@orchestrator-claude/definitions 3.37.0 → 3.37.2

package/hooks/mailbox-listener.mjs

@@ -6,28 +6,80 @@ import {
   readFileSync as readFileSync2,
   unlinkSync as unlinkSync2,
   renameSync,
-  existsSync,
+  existsSync as existsSync2,
   mkdirSync as mkdirSync2,
   writeFileSync as writeFileSync2
 } from "node:fs";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 import { randomUUID } from "node:crypto";
 
 // hooks/lib/api-client.ts
 import { readFileSync, writeFileSync, mkdirSync, statSync, unlinkSync, readdirSync } from "node:fs";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-var __filename = fileURLToPath(import.meta.url);
-var __dirname = dirname(__filename);
-var PROJECT_ROOT = join(__dirname, "..", "..", "..");
-var STATE_DIR = join(PROJECT_ROOT, ".orchestrator", ".state");
-var JWT_CACHE = join(STATE_DIR, "jwt-token");
-var DEBUG_LOG = join(STATE_DIR, "hook-debug.log");
+import { join as join2 } from "node:path";
+import { tmpdir } from "node:os";
+import { createHash } from "node:crypto";
+
+// ../project-root-resolver/dist/index.js
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+function hasProjectRootMarker(candidate, sentinel) {
+  return existsSync(join(candidate, ".git")) || existsSync(join(candidate, "package.json")) || existsSync(join(candidate, sentinel, ".root"));
+}
+function resolveProjectRoot(cwd, sentinel = ".orchestrator") {
+  const candidates = [];
+  let currentDir = cwd;
+  for (; ; ) {
+    if (existsSync(join(currentDir, sentinel))) {
+      candidates.push(currentDir);
+    }
+    const parentDir = dirname(currentDir);
+    if (parentDir === currentDir) {
+      break;
+    }
+    currentDir = parentDir;
+  }
+  const [innermost] = candidates;
+  if (innermost === void 0) {
+    return null;
+  }
+  for (const candidate of candidates) {
+    if (hasProjectRootMarker(candidate, sentinel)) {
+      return candidate;
+    }
+  }
+  return innermost;
+}
+
+// hooks/lib/api-client.ts
+function resolveFallbackStateDir(cwd) {
+  const cwdHash = createHash("sha256").update(cwd).digest("hex").slice(0, 16);
+  return join2(tmpdir(), "orchestrator-hook-fallback", cwdHash);
+}
+var PROJECT_ROOT = (() => {
+  const resolved = resolveHookProjectRoot(process.cwd());
+  if (resolved !== null && hasProjectRootMarker(resolved, ".orchestrator")) {
+    return resolved;
+  }
+  return null;
+})();
+var STATE_DIR_OVERRIDE = process.env.ORCHESTRATOR_STATE_DIR;
+var STATE_DIR = STATE_DIR_OVERRIDE !== void 0 && STATE_DIR_OVERRIDE !== "" ? STATE_DIR_OVERRIDE : PROJECT_ROOT !== null ? join2(PROJECT_ROOT, ".orchestrator", ".state") : resolveFallbackStateDir(process.cwd());
+var JWT_CACHE = join2(STATE_DIR, "jwt-token");
+var DEBUG_LOG = join2(STATE_DIR, "hook-debug.log");
 mkdirSync(STATE_DIR, { recursive: true });
+if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT === null) {
+  log(
+    "API-CLIENT",
+    `PROJECT_ROOT: no marker-verified ".orchestrator" project root found above ${process.cwd()} \u2014 falling back to isolated state dir ${STATE_DIR} (RF-003)`
+  );
+}
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
 var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
 var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
 var PROJECT_ID = process.env.ORCHESTRATOR_PROJECT_ID || "";
+function resolveHookProjectRoot(cwd) {
+  return resolveProjectRoot(cwd);
+}
 function log(prefix, msg) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d+Z$/, "Z");
   try {
@@ -37,11 +89,11 @@ function log(prefix, msg) {
   } catch {
   }
 }
-var LAST_COMPLETED_FILE = join(STATE_DIR, "last-completed-workflow.json");
+var LAST_COMPLETED_FILE = join2(STATE_DIR, "last-completed-workflow.json");
 var LAST_COMPLETED_TTL_MS = 60 * 60 * 1e3;
-var INVOCATIONS_DIR = join(STATE_DIR, "invocations");
+var INVOCATIONS_DIR = join2(STATE_DIR, "invocations");
 var INVOCATION_STATE_TTL_MS = 4 * 60 * 60 * 1e3;
-var DISPATCH_INTENT_DIR = join(STATE_DIR, "dispatch-intent");
+var DISPATCH_INTENT_DIR = join2(STATE_DIR, "dispatch-intent");
 function outputContext(hookEvent, context) {
   console.log(
     JSON.stringify({
@@ -82,7 +134,7 @@ function consumeInbox(inboxPath, quarantinePath, paneRole) {
   const consumed = [];
   const errors = [];
   for (const file of files) {
-    const filePath = join2(inboxPath, file);
+    const filePath = join3(inboxPath, file);
     try {
       const raw = readFileSync2(filePath, "utf-8");
       const parsed = JSON.parse(raw);
@@ -101,7 +153,7 @@ function consumeInbox(inboxPath, quarantinePath, paneRole) {
       log(HOOK, `Quarantine: ${file} \u2014 ${errMsg}`);
       try {
         mkdirSync2(quarantinePath, { recursive: true });
-        renameSync(filePath, join2(quarantinePath, file));
+        renameSync(filePath, join3(quarantinePath, file));
       } catch {
       }
     }
@@ -211,7 +263,7 @@ function relaySidecarMessages(consumed, sprintId, paneRole, deps = { readdirSync
         };
         const sidecarAddr = `${sidecar.role}-${String(sidecar.index)}`;
         const targetInbox = `/tmp/${sprintId}/mailbox/${sidecarAddr}/inbox`;
-        const targetPath = join2(targetInbox, `${envelope.id}.json`);
+        const targetPath = join3(targetInbox, `${envelope.id}.json`);
         deps.writeFileSync(targetPath, JSON.stringify(envelope), "utf-8");
         log(HOOK, `Relayed task_complete to ${sidecarAddr}: ${envelope.id}`);
       } catch (err) {
@@ -229,7 +281,7 @@ async function main() {
   }
   const inboxPath = `/tmp/${sprintId}/mailbox/${paneRole}/inbox`;
   const quarantinePath = `/tmp/${sprintId}/mailbox/${paneRole}/quarantine`;
-  if (!existsSync(inboxPath)) {
+  if (!existsSync2(inboxPath)) {
     return;
   }
   let hookEventName;

package/hooks/playwright-output-guard.mjs

@@ -1,38 +1,68 @@
 import { createRequire as __createRequireShim } from 'node:module'; const require = __createRequireShim(import.meta.url);
 
 // hooks/playwright-output-guard.ts
-import { dirname as dirname3, isAbsolute, normalize, resolve } from "node:path";
+import { dirname as dirname2, isAbsolute, normalize, resolve } from "node:path";
 
 // hooks/lib/api-client.ts
 import { readFileSync, writeFileSync, mkdirSync, statSync, unlinkSync, readdirSync } from "node:fs";
-import { join as join2, dirname as dirname2 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { join as join2 } from "node:path";
+import { tmpdir } from "node:os";
+import { createHash } from "node:crypto";
 
 // ../project-root-resolver/dist/index.js
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
+function hasProjectRootMarker(candidate, sentinel) {
+  return existsSync(join(candidate, ".git")) || existsSync(join(candidate, "package.json")) || existsSync(join(candidate, sentinel, ".root"));
+}
 function resolveProjectRoot(cwd, sentinel = ".orchestrator") {
+  const candidates = [];
   let currentDir = cwd;
   for (; ; ) {
     if (existsSync(join(currentDir, sentinel))) {
-      return currentDir;
+      candidates.push(currentDir);
     }
     const parentDir = dirname(currentDir);
     if (parentDir === currentDir) {
-      return null;
+      break;
     }
     currentDir = parentDir;
   }
+  const [innermost] = candidates;
+  if (innermost === void 0) {
+    return null;
+  }
+  for (const candidate of candidates) {
+    if (hasProjectRootMarker(candidate, sentinel)) {
+      return candidate;
+    }
+  }
+  return innermost;
 }
 
 // hooks/lib/api-client.ts
-var __filename = fileURLToPath(import.meta.url);
-var __dirname = dirname2(__filename);
-var PROJECT_ROOT = join2(__dirname, "..", "..", "..");
-var STATE_DIR = join2(PROJECT_ROOT, ".orchestrator", ".state");
+function resolveFallbackStateDir(cwd) {
+  const cwdHash = createHash("sha256").update(cwd).digest("hex").slice(0, 16);
+  return join2(tmpdir(), "orchestrator-hook-fallback", cwdHash);
+}
+var PROJECT_ROOT = (() => {
+  const resolved = resolveHookProjectRoot(process.cwd());
+  if (resolved !== null && hasProjectRootMarker(resolved, ".orchestrator")) {
+    return resolved;
+  }
+  return null;
+})();
+var STATE_DIR_OVERRIDE = process.env.ORCHESTRATOR_STATE_DIR;
+var STATE_DIR = STATE_DIR_OVERRIDE !== void 0 && STATE_DIR_OVERRIDE !== "" ? STATE_DIR_OVERRIDE : PROJECT_ROOT !== null ? join2(PROJECT_ROOT, ".orchestrator", ".state") : resolveFallbackStateDir(process.cwd());
 var JWT_CACHE = join2(STATE_DIR, "jwt-token");
 var DEBUG_LOG = join2(STATE_DIR, "hook-debug.log");
 mkdirSync(STATE_DIR, { recursive: true });
+if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT === null) {
+  log(
+    "API-CLIENT",
+    `PROJECT_ROOT: no marker-verified ".orchestrator" project root found above ${process.cwd()} \u2014 falling back to isolated state dir ${STATE_DIR} (RF-003)`
+  );
+}
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
 var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
 var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
@@ -95,7 +125,7 @@ var GUIDANCE = 'Playwright Output Guard: screenshots n\xE3o podem cair na raiz d
 function evaluateFilename(filename) {
   if (!filename) return { decision: "allow" };
   const resolved = isAbsolute(filename) ? normalize(filename) : resolve(PROJECT_ROOT2, filename);
-  const dir = dirname3(resolved);
+  const dir = dirname2(resolved);
   if (dir === PROJECT_ROOT2) {
     return { decision: "deny", reason: GUIDANCE };
   }

package/hooks/post-implement.mjs

@@ -2,34 +2,64 @@ import { createRequire as __createRequireShim } from 'node:module'; const requir
 
 // hooks/lib/api-client.ts
 import { readFileSync, writeFileSync, mkdirSync, statSync, unlinkSync, readdirSync } from "node:fs";
-import { join as join2, dirname as dirname2 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { join as join2 } from "node:path";
+import { tmpdir } from "node:os";
+import { createHash } from "node:crypto";
 
 // ../project-root-resolver/dist/index.js
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
+function hasProjectRootMarker(candidate, sentinel) {
+  return existsSync(join(candidate, ".git")) || existsSync(join(candidate, "package.json")) || existsSync(join(candidate, sentinel, ".root"));
+}
 function resolveProjectRoot(cwd, sentinel = ".orchestrator") {
+  const candidates = [];
   let currentDir = cwd;
   for (; ; ) {
     if (existsSync(join(currentDir, sentinel))) {
-      return currentDir;
+      candidates.push(currentDir);
     }
     const parentDir = dirname(currentDir);
     if (parentDir === currentDir) {
-      return null;
+      break;
     }
     currentDir = parentDir;
   }
+  const [innermost] = candidates;
+  if (innermost === void 0) {
+    return null;
+  }
+  for (const candidate of candidates) {
+    if (hasProjectRootMarker(candidate, sentinel)) {
+      return candidate;
+    }
+  }
+  return innermost;
 }
 
 // hooks/lib/api-client.ts
-var __filename = fileURLToPath(import.meta.url);
-var __dirname = dirname2(__filename);
-var PROJECT_ROOT = join2(__dirname, "..", "..", "..");
-var STATE_DIR = join2(PROJECT_ROOT, ".orchestrator", ".state");
+function resolveFallbackStateDir(cwd) {
+  const cwdHash = createHash("sha256").update(cwd).digest("hex").slice(0, 16);
+  return join2(tmpdir(), "orchestrator-hook-fallback", cwdHash);
+}
+var PROJECT_ROOT = (() => {
+  const resolved = resolveHookProjectRoot(process.cwd());
+  if (resolved !== null && hasProjectRootMarker(resolved, ".orchestrator")) {
+    return resolved;
+  }
+  return null;
+})();
+var STATE_DIR_OVERRIDE = process.env.ORCHESTRATOR_STATE_DIR;
+var STATE_DIR = STATE_DIR_OVERRIDE !== void 0 && STATE_DIR_OVERRIDE !== "" ? STATE_DIR_OVERRIDE : PROJECT_ROOT !== null ? join2(PROJECT_ROOT, ".orchestrator", ".state") : resolveFallbackStateDir(process.cwd());
 var JWT_CACHE = join2(STATE_DIR, "jwt-token");
 var DEBUG_LOG = join2(STATE_DIR, "hook-debug.log");
 mkdirSync(STATE_DIR, { recursive: true });
+if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT === null) {
+  log(
+    "API-CLIENT",
+    `PROJECT_ROOT: no marker-verified ".orchestrator" project root found above ${process.cwd()} \u2014 falling back to isolated state dir ${STATE_DIR} (RF-003)`
+  );
+}
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
 var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
 var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";

package/hooks/pre-agent-dispatch.mjs

@@ -1,38 +1,68 @@
 import { createRequire as __createRequireShim } from 'node:module'; const require = __createRequireShim(import.meta.url);
 
 // hooks/pre-agent-dispatch.ts
-import { execFileSync } from "node:child_process";
+import { execFileSync as execFileSync2 } from "node:child_process";
 
 // hooks/lib/api-client.ts
 import { readFileSync, writeFileSync, mkdirSync, statSync, unlinkSync, readdirSync } from "node:fs";
-import { join as join2, dirname as dirname2 } from "node:path";
-import { fileURLToPath } from "node:url";
+import { join as join2 } from "node:path";
+import { tmpdir } from "node:os";
+import { createHash } from "node:crypto";
 
 // ../project-root-resolver/dist/index.js
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
+function hasProjectRootMarker(candidate, sentinel) {
+  return existsSync(join(candidate, ".git")) || existsSync(join(candidate, "package.json")) || existsSync(join(candidate, sentinel, ".root"));
+}
 function resolveProjectRoot(cwd, sentinel = ".orchestrator") {
+  const candidates = [];
   let currentDir = cwd;
   for (; ; ) {
     if (existsSync(join(currentDir, sentinel))) {
-      return currentDir;
+      candidates.push(currentDir);
     }
     const parentDir = dirname(currentDir);
     if (parentDir === currentDir) {
-      return null;
+      break;
     }
     currentDir = parentDir;
   }
+  const [innermost] = candidates;
+  if (innermost === void 0) {
+    return null;
+  }
+  for (const candidate of candidates) {
+    if (hasProjectRootMarker(candidate, sentinel)) {
+      return candidate;
+    }
+  }
+  return innermost;
 }
 
 // hooks/lib/api-client.ts
-var __filename = fileURLToPath(import.meta.url);
-var __dirname = dirname2(__filename);
-var PROJECT_ROOT = join2(__dirname, "..", "..", "..");
-var STATE_DIR = join2(PROJECT_ROOT, ".orchestrator", ".state");
+function resolveFallbackStateDir(cwd) {
+  const cwdHash = createHash("sha256").update(cwd).digest("hex").slice(0, 16);
+  return join2(tmpdir(), "orchestrator-hook-fallback", cwdHash);
+}
+var PROJECT_ROOT = (() => {
+  const resolved = resolveHookProjectRoot(process.cwd());
+  if (resolved !== null && hasProjectRootMarker(resolved, ".orchestrator")) {
+    return resolved;
+  }
+  return null;
+})();
+var STATE_DIR_OVERRIDE = process.env.ORCHESTRATOR_STATE_DIR;
+var STATE_DIR = STATE_DIR_OVERRIDE !== void 0 && STATE_DIR_OVERRIDE !== "" ? STATE_DIR_OVERRIDE : PROJECT_ROOT !== null ? join2(PROJECT_ROOT, ".orchestrator", ".state") : resolveFallbackStateDir(process.cwd());
 var JWT_CACHE = join2(STATE_DIR, "jwt-token");
 var DEBUG_LOG = join2(STATE_DIR, "hook-debug.log");
 mkdirSync(STATE_DIR, { recursive: true });
+if ((STATE_DIR_OVERRIDE === void 0 || STATE_DIR_OVERRIDE === "") && PROJECT_ROOT === null) {
+  log(
+    "API-CLIENT",
+    `PROJECT_ROOT: no marker-verified ".orchestrator" project root found above ${process.cwd()} \u2014 falling back to isolated state dir ${STATE_DIR} (RF-003)`
+  );
+}
 var API_URL = process.env.ORCHESTRATOR_API_URL || "http://localhost:3001";
 var AUTH_EMAIL = process.env.ORCHESTRATOR_ADMIN_EMAIL || process.env.ORCHESTRATOR_AUTH_EMAIL || "system@orchestrator.local";
 var AUTH_PASSWORD = process.env.ORCHESTRATOR_ADMIN_PASSWORD || process.env.ORCHESTRATOR_AUTH_PASSWORD || "system123";
@@ -73,6 +103,10 @@ async function ensureProjectIdResolved(token) {
     );
   }
 }
+function normalizeAgentName(subagentType) {
+  const i = subagentType.lastIndexOf(":");
+  return i === -1 ? subagentType : subagentType.slice(i + 1);
+}
 function log(prefix, msg) {
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d+Z$/, "Z");
   try {
@@ -211,6 +245,72 @@ function outputContext(hookEvent, context) {
   );
 }
 
+// hooks/lib/dispatch-marker.ts
+import { execFileSync } from "node:child_process";
+var DISPATCH_MARKER_REF_PREFIX = "refs/orchestrator/dispatch";
+var MAX_DISPATCH_MARKERS_PER_KEY = 20;
+var EMPTY_COMPONENT_PLACEHOLDER = "unknown";
+function sanitizeRefComponent(raw) {
+  const cleaned = (raw || "").replace(/[^A-Za-z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
+  return cleaned || EMPTY_COMPONENT_PLACEHOLDER;
+}
+function formatMarkerStamp(d) {
+  return d.toISOString().replace(/[-:.]/g, "");
+}
+function buildMarkerRefName(branch, agent, stamp) {
+  const branchPart = sanitizeRefComponent(branch);
+  const agentPart = sanitizeRefComponent(agent);
+  const stampPart = sanitizeRefComponent(stamp);
+  return `${DISPATCH_MARKER_REF_PREFIX}/${branchPart}/${stampPart}-${agentPart}`;
+}
+function runGitDefault(args) {
+  return execFileSync("git", args, {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+}
+function pruneOldestMarkers(prefix, cap, deps) {
+  const listed = deps.runGit(["for-each-ref", "--format=%(refname)", "--sort=refname", `${prefix}/`]).split("\n").map((l) => l.trim()).filter(Boolean);
+  const excess = listed.length - cap;
+  if (excess <= 0) return [];
+  const doomed = listed.slice(0, excess);
+  for (const ref of doomed) {
+    deps.runGit(["update-ref", "-d", ref]);
+  }
+  return doomed;
+}
+function writeDispatchBoundaryMarker(agentName, branch, deps) {
+  let ref = "";
+  try {
+    if (sanitizeRefComponent(agentName) === EMPTY_COMPONENT_PLACEHOLDER) {
+      return {
+        status: "failed",
+        reason: `refusing to write an unattributable marker (agent name "${agentName}")`
+      };
+    }
+    const sha = deps.runGit(["rev-parse", "HEAD"]).trim();
+    if (!/^[0-9a-f]{40}$/.test(sha)) {
+      return { status: "failed", reason: `HEAD did not resolve to a 40-hex sha (got "${sha}")` };
+    }
+    const stamp = formatMarkerStamp((deps.now ?? (() => /* @__PURE__ */ new Date()))());
+    ref = buildMarkerRefName(branch, agentName, stamp);
+    deps.runGit(["update-ref", ref, sha]);
+    let pruned = [];
+    try {
+      pruned = pruneOldestMarkers(
+        `${DISPATCH_MARKER_REF_PREFIX}/${sanitizeRefComponent(branch)}`,
+        MAX_DISPATCH_MARKERS_PER_KEY,
+        deps
+      );
+    } catch {
+      pruned = [];
+    }
+    return { status: "written", ref, sha, pruned };
+  } catch (err) {
+    return { status: "failed", reason: `${ref ? `ref="${ref}" ` : ""}${String(err)}` };
+  }
+}
+
 // hooks/pre-agent-dispatch.ts
 var HOOK = "PRE-AGENT-DISPATCH";
 var KNOWN_AGENTS = [
@@ -232,10 +332,6 @@ var COMMITTING_AGENTS = [
   "frontend-engineer"
 ];
 var PROTECTED_BRANCHES = ["main", "master"];
-function normalizeAgentName(subagentType) {
-  const i = subagentType.lastIndexOf(":");
-  return i === -1 ? subagentType : subagentType.slice(i + 1);
-}
 function isCommittingAgent(subagentType) {
   if (!subagentType) return false;
   const t = normalizeAgentName(subagentType).toLowerCase();
@@ -274,7 +370,7 @@ function evaluateDispatch(ctx) {
 }
 function readBranchFromGit() {
   try {
-    return execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    return execFileSync2("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
@@ -288,7 +384,8 @@ var defaultDeps = {
   log,
   readBranch: readBranchFromGit,
   getActiveWorkflow,
-  writeDispatchIntent
+  writeDispatchIntent,
+  writeDispatchMarker: (agentName, branch) => writeDispatchBoundaryMarker(agentName, branch, { runGit: runGitDefault })
 };
 var DISPATCH_INTENT_RESOLVE_TIMEOUT_MS = 3e3;
 async function stampDispatchIntent(deps) {
@@ -310,6 +407,29 @@ async function stampDispatchIntent(deps) {
     deps.log(HOOK, `[TD-205] stampDispatchIntent failed (fail-open): ${String(err)}`);
   }
 }
+function markDispatchBoundary(subagentType, branch, deps) {
+  if (!deps.writeDispatchMarker) return [];
+  if (!isCommittingAgent(subagentType)) return [];
+  try {
+    const outcome = deps.writeDispatchMarker(subagentType, branch);
+    if (outcome.status === "written") {
+      deps.log(HOOK, `[S445] boundary marker ${outcome.ref} -> ${outcome.sha}`);
+      if (outcome.pruned.length > 0) {
+        deps.log(HOOK, `[S445] pruned ${outcome.pruned.length} marker(s) over retention cap`);
+      }
+      return [];
+    }
+    deps.log(HOOK, `[S445] boundary marker FAILED: ${outcome.reason}`);
+    return [
+      `[BOUNDARY-MARKER][S445] Could not record the pre-dispatch git coordinate for '${subagentType}' on '${branch}': ${outcome.reason}. The dispatch proceeds (this never blocks), but there will be NO ref to 'git reset --hard' back to for this agent's work.`
+    ];
+  } catch (err) {
+    deps.log(HOOK, `[S445] boundary marker threw (fail-open): ${String(err)}`);
+    return [
+      `[BOUNDARY-MARKER][S445] Boundary-marker step threw for '${subagentType}': ${String(err)}. Dispatch proceeds; no rollback coordinate was recorded.`
+    ];
+  }
+}
 async function mainWithDeps(deps) {
   const stdin = await deps.readStdin();
   const toolInput = getField(stdin, "tool_input") || "";
@@ -317,6 +437,7 @@ async function mainWithDeps(deps) {
   const prompt = getField(stdin, "tool_input.prompt") || getField(stdin, "tool_input.description") || (typeof toolInput === "string" ? toolInput : JSON.stringify(toolInput));
   const branch = deps.readBranch();
   const warnings = evaluateDispatch({ subagentType, prompt, branch });
+  warnings.push(...markDispatchBoundary(subagentType, branch, deps));
   await stampDispatchIntent(deps);
   if (warnings.length > 0) {
     deps.outputContext(HOOK, warnings.join("\n"));
@@ -340,7 +461,7 @@ export {
   isCommittingAgent,
   isProtectedBranch,
   mainWithDeps,
-  normalizeAgentName,
+  markDispatchBoundary,
   parseBranchFromHead,
   stampDispatchIntent
 };