opencode-swarm 7.177.1 → 7.178.1

package/dist/cli/{index-fpbcxykc.js → index-6b295cas.js}

@@ -163,6 +163,92 @@ function isCanonicalPathWithinRoot(targetPath, rootPath) {
   }
   return false;
 }
+function createCanonicalPathWithinRootChecker(rootPath) {
+  const resolvedRoot = path.resolve(rootPath);
+  const canonicalRoot = canonicalExistingFilesystemPath(rootPath);
+  const rootPrefix = canonicalRoot ? canonicalRoot.endsWith("/") ? canonicalRoot : `${canonicalRoot}/` : null;
+  const entryCache = new Map;
+  const maxCacheEntries = 32768;
+  const isWithinCanonicalRoot = (candidate) => {
+    return canonicalRoot !== null && (candidate === canonicalRoot || candidate.startsWith(rootPrefix ?? ""));
+  };
+  const readEntry = (entryPath) => {
+    const cached = entryCache.get(entryPath);
+    if (cached)
+      return cached;
+    let entry;
+    try {
+      const stat = fs.lstatSync(entryPath);
+      const isSymbolicLink = stat.isSymbolicLink();
+      entry = {
+        inaccessible: false,
+        isSymbolicLink,
+        canonicalPath: isSymbolicLink ? canonicalExistingFilesystemPath(entryPath) : null
+      };
+    } catch (error) {
+      const code = error && typeof error === "object" && "code" in error ? String(error.code) : undefined;
+      entry = {
+        inaccessible: code !== "ENOENT" && code !== "ENOTDIR",
+        isSymbolicLink: false,
+        canonicalPath: null
+      };
+    }
+    if (entryCache.size >= maxCacheEntries)
+      entryCache.clear();
+    entryCache.set(entryPath, entry);
+    return entry;
+  };
+  return (targetPath) => {
+    if (canonicalRoot === null)
+      return false;
+    const resolvedTarget = path.resolve(targetPath);
+    const relative2 = path.relative(resolvedRoot, resolvedTarget);
+    if (relative2.startsWith("..") || path.isAbsolute(relative2))
+      return false;
+    let probe = resolvedTarget;
+    for (let depth = 0;depth < 4096; depth++) {
+      const entry = readEntry(probe);
+      if (entry.inaccessible)
+        return false;
+      if (entry.isSymbolicLink) {
+        return entry.canonicalPath !== null && isWithinCanonicalRoot(entry.canonicalPath);
+      }
+      if (probe === resolvedRoot)
+        return true;
+      const parent = path.dirname(probe);
+      if (parent === probe)
+        return false;
+      probe = parent;
+    }
+    return false;
+  };
+}
+function createTargetWithinRootValidator(root) {
+  const isCanonicalWithinRoot = createCanonicalPathWithinRootChecker(root);
+  return (filePath) => {
+    if (!filePath || filePath.trim() === "") {
+      return "Empty path";
+    }
+    if (path.isAbsolute(filePath) || /^[A-Za-z]:[/\\]/.test(filePath)) {
+      return `Absolute path rejected: ${filePath}`;
+    }
+    if (containsPathTraversal(filePath)) {
+      return `Path traversal detected: ${filePath}`;
+    }
+    if (containsControlChars(filePath)) {
+      return `Control characters detected in path: ${filePath}`;
+    }
+    const resolved = path.resolve(root, filePath);
+    const relative2 = path.relative(root, resolved);
+    if (relative2.startsWith("..") || path.isAbsolute(relative2)) {
+      return `Path escapes root: ${filePath}`;
+    }
+    if (!isCanonicalWithinRoot(resolved)) {
+      return `Path escapes root via symlink/junction: ${filePath}`;
+    }
+    return null;
+  };
+}
 function validateTargetWithinRoot(filePath, root) {
   if (!filePath || filePath.trim() === "") {
     return "Empty path";
@@ -197,4 +283,4 @@ var _internals = {
   validateTargetWithinRoot
 };
 
-export { containsPathTraversal, containsControlChars, validateWorkspaceRoot, validateProjectDirectory, validateSymlinkBoundary, isCanonicalPathWithinRoot, validateTargetWithinRoot };
+export { containsPathTraversal, containsControlChars, validateWorkspaceRoot, validateProjectDirectory, validateSymlinkBoundary, isCanonicalPathWithinRoot, createTargetWithinRootValidator, validateTargetWithinRoot };

package/dist/cli/{index-1042jnb9.js → index-6e8fpjdg.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   isCanonicalPathWithinRoot
-} from "./index-fpbcxykc.js";
+} from "./index-6b295cas.js";
 import {
   sameExistingFilesystemPath
 } from "./index-ry16d01s.js";
@@ -12,13 +12,13 @@ import {
   PluginConfigSchema,
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-e48h8m73.js";
+} from "./index-zv3j0v08.js";
 import {
   ALL_AGENT_NAMES,
   TOOL_NAME_SET,
   init_constants,
   init_tool_metadata
-} from "./index-n7nzwz0q.js";
+} from "./index-m2n1rhgv.js";
 import {
   log
 } from "./index-zgwm4ryv.js";
@@ -1343,6 +1343,10 @@ function validateConfigKey(path2, value) {
       emitObjectTypeMismatch("skill_opt", value, findings);
       break;
     }
+    case "dashboard": {
+      emitObjectTypeMismatch("dashboard", value, findings);
+      break;
+    }
     default: {
       const topLevel = path2.split(".")[0];
       if (KNOWN_TOP_LEVEL_KEYS.has(topLevel)) {

package/dist/cli/{index-822hhbkc.js → index-7kty6f59.js}

@@ -2,10 +2,10 @@
 import {
   captureWorkspaceSnapshotAsync,
   changedFilesSinceSnapshotAsync
-} from "./index-5d2avnj9.js";
+} from "./index-2b0ktpbf.js";
 import {
   removeWorktreeProvisioningOwner
-} from "./index-7nsvszwn.js";
+} from "./index-3pzwsesm.js";
 import {
   SOURCE_WORKTREE_GONE_STAGE,
   ensureTaskGateRequirementsReceiptForSettledTransition,
@@ -14,16 +14,16 @@ import {
   reconcileLandedMerge,
   withTaskEvidenceTransaction,
   writeWorkflowWalFile
-} from "./index-fnq5ac3f.js";
+} from "./index-1hgqs8j8.js";
 import {
   validateSwarmPath
-} from "./index-exhm2ztr.js";
+} from "./index-s4bkey0q.js";
 import {
   appendCoreEventSync
-} from "./index-t2nf57mv.js";
+} from "./index-w1b5qqnp.js";
 import {
   tryAcquireLock
-} from "./index-tj0sdxg9.js";
+} from "./index-kz9pcqn9.js";
 import {
   canonicalRootKeyFresh
 } from "./index-1xnse449.js";
@@ -38,7 +38,7 @@ import {
 import {
   init_path_identity,
   isPathWithinDeclaredScope
-} from "./index-yzjaj53h.js";
+} from "./index-9rwhas09.js";
 import {
   criticalWarn,
   init_logger
@@ -501,7 +501,7 @@ async function cleanupRecoveredWorktree(directory, descriptor, options) {
     awaitingMergeByCallID,
     cleanupStandardWorktreeForCallId,
     standardWorktreeByCallID
-  } = await import("./worktree-isolation-fsqe1qdv.js");
+  } = await import("./worktree-isolation-aebdyb1m.js");
   standardWorktreeByCallID.delete(descriptor.callID);
   if (hasResidue)
     awaitingMergeByCallID.set(descriptor.callID, {
@@ -633,7 +633,7 @@ async function recoverCoderSettlement(directory, taskId) {
           awaitingMergeByCallID,
           finishStandardWorktreeDispatch,
           standardWorktreeByCallID
-        } = await import("./worktree-isolation-fsqe1qdv.js");
+        } = await import("./worktree-isolation-aebdyb1m.js");
         const descriptor = wal.worktree;
         const reconstructedDispatch = {
           callID: descriptor.callID,

package/dist/cli/{index-k6bjkqw8.js → index-7n4dtzk4.js}

@@ -11,7 +11,7 @@ import {
   assertProjectRoot,
   atomicWriteFile,
   withEvidenceLock
-} from "./index-tj0sdxg9.js";
+} from "./index-kz9pcqn9.js";
 import {
   exports_external,
   init_zod

package/dist/cli/{index-yzjaj53h.js → index-9rwhas09.js}

@@ -66,4 +66,4 @@ var init_path_identity = __esm(() => {
   BIDI_CONTROL_CHARACTERS = /[\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
 });
 
-export { getPathFlavor, pathIdentitiesEqual, isPathIdentityWithin, isPathWithinDeclaredScope, isOnDifferentPathRoot, unsafePathTextReason, sanitizeDiagnosticText, init_path_identity };
+export { getPathFlavor, normalizePathIdentity, pathIdentitiesEqual, isPathIdentityWithin, isPathWithinDeclaredScope, isOnDifferentPathRoot, unsafePathTextReason, sanitizeDiagnosticText, init_path_identity };

package/dist/cli/{index-yrs4wwfq.js → index-b50qevsm.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   authorizeCuration
-} from "./index-wemtrnch.js";
+} from "./index-xr9n0vjv.js";
 import {
   findNearDuplicate,
   inferTags,
@@ -9,13 +9,13 @@ import {
   resolveSwarmKnowledgePath,
   resolveSwarmRejectedPath,
   transactKnowledge
-} from "./index-634pjhe4.js";
+} from "./index-2pyba37z.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-en0p0hqp.js";
+} from "./index-t8dqe4ns.js";
 import {
   atomicWriteFile
-} from "./index-tj0sdxg9.js";
+} from "./index-kz9pcqn9.js";
 import {
   require_proper_lockfile
 } from "./index-7g4c7s5r.js";

package/dist/cli/{index-v2he8xfj.js → index-bb148vht.js}

@@ -2,13 +2,13 @@
 import {
   derivePlanId,
   derivePlanIdentityHash
-} from "./index-1bq6hkw5.js";
+} from "./index-whjrhatw.js";
 import {
   DURABILITY_CLASSES,
   getProjectDb,
   projectDbExists,
   withImmediateTransaction
-} from "./index-xnednxvm.js";
+} from "./index-nzekzzs2.js";
 import {
   init_logger,
   warn

package/dist/cli/{index-hp5eet6g.js → index-byfrearz.js}

@@ -2,7 +2,7 @@
 import {
   _internals,
   resolveWorktreeIsolationConfig
-} from "./index-67amf4my.js";
+} from "./index-2e6txjp7.js";
 import {
   ApprovalEvidenceSchema,
   BaseEvidenceSchema,
@@ -44,7 +44,7 @@ import {
   loadPluginConfigWithMeta,
   loadPluginConfigWithMetaAsync,
   resetConfigAdvisoryDedup
-} from "./index-m0cdjvtv.js";
+} from "./index-qbs49vge.js";
 import"./index-zz7gzw57.js";
 import"./index-4ddpvd5c.js";
 import {
@@ -71,7 +71,7 @@ import {
   TurboConfigSchema,
   WorktreeIsolationConfigSchema,
   resolveAutoReviewConfig
-} from "./index-e48h8m73.js";
+} from "./index-zv3j0v08.js";
 import {
   ALL_AGENT_NAMES,
   ALL_SUBAGENT_NAMES,
@@ -81,7 +81,7 @@ import {
   QA_AGENTS,
   isQAAgent,
   isSubagent
-} from "./index-n7nzwz0q.js";
+} from "./index-m2n1rhgv.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";
 import"./index-zpsr8rpc.js";

package/dist/cli/{index-fnw6zfh0.js → index-eq1n57tg.js}

@@ -4,7 +4,7 @@ import {
   readShellAuditTail,
   redactPath,
   redactShellCommand
-} from "./index-fgv6qp10.js";
+} from "./index-x1m1nnry.js";
 
 // src/services/guardrail-log-service.ts
 var BLOCK_TYPES = new Set([