@ordewell/core 0.11.3 → 0.12.0

package/AUTHORS.md

@@ -26,12 +26,14 @@ record of who built what, rather than `git log`.
   planner's duplicated usage-limit message (#79, #96).
 - [@haltingstate](https://github.com/haltingstate) — made the terminal UI's
   stepper say what a saved step does next, instead of encoding it in a
-  sentinel index (#123).
+  sentinel index (#123), and improved tool-call errors (#124).
 - [@Logic769](https://github.com/Logic769) — made `/resume` an alias of
   `/sessions` in the planner chat (#139).
 - Hanbin Tan ([@hskl18](https://github.com/hskl18)) — documented how
   planners and runners get their models and credentials (#140).
 
+- [@torialfaro](https://github.com/torialfaro) and [@aavykyy](https://github.com/aavykyy) — made VS Code task prompts keyboard accessible (#141).
+
 Thank you. Contributions are welcome — see [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## Acknowledgements

package/dist/{IRunner-ihalYfTo.d.mts → IRunner-BwzyUVIL.d.mts}

@@ -1,5 +1,5 @@
 import { ChildProcess } from 'child_process';
-import { aS as Task, az as RunnerId, b6 as UsageRecord, aQ as SubagentOutcome, aA as RunnerSessionCost, i as DiscoveredModel, a$ as TaskSkillSnapshot, p as HandoffCheck } from './Task-BL4Idm9r.mjs';
+import { b1 as Task, aK as RunnerId, bh as UsageRecord, a$ as SubagentOutcome, aL as RunnerSessionCost, i as DiscoveredModel, ba as TaskSkillSnapshot, p as HandoffCheck } from './Task-BTEH-ztX.mjs';
 import { z } from 'zod/v4';
 
 /** A script task's time limit when it sets none. */
@@ -174,6 +174,8 @@ interface ShellLaunch {
      * timeout, and stops waiting for output a moment after it exits.
      */
     wallTimeMs?: number;
+    /** A sealed run's memory limit, which its result names if the run was ended at it (ADR-0036 S1). */
+    memoryBytes?: number;
 }
 interface ResearchShellDeps {
     platform?: NodeJS.Platform;
@@ -708,6 +710,12 @@ interface IConfig {
     approvalDefaults: boolean;
     /** The user's effect allowlist rules (ADR-0035, `effectAllowlist.ts`), read on every request. It has no defaults. */
     effectAllowlist: string[];
+    /**
+     * The user's notify command as an argument vector (ADR-0053), read as each
+     * new escalation appears; empty when there is none. A repository never sets
+     * it, because it would then run a command on the user's machine.
+     */
+    notifyCommand: string[];
     /** How many fetches and searches one planner turn may make (ADR-0027). User-only, like the approval settings. */
     webReadBudget: number;
     /**
@@ -738,6 +746,12 @@ interface ToolOutcome {
      * names the limit it ran out of rather than blaming the command.
      */
     timedOut?: boolean;
+    /**
+     * The signal that ended the child, if one did. The adapters report it, and a
+     * sealed run's result reads it for the one that means its memory limit ended
+     * the run (ADR-0036 S1).
+     */
+    signal?: NodeJS.Signals;
 }
 interface ReadFileOpts {
     maxBytes?: number;
@@ -864,7 +878,7 @@ interface IFileSystem {
     setOutboundSecrets?(secrets: () => Iterable<string>): void;
     /** Where the filesystem tells the session, once, that the planner's shell runs without an OS sandbox here (ADR-0011 B5). */
     setNotice?(notice: (message: string) => void): void;
-    /** The session ended: its scratch directory is removed, and the next command starts a fresh one (ADR-0011 B2). */
+    /** The session ended: its scratch directories are removed, and the next command starts fresh ones (ADR-0011 B2). */
     endSession?(): void;
     /** Whether a command can run sealed on this host (ADR-0036 S6); where it cannot, the session's one notice says so. */
     canSeal?(): Promise<boolean>;
@@ -1533,18 +1547,26 @@ interface SandboxProfile {
     limits?: SandboxLimits;
 }
 /**
- * Held by the kernel's resource limits, set before the launcher starts, and
- * by the caller's clock (ADR-0036 S1).
+ * Held by the kernel's resource limits, set before the launcher starts, by a
+ * watcher beside the launcher, outside the sandbox, and by the caller's clock
+ * (ADR-0036 S1).
  */
 interface SandboxLimits {
     /** Processes the command may start beyond those its user already runs, which the kernel's limit counts too. */
     processes: number;
     /**
-     * Bytes of address space any one of its processes may map. On macOS, where
-     * every program maps hundreds of gigabytes as it starts, it is counted on
-     * top of that.
+     * Bytes of real memory the command may hold: resident memory summed across
+     * its processes, which the watcher reads about once a second and ends the
+     * command for passing ({@link MEMORY_LIMIT_SIGNAL}).
      */
     memoryBytes: number;
+    /**
+     * Bytes of address space any one of its processes may map: a backstop
+     * against a runaway allocator, not a measure of memory, since V8 reserves
+     * far more than it touches. On macOS, where every program maps hundreds of
+     * gigabytes as it starts, it is counted on top of that.
+     */
+    addressSpaceBytes: number;
     /** Milliseconds before the caller kills the command, and with it every process it started. */
     wallTimeMs: number;
 }
@@ -1559,9 +1581,12 @@ interface SandboxInvocation {
 interface SandboxLaunch {
     file: string;
     args: string[];
+    /** What `file` starts with. A launcher that runs before the sandbox gets only what the profile keeps of the host's. */
     env: NodeJS.ProcessEnv;
     /** The profile's wall-time limit: the caller kills the launch with SIGKILL once it has run this long. */
     wallTimeMs?: number;
+    /** The profile's memory limit, past which the launch ends by {@link MEMORY_LIMIT_SIGNAL}. */
+    memoryBytes?: number;
 }
 type SandboxProbe = {
     ok: true;
@@ -1676,7 +1701,12 @@ interface PlannerSandboxDeps {
     uid?: number;
     exec?: ProbeExec;
 }
-/** Enough for a loop over a repository's files, a pipeline or a short script; not for a build. */
+/**
+ * Time enough for a loop over a repository's files, a pipeline or a short
+ * script, not for a build. The memory is real memory across the run; the
+ * address space is per process and far above what V8 reserves for ordinary
+ * programs (ADR-0036 S1, which records the measurement).
+ */
 declare const SEALED_LIMITS: SandboxLimits;
 /**
  * A read-only task's sealed runs (ADR-0046): the same resources, with the ten
@@ -1699,18 +1729,18 @@ interface PlannerShellLaunch {
     sandboxed: boolean;
 }
 /**
- * One session's view of the sandbox: its scratch directory, made on the first
- * command and removed when the session ends, and its one notice when the
- * sandbox, or a sealed run in it, cannot run here.
+ * One session's view of the sandbox: a scratch directory for each profile,
+ * made on its first command and removed when the session ends, and its one
+ * notice when the sandbox, or a sealed run in it, cannot run here.
  */
 declare class PlannerShellSandbox {
     private readonly resolve;
-    private scratch;
+    private readonly scratch;
     private noticed;
     private notice;
     constructor(resolve?: () => Promise<PlannerSandboxAvailability>);
     setNotice(notice: (message: string) => void): void;
-    /** The same host's sandbox for another caller, with a scratch directory of its own: a read-only task's (ADR-0046). */
+    /** The same host's sandbox for another caller, with scratch directories of its own: a read-only task's (ADR-0046). */
     withOwnScratch(): PlannerShellSandbox;
     /**
      * The launch for one command (B6): the research shell wrapped in the
@@ -1733,8 +1763,10 @@ declare class PlannerShellSandbox {
     /**
      * The launch for a harness's own shell (ADR-0036 N2): the same sealed profile
      * as a sealed run, with the network the harness gives it (N3), plus the
-     * harness's short temporary directory. The workspace stays read-only. Throws
-     * where the sandbox cannot run, so a caller never falls back to the bare shell.
+     * harness's short temporary directory. The workspace stays read-only. Its
+     * home is a scratch directory of its own, so whatever startup files its shell
+     * reads, a sealed run wrote none of them (S8). Throws where the sandbox
+     * cannot run, so a caller never falls back to the bare shell.
      */
     launchNativeShell(opts: {
         workspace: string;
@@ -1743,9 +1775,9 @@ declare class PlannerShellSandbox {
         shellArgs?: readonly string[];
         env?: NodeJS.ProcessEnv;
     }): Promise<SandboxLaunch>;
-    /** The scratch directory every launch here gets as `$TMPDIR` and `$HOME`, made if it is not there. */
+    /** The scratch directory a sealed run gets as `$TMPDIR` and `$HOME`, made if it is not there. */
     scratchPath(): string;
-    /** The session ended: its scratch directory goes, and a next session starts with a fresh one and its own notice. */
+    /** The session ended: its scratch directories go, and a next session starts with fresh ones and its own notice. */
     end(): void;
     private say;
     private invocation;
@@ -2074,6 +2106,14 @@ interface TaskRunnerFlags {
     /** The manifest's further settings for the task's mode, by setting name — see `RunnerFeatures.modeSettings`. */
     modeSettings: Record<string, string>;
 }
+/**
+ * What a task runner loads of the user's own setup (the `taskRunnerConfig`
+ * setting): `user` is everything the runner would load for the user,
+ * `minimal` only what a task needs — Ordewell's server, the repository's
+ * instructions — so the user's connectors, skills and settings do not ride in
+ * every attempt's context. Runners that cannot narrow their setup ignore it.
+ */
+type TaskRunnerConfig = 'user' | 'minimal';
 /** A plan task driven over the runner's programmatic protocol (ADR-0018, C1). */
 interface TaskStartOptions extends AgentStartCommon {
     kind: 'task';
@@ -2082,6 +2122,8 @@ interface TaskStartOptions extends AgentStartCommon {
     /** The task's runner mode id, as the plan names it. */
     mode: string;
     flags: TaskRunnerFlags;
+    /** What the runner loads of the user's setup; absent means `user`. */
+    runnerConfig?: TaskRunnerConfig;
     /** The attempt's work lands as a commit (ADR-0047): its completion contract asks for the message. */
     commits?: true;
     /**
@@ -2823,6 +2865,8 @@ interface IRunner {
         cancelled?: AbortSignal;
         /** The attempt's work lands as a commit (ADR-0047): its runner is told to write the message in `task_complete`. */
         commits?: true;
+        /** What the runner loads of the user's own setup (the `taskRunnerConfig` setting); absent means all of it. Runners that cannot narrow it ignore it. */
+        runnerConfig?: TaskRunnerConfig;
         /** A script task's body (ADR-0035): only the script runner reads it, and it runs nothing else. */
         script?: ScriptBody;
         /**
@@ -2868,4 +2912,4 @@ interface IRunner {
     activeCount: number;
 }
 
-export { type McpToolContext as $, AUTO_COMMANDS as A, type BashOptions as B, type CatalogModel as C, DEFAULT_PLANNER_ALLOWLIST as D, type DiscoveryCommand as E, type EditPlanArgs as F, type FetchAllProviderModelsOptions as G, type FindSymbolOptions as H, GIT_READONLY_SUBCOMMANDS as I, GREP_DEFAULT_HEAD_LIMIT as J, type GlobOptions as K, type GrepOptions as L, type GrepOutputMode as M, type IApproval as N, type IConfig as O, type IFileSystem as P, type IRunner as Q, type IRunnerSession as R, type InvokedCommand as S, LineBuffer as T, type ListModelsArgs as U, type ListRunnersArgs as V, type LoadSkillArgs as W, type McpClientConfig as X, type McpCredential as Y, type McpRefusal as Z, type McpTool as _, type AgentAdapter as a, type SealedAvailability as a$, type McpToolReply as a0, type MessageTaskArgs as a1, ModelCatalog as a2, type ModelShortcut as a3, ORCHESTRATOR_SHORTCUTS as a4, ORDEWELL_MCP_PATH as a5, ORDEWELL_MCP_SERVER_NAME as a6, type OneTaskArgs as a7, type OrchestratorOption as a8, OrdewellMcpServer as a9, type RunCommandArgs as aA, type RunPlanArgs as aB, type RunnerAuthSpec as aC, type RunnerAuthStatus as aD, type RunnerCommand as aE, type RunnerCommandKind as aF, type RunnerEntry as aG, type RunnerEnv as aH, type RunnerFeatures as aI, type RunnerManifest as aJ, type RunnerMcpServer as aK, type RunnerMode as aL, type RunnerModelDiscovery as aM, type RunnerModelRef as aN, RunnerRegistry as aO, SEALED_LIMITS as aP, SEARCH_EXCLUSIONS as aQ, type SandboxBackend as aR, type SandboxInvocation as aS, type SandboxLaunch as aT, type SandboxLimits as aU, type SandboxProfile as aV, type ScriptBody as aW, type ScriptExit as aX, type ScriptFullOutput as aY, type ScriptRun as aZ, type ScriptStatus as a_, type OwnSealedRuns as aa, type OwnerOnlyFile as ab, PLANNER_EXECUTION_TOOLS as ac, PLANNER_SANDBOX_DOCS as ad, PLANNER_TOOLS as ae, type PlannerAllowlist as af, type PlannerBackendId as ag, type PlannerSandboxAvailability as ah, type PlannerSandboxDeps as ai, PlannerShellSandbox as aj, type PlannerStartOptions as ak, type PlannerTokenScope as al, type PlannerToolHandler as am, type ProjectMcpServer as an, type ProviderCredentialSource as ao, type ProviderModelLists as ap, type ProviderModelsResult as aq, type QueuedTaskMessage as ar, READ_ONLY_TASK_TOOLS as as, REFUSED_COMMANDS as at, type ReadFileOpts as au, type ReadTaskArgs as av, type ResearchShell as aw, type ResearchShellDeps as ax, type RetryTaskArgs as ay, type RuleWord as az, type AgentAdapterFactory as b, type SealedRunOptions as b0, type ShellDialect as b1, type ShellLaunch as b2, type SpawnFn as b3, type StandingDecision as b4, type StructuredEvent as b5, type StructuredTurnEnd as b6, type SubmitPlanArgs as b7, TASK_COMPLETE_TOOL as b8, TASK_COMPLETION_CONTRACT as b9, effectiveApprovalMode as bA, enabledRunners as bB, fetchAllProviderModels as bC, findRunnerCommand as bD, isGranted as bE, isRunnerApproval as bF, knownModelId as bG, mcpClientConfig as bH, ownerOnlyConfigFile as bI, parseAllowlist as bJ, parseApprovalModeSetting as bK, researchShellWarning as bL, researchToolsPath as bM, resolveModelShortcut as bN, resolvePlannerSandbox as bO, resolveProvider as bP, resolveResearchShell as bQ, scopeAllowed as bR, scriptBodyOf as bS, scriptBodyText as bT, scriptTaskText as bU, sharedMcpServer as bV, taskCompletionContract as bW, timeLimitText as bX, toApprovalDecision as bY, toOrchestratorOptions as bZ, toolAllowed as b_, TASK_SEALED_LIMITS as ba, TASK_TOOLS as bb, type TaskCompleteArgs as bc, type TaskDiffArgs as bd, type TaskMessageFrom as be, type TaskModeAgentAdapter as bf, TaskModeUnsupportedError as bg, type TaskOutputArgs as bh, type TaskQueryArgs as bi, type TaskRunCommandArgs as bj, type TaskRunnerFlags as bk, type TaskShell as bl, type TaskShellSite as bm, type TaskStartOptions as bn, type TaskTokenScope as bo, type TaskToolHandler as bp, type TaskWebReads as bq, type ToolOutcome as br, type UsageLimitSignal as bs, approvalScopes as bt, classifyCommand as bu, clearPlannerSandboxCache as bv, clearResearchShellCache as bw, collectProviderCredentials as bx, commandAllowedBy as by, commandLine as bz, type AgentEvent as c, type AgentProcessDeps as d, type AgentStartOptions as e, type AiProvider as f, type AllProviderModels as g, type AnswerApprovalArgs as h, type ApplyPatchArgs as i, type ApprovalAnswer as j, type ApprovalDecision as k, type ApprovalKind as l, type ApprovalMode as m, type ApprovalModeSetting as n, ApprovalPolicy as o, type ApprovalPolicyOptions as p, type ApprovalRequest as q, type ApprovalSource as r, type AttachState as s, type CheckpointAnswer as t, type CheckpointArgs as u, type CommandClassification as v, type CommandTier as w, type CommandWords as x, DEFAULT_SCRIPT_TIMEOUT_MS as y, DENY_ALL as z };
+export { type McpToolContext as $, AUTO_COMMANDS as A, type BashOptions as B, type CatalogModel as C, DEFAULT_PLANNER_ALLOWLIST as D, type DiscoveryCommand as E, type EditPlanArgs as F, type FetchAllProviderModelsOptions as G, type FindSymbolOptions as H, GIT_READONLY_SUBCOMMANDS as I, GREP_DEFAULT_HEAD_LIMIT as J, type GlobOptions as K, type GrepOptions as L, type GrepOutputMode as M, type IApproval as N, type IConfig as O, type IFileSystem as P, type IRunner as Q, type IRunnerSession as R, type InvokedCommand as S, LineBuffer as T, type ListModelsArgs as U, type ListRunnersArgs as V, type LoadSkillArgs as W, type McpClientConfig as X, type McpCredential as Y, type McpRefusal as Z, type McpTool as _, type AgentAdapter as a, type SealedAvailability as a$, type McpToolReply as a0, type MessageTaskArgs as a1, ModelCatalog as a2, type ModelShortcut as a3, ORCHESTRATOR_SHORTCUTS as a4, ORDEWELL_MCP_PATH as a5, ORDEWELL_MCP_SERVER_NAME as a6, type OneTaskArgs as a7, type OrchestratorOption as a8, OrdewellMcpServer as a9, type RunCommandArgs as aA, type RunPlanArgs as aB, type RunnerAuthSpec as aC, type RunnerAuthStatus as aD, type RunnerCommand as aE, type RunnerCommandKind as aF, type RunnerEntry as aG, type RunnerEnv as aH, type RunnerFeatures as aI, type RunnerManifest as aJ, type RunnerMcpServer as aK, type RunnerMode as aL, type RunnerModelDiscovery as aM, type RunnerModelRef as aN, RunnerRegistry as aO, SEALED_LIMITS as aP, SEARCH_EXCLUSIONS as aQ, type SandboxBackend as aR, type SandboxInvocation as aS, type SandboxLaunch as aT, type SandboxLimits as aU, type SandboxProfile as aV, type ScriptBody as aW, type ScriptExit as aX, type ScriptFullOutput as aY, type ScriptRun as aZ, type ScriptStatus as a_, type OwnSealedRuns as aa, type OwnerOnlyFile as ab, PLANNER_EXECUTION_TOOLS as ac, PLANNER_SANDBOX_DOCS as ad, PLANNER_TOOLS as ae, type PlannerAllowlist as af, type PlannerBackendId as ag, type PlannerSandboxAvailability as ah, type PlannerSandboxDeps as ai, PlannerShellSandbox as aj, type PlannerStartOptions as ak, type PlannerTokenScope as al, type PlannerToolHandler as am, type ProjectMcpServer as an, type ProviderCredentialSource as ao, type ProviderModelLists as ap, type ProviderModelsResult as aq, type QueuedTaskMessage as ar, READ_ONLY_TASK_TOOLS as as, REFUSED_COMMANDS as at, type ReadFileOpts as au, type ReadTaskArgs as av, type ResearchShell as aw, type ResearchShellDeps as ax, type RetryTaskArgs as ay, type RuleWord as az, type AgentAdapterFactory as b, toolAllowed as b$, type SealedRunOptions as b0, type ShellDialect as b1, type ShellLaunch as b2, type SpawnFn as b3, type StandingDecision as b4, type StructuredEvent as b5, type StructuredTurnEnd as b6, type SubmitPlanArgs as b7, TASK_COMPLETE_TOOL as b8, TASK_COMPLETION_CONTRACT as b9, commandLine as bA, effectiveApprovalMode as bB, enabledRunners as bC, fetchAllProviderModels as bD, findRunnerCommand as bE, isGranted as bF, isRunnerApproval as bG, knownModelId as bH, mcpClientConfig as bI, ownerOnlyConfigFile as bJ, parseAllowlist as bK, parseApprovalModeSetting as bL, researchShellWarning as bM, researchToolsPath as bN, resolveModelShortcut as bO, resolvePlannerSandbox as bP, resolveProvider as bQ, resolveResearchShell as bR, scopeAllowed as bS, scriptBodyOf as bT, scriptBodyText as bU, scriptTaskText as bV, sharedMcpServer as bW, taskCompletionContract as bX, timeLimitText as bY, toApprovalDecision as bZ, toOrchestratorOptions as b_, TASK_SEALED_LIMITS as ba, TASK_TOOLS as bb, type TaskCompleteArgs as bc, type TaskDiffArgs as bd, type TaskMessageFrom as be, type TaskModeAgentAdapter as bf, TaskModeUnsupportedError as bg, type TaskOutputArgs as bh, type TaskQueryArgs as bi, type TaskRunCommandArgs as bj, type TaskRunnerConfig as bk, type TaskRunnerFlags as bl, type TaskShell as bm, type TaskShellSite as bn, type TaskStartOptions as bo, type TaskTokenScope as bp, type TaskToolHandler as bq, type TaskWebReads as br, type ToolOutcome as bs, type UsageLimitSignal as bt, approvalScopes as bu, classifyCommand as bv, clearPlannerSandboxCache as bw, clearResearchShellCache as bx, collectProviderCredentials as by, commandAllowedBy as bz, type AgentEvent as c, type AgentProcessDeps as d, type AgentStartOptions as e, type AiProvider as f, type AllProviderModels as g, type AnswerApprovalArgs as h, type ApplyPatchArgs as i, type ApprovalAnswer as j, type ApprovalDecision as k, type ApprovalKind as l, type ApprovalMode as m, type ApprovalModeSetting as n, ApprovalPolicy as o, type ApprovalPolicyOptions as p, type ApprovalRequest as q, type ApprovalSource as r, type AttachState as s, type CheckpointAnswer as t, type CheckpointArgs as u, type CommandClassification as v, type CommandTier as w, type CommandWords as x, DEFAULT_SCRIPT_TIMEOUT_MS as y, DENY_ALL as z };

package/dist/{IRunner-DOMtDTVt.d.ts → IRunner-DjJkYwko.d.ts}

@@ -1,5 +1,5 @@
 import { ChildProcess } from 'child_process';
-import { aS as Task, az as RunnerId, b6 as UsageRecord, aQ as SubagentOutcome, aA as RunnerSessionCost, i as DiscoveredModel, a$ as TaskSkillSnapshot, p as HandoffCheck } from './Task-BL4Idm9r.js';
+import { b1 as Task, aK as RunnerId, bh as UsageRecord, a$ as SubagentOutcome, aL as RunnerSessionCost, i as DiscoveredModel, ba as TaskSkillSnapshot, p as HandoffCheck } from './Task-BTEH-ztX.js';
 import { z } from 'zod/v4';
 
 /** A script task's time limit when it sets none. */
@@ -174,6 +174,8 @@ interface ShellLaunch {
      * timeout, and stops waiting for output a moment after it exits.
      */
     wallTimeMs?: number;
+    /** A sealed run's memory limit, which its result names if the run was ended at it (ADR-0036 S1). */
+    memoryBytes?: number;
 }
 interface ResearchShellDeps {
     platform?: NodeJS.Platform;
@@ -708,6 +710,12 @@ interface IConfig {
     approvalDefaults: boolean;
     /** The user's effect allowlist rules (ADR-0035, `effectAllowlist.ts`), read on every request. It has no defaults. */
     effectAllowlist: string[];
+    /**
+     * The user's notify command as an argument vector (ADR-0053), read as each
+     * new escalation appears; empty when there is none. A repository never sets
+     * it, because it would then run a command on the user's machine.
+     */
+    notifyCommand: string[];
     /** How many fetches and searches one planner turn may make (ADR-0027). User-only, like the approval settings. */
     webReadBudget: number;
     /**
@@ -738,6 +746,12 @@ interface ToolOutcome {
      * names the limit it ran out of rather than blaming the command.
      */
     timedOut?: boolean;
+    /**
+     * The signal that ended the child, if one did. The adapters report it, and a
+     * sealed run's result reads it for the one that means its memory limit ended
+     * the run (ADR-0036 S1).
+     */
+    signal?: NodeJS.Signals;
 }
 interface ReadFileOpts {
     maxBytes?: number;
@@ -864,7 +878,7 @@ interface IFileSystem {
     setOutboundSecrets?(secrets: () => Iterable<string>): void;
     /** Where the filesystem tells the session, once, that the planner's shell runs without an OS sandbox here (ADR-0011 B5). */
     setNotice?(notice: (message: string) => void): void;
-    /** The session ended: its scratch directory is removed, and the next command starts a fresh one (ADR-0011 B2). */
+    /** The session ended: its scratch directories are removed, and the next command starts fresh ones (ADR-0011 B2). */
     endSession?(): void;
     /** Whether a command can run sealed on this host (ADR-0036 S6); where it cannot, the session's one notice says so. */
     canSeal?(): Promise<boolean>;
@@ -1533,18 +1547,26 @@ interface SandboxProfile {
     limits?: SandboxLimits;
 }
 /**
- * Held by the kernel's resource limits, set before the launcher starts, and
- * by the caller's clock (ADR-0036 S1).
+ * Held by the kernel's resource limits, set before the launcher starts, by a
+ * watcher beside the launcher, outside the sandbox, and by the caller's clock
+ * (ADR-0036 S1).
  */
 interface SandboxLimits {
     /** Processes the command may start beyond those its user already runs, which the kernel's limit counts too. */
     processes: number;
     /**
-     * Bytes of address space any one of its processes may map. On macOS, where
-     * every program maps hundreds of gigabytes as it starts, it is counted on
-     * top of that.
+     * Bytes of real memory the command may hold: resident memory summed across
+     * its processes, which the watcher reads about once a second and ends the
+     * command for passing ({@link MEMORY_LIMIT_SIGNAL}).
      */
     memoryBytes: number;
+    /**
+     * Bytes of address space any one of its processes may map: a backstop
+     * against a runaway allocator, not a measure of memory, since V8 reserves
+     * far more than it touches. On macOS, where every program maps hundreds of
+     * gigabytes as it starts, it is counted on top of that.
+     */
+    addressSpaceBytes: number;
     /** Milliseconds before the caller kills the command, and with it every process it started. */
     wallTimeMs: number;
 }
@@ -1559,9 +1581,12 @@ interface SandboxInvocation {
 interface SandboxLaunch {
     file: string;
     args: string[];
+    /** What `file` starts with. A launcher that runs before the sandbox gets only what the profile keeps of the host's. */
     env: NodeJS.ProcessEnv;
     /** The profile's wall-time limit: the caller kills the launch with SIGKILL once it has run this long. */
     wallTimeMs?: number;
+    /** The profile's memory limit, past which the launch ends by {@link MEMORY_LIMIT_SIGNAL}. */
+    memoryBytes?: number;
 }
 type SandboxProbe = {
     ok: true;
@@ -1676,7 +1701,12 @@ interface PlannerSandboxDeps {
     uid?: number;
     exec?: ProbeExec;
 }
-/** Enough for a loop over a repository's files, a pipeline or a short script; not for a build. */
+/**
+ * Time enough for a loop over a repository's files, a pipeline or a short
+ * script, not for a build. The memory is real memory across the run; the
+ * address space is per process and far above what V8 reserves for ordinary
+ * programs (ADR-0036 S1, which records the measurement).
+ */
 declare const SEALED_LIMITS: SandboxLimits;
 /**
  * A read-only task's sealed runs (ADR-0046): the same resources, with the ten
@@ -1699,18 +1729,18 @@ interface PlannerShellLaunch {
     sandboxed: boolean;
 }
 /**
- * One session's view of the sandbox: its scratch directory, made on the first
- * command and removed when the session ends, and its one notice when the
- * sandbox, or a sealed run in it, cannot run here.
+ * One session's view of the sandbox: a scratch directory for each profile,
+ * made on its first command and removed when the session ends, and its one
+ * notice when the sandbox, or a sealed run in it, cannot run here.
  */
 declare class PlannerShellSandbox {
     private readonly resolve;
-    private scratch;
+    private readonly scratch;
     private noticed;
     private notice;
     constructor(resolve?: () => Promise<PlannerSandboxAvailability>);
     setNotice(notice: (message: string) => void): void;
-    /** The same host's sandbox for another caller, with a scratch directory of its own: a read-only task's (ADR-0046). */
+    /** The same host's sandbox for another caller, with scratch directories of its own: a read-only task's (ADR-0046). */
     withOwnScratch(): PlannerShellSandbox;
     /**
      * The launch for one command (B6): the research shell wrapped in the
@@ -1733,8 +1763,10 @@ declare class PlannerShellSandbox {
     /**
      * The launch for a harness's own shell (ADR-0036 N2): the same sealed profile
      * as a sealed run, with the network the harness gives it (N3), plus the
-     * harness's short temporary directory. The workspace stays read-only. Throws
-     * where the sandbox cannot run, so a caller never falls back to the bare shell.
+     * harness's short temporary directory. The workspace stays read-only. Its
+     * home is a scratch directory of its own, so whatever startup files its shell
+     * reads, a sealed run wrote none of them (S8). Throws where the sandbox
+     * cannot run, so a caller never falls back to the bare shell.
      */
     launchNativeShell(opts: {
         workspace: string;
@@ -1743,9 +1775,9 @@ declare class PlannerShellSandbox {
         shellArgs?: readonly string[];
         env?: NodeJS.ProcessEnv;
     }): Promise<SandboxLaunch>;
-    /** The scratch directory every launch here gets as `$TMPDIR` and `$HOME`, made if it is not there. */
+    /** The scratch directory a sealed run gets as `$TMPDIR` and `$HOME`, made if it is not there. */
     scratchPath(): string;
-    /** The session ended: its scratch directory goes, and a next session starts with a fresh one and its own notice. */
+    /** The session ended: its scratch directories go, and a next session starts with fresh ones and its own notice. */
     end(): void;
     private say;
     private invocation;
@@ -2074,6 +2106,14 @@ interface TaskRunnerFlags {
     /** The manifest's further settings for the task's mode, by setting name — see `RunnerFeatures.modeSettings`. */
     modeSettings: Record<string, string>;
 }
+/**
+ * What a task runner loads of the user's own setup (the `taskRunnerConfig`
+ * setting): `user` is everything the runner would load for the user,
+ * `minimal` only what a task needs — Ordewell's server, the repository's
+ * instructions — so the user's connectors, skills and settings do not ride in
+ * every attempt's context. Runners that cannot narrow their setup ignore it.
+ */
+type TaskRunnerConfig = 'user' | 'minimal';
 /** A plan task driven over the runner's programmatic protocol (ADR-0018, C1). */
 interface TaskStartOptions extends AgentStartCommon {
     kind: 'task';
@@ -2082,6 +2122,8 @@ interface TaskStartOptions extends AgentStartCommon {
     /** The task's runner mode id, as the plan names it. */
     mode: string;
     flags: TaskRunnerFlags;
+    /** What the runner loads of the user's setup; absent means `user`. */
+    runnerConfig?: TaskRunnerConfig;
     /** The attempt's work lands as a commit (ADR-0047): its completion contract asks for the message. */
     commits?: true;
     /**
@@ -2823,6 +2865,8 @@ interface IRunner {
         cancelled?: AbortSignal;
         /** The attempt's work lands as a commit (ADR-0047): its runner is told to write the message in `task_complete`. */
         commits?: true;
+        /** What the runner loads of the user's own setup (the `taskRunnerConfig` setting); absent means all of it. Runners that cannot narrow it ignore it. */
+        runnerConfig?: TaskRunnerConfig;
         /** A script task's body (ADR-0035): only the script runner reads it, and it runs nothing else. */
         script?: ScriptBody;
         /**
@@ -2868,4 +2912,4 @@ interface IRunner {
     activeCount: number;
 }
 
-export { type McpToolContext as $, AUTO_COMMANDS as A, type BashOptions as B, type CatalogModel as C, DEFAULT_PLANNER_ALLOWLIST as D, type DiscoveryCommand as E, type EditPlanArgs as F, type FetchAllProviderModelsOptions as G, type FindSymbolOptions as H, GIT_READONLY_SUBCOMMANDS as I, GREP_DEFAULT_HEAD_LIMIT as J, type GlobOptions as K, type GrepOptions as L, type GrepOutputMode as M, type IApproval as N, type IConfig as O, type IFileSystem as P, type IRunner as Q, type IRunnerSession as R, type InvokedCommand as S, LineBuffer as T, type ListModelsArgs as U, type ListRunnersArgs as V, type LoadSkillArgs as W, type McpClientConfig as X, type McpCredential as Y, type McpRefusal as Z, type McpTool as _, type AgentAdapter as a, type SealedAvailability as a$, type McpToolReply as a0, type MessageTaskArgs as a1, ModelCatalog as a2, type ModelShortcut as a3, ORCHESTRATOR_SHORTCUTS as a4, ORDEWELL_MCP_PATH as a5, ORDEWELL_MCP_SERVER_NAME as a6, type OneTaskArgs as a7, type OrchestratorOption as a8, OrdewellMcpServer as a9, type RunCommandArgs as aA, type RunPlanArgs as aB, type RunnerAuthSpec as aC, type RunnerAuthStatus as aD, type RunnerCommand as aE, type RunnerCommandKind as aF, type RunnerEntry as aG, type RunnerEnv as aH, type RunnerFeatures as aI, type RunnerManifest as aJ, type RunnerMcpServer as aK, type RunnerMode as aL, type RunnerModelDiscovery as aM, type RunnerModelRef as aN, RunnerRegistry as aO, SEALED_LIMITS as aP, SEARCH_EXCLUSIONS as aQ, type SandboxBackend as aR, type SandboxInvocation as aS, type SandboxLaunch as aT, type SandboxLimits as aU, type SandboxProfile as aV, type ScriptBody as aW, type ScriptExit as aX, type ScriptFullOutput as aY, type ScriptRun as aZ, type ScriptStatus as a_, type OwnSealedRuns as aa, type OwnerOnlyFile as ab, PLANNER_EXECUTION_TOOLS as ac, PLANNER_SANDBOX_DOCS as ad, PLANNER_TOOLS as ae, type PlannerAllowlist as af, type PlannerBackendId as ag, type PlannerSandboxAvailability as ah, type PlannerSandboxDeps as ai, PlannerShellSandbox as aj, type PlannerStartOptions as ak, type PlannerTokenScope as al, type PlannerToolHandler as am, type ProjectMcpServer as an, type ProviderCredentialSource as ao, type ProviderModelLists as ap, type ProviderModelsResult as aq, type QueuedTaskMessage as ar, READ_ONLY_TASK_TOOLS as as, REFUSED_COMMANDS as at, type ReadFileOpts as au, type ReadTaskArgs as av, type ResearchShell as aw, type ResearchShellDeps as ax, type RetryTaskArgs as ay, type RuleWord as az, type AgentAdapterFactory as b, type SealedRunOptions as b0, type ShellDialect as b1, type ShellLaunch as b2, type SpawnFn as b3, type StandingDecision as b4, type StructuredEvent as b5, type StructuredTurnEnd as b6, type SubmitPlanArgs as b7, TASK_COMPLETE_TOOL as b8, TASK_COMPLETION_CONTRACT as b9, effectiveApprovalMode as bA, enabledRunners as bB, fetchAllProviderModels as bC, findRunnerCommand as bD, isGranted as bE, isRunnerApproval as bF, knownModelId as bG, mcpClientConfig as bH, ownerOnlyConfigFile as bI, parseAllowlist as bJ, parseApprovalModeSetting as bK, researchShellWarning as bL, researchToolsPath as bM, resolveModelShortcut as bN, resolvePlannerSandbox as bO, resolveProvider as bP, resolveResearchShell as bQ, scopeAllowed as bR, scriptBodyOf as bS, scriptBodyText as bT, scriptTaskText as bU, sharedMcpServer as bV, taskCompletionContract as bW, timeLimitText as bX, toApprovalDecision as bY, toOrchestratorOptions as bZ, toolAllowed as b_, TASK_SEALED_LIMITS as ba, TASK_TOOLS as bb, type TaskCompleteArgs as bc, type TaskDiffArgs as bd, type TaskMessageFrom as be, type TaskModeAgentAdapter as bf, TaskModeUnsupportedError as bg, type TaskOutputArgs as bh, type TaskQueryArgs as bi, type TaskRunCommandArgs as bj, type TaskRunnerFlags as bk, type TaskShell as bl, type TaskShellSite as bm, type TaskStartOptions as bn, type TaskTokenScope as bo, type TaskToolHandler as bp, type TaskWebReads as bq, type ToolOutcome as br, type UsageLimitSignal as bs, approvalScopes as bt, classifyCommand as bu, clearPlannerSandboxCache as bv, clearResearchShellCache as bw, collectProviderCredentials as bx, commandAllowedBy as by, commandLine as bz, type AgentEvent as c, type AgentProcessDeps as d, type AgentStartOptions as e, type AiProvider as f, type AllProviderModels as g, type AnswerApprovalArgs as h, type ApplyPatchArgs as i, type ApprovalAnswer as j, type ApprovalDecision as k, type ApprovalKind as l, type ApprovalMode as m, type ApprovalModeSetting as n, ApprovalPolicy as o, type ApprovalPolicyOptions as p, type ApprovalRequest as q, type ApprovalSource as r, type AttachState as s, type CheckpointAnswer as t, type CheckpointArgs as u, type CommandClassification as v, type CommandTier as w, type CommandWords as x, DEFAULT_SCRIPT_TIMEOUT_MS as y, DENY_ALL as z };
+export { type McpToolContext as $, AUTO_COMMANDS as A, type BashOptions as B, type CatalogModel as C, DEFAULT_PLANNER_ALLOWLIST as D, type DiscoveryCommand as E, type EditPlanArgs as F, type FetchAllProviderModelsOptions as G, type FindSymbolOptions as H, GIT_READONLY_SUBCOMMANDS as I, GREP_DEFAULT_HEAD_LIMIT as J, type GlobOptions as K, type GrepOptions as L, type GrepOutputMode as M, type IApproval as N, type IConfig as O, type IFileSystem as P, type IRunner as Q, type IRunnerSession as R, type InvokedCommand as S, LineBuffer as T, type ListModelsArgs as U, type ListRunnersArgs as V, type LoadSkillArgs as W, type McpClientConfig as X, type McpCredential as Y, type McpRefusal as Z, type McpTool as _, type AgentAdapter as a, type SealedAvailability as a$, type McpToolReply as a0, type MessageTaskArgs as a1, ModelCatalog as a2, type ModelShortcut as a3, ORCHESTRATOR_SHORTCUTS as a4, ORDEWELL_MCP_PATH as a5, ORDEWELL_MCP_SERVER_NAME as a6, type OneTaskArgs as a7, type OrchestratorOption as a8, OrdewellMcpServer as a9, type RunCommandArgs as aA, type RunPlanArgs as aB, type RunnerAuthSpec as aC, type RunnerAuthStatus as aD, type RunnerCommand as aE, type RunnerCommandKind as aF, type RunnerEntry as aG, type RunnerEnv as aH, type RunnerFeatures as aI, type RunnerManifest as aJ, type RunnerMcpServer as aK, type RunnerMode as aL, type RunnerModelDiscovery as aM, type RunnerModelRef as aN, RunnerRegistry as aO, SEALED_LIMITS as aP, SEARCH_EXCLUSIONS as aQ, type SandboxBackend as aR, type SandboxInvocation as aS, type SandboxLaunch as aT, type SandboxLimits as aU, type SandboxProfile as aV, type ScriptBody as aW, type ScriptExit as aX, type ScriptFullOutput as aY, type ScriptRun as aZ, type ScriptStatus as a_, type OwnSealedRuns as aa, type OwnerOnlyFile as ab, PLANNER_EXECUTION_TOOLS as ac, PLANNER_SANDBOX_DOCS as ad, PLANNER_TOOLS as ae, type PlannerAllowlist as af, type PlannerBackendId as ag, type PlannerSandboxAvailability as ah, type PlannerSandboxDeps as ai, PlannerShellSandbox as aj, type PlannerStartOptions as ak, type PlannerTokenScope as al, type PlannerToolHandler as am, type ProjectMcpServer as an, type ProviderCredentialSource as ao, type ProviderModelLists as ap, type ProviderModelsResult as aq, type QueuedTaskMessage as ar, READ_ONLY_TASK_TOOLS as as, REFUSED_COMMANDS as at, type ReadFileOpts as au, type ReadTaskArgs as av, type ResearchShell as aw, type ResearchShellDeps as ax, type RetryTaskArgs as ay, type RuleWord as az, type AgentAdapterFactory as b, toolAllowed as b$, type SealedRunOptions as b0, type ShellDialect as b1, type ShellLaunch as b2, type SpawnFn as b3, type StandingDecision as b4, type StructuredEvent as b5, type StructuredTurnEnd as b6, type SubmitPlanArgs as b7, TASK_COMPLETE_TOOL as b8, TASK_COMPLETION_CONTRACT as b9, commandLine as bA, effectiveApprovalMode as bB, enabledRunners as bC, fetchAllProviderModels as bD, findRunnerCommand as bE, isGranted as bF, isRunnerApproval as bG, knownModelId as bH, mcpClientConfig as bI, ownerOnlyConfigFile as bJ, parseAllowlist as bK, parseApprovalModeSetting as bL, researchShellWarning as bM, researchToolsPath as bN, resolveModelShortcut as bO, resolvePlannerSandbox as bP, resolveProvider as bQ, resolveResearchShell as bR, scopeAllowed as bS, scriptBodyOf as bT, scriptBodyText as bU, scriptTaskText as bV, sharedMcpServer as bW, taskCompletionContract as bX, timeLimitText as bY, toApprovalDecision as bZ, toOrchestratorOptions as b_, TASK_SEALED_LIMITS as ba, TASK_TOOLS as bb, type TaskCompleteArgs as bc, type TaskDiffArgs as bd, type TaskMessageFrom as be, type TaskModeAgentAdapter as bf, TaskModeUnsupportedError as bg, type TaskOutputArgs as bh, type TaskQueryArgs as bi, type TaskRunCommandArgs as bj, type TaskRunnerConfig as bk, type TaskRunnerFlags as bl, type TaskShell as bm, type TaskShellSite as bn, type TaskStartOptions as bo, type TaskTokenScope as bp, type TaskToolHandler as bq, type TaskWebReads as br, type ToolOutcome as bs, type UsageLimitSignal as bt, approvalScopes as bu, classifyCommand as bv, clearPlannerSandboxCache as bw, clearResearchShellCache as bx, collectProviderCredentials as by, commandAllowedBy as bz, type AgentEvent as c, type AgentProcessDeps as d, type AgentStartOptions as e, type AiProvider as f, type AllProviderModels as g, type AnswerApprovalArgs as h, type ApplyPatchArgs as i, type ApprovalAnswer as j, type ApprovalDecision as k, type ApprovalKind as l, type ApprovalMode as m, type ApprovalModeSetting as n, ApprovalPolicy as o, type ApprovalPolicyOptions as p, type ApprovalRequest as q, type ApprovalSource as r, type AttachState as s, type CheckpointAnswer as t, type CheckpointArgs as u, type CommandClassification as v, type CommandTier as w, type CommandWords as x, DEFAULT_SCRIPT_TIMEOUT_MS as y, DENY_ALL as z };

package/dist/{ModeResolver-DyXeZ9ib.d.ts → ModeResolver-CHsaoV7M.d.ts}

@@ -1,4 +1,4 @@
-import { az as RunnerId } from './Task-BL4Idm9r.js';
+import { aK as RunnerId } from './Task-BTEH-ztX.js';
 
 interface RunnerModeInfo {
     id: string;

package/dist/{ModeResolver-BDAgouuE.d.mts → ModeResolver-b_7bPlBS.d.mts}

@@ -1,4 +1,4 @@
-import { az as RunnerId } from './Task-BL4Idm9r.mjs';
+import { aK as RunnerId } from './Task-BTEH-ztX.mjs';
 
 interface RunnerModeInfo {
     id: string;