opencode-swarm 7.200.1 → 7.200.2

package/dist/cli/{skill-generator-q4afafh3.js → skill-generator-xh2w2pvq.js}

@@ -33,20 +33,20 @@ import {
   sanitizeSlug,
   selectCandidateEntries,
   writeEvalStub
-} from "./index-th667k1y.js";
+} from "./index-mrq61h10.js";
 import"./index-q7sjgr1y.js";
-import"./index-0ptf66x5.js";
-import"./index-parkaa70.js";
+import"./index-trvn0kg0.js";
+import"./index-vrvcn7k1.js";
 import"./index-m9zzj4ee.js";
 import"./index-xyvsdn07.js";
-import"./index-sz67z90q.js";
+import"./index-gpr3j0w1.js";
 import"./index-v1h70r3y.js";
 import"./index-rtry5xyf.js";
-import"./index-51dw4bjc.js";
+import"./index-gss7ch5k.js";
 import"./index-g22dps7x.js";
 import"./index-0725jpp7.js";
 import"./index-ypxq0x7r.js";
-import"./index-bn3aa5q1.js";
+import"./index-nbg19t1b.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
 import"./index-g57p8p1k.js";
@@ -59,11 +59,11 @@ import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
 import"./index-epzadpmm.js";
 import"./index-3t46mez1.js";
-import"./index-3020n6d9.js";
+import"./index-pvpeggb5.js";
 import"./index-sp2cxpaq.js";
 import"./index-qbxk2rn6.js";
 import"./index-zgwm4ryv.js";
-import"./index-p6v544jn.js";
+import"./index-yctvn9z9.js";
 import"./index-xfzkq1k4.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";

package/dist/cli/{snapshot-coordination-init-b4kmrgh7.js → snapshot-coordination-init-jn2rh2s8.js}

@@ -8,51 +8,51 @@ import {
   markSnapshotCoordinationClosing,
   retrySnapshotCoordinationInitialization,
   startSnapshotCoordinationInitialization
-} from "./index-2hnnkj64.js";
+} from "./index-y7khxj1g.js";
 import"./index-s3w41p1x.js";
-import"./index-qzakbjcg.js";
-import"./index-c9g3hkjz.js";
-import"./index-pe77h482.js";
+import"./index-ngzt2xmr.js";
+import"./index-bw6q2v41.js";
+import"./index-43scxm6a.js";
 import"./index-5snwc3dz.js";
 import"./index-axqyjreb.js";
 import"./index-txdagbh7.js";
-import"./index-dgyddtje.js";
-import"./index-z9mysg5m.js";
+import"./index-bt2h69a2.js";
+import"./index-4ts6jpmj.js";
 import"./index-rdec0y3z.js";
-import"./index-12h2rtdj.js";
-import"./index-qaqyq25k.js";
-import"./index-th667k1y.js";
+import"./index-kezh6nhq.js";
+import"./index-evf5t4ba.js";
+import"./index-mrq61h10.js";
 import"./index-1v277wxc.js";
 import"./index-wgf1780e.js";
 import"./index-x5jwegqw.js";
 import"./index-b4kdms7x.js";
-import"./index-0tygsk8b.js";
+import"./index-h29ckdg5.js";
 import"./index-pt7h91zc.js";
 import"./index-q7sjgr1y.js";
-import"./index-rzkmg02a.js";
-import"./index-w2bhrp6z.js";
+import"./index-sv514p10.js";
+import"./index-yk3b7ywa.js";
 import"./index-6b295cas.js";
 import"./index-9nyqt3kb.js";
-import"./index-vtkgg2qn.js";
+import"./index-4cw3w8qm.js";
 import"./index-v3bmwmqw.js";
 import"./index-8mrentmw.js";
-import"./index-3zspah3v.js";
-import"./index-sva5swrs.js";
-import"./index-3exe6k66.js";
+import"./index-pktvge7a.js";
+import"./index-rav29yb2.js";
+import"./index-ab1k780s.js";
 import"./index-spggmr30.js";
-import"./index-0ptf66x5.js";
-import"./index-parkaa70.js";
+import"./index-trvn0kg0.js";
+import"./index-vrvcn7k1.js";
 import"./index-m9zzj4ee.js";
 import"./index-xyvsdn07.js";
-import"./index-sz67z90q.js";
+import"./index-gpr3j0w1.js";
 import"./index-v1h70r3y.js";
 import"./index-rtry5xyf.js";
-import"./index-51dw4bjc.js";
+import"./index-gss7ch5k.js";
 import"./index-g22dps7x.js";
 import"./index-0725jpp7.js";
-import"./index-2m740hyt.js";
+import"./index-xfkzwc4p.js";
 import"./index-s9y49avf.js";
-import"./index-s8eac99p.js";
+import"./index-bncex5hw.js";
 import"./index-na6ph1fp.js";
 import"./index-ves1rtqt.js";
 import"./index-ry16d01s.js";
@@ -61,7 +61,7 @@ import"./index-nzfq1ms2.js";
 import"./index-7pmbnjvj.js";
 import"./index-9rwhas09.js";
 import"./index-ypxq0x7r.js";
-import"./index-bn3aa5q1.js";
+import"./index-nbg19t1b.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
 import"./index-g57p8p1k.js";
@@ -74,11 +74,11 @@ import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
 import"./index-epzadpmm.js";
 import"./index-3t46mez1.js";
-import"./index-3020n6d9.js";
+import"./index-pvpeggb5.js";
 import"./index-sp2cxpaq.js";
 import"./index-qbxk2rn6.js";
 import"./index-zgwm4ryv.js";
-import"./index-p6v544jn.js";
+import"./index-yctvn9z9.js";
 import"./index-xfzkq1k4.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";

package/dist/cli/{speckit-checkoff-1v02b2dt.js → speckit-checkoff-98zsw8c4.js}

@@ -7,15 +7,15 @@ import {
   parseSpeckitTasksContent,
   propagateSpeckitCheckoff,
   writeSpeckitCheckoffLedger
-} from "./index-3zspah3v.js";
+} from "./index-pktvge7a.js";
 import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
 import"./index-epzadpmm.js";
-import"./index-3020n6d9.js";
+import"./index-pvpeggb5.js";
 import"./index-sp2cxpaq.js";
 import"./index-qbxk2rn6.js";
 import"./index-zgwm4ryv.js";
-import"./index-p6v544jn.js";
+import"./index-yctvn9z9.js";
 import"./index-xfzkq1k4.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";

package/dist/cli/{worktree-collision-ownership-84m9f5an.js → worktree-collision-ownership-2xqxqp0x.js}

@@ -10,7 +10,7 @@ import {
 import {
   scanDelegationFallbacksForRecovery,
   scanDelegationsForRecovery
-} from "./index-0tygsk8b.js";
+} from "./index-h29ckdg5.js";
 import {
   scanWorktreeMergeFailuresForRecovery
 } from "./index-v3bmwmqw.js";
@@ -23,7 +23,7 @@ import"./index-rdm3px0g.js";
 import"./index-nzfq1ms2.js";
 import"./index-7pmbnjvj.js";
 import"./index-ypxq0x7r.js";
-import"./index-bn3aa5q1.js";
+import"./index-nbg19t1b.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
 import"./index-g57p8p1k.js";

package/dist/cli/{worktree-isolation-xwbszhja.js → worktree-isolation-rxpwxvw3.js}

@@ -25,53 +25,53 @@ import {
   sanitizeWorktreeTaskId,
   standardWorktreeByCallID,
   standardWorktreeSerializationSessions
-} from "./index-2hnnkj64.js";
+} from "./index-y7khxj1g.js";
 import"./index-s3w41p1x.js";
-import"./index-qzakbjcg.js";
-import"./index-c9g3hkjz.js";
-import"./index-pe77h482.js";
+import"./index-ngzt2xmr.js";
+import"./index-bw6q2v41.js";
+import"./index-43scxm6a.js";
 import"./index-5snwc3dz.js";
 import"./index-axqyjreb.js";
 import"./index-txdagbh7.js";
-import"./index-dgyddtje.js";
-import"./index-z9mysg5m.js";
+import"./index-bt2h69a2.js";
+import"./index-4ts6jpmj.js";
 import"./index-rdec0y3z.js";
-import"./index-12h2rtdj.js";
-import"./index-qaqyq25k.js";
-import"./index-th667k1y.js";
+import"./index-kezh6nhq.js";
+import"./index-evf5t4ba.js";
+import"./index-mrq61h10.js";
 import"./index-1v277wxc.js";
 import"./index-wgf1780e.js";
 import"./index-x5jwegqw.js";
 import"./index-b4kdms7x.js";
-import"./index-0tygsk8b.js";
+import"./index-h29ckdg5.js";
 import"./index-pt7h91zc.js";
 import"./index-q7sjgr1y.js";
-import"./index-rzkmg02a.js";
-import"./index-w2bhrp6z.js";
+import"./index-sv514p10.js";
+import"./index-yk3b7ywa.js";
 import"./index-6b295cas.js";
 import"./index-9nyqt3kb.js";
-import"./index-vtkgg2qn.js";
+import"./index-4cw3w8qm.js";
 import"./index-v3bmwmqw.js";
 import"./index-8mrentmw.js";
-import"./index-3zspah3v.js";
-import"./index-sva5swrs.js";
-import"./index-3exe6k66.js";
+import"./index-pktvge7a.js";
+import"./index-rav29yb2.js";
+import"./index-ab1k780s.js";
 import"./index-spggmr30.js";
-import"./index-0ptf66x5.js";
-import"./index-parkaa70.js";
+import"./index-trvn0kg0.js";
+import"./index-vrvcn7k1.js";
 import"./index-m9zzj4ee.js";
 import"./index-xyvsdn07.js";
-import"./index-sz67z90q.js";
+import"./index-gpr3j0w1.js";
 import"./index-v1h70r3y.js";
 import"./index-rtry5xyf.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-51dw4bjc.js";
+} from "./index-gss7ch5k.js";
 import"./index-g22dps7x.js";
 import"./index-0725jpp7.js";
-import"./index-2m740hyt.js";
+import"./index-xfkzwc4p.js";
 import"./index-s9y49avf.js";
-import"./index-s8eac99p.js";
+import"./index-bncex5hw.js";
 import"./index-na6ph1fp.js";
 import"./index-ves1rtqt.js";
 import"./index-ry16d01s.js";
@@ -80,7 +80,7 @@ import"./index-nzfq1ms2.js";
 import"./index-7pmbnjvj.js";
 import"./index-9rwhas09.js";
 import"./index-ypxq0x7r.js";
-import"./index-bn3aa5q1.js";
+import"./index-nbg19t1b.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
 import"./index-g57p8p1k.js";
@@ -93,11 +93,11 @@ import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
 import"./index-epzadpmm.js";
 import"./index-3t46mez1.js";
-import"./index-3020n6d9.js";
+import"./index-pvpeggb5.js";
 import"./index-sp2cxpaq.js";
 import"./index-qbxk2rn6.js";
 import"./index-zgwm4ryv.js";
-import"./index-p6v544jn.js";
+import"./index-yctvn9z9.js";
 import"./index-xfzkq1k4.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";

package/dist/config/schema.d.ts

@@ -3380,6 +3380,7 @@ export declare const PluginConfigSchema: z.ZodObject<{
             trusted_domains: z.ZodDefault<z.ZodArray<z.ZodString>>;
             protected_paths: z.ZodDefault<z.ZodArray<z.ZodString>>;
             allow_defaults: z.ZodDefault<z.ZodBoolean>;
+            trust_code_mode_wrapper: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
         denials: z.ZodDefault<z.ZodObject<{
             max_consecutive: z.ZodDefault<z.ZodNumber>;
@@ -3402,6 +3403,7 @@ export declare const PluginConfigSchema: z.ZodObject<{
             max_consecutive_dispatch_failures: z.ZodDefault<z.ZodNumber>;
             total_timeout_ms: z.ZodDefault<z.ZodNumber>;
             cleanup_timeout_ms: z.ZodDefault<z.ZodNumber>;
+            hook_timeout_ms: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strip>>;
     }, z.core.$strip>>>;
     pr_feedback_loop: z.ZodOptional<z.ZodObject<{

package/dist/full-auto/code-mode-program.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Strict recogniser for the only OpenCode v2 Code Mode programs Full-Auto may
+ * pass through without a critic (#3446).
+ *
+ * The Code Mode sandbox is not limited to hooked tools: it also exposes
+ * `fetch`, `Function`, `crypto`, `URL`, `Promise`, `JSON`, `Math` and `Date`
+ * (observed on OpenCode 2.1.4), so "the wrapper only routes nested tool calls"
+ * is false in general. A denylist over arbitrary JS cannot be made safe
+ * (`Function(...)`, computed member access, string concatenation). Instead,
+ * this module ACCEPTS a tiny grammar and rejects everything else:
+ *
+ *   program := ws [`return` ws] [`await` ws] callee ws `(` ws [value] ws `)` ws [`;`] ws
+ *   callee  := `search` | `tools` segment+
+ *   segment := `.` ident | `[` ws string ws `]`
+ *   value   := string | number | `true` | `false` | `null` | object | array
+ *   object  := `{` ws [pair (ws `,` ws pair)* [ws `,`]] ws `}`
+ *   pair    := (ident | string) ws `:` ws value
+ *
+ * That is exactly one tool call whose argument is plain data: no identifiers
+ * other than the callee path and object keys, so no other call, no member
+ * access on a value, no computed keys, no templates, comments, regexes or
+ * functions can appear. The nested call itself is still dispatched through the
+ * same tool.execute.before chain under its own name and classified there.
+ * Anything else (multi-statement, loops, variables, `fetch`, ...) returns
+ * false and Full-Auto keeps escalating it to the critic.
+ */
+/**
+ * True only when `code` is exactly one `tools.<path>(<plain data>)` or
+ * `search(<plain data>)` call, optionally prefixed by `return` and/or `await`.
+ */
+export declare function isSingleToolCallProgram(code: unknown): boolean;

package/dist/full-auto/critic-tools.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Tools denied to the Full-Auto critic agent (#3446).
+ *
+ * The critic's task is "verify using read-only tools only", but `shell`/`bash`
+ * are not read-only and — worse for latency — let the critic wander: on
+ * OpenCode 2 every observed critic session ran `grep -rl` / `find ~` over the
+ * user's home directory until the oversight deadline killed it, so no verdict
+ * was ever produced and Full-Auto paused. Shell is denied alongside the
+ * mutating tools; the critic keeps read/grep/glob and the swarm's own
+ * read-only verification tools (diff, evidence, test_impact, symbols).
+ *
+ * Limit, stated plainly: `execute` (OpenCode 2 Code Mode, which reaches plugin
+ * tools such as diff/evidence/test_impact) stays available to the critic by
+ * design, and its sandbox also exposes `fetch`/`Function`, which no hook sees.
+ * This denial list therefore bounds shell and mutating tools only; it is not a
+ * sandbox. A restricted critic Code Mode surface is a follow-up.
+ */
+export declare const FULL_AUTO_CRITIC_DENIED_TOOLS: Readonly<Record<string, false>>;

package/dist/full-auto/policy.d.ts

@@ -31,6 +31,8 @@ export interface FullAutoPolicyConfig {
         trusted_domains?: string[];
         protected_paths?: string[];
         allow_defaults?: boolean;
+        /** Opt in to passing the marked OpenCode 2 Code Mode wrapper (#3446). */
+        trust_code_mode_wrapper?: boolean;
     };
     oversight?: {
         on_high_risk_action?: boolean;
@@ -52,6 +54,21 @@ export interface FullAutoClassifierInput {
     planSummary?: string;
     changedFiles?: string[];
     fullAutoConfig: FullAutoPolicyConfig | undefined;
+    /**
+     * True for a call the OpenCode v2 adapter marked as the host's Code Mode
+     * `execute` wrapper (see `src/hooks/code-mode-wrapper.ts`). The mark is not
+     * proof of provenance (a same-named third-party tool is marked too), so it
+     * is only honoured with the operator opt-in `trust_code_mode_wrapper`.
+     */
+    hostCodeModeWrapper?: boolean;
+    /**
+     * True when this `swarm_command` is on the explicit read-only allowlist
+     * (`READ_ONLY_SWARM_COMMANDS`) AND the tool's own policy allows it. Computed
+     * by the permission hook so this module stays free of the command
+     * registry's import graph. Absent or false means the call is escalated like
+     * any unclassified tool.
+     */
+    swarmCommandReadOnly?: boolean;
     pluginConfig?: {
         memory?: {
             enabled?: boolean;

package/dist/hooks/code-mode-wrapper.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Per-call marker for the OpenCode v2 Code Mode `execute` wrapper (#3446).
+ *
+ * OpenCode v2 reaches plugin and MCP tools through one host-owned `execute`
+ * tool whose input is a JS program (`{ code }`); every nested `tools.<name>()`
+ * call is dispatched through the tool.execute.before chain under its own name.
+ * Only the v2 adapter sees the host's real tool id, so only the adapter can
+ * mark a call. The mark is NOT proof of provenance: a v2 tool event is just
+ * {tool, sessionID, agent, messageID, id, input}, so a plugin- or MCP-provided
+ * tool that shares the name `execute` and takes a string `code` is marked too.
+ * That is why the Full-Auto classifier only honours the mark when the operator
+ * opts in (`permission_policy.trust_code_mode_wrapper`, default false) and the
+ * program is exactly one plain-data tool call. On a v1 host nothing is marked.
+ *
+ * Side-channel shape mirrors `src/sandbox/skip-state.ts` (keyed by
+ * session + call, bounded, FIFO-evicted) so session state stays bounded
+ * (invariant 8).
+ */
+/** Hard cap on retained marks; oldest are evicted first. */
+export declare const MAX_CODE_MODE_WRAPPER_MARKS = 256;
+/** Record that this exact call is the host's Code Mode `execute` wrapper. */
+export declare function recordCodeModeWrapperCall(sessionID: string, callID: string): void;
+/** True only for a call the v2 adapter marked as the Code Mode wrapper. */
+export declare function isCodeModeWrapperCall(sessionID: string, callID: string | undefined): boolean;
+/** Drop a mark once the call has completed. */
+export declare function clearCodeModeWrapperCall(sessionID: string, callID: string): void;
+/** Test seam: drop every mark. */
+export declare function resetCodeModeWrapperCalls(): void;

package/dist/hooks/full-auto-intercept.d.ts

@@ -69,4 +69,9 @@ export declare function createFullAutoInterceptHook(config: PluginConfig, direct
         messages?: MessageWithParts[];
     }) => Promise<void>;
 };
+/**
+ * Builds additional context to append to the autonomous oversight prompt.
+ * This provides the architect's question/output for the critic to evaluate.
+ */
+export declare function buildCriticContext(architectOutput: string, escalationType: 'phase_completion' | 'question'): string;
 export {};

package/dist/hooks/full-auto-permission.d.ts

@@ -35,6 +35,31 @@ export interface FullAutoPermissionHookOptions {
     config: PluginConfig;
     directory: string;
 }
+/**
+ * `/swarm` commands that only read and display state. Deliberately SEPARATE from
+ * the tool policy's agent allowlist, which also contains state-changing and
+ * process-spawning commands (`auto-proceed`, `guardrail reset`, `attest`,
+ * `ci-simulate`, `gate-audit`, `review`, `post-mortem`, `pr subscribe`,
+ * `sdd project`, `*-opt` runs, ...). Canonical keys.
+ *
+ * The invariant is: no change to source, plan, gates or any operator-visible
+ * state, and no process spawn or network egress. Some of these commands do
+ * refresh bookkeeping under `.swarm/` (e.g. `report` writes `.swarm/swarm.db`
+ * and a cohort manifest, `memory *` create `.swarm/memory/memory.db`, and
+ * commands that load the plan may regenerate `plan.md`): writes are confined
+ * to `.swarm/`, which `tests/unit/hooks/full-auto-swarm-command-policy-3446.test.ts`
+ * pins by running every key and diffing the tree outside `.swarm/`. Keys that
+ * were shown to spawn processes (`diagnose`, `doctor tools`) or contact
+ * GitHub (`pr status`) are NOT in this set.
+ */
+export declare const READ_ONLY_SWARM_COMMANDS: ReadonlySet<string>;
+/**
+ * Is this `swarm_command` call on the read-only allowlist AND permitted by the
+ * tool's own policy for this exact command + args? Anything else (unknown,
+ * human-only, restricted, bad args, or any state-changing command) returns
+ * false and falls through to the normal escalation.
+ */
+export declare function isSwarmCommandReadOnly(args: unknown): boolean;
 export declare function createFullAutoPermissionHook(options: FullAutoPermissionHookOptions): {
     toolBefore: (input: {
         tool: string;

package/dist/hooks/pr-workflow-gate.d.ts

@@ -31,7 +31,7 @@ export { PR_REVIEW_BASE_DIMENSION_IDS };
 export declare const PR_REVIEW_REQUIRED_MICRO_LANE_IDS: ("auth-identity-secrets" | "untrusted-input-boundaries" | "subprocess-platform" | "concurrency-state" | "dependencies-build-release" | "api-schema-migrations" | "test-infrastructure" | "ui-accessibility-i18n" | "privacy-observability" | "generated-provenance" | "unclassified-risk")[];
 export type PrReviewBaseDimensionId = (typeof PR_REVIEW_BASE_DIMENSION_IDS)[number];
 export type PrWorkflowMode = 'PR_REVIEW' | 'PR_FEEDBACK';
-export type PrReviewLaneValidationPredicate = 'batch.validated_at' | 'batch.expected_lane_unique' | 'record.missing' | 'record.duplicate_lane' | 'record.subagent_session_id' | 'record.duplicate_subagent_session_id' | 'record.forbidden_subagent_session_id' | 'record.created_at' | 'record.workflow_lane' | 'record.owned_workflow_lanes' | 'record.mode' | 'record.pr_head_sha' | 'record.git_head' | 'record.status' | 'result.output_degraded' | 'result.transcript_incomplete' | 'result.chars' | 'result.digest' | 'result.output_ref' | 'artifact.readable' | 'artifact.ref' | 'artifact.batch_id' | 'artifact.lane_id' | 'artifact.mode' | 'artifact.session_id' | 'artifact.parent_session_id' | 'artifact.agent' | 'artifact.role' | 'artifact.source' | 'artifact.workflow_lane_record' | 'artifact.workflow_lane_expected' | 'artifact.pr_head_sha' | 'artifact.git_head' | 'artifact.revision_digest' | 'record.scope' | 'artifact.scope' | 'artifact.digest' | 'artifact.chars' | 'discovery.header' | 'discovery.row' | 'discovery.coverage' | 'discovery.duplicate_evidence' | 'reviewer.verdict_rows' | 'critic.verdict_rows';
+export type PrReviewLaneValidationPredicate = 'batch.validated_at' | 'batch.expected_lane_unique' | 'record.missing' | 'record.duplicate_lane' | 'record.subagent_session_id' | 'record.duplicate_subagent_session_id' | 'record.forbidden_subagent_session_id' | 'record.created_at' | 'record.workflow_lane' | 'record.owned_workflow_lanes' | 'record.mode' | 'record.normalized_agent' | 'record.pr_head_sha' | 'record.git_head' | 'record.status' | 'result.output_degraded' | 'result.transcript_incomplete' | 'result.chars' | 'result.digest' | 'result.output_ref' | 'artifact.readable' | 'artifact.ref' | 'artifact.batch_id' | 'artifact.lane_id' | 'artifact.mode' | 'artifact.session_id' | 'artifact.parent_session_id' | 'artifact.agent' | 'artifact.role' | 'artifact.source' | 'artifact.workflow_lane_record' | 'artifact.workflow_lane_expected' | 'artifact.pr_head_sha' | 'artifact.git_head' | 'artifact.revision_digest' | 'record.scope' | 'artifact.scope' | 'artifact.digest' | 'artifact.chars' | 'discovery.header' | 'discovery.row' | 'discovery.coverage' | 'discovery.duplicate_evidence' | 'reviewer.verdict_rows' | 'critic.verdict_rows';
 export interface PrReviewLaneValidationFailure {
     predicate: PrReviewLaneValidationPredicate;
     expected: string;
@@ -182,6 +182,15 @@ export interface PrWorkflowLaneSpec {
     laneId?: string;
     workflowLane?: string;
     reviewItemIds?: string[];
+    /**
+     * The agent this lane declares it will run (threaded from the dispatch
+     * lane's `agent`). The critic-phase recorder asserts its canonical role
+     * (issue #3340 AC1): PR_REVIEW critic batches are refused unless every
+     * lane declares an agent whose resolved role is exactly `critic`, so the
+     * role rule holds at the persisting boundary instead of only at the
+     * dispatch call site (#3310). Persisted on the batch record for audit.
+     */
+    agent?: string;
     /**
      * Complete dimension/family set this lane covers under a consolidated depth
      * tier. Must contain workflowLane. Absent means the singleton [workflowLane].
@@ -425,6 +434,8 @@ interface PrReviewValidationBatchRecord {
         laneId: string;
         workflowLane: string;
         reviewItemIds?: string[];
+        /** Declared lane agent (issue #3340 audit trail; critic batches refuse non-critic roles at record time). */
+        agent?: string;
     }>;
     validatedAt: string;
 }
@@ -1357,6 +1368,14 @@ export declare function recordPrReviewValidationBatch(directory: string, session
      * closed so the prompt can never misrepresent the stamped receipt.
      */
     expectedPresentationOrder?: 'A' | 'B';
+    /**
+     * Issue #3340 AC1: the generated-agent-name registry the dispatch
+     * caller resolves lane roles against. When supplied, the critic-phase
+     * admission below resolves declared agents through the identical
+     * strict resolver, so the gate verdict matches the dispatch verdict
+     * for prefixed generated names (e.g. `mega_critic`).
+     */
+    generatedAgentNames?: readonly string[];
 }): Promise<PrWorkflowGateState>;
 /**
  * Validate that every declared council obligation has a successful retry, and
@@ -1835,6 +1854,7 @@ export declare const _test_exports: {
                 laneId: string;
                 workflowLane: string;
                 reviewItemIds?: string[] | undefined;
+                agent?: string | undefined;
             }[];
             validatedAt: string;
         }[] | undefined;

package/dist/host/v2/hook-budget.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Budget for the OpenCode 2 `tool.execute.before` guard chain (#3446).
+ *
+ * The v2 adapter wraps the whole v1 before-chain in one timeout. The chain is
+ * normally instant, but while Full-Auto is running it can contain an LLM
+ * oversight dispatch whose own deadline (`full_auto.oversight.total_timeout_ms`,
+ * default 120 s, up to 300 s) is LONGER than the fixed 60 s the adapter used.
+ * The host then reported "tool.execute.before exceeded budget" at 60 s while the
+ * critic kept running to its own deadline, and the run paused.
+ *
+ * Resolution order:
+ *   1. `full_auto.oversight.hook_timeout_ms` when set (explicit, always applies);
+ *   2. else, while a Full-Auto run is active for the session:
+ *      `oversight.total_timeout_ms + 30 s` (never below the base);
+ *   3. else the 60 s base.
+ *
+ * Settings are keyed by project directory (one plugin process can host several
+ * projects, each with its own config); a call without a directory, or for an
+ * unknown one, uses the default slot, then the module defaults.
+ */
+export declare const V2_TOOL_BEFORE_BASE_MS = 60000;
+export declare const V2_TOOL_BEFORE_MARGIN_MS = 30000;
+export declare const V2_TOOL_BEFORE_MAX_MS = 900000;
+/** Max distinct project directories retained (invariant 8: bounded state). */
+export declare const V2_TOOL_BEFORE_BUDGET_MAX_ENTRIES = 64;
+/**
+ * Record the relevant `full_auto.oversight` settings for a project directory
+ * (call at setup; omit `directory` to set the default slot).
+ */
+export declare function configureV2ToolBeforeBudget(fullAuto: unknown, directory?: string): void;
+/** Budget, in ms, for one `tool.execute.before` chain. */
+export declare function resolveV2ToolBeforeBudgetMs(fullAutoActive: boolean, directory?: string): number;
+/**
+ * Restore defaults for one project directory (setup failure path), or for
+ * everything when called without an argument (test seam).
+ */
+export declare function resetV2ToolBeforeBudget(directory?: string): void;

package/dist/host/v2/hooks.d.ts

@@ -40,6 +40,15 @@ import type { V1HooksSubset, V2PluginContext, V2Registration } from './types';
 /** Mirrors `isTaskToolId`'s shape (dotted SDK form OR normalized base name).
  * Exported for the event pump's progress-event gating (issue #3401). */
 export declare function isV2SubagentToolId(toolName: string | null | undefined): boolean;
+/**
+ * True for the host's Code Mode wrapper (#3446): the host-owned `execute`
+ * tool whose input is a JS program. The host id is matched exactly (no
+ * namespace stripping), and the call must carry a string `code` program.
+ */
+export declare function isV2CodeModeWrapper(event: {
+    readonly tool: string;
+    readonly input?: unknown;
+}): boolean;
 /**
  * Any recognized v2 subagent id (bare, namespace-prefixed, or dotted) is handed
  * to the v1 chain as the bare v1 id `task`. The v1 host reports the native tool

package/dist/host/v2/setup.d.ts

@@ -1,3 +1,16 @@
+/**
+ * Read `full_auto.oversight` once and size the v2 tool.execute.before budget
+ * for this project directory from it (#3446). Bounded and fail-open: on any
+ * error this project's entry is dropped and the module defaults apply (60 s
+ * base; 150 s while a Full-Auto run is active, i.e. the default 120 s
+ * oversight deadline + 30 s) and an operator-visible warning is queued,
+ * because a custom `hook_timeout_ms` / `total_timeout_ms` would not apply.
+ */
+declare function deferredV2ConfigureToolBeforeBudget(directory: string, loadConfig?: typeof loadPluginConfigWithMetaAsync): Promise<void>;
+export declare const _internals: {
+    configureToolBeforeBudget: typeof deferredV2ConfigureToolBeforeBudget;
+};
+import { loadPluginConfigWithMetaAsync } from '../../config/loader';
 import type { V1HooksSubset, V2PluginContext } from './types';
 /** Dependencies injected from src/index.ts (avoids an index↔host cycle). */
 export interface V2SetupDependencies {
@@ -24,3 +37,4 @@ export declare function seedV1SessionState(sessionID: string | undefined, agentR
  * be synchronous and cheap).
  */
 export declare function v2ToolInputSchema(args: unknown): unknown;
+export {};