opencode-swarm 7.136.1 → 7.136.3

package/dist/hooks/pr-workflow-gate.d.ts

@@ -1,6 +1,6 @@
 import * as fsp from 'node:fs/promises';
 import { type PrReviewInlineTriggerRow } from '../background/pr-review-trigger-contract.js';
-import { resolveCommitCountSince, resolveCommitCountSinceAsync, resolveCurrentGitHead, resolveCurrentGitHeadAsync, resolveCurrentUpstreamPushTarget, resolveCurrentUpstreamPushTargetAsync, resolveCurrentUpstreamRemoteRef, resolveExactRemoteBranchHead, resolveExactRemoteBranchHeadAsync, resolveIsExactSingleChildCommit, resolveIsExactSingleChildCommitAsync, resolveIsWorkingTreeClean, resolveIsWorkingTreeCleanAsync, resolvePrReviewDiffStats, resolvePrReviewDiffStatsAsync, resolvePrWorkflowRevisionDigest, resolveRemoteRefsContainingHead, resolveRemoteRefsContainingHeadAsync } from '../background/workspace-snapshot.js';
+import { type RevisionDigestResult, resolveCommitCountSince, resolveCommitCountSinceAsync, resolveCurrentGitHead, resolveCurrentGitHeadAsync, resolveCurrentUpstreamPushTarget, resolveCurrentUpstreamPushTargetAsync, resolveCurrentUpstreamRemoteRef, resolveExactRemoteBranchHead, resolveExactRemoteBranchHeadAsync, resolveIsExactSingleChildCommit, resolveIsExactSingleChildCommitAsync, resolveIsWorkingTreeClean, resolveIsWorkingTreeCleanAsync, resolvePrReviewDiffStats, resolvePrReviewDiffStatsAsync, resolvePrWorkflowRevisionDigest, resolvePrWorkflowRevisionDigestDetailed, resolveRemoteRefsContainingHead, resolveRemoteRefsContainingHeadAsync } from '../background/workspace-snapshot.js';
 import { type PrWorkflowGitState } from '../git/pr-workflow-state.js';
 export declare const PR_REVIEW_BASE_DIMENSION_IDS: readonly ["intent-architecture", "correctness-state", "tests-falsifiability", "security-trust", "reliability-performance", "compatibility-delivery"];
 export declare const PR_REVIEW_REQUIRED_MICRO_LANE_IDS: ("auth-identity-secrets" | "untrusted-input-boundaries" | "subprocess-platform" | "concurrency-state" | "dependencies-build-release" | "api-schema-migrations" | "test-infrastructure" | "ui-accessibility-i18n" | "privacy-observability" | "generated-provenance" | "unclassified-risk")[];
@@ -41,6 +41,25 @@ export declare const PR_REVIEW_DEPTH_TIER_THRESHOLDS: {
  * multiple dimensions while every dimension stays mandatory to evaluate.
  */
 export declare const PR_REVIEW_BASE_LANE_FLOORS: Record<PrReviewDepthTier, number>;
+/**
+ * Cumulative lane floor for a tier-L base wave that used consolidated failure
+ * recovery (issue #1968 MUST-FIX 1).
+ *
+ * `PR_REVIEW_BASE_LANE_FLOORS.L` is the *initial wave* floor and equals the
+ * dimension count, so it cannot also serve as the post-consolidation floor: any
+ * consolidated lane owns at least two dimensions, so a wave that consolidated
+ * even once is backed by at most five lanes. Enforcing six cumulatively would
+ * make the tier-L retry exception unreachable — i.e. delete the feature.
+ *
+ * The bound that *is* enforceable, and is the property worth defending, is that
+ * a tier-L wave may never be reduced by consolidation to a lane count a tier-M
+ * dispatch would already have satisfied: the depth tier chosen for this PR must
+ * not be silently downgraded by failure recovery. Hence "strictly more than the
+ * tier-M floor" — four distinct lanes for six dimensions, a bounded loss of at
+ * most two lanes of depth, versus the unbounded loss (down to two lanes) a
+ * per-batch-only floor permits when a retry is split across batches.
+ */
+export declare const PR_REVIEW_TIER_L_CONSOLIDATED_LANE_FLOOR: number;
 /**
  * Minimum lane counts for a FULL micro (risk-family) sweep per depth tier. These
  * mirror the base floors' tier *semantics* — not their numbers — scaled to the
@@ -171,6 +190,35 @@ interface PrReviewValidationBatchRecord {
     }>;
     validatedAt: string;
 }
+/**
+ * Per-batch coherence keys for item-keyed reviewer/critic composition.
+ *
+ * This deliberately lives OUTSIDE `PrReviewValidationBatchRecord`: that record's
+ * schema is `.strict()`, and Zod's unknown-key policy is per-schema — the parent
+ * state schema's `.passthrough()` does not relax a strict child. Adding fields to
+ * the batch record would make a rolled-back plugin fail `safeParse` on every gate
+ * state read, including `requireAnyActiveState`, which `abortPrWorkflow` calls
+ * *before* the clear escape hatch. Keeping this as one new optional TOP-LEVEL key
+ * on the passthrough parent keeps older code at "ignore the field I don't know"
+ * instead of "refuse to read the file at all".
+ */
+interface PrReviewBatchCoherenceRecord {
+    /**
+     * The exact candidate/critic inventory this batch's ownership was validated
+     * against at record time (the same set `assertExactStringSet` compared the
+     * declared lane items to).
+     */
+    validatedInventory: string[];
+    /**
+     * Critic batches only: per-item sha256 of the full canonical `[REVIEWED]` row
+     * that was authoritative for that item when the critic batch was declared. A
+     * critic claim is admitted only while the current winning reviewer row for
+     * that item is byte-identical, so a reviewer re-run that changes evidence or
+     * root cause — not only classification/severity — drops exactly the critic
+     * claims it invalidated and leaves its siblings intact.
+     */
+    reviewerItemBindings?: Record<string, string>;
+}
 export interface PrWorkflowGateState {
     schemaVersion: 1;
     /** Monotonic durable revision used to reject stale same-session transitions. */
@@ -199,6 +247,29 @@ export interface PrWorkflowGateState {
     prReviewTriggerLedger?: PrReviewInlineTriggerRow[];
     prReviewTriggerEvalPath?: string;
     prReviewValidationBatches?: PrReviewValidationBatchRecord[];
+    /** Keyed by validation batch id. See `PrReviewBatchCoherenceRecord`. */
+    prReviewBatchCoherence?: Record<string, PrReviewBatchCoherenceRecord>;
+    /**
+     * Child session ids that produced a reviewer artifact for a validation batch
+     * the capacity GC has since dropped (issue #1968 MUST-FIX 3).
+     *
+     * `reviewerSubagentSessionIds` derives the critic reuse ban by walking the
+     * live reviewer batches, so pruning one would silently un-forbid its child
+     * sessions and let an agent challenge its own review. This ledger carries
+     * that fail-closed set across the prune.
+     */
+    prReviewRetiredReviewerSessionIds?: string[];
+    /**
+     * Canonical dimension-set keys of consolidated base lanes whose batch the
+     * capacity GC dropped (issue #1968 review round 2, FIX D).
+     *
+     * `tierLBackingLaneCount` covers the consolidated lanes it can see, and it can
+     * only see surviving `prReviewBaseDispatches`. A failed consolidated base
+     * batch is prunable, so without this ledger a prune would shrink the cover's
+     * universe and monotonically hand the wave back consolidation budget it had
+     * already spent.
+     */
+    prReviewRetiredConsolidatedLanes?: string[];
     prReviewArtifactRunId?: string;
     prReviewFindingsPath?: string;
     prReviewArtifactBoundaries?: PrReviewArtifactBoundary[];
@@ -210,6 +281,16 @@ export interface PrWorkflowGateState {
     prFeedbackReviewHandoff?: PrFeedbackReviewHandoffRecord;
     prFeedbackInventory?: string[];
     prFeedbackVerifications?: PrFeedbackVerificationRecord[];
+    /**
+     * Item -> lane bindings of verification batches the capacity GC dropped
+     * (issue #1968 review round 2, MUST-FIX C).
+     *
+     * `enforcePrFeedbackVerificationOwnership` rejects a re-claim of an inventory
+     * item by a different lane using a ledger rebuilt from every live batch.
+     * Pruning a batch would silently un-claim its items; this carries the binding
+     * across the prune so the rejection stays cumulative.
+     */
+    prFeedbackRetiredItemOwnership?: Record<string, string>;
     /** @deprecated Compatibility projection of the most recent verification dispatch. */
     prFeedbackVerification?: PrFeedbackVerificationRecord;
     prFeedbackStageA?: PrFeedbackStageARecord;
@@ -294,16 +375,26 @@ export declare function enforcePrWorkflowDispatchLanesAsync(directory: string, s
 export declare function enforcePrReviewBaseDimensions(directory: string, sessionID: string, lanes: readonly PrWorkflowLaneSpec[], options: {
     batchId: string;
     prHeadSha: string;
+    revisionDigest?: string;
 }): Promise<PrWorkflowGateState>;
+declare function minimumConsolidatedLaneCover(sets: ReadonlyArray<readonly string[]>): number;
 /** Validate durable exact-six PR review evidence across all base and retry batches. */
-export declare function assertPrReviewBaseCoverageSettled(directory: string, sessionID: string): Promise<PrWorkflowGateState>;
+export declare function assertPrReviewBaseCoverageSettled(directory: string, sessionID: string, gateContext?: PrReviewGateContext): Promise<PrWorkflowGateState>;
 /** Persist a council/reviewer/critic validation batch before launch. */
 export declare function recordPrReviewValidationBatch(directory: string, sessionID: string, phase: PrReviewValidationPhase, lanes: readonly PrWorkflowLaneSpec[], options: {
     batchId: string;
     prHeadSha: string;
 }): Promise<PrWorkflowGateState>;
-/** Validate that every declared council/reviewer/critic obligation has a successful retry. */
-export declare function assertPrReviewValidationSettled(directory: string, sessionID: string, phase?: PrReviewValidationPhase): Promise<PrWorkflowGateState>;
+/**
+ * Validate that every declared council obligation has a successful retry, and
+ * that every reviewer/critic *item* carries an authenticated verdict.
+ *
+ * Council keeps lane-level accounting (council lanes carry no item ownership).
+ * Reviewer and critic settle through `composePrReviewPhaseVerdicts`, so
+ * settlement and every verdict derivation are literally the same computation —
+ * settlement can never pass while derivation is empty.
+ */
+export declare function assertPrReviewValidationSettled(directory: string, sessionID: string, phase?: PrReviewValidationPhase, gateContext?: PrReviewGateContext): Promise<PrWorkflowGateState>;
 export declare function declarePrFeedbackInventory(directory: string, sessionID: string, inventoryIds: readonly string[], options: {
     prHeadSha: string;
 }): Promise<PrWorkflowGateState>;
@@ -368,6 +459,8 @@ export declare function enforcePrWorkflowToolBefore(directory: string, sessionID
 /** Validate the terminal PR workflow contract before removing its durable gate. */
 export declare function completePrWorkflow(directory: string, sessionID: string, expectedMode: PrWorkflowMode, prHeadSha: string): Promise<PrWorkflowCompletionStatus>;
 export declare const _test_exports: {
+    minimumConsolidatedLaneCover: typeof minimumConsolidatedLaneCover;
+    MAX_COVER_UNIVERSE_BITS: number;
     workflowGateStateRelativePath: typeof workflowGateStateRelativePath;
     workflowGateStateLockRelativePath: typeof workflowGateStateLockRelativePath;
     workflowCheckoutMutationLockRelativePath: typeof workflowCheckoutMutationLockRelativePath;
@@ -403,9 +496,66 @@ export declare const _test_exports: {
     resolvePrReviewDiffStats: typeof resolvePrReviewDiffStats;
     resolvePrReviewDiffStatsAsync: typeof resolvePrReviewDiffStatsAsync;
     resolvePrWorkflowRevisionDigest: typeof resolvePrWorkflowRevisionDigest;
+    /**
+     * The batch cap the capacity GC reclaims against. Exposed so the GC suite
+     * builds its fixture from the real bound instead of a hand-copied literal
+     * that would silently drift if the cap ever moved.
+     */
+    MAX_WORKFLOW_BATCHES: number;
+    /**
+     * The three ledger ceilings whose overflow makes the capacity GC abandon a
+     * prune and keep every batch. Exposed on the same reasoning as
+     * `MAX_WORKFLOW_BATCHES`: the overflow suite seeds a ledger to exactly its
+     * bound from the real constant, so a hand-copied literal cannot drift away
+     * from the branch it is meant to reach.
+     */
+    MAX_RETIRED_REVIEWER_SESSION_IDS: number;
+    MAX_RETIRED_CONSOLIDATED_LANES: number;
+    MAX_RETIRED_FEEDBACK_ITEM_OWNERS: number;
+    /**
+     * Issue #1968 P2.2: lets a focused test drive one specific bounded-snapshot
+     * failure reason so the BLOCKED diagnostic can be asserted per bound. The
+     * pre-existing `resolvePrWorkflowRevisionDigest` seam above still takes
+     * priority-two precedence and is unchanged for every existing fixture.
+     */
+    resolvePrWorkflowRevisionDigestDetailed: typeof resolvePrWorkflowRevisionDigestDetailed;
     resolveRemoteRefsContainingHead: typeof resolveRemoteRefsContainingHead;
     resolveRemoteRefsContainingHeadAsync: typeof resolveRemoteRefsContainingHeadAsync;
     parseCriticVerdict: typeof parseCriticVerdict;
+    /**
+     * Read-only view of the item-keyed composition for one session, including
+     * the diagnostics that settlement only logs (abandoned declared lanes,
+     * batches skipped for inventory incoherence). Production callers reach the
+     * same computation through settlement and the verdict derivations.
+     */
+    composePrReviewPhaseVerdicts: (directory: string, sessionID: string, phase: PrReviewComposablePhase) => Promise<PrReviewPhaseComposition>;
+    /**
+     * Issue #1968 B1 guardrail, exposed directly.
+     *
+     * Production reaches it from `assertPrReviewValidationSettled`, both
+     * critic-coverage gates and the artifact-record projection check. Item-keyed
+     * composition makes a real violation unreachable by construction, so the only
+     * way to exercise the assertion's own behaviour (and its cause-naming
+     * message) without mutating production code is to hand it the divergent pair
+     * a future re-split would produce.
+     */
+    assertSettledPhaseHasAuthoritativeVerdicts: typeof assertSettledPhaseHasAuthoritativeVerdicts;
+    /**
+     * The critic-coverage gate's guarded input, exposed for the same reason as
+     * the assertion above: production reaches its unsettled-reviewer branch only
+     * if a caller stops settling reviewer first, which is precisely the future
+     * regression it exists to catch, so the branch is otherwise untestable.
+     */
+    derivePrReviewCriticInventoryForCoverageGate: (directory: string, sessionID: string, origin?: string) => Promise<string[]>;
+    /**
+     * Read-only view of the mandatory candidate inventory for one session.
+     * Production reaches the same derivation through validation-batch ownership
+     * validation, the composition, and the artifact-boundary checks; this seam
+     * lets a focused test observe *which* base lane won a dimension (the tier-L
+     * singleton-over-consolidated precedence) without standing up the full
+     * micro-sweep and trigger-ledger prerequisites those entry points require.
+     */
+    derivePrReviewCandidateInventory: (directory: string, sessionID: string) => Promise<string[]>;
     isProcessAlive: typeof isProcessAlive;
     isSafeStandaloneGitCommit: typeof isSafeStandaloneGitCommit;
     rename: typeof fsp.rename;
@@ -421,6 +571,113 @@ export declare function normalizePrWorkflowShellCommand(command: string): {
     strippedCdPrefix: boolean;
 };
 declare function isSafeStandaloneGitCommit(command: string): boolean;
+/**
+ * The gate's view of a digest failure. Everything the bounded-snapshot resolver
+ * can report, plus one test-only case: an injected `string | null` seam returned
+ * `null`, which carries no reason at all. Modelled explicitly rather than folded
+ * into one of the real reasons so a diagnostic never claims a bound fired when
+ * nothing proved it did.
+ */
+type GateRevisionDigestResult = RevisionDigestResult | {
+    ok: false;
+    reason: 'seam-unavailable';
+    detail?: string;
+};
+/**
+ * Name the exact bound that fired, plus what to do about it.
+ *
+ * Exported because `dispatch_lanes_async` resolves the same bounded revision
+ * digest before any gate entry point runs, and must produce the same
+ * bound-naming diagnostic rather than the pre-fix "could not compute" with no
+ * indication of which of six limits was hit (issue #1968 P2.2 / criterion 6).
+ */
+export declare function describePrWorkflowRevisionDigestFailure(failure: Extract<GateRevisionDigestResult, {
+    ok: false;
+}>): string;
+/**
+ * One PR_REVIEW gate entry point's memoized derivation context.
+ *
+ * Two properties, both load-bearing:
+ *
+ * 1. **One revision digest per gate call.** Every artifact-integrity check below
+ *    compares the persisted artifact's `revisionDigest` against the current
+ *    worktree revision. Resolving that per record costs three blocking `git`
+ *    calls plus a full re-read of every changed file, once per record. Both
+ *    callers of the marker check already require
+ *    `record.workspace.prHeadSha === state.prHeadSha` earlier in the same
+ *    predicate, so every record reaching the comparison shares one head and one
+ *    resolution is equivalent to N.
+ *
+ *    **Honest equivalence statement:** one digest is equivalent to N per-record
+ *    resolves *absent concurrent worktree mutation during a gate call*. The
+ *    resolver reads the live worktree, so this narrows a TOCTOU window rather
+ *    than being a pure cost change. It adopts the precedent already set by the
+ *    PR_FEEDBACK verification path, which resolves once and threads.
+ *
+ * 2. **One composed verdict map per gate call.** Settlement, critic-inventory
+ *    derivation, the artifact-record projection check and the legacy-eligibility
+ *    marker check are separate passes over the same state. They must never hold
+ *    two different notions of "the current reviewer verdict", so the composition
+ *    is computed once here and the same object is handed to all of them.
+ *
+ * A context is valid for exactly one gate entry-point call over one state
+ * snapshot. Never cache it across calls.
+ */
+interface PrReviewGateContext {
+    readonly revisionDigest: string;
+    reviewer?: PrReviewPhaseComposition;
+    critic?: PrReviewPhaseComposition;
+    candidateInventory?: string[];
+}
+type PrReviewComposablePhase = 'reviewer' | 'critic';
+/** One item's admitted verdict plus the lane provenance that admitted it. */
+interface PrReviewItemClaim {
+    batchId: string;
+    laneId: string;
+    workflowLane: string;
+    /** Reviewer classification, or critic status. */
+    classification: string;
+    severity: string;
+    /**
+     * sha256 of the full canonical `[REVIEWED]` row this claim was parsed from.
+     * Reviewer claims only — this is what a critic batch binds to per item.
+     */
+    rowDigest?: string;
+}
+interface PrReviewPhaseComposition {
+    /** Item id -> winning claim. Most recent successful lane per item wins. */
+    claims: Map<string, PrReviewItemClaim>;
+    requiredInventory: string[];
+    unclaimed: string[];
+    contributingBatchIds: string[];
+    diagnostics: string[];
+}
+/**
+ * **B1 invariant — the accounting defect class's most dangerous recurrence.**
+ *
+ * Issue #1968's defect class treats the whole inventory on the current revision
+ * as the atomic unit of validity. Its worst recurrence is not a false BLOCK, it
+ * is a silent PASS: a phase treated as *settled* while the authoritative verdict
+ * map every downstream gate reads is empty or partial. For the reviewer phase
+ * that chain is `derivePrReviewCriticInventory` -> `[]` ->
+ * `completePrWorkflow`'s `criticInventory.length > 0` is false -> **critic
+ * coverage is skipped entirely** and CONFIRMED CRITICAL/HIGH findings ship
+ * unchallenged, with the only surface symptom a downstream
+ * `no authoritative reviewer verdict` that names a consequence, not the cause.
+ *
+ * Composition currently makes this unreachable by construction: settlement *is*
+ * `unclaimed.length === 0` over the very map derivation projects, and claims are
+ * filtered to `requiredInventory`, so `unclaimed === []` implies the map covers
+ * every required item. This assertion deliberately does **not** rely on that
+ * adjacency. It states the property directly so a future refactor that re-splits
+ * settlement from derivation fails loudly at the gate instead of silently
+ * skipping the critic phase.
+ *
+ * Fail-closed and always on; never downgraded to a warning, because the failure
+ * it catches is invisible in the passing direction. Pure over values the caller
+ * already computed: no digest resolution, no artifact reads, no subprocess work.
+ */
+declare function assertSettledPhaseHasAuthoritativeVerdicts(phase: PrReviewComposablePhase, composed: Pick<PrReviewPhaseComposition, 'requiredInventory' | 'unclaimed'>, authoritative: ReadonlyMap<string, unknown>, origin: string): void;
 /** Require at least one semantically valid discovery row or CLEAN attestation. */
 export declare function prReviewDiscoveryArtifactCoversLane(text: string, expectedWorkflowLane: string, ownedWorkflowLanes?: readonly string[]): boolean;
 declare function parseCriticVerdict(text: string, itemId: string, reviewerSeverity?: string): {

package/dist/hooks/pr-workflow-response-gate.d.ts

@@ -73,12 +73,16 @@ export declare const MAX_FALLBACK_BANNER_INJECTIONS_PER_SESSION = 20;
  */
 export declare const DEFAULT_TOTAL_WAKE_CEILINGS: Record<PrReviewDepthTier, number>;
 /**
- * Bounded FIFO map of tracked wake budgets. Invariant 8 (session/global
- * state): module-level state must have an explicit eviction strategy. Three
- * further per-session maps share this same bound and the same FIFO discipline:
- * `bannerStamps` (instant of the last full banner), `banneredMessages` (the
- * assistant message already carrying a banner), and `fallbackInjections` (the
- * injection count on the messageID-less path).
+ * Bound on the tracked wake budgets. Invariant 8 (session/global state):
+ * module-level state must have an explicit eviction strategy. `wakeBudgets`
+ * evicts LEAST RECENTLY WOKEN — see {@link evictIfOverBound}, which also
+ * refuses to drop suspended or in-flight entries and therefore treats this
+ * bound as best-effort. Three further per-session maps share the same numeric
+ * bound but keep the simpler insertion-order FIFO discipline, because they
+ * hold no enforcement state that is unsafe to lose: `bannerStamps` (instant of
+ * the last full banner), `banneredMessages` (the assistant message already
+ * carrying a banner), and `fallbackInjections` (the injection count on the
+ * messageID-less path).
  */
 export declare const MAX_TRACKED_WAKE_SESSIONS = 200;
 interface PrWorkflowResponseGateClient {
@@ -89,12 +93,26 @@ interface WakeBudget {
     lastWakeAt: number;
     lastSeenRevision?: number;
     suspended: boolean;
-    /** Total number of wake attempts across the session lifetime. Never reset by
-     * revision progress — only the consecutive counter resets on progress. */
+    /** Total number of wake attempts recorded for this budget. NEVER reset by
+     * revision progress — only the consecutive counter resets on progress; that
+     * is the guarantee this counter exists to provide. Its SCOPE is the scope of
+     * the enclosing map (see `wakeBudgets` in
+     * {@link createPrWorkflowResponseGate}): one PROCESS lifetime, running until
+     * the durable gate CLEARS. `resetBudget` drops the entry on a gate clear
+     * (complete/abort) and a plugin reload starts fresh totals — so this is not
+     * a total across the whole conversation/session lifetime.
+     *
+     * Deliberately NOT "one workflow activation": `transitionPrReviewToFeedback`
+     * (`pr-workflow-gate.ts`) mints a new `workflowInstanceId` WITHOUT clearing
+     * the gate, so a budget survives the PR_REVIEW -> PR_FEEDBACK handoff and
+     * keeps accumulating across both activations. See the ceiling note at the
+     * `totalWakes` increment for why that matters. */
     totalWakes: number;
     /** Discriminator for WHY the session was suspended: 'consecutive' means
      * the consecutive-unproductive budget was exhausted; 'total' means the
-     * absolute per-session total-wake ceiling was reached. */
+     * total-wake ceiling in force for this process, at the tier the gate
+     * currently reports, was reached (same scope caveat as
+     * {@link WakeBudget.totalWakes}). */
     suspendedReason: 'consecutive' | 'total';
 }
 /**

package/dist/hooks/trajectory-logger.d.ts

@@ -23,6 +23,13 @@ export interface TrajectoryEntry {
     args_summary: string;
     verdict: string;
     elapsed_ms: number;
+    /**
+     * Host tool-call id. Written only by {@link recordDeniedToolCall} (issue
+     * #2063 D1) so a `tool.execute.after` that unexpectedly fires for a call
+     * whose before-hook already threw can be recognised and skipped instead of
+     * double-recording the same call.
+     */
+    callID?: string;
 }
 /**
  * Truncates a trajectory file to the newest half when maxLines is exceeded.
@@ -32,6 +39,28 @@ export interface TrajectoryEntry {
  * @param maxLines - Maximum number of lines to retain
  */
 export declare function truncateTrajectoryFile(filePath: string, maxLines: number): Promise<void>;
+/**
+ * Derives the action type from the tool name.
+ *
+ * Issue #2063 D2: the name is normalized via `normalizeToolNameLowerCase`
+ * first, so host-namespaced names (`opencode:bash`, `opencode.read`) bucket
+ * identically to their bare forms. Previously they all fell through to
+ * `tool_use`, which flattened the taxonomy PRM pattern detection reads. `grep`
+ * was likewise missing from the read bucket despite being one of the most
+ * frequent read-only calls.
+ *
+ * @param tool - Tool name (may carry a host namespace prefix)
+ * @returns Action type string
+ */
+declare function deriveAction(tool: string): string;
+/**
+ * Extracts the target from tool arguments.
+ *
+ * @param tool - Tool name
+ * @param args - Tool arguments object
+ * @returns Target string
+ */
+declare function extractTarget(tool: string, args?: Record<string, unknown>): string;
 /**
  * Creates the trajectory logger hook pair.
  *
@@ -51,6 +80,41 @@ export declare function createTrajectoryLoggerHook(config: Partial<TrajectoryCon
         metadata: unknown;
     }) => Promise<void>;
 };
+/**
+ * Records a tool call that a fail-closed `tool.execute.before` hook DENIED.
+ *
+ * Before this existed the trajectory only contained calls that ran, so a
+ * session that spent fifty turns re-issuing a dispatch the delegation gate kept
+ * rejecting looked, to PRM and to any post-hoc reader, like a session that made
+ * no tool calls at all — the exact loop shape #2063 is about was invisible in
+ * the record of it.
+ *
+ * Contract:
+ *   - The step is minted with the SHARED `nextTrajectoryStep(sessionId)`. Any
+ *     private counter would desynchronise the `prmTrajectoryStep` window and
+ *     silently break PRM's step-range filtering.
+ *   - `session.delegationActive` gates recording at all (the architect session
+ *     is deliberately out of scope); the task-evidence copy additionally
+ *     requires `session.currentTaskId`, so a subagent running without a task id
+ *     still lands in the PRM store.
+ *   - EVERY failure is swallowed. This runs inside the `catch` that is about to
+ *     rethrow a policy denial; it must never change which error propagates.
+ *
+ * @param sessionID - Session whose chain denied the call
+ * @param input - The host `tool.execute.before` input (tool / callID / args)
+ * @param errorMessage - The ORIGINAL denial message, before any B1 decoration
+ * @param directory - Workspace root (evidence + PRM store live under `.swarm/`)
+ * @param options - `maxLines` mirrors the hook's `max_lines` config
+ */
+export declare function recordDeniedToolCall(sessionID: string, input: {
+    tool: string;
+    callID?: string;
+    args?: Record<string, unknown>;
+}, errorMessage: string, directory: string, options?: {
+    maxLines?: number;
+}): Promise<void>;
+/** Test helper: drop all denied-call dedupe markers. */
+export declare function clearDeniedCallMarkers(): void;
 /**
  * Resets the step counter for a session. Called when a new session starts
  * or when trajectory tracking should restart from step 1.
@@ -73,3 +137,15 @@ export declare function clearTrajectoryStep(sessionId?: string): void;
  * @param startTime - Start timestamp in milliseconds
  */
 export declare function recordToolCallStart(sessionId: string, callID: string, startTime: number): void;
+/**
+ * Tier-0 pure-function test seam (writing-tests skill). These helpers take no
+ * external dependencies, so testing them directly needs no mocks at all.
+ */
+export declare const _test_exports: {
+    readonly deriveAction: typeof deriveAction;
+    readonly extractTarget: typeof extractTarget;
+    readonly MAX_DENIED_CALL_MARKERS: 500;
+    readonly DENIED_CALL_TTL_MS: number;
+    readonly deniedCallMarkerCount: () => number;
+};
+export {};

package/dist/hooks/write-target-resolver.d.ts

@@ -10,6 +10,25 @@ export type WriteTargetResolution = {
 export interface WriteTargetResolverContext {
     directory: string;
 }
+/**
+ * Field names a patch-family tool (`patch` / `apply_patch` /
+ * `swarm_apply_patch`) may use to carry its patch payload. Issue #2059: models
+ * and tool wrappers commonly emit `patchText`, `patch_text`, `patchPayload`,
+ * `text`, or `content`; recognizing only `patch`/`input`/`diff` made the
+ * resolver throw `WRITE TARGET UNVERIFIABLE: No patch payload was provided`
+ * for valid diffs.
+ *
+ * Exported so the guardrail layer (`tool-before.ts`) can reuse the single
+ * source of truth instead of drifting its own inline copies (the drift is what
+ * hid the original bug — three copies of this list existed).
+ *
+ * Collision safety: the patch resolver only runs for tools in
+ * `WRITE_TOOL_NAMES`, and `extract_code_blocks` (which uses `content`) routes
+ * to `extractResolver`, not `patchResolver`. Any future `WRITE_TOOL_NAMES`
+ * addition that uses `text` or `content` for a non-patch purpose must be
+ * audited against this list.
+ */
+export declare const PATCH_PAYLOAD_KEYS: readonly ["patch", "input", "diff", "patchText", "patch_text", "patchPayload", "text", "content"];
 declare function genericResolver(args: Record<string, unknown>): WriteTargetResolution;
 declare function extractResolver(args: Record<string, unknown>, context: WriteTargetResolverContext): WriteTargetResolution;
 /** One authoritative resolver per registered write tool. */