opencode-swarm 7.186.8 → 7.187.0

package/dist/cli/{index-5dgg9vhz.js → index-hvr82s1t.js}

@@ -7,7 +7,7 @@ import {
   loadPlan,
   transientBackoff,
   updateTaskCheckpointReceipt
-} from "./index-xgsy3hzf.js";
+} from "./index-d6kvatwp.js";
 import {
   tool
 } from "./index-9nyqt3kb.js";
@@ -18,12 +18,15 @@ import {
   isSpawnCwdMissing,
   isSpawnCwdUnreadable
 } from "./index-g4fs6z4e.js";
+import {
+  validateSwarmPath
+} from "./index-bejxkee0.js";
 import {
   readLedgerEvents
-} from "./index-2nbws8bd.js";
+} from "./index-5m56c5r6.js";
 import {
   appendCoreEventSync
-} from "./index-zcpd36zm.js";
+} from "./index-ww8payq9.js";
 import {
   derivePlanId,
   derivePlanIdentityHash
@@ -36,9 +39,12 @@ import {
 import {
   tryAcquireLock
 } from "./index-ejhxgyvm.js";
+import {
+  atomicWriteSwarmFileSync
+} from "./index-r6e8syr3.js";
 import {
   loadPluginConfigWithMeta
-} from "./index-cvwkjnr5.js";
+} from "./index-469xmpd6.js";
 import {
   init_git_executable,
   resolveGitExecutable
@@ -47,20 +53,443 @@ import {
   exports_external,
   init_zod
 } from "./index-gknz3bv1.js";
+import {
+  init_logger,
+  log
+} from "./index-zgwm4ryv.js";
 
 // src/tools/checkpoint.ts
 init_zod();
 import * as child_process from "child_process";
+import * as fs4 from "fs";
+import * as path5 from "path";
+
+// src/commands/destructive-purge.ts
+import { createHash, randomBytes } from "crypto";
+import * as fs from "fs";
+import * as path from "path";
+init_logger();
+var PENDING_PURGE_PATH = "pending-purge.json";
+var PENDING_PURGE_TTL_MS = 15 * 60 * 1000;
+var _internals = {
+  readFileSync: fs.readFileSync,
+  rmSync: fs.rmSync.bind(fs),
+  existsSync: fs.existsSync.bind(fs),
+  atomicWriteSwarmFileSync,
+  now: () => Date.now(),
+  randomBytes,
+  scopeDigest
+};
+function pendingPath(directory) {
+  return validateSwarmPath(directory, PENDING_PURGE_PATH);
+}
+function resolveCandidates(scopeTarget, extra) {
+  if (extra?.candidates && extra.candidates.length > 0) {
+    return { kind: extra.kind ?? "set", candidates: extra.candidates };
+  }
+  return {
+    kind: extra?.kind ?? "single",
+    candidates: [{ path: scopeTarget, reason: "operator-requested" }]
+  };
+}
+function scopeDigest(kind, candidates) {
+  const paths = candidates.map((c) => {
+    const resolved = path.resolve(c.path);
+    if (resolved.includes("\x00") || resolved.includes(`
+`)) {
+      throw new Error(`Purge candidate path contains a NUL or newline separator character and cannot be scope-bound: ${JSON.stringify(resolved)}`);
+    }
+    return resolved;
+  });
+  const sorted = paths.sort().join(`
+`);
+  return createHash("sha256").update(`${kind}\x00${sorted}`).digest("hex");
+}
+function mintToken(digest) {
+  return createHash("sha256").update(`${digest}:${_internals.randomBytes(16).toString("hex")}`).digest("hex").slice(0, 24);
+}
+function readPending(directory) {
+  try {
+    const raw = _internals.readFileSync(pendingPath(directory), "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || parsed.schemaVersion !== 1 || typeof parsed.scopeDigest !== "string" || typeof parsed.confirmToken !== "string" || typeof parsed.createdAt !== "number") {
+      return null;
+    }
+    if (!Number.isFinite(parsed.createdAt))
+      return null;
+    if (parsed.createdAt > _internals.now() + 60000)
+      return null;
+    if (_internals.now() - parsed.createdAt > PENDING_PURGE_TTL_MS) {
+      return null;
+    }
+    return {
+      schemaVersion: 1,
+      scopeDigest: parsed.scopeDigest,
+      confirmToken: parsed.confirmToken,
+      createdAt: parsed.createdAt
+    };
+  } catch {
+    return null;
+  }
+}
+function writePending(directory, record) {
+  _internals.atomicWriteSwarmFileSync(pendingPath(directory), JSON.stringify(record, null, 2));
+}
+function previewDestructivePurge(scopeTarget, projectRoot, extra) {
+  const scope = resolveCandidates(scopeTarget, extra);
+  const previewLines = [
+    `Destructive purge preview (${scope.candidates.length} candidate(s)) for ${projectRoot}:`,
+    ...scope.candidates.map((c) => `  - ${c.path} (${c.reason})`),
+    "Uncommitted work inside these directories will be DESTROYED."
+  ];
+  return {
+    previewLines,
+    counts: { total: scope.candidates.length },
+    optionLabel: `--confirm=<token>`,
+    confirmToken: "<run again to receive your confirm token>",
+    candidates: scope.candidates
+  };
+}
+function issueConfirmToken(scopeTarget, projectRoot, extra) {
+  const scope = resolveCandidates(scopeTarget, extra);
+  const digest = scopeDigest(scope.kind, scope.candidates);
+  const token = mintToken(digest);
+  writePending(projectRoot, {
+    schemaVersion: 1,
+    scopeDigest: digest,
+    confirmToken: token,
+    createdAt: _internals.now()
+  });
+  return token;
+}
+function consumeConfirmToken(scopeTarget, projectRoot, token, extra) {
+  const verdict = verifyPendingConfirmToken(scopeTarget, projectRoot, token, extra);
+  if (!verdict.ok)
+    return verdict;
+  try {
+    _internals.rmSync(pendingPath(projectRoot), { force: true });
+  } catch (error) {
+    log(`[destructive-purge] could not consume pending record: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return { ok: true };
+}
+function verifyPendingConfirmToken(scopeTarget, projectRoot, token, extra) {
+  const pending = readPending(projectRoot);
+  if (!pending) {
+    return {
+      ok: false,
+      reason: "no pending purge for this scope (expired, overwritten, or already executed)"
+    };
+  }
+  const scope = resolveCandidates(scopeTarget, extra);
+  const digest = scopeDigest(scope.kind, scope.candidates);
+  if (pending.confirmToken !== token) {
+    return { ok: false, reason: "confirm token mismatch" };
+  }
+  if (pending.scopeDigest !== digest) {
+    return {
+      ok: false,
+      reason: "purge scope changed since the token was issued \u2014 re-run the preview and confirm the new token"
+    };
+  }
+  return { ok: true };
+}
+function executeDestructivePurge(scopeTarget, projectRoot, token, extra) {
+  const verdict = verifyPendingConfirmToken(scopeTarget, projectRoot, token, extra);
+  if (!verdict.ok)
+    return verdict;
+  const { candidates } = resolveCandidates(scopeTarget, extra);
+  const purged = [];
+  for (const candidate of candidates) {
+    if (!_internals.existsSync(candidate.path))
+      continue;
+    try {
+      _internals.rmSync(candidate.path, { recursive: true, force: true });
+      purged.push(candidate.path);
+    } catch (error) {
+      try {
+        _internals.rmSync(pendingPath(projectRoot), { force: true });
+      } catch {}
+      return {
+        ok: false,
+        reason: `candidate ${candidate.path} could not be purged: ${error instanceof Error ? error.message : String(error)}`
+      };
+    }
+  }
+  try {
+    _internals.rmSync(pendingPath(projectRoot), { force: true });
+  } catch (error) {
+    log(`[destructive-purge] could not consume pending record: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  return { ok: true, purged };
+}
+
+// src/commands/reset-backup.ts
 import * as fs2 from "fs";
 import * as path2 from "path";
+var RESET_BACKUP_RETENTION = 5;
+function backupSwarmStateBeforeReset(directory, kind, relEntries, opts) {
+  const warnings = [];
+  const copied = [];
+  const swarmDir = path2.join(directory, ".swarm");
+  try {
+    const stat = fs2.lstatSync(swarmDir);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+      warnings.push("backup skipped: .swarm is a symlink or not a directory \u2014 nothing was backed up");
+      return { backupDir: null, copied, warnings };
+    }
+  } catch {
+    warnings.push("backup skipped: .swarm directory is missing \u2014 nothing was backed up");
+    return { backupDir: null, copied, warnings };
+  }
+  const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
+  const backupsRoot = path2.join(swarmDir, opts?.backupsRoot ?? "reset-backups");
+  const backupDir = path2.join(backupsRoot, `${kind}-${timestamp}`);
+  let backupDirCreated = false;
+  const ensureBackupDir = () => {
+    if (!backupDirCreated) {
+      fs2.mkdirSync(backupDir, { recursive: true });
+      backupDirCreated = true;
+    }
+  };
+  for (const rel of relEntries) {
+    let src;
+    try {
+      src = validateSwarmPath(directory, rel);
+    } catch {
+      warnings.push(`skipped backup of ${rel} (path validation failed)`);
+      continue;
+    }
+    if (!fs2.existsSync(src))
+      continue;
+    try {
+      ensureBackupDir();
+      const dest = path2.join(backupDir, rel);
+      fs2.mkdirSync(path2.dirname(dest), { recursive: true });
+      fs2.cpSync(src, dest, { recursive: true });
+      copied.push(rel);
+    } catch (err) {
+      warnings.push(`failed to back up ${rel}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  if (copied.length === 0) {
+    if (backupDirCreated) {
+      try {
+        fs2.rmSync(backupDir, { recursive: true, force: true });
+      } catch {}
+    }
+    return { backupDir: null, copied, warnings };
+  }
+  pruneOldResetBackups(backupsRoot, warnings, path2.basename(backupDir));
+  return { backupDir, copied, warnings };
+}
+var BACKUP_KIND_PREFIXES = [
+  "reset-session-",
+  "rollback-git-",
+  "rollback-",
+  "reset-"
+];
+function backupTimestampSortKey(name) {
+  for (const prefix of BACKUP_KIND_PREFIXES) {
+    if (name.startsWith(prefix)) {
+      return name.slice(prefix.length).replace(/\D/g, "");
+    }
+  }
+  return "";
+}
+function pruneOldResetBackups(backupsRoot, warnings, keepDirName) {
+  try {
+    const entries = fs2.readdirSync(backupsRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => ({ name: e.name, key: backupTimestampSortKey(e.name) })).sort((a, b) => a.key === b.key ? b.name.localeCompare(a.name) : b.key.localeCompare(a.key));
+    for (const stale of entries.slice(RESET_BACKUP_RETENTION)) {
+      if (stale.name === keepDirName)
+        continue;
+      try {
+        fs2.rmSync(path2.join(backupsRoot, stale.name), {
+          recursive: true,
+          force: true
+        });
+      } catch (err) {
+        warnings.push(`failed to prune old backup ${stale.name}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+  } catch (err) {
+    warnings.push(`failed to prune old reset backups: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function backupTrackedChangesBeforeRollback(directory, repoRelPaths) {
+  const warnings = [];
+  const copied = [];
+  const swarmDir = path2.join(directory, ".swarm");
+  try {
+    const stat = fs2.lstatSync(swarmDir);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+      warnings.push("backup skipped: .swarm is a symlink or not a directory \u2014 nothing was backed up");
+      return { backupDir: null, copied, warnings };
+    }
+  } catch {
+    warnings.push("backup skipped: .swarm directory is missing \u2014 nothing was backed up");
+    return { backupDir: null, copied, warnings };
+  }
+  const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
+  const backupsRoot = path2.join(swarmDir, "rollback-backups");
+  const backupDir = path2.join(backupsRoot, `rollback-git-${timestamp}`);
+  let backupDirCreated = false;
+  const ensureBackupDir = () => {
+    if (!backupDirCreated) {
+      fs2.mkdirSync(backupDir, { recursive: true });
+      backupDirCreated = true;
+    }
+  };
+  for (const rel of repoRelPaths) {
+    if (!rel)
+      continue;
+    const src = path2.join(directory, rel);
+    if (!fs2.existsSync(src))
+      continue;
+    try {
+      ensureBackupDir();
+      const dest = path2.join(backupDir, "tracked", rel);
+      fs2.mkdirSync(path2.dirname(dest), { recursive: true });
+      fs2.cpSync(src, dest, { recursive: true });
+      copied.push(rel);
+    } catch (err) {
+      warnings.push(`failed to back up ${rel}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  if (copied.length === 0) {
+    if (backupDirCreated) {
+      try {
+        fs2.rmSync(backupDir, { recursive: true, force: true });
+      } catch {}
+    }
+    return { backupDir: null, copied, warnings };
+  }
+  pruneOldResetBackups(backupsRoot, warnings, path2.basename(backupDir));
+  return { backupDir, copied, warnings };
+}
+
+// src/commands/rollback-gate.ts
+init_git_executable();
+import { spawnSync } from "child_process";
+import * as fsSync from "fs";
+import * as path3 from "path";
+var ROLLBACK_GIT_KIND = "swarm-rollback-git";
+var ROLLBACK_PHASE_KIND = "swarm-rollback-phase";
+var GIT_STATUS_TIMEOUT_MS = 1e4;
+var GIT_LIST_MAX_BUFFER_BYTES = 32 * 1024 * 1024;
+var _rollbackGateInternals = {
+  runGit: (args, cwd) => {
+    const result = spawnSync(resolveGitExecutable(), args, {
+      cwd,
+      encoding: "utf-8",
+      timeout: GIT_STATUS_TIMEOUT_MS,
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (result.error || result.status !== 0)
+      return null;
+    return result.stdout ?? "";
+  },
+  runGitBuffered: (args, cwd) => {
+    const result = spawnSync(resolveGitExecutable(), args, {
+      cwd,
+      encoding: "utf-8",
+      timeout: GIT_STATUS_TIMEOUT_MS,
+      windowsHide: true,
+      maxBuffer: GIT_LIST_MAX_BUFFER_BYTES,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (result.error || result.status !== 0)
+      return null;
+    return result.stdout ?? "";
+  }
+};
+function isRealGitRepository(directory) {
+  try {
+    if (fsSync.statSync(path3.join(directory, ".git")).isFile())
+      return true;
+  } catch {
+    return false;
+  }
+  return fsSync.existsSync(path3.join(directory, ".git", "HEAD"));
+}
+function parseTrackedDirtyPaths(statusOutput) {
+  const dirtyPaths = [];
+  const tokens = statusOutput.split("\x00");
+  for (let i = 0;i < tokens.length; i += 1) {
+    const token = tokens[i];
+    if (token === "" || token.length < 4)
+      continue;
+    const xy = token.slice(0, 2);
+    if (xy === "??")
+      continue;
+    const filePath = token.slice(3);
+    if (!filePath)
+      continue;
+    dirtyPaths.push(filePath);
+    if (/[RC]/.test(xy) && i + 1 < tokens.length && tokens[i + 1] !== "") {
+      dirtyPaths.push(tokens[i + 1]);
+      i += 1;
+    }
+  }
+  return dirtyPaths;
+}
+function untrackedPathsInTargetTree(directory, targetSha) {
+  if (!isRealGitRepository(directory))
+    return [];
+  const targetTree = _rollbackGateInternals.runGitBuffered(["ls-tree", "-r", "-z", "--name-only", targetSha], directory);
+  const index = _rollbackGateInternals.runGitBuffered(["ls-files", "-z"], directory);
+  if (targetTree === null || index === null)
+    return [];
+  const indexed = new Set(index.split("\x00").filter((p) => p !== ""));
+  const inWay = [];
+  for (const rel of targetTree.split("\x00")) {
+    if (rel === "" || indexed.has(rel))
+      continue;
+    if (fsSync.existsSync(path3.join(directory, rel)))
+      inWay.push(rel);
+  }
+  return inWay;
+}
+function trackedDirtyCandidates(directory, dirtyRelPaths) {
+  return dirtyRelPaths.map((rel) => ({
+    path: path3.join(directory, rel),
+    reason: "uncommitted tracked change \u2014 destroyed by git reset --hard"
+  }));
+}
+function swarmOverwriteCandidates(directory, overwriteRelPaths) {
+  return overwriteRelPaths.map((rel) => ({
+    path: path3.join(directory, ".swarm", rel),
+    reason: "live .swarm state replaced by the checkpoint copy"
+  }));
+}
+function measureGitDestruction(directory, targetSha) {
+  if (!isRealGitRepository(directory)) {
+    return { kind: "ok", dirtyRelPaths: [] };
+  }
+  const status = _rollbackGateInternals.runGit(["status", "--porcelain", "-z"], directory);
+  if (status === null) {
+    return { kind: "unreadable" };
+  }
+  const dirtyRelPaths = parseTrackedDirtyPaths(status);
+  if (targetSha) {
+    for (const rel of untrackedPathsInTargetTree(directory, targetSha)) {
+      if (!dirtyRelPaths.includes(rel))
+        dirtyRelPaths.push(rel);
+    }
+  }
+  return { kind: "ok", dirtyRelPaths };
+}
+
+// src/tools/checkpoint.ts
 init_git_executable();
 
 // src/tools/create-tool.ts
 init_zod();
 
 // src/tools/resolve-working-directory.ts
-import * as fs from "fs";
-import * as path from "path";
+import * as fs3 from "fs";
+import * as path4 from "path";
 function resolveWorkingDirectory(workingDirectory, fallbackDirectory) {
   if (workingDirectory == null || workingDirectory === "") {
     if (typeof fallbackDirectory !== "string" || fallbackDirectory === "") {
@@ -105,11 +534,11 @@ function resolveWorkingDirectory(workingDirectory, fallbackDirectory) {
       message: "Invalid working_directory: path traversal sequences (..) are not allowed"
     };
   }
-  const normalizedDir = path.normalize(workingDirectory);
-  const resolvedDir = path.resolve(normalizedDir);
+  const normalizedDir = path4.normalize(workingDirectory);
+  const resolvedDir = path4.resolve(normalizedDir);
   let statResult;
   try {
-    statResult = fs.statSync(resolvedDir);
+    statResult = fs3.statSync(resolvedDir);
   } catch {
     return {
       success: false,
@@ -133,10 +562,10 @@ function resolveWorkingDirectory(workingDirectory, fallbackDirectory) {
   if (typeof fallbackDirectory !== "string" || fallbackDirectory === "") {
     return { success: true, directory: resolvedDir };
   }
-  const resolvedFallback = path.resolve(fallbackDirectory);
+  const resolvedFallback = path4.resolve(fallbackDirectory);
   let fallbackExists = false;
   try {
-    fs.statSync(resolvedFallback);
+    fs3.statSync(resolvedFallback);
     fallbackExists = true;
   } catch {
     fallbackExists = false;
@@ -238,11 +667,11 @@ var SHELL_METACHARACTERS = /[;|&$`(){}<>!'"]/;
 var SAFE_LABEL_PATTERN = /^[a-zA-Z0-9_ -]+$/;
 var CONTROL_CHAR_PATTERN = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 var NON_ASCII_PATTERN = /[^\x20-\x7E]/;
-var _internals = {
+var _internals2 = {
   tryAcquireLock,
   loadPlan,
   gitExec,
-  sleep: (ms) => new Promise((resolve2) => setTimeout(resolve2, ms)),
+  sleep: (ms) => new Promise((resolve3) => setTimeout(resolve3, ms)),
   findCommitByExactSubject,
   stageAllExcludingSwarm,
   resolveGitExecutable
@@ -296,13 +725,13 @@ function validateLabel(label) {
   return null;
 }
 function getCheckpointLogPath(directory) {
-  return path2.join(directory, CHECKPOINT_LOG_PATH);
+  return path5.join(directory, CHECKPOINT_LOG_PATH);
 }
 function readCheckpointLog(directory) {
   const logPath = getCheckpointLogPath(directory);
   try {
-    if (fs2.existsSync(logPath)) {
-      const content = fs2.readFileSync(logPath, "utf-8");
+    if (fs4.existsSync(logPath)) {
+      const content = fs4.readFileSync(logPath, "utf-8");
       const parsed = JSON.parse(content);
       if (!parsed.checkpoints || !Array.isArray(parsed.checkpoints)) {
         return { version: 1, checkpoints: [] };
@@ -312,15 +741,15 @@ function readCheckpointLog(directory) {
   } catch {}
   return { version: 1, checkpoints: [] };
 }
-function writeCheckpointLog(log, directory) {
+function writeCheckpointLog(log2, directory) {
   const logPath = getCheckpointLogPath(directory);
-  const dir = path2.dirname(logPath);
-  if (!fs2.existsSync(dir)) {
-    fs2.mkdirSync(dir, { recursive: true });
+  const dir = path5.dirname(logPath);
+  if (!fs4.existsSync(dir)) {
+    fs4.mkdirSync(dir, { recursive: true });
   }
   const tempPath = `${logPath}.tmp`;
-  fs2.writeFileSync(tempPath, JSON.stringify(log, null, 2), "utf-8");
-  fs2.renameSync(tempPath, logPath);
+  fs4.writeFileSync(tempPath, JSON.stringify(log2, null, 2), "utf-8");
+  fs4.renameSync(tempPath, logPath);
 }
 function appendRetentionEvent(directory, event) {
   try {
@@ -340,52 +769,52 @@ function loadCheckpointConfig(directory) {
   } catch {}
   return { maxCheckpoints, allowEmptyCommits };
 }
-function appendCheckpointEntry(directory, log, entry, maxCheckpoints) {
-  const existing = log.checkpoints.find((checkpoint) => checkpoint.label === entry.label);
+function appendCheckpointEntry(directory, log2, entry, maxCheckpoints) {
+  const existing = log2.checkpoints.find((checkpoint) => checkpoint.label === entry.label);
   if (existing) {
     if (existing.sha !== entry.sha) {
       throw new Error(`checkpoint log conflict: label "${entry.label}" already exists with a different SHA`);
     }
     return;
   }
-  log.checkpoints.push(entry);
-  if (log.checkpoints.length > maxCheckpoints) {
-    const evicted = log.checkpoints.splice(0, log.checkpoints.length - maxCheckpoints);
+  log2.checkpoints.push(entry);
+  if (log2.checkpoints.length > maxCheckpoints) {
+    const evicted = log2.checkpoints.splice(0, log2.checkpoints.length - maxCheckpoints);
     appendRetentionEvent(directory, {
       event: "checkpoint_retention_applied",
       evicted_labels: evicted.map((checkpoint) => checkpoint.label),
       evicted_count: evicted.length,
-      remaining_count: log.checkpoints.length
+      remaining_count: log2.checkpoints.length
     });
   }
 }
-function upsertTaskCompletionCheckpointEntry(directory, log, entry, maxCheckpoints) {
-  const existingIndex = log.checkpoints.findIndex((checkpoint) => checkpoint.label === entry.label);
+function upsertTaskCompletionCheckpointEntry(directory, log2, entry, maxCheckpoints) {
+  const existingIndex = log2.checkpoints.findIndex((checkpoint) => checkpoint.label === entry.label);
   if (existingIndex >= 0) {
-    const existing = log.checkpoints[existingIndex];
+    const existing = log2.checkpoints[existingIndex];
     if (existing.sha === entry.sha) {
       return;
     }
-    log.checkpoints[existingIndex] = entry;
+    log2.checkpoints[existingIndex] = entry;
     return;
   }
-  log.checkpoints.push(entry);
-  if (log.checkpoints.length > maxCheckpoints) {
-    const evicted = log.checkpoints.splice(0, log.checkpoints.length - maxCheckpoints);
+  log2.checkpoints.push(entry);
+  if (log2.checkpoints.length > maxCheckpoints) {
+    const evicted = log2.checkpoints.splice(0, log2.checkpoints.length - maxCheckpoints);
     appendRetentionEvent(directory, {
       event: "checkpoint_retention_applied",
       evicted_labels: evicted.map((checkpoint) => checkpoint.label),
       evicted_count: evicted.length,
-      remaining_count: log.checkpoints.length
+      remaining_count: log2.checkpoints.length
     });
   }
 }
 function stageAllExcludingSwarm(directory) {
-  _internals.gitExec(["add", "--all", "--", ...NON_SWARM_COMMIT_PATHSPEC], directory);
+  _internals2.gitExec(["add", "--all", "--", ...NON_SWARM_COMMIT_PATHSPEC], directory);
 }
 function gitExec(args, cwd) {
   for (let attempt = 0;attempt < MAX_TRANSIENT_RETRIES; attempt++) {
-    const result = child_process.spawnSync(_internals.resolveGitExecutable(), args, {
+    const result = child_process.spawnSync(_internals2.resolveGitExecutable(), args, {
       cwd,
       encoding: "utf-8",
       timeout: GIT_TIMEOUT_MS,
@@ -442,7 +871,7 @@ function isGitRepo(directory) {
   }
 }
 function findCommitByExactSubject(directory, subject) {
-  const output = _internals.gitExec([
+  const output = _internals2.gitExec([
     "log",
     "HEAD",
     "--format=%H%x00%s",
@@ -472,7 +901,7 @@ async function withTaskCompletionLocksResult(input) {
     attempts++;
     let planLockResult;
     try {
-      planLockResult = await _internals.tryAcquireLock(input.directory, PLAN_LOCK_PATH, CHECKPOINT_AGENT_NAME, `save-task-completion-plan-${input.taskId}`);
+      planLockResult = await _internals2.tryAcquireLock(input.directory, PLAN_LOCK_PATH, CHECKPOINT_AGENT_NAME, `save-task-completion-plan-${input.taskId}`);
     } catch (error) {
       if (input.onFailure) {
         return input.onFailure(error);
@@ -486,13 +915,13 @@ async function withTaskCompletionLocksResult(input) {
       if (attempts >= CHECKPOINT_LOCK_MAX_ATTEMPTS || Date.now() + CHECKPOINT_LOCK_DELAY_MS > deadline) {
         break;
       }
-      await _internals.sleep(CHECKPOINT_LOCK_DELAY_MS);
+      await _internals2.sleep(CHECKPOINT_LOCK_DELAY_MS);
       continue;
     }
     try {
       let checkpointLockResult;
       try {
-        checkpointLockResult = await _internals.tryAcquireLock(input.directory, CHECKPOINT_LOG_PATH, CHECKPOINT_AGENT_NAME, `save-task-completion-checkpoint-${input.taskId}`);
+        checkpointLockResult = await _internals2.tryAcquireLock(input.directory, CHECKPOINT_LOG_PATH, CHECKPOINT_AGENT_NAME, `save-task-completion-checkpoint-${input.taskId}`);
       } catch (error) {
         if (input.onFailure) {
           return input.onFailure(error);
@@ -506,7 +935,7 @@ async function withTaskCompletionLocksResult(input) {
         if (attempts >= CHECKPOINT_LOCK_MAX_ATTEMPTS || Date.now() + CHECKPOINT_LOCK_DELAY_MS > deadline) {
           break;
         }
-        await _internals.sleep(CHECKPOINT_LOCK_DELAY_MS);
+        await _internals2.sleep(CHECKPOINT_LOCK_DELAY_MS);
         continue;
       }
       try {
@@ -562,7 +991,7 @@ async function withCheckpointMutationLockResult(input) {
     attempts++;
     let lockResult;
     try {
-      lockResult = await _internals.tryAcquireLock(input.directory, CHECKPOINT_LOG_PATH, CHECKPOINT_AGENT_NAME, input.operationKey);
+      lockResult = await _internals2.tryAcquireLock(input.directory, CHECKPOINT_LOG_PATH, CHECKPOINT_AGENT_NAME, input.operationKey);
     } catch (error) {
       if (input.onFailure) {
         return input.onFailure(error);
@@ -599,7 +1028,7 @@ async function withCheckpointMutationLockResult(input) {
     if (attempts >= CHECKPOINT_LOCK_MAX_ATTEMPTS || Date.now() + CHECKPOINT_LOCK_DELAY_MS > deadline) {
       break;
     }
-    await _internals.sleep(CHECKPOINT_LOCK_DELAY_MS);
+    await _internals2.sleep(CHECKPOINT_LOCK_DELAY_MS);
   }
   if (input.onBusy) {
     return input.onBusy(attempts);
@@ -615,8 +1044,8 @@ async function withCheckpointMutationLockResult(input) {
 function handleSave(label, directory) {
   try {
     const { maxCheckpoints, allowEmptyCommits } = loadCheckpointConfig(directory);
-    const log = readCheckpointLog(directory);
-    const existingCheckpoint = log.checkpoints.find((checkpoint) => checkpoint.label === label);
+    const log2 = readCheckpointLog(directory);
+    const existingCheckpoint = log2.checkpoints.find((checkpoint) => checkpoint.label === label);
     if (existingCheckpoint) {
       return serializeResult("save", {
         success: false,
@@ -624,7 +1053,7 @@ function handleSave(label, directory) {
       });
     }
     const timestamp = new Date().toISOString();
-    _internals.stageAllExcludingSwarm(directory);
+    _internals2.stageAllExcludingSwarm(directory);
     const hasStagedChanges = (() => {
       try {
         gitExec(["diff", "--cached", "--quiet"], directory);
@@ -639,12 +1068,12 @@ function handleSave(label, directory) {
       gitExec(["commit", "--allow-empty", "-m", `checkpoint: ${label}`], directory);
     }
     const newSha = getCurrentSha(directory);
-    appendCheckpointEntry(directory, log, {
+    appendCheckpointEntry(directory, log2, {
       label,
       sha: newSha,
       timestamp
     }, maxCheckpoints);
-    writeCheckpointLog(log, directory);
+    writeCheckpointLog(log2, directory);
     return serializeResult("save", {
       success: true,
       label,
@@ -668,8 +1097,8 @@ async function saveCheckpointRecord(label, directory) {
     directory,
     operationKey: `save-record-${label}`,
     run: async () => {
-      const log = readCheckpointLog(directory);
-      if (log.checkpoints.find((checkpoint) => checkpoint.label === label)) {
+      const log2 = readCheckpointLog(directory);
+      if (log2.checkpoints.find((checkpoint) => checkpoint.label === label)) {
         return { success: false, error: `duplicate label: "${label}"` };
       }
       let sha = "";
@@ -681,12 +1110,12 @@ async function saveCheckpointRecord(label, directory) {
           sha = "";
         }
       }
-      appendCheckpointEntry(directory, log, {
+      appendCheckpointEntry(directory, log2, {
         label,
         sha,
         timestamp: new Date().toISOString()
       }, loadCheckpointConfig(directory).maxCheckpoints);
-      writeCheckpointLog(log, directory);
+      writeCheckpointLog(log2, directory);
       const result = { success: true, sha };
       if (!sha) {
         result.warning = "no git restore target - checkpoint recorded without a SHA (directory may not be a git repository or HEAD is unavailable)";
@@ -703,17 +1132,74 @@ async function saveCheckpointRecord(label, directory) {
     })
   });
 }
-function handleRestore(label, directory) {
+function handleRestore(label, directory, confirmToken) {
   try {
-    const log = readCheckpointLog(directory);
-    const checkpoint = log.checkpoints.find((candidate) => candidate.label === label);
+    const log2 = readCheckpointLog(directory);
+    const checkpoint = log2.checkpoints.find((candidate) => candidate.label === label);
     if (!checkpoint) {
       return serializeResult("restore", {
         success: false,
         error: `checkpoint not found: "${label}"`
       });
     }
-    const logBeforeReset = log;
+    const measurement = measureGitDestruction(directory, checkpoint.sha);
+    if (measurement.kind === "unreadable") {
+      return serializeResult("restore", {
+        success: false,
+        error: "cannot verify the working tree (git status unreadable) \u2014 refusing to restore without a preview. Retry, or inspect git status manually."
+      });
+    }
+    if (measurement.dirtyRelPaths.length > 0) {
+      const candidates = trackedDirtyCandidates(directory, measurement.dirtyRelPaths);
+      const scopeAnchor = candidates[0].path;
+      if (!confirmToken) {
+        const token = issueConfirmToken(scopeAnchor, directory, {
+          kind: ROLLBACK_GIT_KIND,
+          candidates
+        });
+        const shown = measurement.dirtyRelPaths.slice(0, 10);
+        const overflow = measurement.dirtyRelPaths.length - shown.length;
+        return serializeResult("restore", {
+          success: false,
+          requires_confirm: true,
+          preview: [
+            `Restoring to checkpoint "${label}" runs a hard git reset and would DESTROY ${candidates.length} uncommitted tracked file(s):`,
+            ...shown.map((p) => `  - ${p}`),
+            ...overflow > 0 ? [`  (+${overflow} more)`] : [],
+            "Backups are taken automatically once confirmed."
+          ],
+          confirm_token: token,
+          message: "restore preview \u2014 re-run with confirm_token to execute (valid 15 minutes)"
+        });
+      }
+      const verdict = consumeConfirmToken(scopeAnchor, directory, confirmToken, { kind: ROLLBACK_GIT_KIND, candidates });
+      if (!verdict.ok) {
+        return serializeResult("restore", {
+          success: false,
+          error: verdict.reason
+        });
+      }
+      const backup = backupTrackedChangesBeforeRollback(directory, measurement.dirtyRelPaths);
+      const atRiskExisting = measurement.dirtyRelPaths.filter((rel) => fs4.existsSync(path5.join(directory, rel))).length;
+      if (!backup.backupDir || backup.copied.length < atRiskExisting) {
+        return serializeResult("restore", {
+          success: false,
+          error: `backup incomplete (${backup.copied.length}/${atRiskExisting} at-risk file(s) copied) \u2014 restore refused so nothing is destroyed.${backup.warnings.length > 0 ? ` Warnings: ${backup.warnings.join("; ")}` : ""}`
+        });
+      }
+      const logBeforeReset2 = log2;
+      gitExec(["reset", "--hard", checkpoint.sha], directory);
+      writeCheckpointLog(logBeforeReset2, directory);
+      return serializeResult("restore", {
+        success: true,
+        label,
+        sha: checkpoint.sha,
+        backup_dir: backup.backupDir,
+        ...backup.warnings.length > 0 ? { backup_warnings: backup.warnings } : {},
+        message: `Restored to checkpoint: "${label}" (hard reset)${backup.backupDir ? `; destroyed bytes backed up to ${path5.relative(directory, backup.backupDir)}` : ""}${backup.warnings.length > 0 ? `; warnings: ${backup.warnings.join("; ")}` : ""}`
+      });
+    }
+    const logBeforeReset = log2;
     gitExec(["reset", "--hard", checkpoint.sha], directory);
     writeCheckpointLog(logBeforeReset, directory);
     return serializeResult("restore", {
@@ -730,8 +1216,8 @@ function handleRestore(label, directory) {
   }
 }
 function handleList(directory) {
-  const log = readCheckpointLog(directory);
-  const sorted = [...log.checkpoints].sort((a, b) => b.timestamp.localeCompare(a.timestamp));
+  const log2 = readCheckpointLog(directory);
+  const sorted = [...log2.checkpoints].sort((a, b) => b.timestamp.localeCompare(a.timestamp));
   return serializeResult("list", {
     success: true,
     count: sorted.length,
@@ -740,16 +1226,16 @@ function handleList(directory) {
 }
 function handleDelete(label, directory) {
   try {
-    const log = readCheckpointLog(directory);
-    const initialLength = log.checkpoints.length;
-    log.checkpoints = log.checkpoints.filter((checkpoint) => checkpoint.label !== label);
-    if (log.checkpoints.length === initialLength) {
+    const log2 = readCheckpointLog(directory);
+    const initialLength = log2.checkpoints.length;
+    log2.checkpoints = log2.checkpoints.filter((checkpoint) => checkpoint.label !== label);
+    if (log2.checkpoints.length === initialLength) {
       return serializeResult("delete", {
         success: false,
         error: `checkpoint not found: "${label}"`
       });
     }
-    writeCheckpointLog(log, directory);
+    writeCheckpointLog(log2, directory);
     return serializeResult("delete", {
       success: true,
       label,
@@ -767,7 +1253,7 @@ async function handleSaveTaskCompletion(taskId, directory) {
     directory,
     taskId,
     run: async () => {
-      const plan = await _internals.loadPlan(directory);
+      const plan = await _internals2.loadPlan(directory);
       if (!plan) {
         return serializeResult("save_task_completion", {
           success: false,
@@ -787,7 +1273,7 @@ async function handleSaveTaskCompletion(taskId, directory) {
           error: `save_task_completion failed: task "${taskId}" is ${task.status}, not completed`
         });
       }
-      await _internals.afterTaskEligibilityRead?.(directory, task.id);
+      await _internals2.afterTaskEligibilityRead?.(directory, task.id);
       const planIdentityHash = derivePlanIdentityHash(plan);
       const planId = derivePlanId(plan);
       const ledgerEvents = await readLedgerEvents(directory);
@@ -823,12 +1309,12 @@ async function handleSaveTaskCompletion(taskId, directory) {
           message: `Checkpoint task completion already logged for "${descriptor.taskId}"`
         });
       }
-      const recoveredSha = _internals.findCommitByExactSubject(directory, descriptor.subject);
+      const recoveredSha = _internals2.findCommitByExactSubject(directory, descriptor.subject);
       let committedSha = null;
       committedSha = recoveredSha ?? receipt.sha;
       if (!committedSha) {
-        _internals.stageAllExcludingSwarm(directory);
-        _internals.gitExec([
+        _internals2.stageAllExcludingSwarm(directory);
+        _internals2.gitExec([
           "commit",
           "--allow-empty",
           "-m",
@@ -842,13 +1328,13 @@ async function handleSaveTaskCompletion(taskId, directory) {
         throw new Error(`save_task_completion failed: could not resolve commit SHA for task "${descriptor.taskId}"`);
       }
       updateTaskCheckpointReceipt(directory, descriptor, "committed", committedSha);
-      const log = readCheckpointLog(directory);
-      upsertTaskCompletionCheckpointEntry(directory, log, {
+      const log2 = readCheckpointLog(directory);
+      upsertTaskCompletionCheckpointEntry(directory, log2, {
         label: descriptor.label,
         sha: committedSha,
         timestamp: new Date().toISOString()
       }, loadCheckpointConfig(directory).maxCheckpoints);
-      writeCheckpointLog(log, directory);
+      writeCheckpointLog(log2, directory);
       const logged = updateTaskCheckpointReceipt(directory, descriptor, "logged", committedSha);
       return serializeResult("save_task_completion", {
         success: true,
@@ -862,10 +1348,11 @@ async function handleSaveTaskCompletion(taskId, directory) {
 }
 var checkpoint = createSwarmTool({
   allowWorkingDirectoryOverride: true,
-  description: "Save, restore, list, and delete git checkpoints. " + "Use save to create a named snapshot, restore to return tracked files to a checkpoint, " + "list to see all checkpoints, delete to remove a checkpoint from the log, and save_task_completion to record a retry-safe task completion checkpoint. " + "Git commits are preserved on delete.",
+  description: "Save, restore, list, and delete git checkpoints. " + "Use save to create a named snapshot, restore to return tracked files to a checkpoint (a destructive restore previews first and requires a confirm token issued in the preview; destroyed bytes are backed up under .swarm/rollback-backups/), " + "list to see all checkpoints, delete to remove a checkpoint from the log, and save_task_completion to record a retry-safe task completion checkpoint. " + "Git commits are preserved on delete.",
   args: {
     action: exports_external.string().describe("Action to perform: save, restore, list, delete, or save_task_completion"),
     label: exports_external.string().optional().describe("Checkpoint label (required for save, restore, delete)"),
+    confirm_token: exports_external.string().optional().describe("Confirm token from a destructive-restore preview (required when restore would destroy uncommitted tracked work; the preview response carries the token)"),
     task_id: exports_external.string().optional().describe('Plan task ID (required for save_task_completion), e.g. "1.1"')
   },
   execute: async (args, directory) => {
@@ -878,10 +1365,12 @@ var checkpoint = createSwarmTool({
     }
     let action;
     let label;
+    let confirmToken;
     let taskId;
     try {
       action = String(args.action);
       label = args.label !== undefined && args.label !== null ? String(args.label) : undefined;
+      confirmToken = args.confirm_token !== undefined && args.confirm_token !== null ? String(args.confirm_token) : undefined;
       taskId = args.task_id !== undefined && args.task_id !== null ? String(args.task_id) : undefined;
     } catch {
       return serializeResult("unknown", {
@@ -938,7 +1427,7 @@ var checkpoint = createSwarmTool({
           action: "restore",
           directory,
           operationKey: `restore-${label}`,
-          run: async () => handleRestore(label, directory)
+          run: async () => handleRestore(label, directory, confirmToken)
         });
       case "list":
         return handleList(directory);
@@ -960,4 +1449,4 @@ var checkpoint = createSwarmTool({
   }
 });
 
-export { resolveWorkingDirectory, createSwarmTool, _internals, saveCheckpointRecord, checkpoint };
+export { previewDestructivePurge, issueConfirmToken, consumeConfirmToken, executeDestructivePurge, backupSwarmStateBeforeReset, ROLLBACK_GIT_KIND, ROLLBACK_PHASE_KIND, trackedDirtyCandidates, swarmOverwriteCandidates, measureGitDestruction, resolveWorkingDirectory, createSwarmTool, _internals2 as _internals, saveCheckpointRecord, checkpoint };