@ordewell/core 0.10.11 → 0.11.0

package/dist/index.d.ts

@@ -1,11 +1,12 @@
-import { t as IsolationMergeResult, am as Task, E as ExecutionActor, h as ExecutionRecord, i as GuardTrip, al as SupervisorLevel, g as ExecutionCommandName, G as GuardTarget, p as IsolationLandedTask, I as IWorktreeIsolation, J as IsolationTaskStatus, N as PlanIsolation, a7 as RunnerId, a2 as ResearchProgress, az as UsageRecord, a1 as ResearchLogEntry, f as DiscoveredModel, L as LegacyPlanState, a8 as RunnerSessionCost, a5 as ResearchToolType, a0 as ReportedWindow, T as PlannerUsage, at as TaskSkillSnapshot, aj as SkillsService, au as TaskSnapshot, O as PlanState, K as IsolationView, aB as Verdict } from './Task-CfBM0wkV.js';
-export { A as ApprovalRecord, a as AttemptUsage, b as AwaitingReason, B as BUILTIN_SKILL_NAMES, C as ContextFill, c as ConversationMessage, d as CostProvenance, D as DEFAULT_RUNNERS, e as DEFAULT_SUPERVISOR_RETRY_LIMIT, j as IntegrationDisposal, k as InvalidSkill, l as IsolationAvailability, m as IsolationHandoff, n as IsolationHandoffRepo, o as IsolationInactiveReason, q as IsolationLanding, r as IsolationMergeBlock, s as IsolationMergeBlockReason, u as IsolationOutcome, v as IsolationPruneResult, w as IsolationRemoval, x as IsolationRepo, y as IsolationRun, z as IsolationTaskRecord, F as IsolationTaskRef, H as IsolationTaskRepo, M as ModelUsage, Q as PlanStatus, R as PlanUsage, S as PlannerResendState, U as PrepareIntent, V as PreparedTask, W as PreservedWork, X as PreviousWork, Y as RefusedRemoval, Z as RepairEvidence, _ as ReplyRun, $ as RepoGroupLayout, a3 as ResearchStep, a4 as ResearchStepOutcome, a6 as RunSettings, a9 as SessionBilling, aa as SetupFailure, ab as ShadowedSkill, ac as SkillAppliesTo, ad as SkillCatalog, ae as SkillInfo, af as SkillLoad, ag as SkillLoadNotice, ah as SkillMetadata, ai as SkillSource, ap as TaskIsolation, aq as TaskIsolationState, ar as TaskModelAssignment, av as TaskStatus, aw as TaskUsageSummary, ax as TreeSnapshot, ay as UsageLine, aA as UsageTotals, aC as VerificationCheck, aD as addAttemptUsage, aE as addModelUsage, aF as addPlannerUsage, aG as addUsage, aH as addUsageTotals, aI as contextMeterText, aJ as contextMeterTitle, aK as costText, aL as countedSessionCost, aM as createEmptyPlan, aN as createSkillsService, aO as createTask, aP as endAttemptUsage, aQ as flattenTasks, aR as flattenTasksWithParents, aS as formatCost, aT as formatTokenCount, aU as isAwaitingReason, aV as isMeasured, aW as isSupervisorLevel, aX as isUserMessage, aY as migratePlanState, aZ as modelCostTitle, a_ as partedPromptUsage, a$ as pausedOnLimit, b0 as planUsage, b1 as plannerContextFill, b2 as rejoinPlanTree, b3 as resumedSessionWindow, b4 as startAttemptUsage, b5 as subagentCostTitle, b6 as taskUsageSummary, b7 as tasksTotalText, b8 as usageLine, b9 as usageText, ba as waitsForApproval } from './Task-CfBM0wkV.js';
-import { bv as StartAdmission, bw as StartWait, aY as ResolveAll, a8 as IWebFetcher, cp as WebReadPolicy, cn as WebRead, co as WebReadDecision, aw as PendingApprovals, K as ConversationTurn, aL as PlannerModes, a6 as IAiService, I as ConversationRequest, n as AssignmentWriter, m as AssignmentScope, c1 as TaskQueryCatalog, k as AssignmentCatalog, b7 as RunnerCatalog, bl as SessionMessage, bh as SessionBroadcaster, bn as SessionNotice, aC as PlanStore, bX as TaskOrchestrator, ab as IsolationRunController, at as OrchestratorObserver, bQ as TaskLogEvent, a7 as INotification, a2 as GlobalRunSettings, aF as PlannerConversationHost, aE as PlannerConversation, av as PendingApproval, E as ConversationCompaction, a_ as RewindTarget, b6 as RunView, b1 as RunMergeView, b_ as TaskOutputSource, cl as UserSettings, ae as LiveTailOptions, ad as LiveTail, bm as SessionMeta, aK as PlannerModelStore, aJ as PlannerModelRecall, aG as PlannerModelCandidate } from './runSettingsText-C5uv2axI.js';
-export { A as ACT_RISK, a as AUTORUN_RISK, b as AdoptSessionResponse, c as ApplyTaskOpsResult, d as ApprovalAnswerResponse, e as ApprovalBlock, f as ApprovalRequestMessage, g as ApprovalStatus, h as ApprovalsResponse, i as ApproveReviewResponse, j as AskOptions, l as AssignmentIssue, o as AutoMergeTrigger, B as BlockingSubject, C as CHAT_COMMANDS, p as CHECKPOINT_TRUNCATE_LENGTH, q as CancelPlanningResponse, r as CancelResumeResponse, s as CliAgentAiService, t as CliAgentAiServiceDeps, u as CommandBlock, v as CommandDescriptor, w as CommandStatus, x as CommandsResponse, y as CompactionBlock, z as ConversationBusyError, D as ConversationCompactResponse, F as ConversationEditError, G as ConversationForkResponse, H as ConversationInput, J as ConversationRewindResponse, L as ConversationView, M as DEFAULT_WEB_READ_BUDGET, N as DaemonErrorCode, O as DecideOptions, P as DiffRow, Q as DiffRowKind, R as DiffStat, S as DisplayBlock, T as EMPTY_CONVERSATION, U as EMPTY_HOLD, V as EMPTY_RUN, W as EMPTY_TASK_LOG, X as EMPTY_TASK_LOG_FOLLOW, Y as ErrorBody, Z as ExecuteResponse, _ as ExecutionSummary, $ as ForceSendResponse, a0 as GatedConversation, a1 as GeneratePlanResponse, a3 as HEADLESS_CLI_COMMANDS, a4 as HeldEdit, a5 as HeldEditMark, a9 as IsolationDiffResponse, aa as IsolationMergeResponse, ac as LiveOutputLookup, af as LocalEntry, ag as MarkdownToken, ah as MergeGateEntry, ai as MergeGateResponse, aj as MessageBlock, ak as MessageRole, al as ModelsResponse, am as NOT_STARTED, an as NO_TURN, ao as NewTaskFields, ap as NotificationAction, aq as OUTPUT_LINES_DEFAULT, ar as OUTPUT_LINES_MAX, as as OkResponse, au as OutputPreview, ax as PendingApprovalsOptions, ay as PlanBlock, az as PlanMarkerStatus, aA as PlanResponse, aB as PlanSnapshot, aD as PlannerCommandSyntax, aH as PlannerModelChoice, aI as PlannerModelMemory, aM as PlannerNotReady, aN as PlannerNotReadyError, aO as PlannerReadinessConfig, aP as PlannerSubmission, aQ as PlannerTurnDiscardedError, aR as PlannerTurnStoppedError, aS as PlannerUsageLimitError, aT as PrdResponse, aU as PromptHold, aV as RUN_SETTINGS_DEFAULTS, aX as RemoveMessageResponse, aZ as ResolveConflictResponse, a$ as RewindTargetsResponse, b0 as RunInput, b2 as RunSettingsError, b3 as RunSnapshotFrame, b4 as RunTask, b5 as RunTaskStatus, b8 as RunnerLoadedBlock, b9 as RunnersResponse, ba as STOPPED_BEFORE_START, bb as SUPERVISOR_LEVEL_LABEL, bc as SerializedConversationMessage, bd as SerializedPendingTurn, be as SerializedPlan, bf as SerializedTask, bg as SerializedTaskStatus, bi as SessionData, bj as SessionFrame, bk as SessionListResponse, bo as SessionResponse, bp as SettingsResponse, bq as SettingsService, br as SettingsUpdateResponse, bs as SkillInvocation, bt as SkillLoadBlock, bu as SkillToken, bx as StopResponse, by as StreamStamp, bz as SubagentBlock, bA as SubagentChild, bB as SubagentStatus, bC as SurfacePlan, bD as SurfacePlanState, bE as SurfaceTask, bF as TASK_QUERY_ANSWER_MAX_CHARS, bG as TASK_QUERY_ANSWER_OR_OPS, bH as TASK_QUERY_FIELDS, bI as TASK_QUERY_PROTOCOL, bJ as TASK_QUERY_REMINDER, bK as TERMINAL_UI_COMMANDS, bL as TakenPrompt, bM as TaskAttemptSnapshot, bN as TaskControlError, bO as TaskLogAttemptsResponse, bP as TaskLogBatch, bR as TaskLogFollow, bS as TaskLogFollowInput, bT as TaskLogResponse, bU as TaskLogView, bV as TaskMessageResponse, bW as TaskOp, bY as TaskOrchestratorDeps, bZ as TaskOrchestratorOptions, b$ as TaskPlacement, c0 as TaskQuery, c2 as TaskQueryField, c3 as TaskRef, c4 as TaskRowAction, c5 as TaskRowContext, c6 as TaskRowIsolation, c7 as TaskRowKind, c8 as TaskRowPlacement, c9 as TaskRowSubject, ca as TaskRowUsage, cb as TaskRowView, cc as TaskStartResponse, cd as TaskStatusKind, ce as ThinkingDisplayBlock, cf as ToolBlock, cg as ToolHeadline, ch as ToolStatus, ci as TreeTask, cj as TurnGate, ck as UsageBlock, cm as WAITS_FOR_APPROVAL_LABEL, cq as Worded, cr as WorkspacesResponse, cs as abbreviateHome, ct as aheadOfDraft, cu as applyTaskOps, cv as approvalLabel, cw as assignmentIssue, cx as assignmentIssueText, cy as automergeSummary, cz as autorunSummary, cA as awaitingLabel, cB as blockedByLabel, cC as blockingFailures, cD as canMergeTasks, cE as canSetDependencies, cF as canSplitTask, cG as capConflictFiles, cH as classifyOutcome, cI as coalesceTaskLog, cJ as createAiService, cK as dependencyCandidates, cL as dependentsNotice, cM as dependentsOf, cN as describePlannerNotReady, cO as diffRows, cP as diffStat, cQ as diffSummary, cR as digestTaskLog, cS as drainNext, cT as executionSummary, cU as followTaskLog, cV as followTurn, cW as fromTranscript, cX as getSettingsPath, cY as hasHiddenDetail, cZ as holdPrompt, c_ as isTaskRunning, c$ as loadedSkillTokens, d0 as markAction, d1 as markRequestFor, d2 as markdownHtml, d3 as markdownTokens, d4 as namedRepos, d5 as newTaskFields, d6 as opsEditable, d7 as outputLines, d8 as outputPreview, d9 as parseCount, da as parseSwitch, db as parseTaskOpsJson, dc as parseTaskQueryJson, dd as pastGateConfirmation, de as plannerMessage, df as plannerNotReady, dg as plannerNotReadyFor, dh as plannerTranscript, di as reconcileApprovals, dj as reduceConversation, dk as reduceRun, dl as reduceTaskLog, dm as renderTaskQueryAnswer, dn as replayTaskLog, dp as resolveSkillInvocation, dq as resolveTaskRef, dr as resolveUserTaskRef, ds as resumeLabel, dt as resumeTime, du as runSettingsOf, dv as runnerToolSubject, dw as serializePlan, dx as serializeTask, dy as serializeTaskStatus, dz as skillTokens, dA as skippedLabel, dB as stopTurn, dC as subtreeIds, dD as summarizeToolCall, dE as supervisorSummary, dF as surfacePlan, dG as surfacePlanState, dH as takeAt, dI as taskLogForSurface, dJ as taskOrderLabel, dK as taskPlacement, dL as taskQuerySignature, dM as taskRef, dN as taskRefOf, dO as taskRowActions, dP as taskRowView, dQ as taskStartedNotice, dR as taskStatusKind, dS as textHasTaskOps, dT as textHasTaskQuery, dU as titledRefs, dV as titledTaskRef, dW as titledTaskRefOf, dX as toTaskLogEvent, dY as toolHeadline, dZ as trimToolOutput, d_ as truncateCheckpointSummary, d$ as unsendAll, e0 as unsendLatest, e1 as walkPlan } from './runSettingsText-C5uv2axI.js';
-import { j as ApprovalDecision, J as IApproval, L as IFileSystem, ak as ResearchShell, aj as ReadFileOpts, aU as ToolOutcome, H as GrepOptions, B as GlobOptions, y as FindSymbolOptions, M as IRunner, K as IConfig, a9 as PlannerBackendId, af as ProviderModelLists, f as AiProvider, m as ApprovalModeSetting, ac as PlannerToolHandler, ay as RunnerRegistry, a3 as OrchestratorOption, d as AgentProcessDeps, aM as TaskModeAgentAdapter, a as AgentAdapter, e as AgentStartOptions, c as AgentEvent, ap as RunnerCommand, ad as ProjectMcpServer, N as IRunnerSession, n as ApprovalPolicy, i as ApprovalAnswer, a4 as OrdewellMcpServer, aJ as TaskCompleteArgs, r as CheckpointAnswer, aE as StructuredTurnEnd, aD as StructuredEvent, aL as TaskMessageFrom, ah as QueuedTaskMessage, aR as TaskStartOptions, aS as TaskTokenScope, at as RunnerManifest, aQ as TaskRunnerFlags } from './IFileSystem-lTRL_G9Z.js';
-export { A as AUTO_COMMANDS, b as AgentAdapterFactory, g as AllProviderModels, h as AnswerApprovalArgs, k as ApprovalKind, l as ApprovalMode, o as ApprovalPolicyOptions, p as ApprovalRequest, q as ApprovalSource, C as CatalogModel, s as CheckpointArgs, t as CommandClassification, u as CommandTier, v as CommandWords, D as DEFAULT_PLANNER_ALLOWLIST, w as DENY_ALL, x as DiscoveryCommand, E as EditPlanArgs, F as FetchAllProviderModelsOptions, G as GIT_READONLY_SUBCOMMANDS, z as GREP_DEFAULT_HEAD_LIMIT, I as GrepOutputMode, O as InvokedCommand, P as LineBuffer, Q as ListModelsArgs, R as ListRunnersArgs, S as LoadSkillArgs, T as McpClientConfig, U as McpCredential, V as McpTool, W as McpToolContext, X as McpToolReply, Y as MessageTaskArgs, Z as ModelCatalog, _ as ModelShortcut, $ as ORCHESTRATOR_SHORTCUTS, a0 as ORDEWELL_MCP_PATH, a1 as ORDEWELL_MCP_SERVER_NAME, a2 as OneTaskArgs, a5 as OwnerOnlyFile, a6 as PLANNER_EXECUTION_TOOLS, a7 as PLANNER_TOOLS, a8 as PlannerAllowlist, aa as PlannerStartOptions, ab as PlannerTokenScope, ae as ProviderCredentialSource, ag as ProviderModelsResult, ai as REFUSED_COMMANDS, al as ResearchShellDeps, am as RetryTaskArgs, an as RunCommandArgs, ao as RunPlanArgs, aq as RunnerCommandKind, ar as RunnerEntry, as as RunnerFeatures, au as RunnerMcpServer, av as RunnerMode, aw as RunnerModelDiscovery, ax as RunnerModelRef, az as SEARCH_EXCLUSIONS, aA as ShellDialect, aB as SpawnFn, aC as StandingDecision, aF as SubmitPlanArgs, aG as TASK_COMPLETE_TOOL, aH as TASK_COMPLETION_CONTRACT, aI as TASK_TOOLS, aK as TaskDiffArgs, aN as TaskModeUnsupportedError, aO as TaskOutputArgs, aP as TaskQueryArgs, aT as TaskToolHandler, aW as approvalScopes, aX as classifyCommand, aY as clearResearchShellCache, aZ as collectProviderCredentials, a_ as commandAllowedBy, a$ as effectiveApprovalMode, b0 as enabledRunners, b1 as fetchAllProviderModels, b2 as findRunnerCommand, b3 as isGranted, b4 as isRunnerApproval, b5 as knownModelId, b6 as mcpClientConfig, b7 as ownerOnlyConfigFile, b8 as parseAllowlist, b9 as parseApprovalModeSetting, ba as researchShellWarning, bb as researchToolsPath, bc as resolveModelShortcut, bd as resolveProvider, be as resolveResearchShell, bf as scopeAllowed, bg as sharedMcpServer, bh as toApprovalDecision, bi as toOrchestratorOptions, bj as toolAllowed } from './IFileSystem-lTRL_G9Z.js';
-import { R as RunnerModeInfo } from './ModeResolver-CoJAJD-f.js';
-export { a as autonomyLevelLabel, p as parseAutonomyLevel, r as runnerModesFrom } from './ModeResolver-CoJAJD-f.js';
+import { az as RunnerId, au as ResearchProgress, b6 as UsageRecord, at as ResearchLogEntry, aS as Task, i as DiscoveredModel, I as IIsolationPreview, x as IWorktreeIsolation, $ as IsolationTaskStatus, a0 as IsolationView, a8 as PlanIsolation, a1 as LegacyPlanState, aA as RunnerSessionCost, as as ReportedWindow, ag as PlannerUsage, a$ as TaskSkillSnapshot, aO as SkillsService, E as ExecutionActor, b0 as TaskSnapshot, a9 as PlanState, b8 as Verdict, aP as StoredHandoff, p as HandoffCheck } from './Task-BL4Idm9r.js';
+export { A as ApprovalRecord, a as AttemptUsage, b as AwaitingReason, B as BUILTIN_SKILL_NAMES, C as ContextCheckpoint, c as ContextFill, d as ConversationMessage, e as CostProvenance, D as DEFAULT_LOOP_ROUNDS, f as DEFAULT_RUNNERS, g as DEFAULT_SUPERVISOR_RETRY_LIMIT, h as DIGEST_FINDINGS, j as ExecutionCommandName, k as ExecutionRecord, F as FindingSeverity, G as GuardTarget, l as GuardTrip, H as HANDOFF_LIMITS, m as HANDOFF_PUSH_CHARS, n as Handoff, o as HandoffArtifact, q as HandoffCommit, r as HandoffDigest, s as HandoffEvidence, t as HandoffFinding, u as HandoffPatch, v as HandoffPreviewOptions, w as HandoffTaskName, y as IntegrationDisposal, z as InvalidSkill, J as IsolationAvailability, K as IsolationHandoff, L as IsolationHandoffRepo, M as IsolationInactiveReason, N as IsolationLandedTask, O as IsolationLanding, P as IsolationMergeBlock, Q as IsolationMergeBlockReason, R as IsolationMergeResult, S as IsolationOutcome, T as IsolationPreview, U as IsolationPruneResult, V as IsolationRemoval, W as IsolationRepo, X as IsolationRun, Y as IsolationTaskRecord, Z as IsolationTaskRef, _ as IsolationTaskRepo, a2 as LoopSubject, a3 as MAX_LOOP_ROUNDS, a4 as ModelUsage, a5 as PatchFlag, a6 as PatchView, aa as PlanStatus, ab as PlanUsage, ac as PlannerCompaction, ad as PlannerCompactionOutcome, ae as PlannerContextPause, af as PlannerResendState, ah as PrepareIntent, ai as PreparedTask, aj as PreservedWork, ak as PreviewRepo, al as PreviousWork, am as REPORT_MAX_CHARS, an as RefusedRemoval, ao as RepairEvidence, ap as ReplyRun, aq as RepoGroupLayout, ar as RepoHead, av as ResearchStep, aw as ResearchStepOutcome, ay as RunSettings, aB as SEVERITY_LABEL, aC as ScriptConsent, aD as ScriptResult, aE as SessionBilling, aF as SetupFailure, aG as ShadowedSkill, aH as SkillAppliesTo, aI as SkillCatalog, aJ as SkillInfo, aK as SkillLoad, aL as SkillLoadNotice, aM as SkillMetadata, aN as SkillSource, aR as SupervisorLevel, aV as TaskIsolation, aW as TaskIsolationState, aX as TaskLoop, aY as TaskModelAssignment, b1 as TaskStatus, b2 as TaskType, b3 as TaskUsageSummary, b4 as TreeSnapshot, b5 as UsageLine, b7 as UsageTotals, b9 as VerificationCheck, ba as addAttemptUsage, bb as addModelUsage, bc as addPlannerUsage, bd as addUsage, be as addUsageTotals, bf as artifactLines, bg as betweenRounds, bh as boundedHandoffLines, bi as byteSize, bj as checkHandoff, bk as checkOf, bl as contextMeterText, bm as contextMeterTitle, bn as costText, bo as countedSessionCost, bp as createEmptyPlan, bq as createSkillsService, br as createTask, bs as endAttemptUsage, bt as findingLines, bu as flattenTasks, bv as flattenTasksWithParents, bw as formatCost, bx as formatTokenCount, by as handoffDigest, bz as handoffLines, bA as handoffPreviewLines, bB as handoffReferenceText, bC as handoffWakeLines, bD as inLoop, bE as isAwaitingReason, bF as isMeasured, bG as isSupervisorLevel, bH as isUserMessage, bI as loopRemovalRefusal, bJ as loopRoundOf, bK as migratePlanState, bL as modelCostTitle, bM as namedHandoff, bN as openingLines, bO as outOfRounds, bP as partedPromptUsage, bQ as patchChangesText, bR as patchFlagText, bS as patchLines, bT as patchLinesText, bU as patchText, bV as patchView, bW as pausedOnLimit, bX as planUsage, bY as plannerContextFill, bZ as readableTaskIds, b_ as rejoinPlanTree, b$ as resumedSessionWindow, c0 as savedPatchOf, c1 as savedPatchView, c2 as savedPatchViews, c3 as severityLabel, c4 as startAttemptUsage, c5 as storedHandoff, c6 as subagentCostTitle, c7 as taskUsageSummary, c8 as tasksTotalText, c9 as usageLine, ca as usageText, cb as waitsForApproval, cc as withPatch, cd as worstSeverity } from './Task-BL4Idm9r.js';
+import { da as TurnBudgets, b4 as PlanIntake, ao as IWebFetcher, V as ConversationTurn, bj as PlannerModes, by as ResolveAll, dj as WebReadPolicy, dg as WebRead, dh as WebReadDecision, di as WebReadOptions, b0 as PendingApprovals, al as IAiService, ba as PlannerContextDeps, bb as PlannerContextStatus, M as ContextCondenseRequest, T as ConversationRequest, bL as RunnerAuthExec, bK as RunnerAuth, b as AccountLimitBucket, c as AccountLimitSnapshot, t as AssignmentWriter, s as AssignmentScope, cS as TaskQueryCatalog, q as AssignmentCatalog, bO as RunnerCatalog, c6 as SessionMessage, b_ as SessionBroadcaster, c8 as SessionNotice, b8 as PlanStore, cM as TaskOrchestrator, at as IsolationRunController, aX as OrchestratorObserver, cB as TaskLogEvent, bx as ResearchTasks, an as INotification, ag as GlobalRunSettings, c1 as SessionHeld, c3 as SessionLease, bd as PlannerConversationHost, bc as PlannerConversation, aa as ExecutionCommand, F as CommandOutcome, a$ as PendingApproval, P as ConversationCompaction, bA as RewindTarget, bJ as RunView, bE as RunMergeView, bC as RunActivity, cP as TaskOutputSource, aw as LeaseHost, dd as UserSettings, aB as LiveTailOptions, aA as LiveTail, c7 as SessionMeta, bi as PlannerModelStore, bh as PlannerModelRecall, be as PlannerModelCandidate } from './runSettingsText-CAXiTpsj.js';
+export { A as ACT_RISK, a as AUTORUN_RISK, d as AccountLimitStatus, e as AccountLimitWindow, f as AccountLimitsFrame, g as AccountLimitsMessage, h as AdoptSessionResponse, i as ApplyTaskOpsResult, j as ApprovalAnswerResponse, k as ApprovalBlock, l as ApprovalRequestMessage, m as ApprovalStatus, n as ApprovalsResponse, o as ApproveReviewResponse, p as AskOptions, r as AssignmentIssue, u as AutoMergeTrigger, B as BlockingSubject, C as CHAT_COMMANDS, v as CHECKPOINT_TRUNCATE_LENGTH, w as CancelPlanningResponse, x as CancelResumeResponse, y as CliAgentAiService, z as CliAgentAiServiceDeps, D as CommandBlock, E as CommandDescriptor, G as CommandPayload, H as CommandStatus, I as CommandsResponse, J as CompactionBlock, K as CompactionStatus, L as Consent, N as ConversationBusyError, O as ConversationCompactResponse, Q as ConversationEditError, R as ConversationForkResponse, S as ConversationInput, U as ConversationRewindResponse, W as ConversationView, X as DEFAULT_WEB_READ_BUDGET, Y as DaemonErrorCode, Z as DecideOptions, _ as DiffRow, $ as DiffRowKind, a0 as DiffStat, a1 as DisplayBlock, a2 as EMPTY_CONVERSATION, a3 as EMPTY_HOLD, a4 as EMPTY_RUN, a5 as EMPTY_TASK_LOG, a6 as EMPTY_TASK_LOG_FOLLOW, a7 as ErrorBody, a8 as ExecuteCommandResponse, a9 as ExecuteResponse, ab as ExecutionCommands, ac as ExecutionHost, ad as ExecutionSummary, ae as GatedConversation, af as GeneratePlanResponse, ah as HEADLESS_CLI_COMMANDS, ai as HandoffBlock, aj as HandoffForkRepo, ak as HandoffPeekSubject, am as IDLE_ACTIVITY, ap as IsolationDiffResponse, aq as IsolationMergeResponse, ar as IsolationPreviewNotice, as as IsolationPreviewResponse, au as LEASE_HEARTBEAT_MS, av as LEASE_STALE_MS, ax as LeaseHostKind, ay as LeaseHostOptions, az as LiveOutputLookup, aC as LocalEntry, aD as LoopCheckFacts, aE as LoopCheckState, aF as LoopGuard, aG as MappedTool, aH as MarkdownToken, aI as MergeGateEntry, aJ as MergeGateResponse, aK as MergeWordingHandoff, aL as MessageBlock, aM as MessageRole, aN as ModelsResponse, aO as NOT_STARTED, aP as NO_TURN, aQ as NewTaskFields, aR as NotificationAction, aS as OUTPUT_LINES_DEFAULT, aT as OUTPUT_LINES_MAX, aU as OkResponse, aV as OpRef, aW as OpRefusal, aY as OutputPreview, aZ as OverrideDirection, a_ as PLANNED_WITH_LABEL, b1 as PendingApprovalsOptions, b2 as PlanBlock, b3 as PlanBlocks, b5 as PlanMarkerStatus, b6 as PlanResponse, b7 as PlanSnapshot, b9 as PlannerCommandSyntax, bf as PlannerModelChoice, bg as PlannerModelMemory, bk as PlannerNotReady, bl as PlannerNotReadyError, bm as PlannerReadinessConfig, bn as PlannerSubmission, bo as PlannerTurnDiscardedError, bp as PlannerTurnStoppedError, bq as PlannerUsageLimitError, br as PrdResponse, bs as PromptHold, bt as REPORT_PREVIEW_LINES, bu as RUN_SETTINGS_DEFAULTS, bv as ReadRunnerAuthOptions, bz as ResolveConflictResponse, bB as RewindTargetsResponse, bD as RunInput, bF as RunSettingsError, bG as RunSnapshotFrame, bH as RunTask, bI as RunTaskStatus, bM as RunnerAuthExecOptions, bN as RunnerAuthExecResult, bP as RunnerLoadedBlock, bQ as RunnersResponse, bR as STOPPED_BEFORE_START, bS as SUPERVISOR_LEVELS, bT as SUPERVISOR_LEVEL_LABEL, bU as SerializedConversationMessage, bV as SerializedPendingTurn, bW as SerializedPlan, bX as SerializedTask, bY as SerializedTaskStatus, bZ as ServerInfoResponse, b$ as SessionData, c0 as SessionFrame, c2 as SessionHeldError, c4 as SessionLeaseRecord, c5 as SessionListResponse, c9 as SessionResponse, ca as SettingsResponse, cb as SettingsService, cc as SettingsUpdateResponse, cd as SkillInvocation, ce as SkillLoadBlock, cf as SkillToken, cg as StartAdmission, ch as StopResponse, ci as StreamStamp, cj as SubagentBlock, ck as SubagentChild, cl as SubagentStatus, cm as SupervisorPolicy, cn as SurfacePlan, co as SurfacePlanState, cp as SurfaceTask, cq as TASK_QUERY_ANSWER_MAX_CHARS, cr as TASK_QUERY_ANSWER_OR_OPS, cs as TASK_QUERY_FIELDS, ct as TASK_QUERY_PROTOCOL, cu as TASK_QUERY_REMINDER, cv as TERMINAL_UI_COMMANDS, cw as TakenPrompt, cx as TaskAction, cy as TaskAttemptSnapshot, cz as TaskLogAttemptsResponse, cA as TaskLogBatch, cC as TaskLogFollow, cD as TaskLogFollowInput, cE as TaskLogHeaderKind, cF as TaskLogHeaderTask, cG as TaskLogHeaderUsage, cH as TaskLogHeaderView, cI as TaskLogResponse, cJ as TaskLogView, cK as TaskMessageResponse, cL as TaskOp, cN as TaskOrchestratorDeps, cO as TaskOrchestratorOptions, cQ as TaskPlacement, cR as TaskQuery, cT as TaskQueryField, cU as TaskRef, cV as TaskRowAction, cW as TaskRowContext, cX as TaskRowHandoff, cY as TaskRowIsolation, cZ as TaskRowKind, c_ as TaskRowLoop, c$ as TaskRowPlacement, d0 as TaskRowSubject, d1 as TaskRowUsage, d2 as TaskRowView, d3 as TaskRunFacts, d4 as TaskStatusKind, d5 as ThinkingDisplayBlock, d6 as ToolBlock, d7 as ToolHeadline, d8 as ToolStatus, d9 as TreeTask, db as TurnGate, dc as UsageBlock, de as WAITS_FOR_APPROVAL_LABEL, df as WakeUpItem, dk as Worded, dl as WorkspacesResponse, dm as abbreviateHome, dn as accountLimitPercentText, dp as accountLimitWindowLabel, dq as accountLimitsOf, dr as accountLimitsText, ds as accountLimitsTitle, dt as aheadOfDraft, du as applyTaskOps, dv as approvalKindText, dw as approvalLabel, dx as approvalStatusText, dy as assignedRunnerOf, dz as assignmentIssue, dA as assignmentIssueText, dB as automergeSummary, dC as autorunSummary, dD as awaitingLabel, dE as blockNotice, dF as blockNotices, dG as blockedByLabel, dH as blockingFailures, dI as canMergeTasks, dJ as canSetDependencies, dK as canSplitTask, dL as capConflictFiles, dM as cardEditNeedsUnstarted, dN as cardEditable, dO as checkoutRule, dP as classifyOutcome, dQ as coalesceTaskLog, dR as compactionText, dS as confirmedOverride, dT as createAiService, dU as dependencyCandidates, dV as dependentsNotice, dW as dependentsOf, dX as describeHeld, dY as describeHolder, dZ as describeIsolationPreview, d_ as describeMergeResult, d$ as describePlannerNotReady, e0 as diffRows, e1 as diffStat, e2 as diffSummary, e3 as digestTaskLog, e4 as drainNext, e5 as editableWhileRunning, e6 as executionSummary, e7 as followTaskLog, e8 as followTurn, e9 as fromTranscript, ea as getSettingsPath, eb as handoffBaseLine, ec as handoffBranchName, ed as handoffFindingsText, ee as handoffPeekParts, ef as hasAccountLimits, eg as hasHiddenDetail, eh as hasLongReport, ei as holdLabel, ej as holdPrompt, el as isRepoGroup, em as isTaskRunning, en as lastServedModel, eo as loadedSkillTokens, ep as logContinues, eq as logResumes, er as loopBodyLabel, es as loopBodyRound, et as loopCheckLabel, eu as loopCheckState, ev as loopLeaveNotice, ew as loopRowParts, ex as manualOverrideConfirmation, ey as manualOverrideStopFirst, ez as mapAgentTool, eA as markAction, eB as markdownHtml, eC as markdownTokens, eD as mergeOutcome, eE as mergeTarget, eF as namedRepos, eG as newTaskFields, eH as noExecutorRefusal, eI as normalizeAgentArgs, eJ as opRefusalText, eK as opsEditable, eL as outputLines, eM as outputPreview, eN as overrideNeedsConfirmation, eO as parseCount, eP as parseSwitch, eQ as parseTaskOpsJson, eR as parseTaskQueryJson, eS as pastGateConfirmation, eT as planBlocks, eU as planMarkerParts, eV as plannerMessage, eW as plannerNotReady, eX as plannerNotReadyFor, eY as plannerTranscript, eZ as processLeaseHost, e_ as ranSealed, e$ as readRunnerAuth, f0 as receiptLabel, f1 as reconcileApprovals, f2 as recordRunnerAuth, f3 as recordedRunnerAuth, f4 as reduceConversation, f5 as reduceRun, f6 as reduceTaskLog, f7 as renderTaskQueryAnswer, f8 as repairedLanded, f9 as repairedNotice, fa as repeatingChecks, fb as replayTaskLog, fc as repoBaseLine, fd as repoResultLines, fe as reposWithWork, ff as resetRunnerAuth, fg as resolveSkillInvocation, fh as resolveTaskRef, fi as resolveUserTaskRef, fj as resumeLabel, fk as resumeTime, fl as runHoldsEditors, fm as runSettingsOf, fn as runnerToolSubject, fo as scriptExitText, fp as scriptRunText, fq as secondsText, fr as serializePlan, fs as serializeTask, ft as serializeTaskStatus, fu as skillTokens, fv as skippedLabel, fw as stopTurn, fx as subtreeIds, fy as summarizeToolCall, fz as supervisorSummary, fA as surfacePlan, fB as surfacePlanState, fC as takeAt, fD as taskActionCommand, fE as taskChatAvailable, fF as taskLogCommands, fG as taskLogForSurface, fH as taskLogHeaderView, fI as taskOrderLabel, fJ as taskPlacement, fK as taskQuerySignature, fL as taskRef, fM as taskRefOf, fN as taskRowActions, fO as taskRowView, fP as taskStartedNotice, fQ as taskStatusKind, fR as textHasTaskOps, fS as textHasTaskQuery, fT as titledRefs, fU as titledTaskRef, fV as titledTaskRefOf, fW as toTaskLogEvent, fX as toolHeadline, fY as trailerSummary, fZ as trimToolOutput, f_ as truncateCheckpointSummary, f$ as unsendAll, g0 as unsendLatest, g1 as wakeUpItems, g2 as walkPlan, g3 as withoutSealedMark, g4 as workspaceEnvOf } from './runSettingsText-CAXiTpsj.js';
+import { O as IConfig, P as IFileSystem, am as PlannerToolHandler, aj as PlannerShellSandbox, aw as ResearchShell, N as IApproval, au as ReadFileOpts, bq as ToolOutcome, L as GrepOptions, b1 as ShellLaunch, K as GlobOptions, H as FindSymbolOptions, B as BashOptions, bl as TaskShellSite, bk as TaskShell, az as RuleWord, af as PlannerAllowlist, aV as ScriptBody, Q as IRunner, ag as PlannerBackendId, ap as ProviderModelLists, f as AiProvider, n as ApprovalModeSetting, aN as RunnerRegistry, a8 as OrchestratorOption, d as AgentProcessDeps, be as TaskModeAgentAdapter, e as AgentStartOptions, a as AgentAdapter, c as AgentEvent, aE as RunnerCommand$1, s as AttachState, k as ApprovalDecision, an as ProjectMcpServer, R as IRunnerSession, o as ApprovalPolicy, j as ApprovalAnswer, a9 as OrdewellMcpServer, bb as TaskCompleteArgs, aW as ScriptExit, t as CheckpointAnswer, b5 as StructuredTurnEnd, b4 as StructuredEvent, bd as TaskMessageFrom, ar as QueuedTaskMessage, bm as TaskStartOptions, bn as TaskTokenScope, a0 as McpToolReply, bp as TaskWebReads, av as ReadTaskArgs, i as ApplyPatchArgs, aI as RunnerManifest, bj as TaskRunnerFlags } from './IRunner-B5l9PCTv.js';
+export { A as AUTO_COMMANDS, b as AgentAdapterFactory, g as AllProviderModels, h as AnswerApprovalArgs, l as ApprovalKind, m as ApprovalMode, p as ApprovalPolicyOptions, q as ApprovalRequest, r as ApprovalSource, C as CatalogModel, u as CheckpointArgs, v as CommandClassification, w as CommandTier, x as CommandWords, D as DEFAULT_PLANNER_ALLOWLIST, y as DEFAULT_SCRIPT_TIMEOUT_MS, z as DENY_ALL, E as DiscoveryCommand, F as EditPlanArgs, G as FetchAllProviderModelsOptions, I as GIT_READONLY_SUBCOMMANDS, J as GREP_DEFAULT_HEAD_LIMIT, M as GrepOutputMode, S as InvokedCommand, T as LineBuffer, U as ListModelsArgs, V as ListRunnersArgs, W as LoadSkillArgs, X as McpClientConfig, Y as McpCredential, Z as McpRefusal, _ as McpTool, $ as McpToolContext, a1 as MessageTaskArgs, a2 as ModelCatalog, a3 as ModelShortcut, a4 as ORCHESTRATOR_SHORTCUTS, a5 as ORDEWELL_MCP_PATH, a6 as ORDEWELL_MCP_SERVER_NAME, a7 as OneTaskArgs, aa as OwnSealedRuns, ab as OwnerOnlyFile, ac as PLANNER_EXECUTION_TOOLS, ad as PLANNER_SANDBOX_DOCS, ae as PLANNER_TOOLS, ah as PlannerSandboxAvailability, ai as PlannerSandboxDeps, ak as PlannerStartOptions, al as PlannerTokenScope, ao as ProviderCredentialSource, aq as ProviderModelsResult, as as READ_ONLY_TASK_TOOLS, at as REFUSED_COMMANDS, ax as ResearchShellDeps, ay as RetryTaskArgs, aA as RunCommandArgs, aB as RunPlanArgs, aC as RunnerAuthSpec, aD as RunnerAuthStatus, aF as RunnerCommandKind, aG as RunnerEntry, aH as RunnerFeatures, aJ as RunnerMcpServer, aK as RunnerMode, aL as RunnerModelDiscovery, aM as RunnerModelRef, aO as SEALED_LIMITS, aP as SEARCH_EXCLUSIONS, aQ as SandboxBackend, aR as SandboxInvocation, aS as SandboxLaunch, aT as SandboxLimits, aU as SandboxProfile, aX as ScriptFullOutput, aY as ScriptRun, aZ as ScriptStatus, a_ as SealedAvailability, a$ as SealedRunOptions, b0 as ShellDialect, b2 as SpawnFn, b3 as StandingDecision, b6 as SubmitPlanArgs, b7 as TASK_COMPLETE_TOOL, b8 as TASK_COMPLETION_CONTRACT, b9 as TASK_SEALED_LIMITS, ba as TASK_TOOLS, bc as TaskDiffArgs, bf as TaskModeUnsupportedError, bg as TaskOutputArgs, bh as TaskQueryArgs, bi as TaskRunCommandArgs, bo as TaskToolHandler, bs as approvalScopes, bt as classifyCommand, bu as clearPlannerSandboxCache, bv as clearResearchShellCache, bw as collectProviderCredentials, bx as commandAllowedBy, by as commandLine, bz as effectiveApprovalMode, bA as enabledRunners, bB as fetchAllProviderModels, bC as findRunnerCommand, bD as isGranted, bE as isRunnerApproval, bF as knownModelId, bG as mcpClientConfig, bH as ownerOnlyConfigFile, bI as parseAllowlist, bJ as parseApprovalModeSetting, bK as researchShellWarning, bL as researchToolsPath, bM as resolveModelShortcut, bN as resolvePlannerSandbox, bO as resolveProvider, bP as resolveResearchShell, bQ as scopeAllowed, bR as scriptBodyOf, bS as scriptBodyText, bT as scriptTaskText, bU as sharedMcpServer, bV as taskCompletionContract, bW as timeLimitText, bX as toApprovalDecision, bY as toOrchestratorOptions, bZ as toolAllowed } from './IRunner-B5l9PCTv.js';
+import { R as RunnerModeInfo } from './ModeResolver-DyXeZ9ib.js';
+export { a as autonomyLevelLabel, p as parseAutonomyFlag, b as parseAutonomyLevel, r as runnerModesFrom } from './ModeResolver-DyXeZ9ib.js';
+import { WorkerOptions, Worker } from 'worker_threads';
 import { ChildProcess } from 'child_process';
 import { EventEmitter } from 'events';
 import 'zod/v4';
@@ -18,427 +19,195 @@ type GitExecFn = (file: string, args: string[], opts: {
     stderr: string;
 }>;
 
-/** One call at the command seam, as every route words it (ADR-0029). Task references are resolved here. */
-type ExecutionCommand = {
-    command: 'run_plan';
-} | {
-    command: 'run_task';
-    task: string;
-} | {
-    command: 'stop_task';
-    task: string;
-} | {
-    command: 'stop_run';
-}
 /**
- * `session`: continue the saved runner session with `message` (ADR-0018, K1),
- * or resume a task paused on a usage limit in it, the message optional;
- * `fresh`: a new attempt from the task's prompt.
+ * A message or interrupt a task cannot take: it is not running, or it is
+ * waiting on something a message does not answer.
+ * The request is wrong, not the orchestrator, so a surface says why.
  */
- | {
-    command: 'retry_task';
-    task: string;
-    from: 'fresh' | 'session';
-    message?: string;
-}
-/** `force`: the user's force send (ADR-0023, F1), which interrupts the running turn and is read next. */
- | {
-    command: 'message_task';
-    task: string;
-    text: string;
-    force?: boolean;
-}
-/** `answer` is checked here rather than typed: an `allow` must reach the seam to be refused with its reason. */
- | {
-    command: 'answer_approval';
-    task: string;
-    approval?: string;
-    answer: string;
-    note?: string;
-}
-/** Merge all: the run's landed work into the user's branch (ADR-0013). */
- | {
-    command: 'merge_all';
-}
-/** End a task as skipped: nothing it did lands, and its dependents go ahead without it once the work it waited on is done. `reason` is required of anyone but the user. */
- | {
-    command: 'skip_task';
-    task: string;
-    reason?: string;
-}
-/** The user's force start: past a failed dependency or a merge gate, queued behind dependencies still under way (ADR-0035). */
- | {
-    command: 'force_start';
-    task: string;
-}
-/** The user vouches for the task's work, which lands as a passed verdict's would; never anyone else (ADR-0029). */
- | {
-    command: 'mark_complete';
-    task: string;
-}
-/** The user takes a completion back: the task is not started again, and held until it is retried or started. */
- | {
-    command: 'mark_not_done';
-    task: string;
-}
-/** Stop a structured task's running turn, keeping its session: it then waits for the user's message. */
- | {
-    command: 'interrupt_task';
-    task: string;
-}
-/** Force send a message queued behind the running turn (ADR-0023, F1); `id` is the one `message_task` answered with. */
- | {
-    command: 'force_send_queued';
-    task: string;
-    id: string;
-}
-/** Take back a message still queued behind the running turn. */
- | {
-    command: 'remove_queued';
-    task: string;
-    id: string;
+declare class TaskControlError extends Error {
+    constructor(message: string);
 }
-/** Keep a task paused on a usage limit from resuming on its own at the reset: it waits for the user's Resume now or Retry. */
- | {
-    command: 'cancel_resume';
-    task: string;
+
+/** Structural subset of an OpenAI-style chat message that compaction reads and rewrites. */
+interface CompactableMessage {
+    role: string;
+    content?: unknown;
+    tool_call_id?: string;
+    tool_calls?: Array<{
+        id?: string;
+        function?: {
+            name?: string;
+            arguments?: string;
+        };
+    }>;
 }
-/** The user's answer to the checkpoint a task waits at: it goes on, or is told `reason` to act on. */
- | {
-    command: 'answer_checkpoint';
-    task: string;
-    answer: 'approve' | 'reject';
-    reason?: string;
+
+interface ToolCall {
+    name: string;
+    args: Record<string, unknown>;
+    id?: string;
 }
-/** The user signs off the plan's review: every task in it is approved, as executing it approves them, and it runs. */
- | {
-    command: 'approve_review';
-};
-/** What a control answers besides its line, for the surface whose button asked. */
-type CommandPayload = 
-/** `message_task`: the queued message's id, which the surface's button answers with. */
-{
-    kind: 'message';
-    id: string;
+interface ToolResult {
+    name: string;
+    output: string;
+    truncated: boolean;
+    totalChars: number;
+    id?: string;
 }
-/** `force_start` queued behind dependencies still under way, rather than started: the line saying so. */
- | {
-    kind: 'queued';
-    line: string;
+interface ResearchTurn {
+    text: string;
+    toolCalls: ToolCall[];
+    hasToolCalls: boolean;
+    /** Reasoning/chain-of-thought captured separately from `text` so it never pollutes plan JSON. */
+    reasoning?: string;
+    /** Provider finish reason, normalized: 'length' means the output-token limit cut the reply mid-stream. */
+    finishReason?: string;
+    /** Exact prompt tokens this turn consumed, when the provider reports usage. */
+    promptTokens?: number;
+    /** The segment `text` streamed under, where the provider streams it. */
+    segmentId?: string;
 }
-/**
- * The user's `merge_all`, merged or stopped: what the Merge all card
- * renders. Whether it closed the run is the Session's `run_closed` (ADR-0013).
- */
- | {
-    kind: 'merge';
-    result: IsolationMergeResult;
-};
-/**
- * What a call came to: `message` is written for the caller, a model included,
- * to act on. A refusal carries a payload only where the act ran and stopped:
- * a Merge all that git would not take.
- */
-type CommandOutcome = {
-    ok: true;
-    message: string;
-    payload?: CommandPayload;
-} | {
-    ok: false;
-    outcome: 'refused' | 'declined';
-    message: string;
-    payload?: CommandPayload;
-};
-/** What the seam does with a valid command: run it, ask the user first, or refuse with a note the caller can act on. */
-type Consent = {
-    kind: 'allow';
-} | {
-    kind: 'ask';
-} | {
-    kind: 'refuse';
-    reason: string;
-};
-/**
- * What a supervisor at `level` may do. The mandate (#23) replaces this check;
- * nothing above it moves.
- */
-type SupervisorPolicy = (level: SupervisorLevel, command: ExecutionCommandName) => Consent;
-/**
- * The supervisor levels (ADR-0029). Off: it does not act. Watch: it reads and
- * suggests, and every execution command it calls is refused. Act: every
- * command runs without asking — choosing Act is the consent — inside the loop
- * guards; what a command may never do, like allowing an approval, is still
- * refused by the command itself.
- */
-declare const SUPERVISOR_LEVELS: SupervisorPolicy;
-/**
- * A check that stops an actor spinning (ADR-0029's loop guards): the trip —
- * the note naming the guard and what would be accepted, and what the user is
- * told — or null to let the call through. Run once the call is valid and
- * consented to, before anyone is asked.
- */
-type LoopGuard = (actor: ExecutionActor, command: ExecutionCommand, target: GuardTarget | undefined) => GuardTrip | null;
-/** A runner request waiting on a task, as the caller is shown it. */
-interface WaitingRequest {
-    id: string;
-    subject: string;
+interface ResearchChat {
+    sendMessage(text: string, signal?: AbortSignal): Promise<ResearchTurn>;
+    sendToolResults(results: ToolResult[], signal?: AbortSignal): Promise<ResearchTurn>;
+    /**
+     * Optional: prune older workspace reads from the history (everything else,
+     * and the newest rounds, are kept) so a follow-up emission has context to
+     * spend on output. Returns the number of characters removed.
+     */
+    compactHistory?(): number;
+    /**
+     * Whether a call's input is held: the call could not fit the model's window
+     * (`PlannerContextExhaustedError`), so its user message or tool results were
+     * kept out of the history. The next message drops a held message and files
+     * held results as a turn before it.
+     */
+    holdsInput?(): boolean;
+    /** Send the held input again, once room is made: no tool runs a second time. */
+    resend?(signal?: AbortSignal): Promise<ResearchTurn>;
+    /** Whether {@link retry} can send the held input: a window is known to compact against. */
+    retryable?(): boolean;
+    /** The user's Retry compaction: condense with their consent, then send the held input once. */
+    retry?(signal?: AbortSignal): Promise<ResearchTurn>;
+    /**
+     * Take `history` in place of the whole message list in one step — a summary
+     * swapped in for what it condensed. Refused, changing nothing, unless each
+     * tool result answers a call of the assistant message just before it, once.
+     */
+    reseed?(history: readonly CompactableMessage[]): void;
+    /**
+     * Optional: the answer to a call the open turn already made in rounds
+     * condensed out of the model's sight, in place of running it again
+     * (ADR-0002). Undefined for a call that runs.
+     */
+    answered?(call: ToolCall): string | undefined;
 }
-/**
- * What the seam reads and calls. The Session supplies it from the operations
- * behind the surfaces' buttons, so a command lands exactly as the matching
- * button press does, whoever asked.
- */
-interface ExecutionHost {
-    /** The plan's task tree; null when there is no plan. */
-    tasks(): readonly Task[] | null;
-    /** The user approved the whole plan by executing it. */
-    planApproved(): boolean;
-    /** The user approved this task: it was in the plan they executed, or they started it themselves. */
-    taskApproved(taskId: string): boolean;
-    /** A task the scheduler leaves for the user to approve: added to the plan since they approved it (ADR-0035). */
-    waitsForApproval(taskId: string): boolean;
-    /** A start the user consented to approves these tasks, before it acts. */
-    approve(taskIds: readonly string[]): void;
-    /** Full autonomy: starts follow plan approval without a question. */
-    autonomous(): boolean;
-    /** The user's autorun setting, as it is now (ADR-0030). */
-    autorun(): boolean;
-    /** The scheduler is driving the plan: ready tasks start as slots free. */
-    scheduling(): boolean;
-    /** An open planner turn holds the scheduler's new starts until its reply ends. */
-    startsHeld(): boolean;
-    /** Work is running right now. */
-    hasLiveWork(): boolean;
-    /** Something will start without being asked again: a start admitted and not yet claimed, or a scheduled resume. */
-    startsPending(): boolean;
-    /** Admit a start that waits before it claims; see {@link StartAdmission}. */
-    admitStart(): StartAdmission;
-    /** The task's attempt is live: starting, running or landing. */
-    running(taskId: string): boolean;
-    maxParallel(): number;
-    /** The run waits on the user to stash or skip isolation before anything starts. */
-    runBlocked(): boolean;
-    /**
-     * Every reason the task cannot start now, from the scheduler's one start
-     * rule (ADR-0034). Takes the task, not its id: one a held edit changes or
-     * adds is judged as the edit leaves it.
-     */
-    startWaits(task: Readonly<Task>): readonly StartWait[];
-    /** The runner requests waiting on a task for an answer. */
-    waitingRequests(taskId: string): readonly WaitingRequest[];
-    /** A start is told who asked: whether a run it opens continues the last one depends on it (ADR-0029). */
-    runPlan(actor: ExecutionActor): Promise<void>;
-    /**
-     * The user's Execute while a run is under way, once it approved every task:
-     * the run takes them in, each starting once its dependencies finish. Answers
-     * the line that says so, naming how many had waited for approval.
-     */
-    joinRun(approved: number): Promise<string>;
-    startTask(taskId: string, actor: ExecutionActor): Promise<void>;
-    /** Force start the task; answers the line saying it waits for its dependencies, when it was queued behind them rather than started. */
-    forceStart(taskId: string): Promise<string | undefined>;
-    markComplete(taskId: string): Promise<void>;
-    markNotDone(taskId: string): Promise<void>;
-    interrupt(taskId: string): Promise<void>;
-    stopTask(taskId: string): Promise<void>;
-    stopRun(): void;
-    retryTask(taskId: string, actor: ExecutionActor): Promise<void>;
-    /** End the task as skipped, landing nothing of it; see {@link TaskOrchestrator.skipTask}. */
-    skipTask(taskId: string, reason: string | undefined, actor: ExecutionActor): Promise<void>;
-    continueTask(taskId: string, message: string, actor: ExecutionActor): Promise<void>;
-    /** Resume a task paused on a usage limit now; see {@link TaskOrchestrator.resumeNow}. */
-    resumeNow(taskId: string, message: string | undefined, actor: ExecutionActor): Promise<void>;
-    messageTask(taskId: string, text: string): string;
-    /** Force send (ADR-0023, F1): interrupt the running turn and deliver this next. */
-    forceMessage(taskId: string, text: string): string;
-    /** False once the message was delivered. */
-    forceSendQueued(taskId: string, id: string): boolean;
-    /** False once the message was delivered or taken back. */
-    removeQueued(taskId: string, id: string): boolean;
-    /** False when no resume was scheduled. */
-    cancelResume(taskId: string): Promise<boolean>;
-    /** The task waits at a checkpoint, and a runner is left to hear the answer. */
-    awaitsCheckpoint(taskId: string): boolean;
-    answerCheckpoint(taskId: string, approve: boolean, reason?: string): void;
-    /** Sign off the review: the plan is the user's, and runs. */
-    approveReview(): Promise<void>;
-    /** Answer a runner's request, as its card does; false once it was answered or withdrawn. */
-    answerRequest(requestId: string, decision: ApprovalDecision): boolean;
-    /** Merge all, through the queue it shares with landings. */
-    mergeAll(): Promise<IsolationMergeResult>;
-    /** Keep the call in the timeline, worded as `text`. */
-    record(record: ExecutionRecord, text: string): void;
-    /** A loop guard stopped a call: the user is told, as the supervisor's message. */
-    guardTripped(trip: GuardTrip): void;
-    /**
-     * The open planner turn holds an edit — to this task, or to any when none is
-     * named — that lands only when its reply ends.
-     */
-    heldEdit(taskId?: string): boolean;
-    /** The plan's task tree as the open turn's held edit leaves it: as it is, when it holds none or one that would not apply. */
-    editedTasks(): readonly Task[];
-    /** The id of the task the open turn's held edit makes under this batch handle; undefined when it names none. */
-    heldHandle(name: string): string | undefined;
-    /**
-     * Run the command again, as the same actor, once the open turn's reply has
-     * landed its edit; `intent` names it if it never does. `admission` is
-     * released once it has run or been dropped.
-     */
-    deferUntilLanded(command: ExecutionCommand, actor: ExecutionActor, intent: string, admission: StartAdmission): void;
-    /** A command deferred behind an edit did not run once the edit landed: the user is told, and so is the planner's next turn. */
-    queuedNotRun(text: string): void;
-}
-interface ExecutionCommandsDeps {
-    host: ExecutionHost;
-    /** The approval card channel a Guarded start asks through. */
-    consent: Pick<IApproval, 'request'>;
-    supervisor?: SupervisorPolicy;
-    guards?: readonly LoopGuard[];
-    now?: () => string;
+/** Everything one conversation turn needs beyond the user message itself. */
+interface ConversationTurnContext {
+    chat: ResearchChat;
+    fs: IFileSystem;
+    runners: RunnerId[];
+    runnerModes?: Record<RunnerId, RunnerModeInfo[]>;
+    /** See {@link ConversationRequest.liveScope}. */
+    liveScope?: () => PlanIntake;
+    autonomousDefault?: boolean;
+    fetcher?: IWebFetcher;
+    /** The session's planner tools; the conversation offers their task reads and execution tools (ADR-0029) when set. */
+    plannerTools?: PlannerToolHandler;
 }
-/**
- * The command seam (ADR-0029, #91): the one place an execution action
- * reaches the scheduler, whether the user, a planner turn or the supervisor
- * asked. It resolves the task, checks the call against the plan's state, who
- * asked and the user's approval, asks the user where consent needs a person,
- * runs the Session operation behind the matching button, and records the call
- * in the timeline with who asked. A refusal names the task and the reason,
- * worded for whoever asked to act on ({@link voiceOf}).
- */
-declare class ExecutionCommands {
-    private readonly deps;
-    private readonly host;
-    private readonly supervisor;
-    private readonly guards;
-    private readonly now;
-    constructor(deps: ExecutionCommandsDeps);
+declare abstract class BaseAiService {
+    protected config: IConfig;
+    protected turnBudgets?: TurnBudgets | undefined;
+    protected conversation: {
+        ctx: ConversationTurnContext;
+        setProgress: (fn: (p: ResearchProgress) => void) => void;
+    } | null;
+    protected activeAbort: AbortController | null;
+    /** See {@link compactions}. */
+    private compacted;
+    constructor(config: IConfig, turnBudgets?: TurnBudgets | undefined);
+    abstract reset(): void;
+    abstract ensureInit(): void;
+    hasActiveConversation(): boolean;
+    pruneContext(): number;
+    /**
+     * The compactions of a conversation's history that changed something, which
+     * the chat reports through {@link countCompaction}. A pruning stubs tool
+     * output alone, never the user messages a plan block rides in, but it counts
+     * all the same: the conversation would rather send the plan whole again than
+     * trust a context changed under it (ADR-0012 T10).
+     */
+    compactions(): number;
+    protected countCompaction(): void;
+    protected startAbortScope(callerSignal?: AbortSignal): AbortSignal;
+    protected stopAbortScope(): void;
+    continueConversation(userMessage: string, onProgress: (progress: ResearchProgress) => void, signal?: AbortSignal): Promise<ConversationTurn>;
+    heldInputRetryable(): boolean;
+    /** The turn a held input was for, carried on from it: its first call is the retry, every later one as in any turn. */
+    retryHeldInput(onProgress: (progress: ResearchProgress) => void, signal?: AbortSignal): Promise<ConversationTurn>;
+    protected abstract streamPlanText(prompt: string, repairHint: string | undefined, onToken: (token: string) => void, onReasoning?: (token: string) => void, signal?: AbortSignal): Promise<string>;
+    /**
+     * Build a fresh chat for one research subagent (own history, subagent system
+     * prompt, cheap model). Null means the provider does not support subagents —
+     * the spawn tool then degrades to a steering message. `onReasoning` streams
+     * live reasoning deltas on models that expose them, same as the top-level loop;
+     * `onUsage` takes each call's usage, as the planner's own chat reports it.
+     */
+    protected createSubagentChat(_onReasoning?: (delta: string) => void, _onUsage?: (record: UsageRecord) => void): ResearchChat | null;
+    /**
+     * One spawn_research_agent tool call, executed at the service layer (not in
+     * executeTool — that would cycle the imports). Every failure path returns a
+     * steering/failed result and the loop continues sequentially: a subagent can
+     * never fail a plan or a turn.
+     */
+    private executeSpawnAgent;
+    /** Collect project context for the planning phase. Shared with the harness backend. */
+    protected static collectResearchContext(fs: IFileSystem, runners: RunnerId[]): Promise<string>;
+    /**
+     * Execute one round of tool calls and report each through onProgress.
+     * Returns the results to feed back plus the log entries produced.
+     */
+    private executeToolCalls;
     /**
-     * `admitted`: a deferred start's admission, taken as it was queued, which
-     * its owner releases; a start asked for now takes its own.
-     */
-    run(asked: ExecutionCommand, actor: ExecutionActor, admitted?: StartAdmission): Promise<CommandOutcome>;
-    /** A valid, consented call, from the user's answer where one is needed to the act and its record. */
-    private carryOut;
+     * Countdown appended to the last tool result of the final few rounds, so the
+     * model lands the turn on its own terms instead of being cut off exactly at
+     * the budget boundary mid-exploration.
+     */
+    private static appendBudgetCountdown;
+    /**
+     * Run one planner conversation turn (ADR-0002): send the message, satisfy
+     * tool calls until the model answers in prose or JSON, and settle the reply
+     * through {@link settleReply}, which owns classification and every
+     * corrective retry. The model decides transitions — there are no sentinels
+     * and no question tags. A turn whose final text parses as a `{tasks:[...]}`
+     * object commits the plan; anything else is a message to the user.
+     */
+    protected runConversationTurn(ctx: ConversationTurnContext, message: string, onProgress: (progress: ResearchProgress) => void, signal?: AbortSignal, 
+    /** What the turn's first call is, in place of sending `message`: a held input sent again. */
+    firstCall?: () => Promise<ResearchTurn>): Promise<ConversationTurn>;
+    /** One model call of a conversation turn: the message, then tool rounds until the model replies without tools. */
+    private runToolRounds;
     /**
-     * A command deferred behind the turn's edit, run now that the edit landed.
-     * Nobody reads its answer, so one that does not run is kept as refused and
-     * said, to the user and to the planner's next turn.
+     * One round's calls run, except those the chat answers as already made in
+     * the turn's condensed rounds (ADR-0002): each of those is answered with
+     * what it returned and shown as not executed, before anything runs.
+     * Results and steps stay in call order.
      */
-    replay(command: ExecutionCommand, actor: ExecutionActor, admission: StartAdmission): Promise<void>;
+    private runRound;
     /**
-     * A start that waits for the turn's edit is judged now, against the plan as
-     * that edit leaves it — the edit counts as the change a retry needs — so one
-     * that could never run is refused while the caller still reads the answer,
-     * and one the user will be asked about says so. `located` is the task as the
-     * plan has it now, absent for a task the edit adds.
+     * Run the LLM tool-calling research loop for one-shot planning. Returns
+     * parsed tasks if a plan was emitted mid-loop, or null if the loop
+     * exhausted without a valid plan.
      */
-    private judgeAsEdited;
-    private tripped;
-    /** `approves` is null for a start that runs without asking, else what the user's yes would approve. */
-    private defer;
-    /**
-     * The tasks a start approves, read from the plan as it stands at the
-     * command's last check. Autorun starts a plan as the user's standing
-     * instruction, so its start approves what it runs as the user's does; so
-     * does a start under its exception for added tasks. A yes on the card
-     * approves the tasks the card named, and no others.
-     */
-    private consented;
-    /**
-     * With autorun on and Full, a planner turn may start a task added after the
-     * user approved the plan (ADR-0030). Read at each start, so switching either
-     * off stops it at once; never on a plan the user has not approved.
-     */
-    private addedMayStart;
-    /**
-     * Guarded means "ask the user first": a planner start in the user's own
-     * turn asks, so tasks they have not approved go into the question rather
-     * than refusing it. The supervisor's starts stay within what the user
-     * approved (ADR-0029).
-     */
-    private asksToApprove;
-    /**
-     * Who may do what without the mandate (#23): the user's own call needs no
-     * consent, and their own controls are theirs alone; a planner turn may
-     * always end or steer work, and starts it only as the autonomy level says;
-     * the supervisor's level decides for it.
-     */
-    private consent;
-    /**
-     * Whether the command can run now, and how, judged against `tasks`: the
-     * plan, or the plan as the turn's held edit leaves it. Read afresh after a
-     * question, since answering takes time.
-     */
-    private prepare;
-    private prepareRunPlan;
-    /** A start of one task: `run_task`, or a fresh `retry_task`, which also takes a task that failed or waits on the user. */
-    private prepareStart;
-    /**
-     * The user's force start goes past what the scheduler waits for, so only
-     * what no start could get past is refused here; the start rule decides the
-     * rest at the claim, and a dependency still under way queues it.
-     */
-    private prepareForceStart;
-    /** Signing off the review approves every task in the plan, as executing it does: the seam records that before it acts. */
-    private prepareApproveReview;
-    private prepareMarkComplete;
-    private prepareMarkNotDone;
-    private prepareInterrupt;
-    private prepareCancelResume;
-    private prepareCheckpoint;
-    private prepareContinue;
-    /**
-     * A pause is not a failure: the attempt stopped on its account's limit, so
-     * its saved session goes on where it was, told the limit has reset. The
-     * message is what to add to that; none is needed.
-     */
-    private prepareResume;
-    private prepareStop;
-    private prepareStopRun;
-    private prepareMessage;
-    /** A message queued behind the running turn, sent now or taken back; one delivered meanwhile is past either. */
-    private prepareQueued;
-    /**
-     * The user answers a runner's request as its card does. Anyone else only
-     * narrows or hands it on: allowing would widen the mode the plan gave the
-     * task (ADR-0029).
-     */
-    private prepareAnswer;
-    private prepareMergeAll;
-    /**
-     * A skip is a decision not to wait for the task. Running it again undoes
-     * that decision, so the supervisor leaves it to the user rather than going
-     * round between the two.
-     */
-    private skippedRefusal;
-    /**
-     * A skip ends a task without a verdict and lands nothing, so it never
-     * vouches for work. Anyone but the user names why, and the supervisor only
-     * gives up on a task that already needs someone: failed, blocked, or
-     * waiting for input.
-     */
-    private prepareSkip;
-    /**
-     * Why a start is not the user's to have made, or the task it asks them to
-     * approve, or null: the user's own call is its own approval.
-     */
-    private unapproved;
-    /**
-     * The Guarded question, on the card the user answers other planner requests
-     * on. It names every task a yes approves, since a yes is the user's
-     * approval of them as Execute plan would be.
-     */
-    private question;
-    /** What was asked, as "start task #4 "Title"". */
-    private intent;
-    private refuse;
-    private keep;
-    private all;
-    private located;
-    /** A reference read against the plan as the held edit leaves it, where the handles its batch gives come first. */
-    private locateAsEdited;
-    /** A reference as a caller writes one — see {@link resolveTaskRef}; the user's as they type one ({@link resolveUserTaskRef}). */
-    private locate;
+    protected runResearchLoop(chat: ResearchChat, firstMessage: string, fs: IFileSystem, onProgress: (progress: ResearchProgress) => void, runners: RunnerId[], initialLog?: ResearchLogEntry[], fetcher?: IWebFetcher, userGoal?: string, runnerModes?: Record<RunnerId, RunnerModeInfo[]>, autonomousDefault?: boolean, signal?: AbortSignal): Promise<{
+        tasks: Task[] | null;
+        researchLog: ResearchLogEntry[];
+        researchResults: string;
+    }>;
+    protected generatePlanFallback(userDescription: string, contextStr: string, researchResults: string, modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, runners: RunnerId[], onProgress: (progress: ResearchProgress) => void, researchLog?: ResearchLogEntry[], runnerModes?: Record<RunnerId, RunnerModeInfo[]>, autonomousDefault?: boolean, signal?: AbortSignal, modes?: PlannerModes): Promise<{
+        tasks: Task[];
+        researchLog: ResearchLogEntry[];
+    }>;
 }
 
 /**
@@ -455,9 +224,10 @@ declare class ExecutionCommands {
  */
 declare abstract class BaseFileSystem implements IFileSystem {
     private readonly resolveWebHost;
+    private readonly sandbox;
     private approval;
     private outboundSecrets;
-    constructor(resolveWebHost?: ResolveAll);
+    constructor(resolveWebHost?: ResolveAll, sandbox?: PlannerShellSandbox);
     /**
      * The interpreter `execBashImpl` will hand the command to. Owned here rather
      * than per-adapter because {@link classifyCommand} has to be told the same
@@ -468,12 +238,20 @@ declare abstract class BaseFileSystem implements IFileSystem {
     /** Surfaces inject the human channel here; without it, external access is denied. */
     setApproval(approval: IApproval): void;
     setOutboundSecrets(secrets: () => Iterable<string>): void;
+    setNotice(notice: (message: string) => void): void;
+    endSession(): void;
+    canSeal(): Promise<boolean>;
     abstract getWorkspaceRoot(): string;
     protected abstract readFileImpl(absPath: string, opts?: ReadFileOpts): Promise<ToolOutcome>;
     protected abstract globImpl(pattern: string, absRoot: string, headLimit: number): Promise<ToolOutcome>;
     protected abstract grepImpl(pattern: string, absRoot: string, opts: GrepOptions): Promise<ToolOutcome>;
     protected abstract listDirImpl(absPath: string, depth: number): Promise<ToolOutcome>;
-    protected abstract execBashImpl(command: string, signal?: AbortSignal): Promise<ToolOutcome>;
+    /**
+     * Run `command` through `shell` from `cwd`, appending it after
+     * `shell.args`; `shell.file: null` is `shell: true`. `cwd` is the workspace
+     * root, or a read-only task's working directory (ADR-0046).
+     */
+    protected abstract execBashImpl(command: string, shell: ShellLaunch, signal: AbortSignal | undefined, cwd: string): Promise<ToolOutcome>;
     /**
      * Resolve `p` and confirm the planner may touch it. In-workspace paths pass
      * silently; anything else needs one approval, remembered per containing
@@ -506,17 +284,66 @@ declare abstract class BaseFileSystem implements IFileSystem {
      */
     private outsidePaths;
     private policyOptions;
+    private plannerSite;
     /**
      * Three tiers (see `commandPolicy.ts`): read-only inspection runs silently,
      * anything else asks once and is remembered, and writes are refused outright
      * because a planner that mutates the workspace has stopped being a planner.
+     * Where the sandbox can seal a command, what the envelope would refuse
+     * without asking anyone runs sealed instead (ADR-0036 S2): the classifier's
+     * refusal, and the approval mode's. A person's denial still refuses.
      *
      * Everything a command needs — its own approval and every outside directory
      * it touches — is one request, so one command is one prompt. Each scope is
      * still granted separately: approving the pair does not approve another
      * directory the next command names.
      */
-    bash(command: string, signal?: AbortSignal): Promise<ToolOutcome>;
+    bash(command: string, signal?: AbortSignal, opts?: BashOptions): Promise<ToolOutcome>;
+    /**
+     * A read-only task's `run_command` (ADR-0046): the planner's classifier,
+     * path confinement, allowlist and exclusions, at the task's working
+     * directory, asking nobody. What would ask or be refused runs sealed, the
+     * workspace readable and the task's worktree writable, or is refused where
+     * no sandbox can seal it. What the allowlist or the read-only tier runs
+     * runs as the planner's command would, until the shell's first sealed run;
+     * from then on every command runs sealed. Its scratch directory is its own.
+     */
+    taskShell({ cwd, writable, worktrees }: TaskShellSite): TaskShell;
+    /**
+     * Ordewell's own script in a read-only task's shell (ADR-0050), sealed from
+     * one of its worktree roots. No command rule judges it, since the task did
+     * not write it; it runs under the task's sealed profile and is checked
+     * after as the task's own sealed runs are, so git that reads a worktree a
+     * sealed run wrote runs only inside the seal (ADR-0046).
+     */
+    private runOwn;
+    private runIn;
+    /**
+     * A scope inside `command` the user denied on the card this session, or
+     * undefined (ADR-0036 S3). The whole command's request is peeked by the
+     * caller; this reaches the commands a refused wrapper hides, each remembered
+     * under its own scope, so wrapping a denied command never routes around the
+     * denial.
+     */
+    private deniedInnerScope;
+    /** A refusal the envelope reached without asking anyone, run sealed where this host can (ADR-0036 S2), or `refused` as it was (S6). */
+    private sealedInstead;
+    /**
+     * One sealed run (S1): no network, no home, nothing it writes reaching the
+     * workspace, and nobody asked. What the user said no to stays refused (S3):
+     * a `!` exclusion naming the command or a path it touches, and a denial
+     * given on the card this session.
+     */
+    private runSealed;
+    /**
+     * One sealed run from `cwd`, and what follows every one in a read-only
+     * task's shell (ADR-0046): the `.git` record checked, a planted `.git` and
+     * every link out of the worktree removed, and the shell stopped where that
+     * could not hold. `swept` says what was removed, for the result.
+     */
+    private sealedRun;
+    /** Every command the planner's shell starts goes through here, inside the sandbox where this host has one (ADR-0011 B1, B6). */
+    private runShell;
 }
 
 /** One directory entry, as the host's file API reports it. */
@@ -719,10 +546,10 @@ interface HttpWebFetcherOptions {
     cache?: WebResponseCache;
     /** Shared across sessions so the search cooldown is process-wide. */
     searchProvider?: ISearchProvider;
-    /** False for a research subagent, which must never prompt (see {@link forSubagent}). */
+    /** False for a research subagent or a read-only task, which must never prompt (see {@link forSubagent}, {@link forTask}). */
     prompting?: boolean;
 }
-type WebReadDecider = Pick<WebReadPolicy, 'decide'> & Partial<Pick<WebReadPolicy, 'searchesUnasked'>>;
+type WebReadDecider = Pick<WebReadPolicy, 'decide'> & Partial<Pick<WebReadPolicy, 'searchesUnasked' | 'remaining' | 'forTask'>>;
 declare class HttpWebFetcher implements IWebFetcher {
     private readonly policy;
     private readonly fetchImpl;
@@ -735,10 +562,20 @@ declare class HttpWebFetcher implements IWebFetcher {
     constructor(opts: HttpWebFetcherOptions);
     decide(read: WebRead): Promise<WebReadDecision>;
     private get decideOptions();
+    private optionsOf;
     forSubagent(): IWebFetcher;
+    /**
+     * The fetcher for one read-only task attempt (ADR-0046): a subagent's, never
+     * prompting, over the policy's {@link WebReadPolicy.forTask}, so the attempt
+     * has a budget of its own while the cache, transport and search provider,
+     * and with them the search cooldown, stay the session's.
+     */
+    forTask(task: string): IWebFetcher | undefined;
+    private nonPrompting;
     searchesUnasked(provider: string): boolean;
-    fetch(url: string): Promise<ToolOutcome>;
-    search(query: string): Promise<ToolOutcome>;
+    remaining(): number | undefined;
+    fetch(url: string, opts?: WebReadOptions): Promise<ToolOutcome>;
+    search(query: string, opts?: WebReadOptions): Promise<ToolOutcome>;
     private get;
     private render;
     private getSearchPage;
@@ -753,6 +590,106 @@ declare class HttpWebFetcher implements IWebFetcher {
     private hop;
 }
 
+/**
+ * The daily version check (ADR-0048): one ping a day that counts installs
+ * under an install ID replaced every 30 days, and may answer with a newer
+ * version.
+ */
+declare const VERSION_CHECK_URL = "https://ordewell.ai/api/v1/ping";
+declare const VERSION_CHECK_NOTICE: string;
+/** The slice of `fetch` the check uses; the platform `fetch` satisfies it. */
+type PingFetch = (url: string, init: {
+    method: 'GET';
+    signal: AbortSignal;
+    redirect: 'manual';
+}) => Promise<{
+    status: number;
+    text(): Promise<string>;
+}>;
+interface VersionCheckOptions {
+    /** The running version, sent as `v` and compared against the answer. */
+    version: string;
+    /** The one-time notice, on the first start on a machine. */
+    onNotice(text: string): void;
+    /** A newer version is out; `text` is the line to show. */
+    onUpdate(text: string, latest: string): void;
+    /** False turns the whole check off, as the off-switch variables do. */
+    telemetryEnabled?: boolean;
+    env?: Record<string, string | undefined>;
+    /** Where the state file lives; `globalDataDir()` by default. */
+    stateDir?: string;
+    fetch?: PingFetch;
+    now?: () => number;
+}
+interface VersionCheck {
+    /** Settles once no ping is in flight. Never rejects. */
+    settled(): Promise<void>;
+    /** Stops the daily re-check. */
+    stop(): void;
+}
+/**
+ * Starts the check for this process: the one-time notice on the first start
+ * on a machine, otherwise a ping if a day has passed since the last one, and
+ * the same test again on an unref'd timer for as long as the process lives.
+ * Never throws and never waits on the network.
+ */
+declare function startVersionCheck(options: VersionCheckOptions): VersionCheck;
+
+/**
+ * The effect allowlist (ADR-0035): the user's standing approval for named
+ * effects, beside the planner allowlist, which names reads. It pre-approves a
+ * script task whose `commands` are all covered; it never covers a `script`
+ * body, whose shell text no rule can be matched against.
+ *
+ * A rule is matched against the whole command, every word in order and flags
+ * included, because an effect's flags change what it does: `git push origin
+ * feature/*` covers `git push origin feature/login`, never the same push with
+ * `--force`. `*` stands for one word, or inside a word for any run of
+ * characters, as in the planner allowlist, except that it never stands for
+ * what changes the effect: a flag (`--force`, and `/force` on Windows), a
+ * refspec's force or delete (`+main`, `:main`), or a `:` outside a URL
+ * (`feature/x:main`, which pushes to `main`). The rule writes any of those
+ * itself. A rule spells out its operation before any `*`, so
+ * `az webapp config * set` is no rule at all.
+ *
+ * Exclusions are the planner allowlist's `!` entries, with any `!` entry
+ * written here; an exclusion wins. A command exclusion is matched as the
+ * planner allowlist matches it; a path or URL exclusion holds for an argument
+ * that names an absolute path or URL it covers, whole or after a `=`, `@`,
+ * `:` or `,` or a short flag (`--url=…`, `-d @…`). A relative path is not
+ * resolved, since the body does not say where it runs. A program named by its
+ * path is a file the repository ships (ADR-0026), so it is never covered.
+ * There are no built-in rules: a default would pre-approve an effect the user
+ * never chose.
+ */
+interface EffectRule {
+    text: string;
+    binary: string;
+    words: RuleWord[];
+}
+interface EffectRules {
+    rules: EffectRule[];
+    exclusions: PlannerAllowlist;
+    platform: NodeJS.Platform;
+    /** The entries that are no rule, each with the warning that says why it is ignored. */
+    ignored: {
+        rule: string;
+        warning: string;
+    }[];
+}
+/**
+ * `entries` are the effect allowlist's; `plannerEntries` the planner allowlist
+ * in force, whose `!` entries hold here too; `platform` the one the commands
+ * run on, which decides how a flag is spelled and how a path resolves.
+ */
+declare function parseEffectAllowlist(entries: readonly string[], plannerEntries?: readonly string[], platform?: NodeJS.Platform): EffectRules;
+/**
+ * The rules, by name, that cover every command of a `commands` body, or null
+ * when one command is not covered, an exclusion holds for one, or the body is
+ * a `script`.
+ */
+declare function effectRuleFor(list: EffectRules, body: ScriptBody): string | null;
+
 /**
  * Carries a structured task's tool requests to the session's one approval
  * seam (ADR-0018, A1), so a runner's request is answered through
@@ -1004,8 +941,11 @@ declare abstract class BaseConfig implements IConfig {
     get conflictRepairAttempts(): number;
     get approvalMode(): ApprovalModeSetting;
     get webReadBudget(): number;
+    /** The native-shell opt-in (ADR-0036 N1): off unless the launching environment says on. Never a workspace variable. */
+    get plannerNativeShell(): boolean;
     get approvalDefaults(): boolean;
     get approvalPreApproved(): string[];
+    get effectAllowlist(): string[];
     /**
      * Who plans when no surface setting names a planner: an explicit
      * AI_PROVIDER, then a vendor whose key is in the environment,
@@ -1084,18 +1024,6 @@ declare class EnvConfig extends BaseConfig {
     setProviderModelLists(): void;
 }
 
-/**
- * How "Merge all" went, in words every surface shares. `group` is whether the
- * run spans more than a lone repo at `.`; only a merge into every repository
- * has something to say about that. `repaired` names the landed tasks that only
- * landed after a conflict repair (ADR-0015), so a clean-looking merge still
- * points review at what changed to get there.
- */
-declare function describeMergeResult(result: IsolationMergeResult, branch: string, group: boolean, repaired?: IsolationLandedTask[]): {
-    level: 'info' | 'warn' | 'error';
-    message: string;
-};
-
 interface WorktreeIsolationDeps {
     config: Pick<IConfig, 'worktreeIsolation' | 'worktreeSetupCommand' | 'workspaceRepos' | 'worktreeLinks'>;
     /** Test seam: every git invocation goes through this. */
@@ -1103,7 +1031,11 @@ interface WorktreeIsolationDeps {
     resolvePath?: () => Promise<string>;
     platform?: NodeJS.Platform;
     mintRunId?: () => string;
+    /** Whether the commits Ordewell writes end with the Planned-with trailer; read as each is written, so a change reaches the next landing. */
+    plannedWith?: () => boolean;
 }
+/** The preview alone, for a surface that shows isolation without ever running it. */
+declare function createIsolationPreview(deps: Pick<WorktreeIsolationDeps, 'config' | 'execFileImpl' | 'resolvePath'>): IIsolationPreview;
 declare function createWorktreeIsolation(deps: WorktreeIsolationDeps): IWorktreeIsolation;
 
 /** A task record as ADR-0013 persisted it, for one repository. */
@@ -1136,35 +1068,17 @@ interface Adr0013PlanIsolation {
  * off exactly as it would have.
  */
 declare function migratePlanIsolation(state: PlanIsolation | Adr0013PlanIsolation): PlanIsolation;
-
-/** The part of a run's handoff a Merge confirmation is worded from; structural, so each surface passes the handoff it holds. */
-interface MergeWordingHandoff {
-    repos: readonly {
-        path: string;
-        baseBranch?: string;
-        landed: readonly unknown[];
-    }[];
-}
-/**
- * Whether the run spans more than a lone repo at the workspace root. A group of
- * one at `.` is worded and drawn exactly as it was before repo groups; anything
- * else names its repos.
- */
-declare function isRepoGroup(handoff: {
-    repos: readonly {
-        path: string;
-    }[];
-}): boolean;
-/** The repos Merge all will merge: those with work on their integration branch, else all of them. */
-declare function reposWithWork(handoff: MergeWordingHandoff): string[];
 /**
- * What a Merge confirmation says the branch lands on: the branch the run
- * started on, which Merge all insists is checked out. A repo that started
- * detached has none, and keeps the old wording.
+ * What a persisted plan says about its isolated run, as a surface shows it: the
+ * handoff and each task's mark. `null` when the payload carries no record — a
+ * planner reply, or a plan that never isolated — which says nothing either way.
+ *
+ * This is the one reading of a saved record outside the daemon: the migration
+ * from the ADR-0013 shape happens here, so no surface grows its own parser.
+ * `repairLimit` is server config a saved plan never carries; without it the
+ * repair attempt is left for a live status update to fill in.
  */
-declare function mergeTarget(handoff: MergeWordingHandoff): string;
-/** The refusal Merge all makes when a repo is on another branch, for a confirmation to warn of; empty when no repo named a branch. */
-declare function checkoutRule(handoff: MergeWordingHandoff): string;
+declare function isolationViewOfPlan(plan: unknown, repairLimit?: number): IsolationView | null;
 
 interface ILogger {
     warn(scope: string, message: string, err?: unknown): void;
@@ -1174,139 +1088,49 @@ declare class ConsoleLogger implements ILogger {
 }
 declare const defaultLogger: ILogger;
 
-interface ToolCall {
-    name: string;
-    args: Record<string, unknown>;
-    id?: string;
-}
-interface ToolResult {
-    name: string;
-    output: string;
-    truncated: boolean;
-    totalChars: number;
-    id?: string;
+/** What a Gemini planner is built with beyond its config. */
+interface GeminiServiceDeps extends PlannerContextDeps {
+    turnBudgets?: TurnBudgets;
 }
-interface ResearchTurn {
-    text: string;
-    toolCalls: ToolCall[];
-    hasToolCalls: boolean;
-    /** Reasoning/chain-of-thought captured separately from `text` so it never pollutes plan JSON. */
-    reasoning?: string;
-    /** Provider finish reason, normalized: 'length' means the output-token limit cut the reply mid-stream. */
-    finishReason?: string;
-    /** Exact prompt tokens this turn consumed, when the provider reports usage — drives proactive compaction. */
-    promptTokens?: number;
-    /** The segment `text` streamed under, where the provider streams it. */
-    segmentId?: string;
-}
-interface ResearchChat {
-    sendMessage(text: string, signal?: AbortSignal): Promise<ResearchTurn>;
-    sendToolResults(results: ToolResult[], signal?: AbortSignal): Promise<ResearchTurn>;
-    /**
-     * Optional: prune bulky raw tool outputs from the history in place (subagent
-     * digests are kept) so a follow-up emission has context to spend on output.
-     * Returns the number of characters removed. Providers whose SDK owns the
-     * history (Gemini) may not support it.
-     */
-    compactHistory?(): number;
-}
-/** Everything one conversation turn needs beyond the user message itself. */
-interface ConversationTurnContext {
-    chat: ResearchChat;
-    fs: IFileSystem;
-    runners: RunnerId[];
-    runnerModes?: Record<RunnerId, RunnerModeInfo[]>;
-    autonomousDefault?: boolean;
-    fetcher?: IWebFetcher;
-    /** The session's planner tools; the conversation offers their task reads and execution tools (ADR-0029) when set. */
-    plannerTools?: PlannerToolHandler;
-}
-declare abstract class BaseAiService {
-    protected config: IConfig;
-    protected conversation: {
-        ctx: ConversationTurnContext;
-        setProgress: (fn: (p: ResearchProgress) => void) => void;
-    } | null;
-    protected activeAbort: AbortController | null;
-    constructor(config: IConfig);
-    abstract reset(): void;
-    abstract ensureInit(): void;
-    hasActiveConversation(): boolean;
-    pruneContext(): number;
-    protected startAbortScope(callerSignal?: AbortSignal): AbortSignal;
-    protected stopAbortScope(): void;
-    continueConversation(userMessage: string, onProgress: (progress: ResearchProgress) => void, signal?: AbortSignal): Promise<ConversationTurn>;
-    protected abstract streamPlanText(prompt: string, repairHint: string | undefined, onToken: (token: string) => void, onReasoning?: (token: string) => void, signal?: AbortSignal): Promise<string>;
-    /**
-     * Build a fresh chat for one research subagent (own history, subagent system
-     * prompt, cheap model). Null means the provider does not support subagents —
-     * the spawn tool then degrades to a steering message. `onReasoning` streams
-     * live reasoning deltas on models that expose them, same as the top-level loop;
-     * `onUsage` takes each call's usage, as the planner's own chat reports it.
-     */
-    protected createSubagentChat(_onReasoning?: (delta: string) => void, _onUsage?: (record: UsageRecord) => void): ResearchChat | null;
-    /**
-     * One spawn_research_agent tool call, executed at the service layer (not in
-     * executeTool — that would cycle the imports). Every failure path returns a
-     * steering/failed result and the loop continues sequentially: a subagent can
-     * never fail a plan or a turn.
-     */
-    private executeSpawnAgent;
-    /** Collect project context for the planning phase. Shared with the harness backend. */
-    protected static collectResearchContext(fs: IFileSystem, runners: RunnerId[]): Promise<string>;
-    /**
-     * Execute one round of tool calls and report each through onProgress.
-     * Returns the results to feed back plus the log entries produced.
-     */
-    private executeToolCalls;
-    /**
-     * Countdown appended to the last tool result of the final few rounds, so the
-     * model lands the turn on its own terms instead of being cut off exactly at
-     * the budget boundary mid-exploration.
-     */
-    private static appendBudgetCountdown;
-    /**
-     * Run one planner conversation turn (ADR-0002): send the message, satisfy
-     * tool calls until the model answers in prose or JSON, and settle the reply
-     * through {@link settleReply}, which owns classification and every
-     * corrective retry. The model decides transitions — there are no sentinels
-     * and no question tags. A turn whose final text parses as a `{tasks:[...]}`
-     * object commits the plan; anything else is a message to the user.
-     */
-    protected runConversationTurn(ctx: ConversationTurnContext, message: string, onProgress: (progress: ResearchProgress) => void, signal?: AbortSignal): Promise<ConversationTurn>;
-    /** One model call of a conversation turn: the message, then tool rounds until the model replies without tools. */
-    private runToolRounds;
-    /**
-     * Run the LLM tool-calling research loop for one-shot planning. Returns
-     * parsed tasks if a plan was emitted mid-loop, or null if the loop
-     * exhausted without a valid plan.
-     */
-    protected runResearchLoop(chat: ResearchChat, firstMessage: string, fs: IFileSystem, onProgress: (progress: ResearchProgress) => void, runners: RunnerId[], initialLog?: ResearchLogEntry[], fetcher?: IWebFetcher, userGoal?: string, runnerModes?: Record<RunnerId, RunnerModeInfo[]>, autonomousDefault?: boolean, signal?: AbortSignal): Promise<{
-        tasks: Task[] | null;
-        researchLog: ResearchLogEntry[];
-        researchResults: string;
-    }>;
-    protected generatePlanFallback(userDescription: string, contextStr: string, researchResults: string, modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, runners: RunnerId[], onProgress: (progress: ResearchProgress) => void, researchLog?: ResearchLogEntry[], runnerModes?: Record<RunnerId, RunnerModeInfo[]>, autonomousDefault?: boolean, signal?: AbortSignal, modes?: PlannerModes): Promise<{
-        tasks: Task[];
-        researchLog: ResearchLogEntry[];
-    }>;
-}
-
 declare class GeminiService extends BaseAiService implements IAiService {
+    private readonly deps;
     private genAI;
     private genAIKey;
     private model;
     /** The id `model` was made for; the SDK's own `model.model` is its `models/…` resource path. */
     private modelId;
-    constructor(config: IConfig);
+    /** Outlives a conversation: what a model's provider measured still holds for the next one on it. */
+    private readonly gauge;
+    constructor(config: IConfig, deps?: GeminiServiceDeps);
     private init;
     /** The planner model picked for this session, as the API names it. */
     private plannerModel;
     private getPlanningModel;
+    /**
+     * Gemini's catalog states a model's prompt limit (`inputTokenLimit`, which
+     * the catalog carries as the model's window) apart from its reply limit
+     * (`outputTokenLimit`): the reply is never taken out of the prompt's room.
+     */
+    private limitsOf;
+    private autoCompaction;
+    /** Read at each call, so a model or setting changed mid-turn applies from its next call. */
+    private plannerBudget;
+    /** What automatic compaction does for the planner model configured now. */
+    plannerContextStatus(): PlannerContextStatus;
+    /** A chat on the planner model, whichever it is at each call. */
+    private chat;
+    /**
+     * One call on the planner's own model and key that declares no functions:
+     * what a summary of its context is written by. Its usage is reported like
+     * any call's, for the caller to mark as measuring no context.
+     */
+    private readonly summaryCall;
+    private summarizer;
+    condenseContext(request: ContextCondenseRequest): Promise<string>;
     ensureInit(): void;
     reset(): void;
     startConversation(req: ConversationRequest): Promise<ConversationTurn>;
-    protected streamPlanText(prompt: string, repairHint: string | undefined, onToken: (token: string) => void, onReasoning?: (token: string) => void, _signal?: AbortSignal): Promise<string>;
+    protected streamPlanText(prompt: string, repairHint: string | undefined, onToken: (token: string) => void, onReasoning?: (token: string) => void, signal?: AbortSignal): Promise<string>;
     /**
      * Drain a Gemini content stream, routing "thought" parts to the reasoning channel
      * and answer text to the parser. `chunk.text()` throws when a chunk is reasoning-only,
@@ -1315,18 +1139,41 @@ declare class GeminiService extends BaseAiService implements IAiService {
     private consumePlanStream;
     /** Gemini-specific stream over raw Parts for generatePlanDirect. */
     private streamPlanTextWithParts;
+    /** One plan emission, asking for no longer a reply than the model states it serves. */
+    private emitPlan;
     researchAndPlan(userDescription: string, runners: RunnerId[], modelsByRunner: Partial<Record<RunnerId, DiscoveredModel[]>>, fs: IFileSystem, onProgress: (progress: ResearchProgress) => void, fetcher?: IWebFetcher, runnerModes?: Record<RunnerId, RunnerModeInfo[]>, modes?: PlannerModes, signal?: AbortSignal): Promise<{
         tasks: Task[];
         researchLog: ResearchLogEntry[];
         researchResults: string;
     }>;
-    generatePlanDirect(userDescription: string, runners?: RunnerId[], modelsByRunner?: Partial<Record<RunnerId, DiscoveredModel[]>>, onToken?: (token: string) => void, fs?: IFileSystem, _fetcher?: IWebFetcher, runnerModes?: Record<RunnerId, RunnerModeInfo[]>, modes?: PlannerModes, _signal?: AbortSignal): Promise<Task[]>;
+    generatePlanDirect(userDescription: string, runners?: RunnerId[], modelsByRunner?: Partial<Record<RunnerId, DiscoveredModel[]>>, onToken?: (token: string) => void, fs?: IFileSystem, _fetcher?: IWebFetcher, runnerModes?: Record<RunnerId, RunnerModeInfo[]>, modes?: PlannerModes, signal?: AbortSignal): Promise<Task[]>;
 }
 
+/** What an API planner is built with beyond its config. */
+interface OpenAiServiceDeps extends PlannerContextDeps {
+    turnBudgets?: TurnBudgets;
+}
 declare class OpenAiService extends BaseAiService implements IAiService {
+    private readonly deps;
     private client;
     private clientCredentials;
-    constructor(config: IConfig);
+    /** Outlives a conversation: what a model's provider measured still holds for the next one on it. */
+    private readonly gauge;
+    constructor(config: IConfig, deps?: OpenAiServiceDeps);
+    private limitsOf;
+    private autoCompaction;
+    /** Read at each call, so a model or setting changed mid-turn applies from its next call. */
+    private plannerBudget;
+    /**
+     * One call on the planner's own model and credentials that offers no tools:
+     * what a summary of its context is written by. Its usage is reported like
+     * any call's, for the caller to mark as measuring no context.
+     */
+    private readonly summaryCall;
+    private summarizer;
+    condenseContext(request: ContextCondenseRequest): Promise<string>;
+    /** What automatic compaction does for the planner model configured now. */
+    plannerContextStatus(): PlannerContextStatus;
     /**
      * Rebuilt whenever the key or endpoint differs from the one the client was
      * made with. A Session outlives `/key` and endpoint edits, so a client cached
@@ -1434,11 +1281,20 @@ declare class ModelResolver {
     private discovery;
     private fetchImpl?;
     private cachedPickerOptions;
+    /** A catalog load under way: a second ask, or a warm-up, shares it rather than fetching again. */
+    private pickerLoad;
     private lastDiscoveryErrors;
     constructor(registry: RunnerRegistry, config: IConfig, deps?: ModelResolverDeps);
     static builtinOptions(): OrchestratorOption[];
     modelsForRunners(runners: RunnerId[]): Promise<Partial<Record<RunnerId, DiscoveredModel[]>>>;
     pickerOptions(): Promise<OrchestratorOption[]>;
+    /**
+     * Start loading the vendor catalogs without waiting for them, unless they
+     * are held or loading already: an API planner whose model's window is not
+     * known yet reads it from them on a later call, never waiting on the fetch.
+     */
+    warmPickerOptions(): void;
+    private loadPickerOptions;
     /**
      * Per-provider failures from the most recent `pickerOptions()` fetch, keyed
      * by provider id. Empty when every configured provider's catalog loaded (or
@@ -1465,9 +1321,32 @@ declare class ModelResolver {
      * omitted rather than guessed.
      */
     contextWindowFor(source: string, model: string): number | undefined;
+    /**
+     * The longest reply a vendor's model is served with, from the picker
+     * catalog already held, when that catalog states one. Reads only, like
+     * {@link contextWindowFor}.
+     */
+    maxOutputTokensFor(source: string, model: string): number | undefined;
     invalidate(): void;
 }
 
+interface RunnerInstallationOptions {
+    /**
+     * The workspace's own variables (ADR-0016), asked afresh for each auth probe
+     * and told which root it is for, so a folder change mid-probe cannot mix one
+     * workspace's account into another's verdict. A `.envrc` can choose another
+     * account, so the probe must ask the same account the planner will use.
+     */
+    env?: (workspace?: string) => Promise<Record<string, string>>;
+    /**
+     * The workspace whose account this installation judges. The verdict is
+     * recorded under it, so a planner gate in that workspace reads it and one in
+     * another cannot (ADR-0009).
+     */
+    workspace?: () => string | undefined;
+    /** Injectable status command runner, so tests need no real agent binary. */
+    authExec?: RunnerAuthExec;
+}
 /**
  * Detects whether a runner's underlying CLI is actually installed on the host,
  * by invoking `<command> --version`. Mirrors ModelDiscovery: injectable exec,
@@ -1477,10 +1356,15 @@ declare class ModelResolver {
 declare class RunnerInstallation {
     private cache;
     private inflight;
+    private authCache;
+    private authInflight;
     private registry;
     private execImpl;
     private now;
-    constructor(registry: RunnerRegistry, execImpl?: ExecImpl, now?: () => number);
+    private env;
+    private workspace;
+    private authExec;
+    constructor(registry: RunnerRegistry, execImpl?: ExecImpl, now?: () => number, options?: RunnerInstallationOptions);
     /** True if the runner's CLI responds to `--version`. Cached per process. */
     isInstalled(runner: string): Promise<boolean>;
     /**
@@ -1497,15 +1381,21 @@ declare class RunnerInstallation {
      * typing a real goal is the failure this exists to prevent.
      *
      * "Usable" is deliberately shallow: the binary answers `--version`, and the
-     * runner has a connector to plan over. Whether the user's subscription is
-     * live cannot be known without spending a turn on it, so an expired login
-     * surfaces where it actually bites — as the agent's own error text on the
-     * first turn.
+     * runner has a connector to plan over. A signed-out runner stays usable —
+     * it is installed, and the user may log in from the same picker — so the
+     * auth verdict rides beside usability, never inside it.
      */
     plannerUsability(runner: string): Promise<{
         usable: boolean;
         reason?: string;
+        auth?: RunnerAuth;
     }>;
+    /**
+     * The runner's own login verdict, cached briefly and asked once when several
+     * callers arrive together. Recorded per workspace for the synchronous planner
+     * gate, which cannot await this.
+     */
+    private authFor;
     /**
      * Whether the CLI can be started the way the harness planner actually starts
      * it: `spawn` with no shell.
@@ -1524,6 +1414,212 @@ declare class RunnerInstallation {
     clear(): void;
 }
 
+/** What one acquisition found. `owner` is a key to compare accounts by, never shown or logged. */
+type AccountLimitReading = 
+/** A full read: it replaces every bucket and window known before. `followUp` asks for one more, coalesced. */
+{
+    kind: 'limits';
+    owner: string;
+    plan?: string;
+    buckets: AccountLimitBucket[];
+    followUp?: boolean;
+}
+/**
+ * A transient failure; `owner` when the account was still seen signed in
+ * before it failed, `retryAfterMs` when the service said how long to wait.
+ */
+ | {
+    kind: 'failed';
+    owner?: string;
+    retryAfterMs?: number;
+}
+/** The account changed while it was being read: what was read may be the old one's. */
+ | {
+    kind: 'account_changed';
+} | {
+    kind: 'signed_out' | 'unsupported' | 'not_installed';
+};
+/**
+ * One runner's way of reading its account's limits. Registered with the
+ * monitor once; the monitor alone decides when it runs, and never runs two of
+ * its acquisitions at once.
+ */
+interface AccountLimitCollector {
+    /** The runner id the snapshot is filed under, and what a task's assignment is matched against. */
+    readonly harness: string;
+    readonly label: string;
+    /** The one model provider its limits meter, when the runner serves others too (`AccountLimitSnapshot.provider`). */
+    readonly provider?: string;
+    /** The effective auth and config the reads see; a change clears what was read under the old one. */
+    scope(): string;
+    /** Must settle on its own deadline; `signal` aborts it early, and its result is then ignored. */
+    acquire(signal: AbortSignal): Promise<AccountLimitReading>;
+}
+type AccountLimitListener = (snapshots: readonly AccountLimitSnapshot[]) => void;
+interface AccountLimitMonitorOptions {
+    /** One per runner, in the order surfaces list them. */
+    collectors: readonly AccountLimitCollector[];
+    /** The clock reads are stamped with; timers are the platform's, so a test fakes both together. */
+    now?: () => number;
+}
+/**
+ * Every installed runner's account limits, owned once per host above any
+ * panel, task or planner (the planner footer and each task log only
+ * subscribe). It decides when each collector runs — on request, about once a
+ * minute while in the foreground, again when a reported window resets — and
+ * never runs two acquisitions of one account at once.
+ *
+ * It believes only the newest acquisition of the scope it started under: an
+ * answer that arrives after a newer start, a scope change, an account change
+ * or dispose is dropped. A full read replaces what was known; a failure keeps
+ * the last read, marked stale, only when the same account was seen; anything
+ * else forgets it. Nothing is persisted: a new host starts knowing nothing.
+ */
+declare class AccountLimitMonitor {
+    private readonly entries;
+    private readonly listeners;
+    private readonly now;
+    private foreground;
+    private disposed;
+    private published;
+    constructor(options: AccountLimitMonitorOptions);
+    snapshots(): readonly AccountLimitSnapshot[];
+    /** Hear every change; the returned function stops it. */
+    subscribe(listener: AccountLimitListener): () => void;
+    /**
+     * Read now, or as soon as the spacing between reads allows; with no
+     * harness, every one. Asks made while a read is out become one follow-up.
+     */
+    refresh(harness?: string): void;
+    /**
+     * A surface connected. It is drawn what is known, so only an account that
+     * is not being read and was not read within the poll interval is read again:
+     * a webview made ready just after a focused start does not read twice.
+     */
+    surfaceConnected(): void;
+    /**
+     * Something spent from the account — a model call, a task's turn — so a
+     * read would show more. Folded into the next poll, or the backoff after a
+     * failure, so a busy planner does not read the account on every call; in
+     * the background, where nothing polls, into the read coming back makes.
+     */
+    invalidate(harness?: string): void;
+    /** Polling runs only in the foreground; coming back reads at once. */
+    setForeground(active: boolean): void;
+    dispose(): void;
+    private each;
+    private request;
+    /**
+     * When the last read started, never later than now: a wall clock set back
+     * since would put it ahead, and every wait measured from it would grow by
+     * the step, focus and refresh included.
+     */
+    private lastStart;
+    /** How long after one read the next poll comes: a minute, longer for an account with nothing to show, backed off after failures. */
+    private interval;
+    /** The auth or config the reads see has changed: what was read under the old one, or is being read, is not this one's. */
+    private fenceScopeChange;
+    private schedule;
+    private clearTimer;
+    private start;
+    private apply;
+    /** After an acquisition: the follow-up it owes, else the next poll. */
+    private next;
+    /** At the earliest future reset the share shown belongs to a window that is over: stale until read again. */
+    private watchResets;
+    private clearResetTimer;
+    private forget;
+    private show;
+    private collect;
+}
+
+interface CodexAccountLimitOptions {
+    /** The manifest's `app-server` launch. */
+    command?: string;
+    args?: string[];
+    timeoutMs?: number;
+    /** Installed, not enabled: an account's limits are worth showing before Codex is given a task. */
+    isInstalled: () => Promise<boolean>;
+    /** The workspace the planner and its tasks run in; its environment can choose another account than the host's (ADR-0016). */
+    workspaceRoot?: () => string | undefined;
+    /** Tests inject the process boundary; the real call stays on the defaults. */
+    deps?: Partial<AgentProcessDeps>;
+}
+/**
+ * Codex's account limits, read the way its own clients read them:
+ * `initialize` → `initialized` → `account/read` → `account/rateLimits/read`,
+ * on a short-lived `app-server` that is taken down after every read. Nothing
+ * here opens a thread, starts a turn, logs in or out, or asks Codex to
+ * refresh its token, and Codex's `auth.json` is never read.
+ *
+ * It runs from the temp directory, so a project's config and hooks are not
+ * run on every poll, but with the workspace's environment on top of the
+ * host's, as the planner and its tasks run: a `CODEX_HOME` the workspace sets
+ * decides whose account it is, not the host's.
+ */
+declare function codexAccountLimitCollector(options: CodexAccountLimitOptions): AccountLimitCollector;
+
+interface ClaudeAccountLimitOptions {
+    timeoutMs?: number;
+    /** Installed, not enabled: an account's limits are worth showing before Claude Code is given a task. */
+    isInstalled: () => Promise<boolean>;
+    /** The workspace the planner and its tasks run in; its environment can choose another account than the host's (ADR-0016). */
+    workspaceRoot?: () => string | undefined;
+    /** Tests inject the process boundary; the real call stays on the defaults. */
+    deps?: Partial<AgentProcessDeps>;
+}
+/**
+ * Claude Code's plan limits, read the way the Agent SDK reads them: the
+ * `initialize` and `get_usage` control requests, on a process of its own
+ * started for nothing else and taken down after every read. Nothing here
+ * writes a user message, so no model is called, and nothing logs in or out,
+ * resumes or saves a session, or reads a credential: the CLI uses its own
+ * login, as it would for a planner.
+ *
+ * It runs from an empty directory of its own, so no project's settings or
+ * hooks run on every poll, but with the workspace's environment on top of the
+ * host's, as the planner and its tasks run: a `CLAUDE_CONFIG_DIR` the
+ * workspace sets decides whose account it is, not the host's.
+ */
+declare function claudeAccountLimitCollector(options: ClaudeAccountLimitOptions): AccountLimitCollector;
+
+interface OpenCodeGoLoginReaderDeps {
+    homedir?: () => string;
+    /** How long one read of the database may take, worker and all. */
+    timeoutMs?: number;
+    /** The worker boundary; a test counts what it starts. */
+    spawnWorker?: (source: string, options: WorkerOptions) => Worker;
+    /** Node options the worker starts with: a test turns SQLite off to stand for a runtime without it. */
+    workerExecArgv?: string[];
+}
+
+interface OpenCodeGoAccountLimitOptions {
+    /** Installed, not enabled: an account's limits are worth showing before OpenCode is given a task. */
+    isInstalled: () => Promise<boolean>;
+    /** The workspace the planner and its tasks run in; its environment can point OpenCode at another store (ADR-0016). */
+    workspaceRoot?: () => string | undefined;
+    /** Tests inject the network, the environment and the store's location; the real call stays on the defaults. */
+    deps?: {
+        fetch?: typeof fetch;
+        now?: () => number;
+        env?: () => NodeJS.ProcessEnv;
+        workspaceEnv?: (root: string) => Promise<Record<string, string>>;
+        reader?: OpenCodeGoLoginReaderDeps;
+        timeoutMs?: number;
+    };
+}
+/**
+ * OpenCode Go's plan windows — five hours, the week and the plan month — for
+ * the login OpenCode would pay for a Go model with (ADR-0051). The login is
+ * read from OpenCode's own store, the one it selects and nothing else, and
+ * sent only to OpenCode's fixed quota addresses: no OpenCode process is
+ * started, no model is called, nothing is refreshed, written or kept.
+ *
+ * The limits meter `opencode-go/…` models only, so a task OpenCode runs on
+ * another provider is not shown them.
+ */
+declare function openCodeGoAccountLimitCollector(options: OpenCodeGoAccountLimitOptions): AccountLimitCollector;
+
 /** The first of {@link findInstalledAgents}; null when none is usable. */
 declare function findInstalledPlanner(installation: Pick<RunnerInstallation, 'plannerUsability'>): Promise<PlannerBackendId | null>;
 /**
@@ -1619,6 +1715,8 @@ declare function providerForRunner(runner: RunnerId): PlannerBackendId | null;
 interface PlannerUsability {
     usable: boolean;
     reason?: string;
+    /** The runner's own login verdict, beside usability: a signed-out agent is still offered. */
+    auth?: RunnerAuth;
 }
 /**
  * One entry of the planner backend list (ADR-0009). `id` is the
@@ -1633,6 +1731,8 @@ interface PlannerBackendEntry {
     runner?: string;
     usable: boolean;
     reason?: string;
+    /** Set for a harness planner whose login status was asked; never a gate on `usable`. */
+    auth?: RunnerAuth;
 }
 /** The detail a usable harness planner is always shown with. */
 declare const HARNESS_PLANNER_REASON = "coding agent \u00B7 no API key needed";
@@ -1691,7 +1791,8 @@ declare const ORDEWELL_SETTABLE_ENV: readonly string[];
  *
  * - The approval-mode and pre-approved-scope variables switch the consent gate
  *   off, so every later command runs unprompted; the web-read budget bounds
- *   how much a planner may send out unasked in Full.
+ *   how much a planner may send out unasked in Full; the effect allowlist
+ *   pre-approves script tasks that change real systems (ADR-0035).
  * - The settings-path override is honoured by the settings service, which
  *   creates directories recursively when persisting — admitting it turns the
  *   same write into an arbitrary-path file write.
@@ -1730,10 +1831,205 @@ declare function supportsTaskMode(runner: string): boolean;
 /** The adapter that drives one task. Throws {@link TaskModeUnsupportedError} for a runner without a connector. */
 declare function createTaskAdapter(runner: string, deps: AgentProcessDeps): TaskModeAgentAdapter;
 
+interface RunnerCommand {
+    command: string;
+    args: string[];
+    /**
+     * Variables set over the workspace's own (ADR-0016), so they win. Handed the
+     * workspace's, for a runner whose value merges into one of them.
+     */
+    env?: (workspace: Record<string, string>) => Record<string, string>;
+    /**
+     * Names this launch must not inherit from the host or the workspace — the
+     * credentials a native-shell planner keeps out of its process (ADR-0036 N2.2).
+     */
+    envDrop?: (name: string) => boolean;
+}
+interface RunnerExit {
+    code: number | null;
+    signal: string | null;
+}
+/**
+ * The one runner process a structured adapter drives (ADR-0018), whatever its
+ * protocol: launched under the cleaned environment in its own process group,
+ * its output decoded as UTF-8, its stderr tail kept for the failure message,
+ * its end observable, and its whole tree killed on dispose.
+ *
+ * Constructed before it is started, so an adapter can tie a resource to
+ * {@link ended} while it is still deciding what to launch.
+ */
+declare class RunnerProcess {
+    private readonly deps;
+    /** Resolves when the process ends — or fails to spawn — so a handshake can lose the race instead of waiting out its timeout. */
+    readonly ended: Promise<void>;
+    private markEnded;
+    private child;
+    /** Disposed before, or while, it launched: nothing may be spawned for an owner that has gone. */
+    private disposed;
+    private exitStatus;
+    /** The process itself reported its end, before its pipes drained; see {@link hasExited}. */
+    private exitReported;
+    private stderrTail;
+    private spawnEnv;
+    /** Stdout readers' end-of-stream flushes, for an end the pipe itself never reports. */
+    private readonly stdoutEnds;
+    constructor(deps: AgentProcessDeps);
+    /**
+     * Launch the process, then run the adapter's `handshake` on it. A handshake
+     * that throws takes the process down with it: no caller keeps an adapter
+     * whose start threw, so a process left running here — a refused handshake,
+     * one that timed out — would have no owner.
+     *
+     * `command` is asked for only once `cwd` is known to exist, and `handshake`
+     * is called in the same tick as the spawn, so a listener it attaches hears
+     * the process's first output.
+     */
+    start(cwd: string, command: (workspace: Record<string, string>) => RunnerCommand, handshake: (child: ChildProcess) => Promise<void>): Promise<void>;
+    private launch;
+    /**
+     * Hear the process's stdout as text, until the returned function is called.
+     * A read can end inside a multibyte character; decoding each chunk alone
+     * turns both halves into U+FFFD.
+     *
+     * `onEnd`, when given, fires once the stream has ended — after the decoder's
+     * own remainder is handed over. Its job is the framing layer's leftover: a
+     * pipe can close with a complete line still buffered but unterminated, and
+     * nothing else will come to flush it.
+     */
+    readStdout(onText: (text: string) => void, onEnd?: () => void): () => void;
+    /** The environment the process was spawned under, for any side process a handshake needs. */
+    get env(): NodeJS.ProcessEnv;
+    /** How the process ended; null while it runs. */
+    get exit(): RunnerExit | null;
+    /**
+     * Whether the process has ended, for any reason. Unlike {@link exit} this is
+     * true from its own 'exit', not only once 'close' has drained the pipes: a
+     * runner that has exited can take no further turn even while a descendant
+     * holds its stdout or stderr.
+     */
+    get hasExited(): boolean;
+    /** The exit code a listener is told: -1 for a signal or a spawn failure. */
+    get exitCode(): number;
+    /** How the process ended, as the end of a sentence. */
+    describeExit(): string;
+    /** Fail-safe contract: a dead runner reports its own last words, never an empty bubble. */
+    withStderrTail(headline: string): string;
+    /**
+     * Tree-wide, because the direct child may be a CLI whose shells, MCP servers
+     * and test runs would outlive it — or, on Windows, the cmd.exe shim rather
+     * than the runner. The forced follow-up is scheduled and unref'd, so a
+     * disposed runner is never the reason the host refuses to exit.
+     */
+    dispose(): void;
+    private end;
+    private appendStderr;
+}
+
+/**
+ * The launcher a harness's own shell runs through (ADR-0036 N2).
+ *
+ * Claude Code names one program in `CLAUDE_CODE_SHELL_PREFIX` and hands it the
+ * whole command string as one argument, so the program is a script: its fixed
+ * part is this session's sandbox launch, and its last argument is the command.
+ * A harness that takes a shell instead (OpenCode's `shell`) can name the same
+ * script the same way.
+ */
+interface NativeShellLauncher {
+    /** `CLAUDE_CODE_SHELL_PREFIX`: the script's path. */
+    prefix: string;
+    /**
+     * `CLAUDE_CODE_TMPDIR`: a short per-session directory, writable in the
+     * profile. Claude Code writes the shell's working directory there after
+     * every command, and warns when the path passes about 30 bytes.
+     */
+    tmpdir: string;
+    /** The harness settings `env` block that names both (N2). */
+    env: Record<string, string>;
+    /** Removes the script and its directory; the next process gets its own. */
+    remove(): void;
+}
+/** The shell a command runs in: the user's own, `/bin/zsh` on the one platform N5 offers. */
+declare function nativeShellInvocation(platform: NodeJS.Platform, env?: NodeJS.ProcessEnv): {
+    shell: string;
+    args: string[];
+};
+/**
+ * Build the launcher for one planner process. The script lives in the OS's own
+ * temporary directory, outside every directory the sealed profile can read or
+ * write, so a command cannot rewrite what the next one starts through. Its
+ * short temp folder is under `/tmp` instead, because the harness warns past
+ * about thirty bytes and `/private/tmp` on macOS keeps the path short; the
+ * profile is given only that folder, never the script.
+ */
+declare function createNativeShellLauncher(opts: {
+    workspace: string;
+    sandbox: PlannerShellSandbox;
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+}): Promise<NativeShellLauncher>;
+
+/**
+ * What every structured adapter owes the one runner process it drives
+ * (ADR-0018 L1), whatever it speaks to it: the {@link RunnerProcess}, whether
+ * it is still alive, who hears it end, how a dead one is reported, and what the
+ * process owns being freed with it.
+ *
+ * Stdio line framing sits on top of this for Claude Code and Codex; OpenCode,
+ * an HTTP server process, uses it without any framing.
+ */
+declare abstract class ProcessLifecycle {
+    protected deps: AgentProcessDeps;
+    protected process: ChildProcess | null;
+    /** What this process is to the user — a planner or a task's runner — for the words a failure is reported in. */
+    protected role: 'planner' | 'task';
+    protected readonly runner: RunnerProcess;
+    /**
+     * What the process owns, by name: the MCP config file holding its token, the
+     * sealed shell launcher and its sandbox. One registry rather than a field
+     * and a cleanup per adapter, so a resource an adapter claims cannot be the
+     * one its cleanup forgot.
+     */
+    private readonly owned;
+    private disposed;
+    constructor(deps: AgentProcessDeps);
+    /** Fail-safe contract: a dead process reports its own last words, never an empty bubble. */
+    protected abstract exitMessage(): string;
+    get exited(): boolean;
+    /** Resolves when the process ends, so a handshake can lose the race instead of waiting out its timeout. */
+    protected get processEnded(): Promise<void>;
+    /** Whether {@link dispose} has run, for a loop that must stop once the process is gone. */
+    protected get isDisposed(): boolean;
+    onProcessExit(listener: (code: number, lastWords?: string) => void): void;
+    /**
+     * Launch the process and run `handshake` on it. A start that throws takes
+     * the process down and frees what the adapter owns with it: no caller keeps
+     * an adapter whose start threw.
+     */
+    protected startProcess(cwd: string, command: (workspace: Record<string, string>) => RunnerCommand, handshake: (child: ChildProcess) => Promise<void>): Promise<void>;
+    /**
+     * Hand `release` to the process: it runs once, when the process ends or the
+     * adapter is disposed, whichever comes first. A second claim on a name frees
+     * the first, so a process launched again does not leak its predecessor's.
+     * A claim made after the adapter was disposed is freed at once.
+     */
+    protected own(name: string, release: () => void): void;
+    /** Prepare this planner's own shell (ADR-0036 N2) and own it, or null when the start did not ask for one. */
+    protected ownNativeShell(opts: AgentStartOptions): Promise<NativeShellLauncher | null>;
+    /**
+     * Frees what the process owns, then ends its whole process tree. Idempotent:
+     * every path that gives up on the process — a stop, a refused start, a
+     * turn's abort — ends here.
+     */
+    dispose(): void;
+    private freeOwned;
+}
+
 interface SpawnSpec {
     command: string;
     args: string[];
     env?: Record<string, string>;
+    /** Names the launch must not inherit from the host or the workspace (ADR-0036 N2.2). */
+    envDrop?: (name: string) => boolean;
 }
 /**
  * Shared plumbing for the agents that speak newline-delimited JSON over stdio.
@@ -1746,16 +2042,13 @@ interface SpawnSpec {
  *
  * Subclasses own their agent's protocol: what to spawn, how to phrase a user
  * turn, and how to read one protocol line. Everything below — line framing,
- * turn lifecycle, abort — is the same for all of them, and the process itself
- * is a {@link RunnerProcess}.
+ * turn lifecycle, abort — is the same for all of them; the process and what it
+ * owns are {@link ProcessLifecycle}'s.
  */
-declare abstract class StdioAgentAdapter implements AgentAdapter {
-    protected deps: AgentProcessDeps;
+declare abstract class StdioAgentAdapter extends ProcessLifecycle implements AgentAdapter {
     abstract readonly agentId: string;
-    protected process: ChildProcess | null;
     protected sessionId: string | null;
     private readonly stdout;
-    private readonly runner;
     /** Set for the duration of a turn. Outside one, events are buffered rather than dropped. */
     private turnEmit;
     /** Set for the duration of a turn. Pinged on every raw line, whether or not `handleLine` turns it into an event. */
@@ -1776,9 +2069,6 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     private hadTurn;
     /** A task's session, which wants what the agent says on its own after a turn closed; a planner registers none and drops it. */
     private outOfTurnListener;
-    private disposed;
-    /** What this process is to the user — a planner or a task's runner — for the words a failure is reported in. */
-    protected role: 'planner' | 'task';
     constructor(deps: AgentProcessDeps);
     /**
      * The command line that starts this agent in its read-only mode, given the
@@ -1795,6 +2085,12 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     /** Protocol handshake, if the agent needs one before it accepts a turn. */
     protected handshake(_opts: AgentStartOptions): Promise<void>;
     start(opts: AgentStartOptions): Promise<void>;
+    /**
+     * Spawn `spec`, read its protocol, then run `handshake`. {@link start} is a
+     * planner's or a task's launch; a launch that is neither — a query that
+     * never opens a turn — comes through here with its own command line.
+     */
+    protected launch(cwd: string, spec: (workspace: Record<string, string>) => SpawnSpec, handshake: () => Promise<void>): Promise<void>;
     /**
      * Every protocol line goes to `handleLine`, turn or no turn: an agent's
      * handshake and its session-id announcement both arrive before the first
@@ -1807,24 +2103,34 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
      * to the open turn, or held for the first one.
      */
     protected announce(event: AgentEvent): void;
-    /** Resolves when the process ends, so a handshake can lose the race instead of waiting out its timeout. */
-    protected get processEnded(): Promise<void>;
     /** The environment the agent was spawned under, for any side process a handshake needs. */
     protected get spawnEnv(): NodeJS.ProcessEnv;
     send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal, onActivity?: () => void): Promise<void>;
     onOutOfTurn(listener: (event: AgentEvent) => void): void;
     nativeSessionId(): string | null;
-    get exited(): boolean;
-    onProcessExit(listener: (code: number, lastWords?: string) => void): void;
     dispose(): void;
     /** Write one raw protocol line to the agent. */
     protected writeLine(payload: unknown): void;
-    /** Fail-safe contract: a dead agent reports its own last words, never an empty bubble. */
     protected exitMessage(): string;
     /** Parse a protocol line, ignoring the non-JSON banners some CLIs print. */
     protected static parse<T>(line: string): T | null;
 }
 
+/**
+ * What one control request came to: its answer's payload as the CLI sent it,
+ * the CLI's refusal in its own words, or no answer in time — with the
+ * process's stderr tail when it ended instead.
+ */
+type ClaudeControlAnswer = {
+    kind: 'answered';
+    response: unknown;
+} | {
+    kind: 'refused';
+    error: string;
+} | {
+    kind: 'silent';
+    lastWords?: string;
+};
 declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAgentAdapter {
     readonly agentId = "claude-code";
     private controlCount;
@@ -1833,10 +2139,15 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     /** An interrupt was sent during the current turn, so an aborted result is that interrupt, not a failure. */
     private interruptRequested;
     private readonly permissions;
+    private readOnlySite;
+    /** The sealed launcher this process's shell goes through, when the opt-in is on (ADR-0036 N2). */
+    private nativeShell;
     /** This turn's runs of reply text, each a text block named `<message id>:<block index>`. */
     private replyRuns;
     /** The model answering the planner's current message, and the message's id, as its `message_start` named them. */
     private plannerModel;
+    /** The CLI's version, from its first `init`; the native-shell check reads it (ADR-0036 N2). */
+    private installedVersion;
     /**
      * The id the turn runs as, as `init` names it. A `[1m]` variant is the
      * selected id, while a message names the API's canonical id without it.
@@ -1879,8 +2190,6 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     private requestedMode;
     /** The session `--resume` asked for, until the CLI's `init` shows it was taken up. */
     private pendingResume;
-    /** The `--mcp-config` file of the running process, which holds its token; removed with the process. */
-    private mcpConfig;
     /** Whether this process was given the server, so its tools' requests are Ordewell's own. */
     private givenOrdewell;
     /** The `CLAUDE_CONFIG_DIR` a planner runs under, where the CLI saves its long tool results. */
@@ -1889,6 +2198,8 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     private readonly steers;
     /** The last turn's `result` ended it, so a steer's echo now opens a turn the CLI started for that message. */
     private turnClosed;
+    /** The model is working in a turn the CLI opened itself, after the last one closed: a background wake. */
+    private runnerTurn;
     /** The task's commands as the CLI last listed them, and what its `init` said of them (#66). */
     private listedCommands;
     private skillNames;
@@ -1908,8 +2219,16 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
      * `init`, which can be another `/model`'s.
      */
     private modelCommands;
+    /**
+     * Prepare the native shell before the process starts, or fail the start
+     * rather than run it outside a sandbox. The launcher is a file this process
+     * owns: `CLAUDE_CODE_SHELL_PREFIX` can only name a program, and Claude Code
+     * hands it the whole command as one argument (ADR-0036 N2).
+     */
+    start(opts: AgentStartOptions): Promise<void>;
     protected spawnSpec(opts: AgentStartOptions, workspace: Record<string, string>): SpawnSpec;
     sessionCost(): RunnerSessionCost | null;
+    version(): string | null;
     /**
      * A cleared conversation's totals start again from zero, so what follows is
      * all new spend, even for a resume that had no count kept.
@@ -1920,8 +2239,8 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     savedOutput(abs: string): boolean;
     /**
      * A task's run: the manifest decides what its mode and effort mean
-     * (ADR-0001), and this adds only the protocol around them. No tool list and
-     * system prompt beyond the completion contract — the task's prompt is its
+     * (ADR-0001). Read-only tasks withhold native writes and shell tools
+     * (ADR-0046); other tasks keep the runner's native tools. The prompt is its
      * first turn, and the contract is where the CLI's own compaction cannot
      * summarise it away. `--permission-prompt-tool stdio` routes the questions the mode
      * leaves open to the control channel, where the adapter must answer them;
@@ -1937,21 +2256,18 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     private plannerServers;
     /** The file holding the token lives exactly as long as the process that reads it. */
     private ordewellServerArgs;
-    private removeMcpConfig;
-    /**
-     * Under `--permission-mode plan` the CLI runs Sonnet for the `haiku` alias,
-     * though it runs a full id as given: a read-only task would silently run a
-     * dearer model than its plan names (ADR-0001). The CLI's own list says what
-     * the alias resolves to now; that id is pinned before the first turn.
-     */
-    protected handshake(opts: AgentStartOptions): Promise<void>;
+    protected handshake(): Promise<void>;
     /**
      * What `-p` can run. The CLI lists commands only its TUI runs (`init`'s
      * `terminal_slash_commands`) and internal ones named `__…` all the same.
      */
-    commands(): RunnerCommand[];
-    /** Asks the CLI itself, which reports `pending` until its connection attempt settles. */
-    mcpAttached(): Promise<boolean>;
+    commands(): RunnerCommand$1[];
+    /**
+     * Asks the CLI itself, which reports `pending` until its connection attempt
+     * settles. A process that exited ends the wait at once: its report is gone
+     * with it, and no answer would ever come.
+     */
+    mcpAttached(): Promise<AttachState>;
     /**
      * Claude Code's soft interrupt: the turn stops, the process and its session
      * stay. The CLI acknowledges on the control channel, then closes the turn
@@ -1975,6 +2291,17 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
      * with the message unread.
      */
     steer(id: string, text: string): Promise<boolean>;
+    /**
+     * Launch the process as an account query rather than a planner or a task,
+     * from `cwd`, and ask it who is signed in (`initialize`). Then
+     * {@link queryUsage} asks what the plan's limits stand at. Both go on the
+     * control channel and no user message is ever written, so no model is
+     * called and no turn opens. The caller ends input and disposes.
+     */
+    openAccountQuery(cwd: string, timeoutMs: number): Promise<ClaudeControlAnswer>;
+    /** The plan's limits, on a process {@link openAccountQuery} opened. */
+    queryUsage(timeoutMs: number): Promise<ClaudeControlAnswer>;
+    private controlAnswer;
     /** Send a control request and wait for its answer; null when none came in time or the process ended. */
     private control;
     /**
@@ -2173,6 +2500,8 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     private sandbox;
     /** A planner on a host where no sandbox starts: Codex's own shell is off, and `run_command` is its only one (ADR-0033). */
     private ownShellOff;
+    /** A read-only task's: every MCP server Codex would start beside Ordewell's, each switched off for its thread (ADR-0046). */
+    private withheldServers;
     /** The Ordewell server's startup state, as Codex last reported it for this thread. */
     private mcpStartup;
     private mcpStartupSettled;
@@ -2203,9 +2532,17 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
      * would pretend it was resumed.
      */
     private openThread;
-    commands(): RunnerCommand[];
+    commands(): RunnerCommand$1[];
     invokeCommand(name: string, args: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal): Promise<void>;
     private loadCommands;
+    /**
+     * The MCP servers Codex's own configuration would start, every layer of it,
+     * less Ordewell's. A read-only task may change nothing, and a user's server
+     * can: one set to approve its tools runs them under any approval policy, so
+     * none of them starts (ADR-0046), as Claude's and OpenCode's deny theirs.
+     * Not knowing them, the task does not start.
+     */
+    private configuredServers;
     private requestThread;
     private threadParams;
     /**
@@ -2213,7 +2550,7 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
      * has tried to connect (ADR-0022, S4). A report that came before this was
      * asked is kept, so asking late still gets the answer.
      */
-    mcpAttached(): Promise<boolean>;
+    mcpAttached(): Promise<AttachState>;
     private effort;
     /**
      * `turn/interrupt` names the turn as well as the thread, so an interrupt
@@ -2341,7 +2678,7 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
 
 declare const CODEX_SANDBOX_DOCS = "https://github.com/ordewell/ordewell/blob/main/docs/troubleshooting.md#codex-sandbox-unavailable-on-this-host";
 /** The one line a surface shows next to the runner list while Codex's sandboxed modes are off. */
-declare const CODEX_SANDBOX_OFF_LINE = "Codex sandbox unavailable on this host: read-only and Guarded modes are off";
+declare const CODEX_SANDBOX_OFF_LINE = "Codex sandbox unavailable on this host: Guarded mode is off";
 /**
  * The line a runner or mode list shows, and the page that explains it, when
  * the catalog says Codex's sandboxed modes are off. Null when nothing is.
@@ -2399,20 +2736,18 @@ declare class CodexSandboxAvailability {
  * detail, never the final reply. A task turn is posted asynchronously and read
  * entirely from the stream — see {@link sendTask}.
  */
-declare class OpenCodeAdapter implements TaskModeAgentAdapter {
-    private deps;
+declare class OpenCodeAdapter extends ProcessLifecycle implements TaskModeAgentAdapter {
     readonly agentId = "opencode";
     private nativeCommands;
     private readonly nativeSkills;
     private manualCompaction;
     private loaded;
-    private process;
     private baseUrl;
+    /** The server's version from `/api/info`; null on 1.x, which does not report one (ADR-0036 N2). */
+    private serverVersion;
     /** Sent on every request to a task's server, which a per-task password secures. */
     private authorization;
     private sessionId;
-    private readonly runner;
-    private disposed;
     private planner;
     private task;
     /** The last assistant message already settled — the baseline {@link recoverReply} measures a new reply against. */
@@ -2429,9 +2764,8 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
     private v2;
     /** The Ordewell server this process was configured with; null when none was given or its config could not be merged. */
     private ordewell;
-    constructor(deps: AgentProcessDeps);
-    private get processEnded();
-    get exited(): boolean;
+    /** The sealed launcher this planner's own shell goes through, when the opt-in is on (ADR-0036 N2). */
+    private nativeShell;
     start(opts: AgentStartOptions): Promise<void>;
     private launch;
     /**
@@ -2443,7 +2777,7 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
     private serverAddress;
     /** From the server's address to an open session — the 2.x API's, or a 1.x one created or resumed. */
     private connect;
-    commands(): RunnerCommand[];
+    commands(): RunnerCommand$1[];
     private loadCommands;
     invokeCommand(name: string, args: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal): Promise<void>;
     private emitLoaded;
@@ -2455,9 +2789,25 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
      * to the turn before, and {@link pollStatus} stands behind the stream,
      * which can miss a status frame. No request is held open for the turn, so
      * fetch's 300s header timeout, the planner's reason for
-     * {@link recoverReply}, never applies.
+     * {@link recoverReply}, never applies — except to a native command, whose
+     * POST is held and is followed by {@link heldPost}.
      */
     private sendTask;
+    /**
+     * The POST of a native command, or null when it was refused before sending
+     * (and said so). Unlike `prompt_async`, `/command` and `/summarize` answer
+     * only when the turn is done, so the request carries no deadline.
+     */
+    private commandPost;
+    /**
+     * How a command turn's held POST came out. A socket that died under it says
+     * nothing about the turn — the server works on regardless, as it does for
+     * the planner's {@link recoverReply} — so that, like the session going idle
+     * first, leaves the turn to the idle wait. Only a server's refusal, or a
+     * transport that failed with the session never seen working, is the
+     * message not having been taken.
+     */
+    private heldPost;
     /**
      * The prompt that carries a task message: the mode as the agent, the task
      * model and effort, and only `question` withheld. A steer names its own
@@ -2500,7 +2850,6 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
      * interrupted, because the request is remembered.
      */
     interrupt(timeoutMs: number): Promise<boolean>;
-    onProcessExit(listener: (code: number, lastWords?: string) => void): void;
     answerPermission(id: string, decision: ApprovalDecision): boolean | Promise<boolean>;
     /**
      * OpenCode 2.x replaced the 1.x HTTP surface rather than extending it, and
@@ -2508,7 +2857,6 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
      * answers with anything else — keeps the 1.x protocol this class speaks.
      */
     private v2Version;
-    private role;
     /**
      * Turn one settled assistant message into events. The settled response is
      * authoritative: it names the assistant message, so its parts are the ones
@@ -2572,37 +2920,55 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
     /** `/event` for one turn — see {@link openEventStream}. Load-bearing for {@link onPermissionAsked}. */
     private openStream;
     private json;
+    /** `timeoutMs` null is for a turn's own POST, which the server answers when the turn is done. */
     private request;
     private headers;
     nativeSessionId(): string | null;
+    version(): string | null;
     unusableProjectServers(): ProjectMcpServer[];
     /** 2.x only: a 1.x server's saved output was never checked, so it is asked about as any outside read. */
     savedOutput(abs: string): boolean;
-    /** Asks the server, which lists every MCP server it has with the state of its connection. */
-    mcpAttached(): Promise<boolean>;
+    /**
+     * Asks the server, which lists every MCP server it has with the state of its
+     * connection. On 2.x, connected once the model would be offered the tools.
+     */
+    mcpAttached(): Promise<AttachState>;
     /** 2.x lists its servers as `{ name, status: { status } }`, and only once it has started connecting them. */
     private v2McpStatus;
     dispose(): void;
-    private exitMessage;
+    protected exitMessage(): string;
 }
 
-interface MappedTool {
-    tool: ResearchToolType;
-    /** The agent's own name, kept whenever it differs from the member it mapped to. */
-    toolLabel?: string;
-}
 /**
- * Classify one agent tool name. Case- and separator-insensitive, because the
- * three agents disagree on `Read` vs `read` vs `read_file` for the same thing.
+ * Whether a harness planner may be offered its own shell (ADR-0036 N2, N4), and
+ * why not when it cannot. The table below is the live checks and nothing more:
+ * a harness or version it does not name has not been checked, so it keeps
+ * `run_command` alone. A new harness release is not handed an older release's
+ * checks; it waits for its own.
  */
-declare function mapAgentTool(name: string): MappedTool;
+type NativeShellOffer = {
+    offered: true;
+}
+/** A whole sentence, shown once per session and in the setting's description. */
+ | {
+    offered: false;
+    reason: string;
+};
 /**
- * Normalize an agent's tool arguments into the shapes `summarizeToolCall`
- * already knows how to read, so a harness `Read` gets a one-line summary
- * instead of a bare tool name. Unknown keys are preserved — the raw args stay
- * visible under the surfaces' output chevron.
+ * What to tell the user about the opt-in for this harness. `version` is the
+ * one the harness reported: Claude Code's `init` line, or an OpenCode 2.x
+ * server's `/api/info`. Null means it reported none — Claude Code before its
+ * first `init`, or OpenCode 1.x, which does not answer with one.
+ *
+ * Linux is deliberately not offered yet: N2 asks for checks on the installed
+ * version, the checks were run on macOS, and bubblewrap passing is a sandbox
+ * probe rather than a live check of either harness's shell.
  */
-declare function normalizeAgentArgs(tool: ResearchToolType, args: Record<string, unknown>): Record<string, unknown>;
+declare function nativeShellOffer(input: {
+    runner: string;
+    version: string | null;
+    platform?: NodeJS.Platform;
+}): NativeShellOffer;
 
 interface PlannerBackendOptions {
     /** The planner provider configured now. */
@@ -2796,10 +3162,15 @@ type PlannerUsageMessage = Extract<SessionMessage, {
  */
 declare class PlannerUsageLedger {
     private readonly sessionWindows;
+    private readonly contextStatus;
     private usage;
     private windows;
-    /** `sessionWindows` serves the window of a planner model whose backend reports none. */
-    constructor(sessionWindows?: SessionWindows);
+    /**
+     * `sessionWindows` serves the window of a planner model whose backend
+     * reports none; `contextStatus`, what an API planner's automatic compaction
+     * does for its model now — undefined on a harness planner.
+     */
+    constructor(sessionWindows?: SessionWindows, contextStatus?: () => PlannerContextStatus | undefined);
     /** Fold one model call's record into the totals; returns the running ledger. */
     record(record: UsageRecord): PlannerUsage;
     /** Adopt a persisted ledger (a reopened session) or start from zero. */
@@ -2814,12 +3185,15 @@ declare class PlannerUsageLedger {
     message(turnId?: string): PlannerUsageMessage;
 }
 
+type PlannerCompactionMessage = Extract<SessionMessage, {
+    type: 'planner_compaction';
+}>;
 interface SessionEventRelayDeps {
     broadcast: SessionBroadcaster;
     /** Where isolation notices go, for a host whose notifications are not seen by the user. */
     onNotice?: (notice: SessionNotice) => void;
     store: Pick<PlanStore, 'allTasks' | 'snapshot'>;
-    orchestrator: Pick<TaskOrchestrator, 'getIdleSince' | 'getQueuedTaskMessages' | 'getMergeGate' | 'runMergeView'>;
+    orchestrator: Pick<TaskOrchestrator, 'getIdleSince' | 'getCompletionReceipt' | 'getQueuedTaskMessages' | 'getMergeGate' | 'holdReason' | 'runMergeView' | 'activity'>;
     runs: Pick<IsolationRunController, 'taskIsolation'>;
     /** Shared with the Session, which snapshots, restores and clears it. */
     usage: PlannerUsageLedger;
@@ -2863,6 +3237,8 @@ declare class SessionEventRelay {
     private statusOwed;
     /** The planner's requests announced and not yet settled, as they were announced: a surface joining now is owed them. */
     private readonly announced;
+    /** The planner compaction started and not yet ended, as it was announced: a surface joining now is owed it too. */
+    private compacting;
     constructor(deps: SessionEventRelayDeps);
     /** `plan` is read per event: a Session with no plan (or mid-reset) announces nothing about tasks. */
     observer(plan: () => LegacyPlanState | null): RelayObserver;
@@ -2887,6 +3263,8 @@ declare class SessionEventRelay {
     announcedApprovals(): Extract<SessionMessage, {
         type: 'approval_request';
     }>[];
+    /** The planner compaction running now, as its start was announced; undefined when none is. */
+    currentCompaction(): PlannerCompactionMessage | undefined;
     executionComplete(plan: LegacyPlanState | null): void;
     /** `turnId`: the planner turn whose commit this is, when one is. */
     planGenerated(plan: LegacyPlanState | null, goal: string, turnId?: string): void;
@@ -2912,6 +3290,22 @@ declare function listTaskLogAttempts(location: TaskLogLocation, taskId: string):
  * ever overwritten.
  */
 declare function openTaskLog(location: TaskLogLocation, taskId: string, attempt?: number): TaskLogFile;
+/**
+ * Where a script task attempt's whole output goes, with its directory ready.
+ * The caller writes the file; it is named for the attempt's number so it sits
+ * beside the log, and is no attempt of its own.
+ */
+declare function prepareTaskOutputFile(location: TaskLogLocation, taskId: string, attempt: number): string;
+/** Where a read-only attempt's saved patch is kept, beside its log (ADR-0050). */
+declare function taskPatchFile(location: TaskLogLocation, taskId: string, attempt: number): string;
+/**
+ * Keep a read-only attempt's patch beside its log, in place of one it saved
+ * before (ADR-0050). Written whole under another name first, so a reader
+ * never finds half a patch. Returns where it is.
+ */
+declare function saveTaskPatch(location: TaskLogLocation, taskId: string, attempt: number, patch: Buffer): string;
+/** A saved patch, or undefined when that attempt kept none. */
+declare function readTaskPatch(location: TaskLogLocation, taskId: string, attempt: number): Buffer | undefined;
 /**
  * One attempt's events, in order; empty when it has no log. A line that does
  * not parse is skipped — the last one, most likely, cut off by a crash
@@ -2949,12 +3343,27 @@ declare class TaskLogRecorder {
      * An entry the session did not emit, written into the log of the attempt
      * that runs `sessionId` and sent at once: what Ordewell made of one of its
      * events once that settled. Dropped once the task's next attempt started.
+     * With no session — a user task's completion has none — the entry opens an
+     * attempt log of its own, so a reader of the task's logs finds it like any other.
      */
-    note(sessionId: string, taskId: string, entry: TaskLogEvent): void;
+    note(sessionId: string | undefined, taskId: string, entry: TaskLogEvent): void;
+    private writeAlone;
     /** Start a new attempt's log for `session`, opening with the skills it was given, and keep it until the session exits. */
     record(taskId: string, session: IRunnerSession, skills?: readonly TaskSkillSnapshot[], attemptNumber?: number): void;
 }
 
+/**
+ * How a surface's direct edit is admitted. The task card offers its editors
+ * only on a task that has not started, so its edit must not land on one the
+ * scheduler claimed while discovery or the skill check was still running.
+ * Other direct callers (the TUI, the API, the runner's own model switch) keep
+ * the wider direct-edit contract and pass nothing.
+ */
+interface TaskEditOptions {
+    /** Refuse the edit once the task is live or its status has left the unstarted set. */
+    requireUnstarted?: boolean;
+}
+
 /**
  * Options for plan generation. Progress is not overridable: every planner
  * progress event is translated to a SessionMessage inside the Session and
@@ -2970,8 +3379,10 @@ interface SessionRuntimeSettings {
     modelAllowlist?: Record<string, string[]>;
     /** Absent means the user never chose, and `config.enabledRunners` (the host's defaults) decides. */
     enabledRunners?: RunnerId[];
-    /** The user's run settings (ADR-0030); absent means every default. */
+    /** The user's saved run settings (ADR-0030), which seed a new session; absent means every default. */
     run?: GlobalRunSettings;
+    /** Whether an API planner compacts its own context before a call that would not fit; absent means on. */
+    plannerAutoCompaction?: boolean;
 }
 declare function sessionRuntimeSettings(settings: UserSettings): SessionRuntimeSettings;
 /** Where a fork landed: the new session's id, and what adopting it needs. */
@@ -2997,6 +3408,8 @@ interface SessionDeps {
     config: IConfig;
     notifications: INotification;
     runner: IRunner;
+    /** What runs script tasks' bodies (ADR-0035); the real {@link ScriptRunner} unless a test supplies one. */
+    scriptRunner?: IRunner;
     registry: RunnerRegistry;
     /** Resolves the workspace root for the orchestrator (lazy — VS Code can change it). */
     workspaceRoot: () => string;
@@ -3008,7 +3421,11 @@ interface SessionDeps {
     onNotice?: (notice: SessionNotice) => void;
     /** Shared across sessions — sole producer of model catalogs and routing lists. */
     modelResolver: ModelResolver;
-    /** Live runtime settings (enabled runners). Read at each operation that needs them. */
+    /**
+     * Live runtime settings (enabled runners). Its run values seed a session
+     * when it opens; a later change reaches an open session through
+     * {@link Session.applyRunSettings}.
+     */
     settings: () => SessionRuntimeSettings;
     /**
      * Host-assigned session id. When set, every persist writes under this id so
@@ -3038,10 +3455,27 @@ interface SessionDeps {
     isolation?: IWorktreeIsolation;
     /** Persistence seam. Defaults to the saved-session store under the workspace. */
     saveSession?: SaveSession;
+    /**
+     * The host whose lease the session holds while it is open (ADR-0049).
+     * Defaults to this process's when saves go to the session store; a session
+     * given its own `saveSession` owns nothing on disk, so it holds no lease
+     * unless given a host too.
+     */
+    leaseHost?: LeaseHost;
     /** Where a structured task's log is saved (ADR-0018, P1). Defaults to a file per attempt beside the session's. */
     openTaskLog?: (location: TaskLogLocation, taskId: string, attempt?: number) => TaskLogFile;
     /** The Ordewell MCP server a harness planner's tools are served from (ADR-0022). Defaults to the process's one. */
     mcpServer?: OrdewellMcpServer;
+    /**
+     * What carries web reads (ADR-0027): the pinned transport, real DNS and the
+     * process-wide cache and search provider unless a test fakes the network.
+     */
+    web?: {
+        transport?: WebTransport;
+        resolveHost?: ResolveAll;
+        cache?: WebResponseCache;
+        searchProvider?: ISearchProvider;
+    };
 }
 /**
  * The composition root: builds every collaborator a Session drives and wires
@@ -3078,6 +3512,8 @@ interface SessionParts {
     fetcher: IWebFetcher;
     skillsService: Pick<SkillsService, 'findSkill' | 'listSkills' | 'searchedDirs' | 'forRoot'>;
     saveSession: SaveSession;
+    /** Its lease, told by the Session what to do when another host takes it (ADR-0049). */
+    lease: (onLost: (held: SessionHeld) => void) => SessionLease;
     /** The conversation's host is the Session itself, so only the Session can make it. */
     conversation: (host: PlannerConversationHost) => PlannerConversation;
 }
@@ -3094,6 +3530,7 @@ interface SessionParts {
  * (setModels, setRunnerList, …) stay on the host; Session never emits them.
  */
 declare class Session {
+    readonly research: ResearchTasks;
     private readonly backend;
     private readonly usage;
     private readonly windows;
@@ -3115,22 +3552,37 @@ declare class Session {
      * supervisor has first.
      */
     private sentHandoff;
+    /** The effect allowlist rules already warned about as ignored, so each is said once, not on every script. */
+    private readonly ignoredEffectRules;
     /** The run was forgotten and no surface has been told yet; see {@link announceClosed}. */
     private closedUnannounced;
-    /** The edit the open planner turn holds, as last announced: a surface that joins mid-turn is shown it. */
-    private sentHeld;
     private readonly notifications;
     private readonly onNotice?;
     private readonly modelResolver;
     private readonly fsAdapter;
     private readonly approvals;
+    /** What the user, and the planner for research, approved to run; kept by {@link ApprovalRecord}, saved on the plan. */
+    private readonly record;
+    /** Approval was withdrawn and no plan broadcast has carried it to the surfaces yet; see {@link withdrawalOwed}. */
+    private withdrawalUnannounced;
     private readonly approvalPolicy;
     private readonly taskLogs;
     private readonly fetcher;
     private readonly settingsFn;
+    /**
+     * This session's copy of the user's run settings (ADR-0030), seeded when it
+     * opens. Another session's change writes the file but does not move this one.
+     */
+    private runSettingsValue;
     private readonly save;
+    /** One live host per session (ADR-0049): no save, and no run, without it. */
+    private readonly lease;
+    /** The host a save was refused for, so the refusal is said once rather than at every save. */
+    private saveRefusedFor;
     /** User controls in flight; see {@link withSave}. */
     private controlsInFlight;
+    /** A whole-plan start opening; a second Execute joins it rather than resetting the run under it. */
+    private runOpening;
     private unsubObserver;
     private readonly hostSessionId?;
     private currentSessionId;
@@ -3139,6 +3591,8 @@ declare class Session {
     private readonly turns;
     /** Destroyed: a turn that waited for the planner to be found must not open on it. */
     private closed;
+    /** Destroyed and let go of its lease for good: whatever settles later neither saves nor holds the session. */
+    private leaseReleased;
     /**
      * Turns PlanTurns does not open, waiting at the planner gate, each ended
      * with why it must not open: a Stop, a newer goal, or its plan scope ending.
@@ -3151,9 +3605,9 @@ declare class Session {
     private readonly supervision;
     /** The open planner turn's, or the last one's once it settled; see {@link openTurn}. */
     private turnEffects;
-    /** Every turn's effects with starts still owed: a turn's may still be running its starts when the next opens. */
-    private readonly owingEffects;
     private unlistenApprovals;
+    /** The one check of a planner's change to the plan; an Act supervisor's edits meet its guard. */
+    private readonly planChanges;
     private readonly plannerTools;
     constructor(parts: SessionParts);
     /**
@@ -3162,13 +3616,7 @@ declare class Session {
      * tools come here; see {@link ExecutionCommands}.
      */
     execute(command: ExecutionCommand, actor: ExecutionActor): Promise<CommandOutcome>;
-    private newTurnEffects;
-    /**
-     * Run one planner turn with its own {@link TurnEffects}, settled in a
-     * `finally`: a turn that throws — stopped, failed, discarded — still
-     * reports what it deferred as not done, rather than the next turn
-     * silently forgetting it.
-     */
+    /** Run one planner turn with its own {@link TurnEffects}, which only a turn that lands hands back. */
     private openTurn;
     /**
      * Autorun (ADR-0030): a plan the planner submitted in the turn that just
@@ -3183,62 +3631,55 @@ declare class Session {
      */
     private executionHost;
     /**
-     * Whether the open turn holds a task edit, landing as its reply ends, that
-     * changes this task — or any, when none is named. A whole plan held is not
-     * one: nothing it would start is approved until the user executes it.
-     */
-    private heldEdit;
-    /** The plan's tasks as the open turn's held edit leaves them: as they are, when it holds none or one that would not apply. */
-    private editedTasks;
-    /** {@link editedTasks}, with the id each of the held batch's handles names in them. */
-    private editedPlan;
-    /** The task as the open turn's held edit leaves it; undefined when that edit removes it. */
-    private asEdited;
+     * The script task a `run_script` call would add (ADR-0035), checked as the
+     * planner's own add is, against the plan as it stands, the turn's committed
+     * edits included. A supervisor's is held to the oscillation guard its edits
+     * are held to, and marked as its own.
+     */
+    private draftScript;
+    /** A drafted script task into the plan now, unapproved: the seam approves it once its start is consented to. */
+    private addScript;
+    /** Settles once the task's attempt is over — it ended, was stopped or left the plan — or after `ms`, or as `signal` aborts. */
+    private awaitEnd;
+    /** A task's result is owed to the planner (ADR-0037, R2): saved on the task, so a restart still owes it. */
+    private oweReport;
+    /** The end of a task's output as a report carries it: the live capture while it lasts, else the tail its verdict kept. */
+    private reportTail;
     /** The open planner turn is the supervisor's, acting at Act: its edits and added tasks are its own (ADR-0029). */
     private supervisorEditing;
     /**
-     * The runners a planner edit may put a task on (`assignableRunners`). An
-     * edit is checked as it is made and again as it lands against this one set,
-     * so what was accepted cannot be refused at commit.
-     */
-    private editRunners;
-    /**
-     * A planner edit checked as it is made and again as it lands: the applier's
-     * rules, then, for the supervisor, the oscillation guard. `held` are the
-     * ops the turn already holds, which `ops` join; errors are numbered by `ops`.
+     * What every planner change is checked against (`PlanChangeCheck`), as it
+     * is submitted and as it commits: the live catalog and plan, and the
+     * handles the open turn's committed edits gave. A change may put a task
+     * only on the runners enabled now (`assignableRunners`), one set at both
+     * ends, so what was accepted cannot be refused at commit unless the catalog
+     * moved; the plan's own runners' modes are read too, for a task left on one
+     * switched off since. `guarded`: the change meets the supervisor's
+     * oscillation guard.
      */
-    private checkPlannerOps;
+    private changeScope;
     /** A line from Ordewell itself, kept in the transcript where it happened. */
     private systemNote;
     /** A message to the user in the supervisor's voice, kept in the transcript where it happened. */
     private supervisorNote;
     /**
      * Who the open planner turn speaks for at the seam: the supervisor in a
-     * wake-up turn, at its level as of this call, else the user's turn.
+     * wake-up turn, at its level as of this call, else the user's turn — which a
+     * report turn for a task that turn started acts as (ADR-0037, R3).
      */
     private turnActor;
-    /** The user's run settings as they stand now (ADR-0030). */
+    /** Whether the commits Ordewell writes carry the Planned-with trailer now; the user's setting, not the run's copy, so a change reaches the next landing. */
+    plannedWithTrailer(): boolean;
+    /** The run settings this session shows and starts its runs with (ADR-0030): its own copy, not the file's. */
+    runSettings(): GlobalRunSettings;
+    /** The user's run settings as they stand for this session (ADR-0030). */
     private userRunSettings;
     /** A call at the seam, in the transcript where it happened and on every surface at once. */
     private recordExecution;
-    /**
-     * Whether the user approved this task to run (ADR-0029, ADR-0035): it was in
-     * the plan they executed, or they started it, added it or let it start since,
-     * and it has been in the plan ever since. The one reading of the approval
-     * record — the seam and the scheduler both ask it.
-     */
+    /** Whether the user approved this task to run; see {@link ApprovalRecord.isApproved}. */
     isApproved(taskId: string): boolean;
-    /** A task the scheduler leaves for the user to approve; see {@link waitsForApproval}. */
+    /** A task the scheduler leaves for the user to approve; see {@link ApprovalRecord.waitsForApproval}. */
     waitsForApproval(taskId: string): boolean;
-    /** What the user approved to run (ADR-0029): a start of their own approves the task and its subtasks. */
-    private approve;
-    /**
-     * A task that leaves the plan takes its approval with it, whichever route
-     * removed it: an edit, a merge or split, a whole plan that leaves it out.
-     * Approval is of the task the user saw, and a planner may later write a new
-     * task under the same id (ADR-0029).
-     */
-    private keepApprovals;
     /**
      * Answer an outstanding approval. Every surface funnels here — the web
      * server's HTTP route, the VS Code webview, the TUI prompt — so the decision
@@ -3251,14 +3692,34 @@ declare class Session {
     announcedApprovals(): Extract<SessionMessage, {
         type: 'approval_request';
     }>[];
+    /**
+     * The planner compaction in flight, as its start was announced, for a
+     * surface that joins or reconnects while it runs; undefined when none is.
+     */
+    plannerCompaction(): Extract<SessionMessage, {
+        type: 'planner_compaction';
+    }> | undefined;
     /** Scopes the user granted this session — surfaced so a UI can show what is already allowed. */
     approvedScopes(): string[];
     /** The stable id this session persists under — matches the host's id when one was provided. */
     get sessionId(): string;
+    /**
+     * The workspace whose account this session's planner gate judges, so a host
+     * can re-probe it before a turn without keeping a second copy.
+     */
+    get workspaceRoot(): string;
+    /** The planner this session's own gate reads — not whatever the host's config says now. */
+    get plannerProvider(): PlannerBackendId;
     /** Where this session's structured task logs are saved (ADR-0018, P1). */
     get taskLogLocation(): TaskLogLocation;
     /** The attempts of a task that have a saved log, oldest first. */
     taskLogAttempts(taskId: string): number[];
+    /**
+     * Mark tasks a saved plan has no attempted flag for but whose logs prove an
+     * attempt ran. Only AI and script tasks: a manual task's completion wrote a
+     * handoff log, which is not a chat.
+     */
+    private creditLoggedAttempts;
     /** One attempt's saved log, for `replayTaskLog` — what a reopened task view shows. */
     taskLog(taskId: string, attempt: number): TaskLogEvent[];
     get executionLog(): ReadonlyArray<TaskSnapshot>;
@@ -3286,13 +3747,32 @@ declare class Session {
     private persist;
     /** A new plan on a long-lived Session gets its own persisted identity (unless the host fixed one). */
     private remintSessionId;
+    /**
+     * Null while this Session may save its session and run in its isolation
+     * run; otherwise the host that holds it (ADR-0049). Claims the lease when
+     * no live host holds it, as a new session's first save does.
+     */
+    heldElsewhere(): SessionHeld | null;
+    /**
+     * A new plan under the host's fixed id writes that session's file: refused
+     * before any planner turn while another host has it open (ADR-0049). A
+     * minted id is new, and is claimed at its first save.
+     */
+    private claimHostSession;
+    private saveRefused;
+    /**
+     * Another host took the session over, judging this one gone (ADR-0049). Its
+     * runners must not work on beside that host's, in the worktrees that host
+     * now prepares, so the run here stops.
+     */
+    private leaseLost;
     /**
      * The plan scope ends: everything that belongs to the plan this Session
      * holds goes, so nothing of it reaches the next one — a new plan, another
      * session adopted, or the Session closed. Its run is stopped, the planner
-     * turn in flight is abandoned with everything it held, what that turn
-     * deferred is settled, and the conversation, supervision, usage ledger,
-     * execution log and planner prompts are cleared. A new plan on the same
+     * turn in flight is abandoned with everything it held, and the
+     * conversation, supervision, usage ledger, execution log and planner
+     * prompts are cleared. A new plan on the same
      * Session keeps the scopes the user granted (`keepGrants`); a session
      * boundary does not (ADR-0008).
      */
@@ -3331,9 +3811,9 @@ declare class Session {
      * A task is running right now. Deliberately live work, not the scheduler's
      * armed flag: a run paused on a user task, a hold or a cancellation has
      * nothing executing, and reporting it as executing is what left the plan
-     * unstartable after its last live task was cancelled.
+     * unstartable after its last live task was cancelled. See
+     * {@link TaskOrchestrator.hasLiveWork}: a spawned runner, not merely an armed scheduler.
      */
-    /** See {@link TaskOrchestrator.hasLiveWork} — a spawned runner, not merely an armed scheduler. */
     get isExecuting(): boolean;
     get status(): 'approved' | 'running' | 'completed';
     /**
@@ -3365,6 +3845,11 @@ declare class Session {
      * that read the wait as idle sent a follow-up as a new goal.
      */
     get isPlannerBusy(): boolean;
+    /**
+     * The planner turn answering right now, if one is: a surface whose stream
+     * lost that turn's end reads this back to tell a stale gate from a live one.
+     */
+    get plannerTurnId(): string | undefined;
     /**
      * Stop the planner turn in flight. It still settles — a backend hands back
      * what it had — and ends as stopped. A turn still waiting at the planner
@@ -3379,6 +3864,8 @@ declare class Session {
      * answers, the enabled default is a stale guess a request must not freeze.
      */
     private chosenRunners;
+    /** Whether a first turn for `requested` would be refused for want of an enabled runner: a host calls it before it replaces a live session. */
+    assertRunnersEnabled(requested: RunnerId[] | undefined): void;
     generatePlan(goal: string, runners?: RunnerId[], options?: GeneratePlanOptions): Promise<LegacyPlanState>;
     /**
      * Kick off the planner conversation (ADR-0002): research + the first planner
@@ -3428,23 +3915,31 @@ declare class Session {
     private saveFork;
     /**
      * Condense the conversation on the user's say-so: a hidden planner turn
-     * summarises it, and the summary replaces everything but the last two
-     * exchanges. Conversation only — the tasks, and any run
+     * summarises it, and the summary stands in for everything but the last two
+     * exchanges in the planner's context, the transcript keeping every message.
+     * Conversation only — the tasks, and any run
      * executing them, are untouched. Atomic: a failed or stopped turn changes
      * nothing.
      */
     compactConversation(signal?: AbortSignal): Promise<ConversationCompaction>;
     rewindTargets(): RewindTarget[];
-    /** A plan the planner submitted through its tool, already checked against the live catalog. */
+    /**
+     * A plan the planner submitted through its tool, already checked against
+     * the live catalog: committed now, in the turn the call was made in
+     * (ADR-0022 P2), and answered with the tasks it holds.
+     */
     private submitPlanFromTool;
     /**
-     * A task edit the planner made through its tool. Checked against the live
-     * catalog — an edit to a running or completed task is refused here, with
-     * what would be accepted — then handed to the open turn, which commits it as
-     * it would the same ops in a taskOps reply. Edits made in one reply join one
-     * batch, which applies whole or not at all.
+     * A task edit the planner made through its tool, checked against the live
+     * catalog and committed now, in the turn the call was made in, as a batch
+     * of its own: whole or not at all, against the plan as it stands
+     * (ADR-0022 P2). An edit to a running or completed task is refused, with
+     * what would be accepted. Answered with the tasks it added and the task
+     * each handle it gave names, for a later call to read or start them by.
      */
     private editPlanFromTool;
+    /** Tasks as a planner tool's answer names them: by id and by the reference the plan gives each now. */
+    private taskHeads;
     /** Whether the planner conversation is live (started and not yet committed to a plan). */
     get isConversationActive(): boolean;
     /**
@@ -3464,12 +3959,10 @@ declare class Session {
     private skillsAt;
     private conversationOpening;
     /**
-     * Load planner-produced tasks, coerced to the allowlist read live — it may
-     * have changed since planning started. Tasks adopted on an armed scheduler,
-     * or on a run that awaits a resume (ADR-0034), are reconciled rather than
-     * reloaded: `loadPlan` clears the on-hold set and the review approval, so a
-     * task the user cancelled would be re-armed and re-spawned by the re-tick
-     * that follows, and a retry after the edit would run the task alone.
+     * Load planner-produced tasks, as the check they landed through resolved
+     * them against the catalog read live: it may have changed since planning
+     * started. The scheduler adopts them into the run under way, or as the plan
+     * the next run starts from (`adoptEdit`).
      *
      * A whole-plan commit is the planner restating every task, so it is laid
      * over the plan's execution state rather than replacing it: a planner that
@@ -3478,17 +3971,20 @@ declare class Session {
      * tasks, and `rearm`, the one op meant to change a status, must stand.
      */
     private adoptPlannerTasks;
+    private adoptResearch;
     private preparePlannerTaskUpdates;
     /**
      * PRD mode: when the planner writes the full markdown PRD, save it to
      * .scratch/<slug>/PRD.md (Matt Pocock to-prd convention) and keep it on the plan.
      */
     private capturePrd;
+    /** Merge the run settings this session owns, ignoring a field it does not know from a client's body. */
+    private mergeRunSettings;
     /**
      * The user changed run settings in this session (ADR-0030), which the host
      * has already saved: the run under way takes them at once, in either
      * direction — the wake-up turn under way too, since the seam reads the run's
-     * level at each call. Other sessions' runs keep theirs until they end.
+     * level at each call. Other sessions keep the values they opened with.
      */
     applyRunSettings(changes: Partial<GlobalRunSettings>): void;
     private idlePlan;
@@ -3497,7 +3993,8 @@ declare class Session {
      * Execute while a run is under way (#95): the seam has approved every task,
      * as executing does, and the run takes them in. A run the scheduler was not
      * driving, one task started on its own, becomes the plan's run, as Execute
-     * would make it.
+     * would make it. The planner's run_plan joins with `approved` 0: the
+     * scheduler starts only approved tasks, so `left` tasks still wait.
      */
     private joinRun;
     private startOneTask;
@@ -3511,6 +4008,16 @@ declare class Session {
     reschedule(): Promise<void>;
     private restartTask;
     private resumeTask;
+    /**
+     * The user's Retry compaction of a planner paused on its context (ADR-0002):
+     * the paused turn opens again on the inputs it kept. On the live context it
+     * condenses what it can, then sends the held input once; with the live
+     * context gone — a reload, another provider — a turn that only read starts
+     * again from the transcript. One whose calls changed something is refused,
+     * the pause kept, since no note could stop an effect running twice. Settles
+     * with the plan the turn lands, or paused again on; a Stop ends the pause.
+     */
+    retryPlannerCompaction(signal?: AbortSignal): Promise<LegacyPlanState>;
     /**
      * Keep what waits on the planner's usage limit from being sent at the reset:
      * it goes with the user's next message instead. False when nothing waits on
@@ -3612,6 +4119,13 @@ declare class Session {
     stopExecution(): void;
     /** Something will start without being asked again; see {@link TaskOrchestrator.startsPending}. */
     get startsPending(): boolean;
+    /**
+     * What the run is doing — starting, running, scheduled, resumable, and
+     * whether it advances on its own — for a surface or a guard that must tell a
+     * start on its way from real execution.
+     * See {@link TaskOrchestrator.activity}.
+     */
+    get activity(): RunActivity;
     /**
      * Run a user control and save what it changed before any surface hears of
      * it. Not a status hold, as {@link saved} is: these await spawns and git, so
@@ -3634,31 +4148,27 @@ declare class Session {
      * reschedule they owe.
      */
     private mutatePlan;
+    /** The plan to every surface, with the approvals it holds now. */
+    private announcePlan;
+    /**
+     * Approval was taken from a task, by a rule that runs wherever the tree
+     * changes (ADR-0029). A mutation that is under way announces the plan as it
+     * ends, and that broadcast carries this; one that is not, a load or a route
+     * that announces nothing of the plan, is followed by one of its own as soon
+     * as the synchronous work is done, so no surface keeps showing the task
+     * approved.
+     */
+    private withdrawalOwed;
     /** Patch one task's fields, checked as the planner's task ops are; see {@link PlanEditor.updateTask}. */
-    updateTask(taskId: string, changes: Partial<Task>): Promise<LegacyPlanState | null>;
+    updateTask(taskId: string, changes: Partial<Task>, options?: TaskEditOptions): Promise<LegacyPlanState | null>;
     /** Move one task onto a different runner, re-deriving what is scoped to it; see {@link PlanEditor.setTaskRunner}. */
-    setTaskRunner(taskId: string, runner: RunnerId): Promise<LegacyPlanState | null>;
+    setTaskRunner(taskId: string, runner: RunnerId, options?: TaskEditOptions): Promise<LegacyPlanState | null>;
     /** Replace one task's dependency list, under the same guard as a field patch; see {@link PlanEditor.setTaskDependencies}. */
-    setTaskDependencies(taskId: string, dependencies: string[]): Promise<LegacyPlanState | null>;
+    setTaskDependencies(taskId: string, dependencies: string[], options?: TaskEditOptions): Promise<LegacyPlanState | null>;
     /** Delete one task, cancelling its runner first if it runs; see {@link PlanEditor.removeTask}. */
     removeTask(taskId: string): Promise<LegacyPlanState | null>;
     /** Add one task, deriving what the caller left unset; see {@link PlanEditor.addTask}. */
     addTask(draft: Partial<Task>): Promise<LegacyPlanState | null>;
-    /**
-     * Planner-driven merge: validate compatibility up front, then ask the planner
-     * LLM to produce a single "merge" taskOps op combining the selected tasks.
-     * Goes through the same conversation loop + validated-atomic-edit + corrective
-     * retry flow as every other task_ops edit (ADR-0002). Throws on a
-     * pre-flight compatibility failure so the host surfaces an inline error
-     * before any LLM call.
-     */
-    requestMerge(taskIds: string[], options?: GeneratePlanOptions): Promise<LegacyPlanState>;
-    /**
-     * Planner-driven split: ask the planner LLM to decompose one task into a
-     * sequence of smaller tasks. The model generates the breakdown (no manual
-     * per-task specs from the user). Same conversation-loop/repair path as merge.
-     */
-    requestSplit(taskId: string, options?: GeneratePlanOptions): Promise<LegacyPlanState>;
     loadPlan(plan: LegacyPlanState, goal: string, workspace: string, opts?: {
         sessionId?: string;
         persist?: boolean;
@@ -3716,6 +4226,20 @@ declare class AlreadyExecutingError extends Error {
     constructor();
 }
 
+type ParsedCommand = {
+    ok: true;
+    command: ExecutionCommand;
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * An `ExecutionCommand` out of a request body, or the sentence saying what is
+ * wrong with it. Only the command's own fields are kept, so a body cannot carry
+ * anything the seam does not read.
+ */
+declare function parseExecutionCommand(body: unknown): ParsedCommand;
+
 /**
  * Where Ordewell keeps machine-global data (settings, daemon tokens, caches,
  * credentials). A single home for everything not tied to a project directory,
@@ -3730,6 +4254,9 @@ declare function globalDataDir(): string;
  * on disk, which would otherwise permanently skip lifting anything added to
  * this list later (`.env` did exactly that: real API keys stranded in the old
  * dir because the settings.json move had already made the new dir exist).
+ *
+ * Best-effort: a home it cannot write (read-only, full disk) must not take the
+ * CLI down before `--help`, and the old file stays where it is.
  */
 declare function migrateOldConfigDir(): void;
 
@@ -3801,7 +4328,8 @@ declare class VerdictEngine {
     /**
      * Attach to a spawned session. The runner's `task_complete` call on the
      * attempt's token is the only completion evidence (ADR-0022, V2); a session
-     * that exits before one gets a failed verdict.
+     * that exits before one gets a failed verdict. A script task's session has
+     * no runner to call it: its exit status is the evidence instead (ADR-0035).
      *
      * Returns the attempt's generation, what {@link signalComplete} is checked against.
      */
@@ -3812,6 +4340,12 @@ declare class VerdictEngine {
      * earlier call already settled it.
      */
     signalComplete(taskId: string, generation: number, report: TaskCompleteArgs): void;
+    /**
+     * A script task's exit status (ADR-0035): its one evidence, as a runner's
+     * `task_complete` call is a runner's. It settles the attempt unless that
+     * attempt is no longer the task's current one.
+     */
+    signalScriptExit(taskId: string, generation: number, exit: ScriptExit): void;
     /** The runner was told something after its evidence so far, so only what it reports from here counts. */
     private supersede;
     private acceptVerdict;
@@ -3851,6 +4385,7 @@ declare class BufferedTaskOutputSource implements TaskOutputSource {
     reset(): void;
     finalText(taskId: string): string;
     report(taskId: string): string | undefined;
+    handoff(taskId: string): StoredHandoff | undefined;
     liveTail(taskId: string, opts: LiveTailOptions): LiveTail | null;
     private append;
 }
@@ -3881,11 +4416,12 @@ declare abstract class AbstractRunnerSession implements IRunnerSession {
     abstract queued(): QueuedTaskMessage[];
     abstract interrupt(): Promise<void>;
     abstract nativeSessionId(): string | null;
-    abstract commands(): RunnerCommand[];
+    abstract commands(): RunnerCommand$1[];
     abstract invokeCommand(name: string, args?: string): string;
     abstract answerPermission(id: string, decision: ApprovalDecision): boolean | Promise<boolean>;
     abstract onTaskComplete(listener: (report: TaskCompleteArgs) => void): void;
     abstract onToolCheckpoint(handler: (question: string, signal: AbortSignal) => Promise<CheckpointAnswer>): void;
+    abstract onScriptExit(listener: (exit: ScriptExit) => void): void;
 }
 declare abstract class AbstractRunner<S extends IRunnerSession> implements IRunner {
     protected sessions: Map<string, S>;
@@ -3912,11 +4448,17 @@ interface SessionLaunch {
     createAdapter: (runner: string, deps: AgentProcessDeps) => TaskModeAgentAdapter;
     startOptions: TaskStartOptions;
     interruptGraceMs: number;
-    /** Where this attempt's task tools are served (ADR-0022). */
+    /** Where this attempt's task tools are served (ADR-0022), and a read-only attempt's shell and web reads (ADR-0046) and patch (ADR-0050). */
     tools: {
         server: OrdewellMcpServer;
         scope: TaskTokenScope;
+        shell?: TaskShell;
+        savePatch?: (signal: AbortSignal) => Promise<McpToolReply>;
+        webReads?: TaskWebReads;
     };
+    checkHandoff: (completion: TaskCompleteArgs) => HandoffCheck<TaskCompleteArgs>;
+    readTask?: (args: ReadTaskArgs) => McpToolReply;
+    applyPatch?: (args: ApplyPatchArgs) => Promise<McpToolReply>;
     onNotice?: (message: string) => void;
 }
 /**
@@ -3952,6 +4494,8 @@ declare class StructuredSession extends AbstractRunnerSession {
     private interrupting;
     /** The wind-down once {@link stop} was asked for: the same for every caller, and nothing new is sent meanwhile. */
     private stopping;
+    /** The process is handling its exit: nothing new may be queued, so a held report can still publish. */
+    private exiting;
     private lastSessionId;
     private lastSessionCost;
     private readonly structuredEmitter;
@@ -3972,12 +4516,14 @@ declare class StructuredSession extends AbstractRunnerSession {
      * Start the runner with the attempt's tools attached and send the task's
      * prompt as its first turn. `task_complete` is the only way a task reports
      * it is done, so a runner without the tools is never sent the task: it is
-     * killed and respawned once, and a second failure fails the start.
+     * killed and respawned once, and a second miss is a timeout the task holds.
      */
     start(prompt: string): Promise<void>;
     getOutput(): string;
     onTaskComplete(listener: (report: TaskCompleteArgs) => void): void;
     onToolCheckpoint(handler: (question: string, signal: AbortSignal) => Promise<CheckpointAnswer>): void;
+    /** A runner's model reports through `task_complete`; only a script task's session ends on its exit status (ADR-0035). */
+    onScriptExit(): void;
     /**
      * The runner on a fresh token, attached or respawned once (ADR-0025). Done
      * once the runner reports the server connected — or once the session ended
@@ -4013,7 +4559,7 @@ declare class StructuredSession extends AbstractRunnerSession {
     onTurnEnd(listener: (reason: StructuredTurnEnd) => void): void;
     onEvent(listener: (event: StructuredEvent) => void): void;
     sendMessage(text: string, from?: TaskMessageFrom): string;
-    commands(): RunnerCommand[];
+    commands(): RunnerCommand$1[];
     invokeCommand(name: string, args?: string): string;
     private enqueue;
     /**
@@ -4115,25 +4661,6 @@ declare class StructuredRunner extends AbstractRunner<StructuredSession> {
     spawn(opts: RunnerSpawnOptions): Promise<IRunnerSession>;
 }
 
-/** Whether a task can be continued in its saved runner session (ADR-0018, K1), and in which. */
-type Continuability = {
-    ok: true;
-    sessionId: string;
-} | {
-    ok: false;
-    reason: string;
-};
-/**
- * The rule every surface offers Continue by and the orchestrator enforces: a
- * completed, failed or skipped task, or one paused on a usage limit, whose last
- * attempt left a session id behind. A conflict is resolved by its repair, not a
- * new turn — Retry covers it.
- */
-declare function continuability(task: Task): Continuability;
-declare function canContinue(task: Task): boolean;
-
-declare function stripAnsi(text: string): string;
-
 /**
  * cmd.exe's command-line buffer. A longer line is truncated rather than
  * rejected, which would corrupt a planner's system prompt or a task's prompt
@@ -4197,6 +4724,16 @@ declare class EmbeddedNewlineError extends Error {
     readonly command: string;
     constructor(command: string);
 }
+/**
+ * Thrown when only a batch shim resolved for an argument holding a double
+ * quote. cmd.exe flips its quote state at every `"`, whether or not a backslash
+ * precedes it, so the quote ends the quoting we added and the rest of the
+ * argument is read as commands: `--model "x\" & calc & \"y"` runs `calc`.
+ */
+declare class BatchQuoteError extends Error {
+    readonly command: string;
+    constructor(command: string);
+}
 /**
  * Thrown when `command` cannot be resolved to a real file. Kept distinguishable
  * from `WorkspaceNotFoundError` (utils/workspace) even though both a missing
@@ -4243,15 +4780,185 @@ declare function windowsCommandLine(file: string, args: string[]): string;
  * a `.ps1` beside a too-long `.cmd` still raises.
  *
  * A line break does reorder them: cmd.exe cannot carry one at any length, so a
- * `.ps1` beside a `.cmd` wins, and a lone `.cmd` raises.
+ * `.ps1` beside a `.cmd` wins, and a lone `.cmd` raises. So does a double
+ * quote, which cmd.exe cannot carry safely.
  *
  * @throws {CommandLineTooLongError} when the selected route's buffer cannot
  * carry the arguments.
  * @throws {EmbeddedNewlineError} when the arguments span lines and only the
  * batch route resolved.
+ * @throws {BatchQuoteError} when an argument holds a double quote and only the
+ * batch route resolved.
  */
 declare function planDirectLaunch(command: string, args: string[], deps?: LaunchDeps): Promise<LaunchPlan>;
 
+/**
+ * What runs a script task's attempt, where a runner id would name a coding
+ * agent: no registered runner does, and no model is involved (ADR-0035).
+ */
+declare const SCRIPT_RUNNER = "script";
+type ScriptSpawnFn = (file: string, args: string[], options: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    stdio: ['ignore', 'pipe', 'pipe'];
+    detached: boolean;
+    shell: boolean;
+    windowsVerbatimArguments?: boolean;
+    windowsHide: true;
+}) => ChildProcess;
+/** Every OS touchpoint is injectable, and production uses the defaults. */
+interface ScriptRunnerDeps {
+    spawn?: ScriptSpawnFn;
+    platform?: NodeJS.Platform;
+    /** The PATH steps run under. Defaults to the augmented PATH a runner gets. */
+    resolvePath?: () => Promise<string>;
+    /** The interpreter a `script` body runs in. Defaults to the research shell (ADR-0011). */
+    shell?: () => ResearchShell;
+    isDirectory?: (dir: string) => boolean;
+    /** How the launch seam looks a program up on Windows (ADR-0010); the real filesystem and environment unless set. */
+    launch?: Pick<LaunchDeps, 'exists' | 'comSpec' | 'powerShell' | 'pathExt'>;
+    /**
+     * Where an attempt's whole output is streamed, beside its task log: the log
+     * keeps only the ends of a long output, and a failure is often in the
+     * middle. Prepares the file's directory and returns its path; none is kept
+     * without it.
+     */
+    fullOutputFile?: (taskId: string, attempt: number) => string;
+    /** The most characters that file keeps; the {@link FULL_OUTPUT_MAX_CHARS} guard unless a test sets one. */
+    fullOutputMaxChars?: number;
+}
+interface ScriptSessionSetup {
+    body: ScriptBody;
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    spawn: ScriptSpawnFn;
+    platform: NodeJS.Platform;
+    launch: LaunchDeps;
+    shell: () => ResearchShell;
+    fullOutput?: {
+        file: string;
+        maxChars: number;
+    };
+}
+/**
+ * One attempt of a script task (ADR-0035): its body run at the workspace root
+ * with no model. `commands` run in order with no shell, each program resolved
+ * through the launch seam (ADR-0010), stopping at the first that fails; a
+ * `script` runs once, in the research shell's interpreter. Each step's command,
+ * output and exit status are its events, which are the task's log. Its end is
+ * handed on as the attempt's evidence ({@link onScriptExit}), and only then
+ * does the session exit.
+ *
+ * Every step leads its own process group, so the time limit, a stop and the
+ * task's end reach whatever it started in that group. A process that leaves
+ * the group (`setsid`, `setpgrp`) is out of reach of a group signal, and once
+ * its parent exits nothing ties it to the step: holding it is the work of a
+ * boundary around the task, a container or a lease (#97, #99), not of a signal.
+ */
+declare class ScriptSession extends AbstractRunnerSession {
+    private readonly setup;
+    private readonly events;
+    private readonly endListeners;
+    private readonly steps;
+    private readonly children;
+    private child;
+    private output;
+    private running;
+    private stopped;
+    private timedOut;
+    private errorTail;
+    private logged;
+    private logTail;
+    private omitted;
+    private full;
+    private markGone;
+    private readonly gone;
+    constructor(id: string, taskId: string, setup: ScriptSessionSetup);
+    /** Whoever spawned it attaches its listeners when the spawn resolves, so the body starts a macrotask later. */
+    begin(): void;
+    private run;
+    private runStep;
+    /**
+     * An argument vector is never joined into a shell string: on POSIX it is
+     * exec'd as written, and on Windows the launch seam finds the program the
+     * way CreateProcess will not. A script goes to the research shell's
+     * interpreter, the one the planner's own commands use.
+     */
+    private launchOf;
+    private spawnStep;
+    private expire;
+    private print;
+    private printError;
+    private openFullOutput;
+    private saveOutput;
+    /** Resolves once the file is on disk, so a reader of the exit finds it whole. */
+    private closeFullOutput;
+    /** Streamed into the log until the step's head is full; past it, only a tail is kept, for {@link flushLogTail}. */
+    private logOutput;
+    private flushLogTail;
+    private emit;
+    /** Ends the step under way and every one after it; resolves once the session has exited. */
+    stop(): Promise<void>;
+    kill(): void;
+    getOutput(): string;
+    /** Nothing reads a step's input. */
+    write(): void;
+    turnState(): 'working' | 'idle';
+    /** A script has no turns. */
+    onTurnEnd(): void;
+    onEvent(listener: (event: StructuredEvent) => void): void;
+    sendMessage(): string;
+    forceSend(): string;
+    forceSendQueued(): boolean;
+    removeQueued(): boolean;
+    queued(): QueuedTaskMessage[];
+    /** There is no turn to interrupt: Stop ends a script. */
+    interrupt(): Promise<void>;
+    nativeSessionId(): string | null;
+    commands(): RunnerCommand$1[];
+    invokeCommand(): string;
+    answerPermission(): boolean;
+    /** With no runner, nothing calls `task_complete`: the exit status is the evidence. */
+    onTaskComplete(): void;
+    onToolCheckpoint(): void;
+    onScriptExit(listener: (exit: ScriptExit) => void): void;
+}
+/**
+ * Starts script task attempts (ADR-0035), as a runner starts a coding agent's,
+ * so the task log, the merge gate, the Merge-all exclusion and the
+ * tracked-file check meet one the way they meet an ops task. It reads only the
+ * spawn's `script` body, `cwd` and `env`: there is no model, mode or prompt.
+ * The step environment is the one a runner gets — the host's, cleaned, under
+ * the workspace's own variables (ADR-0016).
+ */
+declare class ScriptRunner extends AbstractRunner<ScriptSession> {
+    private readonly deps;
+    private spawned;
+    constructor(deps?: ScriptRunnerDeps);
+    spawn(opts: RunnerSpawnOptions): Promise<IRunnerSession>;
+    /** An attempt with no number has no place to keep a file: a log would not know which attempt it was. */
+    private fullOutputFor;
+}
+
+/** Whether a task can be continued in its saved runner session (ADR-0018, K1), and in which. */
+type Continuability = {
+    ok: true;
+    sessionId: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * The rule every surface offers Continue by and the orchestrator enforces: a
+ * completed, failed or skipped task, or one paused on a usage limit, whose last
+ * attempt left a session id behind. A conflict is resolved by its repair, not a
+ * new turn — Retry covers it.
+ */
+declare function continuability(task: Task): Continuability;
+declare function canContinue(task: Task): boolean;
+
+declare function stripAnsi(text: string): string;
+
 /**
  * A workspace path that does not exist, or exists but is not a directory.
  * Checked at every surface that starts a planner or spawns an agent inside
@@ -4441,6 +5148,15 @@ declare const OPENCODE_MANIFEST: RunnerManifest;
 
 declare const STATE_DIR = ".ordewell";
 declare function ensureDir(dir: string): void;
+/**
+ * Replace `filePath` with `content` in one step. Writing in place truncates
+ * the old bytes first, so a crash, power loss or a full disk mid-write leaves
+ * an empty or half-written file where the last good one was — silent loss of
+ * the only copy, for a session or a saved plan. The bytes go to a fresh temp
+ * file beside the target and a rename swaps it in; within one directory that
+ * is atomic, so a reader sees the old file or the new one.
+ */
+declare function writeFileAtomic(filePath: string, content: string): void;
 declare function getStateDir(baseDir?: string): string;
 /**
  * Ignores the state directory's contents except this file and `skills/`, so a
@@ -4557,4 +5273,9 @@ declare const DEFAULT_MAX_PARALLEL = 5;
  */
 declare function parseMaxParallel(value: unknown): number | null;
 
-export { ALL_PROVIDERS, AbstractRunner, AbstractRunnerSession, type Adr0013IsolationRun, type Adr0013PlanIsolation, type Adr0013TaskRecord, AgentAdapter, AgentEvent, AgentProcessDeps, AgentStartOptions, AiProvider, AlreadyExecutingError, ApprovalAnswer, ApprovalDecision, ApprovalModeSetting, ApprovalPolicy, AssignmentScope, BaseAiService, BaseConfig, BaseFileSystem, BufferedTaskOutputSource, type ByPlannerBackend, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CMD_EXE_MAX_COMMAND_LINE, CODEX_SANDBOX_DOCS, CODEX_SANDBOX_OFF_LINE, type CachedPage, type CappedRows, CheckpointAnswer, type CheckpointListener, ClaudeCodeAdapter, CodexAdapter, CodexSandboxAvailability, CommandLineTooLongError, type CommandOutcome, type CommandPayload, type ConfiguredPlanner, type Consent, ConsoleLogger, ContextCollector, type Continuability, ConversationCompaction, type ConversationFork, ConversationRequest, type ConversationRewind, ConversationTurn, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DEFAULT_MAX_PARALLEL, type DirEntry, DiscoveredModel, DuckDuckGoSearchProvider, EmbeddedNewlineError, type EnvAdmission, EnvConfig, type ExecImpl, ExecutableNotFoundError, ExecutionActor, type ExecutionCommand, ExecutionCommandName, ExecutionCommands, type ExecutionHost, ExecutionRecord, FindSymbolOptions, GREP_PCRE_PROBE_ARGS, GeminiService, type GitExecFn, GlobOptions, GlobalRunSettings, type GrepInvocation, GrepOptions, type GrepRegex, GuardTarget, GuardTrip, HARNESS_PLANNER_REASON, type HasBinFn, HttpWebFetcher, type HttpWebFetcherOptions, IAiService, IApproval, IConfig, IFileSystem, type ILogger, INotification, IRunner, IRunnerSession, type ISearchProvider, IWorktreeIsolation, IsolationLandedTask, IsolationMergeResult, IsolationTaskStatus, IsolationView, type KillTreeDeps, type LaunchDeps, type LaunchPlan, LegacyPlanState, LiveTail, LiveTailOptions, type LoopGuard, type MappedTool, type MergeWordingHandoff, ModelResolver, type ModelResolverDeps, NoPlanError, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OpenAiService, OpenCodeAdapter, OrchestratorObserver, OrchestratorOption, OrdewellMcpServer, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, PendingApproval, PendingApprovals, PlanEditError, PlanIsolation, type PlanRequest, PlanState, PlanStore, Planner, type PlannerBackendEntry, PlannerBackendId, type PlannerChoice, PlannerModelCandidate, type PlannerModelLookup, PlannerModelRecall, type PlannerModelSource, PlannerModelStore, type PlannerSelectionChange, type PlannerSelectionCurrent, type PlannerSelectionResult, type PlannerSelectionState, PlannerToolHandler, type PlannerUsability, PlannerUsage, type PrdBlock, ProviderModelLists, type ProviderRegistration, QueuedTaskMessage, ReadFileOpts, ReportedWindow, type ResearchChat, ResearchLogEntry, ResearchShell, type ResearchTurn, type ResolvedChoice, type ResolvedPlanner, RewindTarget, RunMergeView, RunView, RunnerApprovals, RunnerCommand, RunnerId, RunnerInstallation, RunnerManifest, RunnerModeInfo, RunnerRegistry, RunnerSessionCost, type RunnerSpawnOptions, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STATE_DIR_IGNORE, STOPPED_TOOL_RESULT, SUPERVISOR_LEVELS, SYMBOL_LANGUAGES, type SaveSession, type SavedState, type SearchHit, type SearchOutcome, type SearchPage, type SearchTransport, Session, SessionBroadcaster, type SessionDeps, SessionMessage, SessionMeta, SessionNotFoundError, SessionNotice, type SessionPlanner, type SessionRuntimeSettings, SkillsService, type SpawnSpec, StartAdmission, StdioAgentAdapter, StructuredEvent, StructuredRunner, type StructuredRunnerDeps, StructuredSession, StructuredTurnEnd, SupervisorLevel, type SupervisorPolicy, Task, TaskCompleteArgs, TaskLogEvent, type TaskLogFile, type TaskLogLocation, TaskLogRecorder, type TaskLogRecorderDeps, TaskMessageFrom, TaskModeAgentAdapter, TaskOrchestrator, TaskOutputSource, TaskQueryCatalog, TaskRunnerFlags, TaskStartOptions, TaskTokenScope, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, UsageRecord, UserSettings, VerdictEngine, type VerdictListener, WINDOWS_MAX_COMMAND_LINE, WebRead, WebReadDecision, type WebResponse, WebResponseCache, type WebResponseCacheOptions, type WebTransport, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, type WorktreeIsolationDeps, admitSettingsEnv, applyHeadLimit, assertWorkspaceExists, assertWorkspaceIsProject, augmentedPath, bearerHeaderValue, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, canContinue, checkoutRule, clearAugmentedPathCache, clearDaemonToken, clearState, clipboardCopyCommand, codexSandboxNotice, configuredProviders, continuability, createSession, createTaskAdapter, createWorktreeIsolation, daemonTokenPath, defaultEnabledRunners, defaultLogger, definitionPattern, deleteSession, describeMergeResult, detectInstalledPlanner, discoverGeminiModels, ensureDir, ensurePrivateDir, ensureStateDirIgnored, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, findInstalledPlanner, formatSearchOutput, getLatestSession, getProviderMeta, getStateDir, globalDataDir, grantScopeFor, grepRegexFromProbe, idSegment, includeGlobFor, installedPlannerAnswered, installedPlannerDetected, isApiProvider, isCliProvider, isExecutableResolved, isOpenAiProvider, isPlannerBackend, isRepoGroup, isVendorModelFor, killTree, languageForId, listSessions, listTaskLogAttempts, listTree, loadSession, loadSessionPlanState, loadState, looksLikeChallenge, mapAgentTool, mergeTarget, migrateOldConfigDir, migratePlanIsolation, mintDaemonToken, mintSessionId, normalizeAgentArgs, normalizeGeminiModel, openTaskLog, parseMaxParallel, parseSearchHits, planDirectLaunch, plannerBackendEntries, prefixModelId, providerForRunner, readDaemonToken, readTaskLog, recordInstalledPlanner, recordedInstalledPlanner, referencePattern, removedPluginNotice, reposWithWork, resetInstalledPlanner, resolveProviderFromPrefix, resolveTaskRunnerFlags, resolveWithin, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, selectPlanner, sessionDataDir, sessionRuntimeSettings, sharedSearchProvider, sharedWebResponseCache, stateExists, stripAnsi, stripModelPrefix, supportsTaskMode, tokenSubprotocols, tokensMatch, wellKnownBinDirs, windowsCommandLine, withPath, writePrivateFile };
+/** The numeric components of a version, or null when it cannot be read. */
+declare function parseVersion(version: string): number[] | null;
+/** Negative, zero or positive as `a` is older than, the same as, or newer than `b`; an unreadable version sorts oldest. */
+declare function compareVersions(a: string, b: string): number;
+
+export { ALL_PROVIDERS, AbstractRunner, AbstractRunnerSession, AccountLimitBucket, type AccountLimitCollector, type AccountLimitListener, AccountLimitMonitor, type AccountLimitMonitorOptions, type AccountLimitReading, AccountLimitSnapshot, type Adr0013IsolationRun, type Adr0013PlanIsolation, type Adr0013TaskRecord, AgentAdapter, AgentEvent, AgentProcessDeps, AgentStartOptions, AiProvider, AlreadyExecutingError, ApprovalAnswer, ApprovalDecision, ApprovalModeSetting, ApprovalPolicy, AssignmentScope, BaseAiService, BaseConfig, BaseFileSystem, BashOptions, BatchQuoteError, BufferedTaskOutputSource, type ByPlannerBackend, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CMD_EXE_MAX_COMMAND_LINE, CODEX_SANDBOX_DOCS, CODEX_SANDBOX_OFF_LINE, type CachedPage, type CappedRows, CheckpointAnswer, type CheckpointListener, type ClaudeAccountLimitOptions, ClaudeCodeAdapter, type CodexAccountLimitOptions, CodexAdapter, CodexSandboxAvailability, CommandLineTooLongError, CommandOutcome, type ConfiguredPlanner, ConsoleLogger, ContextCollector, type Continuability, ConversationCompaction, type ConversationFork, ConversationRequest, type ConversationRewind, ConversationTurn, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DEFAULT_MAX_PARALLEL, type DirEntry, DiscoveredModel, DuckDuckGoSearchProvider, type EffectRules, EmbeddedNewlineError, type EnvAdmission, EnvConfig, type ExecImpl, ExecutableNotFoundError, ExecutionActor, ExecutionCommand, FindSymbolOptions, GREP_PCRE_PROBE_ARGS, GeminiService, type GitExecFn, GlobOptions, GlobalRunSettings, type GrepInvocation, GrepOptions, type GrepRegex, HARNESS_PLANNER_REASON, HandoffCheck, type HasBinFn, HttpWebFetcher, type HttpWebFetcherOptions, IAiService, IApproval, IConfig, IFileSystem, IIsolationPreview, type ILogger, INotification, IRunner, IRunnerSession, type ISearchProvider, IWorktreeIsolation, IsolationTaskStatus, IsolationView, type KillTreeDeps, type LaunchDeps, type LaunchPlan, LeaseHost, LegacyPlanState, LiveTail, LiveTailOptions, McpToolReply, ModelResolver, type ModelResolverDeps, type NativeShellLauncher, type NativeShellOffer, NoPlanError, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OpenAiService, OpenCodeAdapter, type OpenCodeGoAccountLimitOptions, OrchestratorObserver, OrchestratorOption, OrdewellMcpServer, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type ParsedCommand, PendingApproval, PendingApprovals, type PingFetch, PlanEditError, PlanIsolation, type PlanRequest, PlanState, PlanStore, Planner, PlannerAllowlist, type PlannerBackendEntry, PlannerBackendId, type PlannerChoice, PlannerModelCandidate, type PlannerModelLookup, PlannerModelRecall, type PlannerModelSource, PlannerModelStore, type PlannerSelectionChange, type PlannerSelectionCurrent, type PlannerSelectionResult, type PlannerSelectionState, PlannerShellSandbox, PlannerToolHandler, type PlannerUsability, PlannerUsage, type PrdBlock, ProviderModelLists, type ProviderRegistration, QueuedTaskMessage, ReadFileOpts, ReadTaskArgs, ReportedWindow, type ResearchChat, ResearchLogEntry, ResearchShell, type ResearchTurn, type ResolvedChoice, type ResolvedPlanner, RewindTarget, RunActivity, RunMergeView, RunView, RunnerApprovals, RunnerAuth, RunnerAuthExec, RunnerCommand$1 as RunnerCommand, RunnerId, RunnerInstallation, type RunnerInstallationOptions, RunnerManifest, RunnerModeInfo, RunnerRegistry, RunnerSessionCost, type RunnerSpawnOptions, SCRIPT_RUNNER, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STATE_DIR_IGNORE, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SaveSession, type SavedState, ScriptBody, ScriptExit, ScriptRunner, ScriptSession, type SearchHit, type SearchOutcome, type SearchPage, type SearchTransport, Session, SessionBroadcaster, type SessionDeps, SessionHeld, SessionLease, SessionMessage, SessionMeta, SessionNotFoundError, SessionNotice, type SessionPlanner, type SessionRuntimeSettings, ShellLaunch, SkillsService, type SpawnSpec, StdioAgentAdapter, StoredHandoff, StructuredEvent, StructuredRunner, type StructuredRunnerDeps, StructuredSession, StructuredTurnEnd, Task, TaskCompleteArgs, TaskControlError, type TaskEditOptions, TaskLogEvent, type TaskLogFile, type TaskLogLocation, TaskLogRecorder, type TaskLogRecorderDeps, TaskMessageFrom, TaskModeAgentAdapter, TaskOrchestrator, TaskOutputSource, TaskQueryCatalog, TaskRunnerFlags, TaskShell, TaskShellSite, TaskStartOptions, TaskTokenScope, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, UsageRecord, UserSettings, VERSION_CHECK_NOTICE, VERSION_CHECK_URL, VerdictEngine, type VerdictListener, type VersionCheck, type VersionCheckOptions, WINDOWS_MAX_COMMAND_LINE, WebRead, WebReadDecision, type WebResponse, WebResponseCache, type WebResponseCacheOptions, type WebTransport, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, type WorktreeIsolationDeps, admitSettingsEnv, applyHeadLimit, assertWorkspaceExists, assertWorkspaceIsProject, augmentedPath, bearerHeaderValue, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, canContinue, claudeAccountLimitCollector, clearAugmentedPathCache, clearDaemonToken, clearState, clipboardCopyCommand, codexAccountLimitCollector, codexSandboxNotice, compareVersions, configuredProviders, continuability, createIsolationPreview, createNativeShellLauncher, createSession, createTaskAdapter, createWorktreeIsolation, daemonTokenPath, defaultEnabledRunners, defaultLogger, definitionPattern, deleteSession, detectInstalledPlanner, discoverGeminiModels, effectRuleFor, ensureDir, ensurePrivateDir, ensureStateDirIgnored, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, findInstalledPlanner, formatSearchOutput, getLatestSession, getProviderMeta, getStateDir, globalDataDir, grantScopeFor, grepRegexFromProbe, idSegment, includeGlobFor, installedPlannerAnswered, installedPlannerDetected, isApiProvider, isCliProvider, isExecutableResolved, isOpenAiProvider, isPlannerBackend, isVendorModelFor, isolationViewOfPlan, killTree, languageForId, listSessions, listTaskLogAttempts, listTree, loadSession, loadSessionPlanState, loadState, looksLikeChallenge, migrateOldConfigDir, migratePlanIsolation, mintDaemonToken, mintSessionId, nativeShellInvocation, nativeShellOffer, normalizeGeminiModel, openCodeGoAccountLimitCollector, openTaskLog, parseEffectAllowlist, parseExecutionCommand, parseMaxParallel, parseSearchHits, parseVersion, planDirectLaunch, plannerBackendEntries, prefixModelId, prepareTaskOutputFile, providerForRunner, readDaemonToken, readTaskLog, readTaskPatch, recordInstalledPlanner, recordedInstalledPlanner, referencePattern, removedPluginNotice, resetInstalledPlanner, resolveProviderFromPrefix, resolveTaskRunnerFlags, resolveWithin, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, saveTaskPatch, selectPlanner, sessionDataDir, sessionRuntimeSettings, sharedSearchProvider, sharedWebResponseCache, startVersionCheck, stateExists, stripAnsi, stripModelPrefix, supportsTaskMode, taskPatchFile, tokenSubprotocols, tokensMatch, wellKnownBinDirs, windowsCommandLine, withPath, writeFileAtomic, writePrivateFile };