opencode-swarm 7.132.2 → 7.134.0

package/dist/consensus/contracts.d.ts

@@ -68,9 +68,9 @@ export declare const ConsensusMineRequestSchema: z.ZodObject<{
 declare const ConsensusProposedTargetSchema: z.ZodEnum<{
     tooling: "tooling";
     none: "none";
+    orchestration: "orchestration";
     prompt: "prompt";
     skill: "skill";
-    orchestration: "orchestration";
 }>;
 export type ConsensusProposedTarget = z.infer<typeof ConsensusProposedTargetSchema>;
 /**
@@ -151,9 +151,9 @@ export declare const ConsensusAttributeV1Schema: z.ZodObject<{
     proposedTarget: z.ZodEnum<{
         tooling: "tooling";
         none: "none";
+        orchestration: "orchestration";
         prompt: "prompt";
         skill: "skill";
-        orchestration: "orchestration";
     }>;
 }, z.core.$strict>;
 /**
@@ -390,9 +390,9 @@ export declare const ConsensusReportV1Schema: z.ZodObject<{
         proposedTarget: z.ZodEnum<{
             tooling: "tooling";
             none: "none";
+            orchestration: "orchestration";
             prompt: "prompt";
             skill: "skill";
-            orchestration: "orchestration";
         }>;
     }, z.core.$strict>>;
     proposals: z.ZodArray<z.ZodObject<{

package/dist/evaluation/ephemeral-agent-dispatcher.d.ts

@@ -0,0 +1,64 @@
+import type { OpencodeClient } from '@opencode-ai/sdk';
+import type { DelegationCostFields } from '../services/cost-accounting.js';
+import { log } from '../utils/logger.js';
+import type { ModelOverride } from '../utils/model-dispatch-fallback.js';
+export declare const DEFAULT_EPHEMERAL_TIMEOUT_MS = 120000;
+export declare const DEFAULT_EPHEMERAL_CLEANUP_TIMEOUT_MS = 500;
+export declare const DEFAULT_EPHEMERAL_PROMPT_BYTE_LIMIT: number;
+export declare const MAX_EPHEMERAL_PROMPT_BYTE_LIMIT: number;
+export declare const DEFAULT_EPHEMERAL_RESPONSE_BYTE_LIMIT: number;
+export type ReadOnlyToolDenials = Readonly<Record<string, false>>;
+/**
+ * Fail-closed tool policy for isolated review/evaluation agents.
+ *
+ * OpenCode merges this request map with the selected agent's configured tools,
+ * so omitting a registered plugin tool leaves it enabled. Deny every canonical
+ * plugin tool (including deceptively mutable tools such as lint and recursive
+ * tools such as swarm_command) plus built-in mutation/dispatch escape hatches.
+ * Upstream read-only discovery tools remain available.
+ */
+export declare const DEFAULT_READ_ONLY_TOOLS: ReadOnlyToolDenials;
+export type EphemeralAgentDispatchRequest = {
+    client: OpencodeClient;
+    directory: string;
+    parentSessionId?: string;
+    /** Already-resolved OpenCode agent name. Agent lookup belongs to the caller. */
+    agentName: string;
+    model?: ModelOverride;
+    /** Optional system prompt for this isolated session. */
+    system?: string;
+    prompt: string;
+    /** Explicit false-only tool map. The primitive never grants tools implicitly. */
+    readOnlyTools: ReadOnlyToolDenials;
+    title?: string;
+    timeoutMs: number;
+    cleanupTimeoutMs?: number;
+    promptByteLimit?: number;
+    responseByteLimit?: number;
+    abortSignal?: AbortSignal;
+};
+export type EphemeralAgentDispatchResult = {
+    status: 'completed' | 'timeout' | 'cancelled' | 'error';
+    agentName: string;
+    modelId?: string;
+    text: string;
+    error?: string;
+    durationMs: number;
+    promptBytes: number;
+    responseBytes: number;
+    costFields?: DelegationCostFields;
+};
+export declare function boundedDeleteEphemeralSession(client: OpencodeClient, sessionId: string, timeoutMs?: number): Promise<void>;
+export declare const _internals: {
+    boundedDelete: typeof boundedDeleteEphemeralSession;
+    log: typeof log;
+};
+/**
+ * Dispatch one read-only agent in a fresh, parent-bound session.
+ *
+ * This is deliberately policy-free: callers resolve the agent and model, provide
+ * the replacement system prompt, and own retry/fallback policy. The primitive
+ * owns only bounded session creation/prompting, transcript caps, accounting, and
+ * awaited best-effort cleanup.
+ */
+export declare function dispatchEphemeralAgent(request: EphemeralAgentDispatchRequest): Promise<EphemeralAgentDispatchResult>;

package/dist/evaluation/model-dispatcher.d.ts

@@ -1,5 +1,6 @@
 import type { Agent, OpencodeClient } from '@opencode-ai/sdk';
-import { log } from '../utils/logger.js';
+import type { DelegationCostFields } from '../services/cost-accounting.js';
+import { _internals as ephemeralDispatcherInternals } from './ephemeral-agent-dispatcher.js';
 export type EvaluationModelDispatchRequest = {
     directory: string;
     agentName: string;
@@ -18,13 +19,18 @@ export type EvaluationModelDispatchResult = {
     text: string;
     durationMs: number;
     error?: string;
+    promptBytes?: number;
+    responseBytes?: number;
+    costFields?: DelegationCostFields;
 };
 export type EvaluationModelDispatcher = (request: EvaluationModelDispatchRequest) => Promise<EvaluationModelDispatchResult>;
 export declare function resolveEvaluationAgentName(agents: readonly Pick<Agent, 'name'>[], logicalName: string, preferredSwarm?: string): string;
-declare function boundedDelete(client: OpencodeClient, sessionId: string, timeoutMs?: number): Promise<void>;
+/**
+ * Compatibility proxy for the existing evaluation test seam. The shared
+ * primitive remains the single owner of cleanup and logging behavior.
+ */
 export declare const _internals: {
-    boundedDelete: typeof boundedDelete;
-    log: typeof log;
+    boundedDelete: typeof ephemeralDispatcherInternals.boundedDelete;
+    log: typeof ephemeralDispatcherInternals.log;
 };
 export declare function createEvaluationModelDispatcher(client: OpencodeClient): EvaluationModelDispatcher;
-export {};

package/dist/hooks/auto-review.d.ts

@@ -1,90 +1,55 @@
 /**
- * Auto-review hook (auto-review machinery, piece B) — opt-in.
+ * Automatic task-completion review hook.
  *
- * When `auto_review.enabled` is true, completing a task
- * (`update_task_status` → status 'completed') and/or a phase
- * (`phase_complete`) automatically dispatches the registered reviewer agent
- * over a fresh ephemeral session to review the current execution diff —
- * the same "second model reviews the work in a clean context" pattern used
- * by Claude Code's auto-review and Codex's review model. The reviewer agent
- * carries its own configured model (`agents.reviewer.model`), so the review
- * model is independently configurable from the coder/architect models.
- *
- * The pass is ADVISORY and fully fail-open:
- *   - fire-and-forget from `tool.execute.after` (never blocks the tool)
- *   - verdicts are persisted as durable review receipts
- *     (`.swarm/review-receipts/`, scope-fingerprinted over the diff) and an
- *     `auto_review` event is appended to `.swarm/events.jsonl`
- *   - a REJECTED or unparseable verdict injects a `[AUTO-REVIEW]` advisory
- *     into the architect's next prompt; APPROVED stays silent
- *
- * Bounds (AGENTS.md invariants 3 and 8): the diff subprocess uses execFile
- * with cwd/timeout/maxBuffer and ignored stdin; dispatches are guarded by a
- * per-session in-flight set plus a 60s cooldown in a bounded FIFO map.
- *
- * #1896 / #1905: on a transient/quota dispatch error the reviewer fails over to
- * a configured `fallback_models` entry via the shared `dispatchWithModelFallback`
- * helper, instead of immediately writing a `verdict: 'error'` event (a quota
- * blip previously dropped the review pass with no recovery). The SDK error
- * envelope is preserved in the thrown message so the classifier sees the quota
- * token on the dominant SDK error shape.
+ * Phase/plan review is owned by the phase_complete tool body so it can await a
+ * durable artifact before the evidence-only gate runs. This hook therefore owns
+ * only task-completion review, remains fire-and-forget, and delegates every
+ * model/diff/persistence decision to the shared review engine.
  */
 import { type AutoReviewConfig } from '../config/schema.js';
-import { type ModelOverride } from '../utils/model-dispatch-fallback.js';
-/** Test-only: clear module-level dispatch tracking. */
-export declare function resetAutoReviewTracking(): void;
-export type ExecutionDiffResult = {
-    status: 'ok';
-    diff: string;
-} | {
-    status: 'clean';
-} | {
-    status: 'error';
-    reason: string;
-};
-/**
- * Collect the execution diff for review: `git diff HEAD` (tracked changes)
- * plus a porcelain summary of untracked files. Distinguishes a clean working
- * tree from collection failures (git missing, timeout, diff exceeding the
- * 2× maxBuffer cap) so events report honestly. Output is truncated to
- * `maxBytes`.
- */
-declare function computeExecutionDiff(directory: string, maxBytes: number): Promise<ExecutionDiffResult>;
-declare function dispatchReviewer(directory: string, prompt: string, agentName: string, timeoutMs: number, parentSessionId: string, model?: ModelOverride): Promise<string>;
+import type { ReviewModelDispatcher } from '../review/contracts.js';
+import { type ReviewEngineResult, runReviewEngine } from '../review/engine.js';
+import { type ReviewAgentModelRegistry } from '../review/runtime.js';
 export interface AutoReviewRunInput {
     directory: string;
     sessionID: string;
-    trigger: 'task_completion' | 'phase_boundary';
+    trigger: 'task_completion';
     taskId?: string;
-    phase?: number;
-    config: Required<Pick<AutoReviewConfig, 'timeout_ms' | 'max_diff_kb'>>;
+    config: AutoReviewConfig;
+    dispatcher?: ReviewModelDispatcher;
+    generatedAgentNames?: Iterable<string>;
+    activeAgentName?: string;
+    agentModelRegistry?: ReviewAgentModelRegistry;
     injectAdvisory: (sessionId: string, message: string) => void;
 }
-/**
- * Execute one auto-review pass: collect diff → dispatch reviewer over an
- * ephemeral session → persist receipt + event → advisory on REJECTED or
- * unparseable output. Fully fail-open; never throws.
- */
-export declare function runAutoReview(input: AutoReviewRunInput): Promise<void>;
+export declare function runAutoReview(input: AutoReviewRunInput): Promise<ReviewEngineResult | undefined>;
 export interface AutoReviewHookOptions {
     config: AutoReviewConfig;
     directory: string;
+    dispatcher?: ReviewModelDispatcher;
+    generatedAgentNames?: Iterable<string>;
+    agentModelRegistry?: ReviewAgentModelRegistry;
+    getActiveAgentName?: (sessionID: string) => string | undefined;
     injectAdvisory: (sessionId: string, message: string) => void;
 }
+export interface AutoReviewToolAfterContext {
+    /**
+     * Arguments recovered from the callID snapshot. The OpenCode SDK's
+     * `tool.execute.after` output does not carry the original tool arguments.
+     */
+    args: Record<string, unknown> | null;
+}
 export declare function createAutoReviewHook(options: AutoReviewHookOptions): {
     toolAfter: (input: {
         tool: string;
         sessionID: string;
         callID?: string;
-    }, output: {
-        args?: unknown;
-        output?: unknown;
-    }) => Promise<void>;
+    }, context: AutoReviewToolAfterContext) => Promise<void>;
+    /** Instance-local test/lifecycle seam; never affects another plugin instance. */
+    resetTracking: () => void;
 };
 export declare const _internals: {
-    computeExecutionDiff: typeof computeExecutionDiff;
-    dispatchReviewer: typeof dispatchReviewer;
+    runReviewEngine: typeof runReviewEngine;
     runAutoReview: typeof runAutoReview;
     now: () => number;
 };
-export {};

package/dist/hooks/delegation-gate/worktree-collision-ownership.d.ts

@@ -0,0 +1,28 @@
+export interface StandardWorktreeCollisionIdentity {
+    directory: string;
+    parentSessionId: string;
+    taskId: string;
+    branchName: string;
+    worktreePath: string;
+}
+export type StandardWorktreeCollisionOwnership = {
+    status: 'unowned';
+} | {
+    status: 'protected';
+    ownerKind: 'primary' | 'fallback' | 'provisioning' | 'ownership-tag' | 'merge-status';
+    lifecycle: 'active' | 'preserved';
+    reason: string;
+} | {
+    status: 'uncertain';
+    reason: string;
+};
+/**
+ * Strict restart-time ownership classification for one exact same-session
+ * collision. Scanner order is part of the safety contract:
+ *
+ * provisioning -> fallback -> primary -> ownership tag -> merge status
+ *
+ * Fallback precedes primary because promotion publishes primary before removing
+ * fallback; this ordering cannot observe ownership absent from both stores.
+ */
+export declare function inspectStandardWorktreeCollisionOwnership(identity: StandardWorktreeCollisionIdentity): Promise<StandardWorktreeCollisionOwnership>;

package/dist/hooks/delegation-gate/worktree-isolation.d.ts

@@ -9,9 +9,12 @@
  * The _internals seam allows test injection of worktree operations.
  */
 import type { PluginConfig, WorktreeIsolationConfig } from '../../config';
+import { tryAcquireLock } from '../../parallel/file-locks';
 import { bunSpawn } from '../../utils/bun-compat';
 import type { WorktreeHandle } from '../../worktree';
 import { attemptMergeBackFromDirty, cleanupOrphanedBranches, postMergeCleanup, provisionWorktree, removeWorktree, startupOrphanRecovery } from '../../worktree';
+import type { DirtyMergeOptions, MergeOperationProvenance } from '../../worktree/merge';
+import { recordWorktreeProvisioningOwner, removeWorktreeProvisioningOwner } from './worktree-provisioning-owner';
 /**
  * FR-201: Per-lane runtime profile injected into spawned child processes.
  *
@@ -62,6 +65,37 @@ export interface StandardWorktreeDispatch {
     /** Configured worktree-dir override, so cleanup trusts the same base. */
     worktree_dir?: string;
 }
+export interface StandardWorktreeSettlementOptions extends Pick<DirtyMergeOptions, 'operationId' | 'resume' | 'onBeforeMerge'> {
+    /**
+     * Awaited after Git reports success (including reconciled success) and before
+     * destructive worktree/branch cleanup. A rejection preserves the lane.
+     */
+    onMerged?: (result: StandardWorktreeMergedSettlement) => Promise<void>;
+}
+export interface StandardWorktreeMergedSettlement {
+    outcome: 'merged';
+    strategy: string;
+    autoCommitted: boolean;
+    cleaned: boolean;
+    reconciled: boolean;
+    provenance?: MergeOperationProvenance;
+}
+export interface StandardWorktreePartialSettlement {
+    outcome: 'partial';
+    stage: string;
+    message: string;
+    autoCommitted: boolean;
+    cleaned: boolean;
+    conflictFiles?: string[];
+    provenance?: MergeOperationProvenance;
+}
+export interface StandardWorktreeFailedSettlement {
+    outcome: 'failed';
+    stage: string;
+    message: string;
+    provenance?: MergeOperationProvenance;
+}
+export type StandardWorktreeSettlementResult = StandardWorktreeMergedSettlement | StandardWorktreePartialSettlement | StandardWorktreeFailedSettlement;
 export interface AwaitingMergeRecord {
     callID: string;
     parentSessionID: string;
@@ -130,6 +164,7 @@ export declare function preProvisionCollisionCheck(taskId: string, directory: st
     existingBranch?: string;
     ownerSessionId?: string;
     worktreePath?: string;
+    uncertainty?: string;
 }>;
 /**
  * FR-001b SC-005: Returns true when `branchName`'s embedded session ID matches
@@ -140,6 +175,13 @@ export declare function preProvisionCollisionCheck(taskId: string, directory: st
  * patterns.
  */
 export declare function isLaneOwnedByCurrentSession(branchName: string, expectedSessionId: string): boolean;
+declare function inspectStandardWorktreeCollisionOwnership(identity: {
+    directory: string;
+    parentSessionId: string;
+    taskId: string;
+    branchName: string;
+    worktreePath: string;
+}): Promise<import("./worktree-collision-ownership").StandardWorktreeCollisionOwnership>;
 export declare function precreateStandardWorktreeSession(args: {
     config: PluginConfig;
     directory: string;
@@ -155,6 +197,19 @@ export declare function precreateStandardWorktreeSession(args: {
         files: string[];
     };
 }): Promise<void>;
+/**
+ * Create a durable ownership tag without touching an in-flight background
+ * coder's index or working tree. This is used only when both correlation
+ * stores fail after launch: committing dirty files at that point could race
+ * the still-running child, while a tag plus the durable merge-status record
+ * makes restart cleanup fail closed.
+ */
+export declare function preserveBackgroundWorktreeOwnershipForCallId(callID: string): Promise<{
+    outcome: 'preserved' | 'preserve-failed' | 'not-found';
+    tag?: string;
+    ref?: string;
+    error?: string;
+}>;
 /**
  * FR-001c: Preserves dirty work in a worktree before cleanup on denial or cancellation.
  *
@@ -223,7 +278,7 @@ export declare function finishStandardWorktreeDispatch(directory: string, dispat
  * derived from dispatch.callID (for backward compatibility with test callers
  * that pass StandardWorktreeDispatch objects directly).
  */
-callID?: string): Promise<void>;
+callID?: string, settlement?: StandardWorktreeSettlementOptions): Promise<StandardWorktreeSettlementResult>;
 /**
  * FR-201: Read and parse a lane runtime profile from disk.
  *
@@ -264,6 +319,11 @@ export declare const _internals: {
     cleanupStandardWorktreeForCallId: typeof cleanupStandardWorktreeForCallId;
     /** FR-001c: preserves dirty worktree state before cleanup on denial/cancellation. */
     preserveDirtyWorktreeForCallId: typeof preserveDirtyWorktreeForCallId;
+    /** Background launch durability fallback: tag ownership without racing the child. */
+    preserveBackgroundWorktreeOwnershipForCallId: typeof preserveBackgroundWorktreeOwnershipForCallId;
+    tryAcquireWorktreeLifecycleLock: typeof tryAcquireLock;
+    recordWorktreeProvisioningOwner: typeof recordWorktreeProvisioningOwner;
+    removeWorktreeProvisioningOwner: typeof removeWorktreeProvisioningOwner;
     /** FR-001b SC-004: path-based dirty worktree preservation for stale-lane fallback. */
     preserveDirtyWorktreeAtPath: typeof preserveDirtyWorktreeAtPath;
     /** FR-001a: abort entry point for in-flight dispatches. */
@@ -271,6 +331,8 @@ export declare const _internals: {
     standardWorktreeByCallID: Map<string, StandardWorktreeDispatch>;
     /** FR-001b SC-004: pre-provision collision check. */
     preProvisionCollisionCheck: typeof preProvisionCollisionCheck;
+    /** Restart-safe durable owner classification for a colliding lane. */
+    inspectStandardWorktreeCollisionOwnership: typeof inspectStandardWorktreeCollisionOwnership;
     /** FR-001b SC-005: lane ownership validation. */
     isLaneOwnedByCurrentSession: typeof isLaneOwnedByCurrentSession;
     /** FR-001b: bunSpawn — exposed for test injection so collision check can be mocked. */

package/dist/hooks/delegation-gate/worktree-merge-status.d.ts

@@ -43,6 +43,13 @@ export interface WorktreeMergeFailure {
     /** Timestamp (Date.now()) when merge-back completed (success or failure). */
     completedAt?: number;
 }
+export type WorktreeMergeRecoveryScanResult = {
+    status: 'ok';
+    failures: Array<[string, WorktreeMergeFailure]>;
+} | {
+    status: 'uncertain';
+    reason: string;
+};
 declare function getDurableStatusPath(projectDir?: string): string;
 /**
  * Load the durable file into the in-memory map. The clear+repopulate is
@@ -52,6 +59,13 @@ declare function getDurableStatusPath(projectDir?: string): string;
  */
 declare function loadDurableStatus(statusPath: string): void;
 declare function saveDurableStatus(statusPath: string): void;
+/**
+ * Strict recovery-only read of durable merge ownership. The normal registry
+ * stays fail-open for plugin loadability, while destructive orphan cleanup
+ * receives an explicit uncertainty result for read, parse, schema, or cap
+ * failures.
+ */
+export declare function scanWorktreeMergeFailuresForRecovery(projectDir: string): WorktreeMergeRecoveryScanResult;
 /**
  * Initialize the durable status path for this project and load existing
  * status from disk. Called from `createDelegationGateHook` before any coder

package/dist/hooks/delegation-gate/worktree-ownership-tag.d.ts

@@ -0,0 +1,19 @@
+export interface BackgroundWorktreeOwnershipTag {
+    sessionId: string;
+    laneId: string;
+    callDigest: string;
+    ref: string;
+}
+export type BackgroundWorktreeOwnershipTagScan = {
+    status: 'ok';
+    owners: BackgroundWorktreeOwnershipTag[];
+} | {
+    status: 'uncertain';
+    reason: string;
+};
+/**
+ * Strict, bounded ownership-tag scan shared by init recovery and restart
+ * collision classification. Any malformed or unreadable entry is uncertainty:
+ * destructive cleanup must never infer absence from incomplete ownership data.
+ */
+export declare function scanBackgroundWorktreeOwnershipTagsForRecovery(directory: string): Promise<BackgroundWorktreeOwnershipTagScan>;

package/dist/hooks/delegation-gate/worktree-provisioning-owner.d.ts

@@ -0,0 +1,30 @@
+export declare const WORKTREE_LIFECYCLE_LOCK_FILE = ".swarm/locks/init-orphan-recovery.lock";
+export interface WorktreeProvisioningOwner {
+    schemaVersion: 1 | 2;
+    callID: string;
+    parentSessionId: string;
+    worktreeSessionId: string;
+    /** Added in v2 so restart collision checks can identify the exact lane. */
+    taskId?: string;
+    createdAt: number;
+}
+export type WorktreeProvisioningOwnerScan = {
+    status: 'ok';
+    owners: WorktreeProvisioningOwner[];
+} | {
+    status: 'uncertain';
+    reason: string;
+};
+/**
+ * Publish a provisional owner before a standard worktree can be created.
+ * Callers hold the shared orphan-recovery lifecycle lock during this atomic
+ * write, closing the gap between recovery's owner snapshot and provisioning.
+ */
+export declare function recordWorktreeProvisioningOwner(directory: string, input: Omit<WorktreeProvisioningOwner, 'schemaVersion' | 'createdAt'>): WorktreeProvisioningOwner;
+/** Remove a provisional owner only after durable ownership or cleanup exists. */
+export declare function removeWorktreeProvisioningOwner(directory: string, callID: string): boolean;
+/**
+ * Strict recovery scan. Anything except ENOENT is uncertainty because omitting
+ * one marker could allow destructive cleanup to race a live worktree.
+ */
+export declare function scanWorktreeProvisioningOwnersForRecovery(directory: string): WorktreeProvisioningOwnerScan;

package/dist/hooks/delegation-gate.d.ts

@@ -4,6 +4,7 @@
  * Warns the architect when coder delegations are too large or batched.
  * Uses experimental.chat.messages.transform to provide non-blocking guidance.
  */
+import type { BackgroundDelegationRecord } from '../background/pending-delegations.js';
 import type { PluginConfig } from '../config';
 import { loadPlanJsonOnly } from '../plan/manager';
 import type { AgentSessionState } from '../state';
@@ -47,11 +48,12 @@ export declare function clearPendingCoderScope(): void;
  * `Task` with `background=true` (gated upstream by
  * `OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS=true`) returns a "running" placeholder
  * immediately and completes later via synthetic parent injection. The delegation gate
- * treats a `Task` result as completion, so a background swarm delegation would advance
- * Stage B / record gate evidence before any review/test output exists. Until swarm can
- * correlate the deferred completion safely (a separate, spike-gated PR), background
- * swarm delegations are fail-closed-blocked. We do NOT silently coerce `background` to
- * false — the unsupported capability is surfaced explicitly.
+ * treats a foreground `Task` result as completion, so the running placeholder must be
+ * tracked without terminal side effects. When the opt-in is enabled, trusted deferred
+ * completion ingestion performs exact parent correlation, workspace settlement, and
+ * role-appropriate state/evidence updates. With the opt-in disabled (the default while
+ * upstream remains experimental), background swarm delegations are fail-closed-blocked.
+ * We do NOT silently coerce `background` to false.
  */
 export declare const SWARM_BACKGROUND_TASK_BLOCKED_MESSAGE: string;
 /**
@@ -268,7 +270,7 @@ interface MessageWithParts {
  * approval. Does not throw — returns `false` for any failure (fail-closed).
  */
 export declare function isPlanCriticApproved(directory: string): Promise<boolean>;
-declare function resolveDelegatedPlanTaskId(args: Record<string, unknown>, knownPlanTaskIds?: ReadonlySet<string>): string | null;
+export declare function resolveDelegatedPlanTaskId(args: Record<string, unknown>, knownPlanTaskIds?: ReadonlySet<string>): string | null;
 /**
  * Builds a cause-specific diagnostic for `prepareCoderScope`'s SCOPE_NOT_DECLARED
  * throw when `resolveDelegatedPlanTaskId` returns null. Re-runs extraction with
@@ -324,12 +326,18 @@ export declare const _internals: {
     parsePerTaskVerdicts: typeof parsePerTaskVerdicts;
     buildParallelExecutionGuidance: typeof buildParallelExecutionGuidance;
     loadPlanJsonOnly: typeof loadPlanJsonOnly;
+    recordPendingDelegationForBackground: typeof import("../background/pending-delegations.js").recordPendingDelegation;
+    writeDelegationFallbackForBackground: typeof import("../background/pending-delegations.js").writeDelegationFallback;
+    reserveBackgroundCoderSlotForDispatch: typeof import("../background/pending-delegations.js").reserveBackgroundCoderSlot;
+    bindBackgroundCoderReservationForDispatch: typeof import("../background/pending-delegations.js").bindBackgroundCoderReservation;
+    releaseBackgroundCoderReservationForDispatch: typeof import("../background/pending-delegations.js").releaseBackgroundCoderReservation;
     resetStandardWorktreeIsolationState: typeof resetStandardWorktreeIsolationState;
     PLAN_CRITIC_TASK_SIGNALS: readonly ["critic-gate", "plan critic", "review plan", "review the plan", "plan.md", "approve the plan", "plan approval"];
     provisionWorktree: typeof _wtiInternals.provisionWorktree;
     removeWorktree: typeof _wtiInternals.removeWorktree;
     attemptMergeBackFromDirty: typeof _wtiInternals.attemptMergeBackFromDirty;
     postMergeCleanup: typeof _wtiInternals.postMergeCleanup;
+    preserveBackgroundWorktreeOwnershipForCallId: typeof _wtiInternals.preserveBackgroundWorktreeOwnershipForCallId;
 };
 /**
  * Creates the experimental.chat.messages.transform hook for delegation gating.
@@ -358,4 +366,5 @@ export declare function createDelegationGateHook(config: PluginConfig, directory
         childSessionID: string;
     }) => Promise<void>;
     sessionEnded: (sessionID: string, includeOwnedChildren?: boolean) => void;
+    backgroundCompletionClaimed: (record: BackgroundDelegationRecord) => void;
 };

package/dist/hooks/guardrails/tool-before.d.ts

@@ -37,6 +37,14 @@ export interface ToolBeforeContext {
      * trusted roots when exempting `git worktree remove --force` (issue #1708).
      */
     worktreeBaseDirOverrides?: string[];
+    /** Hold exact child-write provenance until the matching after-hook succeeds. */
+    rememberReviewerScopeWrite?: (input: {
+        callID: string;
+        parentSessionID: string;
+        taskId: string;
+        coderCallID: string;
+        file: string;
+    }) => void;
 }
 /**
  * Creates a toolBefore handler with the given shared context.

package/dist/hooks/index.d.ts

@@ -4,7 +4,7 @@ export { createCompactionCustomizerHook } from './compaction-customizer';
 export { createContextBudgetHandler } from './context-budget';
 export { createContextCapsuleInjectHook } from './context-capsule-inject';
 export { createCuratorLLMDelegate } from './curator-llm-factory';
-export { createDelegationGateHook } from './delegation-gate';
+export { createDelegationGateHook, outputLooksLikeBackgroundRunning, } from './delegation-gate';
 export { createDelegationSanitizerHook } from './delegation-sanitizer';
 export { createDelegationTrackerHook } from './delegation-tracker';
 export { extractCurrentPhase, extractCurrentPhaseFromPlan, extractCurrentTask, extractCurrentTaskFromPlan, extractDecisions, extractIncompleteTasks, extractIncompleteTasksFromPlan, extractPatterns, } from './extractors';

package/dist/hooks/init-orphan-recovery.d.ts

@@ -15,8 +15,19 @@
  * reads the advisory file at session-start and pushes messages to pendingAdvisoryMessages.
  */
 import * as fs from 'node:fs';
+import { scanDelegationFallbacksForRecovery, scanDelegationsForRecovery } from '../background/pending-delegations.js';
 import { isLocked, listActiveLocks, tryAcquireLock } from '../parallel/file-locks';
 import { removeWorktree } from '../worktree/core';
+import { scanWorktreeMergeFailuresForRecovery } from './delegation-gate/worktree-merge-status';
+import { scanWorktreeProvisioningOwnersForRecovery } from './delegation-gate/worktree-provisioning-owner';
+type OwnershipTagSessionScan = {
+    status: 'ok';
+    sessionIds: string[];
+} | {
+    status: 'uncertain';
+    reason: string;
+};
+declare function listOwnershipTagSessionIds(directory: string): Promise<OwnershipTagSessionScan>;
 /**
  * Lock file path for the init orphan recovery advisory lock.
  * advisory-only — signals that another process may be actively using the repo.
@@ -33,6 +44,11 @@ export declare const _internals: {
     isLocked: typeof isLocked;
     listActiveLocks: typeof listActiveLocks;
     tryAcquireLock: typeof tryAcquireLock;
+    listOwnershipTagSessionIds: typeof listOwnershipTagSessionIds;
+    scanDelegationsForRecovery: typeof scanDelegationsForRecovery;
+    scanDelegationFallbacksForRecovery: typeof scanDelegationFallbacksForRecovery;
+    scanWorktreeMergeFailuresForRecovery: typeof scanWorktreeMergeFailuresForRecovery;
+    scanWorktreeProvisioningOwnersForRecovery: typeof scanWorktreeProvisioningOwnersForRecovery;
 };
 export interface InitOrphanRecoveryResult {
     attempted: boolean;
@@ -63,3 +79,4 @@ export interface InitOrphanRecoveryResult {
  * @returns Result object describing what was attempted and any warnings/diagnostics
  */
 export declare function runInitOrphanRecovery(directory: string): Promise<InitOrphanRecoveryResult>;
+export {};