@ordewell/core 0.11.1 → 0.11.3

package/dist/index.mjs

@@ -47,6 +47,7 @@ import {
   assignmentConsequence,
   assignmentIssue,
   assignmentIssueText,
+  attachingLabel,
   automergeSummary,
   autorunSummary,
   awaitingLabel,
@@ -231,7 +232,7 @@ import {
   withPatch,
   withoutSealedMark,
   worstSeverity
-} from "./chunk-4QXOWEGC.mjs";
+} from "./chunk-7WNLN63J.mjs";
 import {
   DEFAULT_LOOP_ROUNDS,
   DEFAULT_SCRIPT_TIMEOUT_MS,
@@ -918,9 +919,9 @@ function literalCdTarget(seg) {
   return target === "" || target.startsWith("-") || target.startsWith("~") || /[*?[]/.test(target) ? void 0 : target;
 }
 function followCd(segments) {
-  if (segments.some((s) => s.joinedBy === "other" || SHELL_STATE_COMMANDS.has(s.binary))) return;
+  if (segments.some((s) => s.joinedBy === "other" || movesShell(s))) return;
   const inPipeline = (i) => segments[i].joinedBy === "pipe" || segments[i + 1]?.joinedBy === "pipe";
-  if (segments.some((s, i) => s.binary === "cd" && !inPipeline(i) && literalCdTarget(s) === void 0)) return;
+  if (segments.some((s, i) => s.binary.toLowerCase() === "cd" && !inPipeline(i) && literalCdTarget(s) === void 0)) return;
   let chain = [];
   segments.forEach((seg, i) => {
     seg.cwd = chain;
@@ -929,7 +930,7 @@ function followCd(segments) {
   });
 }
 function markShellState(segments, bareSegment) {
-  if (!bareSegment && !segments.some((s) => SHELL_STATE_COMMANDS.has(s.binary))) return;
+  if (!bareSegment && !segments.some(movesShell)) return;
   for (const seg of segments) if (seg.binary === "cd") seg.cdSteered = true;
 }
 var SHELL_STATE_COMMANDS = /* @__PURE__ */ new Set([
@@ -948,6 +949,7 @@ var SHELL_STATE_COMMANDS = /* @__PURE__ */ new Set([
   "exec",
   "pushd",
   "popd",
+  "chdir",
   "alias",
   "unalias",
   "builtin",
@@ -956,6 +958,9 @@ var SHELL_STATE_COMMANDS = /* @__PURE__ */ new Set([
   "hash",
   "trap"
 ]);
+function movesShell(seg) {
+  return SHELL_STATE_COMMANDS.has(seg.binary.toLowerCase());
+}
 
 // src/services/commandRunners.ts
 var HELP_FLAGS = ["--help", "--version"];
@@ -1811,8 +1816,9 @@ var FLAG_POLICY = {
   sort: {
     cluster: true,
     // Absent on purpose: `-o`/`--output` writes a file with no redirect for the
-    // redirect check to see, and `--compress-program` names a program that sort
-    // runs over its own temporary files — a permitted binary as an interpreter.
+    // redirect check to see, `-T`/`--temporary-directory` names where sort writes
+    // its run files, and `--compress-program` names a program that sort runs
+    // over its own temporary files — a permitted binary as an interpreter.
     booleans: [
       "-b",
       "-c",
@@ -1851,11 +1857,9 @@ var FLAG_POLICY = {
       "-k",
       "-t",
       "-S",
-      "-T",
       "--key",
       "--field-separator",
       "--buffer-size",
-      "--temporary-directory",
       "--random-source",
       "--batch-size",
       "--parallel",
@@ -2482,23 +2486,28 @@ function scanFlags(seg) {
   const booleans = /* @__PURE__ */ new Set([...spec.booleans ?? [], ...UNIVERSAL_FLAGS]);
   const values = new Set(spec.values ?? []);
   const operands = [];
+  const operandAt = [];
+  const operand = (at) => {
+    operands.push(seg.args[at]);
+    operandAt.push(at);
+  };
   let i = 0;
   while (i < seg.args.length) {
     const token = seg.args[i];
     if (token === "--" && !spec.expressionArgs) {
-      operands.push(...seg.args.slice(i + 1));
+      for (let j = i + 1; j < seg.args.length; j++) operand(j);
       break;
     }
     if (!/^-./.test(token)) {
-      operands.push(token);
+      operand(i);
       i++;
       continue;
     }
     const shape = matchFlag(spec, booleans, values, token);
-    if (shape === void 0) return { unknown: flagLabel(token), operands };
+    if (shape === void 0) return { unknown: flagLabel(token), operands, operandAt };
     i += shape === "value" && takesNextToken(seg.args[i + 1]) ? 2 : 1;
   }
-  return { operands };
+  return { operands, operandAt };
 }
 function subcommandOf(seg) {
   const scan = scanFlags(seg);
@@ -2651,6 +2660,8 @@ function sedRefusalFor(binary, scripts) {
       return `The "${binary}" script runs a shell command (the "e" command or the "e" flag of "s"), which this classifier cannot inspect. ${INSPECT_OR_TASK}`;
     case "write":
       return `The "${binary}" script writes a file (the "w"/"W" command or the "w" flag of "s"). You are a read-only planner \u2014 print the output instead, or describe the write as a task.`;
+    case "read":
+      return `The "${binary}" script reads a file it names itself (the "r"/"R" command), which path confinement cannot see. Read that file directly instead.`;
     default:
       return `This classifier could not read the "${binary}" script well enough to rule out a shell command or a file write in it. Rewrite it with plain print, delete and substitute commands, or describe the work as a task.`;
   }
@@ -2771,6 +2782,7 @@ function sedScriptHazard(script) {
     if (cmd === void 0) return "unreadable";
     if (cmd === "e") return "exec";
     if (cmd === "w" || cmd === "W") return "write";
+    if (cmd === "r" || cmd === "R") return "read";
     if (cmd === "{" || cmd === "}") continue;
     if (cmd === "#") {
       while (i < n && script[i] !== "\n") i++;
@@ -2792,7 +2804,7 @@ function sedScriptHazard(script) {
       if (!commandEnds()) return "unreadable";
       continue;
     }
-    if ("aicrR".includes(cmd)) {
+    if ("aic".includes(cmd)) {
       while (i < n && script[i] !== "\n") i += script[i] === "\\" ? 2 : 1;
       continue;
     }
@@ -2892,6 +2904,12 @@ function awkRefusalFor(binary, programs) {
         return `The "${binary}" program pipes to or from a command ("|"), which runs it through a shell this classifier cannot inspect. ${INSPECT_OR_TASK}`;
       case "write":
         return `The "${binary}" program redirects its output to a file (">"). You are a read-only planner \u2014 print to standard output instead, or describe the write as a task.`;
+      case "read":
+        return `The "${binary}" program reads a file it names itself ("getline <" or an "ARGV" entry), which path confinement cannot see. Name the file as an operand instead.`;
+      case "environment":
+        return `The "${binary}" program reads the environment ("ENVIRON"), which holds credentials. Run printenv for the one variable you need, which asks first.`;
+      case "symbol-table":
+        return `The "${binary}" program uses "SYMTAB", which gawk reads as every global by name, "ENVIRON" and "ARGV" included. Name the variable you need directly.`;
       case "extension":
         return `The "${binary}" program uses an "@" form, which loads an extension, includes a source file or calls a function by name \u2014 none of which this classifier can inspect. ${INSPECT_OR_TASK}`;
       default:
@@ -2933,6 +2951,7 @@ function awkProgramHazard(program) {
   let slash = "regex";
   let depth = 0;
   let printDepth;
+  let getlineDepth;
   let continues = false;
   const readRegex = () => {
     i++;
@@ -2999,7 +3018,10 @@ function awkProgramHazard(program) {
       continue;
     }
     if (c === "\n" || c === ";") {
-      if (c === ";" || !continues) printDepth = void 0;
+      if (c === ";" || !continues) {
+        printDepth = void 0;
+        getlineDepth = void 0;
+      }
       slash = "regex";
       i++;
       continue;
@@ -3050,6 +3072,12 @@ function awkProgramHazard(program) {
       slash = "unclear";
       continue;
     }
+    if (c === "<") {
+      if (getlineDepth !== void 0 && depth >= getlineDepth) return "read";
+      i++;
+      slash = "unclear";
+      continue;
+    }
     if (c === "(" || c === "[") {
       depth++;
       i++;
@@ -3058,12 +3086,16 @@ function awkProgramHazard(program) {
     }
     if (c === ")" || c === "]") {
       depth--;
+      if (getlineDepth !== void 0 && depth < getlineDepth) getlineDepth = void 0;
       i++;
       slash = "divide";
       continue;
     }
     if (c === "{" || c === "}") {
-      if (c === "}") printDepth = void 0;
+      if (c === "}") {
+        printDepth = void 0;
+        getlineDepth = void 0;
+      }
       i++;
       slash = "regex";
       continue;
@@ -3084,6 +3116,10 @@ function awkProgramHazard(program) {
       while (i < n && /[A-Za-z0-9_.]/.test(program[i])) i++;
       const word = program.slice(start, i);
       if (word === "system") return "exec";
+      if (word === "ENVIRON") return "environment";
+      if (word === "ARGV") return "read";
+      if (word === "SYMTAB") return "symbol-table";
+      if (word === "getline") getlineDepth = depth;
       if (word === "print" || word === "printf") printDepth = depth;
       slash = AWK_KEYWORDS.includes(word) ? "unclear" : "divide";
       continue;
@@ -3970,6 +4006,36 @@ var GIT_READONLY_SUBCOMMANDS = [
   "whatchanged",
   "cat-file"
 ];
+var onlyAction = (...reads) => (after) => after[0] === void 0 || reads.includes(after[0]);
+var GIT_PROMPTABLE = {
+  "ls-remote": () => true,
+  "for-each-ref": () => true,
+  "show-ref": () => true,
+  "name-rev": () => true,
+  "merge-base": () => true,
+  "count-objects": () => true,
+  "cherry": () => true,
+  "range-diff": () => true,
+  "diff-tree": () => true,
+  "diff-files": () => true,
+  "diff-index": () => true,
+  "show-branch": () => true,
+  "annotate": () => true,
+  "check-ignore": () => true,
+  "check-attr": () => true,
+  "check-ref-format": () => true,
+  "check-mailmap": () => true,
+  "var": () => true,
+  "version": () => true,
+  "worktree": onlyAction("list"),
+  "notes": onlyAction("list", "show"),
+  "bisect": onlyAction("log"),
+  "sparse-checkout": onlyAction("list"),
+  "reflog": onlyAction("show", "exists"),
+  "symbolic-ref": (after) => after.filter((a) => !a.startsWith("-")).length <= 1,
+  // `-w` writes the object; git's shared flag set keeps it for `git diff -w`.
+  "hash-object": (after) => !after.some((a) => /^-[^-]*w/.test(a))
+};
 var REFUSED_COMMANDS = [
   "rm",
   "rmdir",
@@ -4061,7 +4127,28 @@ var REFUSED_SUBCOMMANDS = {
     "clone",
     "fetch",
     "pull",
-    "submodule"
+    "submodule",
+    "add",
+    "rm",
+    "mv",
+    "format-patch",
+    "replace",
+    "mergetool",
+    "repack",
+    "update-index",
+    "read-tree",
+    "checkout-index",
+    "merge-file",
+    "bundle",
+    "commit-tree",
+    "write-tree",
+    "mktree",
+    "mktag",
+    "unpack-objects",
+    "fast-import",
+    "pack-refs",
+    "prune-packed",
+    "maintenance"
   ],
   npm: ["publish", "unpublish", "deprecate", "owner", "access", "token", "login", "logout"],
   yarn: ["publish", "npm"],
@@ -4271,7 +4358,7 @@ function pathRefs(command, opts = {}) {
   return lexAll(command.trim(), dialect, opts.cdpathSet).segments.flatMap((seg) => {
     const patterns = patternArgs(seg);
     const cwd = seg.cwd ?? [];
-    return [...seg.args.filter((_, i) => !patterns.has(i)), ...seg.inputs].flatMap(pathIn).map((path46) => ({ path: path46, cwd }));
+    return [...seg.args.filter((_, i) => !patterns.has(i)), ...seg.inputs].flatMap(pathIn).map((path49) => ({ path: path49, cwd }));
   });
 }
 function excludedBy(command, allow, opts = {}) {
@@ -4378,7 +4465,9 @@ function patternArgs(seg) {
 var SCOPE_LEAD_ARGS = 2;
 function scopeFor(seg) {
   const name = seg.binaryPath ?? seg.binary;
-  if (!MULTIPLEXERS.includes(seg.binary.toLowerCase())) return name;
+  const program = programName(seg.binary);
+  if (!MULTIPLEXERS.includes(program)) return name;
+  if (program === "git") return gitScope(seg, name);
   const lead = [];
   for (const arg of seg.args) {
     if (arg.startsWith("-")) break;
@@ -4387,6 +4476,14 @@ function scopeFor(seg) {
   }
   return [name, ...lead].join(" ");
 }
+function gitScope(seg, name) {
+  const scan = scanFlags({ ...seg, binary: "git" });
+  if (!scan || scan.unknown || scan.operands[0] === "ls-remote") return [name, ...seg.args].map(scopeWord).join(" ");
+  return [name, ...scan.operands.slice(0, SCOPE_LEAD_ARGS)].join(" ");
+}
+function scopeWord(word) {
+  return word === "" || /[\s"'\\]/.test(word) ? JSON.stringify(word) : word;
+}
 function climbsByGlob(seg) {
   if (!seg.globbed) return false;
   const patterns = patternArgs(seg);
@@ -4408,6 +4505,27 @@ function swallowsRefName(arg) {
   const values = FLAG_POLICY.git.values ?? [];
   return [...arg.slice(1)].some((c) => c !== "n" && values.includes(`-${c}`));
 }
+function gitArgsAfterSubcommand(seg) {
+  const at = scanFlags(seg)?.operandAt[0];
+  return at === void 0 ? [] : seg.args.slice(at + 1);
+}
+var REMOTE_NAME = /^[A-Za-z0-9_][A-Za-z0-9_.-]*$/;
+function namesConfiguredRemote(seg, after) {
+  const destination2 = scanFlags({ ...seg, args: after })?.operands[0];
+  return destination2 === void 0 || REMOTE_NAME.test(destination2);
+}
+function programName(binary) {
+  return binary.toLowerCase().replace(/\.exe$/, "");
+}
+function isRemoteListing(seg) {
+  const git2 = { ...seg, binary: programName(seg.binary) };
+  return git2.binary === "git" && subcommandOf(git2) === "ls-remote";
+}
+function remoteListingTexts(seg) {
+  if (!isRemoteListing(seg)) return [];
+  const git2 = { ...seg, binary: "git" };
+  return scanFlags({ ...git2, args: gitArgsAfterSubcommand(git2) })?.operands ?? [];
+}
 function refusalFor(seg, trustedResolves) {
   const web = webCommand(seg, trustedResolves);
   if (web?.reason) return web.reason;
@@ -4445,8 +4563,24 @@ function refusalFor(seg, trustedResolves) {
   }
   if (seg.binary === "git") {
     const sub = subcommandOf(seg);
+    const after = gitArgsAfterSubcommand(seg);
+    if (sub !== void 0 && !GIT_READONLY_SUBCOMMANDS.includes(sub)) {
+      const reads = GIT_PROMPTABLE[sub];
+      if (!reads) {
+        return `"git ${sub}" is not a git subcommand known only to read, so it may write the repository. You are a read-only planner: ${EFFECT_ROUTE}`;
+      }
+      if (!reads(after)) {
+        return `"git ${[sub, ...after].join(" ")}" is not a read-only form of "git ${sub}". You are a read-only planner: ${EFFECT_ROUTE}`;
+      }
+    }
+    if (sub === "ls-remote" && !namesConfiguredRemote(seg, after)) {
+      return `"git ls-remote" given a URL, an address or a path reaches it through git's own transport, which resolves the host itself and follows a redirect, so the origin approval, address guard and pinned connection a web read gets (ADR-0027) cannot hold for it. Name a remote the repository configures, such as "git ls-remote origin", or fetch the page with your web fetch tool.`;
+    }
+    if (sub === "ls-remote" && (seg.expandable || seg.globbed || after.some((a) => a.includes("~")))) {
+      return `The shell rewrites part of this "git ls-remote" before git sees it (a variable, substitution, glob or "~"), so what it sends the remote, and which repository it lists, cannot be checked for a secret or approved. Write the remote and patterns literally, in single quotes where they hold a "*", and re-run.`;
+    }
     if (sub === "branch" || sub === "tag") {
-      const flag2 = seg.args.find((a) => ["-D", "-d", "-m", "-M", "--delete", "--move"].includes(a)) ?? seg.args.slice(seg.args.indexOf(sub) + 1).find(swallowsRefName);
+      const flag2 = seg.args.find((a) => ["-D", "-d", "-m", "-M", "--delete", "--move"].includes(a)) ?? after.find(swallowsRefName);
       if (flag2) {
         return `"git ${sub} ${flag2}" mutates refs. You are a read-only planner: ${EFFECT_ROUTE}`;
       }
@@ -4585,10 +4719,10 @@ function classifyCommand(command, opts = {}) {
       return { tier: "refuse", scope: "", reason: `curl and wget are refused in Full and allowlist mode. ${web.effect ? EFFECT_REFUSAL_HINT : READ_REFUSAL_HINT}` };
     }
     const allow = opts.allow;
-    if (web && allow && web.urls.some((url) => scopeExcluded(allow, `${seg.binary.toLowerCase().replace(/\.exe$/, "")} ${url.origin}/*`))) {
+    if (web && allow && web.urls.some((url) => scopeExcluded(allow, `${programName(seg.binary)} ${url.origin}/*`))) {
       return { tier: "refuse", scope: "", reason: `The web origin is excluded by the planner allowlist. ${READ_REFUSAL_HINT}` };
     }
-    const reason = refusalFor({ ...seg, binary: seg.binary.toLowerCase() }, opts.trustedWebResolves);
+    const reason = refusalFor({ ...seg, binary: programName(seg.binary) }, opts.trustedWebResolves);
     if (reason) return { tier: "refuse", scope: "", reason: withWrapperNote(reason, wrappers) };
     if (runner && !XARGS_TARGETS.includes(seg.binary)) {
       return {
@@ -4598,23 +4732,24 @@ function classifyCommand(command, opts = {}) {
       };
     }
   }
-  if (unwrapped.some(({ seg }) => seg.binary.toLowerCase().replace(/\.exe$/, "") === "wget") && wgetVersionCommands(command, opts.dialect).includes(void 0)) {
+  if (unwrapped.some(({ seg }) => programName(seg.binary) === "wget") && wgetVersionCommands(command, opts.dialect).includes(void 0)) {
     return { tier: "refuse", scope: "", reason: `The wget executable cannot be checked safely in this working directory. ${READ_REFUSAL_HINT}` };
   }
   const nonAuto = unwrapped.filter((u) => u.runner !== void 0 || u.wrappers.some((w) => w !== w.toLowerCase()) || !isAuto(u.seg, opts));
   if (nonAuto.length === 0) return { tier: "auto", scope: "" };
+  const changesDirectory = unwrapped.some(({ seg }) => seg.binary.toLowerCase() === "cd");
   const lineScoped = nonAuto.some((u) => {
     const name = u.seg.binary.toLowerCase();
-    return name === "cd" || name !== "command" && SHELL_STATE_COMMANDS.has(name) || climbsByGlob(u.seg);
+    return name === "cd" || name !== "command" && SHELL_STATE_COMMANDS.has(name) || climbsByGlob(u.seg) || isRemoteListing(u.seg) && (changesDirectory || u.wrappers.length > 0 || nonAuto.length > 1);
   });
   const webUrls = nonAuto.flatMap((u) => webCommand(u.seg, opts.trustedWebResolves)?.urls ?? []);
-  const webOutboundTexts = nonAuto.flatMap((u) => webCommand(u.seg, opts.trustedWebResolves)?.outboundTexts ?? []);
+  const outboundTexts = nonAuto.flatMap((u) => webCommand(u.seg, opts.trustedWebResolves)?.outboundTexts ?? remoteListingTexts(u.seg));
   if (lineScoped && webUrls.length === 0) {
-    return { tier: "ask", scope: trimmed };
+    return { tier: "ask", scope: trimmed, ...outboundTexts.length ? { outboundTexts } : {} };
   }
   const scopes = [...new Set(nonAuto.flatMap((u) => {
     const web = webCommand(u.seg, opts.trustedWebResolves);
-    return web ? web.urls.map((url) => `${u.seg.binary.toLowerCase().replace(/\.exe$/, "")} ${url.origin}/*`) : [lineScoped ? trimmed : u.runner ? `${u.runner} ${scopeFor(u.seg)}` : scopeFor(u.seg)];
+    return web ? web.urls.map((url) => `${programName(u.seg.binary)} ${url.origin}/*`) : [lineScoped ? trimmed : u.runner ? `${u.runner} ${scopeFor(u.seg)}` : scopeFor(u.seg)];
   }))].sort();
   const scope = scopes.join(" + ");
   const perInvocation = nonAuto.some((u) => webCommand(u.seg, opts.trustedWebResolves)?.perInvocation);
@@ -4622,7 +4757,8 @@ function classifyCommand(command, opts = {}) {
   return {
     tier: "ask",
     scope,
-    ...webUrls.length ? { webUrls, webOutboundTexts } : {},
+    ...webUrls.length ? { webUrls } : {},
+    ...outboundTexts.length ? { outboundTexts } : {},
     ...scopes.length > 1 && webUrls.length ? { scopes } : {},
     ...perInvocation ? { perInvocation } : {},
     ...allowedBy ? { allowedBy } : {}
@@ -6176,7 +6312,7 @@ ${TASK_CONTINUE}`);
     command = disableWebCommandStartup(command, this.researchShell.dialect);
     const { approval, root } = site;
     const allow = approval.allowlist?.();
-    const { tier, scope, reason, allowedBy, perInvocation, scopes: commandScopes, webUrls, webOutboundTexts } = classifyCommand(command, {
+    const { tier, scope, reason, allowedBy, perInvocation, scopes: commandScopes, webUrls, outboundTexts } = classifyCommand(command, {
       ...this.policyOptions(),
       ...approval.commandPolicy?.(),
       ...allow ? { allow } : {}
@@ -6201,8 +6337,9 @@ ${TASK_CONTINUE}`);
     if (site.task?.sealed) return this.runSealed(site, command, request, "after", signal);
     if (tier === "refuse") return this.sealedInstead(site, command, request, refusal(`Command refused: ${reason}${site.task ? `
 ${TASK_UNSEALED} ${TASK_CONTINUE}` : ""}`), signal);
-    if (webUrls?.length && carriesSecret([...webOutboundTexts ?? [], ...webUrls.map((url) => url.href)], [...this.outboundSecrets(), ...sensitiveEnvValues(process.env)])) {
-      return refusal("Command refused: a web command contains what looks like a secret. Fetch the page with your web fetch tool, without credentials.");
+    const outbound = [...outboundTexts ?? [], ...(webUrls ?? []).map((url) => url.href)];
+    if (outbound.length && carriesSecret(outbound, [...this.outboundSecrets(), ...sensitiveEnvValues(process.env)])) {
+      return refusal(webUrls?.length ? "Command refused: a web command contains what looks like a secret. Fetch the page with your web fetch tool, without credentials." : "Command refused: what this command sends over the network contains what looks like a secret. Run it without the value.");
     }
     const vettedAddresses = /* @__PURE__ */ new Map();
     for (const url of webUrls ?? []) {
@@ -6305,7 +6442,7 @@ ${outcome.output}${outcome.success ? "" : `
     }
     let shell;
     try {
-      const sealed = site.task?.gitBefore ? { ...site.sealed, gitEntries: site.task.gitBefore.entries.map(({ path: path46, directory }) => ({ path: path46, directory })) } : site.sealed;
+      const sealed = site.task?.gitBefore ? { ...site.sealed, gitEntries: site.task.gitBefore.entries.map(({ path: path49, directory }) => ({ path: path49, directory })) } : site.sealed;
       shell = await site.sandbox.launchSealed(this.researchShell, sealed);
     } catch (err) {
       return { refused: refusal(`Command not run: its sealed sandbox could not be prepared (${err instanceof Error ? err.message : String(err)}).`) };
@@ -7984,6 +8121,7 @@ function enabledRunners(cfg) {
 }
 
 // src/plugins/builtin/claudeModels.ts
+import * as path12 from "path";
 var ANTHROPIC_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 var ANTHROPIC_VARIANT_LABELS = {
   adaptive: "Adaptive",
@@ -8077,6 +8215,53 @@ function parseClaudeHelp(stdout) {
   }
   return models;
 }
+function claudeConfigDir(env) {
+  return env.CLAUDE_CONFIG_DIR?.trim() || "~/.claude";
+}
+function claudeManagedSettingsDir(platform = process.platform) {
+  if (platform === "darwin") return "/Library/Application Support/ClaudeCode";
+  if (platform === "win32") return "C:\\Program Files\\ClaudeCode";
+  return "/etc/claude-code";
+}
+function readClaudeSettingsModels(files, platform = process.platform) {
+  const managed = claudeManagedSettingsDir(platform);
+  const join45 = platform === "win32" ? path12.win32.join : path12.posix.join;
+  const dropIns = files.list(join45(managed, "managed-settings.d")).filter((name) => name.endsWith(".json") && !name.startsWith(".")).sort().map((name) => join45(managed, "managed-settings.d", name));
+  const ranked = [...dropIns.reverse(), join45(managed, "managed-settings.json"), join45(claudeConfigDir(files.env), "settings.json")];
+  for (const file of ranked) {
+    const content = files.read(file);
+    const lineup = content === null ? null : parseClaudeSettingsModels(content);
+    if (lineup) return lineup;
+  }
+  return [];
+}
+function parseClaudeSettingsModels(content) {
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return null;
+  }
+  const picker = parsed && typeof parsed === "object" ? parsed.modelPicker : void 0;
+  const options = picker && typeof picker === "object" ? picker.options : void 0;
+  if (!Array.isArray(options)) return null;
+  const seen = /* @__PURE__ */ new Set();
+  const models = [];
+  for (const row of options) {
+    if (!row || typeof row !== "object") continue;
+    const { model: raw, label } = row;
+    const model = typeof raw === "string" ? raw.trim() : "";
+    if (!model || seen.has(model)) continue;
+    seen.add(model);
+    models.push({
+      modelId: model,
+      modelLabel: typeof label === "string" && label.trim() ? label.trim() : model,
+      runnerProvider: model.includes("/") ? model.split("/")[0] : void 0,
+      variants: []
+    });
+  }
+  return models;
+}
 
 // src/plugins/builtin/claude-code.manifest.ts
 var TURN_NOT_LOGGED_IN = /not logged in\s*·\s*please run \/login/i;
@@ -8115,18 +8300,24 @@ var CLAUDE_CODE_MANIFEST = {
     // 3. canonicalAliases — stable --model contracts (opus/sonnet/haiku/fable)
     //    merged into any successful result to fill gaps, and used as the full
     //    last-resort list when both API and CLI are unavailable.
+    //
+    // Whichever source answers, the models the user added to Claude's own
+    // picker (`modelPicker.options` in its managed or user settings, usually
+    // gateway IDs) are appended (settingsModels): the CLI accepts them as
+    // `--model` values though no catalog above lists them.
     apiDiscovery: {
       url: "https://api.anthropic.com/v1/models?limit=100",
       headers: { "anthropic-version": "2023-06-01" },
       auth: [
         { type: "env", varName: "ANTHROPIC_API_KEY", header: "X-Api-Key" },
-        { type: "file", path: "~/.claude/.credentials.json", jsonPath: "claudeAiOauth.accessToken", header: "Authorization", prefix: "Bearer " }
+        { type: "file", path: (env) => `${claudeConfigDir(env)}/.credentials.json`, jsonPath: "claudeAiOauth.accessToken", header: "Authorization", prefix: "Bearer " }
       ],
       parser: parseAnthropicModels
     },
     discoveryCommands: [
       { command: "claude", args: ["--help"], parser: parseClaudeHelp }
     ],
+    settingsModels: (files) => readClaudeSettingsModels(files),
     canonicalAliases: [
       { modelId: "opus", modelLabel: "Opus" },
       { modelId: "sonnet", modelLabel: "Sonnet" },
@@ -8184,7 +8375,7 @@ import { join as join11, resolve as resolve4 } from "path";
 
 // src/services/harness/repoConfig.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
-import * as path12 from "path";
+import * as path13 from "path";
 
 // src/services/mcp/OrdewellMcpServer.ts
 import { createServer } from "http";
@@ -8897,12 +9088,12 @@ function checkpointReply(answer2) {
       return { text: `The checkpoint was withdrawn: ${answer2.why}`, isError: true };
   }
 }
-function fieldPath(path46) {
-  return path46.reduce((text4, part) => typeof part === "number" ? `${text4}[${part}]` : text4 ? `${text4}.${String(part)}` : String(part), "");
+function fieldPath(path49) {
+  return path49.reduce((text4, part) => typeof part === "number" ? `${text4}[${part}]` : text4 ? `${text4}.${String(part)}` : String(part), "");
 }
-function valueAt(value, path46) {
+function valueAt(value, path49) {
   let current = value;
-  for (const part of path46) {
+  for (const part of path49) {
     if (typeof part === "number") {
       if (!Array.isArray(current)) return void 0;
       current = current[part];
@@ -8924,7 +9115,7 @@ function boundedRefusal(issue, args) {
 var LEAKED_PARAMETER = /<\/parameter>|<parameter\s+name\s*=\s*"([^"]*)">/g;
 function leakedMarkupIn(value) {
   const found = [];
-  const walk = (node, path46) => {
+  const walk = (node, path49) => {
     if (typeof node === "string") {
       const names = [];
       let closing = false;
@@ -8932,25 +9123,25 @@ function leakedMarkupIn(value) {
         if (match[1] !== void 0) names.push(match[1]);
         else closing = true;
       }
-      if (names.length > 0 || closing) found.push({ path: path46, names: [...new Set(names)], closing });
+      if (names.length > 0 || closing) found.push({ path: path49, names: [...new Set(names)], closing });
       return;
     }
     if (Array.isArray(node)) {
-      node.forEach((item, i) => walk(item, `${path46}[${i}]`));
+      node.forEach((item, i) => walk(item, `${path49}[${i}]`));
       return;
     }
     if (node !== null && typeof node === "object") {
-      for (const [key, item] of Object.entries(node)) walk(item, path46 ? `${path46}.${key}` : key);
+      for (const [key, item] of Object.entries(node)) walk(item, path49 ? `${path49}.${key}` : key);
     }
   };
   walk(value, "");
   return found;
 }
 function markupRefusal(leaks) {
-  return leaks.map(({ path: path46, names, closing }) => {
+  return leaks.map(({ path: path49, names, closing }) => {
     const tags = [...names.map((n) => `<parameter name="${n}">`), ...closing ? ["</parameter>"] : []];
-    const guide = names.length > 0 ? ` The parameters ${names.map((n) => JSON.stringify(n)).join(", ")} are inside it; pass them as separate arguments, not inside ${path46}.` : " Pass each argument separately, not inside one string.";
-    return `${path46} contains leaked tool-call markup: ${tags.join(", ")}.${guide}`;
+    const guide = names.length > 0 ? ` The parameters ${names.map((n) => JSON.stringify(n)).join(", ")} are inside it; pass them as separate arguments, not inside ${path49}.` : " Pass each argument separately, not inside one string.";
+    return `${path49} contains leaked tool-call markup: ${tags.join(", ")}.${guide}`;
   }).join("\n");
 }
 function invalidArguments(name, error, args) {
@@ -9415,9 +9606,9 @@ function mcpClientConfig(credential) {
 }
 function ownerOnlyConfigFile(fileName, contents) {
   const dir = mkdtempSync2(join9(tmpdir2(), "ordewell-mcp-"));
-  const path46 = join9(dir, fileName);
-  writeFileSync(path46, contents, { mode: 384 });
-  return { path: path46, remove: () => rmSync2(dir, { recursive: true, force: true }) };
+  const path49 = join9(dir, fileName);
+  writeFileSync(path49, contents, { mode: 384 });
+  return { path: path49, remove: () => rmSync2(dir, { recursive: true, force: true }) };
 }
 
 // src/services/harness/repoConfig.ts
@@ -9440,19 +9631,19 @@ function onDisk(target) {
   try {
     return realpathSync2.native(target);
   } catch {
-    return path12.resolve(target);
+    return path13.resolve(target);
   }
 }
 function insideOnDisk(root, target) {
-  const rel = path12.relative(onDisk(root), onDisk(target));
-  return rel === "" || !rel.startsWith("..") && !path12.isAbsolute(rel);
+  const rel = path13.relative(onDisk(root), onDisk(target));
+  return rel === "" || !rel.startsWith("..") && !path13.isAbsolute(rel);
 }
 function repoLevels(workspace) {
   const levels = [];
-  for (let dir = path12.resolve(workspace); ; dir = path12.dirname(dir)) {
+  for (let dir = path13.resolve(workspace); ; dir = path13.dirname(dir)) {
     levels.unshift(dir);
-    if (existsSync3(path12.join(dir, ".git"))) return levels;
-    if (path12.dirname(dir) === dir) return [path12.resolve(workspace)];
+    if (existsSync3(path13.join(dir, ".git"))) return levels;
+    if (path13.dirname(dir) === dir) return [path13.resolve(workspace)];
   }
 }
 function repoRoot(workspace) {
@@ -9546,33 +9737,33 @@ var TomlReader = class {
       if (this.i >= this.src.length) return root;
       if (this.src.startsWith("[[", this.i)) {
         this.i += 2;
-        const path46 = this.key();
+        const path49 = this.key();
         this.expect("]]");
-        const parent = this.tableAt(root, path46.slice(0, -1));
-        const last = path46[path46.length - 1];
+        const parent = this.tableAt(root, path49.slice(0, -1));
+        const last = path49[path49.length - 1];
         const list = Object.hasOwn(parent, last) ? parent[last] : parent[last] = [];
-        if (!Array.isArray(list)) throw this.fail(`${path46.join(".")} is not an array of tables`);
+        if (!Array.isArray(list)) throw this.fail(`${path49.join(".")} is not an array of tables`);
         table = newTable();
         list.push(table);
       } else if (this.src[this.i] === "[") {
         this.i += 1;
-        const path46 = this.key();
+        const path49 = this.key();
         this.expect("]");
-        table = this.tableAt(root, path46);
+        table = this.tableAt(root, path49);
       } else {
-        const path46 = this.key();
+        const path49 = this.key();
         this.skipBlank(false);
         this.expect("=");
         this.skipBlank(false);
-        const owner = this.tableAt(table, path46.slice(0, -1));
-        owner[path46[path46.length - 1]] = this.value();
+        const owner = this.tableAt(table, path49.slice(0, -1));
+        owner[path49[path49.length - 1]] = this.value();
       }
       this.endOfLine();
     }
   }
-  tableAt(from, path46) {
+  tableAt(from, path49) {
     let table = from;
-    for (const part of path46) {
+    for (const part of path49) {
       const next = Object.hasOwn(table, part) ? table[part] : void 0;
       if (next === void 0) table = table[part] = newTable();
       else if (isRecord(next)) table = next;
@@ -9641,10 +9832,10 @@ var TomlReader = class {
         this.i++;
         return table;
       }
-      const path46 = this.key();
+      const path49 = this.key();
       this.expect("=");
       this.skipBlank(false);
-      this.tableAt(table, path46.slice(0, -1))[path46[path46.length - 1]] = this.value();
+      this.tableAt(table, path49.slice(0, -1))[path49[path49.length - 1]] = this.value();
       this.skipBlank(true);
       if (this.src[this.i] === ",") this.i++;
       else if (this.src[this.i] !== "}") throw this.fail("expected , or } in an inline table");
@@ -9789,7 +9980,8 @@ var CODEX_MANIFEST = {
     appServer: {
       command: "codex",
       args: ["app-server"],
-      cacheFile: "~/.codex/models_cache.json"
+      // CODEX_HOME moves all of Codex's own files from `~/.codex`.
+      cacheFile: (env) => `${env.CODEX_HOME?.trim() || "~/.codex"}/models_cache.json`
     },
     canonicalAliases: [
       { modelId: "gpt-5.6-sol", modelLabel: "GPT-5.6-Sol" },
@@ -10018,8 +10210,7 @@ var LineBuffer = class {
 // src/services/harness/ClaudeCodeAdapter.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { realpathSync as realpathSync7 } from "fs";
-import * as os9 from "os";
-import * as path20 from "path";
+import * as path22 from "path";
 
 // src/plugins/resolveArgs.ts
 function claudeThinkingArgs(effort) {
@@ -10057,14 +10248,29 @@ function resolveTaskRunnerFlags(manifest, ctx) {
   return flags;
 }
 
+// src/utils/runnerHome.ts
+import * as os5 from "os";
+function runnerHomeDir(env, platform = process.platform) {
+  const name = platform === "win32" ? "USERPROFILE" : "HOME";
+  const key = platform === "win32" ? Object.keys(env).filter((k) => k.toUpperCase() === name).pop() : name;
+  const home = key === void 0 ? void 0 : env[key];
+  return home ?? os5.homedir();
+}
+function expandRunnerHome(filePath, env = process.env) {
+  if (!filePath.startsWith("~")) return filePath;
+  const home = runnerHomeDir(env);
+  return home ? home + filePath.slice(1) : null;
+}
+
 // src/services/harness/runnerProcess.ts
+import { Socket } from "net";
 import { StringDecoder } from "string_decoder";
 
 // src/utils/shellPath.ts
 import { exec } from "child_process";
 import { promisify } from "util";
-import * as os5 from "os";
-import * as path13 from "path";
+import * as os6 from "os";
+import * as path14 from "path";
 var execAsync = promisify(exec);
 var LOGIN_SHELL_TIMEOUT_MS = 5e3;
 var PATH_MARKER = "__ORDEWELL_PATH__";
@@ -10073,42 +10279,42 @@ var defaultExec = async (command, options) => {
   return { stdout: String(stdout) };
 };
 function posixBinDirs() {
-  const home = os5.homedir();
+  const home = os6.homedir();
   return [
-    path13.join(home, ".local", "bin"),
-    path13.join(home, ".opencode", "bin"),
-    path13.join(home, ".claude", "bin"),
-    path13.join(home, ".bun", "bin"),
-    path13.join(home, ".volta", "bin"),
-    path13.join(home, ".npm-global", "bin"),
-    path13.join(home, "bin"),
+    path14.join(home, ".local", "bin"),
+    path14.join(home, ".opencode", "bin"),
+    path14.join(home, ".claude", "bin"),
+    path14.join(home, ".bun", "bin"),
+    path14.join(home, ".volta", "bin"),
+    path14.join(home, ".npm-global", "bin"),
+    path14.join(home, "bin"),
     "/usr/local/bin",
     "/opt/homebrew/bin"
   ];
 }
 function windowsBinDirs(env, home) {
-  const join43 = (...parts) => path13.win32.join(...parts);
-  const under = (base, ...parts) => base ? [join43(base, ...parts)] : [];
+  const join45 = (...parts) => path14.win32.join(...parts);
+  const under = (base, ...parts) => base ? [join45(base, ...parts)] : [];
   const appData = env.APPDATA;
   const localAppData = env.LOCALAPPDATA;
   const programData = env.ProgramData;
   return [
     // Native per-user installers, PowerShell-driven and otherwise.
-    join43(home, ".local", "bin"),
-    join43(home, ".opencode", "bin"),
-    join43(home, ".claude", "bin"),
-    join43(home, ".codex", "bin"),
+    join45(home, ".local", "bin"),
+    join45(home, ".opencode", "bin"),
+    join45(home, ".claude", "bin"),
+    join45(home, ".codex", "bin"),
     ...under(localAppData, "Programs", "claude"),
     // Node package managers. npm's global prefix is `%APPDATA%\npm`; the
     // literal spelling is kept as a fallback for a host that does not export
     // APPDATA (a service account, a stripped CI container).
     ...under(appData, "npm"),
-    join43(home, "AppData", "Roaming", "npm"),
+    join45(home, "AppData", "Roaming", "npm"),
     ...under(localAppData, "pnpm"),
     ...under(localAppData, "Yarn", "bin"),
-    join43(home, ".bun", "bin"),
+    join45(home, ".bun", "bin"),
     // Windows package managers.
-    join43(home, "scoop", "shims"),
+    join45(home, "scoop", "shims"),
     ...under(env.SCOOP, "shims"),
     ...under(env.SCOOP_GLOBAL ?? programData, "scoop", "shims"),
     ...under(programData, "chocolatey", "bin"),
@@ -10118,13 +10324,13 @@ function windowsBinDirs(env, home) {
     ...under(localAppData, "Microsoft", "WindowsApps"),
     // Version managers. Volta's Windows home is not the POSIX `~/.volta`.
     ...under(localAppData, "Volta", "bin"),
-    join43(home, ".volta", "bin")
+    join45(home, ".volta", "bin")
   ];
 }
 function wellKnownBinDirs(deps = {}) {
   const platform = deps.platform ?? process.platform;
   if (platform !== "win32") return posixBinDirs();
-  return [...new Set(windowsBinDirs(deps.env ?? process.env, deps.home ?? os5.homedir()))];
+  return [...new Set(windowsBinDirs(deps.env ?? process.env, deps.home ?? os6.homedir()))];
 }
 async function loginShellPath(execImpl) {
   if (process.platform === "win32") return null;
@@ -10147,14 +10353,14 @@ function augmentedPath(execImpl = defaultExec) {
       const segments = [];
       const push = (p) => {
         if (!p) return;
-        for (const seg of p.split(path13.delimiter)) {
+        for (const seg of p.split(path14.delimiter)) {
           if (seg && !segments.includes(seg)) segments.push(seg);
         }
       };
       push(process.env.PATH);
       push(await loginShellPath(execImpl));
       for (const dir of wellKnownBinDirs()) push(dir);
-      return segments.join(path13.delimiter);
+      return segments.join(path14.delimiter);
     })();
   }
   return cachedPath;
@@ -10176,7 +10382,7 @@ function withPath(base, resolvedPath, overrides = {}) {
 
 // src/utils/launch.ts
 import * as fsSync4 from "fs";
-import * as path14 from "path";
+import * as path15 from "path";
 var DIRECT_EXTENSIONS = [".exe", ".com"];
 var BATCH_EXTENSIONS = [".cmd", ".bat"];
 var POWERSHELL_EXTENSIONS = [".ps1"];
@@ -10184,7 +10390,7 @@ var CMD_EXE_MAX_COMMAND_LINE = 8191;
 var WINDOWS_MAX_COMMAND_LINE = 32767;
 function defaultPowerShell() {
   const root = process.env.SystemRoot || process.env.windir;
-  return root ? path14.win32.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") : "powershell.exe";
+  return root ? path15.win32.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") : "powershell.exe";
 }
 var POWERSHELL_FLAGS = ["-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File"];
 var CommandLineTooLongError = class extends Error {
@@ -10250,7 +10456,7 @@ Searched: ${searchedPath || "(empty PATH)"}`);
 };
 function isResolvableOnPosixPath(command, PATH, exists) {
   if (command.includes("/")) return exists(command);
-  return PATH.split(path14.delimiter).map((d) => d.trim()).filter(Boolean).some((dir) => exists(path14.join(dir, command)));
+  return PATH.split(path15.delimiter).map((d) => d.trim()).filter(Boolean).some((dir) => exists(path15.join(dir, command)));
 }
 function isExecutableResolved(command, plan, PATH, deps = {}) {
   if ((deps.platform ?? process.platform) === "win32") return plan.file !== command;
@@ -10290,9 +10496,9 @@ function cmdArgs(line) {
   return ["/d", "/s", "/c", `"${line}"`];
 }
 function candidateExtensions(command, pathExt) {
-  const declared = pathExt.split(path14.win32.delimiter).map((e) => e.trim().toLowerCase()).filter(Boolean);
+  const declared = pathExt.split(path15.win32.delimiter).map((e) => e.trim().toLowerCase()).filter(Boolean);
   const known = /* @__PURE__ */ new Set([...DIRECT_EXTENSIONS, ...BATCH_EXTENSIONS, ...POWERSHELL_EXTENSIONS, ...declared]);
-  const ext = path14.win32.extname(command).toLowerCase();
+  const ext = path15.win32.extname(command).toLowerCase();
   if (ext && known.has(ext)) {
     const route = BATCH_EXTENSIONS.includes(ext) ? "cmd" : POWERSHELL_EXTENSIONS.includes(ext) ? "powershell" : "direct";
     return { direct: [], cmd: [], powershell: [], [route]: [""] };
@@ -10313,13 +10519,13 @@ async function findWindowsExecutables(command, deps) {
   const exists = deps.exists ?? defaultExists3;
   const pathExt = (deps.pathExt ?? (() => process.env.PATHEXT ?? ""))();
   const byRoute = candidateExtensions(command, pathExt);
-  const dirs = path14.win32.basename(command) !== command ? [path14.win32.dirname(path14.win32.resolve(command))] : (await (deps.resolvePath ?? augmentedPath)() || "").split(path14.win32.delimiter).map((d) => d.trim().replace(/^"|"$/g, "")).filter(Boolean);
-  const base = path14.win32.basename(command);
+  const dirs = path15.win32.basename(command) !== command ? [path15.win32.dirname(path15.win32.resolve(command))] : (await (deps.resolvePath ?? augmentedPath)() || "").split(path15.win32.delimiter).map((d) => d.trim().replace(/^"|"$/g, "")).filter(Boolean);
+  const base = path15.win32.basename(command);
   const found = [];
   for (const route of ROUTES) {
     outer: for (const ext of byRoute[route]) {
       for (const dir of dirs) {
-        const candidate = path14.win32.join(dir, `${base}${ext}`);
+        const candidate = path15.win32.join(dir, `${base}${ext}`);
         if (exists(candidate)) {
           found.push({ file: candidate, route });
           break outer;
@@ -10367,7 +10573,7 @@ async function planDirectLaunch(command, args, deps = {}) {
 
 // src/utils/workspace.ts
 import * as fs3 from "fs";
-import * as path15 from "path";
+import * as path16 from "path";
 var WorkspaceNotFoundError = class extends Error {
   constructor(workspace) {
     super(`Workspace "${workspace}" does not exist.`);
@@ -10423,7 +10629,7 @@ function assertWorkspaceIsProject(workspace, deps = {}) {
     throw new WorkspaceNotAProjectError(workspace);
   }
   const hasMarker = [...PROJECT_MARKER_DIRS, ...PROJECT_MARKER_FILES].some(
-    (marker2) => exists(path15.join(resolved, marker2))
+    (marker2) => exists(path16.join(resolved, marker2))
   );
   if (!hasMarker) throw new WorkspaceNotAProjectError(workspace);
 }
@@ -10431,12 +10637,12 @@ function assertWorkspaceIsProject(workspace, deps = {}) {
 // src/services/workspaceEnv.ts
 import { execFile as execFile3 } from "child_process";
 import * as fs5 from "fs";
-import * as os6 from "os";
-import * as path17 from "path";
+import * as os7 from "os";
+import * as path18 from "path";
 
 // src/utils/fsHelpers.ts
 import * as fs4 from "fs";
-import * as path16 from "path";
+import * as path17 from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 var STATE_DIR = ".ordewell";
 function ensureDir(dir) {
@@ -10445,9 +10651,9 @@ function ensureDir(dir) {
   }
 }
 function writeFileAtomic(filePath, content) {
-  const dir = path16.dirname(filePath);
+  const dir = path17.dirname(filePath);
   ensureDir(dir);
-  const tempPath = path16.join(dir, `.${path16.basename(filePath)}.${randomUUID2()}.tmp`);
+  const tempPath = path17.join(dir, `.${path17.basename(filePath)}.${randomUUID2()}.tmp`);
   fs4.writeFileSync(tempPath, content, { flag: "wx" });
   try {
     fs4.renameSync(tempPath, filePath);
@@ -10460,7 +10666,7 @@ function writeFileAtomic(filePath, content) {
   }
 }
 function getStateDir(baseDir) {
-  return path16.join(baseDir ?? process.cwd(), STATE_DIR);
+  return path17.join(baseDir ?? process.cwd(), STATE_DIR);
 }
 var IGNORE_FILE = ".gitignore";
 var STATE_DIR_IGNORE = "*\n!.gitignore\n!skills/\n!skills/**\n";
@@ -10468,7 +10674,7 @@ var LEGACY_IGNORES = /* @__PURE__ */ new Set(["*", "*\n"]);
 function ensureStateDirIgnored(baseDir) {
   const dir = getStateDir(baseDir);
   ensureDir(dir);
-  const file = path16.join(dir, IGNORE_FILE);
+  const file = path17.join(dir, IGNORE_FILE);
   try {
     fs4.writeFileSync(file, STATE_DIR_IGNORE, { flag: "wx" });
     return;
@@ -11003,7 +11209,7 @@ function defaultDeps() {
       }
     },
     baseEnv: process.env,
-    home: os6.homedir()
+    home: os7.homedir()
   };
 }
 var REFUSED2 = new Set(SETTINGS_ENV_REFUSED);
@@ -11015,7 +11221,7 @@ async function resolveWorkspaceEnv(cwd, overrides = {}) {
   const direnv = await fromDirenv(checkoutDirOf(cwd, deps), deps);
   result.blockedEnvrc = direnv.blocked;
   Object.assign(collected, direnv.env);
-  const file = findUp(cwd, path17.join(STATE_DIR, WORKSPACE_ENV_FILE), deps);
+  const file = findUp(cwd, path18.join(STATE_DIR, WORKSPACE_ENV_FILE), deps);
   if (file) {
     const content = deps.readFile(file);
     if (content !== null) {
@@ -11032,7 +11238,7 @@ async function resolveWorkspaceEnv(cwd, overrides = {}) {
 }
 var evaluating = /* @__PURE__ */ new Map();
 async function workspaceEnvOf(cwd) {
-  const key = path17.resolve(cwd);
+  const key = path18.resolve(cwd);
   let running = evaluating.get(key);
   if (!running) {
     running = resolveWorkspaceEnv(cwd).then((result) => result.env).finally(() => evaluating.delete(key));
@@ -11041,11 +11247,11 @@ async function workspaceEnvOf(cwd) {
   return { ...await running };
 }
 function checkoutDirOf(cwd, deps) {
-  const parts = path17.resolve(cwd).split(path17.sep);
+  const parts = path18.resolve(cwd).split(path18.sep);
   const at = parts.findIndex((part, i) => part === STATE_DIR && parts[i + 1] === "worktrees");
   if (at < 0 || parts.length < at + 4) return cwd;
-  const root = parts.slice(0, at).join(path17.sep) || path17.sep;
-  const mapped = path17.join(root, ...parts.slice(at + 4));
+  const root = parts.slice(0, at).join(path18.sep) || path18.sep;
+  const mapped = path18.join(root, ...parts.slice(at + 4));
   return deps.isDirectory(mapped) ? mapped : root;
 }
 async function fromDirenv(cwd, deps) {
@@ -11075,18 +11281,18 @@ async function fromDirenv(cwd, deps) {
   return { env, blocked: null };
 }
 function findUp(start, relative17, deps) {
-  let dir = path17.resolve(start);
+  let dir = path18.resolve(start);
   for (; ; ) {
-    const candidate = path17.join(dir, relative17);
+    const candidate = path18.join(dir, relative17);
     if (deps.readFile(candidate) !== null) return candidate;
-    const parent = path17.dirname(dir);
+    const parent = path18.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 async function isTracked(file, deps) {
   try {
-    const out = await deps.run("git", ["ls-files", "--error-unmatch", path17.basename(file)], { cwd: path17.dirname(file), env: deps.baseEnv });
+    const out = await deps.run("git", ["ls-files", "--error-unmatch", path18.basename(file)], { cwd: path18.dirname(file), env: deps.baseEnv });
     return out.code === 0;
   } catch {
     return false;
@@ -11096,7 +11302,7 @@ function parseEnvFile(content, context, home) {
   const env = {};
   const lookup2 = (name) => env[name] ?? context[name] ?? "";
   const expand = (value) => {
-    const tilde = value.startsWith("~/") ? path17.join(home, value.slice(2)) : value;
+    const tilde = value.startsWith("~/") ? path18.join(home, value.slice(2)) : value;
     return tilde.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g, (_, braced, bare) => lookup2(braced ?? bare));
   };
   for (const raw of content.split(/\r?\n/)) {
@@ -11366,7 +11572,7 @@ function readOnlySessionRules(site) {
       real = realpathSync4.native(root);
     } catch {
     }
-    for (const path46 of /* @__PURE__ */ new Set([root, real])) rules.push({ action: "external_directory", resource: `${path46.replace(/[\\/]$/, "")}/*`, effect: "allow" });
+    for (const path49 of /* @__PURE__ */ new Set([root, real])) rules.push({ action: "external_directory", resource: `${path49.replace(/[\\/]$/, "")}/*`, effect: "allow" });
   }
   return rules;
 }
@@ -11492,6 +11698,14 @@ function runnerEnv(resolvedPath, workspace = {}, launch = {}, drop) {
 // src/services/harness/runnerProcess.ts
 var STDERR_TAIL_CHARS = 4e3;
 var CLOSE_GRACE_MS = 2e3;
+function releasePipes(child) {
+  for (const stream of [child.stdin, child.stdout, child.stderr]) {
+    if (stream instanceof Socket) stream.unref();
+  }
+  for (const stream of [child.stdout, child.stderr]) {
+    if (stream instanceof Socket) stream.resume();
+  }
+}
 var RunnerProcess = class {
   constructor(deps) {
     this.deps = deps;
@@ -11564,6 +11778,7 @@ var RunnerProcess = class {
       const grace = setTimeout(() => {
         for (const flush of [...this.stdoutEnds]) flush();
         this.end({ code, signal });
+        releasePipes(child);
       }, CLOSE_GRACE_MS);
       grace.unref?.();
       void this.ended.then(() => clearTimeout(grace));
@@ -11662,11 +11877,11 @@ ${tail}` : ""}`;
 
 // src/services/sandbox/nativeShellLauncher.ts
 import { chmodSync, mkdtempSync as mkdtempSync3, realpathSync as realpathSync5, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
-import * as os7 from "os";
-import * as path18 from "path";
+import * as os8 from "os";
+import * as path19 from "path";
 function nativeShellInvocation(platform, env = process.env) {
   const shell = platform === "darwin" ? "/bin/zsh" : env.SHELL;
-  return { shell: shell && path18.posix.isAbsolute(shell) ? shell : "/bin/sh", args: ["-c"] };
+  return { shell: shell && path19.posix.isAbsolute(shell) ? shell : "/bin/sh", args: ["-c"] };
 }
 var live = /* @__PURE__ */ new Set();
 var exitHook = false;
@@ -11698,10 +11913,10 @@ function launcherScript(launch) {
 }
 async function createNativeShellLauncher(opts) {
   const invocation = nativeShellInvocation(opts.platform ?? process.platform, opts.env);
-  const root = realpathSync5(mkdtempSync3(path18.join(os7.tmpdir(), "ordewell-native-shell-")));
+  const root = realpathSync5(mkdtempSync3(path19.join(os8.tmpdir(), "ordewell-native-shell-")));
   let shortTmp = null;
   try {
-    shortTmp = realpathSync5(mkdtempSync3(path18.join("/tmp", "ow-")));
+    shortTmp = realpathSync5(mkdtempSync3(path19.join("/tmp", "ow-")));
     const tmpdir7 = shortTmp;
     const launch = await opts.sandbox.launchNativeShell({
       workspace: opts.workspace,
@@ -11710,7 +11925,7 @@ async function createNativeShellLauncher(opts) {
       shellArgs: invocation.args,
       ...opts.env ? { env: opts.env } : {}
     });
-    const prefix = path18.join(root, "run");
+    const prefix = path19.join(root, "run");
     writeFileSync3(prefix, launcherScript(launch), { mode: 448 });
     chmodSync(prefix, 448);
     keep(root);
@@ -12079,6 +12294,20 @@ ${lines.map((line) => `${line}
 }
 
 // src/services/harness/claudeOrdewell.ts
+import * as path20 from "path";
+function assertNoClaudeTaskCollision(cwd) {
+  const text4 = readText(path20.join(cwd, ".mcp.json"));
+  if (text4 === void 0) return;
+  let parsed;
+  try {
+    parsed = JSON.parse(text4);
+  } catch {
+    return;
+  }
+  if (isRecord(parsed) && isRecord(parsed.mcpServers) && Object.hasOwn(parsed.mcpServers, ORDEWELL_MCP_SERVER_NAME)) {
+    throw new Error(".mcp.json declares an MCP server named ordewell; rename or remove the ordewell server before starting this task.");
+  }
+}
 var CLAUDE_ORDEWELL = {
   toolName: MCP_CLIENT_TOOL_NAMES.toolName,
   toolNames: MCP_CLIENT_TOOL_NAMES.toolNames,
@@ -12226,9 +12455,8 @@ var ReplyRuns = class {
 };
 
 // src/services/harness/claudeRepoConfig.ts
-import * as os8 from "os";
-import * as path19 from "path";
-var MEMORY_FILES = ["CLAUDE.md", path19.join(".claude", "CLAUDE.md"), "CLAUDE.local.md"];
+import * as path21 from "path";
+var MEMORY_FILES = ["CLAUDE.md", path21.join(".claude", "CLAUDE.md"), "CLAUDE.local.md"];
 var MAX_IMPORT_DEPTH = 5;
 function importsOf(text4) {
   const prose = text4.replace(/```[\s\S]*?```/g, "").replace(/`[^`\n]*`/g, "");
@@ -12239,11 +12467,11 @@ function withImports(workspace, file, depth, seen, into) {
   seen.add(file);
   const text4 = readText(file);
   if (text4 === void 0) return;
-  into.push({ path: path19.relative(workspace, file), text: text4 });
+  into.push({ path: path21.relative(workspace, file), text: text4 });
   if (depth >= MAX_IMPORT_DEPTH) return;
   for (const target of importsOf(text4)) {
     if (target.startsWith("~")) continue;
-    const abs = path19.resolve(path19.dirname(file), target);
+    const abs = path21.resolve(path21.dirname(file), target);
     if (insideOnDisk(workspace, abs)) withImports(workspace, abs, depth + 1, seen, into);
   }
 }
@@ -12264,12 +12492,12 @@ var CLAUDE_REPO_CONFIG = {
   instructions(workspace) {
     const files = [];
     const seen = /* @__PURE__ */ new Set();
-    for (const name of MEMORY_FILES) withImports(workspace, path19.join(workspace, name), 0, seen, files);
+    for (const name of MEMORY_FILES) withImports(workspace, path21.join(workspace, name), 0, seen, files);
     return files;
   },
   projectServers(workspace) {
     const source = ".mcp.json";
-    const text4 = readText(path19.join(workspace, source));
+    const text4 = readText(path21.join(workspace, source));
     if (text4 === void 0) return NO_SERVERS;
     let parsed;
     try {
@@ -12287,13 +12515,14 @@ var CLAUDE_REPO_CONFIG = {
     return found;
   }
 };
-function claudeLocalServers(configDir2, workspace) {
-  const file = configDir2 ? path19.join(configDir2, ".claude.json") : path19.join(os8.homedir(), ".claude.json");
-  const text4 = readText(file);
+function claudeLocalServers(env, workspace) {
+  const configDir2 = env.CLAUDE_CONFIG_DIR?.trim();
+  const file = expandRunnerHome(configDir2 ? path21.join(configDir2, ".claude.json") : "~/.claude.json", env);
+  const text4 = file === null ? void 0 : readText(file);
   if (text4 === void 0) return {};
   try {
     const parsed = JSON.parse(text4);
-    const project = isRecord(parsed) && isRecord(parsed.projects) ? parsed.projects[path19.resolve(workspace)] : void 0;
+    const project = isRecord(parsed) && isRecord(parsed.projects) ? parsed.projects[path21.resolve(workspace)] : void 0;
     return isRecord(project) && isRecord(project.mcpServers) ? project.mcpServers : {};
   } catch {
     return {};
@@ -12548,13 +12777,13 @@ var NO_AUTO_MEMORY = { CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1" };
 function inSavedOutput(abs, configDir2, sessionId) {
   let projects;
   try {
-    projects = realpathSync7.native(path20.join(configDir2, "projects"));
+    projects = realpathSync7.native(path22.join(configDir2, "projects"));
   } catch {
     return false;
   }
-  const rel = path20.relative(projects, abs);
-  if (rel.startsWith("..") || path20.isAbsolute(rel)) return false;
-  const [project, session, folder] = rel.split(path20.sep);
+  const rel = path22.relative(projects, abs);
+  if (rel.startsWith("..") || path22.isAbsolute(rel)) return false;
+  const [project, session, folder] = rel.split(path22.sep);
   return Boolean(project) && session === sessionId && folder === "tool-results";
 }
 var PATH_TOOLS = {
@@ -12792,7 +13021,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
       "--append-system-prompt",
       opts.systemPrompt
     ];
-    if (opts.mcp) args.push(...this.ordewellServerArgs(opts.mcp, "planner", this.plannerServers(opts, workspace)));
+    if (opts.mcp) args.push(...this.ordewellServerArgs(opts.mcp, "planner", this.plannerServers(opts, { ...process.env, ...workspace })));
     if (opts.model) args.push("--model", opts.model);
     if (opts.effort && opts.effort !== "adaptive") args.push("--effort", opts.effort);
     if (opts.resumeSessionId) {
@@ -12800,7 +13029,8 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
       this.countFrom(opts.resumeSessionId, opts.resumeCost);
       this.pendingResume = opts.resumeSessionId;
     }
-    this.configDir = workspace.CLAUDE_CONFIG_DIR ?? process.env.CLAUDE_CONFIG_DIR ?? path20.join(os9.homedir(), ".claude");
+    const env = { ...process.env, ...workspace };
+    this.configDir = expandRunnerHome(claudeConfigDir(env), env);
     return {
       command: "claude",
       args,
@@ -12844,6 +13074,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
    */
   taskSpawnSpec(opts) {
     const readOnly = readOnlyTask(opts);
+    if (!readOnly) assertNoClaudeTaskCollision(opts.cwd);
     this.readOnlySite = readOnly ? opts : null;
     this.requestedMode = readOnly ? PLANNER_PERMISSION_MODE : opts.flags.permissionMode;
     this.followedModel = opts.model;
@@ -12870,13 +13101,12 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
   /**
    * What user-only settings stop the CLI loading that is not the
    * repository's to choose (ADR-0028): the user's own local-scope servers,
-   * under the `CLAUDE_CONFIG_DIR` the planner runs with, and the project
-   * servers approved for it.
+   * from the account in the environment the planner runs with, and the
+   * project servers approved for it.
    */
-  plannerServers(opts, workspace) {
-    const configDir2 = workspace.CLAUDE_CONFIG_DIR ?? process.env.CLAUDE_CONFIG_DIR;
+  plannerServers(opts, env) {
     return {
-      ...claudeLocalServers(configDir2, opts.cwd),
+      ...claudeLocalServers(env, opts.cwd),
       ...Object.fromEntries((opts.projectServers ?? []).map((server4) => [server4.name, server4.definition]))
     };
   }
@@ -13640,8 +13870,8 @@ function runProbe(deps, cwd, env, flags) {
 }
 
 // src/services/harness/codexRepoConfig.ts
-import * as path21 from "path";
-var CONFIG_FILE = path21.join(".codex", "config.toml");
+import * as path23 from "path";
+var CONFIG_FILE = path23.join(".codex", "config.toml");
 function stringsOf(value) {
   return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
 }
@@ -13667,9 +13897,9 @@ var CODEX_REPO_CONFIG = {
     const files = [];
     for (const dir of repoLevels(workspace)) {
       for (const name of ["AGENTS.override.md", "AGENTS.md"]) {
-        const text4 = readText(path21.join(dir, name));
+        const text4 = readText(path23.join(dir, name));
         if (text4 === void 0) continue;
-        files.push({ path: path21.relative(workspace, path21.join(dir, name)) || name, text: text4 });
+        files.push({ path: path23.relative(workspace, path23.join(dir, name)) || name, text: text4 });
         break;
       }
     }
@@ -13680,10 +13910,10 @@ var CODEX_REPO_CONFIG = {
     const byName = /* @__PURE__ */ new Map();
     const unreadable = [];
     for (const dir of repoLevels(workspace)) {
-      const file = path21.join(dir, CONFIG_FILE);
+      const file = path23.join(dir, CONFIG_FILE);
       const text4 = readText(file);
       if (text4 === void 0) continue;
-      const source = path21.relative(workspace, file);
+      const source = path23.relative(workspace, file);
       let parsed;
       try {
         parsed = parseToml(text4);
@@ -13703,9 +13933,9 @@ var CODEX_REPO_CONFIG = {
 };
 function untrustedProjects(workspace) {
   const projects = {};
-  for (let dir = path21.resolve(workspace); ; dir = path21.dirname(dir)) {
+  for (let dir = path23.resolve(workspace); ; dir = path23.dirname(dir)) {
     projects[dir] = { trust_level: "untrusted" };
-    if (path21.dirname(dir) === dir) return projects;
+    if (path23.dirname(dir) === dir) return projects;
   }
 }
 
@@ -14826,7 +15056,7 @@ ${this.exitMessage()}`);
       case "webSearch":
         return;
       case "fileChange": {
-        const paths = (item.changes ?? []).map((change) => change.path).filter((path46) => !!path46);
+        const paths = (item.changes ?? []).map((change) => change.path).filter((path49) => !!path49);
         this.fileChangePaths.set(item.id, paths);
         if (this.startOpts?.kind === "task") {
           for (const change of item.changes ?? []) this.announceFileChange(item.id, change, emit, subagentId);
@@ -14929,20 +15159,20 @@ ${this.exitMessage()}`);
   announceFileChange(itemId, change, emit, subagentId) {
     const rows = this.fileChangeRows.get(itemId) ?? /* @__PURE__ */ new Map();
     this.fileChangeRows.set(itemId, rows);
-    const path46 = this.shownChangePath(change);
-    const known = rows.get(path46);
+    const path49 = this.shownChangePath(change);
+    const known = rows.get(path49);
     if (known) return known;
-    const row = rows.size === 0 ? itemId : `${itemId}:${path46}`;
-    rows.set(path46, row);
-    emit({ type: "tool_call", id: row, name: changeName(change), args: { path: path46 }, ...subagentId ? { subagentId } : {} });
+    const row = rows.size === 0 ? itemId : `${itemId}:${path49}`;
+    rows.set(path49, row);
+    emit({ type: "tool_call", id: row, name: changeName(change), args: { path: path49 }, ...subagentId ? { subagentId } : {} });
     return row;
   }
   /** Relative to the task's worktree, where every path but a stray one lies; a move names both ends. */
   shownChangePath(change) {
-    const shown = (path46) => {
+    const shown = (path49) => {
       const cwd = this.startOpts?.cwd;
-      const rel = cwd ? relative8(cwd, path46) : path46;
-      return rel && rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute6(rel) ? rel : path46;
+      const rel = cwd ? relative8(cwd, path49) : path49;
+      return rel && rel !== ".." && !rel.startsWith(`..${sep3}`) && !isAbsolute6(rel) ? rel : path49;
     };
     const from = shown(change.path ?? "");
     return change.kind?.move_path ? `${from} \u2192 ${shown(change.kind.move_path)}` : from;
@@ -14993,7 +15223,7 @@ import { realpathSync as realpathSync8 } from "fs";
 
 // src/services/harness/projectServers.ts
 import { createHash } from "crypto";
-import * as path22 from "path";
+import * as path24 from "path";
 function canonical2(value) {
   if (Array.isArray(value)) return value.map(canonical2);
   if (!isRecord(value)) return value;
@@ -15004,7 +15234,7 @@ function projectServerScope(server4) {
   return `mcp-server:${server4.name}@${hash}`;
 }
 var scopeName = (scope) => scope.slice(0, scope.lastIndexOf("@"));
-function fileProjectServerApprovals(file = path22.join(globalDataDir(), "project-mcp-servers.json")) {
+function fileProjectServerApprovals(file = path24.join(globalDataDir(), "project-mcp-servers.json")) {
   const load = () => {
     const text4 = readText(file);
     if (text4 === void 0) return {};
@@ -16167,8 +16397,8 @@ var OpenCodeAdapter = class extends ProcessLifecycle {
       this.v2 = new OpenCodeV2({
         version,
         nativeShell: this.nativeShell?.prefix ?? null,
-        request: (method, path46, body, signal, timeoutMs) => this.request(method, path46, body, signal, timeoutMs),
-        json: (method, path46, body, signal, timeoutMs) => this.json(method, path46, body, signal, timeoutMs),
+        request: (method, path49, body, signal, timeoutMs) => this.request(method, path49, body, signal, timeoutMs),
+        json: (method, path49, body, signal, timeoutMs) => this.json(method, path49, body, signal, timeoutMs),
         openEvents: (signal) => this.deps.fetch(`${this.baseUrl}/api/event`, { signal, headers: this.headers() }),
         processEnded: this.processEnded,
         isExited: () => this.exited,
@@ -16805,15 +17035,15 @@ var OpenCodeAdapter = class extends ProcessLifecycle {
       onActivity
     );
   }
-  async json(method, path46, body, signal, timeoutMs) {
-    const response = await this.request(method, path46, body, signal, timeoutMs);
-    if (!response.ok) throw new OpenCodeHttpError(`${method} ${path46} failed: ${response.status} ${response.statusText}`);
+  async json(method, path49, body, signal, timeoutMs) {
+    const response = await this.request(method, path49, body, signal, timeoutMs);
+    if (!response.ok) throw new OpenCodeHttpError(`${method} ${path49} failed: ${response.status} ${response.statusText}`);
     return await response.json().catch(() => null);
   }
   /** `timeoutMs` null is for a turn's own POST, which the server answers when the turn is done. */
-  request(method, path46, body, signal, timeoutMs = REQUEST_TIMEOUT_MS) {
+  request(method, path49, body, signal, timeoutMs = REQUEST_TIMEOUT_MS) {
     const deadline = withDeadline(signal, timeoutMs);
-    return this.deps.fetch(`${this.baseUrl}${path46}`, {
+    return this.deps.fetch(`${this.baseUrl}${path49}`, {
       method,
       headers: this.headers({ "content-type": "application/json" }),
       ...body === void 0 ? {} : { body: JSON.stringify(body) },
@@ -16874,8 +17104,8 @@ var OpenCodeAdapter = class extends ProcessLifecycle {
 };
 
 // src/services/harness/openCodeRepoConfig.ts
-import * as path23 from "path";
-var CONFIG_FILES = ["opencode.json", "opencode.jsonc", path23.join(".opencode", "opencode.json"), path23.join(".opencode", "opencode.jsonc")];
+import * as path25 from "path";
+var CONFIG_FILES = ["opencode.json", "opencode.jsonc", path25.join(".opencode", "opencode.json"), path25.join(".opencode", "opencode.jsonc")];
 var INSTRUCTION_NAMES = ["AGENTS.md", "CLAUDE.md", "CONTEXT.md"];
 function server3(name, entry, source) {
   if (!isRecord(entry)) return "not an object";
@@ -16894,8 +17124,8 @@ var OPENCODE_REPO_CONFIG = {
     const levels = repoLevels(workspace);
     for (const name of INSTRUCTION_NAMES) {
       const files = levels.flatMap((dir) => {
-        const text4 = readText(path23.join(dir, name));
-        return text4 === void 0 ? [] : [{ path: path23.relative(workspace, path23.join(dir, name)) || name, text: text4 }];
+        const text4 = readText(path25.join(dir, name));
+        return text4 === void 0 ? [] : [{ path: path25.relative(workspace, path25.join(dir, name)) || name, text: text4 }];
       });
       if (files.length > 0) return files;
     }
@@ -16907,10 +17137,10 @@ var OPENCODE_REPO_CONFIG = {
     const unreadable = [];
     for (const dir of repoLevels(workspace)) {
       for (const name of CONFIG_FILES) {
-        const file = path23.join(dir, name);
+        const file = path25.join(dir, name);
         const text4 = readText(file);
         if (text4 === void 0) continue;
-        const source = path23.relative(workspace, file);
+        const source = path25.relative(workspace, file);
         let parsed;
         try {
           parsed = parseJsonc(text4);
@@ -17099,7 +17329,7 @@ function knownModelId(value, optionIds, shortcuts) {
 
 // src/services/ModelCatalog.ts
 import * as fs6 from "fs";
-import * as path24 from "path";
+import * as path26 from "path";
 var CACHE_KEY = "model-catalog";
 var CACHE_TTL_MS = 60 * 60 * 1e3;
 function storageKey(baseUrl) {
@@ -17152,7 +17382,7 @@ var ModelCatalog = class {
       const url = (baseUrl || "https://openrouter.ai/api/v1").replace(/\/+$/, "");
       const key = storageKey(url);
       const cacheDir = globalCacheDir();
-      const cacheFile = path24.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
+      const cacheFile = path26.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
       if (fs6.existsSync(cacheFile)) fs6.rmSync(cacheFile);
     } catch {
     }
@@ -17160,7 +17390,7 @@ var ModelCatalog = class {
   static readCache(key) {
     try {
       const cacheDir = globalCacheDir();
-      const cacheFile = path24.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
+      const cacheFile = path26.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
       if (!fs6.existsSync(cacheFile)) return null;
       const raw = fs6.readFileSync(cacheFile, "utf8");
       const data = JSON.parse(raw);
@@ -17174,7 +17404,7 @@ var ModelCatalog = class {
     try {
       const cacheDir = globalCacheDir();
       fs6.mkdirSync(cacheDir, { recursive: true });
-      const cacheFile = path24.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
+      const cacheFile = path26.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
       fs6.writeFileSync(
         cacheFile,
         JSON.stringify({ models, cachedAt: Date.now() }, null, 2)
@@ -17185,15 +17415,17 @@ var ModelCatalog = class {
 };
 
 // src/services/ModelDiscovery.ts
-import * as path25 from "path";
+import * as path27 from "path";
 import { exec as exec2 } from "child_process";
 import { promisify as promisify2 } from "util";
 import * as fsSync5 from "fs";
-import * as osMod from "os";
 
 // src/services/harness/appServerModels.ts
 import { spawn as nodeSpawn } from "child_process";
 var DEFAULT_TIMEOUT_MS3 = 2e4;
+function definedOnly(env) {
+  return Object.fromEntries(Object.entries(env).filter((entry) => entry[1] !== void 0));
+}
 function parseRpcLine(line) {
   try {
     const value = JSON.parse(line);
@@ -17206,10 +17438,9 @@ async function openAppServer(command, args, launch) {
   const runner = new RunnerProcess({
     spawn: nodeSpawn,
     fetch: globalThis.fetch,
-    // The cwd is no workspace: discovery asks for the catalog before one is
-    // chosen, so it pays no direnv round trip before a spawn with a deadline.
-    // The account monitor passes the workspace's environment itself, since
-    // that can choose whose account is read.
+    // The cwd is no workspace, so it pays no direnv round trip before a spawn
+    // with a deadline. Discovery and the account monitor pass the workspace's
+    // environment themselves, since that can choose whose account is read.
     workspaceEnv: async () => ({}),
     ...launch.deps
   });
@@ -17262,7 +17493,11 @@ async function openAppServer(command, args, launch) {
 }
 var APP_SERVER_CLIENT_INFO = { name: "ordewell", title: "Ordewell", version: "0.1.0" };
 async function discoverAppServerModels(command, args, options = {}) {
-  const server4 = await openAppServer(command, args, { cwd: process.cwd(), deps: options.deps });
+  const env = options.env;
+  const server4 = await openAppServer(command, args, {
+    cwd: process.cwd(),
+    deps: { ...env ? { workspaceEnv: async () => definedOnly(env) } : {}, ...options.deps }
+  });
   if (!server4) return null;
   const { rpc } = server4;
   const asked = (async () => {
@@ -17289,10 +17524,10 @@ async function discoverAppServerModels(command, args, options = {}) {
 var execAsync2 = promisify2(exec2);
 var defaultExec2 = async (command, options) => {
   const PATH = await augmentedPath();
-  const { stdout } = await execAsync2(command, { ...options, maxBuffer: 32 * 1024 * 1024, env: withPath(process.env, PATH) });
+  const { stdout } = await execAsync2(command, { timeout: options?.timeout, maxBuffer: 32 * 1024 * 1024, env: withPath(options?.env ?? process.env, PATH) });
   return { stdout: String(stdout) };
 };
-var defaultAppServerClient = (command, args, options) => discoverAppServerModels(command, args, { timeout: options?.timeout });
+var defaultAppServerClient = (command, args, options) => discoverAppServerModels(command, args, { timeout: options?.timeout, env: options?.env });
 function effortVariant(effort) {
   return { id: effort, label: effort.charAt(0).toUpperCase() + effort.slice(1) };
 }
@@ -17326,7 +17561,7 @@ function geminiDiscoveryCacheKey(apiKey) {
   return {
     key: `gemini-models:${hash}`,
     dir,
-    file: path25.join(dir, `gemini_models_${hash}.json`)
+    file: path27.join(dir, `gemini_models_${hash}.json`)
   };
 }
 function readGeminiCache(apiKey) {
@@ -17413,15 +17648,22 @@ function applyVariants(models, manifest) {
   if (!variants || variants.length === 0) return models;
   return models.map((m) => m.variants.length > 0 ? m : { ...m, variants });
 }
-function resolveApiAuth(authMethods) {
+function listDir(dir) {
+  try {
+    return fsSync5.readdirSync(dir);
+  } catch {
+    return [];
+  }
+}
+function resolveApiAuth(authMethods, env) {
   for (const method of authMethods) {
     try {
       let token;
       if (method.type === "env") {
-        token = process.env[method.varName];
+        token = env[method.varName];
       } else {
-        const filePath = method.path.replace(/^~/, osMod.homedir());
-        if (!fsSync5.existsSync(filePath)) continue;
+        const filePath = expandRunnerHome(typeof method.path === "function" ? method.path(env) : method.path, env);
+        if (!filePath || !fsSync5.existsSync(filePath)) continue;
         const data = JSON.parse(fsSync5.readFileSync(filePath, "utf8"));
         token = method.jsonPath.split(".").reduce((obj, key) => {
           if (obj && typeof obj === "object") return obj[key];
@@ -17437,8 +17679,8 @@ function resolveApiAuth(authMethods) {
   }
   return null;
 }
-async function discoverFromApi(manifest, config, fetchImpl) {
-  const auth = resolveApiAuth(config.auth);
+async function discoverFromApi(manifest, config, env, fetchImpl) {
+  const auth = resolveApiAuth(config.auth, env);
   if (!auth) return null;
   try {
     const headers = { ...config.headers, [auth.header]: auth.value };
@@ -17454,7 +17696,7 @@ async function discoverFromApi(manifest, config, fetchImpl) {
 function wasKilled(err) {
   return !!err && typeof err === "object" && err.killed === true;
 }
-async function discoverFromCommand(manifest, execImpl) {
+async function discoverFromCommand(manifest, execImpl, env) {
   const discovery = manifest.modelDiscovery;
   const commands = discovery.discoveryCommands ?? [
     { command: discovery.command, args: discovery.args || [], parser: discovery.parser }
@@ -17463,7 +17705,7 @@ async function discoverFromCommand(manifest, execImpl) {
     let timedOut2 = false;
     for (const cmd of commands) {
       try {
-        const { stdout } = await execImpl(`${cmd.command} ${cmd.args.join(" ")}`, { timeout: 45e3 });
+        const { stdout } = await execImpl(`${cmd.command} ${cmd.args.join(" ")}`, { timeout: 45e3, env });
         const models = parseModelOutput(stdout, cmd.parser, manifest);
         if (models.length > 0) return { models: applyVariants(mergeCanonicalAliases(models, manifest), manifest), timedOut: timedOut2 };
       } catch (err) {
@@ -17529,21 +17771,26 @@ var ModelDiscovery = class {
    * same background service.
    */
   inflight = /* @__PURE__ */ new Map();
+  /** Bumped by every `clear()`: a discovery begun before one answers its own lookups but fills no cache. */
+  generation = 0;
   registry;
   execImpl;
   fetchImpl;
   appServerClient;
   readFileImpl;
   now;
-  constructor(registry, execImpl = defaultExec2, fetchImpl, appServerClient = defaultAppServerClient, readFileImpl, now = Date.now) {
+  env;
+  constructor(registry, execImpl = defaultExec2, fetchImpl, appServerClient = defaultAppServerClient, readFileImpl, now = Date.now, env = async () => process.env) {
     this.registry = registry;
     this.execImpl = execImpl;
     this.fetchImpl = fetchImpl;
     this.appServerClient = appServerClient;
     this.now = now;
+    this.env = env;
     this.readFileImpl = readFileImpl ?? ((filePath) => {
       try {
-        return fsSync5.readFileSync(filePath.replace(/^~/, osMod.homedir()), "utf8");
+        const file = expandRunnerHome(filePath);
+        return file ? fsSync5.readFileSync(file, "utf8") : null;
       } catch {
         return null;
       }
@@ -17555,16 +17802,17 @@ var ModelDiscovery = class {
    * null when both fail so `discover()` falls through to the remaining
    * methods.
    */
-  async discoverFromAppServer(manifest) {
+  async discoverFromAppServer(manifest, env) {
     const config = manifest.modelDiscovery.appServer;
     if (!config) return null;
-    const raw = await this.appServerClient(config.command, config.args);
+    const raw = await this.appServerClient(config.command, config.args, { env });
     if (raw) {
       const models = parseAppServerModels(raw);
       if (models.length > 0) return models;
     }
-    if (config.cacheFile) {
-      const content = this.readFileImpl(config.cacheFile);
+    const cacheFile = config.cacheFile && expandRunnerHome(typeof config.cacheFile === "function" ? config.cacheFile(env) : config.cacheFile, env);
+    if (cacheFile) {
+      const content = this.readFileImpl(cacheFile);
       if (content) {
         const models = parseCodexModelsCache(content);
         if (models.length > 0) return models;
@@ -17602,37 +17850,60 @@ var ModelDiscovery = class {
     if (!manifest) {
       return [];
     }
-    let models;
+    const generation2 = this.generation;
+    const env = await this.env().catch(() => process.env);
+    const found = await this.discoverFromSources(manifest, env);
+    const models = this.withSettingsModels(found.models, manifest, env);
+    if (generation2 !== this.generation) return models;
+    if (found.cacheable && models.length > 0) this.cache.set(runner, models);
+    else this.misses.set(runner, { models, at: this.now() });
+    return models;
+  }
+  async discoverFromSources(manifest, env) {
     let cacheable = true;
     const discovery = manifest.modelDiscovery;
     if (discovery.appServer) {
-      const appServerModels = await this.discoverFromAppServer(manifest);
-      if (appServerModels && appServerModels.length > 0) {
-        this.cache.set(runner, appServerModels);
-        return appServerModels;
-      }
+      const appServerModels = await this.discoverFromAppServer(manifest, env);
+      if (appServerModels && appServerModels.length > 0) return { models: appServerModels, cacheable: true };
       cacheable = false;
     }
     if (discovery.apiDiscovery) {
-      const apiModels = await discoverFromApi(manifest, discovery.apiDiscovery, this.fetchImpl);
+      const apiModels = await discoverFromApi(manifest, discovery.apiDiscovery, env, this.fetchImpl);
       if (apiModels && apiModels.length > 0) {
-        models = applyVariants(mergeCanonicalAliases(apiModels, manifest), manifest);
-        if (cacheable && models.length > 0) this.cache.set(runner, models);
-        return models;
+        return { models: applyVariants(mergeCanonicalAliases(apiModels, manifest), manifest), cacheable };
       }
     }
     if (discovery.method === "command" && (discovery.command || discovery.discoveryCommands?.length)) {
-      const result = await discoverFromCommand(manifest, this.execImpl);
-      models = result.models;
-      cacheable = !result.fromFallback;
-    } else {
-      models = buildFallbackModels(manifest);
+      const result = await discoverFromCommand(manifest, this.execImpl, env);
+      return { models: result.models, cacheable: !result.fromFallback };
     }
-    if (cacheable && models.length > 0) this.cache.set(runner, models);
-    else this.misses.set(runner, { models, at: this.now() });
-    return models;
+    return { models: buildFallbackModels(manifest), cacheable };
+  }
+  /**
+   * Append the models registered in the runner's own settings. Read on every
+   * discovery rather than cached apart, so a refresh picks up an edit;
+   * whatever the sources already offer keeps its entry and metadata.
+   */
+  withSettingsModels(models, manifest, env) {
+    const read2 = manifest.modelDiscovery.settingsModels;
+    if (!read2) return models;
+    const files = {
+      read: (filePath) => {
+        const file = expandRunnerHome(filePath, env);
+        return file ? this.readFileImpl(file) : null;
+      },
+      list: (dir) => {
+        const expanded = expandRunnerHome(dir, env);
+        return expanded ? listDir(expanded) : [];
+      },
+      env
+    };
+    const seen = new Set(models.map((m) => m.modelId));
+    const added = read2(files).filter((m) => !seen.has(m.modelId));
+    return added.length > 0 ? [...models, ...applyVariants(added, manifest)] : models;
   }
   clear() {
+    this.generation++;
     this.cache.clear();
     this.misses.clear();
     this.inflight.clear();
@@ -17798,7 +18069,7 @@ function parseMaxParallel(value) {
 
 // src/services/SettingsService.ts
 import * as fs12 from "fs";
-import * as path32 from "path";
+import * as path34 from "path";
 
 // src/utils/fileLock.ts
 import * as fs7 from "fs";
@@ -18088,7 +18359,7 @@ function stable(value) {
 }
 
 // src/services/runnerExit.ts
-var USAGE_LIMIT_RE = /\b(?:usage|session|weekly|daily|monthly) limit\b|\brate limit (?:exceeded|reached)\b|\brate[- ]limited\b|\blimit (?:will )?reset\b|\bquota (?:exceeded|reached)\b|\btoo many requests\b/i;
+var USAGE_LIMIT_RE = /\b(?:usage|session|weekly|daily|monthly) limit\b|\byou['’]ve hit your (?:[\w'’-]+ ){0,3}?limit\b|\brate limit (?:exceeded|reached)\b|\brate[- ]limited\b|\blimit (?:will )?reset\b|\bquota (?:exceeded|reached)\b|\btoo many requests\b/i;
 var USAGE_LIMIT_TAIL = 4096;
 function classifyRunnerStop(said2) {
   if (typeof said2 !== "string" && said2.usageLimit !== void 0) return said2.usageLimit ? "usage-limit" : "stopped";
@@ -18316,8 +18587,8 @@ var TurnStream = class {
 };
 
 // src/services/skillInvocation.ts
-import * as os10 from "os";
-function abbreviateHome(file, home = os10.homedir(), platform = process.platform) {
+import * as os9 from "os";
+function abbreviateHome(file, home = os9.homedir(), platform = process.platform) {
   const win = platform === "win32";
   const normal = (p) => win ? p.replace(/\\/g, "/") : p;
   const shown = normal(file);
@@ -18332,13 +18603,13 @@ function modelInvocablePlannerSkills(skills) {
 function modelInvocableTaskSkills(skills) {
   return skills.filter((skill) => skill.appliesTo === "task" && skill.modelInvocable);
 }
-function snapshotSkill(skill, invokedBy, home = os10.homedir()) {
+function snapshotSkill(skill, invokedBy, home = os9.homedir()) {
   return { invokedBy, name: skill.name, source: skill.source, path: abbreviateHome(skill.path, home), content: skill.content };
 }
 function attachSkill(skill, home) {
   return { ...snapshotSkill(skill, "user", home), content: "", attaches: { description: skill.description } };
 }
-function resolveSkillInvocation(text4, skillsService, home = os10.homedir()) {
+function resolveSkillInvocation(text4, skillsService, home = os9.homedir()) {
   const skills = skillTokens(text4).flatMap(({ name }) => {
     const skill = skillsService.findSkill(name);
     if (!skill?.userInvocable) return [];
@@ -18402,33 +18673,33 @@ ${skillBlock(entry.skill)}`, timestamp: entry.timestamp });
 }
 
 // src/services/taskSkills.ts
-import * as path31 from "path";
+import * as path33 from "path";
 
 // src/services/SkillsService.ts
 import { createHash as createHash2 } from "crypto";
 import * as fs11 from "fs";
-import * as path30 from "path";
+import * as path32 from "path";
 
 // src/services/builtinSkills.ts
-import * as path26 from "path";
+import * as path28 from "path";
 import { fileURLToPath } from "url";
 function builtinSkillsDir() {
-  const dir = typeof __dirname !== "undefined" && __dirname ? __dirname : path26.dirname(fileURLToPath(
+  const dir = typeof __dirname !== "undefined" && __dirname ? __dirname : path28.dirname(fileURLToPath(
     // @ts-expect-error - import.meta is only valid under an ESM module setting
     import.meta.url
   ));
-  return path26.join(dir, "..", "skills");
+  return path28.join(dir, "..", "skills");
 }
 
 // src/services/repoGroup.ts
 import * as fs10 from "fs";
-import * as path29 from "path";
+import * as path31 from "path";
 
 // src/services/worktreeBootstrap.ts
 import { exec as exec3 } from "child_process";
 import { promisify as promisify4 } from "util";
 import * as fs9 from "fs";
-import * as path28 from "path";
+import * as path30 from "path";
 
 // src/services/gitExec.ts
 import { execFile as execFile4 } from "child_process";
@@ -18510,7 +18781,7 @@ function subcommandOf2(args) {
 
 // src/services/worktreeLink.ts
 import * as fs8 from "fs";
-import * as path27 from "path";
+import * as path29 from "path";
 function linkPath(source, target, platform, hardLink = fs8.linkSync) {
   const isDir = fs8.statSync(source).isDirectory();
   if (platform !== "win32") {
@@ -18535,8 +18806,8 @@ function mirrorDir(source, target, opts) {
   const mirror = (from, to, prefix, top) => {
     fs8.mkdirSync(to, { recursive: true });
     for (const entry of fs8.readdirSync(from, { withFileTypes: true })) {
-      const name = path27.join(prefix, entry.name);
-      const at = { from: path27.join(from, entry.name), to: path27.join(to, entry.name), name };
+      const name = path29.join(prefix, entry.name);
+      const at = { from: path29.join(from, entry.name), to: path29.join(to, entry.name), name };
       if (entry.isSymbolicLink()) links.push(at);
       else if (top && entry.isDirectory() && (entry.name.startsWith("@") || entry.name === ".bin")) mirror(at.from, at.to, name, false);
       else if (linkPath(at.from, at.to, opts.platform, opts.hardLink) === "copy") copied.push(name);
@@ -18556,16 +18827,16 @@ function mirrorDir(source, target, opts) {
 }
 function relink(from, to, opts) {
   const text4 = fs8.readlinkSync(from);
-  const pointee = path27.isAbsolute(text4) ? rebased(text4, opts) : text4;
+  const pointee = path29.isAbsolute(text4) ? rebased(text4, opts) : text4;
   if (opts.platform !== "win32") {
-    if (!fs8.existsSync(path27.resolve(path27.dirname(to), pointee)) && fs8.existsSync(path27.resolve(path27.dirname(from), pointee))) {
-      fs8.symlinkSync(rebased(path27.resolve(path27.dirname(from), pointee), opts), to);
+    if (!fs8.existsSync(path29.resolve(path29.dirname(to), pointee)) && fs8.existsSync(path29.resolve(path29.dirname(from), pointee))) {
+      fs8.symlinkSync(rebased(path29.resolve(path29.dirname(from), pointee), opts), to);
       return "symlink";
     }
     fs8.symlinkSync(pointee, to);
     return "symlink";
   }
-  const resolved = fs8.existsSync(path27.resolve(path27.dirname(to), pointee)) ? path27.resolve(path27.dirname(to), pointee) : rebased(path27.resolve(path27.dirname(from), pointee), opts);
+  const resolved = fs8.existsSync(path29.resolve(path29.dirname(to), pointee)) ? path29.resolve(path29.dirname(to), pointee) : rebased(path29.resolve(path29.dirname(from), pointee), opts);
   try {
     fs8.statSync(resolved);
   } catch {
@@ -18574,9 +18845,9 @@ function relink(from, to, opts) {
   return linkPath(resolved, to, opts.platform, opts.hardLink);
 }
 function rebased(pointee, opts) {
-  const rel = path27.relative(opts.from, pointee);
-  const inside2 = rel !== "" && !rel.startsWith("..") && !path27.isAbsolute(rel);
-  return inside2 && !rel.split(/[\\/]/).includes("node_modules") ? path27.join(opts.to, rel) : pointee;
+  const rel = path29.relative(opts.from, pointee);
+  const inside2 = rel !== "" && !rel.startsWith("..") && !path29.isAbsolute(rel);
+  return inside2 && !rel.split(/[\\/]/).includes("node_modules") ? path29.join(opts.to, rel) : pointee;
 }
 
 // src/services/worktreeBootstrap.ts
@@ -18593,7 +18864,7 @@ function lexists(target) {
     return false;
   }
 }
-function listDir(dir) {
+function listDir2(dir) {
   try {
     return fs9.readdirSync(dir).sort();
   } catch {
@@ -18613,18 +18884,18 @@ function matchLinks(root, patterns) {
 }
 function segmentMatches(root, base, segment) {
   const under = (name) => base ? `${base}/${name}` : name;
-  if (!/[*?]/.test(segment)) return lexists(path28.join(root, base, segment)) ? [under(segment)] : [];
+  if (!/[*?]/.test(segment)) return lexists(path30.join(root, base, segment)) ? [under(segment)] : [];
   const pattern = new RegExp(`^${segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`);
-  return listDir(path28.join(root, base)).filter((name) => !NEVER_SCANNED.has(name) && pattern.test(name)).map(under);
+  return listDir2(path30.join(root, base)).filter((name) => !NEVER_SCANNED.has(name) && pattern.test(name)).map(under);
 }
 function installDirs(root) {
   const packages = matchLinks(root, workspaceGlobs(root)).map((pkg) => `${pkg}/node_modules`);
-  return ["node_modules", ...packages].filter((dir) => lexists(path28.join(root, dir)));
+  return ["node_modules", ...packages].filter((dir) => lexists(path30.join(root, dir)));
 }
 function workspaceGlobs(root) {
   let manifest;
   try {
-    manifest = JSON.parse(fs9.readFileSync(path28.join(root, "package.json"), "utf8"));
+    manifest = JSON.parse(fs9.readFileSync(path30.join(root, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -18639,19 +18910,19 @@ async function bootstrap(repo, cwd, opts) {
   const linked = [];
   const copied = [];
   const link = (name) => {
-    const target = path28.join(cwd, name);
+    const target = path30.join(cwd, name);
     if (lexists(target)) return;
-    fs9.mkdirSync(path28.dirname(target), { recursive: true });
-    if (linkPath(path28.join(repo.root, name), target, opts.platform) === "copy") copied.push(name);
+    fs9.mkdirSync(path30.dirname(target), { recursive: true });
+    if (linkPath(path30.join(repo.root, name), target, opts.platform) === "copy") copied.push(name);
     linked.push(name);
   };
   const mirror = (name) => {
-    const target = path28.join(cwd, name);
-    if (lexists(target) || !fs9.existsSync(path28.dirname(target))) return;
-    const source = path28.join(repo.root, name);
+    const target = path30.join(cwd, name);
+    if (lexists(target) || !fs9.existsSync(path30.dirname(target))) return;
+    const source = path30.join(repo.root, name);
     if (!fs9.lstatSync(source).isDirectory()) return link(name);
     const mirrored = mirrorDir(source, target, { platform: opts.platform, from: repo.root, to: cwd });
-    copied.push(...mirrored.map((entry) => path28.join(name, entry)));
+    copied.push(...mirrored.map((entry) => path30.join(name, entry)));
     linked.push(name);
   };
   if (!setup) {
@@ -18686,12 +18957,12 @@ async function runSetup(command, repo, cwd, resolvePath) {
 
 // src/services/repoGroup.ts
 function hasGitEntry(dir) {
-  return fs10.existsSync(path29.join(dir, ".git"));
+  return fs10.existsSync(path31.join(dir, ".git"));
 }
 function groupPathOf(listed3) {
   const slashed = listed3.trim().replace(/\\/g, "/");
-  if (path29.posix.isAbsolute(slashed) || path29.win32.isAbsolute(slashed)) return null;
-  const rel = path29.posix.normalize(slashed).replace(/\/+$/, "");
+  if (path31.posix.isAbsolute(slashed) || path31.win32.isAbsolute(slashed)) return null;
+  const rel = path31.posix.normalize(slashed).replace(/\/+$/, "");
   return rel === "" || rel === "." || rel === ".." || rel.startsWith("../") ? null : rel;
 }
 function childDirs(dir) {
@@ -18702,14 +18973,14 @@ function childDirs(dir) {
   }
 }
 function groupPaths(workspaceRoot, listed3) {
-  if (listed3.length === 0) return childDirs(workspaceRoot).filter((name) => hasGitEntry(path29.join(workspaceRoot, name)));
-  const paths = listed3.map(groupPathOf).filter((rel) => rel !== null && hasGitEntry(path29.join(workspaceRoot, rel)));
+  if (listed3.length === 0) return childDirs(workspaceRoot).filter((name) => hasGitEntry(path31.join(workspaceRoot, name)));
+  const paths = listed3.map(groupPathOf).filter((rel) => rel !== null && hasGitEntry(path31.join(workspaceRoot, rel)));
   return [...new Set(paths)].sort();
 }
 function workspaceRepoGroup(workspaceRoot, listed3) {
-  for (let dir = path29.resolve(workspaceRoot); ; dir = path29.dirname(dir)) {
+  for (let dir = path31.resolve(workspaceRoot); ; dir = path31.dirname(dir)) {
     if (hasGitEntry(dir)) return [SELF_REPO];
-    if (path29.dirname(dir) === dir) break;
+    if (path31.dirname(dir) === dir) break;
   }
   return groupPaths(workspaceRoot, listed3);
 }
@@ -18790,8 +19061,8 @@ function copyDirSync(src, dest) {
   fs11.mkdirSync(dest, { recursive: true });
   const entries = fs11.readdirSync(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = path30.join(src, entry.name);
-    const destPath = path30.join(dest, entry.name);
+    const srcPath = path32.join(src, entry.name);
+    const destPath = path32.join(dest, entry.name);
     if (entry.isDirectory()) copyDirSync(srcPath, destPath);
     else fs11.copyFileSync(srcPath, destPath);
   }
@@ -18815,7 +19086,7 @@ function readDir(dir, source) {
   if (!fs11.existsSync(dir)) return { skills, invalid };
   for (const entry of fs11.readdirSync(dir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const skillFile = path30.join(dir, entry.name, "SKILL.md");
+    const skillFile = path32.join(dir, entry.name, "SKILL.md");
     if (!fs11.existsSync(skillFile)) continue;
     if (!isSkillName(entry.name)) {
       invalid.push({ name: entry.name, path: skillFile, source, reason: INVALID_SKILL_NAME_REASON });
@@ -18834,15 +19105,15 @@ function skillFileIn(dir, name) {
     return void 0;
   }
   if (!entries.some((entry) => entry.isDirectory() && entry.name === name)) return void 0;
-  const skillFile = path30.join(dir, name, "SKILL.md");
+  const skillFile = path32.join(dir, name, "SKILL.md");
   return fs11.existsSync(skillFile) ? skillFile : void 0;
 }
 function skillsDirOf(root) {
-  return path30.join(root, STATE_DIR, "skills");
+  return path32.join(root, STATE_DIR, "skills");
 }
 function workspaceSkillRoots(workspaceRoot, repos, checkout = workspaceRoot) {
   if (repos.length === 0 || repos.includes(SELF_REPO)) return [checkout];
-  return [workspaceRoot, ...repos.map((repo) => path30.join(checkout, repo))];
+  return [workspaceRoot, ...repos.map((repo) => path32.join(checkout, repo))];
 }
 var SkillsService = class _SkillsService {
   workspaceRoots;
@@ -18865,11 +19136,11 @@ var SkillsService = class _SkillsService {
     return this.workspaceRoots.map(skillsDirOf);
   }
   globalDir() {
-    return path30.join(globalDataDir(), "skills");
+    return path32.join(globalDataDir(), "skills");
   }
   readSeedManifest() {
     try {
-      const parsed = JSON.parse(fs11.readFileSync(path30.join(this.globalDir(), SEED_MANIFEST), "utf8"));
+      const parsed = JSON.parse(fs11.readFileSync(path32.join(this.globalDir(), SEED_MANIFEST), "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         return Object.fromEntries(
           Object.entries(parsed).filter((entry) => typeof entry[1] === "string")
@@ -18885,7 +19156,7 @@ var SkillsService = class _SkillsService {
     manifest[name] = hash;
     try {
       fs11.mkdirSync(this.globalDir(), { recursive: true });
-      fs11.writeFileSync(path30.join(this.globalDir(), SEED_MANIFEST), JSON.stringify(manifest, null, 2));
+      fs11.writeFileSync(path32.join(this.globalDir(), SEED_MANIFEST), JSON.stringify(manifest, null, 2));
     } catch (err) {
       console.warn(`Could not record seeded skill ${name}: ${String(err)}`);
     }
@@ -18896,11 +19167,11 @@ var SkillsService = class _SkillsService {
     return this.readSeedManifest()[name] === currentHash || (PRIOR_BUILTIN_HASHES[name] ?? []).includes(currentHash);
   }
   seed(name) {
-    const dest = path30.join(this.globalDir(), name);
+    const dest = path32.join(this.globalDir(), name);
     const exists = fs11.existsSync(dest);
     let srcDir;
     try {
-      srcDir = path30.join(builtinSkillsDir(), name);
+      srcDir = path32.join(builtinSkillsDir(), name);
     } catch (err) {
       if (!exists) console.warn(`Could not locate built-in skills dir: ${String(err)}`);
       return false;
@@ -18909,9 +19180,9 @@ var SkillsService = class _SkillsService {
       if (!exists) console.warn(`Built-in skill not found in package: ${name}`);
       return false;
     }
-    const srcHash = fileHash(path30.join(srcDir, "SKILL.md"));
+    const srcHash = fileHash(path32.join(srcDir, "SKILL.md"));
     if (exists) {
-      const currentHash = fileHash(path30.join(dest, "SKILL.md"));
+      const currentHash = fileHash(path32.join(dest, "SKILL.md"));
       if (currentHash !== void 0 && currentHash === srcHash) {
         this.recordSeed(name, currentHash);
         return false;
@@ -18955,7 +19226,7 @@ var SkillsService = class _SkillsService {
     if (entries.length !== 1 || entries[0].name !== "SKILL.md" || !entries[0].isFile()) return false;
     let raw;
     try {
-      raw = readSkillText(path30.join(dir, "SKILL.md"));
+      raw = readSkillText(path32.join(dir, "SKILL.md"));
     } catch {
       return false;
     }
@@ -18963,7 +19234,7 @@ var SkillsService = class _SkillsService {
   }
   pruneRetired() {
     for (const name of RETIRED_BUILTIN_SKILL_NAMES) {
-      const dest = path30.join(this.globalDir(), name);
+      const dest = path32.join(this.globalDir(), name);
       if (!fs11.existsSync(dest)) continue;
       if (!this.isUnmodifiedRetiredSeed(dest, name)) continue;
       try {
@@ -19101,12 +19372,12 @@ var runGit = execFileWithTimeout(1e4);
 async function committedInHead(files) {
   const byDir = /* @__PURE__ */ new Map();
   for (const file of new Set(files)) {
-    const dir = path31.dirname(path31.dirname(file));
+    const dir = path33.dirname(path33.dirname(file));
     byDir.set(dir, [...byDir.get(dir) ?? [], file]);
   }
   const result = /* @__PURE__ */ new Map();
   await Promise.all([...byDir].map(async ([dir, inDir]) => {
-    const relative17 = (file) => path31.relative(dir, file).split(path31.sep).join("/");
+    const relative17 = (file) => path33.relative(dir, file).split(path33.sep).join("/");
     try {
       const { stdout } = await runGit("git", ["ls-tree", "--name-only", "HEAD", "--", ...inDir.map(relative17)], { cwd: dir, env: cleanEnv() });
       const listed3 = new Set(stdout.split("\n").map((line) => line.trim()).filter(Boolean));
@@ -19126,9 +19397,9 @@ function plannedSkillLookup(skillsAt, workspaceRoot, layout) {
     searchedDirs: () => lookup2.searchedDirs(),
     listSkills: () => lookup2.listSkills(),
     uncommitted: async (skills) => {
-      const checked = skills.filter((skill) => skill.source === "workspace" && !(readInPlace && path31.dirname(path31.dirname(skill.path)) === readInPlace));
+      const checked = skills.filter((skill) => skill.source === "workspace" && !(readInPlace && path33.dirname(path33.dirname(skill.path)) === readInPlace));
       const committed = await committedInHead(checked.map((skill) => skill.path));
-      return new Map(checked.filter((skill) => committed.get(skill.path) === false).map((skill) => [skill.path, path31.relative(workspaceRoot, path31.dirname(skill.path)).split(path31.sep).join("/")]));
+      return new Map(checked.filter((skill) => committed.get(skill.path) === false).map((skill) => [skill.path, path33.relative(workspaceRoot, path33.dirname(skill.path)).split(path33.sep).join("/")]));
     }
   };
 }
@@ -19141,13 +19412,13 @@ function checkPlanSkills(tasks, lookup2) {
 function checkTaskSkillsEdit(task2, skills, lookup2) {
   return check([{ taskId: task2.id, owner: `Task "${task2.title}"`, ...attached(skills) }], lookup2);
 }
-function subtaskEntries(op, spec, path46 = []) {
+function subtaskEntries(op, spec, path49 = []) {
   const subtasks = spec?.subtasks;
   if (!Array.isArray(subtasks)) return [];
   return subtasks.flatMap((sub, i) => {
     if (typeof sub !== "object" || sub === null) return [];
     const child = sub;
-    const at = [...path46, typeof child.title === "string" && child.title.trim() ? `"${child.title}"` : `#${i + 1}`];
+    const at = [...path49, typeof child.title === "string" && child.title.trim() ? `"${child.title}"` : `#${i + 1}`];
     return [{ op, owner: `subtask ${at.join(" > ")}`, ...attached(child.skills) }, ...subtaskEntries(op, child, at)];
   });
 }
@@ -22989,7 +23260,7 @@ var RUN_SETTING_KEYS = Object.keys(RUN_SETTING_CHECKS);
 function getSettingsPath() {
   const override = process.env.ORDEWELL_SETTINGS_PATH;
   if (override && override.trim()) return override.trim();
-  return path32.join(globalDataDir(), "settings.json");
+  return path34.join(globalDataDir(), "settings.json");
 }
 function readPlannerModels(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
@@ -23069,8 +23340,8 @@ var SettingsService = class {
    * a watch on the old one pointing at nothing.
    */
   watch(listener) {
-    const dir = path32.dirname(this.filePath);
-    const name = path32.basename(this.filePath);
+    const dir = path34.dirname(this.filePath);
+    const name = path34.basename(this.filePath);
     let seen = this.fileStamp();
     let timer;
     let dead = false;
@@ -23079,7 +23350,7 @@ var SettingsService = class {
       fs12.mkdirSync(dir, { recursive: true });
       watcher = fs12.watch(dir, (_event, changed) => {
         if (dead) return;
-        if (changed && changed !== name && changed !== path32.basename(dir)) return;
+        if (changed && changed !== name && changed !== path34.basename(dir)) return;
         clearTimeout(timer);
         timer = setTimeout(() => {
           const stamp2 = this.fileStamp();
@@ -23312,7 +23583,7 @@ var SettingsService = class {
     if (this.unreadable) {
       throw new Error(`Cannot save settings: ${this.filePath} could not be read, so it will not be overwritten. Fix or remove it and try again.`);
     }
-    const dir = path32.dirname(this.filePath);
+    const dir = path34.dirname(this.filePath);
     if (!fs12.existsSync(dir)) {
       fs12.mkdirSync(dir, { recursive: true });
     }
@@ -23756,7 +24027,7 @@ var BaseConfig = class {
     const { model, effort, override = "" } = configured;
     const named3 = isPlannerBackend(configured.setting ?? "") || isPlannerBackend(process.env.AI_PROVIDER ?? "");
     const pickedElsewhere = configured.pickedFor !== void 0 && configured.pickedFor !== provider;
-    const kept = configured.pickedFor === provider || !pickedElsewhere && (isApiProvider(provider) || named3 && !isForeignModel(provider, model, this.agentCatalog(provider)));
+    const kept = configured.pickedFor === provider || !pickedElsewhere && (isApiProvider(provider) || named3 && !isForeignModel(provider, model, () => this.agentCatalog(provider)));
     if (kept) return { model: override || model, effort, source: override ? "request" : "configured" };
     const own = pickedElsewhere || named3 ? rememberedOrDefault(provider) : detectedAgentChoice(provider, configured);
     return !override || override === own.model ? own : { model: override, effort: "", source: "request" };
@@ -23765,7 +24036,8 @@ var BaseConfig = class {
    * The model ids a coding agent was last discovered serving, empty while
    * discovery is cold. A host that holds a runner catalog supplies it: it is
    * the only evidence that tells OpenCode's `provider/model` ids from an
-   * OpenRouter slug.
+   * OpenRouter slug. Asked only when a named agent's configured model is
+   * neither its alias nor its remembered pick.
    */
   agentCatalog(_provider) {
     return [];
@@ -23790,8 +24062,10 @@ function isVendorModelFor(agent, model) {
   return !discoveryOf(agent)?.providerQualifiedIds && SLUG_SHAPE.test(model);
 }
 function isForeignModel(agent, model, catalog) {
-  if (!model || isStableAlias(agent, model) || catalog.includes(model) || rememberedChoice(agent)?.model === model) return false;
-  return isVendorModelFor(agent, model) || catalog.length > 0 && SLUG_SHAPE.test(model);
+  if (!model || isStableAlias(agent, model) || rememberedChoice(agent)?.model === model) return false;
+  const listed3 = catalog();
+  if (listed3.includes(model)) return false;
+  return isVendorModelFor(agent, model) || listed3.length > 0 && SLUG_SHAPE.test(model);
 }
 function rememberedChoice(provider) {
   const entry = new SettingsService().getPlannerModel(provider);
@@ -23826,11 +24100,11 @@ var EnvConfig = class extends BaseConfig {
 // src/services/taskDiffRead.ts
 import { createHash as createHash3 } from "crypto";
 import * as fs13 from "fs";
-import * as path33 from "path";
+import * as path35 from "path";
 import { devNull } from "os";
 var TASK_DIFF_UNAVAILABLE = "Task diff is not available for this run: no task-specific changes were recorded (shared runs cannot attribute workspace changes to one task).";
 function allowedPath(file) {
-  return file.length > 0 && !path33.isAbsolute(file) && !/^[A-Za-z]:/.test(file) && !file.split(/[\\/]/).some((part) => part === ".." || part === ".git" || part === ".ordewell");
+  return file.length > 0 && !path35.isAbsolute(file) && !/^[A-Za-z]:/.test(file) && !file.split(/[\\/]/).some((part) => part === ".." || part === ".git" || part === ".ordewell");
 }
 function stats(raw) {
   return raw.split("\0").flatMap((row) => {
@@ -23839,8 +24113,8 @@ function stats(raw) {
   });
 }
 function inside(root, target) {
-  const rel = path33.relative(root, target);
-  return rel === "" || !rel.startsWith(`..${path33.sep}`) && rel !== ".." && !path33.isAbsolute(rel);
+  const rel = path35.relative(root, target);
+  return rel === "" || !rel.startsWith(`..${path35.sep}`) && rel !== ".." && !path35.isAbsolute(rel);
 }
 function unquoted(quoted4) {
   const bytes = [];
@@ -23888,10 +24162,10 @@ function patchFiles(patch) {
   const sections = patch.toString("utf8").split(/(?<![^\n])(?=diff --git )/).filter((section) => section.startsWith("diff --git "));
   const files = /* @__PURE__ */ new Map();
   for (const section of sections) {
-    const path46 = sectionPath(section);
+    const path49 = sectionPath(section);
     const counts = sectionStats(section);
-    const earlier = files.get(path46);
-    files.set(path46, earlier ? { path: path46, section: earlier.section + section, added: summed(earlier.added, counts.added), removed: summed(earlier.removed, counts.removed) } : { path: path46, section, ...counts });
+    const earlier = files.get(path49);
+    files.set(path49, earlier ? { path: path49, section: earlier.section + section, added: summed(earlier.added, counts.added), removed: summed(earlier.removed, counts.removed) } : { path: path49, section, ...counts });
   }
   return [...files.values()];
 }
@@ -23961,11 +24235,11 @@ async function readTaskDiff(invoker, run, taskId, options) {
         files.push({ ...file, repo: repo.path, patch: () => git(reader, cwd, [...diffArgs, "--", `:(top,literal)${prefix}${file.path}`]) });
       }
       if (live2) {
-        const workspace = path33.join(entry.worktree, prefix);
+        const workspace = path35.join(entry.worktree, prefix);
         const others = await git(reader, workspace, [...common, "ls-files", "--others", "--exclude-standard", "-z", "--", "."]);
         for (const file of others.split("\0").filter((f) => allowed(f))) {
-          const full = path33.join(workspace, file);
-          if (!inside(fs13.realpathSync(workspace), fs13.realpathSync(path33.dirname(full)))) continue;
+          const full = path35.join(workspace, file);
+          if (!inside(fs13.realpathSync(workspace), fs13.realpathSync(path35.dirname(full)))) continue;
           const untracked = async (numstat) => {
             const result = await tryGit(reader, workspace, [...common, "diff", "--no-index", "--no-renames", "--no-ext-diff", "--no-textconv", ...numstat ? ["--numstat", "-z"] : [], "--", devNull, file]);
             if (!result.ok && result.code !== 1) throw new Error(result.stderr.trim() || "Could not read an untracked file diff.");
@@ -23995,11 +24269,11 @@ ${await file.patch()}`);
 import { randomBytes as randomBytes6 } from "crypto";
 import { spawnSync } from "child_process";
 import * as fs15 from "fs";
-import * as path35 from "path";
+import * as path37 from "path";
 
 // src/utils/prdStore.ts
 import * as fs14 from "fs";
-import * as path34 from "path";
+import * as path36 from "path";
 var PRD_BLOCK_RE = /<!--\s*ORDEWELL_PRD_START\s+slug="([^"]+)"\s*-->\s*([\s\S]*?)\s*<!--\s*ORDEWELL_PRD_END\s*-->/;
 function extractPrdBlock(text4) {
   const match = PRD_BLOCK_RE.exec(text4);
@@ -24013,9 +24287,9 @@ function sanitizeSlug(raw) {
   return raw.toLowerCase().replace(/[^a-z0-9-_]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 }
 function savePrdMarkdown(workspace, slug, markdown) {
-  const dir = path34.join(workspace, ".scratch", sanitizeSlug(slug));
+  const dir = path36.join(workspace, ".scratch", sanitizeSlug(slug));
   fs14.mkdirSync(dir, { recursive: true });
-  const file = path34.join(dir, "PRD.md");
+  const file = path36.join(dir, "PRD.md");
   fs14.writeFileSync(file, markdown.endsWith("\n") ? markdown : markdown + "\n", "utf8");
   return file;
 }
@@ -24047,12 +24321,12 @@ var NESTED_REPO_DEPTH = 2;
 var GITLINK_MODE = "160000";
 var READ_ONLY = ["--no-optional-locks", "-c", "core.fsmonitor=false"];
 function isInside(parent, child) {
-  const rel = path35.relative(parent, child);
-  return rel !== "" && !rel.startsWith("..") && !path35.isAbsolute(rel);
+  const rel = path37.relative(parent, child);
+  return rel !== "" && !rel.startsWith("..") && !path37.isAbsolute(rel);
 }
 function resolvesAsNamed(base, p) {
   try {
-    return fs15.realpathSync(p) === path35.join(fs15.realpathSync(base), path35.relative(base, p));
+    return fs15.realpathSync(p) === path37.join(fs15.realpathSync(base), path37.relative(base, p));
   } catch {
     return false;
   }
@@ -24107,7 +24381,7 @@ function sameDir(a, b) {
     try {
       return fs15.realpathSync.native(p);
     } catch {
-      return path35.resolve(p);
+      return path37.resolve(p);
     }
   };
   return real(a) === real(b);
@@ -24129,7 +24403,7 @@ function clearImmutableFlags(platform, dir) {
   spawnSync("/usr/bin/chflags", ["-R", "nouchg", dir], { stdio: "ignore" });
 }
 function leftoverLinks(dir) {
-  const named3 = listDir(dir).filter((name) => LINKED_ARTIFACTS.has(name) || isEnvFile(name) || isLink(path35.join(dir, name)));
+  const named3 = listDir2(dir).filter((name) => LINKED_ARTIFACTS.has(name) || isEnvFile(name) || isLink(path37.join(dir, name)));
   return [.../* @__PURE__ */ new Set([...named3, ...installDirs(dir)])];
 }
 function isLink(target) {
@@ -24202,7 +24476,7 @@ var GitWorktreeIsolation = class {
       const head = await this.headOf(root);
       const repo = { path: repoPath, head };
       if (scan.toplevel !== void 0) {
-        const top = path35.relative(workspaceRoot, scan.toplevel).split(path35.sep).join("/");
+        const top = path37.relative(workspaceRoot, scan.toplevel).split(path37.sep).join("/");
         if (top !== "") repo.top = top;
       }
       if (enabled && (head.kind === "branch" || head.kind === "detached")) {
@@ -24259,9 +24533,9 @@ var GitWorktreeIsolation = class {
   async nestedRepos(workspaceRoot, toplevel) {
     const found = [];
     const walk = (rel, depth) => {
-      for (const name of childDirs(path35.join(workspaceRoot, rel))) {
+      for (const name of childDirs(path37.join(workspaceRoot, rel))) {
         const child = rel ? `${rel}/${name}` : name;
-        if (hasGitEntry(path35.join(workspaceRoot, child))) found.push(child);
+        if (hasGitEntry(path37.join(workspaceRoot, child))) found.push(child);
         else if (depth < NESTED_REPO_DEPTH) walk(child, depth + 1);
       }
     };
@@ -24279,7 +24553,7 @@ var GitWorktreeIsolation = class {
       const [meta, file] = entry.split("	");
       if (file !== void 0 && meta.startsWith(`${GITLINK_MODE} `)) paths.add(file);
     }
-    const declared = await this.tryGit(workspaceRoot, ["config", "-z", "-f", path35.join(toplevel, ".gitmodules"), "--get-regexp", "^submodule\\..*\\.path$"]);
+    const declared = await this.tryGit(workspaceRoot, ["config", "-z", "-f", path37.join(toplevel, ".gitmodules"), "--get-regexp", "^submodule\\..*\\.path$"]);
     for (const entry of declared.stdout.split("\0")) {
       const value = entry.split("\n")[1];
       if (value) paths.add(value.replace(/\/+$/, ""));
@@ -24337,7 +24611,7 @@ var GitWorktreeIsolation = class {
   async acceptsWorktree(run, repo) {
     const dir = this.integrationDir(run, repo);
     ensureStateDirIgnored(run.workspaceRoot);
-    fs15.mkdirSync(path35.dirname(dir), { recursive: true });
+    fs15.mkdirSync(path37.dirname(dir), { recursive: true });
     const added = await this.tryGit(repo.root, ["worktree", "add", "-q", "--no-checkout", dir, repo.integrationBranch]);
     await this.removeWorktreeDir(run, repo, dir, []);
     return added.ok;
@@ -24352,12 +24626,12 @@ var GitWorktreeIsolation = class {
     if (isolated.includes(SELF_REPO)) return [];
     const shared2 = [];
     const walk = (rel) => {
-      for (const name of listDir(path35.join(workspaceRoot, rel))) {
+      for (const name of listDir2(path37.join(workspaceRoot, rel))) {
         if (!rel && (name === STATE_DIR || name === ".git")) continue;
         const child = rel ? `${rel}/${name}` : name;
         if (isolated.includes(child)) continue;
         if (isolated.some((p) => p.startsWith(`${child}/`))) walk(child);
-        else if (resolves(path35.join(workspaceRoot, child))) shared2.push(child);
+        else if (resolves(path37.join(workspaceRoot, child))) shared2.push(child);
       }
     };
     walk("");
@@ -24397,9 +24671,9 @@ var GitWorktreeIsolation = class {
       try {
         ensureStateDirIgnored(run.workspaceRoot);
         for (const repo of run.repos) {
-          const worktree = path35.join(dir, repo.path);
+          const worktree = path37.join(dir, repo.path);
           const tip = (await this.git(repo.root, ["rev-parse", repo.integrationBranch])).trim();
-          fs15.mkdirSync(path35.dirname(worktree), { recursive: true });
+          fs15.mkdirSync(path37.dirname(worktree), { recursive: true });
           await this.git(repo.root, ["worktree", "add", "-q", "-B", branch, worktree, tip]);
           record.repos[repo.path] = { worktree, linked: [], baseRef: tip };
         }
@@ -24424,13 +24698,13 @@ var GitWorktreeIsolation = class {
             setupFailed.push({ repo: repo.path, detail: err.detail });
           }
           entry.linked = boot.linked;
-          copied.push(...boot.copied.map((name) => path35.posix.join(repo.path, name)));
+          copied.push(...boot.copied.map((name) => path37.posix.join(repo.path, name)));
         }
         for (const rel of run.shared) {
-          const source = path35.join(run.workspaceRoot, rel);
-          const target = path35.join(cwd, rel);
+          const source = path37.join(run.workspaceRoot, rel);
+          const target = path37.join(cwd, rel);
           if (!resolves(source) || lexists(target)) continue;
-          fs15.mkdirSync(path35.dirname(target), { recursive: true });
+          fs15.mkdirSync(path37.dirname(target), { recursive: true });
           if (linkPath(source, target, this.platform) === "copy") copied.push(rel);
           const entry = self ? record.repos[SELF_REPO] : void 0;
           if (entry) entry.linked.push(rel);
@@ -24462,7 +24736,7 @@ var GitWorktreeIsolation = class {
    */
   async clearLeftovers(run, task2, names) {
     const removal = noRemoval();
-    const holder = Object.values(run.tasks).find((r) => r.taskId !== task2.id && (r.branch === names.branch || path35.resolve(r.workspace) === path35.resolve(names.dir) || isInside(r.workspace, names.dir)));
+    const holder = Object.values(run.tasks).find((r) => r.taskId !== task2.id && (r.branch === names.branch || path37.resolve(r.workspace) === path37.resolve(names.dir) || isInside(r.workspace, names.dir)));
     if (holder) throw new Error(`Its worktree path or branch is held by the record of task ${holder.order} (${holder.title}); Ordewell will not remove it`);
     const found = [];
     for (const repo of run.repos) {
@@ -24472,14 +24746,14 @@ var GitWorktreeIsolation = class {
         worktree: /^worktree (.+)$/m.exec(block)?.[1],
         branch: /^branch refs\/heads\/(.+)$/m.exec(block)?.[1]
       }));
-      const at = /* @__PURE__ */ new Set([path35.join(names.dir, repo.path)]);
+      const at = /* @__PURE__ */ new Set([path37.join(names.dir, repo.path)]);
       for (const entry of registered) {
-        if (entry.worktree && entry.branch === names.branch && isInside(this.runRoot(run), path35.resolve(entry.worktree))) at.add(entry.worktree);
+        if (entry.worktree && entry.branch === names.branch && isInside(this.runRoot(run), path37.resolve(entry.worktree))) at.add(entry.worktree);
       }
-      const base = { branch: names.branch, name: path35.basename(names.dir), title: task2.title };
+      const base = { branch: names.branch, name: path37.basename(names.dir), title: task2.title };
       for (const worktree of at) {
         if (!fs15.existsSync(worktree)) continue;
-        const linked = leftoverLinks(path35.join(worktree, await this.prefixOf(repo)));
+        const linked = leftoverLinks(path37.join(worktree, await this.prefixOf(repo)));
         found.push({ repo, worktree, target: { ...base, worktree, linked } });
       }
       found.push({ repo, worktree: names.dir, target: { ...base, linked: [] } });
@@ -24572,7 +24846,7 @@ var GitWorktreeIsolation = class {
    */
   async inWorkspacePlace(repo, worktree) {
     const prefix = await this.prefixOf(repo);
-    return prefix ? path35.join(worktree, prefix) : worktree;
+    return prefix ? path37.join(worktree, prefix) : worktree;
   }
   async prefixOf(repo) {
     return (await this.git(repo.root, ["rev-parse", "--show-prefix"])).trim();
@@ -25102,15 +25376,15 @@ var GitWorktreeIsolation = class {
     return landingMessage(kind, from, this.deps.plannedWith?.() ?? false);
   }
   integrationDir(run, repo) {
-    return path35.join(this.runRoot(run), INTEGRATION_DIR, repo.path);
+    return path37.join(this.runRoot(run), INTEGRATION_DIR, repo.path);
   }
   async ensureIntegrationWorktree(run, repo) {
     return this.admin(run.workspaceRoot, async () => {
       const dir = this.integrationDir(run, repo);
-      if (fs15.existsSync(path35.join(dir, ".git"))) return dir;
+      if (fs15.existsSync(path37.join(dir, ".git"))) return dir;
       await this.tryGit(repo.root, ["worktree", "prune"]);
       ensureStateDirIgnored(run.workspaceRoot);
-      fs15.mkdirSync(path35.dirname(dir), { recursive: true });
+      fs15.mkdirSync(path37.dirname(dir), { recursive: true });
       await this.git(repo.root, ["worktree", "add", "-q", dir, repo.integrationBranch]);
       return dir;
     });
@@ -25133,7 +25407,7 @@ var GitWorktreeIsolation = class {
     const removal = noRemoval();
     for (const repo of opts.preserve === false || record.readOnly ? [] : run.repos) {
       const entry = record.repos[repo.path];
-      const target = { worktree: entry?.worktree, linked: entry?.linked ?? [], branch: record.branch, name: path35.basename(record.workspace), title: record.title, commit: record.commit };
+      const target = { worktree: entry?.worktree, linked: entry?.linked ?? [], branch: record.branch, name: path37.basename(record.workspace), title: record.title, commit: record.commit };
       try {
         const kept = await this.preserve(run, repo, target, opts.intent);
         if (kept) removal.preserved.push({ task: task2, ...kept });
@@ -25214,7 +25488,7 @@ var GitWorktreeIsolation = class {
       return;
     }
     for (const entry of entries) {
-      const target = path35.join(dir, entry.name);
+      const target = path37.join(dir, entry.name);
       if (entry.isSymbolicLink()) this.unlinkIfLink(target);
       else if (entry.isDirectory()) this.unlinkLinksUnder(target);
     }
@@ -25236,20 +25510,20 @@ var GitWorktreeIsolation = class {
         return false;
       }
     };
-    const owned = new Set(Object.values(run.tasks).map((r) => path35.resolve(r.workspace)));
+    const owned = new Set(Object.values(run.tasks).map((r) => path37.resolve(r.workspace)));
     const root = this.runRoot(run);
     if (fs15.existsSync(root)) {
       for (const entry of fs15.readdirSync(root)) {
-        const dir = path35.join(root, entry);
-        if (entry === INTEGRATION_DIR || owned.has(path35.resolve(dir))) continue;
+        const dir = path37.join(root, entry);
+        if (entry === INTEGRATION_DIR || owned.has(path37.resolve(dir))) continue;
         let kept = true;
         for (const repo of run.repos) {
-          const worktree = path35.join(dir, repo.path);
-          const linked = leftoverLinks(path35.join(worktree, await this.prefixOf(repo)));
+          const worktree = path37.join(dir, repo.path);
+          const linked = leftoverLinks(path37.join(worktree, await this.prefixOf(repo)));
           if (!await keep2(repo, { worktree, linked, branch: null, name: entry, title: entry }, worktree)) kept = false;
         }
         if (!kept) continue;
-        for (const repo of run.repos) await this.removeWorktreeDir(run, repo, path35.join(dir, repo.path), []);
+        for (const repo of run.repos) await this.removeWorktreeDir(run, repo, path37.join(dir, repo.path), []);
         this.removeTaskWorkspace(run, dir);
       }
     }
@@ -25267,13 +25541,13 @@ var GitWorktreeIsolation = class {
   }
   async removeWorktreeDir(run, repo, dir, linked) {
     for (const name of /* @__PURE__ */ new Set([...linked, ...installDirs(dir)])) {
-      const target = path35.join(dir, name);
-      if (!resolvesAsNamed(this.runRoot(run), path35.dirname(target))) continue;
+      const target = path37.join(dir, name);
+      if (!resolvesAsNamed(this.runRoot(run), path37.dirname(target))) continue;
       this.unlinkIfLink(target);
       this.unlinkLinksUnder(target);
     }
     for (const name of resolvesAsNamed(this.runRoot(run), dir) ? fs15.readdirSync(dir) : []) {
-      if (LINKED_ARTIFACTS.has(name) || isEnvFile(name)) this.unlinkIfLink(path35.join(dir, name));
+      if (LINKED_ARTIFACTS.has(name) || isEnvFile(name)) this.unlinkIfLink(path37.join(dir, name));
     }
     await this.tryGit(repo.root, ["worktree", "remove", "--force", dir]);
     if (fs15.existsSync(dir) && isInside(this.runRoot(run), dir)) {
@@ -25281,7 +25555,7 @@ var GitWorktreeIsolation = class {
       fs15.rmSync(dir, { recursive: true, force: true });
     }
     await this.tryGit(repo.root, ["worktree", "prune"]);
-    for (let parent = path35.dirname(dir); isInside(this.runRoot(run), parent); parent = path35.dirname(parent)) this.removeIfEmpty(parent);
+    for (let parent = path37.dirname(dir); isInside(this.runRoot(run), parent); parent = path37.dirname(parent)) this.removeIfEmpty(parent);
   }
   unlinkIfLink(target) {
     try {
@@ -25296,14 +25570,14 @@ var GitWorktreeIsolation = class {
     }
   }
   runRoot(run) {
-    return path35.join(run.workspaceRoot, STATE_DIR, "worktrees", run.id);
+    return path37.join(run.workspaceRoot, STATE_DIR, "worktrees", run.id);
   }
   namesFor(run, task2) {
     const slug = sanitizeSlug(task2.title).slice(0, 40).replace(/-+$/, "") || "task";
     let name = `${task2.order}-${slug}`;
     const clash = Object.values(run.tasks).some((r) => r.taskId !== task2.id && r.branch === `ordewell/${run.id}/${name}`);
     if (clash) name = `${name}-${sanitizeSlug(task2.id) || "x"}`;
-    return { branch: `ordewell/${run.id}/${name}`, dir: path35.join(this.runRoot(run), name) };
+    return { branch: `ordewell/${run.id}/${name}`, dir: path37.join(this.runRoot(run), name) };
   }
   async unmergedPaths(cwd) {
     const listed3 = await this.tryGit(cwd, ["diff", "--name-only", "-z", "--diff-filter=U"]);
@@ -25317,7 +25591,7 @@ var GitWorktreeIsolation = class {
   async rebaseInProgress(cwd) {
     for (const dir of ["rebase-merge", "rebase-apply"]) {
       const found = await this.tryGit(cwd, ["rev-parse", "--git-path", dir]);
-      if (found.ok && fs15.existsSync(path35.resolve(cwd, found.stdout.trim()))) return true;
+      if (found.ok && fs15.existsSync(path37.resolve(cwd, found.stdout.trim()))) return true;
     }
     return false;
   }
@@ -25344,6 +25618,29 @@ function createWorktreeIsolation(deps) {
   return new GitWorktreeIsolation(deps);
 }
 
+// src/services/repositoryRunnerConfig.ts
+var RUNNER_CONFIG_ROOTS = [".mcp.json", ".claude", ".claude-plugin", "opencode.json", "opencode.jsonc", ".opencode", ".codex"];
+function repositoryRunnerConfigPaths(paths) {
+  return [...new Set(paths.filter(
+    (path49) => (
+      // Project MCP servers start commands or send data to a repository-chosen URL.
+      path49 === ".mcp.json" || // Settings can run hooks and helpers, load plugins, or redirect traffic.
+      path49 === ".claude/settings.json" || // Local settings have the same execution capabilities as project settings.
+      path49 === ".claude/settings.local.json" || // Hook files provide commands invoked by the runner.
+      path49.startsWith(".claude/hooks/") || // Plugin files can provide code and hooks loaded by the runner.
+      path49.startsWith(".claude/plugins/") || // Plugin metadata can load plugins and their executable components.
+      path49.startsWith(".claude-plugin/") || // Plugin and marketplace manifests can select code for the runner to load.
+      /^\.claude\/(?:[^/]+\/)*(?:plugin|marketplace)\.json$/.test(path49) || // OpenCode config declares MCP servers and plugins; its plugin and tool
+      // directories are code it loads, and an agent definition sets the prompt,
+      // model and permissions of the built-in agent its id names, which a task
+      // launches with. The rest of `.opencode/` is dependencies OpenCode
+      // installs itself, which a later launch must not be held for.
+      /^(?:\.opencode\/)?opencode\.jsonc?$/.test(path49) || /^\.opencode\/(?:plugins?|tools?|agents?)\//.test(path49) || // Codex project config carries MCP servers, hooks and `notify` commands.
+      path49.startsWith(".codex/")
+    )
+  ))].sort();
+}
+
 // src/interfaces/ILogger.ts
 var ConsoleLogger = class {
   warn(scope, message, err) {
@@ -28379,6 +28676,7 @@ var IsolationRunController = class {
   /** Resolver task id → the conflicted task it resolves; see {@link linkResolver}. */
   resolvers = {};
   opening = null;
+  opened = 0;
   /** Bumped by an interrupt, so an activation in flight across it does not open the run it ended. */
   activations = 0;
   /** The start a dirty tree turned away, handed back once the user chooses how to go on. */
@@ -28410,6 +28708,10 @@ var IsolationRunController = class {
   get isOpen() {
     return this.mode !== null;
   }
+  /** How many runs have opened: what tells one run's launches from the next one's. */
+  get epoch() {
+    return this.opened;
+  }
   /** The open run has decided whether it isolates. */
   get decided() {
     return this.mode === "isolated" || this.mode === "shared";
@@ -28507,6 +28809,7 @@ var IsolationRunController = class {
   open() {
     if (this.mode) return;
     this.mode = "undecided";
+    this.opened += 1;
   }
   /**
    * Decide once per run, as its first change task starts, whether it executes
@@ -29147,15 +29450,21 @@ var Landing = class {
    * has landed. Its branch is on the integration branch by then, so it merges
    * clean — and one the resolver did not really bring along conflicts again
    * instead of being taken at its word. Null when there is nothing to land.
+   * The task is named before its landing settles, so the caller can hold
+   * its worktree for as long as the merge is in it; one the caller says is
+   * `leaving` the plan is not landed at all.
    */
-  async landResolved(resolverId) {
+  landResolved(resolverId, leaving = () => false) {
     const conflictedId = this.runs.takeResolver(resolverId);
-    if (!conflictedId) return null;
+    if (!conflictedId || leaving(conflictedId)) return null;
     const task2 = this.tasks.get(conflictedId);
     if (!task2 || this.runs.current?.tasks[conflictedId]?.status !== "conflict") return null;
+    return { task: task2, outcome: this.landConflicted(task2) };
+  }
+  async landConflicted(task2) {
     const landing2 = await this.runs.integrate(task2);
-    if (landing2 !== "merged") return { task: task2, outcome: this.unmerged(task2, landing2) };
-    return { task: task2, outcome: { kind: "landed", messages: [{ level: "info", text: `Task "${task2.title}" landed through its conflict resolution.` }] } };
+    if (landing2 !== "merged") return this.unmerged(task2, landing2);
+    return { kind: "landed", messages: [{ level: "info", text: `Task "${task2.title}" landed through its conflict resolution.` }] };
   }
   /** The repair a conflicted task is owed next; null when repair is off, used up, or there is no isolated run to repair it in. */
   nextRepair(taskId) {
@@ -29500,7 +29809,7 @@ function heldFrom(state) {
 }
 
 // src/services/Attempts.ts
-import * as path38 from "path";
+import * as path41 from "path";
 
 // src/services/VerdictEngine.ts
 var IDLE_TIMEOUT_MS = 10 * 6e4;
@@ -29608,6 +29917,18 @@ var VerdictEngine = class {
     this.resumeIdle(taskId);
     this.toolCheckpoints.get(taskId)?.({ kind: "rejected", reason });
   }
+  /**
+   * An attempt's runner is being started, with no session to watch yet. Its
+   * silence counts from here, so one whose start never resolves — stuck
+   * launching, or waiting for its tools to attach — is flagged quiet as well.
+   * {@link watch} starts the count again once the runner is up.
+   */
+  starting(taskId) {
+    const gen = this.bumpGeneration(taskId);
+    this.idlePaused.delete(taskId);
+    this.openApprovals.delete(taskId);
+    this.touchIdle(taskId, gen);
+  }
   /**
    * Attach to a spawned session. The runner's `task_complete` call on the
    * attempt's token is the only completion evidence (ADR-0022, V2); a session
@@ -29618,6 +29939,9 @@ var VerdictEngine = class {
    */
   watch(task2, session) {
     const gen = this.bumpGeneration(task2.id);
+    this.idlePaused.delete(task2.id);
+    this.openApprovals.delete(task2.id);
+    this.touchIdle(task2.id, gen);
     session.onOutput(() => {
       if (this.generations.get(task2.id) === gen) this.touchIdle(task2.id, gen);
     });
@@ -29873,10 +30197,132 @@ function reportedVerdict(report) {
   return { outcome: "fail", reason: `The runner reported the task ${report.status}: ${why}`, checks, decidedAt, reported };
 }
 
+// src/services/taskStartConfig.ts
+import * as path38 from "path";
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync15, lstatSync as lstatSync4, readdirSync as readdirSync8, readFileSync as readFileSync13, statSync as statSync12 } from "fs";
+var MAX_FILES = 2e3;
+var MAX_DEPTH = 8;
+function liveConfig(dir) {
+  const found = /* @__PURE__ */ new Map();
+  const visit = (rel, depth) => {
+    if (found.size >= MAX_FILES || depth > MAX_DEPTH) return;
+    const full = path38.join(dir, rel);
+    try {
+      const info = statSync12(full);
+      if (info.isFile()) {
+        found.set(rel, createHash4("sha1").update(readFileSync13(full)).digest("hex"));
+      } else if (info.isDirectory() && path38.basename(rel) !== "node_modules") {
+        for (const name of readdirSync8(full)) visit(path38.posix.join(rel, name), depth + 1);
+      }
+    } catch {
+    }
+  };
+  for (const root of RUNNER_CONFIG_ROOTS) visit(root, 0);
+  const selected = new Set(repositoryRunnerConfigPaths([...found.keys()]));
+  return new Map([...found].filter(([name]) => selected.has(name)));
+}
+function linkedRoots(dir) {
+  const linked = /* @__PURE__ */ new Set();
+  for (const root of RUNNER_CONFIG_ROOTS) {
+    try {
+      if (lstatSync4(path38.join(dir, root)).isSymbolicLink()) linked.add(root);
+    } catch {
+    }
+  }
+  return linked;
+}
+function readDirs(root) {
+  const dirs = [{ dir: root, prefix: "" }];
+  for (let dir = root, prefix = ""; !existsSync15(path38.join(dir, ".git")); ) {
+    const parent = path38.dirname(dir);
+    if (parent === dir) return [dirs[0]];
+    dir = parent;
+    prefix += "../";
+    dirs.push({ dir, prefix });
+  }
+  return dirs;
+}
+var TaskStartConfig = class {
+  live = /* @__PURE__ */ new Map();
+  /**
+   * `epoch` names the run the check belongs to; a new run takes a new
+   * baseline. `root` is the workspace root, the checkout a worktree run lands
+   * in; `cwd` is where the runner starts, and `worktree` whether that is a
+   * worktree prepared for it.
+   */
+  async check(run, taskId, where) {
+    const found = where.worktree ? await this.gitDifferences(run, taskId) : [];
+    const id2 = String(where.epoch);
+    const checkout = readDirs(where.root).flatMap(({ dir, prefix }) => this.liveDifferences(`${id2}:checkout:${dir}`, dir).map((name) => `${prefix}${name}`));
+    if (!where.worktree) found.push(...checkout);
+    else {
+      const cwd = where.cwd ?? run?.tasks[taskId]?.workspace;
+      if (cwd) found.push(...this.worktreeDifferences(id2, cwd, where.root));
+    }
+    return [...new Set(found)].sort();
+  }
+  /** The baselines go with the plan they belong to. */
+  clear() {
+    this.live.clear();
+  }
+  /**
+   * What a worktree's runner reads that differs from where the run started.
+   * The `.claude` and `.opencode` directories it links from the checkout are
+   * the checkout's own, so they are compared with the checkout's first state,
+   * which an earlier task's write there does not move. Anything else is the
+   * worktree's, and is compared with its own first state: a setup command's
+   * files are trusted, and a task's later write is not.
+   */
+  worktreeDifferences(id2, dir, root) {
+    const now = liveConfig(dir);
+    const linked = linkedRoots(dir);
+    const fromCheckout = (name) => linked.has(name.split("/")[0]);
+    const key = `${id2}:worktree:${dir}`;
+    let local = this.live.get(key);
+    if (!local) {
+      local = new Map([...now].filter(([name]) => !fromCheckout(name)));
+      this.live.set(key, local);
+    }
+    const checkout = this.live.get(`${id2}:checkout:${root}`);
+    return [...now].filter(([name, hash]) => fromCheckout(name) ? checkout?.get(name) !== hash : local.get(name) !== hash).map(([name]) => name);
+  }
+  liveDifferences(key, dir) {
+    const now = liveConfig(dir);
+    const before = this.live.get(key);
+    if (!before) {
+      this.live.set(key, now);
+      return [];
+    }
+    return [...now].filter(([name, hash]) => before.get(name) !== hash).map(([name]) => name);
+  }
+  async gitDifferences(run, taskId) {
+    if (!run) return [];
+    const invoker = { exec: defaultExecFile2, resolvePath: augmentedPath };
+    const found = [];
+    for (const repo of run.repos) {
+      const cwd = run.tasks[taskId]?.repos[repo.path]?.worktree;
+      if (!cwd || !repo.baseRef || !existsSync15(cwd)) continue;
+      const prefix = repo.path === "." ? (await tryGit(invoker, repo.root, ["rev-parse", "--show-prefix"])).stdout.trim() : "";
+      const roots = [...RUNNER_CONFIG_ROOTS, ...prefix ? RUNNER_CONFIG_ROOTS.map((r) => `${prefix}${r}`) : []];
+      const diff = await tryGit(invoker, cwd, ["diff", "--no-ext-diff", "--no-textconv", "--no-renames", "--name-only", "--diff-filter=ACMRTU", "-z", repo.baseRef, "--"]);
+      const untracked = await tryGit(invoker, cwd, ["ls-files", "--others", "-z", "--", ...roots]);
+      if (!diff.ok || !untracked.ok) continue;
+      for (const name of [...diff.stdout.split("\0"), ...untracked.stdout.split("\0")]) {
+        const here = prefix && name.startsWith(prefix) ? name.slice(prefix.length) : void 0;
+        if (repositoryRunnerConfigPaths([name]).length || here !== void 0 && repositoryRunnerConfigPaths([here]).length) {
+          found.push(repo.path === "." ? name : path38.posix.join(repo.path, name));
+        }
+      }
+    }
+    return found;
+  }
+};
+
 // src/services/ScriptRunner.ts
 import { spawn as nodeSpawn2 } from "child_process";
 import * as fs16 from "fs";
-import * as path36 from "path";
+import * as path39 from "path";
 import { EventEmitter as EventEmitter2 } from "events";
 import { StringDecoder as StringDecoder2 } from "string_decoder";
 
@@ -30017,7 +30463,7 @@ var ScriptSession = class extends AbstractRunnerSession {
   async launchOf(step) {
     if ("argv" in step) {
       const [named3, ...args] = step.argv;
-      const program = this.setup.platform === "win32" && path36.win32.basename(named3) !== named3 && !path36.win32.isAbsolute(named3) ? path36.win32.resolve(this.setup.cwd, named3) : named3;
+      const program = this.setup.platform === "win32" && path39.win32.basename(named3) !== named3 && !path39.win32.isAbsolute(named3) ? path39.win32.resolve(this.setup.cwd, named3) : named3;
       const plan = await planDirectLaunch(program, args, this.setup.launch);
       return { file: plan.file, args: plan.args, shell: false, ...plan.verbatim ? { verbatim: true } : {} };
     }
@@ -30250,10 +30696,10 @@ function passed(status) {
 }
 
 // src/services/PatchCapture.ts
-import { createHash as createHash4, randomBytes as randomBytes7 } from "crypto";
+import { createHash as createHash5, randomBytes as randomBytes7 } from "crypto";
 import * as fs17 from "fs";
-import * as os11 from "os";
-import * as path37 from "path";
+import * as os10 from "os";
+import * as path40 from "path";
 
 // src/services/readTask.ts
 function readTask2(args, readerId, plan, log) {
@@ -30520,7 +30966,7 @@ function linkInPatch(patch) {
 function readOwn(scratch, name, max) {
   let fd;
   try {
-    fd = fs17.openSync(path37.join(scratch, name), fs17.constants.O_RDONLY | (fs17.constants.O_NOFOLLOW ?? 0));
+    fd = fs17.openSync(path40.join(scratch, name), fs17.constants.O_RDONLY | (fs17.constants.O_NOFOLLOW ?? 0));
   } catch (err) {
     throw new Refusal(`the capture left no ${name.split(".").pop()} Ordewell could read (${err.code ?? String(err)})`);
   }
@@ -30558,7 +31004,7 @@ async function captureHeld(runs, opts, signal) {
   const [worktree] = runs.worktrees;
   const scratch = runs.scratch;
   const tag = `ordewell-patch-${randomBytes7(8).toString("hex")}`;
-  const stem = path37.join(scratch, tag);
+  const stem = path40.join(scratch, tag);
   const own = (suffix, max = LISTING_BYTES) => readOwn(scratch, `${tag}.${suffix}`, max);
   try {
     const stage = await runs.run(stageScript(stem, opts.linked ?? []), worktree);
@@ -30596,7 +31042,7 @@ async function captureHeld(runs, opts, signal) {
     return {
       kind: "saved",
       patch,
-      stats: { base, ...countedIn(patch), bytes: patch.length, sha256: createHash4("sha256").update(patch).digest("hex"), flags: [...flags, ...flag("normalized", normalized2)] }
+      stats: { base, ...countedIn(patch), bytes: patch.length, sha256: createHash5("sha256").update(patch).digest("hex"), flags: [...flags, ...flag("normalized", normalized2)] }
     };
   } catch (err) {
     if (err instanceof Refusal) return { kind: "refused", reason: `${err.message}.` };
@@ -30650,8 +31096,8 @@ async function indexEntries(invoker, worktree) {
   return entries;
 }
 async function trialApply(invoker, worktree, patchFile, scratch) {
-  const index = path37.resolve(worktree, (await git(invoker, worktree, [...APPLY_GIT, "rev-parse", "--git-path", "index"])).trim());
-  const copy = path37.join(scratch, "index");
+  const index = path40.resolve(worktree, (await git(invoker, worktree, [...APPLY_GIT, "rev-parse", "--git-path", "index"])).trim());
+  const copy = path40.join(scratch, "index");
   fs17.copyFileSync(index, copy);
   const trial = { ...invoker, exec: (file, args, opts) => invoker.exec(file, args, { ...opts, env: { ...opts.env, GIT_INDEX_FILE: copy } }) };
   const tried = await tryGit(trial, worktree, [...APPLY_GIT, "apply", "--cached", "--3way", "--whitespace=nowarn", patchFile]);
@@ -30671,7 +31117,7 @@ function gitRefused(lead, stderr) {
 function onDisk3(worktree, names) {
   return names.map((name) => {
     try {
-      const stat = fs17.lstatSync(path37.join(worktree, name), { bigint: true, throwIfNoEntry: false });
+      const stat = fs17.lstatSync(path40.join(worktree, name), { bigint: true, throwIfNoEntry: false });
       return stat ? `${stat.mode} ${stat.ino} ${stat.size} ${stat.mtimeNs} ${stat.ctimeNs}` : "none";
     } catch (err) {
       return err.code ?? "unreadable";
@@ -30711,7 +31157,7 @@ function leavesWorktree(worktree, names, linked, held2, left) {
       if (i < parts.length && held2.get(at)?.some((entry) => entry.mode === SUBMODULE)) {
         return `the patch writes ${name}, under ${at}, a submodule, whose files are another repository's.`;
       }
-      const full = path37.join(worktree, ...parts.slice(0, i));
+      const full = path40.join(worktree, ...parts.slice(0, i));
       const stat = fs17.lstatSync(full, { throwIfNoEntry: false });
       if (!stat) break;
       const last = i === parts.length;
@@ -30732,14 +31178,14 @@ async function applyPatch(invoker, worktree, patch, saved, opts = {}) {
   if (patch.length !== saved.bytes) {
     return refused3(`the patch is ${byteSize(patch.length)} where its artifact says ${byteSize(saved.bytes)}, so it was cut short or changed after it was saved.`);
   }
-  if (createHash4("sha256").update(patch).digest("hex") !== saved.sha256) {
+  if (createHash5("sha256").update(patch).digest("hex") !== saved.sha256) {
     return refused3("the patch is not the file that was saved: its hash is not the one its artifact records, so it was changed after it was saved.");
   }
   const link = linkInPatch(patch);
   if (link !== void 0) {
     return refused3(`the patch holds a link or a submodule (${JSON.stringify(link.slice(0, 80))}), which a saved patch never does, so it is not one that was saved.`);
   }
-  const dir = fs17.mkdtempSync(path37.join(os11.tmpdir(), "ordewell-apply-"));
+  const dir = fs17.mkdtempSync(path40.join(os10.tmpdir(), "ordewell-apply-"));
   try {
     const toplevel = (await git(invoker, worktree, [...APPLY_GIT, "rev-parse", "--show-toplevel"])).trim();
     if (fs17.realpathSync(toplevel) !== fs17.realpathSync(worktree)) return refused3(`${worktree} is not the root of a worktree of its own.`);
@@ -30749,7 +31195,7 @@ async function applyPatch(invoker, worktree, patch, saved, opts = {}) {
     }
     const before = await unmergedPaths(invoker, worktree);
     if (before.length > 0) return refused3(`your worktree still has unresolved conflicts (${listed(before.slice(0, 10))}${before.length > 10 ? `, +${before.length - 10} more` : ""}). Resolve them and git add them, or undo them, then apply the patch.`);
-    const file = path37.join(dir, "saved.patch");
+    const file = path40.join(dir, "saved.patch");
     fs17.writeFileSync(file, patch, { flag: "wx", mode: 384 });
     const held2 = await indexEntries(invoker, worktree);
     const named3 = await pathsNamed(invoker, worktree, file);
@@ -30899,6 +31345,11 @@ var TaskWebReader = class {
 };
 
 // src/services/Attempts.ts
+var TaskStartConfigError = class extends Error {
+  constructor(paths) {
+    super(`repository configuration ${paths.map((p) => JSON.stringify(p)).join(", ")} differs from where this run started; remove it to continue, or start a new run once your branch holds it`);
+  }
+};
 var DEFAULT_GIT = { exec: defaultExecFile2, resolvePath: () => augmentedPath() };
 var Attempts = class {
   constructor(deps) {
@@ -30930,6 +31381,7 @@ var Attempts = class {
   live = /* @__PURE__ */ new Map();
   /** Bumped by every plan load: an ended attempt's wind-down belongs to the scope before it. */
   planScope = 0;
+  startConfig = new TaskStartConfig();
   /** Each task's runners still winding down once stopped: a continue waits for them (ADR-0018, L1). */
   windDowns = /* @__PURE__ */ new Map();
   /**
@@ -30985,6 +31437,10 @@ var Attempts = class {
   receipt(taskId) {
     return this.live.get(taskId)?.receipt ?? null;
   }
+  /** Which spawn of the live attempt's runner waits for Ordewell's tools to connect; null when none does. */
+  attaching(taskId) {
+    return this.live.get(taskId)?.attaching ?? null;
+  }
   /** The kind a task's next attempt starts as, short of a repair or a continue: what is weighed before one exists. */
   nextKind(taskId) {
     const task2 = this.deps.store.get(taskId);
@@ -31025,7 +31481,9 @@ var Attempts = class {
       shell: null,
       web: null,
       patch: null,
-      receipt: null
+      receipt: null,
+      attaching: null,
+      spawning: new AbortController()
     };
     this.spawnCounts.set(task2.id, attempt.attempt);
     this.live.set(task2.id, attempt);
@@ -31040,7 +31498,8 @@ var Attempts = class {
   /**
    * The one way an attempt ends. Dropping the record is itself what
    * invalidates a spawn still in flight ({@link run} kills the session it
-   * receives for an attempt that is no longer current).
+   * receives for an attempt that is no longer current), and its cancel takes
+   * back a runner still starting meanwhile.
    *
    * A user interruption also bumps the verifier's generation *before* stopping
    * the runner: a runner may fire onExit synchronously from
@@ -31056,6 +31515,7 @@ var Attempts = class {
     const session = attempt?.session ?? null;
     const nativeSessionId = session?.nativeSessionId() ?? null;
     if (attempt) {
+      attempt.spawning.abort();
       store.endAttemptUsage(taskId, attempt.attempt, (/* @__PURE__ */ new Date()).toISOString(), session?.sessionCost?.() ?? void 0, nativeSessionId ?? void 0);
       this.deps.output.detach(taskId);
       attempt.shell?.end();
@@ -31091,6 +31551,7 @@ var Attempts = class {
     const ended = this.endAll("load");
     this.planScope += 1;
     this.spawnCounts.clear();
+    this.startConfig.clear();
     return ended;
   }
   /** A task leaving the plan: no later attempt of it is numbered from its runs. */
@@ -31223,21 +31684,31 @@ var Attempts = class {
         if (unavailable2) throw new Error(unavailable2);
       }
       if (kind.kind === "continuation") await this.windDowns.get(task2.id);
+      if (!attempt.script && kind.kind === "repair") {
+        const paths = await this.startConfig.check(runs.current, task2.id, { epoch: runs.epoch, root: this.deps.workspaceRoot(), cwd: null, worktree: true });
+        if (paths.length) throw new TaskStartConfigError(paths);
+      }
       const { cwd, worktree, previousWork, workspace } = await attemptCwd(kind, task2, runs);
       attempt.cwd = cwd;
       attempt.worktree = worktree;
+      if (!attempt.script && kind.kind !== "repair" && !landsNothing(kind)) {
+        const paths = await this.startConfig.check(runs.current, task2.id, { epoch: runs.epoch, root: this.deps.workspaceRoot(), cwd, worktree });
+        if (paths.length) throw new TaskStartConfigError(paths);
+      }
       if (checksTree(kind)) attempt.snapshot = await runs.snapshotWorkspace();
       if (this.live.get(task2.id) !== attempt) {
         if (attempt.worktree && !this.live.has(task2.id) && !this.host.completing(task2.id)) await runs.release(task2.id, { keep: kind.kind === "repair" });
         this.abandonSpawn(task2, attempt);
         return false;
       }
+      this.verifier.starting(task2.id);
       const session = attempt.script ? await this.spawnScript(task2, attempt, cwd) : await this.spawnRunner(task2, attempt, cwd, worktree ? workspace : void 0, previousWork);
       if (this.live.get(task2.id) !== attempt) {
         this.abandonSpawn(task2, attempt, session);
         return false;
       }
       attempt.phase = "running";
+      attempt.attaching = null;
       attempt.session = session;
       store.setTaskRunnerSessionId(task2.id, void 0);
       store.clearCarriedFrom(task2.id);
@@ -31306,6 +31777,9 @@ var Attempts = class {
       return { kind: "usage-limited", taskId: task2.id, attempt, said: { message }, output: "" };
     }
     const failed = (failure2) => ({ kind: "spawn-failed", task: task2, attempt, failure: failure2 });
+    if (err instanceof TaskStartConfigError) {
+      return failed({ leaves: "held", hold: err.message, preserveWorktree: true, settles: false, notice: { level: "warn", text: `Task "${task2.title}" is on hold: ${err.message}` } });
+    }
     if (attempt.kind.kind === "continuation" && !attachTimeout) {
       const refused3 = err instanceof RunnerStartupExit;
       const reason = unresumedMessage(task2, refused3 ? `${attempt.runner} could not find its saved session` : `could not start: ${message}`);
@@ -31383,7 +31857,13 @@ var Attempts = class {
       ...web ? { webReads: web } : {},
       applyPatch: (args) => this.applyPatch(task2, attempt, args),
       workspaceRoot: this.deps.workspaceRoot(),
-      onNotice: (message) => this.host.tell("warn", `Task "${task2.title}": ${message}`)
+      onNotice: (message) => this.host.tell("warn", `Task "${task2.title}": ${message}`),
+      cancelled: attempt.spawning.signal,
+      onAttaching: (spawn) => {
+        if (this.live.get(task2.id) !== attempt) return;
+        attempt.attaching = spawn;
+        this.host.emit("onTaskChanged");
+      }
     });
   }
   /**
@@ -31436,9 +31916,9 @@ var Attempts = class {
     const repos = Object.values(this.deps.runs.openRecord(taskId)?.repos ?? {});
     if (repos.length !== 1 || cwd === null) return [];
     const [{ worktree, linked }] = repos;
-    const prefix = path38.relative(worktree, cwd).split(path38.sep).join("/");
-    if (prefix.startsWith("..") || path38.isAbsolute(prefix)) return [];
-    return linked.map((name) => (prefix ? `${prefix}/${name}` : name).split(path38.sep).join("/"));
+    const prefix = path41.relative(worktree, cwd).split(path41.sep).join("/");
+    if (prefix.startsWith("..") || path41.isAbsolute(prefix)) return [];
+    return linked.map((name) => (prefix ? `${prefix}/${name}` : name).split(path41.sep).join("/"));
   }
   /**
    * A script task's start (ADR-0035): its body as the plan holds it now, run
@@ -31476,7 +31956,7 @@ var Attempts = class {
       this.deps.notifications.warn(message);
     };
     if (resolved.blockedEnvrc) {
-      warn(`blocked:${resolved.blockedEnvrc}`, `direnv has blocked ${resolved.blockedEnvrc}, so tasks start without its variables. Run \`direnv allow\` in ${path38.dirname(resolved.blockedEnvrc)} to use them.`);
+      warn(`blocked:${resolved.blockedEnvrc}`, `direnv has blocked ${resolved.blockedEnvrc}, so tasks start without its variables. Run \`direnv allow\` in ${path41.dirname(resolved.blockedEnvrc)} to use them.`);
     }
     if (resolved.trackedEnvFile) {
       warn(`tracked:${resolved.trackedEnvFile}`, `Ignored ${resolved.trackedEnvFile}: git tracks it, and a committed file must not choose the environment agents run in. Untrack it to use it.`);
@@ -31502,7 +31982,7 @@ var Attempts = class {
   uncommittedSkillFolder(name) {
     const root = this.deps.workspaceRoot();
     const skill = this.deps.skillsAt(this.skillRoots(root)).findSkill(name);
-    return skill?.source === "workspace" ? path38.relative(root, path38.dirname(skill.path)).split(path38.sep).join("/") : void 0;
+    return skill?.source === "workspace" ? path41.relative(root, path41.dirname(skill.path)).split(path41.sep).join("/") : void 0;
   }
   /**
    * The roots whose `.ordewell/skills/` an attempt at `cwd` reads: in a repo
@@ -31871,12 +32351,12 @@ function ancestors(task2, store) {
 
 // src/services/sessionLease.ts
 import * as fs19 from "fs";
-import * as path40 from "path";
+import * as path43 from "path";
 import { randomUUID as randomUUID6 } from "crypto";
 
 // src/utils/sessionStore.ts
 import * as fs18 from "fs";
-import * as path39 from "path";
+import * as path42 from "path";
 
 // src/utils/sessionId.ts
 import { randomBytes as randomBytes8 } from "crypto";
@@ -31887,13 +32367,13 @@ function mintSessionId() {
 // src/utils/sessionStore.ts
 var SESSIONS_SUBDIR = "sessions";
 function getSessionsDir(baseDir) {
-  return path39.join(getStateDir(baseDir), SESSIONS_SUBDIR);
+  return path42.join(getStateDir(baseDir), SESSIONS_SUBDIR);
 }
 function idSegment(id2) {
   return /^[A-Za-z0-9_-][A-Za-z0-9._-]{0,127}$/.test(id2) ? id2 : `~${Buffer.from(id2, "utf-8").toString("hex")}`;
 }
 function sessionDataDir(sessionId, baseDir) {
-  return path39.join(getSessionsDir(baseDir), idSegment(sessionId));
+  return path42.join(getSessionsDir(baseDir), idSegment(sessionId));
 }
 var REJECTION_MESSAGE = "This session was created with an older version of Ordewell. Please re-plan.";
 function isSessionMeta(value) {
@@ -31920,8 +32400,8 @@ function legacySessionFilename(session) {
   return `${filenameStem(session)}_${session.id.slice(0, 8)}.json`;
 }
 function dropLegacyFile(sessionsDir, meta) {
-  const legacy = path39.join(sessionsDir, legacySessionFilename(meta));
-  if (legacy === path39.join(sessionsDir, sessionFilename(meta)) || !fs18.existsSync(legacy)) return;
+  const legacy = path42.join(sessionsDir, legacySessionFilename(meta));
+  if (legacy === path42.join(sessionsDir, sessionFilename(meta)) || !fs18.existsSync(legacy)) return;
   try {
     const held2 = JSON.parse(fs18.readFileSync(legacy, "utf-8")).meta?.id;
     if (held2 === meta.id) fs18.unlinkSync(legacy);
@@ -31948,7 +32428,7 @@ function saveSession(plan, goal, baseDir, id2) {
   };
   dropRetiredPlanFields(session.plan);
   const filename = sessionFilename(meta);
-  const filePath = path39.join(sessionsDir, filename);
+  const filePath = path42.join(sessionsDir, filename);
   writeFileAtomic(filePath, JSON.stringify(session, null, 2));
   dropLegacyFile(sessionsDir, meta);
   return meta;
@@ -31960,7 +32440,7 @@ function listSessions(baseDir, logger = defaultLogger) {
   return files.map((f) => {
     let parsed;
     try {
-      parsed = JSON.parse(fs18.readFileSync(path39.join(sessionsDir, f), "utf-8"));
+      parsed = JSON.parse(fs18.readFileSync(path42.join(sessionsDir, f), "utf-8"));
     } catch (err) {
       if (err instanceof SyntaxError) return moveAside(sessionsDir, f, "is not valid JSON", logger);
       logger.warn("sessionStore", `failed to read session file ${f}; skipping`, err);
@@ -31981,7 +32461,7 @@ function listSessions(baseDir, logger = defaultLogger) {
 function moveAside(sessionsDir, file, reason, logger) {
   const aside = `${file}.${Date.now()}.corrupt`;
   try {
-    fs18.renameSync(path39.join(sessionsDir, file), path39.join(sessionsDir, aside));
+    fs18.renameSync(path42.join(sessionsDir, file), path42.join(sessionsDir, aside));
     logger.warn("sessionStore", `session file ${file} ${reason}; moved aside to ${aside} rather than overwritten`);
   } catch {
     logger.warn("sessionStore", `failed to read session file ${file}; skipping`);
@@ -31992,7 +32472,7 @@ function findSessionFile(sessionsDir, sessionId, logger) {
   const files = fs18.readdirSync(sessionsDir).filter((f) => f.endsWith(".json"));
   for (const f of files) {
     try {
-      const raw = fs18.readFileSync(path39.join(sessionsDir, f), "utf-8");
+      const raw = fs18.readFileSync(path42.join(sessionsDir, f), "utf-8");
       const session = JSON.parse(raw);
       if (session.meta.id === sessionId) return f;
     } catch (err) {
@@ -32007,7 +32487,7 @@ function loadSession(sessionId, baseDir, logger = defaultLogger) {
   try {
     const file = findSessionFile(sessionsDir, sessionId, logger);
     if (file) {
-      const raw = fs18.readFileSync(path39.join(sessionsDir, file), "utf-8");
+      const raw = fs18.readFileSync(path42.join(sessionsDir, file), "utf-8");
       const parsed = JSON.parse(raw);
       if (hasScalarRunner(parsed)) {
         logger.warn("sessionStore", `session file ${file}: ${REJECTION_MESSAGE}`);
@@ -32049,7 +32529,7 @@ function deleteSession(sessionId, baseDir, logger = defaultLogger) {
   try {
     const file = findSessionFile(sessionsDir, sessionId, logger);
     if (file) {
-      fs18.unlinkSync(path39.join(sessionsDir, file));
+      fs18.unlinkSync(path42.join(sessionsDir, file));
       return true;
     }
   } catch (err) {
@@ -32102,7 +32582,7 @@ var UNLEASED = {
 };
 var hostsHere = /* @__PURE__ */ new Set();
 function leaseFile(sessionId, workspace) {
-  return path40.join(sessionDataDir(sessionId, workspace), LEASE_FILE);
+  return path43.join(sessionDataDir(sessionId, workspace), LEASE_FILE);
 }
 function isRecord6(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -32191,7 +32671,7 @@ var LeaseHost = class {
    */
   acquire(file, workspace, holder) {
     ensureStateDirIgnored(workspace);
-    ensurePrivateDir(path40.dirname(file));
+    ensurePrivateDir(path43.dirname(file));
     const outcome = withFileLock(file, () => {
       const current = readRecord(file);
       const taken = current !== null && current.hostId !== this.id ? current : null;
@@ -32246,7 +32726,7 @@ var LeaseHost = class {
       withFileLock(file, () => {
         if (readRecord(file)?.hostId === this.id) fs19.rmSync(file, { force: true });
       }, "release a session lease");
-      fs19.rmdirSync(path40.dirname(file));
+      fs19.rmdirSync(path43.dirname(file));
     } catch {
     }
   }
@@ -32439,10 +32919,14 @@ var TaskOrchestrator = class _TaskOrchestrator {
   /** Conflict repairs owed with every slot taken and no scheduler to claim them: a freed slot starts them. */
   owedRepairs = /* @__PURE__ */ new Set();
   /**
-   * Tasks Mark complete is landing after it ended their attempt: in progress
-   * with no attempt for as long as that takes, and not orphans for it.
+   * Tasks Mark complete is landing after it ended their attempt, or that
+   * their conflict resolver is landing, and that landing: in progress with
+   * no attempt for as long as it takes, and not orphans for it. Both can be
+   * landing one task at once, so each holds it for itself (see {@link holdWhileLanding}).
    */
-  completing = /* @__PURE__ */ new Set();
+  completing = /* @__PURE__ */ new Map();
+  /** Tasks {@link releaseTask} is tearing down once their landings have settled: none may begin another. */
+  releasing = /* @__PURE__ */ new Set();
   /** Tasks paused on a usage limit, the run's hold on them, and each runner's wait for its reset (ADR-0018, U1). */
   limitPauses;
   /**
@@ -32578,6 +33062,10 @@ var TaskOrchestrator = class _TaskOrchestrator {
   getCompletionReceipt(taskId) {
     return this.attempts.receipt(taskId);
   }
+  /** Which spawn of a live attempt's runner waits for Ordewell's tools to connect (ADR-0025); null when none does. */
+  getToolsAttaching(taskId) {
+    return this.attempts.attaching(taskId);
+  }
   /** Recent clean output of a task's latest attempt, running or ended; null if it never ran. */
   getLiveOutput(taskId, opts) {
     return this.attempts.liveTail(taskId, opts);
@@ -32742,12 +33230,13 @@ var TaskOrchestrator = class _TaskOrchestrator {
   /**
    * Something can still start that nobody has to ask for again: a start
    * admitted and not yet claimed, a force start queued behind its
-   * dependencies, a task that resumes on its own at its usage limit's
-   * reset, or a start a dirty checkout parked for Stash and continue to
-   * replay. A Stop is owed to it, whether or not anything runs.
+   * dependencies, a conflict repair owed a slot or the end of a start hold,
+   * a task that resumes on its own at its usage limit's reset, or a start a
+   * dirty checkout parked for Stash and continue to replay. A Stop is owed to
+   * it, whether or not anything runs.
    */
   get startsPending() {
-    return this.admissions > 0 || this.queuedStarts.size > 0 || this.runs.blocked || this.store.allTasks.some(waitsForReset);
+    return this.admissions > 0 || this.queuedStarts.size > 0 || this.owedRepairs.size > 0 || this.runs.blocked || this.store.allTasks.some(waitsForReset);
   }
   /**
    * The plan's activity as one word for every surface: a start on its way,
@@ -33183,7 +33672,9 @@ var TaskOrchestrator = class _TaskOrchestrator {
         this.store.markPending(task2.id);
         this.hold(task2.id, failure2.hold, false);
       }
-      await this.runs.release(task2.id, { keep: failure2.leaves === "failed" && failure2.keepWorktree });
+      if (failure2.leaves !== "held" || !failure2.preserveWorktree) {
+        await this.runs.release(task2.id, { keep: failure2.leaves === "failed" && failure2.keepWorktree });
+      }
       const { level, text: text4, toastOnly } = failure2.notice;
       if (toastOnly) this.notifications[level](text4);
       else this.tell(level, text4);
@@ -33248,6 +33739,7 @@ var TaskOrchestrator = class _TaskOrchestrator {
    * Work that did not land waits on the user — it never fails the task or
    * blocks its dependents — unless its conflict is owed a repair, which takes
    * the slot the ending attempt freed and never one more than the run allows.
+   * A planner turn's start hold holds it as it holds any new spawn (ADR-0029).
    * The repair follows on from the start whose work it repairs: a Stop since
    * that was admitted withdraws it.
    */
@@ -33255,20 +33747,22 @@ var TaskOrchestrator = class _TaskOrchestrator {
     this.store.markAwaitingUser(task2.id, "conflict");
     this.say(outcome.messages);
     if (outcome.kind !== "repair-needed") return;
-    if (this.attempts.size < this.config.maxParallelSessions) {
+    const waitsFor = this.startHolds > 0 ? "the planner's turn ends" : this.slotsFull() ? "a slot is free" : null;
+    if (!waitsFor) {
       const claimed = this.claim(task2.id, admission);
       if ("refused" in claimed) this.tell("warn", `The conflict of task "${task2.title}" is not repaired: ${claimed.refused}`);
       else this.unawaited(claimed.spawned, `Could not start the repair of task "${task2.title}"`);
     } else {
       this.store.markPending(task2.id);
       if (!this.isScheduling) this.owedRepairs.add(task2.id);
-      this.tell("info", `Task "${task2.title}" is repaired once a slot is free.`);
+      this.tell("info", `Task "${task2.title}" is repaired once ${waitsFor}.`);
     }
   }
-  /** Start the repairs {@link settleUnlanded} left owed, as slots allow. */
+  /** Start the repairs {@link settleUnlanded} left owed, as slots and any start hold allow. */
   startOwedRepairs(admission) {
+    if (this.startHolds > 0) return;
     for (const id2 of [...this.owedRepairs]) {
-      if (this.attempts.size >= this.config.maxParallelSessions) return;
+      if (this.slotsFull()) return;
       this.owedRepairs.delete(id2);
       const task2 = this.store.get(id2);
       if (!task2 || task2.status !== "pending" || this.attempts.has(id2) || !this.landing.nextRepair(id2)) continue;
@@ -33278,13 +33772,31 @@ var TaskOrchestrator = class _TaskOrchestrator {
     }
   }
   async landResolved(resolverId, admission) {
-    const resolved = await this.landing.landResolved(resolverId);
+    const resolved = this.landing.landResolved(resolverId, (id2) => this.releasing.has(id2));
     if (!resolved) return;
-    const { task: task2, outcome } = resolved;
+    const { task: task2 } = resolved;
+    const outcome = await this.holdWhileLanding(task2.id, resolved.outcome);
+    if (this.store.get(task2.id)?.status === "completed") return;
     await this.applyLanding(task2, outcome, admission, () => {
       if (task2.verdict) this.logAndArchive(task2, task2.verdict);
     });
   }
+  /**
+   * Hold a task for as long as `landing` is merging its worktree. Its end lets
+   * go of its own hold only: another landing of the task begun meanwhile
+   * still holds it.
+   */
+  async holdWhileLanding(taskId, landing2) {
+    const holds2 = this.completing.get(taskId) ?? /* @__PURE__ */ new Set();
+    holds2.add(landing2);
+    this.completing.set(taskId, holds2);
+    try {
+      return await landing2;
+    } finally {
+      holds2.delete(landing2);
+      if (holds2.size === 0 && this.completing.get(taskId) === holds2) this.completing.delete(taskId);
+    }
+  }
   getReadyTasks() {
     return this.readiness().ready;
   }
@@ -33392,17 +33904,27 @@ var TaskOrchestrator = class _TaskOrchestrator {
    * as {@link cancelTask} does, but its worktree goes: no task is left to land
    * it into. A spawn still in flight just loses its attempt,
    * which is what makes {@link Attempts} kill the session it is about to
-   * receive. The id's cross-attempt bookkeeping goes too — a hold or retry
-   * count kept for a task that no longer exists would be inherited by nothing.
+   * receive. Every landing of it in flight — Mark complete's, its resolver's —
+   * settles first, so its worktree is not torn down under a merge, and none
+   * begins while it goes; a repair a landing claims is cancelled as any
+   * running attempt is. The id's cross-attempt bookkeeping
+   * goes too — a hold or retry count kept for a task that no longer exists
+   * would be inherited by nothing.
    */
   async releaseTask(taskId) {
     this.limitPauses.cancel(taskId);
-    const phase = this.attempts.phaseOf(taskId);
-    if (phase === "running" || phase === "integrating") await this.cancelAttempt(taskId, { keep: false });
-    else {
-      this.attempts.end(taskId, "release");
-      if (this.store.get(taskId)?.status === "in_progress") this.store.markPending(taskId);
-      await this.runs.release(taskId, { keep: false });
+    for (let holds2 = this.completing.get(taskId); holds2; holds2 = this.completing.get(taskId)) await Promise.allSettled(holds2);
+    this.releasing.add(taskId);
+    try {
+      const phase = this.attempts.phaseOf(taskId);
+      if (phase === "running" || phase === "integrating") await this.cancelAttempt(taskId, { keep: false });
+      else {
+        this.attempts.end(taskId, "release");
+        if (this.store.get(taskId)?.status === "in_progress") this.store.markPending(taskId);
+        await this.runs.release(taskId, { keep: false });
+      }
+    } finally {
+      this.releasing.delete(taskId);
     }
     this.onHold.delete(taskId);
     this.retryCounts.delete(taskId);
@@ -33411,17 +33933,12 @@ var TaskOrchestrator = class _TaskOrchestrator {
   async markTaskComplete(taskId) {
     const task2 = this.store.get(taskId);
     if (!task2 || task2.status === "completed") return;
-    if (this.completing.has(taskId)) return;
+    if (this.completing.has(taskId) || this.releasing.has(taskId)) return;
     const admission = this.admittedNow();
     const ended = this.attempts.end(taskId, "complete");
     const verdict = this.attempts.markComplete(task2);
-    this.completing.add(taskId);
-    let landing2;
-    try {
-      landing2 = await (ended?.integration ?? this.landing.landVouched(task2));
-    } finally {
-      this.completing.delete(taskId);
-    }
+    const landed2 = ended?.integration ?? this.landing.landVouched(task2);
+    const landing2 = await this.holdWhileLanding(taskId, landed2);
     this.store.setTaskVerdict(taskId, verdict);
     const handoff = task2.type === "user" ? userTaskHandoff(task2.userSteps) : void 0;
     this.attempts.handOver(taskId, summarizeOutput(verdict.reason, ""), handoff);
@@ -33710,7 +34227,7 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
       if (!await this.openForAdmitted(taskId, origin, resume, admission)) return;
       if (this.attempts.has(taskId)) return;
       this.refuseOpsDuringMerge(taskId, forced);
-      if (forced.queued && this.holdsQueued(taskId, forced)) {
+      if (forced.queued && (this.holdsQueued(taskId, forced) || this.slotsFull())) {
         this.queuedStarts.set(taskId, { pastGate: forced.pastGate });
         return;
       }
@@ -33769,8 +34286,9 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
         this.queuedStarts.delete(id2);
         continue;
       }
+      if (this.slotsFull()) continue;
       const waits = this.startWaits(task2, task2.research ? void 0 : { queued: true, pastGate: queued.pastGate });
-      if (task2.research && (waits.length > 0 || this.attempts.size >= this.config.maxParallelSessions)) continue;
+      if (task2.research && waits.length > 0) continue;
       if (waits.some((w) => QUEUED_WAITS.has(w.kind))) continue;
       if (this.leftToScheduler(task2) && queued.pastGate.length === 0) {
         this.queuedStarts.delete(id2);
@@ -33799,6 +34317,9 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
     const task2 = this.store.get(taskId);
     return !!task2 && this.startWaits(task2, forced).some((w) => QUEUED_WAITS.has(w.kind) || w.kind === "dependencies" || w.kind === "merge-gate");
   }
+  slotsFull() {
+    return this.attempts.size >= this.config.maxParallelSessions;
+  }
   sayQueuedAtGate(task2, queued, unmerged) {
     const titles = unmerged.map((id2) => `"${this.store.get(id2)?.title ?? id2}"`).join(", ");
     const notice = `Task "${task2.title}" waits for Merge all: the work of ${titles} is not merged into your branch yet. Merge all to start it, or force start it again to start it without that work.`;
@@ -33899,7 +34420,7 @@ ${now.message}` : LIMIT_RESET_MESSAGE;
    */
   async settleRun(after) {
     if (!this.store.isFinished()) this.transition({ type: "reopen" });
-    if (this.attempts.size > 0) return;
+    if (this.attempts.size > 0 || this.owedRepairs.size > 0) return;
     if (this.runState.kind === "held") return;
     if (this.runState.kind !== "scheduling") {
       if (after === "tick") {
@@ -34193,21 +34714,45 @@ var Planner = class {
 };
 
 // src/services/ModelResolver.ts
-var ModelResolver = class {
+var ModelResolver = class _ModelResolver {
   constructor(registry, config, deps = {}) {
     this.registry = registry;
     this.config = config;
-    this.discovery = new ModelDiscovery(registry, deps.execImpl, deps.fetchImpl);
+    this.discovery = new ModelDiscovery(registry, deps.execImpl, deps.fetchImpl, void 0, void 0, void 0, deps.env);
     this.fetchImpl = deps.fetchImpl;
+    this.execImpl = deps.execImpl;
+    this.shared = { vendor: { options: null, load: null, errors: {}, generation: 0 }, root: this, views: /* @__PURE__ */ new Map() };
   }
   registry;
   config;
   discovery;
   fetchImpl;
-  cachedPickerOptions = null;
-  /** A catalog load under way: a second ask, or a warm-up, shares it rather than fetching again. */
-  pickerLoad = null;
-  lastDiscoveryErrors = {};
+  execImpl;
+  shared;
+  get vendor() {
+    return this.shared.vendor;
+  }
+  /**
+   * This resolver for runners launched with another environment, a
+   * workspace's own: their catalogs are discovered and cached under `env`, as
+   * `CLAUDE_CONFIG_DIR` there can name another account, while the vendor
+   * catalogs stay this resolver's, fetched once. One view per `key`, made on
+   * its first ask: a later ask with the same key gets that view, whatever
+   * `env` it passes.
+   */
+  withRunnerEnv(key, env) {
+    let view = this.shared.views.get(key);
+    if (!view) {
+      view = new _ModelResolver(this.registry, this.config, { fetchImpl: this.fetchImpl, execImpl: this.execImpl, env });
+      view.shared = this.shared;
+      this.shared.views.set(key, view);
+    }
+    return view;
+  }
+  /** Every runner-environment catalog this resolver's family holds: its root's and each view's. */
+  runnerCatalogs() {
+    return [this.shared.root, ...this.shared.views.values()].map((resolver) => resolver.discovery);
+  }
   static builtinOptions() {
     return toOrchestratorOptions({}, ORCHESTRATOR_SHORTCUTS);
   }
@@ -34223,16 +34768,16 @@ var ModelResolver = class {
     return Object.fromEntries(discovered);
   }
   async pickerOptions() {
-    if (this.cachedPickerOptions) return this.cachedPickerOptions;
-    if (!this.pickerLoad) {
+    if (this.vendor.options) return this.vendor.options;
+    if (!this.vendor.load) {
       const load = this.loadPickerOptions();
-      this.pickerLoad = load;
+      this.vendor.load = load;
       void load.finally(() => {
-        if (this.pickerLoad === load) this.pickerLoad = null;
+        if (this.vendor.load === load) this.vendor.load = null;
       }).catch(() => {
       });
     }
-    return this.pickerLoad;
+    return this.vendor.load;
   }
   /**
    * Start loading the vendor catalogs without waiting for them, unless they
@@ -34240,20 +34785,25 @@ var ModelResolver = class {
    * known yet reads it from them on a later call, never waiting on the fetch.
    */
   warmPickerOptions() {
-    if (this.cachedPickerOptions || this.pickerLoad) return;
+    if (this.vendor.options || this.vendor.load) return;
     this.pickerOptions().catch(() => {
     });
   }
   async loadPickerOptions() {
+    const vendor = this.vendor;
+    const generation2 = vendor.generation;
     const { apiKeys, baseUrls } = collectProviderCredentials(this.config);
     const { models, errors } = await fetchAllProviderModels({
       apiKeys,
       baseUrls,
       fetchImpl: this.fetchImpl
     });
-    this.lastDiscoveryErrors = errors;
-    this.cachedPickerOptions = toOrchestratorOptions(models, ORCHESTRATOR_SHORTCUTS);
-    return this.cachedPickerOptions;
+    const options = toOrchestratorOptions(models, ORCHESTRATOR_SHORTCUTS);
+    if (vendor.generation === generation2) {
+      vendor.errors = errors;
+      vendor.options = options;
+    }
+    return options;
   }
   /**
    * Per-provider failures from the most recent `pickerOptions()` fetch, keyed
@@ -34262,7 +34812,7 @@ var ModelResolver = class {
    * key/endpoint is set but whose catalog could not be reached.
    */
   getDiscoveryErrors() {
-    return this.lastDiscoveryErrors;
+    return this.vendor.errors;
   }
   async refresh() {
     const options = await this.pickerOptions();
@@ -34273,8 +34823,25 @@ var ModelResolver = class {
     this.config.setProviderModelLists(lists);
     return lists;
   }
+  /** Forget every runner catalog, each workspace's included; the vendor catalogs stay. */
   refreshRunnerModels() {
-    this.discovery.clear();
+    for (const discovery of this.runnerCatalogs()) discovery.clear();
+  }
+  /**
+   * The models a pick for `provider` is judged against: a harness planner's
+   * own runner catalog, or the vendor picker catalog (ADR-0009). Discovered
+   * if not held. Never throws: a catalog that cannot be had is empty.
+   */
+  async plannerCatalog(provider) {
+    const runner = runnerForProvider(provider);
+    if (runner) return candidatesOf((await this.modelsForRunners([runner]))[runner] ?? []);
+    return (await this.pickerOptions().catch(() => [])).map((o) => ({ id: o.id }));
+  }
+  /** {@link plannerCatalog} from what is already held, so a cold catalog is empty; never discovers. */
+  cachedPlannerCatalog(provider) {
+    const runner = runnerForProvider(provider);
+    if (runner) return candidatesOf(this.getCachedRunnerModels(runner));
+    return this.getCachedPickerOptions().map((o) => ({ id: o.id }));
   }
   /**
    * Synchronous reads of whatever the last `modelsForRunners`/`pickerOptions`
@@ -34285,7 +34852,7 @@ var ModelResolver = class {
     return this.discovery.getCached(runner) ?? [];
   }
   getCachedPickerOptions() {
-    return this.cachedPickerOptions ?? [];
+    return this.vendor.options ?? [];
   }
   /**
    * A model's context window from whatever catalog is already cached (#49),
@@ -34298,7 +34865,7 @@ var ModelResolver = class {
    */
   contextWindowFor(source, model) {
     if (!model) return void 0;
-    const window2 = isApiProvider(source) ? this.cachedPickerOptions?.find((o) => o.apiProvider === source && o.id === prefixModelId(source, stripModelPrefix(model, source)))?.contextWindow : this.discovery.getCached(source)?.find((m) => m.modelId === model)?.contextWindow;
+    const window2 = isApiProvider(source) ? this.vendor.options?.find((o) => o.apiProvider === source && o.id === prefixModelId(source, stripModelPrefix(model, source)))?.contextWindow : this.discovery.getCached(source)?.find((m) => m.modelId === model)?.contextWindow;
     return window2 && window2 > 0 ? window2 : void 0;
   }
   /**
@@ -34308,14 +34875,16 @@ var ModelResolver = class {
    */
   maxOutputTokensFor(source, model) {
     if (!model || !isApiProvider(source)) return void 0;
-    const cap = this.cachedPickerOptions?.find((o) => o.apiProvider === source && o.id === prefixModelId(source, stripModelPrefix(model, source)))?.maxOutputTokens;
+    const cap = this.vendor.options?.find((o) => o.apiProvider === source && o.id === prefixModelId(source, stripModelPrefix(model, source)))?.maxOutputTokens;
     return cap && cap > 0 ? cap : void 0;
   }
+  /** Forget every catalog: the vendor ones, and each runner environment's. */
   invalidate() {
-    this.discovery.clear();
-    this.cachedPickerOptions = null;
-    this.pickerLoad = null;
-    this.lastDiscoveryErrors = {};
+    this.refreshRunnerModels();
+    this.vendor.generation++;
+    this.vendor.options = null;
+    this.vendor.load = null;
+    this.vendor.errors = {};
     if (!this.fetchImpl) {
       for (const provider of PROVIDER_PRIORITY) {
         const baseUrl = this.config.getProviderBaseUrl(provider);
@@ -34325,6 +34894,9 @@ var ModelResolver = class {
     }
   }
 };
+function candidatesOf(models) {
+  return models.map((m) => ({ id: m.modelId, variants: m.variants }));
+}
 
 // src/services/RunnerInstallation.ts
 import { exec as exec4 } from "child_process";
@@ -34918,7 +35490,7 @@ import { spawn as nodeSpawn3 } from "child_process";
 import { randomUUID as randomUUID7 } from "crypto";
 import { mkdtempSync as mkdtempSync5, rmSync as rmSync12 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
-import { join as join37 } from "path";
+import { join as join39 } from "path";
 var DEFAULT_TIMEOUT_MS5 = 2e4;
 var INITIALIZE_TIMEOUT_MS2 = 1e4;
 var USAGE_TIMEOUT_MS = 1e4;
@@ -34950,7 +35522,7 @@ function claudeAccountLimitCollector(options) {
   };
 }
 async function readClaudeAccountLimits(options, signal) {
-  const cwd = mkdtempSync5(join37(tmpdir6(), "ordewell-claude-limits-"));
+  const cwd = mkdtempSync5(join39(tmpdir6(), "ordewell-claude-limits-"));
   const removeCwd = () => {
     try {
       rmSync12(cwd, { recursive: true, force: true });
@@ -35034,13 +35606,13 @@ function isoInstant(value) {
 }
 
 // src/services/harness/openCodeGoLimits.ts
-import { homedir as homedir11 } from "os";
+import { homedir as homedir9 } from "os";
 
 // src/services/harness/openCodeCredentials.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { promises as fs20 } from "fs";
 import { homedir as osHomedir } from "os";
-import { join as join38, resolve as resolve13 } from "path";
+import { join as join40, resolve as resolve13 } from "path";
 import { Worker } from "worker_threads";
 var DEFAULT_TIMEOUT_MS6 = 5e3;
 var BUSY_MS = 250;
@@ -35095,19 +35667,19 @@ function walStore(path) {
 parentPort.postMessage(select());
 `;
 var isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var digest = (...parts) => createHash5("sha256").update(parts.join("\0")).digest("hex").slice(0, 32);
+var digest = (...parts) => createHash6("sha256").update(parts.join("\0")).digest("hex").slice(0, 32);
 function openCodeStorePaths(env, home) {
-  const data = join38(env.XDG_DATA_HOME || join38(home, ".local", "share"), "opencode");
+  const data = join40(env.XDG_DATA_HOME || join40(home, ".local", "share"), "opencode");
   const file = env.OPENCODE_DB || "opencode.db";
-  return { db: file === ":memory:" ? null : resolve13(data, file), auth: join38(data, "auth.json") };
+  return { db: file === ":memory:" ? null : resolve13(data, file), auth: join40(data, "auth.json") };
 }
 function openCodeGoLoginReader(deps = {}) {
-  const homedir12 = deps.homedir ?? osHomedir;
+  const homedir10 = deps.homedir ?? osHomedir;
   let last;
   return {
     async read(env, signal) {
       if (signal.aborted) return { kind: "unreadable" };
-      const paths = openCodeStorePaths(env, homedir12());
+      const paths = openCodeStorePaths(env, homedir10());
       const [db, wal, auth] = await Promise.all([
         paths.db ? stamp(paths.db) : null,
         paths.db ? stamp(`${paths.db}-wal`) : null,
@@ -35161,8 +35733,8 @@ function v2Login(db, row) {
     login: { route: "console", owner: digest("console", db, row.id, account, orgID ?? ""), access: value.access, ...orgID ? { orgID } : {}, expires: value.expires }
   };
 }
-async function legacyLogin(path46, env) {
-  const content = env.OPENCODE_AUTH_CONTENT ?? await readSmall(path46);
+async function legacyLogin(path49, env) {
+  const content = env.OPENCODE_AUTH_CONTENT ?? await readSmall(path49);
   if (content === void 0) return env[ENV_KEY] ? { kind: "unsupported" } : { kind: "none" };
   if (content === null) return { kind: "unreadable" };
   const auth = parseJson(content);
@@ -35171,15 +35743,15 @@ async function legacyLogin(path46, env) {
   if (entry === void 0) return env[ENV_KEY] ? { kind: "unsupported" } : { kind: "none" };
   if (!isRecord9(entry) || entry.type !== "api") return { kind: "unsupported" };
   if (typeof entry.key !== "string" || entry.key.length === 0) return { kind: "unreadable" };
-  return { kind: "login", login: { route: "key", owner: digest("v1", path46, entry.key), key: entry.key } };
+  return { kind: "login", login: { route: "key", owner: digest("v1", path49, entry.key), key: entry.key } };
 }
-function queryStore(path46, signal, deps) {
+function queryStore(path49, signal, deps) {
   return new Promise((settle) => {
     let worker;
     try {
       worker = (deps.spawnWorker ?? ((source, options) => new Worker(source, options)))(WORKER_SOURCE, {
         eval: true,
-        workerData: { path: path46, integrations: GO_INTEGRATIONS, busyMs: BUSY_MS, maxValueBytes: MAX_VALUE_BYTES },
+        workerData: { path: path49, integrations: GO_INTEGRATIONS, busyMs: BUSY_MS, maxValueBytes: MAX_VALUE_BYTES },
         execArgv: deps.workerExecArgv ?? [],
         resourceLimits: { maxOldGenerationSizeMb: 64 }
       });
@@ -35206,19 +35778,19 @@ function queryStore(path46, signal, deps) {
     worker.once("exit", aborted);
   });
 }
-async function stamp(path46) {
+async function stamp(path49) {
   try {
-    const stat = await fs20.stat(path46);
+    const stat = await fs20.stat(path49);
     return [stat.ino, stat.size, stat.mtimeMs];
   } catch {
     return null;
   }
 }
-async function readSmall(path46) {
+async function readSmall(path49) {
   try {
-    const stat = await fs20.stat(path46);
+    const stat = await fs20.stat(path49);
     if (!stat.isFile() || stat.size > MAX_AUTH_FILE_BYTES) return null;
-    return await fs20.readFile(path46, "utf8");
+    return await fs20.readFile(path49, "utf8");
   } catch (err) {
     return err.code === "ENOENT" ? void 0 : null;
   }
@@ -35251,7 +35823,7 @@ function openCodeGoAccountLimitCollector(options) {
     label: "OpenCode Go",
     provider: "opencode-go",
     scope: () => {
-      const paths = openCodeStorePaths(env(), (deps.reader?.homedir ?? homedir11)());
+      const paths = openCodeStorePaths(env(), (deps.reader?.homedir ?? homedir9)());
       return ["opencode", paths.db ?? ":memory:", paths.auth].join("\0");
     },
     acquire: async (signal) => {
@@ -36347,20 +36919,20 @@ function createAiService(config, deps) {
 }
 
 // src/services/createSession.ts
-import * as path43 from "path";
+import * as path46 from "path";
 
 // src/services/handoffReferences.ts
 import * as fs21 from "fs";
-import * as path41 from "path";
+import * as path44 from "path";
 import { spawnSync as spawnSync2 } from "child_process";
 function resolveHandoffReferences(handoff, workspace) {
   const checked = /* @__PURE__ */ new Map();
   const contained = (candidate) => {
     try {
       const root = fs21.realpathSync(workspace);
-      const resolved = fs21.realpathSync(path41.resolve(root, candidate));
-      const relative17 = path41.relative(root, resolved);
-      return relative17 !== ".." && !relative17.startsWith(`..${path41.sep}`) && !path41.isAbsolute(relative17) ? resolved : void 0;
+      const resolved = fs21.realpathSync(path44.resolve(root, candidate));
+      const relative17 = path44.relative(root, resolved);
+      return relative17 !== ".." && !relative17.startsWith(`..${path44.sep}`) && !path44.isAbsolute(relative17) ? resolved : void 0;
     } catch {
       return void 0;
     }
@@ -36381,7 +36953,7 @@ function resolveHandoffReferences(handoff, workspace) {
       }
     } else if (/^[0-9a-fA-F]{4,64}$/.test(ref.sha)) {
       const repo = contained(ref.repo ?? ".");
-      if (repo && fs21.existsSync(path41.join(repo, ".git"))) {
+      if (repo && fs21.existsSync(path44.join(repo, ".git"))) {
         const result2 = spawnSync2("git", ["--no-optional-locks", "--no-replace-objects", "cat-file", "-t", ref.sha], {
           cwd: repo,
           encoding: "utf8",
@@ -37733,7 +38305,8 @@ var SessionEventRelay = class {
         this.checkpointQuestion(t.id),
         this.waitsForApproval(t.id),
         this.orchestrator.holdReason(t.id),
-        this.orchestrator.getCompletionReceipt(t.id)
+        this.orchestrator.getCompletionReceipt(t.id),
+        this.orchestrator.getToolsAttaching(t.id)
       )),
       ...runMerge ? { runMerge } : {},
       activity: this.orchestrator.activity
@@ -37855,10 +38428,10 @@ var SessionEventRelay = class {
 
 // src/utils/taskLogStore.ts
 import * as fs22 from "fs";
-import * as path42 from "path";
+import * as path45 from "path";
 var EXTENSION = ".jsonl";
 function taskDir({ baseDir, sessionId }, taskId) {
-  return path42.join(sessionDataDir(sessionId, baseDir), "tasks", idSegment(taskId));
+  return path45.join(sessionDataDir(sessionId, baseDir), "tasks", idSegment(taskId));
 }
 function listTaskLogAttempts(location, taskId) {
   let names;
@@ -37876,7 +38449,7 @@ function openTaskLog(location, taskId, attempt) {
   const next = (listTaskLogAttempts(location, taskId).pop() ?? 0) + 1;
   let number = attempt !== void 0 && Number.isInteger(attempt) && attempt >= 1 ? attempt : next;
   for (; ; ) {
-    const file = path42.join(dir, `${number}${EXTENSION}`);
+    const file = path45.join(dir, `${number}${EXTENSION}`);
     try {
       fs22.writeFileSync(file, "", { flag: "wx" });
     } catch (err) {
@@ -37900,15 +38473,15 @@ function prepareTaskOutputFile(location, taskId, attempt) {
   ensureStateDirIgnored(location.baseDir);
   const dir = taskDir(location, taskId);
   fs22.mkdirSync(dir, { recursive: true });
-  return path42.join(dir, `${attempt}.output.txt`);
+  return path45.join(dir, `${attempt}.output.txt`);
 }
 function taskPatchFile(location, taskId, attempt) {
-  return path42.join(taskDir(location, taskId), `${attempt}.patch`);
+  return path45.join(taskDir(location, taskId), `${attempt}.patch`);
 }
 function saveTaskPatch(location, taskId, attempt, patch) {
   ensureStateDirIgnored(location.baseDir);
   const file = taskPatchFile(location, taskId, attempt);
-  fs22.mkdirSync(path42.dirname(file), { recursive: true });
+  fs22.mkdirSync(path45.dirname(file), { recursive: true });
   const partial = `${file}.${process.pid}-${Date.now()}.partial`;
   fs22.writeFileSync(partial, patch, { flag: "wx" });
   fs22.renameSync(partial, file);
@@ -37929,7 +38502,7 @@ function readTaskLog(location, taskId, attempt) {
   if (!Number.isInteger(attempt) || attempt < 1) return [];
   let raw;
   try {
-    raw = fs22.readFileSync(path42.join(taskDir(location, taskId), `${attempt}${EXTENSION}`), "utf-8");
+    raw = fs22.readFileSync(path45.join(taskDir(location, taskId), `${attempt}${EXTENSION}`), "utf-8");
   } catch {
     return [];
   }
@@ -39958,7 +40531,7 @@ function createSession(deps) {
     ...deps.openTaskLog ? {} : {
       keepPatch: (taskId, attempt, patch) => {
         const location = session.taskLogLocation;
-        return path43.relative(location.baseDir, saveTaskPatch(location, taskId, attempt, patch)).split(path43.sep).join("/");
+        return path46.relative(location.baseDir, saveTaskPatch(location, taskId, attempt, patch)).split(path46.sep).join("/");
       }
     },
     recordHandoff: (sessionId, taskId, handoff) => taskLogs.note(sessionId, taskId, { type: "handoff", handoff }),
@@ -42087,6 +42660,7 @@ var StructuredSession = class extends AbstractRunnerSession {
    */
   async startAttached(opts) {
     const { server: server4, scope, shell, savePatch, webReads } = this.launch.tools;
+    this.launch.onAttaching?.(1);
     const spawned = await spawnAttached({
       runner: this.launch.runner,
       create: () => this.launch.createAdapter(this.launch.runner, this.launch.deps),
@@ -42123,7 +42697,10 @@ var StructuredSession = class extends AbstractRunnerSession {
       },
       cancelled: this.ended.signal,
       startupExit: () => this.startupExit,
-      onRespawn: (failure2) => this.launch.onNotice?.(`${this.launch.runner} started without Ordewell's tools (${failure2}); respawning once.`),
+      onRespawn: (failure2) => {
+        this.launch.onNotice?.(`${this.launch.runner} started without Ordewell's tools (${failure2}); respawning once.`);
+        this.launch.onAttaching?.(2);
+      },
       failed: (first, second) => `Could not start ${this.launch.runner} with Ordewell's tools, so the task was not sent to it. First spawn: ${first}. Respawn: ${second}.`
     });
     if (!spawned) return;
@@ -42706,16 +43283,22 @@ var StructuredRunner = class extends AbstractRunner {
       checkHandoff: opts.checkHandoff ?? ((completion) => checkHandoff(completion, opts.taskId, [])),
       ...opts.readTask ? { readTask: opts.readTask } : {},
       ...opts.applyPatch ? { applyPatch: opts.applyPatch } : {},
-      onNotice: opts.onNotice
+      onNotice: opts.onNotice,
+      onAttaching: opts.onAttaching
     });
     console.error(`[structured] Starting ${opts.runner} [${opts.mode ?? "default"}] (${opts.modelId || "default"}) for task ${opts.taskId.slice(0, 8)}`);
     this.registerSession(id2, session);
+    const cancel = () => void session.stop();
+    opts.cancelled?.addEventListener("abort", cancel, { once: true });
     try {
+      if (opts.cancelled?.aborted) cancel();
       await session.start(opts.prompt);
     } catch (err) {
       session.kill();
       this.sessions.delete(id2);
       throw err;
+    } finally {
+      opts.cancelled?.removeEventListener("abort", cancel);
     }
     return session;
   }
@@ -42789,7 +43372,7 @@ var RunnerRegistry = class {
 
 // src/plugins/removedPluginNotice.ts
 import * as fs23 from "fs";
-import * as path44 from "path";
+import * as path47 from "path";
 function isManifestFile(file) {
   try {
     return fs23.statSync(file).isFile();
@@ -42798,10 +43381,10 @@ function isManifestFile(file) {
   }
 }
 function removedPluginNotice(dataDir = globalDataDir()) {
-  const directory = path44.join(dataDir, "plugins");
+  const directory = path47.join(dataDir, "plugins");
   try {
-    const hasManifest = isManifestFile(path44.join(directory, "manifest.json")) || fs23.readdirSync(directory, { withFileTypes: true }).some(
-      (entry) => (entry.isDirectory() || entry.isSymbolicLink()) && isManifestFile(path44.join(directory, entry.name, "manifest.json"))
+    const hasManifest = isManifestFile(path47.join(directory, "manifest.json")) || fs23.readdirSync(directory, { withFileTypes: true }).some(
+      (entry) => (entry.isDirectory() || entry.isSymbolicLink()) && isManifestFile(path47.join(directory, entry.name, "manifest.json"))
     );
     if (hasManifest) return "Plugin runners were removed; manifests in ~/.ordewell/plugins/ are ignored. See the CHANGELOG.";
   } catch {
@@ -42812,15 +43395,15 @@ function removedPluginNotice(dataDir = globalDataDir()) {
 
 // src/utils/stateStore.ts
 import * as fs24 from "fs";
-import * as path45 from "path";
+import * as path48 from "path";
 var STATE_FILE2 = "state.json";
 function getStatePath(baseDir) {
-  return path45.join(getStateDir(baseDir), STATE_FILE2);
+  return path48.join(getStateDir(baseDir), STATE_FILE2);
 }
 var SESSION_ID_KEY = "sessionId";
 function saveState(plan, baseDir, sessionId) {
   const statePath = getStatePath(baseDir ?? process.cwd());
-  ensureDir(path45.dirname(statePath));
+  ensureDir(path48.dirname(statePath));
   plan.lastUpdated = (/* @__PURE__ */ new Date()).toISOString();
   const file = sessionId ? { ...plan, [SESSION_ID_KEY]: sessionId } : plan;
   dropRetiredPlanFields(file);
@@ -43106,6 +43689,7 @@ export {
   assignedRunnerOf,
   assignmentIssue,
   assignmentIssueText,
+  attachingLabel,
   augmentedPath,
   automergeSummary,
   autonomyLevelLabel,
@@ -43367,6 +43951,7 @@ export {
   repoBaseLine,
   repoResultLines,
   reposWithWork,
+  repositoryRunnerConfigPaths,
   researchShellWarning,
   researchToolsPath,
   resetInstalledPlanner,