opencode-swarm 7.165.0 → 7.166.1

package/dist/cli/{index-r5hj3nfe.js → index-3tyym20r.js}

@@ -14,14 +14,14 @@ import {
   detectWindowsWrites,
   getSharedClassifierGuardrailBlock,
   resolveWriteTargets
-} from "./index-hwz46jj7.js";
+} from "./index-399nq780.js";
 import {
   checkFileAuthority,
   classifyFile,
   isInDeclaredScope,
   redactPath,
   redactShellCommand
-} from "./index-hdakb4n9.js";
+} from "./index-gr8ppbq3.js";
 
 // src/services/guardrail-explain-service.ts
 import path from "path";

package/dist/cli/{index-zycp24b9.js → index-52xdezsh.js}

@@ -14,12 +14,13 @@ import {
   PluginConfigSchema,
   init_schema,
   resolveExternalSkillsConfig
-} from "./index-0e9jh9c7.js";
+} from "./index-wf12wckd.js";
 import {
+  DangerousMergeKeyError,
   MAX_MERGE_DEPTH,
   deepMerge,
   init_merge
-} from "./index-zjygnfay.js";
+} from "./index-zpsr8rpc.js";
 import {
   exports_external,
   init_zod
@@ -503,7 +504,15 @@ function enforceGitBinaryProvenance(mergedRaw, rawUserConfig) {
 function buildConfigWithMeta(rawUserConfig, rawProjectConfig, loadedFromFile, configHadErrors) {
   let mergedRaw = rawUserConfig ?? {};
   if (rawProjectConfig) {
-    mergedRaw = deepMerge(mergedRaw, rawProjectConfig);
+    try {
+      mergedRaw = deepMerge(mergedRaw, rawProjectConfig);
+    } catch (err) {
+      if (err instanceof DangerousMergeKeyError) {
+        advisoryWarn(`[opencode-swarm] \u26A0\uFE0F SECURITY: Ignoring the entire project config (.opencode/${CONFIG_FILENAME}): ` + `it carries the dangerous key "${err.key}" at "${err.path}", a prototype-pollution payload. ` + "Continuing with user-level configuration only.");
+      } else {
+        throw err;
+      }
+    }
   }
   mergedRaw = enforceGitBinaryProvenance(mergedRaw, rawUserConfig);
   if (rawFullAutoLocked(rawUserConfig) || rawFullAutoLocked(rawProjectConfig)) {

package/dist/cli/{index-2k53pfnc.js → index-6rff2h8x.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   authorizeCuration
-} from "./index-ajknebrc.js";
+} from "./index-c20gf089.js";
 import {
   findNearDuplicate,
   inferTags,
@@ -9,13 +9,13 @@ import {
   resolveSwarmKnowledgePath,
   resolveSwarmRejectedPath,
   transactKnowledge
-} from "./index-c4ddtrqg.js";
+} from "./index-bkd3450m.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-6rx1rdaq.js";
+} from "./index-a7rw4g4s.js";
 import {
   atomicWriteFile
-} from "./index-jre6tm3v.js";
+} from "./index-edm41q4j.js";
 import {
   require_proper_lockfile
 } from "./index-7g4c7s5r.js";

package/dist/cli/{index-6m24v15v.js → index-79sr3fd1.js}

@@ -2,13 +2,13 @@
 import {
   derivePlanId,
   derivePlanIdentityHash
-} from "./index-e45htt92.js";
+} from "./index-jx9f4ke1.js";
 import {
   DURABILITY_CLASSES,
   getProjectDb,
   projectDbExists,
   withImmediateTransaction
-} from "./index-w6988bbc.js";
+} from "./index-aftapk6j.js";
 import {
   init_logger,
   warn

package/dist/cli/{index-k1ntjzmf.js → index-8fr2wn18.js}

@@ -12,13 +12,13 @@ import {
   PluginConfigSchema,
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-0e9jh9c7.js";
+} from "./index-wf12wckd.js";
 import {
   ALL_AGENT_NAMES,
   TOOL_NAME_SET,
   init_constants,
   init_tool_metadata
-} from "./index-a0d4fp6r.js";
+} from "./index-0tc0pcmh.js";
 import {
   log
 } from "./index-zgwm4ryv.js";

package/dist/cli/{index-dh5th4jn.js → index-8hqkrd2j.js}

@@ -5,7 +5,7 @@ import {
   batchDurabilityClass,
   classifyDbWriteError,
   getProjectDb
-} from "./index-w6988bbc.js";
+} from "./index-aftapk6j.js";
 import {
   _internals,
   canonicalRootKeyFresh

package/dist/cli/{index-6rx1rdaq.js → index-a7rw4g4s.js}

@@ -4,7 +4,7 @@ import {
 } from "./index-7qefgq4j.js";
 import {
   atomicWriteFile
-} from "./index-jre6tm3v.js";
+} from "./index-edm41q4j.js";
 import {
   init_logger,
   warn

package/dist/cli/{index-w6988bbc.js → index-aftapk6j.js}

@@ -334,6 +334,77 @@ var MIGRATIONS = [
     name: "create_coordination_event_fence_global_age_index",
     sql: `CREATE INDEX IF NOT EXISTS idx_coordination_event_fence_global_age
 			ON coordination_event_fence(created_at, stream_id)`
+  },
+  {
+    version: 29,
+    name: "create_observability_event",
+    sql: `CREATE TABLE IF NOT EXISTS observability_event (
+			event_id TEXT PRIMARY KEY,
+			kind TEXT NOT NULL,
+			category TEXT,
+			severity TEXT,
+			occurred_at TEXT NOT NULL,
+			writer_sequence INTEGER,
+			trace_id TEXT,
+			span_id TEXT,
+			host_session_id TEXT,
+			task_id TEXT,
+			lane_id TEXT,
+			batch_id TEXT,
+			phase_id TEXT,
+			council_round_id TEXT,
+			project_ref TEXT,
+			outcome_status TEXT,
+			retry_index INTEGER,
+			privacy_class TEXT,
+			sampled INTEGER,
+			payload_json TEXT NOT NULL,
+			relationship_violations TEXT,
+			quarantined INTEGER NOT NULL DEFAULT 0,
+			quarantine_reason TEXT,
+			ingested_via TEXT NOT NULL
+		)`
+  },
+  {
+    version: 30,
+    name: "create_observability_event_indexes",
+    sql: `CREATE INDEX IF NOT EXISTS idx_obs_event_occurred
+			ON observability_event(occurred_at);
+			CREATE INDEX IF NOT EXISTS idx_obs_event_kind
+			ON observability_event(kind, occurred_at);
+			CREATE INDEX IF NOT EXISTS idx_obs_event_session
+			ON observability_event(host_session_id, occurred_at);
+			CREATE INDEX IF NOT EXISTS idx_obs_event_task
+			ON observability_event(task_id, occurred_at);
+			CREATE INDEX IF NOT EXISTS idx_obs_event_trace
+			ON observability_event(trace_id);
+			CREATE INDEX IF NOT EXISTS idx_obs_event_batch
+			ON observability_event(batch_id)`
+  },
+  {
+    version: 31,
+    name: "create_observability_sink_health",
+    sql: `CREATE TABLE IF NOT EXISTS observability_sink_health (
+			id INTEGER PRIMARY KEY CHECK(id = 1),
+			accepted INTEGER NOT NULL DEFAULT 0,
+			quarantined INTEGER NOT NULL DEFAULT 0,
+			dropped INTEGER NOT NULL DEFAULT 0,
+			last_error_category TEXT,
+			last_error_at TEXT,
+			last_flush_at TEXT,
+			updated_at TEXT NOT NULL
+		)`
+  },
+  {
+    version: 32,
+    name: "create_observability_import",
+    sql: `CREATE TABLE IF NOT EXISTS observability_import (
+			source TEXT PRIMARY KEY,
+			fingerprint_size INTEGER NOT NULL,
+			fingerprint_mtime_ms INTEGER NOT NULL,
+			lines_seen INTEGER NOT NULL CHECK(lines_seen >= 0),
+			imported_at TEXT NOT NULL
+		)`
   }
 ];
 var _projectDbs = new Map;
@@ -610,7 +681,10 @@ var DURABILITY_CLASSES = {
   phase_report: "normal",
   project_constraints: "normal",
   migration_failures: "normal",
-  schema_migrations: "normal"
+  schema_migrations: "normal",
+  observability_event: "normal",
+  observability_sink_health: "normal",
+  observability_import: "normal"
 };
 function batchDurabilityClass(classes) {
   for (const cls of classes) {

package/dist/cli/{index-j2svfhzk.js → index-axf65x87.js}

@@ -9,7 +9,7 @@ import {
   pseudonymousRef,
   resolveLineageSalt,
   telemetry
-} from "./index-5ebgzb5a.js";
+} from "./index-hwj25q9r.js";
 
 // src/health/learning-health.ts
 import { promises as fs } from "fs";

package/dist/cli/{index-anxs69ad.js → index-bfr392e7.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   SwarmError
-} from "./index-z6xqpmqg.js";
+} from "./index-ee6ydtfe.js";
 import {
   bunFile
 } from "./index-p612v1mv.js";

package/dist/cli/{index-c4ddtrqg.js → index-bkd3450m.js}

@@ -6,10 +6,10 @@ import {
 } from "./index-ae75rja9.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-6rx1rdaq.js";
+} from "./index-a7rw4g4s.js";
 import {
   atomicWriteFile
-} from "./index-jre6tm3v.js";
+} from "./index-edm41q4j.js";
 import {
   readCachedParsedFile
 } from "./index-gy0nyfbw.js";
@@ -713,7 +713,7 @@ async function applyConfidenceFloorAction(directory, touched, options) {
   const {
     readAuthoritativeKnowledgeCounterRollups,
     effectiveRetrievalOutcomes
-  } = await import("./knowledge-events-rv9q9mkm.js");
+  } = await import("./knowledge-events-a5dwkg30.js");
   const rollups = await readAuthoritativeKnowledgeCounterRollups(directory);
   const flagIds = new Set;
   for (const e of atFloor) {
@@ -780,11 +780,11 @@ async function applyConfidenceFloorAction(directory, touched, options) {
     });
   }
   if (action === "quarantine" && toQuarantine.length > 0) {
-    const { quarantineEntry } = await import("./knowledge-validator-8qtd9ys0.js");
-    const { KnowledgeConfigSchema } = await import("./schema-ebfxgya0.js");
+    const { quarantineEntry } = await import("./knowledge-validator-76qrf1ev.js");
+    const { KnowledgeConfigSchema } = await import("./schema-27sedbfk.js");
     let config;
     try {
-      const { loadPluginConfigWithMeta } = await import("./index-1v6vc90w.js");
+      const { loadPluginConfigWithMeta } = await import("./index-j29nkq5d.js");
       const { config: loadedConfig } = loadPluginConfigWithMeta(directory);
       config = KnowledgeConfigSchema.parse(loadedConfig.knowledge ?? {});
     } catch {

package/dist/cli/{index-ajknebrc.js → index-c20gf089.js}

@@ -7,7 +7,7 @@ import {
   readLinkPointer,
   resolveKnowledgeStoreDir,
   resolveLinkDir
-} from "./index-6rx1rdaq.js";
+} from "./index-a7rw4g4s.js";
 
 // src/knowledge/curation-policy.ts
 import { appendFile, mkdir as mkdir2, readFile as readFile2 } from "fs/promises";

package/dist/cli/{index-qzvry1n1.js → index-crjx4sx0.js}

@@ -1,10 +1,10 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-r5hj3nfe.js";
+} from "./index-3tyym20r.js";
 import {
   handleGuardrailLog
-} from "./index-4gmt79q9.js";
+} from "./index-gerkwyrr.js";
 import {
   COMMAND_REGISTRY,
   SWARM_COMMAND_TOOL_ALLOWLIST,
@@ -94,75 +94,75 @@ import {
   handleWriteRetroCommand,
   normalizeSwarmCommandInput,
   resolveCommand
-} from "./index-hwz46jj7.js";
-import"./index-8d90gzaz.js";
-import"./index-f36hy1x4.js";
-import"./index-hdakb4n9.js";
-import"./index-k1ntjzmf.js";
-import"./index-5ythtd9t.js";
-import"./index-tqw8w2n5.js";
+} from "./index-399nq780.js";
+import"./index-2sqgbmtq.js";
+import"./index-hvk3zs62.js";
+import"./index-gr8ppbq3.js";
+import"./index-8fr2wn18.js";
+import"./index-0g5v4s0x.js";
+import"./index-17yszqs5.js";
 import"./index-txdagbh7.js";
 import"./index-cw912re7.js";
-import"./index-6be5caj8.js";
-import"./index-n3pjcks8.js";
-import"./index-g8wdekzz.js";
+import"./index-066xxa4q.js";
+import"./index-13egyjgv.js";
+import"./index-ybcxvv17.js";
 import"./index-70ha9e09.js";
-import"./index-dh5th4jn.js";
+import"./index-8hqkrd2j.js";
 import"./index-9ss2m4rs.js";
-import"./index-ptsqnxwd.js";
+import"./index-xezfx7ge.js";
 import"./index-zsrtt42s.js";
-import"./index-7h94rfem.js";
+import"./index-k5w284js.js";
 import"./index-6chhqq2n.js";
-import"./index-8bdk7124.js";
+import"./index-1zqf2pny.js";
 import"./index-b43rt5ph.js";
 import"./index-q7sjgr1y.js";
-import"./index-e6n7cemz.js";
-import"./index-p7hdp3rp.js";
-import"./index-afpkqsdb.js";
-import"./index-gn6ybsc4.js";
-import"./index-anxs69ad.js";
-import"./index-z6xqpmqg.js";
+import"./index-yt25kpvz.js";
+import"./index-fc1dqzjp.js";
+import"./index-w11whwn3.js";
+import"./index-zha9bdj9.js";
+import"./index-bfr392e7.js";
+import"./index-ee6ydtfe.js";
 import"./index-p612v1mv.js";
-import"./index-2k53pfnc.js";
-import"./index-ajknebrc.js";
+import"./index-6rff2h8x.js";
+import"./index-c20gf089.js";
 import"./index-rtry5xyf.js";
-import"./index-58be2gtd.js";
+import"./index-nph5g4em.js";
 import"./index-3qf1vxtb.js";
 import"./index-n832052r.js";
-import"./index-3xyjvx24.js";
-import"./index-y1zhpfk8.js";
-import"./index-xwbn7c8m.js";
-import"./index-556ja8an.js";
-import"./index-6m24v15v.js";
-import"./index-e45htt92.js";
-import"./index-w6988bbc.js";
+import"./index-xwkn5hse.js";
+import"./index-2y4kargd.js";
+import"./index-2v17wb75.js";
+import"./index-79sr3fd1.js";
+import"./index-jx9f4ke1.js";
+import"./index-aftapk6j.js";
 import"./index-ry16d01s.js";
 import"./index-n4fzmqz8.js";
-import"./index-j2svfhzk.js";
-import"./index-c4ddtrqg.js";
+import"./index-axf65x87.js";
+import"./index-bkd3450m.js";
 import"./index-ae75rja9.js";
-import"./index-6rx1rdaq.js";
+import"./index-a7rw4g4s.js";
 import"./index-7qefgq4j.js";
-import"./index-jre6tm3v.js";
+import"./index-edm41q4j.js";
 import"./index-gy0nyfbw.js";
-import"./index-5ebgzb5a.js";
+import"./index-hwj25q9r.js";
 import"./index-7g4c7s5r.js";
-import"./index-zycp24b9.js";
+import"./index-52xdezsh.js";
 import"./index-9e6fdz2h.js";
 import"./index-4rhhvd1a.js";
 import {
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-0e9jh9c7.js";
+} from "./index-wf12wckd.js";
 import {
   AGENT_TOOL_MAP,
   ORCHESTRATOR_NAME,
   init_constants
-} from "./index-a0d4fp6r.js";
-import"./index-zjygnfay.js";
+} from "./index-0tc0pcmh.js";
+import"./index-zpsr8rpc.js";
 import"./index-bk5tah7q.js";
 import"./index-bpmtbmy9.js";
-import"./index-4fwbbad3.js";
+import"./index-q1r1cfww.js";
+import"./index-yzjaj53h.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 

package/dist/cli/{index-jre6tm3v.js → index-edm41q4j.js}

@@ -4,7 +4,7 @@ import {
 } from "./index-gy0nyfbw.js";
 import {
   emit
-} from "./index-5ebgzb5a.js";
+} from "./index-hwj25q9r.js";
 import {
   require_proper_lockfile
 } from "./index-7g4c7s5r.js";

package/dist/cli/{index-z6xqpmqg.js → index-ee6ydtfe.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   init_merge
-} from "./index-zjygnfay.js";
+} from "./index-zpsr8rpc.js";
 import {
   init_logger
 } from "./index-zgwm4ryv.js";

package/dist/cli/{index-p7hdp3rp.js → index-fc1dqzjp.js}

@@ -13,7 +13,7 @@ import {
 import {
   SWARM_WORKTREE_DIR_NAME,
   init_constants
-} from "./index-a0d4fp6r.js";
+} from "./index-0tc0pcmh.js";
 import {
   log
 } from "./index-zgwm4ryv.js";
@@ -92,7 +92,7 @@ var _internals = {
     symlinkSync: fs.symlinkSync
   },
   writeScopeToDisk: async (directory, taskId, files) => {
-    const { writeScopeToDisk: realWrite } = await import("./scope-persistence-6c55akfz.js");
+    const { writeScopeToDisk: realWrite } = await import("./scope-persistence-q792yfxh.js");
     return realWrite(directory, taskId, files);
   },
   writeLaneProfileToDisk: async (_worktreePath, _laneIndex, _envOverrides) => {

package/dist/cli/{index-4gmt79q9.js → index-gerkwyrr.js}

@@ -4,7 +4,7 @@ import {
   readShellAuditTail,
   redactPath,
   redactShellCommand
-} from "./index-hdakb4n9.js";
+} from "./index-gr8ppbq3.js";
 
 // src/services/guardrail-log-service.ts
 var BLOCK_TYPES = new Set([

package/dist/cli/{index-hdakb4n9.js → index-gr8ppbq3.js}

@@ -1,26 +1,27 @@
 // @bun
-import {
-  getPathFlavor,
-  isOnDifferentPathRoot,
-  isPathIdentityWithin,
-  isPathWithinDeclaredScope,
-  pathIdentitiesEqual,
-  sanitizeDiagnosticText,
-  unsafePathTextReason
-} from "./index-556ja8an.js";
 import {
   observeStoreHealth
-} from "./index-j2svfhzk.js";
+} from "./index-axf65x87.js";
 import {
   telemetry
-} from "./index-5ebgzb5a.js";
+} from "./index-hwj25q9r.js";
 import {
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-0e9jh9c7.js";
+} from "./index-wf12wckd.js";
 import {
   init_constants
-} from "./index-a0d4fp6r.js";
+} from "./index-0tc0pcmh.js";
+import {
+  getPathFlavor,
+  init_path_identity,
+  isOnDifferentPathRoot,
+  isPathIdentityWithin,
+  isPathWithinDeclaredScope,
+  pathIdentitiesEqual,
+  sanitizeDiagnosticText,
+  unsafePathTextReason
+} from "./index-yzjaj53h.js";
 import {
   init_logger,
   warn
@@ -2075,6 +2076,7 @@ class QuickLRU extends Map {
 
 // src/hooks/guardrails/file-authority.ts
 init_schema();
+init_path_identity();
 
 // src/security/protected-path-policy.ts
 import * as path from "path";
@@ -2652,6 +2654,7 @@ function checkFileAuthority(agentName, filePath, cwd, authorityConfig, options =
 
 // src/hooks/guardrails/helpers.ts
 init_constants();
+init_path_identity();
 function isInDeclaredScope(filePath, scopeEntries, cwd) {
   return isPathWithinDeclaredScope(filePath, scopeEntries, cwd);
 }

package/dist/cli/{index-f36hy1x4.js → index-hvk3zs62.js}

@@ -9,7 +9,7 @@ import {
   readEvaluationRun,
   saveEvaluationRun,
   saveTaskSetSnapshot
-} from "./index-tqw8w2n5.js";
+} from "./index-17yszqs5.js";
 import {
   canonicalHash,
   computeCandidateInputContentHash,