Adversarial Review

Critical / High

1. HIGH — src/libswamp/vaults/create.ts: Missing auto-resolve for extension vault types (@-prefixed)

   The old vault_create.ts CLI handler had this block before checking the registry:

   if (!vaultTypeRegistry.has(vaultType) && vaultType.startsWith("@")) {
     await resolveVaultType(vaultType, getAutoResolver());
   }

   The new vaultCreate generator skips this entirely — deps.getVaultTypeInfo just calls vaultTypeRegistry.get(type) and if the type isn't already registered, it immediately yields a validation_failed error.

   Breaking example: swamp vault create @my-org/custom-vault my-vault — this worked before (auto-resolved the extension, registered the type, then created the vault). Now it fails with "Unknown vault type: @my-org/custom-vault".

   Suggested fix: Add a resolveVaultType method to VaultCreateDeps (similar to ModelCreateDeps.resolveModelType) that calls resolveVaultType() from extension_auto_resolver.ts before checking the registry. Call it at the top of the generator before deps.getVaultTypeInfo().

Medium

2. MEDIUM — src/libswamp/repo/init.ts:75,165: RepoInitInput.version and RepoUpgradeInput.version are dead fields

   Both RepoInitInput and RepoUpgradeInput declare a version: string field. The CLI passes VERSION into both. But neither repoInit nor repoUpgrade generators ever read input.version — the version is baked into the deps via createRepoInitDeps(VERSION) / createRepoUpgradeDeps(VERSION) which constructs new RepoService(version). The field is carried through the input for no reason.

   Not a behavioral bug, but it's a confusing API contract — callers must supply a version that is silently ignored. Either remove the field from the input types, or use it in the generator instead of baking it into deps.

Low

3. LOW — src/libswamp/repo/init.ts:112,203: Unsafe as AiTool cast on user-provided string

   input.tool as AiTool is a type assertion on a string that comes from CLI options. If the Cliffy enum type validation ever changes or a caller bypasses it, an invalid tool value would pass through unchecked. The old code had the same pattern, so this isn't a regression — but since the generator is now a reusable library function (not just a CLI handler), the blast radius is wider.

Verdict

FAIL — The missing vault extension auto-resolve (#1) is a behavioral regression that breaks creation of @-scoped extension vault types. Fix that and this is good to merge.

CLI UX Review

Blocking

None.

Suggestions

1. src/presentation/renderers/workflow_create.ts — step names are now bold: The old workflow_create_output.ts rendered step names as plain text (${step.name}), while the new renderer uses ${bold(step.name)}. This is a minor visual improvement but contradicts the PR description's claim that output is "identical". No action needed, just noting the discrepancy.

2. src/presentation/renderers/repo_init.ts — LogRepoInitRenderer omits details on init that upgrade shows: repo upgrade logs skills updated, instructions, settings, and gitignore status. repo init only logs path and tool. This asymmetry predates this PR, but since both renderers are now side-by-side in the same file, it's worth aligning them someday.

Verdict

PASS — Purely internal refactor, all 7 commands maintain correct log/JSON output, error messages are clear and actionable, no regressions observed.

Code Review

Blocking Issues

None.

DDD Assessment

The generators correctly implement the Application Service pattern — they orchestrate domain objects for use cases, own the transaction boundary via deps injection, and yield progress/completion events. All infrastructure access is properly abstracted through deps interfaces, keeping generators fully testable with fakes. Domain value objects (ModelType.create(), RepoPath.create()) and constants (RENAMED_VAULT_TYPES) are appropriately used directly as pure domain logic.

Convention Compliance

• AGPLv3 headers: All new .ts files have correct headers ✅
• No any types: All code is strictly typed (existing AnyOptions pattern in CLI commands uses lint-ignore, consistent with codebase) ✅
• Named exports: All files use named exports ✅
• libswamp import boundary: All renderers and CLI commands import from src/libswamp/mod.ts — never from internal paths ✅
• Both output modes: All commands support "log" and "json" modes via renderer factory pattern ✅
• Test coverage: All 8 generators have corresponding _test.ts files with 17 unit tests covering success paths, validation errors, and edge cases ✅
• mod.ts exports: All new types, generators, and deps factories are properly exported ✅
• DDD ratchet: Updated 48 → 49 (net +1 from new repo_init renderer infrastructure import) ✅

Suggestions (non-blocking)

1. modelCreate redundant ModelType.create() call (src/libswamp/models/create.ts:118): The generator calls ModelType.create(input.typeArg) and then passes input.typeArg to deps.resolveModelType(), which internally also calls ModelType.create(). The modelType value from line 118 is used later for getModelDef/createAndSave, so it's not wasted — but if ModelType.create() ever threw on invalid input, the error would be uncaught here (unlike the deps call which is behind the null-check). Minor, since the current ModelType.create() appears to normalize rather than throw.

2. CI: claude-ux-review job (.github/workflows/ci.yml): Well-structured addition. The new UX review job is gated behind path filters for src/cli/commands/**, src/presentation/**, and src/domain/errors.ts, which is a sensible scope. The auto-merge job correctly depends on it.

Verdict

Clean refactor following established patterns consistently across all 8 generators. Good test coverage, proper DDD layering, and correct import boundaries. LGTM.