opencode-swarm 7.152.1 → 7.153.1

package/dist/config/schema.d.ts

@@ -555,11 +555,25 @@ export declare const GuardrailsConfigSchema: z.ZodObject<{
     execution_stall_stop_calls: z.ZodDefault<z.ZodNumber>;
     execution_stall_episode_minutes: z.ZodDefault<z.ZodNumber>;
     sandbox_macos_enabled: z.ZodOptional<z.ZodBoolean>;
+    sandbox: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodDefault<z.ZodEnum<{
+            advisory: "advisory";
+            required: "required";
+        }>>;
+        require_filesystem: z.ZodDefault<z.ZodBoolean>;
+        require_network: z.ZodDefault<z.ZodBoolean>;
+        require_process: z.ZodDefault<z.ZodBoolean>;
+        network_mode: z.ZodDefault<z.ZodEnum<{
+            on: "on";
+            off: "off";
+        }>>;
+        network_allowlist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        writable_roots: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type GuardrailsConfig = z.infer<typeof GuardrailsConfigSchema>;
 export declare const WatchdogConfigSchema: z.ZodObject<{
     scope_guard: z.ZodDefault<z.ZodBoolean>;
-    skip_in_turbo: z.ZodDefault<z.ZodBoolean>;
     delegation_ledger: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;
 export type WatchdogConfig = z.infer<typeof WatchdogConfigSchema>;
@@ -1281,9 +1295,9 @@ export declare const WorktreeIsolationConfigSchema: z.ZodObject<{
         copy: "copy";
     }>>;
     lane_permissions: z.ZodDefault<z.ZodEnum<{
+        off: "off";
         scoped_allow: "scoped_allow";
         deny: "deny";
-        off: "off";
     }>>;
     serialization_release_after_dispatches: z.ZodDefault<z.ZodNumber>;
     serialization_release_after_ms: z.ZodDefault<z.ZodNumber>;
@@ -1742,6 +1756,13 @@ export interface PrReviewResilienceConfig {
     correlated_failure_threshold: number;
     max_retry_attempts_after_initial: number;
 }
+/**
+ * Issue #2381: staged PR-review resilience defaults OFF while the #2380 repair
+ * program is incomplete. Tier M/L base waves therefore use the legacy one-wave
+ * dispatch unless a project explicitly opts in with `enabled: true`, which
+ * remains fully honored. The tracker re-enables this by default only after its
+ * host/OS/depth validation matrix is green.
+ */
 export declare const DEFAULT_PR_REVIEW_RESILIENCE_CONFIG: PrReviewResilienceConfig;
 export declare const PrReviewResilienceConfigSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
@@ -1960,10 +1981,24 @@ export declare const PluginConfigSchema: z.ZodObject<{
         execution_stall_stop_calls: z.ZodDefault<z.ZodNumber>;
         execution_stall_episode_minutes: z.ZodDefault<z.ZodNumber>;
         sandbox_macos_enabled: z.ZodOptional<z.ZodBoolean>;
+        sandbox: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodDefault<z.ZodEnum<{
+                advisory: "advisory";
+                required: "required";
+            }>>;
+            require_filesystem: z.ZodDefault<z.ZodBoolean>;
+            require_network: z.ZodDefault<z.ZodBoolean>;
+            require_process: z.ZodDefault<z.ZodBoolean>;
+            network_mode: z.ZodDefault<z.ZodEnum<{
+                on: "on";
+                off: "off";
+            }>>;
+            network_allowlist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            writable_roots: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     watchdog: z.ZodOptional<z.ZodObject<{
         scope_guard: z.ZodDefault<z.ZodBoolean>;
-        skip_in_turbo: z.ZodDefault<z.ZodBoolean>;
         delegation_ledger: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
     self_review: z.ZodOptional<z.ZodObject<{
@@ -2594,9 +2629,9 @@ export declare const PluginConfigSchema: z.ZodObject<{
             copy: "copy";
         }>>;
         lane_permissions: z.ZodDefault<z.ZodEnum<{
+            off: "off";
             scoped_allow: "scoped_allow";
             deny: "deny";
-            off: "off";
         }>>;
         serialization_release_after_dispatches: z.ZodDefault<z.ZodNumber>;
         serialization_release_after_ms: z.ZodDefault<z.ZodNumber>;

package/dist/consensus/contracts.d.ts

@@ -12,6 +12,7 @@
  * without forcing consumers to read Zod inference to learn the shape.
  */
 import { z } from 'zod';
+import type { WriteAuthorityOrigin } from '../security/write-authority.js';
 /** Upper bound on any single reference list. Keeps a report bounded on disk. */
 export declare const MAX_CONSENSUS_REFS = 200;
 /**
@@ -234,6 +235,7 @@ export interface ProposedSkillChangeProvenance {
     writeOrigin: {
         sessionId?: string;
         agentRole?: string;
+        authority?: WriteAuthorityOrigin;
         producedAt: string;
     };
 }
@@ -258,6 +260,12 @@ export declare const ProposedSkillChangeSchema: z.ZodObject<{
         writeOrigin: z.ZodObject<{
             sessionId: z.ZodOptional<z.ZodString>;
             agentRole: z.ZodOptional<z.ZodString>;
+            authority: z.ZodOptional<z.ZodEnum<{
+                critic_approved: "critic_approved";
+                autonomous: "autonomous";
+                optimizer_proposed: "optimizer_proposed";
+                human_approved: "human_approved";
+            }>>;
             producedAt: z.ZodISODateTime;
         }, z.core.$strict>;
     }, z.core.$strict>;
@@ -420,6 +428,12 @@ export declare const ConsensusReportV1Schema: z.ZodObject<{
             writeOrigin: z.ZodObject<{
                 sessionId: z.ZodOptional<z.ZodString>;
                 agentRole: z.ZodOptional<z.ZodString>;
+                authority: z.ZodOptional<z.ZodEnum<{
+                    critic_approved: "critic_approved";
+                    autonomous: "autonomous";
+                    optimizer_proposed: "optimizer_proposed";
+                    human_approved: "human_approved";
+                }>>;
                 producedAt: z.ZodISODateTime;
             }, z.core.$strict>;
         }, z.core.$strict>;

package/dist/consensus/corpus.d.ts

@@ -81,6 +81,7 @@ import { type GateAuditReadSummary } from '../evaluation/store.js';
 import { type LoadEvidenceResult } from '../evidence/manager.js';
 import type { RetrievalOutcome } from '../hooks/knowledge-types.js';
 import { readSkillUsageEntries, type readSkillUsageEntriesWithCoverage } from '../hooks/skill-usage-log.js';
+import { type TrajectoryReadWithCoverage } from '../prm/trajectory-store.js';
 import type { TrajectoryEntry } from '../prm/types.js';
 import type { ConsensusCorpusHash, ConsensusSourceKind } from './contracts.js';
 /**
@@ -129,6 +130,21 @@ export interface CorpusReaders {
     readTaskTrajectory: (directory: string, taskId: string) => Promise<TrajectoryEntry[]>;
     listTrajectorySessions: (directory: string) => Promise<string[]>;
     readTrajectory: (sessionId: string, directory: string) => Promise<TrajectoryEntry[]>;
+    /**
+     * Additive coverage seam (issue #2041 Required 4), mirroring
+     * `readSkillUsageEntriesWithCoverage` above: optional, deliberately NOT
+     * part of `defaultReaders()`, and injecting it overrides BOTH the entries
+     * and the coverage verdict so an injected fixture stays coherent.
+     *
+     * Without it, entries keep coming from `readTrajectory` (injected fixtures
+     * keep working) and the default coverage verdict comes from the session's
+     * persisted checkpoint (`readTrajectoryCheckpoint`) — the same
+     * manifest-only precedent the skill-usage source uses. The default path's
+     * known limit mirrors that precedent too: it discloses compaction eviction
+     * (`droppedEntries`) but not a single read that hit the tail-window byte
+     * cap, which for a within-budget store is unreachable.
+     */
+    readTrajectoryWithCoverage?: (sessionId: string, directory: string) => Promise<TrajectoryReadWithCoverage>;
     readSkillUsageEntries: typeof readSkillUsageEntries;
     /**
      * Additive coverage seam (issue #2038 §7). Optional, and deliberately NOT

package/dist/hooks/delegation-gate/worktree-isolation.d.ts

@@ -13,9 +13,12 @@ import { tryAcquireLock } from '../../parallel/file-locks';
 import { bunSpawn } from '../../utils/bun-compat';
 import { resolveGitExecutable } from '../../utils/git-executable.js';
 import type { WorktreeHandle } from '../../worktree';
-import { attemptMergeBackFromDirty, cleanupOrphanedBranches, postMergeCleanup, provisionWorktree, pruneStaleWorktreeMetadata, removeWorktree, startupOrphanRecovery } from '../../worktree';
-import type { DirtyMergeOptions, MergeOperationProvenance } from '../../worktree/merge';
+import { attemptMergeBackFromDirty, cleanupOrphanedBranches, postMergeCleanup, provisionWorktree, pruneStaleWorktreeMetadata, recoverMergeBackFromImmutableCoordinates, removeWorktree, startupOrphanRecovery } from '../../worktree';
+import type { DirtyMergeOptions, ImmutableMergeRecoveryCoordinates, MergeOperationProvenance } from '../../worktree/merge';
+import type { WorktreeProvisioningOwnerRemovalIdentity } from './worktree-provisioning-owner';
 import { recordWorktreeProvisioningOwner, removeWorktreeProvisioningOwner } from './worktree-provisioning-owner';
+import type { WorktreeRecoveryImmutableIdentityInput } from './worktree-recovery-authority';
+import { claimWorktreeRecoveryAuthority, finalizeWorktreeRecoveryAuthority, lookupWorktreeRecoveryAuthoritiesByTask, publishWorktreeRecoveryAuthority, releaseWorktreeRecoveryClaim, renewWorktreeRecoveryClaim, replayWorktreeRecoveryClaimJournal } from './worktree-recovery-authority';
 /**
  * FR-201: Per-lane runtime profile injected into spawned child processes.
  *
@@ -59,8 +62,23 @@ export interface StandardWorktreeDispatch {
     parentSessionID: string;
     taskId: string;
     planTaskId?: string;
+    reservationId?: string;
+    generation?: number;
+    provisioningOwner?: WorktreeProvisioningOwnerRemovalIdentity;
+    canonicalBranch?: string;
+    canonicalPath?: string;
     handle: WorktreeHandle;
     mergeStrategy: 'merge' | 'rebase' | 'cherry-pick';
+    recoveryClaim?: {
+        authorityDigest: string;
+        claimRevision: number;
+        rawToken: string;
+        coordinates?: ImmutableMergeRecoveryCoordinates;
+        settlement?: {
+            sourceCommitOrder: string[];
+            rewrittenCommitOrder: string[];
+        };
+    };
     /** FR-201: 0-based lane index for runtime profile derivation. */
     laneIndex: number;
     /** Configured worktree-dir override, so cleanup trusts the same base. */
@@ -102,6 +120,9 @@ export interface AwaitingMergeRecord {
     parentSessionID: string;
     taskId: string;
     planTaskId?: string;
+    /** Exact durable launch identity threaded from the delegation gate. */
+    reservationId?: string;
+    generation?: number;
     branch: string;
     worktreePath: string;
     mergeStrategy: 'merge' | 'rebase' | 'cherry-pick';
@@ -125,6 +146,11 @@ interface SessionSerializationState {
      */
     successfulDispatchesSince: number;
 }
+interface CleanupStandardWorktreeResult {
+    removedWorktree: boolean;
+    cleanedBranch: boolean;
+    preservedRecoveryLane: boolean;
+}
 export declare function getStandardWorktreeDegradationReason(sessionID: string): {
     reason: string;
     at: number;
@@ -187,6 +213,13 @@ declare function inspectStandardWorktreeCollisionOwnership(identity: {
     branchName: string;
     worktreePath: string;
 }): Promise<import("./worktree-collision-ownership").StandardWorktreeCollisionOwnership>;
+declare function buildWorktreeRecoveryPublishIdentity(input: {
+    directory: string;
+    dispatch: StandardWorktreeDispatch;
+    taskId: string;
+    provenance: MergeOperationProvenance;
+    conflictFiles?: string[];
+}): Promise<WorktreeRecoveryImmutableIdentityInput | undefined>;
 export declare function precreateStandardWorktreeSession(args: {
     config: PluginConfig;
     directory: string;
@@ -194,6 +227,9 @@ export declare function precreateStandardWorktreeSession(args: {
     callID: string;
     taskId: string;
     planTaskId?: string;
+    /** Exact durable launch identity threaded from the delegation gate. */
+    reservationId?: string;
+    generation?: number;
     description?: string;
     outputArgs: Record<string, unknown>;
     /** Scope to materialize into the lane for durability across restart (FR-102). */
@@ -264,7 +300,7 @@ export declare function preserveDirtyWorktreeAtPath(worktreePath: string, branch
  * @param directory - The project root (required for git worktree/branch commands).
  * @param worktree_dir - Configured worktree-dir override.
  */
-export declare function cleanupStandardWorktreeForCallId(callID: string, reason: 'success' | 'denied' | 'cancelled', directory: string, worktree_dir?: string): Promise<void>;
+export declare function cleanupStandardWorktreeForCallId(callID: string, reason: 'success' | 'denied' | 'cancelled', directory: string, worktree_dir?: string): Promise<CleanupStandardWorktreeResult>;
 /**
  * FR-001a: Abort an in-flight standard worktree dispatch.
  *
@@ -310,6 +346,7 @@ export declare const _internals: {
     provisionWorktree: typeof provisionWorktree;
     removeWorktree: typeof removeWorktree;
     attemptMergeBackFromDirty: typeof attemptMergeBackFromDirty;
+    recoverMergeBackFromImmutableCoordinates: typeof recoverMergeBackFromImmutableCoordinates;
     postMergeCleanup: typeof postMergeCleanup;
     pruneStaleWorktreeMetadata: typeof pruneStaleWorktreeMetadata;
     /** FR-201: read lane runtime profile from disk for spawn injection. */
@@ -335,8 +372,18 @@ export declare const _internals: {
     tryAcquireWorktreeLifecycleLock: typeof tryAcquireLock;
     recordWorktreeProvisioningOwner: typeof recordWorktreeProvisioningOwner;
     removeWorktreeProvisioningOwner: typeof removeWorktreeProvisioningOwner;
+    lookupWorktreeRecoveryAuthoritiesByTask: typeof lookupWorktreeRecoveryAuthoritiesByTask;
+    claimWorktreeRecoveryAuthority: typeof claimWorktreeRecoveryAuthority;
+    renewWorktreeRecoveryClaim: typeof renewWorktreeRecoveryClaim;
+    releaseWorktreeRecoveryClaim: typeof releaseWorktreeRecoveryClaim;
+    finalizeWorktreeRecoveryAuthority: typeof finalizeWorktreeRecoveryAuthority;
+    publishWorktreeRecoveryAuthority: typeof publishWorktreeRecoveryAuthority;
+    replayWorktreeRecoveryClaimJournal: typeof replayWorktreeRecoveryClaimJournal;
+    buildWorktreeRecoveryPublishIdentity: typeof buildWorktreeRecoveryPublishIdentity;
     /** FR-001b SC-004: path-based dirty worktree preservation for stale-lane fallback. */
     preserveDirtyWorktreeAtPath: typeof preserveDirtyWorktreeAtPath;
+    /** Bounded lane session.create timeout (tests may override). */
+    worktreeSessionCreateTimeoutMs: number;
     /** FR-001a: abort entry point for in-flight dispatches. */
     abortStandardWorktreeDispatch: typeof abortStandardWorktreeDispatch;
     standardWorktreeByCallID: Map<string, StandardWorktreeDispatch>;

package/dist/hooks/delegation-gate/worktree-provisioning-owner.d.ts

@@ -5,15 +5,36 @@
  */
 export declare const WORKTREE_PROVISIONING_OWNER_LEASE_MS: number;
 export declare const WORKTREE_LIFECYCLE_LOCK_FILE = ".swarm/locks/init-orphan-recovery.lock";
+export declare const WORKTREE_PROVISIONING_LIFECYCLE_STATES: readonly ["OWNER_PUBLISHED", "OWNER_REMOVED"];
+export type WorktreeProvisioningLifecycleState = (typeof WORKTREE_PROVISIONING_LIFECYCLE_STATES)[number];
 export interface WorktreeProvisioningOwner {
-    schemaVersion: 1 | 2;
+    schemaVersion: 1 | 2 | 3;
     callID: string;
     parentSessionId: string;
     worktreeSessionId: string;
     /** Added in v2 so restart collision checks can identify the exact lane. */
     taskId?: string;
+    /** Added in v3 so restart recovery can correlate the exact reservation. */
+    reservationId?: string;
+    /** Added in v3 so restart recovery can fence same-task retries. */
+    generation?: number;
+    /** Added in v3 so crash recovery can corroborate the exact lane ref. */
+    branchName?: string;
     createdAt: number;
 }
+export type WorktreeProvisioningOwnerRemovalIdentity = Pick<WorktreeProvisioningOwner, 'reservationId' | 'generation' | 'branchName'>;
+export interface WorktreeProvisioningLifecycleEntry {
+    schemaVersion: 1;
+    state: WorktreeProvisioningLifecycleState;
+    callID: string;
+    parentSessionId: string;
+    worktreeSessionId: string;
+    taskId?: string;
+    reservationId?: string;
+    generation?: number;
+    branchName?: string;
+    recordedAt: number;
+}
 export type WorktreeProvisioningOwnerScan = {
     status: 'ok';
     owners: WorktreeProvisioningOwner[];
@@ -21,6 +42,16 @@ export type WorktreeProvisioningOwnerScan = {
     status: 'uncertain';
     reason: string;
 };
+export type WorktreeProvisioningLifecycleJournalScan = {
+    status: 'ok';
+    entries: WorktreeProvisioningLifecycleEntry[];
+} | {
+    status: 'uncertain';
+    reason: string;
+};
+declare function ownerPath(directory: string, callID: string): string;
+declare function journalPath(directory: string): string;
+declare function readOwner(directory: string, callID: string): WorktreeProvisioningOwner | null;
 /**
  * Publish a provisional owner before a standard worktree can be created.
  * Callers hold the shared orphan-recovery lifecycle lock during this atomic
@@ -28,9 +59,16 @@ export type WorktreeProvisioningOwnerScan = {
  */
 export declare function recordWorktreeProvisioningOwner(directory: string, input: Omit<WorktreeProvisioningOwner, 'schemaVersion' | 'createdAt'>): WorktreeProvisioningOwner;
 /** Remove a provisional owner only after durable ownership or cleanup exists. */
-export declare function removeWorktreeProvisioningOwner(directory: string, callID: string): boolean;
+export declare function removeWorktreeProvisioningOwner(directory: string, callID: string, expected?: WorktreeProvisioningOwnerRemovalIdentity): boolean;
 /**
  * Strict recovery scan. Anything except ENOENT is uncertainty because omitting
  * one marker could allow destructive cleanup to race a live worktree.
  */
 export declare function scanWorktreeProvisioningOwnersForRecovery(directory: string): WorktreeProvisioningOwnerScan;
+export declare function scanWorktreeProvisioningLifecycleJournalForRecovery(directory: string): WorktreeProvisioningLifecycleJournalScan;
+export declare const _internals: {
+    getOwnerPath: typeof ownerPath;
+    getJournalPath: typeof journalPath;
+    readOwner: typeof readOwner;
+};
+export {};

package/dist/hooks/delegation-gate/worktree-recovery-authority.d.ts

@@ -0,0 +1,201 @@
+export declare const WORKTREE_RECOVERY_MUTATOR_NAMES: readonly ["publish", "claim", "renew", "release", "finalize", "replay"];
+export type WorktreeRecoveryMutatorName = (typeof WORKTREE_RECOVERY_MUTATOR_NAMES)[number];
+export type WorktreeRecoveryStrategy = 'merge' | 'rebase' | 'cherry-pick';
+export type WorktreeRecoveryStatus = 'preserved' | 'claimed' | 'released' | 'finalized';
+export type WorktreeRecoveryJournalState = 'PREPARED' | 'COMMITTED' | 'CLAIM_RENEWED' | 'ABORTED' | 'RELEASED' | 'FINALIZED';
+export interface WorktreeRecoveryImmutableIdentityInput {
+    originalCallID: string;
+    parentSessionId: string;
+    taskId: string;
+    reservationId: string;
+    generation: number;
+    canonicalBranch: string;
+    canonicalPath: string;
+    laneBranch: string;
+    lanePath: string;
+    expectedPrimaryHead: string;
+    sourceBaseOid: string;
+    sourceHeadOid: string;
+    targetHeadOid: string;
+    strategy: WorktreeRecoveryStrategy;
+    declaredConflictFiles?: string[];
+}
+export interface WorktreeRecoveryImmutableIdentity extends WorktreeRecoveryImmutableIdentityInput {
+    createdAt: number;
+}
+export interface WorktreeRecoveryClaimState {
+    claimantCallID: string;
+    claimantSessionId: string;
+    childSessionId: string;
+    claimRevision: number;
+    attempt: number;
+    leaseExpiresAt: number;
+    claimTokenDigest: string;
+    claimedAt: number;
+}
+export interface WorktreeRecoveryAuthorityRecord {
+    schemaVersion: 2;
+    authorityDigest: string;
+    immutable: WorktreeRecoveryImmutableIdentity;
+    status: WorktreeRecoveryStatus;
+    claim?: WorktreeRecoveryClaimState;
+    claimCursor?: {
+        lastClaimRevision: number;
+        lastAttempt: number;
+    };
+    finalizedAt?: number;
+    settlement?: {
+        sourceCommitOrder: string[];
+        rewrittenCommitOrder: string[];
+    };
+}
+interface WorktreeRecoveryStore {
+    schemaVersion: 2;
+    authorities: WorktreeRecoveryAuthorityRecord[];
+    index: {
+        bySessionTask: Record<string, string[]>;
+    };
+}
+export interface WorktreeRecoveryClaimJournalEntry {
+    schemaVersion: 1;
+    authorityDigest: string;
+    state: WorktreeRecoveryJournalState;
+    claimantCallID: string;
+    claimantSessionId: string;
+    childSessionId?: string;
+    claimRevision: number;
+    attempt: number;
+    leaseExpiresAt: number;
+    claimTokenDigest: string;
+    preparedAt: number;
+    credentialInstalledAt?: number;
+    committedAt?: number;
+    abortedAt?: number;
+    reason?: string;
+}
+interface WorktreeRecoveryClaimJournal {
+    schemaVersion: 1;
+    entries: WorktreeRecoveryClaimJournalEntry[];
+}
+interface WorktreeRecoveryCredential {
+    schemaVersion: 1;
+    authorityDigest: string;
+    claimantCallID: string;
+    claimantSessionId: string;
+    childSessionId: string;
+    claimRevision: number;
+    rawToken: string;
+    leaseExpiresAt: number;
+    createdAt: number;
+}
+type ScanStatus = 'ok' | 'unsupported-legacy' | 'uncertain';
+export type WorktreeRecoveryScanResult = {
+    status: 'ok';
+    authorities: WorktreeRecoveryAuthorityRecord[];
+} | {
+    status: 'unsupported-legacy';
+    reason: string;
+} | {
+    status: 'uncertain';
+    reason: string;
+};
+export type WorktreeRecoveryLookupResult = {
+    status: 'ok';
+    authorities: WorktreeRecoveryAuthorityRecord[];
+} | {
+    status: Exclude<ScanStatus, 'ok'>;
+    reason: string;
+};
+type BaseMutationFailureCode = 'not_found' | 'busy' | 'stale_claim' | 'retry_cap_exceeded' | 'revalidation_required' | 'revalidation_failed' | 'unsupported_legacy' | 'uncertain_store' | 'finalized';
+type BaseMutationFailure = {
+    ok: false;
+    code: BaseMutationFailureCode;
+    reason: string;
+};
+export type PublishWorktreeRecoveryAuthorityResult = {
+    ok: true;
+    authority: WorktreeRecoveryAuthorityRecord;
+} | BaseMutationFailure;
+export type ClaimWorktreeRecoveryAuthorityResult = {
+    ok: true;
+    authority: WorktreeRecoveryAuthorityRecord;
+    rawToken: string;
+    credentialPath: string;
+} | BaseMutationFailure;
+export type MutateWorktreeRecoveryClaimResult = {
+    ok: true;
+    authority: WorktreeRecoveryAuthorityRecord;
+} | BaseMutationFailure;
+export interface ClaimWorktreeRecoveryAuthorityRequest {
+    authorityDigest: string;
+    claimantCallID: string;
+    claimantSessionId: string;
+    now?: number;
+    leaseMs: number;
+    maxAttempts?: number;
+    createChildSession: () => string | Promise<string>;
+    revalidateExpiredClaim?: (args: {
+        authority: WorktreeRecoveryAuthorityRecord;
+        previousClaim: WorktreeRecoveryClaimState;
+    }) => {
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    } | Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+}
+interface ExactClaimMutationRequest {
+    authorityDigest: string;
+    claimantCallID: string;
+    claimRevision: number;
+    rawToken: string;
+    now?: number;
+}
+export interface FinalizeWorktreeRecoveryAuthorityRequest extends ExactClaimMutationRequest {
+    settlement?: {
+        sourceCommitOrder: string[];
+        rewrittenCommitOrder: string[];
+    };
+}
+export interface ReplayPreparedClaimOptions {
+    onAbortPreparedClaim?: (entry: WorktreeRecoveryClaimJournalEntry) => void;
+}
+export interface ReplayPreparedClaimOutcome {
+    authorityDigest: string;
+    outcome: 'aborted_prepared_claim' | 'removed_uncommitted_credential' | 'committed_claim_stable' | 'released_orphaned_committed_claim' | 'repaired_terminal_claim' | 'uncertain_committed_without_authority' | 'noop';
+}
+declare function storePath(directory: string): string;
+declare function journalPath(directory: string): string;
+declare function credentialPath(directory: string, authorityDigest: string): string;
+declare function acquireAuthorityLock(directory: string): (() => void) | undefined;
+export declare function publishWorktreeRecoveryAuthority(directory: string, input: WorktreeRecoveryImmutableIdentityInput): PublishWorktreeRecoveryAuthorityResult;
+export declare function scanWorktreeRecoveryAuthoritiesForRecovery(directory: string): WorktreeRecoveryScanResult;
+export declare function lookupWorktreeRecoveryAuthoritiesByTask(directory: string, query: {
+    parentSessionId: string;
+    taskId: string;
+}): WorktreeRecoveryLookupResult;
+export declare function claimWorktreeRecoveryAuthority(directory: string, request: ClaimWorktreeRecoveryAuthorityRequest): Promise<ClaimWorktreeRecoveryAuthorityResult>;
+export declare function renewWorktreeRecoveryClaim(directory: string, request: ExactClaimMutationRequest & {
+    leaseMs: number;
+}): MutateWorktreeRecoveryClaimResult;
+export declare function releaseWorktreeRecoveryClaim(directory: string, request: ExactClaimMutationRequest): MutateWorktreeRecoveryClaimResult;
+export declare function finalizeWorktreeRecoveryAuthority(directory: string, request: FinalizeWorktreeRecoveryAuthorityRequest): MutateWorktreeRecoveryClaimResult;
+export declare function replayWorktreeRecoveryClaimJournal(directory: string, options?: ReplayPreparedClaimOptions): ReplayPreparedClaimOutcome[];
+export declare const _internals: {
+    generateRawToken: () => string;
+    writeRecoveryStore: (targetPath: string, store: WorktreeRecoveryStore, _phase: "publish" | "claim-commit" | "claim-renew" | "claim-release" | "claim-finalize") => void;
+    writeClaimJournal: (targetPath: string, journal: WorktreeRecoveryClaimJournal) => void;
+    writeCredentialFile: (targetPath: string, credential: WorktreeRecoveryCredential) => void;
+    getRecoveryStorePath: typeof storePath;
+    getClaimJournalPath: typeof journalPath;
+    getCredentialPath: typeof credentialPath;
+    acquireAuthorityLock: typeof acquireAuthorityLock;
+    readClaimJournal(directory: string): WorktreeRecoveryClaimJournal;
+    resetForTest(): void;
+};
+export {};

package/dist/hooks/full-auto-permission.d.ts

@@ -24,6 +24,13 @@
  *     or terminate per `full_auto.denials.on_limit`.
  */
 import type { PluginConfig } from '../config';
+import { assessSandboxEnforcement } from '../sandbox/executor';
+import { clearSandboxWrapOutcome, readSandboxWrapOutcome } from '../sandbox/skip-state';
+export declare const _internals: {
+    assessSandboxEnforcement: typeof assessSandboxEnforcement;
+    readSandboxWrapOutcome: typeof readSandboxWrapOutcome;
+    clearSandboxWrapOutcome: typeof clearSandboxWrapOutcome;
+};
 export interface FullAutoPermissionHookOptions {
     config: PluginConfig;
     directory: string;

package/dist/hooks/guardrails/index.d.ts

@@ -8,7 +8,7 @@
  */
 import { extractSwarmIdFromAgentName, getSwarmAgents, resolveFallbackModel } from '../../agents/index';
 import { type AuthorityConfig, type GuardrailsConfig } from '../../config/schema';
-import { getExecutor } from '../../sandbox/executor';
+import { assessSandboxEnforcement, getExecutor } from '../../sandbox/executor';
 import { dcCheckJunctionCreation } from './destructive-command';
 import { getMostRecentAssistantText, getProviderFailureFingerprint, isTransientProviderFailureText } from './messages-transform';
 export declare const _internals: {
@@ -21,6 +21,7 @@ export declare const _internals: {
     dcCheckJunctionCreation: typeof dcCheckJunctionCreation;
     extractErrorSignal: typeof extractErrorSignal;
     getSandboxExecutor: typeof getExecutor;
+    assessSandboxEnforcement: typeof assessSandboxEnforcement;
     /** Test-only compatibility for legacy direct-after hook tests. */
     allowUncorrelatedGateReceipts: boolean;
     MAX_PENDING_GATE_RECEIPTS_PER_SESSION: number;

package/dist/hooks/guardrails/tool-before.d.ts

@@ -38,6 +38,8 @@ export interface ToolBeforeContext {
     worktreeBaseDirOverrides?: string[];
     /** Sandbox executor getter seam for tests and platform-specific overrides. */
     getSandboxExecutor: typeof import('../../sandbox/executor').getExecutor;
+    /** Sandbox capability assessment seam for deterministic cross-platform tests. */
+    assessSandboxEnforcement: typeof import('../../sandbox/executor').assessSandboxEnforcement;
     /** Hold exact child-write provenance until the matching after-hook succeeds. */
     rememberReviewerScopeWrite?: (input: {
         callID: string;
@@ -49,6 +51,8 @@ export interface ToolBeforeContext {
     /** Snapshot an exact authorized write for success-only lease renewal. */
     rememberScopeLeaseCandidate?: (input: ScopeLeaseCandidateInput) => void;
 }
+/** @internal test seam */
+export declare function _resetSandboxUnavailableWarningState(): void;
 /**
  * Creates a toolBefore handler with the given shared context.
  *

package/dist/hooks/init-orphan-recovery.d.ts

@@ -21,7 +21,8 @@ import { isLocked, listActiveLocks, tryAcquireLock } from '../parallel/file-lock
 import { removeWorktree } from '../worktree/core';
 import { scanRegisteredWorktreeLiveness } from '../worktree/merge';
 import { scanWorktreeMergeFailuresForRecovery } from './delegation-gate/worktree-merge-status';
-import { removeWorktreeProvisioningOwner, scanWorktreeProvisioningOwnersForRecovery } from './delegation-gate/worktree-provisioning-owner';
+import { removeWorktreeProvisioningOwner, scanWorktreeProvisioningLifecycleJournalForRecovery, scanWorktreeProvisioningOwnersForRecovery } from './delegation-gate/worktree-provisioning-owner';
+import { replayWorktreeRecoveryClaimJournal, scanWorktreeRecoveryAuthoritiesForRecovery } from './delegation-gate/worktree-recovery-authority';
 type OwnershipTagSessionScan = {
     status: 'ok';
     sessionIds: string[];
@@ -51,7 +52,10 @@ export declare const _internals: {
     recordDelegationRecoveryObservation: typeof recordDelegationRecoveryObservation;
     scanDelegationFallbacksForRecovery: typeof scanDelegationFallbacksForRecovery;
     scanWorktreeMergeFailuresForRecovery: typeof scanWorktreeMergeFailuresForRecovery;
+    scanWorktreeRecoveryAuthoritiesForRecovery: typeof scanWorktreeRecoveryAuthoritiesForRecovery;
+    replayWorktreeRecoveryClaimJournal: typeof replayWorktreeRecoveryClaimJournal;
     scanWorktreeProvisioningOwnersForRecovery: typeof scanWorktreeProvisioningOwnersForRecovery;
+    scanWorktreeProvisioningLifecycleJournalForRecovery: typeof scanWorktreeProvisioningLifecycleJournalForRecovery;
     scanRegisteredWorktreeLiveness: typeof scanRegisteredWorktreeLiveness;
     removeWorktreeProvisioningOwner: typeof removeWorktreeProvisioningOwner;
 };

package/dist/hooks/pr-workflow-gate.d.ts

@@ -784,6 +784,8 @@ export declare class PrReviewResilienceRetryExhaustedError extends Error {
     readonly code: "PR_REVIEW_RESILIENCE_RETRY_EXHAUSTED";
     constructor(message: string);
 }
+declare function snapshotPrReviewResiliencePolicy(policy?: PrReviewResilienceConfig): PrReviewResiliencePolicyRecord;
+declare function effectivePrReviewResiliencePolicy(state: PrWorkflowGateState, requestedPolicy?: PrReviewResilienceConfig): PrReviewResiliencePolicyRecord;
 declare function classifyTerminalFailureSignature(record: BackgroundDelegationRecord): string | null;
 interface EnforcePrReviewBaseDimensionsOptions {
     batchId: string;
@@ -969,6 +971,16 @@ export declare const _test_exports: {
      * shortening the threshold, not by waiting minutes.
      */
     pendingLaneLivenessThresholdMs: number;
+    /**
+     * Issue #2381: exposed so the staged-resilience DEFAULT can be pinned
+     * directly. This resolution path is reached whenever a gate state carries no
+     * recorded policy and no policy is supplied, and it previously hardcoded
+     * `enabled: true`; the default flip is only real if this agrees with
+     * `DEFAULT_PR_REVIEW_RESILIENCE_CONFIG`. Pure functions of their arguments,
+     * so `_test_exports` is the right seam (no `mock.module` needed).
+     */
+    effectivePrReviewResiliencePolicy: typeof effectivePrReviewResiliencePolicy;
+    snapshotPrReviewResiliencePolicy: typeof snapshotPrReviewResiliencePolicy;
     resolveCurrentGitHead: typeof resolveCurrentGitHead;
     resolveCurrentGitHeadAsync: typeof resolveCurrentGitHeadAsync;
     resolveCurrentUpstreamPushTarget: typeof resolveCurrentUpstreamPushTarget;

package/dist/hooks/scope-guard.d.ts

@@ -19,12 +19,10 @@ import { resolveWriteTargets } from './write-target-resolver';
 export interface ScopeGuardConfig {
     /** Whether scope guard is enabled (default: true) */
     enabled: boolean;
-    /** Whether to skip in turbo mode (default: false — NOT skippable by design) */
-    skip_in_turbo: boolean;
 }
 /**
  * Creates the scope-guard hook that blocks out-of-scope writes.
- * @param config - ScopeGuardConfig (enabled, skip_in_turbo)
+ * @param config - ScopeGuardConfig. Scope enforcement is never skipped in Turbo.
  * @param fallbackDirectory - The plugin-root directory (`ctx.directory`). Used
  *   ONLY as the fallback for sessions with no recorded workspace root. Issue
  *   #2002: this hook is constructed once per plugin instance and serves every