opencode-swarm 7.164.6 → 7.164.7

package/dist/cli/{index-x76mprg2.js → index-9qkytpwa.js}

@@ -3,14 +3,17 @@ import {
   EvaluationRunV1Schema,
   GateAuditResultV1Schema,
   getProtectedEvaluationRunIds
-} from "./index-9qvmsyab.js";
+} from "./index-wgqeqy68.js";
+import {
+  validateWorkspaceRoot
+} from "./index-cw912re7.js";
 import {
   DURABILITY_CLASSES,
   getProjectDb,
   projectDbExists,
   readEffectiveSpecSync,
   withDurabilityClass
-} from "./index-zjg5ajf5.js";
+} from "./index-x3qzt684.js";
 import {
   getWorktreeMergeFailure
 } from "./index-zsrtt42s.js";
@@ -24,7 +27,7 @@ import {
   readTaskEvidence,
   readTaskEvidenceRaw,
   sanitizeTaskId
-} from "./index-g5714mpv.js";
+} from "./index-388sxv1b.js";
 import {
   LedgerStaleWriterError,
   appendLedgerEvent,
@@ -44,10 +47,10 @@ import {
   replayFromLedgerWithStatus,
   takeSnapshotEvent,
   takeSnapshotWithRetry
-} from "./index-j645xpsm.js";
+} from "./index-v1fj9exz.js";
 import {
   appendCoreEventSync
-} from "./index-pvp5tnn2.js";
+} from "./index-3sv8t7ca.js";
 import {
   init_executor,
   isUntrustedEnvKey,
@@ -63,7 +66,7 @@ import {
   estimateTokens,
   readSwarmFileAsync,
   validateSwarmPath
-} from "./index-2c3np82d.js";
+} from "./index-8tqqmsav.js";
 import {
   bunHash,
   bunWrite,
@@ -71,25 +74,28 @@ import {
 } from "./index-r3mvsbtq.js";
 import {
   PlanSchema
-} from "./index-ew99d4y6.js";
+} from "./index-xy59dnvq.js";
 import {
   GIT_BINARY_ENV_VAR,
   describeGitResolution,
   init_git_executable,
   resolveGitExecutable
 } from "./index-9e6fdz2h.js";
+import {
+  canonicalRootKeyFresh
+} from "./index-7qefgq4j.js";
 import {
   assertProjectRoot,
   tryAcquireLock,
   withEvidenceLock
-} from "./index-fxxja498.js";
+} from "./index-2czt53wz.js";
 import {
   invalidateCachedArtifact,
   readCachedParsedFile
-} from "./index-cyhw0der.js";
+} from "./index-t1qzjhnj.js";
 import {
   emit
-} from "./index-1dz8hv7p.js";
+} from "./index-kvq1e82k.js";
 import {
   ZodError,
   init_zod
@@ -115,7 +121,7 @@ import {
   writeFileSync as writeFileSync2
 } from "fs";
 import * as fsPromises from "fs/promises";
-import * as path5 from "path";
+import * as path4 from "path";
 
 // src/db/task-checkpoint-receipt.ts
 import { createHash } from "crypto";
@@ -883,7 +889,7 @@ var _internals = {
 
 // src/services/run-memory.ts
 import * as crypto from "crypto";
-import * as fs2 from "fs/promises";
+import * as fs from "fs/promises";
 
 // src/hooks/context-sanitizer.ts
 function sanitizeContextText(text) {
@@ -895,206 +901,6 @@ function sanitizeContextText(text) {
 
 // src/services/run-memory.ts
 init_logger();
-
-// src/utils/path-security.ts
-import * as fs from "fs";
-import * as path2 from "path";
-function containsPathTraversal(str) {
-  if (/\.\.[/\\]/.test(str))
-    return true;
-  if (/(?:^|[/\\])\.\.(?:[/\\]|$)/.test(str))
-    return true;
-  if (/%2e%2e/i.test(str))
-    return true;
-  if (/%2e\./i.test(str))
-    return true;
-  if (/%2e/i.test(str) && /\.\./.test(str))
-    return true;
-  if (/%252e%252e/i.test(str))
-    return true;
-  if (/\uff0e/.test(str))
-    return true;
-  if (/\u3002/.test(str))
-    return true;
-  if (/\uff65/.test(str))
-    return true;
-  if (/%2f/i.test(str))
-    return true;
-  if (/%5c/i.test(str))
-    return true;
-  return false;
-}
-function containsControlChars(str) {
-  for (const ch of str) {
-    const code = ch.codePointAt(0);
-    if (code === undefined)
-      continue;
-    if (code <= 31 || code >= 127 && code <= 159)
-      return true;
-    if (code >= 8234 && code <= 8238)
-      return true;
-    if (code >= 8294 && code <= 8297)
-      return true;
-  }
-  return false;
-}
-function validateWorkspaceRoot(directory) {
-  validateProjectDirectory(directory);
-}
-function validateDirectory(directory) {
-  if (!directory || directory.trim() === "") {
-    throw new Error("Invalid directory: empty");
-  }
-  if (containsPathTraversal(directory)) {
-    throw new Error("Invalid directory: path traversal detected");
-  }
-  if (containsControlChars(directory)) {
-    throw new Error("Invalid directory: control characters detected");
-  }
-  if (directory.startsWith("/") || directory.startsWith("\\")) {
-    throw new Error("Invalid directory: absolute path");
-  }
-  if (/^[A-Za-z]:[/\\]/.test(directory)) {
-    throw new Error("Invalid directory: Windows absolute path");
-  }
-}
-function validateProjectDirectory(directory) {
-  if (!directory || directory.trim() === "") {
-    throw new Error("Invalid project directory: empty");
-  }
-  if (containsPathTraversal(directory)) {
-    throw new Error("Invalid project directory: path traversal detected");
-  }
-  if (containsControlChars(directory)) {
-    throw new Error("Invalid project directory: control characters detected");
-  }
-  if (!path2.isAbsolute(directory) && !/^[A-Za-z]:[/\\]/.test(directory)) {
-    throw new Error("Invalid project directory: must be an absolute path");
-  }
-  assertNotSystemLocation(directory);
-}
-var DENIED_ROOT_SUBTREES = new Set([
-  "etc",
-  "usr",
-  "bin",
-  "sbin",
-  "lib",
-  "lib64",
-  "boot",
-  "dev",
-  "proc",
-  "sys",
-  "windows",
-  "winnt",
-  "program files",
-  "program files (x86)",
-  "programdata",
-  "system volume information"
-]);
-var DENIED_EXACT_ROOT_CHILDREN = new Set(["users", "home", "root"]);
-function assertNotSystemLocation(directory) {
-  for (const parser of [path2.win32, path2.posix]) {
-    if (!parser.isAbsolute(directory))
-      continue;
-    const normalized = parser.normalize(directory);
-    const { root } = parser.parse(normalized);
-    const segments = normalized.slice(root.length).split(/[/\\]/).filter((segment) => segment.length > 0);
-    if (segments.length === 0) {
-      throw new Error(`Invalid project directory: filesystem root is not a project root (${directory})`);
-    }
-    const first = (segments[0] ?? "").toLowerCase();
-    if (DENIED_ROOT_SUBTREES.has(first) || segments.length === 1 && DENIED_EXACT_ROOT_CHILDREN.has(first)) {
-      throw new Error(`Invalid project directory: system location is not a project root (${directory})`);
-    }
-  }
-}
-function resolveNearestExistingCanonical(inputPath, resolver) {
-  try {
-    return resolver(inputPath);
-  } catch {}
-  const lexicallyResolved = path2.resolve(inputPath);
-  let probe = lexicallyResolved;
-  const tail = [];
-  for (let i = 0;i < 4096; i++) {
-    const parent = path2.dirname(probe);
-    if (parent === probe) {
-      return lexicallyResolved;
-    }
-    tail.unshift(path2.basename(probe));
-    probe = parent;
-    try {
-      const canonicalAncestor = resolver(probe);
-      return path2.normalize(path2.join(canonicalAncestor, ...tail));
-    } catch {}
-  }
-  return lexicallyResolved;
-}
-function validateSymlinkBoundary(targetPath, rootPath) {
-  const realTarget = resolveNearestExistingCanonical(targetPath, _internals2.realpathSync);
-  const realRoot = resolveNearestExistingCanonical(rootPath, _internals2.realpathSync);
-  const normalizedTarget = path2.normalize(realTarget);
-  const normalizedRoot = path2.normalize(realRoot);
-  if (!normalizedTarget.startsWith(normalizedRoot + path2.sep) && normalizedTarget !== normalizedRoot) {
-    throw new Error(`Symlink resolution escaped boundary: ${realTarget} is not within ${realRoot}`);
-  }
-}
-function isCanonicalPathWithinRoot(targetPath, rootPath) {
-  let canonicalRoot;
-  try {
-    canonicalRoot = fs.realpathSync(rootPath);
-  } catch {
-    canonicalRoot = path2.normalize(rootPath);
-  }
-  let probe = path2.normalize(targetPath);
-  for (let i = 0;i < 4096; i++) {
-    try {
-      const canonicalProbe = fs.realpathSync(probe);
-      const relative2 = path2.relative(canonicalRoot, canonicalProbe);
-      return !relative2.startsWith("..") && !path2.isAbsolute(relative2);
-    } catch {
-      const parent = path2.dirname(probe);
-      if (parent === probe)
-        return false;
-      probe = parent;
-    }
-  }
-  return false;
-}
-function validateTargetWithinRoot(filePath, root) {
-  if (!filePath || filePath.trim() === "") {
-    return "Empty path";
-  }
-  if (path2.isAbsolute(filePath) || /^[A-Za-z]:[/\\]/.test(filePath)) {
-    return `Absolute path rejected: ${filePath}`;
-  }
-  if (containsPathTraversal(filePath)) {
-    return `Path traversal detected: ${filePath}`;
-  }
-  if (containsControlChars(filePath)) {
-    return `Control characters detected in path: ${filePath}`;
-  }
-  const resolved = path2.resolve(root, filePath);
-  const relative2 = path2.relative(root, resolved);
-  if (relative2.startsWith("..") || path2.isAbsolute(relative2)) {
-    return `Path escapes root: ${filePath}`;
-  }
-  if (!isCanonicalPathWithinRoot(resolved, root)) {
-    return `Path escapes root via symlink/junction: ${filePath}`;
-  }
-  return null;
-}
-var _internals2 = {
-  realpathSync: fs.realpathSync,
-  containsPathTraversal,
-  containsControlChars,
-  validateDirectory,
-  validateProjectDirectory,
-  validateSymlinkBoundary,
-  isCanonicalPathWithinRoot,
-  validateTargetWithinRoot
-};
-
-// src/services/run-memory.ts
 var RUN_MEMORY_FILENAME = "run-memory.jsonl";
 var MAX_SUMMARY_TOKENS = 500;
 function generateTaskFingerprint(taskId, fileTargets) {
@@ -1107,7 +913,7 @@ async function recordOutcome(directory, entry) {
   const resolvedPath = validateSwarmPath(directory, RUN_MEMORY_FILENAME);
   const line = `${JSON.stringify(entry)}
 `;
-  await fs2.appendFile(resolvedPath, line, { encoding: "utf-8" });
+  await fs.appendFile(resolvedPath, line, { encoding: "utf-8" });
 }
 async function getTaskHistory(directory, taskId) {
   validateWorkspaceRoot(directory);
@@ -1134,14 +940,14 @@ async function recordTaskAttempt(directory, input) {
   try {
     let history = [];
     try {
-      history = await _internals3.getTaskHistory(directory, input.taskId);
+      history = await _internals2.getTaskHistory(directory, input.taskId);
     } catch (err) {
       warn(`[run-memory] history read for task ${input.taskId} failed; recording with attemptNumber 1: ${err instanceof Error ? err.message : String(err)}`);
     }
     const entry = {
       timestamp: new Date().toISOString(),
       taskId: input.taskId,
-      taskFingerprint: _internals3.generateTaskFingerprint(input.taskId, input.fileTargets ?? []),
+      taskFingerprint: _internals2.generateTaskFingerprint(input.taskId, input.fileTargets ?? []),
       agent: input.agent,
       outcome: input.outcome,
       attemptNumber: history.length + 1
@@ -1155,7 +961,7 @@ async function recordTaskAttempt(directory, input) {
     if (typeof input.durationMs === "number") {
       entry.durationMs = input.durationMs;
     }
-    await _internals3.recordOutcome(directory, entry);
+    await _internals2.recordOutcome(directory, entry);
   } catch (err) {
     warn(`[run-memory] failed to record ${input.outcome} for task ${input.taskId}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -1219,10 +1025,10 @@ async function getRunMemorySummary(directory) {
   if (entries.length === 0) {
     return null;
   }
-  const groups = _internals3.groupByTaskId(entries);
+  const groups = _internals2.groupByTaskId(entries);
   const summaries = [];
   for (const [taskId, taskEntries] of groups) {
-    const summary = _internals3.summarizeTask(taskId, taskEntries);
+    const summary = _internals2.summarizeTask(taskId, taskEntries);
     if (summary) {
       summaries.push(summary);
     }
@@ -1252,7 +1058,7 @@ Use this data to avoid repeating known failure patterns.`;
   }
   return prefix + summaryText + suffix;
 }
-var _internals3 = {
+var _internals2 = {
   generateTaskFingerprint,
   recordOutcome,
   recordTaskAttempt,
@@ -1263,17 +1069,17 @@ var _internals3 = {
 };
 
 // src/turbo/epic/state.ts
+import * as fs2 from "fs";
+import * as path2 from "path";
 init_logger();
-import * as fs3 from "fs";
-import * as path3 from "path";
 var STATE_FILE = "epic-state.json";
 function nowISO() {
   return new Date().toISOString();
 }
 function ensureSwarmDir(directory) {
-  const swarmDir = path3.resolve(directory, ".swarm");
-  if (!fs3.existsSync(swarmDir)) {
-    fs3.mkdirSync(swarmDir, { recursive: true });
+  const swarmDir = path2.resolve(directory, ".swarm");
+  if (!fs2.existsSync(swarmDir)) {
+    fs2.mkdirSync(swarmDir, { recursive: true });
   }
   return swarmDir;
 }
@@ -1284,26 +1090,29 @@ function emptySessionState(sessionID) {
   return { sessionID, active: false };
 }
 var stateUnreadableMap = new Map;
+function stateKey(directory) {
+  return canonicalRootKeyFresh(directory);
+}
 function isStateUnreadable(directory) {
-  return stateUnreadableMap.get(directory) ?? false;
+  return stateUnreadableMap.get(stateKey(directory)) ?? false;
 }
 function markStateUnreadable(directory, reason) {
-  stateUnreadableMap.set(directory, true);
+  stateUnreadableMap.set(stateKey(directory), true);
   error(`[turbo/epic/state] state file unreadable for ${directory}: ${reason} \u2014 failing closed`);
 }
 function readPersisted(directory) {
   try {
-    const filePath = path3.join(directory, ".swarm", STATE_FILE);
-    if (!fs3.existsSync(filePath)) {
+    const filePath = path2.join(directory, ".swarm", STATE_FILE);
+    if (!fs2.existsSync(filePath)) {
       const seed = emptyPersisted();
       try {
         ensureSwarmDir(directory);
-        fs3.writeFileSync(filePath, `${JSON.stringify(seed, null, 2)}
+        fs2.writeFileSync(filePath, `${JSON.stringify(seed, null, 2)}
 `, "utf-8");
       } catch {}
       return seed;
     }
-    const raw = fs3.readFileSync(filePath, "utf-8");
+    const raw = fs2.readFileSync(filePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || parsed.version !== 1 || !parsed.sessions || typeof parsed.sessions !== "object" || Array.isArray(parsed.sessions)) {
       markStateUnreadable(directory, `malformed shape (version=${parsed?.version}, sessions type=${Array.isArray(parsed?.sessions) ? "array" : typeof parsed?.sessions})`);
@@ -1321,7 +1130,7 @@ function readPersisted(directory) {
   }
 }
 function writePersisted(directory, persisted) {
-  if (stateUnreadableMap.get(directory)) {
+  if (stateUnreadableMap.get(stateKey(directory))) {
     throw new Error(`Epic state is unreadable. Please repair .swarm/${STATE_FILE} before continuing.`);
   }
   let filePath;
@@ -1329,7 +1138,7 @@ function writePersisted(directory, persisted) {
   let payload;
   try {
     ensureSwarmDir(directory);
-    filePath = path3.join(directory, ".swarm", STATE_FILE);
+    filePath = path2.join(directory, ".swarm", STATE_FILE);
     tmpPath = `${filePath}.tmp.${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     persisted.updatedAt = nowISO();
     payload = `${JSON.stringify(persisted, null, 2)}
@@ -1340,20 +1149,20 @@ function writePersisted(directory, persisted) {
     throw new Error(`Epic state persistence prepare failed: ${msg}`);
   }
   try {
-    fs3.writeFileSync(tmpPath, payload, "utf-8");
-    fs3.renameSync(tmpPath, filePath);
+    fs2.writeFileSync(tmpPath, payload, "utf-8");
+    fs2.renameSync(tmpPath, filePath);
   } catch (error2) {
     const msg = error2 instanceof Error ? error2.message : String(error2);
     error(`[turbo/epic/state] Failed to persist ${STATE_FILE} atomically: ${msg}`);
     try {
-      if (fs3.existsSync(tmpPath))
-        fs3.unlinkSync(tmpPath);
+      if (fs2.existsSync(tmpPath))
+        fs2.unlinkSync(tmpPath);
     } catch {}
     throw new Error(`Epic state persistence failed: ${msg}`);
   }
 }
 function loadEpicSessionState(directory, sessionID) {
-  if (stateUnreadableMap.get(directory))
+  if (stateUnreadableMap.get(stateKey(directory)))
     return null;
   const persisted = readPersisted(directory);
   if (!persisted)
@@ -1361,7 +1170,7 @@ function loadEpicSessionState(directory, sessionID) {
   return persisted.sessions[sessionID] ?? null;
 }
 function saveEpicSessionState(directory, state) {
-  if (stateUnreadableMap.get(directory)) {
+  if (stateUnreadableMap.get(stateKey(directory))) {
     throw new Error(`Epic state is unreadable for ${directory}. Repair .swarm/${STATE_FILE} before continuing.`);
   }
   const persisted = readPersisted(directory);
@@ -1376,9 +1185,9 @@ function isEpicModeActive(directory, sessionID) {
   return state?.active === true;
 }
 function isEpicModeActiveForProject(directory) {
-  if (stateUnreadableMap.get(directory))
+  if (stateUnreadableMap.get(stateKey(directory)))
     return false;
-  if (!fs3.existsSync(path3.join(directory, ".swarm", STATE_FILE))) {
+  if (!fs2.existsSync(path2.join(directory, ".swarm", STATE_FILE))) {
     return false;
   }
   const persisted = readPersisted(directory);
@@ -1429,11 +1238,11 @@ function isLockContentionError(err) {
   return INDEX_LOCK_ERROR_RE.test(msg);
 }
 async function commitTaskCompletion(directory, taskId, description, scopePaths) {
-  if (!_internals4.isGitRepo(directory)) {
+  if (!_internals3.isGitRepo(directory)) {
     return { committed: false, reason: "no-git" };
   }
   try {
-    if (_internals4.hasExistingTaskCommit(directory, taskId)) {
+    if (_internals3.hasExistingTaskCommit(directory, taskId)) {
       return { committed: true, reason: "idempotent-skip" };
     }
   } catch {}
@@ -1454,15 +1263,15 @@ async function commitTaskCompletion(directory, taskId, description, scopePaths)
   for (let attempt = 0;attempt <= INDEX_LOCK_BACKOFF_MS.length; attempt++) {
     try {
       if (paths.length > 0) {
-        _internals4.stageScopedPaths(directory, paths);
+        _internals3.stageScopedPaths(directory, paths);
       }
-      _internals4.commitAllowEmpty(directory, message);
-      const sha = _internals4.gitHeadSha(directory);
+      _internals3.commitAllowEmpty(directory, message);
+      const sha = _internals3.gitHeadSha(directory);
       return { committed: true, reason: "success", sha };
     } catch (err) {
       lastError = err;
       if (attempt < INDEX_LOCK_BACKOFF_MS.length && isLockContentionError(err)) {
-        await _internals4.sleep(INDEX_LOCK_BACKOFF_MS[attempt]);
+        await _internals3.sleep(INDEX_LOCK_BACKOFF_MS[attempt]);
         continue;
       }
       break;
@@ -1472,7 +1281,7 @@ async function commitTaskCompletion(directory, taskId, description, scopePaths)
   criticalWarn(`[epic:task-commit] commit for task ${taskId} failed (non-fatal): ${msg}`);
   return { committed: false, reason: "commit-failed", error: msg };
 }
-var _internals4 = {
+var _internals3 = {
   isGitRepo: (cwd) => isGitRepo(cwd),
   stageScopedPaths: (cwd, paths) => {
     const CHUNK = 200;
@@ -1487,7 +1296,7 @@ var _internals4 = {
   gitHeadSha: (cwd) => {
     return _internals.gitExec(["rev-parse", "HEAD"], cwd).trim();
   },
-  sleep: (ms) => new Promise((resolve3) => setTimeout(resolve3, ms)),
+  sleep: (ms) => new Promise((resolve2) => setTimeout(resolve2, ms)),
   hasExistingTaskCommit: (cwd, taskId) => {
     const safeId = scrubTaskIdForGitSubject(taskId);
     const escaped = safeId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1504,8 +1313,8 @@ var _internals4 = {
 };
 
 // src/turbo/lean/conflicts.ts
-import * as fs4 from "fs";
-import * as path4 from "path";
+import * as fs3 from "fs";
+import * as path3 from "path";
 
 // src/utils/path.ts
 function normalizePath(p) {
@@ -1633,12 +1442,12 @@ function isProtectedPath(normalizedPath) {
   return false;
 }
 function readTaskScopes(directory, taskId) {
-  const scopePath = path4.join(directory, ".swarm", "scopes", `scope-${taskId}.json`);
+  const scopePath = path3.join(directory, ".swarm", "scopes", `scope-${taskId}.json`);
   try {
-    if (!fs4.existsSync(scopePath)) {
+    if (!fs3.existsSync(scopePath)) {
       return null;
     }
-    const raw = fs4.readFileSync(scopePath, "utf-8");
+    const raw = fs3.readFileSync(scopePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || !Array.isArray(parsed.files)) {
       return null;
@@ -1652,15 +1461,15 @@ function readTaskScopes(directory, taskId) {
 // src/utils/spec-hash.ts
 import { createHash as createHash3 } from "crypto";
 import * as fsSync2 from "fs";
-import { join as join4 } from "path";
+import { join as join3 } from "path";
 async function computeSpecHash(directory) {
-  const spec = _internals5.readEffectiveSpecSync(directory);
+  const spec = _internals4.readEffectiveSpecSync(directory);
   if (!spec)
     return null;
   return createHash3("sha256").update(spec.content, "utf-8").digest("hex");
 }
 async function isSpecStale(directory, plan) {
-  const currentHash = await _internals5.computeSpecHash(directory);
+  const currentHash = await _internals4.computeSpecHash(directory);
   if (!plan.specHash) {
     return { stale: false };
   }
@@ -1681,7 +1490,7 @@ async function isSpecStale(directory, plan) {
   return { stale: false };
 }
 function isObligationPreserving(directory) {
-  const snapshotPath = join4(directory, ".swarm", "spec-snapshot.md");
+  const snapshotPath = join3(directory, ".swarm", "spec-snapshot.md");
   try {
     let recordedContent;
     try {
@@ -1689,15 +1498,15 @@ function isObligationPreserving(directory) {
     } catch {
       return false;
     }
-    const currentResult = _internals5.readEffectiveSpecSync(directory);
+    const currentResult = _internals4.readEffectiveSpecSync(directory);
     if (!currentResult || !currentResult.content) {
       return false;
     }
     const currentContent = currentResult.content;
-    const normalize2 = (text) => text.replace(/\r\n/g, `
+    const normalize = (text) => text.replace(/\r\n/g, `
 `);
-    const recordedNorm = normalize2(recordedContent);
-    const currentNorm = normalize2(currentContent);
+    const recordedNorm = normalize(recordedContent);
+    const currentNorm = normalize(currentContent);
     const splitParagraphs = (text) => text.split(/\n\s*\n/).map((p) => p.trim()).filter((p) => p.length > 0);
     const recordedParagraphs = splitParagraphs(recordedNorm);
     const currentParagraphs = splitParagraphs(currentNorm);
@@ -1719,7 +1528,7 @@ function isObligationPreserving(directory) {
     return false;
   }
 }
-var _internals5 = {
+var _internals4 = {
   computeSpecDiff,
   computeSpecHash,
   isObligationPreserving,
@@ -1727,7 +1536,7 @@ var _internals5 = {
   readEffectiveSpecSync
 };
 function computeSpecDiff(directory) {
-  const snapshotPath = join4(directory, ".swarm", "spec-snapshot.md");
+  const snapshotPath = join3(directory, ".swarm", "spec-snapshot.md");
   let recordedContent;
   try {
     const snapshotSize = fsSync2.statSync(snapshotPath).size;
@@ -1739,16 +1548,16 @@ function computeSpecDiff(directory) {
   } catch {
     return null;
   }
-  const spec = _internals5.readEffectiveSpecSync(directory);
+  const spec = _internals4.readEffectiveSpecSync(directory);
   if (!spec) {
     return null;
   }
   const currentContent = spec.content;
-  const normalize2 = (text) => text.replace(/\r\n/g, `
+  const normalize = (text) => text.replace(/\r\n/g, `
 `);
-  const recordedLines = normalize2(recordedContent).split(`
+  const recordedLines = normalize(recordedContent).split(`
 `);
-  const currentLines = normalize2(currentContent).split(`
+  const currentLines = normalize(currentContent).split(`
 `);
   const diffLines = computeLcsDiff(recordedLines, currentLines);
   const MAX_DIFF_LINES = 300;
@@ -1833,7 +1642,7 @@ var startupLedgerCheckedWorkspaces = new Set;
 var ledgerStaleWorkspaces = new Set;
 var recoveryMutexes = new Map;
 var PLAN_JSON_CACHE_NAMESPACE = "plan-json:validated:v1";
-var _internals6 = {
+var _internals5 = {
   loadPlan,
   loadPlanJsonOnly,
   regeneratePlanMarkdown,
@@ -1931,7 +1740,7 @@ async function retryCasWithBackoff(directory, eventInput, options) {
         expectedHashPrefix: currentExpected.slice(0, 8),
         delayMs
       });
-      await new Promise((resolve4) => setTimeout(resolve4, delayMs));
+      await new Promise((resolve3) => setTimeout(resolve3, delayMs));
       if (options.verifyValid) {
         const stillValid = await options.verifyValid();
         if (!stillValid)
@@ -1974,7 +1783,7 @@ async function getLatestLedgerHash(directory) {
   }
 }
 async function surfaceLedgerStaleIfPersisted(directory, plan) {
-  const resolvedWorkspace = path5.resolve(directory);
+  const resolvedWorkspace = canonicalRootKeyFresh(directory);
   if (!ledgerStaleWorkspaces.has(resolvedWorkspace)) {
     return plan;
   }
@@ -1993,7 +1802,7 @@ async function surfaceLedgerStaleIfPersisted(directory, plan) {
   return plan;
 }
 async function parsePlanJsonCached(directory) {
-  const planJsonPath = path5.resolve(directory, ".swarm", "plan.json");
+  const planJsonPath = path4.resolve(directory, ".swarm", "plan.json");
   return readCachedParsedFile(planJsonPath, PLAN_JSON_CACHE_NAMESPACE, () => readSwarmFileAsync(directory, "plan.json"), (planJsonContent) => {
     if (planJsonContent.includes("\x00") || planJsonContent.includes("\uFFFD")) {
       throw new Error("Plan rejected: .swarm/plan.json contains null bytes or invalid encoding");
@@ -2055,13 +1864,13 @@ async function isPlanMdInSync(directory, plan, cache) {
 }
 async function regeneratePlanMarkdown(directory, plan) {
   assertProjectRoot(directory);
-  const swarmDir = path5.resolve(directory, ".swarm");
+  const swarmDir = path4.resolve(directory, ".swarm");
   const contentHash = computePlanContentHash(plan);
   const markdown = derivePlanMarkdown(plan);
   const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-  const mdPath = path5.join(swarmDir, "plan.md");
-  const mdTempPath = path5.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const mdPath = path4.join(swarmDir, "plan.md");
+  const mdTempPath = path4.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   try {
     await bunWrite(mdTempPath, markdownWithHash);
     renameSync2(mdTempPath, mdPath);
@@ -2086,7 +1895,7 @@ async function loadPlan(directory, cache) {
           const inSync = await isPlanMdInSync(directory, validated, cache);
           if (!inSync) {
             try {
-              await _internals6.regeneratePlanMarkdown(directory, validated);
+              await _internals5.regeneratePlanMarkdown(directory, validated);
             } catch (regenError) {
               warn(`Failed to regenerate plan.md: ${regenError instanceof Error ? regenError.message : String(regenError)}. Proceeding with plan.json only.`);
             }
@@ -2094,7 +1903,7 @@ async function loadPlan(directory, cache) {
           if (await ledgerExists(directory)) {
             const planHash = computePlanLedgerHash(validated);
             const ledgerHash = await getLatestLedgerHash(directory);
-            const resolvedWorkspace = path5.resolve(directory);
+            const resolvedWorkspace = canonicalRootKeyFresh(directory);
             if (!startupLedgerCheckedWorkspaces.has(resolvedWorkspace)) {
               startupLedgerCheckedWorkspaces.add(resolvedWorkspace);
               if (ledgerHash !== "" && planHash !== ledgerHash) {
@@ -2169,7 +1978,7 @@ async function loadPlan(directory, cache) {
                 try {
                   assertProjectRoot(directory);
                   const diffInfo = computeSpecDiff(directory);
-                  const specStalenessPath = path5.join(directory, ".swarm", "spec-staleness.json");
+                  const specStalenessPath = path4.join(directory, ".swarm", "spec-staleness.json");
                   await fsPromises.writeFile(specStalenessPath, JSON.stringify({
                     type: "spec_stale_detected",
                     timestamp: new Date().toISOString(),
@@ -2249,11 +2058,11 @@ async function loadPlan(directory, cache) {
     return migrated;
   }
   if (await ledgerExists(directory)) {
-    const resolvedDir = path5.resolve(directory);
+    const resolvedDir = canonicalRootKeyFresh(directory);
     const existingMutex = recoveryMutexes.get(resolvedDir);
     if (existingMutex) {
       await existingMutex;
-      const postRecoveryPlan = await _internals6.loadPlanJsonOnly(directory);
+      const postRecoveryPlan = await _internals5.loadPlanJsonOnly(directory);
       if (postRecoveryPlan)
         return postRecoveryPlan;
     }
@@ -2313,7 +2122,7 @@ async function loadPlan(directory, cache) {
   return null;
 }
 async function savePlanWithAutoAcknowledgedRemovals(directory, plan, source, reason, options) {
-  const existing = await _internals6.loadPlanJsonOnly(directory);
+  const existing = await _internals5.loadPlanJsonOnly(directory);
   const newIds = new Set;
   for (const phase of plan.phases) {
     for (const task of phase.tasks)
@@ -2363,7 +2172,7 @@ async function savePlan(directory, plan, options) {
   }
   if (options?.preserveCompletedStatuses !== false) {
     try {
-      const currentPlan2 = await _internals6.loadPlanJsonOnly(directory);
+      const currentPlan2 = await _internals5.loadPlanJsonOnly(directory);
       if (currentPlan2) {
         const completedTaskIds = new Set;
         for (const phase of currentPlan2.phases) {
@@ -2385,7 +2194,7 @@ async function savePlan(directory, plan, options) {
     } catch {}
   }
   derivePhaseStatusesInPlace(validated);
-  const currentPlan = await _internals6.loadPlanJsonOnly(directory);
+  const currentPlan = await _internals5.loadPlanJsonOnly(directory);
   const planId = derivePlanId(validated);
   const planHashForInit = computePlanLedgerHash(validated);
   if (!await ledgerExists(directory)) {
@@ -2401,9 +2210,9 @@ async function savePlan(directory, plan, options) {
   } else {
     const existingEvents = await readLedgerEvents(directory);
     if (existingEvents.length > 0 && existingEvents[0].plan_id !== planId) {
-      const swarmDir2 = path5.resolve(directory, ".swarm");
-      const oldLedgerPath = path5.join(swarmDir2, "plan-ledger.jsonl");
-      const oldLedgerBackupPath = path5.join(swarmDir2, `plan-ledger.backup-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
+      const swarmDir2 = path4.resolve(directory, ".swarm");
+      const oldLedgerPath = path4.join(swarmDir2, "plan-ledger.jsonl");
+      const oldLedgerBackupPath = path4.join(swarmDir2, `plan-ledger.backup-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
       let backupExists = false;
       if (existsSync3(oldLedgerPath)) {
         try {
@@ -2443,7 +2252,7 @@ async function savePlan(directory, plan, options) {
         }
       }
       if (initSucceeded && backupExists) {
-        const archivePath = path5.join(swarmDir2, `plan-ledger.archived-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
+        const archivePath = path4.join(swarmDir2, `plan-ledger.archived-${Date.now()}-${Math.floor(Math.random() * 1e9)}.jsonl`);
         try {
           renameSync2(oldLedgerBackupPath, archivePath);
           warn(`[savePlan] Ledger identity mismatch (was "${existingEvents[0].plan_id}", now "${planId}") \u2014 archived old ledger to ${archivePath} and reinitializing.`);
@@ -2468,7 +2277,7 @@ async function savePlan(directory, plan, options) {
           const toRemove = archivedSiblings.slice(0, archivedSiblings.length - MAX_ARCHIVED_SIBLINGS);
           for (const file of toRemove) {
             try {
-              unlinkSync2(path5.join(swarmDir2, file));
+              unlinkSync2(path4.join(swarmDir2, file));
             } catch {}
           }
         }
@@ -2571,7 +2380,7 @@ async function savePlan(directory, plan, options) {
             expectedHash: currentHash,
             planHashAfter: hashAfter,
             verifyValid: async () => {
-              const onDisk = await _internals6.loadPlanJsonOnly(directory);
+              const onDisk = await _internals5.loadPlanJsonOnly(directory);
               if (!onDisk)
                 return true;
               for (const p of onDisk.phases) {
@@ -2610,7 +2419,7 @@ async function savePlan(directory, plan, options) {
               expectedHash: currentHash,
               planHashAfter: hashAfter,
               verifyValid: async () => {
-                const onDisk = await _internals6.loadPlanJsonOnly(directory);
+                const onDisk = await _internals5.loadPlanJsonOnly(directory);
                 if (!onDisk)
                   return true;
                 for (const p of onDisk.phases) {
@@ -2651,9 +2460,9 @@ async function savePlan(directory, plan, options) {
       source: "savePlan_manager"
     });
   }
-  const swarmDir = path5.resolve(directory, ".swarm");
-  const planPath = path5.join(swarmDir, "plan.json");
-  const tempPath = path5.join(swarmDir, `plan.json.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const swarmDir = path4.resolve(directory, ".swarm");
+  const planPath = path4.join(swarmDir, "plan.json");
+  const tempPath = path4.join(swarmDir, `plan.json.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   try {
     await bunWrite(tempPath, JSON.stringify(projectedPlan, null, 2));
     options?.preCommitCheck?.();
@@ -2665,7 +2474,7 @@ async function savePlan(directory, plan, options) {
   }
   invalidateCachedArtifact(planPath);
   try {
-    const markerPath = path5.join(swarmDir, ".plan-write-marker");
+    const markerPath = path4.join(swarmDir, ".plan-write-marker");
     const inProgressMarker = JSON.stringify({
       source: "plan_manager",
       timestamp: new Date().toISOString(),
@@ -2680,8 +2489,8 @@ async function savePlan(directory, plan, options) {
     const markdown = derivePlanMarkdown(projectedPlan);
     const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-    const mdPath = path5.join(swarmDir, "plan.md");
-    const mdTempPath = path5.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+    const mdPath = path4.join(swarmDir, "plan.md");
+    const mdTempPath = path4.join(swarmDir, `plan.md.tmp.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
     try {
       await bunWrite(mdTempPath, markdownWithHash);
       renameSync2(mdTempPath, mdPath);
@@ -2703,7 +2512,7 @@ ${markdown}`;
     } catch {}
   }
   try {
-    const markerPath = path5.join(swarmDir, ".plan-write-marker");
+    const markerPath = path4.join(swarmDir, ".plan-write-marker");
     const tasksCount = projectedPlan.phases.reduce((sum, phase) => sum + phase.tasks.length, 0);
     const marker = JSON.stringify({
       source: "plan_manager",
@@ -2751,11 +2560,11 @@ async function rebuildPlan(directory, plan, options) {
   const targetPlan = plan ?? await replayFromLedger(directory);
   if (!targetPlan)
     return null;
-  const swarmDir = path5.join(directory, ".swarm");
-  const planPath = path5.join(swarmDir, "plan.json");
-  const mdPath = path5.join(swarmDir, "plan.md");
+  const swarmDir = path4.join(directory, ".swarm");
+  const planPath = path4.join(swarmDir, "plan.json");
+  const mdPath = path4.join(swarmDir, "plan.md");
   mkdirSync2(swarmDir, { recursive: true });
-  const tempPlanPath = path5.join(swarmDir, `plan.json.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const tempPlanPath = path4.join(swarmDir, `plan.json.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   {
     const fd = openSync(tempPlanPath, "w");
     try {
@@ -2768,7 +2577,7 @@ async function rebuildPlan(directory, plan, options) {
   renameSync2(tempPlanPath, planPath);
   invalidateCachedArtifact(planPath);
   try {
-    const markerPath = path5.join(swarmDir, ".plan-write-marker");
+    const markerPath = path4.join(swarmDir, ".plan-write-marker");
     const inProgressMarker = JSON.stringify({
       source: "plan_manager",
       timestamp: new Date().toISOString(),
@@ -2783,13 +2592,13 @@ async function rebuildPlan(directory, plan, options) {
     const markdown = derivePlanMarkdown(targetPlan);
     const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-    const tempMdPath = path5.join(swarmDir, `plan.md.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+    const tempMdPath = path4.join(swarmDir, `plan.md.rebuild.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
     await bunWrite(tempMdPath, markdownWithHash);
     renameSync2(tempMdPath, mdPath);
     invalidateCachedArtifact(mdPath);
   } finally {
     try {
-      const markerPath = path5.join(swarmDir, ".plan-write-marker");
+      const markerPath = path4.join(swarmDir, ".plan-write-marker");
       const tasksCount = targetPlan.phases.reduce((sum, phase) => sum + phase.tasks.length, 0);
       const marker = JSON.stringify({
         source: "plan_manager",
@@ -2853,14 +2662,14 @@ async function closePlanTerminalState(directory, plan, options) {
     planHashAfter: hashAfter,
     source: "close_terminal"
   });
-  const swarmDir = path5.join(directory, ".swarm");
-  const planPath = path5.join(swarmDir, "plan.json");
-  const tempPlanPath = path5.join(swarmDir, `plan.json.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+  const swarmDir = path4.join(directory, ".swarm");
+  const planPath = path4.join(swarmDir, "plan.json");
+  const tempPlanPath = path4.join(swarmDir, `plan.json.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
   await bunWrite(tempPlanPath, JSON.stringify(validated, null, 2));
   renameSync2(tempPlanPath, planPath);
   invalidateCachedArtifact(planPath);
   try {
-    const markerPath = path5.join(swarmDir, ".plan-write-marker");
+    const markerPath = path4.join(swarmDir, ".plan-write-marker");
     const inProgressMarker = JSON.stringify({
       source: "plan_manager_close",
       timestamp: new Date().toISOString(),
@@ -2871,18 +2680,18 @@ async function closePlanTerminalState(directory, plan, options) {
     await bunWrite(markerPath, inProgressMarker);
   } catch {}
   try {
-    const mdPath = path5.join(swarmDir, "plan.md");
+    const mdPath = path4.join(swarmDir, "plan.md");
     const contentHash = computePlanContentHash(validated);
     const markdown = derivePlanMarkdown(validated);
     const markdownWithHash = `<!-- PLAN_HASH: ${contentHash} -->
 ${markdown}`;
-    const mdTempPath = path5.join(swarmDir, `plan.md.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
+    const mdTempPath = path4.join(swarmDir, `plan.md.close.${Date.now()}.${Math.floor(Math.random() * 1e9)}`);
     await bunWrite(mdTempPath, markdownWithHash);
     renameSync2(mdTempPath, mdPath);
     invalidateCachedArtifact(mdPath);
   } finally {
     try {
-      const markerPath = path5.join(swarmDir, ".plan-write-marker");
+      const markerPath = path4.join(swarmDir, ".plan-write-marker");
       const tasksCount = validated.phases.reduce((sum, phase) => sum + phase.tasks.length, 0);
       const marker = JSON.stringify({
         source: "plan_manager_close",
@@ -2910,7 +2719,7 @@ async function updateTaskStatus(directory, taskId, status, options) {
     return "pending";
   };
   {
-    const currentPlan = await _internals6.loadPlanJsonOnly(directory);
+    const currentPlan = await _internals5.loadPlanJsonOnly(directory);
     if (currentPlan) {
       const currentTask = currentPlan.phases.flatMap((p) => p.tasks).find((t) => t.id === taskId);
       const settled = currentTask && currentTask.status !== "pending" && currentTask.status !== "in_progress";
@@ -2923,7 +2732,7 @@ async function updateTaskStatus(directory, taskId, status, options) {
   }
   const MAX_OUTER_RETRIES = 1;
   for (let attempt = 0;attempt <= MAX_OUTER_RETRIES; attempt++) {
-    const plan = await _internals6.loadPlan(directory);
+    const plan = await _internals5.loadPlan(directory);
     if (plan === null) {
       throw new Error(`Plan not found in directory: ${directory}`);
     }
@@ -2954,7 +2763,7 @@ async function updateTaskStatus(directory, taskId, status, options) {
       if (status === "completed" || status === "blocked") {
         const recordedTask = updatedPlan.phases.flatMap((phase) => phase.tasks).find((candidate) => candidate.id === taskId);
         try {
-          await _internals6.recordTaskAttempt(directory, {
+          await _internals5.recordTaskAttempt(directory, {
             taskId,
             agent: "plan-status",
             outcome: status === "completed" ? "pass" : "fail",
@@ -2965,8 +2774,8 @@ async function updateTaskStatus(directory, taskId, status, options) {
           warn(`[plan/manager] run-memory record for ${taskId} failed: ${err instanceof Error ? err.message : String(err)}`);
         }
       }
-      if (status === "completed" && _internals6.isGitRepo(directory) && _internals6.isEpicModeActiveForProject(directory)) {
-        const mergeFailure = _internals6.getWorktreeMergeFailure(taskId);
+      if (status === "completed" && _internals5.isGitRepo(directory) && _internals5.isEpicModeActiveForProject(directory)) {
+        const mergeFailure = _internals5.getWorktreeMergeFailure(taskId);
         if (mergeFailure) {
           criticalWarn(`[plan/manager] Rule 2 auto-commit SKIPPED for ${taskId}: worktree merge-back ${mergeFailure.outcome} at stage '${mergeFailure.stage}'. The task's changes are NOT in the main tree, so no completion marker is written (Rule 3 must not treat this task as satisfied). Resolve the preserved worktree, then re-run the task. Detail: ${mergeFailure.message}`);
           return updatedPlan;
@@ -2980,8 +2789,8 @@ async function updateTaskStatus(directory, taskId, status, options) {
               break;
             }
           }
-          const canonicalScope = _internals6.readTaskScopes(directory, taskId);
-          await _internals6.commitTaskCompletion(directory, taskId, taskDescription, canonicalScope ?? undefined);
+          const canonicalScope = _internals5.readTaskScopes(directory, taskId);
+          await _internals5.commitTaskCompletion(directory, taskId, taskDescription, canonicalScope ?? undefined);
         } catch (commitErr) {
           criticalWarn(`[plan/manager] Rule 2 auto-commit for ${taskId} threw (non-fatal): ${commitErr instanceof Error ? commitErr.message : String(commitErr)}`);
         }
@@ -3296,17 +3105,17 @@ init_zod();
 import {
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync2,
-  realpathSync as realpathSync2,
+  realpathSync,
   renameSync as renameSync3,
   rmSync,
   statSync as statSync2
 } from "fs";
-import * as fs7 from "fs/promises";
-import * as path7 from "path";
+import * as fs6 from "fs/promises";
+import * as path6 from "path";
 
 // src/evaluation/retention.ts
-import * as fs5 from "fs/promises";
-import * as path6 from "path";
+import * as fs4 from "fs/promises";
+import * as path5 from "path";
 function artifactKey(artifact) {
   return `${artifact.namespace}/${artifact.id}`;
 }
@@ -3314,10 +3123,10 @@ function validId(value) {
   return /^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$/.test(value);
 }
 async function evaluationRunCandidates(directory) {
-  const root = path6.join(directory, ".swarm", "evolution", "runs");
+  const root = path5.join(directory, ".swarm", "evolution", "runs");
   let entries = [];
   try {
-    entries = await fs5.readdir(root, { withFileTypes: true });
+    entries = await fs4.readdir(root, { withFileTypes: true });
   } catch (error2) {
     if (error2.code === "ENOENT") {
       return { candidates: [], corrupt: [] };
@@ -3333,9 +3142,9 @@ async function evaluationRunCandidates(directory) {
     if (!validId(id))
       continue;
     const artifact = { namespace: "evaluation-run", id };
-    const target = path6.join(root, entry.name);
+    const target = path5.join(root, entry.name);
     try {
-      const run = EvaluationRunV1Schema.parse(JSON.parse(await fs5.readFile(target, "utf8")));
+      const run = EvaluationRunV1Schema.parse(JSON.parse(await fs4.readFile(target, "utf8")));
       if (run.runId !== id)
         throw new Error("run id/path mismatch");
       candidates.push({
@@ -3351,10 +3160,10 @@ async function evaluationRunCandidates(directory) {
   return { candidates, corrupt };
 }
 async function gateAuditCandidates(directory) {
-  const root = path6.join(directory, ".swarm", "evidence", "gate-audit");
+  const root = path5.join(directory, ".swarm", "evidence", "gate-audit");
   let entries = [];
   try {
-    entries = await fs5.readdir(root, { withFileTypes: true });
+    entries = await fs4.readdir(root, { withFileTypes: true });
   } catch (error2) {
     if (error2.code === "ENOENT") {
       return { candidates: [], corrupt: [] };
@@ -3367,9 +3176,9 @@ async function gateAuditCandidates(directory) {
     if (!entry.isDirectory() || !validId(entry.name))
       continue;
     const artifact = { namespace: "gate-audit", id: entry.name };
-    const target = path6.join(root, entry.name);
+    const target = path5.join(root, entry.name);
     try {
-      const result = GateAuditResultV1Schema.parse(JSON.parse(await fs5.readFile(path6.join(target, "results.json"), "utf8")));
+      const result = GateAuditResultV1Schema.parse(JSON.parse(await fs4.readFile(path5.join(target, "results.json"), "utf8")));
       if (result.runId !== entry.name)
         throw new Error("run id/path mismatch");
       candidates.push({
@@ -3400,10 +3209,10 @@ async function protectedArtifacts(directory) {
 }
 async function removeCandidate(candidate) {
   if (candidate.kind === "directory") {
-    await fs5.rm(candidate.target, { recursive: true, force: true });
+    await fs4.rm(candidate.target, { recursive: true, force: true });
     return;
   }
-  await fs5.unlink(candidate.target);
+  await fs4.unlink(candidate.target);
 }
 var _retentionInternals = {
   protectedArtifacts,
@@ -3411,7 +3220,7 @@ var _retentionInternals = {
 };
 async function archiveEvaluationArtifacts(args) {
   assertProjectRoot(args.directory);
-  return withEvidenceLock(args.directory, path6.join("evolution", "retention-index"), "evaluation-retention", "archive", async () => {
+  return withEvidenceLock(args.directory, path5.join("evolution", "retention-index"), "evaluation-retention", "archive", async () => {
     const inventory = await retentionCandidates(args.directory);
     let protectedKeys = await _retentionInternals.protectedArtifacts(args.directory);
     const protectedRefs = inventory.candidates.filter((candidate) => protectedKeys.has(artifactKey(candidate.artifact))).map((candidate) => candidate.artifact);
@@ -3460,7 +3269,7 @@ async function archiveEvaluationArtifacts(args) {
 }
 
 // src/evidence/documents-retention.ts
-import * as fs6 from "fs";
+import * as fs5 from "fs";
 import * as fsp from "fs/promises";
 import * as readline from "readline";
 var EVIDENCE_CACHE_FILE = "evidence-cache/documents.jsonl";
@@ -3468,13 +3277,13 @@ var MAX_READ_BYTES = 100 * 1024 * 1024;
 var RENAME_MAX_ATTEMPTS = 5;
 var RENAME_BACKOFF_MS = 10;
 var RENAME_RETRY_CODES = new Set(["EPERM", "EBUSY", "ENOTEMPTY", "EACCES"]);
-var _internals7 = {
+var _internals6 = {
   stat: (p) => fsp.stat(p),
-  createReadStream: (p, options) => fs6.createReadStream(p, options),
-  openSync: (p, flags) => fs6.openSync(p, flags),
-  writeSync: (fd, data, position) => fs6.writeSync(fd, data, position),
-  fsyncSync: (fd) => fs6.fsyncSync(fd),
-  closeSync: (fd) => fs6.closeSync(fd),
+  createReadStream: (p, options) => fs5.createReadStream(p, options),
+  openSync: (p, flags) => fs5.openSync(p, flags),
+  writeSync: (fd, data, position) => fs5.writeSync(fd, data, position),
+  fsyncSync: (fd) => fs5.fsyncSync(fd),
+  closeSync: (fd) => fs5.closeSync(fd),
   renameWithRetry: atomicRenameWithRetry,
   unlink: (p) => fsp.unlink(p)
 };
@@ -3491,7 +3300,7 @@ async function atomicRenameWithRetry(src, dst, renameFn = fsp.rename) {
         throw err;
       }
       if (attempt < RENAME_MAX_ATTEMPTS - 1) {
-        await new Promise((resolve4) => setTimeout(resolve4, RENAME_BACKOFF_MS));
+        await new Promise((resolve3) => setTimeout(resolve3, RENAME_BACKOFF_MS));
       }
     }
   }
@@ -3510,9 +3319,9 @@ function emptyResult(dryRun) {
   };
 }
 async function readCacheRows(filePath) {
-  const stat2 = await _internals7.stat(filePath);
+  const stat2 = await _internals6.stat(filePath);
   const bytesBefore = stat2.size;
-  const stream = _internals7.createReadStream(filePath, {
+  const stream = _internals6.createReadStream(filePath, {
     encoding: "utf8",
     highWaterMark: 64 * 1024
   });
@@ -3588,23 +3397,23 @@ async function rewriteAtomic(filePath, survivors) {
 `)}
 ` : "";
   let succeeded = false;
-  const fd = _internals7.openSync(tmpPath, "w");
+  const fd = _internals6.openSync(tmpPath, "w");
   try {
-    _internals7.writeSync(fd, payload, 0);
-    _internals7.fsyncSync(fd);
-    _internals7.closeSync(fd);
-    await _internals7.renameWithRetry(tmpPath, filePath);
+    _internals6.writeSync(fd, payload, 0);
+    _internals6.fsyncSync(fd);
+    _internals6.closeSync(fd);
+    await _internals6.renameWithRetry(tmpPath, filePath);
     succeeded = true;
   } catch (err) {
     try {
-      _internals7.closeSync(fd);
+      _internals6.closeSync(fd);
     } catch {}
     const msg = err instanceof Error ? err.message : String(err);
     throw new Error(`documents-cache rewrite failed: ${msg}`);
   } finally {
     if (!succeeded) {
       try {
-        await _internals7.unlink(tmpPath);
+        await _internals6.unlink(tmpPath);
       } catch {}
     }
   }
@@ -3617,7 +3426,7 @@ async function pruneEvidenceDocuments(args) {
   const filePath = validateSwarmPath(args.directory, EVIDENCE_CACHE_FILE);
   let stat2;
   try {
-    stat2 = await _internals7.stat(filePath);
+    stat2 = await _internals6.stat(filePath);
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT")
@@ -3721,21 +3530,21 @@ function isSecretscanEvidence(evidence) {
 var sanitizeTaskId2 = sanitizeTaskId;
 function validateProjectRoot(directory) {
   assertProjectRoot(directory, {
-    realpathSync: _internals8.realpathSync,
-    statSync: _internals8.statSync
+    realpathSync: _internals7.realpathSync,
+    statSync: _internals7.statSync
   }, "evidence");
 }
 async function saveEvidence(directory, taskId, evidence, abortSignal) {
   abortSignal?.throwIfAborted();
-  _internals8.validateProjectRoot(directory);
+  _internals7.validateProjectRoot(directory);
   const sanitizedTaskId = sanitizeTaskId2(taskId);
-  const relativePath = path7.join("evidence", sanitizedTaskId, "evidence.json");
+  const relativePath = path6.join("evidence", sanitizedTaskId, "evidence.json");
   validateSwarmPath(directory, relativePath);
-  _internals8.validateEvidence(evidence);
+  _internals7.validateEvidence(evidence);
   return withEvidenceLock(directory, relativePath, "evidence-manager", sanitizedTaskId, async () => {
     abortSignal?.throwIfAborted();
     const evidencePath = validateSwarmPath(directory, relativePath);
-    const evidenceDir = path7.dirname(evidencePath);
+    const evidenceDir = path6.dirname(evidencePath);
     let bundle;
     const existingContent = await readSwarmFileAsync(directory, relativePath);
     abortSignal?.throwIfAborted();
@@ -3779,7 +3588,7 @@ async function saveEvidence(directory, taskId, evidence, abortSignal) {
       throw new Error(`Evidence bundle size (${bundleJson.length} bytes) exceeds maximum (${EVIDENCE_MAX_JSON_BYTES} bytes)`);
     }
     mkdirSync3(evidenceDir, { recursive: true });
-    const tempPath = path7.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
+    const tempPath = path6.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
     try {
       await bunWrite(tempPath, bundleJson);
       abortSignal?.throwIfAborted();
@@ -3825,7 +3634,7 @@ function wrapFlatRetrospective(flatEntry, taskId) {
 }
 async function loadEvidence(directory, taskId, options) {
   const sanitizedTaskId = sanitizeTaskId2(taskId);
-  const relativePath = path7.join("evidence", sanitizedTaskId, "evidence.json");
+  const relativePath = path6.join("evidence", sanitizedTaskId, "evidence.json");
   if (relativePath.length > 4096) {
     return { status: "not_found" };
   }
@@ -3841,7 +3650,7 @@ async function loadEvidence(directory, taskId, options) {
     return { status: "invalid_schema", errors: ["Invalid JSON"] };
   }
   if (isFlatRetrospective(parsed)) {
-    const wrappedBundle = _internals8.wrapFlatRetrospective(parsed, sanitizedTaskId);
+    const wrappedBundle = _internals7.wrapFlatRetrospective(parsed, sanitizedTaskId);
     try {
       const validated = EvidenceBundleSchema.parse(wrappedBundle);
       if (options?.migrate === false) {
@@ -3850,12 +3659,12 @@ async function loadEvidence(directory, taskId, options) {
       try {
         validateProjectRoot(directory);
         await withEvidenceLock(directory, relativePath, "evidence-loader", sanitizedTaskId, async () => {
-          const evidenceDir = path7.dirname(evidencePath);
+          const evidenceDir = path6.dirname(evidencePath);
           const bundleJson = JSON.stringify(validated);
-          const tempPath = path7.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
+          const tempPath = path6.join(evidenceDir, `evidence.json.tmp.${Date.now()}.${process.pid}`);
           try {
             await bunWrite(tempPath, bundleJson);
-            await fs7.rename(tempPath, evidencePath);
+            await fs6.rename(tempPath, evidencePath);
             invalidateCachedArtifact(evidencePath);
           } catch (writeError) {
             try {
@@ -3898,7 +3707,7 @@ async function listEvidenceTaskIds(directory) {
   }
   const taskIds = [];
   for (const entry of entries) {
-    const entryPath = path7.join(evidenceBasePath, entry);
+    const entryPath = path6.join(evidenceBasePath, entry);
     try {
       const stats = statSync2(entryPath);
       if (!stats.isDirectory()) {
@@ -3921,7 +3730,7 @@ async function deleteEvidence(directory, taskId) {
   } catch {
     return false;
   }
-  const relativePath = path7.join("evidence", sanitizedTaskId);
+  const relativePath = path6.join("evidence", sanitizedTaskId);
   const evidenceDir = validateSwarmPath(directory, relativePath);
   try {
     statSync2(evidenceDir);
@@ -3937,18 +3746,18 @@ async function deleteEvidence(directory, taskId) {
   }
 }
 async function checkRequirementCoverage(phase, directory) {
-  const relativePath = path7.join("evidence", `req-coverage-phase-${phase}.json`);
-  const absolutePath = path7.resolve(directory, ".swarm", relativePath);
+  const relativePath = path6.join("evidence", `req-coverage-phase-${phase}.json`);
+  const absolutePath = path6.resolve(directory, ".swarm", relativePath);
   try {
-    await fs7.access(absolutePath);
+    await fs6.access(absolutePath);
     return { exists: true, path: absolutePath };
   } catch {
     return { exists: false, path: absolutePath };
   }
 }
 async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
-  const taskIds = await _internals8.listEvidenceTaskIds(directory);
-  const cutoffDate = options?.now ? new Date(options.now) : _internals8.now();
+  const taskIds = await _internals7.listEvidenceTaskIds(directory);
+  const cutoffDate = options?.now ? new Date(options.now) : _internals7.now();
   cutoffDate.setDate(cutoffDate.getDate() - maxAgeDays);
   const cutoffIso = cutoffDate.toISOString();
   const selected = new Set;
@@ -3960,7 +3769,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   for (const taskId of taskIds) {
     let result;
     try {
-      result = await _internals8.loadEvidence(directory, taskId);
+      result = await _internals7.loadEvidence(directory, taskId);
     } catch {
       warn("archive: skipping corrupt or unreadable evidence for task", taskId);
       continue;
@@ -3988,7 +3797,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   }
   if (!options?.dryRun) {
     for (const taskId of [...selected].sort()) {
-      const deleted = await _internals8.deleteEvidence(directory, taskId);
+      const deleted = await _internals7.deleteEvidence(directory, taskId);
       if (deleted)
         archived.push(taskId);
       else
@@ -4014,7 +3823,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
   };
   if (typeof options?.cacheMaxBytes === "number" && options.cacheMaxBytes > 0 || typeof options?.cacheMaxRecords === "number" && options.cacheMaxRecords > 0) {
     try {
-      documentsCache = await _internals8.pruneEvidenceDocuments({
+      documentsCache = await _internals7.pruneEvidenceDocuments({
         directory,
         maxBytes: options?.cacheMaxBytes,
         maxRecords: options?.cacheMaxRecords,
@@ -4042,7 +3851,7 @@ async function archiveEvidence(directory, maxAgeDays, maxBundles, options) {
 function validateEvidence(evidence) {
   return EvidenceSchema.parse(evidence);
 }
-var _internals8 = {
+var _internals7 = {
   wrapFlatRetrospective,
   loadEvidence,
   listEvidenceTaskIds,
@@ -4051,7 +3860,7 @@ var _internals8 = {
   saveEvidence,
   deleteEvidence,
   pruneEvidenceDocuments,
-  realpathSync: realpathSync2,
+  realpathSync,
   statSync: statSync2,
   now: () => new Date
 };
@@ -4166,4 +3975,4 @@ function mergeDurableGateEntriesFromEvidence(taskId, entries, evidence) {
   return merged;
 }
 
-export { normalizePath, buildTaskCompletionDescriptor, ensureTaskCheckpointReceipt, updateTaskCheckpointReceipt, MAX_TRANSIENT_RETRIES, isTransientSpawnError, transientBackoff, getGitRepositoryStatus, isGitRepo, getDefaultBaseBranch, detectDefaultRemoteBranch, resetToRemoteBranch, resetToMainAfterMerge, containsPathTraversal, containsControlChars, validateSymlinkBoundary, validateTargetWithinRoot, isStateUnreadable, loadEpicSessionState, isEpicModeActive, enableEpicMode, disableEpicMode, pathsConflict, isGlobalFile, isProtectedPath, readTaskScopes, loadPlanJsonOnly, loadPlan, savePlan, closePlanTerminalState, updateTaskStatus, derivePlanMarkdown, isValidEvidenceType, isSecretscanEvidence, sanitizeTaskId2 as sanitizeTaskId, validateProjectRoot, saveEvidence, loadEvidence, listEvidenceTaskIds, checkRequirementCoverage, archiveEvidence, readDurableGateEvidence, getDurableGateEvidenceStatus, getDurableGateEvidenceStatusForTask, mergeDurableGateEntriesFromEvidence };
+export { normalizePath, buildTaskCompletionDescriptor, ensureTaskCheckpointReceipt, updateTaskCheckpointReceipt, MAX_TRANSIENT_RETRIES, isTransientSpawnError, transientBackoff, getGitRepositoryStatus, isGitRepo, getDefaultBaseBranch, detectDefaultRemoteBranch, resetToRemoteBranch, resetToMainAfterMerge, isStateUnreadable, loadEpicSessionState, isEpicModeActive, enableEpicMode, disableEpicMode, pathsConflict, isGlobalFile, isProtectedPath, readTaskScopes, loadPlanJsonOnly, loadPlan, savePlan, closePlanTerminalState, updateTaskStatus, derivePlanMarkdown, isValidEvidenceType, isSecretscanEvidence, sanitizeTaskId2 as sanitizeTaskId, validateProjectRoot, saveEvidence, loadEvidence, listEvidenceTaskIds, checkRequirementCoverage, archiveEvidence, readDurableGateEvidence, getDurableGateEvidenceStatus, getDurableGateEvidenceStatusForTask, mergeDurableGateEntriesFromEvidence };