@ordewell/core 0.5.6 → 0.6.1

package/dist/index.d.ts

@@ -1,14 +1,14 @@
-import { aG as RunnerId, ag as PlanStatus, a6 as LegacyPlanState, I as IApproval, k as ApprovalDecision, p as ApprovalRequest, j as ApprovalAnswer, L as ITerminalRunner, J as IConfig, h as AiProvider, as as ProviderModelLists, m as ApprovalMode, X as IsolationMergeResult, T as IsolationLandedTask, N as IWorktreeIsolation, a2 as IsolationTaskStatus, ad as PlanIsolation, aL as RunnerTransport, az as RepoGroupLayout, M as ITerminalSession, w as DiscoveredModel, aU as Task, f as AgentProcessDeps, c as AgentAdapter, aB as ResearchProgress, aA as ResearchLogEntry, u as ConversationMessage, b9 as UsageRecord, b1 as TaskSnapshot, r as AwaitingReason, Q as IsolationHandoff, $ as IsolationRun, a0 as IsolationTaskRecord, aV as TaskIsolation, a3 as IsolationView, Y as IsolationOutcome, ay as RepairEvidence, bg as Verdict, aJ as RunnerRegistry, ax as QueuedTaskMessage, aw as QueuedMessage, b as ActiveTaskSession, ac as OrchestratorOption, aY as TaskModeAgentAdapter, g as AgentStartOptions, e as AgentEvent, aE as ResearchToolType, ai as PlannerUsage, n as ApprovalPolicy, af as PlanState, aH as RunnerInvocation, A as AbstractRunner, a as AbstractTerminalSession, aQ as StructuredSessionCapability, b2 as TaskStartOptions, aR as StructuredTurnEnd, aP as StructuredEvent, aK as RunnerSpawnOptions, K as IPluginStore, aI as RunnerPluginManifest, aF as ResolveContext } from './Task-Dyxp67s2.js';
-export { d as AgentAdapterFactory, i as AllProviderModels, l as ApprovalKind, o as ApprovalPolicyOptions, q as ApprovalSource, B as BlockingPrompt, C as CMD_EXE_MAX_COMMAND_LINE, s as CatalogModel, t as CommandLineTooLongError, D as DENY_ALL, v as DiscoveredMode, x as DiscoveryCommand, E as EmbeddedNewlineError, y as ExecutableNotFoundError, F as FetchAllProviderModelsOptions, H as HeadlessRunner, z as HeadlessRunnerDeps, G as HeadlessSession, O as IntegrationDisposal, P as IsolationAvailability, R as IsolationHandoffRepo, S as IsolationInactiveReason, U as IsolationLanding, V as IsolationMergeBlock, W as IsolationMergeBlockReason, Z as IsolationPruneResult, _ as IsolationRepo, a1 as IsolationTaskRepo, a4 as LaunchDeps, a5 as LaunchPlan, a7 as LineBuffer, a8 as Message, a9 as ModelCatalog, aa as ModelShortcut, ab as ORCHESTRATOR_SHORTCUTS, ae as PlanModificationWarnings, ah as PlannerStartOptions, aj as PluginCloneFn, ak as PluginEntry, al as PluginFeatures, am as PluginMode, an as PluginModelDiscovery, ao as PluginRunnerDef, ap as PreparedLaunch, aq as PreparedTask, ar as ProviderCredentialSource, at as ProviderModelsResult, au as PtySize, av as PtyWrapOptions, aC as ResearchStep, aD as ResearchStepOutcome, aM as StreamEvent, aN as StreamStepEvent, aO as StreamThinkingEvent, aS as SubagentLogEntry, aT as SubagentOutcome, aW as TaskIsolationState, aX as TaskMode, aZ as TaskModeUnsupportedError, a_ as TaskModelAssignment, a$ as TaskOutputSummary, b0 as TaskRunnerFlags, b3 as TaskStatus, b4 as TaskTransport, b5 as TaskType, b6 as TaskWithParent, b7 as ThinkingBlock, b8 as UsageLine, ba as UsageTotals, bb as UserPromptEntry, bc as UserStep, bd as ValidationCheck, be as ValidationContext, bf as ValidationResult, bh as VerificationCheck, bi as WINDOWS_MAX_COMMAND_LINE, bj as addPlannerUsage, bk as addTaskToPlan, bl as addUsage, bm as buildShellInvocation, bn as collectProviderCredentials, bo as createEmptyPlan, bp as createTask, bq as emptyWarnings, br as enabledRunners, bs as fetchAllProviderModels, bt as flattenTasks, bu as flattenTasksWithParents, bv as isAwaitingReason, bw as isExecutableResolved, bx as isGranted, by as isMeasured, bz as isReservedRunnerName, bA as isRunnerApproval, bB as isRunnerTransport, bC as isStructuredSession, bD as keepExecutionState, bE as knownModelId, bF as migrateLegacyPlan, bG as migratePlanState, bH as migrateTask, bI as partedPromptUsage, bJ as planDirectLaunch, bK as planShellLaunch, bL as plannerContextFill, bM as posixShellQuote, bN as removeTaskFromPlan, bO as renumberTasks, bP as resolveModelShortcut, bQ as resolveProvider, bR as stripAnsi, bS as toApprovalDecision, bT as toOrchestratorOptions, bU as updateTaskInPlan, bV as usageLine, bW as validateModifiedPlan, bX as warningsText, bY as windowsCommandLine, bZ as wrapWithPty } from './Task-Dyxp67s2.js';
-import { t as TaskOp, l as SessionBroadcaster, A as ApplyTaskOpsResult, m as SessionMessage, n as SessionNotice, r as TaskLogEvent } from './plan-utils-BMyEiDKv.js';
-export { a as ApprovalBlock, b as ApprovalStatus, C as CHECKPOINT_TRUNCATE_LENGTH, c as ConversationInput, d as ConversationView, D as DisplayBlock, E as EMPTY_CONVERSATION, e as EMPTY_HOLD, f as EMPTY_TASK_LOG, G as GatedConversation, L as LocalEntry, M as MessageBlock, g as MessageRole, N as NO_TURN, O as OutputPreview, P as PlanBlock, h as PlanMarkerStatus, i as PromptHold, S as SerializedPlan, j as SerializedTask, k as SerializedTaskStatus, o as SubagentBlock, p as SubagentChild, q as SubagentStatus, T as TakenPrompt, s as TaskLogView, u as TaskRef, v as ThinkingDisplayBlock, w as ToolBlock, x as ToolHeadline, y as ToolStatus, z as TurnGate, U as UsageBlock, B as aheadOfDraft, F as applyTaskOps, H as canMergeTasks, I as canSetDependencies, J as canSplitTask, K as capConflictFiles, Q as classifyOutcome, R as coalesceTaskLog, V as dependencyCandidates, W as dependentsOf, X as drainNext, Y as executionSummary, Z as followTurn, _ as fromTranscript, $ as hasHiddenDetail, a0 as holdPrompt, a1 as outputLines, a2 as outputPreview, a3 as parseTaskOpsJson, a4 as reduceConversation, a5 as reduceTaskLog, a6 as replayTaskLog, a7 as runnerToolSubject, a8 as serializePlan, a9 as serializeTask, aa as serializeTaskStatus, ab as stopTurn, ac as summarizeToolCall, ad as taskStartedNotice, ae as textHasTaskOps, af as toTaskLogEvent, ag as toolHeadline, ah as trimToolOutput, ai as truncateCheckpointSummary, aj as unsendAll, ak as unsendLatest } from './plan-utils-BMyEiDKv.js';
-import { I as IFileSystem, R as ReadFileOpts, T as ToolOutcome, b as GrepOptions, a as GlobOptions, F as FindSymbolOptions } from './IFileSystem-C0l-4MGT.js';
-export { G as GREP_DEFAULT_HEAD_LIMIT, c as GrepOutputMode, S as SEARCH_EXCLUSIONS } from './IFileSystem-C0l-4MGT.js';
-import { R as RunnerModeInfo } from './ModeResolver-CjpG5Wli.js';
-export { M as ManifestLookup, b as buildModeGuide, f as filteredBuildModes, r as resolveDefaultMode, a as resolveTaskMode, c as runnerModesFrom } from './ModeResolver-CjpG5Wli.js';
+import { aG as RunnerId, ag as PlanStatus, a6 as LegacyPlanState, I as IApproval, k as ApprovalDecision, p as ApprovalRequest, j as ApprovalAnswer, L as ITerminalRunner, J as IConfig, h as AiProvider, as as ProviderModelLists, m as ApprovalMode, X as IsolationMergeResult, T as IsolationLandedTask, N as IWorktreeIsolation, a2 as IsolationTaskStatus, ad as PlanIsolation, aL as RunnerTransport, az as RepoGroupLayout, M as ITerminalSession, w as DiscoveredModel, aU as Task, f as AgentProcessDeps, c as AgentAdapter, aB as ResearchProgress, aA as ResearchLogEntry, u as ConversationMessage, ba as UsageRecord, b1 as TaskSnapshot, r as AwaitingReason, Q as IsolationHandoff, $ as IsolationRun, a0 as IsolationTaskRecord, aV as TaskIsolation, a3 as IsolationView, Y as IsolationOutcome, ay as RepairEvidence, b8 as TreeSnapshot, bh as Verdict, aJ as RunnerRegistry, ax as QueuedTaskMessage, aw as QueuedMessage, b as ActiveTaskSession, ac as OrchestratorOption, aY as TaskModeAgentAdapter, g as AgentStartOptions, e as AgentEvent, aE as ResearchToolType, ai as PlannerUsage, n as ApprovalPolicy, af as PlanState, aH as RunnerInvocation, A as AbstractRunner, a as AbstractTerminalSession, aQ as StructuredSessionCapability, b2 as TaskStartOptions, aR as StructuredTurnEnd, aP as StructuredEvent, aK as RunnerSpawnOptions, K as IPluginStore, aI as RunnerPluginManifest, aF as ResolveContext, b0 as TaskRunnerFlags } from './Task-ib_U0YP7.js';
+export { d as AgentAdapterFactory, i as AllProviderModels, l as ApprovalKind, o as ApprovalPolicyOptions, q as ApprovalSource, B as BlockingPrompt, C as CMD_EXE_MAX_COMMAND_LINE, s as CatalogModel, t as CommandLineTooLongError, D as DENY_ALL, v as DiscoveredMode, x as DiscoveryCommand, E as EmbeddedNewlineError, y as ExecutableNotFoundError, F as FetchAllProviderModelsOptions, H as HeadlessRunner, z as HeadlessRunnerDeps, G as HeadlessSession, O as IntegrationDisposal, P as IsolationAvailability, R as IsolationHandoffRepo, S as IsolationInactiveReason, U as IsolationLanding, V as IsolationMergeBlock, W as IsolationMergeBlockReason, Z as IsolationPruneResult, _ as IsolationRepo, a1 as IsolationTaskRepo, a4 as LaunchDeps, a5 as LaunchPlan, a7 as LineBuffer, a8 as Message, a9 as ModelCatalog, aa as ModelShortcut, ab as ORCHESTRATOR_SHORTCUTS, ae as PlanModificationWarnings, ah as PlannerStartOptions, aj as PluginCloneFn, ak as PluginEntry, al as PluginFeatures, am as PluginMode, an as PluginModelDiscovery, ao as PluginRunnerDef, ap as PreparedLaunch, aq as PreparedTask, ar as ProviderCredentialSource, at as ProviderModelsResult, au as PtySize, av as PtyWrapOptions, aC as ResearchStep, aD as ResearchStepOutcome, aM as StreamEvent, aN as StreamStepEvent, aO as StreamThinkingEvent, aS as SubagentLogEntry, aT as SubagentOutcome, aW as TaskIsolationState, aX as TaskMode, aZ as TaskModeUnsupportedError, a_ as TaskModelAssignment, a$ as TaskOutputSummary, b3 as TaskStatus, b4 as TaskTransport, b5 as TaskType, b6 as TaskWithParent, b7 as ThinkingBlock, b9 as UsageLine, bb as UsageTotals, bc as UserPromptEntry, bd as UserStep, be as ValidationCheck, bf as ValidationContext, bg as ValidationResult, bi as VerificationCheck, bj as WINDOWS_MAX_COMMAND_LINE, bk as addPlannerUsage, bl as addTaskToPlan, bm as addUsage, bn as approvalScopes, bo as buildShellInvocation, bp as collectProviderCredentials, bq as createEmptyPlan, br as createTask, bs as emptyWarnings, bt as enabledRunners, bu as fetchAllProviderModels, bv as flattenTasks, bw as flattenTasksWithParents, bx as isAwaitingReason, by as isExecutableResolved, bz as isGranted, bA as isMeasured, bB as isReservedRunnerName, bC as isRunnerApproval, bD as isRunnerTransport, bE as isStructuredSession, bF as keepExecutionState, bG as knownModelId, bH as migrateLegacyPlan, bI as migratePlanState, bJ as migrateTask, bK as partedPromptUsage, bL as planDirectLaunch, bM as planShellLaunch, bN as plannerContextFill, bO as posixShellQuote, bP as removeTaskFromPlan, bQ as renumberTasks, bR as resolveModelShortcut, bS as resolveProvider, bT as stripAnsi, bU as toApprovalDecision, bV as toOrchestratorOptions, bW as updateTaskInPlan, bX as usageLine, bY as validateModifiedPlan, bZ as warningsText, b_ as windowsCommandLine, b$ as wrapWithPty } from './Task-ib_U0YP7.js';
+import { u as TaskOp, M as MergeGateView, m as SessionBroadcaster, A as ApplyTaskOpsResult, n as SessionMessage, o as SessionNotice, s as TaskLogEvent } from './plan-utils-DvHPzAfV.js';
+export { a as ApprovalBlock, b as ApprovalStatus, C as CHECKPOINT_TRUNCATE_LENGTH, c as ConversationInput, d as ConversationView, D as DisplayBlock, E as EMPTY_CONVERSATION, e as EMPTY_HOLD, f as EMPTY_TASK_LOG, G as GatedConversation, L as LocalEntry, g as MessageBlock, h as MessageRole, N as NO_TURN, O as OutputPreview, P as PlanBlock, i as PlanMarkerStatus, j as PromptHold, S as SerializedPlan, k as SerializedTask, l as SerializedTaskStatus, p as SubagentBlock, q as SubagentChild, r as SubagentStatus, T as TakenPrompt, t as TaskLogView, v as TaskRef, w as ThinkingDisplayBlock, x as ToolBlock, y as ToolHeadline, z as ToolStatus, B as TurnGate, U as UsageBlock, F as aheadOfDraft, H as applyTaskOps, I as canMergeTasks, J as canSetDependencies, K as canSplitTask, Q as capConflictFiles, R as classifyOutcome, V as coalesceTaskLog, W as dependencyCandidates, X as dependentsOf, Y as drainNext, Z as executionSummary, _ as followTurn, $ as fromTranscript, a0 as hasHiddenDetail, a1 as holdPrompt, a2 as outputLines, a3 as outputPreview, a4 as parseTaskOpsJson, a5 as reduceConversation, a6 as reduceTaskLog, a7 as replayTaskLog, a8 as runnerToolSubject, a9 as serializePlan, aa as serializeTask, ab as serializeTaskStatus, ac as stopTurn, ad as summarizeToolCall, ae as taskStartedNotice, af as textHasTaskOps, ag as toTaskLogEvent, ah as toolHeadline, ai as trimToolOutput, aj as truncateCheckpointSummary, ak as unsendAll, al as unsendLatest } from './plan-utils-DvHPzAfV.js';
+import { I as IFileSystem, R as ReadFileOpts, T as ToolOutcome, b as GrepOptions, a as GlobOptions, F as FindSymbolOptions } from './IFileSystem-DuEiG_kA.js';
+export { G as GREP_DEFAULT_HEAD_LIMIT, c as GrepOutputMode, S as SEARCH_EXCLUSIONS } from './IFileSystem-DuEiG_kA.js';
+import { R as RunnerModeInfo } from './ModeResolver-DXxV4n_V.js';
+export { M as ManifestLookup, a as autonomyLevelLabel, b as buildModeGuide, f as filteredBuildModes, p as parseAutonomyLevel, r as resolveDefaultMode, c as resolveTaskMode, d as runnerModesFrom } from './ModeResolver-DXxV4n_V.js';
 import { ChildProcess } from 'child_process';
-import { b as PlanParseError } from './parsing-EcmCsF1y.js';
-export { P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, T as TASK_OPS_ENVELOPE_KEY, c as TASK_QUERY_ENVELOPE_KEY, d as checkDepsResolve, e as checkImmutableLog, f as checkInProgress, g as checkNoCycles, h as checkUniqueIds, i as escapeControlCharsInStrings, j as extractJsonObject, k as extractObjectWithBalance, l as extractObjectsWithKey, m as looksLikePlanAttempt, o as opensWithJsonObject, p as parsePartialPlan, n as parsePlanJson, s as stripModelNoise, q as stripTrailingCommas, v as validatePlanModification } from './parsing-EcmCsF1y.js';
+import { b as PlanParseError } from './parsing-C8Z22twN.js';
+export { P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, T as TASK_OPS_ENVELOPE_KEY, c as TASK_QUERY_ENVELOPE_KEY, d as checkDepsResolve, e as checkImmutableLog, f as checkInProgress, g as checkNoCycles, h as checkUniqueIds, i as escapeControlCharsInStrings, j as extractJsonObject, k as extractObjectWithBalance, l as extractObjectsWithKey, m as looksLikePlanAttempt, o as opensWithJsonObject, p as parsePartialPlan, n as parsePlanJson, s as stripModelNoise, q as stripTrailingCommas, v as validatePlanModification } from './parsing-C8Z22twN.js';
 export { resolveOrderLabel, taskOrderLabel } from './order-labels.js';
 import 'events';
 
@@ -261,16 +261,19 @@ declare abstract class BaseFileSystem implements IFileSystem {
      * Path confinement for `bash`: an `auto`-tier binary (`cat`, `find`, `rg`, …)
      * is only auto because *reading* is read-only — its arguments can still
      * name a path outside the workspace, which is the exact escape confinement
-     * closes for `readFile`/`glob`/`grep`. Each escaping path needs its own
-     * approval (scoped to its containing directory); approving one does not
-     * approve another, so a single command touching two external dirs prompts
-     * once per distinct scope rather than carrying the first grant to the rest.
+     * closes for `readFile`/`glob`/`grep`. Each escaping path is scoped to its
+     * containing directory, one entry per distinct scope.
      */
-    private authorizeCommandPaths;
+    private outsidePaths;
     /**
      * Three tiers (see `commandPolicy.ts`): read-only inspection runs silently,
      * anything else asks once and is remembered, and writes are refused outright
      * because a planner that mutates the workspace has stopped being a planner.
+     *
+     * Everything a command needs — its own approval and every outside directory
+     * it touches — is one request, so one command is one prompt. Each scope is
+     * still granted separately: approving the pair does not approve another
+     * directory the next command names.
      */
     bash(command: string, signal?: AbortSignal): Promise<ToolOutcome>;
 }
@@ -698,8 +701,8 @@ interface UserSettings {
      */
     enabledRunners?: string[];
     /**
-     * How tasks' runners are driven (ADR-0018). Experimental; a run copies it
-     * onto its plan when it starts, so a change applies from the next run.
+     * How tasks' runners are driven (ADR-0018). A run copies it onto its plan
+     * when it starts, so a change applies from the next run.
      */
     runnerTransport: RunnerTransport;
 }
@@ -718,6 +721,12 @@ declare class SettingsService {
     private filePath;
     private cache;
     private cachedMtimeMs;
+    /**
+     * Whether the transport on disk (or just set) is the user's own choice.
+     * Writing the default back out would turn it into one, and a later change of
+     * default would then never reach this user.
+     */
+    private transportChosen;
     constructor(filePath?: string);
     getAll(): UserSettings;
     private fileMtimeMs;
@@ -1341,6 +1350,8 @@ declare class PlanStore {
     private _planTasks;
     private _allTasks;
     private _taskMap;
+    /** Task id → the top-level task it hangs under, itself for a top-level task. */
+    private _rootMap;
     private _planRunners;
     private _onMutate;
     private _executionLog;
@@ -1356,6 +1367,11 @@ declare class PlanStore {
     isCompleted(id: string): boolean;
     isFailed(id: string): boolean;
     get(taskId: string): Readonly<Task> | undefined;
+    /**
+     * Whether a task runs as an ops task (ADR-0020). Only a top-level AI task
+     * can be one; a subtask runs with the top-level task it hangs under.
+     */
+    isOps(taskId: string): boolean;
     /** A copy of the task tree, detached from the store: later status changes do not reach it. */
     snapshot(): Task[];
     getExecutionLog(): ReadonlyArray<TaskSnapshot>;
@@ -1392,6 +1408,8 @@ declare class PlanStore {
     markAwaitingUser(id: string, reason?: AwaitingReason): void;
     markPending(id: string): void;
     retry(id: string): void;
+    /** Kept on the task: it was force-started past its merge gate, before these dependencies' work was merged (ADR-0020). */
+    setForcedPastGate(id: string, dependencies: string[]): void;
     /** A reason outlives nothing: any status but `awaiting_user` drops it. */
     private setStatus;
     blockDependents(id: string): void;
@@ -1431,6 +1449,7 @@ interface IsolationRunListener {
     /**
      * A run opened — the one moment shared by Execute, a manual task run and
      * a force start, so whatever a run pins for its whole length is read here.
+     * Whether it isolates is decided later, at its first change task.
      */
     opened(): void;
     /** A run did not start: `repos` of the group have tracked changes. */
@@ -1453,12 +1472,13 @@ interface IsolationRunControllerDeps {
     listener: IsolationRunListener;
 }
 /**
- * The lifecycle of a plan's isolation run (ADR-0013, ADR-0014), between the
- * scheduler and the git layer: deciding at a run's start whether it executes
- * in worktrees, a blocked run and how it goes on, each attempt's working
- * directory, releasing worktrees, the handoff when the run closes, and what the
- * user does with it afterwards. The record it keeps outlives one run — a
- * resumed plan continues it.
+ * The lifecycle of a plan's isolation run (ADR-0013, ADR-0014, ADR-0020),
+ * between the scheduler and the git layer: deciding, at a run's first change
+ * task, whether it executes in worktrees, a blocked run and how it goes on,
+ * each attempt's working directory, releasing worktrees, which landed work the
+ * user has merged, the tree check of an ops task, the handoff when the run
+ * closes, and what the user does with it afterwards. The record it keeps
+ * outlives one run — a resumed plan continues it.
  */
 declare class IsolationRunController {
     private readonly isolation;
@@ -1470,9 +1490,9 @@ declare class IsolationRunController {
     /** Copied paths already reported for the current run: every task gets the same copies. */
     private reportedCopies;
     /**
-     * How the open run executes; null while no run is open. A run is one
-     * Execute-Plan or one manual task run, from its start until it settles or
-     * is stopped.
+     * How the open run executes; null while no run is open, `undecided` until
+     * its first change task asks. A run is one Execute-Plan or one manual task
+     * run, from its start until it settles or is stopped.
      */
     private mode;
     /** Resolver task id → the conflicted task it resolves; see {@link linkResolver}. */
@@ -1486,6 +1506,8 @@ declare class IsolationRunController {
     /** The plan's run record, open or not; null when the plan has not isolated. */
     get current(): IsolationRun | null;
     get isOpen(): boolean;
+    /** The open run has decided whether it isolates. */
+    get decided(): boolean;
     /** The open run executes in worktrees. */
     get isolating(): boolean;
     /** A run is waiting on the user to stash or to go on without isolation. */
@@ -1509,12 +1531,15 @@ declare class IsolationRunController {
      * would otherwise write a new session file on every reload.
      */
     adopt(state: PlanIsolation | null): Promise<void>;
+    /** Open a run if none is, leaving whether it isolates to its first change task. */
+    open(): void;
     /**
-     * Open a run if none is: decide once, at its start, whether it executes in
-     * worktrees. `resume` is what a dirty tree parks until the user chooses how
-     * to go on. Resolves false when the run did not start.
+     * Decide once per run, as its first change task starts, whether it executes
+     * in worktrees (ADR-0020): an ops task needs none, so a run of only ops
+     * tasks never asks. `resume` is what a dirty tree parks until the user
+     * chooses how to go on. Resolves false while the run waits on that choice.
      */
-    open(resume: () => Promise<void>): Promise<boolean>;
+    decide(resume: () => Promise<void>): Promise<boolean>;
     /**
      * Whether the run in force, or else the next one, gives each task its own
      * worktrees, and of which repo group — what the planner is told, since it
@@ -1541,6 +1566,7 @@ declare class IsolationRunController {
      */
     attemptCwd(task: Task, opts: {
         repair: boolean;
+        ops?: boolean;
     }): Promise<{
         cwd: string;
         worktree: boolean;
@@ -1562,8 +1588,33 @@ declare class IsolationRunController {
     release(taskId: string, opts: {
         keep: boolean;
     }, landing?: Promise<unknown> | null): Promise<void>;
-    /** Close the open run. An isolated one hands its integration branch over for review. */
+    /**
+     * Close the open run. An isolated one hands its integration branch over for
+     * review — unless the user merged everything it landed at merge gates
+     * already, which leaves nothing to hand over, so it is cleared up as a Merge
+     * all would have.
+     */
     close(): Promise<void>;
+    /**
+     * Whether a task's landed work still waits to be merged into the user's
+     * branch — what holds an ops or user task at its merge gate (ADR-0020). A
+     * task with no record never landed anything to wait for.
+     */
+    awaitsMerge(taskId: string): boolean;
+    /**
+     * Look again for landed work the user has merged — by Merge all, or by hand
+     * with git. Resolves true when some was found.
+     */
+    refreshInHead(): Promise<boolean>;
+    /**
+     * The tracked state of the workspace as an ops task starts, for
+     * {@link filesChangedSince} (ADR-0020). Null where the check does not run:
+     * a run that shares the workspace root, where every task's edits land in
+     * it, or a workspace git cannot isolate at all.
+     */
+    snapshotWorkspace(): Promise<TreeSnapshot | null>;
+    /** Tracked files changed since `snapshot`; none when the run has since gone on in the workspace root. */
+    filesChangedSince(snapshot: TreeSnapshot | null): Promise<string[]>;
     /**
      * A stop or a plan load: the open run ends without a handoff and a parked
      * start is dropped. `keepOpen` spares a run the scheduler is still driving.
@@ -1582,9 +1633,11 @@ declare class IsolationRunController {
     reviewDiff(): Promise<string>;
     /**
      * "Merge all": the run's integration branches into whatever the user has
-     * checked out, in every repo or none. Once everything merged, the run has
-     * nothing left to hand over, so it is cleared up and forgotten; a branch
-     * the user's HEAD somehow does not contain stays for the next run's sweep.
+     * checked out, in every repo or none. During a run it merges what has
+     * landed so far and the run goes on (ADR-0020): its branches stay for the
+     * tasks still to land. Once a settled run merged everything, it has nothing
+     * left to hand over, so it is cleared up and forgotten; a branch the user's
+     * HEAD somehow does not contain stays for the next run's sweep.
      */
     merge(): Promise<IsolationMergeResult>;
     /** Worktrees and task branches go; the integration branch and the record stay for review and merge. */
@@ -1593,7 +1646,7 @@ declare class IsolationRunController {
     discard(): Promise<void>;
     private clearMerged;
     private forget;
-    private decide;
+    private assess;
     private activate;
     private begin;
     /** What earlier runs left merged in the group goes; a failure here is worth a word, never a stopped run. */
@@ -1890,6 +1943,10 @@ declare class TaskOrchestrator {
      * pending and nothing ran until the user also re-ran the whole plan.
      */
     private haltedByFailure;
+    /** A Merge all is under way: no ops task starts until it ends (ADR-0020). */
+    private merging;
+    /** The last "waiting for Merge all" notice, so a run paused at a gate says it once, not on every tick. */
+    private gateNotice;
     /** The workspace's own variables for a task's cwd (ADR-0016); swapped out in tests. */
     private workspaceEnv;
     /** What the workspace env has already warned about, so a run says it once, not per task. */
@@ -1997,8 +2054,26 @@ declare class TaskOrchestrator {
      */
     adoptIsolation(state: PlanIsolation | null): Promise<void>;
     reviewRunDiff(): Promise<string>;
-    /** "Merge all"; a run that merged everything is cleared up and forgotten. */
+    /**
+     * "Merge all"; a settled run that merged everything is cleared up and
+     * forgotten. During a run it merges what has landed and the run goes on:
+     * the tasks waiting at a merge gate for that work then start (ADR-0020).
+     * Never while an ops task runs, and no ops task starts until it ends — the
+     * one overlap the plan cannot order, because the merge is the user's.
+     */
     mergeRun(): Promise<IsolationMergeResult>;
+    /**
+     * The run as a surface offers Merge all mid-run (ADR-0020): what has landed
+     * and is not merged, and whether the run is paused at its gates with nothing
+     * else running. Null while no task waits at a gate.
+     */
+    mergeGateView(): MergeGateView | null;
+    /**
+     * The dependencies an ops or user task waits on at its merge gate: those
+     * whose landed work is not in the user's branch yet (ADR-0020). Empty once
+     * the task has started, and for every other task.
+     */
+    getMergeGate(taskId: string): string[];
     /** Worktrees and task branches go; the integration branch and the record stay for review and merge. */
     cleanupRun(): Promise<void>;
     /** The run and everything it made go, and the plan forgets it; the next run starts afresh. */
@@ -2068,6 +2143,14 @@ declare class TaskOrchestrator {
     linkConflictResolver(resolverId: string, conflictedId: string): void;
     private landResolved;
     getReadyTasks(): Task[];
+    private readiness;
+    /**
+     * Open the run a task starts in, and for a change task decide whether it
+     * isolates (ADR-0020): an ops task needs no worktree, so it never waits on
+     * that choice. False while a dirty tree waits on the user; `resume` is what
+     * their choice replays.
+     */
+    private openFor;
     /**
      * Cancel a running (or scheduled) task: kill its session and return it to
      * 'pending' — "not executed". The task is put on hold so the scheduler
@@ -2117,6 +2200,13 @@ declare class TaskOrchestrator {
      * No-op if the task is unknown, not an AI task, or already running.
      */
     forceStartTask(taskId: string): Promise<void>;
+    private refuseOpsDuringMerge;
+    /**
+     * A force start passes a merge gate (ADR-0020), and the surface confirmed it
+     * first; the choice is kept on the task and said, because the work it acts
+     * on is not in the user's branch.
+     */
+    private notePastGate;
     /**
      * Run exactly one task outside full-plan scheduling. The active/starting
      * session still contributes to {@link hasLiveWork} so every surface exposes
@@ -2139,6 +2229,11 @@ declare class TaskOrchestrator {
         parallelGroups: number[][];
     };
     tick(): Promise<void>;
+    /**
+     * A run paused at merge gates says so, as plainly as a task that waits on
+     * the user: which tasks wait, and that Merge all lets them go on (ADR-0020).
+     */
+    private sayGate;
     private startTask;
     /**
      * The fallible half of starting a task: resolving its cwd/worktree and
@@ -2568,6 +2663,8 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     private betweenTurns;
     /** Set once a turn has ended: after that, out-of-turn events are stale, not startup. */
     private hadTurn;
+    /** A task's session, which wants what the agent says on its own after a turn closed; a planner registers none and drops it. */
+    private outOfTurnListener;
     private disposed;
     /** Resolves when the process ends, so a handshake can lose the race instead of waiting out its timeout. */
     protected processEnded: Promise<void>;
@@ -2590,6 +2687,7 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     protected handshake(_opts: AgentStartOptions): Promise<void>;
     start(opts: AgentStartOptions): Promise<void>;
     send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal, onActivity?: () => void): Promise<void>;
+    onOutOfTurn(listener: (event: AgentEvent) => void): void;
     nativeSessionId(): string | null;
     onProcessExit(listener: (code: number) => void): void;
     dispose(): void;
@@ -2639,6 +2737,18 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     private readonly openSubagents;
     /** Subagent messages already counted. A message arrives as one line per content block, each repeating its usage. */
     private readonly countedSubagentMessages;
+    /** Background tasks (shells, agents) the CLI reports as still running, as of its last `background_tasks_changed`. */
+    private backgroundTaskCount;
+    /**
+     * A task's turn whose `result` arrived while background work was still open.
+     * The CLI reports that result when the model stops talking, then opens a turn
+     * of its own when the work finishes; a turn ended at the first result would
+     * lose everything said after it, the completion marker included.
+     */
+    private resultHeld;
+    private followOnTimer;
+    /** The mode a task asked for, to hold the CLI to it once its `init` says what it started in. */
+    private requestedMode;
     /** The session `--resume` asked for, until the CLI's `init` shows it was taken up. */
     private pendingResume;
     protected spawnSpec(opts: AgentStartOptions): SpawnSpec;
@@ -2672,8 +2782,18 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
      * a grant of Ordewell's making.
      */
     answerPermission(id: string, decision: ApprovalDecision): boolean;
+    dispose(): void;
+    private clearFollowOnTimer;
     protected turnPayload(message: string): string;
     protected handleLine(line: string, emit: (event: AgentEvent) => void): void;
+    /**
+     * `--permission-mode auto` on a model or account without auto mode is not
+     * refused: the CLI says nothing and starts in `default`, then asks about every
+     * write — a request nobody is there to answer. The plan, not the CLI, decides
+     * the mode (ADR-0001), so a different one fails the turn rather than running.
+     */
+    private refuseOtherMode;
+    private awaitFollowOnTurn;
     private startSubagent;
     /**
      * A subagent's messages do not stream, so each line's usage is the snapshot
@@ -2706,8 +2826,10 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
 }
 
 /**
- * Codex as a planner, over its `app-server` stdio JSON-RPC transport
- * (ADR-0009).
+ * Codex as a planner (ADR-0009) and as a task's runner (ADR-0018, #54), over
+ * its `app-server` stdio JSON-RPC transport. The start switch decides the
+ * thread's settings and who answers its requests; everything a turn reports
+ * is read the same way for both.
  *
  * Ordewell already speaks a slice of this protocol — `ModelDiscovery` drives
  * `initialize` → `model/list` to build the Codex model catalog — so the
@@ -2719,7 +2841,7 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
  * version that renames them will surface as a visible dead turn rather than a
  * hang, because the base class watches the process as well as the protocol.
  */
-declare class CodexAdapter extends StdioAgentAdapter {
+declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAdapter {
     readonly agentId = "codex";
     private threadId;
     /** The model Codex opened the thread with — usage records name it. */
@@ -2730,6 +2852,28 @@ declare class CodexAdapter extends StdioAgentAdapter {
     private startOpts;
     /** Whether this turn has already emitted prose — see the `agentMessage` case. */
     private turnHasText;
+    /**
+     * The turn in flight. Its id arrives with `turn/started` or the `turn/start`
+     * response, whichever lands first; `turn/interrupt` cannot be sent without it.
+     */
+    private turn;
+    /** The JSON-RPC id of the `turn/start` that opened {@link turn}. */
+    private turnRequestId;
+    /** The last turn this adapter ended — so its second end signal, landing late, ends nothing. */
+    private endedTurnId;
+    /** An interrupt was asked for during this turn, so however it ends, it was cut short. */
+    private interruptRequested;
+    /** An interrupt asked for before Codex named the turn, sent once it does. */
+    private interruptOnStart;
+    /** A task's approval requests still waiting for an answer, by the request id as a string. */
+    private readonly openPermissions;
+    /**
+     * The files each in-flight `fileChange` item touches. Its approval request
+     * names only the item, and a person deciding needs to see the files.
+     */
+    private readonly fileChangePaths;
+    /** Requests this adapter sent and awaits an answer to, by JSON-RPC id. */
+    private readonly pendingRequests;
     private resumeAttempted;
     private resumeFallbackSent;
     private sandbox;
@@ -2739,26 +2883,43 @@ declare class CodexAdapter extends StdioAgentAdapter {
      * one stream; the thread id is what tells them apart (see {@link subagentOf}).
      */
     private readonly subagents;
-    /** Codex only plans for now (#54): its tasks stay on the terminal transport. */
-    start(opts: AgentStartOptions): Promise<void>;
     protected spawnSpec(opts: AgentStartOptions): SpawnSpec;
     /**
-     * `initialize`, then `thread/start`, both before the first user message. The
-     * thread is pinned to the read-only sandbox with approvals set to `never` —
-     * with nobody watching a planner's prompts, "ask" would mean "hang", which is
-     * ADR-0008's absent-is-denial invariant kept by construction.
+     * `initialize`, then `thread/start`, both before the first user message. A
+     * planner's thread is pinned to the read-only sandbox with approvals set to
+     * `never` — with nobody watching a planner's prompts, "ask" would mean
+     * "hang", which is ADR-0008's absent-is-denial invariant kept by
+     * construction. A task's runs as its mode says (see {@link threadParams}).
      */
     protected handshake(opts: AgentStartOptions): Promise<void>;
     /**
-     * Open the thread this session plans in. A resume id means the previous
+     * Open this session's thread. A resume id means the previous
      * process died mid-session: `thread/resume` puts the agent back in front of
-     * the context it already paid to read. A failed resume is not an error — the
-     * response handler falls back to a fresh thread, which is the same
-     * degradation `restoreChat` performs on every surface (T4).
+     * the context it already paid to read. A planner's failed resume is not an
+     * error — the response handler falls back to a fresh thread, which is the
+     * same degradation `restoreChat` performs on every surface (T4). A task's
+     * is: Continue (K1) offers the session that did the work, and a fresh thread
+     * in its place would pretend it was resumed.
      */
     private startThread;
+    private threadParams;
+    private effort;
+    /**
+     * `turn/interrupt` names the turn as well as the thread, so an interrupt
+     * asked for before Codex has named the turn waits for it. Codex acknowledges
+     * with an empty result, then ends the turn as `interrupted`.
+     */
+    interrupt(timeoutMs: number): Promise<boolean>;
+    /**
+     * Answer an open approval in its own result schema. Codex's decline carries
+     * no message, so a deny note reaches the agent as input steered into the
+     * running turn.
+     */
+    answerPermission(id: string, decision: ApprovalDecision): boolean;
     protected turnPayload(message: string): string;
     protected handleLine(line: string, emit: (event: AgentEvent) => void): void;
+    private turnStarted;
+    private closeTurn;
     /**
      * The child thread id when `threadId` names a subagent's thread, or undefined
      * for the planner's own. Codex replays both threads on one stream and only
@@ -2779,6 +2940,14 @@ declare class CodexAdapter extends StdioAgentAdapter {
      * not added a second time. Codex reports no price.
      */
     private emitUsage;
+    /**
+     * A task's server→client request. An approval stays open for someone to
+     * answer (ADR-0018, A1); everything else is answered at once, because an
+     * unanswered request stalls the turn forever.
+     */
+    private openTaskRequest;
+    /** The request as a person sees it, led by the field that says what it is about. */
+    private approvalInput;
     /**
      * Refuse one server→client request. Requests whose result schema can express
      * a refusal get that payload; everything else — a permission grant, a
@@ -2804,7 +2973,8 @@ declare class CodexAdapter extends StdioAgentAdapter {
 }
 
 /**
- * OpenCode as a planner, over its headless HTTP server (ADR-0009).
+ * OpenCode as a planner or a task runner, over its headless HTTP server
+ * (ADR-0009, ADR-0018).
  *
  * The odd one out: `opencode serve` is a real server rather than a stdio
  * protocol, so this adapter owns both halves of the boundary — it spawns the
@@ -2812,31 +2982,80 @@ declare class CodexAdapter extends StdioAgentAdapter {
  * talks to it through the injected `fetch`. Both are part of the one seam the
  * tests drive.
  *
- * The turn ends when the message POST resolves, and its response is the
+ * A planner turn ends when the message POST resolves, and its response is the
  * authoritative copy of the reply's last message. Everything else — reply text
  * as it streams, earlier model calls' text and reasoning, per-call usage, the
  * subagents a `task` call runs — arrives only on the server's `/event` channel.
  * An event name that changes between OpenCode versions therefore costs that
- * detail, never the final reply.
+ * detail, never the final reply. A task turn is posted asynchronously and read
+ * entirely from the stream — see {@link sendTask}.
  */
-declare class OpenCodeAdapter implements AgentAdapter {
+declare class OpenCodeAdapter implements TaskModeAgentAdapter {
     private deps;
     readonly agentId = "opencode";
     private process;
     private baseUrl;
+    /** Sent on every request to a task's server, which a per-task password secures. */
+    private authorization;
     private sessionId;
     private stderrTail;
     private exited;
+    private exitCode;
     private disposed;
-    private opts;
+    private markEnded;
+    private readonly processEnded;
+    private planner;
+    private task;
     /** Whether this turn has already emitted reply text — see {@link emitPart}. */
     private turnHasText;
     /** The last assistant message already settled — the baseline {@link recoverReply} measures a new reply against. */
     private lastAssistantId;
+    private taskTurn;
+    /** An abort was posted during the current task turn, so the idle that follows ends it as interrupted. */
+    private interruptRequested;
+    /** A task's requests waiting for an answer, by request id, with the session that asked. */
+    private readonly openPermissions;
     constructor(deps: AgentProcessDeps);
-    /** OpenCode only plans for now (#55): its tasks stay on the terminal transport. */
-    start(options: AgentStartOptions): Promise<void>;
+    start(opts: AgentStartOptions): Promise<void>;
     send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal, onActivity?: () => void): Promise<void>;
+    /**
+     * One task turn. `prompt_async` only queues the work, so the turn is over
+     * when the session goes idle — OpenCode's own `run` rules: an idle frame
+     * counts once `/session/status` confirms it, because a late idle can belong
+     * to the turn before, and {@link pollStatus} stands behind the stream,
+     * which can miss a status frame. No request is held open for the turn, so
+     * fetch's 300s header timeout, the planner's reason for
+     * {@link recoverReply}, never applies.
+     */
+    private sendTask;
+    /**
+     * Whatever of the turn's own messages the stream missed. Each part is
+     * emitted once, so a turn the stream saw whole adds nothing here; one that
+     * lost its last text part still reaches the plain-text channel, where the
+     * done marker is looked for.
+     */
+    private readBack;
+    /**
+     * The stream can drop a status frame while still delivering the rest, so a
+     * task turn also reads the status itself. A busy session is this turn's own
+     * work as surely as a frame is.
+     */
+    private pollStatus;
+    /** An idle frame ends the turn only if the server agrees now. When it will not say, the frame is trusted, as upstream trusts it. */
+    private confirmIdle;
+    /** Whether the task's session is working, or null when the server will not say. A session absent from the map is idle. */
+    private sessionBusy;
+    /** What a frame of the task's own session says about the turn's end. */
+    private followTaskTurn;
+    /**
+     * Abort the running turn, keeping the server and its session. OpenCode
+     * acknowledges by going idle, which is also what ends the turn — as
+     * interrupted, because the request is remembered.
+     */
+    interrupt(timeoutMs: number): Promise<boolean>;
+    onProcessExit(listener: (code: number) => void): void;
+    answerPermission(id: string, decision: ApprovalDecision): boolean;
+    private role;
     /**
      * Turn one settled assistant message into events. The settled response is
      * authoritative: it names the assistant message, so its parts are the ones
@@ -2905,6 +3124,27 @@ declare class OpenCodeAdapter implements AgentAdapter {
      * shows the planner reaching for something it may not have.
      */
     private denyPermission;
+    /**
+     * A task's request. Under a mode whose manifest sets `approvals: auto` —
+     * `build`, which the terminal transport runs with `--auto` — it is answered
+     * at once with what `run --auto` answers, so the same plan behaves the same
+     * on both transports (ADR-0001), and announced already decided so the log
+     * still shows it. Any other mode leaves it open for an approval card.
+     */
+    private askPermission;
+    /**
+     * `POST /permission/:id/reply` is the current answer. The per-session path
+     * it replaced is tried only when a server too old to know the new one 404s.
+     */
+    private replyPermission;
+    /**
+     * Open `/event` for one turn and wait until it is connected. The stream
+     * stopped being best-effort the moment permission answers moved onto it: a
+     * request raised before we connect is one nobody answers, and the turn
+     * hangs on it. Waiting is bounded so a server that never opens `/event`
+     * still gets its turn.
+     */
+    private openStream;
     /**
      * Server-sent events from `/event`: the turn's live text, reasoning, tool
      * activity and usage, and the only channel permission requests arrive on —
@@ -2912,6 +3152,8 @@ declare class OpenCodeAdapter implements AgentAdapter {
      */
     private streamEvents;
     private json;
+    private request;
+    private headers;
     nativeSessionId(): string | null;
     dispose(): void;
     private exitMessage;
@@ -3301,7 +3543,7 @@ interface SessionEventRelayDeps {
     /** Where isolation notices go, for a host whose notifications are not seen by the user. */
     onNotice?: (notice: SessionNotice) => void;
     store: Pick<PlanStore, 'allTasks' | 'snapshot'>;
-    orchestrator: Pick<TaskOrchestrator, 'getIdleSince' | 'getTaskIsolation' | 'getQueuedTaskMessages'>;
+    orchestrator: Pick<TaskOrchestrator, 'getIdleSince' | 'getTaskIsolation' | 'getQueuedTaskMessages' | 'getMergeGate' | 'mergeGateView'>;
     /** Shared with the Session, which snapshots, restores and clears it. */
     usage: PlannerUsageLedger;
     /** How many of a task's runner requests wait for an answer (ADR-0018, A1). */
@@ -3822,13 +4064,19 @@ declare class Session {
      * session asks here instead.
      */
     isolationView(): IsolationView | null;
+    /** The dependencies a task waits on at its merge gate (ADR-0020); empty when it waits for no Merge all. */
+    mergeGate(taskId: string): string[];
+    /** What Merge all would merge mid-run, while any task waits at a merge gate; null otherwise. */
+    mergeGateView(): MergeGateView | null;
     /** The run's integration branch against its base ref, as a unified diff. */
     reviewRunDiff(): Promise<string>;
     /**
      * "Merge all": each repo's integration branch into whatever the user has
      * checked out there — every repo, or none if any cannot take it. The one
      * irreversible step of isolated execution, so this explicit call is the
-     * only way it ever happens.
+     * only way it ever happens. During a run it merges what has landed so far,
+     * which is what opens a merge gate (ADR-0020); it waits for no ops task,
+     * and refuses while one runs.
      */
     mergeRun(): Promise<IsolationMergeResult>;
     /** Remove the run's worktrees and task branches; keep its integration branch to review or merge. */
@@ -4410,6 +4658,8 @@ interface ComposeOptions {
     planMapEnabled?: boolean;
     planMapMaxEntries?: number;
     tddEnabled?: boolean;
+    /** An ops task's last attempt, as its output ended (ADR-0020); absent on a first attempt. */
+    previousAttempt?: string;
 }
 declare function composeAugmentedPrompt(task: Task, allTasks: readonly Task[], opts?: ComposeOptions): string;
 /**
@@ -4418,7 +4668,9 @@ declare function composeAugmentedPrompt(task: Task, allTasks: readonly Task[], o
  * original prompt, so it is not sent again — but it holds the old worktree
  * too, and this attempt's is fresh from the integration branch.
  */
-declare function composeContinuationPrompt(task: Task, message: string): string;
+declare function composeContinuationPrompt(task: Task, message: string, opts?: {
+    ops?: boolean;
+}): string;
 
 type ExecFileFn = (command: string, args: string[]) => Promise<{
     stdout: string;
@@ -4625,7 +4877,16 @@ declare class StructuredSession extends AbstractTerminalSession implements Struc
      */
     private restartInterrupted;
     private startAdapter;
+    private openTurn;
     private deliver;
+    private route;
+    /**
+     * The runner spoke with no message of ours in flight. When it is working — a
+     * turn it opened itself once background work finished — that is a turn of the
+     * task like any other: the state says working, a queued message waits, and its
+     * end settles it. A message with no text in `turn_start` marks it as not ours.
+     */
+    private handleOutOfTurn;
     private openPermission;
     private cancelPermission;
     private handleEvent;
@@ -5007,14 +5268,11 @@ declare function resolveArgs(manifest: RunnerPluginManifest, ctx: ResolveContext
 /**
  * The manifest's meaning of a task's mode and effort, for a runner driven over
  * its programmatic protocol rather than a command line built from
- * `argsTemplate` (ADR-0018, C1). Same functions and the same `{{if thinking}}`
- * gate as the template path, so a structured task and a terminal task given
- * the same plan run under the same permission mode and effort.
+ * `argsTemplate` (ADR-0018, C1). The effort stays a raw id behind the same
+ * `{{if thinking}}` gate as the template path: how an effort reaches the
+ * runner is protocol, which each adapter owns.
  */
-declare function resolveTaskRunnerFlags(manifest: RunnerPluginManifest, ctx: Pick<ResolveContext, 'mode' | 'model' | 'thinkingEffort'>): {
-    permissionMode: string;
-    effortArgs: string[];
-};
+declare function resolveTaskRunnerFlags(manifest: RunnerPluginManifest, ctx: Pick<ResolveContext, 'mode' | 'model' | 'thinkingEffort'>): TaskRunnerFlags;
 
 declare const CLAUDE_CODE_MANIFEST: RunnerPluginManifest;
 
@@ -5145,4 +5403,4 @@ declare const DEFAULT_MAX_PARALLEL = 3;
  */
 declare function parseMaxParallel(value: unknown): number | null;
 
-export { ALLOWED_PLUGIN_HOSTS, ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractTerminalSession, ActiveTaskSession, type Adr0013IsolationRun, type Adr0013PlanIsolation, type Adr0013TaskRecord, AgentAdapter, AgentEvent, AgentProcessDeps, AgentStartOptions, AiProvider, ApplyTaskOpsResult, ApprovalAnswer, ApprovalDecision, ApprovalMode, ApprovalPolicy, ApprovalRequest, type AskOptions, AwaitingReason, BUILTIN_SKILL_NAMES, BaseAiService, BaseConfig, BaseFileSystem, BufferedTaskOutputSource, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CORE_PLANNER_PROMPT, type CappedRows, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, type CommandTier, type ComposeOptions, ConsoleLogger, ContextCollector, type Continuability, ConversationBusyError, type ConversationCompaction, ConversationEditError, type ConversationFork, ConversationMessage, type ConversationRequest, type ConversationRewind, type ConversationTurn, type ConversationVariant, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DEFAULT_MAX_PARALLEL, DiscoveredModel, type EnvAdmission, EnvConfig, type ExecFileFn, type ExecImpl, FindSymbolOptions, FsPluginStore, GIT_READONLY_SUBCOMMANDS, GeminiService, type GitExecFn, GlobOptions, type GrepInvocation, GrepOptions, type HasBinFn, HomeTranscriptReader, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IPluginStore, ITerminalRunner, ITerminalSession, IWorktreeIsolation, IsolationHandoff, IsolationLandedTask, IsolationMergeResult, IsolationOutcome, IsolationRun, IsolationTaskRecord, IsolationTaskStatus, IsolationView, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, LegacyPlanState, type LiveOutputLookup, type LiveTail, type LiveTailOptions, type MappedTool, ModelResolver, type ModelResolverDeps, type ModifyPlanRequest, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OUTPUT_LINES_DEFAULT, OUTPUT_LINES_MAX, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, PLUGIN_NAME_PATTERN, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanIsolation, PlanParseError, type PlanRequest, PlanState, PlanStatus, PlanStore, Planner, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerRuntimeToggles, PlannerUsage, type PluginSource, type PrdBlock, type PriorOutput, type ProbeFn, ProviderModelLists, type ProviderRegistration, QueuedMessage, QueuedTaskMessage, REFUSED_COMMANDS, ReadFileOpts, RepairEvidence, type RepairLoopOpts, type RepairVerdict, RepoGroupLayout, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchToolType, type ResearchTurn, ResolveContext, type RewindTarget, RunnerApprovals, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerInvocation, type RunnerMode, RunnerModeInfo, RunnerPluginManifest, RunnerRegistry, RunnerSpawnOptions, RunnerTransport, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SaveSession, Session, SessionBroadcaster, type SessionData, type SessionDeps, SessionMessage, type SessionMeta, SessionNotice, type SessionPlanner, type SessionRuntimeSettings, SettingsService, type ShellDialect, type SkillInfo, type SkillMetadata, SkillsService, type SpawnSpec, StdioAgentAdapter, StructuredEvent, StructuredRunner, type StructuredRunnerDeps, StructuredSession, StructuredSessionCapability, StructuredTurnEnd, TASK_QUERY_ANSWER_MAX_CHARS, TASK_QUERY_ANSWER_OR_OPS, TASK_QUERY_FIELDS, TASK_QUERY_PROTOCOL, TASK_QUERY_REMINDER, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, type TaskAttemptSnapshot, TaskControlError, TaskIsolation, TaskLogEvent, type TaskLogFile, type TaskLogLocation, TaskLogRecorder, type TaskLogRecorderDeps, TaskModeAgentAdapter, TaskOp, TaskOrchestrator, type TaskOrchestratorDeps, type TaskOrchestratorOptions, type TaskOutputAttempt, type TaskOutputSource, type TaskQuery, type TaskQueryCatalog, type TaskQueryField, TaskSnapshot, TaskStartOptions, TmuxRunner, type TmuxRunnerDeps, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, type TranscriptQuery, type TranscriptReader, type TransportRoute, TransportRouter, UsageRecord, type UserSettings, Verdict, VerdictEngine, type VerdictListener, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, type WorktreeIsolationDeps, admitSettingsEnv, applyHeadLimit, assertInstallablePluginUrl, assertPlainPluginName, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConflictRepairPrompt, buildConflictResolutionPrompt, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildRunnerInvocation, buildSplitPrompt, buildSubagentSystemPrompt, canContinue, clampThinkingEffort, classifyCommand, classifyPlannerReply, classifyPluginSource, clearAugmentedPathCache, clearDaemonToken, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, composeContinuationPrompt, configuredProviders, continuability, createAiService, createSession, createSkillsService, createTaskAdapter, createTaskOrchestrator, createWorktreeIsolation, daemonTokenPath, defaultLogger, definitionPattern, deleteSession, describeMergeResult, discoverGeminiModels, effectiveAllowlist, ensureDir, ensurePrivateDir, ensureStateDirIgnored, executionLogBlock, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, globalDataDir, grantScopeFor, hasTmux, idSegment, includeGlobFor, isCliProvider, isOpenAiProvider, isPlainPluginName, isValidManifest, killTree, languageForId, listSessions, listTaskLogAttempts, loadSession, loadSessionPlanState, loadState, mapAgentTool, migrateOldConfigDir, migratePlanIsolation, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, openTaskLog, parseMaxParallel, parseTaskQueryJson, pendingEditRulesBlock, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, reEmitTaskQueryPrompt, readDaemonToken, readTaskLog, referencePattern, renderPlanMap, renderPriorOutputs, renderTaskQueryAnswer, repairLoop, researchShellWarning, researchToolsPath, resolveArgs, resolvePluginInstallDir, resolveProviderFromPrefix, resolveResearchShell, resolveSkillInvocation, resolveTaskRunnerFlags, resolveWithin, retargetTaskRunner, routeTransport, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, sessionDataDir, sessionRuntimeSettings, stateExists, stripModelPrefix, summarizeOutput, supportsTaskMode, taskOpsRejectedPrompt, taskQuerySignature, textHasTaskQuery, tmuxSessionName, tmuxSocketName, tmuxWindowName, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, withPath, writePrivateFile };
+export { ALLOWED_PLUGIN_HOSTS, ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractTerminalSession, ActiveTaskSession, type Adr0013IsolationRun, type Adr0013PlanIsolation, type Adr0013TaskRecord, AgentAdapter, AgentEvent, AgentProcessDeps, AgentStartOptions, AiProvider, ApplyTaskOpsResult, ApprovalAnswer, ApprovalDecision, ApprovalMode, ApprovalPolicy, ApprovalRequest, type AskOptions, AwaitingReason, BUILTIN_SKILL_NAMES, BaseAiService, BaseConfig, BaseFileSystem, BufferedTaskOutputSource, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CORE_PLANNER_PROMPT, type CappedRows, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, type CommandTier, type ComposeOptions, ConsoleLogger, ContextCollector, type Continuability, ConversationBusyError, type ConversationCompaction, ConversationEditError, type ConversationFork, ConversationMessage, type ConversationRequest, type ConversationRewind, type ConversationTurn, type ConversationVariant, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DEFAULT_MAX_PARALLEL, DiscoveredModel, type EnvAdmission, EnvConfig, type ExecFileFn, type ExecImpl, FindSymbolOptions, FsPluginStore, GIT_READONLY_SUBCOMMANDS, GeminiService, type GitExecFn, GlobOptions, type GrepInvocation, GrepOptions, type HasBinFn, HomeTranscriptReader, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IPluginStore, ITerminalRunner, ITerminalSession, IWorktreeIsolation, IsolationHandoff, IsolationLandedTask, IsolationMergeResult, IsolationOutcome, IsolationRun, IsolationTaskRecord, IsolationTaskStatus, IsolationView, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, LegacyPlanState, type LiveOutputLookup, type LiveTail, type LiveTailOptions, type MappedTool, MergeGateView, ModelResolver, type ModelResolverDeps, type ModifyPlanRequest, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OUTPUT_LINES_DEFAULT, OUTPUT_LINES_MAX, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, PLUGIN_NAME_PATTERN, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanIsolation, PlanParseError, type PlanRequest, PlanState, PlanStatus, PlanStore, Planner, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerRuntimeToggles, PlannerUsage, type PluginSource, type PrdBlock, type PriorOutput, type ProbeFn, ProviderModelLists, type ProviderRegistration, QueuedMessage, QueuedTaskMessage, REFUSED_COMMANDS, ReadFileOpts, RepairEvidence, type RepairLoopOpts, type RepairVerdict, RepoGroupLayout, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchToolType, type ResearchTurn, ResolveContext, type RewindTarget, RunnerApprovals, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerInvocation, type RunnerMode, RunnerModeInfo, RunnerPluginManifest, RunnerRegistry, RunnerSpawnOptions, RunnerTransport, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SaveSession, Session, SessionBroadcaster, type SessionData, type SessionDeps, SessionMessage, type SessionMeta, SessionNotice, type SessionPlanner, type SessionRuntimeSettings, SettingsService, type ShellDialect, type SkillInfo, type SkillMetadata, SkillsService, type SpawnSpec, StdioAgentAdapter, StructuredEvent, StructuredRunner, type StructuredRunnerDeps, StructuredSession, StructuredSessionCapability, StructuredTurnEnd, TASK_QUERY_ANSWER_MAX_CHARS, TASK_QUERY_ANSWER_OR_OPS, TASK_QUERY_FIELDS, TASK_QUERY_PROTOCOL, TASK_QUERY_REMINDER, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, type TaskAttemptSnapshot, TaskControlError, TaskIsolation, TaskLogEvent, type TaskLogFile, type TaskLogLocation, TaskLogRecorder, type TaskLogRecorderDeps, TaskModeAgentAdapter, TaskOp, TaskOrchestrator, type TaskOrchestratorDeps, type TaskOrchestratorOptions, type TaskOutputAttempt, type TaskOutputSource, type TaskQuery, type TaskQueryCatalog, type TaskQueryField, TaskRunnerFlags, TaskSnapshot, TaskStartOptions, TmuxRunner, type TmuxRunnerDeps, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, type TranscriptQuery, type TranscriptReader, type TransportRoute, TransportRouter, TreeSnapshot, UsageRecord, type UserSettings, Verdict, VerdictEngine, type VerdictListener, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, type WorktreeIsolationDeps, admitSettingsEnv, applyHeadLimit, assertInstallablePluginUrl, assertPlainPluginName, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConflictRepairPrompt, buildConflictResolutionPrompt, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildRunnerInvocation, buildSplitPrompt, buildSubagentSystemPrompt, canContinue, clampThinkingEffort, classifyCommand, classifyPlannerReply, classifyPluginSource, clearAugmentedPathCache, clearDaemonToken, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, composeContinuationPrompt, configuredProviders, continuability, createAiService, createSession, createSkillsService, createTaskAdapter, createTaskOrchestrator, createWorktreeIsolation, daemonTokenPath, defaultLogger, definitionPattern, deleteSession, describeMergeResult, discoverGeminiModels, effectiveAllowlist, ensureDir, ensurePrivateDir, ensureStateDirIgnored, executionLogBlock, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, globalDataDir, grantScopeFor, hasTmux, idSegment, includeGlobFor, isCliProvider, isOpenAiProvider, isPlainPluginName, isValidManifest, killTree, languageForId, listSessions, listTaskLogAttempts, loadSession, loadSessionPlanState, loadState, mapAgentTool, migrateOldConfigDir, migratePlanIsolation, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, openTaskLog, parseMaxParallel, parseTaskQueryJson, pendingEditRulesBlock, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, reEmitTaskQueryPrompt, readDaemonToken, readTaskLog, referencePattern, renderPlanMap, renderPriorOutputs, renderTaskQueryAnswer, repairLoop, researchShellWarning, researchToolsPath, resolveArgs, resolvePluginInstallDir, resolveProviderFromPrefix, resolveResearchShell, resolveSkillInvocation, resolveTaskRunnerFlags, resolveWithin, retargetTaskRunner, routeTransport, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, sessionDataDir, sessionRuntimeSettings, stateExists, stripModelPrefix, summarizeOutput, supportsTaskMode, taskOpsRejectedPrompt, taskQuerySignature, textHasTaskQuery, tmuxSessionName, tmuxSocketName, tmuxWindowName, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, withPath, writePrivateFile };