@ordewell/core 0.11.2 → 0.11.3

package/dist/index.js

@@ -472,6 +472,7 @@ __export(index_exports, {
   repoBaseLine: () => repoBaseLine,
   repoResultLines: () => repoResultLines,
   reposWithWork: () => reposWithWork,
+  repositoryRunnerConfigPaths: () => repositoryRunnerConfigPaths,
   researchShellWarning: () => researchShellWarning,
   researchToolsPath: () => researchToolsPath,
   resetInstalledPlanner: () => resetInstalledPlanner,
@@ -662,18 +663,18 @@ function dependencyTargetErrors(tasks, taskId, dependencies) {
 }
 function findDependencyCycle(tasks) {
   const byId = new Map([...walkPlan(tasks)].map(({ task: task2 }) => [task2.id, task2]));
-  const path48 = [];
+  const path50 = [];
   const done = /* @__PURE__ */ new Set();
   const visit = (id2) => {
     if (done.has(id2)) return null;
-    const at = path48.indexOf(id2);
-    if (at >= 0) return path48.slice(at);
-    path48.push(id2);
+    const at = path50.indexOf(id2);
+    if (at >= 0) return path50.slice(at);
+    path50.push(id2);
     for (const dep of byId.get(id2)?.dependencies ?? []) {
       const hit = visit(dep);
       if (hit) return hit;
     }
-    path48.pop();
+    path50.pop();
     done.add(id2);
     return null;
   };
@@ -1738,7 +1739,7 @@ function lastServedModel(events) {
   return void 0;
 }
 function taskLogForSurface(events) {
-  return events.map((event) => event.type === "task_skills" ? { type: "task_skills", skills: event.skills.map(({ name, source, path: path48 }) => ({ name, source, path: path48 })) } : event);
+  return events.map((event) => event.type === "task_skills" ? { type: "task_skills", skills: event.skills.map(({ name, source, path: path50 }) => ({ name, source, path: path50 })) } : event);
 }
 function coalesceTaskLog(events) {
   const out = [];
@@ -6220,7 +6221,7 @@ function pathRefs(command, opts = {}) {
   return lexAll(command.trim(), dialect, opts.cdpathSet).segments.flatMap((seg) => {
     const patterns = patternArgs(seg);
     const cwd = seg.cwd ?? [];
-    return [...seg.args.filter((_, i) => !patterns.has(i)), ...seg.inputs].flatMap(pathIn).map((path48) => ({ path: path48, cwd }));
+    return [...seg.args.filter((_, i) => !patterns.has(i)), ...seg.inputs].flatMap(pathIn).map((path50) => ({ path: path50, cwd }));
   });
 }
 function excludedBy(command, allow, opts = {}) {
@@ -6764,10 +6765,10 @@ function summarizeToolCall(tool2, argsJson, toolLabel) {
       const scope = args.include ? ` in ${args.include}` : "";
       return `grep ${ellipsize(String(args.pattern), 40)}${scope}${mode}`;
     }
-    const path48 = args.filePath || args.file_path || args.path;
-    if (path48) {
-      const basename6 = String(path48).split("/").pop() || String(path48);
-      return `${display} ${basename6}`;
+    const path50 = args.filePath || args.file_path || args.path;
+    if (path50) {
+      const basename7 = String(path50).split("/").pop() || String(path50);
+      return `${display} ${basename7}`;
     }
     if (args.pattern) {
       return `${display} ${args.pattern}`;
@@ -8382,7 +8383,7 @@ ${outcome.output}${outcome.success ? "" : `
     }
     let shell;
     try {
-      const sealed2 = site.task?.gitBefore ? { ...site.sealed, gitEntries: site.task.gitBefore.entries.map(({ path: path48, directory }) => ({ path: path48, directory })) } : site.sealed;
+      const sealed2 = site.task?.gitBefore ? { ...site.sealed, gitEntries: site.task.gitBefore.entries.map(({ path: path50, directory }) => ({ path: path50, directory })) } : site.sealed;
       shell = await site.sandbox.launchSealed(this.researchShell, sealed2);
     } catch (err) {
       return { refused: refusal(`Command not run: its sealed sandbox could not be prepared (${err instanceof Error ? err.message : String(err)}).`) };
@@ -9931,8 +9932,8 @@ function firstLineOf(command) {
 function text(value) {
   return typeof value === "string" ? value : "";
 }
-function searchArg(pattern, path48, include = "") {
-  return `${pattern}${path48 ? ` in ${path48}` : ""}${include ? ` (${include})` : ""}`;
+function searchArg(pattern, path50, include = "") {
+  return `${pattern}${path50 ? ` in ${path50}` : ""}${include ? ` (${include})` : ""}`;
 }
 function hintArg(args) {
   for (const field of HINT_FIELDS) {
@@ -10037,8 +10038,8 @@ function userMessage(id2, text6, skills, { turnId, forced } = {}) {
     ...forced ? { forced: true } : {}
   };
 }
-function skillLoadNotice({ invokedBy, name, source, path: path48, attaches }) {
-  return { invokedBy, name, source, path: path48, ...attaches ? { attaches } : {} };
+function skillLoadNotice({ invokedBy, name, source, path: path50, attaches }) {
+  return { invokedBy, name, source, path: path50, ...attaches ? { attaches } : {} };
 }
 var LOAD_SKILL_TOOL = /(?:^|_)load_skill$/;
 function surfaceStep(step) {
@@ -10055,8 +10056,8 @@ function loadedSkillName(args) {
     return void 0;
   }
 }
-function skillLoadBlock(id2, { invokedBy, name, source, path: path48, attaches }, turnId) {
-  return { type: "skill_load", id: id2, invokedBy, name, source, path: path48, ...attaches ? { attaches } : {}, ...turnId ? { turnId } : {} };
+function skillLoadBlock(id2, { invokedBy, name, source, path: path50, attaches }, turnId) {
+  return { type: "skill_load", id: id2, invokedBy, name, source, path: path50, ...attaches ? { attaches } : {}, ...turnId ? { turnId } : {} };
 }
 function subagentBlock(id2, { toolCallId, model, usage, turnId, ...fields }) {
   return {
@@ -10934,9 +10935,9 @@ function claudeManagedSettingsDir(platform = process.platform) {
 }
 function readClaudeSettingsModels(files, platform = process.platform) {
   const managed = claudeManagedSettingsDir(platform);
-  const join44 = platform === "win32" ? path13.win32.join : path13.posix.join;
-  const dropIns = files.list(join44(managed, "managed-settings.d")).filter((name) => name.endsWith(".json") && !name.startsWith(".")).sort().map((name) => join44(managed, "managed-settings.d", name));
-  const ranked = [...dropIns.reverse(), join44(managed, "managed-settings.json"), join44(claudeConfigDir(files.env), "settings.json")];
+  const join46 = platform === "win32" ? path13.win32.join : path13.posix.join;
+  const dropIns = files.list(join46(managed, "managed-settings.d")).filter((name) => name.endsWith(".json") && !name.startsWith(".")).sort().map((name) => join46(managed, "managed-settings.d", name));
+  const ranked = [...dropIns.reverse(), join46(managed, "managed-settings.json"), join46(claudeConfigDir(files.env), "settings.json")];
   for (const file of ranked) {
     const content = files.read(file);
     const lineup = content === null ? null : parseClaudeSettingsModels(content);
@@ -12048,12 +12049,12 @@ function checkpointReply(answer2) {
       return { text: `The checkpoint was withdrawn: ${answer2.why}`, isError: true };
   }
 }
-function fieldPath(path48) {
-  return path48.reduce((text6, part) => typeof part === "number" ? `${text6}[${part}]` : text6 ? `${text6}.${String(part)}` : String(part), "");
+function fieldPath(path50) {
+  return path50.reduce((text6, part) => typeof part === "number" ? `${text6}[${part}]` : text6 ? `${text6}.${String(part)}` : String(part), "");
 }
-function valueAt(value, path48) {
+function valueAt(value, path50) {
   let current = value;
-  for (const part of path48) {
+  for (const part of path50) {
     if (typeof part === "number") {
       if (!Array.isArray(current)) return void 0;
       current = current[part];
@@ -12075,7 +12076,7 @@ function boundedRefusal(issue, args) {
 var LEAKED_PARAMETER = /<\/parameter>|<parameter\s+name\s*=\s*"([^"]*)">/g;
 function leakedMarkupIn(value) {
   const found = [];
-  const walk = (node, path48) => {
+  const walk = (node, path50) => {
     if (typeof node === "string") {
       const names = [];
       let closing = false;
@@ -12083,25 +12084,25 @@ function leakedMarkupIn(value) {
         if (match[1] !== void 0) names.push(match[1]);
         else closing = true;
       }
-      if (names.length > 0 || closing) found.push({ path: path48, names: [...new Set(names)], closing });
+      if (names.length > 0 || closing) found.push({ path: path50, names: [...new Set(names)], closing });
       return;
     }
     if (Array.isArray(node)) {
-      node.forEach((item, i) => walk(item, `${path48}[${i}]`));
+      node.forEach((item, i) => walk(item, `${path50}[${i}]`));
       return;
     }
     if (node !== null && typeof node === "object") {
-      for (const [key, item] of Object.entries(node)) walk(item, path48 ? `${path48}.${key}` : key);
+      for (const [key, item] of Object.entries(node)) walk(item, path50 ? `${path50}.${key}` : key);
     }
   };
   walk(value, "");
   return found;
 }
 function markupRefusal(leaks) {
-  return leaks.map(({ path: path48, names, closing }) => {
+  return leaks.map(({ path: path50, names, closing }) => {
     const tags = [...names.map((n) => `<parameter name="${n}">`), ...closing ? ["</parameter>"] : []];
-    const guide = names.length > 0 ? ` The parameters ${names.map((n) => JSON.stringify(n)).join(", ")} are inside it; pass them as separate arguments, not inside ${path48}.` : " Pass each argument separately, not inside one string.";
-    return `${path48} contains leaked tool-call markup: ${tags.join(", ")}.${guide}`;
+    const guide = names.length > 0 ? ` The parameters ${names.map((n) => JSON.stringify(n)).join(", ")} are inside it; pass them as separate arguments, not inside ${path50}.` : " Pass each argument separately, not inside one string.";
+    return `${path50} contains leaked tool-call markup: ${tags.join(", ")}.${guide}`;
   }).join("\n");
 }
 function invalidArguments(name, error, args) {
@@ -12566,9 +12567,9 @@ function mcpClientConfig(credential) {
 }
 function ownerOnlyConfigFile(fileName, contents) {
   const dir = (0, import_fs5.mkdtempSync)((0, import_path4.join)((0, import_os.tmpdir)(), "ordewell-mcp-"));
-  const path48 = (0, import_path4.join)(dir, fileName);
-  (0, import_fs5.writeFileSync)(path48, contents, { mode: 384 });
-  return { path: path48, remove: () => (0, import_fs5.rmSync)(dir, { recursive: true, force: true }) };
+  const path50 = (0, import_path4.join)(dir, fileName);
+  (0, import_fs5.writeFileSync)(path50, contents, { mode: 384 });
+  return { path: path50, remove: () => (0, import_fs5.rmSync)(dir, { recursive: true, force: true }) };
 }
 
 // src/services/harness/repoConfig.ts
@@ -12697,33 +12698,33 @@ var TomlReader = class {
       if (this.i >= this.src.length) return root;
       if (this.src.startsWith("[[", this.i)) {
         this.i += 2;
-        const path48 = this.key();
+        const path50 = this.key();
         this.expect("]]");
-        const parent = this.tableAt(root, path48.slice(0, -1));
-        const last = path48[path48.length - 1];
+        const parent = this.tableAt(root, path50.slice(0, -1));
+        const last = path50[path50.length - 1];
         const list = Object.hasOwn(parent, last) ? parent[last] : parent[last] = [];
-        if (!Array.isArray(list)) throw this.fail(`${path48.join(".")} is not an array of tables`);
+        if (!Array.isArray(list)) throw this.fail(`${path50.join(".")} is not an array of tables`);
         table = newTable();
         list.push(table);
       } else if (this.src[this.i] === "[") {
         this.i += 1;
-        const path48 = this.key();
+        const path50 = this.key();
         this.expect("]");
-        table = this.tableAt(root, path48);
+        table = this.tableAt(root, path50);
       } else {
-        const path48 = this.key();
+        const path50 = this.key();
         this.skipBlank(false);
         this.expect("=");
         this.skipBlank(false);
-        const owner = this.tableAt(table, path48.slice(0, -1));
-        owner[path48[path48.length - 1]] = this.value();
+        const owner = this.tableAt(table, path50.slice(0, -1));
+        owner[path50[path50.length - 1]] = this.value();
       }
       this.endOfLine();
     }
   }
-  tableAt(from, path48) {
+  tableAt(from, path50) {
     let table = from;
-    for (const part of path48) {
+    for (const part of path50) {
       const next = Object.hasOwn(table, part) ? table[part] : void 0;
       if (next === void 0) table = table[part] = newTable();
       else if (isRecord2(next)) table = next;
@@ -12792,10 +12793,10 @@ var TomlReader = class {
         this.i++;
         return table;
       }
-      const path48 = this.key();
+      const path50 = this.key();
       this.expect("=");
       this.skipBlank(false);
-      this.tableAt(table, path48.slice(0, -1))[path48[path48.length - 1]] = this.value();
+      this.tableAt(table, path50.slice(0, -1))[path50[path50.length - 1]] = this.value();
       this.skipBlank(true);
       if (this.src[this.i] === ",") this.i++;
       else if (this.src[this.i] !== "}") throw this.fail("expected , or } in an inline table");
@@ -13170,7 +13171,7 @@ var LineBuffer = class {
 // src/services/harness/ClaudeCodeAdapter.ts
 var import_crypto6 = require("crypto");
 var import_fs11 = require("fs");
-var path22 = __toESM(require("path"));
+var path23 = __toESM(require("path"));
 
 // src/plugins/resolveArgs.ts
 function claudeThinkingArgs(effort) {
@@ -13253,28 +13254,28 @@ function posixBinDirs() {
   ];
 }
 function windowsBinDirs(env, home) {
-  const join44 = (...parts) => path15.win32.join(...parts);
-  const under = (base, ...parts) => base ? [join44(base, ...parts)] : [];
+  const join46 = (...parts) => path15.win32.join(...parts);
+  const under = (base, ...parts) => base ? [join46(base, ...parts)] : [];
   const appData = env.APPDATA;
   const localAppData = env.LOCALAPPDATA;
   const programData = env.ProgramData;
   return [
     // Native per-user installers, PowerShell-driven and otherwise.
-    join44(home, ".local", "bin"),
-    join44(home, ".opencode", "bin"),
-    join44(home, ".claude", "bin"),
-    join44(home, ".codex", "bin"),
+    join46(home, ".local", "bin"),
+    join46(home, ".opencode", "bin"),
+    join46(home, ".claude", "bin"),
+    join46(home, ".codex", "bin"),
     ...under(localAppData, "Programs", "claude"),
     // Node package managers. npm's global prefix is `%APPDATA%\npm`; the
     // literal spelling is kept as a fallback for a host that does not export
     // APPDATA (a service account, a stripped CI container).
     ...under(appData, "npm"),
-    join44(home, "AppData", "Roaming", "npm"),
+    join46(home, "AppData", "Roaming", "npm"),
     ...under(localAppData, "pnpm"),
     ...under(localAppData, "Yarn", "bin"),
-    join44(home, ".bun", "bin"),
+    join46(home, ".bun", "bin"),
     // Windows package managers.
-    join44(home, "scoop", "shims"),
+    join46(home, "scoop", "shims"),
     ...under(env.SCOOP, "shims"),
     ...under(env.SCOOP_GLOBAL ?? programData, "scoop", "shims"),
     ...under(programData, "chocolatey", "bin"),
@@ -13284,7 +13285,7 @@ function windowsBinDirs(env, home) {
     ...under(localAppData, "Microsoft", "WindowsApps"),
     // Version managers. Volta's Windows home is not the POSIX `~/.volta`.
     ...under(localAppData, "Volta", "bin"),
-    join44(home, ".volta", "bin")
+    join46(home, ".volta", "bin")
   ];
 }
 function wellKnownBinDirs(deps = {}) {
@@ -14532,7 +14533,7 @@ function readOnlySessionRules(site) {
       real = import_fs8.realpathSync.native(root);
     } catch {
     }
-    for (const path48 of /* @__PURE__ */ new Set([root, real])) rules.push({ action: "external_directory", resource: `${path48.replace(/[\\/]$/, "")}/*`, effect: "allow" });
+    for (const path50 of /* @__PURE__ */ new Set([root, real])) rules.push({ action: "external_directory", resource: `${path50.replace(/[\\/]$/, "")}/*`, effect: "allow" });
   }
   return rules;
 }
@@ -15254,6 +15255,20 @@ ${lines2.map((line) => `${line}
 }
 
 // src/services/harness/claudeOrdewell.ts
+var path21 = __toESM(require("path"));
+function assertNoClaudeTaskCollision(cwd) {
+  const text6 = readText(path21.join(cwd, ".mcp.json"));
+  if (text6 === void 0) return;
+  let parsed;
+  try {
+    parsed = JSON.parse(text6);
+  } catch {
+    return;
+  }
+  if (isRecord2(parsed) && isRecord2(parsed.mcpServers) && Object.hasOwn(parsed.mcpServers, ORDEWELL_MCP_SERVER_NAME)) {
+    throw new Error(".mcp.json declares an MCP server named ordewell; rename or remove the ordewell server before starting this task.");
+  }
+}
 var CLAUDE_ORDEWELL = {
   toolName: MCP_CLIENT_TOOL_NAMES.toolName,
   toolNames: MCP_CLIENT_TOOL_NAMES.toolNames,
@@ -15401,8 +15416,8 @@ var ReplyRuns = class {
 };
 
 // src/services/harness/claudeRepoConfig.ts
-var path21 = __toESM(require("path"));
-var MEMORY_FILES = ["CLAUDE.md", path21.join(".claude", "CLAUDE.md"), "CLAUDE.local.md"];
+var path22 = __toESM(require("path"));
+var MEMORY_FILES = ["CLAUDE.md", path22.join(".claude", "CLAUDE.md"), "CLAUDE.local.md"];
 var MAX_IMPORT_DEPTH = 5;
 function importsOf(text6) {
   const prose = text6.replace(/```[\s\S]*?```/g, "").replace(/`[^`\n]*`/g, "");
@@ -15413,11 +15428,11 @@ function withImports(workspace, file, depth, seen, into) {
   seen.add(file);
   const text6 = readText(file);
   if (text6 === void 0) return;
-  into.push({ path: path21.relative(workspace, file), text: text6 });
+  into.push({ path: path22.relative(workspace, file), text: text6 });
   if (depth >= MAX_IMPORT_DEPTH) return;
   for (const target of importsOf(text6)) {
     if (target.startsWith("~")) continue;
-    const abs = path21.resolve(path21.dirname(file), target);
+    const abs = path22.resolve(path22.dirname(file), target);
     if (insideOnDisk(workspace, abs)) withImports(workspace, abs, depth + 1, seen, into);
   }
 }
@@ -15438,12 +15453,12 @@ var CLAUDE_REPO_CONFIG = {
   instructions(workspace) {
     const files = [];
     const seen = /* @__PURE__ */ new Set();
-    for (const name of MEMORY_FILES) withImports(workspace, path21.join(workspace, name), 0, seen, files);
+    for (const name of MEMORY_FILES) withImports(workspace, path22.join(workspace, name), 0, seen, files);
     return files;
   },
   projectServers(workspace) {
     const source = ".mcp.json";
-    const text6 = readText(path21.join(workspace, source));
+    const text6 = readText(path22.join(workspace, source));
     if (text6 === void 0) return NO_SERVERS;
     let parsed;
     try {
@@ -15463,12 +15478,12 @@ var CLAUDE_REPO_CONFIG = {
 };
 function claudeLocalServers(env, workspace) {
   const configDir2 = env.CLAUDE_CONFIG_DIR?.trim();
-  const file = expandRunnerHome(configDir2 ? path21.join(configDir2, ".claude.json") : "~/.claude.json", env);
+  const file = expandRunnerHome(configDir2 ? path22.join(configDir2, ".claude.json") : "~/.claude.json", env);
   const text6 = file === null ? void 0 : readText(file);
   if (text6 === void 0) return {};
   try {
     const parsed = JSON.parse(text6);
-    const project = isRecord2(parsed) && isRecord2(parsed.projects) ? parsed.projects[path21.resolve(workspace)] : void 0;
+    const project = isRecord2(parsed) && isRecord2(parsed.projects) ? parsed.projects[path22.resolve(workspace)] : void 0;
     return isRecord2(project) && isRecord2(project.mcpServers) ? project.mcpServers : {};
   } catch {
     return {};
@@ -15723,13 +15738,13 @@ var NO_AUTO_MEMORY = { CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1" };
 function inSavedOutput(abs, configDir2, sessionId) {
   let projects;
   try {
-    projects = import_fs11.realpathSync.native(path22.join(configDir2, "projects"));
+    projects = import_fs11.realpathSync.native(path23.join(configDir2, "projects"));
   } catch {
     return false;
   }
-  const rel = path22.relative(projects, abs);
-  if (rel.startsWith("..") || path22.isAbsolute(rel)) return false;
-  const [project, session, folder] = rel.split(path22.sep);
+  const rel = path23.relative(projects, abs);
+  if (rel.startsWith("..") || path23.isAbsolute(rel)) return false;
+  const [project, session, folder] = rel.split(path23.sep);
   return Boolean(project) && session === sessionId && folder === "tool-results";
 }
 var PATH_TOOLS = {
@@ -16020,6 +16035,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
    */
   taskSpawnSpec(opts) {
     const readOnly = readOnlyTask(opts);
+    if (!readOnly) assertNoClaudeTaskCollision(opts.cwd);
     this.readOnlySite = readOnly ? opts : null;
     this.requestedMode = readOnly ? PLANNER_PERMISSION_MODE : opts.flags.permissionMode;
     this.followedModel = opts.model;
@@ -16815,8 +16831,8 @@ function runProbe(deps, cwd, env, flags) {
 }
 
 // src/services/harness/codexRepoConfig.ts
-var path23 = __toESM(require("path"));
-var CONFIG_FILE = path23.join(".codex", "config.toml");
+var path24 = __toESM(require("path"));
+var CONFIG_FILE = path24.join(".codex", "config.toml");
 function stringsOf(value) {
   return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
 }
@@ -16842,9 +16858,9 @@ var CODEX_REPO_CONFIG = {
     const files = [];
     for (const dir of repoLevels(workspace)) {
       for (const name of ["AGENTS.override.md", "AGENTS.md"]) {
-        const text6 = readText(path23.join(dir, name));
+        const text6 = readText(path24.join(dir, name));
         if (text6 === void 0) continue;
-        files.push({ path: path23.relative(workspace, path23.join(dir, name)) || name, text: text6 });
+        files.push({ path: path24.relative(workspace, path24.join(dir, name)) || name, text: text6 });
         break;
       }
     }
@@ -16855,10 +16871,10 @@ var CODEX_REPO_CONFIG = {
     const byName = /* @__PURE__ */ new Map();
     const unreadable = [];
     for (const dir of repoLevels(workspace)) {
-      const file = path23.join(dir, CONFIG_FILE);
+      const file = path24.join(dir, CONFIG_FILE);
       const text6 = readText(file);
       if (text6 === void 0) continue;
-      const source = path23.relative(workspace, file);
+      const source = path24.relative(workspace, file);
       let parsed;
       try {
         parsed = parseToml(text6);
@@ -16878,9 +16894,9 @@ var CODEX_REPO_CONFIG = {
 };
 function untrustedProjects(workspace) {
   const projects = {};
-  for (let dir = path23.resolve(workspace); ; dir = path23.dirname(dir)) {
+  for (let dir = path24.resolve(workspace); ; dir = path24.dirname(dir)) {
     projects[dir] = { trust_level: "untrusted" };
-    if (path23.dirname(dir) === dir) return projects;
+    if (path24.dirname(dir) === dir) return projects;
   }
 }
 
@@ -18001,7 +18017,7 @@ ${this.exitMessage()}`);
       case "webSearch":
         return;
       case "fileChange": {
-        const paths = (item.changes ?? []).map((change) => change.path).filter((path48) => !!path48);
+        const paths = (item.changes ?? []).map((change) => change.path).filter((path50) => !!path50);
         this.fileChangePaths.set(item.id, paths);
         if (this.startOpts?.kind === "task") {
           for (const change of item.changes ?? []) this.announceFileChange(item.id, change, emit, subagentId);
@@ -18104,20 +18120,20 @@ ${this.exitMessage()}`);
   announceFileChange(itemId, change, emit, subagentId) {
     const rows = this.fileChangeRows.get(itemId) ?? /* @__PURE__ */ new Map();
     this.fileChangeRows.set(itemId, rows);
-    const path48 = this.shownChangePath(change);
-    const known = rows.get(path48);
+    const path50 = this.shownChangePath(change);
+    const known = rows.get(path50);
     if (known) return known;
-    const row = rows.size === 0 ? itemId : `${itemId}:${path48}`;
-    rows.set(path48, row);
-    emit({ type: "tool_call", id: row, name: changeName(change), args: { path: path48 }, ...subagentId ? { subagentId } : {} });
+    const row = rows.size === 0 ? itemId : `${itemId}:${path50}`;
+    rows.set(path50, row);
+    emit({ type: "tool_call", id: row, name: changeName(change), args: { path: path50 }, ...subagentId ? { subagentId } : {} });
     return row;
   }
   /** Relative to the task's worktree, where every path but a stray one lies; a move names both ends. */
   shownChangePath(change) {
-    const shown = (path48) => {
+    const shown = (path50) => {
       const cwd = this.startOpts?.cwd;
-      const rel = cwd ? (0, import_path6.relative)(cwd, path48) : path48;
-      return rel && rel !== ".." && !rel.startsWith(`..${import_path6.sep}`) && !(0, import_path6.isAbsolute)(rel) ? rel : path48;
+      const rel = cwd ? (0, import_path6.relative)(cwd, path50) : path50;
+      return rel && rel !== ".." && !rel.startsWith(`..${import_path6.sep}`) && !(0, import_path6.isAbsolute)(rel) ? rel : path50;
     };
     const from = shown(change.path ?? "");
     return change.kind?.move_path ? `${from} \u2192 ${shown(change.kind.move_path)}` : from;
@@ -18168,7 +18184,7 @@ var import_fs12 = require("fs");
 
 // src/services/harness/projectServers.ts
 var import_crypto8 = require("crypto");
-var path24 = __toESM(require("path"));
+var path25 = __toESM(require("path"));
 function canonical2(value) {
   if (Array.isArray(value)) return value.map(canonical2);
   if (!isRecord2(value)) return value;
@@ -18179,7 +18195,7 @@ function projectServerScope(server4) {
   return `mcp-server:${server4.name}@${hash}`;
 }
 var scopeName = (scope) => scope.slice(0, scope.lastIndexOf("@"));
-function fileProjectServerApprovals(file = path24.join(globalDataDir(), "project-mcp-servers.json")) {
+function fileProjectServerApprovals(file = path25.join(globalDataDir(), "project-mcp-servers.json")) {
   const load = () => {
     const text6 = readText(file);
     if (text6 === void 0) return {};
@@ -19342,8 +19358,8 @@ var OpenCodeAdapter = class extends ProcessLifecycle {
       this.v2 = new OpenCodeV2({
         version,
         nativeShell: this.nativeShell?.prefix ?? null,
-        request: (method, path48, body, signal, timeoutMs) => this.request(method, path48, body, signal, timeoutMs),
-        json: (method, path48, body, signal, timeoutMs) => this.json(method, path48, body, signal, timeoutMs),
+        request: (method, path50, body, signal, timeoutMs) => this.request(method, path50, body, signal, timeoutMs),
+        json: (method, path50, body, signal, timeoutMs) => this.json(method, path50, body, signal, timeoutMs),
         openEvents: (signal) => this.deps.fetch(`${this.baseUrl}/api/event`, { signal, headers: this.headers() }),
         processEnded: this.processEnded,
         isExited: () => this.exited,
@@ -19980,15 +19996,15 @@ var OpenCodeAdapter = class extends ProcessLifecycle {
       onActivity
     );
   }
-  async json(method, path48, body, signal, timeoutMs) {
-    const response = await this.request(method, path48, body, signal, timeoutMs);
-    if (!response.ok) throw new OpenCodeHttpError(`${method} ${path48} failed: ${response.status} ${response.statusText}`);
+  async json(method, path50, body, signal, timeoutMs) {
+    const response = await this.request(method, path50, body, signal, timeoutMs);
+    if (!response.ok) throw new OpenCodeHttpError(`${method} ${path50} failed: ${response.status} ${response.statusText}`);
     return await response.json().catch(() => null);
   }
   /** `timeoutMs` null is for a turn's own POST, which the server answers when the turn is done. */
-  request(method, path48, body, signal, timeoutMs = REQUEST_TIMEOUT_MS) {
+  request(method, path50, body, signal, timeoutMs = REQUEST_TIMEOUT_MS) {
     const deadline = withDeadline(signal, timeoutMs);
-    return this.deps.fetch(`${this.baseUrl}${path48}`, {
+    return this.deps.fetch(`${this.baseUrl}${path50}`, {
       method,
       headers: this.headers({ "content-type": "application/json" }),
       ...body === void 0 ? {} : { body: JSON.stringify(body) },
@@ -20049,8 +20065,8 @@ var OpenCodeAdapter = class extends ProcessLifecycle {
 };
 
 // src/services/harness/openCodeRepoConfig.ts
-var path25 = __toESM(require("path"));
-var CONFIG_FILES = ["opencode.json", "opencode.jsonc", path25.join(".opencode", "opencode.json"), path25.join(".opencode", "opencode.jsonc")];
+var path26 = __toESM(require("path"));
+var CONFIG_FILES = ["opencode.json", "opencode.jsonc", path26.join(".opencode", "opencode.json"), path26.join(".opencode", "opencode.jsonc")];
 var INSTRUCTION_NAMES = ["AGENTS.md", "CLAUDE.md", "CONTEXT.md"];
 function server3(name, entry, source) {
   if (!isRecord2(entry)) return "not an object";
@@ -20069,8 +20085,8 @@ var OPENCODE_REPO_CONFIG = {
     const levels = repoLevels(workspace);
     for (const name of INSTRUCTION_NAMES) {
       const files = levels.flatMap((dir) => {
-        const text6 = readText(path25.join(dir, name));
-        return text6 === void 0 ? [] : [{ path: path25.relative(workspace, path25.join(dir, name)) || name, text: text6 }];
+        const text6 = readText(path26.join(dir, name));
+        return text6 === void 0 ? [] : [{ path: path26.relative(workspace, path26.join(dir, name)) || name, text: text6 }];
       });
       if (files.length > 0) return files;
     }
@@ -20082,10 +20098,10 @@ var OPENCODE_REPO_CONFIG = {
     const unreadable = [];
     for (const dir of repoLevels(workspace)) {
       for (const name of CONFIG_FILES) {
-        const file = path25.join(dir, name);
+        const file = path26.join(dir, name);
         const text6 = readText(file);
         if (text6 === void 0) continue;
-        const source = path25.relative(workspace, file);
+        const source = path26.relative(workspace, file);
         let parsed;
         try {
           parsed = parseJsonc(text6);
@@ -20274,7 +20290,7 @@ function knownModelId(value, optionIds, shortcuts) {
 
 // src/services/ModelCatalog.ts
 var fs6 = __toESM(require("fs"));
-var path26 = __toESM(require("path"));
+var path27 = __toESM(require("path"));
 var CACHE_KEY = "model-catalog";
 var CACHE_TTL_MS = 60 * 60 * 1e3;
 function storageKey(baseUrl) {
@@ -20327,7 +20343,7 @@ var ModelCatalog = class {
       const url = (baseUrl || "https://openrouter.ai/api/v1").replace(/\/+$/, "");
       const key = storageKey(url);
       const cacheDir = globalCacheDir();
-      const cacheFile = path26.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
+      const cacheFile = path27.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
       if (fs6.existsSync(cacheFile)) fs6.rmSync(cacheFile);
     } catch {
     }
@@ -20335,7 +20351,7 @@ var ModelCatalog = class {
   static readCache(key) {
     try {
       const cacheDir = globalCacheDir();
-      const cacheFile = path26.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
+      const cacheFile = path27.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
       if (!fs6.existsSync(cacheFile)) return null;
       const raw = fs6.readFileSync(cacheFile, "utf8");
       const data = JSON.parse(raw);
@@ -20349,7 +20365,7 @@ var ModelCatalog = class {
     try {
       const cacheDir = globalCacheDir();
       fs6.mkdirSync(cacheDir, { recursive: true });
-      const cacheFile = path26.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
+      const cacheFile = path27.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
       fs6.writeFileSync(
         cacheFile,
         JSON.stringify({ models, cachedAt: Date.now() }, null, 2)
@@ -20360,7 +20376,7 @@ var ModelCatalog = class {
 };
 
 // src/services/ModelDiscovery.ts
-var path27 = __toESM(require("path"));
+var path28 = __toESM(require("path"));
 var import_child_process6 = require("child_process");
 var import_util2 = require("util");
 var fsSync5 = __toESM(require("fs"));
@@ -20506,7 +20522,7 @@ function geminiDiscoveryCacheKey(apiKey) {
   return {
     key: `gemini-models:${hash}`,
     dir,
-    file: path27.join(dir, `gemini_models_${hash}.json`)
+    file: path28.join(dir, `gemini_models_${hash}.json`)
   };
 }
 function readGeminiCache(apiKey) {
@@ -21014,7 +21030,7 @@ function parseMaxParallel(value) {
 
 // src/services/SettingsService.ts
 var fs12 = __toESM(require("fs"));
-var path34 = __toESM(require("path"));
+var path35 = __toESM(require("path"));
 
 // src/utils/fileLock.ts
 var fs7 = __toESM(require("fs"));
@@ -23066,33 +23082,33 @@ ${skillBlock(entry.skill)}`, timestamp: entry.timestamp });
 }
 
 // src/services/taskSkills.ts
-var path33 = __toESM(require("path"));
+var path34 = __toESM(require("path"));
 
 // src/services/SkillsService.ts
 var import_crypto12 = require("crypto");
 var fs11 = __toESM(require("fs"));
-var path32 = __toESM(require("path"));
+var path33 = __toESM(require("path"));
 
 // src/services/builtinSkills.ts
-var path28 = __toESM(require("path"));
+var path29 = __toESM(require("path"));
 var import_url = require("url");
 function builtinSkillsDir() {
-  const dir = typeof __dirname !== "undefined" && __dirname ? __dirname : path28.dirname((0, import_url.fileURLToPath)(
+  const dir = typeof __dirname !== "undefined" && __dirname ? __dirname : path29.dirname((0, import_url.fileURLToPath)(
     // @ts-expect-error - import.meta is only valid under an ESM module setting
     __filename
   ));
-  return path28.join(dir, "..", "skills");
+  return path29.join(dir, "..", "skills");
 }
 
 // src/services/repoGroup.ts
 var fs10 = __toESM(require("fs"));
-var path31 = __toESM(require("path"));
+var path32 = __toESM(require("path"));
 
 // src/services/worktreeBootstrap.ts
 var import_child_process8 = require("child_process");
 var import_util4 = require("util");
 var fs9 = __toESM(require("fs"));
-var path30 = __toESM(require("path"));
+var path31 = __toESM(require("path"));
 
 // src/services/gitExec.ts
 var import_child_process7 = require("child_process");
@@ -23174,7 +23190,7 @@ function subcommandOf2(args) {
 
 // src/services/worktreeLink.ts
 var fs8 = __toESM(require("fs"));
-var path29 = __toESM(require("path"));
+var path30 = __toESM(require("path"));
 function linkPath(source, target, platform, hardLink = fs8.linkSync) {
   const isDir = fs8.statSync(source).isDirectory();
   if (platform !== "win32") {
@@ -23199,8 +23215,8 @@ function mirrorDir(source, target, opts) {
   const mirror = (from, to, prefix, top) => {
     fs8.mkdirSync(to, { recursive: true });
     for (const entry of fs8.readdirSync(from, { withFileTypes: true })) {
-      const name = path29.join(prefix, entry.name);
-      const at = { from: path29.join(from, entry.name), to: path29.join(to, entry.name), name };
+      const name = path30.join(prefix, entry.name);
+      const at = { from: path30.join(from, entry.name), to: path30.join(to, entry.name), name };
       if (entry.isSymbolicLink()) links.push(at);
       else if (top && entry.isDirectory() && (entry.name.startsWith("@") || entry.name === ".bin")) mirror(at.from, at.to, name, false);
       else if (linkPath(at.from, at.to, opts.platform, opts.hardLink) === "copy") copied.push(name);
@@ -23220,16 +23236,16 @@ function mirrorDir(source, target, opts) {
 }
 function relink(from, to, opts) {
   const text6 = fs8.readlinkSync(from);
-  const pointee = path29.isAbsolute(text6) ? rebased(text6, opts) : text6;
+  const pointee = path30.isAbsolute(text6) ? rebased(text6, opts) : text6;
   if (opts.platform !== "win32") {
-    if (!fs8.existsSync(path29.resolve(path29.dirname(to), pointee)) && fs8.existsSync(path29.resolve(path29.dirname(from), pointee))) {
-      fs8.symlinkSync(rebased(path29.resolve(path29.dirname(from), pointee), opts), to);
+    if (!fs8.existsSync(path30.resolve(path30.dirname(to), pointee)) && fs8.existsSync(path30.resolve(path30.dirname(from), pointee))) {
+      fs8.symlinkSync(rebased(path30.resolve(path30.dirname(from), pointee), opts), to);
       return "symlink";
     }
     fs8.symlinkSync(pointee, to);
     return "symlink";
   }
-  const resolved = fs8.existsSync(path29.resolve(path29.dirname(to), pointee)) ? path29.resolve(path29.dirname(to), pointee) : rebased(path29.resolve(path29.dirname(from), pointee), opts);
+  const resolved = fs8.existsSync(path30.resolve(path30.dirname(to), pointee)) ? path30.resolve(path30.dirname(to), pointee) : rebased(path30.resolve(path30.dirname(from), pointee), opts);
   try {
     fs8.statSync(resolved);
   } catch {
@@ -23238,9 +23254,9 @@ function relink(from, to, opts) {
   return linkPath(resolved, to, opts.platform, opts.hardLink);
 }
 function rebased(pointee, opts) {
-  const rel = path29.relative(opts.from, pointee);
-  const inside2 = rel !== "" && !rel.startsWith("..") && !path29.isAbsolute(rel);
-  return inside2 && !rel.split(/[\\/]/).includes("node_modules") ? path29.join(opts.to, rel) : pointee;
+  const rel = path30.relative(opts.from, pointee);
+  const inside2 = rel !== "" && !rel.startsWith("..") && !path30.isAbsolute(rel);
+  return inside2 && !rel.split(/[\\/]/).includes("node_modules") ? path30.join(opts.to, rel) : pointee;
 }
 
 // src/services/worktreeBootstrap.ts
@@ -23277,18 +23293,18 @@ function matchLinks(root, patterns) {
 }
 function segmentMatches(root, base, segment) {
   const under = (name) => base ? `${base}/${name}` : name;
-  if (!/[*?]/.test(segment)) return lexists(path30.join(root, base, segment)) ? [under(segment)] : [];
+  if (!/[*?]/.test(segment)) return lexists(path31.join(root, base, segment)) ? [under(segment)] : [];
   const pattern = new RegExp(`^${segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`);
-  return listDir2(path30.join(root, base)).filter((name) => !NEVER_SCANNED.has(name) && pattern.test(name)).map(under);
+  return listDir2(path31.join(root, base)).filter((name) => !NEVER_SCANNED.has(name) && pattern.test(name)).map(under);
 }
 function installDirs(root) {
   const packages = matchLinks(root, workspaceGlobs(root)).map((pkg) => `${pkg}/node_modules`);
-  return ["node_modules", ...packages].filter((dir) => lexists(path30.join(root, dir)));
+  return ["node_modules", ...packages].filter((dir) => lexists(path31.join(root, dir)));
 }
 function workspaceGlobs(root) {
   let manifest;
   try {
-    manifest = JSON.parse(fs9.readFileSync(path30.join(root, "package.json"), "utf8"));
+    manifest = JSON.parse(fs9.readFileSync(path31.join(root, "package.json"), "utf8"));
   } catch {
     return [];
   }
@@ -23303,19 +23319,19 @@ async function bootstrap(repo, cwd, opts) {
   const linked = [];
   const copied = [];
   const link = (name) => {
-    const target = path30.join(cwd, name);
+    const target = path31.join(cwd, name);
     if (lexists(target)) return;
-    fs9.mkdirSync(path30.dirname(target), { recursive: true });
-    if (linkPath(path30.join(repo.root, name), target, opts.platform) === "copy") copied.push(name);
+    fs9.mkdirSync(path31.dirname(target), { recursive: true });
+    if (linkPath(path31.join(repo.root, name), target, opts.platform) === "copy") copied.push(name);
     linked.push(name);
   };
   const mirror = (name) => {
-    const target = path30.join(cwd, name);
-    if (lexists(target) || !fs9.existsSync(path30.dirname(target))) return;
-    const source = path30.join(repo.root, name);
+    const target = path31.join(cwd, name);
+    if (lexists(target) || !fs9.existsSync(path31.dirname(target))) return;
+    const source = path31.join(repo.root, name);
     if (!fs9.lstatSync(source).isDirectory()) return link(name);
     const mirrored = mirrorDir(source, target, { platform: opts.platform, from: repo.root, to: cwd });
-    copied.push(...mirrored.map((entry) => path30.join(name, entry)));
+    copied.push(...mirrored.map((entry) => path31.join(name, entry)));
     linked.push(name);
   };
   if (!setup) {
@@ -23350,12 +23366,12 @@ async function runSetup(command, repo, cwd, resolvePath) {
 
 // src/services/repoGroup.ts
 function hasGitEntry(dir) {
-  return fs10.existsSync(path31.join(dir, ".git"));
+  return fs10.existsSync(path32.join(dir, ".git"));
 }
 function groupPathOf(listed3) {
   const slashed = listed3.trim().replace(/\\/g, "/");
-  if (path31.posix.isAbsolute(slashed) || path31.win32.isAbsolute(slashed)) return null;
-  const rel = path31.posix.normalize(slashed).replace(/\/+$/, "");
+  if (path32.posix.isAbsolute(slashed) || path32.win32.isAbsolute(slashed)) return null;
+  const rel = path32.posix.normalize(slashed).replace(/\/+$/, "");
   return rel === "" || rel === "." || rel === ".." || rel.startsWith("../") ? null : rel;
 }
 function childDirs(dir) {
@@ -23366,14 +23382,14 @@ function childDirs(dir) {
   }
 }
 function groupPaths(workspaceRoot, listed3) {
-  if (listed3.length === 0) return childDirs(workspaceRoot).filter((name) => hasGitEntry(path31.join(workspaceRoot, name)));
-  const paths = listed3.map(groupPathOf).filter((rel) => rel !== null && hasGitEntry(path31.join(workspaceRoot, rel)));
+  if (listed3.length === 0) return childDirs(workspaceRoot).filter((name) => hasGitEntry(path32.join(workspaceRoot, name)));
+  const paths = listed3.map(groupPathOf).filter((rel) => rel !== null && hasGitEntry(path32.join(workspaceRoot, rel)));
   return [...new Set(paths)].sort();
 }
 function workspaceRepoGroup(workspaceRoot, listed3) {
-  for (let dir = path31.resolve(workspaceRoot); ; dir = path31.dirname(dir)) {
+  for (let dir = path32.resolve(workspaceRoot); ; dir = path32.dirname(dir)) {
     if (hasGitEntry(dir)) return [SELF_REPO];
-    if (path31.dirname(dir) === dir) break;
+    if (path32.dirname(dir) === dir) break;
   }
   return groupPaths(workspaceRoot, listed3);
 }
@@ -23454,8 +23470,8 @@ function copyDirSync(src, dest) {
   fs11.mkdirSync(dest, { recursive: true });
   const entries = fs11.readdirSync(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = path32.join(src, entry.name);
-    const destPath = path32.join(dest, entry.name);
+    const srcPath = path33.join(src, entry.name);
+    const destPath = path33.join(dest, entry.name);
     if (entry.isDirectory()) copyDirSync(srcPath, destPath);
     else fs11.copyFileSync(srcPath, destPath);
   }
@@ -23479,7 +23495,7 @@ function readDir(dir, source) {
   if (!fs11.existsSync(dir)) return { skills, invalid };
   for (const entry of fs11.readdirSync(dir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const skillFile = path32.join(dir, entry.name, "SKILL.md");
+    const skillFile = path33.join(dir, entry.name, "SKILL.md");
     if (!fs11.existsSync(skillFile)) continue;
     if (!isSkillName(entry.name)) {
       invalid.push({ name: entry.name, path: skillFile, source, reason: INVALID_SKILL_NAME_REASON });
@@ -23498,15 +23514,15 @@ function skillFileIn(dir, name) {
     return void 0;
   }
   if (!entries.some((entry) => entry.isDirectory() && entry.name === name)) return void 0;
-  const skillFile = path32.join(dir, name, "SKILL.md");
+  const skillFile = path33.join(dir, name, "SKILL.md");
   return fs11.existsSync(skillFile) ? skillFile : void 0;
 }
 function skillsDirOf(root) {
-  return path32.join(root, STATE_DIR, "skills");
+  return path33.join(root, STATE_DIR, "skills");
 }
 function workspaceSkillRoots(workspaceRoot, repos, checkout = workspaceRoot) {
   if (repos.length === 0 || repos.includes(SELF_REPO)) return [checkout];
-  return [workspaceRoot, ...repos.map((repo) => path32.join(checkout, repo))];
+  return [workspaceRoot, ...repos.map((repo) => path33.join(checkout, repo))];
 }
 var SkillsService = class _SkillsService {
   workspaceRoots;
@@ -23529,11 +23545,11 @@ var SkillsService = class _SkillsService {
     return this.workspaceRoots.map(skillsDirOf);
   }
   globalDir() {
-    return path32.join(globalDataDir(), "skills");
+    return path33.join(globalDataDir(), "skills");
   }
   readSeedManifest() {
     try {
-      const parsed = JSON.parse(fs11.readFileSync(path32.join(this.globalDir(), SEED_MANIFEST), "utf8"));
+      const parsed = JSON.parse(fs11.readFileSync(path33.join(this.globalDir(), SEED_MANIFEST), "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         return Object.fromEntries(
           Object.entries(parsed).filter((entry) => typeof entry[1] === "string")
@@ -23549,7 +23565,7 @@ var SkillsService = class _SkillsService {
     manifest[name] = hash;
     try {
       fs11.mkdirSync(this.globalDir(), { recursive: true });
-      fs11.writeFileSync(path32.join(this.globalDir(), SEED_MANIFEST), JSON.stringify(manifest, null, 2));
+      fs11.writeFileSync(path33.join(this.globalDir(), SEED_MANIFEST), JSON.stringify(manifest, null, 2));
     } catch (err) {
       console.warn(`Could not record seeded skill ${name}: ${String(err)}`);
     }
@@ -23560,11 +23576,11 @@ var SkillsService = class _SkillsService {
     return this.readSeedManifest()[name] === currentHash || (PRIOR_BUILTIN_HASHES[name] ?? []).includes(currentHash);
   }
   seed(name) {
-    const dest = path32.join(this.globalDir(), name);
+    const dest = path33.join(this.globalDir(), name);
     const exists = fs11.existsSync(dest);
     let srcDir;
     try {
-      srcDir = path32.join(builtinSkillsDir(), name);
+      srcDir = path33.join(builtinSkillsDir(), name);
     } catch (err) {
       if (!exists) console.warn(`Could not locate built-in skills dir: ${String(err)}`);
       return false;
@@ -23573,9 +23589,9 @@ var SkillsService = class _SkillsService {
       if (!exists) console.warn(`Built-in skill not found in package: ${name}`);
       return false;
     }
-    const srcHash = fileHash(path32.join(srcDir, "SKILL.md"));
+    const srcHash = fileHash(path33.join(srcDir, "SKILL.md"));
     if (exists) {
-      const currentHash = fileHash(path32.join(dest, "SKILL.md"));
+      const currentHash = fileHash(path33.join(dest, "SKILL.md"));
       if (currentHash !== void 0 && currentHash === srcHash) {
         this.recordSeed(name, currentHash);
         return false;
@@ -23619,7 +23635,7 @@ var SkillsService = class _SkillsService {
     if (entries.length !== 1 || entries[0].name !== "SKILL.md" || !entries[0].isFile()) return false;
     let raw;
     try {
-      raw = readSkillText(path32.join(dir, "SKILL.md"));
+      raw = readSkillText(path33.join(dir, "SKILL.md"));
     } catch {
       return false;
     }
@@ -23627,7 +23643,7 @@ var SkillsService = class _SkillsService {
   }
   pruneRetired() {
     for (const name of RETIRED_BUILTIN_SKILL_NAMES) {
-      const dest = path32.join(this.globalDir(), name);
+      const dest = path33.join(this.globalDir(), name);
       if (!fs11.existsSync(dest)) continue;
       if (!this.isUnmodifiedRetiredSeed(dest, name)) continue;
       try {
@@ -23765,12 +23781,12 @@ var runGit = execFileWithTimeout(1e4);
 async function committedInHead(files) {
   const byDir = /* @__PURE__ */ new Map();
   for (const file of new Set(files)) {
-    const dir = path33.dirname(path33.dirname(file));
+    const dir = path34.dirname(path34.dirname(file));
     byDir.set(dir, [...byDir.get(dir) ?? [], file]);
   }
   const result = /* @__PURE__ */ new Map();
   await Promise.all([...byDir].map(async ([dir, inDir]) => {
-    const relative17 = (file) => path33.relative(dir, file).split(path33.sep).join("/");
+    const relative17 = (file) => path34.relative(dir, file).split(path34.sep).join("/");
     try {
       const { stdout } = await runGit("git", ["ls-tree", "--name-only", "HEAD", "--", ...inDir.map(relative17)], { cwd: dir, env: cleanEnv() });
       const listed3 = new Set(stdout.split("\n").map((line) => line.trim()).filter(Boolean));
@@ -23790,9 +23806,9 @@ function plannedSkillLookup(skillsAt, workspaceRoot, layout) {
     searchedDirs: () => lookup2.searchedDirs(),
     listSkills: () => lookup2.listSkills(),
     uncommitted: async (skills) => {
-      const checked = skills.filter((skill) => skill.source === "workspace" && !(readInPlace && path33.dirname(path33.dirname(skill.path)) === readInPlace));
+      const checked = skills.filter((skill) => skill.source === "workspace" && !(readInPlace && path34.dirname(path34.dirname(skill.path)) === readInPlace));
       const committed = await committedInHead(checked.map((skill) => skill.path));
-      return new Map(checked.filter((skill) => committed.get(skill.path) === false).map((skill) => [skill.path, path33.relative(workspaceRoot, path33.dirname(skill.path)).split(path33.sep).join("/")]));
+      return new Map(checked.filter((skill) => committed.get(skill.path) === false).map((skill) => [skill.path, path34.relative(workspaceRoot, path34.dirname(skill.path)).split(path34.sep).join("/")]));
     }
   };
 }
@@ -23805,13 +23821,13 @@ function checkPlanSkills(tasks, lookup2) {
 function checkTaskSkillsEdit(task2, skills, lookup2) {
   return check([{ taskId: task2.id, owner: `Task "${task2.title}"`, ...attached(skills) }], lookup2);
 }
-function subtaskEntries(op, spec, path48 = []) {
+function subtaskEntries(op, spec, path50 = []) {
   const subtasks = spec?.subtasks;
   if (!Array.isArray(subtasks)) return [];
   return subtasks.flatMap((sub, i) => {
     if (typeof sub !== "object" || sub === null) return [];
     const child = sub;
-    const at = [...path48, typeof child.title === "string" && child.title.trim() ? `"${child.title}"` : `#${i + 1}`];
+    const at = [...path50, typeof child.title === "string" && child.title.trim() ? `"${child.title}"` : `#${i + 1}`];
     return [{ op, owner: `subtask ${at.join(" > ")}`, ...attached(child.skills) }, ...subtaskEntries(op, child, at)];
   });
 }
@@ -27681,7 +27697,7 @@ var RUN_SETTING_KEYS = Object.keys(RUN_SETTING_CHECKS);
 function getSettingsPath() {
   const override = process.env.ORDEWELL_SETTINGS_PATH;
   if (override && override.trim()) return override.trim();
-  return path34.join(globalDataDir(), "settings.json");
+  return path35.join(globalDataDir(), "settings.json");
 }
 function readPlannerModels(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
@@ -27761,8 +27777,8 @@ var SettingsService = class {
    * a watch on the old one pointing at nothing.
    */
   watch(listener) {
-    const dir = path34.dirname(this.filePath);
-    const name = path34.basename(this.filePath);
+    const dir = path35.dirname(this.filePath);
+    const name = path35.basename(this.filePath);
     let seen = this.fileStamp();
     let timer;
     let dead = false;
@@ -27771,7 +27787,7 @@ var SettingsService = class {
       fs12.mkdirSync(dir, { recursive: true });
       watcher = fs12.watch(dir, (_event, changed) => {
         if (dead) return;
-        if (changed && changed !== name && changed !== path34.basename(dir)) return;
+        if (changed && changed !== name && changed !== path35.basename(dir)) return;
         clearTimeout(timer);
         timer = setTimeout(() => {
           const stamp2 = this.fileStamp();
@@ -28004,7 +28020,7 @@ var SettingsService = class {
     if (this.unreadable) {
       throw new Error(`Cannot save settings: ${this.filePath} could not be read, so it will not be overwritten. Fix or remove it and try again.`);
     }
-    const dir = path34.dirname(this.filePath);
+    const dir = path35.dirname(this.filePath);
     if (!fs12.existsSync(dir)) {
       fs12.mkdirSync(dir, { recursive: true });
     }
@@ -28606,11 +28622,11 @@ function mergeOutcome(result, branch, group, repaired = []) {
 // src/services/taskDiffRead.ts
 var import_crypto13 = require("crypto");
 var fs13 = __toESM(require("fs"));
-var path35 = __toESM(require("path"));
+var path36 = __toESM(require("path"));
 var import_os3 = require("os");
 var TASK_DIFF_UNAVAILABLE = "Task diff is not available for this run: no task-specific changes were recorded (shared runs cannot attribute workspace changes to one task).";
 function allowedPath(file) {
-  return file.length > 0 && !path35.isAbsolute(file) && !/^[A-Za-z]:/.test(file) && !file.split(/[\\/]/).some((part) => part === ".." || part === ".git" || part === ".ordewell");
+  return file.length > 0 && !path36.isAbsolute(file) && !/^[A-Za-z]:/.test(file) && !file.split(/[\\/]/).some((part) => part === ".." || part === ".git" || part === ".ordewell");
 }
 function stats(raw) {
   return raw.split("\0").flatMap((row) => {
@@ -28619,8 +28635,8 @@ function stats(raw) {
   });
 }
 function inside(root, target) {
-  const rel = path35.relative(root, target);
-  return rel === "" || !rel.startsWith(`..${path35.sep}`) && rel !== ".." && !path35.isAbsolute(rel);
+  const rel = path36.relative(root, target);
+  return rel === "" || !rel.startsWith(`..${path36.sep}`) && rel !== ".." && !path36.isAbsolute(rel);
 }
 function unquoted(quoted4) {
   const bytes = [];
@@ -28668,10 +28684,10 @@ function patchFiles(patch) {
   const sections = patch.toString("utf8").split(/(?<![^\n])(?=diff --git )/).filter((section) => section.startsWith("diff --git "));
   const files = /* @__PURE__ */ new Map();
   for (const section of sections) {
-    const path48 = sectionPath(section);
+    const path50 = sectionPath(section);
     const counts = sectionStats(section);
-    const earlier = files.get(path48);
-    files.set(path48, earlier ? { path: path48, section: earlier.section + section, added: summed(earlier.added, counts.added), removed: summed(earlier.removed, counts.removed) } : { path: path48, section, ...counts });
+    const earlier = files.get(path50);
+    files.set(path50, earlier ? { path: path50, section: earlier.section + section, added: summed(earlier.added, counts.added), removed: summed(earlier.removed, counts.removed) } : { path: path50, section, ...counts });
   }
   return [...files.values()];
 }
@@ -28741,11 +28757,11 @@ async function readTaskDiff(invoker, run, taskId, options) {
         files.push({ ...file, repo: repo.path, patch: () => git(reader, cwd, [...diffArgs, "--", `:(top,literal)${prefix}${file.path}`]) });
       }
       if (live3) {
-        const workspace = path35.join(entry.worktree, prefix);
+        const workspace = path36.join(entry.worktree, prefix);
         const others = await git(reader, workspace, [...common, "ls-files", "--others", "--exclude-standard", "-z", "--", "."]);
         for (const file of others.split("\0").filter((f) => allowed(f))) {
-          const full = path35.join(workspace, file);
-          if (!inside(fs13.realpathSync(workspace), fs13.realpathSync(path35.dirname(full)))) continue;
+          const full = path36.join(workspace, file);
+          if (!inside(fs13.realpathSync(workspace), fs13.realpathSync(path36.dirname(full)))) continue;
           const untracked = async (numstat) => {
             const result = await tryGit(reader, workspace, [...common, "diff", "--no-index", "--no-renames", "--no-ext-diff", "--no-textconv", ...numstat ? ["--numstat", "-z"] : [], "--", import_os3.devNull, file]);
             if (!result.ok && result.code !== 1) throw new Error(result.stderr.trim() || "Could not read an untracked file diff.");
@@ -28775,11 +28791,11 @@ ${await file.patch()}`);
 var import_crypto14 = require("crypto");
 var import_child_process9 = require("child_process");
 var fs15 = __toESM(require("fs"));
-var path37 = __toESM(require("path"));
+var path38 = __toESM(require("path"));
 
 // src/utils/prdStore.ts
 var fs14 = __toESM(require("fs"));
-var path36 = __toESM(require("path"));
+var path37 = __toESM(require("path"));
 var PRD_BLOCK_RE = /<!--\s*ORDEWELL_PRD_START\s+slug="([^"]+)"\s*-->\s*([\s\S]*?)\s*<!--\s*ORDEWELL_PRD_END\s*-->/;
 function extractPrdBlock(text6) {
   const match = PRD_BLOCK_RE.exec(text6);
@@ -28793,9 +28809,9 @@ function sanitizeSlug(raw) {
   return raw.toLowerCase().replace(/[^a-z0-9-_]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
 }
 function savePrdMarkdown(workspace, slug, markdown) {
-  const dir = path36.join(workspace, ".scratch", sanitizeSlug(slug));
+  const dir = path37.join(workspace, ".scratch", sanitizeSlug(slug));
   fs14.mkdirSync(dir, { recursive: true });
-  const file = path36.join(dir, "PRD.md");
+  const file = path37.join(dir, "PRD.md");
   fs14.writeFileSync(file, markdown.endsWith("\n") ? markdown : markdown + "\n", "utf8");
   return file;
 }
@@ -28827,12 +28843,12 @@ var NESTED_REPO_DEPTH = 2;
 var GITLINK_MODE = "160000";
 var READ_ONLY = ["--no-optional-locks", "-c", "core.fsmonitor=false"];
 function isInside(parent, child) {
-  const rel = path37.relative(parent, child);
-  return rel !== "" && !rel.startsWith("..") && !path37.isAbsolute(rel);
+  const rel = path38.relative(parent, child);
+  return rel !== "" && !rel.startsWith("..") && !path38.isAbsolute(rel);
 }
 function resolvesAsNamed(base, p) {
   try {
-    return fs15.realpathSync(p) === path37.join(fs15.realpathSync(base), path37.relative(base, p));
+    return fs15.realpathSync(p) === path38.join(fs15.realpathSync(base), path38.relative(base, p));
   } catch {
     return false;
   }
@@ -28887,7 +28903,7 @@ function sameDir(a, b) {
     try {
       return fs15.realpathSync.native(p);
     } catch {
-      return path37.resolve(p);
+      return path38.resolve(p);
     }
   };
   return real(a) === real(b);
@@ -28909,7 +28925,7 @@ function clearImmutableFlags(platform, dir) {
   (0, import_child_process9.spawnSync)("/usr/bin/chflags", ["-R", "nouchg", dir], { stdio: "ignore" });
 }
 function leftoverLinks(dir) {
-  const named3 = listDir2(dir).filter((name) => LINKED_ARTIFACTS.has(name) || isEnvFile(name) || isLink(path37.join(dir, name)));
+  const named3 = listDir2(dir).filter((name) => LINKED_ARTIFACTS.has(name) || isEnvFile(name) || isLink(path38.join(dir, name)));
   return [.../* @__PURE__ */ new Set([...named3, ...installDirs(dir)])];
 }
 function isLink(target) {
@@ -28982,7 +28998,7 @@ var GitWorktreeIsolation = class {
       const head = await this.headOf(root);
       const repo = { path: repoPath, head };
       if (scan.toplevel !== void 0) {
-        const top = path37.relative(workspaceRoot, scan.toplevel).split(path37.sep).join("/");
+        const top = path38.relative(workspaceRoot, scan.toplevel).split(path38.sep).join("/");
         if (top !== "") repo.top = top;
       }
       if (enabled && (head.kind === "branch" || head.kind === "detached")) {
@@ -29039,9 +29055,9 @@ var GitWorktreeIsolation = class {
   async nestedRepos(workspaceRoot, toplevel) {
     const found = [];
     const walk = (rel, depth) => {
-      for (const name of childDirs(path37.join(workspaceRoot, rel))) {
+      for (const name of childDirs(path38.join(workspaceRoot, rel))) {
         const child = rel ? `${rel}/${name}` : name;
-        if (hasGitEntry(path37.join(workspaceRoot, child))) found.push(child);
+        if (hasGitEntry(path38.join(workspaceRoot, child))) found.push(child);
         else if (depth < NESTED_REPO_DEPTH) walk(child, depth + 1);
       }
     };
@@ -29059,7 +29075,7 @@ var GitWorktreeIsolation = class {
       const [meta, file] = entry.split("	");
       if (file !== void 0 && meta.startsWith(`${GITLINK_MODE} `)) paths.add(file);
     }
-    const declared = await this.tryGit(workspaceRoot, ["config", "-z", "-f", path37.join(toplevel, ".gitmodules"), "--get-regexp", "^submodule\\..*\\.path$"]);
+    const declared = await this.tryGit(workspaceRoot, ["config", "-z", "-f", path38.join(toplevel, ".gitmodules"), "--get-regexp", "^submodule\\..*\\.path$"]);
     for (const entry of declared.stdout.split("\0")) {
       const value = entry.split("\n")[1];
       if (value) paths.add(value.replace(/\/+$/, ""));
@@ -29117,7 +29133,7 @@ var GitWorktreeIsolation = class {
   async acceptsWorktree(run, repo) {
     const dir = this.integrationDir(run, repo);
     ensureStateDirIgnored(run.workspaceRoot);
-    fs15.mkdirSync(path37.dirname(dir), { recursive: true });
+    fs15.mkdirSync(path38.dirname(dir), { recursive: true });
     const added = await this.tryGit(repo.root, ["worktree", "add", "-q", "--no-checkout", dir, repo.integrationBranch]);
     await this.removeWorktreeDir(run, repo, dir, []);
     return added.ok;
@@ -29132,12 +29148,12 @@ var GitWorktreeIsolation = class {
     if (isolated.includes(SELF_REPO)) return [];
     const shared2 = [];
     const walk = (rel) => {
-      for (const name of listDir2(path37.join(workspaceRoot, rel))) {
+      for (const name of listDir2(path38.join(workspaceRoot, rel))) {
         if (!rel && (name === STATE_DIR || name === ".git")) continue;
         const child = rel ? `${rel}/${name}` : name;
         if (isolated.includes(child)) continue;
         if (isolated.some((p) => p.startsWith(`${child}/`))) walk(child);
-        else if (resolves(path37.join(workspaceRoot, child))) shared2.push(child);
+        else if (resolves(path38.join(workspaceRoot, child))) shared2.push(child);
       }
     };
     walk("");
@@ -29177,9 +29193,9 @@ var GitWorktreeIsolation = class {
       try {
         ensureStateDirIgnored(run.workspaceRoot);
         for (const repo of run.repos) {
-          const worktree = path37.join(dir, repo.path);
+          const worktree = path38.join(dir, repo.path);
           const tip = (await this.git(repo.root, ["rev-parse", repo.integrationBranch])).trim();
-          fs15.mkdirSync(path37.dirname(worktree), { recursive: true });
+          fs15.mkdirSync(path38.dirname(worktree), { recursive: true });
           await this.git(repo.root, ["worktree", "add", "-q", "-B", branch, worktree, tip]);
           record.repos[repo.path] = { worktree, linked: [], baseRef: tip };
         }
@@ -29204,13 +29220,13 @@ var GitWorktreeIsolation = class {
             setupFailed.push({ repo: repo.path, detail: err.detail });
           }
           entry.linked = boot.linked;
-          copied.push(...boot.copied.map((name) => path37.posix.join(repo.path, name)));
+          copied.push(...boot.copied.map((name) => path38.posix.join(repo.path, name)));
         }
         for (const rel of run.shared) {
-          const source = path37.join(run.workspaceRoot, rel);
-          const target = path37.join(cwd, rel);
+          const source = path38.join(run.workspaceRoot, rel);
+          const target = path38.join(cwd, rel);
           if (!resolves(source) || lexists(target)) continue;
-          fs15.mkdirSync(path37.dirname(target), { recursive: true });
+          fs15.mkdirSync(path38.dirname(target), { recursive: true });
           if (linkPath(source, target, this.platform) === "copy") copied.push(rel);
           const entry = self ? record.repos[SELF_REPO] : void 0;
           if (entry) entry.linked.push(rel);
@@ -29242,7 +29258,7 @@ var GitWorktreeIsolation = class {
    */
   async clearLeftovers(run, task2, names) {
     const removal = noRemoval();
-    const holder = Object.values(run.tasks).find((r) => r.taskId !== task2.id && (r.branch === names.branch || path37.resolve(r.workspace) === path37.resolve(names.dir) || isInside(r.workspace, names.dir)));
+    const holder = Object.values(run.tasks).find((r) => r.taskId !== task2.id && (r.branch === names.branch || path38.resolve(r.workspace) === path38.resolve(names.dir) || isInside(r.workspace, names.dir)));
     if (holder) throw new Error(`Its worktree path or branch is held by the record of task ${holder.order} (${holder.title}); Ordewell will not remove it`);
     const found = [];
     for (const repo of run.repos) {
@@ -29252,14 +29268,14 @@ var GitWorktreeIsolation = class {
         worktree: /^worktree (.+)$/m.exec(block)?.[1],
         branch: /^branch refs\/heads\/(.+)$/m.exec(block)?.[1]
       }));
-      const at = /* @__PURE__ */ new Set([path37.join(names.dir, repo.path)]);
+      const at = /* @__PURE__ */ new Set([path38.join(names.dir, repo.path)]);
       for (const entry of registered) {
-        if (entry.worktree && entry.branch === names.branch && isInside(this.runRoot(run), path37.resolve(entry.worktree))) at.add(entry.worktree);
+        if (entry.worktree && entry.branch === names.branch && isInside(this.runRoot(run), path38.resolve(entry.worktree))) at.add(entry.worktree);
       }
-      const base = { branch: names.branch, name: path37.basename(names.dir), title: task2.title };
+      const base = { branch: names.branch, name: path38.basename(names.dir), title: task2.title };
       for (const worktree of at) {
         if (!fs15.existsSync(worktree)) continue;
-        const linked = leftoverLinks(path37.join(worktree, await this.prefixOf(repo)));
+        const linked = leftoverLinks(path38.join(worktree, await this.prefixOf(repo)));
         found.push({ repo, worktree, target: { ...base, worktree, linked } });
       }
       found.push({ repo, worktree: names.dir, target: { ...base, linked: [] } });
@@ -29352,7 +29368,7 @@ var GitWorktreeIsolation = class {
    */
   async inWorkspacePlace(repo, worktree) {
     const prefix = await this.prefixOf(repo);
-    return prefix ? path37.join(worktree, prefix) : worktree;
+    return prefix ? path38.join(worktree, prefix) : worktree;
   }
   async prefixOf(repo) {
     return (await this.git(repo.root, ["rev-parse", "--show-prefix"])).trim();
@@ -29882,15 +29898,15 @@ var GitWorktreeIsolation = class {
     return landingMessage(kind, from, this.deps.plannedWith?.() ?? false);
   }
   integrationDir(run, repo) {
-    return path37.join(this.runRoot(run), INTEGRATION_DIR, repo.path);
+    return path38.join(this.runRoot(run), INTEGRATION_DIR, repo.path);
   }
   async ensureIntegrationWorktree(run, repo) {
     return this.admin(run.workspaceRoot, async () => {
       const dir = this.integrationDir(run, repo);
-      if (fs15.existsSync(path37.join(dir, ".git"))) return dir;
+      if (fs15.existsSync(path38.join(dir, ".git"))) return dir;
       await this.tryGit(repo.root, ["worktree", "prune"]);
       ensureStateDirIgnored(run.workspaceRoot);
-      fs15.mkdirSync(path37.dirname(dir), { recursive: true });
+      fs15.mkdirSync(path38.dirname(dir), { recursive: true });
       await this.git(repo.root, ["worktree", "add", "-q", dir, repo.integrationBranch]);
       return dir;
     });
@@ -29913,7 +29929,7 @@ var GitWorktreeIsolation = class {
     const removal = noRemoval();
     for (const repo of opts.preserve === false || record.readOnly ? [] : run.repos) {
       const entry = record.repos[repo.path];
-      const target = { worktree: entry?.worktree, linked: entry?.linked ?? [], branch: record.branch, name: path37.basename(record.workspace), title: record.title, commit: record.commit };
+      const target = { worktree: entry?.worktree, linked: entry?.linked ?? [], branch: record.branch, name: path38.basename(record.workspace), title: record.title, commit: record.commit };
       try {
         const kept = await this.preserve(run, repo, target, opts.intent);
         if (kept) removal.preserved.push({ task: task2, ...kept });
@@ -29994,7 +30010,7 @@ var GitWorktreeIsolation = class {
       return;
     }
     for (const entry of entries) {
-      const target = path37.join(dir, entry.name);
+      const target = path38.join(dir, entry.name);
       if (entry.isSymbolicLink()) this.unlinkIfLink(target);
       else if (entry.isDirectory()) this.unlinkLinksUnder(target);
     }
@@ -30016,20 +30032,20 @@ var GitWorktreeIsolation = class {
         return false;
       }
     };
-    const owned = new Set(Object.values(run.tasks).map((r) => path37.resolve(r.workspace)));
+    const owned = new Set(Object.values(run.tasks).map((r) => path38.resolve(r.workspace)));
     const root = this.runRoot(run);
     if (fs15.existsSync(root)) {
       for (const entry of fs15.readdirSync(root)) {
-        const dir = path37.join(root, entry);
-        if (entry === INTEGRATION_DIR || owned.has(path37.resolve(dir))) continue;
+        const dir = path38.join(root, entry);
+        if (entry === INTEGRATION_DIR || owned.has(path38.resolve(dir))) continue;
         let kept = true;
         for (const repo of run.repos) {
-          const worktree = path37.join(dir, repo.path);
-          const linked = leftoverLinks(path37.join(worktree, await this.prefixOf(repo)));
+          const worktree = path38.join(dir, repo.path);
+          const linked = leftoverLinks(path38.join(worktree, await this.prefixOf(repo)));
           if (!await keep2(repo, { worktree, linked, branch: null, name: entry, title: entry }, worktree)) kept = false;
         }
         if (!kept) continue;
-        for (const repo of run.repos) await this.removeWorktreeDir(run, repo, path37.join(dir, repo.path), []);
+        for (const repo of run.repos) await this.removeWorktreeDir(run, repo, path38.join(dir, repo.path), []);
         this.removeTaskWorkspace(run, dir);
       }
     }
@@ -30047,13 +30063,13 @@ var GitWorktreeIsolation = class {
   }
   async removeWorktreeDir(run, repo, dir, linked) {
     for (const name of /* @__PURE__ */ new Set([...linked, ...installDirs(dir)])) {
-      const target = path37.join(dir, name);
-      if (!resolvesAsNamed(this.runRoot(run), path37.dirname(target))) continue;
+      const target = path38.join(dir, name);
+      if (!resolvesAsNamed(this.runRoot(run), path38.dirname(target))) continue;
       this.unlinkIfLink(target);
       this.unlinkLinksUnder(target);
     }
     for (const name of resolvesAsNamed(this.runRoot(run), dir) ? fs15.readdirSync(dir) : []) {
-      if (LINKED_ARTIFACTS.has(name) || isEnvFile(name)) this.unlinkIfLink(path37.join(dir, name));
+      if (LINKED_ARTIFACTS.has(name) || isEnvFile(name)) this.unlinkIfLink(path38.join(dir, name));
     }
     await this.tryGit(repo.root, ["worktree", "remove", "--force", dir]);
     if (fs15.existsSync(dir) && isInside(this.runRoot(run), dir)) {
@@ -30061,7 +30077,7 @@ var GitWorktreeIsolation = class {
       fs15.rmSync(dir, { recursive: true, force: true });
     }
     await this.tryGit(repo.root, ["worktree", "prune"]);
-    for (let parent = path37.dirname(dir); isInside(this.runRoot(run), parent); parent = path37.dirname(parent)) this.removeIfEmpty(parent);
+    for (let parent = path38.dirname(dir); isInside(this.runRoot(run), parent); parent = path38.dirname(parent)) this.removeIfEmpty(parent);
   }
   unlinkIfLink(target) {
     try {
@@ -30076,14 +30092,14 @@ var GitWorktreeIsolation = class {
     }
   }
   runRoot(run) {
-    return path37.join(run.workspaceRoot, STATE_DIR, "worktrees", run.id);
+    return path38.join(run.workspaceRoot, STATE_DIR, "worktrees", run.id);
   }
   namesFor(run, task2) {
     const slug = sanitizeSlug(task2.title).slice(0, 40).replace(/-+$/, "") || "task";
     let name = `${task2.order}-${slug}`;
     const clash = Object.values(run.tasks).some((r) => r.taskId !== task2.id && r.branch === `ordewell/${run.id}/${name}`);
     if (clash) name = `${name}-${sanitizeSlug(task2.id) || "x"}`;
-    return { branch: `ordewell/${run.id}/${name}`, dir: path37.join(this.runRoot(run), name) };
+    return { branch: `ordewell/${run.id}/${name}`, dir: path38.join(this.runRoot(run), name) };
   }
   async unmergedPaths(cwd) {
     const listed3 = await this.tryGit(cwd, ["diff", "--name-only", "-z", "--diff-filter=U"]);
@@ -30097,7 +30113,7 @@ var GitWorktreeIsolation = class {
   async rebaseInProgress(cwd) {
     for (const dir of ["rebase-merge", "rebase-apply"]) {
       const found = await this.tryGit(cwd, ["rev-parse", "--git-path", dir]);
-      if (found.ok && fs15.existsSync(path37.resolve(cwd, found.stdout.trim()))) return true;
+      if (found.ok && fs15.existsSync(path38.resolve(cwd, found.stdout.trim()))) return true;
     }
     return false;
   }
@@ -30171,6 +30187,29 @@ function describeIsolationPreview(preview) {
   }
 }
 
+// src/services/repositoryRunnerConfig.ts
+var RUNNER_CONFIG_ROOTS = [".mcp.json", ".claude", ".claude-plugin", "opencode.json", "opencode.jsonc", ".opencode", ".codex"];
+function repositoryRunnerConfigPaths(paths) {
+  return [...new Set(paths.filter(
+    (path50) => (
+      // Project MCP servers start commands or send data to a repository-chosen URL.
+      path50 === ".mcp.json" || // Settings can run hooks and helpers, load plugins, or redirect traffic.
+      path50 === ".claude/settings.json" || // Local settings have the same execution capabilities as project settings.
+      path50 === ".claude/settings.local.json" || // Hook files provide commands invoked by the runner.
+      path50.startsWith(".claude/hooks/") || // Plugin files can provide code and hooks loaded by the runner.
+      path50.startsWith(".claude/plugins/") || // Plugin metadata can load plugins and their executable components.
+      path50.startsWith(".claude-plugin/") || // Plugin and marketplace manifests can select code for the runner to load.
+      /^\.claude\/(?:[^/]+\/)*(?:plugin|marketplace)\.json$/.test(path50) || // OpenCode config declares MCP servers and plugins; its plugin and tool
+      // directories are code it loads, and an agent definition sets the prompt,
+      // model and permissions of the built-in agent its id names, which a task
+      // launches with. The rest of `.opencode/` is dependencies OpenCode
+      // installs itself, which a later launch must not be held for.
+      /^(?:\.opencode\/)?opencode\.jsonc?$/.test(path50) || /^\.opencode\/(?:plugins?|tools?|agents?)\//.test(path50) || // Codex project config carries MCP servers, hooks and `notify` commands.
+      path50.startsWith(".codex/")
+    )
+  ))].sort();
+}
+
 // src/services/mergeWording.ts
 function isRepoGroup(handoff) {
   return handoff.repos.some((r) => r.path !== ".");
@@ -30205,7 +30244,7 @@ function handoffBaseLine(handoff, length) {
   return handoff.repos.map((repo) => `${group ? `${repo.path}: ` : ""}${repoBaseLine(repo, length)}`).join(", ");
 }
 function repoResultLines(handoff) {
-  return handoff.repos.map(({ path: path48, landed: landed2 }) => `${path48}: ${landed2.length === 0 ? "nothing to merge" : `${landed2.length} task${landed2.length === 1 ? "" : "s"} landed`}`);
+  return handoff.repos.map(({ path: path50, landed: landed2 }) => `${path50}: ${landed2.length === 0 ? "nothing to merge" : `${landed2.length} task${landed2.length === 1 ? "" : "s"} landed`}`);
 }
 
 // src/interfaces/ILogger.ts
@@ -33264,6 +33303,7 @@ var IsolationRunController = class {
   /** Resolver task id → the conflicted task it resolves; see {@link linkResolver}. */
   resolvers = {};
   opening = null;
+  opened = 0;
   /** Bumped by an interrupt, so an activation in flight across it does not open the run it ended. */
   activations = 0;
   /** The start a dirty tree turned away, handed back once the user chooses how to go on. */
@@ -33295,6 +33335,10 @@ var IsolationRunController = class {
   get isOpen() {
     return this.mode !== null;
   }
+  /** How many runs have opened: what tells one run's launches from the next one's. */
+  get epoch() {
+    return this.opened;
+  }
   /** The open run has decided whether it isolates. */
   get decided() {
     return this.mode === "isolated" || this.mode === "shared";
@@ -33392,6 +33436,7 @@ var IsolationRunController = class {
   open() {
     if (this.mode) return;
     this.mode = "undecided";
+    this.opened += 1;
   }
   /**
    * Decide once per run, as its first change task starts, whether it executes
@@ -34391,7 +34436,7 @@ function heldFrom(state) {
 }
 
 // src/services/Attempts.ts
-var path40 = __toESM(require("path"));
+var path42 = __toESM(require("path"));
 
 // src/services/VerdictEngine.ts
 var IDLE_TIMEOUT_MS = 10 * 6e4;
@@ -34779,10 +34824,132 @@ function reportedVerdict(report) {
   return { outcome: "fail", reason: `The runner reported the task ${report.status}: ${why}`, checks, decidedAt, reported };
 }
 
+// src/services/taskStartConfig.ts
+var path39 = __toESM(require("path"));
+var import_crypto15 = require("crypto");
+var import_fs13 = require("fs");
+var MAX_FILES = 2e3;
+var MAX_DEPTH = 8;
+function liveConfig(dir) {
+  const found = /* @__PURE__ */ new Map();
+  const visit = (rel, depth) => {
+    if (found.size >= MAX_FILES || depth > MAX_DEPTH) return;
+    const full = path39.join(dir, rel);
+    try {
+      const info = (0, import_fs13.statSync)(full);
+      if (info.isFile()) {
+        found.set(rel, (0, import_crypto15.createHash)("sha1").update((0, import_fs13.readFileSync)(full)).digest("hex"));
+      } else if (info.isDirectory() && path39.basename(rel) !== "node_modules") {
+        for (const name of (0, import_fs13.readdirSync)(full)) visit(path39.posix.join(rel, name), depth + 1);
+      }
+    } catch {
+    }
+  };
+  for (const root of RUNNER_CONFIG_ROOTS) visit(root, 0);
+  const selected = new Set(repositoryRunnerConfigPaths([...found.keys()]));
+  return new Map([...found].filter(([name]) => selected.has(name)));
+}
+function linkedRoots(dir) {
+  const linked = /* @__PURE__ */ new Set();
+  for (const root of RUNNER_CONFIG_ROOTS) {
+    try {
+      if ((0, import_fs13.lstatSync)(path39.join(dir, root)).isSymbolicLink()) linked.add(root);
+    } catch {
+    }
+  }
+  return linked;
+}
+function readDirs(root) {
+  const dirs = [{ dir: root, prefix: "" }];
+  for (let dir = root, prefix = ""; !(0, import_fs13.existsSync)(path39.join(dir, ".git")); ) {
+    const parent = path39.dirname(dir);
+    if (parent === dir) return [dirs[0]];
+    dir = parent;
+    prefix += "../";
+    dirs.push({ dir, prefix });
+  }
+  return dirs;
+}
+var TaskStartConfig = class {
+  live = /* @__PURE__ */ new Map();
+  /**
+   * `epoch` names the run the check belongs to; a new run takes a new
+   * baseline. `root` is the workspace root, the checkout a worktree run lands
+   * in; `cwd` is where the runner starts, and `worktree` whether that is a
+   * worktree prepared for it.
+   */
+  async check(run, taskId, where) {
+    const found = where.worktree ? await this.gitDifferences(run, taskId) : [];
+    const id2 = String(where.epoch);
+    const checkout = readDirs(where.root).flatMap(({ dir, prefix }) => this.liveDifferences(`${id2}:checkout:${dir}`, dir).map((name) => `${prefix}${name}`));
+    if (!where.worktree) found.push(...checkout);
+    else {
+      const cwd = where.cwd ?? run?.tasks[taskId]?.workspace;
+      if (cwd) found.push(...this.worktreeDifferences(id2, cwd, where.root));
+    }
+    return [...new Set(found)].sort();
+  }
+  /** The baselines go with the plan they belong to. */
+  clear() {
+    this.live.clear();
+  }
+  /**
+   * What a worktree's runner reads that differs from where the run started.
+   * The `.claude` and `.opencode` directories it links from the checkout are
+   * the checkout's own, so they are compared with the checkout's first state,
+   * which an earlier task's write there does not move. Anything else is the
+   * worktree's, and is compared with its own first state: a setup command's
+   * files are trusted, and a task's later write is not.
+   */
+  worktreeDifferences(id2, dir, root) {
+    const now = liveConfig(dir);
+    const linked = linkedRoots(dir);
+    const fromCheckout = (name) => linked.has(name.split("/")[0]);
+    const key = `${id2}:worktree:${dir}`;
+    let local = this.live.get(key);
+    if (!local) {
+      local = new Map([...now].filter(([name]) => !fromCheckout(name)));
+      this.live.set(key, local);
+    }
+    const checkout = this.live.get(`${id2}:checkout:${root}`);
+    return [...now].filter(([name, hash]) => fromCheckout(name) ? checkout?.get(name) !== hash : local.get(name) !== hash).map(([name]) => name);
+  }
+  liveDifferences(key, dir) {
+    const now = liveConfig(dir);
+    const before = this.live.get(key);
+    if (!before) {
+      this.live.set(key, now);
+      return [];
+    }
+    return [...now].filter(([name, hash]) => before.get(name) !== hash).map(([name]) => name);
+  }
+  async gitDifferences(run, taskId) {
+    if (!run) return [];
+    const invoker = { exec: defaultExecFile2, resolvePath: augmentedPath };
+    const found = [];
+    for (const repo of run.repos) {
+      const cwd = run.tasks[taskId]?.repos[repo.path]?.worktree;
+      if (!cwd || !repo.baseRef || !(0, import_fs13.existsSync)(cwd)) continue;
+      const prefix = repo.path === "." ? (await tryGit(invoker, repo.root, ["rev-parse", "--show-prefix"])).stdout.trim() : "";
+      const roots = [...RUNNER_CONFIG_ROOTS, ...prefix ? RUNNER_CONFIG_ROOTS.map((r) => `${prefix}${r}`) : []];
+      const diff = await tryGit(invoker, cwd, ["diff", "--no-ext-diff", "--no-textconv", "--no-renames", "--name-only", "--diff-filter=ACMRTU", "-z", repo.baseRef, "--"]);
+      const untracked = await tryGit(invoker, cwd, ["ls-files", "--others", "-z", "--", ...roots]);
+      if (!diff.ok || !untracked.ok) continue;
+      for (const name of [...diff.stdout.split("\0"), ...untracked.stdout.split("\0")]) {
+        const here = prefix && name.startsWith(prefix) ? name.slice(prefix.length) : void 0;
+        if (repositoryRunnerConfigPaths([name]).length || here !== void 0 && repositoryRunnerConfigPaths([here]).length) {
+          found.push(repo.path === "." ? name : path39.posix.join(repo.path, name));
+        }
+      }
+    }
+    return found;
+  }
+};
+
 // src/services/ScriptRunner.ts
 var import_child_process11 = require("child_process");
 var fs16 = __toESM(require("fs"));
-var path38 = __toESM(require("path"));
+var path40 = __toESM(require("path"));
 var import_events2 = require("events");
 var import_string_decoder2 = require("string_decoder");
 
@@ -34923,7 +35090,7 @@ var ScriptSession = class extends AbstractRunnerSession {
   async launchOf(step) {
     if ("argv" in step) {
       const [named3, ...args] = step.argv;
-      const program = this.setup.platform === "win32" && path38.win32.basename(named3) !== named3 && !path38.win32.isAbsolute(named3) ? path38.win32.resolve(this.setup.cwd, named3) : named3;
+      const program = this.setup.platform === "win32" && path40.win32.basename(named3) !== named3 && !path40.win32.isAbsolute(named3) ? path40.win32.resolve(this.setup.cwd, named3) : named3;
       const plan = await planDirectLaunch(program, args, this.setup.launch);
       return { file: plan.file, args: plan.args, shell: false, ...plan.verbatim ? { verbatim: true } : {} };
     }
@@ -35156,10 +35323,10 @@ function passed(status) {
 }
 
 // src/services/PatchCapture.ts
-var import_crypto15 = require("crypto");
+var import_crypto16 = require("crypto");
 var fs17 = __toESM(require("fs"));
 var os10 = __toESM(require("os"));
-var path39 = __toESM(require("path"));
+var path41 = __toESM(require("path"));
 
 // src/services/readTask.ts
 function readTask2(args, readerId, plan, log) {
@@ -35426,7 +35593,7 @@ function linkInPatch(patch) {
 function readOwn(scratch, name, max) {
   let fd;
   try {
-    fd = fs17.openSync(path39.join(scratch, name), fs17.constants.O_RDONLY | (fs17.constants.O_NOFOLLOW ?? 0));
+    fd = fs17.openSync(path41.join(scratch, name), fs17.constants.O_RDONLY | (fs17.constants.O_NOFOLLOW ?? 0));
   } catch (err) {
     throw new Refusal(`the capture left no ${name.split(".").pop()} Ordewell could read (${err.code ?? String(err)})`);
   }
@@ -35463,8 +35630,8 @@ async function captureHeld(runs, opts, signal) {
   if (!runs.touched) return { kind: "empty", reason: "no command of this task has run sealed, so its worktree holds only what Ordewell checked out.", flags: [] };
   const [worktree] = runs.worktrees;
   const scratch = runs.scratch;
-  const tag = `ordewell-patch-${(0, import_crypto15.randomBytes)(8).toString("hex")}`;
-  const stem = path39.join(scratch, tag);
+  const tag = `ordewell-patch-${(0, import_crypto16.randomBytes)(8).toString("hex")}`;
+  const stem = path41.join(scratch, tag);
   const own = (suffix, max = LISTING_BYTES) => readOwn(scratch, `${tag}.${suffix}`, max);
   try {
     const stage = await runs.run(stageScript(stem, opts.linked ?? []), worktree);
@@ -35502,7 +35669,7 @@ async function captureHeld(runs, opts, signal) {
     return {
       kind: "saved",
       patch,
-      stats: { base, ...countedIn(patch), bytes: patch.length, sha256: (0, import_crypto15.createHash)("sha256").update(patch).digest("hex"), flags: [...flags, ...flag("normalized", normalized2)] }
+      stats: { base, ...countedIn(patch), bytes: patch.length, sha256: (0, import_crypto16.createHash)("sha256").update(patch).digest("hex"), flags: [...flags, ...flag("normalized", normalized2)] }
     };
   } catch (err) {
     if (err instanceof Refusal) return { kind: "refused", reason: `${err.message}.` };
@@ -35556,8 +35723,8 @@ async function indexEntries(invoker, worktree) {
   return entries;
 }
 async function trialApply(invoker, worktree, patchFile, scratch) {
-  const index = path39.resolve(worktree, (await git(invoker, worktree, [...APPLY_GIT, "rev-parse", "--git-path", "index"])).trim());
-  const copy = path39.join(scratch, "index");
+  const index = path41.resolve(worktree, (await git(invoker, worktree, [...APPLY_GIT, "rev-parse", "--git-path", "index"])).trim());
+  const copy = path41.join(scratch, "index");
   fs17.copyFileSync(index, copy);
   const trial = { ...invoker, exec: (file, args, opts) => invoker.exec(file, args, { ...opts, env: { ...opts.env, GIT_INDEX_FILE: copy } }) };
   const tried = await tryGit(trial, worktree, [...APPLY_GIT, "apply", "--cached", "--3way", "--whitespace=nowarn", patchFile]);
@@ -35577,7 +35744,7 @@ function gitRefused(lead, stderr) {
 function onDisk3(worktree, names) {
   return names.map((name) => {
     try {
-      const stat = fs17.lstatSync(path39.join(worktree, name), { bigint: true, throwIfNoEntry: false });
+      const stat = fs17.lstatSync(path41.join(worktree, name), { bigint: true, throwIfNoEntry: false });
       return stat ? `${stat.mode} ${stat.ino} ${stat.size} ${stat.mtimeNs} ${stat.ctimeNs}` : "none";
     } catch (err) {
       return err.code ?? "unreadable";
@@ -35617,7 +35784,7 @@ function leavesWorktree(worktree, names, linked, held2, left) {
       if (i < parts.length && held2.get(at)?.some((entry) => entry.mode === SUBMODULE)) {
         return `the patch writes ${name}, under ${at}, a submodule, whose files are another repository's.`;
       }
-      const full = path39.join(worktree, ...parts.slice(0, i));
+      const full = path41.join(worktree, ...parts.slice(0, i));
       const stat = fs17.lstatSync(full, { throwIfNoEntry: false });
       if (!stat) break;
       const last = i === parts.length;
@@ -35638,14 +35805,14 @@ async function applyPatch(invoker, worktree, patch, saved, opts = {}) {
   if (patch.length !== saved.bytes) {
     return refused4(`the patch is ${byteSize(patch.length)} where its artifact says ${byteSize(saved.bytes)}, so it was cut short or changed after it was saved.`);
   }
-  if ((0, import_crypto15.createHash)("sha256").update(patch).digest("hex") !== saved.sha256) {
+  if ((0, import_crypto16.createHash)("sha256").update(patch).digest("hex") !== saved.sha256) {
     return refused4("the patch is not the file that was saved: its hash is not the one its artifact records, so it was changed after it was saved.");
   }
   const link = linkInPatch(patch);
   if (link !== void 0) {
     return refused4(`the patch holds a link or a submodule (${JSON.stringify(link.slice(0, 80))}), which a saved patch never does, so it is not one that was saved.`);
   }
-  const dir = fs17.mkdtempSync(path39.join(os10.tmpdir(), "ordewell-apply-"));
+  const dir = fs17.mkdtempSync(path41.join(os10.tmpdir(), "ordewell-apply-"));
   try {
     const toplevel = (await git(invoker, worktree, [...APPLY_GIT, "rev-parse", "--show-toplevel"])).trim();
     if (fs17.realpathSync(toplevel) !== fs17.realpathSync(worktree)) return refused4(`${worktree} is not the root of a worktree of its own.`);
@@ -35655,7 +35822,7 @@ async function applyPatch(invoker, worktree, patch, saved, opts = {}) {
     }
     const before = await unmergedPaths(invoker, worktree);
     if (before.length > 0) return refused4(`your worktree still has unresolved conflicts (${listed(before.slice(0, 10))}${before.length > 10 ? `, +${before.length - 10} more` : ""}). Resolve them and git add them, or undo them, then apply the patch.`);
-    const file = path39.join(dir, "saved.patch");
+    const file = path41.join(dir, "saved.patch");
     fs17.writeFileSync(file, patch, { flag: "wx", mode: 384 });
     const held2 = await indexEntries(invoker, worktree);
     const named3 = await pathsNamed(invoker, worktree, file);
@@ -35805,6 +35972,11 @@ var TaskWebReader = class {
 };
 
 // src/services/Attempts.ts
+var TaskStartConfigError = class extends Error {
+  constructor(paths) {
+    super(`repository configuration ${paths.map((p) => JSON.stringify(p)).join(", ")} differs from where this run started; remove it to continue, or start a new run once your branch holds it`);
+  }
+};
 var DEFAULT_GIT = { exec: defaultExecFile2, resolvePath: () => augmentedPath() };
 var Attempts = class {
   constructor(deps) {
@@ -35836,6 +36008,7 @@ var Attempts = class {
   live = /* @__PURE__ */ new Map();
   /** Bumped by every plan load: an ended attempt's wind-down belongs to the scope before it. */
   planScope = 0;
+  startConfig = new TaskStartConfig();
   /** Each task's runners still winding down once stopped: a continue waits for them (ADR-0018, L1). */
   windDowns = /* @__PURE__ */ new Map();
   /**
@@ -36005,6 +36178,7 @@ var Attempts = class {
     const ended = this.endAll("load");
     this.planScope += 1;
     this.spawnCounts.clear();
+    this.startConfig.clear();
     return ended;
   }
   /** A task leaving the plan: no later attempt of it is numbered from its runs. */
@@ -36137,9 +36311,17 @@ var Attempts = class {
         if (unavailable2) throw new Error(unavailable2);
       }
       if (kind.kind === "continuation") await this.windDowns.get(task2.id);
+      if (!attempt.script && kind.kind === "repair") {
+        const paths = await this.startConfig.check(runs.current, task2.id, { epoch: runs.epoch, root: this.deps.workspaceRoot(), cwd: null, worktree: true });
+        if (paths.length) throw new TaskStartConfigError(paths);
+      }
       const { cwd, worktree, previousWork, workspace } = await attemptCwd(kind, task2, runs);
       attempt.cwd = cwd;
       attempt.worktree = worktree;
+      if (!attempt.script && kind.kind !== "repair" && !landsNothing(kind)) {
+        const paths = await this.startConfig.check(runs.current, task2.id, { epoch: runs.epoch, root: this.deps.workspaceRoot(), cwd, worktree });
+        if (paths.length) throw new TaskStartConfigError(paths);
+      }
       if (checksTree(kind)) attempt.snapshot = await runs.snapshotWorkspace();
       if (this.live.get(task2.id) !== attempt) {
         if (attempt.worktree && !this.live.has(task2.id) && !this.host.completing(task2.id)) await runs.release(task2.id, { keep: kind.kind === "repair" });
@@ -36222,6 +36404,9 @@ var Attempts = class {
       return { kind: "usage-limited", taskId: task2.id, attempt, said: { message }, output: "" };
     }
     const failed = (failure2) => ({ kind: "spawn-failed", task: task2, attempt, failure: failure2 });
+    if (err instanceof TaskStartConfigError) {
+      return failed({ leaves: "held", hold: err.message, preserveWorktree: true, settles: false, notice: { level: "warn", text: `Task "${task2.title}" is on hold: ${err.message}` } });
+    }
     if (attempt.kind.kind === "continuation" && !attachTimeout) {
       const refused4 = err instanceof RunnerStartupExit;
       const reason = unresumedMessage(task2, refused4 ? `${attempt.runner} could not find its saved session` : `could not start: ${message}`);
@@ -36358,9 +36543,9 @@ var Attempts = class {
     const repos = Object.values(this.deps.runs.openRecord(taskId)?.repos ?? {});
     if (repos.length !== 1 || cwd === null) return [];
     const [{ worktree, linked }] = repos;
-    const prefix = path40.relative(worktree, cwd).split(path40.sep).join("/");
-    if (prefix.startsWith("..") || path40.isAbsolute(prefix)) return [];
-    return linked.map((name) => (prefix ? `${prefix}/${name}` : name).split(path40.sep).join("/"));
+    const prefix = path42.relative(worktree, cwd).split(path42.sep).join("/");
+    if (prefix.startsWith("..") || path42.isAbsolute(prefix)) return [];
+    return linked.map((name) => (prefix ? `${prefix}/${name}` : name).split(path42.sep).join("/"));
   }
   /**
    * A script task's start (ADR-0035): its body as the plan holds it now, run
@@ -36398,7 +36583,7 @@ var Attempts = class {
       this.deps.notifications.warn(message);
     };
     if (resolved.blockedEnvrc) {
-      warn(`blocked:${resolved.blockedEnvrc}`, `direnv has blocked ${resolved.blockedEnvrc}, so tasks start without its variables. Run \`direnv allow\` in ${path40.dirname(resolved.blockedEnvrc)} to use them.`);
+      warn(`blocked:${resolved.blockedEnvrc}`, `direnv has blocked ${resolved.blockedEnvrc}, so tasks start without its variables. Run \`direnv allow\` in ${path42.dirname(resolved.blockedEnvrc)} to use them.`);
     }
     if (resolved.trackedEnvFile) {
       warn(`tracked:${resolved.trackedEnvFile}`, `Ignored ${resolved.trackedEnvFile}: git tracks it, and a committed file must not choose the environment agents run in. Untrack it to use it.`);
@@ -36424,7 +36609,7 @@ var Attempts = class {
   uncommittedSkillFolder(name) {
     const root = this.deps.workspaceRoot();
     const skill = this.deps.skillsAt(this.skillRoots(root)).findSkill(name);
-    return skill?.source === "workspace" ? path40.relative(root, path40.dirname(skill.path)).split(path40.sep).join("/") : void 0;
+    return skill?.source === "workspace" ? path42.relative(root, path42.dirname(skill.path)).split(path42.sep).join("/") : void 0;
   }
   /**
    * The roots whose `.ordewell/skills/` an attempt at `cwd` reads: in a repo
@@ -36854,29 +37039,29 @@ function ancestors(task2, store) {
 
 // src/services/sessionLease.ts
 var fs19 = __toESM(require("fs"));
-var path42 = __toESM(require("path"));
-var import_crypto17 = require("crypto");
+var path44 = __toESM(require("path"));
+var import_crypto18 = require("crypto");
 
 // src/utils/sessionStore.ts
 var fs18 = __toESM(require("fs"));
-var path41 = __toESM(require("path"));
+var path43 = __toESM(require("path"));
 
 // src/utils/sessionId.ts
-var import_crypto16 = require("crypto");
+var import_crypto17 = require("crypto");
 function mintSessionId() {
-  return `session-${(0, import_crypto16.randomBytes)(16).toString("hex")}`;
+  return `session-${(0, import_crypto17.randomBytes)(16).toString("hex")}`;
 }
 
 // src/utils/sessionStore.ts
 var SESSIONS_SUBDIR = "sessions";
 function getSessionsDir(baseDir) {
-  return path41.join(getStateDir(baseDir), SESSIONS_SUBDIR);
+  return path43.join(getStateDir(baseDir), SESSIONS_SUBDIR);
 }
 function idSegment(id2) {
   return /^[A-Za-z0-9_-][A-Za-z0-9._-]{0,127}$/.test(id2) ? id2 : `~${Buffer.from(id2, "utf-8").toString("hex")}`;
 }
 function sessionDataDir(sessionId, baseDir) {
-  return path41.join(getSessionsDir(baseDir), idSegment(sessionId));
+  return path43.join(getSessionsDir(baseDir), idSegment(sessionId));
 }
 var REJECTION_MESSAGE = "This session was created with an older version of Ordewell. Please re-plan.";
 function isSessionMeta(value) {
@@ -36903,8 +37088,8 @@ function legacySessionFilename(session) {
   return `${filenameStem(session)}_${session.id.slice(0, 8)}.json`;
 }
 function dropLegacyFile(sessionsDir, meta) {
-  const legacy = path41.join(sessionsDir, legacySessionFilename(meta));
-  if (legacy === path41.join(sessionsDir, sessionFilename(meta)) || !fs18.existsSync(legacy)) return;
+  const legacy = path43.join(sessionsDir, legacySessionFilename(meta));
+  if (legacy === path43.join(sessionsDir, sessionFilename(meta)) || !fs18.existsSync(legacy)) return;
   try {
     const held2 = JSON.parse(fs18.readFileSync(legacy, "utf-8")).meta?.id;
     if (held2 === meta.id) fs18.unlinkSync(legacy);
@@ -36931,7 +37116,7 @@ function saveSession(plan, goal, baseDir, id2) {
   };
   dropRetiredPlanFields(session.plan);
   const filename = sessionFilename(meta);
-  const filePath = path41.join(sessionsDir, filename);
+  const filePath = path43.join(sessionsDir, filename);
   writeFileAtomic(filePath, JSON.stringify(session, null, 2));
   dropLegacyFile(sessionsDir, meta);
   return meta;
@@ -36943,7 +37128,7 @@ function listSessions(baseDir, logger = defaultLogger) {
   return files.map((f) => {
     let parsed;
     try {
-      parsed = JSON.parse(fs18.readFileSync(path41.join(sessionsDir, f), "utf-8"));
+      parsed = JSON.parse(fs18.readFileSync(path43.join(sessionsDir, f), "utf-8"));
     } catch (err) {
       if (err instanceof SyntaxError) return moveAside(sessionsDir, f, "is not valid JSON", logger);
       logger.warn("sessionStore", `failed to read session file ${f}; skipping`, err);
@@ -36964,7 +37149,7 @@ function listSessions(baseDir, logger = defaultLogger) {
 function moveAside(sessionsDir, file, reason, logger) {
   const aside = `${file}.${Date.now()}.corrupt`;
   try {
-    fs18.renameSync(path41.join(sessionsDir, file), path41.join(sessionsDir, aside));
+    fs18.renameSync(path43.join(sessionsDir, file), path43.join(sessionsDir, aside));
     logger.warn("sessionStore", `session file ${file} ${reason}; moved aside to ${aside} rather than overwritten`);
   } catch {
     logger.warn("sessionStore", `failed to read session file ${file}; skipping`);
@@ -36975,7 +37160,7 @@ function findSessionFile(sessionsDir, sessionId, logger) {
   const files = fs18.readdirSync(sessionsDir).filter((f) => f.endsWith(".json"));
   for (const f of files) {
     try {
-      const raw = fs18.readFileSync(path41.join(sessionsDir, f), "utf-8");
+      const raw = fs18.readFileSync(path43.join(sessionsDir, f), "utf-8");
       const session = JSON.parse(raw);
       if (session.meta.id === sessionId) return f;
     } catch (err) {
@@ -36990,7 +37175,7 @@ function loadSession(sessionId, baseDir, logger = defaultLogger) {
   try {
     const file = findSessionFile(sessionsDir, sessionId, logger);
     if (file) {
-      const raw = fs18.readFileSync(path41.join(sessionsDir, file), "utf-8");
+      const raw = fs18.readFileSync(path43.join(sessionsDir, file), "utf-8");
       const parsed = JSON.parse(raw);
       if (hasScalarRunner(parsed)) {
         logger.warn("sessionStore", `session file ${file}: ${REJECTION_MESSAGE}`);
@@ -37032,7 +37217,7 @@ function deleteSession(sessionId, baseDir, logger = defaultLogger) {
   try {
     const file = findSessionFile(sessionsDir, sessionId, logger);
     if (file) {
-      fs18.unlinkSync(path41.join(sessionsDir, file));
+      fs18.unlinkSync(path43.join(sessionsDir, file));
       return true;
     }
   } catch (err) {
@@ -37085,7 +37270,7 @@ var UNLEASED = {
 };
 var hostsHere = /* @__PURE__ */ new Set();
 function leaseFile(sessionId, workspace) {
-  return path42.join(sessionDataDir(sessionId, workspace), LEASE_FILE);
+  return path44.join(sessionDataDir(sessionId, workspace), LEASE_FILE);
 }
 function isRecord9(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -37121,7 +37306,7 @@ var LeaseHost = class {
   held = /* @__PURE__ */ new Map();
   heartbeat = null;
   constructor(options = {}) {
-    this.id = options.id ?? (0, import_crypto17.randomUUID)();
+    this.id = options.id ?? (0, import_crypto18.randomUUID)();
     this.pid = options.pid ?? process.pid;
     this.kindOf = options.kind ?? (() => void 0);
     this.alive = options.alive ?? processAlive;
@@ -37174,7 +37359,7 @@ var LeaseHost = class {
    */
   acquire(file, workspace, holder) {
     ensureStateDirIgnored(workspace);
-    ensurePrivateDir(path42.dirname(file));
+    ensurePrivateDir(path44.dirname(file));
     const outcome = withFileLock(file, () => {
       const current = readRecord(file);
       const taken = current !== null && current.hostId !== this.id ? current : null;
@@ -37229,7 +37414,7 @@ var LeaseHost = class {
       withFileLock(file, () => {
         if (readRecord(file)?.hostId === this.id) fs19.rmSync(file, { force: true });
       }, "release a session lease");
-      fs19.rmdirSync(path42.dirname(file));
+      fs19.rmdirSync(path44.dirname(file));
     } catch {
     }
   }
@@ -38175,7 +38360,9 @@ var TaskOrchestrator = class _TaskOrchestrator {
         this.store.markPending(task2.id);
         this.hold(task2.id, failure2.hold, false);
       }
-      await this.runs.release(task2.id, { keep: failure2.leaves === "failed" && failure2.keepWorktree });
+      if (failure2.leaves !== "held" || !failure2.preserveWorktree) {
+        await this.runs.release(task2.id, { keep: failure2.leaves === "failed" && failure2.keepWorktree });
+      }
       const { level, text: text6, toastOnly } = failure2.notice;
       if (toastOnly) this.notifications[level](text6);
       else this.tell(level, text6);
@@ -39988,8 +40175,8 @@ function codexWindow(slot, raw) {
 
 // src/services/harness/claudeAccountLimits.ts
 var import_child_process13 = require("child_process");
-var import_crypto18 = require("crypto");
-var import_fs13 = require("fs");
+var import_crypto19 = require("crypto");
+var import_fs14 = require("fs");
 var import_os5 = require("os");
 var import_path8 = require("path");
 var DEFAULT_TIMEOUT_MS5 = 2e4;
@@ -40023,10 +40210,10 @@ function claudeAccountLimitCollector(options) {
   };
 }
 async function readClaudeAccountLimits(options, signal) {
-  const cwd = (0, import_fs13.mkdtempSync)((0, import_path8.join)((0, import_os5.tmpdir)(), "ordewell-claude-limits-"));
+  const cwd = (0, import_fs14.mkdtempSync)((0, import_path8.join)((0, import_os5.tmpdir)(), "ordewell-claude-limits-"));
   const removeCwd = () => {
     try {
-      (0, import_fs13.rmSync)(cwd, { recursive: true, force: true });
+      (0, import_fs14.rmSync)(cwd, { recursive: true, force: true });
     } catch {
     }
   };
@@ -40068,7 +40255,7 @@ async function readClaudeAccountLimits(options, signal) {
 }
 function claudeAccountOwner(account) {
   const email = isRecord11(account) ? text5(account.email) : void 0;
-  if (!isRecord11(account) || !email) return `unnamed\0${(0, import_crypto18.randomUUID)()}`;
+  if (!isRecord11(account) || !email) return `unnamed\0${(0, import_crypto19.randomUUID)()}`;
   return [text5(account.apiProvider) ?? "", email, text5(account.organization) ?? ""].join("\0");
 }
 function claudeLimitReading(usage, owner, accountPlan) {
@@ -40110,8 +40297,8 @@ function isoInstant(value) {
 var import_os7 = require("os");
 
 // src/services/harness/openCodeCredentials.ts
-var import_crypto19 = require("crypto");
-var import_fs14 = require("fs");
+var import_crypto20 = require("crypto");
+var import_fs15 = require("fs");
 var import_os6 = require("os");
 var import_path9 = require("path");
 var import_worker_threads = require("worker_threads");
@@ -40168,7 +40355,7 @@ function walStore(path) {
 parentPort.postMessage(select());
 `;
 var isRecord12 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var digest = (...parts) => (0, import_crypto19.createHash)("sha256").update(parts.join("\0")).digest("hex").slice(0, 32);
+var digest = (...parts) => (0, import_crypto20.createHash)("sha256").update(parts.join("\0")).digest("hex").slice(0, 32);
 function openCodeStorePaths(env, home) {
   const data = (0, import_path9.join)(env.XDG_DATA_HOME || (0, import_path9.join)(home, ".local", "share"), "opencode");
   const file = env.OPENCODE_DB || "opencode.db";
@@ -40234,8 +40421,8 @@ function v2Login(db, row) {
     login: { route: "console", owner: digest("console", db, row.id, account, orgID ?? ""), access: value.access, ...orgID ? { orgID } : {}, expires: value.expires }
   };
 }
-async function legacyLogin(path48, env) {
-  const content = env.OPENCODE_AUTH_CONTENT ?? await readSmall(path48);
+async function legacyLogin(path50, env) {
+  const content = env.OPENCODE_AUTH_CONTENT ?? await readSmall(path50);
   if (content === void 0) return env[ENV_KEY] ? { kind: "unsupported" } : { kind: "none" };
   if (content === null) return { kind: "unreadable" };
   const auth = parseJson(content);
@@ -40244,15 +40431,15 @@ async function legacyLogin(path48, env) {
   if (entry === void 0) return env[ENV_KEY] ? { kind: "unsupported" } : { kind: "none" };
   if (!isRecord12(entry) || entry.type !== "api") return { kind: "unsupported" };
   if (typeof entry.key !== "string" || entry.key.length === 0) return { kind: "unreadable" };
-  return { kind: "login", login: { route: "key", owner: digest("v1", path48, entry.key), key: entry.key } };
+  return { kind: "login", login: { route: "key", owner: digest("v1", path50, entry.key), key: entry.key } };
 }
-function queryStore(path48, signal, deps) {
+function queryStore(path50, signal, deps) {
   return new Promise((settle) => {
     let worker;
     try {
       worker = (deps.spawnWorker ?? ((source, options) => new import_worker_threads.Worker(source, options)))(WORKER_SOURCE, {
         eval: true,
-        workerData: { path: path48, integrations: GO_INTEGRATIONS, busyMs: BUSY_MS, maxValueBytes: MAX_VALUE_BYTES },
+        workerData: { path: path50, integrations: GO_INTEGRATIONS, busyMs: BUSY_MS, maxValueBytes: MAX_VALUE_BYTES },
         execArgv: deps.workerExecArgv ?? [],
         resourceLimits: { maxOldGenerationSizeMb: 64 }
       });
@@ -40279,19 +40466,19 @@ function queryStore(path48, signal, deps) {
     worker.once("exit", aborted);
   });
 }
-async function stamp(path48) {
+async function stamp(path50) {
   try {
-    const stat = await import_fs14.promises.stat(path48);
+    const stat = await import_fs15.promises.stat(path50);
     return [stat.ino, stat.size, stat.mtimeMs];
   } catch {
     return null;
   }
 }
-async function readSmall(path48) {
+async function readSmall(path50) {
   try {
-    const stat = await import_fs14.promises.stat(path48);
+    const stat = await import_fs15.promises.stat(path50);
     if (!stat.isFile() || stat.size > MAX_AUTH_FILE_BYTES) return null;
-    return await import_fs14.promises.readFile(path48, "utf8");
+    return await import_fs15.promises.readFile(path50, "utf8");
   } catch (err) {
     return err.code === "ENOENT" ? void 0 : null;
   }
@@ -41420,20 +41607,20 @@ function createAiService(config, deps) {
 }
 
 // src/services/createSession.ts
-var path45 = __toESM(require("path"));
+var path47 = __toESM(require("path"));
 
 // src/services/handoffReferences.ts
 var fs21 = __toESM(require("fs"));
-var path43 = __toESM(require("path"));
+var path45 = __toESM(require("path"));
 var import_child_process15 = require("child_process");
 function resolveHandoffReferences(handoff, workspace) {
   const checked = /* @__PURE__ */ new Map();
   const contained = (candidate) => {
     try {
       const root = fs21.realpathSync(workspace);
-      const resolved = fs21.realpathSync(path43.resolve(root, candidate));
-      const relative17 = path43.relative(root, resolved);
-      return relative17 !== ".." && !relative17.startsWith(`..${path43.sep}`) && !path43.isAbsolute(relative17) ? resolved : void 0;
+      const resolved = fs21.realpathSync(path45.resolve(root, candidate));
+      const relative17 = path45.relative(root, resolved);
+      return relative17 !== ".." && !relative17.startsWith(`..${path45.sep}`) && !path45.isAbsolute(relative17) ? resolved : void 0;
     } catch {
       return void 0;
     }
@@ -41454,7 +41641,7 @@ function resolveHandoffReferences(handoff, workspace) {
       }
     } else if (/^[0-9a-fA-F]{4,64}$/.test(ref.sha)) {
       const repo = contained(ref.repo ?? ".");
-      if (repo && fs21.existsSync(path43.join(repo, ".git"))) {
+      if (repo && fs21.existsSync(path45.join(repo, ".git"))) {
         const result2 = (0, import_child_process15.spawnSync)("git", ["--no-optional-locks", "--no-replace-objects", "cat-file", "-t", ref.sha], {
           cwd: repo,
           encoding: "utf8",
@@ -42450,7 +42637,7 @@ function surfacePendingTurns(pending) {
 function surfaceTask({ attemptSkills, subtasks, runnerSessionId: _runnerSessionId, ...task2 }) {
   return {
     ...task2,
-    ...attemptSkills ? { attemptSkills: attemptSkills.map(({ name, source, path: path48 }) => ({ name, source, path: path48 })) } : {},
+    ...attemptSkills ? { attemptSkills: attemptSkills.map(({ name, source, path: path50 }) => ({ name, source, path: path50 })) } : {},
     subtasks: (subtasks ?? []).map(surfaceTask)
   };
 }
@@ -43230,10 +43417,10 @@ var SessionEventRelay = class {
 
 // src/utils/taskLogStore.ts
 var fs22 = __toESM(require("fs"));
-var path44 = __toESM(require("path"));
+var path46 = __toESM(require("path"));
 var EXTENSION = ".jsonl";
 function taskDir({ baseDir, sessionId }, taskId) {
-  return path44.join(sessionDataDir(sessionId, baseDir), "tasks", idSegment(taskId));
+  return path46.join(sessionDataDir(sessionId, baseDir), "tasks", idSegment(taskId));
 }
 function listTaskLogAttempts(location, taskId) {
   let names;
@@ -43251,7 +43438,7 @@ function openTaskLog(location, taskId, attempt) {
   const next = (listTaskLogAttempts(location, taskId).pop() ?? 0) + 1;
   let number = attempt !== void 0 && Number.isInteger(attempt) && attempt >= 1 ? attempt : next;
   for (; ; ) {
-    const file = path44.join(dir, `${number}${EXTENSION}`);
+    const file = path46.join(dir, `${number}${EXTENSION}`);
     try {
       fs22.writeFileSync(file, "", { flag: "wx" });
     } catch (err) {
@@ -43275,15 +43462,15 @@ function prepareTaskOutputFile(location, taskId, attempt) {
   ensureStateDirIgnored(location.baseDir);
   const dir = taskDir(location, taskId);
   fs22.mkdirSync(dir, { recursive: true });
-  return path44.join(dir, `${attempt}.output.txt`);
+  return path46.join(dir, `${attempt}.output.txt`);
 }
 function taskPatchFile(location, taskId, attempt) {
-  return path44.join(taskDir(location, taskId), `${attempt}.patch`);
+  return path46.join(taskDir(location, taskId), `${attempt}.patch`);
 }
 function saveTaskPatch(location, taskId, attempt, patch) {
   ensureStateDirIgnored(location.baseDir);
   const file = taskPatchFile(location, taskId, attempt);
-  fs22.mkdirSync(path44.dirname(file), { recursive: true });
+  fs22.mkdirSync(path46.dirname(file), { recursive: true });
   const partial = `${file}.${process.pid}-${Date.now()}.partial`;
   fs22.writeFileSync(partial, patch, { flag: "wx" });
   fs22.renameSync(partial, file);
@@ -43304,7 +43491,7 @@ function readTaskLog(location, taskId, attempt) {
   if (!Number.isInteger(attempt) || attempt < 1) return [];
   let raw;
   try {
-    raw = fs22.readFileSync(path44.join(taskDir(location, taskId), `${attempt}${EXTENSION}`), "utf-8");
+    raw = fs22.readFileSync(path46.join(taskDir(location, taskId), `${attempt}${EXTENSION}`), "utf-8");
   } catch {
     return [];
   }
@@ -45366,7 +45553,7 @@ function createSession(deps) {
     ...deps.openTaskLog ? {} : {
       keepPatch: (taskId, attempt, patch) => {
         const location = session.taskLogLocation;
-        return path45.relative(location.baseDir, saveTaskPatch(location, taskId, attempt, patch)).split(path45.sep).join("/");
+        return path47.relative(location.baseDir, saveTaskPatch(location, taskId, attempt, patch)).split(path47.sep).join("/");
       }
     },
     recordHandoff: (sessionId, taskId, handoff) => taskLogs.note(sessionId, taskId, { type: "handoff", handoff }),
@@ -49260,7 +49447,7 @@ var RunnerRegistry = class {
 
 // src/plugins/removedPluginNotice.ts
 var fs23 = __toESM(require("fs"));
-var path46 = __toESM(require("path"));
+var path48 = __toESM(require("path"));
 function isManifestFile(file) {
   try {
     return fs23.statSync(file).isFile();
@@ -49269,10 +49456,10 @@ function isManifestFile(file) {
   }
 }
 function removedPluginNotice(dataDir = globalDataDir()) {
-  const directory = path46.join(dataDir, "plugins");
+  const directory = path48.join(dataDir, "plugins");
   try {
-    const hasManifest = isManifestFile(path46.join(directory, "manifest.json")) || fs23.readdirSync(directory, { withFileTypes: true }).some(
-      (entry) => (entry.isDirectory() || entry.isSymbolicLink()) && isManifestFile(path46.join(directory, entry.name, "manifest.json"))
+    const hasManifest = isManifestFile(path48.join(directory, "manifest.json")) || fs23.readdirSync(directory, { withFileTypes: true }).some(
+      (entry) => (entry.isDirectory() || entry.isSymbolicLink()) && isManifestFile(path48.join(directory, entry.name, "manifest.json"))
     );
     if (hasManifest) return "Plugin runners were removed; manifests in ~/.ordewell/plugins/ are ignored. See the CHANGELOG.";
   } catch {
@@ -49283,15 +49470,15 @@ function removedPluginNotice(dataDir = globalDataDir()) {
 
 // src/utils/stateStore.ts
 var fs24 = __toESM(require("fs"));
-var path47 = __toESM(require("path"));
+var path49 = __toESM(require("path"));
 var STATE_FILE2 = "state.json";
 function getStatePath(baseDir) {
-  return path47.join(getStateDir(baseDir), STATE_FILE2);
+  return path49.join(getStateDir(baseDir), STATE_FILE2);
 }
 var SESSION_ID_KEY = "sessionId";
 function saveState(plan, baseDir, sessionId) {
   const statePath = getStatePath(baseDir ?? process.cwd());
-  ensureDir(path47.dirname(statePath));
+  ensureDir(path49.dirname(statePath));
   plan.lastUpdated = (/* @__PURE__ */ new Date()).toISOString();
   const file = sessionId ? { ...plan, [SESSION_ID_KEY]: sessionId } : plan;
   dropRetiredPlanFields(file);
@@ -49840,6 +50027,7 @@ var PlannerModelMemory = class {
   repoBaseLine,
   repoResultLines,
   reposWithWork,
+  repositoryRunnerConfigPaths,
   researchShellWarning,
   researchToolsPath,
   resetInstalledPlanner,