opencode-swarm 7.144.7 → 7.145.0

package/dist/cli/{index-q7zy6dej.js → index-6hqhyb0f.js}

@@ -1,4 +1,7 @@
 // @bun
+import {
+  bunSpawn
+} from "./index-zj6t9zgx.js";
 import {
   SWARM_WORKTREE_DIR_NAME,
   init_constants
@@ -11,9 +14,6 @@ import {
   advisoryWarn,
   init_warning_buffer
 } from "./index-4rhhvd1a.js";
-import {
-  bunSpawn
-} from "./index-zj6t9zgx.js";
 import {
   log
 } from "./index-zgwm4ryv.js";
@@ -92,7 +92,7 @@ var _internals = {
     symlinkSync: fs.symlinkSync
   },
   writeScopeToDisk: async (directory, taskId, files) => {
-    const { writeScopeToDisk: realWrite } = await import("./scope-persistence-k9mqd414.js");
+    const { writeScopeToDisk: realWrite } = await import("./scope-persistence-dv6z7n08.js");
     return realWrite(directory, taskId, files);
   },
   writeLaneProfileToDisk: async (_worktreePath, _laneIndex, _envOverrides) => {

package/dist/cli/{index-9s8drsf9.js → index-6q3agdmr.js}

@@ -1,16 +1,12 @@
 // @bun
 import {
-  invalidateCachedArtifact
-} from "./index-ed5ykebp.js";
+  atomicWriteFileAnyRoot
+} from "./index-4evasm2b.js";
 import {
   withEvidenceLock
-} from "./index-f9vvg5xb.js";
-import {
-  bunWrite
-} from "./index-zj6t9zgx.js";
+} from "./index-pa86tpgt.js";
 
 // src/evidence/task-file.ts
-import { renameSync, unlinkSync } from "fs";
 import * as path from "path";
 function taskEvidenceRelPath(taskId) {
   return path.join("evidence", `${taskId}.json`);
@@ -18,21 +14,8 @@ function taskEvidenceRelPath(taskId) {
 function taskEvidencePath(directory, taskId) {
   return path.join(directory, ".swarm", taskEvidenceRelPath(taskId));
 }
-var _internals = {
-  renameSync,
-  unlinkSync
-};
 async function atomicWriteFile(targetPath, content) {
-  const tempPath = `${targetPath}.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`;
-  try {
-    await bunWrite(tempPath, content);
-    _internals.renameSync(tempPath, targetPath);
-  } finally {
-    try {
-      _internals.unlinkSync(tempPath);
-    } catch {}
-  }
-  invalidateCachedArtifact(targetPath);
+  await atomicWriteFileAnyRoot(targetPath, content);
 }
 function withTaskEvidenceLock(directory, taskId, agent, fn) {
   return withEvidenceLock(directory, taskEvidenceRelPath(taskId), agent, taskId, fn);

package/dist/cli/{index-hkdgkkhb.js → index-77ef8gye.js}

@@ -1,10 +1,10 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-fv0s19g9.js";
+} from "./index-w8pgjr75.js";
 import {
   withEvidenceLock
-} from "./index-f9vvg5xb.js";
+} from "./index-pa86tpgt.js";
 import {
   exports_external,
   init_zod

package/dist/cli/{index-bx20cv1v.js → index-7g276m9m.js}

@@ -2,10 +2,10 @@
 import {
   init_loader,
   loadPluginConfigWithMeta
-} from "./index-zq9gs0yk.js";
+} from "./index-0pcq32y2.js";
 import {
   init_schema
-} from "./index-x4eqd82b.js";
+} from "./index-zfhe7vbb.js";
 import {
   DEFAULT_WORKTREE_ISOLATION_CONFIG,
   init_constants

package/dist/cli/{index-zy7f84cs.js → index-85gkedsf.js}

@@ -977,6 +977,14 @@ var init_windows = __esm(() => {
 function isValidEnvKey(key) {
   return /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(key);
 }
+function isUntrustedEnvKey(key) {
+  const upper = key.toUpperCase();
+  for (const prefix of UNTRUSTED_ENV_KEY_PREFIXES) {
+    if (upper.startsWith(prefix))
+      return true;
+  }
+  return false;
+}
 async function getExecutor() {
   if (_cachedExecutorPromise !== undefined) {
     return _cachedExecutorPromise;
@@ -998,7 +1006,7 @@ async function _createExecutor() {
   return null;
 }
 async function _createLinuxExecutor() {
-  const { SandboxCapabilityProbe, isBubblewrapAvailable } = await import("./capability-probe-976tt4ba.js");
+  const { SandboxCapabilityProbe, isBubblewrapAvailable } = await import("./capability-probe-va4kk8vg.js");
   await new SandboxCapabilityProbe().detect();
   if (!isBubblewrapAvailable()) {
     return null;
@@ -1018,7 +1026,7 @@ async function _createMacOSExecutor() {
     }
     return null;
   }
-  const { SandboxCapabilityProbe, isSandboxExecAvailable } = await import("./capability-probe-976tt4ba.js");
+  const { SandboxCapabilityProbe, isSandboxExecAvailable } = await import("./capability-probe-va4kk8vg.js");
   await new SandboxCapabilityProbe().detect();
   if (!isSandboxExecAvailable()) {
     return null;
@@ -1031,7 +1039,7 @@ async function _createMacOSExecutor() {
   }
 }
 async function _createWindowsExecutor() {
-  const { SandboxCapabilityProbe, isWindowsSandboxAvailable } = await import("./capability-probe-976tt4ba.js");
+  const { SandboxCapabilityProbe, isWindowsSandboxAvailable } = await import("./capability-probe-va4kk8vg.js");
   await new SandboxCapabilityProbe().detect();
   if (!isWindowsSandboxAvailable()) {
     return null;
@@ -1043,7 +1051,7 @@ async function _createWindowsExecutor() {
     return null;
   }
 }
-var SandboxError, _cachedExecutorPromise, _macosSandboxEnabled = false, _hasWarnedMacOSSandboxDisabledByConfig = false;
+var SandboxError, UNTRUSTED_ENV_KEY_PREFIXES, _cachedExecutorPromise, _macosSandboxEnabled = false, _hasWarnedMacOSSandboxDisabledByConfig = false;
 var init_executor = __esm(() => {
   init_logger();
   SandboxError = class SandboxError extends Error {
@@ -1054,6 +1062,7 @@ var init_executor = __esm(() => {
       this.name = "SandboxError";
     }
   };
+  UNTRUSTED_ENV_KEY_PREFIXES = ["GIT_", "LD_", "DYLD_"];
 });
 
 // src/sandbox/linux/bubblewrap-executor.ts
@@ -1207,4 +1216,4 @@ var init_bubblewrap_executor = __esm(() => {
   };
 });
 
-export { _internals4 as _internals, init_bubblewrap_executor, _internals as _internals1, init_sandbox_exec_executor, exports_runner_client, init_runner_client, isValidEnvKey, getExecutor, init_executor };
+export { _internals4 as _internals, init_bubblewrap_executor, _internals as _internals1, init_sandbox_exec_executor, exports_runner_client, init_runner_client, isValidEnvKey, isUntrustedEnvKey, getExecutor, init_executor };

package/dist/cli/{index-7bvd5nh2.js → index-apjdytwx.js}

@@ -4,14 +4,14 @@ import {
   PlanSchema,
   TaskStatusSchema,
   init_loader
-} from "./index-zq9gs0yk.js";
+} from "./index-0pcq32y2.js";
 import {
   assertProjectRoot,
   withEvidenceLock
-} from "./index-f9vvg5xb.js";
+} from "./index-pa86tpgt.js";
 import {
   emit
-} from "./index-1jsmmx7y.js";
+} from "./index-zz5qsjd1.js";
 import {
   criticalWarn,
   init_logger,

package/dist/cli/{index-pzsezhek.js → index-b3xret0a.js}

@@ -6,12 +6,12 @@ import {
   resolveSwarmKnowledgePath,
   transactKnowledge,
   wordBigrams
-} from "./index-77h4xjn5.js";
+} from "./index-qfawexc8.js";
 import {
   queryHistoricalOutcomes,
   readKnowledgeEvents,
   recordKnowledgeEvent
-} from "./index-qm0mz7rj.js";
+} from "./index-c13ttmak.js";
 import {
   init_knowledge_types,
   isActiveStatus
@@ -224,11 +224,11 @@ async function maybeQuarantineOnContradiction(directory, entryId, threshold, win
         alreadyInactive: true
       };
     }
-    const { quarantineEntry } = await import("./knowledge-validator-sng5xt5a.js");
+    const { quarantineEntry } = await import("./knowledge-validator-91ym56e0.js");
     let policyConfig;
     try {
-      const { KnowledgeConfigSchema } = await import("./schema-vnghba3d.js");
-      const { loadPluginConfigWithMeta } = await import("./index-r2q0nd0a.js");
+      const { KnowledgeConfigSchema } = await import("./schema-nq9tcz87.js");
+      const { loadPluginConfigWithMeta } = await import("./index-kp87kr1a.js");
       const { config: loadedConfig } = loadPluginConfigWithMeta(directory);
       policyConfig = KnowledgeConfigSchema.parse(loadedConfig.knowledge ?? {});
     } catch {

package/dist/cli/{index-qm0mz7rj.js → index-c13ttmak.js}

@@ -1,29 +1,29 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-fv0s19g9.js";
+} from "./index-w8pgjr75.js";
 import {
   loadPluginConfigWithMeta
-} from "./index-zq9gs0yk.js";
+} from "./index-0pcq32y2.js";
 import {
   KnowledgeConfigSchema,
   init_schema
-} from "./index-x4eqd82b.js";
+} from "./index-zfhe7vbb.js";
 import {
   resolveHiveEventsPath
 } from "./index-ae75rja9.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-h1p08s3n.js";
+} from "./index-s72naw1j.js";
 import {
   atomicWriteFile
-} from "./index-9s8drsf9.js";
+} from "./index-6q3agdmr.js";
 import {
   assertProjectRoot
-} from "./index-f9vvg5xb.js";
+} from "./index-pa86tpgt.js";
 import {
   emit
-} from "./index-1jsmmx7y.js";
+} from "./index-zz5qsjd1.js";
 import {
   require_proper_lockfile
 } from "./index-7g4c7s5r.js";
@@ -2545,7 +2545,7 @@ async function applyKnowledgeVerdictFeedback(directory, options) {
     }
     let bumps = 0;
     if (deltas.length > 0) {
-      const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-g389c1cy.js");
+      const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-8kk3rghx.js");
       bumps = await bumpKnowledgeConfidenceBatch(directory, deltas, options?.floorOptions);
     }
     return {

package/dist/cli/{index-d879g58v.js → index-e00wbqw5.js}

@@ -2,14 +2,14 @@
 import {
   readKnowledge,
   transactKnowledge
-} from "./index-77h4xjn5.js";
+} from "./index-qfawexc8.js";
 import {
   init_git_executable,
   resolveGitExecutableAsync
 } from "./index-9e6fdz2h.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-h1p08s3n.js";
+} from "./index-s72naw1j.js";
 import {
   init_knowledge_types,
   isActiveStatus

package/dist/cli/{index-cwtpqm5f.js → index-e1pxav9g.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-fv0s19g9.js";
+} from "./index-w8pgjr75.js";
 
 // src/hooks/delegation-gate/worktree-provisioning-owner.ts
 import { createHash, randomBytes } from "crypto";

package/dist/cli/{index-n4hwcsbd.js → index-ffdwj1an.js}

@@ -1,17 +1,17 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-fv0s19g9.js";
+} from "./index-w8pgjr75.js";
+import {
+  bunWrite
+} from "./index-zj6t9zgx.js";
 import {
   withEvidenceLock
-} from "./index-f9vvg5xb.js";
+} from "./index-pa86tpgt.js";
 import {
   exports_external,
   init_zod
 } from "./index-bpmtbmy9.js";
-import {
-  bunWrite
-} from "./index-zj6t9zgx.js";
 import {
   init_logger,
   warn

package/dist/cli/{index-vdha477y.js → index-fp464as8.js}

@@ -7,7 +7,7 @@ import {
   readLinkPointer,
   resolveKnowledgeStoreDir,
   resolveLinkDir
-} from "./index-h1p08s3n.js";
+} from "./index-s72naw1j.js";
 
 // src/knowledge/curation-policy.ts
 import { appendFile, mkdir as mkdir2, readFile as readFile2 } from "fs/promises";

package/dist/cli/{index-c1cfsg9y.js → index-h4hasck4.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   authorizeCuration
-} from "./index-vdha477y.js";
+} from "./index-fp464as8.js";
 import {
   findNearDuplicate,
   inferTags,
@@ -9,13 +9,13 @@ import {
   resolveSwarmKnowledgePath,
   resolveSwarmRejectedPath,
   transactKnowledge
-} from "./index-77h4xjn5.js";
+} from "./index-qfawexc8.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-h1p08s3n.js";
+} from "./index-s72naw1j.js";
 import {
   atomicWriteFile
-} from "./index-9s8drsf9.js";
+} from "./index-6q3agdmr.js";
 import {
   require_proper_lockfile
 } from "./index-7g4c7s5r.js";

package/dist/cli/{index-39jbnhar.js → index-hfzcztv6.js}

@@ -1,10 +1,10 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-yz0hfa4g.js";
+} from "./index-4e5a28h7.js";
 import {
   handleGuardrailLog
-} from "./index-xjgwr4c6.js";
+} from "./index-k6pdsct6.js";
 import {
   COMMAND_REGISTRY,
   SWARM_COMMAND_TOOL_ALLOWLIST,
@@ -85,50 +85,51 @@ import {
   handleWriteRetroCommand,
   normalizeSwarmCommandInput,
   resolveCommand
-} from "./index-x4q96ejx.js";
-import"./index-gmdgap01.js";
-import"./index-00fk9c3b.js";
-import"./index-s1xefrx7.js";
+} from "./index-6ezbzd5e.js";
+import"./index-2dnqazyr.js";
+import"./index-0jr9zn34.js";
+import"./index-v64kjqvg.js";
 import"./index-134d35c1.js";
 import"./index-abtrcs16.js";
-import"./index-6z5jtf7d.js";
-import"./index-wknz5c8q.js";
+import"./index-wk54ey3h.js";
+import"./index-jy9bwa9k.js";
 import"./index-y8552snf.js";
-import"./index-d879g58v.js";
+import"./index-e00wbqw5.js";
 import"./index-70ha9e09.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
-import"./index-f36ybbsv.js";
-import"./index-hkdgkkhb.js";
-import"./index-w9bnt74s.js";
-import"./index-pzsezhek.js";
-import"./index-c1cfsg9y.js";
-import"./index-vdha477y.js";
+import"./index-b30x236n.js";
+import"./index-77ef8gye.js";
+import"./index-mkks7jwg.js";
+import"./index-b3xret0a.js";
+import"./index-h4hasck4.js";
+import"./index-fp464as8.js";
 import"./index-rtry5xyf.js";
 import"./index-zsrtt42s.js";
-import"./index-n4hwcsbd.js";
-import"./index-cwtpqm5f.js";
-import"./index-grkev1g6.js";
-import"./index-q7zy6dej.js";
-import"./index-jszgrk71.js";
-import"./index-7bvd5nh2.js";
+import"./index-ffdwj1an.js";
+import"./index-e1pxav9g.js";
+import"./index-s6cwsnrw.js";
+import"./index-6hqhyb0f.js";
+import"./index-4zwjc9sb.js";
+import"./index-apjdytwx.js";
 import"./index-556ja8an.js";
 import"./index-7sy3aa9m.js";
 import"./index-wx8zdh4a.js";
-import"./index-b44qqqt2.js";
-import"./index-zy7f84cs.js";
-import"./index-77h4xjn5.js";
-import"./index-qm0mz7rj.js";
-import"./index-bx20cv1v.js";
+import"./index-3g0xk6tk.js";
+import"./index-85gkedsf.js";
+import"./index-qfawexc8.js";
+import"./index-c13ttmak.js";
+import"./index-7g276m9m.js";
 import"./index-gprxjmm7.js";
 import"./index-n832052r.js";
-import"./index-fv0s19g9.js";
+import"./index-w8pgjr75.js";
 import"./index-z6xqpmqg.js";
-import"./index-zq9gs0yk.js";
+import"./index-zj6t9zgx.js";
+import"./index-0pcq32y2.js";
 import {
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-x4eqd82b.js";
+} from "./index-zfhe7vbb.js";
 import {
   AGENT_TOOL_MAP,
   ORCHESTRATOR_NAME,
@@ -138,15 +139,15 @@ import"./index-9e6fdz2h.js";
 import"./index-4rhhvd1a.js";
 import"./index-zjygnfay.js";
 import"./index-ae75rja9.js";
-import"./index-h1p08s3n.js";
-import"./index-9s8drsf9.js";
-import"./index-ed5ykebp.js";
+import"./index-s72naw1j.js";
+import"./index-6q3agdmr.js";
 import"./index-bk5tah7q.js";
-import"./index-f9vvg5xb.js";
-import"./index-1jsmmx7y.js";
+import"./index-4evasm2b.js";
+import"./index-pa86tpgt.js";
+import"./index-zz5qsjd1.js";
 import"./index-7g4c7s5r.js";
 import"./index-bpmtbmy9.js";
-import"./index-zj6t9zgx.js";
+import"./index-ed5ykebp.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 

package/dist/cli/{index-wknz5c8q.js → index-jy9bwa9k.js}

@@ -9,11 +9,11 @@ import {
 } from "./index-y8552snf.js";
 import {
   atomicWriteFile
-} from "./index-9s8drsf9.js";
+} from "./index-6q3agdmr.js";
 import {
   assertProjectRoot,
   withEvidenceLock
-} from "./index-f9vvg5xb.js";
+} from "./index-pa86tpgt.js";
 import {
   exports_external,
   init_zod

package/dist/cli/{index-xjgwr4c6.js → index-k6pdsct6.js}

@@ -2,7 +2,7 @@
 import {
   redactPath,
   redactShellCommand
-} from "./index-gmdgap01.js";
+} from "./index-2dnqazyr.js";
 
 // src/services/guardrail-log-service.ts
 import * as fs from "fs/promises";

package/dist/cli/{index-r2q0nd0a.js → index-kp87kr1a.js}

@@ -2,7 +2,7 @@
 import {
   _internals,
   resolveWorktreeIsolationConfig
-} from "./index-bx20cv1v.js";
+} from "./index-7g276m9m.js";
 import {
   ApprovalEvidenceSchema,
   BaseEvidenceSchema,
@@ -42,7 +42,7 @@ import {
   loadPluginConfig,
   loadPluginConfigWithMeta,
   loadPluginConfigWithMetaAsync
-} from "./index-zq9gs0yk.js";
+} from "./index-0pcq32y2.js";
 import {
   AUTO_REVIEW_V8_BURN_IN_DECISION,
   AgentOverrideConfigSchema,
@@ -64,7 +64,7 @@ import {
   TurboConfigSchema,
   WorktreeIsolationConfigSchema,
   resolveAutoReviewConfig
-} from "./index-x4eqd82b.js";
+} from "./index-zfhe7vbb.js";
 import {
   ALL_AGENT_NAMES,
   ALL_SUBAGENT_NAMES,

package/dist/cli/{index-w9bnt74s.js → index-mkks7jwg.js}

@@ -2,18 +2,18 @@
 import {
   ALLOWED_SKILL_PATH_PREFIXES,
   validateSkillPath
-} from "./index-c1cfsg9y.js";
+} from "./index-h4hasck4.js";
 import {
   computeOutcomeSignal,
   readKnowledge,
   resolveHiveKnowledgePath,
   resolveSwarmKnowledgePath,
   transactKnowledge
-} from "./index-77h4xjn5.js";
+} from "./index-qfawexc8.js";
 import {
   effectiveRetrievalOutcomes,
   readAuthoritativeKnowledgeCounterRollups
-} from "./index-qm0mz7rj.js";
+} from "./index-c13ttmak.js";
 import {
   advisoryWarn,
   init_warning_buffer
@@ -22,6 +22,10 @@ import {
   init_knowledge_types,
   isActiveStatus
 } from "./index-bk5tah7q.js";
+import {
+  atomicWriteFileAnyRoot,
+  atomicWriteSwarmFile
+} from "./index-4evasm2b.js";
 import {
   init_logger,
   log,
@@ -33,7 +37,7 @@ import {
 
 // src/services/skill-generator.ts
 import { existsSync as existsSync2, unlinkSync } from "fs";
-import { mkdir as mkdir4, readFile as readFile4, rename as rename3, unlink, writeFile as writeFile4 } from "fs/promises";
+import { mkdir as mkdir4, readFile as readFile4, unlink, writeFile as writeFile3 } from "fs/promises";
 import * as path4 from "path";
 
 // src/config/bundled-skills.ts
@@ -375,9 +379,7 @@ import {
   readdir as readdir2,
   readFile as readFile3,
   realpath,
-  rename as rename2,
-  stat as stat2,
-  writeFile as writeFile3
+  stat as stat2
 } from "fs/promises";
 import * as path3 from "path";
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
@@ -692,9 +694,7 @@ async function evaluateSkillChange(req) {
 }
 async function atomicWrite(filePath, content) {
   await mkdir3(path3.dirname(filePath), { recursive: true });
-  const tmp = `${filePath}.tmp-${process.pid}-${Date.now()}`;
-  await writeFile3(tmp, content, "utf-8");
-  await rename2(tmp, filePath);
+  await atomicWriteSwarmFile(filePath, content);
 }
 async function appendRejectedSkillEdit(req, evaluation) {
   const filePath = rejectedEditsPath(req.directory);
@@ -1040,9 +1040,7 @@ function escapeMarkdown(s) {
 }
 async function atomicWrite2(p, content) {
   await mkdir4(path4.dirname(p), { recursive: true });
-  const tmp = `${p}.tmp-${process.pid}-${Date.now()}`;
-  await writeFile4(tmp, content, "utf-8");
-  await rename3(tmp, p);
+  await atomicWriteFileAnyRoot(p, content);
 }
 async function generateSkills(req) {
   const minConfidence = req.minConfidence ?? DEFAULT_SKILL_MIN_CONFIDENCE;
@@ -1794,7 +1792,7 @@ async function retireSkill(directory, slug, reason) {
     reason: reason ?? "manual_retire"
   });
   await mkdir4(markerDir, { recursive: true });
-  await writeFile4(markerPath, markerContent, "utf-8");
+  await writeFile3(markerPath, markerContent, "utf-8");
   let clearedLinks = [];
   try {
     clearedLinks = await clearRetiredSkillLinks(directory, skillPath, cleanSlug);
@@ -1884,7 +1882,7 @@ async function clearSkillLinks(directory, skillFilePath, slug, mode) {
 }
 async function markSkillStale(skillDir, reason) {
   await mkdir4(skillDir, { recursive: true });
-  await writeFile4(path4.join(skillDir, "stale.marker"), reason, "utf-8");
+  await writeFile3(path4.join(skillDir, "stale.marker"), reason, "utf-8");
 }
 async function clearSkillStale(skillDir) {
   const markerPath = path4.join(skillDir, "stale.marker");