opencode-swarm 7.198.2 → 7.199.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.opencode/skills/swarm-pr-feedback/SKILL.md +6 -6
- package/.opencode/skills/swarm-pr-feedback/references/followup-dispositions.md +74 -0
- package/.opencode/skills/swarm-pr-review/references/lane-output-recoverability.md +25 -0
- package/binaries/win32-arm64/swarm-sandbox-runner.exe +0 -0
- package/binaries/win32-x64/swarm-sandbox-runner.exe +0 -0
- package/dist/background/pending-delegations.d.ts +1 -1
- package/dist/background/pr-review-contract.d.ts +10 -0
- package/dist/cli/{auto-checkpoint-ekp5j5v5.js → auto-checkpoint-x13d1g1t.js} +8 -8
- package/dist/cli/{checkpoint-30yrbqee.js → checkpoint-68nb8k3t.js} +16 -16
- package/dist/cli/{coder-settlement-t3zcgsd6.js → coder-settlement-kmdmdpyy.js} +12 -12
- package/dist/cli/{config-doctor-6w105xpy.js → config-doctor-4b0jb15n.js} +15 -15
- package/dist/cli/{core-6hyt1hg6.js → core-6kkm2vrz.js} +3 -3
- package/dist/cli/{curation-policy-m8ng2vm5.js → curation-policy-0smbd33w.js} +6 -6
- package/dist/cli/{curator-drift-z83e3a60.js → curator-drift-axcgdjy4.js} +8 -8
- package/dist/cli/curator-llm-factory-58ec737y.js +82 -0
- package/dist/cli/{curator-bzy7cess.js → curator-z8xzxh9f.js} +42 -42
- package/dist/cli/{doctor-knowledge-receipt-phase-id-8av1860z.js → doctor-knowledge-receipt-phase-id-hkjt6hv4.js} +8 -8
- package/dist/cli/{evidence-summary-service-ym7y7w5k.js → evidence-summary-service-981cx8wa.js} +19 -19
- package/dist/cli/{gate-evidence-vvhtzwry.js → gate-evidence-zyvwsp7a.js} +7 -7
- package/dist/cli/guardrail-explain-23b0amne.js +83 -0
- package/dist/cli/{guardrail-log-4f0jxq61.js → guardrail-log-s2gxszvm.js} +8 -7
- package/dist/cli/{guardrail-reset-cqq3yk9s.js → guardrail-reset-kt18vr45.js} +42 -42
- package/dist/cli/{hive-promoter-vvgdsx8s.js → hive-promoter-fz7ep8h4.js} +42 -42
- package/dist/cli/{index-rnjtf5kn.js → index-14vhp87b.js} +2 -2
- package/dist/cli/{index-yk1vnpzx.js → index-2bc7zfw3.js} +1 -1
- package/dist/cli/{index-d31b2zvf.js → index-2mx2gn97.js} +1 -1
- package/dist/cli/{index-5hbb3088.js → index-3zzxrwaf.js} +4 -4
- package/dist/cli/{index-bj916p5e.js → index-408tpd21.js} +261 -21
- package/dist/cli/{index-gc9dvmy7.js → index-4rrff8k6.js} +2 -2
- package/dist/cli/{index-89j5h1j9.js → index-4s6kdsfr.js} +1 -1
- package/dist/cli/{index-v85gn9jm.js → index-61fa8hg7.js} +5 -5
- package/dist/cli/{index-7e9mqse6.js → index-61m1jw7p.js} +3 -3
- package/dist/cli/{index-4s3770gs.js → index-6dtt0brw.js} +4 -4
- package/dist/cli/{index-whmby20t.js → index-795vmpe6.js} +42 -42
- package/dist/cli/{index-t7qgt5yk.js → index-7c432abn.js} +2 -2
- package/dist/cli/{index-xez06sc1.js → index-820pzqd6.js} +1 -1
- package/dist/cli/{index-mx74665q.js → index-8pyg2qnw.js} +4 -4
- package/dist/cli/{index-v30zmakk.js → index-9ztsfved.js} +2 -2
- package/dist/cli/{index-tnnxvq2f.js → index-bb2rx8k2.js} +6 -6
- package/dist/cli/{index-qg6qn99c.js → index-bkscmz4z.js} +7 -7
- package/dist/cli/{index-vjwmcxz4.js → index-f900029m.js} +7 -7
- package/dist/cli/{index-drf91t9h.js → index-fmbqyqqw.js} +5 -5
- package/dist/cli/{index-cfs1k1eh.js → index-ge7vn1vz.js} +5 -5
- package/dist/cli/{index-e4hj8r57.js → index-h349p91m.js} +34 -3
- package/dist/cli/{index-tdpfecs3.js → index-hc6wa3yg.js} +2 -2
- package/dist/cli/{index-76mg98ac.js → index-jccs3fgn.js} +1 -1
- package/dist/cli/{index-wg1mt92h.js → index-jhk4000q.js} +9 -8
- package/dist/cli/{index-xxb2depv.js → index-m4s5a2sp.js} +7 -7
- package/dist/cli/{index-y81sw9vt.js → index-mzx33w6e.js} +11 -11
- package/dist/cli/{index-9keabj7d.js → index-n9ry04hw.js} +4 -4
- package/dist/cli/{index-bczx8jcg.js → index-nacmcvc4.js} +5 -12
- package/dist/cli/{index-d9jrzepr.js → index-npy15m50.js} +3 -3
- package/dist/cli/{index-rqxwv4q5.js → index-nr1pj3hy.js} +1 -1
- package/dist/cli/{index-6pc5j9rb.js → index-nreezgrd.js} +3 -3
- package/dist/cli/{index-ehw0s6xa.js → index-p35gw2x7.js} +1 -1
- package/dist/cli/{index-xt4q610f.js → index-p5pgjp7n.js} +1 -1
- package/dist/cli/{index-166xny29.js → index-pf0xrx9w.js} +605 -172
- package/dist/cli/{index-59w9zfc5.js → index-px1dnna2.js} +5 -5
- package/dist/cli/{index-84r9rydf.js → index-pxdc0qn1.js} +2 -2
- package/dist/cli/{index-5h5tj8wc.js → index-qqv9rr8k.js} +44 -44
- package/dist/cli/{index-hd3d7rcw.js → index-r7ayh42s.js} +3 -3
- package/dist/cli/{index-rfcb9f54.js → index-t1t93qm0.js} +3 -2
- package/dist/cli/{index-xrghsqg3.js → index-vj0zede7.js} +4 -4
- package/dist/cli/{index-wrn4khfb.js → index-w00dj8p5.js} +1 -1
- package/dist/cli/{index-0ap067j7.js → index-w4624tpw.js} +2 -2
- package/dist/cli/{index-mjmsq8t7.js → index-w7d8gcj0.js} +2 -2
- package/dist/cli/{index-h86e4jp9.js → index-w9f2jbwe.js} +2 -2
- package/dist/cli/{index-bd4szzja.js → index-weewx5nx.js} +1 -1
- package/dist/cli/{index-0y5yvag6.js → index-xj9260dh.js} +6 -6
- package/dist/cli/{index-p4xmq6aa.js → index-ywb5er8g.js} +1 -1
- package/dist/cli/index.js +43 -43
- package/dist/cli/{knowledge-escalator-8hrnc4bd.js → knowledge-escalator-cf6m9y0s.js} +14 -14
- package/dist/cli/{knowledge-events-v2abqt9z.js → knowledge-events-hn5hymam.js} +12 -12
- package/dist/cli/{knowledge-link-5qt3pe5v.js → knowledge-link-1f91bzcc.js} +5 -5
- package/dist/cli/{knowledge-store-9y17zzce.js → knowledge-store-mgqk4hvy.js} +6 -6
- package/dist/cli/{knowledge-validator-7red2zwb.js → knowledge-validator-x9yrte9q.js} +8 -8
- package/dist/cli/{mcp-gbyndb15.js → mcp-hpmh4d6d.js} +1 -1
- package/dist/cli/{model-preflight-1tsaksc7.js → model-preflight-ry5jjnx4.js} +42 -42
- package/dist/cli/{pending-delegations-yg769m4y.js → pending-delegations-j850kj5p.js} +12 -12
- package/dist/cli/{pr-subscriptions-mc2mvjkj.js → pr-subscriptions-mme9gb5e.js} +12 -12
- package/dist/cli/{pr-workflow-gate-0fb280b2.js → pr-workflow-gate-n6bj3dnn.js} +46 -42
- package/dist/cli/{runner-rwya5yhg.js → runner-qe3fkzx5.js} +6 -6
- package/dist/cli/{scan-cursor-g74j6gcr.js → scan-cursor-fdpxbx4f.js} +7 -7
- package/dist/cli/{schema-q2v7px9y.js → schema-amcjvk8a.js} +1 -1
- package/dist/cli/{scope-persistence-g88f0163.js → scope-persistence-mp4kqpk2.js} +15 -15
- package/dist/cli/{server-j3a7q7gg.js → server-ptdvpwyd.js} +42 -42
- package/dist/cli/{skill-generator-30bjrvcc.js → skill-generator-v59hhybn.js} +16 -16
- package/dist/cli/{snapshot-coordination-init-9ekvft16.js → snapshot-coordination-init-nv6e4svp.js} +42 -42
- package/dist/cli/{speckit-checkoff-sx24fz29.js → speckit-checkoff-me8kd3wd.js} +4 -4
- package/dist/cli/{telemetry-t3425cht.js → telemetry-6yv06xyz.js} +1 -1
- package/dist/cli/{workspace-snapshot-bst64vey.js → workspace-snapshot-vhvrkbbb.js} +3 -3
- package/dist/cli/{worktree-collision-ownership-shtk6dsk.js → worktree-collision-ownership-84qyqars.js} +13 -13
- package/dist/cli/{worktree-isolation-x41cgd9n.js → worktree-isolation-99qvz8ap.js} +42 -42
- package/dist/config/schema.d.ts +2 -0
- package/dist/config/skill-contract-digest.d.ts +29 -4
- package/dist/hooks/guardrails/file-authority.d.ts +17 -0
- package/dist/hooks/pr-workflow-gate.d.ts +17 -0
- package/dist/hooks/skill-scoring.d.ts +40 -0
- package/dist/index.js +129 -120
- package/dist/pr-review/verdict-settlement.d.ts +40 -4
- package/dist/state.d.ts +49 -0
- package/opencode-swarm.schema.json +4 -0
- package/package.json +1 -1
- package/dist/cli/curator-llm-factory-ykpty14a.js +0 -82
- package/dist/cli/guardrail-explain-1ethgkvp.js +0 -83
|
@@ -1,14 +1,18 @@
|
|
|
1
1
|
// @bun
|
|
2
2
|
import {
|
|
3
3
|
observeStoreHealth
|
|
4
|
-
} from "./index-
|
|
4
|
+
} from "./index-hc6wa3yg.js";
|
|
5
5
|
import {
|
|
6
6
|
telemetry
|
|
7
|
-
} from "./index-
|
|
7
|
+
} from "./index-6dtt0brw.js";
|
|
8
|
+
import {
|
|
9
|
+
init_git_executable,
|
|
10
|
+
resolveGitExecutable
|
|
11
|
+
} from "./index-zxdawwc7.js";
|
|
8
12
|
import {
|
|
9
13
|
init_schema,
|
|
10
14
|
stripKnownSwarmPrefix
|
|
11
|
-
} from "./index-
|
|
15
|
+
} from "./index-t1t93qm0.js";
|
|
12
16
|
import {
|
|
13
17
|
init_constants
|
|
14
18
|
} from "./index-hqrkr9ag.js";
|
|
@@ -1806,6 +1810,7 @@ function stableCanonicalStringify(value) {
|
|
|
1806
1810
|
}
|
|
1807
1811
|
|
|
1808
1812
|
// src/hooks/guardrails/file-authority.ts
|
|
1813
|
+
import { execFileSync } from "child_process";
|
|
1809
1814
|
import * as fsSync from "fs";
|
|
1810
1815
|
var import_picomatch = __toESM(require_picomatch2(), 1);
|
|
1811
1816
|
import * as path2 from "path";
|
|
@@ -2148,12 +2153,166 @@ function protectedRoots(projectRoot, additional = []) {
|
|
|
2148
2153
|
var HASH_INPUT_CAP_BYTES = 64 * 1024;
|
|
2149
2154
|
|
|
2150
2155
|
// src/hooks/guardrails/file-authority.ts
|
|
2156
|
+
init_git_executable();
|
|
2151
2157
|
var pathNormalizationCache = new QuickLRU({
|
|
2152
2158
|
maxSize: 500
|
|
2153
2159
|
});
|
|
2154
2160
|
var globMatcherCache = new QuickLRU({
|
|
2155
2161
|
maxSize: 200
|
|
2156
2162
|
});
|
|
2163
|
+
var GIT_WORKTREE_CACHE_MAX_AGE_MS = 60000;
|
|
2164
|
+
var gitWorktreeCache = new QuickLRU({
|
|
2165
|
+
maxSize: 50,
|
|
2166
|
+
maxAge: GIT_WORKTREE_CACHE_MAX_AGE_MS
|
|
2167
|
+
});
|
|
2168
|
+
function gitEnvWithoutRepoRedirectors() {
|
|
2169
|
+
const env = { ...process.env };
|
|
2170
|
+
delete env.GIT_DIR;
|
|
2171
|
+
delete env.GIT_WORK_TREE;
|
|
2172
|
+
delete env.GIT_INDEX_FILE;
|
|
2173
|
+
delete env.GIT_COMMON_DIR;
|
|
2174
|
+
return env;
|
|
2175
|
+
}
|
|
2176
|
+
function parseWorktreeListPorcelain(output) {
|
|
2177
|
+
const records = [];
|
|
2178
|
+
for (const line of output.split(`
|
|
2179
|
+
`)) {
|
|
2180
|
+
if (line.startsWith("worktree ")) {
|
|
2181
|
+
const wtPath = line.slice("worktree ".length).trim();
|
|
2182
|
+
if (wtPath) {
|
|
2183
|
+
records.push({ path: wtPath, attributes: new Set });
|
|
2184
|
+
}
|
|
2185
|
+
continue;
|
|
2186
|
+
}
|
|
2187
|
+
const record = records[records.length - 1];
|
|
2188
|
+
if (!record)
|
|
2189
|
+
continue;
|
|
2190
|
+
const separator = line.indexOf(" ");
|
|
2191
|
+
const attribute = separator === -1 ? line : line.slice(0, separator);
|
|
2192
|
+
if (attribute)
|
|
2193
|
+
record.attributes.add(attribute);
|
|
2194
|
+
}
|
|
2195
|
+
return records;
|
|
2196
|
+
}
|
|
2197
|
+
function canonicalizeWindowsPathNative(p) {
|
|
2198
|
+
if (process.platform !== "win32")
|
|
2199
|
+
return p;
|
|
2200
|
+
try {
|
|
2201
|
+
const native = fsSync.realpathSync.native(p);
|
|
2202
|
+
return native.startsWith(String.fromCharCode(92, 92, 63, 92)) ? native.slice(4) : native;
|
|
2203
|
+
} catch {
|
|
2204
|
+
return;
|
|
2205
|
+
}
|
|
2206
|
+
}
|
|
2207
|
+
function canonicalizeWindowsPathTailTolerant(p) {
|
|
2208
|
+
if (process.platform !== "win32")
|
|
2209
|
+
return p;
|
|
2210
|
+
const tail = [];
|
|
2211
|
+
let probe = p;
|
|
2212
|
+
for (;; ) {
|
|
2213
|
+
const native = canonicalizeWindowsPathNative(probe);
|
|
2214
|
+
if (native !== undefined) {
|
|
2215
|
+
return tail.length === 0 ? native : path2.join(native, ...tail.reverse());
|
|
2216
|
+
}
|
|
2217
|
+
const parent = path2.dirname(probe);
|
|
2218
|
+
if (parent === probe)
|
|
2219
|
+
return p;
|
|
2220
|
+
tail.push(path2.basename(probe));
|
|
2221
|
+
probe = parent;
|
|
2222
|
+
}
|
|
2223
|
+
}
|
|
2224
|
+
function isValidWorktreeRecord(repoRootRecord, record) {
|
|
2225
|
+
if (record === repoRootRecord) {
|
|
2226
|
+
try {
|
|
2227
|
+
return fsSync.statSync(path2.join(record.path, ".git")).isDirectory();
|
|
2228
|
+
} catch {
|
|
2229
|
+
return false;
|
|
2230
|
+
}
|
|
2231
|
+
}
|
|
2232
|
+
if (record.attributes.has("bare"))
|
|
2233
|
+
return false;
|
|
2234
|
+
const dotGitPath = path2.join(record.path, ".git");
|
|
2235
|
+
let dotGitStat;
|
|
2236
|
+
try {
|
|
2237
|
+
dotGitStat = fsSync.lstatSync(dotGitPath);
|
|
2238
|
+
} catch {
|
|
2239
|
+
return false;
|
|
2240
|
+
}
|
|
2241
|
+
if (!dotGitStat.isFile())
|
|
2242
|
+
return false;
|
|
2243
|
+
let gitDirLine;
|
|
2244
|
+
try {
|
|
2245
|
+
gitDirLine = fsSync.readFileSync(dotGitPath, "utf8").trim();
|
|
2246
|
+
} catch {
|
|
2247
|
+
return false;
|
|
2248
|
+
}
|
|
2249
|
+
if (!gitDirLine.startsWith("gitdir:"))
|
|
2250
|
+
return false;
|
|
2251
|
+
const gitDirRef = gitDirLine.slice("gitdir:".length).trim();
|
|
2252
|
+
if (!gitDirRef)
|
|
2253
|
+
return false;
|
|
2254
|
+
const gitDirPath = path2.isAbsolute(gitDirRef) ? gitDirRef : path2.resolve(record.path, gitDirRef);
|
|
2255
|
+
let registrationGitdirFile;
|
|
2256
|
+
try {
|
|
2257
|
+
registrationGitdirFile = fsSync.realpathSync(path2.join(gitDirPath, "gitdir"));
|
|
2258
|
+
} catch {
|
|
2259
|
+
return false;
|
|
2260
|
+
}
|
|
2261
|
+
if (repoRootRecord) {
|
|
2262
|
+
let worktreesRoot;
|
|
2263
|
+
try {
|
|
2264
|
+
worktreesRoot = path2.join(fsSync.realpathSync(path2.join(repoRootRecord.path, ".git")), "worktrees");
|
|
2265
|
+
} catch {
|
|
2266
|
+
return false;
|
|
2267
|
+
}
|
|
2268
|
+
if (!isPathIdentityWithin(registrationGitdirFile, worktreesRoot)) {
|
|
2269
|
+
return false;
|
|
2270
|
+
}
|
|
2271
|
+
}
|
|
2272
|
+
let backReference;
|
|
2273
|
+
try {
|
|
2274
|
+
backReference = fsSync.readFileSync(registrationGitdirFile, "utf8").trim();
|
|
2275
|
+
} catch {
|
|
2276
|
+
return false;
|
|
2277
|
+
}
|
|
2278
|
+
try {
|
|
2279
|
+
return pathIdentitiesEqual(fsSync.realpathSync(dotGitPath), fsSync.realpathSync(backReference));
|
|
2280
|
+
} catch {
|
|
2281
|
+
return false;
|
|
2282
|
+
}
|
|
2283
|
+
}
|
|
2284
|
+
function getLinkedGitWorktrees(dir) {
|
|
2285
|
+
const cached = gitWorktreeCache.get(dir);
|
|
2286
|
+
if (cached !== undefined) {
|
|
2287
|
+
return cached;
|
|
2288
|
+
}
|
|
2289
|
+
const worktrees = [];
|
|
2290
|
+
try {
|
|
2291
|
+
const output = execFileSync(resolveGitExecutable(), ["worktree", "list", "--porcelain"], {
|
|
2292
|
+
cwd: dir,
|
|
2293
|
+
encoding: "utf8",
|
|
2294
|
+
stdio: ["ignore", "pipe", "ignore"],
|
|
2295
|
+
timeout: 1500,
|
|
2296
|
+
maxBuffer: 4 * 1024 * 1024,
|
|
2297
|
+
windowsHide: true,
|
|
2298
|
+
env: gitEnvWithoutRepoRedirectors()
|
|
2299
|
+
});
|
|
2300
|
+
const records = parseWorktreeListPorcelain(output);
|
|
2301
|
+
const repoRootRecord = records[0];
|
|
2302
|
+
for (const record of records) {
|
|
2303
|
+
if (!isValidWorktreeRecord(repoRootRecord, record)) {
|
|
2304
|
+
continue;
|
|
2305
|
+
}
|
|
2306
|
+
const native = canonicalizeWindowsPathNative(record.path);
|
|
2307
|
+
if (native === undefined) {
|
|
2308
|
+
continue;
|
|
2309
|
+
}
|
|
2310
|
+
worktrees.push(native);
|
|
2311
|
+
}
|
|
2312
|
+
} catch {}
|
|
2313
|
+
gitWorktreeCache.set(dir, worktrees);
|
|
2314
|
+
return worktrees;
|
|
2315
|
+
}
|
|
2157
2316
|
function normalizePathWithCache(filePath, cwd) {
|
|
2158
2317
|
const cacheKey = `${cwd}:${filePath}`;
|
|
2159
2318
|
const cached = pathNormalizationCache.get(cacheKey);
|
|
@@ -2468,23 +2627,93 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
|
|
|
2468
2627
|
resolvedTarget = path2.resolve(dir, filePath);
|
|
2469
2628
|
normalizedPath = path2.relative(dir, resolvedTarget).replace(/\\/g, "/");
|
|
2470
2629
|
}
|
|
2630
|
+
let effectiveDir = dir;
|
|
2631
|
+
const nativeTarget2 = canonicalizeWindowsPathTailTolerant(resolvedTarget);
|
|
2632
|
+
const matchWorktreeRoot = () => {
|
|
2633
|
+
const worktrees = getLinkedGitWorktrees(dir);
|
|
2634
|
+
let best;
|
|
2635
|
+
for (const wt of worktrees) {
|
|
2636
|
+
const relToWt = path2.relative(wt, nativeTarget2).replace(/\\/g, "/");
|
|
2637
|
+
if (relToWt !== ".." && !relToWt.startsWith("../") && !isOnDifferentFilesystemRoot(nativeTarget2, wt)) {
|
|
2638
|
+
if (!best || wt.length > best.wt.length) {
|
|
2639
|
+
best = { wt, rel: relToWt };
|
|
2640
|
+
}
|
|
2641
|
+
}
|
|
2642
|
+
}
|
|
2643
|
+
if (best) {
|
|
2644
|
+
effectiveDir = best.wt;
|
|
2645
|
+
normalizedPath = best.rel;
|
|
2646
|
+
}
|
|
2647
|
+
return best?.wt;
|
|
2648
|
+
};
|
|
2649
|
+
const findPlantedLinkBelow = (root) => {
|
|
2650
|
+
const ancestors = [];
|
|
2651
|
+
let current = nativeTarget2;
|
|
2652
|
+
while (true) {
|
|
2653
|
+
const rel = path2.relative(root, current);
|
|
2654
|
+
if (rel === "" || rel === ".." || rel.startsWith(`..${path2.sep}`) || path2.isAbsolute(rel))
|
|
2655
|
+
break;
|
|
2656
|
+
ancestors.push(current);
|
|
2657
|
+
const parent = path2.dirname(current);
|
|
2658
|
+
if (parent === current)
|
|
2659
|
+
break;
|
|
2660
|
+
current = parent;
|
|
2661
|
+
}
|
|
2662
|
+
for (const ancestor of ancestors) {
|
|
2663
|
+
try {
|
|
2664
|
+
if (fsSync.lstatSync(ancestor).isSymbolicLink())
|
|
2665
|
+
return ancestor;
|
|
2666
|
+
} catch (err) {
|
|
2667
|
+
const code = err.code;
|
|
2668
|
+
if (code === "ENOENT")
|
|
2669
|
+
continue;
|
|
2670
|
+
return ancestor;
|
|
2671
|
+
}
|
|
2672
|
+
}
|
|
2673
|
+
return null;
|
|
2674
|
+
};
|
|
2471
2675
|
if (isOnDifferentFilesystemRoot(resolvedTarget, dir)) {
|
|
2472
|
-
|
|
2473
|
-
|
|
2474
|
-
|
|
2475
|
-
|
|
2476
|
-
|
|
2477
|
-
|
|
2478
|
-
|
|
2479
|
-
|
|
2480
|
-
|
|
2481
|
-
|
|
2482
|
-
|
|
2483
|
-
|
|
2484
|
-
|
|
2485
|
-
|
|
2676
|
+
const matchedWorktree = matchWorktreeRoot();
|
|
2677
|
+
if (!matchedWorktree) {
|
|
2678
|
+
return denyAuthority(agentName, normalizedPath, {
|
|
2679
|
+
code: "AUTHORITY_ROOT_ESCAPE",
|
|
2680
|
+
layer: "containment",
|
|
2681
|
+
rule: "same-filesystem-root",
|
|
2682
|
+
detail: "target is on a different drive or filesystem root"
|
|
2683
|
+
});
|
|
2684
|
+
}
|
|
2685
|
+
const plantedLink = findPlantedLinkBelow(matchedWorktree);
|
|
2686
|
+
if (plantedLink) {
|
|
2687
|
+
return denyAuthority(agentName, normalizedPath, {
|
|
2688
|
+
code: "AUTHORITY_ROOT_ESCAPE",
|
|
2689
|
+
layer: "containment",
|
|
2690
|
+
rule: "workspace-containment",
|
|
2691
|
+
detail: `re-rooted target crosses symlink/junction "${plantedLink}" inside the matched worktree`
|
|
2692
|
+
});
|
|
2693
|
+
}
|
|
2694
|
+
} else if (normalizedPath === ".." || normalizedPath.startsWith("../")) {
|
|
2695
|
+
const matchedWorktree = matchWorktreeRoot();
|
|
2696
|
+
if (!matchedWorktree) {
|
|
2697
|
+
return denyAuthority(agentName, normalizedPath, {
|
|
2698
|
+
code: "AUTHORITY_ROOT_ESCAPE",
|
|
2699
|
+
layer: "containment",
|
|
2700
|
+
rule: "workspace-containment",
|
|
2701
|
+
detail: "target resolves outside the working directory"
|
|
2702
|
+
});
|
|
2703
|
+
}
|
|
2704
|
+
const plantedLink = findPlantedLinkBelow(matchedWorktree);
|
|
2705
|
+
if (plantedLink) {
|
|
2706
|
+
return denyAuthority(agentName, normalizedPath, {
|
|
2707
|
+
code: "AUTHORITY_ROOT_ESCAPE",
|
|
2708
|
+
layer: "containment",
|
|
2709
|
+
rule: "workspace-containment",
|
|
2710
|
+
detail: `re-rooted target crosses symlink/junction "${plantedLink}" inside the matched worktree`
|
|
2711
|
+
});
|
|
2712
|
+
}
|
|
2486
2713
|
}
|
|
2487
|
-
const
|
|
2714
|
+
const classifiedRules = effectiveRules[normalizedAgent] ?? effectiveRules[strippedAgent];
|
|
2715
|
+
const unclassifiedWhileDisabled = !classifiedRules && options.authorityEnabled === false && normalizedAgent !== "unknown";
|
|
2716
|
+
const rules = classifiedRules ?? (unclassifiedWhileDisabled ? {} : undefined);
|
|
2488
2717
|
if (!rules) {
|
|
2489
2718
|
return denyAuthority(agentName, normalizedPath, {
|
|
2490
2719
|
code: "AUTHORITY_UNKNOWN_AGENT",
|
|
@@ -2494,10 +2723,10 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
|
|
|
2494
2723
|
});
|
|
2495
2724
|
}
|
|
2496
2725
|
const flavor = getPathFlavor();
|
|
2497
|
-
const matchesPathPrefix = (candidate, prefix) => isPathIdentityWithin(path2.resolve(
|
|
2726
|
+
const matchesPathPrefix = (candidate, prefix) => isPathIdentityWithin(path2.resolve(effectiveDir, candidate), path2.resolve(effectiveDir, prefix), flavor);
|
|
2498
2727
|
const matchesGlob = (glob) => getGlobMatcher(glob)(normalizedPath);
|
|
2499
2728
|
for (const prefix of options.universalDenyPrefixes ?? []) {
|
|
2500
|
-
if (matchesAuthorityDenyPrefix(normalizedPath, prefix,
|
|
2729
|
+
if (matchesAuthorityDenyPrefix(normalizedPath, prefix, effectiveDir, flavor)) {
|
|
2501
2730
|
return denyAuthority(agentName, normalizedPath, {
|
|
2502
2731
|
code: "AUTHORITY_UNIVERSAL_DENY",
|
|
2503
2732
|
layer: "universal-deny",
|
|
@@ -2518,6 +2747,17 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
|
|
|
2518
2747
|
detail: "coder writes to repository control state (.git/.swarm) are always protected"
|
|
2519
2748
|
});
|
|
2520
2749
|
}
|
|
2750
|
+
if (unclassifiedWhileDisabled && isPolicyProtectedPath(normalizedPath, {
|
|
2751
|
+
includeDefaults: false,
|
|
2752
|
+
additional: [".git", ".swarm"]
|
|
2753
|
+
})) {
|
|
2754
|
+
return denyAuthority(agentName, normalizedPath, {
|
|
2755
|
+
code: "AUTHORITY_PROTECTED_PATH",
|
|
2756
|
+
layer: "protected-path",
|
|
2757
|
+
rule: "unclassified-agent-control-state-protection",
|
|
2758
|
+
detail: "unclassified agent writes to repository control state (.git/.swarm) are always protected"
|
|
2759
|
+
});
|
|
2760
|
+
}
|
|
2521
2761
|
const isSwarmRole = Object.hasOwn(AUTHORITY_ROLE_CAPABILITIES, strippedAgent);
|
|
2522
2762
|
if (isSwarmRole) {
|
|
2523
2763
|
const matchedVerifier = [
|
|
@@ -2550,7 +2790,7 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
|
|
|
2550
2790
|
detail: "agent role is read-only"
|
|
2551
2791
|
});
|
|
2552
2792
|
}
|
|
2553
|
-
const pathIsInDeclaredScope = isCoderAgent && options.declaredScope != null && options.declaredScope.length > 0 && isPathWithinDeclaredScope(normalizedPath, options.declaredScope,
|
|
2793
|
+
const pathIsInDeclaredScope = isCoderAgent && options.declaredScope != null && options.declaredScope.length > 0 && isPathWithinDeclaredScope(normalizedPath, options.declaredScope, effectiveDir);
|
|
2554
2794
|
if (pathIsInDeclaredScope) {
|
|
2555
2795
|
return {
|
|
2556
2796
|
allowed: true,
|
|
@@ -2,10 +2,10 @@
|
|
|
2
2
|
import {
|
|
3
3
|
init_loader,
|
|
4
4
|
loadPluginConfigWithMeta
|
|
5
|
-
} from "./index-
|
|
5
|
+
} from "./index-weewx5nx.js";
|
|
6
6
|
import {
|
|
7
7
|
init_schema
|
|
8
|
-
} from "./index-
|
|
8
|
+
} from "./index-t1t93qm0.js";
|
|
9
9
|
import {
|
|
10
10
|
DEFAULT_WORKTREE_ISOLATION_CONFIG,
|
|
11
11
|
init_constants
|
|
@@ -4,26 +4,26 @@ import {
|
|
|
4
4
|
} from "./index-m9zzj4ee.js";
|
|
5
5
|
import {
|
|
6
6
|
validateSwarmPath
|
|
7
|
-
} from "./index-
|
|
7
|
+
} from "./index-820pzqd6.js";
|
|
8
8
|
import {
|
|
9
9
|
observeReceiptTransition
|
|
10
|
-
} from "./index-
|
|
10
|
+
} from "./index-hc6wa3yg.js";
|
|
11
11
|
import {
|
|
12
12
|
assertProjectRoot
|
|
13
13
|
} from "./index-t7hmqgjy.js";
|
|
14
14
|
import {
|
|
15
15
|
emit
|
|
16
|
-
} from "./index-
|
|
16
|
+
} from "./index-6dtt0brw.js";
|
|
17
17
|
import {
|
|
18
18
|
resolveActivePhaseId
|
|
19
19
|
} from "./index-gx2vp8gx.js";
|
|
20
20
|
import {
|
|
21
21
|
loadPluginConfigWithMeta
|
|
22
|
-
} from "./index-
|
|
22
|
+
} from "./index-weewx5nx.js";
|
|
23
23
|
import {
|
|
24
24
|
KnowledgeConfigSchema,
|
|
25
25
|
init_schema
|
|
26
|
-
} from "./index-
|
|
26
|
+
} from "./index-t1t93qm0.js";
|
|
27
27
|
|
|
28
28
|
// src/utils/context-decisions.ts
|
|
29
29
|
function extractContextDecisions(content) {
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
// @bun
|
|
2
2
|
import {
|
|
3
3
|
validateSwarmPath
|
|
4
|
-
} from "./index-
|
|
4
|
+
} from "./index-820pzqd6.js";
|
|
5
5
|
import {
|
|
6
6
|
bunSpawn
|
|
7
7
|
} from "./index-2s7dvzff.js";
|
|
@@ -10,7 +10,7 @@ import {
|
|
|
10
10
|
} from "./index-fzpt2djt.js";
|
|
11
11
|
import {
|
|
12
12
|
atomicWriteSwarmFileSync
|
|
13
|
-
} from "./index-
|
|
13
|
+
} from "./index-ywb5er8g.js";
|
|
14
14
|
import {
|
|
15
15
|
advisoryWarn,
|
|
16
16
|
init_git_executable,
|
|
@@ -242,7 +242,7 @@ var _internals2 = {
|
|
|
242
242
|
symlinkSync: fs2.symlinkSync
|
|
243
243
|
},
|
|
244
244
|
writeScopeToDisk: async (directory, taskId, files) => {
|
|
245
|
-
const { writeScopeToDisk: realWrite } = await import("./scope-persistence-
|
|
245
|
+
const { writeScopeToDisk: realWrite } = await import("./scope-persistence-mp4kqpk2.js");
|
|
246
246
|
return realWrite(directory, taskId, files);
|
|
247
247
|
},
|
|
248
248
|
writeLaneProfileToDisk: async (_worktreePath, _laneIndex, _envOverrides) => {
|
|
@@ -236,7 +236,7 @@ var CATALOG_SOURCE = [
|
|
|
236
236
|
category: "delegation",
|
|
237
237
|
severity: "info",
|
|
238
238
|
privacyClass: "pseudonymous",
|
|
239
|
-
producer: "src/index.ts:
|
|
239
|
+
producer: "src/index.ts:1007",
|
|
240
240
|
consumers: CONSUMER_COST_CORRECTION,
|
|
241
241
|
retentionOwnerIssue: ISSUE_COST_RETENTION,
|
|
242
242
|
requiredWorkflowIds: REQUIRE_SESSION_AND_TASK,
|
|
@@ -249,7 +249,7 @@ var CATALOG_SOURCE = [
|
|
|
249
249
|
category: "delegation",
|
|
250
250
|
severity: "info",
|
|
251
251
|
privacyClass: "pseudonymous",
|
|
252
|
-
producer: "src/index.ts:
|
|
252
|
+
producer: "src/index.ts:2170",
|
|
253
253
|
consumers: NO_CONSUMERS,
|
|
254
254
|
futureOwnerIssue: ISSUE_SINK,
|
|
255
255
|
retentionOwnerIssue: ISSUE_COST_RETENTION,
|
|
@@ -263,7 +263,7 @@ var CATALOG_SOURCE = [
|
|
|
263
263
|
category: "delegation",
|
|
264
264
|
severity: "notice",
|
|
265
265
|
privacyClass: "pseudonymous",
|
|
266
|
-
producer: "src/index.ts:
|
|
266
|
+
producer: "src/index.ts:2190",
|
|
267
267
|
consumers: CONSUMER_COST_JOIN,
|
|
268
268
|
retentionOwnerIssue: ISSUE_COST_RETENTION,
|
|
269
269
|
requiredWorkflowIds: REQUIRE_SESSION,
|
|
@@ -408,7 +408,7 @@ var CATALOG_SOURCE = [
|
|
|
408
408
|
category: "gate",
|
|
409
409
|
severity: "info",
|
|
410
410
|
privacyClass: "pseudonymous",
|
|
411
|
-
producer: "src/pr-review/legacy-transcript-adapter.ts:
|
|
411
|
+
producer: "src/pr-review/legacy-transcript-adapter.ts:1032",
|
|
412
412
|
consumers: NO_CONSUMERS,
|
|
413
413
|
futureOwnerIssue: ISSUE_SINK,
|
|
414
414
|
retentionOwnerIssue: ISSUE_LIFECYCLE_RETENTION
|
|
@@ -23,76 +23,76 @@ import {
|
|
|
23
23
|
resolveFallbackModel,
|
|
24
24
|
resolvePrimaryAgentNames,
|
|
25
25
|
stripSwarmPrefix
|
|
26
|
-
} from "./index-
|
|
27
|
-
import"./index-
|
|
28
|
-
import"./index-
|
|
29
|
-
import"./index-
|
|
26
|
+
} from "./index-pf0xrx9w.js";
|
|
27
|
+
import"./index-408tpd21.js";
|
|
28
|
+
import"./index-nacmcvc4.js";
|
|
29
|
+
import"./index-px1dnna2.js";
|
|
30
30
|
import"./index-j2vv0h13.js";
|
|
31
|
-
import"./index-
|
|
32
|
-
import"./index-
|
|
31
|
+
import"./index-jccs3fgn.js";
|
|
32
|
+
import"./index-7c432abn.js";
|
|
33
33
|
import"./index-txdagbh7.js";
|
|
34
|
-
import"./index-
|
|
34
|
+
import"./index-w4624tpw.js";
|
|
35
35
|
import {
|
|
36
36
|
createExplorerAgent
|
|
37
37
|
} from "./index-rdec0y3z.js";
|
|
38
|
-
import"./index-
|
|
39
|
-
import"./index-
|
|
40
|
-
import"./index-
|
|
41
|
-
import"./index-
|
|
42
|
-
import"./index-
|
|
43
|
-
import"./index-
|
|
38
|
+
import"./index-npy15m50.js";
|
|
39
|
+
import"./index-m4s5a2sp.js";
|
|
40
|
+
import"./index-n9ry04hw.js";
|
|
41
|
+
import"./index-xj9260dh.js";
|
|
42
|
+
import"./index-9ztsfved.js";
|
|
43
|
+
import"./index-bkscmz4z.js";
|
|
44
44
|
import"./index-cjapb4hy.js";
|
|
45
|
-
import"./index-
|
|
45
|
+
import"./index-pxdc0qn1.js";
|
|
46
46
|
import"./index-pt7h91zc.js";
|
|
47
47
|
import"./index-q7sjgr1y.js";
|
|
48
|
-
import"./index-
|
|
49
|
-
import"./index-
|
|
48
|
+
import"./index-bb2rx8k2.js";
|
|
49
|
+
import"./index-mzx33w6e.js";
|
|
50
50
|
import"./index-6b295cas.js";
|
|
51
51
|
import"./index-9nyqt3kb.js";
|
|
52
|
-
import"./index-
|
|
52
|
+
import"./index-nreezgrd.js";
|
|
53
53
|
import"./index-v3bmwmqw.js";
|
|
54
|
-
import"./index-
|
|
55
|
-
import"./index-
|
|
56
|
-
import"./index-
|
|
54
|
+
import"./index-w9f2jbwe.js";
|
|
55
|
+
import"./index-3zzxrwaf.js";
|
|
56
|
+
import"./index-61m1jw7p.js";
|
|
57
57
|
import"./index-g4fs6z4e.js";
|
|
58
|
-
import"./index-
|
|
59
|
-
import"./index-
|
|
60
|
-
import"./index-
|
|
58
|
+
import"./index-jhk4000q.js";
|
|
59
|
+
import"./index-8pyg2qnw.js";
|
|
60
|
+
import"./index-61fa8hg7.js";
|
|
61
61
|
import"./index-m9zzj4ee.js";
|
|
62
|
-
import"./index-
|
|
62
|
+
import"./index-820pzqd6.js";
|
|
63
63
|
import"./index-2s7dvzff.js";
|
|
64
|
-
import"./index-
|
|
65
|
-
import"./index-
|
|
64
|
+
import"./index-vj0zede7.js";
|
|
65
|
+
import"./index-2mx2gn97.js";
|
|
66
66
|
import"./index-rtry5xyf.js";
|
|
67
|
-
import"./index-
|
|
67
|
+
import"./index-4rrff8k6.js";
|
|
68
68
|
import"./index-g22dps7x.js";
|
|
69
69
|
import"./index-0725jpp7.js";
|
|
70
|
-
import"./index-
|
|
71
|
-
import"./index-
|
|
72
|
-
import"./index-
|
|
73
|
-
import"./index-
|
|
74
|
-
import"./index-
|
|
75
|
-
import"./index-
|
|
70
|
+
import"./index-ge7vn1vz.js";
|
|
71
|
+
import"./index-fmbqyqqw.js";
|
|
72
|
+
import"./index-h349p91m.js";
|
|
73
|
+
import"./index-p5pgjp7n.js";
|
|
74
|
+
import"./index-nr1pj3hy.js";
|
|
75
|
+
import"./index-w00dj8p5.js";
|
|
76
76
|
import"./index-ry16d01s.js";
|
|
77
77
|
import"./index-rdm3px0g.js";
|
|
78
78
|
import"./index-7pmbnjvj.js";
|
|
79
|
-
import"./index-
|
|
80
|
-
import"./index-
|
|
79
|
+
import"./index-hc6wa3yg.js";
|
|
80
|
+
import"./index-f900029m.js";
|
|
81
81
|
import"./index-vzm6zre7.js";
|
|
82
82
|
import"./index-ae75rja9.js";
|
|
83
|
-
import"./index-
|
|
84
|
-
import"./index-
|
|
85
|
-
import"./index-
|
|
83
|
+
import"./index-2bc7zfw3.js";
|
|
84
|
+
import"./index-w7d8gcj0.js";
|
|
85
|
+
import"./index-4s6kdsfr.js";
|
|
86
86
|
import"./index-t7hmqgjy.js";
|
|
87
|
-
import"./index-
|
|
87
|
+
import"./index-6dtt0brw.js";
|
|
88
88
|
import"./index-fzpt2djt.js";
|
|
89
89
|
import"./index-ejhxgyvm.js";
|
|
90
90
|
import"./index-7g4c7s5r.js";
|
|
91
|
-
import"./index-
|
|
91
|
+
import"./index-ywb5er8g.js";
|
|
92
92
|
import"./index-gx2vp8gx.js";
|
|
93
|
-
import"./index-
|
|
93
|
+
import"./index-weewx5nx.js";
|
|
94
94
|
import"./index-zxdawwc7.js";
|
|
95
|
-
import"./index-
|
|
95
|
+
import"./index-t1t93qm0.js";
|
|
96
96
|
import"./index-hqrkr9ag.js";
|
|
97
97
|
import"./index-bk5tah7q.js";
|
|
98
98
|
import"./index-gknz3bv1.js";
|
|
@@ -9,10 +9,10 @@ import {
|
|
|
9
9
|
} from "./index-txdagbh7.js";
|
|
10
10
|
import {
|
|
11
11
|
atomicWriteFile
|
|
12
|
-
} from "./index-
|
|
12
|
+
} from "./index-w7d8gcj0.js";
|
|
13
13
|
import {
|
|
14
14
|
withEvidenceLock
|
|
15
|
-
} from "./index-
|
|
15
|
+
} from "./index-4s6kdsfr.js";
|
|
16
16
|
import {
|
|
17
17
|
assertProjectRoot
|
|
18
18
|
} from "./index-t7hmqgjy.js";
|
|
@@ -1,16 +1,16 @@
|
|
|
1
1
|
// @bun
|
|
2
2
|
import {
|
|
3
3
|
queryHistoricalOutcomes
|
|
4
|
-
} from "./index-
|
|
4
|
+
} from "./index-61fa8hg7.js";
|
|
5
5
|
import {
|
|
6
6
|
resolveHiveEventsPath
|
|
7
7
|
} from "./index-ae75rja9.js";
|
|
8
8
|
import {
|
|
9
9
|
resolveKnowledgeStoreDir
|
|
10
|
-
} from "./index-
|
|
10
|
+
} from "./index-2bc7zfw3.js";
|
|
11
11
|
import {
|
|
12
12
|
atomicWriteFile
|
|
13
|
-
} from "./index-
|
|
13
|
+
} from "./index-w7d8gcj0.js";
|
|
14
14
|
import {
|
|
15
15
|
canonicalRootKey
|
|
16
16
|
} from "./index-fzpt2djt.js";
|
|
@@ -708,7 +708,7 @@ async function applyKnowledgeVerdictFeedback(directory, options) {
|
|
|
708
708
|
}
|
|
709
709
|
let bumps = 0;
|
|
710
710
|
if (deltas.length > 0) {
|
|
711
|
-
const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-
|
|
711
|
+
const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-mgqk4hvy.js");
|
|
712
712
|
bumps = await bumpKnowledgeConfidenceBatch(directory, deltas, options?.floorOptions);
|
|
713
713
|
}
|
|
714
714
|
return {
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
// @bun
|
|
2
2
|
import {
|
|
3
3
|
validateSwarmPath
|
|
4
|
-
} from "./index-
|
|
4
|
+
} from "./index-820pzqd6.js";
|
|
5
5
|
import {
|
|
6
6
|
bunSpawn
|
|
7
7
|
} from "./index-2s7dvzff.js";
|
|
@@ -11,7 +11,7 @@ import {
|
|
|
11
11
|
} from "./index-fzpt2djt.js";
|
|
12
12
|
import {
|
|
13
13
|
atomicWriteSwarmFile
|
|
14
|
-
} from "./index-
|
|
14
|
+
} from "./index-ywb5er8g.js";
|
|
15
15
|
import {
|
|
16
16
|
init_git_executable,
|
|
17
17
|
resolveGitExecutable
|