opencode-swarm 7.192.0 → 7.192.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (120) hide show
  1. package/.opencode/skills/critic-gate/SKILL.md +2 -1
  2. package/.opencode/skills/execute/SKILL.md +1 -1
  3. package/.opencode/skills/swarm-pr-review/SKILL.md +2 -2
  4. package/.opencode/skills/swarm-pr-review/references/lane-output-recoverability.md +18 -8
  5. package/README.md +5 -3
  6. package/binaries/win32-arm64/swarm-sandbox-runner.exe +0 -0
  7. package/binaries/win32-x64/swarm-sandbox-runner.exe +0 -0
  8. package/dist/agents/critic.d.ts +2 -2
  9. package/dist/background/pr-review-trigger-contract.d.ts +145 -0
  10. package/dist/cli/{auto-checkpoint-fzybxf58.js → auto-checkpoint-735m8sz7.js} +8 -8
  11. package/dist/cli/{capability-probe-3mgxcfr9.js → capability-probe-rty1315z.js} +1 -1
  12. package/dist/cli/{checkpoint-6fr9tc3h.js → checkpoint-ptzc5jev.js} +16 -16
  13. package/dist/cli/{coder-settlement-1t0r6q0r.js → coder-settlement-hh5165m1.js} +12 -12
  14. package/dist/cli/{config-doctor-0kd6w45h.js → config-doctor-wzzvhpcr.js} +15 -15
  15. package/dist/cli/{core-dxraa2ss.js → core-0jarm64k.js} +3 -3
  16. package/dist/cli/{curation-policy-6p6fcfjb.js → curation-policy-yzdznz4z.js} +6 -6
  17. package/dist/cli/{curator-drift-6qb0c363.js → curator-drift-f4aqxz9e.js} +8 -8
  18. package/dist/cli/{curator-hwwp7e2g.js → curator-f7crssw2.js} +43 -43
  19. package/dist/cli/curator-llm-factory-kxnzvhje.js +82 -0
  20. package/dist/cli/{doctor-knowledge-receipt-phase-id-ay2ngn4a.js → doctor-knowledge-receipt-phase-id-qvp1h3xv.js} +8 -8
  21. package/dist/cli/{evidence-summary-service-fyyzhbsc.js → evidence-summary-service-379skych.js} +19 -19
  22. package/dist/cli/{gate-evidence-zt2vj631.js → gate-evidence-b4cfrrgn.js} +7 -7
  23. package/dist/cli/guardrail-explain-tcnfc3te.js +83 -0
  24. package/dist/cli/{guardrail-log-ppgfsfzt.js → guardrail-log-xe1evybk.js} +7 -7
  25. package/dist/cli/{guardrail-reset-4psprskt.js → guardrail-reset-jwx5hsgp.js} +43 -43
  26. package/dist/cli/{hive-promoter-vxrwvhga.js → hive-promoter-nks9a9s8.js} +43 -43
  27. package/dist/cli/{index-y9v41185.js → index-0e1nxkte.js} +1 -1
  28. package/dist/cli/{index-r9yvpr2m.js → index-1n7sf9gz.js} +2 -2
  29. package/dist/cli/{index-d5dwf6q6.js → index-25zjz6kv.js} +5 -5
  30. package/dist/cli/{index-ywmz75rj.js → index-29z0w323.js} +7 -7
  31. package/dist/cli/{index-05t8f1bj.js → index-2y7y0bxf.js} +43 -43
  32. package/dist/cli/{index-sxw0jbyc.js → index-4qreeddq.js} +4 -4
  33. package/dist/cli/{index-mj237f76.js → index-4tfr4j1a.js} +7 -7
  34. package/dist/cli/{index-z3ahy9c2.js → index-4twjbsfw.js} +2 -2
  35. package/dist/cli/{index-sxj143a4.js → index-5dws7eyb.js} +1 -1
  36. package/dist/cli/{index-b2j231jy.js → index-5gy5dc2n.js} +2 -2
  37. package/dist/cli/{index-hqqfxytt.js → index-5s74qd5b.js} +1 -1
  38. package/dist/cli/{index-dexj54h2.js → index-7a92gwbg.js} +4 -4
  39. package/dist/cli/{index-egkph2cs.js → index-7bppy3ve.js} +4 -4
  40. package/dist/cli/{index-mqf06fyy.js → index-878ksabw.js} +11 -11
  41. package/dist/cli/{index-p1z7pafk.js → index-89826pb5.js} +2 -2
  42. package/dist/cli/{index-2fpv2wmc.js → index-8zj647hc.js} +1 -1
  43. package/dist/cli/{index-ecx8jh7s.js → index-914wsfyy.js} +2 -2
  44. package/dist/cli/{index-tv0m2css.js → index-a83gmv2e.js} +2 -2
  45. package/dist/cli/{index-zk6ttjkt.js → index-a9m7h5v0.js} +2 -2
  46. package/dist/cli/{index-sx3g9nwg.js → index-asm2r4g2.js} +4 -4
  47. package/dist/cli/{index-v9geqn2t.js → index-ba87gkb4.js} +20 -6
  48. package/dist/cli/{index-3zwhxk98.js → index-bgzpw6ge.js} +1 -1
  49. package/dist/cli/{index-3c8v05x1.js → index-br28jc6d.js} +3 -3
  50. package/dist/cli/{index-sgxbqba0.js → index-bzfn85kq.js} +119 -55
  51. package/dist/cli/{index-zv71frp3.js → index-cf003krm.js} +6 -6
  52. package/dist/cli/{index-mcv0v2dp.js → index-dt4cjxbz.js} +1 -1
  53. package/dist/cli/{index-mjfpaxw3.js → index-dtet46e6.js} +7 -7
  54. package/dist/cli/{index-8bx6vhzk.js → index-e8k0v19e.js} +1 -1
  55. package/dist/cli/{index-nkgzkt7c.js → index-eaess7dm.js} +1 -1
  56. package/dist/cli/{index-93zvq6wn.js → index-ejq082zj.js} +5 -5
  57. package/dist/cli/{index-4d04qzw5.js → index-f54stv77.js} +3 -3
  58. package/dist/cli/{index-kfevm0n5.js → index-fzqn2kk8.js} +2 -2
  59. package/dist/cli/{index-n8q43eff.js → index-g8jd3h4r.js} +2 -2
  60. package/dist/cli/{index-gv63kdd3.js → index-hcsz7bhg.js} +3 -3
  61. package/dist/cli/{index-ngjjwcam.js → index-k96fx4yw.js} +2 -2
  62. package/dist/cli/{index-feaxsjrt.js → index-mbn4vn3z.js} +1 -1
  63. package/dist/cli/{index-7vnr5cmp.js → index-mtqwyjrg.js} +1 -1
  64. package/dist/cli/{index-qs9myayh.js → index-nwswxes7.js} +4 -4
  65. package/dist/cli/{index-aazwrwy1.js → index-q0bctx7k.js} +1 -1
  66. package/dist/cli/{index-1ajj6zbq.js → index-qp3twbdz.js} +45 -45
  67. package/dist/cli/{index-rehvfgre.js → index-qta3x82z.js} +253 -108
  68. package/dist/cli/{index-646s7gp9.js → index-w8e73tp0.js} +12 -7
  69. package/dist/cli/{index-c5644p1y.js → index-w917g452.js} +6 -6
  70. package/dist/cli/{index-9qwmx95b.js → index-w9y482mp.js} +1 -1
  71. package/dist/cli/{index-bx6x9ee7.js → index-xen0j48x.js} +2 -2
  72. package/dist/cli/{index-6v42d116.js → index-xf5v44qh.js} +3 -3
  73. package/dist/cli/{index-3pkeqcxe.js → index-ypvz2c60.js} +7 -7
  74. package/dist/cli/{index-x00ghp37.js → index-yte4hqhv.js} +3 -3
  75. package/dist/cli/index.d.ts +2 -2
  76. package/dist/cli/index.js +60 -54
  77. package/dist/cli/{knowledge-escalator-b45xccz8.js → knowledge-escalator-gzzr7cy2.js} +14 -14
  78. package/dist/cli/{knowledge-events-rtmavbyy.js → knowledge-events-b16yc189.js} +12 -12
  79. package/dist/cli/{knowledge-link-6hw3z6wn.js → knowledge-link-a5tvjqdt.js} +5 -5
  80. package/dist/cli/{knowledge-store-0beaqdxd.js → knowledge-store-arj3by4h.js} +6 -6
  81. package/dist/cli/{knowledge-validator-r1kjxt80.js → knowledge-validator-b3qhjg0t.js} +8 -8
  82. package/dist/cli/{mcp-gq7gy5qm.js → mcp-972t0jt0.js} +1 -1
  83. package/dist/cli/{model-preflight-za9f75h1.js → model-preflight-f1xvxk6e.js} +43 -43
  84. package/dist/cli/{pending-delegations-ba4bbh3d.js → pending-delegations-fv5xz799.js} +12 -12
  85. package/dist/cli/{pr-subscriptions-9ge667xn.js → pr-subscriptions-4mcwj33s.js} +12 -12
  86. package/dist/cli/{pr-workflow-gate-p1sv3vp7.js → pr-workflow-gate-ap5cp211.js} +45 -43
  87. package/dist/cli/{runner-ssnsje35.js → runner-8qybgy4n.js} +6 -6
  88. package/dist/cli/{scan-cursor-hrn48cja.js → scan-cursor-tceyckdx.js} +7 -7
  89. package/dist/cli/{schema-6cwam61t.js → schema-pqevpe3m.js} +1 -1
  90. package/dist/cli/{scope-persistence-z8b0cj5e.js → scope-persistence-ta6ydymv.js} +15 -15
  91. package/dist/cli/{server-sqxa4vjy.js → server-s9bfax7h.js} +43 -43
  92. package/dist/cli/{skill-generator-6dfgb9hj.js → skill-generator-xdg4626x.js} +16 -16
  93. package/dist/cli/{snapshot-coordination-init-rt4xyayx.js → snapshot-coordination-init-wn0hnwyv.js} +43 -43
  94. package/dist/cli/{speckit-checkoff-q1zqzwbw.js → speckit-checkoff-8x139jpf.js} +4 -4
  95. package/dist/cli/{telemetry-9szfdfqv.js → telemetry-qaymh4gg.js} +1 -1
  96. package/dist/cli/{workspace-snapshot-9f12p1s1.js → workspace-snapshot-vfpnxjsp.js} +3 -3
  97. package/dist/cli/{worktree-collision-ownership-ge241a9e.js → worktree-collision-ownership-as8hnnff.js} +13 -13
  98. package/dist/cli/{worktree-isolation-c9x73qrk.js → worktree-isolation-7vrs8t9b.js} +49 -43
  99. package/dist/commands/turbo.d.ts +4 -3
  100. package/dist/config/constants.d.ts +2 -2
  101. package/dist/config/plan-schema.d.ts +16 -0
  102. package/dist/epic/phase-readiness.d.ts +4 -2
  103. package/dist/evaluation/ephemeral-agent-dispatcher.d.ts +11 -0
  104. package/dist/failures/provider-message-error.d.ts +32 -0
  105. package/dist/hooks/delegation-gate/worktree-isolation.d.ts +40 -0
  106. package/dist/hooks/delegation-gate.d.ts +13 -0
  107. package/dist/hooks/extractors.d.ts +2 -0
  108. package/dist/hooks/guardrails/index.d.ts +2 -0
  109. package/dist/hooks/guardrails/parallel-gate-attribution.d.ts +10 -0
  110. package/dist/hooks/pr-workflow-gate.d.ts +12 -1
  111. package/dist/index.js +415 -412
  112. package/dist/plan/ledger.d.ts +21 -3
  113. package/dist/sandbox/linux/bubblewrap-executor.d.ts +24 -0
  114. package/dist/services/skill-optimizer/store.d.ts +2 -2
  115. package/dist/tools/phase-complete.d.ts +4 -0
  116. package/dist/tools/write-pr-review-trigger-eval.d.ts +4 -0
  117. package/opencode-swarm.schema.json +1 -1
  118. package/package.json +1 -1
  119. package/dist/cli/curator-llm-factory-w6hvns5a.js +0 -82
  120. package/dist/cli/guardrail-explain-ddtj3djc.js +0 -83
@@ -1,7 +1,7 @@
1
1
  // @bun
2
2
  import {
3
3
  authorizeCuration
4
- } from "./index-sxj143a4.js";
4
+ } from "./index-5dws7eyb.js";
5
5
  import {
6
6
  findNearDuplicate,
7
7
  inferTags,
@@ -9,13 +9,13 @@ import {
9
9
  resolveSwarmKnowledgePath,
10
10
  resolveSwarmRejectedPath,
11
11
  transactKnowledge
12
- } from "./index-ywmz75rj.js";
12
+ } from "./index-29z0w323.js";
13
13
  import {
14
14
  resolveKnowledgeStoreDir
15
- } from "./index-3zwhxk98.js";
15
+ } from "./index-bgzpw6ge.js";
16
16
  import {
17
17
  atomicWriteFile
18
- } from "./index-r9yvpr2m.js";
18
+ } from "./index-1n7sf9gz.js";
19
19
  import {
20
20
  require_proper_lockfile
21
21
  } from "./index-7g4c7s5r.js";
@@ -4,7 +4,7 @@ import {
4
4
  } from "./index-6b295cas.js";
5
5
  import {
6
6
  readEffectiveSpecSync
7
- } from "./index-hqqfxytt.js";
7
+ } from "./index-5s74qd5b.js";
8
8
  import {
9
9
  _internals,
10
10
  clearWorktreeMergeStatus,
@@ -20,7 +20,7 @@ import {
20
20
  estimateTokens,
21
21
  readSwarmFileAsync,
22
22
  validateSwarmPath
23
- } from "./index-nkgzkt7c.js";
23
+ } from "./index-eaess7dm.js";
24
24
  import {
25
25
  bunHash,
26
26
  bunWrite
@@ -43,10 +43,10 @@ import {
43
43
  replayFromLedgerWithStatus,
44
44
  takeSnapshotEvent,
45
45
  takeSnapshotWithRetry
46
- } from "./index-v9geqn2t.js";
46
+ } from "./index-ba87gkb4.js";
47
47
  import {
48
48
  appendCoreEventSync
49
- } from "./index-zk6ttjkt.js";
49
+ } from "./index-a9m7h5v0.js";
50
50
  import {
51
51
  deleteCoordinationStateWithinTransaction,
52
52
  getCoordinationStateRaw,
@@ -55,13 +55,13 @@ import {
55
55
  transitionCoordinationState,
56
56
  transitionCoordinationStateWithinTransaction,
57
57
  withCoordinationTransaction
58
- } from "./index-feaxsjrt.js";
58
+ } from "./index-mbn4vn3z.js";
59
59
  import {
60
60
  DURABILITY_CLASSES,
61
61
  getProjectDb,
62
62
  projectDbExists,
63
63
  withDurabilityClass
64
- } from "./index-2fpv2wmc.js";
64
+ } from "./index-8zj647hc.js";
65
65
  import {
66
66
  derivePlanId,
67
67
  derivePlanIdentityHash
@@ -71,7 +71,7 @@ import {
71
71
  } from "./index-t7hmqgjy.js";
72
72
  import {
73
73
  emit
74
- } from "./index-7vnr5cmp.js";
74
+ } from "./index-mtqwyjrg.js";
75
75
  import {
76
76
  canonicalRootKeyFresh
77
77
  } from "./index-fzpt2djt.js";
@@ -82,7 +82,7 @@ import {
82
82
  atomicWriteSwarmFileSync,
83
83
  invalidateCachedArtifact,
84
84
  readCachedParsedFile
85
- } from "./index-qs9myayh.js";
85
+ } from "./index-nwswxes7.js";
86
86
  import {
87
87
  PlanSchema,
88
88
  normalizeCurrentPhaseInPlace,
@@ -93,7 +93,7 @@ import {
93
93
  init_loader,
94
94
  isEpicModeConfigEnabled,
95
95
  loadPluginConfigWithMeta
96
- } from "./index-9qwmx95b.js";
96
+ } from "./index-w9y482mp.js";
97
97
  import {
98
98
  exports_external,
99
99
  init_zod
@@ -2664,7 +2664,7 @@ ${markdown}`;
2664
2664
  }
2665
2665
  }
2666
2666
  async function defaultMaybeSaveAutoCheckpoint(directory, plan) {
2667
- const { maybeSaveAutoCheckpoint } = await import("./auto-checkpoint-fzybxf58.js");
2667
+ const { maybeSaveAutoCheckpoint } = await import("./auto-checkpoint-735m8sz7.js");
2668
2668
  return maybeSaveAutoCheckpoint(directory, plan);
2669
2669
  }
2670
2670
  async function updateTaskStatus(directory, taskId, status, options) {
@@ -2740,7 +2740,7 @@ async function updateTaskStatus(directory, taskId, status, options) {
2740
2740
  if (status === "completed") {
2741
2741
  try {
2742
2742
  const completedTask = updatedPlan.phases.flatMap((phase) => phase.tasks).find((candidate) => candidate.id === taskId);
2743
- const { maybePropagateSpeckitCheckoff } = await import("./speckit-checkoff-q1zqzwbw.js");
2743
+ const { maybePropagateSpeckitCheckoff } = await import("./speckit-checkoff-8x139jpf.js");
2744
2744
  await maybePropagateSpeckitCheckoff(directory, {
2745
2745
  taskId,
2746
2746
  frRefs: completedTask?.fr_refs ?? [],
@@ -2,10 +2,10 @@
2
2
  import {
3
3
  init_loader,
4
4
  loadPluginConfigWithMeta
5
- } from "./index-9qwmx95b.js";
5
+ } from "./index-w9y482mp.js";
6
6
  import {
7
7
  init_schema
8
- } from "./index-tv0m2css.js";
8
+ } from "./index-a83gmv2e.js";
9
9
  import {
10
10
  DEFAULT_WORKTREE_ISOLATION_CONFIG,
11
11
  init_constants
@@ -11,7 +11,7 @@ import {
11
11
  } from "./index-fzpt2djt.js";
12
12
  import {
13
13
  atomicWriteSwarmFileSync
14
- } from "./index-qs9myayh.js";
14
+ } from "./index-nwswxes7.js";
15
15
 
16
16
  // src/db/project-db.ts
17
17
  import { existsSync, mkdirSync, unlinkSync } from "fs";
@@ -2,10 +2,10 @@
2
2
  import {
3
3
  readKnowledge,
4
4
  transactKnowledge
5
- } from "./index-ywmz75rj.js";
5
+ } from "./index-29z0w323.js";
6
6
  import {
7
7
  resolveKnowledgeStoreDir
8
- } from "./index-3zwhxk98.js";
8
+ } from "./index-bgzpw6ge.js";
9
9
  import {
10
10
  init_git_executable,
11
11
  resolveGitExecutableAsync
@@ -21,7 +21,7 @@ var package_default;
21
21
  var init_package = __esm(() => {
22
22
  package_default = {
23
23
  name: "opencode-swarm",
24
- version: "7.192.0",
24
+ version: "7.192.2",
25
25
  description: "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
26
26
  main: "dist/index.js",
27
27
  types: "dist/index.d.ts",
@@ -1932,7 +1932,7 @@ var init_schema = __esm(() => {
1932
1932
  worktree: WorktreeIsolationConfigSchema.optional().describe("Worktree isolation policy for parallel coder dispatch lanes (general surface; Lean Turbo keeps its legacy per-mode fields)."),
1933
1933
  turbo: TurboConfigSchema.optional().describe("Turbo execution strategy block (Phase 1). Absent means current behavior unchanged."),
1934
1934
  epic: EpicConfigSchema.optional().describe("Epic Mode block: one plan = one epic delivered in conflict-free parallel waves. Opt in with `mode.enabled: true`, then `/swarm epic start`. Needs no `turbo` block (legacy `turbo.epic` is still accepted and migrated here)."),
1935
- turbo_mode: exports_external.boolean().default(false).optional().describe("Bypass reviewer/test gates for rapid iteration (v6.40). When true, new sessions start with turbo mode on (session default); /swarm turbo still toggles per session. Directory-less constructions default off."),
1935
+ turbo_mode: exports_external.boolean().default(false).optional().describe("Turbo mode for rapid iteration (v6.40): skips phase_complete Gates 1\u20135 and lets a non-Tier-3 task be re-dispatched to the coder before Stage A passes; per-task Stage A and Stage B (reviewer + test_engineer) are still required. When true, new sessions start with turbo mode on (session default); /swarm turbo still toggles per session. Directory-less constructions default off."),
1936
1936
  quiet: exports_external.boolean().default(true).optional().describe("Suppress non-critical startup warnings (default true keeps the TUI clean). Set false to restore verbose warnings for debugging."),
1937
1937
  version_check: exports_external.boolean().default(true).optional().describe("Background staleness check against npm, throttled to once per 24h (issue #675). Set false to fully disable the network call."),
1938
1938
  full_auto: exports_external.object({
@@ -1,10 +1,10 @@
1
1
  // @bun
2
2
  import {
3
3
  observeStoreHealth
4
- } from "./index-z3ahy9c2.js";
4
+ } from "./index-4twjbsfw.js";
5
5
  import {
6
6
  telemetry
7
- } from "./index-7vnr5cmp.js";
7
+ } from "./index-mtqwyjrg.js";
8
8
  import {
9
9
  init_logger,
10
10
  warn
@@ -5,18 +5,18 @@ import {
5
5
  import {
6
6
  effectiveRetrievalOutcomes,
7
7
  readAuthoritativeKnowledgeCounterRollups
8
- } from "./index-sxw0jbyc.js";
8
+ } from "./index-4qreeddq.js";
9
9
  import {
10
10
  ALLOWED_SKILL_PATH_PREFIXES,
11
11
  validateSkillPath
12
- } from "./index-egkph2cs.js";
12
+ } from "./index-7bppy3ve.js";
13
13
  import {
14
14
  computeOutcomeSignal,
15
15
  readKnowledge,
16
16
  resolveHiveKnowledgePath,
17
17
  resolveSwarmKnowledgePath,
18
18
  transactKnowledge
19
- } from "./index-ywmz75rj.js";
19
+ } from "./index-29z0w323.js";
20
20
  import {
21
21
  appendCappedJsonl,
22
22
  resolveRetentionCap
@@ -27,7 +27,7 @@ import {
27
27
  import {
28
28
  atomicWriteFileAnyRoot,
29
29
  atomicWriteSwarmFile
30
- } from "./index-qs9myayh.js";
30
+ } from "./index-nwswxes7.js";
31
31
  import {
32
32
  advisoryWarn,
33
33
  init_warning_buffer
@@ -4,20 +4,20 @@ import {
4
4
  projectDbExists,
5
5
  withImmediateTransaction,
6
6
  withProjectDbReadOnly
7
- } from "./index-2fpv2wmc.js";
7
+ } from "./index-8zj647hc.js";
8
8
  import {
9
9
  derivePlanId,
10
10
  derivePlanIdentityHash
11
11
  } from "./index-7pmbnjvj.js";
12
12
  import {
13
13
  withEvidenceLock
14
- } from "./index-8bx6vhzk.js";
14
+ } from "./index-e8k0v19e.js";
15
15
  import {
16
16
  assertProjectRoot
17
17
  } from "./index-t7hmqgjy.js";
18
18
  import {
19
19
  emit
20
- } from "./index-7vnr5cmp.js";
20
+ } from "./index-mtqwyjrg.js";
21
21
  import {
22
22
  ExecutionProfileSchema,
23
23
  PlanSchema,
@@ -27,11 +27,11 @@ import {
27
27
  import {
28
28
  init_loader,
29
29
  loadPluginConfig
30
- } from "./index-9qwmx95b.js";
30
+ } from "./index-w9y482mp.js";
31
31
  import {
32
32
  init_package,
33
33
  package_default
34
- } from "./index-tv0m2css.js";
34
+ } from "./index-a83gmv2e.js";
35
35
  import {
36
36
  criticalWarn,
37
37
  init_logger,
@@ -1976,6 +1976,20 @@ async function loadLastApprovedPlan(directory, expectedPlanId) {
1976
1976
  const integrity = await readLedgerEventsWithIntegrity(directory);
1977
1977
  return findLastApprovedSnapshot(integrity.events, expectedPlanId);
1978
1978
  }
1979
+ function approvedSnapshotCoversPlan(approved, plan) {
1980
+ const current = computePlanStructureHash(plan);
1981
+ if (approved.payloadHash === current)
1982
+ return true;
1983
+ if (approved.plan.current_phase === plan.current_phase)
1984
+ return false;
1985
+ if (computePlanStructureHash(approved.plan) !== approved.payloadHash) {
1986
+ return false;
1987
+ }
1988
+ return computePlanStructureHash({
1989
+ ...approved.plan,
1990
+ current_phase: plan.current_phase
1991
+ }) === current;
1992
+ }
1979
1993
  async function loadLastPlanCriticApprovedSnapshot(directory, expectedPlanId) {
1980
1994
  const integrity = await readLedgerEventsWithIntegrity(directory);
1981
1995
  return findLastApprovedSnapshot(integrity.events, expectedPlanId, (payload) => payload.approval?.source === "plan_critic_gate");
@@ -2050,4 +2064,4 @@ var _internals = {
2050
2064
  randomUUID: () => crypto.randomUUID()
2051
2065
  };
2052
2066
 
2053
- export { renderPlanningProfileDirective, resolvePlanningProfile, normalizeExecutionProfileForHash, LedgerStaleWriterError, computePlanLedgerHash, computePlanStructureHash, computeCurrentPlanHash, ledgerExists, getLatestLedgerSeq, readLedgerEvents, initLedger, readPlanEpochIdentity, getOrAdoptPlanEpochUnderLock, appendLedgerEvent, takeSnapshotWithRetry, takeSnapshotEvent, replaceTruncatedLedgerWithRecoveryRoot, clearPlanLedgerForReset, replacePlanLedgerWithRoot, replayFromLedger, peekPlanFromLedger, replayFromLedgerWithStatus, readLedgerEventsWithIntegrity, loadLastApprovedPlan, loadLastPlanCriticApprovedSnapshot };
2067
+ export { renderPlanningProfileDirective, resolvePlanningProfile, normalizeExecutionProfileForHash, LedgerStaleWriterError, computePlanLedgerHash, computePlanStructureHash, computeCurrentPlanHash, ledgerExists, getLatestLedgerSeq, readLedgerEvents, initLedger, readPlanEpochIdentity, getOrAdoptPlanEpochUnderLock, appendLedgerEvent, takeSnapshotWithRetry, takeSnapshotEvent, replaceTruncatedLedgerWithRecoveryRoot, clearPlanLedgerForReset, replacePlanLedgerWithRoot, replayFromLedger, peekPlanFromLedger, replayFromLedgerWithStatus, readLedgerEventsWithIntegrity, loadLastApprovedPlan, approvedSnapshotCoversPlan, loadLastPlanCriticApprovedSnapshot };
@@ -1,7 +1,7 @@
1
1
  // @bun
2
2
  import {
3
3
  atomicWriteFile
4
- } from "./index-r9yvpr2m.js";
4
+ } from "./index-1n7sf9gz.js";
5
5
  import {
6
6
  canonicalRootKeyFresh
7
7
  } from "./index-fzpt2djt.js";
@@ -1,10 +1,10 @@
1
1
  // @bun
2
2
  import {
3
3
  readEffectiveSpecSync
4
- } from "./index-hqqfxytt.js";
4
+ } from "./index-5s74qd5b.js";
5
5
  import {
6
6
  readSwarmFileAsync
7
- } from "./index-nkgzkt7c.js";
7
+ } from "./index-eaess7dm.js";
8
8
  import {
9
9
  DURABILITY_CLASSES,
10
10
  DbWriteError,
@@ -13,7 +13,7 @@ import {
13
13
  classifyDbWriteError,
14
14
  getProjectDb,
15
15
  projectDbExists
16
- } from "./index-2fpv2wmc.js";
16
+ } from "./index-8zj647hc.js";
17
17
  import {
18
18
  _internals,
19
19
  canonicalRootKeyFresh
@@ -1047,7 +1047,7 @@ async function _createExecutor() {
1047
1047
  return null;
1048
1048
  }
1049
1049
  async function _createLinuxExecutor() {
1050
- const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isBubblewrapAvailable } = await import("./capability-probe-3mgxcfr9.js");
1050
+ const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isBubblewrapAvailable } = await import("./capability-probe-rty1315z.js");
1051
1051
  await new SandboxCapabilityProbe2().detect();
1052
1052
  if (!isBubblewrapAvailable()) {
1053
1053
  return null;
@@ -1067,7 +1067,7 @@ async function _createMacOSExecutor() {
1067
1067
  }
1068
1068
  return null;
1069
1069
  }
1070
- const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isSandboxExecAvailable } = await import("./capability-probe-3mgxcfr9.js");
1070
+ const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isSandboxExecAvailable } = await import("./capability-probe-rty1315z.js");
1071
1071
  await new SandboxCapabilityProbe2().detect();
1072
1072
  if (!isSandboxExecAvailable()) {
1073
1073
  return null;
@@ -1080,7 +1080,7 @@ async function _createMacOSExecutor() {
1080
1080
  }
1081
1081
  }
1082
1082
  async function _createWindowsExecutor() {
1083
- const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isWindowsSandboxAvailable } = await import("./capability-probe-3mgxcfr9.js");
1083
+ const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isWindowsSandboxAvailable } = await import("./capability-probe-rty1315z.js");
1084
1084
  await new SandboxCapabilityProbe2().detect();
1085
1085
  if (!isWindowsSandboxAvailable()) {
1086
1086
  return null;
@@ -1111,6 +1111,7 @@ var init_executor = __esm(() => {
1111
1111
  // src/sandbox/linux/bubblewrap-executor.ts
1112
1112
  import { spawnSync as spawnSync4 } from "child_process";
1113
1113
  import { existsSync as existsSync3 } from "fs";
1114
+ import { tmpdir as tmpdir5 } from "os";
1114
1115
  function resolveBwrapBinary() {
1115
1116
  try {
1116
1117
  if (existsSync3(BWRAP_ABSOLUTE)) {
@@ -1119,10 +1120,84 @@ function resolveBwrapBinary() {
1119
1120
  } catch {}
1120
1121
  return "bwrap";
1121
1122
  }
1123
+ function shellQuote(s) {
1124
+ return `'${shellEscape2(s)}'`;
1125
+ }
1126
+ function buildBwrapArgs(input) {
1127
+ const { quote } = input;
1128
+ const roBindArgs = input.readonlyRoots.flatMap((p) => [
1129
+ "--ro-bind",
1130
+ quote(p),
1131
+ quote(p)
1132
+ ]);
1133
+ const bindArgs = input.scopes.flatMap((p) => ["--bind", quote(p), quote(p)]);
1134
+ const args = [
1135
+ "--unshare-user",
1136
+ "--unshare-ipc",
1137
+ "--die-with-parent",
1138
+ "--new-session",
1139
+ "--cap-drop",
1140
+ "ALL",
1141
+ ...roBindArgs,
1142
+ ...bindArgs,
1143
+ "--dev",
1144
+ "/dev",
1145
+ "--size",
1146
+ String(TMPFS_SIZE_BYTES),
1147
+ "--tmpfs",
1148
+ quote(input.temp),
1149
+ "--ro-bind",
1150
+ "/etc",
1151
+ "/etc",
1152
+ "--ro-bind",
1153
+ "/usr",
1154
+ "/usr",
1155
+ "--ro-bind",
1156
+ "/lib",
1157
+ "/lib",
1158
+ "--ro-bind",
1159
+ "/lib64",
1160
+ "/lib64",
1161
+ "--proc",
1162
+ "/proc",
1163
+ "--unshare-pid",
1164
+ ...input.envArgs,
1165
+ "--",
1166
+ "bash",
1167
+ "-c",
1168
+ quote(input.command)
1169
+ ];
1170
+ if ((input.networkMode ?? "off") === "off") {
1171
+ args.splice(1, 0, "--unshare-net");
1172
+ }
1173
+ return args;
1174
+ }
1175
+ function probeBwrapNamespace(binary) {
1176
+ try {
1177
+ const result = spawnSync4(binary, [...BWRAP_NAMESPACE_SMOKE_ARGS], {
1178
+ cwd: tmpdir5(),
1179
+ windowsHide: true,
1180
+ encoding: "utf-8",
1181
+ timeout: 5000,
1182
+ stdio: ["ignore", "ignore", "pipe"]
1183
+ });
1184
+ if (!result.error && result.status === 0)
1185
+ return { ok: true };
1186
+ const reason = result.error?.message ?? (result.stderr?.trim().split(`
1187
+ `)[0] || `exit ${result.status}`);
1188
+ return { ok: false, reason };
1189
+ } catch (err) {
1190
+ return {
1191
+ ok: false,
1192
+ reason: err instanceof Error ? err.message : String(err)
1193
+ };
1194
+ }
1195
+ }
1122
1196
  function probeBwrap() {
1123
1197
  try {
1124
1198
  const binary = _internals4.resolveBwrapBinary();
1125
1199
  const result = spawnSync4(binary, ["--version"], {
1200
+ cwd: tmpdir5(),
1126
1201
  windowsHide: true,
1127
1202
  encoding: "utf-8",
1128
1203
  timeout: 5000,
@@ -1137,7 +1212,15 @@ function probeBwrap() {
1137
1212
  warn(`Sandbox disabled: bwrap spawn error (${result.error.message}). Falling through to tool-layer enforcement.`);
1138
1213
  return false;
1139
1214
  }
1140
- return result.status === BWRAP_VERSION_EXIT && result.stdout.trim().length > 0;
1215
+ if (result.status !== BWRAP_VERSION_EXIT || result.stdout.trim().length === 0) {
1216
+ return false;
1217
+ }
1218
+ const smoke = _internals4.probeBwrapNamespace(binary);
1219
+ if (!smoke.ok) {
1220
+ warn(`Sandbox disabled: bwrap cannot create a sandbox on this host (${smoke.reason}). ` + "Unprivileged user namespaces may be restricted (Ubuntu 24.04+: " + "kernel.apparmor_restrict_unprivileged_userns=1). Falling through to tool-layer enforcement.");
1221
+ return false;
1222
+ }
1223
+ return true;
1141
1224
  } catch (err) {
1142
1225
  const message = err instanceof Error ? err.message : String(err);
1143
1226
  warn(`Sandbox disabled: probe threw (${message}). Falling through to tool-layer enforcement.`);
@@ -1190,16 +1273,6 @@ class BubblewrapSandboxExecutor {
1190
1273
  const readonlyRoots = [
1191
1274
  ...new Set((policy?.readonly_roots ?? []).filter((p) => typeof p === "string" && p.startsWith("/") && p !== "/"))
1192
1275
  ];
1193
- const roBindArgs = readonlyRoots.flatMap((p) => [
1194
- "--ro-bind",
1195
- `'${shellEscape2(p)}'`,
1196
- `'${shellEscape2(p)}'`
1197
- ]);
1198
- const bindArgs = allScopes.flatMap((p) => [
1199
- "--bind",
1200
- `'${shellEscape2(p)}'`,
1201
- `'${shellEscape2(p)}'`
1202
- ]);
1203
1276
  const envArgs = [];
1204
1277
  if (envOverrides) {
1205
1278
  for (const [key, value] of Object.entries(envOverrides)) {
@@ -1209,49 +1282,19 @@ class BubblewrapSandboxExecutor {
1209
1282
  if (value === null) {
1210
1283
  envArgs.push("--unsetenv", key);
1211
1284
  } else {
1212
- envArgs.push("--setenv", key, `'${shellEscape2(value)}'`);
1285
+ envArgs.push("--setenv", key, shellQuote(value));
1213
1286
  }
1214
1287
  }
1215
1288
  }
1216
- const args = [
1217
- "--unshare-user",
1218
- "--unshare-ipc",
1219
- "--die-with-parent",
1220
- "--new-session",
1221
- "--cap-drop",
1222
- "ALL",
1223
- ...roBindArgs,
1224
- ...bindArgs,
1225
- "--dev",
1226
- "/dev",
1227
- "--size",
1228
- String(TMPFS_SIZE_BYTES),
1229
- "--tmpfs",
1230
- `'${shellEscape2(temp)}'`,
1231
- "--ro-bind",
1232
- "/etc",
1233
- "/etc",
1234
- "--ro-bind",
1235
- "/usr",
1236
- "/usr",
1237
- "--ro-bind",
1238
- "/lib",
1239
- "/lib",
1240
- "--ro-bind",
1241
- "/lib64",
1242
- "/lib64",
1243
- "--proc",
1244
- "/proc",
1245
- "--unshare-pid",
1246
- ...envArgs,
1247
- "--",
1248
- "bash",
1249
- "-c",
1250
- `'${shellEscape2(command)}'`
1251
- ];
1252
- if ((policy?.network_mode ?? "off") === "off") {
1253
- args.splice(1, 0, "--unshare-net");
1254
- }
1289
+ const args = buildBwrapArgs({
1290
+ quote: shellQuote,
1291
+ temp,
1292
+ readonlyRoots,
1293
+ scopes: allScopes,
1294
+ envArgs,
1295
+ networkMode: policy?.network_mode,
1296
+ command
1297
+ });
1255
1298
  const binary = _internals4.resolveBwrapBinary();
1256
1299
  return `${binary} ${args.join(" ")}`;
1257
1300
  }
@@ -1259,13 +1302,23 @@ class BubblewrapSandboxExecutor {
1259
1302
  return {};
1260
1303
  }
1261
1304
  }
1262
- var BWRAP_VERSION_EXIT = 0, BWRAP_UNAVAILABLE_CODES, BWRAP_ABSOLUTE = "/usr/bin/bwrap", TMPFS_SIZE_BYTES = 524288000, _internals4;
1305
+ var BWRAP_VERSION_EXIT = 0, BWRAP_UNAVAILABLE_CODES, BWRAP_ABSOLUTE = "/usr/bin/bwrap", TMPFS_SIZE_BYTES = 524288000, BWRAP_NAMESPACE_SMOKE_ARGS, _internals4;
1263
1306
  var init_bubblewrap_executor = __esm(() => {
1264
1307
  init_logger();
1265
1308
  init_executor();
1266
1309
  BWRAP_UNAVAILABLE_CODES = new Set(["ENOENT", "EACCES", "ENOSPC"]);
1310
+ BWRAP_NAMESPACE_SMOKE_ARGS = buildBwrapArgs({
1311
+ quote: (value) => value,
1312
+ temp: "/tmp",
1313
+ readonlyRoots: [],
1314
+ scopes: [],
1315
+ envArgs: [],
1316
+ networkMode: "off",
1317
+ command: "true"
1318
+ });
1267
1319
  _internals4 = {
1268
1320
  probeBwrap,
1321
+ probeBwrapNamespace,
1269
1322
  resolveBwrapBinary
1270
1323
  };
1271
1324
  });
@@ -1604,6 +1657,17 @@ async function probeLinux() {
1604
1657
  const binary = _internals4.resolveBwrapBinary();
1605
1658
  const output = await _internals5.withProbeTimeout(binary, ["--version"], 2000);
1606
1659
  if (output.length > 0) {
1660
+ try {
1661
+ await _internals5.withProbeTimeout(binary, [...BWRAP_NAMESPACE_SMOKE_ARGS], 2000);
1662
+ } catch (smokeError) {
1663
+ const detail = smokeError instanceof Error ? smokeError.message : String(smokeError);
1664
+ return {
1665
+ status: "disabled",
1666
+ mechanism: "Bubblewrap",
1667
+ platform: "linux",
1668
+ error: `bwrap cannot create a sandbox on this host (unprivileged user namespaces may be restricted): ${detail}`
1669
+ };
1670
+ }
1607
1671
  return {
1608
1672
  status: "enabled",
1609
1673
  strength: "strong",
@@ -4,7 +4,7 @@ import {
4
4
  ensureTaskCheckpointReceipt,
5
5
  loadPlan,
6
6
  updateTaskCheckpointReceipt
7
- } from "./index-mqf06fyy.js";
7
+ } from "./index-878ksabw.js";
8
8
  import {
9
9
  tool
10
10
  } from "./index-9nyqt3kb.js";
@@ -17,13 +17,13 @@ import {
17
17
  } from "./index-g4fs6z4e.js";
18
18
  import {
19
19
  validateSwarmPath
20
- } from "./index-nkgzkt7c.js";
20
+ } from "./index-eaess7dm.js";
21
21
  import {
22
22
  readLedgerEvents
23
- } from "./index-v9geqn2t.js";
23
+ } from "./index-ba87gkb4.js";
24
24
  import {
25
25
  appendCoreEventSync
26
- } from "./index-zk6ttjkt.js";
26
+ } from "./index-a9m7h5v0.js";
27
27
  import {
28
28
  derivePlanId,
29
29
  derivePlanIdentityHash
@@ -38,10 +38,10 @@ import {
38
38
  } from "./index-ejhxgyvm.js";
39
39
  import {
40
40
  atomicWriteSwarmFileSync
41
- } from "./index-qs9myayh.js";
41
+ } from "./index-nwswxes7.js";
42
42
  import {
43
43
  loadPluginConfigWithMeta
44
- } from "./index-9qwmx95b.js";
44
+ } from "./index-w9y482mp.js";
45
45
  import {
46
46
  init_git_executable,
47
47
  resolveGitExecutable
@@ -4,7 +4,7 @@ import {
4
4
  getProjectDb,
5
5
  projectDbExists,
6
6
  withImmediateTransaction
7
- } from "./index-2fpv2wmc.js";
7
+ } from "./index-8zj647hc.js";
8
8
  import {
9
9
  derivePlanId,
10
10
  derivePlanIdentityHash
@@ -1,27 +1,27 @@
1
1
  // @bun
2
2
  import {
3
3
  validateSwarmPath
4
- } from "./index-nkgzkt7c.js";
4
+ } from "./index-eaess7dm.js";
5
5
  import {
6
6
  deleteCoordinationState,
7
7
  importCoordinationOnce,
8
8
  listCoordinationStates,
9
9
  transitionCoordinationState,
10
10
  withCoordinationTransaction
11
- } from "./index-feaxsjrt.js";
11
+ } from "./index-mbn4vn3z.js";
12
12
  import {
13
13
  getProjectDb,
14
14
  projectDbExists
15
- } from "./index-2fpv2wmc.js";
15
+ } from "./index-8zj647hc.js";
16
16
  import {
17
17
  observeStoreHealth
18
- } from "./index-z3ahy9c2.js";
18
+ } from "./index-4twjbsfw.js";
19
19
  import {
20
20
  withEvidenceLock
21
- } from "./index-8bx6vhzk.js";
21
+ } from "./index-e8k0v19e.js";
22
22
  import {
23
23
  telemetry
24
- } from "./index-7vnr5cmp.js";
24
+ } from "./index-mtqwyjrg.js";
25
25
  import {
26
26
  canonicalRootKey,
27
27
  canonicalRootKeyFresh,
@@ -29,7 +29,7 @@ import {
29
29
  } from "./index-fzpt2djt.js";
30
30
  import {
31
31
  atomicWriteSwarmFileSync
32
- } from "./index-qs9myayh.js";
32
+ } from "./index-nwswxes7.js";
33
33
  import {
34
34
  exports_external,
35
35
  init_zod
@@ -4,7 +4,7 @@ import {
4
4
  } from "./index-t7hmqgjy.js";
5
5
  import {
6
6
  emit
7
- } from "./index-7vnr5cmp.js";
7
+ } from "./index-mtqwyjrg.js";
8
8
  import {
9
9
  tryAcquireLock
10
10
  } from "./index-ejhxgyvm.js";