@ordewell/core 0.6.3 → 0.7.0

package/dist/index.mjs

@@ -14,8 +14,9 @@ import {
   resolveDefaultMode,
   resolveTaskMode,
   runnerModesFrom,
-  validatePlanModification
-} from "./chunk-M4KXBEFJ.mjs";
+  validatePlanModification,
+  validatePlanTasks
+} from "./chunk-J3YSTPCE.mjs";
 import {
   CHECKPOINT_TRUNCATE_LENGTH,
   EMPTY_CONVERSATION,
@@ -37,6 +38,9 @@ import {
   continuability,
   dependencyCandidates,
   dependentsOf,
+  diffRows,
+  diffStat,
+  diffSummary,
   drainNext,
   effectiveAllowlist,
   executionSummary,
@@ -76,7 +80,7 @@ import {
   unsendLatest,
   usageLine,
   validateTaskEdit
-} from "./chunk-I6U3PVHL.mjs";
+} from "./chunk-LSGY7AIZ.mjs";
 import {
   PLAN_ENVELOPE_KEY,
   PlanParseError,
@@ -105,7 +109,7 @@ import {
   updateTaskInPlan,
   validateModifiedPlan,
   warningsText
-} from "./chunk-JRZPSNRO.mjs";
+} from "./chunk-YU4UKKKI.mjs";
 import {
   resolveOrderLabel,
   taskOrderLabel
@@ -266,9 +270,9 @@ var SEARCH_EXCLUSIONS = [
 ];
 
 // src/interfaces/IApproval.ts
-function toApprovalDecision(answer) {
-  if (typeof answer === "boolean") return { decision: answer ? "allow" : "deny" };
-  return answer;
+function toApprovalDecision(answer2) {
+  if (typeof answer2 === "boolean") return { decision: answer2 ? "allow" : "deny" };
+  return answer2;
 }
 function isGranted(decision) {
   return decision.decision !== "deny";
@@ -2345,7 +2349,10 @@ var WRAPPER_FAMILY = {
   // The multi-call binary ships its own `rm`, `mv` and `sh`, so the refused
   // name arrives as its first argument.
   busybox: { booleanFlags: ["--list", "--install", ...HELP_FLAGS] },
-  command: { booleanFlags: ["-p"], noExecFlags: ["-v", "-V"] }
+  command: { booleanFlags: ["-p"], noExecFlags: ["-v", "-V"] },
+  // Runs the named shell builtin, so `builtin eval …` is an `eval`. Classified
+  // on its own name it only asked, and a grant for `builtin echo` covered it.
+  builtin: {}
 };
 var XARGS_SPEC = {
   valueFlags: [
@@ -3075,6 +3082,9 @@ function refusalFor(seg) {
   if (seg.binary === "source" || seg.binary === ".") {
     return `"${seg.binary}" runs a file's contents as commands, which this classifier cannot inspect. Use the read-only research tools, or describe it as a task.`;
   }
+  if (seg.binary === "enable" && seg.args.some((a) => /^-[a-zA-Z]*f/.test(a))) {
+    return `"enable -f" loads a shared library into the shell, which runs its code. Use the read-only research tools, or describe it as a task.`;
+  }
   if (SHELL_KEYWORDS.includes(seg.binary)) {
     return `"${seg.binary}" is a shell keyword or compound-command opener. This classifier only inspects the command that runs first, and a keyword hides the real one from it. Run the inner command directly, or describe it as a task.`;
   }
@@ -3185,6 +3195,9 @@ function classifyCommand(command, opts = {}) {
   }
   const nonAuto = unwrapped.filter((u) => u.runner !== void 0 || !isAuto(u.seg, opts));
   if (nonAuto.length === 0) return { tier: "auto", scope: "" };
+  if (nonAuto.some((u) => u.seg.binary === "cd" || u.seg.binary !== "command" && SHELL_STATE_COMMANDS.has(u.seg.binary))) {
+    return { tier: "ask", scope: trimmed };
+  }
   const scope = [...new Set(nonAuto.map((u) => u.runner ? `${u.runner} ${scopeFor(u.seg)}` : scopeFor(u.seg)))].sort().join(" + ");
   return { tier: "ask", scope };
 }
@@ -3805,12 +3818,12 @@ var ApprovalPolicy = class {
       if (this.generation === gen) this.inFlight.delete(openKey);
     });
     this.inFlight.set(openKey, pending);
-    const answer = await pending;
+    const answer2 = await pending;
     if (this.generation === gen) {
-      if (answer) open.forEach((s) => this.granted.add(s));
+      if (answer2) open.forEach((s) => this.granted.add(s));
       else this.refused.add(key);
     }
-    return decide(answer, "asked");
+    return decide(answer2, "asked");
   }
   /** Scopes the user has granted this session — for display and for persistence. */
   grantedScopes() {
@@ -3871,10 +3884,10 @@ var PendingApprovals = class {
    * settled. "Allow for this task" on a request that did not offer it is a
    * plain allow: no grant is made that the requester never proposed.
    */
-  resolve(id, answer) {
+  resolve(id, answer2) {
     const entry = this.entries.get(id);
     if (!entry) return false;
-    const decision = toApprovalDecision(answer);
+    const decision = toApprovalDecision(answer2);
     entry.settle(decision.decision === "allowForTask" && !entry.pending.request.allowForTask ? { decision: "allow" } : decision);
     return true;
   }
@@ -4112,9 +4125,9 @@ function applyHeadLimit(stdout, headLimit) {
 }
 function formatSearchOutput(capped, root, opts) {
   if (capped.rows.length === 0) return opts.emptyMessage;
-  const sep2 = opts.sep ?? path3.sep;
-  const prefix = root === sep2 || root.endsWith(sep2) ? root : `${root}${sep2}`;
-  const body = prefix === sep2 ? capped.rows.join("\n") : capped.rows.map((row) => row.startsWith(prefix) ? row.slice(prefix.length) : row).join("\n");
+  const sep3 = opts.sep ?? path3.sep;
+  const prefix = root === sep3 || root.endsWith(sep3) ? root : `${root}${sep3}`;
+  const body = prefix === sep3 ? capped.rows.join("\n") : capped.rows.map((row) => row.startsWith(prefix) ? row.slice(prefix.length) : row).join("\n");
   if (!capped.truncated) return body;
   const hint = opts.hint ? ` ${opts.hint}` : "";
   return `${body}
@@ -5069,28 +5082,28 @@ function posixBinDirs() {
   ];
 }
 function windowsBinDirs(env, home) {
-  const join25 = (...parts) => path4.win32.join(...parts);
-  const under = (base, ...parts) => base ? [join25(base, ...parts)] : [];
+  const join26 = (...parts) => path4.win32.join(...parts);
+  const under = (base, ...parts) => base ? [join26(base, ...parts)] : [];
   const appData = env.APPDATA;
   const localAppData = env.LOCALAPPDATA;
   const programData = env.ProgramData;
   return [
     // Native per-user installers, PowerShell-driven and otherwise.
-    join25(home, ".local", "bin"),
-    join25(home, ".opencode", "bin"),
-    join25(home, ".claude", "bin"),
-    join25(home, ".codex", "bin"),
+    join26(home, ".local", "bin"),
+    join26(home, ".opencode", "bin"),
+    join26(home, ".claude", "bin"),
+    join26(home, ".codex", "bin"),
     ...under(localAppData, "Programs", "claude"),
     // Node package managers. npm's global prefix is `%APPDATA%\npm`; the
     // literal spelling is kept as a fallback for a host that does not export
     // APPDATA (a service account, a stripped CI container).
     ...under(appData, "npm"),
-    join25(home, "AppData", "Roaming", "npm"),
+    join26(home, "AppData", "Roaming", "npm"),
     ...under(localAppData, "pnpm"),
     ...under(localAppData, "Yarn", "bin"),
-    join25(home, ".bun", "bin"),
+    join26(home, ".bun", "bin"),
     // Windows package managers.
-    join25(home, "scoop", "shims"),
+    join26(home, "scoop", "shims"),
     ...under(env.SCOOP, "shims"),
     ...under(env.SCOOP_GLOBAL ?? programData, "scoop", "shims"),
     ...under(programData, "chocolatey", "bin"),
@@ -5100,7 +5113,7 @@ function windowsBinDirs(env, home) {
     ...under(localAppData, "Microsoft", "WindowsApps"),
     // Version managers. Volta's Windows home is not the POSIX `~/.volta`.
     ...under(localAppData, "Volta", "bin"),
-    join25(home, ".volta", "bin")
+    join26(home, ".volta", "bin")
   ];
 }
 function wellKnownBinDirs(deps = {}) {
@@ -5588,18 +5601,18 @@ var GitWorktreeIsolation = class {
    */
   sharedPaths(workspaceRoot, isolated) {
     if (isolated.includes(SELF_REPO)) return [];
-    const shared = [];
+    const shared2 = [];
     const walk = (rel) => {
       for (const name of listDir(path8.join(workspaceRoot, rel))) {
         if (!rel && (name === STATE_DIR || name === ".git")) continue;
         const child = rel ? `${rel}/${name}` : name;
         if (isolated.includes(child)) continue;
         if (isolated.some((p) => p.startsWith(`${child}/`))) walk(child);
-        else if (resolves(path8.join(workspaceRoot, child))) shared.push(child);
+        else if (resolves(path8.join(workspaceRoot, child))) shared2.push(child);
       }
     };
     walk("");
-    return shared;
+    return shared2;
   }
   prepare(task, run) {
     return this.admin(run.workspaceRoot, async () => {
@@ -6427,10 +6440,12 @@ var TASK_QUERY_FIELDS = [
   "userStoriesCovered",
   "output"
 ];
+var TASK_QUERY_TASK_FIELDS = TASK_QUERY_FIELDS.filter((f) => f !== "output");
 var OUTPUT_LINES_DEFAULT = 80;
 var OUTPUT_LINES_MAX = 400;
 var TASK_QUERY_ANSWER_MAX_CHARS = 2e4;
 var ANSWER_TAIL_RESERVE = 4e3;
+var OUTPUT_TAIL_MAX_CHARS = TASK_QUERY_ANSWER_MAX_CHARS - ANSWER_TAIL_RESERVE;
 function textHasTaskQuery(text) {
   return text.includes(`"${TASK_QUERY_ENVELOPE_KEY}"`);
 }
@@ -6506,6 +6521,7 @@ function taskQuerySignature(query) {
   return JSON.stringify([query.tasks, query.fields ?? null, query.catalog, query.outputLines ?? null, query.outputSince ?? null]);
 }
 var TASK_QUERY_ANSWER_OR_OPS = "You have now read everything you asked for. Do not send another taskQuery this turn: answer the user in prose, or emit the taskOps JSON for the change you came to make.";
+var TASK_READ_ANSWER_OR_EDIT = "You have now read everything you asked for. Do not read again this turn: answer the user in prose, or call edit_plan for the change you came to make.";
 var TASK_QUERY_PROTOCOL = [
   "READING A TASK BEFORE YOU EDIT IT:",
   "The plan block you are shown each turn carries only short fields \u2014 it never contains a task's prompt, its user steps, or a completed task's verdict. Never rewrite a field you have not read. To read one, reply with ONLY this JSON object:",
@@ -6517,7 +6533,16 @@ var TASK_QUERY_PROTOCOL = [
   "Ordewell answers immediately with the detail and changes nothing. Then reply again with your taskOps JSON, or with prose for the user.",
   "Three queries per user message; after that every answer also tells you to land the turn. Do not ask the same question twice."
 ];
+var TASK_READ_TOOLS_PROTOCOL = [
+  "READING A TASK BEFORE YOU EDIT IT:",
+  "The plan block you are shown each turn carries only short fields \u2014 it never contains a task's prompt, its user steps, or a completed task's verdict. Never rewrite a field you have not read. Read with these tools; they change nothing:",
+  '- task_query: "tasks" are one or more task references ("<id or #order>"). Ask for everything you need in ONE call. "fields" is optional (omit it to get description, prompt, userSteps, verdict, outputSummary and userStoriesCovered). "catalog": true also returns every runner with its models, thinking-effort variants and modes.',
+  `- task_output: the recent output of a task that is running right now \u2014 the way to diagnose a task that looks stuck mid-execution. "lines" (default 80, at most 400) sets how many; pass an answer's "nextOffset" back as "since" to read only what follows. A task that is not running answers with its verdict, output summary and a digest of its last attempt.`,
+  "Three reads per user message; after that every answer also tells you to land the turn, and after six they are refused. Do not ask the same question twice.",
+  "Once a plan exists, change it with edit_plan \u2014 every turn shows you its operations. Never reply with taskOps or taskQuery JSON."
+];
 var TASK_QUERY_REMINDER = `- To READ a task in full (prompt, user steps, verdict, output, user stories) or the whole model/mode catalog before editing, reply with ONLY {"${TASK_QUERY_ENVELOPE_KEY}":{"tasks":["<id or #order>"],"catalog":true}} \u2014 it changes nothing, and you then reply again with your ops.`;
+var TASK_READ_TOOLS_REMINDER = "- To READ a task in full (prompt, user steps, verdict, user stories), a running task's output, or the whole model/mode catalog before editing, call task_query or task_output \u2014 they change nothing \u2014 and then call edit_plan with your ops.";
 function findTask(tasks, ref) {
   const byId = tasks.find((t) => t.id === ref);
   if (byId) return byId;
@@ -6726,7 +6751,7 @@ function verificationModeBlock() {
   ].join("\n");
 }
 function researchPhaseBlock(harnessMode) {
-  const shared = [
+  const shared2 = [
     "RESEARCH PHASE:",
     "- Start by reading README.md and any agent config files (AGENTS.md, CLAUDE.md)"
   ];
@@ -6740,7 +6765,7 @@ function researchPhaseBlock(harnessMode) {
     "- Read key source files to understand architecture"
   ];
   return [
-    ...shared,
+    ...shared2,
     ...toolSpecific,
     "- Synthesize tool findings into your messages. The user does not see raw tool output; only your synthesis reaches them.",
     "- Research and questions can interleave \u2014 you can explore a file, then ask a question grounded in it, in one response"
@@ -6802,28 +6827,38 @@ function buildConversationSystemPrompt(goal, context, modelsByRunner, runners, r
     verificationBlock
   );
 }
+var PLANNER_TOOLS_CATALOG = [
+  "RUNNERS, MODELS AND MODES:",
+  "Which runners, models and modes you may assign can change while you plan: the user may enable a runner or edit the model allowlist at any time. Read them just before you submit, never from memory:",
+  "1. Call list_runners: the enabled runners, each with its task modes and default mode.",
+  "2. Call list_models for each runner you will assign: its allowed models, with their thinking-effort variants.",
+  `3. Call submit_plan with the whole plan. "assignedRunner" must be a runner list_runners returned, "assignedModel.modelId" a modelId list_models returned for that runner, "taskMode" one of that runner's modes.`,
+  '4. If submit_plan returns errors, fix exactly what each one names and call it again in the same reply. If it reports "coerced" changes, tell the user what was changed.',
+  ""
+];
 function buildConversationBody(goal, context, modelsJson, runners, modeGuide, modeExamples, variant, verificationBlock) {
+  const tools = variant.plannerTools ?? false;
   return [
-    "You are Ordewell's project planner. You explore the codebase, ask concise clarifying questions grounded in your findings, and produce structured task plans as JSON. Be direct: avoid unnecessary preamble, summaries, or explanations unless the user asks for detail.",
+    `You are Ordewell's project planner. You explore the codebase, ask concise clarifying questions grounded in your findings, and produce structured task plans ${tools ? "through the submit_plan tool" : "as JSON"}. Be direct: avoid unnecessary preamble, summaries, or explanations unless the user asks for detail.`,
     "",
     "WORKFLOW:",
     "1. Explore the workspace with tools to understand the codebase.",
     "2. Ask clarifying questions grounded in your findings. Reference actual files. When the goal is vague, or a decision would materially change the outcome (storage engine, library choice, scope, API shape), ask the user BEFORE planning \u2014 never silently assume. Clear, fully-specified goals need no questions.",
     "3. When you have enough context, produce a prose outline \u2014 a short list describing each vertical slice in order.",
-    '4. After the user confirms the outline, emit the final task plan as a JSON object with a "tasks" array.',
+    tools ? "4. After the user confirms the outline, call list_runners and list_models, then submit the final task plan with submit_plan." : '4. After the user confirms the outline, emit the final task plan as a JSON object with a "tasks" array.',
     "",
     researchPhaseBlock(variant.harness ?? false),
     verificationBlock,
     "",
     "OUTLINE PHASE:",
-    "- When you are ready to propose a plan, first show a prose outline. DO NOT jump straight to JSON.",
+    `- When you are ready to propose a plan, first show a prose outline. DO NOT jump straight to ${tools ? "submit_plan" : "JSON"}.`,
     "- Format: a numbered list describing each vertical tracer-bullet slice, with the files/layers each slice touches.",
     '- Example: "1. Set up database schema (src/db/schema.ts) \u2014 creates tables for users and sessions\n2. Add auth middleware (src/auth/middleware.ts) \u2014 validates JWTs on protected routes\n3. Build login page (src/ui/Login.tsx) \u2014 form component with validation"',
     "- The user may reply with adjustments. Revise the outline and re-present it.",
-    "- When the user confirms the outline, emit the task plan JSON.",
+    tools ? "- When the user confirms the outline, submit the plan with submit_plan." : "- When the user confirms the outline, emit the task plan JSON.",
     "",
     "PLAN FORMAT:",
-    "Generate a task plan using this JSON format:",
+    tools ? 'submit_plan takes {"tasks": [...]}, every task in this shape:' : "Generate a task plan using this JSON format:",
     "",
     "{",
     '  "tasks": [',
@@ -6837,8 +6872,8 @@ function buildConversationBody(goal, context, modelsJson, runners, modeGuide, mo
     '      "prompt": "Detailed instructions for the AI assistant (ai tasks only)",',
     '      "userSteps": [{ "order": 1, "instruction": "Step description", "completed": false }],',
     `      "assignedModel": { "modelId": "model-id", "modelLabel": "Model Label", "thinkingEffort": "a variant id from that model's variants list \u2014 omit if the model has none" },`,
-    '      "assignedRunner": "' + runners.join("|") + '",',
-    '      "taskMode": "' + modeExamples + '",',
+    '      "assignedRunner": "' + (tools ? "a runner id from list_runners" : runners.join("|")) + '",',
+    '      "taskMode": "' + (tools ? "one of that runner's modes from list_runners" : modeExamples) + '",',
     '      "autonomy": "AFK|HITL",',
     '      "sliceType": "AFK|HITL",',
     '      "ops": true,',
@@ -6870,8 +6905,13 @@ function buildConversationBody(goal, context, modelsJson, runners, modeGuide, mo
     ...opsTaskSection(true),
     "",
     "RULES:",
-    "- Do NOT wrap the JSON in markdown code blocks. Output ONLY the JSON object when committing the plan.",
-    "- Emit the outline BEFORE the JSON. Do not skip the outline.",
+    ...tools ? [
+      "- Submit the plan ONLY through submit_plan. Never write it as JSON in your reply.",
+      "- Show the outline BEFORE submitting. Do not skip the outline."
+    ] : [
+      "- Do NOT wrap the JSON in markdown code blocks. Output ONLY the JSON object when committing the plan.",
+      "- Emit the outline BEFORE the JSON. Do not skip the outline."
+    ],
     "- Reference specific files and patterns from your research in task prompts.",
     ...variant.isolatedExecution ? [] : [OVERLAP_AVOIDANCE_RULE],
     "",
@@ -6879,23 +6919,19 @@ function buildConversationBody(goal, context, modelsJson, runners, modeGuide, mo
     "- When suggesting libraries, frameworks, or patterns, first verify they already exist in the codebase. NEVER assume a library is available just because it is well-known. Check package.json, imports, or surrounding files first.",
     "- Follow the existing code style, naming conventions, and architectural patterns of the project.",
     "",
-    "MODEL ASSIGNMENT:",
-    "Available models:",
-    modelsJson,
-    "",
-    runnerInstruction(runners),
+    ...tools ? PLANNER_TOOLS_CATALOG : ["MODEL ASSIGNMENT:", "Available models:", modelsJson, "", runnerInstruction(runners)],
     "MODEL SELECTION GUIDELINES:",
     "- Use stronger models for complex refactoring, architecture changes, security-critical code.",
     "- Use weaker/faster models for simple file operations, test generation, config changes, documentation.",
-    `- Assign thinkingEffort based on task complexity, choosing ONLY from the assigned model's "variants" list above (e.g. low for simple tasks, high for complex ones). Omit thinkingEffort if the model has no variants.`,
+    `- Assign thinkingEffort based on task complexity, choosing ONLY from the assigned model's "variants" list ${tools ? "from list_models" : "above"} (e.g. low for simple tasks, high for complex ones). Omit thinkingEffort if the model has no variants.`,
     "",
     "TASK MODE:",
-    modeGuide,
+    tools ? `Use each runner's default mode from list_runners unless the task needs a different mode it lists. Avoid "plan" (read-only) unless the user asked for analysis only.` : modeGuide,
     "",
-    // Shared by both variants on purpose: the read channel is a text envelope
-    // exactly so a harness planner, which Ordewell cannot hand tools to, speaks
-    // the same protocol as an API-backed one (ADR-0009).
-    ...TASK_QUERY_PROTOCOL,
+    // The envelope is shared by both variants on purpose: a harness planner
+    // Ordewell could not hand tools to speaks the same protocol as an
+    // API-backed one (ADR-0009). One it did hand them to reads through them.
+    ...tools ? TASK_READ_TOOLS_PROTOCOL : TASK_QUERY_PROTOCOL,
     "",
     context ? `PROJECT CONTEXT:
 ${context}
@@ -7198,7 +7234,7 @@ function buildModifyDuringExecutionPrompt(executionLog, pendingTasks, userMessag
   sections.push('Return the COMPLETE modified pending tasks as a JSON object with a single "tasks" array. Include all pending tasks, not just the modified ones.\nDo NOT wrap the JSON in markdown code blocks. Output ONLY the JSON object.');
   return sections.join("\n");
 }
-function buildMergePrompt(taskIds, tasks) {
+function buildMergePrompt(taskIds, tasks, tools = false) {
   const idSet = new Set(taskIds);
   const selected = tasks.filter((t) => idSet.has(t.id)).sort((a, b) => a.order - b.order);
   const refs = selected.map((t) => `#${t.order} "${t.title}" (id=${t.id})`).join(", ");
@@ -7206,22 +7242,22 @@ function buildMergePrompt(taskIds, tasks) {
     `Merge these tasks into ONE combined task: ${refs}.`,
     "Write a clear combined title, description, and prompt that cover all of their work.",
     "The merged task takes the union of their dependencies (excluding the merged tasks themselves) and preserves their user stories.",
-    'Set "assignedRunner" and "assignedModel" on the merged task \u2014 use one of the runners and models listed in <available_models> above. Prefer the strongest model if the merged work is complex.',
-    'Reply with ONLY a taskOps JSON object using a single "merge" op:',
-    `  {"taskOps":[{"op":"merge","taskIds":[${selected.map((t) => `"${t.id}"`).join(", ")}],"merged":{"title":"...","description":"...","prompt":"...","assignedRunner":"...","assignedModel":{"modelId":"...","modelLabel":"..."}}}]}`,
+    `Set "assignedRunner" and "assignedModel" on the merged task \u2014 use one of the runners and models ${tools ? "list_runners and list_models return" : "listed in <available_models> above"}. Prefer the strongest model if the merged work is complex.`,
+    tools ? 'Call edit_plan with a single "merge" op:' : 'Reply with ONLY a taskOps JSON object using a single "merge" op:',
+    `  {"${tools ? "ops" : "taskOps"}":[{"op":"merge","taskIds":[${selected.map((t) => `"${t.id}"`).join(", ")}],"merged":{"title":"...","description":"...","prompt":"...","assignedRunner":"...","assignedModel":{"modelId":"...","modelLabel":"..."}}}]}`,
     `If this merge needs a companion op in the same batch (e.g. an added task that should depend on the merge result), give the merge op a "handle" (any unused name) and reference it from the later op's taskId/dependencies.`
   ].join("\n");
 }
-function buildSplitPrompt(taskId, tasks) {
+function buildSplitPrompt(taskId, tasks, tools = false) {
   const task = tasks.find((t) => t.id === taskId);
   if (!task) return `Split task ${taskId} into smaller tasks.`;
   return [
     `Split task #${task.order} "${task.title}" (id=${task.id}) into multiple smaller tasks that together accomplish the same work.`,
     "Decompose it into a sensible ordered sequence. Write a clear title, description, and prompt for each part.",
     "The first part inherits the original task's dependencies. Each later part depends on the previous part. Tasks that depended on the original now depend on the LAST part.",
-    'Set "assignedRunner" and "assignedModel" on each part \u2014 use the runners and models listed in <available_models> above. You may assign different models to different parts (e.g. a stronger model for a complex part, a faster one for a simple part).',
-    'Reply with ONLY a taskOps JSON object using a single "split" op:',
-    `  {"taskOps":[{"op":"split","taskId":"${task.id}","parts":[{"title":"...","description":"...","prompt":"...","assignedRunner":"...","assignedModel":{"modelId":"...","modelLabel":"..."}},...]}]}`,
+    `Set "assignedRunner" and "assignedModel" on each part \u2014 use the runners and models ${tools ? "list_runners and list_models return" : "listed in <available_models> above"}. You may assign different models to different parts (e.g. a stronger model for a complex part, a faster one for a simple part).`,
+    tools ? 'Call edit_plan with a single "split" op:' : 'Reply with ONLY a taskOps JSON object using a single "split" op:',
+    `  {"${tools ? "ops" : "taskOps"}":[{"op":"split","taskId":"${task.id}","parts":[{"title":"...","description":"...","prompt":"...","assignedRunner":"...","assignedModel":{"modelId":"...","modelLabel":"..."}},...]}]}`,
     `If this split needs a companion op in the same batch (e.g. another task that should depend on the last part), give the split op a "handle" (any unused name) \u2014 it names the last part \u2014 and reference it from the later op's taskId/dependencies.`
   ].join("\n");
 }
@@ -7275,15 +7311,15 @@ ${task.prompt ?? task.description}`;
 
 // src/services/PlanRepair.ts
 async function repairLoop(opts) {
-  let reply = await opts.first();
+  let reply2 = await opts.first();
   for (let repairs = 0; ; repairs++) {
-    const verdict = await opts.interpret(reply);
+    const verdict = await opts.interpret(reply2);
     if ("done" in verdict) return verdict.done;
     if (repairs >= opts.maxRepairs) {
-      return opts.onExhausted({ reply, errors: verdict.retry.errors, cause: verdict.retry.cause });
+      return opts.onExhausted({ reply: reply2, errors: verdict.retry.errors, cause: verdict.retry.cause });
     }
     const { corrective } = verdict.retry;
-    reply = await opts.resend(typeof corrective === "function" ? corrective() : corrective);
+    reply2 = await opts.resend(typeof corrective === "function" ? corrective() : corrective);
   }
 }
 var JSON_REPAIR_INSTRUCTION = "Your previous response could not be parsed as JSON. Re-send ONLY the JSON object \u2014 no prose before or after, no explanation, no markdown code fences.";
@@ -7399,34 +7435,34 @@ async function settleReply(opts) {
       }
       if (attempt.failure !== void 0) return { done: message(attempt.failure) };
       if (!attempt.text.trim()) return { done: message(emptyReplyReport(deniedStep(attempt))) };
-      const reply = classifyPlannerReply(attempt.text, opts.classify);
-      switch (reply.kind) {
+      const reply2 = classifyPlannerReply(attempt.text, opts.classify);
+      switch (reply2.kind) {
         case "plan":
-          return { done: { kind: "plan", tasks: reply.tasks, text: said(attempt), researchLog } };
+          return { done: { kind: "plan", tasks: reply2.tasks, text: said(attempt), researchLog } };
         case "task_ops":
-          return { done: { kind: "task_ops", ops: reply.ops, text: said(attempt), researchLog } };
+          return { done: { kind: "task_ops", ops: reply2.ops, text: said(attempt), researchLog } };
         // A read is answered by the conversation, which owns the plan and the
         // catalog, so it leaves here the way a plan or an edit does.
         case "task_query":
-          return { done: { kind: "task_query", query: reply.query, text: said(attempt), researchLog } };
+          return { done: { kind: "task_query", query: reply2.query, text: said(attempt), researchLog } };
         case "prose":
           return { done: asProse(attempt) };
       }
       if (opts.signal?.aborted) return { done: asProse(attempt) };
-      const errors = [reply.error.message];
-      switch (reply.kind) {
+      const errors = [reply2.error.message];
+      switch (reply2.kind) {
         case "broken_task_ops":
-          return { retry: { errors, corrective: reEmitTaskOpsPrompt(reply.error.message), cause: reply.error } };
+          return { retry: { errors, corrective: reEmitTaskOpsPrompt(reply2.error.message), cause: reply2.error } };
         case "broken_task_query":
-          return { retry: { errors, corrective: reEmitTaskQueryPrompt(reply.error.message), cause: reply.error } };
+          return { retry: { errors, corrective: reEmitTaskQueryPrompt(reply2.error.message), cause: reply2.error } };
         case "broken_plan": {
-          const corrective = reply.error.truncated || attempt.cutOff ? () => truncatedPlanReEmitPrompt((opts.compactHistory?.() ?? 0) > 0) : reEmitPlanPrompt(reply.error.message);
-          return { retry: { errors, corrective, cause: reply.error } };
+          const corrective = reply2.error.truncated || attempt.cutOff ? () => truncatedPlanReEmitPrompt((opts.compactHistory?.() ?? 0) > 0) : reEmitPlanPrompt(reply2.error.message);
+          return { retry: { errors, corrective, cause: reply2.error } };
         }
       }
     },
     maxRepairs: MAX_JSON_REPAIRS,
-    onExhausted: ({ reply }) => asProse(reply)
+    onExhausted: ({ reply: reply2 }) => asProse(reply2)
   });
 }
 var said = (attempt) => attempt.fullText ?? attempt.text;
@@ -7653,8 +7689,8 @@ function compactResearchResults(resultsText, maxChars = COMPACTION_LIMITS.resear
   const blocks = [{ tool: null, lines: [] }];
   for (const line of resultsText.split("\n")) {
     const m = headerRe.exec(line);
-    const tool = m && knownNames.has(m[1]) ? m[1] : line === "[LLM response]" ? "llm_response" : null;
-    if (tool) blocks.push({ tool, lines: [line] });
+    const tool2 = m && knownNames.has(m[1]) ? m[1] : line === "[LLM response]" ? "llm_response" : null;
+    if (tool2) blocks.push({ tool: tool2, lines: [line] });
     else blocks[blocks.length - 1].lines.push(line);
   }
   const texts = blocks.map((b) => b.lines.join("\n"));
@@ -8147,9 +8183,9 @@ ${llmOutput}
         return { tasks: null, researchLog, researchResults };
       }
       const thinking = turn.reasoning ? turn.reasoning.slice(-200) : turn.text.slice(-200);
-      const reply = classifyPlannerReply(turn.text, { runners, runnerModes, autonomousDefault });
-      if (reply.kind === "plan") {
-        return { tasks: reply.tasks, researchLog, researchResults };
+      const reply2 = classifyPlannerReply(turn.text, { runners, runnerModes, autonomousDefault });
+      if (reply2.kind === "plan") {
+        return { tasks: reply2.tasks, researchLog, researchResults };
       }
       if (!turn.hasToolCalls) break;
       const { toolResults, logEntries, resultsText } = await this.executeToolCalls(
@@ -8868,7 +8904,7 @@ ${collected.aiflowContext}
 };
 
 // src/services/TaskOrchestrator.ts
-import * as path13 from "path";
+import * as path14 from "path";
 
 // src/services/promptAugment.ts
 var MAX_TAIL_CHARS = 500;
@@ -8986,10 +9022,14 @@ function renderPreviousAttempt(output) {
     tail
   ].join("\n");
 }
-function renderCompletionMarker(task) {
+function renderCompletionMarker(task, completionTool = false) {
+  const howto = `Build it by writing \`<<<ORDEWELL_\` immediately followed by \`DONE_${task.completionMarker}>>>\` \u2014 joined into a single unbroken token, with no space, quote, or any other character between the two parts.`;
+  if (!completionTool) return `
+
+When you have fully completed this task, print one final line containing only the completion marker. ${howto}`;
   return `
 
-When you have fully completed this task, print one final line containing only the completion marker. Build it by writing \`<<<ORDEWELL_\` immediately followed by \`DONE_${task.completionMarker}>>>\` \u2014 joined into a single unbroken token, with no space, quote, or any other character between the two parts.`;
+When you have fully completed this task, call the \`task_complete\` tool with status \`done\` and a summary of what you did; the tasks that depend on this one are given that summary. If you cannot complete it, call \`task_complete\` with status \`blocked\` or \`failed\` and the reason instead, and print no marker. After a \`done\` call, or if the tool is not available to you, also print one final line containing only the completion marker. ${howto}`;
 }
 function renderTddInstruction() {
   return [
@@ -9010,7 +9050,21 @@ function renderTddInstruction() {
   ].join("\n");
 }
 var CHECKPOINT_MARKER_HOWTO = "Build it by writing `<<<ORDEWELL_` immediately followed by `CHECKPOINT:` \u2014 no space, quote, or any other character between those two parts \u2014 then a brief summary of what you are about to do and why human input is needed, closed with `>>>`";
-function renderCheckpointInstruction() {
+function renderCheckpointInstruction(checkpointTool = false) {
+  if (checkpointTool) {
+    return [
+      "## Human-in-the-loop checkpoints",
+      "",
+      "When you reach a decision point that requires human judgment \u2014 before destructive",
+      "operations, after major design decisions, or when multiple viable paths exist \u2014 pause",
+      "and request input:",
+      "",
+      "1. Call the `checkpoint` tool with a brief summary of what you are about to do and why human input is needed. The call waits for the human, and its result is their answer",
+      "2. If the result is `continue`: proceed with the action you described",
+      "3. If the result starts with `rejected:`: the rest is why. Adjust your approach and call `checkpoint` again if needed",
+      `4. If the \`checkpoint\` tool is not available to you, or the call fails, fall back to the marker: print one line holding only the checkpoint marker and wait for ORDEWELL_CONTINUE or ORDEWELL_REJECT. ${CHECKPOINT_MARKER_HOWTO}`
+    ].join("\n");
+  }
   return [
     "## Human-in-the-loop checkpoints",
     "",
@@ -9042,9 +9096,9 @@ function composeAugmentedPrompt(task, allTasks, opts) {
     blocks.push(renderTddInstruction());
   }
   if (isHitlTask(task)) {
-    blocks.push(renderCheckpointInstruction());
+    blocks.push(renderCheckpointInstruction(opts?.completionTool));
   }
-  const marker2 = renderCompletionMarker(task);
+  const marker2 = renderCompletionMarker(task, opts?.completionTool);
   if (blocks.length === 0) return basePrompt + marker2;
   return `${blocks.join("\n\n")}
 
@@ -9055,12 +9109,12 @@ function composeContinuationPrompt(task, message, opts = {}) {
     opts.ops ? "(Ordewell) You are continuing this task in the same session, in the same checkout. What your earlier attempt did outside the repository was not undone: check what already exists before acting again." : "(Ordewell) You are continuing this task in the same session. Your working directory was recreated from the integration branch: work from your earlier attempt is there only if it landed, so check the files before relying on them."
   ];
   if (isHitlTask(task)) {
-    reminder.push(`If you reach a decision that needs human judgment, print one line holding only the checkpoint marker and wait for ORDEWELL_CONTINUE or ORDEWELL_REJECT. ${CHECKPOINT_MARKER_HOWTO}.`);
+    reminder.push(opts.completionTool ? `If you reach a decision that needs human judgment, call the \`checkpoint\` tool: its result is \`continue\` or \`rejected: <why>\`. Only if the tool is not available to you, print one line holding only the checkpoint marker and wait for ORDEWELL_CONTINUE or ORDEWELL_REJECT. ${CHECKPOINT_MARKER_HOWTO}.` : `If you reach a decision that needs human judgment, print one line holding only the checkpoint marker and wait for ORDEWELL_CONTINUE or ORDEWELL_REJECT. ${CHECKPOINT_MARKER_HOWTO}.`);
   }
   return `${message.trim()}
 
 ---
-${reminder.join("\n\n")}${renderCompletionMarker(task)}`;
+${reminder.join("\n\n")}${renderCompletionMarker(task, opts.completionTool)}`;
 }
 
 // src/services/VerdictEngine.ts
@@ -9078,6 +9132,13 @@ var VerdictEngine = class {
   pausedSessions = /* @__PURE__ */ new Map();
   listeners = [];
   checkpointListeners = [];
+  withdrawnListeners = [];
+  /**
+   * The open `checkpoint` tool call per task (ADR-0022, V5): settling it is how
+   * an answer reaches a runner that asked through the tool, where the marker's
+   * answer is typed into the session instead.
+   */
+  toolCheckpoints = /* @__PURE__ */ new Map();
   idleListeners = [];
   /**
    * Per-task generation. Replaced on every watch(), clear() and verdict.
@@ -9108,6 +9169,9 @@ var VerdictEngine = class {
   onCheckpoint(listener) {
     this.checkpointListeners.push(listener);
   }
+  onCheckpointWithdrawn(listener) {
+    this.withdrawnListeners.push(listener);
+  }
   onIdleChange(listener) {
     this.idleListeners.push(listener);
   }
@@ -9169,6 +9233,11 @@ ${line}
   }
   approveCheckpoint(taskId) {
     this.resumeIdle(taskId);
+    const toolCall = this.toolCheckpoints.get(taskId);
+    if (toolCall) {
+      toolCall({ kind: "continue" });
+      return;
+    }
     const session = this.pausedSessions.get(taskId);
     if (session) {
       session.write(this.resumeToken(session, "ORDEWELL_CONTINUE"));
@@ -9177,6 +9246,11 @@ ${line}
   }
   rejectCheckpoint(taskId, reason) {
     this.resumeIdle(taskId);
+    const toolCall = this.toolCheckpoints.get(taskId);
+    if (toolCall) {
+      toolCall({ kind: "rejected", reason });
+      return;
+    }
     const session = this.pausedSessions.get(taskId);
     if (session) {
       session.write(this.resumeToken(session, `ORDEWELL_REJECT: ${reason}`));
@@ -9187,7 +9261,10 @@ ${line}
    * Attach to a spawned session: scan the output tail for the task's completion
    * marker (delivering a verdict immediately while leaving interactive sessions
    * open), scan for checkpoint markers, and on exit produce a failed verdict
-   * when the marker was never observed.
+   * when the marker was never observed. A structured session's `task_complete`
+   * call is evidence too (ADR-0022, V2): whichever signal comes first decides.
+   *
+   * Returns the attempt's generation, what {@link signalComplete} is checked against.
    */
   watch(task, session) {
     const doneToken = `<<<ORDEWELL_DONE_${task.completionMarker}>>>`;
@@ -9217,6 +9294,8 @@ ${line}
         else if (event.type === "permission_request" && !event.decided) this.approvalOpened(task.id, event.id);
         else if (event.type === "permission_decided" || event.type === "permission_withdrawn") this.approvalClosed(task.id, event.id, gen);
       });
+      session.onTaskComplete((report) => this.signalComplete(task.id, gen, report));
+      session.onToolCheckpoint((question, signal) => this.raiseCheckpoint(task.id, gen, question, signal));
     }
     session.onExit((exitCode) => {
       if (this.generations.get(task.id) !== gen) return;
@@ -9225,6 +9304,52 @@ ${line}
       const verdict = this.decide(task, exitCode);
       for (const l of this.listeners) l(task.id, verdict);
     });
+    return gen;
+  }
+  /**
+   * The runner's own `task_complete` call (ADR-0022, V1/V3): settles the
+   * attempt exactly as the marker does, unless that attempt is no longer the
+   * task's current one or another signal already settled it.
+   */
+  signalComplete(taskId, generation, report) {
+    if (this.generations.get(taskId) !== generation) return;
+    this.forget(taskId);
+    this.bumpGeneration(taskId);
+    const verdict = reportedVerdict(report);
+    for (const l of this.listeners) l(taskId, verdict);
+  }
+  /**
+   * The runner's `checkpoint` call (ADR-0022, V5): raised through the same
+   * listeners as the marker, so the task waits on the user the same way, and
+   * settled by {@link approveCheckpoint} or {@link rejectCheckpoint}. It is
+   * withdrawn, never left hanging, once the attempt is over or the call goes.
+   */
+  raiseCheckpoint(taskId, generation, question, signal) {
+    if (this.generations.get(taskId) !== generation || signal.aborted) {
+      return Promise.resolve({ kind: "withdrawn", why: "this attempt has ended." });
+    }
+    if (this.toolCheckpoints.has(taskId)) {
+      return Promise.resolve({ kind: "withdrawn", why: "another checkpoint is still waiting for an answer. Wait for it before asking again." });
+    }
+    return new Promise((resolve7) => {
+      const settle = (answer2) => {
+        signal.removeEventListener("abort", onAbort);
+        if (this.toolCheckpoints.get(taskId) === settle) this.toolCheckpoints.delete(taskId);
+        resolve7(answer2);
+      };
+      const onAbort = () => {
+        settle({ kind: "withdrawn", why: "the call was cancelled." });
+        if (this.generations.get(taskId) !== generation) return;
+        this.resumeIdle(taskId);
+        for (const l of this.withdrawnListeners) l(taskId);
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+      this.toolCheckpoints.set(taskId, settle);
+      for (const l of this.checkpointListeners) l(taskId, question.trim());
+    });
+  }
+  withdrawToolCheckpoint(taskId) {
+    this.toolCheckpoints.get(taskId)?.({ kind: "withdrawn", why: "this attempt has ended." });
   }
   approvalOpened(taskId, approvalId) {
     const open = this.openApprovals.get(taskId) ?? /* @__PURE__ */ new Set();
@@ -9258,6 +9383,7 @@ ${line}
     this.markerTails.delete(taskId);
     this.checkpointCarry.delete(taskId);
     this.pausedSessions.delete(taskId);
+    this.withdrawToolCheckpoint(taskId);
     this.idlePaused.delete(taskId);
     this.openApprovals.delete(taskId);
     this.clearIdle(taskId);
@@ -9293,6 +9419,7 @@ ${line}
     this.markerTails.clear();
     this.checkpointCarry.clear();
     this.pausedSessions.clear();
+    for (const taskId of [...this.toolCheckpoints.keys()]) this.withdrawToolCheckpoint(taskId);
     for (const timer of this.idleTimers.values()) clearTimeout(timer);
     this.idleTimers.clear();
     this.idleSince.clear();
@@ -9346,6 +9473,28 @@ ${line}
     };
   }
 };
+function reportedVerdict(report) {
+  const checks = [
+    {
+      name: "task_complete",
+      passed: report.status === "done",
+      skipped: false,
+      detail: `the runner called task_complete with status "${report.status}"`
+    },
+    {
+      name: "completion_marker",
+      passed: report.status === "done",
+      skipped: true,
+      detail: "bypassed \u2014 the runner reported through task_complete"
+    }
+  ];
+  const decidedAt = (/* @__PURE__ */ new Date()).toISOString();
+  if (report.status === "done") {
+    return { outcome: "pass", reason: "Verified: the runner reported completion through task_complete. Task completed successfully.", checks, decidedAt };
+  }
+  const why = report.reason?.trim() || "no reason given";
+  return { outcome: "fail", reason: `The runner reported the task ${report.status}: ${why}`, checks, decidedAt };
+}
 
 // src/services/transcriptCapture.ts
 import { readFileSync as readFileSync3, readdirSync as readdirSync3, statSync as statSync5, existsSync as existsSync4 } from "fs";
@@ -9509,10 +9658,10 @@ async function fromDirenv(cwd, deps) {
   }
   return { env, blocked: null };
 }
-function findUp(start, relative5, deps) {
+function findUp(start, relative6, deps) {
   let dir = path9.resolve(start);
   for (; ; ) {
-    const candidate = path9.join(dir, relative5);
+    const candidate = path9.join(dir, relative6);
     if (deps.readFile(candidate) !== null) return candidate;
     const parent = path9.dirname(dir);
     if (parent === dir) return null;
@@ -9761,6 +9910,11 @@ var BufferedTaskOutputSource = class {
     session.onExit(() => {
       capture.exited = true;
     });
+    if (isStructuredSession(session)) {
+      session.onTaskComplete(({ summary }) => {
+        if (capture.attached && summary.trim()) capture.reported = summary.trim();
+      });
+    }
   }
   detach(taskId) {
     const capture = this.captures.get(taskId);
@@ -9771,6 +9925,8 @@ var BufferedTaskOutputSource = class {
     this.captures.clear();
   }
   async finalText(attempt, doneToken) {
+    const reported = this.captures.get(attempt.taskId)?.reported;
+    if (reported) return defuseMarkers(reported);
     if (attempt.cwd && attempt.completionMarker) {
       const transcript = await this.transcripts.finalAssistantText({
         runner: attempt.runner,
@@ -10610,8 +10766,8 @@ var IsolationRunController = class {
     this.resolvers = {};
     this.reportedCopies.clear();
     this.listener.changed();
-    const shared = sharedPathsNotice(this.run);
-    if (shared) this.tell("info", shared);
+    const shared2 = sharedPathsNotice(this.run);
+    if (shared2) this.tell("info", shared2);
   }
   reportCopies(copied) {
     const fresh = copied.filter((p) => !this.reportedCopies.has(p));
@@ -11783,6 +11939,502 @@ ${tail}` : ""}`;
   }
 };
 
+// src/services/harness/fileDiff.ts
+function markedLines(text, mark) {
+  if (!text) return text;
+  const body = text.endsWith("\n") ? text.slice(0, -1) : text;
+  return `${body.split("\n").map((line) => `${mark}${line}`).join("\n")}${body === text ? "" : "\n"}`;
+}
+var HUNK_HEADER = /^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/;
+function hunksOf(diff) {
+  const kept = [];
+  let oldLeft = 0;
+  let newLeft = 0;
+  for (const line of diff.split("\n")) {
+    if (oldLeft > 0 || newLeft > 0 || line.startsWith("\\")) {
+      kept.push(line);
+      if (line.startsWith("\\")) continue;
+      if (!line.startsWith("+")) oldLeft -= 1;
+      if (!line.startsWith("-")) newLeft -= 1;
+      continue;
+    }
+    const header = HUNK_HEADER.exec(line);
+    if (!header) continue;
+    kept.push(line);
+    oldLeft = header[1] === void 0 ? 1 : Number(header[1]);
+    newLeft = header[2] === void 0 ? 1 : Number(header[2]);
+  }
+  return kept.length ? `${kept.join("\n")}${diff.endsWith("\n") ? "\n" : ""}` : diff;
+}
+function range(start, lines) {
+  return lines === 1 ? `${start}` : `${start},${lines}`;
+}
+function structuredPatchText(patch) {
+  if (!Array.isArray(patch)) return "";
+  let text = "";
+  for (const hunk of patch) {
+    if (!hunk || typeof hunk !== "object") return "";
+    const { oldStart, oldLines, newStart, newLines, lines } = hunk;
+    if (typeof oldStart !== "number" || typeof oldLines !== "number" || typeof newStart !== "number" || typeof newLines !== "number") return "";
+    if (!Array.isArray(lines) || !lines.every((line) => typeof line === "string")) return "";
+    text += `@@ -${range(oldStart, oldLines)} +${range(newStart, newLines)} @@
+${lines.map((line) => `${line}
+`).join("")}`;
+  }
+  return text;
+}
+
+// src/services/mcp/OrdewellMcpServer.ts
+import { createServer } from "http";
+import { randomBytes as randomBytes4 } from "crypto";
+import { Server as McpProtocolServer } from "@modelcontextprotocol/sdk/server/index.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, McpError } from "@modelcontextprotocol/sdk/types.js";
+
+// src/utils/daemonToken.ts
+import { randomBytes as randomBytes3, timingSafeEqual } from "crypto";
+import { readFileSync as readFileSync4, unlinkSync as unlinkSync2 } from "fs";
+import { join as join13 } from "path";
+
+// src/utils/globalDataDir.ts
+import * as fs7 from "fs";
+import * as path13 from "path";
+import * as os5 from "os";
+function globalDataDir() {
+  return path13.join(os5.homedir(), ".ordewell");
+}
+function copyDirSync(src, dest) {
+  fs7.mkdirSync(dest, { recursive: true });
+  const entries = fs7.readdirSync(src, { withFileTypes: true });
+  for (const entry of entries) {
+    const srcPath = path13.join(src, entry.name);
+    const destPath = path13.join(dest, entry.name);
+    if (entry.isDirectory()) {
+      copyDirSync(srcPath, destPath);
+    } else {
+      fs7.copyFileSync(srcPath, destPath);
+    }
+  }
+}
+var migrated = false;
+function migrateOldConfigDir() {
+  if (migrated) return;
+  migrated = true;
+  const oldDir = path13.join(os5.homedir(), ".config", "ordewell");
+  if (!fs7.existsSync(oldDir)) return;
+  const newDir = globalDataDir();
+  const liftFile = (name) => {
+    const oldFile = path13.join(oldDir, name);
+    const newFile = path13.join(newDir, name);
+    if (fs7.existsSync(oldFile) && !fs7.existsSync(newFile)) {
+      fs7.mkdirSync(newDir, { recursive: true });
+      fs7.copyFileSync(oldFile, newFile);
+    }
+  };
+  liftFile("settings.json");
+  liftFile(".env");
+  const oldPlugins = path13.join(oldDir, "plugins");
+  const newPlugins = path13.join(newDir, "plugins");
+  if (fs7.existsSync(oldPlugins) && !fs7.existsSync(newPlugins)) {
+    copyDirSync(oldPlugins, newPlugins);
+  }
+}
+
+// src/utils/privateFile.ts
+import { closeSync, mkdirSync as mkdirSync6, openSync, renameSync, unlinkSync, writeSync } from "fs";
+import { basename as basename2, dirname as dirname5, join as join12 } from "path";
+import { randomBytes as randomBytes2 } from "crypto";
+var DIR_MODE = 448;
+var FILE_MODE = 384;
+var POSIX_MODES = process.platform !== "win32";
+function ensurePrivateDir(dir) {
+  if (POSIX_MODES) {
+    mkdirSync6(dir, { recursive: true, mode: DIR_MODE });
+    return;
+  }
+  mkdirSync6(dir, { recursive: true });
+}
+function writePrivateFile(filePath, content) {
+  const dir = dirname5(filePath);
+  ensurePrivateDir(dir);
+  const tempPath = join12(dir, `.${basename2(filePath)}.${randomBytes2(8).toString("hex")}.tmp`);
+  const fd = openSync(tempPath, "wx", POSIX_MODES ? FILE_MODE : void 0);
+  try {
+    writeSync(fd, content);
+  } finally {
+    closeSync(fd);
+  }
+  try {
+    renameSync(tempPath, filePath);
+  } catch (err) {
+    try {
+      unlinkSync(tempPath);
+    } catch {
+    }
+    throw err;
+  }
+}
+
+// src/utils/daemonToken.ts
+var BEARER_PREFIX = "bearer ";
+var DAEMON_TOKEN_SUBPROTOCOL_PREFIX = "ordewell.token.";
+var DAEMON_SUBPROTOCOL = "ordewell.v1";
+function configDir() {
+  return globalDataDir();
+}
+function daemonTokenPath(port) {
+  return join13(configDir(), `server-${port}.token`);
+}
+function mintDaemonToken(port) {
+  const token = randomBytes3(32).toString("base64url");
+  const file = daemonTokenPath(port);
+  writePrivateFile(file, token);
+  return { token, file };
+}
+function readDaemonToken(port) {
+  try {
+    const token = readFileSync4(daemonTokenPath(port), "utf8").trim();
+    return token === "" ? void 0 : token;
+  } catch {
+    return void 0;
+  }
+}
+function clearDaemonToken(port) {
+  try {
+    unlinkSync2(daemonTokenPath(port));
+  } catch {
+  }
+}
+function bearerHeaderValue(token) {
+  return `Bearer ${token}`;
+}
+function tokenSubprotocols(token) {
+  return [DAEMON_SUBPROTOCOL, `${DAEMON_TOKEN_SUBPROTOCOL_PREFIX}${token}`];
+}
+function extractPresentedToken(carriers) {
+  const authorization = carriers.authorization;
+  if (authorization && authorization.toLowerCase().startsWith(BEARER_PREFIX)) {
+    const value = authorization.slice(BEARER_PREFIX.length).trim();
+    if (value !== "") return value;
+  }
+  for (const offered of (carriers.secWebSocketProtocol ?? "").split(",")) {
+    const value = offered.trim();
+    if (!value.startsWith(DAEMON_TOKEN_SUBPROTOCOL_PREFIX)) continue;
+    const token = value.slice(DAEMON_TOKEN_SUBPROTOCOL_PREFIX.length);
+    if (token !== "") return token;
+  }
+  return void 0;
+}
+function tokensMatch(presented, expected) {
+  if (presented === void 0) return false;
+  const a = Buffer.from(presented, "utf8");
+  const b = Buffer.from(expected, "utf8");
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+
+// src/services/mcp/tools.ts
+import { z } from "zod/v4";
+var taskCompleteInput = z.object({
+  status: z.enum(["done", "blocked", "failed"]).describe("'done' only when the task is fully complete. 'blocked' or 'failed' end the attempt without passing."),
+  summary: z.string().describe("What was done, handed to the tasks that depend on this one."),
+  reason: z.string().optional().describe("Why the task is blocked or failed. Expected for anything but 'done'.")
+});
+var checkpointInput = z.object({
+  question: z.string().min(1).describe("The question for the user. The call returns their answer.")
+});
+var listRunnersInput = z.object({});
+var listModelsInput = z.object({
+  runner: z.string().min(1).describe("A runner id from list_runners.")
+});
+var taskRef = z.union([z.string().min(1), z.number().int().min(0)]).describe('A task id, "#order", a bare order, or a title.');
+var modelAssignment = z.looseObject({
+  modelId: z.string(),
+  modelLabel: z.string().optional(),
+  thinkingEffort: z.string().optional().describe("A variant id from that model's variants list.")
+});
+var planTask = z.looseObject({
+  id: z.string().optional(),
+  order: z.number().optional(),
+  title: z.string(),
+  description: z.string().optional(),
+  type: z.enum(["ai", "user"]).optional(),
+  dependencies: z.array(z.string()).optional(),
+  prompt: z.string().optional(),
+  userSteps: z.array(z.looseObject({ order: z.number().optional(), instruction: z.string() })).optional(),
+  assignedRunner: z.string().optional(),
+  assignedModel: modelAssignment.optional(),
+  taskMode: z.string().optional(),
+  autonomy: z.enum(["AFK", "HITL"]).optional(),
+  sliceType: z.enum(["AFK", "HITL"]).optional(),
+  ops: z.boolean().optional(),
+  userStoriesCovered: z.array(z.string()).optional(),
+  subtasks: z.array(z.record(z.string(), z.unknown())).optional()
+});
+var submitPlanInput = z.object({
+  tasks: z.array(planTask).min(1).describe("The whole plan, in order.")
+});
+var taskFields = z.record(z.string(), z.unknown());
+var handle = z.string().optional();
+var taskOp = z.discriminatedUnion("op", [
+  z.object({ op: z.literal("update"), taskId: taskRef, changes: taskFields }),
+  z.object({ op: z.literal("add"), task: taskFields, handle }),
+  z.object({ op: z.literal("remove"), taskId: taskRef }),
+  z.object({ op: z.literal("reorder"), taskIds: z.array(taskRef) }),
+  z.object({ op: z.literal("merge"), taskIds: z.array(taskRef), merged: taskFields, handle }),
+  z.object({ op: z.literal("split"), taskId: taskRef, parts: z.array(taskFields), handle }),
+  z.object({ op: z.literal("rearm"), taskId: taskRef, changes: taskFields.optional() })
+]);
+var editPlanInput = z.object({
+  ops: z.array(taskOp).min(1).describe("Applied as one batch; every ref resolves against the plan before any op runs.")
+});
+var taskQueryInput = z.object({
+  tasks: z.array(taskRef).optional(),
+  fields: z.array(z.enum(TASK_QUERY_TASK_FIELDS)).optional().describe("Omit to read every field. A task's output is read with task_output."),
+  catalog: z.boolean().optional().describe("Also return every runner with its models, thinking-effort variants and modes.")
+}).refine((q) => (q.tasks?.length ?? 0) > 0 || q.catalog === true, { message: "Name at least one task, or set catalog: true." });
+var taskOutputInput = z.object({
+  task: taskRef,
+  lines: z.number().int().min(1).optional().describe(`How many lines to return; the default is 80 and anything over ${OUTPUT_LINES_MAX} is cut to ${OUTPUT_LINES_MAX}.`),
+  since: z.number().int().min(0).optional().describe("A previous answer's nextOffset: return only what came after it.")
+});
+function checkpointReply(answer2) {
+  switch (answer2.kind) {
+    case "continue":
+      return { text: "continue" };
+    case "rejected":
+      return { text: `rejected: ${answer2.reason}` };
+    case "withdrawn":
+      return { text: `The checkpoint was withdrawn: ${answer2.why}`, isError: true };
+  }
+}
+function tool(name, description, input, pick, annotations) {
+  return {
+    name,
+    description,
+    inputSchema: { ...z.toJSONSchema(input, { io: "input" }), type: "object" },
+    ...annotations ? { annotations } : {},
+    async call(handler, args, context) {
+      const run = pick(handler);
+      if (!run) return { text: `${name} is not available in this session.`, isError: true };
+      const parsed = input.safeParse(args ?? {});
+      if (!parsed.success) return { text: `Invalid ${name} arguments: ${z.prettifyError(parsed.error)}`, isError: true };
+      return run(parsed.data, context);
+    }
+  };
+}
+var TASK_TOOLS = [
+  tool(
+    "task_complete",
+    "Report that this task has ended, and how. Call it once, as your last action.",
+    taskCompleteInput,
+    (h) => h.taskComplete?.bind(h)
+  ),
+  tool(
+    "checkpoint",
+    "Ask the user a question and wait for the answer, which is this call's result.",
+    checkpointInput,
+    (h) => h.checkpoint?.bind(h)
+  )
+];
+var PLANNER_READ_ONLY = { readOnlyHint: true };
+var PLANNER_TOOLS = [
+  tool(
+    "list_runners",
+    "List the runners enabled right now, each with its modes and default mode. Call it just before submit_plan.",
+    listRunnersInput,
+    (h) => h.listRunners?.bind(h),
+    PLANNER_READ_ONLY
+  ),
+  tool(
+    "list_models",
+    "List the models a runner may use right now, with labels and thinking-effort variants.",
+    listModelsInput,
+    (h) => h.listModels?.bind(h),
+    PLANNER_READ_ONLY
+  ),
+  tool(
+    "submit_plan",
+    "Submit the whole plan. It is checked against the live runners and models; an error names the task, the field and what would be accepted.",
+    submitPlanInput,
+    (h) => h.submitPlan?.bind(h),
+    PLANNER_READ_ONLY
+  ),
+  tool(
+    "edit_plan",
+    "Change the current plan with task operations: update, add, remove, reorder, merge, split or rearm.",
+    editPlanInput,
+    (h) => h.editPlan?.bind(h),
+    PLANNER_READ_ONLY
+  ),
+  tool(
+    "task_query",
+    "Read the long fields of plan tasks that the plan summary leaves out (prompt, user steps, verdict, output summary), and optionally the live runner catalog. Read a task before you rewrite it.",
+    taskQueryInput,
+    (h) => h.taskQuery?.bind(h),
+    PLANNER_READ_ONLY
+  ),
+  tool(
+    "task_output",
+    "Read the recent output of a running task, to check what its runner is doing; paged by offset. A task that is not running answers with its verdict, output summary and a digest of its last attempt.",
+    taskOutputInput,
+    (h) => h.taskOutput?.bind(h),
+    PLANNER_READ_ONLY
+  )
+];
+
+// src/services/mcp/OrdewellMcpServer.ts
+var ORDEWELL_MCP_PATH = "/mcp";
+var DEFAULT_HEARTBEAT_MS = 3e4;
+var OrdewellMcpServer = class {
+  grants = /* @__PURE__ */ new Map();
+  http;
+  listening;
+  boundUrl;
+  boundHost;
+  heartbeatMs;
+  constructor(options = {}) {
+    this.heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
+  }
+  /** The listener's URL, once the first token has started it. */
+  get url() {
+    return this.boundUrl;
+  }
+  issueTaskToken(scope, handler = {}) {
+    return this.issue({ role: "task", scope: { ...scope }, handler, revoked: new AbortController() });
+  }
+  issuePlannerToken(scope, handler = {}) {
+    return this.issue({ role: "planner", scope: { ...scope }, handler, revoked: new AbortController() });
+  }
+  /** Refuse every later request carrying `token`, and abort the calls it has in flight. */
+  revoke(token) {
+    const grant = this.grants.get(token);
+    if (!grant) return;
+    this.grants.delete(token);
+    grant.revoked.abort();
+  }
+  async dispose() {
+    for (const token of [...this.grants.keys()]) this.revoke(token);
+    const http = this.http;
+    this.http = void 0;
+    this.listening = void 0;
+    this.boundUrl = void 0;
+    this.boundHost = void 0;
+    if (!http) return;
+    http.closeAllConnections();
+    await new Promise((resolve7) => http.close(() => resolve7()));
+  }
+  async issue(grant) {
+    const url = await this.start();
+    const token = randomBytes4(32).toString("base64url");
+    this.grants.set(token, grant);
+    return { url, token };
+  }
+  start() {
+    this.listening ??= new Promise((resolve7, reject) => {
+      const http = createServer((req, res) => {
+        this.handle(req, res).catch(() => {
+          if (!res.headersSent) reply(res, 500, "Internal error");
+          else res.destroy();
+        });
+      });
+      http.once("error", (err) => {
+        this.listening = void 0;
+        reject(err);
+      });
+      http.listen(0, "127.0.0.1", () => {
+        const address = http.address();
+        if (address === null || typeof address === "string") {
+          reject(new Error("Ordewell MCP server bound to no TCP port"));
+          return;
+        }
+        this.boundHost = `127.0.0.1:${address.port}`;
+        this.boundUrl = `http://${this.boundHost}${ORDEWELL_MCP_PATH}`;
+        resolve7(this.boundUrl);
+      });
+      http.unref();
+      this.http = http;
+    });
+    return this.listening;
+  }
+  async handle(req, res) {
+    if (req.headers.host !== this.boundHost || req.headers.origin !== void 0) {
+      reply(res, 403, "Forbidden");
+      return;
+    }
+    const token = extractPresentedToken({ authorization: req.headers.authorization });
+    const grant = token === void 0 ? void 0 : this.grants.get(token);
+    if (!grant) {
+      reply(res, 401, "Unauthorized");
+      return;
+    }
+    if (new URL(req.url ?? "/", `http://${this.boundHost}`).pathname !== ORDEWELL_MCP_PATH) {
+      reply(res, 404, "Not found");
+      return;
+    }
+    const mcp = new McpProtocolServer({ name: "ordewell", version: "1" }, { capabilities: { tools: {} } });
+    if (grant.role === "task") serveTools(mcp, TASK_TOOLS, grant.handler, grant.revoked.signal, this.heartbeatMs);
+    else serveTools(mcp, PLANNER_TOOLS, grant.handler, grant.revoked.signal, this.heartbeatMs);
+    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+    res.on("close", () => {
+      void transport.close();
+      void mcp.close();
+    });
+    await mcp.connect(transport);
+    await transport.handleRequest(req, res);
+  }
+};
+function serveTools(mcp, tools, handler, revoked, heartbeatMs) {
+  mcp.setRequestHandler(ListToolsRequestSchema, () => ({
+    tools: tools.map(({ name, description, inputSchema, annotations }) => ({ name, description, inputSchema, ...annotations ? { annotations } : {} }))
+  }));
+  mcp.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+    const tool2 = tools.find((t) => t.name === request.params.name);
+    if (!tool2) throw new McpError(ErrorCode.InvalidParams, `Unknown tool: ${request.params.name}`);
+    const progressToken = request.params._meta?.progressToken;
+    let beats = 0;
+    const heartbeat = progressToken === void 0 ? void 0 : setInterval(() => {
+      beats += 1;
+      extra.sendNotification({ method: "notifications/progress", params: { progressToken, progress: beats } }).catch(() => void 0);
+    }, heartbeatMs);
+    try {
+      const result = await tool2.call(handler, request.params.arguments, { signal: AbortSignal.any([revoked, extra.signal]) });
+      return { content: [{ type: "text", text: result.text }], isError: result.isError ?? false };
+    } catch (err) {
+      return { content: [{ type: "text", text: err instanceof Error ? err.message : String(err) }], isError: true };
+    } finally {
+      clearInterval(heartbeat);
+    }
+  });
+}
+function reply(res, status, message) {
+  res.writeHead(status, { "content-type": "text/plain" }).end(message);
+}
+var shared;
+function sharedMcpServer() {
+  shared ??= new OrdewellMcpServer();
+  return shared;
+}
+
+// src/services/mcp/clientConfig.ts
+import { mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { tmpdir } from "os";
+import { join as join14 } from "path";
+var ORDEWELL_MCP_SERVER_NAME = "ordewell";
+function mcpClientConfig(credential) {
+  return {
+    name: ORDEWELL_MCP_SERVER_NAME,
+    url: credential.url,
+    headers: { Authorization: bearerHeaderValue(credential.token) }
+  };
+}
+function ownerOnlyConfigFile(fileName, contents) {
+  const dir = mkdtempSync(join14(tmpdir(), "ordewell-mcp-"));
+  const path26 = join14(dir, fileName);
+  writeFileSync3(path26, contents, { mode: 384 });
+  return { path: path26, remove: () => rmSync2(dir, { recursive: true, force: true }) };
+}
+
 // src/services/harness/ClaudeCodeAdapter.ts
 var DISALLOWED_TOOLS = ["Edit", "Write", "MultiEdit", "NotebookEdit", "KillShell"];
 var TASK_DISALLOWED_TOOLS = ["AskUserQuestion"];
@@ -11797,7 +12449,10 @@ var PROTOCOL_ARGS = [
 ];
 var ASYNC_LAUNCH_MARKER = "Async agent launched successfully";
 var FOLLOW_ON_TURN_GRACE_MS = 5e3;
+var MCP_ATTACH_TIMEOUT_MS = 1e4;
+var MCP_STATUS_POLL_MS = 100;
 var DEFAULT_DENIAL = "Denied in Ordewell. Continue without it, or say what you need.";
+var ORDEWELL_TASK_TOOLS = ["task_complete", "checkpoint"];
 var SUBAGENT_TOOLS = /* @__PURE__ */ new Set(["Agent", "Task"]);
 function usageRecord(usage, model, subagentId) {
   const record = {
@@ -11830,10 +12485,16 @@ function flattenContent(content) {
   }
   return "";
 }
+function editDiff(result) {
+  if (!result || typeof result !== "object") return "";
+  const { type, content, structuredPatch } = result;
+  if (type === "create" && typeof content === "string") return markedLines(content, "+");
+  return structuredPatchText(structuredPatch);
+}
 var ClaudeCodeAdapter = class extends StdioAgentAdapter {
   agentId = "claude-code";
-  interruptCount = 0;
-  /** Interrupts sent and not yet acknowledged, by request id. */
+  controlCount = 0;
+  /** Control requests sent and not yet answered, by request id. */
   pendingControl = /* @__PURE__ */ new Map();
   /** An interrupt was sent during the current turn, so an aborted result is that interrupt, not a failure. */
   interruptRequested = false;
@@ -11872,6 +12533,10 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
   requestedMode = null;
   /** The session `--resume` asked for, until the CLI's `init` shows it was taken up. */
   pendingResume = null;
+  /** The `--mcp-config` file of the running process, which holds its token; removed with the process. */
+  mcpConfig = null;
+  /** `mcp__ordewell__`, once this process was given the server. */
+  ordewellToolPrefix = null;
   spawnSpec(opts) {
     if (opts.kind === "task") return this.taskSpawnSpec(opts);
     const args = [
@@ -11884,6 +12549,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
       "--append-system-prompt",
       opts.systemPrompt
     ];
+    if (opts.mcp) args.push(...this.ordewellServerArgs(opts.mcp, PLANNER_TOOLS.map((t) => t.name)));
     if (opts.model) args.push("--model", opts.model);
     if (opts.effort && opts.effort !== "adaptive") args.push("--effort", opts.effort);
     if (opts.resumeSessionId) {
@@ -11919,30 +12585,78 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
       this.reportedCostUsd = void 0;
       this.pendingResume = opts.resumeSessionId;
     }
+    if (opts.mcp) args.push(...this.ordewellServerArgs(opts.mcp, ORDEWELL_TASK_TOOLS));
     return { command: "claude", args };
   }
+  /**
+   * `--mcp-config` takes a path as well as inline JSON; the path keeps the
+   * token out of the argv every local user can list (ADR-0022, A5). The file
+   * lives exactly as long as the process that reads it. `alwaysLoad` because
+   * the CLI otherwise defers MCP tools behind its tool search, and a model
+   * that has to look an Ordewell tool up first tends to go on without it.
+   */
+  ordewellServerArgs(mcp, tools) {
+    this.removeMcpConfig();
+    const config = { mcpServers: { [mcp.name]: { type: "http", url: mcp.url, headers: mcp.headers, alwaysLoad: true } } };
+    const file = ownerOnlyConfigFile("mcp.json", JSON.stringify(config));
+    this.mcpConfig = file;
+    void this.processEnded.then(() => file.remove());
+    const prefix = `mcp__${mcp.name}__`;
+    this.ordewellToolPrefix = prefix;
+    return ["--mcp-config", file.path, "--allowedTools", tools.map((tool2) => `${prefix}${tool2}`).join(",")];
+  }
+  removeMcpConfig() {
+    this.mcpConfig?.remove();
+    this.mcpConfig = null;
+  }
+  async start(opts) {
+    try {
+      await super.start(opts);
+    } catch (err) {
+      this.removeMcpConfig();
+      throw err;
+    }
+  }
+  /** Asks the CLI itself, which reports `pending` until its connection attempt settles. */
+  async mcpAttached() {
+    if (!this.mcpConfig) return false;
+    const deadline = Date.now() + MCP_ATTACH_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      const answer2 = await this.control({ subtype: "mcp_status" }, deadline - Date.now());
+      const status = answer2?.response?.mcpServers?.find((s) => s.name === ORDEWELL_MCP_SERVER_NAME)?.status;
+      if (status === "connected") return true;
+      if (status !== "pending") return false;
+      await new Promise((resolve7) => setTimeout(resolve7, MCP_STATUS_POLL_MS));
+    }
+    return false;
+  }
   /**
    * Claude Code's soft interrupt: the turn stops, the process and its session
    * stay. The CLI acknowledges on the control channel, then closes the turn
    * with an `error_during_execution` result, which {@link handleLine} reports
    * as an interrupted `turn_end`.
    */
-  interrupt(timeoutMs) {
-    if (!this.process) return Promise.resolve(false);
-    this.interruptCount += 1;
-    const requestId = `ordewell-interrupt-${this.interruptCount}`;
+  async interrupt(timeoutMs) {
+    if (!this.process) return false;
     this.interruptRequested = true;
+    return (await this.control({ subtype: "interrupt" }, timeoutMs))?.subtype === "success";
+  }
+  /** Send a control request and wait for its answer; null when none came in time or the process ended. */
+  control(request, timeoutMs) {
+    if (!this.process) return Promise.resolve(null);
+    this.controlCount += 1;
+    const requestId = `ordewell-${request.subtype}-${this.controlCount}`;
     return new Promise((resolve7) => {
-      const settle = (ok) => {
+      const settle = (response) => {
         if (!this.pendingControl.delete(requestId)) return;
         clearTimeout(timer);
-        resolve7(ok);
+        resolve7(response);
       };
-      const timer = setTimeout(() => settle(false), timeoutMs);
+      const timer = setTimeout(() => settle(null), timeoutMs);
       timer.unref?.();
       this.pendingControl.set(requestId, settle);
-      void this.processEnded.then(() => settle(false));
-      this.writeLine({ type: "control_request", request_id: requestId, request: { subtype: "interrupt" } });
+      void this.processEnded.then(() => settle(null));
+      this.writeLine({ type: "control_request", request_id: requestId, request });
     });
   }
   /**
@@ -11977,6 +12691,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
   }
   dispose() {
     this.clearFollowOnTimer();
+    this.removeMcpConfig();
     super.dispose();
   }
   clearFollowOnTimer() {
@@ -12027,12 +12742,18 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
           emit({ type: "permission_request", id, name: msg.request.tool_name ?? "unknown", detail: JSON.stringify(input) });
           return;
         }
+        const name = msg.request.tool_name ?? "unknown";
+        if (this.ordewellToolPrefix && name.startsWith(this.ordewellToolPrefix)) {
+          this.writeLine({ type: "control_response", response: { subtype: "success", request_id: id, response: { behavior: "allow", updatedInput: input } } });
+          emit({ type: "permission_request", id, name, detail: JSON.stringify(input), input, decided: { decision: "allow" } });
+          return;
+        }
         const suggestions = msg.request.permission_suggestions ?? [];
         this.openPermissions.set(id, { input, suggestions });
         emit({
           type: "permission_request",
           id,
-          name: msg.request.tool_name ?? "unknown",
+          name,
           detail: JSON.stringify(input),
           input,
           suggestions,
@@ -12048,7 +12769,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
       }
       case "control_response": {
         const requestId = msg.response?.request_id;
-        if (requestId) this.pendingControl.get(requestId)?.(msg.response?.subtype === "success");
+        if (requestId) this.pendingControl.get(requestId)?.(msg.response ?? null);
         return;
       }
       case "assistant":
@@ -12076,6 +12797,7 @@ ${block.text}` : block.text });
           if (block.type !== "tool_result") continue;
           const id = block.tool_use_id ?? "";
           const output = flattenContent(block.content);
+          const diff = block.is_error === true ? "" : editDiff(msg.tool_use_result);
           const subagent = subagentId ? void 0 : this.openSubagents.get(id);
           if (!subagentId && output.includes(ASYNC_LAUNCH_MARKER)) {
             emit({ type: "background_agent", id });
@@ -12083,7 +12805,7 @@ ${block.text}` : block.text });
           } else if (subagent) {
             this.finishForegroundSubagent(id, msg.tool_use_result, output, block.is_error === true, emit);
           }
-          emit({ type: "tool_result", id, name: "", output, success: block.is_error !== true, subagentId });
+          emit({ type: "tool_result", id, name: "", output: diff || output, success: block.is_error !== true, subagentId });
         }
         return;
       case "system":
@@ -12219,6 +12941,9 @@ ${block.text}` : block.text });
   }
 };
 
+// src/services/harness/CodexAdapter.ts
+import { isAbsolute as isAbsolute4, relative as relative4, sep as sep2 } from "path";
+
 // src/services/harness/codexSandbox.ts
 var PROBE_TIMEOUT_MS = 1e4;
 var USERNS_FAILURE = /bwrap|bubblewrap|user namespace|RTM_NEWADDR/i;
@@ -12278,6 +13003,17 @@ function runProbe(deps, cwd, env, flags) {
 
 // src/services/harness/CodexAdapter.ts
 var HANDSHAKE_TIMEOUT_MS = 3e4;
+var MCP_ATTACH_TIMEOUT_MS2 = 1e4;
+var CHANGE_NAMES = { add: "Add", update: "Update", delete: "Delete" };
+function changeName(change) {
+  return CHANGE_NAMES[change.kind?.type ?? ""] ?? "file_change";
+}
+function changeDiff(change) {
+  const diff = change.diff ?? "";
+  if (change.kind?.type === "add") return markedLines(diff, "+");
+  if (change.kind?.type === "delete") return markedLines(diff, "-");
+  return diff;
+}
 function subagentOutcome(status) {
   switch (status) {
     case "completed":
@@ -12311,7 +13047,29 @@ var DECLINE_RESULTS = {
   execCommandApproval: { decision: "denied" },
   applyPatchApproval: { decision: "denied" }
 };
-var REVIEW_DECISIONS = { allow: "accept", allowForTask: "acceptForSession", deny: "decline" };
+function shownToolName(item) {
+  const tool2 = item.tool ?? "mcp_tool";
+  return item.server === ORDEWELL_MCP_SERVER_NAME ? `mcp__${ORDEWELL_MCP_SERVER_NAME}__${tool2}` : tool2;
+}
+function mcpHeaderEnv(mcp) {
+  return Object.fromEntries(Object.keys(mcp.headers).map((header, i) => [header, `ORDEWELL_MCP_TOKEN_${i}`]));
+}
+function ordewellServerConfig(mcp) {
+  return {
+    url: mcp.url,
+    env_http_headers: mcpHeaderEnv(mcp),
+    default_tools_approval_mode: "approve"
+  };
+}
+var TASK_TOOLS_NOTE = [
+  "This task has two tools from the `ordewell` MCP server: `task_complete` and `checkpoint`.",
+  "They are not in your tool list up front. Find them with the tool discovery you have (the `exec` tool's `ALL_TOOLS` list) and call them by their full names, `mcp__ordewell__task_complete` and `mcp__ordewell__checkpoint`.",
+  "Look for them before you finish; the task is reported complete through `task_complete`."
+].join(" ");
+function isOrdewellElicitation(method, params) {
+  return method === "mcpServer/elicitation/request" && params.serverName === ORDEWELL_MCP_SERVER_NAME;
+}
+var REVIEW_DECISIONS = { allow: "accept", allowForTask: "acceptForSession", deny: "decline" };
 var TASK_APPROVALS = {
   "item/commandExecution/requestApproval": {
     name: "shell",
@@ -12385,11 +13143,16 @@ var CodexAdapter = class extends StdioAgentAdapter {
    * names only the item, and a person deciding needs to see the files.
    */
   fileChangePaths = /* @__PURE__ */ new Map();
+  /** The row each announced file of an in-flight `fileChange` item is shown under, by the file's shown path. */
+  fileChangeRows = /* @__PURE__ */ new Map();
   /** Requests this adapter sent and awaits an answer to, by JSON-RPC id. */
   pendingRequests = /* @__PURE__ */ new Map();
   resumeAttempted = false;
   resumeFallbackSent = false;
   sandbox = "default";
+  /** The Ordewell server's startup state, as Codex last reported it for this thread. */
+  mcpStartup = null;
+  mcpStartupSettled = null;
   /**
    * Subagent threads this session has spawned, keyed by the child thread id.
    * Codex runs a subagent in its own thread and replays both threads' events on
@@ -12398,7 +13161,9 @@ var CodexAdapter = class extends StdioAgentAdapter {
   subagents = /* @__PURE__ */ new Map();
   spawnSpec(opts) {
     this.startOpts = opts;
-    return { command: "codex", args: ["app-server"] };
+    const headers = opts.mcp ? mcpHeaderEnv(opts.mcp) : {};
+    const env = Object.fromEntries(Object.entries(headers).map(([header, name]) => [name, opts.mcp.headers[header]]));
+    return { command: "codex", args: ["app-server"], ...opts.mcp ? { env } : {} };
   }
   /**
    * `initialize`, then `thread/start`, both before the first user message. A
@@ -12465,7 +13230,11 @@ ${this.exitMessage()}`);
       cwd: opts?.cwd,
       ...opts?.model ? { model: opts.model } : {}
     };
-    const legacyLandlock = this.sandbox === "legacy-landlock" ? { config: { features: { use_legacy_landlock: true } } } : {};
+    const config = {
+      ...this.sandbox === "legacy-landlock" ? { features: { use_legacy_landlock: true } } : {},
+      ...opts?.mcp ? { mcp_servers: { [opts.mcp.name]: ordewellServerConfig(opts.mcp) } } : {}
+    };
+    const threadConfig = Object.keys(config).length ? { config } : {};
     if (opts?.kind === "task") {
       const { approvalPolicy, approvalsReviewer } = opts.flags.modeSettings;
       return {
@@ -12473,14 +13242,15 @@ ${this.exitMessage()}`);
         sandbox: opts.flags.permissionMode,
         ...approvalPolicy ? { approvalPolicy } : {},
         ...approvalsReviewer ? { approvalsReviewer } : {},
-        ...legacyLandlock
+        ...opts.mcp ? { developerInstructions: TASK_TOOLS_NOTE } : {},
+        ...threadConfig
       };
     }
     return {
       ...common,
       sandbox: "read-only",
       approvalPolicy: "never",
-      ...legacyLandlock,
+      ...threadConfig,
       // `developerInstructions` layers on top of Codex's own base prompt, the
       // way Claude Code's `--append-system-prompt` does. `baseInstructions`
       // replaces it — which takes Codex's description of its own tools with
@@ -12489,6 +13259,32 @@ ${this.exitMessage()}`);
       developerInstructions: opts?.systemPrompt
     };
   }
+  /**
+   * Codex's own startup report for the server, which it sends once the thread
+   * has tried to connect (ADR-0022, S4). A report that came before this was
+   * asked is kept, so asking late still gets the answer.
+   */
+  async mcpAttached() {
+    if (!this.startOpts?.mcp || !this.process) return false;
+    const deadline = Date.now() + MCP_ATTACH_TIMEOUT_MS2;
+    while (this.mcpStartup === null || this.mcpStartup === "starting") {
+      const left = deadline - Date.now();
+      if (left <= 0) return false;
+      const ended = await Promise.race([
+        new Promise((resolve7) => {
+          this.mcpStartupSettled = () => resolve7(false);
+        }),
+        this.processEnded.then(() => true),
+        new Promise((resolve7) => {
+          const t = setTimeout(() => resolve7(false), left);
+          t.unref?.();
+        })
+      ]);
+      this.mcpStartupSettled = null;
+      if (ended) return false;
+    }
+    return this.mcpStartup === "ready";
+  }
   effort() {
     const opts = this.startOpts;
     return opts?.kind === "task" ? opts.flags.effort : opts?.effort;
@@ -12660,6 +13456,13 @@ ${this.exitMessage()}`);
         if (this.openPermissions.delete(id)) emit({ type: "permission_cancelled", id });
         return;
       }
+      case "mcpServer/startupStatus/updated": {
+        const startup = msg.params;
+        if (startup?.name !== ORDEWELL_MCP_SERVER_NAME || !startup.status) return;
+        this.mcpStartup = startup.status;
+        this.mcpStartupSettled?.();
+        return;
+      }
       case "thread/tokenUsage/updated":
         this.emitUsage(msg.params, emit);
         return;
@@ -12798,6 +13601,10 @@ ${this.exitMessage()}`);
     const method = msg.method;
     const params = msg.params ?? {};
     const approval = TASK_APPROVALS[method];
+    if (isOrdewellElicitation(method, params)) {
+      this.writeLine({ jsonrpc: "2.0", id: msg.id, result: { action: "accept", content: {} } });
+      return;
+    }
     if (approval && (method !== "mcpServer/elicitation/request" || isYesNoElicitation(params))) {
       const id = String(msg.id);
       const input = this.approvalInput(method, params);
@@ -12838,6 +13645,10 @@ ${this.exitMessage()}`);
    */
   answerServerRequest(msg, emit) {
     const method = msg.method;
+    if (isOrdewellElicitation(method, msg.params ?? {})) {
+      this.writeLine({ jsonrpc: "2.0", id: msg.id, result: { action: "accept", content: {} } });
+      return;
+    }
     const result = DECLINE_RESULTS[method];
     if (result) {
       this.writeLine({ jsonrpc: "2.0", id: msg.id, result });
@@ -12864,7 +13675,7 @@ ${this.exitMessage()}`);
         emit({ type: "tool_call", id: item.id, name: "shell", args: { command: item.command, cwd: item.cwd }, ...subagentId ? { subagentId } : {} });
         return;
       case "mcpToolCall":
-        emit({ type: "tool_call", id: item.id, name: item.tool ?? "mcp_tool", args: item.arguments ?? {}, ...subagentId ? { subagentId } : {} });
+        emit({ type: "tool_call", id: item.id, name: shownToolName(item), args: item.arguments ?? {}, ...subagentId ? { subagentId } : {} });
         return;
       case "dynamicToolCall":
         emit({ type: "tool_call", id: item.id, name: item.tool ?? "tool", args: item.arguments ?? {}, ...subagentId ? { subagentId } : {} });
@@ -12876,7 +13687,7 @@ ${this.exitMessage()}`);
         const paths = (item.changes ?? []).map((change) => change.path).filter((path26) => !!path26);
         this.fileChangePaths.set(item.id, paths);
         if (this.startOpts?.kind === "task") {
-          emit({ type: "tool_call", id: item.id, name: "file_change", args: { path: paths.join(", ") }, ...subagentId ? { subagentId } : {} });
+          for (const change of item.changes ?? []) this.announceFileChange(item.id, change, emit, subagentId);
         }
         return;
       }
@@ -12933,7 +13744,7 @@ ${item.text}` : item.text });
         emit({
           type: "tool_result",
           id,
-          name: item.tool ?? "tool",
+          name: item.type === "mcpToolCall" ? shownToolName(item) : item.tool ?? "tool",
           output: item.error ?? flattenText(item.result) ?? "",
           success: item.status !== "error" && item.success !== false && !item.error,
           ...subagentId ? { subagentId } : {}
@@ -12947,8 +13758,11 @@ ${item.text}` : item.text });
       case "fileChange":
         this.fileChangePaths.delete(id);
         if (this.startOpts?.kind === "task") {
-          const diff = (item.changes ?? []).map((change) => change.diff ?? "").join("\n");
-          emit({ type: "tool_result", id, name: "file_change", output: diff, success: item.status === "completed", ...subagentId ? { subagentId } : {} });
+          for (const change of item.changes ?? []) {
+            const row = this.announceFileChange(id, change, emit, subagentId);
+            emit({ type: "tool_result", id: row, name: changeName(change), output: changeDiff(change), success: item.status === "completed", ...subagentId ? { subagentId } : {} });
+          }
+          this.fileChangeRows.delete(id);
           return;
         }
         emit({ type: "tool_result", id, name: "file_change", output: JSON.stringify(item), success: false, ...subagentId ? { subagentId } : {} });
@@ -12957,6 +13771,34 @@ ${item.text}` : item.text });
         return;
     }
   }
+  /**
+   * One row per changed file: a patch is several files, and one row naming
+   * them all reads as a single cut-off path. The first file keeps the item's
+   * id, which an approval for the patch points at. Announcing a file twice
+   * returns the row it already has, so a change first seen completed still
+   * gets its call.
+   */
+  announceFileChange(itemId, change, emit, subagentId) {
+    const rows = this.fileChangeRows.get(itemId) ?? /* @__PURE__ */ new Map();
+    this.fileChangeRows.set(itemId, rows);
+    const path26 = this.shownChangePath(change);
+    const known = rows.get(path26);
+    if (known) return known;
+    const row = rows.size === 0 ? itemId : `${itemId}:${path26}`;
+    rows.set(path26, row);
+    emit({ type: "tool_call", id: row, name: changeName(change), args: { path: path26 }, ...subagentId ? { subagentId } : {} });
+    return row;
+  }
+  /** Relative to the task's worktree, where every path but a stray one lies; a move names both ends. */
+  shownChangePath(change) {
+    const shown = (path26) => {
+      const cwd = this.startOpts?.cwd;
+      const rel = cwd ? relative4(cwd, path26) : path26;
+      return rel && rel !== ".." && !rel.startsWith(`..${sep2}`) && !isAbsolute4(rel) ? rel : path26;
+    };
+    const from = shown(change.path ?? "");
+    return change.kind?.move_path ? `${from} \u2192 ${shown(change.kind.move_path)}` : from;
+  }
   /**
    * A `collabAgentToolCall` — the planner spawning, waiting on or messaging a
    * subagent. The call itself is planner-level tool activity; the lifecycle it
@@ -12996,7 +13838,45 @@ ${item.text}` : item.text });
 };
 
 // src/services/harness/OpenCodeAdapter.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes5 } from "crypto";
+
+// src/services/harness/openCodeOrdewell.ts
+function ordewellToolPrefix(mcp) {
+  return `${mcp.name}_`;
+}
+function isOrdewellTool(mcp, permission) {
+  return !!mcp && !!permission && permission.startsWith(ordewellToolPrefix(mcp));
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function deepMerge(base, over) {
+  const merged = { ...base };
+  for (const [key, value] of Object.entries(over)) {
+    const current = merged[key];
+    merged[key] = isRecord(current) && isRecord(value) ? deepMerge(current, value) : value;
+  }
+  return merged;
+}
+function mergeOrdewellConfig(existing, mcp) {
+  let base = {};
+  if (existing?.trim()) {
+    let parsed;
+    try {
+      parsed = JSON.parse(existing);
+    } catch {
+      return null;
+    }
+    if (!isRecord(parsed)) return null;
+    base = parsed;
+  }
+  const policy = typeof base.permission === "string" ? { "*": base.permission } : base.permission;
+  const ours = {
+    mcp: { [mcp.name]: { type: "remote", url: mcp.url, headers: mcp.headers, enabled: true } },
+    permission: { [`${ordewellToolPrefix(mcp)}*`]: "allow" }
+  };
+  return JSON.stringify(deepMerge({ ...base, ...policy === void 0 ? {} : { permission: policy } }, ours));
+}
 
 // src/services/harness/OpenCodeV2.ts
 var STREAM_CONNECT_TIMEOUT_MS = 5e3;
@@ -13079,12 +13959,16 @@ var OpenCodeV2 = class {
     const created = await this.host.json("POST", "/api/session", {
       agent: this.agent,
       ...this.model ? { model: this.model } : {},
-      permissions: this.role === "planner" ? PLANNER_RULES : TASK_RULES
+      permissions: [...this.role === "planner" ? PLANNER_RULES : TASK_RULES, ...this.ordewellRules()]
     });
     if (!created?.data?.id) throw new Error(`The OpenCode ${this.role} server did not return a session id.`);
     this.sessionId = created.data.id;
     await this.applyInstructions();
   }
+  /** Allow the Ordewell server's tools, so a call never waits on a person (ADR-0022, S3). */
+  ordewellRules() {
+    return this.opts.mcp ? [{ action: `${ordewellToolPrefix(this.opts.mcp)}*`, resource: "*", effect: "allow" }] : [];
+  }
   /** The planner's system prompt rides on the session as an instruction entry — a prompt has no system field. */
   async applyInstructions() {
     if (this.opts.kind !== "planner" || !this.opts.systemPrompt) return;
@@ -13222,8 +14106,8 @@ var OpenCodeV2 = class {
     });
     return true;
   }
-  async replyPermission(id, sessionId, reply) {
-    await this.host.request("POST", `/api/session/${sessionId}/permission/${id}/reply`, reply);
+  async replyPermission(id, sessionId, reply2) {
+    await this.host.request("POST", `/api/session/${sessionId}/permission/${id}/reply`, reply2);
   }
   async openStream(state, turn, onEvent, onActivity) {
     const streamAbort = new AbortController();
@@ -13463,6 +14347,11 @@ var OpenCodeV2 = class {
     const request = this.permissionRequest(ask);
     if (!request || state.seen.has(`perm:${request.id}`)) return;
     state.seen.add(`perm:${request.id}`);
+    if (isOrdewellTool(this.opts.mcp, request.name)) {
+      void this.replyPermission(request.id, session, { decision: "once" }).catch(() => {
+      });
+      return;
+    }
     onEvent(request);
     void this.replyPermission(request.id, session, { decision: "reject" }).catch(() => {
     });
@@ -13478,7 +14367,7 @@ var OpenCodeV2 = class {
     const request = this.permissionRequest(ask);
     if (!request || state.seen.has(`perm:${request.id}`)) return;
     state.seen.add(`perm:${request.id}`);
-    if (this.opts.kind === "task" && this.opts.flags.modeSettings.approvals === AUTO_APPROVALS) {
+    if (isOrdewellTool(this.opts.mcp, request.name) || this.opts.kind === "task" && this.opts.flags.modeSettings.approvals === AUTO_APPROVALS) {
       onEvent({ ...request, decided: { decision: "allow" } });
       void this.replyPermission(request.id, session, { decision: "once" }).catch(() => {
       });
@@ -13497,6 +14386,8 @@ var RECOVERY_POLL_INTERVAL_MS = 2e3;
 var RECOVERY_TIMEOUT_MS = 9e5;
 var STATUS_POLL_INTERVAL_MS = 1e3;
 var SERVER_USERNAME = "opencode";
+var MCP_ATTACH_TIMEOUT_MS3 = 1e4;
+var MCP_STATUS_POLL_MS2 = 200;
 var DISABLED_TOOLS = {
   question: false,
   edit: false,
@@ -13562,6 +14453,12 @@ function unwrapFileToolOutput(output) {
   const inner = output.match(/<content>\n?([\s\S]*?)\n?<\/content>/);
   return inner ? inner[1] : output;
 }
+function editDiff2(tool2, state) {
+  const { diff, exists } = state?.metadata ?? {};
+  if (typeof diff === "string" && diff) return hunksOf(diff);
+  const content = state?.input?.content;
+  return tool2 === "write" && exists === false && typeof content === "string" ? markedLines(content, "+") : "";
+}
 function delay2(ms, signal) {
   return new Promise((resolve7) => {
     const timer = setTimeout(resolve7, ms);
@@ -13614,6 +14511,8 @@ var OpenCodeAdapter = class {
   openPermissions = /* @__PURE__ */ new Map();
   /** Set once the server turns out to speak the 2.x API, which then owns the session. */
   v2 = null;
+  /** The Ordewell server this process was configured with; null when none was given or its config could not be merged. */
+  ordewell = null;
   async start(opts) {
     if (opts.kind === "task") this.task = opts;
     else this.planner = opts;
@@ -13628,9 +14527,19 @@ var OpenCodeAdapter = class {
       throw new ExecutableNotFoundError("opencode", PATH);
     }
     const workspaceEnv = await (this.deps.workspaceEnv ?? workspaceEnvOf)(opts.cwd);
-    const password = randomBytes2(24).toString("base64url");
+    const password = randomBytes5(24).toString("base64url");
+    const ordewellConfig = opts.mcp ? mergeOrdewellConfig(workspaceEnv.OPENCODE_CONFIG_CONTENT ?? process.env.OPENCODE_CONFIG_CONTENT, opts.mcp) : null;
+    if (opts.mcp && ordewellConfig === null) {
+      console.error("[opencode] OPENCODE_CONFIG_CONTENT is not a JSON object, so the Ordewell tools were not injected.");
+    }
+    this.ordewell = ordewellConfig === null ? null : opts.mcp ?? null;
     this.process = this.deps.spawn(launch.file, launch.args, {
-      env: runnerEnv(PATH, { ...workspaceEnv, OPENCODE_SERVER_USERNAME: SERVER_USERNAME, OPENCODE_SERVER_PASSWORD: password }),
+      env: runnerEnv(PATH, {
+        ...workspaceEnv,
+        ...ordewellConfig === null ? {} : { OPENCODE_CONFIG_CONTENT: ordewellConfig },
+        OPENCODE_SERVER_USERNAME: SERVER_USERNAME,
+        OPENCODE_SERVER_PASSWORD: password
+      }),
       stdio: ["pipe", "pipe", "pipe"],
       cwd: opts.cwd,
       windowsVerbatimArguments: launch.verbatim
@@ -13680,7 +14589,7 @@ ${this.stderrTail.trim()}` : ""}`);
         processEnded: this.processEnded,
         isExited: () => this.exited,
         exitMessage: () => this.exitMessage()
-      }, opts, this.role());
+      }, { ...opts, mcp: this.ordewell ?? void 0 }, this.role());
       try {
         await this.v2.start();
       } catch (err) {
@@ -13733,12 +14642,12 @@ ${this.stderrTail.trim()}` : ""}`);
         ...this.planner?.effort ? { variant: this.planner.effort } : {},
         ...this.planner?.systemPrompt ? { system: this.planner.systemPrompt } : {}
       };
-      const reply = await this.json("POST", `/session/${this.sessionId}/message`, body, signal);
+      const reply2 = await this.json("POST", `/session/${this.sessionId}/message`, body, signal);
       if (signal?.aborted) {
         this.dispose();
         return;
       }
-      this.settle(reply, turn, onEvent);
+      this.settle(reply2, turn, onEvent);
     } catch (err) {
       if (signal?.aborted) {
         this.dispose();
@@ -13844,13 +14753,13 @@ ${this.stderrTail.trim()}` : ""}`);
         break;
       }
     }
-    for (const reply of messages.slice(start)) {
-      const id = reply.info?.id;
-      if (reply.info?.role !== "assistant" || !id) continue;
-      for (const part of reply.parts ?? []) {
+    for (const reply2 of messages.slice(start)) {
+      const id = reply2.info?.id;
+      if (reply2.info?.role !== "assistant" || !id) continue;
+      for (const part of reply2.parts ?? []) {
         if (part.messageID === id) this.emitPart(part, turn, onEvent);
       }
-      this.countUsage(reply.info, turn, onEvent);
+      this.countUsage(reply2.info, turn, onEvent);
     }
   }
   /**
@@ -13960,18 +14869,18 @@ ${this.stderrTail.trim()}` : ""}`);
    * their text, reasoning and usage — reach Ordewell over the stream or not at
    * all.
    */
-  settle(reply, turn, onEvent) {
-    const failure = typeof reply?.error === "string" ? reply.error : reply?.error?.message ?? reply?.info?.error?.data?.message;
+  settle(reply2, turn, onEvent) {
+    const failure = typeof reply2?.error === "string" ? reply2.error : reply2?.error?.message ?? reply2?.info?.error?.data?.message;
     if (failure) {
       onEvent({ type: "error", message: failure });
       return;
     }
-    const assistantId = reply?.info?.id;
-    for (const part of reply?.parts ?? []) {
+    const assistantId = reply2?.info?.id;
+    for (const part of reply2?.parts ?? []) {
       if (part.type !== "tool" && assistantId && part.messageID !== assistantId) continue;
       this.emitPart(part, turn, onEvent);
     }
-    if (reply?.info) this.countUsage(reply.info, turn, onEvent);
+    if (reply2?.info) this.countUsage(reply2.info, turn, onEvent);
     if (assistantId) this.lastAssistantId = assistantId;
     onEvent({ type: "turn_end" });
   }
@@ -14048,7 +14957,7 @@ ${this.stderrTail.trim()}` : ""}`);
         type: "tool_result",
         id: callId,
         name,
-        output: unwrapFileToolOutput(part.state?.output ?? part.state?.error ?? ""),
+        output: status === "completed" && editDiff2(name, part.state) || unwrapFileToolOutput(part.state?.output ?? part.state?.error ?? ""),
         success: status === "completed",
         subagentId
       });
@@ -14182,6 +15091,11 @@ ${this.stderrTail.trim()}` : ""}`);
     const id = ask.id;
     if (!id || seen.has(`perm:${id}`)) return;
     seen.add(`perm:${id}`);
+    if (isOrdewellTool(this.ordewell, permissionName(ask))) {
+      void this.replyPermission(id, ask.sessionID ?? this.sessionId ?? "", { reply: "once" }).catch(() => {
+      });
+      return;
+    }
     onEvent({ type: "permission_request", id, name: permissionName(ask), detail: permissionDetail(ask) });
     void this.replyPermission(id, ask.sessionID ?? this.sessionId ?? "", { reply: "reject" }).catch(() => {
     });
@@ -14208,7 +15122,7 @@ ${this.stderrTail.trim()}` : ""}`);
       ...ask.always?.length ? { suggestions: ask.always } : {},
       ...ask.tool?.callID ? { toolUseId: ask.tool.callID } : {}
     };
-    if (this.task?.flags.modeSettings.approvals === AUTO_APPROVALS2) {
+    if (isOrdewellTool(this.ordewell, request.name) || this.task?.flags.modeSettings.approvals === AUTO_APPROVALS2) {
       onEvent({ ...request, decided: { decision: "allow" } });
       void this.replyPermission(id, sessionId, { reply: "once" }).catch(() => {
       });
@@ -14221,10 +15135,10 @@ ${this.stderrTail.trim()}` : ""}`);
    * `POST /permission/:id/reply` is the current answer. The per-session path
    * it replaced is tried only when a server too old to know the new one 404s.
    */
-  async replyPermission(id, sessionId, reply) {
-    const response = await this.request("POST", `/permission/${id}/reply`, reply);
+  async replyPermission(id, sessionId, reply2) {
+    const response = await this.request("POST", `/permission/${id}/reply`, reply2);
     if (response.status !== 404) return;
-    await this.request("POST", `/session/${sessionId}/permissions/${id}`, { response: reply.reply });
+    await this.request("POST", `/session/${sessionId}/permissions/${id}`, { response: reply2.reply });
   }
   /**
    * Open `/event` for one turn and wait until it is connected. The stream
@@ -14303,6 +15217,19 @@ ${this.stderrTail.trim()}` : ""}`);
   nativeSessionId() {
     return this.sessionId;
   }
+  /** Asks the server, which lists every MCP server it has with the state of its connection. */
+  async mcpAttached() {
+    if (!this.ordewell || !this.baseUrl) return false;
+    const deadline = Date.now() + MCP_ATTACH_TIMEOUT_MS3;
+    while (Date.now() < deadline && !this.exited) {
+      const servers = await this.json("GET", "/mcp").catch(() => null);
+      const status = servers?.[this.ordewell.name]?.status;
+      if (status === "connected") return true;
+      if (status !== void 0 && status !== "pending") return false;
+      await delay2(MCP_STATUS_POLL_MS2);
+    }
+    return false;
+  }
   dispose() {
     if (this.disposed) return;
     this.disposed = true;
@@ -14325,9 +15252,13 @@ var TASK_MODE_ADAPTERS = {
   codex: (deps) => new CodexAdapter(deps),
   opencode: (deps) => new OpenCodeAdapter(deps)
 };
+var ORDEWELL_TOOL_RUNNERS = /* @__PURE__ */ new Set(["claude-code", "codex", "opencode"]);
 function supportsTaskMode(runner) {
   return Object.hasOwn(TASK_MODE_ADAPTERS, runner);
 }
+function takesOrdewellTools(runner) {
+  return ORDEWELL_TOOL_RUNNERS.has(runner);
+}
 function createTaskAdapter(runner, deps) {
   if (!supportsTaskMode(runner)) throw new TaskModeUnsupportedError(runner);
   return TASK_MODE_ADAPTERS[runner](deps);
@@ -14340,6 +15271,9 @@ function routeTransport(requested, runner, registry) {
   const name = registry?.get(runner)?.manifest.displayName ?? runner;
   return { transport: "terminal", fallback: `no structured connector for ${name} yet` };
 }
+function givesCompletionTool(requested, runner, registry) {
+  return routeTransport(requested, runner, registry).transport === "structured" && takesOrdewellTools(runner);
+}
 var TransportRouter = class {
   constructor(runners) {
     this.runners = runners;
@@ -14462,6 +15396,11 @@ var TaskOrchestrator = class _TaskOrchestrator {
       this.emit("onTaskSettled", { taskId });
       this.emit("onCheckpoint", { taskId, taskTitle: task.title, summary });
     });
+    this.verifier.onCheckpointWithdrawn((taskId) => {
+      if (!this.atCheckpoint(taskId)) return;
+      this.store.markInProgress(taskId);
+      this.emit("onTaskChanged");
+    });
     this.verifier.onIdleChange(() => this.emit("onTaskChanged"));
   }
   /**
@@ -14548,7 +15487,7 @@ var TaskOrchestrator = class _TaskOrchestrator {
       this.notifications.warn(message);
     };
     if (resolved.blockedEnvrc) {
-      warn(`blocked:${resolved.blockedEnvrc}`, `direnv has blocked ${resolved.blockedEnvrc}, so tasks start without its variables. Run \`direnv allow\` in ${path13.dirname(resolved.blockedEnvrc)} to use them.`);
+      warn(`blocked:${resolved.blockedEnvrc}`, `direnv has blocked ${resolved.blockedEnvrc}, so tasks start without its variables. Run \`direnv allow\` in ${path14.dirname(resolved.blockedEnvrc)} to use them.`);
     }
     if (resolved.trackedEnvFile) {
       warn(`tracked:${resolved.trackedEnvFile}`, `Ignored ${resolved.trackedEnvFile}: git tracks it, and a committed file must not choose the environment agents run in. Untrack it to use it.`);
@@ -15379,17 +16318,19 @@ ${summary || "(empty \u2014 no output captured)"}`);
         this.abandonSpawn(task, attempt);
         return false;
       }
-      const finalPrompt = attempt.continuation ? composeContinuationPrompt(task, attempt.continuation.message, { ops: attempt.ops }) : composeAugmentedPrompt(attempt.repair ? { ...task, prompt: this.landing.repairPrompt(task) } : task, this.store.planTasks, {
+      const transport = attempt.continuation ? "structured" : this.planTransport ?? "terminal";
+      const completionTool = givesCompletionTool(transport, attempt.runner, this.registry);
+      const finalPrompt = attempt.continuation ? composeContinuationPrompt(task, attempt.continuation.message, { ops: attempt.ops, completionTool }) : composeAugmentedPrompt(attempt.repair ? { ...task, prompt: this.landing.repairPrompt(task) } : task, this.store.planTasks, {
         planMapEnabled: this.config.planMapEnabled,
         // A merge to resolve is not new behaviour to drive test-first.
         tddEnabled: !attempt.repair && this.tddEnabled(),
         // An ops task's effects outlive a failed attempt and are never rolled
         // back, so the next one is told what the last one did (ADR-0020).
-        previousAttempt: attempt.ops ? this.opsPreviousAttempt(task.id) : void 0
+        previousAttempt: attempt.ops ? this.opsPreviousAttempt(task.id) : void 0,
+        completionTool
       });
       this.lingering.close(task.id);
       const env = await this.envForTask(cwd);
-      const transport = attempt.continuation ? "structured" : this.planTransport ?? "terminal";
       const session = await this.terminalRunner.spawn({
         taskId: task.id,
         runner: attempt.runner,
@@ -15404,7 +16345,8 @@ ${summary || "(empty \u2014 no output captured)"}`);
         title: task.title,
         env,
         transport,
-        resumeSessionId: attempt.continuation?.resumeSessionId
+        resumeSessionId: attempt.continuation?.resumeSessionId,
+        attempt: attempt.attempt
       });
       if (this.attempts.get(task.id) !== attempt) {
         this.abandonSpawn(task, attempt, session);
@@ -15702,52 +16644,6 @@ import { exec as exec3, spawn } from "child_process";
 import { promisify as promisify3 } from "util";
 import * as fsSync3 from "fs";
 import * as osMod from "os";
-
-// src/utils/globalDataDir.ts
-import * as fs7 from "fs";
-import * as path14 from "path";
-import * as os5 from "os";
-function globalDataDir() {
-  return path14.join(os5.homedir(), ".ordewell");
-}
-function copyDirSync(src, dest) {
-  fs7.mkdirSync(dest, { recursive: true });
-  const entries = fs7.readdirSync(src, { withFileTypes: true });
-  for (const entry of entries) {
-    const srcPath = path14.join(src, entry.name);
-    const destPath = path14.join(dest, entry.name);
-    if (entry.isDirectory()) {
-      copyDirSync(srcPath, destPath);
-    } else {
-      fs7.copyFileSync(srcPath, destPath);
-    }
-  }
-}
-var migrated = false;
-function migrateOldConfigDir() {
-  if (migrated) return;
-  migrated = true;
-  const oldDir = path14.join(os5.homedir(), ".config", "ordewell");
-  if (!fs7.existsSync(oldDir)) return;
-  const newDir = globalDataDir();
-  const liftFile = (name) => {
-    const oldFile = path14.join(oldDir, name);
-    const newFile = path14.join(newDir, name);
-    if (fs7.existsSync(oldFile) && !fs7.existsSync(newFile)) {
-      fs7.mkdirSync(newDir, { recursive: true });
-      fs7.copyFileSync(oldFile, newFile);
-    }
-  };
-  liftFile("settings.json");
-  liftFile(".env");
-  const oldPlugins = path14.join(oldDir, "plugins");
-  const newPlugins = path14.join(newDir, "plugins");
-  if (fs7.existsSync(oldPlugins) && !fs7.existsSync(newPlugins)) {
-    copyDirSync(oldPlugins, newPlugins);
-  }
-}
-
-// src/services/ModelDiscovery.ts
 var execAsync3 = promisify3(exec3);
 var defaultExec2 = async (command, options) => {
   const PATH = await augmentedPath();
@@ -16954,6 +17850,7 @@ var CliAgentAiService = class {
     };
     this.makeAdapter = deps.createAdapter ?? defaultAdapter;
     this.workspaceRoot = deps.workspaceRoot ?? (() => process.cwd());
+    this.mcpServer = deps.mcpServer;
   }
   config;
   runner;
@@ -16968,6 +17865,11 @@ var CliAgentAiService = class {
    */
   lastNativeSessionId = null;
   conversation = null;
+  mcpServer;
+  /** The planner token the running process was spawned with; revoked with the process (ADR-0022, A3). */
+  plannerToken = null;
+  /** Whether the running planner was spawned with its tools and the CLI reported them connected. */
+  toolsAttached = false;
   activeAbort = null;
   /**
    * Every subagent this conversation has reported starting, and finishing.
@@ -16990,6 +17892,10 @@ var CliAgentAiService = class {
     if (!this.conversation) return true;
     return this.conversation.startOptions.model === this.plannerModel() && this.conversation.startOptions.effort === this.config.plannerThinkingEffort;
   }
+  /** Whether this conversation's planner submits through the Ordewell MCP server rather than the envelopes. */
+  plannerToolsAttached() {
+    return this.toolsAttached;
+  }
   /** The agent's own session id, a resumption hint only — Ordewell's transcript is authoritative (T4). */
   nativeSessionId() {
     return this.adapter?.nativeSessionId() ?? null;
@@ -16997,8 +17903,8 @@ var CliAgentAiService = class {
   reset() {
     this.activeAbort?.abort();
     this.activeAbort = null;
-    this.adapter?.dispose();
-    this.adapter = null;
+    this.disposeAdapter();
+    this.toolsAttached = false;
     this.lastNativeSessionId = null;
     this.conversation = null;
     this.subagents.started.clear();
@@ -17025,9 +17931,23 @@ var CliAgentAiService = class {
       model: this.plannerModel(),
       effort: this.config.plannerThinkingEffort
     };
-    await this.startAdapter(startOptions);
+    const tools = req.plannerTools && this.mcpServer ? {
+      offer: req.plannerTools,
+      systemPrompt: buildConversationSystemPrompt(
+        req.goal,
+        contextStr,
+        req.modelsByRunner,
+        req.runners,
+        req.runnerModes,
+        req.autonomousDefault ?? true,
+        req.verificationEnabled ?? false,
+        { harness: true, isolatedExecution: req.isolatedExecution, plannerTools: true }
+      )
+    } : void 0;
+    await this.startAdapter(startOptions, tools);
     this.conversation = {
       startOptions,
+      tools,
       runners: req.runners,
       runnerModes: req.runnerModes,
       autonomousDefault: req.autonomousDefault
@@ -17232,10 +18152,7 @@ var CliAgentAiService = class {
       settle(id, "The agent ended the turn without reporting this call's result.", false, "not_executed");
     }
     this.lastNativeSessionId = adapter.nativeSessionId() ?? this.lastNativeSessionId;
-    if (error || signal?.aborted) {
-      adapter.dispose();
-      this.adapter = null;
-    }
+    if (error || signal?.aborted) this.disposeAdapter();
     return { text, researchLog, error, aborted: signal?.aborted, backgroundAgents };
   }
   // --- Process lifecycle ---
@@ -17244,13 +18161,50 @@ var CliAgentAiService = class {
    * type: the read-only boundary (ADR-0008/0009) cannot be crossed into task
    * mode from here without changing this signature.
    */
-  async startAdapter(opts) {
+  async startAdapter(opts, tools) {
     const adapter = this.makeAdapter(this.runner, this.processDeps);
     if (!adapter) throw new Error(`No planner adapter is available for "${this.runner}".`);
+    this.toolsAttached = false;
+    if (tools && this.mcpServer && adapter.mcpAttached) {
+      if (await this.startWithTools(adapter, opts, tools, this.mcpServer)) return adapter;
+      return this.startAdapter(opts);
+    }
     await adapter.start(opts);
     this.adapter = adapter;
     return adapter;
   }
+  /** Spawn with the Ordewell server injected. False, with nothing left running, when it did not connect. */
+  async startWithTools(adapter, opts, tools, server) {
+    let credential;
+    try {
+      credential = await server.issuePlannerToken({ sessionId: tools.offer.sessionId }, tools.offer.handler);
+    } catch {
+      return false;
+    }
+    try {
+      await adapter.start({ ...opts, systemPrompt: tools.systemPrompt, mcp: mcpClientConfig(credential) });
+      if (await adapter.mcpAttached()) {
+        this.adapter = adapter;
+        this.plannerToken = credential.token;
+        this.toolsAttached = true;
+        return true;
+      }
+    } catch (err) {
+      adapter.dispose();
+      server.revoke(credential.token);
+      throw err;
+    }
+    adapter.dispose();
+    server.revoke(credential.token);
+    return false;
+  }
+  /** Kill the planner process, and with it the token it was spawned with. */
+  disposeAdapter() {
+    this.adapter?.dispose();
+    this.adapter = null;
+    if (this.plannerToken) this.mcpServer?.revoke(this.plannerToken);
+    this.plannerToken = null;
+  }
   /**
    * The live agent process, restarted from its own session id if it died
    * between turns. Resume is a hint: when it fails, the caller's next
@@ -17261,7 +18215,7 @@ var CliAgentAiService = class {
     if (this.adapter) return this.adapter;
     const conversation = this.conversation;
     if (!conversation) throw new Error("No active planner conversation.");
-    await this.startAdapter({ ...conversation.startOptions, resumeSessionId: this.lastNativeSessionId ?? void 0 });
+    await this.startAdapter({ ...conversation.startOptions, resumeSessionId: this.lastNativeSessionId ?? void 0 }, conversation.tools);
     return this.adapter;
   }
   plannerModel() {
@@ -17280,7 +18234,9 @@ var CliAgentAiService = class {
     const previous = this.adapter;
     const previousConversation = this.conversation;
     const previousSessionId = this.lastNativeSessionId;
+    const previousTools = { token: this.plannerToken, attached: this.toolsAttached };
     this.adapter = null;
+    this.plannerToken = null;
     const startOptions = {
       kind: "planner",
       cwd: this.workspaceRoot(),
@@ -17310,6 +18266,8 @@ var CliAgentAiService = class {
     } finally {
       oneShotAdapter?.dispose();
       this.adapter = previous;
+      this.plannerToken = previousTools.token;
+      this.toolsAttached = previousTools.attached;
       this.conversation = previousConversation;
       this.lastNativeSessionId = previousSessionId;
     }
@@ -17405,6 +18363,173 @@ function createAiService(config, deps) {
   return new OpenAiService(config);
 }
 
+// src/services/plannerTools.ts
+function runnersOf(tasks) {
+  return [...new Set(flattenTasks(tasks).filter((t) => t.type !== "user").map((t) => t.assignedRunner))];
+}
+function plannerToolHandler(host) {
+  return {
+    async listRunners() {
+      const catalog = await host.liveCatalog();
+      return answer({
+        autonomy: autonomyLevelLabel(catalog.autonomousDefault),
+        runners: catalog.runners.map((id) => {
+          const modes = catalog.modes[id] ?? [];
+          const offered = [...filteredBuildModes(modes, catalog.autonomousDefault), ...modes.filter((m) => m.id === "plan")];
+          return {
+            id,
+            defaultMode: resolveDefaultMode(modes, catalog.autonomousDefault) ?? null,
+            modes: offered.map(({ id: modeId2, label, description }) => ({ id: modeId2, label, description }))
+          };
+        })
+      });
+    },
+    async listModels({ runner }) {
+      const catalog = await host.liveCatalog();
+      if (!catalog.runners.includes(runner)) return notEnabled(runner, catalog.runners);
+      return answer({
+        runner,
+        models: (catalog.models[runner] ?? []).map((m) => ({
+          modelId: m.modelId,
+          modelLabel: m.modelLabel,
+          variants: (m.variants ?? []).map((v) => ({ id: v.id, label: v.label }))
+        }))
+      });
+    },
+    async submitPlan({ tasks }) {
+      const catalog = await host.liveCatalog();
+      const result = validatePlanTasks({ tasks }, catalog.runners, catalog.modes, catalog.autonomousDefault);
+      if (!result.ok) return { isError: true, text: JSON.stringify({ ok: false, errors: result.errors, enabledRunners: catalog.runners }) };
+      const runners = runnersOf(result.tasks);
+      const coerced = coercions(result.tasks, host.coerce(result.tasks, runners));
+      if (!host.submitPlan(result.tasks, runners)) {
+        return { isError: true, text: JSON.stringify({ ok: false, errors: [{ field: "tasks", message: "No planning turn is open to take the plan." }] }) };
+      }
+      return answer({
+        ok: true,
+        tasks: result.tasks.length,
+        coerced,
+        next: "The plan is committed when this reply ends. Tell the user briefly what you submitted; do not repeat the plan as JSON."
+      });
+    },
+    async taskQuery({ tasks, fields, catalog }) {
+      const query = { tasks: (tasks ?? []).map(String), fields: fields ?? [...TASK_QUERY_TASK_FIELDS], catalog: catalog === true };
+      return read(host, taskQuerySignature(query), async () => ({
+        tasks: query.tasks.map((ref) => taskDetail(host.tasks(), ref, query.fields ?? [])),
+        ...query.catalog ? { catalog: catalogDetail(await host.liveCatalog()) } : {}
+      }));
+    },
+    async taskOutput({ task: ref, lines, since }) {
+      const task = findTask(host.tasks(), String(ref));
+      if (!task) return { isError: true, text: JSON.stringify({ ok: false, error: `No task matches "${ref}" in the current plan.` }) };
+      const maxLines = Math.min(lines ?? OUTPUT_LINES_DEFAULT, OUTPUT_LINES_MAX);
+      return read(host, JSON.stringify(["output", task.id, maxLines, since ?? null]), async () => {
+        const head = { task: { id: task.id, order: task.order, title: task.title, status: task.status } };
+        const tail = host.liveOutput(task.id, { maxLines, sinceOffset: since });
+        if (tail?.running) {
+          const fitted = fitTail(tail.text, OUTPUT_TAIL_MAX_CHARS);
+          return { ...head, running: true, output: fitted.text, nextOffset: tail.nextOffset, ...fitted.trimmed ? { trimmedToFit: true } : {} };
+        }
+        return {
+          ...head,
+          running: false,
+          reason: "This task is not running, so there is no live output: its outcome is below.",
+          verdict: verdictDetail(task.verdict),
+          outputSummary: outputSummaryDetail(task),
+          lastAttempt: host.lastAttempt(task.id)
+        };
+      });
+    },
+    async editPlan({ ops }) {
+      const outcome = await host.editPlan(ops);
+      if (!outcome.ok) return { isError: true, text: JSON.stringify({ ok: false, errors: outcome.errors.map(opError) }) };
+      return answer({
+        ok: true,
+        summary: outcome.summary,
+        queued: outcome.queued,
+        next: outcome.queued ? "A task you named is running, so the edit is parked and nothing was checked: it is applied between task batches, when the user's message comes back to you. Tell the user it is queued." : "The edit is applied when this reply ends, and the user is shown what changed. Tell them briefly; do not repeat it as JSON."
+      });
+    }
+  };
+}
+function opError(message) {
+  const match = /^op (\d+) \((\w+)\): ([\s\S]*)$/.exec(message);
+  return match ? { op: Number(match[1]), kind: match[2], message: match[3] } : { message };
+}
+async function read(host, signature, answerRead) {
+  const result = await host.read(signature, answerRead);
+  if (result.status === "refused") {
+    return { isError: true, text: JSON.stringify({ ok: false, error: "You have used every read this message allows. Nothing was read: answer the user in prose, or call edit_plan for the change you came to make." }) };
+  }
+  return answer({ ...result.value, ...result.landNow ? { note: TASK_READ_ANSWER_OR_EDIT } : {} });
+}
+function verdictDetail(verdict) {
+  if (!verdict) return null;
+  return {
+    outcome: verdict.outcome,
+    reason: verdict.reason,
+    checks: verdict.checks.map((c) => ({ name: c.name, result: c.skipped ? "skipped" : c.passed ? "pass" : "fail" }))
+  };
+}
+function outputSummaryDetail({ outputSummary }) {
+  return outputSummary ? { reviewReason: outputSummary.reviewReason, ...outputSummary.logTail ? { logTail: outputSummary.logTail } : {} } : null;
+}
+function taskDetail(plan, ref, fields) {
+  const task = findTask(plan, ref);
+  if (!task) return { ref, error: "no task matches this reference in the current plan." };
+  const wants = (field) => fields.includes(field);
+  return {
+    id: task.id,
+    order: task.order,
+    title: task.title,
+    status: task.status,
+    type: task.type === "user" ? "user" : "ai",
+    ...wants("description") ? { description: task.description || null } : {},
+    ...wants("prompt") ? { prompt: task.prompt || null } : {},
+    ...wants("userSteps") ? { userSteps: task.userSteps?.length ? task.userSteps.map((s) => ({ order: s.order, instruction: s.instruction, completed: s.completed === true })) : null } : {},
+    ...wants("verdict") ? { verdict: verdictDetail(task.verdict) } : {},
+    ...wants("outputSummary") ? { outputSummary: outputSummaryDetail(task) } : {},
+    ...wants("userStoriesCovered") ? { userStoriesCovered: task.userStoriesCovered?.length ? task.userStoriesCovered : null } : {}
+  };
+}
+function catalogDetail(catalog) {
+  return {
+    runners: catalog.runners.map((id) => {
+      const modes = catalog.modes[id] ?? [];
+      const defaultMode = resolveDefaultMode(modes, catalog.autonomousDefault);
+      return {
+        id,
+        models: (catalog.models[id] ?? []).map((m) => ({
+          modelId: m.modelId,
+          modelLabel: m.modelLabel,
+          variants: (m.variants ?? []).map((v) => ({ id: v.id, label: v.label }))
+        })),
+        modes: modes.map((m) => ({ id: m.id, label: m.label, description: m.description, default: m.id === defaultMode }))
+      };
+    })
+  };
+}
+function answer(body) {
+  return { text: JSON.stringify(body) };
+}
+function notEnabled(runner, enabled) {
+  return { isError: true, text: `Runner "${runner}" is not enabled. Enabled runners: ${enabled.join(", ") || "(none)"}.` };
+}
+function coercions(submitted, landed) {
+  return submitted.flatMap((task, i) => {
+    const after = landed[i];
+    const out = [];
+    if (after.assignedRunner !== task.assignedRunner) {
+      out.push({ taskId: task.id, field: "assignedRunner", from: task.assignedRunner, to: after.assignedRunner });
+    }
+    const [fromModel, toModel] = [task.assignedModel?.modelId ?? null, after.assignedModel?.modelId ?? null];
+    if (fromModel !== toModel) out.push({ taskId: task.id, field: "assignedModel", from: fromModel, to: toModel });
+    const [fromEffort, toEffort] = [task.assignedModel?.thinkingEffort ?? null, after.assignedModel?.thinkingEffort ?? null];
+    if (fromEffort !== toEffort) out.push({ taskId: task.id, field: "thinkingEffort", from: fromEffort, to: toEffort });
+    return out;
+  });
+}
+
 // src/services/PlannerConversation.ts
 import { v4 as uuidv45 } from "uuid";
 
@@ -17421,8 +18546,8 @@ function summaryRequest(planLines) {
     ...planLines ? ["<current_plan>", ...planLines, "</current_plan>"] : []
   ].join("\n");
 }
-function extractSummary(reply) {
-  const matches = [...reply.matchAll(new RegExp(`${SUMMARY_OPEN}([\\s\\S]*?)${SUMMARY_CLOSE}`, "g"))];
+function extractSummary(reply2) {
+  const matches = [...reply2.matchAll(new RegExp(`${SUMMARY_OPEN}([\\s\\S]*?)${SUMMARY_CLOSE}`, "g"))];
   const summary = matches.at(-1)?.[1].trim();
   return summary || null;
 }
@@ -17441,6 +18566,7 @@ function keptTail(transcript) {
 
 // src/services/PlannerConversation.ts
 var CATALOG_MODEL_CAP = 100;
+var PLANNER_TOOLS_REMINDER = "Runners, models and modes may have changed since you last read them: call list_runners and list_models just before submit_plan.";
 var MAX_TASK_QUERIES = 3;
 var MAX_TASK_QUERIES_HARD = 6;
 function freshReadBudget() {
@@ -17470,7 +18596,7 @@ var PlannerConversation = class {
   savedInBackground = 0;
   turnsInFlight = 0;
   compacting = false;
-  openTurnId = null;
+  openTurn = null;
   get transcript() {
     return this.host.plan()?.conversationHistory ?? [];
   }
@@ -17480,7 +18606,48 @@ var PlannerConversation = class {
   }
   /** The user turn being answered, for what the host raises during it — an approval the turn's research asks for. */
   get currentTurnId() {
-    return this.openTurnId ?? void 0;
+    return this.openTurn?.stream.turnId;
+  }
+  /**
+   * Hand the open turn a plan (already validated) or a task edit. The turn
+   * settles with it exactly as with the same plan or ops parsed out of its
+   * reply, and it wins over any envelope that reply carries. A later
+   * submission replaces an earlier one. False when no user turn is open.
+   */
+  submit(submission) {
+    if (!this.openTurn) return false;
+    this.openTurn.submitted = submission;
+    return true;
+  }
+  /**
+   * The edit the open turn already holds, for a further edit in the same reply
+   * to join rather than replace. Empty when it holds nothing; null when it holds
+   * a whole plan, which an edit cannot be layered on.
+   */
+  pendingOps() {
+    const held = this.openTurn?.submitted;
+    if (!held) return [];
+    return held.kind === "task_ops" ? held.ops : null;
+  }
+  /** Whether the turn would park this edit until a batch boundary instead of applying it as it settles. */
+  editWouldQueue(ops) {
+    return this.editTouchesLiveWork({ kind: "task_ops", ops, text: "", researchLog: [] });
+  }
+  /**
+   * A read the planner makes through a tool. It spends the same per-turn budget
+   * as an envelope read, so a planner cannot read more by switching channels:
+   * past the soft limit, or on a repeated question, the answer still comes but
+   * is told to land the turn; at the hard limit it is refused. `signature`
+   * names the question, for the repeat check.
+   */
+  async read(signature, answer2) {
+    const reads = this.openTurn?.reads;
+    if (!reads) return { status: "answered", value: await answer2(), landNow: false };
+    if (reads.answered >= MAX_TASK_QUERIES_HARD) return { status: "refused" };
+    const landNow = reads.seen.has(signature) || reads.answered >= MAX_TASK_QUERIES;
+    reads.seen.add(signature);
+    reads.answered++;
+    return { status: "answered", value: await answer2(), landNow };
   }
   /** Whether the model still holds this conversation in memory. */
   get isActive() {
@@ -17768,15 +18935,16 @@ ${message}` : message;
   async userTurn(prompt, signal, run) {
     const turnId = uuidv45();
     const stream = new TurnStream(turnId, (p) => this.host.onProgress(p));
-    this.openTurnId = turnId;
+    const turn = { stream, signal, reads: freshReadBudget() };
+    this.openTurn = turn;
     this.host.broadcast({ type: "planner_turn_started", turnId, prompt });
     let outcome = "error";
     try {
-      const settled = await this.inTurn(() => run({ stream, signal, reads: freshReadBudget() }));
+      const settled = await this.inTurn(() => run(turn));
       outcome = settled.outcome;
       return settled.plan;
     } finally {
-      if (this.openTurnId === turnId) this.openTurnId = null;
+      if (this.openTurn === turn) this.openTurn = null;
       this.host.broadcast({ type: "planner_turn_ended", turnId, outcome: signal?.aborted ? "stopped" : outcome });
     }
   }
@@ -17827,10 +18995,11 @@ ${message}` : message;
    * ops JSON still gets its two corrective retries; charging it for the read
    * would cost it the chance to fix the edit.
    */
-  async drainTaskQueries(turn, { reads, signal, stream }) {
+  async drainTaskQueries(turn, userTurn) {
+    const { reads, signal, stream } = userTurn;
     const ai = this.host.aiService();
     const carried = [];
-    let current = turn;
+    let current = this.claimSubmission(turn, userTurn);
     while (current.kind === "task_query") {
       carried.push(...current.researchLog);
       if (reads.answered >= MAX_TASK_QUERIES_HARD || !ai.hasActiveConversation() || signal?.aborted) {
@@ -17844,17 +19013,30 @@ ${message}` : message;
       const insist = reads.seen.has(signature) || reads.answered >= MAX_TASK_QUERIES;
       reads.seen.add(signature);
       reads.answered++;
-      const answer = this.taskQueryAnswer(current.query);
-      current = await ai.continueConversation(
-        insist ? `${answer}
+      const answer2 = this.taskQueryAnswer(current.query);
+      current = this.claimSubmission(await ai.continueConversation(
+        insist ? `${answer2}
 
-${TASK_QUERY_ANSWER_OR_OPS}` : answer,
+${TASK_QUERY_ANSWER_OR_OPS}` : answer2,
         stream.sink(),
         signal
-      );
+      ), userTurn);
     }
     return carried.length > 0 ? { ...current, researchLog: [...carried, ...current.researchLog] } : current;
   }
+  /**
+   * The backend's answer, with what was handed in while it ran standing in
+   * for whatever its reply carried. Taken once: a corrective re-send after a
+   * rejected edit must not settle on the same submission again. A stopped
+   * turn commits nothing, the same as a stopped reply with a plan in it.
+   */
+  claimSubmission(turn, userTurn) {
+    const submitted = userTurn.submitted;
+    userTurn.submitted = void 0;
+    if (!submitted || userTurn.signal?.aborted) return turn;
+    const { text, researchLog } = turn;
+    return submitted.kind === "plan" ? { kind: "plan", tasks: submitted.tasks, text, researchLog } : { kind: "task_ops", ops: submitted.ops, text, researchLog };
+  }
   /**
    * Render one read out of live state. Never persisted to the transcript: the
    * detail is context for the planner's next reply, and re-sending it on every
@@ -17898,7 +19080,7 @@ The plan is unchanged. Rephrase the request, or adjust the tasks manually.`,
         return { retry: { errors: applied.errors, corrective: taskOpsRejectedPrompt(applied.errors) } };
       },
       maxRepairs: 2,
-      onExhausted: ({ reply, errors }) => invalidOps(errors, reply.researchLog)
+      onExhausted: ({ reply: reply2, errors }) => invalidOps(errors, reply2.researchLog)
     });
     if ("plan" in settled) {
       await this.host.afterEdit();
@@ -17961,10 +19143,12 @@ The plan is unchanged. Rephrase the request, or adjust the tasks manually.`,
    *
    * The host's catalog is allowlist-filtered, so a restricted allowlist stays a
    * hard bound on every turn, and reads the plan's runners live, so a runner
-   * admitted mid-session by a retarget is shown like every other.
+   * admitted mid-session by a retarget is shown like every other. A planner
+   * with Ordewell's tools gets a reminder to read the catalog instead.
    */
   catalogBlock() {
     if (!this.host.plan()) return null;
+    if (this.host.aiService().plannerToolsAttached?.()) return PLANNER_TOOLS_REMINDER;
     const { runners, models, modes, autonomousDefault } = this.host.catalog();
     const modelLines = runners.map((runner) => {
       const list = models[runner] ?? [];
@@ -17999,6 +19183,7 @@ The plan is unchanged. Rephrase the request, or adjust the tasks manually.`,
     const tasks = this.host.tasks();
     const lines = this.currentPlanLines();
     if (!lines) return null;
+    const tools = this.host.aiService().plannerToolsAttached?.() ?? false;
     const locked = tasks.filter((t) => t.status === "in_progress");
     const execNote = this.host.hasLiveWork() ? `
 Execution is RUNNING${locked.length ? ` \u2014 these tasks are locked: ${locked.map((t) => `#${t.order}`).join(", ")}` : ""}. Any task edits you emit will be queued and applied between batches.` : "";
@@ -18008,8 +19193,8 @@ Execution is RUNNING${locked.length ? ` \u2014 these tasks are locked: ${locked.
       "</current_plan>",
       "The block above is the CURRENT task plan \u2014 short fields only. Choose how to respond:",
       "- To answer a question or discuss, reply in plain prose (no JSON).",
-      TASK_QUERY_REMINDER,
-      ...taskOpsProtocol(execNote)
+      tools ? TASK_READ_TOOLS_REMINDER : TASK_QUERY_REMINDER,
+      ...taskOpsProtocol(execNote, tools)
     ].filter(Boolean).join("\n");
   }
   /** One line per task with stable references — null until the plan has tasks. */
@@ -18285,6 +19470,7 @@ function retargetTaskRunner(task, runner, catalog) {
 }
 
 // src/services/SkillsService.ts
+import { createHash } from "crypto";
 import * as fs9 from "fs";
 import * as path18 from "path";
 
@@ -18302,6 +19488,11 @@ function builtinSkillsDir() {
 // src/services/SkillsService.ts
 var BUILTIN_SKILL_NAMES = ["grilling", "to-spec", "improve-codebase-architecture"];
 var RETIRED_BUILTIN_SKILL_NAMES = ["grill-me"];
+var PRIOR_BUILTIN_HASHES = {
+  grilling: ["d5d4cb8589fbb4a0f3296bae15033f2297ef682aaf5615a3dee258451f96e5c3"],
+  "improve-codebase-architecture": ["b5154b5e3baca9a5f244634453e83706d742011c31163648c2b8395a2524dd9c"]
+};
+var SEED_MANIFEST = ".seeded.json";
 function parseSkillFile(filePath, name, source) {
   const raw = fs9.readFileSync(filePath, "utf8");
   const frontmatter = {};
@@ -18341,6 +19532,13 @@ function copyDirSync2(src, dest) {
     else fs9.copyFileSync(srcPath, destPath);
   }
 }
+function fileHash(file) {
+  try {
+    return createHash("sha256").update(fs9.readFileSync(file)).digest("hex");
+  } catch {
+    return void 0;
+  }
+}
 function readDir(dir, source) {
   if (!fs9.existsSync(dir)) return [];
   const entries = fs9.readdirSync(dir, { withFileTypes: true });
@@ -18365,21 +19563,59 @@ var SkillsService = class {
   globalDir() {
     return path18.join(globalDataDir(), "skills");
   }
+  readSeedManifest() {
+    try {
+      const parsed = JSON.parse(fs9.readFileSync(path18.join(this.globalDir(), SEED_MANIFEST), "utf8"));
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        return Object.fromEntries(
+          Object.entries(parsed).filter((entry) => typeof entry[1] === "string")
+        );
+      }
+    } catch {
+    }
+    return {};
+  }
+  recordSeed(name, hash) {
+    const manifest = this.readSeedManifest();
+    if (manifest[name] === hash) return;
+    manifest[name] = hash;
+    try {
+      fs9.mkdirSync(this.globalDir(), { recursive: true });
+      fs9.writeFileSync(path18.join(this.globalDir(), SEED_MANIFEST), JSON.stringify(manifest, null, 2));
+    } catch (err) {
+      console.warn(`Could not record seeded skill ${name}: ${String(err)}`);
+    }
+  }
+  /** A seed the user never edited: safe to replace with a newer built-in. */
+  isUntouchedSeed(name, currentHash) {
+    if (currentHash === void 0) return false;
+    return this.readSeedManifest()[name] === currentHash || (PRIOR_BUILTIN_HASHES[name] ?? []).includes(currentHash);
+  }
   seed(name) {
     const dest = path18.join(this.globalDir(), name);
-    if (fs9.existsSync(dest)) return false;
+    const exists = fs9.existsSync(dest);
     let srcDir;
     try {
       srcDir = path18.join(builtinSkillsDir(), name);
     } catch (err) {
-      console.warn(`Could not locate built-in skills dir: ${String(err)}`);
+      if (!exists) console.warn(`Could not locate built-in skills dir: ${String(err)}`);
       return false;
     }
     if (!fs9.existsSync(srcDir)) {
-      console.warn(`Built-in skill not found in package: ${name}`);
+      if (!exists) console.warn(`Built-in skill not found in package: ${name}`);
       return false;
     }
+    const srcHash = fileHash(path18.join(srcDir, "SKILL.md"));
+    if (exists) {
+      const currentHash = fileHash(path18.join(dest, "SKILL.md"));
+      if (currentHash !== void 0 && currentHash === srcHash) {
+        this.recordSeed(name, currentHash);
+        return false;
+      }
+      if (!this.isUntouchedSeed(name, currentHash)) return false;
+    }
     copyDirSync2(srcDir, dest);
+    if (srcHash) this.recordSeed(name, srcHash);
     return true;
   }
   seedBuiltinSkill(name) {
@@ -18673,9 +19909,9 @@ import * as fs10 from "fs";
 import * as path19 from "path";
 
 // src/utils/sessionId.ts
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes6 } from "crypto";
 function mintSessionId() {
-  return `session-${randomBytes3(16).toString("hex")}`;
+  return `session-${randomBytes6(16).toString("hex")}`;
 }
 
 // src/utils/sessionStore.ts
@@ -19012,7 +20248,12 @@ function lastAttemptDigest(location, taskId) {
   return events.length > 0 ? digestTaskLog(events, OPS_RETRY_DIGEST_CALLS) : null;
 }
 function sessionRuntimeSettings(settings) {
-  return { ...plannerRuntimeToggles(settings), modelAllowlist: settings.modelAllowlist, runnerTransport: settings.runnerTransport };
+  return {
+    ...plannerRuntimeToggles(settings),
+    modelAllowlist: settings.modelAllowlist,
+    runnerTransport: settings.runnerTransport,
+    enabledRunners: settings.enabledRunners
+  };
 }
 var SKILL_TOKEN = /(^|\s)\/([a-z][a-z0-9_-]*)([,.!?;:]*)(?=\s|$)/gi;
 function resolveSkillInvocation(text, skillsService) {
@@ -19036,14 +20277,14 @@ function resolveSkillInvocation(text, skillsService) {
     return `${lead}${skill.content}${punct}`;
   });
 }
-function liveAiService(config, workspaceRoot) {
+function liveAiService(config, workspaceRoot, mcpServer) {
   let live = null;
   let liveProvider = null;
   return () => {
     const provider = config.aiProvider;
     if (live && liveProvider === provider) return live;
     live?.reset();
-    live = createAiService(config, { workspaceRoot });
+    live = createAiService(config, { workspaceRoot, mcpServer });
     liveProvider = provider;
     return live;
   };
@@ -19053,7 +20294,7 @@ function isPlannerApproval(request) {
 }
 function createSession(deps) {
   const pinnedAiService = deps.aiService;
-  const aiService = pinnedAiService ? () => pinnedAiService : liveAiService(deps.config, deps.workspaceRoot);
+  const aiService = pinnedAiService ? () => pinnedAiService : liveAiService(deps.config, deps.workspaceRoot, deps.mcpServer ?? sharedMcpServer());
   const store = new PlanStore();
   const taskLogs = new TaskLogRecorder({
     broadcast: deps.broadcast,
@@ -19183,6 +20424,16 @@ var Session = class {
   currentSessionId;
   skillsService;
   conversation;
+  plannerTools = plannerToolHandler({
+    liveCatalog: () => this.liveCatalog(),
+    coerce: (tasks, runners) => coerceAssignments(tasks, this.allowlist(), runners, this.models()),
+    submitPlan: (tasks, runners) => this.submitPlanFromTool(tasks, runners),
+    editPlan: (ops) => this.editPlanFromTool(ops),
+    tasks: () => this.store.planTasks,
+    read: (signature, answer2) => this.conversation.read(signature, answer2),
+    liveOutput: (taskId, opts) => this.orchestrator.getLiveOutput(taskId, opts),
+    lastAttempt: (taskId) => lastAttemptDigest(this.taskLogLocation, taskId)
+  });
   constructor(parts) {
     this.config = parts.config;
     this.registry = parts.registry;
@@ -19211,17 +20462,7 @@ var Session = class {
       aiService: () => this.aiService(),
       onProgress: (p) => this.events.progress(p),
       opening: (runners) => this.conversationOpening(runners),
-      catalog: () => {
-        const runners = this.plan?.runners ?? [];
-        return {
-          runners,
-          // Allowlist-filtered: neither the per-turn block nor a read may offer
-          // a model the planner is forbidden to assign.
-          models: filterModelsForPrompt(this.models(), this.allowlist()),
-          modes: this.runnerModesFor(runners),
-          autonomousDefault: this.config.autonomousMode
-        };
-      },
+      catalog: () => this.catalogOf(this.plan?.runners ?? []),
       tasks: () => this.store.planTasks,
       liveOutput: (taskId, opts) => this.orchestrator.getLiveOutput(taskId, opts),
       hasLiveWork: () => this.hasLiveWork,
@@ -19245,8 +20486,8 @@ var Session = class {
    * server's HTTP route, the VS Code webview, the TUI prompt — so the decision
    * path is identical regardless of who is looking.
    */
-  resolveApproval(id, answer) {
-    return this.approvals.resolve(id, answer);
+  resolveApproval(id, answer2) {
+    return this.approvals.resolve(id, answer2);
   }
   /** Requests still waiting for an answer, replayed to a surface that connects mid-prompt. */
   outstandingApprovals() {
@@ -19366,6 +20607,27 @@ var Session = class {
     this.modelsCache = {};
     this.remintSessionId();
   }
+  /**
+   * What a planner may assign right now: every enabled runner, its modes, and
+   * its allowlisted models — read as of this call, so a runner enabled or an
+   * allowlist edited since planning started is in it (#69). Discovers a
+   * runner's models the first time it is asked for.
+   */
+  async liveCatalog() {
+    const runners = this.enabledRunners();
+    this.modelsCache = { ...this.modelsCache, ...await this.modelResolver.modelsForRunners(runners) };
+    return this.catalogOf(runners);
+  }
+  catalogOf(runners) {
+    return {
+      runners,
+      // Allowlist-filtered: neither the per-turn block nor a read may offer
+      // a model the planner is forbidden to assign.
+      models: filterModelsForPrompt(this.models(), this.allowlist()),
+      modes: this.runnerModesFor(runners),
+      autonomousDefault: this.config.autonomousMode
+    };
+  }
   runnerModesFor(runners) {
     return runnerModesFrom(this.registry, runners);
   }
@@ -19377,13 +20639,17 @@ var Session = class {
    * allowlist here — {@link checkModelAndModeValidity} narrows by
    * allowlist itself, the same way `coerceAssignments` does.
    */
-  editCatalog() {
+  editCatalog(runners = this.plan?.runners ?? []) {
     return {
       modelsByRunner: this.models(),
-      runnerModes: this.runnerModesFor(this.plan?.runners ?? []),
+      runnerModes: this.runnerModesFor(runners),
       perRunnerAllowlist: this.allowlist()
     };
   }
+  /** The runners enabled right now — a toggle made since the session was built counts (#69). */
+  enabledRunners() {
+    return this.settingsFn().enabledRunners ?? this.config.enabledRunners;
+  }
   /**
    * The allowlist in force right now. Unset means no restriction — falling
    * back to the one planning started under would keep a restriction the user
@@ -19485,7 +20751,7 @@ var Session = class {
     this.goal = goal;
     this.remintSessionId();
     this.beginFreshPlan();
-    const enabled = this.config.enabledRunners;
+    const enabled = this.enabledRunners();
     const chosenRunners = runners.filter((r) => enabled.includes(r));
     if (chosenRunners.length === 0) throw new Error("None of the requested runners are enabled");
     const { modelsByRunner, runnerModes, settings } = await this.plannerCatalog(chosenRunners);
@@ -19529,7 +20795,7 @@ var Session = class {
     this.goal = this.resolveSkillInvocation(goal);
     this.remintSessionId();
     this.beginFreshPlan();
-    const enabled = this.config.enabledRunners;
+    const enabled = this.enabledRunners();
     const chosenRunners = runners.filter((r) => enabled.includes(r));
     if (chosenRunners.length === 0) throw new Error("None of the requested runners are enabled");
     const opening = await this.conversationOpening(chosenRunners);
@@ -19607,6 +20873,49 @@ var Session = class {
   rewindTargets() {
     return this.conversation.rewindTargets();
   }
+  /**
+   * Hand the planner turn in flight a validated plan or a task edit; the turn
+   * commits it as it would the same JSON in the planner's reply. False when
+   * no turn is open.
+   */
+  submitToTurn(submission) {
+    return this.conversation.submit(submission);
+  }
+  /**
+   * A plan the planner submitted through its tool, already checked against the
+   * live catalog. Its runners join `plan.runners` here, so a runner enabled
+   * since planning started is not snapped back by the commit (#69).
+   */
+  submitPlanFromTool(tasks, runners) {
+    if (!this.plan || !this.conversation.submit({ kind: "plan", tasks })) return false;
+    for (const runner of runners) this.admitRunner(runner, this.modelsCache[runner] ?? []);
+    return true;
+  }
+  /**
+   * A task edit the planner made through its tool. Checked against the live
+   * catalog, then handed to the open turn, which commits it as it would the
+   * same ops in a taskOps reply — including parking it behind a running batch,
+   * which the envelope does before any check, so a queued edit is not checked
+   * here either. Edits made in one reply join one batch.
+   */
+  async editPlanFromTool(ops) {
+    const refuse = (message) => ({ ok: false, errors: [message] });
+    const catalog = await this.liveCatalog();
+    if (!this.plan || this.store.planTasks.length === 0) return refuse("There is no plan to edit yet: submit one with submit_plan.");
+    const held = this.conversation.pendingOps();
+    if (!held) return refuse("A whole plan was submitted in this reply and replaces the plan when it ends: make the edit in your next reply.");
+    const batch = [...held, ...ops];
+    const queued = this.conversation.editWouldQueue(batch);
+    let summary = [];
+    if (!queued) {
+      const result = applyTaskOps(this.store.planTasks, batch, catalog.runners, this.editCatalog(catalog.runners));
+      if (!result.ok) return { ok: false, errors: result.errors };
+      summary = result.summary;
+      for (const runner of runnersOf(result.tasks)) this.admitRunner(runner, this.modelsCache[runner] ?? []);
+    }
+    if (!this.conversation.submit({ kind: "task_ops", ops: batch })) return refuse("No planning turn is open to take the edit.");
+    return { ok: true, summary, queued };
+  }
   /** Whether the planner conversation is live (started and not yet committed to a plan). */
   get isConversationActive() {
     return this.conversation.isActive;
@@ -19652,7 +20961,8 @@ var Session = class {
       // usage line can show context fill (#49). Unknown stays absent.
       contextWindow: this.modelResolver.contextWindowFor?.(this.config.orchestratorModel),
       fs: this.fsAdapter,
-      fetcher: this.fetcher
+      fetcher: this.fetcher,
+      plannerTools: { sessionId: this.sessionId, handler: this.plannerTools }
     };
   }
   /**
@@ -19770,7 +21080,7 @@ var Session = class {
       ])
     );
     try {
-      const modelsByRunner = await this.modelResolver.modelsForRunners(this.config.enabledRunners);
+      const modelsByRunner = await this.modelResolver.modelsForRunners(this.enabledRunners());
       const runnerModes = this.runnerModesFor(this.plan?.runners ?? ["claude-code"]);
       const { modelAllowlist } = this.settingsFn();
       const result = await this.planner.modifyDuringExecution({
@@ -20117,7 +21427,7 @@ var Session = class {
     if (!this.plan) throw new Error("No active plan state");
     const check = canMergeTasks(this.store.planTasks, taskIds);
     if (!check.ok) throw new Error(check.error ?? "These tasks cannot be merged");
-    const prompt = buildMergePrompt(taskIds, this.store.planTasks);
+    const prompt = buildMergePrompt(taskIds, this.store.planTasks, this.aiService().plannerToolsAttached?.());
     return this.continueConversation(prompt, options);
   }
   /**
@@ -20129,7 +21439,7 @@ var Session = class {
     if (!this.plan) throw new Error("No active plan state");
     const check = canSplitTask(this.store.planTasks, taskId);
     if (!check.ok) throw new Error(check.error ?? "This task cannot be split");
-    const prompt = buildSplitPrompt(taskId, this.store.planTasks);
+    const prompt = buildSplitPrompt(taskId, this.store.planTasks, this.aiService().plannerToolsAttached?.());
     return this.continueConversation(prompt, options);
   }
   loadPlan(plan, goal, workspace, opts) {
@@ -20169,41 +21479,6 @@ var Session = class {
   }
 };
 
-// src/utils/privateFile.ts
-import { closeSync, mkdirSync as mkdirSync10, openSync, renameSync, unlinkSync as unlinkSync2, writeSync } from "fs";
-import { basename as basename2, dirname as dirname7, join as join18 } from "path";
-import { randomBytes as randomBytes4 } from "crypto";
-var DIR_MODE = 448;
-var FILE_MODE = 384;
-var POSIX_MODES = process.platform !== "win32";
-function ensurePrivateDir(dir) {
-  if (POSIX_MODES) {
-    mkdirSync10(dir, { recursive: true, mode: DIR_MODE });
-    return;
-  }
-  mkdirSync10(dir, { recursive: true });
-}
-function writePrivateFile(filePath, content) {
-  const dir = dirname7(filePath);
-  ensurePrivateDir(dir);
-  const tempPath = join18(dir, `.${basename2(filePath)}.${randomBytes4(8).toString("hex")}.tmp`);
-  const fd = openSync(tempPath, "wx", POSIX_MODES ? FILE_MODE : void 0);
-  try {
-    writeSync(fd, content);
-  } finally {
-    closeSync(fd);
-  }
-  try {
-    renameSync(tempPath, filePath);
-  } catch (err) {
-    try {
-      unlinkSync2(tempPath);
-    } catch {
-    }
-    throw err;
-  }
-}
-
 // src/services/buildRunnerArgs.ts
 function buildRunnerInvocation(opts) {
   const entry = opts.registry.get(opts.runner);
@@ -20460,9 +21735,9 @@ var HeadlessRunner = class extends AbstractRunner {
 // src/services/TmuxRunner.ts
 import { execFile as execFile5 } from "child_process";
 import { promisify as promisify5 } from "util";
-import { tmpdir } from "os";
-import { join as join19 } from "path";
-import { existsSync as existsSync11, readFileSync as readFileSync9, unlinkSync as unlinkSync3, writeFileSync as writeFileSync7 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join21 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync10, unlinkSync as unlinkSync4, writeFileSync as writeFileSync9 } from "fs";
 
 // src/utils/tmux.ts
 import { execSync as execSync2 } from "child_process";
@@ -20560,7 +21835,7 @@ var TmuxSession = class extends AbstractTerminalSession {
    * lets the user keep poking at a finished task's terminal.
    */
   async start(command, args, cwd, env) {
-    writeFileSync7(this.logPath, "");
+    writeFileSync9(this.logPath, "");
     const envAssignments = Object.entries(env ?? {}).map(([k, v]) => `${k}=${posixShellQuote(v)}`).join(" ");
     const inner = [command, ...args].map(posixShellQuote).join(" ");
     const prefix = envAssignments ? `env ${envAssignments} ` : "";
@@ -20583,7 +21858,7 @@ var TmuxSession = class extends AbstractTerminalSession {
   readLog() {
     let content;
     try {
-      content = existsSync11(this.logPath) ? readFileSync9(this.logPath, "utf8") : "";
+      content = existsSync11(this.logPath) ? readFileSync10(this.logPath, "utf8") : "";
     } catch {
       return false;
     }
@@ -20639,7 +21914,7 @@ var TmuxSession = class extends AbstractTerminalSession {
     this.tmux(["pipe-pane", "-t", this.target]).catch(() => {
     });
     try {
-      unlinkSync3(this.logPath);
+      unlinkSync4(this.logPath);
     } catch {
     }
     this.baseHandleExit(code);
@@ -20676,7 +21951,7 @@ var TmuxRunner = class extends AbstractRunner {
     this.execFileImpl = deps.execFileImpl ?? defaultExecFile3;
     this.resolvePath = deps.resolvePath ?? augmentedPath;
     this.pollIntervalMs = deps.pollIntervalMs ?? 500;
-    this.logDir = deps.logDir ?? tmpdir();
+    this.logDir = deps.logDir ?? tmpdir2();
     this.clipboardCommand = deps.clipboardCommand ?? (() => clipboardCopyCommand());
     this.runnerVersion = deps.runnerVersion ?? probeRunnerVersion;
   }
@@ -20796,7 +22071,7 @@ var TmuxRunner = class extends AbstractRunner {
       windowName,
       this.execFileImpl,
       this.pollIntervalMs,
-      join19(this.logDir, `${id}.log`),
+      join21(this.logDir, `${id}.log`),
       this.socket
     );
     invocation.env = { ...opts.env, ...invocation.env, PATH: await this.resolvePath() };
@@ -20824,9 +22099,9 @@ var KEY_ARGS = {
 };
 var FALLBACK_KEY_ARGS = ["file_path", "path", "notebook_path", "description", "pattern", "command", "url", "query", "prompt"];
 function toolLine(name, args) {
-  const { tool } = mapAgentTool(name);
-  const normalized = normalizeAgentArgs(tool, args);
-  const preferred = KEY_ARGS[tool];
+  const { tool: tool2 } = mapAgentTool(name);
+  const normalized = normalizeAgentArgs(tool2, args);
+  const preferred = KEY_ARGS[tool2];
   for (const key of preferred ? [preferred, ...FALLBACK_KEY_ARGS] : FALLBACK_KEY_ARGS) {
     const value = normalized[key];
     if (typeof value !== "string") continue;
@@ -20889,6 +22164,7 @@ var StructuredSession = class extends AbstractTerminalSession {
   constructor(id, taskId, launch) {
     super(id, taskId);
     this.launch = launch;
+    this.startOptions = launch.startOptions;
     this.text = new PlainTextChannel((text) => {
       this.output += text;
       this.outputEmitter.emit("output", text);
@@ -20917,9 +22193,20 @@ var StructuredSession = class extends AbstractTerminalSession {
    * requests — while an approval must be answerable by id across the session.
    */
   permissions = /* @__PURE__ */ new Map();
+  /** The launch's start options, with this attempt's server once its token is issued. */
+  startOptions;
+  /** This attempt's MCP token, until the session ends (ADR-0022, A2). */
+  toolToken = null;
+  checkpointHandler = null;
   /** Start the runner and send the task's prompt as its first turn. */
   async start(prompt) {
-    await this.startAdapter(this.launch.startOptions);
+    await this.issueTools();
+    try {
+      await this.startAdapter(this.startOptions);
+    } catch (err) {
+      this.revokeTools();
+      throw err;
+    }
     this.state = "working";
     setImmediate(() => {
       if (!this.exited) this.deliver(prompt);
@@ -20928,6 +22215,49 @@ var StructuredSession = class extends AbstractTerminalSession {
   getOutput() {
     return this.output;
   }
+  onTaskComplete(listener) {
+    this.structuredEmitter.on("taskComplete", listener);
+  }
+  onToolCheckpoint(handler) {
+    this.checkpointHandler = handler;
+  }
+  /**
+   * A server that cannot start costs the task its tools, not its run: the
+   * prompt still teaches the marker (ADR-0022, S2).
+   */
+  async issueTools() {
+    const tools = this.launch.tools;
+    if (!tools) return;
+    try {
+      const credential = await tools.server.issueTaskToken(tools.scope, {
+        taskComplete: async (report) => {
+          this.structuredEmitter.emit("taskComplete", report);
+          return { text: "Recorded. End your turn now." };
+        },
+        checkpoint: async ({ question }, { signal }) => {
+          if (!this.checkpointHandler) return { text: "checkpoint is not available in this session.", isError: true };
+          return checkpointReply(await this.checkpointHandler(question, signal));
+        }
+      });
+      if (this.exited) {
+        tools.server.revoke(credential.token);
+        return;
+      }
+      this.toolToken = credential.token;
+      this.startOptions = { ...this.startOptions, mcp: mcpClientConfig(credential) };
+    } catch (err) {
+      console.error(`[structured] No Ordewell tools for task ${this.taskId.slice(0, 8)}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  revokeTools() {
+    if (this.toolToken === null) return;
+    this.launch.tools?.server.revoke(this.toolToken);
+    this.toolToken = null;
+  }
+  baseHandleExit(code) {
+    this.revokeTools();
+    super.baseHandleExit(code);
+  }
   /** A reply typed at the task — a checkpoint answer, most often — is a user message. */
   write(text) {
     const message = text.trim();
@@ -21025,12 +22355,12 @@ var StructuredSession = class extends AbstractTerminalSession {
    * session id after an abort.
    */
   async restartInterrupted(turn) {
-    const resumeSessionId = this.nativeSessionId() ?? this.launch.startOptions.resumeSessionId;
+    const resumeSessionId = this.nativeSessionId() ?? this.startOptions.resumeSessionId;
     this.generation += 1;
     turn.abort.abort();
     if (this.adapter) this.withdrawPermissions(this.adapter);
     try {
-      await this.startAdapter({ ...this.launch.startOptions, resumeSessionId });
+      await this.startAdapter({ ...this.startOptions, resumeSessionId });
     } catch (err) {
       this.text.line(`Could not restart ${this.launch.runner} after the interrupt: ${err instanceof Error ? err.message : String(err)}`);
       this.endTurn(turn, "interrupted");
@@ -21168,11 +22498,13 @@ var StructuredRunner = class extends AbstractRunner {
   processDeps;
   createAdapter;
   interruptGraceMs;
+  mcp;
   constructor(deps = {}) {
     super();
     this.processDeps = deps.process ?? {};
     this.createAdapter = deps.createAdapter ?? createTaskAdapter;
     this.interruptGraceMs = deps.interruptGraceMs ?? DEFAULT_INTERRUPT_GRACE_MS;
+    this.mcp = deps.mcp ?? sharedMcpServer();
   }
   async spawn(opts) {
     const manifest = opts.registry?.get(opts.runner)?.manifest;
@@ -21199,7 +22531,8 @@ var StructuredRunner = class extends AbstractRunner {
         flags: resolveTaskRunnerFlags(manifest, { mode: opts.mode ?? "default", model: opts.modelId, thinkingEffort: opts.thinkingEffort }),
         resumeSessionId: opts.resumeSessionId
       },
-      interruptGraceMs: this.interruptGraceMs
+      interruptGraceMs: this.interruptGraceMs,
+      ...takesOrdewellTools(opts.runner) ? { tools: { server: this.mcp, scope: { sessionId: opts.planSessionId ?? "", taskId: opts.taskId, attempt: opts.attempt ?? 1 } } } : {}
     });
     console.error(`[structured] Starting ${opts.runner} [${opts.mode ?? "default"}] (${opts.modelId || "default"}) for task ${opts.taskId.slice(0, 8)}`);
     this.registerSession(id, session);
@@ -21213,73 +22546,12 @@ var StructuredRunner = class extends AbstractRunner {
   }
 };
 
-// src/utils/daemonToken.ts
-import { randomBytes as randomBytes5, timingSafeEqual } from "crypto";
-import { readFileSync as readFileSync10, unlinkSync as unlinkSync4 } from "fs";
-import { join as join20 } from "path";
-var BEARER_PREFIX = "bearer ";
-var DAEMON_TOKEN_SUBPROTOCOL_PREFIX = "ordewell.token.";
-var DAEMON_SUBPROTOCOL = "ordewell.v1";
-function configDir() {
-  return globalDataDir();
-}
-function daemonTokenPath(port) {
-  return join20(configDir(), `server-${port}.token`);
-}
-function mintDaemonToken(port) {
-  const token = randomBytes5(32).toString("base64url");
-  const file = daemonTokenPath(port);
-  writePrivateFile(file, token);
-  return { token, file };
-}
-function readDaemonToken(port) {
-  try {
-    const token = readFileSync10(daemonTokenPath(port), "utf8").trim();
-    return token === "" ? void 0 : token;
-  } catch {
-    return void 0;
-  }
-}
-function clearDaemonToken(port) {
-  try {
-    unlinkSync4(daemonTokenPath(port));
-  } catch {
-  }
-}
-function bearerHeaderValue(token) {
-  return `Bearer ${token}`;
-}
-function tokenSubprotocols(token) {
-  return [DAEMON_SUBPROTOCOL, `${DAEMON_TOKEN_SUBPROTOCOL_PREFIX}${token}`];
-}
-function extractPresentedToken(carriers) {
-  const authorization = carriers.authorization;
-  if (authorization && authorization.toLowerCase().startsWith(BEARER_PREFIX)) {
-    const value = authorization.slice(BEARER_PREFIX.length).trim();
-    if (value !== "") return value;
-  }
-  for (const offered of (carriers.secWebSocketProtocol ?? "").split(",")) {
-    const value = offered.trim();
-    if (!value.startsWith(DAEMON_TOKEN_SUBPROTOCOL_PREFIX)) continue;
-    const token = value.slice(DAEMON_TOKEN_SUBPROTOCOL_PREFIX.length);
-    if (token !== "") return token;
-  }
-  return void 0;
-}
-function tokensMatch(presented, expected) {
-  if (presented === void 0) return false;
-  const a = Buffer.from(presented, "utf8");
-  const b = Buffer.from(expected, "utf8");
-  if (a.length !== b.length) return false;
-  return timingSafeEqual(a, b);
-}
-
 // src/plugins/RunnerRegistry.ts
 import * as fs13 from "fs";
 import * as path23 from "path";
 import * as os6 from "os";
 import { execFileSync } from "child_process";
-import { randomBytes as randomBytes6 } from "crypto";
+import { randomBytes as randomBytes7 } from "crypto";
 
 // src/plugins/FsPluginStore.ts
 import * as fs12 from "fs";
@@ -21303,8 +22575,8 @@ function resolvePluginInstallDir(pluginsDir, name) {
   assertPlainPluginName(name);
   const root = path21.resolve(pluginsDir);
   const dest = path21.resolve(root, name);
-  const relative5 = path21.relative(root, dest);
-  if (relative5 !== name || relative5 === "" || path21.isAbsolute(relative5)) {
+  const relative6 = path21.relative(root, dest);
+  if (relative6 !== name || relative6 === "" || path21.isAbsolute(relative6)) {
     throw new Error(`Plugin install path escapes the plugins directory: ${JSON.stringify(name)}`);
   }
   return dest;
@@ -21918,7 +23190,7 @@ var RunnerRegistry = class {
   }
   installFromGit(url) {
     const validated = assertInstallablePluginUrl(url);
-    const tmpDir = path23.join(os6.tmpdir(), `ordewell-plugin-${randomBytes6(12).toString("hex")}`);
+    const tmpDir = path23.join(os6.tmpdir(), `ordewell-plugin-${randomBytes7(12).toString("hex")}`);
     this.store.ensureDir(tmpDir);
     try {
       try {
@@ -22337,11 +23609,15 @@ export {
   NO_TURN,
   OPENCODE_MANIFEST,
   ORCHESTRATOR_SHORTCUTS,
+  ORDEWELL_MCP_PATH,
+  ORDEWELL_MCP_SERVER_NAME,
   ORDEWELL_SETTABLE_ENV,
   OUTPUT_LINES_DEFAULT,
   OUTPUT_LINES_MAX,
   OpenAiService,
   OpenCodeAdapter,
+  OrdewellMcpServer,
+  PLANNER_TOOLS,
   PLAN_ENVELOPE_KEY,
   PLUGIN_NAME_PATTERN,
   PROVIDER_CREDENTIAL_ENV,
@@ -22378,6 +23654,7 @@ export {
   TASK_QUERY_FIELDS,
   TASK_QUERY_PROTOCOL,
   TASK_QUERY_REMINDER,
+  TASK_TOOLS,
   TRUNCATED_PLAN_REPAIR_INSTRUCTION,
   TaskControlError,
   TaskLogRecorder,
@@ -22461,10 +23738,14 @@ export {
   daemonTokenPath,
   defaultLogger,
   definitionPattern,
+  defuseMarkers,
   deleteSession,
   dependencyCandidates,
   dependentsOf,
   describeMergeResult,
+  diffRows,
+  diffStat,
+  diffSummary,
   digestTaskLog,
   discoverGeminiModels,
   drainNext,
@@ -22527,6 +23808,7 @@ export {
   loadState,
   looksLikePlanAttempt,
   mapAgentTool,
+  mcpClientConfig,
   migrateLegacyPlan,
   migrateOldConfigDir,
   migratePlanIsolation,
@@ -22542,6 +23824,7 @@ export {
   opensWithJsonObject,
   outputLines,
   outputPreview,
+  ownerOnlyConfigFile,
   parseAutonomyLevel,
   parseMaxParallel,
   parsePartialPlan,
@@ -22600,6 +23883,7 @@ export {
   serializeTaskStatus,
   sessionDataDir,
   sessionRuntimeSettings,
+  sharedMcpServer,
   stateExists,
   stopTurn,
   stripAnsi,
@@ -22633,6 +23917,7 @@ export {
   usageLine,
   validateModifiedPlan,
   validatePlanModification,
+  validatePlanTasks,
   warningsText,
   wellKnownBinDirs,
   windowsCommandLine,