@ordewell/core 0.11.0 → 0.11.2

package/dist/index.js

@@ -210,6 +210,7 @@ __export(index_exports, {
   assignedRunnerOf: () => assignedRunnerOf,
   assignmentIssue: () => assignmentIssue,
   assignmentIssueText: () => assignmentIssueText,
+  attachingLabel: () => attachingLabel,
   augmentedPath: () => augmentedPath,
   automergeSummary: () => automergeSummary,
   autonomyLevelLabel: () => autonomyLevelLabel,
@@ -661,18 +662,18 @@ function dependencyTargetErrors(tasks, taskId, dependencies) {
 }
 function findDependencyCycle(tasks) {
   const byId = new Map([...walkPlan(tasks)].map(({ task: task2 }) => [task2.id, task2]));
-  const path47 = [];
+  const path48 = [];
   const done = /* @__PURE__ */ new Set();
   const visit = (id2) => {
     if (done.has(id2)) return null;
-    const at = path47.indexOf(id2);
-    if (at >= 0) return path47.slice(at);
-    path47.push(id2);
+    const at = path48.indexOf(id2);
+    if (at >= 0) return path48.slice(at);
+    path48.push(id2);
     for (const dep of byId.get(id2)?.dependencies ?? []) {
       const hit = visit(dep);
       if (hit) return hit;
     }
-    path47.pop();
+    path48.pop();
     done.add(id2);
     return null;
   };
@@ -1737,7 +1738,7 @@ function lastServedModel(events) {
   return void 0;
 }
 function taskLogForSurface(events) {
-  return events.map((event) => event.type === "task_skills" ? { type: "task_skills", skills: event.skills.map(({ name, source, path: path47 }) => ({ name, source, path: path47 })) } : event);
+  return events.map((event) => event.type === "task_skills" ? { type: "task_skills", skills: event.skills.map(({ name, source, path: path48 }) => ({ name, source, path: path48 })) } : event);
 }
 function coalesceTaskLog(events) {
   const out = [];
@@ -2780,9 +2781,9 @@ function literalCdTarget(seg) {
   return target === "" || target.startsWith("-") || target.startsWith("~") || /[*?[]/.test(target) ? void 0 : target;
 }
 function followCd(segments) {
-  if (segments.some((s) => s.joinedBy === "other" || SHELL_STATE_COMMANDS.has(s.binary))) return;
+  if (segments.some((s) => s.joinedBy === "other" || movesShell(s))) return;
   const inPipeline = (i) => segments[i].joinedBy === "pipe" || segments[i + 1]?.joinedBy === "pipe";
-  if (segments.some((s, i) => s.binary === "cd" && !inPipeline(i) && literalCdTarget(s) === void 0)) return;
+  if (segments.some((s, i) => s.binary.toLowerCase() === "cd" && !inPipeline(i) && literalCdTarget(s) === void 0)) return;
   let chain = [];
   segments.forEach((seg, i) => {
     seg.cwd = chain;
@@ -2791,7 +2792,7 @@ function followCd(segments) {
   });
 }
 function markShellState(segments, bareSegment) {
-  if (!bareSegment && !segments.some((s) => SHELL_STATE_COMMANDS.has(s.binary))) return;
+  if (!bareSegment && !segments.some(movesShell)) return;
   for (const seg of segments) if (seg.binary === "cd") seg.cdSteered = true;
 }
 var SHELL_STATE_COMMANDS = /* @__PURE__ */ new Set([
@@ -2810,6 +2811,7 @@ var SHELL_STATE_COMMANDS = /* @__PURE__ */ new Set([
   "exec",
   "pushd",
   "popd",
+  "chdir",
   "alias",
   "unalias",
   "builtin",
@@ -2818,6 +2820,9 @@ var SHELL_STATE_COMMANDS = /* @__PURE__ */ new Set([
   "hash",
   "trap"
 ]);
+function movesShell(seg) {
+  return SHELL_STATE_COMMANDS.has(seg.binary.toLowerCase());
+}
 
 // src/services/commandRunners.ts
 var HELP_FLAGS = ["--help", "--version"];
@@ -3673,8 +3678,9 @@ var FLAG_POLICY = {
   sort: {
     cluster: true,
     // Absent on purpose: `-o`/`--output` writes a file with no redirect for the
-    // redirect check to see, and `--compress-program` names a program that sort
-    // runs over its own temporary files — a permitted binary as an interpreter.
+    // redirect check to see, `-T`/`--temporary-directory` names where sort writes
+    // its run files, and `--compress-program` names a program that sort runs
+    // over its own temporary files — a permitted binary as an interpreter.
     booleans: [
       "-b",
       "-c",
@@ -3713,11 +3719,9 @@ var FLAG_POLICY = {
       "-k",
       "-t",
       "-S",
-      "-T",
       "--key",
       "--field-separator",
       "--buffer-size",
-      "--temporary-directory",
       "--random-source",
       "--batch-size",
       "--parallel",
@@ -4344,23 +4348,28 @@ function scanFlags(seg) {
   const booleans = /* @__PURE__ */ new Set([...spec.booleans ?? [], ...UNIVERSAL_FLAGS]);
   const values = new Set(spec.values ?? []);
   const operands = [];
+  const operandAt = [];
+  const operand = (at) => {
+    operands.push(seg.args[at]);
+    operandAt.push(at);
+  };
   let i = 0;
   while (i < seg.args.length) {
     const token = seg.args[i];
     if (token === "--" && !spec.expressionArgs) {
-      operands.push(...seg.args.slice(i + 1));
+      for (let j = i + 1; j < seg.args.length; j++) operand(j);
       break;
     }
     if (!/^-./.test(token)) {
-      operands.push(token);
+      operand(i);
       i++;
       continue;
     }
     const shape = matchFlag(spec, booleans, values, token);
-    if (shape === void 0) return { unknown: flagLabel(token), operands };
+    if (shape === void 0) return { unknown: flagLabel(token), operands, operandAt };
     i += shape === "value" && takesNextToken(seg.args[i + 1]) ? 2 : 1;
   }
-  return { operands };
+  return { operands, operandAt };
 }
 function subcommandOf(seg) {
   const scan = scanFlags(seg);
@@ -4513,6 +4522,8 @@ function sedRefusalFor(binary, scripts) {
       return `The "${binary}" script runs a shell command (the "e" command or the "e" flag of "s"), which this classifier cannot inspect. ${INSPECT_OR_TASK}`;
     case "write":
       return `The "${binary}" script writes a file (the "w"/"W" command or the "w" flag of "s"). You are a read-only planner \u2014 print the output instead, or describe the write as a task.`;
+    case "read":
+      return `The "${binary}" script reads a file it names itself (the "r"/"R" command), which path confinement cannot see. Read that file directly instead.`;
     default:
       return `This classifier could not read the "${binary}" script well enough to rule out a shell command or a file write in it. Rewrite it with plain print, delete and substitute commands, or describe the work as a task.`;
   }
@@ -4633,6 +4644,7 @@ function sedScriptHazard(script) {
     if (cmd === void 0) return "unreadable";
     if (cmd === "e") return "exec";
     if (cmd === "w" || cmd === "W") return "write";
+    if (cmd === "r" || cmd === "R") return "read";
     if (cmd === "{" || cmd === "}") continue;
     if (cmd === "#") {
       while (i < n && script[i] !== "\n") i++;
@@ -4654,7 +4666,7 @@ function sedScriptHazard(script) {
       if (!commandEnds()) return "unreadable";
       continue;
     }
-    if ("aicrR".includes(cmd)) {
+    if ("aic".includes(cmd)) {
       while (i < n && script[i] !== "\n") i += script[i] === "\\" ? 2 : 1;
       continue;
     }
@@ -4754,6 +4766,12 @@ function awkRefusalFor(binary, programs) {
         return `The "${binary}" program pipes to or from a command ("|"), which runs it through a shell this classifier cannot inspect. ${INSPECT_OR_TASK}`;
       case "write":
         return `The "${binary}" program redirects its output to a file (">"). You are a read-only planner \u2014 print to standard output instead, or describe the write as a task.`;
+      case "read":
+        return `The "${binary}" program reads a file it names itself ("getline <" or an "ARGV" entry), which path confinement cannot see. Name the file as an operand instead.`;
+      case "environment":
+        return `The "${binary}" program reads the environment ("ENVIRON"), which holds credentials. Run printenv for the one variable you need, which asks first.`;
+      case "symbol-table":
+        return `The "${binary}" program uses "SYMTAB", which gawk reads as every global by name, "ENVIRON" and "ARGV" included. Name the variable you need directly.`;
       case "extension":
         return `The "${binary}" program uses an "@" form, which loads an extension, includes a source file or calls a function by name \u2014 none of which this classifier can inspect. ${INSPECT_OR_TASK}`;
       default:
@@ -4795,6 +4813,7 @@ function awkProgramHazard(program) {
   let slash = "regex";
   let depth = 0;
   let printDepth;
+  let getlineDepth;
   let continues = false;
   const readRegex = () => {
     i++;
@@ -4861,7 +4880,10 @@ function awkProgramHazard(program) {
       continue;
     }
     if (c === "\n" || c === ";") {
-      if (c === ";" || !continues) printDepth = void 0;
+      if (c === ";" || !continues) {
+        printDepth = void 0;
+        getlineDepth = void 0;
+      }
       slash = "regex";
       i++;
       continue;
@@ -4912,6 +4934,12 @@ function awkProgramHazard(program) {
       slash = "unclear";
       continue;
     }
+    if (c === "<") {
+      if (getlineDepth !== void 0 && depth >= getlineDepth) return "read";
+      i++;
+      slash = "unclear";
+      continue;
+    }
     if (c === "(" || c === "[") {
       depth++;
       i++;
@@ -4920,12 +4948,16 @@ function awkProgramHazard(program) {
     }
     if (c === ")" || c === "]") {
       depth--;
+      if (getlineDepth !== void 0 && depth < getlineDepth) getlineDepth = void 0;
       i++;
       slash = "divide";
       continue;
     }
     if (c === "{" || c === "}") {
-      if (c === "}") printDepth = void 0;
+      if (c === "}") {
+        printDepth = void 0;
+        getlineDepth = void 0;
+      }
       i++;
       slash = "regex";
       continue;
@@ -4946,6 +4978,10 @@ function awkProgramHazard(program) {
       while (i < n && /[A-Za-z0-9_.]/.test(program[i])) i++;
       const word = program.slice(start, i);
       if (word === "system") return "exec";
+      if (word === "ENVIRON") return "environment";
+      if (word === "ARGV") return "read";
+      if (word === "SYMTAB") return "symbol-table";
+      if (word === "getline") getlineDepth = depth;
       if (word === "print" || word === "printf") printDepth = depth;
       slash = AWK_KEYWORDS.includes(word) ? "unclear" : "divide";
       continue;
@@ -5832,6 +5868,36 @@ var GIT_READONLY_SUBCOMMANDS = [
   "whatchanged",
   "cat-file"
 ];
+var onlyAction = (...reads) => (after) => after[0] === void 0 || reads.includes(after[0]);
+var GIT_PROMPTABLE = {
+  "ls-remote": () => true,
+  "for-each-ref": () => true,
+  "show-ref": () => true,
+  "name-rev": () => true,
+  "merge-base": () => true,
+  "count-objects": () => true,
+  "cherry": () => true,
+  "range-diff": () => true,
+  "diff-tree": () => true,
+  "diff-files": () => true,
+  "diff-index": () => true,
+  "show-branch": () => true,
+  "annotate": () => true,
+  "check-ignore": () => true,
+  "check-attr": () => true,
+  "check-ref-format": () => true,
+  "check-mailmap": () => true,
+  "var": () => true,
+  "version": () => true,
+  "worktree": onlyAction("list"),
+  "notes": onlyAction("list", "show"),
+  "bisect": onlyAction("log"),
+  "sparse-checkout": onlyAction("list"),
+  "reflog": onlyAction("show", "exists"),
+  "symbolic-ref": (after) => after.filter((a) => !a.startsWith("-")).length <= 1,
+  // `-w` writes the object; git's shared flag set keeps it for `git diff -w`.
+  "hash-object": (after) => !after.some((a) => /^-[^-]*w/.test(a))
+};
 var REFUSED_COMMANDS = [
   "rm",
   "rmdir",
@@ -5923,7 +5989,28 @@ var REFUSED_SUBCOMMANDS = {
     "clone",
     "fetch",
     "pull",
-    "submodule"
+    "submodule",
+    "add",
+    "rm",
+    "mv",
+    "format-patch",
+    "replace",
+    "mergetool",
+    "repack",
+    "update-index",
+    "read-tree",
+    "checkout-index",
+    "merge-file",
+    "bundle",
+    "commit-tree",
+    "write-tree",
+    "mktree",
+    "mktag",
+    "unpack-objects",
+    "fast-import",
+    "pack-refs",
+    "prune-packed",
+    "maintenance"
   ],
   npm: ["publish", "unpublish", "deprecate", "owner", "access", "token", "login", "logout"],
   yarn: ["publish", "npm"],
@@ -6133,7 +6220,7 @@ function pathRefs(command, opts = {}) {
   return lexAll(command.trim(), dialect, opts.cdpathSet).segments.flatMap((seg) => {
     const patterns = patternArgs(seg);
     const cwd = seg.cwd ?? [];
-    return [...seg.args.filter((_, i) => !patterns.has(i)), ...seg.inputs].flatMap(pathIn).map((path47) => ({ path: path47, cwd }));
+    return [...seg.args.filter((_, i) => !patterns.has(i)), ...seg.inputs].flatMap(pathIn).map((path48) => ({ path: path48, cwd }));
   });
 }
 function excludedBy(command, allow, opts = {}) {
@@ -6240,7 +6327,9 @@ function patternArgs(seg) {
 var SCOPE_LEAD_ARGS = 2;
 function scopeFor(seg) {
   const name = seg.binaryPath ?? seg.binary;
-  if (!MULTIPLEXERS.includes(seg.binary.toLowerCase())) return name;
+  const program = programName(seg.binary);
+  if (!MULTIPLEXERS.includes(program)) return name;
+  if (program === "git") return gitScope(seg, name);
   const lead = [];
   for (const arg of seg.args) {
     if (arg.startsWith("-")) break;
@@ -6249,6 +6338,14 @@ function scopeFor(seg) {
   }
   return [name, ...lead].join(" ");
 }
+function gitScope(seg, name) {
+  const scan = scanFlags({ ...seg, binary: "git" });
+  if (!scan || scan.unknown || scan.operands[0] === "ls-remote") return [name, ...seg.args].map(scopeWord).join(" ");
+  return [name, ...scan.operands.slice(0, SCOPE_LEAD_ARGS)].join(" ");
+}
+function scopeWord(word) {
+  return word === "" || /[\s"'\\]/.test(word) ? JSON.stringify(word) : word;
+}
 function climbsByGlob(seg) {
   if (!seg.globbed) return false;
   const patterns = patternArgs(seg);
@@ -6270,6 +6367,27 @@ function swallowsRefName(arg) {
   const values = FLAG_POLICY.git.values ?? [];
   return [...arg.slice(1)].some((c) => c !== "n" && values.includes(`-${c}`));
 }
+function gitArgsAfterSubcommand(seg) {
+  const at = scanFlags(seg)?.operandAt[0];
+  return at === void 0 ? [] : seg.args.slice(at + 1);
+}
+var REMOTE_NAME = /^[A-Za-z0-9_][A-Za-z0-9_.-]*$/;
+function namesConfiguredRemote(seg, after) {
+  const destination2 = scanFlags({ ...seg, args: after })?.operands[0];
+  return destination2 === void 0 || REMOTE_NAME.test(destination2);
+}
+function programName(binary) {
+  return binary.toLowerCase().replace(/\.exe$/, "");
+}
+function isRemoteListing(seg) {
+  const git2 = { ...seg, binary: programName(seg.binary) };
+  return git2.binary === "git" && subcommandOf(git2) === "ls-remote";
+}
+function remoteListingTexts(seg) {
+  if (!isRemoteListing(seg)) return [];
+  const git2 = { ...seg, binary: "git" };
+  return scanFlags({ ...git2, args: gitArgsAfterSubcommand(git2) })?.operands ?? [];
+}
 function refusalFor(seg, trustedResolves) {
   const web = webCommand(seg, trustedResolves);
   if (web?.reason) return web.reason;
@@ -6307,8 +6425,24 @@ function refusalFor(seg, trustedResolves) {
   }
   if (seg.binary === "git") {
     const sub = subcommandOf(seg);
+    const after = gitArgsAfterSubcommand(seg);
+    if (sub !== void 0 && !GIT_READONLY_SUBCOMMANDS.includes(sub)) {
+      const reads = GIT_PROMPTABLE[sub];
+      if (!reads) {
+        return `"git ${sub}" is not a git subcommand known only to read, so it may write the repository. You are a read-only planner: ${EFFECT_ROUTE}`;
+      }
+      if (!reads(after)) {
+        return `"git ${[sub, ...after].join(" ")}" is not a read-only form of "git ${sub}". You are a read-only planner: ${EFFECT_ROUTE}`;
+      }
+    }
+    if (sub === "ls-remote" && !namesConfiguredRemote(seg, after)) {
+      return `"git ls-remote" given a URL, an address or a path reaches it through git's own transport, which resolves the host itself and follows a redirect, so the origin approval, address guard and pinned connection a web read gets (ADR-0027) cannot hold for it. Name a remote the repository configures, such as "git ls-remote origin", or fetch the page with your web fetch tool.`;
+    }
+    if (sub === "ls-remote" && (seg.expandable || seg.globbed || after.some((a) => a.includes("~")))) {
+      return `The shell rewrites part of this "git ls-remote" before git sees it (a variable, substitution, glob or "~"), so what it sends the remote, and which repository it lists, cannot be checked for a secret or approved. Write the remote and patterns literally, in single quotes where they hold a "*", and re-run.`;
+    }
     if (sub === "branch" || sub === "tag") {
-      const flag2 = seg.args.find((a) => ["-D", "-d", "-m", "-M", "--delete", "--move"].includes(a)) ?? seg.args.slice(seg.args.indexOf(sub) + 1).find(swallowsRefName);
+      const flag2 = seg.args.find((a) => ["-D", "-d", "-m", "-M", "--delete", "--move"].includes(a)) ?? after.find(swallowsRefName);
       if (flag2) {
         return `"git ${sub} ${flag2}" mutates refs. You are a read-only planner: ${EFFECT_ROUTE}`;
       }
@@ -6447,10 +6581,10 @@ function classifyCommand(command, opts = {}) {
       return { tier: "refuse", scope: "", reason: `curl and wget are refused in Full and allowlist mode. ${web.effect ? EFFECT_REFUSAL_HINT : READ_REFUSAL_HINT}` };
     }
     const allow = opts.allow;
-    if (web && allow && web.urls.some((url) => scopeExcluded(allow, `${seg.binary.toLowerCase().replace(/\.exe$/, "")} ${url.origin}/*`))) {
+    if (web && allow && web.urls.some((url) => scopeExcluded(allow, `${programName(seg.binary)} ${url.origin}/*`))) {
       return { tier: "refuse", scope: "", reason: `The web origin is excluded by the planner allowlist. ${READ_REFUSAL_HINT}` };
     }
-    const reason = refusalFor({ ...seg, binary: seg.binary.toLowerCase() }, opts.trustedWebResolves);
+    const reason = refusalFor({ ...seg, binary: programName(seg.binary) }, opts.trustedWebResolves);
     if (reason) return { tier: "refuse", scope: "", reason: withWrapperNote(reason, wrappers) };
     if (runner && !XARGS_TARGETS.includes(seg.binary)) {
       return {
@@ -6460,23 +6594,24 @@ function classifyCommand(command, opts = {}) {
       };
     }
   }
-  if (unwrapped.some(({ seg }) => seg.binary.toLowerCase().replace(/\.exe$/, "") === "wget") && wgetVersionCommands(command, opts.dialect).includes(void 0)) {
+  if (unwrapped.some(({ seg }) => programName(seg.binary) === "wget") && wgetVersionCommands(command, opts.dialect).includes(void 0)) {
     return { tier: "refuse", scope: "", reason: `The wget executable cannot be checked safely in this working directory. ${READ_REFUSAL_HINT}` };
   }
   const nonAuto = unwrapped.filter((u) => u.runner !== void 0 || u.wrappers.some((w) => w !== w.toLowerCase()) || !isAuto(u.seg, opts));
   if (nonAuto.length === 0) return { tier: "auto", scope: "" };
+  const changesDirectory = unwrapped.some(({ seg }) => seg.binary.toLowerCase() === "cd");
   const lineScoped = nonAuto.some((u) => {
     const name = u.seg.binary.toLowerCase();
-    return name === "cd" || name !== "command" && SHELL_STATE_COMMANDS.has(name) || climbsByGlob(u.seg);
+    return name === "cd" || name !== "command" && SHELL_STATE_COMMANDS.has(name) || climbsByGlob(u.seg) || isRemoteListing(u.seg) && (changesDirectory || u.wrappers.length > 0 || nonAuto.length > 1);
   });
   const webUrls = nonAuto.flatMap((u) => webCommand(u.seg, opts.trustedWebResolves)?.urls ?? []);
-  const webOutboundTexts = nonAuto.flatMap((u) => webCommand(u.seg, opts.trustedWebResolves)?.outboundTexts ?? []);
+  const outboundTexts = nonAuto.flatMap((u) => webCommand(u.seg, opts.trustedWebResolves)?.outboundTexts ?? remoteListingTexts(u.seg));
   if (lineScoped && webUrls.length === 0) {
-    return { tier: "ask", scope: trimmed2 };
+    return { tier: "ask", scope: trimmed2, ...outboundTexts.length ? { outboundTexts } : {} };
   }
   const scopes = [...new Set(nonAuto.flatMap((u) => {
     const web = webCommand(u.seg, opts.trustedWebResolves);
-    return web ? web.urls.map((url) => `${u.seg.binary.toLowerCase().replace(/\.exe$/, "")} ${url.origin}/*`) : [lineScoped ? trimmed2 : u.runner ? `${u.runner} ${scopeFor(u.seg)}` : scopeFor(u.seg)];
+    return web ? web.urls.map((url) => `${programName(u.seg.binary)} ${url.origin}/*`) : [lineScoped ? trimmed2 : u.runner ? `${u.runner} ${scopeFor(u.seg)}` : scopeFor(u.seg)];
   }))].sort();
   const scope = scopes.join(" + ");
   const perInvocation = nonAuto.some((u) => webCommand(u.seg, opts.trustedWebResolves)?.perInvocation);
@@ -6484,7 +6619,8 @@ function classifyCommand(command, opts = {}) {
   return {
     tier: "ask",
     scope,
-    ...webUrls.length ? { webUrls, webOutboundTexts } : {},
+    ...webUrls.length ? { webUrls } : {},
+    ...outboundTexts.length ? { outboundTexts } : {},
     ...scopes.length > 1 && webUrls.length ? { scopes } : {},
     ...perInvocation ? { perInvocation } : {},
     ...allowedBy ? { allowedBy } : {}
@@ -6628,9 +6764,9 @@ function summarizeToolCall(tool2, argsJson, toolLabel) {
       const scope = args.include ? ` in ${args.include}` : "";
       return `grep ${ellipsize(String(args.pattern), 40)}${scope}${mode}`;
     }
-    const path47 = args.filePath || args.file_path || args.path;
-    if (path47) {
-      const basename6 = String(path47).split("/").pop() || String(path47);
+    const path48 = args.filePath || args.file_path || args.path;
+    if (path48) {
+      const basename6 = String(path48).split("/").pop() || String(path48);
       return `${display} ${basename6}`;
     }
     if (args.pattern) {
@@ -8116,7 +8252,7 @@ ${TASK_CONTINUE}`);
     command = disableWebCommandStartup(command, this.researchShell.dialect);
     const { approval, root } = site;
     const allow = approval.allowlist?.();
-    const { tier, scope, reason, allowedBy, perInvocation, scopes: commandScopes, webUrls, webOutboundTexts } = classifyCommand(command, {
+    const { tier, scope, reason, allowedBy, perInvocation, scopes: commandScopes, webUrls, outboundTexts } = classifyCommand(command, {
       ...this.policyOptions(),
       ...approval.commandPolicy?.(),
       ...allow ? { allow } : {}
@@ -8141,8 +8277,9 @@ ${TASK_CONTINUE}`);
     if (site.task?.sealed) return this.runSealed(site, command, request, "after", signal);
     if (tier === "refuse") return this.sealedInstead(site, command, request, refusal(`Command refused: ${reason}${site.task ? `
 ${TASK_UNSEALED} ${TASK_CONTINUE}` : ""}`), signal);
-    if (webUrls?.length && carriesSecret([...webOutboundTexts ?? [], ...webUrls.map((url) => url.href)], [...this.outboundSecrets(), ...sensitiveEnvValues(process.env)])) {
-      return refusal("Command refused: a web command contains what looks like a secret. Fetch the page with your web fetch tool, without credentials.");
+    const outbound = [...outboundTexts ?? [], ...(webUrls ?? []).map((url) => url.href)];
+    if (outbound.length && carriesSecret(outbound, [...this.outboundSecrets(), ...sensitiveEnvValues(process.env)])) {
+      return refusal(webUrls?.length ? "Command refused: a web command contains what looks like a secret. Fetch the page with your web fetch tool, without credentials." : "Command refused: what this command sends over the network contains what looks like a secret. Run it without the value.");
     }
     const vettedAddresses = /* @__PURE__ */ new Map();
     for (const url of webUrls ?? []) {
@@ -8245,7 +8382,7 @@ ${outcome.output}${outcome.success ? "" : `
     }
     let shell;
     try {
-      const sealed2 = site.task?.gitBefore ? { ...site.sealed, gitEntries: site.task.gitBefore.entries.map(({ path: path47, directory }) => ({ path: path47, directory })) } : site.sealed;
+      const sealed2 = site.task?.gitBefore ? { ...site.sealed, gitEntries: site.task.gitBefore.entries.map(({ path: path48, directory }) => ({ path: path48, directory })) } : site.sealed;
       shell = await site.sandbox.launchSealed(this.researchShell, sealed2);
     } catch (err) {
       return { refused: refusal(`Command not run: its sealed sandbox could not be prepared (${err instanceof Error ? err.message : String(err)}).`) };
@@ -9794,8 +9931,8 @@ function firstLineOf(command) {
 function text(value) {
   return typeof value === "string" ? value : "";
 }
-function searchArg(pattern, path47, include = "") {
-  return `${pattern}${path47 ? ` in ${path47}` : ""}${include ? ` (${include})` : ""}`;
+function searchArg(pattern, path48, include = "") {
+  return `${pattern}${path48 ? ` in ${path48}` : ""}${include ? ` (${include})` : ""}`;
 }
 function hintArg(args) {
   for (const field of HINT_FIELDS) {
@@ -9900,8 +10037,8 @@ function userMessage(id2, text6, skills, { turnId, forced } = {}) {
     ...forced ? { forced: true } : {}
   };
 }
-function skillLoadNotice({ invokedBy, name, source, path: path47, attaches }) {
-  return { invokedBy, name, source, path: path47, ...attaches ? { attaches } : {} };
+function skillLoadNotice({ invokedBy, name, source, path: path48, attaches }) {
+  return { invokedBy, name, source, path: path48, ...attaches ? { attaches } : {} };
 }
 var LOAD_SKILL_TOOL = /(?:^|_)load_skill$/;
 function surfaceStep(step) {
@@ -9918,8 +10055,8 @@ function loadedSkillName(args) {
     return void 0;
   }
 }
-function skillLoadBlock(id2, { invokedBy, name, source, path: path47, attaches }, turnId) {
-  return { type: "skill_load", id: id2, invokedBy, name, source, path: path47, ...attaches ? { attaches } : {}, ...turnId ? { turnId } : {} };
+function skillLoadBlock(id2, { invokedBy, name, source, path: path48, attaches }, turnId) {
+  return { type: "skill_load", id: id2, invokedBy, name, source, path: path48, ...attaches ? { attaches } : {}, ...turnId ? { turnId } : {} };
 }
 function subagentBlock(id2, { toolCallId, model, usage, turnId, ...fields }) {
   return {
@@ -10693,6 +10830,7 @@ function enabledRunners(cfg) {
 }
 
 // src/plugins/builtin/claudeModels.ts
+var path13 = __toESM(require("path"));
 var ANTHROPIC_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 var ANTHROPIC_VARIANT_LABELS = {
   adaptive: "Adaptive",
@@ -10786,6 +10924,53 @@ function parseClaudeHelp(stdout) {
   }
   return models;
 }
+function claudeConfigDir(env) {
+  return env.CLAUDE_CONFIG_DIR?.trim() || "~/.claude";
+}
+function claudeManagedSettingsDir(platform = process.platform) {
+  if (platform === "darwin") return "/Library/Application Support/ClaudeCode";
+  if (platform === "win32") return "C:\\Program Files\\ClaudeCode";
+  return "/etc/claude-code";
+}
+function readClaudeSettingsModels(files, platform = process.platform) {
+  const managed = claudeManagedSettingsDir(platform);
+  const join44 = platform === "win32" ? path13.win32.join : path13.posix.join;
+  const dropIns = files.list(join44(managed, "managed-settings.d")).filter((name) => name.endsWith(".json") && !name.startsWith(".")).sort().map((name) => join44(managed, "managed-settings.d", name));
+  const ranked = [...dropIns.reverse(), join44(managed, "managed-settings.json"), join44(claudeConfigDir(files.env), "settings.json")];
+  for (const file of ranked) {
+    const content = files.read(file);
+    const lineup = content === null ? null : parseClaudeSettingsModels(content);
+    if (lineup) return lineup;
+  }
+  return [];
+}
+function parseClaudeSettingsModels(content) {
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return null;
+  }
+  const picker = parsed && typeof parsed === "object" ? parsed.modelPicker : void 0;
+  const options = picker && typeof picker === "object" ? picker.options : void 0;
+  if (!Array.isArray(options)) return null;
+  const seen = /* @__PURE__ */ new Set();
+  const models = [];
+  for (const row of options) {
+    if (!row || typeof row !== "object") continue;
+    const { model: raw, label } = row;
+    const model = typeof raw === "string" ? raw.trim() : "";
+    if (!model || seen.has(model)) continue;
+    seen.add(model);
+    models.push({
+      modelId: model,
+      modelLabel: typeof label === "string" && label.trim() ? label.trim() : model,
+      runnerProvider: model.includes("/") ? model.split("/")[0] : void 0,
+      variants: []
+    });
+  }
+  return models;
+}
 
 // src/plugins/builtin/claude-code.manifest.ts
 var TURN_NOT_LOGGED_IN = /not logged in\s*·\s*please run \/login/i;
@@ -10824,18 +11009,24 @@ var CLAUDE_CODE_MANIFEST = {
     // 3. canonicalAliases — stable --model contracts (opus/sonnet/haiku/fable)
     //    merged into any successful result to fill gaps, and used as the full
     //    last-resort list when both API and CLI are unavailable.
+    //
+    // Whichever source answers, the models the user added to Claude's own
+    // picker (`modelPicker.options` in its managed or user settings, usually
+    // gateway IDs) are appended (settingsModels): the CLI accepts them as
+    // `--model` values though no catalog above lists them.
     apiDiscovery: {
       url: "https://api.anthropic.com/v1/models?limit=100",
       headers: { "anthropic-version": "2023-06-01" },
       auth: [
         { type: "env", varName: "ANTHROPIC_API_KEY", header: "X-Api-Key" },
-        { type: "file", path: "~/.claude/.credentials.json", jsonPath: "claudeAiOauth.accessToken", header: "Authorization", prefix: "Bearer " }
+        { type: "file", path: (env) => `${claudeConfigDir(env)}/.credentials.json`, jsonPath: "claudeAiOauth.accessToken", header: "Authorization", prefix: "Bearer " }
       ],
       parser: parseAnthropicModels
     },
     discoveryCommands: [
       { command: "claude", args: ["--help"], parser: parseClaudeHelp }
     ],
+    settingsModels: (files) => readClaudeSettingsModels(files),
     canonicalAliases: [
       { modelId: "opus", modelLabel: "Opus" },
       { modelId: "sonnet", modelLabel: "Sonnet" },
@@ -10893,7 +11084,7 @@ var import_path5 = require("path");
 
 // src/services/harness/repoConfig.ts
 var import_fs6 = require("fs");
-var path13 = __toESM(require("path"));
+var path14 = __toESM(require("path"));
 
 // src/services/mcp/OrdewellMcpServer.ts
 var import_http = require("http");
@@ -11857,12 +12048,12 @@ function checkpointReply(answer2) {
       return { text: `The checkpoint was withdrawn: ${answer2.why}`, isError: true };
   }
 }
-function fieldPath(path47) {
-  return path47.reduce((text6, part) => typeof part === "number" ? `${text6}[${part}]` : text6 ? `${text6}.${String(part)}` : String(part), "");
+function fieldPath(path48) {
+  return path48.reduce((text6, part) => typeof part === "number" ? `${text6}[${part}]` : text6 ? `${text6}.${String(part)}` : String(part), "");
 }
-function valueAt(value, path47) {
+function valueAt(value, path48) {
   let current = value;
-  for (const part of path47) {
+  for (const part of path48) {
     if (typeof part === "number") {
       if (!Array.isArray(current)) return void 0;
       current = current[part];
@@ -11884,7 +12075,7 @@ function boundedRefusal(issue, args) {
 var LEAKED_PARAMETER = /<\/parameter>|<parameter\s+name\s*=\s*"([^"]*)">/g;
 function leakedMarkupIn(value) {
   const found = [];
-  const walk = (node, path47) => {
+  const walk = (node, path48) => {
     if (typeof node === "string") {
       const names = [];
       let closing = false;
@@ -11892,25 +12083,25 @@ function leakedMarkupIn(value) {
         if (match[1] !== void 0) names.push(match[1]);
         else closing = true;
       }
-      if (names.length > 0 || closing) found.push({ path: path47, names: [...new Set(names)], closing });
+      if (names.length > 0 || closing) found.push({ path: path48, names: [...new Set(names)], closing });
       return;
     }
     if (Array.isArray(node)) {
-      node.forEach((item, i) => walk(item, `${path47}[${i}]`));
+      node.forEach((item, i) => walk(item, `${path48}[${i}]`));
       return;
     }
     if (node !== null && typeof node === "object") {
-      for (const [key, item] of Object.entries(node)) walk(item, path47 ? `${path47}.${key}` : key);
+      for (const [key, item] of Object.entries(node)) walk(item, path48 ? `${path48}.${key}` : key);
     }
   };
   walk(value, "");
   return found;
 }
 function markupRefusal(leaks) {
-  return leaks.map(({ path: path47, names, closing }) => {
+  return leaks.map(({ path: path48, names, closing }) => {
     const tags = [...names.map((n) => `<parameter name="${n}">`), ...closing ? ["</parameter>"] : []];
-    const guide = names.length > 0 ? ` The parameters ${names.map((n) => JSON.stringify(n)).join(", ")} are inside it; pass them as separate arguments, not inside ${path47}.` : " Pass each argument separately, not inside one string.";
-    return `${path47} contains leaked tool-call markup: ${tags.join(", ")}.${guide}`;
+    const guide = names.length > 0 ? ` The parameters ${names.map((n) => JSON.stringify(n)).join(", ")} are inside it; pass them as separate arguments, not inside ${path48}.` : " Pass each argument separately, not inside one string.";
+    return `${path48} contains leaked tool-call markup: ${tags.join(", ")}.${guide}`;
   }).join("\n");
 }
 function invalidArguments(name, error, args) {
@@ -12375,9 +12566,9 @@ function mcpClientConfig(credential) {
 }
 function ownerOnlyConfigFile(fileName, contents) {
   const dir = (0, import_fs5.mkdtempSync)((0, import_path4.join)((0, import_os.tmpdir)(), "ordewell-mcp-"));
-  const path47 = (0, import_path4.join)(dir, fileName);
-  (0, import_fs5.writeFileSync)(path47, contents, { mode: 384 });
-  return { path: path47, remove: () => (0, import_fs5.rmSync)(dir, { recursive: true, force: true }) };
+  const path48 = (0, import_path4.join)(dir, fileName);
+  (0, import_fs5.writeFileSync)(path48, contents, { mode: 384 });
+  return { path: path48, remove: () => (0, import_fs5.rmSync)(dir, { recursive: true, force: true }) };
 }
 
 // src/services/harness/repoConfig.ts
@@ -12400,19 +12591,19 @@ function onDisk(target) {
   try {
     return import_fs6.realpathSync.native(target);
   } catch {
-    return path13.resolve(target);
+    return path14.resolve(target);
   }
 }
 function insideOnDisk(root, target) {
-  const rel = path13.relative(onDisk(root), onDisk(target));
-  return rel === "" || !rel.startsWith("..") && !path13.isAbsolute(rel);
+  const rel = path14.relative(onDisk(root), onDisk(target));
+  return rel === "" || !rel.startsWith("..") && !path14.isAbsolute(rel);
 }
 function repoLevels(workspace) {
   const levels = [];
-  for (let dir = path13.resolve(workspace); ; dir = path13.dirname(dir)) {
+  for (let dir = path14.resolve(workspace); ; dir = path14.dirname(dir)) {
     levels.unshift(dir);
-    if ((0, import_fs6.existsSync)(path13.join(dir, ".git"))) return levels;
-    if (path13.dirname(dir) === dir) return [path13.resolve(workspace)];
+    if ((0, import_fs6.existsSync)(path14.join(dir, ".git"))) return levels;
+    if (path14.dirname(dir) === dir) return [path14.resolve(workspace)];
   }
 }
 function repoRoot(workspace) {
@@ -12506,33 +12697,33 @@ var TomlReader = class {
       if (this.i >= this.src.length) return root;
       if (this.src.startsWith("[[", this.i)) {
         this.i += 2;
-        const path47 = this.key();
+        const path48 = this.key();
         this.expect("]]");
-        const parent = this.tableAt(root, path47.slice(0, -1));
-        const last = path47[path47.length - 1];
+        const parent = this.tableAt(root, path48.slice(0, -1));
+        const last = path48[path48.length - 1];
         const list = Object.hasOwn(parent, last) ? parent[last] : parent[last] = [];
-        if (!Array.isArray(list)) throw this.fail(`${path47.join(".")} is not an array of tables`);
+        if (!Array.isArray(list)) throw this.fail(`${path48.join(".")} is not an array of tables`);
         table = newTable();
         list.push(table);
       } else if (this.src[this.i] === "[") {
         this.i += 1;
-        const path47 = this.key();
+        const path48 = this.key();
         this.expect("]");
-        table = this.tableAt(root, path47);
+        table = this.tableAt(root, path48);
       } else {
-        const path47 = this.key();
+        const path48 = this.key();
         this.skipBlank(false);
         this.expect("=");
         this.skipBlank(false);
-        const owner = this.tableAt(table, path47.slice(0, -1));
-        owner[path47[path47.length - 1]] = this.value();
+        const owner = this.tableAt(table, path48.slice(0, -1));
+        owner[path48[path48.length - 1]] = this.value();
       }
       this.endOfLine();
     }
   }
-  tableAt(from, path47) {
+  tableAt(from, path48) {
     let table = from;
-    for (const part of path47) {
+    for (const part of path48) {
       const next = Object.hasOwn(table, part) ? table[part] : void 0;
       if (next === void 0) table = table[part] = newTable();
       else if (isRecord2(next)) table = next;
@@ -12601,10 +12792,10 @@ var TomlReader = class {
         this.i++;
         return table;
       }
-      const path47 = this.key();
+      const path48 = this.key();
       this.expect("=");
       this.skipBlank(false);
-      this.tableAt(table, path47.slice(0, -1))[path47[path47.length - 1]] = this.value();
+      this.tableAt(table, path48.slice(0, -1))[path48[path48.length - 1]] = this.value();
       this.skipBlank(true);
       if (this.src[this.i] === ",") this.i++;
       else if (this.src[this.i] !== "}") throw this.fail("expected , or } in an inline table");
@@ -12749,7 +12940,8 @@ var CODEX_MANIFEST = {
     appServer: {
       command: "codex",
       args: ["app-server"],
-      cacheFile: "~/.codex/models_cache.json"
+      // CODEX_HOME moves all of Codex's own files from `~/.codex`.
+      cacheFile: (env) => `${env.CODEX_HOME?.trim() || "~/.codex"}/models_cache.json`
     },
     canonicalAliases: [
       { modelId: "gpt-5.6-sol", modelLabel: "GPT-5.6-Sol" },
@@ -12978,8 +13170,7 @@ var LineBuffer = class {
 // src/services/harness/ClaudeCodeAdapter.ts
 var import_crypto6 = require("crypto");
 var import_fs11 = require("fs");
-var os9 = __toESM(require("os"));
-var path21 = __toESM(require("path"));
+var path22 = __toESM(require("path"));
 
 // src/plugins/resolveArgs.ts
 function claudeThinkingArgs(effort) {
@@ -13017,14 +13208,29 @@ function resolveTaskRunnerFlags(manifest, ctx) {
   return flags;
 }
 
+// src/utils/runnerHome.ts
+var os5 = __toESM(require("os"));
+function runnerHomeDir(env, platform = process.platform) {
+  const name = platform === "win32" ? "USERPROFILE" : "HOME";
+  const key = platform === "win32" ? Object.keys(env).filter((k) => k.toUpperCase() === name).pop() : name;
+  const home = key === void 0 ? void 0 : env[key];
+  return home ?? os5.homedir();
+}
+function expandRunnerHome(filePath, env = process.env) {
+  if (!filePath.startsWith("~")) return filePath;
+  const home = runnerHomeDir(env);
+  return home ? home + filePath.slice(1) : null;
+}
+
 // src/services/harness/runnerProcess.ts
+var import_net = require("net");
 var import_string_decoder = require("string_decoder");
 
 // src/utils/shellPath.ts
 var import_child_process3 = require("child_process");
 var import_util = require("util");
-var os5 = __toESM(require("os"));
-var path14 = __toESM(require("path"));
+var os6 = __toESM(require("os"));
+var path15 = __toESM(require("path"));
 var execAsync = (0, import_util.promisify)(import_child_process3.exec);
 var LOGIN_SHELL_TIMEOUT_MS = 5e3;
 var PATH_MARKER = "__ORDEWELL_PATH__";
@@ -13033,21 +13239,21 @@ var defaultExec = async (command, options) => {
   return { stdout: String(stdout) };
 };
 function posixBinDirs() {
-  const home = os5.homedir();
+  const home = os6.homedir();
   return [
-    path14.join(home, ".local", "bin"),
-    path14.join(home, ".opencode", "bin"),
-    path14.join(home, ".claude", "bin"),
-    path14.join(home, ".bun", "bin"),
-    path14.join(home, ".volta", "bin"),
-    path14.join(home, ".npm-global", "bin"),
-    path14.join(home, "bin"),
+    path15.join(home, ".local", "bin"),
+    path15.join(home, ".opencode", "bin"),
+    path15.join(home, ".claude", "bin"),
+    path15.join(home, ".bun", "bin"),
+    path15.join(home, ".volta", "bin"),
+    path15.join(home, ".npm-global", "bin"),
+    path15.join(home, "bin"),
     "/usr/local/bin",
     "/opt/homebrew/bin"
   ];
 }
 function windowsBinDirs(env, home) {
-  const join44 = (...parts) => path14.win32.join(...parts);
+  const join44 = (...parts) => path15.win32.join(...parts);
   const under = (base, ...parts) => base ? [join44(base, ...parts)] : [];
   const appData = env.APPDATA;
   const localAppData = env.LOCALAPPDATA;
@@ -13084,7 +13290,7 @@ function windowsBinDirs(env, home) {
 function wellKnownBinDirs(deps = {}) {
   const platform = deps.platform ?? process.platform;
   if (platform !== "win32") return posixBinDirs();
-  return [...new Set(windowsBinDirs(deps.env ?? process.env, deps.home ?? os5.homedir()))];
+  return [...new Set(windowsBinDirs(deps.env ?? process.env, deps.home ?? os6.homedir()))];
 }
 async function loginShellPath(execImpl) {
   if (process.platform === "win32") return null;
@@ -13107,14 +13313,14 @@ function augmentedPath(execImpl = defaultExec) {
       const segments = [];
       const push = (p) => {
         if (!p) return;
-        for (const seg of p.split(path14.delimiter)) {
+        for (const seg of p.split(path15.delimiter)) {
           if (seg && !segments.includes(seg)) segments.push(seg);
         }
       };
       push(process.env.PATH);
       push(await loginShellPath(execImpl));
       for (const dir of wellKnownBinDirs()) push(dir);
-      return segments.join(path14.delimiter);
+      return segments.join(path15.delimiter);
     })();
   }
   return cachedPath;
@@ -13136,7 +13342,7 @@ function withPath(base, resolvedPath, overrides = {}) {
 
 // src/utils/launch.ts
 var fsSync4 = __toESM(require("fs"));
-var path15 = __toESM(require("path"));
+var path16 = __toESM(require("path"));
 var DIRECT_EXTENSIONS = [".exe", ".com"];
 var BATCH_EXTENSIONS = [".cmd", ".bat"];
 var POWERSHELL_EXTENSIONS = [".ps1"];
@@ -13144,7 +13350,7 @@ var CMD_EXE_MAX_COMMAND_LINE = 8191;
 var WINDOWS_MAX_COMMAND_LINE = 32767;
 function defaultPowerShell() {
   const root = process.env.SystemRoot || process.env.windir;
-  return root ? path15.win32.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") : "powershell.exe";
+  return root ? path16.win32.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") : "powershell.exe";
 }
 var POWERSHELL_FLAGS = ["-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File"];
 var CommandLineTooLongError = class extends Error {
@@ -13210,7 +13416,7 @@ Searched: ${searchedPath || "(empty PATH)"}`);
 };
 function isResolvableOnPosixPath(command, PATH, exists) {
   if (command.includes("/")) return exists(command);
-  return PATH.split(path15.delimiter).map((d) => d.trim()).filter(Boolean).some((dir) => exists(path15.join(dir, command)));
+  return PATH.split(path16.delimiter).map((d) => d.trim()).filter(Boolean).some((dir) => exists(path16.join(dir, command)));
 }
 function isExecutableResolved(command, plan, PATH, deps = {}) {
   if ((deps.platform ?? process.platform) === "win32") return plan.file !== command;
@@ -13250,9 +13456,9 @@ function cmdArgs(line) {
   return ["/d", "/s", "/c", `"${line}"`];
 }
 function candidateExtensions(command, pathExt) {
-  const declared = pathExt.split(path15.win32.delimiter).map((e) => e.trim().toLowerCase()).filter(Boolean);
+  const declared = pathExt.split(path16.win32.delimiter).map((e) => e.trim().toLowerCase()).filter(Boolean);
   const known = /* @__PURE__ */ new Set([...DIRECT_EXTENSIONS, ...BATCH_EXTENSIONS, ...POWERSHELL_EXTENSIONS, ...declared]);
-  const ext = path15.win32.extname(command).toLowerCase();
+  const ext = path16.win32.extname(command).toLowerCase();
   if (ext && known.has(ext)) {
     const route = BATCH_EXTENSIONS.includes(ext) ? "cmd" : POWERSHELL_EXTENSIONS.includes(ext) ? "powershell" : "direct";
     return { direct: [], cmd: [], powershell: [], [route]: [""] };
@@ -13273,13 +13479,13 @@ async function findWindowsExecutables(command, deps) {
   const exists = deps.exists ?? defaultExists3;
   const pathExt = (deps.pathExt ?? (() => process.env.PATHEXT ?? ""))();
   const byRoute = candidateExtensions(command, pathExt);
-  const dirs = path15.win32.basename(command) !== command ? [path15.win32.dirname(path15.win32.resolve(command))] : (await (deps.resolvePath ?? augmentedPath)() || "").split(path15.win32.delimiter).map((d) => d.trim().replace(/^"|"$/g, "")).filter(Boolean);
-  const base = path15.win32.basename(command);
+  const dirs = path16.win32.basename(command) !== command ? [path16.win32.dirname(path16.win32.resolve(command))] : (await (deps.resolvePath ?? augmentedPath)() || "").split(path16.win32.delimiter).map((d) => d.trim().replace(/^"|"$/g, "")).filter(Boolean);
+  const base = path16.win32.basename(command);
   const found = [];
   for (const route of ROUTES) {
     outer: for (const ext of byRoute[route]) {
       for (const dir of dirs) {
-        const candidate = path15.win32.join(dir, `${base}${ext}`);
+        const candidate = path16.win32.join(dir, `${base}${ext}`);
         if (exists(candidate)) {
           found.push({ file: candidate, route });
           break outer;
@@ -13327,7 +13533,7 @@ async function planDirectLaunch(command, args, deps = {}) {
 
 // src/utils/workspace.ts
 var fs3 = __toESM(require("fs"));
-var path16 = __toESM(require("path"));
+var path17 = __toESM(require("path"));
 var WorkspaceNotFoundError = class extends Error {
   constructor(workspace) {
     super(`Workspace "${workspace}" does not exist.`);
@@ -13383,7 +13589,7 @@ function assertWorkspaceIsProject(workspace, deps = {}) {
     throw new WorkspaceNotAProjectError(workspace);
   }
   const hasMarker = [...PROJECT_MARKER_DIRS, ...PROJECT_MARKER_FILES].some(
-    (marker2) => exists(path16.join(resolved, marker2))
+    (marker2) => exists(path17.join(resolved, marker2))
   );
   if (!hasMarker) throw new WorkspaceNotAProjectError(workspace);
 }
@@ -13391,12 +13597,12 @@ function assertWorkspaceIsProject(workspace, deps = {}) {
 // src/services/workspaceEnv.ts
 var import_child_process4 = require("child_process");
 var fs5 = __toESM(require("fs"));
-var os6 = __toESM(require("os"));
-var path18 = __toESM(require("path"));
+var os7 = __toESM(require("os"));
+var path19 = __toESM(require("path"));
 
 // src/utils/fsHelpers.ts
 var fs4 = __toESM(require("fs"));
-var path17 = __toESM(require("path"));
+var path18 = __toESM(require("path"));
 var import_crypto5 = require("crypto");
 var STATE_DIR = ".ordewell";
 function ensureDir(dir) {
@@ -13405,9 +13611,9 @@ function ensureDir(dir) {
   }
 }
 function writeFileAtomic(filePath, content) {
-  const dir = path17.dirname(filePath);
+  const dir = path18.dirname(filePath);
   ensureDir(dir);
-  const tempPath = path17.join(dir, `.${path17.basename(filePath)}.${(0, import_crypto5.randomUUID)()}.tmp`);
+  const tempPath = path18.join(dir, `.${path18.basename(filePath)}.${(0, import_crypto5.randomUUID)()}.tmp`);
   fs4.writeFileSync(tempPath, content, { flag: "wx" });
   try {
     fs4.renameSync(tempPath, filePath);
@@ -13420,7 +13626,7 @@ function writeFileAtomic(filePath, content) {
   }
 }
 function getStateDir(baseDir) {
-  return path17.join(baseDir ?? process.cwd(), STATE_DIR);
+  return path18.join(baseDir ?? process.cwd(), STATE_DIR);
 }
 var IGNORE_FILE = ".gitignore";
 var STATE_DIR_IGNORE = "*\n!.gitignore\n!skills/\n!skills/**\n";
@@ -13428,7 +13634,7 @@ var LEGACY_IGNORES = /* @__PURE__ */ new Set(["*", "*\n"]);
 function ensureStateDirIgnored(baseDir) {
   const dir = getStateDir(baseDir);
   ensureDir(dir);
-  const file = path17.join(dir, IGNORE_FILE);
+  const file = path18.join(dir, IGNORE_FILE);
   try {
     fs4.writeFileSync(file, STATE_DIR_IGNORE, { flag: "wx" });
     return;
@@ -13963,7 +14169,7 @@ function defaultDeps() {
       }
     },
     baseEnv: process.env,
-    home: os6.homedir()
+    home: os7.homedir()
   };
 }
 var REFUSED2 = new Set(SETTINGS_ENV_REFUSED);
@@ -13975,7 +14181,7 @@ async function resolveWorkspaceEnv(cwd, overrides = {}) {
   const direnv = await fromDirenv(checkoutDirOf(cwd, deps), deps);
   result.blockedEnvrc = direnv.blocked;
   Object.assign(collected, direnv.env);
-  const file = findUp(cwd, path18.join(STATE_DIR, WORKSPACE_ENV_FILE), deps);
+  const file = findUp(cwd, path19.join(STATE_DIR, WORKSPACE_ENV_FILE), deps);
   if (file) {
     const content = deps.readFile(file);
     if (content !== null) {
@@ -13992,7 +14198,7 @@ async function resolveWorkspaceEnv(cwd, overrides = {}) {
 }
 var evaluating = /* @__PURE__ */ new Map();
 async function workspaceEnvOf(cwd) {
-  const key = path18.resolve(cwd);
+  const key = path19.resolve(cwd);
   let running2 = evaluating.get(key);
   if (!running2) {
     running2 = resolveWorkspaceEnv(cwd).then((result) => result.env).finally(() => evaluating.delete(key));
@@ -14001,11 +14207,11 @@ async function workspaceEnvOf(cwd) {
   return { ...await running2 };
 }
 function checkoutDirOf(cwd, deps) {
-  const parts = path18.resolve(cwd).split(path18.sep);
+  const parts = path19.resolve(cwd).split(path19.sep);
   const at = parts.findIndex((part, i) => part === STATE_DIR && parts[i + 1] === "worktrees");
   if (at < 0 || parts.length < at + 4) return cwd;
-  const root = parts.slice(0, at).join(path18.sep) || path18.sep;
-  const mapped = path18.join(root, ...parts.slice(at + 4));
+  const root = parts.slice(0, at).join(path19.sep) || path19.sep;
+  const mapped = path19.join(root, ...parts.slice(at + 4));
   return deps.isDirectory(mapped) ? mapped : root;
 }
 async function fromDirenv(cwd, deps) {
@@ -14035,18 +14241,18 @@ async function fromDirenv(cwd, deps) {
   return { env, blocked: null };
 }
 function findUp(start, relative17, deps) {
-  let dir = path18.resolve(start);
+  let dir = path19.resolve(start);
   for (; ; ) {
-    const candidate = path18.join(dir, relative17);
+    const candidate = path19.join(dir, relative17);
     if (deps.readFile(candidate) !== null) return candidate;
-    const parent = path18.dirname(dir);
+    const parent = path19.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 async function isTracked(file, deps) {
   try {
-    const out = await deps.run("git", ["ls-files", "--error-unmatch", path18.basename(file)], { cwd: path18.dirname(file), env: deps.baseEnv });
+    const out = await deps.run("git", ["ls-files", "--error-unmatch", path19.basename(file)], { cwd: path19.dirname(file), env: deps.baseEnv });
     return out.code === 0;
   } catch {
     return false;
@@ -14056,7 +14262,7 @@ function parseEnvFile(content, context, home) {
   const env = {};
   const lookup2 = (name) => env[name] ?? context[name] ?? "";
   const expand = (value) => {
-    const tilde = value.startsWith("~/") ? path18.join(home, value.slice(2)) : value;
+    const tilde = value.startsWith("~/") ? path19.join(home, value.slice(2)) : value;
     return tilde.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g, (_, braced, bare) => lookup2(braced ?? bare));
   };
   for (const raw of content.split(/\r?\n/)) {
@@ -14326,7 +14532,7 @@ function readOnlySessionRules(site) {
       real = import_fs8.realpathSync.native(root);
     } catch {
     }
-    for (const path47 of /* @__PURE__ */ new Set([root, real])) rules.push({ action: "external_directory", resource: `${path47.replace(/[\\/]$/, "")}/*`, effect: "allow" });
+    for (const path48 of /* @__PURE__ */ new Set([root, real])) rules.push({ action: "external_directory", resource: `${path48.replace(/[\\/]$/, "")}/*`, effect: "allow" });
   }
   return rules;
 }
@@ -14452,6 +14658,14 @@ function runnerEnv(resolvedPath, workspace = {}, launch = {}, drop) {
 // src/services/harness/runnerProcess.ts
 var STDERR_TAIL_CHARS = 4e3;
 var CLOSE_GRACE_MS = 2e3;
+function releasePipes(child) {
+  for (const stream of [child.stdin, child.stdout, child.stderr]) {
+    if (stream instanceof import_net.Socket) stream.unref();
+  }
+  for (const stream of [child.stdout, child.stderr]) {
+    if (stream instanceof import_net.Socket) stream.resume();
+  }
+}
 var RunnerProcess = class {
   constructor(deps) {
     this.deps = deps;
@@ -14524,6 +14738,7 @@ var RunnerProcess = class {
       const grace = setTimeout(() => {
         for (const flush of [...this.stdoutEnds]) flush();
         this.end({ code, signal });
+        releasePipes(child);
       }, CLOSE_GRACE_MS);
       grace.unref?.();
       void this.ended.then(() => clearTimeout(grace));
@@ -14622,11 +14837,11 @@ ${tail}` : ""}`;
 
 // src/services/sandbox/nativeShellLauncher.ts
 var import_fs9 = require("fs");
-var os7 = __toESM(require("os"));
-var path19 = __toESM(require("path"));
+var os8 = __toESM(require("os"));
+var path20 = __toESM(require("path"));
 function nativeShellInvocation(platform, env = process.env) {
   const shell = platform === "darwin" ? "/bin/zsh" : env.SHELL;
-  return { shell: shell && path19.posix.isAbsolute(shell) ? shell : "/bin/sh", args: ["-c"] };
+  return { shell: shell && path20.posix.isAbsolute(shell) ? shell : "/bin/sh", args: ["-c"] };
 }
 var live = /* @__PURE__ */ new Set();
 var exitHook = false;
@@ -14658,10 +14873,10 @@ function launcherScript(launch) {
 }
 async function createNativeShellLauncher(opts) {
   const invocation = nativeShellInvocation(opts.platform ?? process.platform, opts.env);
-  const root = (0, import_fs9.realpathSync)((0, import_fs9.mkdtempSync)(path19.join(os7.tmpdir(), "ordewell-native-shell-")));
+  const root = (0, import_fs9.realpathSync)((0, import_fs9.mkdtempSync)(path20.join(os8.tmpdir(), "ordewell-native-shell-")));
   let shortTmp = null;
   try {
-    shortTmp = (0, import_fs9.realpathSync)((0, import_fs9.mkdtempSync)(path19.join("/tmp", "ow-")));
+    shortTmp = (0, import_fs9.realpathSync)((0, import_fs9.mkdtempSync)(path20.join("/tmp", "ow-")));
     const tmpdir7 = shortTmp;
     const launch = await opts.sandbox.launchNativeShell({
       workspace: opts.workspace,
@@ -14670,7 +14885,7 @@ async function createNativeShellLauncher(opts) {
       shellArgs: invocation.args,
       ...opts.env ? { env: opts.env } : {}
     });
-    const prefix = path19.join(root, "run");
+    const prefix = path20.join(root, "run");
     (0, import_fs9.writeFileSync)(prefix, launcherScript(launch), { mode: 448 });
     (0, import_fs9.chmodSync)(prefix, 448);
     keep(root);
@@ -15186,9 +15401,8 @@ var ReplyRuns = class {
 };
 
 // src/services/harness/claudeRepoConfig.ts
-var os8 = __toESM(require("os"));
-var path20 = __toESM(require("path"));
-var MEMORY_FILES = ["CLAUDE.md", path20.join(".claude", "CLAUDE.md"), "CLAUDE.local.md"];
+var path21 = __toESM(require("path"));
+var MEMORY_FILES = ["CLAUDE.md", path21.join(".claude", "CLAUDE.md"), "CLAUDE.local.md"];
 var MAX_IMPORT_DEPTH = 5;
 function importsOf(text6) {
   const prose = text6.replace(/```[\s\S]*?```/g, "").replace(/`[^`\n]*`/g, "");
@@ -15199,11 +15413,11 @@ function withImports(workspace, file, depth, seen, into) {
   seen.add(file);
   const text6 = readText(file);
   if (text6 === void 0) return;
-  into.push({ path: path20.relative(workspace, file), text: text6 });
+  into.push({ path: path21.relative(workspace, file), text: text6 });
   if (depth >= MAX_IMPORT_DEPTH) return;
   for (const target of importsOf(text6)) {
     if (target.startsWith("~")) continue;
-    const abs = path20.resolve(path20.dirname(file), target);
+    const abs = path21.resolve(path21.dirname(file), target);
     if (insideOnDisk(workspace, abs)) withImports(workspace, abs, depth + 1, seen, into);
   }
 }
@@ -15224,12 +15438,12 @@ var CLAUDE_REPO_CONFIG = {
   instructions(workspace) {
     const files = [];
     const seen = /* @__PURE__ */ new Set();
-    for (const name of MEMORY_FILES) withImports(workspace, path20.join(workspace, name), 0, seen, files);
+    for (const name of MEMORY_FILES) withImports(workspace, path21.join(workspace, name), 0, seen, files);
     return files;
   },
   projectServers(workspace) {
     const source = ".mcp.json";
-    const text6 = readText(path20.join(workspace, source));
+    const text6 = readText(path21.join(workspace, source));
     if (text6 === void 0) return NO_SERVERS;
     let parsed;
     try {
@@ -15247,13 +15461,14 @@ var CLAUDE_REPO_CONFIG = {
     return found;
   }
 };
-function claudeLocalServers(configDir2, workspace) {
-  const file = configDir2 ? path20.join(configDir2, ".claude.json") : path20.join(os8.homedir(), ".claude.json");
-  const text6 = readText(file);
+function claudeLocalServers(env, workspace) {
+  const configDir2 = env.CLAUDE_CONFIG_DIR?.trim();
+  const file = expandRunnerHome(configDir2 ? path21.join(configDir2, ".claude.json") : "~/.claude.json", env);
+  const text6 = file === null ? void 0 : readText(file);
   if (text6 === void 0) return {};
   try {
     const parsed = JSON.parse(text6);
-    const project = isRecord2(parsed) && isRecord2(parsed.projects) ? parsed.projects[path20.resolve(workspace)] : void 0;
+    const project = isRecord2(parsed) && isRecord2(parsed.projects) ? parsed.projects[path21.resolve(workspace)] : void 0;
     return isRecord2(project) && isRecord2(project.mcpServers) ? project.mcpServers : {};
   } catch {
     return {};
@@ -15508,13 +15723,13 @@ var NO_AUTO_MEMORY = { CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1" };
 function inSavedOutput(abs, configDir2, sessionId) {
   let projects;
   try {
-    projects = import_fs11.realpathSync.native(path21.join(configDir2, "projects"));
+    projects = import_fs11.realpathSync.native(path22.join(configDir2, "projects"));
   } catch {
     return false;
   }
-  const rel = path21.relative(projects, abs);
-  if (rel.startsWith("..") || path21.isAbsolute(rel)) return false;
-  const [project, session, folder] = rel.split(path21.sep);
+  const rel = path22.relative(projects, abs);
+  if (rel.startsWith("..") || path22.isAbsolute(rel)) return false;
+  const [project, session, folder] = rel.split(path22.sep);
   return Boolean(project) && session === sessionId && folder === "tool-results";
 }
 var PATH_TOOLS = {
@@ -15752,7 +15967,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
       "--append-system-prompt",
       opts.systemPrompt
     ];
-    if (opts.mcp) args.push(...this.ordewellServerArgs(opts.mcp, "planner", this.plannerServers(opts, workspace)));
+    if (opts.mcp) args.push(...this.ordewellServerArgs(opts.mcp, "planner", this.plannerServers(opts, { ...process.env, ...workspace })));
     if (opts.model) args.push("--model", opts.model);
     if (opts.effort && opts.effort !== "adaptive") args.push("--effort", opts.effort);
     if (opts.resumeSessionId) {
@@ -15760,7 +15975,8 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
       this.countFrom(opts.resumeSessionId, opts.resumeCost);
       this.pendingResume = opts.resumeSessionId;
     }
-    this.configDir = workspace.CLAUDE_CONFIG_DIR ?? process.env.CLAUDE_CONFIG_DIR ?? path21.join(os9.homedir(), ".claude");
+    const env = { ...process.env, ...workspace };
+    this.configDir = expandRunnerHome(claudeConfigDir(env), env);
     return {
       command: "claude",
       args,
@@ -15830,13 +16046,12 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
   /**
    * What user-only settings stop the CLI loading that is not the
    * repository's to choose (ADR-0028): the user's own local-scope servers,
-   * under the `CLAUDE_CONFIG_DIR` the planner runs with, and the project
-   * servers approved for it.
+   * from the account in the environment the planner runs with, and the
+   * project servers approved for it.
    */
-  plannerServers(opts, workspace) {
-    const configDir2 = workspace.CLAUDE_CONFIG_DIR ?? process.env.CLAUDE_CONFIG_DIR;
+  plannerServers(opts, env) {
     return {
-      ...claudeLocalServers(configDir2, opts.cwd),
+      ...claudeLocalServers(env, opts.cwd),
       ...Object.fromEntries((opts.projectServers ?? []).map((server4) => [server4.name, server4.definition]))
     };
   }
@@ -16600,8 +16815,8 @@ function runProbe(deps, cwd, env, flags) {
 }
 
 // src/services/harness/codexRepoConfig.ts
-var path22 = __toESM(require("path"));
-var CONFIG_FILE = path22.join(".codex", "config.toml");
+var path23 = __toESM(require("path"));
+var CONFIG_FILE = path23.join(".codex", "config.toml");
 function stringsOf(value) {
   return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
 }
@@ -16627,9 +16842,9 @@ var CODEX_REPO_CONFIG = {
     const files = [];
     for (const dir of repoLevels(workspace)) {
       for (const name of ["AGENTS.override.md", "AGENTS.md"]) {
-        const text6 = readText(path22.join(dir, name));
+        const text6 = readText(path23.join(dir, name));
         if (text6 === void 0) continue;
-        files.push({ path: path22.relative(workspace, path22.join(dir, name)) || name, text: text6 });
+        files.push({ path: path23.relative(workspace, path23.join(dir, name)) || name, text: text6 });
         break;
       }
     }
@@ -16640,10 +16855,10 @@ var CODEX_REPO_CONFIG = {
     const byName = /* @__PURE__ */ new Map();
     const unreadable = [];
     for (const dir of repoLevels(workspace)) {
-      const file = path22.join(dir, CONFIG_FILE);
+      const file = path23.join(dir, CONFIG_FILE);
       const text6 = readText(file);
       if (text6 === void 0) continue;
-      const source = path22.relative(workspace, file);
+      const source = path23.relative(workspace, file);
       let parsed;
       try {
         parsed = parseToml(text6);
@@ -16663,9 +16878,9 @@ var CODEX_REPO_CONFIG = {
 };
 function untrustedProjects(workspace) {
   const projects = {};
-  for (let dir = path22.resolve(workspace); ; dir = path22.dirname(dir)) {
+  for (let dir = path23.resolve(workspace); ; dir = path23.dirname(dir)) {
     projects[dir] = { trust_level: "untrusted" };
-    if (path22.dirname(dir) === dir) return projects;
+    if (path23.dirname(dir) === dir) return projects;
   }
 }
 
@@ -17786,7 +18001,7 @@ ${this.exitMessage()}`);
       case "webSearch":
         return;
       case "fileChange": {
-        const paths = (item.changes ?? []).map((change) => change.path).filter((path47) => !!path47);
+        const paths = (item.changes ?? []).map((change) => change.path).filter((path48) => !!path48);
         this.fileChangePaths.set(item.id, paths);
         if (this.startOpts?.kind === "task") {
           for (const change of item.changes ?? []) this.announceFileChange(item.id, change, emit, subagentId);
@@ -17889,20 +18104,20 @@ ${this.exitMessage()}`);
   announceFileChange(itemId, change, emit, subagentId) {
     const rows = this.fileChangeRows.get(itemId) ?? /* @__PURE__ */ new Map();
     this.fileChangeRows.set(itemId, rows);
-    const path47 = this.shownChangePath(change);
-    const known = rows.get(path47);
+    const path48 = this.shownChangePath(change);
+    const known = rows.get(path48);
     if (known) return known;
-    const row = rows.size === 0 ? itemId : `${itemId}:${path47}`;
-    rows.set(path47, row);
-    emit({ type: "tool_call", id: row, name: changeName(change), args: { path: path47 }, ...subagentId ? { subagentId } : {} });
+    const row = rows.size === 0 ? itemId : `${itemId}:${path48}`;
+    rows.set(path48, row);
+    emit({ type: "tool_call", id: row, name: changeName(change), args: { path: path48 }, ...subagentId ? { subagentId } : {} });
     return row;
   }
   /** Relative to the task's worktree, where every path but a stray one lies; a move names both ends. */
   shownChangePath(change) {
-    const shown = (path47) => {
+    const shown = (path48) => {
       const cwd = this.startOpts?.cwd;
-      const rel = cwd ? (0, import_path6.relative)(cwd, path47) : path47;
-      return rel && rel !== ".." && !rel.startsWith(`..${import_path6.sep}`) && !(0, import_path6.isAbsolute)(rel) ? rel : path47;
+      const rel = cwd ? (0, import_path6.relative)(cwd, path48) : path48;
+      return rel && rel !== ".." && !rel.startsWith(`..${import_path6.sep}`) && !(0, import_path6.isAbsolute)(rel) ? rel : path48;
     };
     const from = shown(change.path ?? "");
     return change.kind?.move_path ? `${from} \u2192 ${shown(change.kind.move_path)}` : from;
@@ -17953,7 +18168,7 @@ var import_fs12 = require("fs");
 
 // src/services/harness/projectServers.ts
 var import_crypto8 = require("crypto");
-var path23 = __toESM(require("path"));
+var path24 = __toESM(require("path"));
 function canonical2(value) {
   if (Array.isArray(value)) return value.map(canonical2);
   if (!isRecord2(value)) return value;
@@ -17964,7 +18179,7 @@ function projectServerScope(server4) {
   return `mcp-server:${server4.name}@${hash}`;
 }
 var scopeName = (scope) => scope.slice(0, scope.lastIndexOf("@"));
-function fileProjectServerApprovals(file = path23.join(globalDataDir(), "project-mcp-servers.json")) {
+function fileProjectServerApprovals(file = path24.join(globalDataDir(), "project-mcp-servers.json")) {
   const load = () => {
     const text6 = readText(file);
     if (text6 === void 0) return {};
@@ -19127,8 +19342,8 @@ var OpenCodeAdapter = class extends ProcessLifecycle {
       this.v2 = new OpenCodeV2({
         version,
         nativeShell: this.nativeShell?.prefix ?? null,
-        request: (method, path47, body, signal, timeoutMs) => this.request(method, path47, body, signal, timeoutMs),
-        json: (method, path47, body, signal, timeoutMs) => this.json(method, path47, body, signal, timeoutMs),
+        request: (method, path48, body, signal, timeoutMs) => this.request(method, path48, body, signal, timeoutMs),
+        json: (method, path48, body, signal, timeoutMs) => this.json(method, path48, body, signal, timeoutMs),
         openEvents: (signal) => this.deps.fetch(`${this.baseUrl}/api/event`, { signal, headers: this.headers() }),
         processEnded: this.processEnded,
         isExited: () => this.exited,
@@ -19765,15 +19980,15 @@ var OpenCodeAdapter = class extends ProcessLifecycle {
       onActivity
     );
   }
-  async json(method, path47, body, signal, timeoutMs) {
-    const response = await this.request(method, path47, body, signal, timeoutMs);
-    if (!response.ok) throw new OpenCodeHttpError(`${method} ${path47} failed: ${response.status} ${response.statusText}`);
+  async json(method, path48, body, signal, timeoutMs) {
+    const response = await this.request(method, path48, body, signal, timeoutMs);
+    if (!response.ok) throw new OpenCodeHttpError(`${method} ${path48} failed: ${response.status} ${response.statusText}`);
     return await response.json().catch(() => null);
   }
   /** `timeoutMs` null is for a turn's own POST, which the server answers when the turn is done. */
-  request(method, path47, body, signal, timeoutMs = REQUEST_TIMEOUT_MS) {
+  request(method, path48, body, signal, timeoutMs = REQUEST_TIMEOUT_MS) {
     const deadline = withDeadline(signal, timeoutMs);
-    return this.deps.fetch(`${this.baseUrl}${path47}`, {
+    return this.deps.fetch(`${this.baseUrl}${path48}`, {
       method,
       headers: this.headers({ "content-type": "application/json" }),
       ...body === void 0 ? {} : { body: JSON.stringify(body) },
@@ -19834,8 +20049,8 @@ var OpenCodeAdapter = class extends ProcessLifecycle {
 };
 
 // src/services/harness/openCodeRepoConfig.ts
-var path24 = __toESM(require("path"));
-var CONFIG_FILES = ["opencode.json", "opencode.jsonc", path24.join(".opencode", "opencode.json"), path24.join(".opencode", "opencode.jsonc")];
+var path25 = __toESM(require("path"));
+var CONFIG_FILES = ["opencode.json", "opencode.jsonc", path25.join(".opencode", "opencode.json"), path25.join(".opencode", "opencode.jsonc")];
 var INSTRUCTION_NAMES = ["AGENTS.md", "CLAUDE.md", "CONTEXT.md"];
 function server3(name, entry, source) {
   if (!isRecord2(entry)) return "not an object";
@@ -19854,8 +20069,8 @@ var OPENCODE_REPO_CONFIG = {
     const levels = repoLevels(workspace);
     for (const name of INSTRUCTION_NAMES) {
       const files = levels.flatMap((dir) => {
-        const text6 = readText(path24.join(dir, name));
-        return text6 === void 0 ? [] : [{ path: path24.relative(workspace, path24.join(dir, name)) || name, text: text6 }];
+        const text6 = readText(path25.join(dir, name));
+        return text6 === void 0 ? [] : [{ path: path25.relative(workspace, path25.join(dir, name)) || name, text: text6 }];
       });
       if (files.length > 0) return files;
     }
@@ -19867,10 +20082,10 @@ var OPENCODE_REPO_CONFIG = {
     const unreadable = [];
     for (const dir of repoLevels(workspace)) {
       for (const name of CONFIG_FILES) {
-        const file = path24.join(dir, name);
+        const file = path25.join(dir, name);
         const text6 = readText(file);
         if (text6 === void 0) continue;
-        const source = path24.relative(workspace, file);
+        const source = path25.relative(workspace, file);
         let parsed;
         try {
           parsed = parseJsonc(text6);
@@ -20059,7 +20274,7 @@ function knownModelId(value, optionIds, shortcuts) {
 
 // src/services/ModelCatalog.ts
 var fs6 = __toESM(require("fs"));
-var path25 = __toESM(require("path"));
+var path26 = __toESM(require("path"));
 var CACHE_KEY = "model-catalog";
 var CACHE_TTL_MS = 60 * 60 * 1e3;
 function storageKey(baseUrl) {
@@ -20112,7 +20327,7 @@ var ModelCatalog = class {
       const url = (baseUrl || "https://openrouter.ai/api/v1").replace(/\/+$/, "");
       const key = storageKey(url);
       const cacheDir = globalCacheDir();
-      const cacheFile = path25.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
+      const cacheFile = path26.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
       if (fs6.existsSync(cacheFile)) fs6.rmSync(cacheFile);
     } catch {
     }
@@ -20120,7 +20335,7 @@ var ModelCatalog = class {
   static readCache(key) {
     try {
       const cacheDir = globalCacheDir();
-      const cacheFile = path25.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
+      const cacheFile = path26.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
       if (!fs6.existsSync(cacheFile)) return null;
       const raw = fs6.readFileSync(cacheFile, "utf8");
       const data = JSON.parse(raw);
@@ -20134,7 +20349,7 @@ var ModelCatalog = class {
     try {
       const cacheDir = globalCacheDir();
       fs6.mkdirSync(cacheDir, { recursive: true });
-      const cacheFile = path25.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
+      const cacheFile = path26.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
       fs6.writeFileSync(
         cacheFile,
         JSON.stringify({ models, cachedAt: Date.now() }, null, 2)
@@ -20145,15 +20360,17 @@ var ModelCatalog = class {
 };
 
 // src/services/ModelDiscovery.ts
-var path26 = __toESM(require("path"));
+var path27 = __toESM(require("path"));
 var import_child_process6 = require("child_process");
 var import_util2 = require("util");
 var fsSync5 = __toESM(require("fs"));
-var osMod = __toESM(require("os"));
 
 // src/services/harness/appServerModels.ts
 var import_child_process5 = require("child_process");
 var DEFAULT_TIMEOUT_MS3 = 2e4;
+function definedOnly(env) {
+  return Object.fromEntries(Object.entries(env).filter((entry) => entry[1] !== void 0));
+}
 function parseRpcLine(line) {
   try {
     const value = JSON.parse(line);
@@ -20166,10 +20383,9 @@ async function openAppServer(command, args, launch) {
   const runner = new RunnerProcess({
     spawn: import_child_process5.spawn,
     fetch: globalThis.fetch,
-    // The cwd is no workspace: discovery asks for the catalog before one is
-    // chosen, so it pays no direnv round trip before a spawn with a deadline.
-    // The account monitor passes the workspace's environment itself, since
-    // that can choose whose account is read.
+    // The cwd is no workspace, so it pays no direnv round trip before a spawn
+    // with a deadline. Discovery and the account monitor pass the workspace's
+    // environment themselves, since that can choose whose account is read.
     workspaceEnv: async () => ({}),
     ...launch.deps
   });
@@ -20222,7 +20438,11 @@ async function openAppServer(command, args, launch) {
 }
 var APP_SERVER_CLIENT_INFO = { name: "ordewell", title: "Ordewell", version: "0.1.0" };
 async function discoverAppServerModels(command, args, options = {}) {
-  const server4 = await openAppServer(command, args, { cwd: process.cwd(), deps: options.deps });
+  const env = options.env;
+  const server4 = await openAppServer(command, args, {
+    cwd: process.cwd(),
+    deps: { ...env ? { workspaceEnv: async () => definedOnly(env) } : {}, ...options.deps }
+  });
   if (!server4) return null;
   const { rpc } = server4;
   const asked = (async () => {
@@ -20249,10 +20469,10 @@ async function discoverAppServerModels(command, args, options = {}) {
 var execAsync2 = (0, import_util2.promisify)(import_child_process6.exec);
 var defaultExec2 = async (command, options) => {
   const PATH = await augmentedPath();
-  const { stdout } = await execAsync2(command, { ...options, maxBuffer: 32 * 1024 * 1024, env: withPath(process.env, PATH) });
+  const { stdout } = await execAsync2(command, { timeout: options?.timeout, maxBuffer: 32 * 1024 * 1024, env: withPath(options?.env ?? process.env, PATH) });
   return { stdout: String(stdout) };
 };
-var defaultAppServerClient = (command, args, options) => discoverAppServerModels(command, args, { timeout: options?.timeout });
+var defaultAppServerClient = (command, args, options) => discoverAppServerModels(command, args, { timeout: options?.timeout, env: options?.env });
 function effortVariant(effort) {
   return { id: effort, label: effort.charAt(0).toUpperCase() + effort.slice(1) };
 }
@@ -20286,7 +20506,7 @@ function geminiDiscoveryCacheKey(apiKey) {
   return {
     key: `gemini-models:${hash}`,
     dir,
-    file: path26.join(dir, `gemini_models_${hash}.json`)
+    file: path27.join(dir, `gemini_models_${hash}.json`)
   };
 }
 function readGeminiCache(apiKey) {
@@ -20373,15 +20593,22 @@ function applyVariants(models, manifest) {
   if (!variants || variants.length === 0) return models;
   return models.map((m) => m.variants.length > 0 ? m : { ...m, variants });
 }
-function resolveApiAuth(authMethods) {
+function listDir(dir) {
+  try {
+    return fsSync5.readdirSync(dir);
+  } catch {
+    return [];
+  }
+}
+function resolveApiAuth(authMethods, env) {
   for (const method of authMethods) {
     try {
       let token;
       if (method.type === "env") {
-        token = process.env[method.varName];
+        token = env[method.varName];
       } else {
-        const filePath = method.path.replace(/^~/, osMod.homedir());
-        if (!fsSync5.existsSync(filePath)) continue;
+        const filePath = expandRunnerHome(typeof method.path === "function" ? method.path(env) : method.path, env);
+        if (!filePath || !fsSync5.existsSync(filePath)) continue;
         const data = JSON.parse(fsSync5.readFileSync(filePath, "utf8"));
         token = method.jsonPath.split(".").reduce((obj, key) => {
           if (obj && typeof obj === "object") return obj[key];
@@ -20397,8 +20624,8 @@ function resolveApiAuth(authMethods) {
   }
   return null;
 }
-async function discoverFromApi(manifest, config, fetchImpl) {
-  const auth = resolveApiAuth(config.auth);
+async function discoverFromApi(manifest, config, env, fetchImpl) {
+  const auth = resolveApiAuth(config.auth, env);
   if (!auth) return null;
   try {
     const headers = { ...config.headers, [auth.header]: auth.value };
@@ -20414,7 +20641,7 @@ async function discoverFromApi(manifest, config, fetchImpl) {
 function wasKilled(err) {
   return !!err && typeof err === "object" && err.killed === true;
 }
-async function discoverFromCommand(manifest, execImpl) {
+async function discoverFromCommand(manifest, execImpl, env) {
   const discovery = manifest.modelDiscovery;
   const commands = discovery.discoveryCommands ?? [
     { command: discovery.command, args: discovery.args || [], parser: discovery.parser }
@@ -20423,7 +20650,7 @@ async function discoverFromCommand(manifest, execImpl) {
     let timedOut2 = false;
     for (const cmd of commands) {
       try {
-        const { stdout } = await execImpl(`${cmd.command} ${cmd.args.join(" ")}`, { timeout: 45e3 });
+        const { stdout } = await execImpl(`${cmd.command} ${cmd.args.join(" ")}`, { timeout: 45e3, env });
         const models = parseModelOutput(stdout, cmd.parser, manifest);
         if (models.length > 0) return { models: applyVariants(mergeCanonicalAliases(models, manifest), manifest), timedOut: timedOut2 };
       } catch (err) {
@@ -20489,21 +20716,26 @@ var ModelDiscovery = class {
    * same background service.
    */
   inflight = /* @__PURE__ */ new Map();
+  /** Bumped by every `clear()`: a discovery begun before one answers its own lookups but fills no cache. */
+  generation = 0;
   registry;
   execImpl;
   fetchImpl;
   appServerClient;
   readFileImpl;
   now;
-  constructor(registry, execImpl = defaultExec2, fetchImpl, appServerClient = defaultAppServerClient, readFileImpl, now = Date.now) {
+  env;
+  constructor(registry, execImpl = defaultExec2, fetchImpl, appServerClient = defaultAppServerClient, readFileImpl, now = Date.now, env = async () => process.env) {
     this.registry = registry;
     this.execImpl = execImpl;
     this.fetchImpl = fetchImpl;
     this.appServerClient = appServerClient;
     this.now = now;
+    this.env = env;
     this.readFileImpl = readFileImpl ?? ((filePath) => {
       try {
-        return fsSync5.readFileSync(filePath.replace(/^~/, osMod.homedir()), "utf8");
+        const file = expandRunnerHome(filePath);
+        return file ? fsSync5.readFileSync(file, "utf8") : null;
       } catch {
         return null;
       }
@@ -20515,16 +20747,17 @@ var ModelDiscovery = class {
    * null when both fail so `discover()` falls through to the remaining
    * methods.
    */
-  async discoverFromAppServer(manifest) {
+  async discoverFromAppServer(manifest, env) {
     const config = manifest.modelDiscovery.appServer;
     if (!config) return null;
-    const raw = await this.appServerClient(config.command, config.args);
+    const raw = await this.appServerClient(config.command, config.args, { env });
     if (raw) {
       const models = parseAppServerModels(raw);
       if (models.length > 0) return models;
     }
-    if (config.cacheFile) {
-      const content = this.readFileImpl(config.cacheFile);
+    const cacheFile = config.cacheFile && expandRunnerHome(typeof config.cacheFile === "function" ? config.cacheFile(env) : config.cacheFile, env);
+    if (cacheFile) {
+      const content = this.readFileImpl(cacheFile);
       if (content) {
         const models = parseCodexModelsCache(content);
         if (models.length > 0) return models;
@@ -20562,37 +20795,60 @@ var ModelDiscovery = class {
     if (!manifest) {
       return [];
     }
-    let models;
+    const generation2 = this.generation;
+    const env = await this.env().catch(() => process.env);
+    const found = await this.discoverFromSources(manifest, env);
+    const models = this.withSettingsModels(found.models, manifest, env);
+    if (generation2 !== this.generation) return models;
+    if (found.cacheable && models.length > 0) this.cache.set(runner, models);
+    else this.misses.set(runner, { models, at: this.now() });
+    return models;
+  }
+  async discoverFromSources(manifest, env) {
     let cacheable = true;
     const discovery = manifest.modelDiscovery;
     if (discovery.appServer) {
-      const appServerModels = await this.discoverFromAppServer(manifest);
-      if (appServerModels && appServerModels.length > 0) {
-        this.cache.set(runner, appServerModels);
-        return appServerModels;
-      }
+      const appServerModels = await this.discoverFromAppServer(manifest, env);
+      if (appServerModels && appServerModels.length > 0) return { models: appServerModels, cacheable: true };
       cacheable = false;
     }
     if (discovery.apiDiscovery) {
-      const apiModels = await discoverFromApi(manifest, discovery.apiDiscovery, this.fetchImpl);
+      const apiModels = await discoverFromApi(manifest, discovery.apiDiscovery, env, this.fetchImpl);
       if (apiModels && apiModels.length > 0) {
-        models = applyVariants(mergeCanonicalAliases(apiModels, manifest), manifest);
-        if (cacheable && models.length > 0) this.cache.set(runner, models);
-        return models;
+        return { models: applyVariants(mergeCanonicalAliases(apiModels, manifest), manifest), cacheable };
       }
     }
     if (discovery.method === "command" && (discovery.command || discovery.discoveryCommands?.length)) {
-      const result = await discoverFromCommand(manifest, this.execImpl);
-      models = result.models;
-      cacheable = !result.fromFallback;
-    } else {
-      models = buildFallbackModels(manifest);
+      const result = await discoverFromCommand(manifest, this.execImpl, env);
+      return { models: result.models, cacheable: !result.fromFallback };
     }
-    if (cacheable && models.length > 0) this.cache.set(runner, models);
-    else this.misses.set(runner, { models, at: this.now() });
-    return models;
+    return { models: buildFallbackModels(manifest), cacheable };
+  }
+  /**
+   * Append the models registered in the runner's own settings. Read on every
+   * discovery rather than cached apart, so a refresh picks up an edit;
+   * whatever the sources already offer keeps its entry and metadata.
+   */
+  withSettingsModels(models, manifest, env) {
+    const read2 = manifest.modelDiscovery.settingsModels;
+    if (!read2) return models;
+    const files = {
+      read: (filePath) => {
+        const file = expandRunnerHome(filePath, env);
+        return file ? this.readFileImpl(file) : null;
+      },
+      list: (dir) => {
+        const expanded = expandRunnerHome(dir, env);
+        return expanded ? listDir(expanded) : [];
+      },
+      env
+    };
+    const seen = new Set(models.map((m) => m.modelId));
+    const added = read2(files).filter((m) => !seen.has(m.modelId));
+    return added.length > 0 ? [...models, ...applyVariants(added, manifest)] : models;
   }
   clear() {
+    this.generation++;
     this.cache.clear();
     this.misses.clear();
     this.inflight.clear();
@@ -20758,7 +21014,7 @@ function parseMaxParallel(value) {
 
 // src/services/SettingsService.ts
 var fs12 = __toESM(require("fs"));
-var path33 = __toESM(require("path"));
+var path34 = __toESM(require("path"));
 
 // src/utils/fileLock.ts
 var fs7 = __toESM(require("fs"));
@@ -20890,6 +21146,10 @@ var RECEIPT_LABELS = {
 function receiptLabel(task2) {
   return isTaskRunning(task2) && task2.completionReceived ? RECEIPT_LABELS[task2.completionReceived] : null;
 }
+function attachingLabel(task2) {
+  if (!isTaskRunning(task2) || !task2.attaching) return null;
+  return task2.attaching === 2 ? "Connecting Ordewell's tools, retry" : "Connecting Ordewell's tools";
+}
 function approvalLabel(count) {
   if (!count) return null;
   return count > 1 ? `Waiting for approval (${count})` : "Waiting for approval";
@@ -22359,7 +22619,7 @@ function createWakePolicy(options) {
 }
 
 // src/services/runnerExit.ts
-var USAGE_LIMIT_RE = /\b(?:usage|session|weekly|daily|monthly) limit\b|\brate limit (?:exceeded|reached)\b|\brate[- ]limited\b|\blimit (?:will )?reset\b|\bquota (?:exceeded|reached)\b|\btoo many requests\b/i;
+var USAGE_LIMIT_RE = /\b(?:usage|session|weekly|daily|monthly) limit\b|\byou['’]ve hit your (?:[\w'’-]+ ){0,3}?limit\b|\brate limit (?:exceeded|reached)\b|\brate[- ]limited\b|\blimit (?:will )?reset\b|\bquota (?:exceeded|reached)\b|\btoo many requests\b/i;
 var USAGE_LIMIT_TAIL = 4096;
 function classifyRunnerStop(said2) {
   if (typeof said2 !== "string" && said2.usageLimit !== void 0) return said2.usageLimit ? "usage-limit" : "stopped";
@@ -22720,8 +22980,8 @@ function compactionCut(transcript) {
 }
 
 // src/services/skillInvocation.ts
-var os10 = __toESM(require("os"));
-function abbreviateHome(file, home = os10.homedir(), platform = process.platform) {
+var os9 = __toESM(require("os"));
+function abbreviateHome(file, home = os9.homedir(), platform = process.platform) {
   const win = platform === "win32";
   const normal = (p) => win ? p.replace(/\\/g, "/") : p;
   const shown = normal(file);
@@ -22736,13 +22996,13 @@ function modelInvocablePlannerSkills(skills) {
 function modelInvocableTaskSkills(skills) {
   return skills.filter((skill) => skill.appliesTo === "task" && skill.modelInvocable);
 }
-function snapshotSkill(skill, invokedBy, home = os10.homedir()) {
+function snapshotSkill(skill, invokedBy, home = os9.homedir()) {
   return { invokedBy, name: skill.name, source: skill.source, path: abbreviateHome(skill.path, home), content: skill.content };
 }
 function attachSkill(skill, home) {
   return { ...snapshotSkill(skill, "user", home), content: "", attaches: { description: skill.description } };
 }
-function resolveSkillInvocation(text6, skillsService, home = os10.homedir()) {
+function resolveSkillInvocation(text6, skillsService, home = os9.homedir()) {
   const skills = skillTokens(text6).flatMap(({ name }) => {
     const skill = skillsService.findSkill(name);
     if (!skill?.userInvocable) return [];
@@ -22806,33 +23066,33 @@ ${skillBlock(entry.skill)}`, timestamp: entry.timestamp });
 }
 
 // src/services/taskSkills.ts
-var path32 = __toESM(require("path"));
+var path33 = __toESM(require("path"));
 
 // src/services/SkillsService.ts
 var import_crypto12 = require("crypto");
 var fs11 = __toESM(require("fs"));
-var path31 = __toESM(require("path"));
+var path32 = __toESM(require("path"));
 
 // src/services/builtinSkills.ts
-var path27 = __toESM(require("path"));
+var path28 = __toESM(require("path"));
 var import_url = require("url");
 function builtinSkillsDir() {
-  const dir = typeof __dirname !== "undefined" && __dirname ? __dirname : path27.dirname((0, import_url.fileURLToPath)(
+  const dir = typeof __dirname !== "undefined" && __dirname ? __dirname : path28.dirname((0, import_url.fileURLToPath)(
     // @ts-expect-error - import.meta is only valid under an ESM module setting
     __filename
   ));
-  return path27.join(dir, "..", "skills");
+  return path28.join(dir, "..", "skills");
 }
 
 // src/services/repoGroup.ts
 var fs10 = __toESM(require("fs"));
-var path30 = __toESM(require("path"));
+var path31 = __toESM(require("path"));
 
 // src/services/worktreeBootstrap.ts
 var import_child_process8 = require("child_process");
 var import_util4 = require("util");
 var fs9 = __toESM(require("fs"));
-var path29 = __toESM(require("path"));
+var path30 = __toESM(require("path"));
 
 // src/services/gitExec.ts
 var import_child_process7 = require("child_process");
@@ -22914,7 +23174,7 @@ function subcommandOf2(args) {
 
 // src/services/worktreeLink.ts
 var fs8 = __toESM(require("fs"));
-var path28 = __toESM(require("path"));
+var path29 = __toESM(require("path"));
 function linkPath(source, target, platform, hardLink = fs8.linkSync) {
   const isDir = fs8.statSync(source).isDirectory();
   if (platform !== "win32") {
@@ -22939,8 +23199,8 @@ function mirrorDir(source, target, opts) {
   const mirror = (from, to, prefix, top) => {
     fs8.mkdirSync(to, { recursive: true });
     for (const entry of fs8.readdirSync(from, { withFileTypes: true })) {
-      const name = path28.join(prefix, entry.name);
-      const at = { from: path28.join(from, entry.name), to: path28.join(to, entry.name), name };
+      const name = path29.join(prefix, entry.name);
+      const at = { from: path29.join(from, entry.name), to: path29.join(to, entry.name), name };
       if (entry.isSymbolicLink()) links.push(at);
       else if (top && entry.isDirectory() && (entry.name.startsWith("@") || entry.name === ".bin")) mirror(at.from, at.to, name, false);
       else if (linkPath(at.from, at.to, opts.platform, opts.hardLink) === "copy") copied.push(name);
@@ -22960,16 +23220,16 @@ function mirrorDir(source, target, opts) {
 }
 function relink(from, to, opts) {
   const text6 = fs8.readlinkSync(from);
-  const pointee = path28.isAbsolute(text6) ? rebased(text6, opts) : text6;
+  const pointee = path29.isAbsolute(text6) ? rebased(text6, opts) : text6;
   if (opts.platform !== "win32") {
-    if (!fs8.existsSync(path28.resolve(path28.dirname(to), pointee)) && fs8.existsSync(path28.resolve(path28.dirname(from), pointee))) {
-      fs8.symlinkSync(rebased(path28.resolve(path28.dirname(from), pointee), opts), to);
+    if (!fs8.existsSync(path29.resolve(path29.dirname(to), pointee)) && fs8.existsSync(path29.resolve(path29.dirname(from), pointee))) {
+      fs8.symlinkSync(rebased(path29.resolve(path29.dirname(from), pointee), opts), to);
       return "symlink";
     }
     fs8.symlinkSync(pointee, to);
     return "symlink";
   }
-  const resolved = fs8.existsSync(path28.resolve(path28.dirname(to), pointee)) ? path28.resolve(path28.dirname(to), pointee) : rebased(path28.resolve(path28.dirname(from), pointee), opts);
+  const resolved = fs8.existsSync(path29.resolve(path29.dirname(to), pointee)) ? path29.resolve(path29.dirname(to), pointee) : rebased(path29.resolve(path29.dirname(from), pointee), opts);
   try {
     fs8.statSync(resolved);
   } catch {
@@ -22978,9 +23238,9 @@ function relink(from, to, opts) {
   return linkPath(resolved, to, opts.platform, opts.hardLink);
 }
 function rebased(pointee, opts) {
-  const rel = path28.relative(opts.from, pointee);
-  const inside2 = rel !== "" && !rel.startsWith("..") && !path28.isAbsolute(rel);
-  return inside2 && !rel.split(/[\\/]/).includes("node_modules") ? path28.join(opts.to, rel) : pointee;
+  const rel = path29.relative(opts.from, pointee);
+  const inside2 = rel !== "" && !rel.startsWith("..") && !path29.isAbsolute(rel);
+  return inside2 && !rel.split(/[\\/]/).includes("node_modules") ? path29.join(opts.to, rel) : pointee;
 }
 
 // src/services/worktreeBootstrap.ts
@@ -22997,7 +23257,7 @@ function lexists(target) {
     return false;
   }
 }
-function listDir(dir) {
+function listDir2(dir) {
   try {
     return fs9.readdirSync(dir).sort();
   } catch {
@@ -23017,18 +23277,18 @@ function matchLinks(root, patterns) {
 }
 function segmentMatches(root, base, segment) {
   const under = (name) => base ? `${base}/${name}` : name;
-  if (!/[*?]/.test(segment)) return lexists(path29.join(root, base, segment)) ? [under(segment)] : [];
+  if (!/[*?]/.test(segment)) return lexists(path30.join(root, base, segment)) ? [under(segment)] : [];
   const pattern = new RegExp(`^${segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`);
-  return listDir(path29.join(root, base)).filter((name) => !NEVER_SCANNED.has(name) && pattern.test(name)).map(under);
+  return listDir2(path30.join(root, base)).filter((name) => !NEVER_SCANNED.has(name) && pattern.test(name)).map(under);
 }
 function installDirs(root) {
   const packages = matchLinks(root, workspaceGlobs(root)).map((pkg) => `${pkg}/node_modules`);
-  return ["node_modules", ...packages].filter((dir) => lexists(path29.join(root, dir)));
+  return ["node_modules", ...packages].filter((dir) => lexists(path30.join(root, dir)));
 }
 function workspaceGlobs(root) {
   let manifest;
   try {
-    manifest = JSON.parse(fs9.readFileSync(path29.join(root, "package.json"), "utf8"));
+    manifest = JSON.parse(fs9.readFileSync(path30.join(root, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -23043,19 +23303,19 @@ async function bootstrap(repo, cwd, opts) {
   const linked = [];
   const copied = [];
   const link = (name) => {
-    const target = path29.join(cwd, name);
+    const target = path30.join(cwd, name);
     if (lexists(target)) return;
-    fs9.mkdirSync(path29.dirname(target), { recursive: true });
-    if (linkPath(path29.join(repo.root, name), target, opts.platform) === "copy") copied.push(name);
+    fs9.mkdirSync(path30.dirname(target), { recursive: true });
+    if (linkPath(path30.join(repo.root, name), target, opts.platform) === "copy") copied.push(name);
     linked.push(name);
   };
   const mirror = (name) => {
-    const target = path29.join(cwd, name);
-    if (lexists(target) || !fs9.existsSync(path29.dirname(target))) return;
-    const source = path29.join(repo.root, name);
+    const target = path30.join(cwd, name);
+    if (lexists(target) || !fs9.existsSync(path30.dirname(target))) return;
+    const source = path30.join(repo.root, name);
     if (!fs9.lstatSync(source).isDirectory()) return link(name);
     const mirrored = mirrorDir(source, target, { platform: opts.platform, from: repo.root, to: cwd });
-    copied.push(...mirrored.map((entry) => path29.join(name, entry)));
+    copied.push(...mirrored.map((entry) => path30.join(name, entry)));
     linked.push(name);
   };
   if (!setup) {
@@ -23090,12 +23350,12 @@ async function runSetup(command, repo, cwd, resolvePath) {
 
 // src/services/repoGroup.ts
 function hasGitEntry(dir) {
-  return fs10.existsSync(path30.join(dir, ".git"));
+  return fs10.existsSync(path31.join(dir, ".git"));
 }
 function groupPathOf(listed3) {
   const slashed = listed3.trim().replace(/\\/g, "/");
-  if (path30.posix.isAbsolute(slashed) || path30.win32.isAbsolute(slashed)) return null;
-  const rel = path30.posix.normalize(slashed).replace(/\/+$/, "");
+  if (path31.posix.isAbsolute(slashed) || path31.win32.isAbsolute(slashed)) return null;
+  const rel = path31.posix.normalize(slashed).replace(/\/+$/, "");
   return rel === "" || rel === "." || rel === ".." || rel.startsWith("../") ? null : rel;
 }
 function childDirs(dir) {
@@ -23106,14 +23366,14 @@ function childDirs(dir) {
   }
 }
 function groupPaths(workspaceRoot, listed3) {
-  if (listed3.length === 0) return childDirs(workspaceRoot).filter((name) => hasGitEntry(path30.join(workspaceRoot, name)));
-  const paths = listed3.map(groupPathOf).filter((rel) => rel !== null && hasGitEntry(path30.join(workspaceRoot, rel)));
+  if (listed3.length === 0) return childDirs(workspaceRoot).filter((name) => hasGitEntry(path31.join(workspaceRoot, name)));
+  const paths = listed3.map(groupPathOf).filter((rel) => rel !== null && hasGitEntry(path31.join(workspaceRoot, rel)));
   return [...new Set(paths)].sort();
 }
 function workspaceRepoGroup(workspaceRoot, listed3) {
-  for (let dir = path30.resolve(workspaceRoot); ; dir = path30.dirname(dir)) {
+  for (let dir = path31.resolve(workspaceRoot); ; dir = path31.dirname(dir)) {
     if (hasGitEntry(dir)) return [SELF_REPO];
-    if (path30.dirname(dir) === dir) break;
+    if (path31.dirname(dir) === dir) break;
   }
   return groupPaths(workspaceRoot, listed3);
 }
@@ -23194,8 +23454,8 @@ function copyDirSync(src, dest) {
   fs11.mkdirSync(dest, { recursive: true });
   const entries = fs11.readdirSync(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = path31.join(src, entry.name);
-    const destPath = path31.join(dest, entry.name);
+    const srcPath = path32.join(src, entry.name);
+    const destPath = path32.join(dest, entry.name);
     if (entry.isDirectory()) copyDirSync(srcPath, destPath);
     else fs11.copyFileSync(srcPath, destPath);
   }
@@ -23219,7 +23479,7 @@ function readDir(dir, source) {
   if (!fs11.existsSync(dir)) return { skills, invalid };
   for (const entry of fs11.readdirSync(dir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const skillFile = path31.join(dir, entry.name, "SKILL.md");
+    const skillFile = path32.join(dir, entry.name, "SKILL.md");
     if (!fs11.existsSync(skillFile)) continue;
     if (!isSkillName(entry.name)) {
       invalid.push({ name: entry.name, path: skillFile, source, reason: INVALID_SKILL_NAME_REASON });
@@ -23238,15 +23498,15 @@ function skillFileIn(dir, name) {
     return void 0;
   }
   if (!entries.some((entry) => entry.isDirectory() && entry.name === name)) return void 0;
-  const skillFile = path31.join(dir, name, "SKILL.md");
+  const skillFile = path32.join(dir, name, "SKILL.md");
   return fs11.existsSync(skillFile) ? skillFile : void 0;
 }
 function skillsDirOf(root) {
-  return path31.join(root, STATE_DIR, "skills");
+  return path32.join(root, STATE_DIR, "skills");
 }
 function workspaceSkillRoots(workspaceRoot, repos, checkout = workspaceRoot) {
   if (repos.length === 0 || repos.includes(SELF_REPO)) return [checkout];
-  return [workspaceRoot, ...repos.map((repo) => path31.join(checkout, repo))];
+  return [workspaceRoot, ...repos.map((repo) => path32.join(checkout, repo))];
 }
 var SkillsService = class _SkillsService {
   workspaceRoots;
@@ -23269,11 +23529,11 @@ var SkillsService = class _SkillsService {
     return this.workspaceRoots.map(skillsDirOf);
   }
   globalDir() {
-    return path31.join(globalDataDir(), "skills");
+    return path32.join(globalDataDir(), "skills");
   }
   readSeedManifest() {
     try {
-      const parsed = JSON.parse(fs11.readFileSync(path31.join(this.globalDir(), SEED_MANIFEST), "utf8"));
+      const parsed = JSON.parse(fs11.readFileSync(path32.join(this.globalDir(), SEED_MANIFEST), "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         return Object.fromEntries(
           Object.entries(parsed).filter((entry) => typeof entry[1] === "string")
@@ -23289,7 +23549,7 @@ var SkillsService = class _SkillsService {
     manifest[name] = hash;
     try {
       fs11.mkdirSync(this.globalDir(), { recursive: true });
-      fs11.writeFileSync(path31.join(this.globalDir(), SEED_MANIFEST), JSON.stringify(manifest, null, 2));
+      fs11.writeFileSync(path32.join(this.globalDir(), SEED_MANIFEST), JSON.stringify(manifest, null, 2));
     } catch (err) {
       console.warn(`Could not record seeded skill ${name}: ${String(err)}`);
     }
@@ -23300,11 +23560,11 @@ var SkillsService = class _SkillsService {
     return this.readSeedManifest()[name] === currentHash || (PRIOR_BUILTIN_HASHES[name] ?? []).includes(currentHash);
   }
   seed(name) {
-    const dest = path31.join(this.globalDir(), name);
+    const dest = path32.join(this.globalDir(), name);
     const exists = fs11.existsSync(dest);
     let srcDir;
     try {
-      srcDir = path31.join(builtinSkillsDir(), name);
+      srcDir = path32.join(builtinSkillsDir(), name);
     } catch (err) {
       if (!exists) console.warn(`Could not locate built-in skills dir: ${String(err)}`);
       return false;
@@ -23313,9 +23573,9 @@ var SkillsService = class _SkillsService {
       if (!exists) console.warn(`Built-in skill not found in package: ${name}`);
       return false;
     }
-    const srcHash = fileHash(path31.join(srcDir, "SKILL.md"));
+    const srcHash = fileHash(path32.join(srcDir, "SKILL.md"));
     if (exists) {
-      const currentHash = fileHash(path31.join(dest, "SKILL.md"));
+      const currentHash = fileHash(path32.join(dest, "SKILL.md"));
       if (currentHash !== void 0 && currentHash === srcHash) {
         this.recordSeed(name, currentHash);
         return false;
@@ -23359,7 +23619,7 @@ var SkillsService = class _SkillsService {
     if (entries.length !== 1 || entries[0].name !== "SKILL.md" || !entries[0].isFile()) return false;
     let raw;
     try {
-      raw = readSkillText(path31.join(dir, "SKILL.md"));
+      raw = readSkillText(path32.join(dir, "SKILL.md"));
     } catch {
       return false;
     }
@@ -23367,7 +23627,7 @@ var SkillsService = class _SkillsService {
   }
   pruneRetired() {
     for (const name of RETIRED_BUILTIN_SKILL_NAMES) {
-      const dest = path31.join(this.globalDir(), name);
+      const dest = path32.join(this.globalDir(), name);
       if (!fs11.existsSync(dest)) continue;
       if (!this.isUnmodifiedRetiredSeed(dest, name)) continue;
       try {
@@ -23505,12 +23765,12 @@ var runGit = execFileWithTimeout(1e4);
 async function committedInHead(files) {
   const byDir = /* @__PURE__ */ new Map();
   for (const file of new Set(files)) {
-    const dir = path32.dirname(path32.dirname(file));
+    const dir = path33.dirname(path33.dirname(file));
     byDir.set(dir, [...byDir.get(dir) ?? [], file]);
   }
   const result = /* @__PURE__ */ new Map();
   await Promise.all([...byDir].map(async ([dir, inDir]) => {
-    const relative17 = (file) => path32.relative(dir, file).split(path32.sep).join("/");
+    const relative17 = (file) => path33.relative(dir, file).split(path33.sep).join("/");
     try {
       const { stdout } = await runGit("git", ["ls-tree", "--name-only", "HEAD", "--", ...inDir.map(relative17)], { cwd: dir, env: cleanEnv() });
       const listed3 = new Set(stdout.split("\n").map((line) => line.trim()).filter(Boolean));
@@ -23530,9 +23790,9 @@ function plannedSkillLookup(skillsAt, workspaceRoot, layout) {
     searchedDirs: () => lookup2.searchedDirs(),
     listSkills: () => lookup2.listSkills(),
     uncommitted: async (skills) => {
-      const checked = skills.filter((skill) => skill.source === "workspace" && !(readInPlace && path32.dirname(path32.dirname(skill.path)) === readInPlace));
+      const checked = skills.filter((skill) => skill.source === "workspace" && !(readInPlace && path33.dirname(path33.dirname(skill.path)) === readInPlace));
       const committed = await committedInHead(checked.map((skill) => skill.path));
-      return new Map(checked.filter((skill) => committed.get(skill.path) === false).map((skill) => [skill.path, path32.relative(workspaceRoot, path32.dirname(skill.path)).split(path32.sep).join("/")]));
+      return new Map(checked.filter((skill) => committed.get(skill.path) === false).map((skill) => [skill.path, path33.relative(workspaceRoot, path33.dirname(skill.path)).split(path33.sep).join("/")]));
     }
   };
 }
@@ -23545,13 +23805,13 @@ function checkPlanSkills(tasks, lookup2) {
 function checkTaskSkillsEdit(task2, skills, lookup2) {
   return check([{ taskId: task2.id, owner: `Task "${task2.title}"`, ...attached(skills) }], lookup2);
 }
-function subtaskEntries(op, spec, path47 = []) {
+function subtaskEntries(op, spec, path48 = []) {
   const subtasks = spec?.subtasks;
   if (!Array.isArray(subtasks)) return [];
   return subtasks.flatMap((sub, i) => {
     if (typeof sub !== "object" || sub === null) return [];
     const child = sub;
-    const at = [...path47, typeof child.title === "string" && child.title.trim() ? `"${child.title}"` : `#${i + 1}`];
+    const at = [...path48, typeof child.title === "string" && child.title.trim() ? `"${child.title}"` : `#${i + 1}`];
     return [{ op, owner: `subtask ${at.join(" > ")}`, ...attached(child.skills) }, ...subtaskEntries(op, child, at)];
   });
 }
@@ -27421,7 +27681,7 @@ var RUN_SETTING_KEYS = Object.keys(RUN_SETTING_CHECKS);
 function getSettingsPath() {
   const override = process.env.ORDEWELL_SETTINGS_PATH;
   if (override && override.trim()) return override.trim();
-  return path33.join(globalDataDir(), "settings.json");
+  return path34.join(globalDataDir(), "settings.json");
 }
 function readPlannerModels(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
@@ -27501,8 +27761,8 @@ var SettingsService = class {
    * a watch on the old one pointing at nothing.
    */
   watch(listener) {
-    const dir = path33.dirname(this.filePath);
-    const name = path33.basename(this.filePath);
+    const dir = path34.dirname(this.filePath);
+    const name = path34.basename(this.filePath);
     let seen = this.fileStamp();
     let timer;
     let dead = false;
@@ -27511,7 +27771,7 @@ var SettingsService = class {
       fs12.mkdirSync(dir, { recursive: true });
       watcher = fs12.watch(dir, (_event, changed) => {
         if (dead) return;
-        if (changed && changed !== name && changed !== path33.basename(dir)) return;
+        if (changed && changed !== name && changed !== path34.basename(dir)) return;
         clearTimeout(timer);
         timer = setTimeout(() => {
           const stamp2 = this.fileStamp();
@@ -27744,7 +28004,7 @@ var SettingsService = class {
     if (this.unreadable) {
       throw new Error(`Cannot save settings: ${this.filePath} could not be read, so it will not be overwritten. Fix or remove it and try again.`);
     }
-    const dir = path33.dirname(this.filePath);
+    const dir = path34.dirname(this.filePath);
     if (!fs12.existsSync(dir)) {
       fs12.mkdirSync(dir, { recursive: true });
     }
@@ -28188,7 +28448,7 @@ var BaseConfig = class {
     const { model, effort, override = "" } = configured;
     const named3 = isPlannerBackend(configured.setting ?? "") || isPlannerBackend(process.env.AI_PROVIDER ?? "");
     const pickedElsewhere = configured.pickedFor !== void 0 && configured.pickedFor !== provider;
-    const kept = configured.pickedFor === provider || !pickedElsewhere && (isApiProvider(provider) || named3 && !isForeignModel(provider, model, this.agentCatalog(provider)));
+    const kept = configured.pickedFor === provider || !pickedElsewhere && (isApiProvider(provider) || named3 && !isForeignModel(provider, model, () => this.agentCatalog(provider)));
     if (kept) return { model: override || model, effort, source: override ? "request" : "configured" };
     const own = pickedElsewhere || named3 ? rememberedOrDefault(provider) : detectedAgentChoice(provider, configured);
     return !override || override === own.model ? own : { model: override, effort: "", source: "request" };
@@ -28197,7 +28457,8 @@ var BaseConfig = class {
    * The model ids a coding agent was last discovered serving, empty while
    * discovery is cold. A host that holds a runner catalog supplies it: it is
    * the only evidence that tells OpenCode's `provider/model` ids from an
-   * OpenRouter slug.
+   * OpenRouter slug. Asked only when a named agent's configured model is
+   * neither its alias nor its remembered pick.
    */
   agentCatalog(_provider) {
     return [];
@@ -28222,8 +28483,10 @@ function isVendorModelFor(agent, model) {
   return !discoveryOf(agent)?.providerQualifiedIds && SLUG_SHAPE.test(model);
 }
 function isForeignModel(agent, model, catalog) {
-  if (!model || isStableAlias(agent, model) || catalog.includes(model) || rememberedChoice(agent)?.model === model) return false;
-  return isVendorModelFor(agent, model) || catalog.length > 0 && SLUG_SHAPE.test(model);
+  if (!model || isStableAlias(agent, model) || rememberedChoice(agent)?.model === model) return false;
+  const listed3 = catalog();
+  if (listed3.includes(model)) return false;
+  return isVendorModelFor(agent, model) || listed3.length > 0 && SLUG_SHAPE.test(model);
 }
 function rememberedChoice(provider) {
   const entry = new SettingsService().getPlannerModel(provider);
@@ -28343,11 +28606,11 @@ function mergeOutcome(result, branch, group, repaired = []) {
 // src/services/taskDiffRead.ts
 var import_crypto13 = require("crypto");
 var fs13 = __toESM(require("fs"));
-var path34 = __toESM(require("path"));
+var path35 = __toESM(require("path"));
 var import_os3 = require("os");
 var TASK_DIFF_UNAVAILABLE = "Task diff is not available for this run: no task-specific changes were recorded (shared runs cannot attribute workspace changes to one task).";
 function allowedPath(file) {
-  return file.length > 0 && !path34.isAbsolute(file) && !/^[A-Za-z]:/.test(file) && !file.split(/[\\/]/).some((part) => part === ".." || part === ".git" || part === ".ordewell");
+  return file.length > 0 && !path35.isAbsolute(file) && !/^[A-Za-z]:/.test(file) && !file.split(/[\\/]/).some((part) => part === ".." || part === ".git" || part === ".ordewell");
 }
 function stats(raw) {
   return raw.split("\0").flatMap((row) => {
@@ -28356,8 +28619,8 @@ function stats(raw) {
   });
 }
 function inside(root, target) {
-  const rel = path34.relative(root, target);
-  return rel === "" || !rel.startsWith(`..${path34.sep}`) && rel !== ".." && !path34.isAbsolute(rel);
+  const rel = path35.relative(root, target);
+  return rel === "" || !rel.startsWith(`..${path35.sep}`) && rel !== ".." && !path35.isAbsolute(rel);
 }
 function unquoted(quoted4) {
   const bytes = [];
@@ -28405,10 +28668,10 @@ function patchFiles(patch) {
   const sections = patch.toString("utf8").split(/(?<![^\n])(?=diff --git )/).filter((section) => section.startsWith("diff --git "));
   const files = /* @__PURE__ */ new Map();
   for (const section of sections) {
-    const path47 = sectionPath(section);
+    const path48 = sectionPath(section);
     const counts = sectionStats(section);
-    const earlier = files.get(path47);
-    files.set(path47, earlier ? { path: path47, section: earlier.section + section, added: summed(earlier.added, counts.added), removed: summed(earlier.removed, counts.removed) } : { path: path47, section, ...counts });
+    const earlier = files.get(path48);
+    files.set(path48, earlier ? { path: path48, section: earlier.section + section, added: summed(earlier.added, counts.added), removed: summed(earlier.removed, counts.removed) } : { path: path48, section, ...counts });
   }
   return [...files.values()];
 }
@@ -28478,11 +28741,11 @@ async function readTaskDiff(invoker, run, taskId, options) {
         files.push({ ...file, repo: repo.path, patch: () => git(reader, cwd, [...diffArgs, "--", `:(top,literal)${prefix}${file.path}`]) });
       }
       if (live3) {
-        const workspace = path34.join(entry.worktree, prefix);
+        const workspace = path35.join(entry.worktree, prefix);
         const others = await git(reader, workspace, [...common, "ls-files", "--others", "--exclude-standard", "-z", "--", "."]);
         for (const file of others.split("\0").filter((f) => allowed(f))) {
-          const full = path34.join(workspace, file);
-          if (!inside(fs13.realpathSync(workspace), fs13.realpathSync(path34.dirname(full)))) continue;
+          const full = path35.join(workspace, file);
+          if (!inside(fs13.realpathSync(workspace), fs13.realpathSync(path35.dirname(full)))) continue;
           const untracked = async (numstat) => {
             const result = await tryGit(reader, workspace, [...common, "diff", "--no-index", "--no-renames", "--no-ext-diff", "--no-textconv", ...numstat ? ["--numstat", "-z"] : [], "--", import_os3.devNull, file]);
             if (!result.ok && result.code !== 1) throw new Error(result.stderr.trim() || "Could not read an untracked file diff.");
@@ -28512,11 +28775,11 @@ ${await file.patch()}`);
 var import_crypto14 = require("crypto");
 var import_child_process9 = require("child_process");
 var fs15 = __toESM(require("fs"));
-var path36 = __toESM(require("path"));
+var path37 = __toESM(require("path"));
 
 // src/utils/prdStore.ts
 var fs14 = __toESM(require("fs"));
-var path35 = __toESM(require("path"));
+var path36 = __toESM(require("path"));
 var PRD_BLOCK_RE = /<!--\s*ORDEWELL_PRD_START\s+slug="([^"]+)"\s*-->\s*([\s\S]*?)\s*<!--\s*ORDEWELL_PRD_END\s*-->/;
 function extractPrdBlock(text6) {
   const match = PRD_BLOCK_RE.exec(text6);
@@ -28530,9 +28793,9 @@ function sanitizeSlug(raw) {
   return raw.toLowerCase().replace(/[^a-z0-9-_]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 }
 function savePrdMarkdown(workspace, slug, markdown) {
-  const dir = path35.join(workspace, ".scratch", sanitizeSlug(slug));
+  const dir = path36.join(workspace, ".scratch", sanitizeSlug(slug));
   fs14.mkdirSync(dir, { recursive: true });
-  const file = path35.join(dir, "PRD.md");
+  const file = path36.join(dir, "PRD.md");
   fs14.writeFileSync(file, markdown.endsWith("\n") ? markdown : markdown + "\n", "utf8");
   return file;
 }
@@ -28564,12 +28827,12 @@ var NESTED_REPO_DEPTH = 2;
 var GITLINK_MODE = "160000";
 var READ_ONLY = ["--no-optional-locks", "-c", "core.fsmonitor=false"];
 function isInside(parent, child) {
-  const rel = path36.relative(parent, child);
-  return rel !== "" && !rel.startsWith("..") && !path36.isAbsolute(rel);
+  const rel = path37.relative(parent, child);
+  return rel !== "" && !rel.startsWith("..") && !path37.isAbsolute(rel);
 }
 function resolvesAsNamed(base, p) {
   try {
-    return fs15.realpathSync(p) === path36.join(fs15.realpathSync(base), path36.relative(base, p));
+    return fs15.realpathSync(p) === path37.join(fs15.realpathSync(base), path37.relative(base, p));
   } catch {
     return false;
   }
@@ -28624,7 +28887,7 @@ function sameDir(a, b) {
     try {
       return fs15.realpathSync.native(p);
     } catch {
-      return path36.resolve(p);
+      return path37.resolve(p);
     }
   };
   return real(a) === real(b);
@@ -28646,7 +28909,7 @@ function clearImmutableFlags(platform, dir) {
   (0, import_child_process9.spawnSync)("/usr/bin/chflags", ["-R", "nouchg", dir], { stdio: "ignore" });
 }
 function leftoverLinks(dir) {
-  const named3 = listDir(dir).filter((name) => LINKED_ARTIFACTS.has(name) || isEnvFile(name) || isLink(path36.join(dir, name)));
+  const named3 = listDir2(dir).filter((name) => LINKED_ARTIFACTS.has(name) || isEnvFile(name) || isLink(path37.join(dir, name)));
   return [.../* @__PURE__ */ new Set([...named3, ...installDirs(dir)])];
 }
 function isLink(target) {
@@ -28719,7 +28982,7 @@ var GitWorktreeIsolation = class {
       const head = await this.headOf(root);
       const repo = { path: repoPath, head };
       if (scan.toplevel !== void 0) {
-        const top = path36.relative(workspaceRoot, scan.toplevel).split(path36.sep).join("/");
+        const top = path37.relative(workspaceRoot, scan.toplevel).split(path37.sep).join("/");
         if (top !== "") repo.top = top;
       }
       if (enabled && (head.kind === "branch" || head.kind === "detached")) {
@@ -28776,9 +29039,9 @@ var GitWorktreeIsolation = class {
   async nestedRepos(workspaceRoot, toplevel) {
     const found = [];
     const walk = (rel, depth) => {
-      for (const name of childDirs(path36.join(workspaceRoot, rel))) {
+      for (const name of childDirs(path37.join(workspaceRoot, rel))) {
         const child = rel ? `${rel}/${name}` : name;
-        if (hasGitEntry(path36.join(workspaceRoot, child))) found.push(child);
+        if (hasGitEntry(path37.join(workspaceRoot, child))) found.push(child);
         else if (depth < NESTED_REPO_DEPTH) walk(child, depth + 1);
       }
     };
@@ -28796,7 +29059,7 @@ var GitWorktreeIsolation = class {
       const [meta, file] = entry.split("	");
       if (file !== void 0 && meta.startsWith(`${GITLINK_MODE} `)) paths.add(file);
     }
-    const declared = await this.tryGit(workspaceRoot, ["config", "-z", "-f", path36.join(toplevel, ".gitmodules"), "--get-regexp", "^submodule\\..*\\.path$"]);
+    const declared = await this.tryGit(workspaceRoot, ["config", "-z", "-f", path37.join(toplevel, ".gitmodules"), "--get-regexp", "^submodule\\..*\\.path$"]);
     for (const entry of declared.stdout.split("\0")) {
       const value = entry.split("\n")[1];
       if (value) paths.add(value.replace(/\/+$/, ""));
@@ -28854,7 +29117,7 @@ var GitWorktreeIsolation = class {
   async acceptsWorktree(run, repo) {
     const dir = this.integrationDir(run, repo);
     ensureStateDirIgnored(run.workspaceRoot);
-    fs15.mkdirSync(path36.dirname(dir), { recursive: true });
+    fs15.mkdirSync(path37.dirname(dir), { recursive: true });
     const added = await this.tryGit(repo.root, ["worktree", "add", "-q", "--no-checkout", dir, repo.integrationBranch]);
     await this.removeWorktreeDir(run, repo, dir, []);
     return added.ok;
@@ -28869,12 +29132,12 @@ var GitWorktreeIsolation = class {
     if (isolated.includes(SELF_REPO)) return [];
     const shared2 = [];
     const walk = (rel) => {
-      for (const name of listDir(path36.join(workspaceRoot, rel))) {
+      for (const name of listDir2(path37.join(workspaceRoot, rel))) {
         if (!rel && (name === STATE_DIR || name === ".git")) continue;
         const child = rel ? `${rel}/${name}` : name;
         if (isolated.includes(child)) continue;
         if (isolated.some((p) => p.startsWith(`${child}/`))) walk(child);
-        else if (resolves(path36.join(workspaceRoot, child))) shared2.push(child);
+        else if (resolves(path37.join(workspaceRoot, child))) shared2.push(child);
       }
     };
     walk("");
@@ -28914,9 +29177,9 @@ var GitWorktreeIsolation = class {
       try {
         ensureStateDirIgnored(run.workspaceRoot);
         for (const repo of run.repos) {
-          const worktree = path36.join(dir, repo.path);
+          const worktree = path37.join(dir, repo.path);
           const tip = (await this.git(repo.root, ["rev-parse", repo.integrationBranch])).trim();
-          fs15.mkdirSync(path36.dirname(worktree), { recursive: true });
+          fs15.mkdirSync(path37.dirname(worktree), { recursive: true });
           await this.git(repo.root, ["worktree", "add", "-q", "-B", branch, worktree, tip]);
           record.repos[repo.path] = { worktree, linked: [], baseRef: tip };
         }
@@ -28941,13 +29204,13 @@ var GitWorktreeIsolation = class {
             setupFailed.push({ repo: repo.path, detail: err.detail });
           }
           entry.linked = boot.linked;
-          copied.push(...boot.copied.map((name) => path36.posix.join(repo.path, name)));
+          copied.push(...boot.copied.map((name) => path37.posix.join(repo.path, name)));
         }
         for (const rel of run.shared) {
-          const source = path36.join(run.workspaceRoot, rel);
-          const target = path36.join(cwd, rel);
+          const source = path37.join(run.workspaceRoot, rel);
+          const target = path37.join(cwd, rel);
           if (!resolves(source) || lexists(target)) continue;
-          fs15.mkdirSync(path36.dirname(target), { recursive: true });
+          fs15.mkdirSync(path37.dirname(target), { recursive: true });
           if (linkPath(source, target, this.platform) === "copy") copied.push(rel);
           const entry = self ? record.repos[SELF_REPO] : void 0;
           if (entry) entry.linked.push(rel);
@@ -28979,7 +29242,7 @@ var GitWorktreeIsolation = class {
    */
   async clearLeftovers(run, task2, names) {
     const removal = noRemoval();
-    const holder = Object.values(run.tasks).find((r) => r.taskId !== task2.id && (r.branch === names.branch || path36.resolve(r.workspace) === path36.resolve(names.dir) || isInside(r.workspace, names.dir)));
+    const holder = Object.values(run.tasks).find((r) => r.taskId !== task2.id && (r.branch === names.branch || path37.resolve(r.workspace) === path37.resolve(names.dir) || isInside(r.workspace, names.dir)));
     if (holder) throw new Error(`Its worktree path or branch is held by the record of task ${holder.order} (${holder.title}); Ordewell will not remove it`);
     const found = [];
     for (const repo of run.repos) {
@@ -28989,14 +29252,14 @@ var GitWorktreeIsolation = class {
         worktree: /^worktree (.+)$/m.exec(block)?.[1],
         branch: /^branch refs\/heads\/(.+)$/m.exec(block)?.[1]
       }));
-      const at = /* @__PURE__ */ new Set([path36.join(names.dir, repo.path)]);
+      const at = /* @__PURE__ */ new Set([path37.join(names.dir, repo.path)]);
       for (const entry of registered) {
-        if (entry.worktree && entry.branch === names.branch && isInside(this.runRoot(run), path36.resolve(entry.worktree))) at.add(entry.worktree);
+        if (entry.worktree && entry.branch === names.branch && isInside(this.runRoot(run), path37.resolve(entry.worktree))) at.add(entry.worktree);
       }
-      const base = { branch: names.branch, name: path36.basename(names.dir), title: task2.title };
+      const base = { branch: names.branch, name: path37.basename(names.dir), title: task2.title };
       for (const worktree of at) {
         if (!fs15.existsSync(worktree)) continue;
-        const linked = leftoverLinks(path36.join(worktree, await this.prefixOf(repo)));
+        const linked = leftoverLinks(path37.join(worktree, await this.prefixOf(repo)));
         found.push({ repo, worktree, target: { ...base, worktree, linked } });
       }
       found.push({ repo, worktree: names.dir, target: { ...base, linked: [] } });
@@ -29089,7 +29352,7 @@ var GitWorktreeIsolation = class {
    */
   async inWorkspacePlace(repo, worktree) {
     const prefix = await this.prefixOf(repo);
-    return prefix ? path36.join(worktree, prefix) : worktree;
+    return prefix ? path37.join(worktree, prefix) : worktree;
   }
   async prefixOf(repo) {
     return (await this.git(repo.root, ["rev-parse", "--show-prefix"])).trim();
@@ -29619,15 +29882,15 @@ var GitWorktreeIsolation = class {
     return landingMessage(kind, from, this.deps.plannedWith?.() ?? false);
   }
   integrationDir(run, repo) {
-    return path36.join(this.runRoot(run), INTEGRATION_DIR, repo.path);
+    return path37.join(this.runRoot(run), INTEGRATION_DIR, repo.path);
   }
   async ensureIntegrationWorktree(run, repo) {
     return this.admin(run.workspaceRoot, async () => {
       const dir = this.integrationDir(run, repo);
-      if (fs15.existsSync(path36.join(dir, ".git"))) return dir;
+      if (fs15.existsSync(path37.join(dir, ".git"))) return dir;
       await this.tryGit(repo.root, ["worktree", "prune"]);
       ensureStateDirIgnored(run.workspaceRoot);
-      fs15.mkdirSync(path36.dirname(dir), { recursive: true });
+      fs15.mkdirSync(path37.dirname(dir), { recursive: true });
       await this.git(repo.root, ["worktree", "add", "-q", dir, repo.integrationBranch]);
       return dir;
     });
@@ -29650,7 +29913,7 @@ var GitWorktreeIsolation = class {
     const removal = noRemoval();
     for (const repo of opts.preserve === false || record.readOnly ? [] : run.repos) {
       const entry = record.repos[repo.path];
-      const target = { worktree: entry?.worktree, linked: entry?.linked ?? [], branch: record.branch, name: path36.basename(record.workspace), title: record.title, commit: record.commit };
+      const target = { worktree: entry?.worktree, linked: entry?.linked ?? [], branch: record.branch, name: path37.basename(record.workspace), title: record.title, commit: record.commit };
       try {
         const kept = await this.preserve(run, repo, target, opts.intent);
         if (kept) removal.preserved.push({ task: task2, ...kept });
@@ -29731,7 +29994,7 @@ var GitWorktreeIsolation = class {
       return;
     }
     for (const entry of entries) {
-      const target = path36.join(dir, entry.name);
+      const target = path37.join(dir, entry.name);
       if (entry.isSymbolicLink()) this.unlinkIfLink(target);
       else if (entry.isDirectory()) this.unlinkLinksUnder(target);
     }
@@ -29753,20 +30016,20 @@ var GitWorktreeIsolation = class {
         return false;
       }
     };
-    const owned = new Set(Object.values(run.tasks).map((r) => path36.resolve(r.workspace)));
+    const owned = new Set(Object.values(run.tasks).map((r) => path37.resolve(r.workspace)));
     const root = this.runRoot(run);
     if (fs15.existsSync(root)) {
       for (const entry of fs15.readdirSync(root)) {
-        const dir = path36.join(root, entry);
-        if (entry === INTEGRATION_DIR || owned.has(path36.resolve(dir))) continue;
+        const dir = path37.join(root, entry);
+        if (entry === INTEGRATION_DIR || owned.has(path37.resolve(dir))) continue;
         let kept = true;
         for (const repo of run.repos) {
-          const worktree = path36.join(dir, repo.path);
-          const linked = leftoverLinks(path36.join(worktree, await this.prefixOf(repo)));
+          const worktree = path37.join(dir, repo.path);
+          const linked = leftoverLinks(path37.join(worktree, await this.prefixOf(repo)));
           if (!await keep2(repo, { worktree, linked, branch: null, name: entry, title: entry }, worktree)) kept = false;
         }
         if (!kept) continue;
-        for (const repo of run.repos) await this.removeWorktreeDir(run, repo, path36.join(dir, repo.path), []);
+        for (const repo of run.repos) await this.removeWorktreeDir(run, repo, path37.join(dir, repo.path), []);
         this.removeTaskWorkspace(run, dir);
       }
     }
@@ -29784,13 +30047,13 @@ var GitWorktreeIsolation = class {
   }
   async removeWorktreeDir(run, repo, dir, linked) {
     for (const name of /* @__PURE__ */ new Set([...linked, ...installDirs(dir)])) {
-      const target = path36.join(dir, name);
-      if (!resolvesAsNamed(this.runRoot(run), path36.dirname(target))) continue;
+      const target = path37.join(dir, name);
+      if (!resolvesAsNamed(this.runRoot(run), path37.dirname(target))) continue;
       this.unlinkIfLink(target);
       this.unlinkLinksUnder(target);
     }
     for (const name of resolvesAsNamed(this.runRoot(run), dir) ? fs15.readdirSync(dir) : []) {
-      if (LINKED_ARTIFACTS.has(name) || isEnvFile(name)) this.unlinkIfLink(path36.join(dir, name));
+      if (LINKED_ARTIFACTS.has(name) || isEnvFile(name)) this.unlinkIfLink(path37.join(dir, name));
     }
     await this.tryGit(repo.root, ["worktree", "remove", "--force", dir]);
     if (fs15.existsSync(dir) && isInside(this.runRoot(run), dir)) {
@@ -29798,7 +30061,7 @@ var GitWorktreeIsolation = class {
       fs15.rmSync(dir, { recursive: true, force: true });
     }
     await this.tryGit(repo.root, ["worktree", "prune"]);
-    for (let parent = path36.dirname(dir); isInside(this.runRoot(run), parent); parent = path36.dirname(parent)) this.removeIfEmpty(parent);
+    for (let parent = path37.dirname(dir); isInside(this.runRoot(run), parent); parent = path37.dirname(parent)) this.removeIfEmpty(parent);
   }
   unlinkIfLink(target) {
     try {
@@ -29813,14 +30076,14 @@ var GitWorktreeIsolation = class {
     }
   }
   runRoot(run) {
-    return path36.join(run.workspaceRoot, STATE_DIR, "worktrees", run.id);
+    return path37.join(run.workspaceRoot, STATE_DIR, "worktrees", run.id);
   }
   namesFor(run, task2) {
     const slug = sanitizeSlug(task2.title).slice(0, 40).replace(/-+$/, "") || "task";
     let name = `${task2.order}-${slug}`;
     const clash = Object.values(run.tasks).some((r) => r.taskId !== task2.id && r.branch === `ordewell/${run.id}/${name}`);
     if (clash) name = `${name}-${sanitizeSlug(task2.id) || "x"}`;
-    return { branch: `ordewell/${run.id}/${name}`, dir: path36.join(this.runRoot(run), name) };
+    return { branch: `ordewell/${run.id}/${name}`, dir: path37.join(this.runRoot(run), name) };
   }
   async unmergedPaths(cwd) {
     const listed3 = await this.tryGit(cwd, ["diff", "--name-only", "-z", "--diff-filter=U"]);
@@ -29834,7 +30097,7 @@ var GitWorktreeIsolation = class {
   async rebaseInProgress(cwd) {
     for (const dir of ["rebase-merge", "rebase-apply"]) {
       const found = await this.tryGit(cwd, ["rev-parse", "--git-path", dir]);
-      if (found.ok && fs15.existsSync(path36.resolve(cwd, found.stdout.trim()))) return true;
+      if (found.ok && fs15.existsSync(path37.resolve(cwd, found.stdout.trim()))) return true;
     }
     return false;
   }
@@ -29942,7 +30205,7 @@ function handoffBaseLine(handoff, length) {
   return handoff.repos.map((repo) => `${group ? `${repo.path}: ` : ""}${repoBaseLine(repo, length)}`).join(", ");
 }
 function repoResultLines(handoff) {
-  return handoff.repos.map(({ path: path47, landed: landed2 }) => `${path47}: ${landed2.length === 0 ? "nothing to merge" : `${landed2.length} task${landed2.length === 1 ? "" : "s"} landed`}`);
+  return handoff.repos.map(({ path: path48, landed: landed2 }) => `${path48}: ${landed2.length === 0 ? "nothing to merge" : `${landed2.length} task${landed2.length === 1 ? "" : "s"} landed`}`);
 }
 
 // src/interfaces/ILogger.ts
@@ -33769,15 +34032,21 @@ var Landing = class {
    * has landed. Its branch is on the integration branch by then, so it merges
    * clean — and one the resolver did not really bring along conflicts again
    * instead of being taken at its word. Null when there is nothing to land.
+   * The task is named before its landing settles, so the caller can hold
+   * its worktree for as long as the merge is in it; one the caller says is
+   * `leaving` the plan is not landed at all.
    */
-  async landResolved(resolverId) {
+  landResolved(resolverId, leaving = () => false) {
     const conflictedId = this.runs.takeResolver(resolverId);
-    if (!conflictedId) return null;
+    if (!conflictedId || leaving(conflictedId)) return null;
     const task2 = this.tasks.get(conflictedId);
     if (!task2 || this.runs.current?.tasks[conflictedId]?.status !== "conflict") return null;
+    return { task: task2, outcome: this.landConflicted(task2) };
+  }
+  async landConflicted(task2) {
     const landing2 = await this.runs.integrate(task2);
-    if (landing2 !== "merged") return { task: task2, outcome: this.unmerged(task2, landing2) };
-    return { task: task2, outcome: { kind: "landed", messages: [{ level: "info", text: `Task "${task2.title}" landed through its conflict resolution.` }] } };
+    if (landing2 !== "merged") return this.unmerged(task2, landing2);
+    return { kind: "landed", messages: [{ level: "info", text: `Task "${task2.title}" landed through its conflict resolution.` }] };
   }
   /** The repair a conflicted task is owed next; null when repair is off, used up, or there is no isolated run to repair it in. */
   nextRepair(taskId) {
@@ -34122,7 +34391,7 @@ function heldFrom(state) {
 }
 
 // src/services/Attempts.ts
-var path39 = __toESM(require("path"));
+var path40 = __toESM(require("path"));
 
 // src/services/VerdictEngine.ts
 var IDLE_TIMEOUT_MS = 10 * 6e4;
@@ -34230,6 +34499,18 @@ var VerdictEngine = class {
     this.resumeIdle(taskId);
     this.toolCheckpoints.get(taskId)?.({ kind: "rejected", reason });
   }
+  /**
+   * An attempt's runner is being started, with no session to watch yet. Its
+   * silence counts from here, so one whose start never resolves — stuck
+   * launching, or waiting for its tools to attach — is flagged quiet as well.
+   * {@link watch} starts the count again once the runner is up.
+   */
+  starting(taskId) {
+    const gen = this.bumpGeneration(taskId);
+    this.idlePaused.delete(taskId);
+    this.openApprovals.delete(taskId);
+    this.touchIdle(taskId, gen);
+  }
   /**
    * Attach to a spawned session. The runner's `task_complete` call on the
    * attempt's token is the only completion evidence (ADR-0022, V2); a session
@@ -34240,6 +34521,9 @@ var VerdictEngine = class {
    */
   watch(task2, session) {
     const gen = this.bumpGeneration(task2.id);
+    this.idlePaused.delete(task2.id);
+    this.openApprovals.delete(task2.id);
+    this.touchIdle(task2.id, gen);
     session.onOutput(() => {
       if (this.generations.get(task2.id) === gen) this.touchIdle(task2.id, gen);
     });
@@ -34498,7 +34782,7 @@ function reportedVerdict(report) {
 // src/services/ScriptRunner.ts
 var import_child_process11 = require("child_process");
 var fs16 = __toESM(require("fs"));
-var path37 = __toESM(require("path"));
+var path38 = __toESM(require("path"));
 var import_events2 = require("events");
 var import_string_decoder2 = require("string_decoder");
 
@@ -34639,7 +34923,7 @@ var ScriptSession = class extends AbstractRunnerSession {
   async launchOf(step) {
     if ("argv" in step) {
       const [named3, ...args] = step.argv;
-      const program = this.setup.platform === "win32" && path37.win32.basename(named3) !== named3 && !path37.win32.isAbsolute(named3) ? path37.win32.resolve(this.setup.cwd, named3) : named3;
+      const program = this.setup.platform === "win32" && path38.win32.basename(named3) !== named3 && !path38.win32.isAbsolute(named3) ? path38.win32.resolve(this.setup.cwd, named3) : named3;
       const plan = await planDirectLaunch(program, args, this.setup.launch);
       return { file: plan.file, args: plan.args, shell: false, ...plan.verbatim ? { verbatim: true } : {} };
     }
@@ -34874,8 +35158,8 @@ function passed(status) {
 // src/services/PatchCapture.ts
 var import_crypto15 = require("crypto");
 var fs17 = __toESM(require("fs"));
-var os11 = __toESM(require("os"));
-var path38 = __toESM(require("path"));
+var os10 = __toESM(require("os"));
+var path39 = __toESM(require("path"));
 
 // src/services/readTask.ts
 function readTask2(args, readerId, plan, log) {
@@ -35142,7 +35426,7 @@ function linkInPatch(patch) {
 function readOwn(scratch, name, max) {
   let fd;
   try {
-    fd = fs17.openSync(path38.join(scratch, name), fs17.constants.O_RDONLY | (fs17.constants.O_NOFOLLOW ?? 0));
+    fd = fs17.openSync(path39.join(scratch, name), fs17.constants.O_RDONLY | (fs17.constants.O_NOFOLLOW ?? 0));
   } catch (err) {
     throw new Refusal(`the capture left no ${name.split(".").pop()} Ordewell could read (${err.code ?? String(err)})`);
   }
@@ -35180,7 +35464,7 @@ async function captureHeld(runs, opts, signal) {
   const [worktree] = runs.worktrees;
   const scratch = runs.scratch;
   const tag = `ordewell-patch-${(0, import_crypto15.randomBytes)(8).toString("hex")}`;
-  const stem = path38.join(scratch, tag);
+  const stem = path39.join(scratch, tag);
   const own = (suffix, max = LISTING_BYTES) => readOwn(scratch, `${tag}.${suffix}`, max);
   try {
     const stage = await runs.run(stageScript(stem, opts.linked ?? []), worktree);
@@ -35272,8 +35556,8 @@ async function indexEntries(invoker, worktree) {
   return entries;
 }
 async function trialApply(invoker, worktree, patchFile, scratch) {
-  const index = path38.resolve(worktree, (await git(invoker, worktree, [...APPLY_GIT, "rev-parse", "--git-path", "index"])).trim());
-  const copy = path38.join(scratch, "index");
+  const index = path39.resolve(worktree, (await git(invoker, worktree, [...APPLY_GIT, "rev-parse", "--git-path", "index"])).trim());
+  const copy = path39.join(scratch, "index");
   fs17.copyFileSync(index, copy);
   const trial = { ...invoker, exec: (file, args, opts) => invoker.exec(file, args, { ...opts, env: { ...opts.env, GIT_INDEX_FILE: copy } }) };
   const tried = await tryGit(trial, worktree, [...APPLY_GIT, "apply", "--cached", "--3way", "--whitespace=nowarn", patchFile]);
@@ -35293,7 +35577,7 @@ function gitRefused(lead, stderr) {
 function onDisk3(worktree, names) {
   return names.map((name) => {
     try {
-      const stat = fs17.lstatSync(path38.join(worktree, name), { bigint: true, throwIfNoEntry: false });
+      const stat = fs17.lstatSync(path39.join(worktree, name), { bigint: true, throwIfNoEntry: false });
       return stat ? `${stat.mode} ${stat.ino} ${stat.size} ${stat.mtimeNs} ${stat.ctimeNs}` : "none";
     } catch (err) {
       return err.code ?? "unreadable";
@@ -35333,7 +35617,7 @@ function leavesWorktree(worktree, names, linked, held2, left) {
       if (i < parts.length && held2.get(at)?.some((entry) => entry.mode === SUBMODULE)) {
         return `the patch writes ${name}, under ${at}, a submodule, whose files are another repository's.`;
       }
-      const full = path38.join(worktree, ...parts.slice(0, i));
+      const full = path39.join(worktree, ...parts.slice(0, i));
       const stat = fs17.lstatSync(full, { throwIfNoEntry: false });
       if (!stat) break;
       const last = i === parts.length;
@@ -35361,7 +35645,7 @@ async function applyPatch(invoker, worktree, patch, saved, opts = {}) {
   if (link !== void 0) {
     return refused4(`the patch holds a link or a submodule (${JSON.stringify(link.slice(0, 80))}), which a saved patch never does, so it is not one that was saved.`);
   }
-  const dir = fs17.mkdtempSync(path38.join(os11.tmpdir(), "ordewell-apply-"));
+  const dir = fs17.mkdtempSync(path39.join(os10.tmpdir(), "ordewell-apply-"));
   try {
     const toplevel = (await git(invoker, worktree, [...APPLY_GIT, "rev-parse", "--show-toplevel"])).trim();
     if (fs17.realpathSync(toplevel) !== fs17.realpathSync(worktree)) return refused4(`${worktree} is not the root of a worktree of its own.`);
@@ -35371,7 +35655,7 @@ async function applyPatch(invoker, worktree, patch, saved, opts = {}) {
     }
     const before = await unmergedPaths(invoker, worktree);
     if (before.length > 0) return refused4(`your worktree still has unresolved conflicts (${listed(before.slice(0, 10))}${before.length > 10 ? `, +${before.length - 10} more` : ""}). Resolve them and git add them, or undo them, then apply the patch.`);
-    const file = path38.join(dir, "saved.patch");
+    const file = path39.join(dir, "saved.patch");
     fs17.writeFileSync(file, patch, { flag: "wx", mode: 384 });
     const held2 = await indexEntries(invoker, worktree);
     const named3 = await pathsNamed(invoker, worktree, file);
@@ -35607,6 +35891,10 @@ var Attempts = class {
   receipt(taskId) {
     return this.live.get(taskId)?.receipt ?? null;
   }
+  /** Which spawn of the live attempt's runner waits for Ordewell's tools to connect; null when none does. */
+  attaching(taskId) {
+    return this.live.get(taskId)?.attaching ?? null;
+  }
   /** The kind a task's next attempt starts as, short of a repair or a continue: what is weighed before one exists. */
   nextKind(taskId) {
     const task2 = this.deps.store.get(taskId);
@@ -35647,7 +35935,9 @@ var Attempts = class {
       shell: null,
       web: null,
       patch: null,
-      receipt: null
+      receipt: null,
+      attaching: null,
+      spawning: new AbortController()
     };
     this.spawnCounts.set(task2.id, attempt.attempt);
     this.live.set(task2.id, attempt);
@@ -35662,7 +35952,8 @@ var Attempts = class {
   /**
    * The one way an attempt ends. Dropping the record is itself what
    * invalidates a spawn still in flight ({@link run} kills the session it
-   * receives for an attempt that is no longer current).
+   * receives for an attempt that is no longer current), and its cancel takes
+   * back a runner still starting meanwhile.
    *
    * A user interruption also bumps the verifier's generation *before* stopping
    * the runner: a runner may fire onExit synchronously from
@@ -35678,6 +35969,7 @@ var Attempts = class {
     const session = attempt?.session ?? null;
     const nativeSessionId = session?.nativeSessionId() ?? null;
     if (attempt) {
+      attempt.spawning.abort();
       store.endAttemptUsage(taskId, attempt.attempt, (/* @__PURE__ */ new Date()).toISOString(), session?.sessionCost?.() ?? void 0, nativeSessionId ?? void 0);
       this.deps.output.detach(taskId);
       attempt.shell?.end();
@@ -35854,12 +36146,14 @@ var Attempts = class {
         this.abandonSpawn(task2, attempt);
         return false;
       }
+      this.verifier.starting(task2.id);
       const session = attempt.script ? await this.spawnScript(task2, attempt, cwd) : await this.spawnRunner(task2, attempt, cwd, worktree ? workspace : void 0, previousWork);
       if (this.live.get(task2.id) !== attempt) {
         this.abandonSpawn(task2, attempt, session);
         return false;
       }
       attempt.phase = "running";
+      attempt.attaching = null;
       attempt.session = session;
       store.setTaskRunnerSessionId(task2.id, void 0);
       store.clearCarriedFrom(task2.id);
@@ -36005,7 +36299,13 @@ var Attempts = class {
       ...web ? { webReads: web } : {},
       applyPatch: (args) => this.applyPatch(task2, attempt, args),
       workspaceRoot: this.deps.workspaceRoot(),
-      onNotice: (message) => this.host.tell("warn", `Task "${task2.title}": ${message}`)
+      onNotice: (message) => this.host.tell("warn", `Task "${task2.title}": ${message}`),
+      cancelled: attempt.spawning.signal,
+      onAttaching: (spawn) => {
+        if (this.live.get(task2.id) !== attempt) return;
+        attempt.attaching = spawn;
+        this.host.emit("onTaskChanged");
+      }
     });
   }
   /**
@@ -36058,9 +36358,9 @@ var Attempts = class {
     const repos = Object.values(this.deps.runs.openRecord(taskId)?.repos ?? {});
     if (repos.length !== 1 || cwd === null) return [];
     const [{ worktree, linked }] = repos;
-    const prefix = path39.relative(worktree, cwd).split(path39.sep).join("/");
-    if (prefix.startsWith("..") || path39.isAbsolute(prefix)) return [];
-    return linked.map((name) => (prefix ? `${prefix}/${name}` : name).split(path39.sep).join("/"));
+    const prefix = path40.relative(worktree, cwd).split(path40.sep).join("/");
+    if (prefix.startsWith("..") || path40.isAbsolute(prefix)) return [];
+    return linked.map((name) => (prefix ? `${prefix}/${name}` : name).split(path40.sep).join("/"));
   }
   /**
    * A script task's start (ADR-0035): its body as the plan holds it now, run
@@ -36098,7 +36398,7 @@ var Attempts = class {
       this.deps.notifications.warn(message);
     };
     if (resolved.blockedEnvrc) {
-      warn(`blocked:${resolved.blockedEnvrc}`, `direnv has blocked ${resolved.blockedEnvrc}, so tasks start without its variables. Run \`direnv allow\` in ${path39.dirname(resolved.blockedEnvrc)} to use them.`);
+      warn(`blocked:${resolved.blockedEnvrc}`, `direnv has blocked ${resolved.blockedEnvrc}, so tasks start without its variables. Run \`direnv allow\` in ${path40.dirname(resolved.blockedEnvrc)} to use them.`);
     }
     if (resolved.trackedEnvFile) {
       warn(`tracked:${resolved.trackedEnvFile}`, `Ignored ${resolved.trackedEnvFile}: git tracks it, and a committed file must not choose the environment agents run in. Untrack it to use it.`);
@@ -36124,7 +36424,7 @@ var Attempts = class {
   uncommittedSkillFolder(name) {
     const root = this.deps.workspaceRoot();
     const skill = this.deps.skillsAt(this.skillRoots(root)).findSkill(name);
-    return skill?.source === "workspace" ? path39.relative(root, path39.dirname(skill.path)).split(path39.sep).join("/") : void 0;
+    return skill?.source === "workspace" ? path40.relative(root, path40.dirname(skill.path)).split(path40.sep).join("/") : void 0;
   }
   /**
    * The roots whose `.ordewell/skills/` an attempt at `cwd` reads: in a repo
@@ -36554,12 +36854,12 @@ function ancestors(task2, store) {
 
 // src/services/sessionLease.ts
 var fs19 = __toESM(require("fs"));
-var path41 = __toESM(require("path"));
+var path42 = __toESM(require("path"));
 var import_crypto17 = require("crypto");
 
 // src/utils/sessionStore.ts
 var fs18 = __toESM(require("fs"));
-var path40 = __toESM(require("path"));
+var path41 = __toESM(require("path"));
 
 // src/utils/sessionId.ts
 var import_crypto16 = require("crypto");
@@ -36570,13 +36870,13 @@ function mintSessionId() {
 // src/utils/sessionStore.ts
 var SESSIONS_SUBDIR = "sessions";
 function getSessionsDir(baseDir) {
-  return path40.join(getStateDir(baseDir), SESSIONS_SUBDIR);
+  return path41.join(getStateDir(baseDir), SESSIONS_SUBDIR);
 }
 function idSegment(id2) {
   return /^[A-Za-z0-9_-][A-Za-z0-9._-]{0,127}$/.test(id2) ? id2 : `~${Buffer.from(id2, "utf-8").toString("hex")}`;
 }
 function sessionDataDir(sessionId, baseDir) {
-  return path40.join(getSessionsDir(baseDir), idSegment(sessionId));
+  return path41.join(getSessionsDir(baseDir), idSegment(sessionId));
 }
 var REJECTION_MESSAGE = "This session was created with an older version of Ordewell. Please re-plan.";
 function isSessionMeta(value) {
@@ -36603,8 +36903,8 @@ function legacySessionFilename(session) {
   return `${filenameStem(session)}_${session.id.slice(0, 8)}.json`;
 }
 function dropLegacyFile(sessionsDir, meta) {
-  const legacy = path40.join(sessionsDir, legacySessionFilename(meta));
-  if (legacy === path40.join(sessionsDir, sessionFilename(meta)) || !fs18.existsSync(legacy)) return;
+  const legacy = path41.join(sessionsDir, legacySessionFilename(meta));
+  if (legacy === path41.join(sessionsDir, sessionFilename(meta)) || !fs18.existsSync(legacy)) return;
   try {
     const held2 = JSON.parse(fs18.readFileSync(legacy, "utf-8")).meta?.id;
     if (held2 === meta.id) fs18.unlinkSync(legacy);
@@ -36631,7 +36931,7 @@ function saveSession(plan, goal, baseDir, id2) {
   };
   dropRetiredPlanFields(session.plan);
   const filename = sessionFilename(meta);
-  const filePath = path40.join(sessionsDir, filename);
+  const filePath = path41.join(sessionsDir, filename);
   writeFileAtomic(filePath, JSON.stringify(session, null, 2));
   dropLegacyFile(sessionsDir, meta);
   return meta;
@@ -36643,7 +36943,7 @@ function listSessions(baseDir, logger = defaultLogger) {
   return files.map((f) => {
     let parsed;
     try {
-      parsed = JSON.parse(fs18.readFileSync(path40.join(sessionsDir, f), "utf-8"));
+      parsed = JSON.parse(fs18.readFileSync(path41.join(sessionsDir, f), "utf-8"));
     } catch (err) {
       if (err instanceof SyntaxError) return moveAside(sessionsDir, f, "is not valid JSON", logger);
       logger.warn("sessionStore", `failed to read session file ${f}; skipping`, err);
@@ -36664,7 +36964,7 @@ function listSessions(baseDir, logger = defaultLogger) {
 function moveAside(sessionsDir, file, reason, logger) {
   const aside = `${file}.${Date.now()}.corrupt`;
   try {
-    fs18.renameSync(path40.join(sessionsDir, file), path40.join(sessionsDir, aside));
+    fs18.renameSync(path41.join(sessionsDir, file), path41.join(sessionsDir, aside));
     logger.warn("sessionStore", `session file ${file} ${reason}; moved aside to ${aside} rather than overwritten`);
   } catch {
     logger.warn("sessionStore", `failed to read session file ${file}; skipping`);
@@ -36675,7 +36975,7 @@ function findSessionFile(sessionsDir, sessionId, logger) {
   const files = fs18.readdirSync(sessionsDir).filter((f) => f.endsWith(".json"));
   for (const f of files) {
     try {
-      const raw = fs18.readFileSync(path40.join(sessionsDir, f), "utf-8");
+      const raw = fs18.readFileSync(path41.join(sessionsDir, f), "utf-8");
       const session = JSON.parse(raw);
       if (session.meta.id === sessionId) return f;
     } catch (err) {
@@ -36690,7 +36990,7 @@ function loadSession(sessionId, baseDir, logger = defaultLogger) {
   try {
     const file = findSessionFile(sessionsDir, sessionId, logger);
     if (file) {
-      const raw = fs18.readFileSync(path40.join(sessionsDir, file), "utf-8");
+      const raw = fs18.readFileSync(path41.join(sessionsDir, file), "utf-8");
       const parsed = JSON.parse(raw);
       if (hasScalarRunner(parsed)) {
         logger.warn("sessionStore", `session file ${file}: ${REJECTION_MESSAGE}`);
@@ -36732,7 +37032,7 @@ function deleteSession(sessionId, baseDir, logger = defaultLogger) {
   try {
     const file = findSessionFile(sessionsDir, sessionId, logger);
     if (file) {
-      fs18.unlinkSync(path40.join(sessionsDir, file));
+      fs18.unlinkSync(path41.join(sessionsDir, file));
       return true;
     }
   } catch (err) {
@@ -36785,7 +37085,7 @@ var UNLEASED = {
 };
 var hostsHere = /* @__PURE__ */ new Set();
 function leaseFile(sessionId, workspace) {
-  return path41.join(sessionDataDir(sessionId, workspace), LEASE_FILE);
+  return path42.join(sessionDataDir(sessionId, workspace), LEASE_FILE);
 }
 function isRecord9(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -36874,7 +37174,7 @@ var LeaseHost = class {
    */
   acquire(file, workspace, holder) {
     ensureStateDirIgnored(workspace);
-    ensurePrivateDir(path41.dirname(file));
+    ensurePrivateDir(path42.dirname(file));
     const outcome = withFileLock(file, () => {
       const current = readRecord(file);
       const taken = current !== null && current.hostId !== this.id ? current : null;
@@ -36929,7 +37229,7 @@ var LeaseHost = class {
       withFileLock(file, () => {
         if (readRecord(file)?.hostId === this.id) fs19.rmSync(file, { force: true });
       }, "release a session lease");
-      fs19.rmdirSync(path41.dirname(file));
+      fs19.rmdirSync(path42.dirname(file));
     } catch {
     }
   }
@@ -37122,10 +37422,14 @@ var TaskOrchestrator = class _TaskOrchestrator {
   /** Conflict repairs owed with every slot taken and no scheduler to claim them: a freed slot starts them. */
   owedRepairs = /* @__PURE__ */ new Set();
   /**
-   * Tasks Mark complete is landing after it ended their attempt: in progress
-   * with no attempt for as long as that takes, and not orphans for it.
+   * Tasks Mark complete is landing after it ended their attempt, or that
+   * their conflict resolver is landing, and that landing: in progress with
+   * no attempt for as long as it takes, and not orphans for it. Both can be
+   * landing one task at once, so each holds it for itself (see {@link holdWhileLanding}).
    */
-  completing = /* @__PURE__ */ new Set();
+  completing = /* @__PURE__ */ new Map();
+  /** Tasks {@link releaseTask} is tearing down once their landings have settled: none may begin another. */
+  releasing = /* @__PURE__ */ new Set();
   /** Tasks paused on a usage limit, the run's hold on them, and each runner's wait for its reset (ADR-0018, U1). */
   limitPauses;
   /**
@@ -37261,6 +37565,10 @@ var TaskOrchestrator = class _TaskOrchestrator {
   getCompletionReceipt(taskId) {
     return this.attempts.receipt(taskId);
   }
+  /** Which spawn of a live attempt's runner waits for Ordewell's tools to connect (ADR-0025); null when none does. */
+  getToolsAttaching(taskId) {
+    return this.attempts.attaching(taskId);
+  }
   /** Recent clean output of a task's latest attempt, running or ended; null if it never ran. */
   getLiveOutput(taskId, opts) {
     return this.attempts.liveTail(taskId, opts);
@@ -37425,12 +37733,13 @@ var TaskOrchestrator = class _TaskOrchestrator {
   /**
    * Something can still start that nobody has to ask for again: a start
    * admitted and not yet claimed, a force start queued behind its
-   * dependencies, a task that resumes on its own at its usage limit's
-   * reset, or a start a dirty checkout parked for Stash and continue to
-   * replay. A Stop is owed to it, whether or not anything runs.
+   * dependencies, a conflict repair owed a slot or the end of a start hold,
+   * a task that resumes on its own at its usage limit's reset, or a start a
+   * dirty checkout parked for Stash and continue to replay. A Stop is owed to
+   * it, whether or not anything runs.
    */
   get startsPending() {
-    return this.admissions > 0 || this.queuedStarts.size > 0 || this.runs.blocked || this.store.allTasks.some(waitsForReset);
+    return this.admissions > 0 || this.queuedStarts.size > 0 || this.owedRepairs.size > 0 || this.runs.blocked || this.store.allTasks.some(waitsForReset);
   }
   /**
    * The plan's activity as one word for every surface: a start on its way,
@@ -37931,6 +38240,7 @@ var TaskOrchestrator = class _TaskOrchestrator {
    * Work that did not land waits on the user — it never fails the task or
    * blocks its dependents — unless its conflict is owed a repair, which takes
    * the slot the ending attempt freed and never one more than the run allows.
+   * A planner turn's start hold holds it as it holds any new spawn (ADR-0029).
    * The repair follows on from the start whose work it repairs: a Stop since
    * that was admitted withdraws it.
    */
@@ -37938,20 +38248,22 @@ var TaskOrchestrator = class _TaskOrchestrator {
     this.store.markAwaitingUser(task2.id, "conflict");
     this.say(outcome.messages);
     if (outcome.kind !== "repair-needed") return;
-    if (this.attempts.size < this.config.maxParallelSessions) {
+    const waitsFor = this.startHolds > 0 ? "the planner's turn ends" : this.slotsFull() ? "a slot is free" : null;
+    if (!waitsFor) {
       const claimed = this.claim(task2.id, admission);
       if ("refused" in claimed) this.tell("warn", `The conflict of task "${task2.title}" is not repaired: ${claimed.refused}`);
       else this.unawaited(claimed.spawned, `Could not start the repair of task "${task2.title}"`);
     } else {
       this.store.markPending(task2.id);
       if (!this.isScheduling) this.owedRepairs.add(task2.id);
-      this.tell("info", `Task "${task2.title}" is repaired once a slot is free.`);
+      this.tell("info", `Task "${task2.title}" is repaired once ${waitsFor}.`);
     }
   }
-  /** Start the repairs {@link settleUnlanded} left owed, as slots allow. */
+  /** Start the repairs {@link settleUnlanded} left owed, as slots and any start hold allow. */
   startOwedRepairs(admission) {
+    if (this.startHolds > 0) return;
     for (const id2 of [...this.owedRepairs]) {
-      if (this.attempts.size >= this.config.maxParallelSessions) return;
+      if (this.slotsFull()) return;
       this.owedRepairs.delete(id2);
       const task2 = this.store.get(id2);
       if (!task2 || task2.status !== "pending" || this.attempts.has(id2) || !this.landing.nextRepair(id2)) continue;
@@ -37961,13 +38273,31 @@ var TaskOrchestrator = class _TaskOrchestrator {
     }
   }
   async landResolved(resolverId, admission) {
-    const resolved = await this.landing.landResolved(resolverId);
+    const resolved = this.landing.landResolved(resolverId, (id2) => this.releasing.has(id2));
     if (!resolved) return;
-    const { task: task2, outcome } = resolved;
+    const { task: task2 } = resolved;
+    const outcome = await this.holdWhileLanding(task2.id, resolved.outcome);
+    if (this.store.get(task2.id)?.status === "completed") return;
     await this.applyLanding(task2, outcome, admission, () => {
       if (task2.verdict) this.logAndArchive(task2, task2.verdict);
     });
   }
+  /**
+   * Hold a task for as long as `landing` is merging its worktree. Its end lets
+   * go of its own hold only: another landing of the task begun meanwhile
+   * still holds it.
+   */
+  async holdWhileLanding(taskId, landing2) {
+    const holds2 = this.completing.get(taskId) ?? /* @__PURE__ */ new Set();
+    holds2.add(landing2);
+    this.completing.set(taskId, holds2);
+    try {
+      return await landing2;
+    } finally {
+      holds2.delete(landing2);
+      if (holds2.size === 0 && this.completing.get(taskId) === holds2) this.completing.delete(taskId);
+    }
+  }
   getReadyTasks() {
     return this.readiness().ready;
   }
@@ -38075,17 +38405,27 @@ var TaskOrchestrator = class _TaskOrchestrator {
    * as {@link cancelTask} does, but its worktree goes: no task is left to land
    * it into. A spawn still in flight just loses its attempt,
    * which is what makes {@link Attempts} kill the session it is about to
-   * receive. The id's cross-attempt bookkeeping goes too — a hold or retry
-   * count kept for a task that no longer exists would be inherited by nothing.
+   * receive. Every landing of it in flight — Mark complete's, its resolver's —
+   * settles first, so its worktree is not torn down under a merge, and none
+   * begins while it goes; a repair a landing claims is cancelled as any
+   * running attempt is. The id's cross-attempt bookkeeping
+   * goes too — a hold or retry count kept for a task that no longer exists
+   * would be inherited by nothing.
    */
   async releaseTask(taskId) {
     this.limitPauses.cancel(taskId);
-    const phase = this.attempts.phaseOf(taskId);
-    if (phase === "running" || phase === "integrating") await this.cancelAttempt(taskId, { keep: false });
-    else {
-      this.attempts.end(taskId, "release");
-      if (this.store.get(taskId)?.status === "in_progress") this.store.markPending(taskId);
-      await this.runs.release(taskId, { keep: false });
+    for (let holds2 = this.completing.get(taskId); holds2; holds2 = this.completing.get(taskId)) await Promise.allSettled(holds2);
+    this.releasing.add(taskId);
+    try {
+      const phase = this.attempts.phaseOf(taskId);
+      if (phase === "running" || phase === "integrating") await this.cancelAttempt(taskId, { keep: false });
+      else {
+        this.attempts.end(taskId, "release");
+        if (this.store.get(taskId)?.status === "in_progress") this.store.markPending(taskId);
+        await this.runs.release(taskId, { keep: false });
+      }
+    } finally {
+      this.releasing.delete(taskId);
     }
     this.onHold.delete(taskId);
     this.retryCounts.delete(taskId);
@@ -38094,17 +38434,12 @@ var TaskOrchestrator = class _TaskOrchestrator {
   async markTaskComplete(taskId) {
     const task2 = this.store.get(taskId);
     if (!task2 || task2.status === "completed") return;
-    if (this.completing.has(taskId)) return;
+    if (this.completing.has(taskId) || this.releasing.has(taskId)) return;
     const admission = this.admittedNow();
     const ended = this.attempts.end(taskId, "complete");
     const verdict = this.attempts.markComplete(task2);
-    this.completing.add(taskId);
-    let landing2;
-    try {
-      landing2 = await (ended?.integration ?? this.landing.landVouched(task2));
-    } finally {
-      this.completing.delete(taskId);
-    }
+    const landed2 = ended?.integration ?? this.landing.landVouched(task2);
+    const landing2 = await this.holdWhileLanding(taskId, landed2);
     this.store.setTaskVerdict(taskId, verdict);
     const handoff = task2.type === "user" ? userTaskHandoff(task2.userSteps) : void 0;
     this.attempts.handOver(taskId, summarizeOutput(verdict.reason, ""), handoff);
@@ -38393,7 +38728,7 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
       if (!await this.openForAdmitted(taskId, origin, resume, admission)) return;
       if (this.attempts.has(taskId)) return;
       this.refuseOpsDuringMerge(taskId, forced);
-      if (forced.queued && this.holdsQueued(taskId, forced)) {
+      if (forced.queued && (this.holdsQueued(taskId, forced) || this.slotsFull())) {
         this.queuedStarts.set(taskId, { pastGate: forced.pastGate });
         return;
       }
@@ -38452,8 +38787,9 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
         this.queuedStarts.delete(id2);
         continue;
       }
+      if (this.slotsFull()) continue;
       const waits = this.startWaits(task2, task2.research ? void 0 : { queued: true, pastGate: queued.pastGate });
-      if (task2.research && (waits.length > 0 || this.attempts.size >= this.config.maxParallelSessions)) continue;
+      if (task2.research && waits.length > 0) continue;
       if (waits.some((w) => QUEUED_WAITS.has(w.kind))) continue;
       if (this.leftToScheduler(task2) && queued.pastGate.length === 0) {
         this.queuedStarts.delete(id2);
@@ -38482,6 +38818,9 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
     const task2 = this.store.get(taskId);
     return !!task2 && this.startWaits(task2, forced).some((w) => QUEUED_WAITS.has(w.kind) || w.kind === "dependencies" || w.kind === "merge-gate");
   }
+  slotsFull() {
+    return this.attempts.size >= this.config.maxParallelSessions;
+  }
   sayQueuedAtGate(task2, queued, unmerged) {
     const titles = unmerged.map((id2) => `"${this.store.get(id2)?.title ?? id2}"`).join(", ");
     const notice = `Task "${task2.title}" waits for Merge all: the work of ${titles} is not merged into your branch yet. Merge all to start it, or force start it again to start it without that work.`;
@@ -38582,7 +38921,7 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
    */
   async settleRun(after) {
     if (!this.store.isFinished()) this.transition({ type: "reopen" });
-    if (this.attempts.size > 0) return;
+    if (this.attempts.size > 0 || this.owedRepairs.size > 0) return;
     if (this.runState.kind === "held") return;
     if (this.runState.kind !== "scheduling") {
       if (after === "tick") {
@@ -38876,21 +39215,45 @@ var Planner = class {
 };
 
 // src/services/ModelResolver.ts
-var ModelResolver = class {
+var ModelResolver = class _ModelResolver {
   constructor(registry, config, deps = {}) {
     this.registry = registry;
     this.config = config;
-    this.discovery = new ModelDiscovery(registry, deps.execImpl, deps.fetchImpl);
+    this.discovery = new ModelDiscovery(registry, deps.execImpl, deps.fetchImpl, void 0, void 0, void 0, deps.env);
     this.fetchImpl = deps.fetchImpl;
+    this.execImpl = deps.execImpl;
+    this.shared = { vendor: { options: null, load: null, errors: {}, generation: 0 }, root: this, views: /* @__PURE__ */ new Map() };
   }
   registry;
   config;
   discovery;
   fetchImpl;
-  cachedPickerOptions = null;
-  /** A catalog load under way: a second ask, or a warm-up, shares it rather than fetching again. */
-  pickerLoad = null;
-  lastDiscoveryErrors = {};
+  execImpl;
+  shared;
+  get vendor() {
+    return this.shared.vendor;
+  }
+  /**
+   * This resolver for runners launched with another environment, a
+   * workspace's own: their catalogs are discovered and cached under `env`, as
+   * `CLAUDE_CONFIG_DIR` there can name another account, while the vendor
+   * catalogs stay this resolver's, fetched once. One view per `key`, made on
+   * its first ask: a later ask with the same key gets that view, whatever
+   * `env` it passes.
+   */
+  withRunnerEnv(key, env) {
+    let view = this.shared.views.get(key);
+    if (!view) {
+      view = new _ModelResolver(this.registry, this.config, { fetchImpl: this.fetchImpl, execImpl: this.execImpl, env });
+      view.shared = this.shared;
+      this.shared.views.set(key, view);
+    }
+    return view;
+  }
+  /** Every runner-environment catalog this resolver's family holds: its root's and each view's. */
+  runnerCatalogs() {
+    return [this.shared.root, ...this.shared.views.values()].map((resolver) => resolver.discovery);
+  }
   static builtinOptions() {
     return toOrchestratorOptions({}, ORCHESTRATOR_SHORTCUTS);
   }
@@ -38906,16 +39269,16 @@ var ModelResolver = class {
     return Object.fromEntries(discovered);
   }
   async pickerOptions() {
-    if (this.cachedPickerOptions) return this.cachedPickerOptions;
-    if (!this.pickerLoad) {
+    if (this.vendor.options) return this.vendor.options;
+    if (!this.vendor.load) {
       const load = this.loadPickerOptions();
-      this.pickerLoad = load;
+      this.vendor.load = load;
       void load.finally(() => {
-        if (this.pickerLoad === load) this.pickerLoad = null;
+        if (this.vendor.load === load) this.vendor.load = null;
       }).catch(() => {
       });
     }
-    return this.pickerLoad;
+    return this.vendor.load;
   }
   /**
    * Start loading the vendor catalogs without waiting for them, unless they
@@ -38923,20 +39286,25 @@ var ModelResolver = class {
    * known yet reads it from them on a later call, never waiting on the fetch.
    */
   warmPickerOptions() {
-    if (this.cachedPickerOptions || this.pickerLoad) return;
+    if (this.vendor.options || this.vendor.load) return;
     this.pickerOptions().catch(() => {
     });
   }
   async loadPickerOptions() {
+    const vendor = this.vendor;
+    const generation2 = vendor.generation;
     const { apiKeys, baseUrls } = collectProviderCredentials(this.config);
     const { models, errors } = await fetchAllProviderModels({
       apiKeys,
       baseUrls,
       fetchImpl: this.fetchImpl
     });
-    this.lastDiscoveryErrors = errors;
-    this.cachedPickerOptions = toOrchestratorOptions(models, ORCHESTRATOR_SHORTCUTS);
-    return this.cachedPickerOptions;
+    const options = toOrchestratorOptions(models, ORCHESTRATOR_SHORTCUTS);
+    if (vendor.generation === generation2) {
+      vendor.errors = errors;
+      vendor.options = options;
+    }
+    return options;
   }
   /**
    * Per-provider failures from the most recent `pickerOptions()` fetch, keyed
@@ -38945,7 +39313,7 @@ var ModelResolver = class {
    * key/endpoint is set but whose catalog could not be reached.
    */
   getDiscoveryErrors() {
-    return this.lastDiscoveryErrors;
+    return this.vendor.errors;
   }
   async refresh() {
     const options = await this.pickerOptions();
@@ -38956,8 +39324,25 @@ var ModelResolver = class {
     this.config.setProviderModelLists(lists);
     return lists;
   }
+  /** Forget every runner catalog, each workspace's included; the vendor catalogs stay. */
   refreshRunnerModels() {
-    this.discovery.clear();
+    for (const discovery of this.runnerCatalogs()) discovery.clear();
+  }
+  /**
+   * The models a pick for `provider` is judged against: a harness planner's
+   * own runner catalog, or the vendor picker catalog (ADR-0009). Discovered
+   * if not held. Never throws: a catalog that cannot be had is empty.
+   */
+  async plannerCatalog(provider) {
+    const runner = runnerForProvider(provider);
+    if (runner) return candidatesOf((await this.modelsForRunners([runner]))[runner] ?? []);
+    return (await this.pickerOptions().catch(() => [])).map((o) => ({ id: o.id }));
+  }
+  /** {@link plannerCatalog} from what is already held, so a cold catalog is empty; never discovers. */
+  cachedPlannerCatalog(provider) {
+    const runner = runnerForProvider(provider);
+    if (runner) return candidatesOf(this.getCachedRunnerModels(runner));
+    return this.getCachedPickerOptions().map((o) => ({ id: o.id }));
   }
   /**
    * Synchronous reads of whatever the last `modelsForRunners`/`pickerOptions`
@@ -38968,7 +39353,7 @@ var ModelResolver = class {
     return this.discovery.getCached(runner) ?? [];
   }
   getCachedPickerOptions() {
-    return this.cachedPickerOptions ?? [];
+    return this.vendor.options ?? [];
   }
   /**
    * A model's context window from whatever catalog is already cached (#49),
@@ -38981,7 +39366,7 @@ var ModelResolver = class {
    */
   contextWindowFor(source, model) {
     if (!model) return void 0;
-    const window2 = isApiProvider(source) ? this.cachedPickerOptions?.find((o) => o.apiProvider === source && o.id === prefixModelId(source, stripModelPrefix(model, source)))?.contextWindow : this.discovery.getCached(source)?.find((m) => m.modelId === model)?.contextWindow;
+    const window2 = isApiProvider(source) ? this.vendor.options?.find((o) => o.apiProvider === source && o.id === prefixModelId(source, stripModelPrefix(model, source)))?.contextWindow : this.discovery.getCached(source)?.find((m) => m.modelId === model)?.contextWindow;
     return window2 && window2 > 0 ? window2 : void 0;
   }
   /**
@@ -38991,14 +39376,16 @@ var ModelResolver = class {
    */
   maxOutputTokensFor(source, model) {
     if (!model || !isApiProvider(source)) return void 0;
-    const cap = this.cachedPickerOptions?.find((o) => o.apiProvider === source && o.id === prefixModelId(source, stripModelPrefix(model, source)))?.maxOutputTokens;
+    const cap = this.vendor.options?.find((o) => o.apiProvider === source && o.id === prefixModelId(source, stripModelPrefix(model, source)))?.maxOutputTokens;
     return cap && cap > 0 ? cap : void 0;
   }
+  /** Forget every catalog: the vendor ones, and each runner environment's. */
   invalidate() {
-    this.discovery.clear();
-    this.cachedPickerOptions = null;
-    this.pickerLoad = null;
-    this.lastDiscoveryErrors = {};
+    this.refreshRunnerModels();
+    this.vendor.generation++;
+    this.vendor.options = null;
+    this.vendor.load = null;
+    this.vendor.errors = {};
     if (!this.fetchImpl) {
       for (const provider of PROVIDER_PRIORITY) {
         const baseUrl = this.config.getProviderBaseUrl(provider);
@@ -39008,6 +39395,9 @@ var ModelResolver = class {
     }
   }
 };
+function candidatesOf(models) {
+  return models.map((m) => ({ id: m.modelId, variants: m.variants }));
+}
 
 // src/services/RunnerInstallation.ts
 var import_child_process12 = require("child_process");
@@ -39785,12 +40175,12 @@ function openCodeStorePaths(env, home) {
   return { db: file === ":memory:" ? null : (0, import_path9.resolve)(data, file), auth: (0, import_path9.join)(data, "auth.json") };
 }
 function openCodeGoLoginReader(deps = {}) {
-  const homedir12 = deps.homedir ?? import_os6.homedir;
+  const homedir10 = deps.homedir ?? import_os6.homedir;
   let last;
   return {
     async read(env, signal) {
       if (signal.aborted) return { kind: "unreadable" };
-      const paths = openCodeStorePaths(env, homedir12());
+      const paths = openCodeStorePaths(env, homedir10());
       const [db, wal, auth] = await Promise.all([
         paths.db ? stamp(paths.db) : null,
         paths.db ? stamp(`${paths.db}-wal`) : null,
@@ -39844,8 +40234,8 @@ function v2Login(db, row) {
     login: { route: "console", owner: digest("console", db, row.id, account, orgID ?? ""), access: value.access, ...orgID ? { orgID } : {}, expires: value.expires }
   };
 }
-async function legacyLogin(path47, env) {
-  const content = env.OPENCODE_AUTH_CONTENT ?? await readSmall(path47);
+async function legacyLogin(path48, env) {
+  const content = env.OPENCODE_AUTH_CONTENT ?? await readSmall(path48);
   if (content === void 0) return env[ENV_KEY] ? { kind: "unsupported" } : { kind: "none" };
   if (content === null) return { kind: "unreadable" };
   const auth = parseJson(content);
@@ -39854,15 +40244,15 @@ async function legacyLogin(path47, env) {
   if (entry === void 0) return env[ENV_KEY] ? { kind: "unsupported" } : { kind: "none" };
   if (!isRecord12(entry) || entry.type !== "api") return { kind: "unsupported" };
   if (typeof entry.key !== "string" || entry.key.length === 0) return { kind: "unreadable" };
-  return { kind: "login", login: { route: "key", owner: digest("v1", path47, entry.key), key: entry.key } };
+  return { kind: "login", login: { route: "key", owner: digest("v1", path48, entry.key), key: entry.key } };
 }
-function queryStore(path47, signal, deps) {
+function queryStore(path48, signal, deps) {
   return new Promise((settle) => {
     let worker;
     try {
       worker = (deps.spawnWorker ?? ((source, options) => new import_worker_threads.Worker(source, options)))(WORKER_SOURCE, {
         eval: true,
-        workerData: { path: path47, integrations: GO_INTEGRATIONS, busyMs: BUSY_MS, maxValueBytes: MAX_VALUE_BYTES },
+        workerData: { path: path48, integrations: GO_INTEGRATIONS, busyMs: BUSY_MS, maxValueBytes: MAX_VALUE_BYTES },
         execArgv: deps.workerExecArgv ?? [],
         resourceLimits: { maxOldGenerationSizeMb: 64 }
       });
@@ -39889,19 +40279,19 @@ function queryStore(path47, signal, deps) {
     worker.once("exit", aborted);
   });
 }
-async function stamp(path47) {
+async function stamp(path48) {
   try {
-    const stat = await import_fs14.promises.stat(path47);
+    const stat = await import_fs14.promises.stat(path48);
     return [stat.ino, stat.size, stat.mtimeMs];
   } catch {
     return null;
   }
 }
-async function readSmall(path47) {
+async function readSmall(path48) {
   try {
-    const stat = await import_fs14.promises.stat(path47);
+    const stat = await import_fs14.promises.stat(path48);
     if (!stat.isFile() || stat.size > MAX_AUTH_FILE_BYTES) return null;
-    return await import_fs14.promises.readFile(path47, "utf8");
+    return await import_fs14.promises.readFile(path48, "utf8");
   } catch (err) {
     return err.code === "ENOENT" ? void 0 : null;
   }
@@ -41030,20 +41420,20 @@ function createAiService(config, deps) {
 }
 
 // src/services/createSession.ts
-var path44 = __toESM(require("path"));
+var path45 = __toESM(require("path"));
 
 // src/services/handoffReferences.ts
 var fs21 = __toESM(require("fs"));
-var path42 = __toESM(require("path"));
+var path43 = __toESM(require("path"));
 var import_child_process15 = require("child_process");
 function resolveHandoffReferences(handoff, workspace) {
   const checked = /* @__PURE__ */ new Map();
   const contained = (candidate) => {
     try {
       const root = fs21.realpathSync(workspace);
-      const resolved = fs21.realpathSync(path42.resolve(root, candidate));
-      const relative17 = path42.relative(root, resolved);
-      return relative17 !== ".." && !relative17.startsWith(`..${path42.sep}`) && !path42.isAbsolute(relative17) ? resolved : void 0;
+      const resolved = fs21.realpathSync(path43.resolve(root, candidate));
+      const relative17 = path43.relative(root, resolved);
+      return relative17 !== ".." && !relative17.startsWith(`..${path43.sep}`) && !path43.isAbsolute(relative17) ? resolved : void 0;
     } catch {
       return void 0;
     }
@@ -41064,7 +41454,7 @@ function resolveHandoffReferences(handoff, workspace) {
       }
     } else if (/^[0-9a-fA-F]{4,64}$/.test(ref.sha)) {
       const repo = contained(ref.repo ?? ".");
-      if (repo && fs21.existsSync(path42.join(repo, ".git"))) {
+      if (repo && fs21.existsSync(path43.join(repo, ".git"))) {
         const result2 = (0, import_child_process15.spawnSync)("git", ["--no-optional-locks", "--no-replace-objects", "cat-file", "-t", ref.sha], {
           cwd: repo,
           encoding: "utf8",
@@ -42022,7 +42412,7 @@ function serializeTask(t) {
     ...t.loop && t.loopRound !== void 0 ? { loopRound: t.loopRound } : {}
   };
 }
-function serializeTaskStatus(t, idleSince = null, isolation = null, queued = [], awaitingApproval = 0, mergeGate2 = [], checkpoint = "", waitsForApproval2 = false, holdReason = null, completionReceived = null) {
+function serializeTaskStatus(t, idleSince = null, isolation = null, queued = [], awaitingApproval = 0, mergeGate2 = [], checkpoint = "", waitsForApproval2 = false, holdReason = null, completionReceived = null, attaching = null) {
   return {
     id: t.id,
     type: t.type,
@@ -42030,6 +42420,7 @@ function serializeTaskStatus(t, idleSince = null, isolation = null, queued = [],
     verdict: t.verdict ? { outcome: t.verdict.outcome, reason: t.verdict.reason, checks: t.verdict.checks || [], ...t.verdict.reported ? { reported: t.verdict.reported } : {} } : null,
     idleSince,
     ...completionReceived ? { completionReceived } : {},
+    ...attaching ? { attaching } : {},
     ...t.attempted ? { attempted: true } : {},
     ...t.attemptUsage ? { attemptUsage: structuredClone(t.attemptUsage) } : {},
     ...isolation ? { isolation } : {},
@@ -42059,7 +42450,7 @@ function surfacePendingTurns(pending) {
 function surfaceTask({ attemptSkills, subtasks, runnerSessionId: _runnerSessionId, ...task2 }) {
   return {
     ...task2,
-    ...attemptSkills ? { attemptSkills: attemptSkills.map(({ name, source, path: path47 }) => ({ name, source, path: path47 })) } : {},
+    ...attemptSkills ? { attemptSkills: attemptSkills.map(({ name, source, path: path48 }) => ({ name, source, path: path48 })) } : {},
     subtasks: (subtasks ?? []).map(surfaceTask)
   };
 }
@@ -42479,8 +42870,8 @@ var RunSupervision = class {
 
 // src/services/runView.ts
 var EMPTY_RUN = { tasks: [], runMerge: null, handoff: null, mergeResult: null, activity: IDLE_ACTIVITY };
-function split({ verdict, idleSince, completionReceived, isolation, checkpoint, queued, continuable, awaitingApproval, mergeGate: mergeGate2, forcedPastGate, waitsForApproval: waitsForApproval2, holdReason, handoff, attempted, ...plan }) {
-  return { plan, status: { verdict, idleSince, completionReceived, isolation, checkpoint, queued, continuable, awaitingApproval, mergeGate: mergeGate2, forcedPastGate, waitsForApproval: waitsForApproval2, holdReason, handoff, attempted } };
+function split({ verdict, idleSince, completionReceived, attaching, isolation, checkpoint, queued, continuable, awaitingApproval, mergeGate: mergeGate2, forcedPastGate, waitsForApproval: waitsForApproval2, holdReason, handoff, attempted, ...plan }) {
+  return { plan, status: { verdict, idleSince, completionReceived, attaching, isolation, checkpoint, queued, continuable, awaitingApproval, mergeGate: mergeGate2, forcedPastGate, waitsForApproval: waitsForApproval2, holdReason, handoff, attempted } };
 }
 function refresh(previous, tasks) {
   const held2 = new Map([...walkPlan(previous)].map(({ task: task2 }) => [task2.id, task2]));
@@ -42716,7 +43107,8 @@ var SessionEventRelay = class {
         this.checkpointQuestion(t.id),
         this.waitsForApproval(t.id),
         this.orchestrator.holdReason(t.id),
-        this.orchestrator.getCompletionReceipt(t.id)
+        this.orchestrator.getCompletionReceipt(t.id),
+        this.orchestrator.getToolsAttaching(t.id)
       )),
       ...runMerge ? { runMerge } : {},
       activity: this.orchestrator.activity
@@ -42838,10 +43230,10 @@ var SessionEventRelay = class {
 
 // src/utils/taskLogStore.ts
 var fs22 = __toESM(require("fs"));
-var path43 = __toESM(require("path"));
+var path44 = __toESM(require("path"));
 var EXTENSION = ".jsonl";
 function taskDir({ baseDir, sessionId }, taskId) {
-  return path43.join(sessionDataDir(sessionId, baseDir), "tasks", idSegment(taskId));
+  return path44.join(sessionDataDir(sessionId, baseDir), "tasks", idSegment(taskId));
 }
 function listTaskLogAttempts(location, taskId) {
   let names;
@@ -42859,7 +43251,7 @@ function openTaskLog(location, taskId, attempt) {
   const next = (listTaskLogAttempts(location, taskId).pop() ?? 0) + 1;
   let number = attempt !== void 0 && Number.isInteger(attempt) && attempt >= 1 ? attempt : next;
   for (; ; ) {
-    const file = path43.join(dir, `${number}${EXTENSION}`);
+    const file = path44.join(dir, `${number}${EXTENSION}`);
     try {
       fs22.writeFileSync(file, "", { flag: "wx" });
     } catch (err) {
@@ -42883,15 +43275,15 @@ function prepareTaskOutputFile(location, taskId, attempt) {
   ensureStateDirIgnored(location.baseDir);
   const dir = taskDir(location, taskId);
   fs22.mkdirSync(dir, { recursive: true });
-  return path43.join(dir, `${attempt}.output.txt`);
+  return path44.join(dir, `${attempt}.output.txt`);
 }
 function taskPatchFile(location, taskId, attempt) {
-  return path43.join(taskDir(location, taskId), `${attempt}.patch`);
+  return path44.join(taskDir(location, taskId), `${attempt}.patch`);
 }
 function saveTaskPatch(location, taskId, attempt, patch) {
   ensureStateDirIgnored(location.baseDir);
   const file = taskPatchFile(location, taskId, attempt);
-  fs22.mkdirSync(path43.dirname(file), { recursive: true });
+  fs22.mkdirSync(path44.dirname(file), { recursive: true });
   const partial = `${file}.${process.pid}-${Date.now()}.partial`;
   fs22.writeFileSync(partial, patch, { flag: "wx" });
   fs22.renameSync(partial, file);
@@ -42912,7 +43304,7 @@ function readTaskLog(location, taskId, attempt) {
   if (!Number.isInteger(attempt) || attempt < 1) return [];
   let raw;
   try {
-    raw = fs22.readFileSync(path43.join(taskDir(location, taskId), `${attempt}${EXTENSION}`), "utf-8");
+    raw = fs22.readFileSync(path44.join(taskDir(location, taskId), `${attempt}${EXTENSION}`), "utf-8");
   } catch {
     return [];
   }
@@ -44974,7 +45366,7 @@ function createSession(deps) {
     ...deps.openTaskLog ? {} : {
       keepPatch: (taskId, attempt, patch) => {
         const location = session.taskLogLocation;
-        return path44.relative(location.baseDir, saveTaskPatch(location, taskId, attempt, patch)).split(path44.sep).join("/");
+        return path45.relative(location.baseDir, saveTaskPatch(location, taskId, attempt, patch)).split(path45.sep).join("/");
       }
     },
     recordHandoff: (sessionId, taskId, handoff) => taskLogs.note(sessionId, taskId, { type: "handoff", handoff }),
@@ -47842,6 +48234,7 @@ function taskRowView(task2, context = {}) {
     resumes: resumeLabel(task2, context.now),
     approvals: approvalLabel(task2.awaitingApproval),
     receipt: receiptLabel(task2),
+    attaching: attachingLabel(task2),
     waitsForApproval: task2.waitsForApproval && NOT_STARTED.has(task2.status) ? WAITS_FOR_APPROVAL_LABEL : null,
     holdReason: task2.holdReason?.trim() || null,
     research: task2.type === "ai" && task2.research === true,
@@ -48155,6 +48548,7 @@ var StructuredSession = class extends AbstractRunnerSession {
    */
   async startAttached(opts) {
     const { server: server4, scope, shell, savePatch, webReads } = this.launch.tools;
+    this.launch.onAttaching?.(1);
     const spawned = await spawnAttached({
       runner: this.launch.runner,
       create: () => this.launch.createAdapter(this.launch.runner, this.launch.deps),
@@ -48191,7 +48585,10 @@ var StructuredSession = class extends AbstractRunnerSession {
       },
       cancelled: this.ended.signal,
       startupExit: () => this.startupExit,
-      onRespawn: (failure2) => this.launch.onNotice?.(`${this.launch.runner} started without Ordewell's tools (${failure2}); respawning once.`),
+      onRespawn: (failure2) => {
+        this.launch.onNotice?.(`${this.launch.runner} started without Ordewell's tools (${failure2}); respawning once.`);
+        this.launch.onAttaching?.(2);
+      },
       failed: (first, second) => `Could not start ${this.launch.runner} with Ordewell's tools, so the task was not sent to it. First spawn: ${first}. Respawn: ${second}.`
     });
     if (!spawned) return;
@@ -48774,16 +49171,22 @@ var StructuredRunner = class extends AbstractRunner {
       checkHandoff: opts.checkHandoff ?? ((completion) => checkHandoff(completion, opts.taskId, [])),
       ...opts.readTask ? { readTask: opts.readTask } : {},
       ...opts.applyPatch ? { applyPatch: opts.applyPatch } : {},
-      onNotice: opts.onNotice
+      onNotice: opts.onNotice,
+      onAttaching: opts.onAttaching
     });
     console.error(`[structured] Starting ${opts.runner} [${opts.mode ?? "default"}] (${opts.modelId || "default"}) for task ${opts.taskId.slice(0, 8)}`);
     this.registerSession(id2, session);
+    const cancel = () => void session.stop();
+    opts.cancelled?.addEventListener("abort", cancel, { once: true });
     try {
+      if (opts.cancelled?.aborted) cancel();
       await session.start(opts.prompt);
     } catch (err) {
       session.kill();
       this.sessions.delete(id2);
       throw err;
+    } finally {
+      opts.cancelled?.removeEventListener("abort", cancel);
     }
     return session;
   }
@@ -48857,7 +49260,7 @@ var RunnerRegistry = class {
 
 // src/plugins/removedPluginNotice.ts
 var fs23 = __toESM(require("fs"));
-var path45 = __toESM(require("path"));
+var path46 = __toESM(require("path"));
 function isManifestFile(file) {
   try {
     return fs23.statSync(file).isFile();
@@ -48866,10 +49269,10 @@ function isManifestFile(file) {
   }
 }
 function removedPluginNotice(dataDir = globalDataDir()) {
-  const directory = path45.join(dataDir, "plugins");
+  const directory = path46.join(dataDir, "plugins");
   try {
-    const hasManifest = isManifestFile(path45.join(directory, "manifest.json")) || fs23.readdirSync(directory, { withFileTypes: true }).some(
-      (entry) => (entry.isDirectory() || entry.isSymbolicLink()) && isManifestFile(path45.join(directory, entry.name, "manifest.json"))
+    const hasManifest = isManifestFile(path46.join(directory, "manifest.json")) || fs23.readdirSync(directory, { withFileTypes: true }).some(
+      (entry) => (entry.isDirectory() || entry.isSymbolicLink()) && isManifestFile(path46.join(directory, entry.name, "manifest.json"))
     );
     if (hasManifest) return "Plugin runners were removed; manifests in ~/.ordewell/plugins/ are ignored. See the CHANGELOG.";
   } catch {
@@ -48880,15 +49283,15 @@ function removedPluginNotice(dataDir = globalDataDir()) {
 
 // src/utils/stateStore.ts
 var fs24 = __toESM(require("fs"));
-var path46 = __toESM(require("path"));
+var path47 = __toESM(require("path"));
 var STATE_FILE2 = "state.json";
 function getStatePath(baseDir) {
-  return path46.join(getStateDir(baseDir), STATE_FILE2);
+  return path47.join(getStateDir(baseDir), STATE_FILE2);
 }
 var SESSION_ID_KEY = "sessionId";
 function saveState(plan, baseDir, sessionId) {
   const statePath = getStatePath(baseDir ?? process.cwd());
-  ensureDir(path46.dirname(statePath));
+  ensureDir(path47.dirname(statePath));
   plan.lastUpdated = (/* @__PURE__ */ new Date()).toISOString();
   const file = sessionId ? { ...plan, [SESSION_ID_KEY]: sessionId } : plan;
   dropRetiredPlanFields(file);
@@ -49175,6 +49578,7 @@ var PlannerModelMemory = class {
   assignedRunnerOf,
   assignmentIssue,
   assignmentIssueText,
+  attachingLabel,
   augmentedPath,
   automergeSummary,
   autonomyLevelLabel,