@ordewell/core 0.5.0 → 0.5.2

package/dist/index.js

@@ -56,6 +56,7 @@ __export(index_exports, {
   ConversationEditError: () => ConversationEditError,
   DAEMON_SUBPROTOCOL: () => DAEMON_SUBPROTOCOL,
   DAEMON_TOKEN_SUBPROTOCOL_PREFIX: () => DAEMON_TOKEN_SUBPROTOCOL_PREFIX,
+  DEFAULT_MAX_PARALLEL: () => DEFAULT_MAX_PARALLEL,
   DENY_ALL: () => DENY_ALL,
   EmbeddedNewlineError: () => EmbeddedNewlineError,
   EnvConfig: () => EnvConfig,
@@ -129,6 +130,7 @@ __export(index_exports, {
   augmentPromptWithPriorOutputs: () => augmentPromptWithPriorOutputs,
   augmentedPath: () => augmentedPath,
   bearerHeaderValue: () => bearerHeaderValue,
+  buildConflictRepairPrompt: () => buildConflictRepairPrompt,
   buildConflictResolutionPrompt: () => buildConflictResolutionPrompt,
   buildConversationSystemPrompt: () => buildConversationSystemPrompt,
   buildFallbackGrepArgs: () => buildFallbackGrepArgs,
@@ -148,6 +150,7 @@ __export(index_exports, {
   canMergeTasks: () => canMergeTasks,
   canSetDependencies: () => canSetDependencies,
   canSplitTask: () => canSplitTask,
+  capConflictFiles: () => capConflictFiles,
   checkDepsResolve: () => checkDepsResolve,
   checkImmutableLog: () => checkImmutableLog,
   checkInProgress: () => checkInProgress,
@@ -236,6 +239,7 @@ __export(index_exports, {
   modifyValidationFeedback: () => modifyValidationFeedback,
   normalizeAgentArgs: () => normalizeAgentArgs,
   normalizeGeminiModel: () => normalizeGeminiModel,
+  parseMaxParallel: () => parseMaxParallel,
   parsePartialPlan: () => parsePartialPlan,
   parsePlanJson: () => parsePlanJson,
   parseTaskOpsJson: () => parseTaskOpsJson,
@@ -3189,33 +3193,33 @@ function grepOptions(args) {
   };
 }
 var STOPPED_TOOL_RESULT = "Stopped by the user \u2014 this call was not executed, and no further tool calls will run this turn.";
-async function executeTool(name, args, fs14, fetcher, signal) {
-  const outcome = await runTool(name, args, fs14, fetcher, signal);
+async function executeTool(name, args, fs15, fetcher, signal) {
+  const outcome = await runTool(name, args, fs15, fetcher, signal);
   return { ...outcome, output: redactSecrets(outcome.output) };
 }
-async function runTool(name, args, fs14, fetcher, signal) {
+async function runTool(name, args, fs15, fetcher, signal) {
   if (signal?.aborted) return { success: false, output: STOPPED_TOOL_RESULT, truncated: false };
   switch (name) {
     case "read_file": {
       const offset = num(args.offset);
       const limit = num(args.limit);
       const maxBytes = num(args.maxBytes);
-      return fs14.readFile(String(args.path ?? ""), { offset, limit, maxBytes });
+      return fs15.readFile(String(args.path ?? ""), { offset, limit, maxBytes });
     }
     case "read_files": {
       const paths = Array.isArray(args.paths) ? args.paths.map(String) : [];
-      return fs14.readFiles(paths);
+      return fs15.readFiles(paths);
     }
     case "glob":
-      return fs14.glob(String(args.pattern ?? ""), { path: str(args.path), headLimit: num(args.head_limit ?? args.headLimit) });
+      return fs15.glob(String(args.pattern ?? ""), { path: str(args.path), headLimit: num(args.head_limit ?? args.headLimit) });
     case "grep":
-      return fs14.grep(String(args.pattern ?? ""), grepOptions(args));
+      return fs15.grep(String(args.pattern ?? ""), grepOptions(args));
     case "find_symbol":
-      return fs14.findSymbol(String(args.symbol ?? ""), { language: str(args.language), path: str(args.path) });
+      return fs15.findSymbol(String(args.symbol ?? ""), { language: str(args.language), path: str(args.path) });
     case "list_dir":
-      return fs14.listDir(String(args.path ?? ""), num(args.depth));
+      return fs15.listDir(String(args.path ?? ""), num(args.depth));
     case "bash":
-      return fs14.bash(String(args.command ?? ""), signal);
+      return fs15.bash(String(args.command ?? ""), signal);
     case "fetch": {
       if (!fetcher) return { success: false, output: "Web fetching is not available in this environment.", truncated: false };
       const url = String(args.url ?? "");
@@ -3323,14 +3327,14 @@ var PendingApprovals = class {
   ask(request) {
     const id = `ap-${Date.now()}-${counter++}`;
     const pending = { id, request, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
-    return new Promise((resolve5) => {
+    return new Promise((resolve7) => {
       const settle = (granted) => {
         const entry = this.entries.get(id);
         if (!entry) return;
         clearTimeout(entry.timer);
         this.entries.delete(id);
         this.opts.onSettled?.(id, granted);
-        resolve5(granted);
+        resolve7(granted);
       };
       const timer = setTimeout(() => settle(false), this.opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
       timer.unref?.();
@@ -3428,9 +3432,9 @@ function applyHeadLimit(stdout, headLimit) {
 }
 function formatSearchOutput(capped, root, opts) {
   if (capped.rows.length === 0) return opts.emptyMessage;
-  const sep = opts.sep ?? import_node_path.default.sep;
-  const prefix = root === sep || root.endsWith(sep) ? root : `${root}${sep}`;
-  const body = prefix === sep ? capped.rows.join("\n") : capped.rows.map((row) => row.startsWith(prefix) ? row.slice(prefix.length) : row).join("\n");
+  const sep2 = opts.sep ?? import_node_path.default.sep;
+  const prefix = root === sep2 || root.endsWith(sep2) ? root : `${root}${sep2}`;
+  const body = prefix === sep2 ? capped.rows.join("\n") : capped.rows.map((row) => row.startsWith(prefix) ? row.slice(prefix.length) : row).join("\n");
   if (!capped.truncated) return body;
   const hint = opts.hint ? ` ${opts.hint}` : "";
   return `${body}
@@ -4021,6 +4025,15 @@ function configuredProviders(config) {
   return out;
 }
 
+// src/utils/maxParallel.ts
+var DEFAULT_MAX_PARALLEL = 3;
+function parseMaxParallel(value) {
+  const text = String(value ?? "").trim();
+  const n = typeof value === "number" ? value : Number(text);
+  if (text === "" || !Number.isInteger(n) || n < 1) return null;
+  return n;
+}
+
 // src/interfaces/BaseConfig.ts
 function normalizeGeminiModel(id) {
   return id.replace(/^gemini:/, "").replace(/^google\//, "");
@@ -4028,6 +4041,10 @@ function normalizeGeminiModel(id) {
 function commaList(raw) {
   return (raw || "").split(",").map((s) => s.trim()).filter(Boolean);
 }
+function nonNegativeInt(raw, fallback) {
+  const trimmed = (raw ?? "").trim();
+  return /^\d+$/.test(trimmed) ? Number(trimmed) : fallback;
+}
 var BaseConfig = class {
   // --- Legacy named getters (backward compat) ---
   get openAiBaseUrl() {
@@ -4221,7 +4238,7 @@ var BaseConfig = class {
     return "";
   }
   get maxParallelSessions() {
-    return parseInt(process.env.ORDEWELL_MAX_PARALLEL || "3", 10);
+    return parseMaxParallel(process.env.ORDEWELL_MAX_PARALLEL) ?? DEFAULT_MAX_PARALLEL;
   }
   get researchEnabled() {
     return process.env.ORDEWELL_RESEARCH_ENABLED !== "false";
@@ -4250,6 +4267,9 @@ var BaseConfig = class {
   get worktreeLinks() {
     return commaList(process.env.ORDEWELL_WORKTREE_LINKS);
   }
+  get conflictRepairAttempts() {
+    return nonNegativeInt(process.env.ORDEWELL_CONFLICT_REPAIR_ATTEMPTS, 2);
+  }
   get approvalMode() {
     const raw = (process.env.ORDEWELL_APPROVAL_MODE || "").trim().toLowerCase();
     return raw === "allow" || raw === "deny" ? raw : "ask";
@@ -4309,21 +4329,33 @@ var ISOLATION_STATE = {
   active: "active",
   merged: "integrated",
   conflict: "conflict",
+  repairing: "repairing",
   kept: "kept",
   failed: "kept"
 };
-function taskIsolationOf(record) {
+function taskIsolationOf(record, repairLimit) {
   return {
     state: ISOLATION_STATE[record.status],
     branch: record.branch,
     worktree: record.workspace,
     repos: Object.entries(record.repos).filter(([, r]) => r.changed).map(([repoPath]) => repoPath),
-    ...record.conflictRepo ? { conflictRepo: record.conflictRepo } : {}
+    ...record.conflictRepo ? { conflictRepo: record.conflictRepo } : {},
+    ...record.conflictFiles?.length ? { conflictFiles: record.conflictFiles } : {},
+    ...record.repairs ? { repair: { attempt: record.repairs, limit: repairLimit } } : {},
+    ...record.repairedFiles?.length ? { repairedFiles: record.repairedFiles } : {}
   };
 }
+function capConflictFiles(files, max = 5) {
+  return files.length <= max ? files.join(", ") : `${files.slice(0, max).join(", ")}, +${files.length - max} more`;
+}
 function handoffOf(run) {
   const merged = Object.values(run.tasks).filter((r) => r.status === "merged").sort((a, b) => a.order - b.order);
-  const entry = (r) => ({ taskId: r.taskId, order: r.order, title: r.title });
+  const entry = (r) => ({
+    taskId: r.taskId,
+    order: r.order,
+    title: r.title,
+    ...r.repairedFiles?.length ? { repairedFiles: r.repairedFiles } : {}
+  });
   return {
     repos: run.repos.map((repo) => ({
       path: repo.path,
@@ -4387,13 +4419,17 @@ function landedNotice(landed) {
   if (landed.length === 0) return "Nothing was merged.";
   return landed.length === 1 ? `${landed[0]} was merged already and stays merged.` : `${landed.join(", ")} were merged already and stay merged.`;
 }
-function describeMergeResult(result, branch, group) {
+function repairedNotice(repaired) {
+  const named = repaired.map((t) => `${t.title} (${capConflictFiles(t.repairedFiles ?? [])})`);
+  const list = named.length === 1 ? named[0] : `${named.slice(0, -1).join(", ")} and ${named[named.length - 1]}`;
+  return `${list} landed through ${repaired.length === 1 ? "a conflict repair" : "conflict repairs"}.`;
+}
+function describeMergeResult(result, branch, group, repaired = []) {
   switch (result.outcome) {
-    case "merged":
-      return {
-        level: "info",
-        message: group ? `Merged ${branch} into the checked-out branch of every repository.` : `Merged ${branch} into your checked-out branch.`
-      };
+    case "merged": {
+      const base = group ? `Merged ${branch} into the checked-out branch of every repository.` : `Merged ${branch} into your checked-out branch.`;
+      return { level: "info", message: repaired.length > 0 ? `${base} ${repairedNotice(repaired)}` : base };
+    }
     case "blocked":
       return { level: "warn", message: `Merged nothing, so every tree is as it was: ${result.blocked.map(blockNotice).join("; ")}.` };
     case "conflict":
@@ -4414,7 +4450,7 @@ var import_child_process2 = require("child_process");
 var import_util2 = require("util");
 var import_crypto = require("crypto");
 var fs4 = __toESM(require("fs"));
-var path8 = __toESM(require("path"));
+var path9 = __toESM(require("path"));
 
 // src/utils/shellPath.ts
 var import_child_process = require("child_process");
@@ -4443,28 +4479,28 @@ function posixBinDirs() {
   ];
 }
 function windowsBinDirs(env, home) {
-  const join22 = (...parts) => path5.win32.join(...parts);
-  const under = (base, ...parts) => base ? [join22(base, ...parts)] : [];
+  const join24 = (...parts) => path5.win32.join(...parts);
+  const under = (base, ...parts) => base ? [join24(base, ...parts)] : [];
   const appData = env.APPDATA;
   const localAppData = env.LOCALAPPDATA;
   const programData = env.ProgramData;
   return [
     // Native per-user installers, PowerShell-driven and otherwise.
-    join22(home, ".local", "bin"),
-    join22(home, ".opencode", "bin"),
-    join22(home, ".claude", "bin"),
-    join22(home, ".codex", "bin"),
+    join24(home, ".local", "bin"),
+    join24(home, ".opencode", "bin"),
+    join24(home, ".claude", "bin"),
+    join24(home, ".codex", "bin"),
     ...under(localAppData, "Programs", "claude"),
     // Node package managers. npm's global prefix is `%APPDATA%\npm`; the
     // literal spelling is kept as a fallback for a host that does not export
     // APPDATA (a service account, a stripped CI container).
     ...under(appData, "npm"),
-    join22(home, "AppData", "Roaming", "npm"),
+    join24(home, "AppData", "Roaming", "npm"),
     ...under(localAppData, "pnpm"),
     ...under(localAppData, "Yarn", "bin"),
-    join22(home, ".bun", "bin"),
+    join24(home, ".bun", "bin"),
     // Windows package managers.
-    join22(home, "scoop", "shims"),
+    join24(home, "scoop", "shims"),
     ...under(env.SCOOP, "shims"),
     ...under(env.SCOOP_GLOBAL ?? programData, "scoop", "shims"),
     ...under(programData, "chocolatey", "bin"),
@@ -4474,7 +4510,7 @@ function windowsBinDirs(env, home) {
     ...under(localAppData, "Microsoft", "WindowsApps"),
     // Version managers. Volta's Windows home is not the POSIX `~/.volta`.
     ...under(localAppData, "Volta", "bin"),
-    join22(home, ".volta", "bin")
+    join24(home, ".volta", "bin")
   ];
 }
 function wellKnownBinDirs(deps = {}) {
@@ -4578,6 +4614,7 @@ function savePrdMarkdown(workspace, slug2, markdown) {
 
 // src/services/worktreeLink.ts
 var fs3 = __toESM(require("fs"));
+var path8 = __toESM(require("path"));
 function linkPath(source, target, platform, hardLink = fs3.linkSync) {
   const isDir = fs3.statSync(source).isDirectory();
   if (platform !== "win32") {
@@ -4596,6 +4633,55 @@ function linkPath(source, target, platform, hardLink = fs3.linkSync) {
     return "copy";
   }
 }
+function mirrorDir(source, target, opts) {
+  const copied = [];
+  const links = [];
+  const mirror = (from, to, prefix, top) => {
+    fs3.mkdirSync(to, { recursive: true });
+    for (const entry of fs3.readdirSync(from, { withFileTypes: true })) {
+      const name = path8.join(prefix, entry.name);
+      const at = { from: path8.join(from, entry.name), to: path8.join(to, entry.name), name };
+      if (entry.isSymbolicLink()) links.push(at);
+      else if (top && entry.isDirectory() && (entry.name.startsWith("@") || entry.name === ".bin")) mirror(at.from, at.to, name, false);
+      else if (linkPath(at.from, at.to, opts.platform, opts.hardLink) === "copy") copied.push(name);
+    }
+  };
+  mirror(source, target, "", true);
+  let pending = links;
+  for (let before = Infinity; pending.length > 0 && pending.length < before; ) {
+    before = pending.length;
+    pending = pending.filter((link) => {
+      const kind = relink(link.from, link.to, opts);
+      if (kind === "copy") copied.push(link.name);
+      return kind === null;
+    });
+  }
+  return copied;
+}
+function relink(from, to, opts) {
+  const text = fs3.readlinkSync(from);
+  const pointee = path8.isAbsolute(text) ? rebased(text, opts) : text;
+  if (opts.platform !== "win32") {
+    if (!fs3.existsSync(path8.resolve(path8.dirname(to), pointee)) && fs3.existsSync(path8.resolve(path8.dirname(from), pointee))) {
+      fs3.symlinkSync(rebased(path8.resolve(path8.dirname(from), pointee), opts), to);
+      return "symlink";
+    }
+    fs3.symlinkSync(pointee, to);
+    return "symlink";
+  }
+  const resolved = fs3.existsSync(path8.resolve(path8.dirname(to), pointee)) ? path8.resolve(path8.dirname(to), pointee) : rebased(path8.resolve(path8.dirname(from), pointee), opts);
+  try {
+    fs3.statSync(resolved);
+  } catch {
+    return null;
+  }
+  return linkPath(resolved, to, opts.platform, opts.hardLink);
+}
+function rebased(pointee, opts) {
+  const rel = path8.relative(opts.from, pointee);
+  const inside = rel !== "" && !rel.startsWith("..") && !path8.isAbsolute(rel);
+  return inside && !rel.split(/[\\/]/).includes("node_modules") ? path8.join(opts.to, rel) : pointee;
+}
 
 // src/services/GitWorktreeIsolation.ts
 var execFileAsync = (0, import_util2.promisify)(import_child_process2.execFile);
@@ -4610,15 +4696,17 @@ var INHERITED_GIT_VARS = ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_COM
 var LINKED_ARTIFACTS = /* @__PURE__ */ new Set(["node_modules", "vendor", ".venv", ".claude", ".opencode", ".codegraph", ".envrc"]);
 var isEnvFile = (name) => name.startsWith(".env");
 var INTEGRATION_DIR = "integration";
+var RUN_BRANCH = /^ordewell\/([^/]+)\/[^/]+$/;
+var RUN_WORKTREE = /.*[\\/]\.ordewell[\\/]worktrees[\\/]([^\\/]+)[\\/]/;
 var NESTED_REPO_DEPTH = 2;
 var NEVER_SCANNED = /* @__PURE__ */ new Set([".git", STATE_DIR, "node_modules"]);
 var GITLINK_MODE = "160000";
 function isInside(parent, child) {
-  const rel = path8.relative(parent, child);
-  return rel !== "" && !rel.startsWith("..") && !path8.isAbsolute(rel);
+  const rel = path9.relative(parent, child);
+  return rel !== "" && !rel.startsWith("..") && !path9.isAbsolute(rel);
 }
 function hasGitEntry(dir) {
-  return fs4.existsSync(path8.join(dir, ".git"));
+  return fs4.existsSync(path9.join(dir, ".git"));
 }
 function firstLine(text) {
   return text.split(/\r?\n/, 1)[0].trim();
@@ -4634,12 +4722,20 @@ function statusPaths(porcelain) {
   }
   return paths;
 }
+function leftoverMarkerFiles(check) {
+  const files = check.split(/\r?\n/).flatMap((line) => /^(.+):\d+: leftover conflict marker$/.exec(line)?.[1] ?? []);
+  return [...new Set(files)];
+}
+function settleStatus(record, status) {
+  record.status = status;
+  delete record.repairBase;
+}
 function sameDir(a, b) {
   const real = (p) => {
     try {
       return fs4.realpathSync.native(p);
     } catch {
-      return path8.resolve(p);
+      return path9.resolve(p);
     }
   };
   return real(a) === real(b);
@@ -4673,8 +4769,8 @@ function inactive(reason, repos) {
 }
 function groupPathOf(listed) {
   const slashed = listed.trim().replace(/\\/g, "/");
-  if (path8.posix.isAbsolute(slashed) || path8.win32.isAbsolute(slashed)) return null;
-  const rel = path8.posix.normalize(slashed).replace(/\/+$/, "");
+  if (path9.posix.isAbsolute(slashed) || path9.win32.isAbsolute(slashed)) return null;
+  const rel = path9.posix.normalize(slashed).replace(/\/+$/, "");
   return rel === "" || rel === "." || rel === ".." || rel.startsWith("../") ? null : rel;
 }
 function matchLinks(root, patterns) {
@@ -4690,9 +4786,26 @@ function matchLinks(root, patterns) {
 }
 function segmentMatches(root, base, segment) {
   const under = (name) => base ? `${base}/${name}` : name;
-  if (!/[*?]/.test(segment)) return lexists(path8.join(root, base, segment)) ? [under(segment)] : [];
+  if (!/[*?]/.test(segment)) return lexists(path9.join(root, base, segment)) ? [under(segment)] : [];
   const pattern = new RegExp(`^${segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`);
-  return listDir(path8.join(root, base)).filter((name) => !NEVER_SCANNED.has(name) && pattern.test(name)).map(under);
+  return listDir(path9.join(root, base)).filter((name) => !NEVER_SCANNED.has(name) && pattern.test(name)).map(under);
+}
+function installDirs(root) {
+  const packages = matchLinks(root, workspaceGlobs(root)).map((pkg) => `${pkg}/node_modules`);
+  return ["node_modules", ...packages].filter((dir) => lexists(path9.join(root, dir)));
+}
+function workspaceGlobs(root) {
+  let manifest;
+  try {
+    manifest = JSON.parse(fs4.readFileSync(path9.join(root, "package.json"), "utf8"));
+  } catch {
+    return [];
+  }
+  if (typeof manifest !== "object" || manifest === null || !("workspaces" in manifest)) return [];
+  const { workspaces } = manifest;
+  const listed = typeof workspaces === "object" && workspaces !== null && "packages" in workspaces ? workspaces.packages : workspaces;
+  if (!Array.isArray(listed)) return [];
+  return listed.filter((glob) => typeof glob === "string" && !glob.startsWith("!"));
 }
 var GitWorktreeIsolation = class {
   constructor(deps) {
@@ -4746,7 +4859,7 @@ var GitWorktreeIsolation = class {
   groupPaths(workspaceRoot) {
     const listed = this.deps.config.workspaceRepos;
     if (listed.length === 0) return this.reposDirectlyIn(workspaceRoot);
-    const paths = listed.map(groupPathOf).filter((rel) => rel !== null && hasGitEntry(path8.join(workspaceRoot, rel)));
+    const paths = listed.map(groupPathOf).filter((rel) => rel !== null && hasGitEntry(path9.join(workspaceRoot, rel)));
     return [...new Set(paths)].sort();
   }
   async committedRepos(workspaceRoot, paths) {
@@ -4762,7 +4875,7 @@ var GitWorktreeIsolation = class {
     return status.ok ? status.stdout.trim() !== "" : null;
   }
   reposDirectlyIn(dir) {
-    return this.childDirs(dir).filter((name) => hasGitEntry(path8.join(dir, name)));
+    return this.childDirs(dir).filter((name) => hasGitEntry(path9.join(dir, name)));
   }
   childDirs(dir) {
     try {
@@ -4779,9 +4892,9 @@ var GitWorktreeIsolation = class {
   async nestedRepos(workspaceRoot, toplevel) {
     const found = [];
     const walk = (rel, depth) => {
-      for (const name of this.childDirs(path8.join(workspaceRoot, rel))) {
+      for (const name of this.childDirs(path9.join(workspaceRoot, rel))) {
         const child = rel ? `${rel}/${name}` : name;
-        if (hasGitEntry(path8.join(workspaceRoot, child))) found.push(child);
+        if (hasGitEntry(path9.join(workspaceRoot, child))) found.push(child);
         else if (depth < NESTED_REPO_DEPTH) walk(child, depth + 1);
       }
     };
@@ -4802,7 +4915,7 @@ var GitWorktreeIsolation = class {
       const [meta, file] = entry.split("	");
       if (file !== void 0 && meta.startsWith(`${GITLINK_MODE} `)) paths.add(file);
     }
-    const declared = await this.tryGit(workspaceRoot, ["config", "-z", "-f", path8.join(toplevel, ".gitmodules"), "--get-regexp", "^submodule\\..*\\.path$"]);
+    const declared = await this.tryGit(workspaceRoot, ["config", "-z", "-f", path9.join(toplevel, ".gitmodules"), "--get-regexp", "^submodule\\..*\\.path$"]);
     for (const entry of declared.stdout.split("\0")) {
       const value = entry.split("\n")[1];
       if (value) paths.add(value.replace(/\/+$/, ""));
@@ -4858,7 +4971,7 @@ var GitWorktreeIsolation = class {
   async acceptsWorktree(run, repo) {
     const dir = this.integrationDir(run, repo);
     ensureStateDirIgnored(run.workspaceRoot);
-    fs4.mkdirSync(path8.dirname(dir), { recursive: true });
+    fs4.mkdirSync(path9.dirname(dir), { recursive: true });
     const added = await this.tryGit(repo.root, ["worktree", "add", "-q", "--no-checkout", dir, repo.integrationBranch]);
     await this.removeWorktreeDir(run, repo, dir, []);
     return added.ok;
@@ -4873,12 +4986,12 @@ var GitWorktreeIsolation = class {
     if (isolated.includes(SELF_REPO)) return [];
     const shared = [];
     const walk = (rel) => {
-      for (const name of listDir(path8.join(workspaceRoot, rel))) {
+      for (const name of listDir(path9.join(workspaceRoot, rel))) {
         if (!rel && (name === STATE_DIR || name === ".git")) continue;
         const child = rel ? `${rel}/${name}` : name;
         if (isolated.includes(child)) continue;
         if (isolated.some((p) => p.startsWith(`${child}/`))) walk(child);
-        else if (resolves(path8.join(workspaceRoot, child))) shared.push(child);
+        else if (resolves(path9.join(workspaceRoot, child))) shared.push(child);
       }
     };
     walk("");
@@ -4895,17 +5008,17 @@ var GitWorktreeIsolation = class {
       const copied = [];
       try {
         for (const repo of run.repos) {
-          const worktree = path8.join(dir, repo.path);
+          const worktree = path9.join(dir, repo.path);
           const tip = (await this.git(repo.root, ["rev-parse", repo.integrationBranch])).trim();
-          fs4.mkdirSync(path8.dirname(worktree), { recursive: true });
+          fs4.mkdirSync(path9.dirname(worktree), { recursive: true });
           await this.git(repo.root, ["worktree", "add", "-q", "-B", branch, worktree, tip]);
           record.repos[repo.path] = { worktree, linked: [] };
         }
         run.shared = this.sharedPaths(run.workspaceRoot, run.repos.map((r) => r.path));
         for (const rel of run.shared) {
-          const target = path8.join(dir, rel);
-          fs4.mkdirSync(path8.dirname(target), { recursive: true });
-          if (linkPath(path8.join(run.workspaceRoot, rel), target, this.platform) === "copy") copied.push(rel);
+          const target = path9.join(dir, rel);
+          fs4.mkdirSync(path9.dirname(target), { recursive: true });
+          if (linkPath(path9.join(run.workspaceRoot, rel), target, this.platform) === "copy") copied.push(rel);
         }
         for (const repo of run.repos) {
           const entry = record.repos[repo.path];
@@ -4913,7 +5026,7 @@ var GitWorktreeIsolation = class {
           if (repo.path === SELF_REPO) cwd = inRepo;
           const boot = await this.bootstrap(repo, inRepo);
           entry.linked = boot.linked;
-          copied.push(...boot.copied.map((name) => path8.posix.join(repo.path, name)));
+          copied.push(...boot.copied.map((name) => path9.posix.join(repo.path, name)));
         }
       } catch (err) {
         record.status = "failed";
@@ -4924,6 +5037,53 @@ var GitWorktreeIsolation = class {
       return { cwd, branch, copied };
     });
   }
+  reopen(task, run) {
+    return this.admin(run.workspaceRoot, async () => {
+      const record = run.tasks[task.id];
+      if (record?.status !== "conflict") throw new Error(`Task ${task.order} has no conflict to repair`);
+      let cwd = record.workspace;
+      const repairBase = {};
+      for (const repo of run.repos) {
+        const entry = record.repos[repo.path];
+        if (!entry) continue;
+        if (!fs4.existsSync(entry.worktree)) throw new Error(`The worktree of task ${task.order} is gone: ${entry.worktree}`);
+        if (repo.path === SELF_REPO) cwd = await this.inWorkspacePlace(repo, entry.worktree);
+        if (entry.changed || repo.path === record.conflictRepo) {
+          repairBase[repo.path] = (await this.git(repo.root, ["rev-parse", "--verify", repo.integrationBranch])).trim();
+        }
+      }
+      const files = (record.conflictFiles ?? []).map((file) => record.conflictRepo && record.conflictRepo !== SELF_REPO ? `${record.conflictRepo}/${file}` : file);
+      record.repairs = (record.repairs ?? 0) + 1;
+      record.repairBase = repairBase;
+      record.repairedFiles = [.../* @__PURE__ */ new Set([...record.repairedFiles ?? [], ...files])];
+      record.status = "repairing";
+      return { cwd, branch: record.branch, copied: [] };
+    });
+  }
+  async verifyRepair(task, run) {
+    const record = run.tasks[task.id];
+    if (!record?.repairBase) return { ok: false, reason: "failed", repo: record?.conflictRepo ?? SELF_REPO };
+    for (const repo of run.repos) {
+      const entry = record.repos[repo.path];
+      if (!entry) continue;
+      try {
+        await this.commitWorktree(repo, record, entry);
+      } catch {
+        return { ok: false, reason: "failed", repo: repo.path };
+      }
+    }
+    for (const repo of run.repos) {
+      const base = record.repairBase[repo.path];
+      if (base === void 0) continue;
+      const contains = await this.tryGit(repo.root, ["merge-base", "--is-ancestor", base, record.branch]);
+      if (!contains.ok) return { ok: false, reason: contains.code === 1 ? "not-merged" : "failed", repo: repo.path };
+      const check = await this.tryGit(repo.root, ["-c", "core.quotePath=false", "diff", "--check", base, record.branch]);
+      if (!check.ok && check.code !== 2) return { ok: false, reason: "failed", repo: repo.path };
+      const files = leftoverMarkerFiles(check.stdout);
+      if (files.length > 0) return { ok: false, reason: "conflict-markers", repo: repo.path, files };
+    }
+    return { ok: true };
+  }
   /**
    * The place in a repo's worktree that matches where the workspace sits in
    * the real repo: the worktree itself, or a subdirectory of it when the
@@ -4931,7 +5091,7 @@ var GitWorktreeIsolation = class {
    */
   async inWorkspacePlace(repo, worktree) {
     const prefix = await this.prefixOf(repo);
-    return prefix ? path8.join(worktree, prefix) : worktree;
+    return prefix ? path9.join(worktree, prefix) : worktree;
   }
   async prefixOf(repo) {
     return (await this.git(repo.root, ["rev-parse", "--show-prefix"])).trim();
@@ -4951,6 +5111,7 @@ var GitWorktreeIsolation = class {
       if (!record) return;
       if (opts.keep) {
         if (record.status === "active") record.status = "kept";
+        else if (record.status === "repairing") settleStatus(record, "conflict");
         return;
       }
       await this.removeTask(run, record, { dropRecord: true });
@@ -4970,6 +5131,7 @@ var GitWorktreeIsolation = class {
       for (const record of Object.values(run.tasks)) {
         if (record.status === "active") await this.removeTask(run, record, { dropRecord: true });
         else if (record.status === "merged") await this.removeTask(run, record, { dropRecord: false });
+        else if (record.status === "repairing") settleStatus(record, "conflict");
       }
       await this.removeUnowned(run);
       for (const repo of run.repos) await this.tryGit(repo.root, ["worktree", "prune"]);
@@ -5064,14 +5226,59 @@ var GitWorktreeIsolation = class {
         await this.removeTask(run, record, { dropRecord: record.status !== "merged" });
       }
       await this.removeUnowned(run);
-      if (!opts.keepIntegration) {
-        for (const repo of run.repos) await this.tryGit(repo.root, ["branch", "-D", repo.integrationBranch]);
+      if (opts.integration !== "keep") {
+        for (const repo of run.repos) {
+          if (opts.integration === "delete") await this.tryGit(repo.root, ["branch", "-D", repo.integrationBranch]);
+          else await this.deleteIfMerged(repo.root, repo.integrationBranch);
+        }
         run.tasks = {};
         this.removeIfEmpty(this.runRoot(run));
       }
       for (const repo of run.repos) await this.tryGit(repo.root, ["worktree", "prune"]);
     });
   }
+  sweep(run) {
+    return this.admin(run.workspaceRoot, async () => {
+      const failed = [];
+      for (const repo of run.repos) {
+        if (!await this.sweepRepo(run, repo)) failed.push(repo.path);
+      }
+      if (failed.length > 0) throw new Error(`git failed clearing merged branches of earlier runs in ${failed.join(", ")}`);
+    });
+  }
+  /** False when git failed anywhere; the other branches are still tried. */
+  async sweepRepo(run, repo) {
+    await this.tryGit(repo.root, ["worktree", "prune"]);
+    const worktrees = await this.tryGit(repo.root, ["worktree", "list", "--porcelain"]);
+    const refs = await this.tryGit(repo.root, ["for-each-ref", "--format=%(refname)", "refs/heads/ordewell/"]);
+    if (!worktrees.ok || !refs.ok) return false;
+    const checkedOut = /* @__PURE__ */ new Set();
+    const liveRuns = /* @__PURE__ */ new Set();
+    for (const line of worktrees.stdout.split(/\r?\n/)) {
+      if (line.startsWith("branch refs/heads/")) checkedOut.add(line.slice("branch refs/heads/".length));
+      const runId = line.startsWith("worktree ") ? RUN_WORKTREE.exec(line)?.[1] : void 0;
+      if (runId) liveRuns.add(runId);
+    }
+    let ok = true;
+    for (const ref of refs.stdout.split(/\r?\n/).filter(Boolean)) {
+      const branch = ref.slice("refs/heads/".length);
+      const runId = RUN_BRANCH.exec(branch)?.[1];
+      if (!runId || runId === run.id || liveRuns.has(runId) || checkedOut.has(branch)) continue;
+      if (await this.deleteIfMerged(repo.root, branch) === "failed") ok = false;
+    }
+    return ok;
+  }
+  /**
+   * Delete `branch` only if the repo's checked-out HEAD already contains it —
+   * HEAD, not an upstream: what the user has checked out is what they merged
+   * into. `-d` rather than `-D`, so git also refuses a branch a worktree has
+   * checked out.
+   */
+  async deleteIfMerged(root, branch) {
+    const merged = await this.tryGit(root, ["merge-base", "--is-ancestor", branch, "HEAD"]);
+    if (!merged.ok) return merged.code === 1 ? "kept" : "failed";
+    return (await this.tryGit(root, ["branch", "-d", branch])).ok ? "deleted" : "failed";
+  }
   async drain() {
     try {
       while (this.waiting.length > 0) {
@@ -5124,21 +5331,24 @@ var GitWorktreeIsolation = class {
         return this.stopLanding(record, "failed");
       }
       for (const repo of changed) {
-        const outcome = await this.mergeTask(run, repo, record);
+        const { outcome, files } = await this.mergeTask(run, repo, record);
         if (outcome === "merged") continue;
-        return (await this.settleLanding(run)).length === 0 ? this.stopLanding(record, outcome, repo) : this.stopLanding(record, "failed", repo);
+        return (await this.settleLanding(run)).length === 0 ? this.stopLanding(record, outcome, repo, files) : this.stopLanding(record, "failed", repo);
       }
     }
     delete run.landing;
-    record.status = "merged";
+    settleStatus(record, "merged");
     delete record.conflictRepo;
+    delete record.conflictFiles;
     await this.admin(run.workspaceRoot, () => this.removeTask(run, record, { dropRecord: false })).catch(() => void 0);
     return "merged";
   }
-  stopLanding(record, outcome, repo) {
-    record.status = outcome;
+  stopLanding(record, outcome, repo, files) {
+    settleStatus(record, outcome);
     if (repo) record.conflictRepo = repo.path;
     else delete record.conflictRepo;
+    if (files && files.length > 0) record.conflictFiles = files;
+    else delete record.conflictFiles;
     return outcome;
   }
   /** Merge the task branch into one repo's integration branch. A merge that does not complete is aborted: it is Ordewell's own. */
@@ -5147,13 +5357,13 @@ var GitWorktreeIsolation = class {
     try {
       dir = await this.ensureIntegrationWorktree(run, repo);
     } catch {
-      return "failed";
+      return { outcome: "failed", files: [] };
     }
     const merge = await this.tryGit(dir, ["merge", "--no-ff", "--no-edit", "-m", `Merge task ${record.order}: ${firstLine(record.title)}`, record.branch]);
-    if (merge.ok) return "merged";
-    const conflicted = (await this.unmergedPaths(dir)).length > 0;
+    if (merge.ok) return { outcome: "merged", files: [] };
+    const files = await this.unmergedPaths(dir);
     if (await this.mergeInProgress(dir)) await this.abortMerge(dir);
-    return conflicted ? "conflict" : "failed";
+    return { outcome: files.length > 0 ? "conflict" : "failed", files };
   }
   /**
    * Return every repo of the landing in flight to its recorded tip, then
@@ -5221,15 +5431,15 @@ var GitWorktreeIsolation = class {
     await this.git(entry.worktree, ["commit", "-q", "-m", `ordewell: task ${record.order} ${firstLine(record.title)}`]);
   }
   integrationDir(run, repo) {
-    return path8.join(this.runRoot(run), INTEGRATION_DIR, repo.path);
+    return path9.join(this.runRoot(run), INTEGRATION_DIR, repo.path);
   }
   async ensureIntegrationWorktree(run, repo) {
     return this.admin(run.workspaceRoot, async () => {
       const dir = this.integrationDir(run, repo);
-      if (fs4.existsSync(path8.join(dir, ".git"))) return dir;
+      if (fs4.existsSync(path9.join(dir, ".git"))) return dir;
       await this.tryGit(repo.root, ["worktree", "prune"]);
       ensureStateDirIgnored(run.workspaceRoot);
-      fs4.mkdirSync(path8.dirname(dir), { recursive: true });
+      fs4.mkdirSync(path9.dirname(dir), { recursive: true });
       await this.git(repo.root, ["worktree", "add", "-q", dir, repo.integrationBranch]);
       return dir;
     });
@@ -5264,20 +5474,20 @@ var GitWorktreeIsolation = class {
       return;
     }
     for (const entry of entries) {
-      const target = path8.join(dir, entry.name);
+      const target = path9.join(dir, entry.name);
       if (entry.isSymbolicLink()) this.unlinkIfLink(target);
       else if (entry.isDirectory()) this.unlinkLinksUnder(target);
     }
   }
   /** Task workspaces and branches under this run that no record accounts for. */
   async removeUnowned(run) {
-    const owned = new Set(Object.values(run.tasks).map((r) => path8.resolve(r.workspace)));
+    const owned = new Set(Object.values(run.tasks).map((r) => path9.resolve(r.workspace)));
     const root = this.runRoot(run);
     if (fs4.existsSync(root)) {
       for (const entry of fs4.readdirSync(root)) {
-        const dir = path8.join(root, entry);
-        if (entry === INTEGRATION_DIR || owned.has(path8.resolve(dir))) continue;
-        for (const repo of run.repos) await this.removeWorktreeDir(run, repo, path8.join(dir, repo.path), []);
+        const dir = path9.join(root, entry);
+        if (entry === INTEGRATION_DIR || owned.has(path9.resolve(dir))) continue;
+        for (const repo of run.repos) await this.removeWorktreeDir(run, repo, path9.join(dir, repo.path), []);
         this.removeTaskWorkspace(run, dir);
       }
     }
@@ -5291,14 +5501,18 @@ var GitWorktreeIsolation = class {
     }
   }
   async removeWorktreeDir(run, repo, dir, linked) {
-    for (const name of linked) this.unlinkIfLink(path8.join(dir, name));
+    for (const name of /* @__PURE__ */ new Set([...linked, ...installDirs(dir)])) {
+      const target = path9.join(dir, name);
+      this.unlinkIfLink(target);
+      this.unlinkLinksUnder(target);
+    }
     for (const name of fs4.existsSync(dir) ? fs4.readdirSync(dir) : []) {
-      if (LINKED_ARTIFACTS.has(name) || isEnvFile(name)) this.unlinkIfLink(path8.join(dir, name));
+      if (LINKED_ARTIFACTS.has(name) || isEnvFile(name)) this.unlinkIfLink(path9.join(dir, name));
     }
     await this.tryGit(repo.root, ["worktree", "remove", "--force", dir]);
     if (fs4.existsSync(dir) && isInside(this.runRoot(run), dir)) fs4.rmSync(dir, { recursive: true, force: true });
     await this.tryGit(repo.root, ["worktree", "prune"]);
-    for (let parent = path8.dirname(dir); isInside(this.runRoot(run), parent); parent = path8.dirname(parent)) this.removeIfEmpty(parent);
+    for (let parent = path9.dirname(dir); isInside(this.runRoot(run), parent); parent = path9.dirname(parent)) this.removeIfEmpty(parent);
   }
   unlinkIfLink(target) {
     try {
@@ -5313,14 +5527,14 @@ var GitWorktreeIsolation = class {
     }
   }
   runRoot(run) {
-    return path8.join(run.workspaceRoot, STATE_DIR, "worktrees", run.id);
+    return path9.join(run.workspaceRoot, STATE_DIR, "worktrees", run.id);
   }
   namesFor(run, task) {
     const slug2 = sanitizeSlug(task.title).slice(0, 40).replace(/-+$/, "") || "task";
     let name = `${task.order}-${slug2}`;
     const clash = Object.values(run.tasks).some((r) => r.taskId !== task.id && r.branch === `ordewell/${run.id}/${name}`);
     if (clash) name = `${name}-${sanitizeSlug(task.id) || "x"}`;
-    return { branch: `ordewell/${run.id}/${name}`, dir: path8.join(this.runRoot(run), name) };
+    return { branch: `ordewell/${run.id}/${name}`, dir: path9.join(this.runRoot(run), name) };
   }
   /**
    * Make one repo's worktree runnable: the default artifacts, unless a setup
@@ -5333,16 +5547,26 @@ var GitWorktreeIsolation = class {
     const linked = [];
     const copied = [];
     const link = (name) => {
-      const target = path8.join(cwd, name);
+      const target = path9.join(cwd, name);
       if (lexists(target)) return;
-      fs4.mkdirSync(path8.dirname(target), { recursive: true });
-      if (linkPath(path8.join(repo.root, name), target, this.platform) === "copy") copied.push(name);
+      fs4.mkdirSync(path9.dirname(target), { recursive: true });
+      if (linkPath(path9.join(repo.root, name), target, this.platform) === "copy") copied.push(name);
+      linked.push(name);
+    };
+    const mirror = (name) => {
+      const target = path9.join(cwd, name);
+      if (lexists(target) || !fs4.existsSync(path9.dirname(target))) return;
+      const source = path9.join(repo.root, name);
+      if (!fs4.lstatSync(source).isDirectory()) return link(name);
+      const mirrored = mirrorDir(source, target, { platform: this.platform, from: repo.root, to: cwd });
+      copied.push(...mirrored.map((entry) => path9.join(name, entry)));
       linked.push(name);
     };
     if (!setup) {
       for (const name of fs4.readdirSync(repo.root)) {
-        if (name !== STATE_DIR && (LINKED_ARTIFACTS.has(name) || isEnvFile(name))) link(name);
+        if (name !== STATE_DIR && name !== "node_modules" && (LINKED_ARTIFACTS.has(name) || isEnvFile(name))) link(name);
       }
+      for (const dir of installDirs(repo.root)) mirror(dir);
     }
     for (const name of matchLinks(repo.root, this.deps.config.worktreeLinks)) link(name);
     if (setup) await this.runSetup(setup, repo, cwd);
@@ -6004,6 +6228,7 @@ function researchPhaseBlock(harnessMode) {
 }
 var ISOLATED_PARALLELISM_RULE = "- Each AI task runs in its own git worktree, and its work is merged in afterwards, so tasks that edit the same files can still run in parallel. Never add a dependency just because two tasks touch the same file \u2014 keep dependencies for genuine logical ordering.";
 var OVERLAP_AVOIDANCE_RULE = "- For parallel tasks, specify different target files to avoid merge conflicts.";
+var SHARED_APPEND_FILE_RULE = "- Tasks that run in parallel must not each append to the same shared file (changelogs, registries, index lists) \u2014 give that edit to the final task, or to one task the others depend on.";
 function repoGroupSection(isolated) {
   if (!isolated || isolated.repos.length === 1 && isolated.repos[0] === SELF_REPO) return [];
   return [
@@ -6095,6 +6320,7 @@ function buildConversationBody(goal, context, modelsJson, runners, modeGuide, mo
     "DEPENDENCY & PARALLELISM:",
     "- Independent slices should have NO dependencies \u2014 they run in parallel.",
     "- Only add dependencies when a slice truly depends on artifacts another slice creates.",
+    SHARED_APPEND_FILE_RULE,
     ...variant.isolatedExecution ? [ISOLATED_PARALLELISM_RULE] : [],
     ...repoGroupSection(variant.isolatedExecution),
     "",
@@ -6196,6 +6422,7 @@ function corePlannerPrompt(isolatedExecution) {
     isolatedExecution ? "- Independent vertical slices should have NO dependencies between them \u2014 they can run in parallel." : "- Independent vertical slices (no shared files/modules) should have NO dependencies between them \u2014 they can run in parallel.",
     "- Only add dependencies when the second slice truly depends on artifacts (files, APIs) that the first slice creates.",
     "- Prefer parallelism over serial chains. A plan with 3 independent slices running in parallel is better than 3 sequential tasks.",
+    SHARED_APPEND_FILE_RULE,
     isolatedExecution ? ISOLATED_PARALLELISM_RULE : "- Slices that touch different areas of the codebase are naturally parallel.",
     ...repoGroupSection(isolatedExecution),
     "",
@@ -6473,6 +6700,31 @@ ${task.prompt ?? task.description}`;
     asked
   ].join("\n");
 }
+function buildConflictRepairPrompt(task, conflict, integrationBranch) {
+  const { branch } = conflict;
+  const files = conflict.conflictFiles ?? [];
+  const asked = `What the task was asked to do:
+${task.prompt ?? task.description}`;
+  const resolve7 = "resolve every conflict so that both sides' intent survives: keep the work already integrated and add what the task contributed.";
+  const repos = conflict.repos.filter((repo) => repo !== SELF_REPO);
+  if (repos.length === 0) {
+    return [
+      `Task #${task.order} "${task.title}" passed, but merging its branch \`${branch}\` into \`${integrationBranch}\` conflicted${files.length > 0 ? ` in ${files.join(", ")}` : ""}. None of its work has landed yet.`,
+      `This is the task's own worktree, on \`${branch}\`, with its work committed. Run \`git merge --no-edit ${integrationBranch}\` here and ${resolve7} Never drop either side wholesale, and never abort the merge or reset it away.`,
+      "Build and test the result the way this project does, commit the merge, and only then print the completion marker.",
+      "",
+      asked
+    ].join("\n");
+  }
+  const stoppedIn = conflict.conflictRepo ?? repos[0];
+  return [
+    `Task #${task.order} "${task.title}" passed, but landing its branch \`${branch}\` on \`${integrationBranch}\` conflicted in ${stoppedIn}${files.length > 0 ? ` (${files.join(", ")})` : ""}. A task lands in every repository it changed or in none, so none of its work has landed yet.`,
+    `This is the task's own workspace, with each repository at its usual path on \`${branch}\` and the task's work committed. In each repository the task changed \u2014 ${repos.join(", ")} \u2014 run \`git merge --no-edit ${integrationBranch}\` inside that repository's directory, and ${resolve7} Never drop either side wholesale, and never abort a merge or reset it away.`,
+    "Build and test the result the way this project does, commit the merge in each repository, and only then print the completion marker.",
+    "",
+    asked
+  ].join("\n");
+}
 
 // src/services/PlanValidator.ts
 function parsePlanJson(raw, runners, runnerModes, autonomousDefault = true) {
@@ -7826,8 +8078,8 @@ function compactResearchResults(resultsText, maxChars = COMPACTION_LIMITS.resear
 
 // src/services/ContextCollector.ts
 var ORDEWELL_CONTEXT_MAX = 8e3;
-async function collectResearchContext(fs14, runners) {
-  const collector = new ContextCollector(fs14);
+async function collectResearchContext(fs15, runners) {
+  const collector = new ContextCollector(fs15);
   let contextStr = "";
   let firstContext = null;
   for (const r of runners) {
@@ -7854,8 +8106,8 @@ ${firstContext.dirStructure}
   return contextStr;
 }
 var ContextCollector = class {
-  constructor(fs14, registry) {
-    this.fs = fs14;
+  constructor(fs15, registry) {
+    this.fs = fs15;
     this.registry = registry;
   }
   fs;
@@ -7936,10 +8188,10 @@ function summarizeToolCall(tool, argsJson, toolLabel) {
       const scope = args.include ? ` in ${args.include}` : "";
       return `grep ${ellipsize(String(args.pattern), 40)}${scope}${mode}`;
     }
-    const path23 = args.filePath || args.file_path || args.path;
-    if (path23) {
-      const basename = String(path23).split("/").pop() || String(path23);
-      return `${display} ${basename}`;
+    const path26 = args.filePath || args.file_path || args.path;
+    if (path26) {
+      const basename2 = String(path26).split("/").pop() || String(path26);
+      return `${display} ${basename2}`;
     }
     if (args.pattern) {
       return `${display} ${args.pattern}`;
@@ -7972,22 +8224,22 @@ var ALLOWED_TOOL_NAMES = new Set(subagentToolSpecs().map((t) => t.name));
 function refused(output) {
   return { success: false, output, truncated: false };
 }
-function nonPromptingFs(fs14) {
-  const withinWorkspace = (p) => resolveWithin(fs14.getWorkspaceRoot(), p ?? ".").inside;
+function nonPromptingFs(fs15) {
+  const withinWorkspace = (p) => resolveWithin(fs15.getWorkspaceRoot(), p ?? ".").inside;
   const outsideRefusal = (p) => refused(
     `Path "${p}" is outside the workspace. Research agents are confined to the workspace root \u2014 note the gap in your digest and let the planner request it directly.`
   );
   return {
-    getWorkspaceRoot: () => fs14.getWorkspaceRoot(),
-    readFile: (p, opts) => withinWorkspace(p) ? fs14.readFile(p, opts) : Promise.resolve(outsideRefusal(p)),
+    getWorkspaceRoot: () => fs15.getWorkspaceRoot(),
+    readFile: (p, opts) => withinWorkspace(p) ? fs15.readFile(p, opts) : Promise.resolve(outsideRefusal(p)),
     readFiles: (paths) => {
       const escaping = paths.find((p) => !withinWorkspace(p));
-      return escaping ? Promise.resolve(outsideRefusal(escaping)) : fs14.readFiles(paths);
+      return escaping ? Promise.resolve(outsideRefusal(escaping)) : fs15.readFiles(paths);
     },
-    glob: (pattern, opts) => withinWorkspace(opts?.path) ? fs14.glob(pattern, opts) : Promise.resolve(outsideRefusal(opts.path)),
-    grep: (pattern, opts) => withinWorkspace(opts?.path) ? fs14.grep(pattern, opts) : Promise.resolve(outsideRefusal(opts.path)),
-    findSymbol: (symbol, opts) => withinWorkspace(opts?.path) ? fs14.findSymbol(symbol, opts) : Promise.resolve(outsideRefusal(opts.path)),
-    listDir: (p, depth) => withinWorkspace(p) ? fs14.listDir(p, depth) : Promise.resolve(outsideRefusal(p)),
+    glob: (pattern, opts) => withinWorkspace(opts?.path) ? fs15.glob(pattern, opts) : Promise.resolve(outsideRefusal(opts.path)),
+    grep: (pattern, opts) => withinWorkspace(opts?.path) ? fs15.grep(pattern, opts) : Promise.resolve(outsideRefusal(opts.path)),
+    findSymbol: (symbol, opts) => withinWorkspace(opts?.path) ? fs15.findSymbol(symbol, opts) : Promise.resolve(outsideRefusal(opts.path)),
+    listDir: (p, depth) => withinWorkspace(p) ? fs15.listDir(p, depth) : Promise.resolve(outsideRefusal(p)),
     bash: async (command, signal) => {
       const dialect = resolveResearchShell().dialect;
       const { tier, reason } = classifyCommand(command, { dialect });
@@ -7998,13 +8250,13 @@ function nonPromptingFs(fs14) {
       }
       const escaping = pathLikeArgs(command, { dialect }).find((p) => !withinWorkspace(p));
       if (escaping) return outsideRefusal(escaping);
-      return fs14.bash(command, signal);
+      return fs15.bash(command, signal);
     }
   };
 }
 async function runLoop(prompt, deps) {
   if (deps.signal?.aborted) return "[research agent aborted before starting]";
-  const fs14 = nonPromptingFs(deps.fs);
+  const fs15 = nonPromptingFs(deps.fs);
   const chat = deps.createChat((delta) => deps.onProgress?.({ type: "thinking", text: delta }));
   let turn = await chat.sendMessage(prompt, deps.signal);
   for (let step = 0; turn.hasToolCalls && step < SUBAGENT_LIMITS.maxSteps; step++) {
@@ -8021,7 +8273,7 @@ ${turn.text}`;
       if (tc.name === "read_file" && !("maxBytes" in args) && !("limit" in args)) args.limit = 2e3;
       const toolArgs = JSON.stringify(tc.args);
       deps.onProgress?.({ type: "tool_call", tool: tc.name, toolArgs, toolCallId: tc.id });
-      const res = await executeTool(tc.name, args, fs14, void 0, deps.signal);
+      const res = await executeTool(tc.name, args, fs15, void 0, deps.signal);
       const output = res.output.length > SUBAGENT_LIMITS.toolOutputMaxChars ? res.output.slice(0, SUBAGENT_LIMITS.toolOutputMaxChars) + `
 [... truncated to ${SUBAGENT_LIMITS.toolOutputMaxChars} chars, total ${res.output.length}]` : res.output;
       const stepEntry = {
@@ -8137,7 +8389,7 @@ var BaseAiService = class _BaseAiService {
    * steering/failed result and the loop continues sequentially: a subagent can
    * never fail a plan or a turn.
    */
-  async executeSpawnAgent(args, fs14, onProgress, signal, subagentId) {
+  async executeSpawnAgent(args, fs15, onProgress, signal, subagentId) {
     const prompt = typeof args.prompt === "string" ? args.prompt.trim() : "";
     if (!prompt) {
       return { success: false, output: 'spawn_research_agent requires a non-empty "prompt" string: a self-contained task for the agent, including what its digest must report back.', truncated: false };
@@ -8148,20 +8400,20 @@ var BaseAiService = class _BaseAiService {
         if (!chat) throw new Error("subagent chats are not available for this provider");
         return chat;
       },
-      fs: fs14,
+      fs: fs15,
       signal,
       onProgress: (progress) => onProgress({ ...progress, subagentId })
     });
   }
   /** Collect project context for the planning phase. Shared with the harness backend. */
-  static async collectResearchContext(fs14, runners) {
-    return collectResearchContext(fs14, runners);
+  static async collectResearchContext(fs15, runners) {
+    return collectResearchContext(fs15, runners);
   }
   /**
    * Execute one round of tool calls and report each through onProgress.
    * Returns the results to feed back plus the log entries produced.
    */
-  async executeToolCalls(toolCalls, fs14, onProgress, fetcher, stepIndex, thinking, signal) {
+  async executeToolCalls(toolCalls, fs15, onProgress, fetcher, stepIndex, thinking, signal) {
     const toolResults = [];
     const logEntries = [];
     let resultsText = "";
@@ -8180,18 +8432,18 @@ var BaseAiService = class _BaseAiService {
         const subagentId = (0, import_uuid3.v4)();
         spawnSubagentIds.set(i, subagentId);
         onProgress({ type: "tool_call", tool: toolCalls[i].name, toolArgs: JSON.stringify(toolCalls[i].args), subagentId, toolCallId: toolCalls[i].id });
-        precomputed.set(i, await this.executeSpawnAgent({ ...toolCalls[i].args }, fs14, onProgress, signal, subagentId));
+        precomputed.set(i, await this.executeSpawnAgent({ ...toolCalls[i].args }, fs15, onProgress, signal, subagentId));
       }) : Promise.resolve(),
       parallelIndexes.length > 1 ? mapWithConcurrency(parallelIndexes, TOOL_ROUND_CONCURRENCY, async (i) => {
         onProgress({ type: "tool_call", tool: toolCalls[i].name, toolArgs: JSON.stringify(toolCalls[i].args), toolCallId: toolCalls[i].id });
-        precomputed.set(i, await executeTool(toolCalls[i].name, normalizedArgs[i], fs14, fetcher, signal));
+        precomputed.set(i, await executeTool(toolCalls[i].name, normalizedArgs[i], fs15, fetcher, signal));
       }) : Promise.resolve()
     ]);
     for (const [index, tc] of toolCalls.entries()) {
       const toolArgs = normalizedArgs[index];
       const preResult = precomputed.get(index);
       if (!preResult) onProgress({ type: "tool_call", tool: tc.name, toolArgs: JSON.stringify(tc.args), toolCallId: tc.id });
-      const toolResult = preResult ?? await executeTool(tc.name, toolArgs, fs14, fetcher, signal);
+      const toolResult = preResult ?? await executeTool(tc.name, toolArgs, fs15, fetcher, signal);
       const MAX_RESPONSE_CHARS = 5e4;
       const truncatedResponse = toolResult.success && (toolResult.truncated || toolResult.output.length > MAX_RESPONSE_CHARS);
       const llmOutput = toolResult.output.length > MAX_RESPONSE_CHARS ? toolResult.output.slice(0, MAX_RESPONSE_CHARS) + `
@@ -8377,7 +8629,7 @@ ${llmOutput}
    * parsed tasks if a plan was emitted mid-loop, or null if the loop
    * exhausted without a valid plan.
    */
-  async runResearchLoop(chat, firstMessage, fs14, onProgress, runners, initialLog, fetcher, userGoal, runnerModes, autonomousDefault, signal) {
+  async runResearchLoop(chat, firstMessage, fs15, onProgress, runners, initialLog, fetcher, userGoal, runnerModes, autonomousDefault, signal) {
     const researchLog = initialLog ? [...initialLog] : [];
     if (!initialLog && userGoal) {
       researchLog.push({
@@ -8404,7 +8656,7 @@ ${llmOutput}
       if (!turn.hasToolCalls) break;
       const { toolResults, logEntries, resultsText } = await this.executeToolCalls(
         turn.toolCalls,
-        fs14,
+        fs15,
         onProgress,
         fetcher,
         step,
@@ -8637,11 +8889,11 @@ ${repairHint}` }] : parts;
     return this.consumePlanStream(result, onToken);
   }
   // --- IAiService implementation ---
-  async researchAndPlan(userDescription, runners, modelsByRunner, fs14, onProgress, fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, signal) {
+  async researchAndPlan(userDescription, runners, modelsByRunner, fs15, onProgress, fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, signal) {
     this.ensureInit();
     const { autonomousDefault } = modes;
     const genModel = this.getPlanningModel();
-    const contextStr = await BaseAiService.collectResearchContext(fs14, runners);
+    const contextStr = await BaseAiService.collectResearchContext(fs15, runners);
     const systemPrompt = buildResearchPrompt(userDescription, contextStr, modelsByRunner, runners, runnerModes, modes);
     const firstMessage = `${buildResearchToolsPrompt()}
 
@@ -8652,17 +8904,17 @@ Explore the workspace to understand the codebase, then generate the plan.`;
       generationConfig: { temperature: 0.3, topP: 0.95, maxOutputTokens: 16384 }
     });
     const researchChat = new GeminiResearchChat(chat);
-    const result = await this.runResearchLoop(researchChat, firstMessage, fs14, onProgress, runners, void 0, fetcher, userDescription, runnerModes, autonomousDefault, signal);
+    const result = await this.runResearchLoop(researchChat, firstMessage, fs15, onProgress, runners, void 0, fetcher, userDescription, runnerModes, autonomousDefault, signal);
     if (result.tasks) return { tasks: result.tasks, researchLog: result.researchLog, researchResults: result.researchResults };
     const fallback = await this.generatePlanFallback(userDescription, contextStr, result.researchResults, modelsByRunner, runners, onProgress, result.researchLog, runnerModes, autonomousDefault, signal, modes);
     return { tasks: fallback.tasks, researchLog: fallback.researchLog, researchResults: result.researchResults };
   }
-  async generatePlanDirect(userDescription, runners = ["claude-code"], modelsByRunner = {}, onToken, fs14, _fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, _signal) {
+  async generatePlanDirect(userDescription, runners = ["claude-code"], modelsByRunner = {}, onToken, fs15, _fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, _signal) {
     this.ensureInit();
     const { autonomousDefault } = modes;
     let ctx = "";
-    if (fs14) {
-      const collected = await new ContextCollector(fs14).collect(runners[0] ?? "claude-code");
+    if (fs15) {
+      const collected = await new ContextCollector(fs15).collect(runners[0] ?? "claude-code");
       if (collected.aiflowContext) ctx = `
 <aiflow_context>
 ${collected.aiflowContext}
@@ -8678,12 +8930,12 @@ ${collected.aiflowContext}
       autonomousDefault
     );
   }
-  async modifyPlan(existingPlan, userRequest, modelsByRunner, onProgress, fs14, _fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, _signal) {
+  async modifyPlan(existingPlan, userRequest, modelsByRunner, onProgress, fs15, _fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, _signal) {
     this.ensureInit();
     const { autonomousDefault } = modes;
     let aiflowContext;
-    if (fs14) {
-      const collected = await new ContextCollector(fs14).collect(existingPlan.runners[0] ?? "claude-code");
+    if (fs15) {
+      const collected = await new ContextCollector(fs15).collect(existingPlan.runners[0] ?? "claude-code");
       if (collected.aiflowContext) aiflowContext = collected.aiflowContext;
     }
     const prompt = buildModifyPlanPrompt(existingPlan, userRequest, modelsByRunner, aiflowContext, runnerModes, autonomousDefault);
@@ -8919,11 +9171,11 @@ ${buildResearchToolsPrompt()}` }
     }
   }
   // --- IAiService implementation ---
-  async researchAndPlan(userDescription, runners, modelsByRunner, fs14, onProgress, fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, signal) {
+  async researchAndPlan(userDescription, runners, modelsByRunner, fs15, onProgress, fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, signal) {
     this.ensureInit();
     const client = this.getClient();
     const { autonomousDefault } = modes;
-    const contextStr = await BaseAiService.collectResearchContext(fs14, runners);
+    const contextStr = await BaseAiService.collectResearchContext(fs15, runners);
     const systemPrompt = buildResearchPrompt(userDescription, contextStr, modelsByRunner, runners, runnerModes, modes);
     const userText = `User goal: ${userDescription}`;
     const firstMessage = `${buildResearchToolsPrompt()}
@@ -8941,17 +9193,17 @@ ${userText}`;
       toOpenAiTools(),
       (delta) => onProgress({ type: "thinking", text: delta })
     );
-    const result = await this.runResearchLoop(researchChat, firstMessage, fs14, onProgress, runners, void 0, fetcher, userDescription, runnerModes, autonomousDefault, signal);
+    const result = await this.runResearchLoop(researchChat, firstMessage, fs15, onProgress, runners, void 0, fetcher, userDescription, runnerModes, autonomousDefault, signal);
     if (result.tasks) return { tasks: result.tasks, researchLog: result.researchLog, researchResults: result.researchResults };
     const fallback = await this.generatePlanFallback(userDescription, contextStr, result.researchResults, modelsByRunner, runners, onProgress, result.researchLog, runnerModes, autonomousDefault, signal, modes);
     return { tasks: fallback.tasks, researchLog: fallback.researchLog, researchResults: result.researchResults };
   }
-  async generatePlanDirect(userDescription, runners = ["claude-code"], modelsByRunner = {}, onToken, fs14, _fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, signal) {
+  async generatePlanDirect(userDescription, runners = ["claude-code"], modelsByRunner = {}, onToken, fs15, _fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, signal) {
     this.ensureInit();
     const { autonomousDefault } = modes;
     let ctx = "";
-    if (fs14) {
-      const collected = await new ContextCollector(fs14).collect(runners[0] ?? "claude-code");
+    if (fs15) {
+      const collected = await new ContextCollector(fs15).collect(runners[0] ?? "claude-code");
       if (collected.aiflowContext) ctx = `
 <aiflow_context>
 ${collected.aiflowContext}
@@ -8967,12 +9219,12 @@ ${collected.aiflowContext}
       autonomousDefault
     );
   }
-  async modifyPlan(existingPlan, userRequest, modelsByRunner, onProgress, fs14, _fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, signal) {
+  async modifyPlan(existingPlan, userRequest, modelsByRunner, onProgress, fs15, _fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, signal) {
     this.ensureInit();
     const { autonomousDefault } = modes;
     let aiflowContext;
-    if (fs14) {
-      const collected = await new ContextCollector(fs14).collect(existingPlan.runners[0] ?? "claude-code");
+    if (fs15) {
+      const collected = await new ContextCollector(fs15).collect(existingPlan.runners[0] ?? "claude-code");
       if (collected.aiflowContext) aiflowContext = collected.aiflowContext;
     }
     const prompt = buildModifyPlanPrompt(existingPlan, userRequest, modelsByRunner, aiflowContext, runnerModes, autonomousDefault);
@@ -8991,6 +9243,9 @@ ${collected.aiflowContext}
   }
 };
 
+// src/services/TaskOrchestrator.ts
+var path12 = __toESM(require("path"));
+
 // src/services/promptAugment.ts
 var MAX_TAIL_CHARS = 500;
 var DEFAULT_PLAN_MAP_MAX_ENTRIES = 30;
@@ -9577,17 +9832,229 @@ ${line}
 
 // src/services/transcriptCapture.ts
 var import_fs = require("fs");
+var os4 = __toESM(require("os"));
+var path11 = __toESM(require("path"));
+
+// src/services/workspaceEnv.ts
+var import_child_process3 = require("child_process");
+var fs5 = __toESM(require("fs"));
 var os3 = __toESM(require("os"));
-var path9 = __toESM(require("path"));
+var path10 = __toESM(require("path"));
+
+// src/services/settingsEnvAllowlist.ts
+var ORDEWELL_SETTABLE_ENV = [
+  "AI_PROVIDER",
+  "ORCHESTRATOR_MODEL",
+  "ORDEWELL_SUBAGENT_MODEL",
+  "ORDEWELL_PLANNER_EFFORT",
+  "ORDEWELL_RESEARCH_ENABLED",
+  "ORDEWELL_MAX_PARALLEL",
+  "ORDEWELL_CONFLICT_REPAIR_ATTEMPTS"
+];
+var SETTINGS_ENV_REFUSED = [
+  // Approval posture and pre-approved scope.
+  "ORDEWELL_AUTONOMOUS_MODE",
+  "ORDEWELL_APPROVAL_MODE",
+  "ORDEWELL_APPROVAL_ALLOW",
+  // Where settings are persisted.
+  "ORDEWELL_SETTINGS_PATH",
+  // Runtime options and dynamic loaders.
+  "NODE_OPTIONS",
+  "NODE_REPL_EXTERNAL_MODULE",
+  "NODE_PATH",
+  "ELECTRON_RUN_AS_NODE",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "LD_AUDIT",
+  "DYLD_INSERT_LIBRARIES",
+  "DYLD_LIBRARY_PATH",
+  "DYLD_FRAMEWORK_PATH",
+  // Executable resolution.
+  "PATH",
+  "PATHEXT",
+  "NODE"
+];
+var REFUSED = new Set(SETTINGS_ENV_REFUSED);
+function providerEnvKeys() {
+  const keys = [];
+  for (const meta of Object.values(ALL_PROVIDERS)) {
+    if (meta.apiKeyEnvVar) keys.push(meta.apiKeyEnvVar);
+    if (meta.baseUrlEnvVar) keys.push(meta.baseUrlEnvVar);
+    for (const detect of meta.detectEnvVars) keys.push(detect);
+  }
+  return keys;
+}
+var PROVIDER_CREDENTIAL_ENV = new Set(providerEnvKeys());
+var SETTINGS_ENV_ALLOWLIST = new Set(
+  [...providerEnvKeys(), ...ORDEWELL_SETTABLE_ENV].filter((key) => !REFUSED.has(key))
+);
+function admitSettingsEnv(env) {
+  const accepted = {};
+  const rejected = [];
+  for (const [key, value] of Object.entries(env)) {
+    if (REFUSED.has(key) || !SETTINGS_ENV_ALLOWLIST.has(key) || typeof value !== "string") {
+      rejected.push(key);
+      continue;
+    }
+    accepted[key] = value;
+  }
+  return { accepted, rejected };
+}
+
+// src/services/workspaceEnv.ts
+var WORKSPACE_ENV_FILE = "env";
+var DIRENV_TIMEOUT_MS = 5e3;
+var KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function defaultDeps() {
+  return {
+    run: (command, args, opts) => new Promise((resolve7) => {
+      (0, import_child_process3.execFile)(command, args, { ...opts, timeout: DIRENV_TIMEOUT_MS, encoding: "utf8" }, (err, stdout, stderr) => {
+        const code = err ? typeof err.code === "number" ? Number(err.code) : -1 : 0;
+        resolve7({ code, stdout: String(stdout ?? ""), stderr: String(stderr ?? "") });
+      });
+    }),
+    readFile: (file) => {
+      try {
+        return fs5.readFileSync(file, "utf8");
+      } catch {
+        return null;
+      }
+    },
+    isDirectory: (dir) => {
+      try {
+        return fs5.statSync(dir).isDirectory();
+      } catch {
+        return false;
+      }
+    },
+    baseEnv: process.env,
+    home: os3.homedir()
+  };
+}
+var REFUSED2 = new Set(SETTINGS_ENV_REFUSED);
+async function resolveWorkspaceEnv(cwd, overrides = {}) {
+  const deps = { ...defaultDeps(), ...overrides };
+  const result = { env: {}, blockedEnvrc: null, refused: [], trackedEnvFile: null };
+  if (!deps.isDirectory(cwd)) return result;
+  const collected = {};
+  const direnv = await fromDirenv(checkoutDirOf(cwd, deps), deps);
+  result.blockedEnvrc = direnv.blocked;
+  Object.assign(collected, direnv.env);
+  const file = findUp(cwd, path10.join(STATE_DIR, WORKSPACE_ENV_FILE), deps);
+  if (file) {
+    const content = deps.readFile(file);
+    if (content !== null) {
+      if (await isTracked(file, deps)) result.trackedEnvFile = file;
+      else Object.assign(collected, parseEnvFile(content, { ...deps.baseEnv, ...collected }, deps.home));
+    }
+  }
+  for (const [key, value] of Object.entries(collected)) {
+    if (!KEY.test(key)) continue;
+    if (REFUSED2.has(key) || key.toUpperCase() === "PATH") result.refused.push(key);
+    else result.env[key] = value;
+  }
+  return result;
+}
+async function workspaceEnvOf(cwd) {
+  return (await resolveWorkspaceEnv(cwd)).env;
+}
+function checkoutDirOf(cwd, deps) {
+  const parts = path10.resolve(cwd).split(path10.sep);
+  const at = parts.findIndex((part, i) => part === STATE_DIR && parts[i + 1] === "worktrees");
+  if (at < 0 || parts.length < at + 4) return cwd;
+  const root = parts.slice(0, at).join(path10.sep) || path10.sep;
+  const mapped = path10.join(root, ...parts.slice(at + 4));
+  return deps.isDirectory(mapped) ? mapped : root;
+}
+async function fromDirenv(cwd, deps) {
+  const setting = deps.baseEnv.ORDEWELL_DIRENV;
+  if (setting === "false" || setting === "0") return { env: {}, blocked: null };
+  const baseEnv = Object.fromEntries(Object.entries(deps.baseEnv).filter(([key]) => !key.startsWith("DIRENV_")));
+  let out;
+  try {
+    out = await deps.run("direnv", ["export", "json"], { cwd, env: baseEnv });
+  } catch {
+    return { env: {}, blocked: null };
+  }
+  const blocked = out.stderr.match(/error (\S*\.envrc) is blocked/);
+  if (blocked) return { env: {}, blocked: blocked[1] };
+  if (out.code !== 0 || !out.stdout.trim()) return { env: {}, blocked: null };
+  let parsed;
+  try {
+    parsed = JSON.parse(out.stdout);
+  } catch {
+    return { env: {}, blocked: null };
+  }
+  if (!parsed || typeof parsed !== "object") return { env: {}, blocked: null };
+  const env = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (typeof value === "string" && !key.startsWith("DIRENV_")) env[key] = value;
+  }
+  return { env, blocked: null };
+}
+function findUp(start, relative5, deps) {
+  let dir = path10.resolve(start);
+  for (; ; ) {
+    const candidate = path10.join(dir, relative5);
+    if (deps.readFile(candidate) !== null) return candidate;
+    const parent = path10.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+async function isTracked(file, deps) {
+  try {
+    const out = await deps.run("git", ["ls-files", "--error-unmatch", path10.basename(file)], { cwd: path10.dirname(file), env: deps.baseEnv });
+    return out.code === 0;
+  } catch {
+    return false;
+  }
+}
+function parseEnvFile(content, context, home) {
+  const env = {};
+  const lookup2 = (name) => env[name] ?? context[name] ?? "";
+  const expand = (value) => {
+    const tilde = value.startsWith("~/") ? path10.join(home, value.slice(2)) : value;
+    return tilde.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g, (_, braced, bare) => lookup2(braced ?? bare));
+  };
+  for (const raw of content.split(/\r?\n/)) {
+    const line = raw.trim().replace(/^export\s+/, "");
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq).trim();
+    if (!KEY.test(key)) continue;
+    const rest = line.slice(eq + 1).trim();
+    if (rest.startsWith("'")) {
+      const end = rest.indexOf("'", 1);
+      env[key] = end > 0 ? rest.slice(1, end) : rest.slice(1);
+    } else if (rest.startsWith('"')) {
+      const end = rest.lastIndexOf('"');
+      env[key] = expand((end > 0 ? rest.slice(1, end) : rest.slice(1)).replace(/\\n/g, "\n").replace(/\\"/g, '"'));
+    } else {
+      env[key] = expand(rest.replace(/\s+#.*$/, ""));
+    }
+  }
+  return env;
+}
+
+// src/services/transcriptCapture.ts
 var HomeTranscriptReader = class {
   home;
+  claudeConfigDirs;
   constructor(opts = {}) {
     const { homeDir } = opts;
-    this.home = homeDir ? () => homeDir : () => process.env.HOME || os3.homedir();
+    this.home = homeDir ? () => homeDir : () => process.env.HOME || os4.homedir();
+    const workspaceEnv = opts.workspaceEnv ?? workspaceEnvOf;
+    this.claudeConfigDirs = async (cwd) => [...new Set([
+      (await workspaceEnv(cwd)).CLAUDE_CONFIG_DIR,
+      homeDir ? void 0 : process.env.CLAUDE_CONFIG_DIR,
+      path11.join(this.home(), ".claude")
+    ].filter((dir) => Boolean(dir)))];
   }
   async finalAssistantText(query, maxChars = 4e3) {
     try {
-      if (query.runner === "claude-code") return claudeFinal(this.home(), query, maxChars);
+      if (query.runner === "claude-code") return claudeFinal(await this.claudeConfigDirs(query.cwd), query, maxChars);
       if (query.runner === "opencode") return await opencodeFinal(this.home(), query, maxChars);
       if (query.runner === "codex") return codexFinal(this.home(), query, maxChars);
     } catch {
@@ -9596,20 +10063,20 @@ var HomeTranscriptReader = class {
   }
 };
 var CLAUDE_PROJECT_NAME_MAX = 200;
-function claudeProjectDirs(home, cwd) {
-  const projects = path9.join(home, ".claude", "projects");
+function claudeProjectDirs(configDir2, cwd) {
+  const projects = path11.join(configDir2, "projects");
   const munged = cwd.replace(/[^a-zA-Z0-9]/g, "-");
   if (munged.length <= CLAUDE_PROJECT_NAME_MAX) {
-    const dir = path9.join(projects, munged);
+    const dir = path11.join(projects, munged);
     return (0, import_fs.existsSync)(dir) ? [dir] : [];
   }
   if (!(0, import_fs.existsSync)(projects)) return [];
   const prefix = `${munged.slice(0, CLAUDE_PROJECT_NAME_MAX)}-`;
-  return (0, import_fs.readdirSync)(projects).filter((name) => name.startsWith(prefix)).map((name) => path9.join(projects, name));
+  return (0, import_fs.readdirSync)(projects).filter((name) => name.startsWith(prefix)).map((name) => path11.join(projects, name));
 }
-function claudeFinal(home, query, maxChars) {
+function claudeFinal(configDirs, query, maxChars) {
   const cutoff = query.startedAt ? Date.parse(query.startedAt) : 0;
-  const candidates = claudeProjectDirs(home, query.cwd).flatMap((dir) => (0, import_fs.readdirSync)(dir).filter((f) => f.endsWith(".jsonl")).map((f) => path9.join(dir, f))).filter((f) => cutoff ? (0, import_fs.statSync)(f).mtimeMs >= cutoff - 5e3 : true).sort((a, b) => (0, import_fs.statSync)(b).mtimeMs - (0, import_fs.statSync)(a).mtimeMs);
+  const candidates = configDirs.flatMap((dir) => claudeProjectDirs(dir, query.cwd)).flatMap((dir) => (0, import_fs.readdirSync)(dir).filter((f) => f.endsWith(".jsonl")).map((f) => path11.join(dir, f))).filter((f) => cutoff ? (0, import_fs.statSync)(f).mtimeMs >= cutoff - 5e3 : true).sort((a, b) => (0, import_fs.statSync)(b).mtimeMs - (0, import_fs.statSync)(a).mtimeMs);
   for (const file of candidates) {
     const raw = (0, import_fs.readFileSync)(file, "utf8");
     if (!raw.includes(query.marker)) continue;
@@ -9645,7 +10112,7 @@ async function opencodeFinal(home, query, maxChars) {
   } catch {
     return null;
   }
-  const dbPath = path9.join(home, ".local", "share", "opencode", "opencode.db");
+  const dbPath = path11.join(home, ".local", "share", "opencode", "opencode.db");
   if (!(0, import_fs.existsSync)(dbPath)) return null;
   let db;
   try {
@@ -9698,7 +10165,7 @@ async function opencodeFinal(home, query, maxChars) {
   }
 }
 function codexFinal(home, query, maxChars) {
-  const root = path9.join(home, ".codex", "sessions");
+  const root = path11.join(home, ".codex", "sessions");
   if (!(0, import_fs.existsSync)(root)) return null;
   const cutoff = query.startedAt ? Date.parse(query.startedAt) : 0;
   const files = [];
@@ -9712,7 +10179,7 @@ function codexFinal(home, query, maxChars) {
       continue;
     }
     for (const e of entries) {
-      const full = path9.join(dir, e);
+      const full = path11.join(dir, e);
       let st;
       try {
         st = (0, import_fs.statSync)(full);
@@ -10163,6 +10630,43 @@ ${taskB.description}`,
   }
 };
 
+// src/utils/shell.ts
+var ANSI_RE = /\x1b\[[0-9;]*[A-Za-z]|\x1b\][^\x07]*\x07|\x1b[()][AB012]|\r/g;
+function stripAnsi(text) {
+  return text.replace(ANSI_RE, "");
+}
+function posixShellQuote(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+function buildShellInvocation(command, args) {
+  const inner = [command, ...args].map(posixShellQuote).join(" ");
+  return { shellPath: "/bin/bash", shellArgs: ["-lc", inner] };
+}
+function wrapWithPty(command, args, opts = {}) {
+  const inner = [command, ...args].map(posixShellQuote).join(" ");
+  const watcher = opts.controlChannel ? 'exec 4<&0; ( while read -r C R <&3; do stty cols "$C" rows "$R" <&4; done ) & ' : "";
+  const setup = opts.size ? `stty cols ${opts.size.cols} rows ${opts.size.rows}; ` : "";
+  return { command: "script", args: ["-q", "-e", "-f", "-c", `${watcher}${setup}${inner}`, "/dev/null"] };
+}
+
+// src/services/blockingPrompts.ts
+var TAIL = 4096;
+var squash = (text) => stripAnsi(text).replace(/\s+/g, "").toLowerCase();
+function watchBlockingPrompts(session, prompts, onPrompt) {
+  if (prompts.length === 0) return;
+  const pending = prompts.map((prompt) => ({ prompt, phrase: squash(prompt.phrase) }));
+  let tail = "";
+  session.onOutput((text) => {
+    if (pending.length === 0) return;
+    tail = (tail + squash(text)).slice(-TAIL);
+    for (let i = pending.length - 1; i >= 0; i--) {
+      if (!tail.includes(pending[i].phrase)) continue;
+      onPrompt(pending[i].prompt);
+      pending.splice(i, 1);
+    }
+  });
+}
+
 // src/services/TaskOrchestrator.ts
 var SHARED_ROOT_TAIL = "tasks run in the workspace root without worktree isolation.";
 function sharedRootNotice(reason, repos) {
@@ -10226,6 +10730,25 @@ var TaskOrchestrator = class {
    */
   retryCounts = /* @__PURE__ */ new Map();
   spawnCounts = /* @__PURE__ */ new Map();
+  /**
+   * The terminal a verdict left open, by task. It stays so the user can read
+   * the agent's output or keep talking to it — but only while its worktree
+   * does: once that is removed the agent sits in a deleted directory, and a
+   * newer attempt in the same worktree would share it with a second agent.
+   * Without this, every task of every run left one agent process running
+   * until the daemon stopped.
+   */
+  lingering = /* @__PURE__ */ new Map();
+  /**
+   * A full-plan run a failure paused. Retrying the failed task is the explicit
+   * resume the pause waits for — without this a retry only reset the task to
+   * pending and nothing ran until the user also re-ran the whole plan.
+   */
+  haltedByFailure = false;
+  /** The workspace's own variables for a task's cwd (ADR-0016); swapped out in tests. */
+  workspaceEnv = (cwd) => resolveWorkspaceEnv(cwd);
+  /** What the workspace env has already warned about, so a run says it once, not per task. */
+  envWarnings = /* @__PURE__ */ new Set();
   /**
    * Tasks pulled out of auto-scheduling (user-cancelled or failed to spawn).
    * They stay 'pending' — "not executed" — but the scheduler skips them until
@@ -10269,6 +10792,32 @@ var TaskOrchestrator = class {
   setWorkspaceRoot(fn) {
     this.workspaceRootFn = fn;
   }
+  setWorkspaceEnvResolver(resolve7) {
+    this.workspaceEnv = resolve7;
+  }
+  /**
+   * The variables a task's agent gets from its workspace. What cannot be
+   * applied is said once — silently starting without them is how agents ran
+   * under the wrong account when an edited `.envrc` was left unallowed.
+   */
+  async envForTask(cwd) {
+    const resolved = await this.workspaceEnv(cwd);
+    const warn = (key, message) => {
+      if (this.envWarnings.has(key)) return;
+      this.envWarnings.add(key);
+      this.notifications.warn(message);
+    };
+    if (resolved.blockedEnvrc) {
+      warn(`blocked:${resolved.blockedEnvrc}`, `direnv has blocked ${resolved.blockedEnvrc}, so tasks start without its variables. Run \`direnv allow\` in ${path12.dirname(resolved.blockedEnvrc)} to use them.`);
+    }
+    if (resolved.trackedEnvFile) {
+      warn(`tracked:${resolved.trackedEnvFile}`, `Ignored ${resolved.trackedEnvFile}: git tracks it, and a committed file must not choose the environment agents run in. Untrack it to use it.`);
+    }
+    if (resolved.refused.length > 0) {
+      warn(`refused:${resolved.refused.join(",")}`, `Ignored ${resolved.refused.join(", ")} from the workspace environment: Ordewell never passes these to agents.`);
+    }
+    return resolved.env;
+  }
   setRegistry(registry) {
     this.registry = registry;
   }
@@ -10350,7 +10899,7 @@ var TaskOrchestrator = class {
     if (!this.isolationRun) return null;
     const record = this.isolationRun.tasks[taskId];
     if (!record) return { state: "none" };
-    return taskIsolationOf(record);
+    return taskIsolationOf(record, this.config.conflictRepairAttempts);
   }
   /**
    * The plan's isolation as a surface shows it, for one with no stream to have
@@ -10359,7 +10908,7 @@ var TaskOrchestrator = class {
   isolationView() {
     const run = this.isolationRun;
     if (!run) return null;
-    const tasks = Object.fromEntries(Object.values(run.tasks).map((r) => [r.taskId, taskIsolationOf(r)]));
+    const tasks = Object.fromEntries(Object.values(run.tasks).map((r) => [r.taskId, taskIsolationOf(r, this.config.conflictRepairAttempts)]));
     return { tasks, handoff: handoffOf(run) };
   }
   getAttemptSession(taskId) {
@@ -10395,24 +10944,62 @@ var TaskOrchestrator = class {
   async reviewRunDiff() {
     return this.isolation.reviewDiff(this.requireRun());
   }
-  /** "Merge all": the run's integration branches into whatever the user has checked out, in every repo or none. */
+  /**
+   * "Merge all": the run's integration branches into whatever the user has
+   * checked out, in every repo or none. Once everything merged, the run has
+   * nothing left to hand over, so it is cleared up and forgotten; a branch
+   * the user's HEAD somehow does not contain stays for the next run's sweep.
+   */
   async mergeRun() {
     const run = this.requireRun();
     const result = await this.isolation.mergeIntoCheckedOut(run);
     const branch = integrationBranchNameOf(run);
     const group = run.repos.some((r) => r.path !== SELF_REPO);
-    const { level, message } = describeMergeResult(result, branch, group);
+    const repaired = handoffOf(run).landed.filter((t) => t.repairedFiles?.length);
+    const { level, message } = describeMergeResult(result, branch, group, repaired);
     this.notifications[level](message);
+    if (result.outcome === "merged") await this.clearMergedRun(run);
     return result;
   }
+  async clearMergedRun(run) {
+    this.closeLingeringOf(run);
+    try {
+      await this.isolation.discard(run, { integration: "delete-merged" });
+    } catch (err) {
+      this.tell("warn", `Merged, but could not clean up the run's worktrees and branches: ${err instanceof Error ? err.message : String(err)}`);
+      return;
+    }
+    this.forgetRun();
+  }
   /** Worktrees and task branches go; the integration branch and the record stay for review and merge. */
   async cleanupRun() {
-    await this.isolation.discard(this.requireRun(), { keepIntegration: true });
+    this.closeLingeringOf(this.requireRun());
+    await this.isolation.discard(this.requireRun(), { integration: "keep" });
     this.emit("onIsolationChanged");
   }
   /** The run and everything it made go, and the plan forgets it; the next run starts afresh. */
   async discardRun() {
-    await this.isolation.discard(this.requireRun(), { keepIntegration: false });
+    this.closeLingeringOf(this.requireRun());
+    await this.isolation.discard(this.requireRun(), { integration: "delete" });
+    this.forgetRun();
+  }
+  watchBlockingPrompts(task, attempt, session) {
+    const manifest = this.registry?.get(attempt.runner)?.manifest;
+    watchBlockingPrompts(session, manifest?.runner.blockingPrompts ?? [], (prompt) => {
+      if (this.attempts.get(task.id) !== attempt) return;
+      this.notifications.warn(`Task "${task.title}" is waiting for you: ${manifest?.displayName ?? attempt.runner} is asking ${prompt.asks}. Answer it in the task's terminal.`);
+    });
+  }
+  closeLingering(taskId) {
+    const sessionId = this.lingering.get(taskId);
+    if (sessionId === void 0) return;
+    this.lingering.delete(taskId);
+    this.terminalRunner.stop(sessionId);
+  }
+  closeLingeringOf(run) {
+    for (const taskId of Object.keys(run.tasks)) this.closeLingering(taskId);
+  }
+  forgetRun() {
     this.isolationRun = null;
     this.resolvers = {};
     this.emit("onIsolationChanged");
@@ -10448,7 +11035,8 @@ var TaskOrchestrator = class {
   }
   loadPlan(tasks, planRunners = ["claude-code"]) {
     this.store.load(tasks, planRunners);
-    this.endAllAttempts("load");
+    const repairs = this.endAllAttempts("load").filter((a) => a.repair && a.worktree);
+    for (const a of repairs) void this.releaseWorktree(a.taskId, { keep: true }, a.integration);
     if (!this.running) this.runMode = null;
     this.blockedStart = null;
     this.planStatus = "approved";
@@ -10498,17 +11086,25 @@ var TaskOrchestrator = class {
     if (!await this.openRun(() => this.start()) || this.running) return;
     console.log(`[TaskOrchestrator] Starting with ${this.store.allTasks.length} tasks (${this.store.allTasks.filter((t) => t.type === "ai" && t.prompt).length} AI ready)`);
     this.running = true;
+    this.haltedByFailure = false;
     this.planStatus = "running";
     this.emit("onTaskChanged");
     await this.tick();
   }
+  haltOnFailure() {
+    if (this.running) this.haltedByFailure = true;
+    this.running = false;
+    this.planStatus = "approved";
+  }
   stop() {
+    this.haltedByFailure = false;
     this.running = false;
     this.planStatus = "approved";
     this.terminalRunner.stopAll();
-    const interrupted = [...this.attempts.values()].filter((a) => a.worktree);
-    this.endAllAttempts("stop");
-    for (const a of interrupted) void this.releaseWorktree(a.taskId, { keep: true }, a.integration);
+    for (const a of this.endAllAttempts("stop")) {
+      if (a.repair) this.store.markAwaitingUser(a.taskId);
+      if (a.worktree) void this.releaseWorktree(a.taskId, { keep: true }, a.integration);
+    }
     this.runMode = null;
     this.blockedStart = null;
     this.onHold.clear();
@@ -10524,6 +11120,7 @@ var TaskOrchestrator = class {
     console.error(`[TaskOrchestrator] Task #${task.order} "${task.title}" verdict=${verdict.outcome}`);
     console.error(`[TaskOrchestrator] Runner: ${task.assignedRunner}, Model: ${task.assignedModel?.modelId ?? "default"}`);
     console.error(`[TaskOrchestrator] Prompt preview: ${(task.prompt ?? "").slice(0, 200)}`);
+    if (attempt.repair) return this.settleRepair(task, attempt, verdict);
     const doneToken = `<<<ORDEWELL_DONE_${task.completionMarker}>>>`;
     const summary = await this.output.finalText({ ...attempt, completionMarker: task.completionMarker }, doneToken);
     if (this.attempts.get(taskId) !== attempt) return;
@@ -10537,13 +11134,15 @@ ${summary || "(empty \u2014 no output captured)"}`);
       await this.landPassed(task, landing);
     } else {
       this.store.markFailed(taskId);
-      this.running = false;
-      this.planStatus = "approved";
+      this.haltOnFailure();
       this.notifications.error(`Task "${task.title}" failed verification: ${verdict.reason}`);
       if (attempt.worktree) await this.releaseWorktree(taskId, { keep: true });
     }
     this.store.setTaskOutputSummary(taskId, summarizeOutput(verdict.reason, summary));
     this.logAndArchive(task, verdict);
+    await this.afterVerdict();
+  }
+  async afterVerdict() {
     this.emit("onTaskChanged");
     if (!this.running) {
       if (this.attempts.size === 0) {
@@ -10556,6 +11155,71 @@ ${summary || "(empty \u2014 no output captured)"}`);
     }
     await this.tick();
   }
+  /**
+   * A repair's verdict decides only whether its work may try to land. It never
+   * replaces the verdict the task's own work earned, and a repair that does not
+   * land leaves the task waiting on the user — never a failed task, so never a
+   * halted run.
+   */
+  async settleRepair(task, attempt, verdict) {
+    const landed = verdict.outcome === "pass" ? await this.landRepair(task, attempt) : null;
+    if (this.attempts.get(task.id) !== attempt) return;
+    this.endAttempt(task.id, "verdict");
+    if (!landed) await this.unrepaired(task, `did not finish (${verdict.reason})`);
+    else if (!landed.evidence.ok) await this.unrepaired(task, this.describeEvidence(landed.evidence));
+    else if (landed.outcome === "merged") await this.landedRepair(task, verdict);
+    else this.landUnmerged(task, landed.outcome);
+    await this.afterVerdict();
+  }
+  /**
+   * Evidence before the queue: the repair's work is committed and checked, and
+   * only then merged, through the same serialized landing as any other task —
+   * so a repair the tip has moved past again is a fresh conflict, not a pass.
+   */
+  async landRepair(task, attempt) {
+    const run = this.isolationRun;
+    let evidence = { ok: false, reason: "failed", repo: SELF_REPO };
+    if (!run) return { evidence, outcome: "failed" };
+    attempt.phase = "integrating";
+    attempt.integration = (async () => {
+      evidence = await this.isolation.verifyRepair(task, run).catch(() => ({ ok: false, reason: "failed", repo: run.tasks[task.id]?.conflictRepo ?? SELF_REPO }));
+      if (evidence.ok) return this.integrateWork(task);
+      await this.releaseWorktree(task.id, { keep: true });
+      return "conflict";
+    })();
+    const outcome = await attempt.integration;
+    return { evidence, outcome };
+  }
+  async landedRepair(task, verdict) {
+    const files = this.isolationRun?.tasks[task.id]?.repairedFiles ?? [];
+    this.store.markCompleted(task.id);
+    this.store.unblockDependents(task.id);
+    this.logAndArchive(task, task.verdict ?? verdict);
+    this.tell("info", `Task "${task.title}" landed after repairing a conflict${files.length > 0 ? ` in ${capConflictFiles(files)}` : ""}.`);
+    await this.landResolved(task.id);
+  }
+  /** A repair that did not land leaves the task as its conflict did: waiting on the user, worktree and refs kept. */
+  async unrepaired(task, why) {
+    await this.releaseWorktree(task.id, { keep: true });
+    this.store.markAwaitingUser(task.id);
+    const group = this.isolationRun?.repos.some((r) => r.path !== SELF_REPO);
+    this.tell("warn", `The conflict repair of task "${task.title}" ${why}, so it did not land. Its ${group ? "worktrees are" : "worktree is"} kept \u2014 resolve it by hand and mark it complete, retry it, or resolve it as a task.`);
+  }
+  describeEvidence(evidence) {
+    const run = this.isolationRun;
+    const inRepo = evidence.repo !== SELF_REPO ? ` in ${evidence.repo}` : "";
+    const branch = run ? integrationBranchNameOf(run) : "the integration branch";
+    switch (evidence.reason) {
+      case "not-merged":
+        return `finished, but its branch${inRepo} does not contain ${branch}`;
+      case "conflict-markers": {
+        const files = (evidence.files ?? []).map((file) => evidence.repo !== SELF_REPO ? `${evidence.repo}/${file}` : file);
+        return `finished, but left conflict markers in ${capConflictFiles(files)}`;
+      }
+      case "failed":
+        return `finished, but git could not check its work${inRepo}`;
+    }
+  }
   /**
    * Merge a passed attempt's worktree. The attempt stays live while it waits on
    * the module's merge queue, so a cancel, retry or stop in that window still
@@ -10589,18 +11253,44 @@ ${summary || "(empty \u2014 no output captured)"}`);
   }
   landUnmerged(task, landing) {
     const branch = this.isolationRun ? integrationBranchNameOf(this.isolationRun) : "the integration branch";
-    const repo = this.isolationRun?.tasks[task.id]?.conflictRepo;
-    const inRepo = repo && repo !== SELF_REPO ? repo : null;
+    const record = this.isolationRun?.tasks[task.id];
+    const inRepo = record?.conflictRepo && record.conflictRepo !== SELF_REPO ? record.conflictRepo : null;
     if (landing === "conflict") {
+      const repair = this.nextRepair(task.id);
       this.store.markAwaitingUser(task.id);
-      this.notifications.warn(inRepo ? `Task "${task.title}" passed, but landing it on ${branch} conflicted in ${inRepo}, so none of it landed. Its worktrees are kept \u2014 resolve it by hand, retry it, or resolve it as a task.` : `Task "${task.title}" passed, but merging it into ${branch} conflicted. Its worktree is kept \u2014 resolve it by hand, retry it, or resolve it as a task.`);
+      const files = record?.conflictFiles?.length ? ` (${capConflictFiles(record.conflictFiles)})` : "";
+      const conflicted = inRepo ? `Task "${task.title}" passed, but landing it on ${branch} conflicted in ${inRepo}${files}, so none of it landed.` : `Task "${task.title}" passed, but merging it into ${branch} conflicted${files}.`;
+      if (repair) {
+        this.notifications.warn(conflicted);
+        if (this.attempts.size < this.config.maxParallelSessions) void this.startTask(task);
+        else {
+          this.store.markPending(task.id);
+          this.tell("info", `Task "${task.title}" is repaired once a slot is free.`);
+        }
+        return;
+      }
+      this.notifications.warn(`${conflicted} ${inRepo ? "Its worktrees are" : "Its worktree is"} kept \u2014 resolve it by hand and mark it complete, retry it, or resolve it as a task.`);
+      const whyNot = this.noRepairReason(task);
+      if (whyNot) this.tell("info", whyNot);
     } else {
       this.store.markFailed(task.id);
-      this.running = false;
-      this.planStatus = "approved";
+      this.haltOnFailure();
       this.notifications.error(inRepo ? `Task "${task.title}" passed, but git could not integrate its work in ${inRepo}, so none of it landed. Its worktrees are kept for inspection.` : `Task "${task.title}" passed, but git could not integrate its work. Its worktree is kept for inspection.`);
     }
   }
+  /** The repair a conflicted task is owed next; null when repair is off, used up, or there is no isolated run to repair it in. */
+  nextRepair(taskId) {
+    const record = this.runMode === "isolated" ? this.isolationRun?.tasks[taskId] : void 0;
+    const limit = this.config.conflictRepairAttempts;
+    const spent = record?.repairs ?? 0;
+    return record?.status === "conflict" && spent < limit ? { n: spent + 1, limit } : null;
+  }
+  noRepairReason(task) {
+    const limit = this.config.conflictRepairAttempts;
+    if (limit === 0) return `Conflict repair is off (conflictRepairAttempts is 0), so task "${task.title}" waits for you.`;
+    const spent = this.isolationRun?.tasks[task.id]?.repairs ?? 0;
+    return spent >= limit ? `Task "${task.title}" has had ${spent} of its ${limit} conflict repairs, so its conflict waits for you.` : null;
+  }
   /**
    * Mark which added task resolves which conflict. The resolver merges the
    * conflicted task's branch by hand in its own worktree; once that lands, the
@@ -10635,6 +11325,7 @@ ${summary || "(empty \u2014 no output captured)"}`);
     await integration;
     const run = this.isolationRun;
     if (!run?.tasks[taskId]) return;
+    if (!opts.keep) this.closeLingering(taskId);
     try {
       await this.isolation.release(run, taskId, opts);
     } catch (err) {
@@ -10783,7 +11474,8 @@ ${summary || "(empty \u2014 no output captured)"}`);
     this.onHold.delete(taskId);
     this.emit("onTaskChanged");
     await this.releaseWorktree(taskId, { keep: false }, ended?.integration);
-    await this.tick();
+    if (this.haltedByFailure && !this.running) await this.start();
+    else await this.tick();
   }
   /**
    * Manually start a single AI task right now, bypassing dependency/readiness
@@ -10890,6 +11582,7 @@ ${summary || "(empty \u2014 no output captured)"}`);
       cwd: null,
       worktree: false,
       integration: null,
+      repair: this.nextRepair(task.id),
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     this.spawnCounts.set(task.id, attempt.attempt);
@@ -10900,13 +11593,16 @@ ${summary || "(empty \u2014 no output captured)"}`);
       const cwd = await this.resolveAttemptCwd(task, attempt);
       attempt.cwd = cwd;
       if (this.attempts.get(task.id) !== attempt) {
-        if (attempt.worktree && !this.attempts.has(task.id)) await this.releaseWorktree(task.id, { keep: false });
-        return this.abandonSpawn(task);
+        if (attempt.worktree && !this.attempts.has(task.id)) await this.releaseWorktree(task.id, { keep: attempt.repair !== null });
+        return this.abandonSpawn(task, attempt);
       }
-      const finalPrompt = composeAugmentedPrompt(task, this.store.planTasks, {
+      const finalPrompt = composeAugmentedPrompt(attempt.repair ? { ...task, prompt: this.repairPrompt(task) } : task, this.store.planTasks, {
         planMapEnabled: this.config.planMapEnabled,
-        tddEnabled: this.tddEnabled()
+        // A merge to resolve is not new behaviour to drive test-first.
+        tddEnabled: !attempt.repair && this.tddEnabled()
       });
+      this.closeLingering(task.id);
+      const env = await this.envForTask(cwd);
       const session = await this.terminalRunner.spawn({
         taskId: task.id,
         runner: attempt.runner,
@@ -10918,18 +11614,30 @@ ${summary || "(empty \u2014 no output captured)"}`);
         cwd,
         registry: this.registry ?? void 0,
         order: task.order,
-        title: task.title
+        title: task.title,
+        env
       });
-      if (this.attempts.get(task.id) !== attempt) return this.abandonSpawn(task, session);
+      if (this.attempts.get(task.id) !== attempt) return this.abandonSpawn(task, attempt, session);
       attempt.phase = "running";
       attempt.session = session;
       this.output.attach(task.id, session);
       this.verifier.watch(task, session);
+      this.watchBlockingPrompts(task, attempt, session);
       this.emit("onTaskChanged");
-      this.notifications.info(`Task "${task.title}" started (${attempt.runner})`);
+      if (attempt.repair) {
+        const group = this.isolationRun?.repos.some((r) => r.path !== SELF_REPO);
+        this.tell("info", `Repairing the conflict of task "${task.title}" in its own ${group ? "worktrees" : "worktree"} (repair ${attempt.repair.n} of ${attempt.repair.limit}).`);
+      } else {
+        this.notifications.info(`Task "${task.title}" started (${attempt.runner})`);
+      }
     } catch (err) {
-      if (this.attempts.get(task.id) !== attempt) return this.abandonSpawn(task);
+      if (this.attempts.get(task.id) !== attempt) return this.abandonSpawn(task, attempt);
       this.endAttempt(task.id, "spawn-failed");
+      if (attempt.repair) {
+        await this.unrepaired(task, `could not start: ${err instanceof Error ? err.message : String(err)}`);
+        this.emit("onTaskChanged");
+        return this.tick();
+      }
       await this.releaseWorktree(task.id, { keep: false });
       this.store.markPending(task.id);
       this.onHold.add(task.id);
@@ -10943,17 +11651,35 @@ ${summary || "(empty \u2014 no output captured)"}`);
    * and take back the claim it made. Only the claim — whatever ended the
    * attempt may have decided the task since (mark complete, cancel, retry).
    */
-  abandonSpawn(task, session) {
+  abandonSpawn(task, attempt, session) {
     session?.kill();
     if (this.attempts.has(task.id) || this.store.get(task.id)?.status !== "in_progress") return;
-    this.store.markPending(task.id);
+    if (attempt.repair) this.store.markAwaitingUser(task.id);
+    else this.store.markPending(task.id);
     this.emit("onTaskChanged");
   }
+  repairPrompt(task) {
+    const run = this.requireRun();
+    const record = run.tasks[task.id];
+    const conflict = {
+      branch: record?.branch ?? "",
+      repos: Object.keys(record?.repairBase ?? {}),
+      ...record?.conflictRepo ? { conflictRepo: record.conflictRepo } : {},
+      ...record?.conflictFiles ? { conflictFiles: record.conflictFiles } : {}
+    };
+    return buildConflictRepairPrompt(task, conflict, integrationBranchNameOf(run));
+  }
   /**
    * The one place an attempt's working directory is decided. Async so a
    * per-attempt workspace (worktree isolation, #12) can be prepared here.
    */
   async resolveAttemptCwd(task, attempt) {
+    if (attempt.repair && this.isolationRun) {
+      const { cwd: cwd2 } = await this.isolation.reopen(task, this.isolationRun);
+      attempt.worktree = true;
+      this.emit("onIsolationChanged");
+      return cwd2;
+    }
     if (this.runMode !== "isolated" || !this.isolationRun) {
       await this.releaseWorktree(task.id, { keep: false });
       return this.workspaceRootFn();
@@ -11041,8 +11767,18 @@ ${summary || "(empty \u2014 no output captured)"}`);
       }
     }
     this.runMode = "isolated";
+    await this.sweep();
     return true;
   }
+  /** What earlier runs left merged in the group goes; a failure here is worth a word, never a stopped run. */
+  async sweep() {
+    if (!this.isolationRun) return;
+    try {
+      await this.isolation.sweep(this.isolationRun);
+    } catch (err) {
+      this.tell("warn", `Could not clear merged branches of earlier runs: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
   /**
    * The plan's run carries on while anything has landed on its integration
    * branch: a resumed plan's dependents must start from a tip that holds their
@@ -11055,14 +11791,14 @@ ${summary || "(empty \u2014 no output captured)"}`);
   /**
    * A run with nothing landed holds only superseded attempts, so it goes whole.
    * One that cannot be continued for another reason — it ran from a different
-   * workspace path — keeps its integration branch: only the user gives landed
-   * work up.
+   * workspace path — keeps its integration branch in each repo that has not
+   * merged it: only the user gives landed work up.
    */
   async mintRun(root) {
     const previous = this.isolationRun;
     if (previous) {
       const landed = Object.values(previous.tasks).some((r) => r.status === "merged");
-      await this.isolation.discard(previous, { keepIntegration: landed }).catch(() => void 0);
+      await this.isolation.discard(previous, { integration: landed ? "delete-merged" : "delete" }).catch(() => void 0);
       this.isolationRun = null;
     }
     this.isolationRun = await this.isolation.startRun(root);
@@ -11119,6 +11855,7 @@ ${summary || "(empty \u2014 no output captured)"}`);
     const attempt = this.attempts.get(taskId);
     this.attempts.delete(taskId);
     if (attempt) this.output.detach(taskId);
+    if (reason === "verdict" && attempt?.session) this.lingering.set(taskId, attempt.session.id);
     if (reason === "cancel" || reason === "release" || reason === "complete" || reason === "retry") {
       const task = this.store.get(taskId);
       if (task) this.verifier.clear(task);
@@ -11127,9 +11864,11 @@ ${summary || "(empty \u2014 no output captured)"}`);
     return attempt;
   }
   endAllAttempts(reason) {
-    for (const taskId of [...this.attempts.keys()]) this.endAttempt(taskId, reason);
+    const ended = [...this.attempts.values()];
+    for (const { taskId } of ended) this.endAttempt(taskId, reason);
     this.verifier.reset();
     if (reason === "load") this.output.reset();
+    return ended;
   }
 };
 
@@ -11259,29 +11998,29 @@ ${errors.map((e) => `- ${e}`).join("\n")}`
 };
 
 // src/services/ModelDiscovery.ts
-var path12 = __toESM(require("path"));
-var import_child_process4 = require("child_process");
+var path15 = __toESM(require("path"));
+var import_child_process5 = require("child_process");
 var import_util3 = require("util");
 var fsSync3 = __toESM(require("fs"));
 var osMod = __toESM(require("os"));
 
 // src/utils/globalDataDir.ts
-var fs5 = __toESM(require("fs"));
-var path10 = __toESM(require("path"));
-var os4 = __toESM(require("os"));
+var fs6 = __toESM(require("fs"));
+var path13 = __toESM(require("path"));
+var os5 = __toESM(require("os"));
 function globalDataDir() {
-  return path10.join(os4.homedir(), ".ordewell");
+  return path13.join(os5.homedir(), ".ordewell");
 }
 function copyDirSync(src, dest) {
-  fs5.mkdirSync(dest, { recursive: true });
-  const entries = fs5.readdirSync(src, { withFileTypes: true });
+  fs6.mkdirSync(dest, { recursive: true });
+  const entries = fs6.readdirSync(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = path10.join(src, entry.name);
-    const destPath = path10.join(dest, entry.name);
+    const srcPath = path13.join(src, entry.name);
+    const destPath = path13.join(dest, entry.name);
     if (entry.isDirectory()) {
       copyDirSync(srcPath, destPath);
     } else {
-      fs5.copyFileSync(srcPath, destPath);
+      fs6.copyFileSync(srcPath, destPath);
     }
   }
 }
@@ -11289,50 +12028,29 @@ var migrated = false;
 function migrateOldConfigDir() {
   if (migrated) return;
   migrated = true;
-  const oldDir = path10.join(os4.homedir(), ".config", "ordewell");
-  if (!fs5.existsSync(oldDir)) return;
+  const oldDir = path13.join(os5.homedir(), ".config", "ordewell");
+  if (!fs6.existsSync(oldDir)) return;
   const newDir = globalDataDir();
   const liftFile = (name) => {
-    const oldFile = path10.join(oldDir, name);
-    const newFile = path10.join(newDir, name);
-    if (fs5.existsSync(oldFile) && !fs5.existsSync(newFile)) {
-      fs5.mkdirSync(newDir, { recursive: true });
-      fs5.copyFileSync(oldFile, newFile);
+    const oldFile = path13.join(oldDir, name);
+    const newFile = path13.join(newDir, name);
+    if (fs6.existsSync(oldFile) && !fs6.existsSync(newFile)) {
+      fs6.mkdirSync(newDir, { recursive: true });
+      fs6.copyFileSync(oldFile, newFile);
     }
   };
   liftFile("settings.json");
   liftFile(".env");
-  const oldPlugins = path10.join(oldDir, "plugins");
-  const newPlugins = path10.join(newDir, "plugins");
-  if (fs5.existsSync(oldPlugins) && !fs5.existsSync(newPlugins)) {
+  const oldPlugins = path13.join(oldDir, "plugins");
+  const newPlugins = path13.join(newDir, "plugins");
+  if (fs6.existsSync(oldPlugins) && !fs6.existsSync(newPlugins)) {
     copyDirSync(oldPlugins, newPlugins);
   }
 }
 
 // src/utils/launch.ts
 var fsSync2 = __toESM(require("fs"));
-var path11 = __toESM(require("path"));
-
-// src/utils/shell.ts
-var ANSI_RE = /\x1b\[[0-9;]*[A-Za-z]|\x1b\][^\x07]*\x07|\x1b[()][AB012]|\r/g;
-function stripAnsi(text) {
-  return text.replace(ANSI_RE, "");
-}
-function posixShellQuote(s) {
-  return `'${s.replace(/'/g, `'\\''`)}'`;
-}
-function buildShellInvocation(command, args) {
-  const inner = [command, ...args].map(posixShellQuote).join(" ");
-  return { shellPath: "/bin/bash", shellArgs: ["-lc", inner] };
-}
-function wrapWithPty(command, args, opts = {}) {
-  const inner = [command, ...args].map(posixShellQuote).join(" ");
-  const watcher = opts.controlChannel ? 'exec 4<&0; ( while read -r C R <&3; do stty cols "$C" rows "$R" <&4; done ) & ' : "";
-  const setup = opts.size ? `stty cols ${opts.size.cols} rows ${opts.size.rows}; ` : "";
-  return { command: "script", args: ["-q", "-e", "-f", "-c", `${watcher}${setup}${inner}`, "/dev/null"] };
-}
-
-// src/utils/launch.ts
+var path14 = __toESM(require("path"));
 var DIRECT_EXTENSIONS = [".exe", ".com"];
 var BATCH_EXTENSIONS = [".cmd", ".bat"];
 var POWERSHELL_EXTENSIONS = [".ps1"];
@@ -11340,7 +12058,7 @@ var CMD_EXE_MAX_COMMAND_LINE = 8191;
 var WINDOWS_MAX_COMMAND_LINE = 32767;
 function defaultPowerShell() {
   const root = process.env.SystemRoot || process.env.windir;
-  return root ? path11.win32.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") : "powershell.exe";
+  return root ? path14.win32.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe") : "powershell.exe";
 }
 var POWERSHELL_FLAGS = ["-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File"];
 var CommandLineTooLongError = class extends Error {
@@ -11392,7 +12110,7 @@ Searched: ${searchedPath || "(empty PATH)"}`);
 };
 function isResolvableOnPosixPath(command, PATH, exists) {
   if (command.includes("/")) return exists(command);
-  return PATH.split(path11.delimiter).map((d) => d.trim()).filter(Boolean).some((dir) => exists(path11.join(dir, command)));
+  return PATH.split(path14.delimiter).map((d) => d.trim()).filter(Boolean).some((dir) => exists(path14.join(dir, command)));
 }
 function isExecutableResolved(command, plan, PATH, deps = {}) {
   if ((deps.platform ?? process.platform) === "win32") return plan.file !== command;
@@ -11432,9 +12150,9 @@ function cmdArgs(line) {
   return ["/d", "/s", "/c", `"${line}"`];
 }
 function candidateExtensions(command, pathExt) {
-  const declared = pathExt.split(path11.win32.delimiter).map((e) => e.trim().toLowerCase()).filter(Boolean);
+  const declared = pathExt.split(path14.win32.delimiter).map((e) => e.trim().toLowerCase()).filter(Boolean);
   const known = /* @__PURE__ */ new Set([...DIRECT_EXTENSIONS, ...BATCH_EXTENSIONS, ...POWERSHELL_EXTENSIONS, ...declared]);
-  const ext = path11.win32.extname(command).toLowerCase();
+  const ext = path14.win32.extname(command).toLowerCase();
   if (ext && known.has(ext)) {
     const route = BATCH_EXTENSIONS.includes(ext) ? "cmd" : POWERSHELL_EXTENSIONS.includes(ext) ? "powershell" : "direct";
     return { direct: [], cmd: [], powershell: [], [route]: [""] };
@@ -11455,13 +12173,13 @@ async function findWindowsExecutables(command, deps) {
   const exists = deps.exists ?? defaultExists2;
   const pathExt = (deps.pathExt ?? (() => process.env.PATHEXT ?? ""))();
   const byRoute = candidateExtensions(command, pathExt);
-  const dirs = path11.win32.basename(command) !== command ? [path11.win32.dirname(path11.win32.resolve(command))] : (await (deps.resolvePath ?? augmentedPath)() || "").split(path11.win32.delimiter).map((d) => d.trim().replace(/^"|"$/g, "")).filter(Boolean);
-  const base = path11.win32.basename(command);
+  const dirs = path14.win32.basename(command) !== command ? [path14.win32.dirname(path14.win32.resolve(command))] : (await (deps.resolvePath ?? augmentedPath)() || "").split(path14.win32.delimiter).map((d) => d.trim().replace(/^"|"$/g, "")).filter(Boolean);
+  const base = path14.win32.basename(command);
   const found = [];
   for (const route of ROUTES) {
     outer: for (const ext of byRoute[route]) {
       for (const dir of dirs) {
-        const candidate = path11.win32.join(dir, `${base}${ext}`);
+        const candidate = path14.win32.join(dir, `${base}${ext}`);
         if (exists(candidate)) {
           found.push({ file: candidate, route });
           break outer;
@@ -11507,10 +12225,10 @@ async function planShellLaunch(command, args, deps = {}) {
 }
 
 // src/utils/processTree.ts
-var import_child_process3 = require("child_process");
+var import_child_process4 = require("child_process");
 var HARD_KILL_DELAY_MS = 5e3;
 function defaultExecFile2(file, args, cb) {
-  (0, import_child_process3.execFile)(file, args, (err) => cb(err ?? null));
+  (0, import_child_process4.execFile)(file, args, (err) => cb(err ?? null));
 }
 function killTree(proc, deps = {}) {
   if (!proc || proc.killed || typeof proc.exitCode === "number") return;
@@ -11546,7 +12264,7 @@ function killTree(proc, deps = {}) {
 }
 
 // src/services/ModelDiscovery.ts
-var execAsync3 = (0, import_util3.promisify)(import_child_process4.exec);
+var execAsync3 = (0, import_util3.promisify)(import_child_process5.exec);
 var defaultExec2 = async (command, options) => {
   const PATH = await augmentedPath();
   const { stdout } = await execAsync3(command, { ...options, maxBuffer: 32 * 1024 * 1024, env: withPath(process.env, PATH) });
@@ -11556,16 +12274,16 @@ var defaultAppServerClient = async (command, args, options) => {
   const PATH = await augmentedPath();
   const launch = await planDirectLaunch(command, args).catch(() => null);
   if (!launch) return null;
-  return new Promise((resolve5) => {
+  return new Promise((resolve7) => {
     let child;
     try {
-      child = (0, import_child_process4.spawn)(launch.file, launch.args, {
+      child = (0, import_child_process5.spawn)(launch.file, launch.args, {
         env: withPath(process.env, PATH),
         stdio: ["pipe", "pipe", "ignore"],
         windowsVerbatimArguments: launch.verbatim
       });
     } catch {
-      resolve5(null);
+      resolve7(null);
       return;
     }
     let settled = false;
@@ -11574,7 +12292,7 @@ var defaultAppServerClient = async (command, args, options) => {
       settled = true;
       clearTimeout(timer);
       killTree(child);
-      resolve5(value);
+      resolve7(value);
     };
     const timer = setTimeout(() => finish(null), options?.timeout ?? 2e4);
     child.on("error", () => finish(null));
@@ -11641,7 +12359,7 @@ function geminiDiscoveryCacheKey(apiKey) {
   return {
     key: `gemini-models:${hash}`,
     dir,
-    file: path12.join(dir, `gemini_models_${hash}.json`)
+    file: path15.join(dir, `gemini_models_${hash}.json`)
   };
 }
 function readGeminiCache(apiKey) {
@@ -12164,8 +12882,8 @@ var ModelDiscovery = class {
 };
 
 // src/services/ModelCatalog.ts
-var fs6 = __toESM(require("fs"));
-var path13 = __toESM(require("path"));
+var fs7 = __toESM(require("fs"));
+var path16 = __toESM(require("path"));
 var CACHE_KEY = "model-catalog";
 var CACHE_TTL_MS = 60 * 60 * 1e3;
 function storageKey(baseUrl) {
@@ -12217,17 +12935,17 @@ var ModelCatalog = class {
       const url = (baseUrl || "https://openrouter.ai/api/v1").replace(/\/+$/, "");
       const key = storageKey(url);
       const cacheDir = globalCacheDir();
-      const cacheFile = path13.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
-      if (fs6.existsSync(cacheFile)) fs6.rmSync(cacheFile);
+      const cacheFile = path16.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
+      if (fs7.existsSync(cacheFile)) fs7.rmSync(cacheFile);
     } catch {
     }
   }
   static readCache(key) {
     try {
       const cacheDir = globalCacheDir();
-      const cacheFile = path13.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
-      if (!fs6.existsSync(cacheFile)) return null;
-      const raw = fs6.readFileSync(cacheFile, "utf8");
+      const cacheFile = path16.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
+      if (!fs7.existsSync(cacheFile)) return null;
+      const raw = fs7.readFileSync(cacheFile, "utf8");
       const data = JSON.parse(raw);
       if (Date.now() - data.cachedAt > CACHE_TTL_MS) return null;
       return JSON.stringify(data.models);
@@ -12238,9 +12956,9 @@ var ModelCatalog = class {
   static writeCache(key, models) {
     try {
       const cacheDir = globalCacheDir();
-      fs6.mkdirSync(cacheDir, { recursive: true });
-      const cacheFile = path13.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
-      fs6.writeFileSync(
+      fs7.mkdirSync(cacheDir, { recursive: true });
+      const cacheFile = path16.join(cacheDir, `${key.replace(/[:/]/g, "_")}.json`);
+      fs7.writeFileSync(
         cacheFile,
         JSON.stringify({ models, cachedAt: Date.now() }, null, 2)
       );
@@ -12507,9 +13225,9 @@ var ModelResolver = class {
 };
 
 // src/services/RunnerInstallation.ts
-var import_child_process5 = require("child_process");
+var import_child_process6 = require("child_process");
 var import_util4 = require("util");
-var execAsync4 = (0, import_util4.promisify)(import_child_process5.exec);
+var execAsync4 = (0, import_util4.promisify)(import_child_process6.exec);
 var defaultExec3 = async (command, options) => {
   const PATH = await augmentedPath();
   const { stdout } = await execAsync4(command, { ...options, env: withPath(process.env, PATH) });
@@ -12616,71 +13334,12 @@ var RunnerInstallation = class {
   }
 };
 
-// src/services/settingsEnvAllowlist.ts
-var ORDEWELL_SETTABLE_ENV = [
-  "AI_PROVIDER",
-  "ORCHESTRATOR_MODEL",
-  "ORDEWELL_SUBAGENT_MODEL",
-  "ORDEWELL_PLANNER_EFFORT",
-  "ORDEWELL_RESEARCH_ENABLED",
-  "ORDEWELL_MAX_PARALLEL"
-];
-var SETTINGS_ENV_REFUSED = [
-  // Approval posture and pre-approved scope.
-  "ORDEWELL_AUTONOMOUS_MODE",
-  "ORDEWELL_APPROVAL_MODE",
-  "ORDEWELL_APPROVAL_ALLOW",
-  // Where settings are persisted.
-  "ORDEWELL_SETTINGS_PATH",
-  // Runtime options and dynamic loaders.
-  "NODE_OPTIONS",
-  "NODE_REPL_EXTERNAL_MODULE",
-  "NODE_PATH",
-  "ELECTRON_RUN_AS_NODE",
-  "LD_PRELOAD",
-  "LD_LIBRARY_PATH",
-  "LD_AUDIT",
-  "DYLD_INSERT_LIBRARIES",
-  "DYLD_LIBRARY_PATH",
-  "DYLD_FRAMEWORK_PATH",
-  // Executable resolution.
-  "PATH",
-  "PATHEXT",
-  "NODE"
-];
-var REFUSED = new Set(SETTINGS_ENV_REFUSED);
-function providerEnvKeys() {
-  const keys = [];
-  for (const meta of Object.values(ALL_PROVIDERS)) {
-    if (meta.apiKeyEnvVar) keys.push(meta.apiKeyEnvVar);
-    if (meta.baseUrlEnvVar) keys.push(meta.baseUrlEnvVar);
-    for (const detect of meta.detectEnvVars) keys.push(detect);
-  }
-  return keys;
-}
-var PROVIDER_CREDENTIAL_ENV = new Set(providerEnvKeys());
-var SETTINGS_ENV_ALLOWLIST = new Set(
-  [...providerEnvKeys(), ...ORDEWELL_SETTABLE_ENV].filter((key) => !REFUSED.has(key))
-);
-function admitSettingsEnv(env) {
-  const accepted = {};
-  const rejected = [];
-  for (const [key, value] of Object.entries(env)) {
-    if (REFUSED.has(key) || !SETTINGS_ENV_ALLOWLIST.has(key) || typeof value !== "string") {
-      rejected.push(key);
-      continue;
-    }
-    accepted[key] = value;
-  }
-  return { accepted, rejected };
-}
-
 // src/services/harness/CliAgentAiService.ts
-var import_child_process6 = require("child_process");
+var import_child_process7 = require("child_process");
 
 // src/utils/workspace.ts
-var fs7 = __toESM(require("fs"));
-var path14 = __toESM(require("path"));
+var fs8 = __toESM(require("fs"));
+var path17 = __toESM(require("path"));
 var WorkspaceNotFoundError = class extends Error {
   constructor(workspace) {
     super(`Workspace "${workspace}" does not exist.`);
@@ -12691,7 +13350,7 @@ var WorkspaceNotFoundError = class extends Error {
 };
 function defaultIsDirectory(candidate) {
   try {
-    return fs7.statSync(candidate).isDirectory();
+    return fs8.statSync(candidate).isDirectory();
   } catch {
     return false;
   }
@@ -12727,8 +13386,8 @@ var PROJECT_MARKER_FILES = [
   "CMakeLists.txt"
 ];
 function assertWorkspaceIsProject(workspace, deps = {}) {
-  const realpath = deps.realpath ?? ((candidate) => fs7.realpathSync(candidate));
-  const exists = deps.exists ?? ((candidate) => fs7.existsSync(candidate));
+  const realpath = deps.realpath ?? ((candidate) => fs8.realpathSync(candidate));
+  const exists = deps.exists ?? ((candidate) => fs8.existsSync(candidate));
   let resolved;
   try {
     resolved = realpath(workspace);
@@ -12736,7 +13395,7 @@ function assertWorkspaceIsProject(workspace, deps = {}) {
     throw new WorkspaceNotAProjectError(workspace);
   }
   const hasMarker = [...PROJECT_MARKER_DIRS, ...PROJECT_MARKER_FILES].some(
-    (marker2) => exists(path14.join(resolved, marker2))
+    (marker2) => exists(path17.join(resolved, marker2))
   );
   if (!hasMarker) throw new WorkspaceNotAProjectError(workspace);
 }
@@ -12804,13 +13463,14 @@ var StdioAgentAdapter = class {
   }
   async start(opts) {
     assertWorkspaceExists(opts.cwd, { isDirectory: this.deps.isDirectory });
-    this.processEnded = new Promise((resolve5) => {
-      this.markEnded = resolve5;
+    this.processEnded = new Promise((resolve7) => {
+      this.markEnded = resolve7;
     });
     const spec = this.spawnSpec(opts);
     const resolvePath = this.deps.resolvePath ?? augmentedPath;
     const PATH = await resolvePath();
-    this.spawnEnv = withPath(process.env, PATH, spec.env);
+    const workspace = await (this.deps.workspaceEnv ?? workspaceEnvOf)(opts.cwd);
+    this.spawnEnv = withPath(process.env, PATH, { ...workspace, ...spec.env });
     const launch = await planDirectLaunch(spec.command, spec.args, {
       platform: this.deps.platform,
       resolvePath
@@ -12856,7 +13516,7 @@ ${err.message}`).slice(-STDERR_TAIL_CHARS);
       onEvent({ type: "error", message: this.exitMessage() });
       return;
     }
-    await new Promise((resolve5) => {
+    await new Promise((resolve7) => {
       let settled = false;
       const finish = () => {
         if (settled) return;
@@ -12867,7 +13527,7 @@ ${err.message}`).slice(-STDERR_TAIL_CHARS);
         signal?.removeEventListener("abort", onAbort);
         this.process?.removeListener("exit", onExit);
         this.process?.removeListener("error", onExit);
-        resolve5();
+        resolve7();
       };
       const emit = (event) => {
         onEvent(event);
@@ -13082,14 +13742,14 @@ function codexSandboxUnavailableMessage() {
   ].join("\n");
 }
 function runProbe(deps, cwd, env, flags) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve7) => {
     let output = "";
     let settled = false;
     const finish = (code) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve5({ code, output });
+      resolve7({ code, output });
     };
     const timer = setTimeout(() => finish(null), PROBE_TIMEOUT_MS);
     timer.unref?.();
@@ -13172,8 +13832,8 @@ var CodexAdapter = class extends StdioAgentAdapter {
   async handshake(opts) {
     this.sandbox = await probeCodexSandbox(this.deps, opts.cwd, this.spawnEnv);
     if (this.sandbox === "unavailable") throw new Error(codexSandboxUnavailableMessage());
-    const ready = new Promise((resolve5) => {
-      this.settleHandshake = resolve5;
+    const ready = new Promise((resolve7) => {
+      this.settleHandshake = resolve7;
     });
     this.writeLine({
       jsonrpc: "2.0",
@@ -13186,8 +13846,8 @@ var CodexAdapter = class extends StdioAgentAdapter {
       // A binary that rejects `app-server` outright dies immediately; waiting
       // out the timeout would turn a one-line diagnostic into a 30s stall.
       this.processEnded.then(() => false),
-      new Promise((resolve5) => {
-        const t = setTimeout(() => resolve5(false), HANDSHAKE_TIMEOUT_MS);
+      new Promise((resolve7) => {
+        const t = setTimeout(() => resolve7(false), HANDSHAKE_TIMEOUT_MS);
         t.unref?.();
       })
     ]);
@@ -13464,12 +14124,12 @@ function describeError(err) {
   return lines.join(": ");
 }
 function delay(ms, signal) {
-  return new Promise((resolve5) => {
-    const timer = setTimeout(resolve5, ms);
+  return new Promise((resolve7) => {
+    const timer = setTimeout(resolve7, ms);
     timer.unref?.();
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
-      resolve5();
+      resolve7();
     }, { once: true });
   });
 }
@@ -13503,17 +14163,17 @@ var OpenCodeAdapter = class {
       throw new ExecutableNotFoundError("opencode", PATH);
     }
     this.process = this.deps.spawn(launch.file, launch.args, {
-      env: withPath(process.env, PATH),
+      env: withPath(process.env, PATH, await (this.deps.workspaceEnv ?? workspaceEnvOf)(opts.cwd)),
       stdio: ["pipe", "pipe", "pipe"],
       cwd: opts.cwd,
       windowsVerbatimArguments: launch.verbatim
     });
-    const banner = new Promise((resolve5) => {
+    const banner = new Promise((resolve7) => {
       let seen = "";
       const scan = (chunk) => {
         seen += chunk.toString();
         const match = seen.match(/https?:\/\/[^\s]+/);
-        if (match) resolve5(match[0].replace(/[.,)]$/, ""));
+        if (match) resolve7(match[0].replace(/[.,)]$/, ""));
       };
       this.process.stdout?.on("data", scan);
       this.process.stderr?.on("data", (chunk) => {
@@ -13522,15 +14182,15 @@ var OpenCodeAdapter = class {
       });
       this.process.on("exit", () => {
         this.exited = true;
-        resolve5(null);
+        resolve7(null);
       });
       this.process.on("error", (err) => {
         this.exited = true;
         this.stderrTail = (this.stderrTail + `
 ${err.message}`).slice(-STDERR_TAIL_CHARS2);
-        resolve5(null);
+        resolve7(null);
       });
-      const timer = setTimeout(() => resolve5(null), SERVER_READY_TIMEOUT_MS);
+      const timer = setTimeout(() => resolve7(null), SERVER_READY_TIMEOUT_MS);
       timer.unref?.();
     });
     this.baseUrl = await banner;
@@ -13563,8 +14223,8 @@ ${this.stderrTail.trim()}` : ""}`);
     const streamAbort = new AbortController();
     let connected = () => {
     };
-    const streamReady = new Promise((resolve5) => {
-      connected = resolve5;
+    const streamReady = new Promise((resolve7) => {
+      connected = resolve7;
     });
     const live = this.streamEvents(
       streamAbort.signal,
@@ -13768,14 +14428,14 @@ ${part.text}` : part.text });
       }
     }
   }
-  async json(method, path23, body, signal) {
-    const response = await this.deps.fetch(`${this.baseUrl}${path23}`, {
+  async json(method, path26, body, signal) {
+    const response = await this.deps.fetch(`${this.baseUrl}${path26}`, {
       method,
       headers: { "content-type": "application/json" },
       ...body === void 0 ? {} : { body: JSON.stringify(body) },
       ...signal ? { signal } : {}
     });
-    if (!response.ok) throw new Error(`${method} ${path23} failed: ${response.status} ${response.statusText}`);
+    if (!response.ok) throw new Error(`${method} ${path26} failed: ${response.status} ${response.statusText}`);
     return await response.json().catch(() => null);
   }
   nativeSessionId() {
@@ -13868,7 +14528,7 @@ var CliAgentAiService = class {
     if (!runner) throw new Error(`${config.aiProvider} is not a coding-agent planner.`);
     this.runner = runner;
     this.processDeps = {
-      spawn: deps.spawn ?? import_child_process6.spawn,
+      spawn: deps.spawn ?? import_child_process7.spawn,
       fetch: deps.fetch ?? globalThis.fetch,
       resolvePath: deps.resolvePath,
       platform: deps.platform,
@@ -14229,8 +14889,8 @@ var CliAgentAiService = class {
       this.lastNativeSessionId = previousSessionId;
     }
   }
-  async researchAndPlan(userDescription, runners, modelsByRunner, fs14, onProgress, _fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, signal) {
-    const contextStr = await collectResearchContext(fs14, runners);
+  async researchAndPlan(userDescription, runners, modelsByRunner, fs15, onProgress, _fetcher, runnerModes, modes = DEFAULT_PLANNER_MODES, signal) {
+    const contextStr = await collectResearchContext(fs15, runners);
     const researchLog = [
       { id: `up-${Date.now()}`, type: "user_prompt", content: userDescription, timestamp: (/* @__PURE__ */ new Date()).toISOString() }
     ];
@@ -14444,33 +15104,9 @@ var PlannerConversation = class {
       if (m.role !== "user" || index === 0) return [];
       const line = m.content.split("\n")[0];
       const preview = line.length > REWIND_PREVIEW_WIDTH ? `${line.slice(0, REWIND_PREVIEW_WIDTH - 1)}\u2026` : line;
-      return [{ index, preview, timestamp: m.timestamp }];
+      return [{ index, preview, content: m.content, timestamp: m.timestamp }];
     });
   }
-  /**
-   * Cut the dialogue back to just before the user message at `index` (a
-   * position in the transcript), discarding it and everything after. The task
-   * list is the host's and rides along untouched — rewinding moves where the
-   * conversation resumes, not what the plan is. The planner's research trace
-   * goes back to the same point, by time: its entries carry no link to the
-   * message that caused them.
-   */
-  rewind(index) {
-    this.assertIdle("rewind the conversation");
-    const plan = this.requirePlan();
-    if (!this.rewindTargets().some((t) => t.index === index)) {
-      if (index > 0) throw new ConversationEditError(`No user message at position ${index} to rewind to.`);
-      throw new ConversationEditError(this.transcript[0]?.kind === "compaction" ? "The conversation was condensed there \u2014 a rewind cannot reach back past the summary." : "The first message is the goal \u2014 start a new session to change it.");
-    }
-    const cutoff = this.transcript[index].timestamp;
-    const rewound = this.host.mutate(() => {
-      plan.conversationHistory = this.transcript.slice(0, index);
-      plan.researchLog = (plan.researchLog ?? []).filter((e) => e.timestamp < cutoff);
-      return true;
-    }, () => this.host.broadcastPlan());
-    this.reset();
-    return rewound;
-  }
   /**
    * Replace the transcript with a summary of it, keeping the last two
    * exchanges as they were, and drop the live context so the next message
@@ -14546,6 +15182,28 @@ var PlannerConversation = class {
       researchLog: plan?.researchLog ?? []
     });
   }
+  /**
+   * A copy of the dialogue as it stood just before the user message at
+   * `index` (a position from {@link rewindTargets}) — what a rewind forks
+   * from — plus that message's full text, for a surface to offer back. This
+   * conversation is not touched. The research trace is cut at the same point
+   * by time: its entries carry no link to the message that caused them.
+   */
+  cloneBefore(index) {
+    this.assertIdle("rewind the conversation");
+    if (!this.rewindTargets().some((t) => t.index === index)) {
+      if (index > 0) throw new ConversationEditError(`No user message at position ${index} to rewind to.`);
+      throw new ConversationEditError(this.transcript[0]?.kind === "compaction" ? "The conversation was condensed there \u2014 a rewind cannot reach back past the summary." : "The first message is the goal \u2014 start a new session to change it.");
+    }
+    const { content: rewoundMessage, timestamp: cutoff } = this.transcript[index];
+    return {
+      dialogue: structuredClone({
+        conversationHistory: this.transcript.slice(0, index),
+        researchLog: (this.host.plan()?.researchLog ?? []).filter((e) => e.timestamp < cutoff)
+      }),
+      rewoundMessage
+    };
+  }
   /** A one-shot `modifyPlan` exchange. Call inside the host's mutation ritual. */
   recordModification(request, requestedAt, taskCount) {
     this.append("user", request, { timestamp: requestedAt });
@@ -15131,26 +15789,26 @@ function retargetTaskRunner(task, runner, catalog) {
 }
 
 // src/services/SkillsService.ts
-var fs8 = __toESM(require("fs"));
-var path16 = __toESM(require("path"));
+var fs9 = __toESM(require("fs"));
+var path19 = __toESM(require("path"));
 
 // src/services/builtinSkills.ts
-var path15 = __toESM(require("path"));
+var path18 = __toESM(require("path"));
 var import_url = require("url");
 var import_meta = {};
 function builtinSkillsDir() {
-  const dir = typeof __dirname !== "undefined" && __dirname ? __dirname : path15.dirname((0, import_url.fileURLToPath)(
+  const dir = typeof __dirname !== "undefined" && __dirname ? __dirname : path18.dirname((0, import_url.fileURLToPath)(
     // @ts-expect-error - import.meta is only valid under an ESM module setting
     import_meta.url
   ));
-  return path15.join(dir, "..", "skills");
+  return path18.join(dir, "..", "skills");
 }
 
 // src/services/SkillsService.ts
 var BUILTIN_SKILL_NAMES = ["grilling", "to-spec", "improve-codebase-architecture"];
 var RETIRED_BUILTIN_SKILL_NAMES = ["grill-me"];
 function parseSkillFile(filePath, name, source) {
-  const raw = fs8.readFileSync(filePath, "utf8");
+  const raw = fs9.readFileSync(filePath, "utf8");
   const frontmatter = {};
   let content = raw;
   if (raw.startsWith("---\n")) {
@@ -15179,23 +15837,23 @@ function parseSkillFile(filePath, name, source) {
   return { name, description: metadata.description, metadata, content, path: filePath, source };
 }
 function copyDirSync2(src, dest) {
-  fs8.mkdirSync(dest, { recursive: true });
-  const entries = fs8.readdirSync(src, { withFileTypes: true });
+  fs9.mkdirSync(dest, { recursive: true });
+  const entries = fs9.readdirSync(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = path16.join(src, entry.name);
-    const destPath = path16.join(dest, entry.name);
+    const srcPath = path19.join(src, entry.name);
+    const destPath = path19.join(dest, entry.name);
     if (entry.isDirectory()) copyDirSync2(srcPath, destPath);
-    else fs8.copyFileSync(srcPath, destPath);
+    else fs9.copyFileSync(srcPath, destPath);
   }
 }
 function readDir(dir, source) {
-  if (!fs8.existsSync(dir)) return [];
-  const entries = fs8.readdirSync(dir, { withFileTypes: true });
+  if (!fs9.existsSync(dir)) return [];
+  const entries = fs9.readdirSync(dir, { withFileTypes: true });
   const skills = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const skillFile = path16.join(dir, entry.name, "SKILL.md");
-    if (!fs8.existsSync(skillFile)) continue;
+    const skillFile = path19.join(dir, entry.name, "SKILL.md");
+    if (!fs9.existsSync(skillFile)) continue;
     const parsed = parseSkillFile(skillFile, entry.name, source);
     if (parsed) skills.push(parsed);
   }
@@ -15207,22 +15865,22 @@ var SkillsService = class {
   }
   workspaceRoot;
   localDir() {
-    return this.workspaceRoot ? path16.join(this.workspaceRoot, ".ordewell", "skills") : void 0;
+    return this.workspaceRoot ? path19.join(this.workspaceRoot, ".ordewell", "skills") : void 0;
   }
   globalDir() {
-    return path16.join(globalDataDir(), "skills");
+    return path19.join(globalDataDir(), "skills");
   }
   seed(name) {
-    const dest = path16.join(this.globalDir(), name);
-    if (fs8.existsSync(dest)) return false;
+    const dest = path19.join(this.globalDir(), name);
+    if (fs9.existsSync(dest)) return false;
     let srcDir;
     try {
-      srcDir = path16.join(builtinSkillsDir(), name);
+      srcDir = path19.join(builtinSkillsDir(), name);
     } catch (err) {
       console.warn(`Could not locate built-in skills dir: ${String(err)}`);
       return false;
     }
-    if (!fs8.existsSync(srcDir)) {
+    if (!fs9.existsSync(srcDir)) {
       console.warn(`Built-in skill not found in package: ${name}`);
       return false;
     }
@@ -15236,14 +15894,14 @@ var SkillsService = class {
   isUnmodifiedRetiredSeed(dir, expectedName) {
     let entries;
     try {
-      entries = fs8.readdirSync(dir, { withFileTypes: true });
+      entries = fs9.readdirSync(dir, { withFileTypes: true });
     } catch {
       return false;
     }
     if (entries.length !== 1 || entries[0].name !== "SKILL.md" || !entries[0].isFile()) return false;
     let raw;
     try {
-      raw = fs8.readFileSync(path16.join(dir, "SKILL.md"), "utf8");
+      raw = fs9.readFileSync(path19.join(dir, "SKILL.md"), "utf8");
     } catch {
       return false;
     }
@@ -15260,11 +15918,11 @@ var SkillsService = class {
   }
   pruneRetired() {
     for (const name of RETIRED_BUILTIN_SKILL_NAMES) {
-      const dest = path16.join(this.globalDir(), name);
-      if (!fs8.existsSync(dest)) continue;
+      const dest = path19.join(this.globalDir(), name);
+      if (!fs9.existsSync(dest)) continue;
       if (!this.isUnmodifiedRetiredSeed(dest, name)) continue;
       try {
-        fs8.rmSync(dest, { recursive: true, force: true });
+        fs9.rmSync(dest, { recursive: true, force: true });
       } catch (err) {
         console.warn(`Could not prune retired skill ${name}: ${String(err)}`);
       }
@@ -15275,11 +15933,11 @@ var SkillsService = class {
     if (BUILTIN_SKILL_NAMES.includes(name)) this.seed(name);
     const localDir = this.localDir();
     if (localDir) {
-      const localFile = path16.join(localDir, name, "SKILL.md");
-      if (fs8.existsSync(localFile)) return parseSkillFile(localFile, name, "local");
+      const localFile = path19.join(localDir, name, "SKILL.md");
+      if (fs9.existsSync(localFile)) return parseSkillFile(localFile, name, "local");
     }
-    const globalFile = path16.join(this.globalDir(), name, "SKILL.md");
-    if (fs8.existsSync(globalFile)) return parseSkillFile(globalFile, name, "global");
+    const globalFile = path19.join(this.globalDir(), name, "SKILL.md");
+    if (fs9.existsSync(globalFile)) return parseSkillFile(globalFile, name, "global");
     return void 0;
   }
   listSkills() {
@@ -15360,8 +16018,8 @@ function truncateCheckpointSummary(summary) {
 }
 
 // src/utils/sessionStore.ts
-var fs9 = __toESM(require("fs"));
-var path17 = __toESM(require("path"));
+var fs10 = __toESM(require("fs"));
+var path20 = __toESM(require("path"));
 
 // src/utils/sessionId.ts
 var import_crypto2 = require("crypto");
@@ -15372,7 +16030,7 @@ function mintSessionId() {
 // src/utils/sessionStore.ts
 var SESSIONS_SUBDIR = "sessions";
 function getSessionsDir(baseDir) {
-  return path17.join(getStateDir(baseDir), SESSIONS_SUBDIR);
+  return path20.join(getStateDir(baseDir), SESSIONS_SUBDIR);
 }
 var REJECTION_MESSAGE = "This session was created with an older version of Ordewell. Please re-plan.";
 function hasScalarRunner(parsed) {
@@ -15394,11 +16052,11 @@ function legacySessionFilename(session) {
   return `${filenameStem(session)}_${session.id.slice(0, 8)}.json`;
 }
 function dropLegacyFile(sessionsDir, meta) {
-  const legacy = path17.join(sessionsDir, legacySessionFilename(meta));
-  if (legacy === path17.join(sessionsDir, sessionFilename(meta)) || !fs9.existsSync(legacy)) return;
+  const legacy = path20.join(sessionsDir, legacySessionFilename(meta));
+  if (legacy === path20.join(sessionsDir, sessionFilename(meta)) || !fs10.existsSync(legacy)) return;
   try {
-    const held = JSON.parse(fs9.readFileSync(legacy, "utf-8")).meta?.id;
-    if (held === meta.id) fs9.unlinkSync(legacy);
+    const held = JSON.parse(fs10.readFileSync(legacy, "utf-8")).meta?.id;
+    if (held === meta.id) fs10.unlinkSync(legacy);
   } catch {
   }
 }
@@ -15421,18 +16079,18 @@ function saveSession(plan, goal, baseDir, id) {
     plan: JSON.parse(JSON.stringify(plan))
   };
   const filename = sessionFilename(meta);
-  const filePath = path17.join(sessionsDir, filename);
-  fs9.writeFileSync(filePath, JSON.stringify(session, null, 2));
+  const filePath = path20.join(sessionsDir, filename);
+  fs10.writeFileSync(filePath, JSON.stringify(session, null, 2));
   dropLegacyFile(sessionsDir, meta);
   return meta;
 }
 function listSessions(baseDir, logger = defaultLogger) {
   const sessionsDir = getSessionsDir(baseDir);
-  if (!fs9.existsSync(sessionsDir)) return [];
-  const files = fs9.readdirSync(sessionsDir).filter((f) => f.endsWith(".json"));
+  if (!fs10.existsSync(sessionsDir)) return [];
+  const files = fs10.readdirSync(sessionsDir).filter((f) => f.endsWith(".json"));
   return files.map((f) => {
     try {
-      const raw = fs9.readFileSync(path17.join(sessionsDir, f), "utf-8");
+      const raw = fs10.readFileSync(path20.join(sessionsDir, f), "utf-8");
       const parsed = JSON.parse(raw);
       if (hasScalarRunner(parsed)) {
         logger.warn("sessionStore", `session file ${f}: ${REJECTION_MESSAGE}`);
@@ -15447,10 +16105,10 @@ function listSessions(baseDir, logger = defaultLogger) {
   }).filter((m) => m !== null).sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
 }
 function findSessionFile(sessionsDir, sessionId, logger) {
-  const files = fs9.readdirSync(sessionsDir).filter((f) => f.endsWith(".json"));
+  const files = fs10.readdirSync(sessionsDir).filter((f) => f.endsWith(".json"));
   for (const f of files) {
     try {
-      const raw = fs9.readFileSync(path17.join(sessionsDir, f), "utf-8");
+      const raw = fs10.readFileSync(path20.join(sessionsDir, f), "utf-8");
       const session = JSON.parse(raw);
       if (session.meta.id === sessionId) return f;
     } catch (err) {
@@ -15461,11 +16119,11 @@ function findSessionFile(sessionsDir, sessionId, logger) {
 }
 function loadSession(sessionId, baseDir, logger = defaultLogger) {
   const sessionsDir = getSessionsDir(baseDir);
-  if (!fs9.existsSync(sessionsDir)) return null;
+  if (!fs10.existsSync(sessionsDir)) return null;
   try {
     const file = findSessionFile(sessionsDir, sessionId, logger);
     if (file) {
-      const raw = fs9.readFileSync(path17.join(sessionsDir, file), "utf-8");
+      const raw = fs10.readFileSync(path20.join(sessionsDir, file), "utf-8");
       const parsed = JSON.parse(raw);
       if (hasScalarRunner(parsed)) {
         logger.warn("sessionStore", `session file ${file}: ${REJECTION_MESSAGE}`);
@@ -15496,11 +16154,11 @@ function getLatestSession(baseDir, logger = defaultLogger) {
 }
 function deleteSession(sessionId, baseDir, logger = defaultLogger) {
   const sessionsDir = getSessionsDir(baseDir);
-  if (!fs9.existsSync(sessionsDir)) return false;
+  if (!fs10.existsSync(sessionsDir)) return false;
   try {
     const file = findSessionFile(sessionsDir, sessionId, logger);
     if (file) {
-      fs9.unlinkSync(path17.join(sessionsDir, file));
+      fs10.unlinkSync(path20.join(sessionsDir, file));
       return true;
     }
   } catch (err) {
@@ -16032,26 +16690,30 @@ var Session = class {
    */
   forkConversation() {
     if (!this.plan) throw new ConversationEditError("No planning conversation to fork");
-    const dialogue = this.conversation.clone();
-    const sessionId = mintSessionId();
-    const plan = forkPlanState(this.plan, this.store.planTasks, dialogue, (/* @__PURE__ */ new Date()).toISOString());
-    saveSession(plan, this.goal, this.workspace, sessionId);
-    return { sessionId, goal: this.goal, workspace: this.workspace };
+    return this.saveFork(this.conversation.clone());
   }
   /**
-   * Cut the conversation back to just before a user message (a transcript
-   * position from {@link rewindTargets}). Conversation only: the task list,
-   * and any run executing it, carry on as they are. The planner's live context
-   * is dropped, so the next message replays from the shortened transcript.
+   * Fork the conversation from just before a user message (a transcript
+   * position from {@link rewindTargets}): the fork holds everything said
+   * before it and the current task list, like {@link forkConversation}, and
+   * this session keeps its whole history. The message's full text comes back
+   * so a surface can offer it for resending.
    */
   rewindConversation(userMessageIndex) {
     if (!this.plan) throw new ConversationEditError("No planning conversation to rewind");
-    return this.conversation.rewind(userMessageIndex);
+    const { dialogue, rewoundMessage } = this.conversation.cloneBefore(userMessageIndex);
+    return { ...this.saveFork(dialogue), rewoundMessage };
+  }
+  saveFork(dialogue) {
+    const sessionId = mintSessionId();
+    const plan = forkPlanState(this.plan, this.store.planTasks, dialogue, (/* @__PURE__ */ new Date()).toISOString());
+    saveSession(plan, this.goal, this.workspace, sessionId);
+    return { sessionId, goal: this.goal, workspace: this.workspace };
   }
   /**
    * Condense the conversation on the user's say-so: a hidden planner turn
    * summarises it, and the summary replaces everything but the last two
-   * exchanges. Conversation only, like a rewind — the tasks, and any run
+   * exchanges. Conversation only — the tasks, and any run
    * executing them, are untouched. Atomic: a failed or stopped turn changes
    * nothing.
    */
@@ -16177,6 +16839,10 @@ var Session = class {
     }
     await this.orchestrator.runTask(taskId);
   }
+  /** Start whatever the scheduler can now fit — after the parallel limit was raised mid-run, say. */
+  async reschedule() {
+    await this.orchestrator.tick();
+  }
   async retryTask(taskId) {
     await this.orchestrator.retryTask(taskId);
     this.persist();
@@ -16324,8 +16990,9 @@ var Session = class {
    * The opt-in way through a merge conflict: add an AI task, on the conflicted
    * task's own runner and model, that merges its branch by hand in a worktree
    * of its own. When that task lands, the conflicted one lands through it (see
-   * {@link TaskOrchestrator.linkConflictResolver}). Never automatic — nothing
-   * but this call adds it.
+   * {@link TaskOrchestrator.linkConflictResolver}). The automatic answer to a
+   * conflict is a repair, a new attempt of the same task (ADR-0015); a task is
+   * only ever added to the plan by this call.
    */
   async resolveConflictAsTask(taskId) {
     if (!this.plan) return null;
@@ -16933,7 +17600,7 @@ function buildRunnerInvocation(opts) {
 }
 
 // src/services/HeadlessRunner.ts
-var import_child_process7 = require("child_process");
+var import_child_process8 = require("child_process");
 
 // src/services/AbstractRunner.ts
 var import_events = require("events");
@@ -16988,7 +17655,7 @@ var AbstractRunner = class {
 function defaultHasScriptCmd() {
   if (process.platform === "win32") return false;
   try {
-    (0, import_child_process7.execSync)("which script", { stdio: "ignore" });
+    (0, import_child_process8.execSync)("which script", { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -17078,7 +17745,7 @@ var HeadlessRunner = class extends AbstractRunner {
   defaultInteractive = false;
   constructor(deps = {}) {
     super();
-    this.spawnImpl = deps.spawnImpl ?? import_child_process7.spawn;
+    this.spawnImpl = deps.spawnImpl ?? import_child_process8.spawn;
     this.hasScriptCmd = deps.hasScriptCmd ?? defaultHasScriptCmd;
     this.resolvePath = deps.resolvePath ?? augmentedPath;
     this.launchDeps = { resolvePath: this.resolvePath, ...deps.launchDeps };
@@ -17118,7 +17785,7 @@ var HeadlessRunner = class extends AbstractRunner {
     return {
       launch: await planDirectLaunch(command, args, this.launchDeps),
       resolvedPath,
-      env: invocation.env,
+      env: { ...opts.env, ...invocation.env },
       pty,
       submitPromptKey: invocation.submitPromptKey
     };
@@ -17137,14 +17804,14 @@ var HeadlessRunner = class extends AbstractRunner {
 };
 
 // src/services/TmuxRunner.ts
-var import_child_process9 = require("child_process");
+var import_child_process10 = require("child_process");
 var import_util5 = require("util");
 var import_os = require("os");
 var import_path = require("path");
 var import_fs2 = require("fs");
 
 // src/utils/tmux.ts
-var import_child_process8 = require("child_process");
+var import_child_process9 = require("child_process");
 function tmuxSessionName(port) {
   return `ordewell-${port}`;
 }
@@ -17157,7 +17824,7 @@ function tmuxWindowName(taskId, planSessionId) {
   return `t-${scope}${slug(taskId).slice(0, 16)}`;
 }
 var defaultProbe = () => {
-  (0, import_child_process8.execSync)(process.platform === "win32" ? "where tmux" : "which tmux", { stdio: "ignore" });
+  (0, import_child_process9.execSync)(process.platform === "win32" ? "where tmux" : "which tmux", { stdio: "ignore" });
 };
 function hasTmux(probe = defaultProbe) {
   try {
@@ -17169,7 +17836,7 @@ function hasTmux(probe = defaultProbe) {
 }
 var defaultHasBin = (bin) => {
   try {
-    (0, import_child_process8.execSync)(`${process.platform === "win32" ? "where" : "which"} ${bin}`, { stdio: "ignore" });
+    (0, import_child_process9.execSync)(`${process.platform === "win32" ? "where" : "which"} ${bin}`, { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -17192,7 +17859,7 @@ function clipboardCopyCommand(hasBin = defaultHasBin, platform = process.platfor
 
 // src/services/TmuxRunner.ts
 var EXIT_RE = /<<<ORDEWELL_TMUX_EXIT:(\d+)>>>/;
-var execFileAsync2 = (0, import_util5.promisify)(import_child_process9.execFile);
+var execFileAsync2 = (0, import_util5.promisify)(import_child_process10.execFile);
 var defaultExecFile3 = async (command, args) => {
   const { stdout, stderr } = await execFileAsync2(command, args);
   return { stdout: String(stdout), stderr: String(stderr) };
@@ -17430,7 +18097,7 @@ var TmuxRunner = class extends AbstractRunner {
       (0, import_path.join)(this.logDir, `${id}.log`),
       this.socket
     );
-    invocation.env = { ...invocation.env, PATH: await this.resolvePath() };
+    invocation.env = { ...opts.env, ...invocation.env, PATH: await this.resolvePath() };
     await session.start(invocation.command, invocation.args, opts.cwd, invocation.env);
     if (invocation.submitPromptKey) session.write("\r");
     this.registerSession(id, session);
@@ -17510,18 +18177,18 @@ function tokensMatch(presented, expected) {
 }
 
 // src/plugins/RunnerRegistry.ts
-var fs11 = __toESM(require("fs"));
-var path20 = __toESM(require("path"));
-var os5 = __toESM(require("os"));
-var import_child_process10 = require("child_process");
+var fs12 = __toESM(require("fs"));
+var path23 = __toESM(require("path"));
+var os6 = __toESM(require("os"));
+var import_child_process11 = require("child_process");
 var import_crypto4 = require("crypto");
 
 // src/plugins/FsPluginStore.ts
-var fs10 = __toESM(require("fs"));
-var path19 = __toESM(require("path"));
+var fs11 = __toESM(require("fs"));
+var path22 = __toESM(require("path"));
 
 // src/plugins/pluginNames.ts
-var path18 = __toESM(require("path"));
+var path21 = __toESM(require("path"));
 var PLUGIN_NAME_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
 var MAX_PLUGIN_NAME_LENGTH = 64;
 function isPlainPluginName(name) {
@@ -17536,10 +18203,10 @@ function assertPlainPluginName(name) {
 }
 function resolvePluginInstallDir(pluginsDir, name) {
   assertPlainPluginName(name);
-  const root = path18.resolve(pluginsDir);
-  const dest = path18.resolve(root, name);
-  const relative4 = path18.relative(root, dest);
-  if (relative4 !== name || relative4 === "" || path18.isAbsolute(relative4)) {
+  const root = path21.resolve(pluginsDir);
+  const dest = path21.resolve(root, name);
+  const relative5 = path21.relative(root, dest);
+  if (relative5 !== name || relative5 === "" || path21.isAbsolute(relative5)) {
     throw new Error(`Plugin install path escapes the plugins directory: ${JSON.stringify(name)}`);
   }
   return dest;
@@ -17554,13 +18221,13 @@ function isValidManifest(obj) {
 
 // src/plugins/FsPluginStore.ts
 function userPluginsDir() {
-  return path19.join(globalDataDir(), "plugins");
+  return path22.join(globalDataDir(), "plugins");
 }
 function loadManifestFromDir(dir) {
-  const manifestPath = path19.join(dir, "manifest.json");
-  if (!fs10.existsSync(manifestPath)) return null;
+  const manifestPath = path22.join(dir, "manifest.json");
+  if (!fs11.existsSync(manifestPath)) return null;
   try {
-    const raw = fs10.readFileSync(manifestPath, "utf8");
+    const raw = fs11.readFileSync(manifestPath, "utf8");
     const parsed = JSON.parse(raw);
     if (!isValidManifest(parsed)) return null;
     return parsed;
@@ -17570,29 +18237,29 @@ function loadManifestFromDir(dir) {
 }
 function copyDirSync3(src, dest) {
   ensureDir(dest);
-  const entries = fs10.readdirSync(src, { withFileTypes: true });
+  const entries = fs11.readdirSync(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = path19.join(src, entry.name);
-    const destPath = path19.join(dest, entry.name);
+    const srcPath = path22.join(src, entry.name);
+    const destPath = path22.join(dest, entry.name);
     if (entry.isDirectory()) {
       copyDirSync3(srcPath, destPath);
     } else {
-      fs10.copyFileSync(srcPath, destPath);
+      fs11.copyFileSync(srcPath, destPath);
     }
   }
 }
 function rmDirSync(dir) {
-  if (!fs10.existsSync(dir)) return;
-  const entries = fs10.readdirSync(dir, { withFileTypes: true });
+  if (!fs11.existsSync(dir)) return;
+  const entries = fs11.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const p = path19.join(dir, entry.name);
+    const p = path22.join(dir, entry.name);
     if (entry.isDirectory()) {
       rmDirSync(p);
     } else {
-      fs10.unlinkSync(p);
+      fs11.unlinkSync(p);
     }
   }
-  fs10.rmdirSync(dir);
+  fs11.rmdirSync(dir);
 }
 var FsPluginStore = class {
   getUserPluginsDir() {
@@ -17600,10 +18267,10 @@ var FsPluginStore = class {
   }
   listUserPluginDirs() {
     const dir = userPluginsDir();
-    if (!fs10.existsSync(dir)) return [];
+    if (!fs11.existsSync(dir)) return [];
     let entries;
     try {
-      entries = fs10.readdirSync(dir, { withFileTypes: true });
+      entries = fs11.readdirSync(dir, { withFileTypes: true });
     } catch {
       return [];
     }
@@ -17611,7 +18278,7 @@ var FsPluginStore = class {
   }
   listDir(dir) {
     try {
-      return fs10.readdirSync(dir);
+      return fs11.readdirSync(dir);
     } catch {
       return [];
     }
@@ -17629,20 +18296,20 @@ var FsPluginStore = class {
     ensureDir(dir);
   }
   writeFile(filePath, content) {
-    fs10.writeFileSync(filePath, content);
+    fs11.writeFileSync(filePath, content);
   }
   readFile(filePath) {
     try {
-      return fs10.readFileSync(filePath, "utf8");
+      return fs11.readFileSync(filePath, "utf8");
     } catch {
       return null;
     }
   }
-  dirExists(path23) {
-    return fs10.existsSync(path23) && fs10.statSync(path23).isDirectory();
+  dirExists(path26) {
+    return fs11.existsSync(path26) && fs11.statSync(path26).isDirectory();
   }
-  exists(path23) {
-    return fs10.existsSync(path23);
+  exists(path26) {
+    return fs11.existsSync(path26);
   }
 };
 
@@ -17669,7 +18336,15 @@ var CLAUDE_CODE_MANIFEST = {
       "{{/if}}",
       "{{prompt}}"
     ],
-    promptInArgs: true
+    promptInArgs: true,
+    // Interactive sessions show these even with --dangerously-skip-permissions:
+    // a folder Claude Code has never been trusted in (a fresh clone, or a repo
+    // only ever planned in headlessly), and the first Bypass Permissions run.
+    blockingPrompts: [
+      { phrase: "Is this a project you created or one you trust", asks: "whether to trust the task's folder" },
+      { phrase: "Do you trust the files in this folder", asks: "whether to trust the task's folder" },
+      { phrase: "running in Bypass Permissions mode", asks: "you to accept Bypass Permissions mode" }
+    ]
   },
   features: {
     modelSelection: true,
@@ -18013,7 +18688,7 @@ function isReservedRunnerName(name) {
   return RESERVED_RUNNER_NAMES.has(name.toLowerCase());
 }
 function gitClone(url, destDir) {
-  (0, import_child_process10.execFileSync)("git", ["clone", "--depth", "1", "--", url, destDir], {
+  (0, import_child_process11.execFileSync)("git", ["clone", "--depth", "1", "--", url, destDir], {
     stdio: "pipe",
     timeout: 3e4,
     // A repository that demands credentials should fail, not hang on a prompt.
@@ -18074,7 +18749,7 @@ var RunnerRegistry = class {
     return entry?.source === "builtin";
   }
   installFromPath(sourcePath) {
-    const absPath = path20.resolve(sourcePath);
+    const absPath = path23.resolve(sourcePath);
     if (!this.store.dirExists(absPath)) {
       throw new Error(`Plugin source must be a directory: ${absPath}`);
     }
@@ -18086,7 +18761,7 @@ var RunnerRegistry = class {
   }
   installFromGit(url) {
     const validated = assertInstallablePluginUrl(url);
-    const tmpDir = path20.join(os5.tmpdir(), `ordewell-plugin-${(0, import_crypto4.randomBytes)(12).toString("hex")}`);
+    const tmpDir = path23.join(os6.tmpdir(), `ordewell-plugin-${(0, import_crypto4.randomBytes)(12).toString("hex")}`);
     this.store.ensureDir(tmpDir);
     try {
       try {
@@ -18099,7 +18774,7 @@ var RunnerRegistry = class {
       const hasManifest = contents.some((f) => f === "manifest.json");
       let sourceDir = tmpDir;
       if (!hasManifest) {
-        const onlyEntry = contents.length === 1 ? path20.join(tmpDir, contents[0]) : void 0;
+        const onlyEntry = contents.length === 1 ? path23.join(tmpDir, contents[0]) : void 0;
         if (!onlyEntry || !this.store.dirExists(onlyEntry)) {
           throw new Error(`No manifest.json found in repository: ${validated.toString()}`);
         }
@@ -18147,7 +18822,7 @@ var RunnerRegistry = class {
   }
   createSkeleton(name, outputDir) {
     assertPlainPluginName(name);
-    const dir = path20.resolve(outputDir, name);
+    const dir = path23.resolve(outputDir, name);
     this.store.ensureDir(dir);
     const manifest = {
       name,
@@ -18179,8 +18854,8 @@ var RunnerRegistry = class {
         ]
       }
     };
-    this.store.writeFile(path20.join(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
-    const runSh = path20.join(dir, "run.sh");
+    this.store.writeFile(path23.join(dir, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
+    const runSh = path23.join(dir, "run.sh");
     const scriptContent = `#!/usr/bin/env bash
 # Custom runner script for ${name}
 # Receives:
@@ -18206,30 +18881,30 @@ echo "Running ${name} with prompt: $prompt"
 };
 function fsChmodSync(fpath, mode) {
   try {
-    fs11.chmodSync(fpath, mode);
+    fs12.chmodSync(fpath, mode);
   } catch {
   }
 }
 
 // src/utils/stateStore.ts
-var fs12 = __toESM(require("fs"));
-var path21 = __toESM(require("path"));
+var fs13 = __toESM(require("fs"));
+var path24 = __toESM(require("path"));
 var STATE_FILE = "state.json";
 function getStatePath(baseDir) {
-  return path21.join(getStateDir(baseDir), STATE_FILE);
+  return path24.join(getStateDir(baseDir), STATE_FILE);
 }
 function saveState(plan, baseDir) {
   const statePath = getStatePath(baseDir ?? process.cwd());
-  ensureDir(path21.dirname(statePath));
+  ensureDir(path24.dirname(statePath));
   plan.lastUpdated = (/* @__PURE__ */ new Date()).toISOString();
-  fs12.writeFileSync(statePath, JSON.stringify(plan, null, 2));
+  fs13.writeFileSync(statePath, JSON.stringify(plan, null, 2));
 }
 function loadState(baseDir, logger = defaultLogger) {
   const dir = baseDir ?? process.cwd();
   const statePath = getStatePath(dir);
-  if (!fs12.existsSync(statePath)) return null;
+  if (!fs13.existsSync(statePath)) return null;
   try {
-    const raw = fs12.readFileSync(statePath, "utf-8");
+    const raw = fs13.readFileSync(statePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed.runners)) {
       logger.warn("stateStore", `rejecting state from ${statePath}: old format (scalar "runner" instead of "runners" array). Please re-plan.`);
@@ -18246,16 +18921,16 @@ function loadState(baseDir, logger = defaultLogger) {
 function clearState(baseDir) {
   const dir = baseDir ?? process.cwd();
   const statePath = getStatePath(dir);
-  if (fs12.existsSync(statePath)) fs12.unlinkSync(statePath);
+  if (fs13.existsSync(statePath)) fs13.unlinkSync(statePath);
 }
 function stateExists(baseDir) {
   const dir = baseDir ?? process.cwd();
-  return fs12.existsSync(getStatePath(dir));
+  return fs13.existsSync(getStatePath(dir));
 }
 
 // src/services/SettingsService.ts
-var fs13 = __toESM(require("fs"));
-var path22 = __toESM(require("path"));
+var fs14 = __toESM(require("fs"));
+var path25 = __toESM(require("path"));
 var DEFAULTS = {
   tdd: { enabled: true },
   verification: { enabled: false }
@@ -18263,7 +18938,7 @@ var DEFAULTS = {
 function getSettingsPath() {
   const override = process.env.ORDEWELL_SETTINGS_PATH;
   if (override && override.trim()) return override.trim();
-  return path22.join(globalDataDir(), "settings.json");
+  return path25.join(globalDataDir(), "settings.json");
 }
 function readPlannerModels(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
@@ -18296,7 +18971,7 @@ var SettingsService = class {
   }
   fileMtimeMs() {
     try {
-      return fs13.statSync(this.filePath).mtimeMs;
+      return fs14.statSync(this.filePath).mtimeMs;
     } catch {
       return null;
     }
@@ -18368,8 +19043,8 @@ var SettingsService = class {
   load() {
     migrateOldConfigDir();
     try {
-      if (fs13.existsSync(this.filePath)) {
-        const raw = JSON.parse(fs13.readFileSync(this.filePath, "utf-8"));
+      if (fs14.existsSync(this.filePath)) {
+        const raw = JSON.parse(fs14.readFileSync(this.filePath, "utf-8"));
         const settings = {
           tdd: { enabled: raw.tdd?.enabled ?? DEFAULTS.tdd.enabled },
           verification: { enabled: raw.verification?.enabled ?? DEFAULTS.verification.enabled }
@@ -18391,11 +19066,11 @@ var SettingsService = class {
     return { ...DEFAULTS, tdd: { ...DEFAULTS.tdd }, verification: { ...DEFAULTS.verification } };
   }
   persist() {
-    const dir = path22.dirname(this.filePath);
-    if (!fs13.existsSync(dir)) {
-      fs13.mkdirSync(dir, { recursive: true });
+    const dir = path25.dirname(this.filePath);
+    if (!fs14.existsSync(dir)) {
+      fs14.mkdirSync(dir, { recursive: true });
     }
-    fs13.writeFileSync(this.filePath, JSON.stringify(this.cache, null, 2));
+    fs14.writeFileSync(this.filePath, JSON.stringify(this.cache, null, 2));
     this.cachedMtimeMs = this.fileMtimeMs();
   }
 };
@@ -18462,6 +19137,7 @@ var PlannerModelMemory = class {
   ConversationEditError,
   DAEMON_SUBPROTOCOL,
   DAEMON_TOKEN_SUBPROTOCOL_PREFIX,
+  DEFAULT_MAX_PARALLEL,
   DENY_ALL,
   EmbeddedNewlineError,
   EnvConfig,
@@ -18535,6 +19211,7 @@ var PlannerModelMemory = class {
   augmentPromptWithPriorOutputs,
   augmentedPath,
   bearerHeaderValue,
+  buildConflictRepairPrompt,
   buildConflictResolutionPrompt,
   buildConversationSystemPrompt,
   buildFallbackGrepArgs,
@@ -18554,6 +19231,7 @@ var PlannerModelMemory = class {
   canMergeTasks,
   canSetDependencies,
   canSplitTask,
+  capConflictFiles,
   checkDepsResolve,
   checkImmutableLog,
   checkInProgress,
@@ -18642,6 +19320,7 @@ var PlannerModelMemory = class {
   modifyValidationFeedback,
   normalizeAgentArgs,
   normalizeGeminiModel,
+  parseMaxParallel,
   parsePartialPlan,
   parsePlanJson,
   parseTaskOpsJson,