opencode-swarm 7.144.3 → 7.144.5

package/dist/cli/{worktree-collision-ownership-z5ftwjz3.js → worktree-collision-ownership-vy0kxa98.js}

@@ -5,23 +5,28 @@ import {
 import {
   scanDelegationFallbacksForRecovery,
   scanDelegationsForRecovery
-} from "./index-krxcxkdq.js";
+} from "./index-n4hwcsbd.js";
 import {
   WORKTREE_PROVISIONING_OWNER_LEASE_MS,
   removeWorktreeProvisioningOwner,
   scanWorktreeProvisioningOwnersForRecovery
-} from "./index-k3cxyk66.js";
-import"./index-rn0eq85g.js";
+} from "./index-cwtpqm5f.js";
+import"./index-fv0s19g9.js";
 import"./index-z6xqpmqg.js";
+import {
+  init_git_executable,
+  resolveGitExecutable
+} from "./index-9e6fdz2h.js";
+import"./index-4rhhvd1a.js";
 import"./index-zjygnfay.js";
 import"./index-ed5ykebp.js";
-import"./index-wd24zn2e.js";
-import"./index-s2rcz51a.js";
+import"./index-f9vvg5xb.js";
+import"./index-1jsmmx7y.js";
 import"./index-7g4c7s5r.js";
 import"./index-bpmtbmy9.js";
 import {
   bunSpawn
-} from "./index-4nt52yr9.js";
+} from "./index-zj6t9zgx.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 
@@ -32,6 +37,7 @@ import * as path2 from "path";
 // src/hooks/delegation-gate/worktree-ownership-tag.ts
 import * as fs from "fs";
 import * as path from "path";
+init_git_executable();
 var OWNERSHIP_TAG_SCAN_TIMEOUT_MS = 2000;
 var MAX_OWNERSHIP_TAGS = 512;
 function decodeTagPart(value) {
@@ -52,21 +58,22 @@ async function scanBackgroundWorktreeOwnershipTagsForRecovery(directory) {
       reason: `Git metadata could not be inspected: ${error instanceof Error ? error.message : String(error)}`
     };
   }
-  const proc = bunSpawn([
-    "git",
-    "-C",
-    directory,
-    "for-each-ref",
-    `--count=${MAX_OWNERSHIP_TAGS + 1}`,
-    "--format=%(refname:strip=2)%00%(objectname)",
-    "refs/tags/swarm-preserved-owner/"
-  ], {
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "ignore",
-    timeout: OWNERSHIP_TAG_SCAN_TIMEOUT_MS
-  });
+  let proc;
   try {
+    proc = bunSpawn([
+      resolveGitExecutable(),
+      "-C",
+      directory,
+      "for-each-ref",
+      `--count=${MAX_OWNERSHIP_TAGS + 1}`,
+      "--format=%(refname:strip=2)%00%(objectname)",
+      "refs/tags/swarm-preserved-owner/"
+    ], {
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "ignore",
+      timeout: OWNERSHIP_TAG_SCAN_TIMEOUT_MS
+    });
     const exitCode = await proc.exited;
     if (exitCode !== 0) {
       return {
@@ -104,7 +111,7 @@ async function scanBackgroundWorktreeOwnershipTagsForRecovery(directory) {
     };
   } finally {
     try {
-      proc.kill();
+      proc?.kill();
     } catch {}
   }
 }

package/dist/cli/{worktree-isolation-y2p93438.js → worktree-isolation-rwq0kke7.js}

@@ -20,62 +20,63 @@ import {
   sanitizeWorktreeTaskId,
   standardWorktreeByCallID,
   standardWorktreeSerializationSessions
-} from "./index-247wf23m.js";
-import"./index-7554tecy.js";
-import"./index-2en8s72h.js";
-import"./index-satc0vs6.js";
+} from "./index-wmsehjq6.js";
+import"./index-dtbzyr3s.js";
+import"./index-dc04v786.js";
+import"./index-kh0jt9pg.js";
 import"./index-134d35c1.js";
-import"./index-b6e016tv.js";
-import"./index-zwrqe065.js";
-import"./index-8214dd7j.js";
+import"./index-abtrcs16.js";
+import"./index-6z5jtf7d.js";
+import"./index-wknz5c8q.js";
 import"./index-y8552snf.js";
-import"./index-wck434f8.js";
+import"./index-63tgh0cn.js";
 import"./index-70ha9e09.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
-import"./index-74hpm6sh.js";
-import"./index-584grrwn.js";
-import"./index-pag8nsb1.js";
-import"./index-eya357bk.js";
-import"./index-b227mpnk.js";
-import"./index-0fgwdtvp.js";
+import"./index-f36ybbsv.js";
+import"./index-hkdgkkhb.js";
+import"./index-wm6f7t7w.js";
+import"./index-ea09xax6.js";
+import"./index-rnyt30tm.js";
+import"./index-vdha477y.js";
 import"./index-rtry5xyf.js";
 import"./index-zsrtt42s.js";
-import"./index-krxcxkdq.js";
-import"./index-k3cxyk66.js";
-import"./index-x68tw7v3.js";
-import"./index-6s2q144w.js";
-import"./index-p7hbphaq.js";
-import"./index-j6mfyy0a.js";
+import"./index-n4hwcsbd.js";
+import"./index-cwtpqm5f.js";
+import"./index-a1hxejxc.js";
+import"./index-855hseq4.js";
+import"./index-mkmcz6x8.js";
+import"./index-7e4q41nb.js";
 import"./index-556ja8an.js";
 import"./index-7sy3aa9m.js";
 import"./index-wx8zdh4a.js";
-import"./index-8fwhhayc.js";
-import"./index-q1exe2b3.js";
-import"./index-xwpmxpb7.js";
-import"./index-pr8vhj6j.js";
+import"./index-b44qqqt2.js";
+import"./index-zy7f84cs.js";
+import"./index-641yjpk8.js";
+import"./index-wbrqvm2g.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-qj22wyw2.js";
+} from "./index-1pxqkvvq.js";
 import"./index-gprxjmm7.js";
 import"./index-n832052r.js";
-import"./index-rn0eq85g.js";
+import"./index-fv0s19g9.js";
 import"./index-z6xqpmqg.js";
-import"./index-8hkjk37c.js";
-import"./index-1brb14xc.js";
+import"./index-58cvm3dw.js";
+import"./index-kdak6s63.js";
+import"./index-v3y3qg48.js";
+import"./index-9e6fdz2h.js";
 import"./index-4rhhvd1a.js";
-import"./index-whezv7vc.js";
 import"./index-zjygnfay.js";
 import"./index-ae75rja9.js";
-import"./index-dpfphnmy.js";
-import"./index-zswmbm15.js";
+import"./index-h1p08s3n.js";
+import"./index-9s8drsf9.js";
 import"./index-ed5ykebp.js";
 import"./index-bk5tah7q.js";
-import"./index-wd24zn2e.js";
-import"./index-s2rcz51a.js";
+import"./index-f9vvg5xb.js";
+import"./index-1jsmmx7y.js";
 import"./index-7g4c7s5r.js";
 import"./index-bpmtbmy9.js";
-import"./index-4nt52yr9.js";
+import"./index-zj6t9zgx.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {

package/dist/cli/{worktree-provisioning-owner-g24xd417.js → worktree-provisioning-owner-zzkjycp1.js}

@@ -5,12 +5,12 @@ import {
   recordWorktreeProvisioningOwner,
   removeWorktreeProvisioningOwner,
   scanWorktreeProvisioningOwnersForRecovery
-} from "./index-k3cxyk66.js";
-import"./index-rn0eq85g.js";
+} from "./index-cwtpqm5f.js";
+import"./index-fv0s19g9.js";
 import"./index-z6xqpmqg.js";
 import"./index-zjygnfay.js";
 import"./index-ed5ykebp.js";
-import"./index-4nt52yr9.js";
+import"./index-zj6t9zgx.js";
 import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {

package/dist/commands/ci-simulate.d.ts

@@ -22,10 +22,12 @@
 import * as fs from 'node:fs';
 import { detectDefaultRemoteBranch, getDefaultBaseBranch } from '../git/branch.js';
 import { runExternalTool } from '../utils/external-tool-runner.js';
+import { resolveGitExecutable } from '../utils/git-executable.js';
 export declare const _internals: {
     runExternalTool: typeof runExternalTool;
     getDefaultBaseBranch: typeof getDefaultBaseBranch;
     detectDefaultRemoteBranch: typeof detectDefaultRemoteBranch;
+    resolveGitExecutable: typeof resolveGitExecutable;
     platform: string;
     osTmpdir: () => string;
     fs: {

package/dist/commands/index.d.ts

@@ -46,6 +46,7 @@ export { handlePlanCommand } from './plan';
 export { handlePreflightCommand } from './preflight';
 export { handlePromoteCommand } from './promote';
 export { handleQaGatesCommand } from './qa-gates';
+export { handleRecoverCommand } from './recover';
 export { handleHelpCommand } from './registry';
 export type { CommandContext, CommandEntry, RegisteredCommand, } from './registry.js';
 export { COMMAND_REGISTRY, resolveCommand, VALID_COMMANDS, } from './registry.js';

package/dist/commands/recover.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Handles the /swarm recover command (issue #2268).
+ *
+ * The user-facing invoker for coder-settlement recovery. The wedge class this
+ * exists for: a DISPATCHED settlement WAL whose completion (toolAfter) never
+ * arrived — every dispatch retry is refused with CODER_SETTLEMENT_IN_PROGRESS
+ * / CODER_DISPATCH_IN_PROGRESS and internal sinks (update_task_status, /swarm
+ * close) are paused too. Safe mode recovers settlements whose owning process
+ * is gone; --force additionally releases ownership keys still held by THIS
+ * process (an operator assertion that no dispatch is genuinely in flight —
+ * a still-running dispatch's late completion will then fail settlement with
+ * CODER_SETTLEMENT_IDEMPOTENCY_CONFLICT, which is safe to ignore).
+ *
+ * Human-only by policy: agents already self-heal dead-owner settlements via
+ * update_task_status, and --force must stay an operator decision.
+ */
+export declare function handleRecoverCommand(directory: string, args: string[]): Promise<string>;

package/dist/commands/registry.d.ts

@@ -825,11 +825,19 @@ export declare const COMMAND_REGISTRY: {
     readonly 'reset-session': {
         readonly handler: (ctx: CommandContext) => Promise<string>;
         readonly description: "Clear session state while preserving plan, evidence, and knowledge";
-        readonly details: "Deletes only .swarm/session/state.json and any other session files. Clears in-memory agent sessions, delegation chains, and active-agent mappings. Preserves plan, evidence, and knowledge for cross-session continuity. Before deleting, auto-backs up the session files it removes to .swarm/reset-backups/<timestamp>/ (newest 5 kept).";
+        readonly details: "Deletes only .swarm/session/state.json and any other session files. Clears in-memory agent sessions, delegation chains, and active-agent mappings. Preserves plan, evidence, and knowledge for cross-session continuity. Also recovers stale coder settlements, releasing in-flight ownership held by this process, so dispatches cannot stay wedged on CODER_DISPATCH_IN_PROGRESS (issue #2268). Before deleting, auto-backs up the session files it removes to .swarm/reset-backups/<timestamp>/ (newest 5 kept).";
         readonly args: "";
         readonly category: "utility";
         readonly toolPolicy: "restricted";
     };
+    readonly recover: {
+        readonly handler: (ctx: CommandContext) => Promise<string>;
+        readonly description: "Recover wedged coder settlements [task_id] [--force]";
+        readonly details: "Settles stale coder-settlement WALs in .swarm/coder-settlements/ — the CODER_DISPATCH_IN_PROGRESS wedge where a dispatch's completion never fired (issue #2268). Safe mode recovers settlements whose owner process is gone. --force also releases ownership keys held by this process: use only when no dispatch is genuinely running (a late completion then reports CODER_SETTLEMENT_IDEMPOTENCY_CONFLICT, safe to ignore). Never interrupts another live OpenCode process. Human-only.";
+        readonly args: "[task_id] [--force]";
+        readonly category: "utility";
+        readonly toolPolicy: "human-only";
+    };
     readonly rollback: {
         readonly handler: (ctx: CommandContext) => Promise<string>;
         readonly description: "Restore swarm state or project files to a checkpoint";

package/dist/commands/reset-session.d.ts

@@ -1,3 +1,4 @@
+import { recoverStaleCoderSettlements } from '../workflow/coder-settlement.js';
 import { type OrphanCleanupResult } from '../worktree/merge';
 import { type ResetBackupResult } from './reset-backup';
 /**
@@ -9,6 +10,7 @@ import { type ResetBackupResult } from './reset-backup';
 export declare const _internals: {
     cleanupOrphanedBranches: (directory: string, activeSessionIds: string[]) => Promise<OrphanCleanupResult>;
     backupSwarmStateBeforeReset: (directory: string, kind: 'reset' | 'reset-session', relEntries: string[]) => ResetBackupResult;
+    recoverStaleCoderSettlements: typeof recoverStaleCoderSettlements;
 };
 /**
  * Handles the /swarm reset-session command.

package/dist/config/cache-paths.d.ts

@@ -63,3 +63,60 @@ export declare function getPluginCachePaths(): readonly string[];
  * be cleared during update/install to force a fresh resolution from npm.
  */
 export declare function getPluginLockFilePaths(): readonly string[];
+/**
+ * Anchored version-pinned cache leaf shape: `opencode-swarm@<semver>`, e.g.
+ * `opencode-swarm@7.143.1`, `opencode-swarm@1.2.3-rc.1`,
+ * `opencode-swarm@1.2.3+build.5`. Matches full `major.minor.patch` with
+ * optional pre-release and build-metadata segments (semver 2.0.0 grammar).
+ *
+ * Deliberately NOT a `startsWith('opencode-swarm@')` prefix test — that would
+ * admit a traversal payload like `opencode-swarm@../../..` as a "valid" leaf.
+ * The anchored `^...$` with only `[0-9A-Za-z.-]` permitted in the
+ * pre-release/build segments admits no path separator, NUL byte, whitespace,
+ * or non-ASCII character. Shared by the delete-time safety check
+ * (`isSafeCachePath` in `src/cli/index.ts`, applied AFTER canonicalization)
+ * and this module's own discovery function below, so both agree on exactly
+ * which leaves are "version-pinned opencode-swarm" without duplicating the
+ * pattern (issue #2236 RC3).
+ */
+export declare const VERSION_PINNED_LEAF: RegExp;
+/**
+ * Enumerate `packages/` parent directories for version-pinned opencode-swarm
+ * cache leaves (e.g. `opencode-swarm@7.143.1`) that {@link getPluginCachePaths}
+ * cannot discover — that list is fixed to the literal `opencode-swarm@latest`
+ * / `opencode-swarm` leaves, so a version-pinned OpenCode host install (issue
+ * #2236's reporter had `opencode-swarm@7.143.1`) is invisible to it.
+ *
+ * PERFORMS FILESYSTEM I/O (`readdirSync`). Callers MUST invoke this at
+ * COMMAND TIME only — never at module scope — to preserve AGENTS.md
+ * invariant 1 (plugin init must stay side-effect-minimal).
+ * {@link getPluginCachePaths} stays pure specifically so it can keep being
+ * called at module scope (`src/cli/index.ts:45`); this is the separate,
+ * impure counterpart invoked explicitly by `update()` (`src/cli/index.ts`)
+ * and the `/swarm diagnose` cache check (`src/services/diagnose-service.ts`).
+ *
+ * Returns full paths to matched entries. Does NOT apply the delete-time
+ * safety allowlist (`isSafeCachePath` in `src/cli/index.ts`) — callers that
+ * intend to delete a returned path MUST still run it through that check, and
+ * the check MUST run on the realpath-canonicalized string, exactly like every
+ * other cache-deletion call site.
+ */
+export declare function discoverVersionPinnedCachePaths(): string[];
+/**
+ * Resolve a cache path to its actual package root. Some OpenCode cache
+ * layouts nest the package under `<cachePath>/node_modules/opencode-swarm`;
+ * others ARE the package root directly. Shared by `evictPluginCaches`
+ * (`src/cli/index.ts`, to read the pre-deletion version) and the
+ * `/swarm diagnose` cache check (`src/services/diagnose-service.ts`) so both
+ * agree on where `package.json` lives for a given cache path, per issue
+ * #2236 RC3 ("don't duplicate the version-reading logic").
+ */
+export declare function resolveCachePackageRoot(cachePath: string): string;
+/**
+ * Best-effort read of the installed opencode-swarm version at a cache path.
+ * Returns `null` (never throws) if `package.json` is missing, unreadable, or
+ * unparsable — this feeds human-readable console/diagnostic reporting, not a
+ * safety decision, so a version that can't be determined must degrade
+ * gracefully rather than abort the caller's eviction/diagnosis loop.
+ */
+export declare function readCachePackageVersion(cachePath: string): string | null;

package/dist/config/evidence-schema.d.ts

@@ -220,10 +220,10 @@ export declare const RetrospectiveEvidenceSchema: z.ZodObject<{
     user_directives: z.ZodDefault<z.ZodArray<z.ZodObject<{
         directive: z.ZodString;
         category: z.ZodEnum<{
+            other: "other";
             process: "process";
             architecture: "architecture";
             tooling: "tooling";
-            other: "other";
             code_style: "code_style";
         }>;
         scope: z.ZodEnum<{
@@ -743,10 +743,10 @@ export declare const EvidenceSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     user_directives: z.ZodDefault<z.ZodArray<z.ZodObject<{
         directive: z.ZodString;
         category: z.ZodEnum<{
+            other: "other";
             process: "process";
             architecture: "architecture";
             tooling: "tooling";
-            other: "other";
             code_style: "code_style";
         }>;
         scope: z.ZodEnum<{
@@ -1233,10 +1233,10 @@ export declare const EvidenceBundleSchema: z.ZodObject<{
         user_directives: z.ZodDefault<z.ZodArray<z.ZodObject<{
             directive: z.ZodString;
             category: z.ZodEnum<{
+                other: "other";
                 process: "process";
                 architecture: "architecture";
                 tooling: "tooling";
-                other: "other";
                 code_style: "code_style";
             }>;
             scope: z.ZodEnum<{

package/dist/config/schema.d.ts

@@ -462,6 +462,10 @@ export declare const DesignDocsConfigSchema: z.ZodObject<{
     language: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type DesignDocsConfig = z.infer<typeof DesignDocsConfigSchema>;
+export declare const GitConfigSchema: z.ZodObject<{
+    binary: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type GitConfig = z.infer<typeof GitConfigSchema>;
 export declare const UIReviewConfigSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     trigger_paths: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -550,6 +554,7 @@ export declare const GuardrailsConfigSchema: z.ZodObject<{
     execution_stall_warn_calls: z.ZodDefault<z.ZodNumber>;
     execution_stall_stop_calls: z.ZodDefault<z.ZodNumber>;
     execution_stall_episode_minutes: z.ZodDefault<z.ZodNumber>;
+    sandbox_macos_enabled: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type GuardrailsConfig = z.infer<typeof GuardrailsConfigSchema>;
 export declare const WatchdogConfigSchema: z.ZodObject<{
@@ -1917,6 +1922,7 @@ export declare const PluginConfigSchema: z.ZodObject<{
         execution_stall_warn_calls: z.ZodDefault<z.ZodNumber>;
         execution_stall_stop_calls: z.ZodDefault<z.ZodNumber>;
         execution_stall_episode_minutes: z.ZodDefault<z.ZodNumber>;
+        sandbox_macos_enabled: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     watchdog: z.ZodOptional<z.ZodObject<{
         scope_guard: z.ZodDefault<z.ZodBoolean>;
@@ -2046,6 +2052,9 @@ export declare const PluginConfigSchema: z.ZodObject<{
         out_dir: z.ZodDefault<z.ZodString>;
         language: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
+    git: z.ZodOptional<z.ZodObject<{
+        binary: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
     ui_review: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         trigger_paths: z.ZodDefault<z.ZodArray<z.ZodString>>;

package/dist/git/branch.d.ts

@@ -1,4 +1,5 @@
 import * as child_process from 'node:child_process';
+import { resolveGitExecutable } from '../utils/git-executable.js';
 export type GitRepositoryStatus = {
     isRepo: true;
 } | {
@@ -201,5 +202,6 @@ export declare const _internals: {
     resetToMainAfterMerge: typeof resetToMainAfterMerge;
     spawnSync: typeof __spawnSyncSeam.spawnSync;
     readLaneEnvFileFromDiskSync: typeof readLaneEnvFileFromDiskSync;
+    resolveGitExecutable: typeof resolveGitExecutable;
 };
 export {};

package/dist/git/pr.d.ts

@@ -1,4 +1,5 @@
 import * as child_process from 'node:child_process';
+import { resolveGhBinary } from '../tools/gh-evidence.js';
 import { readLaneEnvFileFromDiskSync } from './branch.js';
 export declare const GIT_TIMEOUT_MS = 30000;
 /**
@@ -70,6 +71,7 @@ export declare const _internals: {
     spawnSync: typeof __spawnSyncSeam.spawnSync;
     readLaneEnvFileFromDiskSync: typeof readLaneEnvFileFromDiskSync;
     getMergeGroupRun: typeof getMergeGroupRun;
+    resolveGhBinary: typeof resolveGhBinary;
 };
 /**
  * Check if gh CLI is available

package/dist/hooks/context-budget.d.ts

@@ -6,6 +6,7 @@
  * to provide proactive context management guidance to the architect agent.
  */
 import type { PluginConfig } from '../config';
+import { telemetry } from '../telemetry';
 interface MessageInfo {
     role: string;
     agent?: string;
@@ -31,6 +32,9 @@ interface MessageWithParts {
     info: MessageInfo;
     parts: MessagePart[];
 }
+export declare const _internals: {
+    telemetryContextPruned: typeof telemetry.contextPruned;
+};
 /**
  * Creates the experimental.chat.messages.transform hook for context budget tracking.
  * Injects warnings when context usage exceeds configured thresholds.

package/dist/hooks/context-usage.d.ts

@@ -0,0 +1,48 @@
+export interface ContextUsageMessageInfo {
+    role?: string;
+    tokens?: {
+        input?: unknown;
+        cache?: {
+            read?: unknown;
+            write?: unknown;
+        };
+    };
+    [key: string]: unknown;
+}
+export interface ContextUsageMessagePart {
+    type?: string;
+    text?: string;
+    state?: {
+        status?: string;
+        input?: unknown;
+        output?: string;
+        error?: string;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface ContextUsageMessage {
+    info?: ContextUsageMessageInfo;
+    parts?: ContextUsageMessagePart[];
+}
+export type ContextUsageSource = 'provider' | 'estimated';
+export interface ContextUsageResult {
+    tokensUsed: number;
+    source: ContextUsageSource;
+    assistantAnchorIndex: number | null;
+}
+export declare function serializeToolInput(input: unknown): string;
+export declare function estimateToolInputTokens(input: unknown): number;
+export declare function getVisibleToolPartText(part: ContextUsageMessagePart): string;
+export declare function estimateVisibleToolPartTokens(part: ContextUsageMessagePart): number;
+export declare function estimateMessageTokens(message: ContextUsageMessage): number;
+export declare function readProviderPromptTokens(message: ContextUsageMessage | undefined): number | undefined;
+export declare function computeContextUsage(messages: ContextUsageMessage[] | undefined): ContextUsageResult;
+export declare const _test_exports: {
+    computeContextUsage: typeof computeContextUsage;
+    estimateToolInputTokens: typeof estimateToolInputTokens;
+    estimateVisibleToolPartTokens: typeof estimateVisibleToolPartTokens;
+    estimateMessageTokens: typeof estimateMessageTokens;
+    readProviderPromptTokens: typeof readProviderPromptTokens;
+    serializeToolInput: typeof serializeToolInput;
+};

package/dist/hooks/delegation-gate/worktree-isolation.d.ts

@@ -11,6 +11,7 @@
 import type { PluginConfig, WorktreeIsolationConfig } from '../../config';
 import { tryAcquireLock } from '../../parallel/file-locks';
 import { bunSpawn } from '../../utils/bun-compat';
+import { resolveGitExecutable } from '../../utils/git-executable.js';
 import type { WorktreeHandle } from '../../worktree';
 import { attemptMergeBackFromDirty, cleanupOrphanedBranches, postMergeCleanup, provisionWorktree, pruneStaleWorktreeMetadata, removeWorktree, startupOrphanRecovery } from '../../worktree';
 import type { DirtyMergeOptions, MergeOperationProvenance } from '../../worktree/merge';
@@ -338,4 +339,10 @@ export declare const _internals: {
     isLaneOwnedByCurrentSession: typeof isLaneOwnedByCurrentSession;
     /** FR-001b: bunSpawn — exposed for test injection so collision check can be mocked. */
     bunSpawn: typeof bunSpawn;
+    /**
+     * Issue #2236 hardening (F1/F4/F5) — resolves the absolute git executable
+     * path instead of spawning the bare `'git'` name. Exposed for test
+     * injection following the `src/worktree/core.ts` convention.
+     */
+    resolveGitExecutable: typeof resolveGitExecutable;
 };

package/dist/hooks/diff-scope.d.ts

@@ -5,6 +5,7 @@
  * Never throws.
  */
 import { bunSpawn } from '../utils/bun-compat';
+import { resolveGitExecutable } from '../utils/git-executable.js';
 /**
  * Test-only dependency-injection seam — see `gitignore-warning.ts:_internals`
  * for the rationale (`mock.module` from `bun:test` leaks across files in
@@ -13,6 +14,12 @@ import { bunSpawn } from '../utils/bun-compat';
  */
 export declare const _internals: {
     bunSpawn: typeof bunSpawn;
+    /**
+     * Test seam for git binary resolution (issue #2236 hardening, lane C1b).
+     * This hook is not on the plugin init path, so the synchronous resolver
+     * is used (unlike `gitignore-warning.ts`, which must use the async one).
+     */
+    resolveGitExecutable: typeof resolveGitExecutable;
 };
 /**
  * Validate that git-changed files match the declared scope for a task.

package/dist/hooks/pr-workflow-gate.d.ts

@@ -2,7 +2,7 @@ import * as fsp from 'node:fs/promises';
 import { z } from 'zod';
 import { type CandidateSeverity, type RowFormatFamily } from '../background/candidate-contract.js';
 import { type LaneOutputArtifact } from '../background/lane-output-store.js';
-import { type BackgroundDelegationRecord, type BackgroundDelegationResult, findByBatchId, sweepStaleDelegations } from '../background/pending-delegations.js';
+import { type BackgroundDelegationRecord, type BackgroundDelegationResult, type BackgroundDelegationWorkflowLaneRecovery, findByBatchId, sweepStaleDelegations } from '../background/pending-delegations.js';
 import { type PrReviewInlineTriggerRow } from '../background/pr-review-trigger-contract.js';
 import { type RevisionDigestResult, resolveCommitCountSince, resolveCommitCountSinceAsync, resolveCurrentGitHead, resolveCurrentGitHeadAsync, resolveCurrentUpstreamPushTarget, resolveCurrentUpstreamPushTargetAsync, resolveCurrentUpstreamRemoteRef, resolveExactRemoteBranchHead, resolveExactRemoteBranchHeadAsync, resolveIsExactSingleChildCommit, resolveIsExactSingleChildCommitAsync, resolveIsWorkingTreeClean, resolveIsWorkingTreeCleanAsync, resolvePrReviewDiffStats, resolvePrReviewDiffStatsAsync, resolvePrWorkflowRevisionDigest, resolvePrWorkflowRevisionDigestDetailed, resolveRemoteRefsContainingHead, resolveRemoteRefsContainingHeadAsync } from '../background/workspace-snapshot.js';
 import { classifyPrWorkflowGitState, type PrWorkflowGitState } from '../git/pr-workflow-state.js';
@@ -10,7 +10,7 @@ export declare const PR_REVIEW_BASE_DIMENSION_IDS: readonly ["intent-architectur
 export declare const PR_REVIEW_REQUIRED_MICRO_LANE_IDS: ("auth-identity-secrets" | "untrusted-input-boundaries" | "subprocess-platform" | "concurrency-state" | "dependencies-build-release" | "api-schema-migrations" | "test-infrastructure" | "ui-accessibility-i18n" | "privacy-observability" | "generated-provenance" | "unclassified-risk")[];
 export type PrReviewBaseDimensionId = (typeof PR_REVIEW_BASE_DIMENSION_IDS)[number];
 export type PrWorkflowMode = 'PR_REVIEW' | 'PR_FEEDBACK';
-export type PrReviewLaneValidationPredicate = 'batch.validated_at' | 'batch.expected_lane_unique' | 'record.missing' | 'record.duplicate_lane' | 'record.subagent_session_id' | 'record.duplicate_subagent_session_id' | 'record.forbidden_subagent_session_id' | 'record.created_at' | 'record.workflow_lane' | 'record.owned_workflow_lanes' | 'record.mode' | 'record.pr_head_sha' | 'record.git_head' | 'record.status' | 'result.output_degraded' | 'result.transcript_incomplete' | 'result.truncated' | 'result.chars' | 'result.digest' | 'result.output_ref' | 'artifact.readable' | 'artifact.ref' | 'artifact.batch_id' | 'artifact.lane_id' | 'artifact.mode' | 'artifact.session_id' | 'artifact.parent_session_id' | 'artifact.agent' | 'artifact.role' | 'artifact.source' | 'artifact.workflow_lane_record' | 'artifact.workflow_lane_expected' | 'artifact.pr_head_sha' | 'artifact.git_head' | 'artifact.revision_digest' | 'record.scope' | 'artifact.scope' | 'artifact.digest' | 'artifact.chars' | 'discovery.header' | 'discovery.row' | 'discovery.coverage' | 'discovery.duplicate_evidence';
+export type PrReviewLaneValidationPredicate = 'batch.validated_at' | 'batch.expected_lane_unique' | 'record.missing' | 'record.duplicate_lane' | 'record.subagent_session_id' | 'record.duplicate_subagent_session_id' | 'record.forbidden_subagent_session_id' | 'record.created_at' | 'record.workflow_lane' | 'record.owned_workflow_lanes' | 'record.mode' | 'record.pr_head_sha' | 'record.git_head' | 'record.status' | 'result.output_degraded' | 'result.transcript_incomplete' | 'result.chars' | 'result.digest' | 'result.output_ref' | 'artifact.readable' | 'artifact.ref' | 'artifact.batch_id' | 'artifact.lane_id' | 'artifact.mode' | 'artifact.session_id' | 'artifact.parent_session_id' | 'artifact.agent' | 'artifact.role' | 'artifact.source' | 'artifact.workflow_lane_record' | 'artifact.workflow_lane_expected' | 'artifact.pr_head_sha' | 'artifact.git_head' | 'artifact.revision_digest' | 'record.scope' | 'artifact.scope' | 'artifact.digest' | 'artifact.chars' | 'discovery.header' | 'discovery.row' | 'discovery.coverage' | 'discovery.duplicate_evidence';
 export interface PrReviewLaneValidationFailure {
     predicate: PrReviewLaneValidationPredicate;
     expected: string;
@@ -25,6 +25,8 @@ export type PrReviewLaneValidationResult = {
      * distinguishable from a well-formed one.
      */
     salvaged?: readonly string[];
+    /** Typed recovery disclosures persisted to the durable delegation ledger. */
+    recoveries?: readonly BackgroundDelegationWorkflowLaneRecovery[];
 } | {
     ok: false;
     failure: PrReviewLaneValidationFailure;
@@ -44,6 +46,20 @@ export interface PrReviewDiscoveryLaneValidationInput {
         checkWorkflowLane?: boolean;
     };
 }
+export interface PrWorkflowTransportRecoveryValidationInput {
+    directory: string;
+    record: BackgroundDelegationRecord;
+    result: BackgroundDelegationResult;
+    artifact: LaneOutputArtifact | null;
+    revisionDigest: string;
+}
+export type PrWorkflowTransportRecoveryValidationResult = {
+    ok: true;
+    recoveries?: readonly BackgroundDelegationWorkflowLaneRecovery[];
+} | {
+    ok: false;
+    reason: string;
+};
 export interface PrWorkflowCheckoutRecoveryRecord {
     code: 'UNMERGED_INDEX' | 'GIT_OPERATION_IN_PROGRESS' | 'DIRTY_SUBMODULE' | 'SWARM_STATE_TRACKING_ERROR' | 'GIT_STATE_INDETERMINATE';
     retryable: false;
@@ -1047,6 +1063,17 @@ declare function analyzePrReviewBatchRecordIntegrity(args: {
  * accidentally accept stale terminal state or a different output reference.
  */
 export declare function validatePrReviewDiscoveryLaneCompletion(input: PrReviewDiscoveryLaneValidationInput): PrReviewLaneValidationResult;
+/**
+ * Collection-time proof for transport-recovered structured workflow lanes.
+ *
+ * Reviewer/critic/PR-feedback lanes normally settle later through the workflow
+ * gate, not in `collect_lane_results`, so a truncated inline preview used to
+ * pass through collection with no durable typed provenance. This helper proves
+ * the durable artifact still carries the exact rows the already-declared batch
+ * owns, allowing collection to persist the transport recovery immediately. Any
+ * unsupported or unprovable structured mode fails closed.
+ */
+export declare function validatePrWorkflowTransportRecovery(input: PrWorkflowTransportRecoveryValidationInput): Promise<PrWorkflowTransportRecoveryValidationResult>;
 /** Require at least one semantically valid discovery row or CLEAN attestation. */
 export declare function prReviewDiscoveryArtifactCoversLane(text: string, expectedWorkflowLane: string, ownedWorkflowLanes?: readonly string[], mode?: string): boolean;
 /**

package/dist/hooks/review-receipt-scope.d.ts

@@ -17,6 +17,7 @@
  */
 import * as child_process from 'node:child_process';
 import * as fs from 'node:fs';
+import { resolveGitExecutable } from '../utils/git-executable.js';
 export declare const REVIEWER_TASK_SCOPE_DESCRIPTION = "reviewer-task-files-v2";
 export declare const REVIEWER_TASK_SCOPE_HEADER = "opencode-swarm-reviewer-task-scope-v2";
 export interface ReviewerTaskScopeDeliveryEntry {
@@ -82,6 +83,12 @@ export declare function resolveReviewerScopeTaskId(directory: string, args: unkn
 export declare const _internals: {
     spawn: typeof child_process.spawn;
     realpath: typeof fs.promises.realpath;
+    /**
+     * Issue #2236 hardening (F1/F4/F5) — resolves the absolute git executable
+     * path instead of spawning the bare `'git'` name. Exposed for test
+     * injection following the `src/worktree/core.ts` convention.
+     */
+    resolveGitExecutable: typeof resolveGitExecutable;
 };
 /**
  * Build the exact reviewer-task manifest for a guardrails-observed file list.