opencode-swarm 7.200.0 → 7.200.2

package/dist/cli/{worktree-collision-ownership-7a1n1f9j.js → worktree-collision-ownership-2xqxqp0x.js}

@@ -6,28 +6,28 @@ import {
   WORKTREE_PROVISIONING_OWNER_LEASE_MS,
   removeWorktreeProvisioningOwner,
   scanWorktreeProvisioningOwnersForRecovery
-} from "./index-r02aqt0a.js";
+} from "./index-b4kdms7x.js";
 import {
   scanDelegationFallbacksForRecovery,
   scanDelegationsForRecovery
-} from "./index-rfvnq6wd.js";
+} from "./index-h29ckdg5.js";
 import {
   scanWorktreeMergeFailuresForRecovery
 } from "./index-v3bmwmqw.js";
-import"./index-x1z5d5kj.js";
-import"./index-99zt998b.js";
-import"./index-vmevv6my.js";
-import"./index-d083d1q7.js";
+import"./index-xyvsdn07.js";
+import"./index-s9y49avf.js";
+import"./index-na6ph1fp.js";
+import"./index-ves1rtqt.js";
 import"./index-ry16d01s.js";
 import"./index-rdm3px0g.js";
-import"./index-wr0n2w3z.js";
+import"./index-nzfq1ms2.js";
 import"./index-7pmbnjvj.js";
-import"./index-1tpz99db.js";
-import"./index-n5k81wym.js";
+import"./index-ypxq0x7r.js";
+import"./index-nbg19t1b.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
-import"./index-dng8z8me.js";
-import"./index-ac8vdmgv.js";
+import"./index-g57p8p1k.js";
+import"./index-traz987v.js";
 import"./index-q8vfw61p.js";
 import"./index-t7hmqgjy.js";
 import"./index-c2k7q723.js";
@@ -36,7 +36,7 @@ import {
 } from "./index-te9hq2f4.js";
 import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
-import"./index-q1x73nnd.js";
+import"./index-epzadpmm.js";
 import"./index-sp2cxpaq.js";
 import"./index-qbxk2rn6.js";
 import"./index-zgwm4ryv.js";

package/dist/cli/{worktree-isolation-8snw7w34.js → worktree-isolation-rxpwxvw3.js}

@@ -25,79 +25,79 @@ import {
   sanitizeWorktreeTaskId,
   standardWorktreeByCallID,
   standardWorktreeSerializationSessions
-} from "./index-hg4qa0aq.js";
-import"./index-nq3zcrhm.js";
-import"./index-8rrs1nc0.js";
-import"./index-md2180vx.js";
-import"./index-yss701b3.js";
-import"./index-0wg5q595.js";
+} from "./index-y7khxj1g.js";
+import"./index-s3w41p1x.js";
+import"./index-ngzt2xmr.js";
+import"./index-bw6q2v41.js";
+import"./index-43scxm6a.js";
+import"./index-5snwc3dz.js";
 import"./index-axqyjreb.js";
 import"./index-txdagbh7.js";
-import"./index-qnabg1wp.js";
-import"./index-vqtca3xv.js";
+import"./index-bt2h69a2.js";
+import"./index-4ts6jpmj.js";
 import"./index-rdec0y3z.js";
-import"./index-qnst0jwc.js";
-import"./index-71bqn1nn.js";
-import"./index-e8m8bb1r.js";
-import"./index-bp476gwc.js";
-import"./index-8a3aasag.js";
+import"./index-kezh6nhq.js";
+import"./index-evf5t4ba.js";
+import"./index-mrq61h10.js";
+import"./index-1v277wxc.js";
+import"./index-wgf1780e.js";
 import"./index-x5jwegqw.js";
-import"./index-r02aqt0a.js";
-import"./index-rfvnq6wd.js";
-import"./index-8mrentmw.js";
+import"./index-b4kdms7x.js";
+import"./index-h29ckdg5.js";
 import"./index-pt7h91zc.js";
 import"./index-q7sjgr1y.js";
-import"./index-22atsy06.js";
-import"./index-35tf03js.js";
+import"./index-sv514p10.js";
+import"./index-yk3b7ywa.js";
 import"./index-6b295cas.js";
 import"./index-9nyqt3kb.js";
-import"./index-9nmrw7ek.js";
+import"./index-4cw3w8qm.js";
 import"./index-v3bmwmqw.js";
-import"./index-sk1rva12.js";
-import"./index-58cr1xg0.js";
-import"./index-m9j9varx.js";
+import"./index-8mrentmw.js";
+import"./index-pktvge7a.js";
+import"./index-rav29yb2.js";
+import"./index-ab1k780s.js";
 import"./index-spggmr30.js";
-import"./index-1rfgzsaw.js";
-import"./index-x25rhkmk.js";
+import"./index-trvn0kg0.js";
+import"./index-vrvcn7k1.js";
 import"./index-m9zzj4ee.js";
-import"./index-x1z5d5kj.js";
-import"./index-p5m71yph.js";
-import"./index-jy0mgzjq.js";
+import"./index-xyvsdn07.js";
+import"./index-gpr3j0w1.js";
+import"./index-v1h70r3y.js";
 import"./index-rtry5xyf.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-hxp5jgd8.js";
+} from "./index-gss7ch5k.js";
 import"./index-g22dps7x.js";
 import"./index-0725jpp7.js";
-import"./index-pyv8vzkx.js";
-import"./index-99zt998b.js";
-import"./index-7v74n9a1.js";
-import"./index-vmevv6my.js";
-import"./index-d083d1q7.js";
+import"./index-xfkzwc4p.js";
+import"./index-s9y49avf.js";
+import"./index-bncex5hw.js";
+import"./index-na6ph1fp.js";
+import"./index-ves1rtqt.js";
 import"./index-ry16d01s.js";
 import"./index-rdm3px0g.js";
-import"./index-wr0n2w3z.js";
+import"./index-nzfq1ms2.js";
 import"./index-7pmbnjvj.js";
 import"./index-9rwhas09.js";
-import"./index-1tpz99db.js";
-import"./index-n5k81wym.js";
+import"./index-ypxq0x7r.js";
+import"./index-nbg19t1b.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
-import"./index-dng8z8me.js";
-import"./index-ac8vdmgv.js";
+import"./index-g57p8p1k.js";
+import"./index-traz987v.js";
 import"./index-q8vfw61p.js";
 import"./index-t7hmqgjy.js";
 import"./index-c2k7q723.js";
 import"./index-te9hq2f4.js";
 import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
-import"./index-q1x73nnd.js";
+import"./index-epzadpmm.js";
 import"./index-3t46mez1.js";
-import"./index-gwc7jahh.js";
+import"./index-pvpeggb5.js";
 import"./index-sp2cxpaq.js";
 import"./index-qbxk2rn6.js";
 import"./index-zgwm4ryv.js";
-import"./index-yvv0my1a.js";
+import"./index-yctvn9z9.js";
 import"./index-xfzkq1k4.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";

package/dist/commands/close/internals.d.ts

@@ -26,7 +26,7 @@ export declare const _internals: {
     CLOSE_REFLECTION_TIMEOUT_MS: number;
     detectFullAuto: typeof import("./orchestrator.js").detectFullAuto;
     guaranteeAllPlansComplete: typeof import("./finalize-stage.js").guaranteeAllPlansComplete;
-    getGitRepositoryStatus: typeof import("../../git/branch.js").getGitRepositoryStatus;
+    getGitRepositoryStatus: typeof import("../../commands/git-status-read.js").readGitRepositoryStatusDetailedAsync;
     resetToMainAfterMerge: (cwd: string, options?: import("./align-stage.js").GuardedResetToMainOptions) => Promise<import("./align-stage.js").GuardedResetToMainResult>;
     resetToRemoteBranch: typeof import("../../git/branch.js").resetToRemoteBranch;
     copyDirRecursive: typeof import("./fs-helpers.js").copyDirRecursive;

package/dist/commands/close/orchestrator.d.ts

@@ -36,6 +36,13 @@ export interface ClosePurgeGate {
         status: number | null;
         stderrTail: string;
     };
+    /**
+     * #3434: porcelain records whose path normalized outside the project
+     * root — excluded from `dirtyPaths`/`candidates` (and therefore from the
+     * confirm-token digest) and surfaced as a bounded warning instead of
+     * being joined into the scope unvalidated.
+     */
+    excludedOutOfRoot: string[];
 }
 /** Test seam for the #2508 gate (simulate git-status read failures). The
  * default routes through the #3317 async reader; legacy sync stubs returning

package/dist/commands/destructive-purge.d.ts

@@ -84,6 +84,18 @@ export declare const GIT_STATUS_ARGS: readonly ["--no-optional-locks", "status",
  * `src/commands/rollback-gate.ts` exports a same-named parser for
  * NUL-terminated `--porcelain -z` output (J1/#2946); the two are deliberately
  * not consolidated in this PR.
+ *
+ * #3434: `../`-bearing (or absolute) records are excluded from the dirty
+ * set and recorded in `excludedOutOfRoot` — the legacy `string[]` export
+ * below returns only the in-root paths. The containment predicate itself is
+ * the rollback-gate module's `isOutOfRootRelativePath` (single shared
+ * definition; the parsers stay separate by design).
+ */
+export declare function parseTrackedDirtyPathsWithExclusions(statusOutput: string): import('./rollback-gate.js').TrackedDirtyParseResult;
+/**
+ * Legacy `string[]` view of the newline-form parser (in-root paths only) —
+ * the export existing suites pin. New consumers that need the exclusion
+ * diagnostic use `parseTrackedDirtyPathsWithExclusions`.
  */
 export declare function parseTrackedDirtyPaths(statusOutput: string): string[];
 /**
@@ -94,10 +106,13 @@ export declare function parseTrackedDirtyPaths(statusOutput: string): string[];
  * helper, so its existing #2508 fail-closed tests keep their injection point.
  * #3317: async — the read is bounded and killable, and legacy sync stubs
  * keep working (awaiting a plain value is a no-op).
+ * #3434: the ok arm carries `excludedOutOfRoot` so the #2953 re-check
+ * compares against the SAME filtered set the operator confirmed.
  */
 export declare function readTrackedDirtyPaths(directory: string): Promise<{
     ok: true;
     dirtyPaths: string[];
+    excludedOutOfRoot: string[];
 } | {
     ok: false;
     /** Structured cause when the reader could tell (absent for legacy `null` stubs). */

package/dist/commands/git-status-read.d.ts

@@ -74,3 +74,26 @@ export declare function readGitStatusAsync(args: readonly string[], cwd: string,
  * non-blocking preview, with no transient-retry chain.
  */
 export declare function readGitRepositoryStatusAsync(cwd: string): Promise<boolean>;
+/**
+ * Detailed twin of `readGitRepositoryStatusAsync` (issue #3427): the same
+ * single-attempt `rev-parse --git-dir` read, mapped to the SAME
+ * `GitRepositoryStatus` vocabulary the sync `branch.getGitRepositoryStatus`
+ * produces — `{isRepo:true}` / `not_git_repo` / `git_unavailable` /
+ * `git_error` with a message — so the finalize align stage can move off the
+ * blocking sync probe without losing its reason-specific skip diagnostics.
+ *
+ * Classification parity with `src/git/branch.ts`:
+ * - ENOENT goes through the shared #2236 `classifySpawnFailure` split — a
+ *   cwd fault is `git_error` NAMING the cwd (never `git_unavailable`);
+ *   binary-missing keeps the full `gitBinaryMissingMessage` remediation text.
+ * - A nonzero child exit is `not_git_repo` only when the bounded stderr
+ *   matches the shared `isNotGitRepositoryMessage` vocabulary; every other
+ *   nonzero exit is `git_error` carrying the status.
+ * - Spawn-class failures (ETIMEDOUT/ESIGNAL/…) are `git_error` with the
+ *   failure code ALWAYS carried in the message — empty stderr never
+ *   discards the class.
+ *
+ * `ignoreOutput` is deliberately NOT set: the bounded stderr feeds the
+ * repo-detection classification.
+ */
+export declare function readGitRepositoryStatusDetailedAsync(cwd: string): Promise<import('../git/branch.js').GitRepositoryStatus>;

package/dist/commands/registry.d.ts

@@ -1077,7 +1077,7 @@ export declare const COMMAND_REGISTRY: {
     readonly 'reset-session': {
         readonly handler: (ctx: CommandContext) => Promise<string>;
         readonly description: "Clear session state while preserving plan, evidence, and knowledge";
-        readonly details: "Deletes only .swarm/session/state.json and other session files. Clears in-memory agent sessions, delegation chains, and active-agent mappings. Preserves plan, evidence, and knowledge. Also releases this session's pending knowledge-gate obligations (#2398) and recovers stale coder settlements so dispatches cannot wedge on CODER_DISPATCH_IN_PROGRESS (#2268). Auto-backs up removed files to .swarm/reset-backups/ (newest 5 kept).";
+        readonly details: "Deletes .swarm/session/state.json plus other session files; clears in-memory sessions, chains, and active-agent maps. Preserves plan, evidence, and knowledge; releases this session's pending knowledge-gate obligations (#2398); recovers coder settlements wedged on CODER_DISPATCH_IN_PROGRESS (#2268); backs up to .swarm/reset-backups/ (newest 5 kept). If a cleanup step fails, the closing guard stays closed by design, writes pause (an advisory says why), and a reset re-run or restart recovers.";
         readonly args: "--confirm=<token> (purge dirty/live lanes)";
         readonly category: "utility";
         readonly toolPolicy: "restricted";

package/dist/commands/rollback-gate.d.ts

@@ -23,6 +23,18 @@ export declare const _rollbackGateInternals: {
  * repositories; git tracks nothing there.
  */
 export declare function isRealGitRepository(directory: string): boolean;
+/** #3434: a parsed porcelain record whose path normalizes outside the repo root. */
+export declare function isOutOfRootRelativePath(rel: string): boolean;
+/**
+ * The NUL-form parser's result contract (#3434): the in-root dirty paths that
+ * feed the destroy scope, plus any records whose path normalized outside the
+ * project root — excluded from the scope and surfaced for the diagnostic
+ * instead of being joined into the confirm-token digest unvalidated.
+ */
+export interface TrackedDirtyParseResult {
+    dirtyPaths: string[];
+    excludedOutOfRoot: string[];
+}
 /**
  * Parse `git status --porcelain -z` output into repo-relative tracked-dirty
  * paths. The -z form is NUL-terminated and NEVER quotes paths (core.quotepath
@@ -36,6 +48,16 @@ export declare function isRealGitRepository(directory: string): boolean;
  * (intent-to-add) — so the test must not anchor to the first column, or the
  * ORIG_PATH token of an R/C-initial file (README.md, CHANGELOG.md, …) is
  * misread as the start of a new record and swallows the next real entry.
+ *
+ * #3434: `../`-bearing (or absolute) records are excluded from the dirty
+ * set and recorded in `excludedOutOfRoot` — the legacy `string[]` export
+ * below returns only the in-root paths.
+ */
+export declare function parseTrackedDirtyPathsWithExclusions(statusOutput: string): TrackedDirtyParseResult;
+/**
+ * Legacy `string[]` view of the NUL-form parser (in-root paths only) — the
+ * export existing suites pin. New consumers that need the exclusion
+ * diagnostic use `parseTrackedDirtyPathsWithExclusions`.
  */
 export declare function parseTrackedDirtyPaths(statusOutput: string): string[];
 /**
@@ -43,11 +65,23 @@ export declare function parseTrackedDirtyPaths(statusOutput: string): string[];
  * index while a file sits on disk at that path. `git reset --hard` silently
  * overwrites exactly these untracked (or since-ignored) files when it
  * materializes the target tree, so they belong in the destruction scope
- * alongside tracked-dirty paths (#2976 review F-1). Returns [] when either
- * listing cannot be read — the tracked-dirty gate above still applies, and
- * the caller's unreadable-status refusal covers real-repo failures.
+ * alongside tracked-dirty paths (#2976 review F-1).
+ *
+ * #3434 fail-closed contract: `failure` is set when either listing cannot
+ * be read, carrying the reader's structured cause when it could tell. The
+ * caller must REFUSE on it — an unreadable enumeration may not read as a
+ * measured "nothing in the way" (the same class #3317 closed for the status
+ * reads). A non-git or bare-marker root returns empty paths with NO failure:
+ * nothing tracked can be in the way there (#2127 convention).
  */
-export declare function untrackedPathsInTargetTree(directory: string, targetSha: string): Promise<string[]>;
+export declare function untrackedPathsInTargetTree(directory: string, targetSha: string): Promise<{
+    paths: string[];
+    failure: {
+        code: string | null;
+        status: number | null;
+        stderrTail: string;
+    } | null;
+}>;
 /**
  * The git-kind candidate set: the absolute paths of tracked-dirty files that
  * `git reset --hard` would destroy. This is the ONLY derivation for
@@ -63,30 +97,63 @@ export declare function swarmOverwriteCandidates(directory: string, overwriteRel
 /**
  * #3317: cause-matched wording for an unreadable destruction measurement —
  * single source shared by the /swarm rollback command and the checkpoint
- * tool sink so the two refusal texts cannot drift.
+ * tool sink so the two refusal texts cannot drift. `source` (#3434
+ * feedback round) names WHICH read failed: the default 'status' keeps the
+ * historical wording BYTE-IDENTICAL (pinned by the #3317 round-2 trace
+ * suite checkpoint-restore-cause-3275); 'enumeration' rewords the arms to
+ * name the ls-tree/ls-files listing so the operator is pointed at the read
+ * that actually failed.
  */
 export declare function describeUnreadableCause(measurement: {
     code?: string | null;
     status?: number | null;
     stderrTail?: string;
-}): string;
+}, source?: 'status' | 'enumeration'): string;
+/**
+ * Sanitize a repo-controlled porcelain record for operator/agent-facing
+ * diagnostic text (#3434 feedback round): collapse control characters
+ * (ANSI/CR/LF/NUL cannot smuggle terminal escapes or forged lines) and
+ * bound the excerpt — the same house discipline as the reader's
+ * `stderrTail` and `excerptProbeOutput`. Excluded records never enter the
+ * scope digest, so the digest's own NUL/newline rejection does not cover
+ * the one place their bytes are rendered.
+ */
+export declare function formatExcludedRecord(rel: string): string;
 /**
  * Measure the destruction scope for a git checkpoint restore. When
  * `targetSha` is provided, files that are untracked (or since-ignored) on
  * disk but tracked in the TARGET tree are included: `git reset --hard`
  * overwrites them silently, so they are part of the destruction set
- * (#2976 review F-1). `unreadable` means git status could not be read
- * inside a real repository — callers must fail closed on it (never treat
- * it as a clean tree). A non-git or bare-marker root returns an empty
- * dirty set: nothing tracked to destroy.
+ * (#2976 review F-1). `unreadable` means git status — or, #3434, the
+ * ls-tree/ls-files enumeration of the target tree — could not be read
+ * inside a real repository; callers must fail closed on it (never treat it
+ * as a clean tree, and never let a failed enumeration shrink the measured
+ * scope). A non-git or bare-marker root returns an empty dirty set: nothing
+ * tracked to destroy. `excludedOutOfRoot` carries porcelain records whose
+ * path normalized outside the project root (#3434) — excluded from the
+ * scope and surfaced for the preview diagnostic.
  */
 export declare function measureGitDestruction(directory: string, targetSha?: string): Promise<{
     kind: 'ok';
     dirtyRelPaths: string[];
+    /** #3434: out-of-root porcelain records excluded from the scope. */
+    excludedOutOfRoot: string[];
 } | {
     kind: 'unreadable';
     /** #3317: why the read failed, when the async reader could tell. */
     code?: string | null;
     status?: number | null;
     stderrTail?: string;
+    /**
+     * #3434 feedback: WHICH read failed — the status read or the
+     * ls-tree/ls-files enumeration. Consumers word the refusal
+     * accordingly instead of always blaming git status.
+     */
+    source: 'status' | 'enumeration';
+    /**
+     * Out-of-root records already parsed from a SUCCESSFUL status
+     * read before the enumeration failed — carried so the refusal
+     * can still disclose them instead of dropping them silently.
+     */
+    excludedOutOfRoot?: string[];
 }>;

package/dist/config/schema.d.ts

@@ -3380,6 +3380,7 @@ export declare const PluginConfigSchema: z.ZodObject<{
             trusted_domains: z.ZodDefault<z.ZodArray<z.ZodString>>;
             protected_paths: z.ZodDefault<z.ZodArray<z.ZodString>>;
             allow_defaults: z.ZodDefault<z.ZodBoolean>;
+            trust_code_mode_wrapper: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
         denials: z.ZodDefault<z.ZodObject<{
             max_consecutive: z.ZodDefault<z.ZodNumber>;
@@ -3402,6 +3403,7 @@ export declare const PluginConfigSchema: z.ZodObject<{
             max_consecutive_dispatch_failures: z.ZodDefault<z.ZodNumber>;
             total_timeout_ms: z.ZodDefault<z.ZodNumber>;
             cleanup_timeout_ms: z.ZodDefault<z.ZodNumber>;
+            hook_timeout_ms: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strip>>;
     }, z.core.$strip>>>;
     pr_feedback_loop: z.ZodOptional<z.ZodObject<{

package/dist/full-auto/code-mode-program.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Strict recogniser for the only OpenCode v2 Code Mode programs Full-Auto may
+ * pass through without a critic (#3446).
+ *
+ * The Code Mode sandbox is not limited to hooked tools: it also exposes
+ * `fetch`, `Function`, `crypto`, `URL`, `Promise`, `JSON`, `Math` and `Date`
+ * (observed on OpenCode 2.1.4), so "the wrapper only routes nested tool calls"
+ * is false in general. A denylist over arbitrary JS cannot be made safe
+ * (`Function(...)`, computed member access, string concatenation). Instead,
+ * this module ACCEPTS a tiny grammar and rejects everything else:
+ *
+ *   program := ws [`return` ws] [`await` ws] callee ws `(` ws [value] ws `)` ws [`;`] ws
+ *   callee  := `search` | `tools` segment+
+ *   segment := `.` ident | `[` ws string ws `]`
+ *   value   := string | number | `true` | `false` | `null` | object | array
+ *   object  := `{` ws [pair (ws `,` ws pair)* [ws `,`]] ws `}`
+ *   pair    := (ident | string) ws `:` ws value
+ *
+ * That is exactly one tool call whose argument is plain data: no identifiers
+ * other than the callee path and object keys, so no other call, no member
+ * access on a value, no computed keys, no templates, comments, regexes or
+ * functions can appear. The nested call itself is still dispatched through the
+ * same tool.execute.before chain under its own name and classified there.
+ * Anything else (multi-statement, loops, variables, `fetch`, ...) returns
+ * false and Full-Auto keeps escalating it to the critic.
+ */
+/**
+ * True only when `code` is exactly one `tools.<path>(<plain data>)` or
+ * `search(<plain data>)` call, optionally prefixed by `return` and/or `await`.
+ */
+export declare function isSingleToolCallProgram(code: unknown): boolean;

package/dist/full-auto/critic-tools.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Tools denied to the Full-Auto critic agent (#3446).
+ *
+ * The critic's task is "verify using read-only tools only", but `shell`/`bash`
+ * are not read-only and — worse for latency — let the critic wander: on
+ * OpenCode 2 every observed critic session ran `grep -rl` / `find ~` over the
+ * user's home directory until the oversight deadline killed it, so no verdict
+ * was ever produced and Full-Auto paused. Shell is denied alongside the
+ * mutating tools; the critic keeps read/grep/glob and the swarm's own
+ * read-only verification tools (diff, evidence, test_impact, symbols).
+ *
+ * Limit, stated plainly: `execute` (OpenCode 2 Code Mode, which reaches plugin
+ * tools such as diff/evidence/test_impact) stays available to the critic by
+ * design, and its sandbox also exposes `fetch`/`Function`, which no hook sees.
+ * This denial list therefore bounds shell and mutating tools only; it is not a
+ * sandbox. A restricted critic Code Mode surface is a follow-up.
+ */
+export declare const FULL_AUTO_CRITIC_DENIED_TOOLS: Readonly<Record<string, false>>;

package/dist/full-auto/policy.d.ts

@@ -31,6 +31,8 @@ export interface FullAutoPolicyConfig {
         trusted_domains?: string[];
         protected_paths?: string[];
         allow_defaults?: boolean;
+        /** Opt in to passing the marked OpenCode 2 Code Mode wrapper (#3446). */
+        trust_code_mode_wrapper?: boolean;
     };
     oversight?: {
         on_high_risk_action?: boolean;
@@ -52,6 +54,21 @@ export interface FullAutoClassifierInput {
     planSummary?: string;
     changedFiles?: string[];
     fullAutoConfig: FullAutoPolicyConfig | undefined;
+    /**
+     * True for a call the OpenCode v2 adapter marked as the host's Code Mode
+     * `execute` wrapper (see `src/hooks/code-mode-wrapper.ts`). The mark is not
+     * proof of provenance (a same-named third-party tool is marked too), so it
+     * is only honoured with the operator opt-in `trust_code_mode_wrapper`.
+     */
+    hostCodeModeWrapper?: boolean;
+    /**
+     * True when this `swarm_command` is on the explicit read-only allowlist
+     * (`READ_ONLY_SWARM_COMMANDS`) AND the tool's own policy allows it. Computed
+     * by the permission hook so this module stays free of the command
+     * registry's import graph. Absent or false means the call is escalated like
+     * any unclassified tool.
+     */
+    swarmCommandReadOnly?: boolean;
     pluginConfig?: {
         memory?: {
             enabled?: boolean;

package/dist/git/branch.d.ts

@@ -7,6 +7,13 @@ export type GitRepositoryStatus = {
     reason: 'not_git_repo' | 'git_unavailable' | 'git_error';
     message: string;
 };
+/**
+ * Repo-detection vocabulary shared with the async detailed reader
+ * (`src/commands/git-status-read.ts`, #3427): the same case-folded phrases
+ * classify a nonzero `rev-parse` exit as `not_git_repo` on the sync and
+ * async probe paths alike, so the two probes cannot drift apart.
+ */
+export declare function isNotGitRepositoryMessage(message: string): boolean;
 /**
  * Seam that calls child_process.spawnSync dynamically.
  * Uses getChildProcessSpawnSync() to resolve at call time, allowing
@@ -71,6 +78,21 @@ declare const __spawnSyncSeam: {
  * looks sufficient but is not — that gap is exactly what #2263 reported.
  */
 export declare function readLaneEnvFileFromDiskSync(worktreePath: string, laneIndex: number): Record<string, string>;
+/**
+ * Issue #2236 F5: builds the *actionable* "git is not available" message.
+ *
+ * `describeGitResolution()` (src/utils/git-executable.ts) is the production
+ * source of truth for what the resolver actually tried — every candidate path,
+ * its source (`override`/`platform`/`path`), and why each was rejected. A bare
+ * "git executable is not available on PATH" is what sent the original report
+ * down a four-day PATH investigation while git was present the whole time, so
+ * the thrown message names the candidates and the override escape hatch.
+ *
+ * `cwd` is named too: reaching this function means the cwd was positively
+ * classified as present-and-a-directory, which is the fact that rules the
+ * #2236 misdiagnosis out rather than leaving it implied.
+ */
+export declare function gitBinaryMissingMessage(cwd: string): string;
 declare function gitExec(args: string[], cwd: string, laneEnv?: Record<string, string>, laneIndex?: number): string;
 export declare function getGitRepositoryStatus(cwd: string): GitRepositoryStatus;
 /**

package/dist/hooks/code-mode-wrapper.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Per-call marker for the OpenCode v2 Code Mode `execute` wrapper (#3446).
+ *
+ * OpenCode v2 reaches plugin and MCP tools through one host-owned `execute`
+ * tool whose input is a JS program (`{ code }`); every nested `tools.<name>()`
+ * call is dispatched through the tool.execute.before chain under its own name.
+ * Only the v2 adapter sees the host's real tool id, so only the adapter can
+ * mark a call. The mark is NOT proof of provenance: a v2 tool event is just
+ * {tool, sessionID, agent, messageID, id, input}, so a plugin- or MCP-provided
+ * tool that shares the name `execute` and takes a string `code` is marked too.
+ * That is why the Full-Auto classifier only honours the mark when the operator
+ * opts in (`permission_policy.trust_code_mode_wrapper`, default false) and the
+ * program is exactly one plain-data tool call. On a v1 host nothing is marked.
+ *
+ * Side-channel shape mirrors `src/sandbox/skip-state.ts` (keyed by
+ * session + call, bounded, FIFO-evicted) so session state stays bounded
+ * (invariant 8).
+ */
+/** Hard cap on retained marks; oldest are evicted first. */
+export declare const MAX_CODE_MODE_WRAPPER_MARKS = 256;
+/** Record that this exact call is the host's Code Mode `execute` wrapper. */
+export declare function recordCodeModeWrapperCall(sessionID: string, callID: string): void;
+/** True only for a call the v2 adapter marked as the Code Mode wrapper. */
+export declare function isCodeModeWrapperCall(sessionID: string, callID: string | undefined): boolean;
+/** Drop a mark once the call has completed. */
+export declare function clearCodeModeWrapperCall(sessionID: string, callID: string): void;
+/** Test seam: drop every mark. */
+export declare function resetCodeModeWrapperCalls(): void;

package/dist/hooks/full-auto-intercept.d.ts

@@ -69,4 +69,9 @@ export declare function createFullAutoInterceptHook(config: PluginConfig, direct
         messages?: MessageWithParts[];
     }) => Promise<void>;
 };
+/**
+ * Builds additional context to append to the autonomous oversight prompt.
+ * This provides the architect's question/output for the critic to evaluate.
+ */
+export declare function buildCriticContext(architectOutput: string, escalationType: 'phase_completion' | 'question'): string;
 export {};

package/dist/hooks/full-auto-permission.d.ts

@@ -35,6 +35,31 @@ export interface FullAutoPermissionHookOptions {
     config: PluginConfig;
     directory: string;
 }
+/**
+ * `/swarm` commands that only read and display state. Deliberately SEPARATE from
+ * the tool policy's agent allowlist, which also contains state-changing and
+ * process-spawning commands (`auto-proceed`, `guardrail reset`, `attest`,
+ * `ci-simulate`, `gate-audit`, `review`, `post-mortem`, `pr subscribe`,
+ * `sdd project`, `*-opt` runs, ...). Canonical keys.
+ *
+ * The invariant is: no change to source, plan, gates or any operator-visible
+ * state, and no process spawn or network egress. Some of these commands do
+ * refresh bookkeeping under `.swarm/` (e.g. `report` writes `.swarm/swarm.db`
+ * and a cohort manifest, `memory *` create `.swarm/memory/memory.db`, and
+ * commands that load the plan may regenerate `plan.md`): writes are confined
+ * to `.swarm/`, which `tests/unit/hooks/full-auto-swarm-command-policy-3446.test.ts`
+ * pins by running every key and diffing the tree outside `.swarm/`. Keys that
+ * were shown to spawn processes (`diagnose`, `doctor tools`) or contact
+ * GitHub (`pr status`) are NOT in this set.
+ */
+export declare const READ_ONLY_SWARM_COMMANDS: ReadonlySet<string>;
+/**
+ * Is this `swarm_command` call on the read-only allowlist AND permitted by the
+ * tool's own policy for this exact command + args? Anything else (unknown,
+ * human-only, restricted, bad args, or any state-changing command) returns
+ * false and falls through to the normal escalation.
+ */
+export declare function isSwarmCommandReadOnly(args: unknown): boolean;
 export declare function createFullAutoPermissionHook(options: FullAutoPermissionHookOptions): {
     toolBefore: (input: {
         tool: string;