opencode-swarm 7.50.2 → 7.50.3

package/dist/cli/index.js

@@ -52,7 +52,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "opencode-swarm",
-    version: "7.50.2",
+    version: "7.50.3",
     description: "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
     main: "dist/index.js",
     types: "dist/index.d.ts",
@@ -40477,7 +40477,7 @@ function getPluginLockFilePaths() {
 var init_cache_paths = () => {};
 
 // src/gate-evidence.ts
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync7 } from "fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync7, realpathSync as realpathSync3 } from "fs";
 function isValidTaskId(taskId) {
   return isStrictTaskId(taskId);
 }

package/dist/index.js

@@ -69,7 +69,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "opencode-swarm",
-    version: "7.50.2",
+    version: "7.50.3",
     description: "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
     main: "dist/index.js",
     types: "dist/index.d.ts",
@@ -40402,7 +40402,7 @@ __export(exports_gate_evidence, {
   deriveRequiredGates: () => deriveRequiredGates,
   DEFAULT_REQUIRED_GATES: () => DEFAULT_REQUIRED_GATES
 });
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync5 } from "node:fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync5, realpathSync as realpathSync5 } from "node:fs";
 import * as path18 from "node:path";
 function isValidTaskId(taskId) {
   return isStrictTaskId(taskId);
@@ -40438,7 +40438,23 @@ function expandRequiredGates(existingGates, newAgentType) {
   return combined.sort();
 }
 function getEvidenceDir(directory) {
-  return path18.join(directory, ".swarm", "evidence");
+  const swarmDir = path18.resolve(directory, ".swarm");
+  const evidenceDir = path18.join(swarmDir, "evidence");
+  mkdirSync8(evidenceDir, { recursive: true });
+  let resolvedSwarmDir;
+  let resolvedEvidenceDir;
+  try {
+    resolvedSwarmDir = path18.normalize(realpathSync5(swarmDir));
+    resolvedEvidenceDir = path18.normalize(realpathSync5(evidenceDir));
+  } catch (error49) {
+    throw new Error(`Unable to resolve evidence directory: ${error49.message}`);
+  }
+  const swarmPrefix = `${resolvedSwarmDir}${path18.sep}`;
+  const withinSwarmBoundary = process.platform === "win32" ? resolvedEvidenceDir.toLowerCase().startsWith(swarmPrefix.toLowerCase()) : resolvedEvidenceDir.startsWith(swarmPrefix);
+  if (!withinSwarmBoundary) {
+    throw new Error(`Evidence path escapes .swarm boundary: ${resolvedEvidenceDir}`);
+  }
+  return resolvedEvidenceDir;
 }
 function getEvidencePath(directory, taskId) {
   assertValidTaskId(taskId);
@@ -40457,10 +40473,9 @@ function readExisting(evidencePath, taskId) {
 }
 async function recordGateEvidence(directory, taskId, gate, sessionId, turbo) {
   assertValidTaskId(taskId);
-  const evidenceDir = getEvidenceDir(directory);
-  mkdirSync8(evidenceDir, { recursive: true });
   await withTaskEvidenceLock(directory, taskId, gate, async () => {
-    const evidencePath = getEvidencePath(directory, taskId);
+    const resolvedEvidenceDir = getEvidenceDir(directory);
+    const evidencePath = path18.join(resolvedEvidenceDir, `${taskId}.json`);
     let existing = null;
     try {
       existing = readExisting(evidencePath, taskId);
@@ -40488,10 +40503,9 @@ async function recordGateEvidence(directory, taskId, gate, sessionId, turbo) {
 }
 async function recordAgentDispatch(directory, taskId, agentType, turbo) {
   assertValidTaskId(taskId);
-  const evidenceDir = getEvidenceDir(directory);
-  mkdirSync8(evidenceDir, { recursive: true });
   await withTaskEvidenceLock(directory, taskId, agentType, async () => {
-    const evidencePath = getEvidencePath(directory, taskId);
+    const resolvedEvidenceDir = getEvidenceDir(directory);
+    const evidencePath = path18.join(resolvedEvidenceDir, `${taskId}.json`);
     let existing = null;
     try {
       existing = readExisting(evidencePath, taskId);
@@ -56868,12 +56882,12 @@ async function appendRejectedLesson(directory, lesson) {
     await appendKnowledge(filePath, lesson);
   }
 }
-function normalize3(text) {
+function normalize4(text) {
   const s = typeof text === "string" ? text : String(text ?? "");
   return s.toLowerCase().replace(/[^\w\s]/g, " ").replace(/\s+/g, " ").trim();
 }
 function wordBigrams(text) {
-  const words = normalize3(text).split(" ").filter(Boolean);
+  const words = normalize4(text).split(" ").filter(Boolean);
   const bigrams = new Set;
   for (let i2 = 0;i2 < words.length - 1; i2++) {
     bigrams.add(`${words[i2]} ${words[i2 + 1]}`);
@@ -59936,11 +59950,11 @@ async function processRetractions(retractions, directory) {
   const existingRetractions = await readRetractionRecords(directory);
   const existingSuppressedLessons = new Set(existingRetractions.map((record3) => record3.normalized_lesson).filter((value) => typeof value === "string" && value.length > 0));
   for (const retractionText of retractions) {
-    const normalizedRetraction = normalize3(retractionText);
+    const normalizedRetraction = normalize4(retractionText);
     const matchedSwarmIds = [];
     const matchedHiveIds = [];
     for (const entry of swarmEntries) {
-      const normalizedLesson = normalize3(entry.lesson);
+      const normalizedLesson = normalize4(entry.lesson);
       if (normalizedLesson === normalizedRetraction) {
         matchedSwarmIds.push(entry.id);
         await quarantineEntry(directory, entry.id, `Retracted by architect: ${retractionText}`, "architect");
@@ -59948,7 +59962,7 @@ async function processRetractions(retractions, directory) {
       }
     }
     for (const entry of hiveEntries) {
-      if (normalize3(entry.lesson) === normalizedRetraction) {
+      if (normalize4(entry.lesson) === normalizedRetraction) {
         matchedHiveIds.push(entry.id);
       }
     }
@@ -68392,7 +68406,7 @@ function parseContextMd(content) {
     for (const bullet of bullets) {
       if (bullet.length < 15)
         continue;
-      const normalized = normalize3(bullet);
+      const normalized = normalize4(bullet);
       if (seen.has(normalized))
         continue;
       seen.add(normalized);
@@ -73602,7 +73616,7 @@ async function _detectAvailableLinter(_projectDir, biomeBin, eslintBin) {
       stderr: "pipe"
     });
     const biomeExit = biomeProc.exited;
-    const timeout = new Promise((resolve17) => setTimeout(() => resolve17("timeout"), DETECT_TIMEOUT));
+    const timeout = new Promise((resolve18) => setTimeout(() => resolve18("timeout"), DETECT_TIMEOUT));
     const result = await Promise.race([biomeExit, timeout]);
     if (result === "timeout") {
       biomeProc.kill();
@@ -73616,7 +73630,7 @@ async function _detectAvailableLinter(_projectDir, biomeBin, eslintBin) {
       stderr: "pipe"
     });
     const eslintExit = eslintProc.exited;
-    const timeout = new Promise((resolve17) => setTimeout(() => resolve17("timeout"), DETECT_TIMEOUT));
+    const timeout = new Promise((resolve18) => setTimeout(() => resolve18("timeout"), DETECT_TIMEOUT));
     const result = await Promise.race([eslintExit, timeout]);
     if (result === "timeout") {
       eslintProc.kill();
@@ -77641,9 +77655,9 @@ async function runTests(framework, scope, files, coverage, timeout_ms, cwd) {
       stderr: "pipe",
       cwd
     });
-    const timeoutPromise = new Promise((resolve21) => setTimeout(() => {
+    const timeoutPromise = new Promise((resolve22) => setTimeout(() => {
       proc.kill();
-      resolve21(-1);
+      resolve22(-1);
     }, timeout_ms));
     const [exitCode, stdoutResult, stderrResult] = await Promise.all([
       Promise.race([proc.exited, timeoutPromise]),
@@ -79190,13 +79204,13 @@ class CircuitBreaker {
     if (this.config.callTimeoutMs <= 0) {
       return fn2();
     }
-    return new Promise((resolve22, reject) => {
+    return new Promise((resolve23, reject) => {
       const timeout = setTimeout(() => {
         reject(new Error(`Call timeout after ${this.config.callTimeoutMs}ms`));
       }, this.config.callTimeoutMs);
       fn2().then((result) => {
         clearTimeout(timeout);
-        resolve22(result);
+        resolve23(result);
       }).catch((error93) => {
         clearTimeout(timeout);
         reject(error93);
@@ -79483,7 +79497,7 @@ var init_queue = __esm(() => {
 
 // src/background/worker.ts
 function sleep(ms) {
-  return new Promise((resolve22) => setTimeout(resolve22, ms));
+  return new Promise((resolve23) => setTimeout(resolve23, ms));
 }
 
 class WorkerManager {
@@ -86843,9 +86857,9 @@ function validateFilename(filename) {
     throw new Error("Invalid filename: contains null byte");
   }
   const pathSeparators = ["/", "\\", ".."];
-  for (const sep9 of pathSeparators) {
-    if (filename.includes(sep9)) {
-      throw new Error(`Invalid filename: contains path separator '${sep9}'`);
+  for (const sep10 of pathSeparators) {
+    if (filename.includes(sep10)) {
+      throw new Error(`Invalid filename: contains path separator '${sep10}'`);
     }
   }
   if (filename.startsWith("/") || filename.startsWith("\\") || /^[a-zA-Z]:/.test(filename)) {
@@ -89263,8 +89277,8 @@ ${JSON.stringify(symbolNames, null, 2)}`);
       var moduleRtn;
       var Module = moduleArg;
       var readyPromiseResolve, readyPromiseReject;
-      var readyPromise = new Promise((resolve30, reject) => {
-        readyPromiseResolve = resolve30;
+      var readyPromise = new Promise((resolve31, reject) => {
+        readyPromiseResolve = resolve31;
         readyPromiseReject = reject;
       });
       var ENVIRONMENT_IS_WEB = typeof window == "object";
@@ -89344,13 +89358,13 @@ ${JSON.stringify(symbolNames, null, 2)}`);
           }
           readAsync = /* @__PURE__ */ __name(async (url3) => {
             if (isFileURI(url3)) {
-              return new Promise((resolve30, reject) => {
+              return new Promise((resolve31, reject) => {
                 var xhr = new XMLHttpRequest;
                 xhr.open("GET", url3, true);
                 xhr.responseType = "arraybuffer";
                 xhr.onload = () => {
                   if (xhr.status == 200 || xhr.status == 0 && xhr.response) {
-                    resolve30(xhr.response);
+                    resolve31(xhr.response);
                     return;
                   }
                   reject(xhr.status);
@@ -89570,10 +89584,10 @@ ${JSON.stringify(symbolNames, null, 2)}`);
         __name(receiveInstantiationResult, "receiveInstantiationResult");
         var info2 = getWasmImports();
         if (Module["instantiateWasm"]) {
-          return new Promise((resolve30, reject) => {
+          return new Promise((resolve31, reject) => {
             Module["instantiateWasm"](info2, (mod, inst) => {
               receiveInstance(mod, inst);
-              resolve30(mod.exports);
+              resolve31(mod.exports);
             });
           });
         }
@@ -91449,13 +91463,13 @@ async function extractDocConstraints(directory, taskFiles, taskDescription) {
   const knowledgePath = resolveSwarmKnowledgePath(directory);
   const existingEntries = await readKnowledge(knowledgePath);
   const taskContext = [...taskFiles, taskDescription].join(" ");
-  const taskBigrams = wordBigrams(normalize3(taskContext));
+  const taskBigrams = wordBigrams(normalize4(taskContext));
   let extractedCount = 0;
   let skippedCount = 0;
   const details = [];
   for (const docFile of manifest.files) {
     const docContext = `${docFile.path} ${docFile.title} ${docFile.summary}`;
-    const docBigrams = wordBigrams(normalize3(docContext));
+    const docBigrams = wordBigrams(normalize4(docContext));
     const score = jaccardBigram(taskBigrams, docBigrams);
     if (score <= RELEVANCE_THRESHOLD) {
       skippedCount++;
@@ -91686,7 +91700,7 @@ async function readMergedKnowledge(directory, config3, context, opts) {
   const seenLessons = new Set;
   const merged = [];
   for (const entry of hiveEntries) {
-    const normalized = normalize3(entry.lesson);
+    const normalized = normalize4(entry.lesson);
     seenLessons.add(normalized);
     merged.push({
       ...entry,
@@ -91695,15 +91709,15 @@ async function readMergedKnowledge(directory, config3, context, opts) {
     });
   }
   for (const entry of swarmEntries) {
-    const normalized = normalize3(entry.lesson);
+    const normalized = normalize4(entry.lesson);
     if (seenLessons.has(normalized)) {
       continue;
     }
     const swarmBigrams = wordBigrams(normalized);
-    const isHiveNearDup = hiveEntries.some((hiveEntry) => jaccardBigram(swarmBigrams, wordBigrams(normalize3(hiveEntry.lesson))) >= JACCARD_THRESHOLD2);
+    const isHiveNearDup = hiveEntries.some((hiveEntry) => jaccardBigram(swarmBigrams, wordBigrams(normalize4(hiveEntry.lesson))) >= JACCARD_THRESHOLD2);
     if (isHiveNearDup)
       continue;
-    const isSwarmNearDup = merged.some((m) => m.tier === "swarm" && jaccardBigram(swarmBigrams, wordBigrams(normalize3(m.lesson))) >= JACCARD_THRESHOLD2);
+    const isSwarmNearDup = merged.some((m) => m.tier === "swarm" && jaccardBigram(swarmBigrams, wordBigrams(normalize4(m.lesson))) >= JACCARD_THRESHOLD2);
     if (isSwarmNearDup)
       continue;
     seenLessons.add(normalized);
@@ -91716,7 +91730,7 @@ async function readMergedKnowledge(directory, config3, context, opts) {
   const retractionRecords = await readRetractionRecords(directory);
   const suppressedLessons = new Set(retractionRecords.map((record3) => record3.normalized_lesson).filter((value) => typeof value === "string" && value.length > 0));
   const scopeFilter = config3.scope_filter ?? ["global"];
-  const filtered = merged.filter((entry) => (opts?.skipScopeFilter || scopeFilter.some((pattern) => (entry.scope ?? "global") === pattern)) && NORMAL_RETRIEVAL_STATUSES.has(entry.status) && !suppressedLessons.has(normalize3(entry.lesson)));
+  const filtered = merged.filter((entry) => (opts?.skipScopeFilter || scopeFilter.some((pattern) => (entry.scope ?? "global") === pattern)) && NORMAL_RETRIEVAL_STATUSES.has(entry.status) && !suppressedLessons.has(normalize4(entry.lesson)));
   const ranked = filtered.map((entry) => {
     let categoryScore = 0;
     if (context?.currentPhase) {
@@ -91960,14 +91974,14 @@ async function searchKnowledge(params) {
       });
     }
     const queryText = (query ?? "").trim();
-    const queryBigrams = queryText ? wordBigrams(normalize3(queryText)) : null;
+    const queryBigrams = queryText ? wordBigrams(normalize4(queryText)) : null;
     const hasQuery = queryBigrams !== null;
     const textWeight = hasQuery ? TEXT_WEIGHT : 0;
     const metaWeight = hasQuery ? META_WEIGHT : 1;
     const minConf = typeof config3.directive_min_confidence === "number" ? config3.directive_min_confidence : DIRECTIVE_BOOST_MIN_CONFIDENCE;
     const scored = candidates.map((entry) => {
       const retrievalOutcomes = effectiveRetrievalOutcomes(entry.retrieval_outcomes, counterRollups.get(entry.id));
-      const textScore = queryBigrams ? jaccardBigram(queryBigrams, wordBigrams(normalize3(entryText(entry)))) : 0;
+      const textScore = queryBigrams ? jaccardBigram(queryBigrams, wordBigrams(normalize4(entryText(entry)))) : 0;
       const metaScore = entry.finalScore;
       const ds = context ? scoreDirectiveAgainstContext(entry, context) : { triggerHit: false, actionHit: false, agentHit: false, score: 0 };
       const confBoost = context && entry.confidence >= minConf && (ds.actionHit || ds.agentHit) ? 0.25 : 0;
@@ -92940,13 +92954,13 @@ class PlanSyncWorker {
     } catch {}
   }
   withTimeout(promise3, ms, timeoutMessage) {
-    return new Promise((resolve24, reject) => {
+    return new Promise((resolve25, reject) => {
       const timer = setTimeout(() => {
         reject(new Error(`${timeoutMessage} (${ms}ms)`));
       }, ms);
       promise3.then((result) => {
         clearTimeout(timer);
-        resolve24(result);
+        resolve25(result);
       }).catch((error93) => {
         clearTimeout(timer);
         reject(error93);
@@ -95393,7 +95407,7 @@ import * as path85 from "node:path";
 init_logger();
 init_path_security();
 import * as fsSync4 from "node:fs";
-import { existsSync as existsSync47, realpathSync as realpathSync10 } from "node:fs";
+import { existsSync as existsSync47, realpathSync as realpathSync11 } from "node:fs";
 import * as fsPromises5 from "node:fs/promises";
 import * as os13 from "node:os";
 import * as path81 from "node:path";
@@ -95415,8 +95429,8 @@ async function withTimeout(promise3, ms, timeoutError) {
   }
 }
 function yieldToEventLoop() {
-  return new Promise((resolve24) => {
-    const t = setTimeout(resolve24, 0);
+  return new Promise((resolve25) => {
+    const t = setTimeout(resolve25, 0);
     if (typeof t.unref === "function") {
       t.unref();
     }
@@ -95757,8 +95771,8 @@ var symbols = createSwarmTool({
 });
 
 // src/tools/repo-graph/safe-realpath.ts
-import { realpathSync as realpathSync9 } from "node:fs";
-function safeRealpathSync(targetPath, fallback, realpathResolver = realpathSync9) {
+import { realpathSync as realpathSync10 } from "node:fs";
+function safeRealpathSync(targetPath, fallback, realpathResolver = realpathSync10) {
   try {
     return realpathResolver(targetPath);
   } catch (error93) {
@@ -96016,7 +96030,7 @@ function resolveModuleSpecifier(workspaceRoot, sourceFile, specifier) {
 function isRefusedWorkspaceRoot(target) {
   let resolved;
   try {
-    resolved = realpathSync10(target);
+    resolved = realpathSync11(target);
   } catch {
     resolved = path81.resolve(target);
   }
@@ -96485,7 +96499,7 @@ async function saveGraph(workspace, graph, options) {
           lastError = error93 instanceof Error ? error93 : new Error(String(error93));
           if (lastError instanceof Error && "code" in lastError && lastError.code === "EEXIST" && retries < WINDOWS_RENAME_MAX_RETRIES2 - 1) {
             retries++;
-            await new Promise((resolve26) => setTimeout(resolve26, WINDOWS_RENAME_RETRY_DELAY_MS2));
+            await new Promise((resolve27) => setTimeout(resolve27, WINDOWS_RENAME_RETRY_DELAY_MS2));
             continue;
           }
           throw lastError;
@@ -97459,26 +97473,26 @@ function pLimit(concurrency) {
     activeCount--;
     resumeNext();
   };
-  const run2 = async (function_, resolve28, arguments_2) => {
+  const run2 = async (function_, resolve29, arguments_2) => {
     const result = (async () => function_(...arguments_2))();
-    resolve28(result);
+    resolve29(result);
     try {
       await result;
     } catch {}
     next();
   };
-  const enqueue = (function_, resolve28, reject, arguments_2) => {
+  const enqueue = (function_, resolve29, reject, arguments_2) => {
     const queueItem = { reject };
     new Promise((internalResolve) => {
       queueItem.run = internalResolve;
       queue.enqueue(queueItem);
-    }).then(run2.bind(undefined, function_, resolve28, arguments_2));
+    }).then(run2.bind(undefined, function_, resolve29, arguments_2));
     if (activeCount < concurrency) {
       resumeNext();
     }
   };
-  const generator = (function_, ...arguments_2) => new Promise((resolve28, reject) => {
-    enqueue(function_, resolve28, reject, arguments_2);
+  const generator = (function_, ...arguments_2) => new Promise((resolve29, reject) => {
+    enqueue(function_, resolve29, reject, arguments_2);
   });
   Object.defineProperties(generator, {
     activeCount: {
@@ -99340,7 +99354,7 @@ function isGitBinaryMissing(err2) {
 // src/hooks/semantic-diff-injection.ts
 async function execGit(directory, args2, options) {
   try {
-    const stdout = await new Promise((resolve31, reject) => {
+    const stdout = await new Promise((resolve32, reject) => {
       const execOpts = {
         encoding: "utf-8",
         cwd: directory,
@@ -99353,7 +99367,7 @@ async function execGit(directory, args2, options) {
           reject(error93);
           return;
         }
-        resolve31(output ?? "");
+        resolve32(output ?? "");
       });
     });
     return stdout;
@@ -102556,7 +102570,7 @@ import * as path98 from "node:path";
 import * as child_process6 from "node:child_process";
 var WIN32_CMD_BINARIES = new Set(["npm", "npx", "pnpm", "yarn"]);
 function spawnAsync(command, cwd, timeoutMs) {
-  return new Promise((resolve33) => {
+  return new Promise((resolve34) => {
     try {
       const [rawCmd, ...args2] = command;
       const cmd = process.platform === "win32" && WIN32_CMD_BINARIES.has(rawCmd) && !rawCmd.includes(".") ? `${rawCmd}.cmd` : rawCmd;
@@ -102603,24 +102617,24 @@ function spawnAsync(command, cwd, timeoutMs) {
         try {
           proc.kill();
         } catch {}
-        resolve33(null);
+        resolve34(null);
       }, timeoutMs);
       proc.on("close", (code) => {
         if (done)
           return;
         done = true;
         clearTimeout(timer);
-        resolve33({ exitCode: code ?? 1, stdout, stderr });
+        resolve34({ exitCode: code ?? 1, stdout, stderr });
       });
       proc.on("error", () => {
         if (done)
           return;
         done = true;
         clearTimeout(timer);
-        resolve33(null);
+        resolve34(null);
       });
     } catch {
-      resolve33(null);
+      resolve34(null);
     }
   });
 }
@@ -106107,7 +106121,7 @@ import {
   mkdirSync as mkdirSync27,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync39,
-  realpathSync as realpathSync13,
+  realpathSync as realpathSync14,
   renameSync as renameSync20,
   rmdirSync,
   unlinkSync as unlinkSync17,
@@ -106141,8 +106155,8 @@ function containsStrictControlChars(str) {
 }
 function isCanonicalProtectedPath(targetPath, workspace) {
   try {
-    const canonicalTarget = realpathSync13(targetPath);
-    const canonicalWorkspace = realpathSync13(workspace);
+    const canonicalTarget = realpathSync14(targetPath);
+    const canonicalWorkspace = realpathSync14(workspace);
     const relative21 = path109.relative(canonicalWorkspace, canonicalTarget).replace(/\\/g, "/");
     const segments = relative21.split("/").filter(Boolean);
     return segments.some((seg) => seg === ".git" || seg === ".swarm");
@@ -106151,8 +106165,8 @@ function isCanonicalProtectedPath(targetPath, workspace) {
     if (parentDir === targetPath)
       return false;
     try {
-      const canonicalParent = realpathSync13(parentDir);
-      const canonicalWorkspace = realpathSync13(workspace);
+      const canonicalParent = realpathSync14(parentDir);
+      const canonicalWorkspace = realpathSync14(workspace);
       const relative21 = path109.relative(canonicalWorkspace, canonicalParent).replace(/\\/g, "/");
       const segments = relative21.split("/").filter(Boolean);
       return segments.some((seg) => seg === ".git" || seg === ".swarm");
@@ -106163,8 +106177,8 @@ function isCanonicalProtectedPath(targetPath, workspace) {
 }
 function isCanonicalPathWithinWorkspace(targetPath, workspaceRoot) {
   try {
-    const canonicalTarget = realpathSync13(targetPath);
-    const canonicalWorkspace = realpathSync13(workspaceRoot);
+    const canonicalTarget = realpathSync14(targetPath);
+    const canonicalWorkspace = realpathSync14(workspaceRoot);
     const relative21 = path109.relative(canonicalWorkspace, canonicalTarget);
     if (relative21.startsWith("..") || path109.isAbsolute(relative21))
       return false;
@@ -106178,8 +106192,8 @@ function isCanonicalPathWithinWorkspace(targetPath, workspaceRoot) {
       return false;
     }
     try {
-      const canonicalParent = realpathSync13(parentDir);
-      const canonicalWorkspace = realpathSync13(workspaceRoot);
+      const canonicalParent = realpathSync14(parentDir);
+      const canonicalWorkspace = realpathSync14(workspaceRoot);
       const relative21 = path109.relative(canonicalWorkspace, canonicalParent);
       if (relative21.startsWith("..") || path109.isAbsolute(relative21))
         return false;
@@ -106457,7 +106471,7 @@ function atomicWriteFileSync(targetPath, content) {
   const tempPrefix = `.apply-patch-${Date.now()}-${process.pid}`;
   let tempPath;
   try {
-    const tempDir = realpathSync13(mkdtempSync2(path109.join(dir, tempPrefix)));
+    const tempDir = realpathSync14(mkdtempSync2(path109.join(dir, tempPrefix)));
     tempPath = path109.join(tempDir, "content");
   } catch {
     tempPath = path109.join(dir, `${tempPrefix}.tmp`);
@@ -110437,7 +110451,7 @@ init_create_tool();
 init_resolve_working_directory();
 async function execGit2(workingDir, args2, options) {
   try {
-    const stdout = await new Promise((resolve41, reject) => {
+    const stdout = await new Promise((resolve42, reject) => {
       const execOpts = {
         encoding: "utf-8",
         cwd: workingDir,
@@ -110450,7 +110464,7 @@ async function execGit2(workingDir, args2, options) {
           reject(error93);
           return;
         }
-        resolve41(output ?? "");
+        resolve42(output ?? "");
       });
     });
     return stdout;
@@ -111390,7 +111404,7 @@ init_create_tool();
 var GITINGEST_TIMEOUT_MS = 1e4;
 var GITINGEST_MAX_RESPONSE_BYTES = 5242880;
 var GITINGEST_MAX_RETRIES = 2;
-var delay = (ms) => new Promise((resolve42) => setTimeout(resolve42, ms));
+var delay = (ms) => new Promise((resolve43) => setTimeout(resolve43, ms));
 async function fetchGitingest(args2) {
   for (let attempt = 0;attempt <= GITINGEST_MAX_RETRIES; attempt++) {
     try {
@@ -112245,7 +112259,7 @@ function filterSwarmEntries(entries, filters, suppressedLessons, scopeFilter) {
         return false;
       }
     }
-    if (suppressedLessons.has(normalize3(entry.lesson))) {
+    if (suppressedLessons.has(normalize4(entry.lesson))) {
       return false;
     }
     return true;
@@ -112266,7 +112280,7 @@ function filterHiveEntries(entries, filters, suppressedLessons) {
     if (filters.minScore !== undefined && entry.confidence < filters.minScore) {
       return false;
     }
-    if (suppressedLessons.has(normalize3(entry.lesson))) {
+    if (suppressedLessons.has(normalize4(entry.lesson))) {
       return false;
     }
     return true;
@@ -117129,7 +117143,7 @@ async function runNpmAudit(directory) {
       stderr: "pipe",
       cwd: directory
     });
-    const timeoutPromise = new Promise((resolve46) => setTimeout(() => resolve46("timeout"), AUDIT_TIMEOUT_MS));
+    const timeoutPromise = new Promise((resolve47) => setTimeout(() => resolve47("timeout"), AUDIT_TIMEOUT_MS));
     const result = await Promise.race([
       Promise.all([proc.stdout.text(), proc.stderr.text()]).then(([stdout2, stderr2]) => ({ stdout: stdout2, stderr: stderr2 })),
       timeoutPromise
@@ -117249,7 +117263,7 @@ async function runPipAudit(directory) {
       stderr: "pipe",
       cwd: directory
     });
-    const timeoutPromise = new Promise((resolve46) => setTimeout(() => resolve46("timeout"), AUDIT_TIMEOUT_MS));
+    const timeoutPromise = new Promise((resolve47) => setTimeout(() => resolve47("timeout"), AUDIT_TIMEOUT_MS));
     const result = await Promise.race([
       Promise.all([proc.stdout.text(), proc.stderr.text()]).then(([stdout2, stderr2]) => ({ stdout: stdout2, stderr: stderr2 })),
       timeoutPromise
@@ -117377,7 +117391,7 @@ async function runCargoAudit(directory) {
       stderr: "pipe",
       cwd: directory
     });
-    const timeoutPromise = new Promise((resolve46) => setTimeout(() => resolve46("timeout"), AUDIT_TIMEOUT_MS));
+    const timeoutPromise = new Promise((resolve47) => setTimeout(() => resolve47("timeout"), AUDIT_TIMEOUT_MS));
     const result = await Promise.race([
       Promise.all([proc.stdout.text(), proc.stderr.text()]).then(([stdout2, stderr]) => ({ stdout: stdout2, stderr })),
       timeoutPromise
@@ -117501,7 +117515,7 @@ async function runGoAudit(directory) {
       stderr: "pipe",
       cwd: directory
     });
-    const timeoutPromise = new Promise((resolve46) => setTimeout(() => resolve46("timeout"), AUDIT_TIMEOUT_MS));
+    const timeoutPromise = new Promise((resolve47) => setTimeout(() => resolve47("timeout"), AUDIT_TIMEOUT_MS));
     const result = await Promise.race([
       Promise.all([proc.stdout.text(), proc.stderr.text()]).then(([stdout2, stderr]) => ({ stdout: stdout2, stderr })),
       timeoutPromise
@@ -117634,7 +117648,7 @@ async function runDotnetAudit(directory) {
       stderr: "pipe",
       cwd: directory
     });
-    const timeoutPromise = new Promise((resolve46) => setTimeout(() => resolve46("timeout"), AUDIT_TIMEOUT_MS));
+    const timeoutPromise = new Promise((resolve47) => setTimeout(() => resolve47("timeout"), AUDIT_TIMEOUT_MS));
     const result = await Promise.race([
       Promise.all([proc.stdout.text(), proc.stderr.text()]).then(([stdout2, stderr]) => ({ stdout: stdout2, stderr })),
       timeoutPromise
@@ -117750,7 +117764,7 @@ async function runBundleAudit(directory) {
       stderr: "pipe",
       cwd: directory
     });
-    const timeoutPromise = new Promise((resolve46) => setTimeout(() => resolve46("timeout"), AUDIT_TIMEOUT_MS));
+    const timeoutPromise = new Promise((resolve47) => setTimeout(() => resolve47("timeout"), AUDIT_TIMEOUT_MS));
     const result = await Promise.race([
       Promise.all([proc.stdout.text(), proc.stderr.text()]).then(([stdout2, stderr]) => ({ stdout: stdout2, stderr })),
       timeoutPromise
@@ -117895,7 +117909,7 @@ async function runDartAudit(directory) {
       stderr: "pipe",
       cwd: directory
     });
-    const timeoutPromise = new Promise((resolve46) => setTimeout(() => resolve46("timeout"), AUDIT_TIMEOUT_MS));
+    const timeoutPromise = new Promise((resolve47) => setTimeout(() => resolve47("timeout"), AUDIT_TIMEOUT_MS));
     const result = await Promise.race([
       Promise.all([proc.stdout.text(), proc.stderr.text()]).then(([stdout2, stderr]) => ({ stdout: stdout2, stderr })),
       timeoutPromise
@@ -118010,7 +118024,7 @@ async function runComposerAudit(directory) {
       stderr: "pipe",
       cwd: directory
     });
-    const timeoutPromise = new Promise((resolve46) => setTimeout(() => resolve46("timeout"), AUDIT_TIMEOUT_MS));
+    const timeoutPromise = new Promise((resolve47) => setTimeout(() => resolve47("timeout"), AUDIT_TIMEOUT_MS));
     const result = await Promise.race([
       Promise.all([proc.stdout.text(), proc.stderr.text()]).then(([stdout2, stderr]) => ({ stdout: stdout2, stderr })),
       timeoutPromise
@@ -119671,7 +119685,7 @@ function mapSemgrepSeverity(severity) {
   }
 }
 async function executeWithTimeout(command, args2, options) {
-  return new Promise((resolve48) => {
+  return new Promise((resolve49) => {
     const child = child_process9.spawn(command, args2, {
       shell: false,
       cwd: options.cwd
@@ -119680,7 +119694,7 @@ async function executeWithTimeout(command, args2, options) {
     let stderr = "";
     const timeout = setTimeout(() => {
       child.kill("SIGTERM");
-      resolve48({
+      resolve49({
         stdout,
         stderr: "Process timed out",
         exitCode: 124
@@ -119694,7 +119708,7 @@ async function executeWithTimeout(command, args2, options) {
     });
     child.on("close", (code) => {
       clearTimeout(timeout);
-      resolve48({
+      resolve49({
         stdout,
         stderr,
         exitCode: code ?? 0
@@ -119702,7 +119716,7 @@ async function executeWithTimeout(command, args2, options) {
     });
     child.on("error", (err2) => {
       clearTimeout(timeout);
-      resolve48({
+      resolve49({
         stdout,
         stderr: err2.message,
         exitCode: 1
@@ -119901,7 +119915,7 @@ async function acquireLock2(lockPath) {
       };
     } catch {
       if (attempt < LOCK_RETRY_DELAYS_MS.length) {
-        await new Promise((resolve49) => setTimeout(resolve49, LOCK_RETRY_DELAYS_MS[attempt]));
+        await new Promise((resolve50) => setTimeout(resolve50, LOCK_RETRY_DELAYS_MS[attempt]));
       }
     }
   }
@@ -123912,7 +123926,7 @@ async function ripgrepSearch(opts) {
       stderr: "pipe",
       cwd: opts.workspace
     });
-    const timeout = new Promise((resolve55) => setTimeout(() => resolve55("timeout"), REGEX_TIMEOUT_MS));
+    const timeout = new Promise((resolve56) => setTimeout(() => resolve56("timeout"), REGEX_TIMEOUT_MS));
     const exitPromise = proc.exited;
     const result = await Promise.race([exitPromise, timeout]);
     if (result === "timeout") {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.50.2",
+	"version": "7.50.3",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",