opencode-swarm 7.192.1 → 7.192.3

package/dist/cli/{index-sgxbqba0.js → index-bzfn85kq.js}

@@ -1047,7 +1047,7 @@ async function _createExecutor() {
   return null;
 }
 async function _createLinuxExecutor() {
-  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isBubblewrapAvailable } = await import("./capability-probe-3mgxcfr9.js");
+  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isBubblewrapAvailable } = await import("./capability-probe-rty1315z.js");
   await new SandboxCapabilityProbe2().detect();
   if (!isBubblewrapAvailable()) {
     return null;
@@ -1067,7 +1067,7 @@ async function _createMacOSExecutor() {
     }
     return null;
   }
-  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isSandboxExecAvailable } = await import("./capability-probe-3mgxcfr9.js");
+  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isSandboxExecAvailable } = await import("./capability-probe-rty1315z.js");
   await new SandboxCapabilityProbe2().detect();
   if (!isSandboxExecAvailable()) {
     return null;
@@ -1080,7 +1080,7 @@ async function _createMacOSExecutor() {
   }
 }
 async function _createWindowsExecutor() {
-  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isWindowsSandboxAvailable } = await import("./capability-probe-3mgxcfr9.js");
+  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isWindowsSandboxAvailable } = await import("./capability-probe-rty1315z.js");
   await new SandboxCapabilityProbe2().detect();
   if (!isWindowsSandboxAvailable()) {
     return null;
@@ -1111,6 +1111,7 @@ var init_executor = __esm(() => {
 // src/sandbox/linux/bubblewrap-executor.ts
 import { spawnSync as spawnSync4 } from "child_process";
 import { existsSync as existsSync3 } from "fs";
+import { tmpdir as tmpdir5 } from "os";
 function resolveBwrapBinary() {
   try {
     if (existsSync3(BWRAP_ABSOLUTE)) {
@@ -1119,10 +1120,84 @@ function resolveBwrapBinary() {
   } catch {}
   return "bwrap";
 }
+function shellQuote(s) {
+  return `'${shellEscape2(s)}'`;
+}
+function buildBwrapArgs(input) {
+  const { quote } = input;
+  const roBindArgs = input.readonlyRoots.flatMap((p) => [
+    "--ro-bind",
+    quote(p),
+    quote(p)
+  ]);
+  const bindArgs = input.scopes.flatMap((p) => ["--bind", quote(p), quote(p)]);
+  const args = [
+    "--unshare-user",
+    "--unshare-ipc",
+    "--die-with-parent",
+    "--new-session",
+    "--cap-drop",
+    "ALL",
+    ...roBindArgs,
+    ...bindArgs,
+    "--dev",
+    "/dev",
+    "--size",
+    String(TMPFS_SIZE_BYTES),
+    "--tmpfs",
+    quote(input.temp),
+    "--ro-bind",
+    "/etc",
+    "/etc",
+    "--ro-bind",
+    "/usr",
+    "/usr",
+    "--ro-bind",
+    "/lib",
+    "/lib",
+    "--ro-bind",
+    "/lib64",
+    "/lib64",
+    "--proc",
+    "/proc",
+    "--unshare-pid",
+    ...input.envArgs,
+    "--",
+    "bash",
+    "-c",
+    quote(input.command)
+  ];
+  if ((input.networkMode ?? "off") === "off") {
+    args.splice(1, 0, "--unshare-net");
+  }
+  return args;
+}
+function probeBwrapNamespace(binary) {
+  try {
+    const result = spawnSync4(binary, [...BWRAP_NAMESPACE_SMOKE_ARGS], {
+      cwd: tmpdir5(),
+      windowsHide: true,
+      encoding: "utf-8",
+      timeout: 5000,
+      stdio: ["ignore", "ignore", "pipe"]
+    });
+    if (!result.error && result.status === 0)
+      return { ok: true };
+    const reason = result.error?.message ?? (result.stderr?.trim().split(`
+`)[0] || `exit ${result.status}`);
+    return { ok: false, reason };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
 function probeBwrap() {
   try {
     const binary = _internals4.resolveBwrapBinary();
     const result = spawnSync4(binary, ["--version"], {
+      cwd: tmpdir5(),
       windowsHide: true,
       encoding: "utf-8",
       timeout: 5000,
@@ -1137,7 +1212,15 @@ function probeBwrap() {
       warn(`Sandbox disabled: bwrap spawn error (${result.error.message}). Falling through to tool-layer enforcement.`);
       return false;
     }
-    return result.status === BWRAP_VERSION_EXIT && result.stdout.trim().length > 0;
+    if (result.status !== BWRAP_VERSION_EXIT || result.stdout.trim().length === 0) {
+      return false;
+    }
+    const smoke = _internals4.probeBwrapNamespace(binary);
+    if (!smoke.ok) {
+      warn(`Sandbox disabled: bwrap cannot create a sandbox on this host (${smoke.reason}). ` + "Unprivileged user namespaces may be restricted (Ubuntu 24.04+: " + "kernel.apparmor_restrict_unprivileged_userns=1). Falling through to tool-layer enforcement.");
+      return false;
+    }
+    return true;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     warn(`Sandbox disabled: probe threw (${message}). Falling through to tool-layer enforcement.`);
@@ -1190,16 +1273,6 @@ class BubblewrapSandboxExecutor {
     const readonlyRoots = [
       ...new Set((policy?.readonly_roots ?? []).filter((p) => typeof p === "string" && p.startsWith("/") && p !== "/"))
     ];
-    const roBindArgs = readonlyRoots.flatMap((p) => [
-      "--ro-bind",
-      `'${shellEscape2(p)}'`,
-      `'${shellEscape2(p)}'`
-    ]);
-    const bindArgs = allScopes.flatMap((p) => [
-      "--bind",
-      `'${shellEscape2(p)}'`,
-      `'${shellEscape2(p)}'`
-    ]);
     const envArgs = [];
     if (envOverrides) {
       for (const [key, value] of Object.entries(envOverrides)) {
@@ -1209,49 +1282,19 @@ class BubblewrapSandboxExecutor {
         if (value === null) {
           envArgs.push("--unsetenv", key);
         } else {
-          envArgs.push("--setenv", key, `'${shellEscape2(value)}'`);
+          envArgs.push("--setenv", key, shellQuote(value));
         }
       }
     }
-    const args = [
-      "--unshare-user",
-      "--unshare-ipc",
-      "--die-with-parent",
-      "--new-session",
-      "--cap-drop",
-      "ALL",
-      ...roBindArgs,
-      ...bindArgs,
-      "--dev",
-      "/dev",
-      "--size",
-      String(TMPFS_SIZE_BYTES),
-      "--tmpfs",
-      `'${shellEscape2(temp)}'`,
-      "--ro-bind",
-      "/etc",
-      "/etc",
-      "--ro-bind",
-      "/usr",
-      "/usr",
-      "--ro-bind",
-      "/lib",
-      "/lib",
-      "--ro-bind",
-      "/lib64",
-      "/lib64",
-      "--proc",
-      "/proc",
-      "--unshare-pid",
-      ...envArgs,
-      "--",
-      "bash",
-      "-c",
-      `'${shellEscape2(command)}'`
-    ];
-    if ((policy?.network_mode ?? "off") === "off") {
-      args.splice(1, 0, "--unshare-net");
-    }
+    const args = buildBwrapArgs({
+      quote: shellQuote,
+      temp,
+      readonlyRoots,
+      scopes: allScopes,
+      envArgs,
+      networkMode: policy?.network_mode,
+      command
+    });
     const binary = _internals4.resolveBwrapBinary();
     return `${binary} ${args.join(" ")}`;
   }
@@ -1259,13 +1302,23 @@ class BubblewrapSandboxExecutor {
     return {};
   }
 }
-var BWRAP_VERSION_EXIT = 0, BWRAP_UNAVAILABLE_CODES, BWRAP_ABSOLUTE = "/usr/bin/bwrap", TMPFS_SIZE_BYTES = 524288000, _internals4;
+var BWRAP_VERSION_EXIT = 0, BWRAP_UNAVAILABLE_CODES, BWRAP_ABSOLUTE = "/usr/bin/bwrap", TMPFS_SIZE_BYTES = 524288000, BWRAP_NAMESPACE_SMOKE_ARGS, _internals4;
 var init_bubblewrap_executor = __esm(() => {
   init_logger();
   init_executor();
   BWRAP_UNAVAILABLE_CODES = new Set(["ENOENT", "EACCES", "ENOSPC"]);
+  BWRAP_NAMESPACE_SMOKE_ARGS = buildBwrapArgs({
+    quote: (value) => value,
+    temp: "/tmp",
+    readonlyRoots: [],
+    scopes: [],
+    envArgs: [],
+    networkMode: "off",
+    command: "true"
+  });
   _internals4 = {
     probeBwrap,
+    probeBwrapNamespace,
     resolveBwrapBinary
   };
 });
@@ -1604,6 +1657,17 @@ async function probeLinux() {
     const binary = _internals4.resolveBwrapBinary();
     const output = await _internals5.withProbeTimeout(binary, ["--version"], 2000);
     if (output.length > 0) {
+      try {
+        await _internals5.withProbeTimeout(binary, [...BWRAP_NAMESPACE_SMOKE_ARGS], 2000);
+      } catch (smokeError) {
+        const detail = smokeError instanceof Error ? smokeError.message : String(smokeError);
+        return {
+          status: "disabled",
+          mechanism: "Bubblewrap",
+          platform: "linux",
+          error: `bwrap cannot create a sandbox on this host (unprivileged user namespaces may be restricted): ${detail}`
+        };
+      }
       return {
         status: "enabled",
         strength: "strong",

package/dist/cli/{index-r3gphy10.js → index-cme96pja.js}

@@ -1,10 +1,10 @@
 // @bun
 import {
   computePlanStructureHash
-} from "./index-yfmgbhwz.js";
+} from "./index-ef0tgsgj.js";
 import {
   appendCoreEventSync
-} from "./index-d4cjbm4p.js";
+} from "./index-a9m7h5v0.js";
 import {
   deleteCoordinationState,
   importCoordinationOnce,
@@ -12,10 +12,10 @@ import {
   transitionCoordinationState,
   transitionCoordinationStateWithinTransaction,
   withCoordinationTransaction
-} from "./index-9b6bxe9b.js";
+} from "./index-mbn4vn3z.js";
 import {
   getProjectDb
-} from "./index-ga1pcs49.js";
+} from "./index-8zj647hc.js";
 import {
   canonicalExistingFilesystemPath,
   legacyCanonicalExistingFilesystemPath
@@ -32,7 +32,7 @@ import {
 import {
   atomicWriteSwarmFile,
   atomicWriteSwarmFileSync
-} from "./index-025wg2re.js";
+} from "./index-nwswxes7.js";
 import {
   PlanSchema
 } from "./index-gx2vp8gx.js";

package/dist/cli/{index-4cm1p2kj.js → index-dt4cjxbz.js}

@@ -4,7 +4,7 @@ import {
   getProjectDb,
   projectDbExists,
   withImmediateTransaction
-} from "./index-ga1pcs49.js";
+} from "./index-8zj647hc.js";
 import {
   derivePlanId,
   derivePlanIdentityHash

package/dist/cli/{index-f6e44xh2.js → index-dtet46e6.js}

@@ -1,27 +1,27 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-mhqh2dc9.js";
+} from "./index-eaess7dm.js";
 import {
   deleteCoordinationState,
   importCoordinationOnce,
   listCoordinationStates,
   transitionCoordinationState,
   withCoordinationTransaction
-} from "./index-9b6bxe9b.js";
+} from "./index-mbn4vn3z.js";
 import {
   getProjectDb,
   projectDbExists
-} from "./index-ga1pcs49.js";
+} from "./index-8zj647hc.js";
 import {
   observeStoreHealth
-} from "./index-k6h66zm3.js";
+} from "./index-4twjbsfw.js";
 import {
   withEvidenceLock
-} from "./index-8bx6vhzk.js";
+} from "./index-e8k0v19e.js";
 import {
   telemetry
-} from "./index-7vnr5cmp.js";
+} from "./index-mtqwyjrg.js";
 import {
   canonicalRootKey,
   canonicalRootKeyFresh,
@@ -29,7 +29,7 @@ import {
 } from "./index-fzpt2djt.js";
 import {
   atomicWriteSwarmFileSync
-} from "./index-025wg2re.js";
+} from "./index-nwswxes7.js";
 import {
   exports_external,
   init_zod

package/dist/cli/{index-8bx6vhzk.js → index-e8k0v19e.js}

@@ -4,7 +4,7 @@ import {
 } from "./index-t7hmqgjy.js";
 import {
   emit
-} from "./index-7vnr5cmp.js";
+} from "./index-mtqwyjrg.js";
 import {
   tryAcquireLock
 } from "./index-ejhxgyvm.js";

package/dist/cli/{index-mhqh2dc9.js → index-eaess7dm.js}

@@ -10,7 +10,7 @@ import {
   readCachedTextFile,
   wasObservedToExist,
   wasRecentlyWrittenByThisProcess
-} from "./index-025wg2re.js";
+} from "./index-nwswxes7.js";
 import {
   warn
 } from "./index-zgwm4ryv.js";

package/dist/cli/{index-yfmgbhwz.js → index-ef0tgsgj.js}

@@ -4,20 +4,20 @@ import {
   projectDbExists,
   withImmediateTransaction,
   withProjectDbReadOnly
-} from "./index-ga1pcs49.js";
+} from "./index-8zj647hc.js";
 import {
   derivePlanId,
   derivePlanIdentityHash
 } from "./index-7pmbnjvj.js";
 import {
   withEvidenceLock
-} from "./index-8bx6vhzk.js";
+} from "./index-e8k0v19e.js";
 import {
   assertProjectRoot
 } from "./index-t7hmqgjy.js";
 import {
   emit
-} from "./index-7vnr5cmp.js";
+} from "./index-mtqwyjrg.js";
 import {
   ExecutionProfileSchema,
   PlanSchema,
@@ -27,11 +27,11 @@ import {
 import {
   init_loader,
   loadPluginConfig
-} from "./index-ney8qpg3.js";
+} from "./index-rhjzq6kw.js";
 import {
   init_package,
   package_default
-} from "./index-b79a8pc2.js";
+} from "./index-04knttpn.js";
 import {
   criticalWarn,
   init_logger,
@@ -1976,6 +1976,20 @@ async function loadLastApprovedPlan(directory, expectedPlanId) {
   const integrity = await readLedgerEventsWithIntegrity(directory);
   return findLastApprovedSnapshot(integrity.events, expectedPlanId);
 }
+function approvedSnapshotCoversPlan(approved, plan) {
+  const current = computePlanStructureHash(plan);
+  if (approved.payloadHash === current)
+    return true;
+  if (approved.plan.current_phase === plan.current_phase)
+    return false;
+  if (computePlanStructureHash(approved.plan) !== approved.payloadHash) {
+    return false;
+  }
+  return computePlanStructureHash({
+    ...approved.plan,
+    current_phase: plan.current_phase
+  }) === current;
+}
 async function loadLastPlanCriticApprovedSnapshot(directory, expectedPlanId) {
   const integrity = await readLedgerEventsWithIntegrity(directory);
   return findLastApprovedSnapshot(integrity.events, expectedPlanId, (payload) => payload.approval?.source === "plan_critic_gate");
@@ -2050,4 +2064,4 @@ var _internals = {
   randomUUID: () => crypto.randomUUID()
 };
 
-export { renderPlanningProfileDirective, resolvePlanningProfile, normalizeExecutionProfileForHash, LedgerStaleWriterError, computePlanLedgerHash, computePlanStructureHash, computeCurrentPlanHash, ledgerExists, getLatestLedgerSeq, readLedgerEvents, initLedger, readPlanEpochIdentity, getOrAdoptPlanEpochUnderLock, appendLedgerEvent, takeSnapshotWithRetry, takeSnapshotEvent, replaceTruncatedLedgerWithRecoveryRoot, clearPlanLedgerForReset, replacePlanLedgerWithRoot, replayFromLedger, peekPlanFromLedger, replayFromLedgerWithStatus, readLedgerEventsWithIntegrity, loadLastApprovedPlan, loadLastPlanCriticApprovedSnapshot };
+export { renderPlanningProfileDirective, resolvePlanningProfile, normalizeExecutionProfileForHash, LedgerStaleWriterError, computePlanLedgerHash, computePlanStructureHash, computeCurrentPlanHash, ledgerExists, getLatestLedgerSeq, readLedgerEvents, initLedger, readPlanEpochIdentity, getOrAdoptPlanEpochUnderLock, appendLedgerEvent, takeSnapshotWithRetry, takeSnapshotEvent, replaceTruncatedLedgerWithRecoveryRoot, clearPlanLedgerForReset, replacePlanLedgerWithRoot, replayFromLedger, peekPlanFromLedger, replayFromLedgerWithStatus, readLedgerEventsWithIntegrity, loadLastApprovedPlan, approvedSnapshotCoversPlan, loadLastPlanCriticApprovedSnapshot };

package/dist/cli/{index-0yrsvwdf.js → index-f6am4ypq.js}

@@ -2,10 +2,10 @@
 import {
   readKnowledgeEvents,
   recordKnowledgeEvent
-} from "./index-advcaree.js";
+} from "./index-4g39c948.js";
 import {
   queryHistoricalOutcomes
-} from "./index-v3bmeqqh.js";
+} from "./index-6a4t4p4p.js";
 import {
   jaccardBigram,
   readKnowledge,
@@ -13,7 +13,7 @@ import {
   resolveSwarmKnowledgePath,
   transactKnowledge,
   wordBigrams
-} from "./index-af3nmk6c.js";
+} from "./index-5mrvx2vm.js";
 import {
   init_knowledge_types,
   isActiveStatus
@@ -226,11 +226,11 @@ async function maybeQuarantineOnContradiction(directory, entryId, threshold, win
         alreadyInactive: true
       };
     }
-    const { quarantineEntry } = await import("./knowledge-validator-eze3s6fn.js");
+    const { quarantineEntry } = await import("./knowledge-validator-v13cjze1.js");
     let policyConfig;
     try {
-      const { KnowledgeConfigSchema } = await import("./schema-hzz32642.js");
-      const { loadPluginConfigWithMeta } = await import("./index-s81tvz98.js");
+      const { KnowledgeConfigSchema } = await import("./schema-qxgn4xzy.js");
+      const { loadPluginConfigWithMeta } = await import("./index-pq5962z7.js");
       const { config: loadedConfig } = loadPluginConfigWithMeta(directory);
       policyConfig = KnowledgeConfigSchema.parse(loadedConfig.knowledge ?? {});
     } catch {

package/dist/cli/{index-ejfmgkt0.js → index-fayfa263.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-mhqh2dc9.js";
+} from "./index-eaess7dm.js";
 import {
   bunSpawn
 } from "./index-2s7dvzff.js";
@@ -10,7 +10,7 @@ import {
 } from "./index-fzpt2djt.js";
 import {
   atomicWriteSwarmFileSync
-} from "./index-025wg2re.js";
+} from "./index-nwswxes7.js";
 import {
   advisoryWarn,
   init_git_executable,
@@ -242,7 +242,7 @@ var _internals2 = {
     symlinkSync: fs2.symlinkSync
   },
   writeScopeToDisk: async (directory, taskId, files) => {
-    const { writeScopeToDisk: realWrite } = await import("./scope-persistence-h4b6p951.js");
+    const { writeScopeToDisk: realWrite } = await import("./scope-persistence-9dscq6a2.js");
     return realWrite(directory, taskId, files);
   },
   writeLaneProfileToDisk: async (_worktreePath, _laneIndex, _envOverrides) => {

package/dist/cli/{index-bwh9196c.js → index-fzcr2s01.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-mhqh2dc9.js";
+} from "./index-eaess7dm.js";
 import {
   bunWrite
 } from "./index-2s7dvzff.js";
@@ -18,21 +18,21 @@ import {
   releaseCoordinationLease,
   transitionCoordinationState,
   withCoordinationTransaction
-} from "./index-9b6bxe9b.js";
+} from "./index-mbn4vn3z.js";
 import {
   getProjectDb,
   projectDbExists
-} from "./index-ga1pcs49.js";
+} from "./index-8zj647hc.js";
 import {
   observeDelegationLedgerPressure
-} from "./index-k6h66zm3.js";
+} from "./index-4twjbsfw.js";
 import {
   EvidenceLockTimeoutError,
   withEvidenceLock
-} from "./index-8bx6vhzk.js";
+} from "./index-e8k0v19e.js";
 import {
   telemetry
-} from "./index-7vnr5cmp.js";
+} from "./index-mtqwyjrg.js";
 import {
   canonicalRootKeyFresh,
   sameProjectRoot
@@ -4735,7 +4735,7 @@ async function reconcileLegacyCoderSettlements(directory, maxRecords, onReconcil
   const candidates = readDelegations(directory).filter((record) => record.normalizedAgent === "coder" && Boolean(record.legacyCoderSettlementTransfer) && Boolean(record.terminalResult)).slice(0, maxRecords);
   if (candidates.length === 0)
     return 0;
-  const { transferCoderSettlementToBackground } = await import("./coder-settlement-tgdjczyp.js");
+  const { transferCoderSettlementToBackground } = await import("./coder-settlement-0nhsjfh1.js");
   let transferred = 0;
   for (const record of candidates) {
     try {

package/dist/cli/{index-t433r606.js → index-fzqn2kk8.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-mhqh2dc9.js";
+} from "./index-eaess7dm.js";
 import {
   bunSpawn
 } from "./index-2s7dvzff.js";
@@ -11,7 +11,7 @@ import {
 } from "./index-fzpt2djt.js";
 import {
   atomicWriteSwarmFile
-} from "./index-025wg2re.js";
+} from "./index-nwswxes7.js";
 import {
   init_git_executable,
   resolveGitExecutable

package/dist/cli/{index-jdw63xyd.js → index-g7vd2azv.js}

@@ -5,11 +5,11 @@ import {
 import {
   atomicWriteFileAnyRoot,
   atomicWriteSwarmFileSync
-} from "./index-025wg2re.js";
+} from "./index-nwswxes7.js";
 import {
   init_loader,
   loadPluginConfig
-} from "./index-ney8qpg3.js";
+} from "./index-rhjzq6kw.js";
 import {
   init_logger,
   log,

package/dist/cli/{index-28zgn6sm.js → index-g8jd3h4r.js}

@@ -1,10 +1,10 @@
 // @bun
 import {
   validateSwarmPath
-} from "./index-mhqh2dc9.js";
+} from "./index-eaess7dm.js";
 import {
   atomicWriteSwarmFileSync
-} from "./index-025wg2re.js";
+} from "./index-nwswxes7.js";
 
 // src/hooks/delegation-gate/worktree-provisioning-owner.ts
 import { createHash } from "crypto";

package/dist/cli/{index-2wps5fec.js → index-hmgx2bsy.js}

@@ -1,10 +1,10 @@
 // @bun
 import {
   readEffectiveSpecSync
-} from "./index-pkgbrrn7.js";
+} from "./index-azr0092e.js";
 import {
   readSwarmFileAsync
-} from "./index-mhqh2dc9.js";
+} from "./index-eaess7dm.js";
 import {
   DURABILITY_CLASSES,
   DbWriteError,
@@ -13,7 +13,7 @@ import {
   classifyDbWriteError,
   getProjectDb,
   projectDbExists
-} from "./index-ga1pcs49.js";
+} from "./index-8zj647hc.js";
 import {
   _internals,
   canonicalRootKeyFresh

package/dist/cli/{index-9b6bxe9b.js → index-mbn4vn3z.js}

@@ -4,7 +4,7 @@ import {
   getProjectDb,
   projectDbExists,
   withImmediateTransaction
-} from "./index-ga1pcs49.js";
+} from "./index-8zj647hc.js";
 
 // src/db/coordination-store.ts
 import { createHash } from "crypto";

package/dist/cli/{index-7vnr5cmp.js → index-mtqwyjrg.js}

@@ -761,7 +761,7 @@ var CATALOG_SOURCE = [
       category: "plan",
       severity: "error",
       privacyClass: "sensitive",
-      producer: "src/plan/ledger.ts:1620",
+      producer: "src/plan/ledger.ts:1623",
       consumers: NO_CONSUMERS,
       futureOwnerIssue: ISSUE_SINK,
       retentionOwnerIssue: ISSUE_PLAN_EVIDENCE_RETENTION,

package/dist/cli/{index-867d9dhf.js → index-nd4kkbjw.js}

@@ -1,14 +1,14 @@
 // @bun
 import {
   observeStoreHealth
-} from "./index-k6h66zm3.js";
+} from "./index-4twjbsfw.js";
 import {
   telemetry
-} from "./index-7vnr5cmp.js";
+} from "./index-mtqwyjrg.js";
 import {
   init_schema,
   stripKnownSwarmPrefix
-} from "./index-b79a8pc2.js";
+} from "./index-04knttpn.js";
 import {
   init_constants
 } from "./index-py8wpe81.js";

package/dist/cli/{index-025wg2re.js → index-nwswxes7.js}

@@ -245,9 +245,9 @@ var SWARM_TEMP_GRAMMARS = [
       "src/hooks/review-receipt.ts:894",
       "src/knowledge/identity.ts:234",
       "src/evidence/phase-participation.ts (pre-#2035; migrated-to=src/evidence/phase-participation.ts:atomicWriteBytes)",
-      "src/turbo/lean/integration.ts:428",
+      "src/turbo/lean/integration.ts:429",
       "src/turbo/lean/reviewer.ts:403",
-      "src/plan/ledger.ts:1471",
+      "src/plan/ledger.ts:1474",
       "src/services/synonym-map.ts:389",
       "src/services/skill-optimizer/store.ts:340",
       "src/services/skill-optimizer/store.ts:503",
@@ -422,7 +422,7 @@ var SWARM_TEMP_GRAMMARS = [
       "src/hooks/skill-usage-pending.ts:817",
       "src/parallel/file-locks.ts:113",
       "src/plan/ledger.ts:607",
-      "src/plan/ledger.ts:1793"
+      "src/plan/ledger.ts:1796"
     ],
     note: "constant-name temps: reported when stale, never auto-quarantined. file-locks meta sidecars live under the scanner-skipped .swarm/locks/ subtree; the ledger reconcile temp embeds instance tokens but its .tmp-suffix shape maps here (conservatively report-only)"
   }