opencode-swarm 7.168.0 → 7.169.0

package/dist/cli/{hive-promoter-esxtcvr1.js → hive-promoter-41zygtgx.js}

@@ -7,65 +7,66 @@ import {
   isHiveEligible,
   promoteFromSwarm,
   promoteToHive
-} from "./index-yevn4jpe.js";
-import"./index-d5qf7hvh.js";
-import"./index-qhey6vc3.js";
-import"./index-30h1pk05.js";
-import"./index-nwwk3dej.js";
-import"./index-cyenn3pf.js";
-import"./index-21ree67h.js";
-import"./index-gp9yzr1v.js";
+} from "./index-3zcds757.js";
+import"./index-5400m33a.js";
+import"./index-7h01bkm6.js";
+import"./index-5reh1bjz.js";
+import"./index-cgpwjctj.js";
+import"./index-egkc2bpv.js";
+import"./index-zapc8vj4.js";
+import"./index-xnpjwc4h.js";
 import"./index-txdagbh7.js";
 import"./index-9br68j86.js";
 import"./index-cw912re7.js";
-import"./index-64phnth4.js";
-import"./index-mr0wn36f.js";
-import"./index-wnzxcr0z.js";
+import"./index-c7kr7tnk.js";
+import"./index-55fkkjec.js";
+import"./index-nwv3e3kc.js";
 import"./index-fyfbpz4f.js";
-import"./index-dfyv3xkd.js";
+import"./index-gfbggp8k.js";
+import"./index-0hgmsyfp.js";
 import"./index-zsrtt42s.js";
-import"./index-ze520xw1.js";
-import"./index-5zqakgp4.js";
-import"./index-bvqqwx84.js";
+import"./index-sb1s03y9.js";
+import"./index-fhh02gwx.js";
+import"./index-nyn01yrz.js";
 import"./index-b43rt5ph.js";
 import"./index-q7sjgr1y.js";
-import"./index-00zx94vn.js";
-import"./index-8f0kscpg.js";
-import"./index-nprngf8p.js";
-import"./index-nsyxj57e.js";
-import"./index-kear8gb7.js";
-import"./index-p612v1mv.js";
-import"./index-3dywbkyr.js";
-import"./index-m35hybf0.js";
+import"./index-sxcfszbe.js";
+import"./index-wwr67xc0.js";
+import"./index-ksybszed.js";
+import"./index-0vgs5r39.js";
+import"./index-b3pmzbh1.js";
+import"./index-2s7dvzff.js";
+import"./index-2znfa537.js";
+import"./index-bm5xrfnx.js";
 import"./index-rtry5xyf.js";
-import"./index-x7k3dps5.js";
+import"./index-s96dpjsk.js";
 import"./index-3qf1vxtb.js";
 import"./index-n832052r.js";
-import"./index-an8b5gda.js";
-import"./index-yv76j77m.js";
-import"./index-a8xbvsse.js";
-import"./index-pyf517sz.js";
-import"./index-h439y187.js";
-import"./index-wst6n478.js";
+import"./index-p6xsgk4r.js";
+import"./index-83m0y4cj.js";
+import"./index-fgp96k3r.js";
+import"./index-br3mvbsa.js";
+import"./index-bernkwgf.js";
+import"./index-dvbf6fpn.js";
 import"./index-rdm3px0g.js";
 import"./index-ry16d01s.js";
-import"./index-qwsh0h2g.js";
+import"./index-5qt9yf5w.js";
 import {
   resolveHiveKnowledgePath
-} from "./index-j950hqmq.js";
+} from "./index-76ng6vmq.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
-import"./index-8ybjqg51.js";
-import"./index-4r5pmtvk.js";
+import"./index-9ttqbhvw.js";
+import"./index-bx1wgn3a.js";
 import"./index-7g4c7s5r.js";
-import"./index-v3xc4sde.js";
-import"./index-z6qreakh.js";
+import"./index-nprdr0sm.js";
+import"./index-nbdmdyke.js";
 import"./index-1xnse449.js";
 import"./index-ee6ydtfe.js";
-import"./index-seetnhpx.js";
+import"./index-3bfzpzsb.js";
 import"./index-0mhftbpp.js";
 import"./index-a1w58b47.js";
-import"./index-exatbqwj.js";
+import"./index-yj24ny5k.js";
 import"./index-sxt7fgcw.js";
 import"./index-bk5tah7q.js";
 import"./index-bpmtbmy9.js";

package/dist/cli/index-0hgmsyfp.js

@@ -0,0 +1,92 @@
+// @bun
+import {
+  bunSpawn
+} from "./index-2s7dvzff.js";
+import {
+  init_git_executable,
+  resolveGitExecutable
+} from "./index-0mhftbpp.js";
+
+// src/hooks/delegation-gate/worktree-ownership-tag.ts
+import * as fs from "fs";
+import * as path from "path";
+init_git_executable();
+var OWNERSHIP_TAG_SCAN_TIMEOUT_MS = 2000;
+var MAX_OWNERSHIP_TAGS = 512;
+function decodeTagPart(value) {
+  if (!value || !/^[A-Za-z0-9_-]+$/.test(value))
+    return null;
+  const decoded = Buffer.from(value, "base64url").toString("utf8");
+  return decoded && Buffer.from(decoded, "utf8").toString("base64url") === value ? decoded : null;
+}
+async function scanBackgroundWorktreeOwnershipTagsForRecovery(directory) {
+  try {
+    fs.statSync(path.join(directory, ".git"));
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return { status: "ok", owners: [] };
+    }
+    return {
+      status: "uncertain",
+      reason: `Git metadata could not be inspected: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  let proc;
+  try {
+    proc = bunSpawn([
+      resolveGitExecutable(),
+      "-C",
+      directory,
+      "for-each-ref",
+      `--count=${MAX_OWNERSHIP_TAGS + 1}`,
+      "--format=%(refname:strip=2)%00%(objectname)",
+      "refs/tags/swarm-preserved-owner/"
+    ], {
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "ignore",
+      timeout: OWNERSHIP_TAG_SCAN_TIMEOUT_MS
+    });
+    const exitCode = await proc.exited;
+    if (exitCode !== 0) {
+      return {
+        status: "uncertain",
+        reason: `ownership tag scan exited ${exitCode}`
+      };
+    }
+    const lines = (await proc.stdout.text()).split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    if (lines.length > MAX_OWNERSHIP_TAGS) {
+      return {
+        status: "uncertain",
+        reason: `ownership tag scan exceeded the ${MAX_OWNERSHIP_TAGS}-tag safety bound`
+      };
+    }
+    const owners = [];
+    for (const line of lines) {
+      const [tag, ref, ...extra] = line.split("\x00");
+      const segments = tag?.split("/") ?? [];
+      const sessionId = decodeTagPart(segments[1] ?? "");
+      const laneId = decodeTagPart(segments[2] ?? "");
+      const callDigest = segments[3];
+      if (extra.length > 0 || segments.length !== 4 || segments[0] !== "swarm-preserved-owner" || !sessionId || !laneId || !callDigest || !/^[0-9a-f]{12}$/.test(callDigest) || !ref || !/^[0-9a-f]{40,64}$/i.test(ref)) {
+        return {
+          status: "uncertain",
+          reason: `malformed background ownership tag entry "${tag ?? ""}"`
+        };
+      }
+      owners.push({ sessionId, laneId, callDigest, ref });
+    }
+    return { status: "ok", owners };
+  } catch (error) {
+    return {
+      status: "uncertain",
+      reason: `ownership tag scan failed: ${error instanceof Error ? error.message : String(error)}`
+    };
+  } finally {
+    try {
+      proc?.kill();
+    } catch {}
+  }
+}
+
+export { scanBackgroundWorktreeOwnershipTagsForRecovery };

package/dist/cli/{index-nsyxj57e.js → index-0vgs5r39.js}

@@ -1,36 +1,36 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-kear8gb7.js";
+} from "./index-b3pmzbh1.js";
 import {
   observeReceiptTransition
-} from "./index-qwsh0h2g.js";
+} from "./index-5qt9yf5w.js";
 import {
   resolveHiveEventsPath
 } from "./index-ae75rja9.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-8ybjqg51.js";
+} from "./index-9ttqbhvw.js";
 import {
   assertProjectRoot,
   atomicWriteFile
-} from "./index-4r5pmtvk.js";
+} from "./index-bx1wgn3a.js";
 import {
   require_proper_lockfile
 } from "./index-7g4c7s5r.js";
 import {
   emit
-} from "./index-z6qreakh.js";
+} from "./index-nprdr0sm.js";
 import {
   canonicalRootKey
 } from "./index-1xnse449.js";
 import {
   loadPluginConfigWithMeta
-} from "./index-seetnhpx.js";
+} from "./index-3bfzpzsb.js";
 import {
   KnowledgeConfigSchema,
   init_schema
-} from "./index-exatbqwj.js";
+} from "./index-yj24ny5k.js";
 import {
   init_logger,
   warn
@@ -2813,7 +2813,7 @@ async function applyKnowledgeVerdictFeedback(directory, options) {
     }
     let bumps = 0;
     if (deltas.length > 0) {
-      const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-stbmb1b9.js");
+      const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-85metj89.js");
       bumps = await bumpKnowledgeConfidenceBatch(directory, deltas, options?.floorOptions);
     }
     return {

package/dist/cli/{index-54w1564x.js → index-1cbjemgh.js}

@@ -14,14 +14,14 @@ import {
   detectWindowsWrites,
   getSharedClassifierGuardrailBlock,
   resolveWriteTargets
-} from "./index-yevn4jpe.js";
+} from "./index-3zcds757.js";
 import {
   checkFileAuthority,
   classifyFile,
   isInDeclaredScope,
   redactPath,
   redactShellCommand
-} from "./index-30h1pk05.js";
+} from "./index-5reh1bjz.js";
 
 // src/services/guardrail-explain-service.ts
 import path from "path";

package/dist/cli/{index-p612v1mv.js → index-2s7dvzff.js}

@@ -137,6 +137,20 @@ function bunHash(input) {
   }
   return hash;
 }
+var DEFAULT_BUN_SPAWN_MAX_BUFFER_BYTES = 5 * 1024 * 1024;
+
+class BunCompatOutputLimitError extends Error {
+  limit;
+  captured;
+  total;
+  constructor(limit, captured, total) {
+    super(`Subprocess output exceeded the ${limit}-byte buffer limit after capturing ${captured} bytes (${total} bytes observed)`);
+    this.name = "BunCompatOutputLimitError";
+    this.limit = limit;
+    this.captured = captured;
+    this.total = total;
+  }
+}
 async function killProcessTreeImpl(pid, signal, directKill, wasDetached) {
   if (typeof pid !== "number" || pid <= 0) {
     directKill(signal);
@@ -267,32 +281,95 @@ function wrapSpawnFailure(error, cwd, executable) {
     return err;
   return describeSpawnCwdFailure(cwd, executable, err) ?? err;
 }
-function streamFromNode(pipe) {
+function normalizedMaxBuffer(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : DEFAULT_BUN_SPAWN_MAX_BUFFER_BYTES;
+}
+function createOutputOverflowController(limit, requestKill) {
+  let error;
+  let killRequested = false;
+  let resolveCompleted;
+  const completed = new Promise((resolve) => {
+    resolveCompleted = resolve;
+  });
+  return {
+    get error() {
+      return error;
+    },
+    completed,
+    overflow(captured, total) {
+      if (error)
+        return;
+      error = new BunCompatOutputLimitError(limit, captured, total);
+      if (killRequested)
+        return;
+      killRequested = true;
+      try {
+        requestKill();
+      } catch {}
+    },
+    complete() {
+      resolveCompleted();
+    }
+  };
+}
+function streamFromNode(pipe, limit, controller) {
+  if (!pipe)
+    return staticStream("");
+  let mode;
   let collected;
-  let readerClaimed = false;
   const collect = () => {
-    if (readerClaimed) {
+    if (mode === "reader") {
       return Promise.reject(new TypeError("Subprocess output is already consumed by a reader"));
     }
-    collected ??= new Promise((resolve) => {
+    mode = "buffered";
+    if (collected)
+      return collected;
+    collected = new Promise((resolve) => {
       if (!pipe) {
         resolve(Buffer.alloc(0));
         return;
       }
       const chunks = [];
+      let captured = 0;
+      let total = 0;
+      let finished = false;
+      const finish = () => {
+        if (finished)
+          return;
+        finished = true;
+        resolve(Buffer.concat(chunks));
+      };
       pipe.on("data", (chunk) => {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        const bytes = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+        total += bytes.byteLength;
+        if (controller?.error || limit === undefined)
+          return;
+        const remaining = limit - captured;
+        if (remaining > 0) {
+          const retained = Buffer.from(bytes.subarray(0, remaining));
+          chunks.push(retained);
+          captured += retained.byteLength;
+        }
+        if (bytes.byteLength > remaining) {
+          controller?.overflow(captured, total);
+        }
       });
-      pipe.on("end", () => resolve(Buffer.concat(chunks)));
-      pipe.on("error", () => resolve(Buffer.concat(chunks)));
+      pipe.on("end", finish);
+      pipe.on("close", finish);
+      pipe.on("error", finish);
+    }).then(async (bytes) => {
+      await controller?.completed;
+      if (controller?.error)
+        throw controller.error;
+      return bytes;
     });
     return collected;
   };
   const toWebReadable = () => {
     if (!pipe) {
       return new ReadableStream({
-        start(controller) {
-          controller.close();
+        start(controller2) {
+          controller2.close();
         }
       });
     }
@@ -301,12 +378,12 @@ function streamFromNode(pipe) {
       return r.toWeb();
     }
     return new ReadableStream({
-      start(controller) {
+      start(controller2) {
         pipe.on("data", (chunk) => {
-          controller.enqueue(typeof chunk === "string" ? new TextEncoder().encode(chunk) : new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength));
+          controller2.enqueue(typeof chunk === "string" ? new TextEncoder().encode(chunk) : new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength));
         });
-        pipe.on("end", () => controller.close());
-        pipe.on("error", (err) => controller.error(err));
+        pipe.on("end", () => controller2.close());
+        pipe.on("error", (err) => controller2.error(err));
       },
       cancel() {
         const destroyable = pipe;
@@ -318,7 +395,7 @@ function streamFromNode(pipe) {
       }
     });
   };
-  return {
+  const result = {
     async text() {
       return (await collect()).toString("utf-8");
     },
@@ -327,18 +404,27 @@ function streamFromNode(pipe) {
       return new Uint8Array(b.buffer, b.byteOffset, b.byteLength);
     },
     getReader() {
-      if (readerClaimed || collected) {
+      if (mode !== undefined) {
         throw new TypeError("Subprocess output is already consumed");
       }
-      readerClaimed = true;
+      mode = "reader";
       return toWebReadable().getReader();
     }
   };
+  if (pipe && controller && limit !== undefined) {
+    queueMicrotask(() => {
+      if (mode === undefined)
+        collect().catch(() => {
+          return;
+        });
+    });
+  }
+  return result;
 }
 function mapStdio(v) {
   return v ?? "pipe";
 }
-function streamFromBun(stream) {
+function streamFromBun(stream, limit, controller) {
   if (!stream || typeof stream !== "object") {
     const empty = {
       async text() {
@@ -349,8 +435,8 @@ function streamFromBun(stream) {
       },
       getReader() {
         return new ReadableStream({
-          start(controller) {
-            controller.close();
+          start(controller2) {
+            controller2.close();
           }
         }).getReader();
       }
@@ -358,36 +444,82 @@ function streamFromBun(stream) {
     return empty;
   }
   const candidate = stream;
-  const collect = async () => {
-    if (typeof candidate.getReader !== "function") {
-      return new Uint8Array(0);
-    }
-    const reader = candidate.getReader();
-    const chunks = [];
-    for (;; ) {
-      const { done, value } = await reader.read();
-      if (done)
-        break;
-      if (value)
-        chunks.push(value);
-    }
-    const total = chunks.reduce((acc, c) => acc + c.byteLength, 0);
-    const out = new Uint8Array(total);
-    let off = 0;
-    for (const c of chunks) {
-      out.set(c, off);
-      off += c.byteLength;
+  let mode;
+  let collected;
+  const collect = () => {
+    if (mode === "reader") {
+      return Promise.reject(new TypeError("Subprocess output is already consumed by a reader"));
     }
-    return out;
+    mode = "buffered";
+    collected ??= (async () => {
+      if (typeof candidate.getReader !== "function")
+        return new Uint8Array(0);
+      const reader = candidate.getReader();
+      const chunks = [];
+      let captured = 0;
+      let total = 0;
+      try {
+        for (;; ) {
+          const { done, value } = await reader.read();
+          if (done)
+            break;
+          if (!value)
+            continue;
+          total += value.byteLength;
+          if (controller?.error || limit === undefined)
+            continue;
+          const remaining = limit - captured;
+          if (remaining > 0) {
+            const retained = value.slice(0, remaining);
+            chunks.push(retained);
+            captured += retained.byteLength;
+          }
+          if (value.byteLength > remaining) {
+            controller?.overflow(captured, total);
+          }
+        }
+      } finally {
+        reader.releaseLock();
+      }
+      await controller?.completed;
+      if (controller?.error)
+        throw controller.error;
+      const out = new Uint8Array(captured);
+      let offset = 0;
+      for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.byteLength;
+      }
+      return out;
+    })();
+    return collected;
   };
-  const text = typeof candidate.text === "function" ? () => candidate.text() : async () => new TextDecoder().decode(await collect());
-  const bytes = typeof candidate.bytes === "function" ? () => candidate.bytes() : collect;
-  const getReader = typeof candidate.getReader === "function" ? () => candidate.getReader() : () => new ReadableStream({
-    start(controller) {
-      controller.close();
+  const result = {
+    async text() {
+      return new TextDecoder().decode(await collect());
+    },
+    bytes: collect,
+    getReader() {
+      if (mode !== undefined) {
+        throw new TypeError("Subprocess output is already consumed");
+      }
+      mode = "reader";
+      return typeof candidate.getReader === "function" ? candidate.getReader() : new ReadableStream({
+        start(streamController) {
+          streamController.close();
+        }
+      }).getReader();
     }
-  }).getReader();
-  return { text, bytes, getReader };
+  };
+  if (typeof candidate.getReader === "function" && controller && limit !== undefined) {
+    queueMicrotask(() => {
+      if (mode === undefined)
+        collect().catch(() => {
+          return;
+        });
+    });
+  }
+  return result;
 }
 function mergeEnvForChild(baseEnv, envOverrides) {
   const hasExplicitBaseEnv = baseEnv !== undefined;
@@ -448,11 +580,13 @@ function spawnCreationFailure(error) {
   };
 }
 function bunSpawn(cmd, options) {
+  const maxBuffer = normalizedMaxBuffer(options?.maxBuffer);
   const bun = getBun();
   if (bun?.spawn) {
     const mergedEnv2 = mergeEnvForChild(options?.env, options?.envOverrides);
     const spawnOpts = { ...options };
     delete spawnOpts.killProcessTree;
+    delete spawnOpts.maxBuffer;
     if (mergedEnv2 !== undefined)
       spawnOpts.env = mergedEnv2;
     if (options?.timeout && options.timeout > 0 && options.killProcessTree !== true) {
@@ -472,6 +606,11 @@ function bunSpawn(cmd, options) {
     const proc2 = spawned;
     const killBunTree = createProcessTreeKiller(proc2.pid, (sig) => proc2.kill(sig), true);
     const killBunProcess = (sig) => options?.killProcessTree ? killBunTree(sig) : Promise.resolve(proc2.kill(sig));
+    const outputController2 = createOutputOverflowController(maxBuffer, () => {
+      killBunProcess("SIGKILL").catch(() => {
+        return;
+      });
+    });
     let timeoutHandle2;
     if (options?.killProcessTree === true && options.timeout && options.timeout > 0) {
       timeoutHandle2 = setTimeout(() => {
@@ -487,10 +626,11 @@ function bunSpawn(cmd, options) {
     const exited2 = proc2.exited.finally(() => {
       if (timeoutHandle2 !== undefined)
         clearTimeout(timeoutHandle2);
+      outputController2.complete();
     });
     return {
-      stdout: streamFromBun(proc2.stdout),
-      stderr: streamFromBun(proc2.stderr),
+      stdout: streamFromBun(proc2.stdout, maxBuffer, outputController2),
+      stderr: streamFromBun(proc2.stderr, maxBuffer, outputController2),
       exited: exited2,
       get exitCode() {
         return proc2.exitCode;
@@ -533,6 +673,11 @@ function bunSpawn(cmd, options) {
     proc.kill(signal);
     return Promise.resolve();
   };
+  const outputController = createOutputOverflowController(maxBuffer, () => {
+    killChild("SIGKILL").catch(() => {
+      return;
+    });
+  });
   let timeoutHandle;
   let observedSignal = null;
   let observedSpawnError = null;
@@ -560,10 +705,11 @@ function bunSpawn(cmd, options) {
   }).finally(() => {
     if (timeoutHandle !== undefined)
       clearTimeout(timeoutHandle);
+    outputController.complete();
   });
   return {
-    stdout: streamFromNode(proc.stdout),
-    stderr: streamFromNode(proc.stderr),
+    stdout: streamFromNode(proc.stdout, maxBuffer, outputController),
+    stderr: streamFromNode(proc.stderr, maxBuffer, outputController),
     exited,
     get exitCode() {
       return observedSpawnError ? null : proc.exitCode;
@@ -596,7 +742,10 @@ function bunSpawnSync(cmd, options) {
   const bun = getBun();
   if (bun?.spawnSync) {
     const mergedEnv2 = mergeEnvForChild(options?.env, options?.envOverrides);
-    const spawnOpts = mergedEnv2 !== undefined ? { ...options, env: mergedEnv2 } : options;
+    const spawnOpts = { ...options };
+    delete spawnOpts.maxBuffer;
+    if (mergedEnv2 !== undefined)
+      spawnOpts.env = mergedEnv2;
     try {
       return bun.spawnSync(cmd, spawnOpts);
     } catch (error) {

package/dist/cli/{index-3dywbkyr.js → index-2znfa537.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   authorizeCuration
-} from "./index-m35hybf0.js";
+} from "./index-bm5xrfnx.js";
 import {
   findNearDuplicate,
   inferTags,
@@ -9,13 +9,13 @@ import {
   resolveSwarmKnowledgePath,
   resolveSwarmRejectedPath,
   transactKnowledge
-} from "./index-j950hqmq.js";
+} from "./index-76ng6vmq.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-8ybjqg51.js";
+} from "./index-9ttqbhvw.js";
 import {
   atomicWriteFile
-} from "./index-4r5pmtvk.js";
+} from "./index-bx1wgn3a.js";
 import {
   require_proper_lockfile
 } from "./index-7g4c7s5r.js";

package/dist/cli/{index-seetnhpx.js → index-3bfzpzsb.js}

@@ -14,7 +14,7 @@ import {
   PluginConfigSchema,
   init_schema,
   resolveExternalSkillsConfig
-} from "./index-exatbqwj.js";
+} from "./index-yj24ny5k.js";
 import {
   exports_external,
   init_zod