opencode-swarm 7.152.1 → 7.153.0

package/dist/cli/{index-q77e475x.js → index-5x67858f.js}

@@ -2,7 +2,7 @@
 import {
   computePlanStructureHash,
   derivePlanId
-} from "./index-xyfdmrv7.js";
+} from "./index-80ekaf5b.js";
 import {
   appendCoreEventSync
 } from "./index-6zkm4p7p.js";
@@ -11,11 +11,11 @@ import {
 } from "./index-556ja8an.js";
 import {
   PlanSchema
-} from "./index-3djxegsc.js";
+} from "./index-e2hs0bh7.js";
 import {
   atomicWriteSwarmFile,
   atomicWriteSwarmFileSync
-} from "./index-7fh82sm1.js";
+} from "./index-k2ydsqs7.js";
 import {
   assertProjectRoot
 } from "./index-txbd25bc.js";

package/dist/cli/{index-k3d919yf.js → index-6v77adf7.js}

@@ -11,10 +11,10 @@ import {
 import {
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-n0vc5b5t.js";
+} from "./index-3z5jtyan.js";
 import {
   init_constants
-} from "./index-cpg98bh1.js";
+} from "./index-myt57pht.js";
 import {
   telemetry
 } from "./index-aw492hpn.js";
@@ -1768,7 +1768,7 @@ function classifyFile(filePath) {
 // src/hooks/guardrails/file-authority.ts
 import * as fsSync from "fs";
 var import_picomatch = __toESM(require_picomatch2(), 1);
-import * as path from "path";
+import * as path2 from "path";
 
 // node_modules/quick-lru/index.js
 class QuickLRU extends Map {
@@ -2045,6 +2045,64 @@ class QuickLRU extends Map {
 // src/hooks/guardrails/file-authority.ts
 init_schema();
 
+// src/security/protected-path-policy.ts
+import * as path from "path";
+var DEFAULT_SEGMENTS = new Set([
+  ".git",
+  ".swarm",
+  ".env",
+  "package.json",
+  "package-lock.json",
+  "bun.lock",
+  "CHANGELOG.md",
+  ".release-please-manifest.json",
+  "release-please-config.json",
+  "CODEOWNERS"
+]);
+var DEFAULT_PREFIXES = [
+  ".github/workflows",
+  ".github/CODEOWNERS",
+  "src/sandbox",
+  "src/hooks/guardrails",
+  "src/security",
+  "src/evaluation",
+  "docs/releases",
+  "tests/fixtures/evaluation"
+];
+function normalizeProtectedPath(value) {
+  return value.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+}
+function equalsOrDescendant(candidate, protectedPath) {
+  const left = process.platform === "win32" ? candidate.toLowerCase() : candidate;
+  const right = process.platform === "win32" ? protectedPath.toLowerCase() : protectedPath;
+  return left === right || left.startsWith(`${right}/`);
+}
+function isPolicyProtectedPath(filePath, options = {}) {
+  if (!filePath)
+    return false;
+  const normalized = normalizeProtectedPath(filePath);
+  const segments = normalized.split("/").filter(Boolean);
+  if (options.includeDefaults !== false) {
+    if (segments.some((segment) => DEFAULT_SEGMENTS.has(process.platform === "win32" ? segment.toLowerCase() : segment)))
+      return true;
+    if (DEFAULT_PREFIXES.some((prefix) => equalsOrDescendant(normalized, prefix)))
+      return true;
+  }
+  return (options.additional ?? []).some((entry) => {
+    const protectedPath = normalizeProtectedPath(entry);
+    if (!protectedPath)
+      return false;
+    if (equalsOrDescendant(normalized, protectedPath))
+      return true;
+    if (protectedPath.includes("/"))
+      return false;
+    return segments.some((segment) => (process.platform === "win32" ? segment.toLowerCase() : segment) === (process.platform === "win32" ? protectedPath.toLowerCase() : protectedPath));
+  });
+}
+function protectedRoots(projectRoot, additional = []) {
+  return [...DEFAULT_PREFIXES, ...DEFAULT_SEGMENTS, ...additional].map((entry) => path.resolve(projectRoot, entry));
+}
+
 // src/utils/arg-hash.ts
 var HASH_INPUT_CAP_BYTES = 64 * 1024;
 
@@ -2079,12 +2137,12 @@ function normalizePathWithCache(filePath, cwd) {
     return cached;
   }
   try {
-    const absolutePath = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
+    const absolutePath = path2.isAbsolute(filePath) ? filePath : path2.resolve(cwd, filePath);
     const normalized = fsSync.realpathSync(absolutePath);
     pathNormalizationCache.set(cacheKey, normalized);
     return normalized;
   } catch {
-    const fallback = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
+    const fallback = path2.isAbsolute(filePath) ? filePath : path2.resolve(cwd, filePath);
     pathNormalizationCache.set(cacheKey, fallback);
     return fallback;
   }
@@ -2232,7 +2290,7 @@ var DEFAULT_AGENT_AUTHORITY_RULES = {
   }
 };
 function matchesAuthorityDenyPrefix(candidate, prefix, cwd, flavor = getPathFlavor()) {
-  const pathImpl = flavor === "win32" ? path.win32 : path.posix;
+  const pathImpl = flavor === "win32" ? path2.win32 : path2.posix;
   const normalizeInput = (value) => flavor === "win32" ? value.replace(/\//g, "\\") : value;
   const normalizedPrefixInput = normalizeInput(prefix);
   const requiresComponentBoundary = normalizedPrefixInput.endsWith(pathImpl.sep);
@@ -2277,8 +2335,8 @@ function buildEffectiveRules(authorityConfig) {
   }
   return merged;
 }
-function isOnDifferentFilesystemRoot(targetAbsolute, cwdAbsolute, pathLib = path) {
-  const flavor = pathLib === path.win32 || pathLib.parse("C:\\probe").root !== "" ? "win32" : "posix";
+function isOnDifferentFilesystemRoot(targetAbsolute, cwdAbsolute, pathLib = path2) {
+  const flavor = pathLib === path2.win32 || pathLib.parse("C:\\probe").root !== "" ? "win32" : "posix";
   return isOnDifferentPathRoot(targetAbsolute, cwdAbsolute, flavor);
 }
 var BUILT_IN_VERIFIER_CONFIG_GLOBS = [
@@ -2349,11 +2407,11 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
   let resolvedTarget;
   try {
     const normalizedWithSymlinks = normalizePathWithCache(filePath, dir);
-    resolvedTarget = path.resolve(dir, normalizedWithSymlinks);
-    normalizedPath = path.relative(dir, resolvedTarget).replace(/\\/g, "/");
+    resolvedTarget = path2.resolve(dir, normalizedWithSymlinks);
+    normalizedPath = path2.relative(dir, resolvedTarget).replace(/\\/g, "/");
   } catch {
-    resolvedTarget = path.resolve(dir, filePath);
-    normalizedPath = path.relative(dir, resolvedTarget).replace(/\\/g, "/");
+    resolvedTarget = path2.resolve(dir, filePath);
+    normalizedPath = path2.relative(dir, resolvedTarget).replace(/\\/g, "/");
   }
   if (isOnDifferentFilesystemRoot(resolvedTarget, dir)) {
     return denyAuthority(agentName, normalizedPath, {
@@ -2381,7 +2439,7 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
     });
   }
   const flavor = getPathFlavor();
-  const matchesPathPrefix = (candidate, prefix) => isPathIdentityWithin(path.resolve(dir, candidate), path.resolve(dir, prefix), flavor);
+  const matchesPathPrefix = (candidate, prefix) => isPathIdentityWithin(path2.resolve(dir, candidate), path2.resolve(dir, prefix), flavor);
   const matchesGlob = (glob) => getGlobMatcher(glob)(normalizedPath);
   for (const prefix of options.universalDenyPrefixes ?? []) {
     if (matchesAuthorityDenyPrefix(normalizedPath, prefix, dir, flavor)) {
@@ -2394,12 +2452,15 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
     }
   }
   const isCoderAgent = normalizedAgent === "coder" || strippedAgent === "coder";
-  if (isCoderAgent && matchesPathPrefix(normalizedPath, ".swarm")) {
+  if (isCoderAgent && isPolicyProtectedPath(normalizedPath, {
+    includeDefaults: false,
+    additional: [".git", ".swarm"]
+  })) {
     return denyAuthority(agentName, normalizedPath, {
       code: "AUTHORITY_PROTECTED_PATH",
       layer: "protected-path",
-      rule: "coder-swarm-state-protection",
-      detail: "coder writes to .swarm are always protected"
+      rule: "coder-control-state-protection",
+      detail: "coder writes to repository control state (.git/.swarm) are always protected"
     });
   }
   const isSwarmRole = Object.hasOwn(AUTHORITY_ROLE_CAPABILITIES, strippedAgent);
@@ -2608,7 +2669,7 @@ function redactShellCommand(cmd) {
 
 // src/hooks/guardrails/shell-audit-store.ts
 import * as fs from "fs";
-import * as path2 from "path";
+import * as path3 from "path";
 import { StringDecoder } from "string_decoder";
 init_logger();
 var SHELL_AUDIT_LIMITS = {
@@ -2718,10 +2779,10 @@ var _internals = {
   emitHealth: emitShellAuditHealth
 };
 function shellAuditFilePath(directory) {
-  return path2.join(directory, ".swarm", "session", "shell-audit.jsonl");
+  return path3.join(directory, ".swarm", "session", "shell-audit.jsonl");
 }
 function lockFilePath(directory) {
-  return path2.join(directory, ".swarm", "session", "shell-audit.lock");
+  return path3.join(directory, ".swarm", "session", "shell-audit.lock");
 }
 function tmpPathFor(finalPath) {
   return `${finalPath}.${process.pid}.tmp`;
@@ -2864,7 +2925,7 @@ function renameSyncWithRetry(fromPath, toPath) {
 function tryLockOnce(directory) {
   const lockPath = lockFilePath(directory);
   try {
-    _internals.mkdirSync(path2.dirname(lockPath), { recursive: true });
+    _internals.mkdirSync(path3.dirname(lockPath), { recursive: true });
     const fd = _internals.openSync(lockPath, "wx");
     _internals.closeSync(fd);
     return true;
@@ -3264,7 +3325,7 @@ function emitHealth(directory, payload) {
 // src/hooks/guardrails/audit-log.ts
 init_logger();
 import { createHash } from "crypto";
-import * as path3 from "path";
+import * as path4 from "path";
 var SHELL_AUDIT_FIELD_CLASSES = Object.freeze({
   ts: "timestamp",
   sessionID: "identifier",
@@ -3298,7 +3359,7 @@ function redactPath(filePath) {
   if (rawMacHomeMatch) {
     return `~${rawMacHomeMatch[2]}`;
   }
-  const normalized = path3.normalize(filePath);
+  const normalized = path4.normalize(filePath);
   const windowsHomeMatch = normalized.match(/^([A-Za-z]:\\[Uu][Ss][Ee][Rr][Ss]\\[^\\]+)(\\.*)$/i);
   if (windowsHomeMatch) {
     return `~\\${windowsHomeMatch[2]}`;
@@ -3360,4 +3421,4 @@ function redactDecisionLineForArchive(line) {
   return changed ? JSON.stringify(record) : line;
 }
 
-export { classifyFile, stableCanonicalStringify, checkFileAuthority, normalizeToolNameLowerCase, isInDeclaredScope, redactShellCommand, readShellAuditTail, getShellAuditFoldedSummary, finalizeShellAuditForClose, redactPath, redactDecisionLineForArchive };
+export { isPolicyProtectedPath, protectedRoots, classifyFile, stableCanonicalStringify, checkFileAuthority, normalizeToolNameLowerCase, isInDeclaredScope, redactShellCommand, readShellAuditTail, getShellAuditFoldedSummary, finalizeShellAuditForClose, redactPath, redactDecisionLineForArchive };

package/dist/cli/{index-0tfgn5x0.js → index-77xy577c.js}

@@ -6,10 +6,10 @@ import {
 } from "./index-ae75rja9.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-79g6edht.js";
+} from "./index-qgfnd206.js";
 import {
   atomicWriteFile
-} from "./index-mken64yj.js";
+} from "./index-0n7nm9e8.js";
 import {
   init_knowledge_types,
   isActiveStatus
@@ -713,7 +713,7 @@ async function applyConfidenceFloorAction(directory, touched, options) {
   const {
     readAuthoritativeKnowledgeCounterRollups,
     effectiveRetrievalOutcomes
-  } = await import("./knowledge-events-kdyv4jzn.js");
+  } = await import("./knowledge-events-79cak7eb.js");
   const rollups = await readAuthoritativeKnowledgeCounterRollups(directory);
   const flagIds = new Set;
   for (const e of atFloor) {
@@ -780,11 +780,11 @@ async function applyConfidenceFloorAction(directory, touched, options) {
     });
   }
   if (action === "quarantine" && toQuarantine.length > 0) {
-    const { quarantineEntry } = await import("./knowledge-validator-4bhtden9.js");
-    const { KnowledgeConfigSchema } = await import("./schema-v4qcqhek.js");
+    const { quarantineEntry } = await import("./knowledge-validator-qsecnt2d.js");
+    const { KnowledgeConfigSchema } = await import("./schema-19qsv6fw.js");
     let config;
     try {
-      const { loadPluginConfigWithMeta } = await import("./index-96m8ckpq.js");
+      const { loadPluginConfigWithMeta } = await import("./index-hexhzq5j.js");
       const { config: loadedConfig } = loadPluginConfigWithMeta(directory);
       config = KnowledgeConfigSchema.parse(loadedConfig.knowledge ?? {});
     } catch {

package/dist/cli/{index-02ajc6d1.js → index-7q56f3se.js}

@@ -2,14 +2,14 @@
 import {
   readKnowledge,
   transactKnowledge
-} from "./index-0tfgn5x0.js";
+} from "./index-77xy577c.js";
 import {
   init_git_executable,
   resolveGitExecutableAsync
 } from "./index-9e6fdz2h.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-79g6edht.js";
+} from "./index-qgfnd206.js";
 import {
   init_knowledge_types,
   isActiveStatus

package/dist/cli/{index-xyfdmrv7.js → index-80ekaf5b.js}

@@ -4,7 +4,7 @@ import {
   PlanSchema,
   TaskStatusSchema,
   init_loader
-} from "./index-3djxegsc.js";
+} from "./index-e2hs0bh7.js";
 import {
   assertProjectRoot,
   withEvidenceLock