opencode-swarm 7.198.2 → 7.199.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (105) hide show
  1. package/.opencode/skills/swarm-pr-feedback/SKILL.md +6 -6
  2. package/.opencode/skills/swarm-pr-feedback/references/followup-dispositions.md +74 -0
  3. package/.opencode/skills/swarm-pr-review/references/lane-output-recoverability.md +25 -0
  4. package/binaries/win32-arm64/swarm-sandbox-runner.exe +0 -0
  5. package/binaries/win32-x64/swarm-sandbox-runner.exe +0 -0
  6. package/dist/background/pending-delegations.d.ts +1 -1
  7. package/dist/background/pr-review-contract.d.ts +10 -0
  8. package/dist/cli/{auto-checkpoint-ekp5j5v5.js → auto-checkpoint-x13d1g1t.js} +8 -8
  9. package/dist/cli/{checkpoint-30yrbqee.js → checkpoint-68nb8k3t.js} +16 -16
  10. package/dist/cli/{coder-settlement-t3zcgsd6.js → coder-settlement-kmdmdpyy.js} +12 -12
  11. package/dist/cli/{config-doctor-6w105xpy.js → config-doctor-4b0jb15n.js} +15 -15
  12. package/dist/cli/{core-6hyt1hg6.js → core-6kkm2vrz.js} +3 -3
  13. package/dist/cli/{curation-policy-m8ng2vm5.js → curation-policy-0smbd33w.js} +6 -6
  14. package/dist/cli/{curator-drift-z83e3a60.js → curator-drift-axcgdjy4.js} +8 -8
  15. package/dist/cli/curator-llm-factory-58ec737y.js +82 -0
  16. package/dist/cli/{curator-bzy7cess.js → curator-z8xzxh9f.js} +42 -42
  17. package/dist/cli/{doctor-knowledge-receipt-phase-id-8av1860z.js → doctor-knowledge-receipt-phase-id-hkjt6hv4.js} +8 -8
  18. package/dist/cli/{evidence-summary-service-ym7y7w5k.js → evidence-summary-service-981cx8wa.js} +19 -19
  19. package/dist/cli/{gate-evidence-vvhtzwry.js → gate-evidence-zyvwsp7a.js} +7 -7
  20. package/dist/cli/guardrail-explain-23b0amne.js +83 -0
  21. package/dist/cli/{guardrail-log-4f0jxq61.js → guardrail-log-s2gxszvm.js} +8 -7
  22. package/dist/cli/{guardrail-reset-cqq3yk9s.js → guardrail-reset-kt18vr45.js} +42 -42
  23. package/dist/cli/{hive-promoter-vvgdsx8s.js → hive-promoter-fz7ep8h4.js} +42 -42
  24. package/dist/cli/{index-rnjtf5kn.js → index-14vhp87b.js} +2 -2
  25. package/dist/cli/{index-yk1vnpzx.js → index-2bc7zfw3.js} +1 -1
  26. package/dist/cli/{index-d31b2zvf.js → index-2mx2gn97.js} +1 -1
  27. package/dist/cli/{index-5hbb3088.js → index-3zzxrwaf.js} +4 -4
  28. package/dist/cli/{index-bj916p5e.js → index-408tpd21.js} +261 -21
  29. package/dist/cli/{index-gc9dvmy7.js → index-4rrff8k6.js} +2 -2
  30. package/dist/cli/{index-89j5h1j9.js → index-4s6kdsfr.js} +1 -1
  31. package/dist/cli/{index-v85gn9jm.js → index-61fa8hg7.js} +5 -5
  32. package/dist/cli/{index-7e9mqse6.js → index-61m1jw7p.js} +3 -3
  33. package/dist/cli/{index-4s3770gs.js → index-6dtt0brw.js} +4 -4
  34. package/dist/cli/{index-whmby20t.js → index-795vmpe6.js} +42 -42
  35. package/dist/cli/{index-t7qgt5yk.js → index-7c432abn.js} +2 -2
  36. package/dist/cli/{index-xez06sc1.js → index-820pzqd6.js} +1 -1
  37. package/dist/cli/{index-mx74665q.js → index-8pyg2qnw.js} +4 -4
  38. package/dist/cli/{index-v30zmakk.js → index-9ztsfved.js} +2 -2
  39. package/dist/cli/{index-tnnxvq2f.js → index-bb2rx8k2.js} +6 -6
  40. package/dist/cli/{index-qg6qn99c.js → index-bkscmz4z.js} +7 -7
  41. package/dist/cli/{index-vjwmcxz4.js → index-f900029m.js} +7 -7
  42. package/dist/cli/{index-drf91t9h.js → index-fmbqyqqw.js} +5 -5
  43. package/dist/cli/{index-cfs1k1eh.js → index-ge7vn1vz.js} +5 -5
  44. package/dist/cli/{index-e4hj8r57.js → index-h349p91m.js} +34 -3
  45. package/dist/cli/{index-tdpfecs3.js → index-hc6wa3yg.js} +2 -2
  46. package/dist/cli/{index-76mg98ac.js → index-jccs3fgn.js} +1 -1
  47. package/dist/cli/{index-wg1mt92h.js → index-jhk4000q.js} +9 -8
  48. package/dist/cli/{index-xxb2depv.js → index-m4s5a2sp.js} +7 -7
  49. package/dist/cli/{index-y81sw9vt.js → index-mzx33w6e.js} +11 -11
  50. package/dist/cli/{index-9keabj7d.js → index-n9ry04hw.js} +4 -4
  51. package/dist/cli/{index-bczx8jcg.js → index-nacmcvc4.js} +5 -12
  52. package/dist/cli/{index-d9jrzepr.js → index-npy15m50.js} +3 -3
  53. package/dist/cli/{index-rqxwv4q5.js → index-nr1pj3hy.js} +1 -1
  54. package/dist/cli/{index-6pc5j9rb.js → index-nreezgrd.js} +3 -3
  55. package/dist/cli/{index-ehw0s6xa.js → index-p35gw2x7.js} +1 -1
  56. package/dist/cli/{index-xt4q610f.js → index-p5pgjp7n.js} +1 -1
  57. package/dist/cli/{index-166xny29.js → index-pf0xrx9w.js} +605 -172
  58. package/dist/cli/{index-59w9zfc5.js → index-px1dnna2.js} +5 -5
  59. package/dist/cli/{index-84r9rydf.js → index-pxdc0qn1.js} +2 -2
  60. package/dist/cli/{index-5h5tj8wc.js → index-qqv9rr8k.js} +44 -44
  61. package/dist/cli/{index-hd3d7rcw.js → index-r7ayh42s.js} +3 -3
  62. package/dist/cli/{index-rfcb9f54.js → index-t1t93qm0.js} +3 -2
  63. package/dist/cli/{index-xrghsqg3.js → index-vj0zede7.js} +4 -4
  64. package/dist/cli/{index-wrn4khfb.js → index-w00dj8p5.js} +1 -1
  65. package/dist/cli/{index-0ap067j7.js → index-w4624tpw.js} +2 -2
  66. package/dist/cli/{index-mjmsq8t7.js → index-w7d8gcj0.js} +2 -2
  67. package/dist/cli/{index-h86e4jp9.js → index-w9f2jbwe.js} +2 -2
  68. package/dist/cli/{index-bd4szzja.js → index-weewx5nx.js} +1 -1
  69. package/dist/cli/{index-0y5yvag6.js → index-xj9260dh.js} +6 -6
  70. package/dist/cli/{index-p4xmq6aa.js → index-ywb5er8g.js} +1 -1
  71. package/dist/cli/index.js +43 -43
  72. package/dist/cli/{knowledge-escalator-8hrnc4bd.js → knowledge-escalator-cf6m9y0s.js} +14 -14
  73. package/dist/cli/{knowledge-events-v2abqt9z.js → knowledge-events-hn5hymam.js} +12 -12
  74. package/dist/cli/{knowledge-link-5qt3pe5v.js → knowledge-link-1f91bzcc.js} +5 -5
  75. package/dist/cli/{knowledge-store-9y17zzce.js → knowledge-store-mgqk4hvy.js} +6 -6
  76. package/dist/cli/{knowledge-validator-7red2zwb.js → knowledge-validator-x9yrte9q.js} +8 -8
  77. package/dist/cli/{mcp-gbyndb15.js → mcp-hpmh4d6d.js} +1 -1
  78. package/dist/cli/{model-preflight-1tsaksc7.js → model-preflight-ry5jjnx4.js} +42 -42
  79. package/dist/cli/{pending-delegations-yg769m4y.js → pending-delegations-j850kj5p.js} +12 -12
  80. package/dist/cli/{pr-subscriptions-mc2mvjkj.js → pr-subscriptions-mme9gb5e.js} +12 -12
  81. package/dist/cli/{pr-workflow-gate-0fb280b2.js → pr-workflow-gate-n6bj3dnn.js} +46 -42
  82. package/dist/cli/{runner-rwya5yhg.js → runner-qe3fkzx5.js} +6 -6
  83. package/dist/cli/{scan-cursor-g74j6gcr.js → scan-cursor-fdpxbx4f.js} +7 -7
  84. package/dist/cli/{schema-q2v7px9y.js → schema-amcjvk8a.js} +1 -1
  85. package/dist/cli/{scope-persistence-g88f0163.js → scope-persistence-mp4kqpk2.js} +15 -15
  86. package/dist/cli/{server-j3a7q7gg.js → server-ptdvpwyd.js} +42 -42
  87. package/dist/cli/{skill-generator-30bjrvcc.js → skill-generator-v59hhybn.js} +16 -16
  88. package/dist/cli/{snapshot-coordination-init-9ekvft16.js → snapshot-coordination-init-nv6e4svp.js} +42 -42
  89. package/dist/cli/{speckit-checkoff-sx24fz29.js → speckit-checkoff-me8kd3wd.js} +4 -4
  90. package/dist/cli/{telemetry-t3425cht.js → telemetry-6yv06xyz.js} +1 -1
  91. package/dist/cli/{workspace-snapshot-bst64vey.js → workspace-snapshot-vhvrkbbb.js} +3 -3
  92. package/dist/cli/{worktree-collision-ownership-shtk6dsk.js → worktree-collision-ownership-84qyqars.js} +13 -13
  93. package/dist/cli/{worktree-isolation-x41cgd9n.js → worktree-isolation-99qvz8ap.js} +42 -42
  94. package/dist/config/schema.d.ts +2 -0
  95. package/dist/config/skill-contract-digest.d.ts +29 -4
  96. package/dist/hooks/guardrails/file-authority.d.ts +17 -0
  97. package/dist/hooks/pr-workflow-gate.d.ts +17 -0
  98. package/dist/hooks/skill-scoring.d.ts +40 -0
  99. package/dist/index.js +129 -120
  100. package/dist/pr-review/verdict-settlement.d.ts +40 -4
  101. package/dist/state.d.ts +49 -0
  102. package/opencode-swarm.schema.json +4 -0
  103. package/package.json +1 -1
  104. package/dist/cli/curator-llm-factory-ykpty14a.js +0 -82
  105. package/dist/cli/guardrail-explain-1ethgkvp.js +0 -83
@@ -1,14 +1,18 @@
1
1
  // @bun
2
2
  import {
3
3
  observeStoreHealth
4
- } from "./index-tdpfecs3.js";
4
+ } from "./index-hc6wa3yg.js";
5
5
  import {
6
6
  telemetry
7
- } from "./index-4s3770gs.js";
7
+ } from "./index-6dtt0brw.js";
8
+ import {
9
+ init_git_executable,
10
+ resolveGitExecutable
11
+ } from "./index-zxdawwc7.js";
8
12
  import {
9
13
  init_schema,
10
14
  stripKnownSwarmPrefix
11
- } from "./index-rfcb9f54.js";
15
+ } from "./index-t1t93qm0.js";
12
16
  import {
13
17
  init_constants
14
18
  } from "./index-hqrkr9ag.js";
@@ -1806,6 +1810,7 @@ function stableCanonicalStringify(value) {
1806
1810
  }
1807
1811
 
1808
1812
  // src/hooks/guardrails/file-authority.ts
1813
+ import { execFileSync } from "child_process";
1809
1814
  import * as fsSync from "fs";
1810
1815
  var import_picomatch = __toESM(require_picomatch2(), 1);
1811
1816
  import * as path2 from "path";
@@ -2148,12 +2153,166 @@ function protectedRoots(projectRoot, additional = []) {
2148
2153
  var HASH_INPUT_CAP_BYTES = 64 * 1024;
2149
2154
 
2150
2155
  // src/hooks/guardrails/file-authority.ts
2156
+ init_git_executable();
2151
2157
  var pathNormalizationCache = new QuickLRU({
2152
2158
  maxSize: 500
2153
2159
  });
2154
2160
  var globMatcherCache = new QuickLRU({
2155
2161
  maxSize: 200
2156
2162
  });
2163
+ var GIT_WORKTREE_CACHE_MAX_AGE_MS = 60000;
2164
+ var gitWorktreeCache = new QuickLRU({
2165
+ maxSize: 50,
2166
+ maxAge: GIT_WORKTREE_CACHE_MAX_AGE_MS
2167
+ });
2168
+ function gitEnvWithoutRepoRedirectors() {
2169
+ const env = { ...process.env };
2170
+ delete env.GIT_DIR;
2171
+ delete env.GIT_WORK_TREE;
2172
+ delete env.GIT_INDEX_FILE;
2173
+ delete env.GIT_COMMON_DIR;
2174
+ return env;
2175
+ }
2176
+ function parseWorktreeListPorcelain(output) {
2177
+ const records = [];
2178
+ for (const line of output.split(`
2179
+ `)) {
2180
+ if (line.startsWith("worktree ")) {
2181
+ const wtPath = line.slice("worktree ".length).trim();
2182
+ if (wtPath) {
2183
+ records.push({ path: wtPath, attributes: new Set });
2184
+ }
2185
+ continue;
2186
+ }
2187
+ const record = records[records.length - 1];
2188
+ if (!record)
2189
+ continue;
2190
+ const separator = line.indexOf(" ");
2191
+ const attribute = separator === -1 ? line : line.slice(0, separator);
2192
+ if (attribute)
2193
+ record.attributes.add(attribute);
2194
+ }
2195
+ return records;
2196
+ }
2197
+ function canonicalizeWindowsPathNative(p) {
2198
+ if (process.platform !== "win32")
2199
+ return p;
2200
+ try {
2201
+ const native = fsSync.realpathSync.native(p);
2202
+ return native.startsWith(String.fromCharCode(92, 92, 63, 92)) ? native.slice(4) : native;
2203
+ } catch {
2204
+ return;
2205
+ }
2206
+ }
2207
+ function canonicalizeWindowsPathTailTolerant(p) {
2208
+ if (process.platform !== "win32")
2209
+ return p;
2210
+ const tail = [];
2211
+ let probe = p;
2212
+ for (;; ) {
2213
+ const native = canonicalizeWindowsPathNative(probe);
2214
+ if (native !== undefined) {
2215
+ return tail.length === 0 ? native : path2.join(native, ...tail.reverse());
2216
+ }
2217
+ const parent = path2.dirname(probe);
2218
+ if (parent === probe)
2219
+ return p;
2220
+ tail.push(path2.basename(probe));
2221
+ probe = parent;
2222
+ }
2223
+ }
2224
+ function isValidWorktreeRecord(repoRootRecord, record) {
2225
+ if (record === repoRootRecord) {
2226
+ try {
2227
+ return fsSync.statSync(path2.join(record.path, ".git")).isDirectory();
2228
+ } catch {
2229
+ return false;
2230
+ }
2231
+ }
2232
+ if (record.attributes.has("bare"))
2233
+ return false;
2234
+ const dotGitPath = path2.join(record.path, ".git");
2235
+ let dotGitStat;
2236
+ try {
2237
+ dotGitStat = fsSync.lstatSync(dotGitPath);
2238
+ } catch {
2239
+ return false;
2240
+ }
2241
+ if (!dotGitStat.isFile())
2242
+ return false;
2243
+ let gitDirLine;
2244
+ try {
2245
+ gitDirLine = fsSync.readFileSync(dotGitPath, "utf8").trim();
2246
+ } catch {
2247
+ return false;
2248
+ }
2249
+ if (!gitDirLine.startsWith("gitdir:"))
2250
+ return false;
2251
+ const gitDirRef = gitDirLine.slice("gitdir:".length).trim();
2252
+ if (!gitDirRef)
2253
+ return false;
2254
+ const gitDirPath = path2.isAbsolute(gitDirRef) ? gitDirRef : path2.resolve(record.path, gitDirRef);
2255
+ let registrationGitdirFile;
2256
+ try {
2257
+ registrationGitdirFile = fsSync.realpathSync(path2.join(gitDirPath, "gitdir"));
2258
+ } catch {
2259
+ return false;
2260
+ }
2261
+ if (repoRootRecord) {
2262
+ let worktreesRoot;
2263
+ try {
2264
+ worktreesRoot = path2.join(fsSync.realpathSync(path2.join(repoRootRecord.path, ".git")), "worktrees");
2265
+ } catch {
2266
+ return false;
2267
+ }
2268
+ if (!isPathIdentityWithin(registrationGitdirFile, worktreesRoot)) {
2269
+ return false;
2270
+ }
2271
+ }
2272
+ let backReference;
2273
+ try {
2274
+ backReference = fsSync.readFileSync(registrationGitdirFile, "utf8").trim();
2275
+ } catch {
2276
+ return false;
2277
+ }
2278
+ try {
2279
+ return pathIdentitiesEqual(fsSync.realpathSync(dotGitPath), fsSync.realpathSync(backReference));
2280
+ } catch {
2281
+ return false;
2282
+ }
2283
+ }
2284
+ function getLinkedGitWorktrees(dir) {
2285
+ const cached = gitWorktreeCache.get(dir);
2286
+ if (cached !== undefined) {
2287
+ return cached;
2288
+ }
2289
+ const worktrees = [];
2290
+ try {
2291
+ const output = execFileSync(resolveGitExecutable(), ["worktree", "list", "--porcelain"], {
2292
+ cwd: dir,
2293
+ encoding: "utf8",
2294
+ stdio: ["ignore", "pipe", "ignore"],
2295
+ timeout: 1500,
2296
+ maxBuffer: 4 * 1024 * 1024,
2297
+ windowsHide: true,
2298
+ env: gitEnvWithoutRepoRedirectors()
2299
+ });
2300
+ const records = parseWorktreeListPorcelain(output);
2301
+ const repoRootRecord = records[0];
2302
+ for (const record of records) {
2303
+ if (!isValidWorktreeRecord(repoRootRecord, record)) {
2304
+ continue;
2305
+ }
2306
+ const native = canonicalizeWindowsPathNative(record.path);
2307
+ if (native === undefined) {
2308
+ continue;
2309
+ }
2310
+ worktrees.push(native);
2311
+ }
2312
+ } catch {}
2313
+ gitWorktreeCache.set(dir, worktrees);
2314
+ return worktrees;
2315
+ }
2157
2316
  function normalizePathWithCache(filePath, cwd) {
2158
2317
  const cacheKey = `${cwd}:${filePath}`;
2159
2318
  const cached = pathNormalizationCache.get(cacheKey);
@@ -2468,23 +2627,93 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
2468
2627
  resolvedTarget = path2.resolve(dir, filePath);
2469
2628
  normalizedPath = path2.relative(dir, resolvedTarget).replace(/\\/g, "/");
2470
2629
  }
2630
+ let effectiveDir = dir;
2631
+ const nativeTarget2 = canonicalizeWindowsPathTailTolerant(resolvedTarget);
2632
+ const matchWorktreeRoot = () => {
2633
+ const worktrees = getLinkedGitWorktrees(dir);
2634
+ let best;
2635
+ for (const wt of worktrees) {
2636
+ const relToWt = path2.relative(wt, nativeTarget2).replace(/\\/g, "/");
2637
+ if (relToWt !== ".." && !relToWt.startsWith("../") && !isOnDifferentFilesystemRoot(nativeTarget2, wt)) {
2638
+ if (!best || wt.length > best.wt.length) {
2639
+ best = { wt, rel: relToWt };
2640
+ }
2641
+ }
2642
+ }
2643
+ if (best) {
2644
+ effectiveDir = best.wt;
2645
+ normalizedPath = best.rel;
2646
+ }
2647
+ return best?.wt;
2648
+ };
2649
+ const findPlantedLinkBelow = (root) => {
2650
+ const ancestors = [];
2651
+ let current = nativeTarget2;
2652
+ while (true) {
2653
+ const rel = path2.relative(root, current);
2654
+ if (rel === "" || rel === ".." || rel.startsWith(`..${path2.sep}`) || path2.isAbsolute(rel))
2655
+ break;
2656
+ ancestors.push(current);
2657
+ const parent = path2.dirname(current);
2658
+ if (parent === current)
2659
+ break;
2660
+ current = parent;
2661
+ }
2662
+ for (const ancestor of ancestors) {
2663
+ try {
2664
+ if (fsSync.lstatSync(ancestor).isSymbolicLink())
2665
+ return ancestor;
2666
+ } catch (err) {
2667
+ const code = err.code;
2668
+ if (code === "ENOENT")
2669
+ continue;
2670
+ return ancestor;
2671
+ }
2672
+ }
2673
+ return null;
2674
+ };
2471
2675
  if (isOnDifferentFilesystemRoot(resolvedTarget, dir)) {
2472
- return denyAuthority(agentName, normalizedPath, {
2473
- code: "AUTHORITY_ROOT_ESCAPE",
2474
- layer: "containment",
2475
- rule: "same-filesystem-root",
2476
- detail: "target is on a different drive or filesystem root"
2477
- });
2478
- }
2479
- if (normalizedPath === ".." || normalizedPath.startsWith("../")) {
2480
- return denyAuthority(agentName, normalizedPath, {
2481
- code: "AUTHORITY_ROOT_ESCAPE",
2482
- layer: "containment",
2483
- rule: "workspace-containment",
2484
- detail: "target resolves outside the working directory"
2485
- });
2676
+ const matchedWorktree = matchWorktreeRoot();
2677
+ if (!matchedWorktree) {
2678
+ return denyAuthority(agentName, normalizedPath, {
2679
+ code: "AUTHORITY_ROOT_ESCAPE",
2680
+ layer: "containment",
2681
+ rule: "same-filesystem-root",
2682
+ detail: "target is on a different drive or filesystem root"
2683
+ });
2684
+ }
2685
+ const plantedLink = findPlantedLinkBelow(matchedWorktree);
2686
+ if (plantedLink) {
2687
+ return denyAuthority(agentName, normalizedPath, {
2688
+ code: "AUTHORITY_ROOT_ESCAPE",
2689
+ layer: "containment",
2690
+ rule: "workspace-containment",
2691
+ detail: `re-rooted target crosses symlink/junction "${plantedLink}" inside the matched worktree`
2692
+ });
2693
+ }
2694
+ } else if (normalizedPath === ".." || normalizedPath.startsWith("../")) {
2695
+ const matchedWorktree = matchWorktreeRoot();
2696
+ if (!matchedWorktree) {
2697
+ return denyAuthority(agentName, normalizedPath, {
2698
+ code: "AUTHORITY_ROOT_ESCAPE",
2699
+ layer: "containment",
2700
+ rule: "workspace-containment",
2701
+ detail: "target resolves outside the working directory"
2702
+ });
2703
+ }
2704
+ const plantedLink = findPlantedLinkBelow(matchedWorktree);
2705
+ if (plantedLink) {
2706
+ return denyAuthority(agentName, normalizedPath, {
2707
+ code: "AUTHORITY_ROOT_ESCAPE",
2708
+ layer: "containment",
2709
+ rule: "workspace-containment",
2710
+ detail: `re-rooted target crosses symlink/junction "${plantedLink}" inside the matched worktree`
2711
+ });
2712
+ }
2486
2713
  }
2487
- const rules = effectiveRules[normalizedAgent] ?? effectiveRules[strippedAgent];
2714
+ const classifiedRules = effectiveRules[normalizedAgent] ?? effectiveRules[strippedAgent];
2715
+ const unclassifiedWhileDisabled = !classifiedRules && options.authorityEnabled === false && normalizedAgent !== "unknown";
2716
+ const rules = classifiedRules ?? (unclassifiedWhileDisabled ? {} : undefined);
2488
2717
  if (!rules) {
2489
2718
  return denyAuthority(agentName, normalizedPath, {
2490
2719
  code: "AUTHORITY_UNKNOWN_AGENT",
@@ -2494,10 +2723,10 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
2494
2723
  });
2495
2724
  }
2496
2725
  const flavor = getPathFlavor();
2497
- const matchesPathPrefix = (candidate, prefix) => isPathIdentityWithin(path2.resolve(dir, candidate), path2.resolve(dir, prefix), flavor);
2726
+ const matchesPathPrefix = (candidate, prefix) => isPathIdentityWithin(path2.resolve(effectiveDir, candidate), path2.resolve(effectiveDir, prefix), flavor);
2498
2727
  const matchesGlob = (glob) => getGlobMatcher(glob)(normalizedPath);
2499
2728
  for (const prefix of options.universalDenyPrefixes ?? []) {
2500
- if (matchesAuthorityDenyPrefix(normalizedPath, prefix, dir, flavor)) {
2729
+ if (matchesAuthorityDenyPrefix(normalizedPath, prefix, effectiveDir, flavor)) {
2501
2730
  return denyAuthority(agentName, normalizedPath, {
2502
2731
  code: "AUTHORITY_UNIVERSAL_DENY",
2503
2732
  layer: "universal-deny",
@@ -2518,6 +2747,17 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
2518
2747
  detail: "coder writes to repository control state (.git/.swarm) are always protected"
2519
2748
  });
2520
2749
  }
2750
+ if (unclassifiedWhileDisabled && isPolicyProtectedPath(normalizedPath, {
2751
+ includeDefaults: false,
2752
+ additional: [".git", ".swarm"]
2753
+ })) {
2754
+ return denyAuthority(agentName, normalizedPath, {
2755
+ code: "AUTHORITY_PROTECTED_PATH",
2756
+ layer: "protected-path",
2757
+ rule: "unclassified-agent-control-state-protection",
2758
+ detail: "unclassified agent writes to repository control state (.git/.swarm) are always protected"
2759
+ });
2760
+ }
2521
2761
  const isSwarmRole = Object.hasOwn(AUTHORITY_ROLE_CAPABILITIES, strippedAgent);
2522
2762
  if (isSwarmRole) {
2523
2763
  const matchedVerifier = [
@@ -2550,7 +2790,7 @@ function checkFileAuthorityWithRules(agentName, filePath, cwd, effectiveRules, o
2550
2790
  detail: "agent role is read-only"
2551
2791
  });
2552
2792
  }
2553
- const pathIsInDeclaredScope = isCoderAgent && options.declaredScope != null && options.declaredScope.length > 0 && isPathWithinDeclaredScope(normalizedPath, options.declaredScope, dir);
2793
+ const pathIsInDeclaredScope = isCoderAgent && options.declaredScope != null && options.declaredScope.length > 0 && isPathWithinDeclaredScope(normalizedPath, options.declaredScope, effectiveDir);
2554
2794
  if (pathIsInDeclaredScope) {
2555
2795
  return {
2556
2796
  allowed: true,
@@ -2,10 +2,10 @@
2
2
  import {
3
3
  init_loader,
4
4
  loadPluginConfigWithMeta
5
- } from "./index-bd4szzja.js";
5
+ } from "./index-weewx5nx.js";
6
6
  import {
7
7
  init_schema
8
- } from "./index-rfcb9f54.js";
8
+ } from "./index-t1t93qm0.js";
9
9
  import {
10
10
  DEFAULT_WORKTREE_ISOLATION_CONFIG,
11
11
  init_constants
@@ -4,7 +4,7 @@ import {
4
4
  } from "./index-t7hmqgjy.js";
5
5
  import {
6
6
  emit
7
- } from "./index-4s3770gs.js";
7
+ } from "./index-6dtt0brw.js";
8
8
  import {
9
9
  tryAcquireLock
10
10
  } from "./index-ejhxgyvm.js";
@@ -4,26 +4,26 @@ import {
4
4
  } from "./index-m9zzj4ee.js";
5
5
  import {
6
6
  validateSwarmPath
7
- } from "./index-xez06sc1.js";
7
+ } from "./index-820pzqd6.js";
8
8
  import {
9
9
  observeReceiptTransition
10
- } from "./index-tdpfecs3.js";
10
+ } from "./index-hc6wa3yg.js";
11
11
  import {
12
12
  assertProjectRoot
13
13
  } from "./index-t7hmqgjy.js";
14
14
  import {
15
15
  emit
16
- } from "./index-4s3770gs.js";
16
+ } from "./index-6dtt0brw.js";
17
17
  import {
18
18
  resolveActivePhaseId
19
19
  } from "./index-gx2vp8gx.js";
20
20
  import {
21
21
  loadPluginConfigWithMeta
22
- } from "./index-bd4szzja.js";
22
+ } from "./index-weewx5nx.js";
23
23
  import {
24
24
  KnowledgeConfigSchema,
25
25
  init_schema
26
- } from "./index-rfcb9f54.js";
26
+ } from "./index-t1t93qm0.js";
27
27
 
28
28
  // src/utils/context-decisions.ts
29
29
  function extractContextDecisions(content) {
@@ -1,7 +1,7 @@
1
1
  // @bun
2
2
  import {
3
3
  validateSwarmPath
4
- } from "./index-xez06sc1.js";
4
+ } from "./index-820pzqd6.js";
5
5
  import {
6
6
  bunSpawn
7
7
  } from "./index-2s7dvzff.js";
@@ -10,7 +10,7 @@ import {
10
10
  } from "./index-fzpt2djt.js";
11
11
  import {
12
12
  atomicWriteSwarmFileSync
13
- } from "./index-p4xmq6aa.js";
13
+ } from "./index-ywb5er8g.js";
14
14
  import {
15
15
  advisoryWarn,
16
16
  init_git_executable,
@@ -242,7 +242,7 @@ var _internals2 = {
242
242
  symlinkSync: fs2.symlinkSync
243
243
  },
244
244
  writeScopeToDisk: async (directory, taskId, files) => {
245
- const { writeScopeToDisk: realWrite } = await import("./scope-persistence-g88f0163.js");
245
+ const { writeScopeToDisk: realWrite } = await import("./scope-persistence-mp4kqpk2.js");
246
246
  return realWrite(directory, taskId, files);
247
247
  },
248
248
  writeLaneProfileToDisk: async (_worktreePath, _laneIndex, _envOverrides) => {
@@ -236,7 +236,7 @@ var CATALOG_SOURCE = [
236
236
  category: "delegation",
237
237
  severity: "info",
238
238
  privacyClass: "pseudonymous",
239
- producer: "src/index.ts:995",
239
+ producer: "src/index.ts:1007",
240
240
  consumers: CONSUMER_COST_CORRECTION,
241
241
  retentionOwnerIssue: ISSUE_COST_RETENTION,
242
242
  requiredWorkflowIds: REQUIRE_SESSION_AND_TASK,
@@ -249,7 +249,7 @@ var CATALOG_SOURCE = [
249
249
  category: "delegation",
250
250
  severity: "info",
251
251
  privacyClass: "pseudonymous",
252
- producer: "src/index.ts:2158",
252
+ producer: "src/index.ts:2170",
253
253
  consumers: NO_CONSUMERS,
254
254
  futureOwnerIssue: ISSUE_SINK,
255
255
  retentionOwnerIssue: ISSUE_COST_RETENTION,
@@ -263,7 +263,7 @@ var CATALOG_SOURCE = [
263
263
  category: "delegation",
264
264
  severity: "notice",
265
265
  privacyClass: "pseudonymous",
266
- producer: "src/index.ts:2178",
266
+ producer: "src/index.ts:2190",
267
267
  consumers: CONSUMER_COST_JOIN,
268
268
  retentionOwnerIssue: ISSUE_COST_RETENTION,
269
269
  requiredWorkflowIds: REQUIRE_SESSION,
@@ -408,7 +408,7 @@ var CATALOG_SOURCE = [
408
408
  category: "gate",
409
409
  severity: "info",
410
410
  privacyClass: "pseudonymous",
411
- producer: "src/pr-review/legacy-transcript-adapter.ts:982",
411
+ producer: "src/pr-review/legacy-transcript-adapter.ts:1032",
412
412
  consumers: NO_CONSUMERS,
413
413
  futureOwnerIssue: ISSUE_SINK,
414
414
  retentionOwnerIssue: ISSUE_LIFECYCLE_RETENTION
@@ -23,76 +23,76 @@ import {
23
23
  resolveFallbackModel,
24
24
  resolvePrimaryAgentNames,
25
25
  stripSwarmPrefix
26
- } from "./index-166xny29.js";
27
- import"./index-bj916p5e.js";
28
- import"./index-bczx8jcg.js";
29
- import"./index-59w9zfc5.js";
26
+ } from "./index-pf0xrx9w.js";
27
+ import"./index-408tpd21.js";
28
+ import"./index-nacmcvc4.js";
29
+ import"./index-px1dnna2.js";
30
30
  import"./index-j2vv0h13.js";
31
- import"./index-76mg98ac.js";
32
- import"./index-t7qgt5yk.js";
31
+ import"./index-jccs3fgn.js";
32
+ import"./index-7c432abn.js";
33
33
  import"./index-txdagbh7.js";
34
- import"./index-0ap067j7.js";
34
+ import"./index-w4624tpw.js";
35
35
  import {
36
36
  createExplorerAgent
37
37
  } from "./index-rdec0y3z.js";
38
- import"./index-d9jrzepr.js";
39
- import"./index-xxb2depv.js";
40
- import"./index-9keabj7d.js";
41
- import"./index-0y5yvag6.js";
42
- import"./index-v30zmakk.js";
43
- import"./index-qg6qn99c.js";
38
+ import"./index-npy15m50.js";
39
+ import"./index-m4s5a2sp.js";
40
+ import"./index-n9ry04hw.js";
41
+ import"./index-xj9260dh.js";
42
+ import"./index-9ztsfved.js";
43
+ import"./index-bkscmz4z.js";
44
44
  import"./index-cjapb4hy.js";
45
- import"./index-84r9rydf.js";
45
+ import"./index-pxdc0qn1.js";
46
46
  import"./index-pt7h91zc.js";
47
47
  import"./index-q7sjgr1y.js";
48
- import"./index-tnnxvq2f.js";
49
- import"./index-y81sw9vt.js";
48
+ import"./index-bb2rx8k2.js";
49
+ import"./index-mzx33w6e.js";
50
50
  import"./index-6b295cas.js";
51
51
  import"./index-9nyqt3kb.js";
52
- import"./index-6pc5j9rb.js";
52
+ import"./index-nreezgrd.js";
53
53
  import"./index-v3bmwmqw.js";
54
- import"./index-h86e4jp9.js";
55
- import"./index-5hbb3088.js";
56
- import"./index-7e9mqse6.js";
54
+ import"./index-w9f2jbwe.js";
55
+ import"./index-3zzxrwaf.js";
56
+ import"./index-61m1jw7p.js";
57
57
  import"./index-g4fs6z4e.js";
58
- import"./index-wg1mt92h.js";
59
- import"./index-mx74665q.js";
60
- import"./index-v85gn9jm.js";
58
+ import"./index-jhk4000q.js";
59
+ import"./index-8pyg2qnw.js";
60
+ import"./index-61fa8hg7.js";
61
61
  import"./index-m9zzj4ee.js";
62
- import"./index-xez06sc1.js";
62
+ import"./index-820pzqd6.js";
63
63
  import"./index-2s7dvzff.js";
64
- import"./index-xrghsqg3.js";
65
- import"./index-d31b2zvf.js";
64
+ import"./index-vj0zede7.js";
65
+ import"./index-2mx2gn97.js";
66
66
  import"./index-rtry5xyf.js";
67
- import"./index-gc9dvmy7.js";
67
+ import"./index-4rrff8k6.js";
68
68
  import"./index-g22dps7x.js";
69
69
  import"./index-0725jpp7.js";
70
- import"./index-cfs1k1eh.js";
71
- import"./index-drf91t9h.js";
72
- import"./index-e4hj8r57.js";
73
- import"./index-xt4q610f.js";
74
- import"./index-rqxwv4q5.js";
75
- import"./index-wrn4khfb.js";
70
+ import"./index-ge7vn1vz.js";
71
+ import"./index-fmbqyqqw.js";
72
+ import"./index-h349p91m.js";
73
+ import"./index-p5pgjp7n.js";
74
+ import"./index-nr1pj3hy.js";
75
+ import"./index-w00dj8p5.js";
76
76
  import"./index-ry16d01s.js";
77
77
  import"./index-rdm3px0g.js";
78
78
  import"./index-7pmbnjvj.js";
79
- import"./index-tdpfecs3.js";
80
- import"./index-vjwmcxz4.js";
79
+ import"./index-hc6wa3yg.js";
80
+ import"./index-f900029m.js";
81
81
  import"./index-vzm6zre7.js";
82
82
  import"./index-ae75rja9.js";
83
- import"./index-yk1vnpzx.js";
84
- import"./index-mjmsq8t7.js";
85
- import"./index-89j5h1j9.js";
83
+ import"./index-2bc7zfw3.js";
84
+ import"./index-w7d8gcj0.js";
85
+ import"./index-4s6kdsfr.js";
86
86
  import"./index-t7hmqgjy.js";
87
- import"./index-4s3770gs.js";
87
+ import"./index-6dtt0brw.js";
88
88
  import"./index-fzpt2djt.js";
89
89
  import"./index-ejhxgyvm.js";
90
90
  import"./index-7g4c7s5r.js";
91
- import"./index-p4xmq6aa.js";
91
+ import"./index-ywb5er8g.js";
92
92
  import"./index-gx2vp8gx.js";
93
- import"./index-bd4szzja.js";
93
+ import"./index-weewx5nx.js";
94
94
  import"./index-zxdawwc7.js";
95
- import"./index-rfcb9f54.js";
95
+ import"./index-t1t93qm0.js";
96
96
  import"./index-hqrkr9ag.js";
97
97
  import"./index-bk5tah7q.js";
98
98
  import"./index-gknz3bv1.js";
@@ -9,10 +9,10 @@ import {
9
9
  } from "./index-txdagbh7.js";
10
10
  import {
11
11
  atomicWriteFile
12
- } from "./index-mjmsq8t7.js";
12
+ } from "./index-w7d8gcj0.js";
13
13
  import {
14
14
  withEvidenceLock
15
- } from "./index-89j5h1j9.js";
15
+ } from "./index-4s6kdsfr.js";
16
16
  import {
17
17
  assertProjectRoot
18
18
  } from "./index-t7hmqgjy.js";
@@ -10,7 +10,7 @@ import {
10
10
  readCachedTextFile,
11
11
  wasObservedToExist,
12
12
  wasRecentlyWrittenByThisProcess
13
- } from "./index-p4xmq6aa.js";
13
+ } from "./index-ywb5er8g.js";
14
14
  import {
15
15
  warn
16
16
  } from "./index-zgwm4ryv.js";
@@ -1,16 +1,16 @@
1
1
  // @bun
2
2
  import {
3
3
  queryHistoricalOutcomes
4
- } from "./index-v85gn9jm.js";
4
+ } from "./index-61fa8hg7.js";
5
5
  import {
6
6
  resolveHiveEventsPath
7
7
  } from "./index-ae75rja9.js";
8
8
  import {
9
9
  resolveKnowledgeStoreDir
10
- } from "./index-yk1vnpzx.js";
10
+ } from "./index-2bc7zfw3.js";
11
11
  import {
12
12
  atomicWriteFile
13
- } from "./index-mjmsq8t7.js";
13
+ } from "./index-w7d8gcj0.js";
14
14
  import {
15
15
  canonicalRootKey
16
16
  } from "./index-fzpt2djt.js";
@@ -708,7 +708,7 @@ async function applyKnowledgeVerdictFeedback(directory, options) {
708
708
  }
709
709
  let bumps = 0;
710
710
  if (deltas.length > 0) {
711
- const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-9y17zzce.js");
711
+ const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-mgqk4hvy.js");
712
712
  bumps = await bumpKnowledgeConfidenceBatch(directory, deltas, options?.floorOptions);
713
713
  }
714
714
  return {
@@ -1,7 +1,7 @@
1
1
  // @bun
2
2
  import {
3
3
  validateSwarmPath
4
- } from "./index-xez06sc1.js";
4
+ } from "./index-820pzqd6.js";
5
5
  import {
6
6
  bunSpawn
7
7
  } from "./index-2s7dvzff.js";
@@ -11,7 +11,7 @@ import {
11
11
  } from "./index-fzpt2djt.js";
12
12
  import {
13
13
  atomicWriteSwarmFile
14
- } from "./index-p4xmq6aa.js";
14
+ } from "./index-ywb5er8g.js";
15
15
  import {
16
16
  init_git_executable,
17
17
  resolveGitExecutable