@ordewell/core 0.4.8 → 0.4.10

package/dist/index.d.ts

@@ -1,13 +1,15 @@
-import { h as RunnerId, c as PlanStatus, L as LegacyPlanState, d as ResearchProgress, a as DiscoveredModel, T as Task, R as ResearchLogEntry, C as ConversationMessage, n as TaskSnapshot, Q as QueuedMessage, A as ActiveTaskSession, g as ResearchToolType, u as Verdict, e as ResearchStep, b as PlanState } from './Task-1NwmUImI.js';
+import { h as RunnerId, c as PlanStatus, L as LegacyPlanState, a as DiscoveredModel, T as Task, d as ResearchProgress, R as ResearchLogEntry, C as ConversationMessage, n as TaskSnapshot, Q as QueuedMessage, A as ActiveTaskSession, g as ResearchToolType, u as Verdict, e as ResearchStep, b as PlanState } from './Task-1NwmUImI.js';
 export { D as DiscoveredMode, M as Message, P as PlanModificationWarnings, f as ResearchStepOutcome, S as StreamEvent, i as StreamStepEvent, j as StreamThinkingEvent, k as TaskMode, l as TaskModelAssignment, m as TaskOutputSummary, o as TaskStatus, p as TaskType, q as ThinkingBlock, U as UserPromptEntry, r as UserStep, V as ValidationCheck, s as ValidationContext, t as ValidationResult, v as VerificationCheck, w as addTaskToPlan, x as createEmptyPlan, y as createTask, z as emptyWarnings, B as flattenTasks, E as migrateLegacyPlan, F as migratePlanState, G as migrateTask, H as removeTaskFromPlan, I as renumberTasks, J as updateTaskInPlan, K as validateModifiedPlan, N as warningsText } from './Task-1NwmUImI.js';
 import { n as IFileSystem, I as IApproval, R as ReadFileOpts, T as ToolOutcome, k as GrepOptions, j as GlobOptions, i as FindSymbolOptions, f as ApprovalRequest, m as IConfig, A as AiProvider, z as ProviderModelLists, c as ApprovalMode, q as ITerminalSession, p as ITerminalRunner, K as RunnerRegistry, s as OrchestratorOption, b as ApprovalKind, g as ApprovalSource, H as RunnerInvocation, o as IPluginStore, J as RunnerPluginManifest, E as ResolveContext } from './ITerminalRunner-CbE6gKLI.js';
 export { a as AllProviderModels, d as ApprovalPolicy, e as ApprovalPolicyOptions, C as CatalogModel, D as DENY_ALL, h as DiscoveryCommand, F as FetchAllProviderModelsOptions, G as GREP_DEFAULT_HEAD_LIMIT, l as GrepOutputMode, M as ModelCatalog, r as ModelShortcut, O as ORCHESTRATOR_SHORTCUTS, P as PluginCloneFn, t as PluginEntry, u as PluginFeatures, v as PluginMode, w as PluginModelDiscovery, x as PluginRunnerDef, y as ProviderCredentialSource, B as ProviderModelsResult, S as SEARCH_EXCLUSIONS, L as collectProviderCredentials, N as enabledRunners, Q as fetchAllProviderModels, U as isReservedRunnerName, V as knownModelId, W as resolveModelShortcut, X as resolveProvider, Y as toOrchestratorOptions } from './ITerminalRunner-CbE6gKLI.js';
-import { R as RunnerModeInfo, b as PlanParseError } from './parsing-RjN9JbyG.js';
-export { M as ManifestLookup, P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, T as TASK_OPS_ENVELOPE_KEY, c as buildModeGuide, d as checkDepsResolve, e as checkImmutableLog, f as checkInProgress, g as checkNoCycles, h as checkUniqueIds, i as escapeControlCharsInStrings, j as extractJsonObject, k as extractObjectWithBalance, l as extractObjectsWithKey, m as filteredBuildModes, n as looksLikePlanAttempt, p as parsePartialPlan, o as parsePlanJson, r as resolveDefaultMode, q as resolveTaskMode, s as runnerModesFrom, t as stripModelNoise, u as stripTrailingCommas, v as validatePlanModification } from './parsing-RjN9JbyG.js';
-import { T as TaskOp } from './plan-utils-Cgc0cCH1.js';
-export { A as ApplyTaskOpsResult, a as TaskRef, b as applyTaskOps, c as canMergeTasks, d as canSetDependencies, e as canSplitTask, f as classifyOutcome, g as dependencyCandidates, h as dependentsOf, p as parseTaskOpsJson, s as summarizeToolCall, t as textHasTaskOps } from './plan-utils-Cgc0cCH1.js';
+import { R as RunnerModeInfo } from './ModeResolver-Dx5gzNPC.js';
+export { M as ManifestLookup, b as buildModeGuide, f as filteredBuildModes, r as resolveDefaultMode, a as resolveTaskMode, c as runnerModesFrom } from './ModeResolver-Dx5gzNPC.js';
+import { T as TaskOp } from './plan-utils-DtsfHnn_.js';
+export { A as ApplyTaskOpsResult, a as TaskRef, b as applyTaskOps, c as canMergeTasks, d as canSetDependencies, e as canSplitTask, f as classifyOutcome, g as dependencyCandidates, h as dependentsOf, p as parseTaskOpsJson, s as summarizeToolCall, t as textHasTaskOps } from './plan-utils-DtsfHnn_.js';
 import { ChildProcess } from 'child_process';
 import { EventEmitter } from 'events';
+import { b as PlanParseError } from './parsing-X0Gvuz-q.js';
+export { P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, T as TASK_OPS_ENVELOPE_KEY, c as TASK_QUERY_ENVELOPE_KEY, d as checkDepsResolve, e as checkImmutableLog, f as checkInProgress, g as checkNoCycles, h as checkUniqueIds, i as escapeControlCharsInStrings, j as extractJsonObject, k as extractObjectWithBalance, l as extractObjectsWithKey, m as looksLikePlanAttempt, p as parsePartialPlan, n as parsePlanJson, s as stripModelNoise, o as stripTrailingCommas, v as validatePlanModification } from './parsing-X0Gvuz-q.js';
 
 interface SessionMeta {
     id: string;
@@ -125,6 +127,11 @@ declare function researchShellWarning(shell: ResearchShell): string | null;
  * name at the front of it: wrappers are unwrapped first, recursively, so
  * `timeout 10 env nice rm -rf x` is an `rm`. See {@link WRAPPER_FAMILY}.
  *
+ * A permitted binary is permitted with the flags it is known to be read-only
+ * with, not with any flag at all: several of them will run a helper program or
+ * write a file when asked to, so `auto` is a per-binary flag allowlist and an
+ * unrecognised flag is refused. See {@link FLAG_POLICY}.
+ *
  * The lexer is dialect-aware, because the interpreter that will actually run
  * the command decides what the tokens are, and getting that wrong is not a
  * cosmetic error here — it is the difference between classifying what runs and
@@ -136,8 +143,24 @@ declare function researchShellWarning(shell: ResearchShell): string | null;
  * what it actually runs (see {@link WRAPPER_FAMILY}); given none it prints the
  * whole process environment — provider credentials included — into the research
  * log, which is a disclosure the developer should get to see coming.
+ *
+ * Membership here is necessary but not sufficient: every name in this list also
+ * declares the flags it is read-only with in {@link FLAG_POLICY}.
  */
 declare const AUTO_COMMANDS: string[];
+/**
+ * `ls-remote` is deliberately absent, and it is the one entry here that is
+ * read-only against the repository. It reaches the network: it contacts
+ * whatever host the named remote or URL resolves to, which routes around the
+ * web fetcher's per-origin approval and its request-forgery guard. So it
+ * prompts rather than running silently.
+ *
+ * Prompting only became the right answer once {@link scopeFor} widened. Under
+ * the old scope it would have been remembered as `git ls-remote`, so one
+ * approval of the workspace's own remote would have authorised a listing
+ * against any host at all — which is the same hole with an approval dialog in
+ * front of it. The scope now carries the destination.
+ */
 declare const GIT_READONLY_SUBCOMMANDS: string[];
 /**
  * Never runs, with or without approval.
@@ -635,6 +658,65 @@ interface PlannerModes {
     researchSubagents: boolean;
 }
 
+/**
+ * The planner's read channel: a `{"taskQuery":{...}}` reply asking Ordewell to
+ * show it what the per-turn plan block deliberately leaves out.
+ *
+ * The plan block carries only short fields, so a planner asked to "add a line
+ * to task 3's prompt" would be rewriting text it has never read. Inlining every
+ * body on every turn was rejected — a twenty-task plan re-sends thousands of
+ * tokens per message — so the planner asks instead, and pays for the detail
+ * only on the turns it uses it.
+ *
+ * This module owns the wire shape and the rendering of the answer; the loop,
+ * the budgets and the injection live in the Session, and the classification
+ * lives in PlanRepair alongside the plan and task-ops envelopes.
+ */
+/** The long fields a query may ask for. Everything else is already in the plan block. */
+declare const TASK_QUERY_FIELDS: readonly ["description", "prompt", "userSteps", "verdict", "outputSummary", "userStoriesCovered"];
+type TaskQueryField = typeof TASK_QUERY_FIELDS[number];
+interface TaskQuery {
+    /** Task references to read in full — an id, "#order", a bare order, or a title. */
+    tasks: string[];
+    /** Narrows what comes back. Omitted means every field in {@link TASK_QUERY_FIELDS}. */
+    fields?: TaskQueryField[];
+    /** Also return the full runner/model catalog with labels, variants and mode descriptions. */
+    catalog: boolean;
+}
+declare function textHasTaskQuery(text: string): boolean;
+/** Parse a `{"taskQuery":...}` reply. Throws PlanParseError when the JSON is unusable. */
+declare function parseTaskQueryJson(text: string): TaskQuery;
+/** Stable identity of a query, so a turn can recognise the planner asking the same thing twice. */
+declare function taskQuerySignature(query: TaskQuery): string;
+/** What a full-catalog read is answered from. Models arrive already allowlist-filtered. */
+interface TaskQueryCatalog {
+    runners: RunnerId[];
+    models: Partial<Record<RunnerId, DiscoveredModel[]>>;
+    modes: Record<RunnerId, RunnerModeInfo[]>;
+    autonomousDefault: boolean;
+}
+/**
+ * Appended when the planner has spent its read budget, or asked the identical
+ * question twice. The detail still comes back — refusing it would leave the
+ * planner editing text it has not read, which is the whole failure this
+ * channel exists to prevent — but the turn is told to land.
+ */
+declare const TASK_QUERY_ANSWER_OR_OPS: string;
+/**
+ * The protocol as the planner is taught it, owned here beside the parser so the
+ * two cannot drift. Both planner backends get these lines verbatim (ADR-0009):
+ * a harness planner has no tool loop to reach, so the envelope is the channel.
+ */
+declare const TASK_QUERY_PROTOCOL: string[];
+/** The one-line reminder the per-turn plan block carries, so the protocol has a single owner. */
+declare const TASK_QUERY_REMINDER = "- To READ a task in full (prompt, user steps, verdict, output, user stories) or the whole model/mode catalog before editing, reply with ONLY {\"taskQuery\":{\"tasks\":[\"<id or #order>\"],\"catalog\":true}} \u2014 it changes nothing, and you then reply again with your ops.";
+/**
+ * Render the injected answer to one read. Never persisted — it is context for
+ * the planner's next reply and nothing else — so it is built fresh from live
+ * state on every query rather than cached.
+ */
+declare function renderTaskQueryAnswer(query: TaskQuery, tasks: Task[], catalog: TaskQueryCatalog): string;
+
 declare abstract class AbstractTerminalSession implements ITerminalSession {
     id: string;
     taskId: string;
@@ -907,6 +989,17 @@ type AgentEvent =
     name: string;
     detail: string;
 }
+/**
+ * The agent delegated work to a subagent it left running in the background,
+ * and may end its turn before that work reports. Ordewell's conversation is
+ * request/response: a turn that ends hands control back to the user, and
+ * anything the agent says afterwards arrives with no turn open and is lost.
+ * Naming the launch is what lets the service ask for the results in time.
+ */
+ | {
+    type: 'background_agent';
+    id: string;
+}
 /** The agent finished its turn and is waiting for the next user message. */
  | {
     type: 'turn_end';
@@ -1111,9 +1204,11 @@ interface ConversationRequest {
 }
 /**
  * One planner turn's outcome. The planner talks to the user (`message`),
- * commits a full plan (`plan`, a `{tasks:[...]}` JSON object), or emits
- * targeted task edits (`task_ops`, a `{taskOps:[...]}` JSON object). The
- * Session validates and applies task ops atomically; the AI service only
+ * commits a full plan (`plan`, a `{tasks:[...]}` JSON object), emits targeted
+ * task edits (`task_ops`, a `{taskOps:[...]}` JSON object), or asks to read
+ * task bodies and the full catalog before editing (`task_query`, a
+ * `{taskQuery:{...}}` JSON object). The Session validates and applies task ops
+ * atomically and answers queries out of its own state; the AI service only
  * parses them.
  */
 type ConversationTurn = {
@@ -1130,6 +1225,11 @@ type ConversationTurn = {
     ops: TaskOp[];
     text: string;
     researchLog: ResearchLogEntry[];
+} | {
+    kind: 'task_query';
+    query: TaskQuery;
+    text: string;
+    researchLog: ResearchLogEntry[];
 };
 interface IAiService {
     /**
@@ -1972,12 +2072,19 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     /** Set for the duration of a turn. Outside one, events are buffered rather than dropped. */
     private turnEmit;
     /**
-     * Events the agent produced between turns — in practice the startup warnings
-     * that arrive during the handshake. Dropping them hid the one diagnostic
-     * that explains a planner which cannot read the workspace, so they are held
-     * until a turn exists to show them in.
+     * Events the agent produced before its first turn — in practice the startup
+     * warnings that arrive during the handshake. Dropping them hid the one
+     * diagnostic that explains a planner which cannot read the workspace, so they
+     * are held until a turn exists to show them in.
+     *
+     * Only before the *first* turn. Once one has run, anything arriving outside a
+     * turn is that closed turn's straggling work — a backgrounded subagent
+     * finishing, a late read — and replaying it into the next turn presents it as
+     * research done for the user's new message.
      */
     private betweenTurns;
+    /** Set once a turn has ended: after that, out-of-turn events are stale, not startup. */
+    private hadTurn;
     private disposed;
     /** Resolves when the process ends, so a handshake can lose the race instead of waiting out its timeout. */
     protected processEnded: Promise<void>;
@@ -2020,6 +2127,8 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
  */
 declare class ClaudeCodeAdapter extends StdioAgentAdapter {
     readonly agentId = "claude-code";
+    /** Whether this turn has already emitted reply text — see {@link handleLine}. */
+    private turnHasText;
     protected spawnSpec(opts: AgentStartOptions): SpawnSpec;
     protected turnPayload(message: string): string;
     protected handleLine(line: string, emit: (event: AgentEvent) => void): void;
@@ -2106,6 +2215,8 @@ declare class OpenCodeAdapter implements AgentAdapter {
     private exited;
     private disposed;
     private opts;
+    /** Whether this turn has already emitted reply text — see {@link emitPart}. */
+    private turnHasText;
     constructor(deps: AgentProcessDeps);
     start(opts: AgentStartOptions): Promise<void>;
     send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal): Promise<void>;
@@ -2454,6 +2565,15 @@ declare class Session {
      */
     reset(): void;
     private runnerModesFor;
+    /**
+     * The catalog a model/task-mode edit is checked against — the same
+     * discovered models and manifest modes the per-turn catalog block shows the
+     * planner, so a refusal here can never name something invalid that the
+     * planner was never told about. `modelsCache` is read live, not filtered by
+     * the allowlist here — {@link checkModelAndModeValidity} narrows by
+     * allowlist itself, the same way `coerceAssignments` does.
+     */
+    private editCatalog;
     get planState(): LegacyPlanState | null;
     /**
      * The live plan in the shape a saved session is read back as. The disk
@@ -2496,6 +2616,26 @@ declare class Session {
      * answers, PRD accept/adjust, outline confirm. One branch, no phase ladder.
      */
     continueConversation(userMessage: string, options?: GeneratePlanOptions): Promise<LegacyPlanState>;
+    /**
+     * Answer every read the planner emits until it says something else.
+     *
+     * The channel is a text envelope rather than a registered tool because the
+     * protocol has to be identical on both planner backends (ADR-0009): Ordewell
+     * owns a tool loop only in the API case, and a harness planner running as a
+     * coding-agent subprocess can only be reached this way.
+     *
+     * Draining here — outside {@link repairLoop} — is what keeps reads free of
+     * the repair budget. A planner that looks a task up and *then* fumbles its
+     * ops JSON still gets its two corrective retries; charging it for the read
+     * would cost it the chance to fix the edit.
+     */
+    private drainTaskQueries;
+    /**
+     * Render one read out of live state. Never persisted to the transcript: the
+     * detail is context for the planner's next reply, and re-sending it on every
+     * later turn is exactly the cost this channel exists to avoid.
+     */
+    private taskQueryAnswer;
     /**
      * Drive a planner turn to a persisted, broadcast outcome. Task edits apply
      * atomically; validation failures are fed back to the model for up to 2
@@ -2504,6 +2644,24 @@ declare class Session {
      * path, not two.
      */
     private settleTurn;
+    /**
+     * The catalog the planner may actually draw from — model ids and task-mode
+     * ids, per selected runner — emitted on EVERY turn, before any plan exists
+     * or after. The system prompt shows this once at conversation start; a long
+     * grill-me interview or PRD negotiation outlives that single showing and the
+     * planner starts misquoting it, so this re-states it per turn instead.
+     *
+     * Built from the allowlist-filtered view (`filterModelsForPrompt`), the same
+     * one the system prompt used — a restricted allowlist stays a hard bound on
+     * every turn, not just the first. `this.modelsCache` itself is never
+     * filtered: `coerceAssignments` needs the full discovered catalog alongside
+     * the allowlist to resolve labels and clamp effort to real variants.
+     *
+     * Reads `this.plan.runners` live, so a runner admitted mid-session by a
+     * retarget (`admitRunner`) is filtered and shown like every other — there is
+     * no separate "originally selected" list to fall stale.
+     */
+    private catalogBlock;
     /**
      * The "you are here" block for post-plan chat: current tasks with stable
      * references, plus the task-ops protocol. Injected per turn (never
@@ -2573,10 +2731,14 @@ declare class Session {
      */
     private editPlan;
     /**
-     * Patch one task's fields. A hand-set dependency list is the one patch that
-     * can leave the plan unschedulable, so it goes through the same
-     * {@link canSetDependencies} guard the planner's pickers use rather than a
-     * second copy of the rule — and throws, so the surface can say why.
+     * Patch one task's fields. A hand-set dependency list, or a type flip
+     * between AI and MAN, are the patches that can leave a task incoherent
+     * (unschedulable, or carrying fields that mean nothing for its new type),
+     * so both go through the same {@link validateTaskEdit} guard the planner's
+     * task-ops applier uses (as the 'direct' actor, which skips the lock rule)
+     * rather than a second copy of the rules — and throws, so the surface can
+     * say why. Gated on the task existing so an edit to an unknown id still
+     * falls through to the no-op `store.update` below instead of throwing.
      */
     updateTask(taskId: string, changes: Partial<Task>): Promise<LegacyPlanState | null>;
     /**
@@ -2864,6 +3026,8 @@ declare function reEmitPlanPrompt(detail: string): string;
 declare function truncatedPlanReEmitPrompt(historyCompacted: boolean): string;
 /** A task-ops attempt was botched (unparseable JSON): re-emit the ops object. */
 declare function reEmitTaskOpsPrompt(detail: string): string;
+/** A read attempt was botched (unparseable or unknown selector): re-emit the query object. */
+declare function reEmitTaskQueryPrompt(detail: string): string;
 /** Task ops parsed but failed semantic validation (cycles, unknown refs, locked tasks). */
 declare function taskOpsRejectedPrompt(errors: string[]): string;
 /** A modified plan failed validation during execution: full re-prompt feedback block. */
@@ -2875,6 +3039,11 @@ type PlannerReplyClassification = {
     kind: 'task_ops';
     ops: TaskOp[];
 }
+/** A read: show me these tasks in full (and/or the whole catalog) before I edit anything. */
+ | {
+    kind: 'task_query';
+    query: TaskQuery;
+}
 /** Clearly attempted a plan (tasks-keyed object, or JSON cut off mid-stream) and botched it — worth a corrective retry. */
  | {
     kind: 'broken_plan';
@@ -2884,6 +3053,11 @@ type PlannerReplyClassification = {
  | {
     kind: 'broken_task_ops';
     error: PlanParseError;
+}
+/** Clearly attempted a read and botched it — worth a corrective retry. */
+ | {
+    kind: 'broken_task_query';
+    error: PlanParseError;
 } | {
     kind: 'prose';
 };
@@ -3370,6 +3544,17 @@ declare const OPENCODE_MANIFEST: RunnerPluginManifest;
 declare const STATE_DIR = ".ordewell";
 declare function ensureDir(dir: string): void;
 declare function getStateDir(baseDir?: string): string;
+/**
+ * A match-everything ignore rule, written *inside* the state directory. A
+ * `.gitignore` containing `*` inside a directory excludes that directory's
+ * whole contents, itself included, so plans and sessions stop being
+ * accidentally committable — without ever touching a file the developer wrote.
+ * Editing their root `.gitignore` would be the intrusive version of this.
+ *
+ * Idempotent, and never overwrites an existing file: a developer who has
+ * customised these rules (to commit their plans deliberately, say) keeps them.
+ */
+declare function ensureStateDirIgnored(baseDir?: string): void;
 
 declare function saveState(plan: LegacyPlanState, baseDir?: string): void;
 declare function loadState(baseDir?: string, logger?: ILogger): LegacyPlanState | null;
@@ -3460,4 +3645,4 @@ declare class PlannerModelMemory {
     recall(provider: string, catalog: PlannerModelCandidate[]): PlannerModelRecall;
 }
 
-export { ALLOWED_PLUGIN_HOSTS, ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractTerminalSession, ActiveTaskSession, type AgentAdapter, type AgentAdapterFactory, type AgentEvent, type AgentProcessDeps, type AgentStartOptions, AiProvider, ApprovalKind, ApprovalMode, ApprovalRequest, ApprovalSource, BaseAiService, BaseConfig, BaseFileSystem, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CMD_EXE_MAX_COMMAND_LINE, CORE_PLANNER_PROMPT, type CappedRows, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, CommandLineTooLongError, type CommandTier, type ComposeOptions, ConsoleLogger, ContextCollector, ConversationMessage, type ConversationRequest, type ConversationTurn, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DiscoveredModel, EmbeddedNewlineError, type EnvAdmission, EnvConfig, type ExecFileFn, type ExecImpl, ExecutableNotFoundError, FindSymbolOptions, FsPluginStore, GIT_READONLY_SUBCOMMANDS, GeminiService, GlobOptions, type GrepInvocation, GrepOptions, type HasBinFn, HeadlessRunner, type HeadlessRunnerDeps, HeadlessSession, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IPluginStore, ITerminalRunner, ITerminalSession, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, type LaunchDeps, type LaunchPlan, LegacyPlanState, LineBuffer, type MappedTool, ModelResolver, type ModelResolverDeps, type ModifyPlanRequest, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, PLUGIN_NAME_PATTERN, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanParseError, type PlanRequest, PlanState, PlanStatus, PlanStore, Planner, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerRuntimeToggles, type PluginSource, type PrdBlock, type PreparedLaunch, type PriorOutput, type ProbeFn, ProviderModelLists, type ProviderRegistration, QueuedMessage, REFUSED_COMMANDS, ReadFileOpts, type RepairLoopOpts, type RepairVerdict, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchStep, ResearchToolType, type ResearchTurn, ResolveContext, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerInvocation, type RunnerMode, RunnerModeInfo, RunnerPluginManifest, RunnerRegistry, type RunnerSpawnOptions, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SerializedPlan, type SerializedTask, type SerializedTaskStatus, Session, type SessionBroadcaster, type SessionData, type SessionDeps, type SessionMessage, type SessionMeta, type SessionPlanner, type SessionRuntimeSettings, SettingsService, type ShellDialect, type SpawnSpec, StdioAgentAdapter, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, TaskOp, TaskOrchestrator, TaskSnapshot, TmuxRunner, type TmuxRunnerDeps, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, type UserSettings, Verdict, VerdictEngine, type VerdictListener, WINDOWS_MAX_COMMAND_LINE, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, admitSettingsEnv, applyHeadLimit, assertInstallablePluginUrl, assertPlainPluginName, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildRunnerInvocation, buildShellInvocation, buildSplitPrompt, buildSubagentSystemPrompt, clampThinkingEffort, classifyCommand, classifyPlannerReply, classifyPluginSource, clearAugmentedPathCache, clearDaemonToken, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, configuredProviders, createAiService, daemonTokenPath, defaultLogger, definitionPattern, deleteSession, discoverGeminiModels, effectiveAllowlist, ensureDir, executionLogBlock, executionSummary, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, grantScopeFor, hasTmux, includeGlobFor, isCliProvider, isExecutableResolved, isOpenAiProvider, isPlainPluginName, isValidManifest, killTree, languageForId, listSessions, loadSession, loadSessionPlanState, loadState, mapAgentTool, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, pendingEditRulesBlock, planDirectLaunch, planShellLaunch, posixShellQuote, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, readDaemonToken, referencePattern, renderPlanMap, renderPriorOutputs, repairLoop, researchShellWarning, researchToolsPath, resolveArgs, resolvePluginInstallDir, resolveProviderFromPrefix, resolveResearchShell, resolveWithin, retargetTaskRunner, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, serializePlan, serializeTask, serializeTaskStatus, sessionRuntimeSettings, stateExists, stripAnsi, stripModelPrefix, summarizeOutput, taskOpsRejectedPrompt, tmuxSessionName, tmuxSocketName, tmuxWindowName, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, windowsCommandLine, withPath, wrapWithPty };
+export { ALLOWED_PLUGIN_HOSTS, ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractTerminalSession, ActiveTaskSession, type AgentAdapter, type AgentAdapterFactory, type AgentEvent, type AgentProcessDeps, type AgentStartOptions, AiProvider, ApprovalKind, ApprovalMode, ApprovalRequest, ApprovalSource, BaseAiService, BaseConfig, BaseFileSystem, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CMD_EXE_MAX_COMMAND_LINE, CORE_PLANNER_PROMPT, type CappedRows, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, CommandLineTooLongError, type CommandTier, type ComposeOptions, ConsoleLogger, ContextCollector, ConversationMessage, type ConversationRequest, type ConversationTurn, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DiscoveredModel, EmbeddedNewlineError, type EnvAdmission, EnvConfig, type ExecFileFn, type ExecImpl, ExecutableNotFoundError, FindSymbolOptions, FsPluginStore, GIT_READONLY_SUBCOMMANDS, GeminiService, GlobOptions, type GrepInvocation, GrepOptions, type HasBinFn, HeadlessRunner, type HeadlessRunnerDeps, HeadlessSession, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IPluginStore, ITerminalRunner, ITerminalSession, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, type LaunchDeps, type LaunchPlan, LegacyPlanState, LineBuffer, type MappedTool, ModelResolver, type ModelResolverDeps, type ModifyPlanRequest, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, PLUGIN_NAME_PATTERN, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanParseError, type PlanRequest, PlanState, PlanStatus, PlanStore, Planner, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerRuntimeToggles, type PluginSource, type PrdBlock, type PreparedLaunch, type PriorOutput, type ProbeFn, ProviderModelLists, type ProviderRegistration, QueuedMessage, REFUSED_COMMANDS, ReadFileOpts, type RepairLoopOpts, type RepairVerdict, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchStep, ResearchToolType, type ResearchTurn, ResolveContext, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerInvocation, type RunnerMode, RunnerModeInfo, RunnerPluginManifest, RunnerRegistry, type RunnerSpawnOptions, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SerializedPlan, type SerializedTask, type SerializedTaskStatus, Session, type SessionBroadcaster, type SessionData, type SessionDeps, type SessionMessage, type SessionMeta, type SessionPlanner, type SessionRuntimeSettings, SettingsService, type ShellDialect, type SpawnSpec, StdioAgentAdapter, TASK_QUERY_ANSWER_OR_OPS, TASK_QUERY_FIELDS, TASK_QUERY_PROTOCOL, TASK_QUERY_REMINDER, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, TaskOp, TaskOrchestrator, type TaskQuery, type TaskQueryCatalog, type TaskQueryField, TaskSnapshot, TmuxRunner, type TmuxRunnerDeps, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, type UserSettings, Verdict, VerdictEngine, type VerdictListener, WINDOWS_MAX_COMMAND_LINE, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, admitSettingsEnv, applyHeadLimit, assertInstallablePluginUrl, assertPlainPluginName, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildRunnerInvocation, buildShellInvocation, buildSplitPrompt, buildSubagentSystemPrompt, clampThinkingEffort, classifyCommand, classifyPlannerReply, classifyPluginSource, clearAugmentedPathCache, clearDaemonToken, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, configuredProviders, createAiService, daemonTokenPath, defaultLogger, definitionPattern, deleteSession, discoverGeminiModels, effectiveAllowlist, ensureDir, ensureStateDirIgnored, executionLogBlock, executionSummary, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, grantScopeFor, hasTmux, includeGlobFor, isCliProvider, isExecutableResolved, isOpenAiProvider, isPlainPluginName, isValidManifest, killTree, languageForId, listSessions, loadSession, loadSessionPlanState, loadState, mapAgentTool, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, parseTaskQueryJson, pendingEditRulesBlock, planDirectLaunch, planShellLaunch, posixShellQuote, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, reEmitTaskQueryPrompt, readDaemonToken, referencePattern, renderPlanMap, renderPriorOutputs, renderTaskQueryAnswer, repairLoop, researchShellWarning, researchToolsPath, resolveArgs, resolvePluginInstallDir, resolveProviderFromPrefix, resolveResearchShell, resolveWithin, retargetTaskRunner, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, serializePlan, serializeTask, serializeTaskStatus, sessionRuntimeSettings, stateExists, stripAnsi, stripModelPrefix, summarizeOutput, taskOpsRejectedPrompt, taskQuerySignature, textHasTaskQuery, tmuxSessionName, tmuxSocketName, tmuxWindowName, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, windowsCommandLine, withPath, wrapWithPty };