@ordewell/core 0.12.0 → 0.12.2

package/dist/{chunk-BKTDYGIP.mjs → chunk-2IFKPYPO.mjs}

@@ -7,7 +7,7 @@ import {
   flattenTasksWithParents,
   inheritedSkills,
   skillNames
-} from "./chunk-F6WS3JLQ.mjs";
+} from "./chunk-PKJTN2PD.mjs";
 
 // src/models/ScriptTask.ts
 var DEFAULT_SCRIPT_TIMEOUT_MS = 10 * 6e4;
@@ -168,6 +168,7 @@ function loopErrors(tasks) {
     const fail = (message) => errors.push({ taskId: check.id, field: "loop", message: `${where} ${message}` });
     if (parent) fail(`has a "loop", but only a top-level task can be a loop's check`);
     if (check.type === "user") fail("is a manual task, so it cannot be a loop's check: a check is an AI task, which reports through task_complete, or a script task, whose exit status decides");
+    if (check.type === "delegated") fail("is a delegated task, so it cannot be a loop's check: a round would start a new child on what is left of its budget. Add a check that depends on it, and put the loop on that");
     if (check.subtasks?.length) fail("is a loop's check, which has no subtasks: each round runs it again whole");
     if (!isRoundCount(loop.maxRounds)) fail(roundsMessage(loop.maxRounds));
     if (!Array.isArray(loop.body) || loop.body.length === 0) fail('has a "loop" with an empty "body": name the tasks that fix what it finds');
@@ -200,6 +201,7 @@ function loopErrors(tasks) {
       bodyOwner.set(id, check);
       if (body.loop) fail(`names "${body.title}" in its loop's "body", which has a loop of its own: a loop has no loop inside its body`);
       if (body.type === "user") fail(`names manual task "${body.title}" in its loop's "body": a body is AI or script tasks, which Ordewell runs again each round`);
+      if (body.type === "delegated") fail(`names delegated task "${body.title}" in its loop's "body": a round would start a new child on what is left of its budget`);
       if (body.subtasks?.length) fail(`names "${body.title}" in its loop's "body", which has subtasks: each round runs a body task again whole, so make each step a task of the body`);
     }
   }
@@ -229,10 +231,25 @@ function loopRemovalRefusal(task) {
   return task.loop ? `"${task.title}" is a loop's check: remove its body tasks first, or drop its loop ("loop": null), so they do not run on their own` : null;
 }
 function loopReshapeRefusal(tasks, target, action) {
+  if (target.type === "delegated") return `"${target.title}" is a delegated task and cannot be ${action}: remove it and add what should replace it`;
   if (target.loop) return `"${target.title}" is a loop's check and cannot be ${action}: drop its loop first ("loop": null)`;
   return checkOf(tasks, target.id) ? `"${target.title}" is in a loop's body and cannot be ${action}: take it out of the loop first` : null;
 }
 
+// src/models/lineBreaks.ts
+var BREAKS = "\\n\\v\\f\\r\\u0085\\u2028\\u2029";
+var LINE_BREAK = new RegExp(`\\r\\n|[${BREAKS}]`);
+var ONE_LINE = new RegExp(`^[^${BREAKS}]*$`);
+function splitLines(text2) {
+  return text2.split(LINE_BREAK);
+}
+function quotedLine(text2) {
+  return JSON.stringify(text2).replace(/[\u0085\u2028\u2029]/g, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function onOneLine(text2) {
+  return ONE_LINE.test(text2) ? text2 : quotedLine(text2);
+}
+
 // src/services/JsonExtractor.ts
 var PLAN_ENVELOPE_KEY = "tasks";
 var TASK_OPS_ENVELOPE_KEY = "taskOps";
@@ -542,6 +559,173 @@ function clampThinkingEffort(effort, variants) {
   return void 0;
 }
 
+// src/services/Mandate.ts
+var GRANTS = ["observe", "steer", "control", "replan", "approve", "delegate", "effect", "research", "merge"];
+var FLOOR_GRANTS = ["observe", "steer", "control", "replan", "approve", "merge"];
+var SHAPE_LIMITS = {
+  depth: { default: 2, hard: 4 },
+  delegatedTasks: { default: 8, hard: 30 },
+  tasksPerPlan: { default: 30, hard: 100 }
+};
+var DEFAULT_CHILD_WALL_CLOCK_MS = 24 * 60 * 60 * 1e3;
+function mandateRefusalText({ level, field, asked, there }) {
+  return `Level ${level} refused ${field}: asked ${asked}, and there is ${there}.`;
+}
+var LEVEL_GRANTS = {
+  off: ["research"],
+  watch: ["observe", "research"],
+  act: ["observe", "steer", "control", "replan", "research", "merge"]
+};
+var DELEGATED_GRANTS = [...FLOOR_GRANTS, "research", "delegate"];
+function rootMandate(settings) {
+  const effect = (settings.effects?.rules.length ?? 0) > 0;
+  const delegation = settings.delegationTokens > 0;
+  const effectRules = settings.effects ? [settings.effects] : [];
+  return {
+    grants: /* @__PURE__ */ new Set([
+      ...LEVEL_GRANTS[settings.level],
+      ...settings.autorun ? ["approve"] : [],
+      ...effect ? ["effect"] : [],
+      ...delegation ? ["delegate"] : []
+    ]),
+    grantable: new Set(delegation ? [...DELEGATED_GRANTS, ...effect ? ["effect"] : []] : []),
+    autonomy: settings.autonomous ? "full" : "guarded",
+    limits: {
+      tokens: settings.delegationTokens,
+      wallClockMs: null,
+      depth: SHAPE_LIMITS.depth.default,
+      delegatedTasks: SHAPE_LIMITS.delegatedTasks.default,
+      tasksPerPlan: SHAPE_LIMITS.tasksPerPlan.default,
+      runners: settings.runners,
+      models: settings.models
+    },
+    exclusions: { protectedPaths: [] },
+    effectRules,
+    ownEffectRules: effectRules
+  };
+}
+function heldMandate(saved, ancestors) {
+  const within = (grants) => new Set([...grants].filter((grant) => ancestors.every((ancestor) => ancestor.grantable.has(grant))));
+  const effectRules = [...ancestors.flatMap((ancestor) => ancestor.effectRules), ...saved.ownEffectRules];
+  return { ...saved, grants: within(saved.grants), grantable: within(saved.grantable), effectRules };
+}
+var listed = (grants) => [...grants].sort().join(", ") || "nothing";
+var lesser = (limit) => (parent, request) => {
+  const { hard } = SHAPE_LIMITS[limit];
+  const asked = request[limit];
+  if (asked !== void 0 && asked > hard) return { refused: { field: `limits.${limit}`, asked: String(asked), there: `a hard limit of ${hard}` } };
+  return { value: Math.min(parent[limit], asked ?? parent[limit]) };
+};
+function intersectModels(parent, asked = {}) {
+  const models = { ...asked, ...parent };
+  for (const runner of Object.keys(parent)) {
+    if (asked[runner]) models[runner] = parent[runner].filter((model) => asked[runner].includes(model));
+  }
+  return models;
+}
+var LIMIT_RULES = {
+  tokens: ({ tokens }, { tokens: asked }) => {
+    if (asked === void 0 || asked <= 0 || asked > tokens) return { refused: { field: "limits.tokens", asked: asked === void 0 ? "none" : String(asked), there: String(tokens) } };
+    return { value: asked };
+  },
+  wallClockMs: ({ wallClockMs: left }, { wallClockMs: asked }) => {
+    if (asked === void 0) return { value: left === null ? DEFAULT_CHILD_WALL_CLOCK_MS : Math.min(left, DEFAULT_CHILD_WALL_CLOCK_MS) };
+    if (asked <= 0 || left !== null && asked > left) return { refused: { field: "limits.wallClockMs", asked: String(asked), there: left === null ? "no limit" : String(left) } };
+    return { value: asked };
+  },
+  depth: ({ depth }, { depth: asked }) => {
+    if (depth <= 0) return { refused: { field: "limits.depth", asked: "a child", there: "no depth left" } };
+    const { hard } = SHAPE_LIMITS.depth;
+    if (asked !== void 0 && asked > hard) return { refused: { field: "limits.depth", asked: String(asked), there: `a hard limit of ${hard}` } };
+    return { value: Math.min(depth - 1, asked ?? depth - 1) };
+  },
+  delegatedTasks: lesser("delegatedTasks"),
+  tasksPerPlan: lesser("tasksPerPlan"),
+  runners: ({ runners }, { runners: asked }) => ({ value: asked ? runners.filter((runner) => asked.includes(runner)) : runners }),
+  models: ({ models }, { models: asked }) => ({ value: intersectModels(models, asked) })
+};
+function handedOn(parent, request) {
+  const asked = /* @__PURE__ */ new Set([...FLOOR_GRANTS, ...request.grants ?? []]);
+  const lost = FLOOR_GRANTS.some((grant) => !parent.grantable.has(grant));
+  if (lost) return { refused: { field: "grants", asked: listed(asked), there: listed(parent.grantable) } };
+  return { value: new Set([...asked].filter((grant) => parent.grantable.has(grant))) };
+}
+var MANDATE_RULES = {
+  grants: handedOn,
+  grantable: handedOn,
+  autonomy: ({ autonomy }, { autonomy: asked }) => ({ value: autonomy === "guarded" || asked === "guarded" ? "guarded" : "full" }),
+  limits: ({ limits }, request) => applyRules(LIMIT_RULES, limits, request),
+  exclusions: ({ exclusions }, { protectedPaths }) => ({ value: { protectedPaths: [.../* @__PURE__ */ new Set([...exclusions.protectedPaths, ...protectedPaths ?? []])] } }),
+  effectRules: ({ effectRules }, { effectRules: asked }) => ({ value: asked ? [...effectRules, asked] : effectRules }),
+  ownEffectRules: (_parent, { effectRules: asked }) => ({ value: asked ? [asked] : [] })
+};
+function applyRules(rules, parent, request) {
+  const value = {};
+  for (const key of Object.keys(rules)) {
+    const ruled = rules[key](parent, request);
+    if ("refused" in ruled) return ruled;
+    value[key] = ruled.value;
+  }
+  return { value };
+}
+function narrow(parent, request) {
+  const ruled = applyRules(MANDATE_RULES, parent, request);
+  return "refused" in ruled ? { ok: false, refusal: { level: request.level, ...ruled.refused } } : { ok: true, mandate: ruled.value };
+}
+function delegatedRequest(task, level) {
+  return {
+    level,
+    ...task.grants ? { grants: task.grants } : {},
+    ...task.budget?.tokens !== void 0 ? { tokens: task.budget.tokens } : {},
+    ...task.budget?.wallClockMs !== void 0 ? { wallClockMs: task.budget.wallClockMs } : {},
+    ...task.protectedPaths ? { protectedPaths: task.protectedPaths } : {}
+  };
+}
+var COMMAND_GRANTS = {
+  run_plan: "control",
+  run_task: "control",
+  stop_task: "control",
+  stop_run: "control",
+  retry_task: "control",
+  message_task: "steer",
+  answer_approval: "steer",
+  merge_all: "merge",
+  skip_task: "control",
+  force_start: null,
+  mark_complete: null,
+  mark_not_done: null,
+  revert_task: null,
+  interrupt_task: null,
+  force_send_queued: null,
+  remove_queued: null,
+  cancel_resume: null,
+  answer_checkpoint: "steer",
+  approve_review: null,
+  run_script: "control"
+};
+function allowsCommand(mandate, command) {
+  const grant = COMMAND_GRANTS[command];
+  return grant !== null && mandate.grants.has(grant);
+}
+function missingGrant(depth, mandate, needed) {
+  return `Level ${depth} refused this: it needs the ${needed} grant, and this node holds ${listed(mandate.grants)}.`;
+}
+var SCRIPT_PAST_THE_RULES = "its body is not covered at every level of the effect rules, and it would run unsealed";
+var TOOL_GRANTS = [
+  ...Object.entries(COMMAND_GRANTS).flatMap(([tool, grant]) => grant ? [[tool, grant]] : []),
+  ["submit_plan", "replan"],
+  ["edit_plan", "replan"]
+];
+function withheldPlannerTools(mandate) {
+  return TOOL_GRANTS.filter(([, grant]) => !mandate.grants.has(grant)).map(([tool]) => tool);
+}
+function autonomousAt(child, global) {
+  return child ? child.mandate("off").autonomy === "full" : global;
+}
+function rootAuthority(settings) {
+  return { depth: 0, mandate: (level) => rootMandate({ ...settings(), level }) };
+}
+
 // src/services/TaskAssignment.ts
 function liveModelRefusal(task) {
   return `"${task.title}" has a live runner, so its model and effort cannot change now: stop the task first, or use the runner's own /model`;
@@ -597,8 +781,8 @@ function resolveAssignment(write) {
   const live = writer !== "runner" && !!before && !!catalog.liveRunner?.(before.id);
   if (live && moved) return { ok: false, field: "assignedRunner", error: liveRunnerRefusal({ title }) };
   if (live && !sameAssignment(before?.assignedModel, written.assignedModel)) return { ok: false, field: "assignedModel", error: liveModelRefusal({ title }) };
-  if (written.type !== "ai") return { ok: true, task: written, adjustments: [] };
-  const mode = modeFor(write, written, moved);
+  if (written.type !== "ai" && written.type !== "delegated") return { ok: true, task: written, adjustments: [] };
+  const mode = written.type === "delegated" ? { ok: true, mode: void 0 } : modeFor(write, written, moved);
   if (!mode.ok) return { ok: false, field: "taskMode", error: mode.error };
   const model = live ? { ok: true, assignment: written.assignedModel } : modelFor(write, moved);
   if (!model.ok) return { ok: false, field: "assignedModel", error: model.error };
@@ -683,6 +867,179 @@ function resolveAssignments(tasks, planned, catalog) {
   return { tasks: walk(tasks), adjustments };
 }
 
+// src/models/Delegation.ts
+function countChildTasks(statuses) {
+  const counts = { completed: 0, running: 0, waiting: 0, pending: 0, failed: 0, skipped: 0 };
+  for (const status of statuses) {
+    if (status === "completed") counts.completed += 1;
+    else if (status === "in_progress") counts.running += 1;
+    else if (status === "awaiting_user") counts.waiting += 1;
+    else if (status === "failed") counts.failed += 1;
+    else if (status === "skipped") counts.skipped += 1;
+    else counts.pending += 1;
+  }
+  return counts;
+}
+var SCOPE_LIMITS = { item: 200, items: 50 };
+var NOT_A_DELEGATED_TASKS_FIELDS = ["prompt", "taskMode", "skills", "userSteps", "ops", "commands", "script", "timeoutMs", "research"];
+var DELEGATED_FIELDS = ["goal", "budget", "grants", "protectedPaths", "scope"];
+var DELEGATION_UNAVAILABLE = "delegation is not available in this session";
+function notOnADelegatedMessage(fields) {
+  return `is a delegated task, which holds a goal for a child plan: leave out ${fields.map((f) => `"${f}"`).join(", ")}`;
+}
+function isBudget(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const { tokens } = value;
+  return typeof tokens === "number" && Number.isInteger(tokens) && tokens > 0;
+}
+function wallClockOk(budget) {
+  const { wallClockMs } = budget;
+  return wallClockMs === void 0 || Number.isInteger(wallClockMs) && wallClockMs > 0;
+}
+function readsOnly(task, runnerModes) {
+  if (task.type !== "ai") return false;
+  const mode = runnerModes ? taggedReadOnlyMode(runnerModes[task.assignedRunner]) : "plan";
+  return mode !== void 0 && task.taskMode === mode;
+}
+function runnerUnread(task, runnerModes) {
+  return task.type === "ai" && runnerModes !== void 0 && runnerModes[task.assignedRunner] === void 0;
+}
+function atAGate(task) {
+  return task.type === "script" && !task.readOnly || task.ops === true;
+}
+function reaches(tasks, from, target) {
+  const byId = new Map(tasks.map((t) => [t.id, t]));
+  const seen = /* @__PURE__ */ new Set();
+  const walk = (task) => task.dependencies.some((id) => {
+    if (seen.has(id)) return false;
+    seen.add(id);
+    const dep = byId.get(id);
+    return dep !== void 0 && (target(dep) || walk(dep));
+  });
+  return walk(from);
+}
+function delegationErrors(tasks, rules = {}) {
+  const errors = [];
+  const delegated = tasks.filter((t) => t.type === "delegated");
+  const fail = (task, field, message) => errors.push({ taskId: task.id, field, message });
+  for (const task of delegated) {
+    const where = `Task "${task.title}"`;
+    if (typeof task.goal !== "string" || !task.goal.trim()) fail(task, "goal", `${where} is a delegated task with no "goal": say what its child plan must achieve`);
+    if (!isBudget(task.budget)) fail(task, "budget", `${where} is a delegated task with no "budget": give it {"tokens": <a whole number>}, and "wallClockMs" if it has a time limit`);
+    else if (!wallClockOk(task.budget)) fail(task, "budget", `${where} has a "wallClockMs" that is not a whole number of milliseconds above 0`);
+    const paths = task.protectedPaths;
+    if (!task.readOnly && (!Array.isArray(paths) || paths.length === 0 || !paths.every((p) => typeof p === "string" && p.trim()))) {
+      fail(task, "protectedPaths", `${where} is a delegated task that lands, with no "protectedPaths": name the paths its child may not change, what its check runs and the configuration that runs it`);
+    }
+    if (task.scope !== void 0 && !scopeOk(task.scope)) fail(task, "scope", `${where} has a "scope" that is not lists of text: "paths", "provides" and "consumes", at most ${SCOPE_LIMITS.items} items of one line and ${SCOPE_LIMITS.item} characters each`);
+    const unknown = (task.grants ?? []).filter((grant) => !GRANTS.includes(grant));
+    if (unknown.length > 0) fail(task, "grants", `${where} asks in "grants" for ${unknown.map((g) => `"${g}"`).join(", ")}, which no grant is: one of ${GRANTS.join(", ")}`);
+    const dependents = tasks.filter((t) => t.dependencies.includes(task.id));
+    if (task.readOnly) {
+      for (const script of dependents.filter((t) => t.type === "script")) {
+        fail(script, "dependencies", `Task "${script.title}" depends on "${task.title}", which is a read-only delegated task, which lands nothing, so a script has nothing to run on: make the check a read-only AI task, which reads its handoff`);
+      }
+    }
+    if (!dependents.some((t) => judges(t, task, rules.runnerModes))) {
+      fail(task, "dependencies", `${where} is a delegated task with no check: add a read-only AI task${task.readOnly ? ", which reads its handoff," : ', or a script task marked "readOnly",'} that depends on it directly`);
+    }
+  }
+  for (const task of tasks.filter((t) => t.type === "script" && t.readOnly)) {
+    if (rules.canSeal === false) fail(task, "readOnly", `Task "${task.title}" is a read-only script task, and this machine has no sandbox to seal one in: make the check a read-only AI task`);
+  }
+  for (const check of tasks.filter((t) => t.loop)) {
+    if (!reaches(tasks, check, (t) => t.type === "delegated")) continue;
+    for (const id of check.loop?.body ?? []) {
+      const body = tasks.find((t) => t.id === id);
+      if (body && atAGate(body)) {
+        fail(body, "loop", `Task "${check.title}" names "${body.title}" in its loop's "body", which waits at a merge gate for work a delegated task's check holds back: make the fix a change task, cut from the integration tip`);
+      }
+    }
+  }
+  return errors;
+}
+function scopeOk(scope) {
+  if (typeof scope !== "object" || scope === null) return false;
+  const { paths, provides, consumes } = scope;
+  const itemOk = (item) => typeof item === "string" && item.trim().length > 0 && item.length <= SCOPE_LIMITS.item && ONE_LINE.test(item);
+  return [paths, provides, consumes].every((list) => list === void 0 || Array.isArray(list) && list.length <= SCOPE_LIMITS.items && list.every(itemOk));
+}
+function judges(task, delegated, runnerModes) {
+  return readsOnly(task, runnerModes) || !delegated.readOnly && task.type === "script" && task.readOnly === true;
+}
+function checksOf(tasks, delegated, rules = {}) {
+  return tasks.filter((t) => t.dependencies.includes(delegated.id) && (judges(t, delegated, rules.runnerModes) || runnerUnread(t, rules.runnerModes)));
+}
+function checksHoldingMerge(tasks, awaitsMerge, rules = {}) {
+  return tasks.filter((t) => t.type === "delegated" && awaitsMerge(t.id)).flatMap((t) => checksOf(tasks, t, rules)).filter((check) => check.status !== "completed" && check.status !== "skipped");
+}
+function commandsOf({ script, commands }) {
+  const written = splitLines(script ?? "").flatMap((line) => line.split(/[;|&]+/)).map((command) => command.trim()).filter((command) => !command.startsWith("#"));
+  return [...written, ...(commands ?? []).map((argv) => argv.join(" "))].filter(Boolean);
+}
+function checkWords(tasks) {
+  const delegated = new Set(tasks.filter((t) => t.type === "delegated").map((t) => t.id));
+  return tasks.filter((t) => t.dependencies.some((id) => delegated.has(id))).flatMap((t) => [
+    ...[t.title, t.prompt ?? ""].map((text2) => ({ text: text2, command: false })),
+    ...commandsOf(t).map((text2) => ({ text: text2, command: true }))
+  ]);
+}
+function checksDelegatedTask(tasks, task, rules = {}) {
+  if (!readsOnly(task, rules.runnerModes) && !runnerUnread(task, rules.runnerModes) && !(task.type === "script" && task.readOnly)) return false;
+  return tasks.some((t) => t.type === "delegated" && task.dependencies.includes(t.id));
+}
+function planSize(tasks) {
+  return flattenTasks(tasks).length;
+}
+function underProtectedPath(file, protectedPath) {
+  const rule = protectedPath.trim().replace(/^\.\//, "").replace(/\\/g, "/");
+  if (!rule) return false;
+  if (rule.includes("*")) return globRegExp(rule).test(file);
+  const bare = rule.replace(/\/+$/, "");
+  return file === bare || file.startsWith(`${bare}/`);
+}
+function fixedStart(rule) {
+  const bare = rule.trim().replace(/^\.\//, "").replace(/\\/g, "/");
+  const star = bare.indexOf("*");
+  return star === -1 ? bare : bare.slice(0, star);
+}
+function pathsMeet(a, b) {
+  if (underProtectedPath(a.replace(/\/+$/, ""), b) || underProtectedPath(b.replace(/\/+$/, ""), a)) return true;
+  if (!a.includes("*") || !b.includes("*")) return false;
+  const [one, other] = [fixedStart(a), fixedStart(b)];
+  return one.startsWith(other) || other.startsWith(one);
+}
+function narrower(a, b) {
+  return b.includes("*") || !a.includes("*") && a.length >= b.length ? a : b;
+}
+function ordered(tasks, a, b) {
+  return reaches(tasks, a, (t) => t.id === b.id) || reaches(tasks, b, (t) => t.id === a.id);
+}
+function scopeOverlaps(tasks) {
+  const scoped = tasks.filter((t) => t.type === "delegated" && t.scope);
+  const said = [];
+  scoped.forEach((a, i) => {
+    for (const b of scoped.slice(i + 1)) {
+      if (ordered(tasks, a, b)) continue;
+      const declared = (a.scope?.paths ?? []).flatMap((one) => (b.scope?.paths ?? []).filter((other) => pathsMeet(one, other)).map((other) => narrower(one, other)));
+      if (declared.length > 0) said.push(`Tasks "${a.title}" and "${b.title}" both declare ${[...new Set(declared)].join(", ")}, and nothing orders them: give one a dependency on the other, or name an owner.`);
+      for (const name of a.scope?.provides ?? []) {
+        if (b.scope?.provides?.includes(name)) said.push(`Tasks "${a.title}" and "${b.title}" both provide "${name}", and nothing orders them: name one owner.`);
+      }
+      for (const [producer, consumer] of [[a, b], [b, a]]) {
+        for (const name of producer.scope?.provides ?? []) {
+          if (consumer.scope?.consumes?.includes(name)) said.push(`Task "${consumer.title}" consumes "${name}", which "${producer.title}" provides, and nothing orders them: a dependency puts the producer first; without one it gets a line when "${producer.title}" lands.`);
+        }
+      }
+    }
+  });
+  return said;
+}
+function globRegExp(rule) {
+  const pattern = rule.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*\/?|\*/g, (star) => star === "*" ? "[^/]*" : "(?:.*/)?");
+  return new RegExp(`^${pattern}(?:/.*)?$`);
+}
+
 // src/services/PlannedTask.ts
 import { v4 as uuidv4 } from "uuid";
 var MODE_NOT_THE_PLANNERS = `"taskMode" is the user's to choose: set "readOnly": true on a task that must not change files, and leave it out otherwise`;
@@ -701,6 +1058,28 @@ function notOnAScript(raw) {
     return value !== void 0 && value !== null && value !== false && !(Array.isArray(value) && value.length === 0);
   });
 }
+function notOnADelegated(raw) {
+  return NOT_A_DELEGATED_TASKS_FIELDS.filter((f) => {
+    const value = raw[f];
+    return value !== void 0 && value !== null && value !== false && !(Array.isArray(value) && value.length === 0);
+  });
+}
+function delegatedFields(raw, base) {
+  const list = (value) => Array.isArray(value) ? value.map(String) : void 0;
+  const goal = text(raw.goal) ?? base.goal;
+  const budget = (isRecord(raw.budget) ? raw.budget : void 0) ?? base.budget;
+  const grants = list(raw.grants) ?? base.grants;
+  const protectedPaths = list(raw.protectedPaths) ?? base.protectedPaths;
+  const scope = (isRecord(raw.scope) ? raw.scope : void 0) ?? base.scope;
+  return {
+    ...goal !== void 0 ? { goal } : {},
+    ...budget ? { budget } : {},
+    ...grants ? { grants } : {},
+    ...protectedPaths ? { protectedPaths } : {},
+    ...scope ? { scope } : {},
+    ...raw.readOnly === true || raw.readOnly === void 0 && base.readOnly ? { readOnly: true } : {}
+  };
+}
 function notOnAScriptMessage(fields) {
   return `is a script task, which runs its "commands" or "script" with no model: leave out ${fields.map((f) => `"${f}"`).join(", ")}`;
 }
@@ -761,27 +1140,35 @@ function plannedTask(spec, catalog, at = {}) {
   const plannerId = text(raw.id);
   const id = freshIds || !plannerId ? newId() : plannerId;
   if (freshIds && plannerId) renamed.set(plannerId, id);
-  const type = raw.type === "user" || raw.type === "ai" || raw.type === "script" ? raw.type : base.type ?? "ai";
+  const delegating = catalog.delegationRefusal === null;
+  const type = raw.type === "user" || raw.type === "ai" || raw.type === "script" || raw.type === "delegated" ? raw.type : base.type ?? "ai";
   const ai = type === "ai";
   const script = type === "script";
+  const delegated = type === "delegated";
+  const sealedScript = script && (catalog.sealsScripts?.({ ...Array.isArray(raw.commands) ? { commands: raw.commands } : {}, ...typeof raw.script === "string" ? { script: raw.script } : {}, ...typeof raw.timeoutMs === "number" ? { timeoutMs: raw.timeoutMs } : {} }) === true || delegating && raw.readOnly === true);
   const assignedRunner = text(raw.assignedRunner) ?? base.assignedRunner ?? catalog.runners[0] ?? DEFAULT_RUNNERS[0];
   const description = text(raw.description) ?? base.description ?? title;
-  const notScripts = script ? notOnAScript(raw) : [];
+  const notScripts = script ? notOnAScript(raw).filter((f) => !(sealedScript && f === "readOnly")) : [];
   if (notScripts.length > 0) errors.push({ taskId: id, field: notScripts[0], message: `${where} ${notOnAScriptMessage(notScripts)}` });
+  if (delegated) {
+    if (!delegating) errors.push({ taskId: id, field: "type", message: catalog.delegationRefusal ?? `${where} is a delegated task, and ${DELEGATION_UNAVAILABLE}.` });
+    const extra = notOnADelegated(raw);
+    if (extra.length > 0) errors.push({ taskId: id, field: extra[0], message: `${where} ${notOnADelegatedMessage(extra)}` });
+  }
   const body = bodyFields(raw, base);
   const shapeErrors = scriptBodyErrors({ type, ...body.raw }).filter((e) => body.malformed.has(e.field));
   for (const e of shapeErrors) errors.push({ taskId: id, field: e.field, message: `${where} ${e.message}` });
   const loop = loopSpec(raw.loop);
   if ("error" in loop) errors.push({ taskId: id, field: "loop", message: `${where} ${loop.error}` });
   if (raw.ops === true && !ai && !script) errors.push({ taskId: id, field: "ops", message: `${where} ${opsPlacementRefusal(type, !!parent)}` });
-  if (raw.taskMode !== void 0 && !script) ignored.push({ taskId: id, field: "taskMode", message: `${where}: ${MODE_NOT_THE_PLANNERS}` });
+  if (raw.taskMode !== void 0 && !script && !delegated) ignored.push({ taskId: id, field: "taskMode", message: `${where}: ${MODE_NOT_THE_PLANNERS}` });
   if (type === "user" && raw.readOnly === true) ignored.push({ taskId: id, field: "readOnly", message: `${where}: ${MANUAL_NOT_READ_ONLY}` });
   const ops = raw.ops !== void 0 ? raw.ops === true : base.ops;
   if (ai && ops && raw.readOnly === true) ignored.push({ taskId: id, field: "readOnly", message: `${where}: ${OPS_NOT_READ_ONLY}` });
   const asked = typeof raw.readOnly === "boolean" ? raw.readOnly : void 0;
   const readOnly = ai && !ops && (asked ?? from?.readOnly ?? parent?.readOnly ?? false);
   if (raw.research !== void 0 && typeof raw.research !== "boolean") errors.push({ taskId: id, field: "research", message: `${where}: "research" must be a boolean` });
-  const assignedModel = ai ? modelOf(raw, base.assignedModel) : void 0;
+  const assignedModel = ai || delegated ? modelOf(raw, base.assignedModel) : void 0;
   const slice = (value) => value === "AFK" || value === "HITL" ? value : void 0;
   const autonomy = ai ? slice(raw.autonomy) ?? base.autonomy ?? parent?.autonomy : void 0;
   const sliceType = slice(raw.sliceType) ?? base.sliceType ?? (ai ? parent?.sliceType : void 0);
@@ -804,7 +1191,7 @@ function plannedTask(spec, catalog, at = {}) {
     type,
     dependencies: Array.isArray(raw.dependencies) ? raw.dependencies.map(String) : base.dependencies ?? [],
     // What a merge or split carries over for a runner is nothing a script runs.
-    prompt: script ? void 0 : text(raw.prompt) || base.prompt || (ai ? description || title || void 0 : void 0),
+    prompt: script || delegated ? void 0 : text(raw.prompt) || base.prompt || (ai ? description || title || void 0 : void 0),
     userSteps: Array.isArray(raw.userSteps) ? raw.userSteps.map((s) => isRecord(s) ? s : {}).map((s) => ({ order: Number(s.order ?? 0), instruction: String(s.instruction ?? ""), completed: false })) : base.userSteps,
     subtasks,
     assignedModel,
@@ -812,15 +1199,17 @@ function plannedTask(spec, catalog, at = {}) {
     autonomy,
     sliceType,
     userStoriesCovered: Array.isArray(raw.userStoriesCovered) ? raw.userStoriesCovered.map(String) : base.userStoriesCovered,
-    ops: script ? void 0 : ops,
+    ops: script || delegated ? void 0 : ops,
     research: typeof raw.research === "boolean" ? raw.research : base.research,
-    skills: script ? void 0 : from ? inheritedSkills(raw.skills, base.skills) : skillNames(raw.skills),
+    skills: script || delegated ? void 0 : from ? inheritedSkills(raw.skills, base.skills) : skillNames(raw.skills),
     ...body.fields,
-    ..."loop" in loop && loop.loop ? { loop: loop.loop } : {}
+    ..."loop" in loop && loop.loop ? { loop: loop.loop } : {},
+    ...delegated ? delegatedFields(raw, base) : {},
+    ...sealedScript ? { readOnly: true } : {}
   };
-  let taskMode = script ? void 0 : base.taskMode;
+  let taskMode = script || delegated ? void 0 : base.taskMode;
   let landedModel = assignedModel;
-  if (ai && catalog.runners.includes(assignedRunner)) {
+  if ((ai || delegated) && catalog.runners.includes(assignedRunner)) {
     const resolved = resolveAssignment({
       writer: catalog.models ? "edit" : "plan",
       task: { ...createTask(fields), taskMode },
@@ -831,7 +1220,7 @@ function plannedTask(spec, catalog, at = {}) {
     if (!resolved.ok) {
       errors.push({ taskId: id, field: resolved.field === "taskMode" ? "readOnly" : resolved.field, message: `${where}: ${resolved.error}` });
     } else {
-      taskMode = resolved.task.taskMode;
+      taskMode = delegated ? void 0 : resolved.task.taskMode;
       landedModel = resolved.task.assignedModel;
       adjustments.push(...resolved.adjustments);
     }
@@ -843,13 +1232,13 @@ function plannedTask(spec, catalog, at = {}) {
 }
 function checkPlanRunners(tasks, runners) {
   if (!runners) return [];
-  return flattenTasksWithParents(tasks).filter(({ task: t }) => t.type === "ai" && !runners.includes(t.assignedRunner)).map(({ task: t, parent }) => ({
+  return flattenTasksWithParents(tasks).filter(({ task: t }) => (t.type === "ai" || t.type === "delegated") && !runners.includes(t.assignedRunner)).map(({ task: t, parent }) => ({
     taskId: t.id,
     field: "assignedRunner",
     message: `${taskWhere(t.title, parent?.title)} has invalid assignedRunner "${t.assignedRunner}". Expected one of: ${runners.join(", ")}`
   }));
 }
-function checkPlanInvariants(tasks, runners, runnerModes) {
+function checkPlanInvariants(tasks, runners, runnerModes, delegation = {}) {
   const rows = flattenTasksWithParents(tasks);
   const errors = [];
   const seen = /* @__PURE__ */ new Set();
@@ -878,6 +1267,10 @@ function checkPlanInvariants(tasks, runners, runnerModes) {
       const extra = notAScriptsFields(t);
       if (extra.length > 0) fail(extra[0], `${where} ${notOnAScriptMessage(extra)}`);
     }
+    if (t.type === "delegated") {
+      if (parent !== null) fail("type", `${where} is a delegated task: only a top-level task can be delegated`);
+      if (t.subtasks?.length) fail("subtasks", `${where} is a delegated task, which has no subtasks: its child plan's tasks are its child's own`);
+    }
     for (const e of scriptBodyErrors(t)) fail(e.field, `${where} ${e.message}`);
     if (t.ops && t.taskMode !== void 0 && t.taskMode === taggedReadOnlyMode(runnerModes?.[t.assignedRunner])) {
       fail("taskMode", `${where} is an ops task, which acts in the workspace, so it cannot use the read-only profile`);
@@ -885,6 +1278,7 @@ function checkPlanInvariants(tasks, runners, runnerModes) {
   }
   errors.push(...checkPlanRunners(tasks, runners));
   errors.push(...loopErrors(tasks));
+  errors.push(...delegationErrors(tasks, { ...runnerModes ? { runnerModes } : {}, ...delegation }));
   for (const { task: t, parent } of rows) {
     for (const error of dependencyTargetErrors(tasks, t.id, t.dependencies.filter((id) => id !== t.id))) {
       errors.push({ taskId: t.id, field: "dependencies", message: `${taskWhere(t.title, parent?.title)}: ${error}` });
@@ -925,6 +1319,10 @@ export {
   loopSpec,
   loopRemovalRefusal,
   loopReshapeRefusal,
+  ONE_LINE,
+  splitLines,
+  quotedLine,
+  onOneLine,
   PLAN_ENVELOPE_KEY,
   TASK_OPS_ENVELOPE_KEY,
   TASK_QUERY_ENVELOPE_KEY,
@@ -936,6 +1334,7 @@ export {
   stripTrailingCommas,
   escapeControlCharsInStrings,
   runnerModesFrom,
+  resolveDefaultMode,
   autonomyLevelLabel,
   parseAutonomyLevel,
   parseAutonomyFlag,
@@ -951,6 +1350,31 @@ export {
   assignableRunners,
   resolveAssignment,
   resolveAssignments,
+  GRANTS,
+  FLOOR_GRANTS,
+  SHAPE_LIMITS,
+  mandateRefusalText,
+  rootMandate,
+  heldMandate,
+  narrow,
+  delegatedRequest,
+  COMMAND_GRANTS,
+  allowsCommand,
+  missingGrant,
+  SCRIPT_PAST_THE_RULES,
+  withheldPlannerTools,
+  autonomousAt,
+  rootAuthority,
+  countChildTasks,
+  DELEGATED_FIELDS,
+  notOnADelegatedMessage,
+  checksOf,
+  checksHoldingMerge,
+  checkWords,
+  checksDelegatedTask,
+  planSize,
+  underProtectedPath,
+  scopeOverlaps,
   MODE_NOT_THE_PLANNERS,
   MANUAL_NOT_READ_ONLY,
   OPS_NOT_READ_ONLY,
@@ -962,4 +1386,4 @@ export {
   checkPlanInvariants,
   detectCycle
 };
-//# sourceMappingURL=chunk-BKTDYGIP.mjs.map
+//# sourceMappingURL=chunk-2IFKPYPO.mjs.map