@ordewell/core 0.5.5 → 0.5.6

package/dist/Task-Dyxp67s2.d.ts

@@ -0,0 +1,2086 @@
+import { ChildProcess } from 'child_process';
+import { EventEmitter } from 'events';
+
+/**
+ * Why isolated execution is unavailable for a workspace. The orchestrator needs
+ * the reason, not just a boolean: `dirty` is offered a stash or an explicit
+ * "run without isolation", while the others fall back to the shared
+ * workspace root with a one-line notice.
+ */
+type IsolationInactiveReason = 'disabled' | 'git-missing' | 'not-git' | 'no-commits' | 'dirty' | 'nested-repos';
+/**
+ * `repos` names, relative to the workspace, the repositories behind the answer:
+ * when active, the ones that will isolate, with `shared` the paths every task
+ * will share live; otherwise the nested ones `nested-repos` refuses, the dirty
+ * ones of a `dirty` group, or the commitless ones of a `no-commits` group. A
+ * group of one names none.
+ */
+type IsolationAvailability = {
+    active: true;
+    repos?: string[];
+    shared?: string[];
+} | {
+    active: false;
+    reason: IsolationInactiveReason;
+    repos?: string[];
+};
+/**
+ * Where a run's tasks work, as the planner is told it: the repos of the group
+ * and the paths shared live between tasks. A lone repository is `['.']` with
+ * nothing shared.
+ */
+interface RepoGroupLayout {
+    repos: string[];
+    shared: string[];
+}
+type IsolationOutcome = 'merged' | 'conflict' | 'failed';
+/**
+ * `active` — worktree exists, a runner may be writing to it.
+ * `kept` — released with its worktree and branch preserved for inspection.
+ * `conflict` — integration stopped on a merge conflict; worktree and refs kept.
+ * `repairing` — a conflict repair (ADR-0015) is working in the kept worktree;
+ *   one that ends without landing leaves the task `conflict` again.
+ * `failed` — integration hit a git error other than a conflict; refs kept.
+ * `merged` — landed on the integration branch; worktree and task branch removed.
+ */
+type IsolationTaskStatus = 'active' | 'kept' | 'conflict' | 'repairing' | 'failed' | 'merged';
+/** One repo's share of a task: its worktree inside the task workspace. */
+interface IsolationTaskRepo {
+    /** Absolute path of this repo's worktree: the task workspace joined with the repo's path. */
+    worktree: string;
+    /**
+     * Paths bootstrapped from the real repo (symlinks, junctions, copies).
+     * Recorded so the commit step can leave them out — a symlink is not matched
+     * by a `node_modules/` ignore rule and would otherwise be committed.
+     */
+    linked: string[];
+    /** Whether the task brought commits to this repo; unknown until it first integrates. */
+    changed?: boolean;
+}
+interface IsolationTaskRecord {
+    taskId: string;
+    order: number;
+    title: string;
+    /** One branch name, the same in every repo, so a task is one name to look up across the group. */
+    branch: string;
+    /**
+     * Absolute path of the task workspace, holding one worktree per repo at the
+     * repo's path. The Runner's cwd is inside it when the workspace is a repo
+     * subdirectory; for a group of one it is the worktree.
+     */
+    workspace: string;
+    /** For the task as a whole: landing is atomic across the repos it changed. */
+    status: IsolationTaskStatus;
+    /** Keyed by repo path. */
+    repos: Record<string, IsolationTaskRepo>;
+    /** The repo whose merge stopped the task from landing, while `status` is `conflict` or `failed`. */
+    conflictRepo?: string;
+    /**
+     * What a `failed` landing stopped on, in words a surface can repeat — a
+     * missing worktree is the common one. Cleared by the next landing attempt,
+     * so a stale reason cannot outlive the failure it explains.
+     */
+    landingError?: string;
+    /** Repo-relative paths, in `conflictRepo`, that conflicted; set only while `status` is `conflict` or `repairing`. */
+    conflictFiles?: string[];
+    /**
+     * Conflict repairs started for this task (ADR-0015). Counted when one starts,
+     * so a crash cannot hand the spent attempt back; absent reads as none.
+     */
+    repairs?: number;
+    /**
+     * Keyed by repo path: each changed repo's integration tip when the repair in
+     * flight started — what the task branch must contain before it may land.
+     * Set only while `status` is `repairing`.
+     */
+    repairBase?: Record<string, string>;
+    /**
+     * Every file a repair was started for, across all of them: as `conflictFiles`
+     * names it in a group of one, prefixed with its repo's path in a group.
+     */
+    repairedFiles?: string[];
+}
+/**
+ * A task's landing in flight: each changed repo's integration tip from before
+ * the task's merge. On the run rather than the task record because it must
+ * outlive that record — a retry drops and recreates it — until every repo is
+ * back at its tip or the task has landed.
+ */
+interface IsolationLanding {
+    taskId: string;
+    /** Keyed by repo path. */
+    tips: Record<string, string>;
+}
+/**
+ * One repository of the group (ADR-0014). Every git operation on it runs in
+ * `root`, never in the workspace root.
+ */
+interface IsolationRepo {
+    /** Relative to the workspace root; `.` when the workspace is itself the repository. */
+    path: string;
+    /**
+     * Absolute: the workspace root joined with `path`. For a group of one that is
+     * the workspace root, which may be a subdirectory of the repository.
+     */
+    root: string;
+    /** The commit checked out at run start. Switching branches mid-run does not retarget it. */
+    baseRef: string;
+    /** Branch name checked out at run start; absent on a detached HEAD. */
+    baseBranch?: string;
+    integrationBranch: string;
+}
+/**
+ * One Execute-Plan click or one manual task run over the workspace's repo
+ * group. Plain JSON on purpose: the orchestrator persists it with the plan
+ * state so a resumed session can find its integration branches again. The
+ * module mutates `tasks` in place.
+ */
+interface IsolationRun {
+    id: string;
+    workspaceRoot: string;
+    repos: IsolationRepo[];
+    /**
+     * Workspace paths outside every isolated repo, linked live into each task
+     * workspace: loose entries of the workspace root, the entries beside a deeper
+     * repo, and `sharedRepos`. Empty for a group of one.
+     */
+    shared: string[];
+    /** Repos of the group that could not be isolated — no commits, or git refused a worktree — and are among `shared`. */
+    sharedRepos: string[];
+    /** Keyed by task id — ids are unique within one plan and a run belongs to one plan. */
+    tasks: Record<string, IsolationTaskRecord>;
+    /**
+     * Set before a task's first merge and cleared once it has landed or been
+     * rolled back. One found set — after a crash, or a rollback git refused —
+     * names exactly what to return each repo's integration branch to.
+     */
+    landing?: IsolationLanding;
+}
+/**
+ * What a plan persists of isolated execution (`LegacyPlanState.isolation`): its
+ * run, and which added tasks resolve which conflicts. Belongs to that plan and
+ * its branches alone, so a copy of the plan (a fork) must not carry it.
+ */
+interface PlanIsolation {
+    run: IsolationRun;
+    /** Resolver task id → the conflicted task whose branch it merges. */
+    resolvers: Record<string, string>;
+}
+/**
+ * A task's isolation as a surface shows it. `kept` covers every record whose
+ * worktree stays for inspection — a failed verdict, an interrupted attempt, an
+ * integration git refused — because to the user they are one thing: work that
+ * did not land and can be looked at. `none` is a task with no worktree in a plan
+ * that has an isolation run.
+ */
+type TaskIsolationState = 'none' | 'active' | 'integrated' | 'conflict' | 'repairing' | 'kept';
+type TaskIsolation = {
+    state: 'none';
+} | {
+    state: Exclude<TaskIsolationState, 'none'>;
+    branch: string;
+    /** The task workspace; for a group of one, the task's worktree. */
+    worktree: string;
+    /** Paths of the repos the task changed. */
+    repos: string[];
+    conflictRepo?: string;
+    /** Repo-relative paths, in `conflictRepo`, that conflicted. */
+    conflictFiles?: string[];
+    /** The conflict repair running or last run, of the most a task may have; absent before its first. */
+    repair?: {
+        attempt: number;
+        limit: number;
+    };
+    /** What {@link IsolationTaskRecord.repairedFiles} says. */
+    repairedFiles?: string[];
+};
+interface IsolationLandedTask {
+    taskId: string;
+    order: number;
+    title: string;
+    /** Set when the task landed only after a conflict repair (ADR-0015): the files it was started for. */
+    repairedFiles?: string[];
+}
+interface IsolationHandoffRepo {
+    path: string;
+    integrationBranch: string;
+    baseRef: string;
+    /** Tasks whose work landed in this repo, in plan order. */
+    landed: IsolationLandedTask[];
+}
+interface IsolationHandoff {
+    repos: IsolationHandoffRepo[];
+    /** Tasks that landed on the integration branches, in plan order. */
+    landed: IsolationLandedTask[];
+}
+/** A plan's isolation as a surface shows it: a mark for each task the run touched, and its handoff. */
+interface IsolationView {
+    tasks: Record<string, TaskIsolation>;
+    handoff: IsolationHandoff;
+}
+/**
+ * Why "Merge all" would not touch a repo. `partial-landing`: a task's landing
+ * was interrupted and could not be rolled back there, so its integration
+ * branch holds part of a task.
+ */
+type IsolationMergeBlockReason = 'merge-in-progress' | 'conflict' | 'uncommitted-changes' | 'partial-landing' | 'git-error';
+interface IsolationMergeBlock {
+    repo: string;
+    reason: IsolationMergeBlockReason;
+    /** The files that would conflict, or the user's uncommitted ones the merge also changes; empty for the other reasons. */
+    files: string[];
+}
+/**
+ * How "Merge all" went.
+ * - `merged`: every repo with work on its integration branch took it.
+ * - `blocked`: the preflight found repos that could not, so nothing was
+ *   touched anywhere; `blocked` says which and why.
+ * - `conflict` / `failed`: a merge stopped in `repo` — on git older than 2.38,
+ *   which cannot preflight, or for a reason no preflight could foresee. That
+ *   merge was aborted, leaving `repo` as it was; `landed` names the repos
+ *   merged before it, which stay merged, and is absent when there are none.
+ *
+ * A group of one is blocked only by a partial landing; otherwise its one merge
+ * lands or is aborted whole, so it reports as it always has.
+ */
+type IsolationMergeResult = {
+    outcome: 'merged';
+} | {
+    outcome: 'blocked';
+    blocked: IsolationMergeBlock[];
+} | {
+    outcome: 'conflict' | 'failed';
+    repo: string;
+    files?: string[];
+    landed?: string[];
+};
+/**
+ * What `discard` does with each repo's integration branch: `keep` it for review
+ * or merge, `delete` it, or delete it only in the repos whose checked-out HEAD
+ * already contains it (`delete-merged`) — the one way that can never give up
+ * landed work the user has not merged.
+ */
+type IntegrationDisposal = 'keep' | 'delete' | 'delete-merged';
+/**
+ * Whether a conflict repair's work may land. `not-merged`: the task branch in
+ * `repo` does not contain the tip the repair started from. `conflict-markers`:
+ * it adds leftover conflict markers to `files`. `failed`: git could not tell.
+ */
+type RepairEvidence = {
+    ok: true;
+} | {
+    ok: false;
+    reason: 'not-merged' | 'conflict-markers' | 'failed';
+    repo: string;
+    files?: string[];
+};
+interface PreparedTask {
+    cwd: string;
+    branch: string;
+    /**
+     * Paths, relative to the task workspace, that are copies rather than links
+     * because a hard link was impossible (Windows, another volume). Edits to them
+     * stay in the task, so the user is told.
+     */
+    copied: string[];
+}
+/**
+ * What a crash-recovery prune found and left alone: task records that were
+ * `active` yet still held unlanded work, so the prune kept them as `kept`
+ * rather than deleting work no one else has.
+ */
+interface IsolationPruneResult {
+    kept: Array<{
+        taskId: string;
+        order: number;
+        title: string;
+    }>;
+}
+interface IWorktreeIsolation {
+    /**
+     * A repo group with at least one repo to isolate, a clean tracked tree in
+     * each, and the config enabled; otherwise the reason it is not.
+     */
+    isActive(workspaceRoot: string): Promise<IsolationAvailability>;
+    /**
+     * Put the tracked changes of every dirty repo of the group on its git stash,
+     * the user's way out of a `dirty` refusal. Untracked files stay: they never
+     * block isolation.
+     */
+    stash(workspaceRoot: string): Promise<void>;
+    /**
+     * Mint a run: resolve each repo's base ref to a commit now, and share the
+     * repos that cannot be isolated. Only meaningful after `isActive` said yes;
+     * throws when no repo of the group can be isolated after all.
+     */
+    startRun(workspaceRoot: string): Promise<IsolationRun>;
+    /**
+     * Create the task workspace — one worktree per isolated repo from its
+     * integration tip, the shared paths linked in — and return the cwd to spawn
+     * the Runner into. A second `prepare` for the same task is a retry: the old
+     * attempt is discarded and the workspace recreated from the tips, so the
+     * task sees everything its predecessors have integrated.
+     */
+    prepare(task: Task, run: IsolationRun): Promise<PreparedTask>;
+    /**
+     * Hand a conflicted task's kept workspace to a conflict repair (ADR-0015)
+     * as it is — nothing is re-cut — and return the same cwd. Records each
+     * changed repo's integration tip as `repairBase`, counts the repair, and
+     * moves the task to `repairing`. Throws for a task that is not `conflict`.
+     */
+    reopen(task: Task, run: IsolationRun): Promise<PreparedTask>;
+    /**
+     * The evidence a repair must show before it lands: its work committed, and
+     * in each repo of `repairBase` the task branch containing that tip
+     * (`git merge-base --is-ancestor`) and adding no leftover conflict markers
+     * (`git diff --check`; whitespace warnings do not count). Changes nothing
+     * else: a task that fails stays `repairing` until released.
+     */
+    verifyRepair(task: Task, run: IsolationRun): Promise<RepairEvidence>;
+    /**
+     * Land the task atomically across the repos it changed: commit each
+     * worktree, then `git merge --no-ff` the task branch into each changed
+     * repo's integration branch. If any merge conflicts or fails, it is aborted
+     * and the merges already made for the task are reset away, so `merged`
+     * always means the whole task landed. Serialized inside the module; among
+     * tasks waiting at once the lowest plan order goes first. On anything but
+     * `merged` the worktrees and refs stay, and nothing is resolved here: a
+     * conflict is repaired, if at all, by a new attempt of the task in its own
+     * worktree (ADR-0015), never inside this queue.
+     *
+     * `persist` is called once `run.landing` is set and before the first
+     * merge; the caller saves the run there, synchronously, which is what
+     * lets `pruneOrphans` finish a landing a crash interrupted.
+     */
+    integrate(task: Task, run: IsolationRun, persist?: () => void): Promise<IsolationOutcome>;
+    /**
+     * `keep: false` removes the task's worktree, branch and record (retry, task
+     * removal). `keep: true` leaves the worktree and branch exactly as they are
+     * for inspection — a failed verdict, a stop, a cancel — and only moves the task off `active`,
+     * so a crash-recovery prune does not sweep it away; a repair it ends leaves
+     * the task `conflict`, as it was before the repair. Takes the run rather than
+     * a bare task id: ids are only unique within one plan, and one daemon serves
+     * many (ADR-0007).
+     */
+    release(run: IsolationRun, taskId: string, opts: {
+        keep: boolean;
+    }): Promise<void>;
+    /** End of run: park the integration branch for review and report what landed. */
+    handoff(run: IsolationRun): Promise<IsolationHandoff>;
+    /**
+     * Drop what a crash left behind: a landing it interrupted is rolled back in
+     * every repo, a repair it interrupted leaves its task `conflict`, then stale
+     * active worktrees and directories no record owns go. An `active` record
+     * that still holds unlanded work — commits its branch alone carries, or
+     * edits in its worktree — is not a crash orphan: it may belong to a runner
+     * another host is still driving, so it is kept as `kept` and named in the
+     * result.
+     */
+    pruneOrphans(run: IsolationRun): Promise<IsolationPruneResult>;
+    /** Unified diff of each repo's integration branch against its base ref. */
+    reviewDiff(run: IsolationRun): Promise<string>;
+    /**
+     * "Merge all": merge each repo's integration branch into whatever the user
+     * has checked out there. The one irreversible step, so it only ever happens
+     * when a caller asks for it. Every repo with work is preflighted first — no
+     * merge of the user's in progress, no conflict against their HEAD, no
+     * uncommitted edit to a file the merge changes — and unless all pass,
+     * nothing is merged anywhere. Only a merge Ordewell itself just started is
+     * ever aborted; nothing of the user's is reset.
+     */
+    mergeIntoCheckedOut(run: IsolationRun): Promise<IsolationMergeResult>;
+    /**
+     * Remove every worktree and task branch of the run, and settle each repo's
+     * integration branch as `integration` says. Anything but `keep` also clears
+     * the run's task records.
+     */
+    discard(run: IsolationRun, opts: {
+        integration: IntegrationDisposal;
+    }): Promise<void>;
+    /**
+     * Clear what other runs left in each repo of `run`'s group: every
+     * `ordewell/<run-id>/…` branch the repo's checked-out HEAD already contains.
+     * Never a branch of `run` itself, one a worktree has checked out, or any
+     * branch of a run that still has a worktree — that run may be live in
+     * another plan. Tries every repo, then throws naming those where git failed.
+     */
+    sweep(run: IsolationRun): Promise<void>;
+}
+
+/** One source for the spawn options, so a runner built on this base cannot drift from the interface. */
+type RunnerSpawnOptions = Parameters<ITerminalRunner['spawn']>[0];
+declare abstract class AbstractTerminalSession implements ITerminalSession {
+    id: string;
+    taskId: string;
+    protected exited: boolean;
+    protected outputEmitter: EventEmitter<any>;
+    protected exitEmitter: EventEmitter<any>;
+    constructor(id: string, taskId: string);
+    protected baseHandleExit(code: number): void;
+    onOutput(callback: (text: string) => void): void;
+    onExit(callback: (code: number) => void): void;
+    abstract kill(): void;
+    abstract getOutput(): string;
+    abstract write(text: string): void;
+}
+declare abstract class AbstractRunner<S extends ITerminalSession> implements ITerminalRunner {
+    protected sessions: Map<string, S>;
+    get activeCount(): number;
+    stop(sessionId: string): void;
+    stopAll(): void;
+    protected registerSession(id: string, session: S): void;
+    abstract spawn(opts: RunnerSpawnOptions): Promise<ITerminalSession>;
+}
+
+declare function stripAnsi(text: string): string;
+declare function posixShellQuote(s: string): string;
+/**
+ * Wrap a command for execution inside a POSIX login shell, which is what
+ * resolves runner binaries managed by nvm/volta/asdf.
+ *
+ * Deliberately POSIX-only. This used to take a `platform` and emit
+ * `powershell.exe -Command "'claude' '-p' '…'"` for Windows, which PowerShell
+ * cannot run at all: a quoted string in leading position is parsed in
+ * expression mode, so the invocation died with a parse error before the runner
+ * started — a task that failed instantly, every time, on that platform. Windows
+ * has no login-shell equivalent to emulate (its PATH comes from the registry
+ * and is already inherited), so {@link planShellLaunch} starts the runner
+ * directly there instead of routing it through a shell. Platform choice belongs
+ * to that function; this one only knows how to phrase the POSIX half.
+ */
+declare function buildShellInvocation(command: string, args: string[]): {
+    shellPath: string;
+    shellArgs: string[];
+};
+/** A terminal size in cells. */
+interface PtySize {
+    cols: number;
+    rows: number;
+}
+/**
+ * Options for {@link wrapWithPty}. `size` sets the PTY's window size before the
+ * wrapped command starts. `controlChannel` makes the wrapper listen on its fd 3
+ * for `"<cols> <rows>"` lines and resize the PTY live — the caller spawns the
+ * child with an extra pipe there and writes resize requests into it.
+ */
+interface PtyWrapOptions {
+    size?: PtySize;
+    controlChannel?: boolean;
+}
+/**
+ * Wrap a command in `script` to allocate the PTY some runners require when
+ * headless; `-e` propagates the child's exit code so verification still works.
+ *
+ * POSIX-only by nature — there is no `script` on Windows, which
+ * `HeadlessRunner`'s `hasScriptCmd` probe already discovers, so this is never
+ * reached there.
+ *
+ * `script` sizes its PTY off the terminal it is attached to; spawned off a pipe
+ * (every transport here) it allocates 0x0, which a runner TUI renders as
+ * garbage. `stty` fixes the size on the PTY slave before the command starts, so
+ * the TUI reads its true dimensions via ioctl.
+ *
+ * The control channel can only live on a *separate* fd from the agent's stdin,
+ * so the wrapper saves the PTY on fd 4 first: POSIX sends an asynchronous
+ * command's stdin to `/dev/null`, so the watcher's own stdin cannot be the PTY.
+ * A background job also inherits an fd 0 that is not the terminal; `stty` names
+ * fd 4 explicitly for that reason.
+ */
+declare function wrapWithPty(command: string, args: string[], opts?: PtyWrapOptions): {
+    command: string;
+    args: string[];
+};
+
+/**
+ * cmd.exe's command-line buffer. A longer line is truncated rather than
+ * rejected, which would corrupt a planner's system prompt or a task's prompt
+ * mid-sentence and produce a confident answer to half a question — so the
+ * batch route refuses instead. See {@link CommandLineTooLongError}.
+ */
+declare const CMD_EXE_MAX_COMMAND_LINE = 8191;
+/**
+ * CreateProcess's own ceiling, which the native and PowerShell routes are
+ * bounded by instead. Windows truncates here too, so the same refusal applies —
+ * it is simply four times further away.
+ */
+declare const WINDOWS_MAX_COMMAND_LINE = 32767;
+interface LaunchPlan {
+    /** The executable handed to `spawn()` or `vscode.window.createTerminal`. */
+    file: string;
+    /** Arguments for `file`. Pass verbatim when {@link verbatim} is set. */
+    args: string[];
+    /**
+     * Windows batch route only: `args` is already a quoted command line and must
+     * not be re-quoted. Maps to `windowsVerbatimArguments` for `spawn`, and to
+     * the string form of `shellArgs` for a VS Code terminal.
+     */
+    verbatim?: boolean;
+}
+/** Test seam: every OS touchpoint is injectable, and production uses the defaults. */
+interface LaunchDeps {
+    platform?: NodeJS.Platform;
+    /** The PATH executables are looked up on. Defaults to the augmented PATH. */
+    resolvePath?: () => Promise<string>;
+    /** True when `candidate` names an existing file. */
+    exists?: (candidate: string) => boolean;
+    /** Absolute path to the Windows command interpreter. */
+    comSpec?: () => string;
+    /** Absolute path to Windows PowerShell. */
+    powerShell?: () => string;
+    /** PATHEXT, as the environment reports it. */
+    pathExt?: () => string;
+}
+/**
+ * Thrown when a command's arguments do not fit the buffer of the only
+ * interpreter that can start it. Windows truncates rather than rejecting, and a
+ * system prompt cut off mid-sentence makes the planner answer half a question
+ * confidently — the silent success this repo refuses — so this is raised
+ * instead. `TaskOrchestrator.startTask` catches it and holds the task, so the
+ * message is what the user reads: it names the fix, because they cannot infer
+ * it from a truncated prompt.
+ */
+declare class CommandLineTooLongError extends Error {
+    readonly command: string;
+    readonly length: number;
+    readonly limit: number;
+    constructor(command: string, length: number, limit?: number);
+}
+/**
+ * Thrown when only a batch shim resolved for a multi-line argument. cmd.exe
+ * reads up to the first CR/LF and discards the rest with no error and exit code
+ * 0 — quoting does not help — so the agent would get the first paragraph of its
+ * prompt without the completion marker instruction, then exit looking successful.
+ */
+declare class EmbeddedNewlineError extends Error {
+    readonly command: string;
+    constructor(command: string);
+}
+/**
+ * Thrown when `command` cannot be resolved to a real file. Kept distinguishable
+ * from `WorkspaceNotFoundError` (utils/workspace) even though both a missing
+ * cwd and a missing binary surface as the same `spawn` ENOENT to Node — the two
+ * are checked, and named, separately so the failure names the actual cause.
+ */
+declare class ExecutableNotFoundError extends Error {
+    readonly command: string;
+    readonly searchedPath: string;
+    constructor(command: string, searchedPath: string);
+}
+/**
+ * Whether `command` actually resolves to a file, given the plan
+ * {@link planDirectLaunch} produced for it and the PATH it was resolved
+ * against.
+ *
+ * POSIX is deliberately identity in `planDirectLaunch` (execvp does its own
+ * PATH search), so the search is repeated here instead. Windows already did
+ * the search inside `planDirectLaunch` — signalled by the returned file
+ * differing from the bare command name it was given; an unresolved command
+ * comes back unchanged.
+ */
+declare function isExecutableResolved(command: string, plan: LaunchPlan, PATH: string, deps?: LaunchDeps): boolean;
+/** The verbatim command line cmd.exe receives after `/d /s /c`, before wrapping. */
+declare function windowsCommandLine(file: string, args: string[]): string;
+/**
+ * How to start `command` with `args` through `spawn()`, with no shell.
+ *
+ * POSIX returns its input unchanged — execvp already searches PATH, and adding
+ * a resolution step there would be a new way for a working setup to break.
+ *
+ * Windows resolves the command against PATH × PATHEXT, preferring a native
+ * executable (spawned directly) over a batch shim (through cmd.exe) over a
+ * PowerShell script shim (through `powershell.exe -File`). A command that
+ * resolves to nothing is returned unchanged, so the caller's existing ENOENT —
+ * which names what the user typed — is what surfaces rather than a second,
+ * vaguer error from here.
+ *
+ * The tiers are tried in preference order and the first that *fits* wins, with
+ * one deliberate exception: an overflowing batch shim does not fall through to
+ * PowerShell. Overflow means a very large prompt, which is precisely where
+ * `-File` argument fidelity is least worth betting on, and where a clear held
+ * task beats a plausibly-mangled one. So capacity does not reorder the tiers —
+ * a `.ps1` beside a too-long `.cmd` still raises.
+ *
+ * A line break does reorder them: cmd.exe cannot carry one at any length, so a
+ * `.ps1` beside a `.cmd` wins, and a lone `.cmd` raises.
+ *
+ * @throws {CommandLineTooLongError} when the selected route's buffer cannot
+ * carry the arguments.
+ * @throws {EmbeddedNewlineError} when the arguments span lines and only the
+ * batch route resolved.
+ */
+declare function planDirectLaunch(command: string, args: string[], deps?: LaunchDeps): Promise<LaunchPlan>;
+/**
+ * How to start `command` for a surface that hands an executable and arguments
+ * to a terminal — the VS Code runner today, a Windows TUI later.
+ *
+ * On POSIX this is the login shell, unchanged: `bash -lc` runs the user's
+ * profile, which is how nvm/volta/asdf-managed runner binaries resolve at all.
+ * Windows has no login-shell equivalent (its PATH comes from the registry and
+ * is already inherited), so it takes the direct route instead. That is not just
+ * a simplification: it means the runner's own exit code is the terminal's exit
+ * code, rather than a `$LASTEXITCODE` that PowerShell propagates unreliably —
+ * and the exit code is half of what {@link VerdictEngine} judges a task on.
+ */
+declare function planShellLaunch(command: string, args: string[], deps?: LaunchDeps): Promise<LaunchPlan>;
+
+type SpawnFn = (command: string, args: string[], options: {
+    env: NodeJS.ProcessEnv;
+    stdio: Array<'pipe' | 'ignore'>;
+    cwd: string;
+    /** Set by the Windows batch route, where `args` is already a quoted command line. */
+    windowsVerbatimArguments?: boolean;
+}) => ChildProcess;
+/** Test seam: every OS touchpoint is injectable; production uses the defaults. */
+interface HeadlessRunnerDeps {
+    spawnImpl?: SpawnFn;
+    hasScriptCmd?: () => boolean;
+    resolvePath?: () => Promise<string>;
+    /**
+     * Overrides for executable resolution ({@link planDirectLaunch}). Only the
+     * Windows branch consults them, so a POSIX test never needs to pass anything.
+     */
+    launchDeps?: LaunchDeps;
+}
+declare class HeadlessSession extends AbstractTerminalSession {
+    private spawnImpl;
+    readonly interactive: boolean;
+    private process;
+    private outputBuffer;
+    private controlStream;
+    constructor(id: string, taskId: string, spawnImpl: SpawnFn, interactive?: boolean);
+    get isStarted(): boolean;
+    start(launch: LaunchPlan, cwd: string, resolvedPath: string, env?: Record<string, string>, options?: {
+        controlChannel?: boolean;
+    }): void;
+    kill(): void;
+    getOutput(): string;
+    write(text: string): void;
+    /** PTY resize requests from a surface that owns the terminal rendering the wrapper. */
+    writeControl(text: string): void;
+}
+
+/** Everything needed to start one runner process, resolved before any child exists. */
+interface PreparedLaunch {
+    launch: LaunchPlan;
+    resolvedPath: string;
+    env: Record<string, string>;
+    /** True when the invocation was wrapped in `script` to allocate a PTY. */
+    pty: boolean;
+    /** True when the started process needs an explicit Enter sent to submit its pre-filled prompt. */
+    submitPromptKey: boolean;
+}
+declare class HeadlessRunner extends AbstractRunner<HeadlessSession> {
+    private spawnImpl;
+    private hasScriptCmd;
+    private resolvePath;
+    private launchDeps;
+    private spawnCount;
+    /**
+     * Session shape: a piped subprocess is not a terminal, so runners get their
+     * non-interactive subcommand. The VS Code runner owns a pseudoterminal and
+     * overrides this to true. Autonomy is a separate axis (see `ResolveContext`)
+     * and stays on either way — no surface has a human answering permission
+     * prompts on the orchestrator's behalf.
+     */
+    protected readonly defaultInteractive: boolean;
+    constructor(deps?: HeadlessRunnerDeps);
+    /**
+     * Unique per spawn, not per task: a retry reuses its task id and ids often
+     * share a prefix, and a shared registry key let the old attempt's exit
+     * unregister the new one. Unlike TmuxRunner, nothing outside this process
+     * keys on the id, so a counter is enough to scope it to the attempt.
+     */
+    protected nextSessionId(taskId: string): string;
+    protected createSession(id: string, taskId: string): HeadlessSession;
+    /** Everything up to, but not including, spawning — so a surface that owns its own child reaches the same decisions. */
+    protected prepareLaunch(opts: RunnerSpawnOptions, ptyOptions?: PtyWrapOptions): Promise<PreparedLaunch>;
+    spawn(opts: RunnerSpawnOptions): Promise<ITerminalSession>;
+}
+
+/**
+ * What one model call consumed, as its provider or runner reported it. Shared
+ * by the planner's usage line (#49) and per-attempt task usage (#26): a record
+ * says nothing about who asked for the call, so either can hold a list of them.
+ *
+ * Every measure is optional because backends report different subsets. An
+ * absent field means "not reported" — never zero — so a total can tell the two
+ * apart.
+ */
+interface UsageRecord {
+    /** The provider or runner id that reported the call — `openai`, `claude-code`, … */
+    source: string;
+    model?: string;
+    inputTokens?: number;
+    outputTokens?: number;
+    /** The share of `inputTokens` served from the provider's prompt cache. */
+    cachedInputTokens?: number;
+    /**
+     * Filled only from a provider's or runner's own report, never from a price
+     * table or an estimate: prices go stale, and a subscription runner has no
+     * per-token price at all. No report means no cost, not a guessed one.
+     */
+    reportedCost?: {
+        amount: number;
+        currency: string;
+    };
+    /** The model's context window, when the runner itself reports it. */
+    contextWindow?: number;
+    /** Set when a subagent made the call; its usage still counts toward the total. */
+    subagentId?: string;
+}
+/**
+ * A running sum of {@link UsageRecord}s. A measure stays absent until some
+ * record reports it. Cost is kept per currency: two runners may bill in
+ * different ones, and there is no honest exchange rate to fold them together.
+ */
+interface UsageTotals {
+    inputTokens?: number;
+    outputTokens?: number;
+    cachedInputTokens?: number;
+    reportedCost?: Record<string, number>;
+}
+/**
+ * The input side of a call whose provider reports its prompt in parts — the
+ * uncached tail, with cache reads and cache writes beside it rather than inside
+ * it (Anthropic, and OpenCode after it). The prompt the model saw is all three;
+ * only the reads were served from cache, since a write is billed as fresh
+ * input. A part left unreported adds nothing, and with no part reported there
+ * is no measure at all.
+ */
+declare function partedPromptUsage(parts: {
+    uncached?: number;
+    cacheRead?: number;
+    cacheWrite?: number;
+}): Pick<UsageRecord, 'inputTokens' | 'cachedInputTokens'>;
+declare function addUsage(totals: UsageTotals, record: UsageRecord): UsageTotals;
+/**
+ * What the planner has consumed over a session (#49). `totals` includes every
+ * `bySubagent` entry. `lastPromptTokens` and `contextWindow` track the
+ * planner's own calls only — a subagent runs its own model, whose window says
+ * nothing about the planner's.
+ */
+interface PlannerUsage {
+    totals: UsageTotals;
+    bySubagent?: Record<string, UsageTotals>;
+    lastPromptTokens?: number;
+    contextWindow?: number;
+}
+declare function addPlannerUsage(usage: PlannerUsage, record: UsageRecord): PlannerUsage;
+/** Whether any measure was reported: a token line of nothing but blanks says nothing. */
+declare function isMeasured(totals: UsageTotals): boolean;
+/** What the token line shows of a ledger — live from its broadcast, or reloaded from the saved one. */
+interface UsageLine {
+    totals: UsageTotals;
+    bySubagent?: Record<string, UsageTotals>;
+    contextFill?: {
+        usedTokens: number;
+        windowTokens: number;
+    };
+}
+declare function usageLine(usage: PlannerUsage): UsageLine;
+/**
+ * The last planner prompt against its window, or undefined while either is
+ * unknown. `usedTokens` is the prompt total as reported, cached tokens
+ * included: a cached token still occupies the window, so subtracting the
+ * cached share would understate how full the context is. A window of 0 is
+ * treated as unknown — never guessed.
+ */
+declare function plannerContextFill(usage: PlannerUsage): {
+    usedTokens: number;
+    windowTokens: number;
+} | undefined;
+
+/**
+ * The planner's single approval seam. Every capability that reaches beyond the
+ * default read-only, in-workspace envelope — a path outside the workspace root,
+ * a shell command outside the auto-allowed set, a URL fetch — routes through
+ * one `request()` so the policy has exactly one owner (the same "one repair
+ * owner" shape as PlanRepair).
+ *
+ * Surfaces supply the human channel. VS Code answers with a modal; the web
+ * server currently has no prompt UI, so it denies unless the scope was
+ * pre-approved through config. Denial is always a visible, actionable tool
+ * result — never a silent success.
+ */
+/**
+ * `runner_tool` is a task runner's own tool request (ADR-0018, A1): it waits
+ * for an answer as long as it takes, and never passes through the planner's
+ * policy — the runner's mode already decided it needed asking.
+ */
+type ApprovalKind = 'external_path' | 'shell_command' | 'url_fetch' | 'runner_tool';
+interface ApprovalRequest {
+    kind: ApprovalKind;
+    /** The concrete thing being asked about: an absolute path, a command line, a URL. */
+    subject: string;
+    /**
+     * What a grant covers. Approving remembers this, not `subject`, so reading a
+     * second file from an already-approved directory does not prompt again.
+     */
+    scope: string;
+    /** One-line context for the prompt. */
+    detail?: string;
+    /** The task whose runner asked; absent for the planner's own requests. */
+    taskId?: string;
+    /** "Allow for this task" can be offered: the runner proposed its own session-scoped grant. */
+    allowForTask?: boolean;
+}
+/**
+ * An answer, from whoever gives it — a person on any surface, or later the
+ * supervisor (#28). `allowForTask` is Allow plus the runner's own grant for
+ * the rest of the task; `note` goes back to the agent with a denial.
+ */
+type ApprovalDecision = {
+    decision: 'allow';
+} | {
+    decision: 'allowForTask';
+} | {
+    decision: 'deny';
+    note?: string;
+};
+/** What an answer may be given as: a planner prompt's yes/no still is one. */
+type ApprovalAnswer = boolean | ApprovalDecision;
+declare function toApprovalDecision(answer: ApprovalAnswer): ApprovalDecision;
+declare function isGranted(decision: ApprovalDecision): boolean;
+declare function isRunnerApproval(request: ApprovalRequest): boolean;
+interface IApproval {
+    request(req: ApprovalRequest): Promise<boolean>;
+}
+/** Denies everything. The safe default when a surface wires no approval channel. */
+declare const DENY_ALL: IApproval;
+
+/**
+ * The harness-planner transport contract (ADR-0009).
+ *
+ * One adapter per coding agent, each speaking that agent's own programmatic
+ * protocol and normalizing it to the event union below. Everything above this
+ * line — reply classification, the repair loop, plan validation, the four
+ * surfaces — is already provider-agnostic, so an adapter is the entire cost of
+ * teaching Ordewell to plan with another agent.
+ */
+/**
+ * One normalized event from a running agent turn. Deliberately smaller than
+ * any single agent's native protocol: this is the intersection Ordewell can act
+ * on, not a lossless re-encoding. Event fidelity differs by agent — `thinking`
+ * is rich on Claude Code and absent elsewhere — so consumers must tolerate a
+ * turn that emits nothing but `assistant_text` and `turn_end`.
+ */
+type AgentEvent = 
+/**
+ * A complete run of the assistant's reply. Concatenated in order to form the
+ * turn's text. When the same run already streamed as `assistant_text_delta`,
+ * this is the authoritative copy of it — it replaces the deltas, it is not
+ * appended after them.
+ */
+{
+    type: 'assistant_text';
+    text: string;
+}
+/**
+ * An incremental piece of the assistant's reply, for agents that stream
+ * partial messages. The planner's own text only: a subagent's words never
+ * arrive here, so they can never become the reply.
+ */
+ | {
+    type: 'assistant_text_delta';
+    text: string;
+}
+/**
+ * Reasoning the agent chose to expose. Never contributes to the reply text.
+ * Like `assistant_text`, it supersedes deltas already streamed for it.
+ */
+ | {
+    type: 'thinking';
+    text: string;
+    subagentId?: string;
+} | {
+    type: 'thinking_delta';
+    text: string;
+    subagentId?: string;
+}
+/** `subagentId` marks a call made inside a subagent rather than by the planner itself. */
+ | {
+    type: 'tool_call';
+    id: string;
+    name: string;
+    args: Record<string, unknown>;
+    subagentId?: string;
+} | {
+    type: 'tool_result';
+    id: string;
+    name: string;
+    output: string;
+    success: boolean;
+    subagentId?: string;
+}
+/** One model call's usage, as the agent reported it — never estimated. */
+ | {
+    type: 'usage';
+    record: UsageRecord;
+}
+/** The agent delegated `brief` to a subagent, whose events carry `subagentId` until it finishes. */
+ | {
+    type: 'subagent_started';
+    subagentId: string;
+    brief: string;
+    model?: string;
+} | {
+    type: 'subagent_finished';
+    subagentId: string;
+    outcome: SubagentOutcome;
+    digest: string;
+}
+/**
+ * The agent asked to do something its mode does not cover. A planner always
+ * auto-denies it (T1) — a planner that can mutate is not a planner — and the
+ * adapter answers so the turn does not hang. A task's request stays open
+ * until {@link TaskModeAgentAdapter.answerPermission} (ADR-0018, A1).
+ *
+ * `input` and `suggestions` are the raw request; `suggestions` are the
+ * agent's own session-scoped grants, what "Allow for this task" answers with.
+ */
+ | {
+    type: 'permission_request';
+    id: string;
+    name: string;
+    detail: string;
+    input?: Record<string, unknown>;
+    suggestions?: unknown[];
+    toolUseId?: string;
+}
+/** The agent withdrew an open request — an interrupt cancels the call it was for. It takes no answer now. */
+ | {
+    type: 'permission_cancelled';
+    id: string;
+}
+/**
+ * The agent delegated work to a subagent it left running in the background,
+ * and may end its turn before that work reports. Ordewell's conversation is
+ * request/response: a turn that ends hands control back to the user, and
+ * anything the agent says afterwards arrives with no turn open and is lost.
+ * Naming the launch is what lets the service ask for the results in time.
+ */
+ | {
+    type: 'background_agent';
+    id: string;
+}
+/**
+ * The agent finished its turn and is waiting for the next user message.
+ * `interrupted` marks a turn cut short by {@link TaskModeAgentAdapter.interrupt}
+ * rather than one the agent chose to end.
+ */
+ | {
+    type: 'turn_end';
+    interrupted?: boolean;
+}
+/** The turn failed. Carries the agent's own words — never a Ordewell paraphrase. */
+ | {
+    type: 'error';
+    message: string;
+};
+interface AgentStartCommon {
+    /** Workspace root. The agent works from here and, in read-only mode, cannot leave it. */
+    cwd: string;
+    /** Model id from the runner's own discovery catalog. Omitted means the agent's default. */
+    model?: string;
+    /**
+     * The agent's own session id from a previous run. For the planner a hint
+     * only: Ordewell's transcript is the source of truth (T4), so a failed resume
+     * degrades to a fresh session seeded from the stored history, not an error.
+     */
+    resumeSessionId?: string;
+}
+/** The read-only planner (ADR-0008/0009). The only start `CliAgentAiService` can express. */
+interface PlannerStartOptions extends AgentStartCommon {
+    kind: 'planner';
+    /** The planner system prompt, in its harness variant. */
+    systemPrompt: string;
+    /** Variant / reasoning effort id from that model's `variants` list. */
+    effort?: string;
+}
+/**
+ * What a runner manifest says the task's mode and effort mean (ADR-0001),
+ * resolved by the same code terminal tasks use — see `resolveTaskRunnerFlags`.
+ * The adapter adds only its protocol flags around these.
+ */
+interface TaskRunnerFlags {
+    /** The runner's own permission-mode value for the task's mode. */
+    permissionMode: string;
+    /** Thinking/effort arguments, already split into argv entries. */
+    effortArgs: string[];
+}
+/** A plan task driven over the runner's programmatic protocol (ADR-0018, C1). */
+interface TaskStartOptions extends AgentStartCommon {
+    kind: 'task';
+    /** The task's runner mode id, as the plan names it. */
+    mode: string;
+    flags: TaskRunnerFlags;
+}
+/**
+ * The explicit start switch. Discriminated so that a read-only planner and a
+ * mutating task can never be confused by a missing field: every caller names
+ * which one it is starting.
+ */
+type AgentStartOptions = PlannerStartOptions | TaskStartOptions;
+/** A runner asked to start in task mode that has no task-mode connector yet. */
+declare class TaskModeUnsupportedError extends Error {
+    readonly runner: string;
+    constructor(runner: string);
+}
+interface AgentAdapter {
+    /** The runner id this adapter drives — `claude-code`, `codex`, `opencode`. */
+    readonly agentId: string;
+    /** Spawn the agent — read-only for a planner, in the task's mode for a task — ready to receive messages. */
+    start(opts: AgentStartOptions): Promise<void>;
+    /**
+     * Send one user message and stream the turn's events until it ends. Resolves
+     * when the agent yields the floor; rejects only when the transport itself
+     * failed in a way no `error` event could describe.
+     *
+     * `onActivity`, when given, fires on raw transport traffic — every stdio
+     * line or stream chunk the process produces — independent of whether that
+     * traffic becomes an `AgentEvent`. An adapter may legitimately emit nothing
+     * for long stretches (a subagent's filtered output, most often); a caller
+     * using presence-of-events as a liveness signal would read that silence as
+     * a hang. `onActivity` is the seam that keeps liveness detection from being
+     * coupled to what each adapter chooses to surface.
+     */
+    send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal, onActivity?: () => void): Promise<void>;
+    /** The agent's native session id once it has announced one. Resumption hint only. */
+    nativeSessionId(): string | null;
+    /** Kill the process and release its resources. Idempotent. */
+    dispose(): void;
+}
+/** What an adapter adds to run a task rather than a planner (ADR-0018). */
+interface TaskModeAgentAdapter extends AgentAdapter {
+    /**
+     * Ask the running turn to stop, keeping the process and its session. Resolves
+     * true once the agent acknowledged it; the turn then ends with
+     * `turn_end { interrupted: true }`. False means the agent did not answer
+     * within `timeoutMs`, and the caller must fall back to killing it.
+     */
+    interrupt(timeoutMs: number): Promise<boolean>;
+    /** Registers a listener for the process ending, for any reason. Fires at most once. */
+    onProcessExit(listener: (code: number) => void): void;
+    /**
+     * Answer an open `permission_request`. False when the id is not open — it
+     * was answered, cancelled, or never asked.
+     */
+    answerPermission(id: string, decision: ApprovalDecision): boolean;
+}
+/**
+ * The single injected boundary between Ordewell and the operating system —
+ * the same pattern `HeadlessRunnerDeps` uses for task execution. Tests feed
+ * recorded agent output through `spawn` (and, for HTTP-transport agents,
+ * `fetch`) so one test exercises adapter parsing, event mapping, reply
+ * classification and the repair loop as a single observable behavior.
+ */
+interface AgentProcessDeps {
+    spawn: SpawnFn;
+    fetch: typeof globalThis.fetch;
+    /** Resolves the PATH agents are spawned under. Defaults to the augmented PATH. */
+    resolvePath?: () => Promise<string>;
+    /** Host platform. Defaults to the real one; injected so OS-specific behavior is testable anywhere. */
+    platform?: NodeJS.Platform;
+    /** True when `workspace` names an existing directory. Defaults to a real filesystem check. */
+    isDirectory?: (workspace: string) => boolean;
+    /** True when `candidate` names an existing, spawnable file. Defaults to a real filesystem check. */
+    exists?: (candidate: string) => boolean;
+    /** The workspace's own variables for a cwd (ADR-0016). Defaults to {@link resolveWorkspaceEnv}. */
+    workspaceEnv?: (cwd: string) => Promise<Record<string, string>>;
+}
+/** Builds the adapter for one runner id, or null when that runner cannot plan. */
+type AgentAdapterFactory = (runner: string, deps: AgentProcessDeps) => AgentAdapter | null;
+/**
+ * Split a stream of chunks into complete lines. Every agent transport here is
+ * newline-delimited JSON of some shape, and a chunk boundary lands mid-object
+ * often enough that parsing per-chunk silently drops events.
+ */
+declare class LineBuffer {
+    private buffer;
+    push(chunk: string, onLine: (line: string) => void): void;
+    /** Anything left unterminated when the stream closed. */
+    flush(): string;
+}
+
+interface RunnerPluginManifest {
+    name: string;
+    displayName: string;
+    description: string;
+    version: string;
+    author?: string;
+    homepage?: string;
+    runner: PluginRunnerDef;
+    features: PluginFeatures;
+    modelDiscovery: PluginModelDiscovery;
+    contextFile?: string;
+    contextFileAltPath?: string;
+    modes?: PluginMode[];
+}
+interface PluginRunnerDef {
+    command: string;
+    argsTemplate: string[];
+    promptInArgs: boolean;
+    env?: Record<string, string>;
+    /** When true, the runner requires a PTY. HeadlessRunner wraps with `script` to allocate one. */
+    requiresTty?: boolean;
+    /**
+     * True when this runner's interactive prompt flag (e.g. opencode's
+     * `--prompt`) only pre-fills its TUI's composer instead of running it, so a
+     * surface driving that TUI unattended must send an explicit Enter after
+     * launch. Only takes effect while the resolved invocation is interactive —
+     * see `RunnerInvocation.submitPromptKey`.
+     */
+    submitPromptKey?: boolean;
+    /**
+     * Screens the agent can stop on before starting the task, waiting for a
+     * human — a folder-trust or permission-mode confirmation. Ordewell never
+     * answers one; seeing it, the task's user is told where to.
+     */
+    blockingPrompts?: BlockingPrompt[];
+}
+interface BlockingPrompt {
+    /** Text the prompt shows; matched ignoring case and whitespace. */
+    phrase: string;
+    /** Completes "<runner> is asking …", e.g. "whether to trust this folder". */
+    asks: string;
+}
+interface PluginFeatures {
+    modelSelection: boolean;
+    thinkingEffort: boolean;
+    planMode: boolean;
+    planModeFlag: string;
+    buildModeFlag?: string;
+    /** Flag appended when headless mode is on, so the agent never prompts for permission (e.g. Claude's --dangerously-skip-permissions). */
+    headlessFlag?: string;
+    thinkingFlag?: string;
+    thinkingValueEnabled?: string;
+    thinkingValueDisabled?: string;
+    thinkingValueAdaptive?: string;
+    /** Maps mode IDs to the CLI --permission-mode value. Used by {{feature:permissionModeVal}}. */
+    permissionModeValues?: Record<string, string>;
+}
+type PluginParser = 'claude-help' | 'opencode-models' | 'opencode-models-verbose' | 'anthropic-models' | 'line-by-line' | 'json' | 'json-table';
+interface DiscoveryCommand {
+    command: string;
+    args: string[];
+    parser?: PluginParser;
+}
+type ApiAuthMethod = {
+    type: 'env';
+    varName: string;
+    header: string;
+    prefix?: string;
+} | {
+    type: 'file';
+    path: string;
+    jsonPath: string;
+    header: string;
+    prefix?: string;
+};
+interface ApiDiscoveryConfig {
+    url: string;
+    headers?: Record<string, string>;
+    auth: ApiAuthMethod[];
+    parser: PluginParser;
+}
+interface PluginModelDiscovery {
+    method: 'command' | 'hardcoded';
+    command?: string;
+    args?: string[];
+    parser?: PluginParser;
+    jsonPath?: string;
+    /**
+     * Stdio JSON-RPC discovery (Codex `app-server`): spawn the command, send
+     * `initialize` then `model/list`, and read the catalog from the response.
+     * Tried BEFORE apiDiscovery and command discovery. When the call fails,
+     * `cacheFile` (the runner's own on-disk catalog cache, `~` expanded) is
+     * read before falling through to the remaining discovery methods.
+     */
+    appServer?: {
+        command: string;
+        args: string[];
+        cacheFile?: string;
+    };
+    /**
+     * Optional last-resort list for user plugins whose CLI cannot enumerate
+     * models. Used only when command discovery fails entirely or the CLI is
+     * unavailable. Built-in manifests must NOT use this: anything listed here is
+     * shown to the user as available even when it isn't.
+     */
+    fallbackModels?: {
+        modelId: string;
+        modelLabel: string;
+    }[];
+    /**
+     * Stable `--model` aliases that the runner's CLI always accepts but its help
+     * text may omit (e.g. Claude's 'haiku'). Merged into successful discovery
+     * results to fill gaps — discovered models take precedence, missing aliases
+     * are appended — and used as the last resort when discovery fails entirely.
+     * Unlike `fallbackModels`, entries must be stable CLI-accepted aliases
+     * (contracts that always resolve), not arbitrary model IDs.
+     */
+    canonicalAliases?: {
+        modelId: string;
+        modelLabel: string;
+    }[];
+    /**
+     * HTTP API discovery — tried BEFORE command discovery. When the runner's CLI
+     * has no model-listing subcommand (Claude Code), an API endpoint can serve as
+     * the authoritative source. Auth methods are tried in order; the first that
+     * yields a token is used. If no auth method yields a token or the request
+     * fails, discovery falls through to `discoveryCommands` + `canonicalAliases`.
+     */
+    apiDiscovery?: ApiDiscoveryConfig;
+    preferredPatterns?: {
+        id: string;
+        label: string;
+    }[];
+    variants?: {
+        id: string;
+        label: string;
+    }[];
+    discoveryCommands?: DiscoveryCommand[];
+}
+interface PluginMode {
+    id: string;
+    label: string;
+    description: string;
+    /** CLI value passed to the runner's permission/mode flag. Defaults to id if omitted. */
+    cliValue?: string;
+    /** Marks this mode as the runner's most permissive mode — the resolved default when autonomous mode is ON. */
+    autonomous?: boolean;
+    /** Marks this mode as the runner's conservative build mode — the resolved default when autonomous mode is OFF. */
+    safe?: boolean;
+}
+interface PluginEntry {
+    manifest: RunnerPluginManifest;
+    source: 'builtin' | 'user';
+    installPath?: string;
+}
+interface ResolveContext {
+    prompt: string;
+    model?: string;
+    thinkingEffort?: string;
+    /** All variant ids the assigned model offers — lets {{opencodeVariantConfig}} disable the non-chosen ones. */
+    modelVariants?: string[];
+    mode: string;
+    /**
+     * Autonomy axis: when true, resolve {{if headless}} blocks and the
+     * {{feature:headless}} token so the agent never stops to ask for permission.
+     * True for every orchestrated task run — nobody is watching the terminal on
+     * Ordewell's behalf — independently of the session *shape* below.
+     */
+    headless?: boolean;
+    /**
+     * Session-shape axis: true when the runner is launched onto a real TTY the
+     * user can attach to (a tmux window, a VS Code pseudoterminal), so the
+     * runner's own TUI should come up rather than its non-interactive
+     * subcommand. Defaults to `!headless` for callers that predate the split.
+     */
+    interactive?: boolean;
+    /** The task's working directory — needed by runners whose autonomy flags name a path. */
+    cwd?: string;
+}
+interface RunnerInvocation {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+    promptInArgs: boolean;
+    /** True when a surface running this invocation on a real TTY must send an explicit Enter once the process starts. */
+    submitPromptKey: boolean;
+}
+/**
+ * Persistent storage seam for plugin manifests. The RunnerRegistry delegates
+ * all filesystem operations to this interface so the plugin lifecycle is
+ * testable without real I/O.
+ */
+interface IPluginStore {
+    /** Path to the user plugins directory (~/.ordewell/plugins/). */
+    getUserPluginsDir(): string;
+    /** List subdirectory names inside the user plugins directory. */
+    listUserPluginDirs(): string[];
+    /** List entry names directly inside a directory. Returns [] when unreadable. */
+    listDir(dir: string): string[];
+    /** Read and parse a manifest.json from pluginDir. Returns null on failure. */
+    loadManifest(pluginDir: string): RunnerPluginManifest | null;
+    /** Recursively copy sourceDir to destDir. */
+    copyDir(sourceDir: string, destDir: string): void;
+    /** Recursively remove a directory. */
+    removeDir(dir: string): void;
+    /** Ensure a directory exists (mkdir -p). */
+    ensureDir(dir: string): void;
+    /** Write a text file. */
+    writeFile(filePath: string, content: string): void;
+    /** Read a UTF-8 text file. Returns null on ENOENT or read error. */
+    readFile(filePath: string): string | null;
+    /** True if path exists and is a directory. */
+    dirExists(path: string): boolean;
+    /** True if path exists. */
+    exists(path: string): boolean;
+}
+
+/**
+ * Decides whether one out-of-envelope capability may run, and remembers the
+ * answer for the rest of the session.
+ *
+ * Grants are keyed on {@link ApprovalRequest.scope}, never on the concrete
+ * subject: approving a read of `/tmp/foo/a.log` grants `/tmp/foo/*`, and
+ * approving `az group list` grants `az group`. Without that, a planner doing
+ * real research would prompt on every single call and the feature would be
+ * unusable.
+ *
+ * `mode` is the policy floor:
+ *   ask     consult the human channel; no channel means deny (headless, web)
+ *   allow   grant everything the tier system did not already refuse
+ *   deny    grant nothing beyond `preApproved`
+ *
+ * Note the ordering: `preApproved` is honored under every mode including
+ * `deny`, because it is an explicit operator decision rather than a default.
+ */
+type ApprovalMode = 'ask' | 'allow' | 'deny';
+interface ApprovalPolicyOptions {
+    mode?: ApprovalMode;
+    /** Scopes granted up front from config. A trailing `*` matches by prefix. */
+    preApproved?: string[];
+    /** The human channel. Absent means there is nobody to ask. */
+    ask?: (req: ApprovalRequest) => Promise<boolean>;
+    /** Called whenever a decision is reached, for surfacing in a UI or a log. */
+    onDecision?: (req: ApprovalRequest, granted: boolean, source: ApprovalSource) => void;
+}
+type ApprovalSource = 'pre-approved' | 'remembered' | 'mode' | 'asked' | 'no-channel';
+declare class ApprovalPolicy implements IApproval {
+    private readonly mode;
+    private readonly preApproved;
+    private readonly asker?;
+    private readonly onDecision?;
+    private readonly granted;
+    private readonly refused;
+    /** One in-flight ask per scope: a parallel tool round must not prompt twice for the same thing. */
+    private readonly inFlight;
+    private generation;
+    constructor(opts?: ApprovalPolicyOptions);
+    request(req: ApprovalRequest): Promise<boolean>;
+    /** Scopes the user has granted this session — for display and for persistence. */
+    grantedScopes(): string[];
+    /** Drop every session-scoped decision. Called on session reset. */
+    reset(): void;
+}
+
+interface CatalogModel {
+    id: string;
+    name: string;
+    description: string;
+    pricing: {
+        prompt: string;
+        completion: string;
+    };
+    contextLength: number;
+}
+declare class ModelCatalog {
+    static fetchModels(apiKey: string, baseUrl?: string, fetchImpl?: typeof fetch): Promise<CatalogModel[]>;
+    /**
+     * Delete the on-disk catalog cache for a base URL so the next fetch re-runs.
+     * Used by the resolver's `invalidate()` in production (no injected fetch);
+     * best-effort — a missing file or unreadable dir is a no-op.
+     */
+    static clearCache(baseUrl?: string): void;
+    private static readCache;
+    private static writeCache;
+}
+
+interface ModelShortcut {
+    label: string;
+    id: string;
+    provider: string;
+    description: string;
+    pricing?: string;
+}
+declare const ORCHESTRATOR_SHORTCUTS: ModelShortcut[];
+declare function resolveModelShortcut(input: string, shortcuts: ModelShortcut[]): string | null;
+/**
+ * Resolves a value to a model id ONLY when it is in the supplied catalog
+ * option list — either directly or via a shortcut label. Free-typed, unknown,
+ * or not-currently-available values return null, so callers never store an id
+ * the user couldn't have selected from the list. Keeps model-setting list-only.
+ */
+declare function knownModelId(value: string, optionIds: string[], shortcuts: ModelShortcut[]): string | null;
+
+type ProviderModelLists = Record<string, string[]>;
+interface OrchestratorOption {
+    id: string;
+    label: string;
+    provider: string;
+    apiProvider: AiProvider;
+    description?: string;
+    pricing?: string;
+    /** The model's context window when the catalog reports one (#49). */
+    contextWindow?: number;
+}
+
+interface FetchAllProviderModelsOptions {
+    apiKeys: Record<string, string>;
+    baseUrls: Record<string, string>;
+    fetchImpl?: typeof fetch;
+}
+type AllProviderModels = Record<string, CatalogModel[]>;
+/**
+ * Result of a picker-catalog fetch fan-out: the per-provider model lists plus
+ * the per-provider failures. `errors` is keyed by provider id and holds the
+ * failure message for any provider whose catalog fetch rejected — the seam the
+ * surfaces (CLI, VS Code) use to flag "this configured provider didn't work"
+ * rather than silently showing a short list.
+ */
+interface ProviderModelsResult {
+    models: AllProviderModels;
+    errors: Record<string, string>;
+}
+/** The provider config fields the discovery fan-out needs. */
+interface ProviderCredentialSource {
+    getProviderApiKey(provider: AiProvider): string;
+    getProviderBaseUrl(provider: AiProvider): string;
+    openaiCompatibleBaseUrl: string;
+}
+/**
+ * Collect the API keys and base URLs the picker fan-out should probe, applying
+ * the single "configured" policy shared by every surface (CLI + VS Code):
+ *  - a preset is discovered only when it has an API key (OpenRouter included —
+ *    its public catalog is not probed keyless, matching the product rule that
+ *    only key-configured providers appear);
+ *  - `openai_compatible` is discovered only when an explicit endpoint is set
+ *    (keyless local servers like ollama / LM Studio).
+ * Base URLs are handed through only for providers that pass the gate, so the
+ * fan-out never touches an unconfigured third-party endpoint.
+ */
+declare function collectProviderCredentials(config: ProviderCredentialSource): {
+    apiKeys: Record<string, string>;
+    baseUrls: Record<string, string>;
+};
+declare function fetchAllProviderModels(opts: FetchAllProviderModelsOptions): Promise<ProviderModelsResult>;
+declare function resolveProvider(modelId: string, providerModelLists: Record<string, string[]>): AiProvider | null;
+declare function toOrchestratorOptions(providerModels: AllProviderModels, shortcuts: ModelShortcut[]): OrchestratorOption[];
+
+/**
+ * Who plans. Mostly LLM vendors reached over HTTP; the last three are *harness
+ * planners* (ADR-0009) — a coding agent CLI already installed on the machine,
+ * driven as the planner over its own programmatic transport and authenticated
+ * by the subscription the user already holds. They are runners in the provider
+ * axis, deliberately: "what plans for me?" is one question, and it belongs in
+ * one setting. `isCliProvider` is the single guard that tells the two kinds
+ * apart.
+ */
+type AiProvider = 'google' | 'openrouter' | 'openai_compatible' | 'openai' | 'xai' | 'groq' | 'deepseek' | 'together' | 'mistral' | 'anthropic' | 'fireworks' | 'perplexity' | 'zhipu' | 'kimi' | 'cerebras' | 'deepinfra' | 'doubao' | 'qwen' | 'hunyuan' | 'baichuan' | 'minimax' | 'yi' | 'stepfun' | 'siliconflow' | 'cohere' | 'novita' | 'claude-code' | 'codex' | 'opencode';
+interface IConfig {
+    aiProvider: AiProvider;
+    apiKey: string;
+    planningModel: string;
+    enabledRunners: string[];
+    maxParallelSessions: number;
+    researchEnabled: boolean;
+    researchMaxSteps: number;
+    researchMaxFileSize: number;
+    openAiBaseUrl: string;
+    openAiApiKey: string;
+    /** Provider keys + base URL the ModelResolver uses to fetch the picker catalogs. */
+    openrouterKey: string;
+    geminiKey: string;
+    geminiBaseUrl?: string;
+    /** Base URL + API key for a user-provided OpenAI-compatible endpoint (ollama, vLLM, LM Studio, etc.). */
+    openaiCompatibleBaseUrl: string;
+    openaiCompatibleApiKey: string;
+    orchestratorModel: string;
+    geminiModel: string;
+    /** Model for research subagents (issue #34); defaults to the (cheap) planner model. */
+    researchSubagentModel: string;
+    /**
+     * Thinking effort / model variant for a harness planner (ADR-0009), chosen
+     * from the agent's own discovered variants. Separate from the per-task
+     * efforts the plan carries — this one is the planner's own dial.
+     */
+    plannerThinkingEffort?: string;
+    planMapEnabled: boolean;
+    autonomousMode: boolean;
+    /**
+     * Run each AI task in its own git worktree and integrate the results on a
+     * per-run branch (ADR-0013). Non-git workspaces fall back to the shared
+     * workspace root regardless of this flag.
+     */
+    worktreeIsolation: boolean;
+    /**
+     * Shell command run in a fresh task worktree instead of symlinking ignored
+     * artifacts from the main worktree — for repos where sharing `node_modules`
+     * or a virtualenv is wrong.
+     */
+    worktreeSetupCommand?: string;
+    /**
+     * Repositories of the repo group listed by hand, relative to the workspace
+     * (ADR-0014). When non-empty the group is exactly these, replacing the
+     * repositories auto-detected directly inside the folder; needed for ones
+     * deeper than that, which are never auto-detected.
+     */
+    workspaceRepos: string[];
+    /**
+     * Extra paths or globs, relative to each repo root, linked from the real repo
+     * into its task worktree where they exist — gitignored local state such as
+     * `*.tfstate` that a task must use, not a copy of.
+     */
+    worktreeLinks: string[];
+    /**
+     * How many conflict repairs one task may go through before its conflict is
+     * left for a person (ADR-0015); 0 turns repair off.
+     */
+    conflictRepairAttempts: number;
+    /**
+     * What to do when planner research reaches outside its default envelope — an
+     * out-of-workspace path, or a shell command beyond the auto-allowed read-only
+     * set. `ask` prompts the user (and denies where no surface can prompt, such as
+     * headless runs); `allow` and `deny` skip the prompt entirely.
+     */
+    approvalMode: ApprovalMode;
+    /** Scopes granted up front, so CI and power users never see a prompt. Trailing `*` matches by prefix. */
+    approvalPreApproved: string[];
+    /** Get the base URL for an OpenAI-compatible provider. */
+    getProviderBaseUrl(provider: AiProvider): string;
+    /** Get the API key for a provider. */
+    getProviderApiKey(provider: AiProvider): string;
+    /**
+     * Push the canonical provider routing lists in (sole producer: ModelResolver).
+     * Config consumes them when resolving a chosen model id to its serving API.
+     */
+    setProviderModelLists(lists: ProviderModelLists): void;
+}
+declare function enabledRunners(cfg: IConfig): RunnerId[];
+
+/** True when a name belongs to a built-in runner and is therefore not installable. */
+declare function isReservedRunnerName(name: string): boolean;
+/** Clone seam: takes a validated URL and a destination, or throws. */
+type PluginCloneFn = (url: string, destDir: string) => void;
+declare class RunnerRegistry {
+    private plugins;
+    private store;
+    private clone;
+    constructor(store?: IPluginStore, clone?: PluginCloneFn);
+    private loadBuiltins;
+    loadUserPlugins(): void;
+    get(id: string): PluginEntry | undefined;
+    getManifest(id: string): RunnerPluginManifest | undefined;
+    list(): PluginEntry[];
+    listEnabled(config: IConfig): PluginEntry[];
+    listEnabledIds(config: IConfig): string[];
+    isBuiltIn(id: string): boolean;
+    installFromPath(sourcePath: string): RunnerPluginManifest;
+    installFromGit(url: string): RunnerPluginManifest;
+    /**
+     * The single destination-building step both install routes share: the name is
+     * constrained to a plain segment and the resolved destination is asserted to
+     * be inside the plugins directory before anything is copied.
+     */
+    private registerInstalled;
+    remove(name: string): void;
+    createSkeleton(name: string, outputDir: string): string;
+}
+
+interface ITerminalSession {
+    id: string;
+    taskId: string;
+    onOutput(callback: (text: string) => void): void;
+    onExit(callback: (code: number) => void): void;
+    kill(): void;
+    getOutput(): string;
+    write(text: string): void;
+    /**
+     * True when the session runs the agent as a raw-mode TUI (a real PTY for the
+     * VS Code terminal, a tmux window). Such a surface submits an input line on
+     * the Enter keystroke (`\r`), so a synchronized resume token terminated with
+     * `\n` only types the line and never sends it. A line-oriented piped session
+     * (`defaultInteractive = false`) leaves this false and accepts `\n`.
+     */
+    readonly interactive?: boolean;
+    /**
+     * Optional transport-level control channel: PTY resize requests for a session
+     * whose runner renders a TUI. Absent on transports without a resizable PTY
+     * (a plain piped subprocess); surfaces must feature-detect before calling.
+     */
+    writeControl?(text: string): void;
+}
+/**
+ * How Ordewell drives a task's runner (ADR-0018): through its screen and
+ * keyboard, or through its programmatic protocol.
+ */
+type RunnerTransport = 'terminal' | 'structured';
+declare function isRunnerTransport(value: unknown): value is RunnerTransport;
+/** How a structured turn ended. `failed` carries the agent's own words in the preceding `error` event. */
+type StructuredTurnEnd = 'completed' | 'interrupted' | 'failed';
+/**
+ * One normalized event from a structured task (ADR-0018, O1b): the adapter's
+ * events, with the turn made explicit at both ends and the message queue (M1)
+ * alongside. Subagent work carries its `subagentId`. The source for the
+ * full-fidelity task log, never for verdicts.
+ */
+type StructuredEvent = Exclude<AgentEvent, {
+    type: 'turn_end';
+} | {
+    type: 'permission_cancelled';
+}>
+/** `text` is the user message the turn answers; `messageId` is set when it had waited in the queue. */
+ | {
+    type: 'turn_start';
+    text: string;
+    messageId?: string;
+} | {
+    type: 'turn_end';
+    reason: StructuredTurnEnd;
+} | {
+    type: 'message_queued';
+    messageId: string;
+    text: string;
+} | {
+    type: 'message_removed';
+    messageId: string;
+}
+/** An open `permission_request` was answered, by whoever answered it (ADR-0018, A1). */
+ | {
+    type: 'permission_decided';
+    id: string;
+    decision: ApprovalDecision;
+}
+/** An open `permission_request` can no longer be answered: the runner withdrew it, or its process is gone. */
+ | {
+    type: 'permission_withdrawn';
+    id: string;
+};
+interface QueuedTaskMessage {
+    id: string;
+    text: string;
+}
+/**
+ * What a session driven over its runner's protocol can do that a terminal
+ * cannot (ADR-0018, S2). Optional: callers feature-detect it with
+ * {@link isStructuredSession}, and code that does not look behaves as it did.
+ */
+interface StructuredSessionCapability {
+    readonly transport: 'structured';
+    /** `working` while a turn runs; `idle` between turns, waiting for a message. */
+    turnState(): 'working' | 'idle';
+    onTurnEnd(listener: (reason: StructuredTurnEnd) => void): void;
+    onEvent(listener: (event: StructuredEvent) => void): void;
+    /**
+     * Queue a user message, delivered when the current turn ends — or at once
+     * when idle. Returns its id, for {@link removeQueued}.
+     */
+    sendMessage(text: string): string;
+    /** Take a message back before it is delivered. False when it already was. */
+    removeQueued(id: string): boolean;
+    /** Messages waiting for the current turn to end, oldest first. */
+    queued(): QueuedTaskMessage[];
+    /**
+     * Stop the running turn, keeping the session: a soft interrupt first, then —
+     * if the runner does not answer in time — kill and resume. Either way the
+     * turn ends `interrupted`. Resolves once it has.
+     */
+    interrupt(): Promise<void>;
+    /** The runner's own session id once announced — what a continue resumes (ADR-0018, K1). */
+    nativeSessionId(): string | null;
+    /**
+     * Answer a `permission_request` this session emitted, by its event id. False
+     * when it is no longer open — answered, withdrawn, or never asked.
+     */
+    answerPermission(id: string, decision: ApprovalDecision): boolean;
+}
+declare function isStructuredSession(session: ITerminalSession): session is ITerminalSession & StructuredSessionCapability;
+
+interface ITerminalRunner {
+    spawn(opts: {
+        taskId: string;
+        runner: string;
+        prompt: string;
+        modelId?: string;
+        thinkingEffort?: string;
+        modelVariants?: string[];
+        mode?: string;
+        headless?: boolean;
+        cwd: string;
+        registry?: RunnerRegistry;
+        /** Task order and title — surfaces use these to label task_started/output events. */
+        order?: number;
+        title?: string;
+        /**
+         * The owning plan session. Task ids are only unique within one plan, so
+         * transports that key OS resources by task (tmux windows, log files) need
+         * this to keep two plans' identically named tasks apart.
+         */
+        planSessionId?: string;
+        /**
+         * The workspace's own variables (ADR-0016), under the runner's: a
+         * manifest's env still wins over them.
+         */
+        env?: Record<string, string>;
+        /**
+         * The transport the plan asks for (ADR-0018, S1). A router decides per
+         * task whether the runner can honour it; any other runner ignores it.
+         */
+        transport?: RunnerTransport;
+        /**
+         * The runner's own session to continue in (ADR-0018, K1). Only the
+         * structured transport can honour it; a terminal session comes back fresh,
+         * which is why a continue refuses one.
+         */
+        resumeSessionId?: string;
+    }): Promise<ITerminalSession>;
+    stop(sessionId: string): void;
+    stopAll(): void;
+    activeCount: number;
+}
+
+interface UserStep {
+    order: number;
+    instruction: string;
+    completed: boolean;
+}
+/** One deterministic signal gathered while verifying a completed task. */
+interface VerificationCheck {
+    name: 'exit_code' | 'completion_marker' | 'manual';
+    passed: boolean;
+    /** A check that did not apply. Skipped checks don't affect the verdict. */
+    skipped: boolean;
+    detail: string;
+}
+/** Evidence-based verdict for a completed task. Single end-to-end outcome produced by verification. */
+interface Verdict {
+    outcome: 'pass' | 'fail';
+    reason: string;
+    checks: VerificationCheck[];
+    decidedAt: string;
+}
+interface TaskOutputSummary {
+    reviewReason: string;
+    logTail: string;
+    capturedAt: string;
+}
+type TaskType = 'ai' | 'user';
+type TaskStatus = 'pending' | 'approved' | 'in_progress' | 'completed' | 'failed' | 'blocked' | 'awaiting_user';
+type TaskMode = string;
+/**
+ * Why an `awaiting_user` task waits (ADR-0018, W1): a structured turn that
+ * ended without the done marker, a checkpoint question, or work that did not
+ * land. Saved, so no surface has to guess it from whether an attempt is live.
+ */
+type AwaitingReason = 'input' | 'checkpoint' | 'conflict';
+declare function isAwaitingReason(value: unknown): value is AwaitingReason;
+interface TaskModelAssignment {
+    modelId: string;
+    modelLabel: string;
+    thinkingEffort?: string;
+    /**
+     * All variant ids the model offered when this assignment was made. Carried
+     * on the assignment because runners need it at spawn time (opencode's TUI
+     * only honors an assigned variant when the others are config-disabled) and
+     * the discovery catalog isn't available there.
+     */
+    availableVariants?: string[];
+}
+type RunnerId = string;
+/**
+ * How a task's latest attempt was driven (ADR-0018). Recorded only when its
+ * plan asked for the structured transport, so a terminal plan's tasks carry
+ * nothing new.
+ */
+interface TaskTransport {
+    kind: RunnerTransport;
+    /** Why a plan that asked for structured ran this task on the terminal — never a silent downgrade (S3). */
+    fallback?: string;
+    /** The runner's own session id of a structured attempt, once it ends: what a continue resumes (K1). */
+    nativeSessionId?: string;
+}
+interface Task {
+    id: string;
+    order: number;
+    title: string;
+    description: string;
+    type: TaskType;
+    status: TaskStatus;
+    dependencies: string[];
+    prompt?: string;
+    userSteps?: UserStep[];
+    subtasks: Task[];
+    verdict?: Verdict;
+    outputSummary?: TaskOutputSummary;
+    assignedModel?: TaskModelAssignment;
+    assignedRunner: RunnerId;
+    thinkingEffort?: string;
+    taskMode?: TaskMode;
+    completionMarker: string;
+    autonomy?: 'AFK' | 'HITL';
+    sliceType?: 'HITL' | 'AFK';
+    userStoriesCovered?: string[];
+    transport?: TaskTransport;
+    /** Set only while `status` is `awaiting_user`, and not always then — a usage-limit pause has none. */
+    awaitingReason?: AwaitingReason;
+}
+interface DiscoveredMode {
+    id: string;
+    label: string;
+    description: string;
+}
+type ResearchToolType = 'read_file' | 'read_files' | 'glob' | 'grep' | 'find_symbol' | 'list_dir' | 'bash' | 'fetch' | 'web_search' | 'spawn_research_agent'
+/**
+ * A tool belonging to a harness planner's own toolbox (ADR-0009) that has no
+ * Ordewell equivalent — Edit, WebFetch, TodoWrite, whatever a coding agent
+ * ships next. The real name travels in `toolLabel` rather than being
+ * relabelled as a tool it is not; the union stays closed so the
+ * exhaustiveness checks in every surface's icon/label switch survive.
+ */
+ | 'agent_tool';
+/**
+ * What happened when a research tool call ran, for honest per-surface
+ * rendering. The broadcast seam carries this on every `research_step_done` so
+ * surfaces do not have to pattern-match refusal text to tell a refused `rm`
+ * from a successful `rm` — the old render path flipped a `✓` for both.
+ */
+type ResearchStepOutcome = 'success' | 'failure' | 'refused' | 'denied' | 'not_executed';
+interface ResearchStep {
+    id: string;
+    tool: ResearchToolType;
+    /** The tool's own name when it came from a harness planner — always set for `agent_tool`. */
+    toolLabel?: string;
+    args: string;
+    result: string;
+    success: boolean;
+    outcome: ResearchStepOutcome;
+    /** The model's tool_call id, so a surface can match `tool_result` to the
+     * pending `tool_call` it announced — robust under parallel same-tool rounds. */
+    toolCallId?: string;
+    /** The research subagent that ran the call, so a reload regroups it under that subagent. */
+    subagentId?: string;
+    timestamp: string;
+    thinkingText?: string;
+}
+interface UserPromptEntry {
+    id: string;
+    type: 'user_prompt' | 'system';
+    content: string;
+    timestamp: string;
+}
+type SubagentOutcome = 'done' | 'failed' | 'stopped';
+/**
+ * One subagent's whole run, logged when it finishes: what it was asked, how it
+ * ended and what it reported. Its steps stay separate entries carrying the same
+ * `subagentId`, so an older reader that knows only steps still shows them.
+ */
+interface SubagentLogEntry {
+    id: string;
+    type: 'subagent';
+    subagentId: string;
+    brief: string;
+    model?: string;
+    outcome: SubagentOutcome;
+    digest: string;
+    usage?: UsageTotals;
+    timestamp: string;
+}
+type ResearchLogEntry = ResearchStep | UserPromptEntry | SubagentLogEntry;
+interface ResearchProgress {
+    type: 'thinking' | 'tool_call' | 'tool_result' | 'plan_token' | 'interrupted' | 'liveness' | 'text_delta' | 'text_retracted' | 'usage' | 'subagent_started' | 'subagent_finished';
+    /** Minted by whoever runs the turn and passed through untouched; absent outside a turn. */
+    turnId?: string;
+    /** One continuous run of model text — text before a tool call is its own segment. */
+    segmentId?: string;
+    text?: string;
+    tool?: string;
+    /** Harness planners (ADR-0009): the agent's own name for a tool Ordewell has no member for. */
+    toolLabel?: string;
+    toolArgs?: string;
+    toolResult?: string;
+    planToken?: string;
+    step?: ResearchStep;
+    /** The model's tool_call id, threaded on tool_call and tool_result so a
+     * surface can match the result to its pending call — robust under parallel
+     * same-tool rounds where LIFO-by-name matching mislabels summaries. */
+    toolCallId?: string;
+    /** Present when this event originates from (or reports on) one spawned research subagent (issue #34). */
+    subagentId?: string;
+    record?: UsageRecord;
+    brief?: string;
+    model?: string;
+    outcome?: SubagentOutcome;
+    digest?: string;
+    usage?: UsageTotals;
+}
+interface ThinkingBlock {
+    id: string;
+    text: string;
+}
+interface StreamThinkingEvent {
+    type: 'thinking';
+    block: ThinkingBlock;
+}
+interface StreamStepEvent {
+    type: 'step';
+    step: ResearchStep;
+}
+type StreamEvent = StreamThinkingEvent | StreamStepEvent;
+interface DiscoveredModel {
+    modelId: string;
+    modelLabel: string;
+    runnerProvider?: string;
+    /**
+     * Human-facing provider name as the runner itself reports it (e.g.
+     * "OpenCode Zen" for `runnerProvider: 'opencode'`). Populated from the
+     * runner's own provider catalog when available; when absent the UI derives a
+     * label from `runnerProvider` by title-casing.
+     */
+    runnerProviderLabel?: string;
+    /**
+     * The runner whose catalog listed this model. Stamped once, at the single
+     * `ModelDiscovery.discover` choke point, so a flat cross-runner list can
+     * still say where each entry came from — `runnerProvider` alone cannot:
+     * OpenCode reports most of its catalog as `openrouter`, which names the
+     * serving backend, not the agent Ordewell would spawn.
+     */
+    runnerId?: string;
+    /** The runner's display name (`OpenCode`), from its manifest. */
+    runnerLabel?: string;
+    variants: {
+        id: string;
+        label: string;
+    }[];
+    /**
+     * The model's context window when the runner or catalog reports it (#49).
+     * Read by the planner-model lookup so context fill can be shown; absent when
+     * unknown rather than defaulted to zero.
+     */
+    contextWindow?: number;
+}
+type PlanStatus = 'draft' | 'approved' | 'rejected' | 'running' | 'completed';
+/**
+ * One entry of the planner's persisted dialogue (ADR-0002). The single source
+ * of truth for both UI redisplay and conversational context. Tool-call results
+ * are NOT stored here — they live in the AI service's tool-use history;
+ * `researchLog` remains the persisted tool trace for the UI.
+ */
+interface ConversationMessage {
+    role: 'user' | 'assistant';
+    content: string;
+    timestamp: string;
+    /**
+     * Timeline marker: 'plan_generated' records the point in the dialogue where
+     * the plan was committed (the UI anchors the plan card there on restore);
+     * 'system' is a host-injected notice; 'compaction' is the summary a
+     * user-triggered compaction left in place of the earlier messages — always
+     * the transcript's first entry. Absent for ordinary chat turns, so
+     * sessions saved before markers existed degrade gracefully.
+     */
+    kind?: 'plan_generated' | 'system' | 'compaction';
+}
+interface QueuedMessage {
+    id: string;
+    text: string;
+    timestamp: string;
+}
+interface PlanModificationWarnings {
+    deletedCompleted: string[];
+    changedCompleted: string[];
+    deletedInProgress: string[];
+    modifiedInProgress: string[];
+    brokenDependencies: string[];
+}
+declare function emptyWarnings(): PlanModificationWarnings;
+interface LegacyPlanState {
+    tasks: Task[];
+    generatedAt: string;
+    status: PlanStatus;
+    runners: RunnerId[];
+    lastUpdated: string;
+    researchLog?: ResearchLogEntry[];
+    /** The planner dialogue — user messages and assistant messages, in order (ADR-0002). */
+    conversationHistory?: ConversationMessage[];
+    /** Full markdown PRD once written by the planner (PRD mode), also saved to .scratch/<slug>/PRD.md. */
+    prdMarkdown?: string;
+    /** Follow-ups queued while tasks execute — applied as plan modifications between batches. */
+    queuedMessages?: QueuedMessage[];
+    /**
+     * The plan's isolation run (ADR-0013), written from the orchestrator at
+     * persist time and read back only when a saved plan is adopted. It names
+     * branches and worktrees that belong to this plan alone: a fork of the plan
+     * must leave it behind rather than share it.
+     */
+    isolation?: PlanIsolation;
+    /**
+     * The `runnerTransport` setting as the plan's latest run copied it when it
+     * started (ADR-0018, S1): the plan, not the live setting, says what runs.
+     */
+    runnerTransport?: RunnerTransport;
+    /** Kept so a reopened session shows the same token line (#49). */
+    plannerUsage?: PlannerUsage;
+}
+interface Message {
+    id: string;
+    role: 'user' | 'planner' | 'system';
+    content: string;
+    timestamp: number;
+}
+interface TaskSnapshot extends Task {
+    completedAt: number;
+    verdict?: Verdict;
+    retryCount: number;
+    finalized: boolean;
+}
+type PlanState = {
+    phase: 'planning';
+    history: Message[];
+    message: string;
+    pendingTasks: Task[];
+} | {
+    phase: 'executing';
+    history: Message[];
+    message: string;
+    executionLog: TaskSnapshot[];
+    pendingTasks: Task[];
+    goal: string;
+    runners: string[];
+    status: PlanStatus;
+};
+declare function migratePlanState(raw: unknown): PlanState;
+declare function migrateLegacyPlan(legacy: LegacyPlanState): PlanState;
+
+declare function createTask(overrides?: Partial<Task>): Task;
+declare function createEmptyPlan(): LegacyPlanState;
+declare function flattenTasks(tasks: readonly Task[]): Task[];
+/** A flattened task with the parent it hangs under, null for a top-level task. */
+interface TaskWithParent {
+    task: Task;
+    parent: Task | null;
+}
+declare function flattenTasksWithParents(tasks: readonly Task[]): TaskWithParent[];
+declare function migrateTask(task: Record<string, unknown>): Task;
+declare function addTaskToPlan(tasks: readonly Task[], partial: Partial<Task>): Task[];
+declare function removeTaskFromPlan(tasks: readonly Task[], taskId: string): Task[];
+declare function updateTaskInPlan(tasks: readonly Task[], taskId: string, changes: Partial<Task>): Task[];
+declare function renumberTasks(tasks: readonly Task[]): Task[];
+/**
+ * Lay a planner-written task list over the plan it rewrites without letting it
+ * change execution state. A planner restates tasks; it never witnessed one run,
+ * so the status it writes is not evidence. A settled task is kept exactly as
+ * it stands wherever the rewrite names it, and put back beside its old
+ * neighbour where the rewrite leaves it out. Every other task keeps the status
+ * it had; a task the rewrite adds starts pending.
+ */
+declare function keepExecutionState(current: readonly Task[], rewrite: Task[]): Task[];
+declare function validateModifiedPlan(original: Task[], modified: Task[]): PlanModificationWarnings;
+interface ActiveTaskSession {
+    id: string;
+    taskId: string;
+}
+interface ValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+interface ValidationContext {
+    executionLog: TaskSnapshot[];
+    oldPending: Task[];
+    newPending: Task[];
+    activeSessions: Map<string, ActiveTaskSession>;
+}
+type ValidationCheck = (ctx: ValidationContext) => ValidationResult;
+declare function warningsText(w: PlanModificationWarnings): string | null;
+
+export { type IsolationRun as $, AbstractRunner as A, type BlockingPrompt as B, CMD_EXE_MAX_COMMAND_LINE as C, DENY_ALL as D, EmbeddedNewlineError as E, type FetchAllProviderModelsOptions as F, HeadlessSession as G, HeadlessRunner as H, type IApproval as I, type IConfig as J, type IPluginStore as K, type ITerminalRunner as L, type ITerminalSession as M, type IWorktreeIsolation as N, type IntegrationDisposal as O, type IsolationAvailability as P, type IsolationHandoff as Q, type IsolationHandoffRepo as R, type IsolationInactiveReason as S, type IsolationLandedTask as T, type IsolationLanding as U, type IsolationMergeBlock as V, type IsolationMergeBlockReason as W, type IsolationMergeResult as X, type IsolationOutcome as Y, type IsolationPruneResult as Z, type IsolationRepo as _, AbstractTerminalSession as a, type TaskOutputSummary as a$, type IsolationTaskRecord as a0, type IsolationTaskRepo as a1, type IsolationTaskStatus as a2, type IsolationView as a3, type LaunchDeps as a4, type LaunchPlan as a5, type LegacyPlanState as a6, LineBuffer as a7, type Message as a8, ModelCatalog as a9, type ResearchLogEntry as aA, type ResearchProgress as aB, type ResearchStep as aC, type ResearchStepOutcome as aD, type ResearchToolType as aE, type ResolveContext as aF, type RunnerId as aG, type RunnerInvocation as aH, type RunnerPluginManifest as aI, RunnerRegistry as aJ, type RunnerSpawnOptions as aK, type RunnerTransport as aL, type StreamEvent as aM, type StreamStepEvent as aN, type StreamThinkingEvent as aO, type StructuredEvent as aP, type StructuredSessionCapability as aQ, type StructuredTurnEnd as aR, type SubagentLogEntry as aS, type SubagentOutcome as aT, type Task as aU, type TaskIsolation as aV, type TaskIsolationState as aW, type TaskMode as aX, type TaskModeAgentAdapter as aY, TaskModeUnsupportedError as aZ, type TaskModelAssignment as a_, type ModelShortcut as aa, ORCHESTRATOR_SHORTCUTS as ab, type OrchestratorOption as ac, type PlanIsolation as ad, type PlanModificationWarnings as ae, type PlanState as af, type PlanStatus as ag, type PlannerStartOptions as ah, type PlannerUsage as ai, type PluginCloneFn as aj, type PluginEntry as ak, type PluginFeatures as al, type PluginMode as am, type PluginModelDiscovery as an, type PluginRunnerDef as ao, type PreparedLaunch as ap, type PreparedTask as aq, type ProviderCredentialSource as ar, type ProviderModelLists as as, type ProviderModelsResult as at, type PtySize as au, type PtyWrapOptions as av, type QueuedMessage as aw, type QueuedTaskMessage as ax, type RepairEvidence as ay, type RepoGroupLayout as az, type ActiveTaskSession as b, type TaskRunnerFlags as b0, type TaskSnapshot as b1, type TaskStartOptions as b2, type TaskStatus as b3, type TaskTransport as b4, type TaskType as b5, type TaskWithParent as b6, type ThinkingBlock as b7, type UsageLine as b8, type UsageRecord as b9, isRunnerApproval as bA, isRunnerTransport as bB, isStructuredSession as bC, keepExecutionState as bD, knownModelId as bE, migrateLegacyPlan as bF, migratePlanState as bG, migrateTask as bH, partedPromptUsage as bI, planDirectLaunch as bJ, planShellLaunch as bK, plannerContextFill as bL, posixShellQuote as bM, removeTaskFromPlan as bN, renumberTasks as bO, resolveModelShortcut as bP, resolveProvider as bQ, stripAnsi as bR, toApprovalDecision as bS, toOrchestratorOptions as bT, updateTaskInPlan as bU, usageLine as bV, validateModifiedPlan as bW, warningsText as bX, windowsCommandLine as bY, wrapWithPty as bZ, type UsageTotals as ba, type UserPromptEntry as bb, type UserStep as bc, type ValidationCheck as bd, type ValidationContext as be, type ValidationResult as bf, type Verdict as bg, type VerificationCheck as bh, WINDOWS_MAX_COMMAND_LINE as bi, addPlannerUsage as bj, addTaskToPlan as bk, addUsage as bl, buildShellInvocation as bm, collectProviderCredentials as bn, createEmptyPlan as bo, createTask as bp, emptyWarnings as bq, enabledRunners as br, fetchAllProviderModels as bs, flattenTasks as bt, flattenTasksWithParents as bu, isAwaitingReason as bv, isExecutableResolved as bw, isGranted as bx, isMeasured as by, isReservedRunnerName as bz, type AgentAdapter as c, type AgentAdapterFactory as d, type AgentEvent as e, type AgentProcessDeps as f, type AgentStartOptions as g, type AiProvider as h, type AllProviderModels as i, type ApprovalAnswer as j, type ApprovalDecision as k, type ApprovalKind as l, type ApprovalMode as m, ApprovalPolicy as n, type ApprovalPolicyOptions as o, type ApprovalRequest as p, type ApprovalSource as q, type AwaitingReason as r, type CatalogModel as s, CommandLineTooLongError as t, type ConversationMessage as u, type DiscoveredMode as v, type DiscoveredModel as w, type DiscoveryCommand as x, ExecutableNotFoundError as y, type HeadlessRunnerDeps as z };