opencode-swarm 7.185.1 → 7.186.1

package/dist/cli/{index-hgfkcb1q.js → index-ef3pecd4.js}

@@ -8,13 +8,13 @@ import {
   protectedRoots,
   redactDecisionLineForArchive,
   stableCanonicalStringify
-} from "./index-ss6b8jpz.js";
+} from "./index-vvajq163.js";
 import {
   detectStraySwarmDirs,
   readDoctorArtifact,
   removeStraySwarmDir,
   runConfigDoctor
-} from "./index-9h93zjm3.js";
+} from "./index-hmwnegkz.js";
 import {
   archiveEvidence,
   checkRequirementCoverage,
@@ -26,7 +26,7 @@ import {
   sanitizeTaskId,
   saveEvidence,
   validateProjectRoot
-} from "./index-pa6fzbms.js";
+} from "./index-chaa1v0b.js";
 import {
   LANGUAGE_REGISTRY,
   _internals as _internals3,
@@ -44,7 +44,7 @@ import {
   runEvaluation,
   runExternalTool,
   withDisposableWorktree
-} from "./index-1fc5aj26.js";
+} from "./index-w12y73z5.js";
 import {
   EvaluationTaskV1Schema,
   GateAuditManifestV1Schema,
@@ -61,7 +61,7 @@ import {
   saveGateAuditResult,
   savePromotionDecision,
   saveTaskSetSnapshot
-} from "./index-62akgg9d.js";
+} from "./index-92y6cpqn.js";
 import {
   canonicalHash,
   canonicalJson,
@@ -77,7 +77,7 @@ import {
   alreadyCuratedThisGeneration,
   claimNextScanBatch,
   resolveCohortId
-} from "./index-smwybqka.js";
+} from "./index-xe34ymp8.js";
 import {
   CURATOR_CONSOLIDATION_PROMPT,
   CURATOR_INIT_PROMPT,
@@ -96,13 +96,13 @@ import {
   getGroupCommitWriter,
   importLegacyJsonl,
   readPriorDriftReports
-} from "./index-s7va6n84.js";
+} from "./index-0t61279z.js";
 import {
   assertNoUnsettledCoderDispatch,
   listCoderSettlementWalStates,
   recoverCoderSettlement,
   recoverStaleCoderSettlements
-} from "./index-ek5gvpvm.js";
+} from "./index-4h6e73bx.js";
 import {
   BUNDLED_PROJECT_SKILL_ROOT,
   DEFAULT_SKILL_MIN_CONFIDENCE,
@@ -123,11 +123,11 @@ import {
   retireSkill,
   selectCandidateEntries,
   syncBundledProjectSkillsIfMissingAsync
-} from "./index-dz5cbkrm.js";
+} from "./index-mnb1pg1n.js";
 import {
   buildEscalationBriefing,
   readRecentEscalations
-} from "./index-5n08z6qj.js";
+} from "./index-qg0nhcke.js";
 import {
   parsePorcelainV2Snapshot,
   resolveCommitCountSince,
@@ -155,7 +155,7 @@ import {
   resolveRemoteUrlIdentity,
   resolveRemoteUrlIdentityAsync,
   switchPrFeedbackTrackingCandidateAsync
-} from "./index-s68z4a39.js";
+} from "./index-9z9g1897.js";
 import {
   buildCorrelationId,
   buildIssueUrl,
@@ -163,8 +163,8 @@ import {
   canonicalForgePrUrl,
   containsControlCharacters,
   detectForgeFromUrl,
+  findSubscriptionRecordForPrUrl,
   getPrSubscriptionHealth,
-  getProviderCapabilities,
   hasNonAsciiHostname,
   isPrSubscriptionCapacityError,
   isPrivateHost,
@@ -176,12 +176,12 @@ import {
   sweepStale,
   unsubscribe,
   updateSnapshot
-} from "./index-cp2nerjd.js";
+} from "./index-dbcwvc1v.js";
 import {
   WORKTREE_LIFECYCLE_LOCK_FILE,
   recordWorktreeProvisioningOwner,
   removeWorktreeProvisioningOwner
-} from "./index-vqz0avr4.js";
+} from "./index-wrhf5apg.js";
 import {
   getLanguageForExtension
 } from "./index-pt7h91zc.js";
@@ -194,7 +194,7 @@ import {
   checkpoint,
   createSwarmTool,
   resolveWorkingDirectory
-} from "./index-nhw5rt5x.js";
+} from "./index-syt8wykh.js";
 import {
   MAX_TRANSIENT_RETRIES,
   PlanRecoverySupersededError,
@@ -222,7 +222,7 @@ import {
   transientBackoff,
   updateTaskStatus,
   withPlanLifecycleLock
-} from "./index-pppjg0ct.js";
+} from "./index-ptp6d5mm.js";
 import {
   containsControlChars,
   containsPathTraversal,
@@ -238,7 +238,7 @@ import {
   resolveSpeckitProjection,
   validateSpeckit,
   writeProjectedSpecSync
-} from "./index-2b3bgm20.js";
+} from "./index-8jq3jsas.js";
 import {
   clearWorktreeMergeStatus,
   getAllWorktreeMergeFailures,
@@ -269,7 +269,7 @@ import {
   transitionTaskWorkflowEvidenceWithStatus,
   withTaskEvidenceTransaction,
   writeWorkflowWalFile
-} from "./index-cnbpht7m.js";
+} from "./index-98j268bh.js";
 import {
   isPathUnderSwarmWorktreeBase,
   listLiveLaneOwners,
@@ -278,7 +278,7 @@ import {
   recordLiveLaneOwner,
   removeWorktree,
   resolveWorktreeBaseDir
-} from "./index-2c6e1p7j.js";
+} from "./index-4z0zdcd7.js";
 import {
   DEFAULT_STALE_DELEGATION_TIMEOUT_MS,
   DELEGATION_COMPACTION_HIGH_WATER_BYTES,
@@ -312,7 +312,7 @@ import {
   scanBackgroundCoderReservationsForAdmission,
   scanDelegationsForRecovery,
   sweepStaleDelegations
-} from "./index-nw16apxs.js";
+} from "./index-ezttvjcf.js";
 import {
   MAX_EVENT_LOG_ENTRIES,
   _internals,
@@ -331,7 +331,7 @@ import {
   recordKnowledgeEvent,
   recordPhaseCloseIntent,
   resolveKnowledgeEventsPath
-} from "./index-ppj5bjaq.js";
+} from "./index-qj7ewgrf.js";
 import {
   estimateCharsForTokens,
   estimateTokens,
@@ -339,7 +339,7 @@ import {
   readSwarmFileAsync,
   safeHook,
   validateSwarmPath
-} from "./index-afmyp3kt.js";
+} from "./index-5v1sqv3m.js";
 import {
   bunFile,
   bunSpawn,
@@ -359,18 +359,18 @@ import {
   validateActionableFields,
   validateLesson,
   validateSkillPath
-} from "./index-ycqsnfd1.js";
+} from "./index-jwkybwv0.js";
 import {
   MAX_CURATION_PROPOSALS,
   authorizeCuration,
   buildConfigFingerprintInput
-} from "./index-8nsjefpc.js";
+} from "./index-bpqw4n2f.js";
 import {
   cohortConfigFingerprint
 } from "./index-rtry5xyf.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-7jt24hpz.js";
+} from "./index-hq9f7fwf.js";
 import {
   RetrospectiveEvidenceSchema
 } from "./index-frcemc0b.js";
@@ -382,7 +382,7 @@ import {
   clearScopeBindings,
   readAuthoritativeScopeBindingSet,
   readDeclaredScopeFilesFromBindings
-} from "./index-6wqv8f7d.js";
+} from "./index-8fnayk3x.js";
 import {
   clearPlanLedgerForReset,
   computePlanStructureHash,
@@ -398,7 +398,7 @@ import {
   replayFromLedgerWithStatus,
   resolvePlanningProfile,
   takeSnapshotEvent
-} from "./index-dryhmaft.js";
+} from "./index-ay508kfq.js";
 import {
   CORE_EVENT_LOCKED,
   appendCoreEventSync,
@@ -408,7 +408,7 @@ import {
   hasSpecDriftAuditEvent,
   hasTaskRepairAuditEvent,
   readCoreEvents
-} from "./index-373880cv.js";
+} from "./index-y7s92gte.js";
 import {
   DEFAULT_QA_GATES,
   computeProfileHash,
@@ -416,7 +416,7 @@ import {
   getEffectiveGates,
   getProfileLookupForIdentity,
   setGatesForIdentity
-} from "./index-9g61bfj9.js";
+} from "./index-010en5sq.js";
 import {
   MAX_COORDINATION_STATE_LIST_ROWS,
   deleteCoordinationImports,
@@ -427,7 +427,7 @@ import {
   listCoordinationStates,
   transitionCoordinationState,
   withCoordinationTransaction
-} from "./index-nen885g8.js";
+} from "./index-q9wnbz9q.js";
 import {
   DURABILITY_CLASSES,
   closeAllProjectDbs,
@@ -436,7 +436,7 @@ import {
   projectDbExists,
   projectDbPath,
   withImmediateTransaction
-} from "./index-74yxwf8y.js";
+} from "./index-t46swpqf.js";
 import {
   canonicalExistingFilesystemPath,
   canonicalPathForFutureIo,
@@ -456,7 +456,7 @@ import {
   observeModelLimitResolution,
   observeStoreHealth,
   readLearningHealth
-} from "./index-xgdypzch.js";
+} from "./index-92bbwjek.js";
 import {
   appendKnowledge,
   appendRejectedLesson,
@@ -487,7 +487,7 @@ import {
   transactFile,
   transactKnowledge,
   wordBigrams
-} from "./index-7n3h39h9.js";
+} from "./index-pe1wgpvg.js";
 import {
   readTailJsonl,
   readTailJsonlDetailed,
@@ -508,10 +508,10 @@ import {
   resolveLinkDir,
   sanitizeLinkId,
   writeLinkPointer
-} from "./index-zxck9sr7.js";
+} from "./index-gjrs1epm.js";
 import {
   atomicWriteFile
-} from "./index-6sffjy74.js";
+} from "./index-c5e1wr7h.js";
 import {
   withEvidenceLock
 } from "./index-6cjpmvpa.js";
@@ -554,7 +554,7 @@ import {
   matchTempGrammar,
   parseTargetBasename,
   resetSwarmArtifactCache
-} from "./index-yj7etak0.js";
+} from "./index-m8dry0a6.js";
 import {
   PlanSchema,
   TaskStatusSchema,
@@ -568,7 +568,7 @@ import {
   loadGateOverrides,
   loadPluginConfig,
   loadPluginConfigWithMeta
-} from "./index-ekyg4p8b.js";
+} from "./index-teyvb5tr.js";
 import {
   addDeferredWarning,
   advisoryWarn,
@@ -600,7 +600,7 @@ import {
   resolveContextWindow,
   resolveGeneratedAgentRole,
   stripKnownSwarmPrefix
-} from "./index-rr1dggfe.js";
+} from "./index-nnmgg6z6.js";
 import {
   AGENT_TOOL_MAP,
   ALL_AGENT_NAMES,
@@ -3389,7 +3389,7 @@ async function importLegacyPrWorkflowGateStateIfNeeded(directory, sessionID, all
       return null;
     throw error2;
   }
-  const legacy = allowSalvagedImport ? (await (await import("./pr-workflow-gate-qd5tfkak.js")).readPrWorkflowGateStateForRecovery(directory, sessionID))?.state ?? null : await readPrWorkflowGateStateFileFromDisk(filePath, sessionID);
+  const legacy = allowSalvagedImport ? (await (await import("./pr-workflow-gate-j3r636zg.js")).readPrWorkflowGateStateForRecovery(directory, sessionID))?.state ?? null : await readPrWorkflowGateStateFileFromDisk(filePath, sessionID);
   if (!legacy)
     return null;
   const namespace = workflowGateStateCoordinationNamespace(sessionID);
@@ -3476,7 +3476,7 @@ async function deleteStateWhileLocked(directory, sessionID, options = {}) {
   let recoveryState = null;
   if (!currentAuthoritative) {
     if (options.allowSalvagedRead) {
-      const { readPrWorkflowGateStateForRecovery } = await import("./pr-workflow-gate-qd5tfkak.js");
+      const { readPrWorkflowGateStateForRecovery } = await import("./pr-workflow-gate-j3r636zg.js");
       recoveryState = (await readPrWorkflowGateStateForRecovery(directory, normalizedSessionID))?.state ?? null;
     }
     if (!recoveryState) {
@@ -15039,7 +15039,7 @@ function isLaneOwnedByCurrentSession(branchName, expectedSessionId) {
   return extracted === expectedSessionId;
 }
 async function inspectStandardWorktreeCollisionOwnership(identity) {
-  const collisionOwnership = await import("./worktree-collision-ownership-80n814a8.js");
+  const collisionOwnership = await import("./worktree-collision-ownership-4yxah5wy.js");
   return collisionOwnership.inspectStandardWorktreeCollisionOwnership(identity);
 }
 async function runRecoveryGit(directory, args, timeoutMs = 15000) {
@@ -15465,7 +15465,7 @@ async function precreateStandardWorktreeSession(args) {
   const laneProfile = computeLaneRuntimeProfile(worktreeConfig.runtime_isolation, laneIndex, handle.worktreePath);
   if (laneProfile) {
     try {
-      const { writeLaneProfileToDiskReal } = await import("./core-cxnqsrxp.js");
+      const { writeLaneProfileToDiskReal } = await import("./core-fvsjr20m.js");
       await writeLaneProfileToDiskReal(handle.worktreePath, laneProfile.laneIndex, laneProfile.envOverrides);
     } catch {}
   }
@@ -16444,7 +16444,7 @@ async function finishStandardWorktreeDispatch(directory, dispatch, config, callI
       }
       clearWorktreeMergeStatus(statusKey);
       try {
-        const { removeLaneProfileFromDiskReal } = await import("./core-cxnqsrxp.js");
+        const { removeLaneProfileFromDiskReal } = await import("./core-fvsjr20m.js");
         await removeLaneProfileFromDiskReal(dispatch.handle.worktreePath, dispatch.laneIndex);
       } catch {}
       const state = serializationStateBySessionID.get(dispatch.parentSessionID);
@@ -24083,7 +24083,7 @@ function clearCriticalShownIds(sessionID) {
 async function rehydratePrSubscriptions(sessionID, directory) {
   const map = new Map;
   try {
-    const { listActive: listActive2 } = await import("./pr-subscriptions-qwr6ybcb.js");
+    const { listActive: listActive2 } = await import("./pr-subscriptions-nacx8r6a.js");
     const records = await listActive2(directory);
     for (const record of records) {
       if (record.sessionID !== sessionID)
@@ -24427,6 +24427,16 @@ var PrReviewValidationBatchRecordSchema = exports_external.object({
   }).strict()).min(1),
   validatedAt: exports_external.string().min(1)
 }).strict();
+var PrReviewMicroFamilyDispatchRecordSchema = exports_external.object({
+  batchId: exports_external.string().min(1),
+  prHeadSha: exports_external.string().min(1),
+  lanes: exports_external.array(exports_external.object({
+    laneId: exports_external.string().min(1),
+    workflowLane: exports_external.string().min(1),
+    ownedWorkflowLanes: exports_external.array(exports_external.string().min(1)).min(1).optional()
+  }).strict()).min(1),
+  admittedAt: exports_external.string().min(1)
+}).strict();
 var PrReviewBatchCoherenceRecordSchema = exports_external.object({
   validatedInventory: exports_external.array(exports_external.string().min(1)),
   reviewerItemBindings: exports_external.record(exports_external.string().min(1), exports_external.string().regex(/^[0-9a-f]{64}$/)).optional(),
@@ -24495,6 +24505,7 @@ var PrWorkflowGateStateSchema = exports_external.object({
   prReviewResilience: PrReviewResilienceStateRecordSchema.optional(),
   prReviewContractRetryDimensions: exports_external.array(PrReviewBaseDimensionIdSchema).max(PR_REVIEW_BASE_DIMENSION_IDS.length).optional(),
   prReviewTriggerLedger: exports_external.array(PrReviewInlineTriggerRowSchema).length(PR_REVIEW_REQUIRED_TRIGGER_IDS.length).optional(),
+  prReviewMicroFamilyDispatches: exports_external.array(PrReviewMicroFamilyDispatchRecordSchema).max(MAX_WORKFLOW_BATCHES).optional(),
   prReviewTriggerEvalPath: exports_external.string().min(1).optional(),
   prReviewTriggerEvalRunId: exports_external.string().min(1).optional(),
   prReviewValidationBatches: exports_external.array(PrReviewValidationBatchRecordSchema).max(MAX_WORKFLOW_BATCHES).optional(),
@@ -24568,11 +24579,11 @@ async function activatePrWorkflow(directory, sessionID, mode, options = {}) {
     let existing = await readPrWorkflowGateStateFromDisk3(directory, normalizedSessionID);
     if (existing?.mode === mode) {
       if (mode === "PR_FEEDBACK" && options.prUrl) {
-        const requestedTarget = canonicalGitHubPrUrl(options.prUrl);
+        const requestedTarget = canonicalGitHubPrUrl(options.prUrl, options.forge);
         if (!requestedTarget) {
           throw new Error("BLOCKED: PR_FEEDBACK target must be a canonical GitHub PR URL");
         }
-        const existingTarget = existing.prFeedbackTargetUrl ? canonicalGitHubPrUrl(existing.prFeedbackTargetUrl) : null;
+        const existingTarget = existing.prFeedbackTargetUrl ? canonicalGitHubPrUrl(existing.prFeedbackTargetUrl, options.forge) : null;
         if (existingTarget && requestedTarget !== existingTarget) {
           throw new Error(`BLOCKED: active PR_FEEDBACK targets a different GitHub pull request`);
         }
@@ -24606,7 +24617,7 @@ async function activatePrWorkflow(directory, sessionID, mode, options = {}) {
     const initialHead = options.prHeadSha ? await assertCurrentCheckoutHead(directory, options.prHeadSha, mode) : undefined;
     const skillContractAdvisories = await ensurePrWorkflowSkillContractsFresh(directory, mode);
     const timestamp = isoNow();
-    const feedbackTargetUrl = mode === "PR_FEEDBACK" && options.prUrl ? canonicalGitHubPrUrl(options.prUrl) ? options.prUrl : null : undefined;
+    const feedbackTargetUrl = mode === "PR_FEEDBACK" && options.prUrl ? canonicalGitHubPrUrl(options.prUrl, options.forge) ? options.prUrl : null : undefined;
     if (feedbackTargetUrl === null) {
       throw new Error("BLOCKED: PR_FEEDBACK target must be a canonical GitHub PR URL");
     }
@@ -26917,6 +26928,36 @@ async function assertPrReviewBaseCoverageSettled2(directory, sessionID, gateCont
     settlement: settled.settlement
   };
 }
+async function recordPrReviewMicroFamilyDispatch(directory, sessionID, lanes, options) {
+  const state = await bindPrWorkflowHead(directory, sessionID, options.prHeadSha);
+  if (state.mode !== "PR_REVIEW")
+    throw wrongModeError(state, "PR_REVIEW");
+  const batchId = normalizeBatchId(options.batchId);
+  const previous = state.prReviewMicroFamilyDispatches ?? [];
+  if (previous.some((record2) => record2.batchId === batchId)) {
+    return state;
+  }
+  if (previous.length >= MAX_WORKFLOW_BATCHES) {
+    throw new Error(`BLOCKED: PR_REVIEW micro-family dispatch ledger limit reached (${MAX_WORKFLOW_BATCHES} recorded acknowledgments). Nothing was appended and no lane was launched, so re-issuing this dispatch call is safe once the ledger has room. A healthy run records at most ~${11 * (1 + 2)} acknowledgments (11 families x initial dispatch + 2 retries), so reaching the cap indicates a dispatch loop. Recovery: let the active workflow settle or restart with abort_pr_workflow (kind "recovery").`);
+  }
+  const record = {
+    batchId,
+    prHeadSha: options.prHeadSha,
+    lanes: normalizeWorkflowLanes(lanes).map((lane) => ({
+      laneId: lane.laneId,
+      workflowLane: lane.workflowLane,
+      ...lane.ownedWorkflowLanes?.length ? { ownedWorkflowLanes: lane.ownedWorkflowLanes } : {}
+    })),
+    admittedAt: isoNow()
+  };
+  const nextState = {
+    ...state,
+    updatedAt: isoNow(),
+    prReviewMicroFamilyDispatches: [...previous, record]
+  };
+  await persistState(directory, nextState);
+  return nextState;
+}
 async function recordPrReviewValidationBatch(directory, sessionID, phase, lanes, options) {
   let state = await bindPrWorkflowHead(directory, sessionID, options.prHeadSha);
   if (state.mode !== "PR_REVIEW")
@@ -29150,8 +29191,8 @@ async function readPrReviewFinalFindingPolicyForReport(directory, sessionID) {
   const blockingFindingIds = policyProjection.blockingFindingIds.flatMap((id) => sourceIdsByPolicyFindingId.get(id) ?? [id]).sort();
   return { policyVersion: 1, permittedVerdicts, blockingFindingIds };
 }
-function canonicalGitHubPrUrl(value) {
-  return canonicalForgePrUrl(value);
+function canonicalGitHubPrUrl(value, configured) {
+  return canonicalForgePrUrl(value, configured);
 }
 function assertMatchingPrReviewFeedbackConsent(record, input) {
   if (record.session_id !== input.sessionID || record.run_id !== input.runId || record.handoff_path !== input.handoffPath || record.handoff_digest !== input.handoffDigest || canonicalGitHubPrUrl(record.pr_url) !== canonicalGitHubPrUrl(input.prUrl) || record.pr_head_sha.toLowerCase() !== input.prHeadSha.toLowerCase() || record.finding_ids_digest !== input.findingIdsDigest || record.source_workflow_instance_id !== input.sourceWorkflowInstanceId) {
@@ -32223,6 +32264,128 @@ async function readPrWorkflowGateStateForRecovery(directory, sessionID) {
 // src/commands/registry.ts
 init_logger();
 
+// src/commands/_shared/url-security.ts
+import * as child_process from "child_process";
+init_git_executable();
+var MAX_URL_LEN = 2048;
+var _internals32 = {
+  spawnSync: (cmd, args, options) => {
+    const mergedEnv = mergeEnvForChild(options?.env, options?.envOverrides);
+    return child_process.spawnSync(cmd, args, {
+      ...options,
+      env: mergedEnv
+    });
+  }
+};
+function sanitizeUrl(raw) {
+  let urlStr = raw.trim();
+  urlStr = urlStr.replace(/^([A-Za-z][A-Za-z0-9+.-]*:\/\/)\/?[^@/]+@/, "$1");
+  urlStr = urlStr.replace(/\[\s*MODE\s*:[^\]]*\]/gi, "");
+  urlStr = urlStr.replace(/^([A-Za-z][A-Za-z0-9+.-]*:\/\/)\/?[^@/]+@/, "$1");
+  const fragmentIdx = urlStr.indexOf("#");
+  if (fragmentIdx !== -1) {
+    urlStr = urlStr.slice(0, fragmentIdx);
+  }
+  const queryIdx = urlStr.indexOf("?");
+  if (queryIdx !== -1) {
+    urlStr = urlStr.slice(0, queryIdx);
+  }
+  if (urlStr.length > MAX_URL_LEN) {
+    urlStr = urlStr.slice(0, MAX_URL_LEN);
+  }
+  return urlStr.trim();
+}
+function sanitizeErrorEcho(raw, maxLength = 80) {
+  let stripped = "";
+  for (const ch of raw) {
+    const cp = ch.codePointAt(0);
+    if (cp !== undefined && (cp <= 31 || cp === 127)) {
+      stripped += " ";
+      continue;
+    }
+    stripped += ch;
+  }
+  const collapsed = stripped.replace(/\s+/g, " ").trim();
+  if (collapsed.length <= maxLength)
+    return collapsed;
+  return `${collapsed.slice(0, maxLength)}\u2026`;
+}
+function validateAndSanitizeGithubUrl(rawUrl, resource, configured) {
+  const sanitized = sanitizeUrl(rawUrl);
+  if (!sanitized) {
+    return { error: "Empty URL" };
+  }
+  if (!sanitized.startsWith("https://")) {
+    return { error: "URL must use HTTPS scheme" };
+  }
+  try {
+    const url = new URL(sanitized);
+    if (hasNonAsciiHostname(url.hostname)) {
+      return { error: "Non-ASCII hostnames are not allowed" };
+    }
+    if (isPrivateHost(url)) {
+      return { error: "Private or localhost URLs are not allowed" };
+    }
+    const matched = matchForgeResourceUrl(sanitized, resource, configured);
+    if (!matched) {
+      return {
+        error: resource === "issues" ? "URL must be a GitHub issue URL (https://github.com/owner/repo/issues/N) or a GitLab issue URL (https://<gitlab-host>/owner/repo/-/issues/N)" : "URL must be a GitHub pull request URL (https://github.com/owner/repo/pull/N) or a GitLab merge request URL (https://<gitlab-host>/owner/repo/-/merge_requests/N)"
+      };
+    }
+    return { sanitized };
+  } catch {
+    return { error: "Invalid URL format" };
+  }
+}
+function detectGitRemote(cwd, laneEnv) {
+  try {
+    const result = _internals32.spawnSync(resolveGitExecutable(), ["remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 5000,
+      ...cwd ? { cwd } : {},
+      envOverrides: laneEnv
+    });
+    if (result.status !== 0 || result.error) {
+      return null;
+    }
+    const remoteUrl = (result.stdout ?? "").trim();
+    return remoteUrl || null;
+  } catch {
+    return null;
+  }
+}
+function parseGitRemoteUrl(remoteUrl) {
+  const httpsMatch = remoteUrl.match(/^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/i);
+  if (httpsMatch) {
+    const owner = httpsMatch[1];
+    const repo = httpsMatch[2].replace(/\.git$/, "");
+    if (containsControlCharacters(owner) || containsControlCharacters(repo)) {
+      return null;
+    }
+    return { owner, repo };
+  }
+  const sshMatch = remoteUrl.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/i);
+  if (sshMatch) {
+    const owner = sshMatch[1];
+    const repo = sshMatch[2].replace(/\.git$/, "");
+    if (containsControlCharacters(owner) || containsControlCharacters(repo)) {
+      return null;
+    }
+    return { owner, repo };
+  }
+  const pathMatch = remoteUrl.match(/\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
+  if (pathMatch) {
+    const owner = pathMatch[1];
+    const repo = pathMatch[2].replace(/\.git$/, "");
+    if (containsControlCharacters(owner) || containsControlCharacters(repo)) {
+      return null;
+    }
+    return { owner, repo };
+  }
+  return null;
+}
+
 // src/commands/abort-pr-workflow.ts
 var USAGE2 = [
   "Usage: /swarm abort-pr-workflow [PR_REVIEW|PR_FEEDBACK] [reason...]",
@@ -32327,7 +32490,7 @@ import { createHash as createHash24 } from "crypto";
 import { mkdir as mkdir6, readFile as readFile10, unlink as unlink2 } from "fs/promises";
 import { dirname as dirname15 } from "path";
 var SPEC_DRIFT_RECOVERY_AGENT = "spec-drift-recovery";
-var _internals32 = {
+var _internals33 = {
   appendEvent,
   assertProjectRoot,
   bunWrite,
@@ -32412,21 +32575,21 @@ async function writeWal3(walPath, wal) {
 }
 async function verifySnapshot(snapshotPath, currentSpec) {
   if (!currentSpec) {
-    await _internals32.unlinkIfExists(snapshotPath);
-    const stillExists = await _internals32.readFileText(snapshotPath) !== null;
+    await _internals33.unlinkIfExists(snapshotPath);
+    const stillExists = await _internals33.readFileText(snapshotPath) !== null;
     if (stillExists) {
       throw new Error("spec snapshot verification failed: snapshot still exists after delete");
     }
     return;
   }
   await atomicWriteFile(snapshotPath, currentSpec.content);
-  const written = await _internals32.readFileText(snapshotPath);
+  const written = await _internals33.readFileText(snapshotPath);
   if (written !== currentSpec.content) {
     throw new Error("spec snapshot verification failed: snapshot content does not match effective spec");
   }
 }
 async function ensureSnapshotEvent(directory, plan, transitionId) {
-  const events = await _internals32.readLedgerEvents(directory);
+  const events = await _internals33.readLedgerEvents(directory);
   for (const event of events) {
     const payload = event.payload;
     const approval = payload?.approval;
@@ -32434,17 +32597,17 @@ async function ensureSnapshotEvent(directory, plan, transitionId) {
       return;
     }
   }
-  await _internals32.takeSnapshotEvent(directory, plan, {
+  await _internals33.takeSnapshotEvent(directory, plan, {
     source: "spec_drift_recovery",
     approvalMetadata: { specDriftTransitionId: transitionId }
   });
 }
 async function appendEvent(directory, event) {
-  const existing = await _internals32.verifyEventPresence(directory, event.type, event.transitionId);
+  const existing = await _internals33.verifyEventPresence(directory, event.type, event.transitionId);
   if (existing)
     return;
   appendCoreEventSync(directory, { ...event }, { dedupeOnAuthorityKey: true });
-  const verified = await _internals32.verifyEventPresence(directory, event.type, event.transitionId);
+  const verified = await _internals33.verifyEventPresence(directory, event.type, event.transitionId);
   if (!verified) {
     throw new Error(`spec drift audit verification failed for transition ${event.transitionId}`);
   }
@@ -32466,7 +32629,7 @@ function buildRecoveryEvent(args) {
   if (args.mode === "acknowledge") {
     return {
       type: "spec_drift_acknowledged",
-      timestamp: _internals32.now(),
+      timestamp: _internals33.now(),
       phase: args.phase,
       planTitle: args.planTitle,
       acknowledgedBy: args.actor === "spec_write" ? "unknown" : args.actor,
@@ -32478,7 +32641,7 @@ function buildRecoveryEvent(args) {
   }
   return {
     type: "spec_drift_repaired",
-    timestamp: _internals32.now(),
+    timestamp: _internals33.now(),
     phase: args.phase,
     planTitle: args.planTitle,
     repairedBy: args.actor,
@@ -32489,11 +32652,11 @@ function buildRecoveryEvent(args) {
   };
 }
 async function reconcileSpecDrift(directory, options) {
-  _internals32.assertProjectRoot(directory);
-  const markerPath = _internals32.validateSwarmPath(directory, "spec-staleness.json");
-  const walPath = _internals32.validateSwarmPath(directory, "spec-drift-recovery.json");
-  const snapshotPath = _internals32.validateSwarmPath(directory, "spec-snapshot.md");
-  const markerMaybe = await _internals32.readFileText(markerPath);
+  _internals33.assertProjectRoot(directory);
+  const markerPath = _internals33.validateSwarmPath(directory, "spec-staleness.json");
+  const walPath = _internals33.validateSwarmPath(directory, "spec-drift-recovery.json");
+  const snapshotPath = _internals33.validateSwarmPath(directory, "spec-snapshot.md");
+  const markerMaybe = await _internals33.readFileText(markerPath);
   if (markerMaybe === null) {
     return {
       status: "no_marker",
@@ -32501,7 +32664,7 @@ async function reconcileSpecDrift(directory, options) {
       message: "No spec drift detected."
     };
   }
-  const specLockResult = options.specLockAlreadyHeld ? null : await _internals32.tryAcquireLock(directory, "spec.md", SPEC_DRIFT_RECOVERY_AGENT, `spec-${options.mode}-${Date.now()}`);
+  const specLockResult = options.specLockAlreadyHeld ? null : await _internals33.tryAcquireLock(directory, "spec.md", SPEC_DRIFT_RECOVERY_AGENT, `spec-${options.mode}-${Date.now()}`);
   if (specLockResult && !specLockResult.acquired) {
     return {
       status: "retry_later",
@@ -32511,7 +32674,7 @@ async function reconcileSpecDrift(directory, options) {
   }
   let lockResult;
   try {
-    lockResult = await _internals32.tryAcquireLock(directory, "plan.json", SPEC_DRIFT_RECOVERY_AGENT, `${options.mode}-${Date.now()}`);
+    lockResult = await _internals33.tryAcquireLock(directory, "plan.json", SPEC_DRIFT_RECOVERY_AGENT, `${options.mode}-${Date.now()}`);
   } catch (error2) {
     if (specLockResult?.acquired && specLockResult.lock._release) {
       await specLockResult.lock._release().catch(() => {});
@@ -32537,7 +32700,7 @@ async function reconcileSpecDrift(directory, options) {
   let errorNewHash;
   try {
     try {
-      const authoritativeMarkerRaw = await _internals32.readFileText(markerPath);
+      const authoritativeMarkerRaw = await _internals33.readFileText(markerPath);
       if (authoritativeMarkerRaw === null) {
         return {
           status: "no_marker",
@@ -32545,14 +32708,14 @@ async function reconcileSpecDrift(directory, options) {
           message: "No spec drift detected."
         };
       }
-      const marker = _internals32.parseMarker(authoritativeMarkerRaw);
+      const marker = _internals33.parseMarker(authoritativeMarkerRaw);
       if (!marker) {
         return buildCorruptMarkerResult(options.mode);
       }
       errorMarker = marker;
       const markerHash = sha2563(authoritativeMarkerRaw);
-      const existingWalRaw = await _internals32.readFileText(walPath);
-      const existingWal = existingWalRaw === null ? null : _internals32.parseWal(existingWalRaw);
+      const existingWalRaw = await _internals33.readFileText(walPath);
+      const existingWal = existingWalRaw === null ? null : _internals33.parseWal(existingWalRaw);
       if (existingWalRaw !== null && !existingWal) {
         return {
           status: "failed",
@@ -32562,7 +32725,7 @@ async function reconcileSpecDrift(directory, options) {
           planTitle: marker.planTitle
         };
       }
-      const currentSpec = _internals32.readEffectiveSpecSync(directory);
+      const currentSpec = _internals33.readEffectiveSpecSync(directory);
       const proposedNewHash = currentSpec?.hash ?? null;
       const proposedTransitionId = buildTransitionId(options.mode, markerHash, marker.specHash_plan, proposedNewHash);
       const proposedWal = {
@@ -32577,7 +32740,7 @@ async function reconcileSpecDrift(directory, options) {
         newHash: proposedNewHash,
         specContent: currentSpec?.content ?? null,
         actor: options.actor,
-        recordedAt: _internals32.now()
+        recordedAt: _internals33.now()
       };
       const markerReplacedDuringPrepared = existingWal?.state === "PREPARED" && existingWal.markerHash !== markerHash;
       const wal = existingWal?.state === "PREPARED" || existingWal?.markerHash === markerHash ? existingWal : proposedWal;
@@ -32586,12 +32749,12 @@ async function reconcileSpecDrift(directory, options) {
       errorTransitionId = transitionId;
       errorNewHash = newHash;
       if (wal === proposedWal) {
-        await _internals32.writeWal(walPath, wal);
+        await _internals33.writeWal(walPath, wal);
       }
       if (wal.newHash === null !== (wal.specContent === null) || wal.specContent !== null && sha2563(wal.specContent) !== wal.newHash) {
         throw new Error(`Spec drift recovery WAL ${transitionId} has inconsistent captured spec content`);
       }
-      let plan = await _internals32.loadPlanJsonOnly(directory);
+      let plan = await _internals33.loadPlanJsonOnly(directory);
       if (!plan) {
         return {
           status: "failed",
@@ -32622,13 +32785,13 @@ async function reconcileSpecDrift(directory, options) {
         }
         if (planMatchesOld) {
           plan.specHash = newHash ?? undefined;
-          await _internals32.savePlan(directory, plan, {
+          await _internals33.savePlan(directory, plan, {
             planLockAlreadyHeld: true
           });
-          plan = await _internals32.loadPlanJsonOnly(directory) ?? plan;
+          plan = await _internals33.loadPlanJsonOnly(directory) ?? plan;
         }
-        await _internals32.ensureSnapshotEvent(directory, plan, transitionId);
-        await _internals32.verifySnapshot(snapshotPath, wal.specContent === null ? null : { content: wal.specContent });
+        await _internals33.ensureSnapshotEvent(directory, plan, transitionId);
+        await _internals33.verifySnapshot(snapshotPath, wal.specContent === null ? null : { content: wal.specContent });
         const event = buildRecoveryEvent({
           mode: wal.mode,
           actor: wal.actor,
@@ -32639,15 +32802,15 @@ async function reconcileSpecDrift(directory, options) {
           previousHash: wal.previousHash,
           transitionId
         });
-        await _internals32.appendEvent(directory, event);
-        await _internals32.writeWal(walPath, { ...wal, state: "COMMITTED" });
+        await _internals33.appendEvent(directory, event);
+        await _internals33.writeWal(walPath, { ...wal, state: "COMMITTED" });
       }
       if (markerReplacedDuringPrepared) {
         const preservedMarker = {
           ...marker,
           specHash_plan: newHash,
           reason: `prior prepared drift recovery committed before this marker: ${marker.reason}`,
-          timestamp: _internals32.now()
+          timestamp: _internals33.now()
         };
         await atomicWriteFile(markerPath, `${JSON.stringify(preservedMarker, null, 2)}
 `);
@@ -32662,7 +32825,7 @@ async function reconcileSpecDrift(directory, options) {
           transitionId
         };
       }
-      const latestSpec = _internals32.readEffectiveSpecSync(directory);
+      const latestSpec = _internals33.readEffectiveSpecSync(directory);
       if ((latestSpec?.hash ?? null) !== newHash) {
         const refreshedMarker = {
           planTitle: wal.planTitle,
@@ -32670,7 +32833,7 @@ async function reconcileSpecDrift(directory, options) {
           specHash_plan: newHash,
           specHash_current: latestSpec?.hash ?? null,
           reason: "spec changed while drift recovery was committing",
-          timestamp: _internals32.now()
+          timestamp: _internals33.now()
         };
         await atomicWriteFile(markerPath, `${JSON.stringify(refreshedMarker, null, 2)}
 `);
@@ -32686,8 +32849,8 @@ async function reconcileSpecDrift(directory, options) {
         };
       }
       try {
-        await _internals32.unlinkIfExists(markerPath);
-        _internals32.invalidateCachedArtifact(markerPath);
+        await _internals33.unlinkIfExists(markerPath);
+        _internals33.invalidateCachedArtifact(markerPath);
       } catch (error2) {
         return {
           status: "cleanup_pending",
@@ -33184,7 +33347,7 @@ ${USAGE4}`;
 
 // src/commands/archive.ts
 init_loader();
-var _internals33 = {
+var _internals34 = {
   now: () => new Date
 };
 function artifactLabel(artifact) {
@@ -33240,7 +33403,7 @@ async function handleArchiveCommand(directory, args) {
   const report = await archiveEvidence(directory, maxAgeDays, maxBundles, {
     report: true,
     dryRun,
-    now: _internals33.now(),
+    now: _internals34.now(),
     cacheMaxBytes,
     cacheMaxRecords
   });
@@ -35207,7 +35370,7 @@ function createShadowCopy(directory, maxBytes = MAX_SHADOW_COPY_BYTES) {
       const rel = path33.relative(directory, src);
       const dest = path33.join(shadowRoot, rel);
       fs21.mkdirSync(path33.dirname(dest), { recursive: true });
-      const copied = _internals34.copyFileBounded(src, dest, maxBytes - copiedBytes);
+      const copied = _internals35.copyFileBounded(src, dest, maxBytes - copiedBytes);
       if (copied === null) {
         removeShadowRoot(shadowRoot);
         return null;
@@ -35220,7 +35383,7 @@ function createShadowCopy(directory, maxBytes = MAX_SHADOW_COPY_BYTES) {
     throw error2;
   }
 }
-var _internals34 = {
+var _internals35 = {
   computeEvidenceQualitySummary,
   copyFileBounded,
   createShadowCopy
@@ -35467,7 +35630,7 @@ async function evaluateAdvisoryCi(options) {
         });
       }
     }
-    const summary = await _internals34.computeEvidenceQualitySummary(directory);
+    const summary = await _internals35.computeEvidenceQualitySummary(directory);
     const q = summary.qualityMetrics;
     const qualityRows = [
       [
@@ -35861,7 +36024,7 @@ async function handleCiCommand(ctx) {
   const signals = createSignalCancellation(controller);
   signals.install();
   try {
-    const result = await _internals35.runAdvisoryCiRuntime({
+    const result = await _internals36.runAdvisoryCiRuntime({
       directory: ctx.directory,
       deadlineMs,
       signal: controller.signal,
@@ -35910,134 +36073,10 @@ async function handleCiCommand(ctx) {
     signals.dispose();
   }
 }
-var _internals35 = { runAdvisoryCiRuntime };
+var _internals36 = { runAdvisoryCiRuntime };
 
 // src/commands/pr-ref.ts
 init_loader();
-
-// src/commands/_shared/url-security.ts
-import * as child_process from "child_process";
-init_git_executable();
-var MAX_URL_LEN = 2048;
-var _internals36 = {
-  spawnSync: (cmd, args, options) => {
-    const mergedEnv = mergeEnvForChild(options?.env, options?.envOverrides);
-    return child_process.spawnSync(cmd, args, {
-      ...options,
-      env: mergedEnv
-    });
-  }
-};
-function sanitizeUrl(raw) {
-  let urlStr = raw.trim();
-  urlStr = urlStr.replace(/^([A-Za-z][A-Za-z0-9+.-]*:\/\/)\/?[^@/]+@/, "$1");
-  urlStr = urlStr.replace(/\[\s*MODE\s*:[^\]]*\]/gi, "");
-  urlStr = urlStr.replace(/^([A-Za-z][A-Za-z0-9+.-]*:\/\/)\/?[^@/]+@/, "$1");
-  const fragmentIdx = urlStr.indexOf("#");
-  if (fragmentIdx !== -1) {
-    urlStr = urlStr.slice(0, fragmentIdx);
-  }
-  const queryIdx = urlStr.indexOf("?");
-  if (queryIdx !== -1) {
-    urlStr = urlStr.slice(0, queryIdx);
-  }
-  if (urlStr.length > MAX_URL_LEN) {
-    urlStr = urlStr.slice(0, MAX_URL_LEN);
-  }
-  return urlStr.trim();
-}
-function sanitizeErrorEcho(raw, maxLength = 80) {
-  let stripped = "";
-  for (const ch of raw) {
-    const cp = ch.codePointAt(0);
-    if (cp !== undefined && (cp <= 31 || cp === 127)) {
-      stripped += " ";
-      continue;
-    }
-    stripped += ch;
-  }
-  const collapsed = stripped.replace(/\s+/g, " ").trim();
-  if (collapsed.length <= maxLength)
-    return collapsed;
-  return `${collapsed.slice(0, maxLength)}\u2026`;
-}
-function validateAndSanitizeGithubUrl(rawUrl, resource, configured) {
-  const sanitized = sanitizeUrl(rawUrl);
-  if (!sanitized) {
-    return { error: "Empty URL" };
-  }
-  if (!sanitized.startsWith("https://")) {
-    return { error: "URL must use HTTPS scheme" };
-  }
-  try {
-    const url = new URL(sanitized);
-    if (hasNonAsciiHostname(url.hostname)) {
-      return { error: "Non-ASCII hostnames are not allowed" };
-    }
-    if (isPrivateHost(url)) {
-      return { error: "Private or localhost URLs are not allowed" };
-    }
-    const matched = matchForgeResourceUrl(sanitized, resource, configured);
-    if (!matched) {
-      return {
-        error: resource === "issues" ? "URL must be a GitHub issue URL (https://github.com/owner/repo/issues/N) or a GitLab issue URL (https://<gitlab-host>/owner/repo/-/issues/N)" : "URL must be a GitHub pull request URL (https://github.com/owner/repo/pull/N) or a GitLab merge request URL (https://<gitlab-host>/owner/repo/-/merge_requests/N)"
-      };
-    }
-    return { sanitized };
-  } catch {
-    return { error: "Invalid URL format" };
-  }
-}
-function detectGitRemote(cwd, laneEnv) {
-  try {
-    const result = _internals36.spawnSync(resolveGitExecutable(), ["remote", "get-url", "origin"], {
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: 5000,
-      ...cwd ? { cwd } : {},
-      envOverrides: laneEnv
-    });
-    if (result.status !== 0 || result.error) {
-      return null;
-    }
-    const remoteUrl = (result.stdout ?? "").trim();
-    return remoteUrl || null;
-  } catch {
-    return null;
-  }
-}
-function parseGitRemoteUrl(remoteUrl) {
-  const httpsMatch = remoteUrl.match(/^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/i);
-  if (httpsMatch) {
-    const owner = httpsMatch[1];
-    const repo = httpsMatch[2].replace(/\.git$/, "");
-    if (containsControlCharacters(owner) || containsControlCharacters(repo)) {
-      return null;
-    }
-    return { owner, repo };
-  }
-  const sshMatch = remoteUrl.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/i);
-  if (sshMatch) {
-    const owner = sshMatch[1];
-    const repo = sshMatch[2].replace(/\.git$/, "");
-    if (containsControlCharacters(owner) || containsControlCharacters(repo)) {
-      return null;
-    }
-    return { owner, repo };
-  }
-  const pathMatch = remoteUrl.match(/\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
-  if (pathMatch) {
-    const owner = pathMatch[1];
-    const repo = pathMatch[2].replace(/\.git$/, "");
-    if (containsControlCharacters(owner) || containsControlCharacters(repo)) {
-      return null;
-    }
-    return { owner, repo };
-  }
-  return null;
-}
-
-// src/commands/pr-ref.ts
 var MAX_INSTRUCTIONS_LEN = 1000;
 var GITHUB_CONTEXT = {
   provider: "github",
@@ -40455,9 +40494,9 @@ function hashContent(content) {
   return createHash27("sha1").update(content).digest("hex");
 }
 async function loadConfigForPolicyCurator(directory) {
-  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-yvhamv41.js");
+  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-g377jsvv.js");
   try {
-    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-fa014mra.js");
+    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-xkxt1b08.js");
     const { config: loadedConfig } = loadPluginConfigWithMeta2(directory);
     return KnowledgeConfigSchema2.parse(loadedConfig.knowledge ?? {});
   } catch {
@@ -43515,7 +43554,7 @@ async function resolveCuratorLLMDelegate(directory, mode, sessionId) {
   const seam = _internals38.createCuratorLLMDelegate;
   if (seam)
     return seam(directory, mode, sessionId);
-  const { createCuratorLLMDelegate } = await import("./curator-llm-factory-hkk29g2y.js");
+  const { createCuratorLLMDelegate } = await import("./curator-llm-factory-29cswvhr.js");
   return createCuratorLLMDelegate(directory, mode, sessionId);
 }
 async function reconcileCloseTerminalStateForPlan(directory, targetPlan, options) {
@@ -43910,7 +43949,7 @@ async function runFinalizeStage(ctx) {
     }
   }
   try {
-    const { CuratorConfigSchema: CCS } = await import("./schema-yvhamv41.js");
+    const { CuratorConfigSchema: CCS } = await import("./schema-g377jsvv.js");
     const { config: pmLoadedConfig } = _internals38.loadPluginConfigWithMeta(ctx.directory);
     const curatorCfg = CCS.parse(pmLoadedConfig.curator ?? {});
     if (curatorCfg.enabled && curatorCfg.postmortem_enabled) {
@@ -46096,7 +46135,7 @@ function serializeAgentSession(s) {
 }
 async function writeSnapshot(directory, state) {
   try {
-    const { ensureSnapshotCoordinationReady } = await import("./snapshot-coordination-init-xqxek8kn.js");
+    const { ensureSnapshotCoordinationReady } = await import("./snapshot-coordination-init-k1f93806.js");
     await ensureSnapshotCoordinationReady(directory);
     const snapshot = {
       version: 3,
@@ -49274,7 +49313,7 @@ function planMerges(active, threshold, maxComparisons, maxMerges) {
   };
 }
 async function sweepActiveNearDuplicates(directory, options = {}) {
-  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-fa014mra.js");
+  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-xkxt1b08.js");
   const { config } = loadPluginConfigWithMeta2(directory);
   const sweepConfig = config.learning?.dedup_sweep;
   if (sweepConfig?.enabled === false)
@@ -50155,14 +50194,14 @@ async function runCuratorInit(directory, config, llmDelegate) {
     }));
     if (llmDelegate) {
       try {
-        const userInput = [
+        const userInput = sanitizeContextText([
           "TASK: CURATOR_INIT",
           `PRIOR_SUMMARY: ${priorSummary ? JSON.stringify(priorSummary) : "none"}`,
           `KNOWLEDGE_ENTRIES: ${JSON.stringify(allEntriesForCurator)}`,
-          `PROJECT_CONTEXT: ${contextMd?.slice(0, config.max_summary_tokens * 2) ?? "none"}`,
-          `POST_MORTEM_DIGEST: ${latestPostMortemDigest ?? "none"}`
+          `PROJECT_CONTEXT: ${sanitizeContextText(contextMd?.slice(0, config.max_summary_tokens * 2) ?? "none")}`,
+          `POST_MORTEM_DIGEST: ${sanitizeContextText(latestPostMortemDigest ?? "none")}`
         ].join(`
-`);
+`));
         const systemPrompt = CURATOR_INIT_PROMPT;
         const timeoutMs = config.llm_timeout_ms ?? DEFAULT_CURATOR_LLM_TIMEOUT_MS;
         const ac = new AbortController;
@@ -50256,7 +50295,7 @@ async function runCuratorPhase(directory, phase, agentsDispatched, config, knowl
     const phaseData = plan?.phases.find((p) => p.id === phase);
     const tasksCompleted = phaseData ? phaseData.tasks.filter((t) => t.status === "completed").length : 0;
     const tasksTotal = phaseData ? phaseData.tasks.length : 0;
-    const keyDecisions = contextMd ? extractContextDecisions(contextMd).map((decision) => decision.raw.trim().slice(2)) : [];
+    const keyDecisions = contextMd ? extractContextDecisions(contextMd).map((decision) => sanitizeContextText(decision.raw.trim().slice(2))) : [];
     const phaseDigest = {
       phase,
       timestamp: new Date().toISOString(),
@@ -50287,16 +50326,16 @@ async function runCuratorPhase(directory, phase, agentsDispatched, config, knowl
       try {
         const priorDigest = priorSummary?.digest ?? "none";
         const systemPrompt = CURATOR_PHASE_PROMPT;
-        const userInput = [
+        const userInput = sanitizeContextText([
           `TASK: CURATOR_PHASE ${phase}`,
-          `PRIOR_DIGEST: ${priorDigest}`,
+          `PRIOR_DIGEST: ${sanitizeContextText(priorDigest)}`,
           `PHASE_EVENTS: ${JSON.stringify(phaseEvents.slice(0, 50))}`,
           `PHASE_DECISIONS: ${JSON.stringify(keyDecisions)}`,
           `AGENTS_DISPATCHED: ${JSON.stringify(agentsDispatched)}`,
           `AGENTS_EXPECTED: ["reviewer", "test_engineer"]`,
           `KNOWLEDGE_ENTRIES: ${JSON.stringify(knowledgeForCurator)}`
         ].join(`
-`);
+`));
         const timeoutMs = config.llm_timeout_ms ?? DEFAULT_CURATOR_LLM_TIMEOUT_MS;
         const ac = new AbortController;
         const timer = setTimeout(() => ac.abort(), timeoutMs);
@@ -50398,7 +50437,7 @@ async function runCuratorPhase(directory, phase, agentsDispatched, config, knowl
     }
     if (config.skill_generation_enabled === true && skillCandidates.length > 0) {
       try {
-        const skillModule = await import("./skill-generator-fzvp9m8z.js");
+        const skillModule = await import("./skill-generator-k3hnf8xx.js");
         for (const cand of skillCandidates) {
           if (cand.confidence < (config.min_skill_confidence ?? DEFAULT_SKILL_MIN_CONFIDENCE)) {
             continue;
@@ -50870,7 +50909,7 @@ async function applyCuratorKnowledgeUpdates(directory, recommendations, knowledg
     } catch {}
   }
   if (contradictedEntries.length > 0 && knowledgeConfig.contradiction_threshold_action === "quarantine") {
-    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-30bb9fyg.js");
+    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-gajaew60.js");
     for (const { id } of contradictedEntries) {
       try {
         await maybeQuarantineOnContradiction(directory, id, knowledgeConfig.contradiction_quarantine_threshold, knowledgeConfig.contradiction_quarantine_window_days);
@@ -51383,9 +51422,9 @@ async function repairPostMortemActions(llmOutput, diagnostics, options) {
       "Allowed queue_triage action values: apply, reject.",
       "Do not include unsupported actions such as merge.",
       "Diagnostics:",
-      diagnostics.join("; "),
+      diagnostics.map((d) => sanitizeContextText(d)).join("; "),
       "Original output:",
-      llmOutput.slice(0, 8000)
+      sanitizeContextText(llmOutput).slice(0, 8000)
     ].join(`
 `);
     const repaired = await options.llmDelegate("", repairPrompt, ac.signal);
@@ -51601,8 +51640,8 @@ function assembleLLMInput(planId, scope, sessionID, planSummary, knowledgeSummar
   const sections = [];
   sections.push(`TASK: CURATOR_POSTMORTEM ${planId}`);
   sections.push(`SCOPE: ${scope}${sessionID ? ` (${sessionID})` : ""}`);
-  sections.push(`PLAN_SUMMARY: ${planSummary}`);
-  sections.push(`CURATOR_DIGESTS: ${curatorDigest ?? "none"}`);
+  sections.push(`PLAN_SUMMARY: ${sanitizeContextText(planSummary)}`);
+  sections.push(`CURATOR_DIGESTS: ${sanitizeContextText(curatorDigest ?? "none")}`);
   const eventsSummary = knowledgeSummary.map((e) => `${e.id}: applied=${e.applied} violated=${e.violated} ignored=${e.ignored} unacknowledged=${e.unacknowledged} confidence=${e.confidence.toFixed(2)} status=${e.status}`).join(`
 `);
   sections.push(`KNOWLEDGE_EVENTS_SUMMARY:
@@ -51633,9 +51672,9 @@ ${retroText}`);
     sections.push(`DRIFT_REPORTS:
 ${driftText}`);
   }
-  return sections.join(`
+  return sanitizeContextText(sections.join(`
 
-`);
+`));
 }
 async function runCuratorPostMortem(directory, options = {}) {
   const warnings = [];
@@ -51702,7 +51741,7 @@ async function runCuratorPostMortem(directory, options = {}) {
       warnings.push("Failed to collect knowledge summary.");
     }
     try {
-      const { getScanStatus } = await import("./scan-cursor-1m6dj2s2.js");
+      const { getScanStatus } = await import("./scan-cursor-y9rchz83.js");
       const scanStatus = await getScanStatus(directory);
       if (scanStatus.remaining_estimate > 0) {
         warnings.push(`Fair scan: reviewed ${knowledgeSummary.length} entries this sweep (generation ${scanStatus.generation}); ${scanStatus.remaining_estimate} more eligible entries will be visited in future curation sweeps.`);
@@ -51874,9 +51913,9 @@ var _internals57 = {
   verifyPostMortemKnowledgeActions,
   repairPostMortemActions,
   loadDefaultKnowledgeConfig: async (directory) => {
-    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-yvhamv41.js");
+    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-g377jsvv.js");
     try {
-      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-fa014mra.js");
+      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-xkxt1b08.js");
       const loaded = loadPluginConfigWithMeta2(directory);
       return KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
     } catch {
@@ -51884,11 +51923,11 @@ var _internals57 = {
     }
   },
   applyCuratorKnowledgeUpdates: async (directory, recommendations, knowledgeConfig, generation) => {
-    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-5k3mktpe.js");
+    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-h7j1xse4.js");
     return applyCuratorKnowledgeUpdates2(directory, recommendations, knowledgeConfig, generation);
   },
   checkHivePromotions: async (entries2, knowledgeConfig, directory) => {
-    const { checkHivePromotions } = await import("./hive-promoter-400xzdds.js");
+    const { checkHivePromotions } = await import("./hive-promoter-632ewk29.js");
     return checkHivePromotions(entries2, knowledgeConfig, directory);
   },
   applyProposalTriage: async (directory, triage) => {
@@ -51897,7 +51936,7 @@ var _internals57 = {
       activateProposal,
       listSkills: listSkills2,
       sanitizeSlug
-    } = await import("./skill-generator-fzvp9m8z.js");
+    } = await import("./skill-generator-k3hnf8xx.js");
     const result = {
       approved: [],
       rejected: [],
@@ -51939,7 +51978,7 @@ var _internals57 = {
     return result;
   },
   readPriorDriftReports: async (directory) => {
-    const { readPriorDriftReports: readPriorDriftReports2 } = await import("./curator-drift-dt4g79a4.js");
+    const { readPriorDriftReports: readPriorDriftReports2 } = await import("./curator-drift-t150w08d.js");
     return readPriorDriftReports2(directory);
   },
   readSwarmKnowledge: (directory) => readKnowledge(resolveSwarmKnowledgePath(directory))
@@ -61735,9 +61774,9 @@ var _internals67 = {
   loadPluginConfigWithMeta,
   loadCuratorDeps: async () => {
     const [{ CuratorConfigSchema }, curator, { createCuratorLLMDelegate }] = await Promise.all([
-      import("./schema-yvhamv41.js"),
-      import("./curator-5k3mktpe.js"),
-      import("./curator-llm-factory-hkk29g2y.js")
+      import("./schema-g377jsvv.js"),
+      import("./curator-h7j1xse4.js"),
+      import("./curator-llm-factory-29cswvhr.js")
     ]);
     return { CuratorConfigSchema, curator, createCuratorLLMDelegate };
   }
@@ -64130,7 +64169,7 @@ async function computeCurationDiagnostics(directory, entries2) {
   let scanCompleted = false;
   let scanRemaining = 0;
   try {
-    const { getScanStatus } = await import("./scan-cursor-1m6dj2s2.js");
+    const { getScanStatus } = await import("./scan-cursor-y9rchz83.js");
     const status = await getScanStatus(directory);
     scanGeneration = status.generation;
     scanCompleted = status.completed;
@@ -64138,19 +64177,19 @@ async function computeCurationDiagnostics(directory, entries2) {
   } catch {}
   let configMatch = null;
   try {
-    const { isLinked: isLinked2 } = await import("./knowledge-link-dv78fb9g.js");
+    const { isLinked: isLinked2 } = await import("./knowledge-link-jnnk0nmk.js");
     if (isLinked2(directory)) {
-      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-yvhamv41.js");
+      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-g377jsvv.js");
       let config;
       try {
-        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-fa014mra.js");
+        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-xkxt1b08.js");
         const loaded = loadPluginConfigWithMeta2(directory);
         config = KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
       } catch {
         config = KnowledgeConfigSchema2.parse({});
       }
       const { cohortConfigFingerprint: cohortConfigFingerprint2 } = await import("./config-fingerprint-v22xh5a2.js");
-      const { buildConfigFingerprintInput: buildConfigFingerprintInput2, readCohortConfigFingerprint } = await import("./curation-policy-ytzwb080.js");
+      const { buildConfigFingerprintInput: buildConfigFingerprintInput2, readCohortConfigFingerprint } = await import("./curation-policy-pxwagyh7.js");
       const currentFp = cohortConfigFingerprint2(buildConfigFingerprintInput2(config));
       const cohortFp = await readCohortConfigFingerprint(directory);
       configMatch = cohortFp === null ? null : currentFp === cohortFp;
@@ -65598,7 +65637,7 @@ async function handleDoctorCommand(directory, args) {
   const result = runConfigDoctor(config, directory);
   let output;
   if (enableAutoFix && result.hasAutoFixableIssues) {
-    const { runConfigDoctorWithFixes } = await import("./config-doctor-3b99vx74.js");
+    const { runConfigDoctorWithFixes } = await import("./config-doctor-mj4ae4jn.js");
     const fixResult = await runConfigDoctorWithFixes(directory, config, true, {
       applyLossy: true
     });
@@ -65636,7 +65675,7 @@ async function handleDoctorCommand(directory, args) {
 `;
   }
   try {
-    const { runModelPreflight } = await import("./model-preflight-g7b12yn2.js");
+    const { runModelPreflight } = await import("./model-preflight-z9p55ssn.js");
     const preflight = await runModelPreflight(config, swarmState.opencodeClient, { generatedAgentNames: swarmState.generatedAgentNames });
     const missingSelection = preflight.resolutions.filter((resolution) => resolution.status === "missing-selection");
     const unresolved = preflight.catalogAvailable ? preflight.resolutions.filter((resolution) => resolution.status === "unresolved") : [];
@@ -66563,7 +66602,7 @@ async function handleEvidenceCommand(directory, args) {
   return formatTaskEvidenceMarkdown(evidenceData);
 }
 async function handleEvidenceSummaryCommand(directory) {
-  const { buildEvidenceSummary } = await import("./evidence-summary-service-8e2fghz0.js");
+  const { buildEvidenceSummary } = await import("./evidence-summary-service-h42y6hwq.js");
   const artifact = await buildEvidenceSummary(directory);
   if (!artifact) {
     return "No plan found. Run `/swarm plan` to check plan status.";
@@ -90896,7 +90935,7 @@ function createCuratorLLMDelegate(directory, mode = "init", sessionId) {
     }
     const sdkOpts = signal ? { signal } : {};
     try {
-      const { getSwarmAgents: getSwarmAgents2, resolveFallbackModel: resolveFallbackModel2 } = await import("./index-rtznwf0g.js");
+      const { getSwarmAgents: getSwarmAgents2, resolveFallbackModel: resolveFallbackModel2 } = await import("./index-hw8w4mkh.js");
       const createResult = await client.session.create({
         ...sessionId ? {
           body: {
@@ -91188,8 +91227,8 @@ init_zod();
 init_loader();
 import { createHash as createHash51, randomUUID as randomUUID22 } from "crypto";
 import * as fsSync9 from "fs";
-import * as fs63 from "fs/promises";
-import * as path127 from "path";
+import * as fs64 from "fs/promises";
+import * as path128 from "path";
 init_logger();
 
 // src/background/pr-feedback-event-queue.ts
@@ -92154,6 +92193,228 @@ var _internals98 = {
 
 // src/git/pr.ts
 init_git_executable();
+
+// src/utils/glab-executable.ts
+init_warning_buffer();
+import { spawnSync as spawnSync5 } from "child_process";
+import * as fs63 from "fs";
+import * as os14 from "os";
+import * as path127 from "path";
+var GLAB_BINARY_ENV_VAR = "OPENCODE_SWARM_GLAB_BINARY";
+var PER_PROBE_TIMEOUT_MS2 = 250;
+var TOTAL_BUDGET_MS3 = 1000;
+var NEGATIVE_CACHE_TTL_MS2 = 60000;
+var BARE_GLAB = "glab";
+var PROBE_MAX_BUFFER_BYTES2 = 64 * 1024;
+var PROBE_OUTPUT_EXCERPT_CHARS2 = 60;
+var WINDOWS_PATH_EXTENSIONS2 = [".exe", ".cmd", ".bat"];
+var GLAB_VERSION_PATTERN = /^glab version \d+\.\d+/;
+function excerptProbeOutput2(raw) {
+  return raw.slice(0, PROBE_OUTPUT_EXCERPT_CHARS2).replace(/[^\x20-\x7E]/g, " ").trim();
+}
+var cache3 = null;
+var lastAttempts2 = [];
+var cacheGeneration2 = 0;
+function windowsGlabAbsoluteCandidates(env) {
+  const candidates = [];
+  const push = (...parts) => {
+    const candidate2 = path127.join(...parts);
+    if (!candidates.includes(candidate2))
+      candidates.push(candidate2);
+  };
+  if (env.ProgramFiles) {
+    push(env.ProgramFiles, "GitLab CLI", "glab.exe");
+  }
+  if (env["ProgramFiles(x86)"]) {
+    push(env["ProgramFiles(x86)"], "GitLab CLI", "glab.exe");
+  }
+  if (env.LOCALAPPDATA) {
+    push(env.LOCALAPPDATA, "GitLab CLI", "glab.exe");
+    push(env.LOCALAPPDATA, "Programs", "GitLab CLI", "glab.exe");
+  }
+  return candidates;
+}
+function platformCandidates2(platform, env) {
+  if (platform === "win32") {
+    return windowsGlabAbsoluteCandidates(env);
+  }
+  if (platform === "darwin") {
+    return ["/opt/homebrew/bin/glab", "/usr/local/bin/glab", "/usr/bin/glab"];
+  }
+  return ["/usr/bin/glab", "/usr/local/bin/glab", "/bin/glab"];
+}
+function isAbsoluteForPlatform2(candidate2, platform) {
+  return platform === "win32" ? path127.win32.isAbsolute(candidate2) : path127.posix.isAbsolute(candidate2);
+}
+function joinDirAndName2(dir, name, platform) {
+  const sep22 = platform === "win32" ? "\\" : "/";
+  const trimmed = dir.replace(/[\\/]+$/, "");
+  return trimmed ? `${trimmed}${sep22}${name}` : `${sep22}${name}`;
+}
+function pathCandidates2(platform) {
+  const pathValue = _internals99.env().PATH ?? "";
+  if (!pathValue)
+    return [];
+  const dirs = pathValue.split(platform === "win32" ? ";" : ":").filter(Boolean);
+  const names = platform === "win32" ? [...WINDOWS_PATH_EXTENSIONS2.map((ext) => `glab${ext}`), "glab"] : ["glab"];
+  const out = [];
+  for (const dir of dirs) {
+    for (const name of names) {
+      const candidate2 = joinDirAndName2(dir, name, platform);
+      if (!out.includes(candidate2))
+        out.push(candidate2);
+    }
+  }
+  return out;
+}
+function envOverride2() {
+  const raw = _internals99.env()[GLAB_BINARY_ENV_VAR];
+  return raw && raw.trim() !== "" ? raw : undefined;
+}
+function buildCandidates2(platform) {
+  const override = envOverride2();
+  const overrideCandidate = override ? [{ source: "override", path: override }] : [];
+  const seen = new Set(overrideCandidate.map((c) => c.path));
+  const rest = [];
+  for (const p of platformCandidates2(platform, _internals99.env())) {
+    if (seen.has(p))
+      continue;
+    seen.add(p);
+    rest.push({ source: "platform", path: p });
+  }
+  for (const p of pathCandidates2(platform)) {
+    if (seen.has(p))
+      continue;
+    seen.add(p);
+    rest.push({ source: "path", path: p });
+  }
+  return [...overrideCandidate, ...rest];
+}
+function probeCandidate2(candidatePath2, platform) {
+  if (!isAbsoluteForPlatform2(candidatePath2, platform)) {
+    return { accepted: false, reason: "not an absolute path" };
+  }
+  let stat13;
+  try {
+    stat13 = fs63.statSync(candidatePath2);
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOENT")
+      return { accepted: false, reason: "no such file" };
+    return {
+      accepted: false,
+      reason: `cannot stat (${code ?? "unknown error"})`
+    };
+  }
+  if (stat13.isDirectory()) {
+    return { accepted: false, reason: "is a directory" };
+  }
+  if (!stat13.isFile()) {
+    return { accepted: false, reason: "not a regular file" };
+  }
+  let result;
+  try {
+    result = _internals99.spawnSync(candidatePath2, ["--version"], {
+      cwd: os14.tmpdir(),
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true,
+      timeout: PER_PROBE_TIMEOUT_MS2,
+      maxBuffer: PROBE_MAX_BUFFER_BYTES2
+    });
+  } catch (err) {
+    return {
+      accepted: false,
+      reason: `spawn threw: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (result.error) {
+    return { accepted: false, reason: `spawn failed: ${result.error.message}` };
+  }
+  if (result.status !== 0) {
+    const statusDescription = result.status !== null ? `exit ${result.status}` : `signal ${result.signal ?? "unknown"}`;
+    return {
+      accepted: false,
+      reason: `glab --version returned ${statusDescription}`
+    };
+  }
+  const versionOutput = (result.stdout ?? "").toString().trim();
+  if (!GLAB_VERSION_PATTERN.test(versionOutput)) {
+    const excerpt = excerptProbeOutput2(versionOutput);
+    return {
+      accepted: false,
+      reason: excerpt ? `not glab: --version printed "${excerpt}"` : "not glab: --version printed nothing"
+    };
+  }
+  return { accepted: true };
+}
+function probeCycle2(candidates, platform, attempts) {
+  const start = _internals99.now();
+  let budgetExceeded = false;
+  for (const candidate2 of candidates) {
+    if (_internals99.now() - start > TOTAL_BUDGET_MS3) {
+      budgetExceeded = true;
+      break;
+    }
+    const result = probeCandidate2(candidate2.path, platform);
+    attempts.push({
+      source: candidate2.source,
+      candidate: candidate2.path,
+      accepted: result.accepted,
+      reason: result.accepted ? undefined : result.reason
+    });
+    if (candidate2.source === "override" && !result.accepted) {
+      advisoryWarn(`[opencode-swarm] ${GLAB_BINARY_ENV_VAR} override "${candidate2.path}" is unusable (${result.reason}); falling back to automatic glab resolution.`);
+    }
+    if (result.accepted) {
+      return { outcome: "accepted", path: candidate2.path };
+    }
+  }
+  return budgetExceeded ? { outcome: "exhausted-budget" } : { outcome: "all-rejected" };
+}
+function readCache3() {
+  if (cache3 === null)
+    return null;
+  if (cache3.kind === "success")
+    return cache3;
+  if (_internals99.now() < cache3.expiresAt)
+    return cache3;
+  cache3 = null;
+  return null;
+}
+function applyProbeResult2(result, attempts, generation) {
+  if (generation !== cacheGeneration2) {
+    return result.outcome === "accepted" ? result.path : BARE_GLAB;
+  }
+  lastAttempts2 = attempts;
+  if (result.outcome === "accepted") {
+    cache3 = { kind: "success", path: result.path };
+    return result.path;
+  }
+  cache3 = {
+    kind: "fallback",
+    expiresAt: _internals99.now() + NEGATIVE_CACHE_TTL_MS2
+  };
+  return BARE_GLAB;
+}
+function resolveGlabExecutable() {
+  const cached = readCache3();
+  if (cached)
+    return cached.kind === "success" ? cached.path : BARE_GLAB;
+  const platform = _internals99.platform();
+  const attempts = [];
+  const generation = cacheGeneration2;
+  const candidates = buildCandidates2(platform);
+  const result = probeCycle2(candidates, platform, attempts);
+  return applyProbeResult2(result, attempts, generation);
+}
+var _internals99 = {
+  spawnSync: spawnSync5,
+  platform: () => process.platform,
+  env: () => process.env,
+  now: () => Date.now()
+};
+
+// src/git/pr.ts
 init_logger();
 
 // src/utils/untrusted-markdown.ts
@@ -92189,7 +92450,7 @@ var EvidencePlanSchema = exports_external.object({
   }).passthrough()).optional()
 }).passthrough();
 function ghExec(args, cwd) {
-  const ghBinary = _internals99.resolveGhExecutable();
+  const ghBinary = _internals100.resolveGhExecutable();
   for (let attempt = 0;attempt < MAX_TRANSIENT_RETRIES; attempt++) {
     const result = child_process5.spawnSync(ghBinary, args, {
       cwd,
@@ -92245,12 +92506,18 @@ function spawnSyncWithTransientRetry(command, args, options) {
   throw new Error(`${command} exited with null`);
 }
 async function ghExecAsync(args, cwd) {
+  return _internals100.forgeExecAsync(_internals100.resolveGhExecutable(), args, cwd, "gh");
+}
+async function forgeExecAsyncImpl(binary, args, cwd, label, opts) {
   return new Promise((resolve40, reject) => {
-    const ghBinary = _internals99.resolveGhExecutable();
-    const proc = child_process5.spawn(ghBinary, args, {
+    const spawnOptions = {
       cwd,
       stdio: ["ignore", "pipe", "pipe"]
-    });
+    };
+    if (opts?.env) {
+      spawnOptions.env = mergeEnvForChild(undefined, opts.env);
+    }
+    const proc = child_process5.spawn(binary, args, spawnOptions);
     const stdoutChunks = [];
     const stderrChunks = [];
     let stdoutBytes = 0;
@@ -92274,7 +92541,7 @@ async function ghExecAsync(args, cwd) {
     proc.stdout?.on("data", (chunk) => {
       stdoutBytes += chunk.length;
       if (stdoutBytes > MAX_OUTPUT_BYTES2) {
-        settle2(() => reject(new Error(`gh ${args[0]} stdout exceeded ${MAX_OUTPUT_BYTES2} bytes`)));
+        settle2(() => reject(new Error(`${label} ${args[0]} stdout exceeded ${MAX_OUTPUT_BYTES2} bytes`)));
         return;
       }
       stdoutChunks.push(chunk);
@@ -92282,13 +92549,13 @@ async function ghExecAsync(args, cwd) {
     proc.stderr?.on("data", (chunk) => {
       stderrBytes += chunk.length;
       if (stderrBytes > MAX_OUTPUT_BYTES2) {
-        settle2(() => reject(new Error(`gh ${args[0]} stderr exceeded ${MAX_OUTPUT_BYTES2} bytes`)));
+        settle2(() => reject(new Error(`${label} ${args[0]} stderr exceeded ${MAX_OUTPUT_BYTES2} bytes`)));
         return;
       }
       stderrChunks.push(chunk);
     });
     const timer = setTimeout(() => {
-      settle2(() => reject(new Error(`gh ${args[0]} timed out after ${GIT_TIMEOUT_MS5}ms`)));
+      settle2(() => reject(new Error(`${label} ${args[0]} timed out after ${GIT_TIMEOUT_MS5}ms`)));
     }, GIT_TIMEOUT_MS5);
     proc.on("error", (err) => {
       settle2(() => reject(err));
@@ -92297,7 +92564,7 @@ async function ghExecAsync(args, cwd) {
       settle2(() => {
         if (code !== 0) {
           const stderr = Buffer.concat(stderrChunks).toString("utf-8");
-          reject(new Error(stderr || `gh exited with ${code}`));
+          reject(new Error(stderr || `${label} exited with ${code}`));
         } else {
           const stdout = Buffer.concat(stdoutChunks).toString("utf-8");
           resolve40(stdout);
@@ -92306,20 +92573,24 @@ async function ghExecAsync(args, cwd) {
     });
   });
 }
-var _internals99 = {
+var _internals100 = {
   ghExec,
   ghExecAsync,
+  forgeExecAsync: forgeExecAsyncImpl,
+  getMRPollSnapshot,
+  getMRComments,
   spawnSyncWithTransientRetry,
   spawnSync: __spawnSyncSeam.spawnSync,
   readLaneEnvFileFromDiskSync,
   getMergeGroupRun,
   resolveGhExecutable,
-  resolveGitExecutable
+  resolveGitExecutable,
+  resolveGlabExecutable
 };
 async function getPRPollSnapshot(prNumber, repoFullName, cwd) {
   let stdout;
   try {
-    stdout = await _internals99.ghExecAsync([
+    stdout = await _internals100.ghExecAsync([
       "pr",
       "view",
       String(prNumber),
@@ -92376,7 +92647,7 @@ function numericIssueCommentId(url, fallbackId, fallbacks) {
 async function getPRReviewComments(prNumber, repoFullName, cwd) {
   let stdout;
   try {
-    stdout = await _internals99.ghExecAsync(["api", `repos/${repoFullName}/pulls/${prNumber}/comments`], cwd);
+    stdout = await _internals100.ghExecAsync(["api", `repos/${repoFullName}/pulls/${prNumber}/comments`], cwd);
   } catch (err) {
     throw new Error(`Failed to fetch review comments for ${repoFullName}#${prNumber}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -92389,6 +92660,129 @@ async function getPRReviewComments(prNumber, repoFullName, cwd) {
     isReviewComment: true
   }));
 }
+var MR_SYNTHESIZED_FIELD_MARKER = "NOT_AVAILABLE";
+function glabSpawnEnv(input) {
+  if (!input.host || input.host === "gitlab.com")
+    return;
+  return { env: { GITLAB_HOST: input.host } };
+}
+function mapMrState(state) {
+  if (state === "merged")
+    return "MERGED";
+  if (state === "closed")
+    return "CLOSED";
+  return "OPEN";
+}
+function mapMrMergeable(mr, detail) {
+  if (mr.has_conflicts === true)
+    return "CONFLICTING";
+  if (mr.detailed_merge_status === "conflict")
+    return "CONFLICTING";
+  if (detail.merge_status === "cannot_be_merged")
+    return "CONFLICTING";
+  if (mr.detailed_merge_status === "mergeable")
+    return "MERGEABLE";
+  if (detail.merge_status === "can_be_merged")
+    return "MERGEABLE";
+  return "UNKNOWN";
+}
+function mapPipelineConclusion(status) {
+  if (status === "success")
+    return "success";
+  if (status === "failed")
+    return "failure";
+  return null;
+}
+async function getMRPollSnapshot(input) {
+  const overlay = glabSpawnEnv(input);
+  const glabBinary = _internals100.resolveGlabExecutable();
+  let viewStdout;
+  try {
+    viewStdout = await _internals100.forgeExecAsync(glabBinary, ["mr", "view", String(input.iid), "-R", input.projectPath, "-F", "json"], input.cwd, "glab", overlay);
+  } catch (err) {
+    throw new Error(`Failed to fetch MR view for ${input.projectPath}!${input.iid}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const mr = JSON.parse(viewStdout);
+  let detailStdout;
+  try {
+    detailStdout = await _internals100.forgeExecAsync(glabBinary, [
+      "api",
+      `projects/${encodeURIComponent(input.projectPath)}/merge_requests/${input.iid}`
+    ], input.cwd, "glab", overlay);
+  } catch (err) {
+    throw new Error(`Failed to fetch MR detail for ${input.projectPath}!${input.iid}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const detail = JSON.parse(detailStdout);
+  let pipelines = [];
+  let pipelinesFetchSucceeded = false;
+  try {
+    const pipelinesStdout = await _internals100.forgeExecAsync(glabBinary, [
+      "api",
+      `projects/${encodeURIComponent(input.projectPath)}/merge_requests/${input.iid}/pipelines?per_page=20`
+    ], input.cwd, "glab", overlay);
+    const rawPipelines = JSON.parse(pipelinesStdout);
+    const headSha = typeof mr.sha === "string" ? mr.sha : "";
+    const forHead = rawPipelines.filter((p) => typeof p.sha === "string" && p.sha === headSha).sort((a, b) => (Number(b.id) || 0) - (Number(a.id) || 0));
+    const latest = forHead[0];
+    const conclusion = mapPipelineConclusion(latest?.status);
+    pipelines = latest && conclusion ? [
+      {
+        name: `pipeline #${String(latest.id ?? "")}`,
+        status: "completed",
+        conclusion,
+        ...typeof latest.web_url === "string" ? { detailsUrl: latest.web_url } : {}
+      }
+    ] : [];
+    pipelinesFetchSucceeded = true;
+  } catch {
+    pipelines = [];
+    pipelinesFetchSucceeded = false;
+  }
+  const state = mapMrState(mr.state);
+  const mergeable = mapMrMergeable(mr, detail);
+  const reviewers = Array.isArray(mr.reviewers) ? mr.reviewers.length : 0;
+  return {
+    status: {
+      number: input.iid,
+      state,
+      mergeable,
+      mergeStateStatus: MR_SYNTHESIZED_FIELD_MARKER,
+      headRefOid: typeof mr.sha === "string" ? mr.sha : "",
+      statusCheckRollup: []
+    },
+    comments: [],
+    merge: {
+      mergeable,
+      mergeStateStatus: MR_SYNTHESIZED_FIELD_MARKER,
+      headRefOid: typeof mr.sha === "string" ? mr.sha : ""
+    },
+    review: {
+      reviewDecision: "",
+      reviewRequestCount: reviewers
+    },
+    pipelines,
+    pipelinesFetchSucceeded
+  };
+}
+async function getMRComments(input) {
+  let stdout;
+  try {
+    stdout = await _internals100.forgeExecAsync(_internals100.resolveGlabExecutable(), [
+      "api",
+      `projects/${encodeURIComponent(input.projectPath)}/merge_requests/${input.iid}/notes?per_page=100&sort=asc&order_by=created_at`
+    ], input.cwd, "glab", glabSpawnEnv(input));
+  } catch (err) {
+    throw new Error(`Failed to fetch MR comments for ${input.projectPath}!${input.iid}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const notes = JSON.parse(stdout);
+  return notes.filter((note) => note.system !== true).map((note) => ({
+    id: String(note.id ?? ""),
+    author: String(note.author?.username ?? ""),
+    body: neutralizeUntrustedMarkdown(String(note.body ?? ""), "GitLab MR note"),
+    createdAt: String(note.created_at ?? ""),
+    isReviewComment: false
+  }));
+}
 async function getMergeGroupRun(statusCheckRollup, repoFullName, cwd) {
   const mergeGroupCheck = statusCheckRollup.find((check) => check.name === "Merge pull request" && check.detailsUrl);
   if (!mergeGroupCheck?.detailsUrl) {
@@ -92401,7 +92795,7 @@ async function getMergeGroupRun(statusCheckRollup, repoFullName, cwd) {
   const runId = runIdMatch[1];
   let stdout;
   try {
-    stdout = await _internals99.ghExecAsync([
+    stdout = await _internals100.ghExecAsync([
       "run",
       "view",
       runId,
@@ -92430,7 +92824,7 @@ var registrationsByCanonical = new Map;
 function resolveRegistration(directory) {
   const lexical = canonicalRootKeyLexical(directory);
   try {
-    const freshKey = _internals100.canonicalRootKeyFresh(directory);
+    const freshKey = _internals101.canonicalRootKeyFresh(directory);
     const canonical = registrationsByCanonical.get(freshKey);
     if (canonical)
       return canonical;
@@ -92452,8 +92846,10 @@ async function evaluatePrFeedbackCurrentHead(directory, repoFullName, prNumber)
 async function dispatchPrFeedbackOversight(input) {
   return await getPrFeedbackLoopRuntime(input.directory)?.dispatchOversight(input) ?? { dispatched: false, verdict: "unavailable", decision: "pending" };
 }
-var _internals100 = {
+var _internals101 = {
   getPRPollSnapshot,
+  getMRPollSnapshot,
+  findSubscriptionRecordForPrUrl,
   dispatchEphemeralAgent,
   parseCriticResponseFields,
   canonicalRootKeyFresh,
@@ -92462,11 +92858,11 @@ var _internals100 = {
 };
 
 // src/background/pr-feedback-loop.ts
-var PR_FEEDBACK_LOOP_STATE_REL = path127.join(".swarm", "pr-feedback-loop-state.json");
+var PR_FEEDBACK_LOOP_STATE_REL = path128.join(".swarm", "pr-feedback-loop-state.json");
 var PR_FEEDBACK_CLEANUP_DIR = "pr-feedback-loop-cleanups";
-var PR_FEEDBACK_EVIDENCE_DIR = path127.join(".swarm", "pr-feedback-evidence");
+var PR_FEEDBACK_EVIDENCE_DIR = path128.join(".swarm", "pr-feedback-evidence");
 var PR_FEEDBACK_LOOP_STATE_LOCK_FILENAME = "pr-feedback-loop-state.lock";
-var PR_FEEDBACK_LOOP_STATE_LOCK_REL = path127.join(".swarm", PR_FEEDBACK_LOOP_STATE_LOCK_FILENAME);
+var PR_FEEDBACK_LOOP_STATE_LOCK_REL = path128.join(".swarm", PR_FEEDBACK_LOOP_STATE_LOCK_FILENAME);
 var MAX_TRACKED_SESSIONS5 = 200;
 var MAX_IN_FLIGHT_SESSIONS = 64;
 var MAX_CANCELLATION_REQUESTS = 64;
@@ -92482,7 +92878,7 @@ var LoopStateSchema = exports_external.object({
   correlations: exports_external.record(exports_external.string(), exports_external.any()),
   sessionTerminals: exports_external.record(exports_external.string(), exports_external.any()).default({})
 });
-var _internals101 = {
+var _internals102 = {
   async evaluateCurrentHead(directory, repoFullName, prNumber) {
     return evaluatePrFeedbackCurrentHead(directory, repoFullName, prNumber);
   },
@@ -92491,13 +92887,20 @@ var _internals101 = {
   },
   async performAuthorizedAction(input) {
     try {
+      const subscription = await findSubscriptionRecordForPrUrl(input.directory, {
+        prUrl: input.event.prUrl,
+        repoFullName: input.event.repoFullName,
+        prNumber: input.event.prNumber,
+        sessionID: input.sessionID
+      });
       await activatePrWorkflow(input.directory, input.sessionID, "PR_FEEDBACK", {
         requireCheckoutPreflight: true,
-        prUrl: input.event.prUrl
+        prUrl: input.event.prUrl,
+        forge: subscription?.forge
       });
       return {
         performed: true,
-        recordPath: path127.join(".swarm", "pr-feedback-loop-state.json")
+        recordPath: path128.join(".swarm", "pr-feedback-loop-state.json")
       };
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -92519,13 +92922,13 @@ var _internals101 = {
   listActive,
   isProcessAlive: isProcessAlive3,
   resetLoopStateLock() {
-    _internals101.beforeLoopStateLockWrite = undefined;
+    _internals102.beforeLoopStateLockWrite = undefined;
   },
   loopStateLockRelativePath: () => PR_FEEDBACK_LOOP_STATE_LOCK_REL,
   reclaimAbandonedLoopStateLock,
   removeLoopStateLockIfOwned
 };
-var defaultLoopInternals = { ..._internals101 };
+var defaultLoopInternals = { ..._internals102 };
 function emptyState2() {
   return {
     schemaVersion: 1,
@@ -92601,7 +93004,7 @@ function hasReservationIdentity(reservation) {
   return Boolean(reservation?.workflowInstanceId.trim() && Number.isInteger(reservation?.ownerPid) && (reservation?.ownerPid ?? 0) > 0);
 }
 async function readLoopState(directory) {
-  const file = path127.join(directory, PR_FEEDBACK_LOOP_STATE_REL);
+  const file = path128.join(directory, PR_FEEDBACK_LOOP_STATE_REL);
   try {
     const raw = fsSync9.readFileSync(file, "utf-8");
     const parsed = LoopStateSchema.safeParse(JSON.parse(raw));
@@ -92632,7 +93035,7 @@ async function writeLoopState(directory, state) {
     }
   }
   state.updatedAt = new Date().toISOString();
-  await writePrWorkflowAtomicJson(directory, validateSwarmPath(directory, path127.basename(PR_FEEDBACK_LOOP_STATE_REL)), state);
+  await writePrWorkflowAtomicJson(directory, validateSwarmPath(directory, path128.basename(PR_FEEDBACK_LOOP_STATE_REL)), state);
 }
 async function withLoopStateLock(directory, fn) {
   const lock = await acquireLoopStateLock(directory);
@@ -92647,21 +93050,21 @@ async function acquireLoopStateLock(directory) {
   const verifiedStateDirectory = await ensurePrWorkflowSafeParentDirectory(directory, lockPath);
   for (let attempt = 0;attempt < LOOP_STATE_LOCK_MAX_ATTEMPTS; attempt++) {
     try {
-      const handle = await fs63.open(lockPath, "wx");
+      const handle = await fs64.open(lockPath, "wx");
       const lock = {
         ownerToken: randomUUID22(),
         pid: process.pid,
-        createdAtMs: _internals101.now()
+        createdAtMs: _internals102.now()
       };
       let writeError;
       try {
-        await _internals101.beforeLoopStateLockWrite?.();
+        await _internals102.beforeLoopStateLockWrite?.();
         const [openedStat, pathStat, realLockPath] = await Promise.all([
           handle.stat({ bigint: true }),
-          fs63.lstat(lockPath, { bigint: true }),
-          fs63.realpath(lockPath)
+          fs64.lstat(lockPath, { bigint: true }),
+          fs64.realpath(lockPath)
         ]);
-        if (!openedStat.isFile() || pathStat.isSymbolicLink() || !pathStat.isFile() || !sameFileIdentity4(openedStat, pathStat) || normalizeComparablePath2(path127.dirname(realLockPath)) !== normalizeComparablePath2(verifiedStateDirectory)) {
+        if (!openedStat.isFile() || pathStat.isSymbolicLink() || !pathStat.isFile() || !sameFileIdentity4(openedStat, pathStat) || normalizeComparablePath2(path128.dirname(realLockPath)) !== normalizeComparablePath2(verifiedStateDirectory)) {
           throw new Error("BLOCKED: PR feedback loop state lock changed or escaped before initialization");
         }
         await handle.writeFile(JSON.stringify(lock), "utf8");
@@ -92702,17 +93105,17 @@ async function reclaimAbandonedLoopStateLock(lockPath) {
     lock = null;
   }
   if (lock) {
-    if (_internals101.isProcessAlive(lock.pid) && _internals101.now() - lock.createdAtMs < LOOP_STATE_LOCK_ALIVE_OWNER_STALE_MS) {
+    if (_internals102.isProcessAlive(lock.pid) && _internals102.now() - lock.createdAtMs < LOOP_STATE_LOCK_ALIVE_OWNER_STALE_MS) {
       return false;
     }
     return removeLoopStateLockIfOwned(lockPath, lock.ownerToken);
   }
   try {
-    const stat14 = await fs63.stat(lockPath);
-    if (_internals101.now() - stat14.mtimeMs < LOOP_STATE_LOCK_UNINITIALIZED_STALE_MS) {
+    const stat14 = await fs64.stat(lockPath);
+    if (_internals102.now() - stat14.mtimeMs < LOOP_STATE_LOCK_UNINITIALIZED_STALE_MS) {
       return false;
     }
-    await fs63.rm(lockPath, { force: true });
+    await fs64.rm(lockPath, { force: true });
     return true;
   } catch (error2) {
     if (error2.code === "ENOENT")
@@ -92723,7 +93126,7 @@ async function reclaimAbandonedLoopStateLock(lockPath) {
 async function readLoopStateLock(lockPath) {
   let raw;
   try {
-    raw = await fs63.readFile(lockPath, "utf8");
+    raw = await fs64.readFile(lockPath, "utf8");
   } catch (error2) {
     if (error2.code === "ENOENT")
       return null;
@@ -92747,7 +93150,7 @@ async function removeLoopStateLockIfOwned(lockPath, ownerToken) {
   if (!lock || lock.ownerToken !== ownerToken)
     return false;
   try {
-    await fs63.rm(lockPath);
+    await fs64.rm(lockPath);
     return true;
   } catch {
     return false;
@@ -92765,7 +93168,7 @@ function sameFileIdentity4(left, right) {
   return left.dev === right.dev && left.ino === right.ino;
 }
 function normalizeComparablePath2(value) {
-  const normalized = path127.normalize(path127.resolve(value));
+  const normalized = path128.normalize(path128.resolve(value));
   return process.platform === "win32" ? normalized.toLowerCase() : normalized;
 }
 function delay3(ms) {
@@ -92869,14 +93272,14 @@ async function cancelPrFeedbackLoopUnlocked(directory, sessionID, reason) {
     clearedEvents: []
   };
   try {
-    const { cancelPrFeedbackPublication: cancelPrFeedbackPublication2 } = await import("./pr-workflow-gate-qd5tfkak.js");
+    const { cancelPrFeedbackPublication: cancelPrFeedbackPublication2 } = await import("./pr-workflow-gate-j3r636zg.js");
     await cancelPrFeedbackPublication2(directory, sessionID, reason);
   } catch (err) {
     warn(`[pr-feedback-loop] cancelPrFeedbackPublication failed (fail-open): ${err instanceof Error ? err.message : String(err)}`);
   }
   try {
     await withLoopStateLock(directory, async () => {
-      const readResult = await _internals101.readState(directory);
+      const readResult = await _internals102.readState(directory);
       if (isCorruptState(readResult)) {
         throw new Error("BLOCKED: loop state is corrupt during durable cancellation admission");
       }
@@ -92889,7 +93292,7 @@ async function cancelPrFeedbackLoopUnlocked(directory, sessionID, reason) {
           correlation.terminal = { state: "cancelled", reason };
         }
         const inFlight = correlation.inFlight;
-        const ownerAlive = inFlight && hasReservationIdentity(inFlight) ? _internals101.isProcessAlive(inFlight.ownerPid) : false;
+        const ownerAlive = inFlight && hasReservationIdentity(inFlight) ? _internals102.isProcessAlive(inFlight.ownerPid) : false;
         const reclaimedReservation = Boolean(inFlight && (inFlight.actionStartedAt === undefined || !ownerAlive));
         if (reclaimedReservation) {
           correlation.inFlight = null;
@@ -92904,7 +93307,7 @@ async function cancelPrFeedbackLoopUnlocked(directory, sessionID, reason) {
           reason
         };
       }
-      await _internals101.writeState(directory, nextState);
+      await _internals102.writeState(directory, nextState);
       return nextState;
     });
   } catch (err) {
@@ -92925,12 +93328,12 @@ async function cancelPrFeedbackLoopUnlocked(directory, sessionID, reason) {
     }
   }
   const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-  receipt.path = path127.join(".swarm", PR_FEEDBACK_CLEANUP_DIR, `cancel-${stamp}.json`);
+  receipt.path = path128.join(".swarm", PR_FEEDBACK_CLEANUP_DIR, `cancel-${stamp}.json`);
   try {
-    fsSync9.mkdirSync(path127.join(directory, ".swarm", PR_FEEDBACK_CLEANUP_DIR), {
+    fsSync9.mkdirSync(path128.join(directory, ".swarm", PR_FEEDBACK_CLEANUP_DIR), {
       recursive: true
     });
-    fsSync9.writeFileSync(path127.join(directory, receipt.path), JSON.stringify({
+    fsSync9.writeFileSync(path128.join(directory, receipt.path), JSON.stringify({
       schemaVersion: 1,
       at: new Date().toISOString(),
       sessionID,
@@ -92982,228 +93385,6 @@ ${USAGE14}`;
 
 // src/background/pr-monitor-worker.ts
 init_warning_buffer();
-
-// src/utils/glab-executable.ts
-init_warning_buffer();
-import { spawnSync as spawnSync6 } from "child_process";
-import * as fs64 from "fs";
-import * as os14 from "os";
-import * as path128 from "path";
-var GLAB_BINARY_ENV_VAR = "OPENCODE_SWARM_GLAB_BINARY";
-var PER_PROBE_TIMEOUT_MS2 = 250;
-var TOTAL_BUDGET_MS3 = 1000;
-var NEGATIVE_CACHE_TTL_MS2 = 60000;
-var BARE_GLAB = "glab";
-var PROBE_MAX_BUFFER_BYTES2 = 64 * 1024;
-var PROBE_OUTPUT_EXCERPT_CHARS2 = 60;
-var WINDOWS_PATH_EXTENSIONS2 = [".exe", ".cmd", ".bat"];
-var GLAB_VERSION_PATTERN = /^glab version \d+\.\d+/;
-function excerptProbeOutput2(raw) {
-  return raw.slice(0, PROBE_OUTPUT_EXCERPT_CHARS2).replace(/[^\x20-\x7E]/g, " ").trim();
-}
-var cache3 = null;
-var lastAttempts2 = [];
-var cacheGeneration2 = 0;
-function windowsGlabAbsoluteCandidates(env) {
-  const candidates = [];
-  const push = (...parts) => {
-    const candidate2 = path128.join(...parts);
-    if (!candidates.includes(candidate2))
-      candidates.push(candidate2);
-  };
-  if (env.ProgramFiles) {
-    push(env.ProgramFiles, "GitLab CLI", "glab.exe");
-  }
-  if (env["ProgramFiles(x86)"]) {
-    push(env["ProgramFiles(x86)"], "GitLab CLI", "glab.exe");
-  }
-  if (env.LOCALAPPDATA) {
-    push(env.LOCALAPPDATA, "GitLab CLI", "glab.exe");
-    push(env.LOCALAPPDATA, "Programs", "GitLab CLI", "glab.exe");
-  }
-  return candidates;
-}
-function platformCandidates2(platform, env) {
-  if (platform === "win32") {
-    return windowsGlabAbsoluteCandidates(env);
-  }
-  if (platform === "darwin") {
-    return ["/opt/homebrew/bin/glab", "/usr/local/bin/glab", "/usr/bin/glab"];
-  }
-  return ["/usr/bin/glab", "/usr/local/bin/glab", "/bin/glab"];
-}
-function isAbsoluteForPlatform2(candidate2, platform) {
-  return platform === "win32" ? path128.win32.isAbsolute(candidate2) : path128.posix.isAbsolute(candidate2);
-}
-function joinDirAndName2(dir, name, platform) {
-  const sep22 = platform === "win32" ? "\\" : "/";
-  const trimmed = dir.replace(/[\\/]+$/, "");
-  return trimmed ? `${trimmed}${sep22}${name}` : `${sep22}${name}`;
-}
-function pathCandidates2(platform) {
-  const pathValue = _internals102.env().PATH ?? "";
-  if (!pathValue)
-    return [];
-  const dirs = pathValue.split(platform === "win32" ? ";" : ":").filter(Boolean);
-  const names = platform === "win32" ? [...WINDOWS_PATH_EXTENSIONS2.map((ext) => `glab${ext}`), "glab"] : ["glab"];
-  const out = [];
-  for (const dir of dirs) {
-    for (const name of names) {
-      const candidate2 = joinDirAndName2(dir, name, platform);
-      if (!out.includes(candidate2))
-        out.push(candidate2);
-    }
-  }
-  return out;
-}
-function envOverride2() {
-  const raw = _internals102.env()[GLAB_BINARY_ENV_VAR];
-  return raw && raw.trim() !== "" ? raw : undefined;
-}
-function buildCandidates2(platform) {
-  const override = envOverride2();
-  const overrideCandidate = override ? [{ source: "override", path: override }] : [];
-  const seen = new Set(overrideCandidate.map((c) => c.path));
-  const rest = [];
-  for (const p of platformCandidates2(platform, _internals102.env())) {
-    if (seen.has(p))
-      continue;
-    seen.add(p);
-    rest.push({ source: "platform", path: p });
-  }
-  for (const p of pathCandidates2(platform)) {
-    if (seen.has(p))
-      continue;
-    seen.add(p);
-    rest.push({ source: "path", path: p });
-  }
-  return [...overrideCandidate, ...rest];
-}
-function probeCandidate2(candidatePath2, platform) {
-  if (!isAbsoluteForPlatform2(candidatePath2, platform)) {
-    return { accepted: false, reason: "not an absolute path" };
-  }
-  let stat14;
-  try {
-    stat14 = fs64.statSync(candidatePath2);
-  } catch (err) {
-    const code = err?.code;
-    if (code === "ENOENT")
-      return { accepted: false, reason: "no such file" };
-    return {
-      accepted: false,
-      reason: `cannot stat (${code ?? "unknown error"})`
-    };
-  }
-  if (stat14.isDirectory()) {
-    return { accepted: false, reason: "is a directory" };
-  }
-  if (!stat14.isFile()) {
-    return { accepted: false, reason: "not a regular file" };
-  }
-  let result;
-  try {
-    result = _internals102.spawnSync(candidatePath2, ["--version"], {
-      cwd: os14.tmpdir(),
-      stdio: ["ignore", "pipe", "ignore"],
-      windowsHide: true,
-      timeout: PER_PROBE_TIMEOUT_MS2,
-      maxBuffer: PROBE_MAX_BUFFER_BYTES2
-    });
-  } catch (err) {
-    return {
-      accepted: false,
-      reason: `spawn threw: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-  if (result.error) {
-    return { accepted: false, reason: `spawn failed: ${result.error.message}` };
-  }
-  if (result.status !== 0) {
-    const statusDescription = result.status !== null ? `exit ${result.status}` : `signal ${result.signal ?? "unknown"}`;
-    return {
-      accepted: false,
-      reason: `glab --version returned ${statusDescription}`
-    };
-  }
-  const versionOutput = (result.stdout ?? "").toString().trim();
-  if (!GLAB_VERSION_PATTERN.test(versionOutput)) {
-    const excerpt = excerptProbeOutput2(versionOutput);
-    return {
-      accepted: false,
-      reason: excerpt ? `not glab: --version printed "${excerpt}"` : "not glab: --version printed nothing"
-    };
-  }
-  return { accepted: true };
-}
-function probeCycle2(candidates, platform, attempts) {
-  const start = _internals102.now();
-  let budgetExceeded = false;
-  for (const candidate2 of candidates) {
-    if (_internals102.now() - start > TOTAL_BUDGET_MS3) {
-      budgetExceeded = true;
-      break;
-    }
-    const result = probeCandidate2(candidate2.path, platform);
-    attempts.push({
-      source: candidate2.source,
-      candidate: candidate2.path,
-      accepted: result.accepted,
-      reason: result.accepted ? undefined : result.reason
-    });
-    if (candidate2.source === "override" && !result.accepted) {
-      advisoryWarn(`[opencode-swarm] ${GLAB_BINARY_ENV_VAR} override "${candidate2.path}" is unusable (${result.reason}); falling back to automatic glab resolution.`);
-    }
-    if (result.accepted) {
-      return { outcome: "accepted", path: candidate2.path };
-    }
-  }
-  return budgetExceeded ? { outcome: "exhausted-budget" } : { outcome: "all-rejected" };
-}
-function readCache3() {
-  if (cache3 === null)
-    return null;
-  if (cache3.kind === "success")
-    return cache3;
-  if (_internals102.now() < cache3.expiresAt)
-    return cache3;
-  cache3 = null;
-  return null;
-}
-function applyProbeResult2(result, attempts, generation) {
-  if (generation !== cacheGeneration2) {
-    return result.outcome === "accepted" ? result.path : BARE_GLAB;
-  }
-  lastAttempts2 = attempts;
-  if (result.outcome === "accepted") {
-    cache3 = { kind: "success", path: result.path };
-    return result.path;
-  }
-  cache3 = {
-    kind: "fallback",
-    expiresAt: _internals102.now() + NEGATIVE_CACHE_TTL_MS2
-  };
-  return BARE_GLAB;
-}
-function resolveGlabExecutable() {
-  const cached = readCache3();
-  if (cached)
-    return cached.kind === "success" ? cached.path : BARE_GLAB;
-  const platform = _internals102.platform();
-  const attempts = [];
-  const generation = cacheGeneration2;
-  const candidates = buildCandidates2(platform);
-  const result = probeCycle2(candidates, platform, attempts);
-  return applyProbeResult2(result, attempts, generation);
-}
-var _internals102 = {
-  spawnSync: spawnSync6,
-  platform: () => process.platform,
-  env: () => process.env,
-  now: () => Date.now()
-};
-
-// src/background/pr-monitor-worker.ts
 var prMonitorWorkerRegistry = new Map;
 function getPrMonitorWorkerHealth(directory) {
   return prMonitorWorkerRegistry.get(directory)?.getHealth() ?? null;
@@ -93413,12 +93594,7 @@ class PrMonitorWorker {
   async pollSinglePr(sub, isTimedOut, isProbe = false) {
     const correlationId = sub.correlationId;
     const forgeContext = detectForgeFromUrl(sub.prUrl) ?? (sub.forge ? { provider: sub.forge.provider, host: sub.forge.host } : null);
-    if (forgeContext && !getProviderCapabilities(forgeContext.provider).statusCheckRollup && !getProviderCapabilities(forgeContext.provider).reviewDecision && !getProviderCapabilities(forgeContext.provider).mergeStateStatus) {
-      const glabBinary = resolveGlabExecutable();
-      const glabStatus = glabBinary === "glab" ? "glab binary not resolved (bare-name fallback)" : "glab binary resolved";
-      log("[PrMonitorWorker] GitLab MR monitoring unavailable: glab-backed polling is not wired yet (issue #2882); skipping gh poll for this subscription", { correlationId, glabStatus });
-      return;
-    }
+    const isGitLab = forgeContext?.provider === "gitlab";
     if (!this.circuitBreakerMap.has(correlationId) && sub.errorCount > 0) {
       this.circuitBreakerMap.set(correlationId, {
         errorCount: sub.errorCount,
@@ -93443,40 +93619,76 @@ class PrMonitorWorker {
       return;
     }
     try {
-      const [snapshot, reviewComments] = await Promise.all([
-        _internals103.getPRPollSnapshot(sub.prNumber, sub.repoFullName, this.directory),
-        _internals103.getPRReviewComments(sub.prNumber, sub.repoFullName, this.directory)
-      ]);
-      if (isTimedOut?.()) {
-        log("[PrMonitorWorker] Skipping late result \u2014 poll already timed out", {
-          correlationId: sub.correlationId
+      let changes;
+      if (isGitLab) {
+        const glabBinary = resolveGlabExecutable();
+        const glabStatus = glabBinary === "glab" ? "glab binary not resolved (bare-name fallback)" : "glab binary resolved";
+        log("[PrMonitorWorker] Polling GitLab MR (glab-backed)", {
+          correlationId,
+          glabStatus
         });
-        return;
-      }
-      let mergeGroupRunResult = null;
-      let mergeGroupRunFetchSucceeded = false;
-      try {
-        mergeGroupRunResult = await _internals103.getMergeGroupRun(snapshot.status.statusCheckRollup, sub.repoFullName, this.directory);
-        mergeGroupRunFetchSucceeded = true;
-      } catch (err) {
-        log("[PrMonitorWorker] Failed to fetch merge group run", {
-          correlationId: sub.correlationId,
-          error: err instanceof Error ? err.message : String(err)
-        });
-      }
-      if (isTimedOut?.()) {
-        log("[PrMonitorWorker] Skipping late result \u2014 poll already timed out", {
-          correlationId: sub.correlationId
+        const mrInput = {
+          projectPath: sub.repoFullName,
+          iid: sub.prNumber,
+          cwd: this.directory,
+          ...forgeContext ? { host: forgeContext.host } : {}
+        };
+        const [mrSnapshot, mrComments] = await Promise.all([
+          _internals103.getMRPollSnapshot(mrInput),
+          _internals103.getMRComments(mrInput)
+        ]);
+        if (isTimedOut?.()) {
+          log("[PrMonitorWorker] Skipping late result \u2014 poll already timed out", {
+            correlationId: sub.correlationId
+          });
+          return;
+        }
+        changes = this.computeChanges(sub, {
+          status: mrSnapshot.status,
+          comments: mrComments,
+          merge: mrSnapshot.merge,
+          review: mrSnapshot.review,
+          mergeGroupRun: null
+        }, true, {
+          checks: mrSnapshot.pipelines,
+          fetchSucceeded: mrSnapshot.pipelinesFetchSucceeded
         });
-        return;
+      } else {
+        const [snapshot, reviewComments] = await Promise.all([
+          _internals103.getPRPollSnapshot(sub.prNumber, sub.repoFullName, this.directory),
+          _internals103.getPRReviewComments(sub.prNumber, sub.repoFullName, this.directory)
+        ]);
+        if (isTimedOut?.()) {
+          log("[PrMonitorWorker] Skipping late result \u2014 poll already timed out", {
+            correlationId: sub.correlationId
+          });
+          return;
+        }
+        let mergeGroupRunResult = null;
+        let mergeGroupRunFetchSucceeded = false;
+        try {
+          mergeGroupRunResult = await _internals103.getMergeGroupRun(snapshot.status.statusCheckRollup, sub.repoFullName, this.directory);
+          mergeGroupRunFetchSucceeded = true;
+        } catch (err) {
+          log("[PrMonitorWorker] Failed to fetch merge group run", {
+            correlationId: sub.correlationId,
+            error: err instanceof Error ? err.message : String(err)
+          });
+        }
+        if (isTimedOut?.()) {
+          log("[PrMonitorWorker] Skipping late result \u2014 poll already timed out", {
+            correlationId: sub.correlationId
+          });
+          return;
+        }
+        changes = this.computeChanges(sub, {
+          status: snapshot.status,
+          comments: [...snapshot.comments, ...reviewComments],
+          merge: snapshot.merge,
+          review: snapshot.review,
+          mergeGroupRun: mergeGroupRunResult
+        }, mergeGroupRunFetchSucceeded);
       }
-      const changes = this.computeChanges(sub, {
-        status: snapshot.status,
-        comments: [...snapshot.comments, ...reviewComments],
-        merge: snapshot.merge,
-        review: snapshot.review,
-        mergeGroupRun: mergeGroupRunResult
-      }, mergeGroupRunFetchSucceeded);
       await this.applyChanges(sub, changes, isTimedOut);
       if (!isTimedOut?.()) {
         this.circuitBreakerMap.delete(correlationId);
@@ -93512,7 +93724,7 @@ class PrMonitorWorker {
       await this.handlePollError(sub, err instanceof Error ? err : new Error(String(err)));
     }
   }
-  computeChanges(sub, current, mergeGroupRunFetchSucceeded) {
+  computeChanges(sub, current, mergeGroupRunFetchSucceeded, gitLabPipelines) {
     const events = [];
     const snapshotUpdates = {
       headRefOid: current.status.headRefOid,
@@ -93539,13 +93751,17 @@ class PrMonitorWorker {
         }
       });
     }
-    const currentCheckSet = this.serializeChecks(current.status.statusCheckRollup);
-    snapshotUpdates.lastCheckRunSet = currentCheckSet;
-    if (sub.lastCheckRunSet !== undefined && currentCheckSet !== sub.lastCheckRunSet) {
-      const prevChecks = this.parseCheckSet(sub.lastCheckRunSet);
-      this.computeCIEvents(sub, prevChecks, current.status.statusCheckRollup, current.status.headRefOid, events);
+    const ciChecks = gitLabPipelines ? gitLabPipelines.checks : current.status.statusCheckRollup;
+    const gitlabNoTerminalVerdict = gitLabPipelines !== undefined && gitLabPipelines.checks.length === 0;
+    if (!gitlabNoTerminalVerdict && (!gitLabPipelines || gitLabPipelines.fetchSucceeded)) {
+      const currentCheckSet = this.serializeChecks(ciChecks);
+      snapshotUpdates.lastCheckRunSet = currentCheckSet;
+      if (sub.lastCheckRunSet !== undefined && currentCheckSet !== sub.lastCheckRunSet) {
+        const prevChecks = this.parseCheckSet(sub.lastCheckRunSet);
+        this.computeCIEvents(sub, prevChecks, ciChecks, current.status.headRefOid, events);
+      }
+      snapshotUpdates.lastCheckRunSet = currentCheckSet;
     }
-    snapshotUpdates.lastCheckRunSet = currentCheckSet;
     if (current.comments.length > 0) {
       const sorted2 = [...current.comments].sort((a, b) => a.createdAt.localeCompare(b.createdAt));
       let newComments;
@@ -93877,6 +94093,8 @@ class PrMonitorWorker {
 var _internals103 = {
   getPRPollSnapshot,
   getPRReviewComments,
+  getMRPollSnapshot,
+  getMRComments,
   getMergeGroupRun,
   listActive,
   updateSnapshot,
@@ -94240,11 +94458,10 @@ async function handlePrSubscribeCommand(directory, args, sessionID) {
       deliveryLine
     ].concat(prUrl.includes("/-/merge_requests/") ? [
       "",
-      "Note: live monitoring is NOT AVAILABLE for GitLab merge",
-      "requests yet \u2014 glab-backed polling is tracked as issue #2882.",
-      "The subscription is recorded and PR reference/gate/",
-      "publication workflows operate on this MR, but no CI/comment/",
-      "review events will be delivered until that lands."
+      "Note: live GitLab MR monitoring is active (glab-backed:",
+      "state, comments, and pipeline CI events). Review-decision",
+      "and status-check rollup equivalents remain NOT AVAILABLE",
+      "for GitLab \u2014 the monitor never fabricates them (issue #2733)."
     ] : []).join(`
 `);
   } catch (err) {
@@ -106680,7 +106897,7 @@ async function runValidationWithTransientRetry(input, candidateContent, baseline
       if (!input.dispatcher) {
         throw new Error("no evaluation dispatcher available (cannot run validation)");
       }
-      const { createModelEvaluationExecutor: createModelEvaluationExecutor2 } = await import("./runner-tb3eppeg.js");
+      const { createModelEvaluationExecutor: createModelEvaluationExecutor2 } = await import("./runner-fns4esbf.js");
       const executor = createModelEvaluationExecutor2(input.dispatcher, input.sessionId);
       const result = await withProtectedSetIntegrity([evalInputRoot, ...protectedRoots(input.directory)], () => _internals129.evaluateCandidateV1({
         projectRoot: input.directory,
@@ -109309,7 +109526,7 @@ function buildDetailedHelp(commandName, entry) {
 async function handleHelpCommand(ctx) {
   const targetCommand = ctx.args.join(" ");
   if (!targetCommand) {
-    const { buildHelpText } = await import("./index-r9zc92pb.js");
+    const { buildHelpText } = await import("./index-03d68zxw.js");
     return buildHelpText();
   }
   const tokens = targetCommand.split(/\s+/);
@@ -109323,7 +109540,7 @@ async function handleHelpCommand(ctx) {
 > Note: \`/swarm ${resolved.key}\` is a deprecated alias for \`/swarm ${aliasTarget}\`.` : detailed;
   }
   const similar = _internals27.findSimilarCommands(targetCommand);
-  const { buildHelpText: fullHelp } = await import("./index-r9zc92pb.js");
+  const { buildHelpText: fullHelp } = await import("./index-03d68zxw.js");
   if (similar.length > 0) {
     return `Command '/swarm ${targetCommand}' not found.
 
@@ -109358,6 +109575,18 @@ async function handleModeCommandWithBundledSkills(ctx, handler, mechanicalMode)
   }
   return result;
 }
+function resolveCommandForgeContext(directory, prUrl) {
+  if (detectForgeFromUrl(prUrl))
+    return;
+  try {
+    const config = loadPluginConfig(directory);
+    const remote = detectGitRemote(directory, undefined);
+    const remotes = remote ? [remote] : [];
+    return resolveForgeContextFromPluginConfig(config, remotes) ?? undefined;
+  } catch {
+    return;
+  }
+}
 async function handlePrFeedbackCommandWithTransition(ctx) {
   if (ctx.packageRoot) {
     await syncBundledProjectSkillsIfMissingAsync(ctx.directory, ctx.packageRoot, true);
@@ -109388,7 +109617,8 @@ async function handlePrFeedbackCommandWithTransition(ctx) {
   } else {
     await activatePrWorkflow(ctx.directory, ctx.sessionID, "PR_FEEDBACK", {
       requireCheckoutPreflight: true,
-      ...parsed.prUrl ? { prUrl: parsed.prUrl } : {}
+      ...parsed.prUrl ? { prUrl: parsed.prUrl } : {},
+      ...parsed.prUrl ? { forge: resolveCommandForgeContext(ctx.directory, parsed.prUrl) } : {}
     });
   }
   return handlePrFeedbackCommand(ctx.directory, ctx.args);
@@ -109638,7 +109868,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-ma658hkw.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-yfd11za1.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -109648,7 +109878,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail reset": {
     handler: async (ctx) => {
-      const { handleGuardrailReset } = await import("./guardrail-reset-w41yndke.js");
+      const { handleGuardrailReset } = await import("./guardrail-reset-fqgf5sdb.js");
       return handleGuardrailReset(ctx.args, ctx.sessionID);
     },
     description: "Reset one exact active invocation/action circuit after repair",
@@ -109669,7 +109899,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-log": {
     handler: async (ctx) => {
-      const { handleGuardrailLog } = await import("./guardrail-log-m6mydjet.js");
+      const { handleGuardrailLog } = await import("./guardrail-log-hcr5rptq.js");
       return handleGuardrailLog(ctx.directory, ctx.args);
     },
     description: "Read the guardrail decision log (use --blocks-only for blocks)",
@@ -114977,4 +115207,4 @@ function getAgentConfigs(config, directory, sessionId, projectContext) {
   return result;
 }
 
-export { resetActionCircuitExternally, getBlockingActionCircuit, resolveConfiguredAgentModel, resolveRegisteredAgentModel, resolveEffectiveAgentOverride, dcNormalizeCommand, dcUnwrapWrappers, dcSplitSegments, dcExtractRecursiveRmTargets, dcEvaluateRecursiveDeleteTargets, dcCheckJunctionCreation, dcExtractWindowsCmdTargets, dcExtractPowerShellTargets, getSharedClassifierGuardrailBlock, classifyCommand, MAX_PARALLEL_VERDICT_TASKS, computeParallelVerdict, resetArchitectPromptBudgetAdvisories, createArchitectAgent, createCoderAgent, GENERALIST_COUNCIL_PROMPT, SKEPTIC_COUNCIL_PROMPT, DOMAIN_EXPERT_COUNCIL_PROMPT, createCriticAgent, createCuratorAgent, createDesignerAgent, createDocsAgent, createResearcherAgent, SECURITY_CATEGORIES, createReviewerAgent, createSMEAgent, createTestEngineerAgent, _internals132 as _internals, stripSwarmPrefix, extractSwarmIdFromAgentName, resolveFallbackModel, getSwarmAgents, createAgents, resolvePrimaryAgentNames, getAgentConfigs, SWARM_COMMAND_TOOL_COMMANDS, SWARM_COMMAND_TOOL_ALLOWLIST, HUMAN_ONLY_SWARM_COMMANDS, classifySwarmCommandToolUse, classifySwarmCommandChatFallbackUse, detectPosixWrites, detectWindowsWrites, resolveWriteTargets, getAgentSession, parseLeanLaneIndex, computeLaneRuntimeProfile, MAX_TRACKED_STANDARD_WORKTREE_CALLS, awaitingMergeByCallID, standardWorktreeByCallID, standardWorktreeSerializationSessions, getStandardWorktreeDegradationReason, resetStandardWorktreeIsolationState, checkStandardWorktreeSerializationRelease, sanitizeWorktreeTaskId, preProvisionCollisionCheck, isLaneOwnedByCurrentSession, precreateStandardWorktreeSession, preserveBackgroundWorktreeOwnershipForCallId, preserveDirtyWorktreeForCallId, preserveDirtyWorktreeAtPath, cleanupStandardWorktreeForCallId, abortStandardWorktreeDispatch, finishStandardWorktreeDispatch, readLaneEnvFileFromDisk, _internals24 as _internals1, redactSecrets, prWorkflowSessionFileStem, ensurePrWorkflowSafeParentDirectory, writePrWorkflowAtomicJson, PrWorkflowCheckoutMutationTimeoutError, withPrWorkflowCheckoutMutationLock, PR_REVIEW_REPORT_VERDICTS, allowedPrReviewReportVerdicts, normalizePrReviewPartialBaseCoverageRecord, rollbackPrReviewPartialBaseCoverageAdmission, readPrReviewTerminalCoverageForReport, PR_REVIEW_REQUIRED_MICRO_LANE_IDS, PR_REVIEW_DEPTH_TIER_THRESHOLDS, PR_REVIEW_BASE_LANE_FLOORS, PR_REVIEW_TIER_L_CONSOLIDATED_LANE_FLOOR, PR_REVIEW_MICRO_LANE_FLOORS, computePrReviewDepthTier, MAX_PR_REVIEW_SUBMIT_REJECTIONS, MAX_PR_FEEDBACK_INVENTORY_AMENDMENTS, activatePrWorkflow, appendPrWorkflowSkillContractAdvisories, readPrWorkflowGateState, recordPrReviewSubmitRejection, latestPrReviewSubmitRejectionMessage, submitPrReviewResult, withPrWorkflowCheckoutPreparationLock, withInactivePrWorkflowCheckoutRestoreLock, clearPrWorkflowGateState, terminalizePrWorkflowGateForSession2 as terminalizePrWorkflowGateForSession, PR_WORKFLOW_PROBE_SKIPPED_NO_BUDGET_REASON, collectPrWorkflowPendingLaneLiveness, settlePresumedStalePrWorkflowLanes, abortPrWorkflow, recoverArmedPrWorkflow, bindPrWorkflowHead, rebindPrFeedbackHead, bindPrReviewBase, assertCurrentCheckoutHead, assertPrReviewCleanCheckout, enforcePrWorkflowDispatchLanesAsync, PrReviewResilienceCircuitOpenError, PrReviewResilienceRetryExhaustedError, enforcePrReviewBaseDimensions, rollbackPrReviewBaseAdmissionIfUnlaunched, admitPrReviewPartialBaseCoverage2 as admitPrReviewPartialBaseCoverage, assertPrReviewBaseCoverageSettled2 as assertPrReviewBaseCoverageSettled, recordPrReviewValidationBatch, assertPrReviewValidationSettled, declarePrFeedbackInventory, enforcePrFeedbackVerificationOwnership, assertPrFeedbackVerificationSettled, recordPrFeedbackStageA, recordPrFeedbackGateBatch, assertPrFeedbackGatePhaseSettled, assertPrFeedbackReadyToPublish, invalidatePrFeedbackPublication, describePrWorkflowPublicationSection, findDanglingLivePublicationGeneration, recordPrFeedbackPushAttemptResult, cancelPrFeedbackPublication, resolvePrReviewWriterRunId, markPrReviewTriggerEvaluationComplete, bindPrReviewTriggerLedger, assertPrReviewArtifactBoundary, assertPrReviewArtifactRecordsMatchAuthoritativeVerdicts, markPrReviewArtifactBoundary, markPrReviewHandoffComplete, readPrReviewFinalFindingPolicyForReport, transitionPrReviewToFeedback, declarePrFeedbackScope, resolvePrFeedbackScopeDeclaration, consumePrFeedbackScopeDeclaration, validatePrFeedbackScopeBinding, enforcePrWorkflowToolBefore, readPrReviewReentryBindingContext, hasActivePrReviewReentryAuthorization, reserveActivePrReviewReentryAuthorization, completePrWorkflow, _test_exports2 as _test_exports, normalizePrWorkflowShellCommand, describePrWorkflowRevisionDigestFailure, readAuthoritativePrReviewCriticSettlements, readAuthoritativePrReviewCriticVerdicts, formatPrReviewLaneValidationFailure, validatePrReviewDiscoveryLaneCompletion2 as validatePrReviewDiscoveryLaneCompletion, validatePrWorkflowTransportRecovery, prReviewDiscoveryArtifactCoversLane, MAX_SALVAGED_SCHEMA_ERROR_CHARS, readPrWorkflowGateStateForRecovery, handleAcknowledgeSpecDriftCommand, handleAgentsCommand, handleAnalyzeCommand, handleApproveWriteCommand, handleArchiveCommand, handleAutoProceedCommand, handleBenchmarkCommand, handleBrainstormCommand, handleCheckpointCommand, DEFAULT_CI_DEADLINE_MS2 as DEFAULT_CI_DEADLINE_MS, createSignalCancellation, handleCiCommand, handleCiSimulateCommand, handleClarifyCommand, safeRealpathSync, createCuratorLLMDelegate, startSnapshotCoordinationInitialization, ensureSnapshotCoordinationReady, retrySnapshotCoordinationInitialization, getSnapshotCoordinationStatus, beginSnapshotCoordinationReset, closeSnapshotCoordinationInitialization, markSnapshotCoordinationClosing, _snapshotCoordinationInternals, handleCloseCommand, _internals56 as _internals2, normalizeRecommendationEntryIdToken, parseKnowledgeRecommendations, parseKnowledgeRecommendationsWithDiagnostics, parseStructuredCuratorBlocks, readCuratorSummary, writeCuratorSummary, appendCuratorRecommendation, mergeCuratorPhaseSummary, filterPhaseEvents, checkPhaseCompliance, runCuratorInit, runCuratorPhase, applyCuratorKnowledgeUpdates, isHiveEligible, countDistinctProjects, checkHivePromotions, _internals60 as _internals3, createHivePromoterHook, promoteToHive, promoteFromSwarm, createMemoryGateway, handleCodebaseReviewCommand, handleConcurrencyCommand, handleConfigCommand, handleConsolidateCommand, handleCostsCommand, handleCouncilCommand, getCoChangePairs, handleCurateCommand, handleDarkMatterCommand, handleDeepDiveCommand, handleDeepResearchCommand, getHostConfigDir, getPluginCachePaths, getPluginLockFilePaths, VERSION_PINNED_LEAF, discoverVersionPinnedCachePaths, readCachePackageVersion, handleDiagnoseCommand, handleDoctorCommand, handleEvidenceCommand, handleEvidenceSummaryCommand, handleExportCommand, handleFullAutoCommand, computeQualityBudget, computeSastScan, handleGateAuditCommand, handleGateStatsCommand, handleHandoffCommand, handleBlueprintValidateCommand, handleBlueprintCurrentCommand, handleBlueprintHistoryCommand, handleBlueprintDiffCommand, handleBlueprintExportCommand, handleHarnessCandidateValidateCommand, handleHarnessCandidateShowCommand, handleHarnessCandidateDiffCommand, handleHistoryCommand, handleKnowledgeQuarantineCommand, handleKnowledgeRestoreCommand, handleKnowledgeMigrateCommand, handleKnowledgeListCommand, handleKnowledgeUnactionableCommand, handleKnowledgeRetryHardeningCommand, handleLearningCommand, handleLinkCommand, searchKnowledge, symbols, handleMemoryCommand, handleMemoryStatusCommand, handleMemoryValueLogCommand, handleMemoryMigrateCommand, handleMemoryImportCommand, handleMemoryExportCommand, handlePlanCommand, handlePreflightCommand, handlePromoteCommand, handleQaGatesCommand, handleRecoverCommand, handleResetCommand, handleResetSessionCommand, handleRetrieveCommand, handleReviewCommand, handleRollbackCommand, handleSddStatusCommand, handleSddValidateCommand, handleSddProjectCommand, handleSddCommand, handleSimulateCommand, handleSpecifyCommand, handleStatusCommand, handleSyncPlanCommand, handleTurboCommand, handleUnlinkCommand, handleWriteRetroCommand, handleHelpCommand, isCommandFailure, COMMAND_REGISTRY, VALID_COMMANDS, _internals27 as _internals4, resolveCommand, normalizeSwarmCommandInput, canonicalCommandKey, formatCommandNotFound, executeSwarmCommand };
+export { resetActionCircuitExternally, getBlockingActionCircuit, resolveConfiguredAgentModel, resolveRegisteredAgentModel, resolveEffectiveAgentOverride, dcNormalizeCommand, dcUnwrapWrappers, dcSplitSegments, dcExtractRecursiveRmTargets, dcEvaluateRecursiveDeleteTargets, dcCheckJunctionCreation, dcExtractWindowsCmdTargets, dcExtractPowerShellTargets, getSharedClassifierGuardrailBlock, classifyCommand, MAX_PARALLEL_VERDICT_TASKS, computeParallelVerdict, resetArchitectPromptBudgetAdvisories, createArchitectAgent, createCoderAgent, GENERALIST_COUNCIL_PROMPT, SKEPTIC_COUNCIL_PROMPT, DOMAIN_EXPERT_COUNCIL_PROMPT, createCriticAgent, createCuratorAgent, createDesignerAgent, createDocsAgent, createResearcherAgent, SECURITY_CATEGORIES, createReviewerAgent, createSMEAgent, createTestEngineerAgent, _internals132 as _internals, stripSwarmPrefix, extractSwarmIdFromAgentName, resolveFallbackModel, getSwarmAgents, createAgents, resolvePrimaryAgentNames, getAgentConfigs, SWARM_COMMAND_TOOL_COMMANDS, SWARM_COMMAND_TOOL_ALLOWLIST, HUMAN_ONLY_SWARM_COMMANDS, classifySwarmCommandToolUse, classifySwarmCommandChatFallbackUse, detectPosixWrites, detectWindowsWrites, resolveWriteTargets, getAgentSession, parseLeanLaneIndex, computeLaneRuntimeProfile, MAX_TRACKED_STANDARD_WORKTREE_CALLS, awaitingMergeByCallID, standardWorktreeByCallID, standardWorktreeSerializationSessions, getStandardWorktreeDegradationReason, resetStandardWorktreeIsolationState, checkStandardWorktreeSerializationRelease, sanitizeWorktreeTaskId, preProvisionCollisionCheck, isLaneOwnedByCurrentSession, precreateStandardWorktreeSession, preserveBackgroundWorktreeOwnershipForCallId, preserveDirtyWorktreeForCallId, preserveDirtyWorktreeAtPath, cleanupStandardWorktreeForCallId, abortStandardWorktreeDispatch, finishStandardWorktreeDispatch, readLaneEnvFileFromDisk, _internals24 as _internals1, redactSecrets, prWorkflowSessionFileStem, ensurePrWorkflowSafeParentDirectory, writePrWorkflowAtomicJson, PrWorkflowCheckoutMutationTimeoutError, withPrWorkflowCheckoutMutationLock, PR_REVIEW_REPORT_VERDICTS, allowedPrReviewReportVerdicts, normalizePrReviewPartialBaseCoverageRecord, rollbackPrReviewPartialBaseCoverageAdmission, readPrReviewTerminalCoverageForReport, PR_REVIEW_REQUIRED_MICRO_LANE_IDS, PR_REVIEW_DEPTH_TIER_THRESHOLDS, PR_REVIEW_BASE_LANE_FLOORS, PR_REVIEW_TIER_L_CONSOLIDATED_LANE_FLOOR, PR_REVIEW_MICRO_LANE_FLOORS, computePrReviewDepthTier, MAX_PR_REVIEW_SUBMIT_REJECTIONS, MAX_PR_FEEDBACK_INVENTORY_AMENDMENTS, activatePrWorkflow, appendPrWorkflowSkillContractAdvisories, readPrWorkflowGateState, recordPrReviewSubmitRejection, latestPrReviewSubmitRejectionMessage, submitPrReviewResult, withPrWorkflowCheckoutPreparationLock, withInactivePrWorkflowCheckoutRestoreLock, clearPrWorkflowGateState, terminalizePrWorkflowGateForSession2 as terminalizePrWorkflowGateForSession, PR_WORKFLOW_PROBE_SKIPPED_NO_BUDGET_REASON, collectPrWorkflowPendingLaneLiveness, settlePresumedStalePrWorkflowLanes, abortPrWorkflow, recoverArmedPrWorkflow, bindPrWorkflowHead, rebindPrFeedbackHead, bindPrReviewBase, assertCurrentCheckoutHead, assertPrReviewCleanCheckout, enforcePrWorkflowDispatchLanesAsync, PrReviewResilienceCircuitOpenError, PrReviewResilienceRetryExhaustedError, enforcePrReviewBaseDimensions, rollbackPrReviewBaseAdmissionIfUnlaunched, admitPrReviewPartialBaseCoverage2 as admitPrReviewPartialBaseCoverage, assertPrReviewBaseCoverageSettled2 as assertPrReviewBaseCoverageSettled, recordPrReviewMicroFamilyDispatch, recordPrReviewValidationBatch, assertPrReviewValidationSettled, declarePrFeedbackInventory, enforcePrFeedbackVerificationOwnership, assertPrFeedbackVerificationSettled, recordPrFeedbackStageA, recordPrFeedbackGateBatch, assertPrFeedbackGatePhaseSettled, assertPrFeedbackReadyToPublish, invalidatePrFeedbackPublication, describePrWorkflowPublicationSection, findDanglingLivePublicationGeneration, recordPrFeedbackPushAttemptResult, cancelPrFeedbackPublication, resolvePrReviewWriterRunId, markPrReviewTriggerEvaluationComplete, bindPrReviewTriggerLedger, assertPrReviewArtifactBoundary, assertPrReviewArtifactRecordsMatchAuthoritativeVerdicts, markPrReviewArtifactBoundary, markPrReviewHandoffComplete, readPrReviewFinalFindingPolicyForReport, transitionPrReviewToFeedback, declarePrFeedbackScope, resolvePrFeedbackScopeDeclaration, consumePrFeedbackScopeDeclaration, validatePrFeedbackScopeBinding, enforcePrWorkflowToolBefore, readPrReviewReentryBindingContext, hasActivePrReviewReentryAuthorization, reserveActivePrReviewReentryAuthorization, completePrWorkflow, _test_exports2 as _test_exports, normalizePrWorkflowShellCommand, describePrWorkflowRevisionDigestFailure, readAuthoritativePrReviewCriticSettlements, readAuthoritativePrReviewCriticVerdicts, formatPrReviewLaneValidationFailure, validatePrReviewDiscoveryLaneCompletion2 as validatePrReviewDiscoveryLaneCompletion, validatePrWorkflowTransportRecovery, prReviewDiscoveryArtifactCoversLane, MAX_SALVAGED_SCHEMA_ERROR_CHARS, readPrWorkflowGateStateForRecovery, handleAcknowledgeSpecDriftCommand, handleAgentsCommand, handleAnalyzeCommand, handleApproveWriteCommand, handleArchiveCommand, handleAutoProceedCommand, handleBenchmarkCommand, handleBrainstormCommand, handleCheckpointCommand, DEFAULT_CI_DEADLINE_MS2 as DEFAULT_CI_DEADLINE_MS, createSignalCancellation, handleCiCommand, handleCiSimulateCommand, handleClarifyCommand, safeRealpathSync, createCuratorLLMDelegate, startSnapshotCoordinationInitialization, ensureSnapshotCoordinationReady, retrySnapshotCoordinationInitialization, getSnapshotCoordinationStatus, beginSnapshotCoordinationReset, closeSnapshotCoordinationInitialization, markSnapshotCoordinationClosing, _snapshotCoordinationInternals, handleCloseCommand, _internals56 as _internals2, normalizeRecommendationEntryIdToken, parseKnowledgeRecommendations, parseKnowledgeRecommendationsWithDiagnostics, parseStructuredCuratorBlocks, readCuratorSummary, writeCuratorSummary, appendCuratorRecommendation, mergeCuratorPhaseSummary, filterPhaseEvents, checkPhaseCompliance, runCuratorInit, runCuratorPhase, applyCuratorKnowledgeUpdates, isHiveEligible, countDistinctProjects, checkHivePromotions, _internals60 as _internals3, createHivePromoterHook, promoteToHive, promoteFromSwarm, createMemoryGateway, handleCodebaseReviewCommand, handleConcurrencyCommand, handleConfigCommand, handleConsolidateCommand, handleCostsCommand, handleCouncilCommand, getCoChangePairs, handleCurateCommand, handleDarkMatterCommand, handleDeepDiveCommand, handleDeepResearchCommand, getHostConfigDir, getPluginCachePaths, getPluginLockFilePaths, VERSION_PINNED_LEAF, discoverVersionPinnedCachePaths, readCachePackageVersion, handleDiagnoseCommand, handleDoctorCommand, handleEvidenceCommand, handleEvidenceSummaryCommand, handleExportCommand, handleFullAutoCommand, computeQualityBudget, computeSastScan, handleGateAuditCommand, handleGateStatsCommand, handleHandoffCommand, handleBlueprintValidateCommand, handleBlueprintCurrentCommand, handleBlueprintHistoryCommand, handleBlueprintDiffCommand, handleBlueprintExportCommand, handleHarnessCandidateValidateCommand, handleHarnessCandidateShowCommand, handleHarnessCandidateDiffCommand, handleHistoryCommand, handleKnowledgeQuarantineCommand, handleKnowledgeRestoreCommand, handleKnowledgeMigrateCommand, handleKnowledgeListCommand, handleKnowledgeUnactionableCommand, handleKnowledgeRetryHardeningCommand, handleLearningCommand, handleLinkCommand, searchKnowledge, symbols, handleMemoryCommand, handleMemoryStatusCommand, handleMemoryValueLogCommand, handleMemoryMigrateCommand, handleMemoryImportCommand, handleMemoryExportCommand, handlePlanCommand, handlePreflightCommand, handlePromoteCommand, handleQaGatesCommand, handleRecoverCommand, handleResetCommand, handleResetSessionCommand, handleRetrieveCommand, handleReviewCommand, handleRollbackCommand, handleSddStatusCommand, handleSddValidateCommand, handleSddProjectCommand, handleSddCommand, handleSimulateCommand, handleSpecifyCommand, handleStatusCommand, handleSyncPlanCommand, handleTurboCommand, handleUnlinkCommand, handleWriteRetroCommand, handleHelpCommand, isCommandFailure, COMMAND_REGISTRY, VALID_COMMANDS, _internals27 as _internals4, resolveCommand, normalizeSwarmCommandInput, canonicalCommandKey, formatCommandNotFound, executeSwarmCommand };