opencode-swarm 7.200.1 → 7.200.3

package/dist/cli/{skill-generator-q4afafh3.js → skill-generator-7hxqq63r.js}

@@ -33,20 +33,20 @@ import {
   sanitizeSlug,
   selectCandidateEntries,
   writeEvalStub
-} from "./index-th667k1y.js";
+} from "./index-xxvman1m.js";
 import"./index-q7sjgr1y.js";
-import"./index-0ptf66x5.js";
-import"./index-parkaa70.js";
+import"./index-v5nh2fhv.js";
+import"./index-encs4mdm.js";
 import"./index-m9zzj4ee.js";
-import"./index-xyvsdn07.js";
-import"./index-sz67z90q.js";
+import"./index-5q3hg1pk.js";
+import"./index-44z8mv05.js";
 import"./index-v1h70r3y.js";
 import"./index-rtry5xyf.js";
-import"./index-51dw4bjc.js";
+import"./index-pmcvznag.js";
 import"./index-g22dps7x.js";
 import"./index-0725jpp7.js";
 import"./index-ypxq0x7r.js";
-import"./index-bn3aa5q1.js";
+import"./index-5c6zse74.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
 import"./index-g57p8p1k.js";
@@ -59,11 +59,11 @@ import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
 import"./index-epzadpmm.js";
 import"./index-3t46mez1.js";
-import"./index-3020n6d9.js";
+import"./index-tmhwpzdg.js";
 import"./index-sp2cxpaq.js";
 import"./index-qbxk2rn6.js";
 import"./index-zgwm4ryv.js";
-import"./index-p6v544jn.js";
+import"./index-5ph10kdd.js";
 import"./index-xfzkq1k4.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";

package/dist/cli/{snapshot-coordination-init-b4kmrgh7.js → snapshot-coordination-init-kh4dayg5.js}

@@ -8,51 +8,51 @@ import {
   markSnapshotCoordinationClosing,
   retrySnapshotCoordinationInitialization,
   startSnapshotCoordinationInitialization
-} from "./index-2hnnkj64.js";
+} from "./index-95k0fkhp.js";
 import"./index-s3w41p1x.js";
-import"./index-qzakbjcg.js";
-import"./index-c9g3hkjz.js";
-import"./index-pe77h482.js";
+import"./index-bft3404e.js";
+import"./index-yg4923ga.js";
+import"./index-mff4szvk.js";
 import"./index-5snwc3dz.js";
 import"./index-axqyjreb.js";
 import"./index-txdagbh7.js";
-import"./index-dgyddtje.js";
-import"./index-z9mysg5m.js";
+import"./index-bcn30s7q.js";
+import"./index-8x90j950.js";
 import"./index-rdec0y3z.js";
-import"./index-12h2rtdj.js";
-import"./index-qaqyq25k.js";
-import"./index-th667k1y.js";
-import"./index-1v277wxc.js";
-import"./index-wgf1780e.js";
+import"./index-q49vqmzh.js";
+import"./index-y46b7a5g.js";
+import"./index-xxvman1m.js";
+import"./index-0vv7vzp8.js";
+import"./index-1j14kbak.js";
 import"./index-x5jwegqw.js";
-import"./index-b4kdms7x.js";
-import"./index-0tygsk8b.js";
+import"./index-7rpcbnp8.js";
+import"./index-2nq7h5cj.js";
 import"./index-pt7h91zc.js";
 import"./index-q7sjgr1y.js";
-import"./index-rzkmg02a.js";
-import"./index-w2bhrp6z.js";
+import"./index-5g0nrnyd.js";
+import"./index-dgv5xy0b.js";
 import"./index-6b295cas.js";
 import"./index-9nyqt3kb.js";
-import"./index-vtkgg2qn.js";
+import"./index-vyb5xf36.js";
 import"./index-v3bmwmqw.js";
 import"./index-8mrentmw.js";
-import"./index-3zspah3v.js";
-import"./index-sva5swrs.js";
-import"./index-3exe6k66.js";
+import"./index-8f7wgcpz.js";
+import"./index-j2x2ajz7.js";
+import"./index-2r6d72m6.js";
 import"./index-spggmr30.js";
-import"./index-0ptf66x5.js";
-import"./index-parkaa70.js";
+import"./index-v5nh2fhv.js";
+import"./index-encs4mdm.js";
 import"./index-m9zzj4ee.js";
-import"./index-xyvsdn07.js";
-import"./index-sz67z90q.js";
+import"./index-5q3hg1pk.js";
+import"./index-44z8mv05.js";
 import"./index-v1h70r3y.js";
 import"./index-rtry5xyf.js";
-import"./index-51dw4bjc.js";
+import"./index-pmcvznag.js";
 import"./index-g22dps7x.js";
 import"./index-0725jpp7.js";
-import"./index-2m740hyt.js";
+import"./index-eac47j2q.js";
 import"./index-s9y49avf.js";
-import"./index-s8eac99p.js";
+import"./index-9cffn82s.js";
 import"./index-na6ph1fp.js";
 import"./index-ves1rtqt.js";
 import"./index-ry16d01s.js";
@@ -61,7 +61,7 @@ import"./index-nzfq1ms2.js";
 import"./index-7pmbnjvj.js";
 import"./index-9rwhas09.js";
 import"./index-ypxq0x7r.js";
-import"./index-bn3aa5q1.js";
+import"./index-5c6zse74.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
 import"./index-g57p8p1k.js";
@@ -74,11 +74,11 @@ import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
 import"./index-epzadpmm.js";
 import"./index-3t46mez1.js";
-import"./index-3020n6d9.js";
+import"./index-tmhwpzdg.js";
 import"./index-sp2cxpaq.js";
 import"./index-qbxk2rn6.js";
 import"./index-zgwm4ryv.js";
-import"./index-p6v544jn.js";
+import"./index-5ph10kdd.js";
 import"./index-xfzkq1k4.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";

package/dist/cli/{speckit-checkoff-1v02b2dt.js → speckit-checkoff-n8s920fs.js}

@@ -7,15 +7,15 @@ import {
   parseSpeckitTasksContent,
   propagateSpeckitCheckoff,
   writeSpeckitCheckoffLedger
-} from "./index-3zspah3v.js";
+} from "./index-8f7wgcpz.js";
 import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
 import"./index-epzadpmm.js";
-import"./index-3020n6d9.js";
+import"./index-tmhwpzdg.js";
 import"./index-sp2cxpaq.js";
 import"./index-qbxk2rn6.js";
 import"./index-zgwm4ryv.js";
-import"./index-p6v544jn.js";
+import"./index-5ph10kdd.js";
 import"./index-xfzkq1k4.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";

package/dist/cli/{workspace-snapshot-93gzfac2.js → workspace-snapshot-veqaqrjr.js}

@@ -52,8 +52,8 @@ import {
   shouldSkipSnapshot,
   switchPrFeedbackTrackingCandidateAsync,
   workspaceSnapshotMatches
-} from "./index-1v277wxc.js";
-import"./index-xyvsdn07.js";
+} from "./index-0vv7vzp8.js";
+import"./index-5q3hg1pk.js";
 import"./index-te9hq2f4.js";
 import"./index-epzadpmm.js";
 import"./index-sp2cxpaq.js";

package/dist/cli/{worktree-collision-ownership-84m9f5an.js → worktree-collision-ownership-7cz0a2sr.js}

@@ -6,15 +6,15 @@ import {
   WORKTREE_PROVISIONING_OWNER_LEASE_MS,
   removeWorktreeProvisioningOwner,
   scanWorktreeProvisioningOwnersForRecovery
-} from "./index-b4kdms7x.js";
+} from "./index-7rpcbnp8.js";
 import {
   scanDelegationFallbacksForRecovery,
   scanDelegationsForRecovery
-} from "./index-0tygsk8b.js";
+} from "./index-2nq7h5cj.js";
 import {
   scanWorktreeMergeFailuresForRecovery
 } from "./index-v3bmwmqw.js";
-import"./index-xyvsdn07.js";
+import"./index-5q3hg1pk.js";
 import"./index-s9y49avf.js";
 import"./index-na6ph1fp.js";
 import"./index-ves1rtqt.js";
@@ -23,7 +23,7 @@ import"./index-rdm3px0g.js";
 import"./index-nzfq1ms2.js";
 import"./index-7pmbnjvj.js";
 import"./index-ypxq0x7r.js";
-import"./index-bn3aa5q1.js";
+import"./index-5c6zse74.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
 import"./index-g57p8p1k.js";

package/dist/cli/{worktree-isolation-xwbszhja.js → worktree-isolation-4dbza44f.js}

@@ -25,53 +25,53 @@ import {
   sanitizeWorktreeTaskId,
   standardWorktreeByCallID,
   standardWorktreeSerializationSessions
-} from "./index-2hnnkj64.js";
+} from "./index-95k0fkhp.js";
 import"./index-s3w41p1x.js";
-import"./index-qzakbjcg.js";
-import"./index-c9g3hkjz.js";
-import"./index-pe77h482.js";
+import"./index-bft3404e.js";
+import"./index-yg4923ga.js";
+import"./index-mff4szvk.js";
 import"./index-5snwc3dz.js";
 import"./index-axqyjreb.js";
 import"./index-txdagbh7.js";
-import"./index-dgyddtje.js";
-import"./index-z9mysg5m.js";
+import"./index-bcn30s7q.js";
+import"./index-8x90j950.js";
 import"./index-rdec0y3z.js";
-import"./index-12h2rtdj.js";
-import"./index-qaqyq25k.js";
-import"./index-th667k1y.js";
-import"./index-1v277wxc.js";
-import"./index-wgf1780e.js";
+import"./index-q49vqmzh.js";
+import"./index-y46b7a5g.js";
+import"./index-xxvman1m.js";
+import"./index-0vv7vzp8.js";
+import"./index-1j14kbak.js";
 import"./index-x5jwegqw.js";
-import"./index-b4kdms7x.js";
-import"./index-0tygsk8b.js";
+import"./index-7rpcbnp8.js";
+import"./index-2nq7h5cj.js";
 import"./index-pt7h91zc.js";
 import"./index-q7sjgr1y.js";
-import"./index-rzkmg02a.js";
-import"./index-w2bhrp6z.js";
+import"./index-5g0nrnyd.js";
+import"./index-dgv5xy0b.js";
 import"./index-6b295cas.js";
 import"./index-9nyqt3kb.js";
-import"./index-vtkgg2qn.js";
+import"./index-vyb5xf36.js";
 import"./index-v3bmwmqw.js";
 import"./index-8mrentmw.js";
-import"./index-3zspah3v.js";
-import"./index-sva5swrs.js";
-import"./index-3exe6k66.js";
+import"./index-8f7wgcpz.js";
+import"./index-j2x2ajz7.js";
+import"./index-2r6d72m6.js";
 import"./index-spggmr30.js";
-import"./index-0ptf66x5.js";
-import"./index-parkaa70.js";
+import"./index-v5nh2fhv.js";
+import"./index-encs4mdm.js";
 import"./index-m9zzj4ee.js";
-import"./index-xyvsdn07.js";
-import"./index-sz67z90q.js";
+import"./index-5q3hg1pk.js";
+import"./index-44z8mv05.js";
 import"./index-v1h70r3y.js";
 import"./index-rtry5xyf.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-51dw4bjc.js";
+} from "./index-pmcvznag.js";
 import"./index-g22dps7x.js";
 import"./index-0725jpp7.js";
-import"./index-2m740hyt.js";
+import"./index-eac47j2q.js";
 import"./index-s9y49avf.js";
-import"./index-s8eac99p.js";
+import"./index-9cffn82s.js";
 import"./index-na6ph1fp.js";
 import"./index-ves1rtqt.js";
 import"./index-ry16d01s.js";
@@ -80,7 +80,7 @@ import"./index-nzfq1ms2.js";
 import"./index-7pmbnjvj.js";
 import"./index-9rwhas09.js";
 import"./index-ypxq0x7r.js";
-import"./index-bn3aa5q1.js";
+import"./index-5c6zse74.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
 import"./index-g57p8p1k.js";
@@ -93,11 +93,11 @@ import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
 import"./index-epzadpmm.js";
 import"./index-3t46mez1.js";
-import"./index-3020n6d9.js";
+import"./index-tmhwpzdg.js";
 import"./index-sp2cxpaq.js";
 import"./index-qbxk2rn6.js";
 import"./index-zgwm4ryv.js";
-import"./index-p6v544jn.js";
+import"./index-5ph10kdd.js";
 import"./index-xfzkq1k4.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";

package/dist/config/schema.d.ts

@@ -3380,6 +3380,7 @@ export declare const PluginConfigSchema: z.ZodObject<{
             trusted_domains: z.ZodDefault<z.ZodArray<z.ZodString>>;
             protected_paths: z.ZodDefault<z.ZodArray<z.ZodString>>;
             allow_defaults: z.ZodDefault<z.ZodBoolean>;
+            trust_code_mode_wrapper: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
         denials: z.ZodDefault<z.ZodObject<{
             max_consecutive: z.ZodDefault<z.ZodNumber>;
@@ -3402,6 +3403,7 @@ export declare const PluginConfigSchema: z.ZodObject<{
             max_consecutive_dispatch_failures: z.ZodDefault<z.ZodNumber>;
             total_timeout_ms: z.ZodDefault<z.ZodNumber>;
             cleanup_timeout_ms: z.ZodDefault<z.ZodNumber>;
+            hook_timeout_ms: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strip>>;
     }, z.core.$strip>>>;
     pr_feedback_loop: z.ZodOptional<z.ZodObject<{

package/dist/full-auto/code-mode-program.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Strict recogniser for the only OpenCode v2 Code Mode programs Full-Auto may
+ * pass through without a critic (#3446).
+ *
+ * The Code Mode sandbox is not limited to hooked tools: it also exposes
+ * `fetch`, `Function`, `crypto`, `URL`, `Promise`, `JSON`, `Math` and `Date`
+ * (observed on OpenCode 2.1.4), so "the wrapper only routes nested tool calls"
+ * is false in general. A denylist over arbitrary JS cannot be made safe
+ * (`Function(...)`, computed member access, string concatenation). Instead,
+ * this module ACCEPTS a tiny grammar and rejects everything else:
+ *
+ *   program := ws [`return` ws] [`await` ws] callee ws `(` ws [value] ws `)` ws [`;`] ws
+ *   callee  := `search` | `tools` segment+
+ *   segment := `.` ident | `[` ws string ws `]`
+ *   value   := string | number | `true` | `false` | `null` | object | array
+ *   object  := `{` ws [pair (ws `,` ws pair)* [ws `,`]] ws `}`
+ *   pair    := (ident | string) ws `:` ws value
+ *
+ * That is exactly one tool call whose argument is plain data: no identifiers
+ * other than the callee path and object keys, so no other call, no member
+ * access on a value, no computed keys, no templates, comments, regexes or
+ * functions can appear. The nested call itself is still dispatched through the
+ * same tool.execute.before chain under its own name and classified there.
+ * Anything else (multi-statement, loops, variables, `fetch`, ...) returns
+ * false and Full-Auto keeps escalating it to the critic.
+ */
+/**
+ * True only when `code` is exactly one `tools.<path>(<plain data>)` or
+ * `search(<plain data>)` call, optionally prefixed by `return` and/or `await`.
+ */
+export declare function isSingleToolCallProgram(code: unknown): boolean;

package/dist/full-auto/critic-tools.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Tools denied to the Full-Auto critic agent (#3446).
+ *
+ * The critic's task is "verify using read-only tools only", but `shell`/`bash`
+ * are not read-only and — worse for latency — let the critic wander: on
+ * OpenCode 2 every observed critic session ran `grep -rl` / `find ~` over the
+ * user's home directory until the oversight deadline killed it, so no verdict
+ * was ever produced and Full-Auto paused. Shell is denied alongside the
+ * mutating tools; the critic keeps read/grep/glob and the swarm's own
+ * read-only verification tools (diff, evidence, test_impact, symbols).
+ *
+ * Limit, stated plainly: `execute` (OpenCode 2 Code Mode, which reaches plugin
+ * tools such as diff/evidence/test_impact) stays available to the critic by
+ * design, and its sandbox also exposes `fetch`/`Function`, which no hook sees.
+ * This denial list therefore bounds shell and mutating tools only; it is not a
+ * sandbox. A restricted critic Code Mode surface is a follow-up.
+ */
+export declare const FULL_AUTO_CRITIC_DENIED_TOOLS: Readonly<Record<string, false>>;

package/dist/full-auto/policy.d.ts

@@ -31,6 +31,8 @@ export interface FullAutoPolicyConfig {
         trusted_domains?: string[];
         protected_paths?: string[];
         allow_defaults?: boolean;
+        /** Opt in to passing the marked OpenCode 2 Code Mode wrapper (#3446). */
+        trust_code_mode_wrapper?: boolean;
     };
     oversight?: {
         on_high_risk_action?: boolean;
@@ -52,6 +54,21 @@ export interface FullAutoClassifierInput {
     planSummary?: string;
     changedFiles?: string[];
     fullAutoConfig: FullAutoPolicyConfig | undefined;
+    /**
+     * True for a call the OpenCode v2 adapter marked as the host's Code Mode
+     * `execute` wrapper (see `src/hooks/code-mode-wrapper.ts`). The mark is not
+     * proof of provenance (a same-named third-party tool is marked too), so it
+     * is only honoured with the operator opt-in `trust_code_mode_wrapper`.
+     */
+    hostCodeModeWrapper?: boolean;
+    /**
+     * True when this `swarm_command` is on the explicit read-only allowlist
+     * (`READ_ONLY_SWARM_COMMANDS`) AND the tool's own policy allows it. Computed
+     * by the permission hook so this module stays free of the command
+     * registry's import graph. Absent or false means the call is escalated like
+     * any unclassified tool.
+     */
+    swarmCommandReadOnly?: boolean;
     pluginConfig?: {
         memory?: {
             enabled?: boolean;

package/dist/hooks/code-mode-wrapper.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Per-call marker for the OpenCode v2 Code Mode `execute` wrapper (#3446).
+ *
+ * OpenCode v2 reaches plugin and MCP tools through one host-owned `execute`
+ * tool whose input is a JS program (`{ code }`); every nested `tools.<name>()`
+ * call is dispatched through the tool.execute.before chain under its own name.
+ * Only the v2 adapter sees the host's real tool id, so only the adapter can
+ * mark a call. The mark is NOT proof of provenance: a v2 tool event is just
+ * {tool, sessionID, agent, messageID, id, input}, so a plugin- or MCP-provided
+ * tool that shares the name `execute` and takes a string `code` is marked too.
+ * That is why the Full-Auto classifier only honours the mark when the operator
+ * opts in (`permission_policy.trust_code_mode_wrapper`, default false) and the
+ * program is exactly one plain-data tool call. On a v1 host nothing is marked.
+ *
+ * Side-channel shape mirrors `src/sandbox/skip-state.ts` (keyed by
+ * session + call, bounded, FIFO-evicted) so session state stays bounded
+ * (invariant 8).
+ */
+/** Hard cap on retained marks; oldest are evicted first. */
+export declare const MAX_CODE_MODE_WRAPPER_MARKS = 256;
+/** Record that this exact call is the host's Code Mode `execute` wrapper. */
+export declare function recordCodeModeWrapperCall(sessionID: string, callID: string): void;
+/** True only for a call the v2 adapter marked as the Code Mode wrapper. */
+export declare function isCodeModeWrapperCall(sessionID: string, callID: string | undefined): boolean;
+/** Drop a mark once the call has completed. */
+export declare function clearCodeModeWrapperCall(sessionID: string, callID: string): void;
+/** Test seam: drop every mark. */
+export declare function resetCodeModeWrapperCalls(): void;

package/dist/hooks/full-auto-intercept.d.ts

@@ -69,4 +69,9 @@ export declare function createFullAutoInterceptHook(config: PluginConfig, direct
         messages?: MessageWithParts[];
     }) => Promise<void>;
 };
+/**
+ * Builds additional context to append to the autonomous oversight prompt.
+ * This provides the architect's question/output for the critic to evaluate.
+ */
+export declare function buildCriticContext(architectOutput: string, escalationType: 'phase_completion' | 'question'): string;
 export {};

package/dist/hooks/full-auto-permission.d.ts

@@ -35,6 +35,31 @@ export interface FullAutoPermissionHookOptions {
     config: PluginConfig;
     directory: string;
 }
+/**
+ * `/swarm` commands that only read and display state. Deliberately SEPARATE from
+ * the tool policy's agent allowlist, which also contains state-changing and
+ * process-spawning commands (`auto-proceed`, `guardrail reset`, `attest`,
+ * `ci-simulate`, `gate-audit`, `review`, `post-mortem`, `pr subscribe`,
+ * `sdd project`, `*-opt` runs, ...). Canonical keys.
+ *
+ * The invariant is: no change to source, plan, gates or any operator-visible
+ * state, and no process spawn or network egress. Some of these commands do
+ * refresh bookkeeping under `.swarm/` (e.g. `report` writes `.swarm/swarm.db`
+ * and a cohort manifest, `memory *` create `.swarm/memory/memory.db`, and
+ * commands that load the plan may regenerate `plan.md`): writes are confined
+ * to `.swarm/`, which `tests/unit/hooks/full-auto-swarm-command-policy-3446.test.ts`
+ * pins by running every key and diffing the tree outside `.swarm/`. Keys that
+ * were shown to spawn processes (`diagnose`, `doctor tools`) or contact
+ * GitHub (`pr status`) are NOT in this set.
+ */
+export declare const READ_ONLY_SWARM_COMMANDS: ReadonlySet<string>;
+/**
+ * Is this `swarm_command` call on the read-only allowlist AND permitted by the
+ * tool's own policy for this exact command + args? Anything else (unknown,
+ * human-only, restricted, bad args, or any state-changing command) returns
+ * false and falls through to the normal escalation.
+ */
+export declare function isSwarmCommandReadOnly(args: unknown): boolean;
 export declare function createFullAutoPermissionHook(options: FullAutoPermissionHookOptions): {
     toolBefore: (input: {
         tool: string;

package/dist/hooks/pr-workflow-gate.d.ts

@@ -31,7 +31,7 @@ export { PR_REVIEW_BASE_DIMENSION_IDS };
 export declare const PR_REVIEW_REQUIRED_MICRO_LANE_IDS: ("auth-identity-secrets" | "untrusted-input-boundaries" | "subprocess-platform" | "concurrency-state" | "dependencies-build-release" | "api-schema-migrations" | "test-infrastructure" | "ui-accessibility-i18n" | "privacy-observability" | "generated-provenance" | "unclassified-risk")[];
 export type PrReviewBaseDimensionId = (typeof PR_REVIEW_BASE_DIMENSION_IDS)[number];
 export type PrWorkflowMode = 'PR_REVIEW' | 'PR_FEEDBACK';
-export type PrReviewLaneValidationPredicate = 'batch.validated_at' | 'batch.expected_lane_unique' | 'record.missing' | 'record.duplicate_lane' | 'record.subagent_session_id' | 'record.duplicate_subagent_session_id' | 'record.forbidden_subagent_session_id' | 'record.created_at' | 'record.workflow_lane' | 'record.owned_workflow_lanes' | 'record.mode' | 'record.pr_head_sha' | 'record.git_head' | 'record.status' | 'result.output_degraded' | 'result.transcript_incomplete' | 'result.chars' | 'result.digest' | 'result.output_ref' | 'artifact.readable' | 'artifact.ref' | 'artifact.batch_id' | 'artifact.lane_id' | 'artifact.mode' | 'artifact.session_id' | 'artifact.parent_session_id' | 'artifact.agent' | 'artifact.role' | 'artifact.source' | 'artifact.workflow_lane_record' | 'artifact.workflow_lane_expected' | 'artifact.pr_head_sha' | 'artifact.git_head' | 'artifact.revision_digest' | 'record.scope' | 'artifact.scope' | 'artifact.digest' | 'artifact.chars' | 'discovery.header' | 'discovery.row' | 'discovery.coverage' | 'discovery.duplicate_evidence' | 'reviewer.verdict_rows' | 'critic.verdict_rows';
+export type PrReviewLaneValidationPredicate = 'batch.validated_at' | 'batch.expected_lane_unique' | 'record.missing' | 'record.duplicate_lane' | 'record.subagent_session_id' | 'record.duplicate_subagent_session_id' | 'record.forbidden_subagent_session_id' | 'record.created_at' | 'record.workflow_lane' | 'record.owned_workflow_lanes' | 'record.mode' | 'record.normalized_agent' | 'record.pr_head_sha' | 'record.git_head' | 'record.status' | 'result.output_degraded' | 'result.transcript_incomplete' | 'result.chars' | 'result.digest' | 'result.output_ref' | 'artifact.readable' | 'artifact.ref' | 'artifact.batch_id' | 'artifact.lane_id' | 'artifact.mode' | 'artifact.session_id' | 'artifact.parent_session_id' | 'artifact.agent' | 'artifact.role' | 'artifact.source' | 'artifact.workflow_lane_record' | 'artifact.workflow_lane_expected' | 'artifact.pr_head_sha' | 'artifact.git_head' | 'artifact.revision_digest' | 'record.scope' | 'artifact.scope' | 'artifact.digest' | 'artifact.chars' | 'discovery.header' | 'discovery.row' | 'discovery.coverage' | 'discovery.duplicate_evidence' | 'reviewer.verdict_rows' | 'critic.verdict_rows';
 export interface PrReviewLaneValidationFailure {
     predicate: PrReviewLaneValidationPredicate;
     expected: string;
@@ -182,6 +182,15 @@ export interface PrWorkflowLaneSpec {
     laneId?: string;
     workflowLane?: string;
     reviewItemIds?: string[];
+    /**
+     * The agent this lane declares it will run (threaded from the dispatch
+     * lane's `agent`). The critic-phase recorder asserts its canonical role
+     * (issue #3340 AC1): PR_REVIEW critic batches are refused unless every
+     * lane declares an agent whose resolved role is exactly `critic`, so the
+     * role rule holds at the persisting boundary instead of only at the
+     * dispatch call site (#3310). Persisted on the batch record for audit.
+     */
+    agent?: string;
     /**
      * Complete dimension/family set this lane covers under a consolidated depth
      * tier. Must contain workflowLane. Absent means the singleton [workflowLane].
@@ -425,6 +434,8 @@ interface PrReviewValidationBatchRecord {
         laneId: string;
         workflowLane: string;
         reviewItemIds?: string[];
+        /** Declared lane agent (issue #3340 audit trail; critic batches refuse non-critic roles at record time). */
+        agent?: string;
     }>;
     validatedAt: string;
 }
@@ -1357,6 +1368,14 @@ export declare function recordPrReviewValidationBatch(directory: string, session
      * closed so the prompt can never misrepresent the stamped receipt.
      */
     expectedPresentationOrder?: 'A' | 'B';
+    /**
+     * Issue #3340 AC1: the generated-agent-name registry the dispatch
+     * caller resolves lane roles against. When supplied, the critic-phase
+     * admission below resolves declared agents through the identical
+     * strict resolver, so the gate verdict matches the dispatch verdict
+     * for prefixed generated names (e.g. `mega_critic`).
+     */
+    generatedAgentNames?: readonly string[];
 }): Promise<PrWorkflowGateState>;
 /**
  * Validate that every declared council obligation has a successful retry, and
@@ -1835,6 +1854,7 @@ export declare const _test_exports: {
                 laneId: string;
                 workflowLane: string;
                 reviewItemIds?: string[] | undefined;
+                agent?: string | undefined;
             }[];
             validatedAt: string;
         }[] | undefined;

package/dist/hooks/utils.d.ts

@@ -25,6 +25,21 @@ type HookHandler<I, O> = (input: I, output: O) => Promise<void>;
 export declare function markFailClosed<I, O>(fn: HookHandler<I, O>): HookHandler<I, O> & {
     __failClosed?: true;
 };
+/**
+ * Read-once accessor for the swallowed-command-error registry (#3318 AC6):
+ * returns the recorded error message for the exact (sessionID, command) pair
+ * and consumes the entry, or undefined when nothing is recorded (a miss
+ * consumes nothing). The v2 command dispatcher is the sole designed reader.
+ *
+ * `sinceMs` (#2910 W6 / review PRR-006): when provided, a record OLDER than
+ * this timestamp is STALE timeout residue (a timed-out dispatch's handler
+ * throwing after its dispatch already returned) — it is consumed and ignored
+ * (undefined) so it cannot poison this dispatch. Records created at or after
+ * `sinceMs` are fresh failures of THIS dispatch.
+ */
+export declare function getLastSwallowedCommandError(sessionID: string, command: string, sinceMs?: number): string | undefined;
+/** Empty the swallowed-command-error registry (v2 setup cleanup / tests). */
+export declare function clearSwallowedCommandErrorRegistry(): void;
 export declare function safeHook<I, O>(fn: HookHandler<I, O>): HookHandler<I, O>;
 /**
  * `composeHandlers` runs handlers sequentially, wrapping EACH handler in