opencode-swarm 7.185.1 → 7.186.0

package/dist/cli/{index-hgfkcb1q.js → index-bgpq7wn2.js}

@@ -8,13 +8,13 @@ import {
   protectedRoots,
   redactDecisionLineForArchive,
   stableCanonicalStringify
-} from "./index-ss6b8jpz.js";
+} from "./index-4fd28s8v.js";
 import {
   detectStraySwarmDirs,
   readDoctorArtifact,
   removeStraySwarmDir,
   runConfigDoctor
-} from "./index-9h93zjm3.js";
+} from "./index-jxd67x6z.js";
 import {
   archiveEvidence,
   checkRequirementCoverage,
@@ -26,7 +26,7 @@ import {
   sanitizeTaskId,
   saveEvidence,
   validateProjectRoot
-} from "./index-pa6fzbms.js";
+} from "./index-amamkcpy.js";
 import {
   LANGUAGE_REGISTRY,
   _internals as _internals3,
@@ -77,7 +77,7 @@ import {
   alreadyCuratedThisGeneration,
   claimNextScanBatch,
   resolveCohortId
-} from "./index-smwybqka.js";
+} from "./index-wmazt588.js";
 import {
   CURATOR_CONSOLIDATION_PROMPT,
   CURATOR_INIT_PROMPT,
@@ -96,13 +96,13 @@ import {
   getGroupCommitWriter,
   importLegacyJsonl,
   readPriorDriftReports
-} from "./index-s7va6n84.js";
+} from "./index-hvmfa7m8.js";
 import {
   assertNoUnsettledCoderDispatch,
   listCoderSettlementWalStates,
   recoverCoderSettlement,
   recoverStaleCoderSettlements
-} from "./index-ek5gvpvm.js";
+} from "./index-151bdyf9.js";
 import {
   BUNDLED_PROJECT_SKILL_ROOT,
   DEFAULT_SKILL_MIN_CONFIDENCE,
@@ -123,11 +123,11 @@ import {
   retireSkill,
   selectCandidateEntries,
   syncBundledProjectSkillsIfMissingAsync
-} from "./index-dz5cbkrm.js";
+} from "./index-9y6cyc7z.js";
 import {
   buildEscalationBriefing,
   readRecentEscalations
-} from "./index-5n08z6qj.js";
+} from "./index-7xt5m1cz.js";
 import {
   parsePorcelainV2Snapshot,
   resolveCommitCountSince,
@@ -163,8 +163,8 @@ import {
   canonicalForgePrUrl,
   containsControlCharacters,
   detectForgeFromUrl,
+  findSubscriptionRecordForPrUrl,
   getPrSubscriptionHealth,
-  getProviderCapabilities,
   hasNonAsciiHostname,
   isPrSubscriptionCapacityError,
   isPrivateHost,
@@ -176,7 +176,7 @@ import {
   sweepStale,
   unsubscribe,
   updateSnapshot
-} from "./index-cp2nerjd.js";
+} from "./index-j972ags2.js";
 import {
   WORKTREE_LIFECYCLE_LOCK_FILE,
   recordWorktreeProvisioningOwner,
@@ -194,7 +194,7 @@ import {
   checkpoint,
   createSwarmTool,
   resolveWorkingDirectory
-} from "./index-nhw5rt5x.js";
+} from "./index-a6h5arqs.js";
 import {
   MAX_TRANSIENT_RETRIES,
   PlanRecoverySupersededError,
@@ -222,7 +222,7 @@ import {
   transientBackoff,
   updateTaskStatus,
   withPlanLifecycleLock
-} from "./index-pppjg0ct.js";
+} from "./index-wkv1qdb0.js";
 import {
   containsControlChars,
   containsPathTraversal,
@@ -238,7 +238,7 @@ import {
   resolveSpeckitProjection,
   validateSpeckit,
   writeProjectedSpecSync
-} from "./index-2b3bgm20.js";
+} from "./index-6ndc8cmn.js";
 import {
   clearWorktreeMergeStatus,
   getAllWorktreeMergeFailures,
@@ -269,7 +269,7 @@ import {
   transitionTaskWorkflowEvidenceWithStatus,
   withTaskEvidenceTransaction,
   writeWorkflowWalFile
-} from "./index-cnbpht7m.js";
+} from "./index-fp4hxcsy.js";
 import {
   isPathUnderSwarmWorktreeBase,
   listLiveLaneOwners,
@@ -278,7 +278,7 @@ import {
   recordLiveLaneOwner,
   removeWorktree,
   resolveWorktreeBaseDir
-} from "./index-2c6e1p7j.js";
+} from "./index-p9m1nhds.js";
 import {
   DEFAULT_STALE_DELEGATION_TIMEOUT_MS,
   DELEGATION_COMPACTION_HIGH_WATER_BYTES,
@@ -312,7 +312,7 @@ import {
   scanBackgroundCoderReservationsForAdmission,
   scanDelegationsForRecovery,
   sweepStaleDelegations
-} from "./index-nw16apxs.js";
+} from "./index-9th8npp7.js";
 import {
   MAX_EVENT_LOG_ENTRIES,
   _internals,
@@ -331,7 +331,7 @@ import {
   recordKnowledgeEvent,
   recordPhaseCloseIntent,
   resolveKnowledgeEventsPath
-} from "./index-ppj5bjaq.js";
+} from "./index-w2b8qq6d.js";
 import {
   estimateCharsForTokens,
   estimateTokens,
@@ -359,7 +359,7 @@ import {
   validateActionableFields,
   validateLesson,
   validateSkillPath
-} from "./index-ycqsnfd1.js";
+} from "./index-5pa0e0k3.js";
 import {
   MAX_CURATION_PROPOSALS,
   authorizeCuration,
@@ -370,7 +370,7 @@ import {
 } from "./index-rtry5xyf.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-7jt24hpz.js";
+} from "./index-d7mcdyqb.js";
 import {
   RetrospectiveEvidenceSchema
 } from "./index-frcemc0b.js";
@@ -382,7 +382,7 @@ import {
   clearScopeBindings,
   readAuthoritativeScopeBindingSet,
   readDeclaredScopeFilesFromBindings
-} from "./index-6wqv8f7d.js";
+} from "./index-vk3ngryj.js";
 import {
   clearPlanLedgerForReset,
   computePlanStructureHash,
@@ -398,7 +398,7 @@ import {
   replayFromLedgerWithStatus,
   resolvePlanningProfile,
   takeSnapshotEvent
-} from "./index-dryhmaft.js";
+} from "./index-bajvxmnb.js";
 import {
   CORE_EVENT_LOCKED,
   appendCoreEventSync,
@@ -487,7 +487,7 @@ import {
   transactFile,
   transactKnowledge,
   wordBigrams
-} from "./index-7n3h39h9.js";
+} from "./index-m94gfe82.js";
 import {
   readTailJsonl,
   readTailJsonlDetailed,
@@ -568,7 +568,7 @@ import {
   loadGateOverrides,
   loadPluginConfig,
   loadPluginConfigWithMeta
-} from "./index-ekyg4p8b.js";
+} from "./index-a1tpq5zr.js";
 import {
   addDeferredWarning,
   advisoryWarn,
@@ -600,7 +600,7 @@ import {
   resolveContextWindow,
   resolveGeneratedAgentRole,
   stripKnownSwarmPrefix
-} from "./index-rr1dggfe.js";
+} from "./index-qyjyd3ej.js";
 import {
   AGENT_TOOL_MAP,
   ALL_AGENT_NAMES,
@@ -3389,7 +3389,7 @@ async function importLegacyPrWorkflowGateStateIfNeeded(directory, sessionID, all
       return null;
     throw error2;
   }
-  const legacy = allowSalvagedImport ? (await (await import("./pr-workflow-gate-qd5tfkak.js")).readPrWorkflowGateStateForRecovery(directory, sessionID))?.state ?? null : await readPrWorkflowGateStateFileFromDisk(filePath, sessionID);
+  const legacy = allowSalvagedImport ? (await (await import("./pr-workflow-gate-tdj50p2g.js")).readPrWorkflowGateStateForRecovery(directory, sessionID))?.state ?? null : await readPrWorkflowGateStateFileFromDisk(filePath, sessionID);
   if (!legacy)
     return null;
   const namespace = workflowGateStateCoordinationNamespace(sessionID);
@@ -3476,7 +3476,7 @@ async function deleteStateWhileLocked(directory, sessionID, options = {}) {
   let recoveryState = null;
   if (!currentAuthoritative) {
     if (options.allowSalvagedRead) {
-      const { readPrWorkflowGateStateForRecovery } = await import("./pr-workflow-gate-qd5tfkak.js");
+      const { readPrWorkflowGateStateForRecovery } = await import("./pr-workflow-gate-tdj50p2g.js");
       recoveryState = (await readPrWorkflowGateStateForRecovery(directory, normalizedSessionID))?.state ?? null;
     }
     if (!recoveryState) {
@@ -15039,7 +15039,7 @@ function isLaneOwnedByCurrentSession(branchName, expectedSessionId) {
   return extracted === expectedSessionId;
 }
 async function inspectStandardWorktreeCollisionOwnership(identity) {
-  const collisionOwnership = await import("./worktree-collision-ownership-80n814a8.js");
+  const collisionOwnership = await import("./worktree-collision-ownership-e2cqcmnw.js");
   return collisionOwnership.inspectStandardWorktreeCollisionOwnership(identity);
 }
 async function runRecoveryGit(directory, args, timeoutMs = 15000) {
@@ -15465,7 +15465,7 @@ async function precreateStandardWorktreeSession(args) {
   const laneProfile = computeLaneRuntimeProfile(worktreeConfig.runtime_isolation, laneIndex, handle.worktreePath);
   if (laneProfile) {
     try {
-      const { writeLaneProfileToDiskReal } = await import("./core-cxnqsrxp.js");
+      const { writeLaneProfileToDiskReal } = await import("./core-pj2fz34e.js");
       await writeLaneProfileToDiskReal(handle.worktreePath, laneProfile.laneIndex, laneProfile.envOverrides);
     } catch {}
   }
@@ -16444,7 +16444,7 @@ async function finishStandardWorktreeDispatch(directory, dispatch, config, callI
       }
       clearWorktreeMergeStatus(statusKey);
       try {
-        const { removeLaneProfileFromDiskReal } = await import("./core-cxnqsrxp.js");
+        const { removeLaneProfileFromDiskReal } = await import("./core-pj2fz34e.js");
         await removeLaneProfileFromDiskReal(dispatch.handle.worktreePath, dispatch.laneIndex);
       } catch {}
       const state = serializationStateBySessionID.get(dispatch.parentSessionID);
@@ -24083,7 +24083,7 @@ function clearCriticalShownIds(sessionID) {
 async function rehydratePrSubscriptions(sessionID, directory) {
   const map = new Map;
   try {
-    const { listActive: listActive2 } = await import("./pr-subscriptions-qwr6ybcb.js");
+    const { listActive: listActive2 } = await import("./pr-subscriptions-qw4wjv66.js");
     const records = await listActive2(directory);
     for (const record of records) {
       if (record.sessionID !== sessionID)
@@ -24568,11 +24568,11 @@ async function activatePrWorkflow(directory, sessionID, mode, options = {}) {
     let existing = await readPrWorkflowGateStateFromDisk3(directory, normalizedSessionID);
     if (existing?.mode === mode) {
       if (mode === "PR_FEEDBACK" && options.prUrl) {
-        const requestedTarget = canonicalGitHubPrUrl(options.prUrl);
+        const requestedTarget = canonicalGitHubPrUrl(options.prUrl, options.forge);
         if (!requestedTarget) {
           throw new Error("BLOCKED: PR_FEEDBACK target must be a canonical GitHub PR URL");
         }
-        const existingTarget = existing.prFeedbackTargetUrl ? canonicalGitHubPrUrl(existing.prFeedbackTargetUrl) : null;
+        const existingTarget = existing.prFeedbackTargetUrl ? canonicalGitHubPrUrl(existing.prFeedbackTargetUrl, options.forge) : null;
         if (existingTarget && requestedTarget !== existingTarget) {
           throw new Error(`BLOCKED: active PR_FEEDBACK targets a different GitHub pull request`);
         }
@@ -24606,7 +24606,7 @@ async function activatePrWorkflow(directory, sessionID, mode, options = {}) {
     const initialHead = options.prHeadSha ? await assertCurrentCheckoutHead(directory, options.prHeadSha, mode) : undefined;
     const skillContractAdvisories = await ensurePrWorkflowSkillContractsFresh(directory, mode);
     const timestamp = isoNow();
-    const feedbackTargetUrl = mode === "PR_FEEDBACK" && options.prUrl ? canonicalGitHubPrUrl(options.prUrl) ? options.prUrl : null : undefined;
+    const feedbackTargetUrl = mode === "PR_FEEDBACK" && options.prUrl ? canonicalGitHubPrUrl(options.prUrl, options.forge) ? options.prUrl : null : undefined;
     if (feedbackTargetUrl === null) {
       throw new Error("BLOCKED: PR_FEEDBACK target must be a canonical GitHub PR URL");
     }
@@ -29150,8 +29150,8 @@ async function readPrReviewFinalFindingPolicyForReport(directory, sessionID) {
   const blockingFindingIds = policyProjection.blockingFindingIds.flatMap((id) => sourceIdsByPolicyFindingId.get(id) ?? [id]).sort();
   return { policyVersion: 1, permittedVerdicts, blockingFindingIds };
 }
-function canonicalGitHubPrUrl(value) {
-  return canonicalForgePrUrl(value);
+function canonicalGitHubPrUrl(value, configured) {
+  return canonicalForgePrUrl(value, configured);
 }
 function assertMatchingPrReviewFeedbackConsent(record, input) {
   if (record.session_id !== input.sessionID || record.run_id !== input.runId || record.handoff_path !== input.handoffPath || record.handoff_digest !== input.handoffDigest || canonicalGitHubPrUrl(record.pr_url) !== canonicalGitHubPrUrl(input.prUrl) || record.pr_head_sha.toLowerCase() !== input.prHeadSha.toLowerCase() || record.finding_ids_digest !== input.findingIdsDigest || record.source_workflow_instance_id !== input.sourceWorkflowInstanceId) {
@@ -32223,6 +32223,128 @@ async function readPrWorkflowGateStateForRecovery(directory, sessionID) {
 // src/commands/registry.ts
 init_logger();
 
+// src/commands/_shared/url-security.ts
+import * as child_process from "child_process";
+init_git_executable();
+var MAX_URL_LEN = 2048;
+var _internals32 = {
+  spawnSync: (cmd, args, options) => {
+    const mergedEnv = mergeEnvForChild(options?.env, options?.envOverrides);
+    return child_process.spawnSync(cmd, args, {
+      ...options,
+      env: mergedEnv
+    });
+  }
+};
+function sanitizeUrl(raw) {
+  let urlStr = raw.trim();
+  urlStr = urlStr.replace(/^([A-Za-z][A-Za-z0-9+.-]*:\/\/)\/?[^@/]+@/, "$1");
+  urlStr = urlStr.replace(/\[\s*MODE\s*:[^\]]*\]/gi, "");
+  urlStr = urlStr.replace(/^([A-Za-z][A-Za-z0-9+.-]*:\/\/)\/?[^@/]+@/, "$1");
+  const fragmentIdx = urlStr.indexOf("#");
+  if (fragmentIdx !== -1) {
+    urlStr = urlStr.slice(0, fragmentIdx);
+  }
+  const queryIdx = urlStr.indexOf("?");
+  if (queryIdx !== -1) {
+    urlStr = urlStr.slice(0, queryIdx);
+  }
+  if (urlStr.length > MAX_URL_LEN) {
+    urlStr = urlStr.slice(0, MAX_URL_LEN);
+  }
+  return urlStr.trim();
+}
+function sanitizeErrorEcho(raw, maxLength = 80) {
+  let stripped = "";
+  for (const ch of raw) {
+    const cp = ch.codePointAt(0);
+    if (cp !== undefined && (cp <= 31 || cp === 127)) {
+      stripped += " ";
+      continue;
+    }
+    stripped += ch;
+  }
+  const collapsed = stripped.replace(/\s+/g, " ").trim();
+  if (collapsed.length <= maxLength)
+    return collapsed;
+  return `${collapsed.slice(0, maxLength)}\u2026`;
+}
+function validateAndSanitizeGithubUrl(rawUrl, resource, configured) {
+  const sanitized = sanitizeUrl(rawUrl);
+  if (!sanitized) {
+    return { error: "Empty URL" };
+  }
+  if (!sanitized.startsWith("https://")) {
+    return { error: "URL must use HTTPS scheme" };
+  }
+  try {
+    const url = new URL(sanitized);
+    if (hasNonAsciiHostname(url.hostname)) {
+      return { error: "Non-ASCII hostnames are not allowed" };
+    }
+    if (isPrivateHost(url)) {
+      return { error: "Private or localhost URLs are not allowed" };
+    }
+    const matched = matchForgeResourceUrl(sanitized, resource, configured);
+    if (!matched) {
+      return {
+        error: resource === "issues" ? "URL must be a GitHub issue URL (https://github.com/owner/repo/issues/N) or a GitLab issue URL (https://<gitlab-host>/owner/repo/-/issues/N)" : "URL must be a GitHub pull request URL (https://github.com/owner/repo/pull/N) or a GitLab merge request URL (https://<gitlab-host>/owner/repo/-/merge_requests/N)"
+      };
+    }
+    return { sanitized };
+  } catch {
+    return { error: "Invalid URL format" };
+  }
+}
+function detectGitRemote(cwd, laneEnv) {
+  try {
+    const result = _internals32.spawnSync(resolveGitExecutable(), ["remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 5000,
+      ...cwd ? { cwd } : {},
+      envOverrides: laneEnv
+    });
+    if (result.status !== 0 || result.error) {
+      return null;
+    }
+    const remoteUrl = (result.stdout ?? "").trim();
+    return remoteUrl || null;
+  } catch {
+    return null;
+  }
+}
+function parseGitRemoteUrl(remoteUrl) {
+  const httpsMatch = remoteUrl.match(/^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/i);
+  if (httpsMatch) {
+    const owner = httpsMatch[1];
+    const repo = httpsMatch[2].replace(/\.git$/, "");
+    if (containsControlCharacters(owner) || containsControlCharacters(repo)) {
+      return null;
+    }
+    return { owner, repo };
+  }
+  const sshMatch = remoteUrl.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/i);
+  if (sshMatch) {
+    const owner = sshMatch[1];
+    const repo = sshMatch[2].replace(/\.git$/, "");
+    if (containsControlCharacters(owner) || containsControlCharacters(repo)) {
+      return null;
+    }
+    return { owner, repo };
+  }
+  const pathMatch = remoteUrl.match(/\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
+  if (pathMatch) {
+    const owner = pathMatch[1];
+    const repo = pathMatch[2].replace(/\.git$/, "");
+    if (containsControlCharacters(owner) || containsControlCharacters(repo)) {
+      return null;
+    }
+    return { owner, repo };
+  }
+  return null;
+}
+
 // src/commands/abort-pr-workflow.ts
 var USAGE2 = [
   "Usage: /swarm abort-pr-workflow [PR_REVIEW|PR_FEEDBACK] [reason...]",
@@ -32327,7 +32449,7 @@ import { createHash as createHash24 } from "crypto";
 import { mkdir as mkdir6, readFile as readFile10, unlink as unlink2 } from "fs/promises";
 import { dirname as dirname15 } from "path";
 var SPEC_DRIFT_RECOVERY_AGENT = "spec-drift-recovery";
-var _internals32 = {
+var _internals33 = {
   appendEvent,
   assertProjectRoot,
   bunWrite,
@@ -32412,21 +32534,21 @@ async function writeWal3(walPath, wal) {
 }
 async function verifySnapshot(snapshotPath, currentSpec) {
   if (!currentSpec) {
-    await _internals32.unlinkIfExists(snapshotPath);
-    const stillExists = await _internals32.readFileText(snapshotPath) !== null;
+    await _internals33.unlinkIfExists(snapshotPath);
+    const stillExists = await _internals33.readFileText(snapshotPath) !== null;
     if (stillExists) {
       throw new Error("spec snapshot verification failed: snapshot still exists after delete");
     }
     return;
   }
   await atomicWriteFile(snapshotPath, currentSpec.content);
-  const written = await _internals32.readFileText(snapshotPath);
+  const written = await _internals33.readFileText(snapshotPath);
   if (written !== currentSpec.content) {
     throw new Error("spec snapshot verification failed: snapshot content does not match effective spec");
   }
 }
 async function ensureSnapshotEvent(directory, plan, transitionId) {
-  const events = await _internals32.readLedgerEvents(directory);
+  const events = await _internals33.readLedgerEvents(directory);
   for (const event of events) {
     const payload = event.payload;
     const approval = payload?.approval;
@@ -32434,17 +32556,17 @@ async function ensureSnapshotEvent(directory, plan, transitionId) {
       return;
     }
   }
-  await _internals32.takeSnapshotEvent(directory, plan, {
+  await _internals33.takeSnapshotEvent(directory, plan, {
     source: "spec_drift_recovery",
     approvalMetadata: { specDriftTransitionId: transitionId }
   });
 }
 async function appendEvent(directory, event) {
-  const existing = await _internals32.verifyEventPresence(directory, event.type, event.transitionId);
+  const existing = await _internals33.verifyEventPresence(directory, event.type, event.transitionId);
   if (existing)
     return;
   appendCoreEventSync(directory, { ...event }, { dedupeOnAuthorityKey: true });
-  const verified = await _internals32.verifyEventPresence(directory, event.type, event.transitionId);
+  const verified = await _internals33.verifyEventPresence(directory, event.type, event.transitionId);
   if (!verified) {
     throw new Error(`spec drift audit verification failed for transition ${event.transitionId}`);
   }
@@ -32466,7 +32588,7 @@ function buildRecoveryEvent(args) {
   if (args.mode === "acknowledge") {
     return {
       type: "spec_drift_acknowledged",
-      timestamp: _internals32.now(),
+      timestamp: _internals33.now(),
       phase: args.phase,
       planTitle: args.planTitle,
       acknowledgedBy: args.actor === "spec_write" ? "unknown" : args.actor,
@@ -32478,7 +32600,7 @@ function buildRecoveryEvent(args) {
   }
   return {
     type: "spec_drift_repaired",
-    timestamp: _internals32.now(),
+    timestamp: _internals33.now(),
     phase: args.phase,
     planTitle: args.planTitle,
     repairedBy: args.actor,
@@ -32489,11 +32611,11 @@ function buildRecoveryEvent(args) {
   };
 }
 async function reconcileSpecDrift(directory, options) {
-  _internals32.assertProjectRoot(directory);
-  const markerPath = _internals32.validateSwarmPath(directory, "spec-staleness.json");
-  const walPath = _internals32.validateSwarmPath(directory, "spec-drift-recovery.json");
-  const snapshotPath = _internals32.validateSwarmPath(directory, "spec-snapshot.md");
-  const markerMaybe = await _internals32.readFileText(markerPath);
+  _internals33.assertProjectRoot(directory);
+  const markerPath = _internals33.validateSwarmPath(directory, "spec-staleness.json");
+  const walPath = _internals33.validateSwarmPath(directory, "spec-drift-recovery.json");
+  const snapshotPath = _internals33.validateSwarmPath(directory, "spec-snapshot.md");
+  const markerMaybe = await _internals33.readFileText(markerPath);
   if (markerMaybe === null) {
     return {
       status: "no_marker",
@@ -32501,7 +32623,7 @@ async function reconcileSpecDrift(directory, options) {
       message: "No spec drift detected."
     };
   }
-  const specLockResult = options.specLockAlreadyHeld ? null : await _internals32.tryAcquireLock(directory, "spec.md", SPEC_DRIFT_RECOVERY_AGENT, `spec-${options.mode}-${Date.now()}`);
+  const specLockResult = options.specLockAlreadyHeld ? null : await _internals33.tryAcquireLock(directory, "spec.md", SPEC_DRIFT_RECOVERY_AGENT, `spec-${options.mode}-${Date.now()}`);
   if (specLockResult && !specLockResult.acquired) {
     return {
       status: "retry_later",
@@ -32511,7 +32633,7 @@ async function reconcileSpecDrift(directory, options) {
   }
   let lockResult;
   try {
-    lockResult = await _internals32.tryAcquireLock(directory, "plan.json", SPEC_DRIFT_RECOVERY_AGENT, `${options.mode}-${Date.now()}`);
+    lockResult = await _internals33.tryAcquireLock(directory, "plan.json", SPEC_DRIFT_RECOVERY_AGENT, `${options.mode}-${Date.now()}`);
   } catch (error2) {
     if (specLockResult?.acquired && specLockResult.lock._release) {
       await specLockResult.lock._release().catch(() => {});
@@ -32537,7 +32659,7 @@ async function reconcileSpecDrift(directory, options) {
   let errorNewHash;
   try {
     try {
-      const authoritativeMarkerRaw = await _internals32.readFileText(markerPath);
+      const authoritativeMarkerRaw = await _internals33.readFileText(markerPath);
       if (authoritativeMarkerRaw === null) {
         return {
           status: "no_marker",
@@ -32545,14 +32667,14 @@ async function reconcileSpecDrift(directory, options) {
           message: "No spec drift detected."
         };
       }
-      const marker = _internals32.parseMarker(authoritativeMarkerRaw);
+      const marker = _internals33.parseMarker(authoritativeMarkerRaw);
       if (!marker) {
         return buildCorruptMarkerResult(options.mode);
       }
       errorMarker = marker;
       const markerHash = sha2563(authoritativeMarkerRaw);
-      const existingWalRaw = await _internals32.readFileText(walPath);
-      const existingWal = existingWalRaw === null ? null : _internals32.parseWal(existingWalRaw);
+      const existingWalRaw = await _internals33.readFileText(walPath);
+      const existingWal = existingWalRaw === null ? null : _internals33.parseWal(existingWalRaw);
       if (existingWalRaw !== null && !existingWal) {
         return {
           status: "failed",
@@ -32562,7 +32684,7 @@ async function reconcileSpecDrift(directory, options) {
           planTitle: marker.planTitle
         };
       }
-      const currentSpec = _internals32.readEffectiveSpecSync(directory);
+      const currentSpec = _internals33.readEffectiveSpecSync(directory);
       const proposedNewHash = currentSpec?.hash ?? null;
       const proposedTransitionId = buildTransitionId(options.mode, markerHash, marker.specHash_plan, proposedNewHash);
       const proposedWal = {
@@ -32577,7 +32699,7 @@ async function reconcileSpecDrift(directory, options) {
         newHash: proposedNewHash,
         specContent: currentSpec?.content ?? null,
         actor: options.actor,
-        recordedAt: _internals32.now()
+        recordedAt: _internals33.now()
       };
       const markerReplacedDuringPrepared = existingWal?.state === "PREPARED" && existingWal.markerHash !== markerHash;
       const wal = existingWal?.state === "PREPARED" || existingWal?.markerHash === markerHash ? existingWal : proposedWal;
@@ -32586,12 +32708,12 @@ async function reconcileSpecDrift(directory, options) {
       errorTransitionId = transitionId;
       errorNewHash = newHash;
       if (wal === proposedWal) {
-        await _internals32.writeWal(walPath, wal);
+        await _internals33.writeWal(walPath, wal);
       }
       if (wal.newHash === null !== (wal.specContent === null) || wal.specContent !== null && sha2563(wal.specContent) !== wal.newHash) {
         throw new Error(`Spec drift recovery WAL ${transitionId} has inconsistent captured spec content`);
       }
-      let plan = await _internals32.loadPlanJsonOnly(directory);
+      let plan = await _internals33.loadPlanJsonOnly(directory);
       if (!plan) {
         return {
           status: "failed",
@@ -32622,13 +32744,13 @@ async function reconcileSpecDrift(directory, options) {
         }
         if (planMatchesOld) {
           plan.specHash = newHash ?? undefined;
-          await _internals32.savePlan(directory, plan, {
+          await _internals33.savePlan(directory, plan, {
             planLockAlreadyHeld: true
           });
-          plan = await _internals32.loadPlanJsonOnly(directory) ?? plan;
+          plan = await _internals33.loadPlanJsonOnly(directory) ?? plan;
         }
-        await _internals32.ensureSnapshotEvent(directory, plan, transitionId);
-        await _internals32.verifySnapshot(snapshotPath, wal.specContent === null ? null : { content: wal.specContent });
+        await _internals33.ensureSnapshotEvent(directory, plan, transitionId);
+        await _internals33.verifySnapshot(snapshotPath, wal.specContent === null ? null : { content: wal.specContent });
         const event = buildRecoveryEvent({
           mode: wal.mode,
           actor: wal.actor,
@@ -32639,15 +32761,15 @@ async function reconcileSpecDrift(directory, options) {
           previousHash: wal.previousHash,
           transitionId
         });
-        await _internals32.appendEvent(directory, event);
-        await _internals32.writeWal(walPath, { ...wal, state: "COMMITTED" });
+        await _internals33.appendEvent(directory, event);
+        await _internals33.writeWal(walPath, { ...wal, state: "COMMITTED" });
       }
       if (markerReplacedDuringPrepared) {
         const preservedMarker = {
           ...marker,
           specHash_plan: newHash,
           reason: `prior prepared drift recovery committed before this marker: ${marker.reason}`,
-          timestamp: _internals32.now()
+          timestamp: _internals33.now()
         };
         await atomicWriteFile(markerPath, `${JSON.stringify(preservedMarker, null, 2)}
 `);
@@ -32662,7 +32784,7 @@ async function reconcileSpecDrift(directory, options) {
           transitionId
         };
       }
-      const latestSpec = _internals32.readEffectiveSpecSync(directory);
+      const latestSpec = _internals33.readEffectiveSpecSync(directory);
       if ((latestSpec?.hash ?? null) !== newHash) {
         const refreshedMarker = {
           planTitle: wal.planTitle,
@@ -32670,7 +32792,7 @@ async function reconcileSpecDrift(directory, options) {
           specHash_plan: newHash,
           specHash_current: latestSpec?.hash ?? null,
           reason: "spec changed while drift recovery was committing",
-          timestamp: _internals32.now()
+          timestamp: _internals33.now()
         };
         await atomicWriteFile(markerPath, `${JSON.stringify(refreshedMarker, null, 2)}
 `);
@@ -32686,8 +32808,8 @@ async function reconcileSpecDrift(directory, options) {
         };
       }
       try {
-        await _internals32.unlinkIfExists(markerPath);
-        _internals32.invalidateCachedArtifact(markerPath);
+        await _internals33.unlinkIfExists(markerPath);
+        _internals33.invalidateCachedArtifact(markerPath);
       } catch (error2) {
         return {
           status: "cleanup_pending",
@@ -33184,7 +33306,7 @@ ${USAGE4}`;
 
 // src/commands/archive.ts
 init_loader();
-var _internals33 = {
+var _internals34 = {
   now: () => new Date
 };
 function artifactLabel(artifact) {
@@ -33240,7 +33362,7 @@ async function handleArchiveCommand(directory, args) {
   const report = await archiveEvidence(directory, maxAgeDays, maxBundles, {
     report: true,
     dryRun,
-    now: _internals33.now(),
+    now: _internals34.now(),
     cacheMaxBytes,
     cacheMaxRecords
   });
@@ -35207,7 +35329,7 @@ function createShadowCopy(directory, maxBytes = MAX_SHADOW_COPY_BYTES) {
       const rel = path33.relative(directory, src);
       const dest = path33.join(shadowRoot, rel);
       fs21.mkdirSync(path33.dirname(dest), { recursive: true });
-      const copied = _internals34.copyFileBounded(src, dest, maxBytes - copiedBytes);
+      const copied = _internals35.copyFileBounded(src, dest, maxBytes - copiedBytes);
       if (copied === null) {
         removeShadowRoot(shadowRoot);
         return null;
@@ -35220,7 +35342,7 @@ function createShadowCopy(directory, maxBytes = MAX_SHADOW_COPY_BYTES) {
     throw error2;
   }
 }
-var _internals34 = {
+var _internals35 = {
   computeEvidenceQualitySummary,
   copyFileBounded,
   createShadowCopy
@@ -35467,7 +35589,7 @@ async function evaluateAdvisoryCi(options) {
         });
       }
     }
-    const summary = await _internals34.computeEvidenceQualitySummary(directory);
+    const summary = await _internals35.computeEvidenceQualitySummary(directory);
     const q = summary.qualityMetrics;
     const qualityRows = [
       [
@@ -35861,7 +35983,7 @@ async function handleCiCommand(ctx) {
   const signals = createSignalCancellation(controller);
   signals.install();
   try {
-    const result = await _internals35.runAdvisoryCiRuntime({
+    const result = await _internals36.runAdvisoryCiRuntime({
       directory: ctx.directory,
       deadlineMs,
       signal: controller.signal,
@@ -35910,134 +36032,10 @@ async function handleCiCommand(ctx) {
     signals.dispose();
   }
 }
-var _internals35 = { runAdvisoryCiRuntime };
+var _internals36 = { runAdvisoryCiRuntime };
 
 // src/commands/pr-ref.ts
 init_loader();
-
-// src/commands/_shared/url-security.ts
-import * as child_process from "child_process";
-init_git_executable();
-var MAX_URL_LEN = 2048;
-var _internals36 = {
-  spawnSync: (cmd, args, options) => {
-    const mergedEnv = mergeEnvForChild(options?.env, options?.envOverrides);
-    return child_process.spawnSync(cmd, args, {
-      ...options,
-      env: mergedEnv
-    });
-  }
-};
-function sanitizeUrl(raw) {
-  let urlStr = raw.trim();
-  urlStr = urlStr.replace(/^([A-Za-z][A-Za-z0-9+.-]*:\/\/)\/?[^@/]+@/, "$1");
-  urlStr = urlStr.replace(/\[\s*MODE\s*:[^\]]*\]/gi, "");
-  urlStr = urlStr.replace(/^([A-Za-z][A-Za-z0-9+.-]*:\/\/)\/?[^@/]+@/, "$1");
-  const fragmentIdx = urlStr.indexOf("#");
-  if (fragmentIdx !== -1) {
-    urlStr = urlStr.slice(0, fragmentIdx);
-  }
-  const queryIdx = urlStr.indexOf("?");
-  if (queryIdx !== -1) {
-    urlStr = urlStr.slice(0, queryIdx);
-  }
-  if (urlStr.length > MAX_URL_LEN) {
-    urlStr = urlStr.slice(0, MAX_URL_LEN);
-  }
-  return urlStr.trim();
-}
-function sanitizeErrorEcho(raw, maxLength = 80) {
-  let stripped = "";
-  for (const ch of raw) {
-    const cp = ch.codePointAt(0);
-    if (cp !== undefined && (cp <= 31 || cp === 127)) {
-      stripped += " ";
-      continue;
-    }
-    stripped += ch;
-  }
-  const collapsed = stripped.replace(/\s+/g, " ").trim();
-  if (collapsed.length <= maxLength)
-    return collapsed;
-  return `${collapsed.slice(0, maxLength)}\u2026`;
-}
-function validateAndSanitizeGithubUrl(rawUrl, resource, configured) {
-  const sanitized = sanitizeUrl(rawUrl);
-  if (!sanitized) {
-    return { error: "Empty URL" };
-  }
-  if (!sanitized.startsWith("https://")) {
-    return { error: "URL must use HTTPS scheme" };
-  }
-  try {
-    const url = new URL(sanitized);
-    if (hasNonAsciiHostname(url.hostname)) {
-      return { error: "Non-ASCII hostnames are not allowed" };
-    }
-    if (isPrivateHost(url)) {
-      return { error: "Private or localhost URLs are not allowed" };
-    }
-    const matched = matchForgeResourceUrl(sanitized, resource, configured);
-    if (!matched) {
-      return {
-        error: resource === "issues" ? "URL must be a GitHub issue URL (https://github.com/owner/repo/issues/N) or a GitLab issue URL (https://<gitlab-host>/owner/repo/-/issues/N)" : "URL must be a GitHub pull request URL (https://github.com/owner/repo/pull/N) or a GitLab merge request URL (https://<gitlab-host>/owner/repo/-/merge_requests/N)"
-      };
-    }
-    return { sanitized };
-  } catch {
-    return { error: "Invalid URL format" };
-  }
-}
-function detectGitRemote(cwd, laneEnv) {
-  try {
-    const result = _internals36.spawnSync(resolveGitExecutable(), ["remote", "get-url", "origin"], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: 5000,
-      ...cwd ? { cwd } : {},
-      envOverrides: laneEnv
-    });
-    if (result.status !== 0 || result.error) {
-      return null;
-    }
-    const remoteUrl = (result.stdout ?? "").trim();
-    return remoteUrl || null;
-  } catch {
-    return null;
-  }
-}
-function parseGitRemoteUrl(remoteUrl) {
-  const httpsMatch = remoteUrl.match(/^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/i);
-  if (httpsMatch) {
-    const owner = httpsMatch[1];
-    const repo = httpsMatch[2].replace(/\.git$/, "");
-    if (containsControlCharacters(owner) || containsControlCharacters(repo)) {
-      return null;
-    }
-    return { owner, repo };
-  }
-  const sshMatch = remoteUrl.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/i);
-  if (sshMatch) {
-    const owner = sshMatch[1];
-    const repo = sshMatch[2].replace(/\.git$/, "");
-    if (containsControlCharacters(owner) || containsControlCharacters(repo)) {
-      return null;
-    }
-    return { owner, repo };
-  }
-  const pathMatch = remoteUrl.match(/\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
-  if (pathMatch) {
-    const owner = pathMatch[1];
-    const repo = pathMatch[2].replace(/\.git$/, "");
-    if (containsControlCharacters(owner) || containsControlCharacters(repo)) {
-      return null;
-    }
-    return { owner, repo };
-  }
-  return null;
-}
-
-// src/commands/pr-ref.ts
 var MAX_INSTRUCTIONS_LEN = 1000;
 var GITHUB_CONTEXT = {
   provider: "github",
@@ -40455,9 +40453,9 @@ function hashContent(content) {
   return createHash27("sha1").update(content).digest("hex");
 }
 async function loadConfigForPolicyCurator(directory) {
-  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-yvhamv41.js");
+  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-zrcgm9d9.js");
   try {
-    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-fa014mra.js");
+    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-p6bvzgp2.js");
     const { config: loadedConfig } = loadPluginConfigWithMeta2(directory);
     return KnowledgeConfigSchema2.parse(loadedConfig.knowledge ?? {});
   } catch {
@@ -43515,7 +43513,7 @@ async function resolveCuratorLLMDelegate(directory, mode, sessionId) {
   const seam = _internals38.createCuratorLLMDelegate;
   if (seam)
     return seam(directory, mode, sessionId);
-  const { createCuratorLLMDelegate } = await import("./curator-llm-factory-hkk29g2y.js");
+  const { createCuratorLLMDelegate } = await import("./curator-llm-factory-13h02244.js");
   return createCuratorLLMDelegate(directory, mode, sessionId);
 }
 async function reconcileCloseTerminalStateForPlan(directory, targetPlan, options) {
@@ -43910,7 +43908,7 @@ async function runFinalizeStage(ctx) {
     }
   }
   try {
-    const { CuratorConfigSchema: CCS } = await import("./schema-yvhamv41.js");
+    const { CuratorConfigSchema: CCS } = await import("./schema-zrcgm9d9.js");
     const { config: pmLoadedConfig } = _internals38.loadPluginConfigWithMeta(ctx.directory);
     const curatorCfg = CCS.parse(pmLoadedConfig.curator ?? {});
     if (curatorCfg.enabled && curatorCfg.postmortem_enabled) {
@@ -46096,7 +46094,7 @@ function serializeAgentSession(s) {
 }
 async function writeSnapshot(directory, state) {
   try {
-    const { ensureSnapshotCoordinationReady } = await import("./snapshot-coordination-init-xqxek8kn.js");
+    const { ensureSnapshotCoordinationReady } = await import("./snapshot-coordination-init-5q0hac3d.js");
     await ensureSnapshotCoordinationReady(directory);
     const snapshot = {
       version: 3,
@@ -49274,7 +49272,7 @@ function planMerges(active, threshold, maxComparisons, maxMerges) {
   };
 }
 async function sweepActiveNearDuplicates(directory, options = {}) {
-  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-fa014mra.js");
+  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-p6bvzgp2.js");
   const { config } = loadPluginConfigWithMeta2(directory);
   const sweepConfig = config.learning?.dedup_sweep;
   if (sweepConfig?.enabled === false)
@@ -50155,14 +50153,14 @@ async function runCuratorInit(directory, config, llmDelegate) {
     }));
     if (llmDelegate) {
       try {
-        const userInput = [
+        const userInput = sanitizeContextText([
           "TASK: CURATOR_INIT",
           `PRIOR_SUMMARY: ${priorSummary ? JSON.stringify(priorSummary) : "none"}`,
           `KNOWLEDGE_ENTRIES: ${JSON.stringify(allEntriesForCurator)}`,
-          `PROJECT_CONTEXT: ${contextMd?.slice(0, config.max_summary_tokens * 2) ?? "none"}`,
-          `POST_MORTEM_DIGEST: ${latestPostMortemDigest ?? "none"}`
+          `PROJECT_CONTEXT: ${sanitizeContextText(contextMd?.slice(0, config.max_summary_tokens * 2) ?? "none")}`,
+          `POST_MORTEM_DIGEST: ${sanitizeContextText(latestPostMortemDigest ?? "none")}`
         ].join(`
-`);
+`));
         const systemPrompt = CURATOR_INIT_PROMPT;
         const timeoutMs = config.llm_timeout_ms ?? DEFAULT_CURATOR_LLM_TIMEOUT_MS;
         const ac = new AbortController;
@@ -50256,7 +50254,7 @@ async function runCuratorPhase(directory, phase, agentsDispatched, config, knowl
     const phaseData = plan?.phases.find((p) => p.id === phase);
     const tasksCompleted = phaseData ? phaseData.tasks.filter((t) => t.status === "completed").length : 0;
     const tasksTotal = phaseData ? phaseData.tasks.length : 0;
-    const keyDecisions = contextMd ? extractContextDecisions(contextMd).map((decision) => decision.raw.trim().slice(2)) : [];
+    const keyDecisions = contextMd ? extractContextDecisions(contextMd).map((decision) => sanitizeContextText(decision.raw.trim().slice(2))) : [];
     const phaseDigest = {
       phase,
       timestamp: new Date().toISOString(),
@@ -50287,16 +50285,16 @@ async function runCuratorPhase(directory, phase, agentsDispatched, config, knowl
       try {
         const priorDigest = priorSummary?.digest ?? "none";
         const systemPrompt = CURATOR_PHASE_PROMPT;
-        const userInput = [
+        const userInput = sanitizeContextText([
           `TASK: CURATOR_PHASE ${phase}`,
-          `PRIOR_DIGEST: ${priorDigest}`,
+          `PRIOR_DIGEST: ${sanitizeContextText(priorDigest)}`,
           `PHASE_EVENTS: ${JSON.stringify(phaseEvents.slice(0, 50))}`,
           `PHASE_DECISIONS: ${JSON.stringify(keyDecisions)}`,
           `AGENTS_DISPATCHED: ${JSON.stringify(agentsDispatched)}`,
           `AGENTS_EXPECTED: ["reviewer", "test_engineer"]`,
           `KNOWLEDGE_ENTRIES: ${JSON.stringify(knowledgeForCurator)}`
         ].join(`
-`);
+`));
         const timeoutMs = config.llm_timeout_ms ?? DEFAULT_CURATOR_LLM_TIMEOUT_MS;
         const ac = new AbortController;
         const timer = setTimeout(() => ac.abort(), timeoutMs);
@@ -50398,7 +50396,7 @@ async function runCuratorPhase(directory, phase, agentsDispatched, config, knowl
     }
     if (config.skill_generation_enabled === true && skillCandidates.length > 0) {
       try {
-        const skillModule = await import("./skill-generator-fzvp9m8z.js");
+        const skillModule = await import("./skill-generator-dztn1ctf.js");
         for (const cand of skillCandidates) {
           if (cand.confidence < (config.min_skill_confidence ?? DEFAULT_SKILL_MIN_CONFIDENCE)) {
             continue;
@@ -50870,7 +50868,7 @@ async function applyCuratorKnowledgeUpdates(directory, recommendations, knowledg
     } catch {}
   }
   if (contradictedEntries.length > 0 && knowledgeConfig.contradiction_threshold_action === "quarantine") {
-    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-30bb9fyg.js");
+    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-7xcd0zea.js");
     for (const { id } of contradictedEntries) {
       try {
         await maybeQuarantineOnContradiction(directory, id, knowledgeConfig.contradiction_quarantine_threshold, knowledgeConfig.contradiction_quarantine_window_days);
@@ -51383,9 +51381,9 @@ async function repairPostMortemActions(llmOutput, diagnostics, options) {
       "Allowed queue_triage action values: apply, reject.",
       "Do not include unsupported actions such as merge.",
       "Diagnostics:",
-      diagnostics.join("; "),
+      diagnostics.map((d) => sanitizeContextText(d)).join("; "),
       "Original output:",
-      llmOutput.slice(0, 8000)
+      sanitizeContextText(llmOutput).slice(0, 8000)
     ].join(`
 `);
     const repaired = await options.llmDelegate("", repairPrompt, ac.signal);
@@ -51601,8 +51599,8 @@ function assembleLLMInput(planId, scope, sessionID, planSummary, knowledgeSummar
   const sections = [];
   sections.push(`TASK: CURATOR_POSTMORTEM ${planId}`);
   sections.push(`SCOPE: ${scope}${sessionID ? ` (${sessionID})` : ""}`);
-  sections.push(`PLAN_SUMMARY: ${planSummary}`);
-  sections.push(`CURATOR_DIGESTS: ${curatorDigest ?? "none"}`);
+  sections.push(`PLAN_SUMMARY: ${sanitizeContextText(planSummary)}`);
+  sections.push(`CURATOR_DIGESTS: ${sanitizeContextText(curatorDigest ?? "none")}`);
   const eventsSummary = knowledgeSummary.map((e) => `${e.id}: applied=${e.applied} violated=${e.violated} ignored=${e.ignored} unacknowledged=${e.unacknowledged} confidence=${e.confidence.toFixed(2)} status=${e.status}`).join(`
 `);
   sections.push(`KNOWLEDGE_EVENTS_SUMMARY:
@@ -51633,9 +51631,9 @@ ${retroText}`);
     sections.push(`DRIFT_REPORTS:
 ${driftText}`);
   }
-  return sections.join(`
+  return sanitizeContextText(sections.join(`
 
-`);
+`));
 }
 async function runCuratorPostMortem(directory, options = {}) {
   const warnings = [];
@@ -51702,7 +51700,7 @@ async function runCuratorPostMortem(directory, options = {}) {
       warnings.push("Failed to collect knowledge summary.");
     }
     try {
-      const { getScanStatus } = await import("./scan-cursor-1m6dj2s2.js");
+      const { getScanStatus } = await import("./scan-cursor-fgecb928.js");
       const scanStatus = await getScanStatus(directory);
       if (scanStatus.remaining_estimate > 0) {
         warnings.push(`Fair scan: reviewed ${knowledgeSummary.length} entries this sweep (generation ${scanStatus.generation}); ${scanStatus.remaining_estimate} more eligible entries will be visited in future curation sweeps.`);
@@ -51874,9 +51872,9 @@ var _internals57 = {
   verifyPostMortemKnowledgeActions,
   repairPostMortemActions,
   loadDefaultKnowledgeConfig: async (directory) => {
-    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-yvhamv41.js");
+    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-zrcgm9d9.js");
     try {
-      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-fa014mra.js");
+      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-p6bvzgp2.js");
       const loaded = loadPluginConfigWithMeta2(directory);
       return KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
     } catch {
@@ -51884,11 +51882,11 @@ var _internals57 = {
     }
   },
   applyCuratorKnowledgeUpdates: async (directory, recommendations, knowledgeConfig, generation) => {
-    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-5k3mktpe.js");
+    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-r0jfc7xw.js");
     return applyCuratorKnowledgeUpdates2(directory, recommendations, knowledgeConfig, generation);
   },
   checkHivePromotions: async (entries2, knowledgeConfig, directory) => {
-    const { checkHivePromotions } = await import("./hive-promoter-400xzdds.js");
+    const { checkHivePromotions } = await import("./hive-promoter-0vg8w79a.js");
     return checkHivePromotions(entries2, knowledgeConfig, directory);
   },
   applyProposalTriage: async (directory, triage) => {
@@ -51897,7 +51895,7 @@ var _internals57 = {
       activateProposal,
       listSkills: listSkills2,
       sanitizeSlug
-    } = await import("./skill-generator-fzvp9m8z.js");
+    } = await import("./skill-generator-dztn1ctf.js");
     const result = {
       approved: [],
       rejected: [],
@@ -51939,7 +51937,7 @@ var _internals57 = {
     return result;
   },
   readPriorDriftReports: async (directory) => {
-    const { readPriorDriftReports: readPriorDriftReports2 } = await import("./curator-drift-dt4g79a4.js");
+    const { readPriorDriftReports: readPriorDriftReports2 } = await import("./curator-drift-q84jn9cc.js");
     return readPriorDriftReports2(directory);
   },
   readSwarmKnowledge: (directory) => readKnowledge(resolveSwarmKnowledgePath(directory))
@@ -61735,9 +61733,9 @@ var _internals67 = {
   loadPluginConfigWithMeta,
   loadCuratorDeps: async () => {
     const [{ CuratorConfigSchema }, curator, { createCuratorLLMDelegate }] = await Promise.all([
-      import("./schema-yvhamv41.js"),
-      import("./curator-5k3mktpe.js"),
-      import("./curator-llm-factory-hkk29g2y.js")
+      import("./schema-zrcgm9d9.js"),
+      import("./curator-r0jfc7xw.js"),
+      import("./curator-llm-factory-13h02244.js")
     ]);
     return { CuratorConfigSchema, curator, createCuratorLLMDelegate };
   }
@@ -64130,7 +64128,7 @@ async function computeCurationDiagnostics(directory, entries2) {
   let scanCompleted = false;
   let scanRemaining = 0;
   try {
-    const { getScanStatus } = await import("./scan-cursor-1m6dj2s2.js");
+    const { getScanStatus } = await import("./scan-cursor-fgecb928.js");
     const status = await getScanStatus(directory);
     scanGeneration = status.generation;
     scanCompleted = status.completed;
@@ -64140,10 +64138,10 @@ async function computeCurationDiagnostics(directory, entries2) {
   try {
     const { isLinked: isLinked2 } = await import("./knowledge-link-dv78fb9g.js");
     if (isLinked2(directory)) {
-      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-yvhamv41.js");
+      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-zrcgm9d9.js");
       let config;
       try {
-        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-fa014mra.js");
+        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-p6bvzgp2.js");
         const loaded = loadPluginConfigWithMeta2(directory);
         config = KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
       } catch {
@@ -65598,7 +65596,7 @@ async function handleDoctorCommand(directory, args) {
   const result = runConfigDoctor(config, directory);
   let output;
   if (enableAutoFix && result.hasAutoFixableIssues) {
-    const { runConfigDoctorWithFixes } = await import("./config-doctor-3b99vx74.js");
+    const { runConfigDoctorWithFixes } = await import("./config-doctor-28ggsms8.js");
     const fixResult = await runConfigDoctorWithFixes(directory, config, true, {
       applyLossy: true
     });
@@ -65636,7 +65634,7 @@ async function handleDoctorCommand(directory, args) {
 `;
   }
   try {
-    const { runModelPreflight } = await import("./model-preflight-g7b12yn2.js");
+    const { runModelPreflight } = await import("./model-preflight-kap3zp3g.js");
     const preflight = await runModelPreflight(config, swarmState.opencodeClient, { generatedAgentNames: swarmState.generatedAgentNames });
     const missingSelection = preflight.resolutions.filter((resolution) => resolution.status === "missing-selection");
     const unresolved = preflight.catalogAvailable ? preflight.resolutions.filter((resolution) => resolution.status === "unresolved") : [];
@@ -66563,7 +66561,7 @@ async function handleEvidenceCommand(directory, args) {
   return formatTaskEvidenceMarkdown(evidenceData);
 }
 async function handleEvidenceSummaryCommand(directory) {
-  const { buildEvidenceSummary } = await import("./evidence-summary-service-8e2fghz0.js");
+  const { buildEvidenceSummary } = await import("./evidence-summary-service-rsectw2t.js");
   const artifact = await buildEvidenceSummary(directory);
   if (!artifact) {
     return "No plan found. Run `/swarm plan` to check plan status.";
@@ -90896,7 +90894,7 @@ function createCuratorLLMDelegate(directory, mode = "init", sessionId) {
     }
     const sdkOpts = signal ? { signal } : {};
     try {
-      const { getSwarmAgents: getSwarmAgents2, resolveFallbackModel: resolveFallbackModel2 } = await import("./index-rtznwf0g.js");
+      const { getSwarmAgents: getSwarmAgents2, resolveFallbackModel: resolveFallbackModel2 } = await import("./index-22f1ek6k.js");
       const createResult = await client.session.create({
         ...sessionId ? {
           body: {
@@ -91188,8 +91186,8 @@ init_zod();
 init_loader();
 import { createHash as createHash51, randomUUID as randomUUID22 } from "crypto";
 import * as fsSync9 from "fs";
-import * as fs63 from "fs/promises";
-import * as path127 from "path";
+import * as fs64 from "fs/promises";
+import * as path128 from "path";
 init_logger();
 
 // src/background/pr-feedback-event-queue.ts
@@ -92154,6 +92152,228 @@ var _internals98 = {
 
 // src/git/pr.ts
 init_git_executable();
+
+// src/utils/glab-executable.ts
+init_warning_buffer();
+import { spawnSync as spawnSync5 } from "child_process";
+import * as fs63 from "fs";
+import * as os14 from "os";
+import * as path127 from "path";
+var GLAB_BINARY_ENV_VAR = "OPENCODE_SWARM_GLAB_BINARY";
+var PER_PROBE_TIMEOUT_MS2 = 250;
+var TOTAL_BUDGET_MS3 = 1000;
+var NEGATIVE_CACHE_TTL_MS2 = 60000;
+var BARE_GLAB = "glab";
+var PROBE_MAX_BUFFER_BYTES2 = 64 * 1024;
+var PROBE_OUTPUT_EXCERPT_CHARS2 = 60;
+var WINDOWS_PATH_EXTENSIONS2 = [".exe", ".cmd", ".bat"];
+var GLAB_VERSION_PATTERN = /^glab version \d+\.\d+/;
+function excerptProbeOutput2(raw) {
+  return raw.slice(0, PROBE_OUTPUT_EXCERPT_CHARS2).replace(/[^\x20-\x7E]/g, " ").trim();
+}
+var cache3 = null;
+var lastAttempts2 = [];
+var cacheGeneration2 = 0;
+function windowsGlabAbsoluteCandidates(env) {
+  const candidates = [];
+  const push = (...parts) => {
+    const candidate2 = path127.join(...parts);
+    if (!candidates.includes(candidate2))
+      candidates.push(candidate2);
+  };
+  if (env.ProgramFiles) {
+    push(env.ProgramFiles, "GitLab CLI", "glab.exe");
+  }
+  if (env["ProgramFiles(x86)"]) {
+    push(env["ProgramFiles(x86)"], "GitLab CLI", "glab.exe");
+  }
+  if (env.LOCALAPPDATA) {
+    push(env.LOCALAPPDATA, "GitLab CLI", "glab.exe");
+    push(env.LOCALAPPDATA, "Programs", "GitLab CLI", "glab.exe");
+  }
+  return candidates;
+}
+function platformCandidates2(platform, env) {
+  if (platform === "win32") {
+    return windowsGlabAbsoluteCandidates(env);
+  }
+  if (platform === "darwin") {
+    return ["/opt/homebrew/bin/glab", "/usr/local/bin/glab", "/usr/bin/glab"];
+  }
+  return ["/usr/bin/glab", "/usr/local/bin/glab", "/bin/glab"];
+}
+function isAbsoluteForPlatform2(candidate2, platform) {
+  return platform === "win32" ? path127.win32.isAbsolute(candidate2) : path127.posix.isAbsolute(candidate2);
+}
+function joinDirAndName2(dir, name, platform) {
+  const sep22 = platform === "win32" ? "\\" : "/";
+  const trimmed = dir.replace(/[\\/]+$/, "");
+  return trimmed ? `${trimmed}${sep22}${name}` : `${sep22}${name}`;
+}
+function pathCandidates2(platform) {
+  const pathValue = _internals99.env().PATH ?? "";
+  if (!pathValue)
+    return [];
+  const dirs = pathValue.split(platform === "win32" ? ";" : ":").filter(Boolean);
+  const names = platform === "win32" ? [...WINDOWS_PATH_EXTENSIONS2.map((ext) => `glab${ext}`), "glab"] : ["glab"];
+  const out = [];
+  for (const dir of dirs) {
+    for (const name of names) {
+      const candidate2 = joinDirAndName2(dir, name, platform);
+      if (!out.includes(candidate2))
+        out.push(candidate2);
+    }
+  }
+  return out;
+}
+function envOverride2() {
+  const raw = _internals99.env()[GLAB_BINARY_ENV_VAR];
+  return raw && raw.trim() !== "" ? raw : undefined;
+}
+function buildCandidates2(platform) {
+  const override = envOverride2();
+  const overrideCandidate = override ? [{ source: "override", path: override }] : [];
+  const seen = new Set(overrideCandidate.map((c) => c.path));
+  const rest = [];
+  for (const p of platformCandidates2(platform, _internals99.env())) {
+    if (seen.has(p))
+      continue;
+    seen.add(p);
+    rest.push({ source: "platform", path: p });
+  }
+  for (const p of pathCandidates2(platform)) {
+    if (seen.has(p))
+      continue;
+    seen.add(p);
+    rest.push({ source: "path", path: p });
+  }
+  return [...overrideCandidate, ...rest];
+}
+function probeCandidate2(candidatePath2, platform) {
+  if (!isAbsoluteForPlatform2(candidatePath2, platform)) {
+    return { accepted: false, reason: "not an absolute path" };
+  }
+  let stat13;
+  try {
+    stat13 = fs63.statSync(candidatePath2);
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOENT")
+      return { accepted: false, reason: "no such file" };
+    return {
+      accepted: false,
+      reason: `cannot stat (${code ?? "unknown error"})`
+    };
+  }
+  if (stat13.isDirectory()) {
+    return { accepted: false, reason: "is a directory" };
+  }
+  if (!stat13.isFile()) {
+    return { accepted: false, reason: "not a regular file" };
+  }
+  let result;
+  try {
+    result = _internals99.spawnSync(candidatePath2, ["--version"], {
+      cwd: os14.tmpdir(),
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true,
+      timeout: PER_PROBE_TIMEOUT_MS2,
+      maxBuffer: PROBE_MAX_BUFFER_BYTES2
+    });
+  } catch (err) {
+    return {
+      accepted: false,
+      reason: `spawn threw: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (result.error) {
+    return { accepted: false, reason: `spawn failed: ${result.error.message}` };
+  }
+  if (result.status !== 0) {
+    const statusDescription = result.status !== null ? `exit ${result.status}` : `signal ${result.signal ?? "unknown"}`;
+    return {
+      accepted: false,
+      reason: `glab --version returned ${statusDescription}`
+    };
+  }
+  const versionOutput = (result.stdout ?? "").toString().trim();
+  if (!GLAB_VERSION_PATTERN.test(versionOutput)) {
+    const excerpt = excerptProbeOutput2(versionOutput);
+    return {
+      accepted: false,
+      reason: excerpt ? `not glab: --version printed "${excerpt}"` : "not glab: --version printed nothing"
+    };
+  }
+  return { accepted: true };
+}
+function probeCycle2(candidates, platform, attempts) {
+  const start = _internals99.now();
+  let budgetExceeded = false;
+  for (const candidate2 of candidates) {
+    if (_internals99.now() - start > TOTAL_BUDGET_MS3) {
+      budgetExceeded = true;
+      break;
+    }
+    const result = probeCandidate2(candidate2.path, platform);
+    attempts.push({
+      source: candidate2.source,
+      candidate: candidate2.path,
+      accepted: result.accepted,
+      reason: result.accepted ? undefined : result.reason
+    });
+    if (candidate2.source === "override" && !result.accepted) {
+      advisoryWarn(`[opencode-swarm] ${GLAB_BINARY_ENV_VAR} override "${candidate2.path}" is unusable (${result.reason}); falling back to automatic glab resolution.`);
+    }
+    if (result.accepted) {
+      return { outcome: "accepted", path: candidate2.path };
+    }
+  }
+  return budgetExceeded ? { outcome: "exhausted-budget" } : { outcome: "all-rejected" };
+}
+function readCache3() {
+  if (cache3 === null)
+    return null;
+  if (cache3.kind === "success")
+    return cache3;
+  if (_internals99.now() < cache3.expiresAt)
+    return cache3;
+  cache3 = null;
+  return null;
+}
+function applyProbeResult2(result, attempts, generation) {
+  if (generation !== cacheGeneration2) {
+    return result.outcome === "accepted" ? result.path : BARE_GLAB;
+  }
+  lastAttempts2 = attempts;
+  if (result.outcome === "accepted") {
+    cache3 = { kind: "success", path: result.path };
+    return result.path;
+  }
+  cache3 = {
+    kind: "fallback",
+    expiresAt: _internals99.now() + NEGATIVE_CACHE_TTL_MS2
+  };
+  return BARE_GLAB;
+}
+function resolveGlabExecutable() {
+  const cached = readCache3();
+  if (cached)
+    return cached.kind === "success" ? cached.path : BARE_GLAB;
+  const platform = _internals99.platform();
+  const attempts = [];
+  const generation = cacheGeneration2;
+  const candidates = buildCandidates2(platform);
+  const result = probeCycle2(candidates, platform, attempts);
+  return applyProbeResult2(result, attempts, generation);
+}
+var _internals99 = {
+  spawnSync: spawnSync5,
+  platform: () => process.platform,
+  env: () => process.env,
+  now: () => Date.now()
+};
+
+// src/git/pr.ts
 init_logger();
 
 // src/utils/untrusted-markdown.ts
@@ -92189,7 +92409,7 @@ var EvidencePlanSchema = exports_external.object({
   }).passthrough()).optional()
 }).passthrough();
 function ghExec(args, cwd) {
-  const ghBinary = _internals99.resolveGhExecutable();
+  const ghBinary = _internals100.resolveGhExecutable();
   for (let attempt = 0;attempt < MAX_TRANSIENT_RETRIES; attempt++) {
     const result = child_process5.spawnSync(ghBinary, args, {
       cwd,
@@ -92245,12 +92465,18 @@ function spawnSyncWithTransientRetry(command, args, options) {
   throw new Error(`${command} exited with null`);
 }
 async function ghExecAsync(args, cwd) {
+  return _internals100.forgeExecAsync(_internals100.resolveGhExecutable(), args, cwd, "gh");
+}
+async function forgeExecAsyncImpl(binary, args, cwd, label, opts) {
   return new Promise((resolve40, reject) => {
-    const ghBinary = _internals99.resolveGhExecutable();
-    const proc = child_process5.spawn(ghBinary, args, {
+    const spawnOptions = {
       cwd,
       stdio: ["ignore", "pipe", "pipe"]
-    });
+    };
+    if (opts?.env) {
+      spawnOptions.env = mergeEnvForChild(undefined, opts.env);
+    }
+    const proc = child_process5.spawn(binary, args, spawnOptions);
     const stdoutChunks = [];
     const stderrChunks = [];
     let stdoutBytes = 0;
@@ -92274,7 +92500,7 @@ async function ghExecAsync(args, cwd) {
     proc.stdout?.on("data", (chunk) => {
       stdoutBytes += chunk.length;
       if (stdoutBytes > MAX_OUTPUT_BYTES2) {
-        settle2(() => reject(new Error(`gh ${args[0]} stdout exceeded ${MAX_OUTPUT_BYTES2} bytes`)));
+        settle2(() => reject(new Error(`${label} ${args[0]} stdout exceeded ${MAX_OUTPUT_BYTES2} bytes`)));
         return;
       }
       stdoutChunks.push(chunk);
@@ -92282,13 +92508,13 @@ async function ghExecAsync(args, cwd) {
     proc.stderr?.on("data", (chunk) => {
       stderrBytes += chunk.length;
       if (stderrBytes > MAX_OUTPUT_BYTES2) {
-        settle2(() => reject(new Error(`gh ${args[0]} stderr exceeded ${MAX_OUTPUT_BYTES2} bytes`)));
+        settle2(() => reject(new Error(`${label} ${args[0]} stderr exceeded ${MAX_OUTPUT_BYTES2} bytes`)));
         return;
       }
       stderrChunks.push(chunk);
     });
     const timer = setTimeout(() => {
-      settle2(() => reject(new Error(`gh ${args[0]} timed out after ${GIT_TIMEOUT_MS5}ms`)));
+      settle2(() => reject(new Error(`${label} ${args[0]} timed out after ${GIT_TIMEOUT_MS5}ms`)));
     }, GIT_TIMEOUT_MS5);
     proc.on("error", (err) => {
       settle2(() => reject(err));
@@ -92297,7 +92523,7 @@ async function ghExecAsync(args, cwd) {
       settle2(() => {
         if (code !== 0) {
           const stderr = Buffer.concat(stderrChunks).toString("utf-8");
-          reject(new Error(stderr || `gh exited with ${code}`));
+          reject(new Error(stderr || `${label} exited with ${code}`));
         } else {
           const stdout = Buffer.concat(stdoutChunks).toString("utf-8");
           resolve40(stdout);
@@ -92306,20 +92532,24 @@ async function ghExecAsync(args, cwd) {
     });
   });
 }
-var _internals99 = {
+var _internals100 = {
   ghExec,
   ghExecAsync,
+  forgeExecAsync: forgeExecAsyncImpl,
+  getMRPollSnapshot,
+  getMRComments,
   spawnSyncWithTransientRetry,
   spawnSync: __spawnSyncSeam.spawnSync,
   readLaneEnvFileFromDiskSync,
   getMergeGroupRun,
   resolveGhExecutable,
-  resolveGitExecutable
+  resolveGitExecutable,
+  resolveGlabExecutable
 };
 async function getPRPollSnapshot(prNumber, repoFullName, cwd) {
   let stdout;
   try {
-    stdout = await _internals99.ghExecAsync([
+    stdout = await _internals100.ghExecAsync([
       "pr",
       "view",
       String(prNumber),
@@ -92376,7 +92606,7 @@ function numericIssueCommentId(url, fallbackId, fallbacks) {
 async function getPRReviewComments(prNumber, repoFullName, cwd) {
   let stdout;
   try {
-    stdout = await _internals99.ghExecAsync(["api", `repos/${repoFullName}/pulls/${prNumber}/comments`], cwd);
+    stdout = await _internals100.ghExecAsync(["api", `repos/${repoFullName}/pulls/${prNumber}/comments`], cwd);
   } catch (err) {
     throw new Error(`Failed to fetch review comments for ${repoFullName}#${prNumber}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -92389,6 +92619,129 @@ async function getPRReviewComments(prNumber, repoFullName, cwd) {
     isReviewComment: true
   }));
 }
+var MR_SYNTHESIZED_FIELD_MARKER = "NOT_AVAILABLE";
+function glabSpawnEnv(input) {
+  if (!input.host || input.host === "gitlab.com")
+    return;
+  return { env: { GITLAB_HOST: input.host } };
+}
+function mapMrState(state) {
+  if (state === "merged")
+    return "MERGED";
+  if (state === "closed")
+    return "CLOSED";
+  return "OPEN";
+}
+function mapMrMergeable(mr, detail) {
+  if (mr.has_conflicts === true)
+    return "CONFLICTING";
+  if (mr.detailed_merge_status === "conflict")
+    return "CONFLICTING";
+  if (detail.merge_status === "cannot_be_merged")
+    return "CONFLICTING";
+  if (mr.detailed_merge_status === "mergeable")
+    return "MERGEABLE";
+  if (detail.merge_status === "can_be_merged")
+    return "MERGEABLE";
+  return "UNKNOWN";
+}
+function mapPipelineConclusion(status) {
+  if (status === "success")
+    return "success";
+  if (status === "failed")
+    return "failure";
+  return null;
+}
+async function getMRPollSnapshot(input) {
+  const overlay = glabSpawnEnv(input);
+  const glabBinary = _internals100.resolveGlabExecutable();
+  let viewStdout;
+  try {
+    viewStdout = await _internals100.forgeExecAsync(glabBinary, ["mr", "view", String(input.iid), "-R", input.projectPath, "-F", "json"], input.cwd, "glab", overlay);
+  } catch (err) {
+    throw new Error(`Failed to fetch MR view for ${input.projectPath}!${input.iid}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const mr = JSON.parse(viewStdout);
+  let detailStdout;
+  try {
+    detailStdout = await _internals100.forgeExecAsync(glabBinary, [
+      "api",
+      `projects/${encodeURIComponent(input.projectPath)}/merge_requests/${input.iid}`
+    ], input.cwd, "glab", overlay);
+  } catch (err) {
+    throw new Error(`Failed to fetch MR detail for ${input.projectPath}!${input.iid}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const detail = JSON.parse(detailStdout);
+  let pipelines = [];
+  let pipelinesFetchSucceeded = false;
+  try {
+    const pipelinesStdout = await _internals100.forgeExecAsync(glabBinary, [
+      "api",
+      `projects/${encodeURIComponent(input.projectPath)}/merge_requests/${input.iid}/pipelines?per_page=20`
+    ], input.cwd, "glab", overlay);
+    const rawPipelines = JSON.parse(pipelinesStdout);
+    const headSha = typeof mr.sha === "string" ? mr.sha : "";
+    const forHead = rawPipelines.filter((p) => typeof p.sha === "string" && p.sha === headSha).sort((a, b) => (Number(b.id) || 0) - (Number(a.id) || 0));
+    const latest = forHead[0];
+    const conclusion = mapPipelineConclusion(latest?.status);
+    pipelines = latest && conclusion ? [
+      {
+        name: `pipeline #${String(latest.id ?? "")}`,
+        status: "completed",
+        conclusion,
+        ...typeof latest.web_url === "string" ? { detailsUrl: latest.web_url } : {}
+      }
+    ] : [];
+    pipelinesFetchSucceeded = true;
+  } catch {
+    pipelines = [];
+    pipelinesFetchSucceeded = false;
+  }
+  const state = mapMrState(mr.state);
+  const mergeable = mapMrMergeable(mr, detail);
+  const reviewers = Array.isArray(mr.reviewers) ? mr.reviewers.length : 0;
+  return {
+    status: {
+      number: input.iid,
+      state,
+      mergeable,
+      mergeStateStatus: MR_SYNTHESIZED_FIELD_MARKER,
+      headRefOid: typeof mr.sha === "string" ? mr.sha : "",
+      statusCheckRollup: []
+    },
+    comments: [],
+    merge: {
+      mergeable,
+      mergeStateStatus: MR_SYNTHESIZED_FIELD_MARKER,
+      headRefOid: typeof mr.sha === "string" ? mr.sha : ""
+    },
+    review: {
+      reviewDecision: "",
+      reviewRequestCount: reviewers
+    },
+    pipelines,
+    pipelinesFetchSucceeded
+  };
+}
+async function getMRComments(input) {
+  let stdout;
+  try {
+    stdout = await _internals100.forgeExecAsync(_internals100.resolveGlabExecutable(), [
+      "api",
+      `projects/${encodeURIComponent(input.projectPath)}/merge_requests/${input.iid}/notes?per_page=100&sort=asc&order_by=created_at`
+    ], input.cwd, "glab", glabSpawnEnv(input));
+  } catch (err) {
+    throw new Error(`Failed to fetch MR comments for ${input.projectPath}!${input.iid}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const notes = JSON.parse(stdout);
+  return notes.filter((note) => note.system !== true).map((note) => ({
+    id: String(note.id ?? ""),
+    author: String(note.author?.username ?? ""),
+    body: neutralizeUntrustedMarkdown(String(note.body ?? ""), "GitLab MR note"),
+    createdAt: String(note.created_at ?? ""),
+    isReviewComment: false
+  }));
+}
 async function getMergeGroupRun(statusCheckRollup, repoFullName, cwd) {
   const mergeGroupCheck = statusCheckRollup.find((check) => check.name === "Merge pull request" && check.detailsUrl);
   if (!mergeGroupCheck?.detailsUrl) {
@@ -92401,7 +92754,7 @@ async function getMergeGroupRun(statusCheckRollup, repoFullName, cwd) {
   const runId = runIdMatch[1];
   let stdout;
   try {
-    stdout = await _internals99.ghExecAsync([
+    stdout = await _internals100.ghExecAsync([
       "run",
       "view",
       runId,
@@ -92430,7 +92783,7 @@ var registrationsByCanonical = new Map;
 function resolveRegistration(directory) {
   const lexical = canonicalRootKeyLexical(directory);
   try {
-    const freshKey = _internals100.canonicalRootKeyFresh(directory);
+    const freshKey = _internals101.canonicalRootKeyFresh(directory);
     const canonical = registrationsByCanonical.get(freshKey);
     if (canonical)
       return canonical;
@@ -92452,8 +92805,10 @@ async function evaluatePrFeedbackCurrentHead(directory, repoFullName, prNumber)
 async function dispatchPrFeedbackOversight(input) {
   return await getPrFeedbackLoopRuntime(input.directory)?.dispatchOversight(input) ?? { dispatched: false, verdict: "unavailable", decision: "pending" };
 }
-var _internals100 = {
+var _internals101 = {
   getPRPollSnapshot,
+  getMRPollSnapshot,
+  findSubscriptionRecordForPrUrl,
   dispatchEphemeralAgent,
   parseCriticResponseFields,
   canonicalRootKeyFresh,
@@ -92462,11 +92817,11 @@ var _internals100 = {
 };
 
 // src/background/pr-feedback-loop.ts
-var PR_FEEDBACK_LOOP_STATE_REL = path127.join(".swarm", "pr-feedback-loop-state.json");
+var PR_FEEDBACK_LOOP_STATE_REL = path128.join(".swarm", "pr-feedback-loop-state.json");
 var PR_FEEDBACK_CLEANUP_DIR = "pr-feedback-loop-cleanups";
-var PR_FEEDBACK_EVIDENCE_DIR = path127.join(".swarm", "pr-feedback-evidence");
+var PR_FEEDBACK_EVIDENCE_DIR = path128.join(".swarm", "pr-feedback-evidence");
 var PR_FEEDBACK_LOOP_STATE_LOCK_FILENAME = "pr-feedback-loop-state.lock";
-var PR_FEEDBACK_LOOP_STATE_LOCK_REL = path127.join(".swarm", PR_FEEDBACK_LOOP_STATE_LOCK_FILENAME);
+var PR_FEEDBACK_LOOP_STATE_LOCK_REL = path128.join(".swarm", PR_FEEDBACK_LOOP_STATE_LOCK_FILENAME);
 var MAX_TRACKED_SESSIONS5 = 200;
 var MAX_IN_FLIGHT_SESSIONS = 64;
 var MAX_CANCELLATION_REQUESTS = 64;
@@ -92482,7 +92837,7 @@ var LoopStateSchema = exports_external.object({
   correlations: exports_external.record(exports_external.string(), exports_external.any()),
   sessionTerminals: exports_external.record(exports_external.string(), exports_external.any()).default({})
 });
-var _internals101 = {
+var _internals102 = {
   async evaluateCurrentHead(directory, repoFullName, prNumber) {
     return evaluatePrFeedbackCurrentHead(directory, repoFullName, prNumber);
   },
@@ -92491,13 +92846,20 @@ var _internals101 = {
   },
   async performAuthorizedAction(input) {
     try {
+      const subscription = await findSubscriptionRecordForPrUrl(input.directory, {
+        prUrl: input.event.prUrl,
+        repoFullName: input.event.repoFullName,
+        prNumber: input.event.prNumber,
+        sessionID: input.sessionID
+      });
       await activatePrWorkflow(input.directory, input.sessionID, "PR_FEEDBACK", {
         requireCheckoutPreflight: true,
-        prUrl: input.event.prUrl
+        prUrl: input.event.prUrl,
+        forge: subscription?.forge
       });
       return {
         performed: true,
-        recordPath: path127.join(".swarm", "pr-feedback-loop-state.json")
+        recordPath: path128.join(".swarm", "pr-feedback-loop-state.json")
       };
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -92519,13 +92881,13 @@ var _internals101 = {
   listActive,
   isProcessAlive: isProcessAlive3,
   resetLoopStateLock() {
-    _internals101.beforeLoopStateLockWrite = undefined;
+    _internals102.beforeLoopStateLockWrite = undefined;
   },
   loopStateLockRelativePath: () => PR_FEEDBACK_LOOP_STATE_LOCK_REL,
   reclaimAbandonedLoopStateLock,
   removeLoopStateLockIfOwned
 };
-var defaultLoopInternals = { ..._internals101 };
+var defaultLoopInternals = { ..._internals102 };
 function emptyState2() {
   return {
     schemaVersion: 1,
@@ -92601,7 +92963,7 @@ function hasReservationIdentity(reservation) {
   return Boolean(reservation?.workflowInstanceId.trim() && Number.isInteger(reservation?.ownerPid) && (reservation?.ownerPid ?? 0) > 0);
 }
 async function readLoopState(directory) {
-  const file = path127.join(directory, PR_FEEDBACK_LOOP_STATE_REL);
+  const file = path128.join(directory, PR_FEEDBACK_LOOP_STATE_REL);
   try {
     const raw = fsSync9.readFileSync(file, "utf-8");
     const parsed = LoopStateSchema.safeParse(JSON.parse(raw));
@@ -92632,7 +92994,7 @@ async function writeLoopState(directory, state) {
     }
   }
   state.updatedAt = new Date().toISOString();
-  await writePrWorkflowAtomicJson(directory, validateSwarmPath(directory, path127.basename(PR_FEEDBACK_LOOP_STATE_REL)), state);
+  await writePrWorkflowAtomicJson(directory, validateSwarmPath(directory, path128.basename(PR_FEEDBACK_LOOP_STATE_REL)), state);
 }
 async function withLoopStateLock(directory, fn) {
   const lock = await acquireLoopStateLock(directory);
@@ -92647,21 +93009,21 @@ async function acquireLoopStateLock(directory) {
   const verifiedStateDirectory = await ensurePrWorkflowSafeParentDirectory(directory, lockPath);
   for (let attempt = 0;attempt < LOOP_STATE_LOCK_MAX_ATTEMPTS; attempt++) {
     try {
-      const handle = await fs63.open(lockPath, "wx");
+      const handle = await fs64.open(lockPath, "wx");
       const lock = {
         ownerToken: randomUUID22(),
         pid: process.pid,
-        createdAtMs: _internals101.now()
+        createdAtMs: _internals102.now()
       };
       let writeError;
       try {
-        await _internals101.beforeLoopStateLockWrite?.();
+        await _internals102.beforeLoopStateLockWrite?.();
         const [openedStat, pathStat, realLockPath] = await Promise.all([
           handle.stat({ bigint: true }),
-          fs63.lstat(lockPath, { bigint: true }),
-          fs63.realpath(lockPath)
+          fs64.lstat(lockPath, { bigint: true }),
+          fs64.realpath(lockPath)
         ]);
-        if (!openedStat.isFile() || pathStat.isSymbolicLink() || !pathStat.isFile() || !sameFileIdentity4(openedStat, pathStat) || normalizeComparablePath2(path127.dirname(realLockPath)) !== normalizeComparablePath2(verifiedStateDirectory)) {
+        if (!openedStat.isFile() || pathStat.isSymbolicLink() || !pathStat.isFile() || !sameFileIdentity4(openedStat, pathStat) || normalizeComparablePath2(path128.dirname(realLockPath)) !== normalizeComparablePath2(verifiedStateDirectory)) {
           throw new Error("BLOCKED: PR feedback loop state lock changed or escaped before initialization");
         }
         await handle.writeFile(JSON.stringify(lock), "utf8");
@@ -92702,17 +93064,17 @@ async function reclaimAbandonedLoopStateLock(lockPath) {
     lock = null;
   }
   if (lock) {
-    if (_internals101.isProcessAlive(lock.pid) && _internals101.now() - lock.createdAtMs < LOOP_STATE_LOCK_ALIVE_OWNER_STALE_MS) {
+    if (_internals102.isProcessAlive(lock.pid) && _internals102.now() - lock.createdAtMs < LOOP_STATE_LOCK_ALIVE_OWNER_STALE_MS) {
       return false;
     }
     return removeLoopStateLockIfOwned(lockPath, lock.ownerToken);
   }
   try {
-    const stat14 = await fs63.stat(lockPath);
-    if (_internals101.now() - stat14.mtimeMs < LOOP_STATE_LOCK_UNINITIALIZED_STALE_MS) {
+    const stat14 = await fs64.stat(lockPath);
+    if (_internals102.now() - stat14.mtimeMs < LOOP_STATE_LOCK_UNINITIALIZED_STALE_MS) {
       return false;
     }
-    await fs63.rm(lockPath, { force: true });
+    await fs64.rm(lockPath, { force: true });
     return true;
   } catch (error2) {
     if (error2.code === "ENOENT")
@@ -92723,7 +93085,7 @@ async function reclaimAbandonedLoopStateLock(lockPath) {
 async function readLoopStateLock(lockPath) {
   let raw;
   try {
-    raw = await fs63.readFile(lockPath, "utf8");
+    raw = await fs64.readFile(lockPath, "utf8");
   } catch (error2) {
     if (error2.code === "ENOENT")
       return null;
@@ -92747,7 +93109,7 @@ async function removeLoopStateLockIfOwned(lockPath, ownerToken) {
   if (!lock || lock.ownerToken !== ownerToken)
     return false;
   try {
-    await fs63.rm(lockPath);
+    await fs64.rm(lockPath);
     return true;
   } catch {
     return false;
@@ -92765,7 +93127,7 @@ function sameFileIdentity4(left, right) {
   return left.dev === right.dev && left.ino === right.ino;
 }
 function normalizeComparablePath2(value) {
-  const normalized = path127.normalize(path127.resolve(value));
+  const normalized = path128.normalize(path128.resolve(value));
   return process.platform === "win32" ? normalized.toLowerCase() : normalized;
 }
 function delay3(ms) {
@@ -92869,14 +93231,14 @@ async function cancelPrFeedbackLoopUnlocked(directory, sessionID, reason) {
     clearedEvents: []
   };
   try {
-    const { cancelPrFeedbackPublication: cancelPrFeedbackPublication2 } = await import("./pr-workflow-gate-qd5tfkak.js");
+    const { cancelPrFeedbackPublication: cancelPrFeedbackPublication2 } = await import("./pr-workflow-gate-tdj50p2g.js");
     await cancelPrFeedbackPublication2(directory, sessionID, reason);
   } catch (err) {
     warn(`[pr-feedback-loop] cancelPrFeedbackPublication failed (fail-open): ${err instanceof Error ? err.message : String(err)}`);
   }
   try {
     await withLoopStateLock(directory, async () => {
-      const readResult = await _internals101.readState(directory);
+      const readResult = await _internals102.readState(directory);
       if (isCorruptState(readResult)) {
         throw new Error("BLOCKED: loop state is corrupt during durable cancellation admission");
       }
@@ -92889,7 +93251,7 @@ async function cancelPrFeedbackLoopUnlocked(directory, sessionID, reason) {
           correlation.terminal = { state: "cancelled", reason };
         }
         const inFlight = correlation.inFlight;
-        const ownerAlive = inFlight && hasReservationIdentity(inFlight) ? _internals101.isProcessAlive(inFlight.ownerPid) : false;
+        const ownerAlive = inFlight && hasReservationIdentity(inFlight) ? _internals102.isProcessAlive(inFlight.ownerPid) : false;
         const reclaimedReservation = Boolean(inFlight && (inFlight.actionStartedAt === undefined || !ownerAlive));
         if (reclaimedReservation) {
           correlation.inFlight = null;
@@ -92904,7 +93266,7 @@ async function cancelPrFeedbackLoopUnlocked(directory, sessionID, reason) {
           reason
         };
       }
-      await _internals101.writeState(directory, nextState);
+      await _internals102.writeState(directory, nextState);
       return nextState;
     });
   } catch (err) {
@@ -92925,12 +93287,12 @@ async function cancelPrFeedbackLoopUnlocked(directory, sessionID, reason) {
     }
   }
   const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-  receipt.path = path127.join(".swarm", PR_FEEDBACK_CLEANUP_DIR, `cancel-${stamp}.json`);
+  receipt.path = path128.join(".swarm", PR_FEEDBACK_CLEANUP_DIR, `cancel-${stamp}.json`);
   try {
-    fsSync9.mkdirSync(path127.join(directory, ".swarm", PR_FEEDBACK_CLEANUP_DIR), {
+    fsSync9.mkdirSync(path128.join(directory, ".swarm", PR_FEEDBACK_CLEANUP_DIR), {
       recursive: true
     });
-    fsSync9.writeFileSync(path127.join(directory, receipt.path), JSON.stringify({
+    fsSync9.writeFileSync(path128.join(directory, receipt.path), JSON.stringify({
       schemaVersion: 1,
       at: new Date().toISOString(),
       sessionID,
@@ -92982,228 +93344,6 @@ ${USAGE14}`;
 
 // src/background/pr-monitor-worker.ts
 init_warning_buffer();
-
-// src/utils/glab-executable.ts
-init_warning_buffer();
-import { spawnSync as spawnSync6 } from "child_process";
-import * as fs64 from "fs";
-import * as os14 from "os";
-import * as path128 from "path";
-var GLAB_BINARY_ENV_VAR = "OPENCODE_SWARM_GLAB_BINARY";
-var PER_PROBE_TIMEOUT_MS2 = 250;
-var TOTAL_BUDGET_MS3 = 1000;
-var NEGATIVE_CACHE_TTL_MS2 = 60000;
-var BARE_GLAB = "glab";
-var PROBE_MAX_BUFFER_BYTES2 = 64 * 1024;
-var PROBE_OUTPUT_EXCERPT_CHARS2 = 60;
-var WINDOWS_PATH_EXTENSIONS2 = [".exe", ".cmd", ".bat"];
-var GLAB_VERSION_PATTERN = /^glab version \d+\.\d+/;
-function excerptProbeOutput2(raw) {
-  return raw.slice(0, PROBE_OUTPUT_EXCERPT_CHARS2).replace(/[^\x20-\x7E]/g, " ").trim();
-}
-var cache3 = null;
-var lastAttempts2 = [];
-var cacheGeneration2 = 0;
-function windowsGlabAbsoluteCandidates(env) {
-  const candidates = [];
-  const push = (...parts) => {
-    const candidate2 = path128.join(...parts);
-    if (!candidates.includes(candidate2))
-      candidates.push(candidate2);
-  };
-  if (env.ProgramFiles) {
-    push(env.ProgramFiles, "GitLab CLI", "glab.exe");
-  }
-  if (env["ProgramFiles(x86)"]) {
-    push(env["ProgramFiles(x86)"], "GitLab CLI", "glab.exe");
-  }
-  if (env.LOCALAPPDATA) {
-    push(env.LOCALAPPDATA, "GitLab CLI", "glab.exe");
-    push(env.LOCALAPPDATA, "Programs", "GitLab CLI", "glab.exe");
-  }
-  return candidates;
-}
-function platformCandidates2(platform, env) {
-  if (platform === "win32") {
-    return windowsGlabAbsoluteCandidates(env);
-  }
-  if (platform === "darwin") {
-    return ["/opt/homebrew/bin/glab", "/usr/local/bin/glab", "/usr/bin/glab"];
-  }
-  return ["/usr/bin/glab", "/usr/local/bin/glab", "/bin/glab"];
-}
-function isAbsoluteForPlatform2(candidate2, platform) {
-  return platform === "win32" ? path128.win32.isAbsolute(candidate2) : path128.posix.isAbsolute(candidate2);
-}
-function joinDirAndName2(dir, name, platform) {
-  const sep22 = platform === "win32" ? "\\" : "/";
-  const trimmed = dir.replace(/[\\/]+$/, "");
-  return trimmed ? `${trimmed}${sep22}${name}` : `${sep22}${name}`;
-}
-function pathCandidates2(platform) {
-  const pathValue = _internals102.env().PATH ?? "";
-  if (!pathValue)
-    return [];
-  const dirs = pathValue.split(platform === "win32" ? ";" : ":").filter(Boolean);
-  const names = platform === "win32" ? [...WINDOWS_PATH_EXTENSIONS2.map((ext) => `glab${ext}`), "glab"] : ["glab"];
-  const out = [];
-  for (const dir of dirs) {
-    for (const name of names) {
-      const candidate2 = joinDirAndName2(dir, name, platform);
-      if (!out.includes(candidate2))
-        out.push(candidate2);
-    }
-  }
-  return out;
-}
-function envOverride2() {
-  const raw = _internals102.env()[GLAB_BINARY_ENV_VAR];
-  return raw && raw.trim() !== "" ? raw : undefined;
-}
-function buildCandidates2(platform) {
-  const override = envOverride2();
-  const overrideCandidate = override ? [{ source: "override", path: override }] : [];
-  const seen = new Set(overrideCandidate.map((c) => c.path));
-  const rest = [];
-  for (const p of platformCandidates2(platform, _internals102.env())) {
-    if (seen.has(p))
-      continue;
-    seen.add(p);
-    rest.push({ source: "platform", path: p });
-  }
-  for (const p of pathCandidates2(platform)) {
-    if (seen.has(p))
-      continue;
-    seen.add(p);
-    rest.push({ source: "path", path: p });
-  }
-  return [...overrideCandidate, ...rest];
-}
-function probeCandidate2(candidatePath2, platform) {
-  if (!isAbsoluteForPlatform2(candidatePath2, platform)) {
-    return { accepted: false, reason: "not an absolute path" };
-  }
-  let stat14;
-  try {
-    stat14 = fs64.statSync(candidatePath2);
-  } catch (err) {
-    const code = err?.code;
-    if (code === "ENOENT")
-      return { accepted: false, reason: "no such file" };
-    return {
-      accepted: false,
-      reason: `cannot stat (${code ?? "unknown error"})`
-    };
-  }
-  if (stat14.isDirectory()) {
-    return { accepted: false, reason: "is a directory" };
-  }
-  if (!stat14.isFile()) {
-    return { accepted: false, reason: "not a regular file" };
-  }
-  let result;
-  try {
-    result = _internals102.spawnSync(candidatePath2, ["--version"], {
-      cwd: os14.tmpdir(),
-      stdio: ["ignore", "pipe", "ignore"],
-      windowsHide: true,
-      timeout: PER_PROBE_TIMEOUT_MS2,
-      maxBuffer: PROBE_MAX_BUFFER_BYTES2
-    });
-  } catch (err) {
-    return {
-      accepted: false,
-      reason: `spawn threw: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-  if (result.error) {
-    return { accepted: false, reason: `spawn failed: ${result.error.message}` };
-  }
-  if (result.status !== 0) {
-    const statusDescription = result.status !== null ? `exit ${result.status}` : `signal ${result.signal ?? "unknown"}`;
-    return {
-      accepted: false,
-      reason: `glab --version returned ${statusDescription}`
-    };
-  }
-  const versionOutput = (result.stdout ?? "").toString().trim();
-  if (!GLAB_VERSION_PATTERN.test(versionOutput)) {
-    const excerpt = excerptProbeOutput2(versionOutput);
-    return {
-      accepted: false,
-      reason: excerpt ? `not glab: --version printed "${excerpt}"` : "not glab: --version printed nothing"
-    };
-  }
-  return { accepted: true };
-}
-function probeCycle2(candidates, platform, attempts) {
-  const start = _internals102.now();
-  let budgetExceeded = false;
-  for (const candidate2 of candidates) {
-    if (_internals102.now() - start > TOTAL_BUDGET_MS3) {
-      budgetExceeded = true;
-      break;
-    }
-    const result = probeCandidate2(candidate2.path, platform);
-    attempts.push({
-      source: candidate2.source,
-      candidate: candidate2.path,
-      accepted: result.accepted,
-      reason: result.accepted ? undefined : result.reason
-    });
-    if (candidate2.source === "override" && !result.accepted) {
-      advisoryWarn(`[opencode-swarm] ${GLAB_BINARY_ENV_VAR} override "${candidate2.path}" is unusable (${result.reason}); falling back to automatic glab resolution.`);
-    }
-    if (result.accepted) {
-      return { outcome: "accepted", path: candidate2.path };
-    }
-  }
-  return budgetExceeded ? { outcome: "exhausted-budget" } : { outcome: "all-rejected" };
-}
-function readCache3() {
-  if (cache3 === null)
-    return null;
-  if (cache3.kind === "success")
-    return cache3;
-  if (_internals102.now() < cache3.expiresAt)
-    return cache3;
-  cache3 = null;
-  return null;
-}
-function applyProbeResult2(result, attempts, generation) {
-  if (generation !== cacheGeneration2) {
-    return result.outcome === "accepted" ? result.path : BARE_GLAB;
-  }
-  lastAttempts2 = attempts;
-  if (result.outcome === "accepted") {
-    cache3 = { kind: "success", path: result.path };
-    return result.path;
-  }
-  cache3 = {
-    kind: "fallback",
-    expiresAt: _internals102.now() + NEGATIVE_CACHE_TTL_MS2
-  };
-  return BARE_GLAB;
-}
-function resolveGlabExecutable() {
-  const cached = readCache3();
-  if (cached)
-    return cached.kind === "success" ? cached.path : BARE_GLAB;
-  const platform = _internals102.platform();
-  const attempts = [];
-  const generation = cacheGeneration2;
-  const candidates = buildCandidates2(platform);
-  const result = probeCycle2(candidates, platform, attempts);
-  return applyProbeResult2(result, attempts, generation);
-}
-var _internals102 = {
-  spawnSync: spawnSync6,
-  platform: () => process.platform,
-  env: () => process.env,
-  now: () => Date.now()
-};
-
-// src/background/pr-monitor-worker.ts
 var prMonitorWorkerRegistry = new Map;
 function getPrMonitorWorkerHealth(directory) {
   return prMonitorWorkerRegistry.get(directory)?.getHealth() ?? null;
@@ -93413,12 +93553,7 @@ class PrMonitorWorker {
   async pollSinglePr(sub, isTimedOut, isProbe = false) {
     const correlationId = sub.correlationId;
     const forgeContext = detectForgeFromUrl(sub.prUrl) ?? (sub.forge ? { provider: sub.forge.provider, host: sub.forge.host } : null);
-    if (forgeContext && !getProviderCapabilities(forgeContext.provider).statusCheckRollup && !getProviderCapabilities(forgeContext.provider).reviewDecision && !getProviderCapabilities(forgeContext.provider).mergeStateStatus) {
-      const glabBinary = resolveGlabExecutable();
-      const glabStatus = glabBinary === "glab" ? "glab binary not resolved (bare-name fallback)" : "glab binary resolved";
-      log("[PrMonitorWorker] GitLab MR monitoring unavailable: glab-backed polling is not wired yet (issue #2882); skipping gh poll for this subscription", { correlationId, glabStatus });
-      return;
-    }
+    const isGitLab = forgeContext?.provider === "gitlab";
     if (!this.circuitBreakerMap.has(correlationId) && sub.errorCount > 0) {
       this.circuitBreakerMap.set(correlationId, {
         errorCount: sub.errorCount,
@@ -93443,40 +93578,76 @@ class PrMonitorWorker {
       return;
     }
     try {
-      const [snapshot, reviewComments] = await Promise.all([
-        _internals103.getPRPollSnapshot(sub.prNumber, sub.repoFullName, this.directory),
-        _internals103.getPRReviewComments(sub.prNumber, sub.repoFullName, this.directory)
-      ]);
-      if (isTimedOut?.()) {
-        log("[PrMonitorWorker] Skipping late result \u2014 poll already timed out", {
-          correlationId: sub.correlationId
-        });
-        return;
-      }
-      let mergeGroupRunResult = null;
-      let mergeGroupRunFetchSucceeded = false;
-      try {
-        mergeGroupRunResult = await _internals103.getMergeGroupRun(snapshot.status.statusCheckRollup, sub.repoFullName, this.directory);
-        mergeGroupRunFetchSucceeded = true;
-      } catch (err) {
-        log("[PrMonitorWorker] Failed to fetch merge group run", {
-          correlationId: sub.correlationId,
-          error: err instanceof Error ? err.message : String(err)
+      let changes;
+      if (isGitLab) {
+        const glabBinary = resolveGlabExecutable();
+        const glabStatus = glabBinary === "glab" ? "glab binary not resolved (bare-name fallback)" : "glab binary resolved";
+        log("[PrMonitorWorker] Polling GitLab MR (glab-backed)", {
+          correlationId,
+          glabStatus
         });
-      }
-      if (isTimedOut?.()) {
-        log("[PrMonitorWorker] Skipping late result \u2014 poll already timed out", {
-          correlationId: sub.correlationId
+        const mrInput = {
+          projectPath: sub.repoFullName,
+          iid: sub.prNumber,
+          cwd: this.directory,
+          ...forgeContext ? { host: forgeContext.host } : {}
+        };
+        const [mrSnapshot, mrComments] = await Promise.all([
+          _internals103.getMRPollSnapshot(mrInput),
+          _internals103.getMRComments(mrInput)
+        ]);
+        if (isTimedOut?.()) {
+          log("[PrMonitorWorker] Skipping late result \u2014 poll already timed out", {
+            correlationId: sub.correlationId
+          });
+          return;
+        }
+        changes = this.computeChanges(sub, {
+          status: mrSnapshot.status,
+          comments: mrComments,
+          merge: mrSnapshot.merge,
+          review: mrSnapshot.review,
+          mergeGroupRun: null
+        }, true, {
+          checks: mrSnapshot.pipelines,
+          fetchSucceeded: mrSnapshot.pipelinesFetchSucceeded
         });
-        return;
+      } else {
+        const [snapshot, reviewComments] = await Promise.all([
+          _internals103.getPRPollSnapshot(sub.prNumber, sub.repoFullName, this.directory),
+          _internals103.getPRReviewComments(sub.prNumber, sub.repoFullName, this.directory)
+        ]);
+        if (isTimedOut?.()) {
+          log("[PrMonitorWorker] Skipping late result \u2014 poll already timed out", {
+            correlationId: sub.correlationId
+          });
+          return;
+        }
+        let mergeGroupRunResult = null;
+        let mergeGroupRunFetchSucceeded = false;
+        try {
+          mergeGroupRunResult = await _internals103.getMergeGroupRun(snapshot.status.statusCheckRollup, sub.repoFullName, this.directory);
+          mergeGroupRunFetchSucceeded = true;
+        } catch (err) {
+          log("[PrMonitorWorker] Failed to fetch merge group run", {
+            correlationId: sub.correlationId,
+            error: err instanceof Error ? err.message : String(err)
+          });
+        }
+        if (isTimedOut?.()) {
+          log("[PrMonitorWorker] Skipping late result \u2014 poll already timed out", {
+            correlationId: sub.correlationId
+          });
+          return;
+        }
+        changes = this.computeChanges(sub, {
+          status: snapshot.status,
+          comments: [...snapshot.comments, ...reviewComments],
+          merge: snapshot.merge,
+          review: snapshot.review,
+          mergeGroupRun: mergeGroupRunResult
+        }, mergeGroupRunFetchSucceeded);
       }
-      const changes = this.computeChanges(sub, {
-        status: snapshot.status,
-        comments: [...snapshot.comments, ...reviewComments],
-        merge: snapshot.merge,
-        review: snapshot.review,
-        mergeGroupRun: mergeGroupRunResult
-      }, mergeGroupRunFetchSucceeded);
       await this.applyChanges(sub, changes, isTimedOut);
       if (!isTimedOut?.()) {
         this.circuitBreakerMap.delete(correlationId);
@@ -93512,7 +93683,7 @@ class PrMonitorWorker {
       await this.handlePollError(sub, err instanceof Error ? err : new Error(String(err)));
     }
   }
-  computeChanges(sub, current, mergeGroupRunFetchSucceeded) {
+  computeChanges(sub, current, mergeGroupRunFetchSucceeded, gitLabPipelines) {
     const events = [];
     const snapshotUpdates = {
       headRefOid: current.status.headRefOid,
@@ -93539,13 +93710,17 @@ class PrMonitorWorker {
         }
       });
     }
-    const currentCheckSet = this.serializeChecks(current.status.statusCheckRollup);
-    snapshotUpdates.lastCheckRunSet = currentCheckSet;
-    if (sub.lastCheckRunSet !== undefined && currentCheckSet !== sub.lastCheckRunSet) {
-      const prevChecks = this.parseCheckSet(sub.lastCheckRunSet);
-      this.computeCIEvents(sub, prevChecks, current.status.statusCheckRollup, current.status.headRefOid, events);
+    const ciChecks = gitLabPipelines ? gitLabPipelines.checks : current.status.statusCheckRollup;
+    const gitlabNoTerminalVerdict = gitLabPipelines !== undefined && gitLabPipelines.checks.length === 0;
+    if (!gitlabNoTerminalVerdict && (!gitLabPipelines || gitLabPipelines.fetchSucceeded)) {
+      const currentCheckSet = this.serializeChecks(ciChecks);
+      snapshotUpdates.lastCheckRunSet = currentCheckSet;
+      if (sub.lastCheckRunSet !== undefined && currentCheckSet !== sub.lastCheckRunSet) {
+        const prevChecks = this.parseCheckSet(sub.lastCheckRunSet);
+        this.computeCIEvents(sub, prevChecks, ciChecks, current.status.headRefOid, events);
+      }
+      snapshotUpdates.lastCheckRunSet = currentCheckSet;
     }
-    snapshotUpdates.lastCheckRunSet = currentCheckSet;
     if (current.comments.length > 0) {
       const sorted2 = [...current.comments].sort((a, b) => a.createdAt.localeCompare(b.createdAt));
       let newComments;
@@ -93877,6 +94052,8 @@ class PrMonitorWorker {
 var _internals103 = {
   getPRPollSnapshot,
   getPRReviewComments,
+  getMRPollSnapshot,
+  getMRComments,
   getMergeGroupRun,
   listActive,
   updateSnapshot,
@@ -94240,11 +94417,10 @@ async function handlePrSubscribeCommand(directory, args, sessionID) {
       deliveryLine
     ].concat(prUrl.includes("/-/merge_requests/") ? [
       "",
-      "Note: live monitoring is NOT AVAILABLE for GitLab merge",
-      "requests yet \u2014 glab-backed polling is tracked as issue #2882.",
-      "The subscription is recorded and PR reference/gate/",
-      "publication workflows operate on this MR, but no CI/comment/",
-      "review events will be delivered until that lands."
+      "Note: live GitLab MR monitoring is active (glab-backed:",
+      "state, comments, and pipeline CI events). Review-decision",
+      "and status-check rollup equivalents remain NOT AVAILABLE",
+      "for GitLab \u2014 the monitor never fabricates them (issue #2733)."
     ] : []).join(`
 `);
   } catch (err) {
@@ -109309,7 +109485,7 @@ function buildDetailedHelp(commandName, entry) {
 async function handleHelpCommand(ctx) {
   const targetCommand = ctx.args.join(" ");
   if (!targetCommand) {
-    const { buildHelpText } = await import("./index-r9zc92pb.js");
+    const { buildHelpText } = await import("./index-4dwhfbed.js");
     return buildHelpText();
   }
   const tokens = targetCommand.split(/\s+/);
@@ -109323,7 +109499,7 @@ async function handleHelpCommand(ctx) {
 > Note: \`/swarm ${resolved.key}\` is a deprecated alias for \`/swarm ${aliasTarget}\`.` : detailed;
   }
   const similar = _internals27.findSimilarCommands(targetCommand);
-  const { buildHelpText: fullHelp } = await import("./index-r9zc92pb.js");
+  const { buildHelpText: fullHelp } = await import("./index-4dwhfbed.js");
   if (similar.length > 0) {
     return `Command '/swarm ${targetCommand}' not found.
 
@@ -109358,6 +109534,18 @@ async function handleModeCommandWithBundledSkills(ctx, handler, mechanicalMode)
   }
   return result;
 }
+function resolveCommandForgeContext(directory, prUrl) {
+  if (detectForgeFromUrl(prUrl))
+    return;
+  try {
+    const config = loadPluginConfig(directory);
+    const remote = detectGitRemote(directory, undefined);
+    const remotes = remote ? [remote] : [];
+    return resolveForgeContextFromPluginConfig(config, remotes) ?? undefined;
+  } catch {
+    return;
+  }
+}
 async function handlePrFeedbackCommandWithTransition(ctx) {
   if (ctx.packageRoot) {
     await syncBundledProjectSkillsIfMissingAsync(ctx.directory, ctx.packageRoot, true);
@@ -109388,7 +109576,8 @@ async function handlePrFeedbackCommandWithTransition(ctx) {
   } else {
     await activatePrWorkflow(ctx.directory, ctx.sessionID, "PR_FEEDBACK", {
       requireCheckoutPreflight: true,
-      ...parsed.prUrl ? { prUrl: parsed.prUrl } : {}
+      ...parsed.prUrl ? { prUrl: parsed.prUrl } : {},
+      ...parsed.prUrl ? { forge: resolveCommandForgeContext(ctx.directory, parsed.prUrl) } : {}
     });
   }
   return handlePrFeedbackCommand(ctx.directory, ctx.args);
@@ -109638,7 +109827,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-ma658hkw.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-njv3pnsw.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -109648,7 +109837,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail reset": {
     handler: async (ctx) => {
-      const { handleGuardrailReset } = await import("./guardrail-reset-w41yndke.js");
+      const { handleGuardrailReset } = await import("./guardrail-reset-11cvwgbe.js");
       return handleGuardrailReset(ctx.args, ctx.sessionID);
     },
     description: "Reset one exact active invocation/action circuit after repair",
@@ -109669,7 +109858,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-log": {
     handler: async (ctx) => {
-      const { handleGuardrailLog } = await import("./guardrail-log-m6mydjet.js");
+      const { handleGuardrailLog } = await import("./guardrail-log-r8zmh4rd.js");
       return handleGuardrailLog(ctx.directory, ctx.args);
     },
     description: "Read the guardrail decision log (use --blocks-only for blocks)",