opencode-swarm 7.164.6 → 7.164.8

package/dist/cli/{index-4k16cz8r.js → index-bzesypf5.js}

@@ -2,30 +2,28 @@
 import {
   captureWorkspaceSnapshot,
   changedFilesSinceSnapshot
-} from "./index-3f7hqtgg.js";
+} from "./index-w3gtqey0.js";
 import {
   removeWorktreeProvisioningOwner
-} from "./index-b0m3efpf.js";
+} from "./index-sxxh4ams.js";
 import {
   SOURCE_WORKTREE_GONE_STAGE,
+  ensureTaskGateRequirementsReceiptForSettledTransition,
   getTaskWorkflowSnapshot,
   readWorkflowWalFile,
   reconcileLandedMerge,
   withTaskEvidenceTransaction,
   writeWorkflowWalFile
-} from "./index-g5714mpv.js";
-import {
-  canonicalRootKeyFresh
-} from "./index-ddszzne4.js";
+} from "./index-px4a2ve0.js";
 import {
   appendCoreEventSync
-} from "./index-pvp5tnn2.js";
+} from "./index-3sv8t7ca.js";
 import {
   isPathWithinDeclaredScope
 } from "./index-556ja8an.js";
 import {
   validateSwarmPath
-} from "./index-2c3np82d.js";
+} from "./index-8tqqmsav.js";
 import {
   init_git_executable,
   resolveGitExecutable
@@ -34,9 +32,12 @@ import {
   advisoryWarn,
   init_warning_buffer
 } from "./index-4rhhvd1a.js";
+import {
+  canonicalRootKeyFresh
+} from "./index-7qefgq4j.js";
 import {
   tryAcquireLock
-} from "./index-fxxja498.js";
+} from "./index-2czt53wz.js";
 import {
   criticalWarn,
   init_logger
@@ -171,6 +172,23 @@ function scopedObservedFiles(directory, context) {
     return null;
   return observed.filter((filePath) => isPathWithinDeclaredScope(filePath, context.declaredFiles ?? [], directory));
 }
+function settlementTransitionEvent(wal) {
+  return wal.accepted ? {
+    type: "accepted_mutation",
+    agentType: "coder",
+    context: {
+      testEngineerExempt: wal.testEngineerExempt === true,
+      settlementFailed: wal.settlementFailed === true
+    },
+    expectedGeneration: wal.expectedGeneration,
+    transitionId: wal.transitionId
+  } : {
+    type: "dispatch_no_mutation",
+    agentType: "coder",
+    expectedGeneration: wal.expectedGeneration,
+    transitionId: wal.transitionId
+  };
+}
 async function commitPrepared(directory, wal) {
   return withTaskEvidenceTransaction(directory, wal.taskId, wal.actor, async (transaction) => {
     let lockedWal = await readWal(walPath(directory, wal.taskId), wal.taskId);
@@ -179,9 +197,14 @@ async function commitPrepared(directory, wal) {
     if (lockedWal.transitionId !== wal.transitionId) {
       throw new Error("CODER_SETTLEMENT_WAL_REPLACED");
     }
+    const transitionEvent = settlementTransitionEvent(lockedWal);
     const snapshot = getTaskWorkflowSnapshot(transaction.read());
     const evidenceAlreadySettled = lockedWal.accepted === true ? snapshot.authoritative && snapshot.state === (lockedWal.settlementFailed === true ? "rework_required" : "coder_delegated") && snapshot.generation === lockedWal.expectedGeneration + 1 && snapshot.lastOutcome === (lockedWal.settlementFailed === true ? "accepted_mutation_failed" : "accepted_mutation") && snapshot.lastTransitionId === lockedWal.transitionId : snapshot.generation === lockedWal.expectedGeneration && snapshot.lastOutcome === "dispatch_no_mutation" && snapshot.lastTransitionId === lockedWal.transitionId;
     if (evidenceAlreadySettled) {
+      const evidence2 = transaction.read();
+      if (lockedWal.accepted === true) {
+        await ensureTaskGateRequirementsReceiptForSettledTransition(directory, lockedWal.taskId, evidence2, transitionEvent);
+      }
       if (lockedWal.state !== "COMMITTED") {
         lockedWal = {
           ...lockedWal,
@@ -194,7 +217,7 @@ async function commitPrepared(directory, wal) {
         });
       }
       return {
-        evidence: transaction.read(),
+        evidence: evidence2,
         accepted: lockedWal.accepted === true,
         alreadyApplied: true
       };
@@ -202,21 +225,7 @@ async function commitPrepared(directory, wal) {
     if (lockedWal.state !== "PREPARED") {
       throw new Error("CODER_SETTLEMENT_NOT_PREPARED");
     }
-    const evidence = await transaction.transition(lockedWal.accepted ? {
-      type: "accepted_mutation",
-      agentType: "coder",
-      context: {
-        testEngineerExempt: lockedWal.testEngineerExempt === true,
-        settlementFailed: lockedWal.settlementFailed === true
-      },
-      expectedGeneration: lockedWal.expectedGeneration,
-      transitionId: lockedWal.transitionId
-    } : {
-      type: "dispatch_no_mutation",
-      agentType: "coder",
-      expectedGeneration: lockedWal.expectedGeneration,
-      transitionId: lockedWal.transitionId
-    });
+    const evidence = await transaction.transition(transitionEvent);
     lockedWal = {
       ...lockedWal,
       state: "COMMITTED",
@@ -478,7 +487,7 @@ async function cleanupRecoveredWorktree(directory, descriptor) {
     awaitingMergeByCallID,
     cleanupStandardWorktreeForCallId,
     standardWorktreeByCallID
-  } = await import("./worktree-isolation-m02ay3kg.js");
+  } = await import("./worktree-isolation-j6zxhjab.js");
   standardWorktreeByCallID.delete(descriptor.callID);
   if (hasResidue)
     awaitingMergeByCallID.set(descriptor.callID, {
@@ -602,7 +611,7 @@ async function recoverCoderSettlement(directory, taskId) {
           awaitingMergeByCallID,
           finishStandardWorktreeDispatch,
           standardWorktreeByCallID
-        } = await import("./worktree-isolation-m02ay3kg.js");
+        } = await import("./worktree-isolation-j6zxhjab.js");
         const descriptor = wal.worktree;
         const reconstructedDispatch = {
           callID: descriptor.callID,

package/dist/cli/{index-ay9cr8tr.js → index-chcv8c7n.js}

@@ -4,7 +4,7 @@ import {
   readShellAuditTail,
   redactPath,
   redactShellCommand
-} from "./index-12xzj0hm.js";
+} from "./index-b10yvv6h.js";
 
 // src/services/guardrail-log-service.ts
 var BLOCK_TYPES = new Set([

package/dist/cli/index-cw912re7.js

@@ -0,0 +1,200 @@
+// @bun
+import {
+  canonicalExistingFilesystemPath
+} from "./index-ry16d01s.js";
+
+// src/utils/path-security.ts
+import * as fs from "fs";
+import * as path from "path";
+function containsPathTraversal(str) {
+  if (/\.\.[/\\]/.test(str))
+    return true;
+  if (/(?:^|[/\\])\.\.(?:[/\\]|$)/.test(str))
+    return true;
+  if (/%2e%2e/i.test(str))
+    return true;
+  if (/%2e\./i.test(str))
+    return true;
+  if (/%2e/i.test(str) && /\.\./.test(str))
+    return true;
+  if (/%252e%252e/i.test(str))
+    return true;
+  if (/\uff0e/.test(str))
+    return true;
+  if (/\u3002/.test(str))
+    return true;
+  if (/\uff65/.test(str))
+    return true;
+  if (/%2f/i.test(str))
+    return true;
+  if (/%5c/i.test(str))
+    return true;
+  return false;
+}
+function containsControlChars(str) {
+  for (const ch of str) {
+    const code = ch.codePointAt(0);
+    if (code === undefined)
+      continue;
+    if (code <= 31 || code >= 127 && code <= 159)
+      return true;
+    if (code >= 8234 && code <= 8238)
+      return true;
+    if (code >= 8294 && code <= 8297)
+      return true;
+  }
+  return false;
+}
+function validateWorkspaceRoot(directory) {
+  validateProjectDirectory(directory);
+}
+function validateDirectory(directory) {
+  if (!directory || directory.trim() === "") {
+    throw new Error("Invalid directory: empty");
+  }
+  if (containsPathTraversal(directory)) {
+    throw new Error("Invalid directory: path traversal detected");
+  }
+  if (containsControlChars(directory)) {
+    throw new Error("Invalid directory: control characters detected");
+  }
+  if (directory.startsWith("/") || directory.startsWith("\\")) {
+    throw new Error("Invalid directory: absolute path");
+  }
+  if (/^[A-Za-z]:[/\\]/.test(directory)) {
+    throw new Error("Invalid directory: Windows absolute path");
+  }
+}
+function validateProjectDirectory(directory) {
+  if (!directory || directory.trim() === "") {
+    throw new Error("Invalid project directory: empty");
+  }
+  if (containsPathTraversal(directory)) {
+    throw new Error("Invalid project directory: path traversal detected");
+  }
+  if (containsControlChars(directory)) {
+    throw new Error("Invalid project directory: control characters detected");
+  }
+  if (!path.isAbsolute(directory) && !/^[A-Za-z]:[/\\]/.test(directory)) {
+    throw new Error("Invalid project directory: must be an absolute path");
+  }
+  assertNotSystemLocation(directory);
+}
+var DENIED_ROOT_SUBTREES = new Set([
+  "etc",
+  "usr",
+  "bin",
+  "sbin",
+  "lib",
+  "lib64",
+  "boot",
+  "dev",
+  "proc",
+  "sys",
+  "windows",
+  "winnt",
+  "program files",
+  "program files (x86)",
+  "programdata",
+  "system volume information"
+]);
+var DENIED_EXACT_ROOT_CHILDREN = new Set(["users", "home", "root"]);
+function assertNotSystemLocation(directory) {
+  for (const parser of [path.win32, path.posix]) {
+    if (!parser.isAbsolute(directory))
+      continue;
+    const normalized = parser.normalize(directory);
+    const { root } = parser.parse(normalized);
+    const segments = normalized.slice(root.length).split(/[/\\]/).filter((segment) => segment.length > 0);
+    if (segments.length === 0) {
+      throw new Error(`Invalid project directory: filesystem root is not a project root (${directory})`);
+    }
+    const first = (segments[0] ?? "").toLowerCase();
+    if (DENIED_ROOT_SUBTREES.has(first) || segments.length === 1 && DENIED_EXACT_ROOT_CHILDREN.has(first)) {
+      throw new Error(`Invalid project directory: system location is not a project root (${directory})`);
+    }
+  }
+}
+function resolveNearestExistingCanonical(inputPath, resolver) {
+  try {
+    return resolver(inputPath);
+  } catch {}
+  const lexicallyResolved = path.resolve(inputPath);
+  let probe = lexicallyResolved;
+  const tail = [];
+  for (let i = 0;i < 4096; i++) {
+    const parent = path.dirname(probe);
+    if (parent === probe) {
+      return lexicallyResolved;
+    }
+    tail.unshift(path.basename(probe));
+    probe = parent;
+    try {
+      const canonicalAncestor = resolver(probe);
+      return path.normalize(path.join(canonicalAncestor, ...tail));
+    } catch {}
+  }
+  return lexicallyResolved;
+}
+function validateSymlinkBoundary(targetPath, rootPath) {
+  const realTarget = resolveNearestExistingCanonical(targetPath, _internals.realpathSync);
+  const realRoot = resolveNearestExistingCanonical(rootPath, _internals.realpathSync);
+  const normalizedTarget = path.normalize(realTarget);
+  const normalizedRoot = path.normalize(realRoot);
+  if (!normalizedTarget.startsWith(normalizedRoot + path.sep) && normalizedTarget !== normalizedRoot) {
+    throw new Error(`Symlink resolution escaped boundary: ${realTarget} is not within ${realRoot}`);
+  }
+}
+function isCanonicalPathWithinRoot(targetPath, rootPath) {
+  const canonicalRoot = canonicalExistingFilesystemPath(rootPath);
+  if (canonicalRoot === null)
+    return false;
+  const rootPrefix = canonicalRoot.endsWith("/") ? canonicalRoot : `${canonicalRoot}/`;
+  let probe = path.resolve(targetPath);
+  for (let i = 0;i < 4096; i++) {
+    const canonicalProbe = canonicalExistingFilesystemPath(probe);
+    if (canonicalProbe !== null) {
+      return canonicalProbe === canonicalRoot || canonicalProbe.startsWith(rootPrefix);
+    }
+    const parent = path.dirname(probe);
+    if (parent === probe)
+      return false;
+    probe = parent;
+  }
+  return false;
+}
+function validateTargetWithinRoot(filePath, root) {
+  if (!filePath || filePath.trim() === "") {
+    return "Empty path";
+  }
+  if (path.isAbsolute(filePath) || /^[A-Za-z]:[/\\]/.test(filePath)) {
+    return `Absolute path rejected: ${filePath}`;
+  }
+  if (containsPathTraversal(filePath)) {
+    return `Path traversal detected: ${filePath}`;
+  }
+  if (containsControlChars(filePath)) {
+    return `Control characters detected in path: ${filePath}`;
+  }
+  const resolved = path.resolve(root, filePath);
+  const relative2 = path.relative(root, resolved);
+  if (relative2.startsWith("..") || path.isAbsolute(relative2)) {
+    return `Path escapes root: ${filePath}`;
+  }
+  if (!isCanonicalPathWithinRoot(resolved, root)) {
+    return `Path escapes root via symlink/junction: ${filePath}`;
+  }
+  return null;
+}
+var _internals = {
+  realpathSync: fs.realpathSync,
+  containsPathTraversal,
+  containsControlChars,
+  validateDirectory,
+  validateProjectDirectory,
+  validateSymlinkBoundary,
+  isCanonicalPathWithinRoot,
+  validateTargetWithinRoot
+};
+
+export { containsPathTraversal, containsControlChars, validateWorkspaceRoot, validateSymlinkBoundary, isCanonicalPathWithinRoot, validateTargetWithinRoot };

package/dist/cli/{index-ty3vtqe2.js → index-espcjyrx.js}

@@ -2,7 +2,7 @@
 import {
   _internals,
   resolveWorktreeIsolationConfig
-} from "./index-hdapetg1.js";
+} from "./index-9ek9d96g.js";
 import {
   ApprovalEvidenceSchema,
   BaseEvidenceSchema,
@@ -44,7 +44,7 @@ import {
   loadPluginConfigWithMeta,
   loadPluginConfigWithMetaAsync,
   resetConfigAdvisoryDedup
-} from "./index-ew99d4y6.js";
+} from "./index-apdp9bc1.js";
 import {
   AUTO_REVIEW_V8_BURN_IN_DECISION,
   AgentOverrideConfigSchema,
@@ -68,7 +68,7 @@ import {
   TurboConfigSchema,
   WorktreeIsolationConfigSchema,
   resolveAutoReviewConfig
-} from "./index-5p1tzpwh.js";
+} from "./index-ypjffdrg.js";
 import"./index-9e6fdz2h.js";
 import"./index-4rhhvd1a.js";
 import {
@@ -80,7 +80,7 @@ import {
   QA_AGENTS,
   isQAAgent,
   isSubagent
-} from "./index-m1nrd3yd.js";
+} from "./index-8psybzzf.js";
 import"./index-zjygnfay.js";
 import"./index-bk5tah7q.js";
 import"./index-bpmtbmy9.js";

package/dist/cli/{index-gwg7a00b.js → index-g2e8b3wm.js}

@@ -1,32 +1,35 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-2c3np82d.js";
+} from "./index-8tqqmsav.js";
 import {
   loadPluginConfigWithMeta
-} from "./index-ew99d4y6.js";
+} from "./index-apdp9bc1.js";
 import {
   KnowledgeConfigSchema,
   init_schema
-} from "./index-5p1tzpwh.js";
+} from "./index-ypjffdrg.js";
 import {
   observeReceiptTransition
-} from "./index-p56xc59p.js";
+} from "./index-9ydhzegh.js";
 import {
   resolveHiveEventsPath
 } from "./index-ae75rja9.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-tegp2mny.js";
+} from "./index-93znbdam.js";
 import {
   atomicWriteFile
-} from "./index-ze5zyv28.js";
+} from "./index-mr3h3sm5.js";
+import {
+  canonicalRootKey
+} from "./index-7qefgq4j.js";
 import {
   assertProjectRoot
-} from "./index-fxxja498.js";
+} from "./index-2czt53wz.js";
 import {
   emit
-} from "./index-1dz8hv7p.js";
+} from "./index-kvq1e82k.js";
 import {
   require_proper_lockfile
 } from "./index-7g4c7s5r.js";
@@ -2437,10 +2440,11 @@ async function buildCounterRollupCacheKey(directory) {
   return `${eventsKey}|${legacyKey}|${baselineKey}`;
 }
 function setCounterRollupCache(directory, key, rollups) {
-  if (counterRollupCache.has(directory)) {
-    counterRollupCache.delete(directory);
+  const cacheKey = canonicalRootKey(directory);
+  if (counterRollupCache.has(cacheKey)) {
+    counterRollupCache.delete(cacheKey);
   }
-  counterRollupCache.set(directory, {
+  counterRollupCache.set(cacheKey, {
     key,
     rollups: cloneRollupMap(rollups)
   });
@@ -2646,10 +2650,11 @@ async function countEntryContradictionsInWindow(directory, entryId, windowDays,
 async function readKnowledgeCounterRollups(directory) {
   try {
     const cacheKey = await buildCounterRollupCacheKey(directory);
-    const cached = counterRollupCache.get(directory);
+    const directoryKey = canonicalRootKey(directory);
+    const cached = counterRollupCache.get(directoryKey);
     if (cached?.key === cacheKey) {
-      counterRollupCache.delete(directory);
-      counterRollupCache.set(directory, cached);
+      counterRollupCache.delete(directoryKey);
+      counterRollupCache.set(directoryKey, cached);
       return cloneRollupMap(cached.rollups);
     }
     const [events, legacyRecords, baseline] = await Promise.all([
@@ -2810,7 +2815,7 @@ async function applyKnowledgeVerdictFeedback(directory, options) {
     }
     let bumps = 0;
     if (deltas.length > 0) {
-      const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-j97ejf6a.js");
+      const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-w3w9gchr.js");
       bumps = await bumpKnowledgeConfidenceBatch(directory, deltas, options?.floorOptions);
     }
     return {

package/dist/cli/{index-rysxqae0.js → index-ghnbpez3.js}

@@ -6,17 +6,17 @@ import {
 } from "./index-ae75rja9.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-tegp2mny.js";
+} from "./index-93znbdam.js";
 import {
   atomicWriteFile
-} from "./index-ze5zyv28.js";
+} from "./index-mr3h3sm5.js";
 import {
   init_knowledge_types,
   isActiveStatus
 } from "./index-bk5tah7q.js";
 import {
   readCachedParsedFile
-} from "./index-cyhw0der.js";
+} from "./index-t1qzjhnj.js";
 import {
   require_proper_lockfile
 } from "./index-7g4c7s5r.js";
@@ -713,7 +713,7 @@ async function applyConfidenceFloorAction(directory, touched, options) {
   const {
     readAuthoritativeKnowledgeCounterRollups,
     effectiveRetrievalOutcomes
-  } = await import("./knowledge-events-n5t313ht.js");
+  } = await import("./knowledge-events-e8hrmjf0.js");
   const rollups = await readAuthoritativeKnowledgeCounterRollups(directory);
   const flagIds = new Set;
   for (const e of atFloor) {
@@ -780,11 +780,11 @@ async function applyConfidenceFloorAction(directory, touched, options) {
     });
   }
   if (action === "quarantine" && toQuarantine.length > 0) {
-    const { quarantineEntry } = await import("./knowledge-validator-01evhydg.js");
-    const { KnowledgeConfigSchema } = await import("./schema-t1scx08g.js");
+    const { quarantineEntry } = await import("./knowledge-validator-exd900vc.js");
+    const { KnowledgeConfigSchema } = await import("./schema-mbb9g4w4.js");
     let config;
     try {
-      const { loadPluginConfigWithMeta } = await import("./index-ty3vtqe2.js");
+      const { loadPluginConfigWithMeta } = await import("./index-espcjyrx.js");
       const { config: loadedConfig } = loadPluginConfigWithMeta(directory);
       config = KnowledgeConfigSchema.parse(loadedConfig.knowledge ?? {});
     } catch {

package/dist/cli/{index-t1nkr7cz.js → index-gkqrk8dd.js}

@@ -13,7 +13,7 @@ import {
 import {
   SWARM_WORKTREE_DIR_NAME,
   init_constants
-} from "./index-m1nrd3yd.js";
+} from "./index-8psybzzf.js";
 import {
   log
 } from "./index-zgwm4ryv.js";
@@ -92,7 +92,7 @@ var _internals = {
     symlinkSync: fs.symlinkSync
   },
   writeScopeToDisk: async (directory, taskId, files) => {
-    const { writeScopeToDisk: realWrite } = await import("./scope-persistence-1a5qmchf.js");
+    const { writeScopeToDisk: realWrite } = await import("./scope-persistence-jrbnhxvx.js");
     return realWrite(directory, taskId, files);
   },
   writeLaneProfileToDisk: async (_worktreePath, _laneIndex, _envOverrides) => {

package/dist/cli/{index-1dz8hv7p.js → index-kvq1e82k.js}

@@ -665,7 +665,7 @@ var CATALOG_SOURCE = [
       category: "plan",
       severity: "notice",
       privacyClass: "operational",
-      producer: "src/plan/manager.ts:345",
+      producer: "src/plan/manager.ts:346",
       consumers: NO_CONSUMERS,
       futureOwnerIssue: ISSUE_SINK,
       retentionOwnerIssue: ISSUE_PLAN_EVIDENCE_RETENTION,
@@ -678,7 +678,7 @@ var CATALOG_SOURCE = [
       category: "plan",
       severity: "warning",
       privacyClass: "sensitive",
-      producer: "src/plan/manager.ts:1853",
+      producer: "src/plan/manager.ts:1854",
       consumers: NO_CONSUMERS,
       futureOwnerIssue: ISSUE_SINK,
       retentionOwnerIssue: ISSUE_PLAN_EVIDENCE_RETENTION,
@@ -691,7 +691,7 @@ var CATALOG_SOURCE = [
       category: "plan",
       severity: "error",
       privacyClass: "sensitive",
-      producer: "src/plan/ledger.ts:1167",
+      producer: "src/plan/ledger.ts:1176",
       consumers: NO_CONSUMERS,
       futureOwnerIssue: ISSUE_SINK,
       retentionOwnerIssue: ISSUE_PLAN_EVIDENCE_RETENTION,

package/dist/cli/{index-ze5zyv28.js → index-mr3h3sm5.js}

@@ -1,10 +1,10 @@
 // @bun
 import {
   withEvidenceLock
-} from "./index-fxxja498.js";
+} from "./index-2czt53wz.js";
 import {
   atomicWriteFileAnyRoot
-} from "./index-cyhw0der.js";
+} from "./index-t1qzjhnj.js";
 
 // src/evidence/task-file.ts
 import * as path from "path";

package/dist/cli/{index-zaab1wz9.js → index-n4fzmqz8.js}

@@ -18,10 +18,12 @@ function createNodeDatabaseCtor(DatabaseSyncCtor) {
       }
       return stmt;
     }
+    static CHANGES_PROBE_SQL = "SELECT changes() AS c, last_insert_rowid() AS r";
     run(sql, ...rest) {
       if (rest.length === 0) {
         this.raw.exec(sql);
-        return;
+        const row = this.statement(NodeSqliteDatabase.CHANGES_PROBE_SQL).get();
+        return { changes: Number(row?.c ?? 0), lastInsertRowid: row?.r ?? 0 };
       }
       const params = rest.length === 1 && Array.isArray(rest[0]) ? rest[0] : rest;
       return this.statement(sql).run(...params);

package/dist/cli/{index-g5714mpv.js → index-px4a2ve0.js}

@@ -2,14 +2,14 @@
 import {
   autoCommitDirty,
   cleanUntrackedFiles
-} from "./index-t1nkr7cz.js";
+} from "./index-gkqrk8dd.js";
 import {
   isPathWithinDeclaredScope,
   unsafePathTextReason
 } from "./index-556ja8an.js";
 import {
   validateSwarmPath
-} from "./index-2c3np82d.js";
+} from "./index-8tqqmsav.js";
 import {
   bunSpawn,
   classifySpawnFailure
@@ -26,13 +26,13 @@ import {
   atomicWriteFile,
   taskEvidencePath,
   withTaskEvidenceLock
-} from "./index-ze5zyv28.js";
+} from "./index-mr3h3sm5.js";
 import {
   assertProjectRoot
-} from "./index-fxxja498.js";
+} from "./index-2czt53wz.js";
 import {
   telemetry
-} from "./index-1dz8hv7p.js";
+} from "./index-kvq1e82k.js";
 import {
   exports_external,
   init_zod
@@ -1557,6 +1557,9 @@ async function writeWorkflowWalFile(kind, filePath, wal) {
 }
 
 // src/gate-evidence.ts
+var _internals3 = {
+  appendTaskGateRequirementsReceiptIfNeeded
+};
 var TASK_WORKFLOW_SCHEMA_MARKER = "exact-task-v1";
 var TASK_WORKFLOW_STATES = [
   "idle",
@@ -1585,6 +1588,7 @@ var TASK_WORKFLOW_OUTCOMES = [
   "task_closed",
   "repair_idle"
 ];
+var TASK_GATE_REQUIREMENTS_RECONSTRUCTION_SENTINEL = "requirements_reconstruction";
 function assertTaskEvidenceWriteAllowed(directory, taskId, event) {
   assertValidTaskId(taskId);
   const coderWalPath = validateSwarmPath(directory, `coder-settlements/${taskId}.json`);
@@ -1720,7 +1724,7 @@ function maybeExpandRequiredGates(existing, event) {
   if (event.type === "accepted_mutation") {
     const agentType = event.agentType;
     if (typeof agentType === "string" && agentType.trim() !== "") {
-      return existing ? expandRequiredGates(existing.required_gates, agentType, event.context ?? {}) : deriveRequiredGates(agentType, event.context ?? {});
+      return existing ? expandRequiredGates(existing.required_gates.filter((gate) => gate !== TASK_GATE_REQUIREMENTS_RECONSTRUCTION_SENTINEL), agentType, event.context ?? {}) : deriveRequiredGates(agentType, event.context ?? {});
     }
   }
   if (event.type === "stage_b_completed" && event.ensureDefaultStageB === true) {
@@ -2031,7 +2035,7 @@ async function withTaskEvidenceTransaction(directory, taskId, agent, callback) {
       });
       await atomicWriteFile(evidencePath, JSON.stringify(validated, null, 2));
       if (event) {
-        await appendTaskGateRequirementsReceiptIfNeeded(directory, taskId, current, validated, event);
+        await _internals3.appendTaskGateRequirementsReceiptIfNeeded(directory, taskId, current, validated, event);
       }
       current = validated;
       return validated;
@@ -2048,6 +2052,11 @@ async function withTaskEvidenceTransaction(directory, taskId, agent, callback) {
     });
   });
 }
+async function ensureTaskGateRequirementsReceiptForSettledTransition(directory, taskId, evidence, event) {
+  assertValidTaskId(taskId);
+  const validated = TaskEvidenceSchema.parse({ ...evidence, taskId });
+  await _internals3.appendTaskGateRequirementsReceiptIfNeeded(directory, taskId, null, validated, event);
+}
 async function recordGateEvidence(directory, taskId, gate, sessionId, turbo, options = {}) {
   assertValidTaskId(taskId);
   if (shouldTreatGateAsStageB(gate) && typeof options.expectedGeneration !== "number") {
@@ -2121,4 +2130,4 @@ function compareTaskWorkflowStateRank(left, right) {
   return WORKFLOW_STATE_RANK[left] - WORKFLOW_STATE_RANK[right];
 }
 
-export { isStrictTaskId, sanitizeTaskId, listRecoveryRecords, GitBinaryMissingError, GitSpawnCwdError, isGitBinaryMissing, isSpawnCwdMissing, isSpawnCwdUnreadable, _internals, SOURCE_WORKTREE_GONE_STAGE, SOURCE_WORKTREE_UNCERTAIN_STAGE, getMergeStrategy, recoverMergeBackFromImmutableCoordinates, reconcileLandedMerge, postMergeCleanup, pruneStaleWorktreeMetadata, attemptMergeBackFromDirty, cleanupOrphanedBranches, startupOrphanRecovery, readWorkflowWalFile, writeWorkflowWalFile, TASK_WORKFLOW_SCHEMA_MARKER, assertTaskEvidenceWriteAllowed, parseTaskEvidence, DEFAULT_REQUIRED_GATES, isValidTaskId, getTaskWorkflowSnapshot, reduceTaskWorkflowSnapshot, deriveRequiredGates, expandRequiredGates, transitionTaskWorkflowEvidence, withTaskEvidenceTransaction, recordGateEvidence, recordAgentDispatch, readTaskEvidence, readTaskEvidenceRaw, hasPassedAllGates, compareTaskWorkflowStateRank };
+export { isStrictTaskId, sanitizeTaskId, listRecoveryRecords, GitBinaryMissingError, GitSpawnCwdError, isGitBinaryMissing, isSpawnCwdMissing, isSpawnCwdUnreadable, _internals, SOURCE_WORKTREE_GONE_STAGE, SOURCE_WORKTREE_UNCERTAIN_STAGE, getMergeStrategy, recoverMergeBackFromImmutableCoordinates, reconcileLandedMerge, postMergeCleanup, pruneStaleWorktreeMetadata, attemptMergeBackFromDirty, cleanupOrphanedBranches, startupOrphanRecovery, readWorkflowWalFile, writeWorkflowWalFile, _internals3 as _internals1, TASK_WORKFLOW_SCHEMA_MARKER, TASK_GATE_REQUIREMENTS_RECONSTRUCTION_SENTINEL, assertTaskEvidenceWriteAllowed, parseTaskEvidence, DEFAULT_REQUIRED_GATES, isValidTaskId, getTaskWorkflowSnapshot, reduceTaskWorkflowSnapshot, deriveRequiredGates, expandRequiredGates, transitionTaskWorkflowEvidence, withTaskEvidenceTransaction, ensureTaskGateRequirementsReceiptForSettledTransition, recordGateEvidence, recordAgentDispatch, readTaskEvidence, readTaskEvidenceRaw, hasPassedAllGates, compareTaskWorkflowStateRank };