath, bundleJson);
       abortSignal?.throwIfAborted();
@@ -4871,7 +3990,7 @@ function wrapFlatRetrospective(flatEntry, taskId) {
 }
 async function loadEvidence(directory, taskId, options) {
   const sanitizedTaskId = sanitizeTaskId2(taskId);
-  const relativePath = path10.join("evidence", sanitizedTaskId, "evidence.json");
+  const relativePath = path7.join("evidence", sanitizedTaskId, "evidence.json");
   if (relativePath.length > 4096) {
     return { status: "not_found" };
   }
@@ -4887,7 +4006,7 @@ async function loadEvidence(directory, taskId, options) {
     return { status: "invalid_schema", errors: ["Invalid JSON"] };
   }
   if (isFlatRetrospective(parsed)) {
-    const wrappedBundle = _internals12.wrapFlatRetrospective(parsed, sanitizedTaskId);
+    const wrappedBundle = _internals8.wrapFlatRetrospective(parsed, sanitizedTaskId);
     try {
       const validated = EvidenceBundleSchema.parse(wrappedBundle);
       if (options?.migrate === false) {
@@ -4896,12 +4015,12 @@ async function loadEvidence(directory, taskId, options) {
       try {
         validateProjectRoot(directory);
         await withEvidenceLock(directory, relativePath, "evidence-loader", sanitizedTaskId, async () => {
-          const evidenceDir = path10.dirname(evidencePath);
+          const evidenceDir = path7.dirname(evidencePath);
           const bundleJson = JSON.stringify(validated);
-          const tempPath = path10.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
+          const tempPath = path7.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
           try {
             await bunWrite(tempPath, bundleJson);
-            await fs8.rename(tempPath, evidencePath);
+            await fs7.rename(tempPath, evidencePath);
             invalidateCachedArtifact(evidencePath);
           } catch (writeError) {
             try {
@@ -4944,7 +4063,7 @@ async function listEvidenceTaskIds(directory) {
   }
   const taskIds = [];
   for (const entry of entries) {
-    const entryPath = path10.join(evidenceBasePath, entry);
+    const entryPath = path7.join(evidenceBasePath, entry);
     try {
       const stats = statSync2(entryPath);
       if (!stats.isDirectory()) {
@@ -4967,7 +4086,7 @@ async function deleteEvidence(directory, taskId) {
   } catch {
     return false;
   }
-  const relativePath = path10.join("evidence", sanitizedTaskId);
+  const relativePath = path7.join("evidence", sanitizedTaskId);
   const evidenceDir = validateSwarmPath(directory, relativePath);
   try {
     statSync2(evidenceDir);
@@ -4983,18 +4102,18 @@ async function deleteEvidence(directory, taskId) {
   }
 }
 async function checkRequirementCoverage(phase, directory) {
-  const relativePath = path10.join("evidence", `req-coverage-phase-${phase}.json`);
-  const absolutePath = path10.resolve(directory, ".swarm", relativePath);
+  const relativePath = path7.join("evidence", `req-coverage-phase-${phase}.json`);
+  const absolutePath = path7.resolve(directory, ".swarm", relativePath);
   try {
-    await fs8.access(absolutePath);
+    await fs7.access(absolutePath);
     return { exists: true, path: absolutePath };
   } catch {
     return { exists: false, path: absolutePath };
   }
 }
 async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
-  const taskIds = await _internals12.listEvidenceTaskIds(directory);
-  const cutoffDate = options?.now ? new Date(options.now) : _internals12.now();
+  const taskIds = await _internals8.listEvidenceTaskIds(directory);
+  const cutoffDate = options?.now ? new Date(options.now) : _internals8.now();
   cutoffDate.setDate(cutoffDate.getDate() - maxAgeDays);
   const cutoffIso = cutoffDate.toISOString();
   const selected = new Set;
@@ -5006,7 +4125,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   for (const taskId of taskIds) {
     let result;
     try {
-      result = await _internals12.loadEvidence(directory, taskId);
+      result = await _internals8.loadEvidence(directory, taskId);
     } catch {
       warn("archive: skipping corrupt or unreadable evidence for task", taskId);
       continue;
@@ -5034,7 +4153,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   }
   if (!options?.dryRun) {
     for (const taskId of [...selected].sort()) {
-      const deleted = await _internals12.deleteEvidence(directory, taskId);
+      const deleted = await _internals8.deleteEvidence(directory, taskId);
       if (deleted)
         archived.push(taskId);
       else
@@ -5060,7 +4179,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   };
   if (typeof options?.cacheMaxBytes === "number" && options.cacheMaxBytes > 0 || typeof options?.cacheMaxRecords === "number" && options.cacheMaxRecords > 0) {
     try {
-      documentsCache = await _internals12.pruneEvidenceDocuments({
+      documentsCache = await _internals8.pruneEvidenceDocuments({
         directory,
         maxBytes: options?.cacheMaxBytes,
         maxRecords: options?.cacheMaxRecords,
@@ -5088,7 +4207,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
 function validateEvidence(evidence) {
   return EvidenceSchema.parse(evidence);
 }
-var _internals12 = {
+var _internals8 = {
   wrapFlatRetrospective,
   loadEvidence,
   listEvidenceTaskIds,
@@ -5212,4 +4331,4 @@ function mergeDurableGateEntriesFromEvidence(taskId, entries, evidence) {
   return merged;
 }
 
-export { projectDbExists, getProjectDb, closeProjectDb, normalizePath, buildTaskCompletionDescriptor, ensureTaskCheckpointReceipt, updateTaskCheckpointReceipt, isValidEnvKey, getExecutor, init_executor, MAX_TRANSIENT_RETRIES, isTransientSpawnError, transientBackoff, getGitRepositoryStatus, isGitRepo, getDefaultBaseBranch, detectDefaultRemoteBranch, resetToRemoteBranch, resetToMainAfterMerge, containsPathTraversal, containsControlChars, validateSymlinkBoundary, isStateUnreadable, loadEpicSessionState, isEpicModeActive, enableEpicMode, disableEpicMode, pathsConflict, isGlobalFile, isProtectedPath, readTaskScopes, loadPlanJsonOnly, loadPlan, savePlan, closePlanTerminalState, updateTaskStatus, derivePlanMarkdown, isValidEvidenceType, sanitizeTaskId2 as sanitizeTaskId, validateProjectRoot, saveEvidence, loadEvidence, listEvidenceTaskIds, checkRequirementCoverage, archiveEvidence, readDurableGateEvidence, getDurableGateEvidenceStatus, getDurableGateEvidenceStatusForTask, mergeDurableGateEntriesFromEvidence };
+export { projectDbExists, getProjectDb, closeProjectDb, normalizePath, buildTaskCompletionDescriptor, ensureTaskCheckpointReceipt, updateTaskCheckpointReceipt, MAX_TRANSIENT_RETRIES, isTransientSpawnError, transientBackoff, getGitRepositoryStatus, isGitRepo, getDefaultBaseBranch, detectDefaultRemoteBranch, resetToRemoteBranch, resetToMainAfterMerge, containsPathTraversal, containsControlChars, validateSymlinkBoundary, isStateUnreadable, loadEpicSessionState, isEpicModeActive, enableEpicMode, disableEpicMode, pathsConflict, isGlobalFile, isProtectedPath, readTaskScopes, loadPlanJsonOnly, loadPlan, savePlan, closePlanTerminalState, updateTaskStatus, derivePlanMarkdown, isValidEvidenceType, sanitizeTaskId2 as sanitizeTaskId, validateProjectRoot, saveEvidence, loadEvidence, listEvidenceTaskIds, checkRequirementCoverage, archiveEvidence, readDurableGateEvidence, getDurableGateEvidenceStatus, getDurableGateEvidenceStatusForTask, mergeDurableGateEntriesFromEvidence };