opencode-swarm 7.168.1 → 7.170.0

package/dist/cli/{index-qkwtth00.js → index-59fcfpkh.js}

@@ -1,7 +1,16 @@
 // @bun
+import {
+  validateSwarmPath
+} from "./index-b3pmzbh1.js";
 import {
   bunSpawn
-} from "./index-p612v1mv.js";
+} from "./index-2s7dvzff.js";
+import {
+  atomicWriteSwarmFileSync
+} from "./index-nbdmdyke.js";
+import {
+  canonicalRootKeyFresh
+} from "./index-1xnse449.js";
 import {
   init_git_executable,
   resolveGitExecutable
@@ -15,6 +24,7 @@ import {
   init_constants
 } from "./index-sxt7fgcw.js";
 import {
+  init_logger,
   log
 } from "./index-zgwm4ryv.js";
 import {
@@ -23,7 +33,7 @@ import {
 
 // src/worktree/core.ts
 init_constants();
-import * as fs from "fs";
+import * as fs2 from "fs";
 import * as fsPromises from "fs/promises";
 import * as os from "os";
 import * as path from "path";
@@ -68,10 +78,152 @@ function matchSwarmLaneBranch(branch) {
   return;
 }
 
+// src/parallel/lane-owners.ts
+import * as fs from "fs";
+init_logger();
+var LIVE_LANE_OWNERS_PATH = "live-lane-owners.json";
+var MAX_LIVE_LANE_OWNERS = 256;
+var MAX_LIVE_LANE_OWNERS_BYTES = 128 * 1024;
+var LIVE_LANE_OWNER_CLAIM_WINDOW_MS = 24 * 60 * 60 * 1000;
+var _internals = {
+  readFileSync: fs.readFileSync,
+  rmSync: fs.rmSync.bind(fs),
+  statSync: fs.statSync,
+  atomicWriteSwarmFileSync,
+  now: () => Date.now(),
+  kill: (pid, signal) => {
+    process.kill(pid, signal);
+    return true;
+  },
+  process: { pid: process.pid }
+};
+function storePath(directory) {
+  return validateSwarmPath(directory, LIVE_LANE_OWNERS_PATH);
+}
+function isLiveLaneOwnerEntry(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const c = value;
+  return typeof c.lanePath === "string" && c.lanePath.length > 0 && typeof c.branchName === "string" && typeof c.sessionId === "string" && typeof c.taskId === "string" && typeof c.ownerPid === "number" && Number.isInteger(c.ownerPid) && c.ownerPid > 0 && typeof c.startedAt === "number" && Number.isFinite(c.startedAt);
+}
+function readStore(directory) {
+  try {
+    const raw = _internals.readFileSync(storePath(directory), "utf-8");
+    if (raw.length > MAX_LIVE_LANE_OWNERS_BYTES) {
+      return { schemaVersion: 1, entries: [] };
+    }
+    const parsed = JSON.parse(raw);
+    if (!parsed || parsed.schemaVersion !== 1 || !Array.isArray(parsed.entries)) {
+      return { schemaVersion: 1, entries: [] };
+    }
+    return {
+      schemaVersion: 1,
+      entries: parsed.entries.filter(isLiveLaneOwnerEntry)
+    };
+  } catch {
+    return { schemaVersion: 1, entries: [] };
+  }
+}
+function writeStore(directory, store) {
+  let entries = store.entries.slice(-MAX_LIVE_LANE_OWNERS);
+  for (;; ) {
+    const serialized = JSON.stringify({ schemaVersion: 1, entries }, null, 2);
+    if (serialized.length <= MAX_LIVE_LANE_OWNERS_BYTES || entries.length === 0) {
+      if (entries.length < store.entries.length) {
+        log(`[lane-owners] store bound dropped ${store.entries.length - entries.length} oldest entries (caps: ${MAX_LIVE_LANE_OWNERS} entries / ${MAX_LIVE_LANE_OWNERS_BYTES} bytes)`);
+      }
+      if (entries.length === 0) {
+        try {
+          _internals.rmSync(storePath(directory), { force: true });
+        } catch {}
+        return;
+      }
+      _internals.atomicWriteSwarmFileSync(storePath(directory), serialized);
+      return;
+    }
+    entries = entries.slice(1);
+  }
+}
+function recordLiveLaneOwner(directory, entry) {
+  try {
+    const store = readStore(directory);
+    const filtered = store.entries.filter((e) => e.lanePath !== entry.lanePath && canonicalRootKeyFresh(e.lanePath) !== canonicalRootKeyFresh(entry.lanePath));
+    filtered.push({
+      ...entry,
+      ownerPid: _internals.process.pid,
+      startedAt: _internals.now()
+    });
+    writeStore(directory, { schemaVersion: 1, entries: filtered });
+  } catch (error) {
+    log(`[lane-owners] could not record live lane owner ${entry.lanePath}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function clearLiveLaneOwner(directory, lanePath) {
+  try {
+    const store = readStore(directory);
+    const canonical = canonicalRootKeyFresh(lanePath);
+    const filtered = store.entries.filter((e) => e.lanePath !== lanePath && canonicalRootKeyFresh(e.lanePath) !== canonical);
+    if (filtered.length === store.entries.length)
+      return;
+    writeStore(directory, { schemaVersion: 1, entries: filtered });
+  } catch (error) {
+    log(`[lane-owners] could not clear live lane owner ${lanePath}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function pidAlive(pid) {
+  try {
+    _internals.kill(pid, 0);
+    return true;
+  } catch (error) {
+    const code = error.code;
+    return code === "EPERM";
+  }
+}
+function pathExists(target) {
+  try {
+    _internals.statSync(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function listLiveLaneOwners(directory) {
+  const store = readStore(directory);
+  const now = _internals.now();
+  const live = [];
+  const reaped = [];
+  const kept = [];
+  for (const entry of store.entries) {
+    if (!pathExists(entry.lanePath)) {
+      reaped.push(entry);
+      continue;
+    }
+    if (now - entry.startedAt > LIVE_LANE_OWNER_CLAIM_WINDOW_MS) {
+      reaped.push(entry);
+      continue;
+    }
+    if (!pidAlive(entry.ownerPid)) {
+      kept.push(entry);
+      continue;
+    }
+    live.push(entry);
+    kept.push(entry);
+  }
+  if (reaped.length > 0) {
+    try {
+      writeStore(directory, { schemaVersion: 1, entries: kept });
+    } catch (error) {
+      log(`[lane-owners] could not persist reap: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return { live, reaped };
+}
+
 // src/worktree/core.ts
 init_warning_buffer();
 init_git_executable();
-var _internals = {
+var _internals2 = {
+  clearLiveLaneOwner,
   bunSpawn,
   resolveGitExecutable,
   platform: process.platform,
@@ -86,13 +238,13 @@ var _internals = {
     return value === "" ? undefined : value;
   },
   fs: {
-    existsSync: fs.existsSync,
+    existsSync: fs2.existsSync,
     cp: fsPromises.cp,
-    cpSync: fs.cpSync,
-    symlinkSync: fs.symlinkSync
+    cpSync: fs2.cpSync,
+    symlinkSync: fs2.symlinkSync
   },
   writeScopeToDisk: async (directory, taskId, files) => {
-    const { writeScopeToDisk: realWrite } = await import("./scope-persistence-f540tc50.js");
+    const { writeScopeToDisk: realWrite } = await import("./scope-persistence-gcn3zm5e.js");
     return realWrite(directory, taskId, files);
   },
   writeLaneProfileToDisk: async (_worktreePath, _laneIndex, _envOverrides) => {
@@ -122,16 +274,16 @@ async function writeLaneProfileToDiskReal(worktreePath, laneIndex, envOverrides)
   if (lines.length === 0)
     return;
   const lanesDir = path.join(worktreePath, ".swarm", "lanes");
-  await fs.promises.mkdir(lanesDir, { recursive: true });
+  await fs2.promises.mkdir(lanesDir, { recursive: true });
   const envPath = path.join(lanesDir, `${laneIndex}.env`);
-  await fs.promises.writeFile(envPath, `${lines.join(`
+  await fs2.promises.writeFile(envPath, `${lines.join(`
 `)}
 `, "utf-8");
 }
 async function removeLaneProfileFromDiskReal(worktreePath, laneIndex) {
   const envPath = path.join(worktreePath, ".swarm", "lanes", `${laneIndex}.env`);
   try {
-    await fs.promises.unlink(envPath);
+    await fs2.promises.unlink(envPath);
   } catch (err) {
     if (err.code !== "ENOENT") {
       log(`[worktree] Failed to remove lane profile ${envPath}: ${err.message}`);
@@ -145,7 +297,7 @@ var GIT_SPAWN_FAILURE_EXIT_CODE = 1;
 async function runGit(args, cwd, timeoutMs = WORKTREE_TIMEOUT_MS) {
   let proc;
   try {
-    proc = _internals.bunSpawn([_internals.resolveGitExecutable(), ...args], {
+    proc = _internals2.bunSpawn([_internals2.resolveGitExecutable(), ...args], {
       cwd,
       timeout: timeoutMs,
       stdin: "ignore",
@@ -165,6 +317,12 @@ async function runGit(args, cwd, timeoutMs = WORKTREE_TIMEOUT_MS) {
     const stdout = await proc.stdout.text();
     const stderr = await proc.stderr.text();
     return { exitCode, stdout, stderr };
+  } catch {
+    return {
+      exitCode: GIT_SPAWN_FAILURE_EXIT_CODE,
+      stdout: "",
+      stderr: `git ${args[0] ?? "command"} output could not be read in ${cwd}`
+    };
   } finally {
     try {
       proc.kill();
@@ -172,19 +330,19 @@ async function runGit(args, cwd, timeoutMs = WORKTREE_TIMEOUT_MS) {
   }
 }
 async function checkPathBudget(worktreeRoot, directory) {
-  if (_internals.platform !== "win32") {
+  if (_internals2.platform !== "win32") {
     return { ok: true };
   }
   let longPaths;
   try {
-    longPaths = await _internals.getCoreLongPaths(directory);
+    longPaths = await _internals2.getCoreLongPaths(directory);
   } catch {}
   if (longPaths === "true") {
     return { ok: true };
   }
   let proc;
   try {
-    proc = _internals.bunSpawn([_internals.resolveGitExecutable(), "ls-files"], {
+    proc = _internals2.bunSpawn([_internals2.resolveGitExecutable(), "ls-files"], {
       cwd: directory,
       timeout: WORKTREE_TIMEOUT_MS,
       stdin: "ignore",
@@ -217,6 +375,8 @@ async function checkPathBudget(worktreeRoot, directory) {
       };
     }
     return { ok: true };
+  } catch {
+    return { ok: true };
   } finally {
     try {
       proc.kill();
@@ -224,9 +384,9 @@ async function checkPathBudget(worktreeRoot, directory) {
   }
 }
 function shortenWorktreePath(_directory, sessionId, laneId) {
-  let tmp = _internals.osTmpdir();
+  let tmp = _internals2.osTmpdir();
   try {
-    tmp = fs.realpathSync(tmp);
+    tmp = fs2.realpathSync(tmp);
   } catch {}
   return path.join(tmp, "swwt", sessionId, laneId);
 }
@@ -234,13 +394,13 @@ function makeWorktreeBranchName(sessionId, id, options) {
   return buildSwarmBranchName(sessionId, id, options.purpose, options.branchStyle === "legacy-lane" && options.purpose === "lane");
 }
 function resolveWorktreeBaseDir(directory, worktreeDir) {
-  return worktreeDir ? path.resolve(directory, worktreeDir) : path.resolve(path.dirname(directory), SWARM_WORKTREE_DIR_NAME);
+  return worktreeDir ? path.resolve(directory, worktreeDir) : path.resolve(directory, SWARM_WORKTREE_DIR_NAME);
 }
 function isPathUnderSwarmWorktreeBase(targetPath, directory, worktreeDirOverrides = []) {
   const caseInsensitive = process.platform === "win32";
   let realTarget;
   try {
-    realTarget = fs.realpathSync(path.resolve(directory, targetPath));
+    realTarget = fs2.realpathSync(path.resolve(directory, targetPath));
   } catch {
     return false;
   }
@@ -252,7 +412,7 @@ function isPathUnderSwarmWorktreeBase(targetPath, directory, worktreeDirOverride
   return bases.some((base) => {
     let realBase;
     try {
-      realBase = fs.realpathSync(base);
+      realBase = fs2.realpathSync(base);
     } catch {
       realBase = path.resolve(base);
     }
@@ -290,7 +450,7 @@ async function provisionWorktree(directory, id, sessionId, options) {
     const normalizeGitPath = (p) => {
       const lexical = p.replace(/\\/g, "/").replace(/\/+$/, "");
       try {
-        return fs.realpathSync(p).replace(/\\/g, "/").replace(/\/+$/, "");
+        return fs2.realpathSync(p).replace(/\\/g, "/").replace(/\/+$/, "");
       } catch {
         return lexical;
       }
@@ -417,16 +577,16 @@ async function provisionWorktree(directory, id, sessionId, options) {
   if (strategy !== "skip") {
     const hostDepDir = path.join(directory, "node_modules");
     const laneDepDir = path.join(worktreePath, "node_modules");
-    if (_internals.fs.existsSync(hostDepDir)) {
+    if (_internals2.fs.existsSync(hostDepDir)) {
       try {
         if (strategy === "copy") {
-          await _internals.fs.cp(hostDepDir, laneDepDir, {
+          await _internals2.fs.cp(hostDepDir, laneDepDir, {
             recursive: true,
             force: true
           });
         } else if (strategy === "link") {
-          const isWindows = _internals.platform === "win32";
-          _internals.fs.symlinkSync(hostDepDir, laneDepDir, isWindows ? "junction" : "dir");
+          const isWindows = _internals2.platform === "win32";
+          _internals2.fs.symlinkSync(hostDepDir, laneDepDir, isWindows ? "junction" : "dir");
         }
       } catch (e) {
         log(`[swarm] deps_strategy '${strategy}' preparation failed for ${id}: ${e instanceof Error ? e.message : String(e)}`);
@@ -439,12 +599,12 @@ async function provisionWorktree(directory, id, sessionId, options) {
   }
   if (options.scope?.taskId && Array.isArray(options.scope.files)) {
     try {
-      await _internals.writeScopeToDisk(worktreePath, options.scope.taskId, options.scope.files);
+      await _internals2.writeScopeToDisk(worktreePath, options.scope.taskId, options.scope.files);
     } catch {}
   }
   if (options.laneProfile) {
     try {
-      await _internals.writeLaneProfileToDisk(worktreePath, options.laneProfile.laneIndex, options.laneProfile.envOverrides);
+      await _internals2.writeLaneProfileToDisk(worktreePath, options.laneProfile.laneIndex, options.laneProfile.envOverrides);
     } catch {}
   }
   return {
@@ -456,14 +616,15 @@ async function provisionWorktree(directory, id, sessionId, options) {
   };
 }
 async function removeWorktree(worktreePath, projectRoot, options) {
-  const isWindows = _internals.platform === "win32";
+  const isWindows = _internals2.platform === "win32";
   const MAX_RETRIES = 4;
   const RETRY_DELAY_MS = 2000;
   let lastError = "";
   for (let attempt = 0;attempt < MAX_RETRIES; attempt++) {
     const result = await runGit(["worktree", "remove", worktreePath], projectRoot);
     if (result.exitCode === 0) {
-      if (fs.existsSync(worktreePath)) {
+      _internals2.clearLiveLaneOwner(projectRoot, worktreePath);
+      if (fs2.existsSync(worktreePath)) {
         const trusted = isPathUnderSwarmWorktreeBase(worktreePath, projectRoot, options?.worktreeDir ? [options.worktreeDir] : []);
         if (!trusted) {
           return {
@@ -471,13 +632,13 @@ async function removeWorktree(worktreePath, projectRoot, options) {
           };
         }
         try {
-          fs.rmSync(worktreePath, { recursive: true, force: true });
+          fs2.rmSync(worktreePath, { recursive: true, force: true });
         } catch (error) {
           return {
             error: `git removed the worktree registration but residual directory cleanup failed: ${error instanceof Error ? error.message : String(error)}`
           };
         }
-        if (fs.existsSync(worktreePath)) {
+        if (fs2.existsSync(worktreePath)) {
           return {
             error: "git removed the worktree registration but the residual directory still exists after cleanup"
           };
@@ -487,21 +648,22 @@ async function removeWorktree(worktreePath, projectRoot, options) {
     }
     lastError = result.stderr.trim() || result.stdout.trim();
     if (isWindows && (lastError.includes("EBUSY") || lastError.includes("EPERM")) && attempt < MAX_RETRIES - 1) {
-      await _internals.sleep(RETRY_DELAY_MS);
+      await _internals2.sleep(RETRY_DELAY_MS);
       continue;
     }
     if (options?.force && isPathUnderSwarmWorktreeBase(worktreePath, projectRoot, options.worktreeDir ? [options.worktreeDir] : [])) {
       const forced = await runGit(["worktree", "remove", "--force", worktreePath], projectRoot);
       if (forced.exitCode === 0) {
-        if (fs.existsSync(worktreePath)) {
+        _internals2.clearLiveLaneOwner(projectRoot, worktreePath);
+        if (fs2.existsSync(worktreePath)) {
           try {
-            fs.rmSync(worktreePath, { recursive: true, force: true });
+            fs2.rmSync(worktreePath, { recursive: true, force: true });
           } catch (error) {
             return {
               error: `git force-removed the worktree registration but residual directory cleanup failed: ${error instanceof Error ? error.message : String(error)}`
             };
           }
-          if (fs.existsSync(worktreePath)) {
+          if (fs2.existsSync(worktreePath)) {
             return {
               error: "git force-removed the worktree registration but the residual directory still exists after cleanup"
             };
@@ -626,4 +788,4 @@ async function assertCleanWorkingTree(directory) {
   return { clean: true };
 }
 
-export { _internals, writeLaneProfileToDiskReal, removeLaneProfileFromDiskReal, checkPathBudget, shortenWorktreePath, makeWorktreeBranchName, resolveWorktreeBaseDir, isPathUnderSwarmWorktreeBase, provisionWorktree, removeWorktree, isCleanWorktree, autoCommitDirty, cleanUntrackedFiles, assertCleanWorkingTree };
+export { recordLiveLaneOwner, listLiveLaneOwners, _internals2 as _internals, writeLaneProfileToDiskReal, removeLaneProfileFromDiskReal, checkPathBudget, shortenWorktreePath, makeWorktreeBranchName, resolveWorktreeBaseDir, isPathUnderSwarmWorktreeBase, provisionWorktree, removeWorktree, isCleanWorktree, autoCommitDirty, cleanUntrackedFiles, assertCleanWorkingTree };

package/dist/cli/{index-j0bxxz9d.js → index-5bbem0ey.js}

@@ -2,10 +2,10 @@
 import {
   captureWorkspaceSnapshotAsync,
   changedFilesSinceSnapshotAsync
-} from "./index-5zqakgp4.js";
+} from "./index-fhh02gwx.js";
 import {
   removeWorktreeProvisioningOwner
-} from "./index-bvqqwx84.js";
+} from "./index-nyn01yrz.js";
 import {
   SOURCE_WORKTREE_GONE_STAGE,
   ensureTaskGateRequirementsReceiptForSettledTransition,
@@ -14,16 +14,16 @@ import {
   reconcileLandedMerge,
   withTaskEvidenceTransaction,
   writeWorkflowWalFile
-} from "./index-gmpmgtzn.js";
+} from "./index-06rbdzqn.js";
 import {
   validateSwarmPath
-} from "./index-kear8gb7.js";
+} from "./index-b3pmzbh1.js";
 import {
   appendCoreEventSync
-} from "./index-a8xbvsse.js";
+} from "./index-fgp96k3r.js";
 import {
   tryAcquireLock
-} from "./index-4r5pmtvk.js";
+} from "./index-bx1wgn3a.js";
 import {
   canonicalRootKeyFresh
 } from "./index-1xnse449.js";
@@ -489,7 +489,7 @@ async function cleanupRecoveredWorktree(directory, descriptor) {
     awaitingMergeByCallID,
     cleanupStandardWorktreeForCallId,
     standardWorktreeByCallID
-  } = await import("./worktree-isolation-1bdzfgky.js");
+  } = await import("./worktree-isolation-nanamt25.js");
   standardWorktreeByCallID.delete(descriptor.callID);
   if (hasResidue)
     awaitingMergeByCallID.set(descriptor.callID, {
@@ -613,7 +613,7 @@ async function recoverCoderSettlement(directory, taskId) {
           awaitingMergeByCallID,
           finishStandardWorktreeDispatch,
           standardWorktreeByCallID
-        } = await import("./worktree-isolation-1bdzfgky.js");
+        } = await import("./worktree-isolation-nanamt25.js");
         const descriptor = wal.worktree;
         const reconstructedDispatch = {
           callID: descriptor.callID,

package/dist/cli/{index-qwsh0h2g.js → index-5qt9yf5w.js}

@@ -1,12 +1,12 @@
 // @bun
-import {
-  atomicWriteSwarmFile
-} from "./index-v3xc4sde.js";
 import {
   pseudonymousRef,
   resolveLineageSalt,
   telemetry
-} from "./index-z6qreakh.js";
+} from "./index-nprdr0sm.js";
+import {
+  atomicWriteSwarmFile
+} from "./index-nbdmdyke.js";
 import {
   canonicalRootKeyFresh
 } from "./index-1xnse449.js";

package/dist/cli/{index-q1r1cfww.js → index-76qm2c2y.js}

@@ -47,9 +47,7 @@ function buildProbeProfile(tempDir) {
   return `(version 1)
 (allow default)
 (deny file-write*)
-(allow file-write* (subpath "${sbplEscapePath(tempDir)}"))
-(setenv SWARM_SANDBOX_PROBE "1")
-(unsetenv SWARM_SANDBOX_PROBE)`;
+(allow file-write* (subpath "${sbplEscapePath(tempDir)}"))`;
 }
 function probeSandboxExec() {
   try {
@@ -96,6 +94,32 @@ function resetProbeMemo() {
 function shellEscape(s) {
   return s.replace(/'/g, "'\\''");
 }
+function buildEnvOverridePrefix(envOverrides) {
+  if (!envOverrides) {
+    return "";
+  }
+  const unsetKeys = [];
+  const exportLines = [];
+  for (const [key, value] of Object.entries(envOverrides)) {
+    if (!isValidEnvKey(key)) {
+      continue;
+    }
+    if (value === null) {
+      unsetKeys.push(key);
+    } else {
+      exportLines.push(`export ${key}='${shellEscape(value)}'`);
+    }
+  }
+  const parts = [];
+  if (unsetKeys.length > 0) {
+    parts.push(`unset ${unsetKeys.join(" ")}`);
+  }
+  parts.push(...exportLines);
+  if (parts.length === 0) {
+    return "";
+  }
+  return `${parts.join("; ")}; `;
+}
 function sbplEscapePath(path2) {
   const withoutControlChars = path2.split("").filter((ch) => {
     const cp = ch.codePointAt(0);
@@ -103,27 +127,13 @@ function sbplEscapePath(path2) {
   }).join("");
   return withoutControlChars.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
 }
-function buildSandboxProfile(scopePaths, tempDir, envOverrides) {
+function buildSandboxProfile(scopePaths, tempDir) {
   const rwPaths = [...scopePaths];
   if (tempDir) {
     rwPaths.push(tempDir);
   }
   const rwAllowLines = rwPaths.map((p) => `(allow file-write* (subpath "${sbplEscapePath(p)}"))`).join(`
 `);
-  const envLines = [];
-  if (envOverrides) {
-    for (const [key, value] of Object.entries(envOverrides)) {
-      if (!isValidEnvKey(key)) {
-        continue;
-      }
-      if (value === null) {
-        envLines.push(`(unsetenv ${key})`);
-      } else {
-        const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
-        envLines.push(`(setenv ${key} "${escaped}")`);
-      }
-    }
-  }
   const profile = `(version 1)
 (allow default)
 (allow file-read* (subpath "/usr"))
@@ -132,9 +142,7 @@ function buildSandboxProfile(scopePaths, tempDir, envOverrides) {
 (allow file-read* (subpath "/lib"))
 (allow file-read* (subpath "/lib64"))
 (deny file-write*)
-${rwAllowLines}
-${envLines.join(`
-`)}`;
+${rwAllowLines}`;
   return profile;
 }
 
@@ -186,7 +194,7 @@ class MacOSSandboxExecutor {
     }
     const temp = tempDir ?? this._tempDir ?? os.tmpdir();
     const allScopes = [...this._scopePaths, ...scopePaths];
-    const profile = buildSandboxProfile(allScopes, temp, envOverrides);
+    const profile = buildSandboxProfile(allScopes, temp);
     let profilePath;
     try {
       const profileDir = mkdtempSync(path.join(os.tmpdir(), "sandbox-"));
@@ -198,7 +206,8 @@ class MacOSSandboxExecutor {
       throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
     }
     const binary = _internals.resolveSandboxExecBinary();
-    const escapedCommand = shellEscape(command);
+    const envPrefix = buildEnvOverridePrefix(envOverrides);
+    const escapedCommand = shellEscape(`${envPrefix}${command}`);
     const escapedProfilePath = shellEscape(profilePath);
     return `${binary} -f '${escapedProfilePath}' bash -c '${escapedCommand}'`;
   }
@@ -208,6 +217,7 @@ class MacOSSandboxExecutor {
       DYLD_LIBRARY_PATH: null,
       DYLD_FRAMEWORK_PATH: null,
       DYLD_ROOT_PATH: null,
+      DYLD_FORCE_FLAT_NAMESPACE: null,
       PATH: "/usr/bin:/bin:/usr/sbin:/sbin"
     };
   }
@@ -223,6 +233,7 @@ var init_sandbox_exec_executor = __esm(() => {
     resetProbeMemo,
     buildSandboxProfile,
     buildProbeProfile,
+    buildEnvOverridePrefix,
     resolveSandboxExecBinary,
     resolveProbeTargetBinary,
     exists: existsSync,
@@ -1036,7 +1047,7 @@ async function _createExecutor() {
   return null;
 }
 async function _createLinuxExecutor() {
-  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isBubblewrapAvailable } = await import("./capability-probe-faqefhah.js");
+  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isBubblewrapAvailable } = await import("./capability-probe-pdwwz8gs.js");
   await new SandboxCapabilityProbe2().detect();
   if (!isBubblewrapAvailable()) {
     return null;
@@ -1056,7 +1067,7 @@ async function _createMacOSExecutor() {
     }
     return null;
   }
-  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isSandboxExecAvailable } = await import("./capability-probe-faqefhah.js");
+  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isSandboxExecAvailable } = await import("./capability-probe-pdwwz8gs.js");
   await new SandboxCapabilityProbe2().detect();
   if (!isSandboxExecAvailable()) {
     return null;
@@ -1069,7 +1080,7 @@ async function _createMacOSExecutor() {
   }
 }
 async function _createWindowsExecutor() {
-  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isWindowsSandboxAvailable } = await import("./capability-probe-faqefhah.js");
+  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isWindowsSandboxAvailable } = await import("./capability-probe-pdwwz8gs.js");
   await new SandboxCapabilityProbe2().detect();
   if (!isWindowsSandboxAvailable()) {
     return null;

package/dist/cli/{index-qhey6vc3.js → index-7h01bkm6.js}

@@ -9,7 +9,7 @@ import {
   readEvaluationRun,
   saveEvaluationRun,
   saveTaskSetSnapshot
-} from "./index-gp9yzr1v.js";
+} from "./index-xnpjwc4h.js";
 import {
   canonicalHash,
   computeCandidateInputContentHash,
@@ -20,7 +20,7 @@ import {
 } from "./index-txdagbh7.js";
 import {
   bunSpawn
-} from "./index-p612v1mv.js";
+} from "./index-2s7dvzff.js";
 import {
   exports_external,
   init_zod