opencode-swarm 7.200.8 → 7.200.10

package/dist/cli/{index-8mrentmw.js → index-dp6hy23p.js}

@@ -26,9 +26,8 @@ var init_bubblewrap = __esm(() => {
 
 // src/sandbox/macos/sandbox-exec-executor.ts
 import { spawnSync } from "child_process";
-import { existsSync, mkdtempSync, writeFileSync } from "fs";
+import { existsSync, realpathSync } from "fs";
 import * as os from "os";
-import * as path from "path";
 function resolveBinary(absolutePath, bareName) {
   try {
     if (_internals.exists(absolutePath)) {
@@ -43,11 +42,24 @@ function resolveSandboxExecBinary() {
 function resolveProbeTargetBinary() {
   return resolveBinary(TRUE_ABSOLUTE, "true");
 }
+function realpathOrSelf(p, fsx = REAL_FS) {
+  const match = SYSTEM_LINK_PREFIX.exec(p);
+  if (!match)
+    return p;
+  const target = `/private/${match[1]}`;
+  try {
+    if (fsx.realpath(`/${match[1]}`) !== target)
+      return p;
+  } catch {
+    return p;
+  }
+  return `/private${p}`;
+}
 function buildProbeProfile(tempDir) {
   return `(version 1)
 (allow default)
 (deny file-write*)
-(allow file-write* (subpath "${sbplEscapePath(tempDir)}"))`;
+(allow file-write* (subpath "${sbplEscapePath(realpathOrSelf(tempDir))}"))`;
 }
 function probeSandboxExec() {
   try {
@@ -120,17 +132,17 @@ function buildEnvOverridePrefix(envOverrides) {
   }
   return `${parts.join("; ")}; `;
 }
-function sbplEscapePath(path2) {
-  const withoutControlChars = path2.split("").filter((ch) => {
+function sbplEscapePath(path) {
+  const withoutControlChars = path.split("").filter((ch) => {
     const cp = ch.codePointAt(0);
     return cp >= 32 && cp !== 127;
   }).join("");
   return withoutControlChars.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
 }
 function buildSandboxProfile(scopePaths, tempDir) {
-  const rwPaths = [...scopePaths];
+  const rwPaths = scopePaths.map((p) => realpathOrSelf(p));
   if (tempDir) {
-    rwPaths.push(tempDir);
+    rwPaths.push(realpathOrSelf(tempDir));
   }
   const rwAllowLines = rwPaths.map((p) => `(allow file-write* (subpath "${sbplEscapePath(p)}"))`).join(`
 `);
@@ -195,21 +207,11 @@ class MacOSSandboxExecutor {
     const temp = tempDir ?? this._tempDir ?? os.tmpdir();
     const allScopes = [...this._scopePaths, ...scopePaths];
     const profile = buildSandboxProfile(allScopes, temp);
-    let profilePath;
-    try {
-      const profileDir = mkdtempSync(path.join(os.tmpdir(), "sandbox-"));
-      profilePath = path.join(profileDir, `profile-${process.pid}-${Date.now()}.sb`);
-      writeFileSync(profilePath, profile, { mode: 384 });
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      warn(`Sandbox disabled: failed to write profile (${message}). Falling through to tool-layer enforcement.`);
-      throw new SandboxError("Sandbox not available", "SANDBOX_UNAVAILABLE");
-    }
     const binary = _internals.resolveSandboxExecBinary();
     const envPrefix = buildEnvOverridePrefix(envOverrides);
     const escapedCommand = shellEscape(`${envPrefix}${command}`);
-    const escapedProfilePath = shellEscape(profilePath);
-    return `${binary} -f '${escapedProfilePath}' bash -c '${escapedCommand}'`;
+    const escapedProfile = shellEscape(profile);
+    return `${binary} -p '${escapedProfile}' bash -c '${escapedCommand}'`;
   }
   getEnvOverrides() {
     return {
@@ -222,17 +224,20 @@ class MacOSSandboxExecutor {
     };
   }
 }
-var SANDBOX_UNAVAILABLE_CODES, SANDBOX_EXEC_ABSOLUTE = "/usr/bin/sandbox-exec", TRUE_ABSOLUTE = "/usr/bin/true", PROBE_FAILURE_TTL_MS = 60000, _probeMemo, _internals;
+var SANDBOX_UNAVAILABLE_CODES, SANDBOX_EXEC_ABSOLUTE = "/usr/bin/sandbox-exec", TRUE_ABSOLUTE = "/usr/bin/true", REAL_FS, SYSTEM_LINK_PREFIX, PROBE_FAILURE_TTL_MS = 60000, _probeMemo, _internals;
 var init_sandbox_exec_executor = __esm(() => {
   init_logger();
   init_executor();
   SANDBOX_UNAVAILABLE_CODES = new Set(["ENOENT", "EACCES", "ENOSPC"]);
+  REAL_FS = { realpath: realpathSync };
+  SYSTEM_LINK_PREFIX = /^\/(tmp|var|etc)(?=\/|$)/;
   _internals = {
     probeSandboxExec,
     probeSandboxExecMemoized,
     resetProbeMemo,
     buildSandboxProfile,
     buildProbeProfile,
+    realpathOrSelf,
     buildEnvOverridePrefix,
     resolveSandboxExecBinary,
     resolveProbeTargetBinary,
@@ -318,7 +323,7 @@ var init_edge_cases = () => {};
 import { Buffer } from "buffer";
 import { spawnSync as spawnSync2 } from "child_process";
 import * as os2 from "os";
-import * as path2 from "path";
+import * as path from "path";
 function containsUnsafePathSyntax(value) {
   return [...value].some((character) => character.charCodeAt(0) < 32 || UNSAFE_PATH_CHARACTERS.has(character));
 }
@@ -327,15 +332,15 @@ function getSafeSystemRoot() {
   if (typeof raw !== "string" || !/^[A-Za-z]:[\\/]/.test(raw) || containsUnsafePathSyntax(raw.slice(2)) || raw.slice(3).split(/[\\/]+/).some((segment) => segment === "." || segment === "..")) {
     return DEFAULT_SYSTEM_ROOT;
   }
-  const normalized = path2.win32.normalize(raw);
+  const normalized = path.win32.normalize(raw);
   return normalized.length > 3 ? normalized.replace(/\\+$/, "") : normalized;
 }
 function getWindowsExecutablePaths() {
   const systemRoot = getSafeSystemRoot();
   return {
     systemRoot,
-    cmdExe: path2.win32.join(systemRoot, "System32", "cmd.exe"),
-    powerShellExe: path2.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
+    cmdExe: path.win32.join(systemRoot, "System32", "cmd.exe"),
+    powerShellExe: path.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")
   };
 }
 function probeWindowsSandbox() {
@@ -371,13 +376,13 @@ function normalizeInheritedPathEntry(rawEntry) {
   if (!/^[A-Za-z]:[\\/]/.test(entry) || containsUnsafePathSyntax(entry.slice(2)) || entry.slice(3).split(/[\\/]+/).some((segment) => segment === "." || segment === "..")) {
     return null;
   }
-  const normalized = path2.win32.normalize(entry);
+  const normalized = path.win32.normalize(entry);
   return normalized.length > 3 ? normalized.replace(/\\+$/, "") : normalized;
 }
 function getSafeWindowsPath() {
   const { systemRoot } = getWindowsExecutablePaths();
   const candidates = [
-    path2.win32.join(systemRoot, "System32"),
+    path.win32.join(systemRoot, "System32"),
     systemRoot,
     ...(process.env.PATH ?? "").split(";")
   ];
@@ -408,7 +413,7 @@ function isPathInScopes(command, scopes) {
   const paths = command.match(pathPattern) || [];
   if (paths.length === 0)
     return true;
-  const normalizedPaths = paths.map((p) => path2.win32.resolve(p));
+  const normalizedPaths = paths.map((p) => path.win32.resolve(p));
   const normalizedScopes = scopes.map((s) => s.toLowerCase().replace(/\\+$/, ""));
   return normalizedPaths.every((p) => {
     const lower = p.toLowerCase();
@@ -620,16 +625,16 @@ __export(exports_runner_client, {
 import { spawn, spawnSync as spawnSync3 } from "child_process";
 import * as fs from "fs";
 import * as os3 from "os";
-import * as path3 from "path";
+import * as path2 from "path";
 import { fileURLToPath } from "url";
 function findRunnerBinary() {
   const arch = process.arch === "x64" ? "x64" : "arm64";
   const platform = "win32";
   const runtimeDir = _internals3.runtimeDir ?? _runtimeDir;
   const packagePaths = [
-    path3.resolve(runtimeDir, "..", "binaries", `${platform}-${arch}`, "swarm-sandbox-runner.exe"),
-    path3.resolve(runtimeDir, "..", "..", "..", "binaries", `${platform}-${arch}`, "swarm-sandbox-runner.exe"),
-    path3.resolve(runtimeDir, "..", "..", "..", "..", "binaries", `${platform}-${arch}`, "swarm-sandbox-runner.exe")
+    path2.resolve(runtimeDir, "..", "binaries", `${platform}-${arch}`, "swarm-sandbox-runner.exe"),
+    path2.resolve(runtimeDir, "..", "..", "..", "binaries", `${platform}-${arch}`, "swarm-sandbox-runner.exe"),
+    path2.resolve(runtimeDir, "..", "..", "..", "..", "binaries", `${platform}-${arch}`, "swarm-sandbox-runner.exe")
   ];
   for (const p of packagePaths) {
     try {
@@ -713,7 +718,7 @@ function probe() {
         capabilities,
         error: `runner protocol mismatch (got ${reportedProtocol ?? "none"}, expected ${RUNNER_PROTOCOL_SCHEMA_VERSION})`
       };
-      criticalWarn(`[sandbox] ${_cachedProbe.error} at ${path3.basename(binary)} \u2014 stale or foreign runner binary refused; degrading to weak sandbox. Run /swarm diagnose for details.`);
+      criticalWarn(`[sandbox] ${_cachedProbe.error} at ${path2.basename(binary)} \u2014 stale or foreign runner binary refused; degrading to weak sandbox. Run /swarm diagnose for details.`);
       return _cachedProbe;
     }
     let mode = "none";
@@ -817,8 +822,8 @@ function _resetProbeCache() {
 }
 function buildDefaultPolicy(workspaceRoot, runId) {
   const id = runId ?? `swarm-${crypto.randomUUID?.() ?? Date.now()}`;
-  const appData = process.env.LOCALAPPDATA ?? path3.join(os3.homedir(), "AppData", "Local");
-  const tempRoot = path3.join(appData, "opencode-swarm", "sandbox", id, "temp");
+  const appData = process.env.LOCALAPPDATA ?? path2.join(os3.homedir(), "AppData", "Local");
+  const tempRoot = path2.join(appData, "opencode-swarm", "sandbox", id, "temp");
   return {
     schema_version: 1,
     run_id: id,
@@ -872,7 +877,7 @@ var init_runner_client = __esm(() => {
 import * as crypto2 from "crypto";
 import * as fs2 from "fs";
 import * as os4 from "os";
-import * as path4 from "path";
+import * as path3 from "path";
 
 class NativeWindowsSandboxExecutor {
   mechanism;
@@ -950,11 +955,11 @@ class NativeWindowsSandboxExecutor {
       }
     }
     const policyJson = JSON.stringify(policy);
-    const policyDir = path4.join(os4.tmpdir(), "swarm-sandbox-policies");
+    const policyDir = path3.join(os4.tmpdir(), "swarm-sandbox-policies");
     try {
       fs2.mkdirSync(policyDir, { recursive: true });
     } catch {}
-    const policyFile = path4.join(policyDir, `${runId}.json`);
+    const policyFile = path3.join(policyDir, `${runId}.json`);
     fs2.writeFileSync(policyFile, policyJson, "utf-8");
     const mode = this._probeResult.mode === "none" ? "auto" : this._probeResult.mode;
     const escapedBinary = binary.includes(" ") ? `"${binary}"` : binary;
@@ -1047,7 +1052,7 @@ async function _createExecutor() {
   return null;
 }
 async function _createLinuxExecutor() {
-  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isBubblewrapAvailable } = await import("./capability-probe-dwqn2609.js");
+  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isBubblewrapAvailable } = await import("./capability-probe-qjndmx6z.js");
   await new SandboxCapabilityProbe2().detect();
   if (!isBubblewrapAvailable()) {
     return null;
@@ -1067,7 +1072,7 @@ async function _createMacOSExecutor() {
     }
     return null;
   }
-  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isSandboxExecAvailable } = await import("./capability-probe-dwqn2609.js");
+  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isSandboxExecAvailable } = await import("./capability-probe-qjndmx6z.js");
   await new SandboxCapabilityProbe2().detect();
   if (!isSandboxExecAvailable()) {
     return null;
@@ -1080,7 +1085,7 @@ async function _createMacOSExecutor() {
   }
 }
 async function _createWindowsExecutor() {
-  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isWindowsSandboxAvailable } = await import("./capability-probe-dwqn2609.js");
+  const { SandboxCapabilityProbe: SandboxCapabilityProbe2, isWindowsSandboxAvailable } = await import("./capability-probe-qjndmx6z.js");
   await new SandboxCapabilityProbe2().detect();
   if (!isWindowsSandboxAvailable()) {
     return null;
@@ -1327,7 +1332,7 @@ var init_bubblewrap_executor = __esm(() => {
 import { execFile, spawnSync as spawnSync5 } from "child_process";
 import * as fs3 from "fs";
 import * as os5 from "os";
-import * as path5 from "path";
+import * as path4 from "path";
 function assessSandboxRequirements(capability, requirements) {
   if (!requirements || requirements.mode !== "required") {
     return { satisfied: true, missing: [] };
@@ -1347,7 +1352,7 @@ function assessSandboxRequirements(capability, requirements) {
 function fileIdentity(input) {
   if (!input)
     return "missing";
-  const candidate = path5.normalize(input);
+  const candidate = path4.normalize(input);
   try {
     const link = fs3.lstatSync(candidate, { bigint: true });
     const stat = fs3.statSync(candidate, { bigint: true });
@@ -1387,11 +1392,11 @@ function resolveWindowsCommandProcessorBinary() {
     candidates.push(comSpec);
   }
   const pathEnv = process.env.Path ?? process.env.PATH ?? "";
-  for (const entry of pathEnv.split(path5.delimiter)) {
+  for (const entry of pathEnv.split(path4.delimiter)) {
     const trimmed = entry.trim();
     if (!trimmed)
       continue;
-    candidates.push(path5.join(trimmed, "cmd.exe"));
+    candidates.push(path4.join(trimmed, "cmd.exe"));
   }
   for (const candidate of candidates) {
     try {
@@ -1473,10 +1478,10 @@ function runBoundedSync(cmd, args, input) {
 }
 function probeLinuxBehavior() {
   const binary = _internals4.resolveBwrapBinary();
-  const tempRoot = fs3.mkdtempSync(path5.join(os5.tmpdir(), "swarm-bwrap-probe-"));
-  const allowedRoot = path5.join(tempRoot, "allowed");
-  const inScopeFile = path5.join(allowedRoot, "inside.txt");
-  const outOfScopeFile = path5.join(tempRoot, "outside.txt");
+  const tempRoot = fs3.mkdtempSync(path4.join(os5.tmpdir(), "swarm-bwrap-probe-"));
+  const allowedRoot = path4.join(tempRoot, "allowed");
+  const inScopeFile = path4.join(allowedRoot, "inside.txt");
+  const outOfScopeFile = path4.join(tempRoot, "outside.txt");
   fs3.mkdirSync(allowedRoot, { recursive: true });
   const reasons = [];
   let filesystem = "weak";
@@ -1551,11 +1556,11 @@ function probeLinuxBehavior() {
 }
 function probeMacOSBehavior() {
   const binary = _internals.resolveSandboxExecBinary();
-  const tempRoot = fs3.mkdtempSync(path5.join(os5.tmpdir(), "swarm-seatbelt-probe-"));
-  const allowedRoot = path5.join(tempRoot, "allowed");
-  const sandboxTemp = path5.join(tempRoot, "sandbox-tmp");
-  const inScopeFile = path5.join(allowedRoot, "inside.txt");
-  const outOfScopeFile = path5.join(tempRoot, "outside.txt");
+  const tempRoot = fs3.mkdtempSync(path4.join(os5.tmpdir(), "swarm-seatbelt-probe-"));
+  const allowedRoot = path4.join(tempRoot, "allowed");
+  const sandboxTemp = path4.join(tempRoot, "sandbox-tmp");
+  const inScopeFile = path4.join(allowedRoot, "inside.txt");
+  const outOfScopeFile = path4.join(tempRoot, "outside.txt");
   fs3.mkdirSync(allowedRoot, { recursive: true });
   fs3.mkdirSync(sandboxTemp, { recursive: true });
   const profile = _internals.buildSandboxProfile([allowedRoot], sandboxTemp);

package/dist/cli/{index-4fkxdnc7.js → index-erp7fk72.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   atomicWriteFile
-} from "./index-yyrnkc3a.js";
+} from "./index-6m551cng.js";
 import {
   canonicalRootKeyFresh
 } from "./index-te9hq2f4.js";

package/dist/cli/{index-16n2s0zf.js → index-ev46f132.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   computePlanStructureHash
-} from "./index-zjjxe0q5.js";
+} from "./index-6e7jxxys.js";
 import {
   deleteCoordinationState,
   importCoordinationOnce,
@@ -9,20 +9,23 @@ import {
   transitionCoordinationState,
   transitionCoordinationStateWithinTransaction,
   withCoordinationTransaction
-} from "./index-2x015vjy.js";
+} from "./index-rck7v4r4.js";
 import {
   getProjectDb
-} from "./index-y7c4hqcj.js";
+} from "./index-ck7jpn0y.js";
 import {
   canonicalExistingFilesystemPath,
   legacyCanonicalExistingFilesystemPath
 } from "./index-ry16d01s.js";
 import {
   appendCoreEventSync
-} from "./index-vtpt8yns.js";
+} from "./index-rjsqf4hv.js";
 import {
   derivePlanId
 } from "./index-7pmbnjvj.js";
+import {
+  PlanSchema
+} from "./index-3t46mez1.js";
 import {
   init_path_identity,
   unsafePathTextReason
@@ -36,10 +39,7 @@ import {
 import {
   atomicWriteSwarmFile,
   atomicWriteSwarmFileSync
-} from "./index-mn75z39t.js";
-import {
-  PlanSchema
-} from "./index-3t46mez1.js";
+} from "./index-9qy3tzt5.js";
 import {
   __toESM
 } from "./index-a76rekgs.js";

package/dist/cli/{index-h7t7hvq3.js → index-fbn2mv67.js}

@@ -1,7 +1,11 @@
 // @bun
 import {
   observeStoreHealth
-} from "./index-8srvdpw6.js";
+} from "./index-8xtdxy91.js";
+import {
+  init_schema,
+  stripKnownSwarmPrefix
+} from "./index-06sj5bjh.js";
 import {
   getPathFlavor,
   init_path_identity,
@@ -14,7 +18,7 @@ import {
 } from "./index-9rwhas09.js";
 import {
   telemetry
-} from "./index-c2k7q723.js";
+} from "./index-6cppzd9c.js";
 import {
   init_git_executable,
   resolveGitExecutable
@@ -26,10 +30,6 @@ import {
   init_logger,
   warn
 } from "./index-zgwm4ryv.js";
-import {
-  init_schema,
-  stripKnownSwarmPrefix
-} from "./index-k5h4mmwd.js";
 import {
   init_constants
 } from "./index-xfzkq1k4.js";

package/dist/cli/{index-vpxdf79m.js → index-ffm3d4cn.js}

@@ -4,15 +4,28 @@ import {
   ensureTaskCheckpointReceipt,
   loadPlan,
   updateTaskCheckpointReceipt
-} from "./index-5z4c9acx.js";
+} from "./index-tm6nwe43.js";
 import {
   tool
 } from "./index-9nyqt3kb.js";
+import {
+  readLedgerEvents
+} from "./index-6e7jxxys.js";
 import {
   init_executor,
   isUntrustedEnvKey,
   isValidEnvKey
-} from "./index-8mrentmw.js";
+} from "./index-dp6hy23p.js";
+import {
+  appendCoreEventSync
+} from "./index-rjsqf4hv.js";
+import {
+  derivePlanId,
+  derivePlanIdentityHash
+} from "./index-7pmbnjvj.js";
+import {
+  loadPluginConfigWithMeta
+} from "./index-ww5ne0g6.js";
 import {
   GitBinaryMissingError,
   GitSpawnCwdError,
@@ -22,17 +35,7 @@ import {
 } from "./index-spggmr30.js";
 import {
   validateSwarmPath
-} from "./index-4krkevgc.js";
-import {
-  readLedgerEvents
-} from "./index-zjjxe0q5.js";
-import {
-  appendCoreEventSync
-} from "./index-vtpt8yns.js";
-import {
-  derivePlanId,
-  derivePlanIdentityHash
-} from "./index-7pmbnjvj.js";
+} from "./index-001tkp0j.js";
 import {
   assertProjectRoot,
   hasExplicitProjectBoundary,
@@ -43,10 +46,7 @@ import {
 } from "./index-ejhxgyvm.js";
 import {
   atomicWriteSwarmFileSync
-} from "./index-mn75z39t.js";
-import {
-  loadPluginConfigWithMeta
-} from "./index-76xnddca.js";
+} from "./index-9qy3tzt5.js";
 import {
   GIT_BINARY_ENV_VAR,
   describeGitResolution,

package/dist/cli/{index-kekvdqj6.js → index-gsnj3a0h.js}

@@ -1,16 +1,16 @@
 // @bun
 import {
   queryHistoricalOutcomes
-} from "./index-jrpfzv5r.js";
+} from "./index-6ehx0pj4.js";
 import {
   resolveHiveEventsPath
 } from "./index-ae75rja9.js";
 import {
   resolveKnowledgeStoreDir
-} from "./index-4fkxdnc7.js";
+} from "./index-erp7fk72.js";
 import {
   atomicWriteFile
-} from "./index-yyrnkc3a.js";
+} from "./index-6m551cng.js";
 import {
   canonicalRootKey
 } from "./index-te9hq2f4.js";
@@ -708,7 +708,7 @@ async function applyKnowledgeVerdictFeedback(directory, options) {
     }
     let bumps = 0;
     if (deltas.length > 0) {
-      const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-dxwsme9q.js");
+      const { bumpKnowledgeConfidenceBatch } = await import("./knowledge-store-g4cpw0hz.js");
       bumps = await bumpKnowledgeConfidenceBatch(directory, deltas, options?.floorOptions);
     }
     return {

package/dist/cli/{index-zvvavx1h.js → index-h9qhy8r6.js}

@@ -2,10 +2,10 @@
 import {
   readKnowledgeEvents,
   recordKnowledgeEvent
-} from "./index-kekvdqj6.js";
+} from "./index-gsnj3a0h.js";
 import {
   queryHistoricalOutcomes
-} from "./index-jrpfzv5r.js";
+} from "./index-6ehx0pj4.js";
 import {
   jaccardBigram,
   readKnowledge,
@@ -13,7 +13,7 @@ import {
   resolveSwarmKnowledgePath,
   transactKnowledge,
   wordBigrams
-} from "./index-c5wk61ak.js";
+} from "./index-vajbtn3v.js";
 import {
   init_knowledge_types,
   isActiveStatus
@@ -226,11 +226,11 @@ async function maybeQuarantineOnContradiction(directory, entryId, threshold, win
         alreadyInactive: true
       };
     }
-    const { quarantineEntry } = await import("./knowledge-validator-7q1w62s7.js");
+    const { quarantineEntry } = await import("./knowledge-validator-zhy6mgxv.js");
     let policyConfig;
     try {
-      const { KnowledgeConfigSchema } = await import("./schema-ff9v839b.js");
-      const { loadPluginConfigWithMeta } = await import("./index-0tvkfdwp.js");
+      const { KnowledgeConfigSchema } = await import("./schema-kep9t01t.js");
+      const { loadPluginConfigWithMeta } = await import("./index-c34tgnwm.js");
       const { config: loadedConfig } = loadPluginConfigWithMeta(directory);
       policyConfig = KnowledgeConfigSchema.parse(loadedConfig.knowledge ?? {});
     } catch {

package/dist/cli/{index-tecp3a77.js → index-kd1n3ne2.js}

@@ -1,27 +1,27 @@
 // @bun
-import {
-  validateSwarmPath
-} from "./index-4krkevgc.js";
 import {
   deleteCoordinationState,
   importCoordinationOnce,
   listCoordinationStates,
   transitionCoordinationState,
   withCoordinationTransaction
-} from "./index-2x015vjy.js";
+} from "./index-rck7v4r4.js";
 import {
   getProjectDb,
   projectDbExists
-} from "./index-y7c4hqcj.js";
+} from "./index-ck7jpn0y.js";
 import {
   observeStoreHealth
-} from "./index-8srvdpw6.js";
+} from "./index-8xtdxy91.js";
+import {
+  validateSwarmPath
+} from "./index-001tkp0j.js";
 import {
   withEvidenceLock
-} from "./index-q8vfw61p.js";
+} from "./index-pjrx4jkq.js";
 import {
   telemetry
-} from "./index-c2k7q723.js";
+} from "./index-6cppzd9c.js";
 import {
   canonicalRootKey,
   canonicalRootKeyFresh,
@@ -29,7 +29,7 @@ import {
 } from "./index-te9hq2f4.js";
 import {
   atomicWriteSwarmFileSync
-} from "./index-mn75z39t.js";
+} from "./index-9qy3tzt5.js";
 import {
   log
 } from "./index-zgwm4ryv.js";

package/dist/cli/{index-2wryy5a7.js → index-kxxy7zq4.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   loadPlanJsonOnly
-} from "./index-5z4c9acx.js";
+} from "./index-tm6nwe43.js";
 import {
   isCanonicalPathWithinRoot
 } from "./index-6b295cas.js";
@@ -14,10 +14,7 @@ import {
   legacyEpicIssuePath,
   migrateLegacyEpicConfig,
   resolveEpicConfig
-} from "./index-76xnddca.js";
-import {
-  log
-} from "./index-zgwm4ryv.js";
+} from "./index-ww5ne0g6.js";
 import {
   FALLBACK_MODELS_MAX,
   GATE_CONFIG_KNOWN_SECTION_KEYS,
@@ -28,7 +25,10 @@ import {
   init_schema,
   retiredEpicKeyReplacement,
   stripKnownSwarmPrefix
-} from "./index-k5h4mmwd.js";
+} from "./index-06sj5bjh.js";
+import {
+  log
+} from "./index-zgwm4ryv.js";
 import {
   ALL_AGENT_NAMES,
   TOOL_NAME_SET,
@@ -711,12 +711,15 @@ function levenshteinDistance(a, b) {
   }
   return matrix[al][bl];
 }
+function describeValueType(value) {
+  return Array.isArray(value) ? "array" : typeof value;
+}
 function emitObjectTypeMismatch(key, value, findings) {
   if (value !== undefined && (typeof value !== "object" || Array.isArray(value) || value === null)) {
     findings.push({
       id: `invalid-${key}-type`,
       title: `Invalid ${key} type`,
-      description: `"${key}" must be an object, got ${typeof value}`,
+      description: `"${key}" must be an object, got ${describeValueType(value)}`,
       severity: "error",
       path: key,
       currentValue: value,
@@ -1348,21 +1351,16 @@ function validateConfigKey(path2, value) {
   }
   switch (path2) {
     case "agents": {
-      if (value !== undefined) {
+      if (typeof value !== "object" || Array.isArray(value)) {
+        const kind = describeValueType(value);
         findings.push({
-          id: "deprecated-agents-config",
-          title: "Deprecated agents configuration",
-          description: 'The "agents" field is deprecated. Use "swarms" instead for multi-swarm support.',
-          severity: "warn",
+          id: "invalid-agents-type",
+          title: "Invalid agents type",
+          description: `"agents" must be an object keyed by agent name, got ${kind}`,
+          severity: "error",
           path: "agents",
           currentValue: value,
-          autoFixable: false,
-          proposedFix: {
-            type: "remove",
-            path: "agents",
-            description: "Remove deprecated agents config - use swarms instead",
-            risk: "low"
-          }
+          autoFixable: false
         });
       }
       break;
@@ -1571,7 +1569,7 @@ function validateConfigKey(path2, value) {
           findings.push({
             id: "invalid-swarms-type",
             title: "Invalid swarms type",
-            description: `"swarms" must be an object, got ${typeof value}`,
+            description: `"swarms" must be an object, got ${describeValueType(value)}`,
             severity: "error",
             path: "swarms",
             currentValue: value,