opencode-swarm 7.132.1 → 7.133.0

package/dist/consensus/contracts.d.ts

@@ -68,9 +68,9 @@ export declare const ConsensusMineRequestSchema: z.ZodObject<{
 declare const ConsensusProposedTargetSchema: z.ZodEnum<{
     tooling: "tooling";
     none: "none";
+    orchestration: "orchestration";
     prompt: "prompt";
     skill: "skill";
-    orchestration: "orchestration";
 }>;
 export type ConsensusProposedTarget = z.infer<typeof ConsensusProposedTargetSchema>;
 /**
@@ -151,9 +151,9 @@ export declare const ConsensusAttributeV1Schema: z.ZodObject<{
     proposedTarget: z.ZodEnum<{
         tooling: "tooling";
         none: "none";
+        orchestration: "orchestration";
         prompt: "prompt";
         skill: "skill";
-        orchestration: "orchestration";
     }>;
 }, z.core.$strict>;
 /**
@@ -390,9 +390,9 @@ export declare const ConsensusReportV1Schema: z.ZodObject<{
         proposedTarget: z.ZodEnum<{
             tooling: "tooling";
             none: "none";
+            orchestration: "orchestration";
             prompt: "prompt";
             skill: "skill";
-            orchestration: "orchestration";
         }>;
     }, z.core.$strict>>;
     proposals: z.ZodArray<z.ZodObject<{

package/dist/evaluation/contracts.d.ts

@@ -278,9 +278,9 @@ export declare const PromotionDecisionV1Schema: z.ZodObject<{
     runId: z.ZodString;
     decidedAt: z.ZodISODateTime;
     status: z.ZodEnum<{
+        reject: "reject";
         inconclusive: "inconclusive";
         accept: "accept";
-        reject: "reject";
     }>;
     reasons: z.ZodArray<z.ZodString>;
     baseline: z.ZodObject<{

package/dist/evaluation/ephemeral-agent-dispatcher.d.ts

@@ -0,0 +1,64 @@
+import type { OpencodeClient } from '@opencode-ai/sdk';
+import type { DelegationCostFields } from '../services/cost-accounting.js';
+import { log } from '../utils/logger.js';
+import type { ModelOverride } from '../utils/model-dispatch-fallback.js';
+export declare const DEFAULT_EPHEMERAL_TIMEOUT_MS = 120000;
+export declare const DEFAULT_EPHEMERAL_CLEANUP_TIMEOUT_MS = 500;
+export declare const DEFAULT_EPHEMERAL_PROMPT_BYTE_LIMIT: number;
+export declare const MAX_EPHEMERAL_PROMPT_BYTE_LIMIT: number;
+export declare const DEFAULT_EPHEMERAL_RESPONSE_BYTE_LIMIT: number;
+export type ReadOnlyToolDenials = Readonly<Record<string, false>>;
+/**
+ * Fail-closed tool policy for isolated review/evaluation agents.
+ *
+ * OpenCode merges this request map with the selected agent's configured tools,
+ * so omitting a registered plugin tool leaves it enabled. Deny every canonical
+ * plugin tool (including deceptively mutable tools such as lint and recursive
+ * tools such as swarm_command) plus built-in mutation/dispatch escape hatches.
+ * Upstream read-only discovery tools remain available.
+ */
+export declare const DEFAULT_READ_ONLY_TOOLS: ReadOnlyToolDenials;
+export type EphemeralAgentDispatchRequest = {
+    client: OpencodeClient;
+    directory: string;
+    parentSessionId?: string;
+    /** Already-resolved OpenCode agent name. Agent lookup belongs to the caller. */
+    agentName: string;
+    model?: ModelOverride;
+    /** Optional system prompt for this isolated session. */
+    system?: string;
+    prompt: string;
+    /** Explicit false-only tool map. The primitive never grants tools implicitly. */
+    readOnlyTools: ReadOnlyToolDenials;
+    title?: string;
+    timeoutMs: number;
+    cleanupTimeoutMs?: number;
+    promptByteLimit?: number;
+    responseByteLimit?: number;
+    abortSignal?: AbortSignal;
+};
+export type EphemeralAgentDispatchResult = {
+    status: 'completed' | 'timeout' | 'cancelled' | 'error';
+    agentName: string;
+    modelId?: string;
+    text: string;
+    error?: string;
+    durationMs: number;
+    promptBytes: number;
+    responseBytes: number;
+    costFields?: DelegationCostFields;
+};
+export declare function boundedDeleteEphemeralSession(client: OpencodeClient, sessionId: string, timeoutMs?: number): Promise<void>;
+export declare const _internals: {
+    boundedDelete: typeof boundedDeleteEphemeralSession;
+    log: typeof log;
+};
+/**
+ * Dispatch one read-only agent in a fresh, parent-bound session.
+ *
+ * This is deliberately policy-free: callers resolve the agent and model, provide
+ * the replacement system prompt, and own retry/fallback policy. The primitive
+ * owns only bounded session creation/prompting, transcript caps, accounting, and
+ * awaited best-effort cleanup.
+ */
+export declare function dispatchEphemeralAgent(request: EphemeralAgentDispatchRequest): Promise<EphemeralAgentDispatchResult>;

package/dist/evaluation/model-dispatcher.d.ts

@@ -1,5 +1,6 @@
 import type { Agent, OpencodeClient } from '@opencode-ai/sdk';
-import { log } from '../utils/logger.js';
+import type { DelegationCostFields } from '../services/cost-accounting.js';
+import { _internals as ephemeralDispatcherInternals } from './ephemeral-agent-dispatcher.js';
 export type EvaluationModelDispatchRequest = {
     directory: string;
     agentName: string;
@@ -18,13 +19,18 @@ export type EvaluationModelDispatchResult = {
     text: string;
     durationMs: number;
     error?: string;
+    promptBytes?: number;
+    responseBytes?: number;
+    costFields?: DelegationCostFields;
 };
 export type EvaluationModelDispatcher = (request: EvaluationModelDispatchRequest) => Promise<EvaluationModelDispatchResult>;
 export declare function resolveEvaluationAgentName(agents: readonly Pick<Agent, 'name'>[], logicalName: string, preferredSwarm?: string): string;
-declare function boundedDelete(client: OpencodeClient, sessionId: string, timeoutMs?: number): Promise<void>;
+/**
+ * Compatibility proxy for the existing evaluation test seam. The shared
+ * primitive remains the single owner of cleanup and logging behavior.
+ */
 export declare const _internals: {
-    boundedDelete: typeof boundedDelete;
-    log: typeof log;
+    boundedDelete: typeof ephemeralDispatcherInternals.boundedDelete;
+    log: typeof ephemeralDispatcherInternals.log;
 };
 export declare function createEvaluationModelDispatcher(client: OpencodeClient): EvaluationModelDispatcher;
-export {};

package/dist/evaluation/public-api.d.ts

@@ -31,7 +31,7 @@ export declare const evaluationV1: ((options: EvaluateCandidateV1Options) => Pro
         decisionId: string;
         runId: string;
         decidedAt: string;
-        status: "inconclusive" | "accept" | "reject";
+        status: "reject" | "inconclusive" | "accept";
         reasons: string[];
         baseline: {
             baselineRunId: string;

package/dist/hooks/auto-review.d.ts

@@ -1,90 +1,55 @@
 /**
- * Auto-review hook (auto-review machinery, piece B) — opt-in.
+ * Automatic task-completion review hook.
  *
- * When `auto_review.enabled` is true, completing a task
- * (`update_task_status` → status 'completed') and/or a phase
- * (`phase_complete`) automatically dispatches the registered reviewer agent
- * over a fresh ephemeral session to review the current execution diff —
- * the same "second model reviews the work in a clean context" pattern used
- * by Claude Code's auto-review and Codex's review model. The reviewer agent
- * carries its own configured model (`agents.reviewer.model`), so the review
- * model is independently configurable from the coder/architect models.
- *
- * The pass is ADVISORY and fully fail-open:
- *   - fire-and-forget from `tool.execute.after` (never blocks the tool)
- *   - verdicts are persisted as durable review receipts
- *     (`.swarm/review-receipts/`, scope-fingerprinted over the diff) and an
- *     `auto_review` event is appended to `.swarm/events.jsonl`
- *   - a REJECTED or unparseable verdict injects a `[AUTO-REVIEW]` advisory
- *     into the architect's next prompt; APPROVED stays silent
- *
- * Bounds (AGENTS.md invariants 3 and 8): the diff subprocess uses execFile
- * with cwd/timeout/maxBuffer and ignored stdin; dispatches are guarded by a
- * per-session in-flight set plus a 60s cooldown in a bounded FIFO map.
- *
- * #1896 / #1905: on a transient/quota dispatch error the reviewer fails over to
- * a configured `fallback_models` entry via the shared `dispatchWithModelFallback`
- * helper, instead of immediately writing a `verdict: 'error'` event (a quota
- * blip previously dropped the review pass with no recovery). The SDK error
- * envelope is preserved in the thrown message so the classifier sees the quota
- * token on the dominant SDK error shape.
+ * Phase/plan review is owned by the phase_complete tool body so it can await a
+ * durable artifact before the evidence-only gate runs. This hook therefore owns
+ * only task-completion review, remains fire-and-forget, and delegates every
+ * model/diff/persistence decision to the shared review engine.
  */
 import { type AutoReviewConfig } from '../config/schema.js';
-import { type ModelOverride } from '../utils/model-dispatch-fallback.js';
-/** Test-only: clear module-level dispatch tracking. */
-export declare function resetAutoReviewTracking(): void;
-export type ExecutionDiffResult = {
-    status: 'ok';
-    diff: string;
-} | {
-    status: 'clean';
-} | {
-    status: 'error';
-    reason: string;
-};
-/**
- * Collect the execution diff for review: `git diff HEAD` (tracked changes)
- * plus a porcelain summary of untracked files. Distinguishes a clean working
- * tree from collection failures (git missing, timeout, diff exceeding the
- * 2× maxBuffer cap) so events report honestly. Output is truncated to
- * `maxBytes`.
- */
-declare function computeExecutionDiff(directory: string, maxBytes: number): Promise<ExecutionDiffResult>;
-declare function dispatchReviewer(directory: string, prompt: string, agentName: string, timeoutMs: number, parentSessionId: string, model?: ModelOverride): Promise<string>;
+import type { ReviewModelDispatcher } from '../review/contracts.js';
+import { type ReviewEngineResult, runReviewEngine } from '../review/engine.js';
+import { type ReviewAgentModelRegistry } from '../review/runtime.js';
 export interface AutoReviewRunInput {
     directory: string;
     sessionID: string;
-    trigger: 'task_completion' | 'phase_boundary';
+    trigger: 'task_completion';
     taskId?: string;
-    phase?: number;
-    config: Required<Pick<AutoReviewConfig, 'timeout_ms' | 'max_diff_kb'>>;
+    config: AutoReviewConfig;
+    dispatcher?: ReviewModelDispatcher;
+    generatedAgentNames?: Iterable<string>;
+    activeAgentName?: string;
+    agentModelRegistry?: ReviewAgentModelRegistry;
     injectAdvisory: (sessionId: string, message: string) => void;
 }
-/**
- * Execute one auto-review pass: collect diff → dispatch reviewer over an
- * ephemeral session → persist receipt + event → advisory on REJECTED or
- * unparseable output. Fully fail-open; never throws.
- */
-export declare function runAutoReview(input: AutoReviewRunInput): Promise<void>;
+export declare function runAutoReview(input: AutoReviewRunInput): Promise<ReviewEngineResult | undefined>;
 export interface AutoReviewHookOptions {
     config: AutoReviewConfig;
     directory: string;
+    dispatcher?: ReviewModelDispatcher;
+    generatedAgentNames?: Iterable<string>;
+    agentModelRegistry?: ReviewAgentModelRegistry;
+    getActiveAgentName?: (sessionID: string) => string | undefined;
     injectAdvisory: (sessionId: string, message: string) => void;
 }
+export interface AutoReviewToolAfterContext {
+    /**
+     * Arguments recovered from the callID snapshot. The OpenCode SDK's
+     * `tool.execute.after` output does not carry the original tool arguments.
+     */
+    args: Record<string, unknown> | null;
+}
 export declare function createAutoReviewHook(options: AutoReviewHookOptions): {
     toolAfter: (input: {
         tool: string;
         sessionID: string;
         callID?: string;
-    }, output: {
-        args?: unknown;
-        output?: unknown;
-    }) => Promise<void>;
+    }, context: AutoReviewToolAfterContext) => Promise<void>;
+    /** Instance-local test/lifecycle seam; never affects another plugin instance. */
+    resetTracking: () => void;
 };
 export declare const _internals: {
-    computeExecutionDiff: typeof computeExecutionDiff;
-    dispatchReviewer: typeof dispatchReviewer;
+    runReviewEngine: typeof runReviewEngine;
     runAutoReview: typeof runAutoReview;
     now: () => number;
 };
-export {};

package/dist/hooks/delegation-gate.d.ts

@@ -268,7 +268,7 @@ interface MessageWithParts {
  * approval. Does not throw — returns `false` for any failure (fail-closed).
  */
 export declare function isPlanCriticApproved(directory: string): Promise<boolean>;
-declare function resolveDelegatedPlanTaskId(args: Record<string, unknown>, knownPlanTaskIds?: ReadonlySet<string>): string | null;
+export declare function resolveDelegatedPlanTaskId(args: Record<string, unknown>, knownPlanTaskIds?: ReadonlySet<string>): string | null;
 /**
  * Builds a cause-specific diagnostic for `prepareCoderScope`'s SCOPE_NOT_DECLARED
  * throw when `resolveDelegatedPlanTaskId` returns null. Re-runs extraction with

package/dist/hooks/guardrails/index.d.ts

@@ -19,6 +19,13 @@ export declare const _internals: {
     resolveFallbackModel: typeof resolveFallbackModel;
     dcCheckJunctionCreation: typeof dcCheckJunctionCreation;
     extractErrorSignal: typeof extractErrorSignal;
+    /**
+     * Test/inspection seams for the no-op detector's bounded session state
+     * (invariant 8). Production code does not call these; they exist so the
+     * eviction bound can be asserted without exporting the maps themselves.
+     */
+    noOpStateSize: () => number;
+    hasNoOpState: (sessionID: string) => boolean;
 };
 /**
  * Issue #853 Layer B: tools that are structurally blocked while
@@ -36,6 +43,31 @@ export declare function enforceSpecDriftGate(directory: string | undefined, tool
  * Extracts bounded provider/error signal from unknown hook error payloads.
  */
 declare function extractErrorSignal(errorContent: unknown): string;
+/**
+ * v6.33.1: No-op work detector state.
+ *
+ * AGENTS.md invariant 8: module-level, session-keyed state must have an explicit
+ * eviction strategy. Both containers below are keyed by `sessionID` and were
+ * previously unbounded — they grew for the lifetime of the plugin process, since
+ * nothing removed a key when a session ended. `noOpWarningIssued` was only ever
+ * `delete`d on a reset, and `toolCallsSinceLastWrite` never shrank at all.
+ *
+ * Bounded LRU, evicting the LEAST-RECENTLY-TOUCHED session.
+ *
+ * Plain insertion-order (FIFO) eviction is wrong here and actively harmful.
+ * `Map.set()` on an EXISTING key does not move it, so the first session created
+ * in the process stays permanently at the front of the iteration order. In an
+ * OpenCode plugin process that first session is the architect — the very session
+ * this detector exists to watch — making it the guaranteed first eviction victim
+ * while a session touched once and abandoned later survives. Measured: with a
+ * FIFO bound, an architect climbing toward the threshold had its counter evicted
+ * and reset mid-climb, and its 15th consecutive no-write call produced ZERO
+ * warnings. A bound must not silence the detector it was added to protect.
+ *
+ * {@link touchNoOpSession} therefore deletes before setting, moving the key to
+ * the back on every touch, so eviction genuinely targets quiet sessions.
+ */
+export declare const MAX_TRACKED_NO_OP_SESSIONS = 200;
 /**
  * Redacts sensitive values from a shell command string before audit logging.
  * Single-sourced from ./helpers (which additionally redacts home paths).

package/dist/hooks/guardrails/messages-transform.d.ts

@@ -32,6 +32,13 @@ type ChatMessageLike = {
         text?: unknown;
     }>;
 };
+/**
+ * Shared by the runaway-output advisory's TEXT and its once-per-drain dedupe
+ * predicate, so the two can never drift apart again. They previously did: the
+ * predicate tested for the string 'runaway output', which the pushed message
+ * never contained, making the guard permanently inert.
+ */
+export declare const RUNAWAY_OUTPUT_ADVISORY_MARKER = "Model is generating analysis without taking action";
 export declare function getMostRecentAssistantText(messages: ChatMessageLike[]): string;
 export declare function isTransientProviderFailureText(text: string): boolean;
 export declare function getProviderFailureFingerprint(text: string): string;

package/dist/hooks/guardrails/tool-before.d.ts

@@ -37,6 +37,14 @@ export interface ToolBeforeContext {
      * trusted roots when exempting `git worktree remove --force` (issue #1708).
      */
     worktreeBaseDirOverrides?: string[];
+    /** Hold exact child-write provenance until the matching after-hook succeeds. */
+    rememberReviewerScopeWrite?: (input: {
+        callID: string;
+        parentSessionID: string;
+        taskId: string;
+        coderCallID: string;
+        file: string;
+    }) => void;
 }
 /**
  * Creates a toolBefore handler with the given shared context.

package/dist/hooks/guardrails.d.ts

@@ -10,5 +10,5 @@
  * - Layer 2 (Hard Block @ 100%): Throws error in toolBefore to block further calls, injects STOP message
  */
 export { type AgentRule, type AttestationRecord, buildEffectiveRules, checkFileAuthority, checkFileAuthorityWithRules, checkWriteTargetForSymlink, clearGuardrailsCaches, DEFAULT_AGENT_AUTHORITY_RULES, getGlobMatcher, hashArgs, isOnDifferentFilesystemRoot, normalizePathWithCache, recordAttestation, validateAndRecordAttestation, validateAttestation, } from './guardrails/file-authority';
-export { _internals, createGuardrailsHooks, enforceSpecDriftGate, redactShellCommand, SPEC_DRIFT_BLOCKED_TOOLS, } from './guardrails/index';
+export { _internals, createGuardrailsHooks, enforceSpecDriftGate, MAX_TRACKED_NO_OP_SESSIONS, redactShellCommand, SPEC_DRIFT_BLOCKED_TOOLS, } from './guardrails/index';
 export { deleteStoredInputArgs, getStoredInputArgs, setStoredInputArgs, } from './guardrails/stored-input-args';

package/dist/hooks/pr-workflow-response-gate.d.ts

@@ -26,26 +26,38 @@ export declare const DEFAULT_MAX_CONSECUTIVE_UNPRODUCTIVE_WAKES = 5;
  */
 export declare const DEFAULT_WAKE_COOLDOWN_MS = 30000;
 /**
- * Minimum time between FULL workflow banners prepended to a single session's
- * completed text parts. The textComplete hook prepends a banner to every
- * architect text part while the durable gate exists; without a cooldown a
- * burst of reasoning parts repeats the full multi-line banner many times
- * (field report: ~8 repeats between two model thoughts). Within the cooldown a
- * short one-line marker is prepended instead; the full banner (and its
- * suspension/interruption recovery notices) returns once the cooldown elapses.
+ * Minimum time between FULL workflow banners for a single session. The banner
+ * is injected at most once per assistant MESSAGE (see the `banneredMessages`
+ * map in {@link createPrWorkflowResponseGate}); this cooldown only chooses
+ * whether that one injection is the full multi-line banner or the short
+ * one-line marker.
  *
- * The input event exposes only `{ sessionID }` — there is NO message/part ID —
- * so this dedupe is necessarily a per-session cooldown, not a per-message one.
- *
- * Suspended and user-interrupted states BYPASS the cooldown entirely: those are
- * invariant-10 operational notices that must appear in full on every part.
+ * Suspended and user-interrupted states BYPASS the cooldown: those are
+ * invariant-10 operational notices that must not be downgraded to the short
+ * marker. They are still subject to the per-message dedupe — "always visible"
+ * means visible on every user-facing turn, not repeated on every part of it.
  * Overridable via `createPrWorkflowResponseGate({ bannerCooldownMs })`.
  */
 export declare const DEFAULT_BANNER_COOLDOWN_MS = 20000;
+/**
+ * Absolute per-session injection ceiling used ONLY when the host does not
+ * supply `messageID`. The pinned host contract
+ * (`@opencode-ai/plugin` `index.d.ts`: `experimental.text.complete` receives
+ * `{ sessionID, messageID, partID }`, all required) always supplies it, so this
+ * path is defensive. Without a ceiling, a host that omitted `messageID` would
+ * fall back to the wall-clock window alone — which is exactly the behavior that
+ * produced the measured flood (968 marker-only lines, 55.3% of a real review
+ * transcript), because a cooldown only downgrades an injection, it never
+ * suppresses one.
+ */
+export declare const MAX_FALLBACK_BANNER_INJECTIONS_PER_SESSION = 20;
 /**
  * Bounded FIFO map of tracked wake budgets. Invariant 8 (session/global
- * state): module-level state must have an explicit eviction strategy. The
- * banner-stamp map (last full-banner instant per session) shares this bound.
+ * state): module-level state must have an explicit eviction strategy. Three
+ * further per-session maps share this same bound and the same FIFO discipline:
+ * `bannerStamps` (instant of the last full banner), `banneredMessages` (the
+ * assistant message already carrying a banner), and `fallbackInjections` (the
+ * injection count on the messageID-less path).
  */
 export declare const MAX_TRACKED_WAKE_SESSIONS = 200;
 interface PrWorkflowResponseGateClient {
@@ -59,19 +71,23 @@ interface WakeBudget {
 }
 /**
  * Prevent an architect from masquerading a premature text output as a terminal
- * verdict. The text-complete hook prepends a workflow-active banner to
- * architect-session text parts while the durable gate exists; the model's
- * original text is preserved below the banner. To avoid spamming the full
- * multi-line banner across a burst of reasoning parts, the full banner is
- * throttled per session (see DEFAULT_BANNER_COOLDOWN_MS) — within the cooldown a
- * short one-line marker is prepended instead. session.idle then mechanically
- * resumes that session.
+ * verdict. The text-complete hook prepends a workflow-active banner to the
+ * FIRST substantive text part of each architect message while the durable gate
+ * exists; the model's original text is preserved below the banner.
+ *
+ * Injection is bounded on three independent axes, because a banner that is
+ * merely throttled is still injected on every part:
+ *   1. blank parts are never decorated (a banner labelling no content is noise);
+ *   2. a part that already opens with a banner is never re-decorated;
+ *   3. at most ONE injection per assistant `messageID`.
+ * The wall-clock cooldown (see DEFAULT_BANNER_COOLDOWN_MS) then only chooses
+ * whether that single injection is the full banner or the short marker.
  *
- * The resume loop is bounded (see DEFAULT_MAX_CONSECUTIVE_UNPRODUCTIVE_WAKES)
- * so a session that cannot make progress suspends instead of spinning
- * forever. Suspended and user-interrupted parts bypass the cooldown and always
- * carry the full suspension/interruption recovery notices so the user-visible
- * surface always names the recovery path.
+ * session.idle mechanically resumes a gated session. The resume loop is bounded
+ * (see DEFAULT_MAX_CONSECUTIVE_UNPRODUCTIVE_WAKES) so a session that cannot make
+ * progress suspends instead of spinning forever. Suspended and user-interrupted
+ * messages bypass the cooldown so their recovery notices are never downgraded to
+ * the short marker.
  */
 export declare function createPrWorkflowResponseGate(options: {
     directory: string;
@@ -86,6 +102,8 @@ export declare function createPrWorkflowResponseGate(options: {
     }) => Promise<void>;
     textComplete: (input: {
         sessionID?: string;
+        messageID?: string;
+        partID?: string;
     }, output: {
         text: string;
     }) => Promise<void>;

package/dist/hooks/review-receipt-collector.d.ts

@@ -4,8 +4,8 @@
  * Parses the mandated reviewer OUTPUT FORMAT (`VERDICT:` / `RISK:` /
  * `ISSUES:` / `FIXES:`) from a returning reviewer Task delegation and
  * persists it as a durable review receipt under `.swarm/review-receipts/`
- * via the existing receipt store (scope-fingerprinted over the delegation
- * prompt, which defines the reviewed scope).
+ * via the existing receipt store. Scope is derived from guardrails-observed
+ * modified files and their current content, never architect-authored prose.
  *
  * Before this collector, reviewer verdicts existed only as free text inside
  * the architect's context — re-reviews and drift verification had no durable
@@ -15,7 +15,14 @@
  *
  * Fail-open: parsing or persistence failures never block tool execution.
  */
-export type ParsedReviewSeverity = 'critical' | 'high' | 'medium';
+import { type ReviewFinding } from '../agents/agent-output-schema.js';
+import { type AutoReviewConfig } from '../config/schema.js';
+import type { ReviewModelDispatcher } from '../review/contracts.js';
+import { type FindingValidationScheduler } from '../review/finding-validator.js';
+import { type ReviewAgentModelRegistry } from '../review/runtime.js';
+import { persistReviewReceipt, type ReviewFindingSeverity, updateReviewReceiptValidations } from './review-receipt.js';
+import { buildReviewerTaskScope, resolveReviewerTaskScope } from './review-receipt-scope.js';
+export type ParsedReviewSeverity = ReviewFindingSeverity;
 export interface ParsedReviewIssue {
     /** Raw issue line (trimmed, bullet stripped) */
     text: string;
@@ -23,6 +30,8 @@ export interface ParsedReviewIssue {
     severity: ParsedReviewSeverity;
     /** `path:line` reference when one appears in the line */
     location?: string;
+    /** Machine-readable source finding, when structured output parsed. */
+    finding?: ReviewFinding;
 }
 export interface ParsedReviewerOutput {
     verdict: 'approved' | 'rejected';
@@ -32,30 +41,64 @@ export interface ParsedReviewerOutput {
     issues: ParsedReviewIssue[];
     /** Required-change lines from the FIXES section */
     fixes: string[];
+    outputMode: 'structured' | 'legacy';
+    overallConfidence?: number;
+    structuredFindings?: ReviewFinding[];
 }
 /**
  * Parse the reviewer agent's mandated output block. Returns null when no
- * unambiguous line-anchored `VERDICT: APPROVED|REJECTED` is present —
- * including when multiple anchored verdict lines DISAGREE (ambiguous output
- * fails toward "no machine-readable verdict", never toward approval).
+ * single unambiguous line-anchored `VERDICT: APPROVED|REJECTED` is present,
+ * including missing, duplicate, or contradictory verdict lines. A structured
+ * verdict must match that single legacy line so ambiguous output fails toward
+ * "no machine-readable verdict", never toward approval.
  */
-export declare function parseReviewerOutput(text: string): ParsedReviewerOutput | null;
+export declare function parseReviewerOutput(text: string, options?: {
+    structured?: boolean;
+}): ParsedReviewerOutput | null;
 export interface ReviewerReceiptInput {
     tool: unknown;
     args?: unknown;
     sessionID?: unknown;
+    callID?: unknown;
 }
 export interface ReviewerReceiptOutput {
     output?: unknown;
+    state?: unknown;
+    status?: unknown;
+    error?: unknown;
+    errors?: unknown;
+    metadata?: unknown;
+    result?: unknown;
 }
 export interface ReviewerReceiptTranscriptInput {
     targetAgent?: string;
-    prompt: string;
+    prompt?: string;
     transcript: string;
     sessionID?: string;
     sessionId?: string;
+    taskId?: string;
+    reviewerCallID?: string;
+    /** Production collectors consume the exact claimed coder generation. */
+    consumeHandoff?: boolean;
 }
-export declare function collectReviewerReceiptFromTranscript(directory: string, input: ReviewerReceiptTranscriptInput): Promise<string | null>;
+export interface ReviewerReceiptValidationOptions {
+    dispatcher?: ReviewModelDispatcher;
+    config?: AutoReviewConfig;
+    generatedAgentNames?: Iterable<string>;
+    agentModelRegistry?: ReviewAgentModelRegistry;
+    injectAdvisory?: (sessionID: string, message: string) => void;
+    /** Shared only within the owning plugin instance. */
+    validationScheduler?: FindingValidationScheduler;
+}
+/** Test seam for the otherwise process-global telemetry sink. */
+export declare const _internals: {
+    delegationEnd: (sessionId: string, agentName: string, taskId: string, result: string, costFields?: Partial<import("../services/cost-accounting.js").DelegationCostFields>) => void;
+    resolveReviewerTaskScope: typeof resolveReviewerTaskScope;
+    buildReviewerTaskScope: typeof buildReviewerTaskScope;
+    persistReviewReceipt: typeof persistReviewReceipt;
+    updateReviewReceiptValidations: typeof updateReviewReceiptValidations;
+};
+export declare function collectReviewerReceiptFromTranscript(directory: string, input: ReviewerReceiptTranscriptInput, validationOptions?: ReviewerReceiptValidationOptions): Promise<string | null>;
 /**
  * `tool.execute.after` collector. When a reviewer Task returns, parse its
  * verdict block and persist a durable review receipt. No-op for non-reviewer
@@ -63,4 +106,4 @@ export declare function collectReviewerReceiptFromTranscript(directory: string,
  *
  * Returns the persisted receipt path (for tests/telemetry) or null.
  */
-export declare function collectReviewerReceiptAfter(directory: string, input: ReviewerReceiptInput, output: ReviewerReceiptOutput): Promise<string | null>;
+export declare function collectReviewerReceiptAfter(directory: string, input: ReviewerReceiptInput, output: ReviewerReceiptOutput, validationOptions?: ReviewerReceiptValidationOptions): Promise<string | null>;