@ordewell/core 0.6.3 → 0.7.0

package/dist/index.js

@@ -79,11 +79,15 @@ __export(index_exports, {
   NO_TURN: () => NO_TURN,
   OPENCODE_MANIFEST: () => OPENCODE_MANIFEST,
   ORCHESTRATOR_SHORTCUTS: () => ORCHESTRATOR_SHORTCUTS,
+  ORDEWELL_MCP_PATH: () => ORDEWELL_MCP_PATH,
+  ORDEWELL_MCP_SERVER_NAME: () => ORDEWELL_MCP_SERVER_NAME,
   ORDEWELL_SETTABLE_ENV: () => ORDEWELL_SETTABLE_ENV,
   OUTPUT_LINES_DEFAULT: () => OUTPUT_LINES_DEFAULT,
   OUTPUT_LINES_MAX: () => OUTPUT_LINES_MAX,
   OpenAiService: () => OpenAiService,
   OpenCodeAdapter: () => OpenCodeAdapter,
+  OrdewellMcpServer: () => OrdewellMcpServer,
+  PLANNER_TOOLS: () => PLANNER_TOOLS,
   PLAN_ENVELOPE_KEY: () => PLAN_ENVELOPE_KEY,
   PLUGIN_NAME_PATTERN: () => PLUGIN_NAME_PATTERN,
   PROVIDER_CREDENTIAL_ENV: () => PROVIDER_CREDENTIAL_ENV,
@@ -120,6 +124,7 @@ __export(index_exports, {
   TASK_QUERY_FIELDS: () => TASK_QUERY_FIELDS,
   TASK_QUERY_PROTOCOL: () => TASK_QUERY_PROTOCOL,
   TASK_QUERY_REMINDER: () => TASK_QUERY_REMINDER,
+  TASK_TOOLS: () => TASK_TOOLS,
   TRUNCATED_PLAN_REPAIR_INSTRUCTION: () => TRUNCATED_PLAN_REPAIR_INSTRUCTION,
   TaskControlError: () => TaskControlError,
   TaskLogRecorder: () => TaskLogRecorder,
@@ -203,10 +208,14 @@ __export(index_exports, {
   daemonTokenPath: () => daemonTokenPath,
   defaultLogger: () => defaultLogger,
   definitionPattern: () => definitionPattern,
+  defuseMarkers: () => defuseMarkers,
   deleteSession: () => deleteSession,
   dependencyCandidates: () => dependencyCandidates,
   dependentsOf: () => dependentsOf,
   describeMergeResult: () => describeMergeResult,
+  diffRows: () => diffRows,
+  diffStat: () => diffStat,
+  diffSummary: () => diffSummary,
   digestTaskLog: () => digestTaskLog,
   discoverGeminiModels: () => discoverGeminiModels,
   drainNext: () => drainNext,
@@ -269,6 +278,7 @@ __export(index_exports, {
   loadState: () => loadState,
   looksLikePlanAttempt: () => looksLikePlanAttempt,
   mapAgentTool: () => mapAgentTool,
+  mcpClientConfig: () => mcpClientConfig,
   migrateLegacyPlan: () => migrateLegacyPlan,
   migrateOldConfigDir: () => migrateOldConfigDir,
   migratePlanIsolation: () => migratePlanIsolation,
@@ -284,6 +294,7 @@ __export(index_exports, {
   opensWithJsonObject: () => opensWithJsonObject,
   outputLines: () => outputLines,
   outputPreview: () => outputPreview,
+  ownerOnlyConfigFile: () => ownerOnlyConfigFile,
   parseAutonomyLevel: () => parseAutonomyLevel,
   parseMaxParallel: () => parseMaxParallel,
   parsePartialPlan: () => parsePartialPlan,
@@ -342,6 +353,7 @@ __export(index_exports, {
   serializeTaskStatus: () => serializeTaskStatus,
   sessionDataDir: () => sessionDataDir,
   sessionRuntimeSettings: () => sessionRuntimeSettings,
+  sharedMcpServer: () => sharedMcpServer,
   stateExists: () => stateExists,
   stopTurn: () => stopTurn,
   stripAnsi: () => stripAnsi,
@@ -375,6 +387,7 @@ __export(index_exports, {
   usageLine: () => usageLine,
   validateModifiedPlan: () => validateModifiedPlan,
   validatePlanModification: () => validatePlanModification,
+  validatePlanTasks: () => validatePlanTasks,
   warningsText: () => warningsText,
   wellKnownBinDirs: () => wellKnownBinDirs,
   windowsCommandLine: () => windowsCommandLine,
@@ -709,13 +722,13 @@ function validateModifiedPlan(original, modified) {
   return warnings;
 }
 function warningsText(w) {
-  const lines = [];
-  if (w.deletedCompleted.length) lines.push(`Completed tasks deleted: ${w.deletedCompleted.join(", ")}`);
-  if (w.changedCompleted.length) lines.push(`Completed tasks modified: ${w.changedCompleted.join(", ")}`);
-  if (w.deletedInProgress.length) lines.push(`In-progress tasks deleted: ${w.deletedInProgress.join(", ")}`);
-  if (w.modifiedInProgress.length) lines.push(`In-progress tasks modified: ${w.modifiedInProgress.join(", ")}`);
-  if (w.brokenDependencies.length) lines.push(`Broken dependencies: ${w.brokenDependencies.join(", ")}`);
-  return lines.length > 0 ? lines.join("\n") : null;
+  const lines2 = [];
+  if (w.deletedCompleted.length) lines2.push(`Completed tasks deleted: ${w.deletedCompleted.join(", ")}`);
+  if (w.changedCompleted.length) lines2.push(`Completed tasks modified: ${w.changedCompleted.join(", ")}`);
+  if (w.deletedInProgress.length) lines2.push(`In-progress tasks deleted: ${w.deletedInProgress.join(", ")}`);
+  if (w.modifiedInProgress.length) lines2.push(`In-progress tasks modified: ${w.modifiedInProgress.join(", ")}`);
+  if (w.brokenDependencies.length) lines2.push(`Broken dependencies: ${w.brokenDependencies.join(", ")}`);
+  return lines2.length > 0 ? lines2.join("\n") : null;
 }
 
 // src/models/Usage.ts
@@ -775,14 +788,14 @@ function capLine(line) {
   return line.length > MAX_LINE_CHARS ? `${line.slice(0, MAX_LINE_CHARS)}\u2026` : line;
 }
 function trimToolOutput(output) {
-  const lines = output.split("\n");
-  const long = lines.some((l) => l.length > MAX_LINE_CHARS);
-  if (lines.length <= HEAD_LINES + TAIL_LINES) return long ? { output: lines.map(capLine).join("\n") } : { output };
-  const omittedLines = lines.length - HEAD_LINES - TAIL_LINES;
+  const lines2 = output.split("\n");
+  const long = lines2.some((l) => l.length > MAX_LINE_CHARS);
+  if (lines2.length <= HEAD_LINES + TAIL_LINES) return long ? { output: lines2.map(capLine).join("\n") } : { output };
+  const omittedLines = lines2.length - HEAD_LINES - TAIL_LINES;
   const kept = [
-    ...lines.slice(0, HEAD_LINES),
+    ...lines2.slice(0, HEAD_LINES),
     `\u2026 ${omittedLines} line${omittedLines === 1 ? "" : "s"} omitted \u2026`,
-    ...lines.slice(-TAIL_LINES)
+    ...lines2.slice(-TAIL_LINES)
   ];
   return { output: kept.map(capLine).join("\n"), omittedLines };
 }
@@ -862,15 +875,15 @@ function digestTaskLog(events, maxCalls) {
     else if (event.type === "text") lastText = event.text;
     else if (event.type === "error") lastError = event.message;
   }
-  const lines = [];
+  const lines2 = [];
   for (const event of events) {
     if (event.type !== "tool_call") continue;
     const outcome = outcomes.get(event.id);
     const args = event.args.length > DIGEST_ARGS_CHARS ? `${event.args.slice(0, DIGEST_ARGS_CHARS)}\u2026` : event.args;
-    lines.push(`- ${event.name} ${args} \u2192 ${outcome === void 0 ? "no result" : outcome ? "ok" : "failed"}`);
+    lines2.push(`- ${event.name} ${args} \u2192 ${outcome === void 0 ? "no result" : outcome ? "ok" : "failed"}`);
   }
-  const omitted = lines.length - maxCalls;
-  const out = omitted > 0 ? [`\u2026 ${omitted} earlier call${omitted === 1 ? "" : "s"} omitted \u2026`, ...lines.slice(omitted)] : lines;
+  const omitted = lines2.length - maxCalls;
+  const out = omitted > 0 ? [`\u2026 ${omitted} earlier call${omitted === 1 ? "" : "s"} omitted \u2026`, ...lines2.slice(omitted)] : lines2;
   const gap = () => out.length > 0 ? [""] : [];
   const said2 = lastText?.trim();
   if (said2) {
@@ -908,9 +921,9 @@ var SEARCH_EXCLUSIONS = [
 ];
 
 // src/interfaces/IApproval.ts
-function toApprovalDecision(answer) {
-  if (typeof answer === "boolean") return { decision: answer ? "allow" : "deny" };
-  return answer;
+function toApprovalDecision(answer2) {
+  if (typeof answer2 === "boolean") return { decision: answer2 ? "allow" : "deny" };
+  return answer2;
 }
 function isGranted(decision) {
   return decision.decision !== "deny";
@@ -2987,7 +3000,10 @@ var WRAPPER_FAMILY = {
   // The multi-call binary ships its own `rm`, `mv` and `sh`, so the refused
   // name arrives as its first argument.
   busybox: { booleanFlags: ["--list", "--install", ...HELP_FLAGS] },
-  command: { booleanFlags: ["-p"], noExecFlags: ["-v", "-V"] }
+  command: { booleanFlags: ["-p"], noExecFlags: ["-v", "-V"] },
+  // Runs the named shell builtin, so `builtin eval …` is an `eval`. Classified
+  // on its own name it only asked, and a grant for `builtin echo` covered it.
+  builtin: {}
 };
 var XARGS_SPEC = {
   valueFlags: [
@@ -3717,6 +3733,9 @@ function refusalFor(seg) {
   if (seg.binary === "source" || seg.binary === ".") {
     return `"${seg.binary}" runs a file's contents as commands, which this classifier cannot inspect. Use the read-only research tools, or describe it as a task.`;
   }
+  if (seg.binary === "enable" && seg.args.some((a) => /^-[a-zA-Z]*f/.test(a))) {
+    return `"enable -f" loads a shared library into the shell, which runs its code. Use the read-only research tools, or describe it as a task.`;
+  }
   if (SHELL_KEYWORDS.includes(seg.binary)) {
     return `"${seg.binary}" is a shell keyword or compound-command opener. This classifier only inspects the command that runs first, and a keyword hides the real one from it. Run the inner command directly, or describe it as a task.`;
   }
@@ -3827,6 +3846,9 @@ function classifyCommand(command, opts = {}) {
   }
   const nonAuto = unwrapped.filter((u) => u.runner !== void 0 || !isAuto(u.seg, opts));
   if (nonAuto.length === 0) return { tier: "auto", scope: "" };
+  if (nonAuto.some((u) => u.seg.binary === "cd" || u.seg.binary !== "command" && SHELL_STATE_COMMANDS.has(u.seg.binary))) {
+    return { tier: "ask", scope: trimmed };
+  }
   const scope = [...new Set(nonAuto.map((u) => u.runner ? `${u.runner} ${scopeFor(u.seg)}` : scopeFor(u.seg)))].sort().join(" + ");
   return { tier: "ask", scope };
 }
@@ -4447,12 +4469,12 @@ var ApprovalPolicy = class {
       if (this.generation === gen) this.inFlight.delete(openKey);
     });
     this.inFlight.set(openKey, pending);
-    const answer = await pending;
+    const answer2 = await pending;
     if (this.generation === gen) {
-      if (answer) open.forEach((s) => this.granted.add(s));
+      if (answer2) open.forEach((s) => this.granted.add(s));
       else this.refused.add(key);
     }
-    return decide(answer, "asked");
+    return decide(answer2, "asked");
   }
   /** Scopes the user has granted this session — for display and for persistence. */
   grantedScopes() {
@@ -4513,10 +4535,10 @@ var PendingApprovals = class {
    * settled. "Allow for this task" on a request that did not offer it is a
    * plain allow: no grant is made that the requester never proposed.
    */
-  resolve(id, answer) {
+  resolve(id, answer2) {
     const entry = this.entries.get(id);
     if (!entry) return false;
-    const decision = toApprovalDecision(answer);
+    const decision = toApprovalDecision(answer2);
     entry.settle(decision.decision === "allowForTask" && !entry.pending.request.allowForTask ? { decision: "allow" } : decision);
     return true;
   }
@@ -4561,6 +4583,10 @@ var KNOWN_TOOLS = {
   list: "list_dir",
   fetch: "fetch"
 };
+var FILE_EDIT_TOOLS = /* @__PURE__ */ new Set(["edit", "write", "multiedit", "notebookedit", "applypatch", "patch", "add", "update", "delete", "filechange"]);
+function isFileEditTool(name) {
+  return FILE_EDIT_TOOLS.has(name.trim().toLowerCase().replace(/[_-]/g, ""));
+}
 function mapAgentTool(name) {
   const normalized = name.trim().toLowerCase().replace(/[_-]/g, "");
   const direct = KNOWN_TOOLS[normalized] ?? KNOWN_TOOLS[name.trim().toLowerCase()];
@@ -4569,25 +4595,25 @@ function mapAgentTool(name) {
   }
   return { tool: "agent_tool", toolLabel: name };
 }
-function normalizeAgentArgs(tool, args) {
+function normalizeAgentArgs(tool2, args) {
   const out = { ...args };
   const alias = (from, to) => {
     if (out[to] === void 0 && out[from] !== void 0) out[to] = out[from];
   };
-  if (tool === "read_file" || tool === "list_dir") {
+  if (tool2 === "read_file" || tool2 === "list_dir") {
     alias("filePath", "path");
     alias("file_path", "path");
     alias("target", "path");
   }
-  if (tool === "bash") {
+  if (tool2 === "bash") {
     alias("cmd", "command");
     alias("script", "command");
     if (typeof out.command !== "string" && Array.isArray(out.command)) {
       out.command = out.command.join(" ");
     }
   }
-  if (tool === "fetch") alias("uri", "url");
-  if (tool === "web_search") alias("q", "query");
+  if (tool2 === "fetch") alias("uri", "url");
+  if (tool2 === "web_search") alias("q", "query");
   return out;
 }
 
@@ -4756,13 +4782,13 @@ function renderTerminalOutput(raw) {
 function renderCleanCapture(raw, doneToken) {
   const rendered = renderTerminalOutput(raw).replace(/[\s─-▟]+$/gm, "");
   if (!doneToken) return rendered.trim();
-  const lines = rendered.split("\n");
+  const lines2 = rendered.split("\n");
   const flat = (s) => flattenTerminalOutput(s);
-  for (let i = 0; i < lines.length; i++) {
-    const own = flat(lines[i]).includes(doneToken);
-    if (own) return lines.slice(0, i).join("\n").trim();
-    const window = flat(lines[i]) + (i + 1 < lines.length ? flat(lines[i + 1]) : "");
-    if (window.includes(doneToken)) return lines.slice(0, i + 1).join("\n").trim();
+  for (let i = 0; i < lines2.length; i++) {
+    const own = flat(lines2[i]).includes(doneToken);
+    if (own) return lines2.slice(0, i).join("\n").trim();
+    const window = flat(lines2[i]) + (i + 1 < lines2.length ? flat(lines2[i + 1]) : "");
+    if (window.includes(doneToken)) return lines2.slice(0, i + 1).join("\n").trim();
   }
   return rendered.trim();
 }
@@ -4793,9 +4819,9 @@ function oneLine(text2) {
   return text2.replace(/\s+/g, " ").trim();
 }
 function firstLineOf(command) {
-  const lines = command.trim().split(/\r?\n/);
-  const more = lines.length - 1;
-  return more > 0 ? `${lines[0]} \u2026 +${more} line${more === 1 ? "" : "s"}` : lines[0];
+  const lines2 = command.trim().split(/\r?\n/);
+  const more = lines2.length - 1;
+  return more > 0 ? `${lines2[0]} \u2026 +${more} line${more === 1 ? "" : "s"}` : lines2[0];
 }
 function text(value) {
   return typeof value === "string" ? value : "";
@@ -4811,8 +4837,8 @@ function hintArg(args) {
   const firstText = Object.values(args).find((v) => typeof v === "string" && v.trim() !== "");
   return firstText ? oneLine(firstText) : "";
 }
-function keyArgOf(tool, args) {
-  switch (tool) {
+function keyArgOf(tool2, args) {
+  switch (tool2) {
     case "bash":
       return firstLineOf(text(args.command));
     case "read_file":
@@ -4836,20 +4862,62 @@ function keyArgOf(tool, args) {
       return hintArg(args);
   }
 }
-function toolHeadline(tool, args, toolLabel) {
-  const name = toolLabel?.trim() || DISPLAY_NAMES[tool] || tool;
+function toolHeadline(tool2, args, toolLabel) {
+  const name = toolLabel?.trim() || DISPLAY_NAMES[tool2] || tool2;
   const parsed = parseArgs(args);
-  return { name, keyArg: parsed ? keyArgOf(tool, parsed) : oneLine(args) };
+  return { name, keyArg: parsed ? keyArgOf(tool2, parsed) : oneLine(args) };
 }
 function outputLines(output) {
-  const lines = output.replace(/\r\n?/g, "\n").replace(ANSI_OR_CTRL_RE, "").split("\n");
-  while (lines.length > 0 && lines[lines.length - 1].trim() === "") lines.pop();
-  return lines;
+  const lines2 = output.replace(/\r\n?/g, "\n").replace(ANSI_OR_CTRL_RE, "").split("\n");
+  while (lines2.length > 0 && lines2[lines2.length - 1].trim() === "") lines2.pop();
+  return lines2;
 }
 function outputPreview(output, maxLines) {
-  const lines = outputLines(output);
-  const shown = lines.slice(0, Math.max(0, maxLines));
-  return { lines: shown, hiddenLineCount: lines.length - shown.length };
+  const lines2 = outputLines(output);
+  const shown = lines2.slice(0, Math.max(0, maxLines));
+  return { lines: shown, hiddenLineCount: lines2.length - shown.length };
+}
+function diffStat(output) {
+  const lines2 = outputLines(output);
+  let added = 0;
+  let removed = 0;
+  for (const line of lines2) {
+    if (line.startsWith("+")) added += 1;
+    else if (line.startsWith("-")) removed += 1;
+    else if (!(line.startsWith("@@") || line.startsWith(" ") || line === "" || line.startsWith("\\"))) return null;
+  }
+  return added + removed > 0 ? { added, removed } : null;
+}
+var HUNK_RANGE = /^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/;
+function diffRows(output) {
+  const rows = [];
+  let oldLine = 1;
+  let newLine = 1;
+  for (const line of outputLines(output)) {
+    const range2 = HUNK_RANGE.exec(line);
+    if (range2) {
+      if (rows.length > 0) rows.push({ kind: "gap", text: "" });
+      oldLine = Number(range2[1]);
+      newLine = Number(range2[2]);
+    } else if (line.startsWith("+")) {
+      rows.push({ kind: "added", line: newLine++, text: line.slice(1) });
+    } else if (line.startsWith("-")) {
+      rows.push({ kind: "removed", line: oldLine++, text: line.slice(1) });
+    } else if (!line.startsWith("\\")) {
+      rows.push({ kind: "context", line: newLine, text: line.slice(1) });
+      oldLine += 1;
+      newLine += 1;
+    }
+  }
+  return rows;
+}
+function lines(count) {
+  return `${count} line${count === 1 ? "" : "s"}`;
+}
+function diffSummary({ added, removed }) {
+  if (!removed) return `Added ${lines(added)}`;
+  if (!added) return `Removed ${lines(removed)}`;
+  return `Added ${lines(added)}, removed ${lines(removed)}`;
 }
 
 // src/conversation/records.ts
@@ -4878,17 +4946,18 @@ var STATUS_OF_OUTCOME = {
   not_executed: "interrupted"
 };
 function finishedTool(call, output, outcome) {
-  return { ...call, status: STATUS_OF_OUTCOME[outcome], outcome, output, outputLineCount: outputLines(output).length };
+  const diff = outcome === "success" && isFileEditTool(call.toolLabel ?? call.tool) ? diffStat(output) : null;
+  return { ...call, status: STATUS_OF_OUTCOME[outcome], outcome, output, outputLineCount: outputLines(output).length, ...diff ? { diff } : {} };
 }
 function settledTool(call, step) {
   return finishedTool(call, step.result, step.outcome);
 }
-function pendingTool(id, { tool, toolLabel, args, toolCallId, turnId }) {
+function pendingTool(id, { tool: tool2, toolLabel, args, toolCallId, turnId }) {
   return {
     type: "tool",
     id,
-    tool,
-    headline: toolHeadline(tool, args, toolLabel),
+    tool: tool2,
+    headline: toolHeadline(tool2, args, toolLabel),
     args,
     status: "pending",
     output: "",
@@ -5078,12 +5147,12 @@ function thinkingWhole(view, { text: text2, subagentId }) {
   return streamWhole(placed, lane, thinkingStream(subagentId), text2, (id) => thinkingBlock(id, blockText(text2), false, subagentId));
 }
 function announceTool(view, { id: toolCallId, name, args, subagentId }) {
-  const { tool, toolLabel } = mapAgentTool(name);
+  const { tool: tool2, toolLabel } = mapAgentTool(name);
   const [placed, lane] = laneOf(view, subagentId);
   return appendOutput(placed, lane, (id) => {
-    const call = pendingTool(id, { tool, toolLabel, args, toolCallId });
+    const call = pendingTool(id, { tool: tool2, toolLabel, args, toolCallId });
     const parsed = parseArgs2(args);
-    return parsed ? { ...call, headline: toolHeadline(tool, JSON.stringify(normalizeAgentArgs(tool, parsed)), toolLabel) } : call;
+    return parsed ? { ...call, headline: toolHeadline(tool2, JSON.stringify(normalizeAgentArgs(tool2, parsed)), toolLabel) } : call;
   });
 }
 function parseArgs2(args) {
@@ -5123,21 +5192,21 @@ function reportUsage(view, { record }) {
   const next = { ...view, usage };
   return isMeasured(usage.totals) ? setUsageLine(next, usageLine(usage)) : next;
 }
-function runnerToolSubject(tool, args) {
-  const { tool: mapped, toolLabel } = mapAgentTool(tool);
+function runnerToolSubject(tool2, args) {
+  const { tool: mapped, toolLabel } = mapAgentTool(tool2);
   const parsed = parseArgs2(args);
   const headline = toolHeadline(mapped, parsed ? JSON.stringify(normalizeAgentArgs(mapped, parsed)) : args, toolLabel);
   return headline.keyArg ? `${headline.name}(${headline.keyArg})` : headline.name;
 }
-function requestApproval(view, { approvalId, tool, args, allowForTask, toolCallId }) {
+function requestApproval(view, { approvalId, tool: tool2, args, allowForTask, toolCallId }) {
   if (view.blocks.some((b) => b.type === "approval" && b.approvalId === approvalId)) return view;
   return append(view, (id) => ({
     type: "approval",
     id,
     approvalId,
     kind: "runner_tool",
-    subject: runnerToolSubject(tool, args),
-    scope: tool,
+    subject: runnerToolSubject(tool2, args),
+    scope: tool2,
     status: "pending",
     ...allowForTask ? { allowForTask } : {},
     ...toolCallId ? { toolCallId } : {}
@@ -5431,9 +5500,9 @@ function applyHeadLimit(stdout, headLimit) {
 }
 function formatSearchOutput(capped, root, opts) {
   if (capped.rows.length === 0) return opts.emptyMessage;
-  const sep2 = opts.sep ?? import_node_path.default.sep;
-  const prefix = root === sep2 || root.endsWith(sep2) ? root : `${root}${sep2}`;
-  const body = prefix === sep2 ? capped.rows.join("\n") : capped.rows.map((row) => row.startsWith(prefix) ? row.slice(prefix.length) : row).join("\n");
+  const sep3 = opts.sep ?? import_node_path.default.sep;
+  const prefix = root === sep3 || root.endsWith(sep3) ? root : `${root}${sep3}`;
+  const body = prefix === sep3 ? capped.rows.join("\n") : capped.rows.map((row) => row.startsWith(prefix) ? row.slice(prefix.length) : row).join("\n");
   if (!capped.truncated) return body;
   const hint = opts.hint ? ` ${opts.hint}` : "";
   return `${body}
@@ -6483,28 +6552,28 @@ function posixBinDirs() {
   ];
 }
 function windowsBinDirs(env, home) {
-  const join26 = (...parts) => path5.win32.join(...parts);
-  const under = (base, ...parts) => base ? [join26(base, ...parts)] : [];
+  const join27 = (...parts) => path5.win32.join(...parts);
+  const under = (base, ...parts) => base ? [join27(base, ...parts)] : [];
   const appData = env.APPDATA;
   const localAppData = env.LOCALAPPDATA;
   const programData = env.ProgramData;
   return [
     // Native per-user installers, PowerShell-driven and otherwise.
-    join26(home, ".local", "bin"),
-    join26(home, ".opencode", "bin"),
-    join26(home, ".claude", "bin"),
-    join26(home, ".codex", "bin"),
+    join27(home, ".local", "bin"),
+    join27(home, ".opencode", "bin"),
+    join27(home, ".claude", "bin"),
+    join27(home, ".codex", "bin"),
     ...under(localAppData, "Programs", "claude"),
     // Node package managers. npm's global prefix is `%APPDATA%\npm`; the
     // literal spelling is kept as a fallback for a host that does not export
     // APPDATA (a service account, a stripped CI container).
     ...under(appData, "npm"),
-    join26(home, "AppData", "Roaming", "npm"),
+    join27(home, "AppData", "Roaming", "npm"),
     ...under(localAppData, "pnpm"),
     ...under(localAppData, "Yarn", "bin"),
-    join26(home, ".bun", "bin"),
+    join27(home, ".bun", "bin"),
     // Windows package managers.
-    join26(home, "scoop", "shims"),
+    join27(home, "scoop", "shims"),
     ...under(env.SCOOP, "shims"),
     ...under(env.SCOOP_GLOBAL ?? programData, "scoop", "shims"),
     ...under(programData, "chocolatey", "bin"),
@@ -6514,7 +6583,7 @@ function windowsBinDirs(env, home) {
     ...under(localAppData, "Microsoft", "WindowsApps"),
     // Version managers. Volta's Windows home is not the POSIX `~/.volta`.
     ...under(localAppData, "Volta", "bin"),
-    join26(home, ".volta", "bin")
+    join27(home, ".volta", "bin")
   ];
 }
 function wellKnownBinDirs(deps = {}) {
@@ -7002,18 +7071,18 @@ var GitWorktreeIsolation = class {
    */
   sharedPaths(workspaceRoot, isolated) {
     if (isolated.includes(SELF_REPO)) return [];
-    const shared = [];
+    const shared2 = [];
     const walk = (rel) => {
       for (const name of listDir(path9.join(workspaceRoot, rel))) {
         if (!rel && (name === STATE_DIR || name === ".git")) continue;
         const child = rel ? `${rel}/${name}` : name;
         if (isolated.includes(child)) continue;
         if (isolated.some((p) => p.startsWith(`${child}/`))) walk(child);
-        else if (resolves(path9.join(workspaceRoot, child))) shared.push(child);
+        else if (resolves(path9.join(workspaceRoot, child))) shared2.push(child);
       }
     };
     walk("");
-    return shared;
+    return shared2;
   }
   prepare(task, run) {
     return this.admin(run.workspaceRoot, async () => {
@@ -7827,13 +7896,14 @@ function filteredBuildModes(modes, autonomousDefault) {
   return buildModes;
 }
 function autonomyLevelLabel(autonomous) {
-  return autonomous ? "Full auto" : "Auto";
+  return autonomous ? "Full" : "Guarded";
 }
 function parseAutonomyLevel(arg) {
   switch (arg?.trim().toLowerCase()) {
     case "full":
     case "on":
       return true;
+    case "guarded":
     case "auto":
     case "off":
       return false;
@@ -7842,7 +7912,7 @@ function parseAutonomyLevel(arg) {
   }
 }
 function buildModeGuide(runnerModes, autonomousDefault = true) {
-  const lines = [];
+  const lines2 = [];
   for (const [runnerId, modes] of Object.entries(runnerModes)) {
     if (!modes || modes.length === 0) continue;
     const filtered = filteredBuildModes(modes, autonomousDefault);
@@ -7851,13 +7921,13 @@ function buildModeGuide(runnerModes, autonomousDefault = true) {
       const tag = isDefaultMode(m, autonomousDefault) ? " (DEFAULT)" : "";
       return `${m.id}${tag} (${m.description})`;
     }).join(", ");
-    lines.push(`- ${runnerId}: ${modeStr}`);
+    lines2.push(`- ${runnerId}: ${modeStr}`);
   }
-  if (lines.length === 0) return "";
+  if (lines2.length === 0) return "";
   return [
     `Autonomy level: ${autonomyLevelLabel(autonomousDefault)}.`,
     "AVAILABLE MODES PER RUNNER:",
-    ...lines,
+    ...lines2,
     "",
     'For each AI task, use the mode marked (DEFAULT) unless the task needs a different compatible mode listed above. Avoid the "plan" mode (read-only) unless the user explicitly requested analysis-only.'
   ].join("\n");
@@ -8098,10 +8168,12 @@ var TASK_QUERY_FIELDS = [
   "userStoriesCovered",
   "output"
 ];
+var TASK_QUERY_TASK_FIELDS = TASK_QUERY_FIELDS.filter((f) => f !== "output");
 var OUTPUT_LINES_DEFAULT = 80;
 var OUTPUT_LINES_MAX = 400;
 var TASK_QUERY_ANSWER_MAX_CHARS = 2e4;
 var ANSWER_TAIL_RESERVE = 4e3;
+var OUTPUT_TAIL_MAX_CHARS = TASK_QUERY_ANSWER_MAX_CHARS - ANSWER_TAIL_RESERVE;
 function textHasTaskQuery(text2) {
   return text2.includes(`"${TASK_QUERY_ENVELOPE_KEY}"`);
 }
@@ -8177,6 +8249,7 @@ function taskQuerySignature(query) {
   return JSON.stringify([query.tasks, query.fields ?? null, query.catalog, query.outputLines ?? null, query.outputSince ?? null]);
 }
 var TASK_QUERY_ANSWER_OR_OPS = "You have now read everything you asked for. Do not send another taskQuery this turn: answer the user in prose, or emit the taskOps JSON for the change you came to make.";
+var TASK_READ_ANSWER_OR_EDIT = "You have now read everything you asked for. Do not read again this turn: answer the user in prose, or call edit_plan for the change you came to make.";
 var TASK_QUERY_PROTOCOL = [
   "READING A TASK BEFORE YOU EDIT IT:",
   "The plan block you are shown each turn carries only short fields \u2014 it never contains a task's prompt, its user steps, or a completed task's verdict. Never rewrite a field you have not read. To read one, reply with ONLY this JSON object:",
@@ -8188,7 +8261,16 @@ var TASK_QUERY_PROTOCOL = [
   "Ordewell answers immediately with the detail and changes nothing. Then reply again with your taskOps JSON, or with prose for the user.",
   "Three queries per user message; after that every answer also tells you to land the turn. Do not ask the same question twice."
 ];
+var TASK_READ_TOOLS_PROTOCOL = [
+  "READING A TASK BEFORE YOU EDIT IT:",
+  "The plan block you are shown each turn carries only short fields \u2014 it never contains a task's prompt, its user steps, or a completed task's verdict. Never rewrite a field you have not read. Read with these tools; they change nothing:",
+  '- task_query: "tasks" are one or more task references ("<id or #order>"). Ask for everything you need in ONE call. "fields" is optional (omit it to get description, prompt, userSteps, verdict, outputSummary and userStoriesCovered). "catalog": true also returns every runner with its models, thinking-effort variants and modes.',
+  `- task_output: the recent output of a task that is running right now \u2014 the way to diagnose a task that looks stuck mid-execution. "lines" (default 80, at most 400) sets how many; pass an answer's "nextOffset" back as "since" to read only what follows. A task that is not running answers with its verdict, output summary and a digest of its last attempt.`,
+  "Three reads per user message; after that every answer also tells you to land the turn, and after six they are refused. Do not ask the same question twice.",
+  "Once a plan exists, change it with edit_plan \u2014 every turn shows you its operations. Never reply with taskOps or taskQuery JSON."
+];
 var TASK_QUERY_REMINDER = `- To READ a task in full (prompt, user steps, verdict, output, user stories) or the whole model/mode catalog before editing, reply with ONLY {"${TASK_QUERY_ENVELOPE_KEY}":{"tasks":["<id or #order>"],"catalog":true}} \u2014 it changes nothing, and you then reply again with your ops.`;
+var TASK_READ_TOOLS_REMINDER = "- To READ a task in full (prompt, user steps, verdict, user stories), a running task's output, or the whole model/mode catalog before editing, call task_query or task_output \u2014 they change nothing \u2014 and then call edit_plan with your ops.";
 function findTask(tasks, ref) {
   const byId = tasks.find((t) => t.id === ref);
   if (byId) return byId;
@@ -8202,13 +8284,13 @@ function findTask(tasks, ref) {
 function fitTail(text2, budget) {
   if (text2.length <= budget) return { text: text2, trimmed: false };
   if (budget <= 0) return { text: "", trimmed: true };
-  const lines = text2.split("\n");
+  const lines2 = text2.split("\n");
   const kept = [];
   let total = 0;
-  for (let i = lines.length - 1; i >= 0; i--) {
-    const cost = lines[i].length + (kept.length > 0 ? 1 : 0);
+  for (let i = lines2.length - 1; i >= 0; i--) {
+    const cost = lines2[i].length + (kept.length > 0 ? 1 : 0);
     if (total + cost > budget) break;
-    kept.unshift(lines[i]);
+    kept.unshift(lines2[i]);
     total += cost;
   }
   if (kept.length === 0) return { text: text2.slice(text2.length - budget), trimmed: true };
@@ -8259,34 +8341,34 @@ function renderField(task, field, ctx) {
   }
 }
 function renderTask(task, fields, ctx) {
-  const lines = [
+  const lines2 = [
     `#${task.order} id=${task.id} "${task.title}" [${task.status}] type:${task.type === "user" ? "MAN" : "AI"}`,
     ...fields.filter((f) => f !== "output").flatMap((f) => renderField(task, f, ctx)),
     ...fields.includes("output") ? renderLiveOutput(task.id, ctx) : [],
     ""
   ];
-  ctx.used += lines.reduce((n, l) => n + l.length + 1, 0);
-  return lines;
+  ctx.used += lines2.reduce((n, l) => n + l.length + 1, 0);
+  return lines2;
 }
 function renderCatalog(catalog) {
-  const lines = [];
+  const lines2 = [];
   for (const runner of catalog.runners) {
     const models = catalog.models[runner] ?? [];
-    lines.push(`${runner} models:`);
-    if (models.length === 0) lines.push("  (none discovered)");
+    lines2.push(`${runner} models:`);
+    if (models.length === 0) lines2.push("  (none discovered)");
     for (const m of models) {
       const variants = m.variants?.length ? ` variants: ${m.variants.map((v) => `${v.id}${v.label && v.label !== v.id ? ` (${v.label})` : ""}`).join(", ")}` : " variants: none";
-      lines.push(`  - ${m.modelId} \u2014 ${m.modelLabel}${variants}`);
+      lines2.push(`  - ${m.modelId} \u2014 ${m.modelLabel}${variants}`);
     }
     const modes = catalog.modes[runner] ?? [];
-    lines.push(`${runner} task modes:`);
-    if (modes.length === 0) lines.push("  (none declared)");
+    lines2.push(`${runner} task modes:`);
+    if (modes.length === 0) lines2.push("  (none declared)");
     const defaultId = resolveDefaultMode(modes, catalog.autonomousDefault);
     for (const mode of modes) {
-      lines.push(`  - ${mode.id} \u2014 ${mode.label}: ${mode.description}${mode.id === defaultId ? " (default)" : ""}`);
+      lines2.push(`  - ${mode.id} \u2014 ${mode.label}: ${mode.description}${mode.id === defaultId ? " (default)" : ""}`);
     }
   }
-  return lines;
+  return lines2;
 }
 function renderTaskQueryAnswer(query, tasks, catalog, liveOutput) {
   const fields = query.fields ?? TASK_QUERY_FIELDS;
@@ -8320,7 +8402,7 @@ function renderTaskQueryAnswer(query, tasks, catalog, liveOutput) {
 
 // src/services/PlanPrompts.ts
 function buildResearchToolsPrompt() {
-  const lines = [
+  const lines2 = [
     "You have access to the following tools to explore the workspace:",
     "",
     "read_file(path: string, offset?: number, limit?: number) - Read file contents with line numbers and optional pagination. offset is a 0-based line number (default 0). limit is max lines (default 2000). Output lines are prefixed with their line numbers. When a file has more lines than requested, a hint shows the offset to use next. Files larger than ~1 MB are rejected \u2014 use grep instead.",
@@ -8340,7 +8422,7 @@ function buildResearchToolsPrompt() {
     'spawn_research_agent(prompt: string) - Launch a stateless read-only research agent that explores the workspace with its own tools and returns a digest. Use it to delegate an open-ended exploration thread \u2014 a subsystem to map, or a "how does X work here" question \u2014 whenever one emerges during research. To explore several independent areas, launch the agents CONCURRENTLY: put multiple spawn_research_agent calls in one reply and they run in parallel.',
     "The agent sees nothing of this conversation, so its prompt must be self-contained: the area or question, the paths/symbols to start from, and exactly what the digest must report back. Do NOT use it on small or single-subsystem repos, or to read one known file \u2014 direct tools are faster there."
   ];
-  return lines.join("\n");
+  return lines2.join("\n");
 }
 function buildSubagentSystemPrompt() {
   return [
@@ -8357,18 +8439,18 @@ function buildSubagentSystemPrompt() {
   ].join("\n");
 }
 function buildModeGuideForRunners(runners, _autonomousDefault) {
-  const lines = ['Assign a "taskMode" to each AI task based on the runner:'];
+  const lines2 = ['Assign a "taskMode" to each AI task based on the runner:'];
   for (const r of runners) {
     if (r === "claude-code") {
-      lines.push('- For claude-code: "acceptEdits" (edit automatically, recommended), "auto" (a classifier approves or blocks each action), "default" (ask before edits), "plan" (read-only analysis), "bypassPermissions" (skip all prompts, CI only).');
+      lines2.push('- For claude-code: "acceptEdits" (edit automatically, recommended), "auto" (a classifier approves or blocks each action), "default" (ask before edits), "plan" (read-only analysis), "bypassPermissions" (skip all prompts, CI only).');
     } else if (r === "opencode") {
-      lines.push('- For opencode: "build" (full access agent), "plan" (read-only analysis).');
+      lines2.push('- For opencode: "build" (full access agent), "plan" (read-only analysis).');
     } else {
-      lines.push(`- For ${r}: use the modes from the runner's manifest.`);
+      lines2.push(`- For ${r}: use the modes from the runner's manifest.`);
     }
   }
-  lines.push('Use the recommended mode for implementation. Use "plan" for analysis-only requests.');
-  return lines.join("\n");
+  lines2.push('Use the recommended mode for implementation. Use "plan" for analysis-only requests.');
+  return lines2.join("\n");
 }
 function buildModeExamplesForRunners(runners) {
   return runners.map((r) => {
@@ -8397,7 +8479,7 @@ function verificationModeBlock() {
   ].join("\n");
 }
 function researchPhaseBlock(harnessMode) {
-  const shared = [
+  const shared2 = [
     "RESEARCH PHASE:",
     "- Start by reading README.md and any agent config files (AGENTS.md, CLAUDE.md)"
   ];
@@ -8411,7 +8493,7 @@ function researchPhaseBlock(harnessMode) {
     "- Read key source files to understand architecture"
   ];
   return [
-    ...shared,
+    ...shared2,
     ...toolSpecific,
     "- Synthesize tool findings into your messages. The user does not see raw tool output; only your synthesis reaches them.",
     "- Research and questions can interleave \u2014 you can explore a file, then ask a question grounded in it, in one response"
@@ -8473,28 +8555,38 @@ function buildConversationSystemPrompt(goal, context, modelsByRunner, runners, r
     verificationBlock
   );
 }
+var PLANNER_TOOLS_CATALOG = [
+  "RUNNERS, MODELS AND MODES:",
+  "Which runners, models and modes you may assign can change while you plan: the user may enable a runner or edit the model allowlist at any time. Read them just before you submit, never from memory:",
+  "1. Call list_runners: the enabled runners, each with its task modes and default mode.",
+  "2. Call list_models for each runner you will assign: its allowed models, with their thinking-effort variants.",
+  `3. Call submit_plan with the whole plan. "assignedRunner" must be a runner list_runners returned, "assignedModel.modelId" a modelId list_models returned for that runner, "taskMode" one of that runner's modes.`,
+  '4. If submit_plan returns errors, fix exactly what each one names and call it again in the same reply. If it reports "coerced" changes, tell the user what was changed.',
+  ""
+];
 function buildConversationBody(goal, context, modelsJson, runners, modeGuide, modeExamples, variant, verificationBlock) {
+  const tools = variant.plannerTools ?? false;
   return [
-    "You are Ordewell's project planner. You explore the codebase, ask concise clarifying questions grounded in your findings, and produce structured task plans as JSON. Be direct: avoid unnecessary preamble, summaries, or explanations unless the user asks for detail.",
+    `You are Ordewell's project planner. You explore the codebase, ask concise clarifying questions grounded in your findings, and produce structured task plans ${tools ? "through the submit_plan tool" : "as JSON"}. Be direct: avoid unnecessary preamble, summaries, or explanations unless the user asks for detail.`,
     "",
     "WORKFLOW:",
     "1. Explore the workspace with tools to understand the codebase.",
     "2. Ask clarifying questions grounded in your findings. Reference actual files. When the goal is vague, or a decision would materially change the outcome (storage engine, library choice, scope, API shape), ask the user BEFORE planning \u2014 never silently assume. Clear, fully-specified goals need no questions.",
     "3. When you have enough context, produce a prose outline \u2014 a short list describing each vertical slice in order.",
-    '4. After the user confirms the outline, emit the final task plan as a JSON object with a "tasks" array.',
+    tools ? "4. After the user confirms the outline, call list_runners and list_models, then submit the final task plan with submit_plan." : '4. After the user confirms the outline, emit the final task plan as a JSON object with a "tasks" array.',
     "",
     researchPhaseBlock(variant.harness ?? false),
     verificationBlock,
     "",
     "OUTLINE PHASE:",
-    "- When you are ready to propose a plan, first show a prose outline. DO NOT jump straight to JSON.",
+    `- When you are ready to propose a plan, first show a prose outline. DO NOT jump straight to ${tools ? "submit_plan" : "JSON"}.`,
     "- Format: a numbered list describing each vertical tracer-bullet slice, with the files/layers each slice touches.",
     '- Example: "1. Set up database schema (src/db/schema.ts) \u2014 creates tables for users and sessions\n2. Add auth middleware (src/auth/middleware.ts) \u2014 validates JWTs on protected routes\n3. Build login page (src/ui/Login.tsx) \u2014 form component with validation"',
     "- The user may reply with adjustments. Revise the outline and re-present it.",
-    "- When the user confirms the outline, emit the task plan JSON.",
+    tools ? "- When the user confirms the outline, submit the plan with submit_plan." : "- When the user confirms the outline, emit the task plan JSON.",
     "",
     "PLAN FORMAT:",
-    "Generate a task plan using this JSON format:",
+    tools ? 'submit_plan takes {"tasks": [...]}, every task in this shape:' : "Generate a task plan using this JSON format:",
     "",
     "{",
     '  "tasks": [',
@@ -8508,8 +8600,8 @@ function buildConversationBody(goal, context, modelsJson, runners, modeGuide, mo
     '      "prompt": "Detailed instructions for the AI assistant (ai tasks only)",',
     '      "userSteps": [{ "order": 1, "instruction": "Step description", "completed": false }],',
     `      "assignedModel": { "modelId": "model-id", "modelLabel": "Model Label", "thinkingEffort": "a variant id from that model's variants list \u2014 omit if the model has none" },`,
-    '      "assignedRunner": "' + runners.join("|") + '",',
-    '      "taskMode": "' + modeExamples + '",',
+    '      "assignedRunner": "' + (tools ? "a runner id from list_runners" : runners.join("|")) + '",',
+    '      "taskMode": "' + (tools ? "one of that runner's modes from list_runners" : modeExamples) + '",',
     '      "autonomy": "AFK|HITL",',
     '      "sliceType": "AFK|HITL",',
     '      "ops": true,',
@@ -8541,8 +8633,13 @@ function buildConversationBody(goal, context, modelsJson, runners, modeGuide, mo
     ...opsTaskSection(true),
     "",
     "RULES:",
-    "- Do NOT wrap the JSON in markdown code blocks. Output ONLY the JSON object when committing the plan.",
-    "- Emit the outline BEFORE the JSON. Do not skip the outline.",
+    ...tools ? [
+      "- Submit the plan ONLY through submit_plan. Never write it as JSON in your reply.",
+      "- Show the outline BEFORE submitting. Do not skip the outline."
+    ] : [
+      "- Do NOT wrap the JSON in markdown code blocks. Output ONLY the JSON object when committing the plan.",
+      "- Emit the outline BEFORE the JSON. Do not skip the outline."
+    ],
     "- Reference specific files and patterns from your research in task prompts.",
     ...variant.isolatedExecution ? [] : [OVERLAP_AVOIDANCE_RULE],
     "",
@@ -8550,23 +8647,19 @@ function buildConversationBody(goal, context, modelsJson, runners, modeGuide, mo
     "- When suggesting libraries, frameworks, or patterns, first verify they already exist in the codebase. NEVER assume a library is available just because it is well-known. Check package.json, imports, or surrounding files first.",
     "- Follow the existing code style, naming conventions, and architectural patterns of the project.",
     "",
-    "MODEL ASSIGNMENT:",
-    "Available models:",
-    modelsJson,
-    "",
-    runnerInstruction(runners),
+    ...tools ? PLANNER_TOOLS_CATALOG : ["MODEL ASSIGNMENT:", "Available models:", modelsJson, "", runnerInstruction(runners)],
     "MODEL SELECTION GUIDELINES:",
     "- Use stronger models for complex refactoring, architecture changes, security-critical code.",
     "- Use weaker/faster models for simple file operations, test generation, config changes, documentation.",
-    `- Assign thinkingEffort based on task complexity, choosing ONLY from the assigned model's "variants" list above (e.g. low for simple tasks, high for complex ones). Omit thinkingEffort if the model has no variants.`,
+    `- Assign thinkingEffort based on task complexity, choosing ONLY from the assigned model's "variants" list ${tools ? "from list_models" : "above"} (e.g. low for simple tasks, high for complex ones). Omit thinkingEffort if the model has no variants.`,
     "",
     "TASK MODE:",
-    modeGuide,
+    tools ? `Use each runner's default mode from list_runners unless the task needs a different mode it lists. Avoid "plan" (read-only) unless the user asked for analysis only.` : modeGuide,
     "",
-    // Shared by both variants on purpose: the read channel is a text envelope
-    // exactly so a harness planner, which Ordewell cannot hand tools to, speaks
-    // the same protocol as an API-backed one (ADR-0009).
-    ...TASK_QUERY_PROTOCOL,
+    // The envelope is shared by both variants on purpose: a harness planner
+    // Ordewell could not hand tools to speaks the same protocol as an
+    // API-backed one (ADR-0009). One it did hand them to reads through them.
+    ...tools ? TASK_READ_TOOLS_PROTOCOL : TASK_QUERY_PROTOCOL,
     "",
     context ? `PROJECT CONTEXT:
 ${context}
@@ -8808,25 +8901,25 @@ function executionLogBlock(executionLog) {
   if (executionLog.length === 0) return "";
   const completed = executionLog.filter((t) => t.status === "completed");
   const failed = executionLog.filter((t) => t.status === "failed");
-  const lines = ["EXECUTION LOG SUMMARY:"];
-  lines.push(`Total entries: ${executionLog.length} (${completed.length} completed, ${failed.length} failed)`);
+  const lines2 = ["EXECUTION LOG SUMMARY:"];
+  lines2.push(`Total entries: ${executionLog.length} (${completed.length} completed, ${failed.length} failed)`);
   if (completed.length > 0) {
-    lines.push("");
-    lines.push("COMPLETED TASKS:");
+    lines2.push("");
+    lines2.push("COMPLETED TASKS:");
     for (const t of completed) {
       const verdict = t.verdict ? ` \u2014 ${t.verdict.outcome.toUpperCase()}: ${t.verdict.reason}` : "";
-      lines.push(`- [${t.id}] ${t.title}${verdict}`);
+      lines2.push(`- [${t.id}] ${t.title}${verdict}`);
     }
   }
   if (failed.length > 0) {
-    lines.push("");
-    lines.push("FAILED TASKS (eligible for retry):");
+    lines2.push("");
+    lines2.push("FAILED TASKS (eligible for retry):");
     for (const t of failed) {
       const verdict = t.verdict ? ` \u2014 ${t.verdict.reason}` : "";
-      lines.push(`- [${t.id}] ${t.title} (retry #${t.retryCount})${verdict}`);
+      lines2.push(`- [${t.id}] ${t.title} (retry #${t.retryCount})${verdict}`);
     }
   }
-  return lines.join("\n");
+  return lines2.join("\n");
 }
 function pendingEditRulesBlock() {
   return [
@@ -8869,7 +8962,7 @@ function buildModifyDuringExecutionPrompt(executionLog, pendingTasks, userMessag
   sections.push('Return the COMPLETE modified pending tasks as a JSON object with a single "tasks" array. Include all pending tasks, not just the modified ones.\nDo NOT wrap the JSON in markdown code blocks. Output ONLY the JSON object.');
   return sections.join("\n");
 }
-function buildMergePrompt(taskIds, tasks) {
+function buildMergePrompt(taskIds, tasks, tools = false) {
   const idSet = new Set(taskIds);
   const selected = tasks.filter((t) => idSet.has(t.id)).sort((a, b) => a.order - b.order);
   const refs = selected.map((t) => `#${t.order} "${t.title}" (id=${t.id})`).join(", ");
@@ -8877,22 +8970,22 @@ function buildMergePrompt(taskIds, tasks) {
     `Merge these tasks into ONE combined task: ${refs}.`,
     "Write a clear combined title, description, and prompt that cover all of their work.",
     "The merged task takes the union of their dependencies (excluding the merged tasks themselves) and preserves their user stories.",
-    'Set "assignedRunner" and "assignedModel" on the merged task \u2014 use one of the runners and models listed in <available_models> above. Prefer the strongest model if the merged work is complex.',
-    'Reply with ONLY a taskOps JSON object using a single "merge" op:',
-    `  {"taskOps":[{"op":"merge","taskIds":[${selected.map((t) => `"${t.id}"`).join(", ")}],"merged":{"title":"...","description":"...","prompt":"...","assignedRunner":"...","assignedModel":{"modelId":"...","modelLabel":"..."}}}]}`,
+    `Set "assignedRunner" and "assignedModel" on the merged task \u2014 use one of the runners and models ${tools ? "list_runners and list_models return" : "listed in <available_models> above"}. Prefer the strongest model if the merged work is complex.`,
+    tools ? 'Call edit_plan with a single "merge" op:' : 'Reply with ONLY a taskOps JSON object using a single "merge" op:',
+    `  {"${tools ? "ops" : "taskOps"}":[{"op":"merge","taskIds":[${selected.map((t) => `"${t.id}"`).join(", ")}],"merged":{"title":"...","description":"...","prompt":"...","assignedRunner":"...","assignedModel":{"modelId":"...","modelLabel":"..."}}}]}`,
     `If this merge needs a companion op in the same batch (e.g. an added task that should depend on the merge result), give the merge op a "handle" (any unused name) and reference it from the later op's taskId/dependencies.`
   ].join("\n");
 }
-function buildSplitPrompt(taskId, tasks) {
+function buildSplitPrompt(taskId, tasks, tools = false) {
   const task = tasks.find((t) => t.id === taskId);
   if (!task) return `Split task ${taskId} into smaller tasks.`;
   return [
     `Split task #${task.order} "${task.title}" (id=${task.id}) into multiple smaller tasks that together accomplish the same work.`,
     "Decompose it into a sensible ordered sequence. Write a clear title, description, and prompt for each part.",
     "The first part inherits the original task's dependencies. Each later part depends on the previous part. Tasks that depended on the original now depend on the LAST part.",
-    'Set "assignedRunner" and "assignedModel" on each part \u2014 use the runners and models listed in <available_models> above. You may assign different models to different parts (e.g. a stronger model for a complex part, a faster one for a simple part).',
-    'Reply with ONLY a taskOps JSON object using a single "split" op:',
-    `  {"taskOps":[{"op":"split","taskId":"${task.id}","parts":[{"title":"...","description":"...","prompt":"...","assignedRunner":"...","assignedModel":{"modelId":"...","modelLabel":"..."}},...]}]}`,
+    `Set "assignedRunner" and "assignedModel" on each part \u2014 use the runners and models ${tools ? "list_runners and list_models return" : "listed in <available_models> above"}. You may assign different models to different parts (e.g. a stronger model for a complex part, a faster one for a simple part).`,
+    tools ? 'Call edit_plan with a single "split" op:' : 'Reply with ONLY a taskOps JSON object using a single "split" op:',
+    `  {"${tools ? "ops" : "taskOps"}":[{"op":"split","taskId":"${task.id}","parts":[{"title":"...","description":"...","prompt":"...","assignedRunner":"...","assignedModel":{"modelId":"...","modelLabel":"..."}},...]}]}`,
     `If this split needs a companion op in the same batch (e.g. another task that should depend on the last part), give the split op a "handle" (any unused name) \u2014 it names the last part \u2014 and reference it from the later op's taskId/dependencies.`
   ].join("\n");
 }
@@ -8975,25 +9068,37 @@ function parsePlanObject(json, raw, runners, runnerModes, autonomousDefault = tr
     const detail = err instanceof Error ? err.message : String(err);
     throw new PlanParseError(`Plan response was not valid JSON: ${detail}`, raw);
   }
-  if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.tasks)) {
-    throw new PlanParseError("Invalid plan: missing tasks array", raw);
+  const result = validatePlanTasks(parsed, runners, runnerModes, autonomousDefault);
+  if (result.ok) return result.tasks;
+  const [first] = result.errors;
+  throw new PlanParseError(first.message, raw, { semantic: first.taskId !== void 0 });
+}
+function validatePlanTasks(obj, runners, runnerModes, autonomousDefault = true) {
+  const rawTasks = isRecord(obj) ? obj.tasks : void 0;
+  if (!Array.isArray(rawTasks)) {
+    return { ok: false, errors: [{ field: "tasks", message: "Invalid plan: missing tasks array" }] };
   }
-  const rawTasks = parsed.tasks;
   if (rawTasks.length === 0) {
-    throw new PlanParseError("Plan contained no tasks", raw);
+    return { ok: false, errors: [{ field: "tasks", message: "Plan contained no tasks" }] };
   }
-  const tasks = rawTasks.map((t) => parseTask(t, runners, runnerModes, autonomousDefault));
-  validateVerticalSliceShape(tasks, raw);
+  const tasks = rawTasks.map((t) => parseTask(asRecord(t), runners, runnerModes, autonomousDefault));
+  const errors = verticalSliceErrors(tasks);
   for (const t of tasks) {
     if (!runners.includes(t.assignedRunner)) {
-      throw new PlanParseError(
-        `Task "${t.title}" has invalid assignedRunner "${t.assignedRunner}". Expected one of: ${runners.join(", ")}`,
-        raw,
-        { semantic: true }
-      );
+      errors.push({
+        taskId: t.id,
+        field: "assignedRunner",
+        message: `Task "${t.title}" has invalid assignedRunner "${t.assignedRunner}". Expected one of: ${runners.join(", ")}`
+      });
     }
   }
-  return tasks;
+  return errors.length > 0 ? { ok: false, errors } : { ok: true, tasks };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asRecord(value) {
+  return isRecord(value) ? value : {};
 }
 function looksLikePlanAttempt(raw) {
   const { matches, sawUnbalanced } = extractObjectsWithKey(raw, PLAN_ENVELOPE_KEY);
@@ -9018,12 +9123,12 @@ function parseTask(raw, runners, runnerModes, autonomousDefault = true, inherite
     // description/title — same fallback TaskOps.applyTaskOps uses for `add`, so
     // a task never silently ends up unschedulable (getReadyTasks requires prompt).
     prompt: raw.prompt ? String(raw.prompt) : description || title || void 0,
-    userSteps: Array.isArray(raw.userSteps) ? raw.userSteps.map((s) => ({
+    userSteps: Array.isArray(raw.userSteps) ? raw.userSteps.map(asRecord).map((s) => ({
       order: Number(s.order ?? 0),
       instruction: String(s.instruction ?? ""),
       completed: false
     })) : void 0,
-    subtasks: Array.isArray(raw.subtasks) ? raw.subtasks.map((s) => parseTask(s, runners, runnerModes, autonomousDefault, { sliceType, autonomy })) : [],
+    subtasks: Array.isArray(raw.subtasks) ? raw.subtasks.map((s) => parseTask(asRecord(s), runners, runnerModes, autonomousDefault, { sliceType, autonomy })) : [],
     assignedModel: raw.assignedModel ? {
       modelId: String(raw.assignedModel.modelId ?? ""),
       modelLabel: String(raw.assignedModel.modelLabel ?? ""),
@@ -9044,42 +9149,28 @@ function parseTask(raw, runners, runnerModes, autonomousDefault = true, inherite
     ops: !inherited && taskType === "ai" && raw.ops === true
   });
 }
-function validateVerticalSliceShape(tasks, raw, parentTitle) {
+function verticalSliceErrors(tasks, parentTitle) {
   const where = (t) => parentTitle ? `subtask "${t.title}" of "${parentTitle}"` : `Task "${t.title}"`;
-  const semantic = { semantic: true };
+  const errors = [];
   for (const t of tasks) {
+    const fail = (field, message) => errors.push({ taskId: t.id, field, message });
     if (!t.sliceType) {
-      throw new PlanParseError(
-        `${where(t)} is missing sliceType. Every task must specify sliceType ("AFK" or "HITL").`,
-        raw,
-        semantic
-      );
+      fail("sliceType", `${where(t)} is missing sliceType. Every task must specify sliceType ("AFK" or "HITL").`);
     }
     if (t.type === "ai" && !t.autonomy) {
-      throw new PlanParseError(
-        `AI ${where(t)} is missing autonomy. Every AI task must specify autonomy ("AFK" or "HITL").`,
-        raw,
-        semantic
-      );
+      fail("autonomy", `AI ${where(t)} is missing autonomy. Every AI task must specify autonomy ("AFK" or "HITL").`);
     }
     if (t.autonomy === "AFK" && t.userSteps && t.userSteps.length > 0) {
-      throw new PlanParseError(
-        `${where(t)} has autonomy "AFK" but contains userSteps. AFK tasks must not have user touchpoints.`,
-        raw,
-        semantic
-      );
+      fail("userSteps", `${where(t)} has autonomy "AFK" but contains userSteps. AFK tasks must not have user touchpoints.`);
     }
-    if (t.type === "user" && t.sliceType !== "HITL") {
-      throw new PlanParseError(
-        `User ${where(t)} has sliceType "${t.sliceType}". User tasks must have sliceType "HITL".`,
-        raw,
-        semantic
-      );
+    if (t.type === "user" && t.sliceType && t.sliceType !== "HITL") {
+      fail("sliceType", `User ${where(t)} has sliceType "${t.sliceType}". User tasks must have sliceType "HITL".`);
     }
     if (t.subtasks.length > 0) {
-      validateVerticalSliceShape(t.subtasks, raw, t.title);
+      errors.push(...verticalSliceErrors(t.subtasks, t.title));
     }
   }
+  return errors;
 }
 function checkUniqueIds(ctx) {
   const seen = /* @__PURE__ */ new Set();
@@ -9382,11 +9473,11 @@ var UPDATABLE_FIELDS = [
   "sliceType",
   "ops"
 ];
-function taskOpsProtocol(executionNote = "") {
+function taskOpsProtocol(executionNote = "", tools = false) {
   const updateChanges = UPDATABLE_FIELDS.map((f) => f === "dependencies" ? '"dependencies"?:["<id or #order>"]' : `"${f}"?`).join(",");
   return [
-    "- To modify specific tasks, reply with ONLY this JSON object:",
-    '  {"taskOps": [',
+    tools ? "- To modify specific tasks, call edit_plan, never a JSON reply. Its argument is:" : "- To modify specific tasks, reply with ONLY this JSON object:",
+    tools ? '  {"ops": [' : '  {"taskOps": [',
     `    {"op":"update","taskId":"<id or #order>","changes":{${updateChanges}}},`,
     '    {"op":"add","task":{"title","description","prompt","dependencies":["<id or #order>"],"assignedRunner"?,"assignedModel"?,"ops"?},"handle"?:"<name>"},',
     '    {"op":"remove","taskId":"<id or #order>"},',
@@ -9395,11 +9486,12 @@ function taskOpsProtocol(executionNote = "") {
     '    {"op":"split","taskId":"<id or #order>","parts":[{"title","description","prompt"?,"assignedRunner"?,"assignedModel"?,...}, ...],"handle"?:"<name>"},',
     `    {"op":"rearm","taskId":"<id or #order>","changes"?:{${updateChanges}}}`,
     "  ]}",
-    '- For sweeping changes, you may instead emit a full {"tasks":[...]} plan JSON.',
+    tools ? "- For sweeping changes, you may instead call submit_plan with the full plan." : '- For sweeping changes, you may instead emit a full {"tasks":[...]} plan JSON.',
     'Every "<id or #order>" ref in a batch resolves against the plan shown above, before any op in the batch runs \u2014 an earlier remove/merge/split never shifts what a later "#N" means.',
     'Give "add", "merge", or "split" a "handle" (any name you choose, unused elsewhere in this batch) to let a LATER op in the same batch reference the task it produces \u2014 for "split", the handle names its last part. A handle used before its defining op is rejected.',
-    'When creating or changing tasks, set "assignedRunner" and "assignedModel" ({"modelId","modelLabel","thinkingEffort"?}) using only the runners and models listed in <available_models>.',
+    `When creating or changing tasks, set "assignedRunner" and "assignedModel" ({"modelId","modelLabel","thinkingEffort"?}) using only the runners and models ${tools ? "list_runners and list_models return" : "listed in <available_models>"}.`,
     'Keep dependencies consistent: no cycles, no references to removed tasks, and never touch running or completed tasks \u2014 "rearm" is the one exception, below.',
+    ...tools ? ["edit_plan checks the batch when you call it and answers with what it will change, or with the error to fix \u2014 call it again in the same reply. The edit is applied when your reply ends; edits you make in one reply join one batch."] : [],
     'Just declare the dependencies you want \u2014 display order is repaired for you afterwards, so a rewire or a newly added prerequisite never needs a "reorder" op. Only a task that is running or completed cannot be shifted, so an edit that would need one to move is rejected.' + executionNote,
     'Flipping "type" between "ai" and "user" is a content change, not just a label: an update to "user" needs "userSteps" in the SAME op, and an update to "ai" needs "prompt" in the SAME op \u2014 the model/mode/effort/autonomy fields (flipping to "user") or the userSteps (flipping to "ai") are cleared automatically.',
     '"rearm" puts a failed OR completed task back to pending \u2014 verdict and output summary are cleared, any dependents it had blocked are released, and it may carry field changes (e.g. a corrected "prompt") applied in the same op. A running task cannot be re-armed. Never rearm a task just to relabel it \u2014 only when it should actually run again.'
@@ -9631,21 +9723,21 @@ function applyTaskOps(currentTasks, ops, runners, catalog) {
   const handleOwner = /* @__PURE__ */ new Map();
   const handleId = /* @__PURE__ */ new Map();
   for (const [i, op] of ops.entries()) {
-    const handle = op.handle;
-    if (handle === void 0) continue;
-    if (typeof handle !== "string" || !handle.trim()) {
+    const handle2 = op.handle;
+    if (handle2 === void 0) continue;
+    if (typeof handle2 !== "string" || !handle2.trim()) {
       errors.push(`op ${i + 1} (${op.op}): handle must be a non-empty string`);
       continue;
     }
-    if (handleOwner.has(handle)) {
-      errors.push(`op ${i + 1} (${op.op}): handle "${handle}" is already used earlier in this batch`);
+    if (handleOwner.has(handle2)) {
+      errors.push(`op ${i + 1} (${op.op}): handle "${handle2}" is already used earlier in this batch`);
       continue;
     }
-    if (refCollidesWithExisting(handle, originalFlatAll)) {
-      errors.push(`op ${i + 1} (${op.op}): handle "${handle}" collides with an existing task reference`);
+    if (refCollidesWithExisting(handle2, originalFlatAll)) {
+      errors.push(`op ${i + 1} (${op.op}): handle "${handle2}" collides with an existing task reference`);
       continue;
     }
-    handleOwner.set(handle, i);
+    handleOwner.set(handle2, i);
   }
   if (errors.length) return { ok: false, tasks: currentTasks, errors, summary: [] };
   const resolveDeps = (deps, opIndex) => {
@@ -10012,15 +10104,15 @@ function applyTaskOps(currentTasks, ops, runners, catalog) {
 
 // src/services/PlanRepair.ts
 async function repairLoop(opts) {
-  let reply = await opts.first();
+  let reply2 = await opts.first();
   for (let repairs = 0; ; repairs++) {
-    const verdict = await opts.interpret(reply);
+    const verdict = await opts.interpret(reply2);
     if ("done" in verdict) return verdict.done;
     if (repairs >= opts.maxRepairs) {
-      return opts.onExhausted({ reply, errors: verdict.retry.errors, cause: verdict.retry.cause });
+      return opts.onExhausted({ reply: reply2, errors: verdict.retry.errors, cause: verdict.retry.cause });
     }
     const { corrective } = verdict.retry;
-    reply = await opts.resend(typeof corrective === "function" ? corrective() : corrective);
+    reply2 = await opts.resend(typeof corrective === "function" ? corrective() : corrective);
   }
 }
 var JSON_REPAIR_INSTRUCTION = "Your previous response could not be parsed as JSON. Re-send ONLY the JSON object \u2014 no prose before or after, no explanation, no markdown code fences.";
@@ -10136,34 +10228,34 @@ async function settleReply(opts) {
       }
       if (attempt.failure !== void 0) return { done: message(attempt.failure) };
       if (!attempt.text.trim()) return { done: message(emptyReplyReport(deniedStep(attempt))) };
-      const reply = classifyPlannerReply(attempt.text, opts.classify);
-      switch (reply.kind) {
+      const reply2 = classifyPlannerReply(attempt.text, opts.classify);
+      switch (reply2.kind) {
         case "plan":
-          return { done: { kind: "plan", tasks: reply.tasks, text: said(attempt), researchLog } };
+          return { done: { kind: "plan", tasks: reply2.tasks, text: said(attempt), researchLog } };
         case "task_ops":
-          return { done: { kind: "task_ops", ops: reply.ops, text: said(attempt), researchLog } };
+          return { done: { kind: "task_ops", ops: reply2.ops, text: said(attempt), researchLog } };
         // A read is answered by the conversation, which owns the plan and the
         // catalog, so it leaves here the way a plan or an edit does.
         case "task_query":
-          return { done: { kind: "task_query", query: reply.query, text: said(attempt), researchLog } };
+          return { done: { kind: "task_query", query: reply2.query, text: said(attempt), researchLog } };
         case "prose":
           return { done: asProse(attempt) };
       }
       if (opts.signal?.aborted) return { done: asProse(attempt) };
-      const errors = [reply.error.message];
-      switch (reply.kind) {
+      const errors = [reply2.error.message];
+      switch (reply2.kind) {
         case "broken_task_ops":
-          return { retry: { errors, corrective: reEmitTaskOpsPrompt(reply.error.message), cause: reply.error } };
+          return { retry: { errors, corrective: reEmitTaskOpsPrompt(reply2.error.message), cause: reply2.error } };
         case "broken_task_query":
-          return { retry: { errors, corrective: reEmitTaskQueryPrompt(reply.error.message), cause: reply.error } };
+          return { retry: { errors, corrective: reEmitTaskQueryPrompt(reply2.error.message), cause: reply2.error } };
         case "broken_plan": {
-          const corrective = reply.error.truncated || attempt.cutOff ? () => truncatedPlanReEmitPrompt((opts.compactHistory?.() ?? 0) > 0) : reEmitPlanPrompt(reply.error.message);
-          return { retry: { errors, corrective, cause: reply.error } };
+          const corrective = reply2.error.truncated || attempt.cutOff ? () => truncatedPlanReEmitPrompt((opts.compactHistory?.() ?? 0) > 0) : reEmitPlanPrompt(reply2.error.message);
+          return { retry: { errors, corrective, cause: reply2.error } };
         }
       }
     },
     maxRepairs: MAX_JSON_REPAIRS,
-    onExhausted: ({ reply }) => asProse(reply)
+    onExhausted: ({ reply: reply2 }) => asProse(reply2)
   });
 }
 var said = (attempt) => attempt.fullText ?? attempt.text;
@@ -10390,8 +10482,8 @@ function compactResearchResults(resultsText, maxChars = COMPACTION_LIMITS.resear
   const blocks = [{ tool: null, lines: [] }];
   for (const line of resultsText.split("\n")) {
     const m = headerRe.exec(line);
-    const tool = m && knownNames.has(m[1]) ? m[1] : line === "[LLM response]" ? "llm_response" : null;
-    if (tool) blocks.push({ tool, lines: [line] });
+    const tool2 = m && knownNames.has(m[1]) ? m[1] : line === "[LLM response]" ? "llm_response" : null;
+    if (tool2) blocks.push({ tool: tool2, lines: [line] });
     else blocks[blocks.length - 1].lines.push(line);
   }
   const texts = blocks.map((b) => b.lines.join("\n"));
@@ -10485,9 +10577,9 @@ function ellipsize(text2, max) {
   const oneLine2 = text2.replace(/\s+/g, " ").trim();
   return oneLine2.length > max ? `${oneLine2.slice(0, max)}\u2026` : oneLine2;
 }
-function summarizeToolCall(tool, argsJson, toolLabel) {
-  const display = toolLabel?.trim() || tool;
-  if (tool === "agent_tool") {
+function summarizeToolCall(tool2, argsJson, toolLabel) {
+  const display = toolLabel?.trim() || tool2;
+  if (tool2 === "agent_tool") {
     try {
       const args = JSON.parse(argsJson);
       const hint = args.path ?? args.file_path ?? args.filePath ?? args.pattern ?? args.query ?? args.url ?? args.command;
@@ -10496,7 +10588,7 @@ function summarizeToolCall(tool, argsJson, toolLabel) {
     }
     return display;
   }
-  if (tool === "spawn_research_agent") {
+  if (tool2 === "spawn_research_agent") {
     try {
       const args = JSON.parse(argsJson);
       const prompt = typeof args.prompt === "string" ? args.prompt : "";
@@ -10508,19 +10600,19 @@ function summarizeToolCall(tool, argsJson, toolLabel) {
   }
   try {
     const args = JSON.parse(argsJson);
-    if (tool === "find_symbol" && args.symbol) {
+    if (tool2 === "find_symbol" && args.symbol) {
       return `find_symbol ${args.symbol}${args.language ? ` [${args.language}]` : ""}`;
     }
-    if (tool === "web_search" && args.query) {
+    if (tool2 === "web_search" && args.query) {
       return `web_search "${ellipsize(String(args.query), 50)}"`;
     }
-    if (tool === "fetch" && args.url) {
+    if (tool2 === "fetch" && args.url) {
       return `fetch ${ellipsize(String(args.url), 60)}`;
     }
-    if (tool === "glob" && args.pattern) {
+    if (tool2 === "glob" && args.pattern) {
       return `glob ${ellipsize(String(args.pattern), 50)}`;
     }
-    if (tool === "grep" && args.pattern) {
+    if (tool2 === "grep" && args.pattern) {
       const mode = args.output_mode && args.output_mode !== "content" ? ` (${args.output_mode})` : "";
       const scope = args.include ? ` in ${args.include}` : "";
       return `grep ${ellipsize(String(args.pattern), 40)}${scope}${mode}`;
@@ -10953,9 +11045,9 @@ ${llmOutput}
         return { tasks: null, researchLog, researchResults };
       }
       const thinking = turn.reasoning ? turn.reasoning.slice(-200) : turn.text.slice(-200);
-      const reply = classifyPlannerReply(turn.text, { runners, runnerModes, autonomousDefault });
-      if (reply.kind === "plan") {
-        return { tasks: reply.tasks, researchLog, researchResults };
+      const reply2 = classifyPlannerReply(turn.text, { runners, runnerModes, autonomousDefault });
+      if (reply2.kind === "plan") {
+        return { tasks: reply2.tasks, researchLog, researchResults };
       }
       if (!turn.hasToolCalls) break;
       const { toolResults, logEntries, resultsText } = await this.executeToolCalls(
@@ -11672,7 +11764,7 @@ ${collected.aiflowContext}
 };
 
 // src/services/TaskOrchestrator.ts
-var path14 = __toESM(require("path"));
+var path15 = __toESM(require("path"));
 
 // src/services/promptAugment.ts
 var MAX_TAIL_CHARS = 500;
@@ -11759,7 +11851,7 @@ function renderPlanMap(planTasks, currentTaskId, opts) {
   const currentIdx = sorted.findIndex((r) => r.task.id === currentTaskId);
   const { window, omitted } = pickWindow(sorted, currentIdx, max);
   const currentTask = sorted.find((r) => r.task.id === currentTaskId)?.task;
-  const lines = window.map((row) => {
+  const lines2 = window.map((row) => {
     const isCurrent = row.task.id === currentTaskId;
     const tag = planMapStatus(row.task, isCurrent);
     const order = row.parent ? row.label : row.label.padStart(2, " ");
@@ -11776,7 +11868,7 @@ You are running as: ${currentTask.assignedRunner}` : "";
     "",
     "This is for context only \u2014 do ONLY the task marked `\u2190 you are here`. Future tasks will handle their own scope; do not preempt them.",
     "",
-    lines.join("\n") + footer + runnerNote
+    lines2.join("\n") + footer + runnerNote
   ].join("\n");
 }
 function renderPreviousAttempt(output) {
@@ -11790,10 +11882,14 @@ function renderPreviousAttempt(output) {
     tail
   ].join("\n");
 }
-function renderCompletionMarker(task) {
+function renderCompletionMarker(task, completionTool = false) {
+  const howto = `Build it by writing \`<<<ORDEWELL_\` immediately followed by \`DONE_${task.completionMarker}>>>\` \u2014 joined into a single unbroken token, with no space, quote, or any other character between the two parts.`;
+  if (!completionTool) return `
+
+When you have fully completed this task, print one final line containing only the completion marker. ${howto}`;
   return `
 
-When you have fully completed this task, print one final line containing only the completion marker. Build it by writing \`<<<ORDEWELL_\` immediately followed by \`DONE_${task.completionMarker}>>>\` \u2014 joined into a single unbroken token, with no space, quote, or any other character between the two parts.`;
+When you have fully completed this task, call the \`task_complete\` tool with status \`done\` and a summary of what you did; the tasks that depend on this one are given that summary. If you cannot complete it, call \`task_complete\` with status \`blocked\` or \`failed\` and the reason instead, and print no marker. After a \`done\` call, or if the tool is not available to you, also print one final line containing only the completion marker. ${howto}`;
 }
 function renderTddInstruction() {
   return [
@@ -11814,7 +11910,21 @@ function renderTddInstruction() {
   ].join("\n");
 }
 var CHECKPOINT_MARKER_HOWTO = "Build it by writing `<<<ORDEWELL_` immediately followed by `CHECKPOINT:` \u2014 no space, quote, or any other character between those two parts \u2014 then a brief summary of what you are about to do and why human input is needed, closed with `>>>`";
-function renderCheckpointInstruction() {
+function renderCheckpointInstruction(checkpointTool = false) {
+  if (checkpointTool) {
+    return [
+      "## Human-in-the-loop checkpoints",
+      "",
+      "When you reach a decision point that requires human judgment \u2014 before destructive",
+      "operations, after major design decisions, or when multiple viable paths exist \u2014 pause",
+      "and request input:",
+      "",
+      "1. Call the `checkpoint` tool with a brief summary of what you are about to do and why human input is needed. The call waits for the human, and its result is their answer",
+      "2. If the result is `continue`: proceed with the action you described",
+      "3. If the result starts with `rejected:`: the rest is why. Adjust your approach and call `checkpoint` again if needed",
+      `4. If the \`checkpoint\` tool is not available to you, or the call fails, fall back to the marker: print one line holding only the checkpoint marker and wait for ORDEWELL_CONTINUE or ORDEWELL_REJECT. ${CHECKPOINT_MARKER_HOWTO}`
+    ].join("\n");
+  }
   return [
     "## Human-in-the-loop checkpoints",
     "",
@@ -11846,9 +11956,9 @@ function composeAugmentedPrompt(task, allTasks, opts) {
     blocks.push(renderTddInstruction());
   }
   if (isHitlTask(task)) {
-    blocks.push(renderCheckpointInstruction());
+    blocks.push(renderCheckpointInstruction(opts?.completionTool));
   }
-  const marker2 = renderCompletionMarker(task);
+  const marker2 = renderCompletionMarker(task, opts?.completionTool);
   if (blocks.length === 0) return basePrompt + marker2;
   return `${blocks.join("\n\n")}
 
@@ -11859,12 +11969,12 @@ function composeContinuationPrompt(task, message, opts = {}) {
     opts.ops ? "(Ordewell) You are continuing this task in the same session, in the same checkout. What your earlier attempt did outside the repository was not undone: check what already exists before acting again." : "(Ordewell) You are continuing this task in the same session. Your working directory was recreated from the integration branch: work from your earlier attempt is there only if it landed, so check the files before relying on them."
   ];
   if (isHitlTask(task)) {
-    reminder.push(`If you reach a decision that needs human judgment, print one line holding only the checkpoint marker and wait for ORDEWELL_CONTINUE or ORDEWELL_REJECT. ${CHECKPOINT_MARKER_HOWTO}.`);
+    reminder.push(opts.completionTool ? `If you reach a decision that needs human judgment, call the \`checkpoint\` tool: its result is \`continue\` or \`rejected: <why>\`. Only if the tool is not available to you, print one line holding only the checkpoint marker and wait for ORDEWELL_CONTINUE or ORDEWELL_REJECT. ${CHECKPOINT_MARKER_HOWTO}.` : `If you reach a decision that needs human judgment, print one line holding only the checkpoint marker and wait for ORDEWELL_CONTINUE or ORDEWELL_REJECT. ${CHECKPOINT_MARKER_HOWTO}.`);
   }
   return `${message.trim()}
 
 ---
-${reminder.join("\n\n")}${renderCompletionMarker(task)}`;
+${reminder.join("\n\n")}${renderCompletionMarker(task, opts.completionTool)}`;
 }
 
 // src/services/VerdictEngine.ts
@@ -11882,6 +11992,13 @@ var VerdictEngine = class {
   pausedSessions = /* @__PURE__ */ new Map();
   listeners = [];
   checkpointListeners = [];
+  withdrawnListeners = [];
+  /**
+   * The open `checkpoint` tool call per task (ADR-0022, V5): settling it is how
+   * an answer reaches a runner that asked through the tool, where the marker's
+   * answer is typed into the session instead.
+   */
+  toolCheckpoints = /* @__PURE__ */ new Map();
   idleListeners = [];
   /**
    * Per-task generation. Replaced on every watch(), clear() and verdict.
@@ -11912,6 +12029,9 @@ var VerdictEngine = class {
   onCheckpoint(listener) {
     this.checkpointListeners.push(listener);
   }
+  onCheckpointWithdrawn(listener) {
+    this.withdrawnListeners.push(listener);
+  }
   onIdleChange(listener) {
     this.idleListeners.push(listener);
   }
@@ -11973,6 +12093,11 @@ ${line}
   }
   approveCheckpoint(taskId) {
     this.resumeIdle(taskId);
+    const toolCall = this.toolCheckpoints.get(taskId);
+    if (toolCall) {
+      toolCall({ kind: "continue" });
+      return;
+    }
     const session = this.pausedSessions.get(taskId);
     if (session) {
       session.write(this.resumeToken(session, "ORDEWELL_CONTINUE"));
@@ -11981,6 +12106,11 @@ ${line}
   }
   rejectCheckpoint(taskId, reason) {
     this.resumeIdle(taskId);
+    const toolCall = this.toolCheckpoints.get(taskId);
+    if (toolCall) {
+      toolCall({ kind: "rejected", reason });
+      return;
+    }
     const session = this.pausedSessions.get(taskId);
     if (session) {
       session.write(this.resumeToken(session, `ORDEWELL_REJECT: ${reason}`));
@@ -11991,7 +12121,10 @@ ${line}
    * Attach to a spawned session: scan the output tail for the task's completion
    * marker (delivering a verdict immediately while leaving interactive sessions
    * open), scan for checkpoint markers, and on exit produce a failed verdict
-   * when the marker was never observed.
+   * when the marker was never observed. A structured session's `task_complete`
+   * call is evidence too (ADR-0022, V2): whichever signal comes first decides.
+   *
+   * Returns the attempt's generation, what {@link signalComplete} is checked against.
    */
   watch(task, session) {
     const doneToken = `<<<ORDEWELL_DONE_${task.completionMarker}>>>`;
@@ -12021,6 +12154,8 @@ ${line}
         else if (event.type === "permission_request" && !event.decided) this.approvalOpened(task.id, event.id);
         else if (event.type === "permission_decided" || event.type === "permission_withdrawn") this.approvalClosed(task.id, event.id, gen);
       });
+      session.onTaskComplete((report) => this.signalComplete(task.id, gen, report));
+      session.onToolCheckpoint((question, signal) => this.raiseCheckpoint(task.id, gen, question, signal));
     }
     session.onExit((exitCode) => {
       if (this.generations.get(task.id) !== gen) return;
@@ -12029,6 +12164,52 @@ ${line}
       const verdict = this.decide(task, exitCode);
       for (const l of this.listeners) l(task.id, verdict);
     });
+    return gen;
+  }
+  /**
+   * The runner's own `task_complete` call (ADR-0022, V1/V3): settles the
+   * attempt exactly as the marker does, unless that attempt is no longer the
+   * task's current one or another signal already settled it.
+   */
+  signalComplete(taskId, generation, report) {
+    if (this.generations.get(taskId) !== generation) return;
+    this.forget(taskId);
+    this.bumpGeneration(taskId);
+    const verdict = reportedVerdict(report);
+    for (const l of this.listeners) l(taskId, verdict);
+  }
+  /**
+   * The runner's `checkpoint` call (ADR-0022, V5): raised through the same
+   * listeners as the marker, so the task waits on the user the same way, and
+   * settled by {@link approveCheckpoint} or {@link rejectCheckpoint}. It is
+   * withdrawn, never left hanging, once the attempt is over or the call goes.
+   */
+  raiseCheckpoint(taskId, generation, question, signal) {
+    if (this.generations.get(taskId) !== generation || signal.aborted) {
+      return Promise.resolve({ kind: "withdrawn", why: "this attempt has ended." });
+    }
+    if (this.toolCheckpoints.has(taskId)) {
+      return Promise.resolve({ kind: "withdrawn", why: "another checkpoint is still waiting for an answer. Wait for it before asking again." });
+    }
+    return new Promise((resolve7) => {
+      const settle = (answer2) => {
+        signal.removeEventListener("abort", onAbort);
+        if (this.toolCheckpoints.get(taskId) === settle) this.toolCheckpoints.delete(taskId);
+        resolve7(answer2);
+      };
+      const onAbort = () => {
+        settle({ kind: "withdrawn", why: "the call was cancelled." });
+        if (this.generations.get(taskId) !== generation) return;
+        this.resumeIdle(taskId);
+        for (const l of this.withdrawnListeners) l(taskId);
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+      this.toolCheckpoints.set(taskId, settle);
+      for (const l of this.checkpointListeners) l(taskId, question.trim());
+    });
+  }
+  withdrawToolCheckpoint(taskId) {
+    this.toolCheckpoints.get(taskId)?.({ kind: "withdrawn", why: "this attempt has ended." });
   }
   approvalOpened(taskId, approvalId) {
     const open = this.openApprovals.get(taskId) ?? /* @__PURE__ */ new Set();
@@ -12062,6 +12243,7 @@ ${line}
     this.markerTails.delete(taskId);
     this.checkpointCarry.delete(taskId);
     this.pausedSessions.delete(taskId);
+    this.withdrawToolCheckpoint(taskId);
     this.idlePaused.delete(taskId);
     this.openApprovals.delete(taskId);
     this.clearIdle(taskId);
@@ -12097,6 +12279,7 @@ ${line}
     this.markerTails.clear();
     this.checkpointCarry.clear();
     this.pausedSessions.clear();
+    for (const taskId of [...this.toolCheckpoints.keys()]) this.withdrawToolCheckpoint(taskId);
     for (const timer of this.idleTimers.values()) clearTimeout(timer);
     this.idleTimers.clear();
     this.idleSince.clear();
@@ -12150,6 +12333,28 @@ ${line}
     };
   }
 };
+function reportedVerdict(report) {
+  const checks = [
+    {
+      name: "task_complete",
+      passed: report.status === "done",
+      skipped: false,
+      detail: `the runner called task_complete with status "${report.status}"`
+    },
+    {
+      name: "completion_marker",
+      passed: report.status === "done",
+      skipped: true,
+      detail: "bypassed \u2014 the runner reported through task_complete"
+    }
+  ];
+  const decidedAt = (/* @__PURE__ */ new Date()).toISOString();
+  if (report.status === "done") {
+    return { outcome: "pass", reason: "Verified: the runner reported completion through task_complete. Task completed successfully.", checks, decidedAt };
+  }
+  const why = report.reason?.trim() || "no reason given";
+  return { outcome: "fail", reason: `The runner reported the task ${report.status}: ${why}`, checks, decidedAt };
+}
 
 // src/services/transcriptCapture.ts
 var import_fs = require("fs");
@@ -12313,10 +12518,10 @@ async function fromDirenv(cwd, deps) {
   }
   return { env, blocked: null };
 }
-function findUp(start, relative5, deps) {
+function findUp(start, relative6, deps) {
   let dir = path10.resolve(start);
   for (; ; ) {
-    const candidate = path10.join(dir, relative5);
+    const candidate = path10.join(dir, relative6);
     if (deps.readFile(candidate) !== null) return candidate;
     const parent = path10.dirname(dir);
     if (parent === dir) return null;
@@ -12522,10 +12727,10 @@ function codexFinal(home, query, maxChars) {
 function codexLastAssistant(file, query) {
   const raw = (0, import_fs.readFileSync)(file, "utf8");
   if (!raw.includes(query.marker)) return null;
-  const lines = raw.split("\n").filter((l) => l.trim());
+  const lines2 = raw.split("\n").filter((l) => l.trim());
   let sawCwd = false;
   let last = null;
-  for (const line of lines) {
+  for (const line of lines2) {
     let rec;
     try {
       rec = JSON.parse(line);
@@ -12565,6 +12770,11 @@ var BufferedTaskOutputSource = class {
     session.onExit(() => {
       capture.exited = true;
     });
+    if (isStructuredSession(session)) {
+      session.onTaskComplete(({ summary }) => {
+        if (capture.attached && summary.trim()) capture.reported = summary.trim();
+      });
+    }
   }
   detach(taskId) {
     const capture = this.captures.get(taskId);
@@ -12575,6 +12785,8 @@ var BufferedTaskOutputSource = class {
     this.captures.clear();
   }
   async finalText(attempt, doneToken) {
+    const reported = this.captures.get(attempt.taskId)?.reported;
+    if (reported) return defuseMarkers(reported);
     if (attempt.cwd && attempt.completionMarker) {
       const transcript = await this.transcripts.finalAssistantText({
         runner: attempt.runner,
@@ -12592,8 +12804,8 @@ var BufferedTaskOutputSource = class {
     if (!capture) return null;
     const total = capture.dropped + capture.raw.length;
     const from = Math.min(Math.max(0, (opts.sinceOffset ?? 0) - capture.dropped), capture.raw.length);
-    const lines = renderCleanCapture(capture.raw.slice(from)).split("\n");
-    const kept = opts.maxLines > 0 ? lines.slice(-opts.maxLines) : [];
+    const lines2 = renderCleanCapture(capture.raw.slice(from)).split("\n");
+    const kept = opts.maxLines > 0 ? lines2.slice(-opts.maxLines) : [];
     return {
       text: kept.join("\n"),
       nextOffset: total,
@@ -13414,8 +13626,8 @@ var IsolationRunController = class {
     this.resolvers = {};
     this.reportedCopies.clear();
     this.listener.changed();
-    const shared = sharedPathsNotice(this.run);
-    if (shared) this.tell("info", shared);
+    const shared2 = sharedPathsNotice(this.run);
+    if (shared2) this.tell("info", shared2);
   }
   reportCopies(copied) {
     const fresh = copied.filter((p) => !this.reportedCopies.has(p));
@@ -14587,166 +14799,724 @@ ${tail}` : ""}`;
   }
 };
 
-// src/services/harness/ClaudeCodeAdapter.ts
-var DISALLOWED_TOOLS = ["Edit", "Write", "MultiEdit", "NotebookEdit", "KillShell"];
-var TASK_DISALLOWED_TOOLS = ["AskUserQuestion"];
-var PROTOCOL_ARGS = [
-  "-p",
-  "--input-format",
-  "stream-json",
-  "--output-format",
-  "stream-json",
-  "--verbose",
-  "--include-partial-messages"
-];
-var ASYNC_LAUNCH_MARKER = "Async agent launched successfully";
-var FOLLOW_ON_TURN_GRACE_MS = 5e3;
-var DEFAULT_DENIAL = "Denied in Ordewell. Continue without it, or say what you need.";
-var SUBAGENT_TOOLS = /* @__PURE__ */ new Set(["Agent", "Task"]);
-function usageRecord(usage, model, subagentId) {
-  const record = {
-    source: "claude-code",
-    ...partedPromptUsage({ uncached: usage.input_tokens, cacheRead: usage.cache_read_input_tokens, cacheWrite: usage.cache_creation_input_tokens })
-  };
-  if (model) record.model = model;
-  if (usage.output_tokens !== void 0) record.outputTokens = usage.output_tokens;
-  if (subagentId) record.subagentId = subagentId;
-  return record;
-}
-function subagentFinalCall(result) {
-  if (typeof result !== "object" || result === null) return null;
-  const { usage, resolvedModel } = result;
-  if (typeof usage !== "object" || usage === null) return null;
-  return { usage, model: typeof resolvedModel === "string" ? resolvedModel : void 0 };
+// src/services/harness/fileDiff.ts
+function markedLines(text2, mark) {
+  if (!text2) return text2;
+  const body = text2.endsWith("\n") ? text2.slice(0, -1) : text2;
+  return `${body.split("\n").map((line) => `${mark}${line}`).join("\n")}${body === text2 ? "" : "\n"}`;
 }
-function notificationOutcome(status) {
-  if (status === "completed") return "done";
-  if (status === "killed" || status === "stopped") return "stopped";
-  return "failed";
+var HUNK_HEADER = /^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/;
+function hunksOf(diff) {
+  const kept = [];
+  let oldLeft = 0;
+  let newLeft = 0;
+  for (const line of diff.split("\n")) {
+    if (oldLeft > 0 || newLeft > 0 || line.startsWith("\\")) {
+      kept.push(line);
+      if (line.startsWith("\\")) continue;
+      if (!line.startsWith("+")) oldLeft -= 1;
+      if (!line.startsWith("-")) newLeft -= 1;
+      continue;
+    }
+    const header = HUNK_HEADER.exec(line);
+    if (!header) continue;
+    kept.push(line);
+    oldLeft = header[1] === void 0 ? 1 : Number(header[1]);
+    newLeft = header[2] === void 0 ? 1 : Number(header[2]);
+  }
+  return kept.length ? `${kept.join("\n")}${diff.endsWith("\n") ? "\n" : ""}` : diff;
 }
-function blocksOf(msg) {
-  return Array.isArray(msg.message?.content) ? msg.message.content : [];
+function range(start, lines2) {
+  return lines2 === 1 ? `${start}` : `${start},${lines2}`;
 }
-function flattenContent(content) {
-  if (typeof content === "string") return content;
-  if (Array.isArray(content)) {
-    return content.map((block) => typeof block === "string" ? block : typeof block?.text === "string" ? block.text : "").filter(Boolean).join("\n");
+function structuredPatchText(patch) {
+  if (!Array.isArray(patch)) return "";
+  let text2 = "";
+  for (const hunk of patch) {
+    if (!hunk || typeof hunk !== "object") return "";
+    const { oldStart, oldLines, newStart, newLines, lines: lines2 } = hunk;
+    if (typeof oldStart !== "number" || typeof oldLines !== "number" || typeof newStart !== "number" || typeof newLines !== "number") return "";
+    if (!Array.isArray(lines2) || !lines2.every((line) => typeof line === "string")) return "";
+    text2 += `@@ -${range(oldStart, oldLines)} +${range(newStart, newLines)} @@
+${lines2.map((line) => `${line}
+`).join("")}`;
   }
-  return "";
+  return text2;
 }
-var ClaudeCodeAdapter = class extends StdioAgentAdapter {
-  agentId = "claude-code";
-  interruptCount = 0;
-  /** Interrupts sent and not yet acknowledged, by request id. */
-  pendingControl = /* @__PURE__ */ new Map();
-  /** An interrupt was sent during the current turn, so an aborted result is that interrupt, not a failure. */
-  interruptRequested = false;
-  /** A task's tool requests still waiting for an answer, by request id, with what the answer echoes back. */
-  openPermissions = /* @__PURE__ */ new Map();
-  /** Whether this turn has already emitted reply text — see {@link handleLine}. */
-  turnHasText = false;
-  /** The text block streaming now follows earlier reply text, so its first delta opens the paragraph. */
-  pendingBreak = false;
-  /** The model answering the planner's current message, as its `message_start` named it. */
-  plannerModel;
-  /**
-   * The session's `total_cost_usd` as last reported. Undefined after a resume:
-   * the CLI restores the resumed session's running total, and what Ordewell
-   * already counted of it is not ours to know here.
-   */
-  reportedCostUsd = 0;
-  /**
-   * Subagents started and not yet finished, keyed by the `Agent` call's id.
-   * Kept across turns: a backgrounded one reports after its turn has ended.
-   */
-  openSubagents = /* @__PURE__ */ new Map();
-  /** Subagent messages already counted. A message arrives as one line per content block, each repeating its usage. */
-  countedSubagentMessages = /* @__PURE__ */ new Set();
-  /** Background tasks (shells, agents) the CLI reports as still running, as of its last `background_tasks_changed`. */
-  backgroundTaskCount = 0;
-  /**
-   * A task's turn whose `result` arrived while background work was still open.
-   * The CLI reports that result when the model stops talking, then opens a turn
-   * of its own when the work finishes; a turn ended at the first result would
-   * lose everything said after it, the completion marker included.
-   */
-  resultHeld = false;
-  followOnTimer = null;
-  /** The mode a task asked for, to hold the CLI to it once its `init` says what it started in. */
-  requestedMode = null;
-  /** The session `--resume` asked for, until the CLI's `init` shows it was taken up. */
-  pendingResume = null;
-  spawnSpec(opts) {
-    if (opts.kind === "task") return this.taskSpawnSpec(opts);
-    const args = [
-      ...PROTOCOL_ARGS,
-      // The read-only guarantee, enforced at spawn rather than by prompt.
-      "--permission-mode",
-      "plan",
-      "--disallowedTools",
-      DISALLOWED_TOOLS.join(","),
-      "--append-system-prompt",
-      opts.systemPrompt
-    ];
-    if (opts.model) args.push("--model", opts.model);
-    if (opts.effort && opts.effort !== "adaptive") args.push("--effort", opts.effort);
-    if (opts.resumeSessionId) {
-      args.push("--resume", opts.resumeSessionId);
-      this.reportedCostUsd = void 0;
-      this.pendingResume = opts.resumeSessionId;
+
+// src/services/mcp/OrdewellMcpServer.ts
+var import_http = require("http");
+var import_crypto4 = require("crypto");
+var import_server = require("@modelcontextprotocol/sdk/server/index.js");
+var import_streamableHttp = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
+var import_types = require("@modelcontextprotocol/sdk/types.js");
+
+// src/utils/daemonToken.ts
+var import_crypto3 = require("crypto");
+var import_fs3 = require("fs");
+var import_path2 = require("path");
+
+// src/utils/globalDataDir.ts
+var fs7 = __toESM(require("fs"));
+var path14 = __toESM(require("path"));
+var os5 = __toESM(require("os"));
+function globalDataDir() {
+  return path14.join(os5.homedir(), ".ordewell");
+}
+function copyDirSync(src, dest) {
+  fs7.mkdirSync(dest, { recursive: true });
+  const entries = fs7.readdirSync(src, { withFileTypes: true });
+  for (const entry of entries) {
+    const srcPath = path14.join(src, entry.name);
+    const destPath = path14.join(dest, entry.name);
+    if (entry.isDirectory()) {
+      copyDirSync(srcPath, destPath);
+    } else {
+      fs7.copyFileSync(srcPath, destPath);
     }
-    return { command: "claude", args };
   }
-  /**
-   * A task's run: the manifest decides what its mode and effort mean
-   * (ADR-0001), and this adds only the protocol around them. No tool list and
-   * no system prompt — the task's prompt is its first turn, as on the terminal
-   * transport. `--permission-prompt-tool stdio` routes the questions the mode
-   * leaves open to the control channel, where the adapter must answer them;
-   * without it `-p` refuses them silently and nothing can ever surface one.
-   */
-  taskSpawnSpec(opts) {
-    this.requestedMode = opts.flags.permissionMode;
-    const args = [
-      ...PROTOCOL_ARGS,
-      "--permission-prompt-tool",
-      "stdio",
-      "--permission-mode",
-      opts.flags.permissionMode,
-      "--disallowedTools",
-      TASK_DISALLOWED_TOOLS.join(","),
-      ...opts.flags.effort ? claudeThinkingArgs(opts.flags.effort) : []
-    ];
-    if (opts.model) args.push("--model", opts.model);
-    if (opts.resumeSessionId) {
-      args.push("--resume", opts.resumeSessionId);
-      this.reportedCostUsd = void 0;
-      this.pendingResume = opts.resumeSessionId;
+}
+var migrated = false;
+function migrateOldConfigDir() {
+  if (migrated) return;
+  migrated = true;
+  const oldDir = path14.join(os5.homedir(), ".config", "ordewell");
+  if (!fs7.existsSync(oldDir)) return;
+  const newDir = globalDataDir();
+  const liftFile = (name) => {
+    const oldFile = path14.join(oldDir, name);
+    const newFile = path14.join(newDir, name);
+    if (fs7.existsSync(oldFile) && !fs7.existsSync(newFile)) {
+      fs7.mkdirSync(newDir, { recursive: true });
+      fs7.copyFileSync(oldFile, newFile);
     }
-    return { command: "claude", args };
+  };
+  liftFile("settings.json");
+  liftFile(".env");
+  const oldPlugins = path14.join(oldDir, "plugins");
+  const newPlugins = path14.join(newDir, "plugins");
+  if (fs7.existsSync(oldPlugins) && !fs7.existsSync(newPlugins)) {
+    copyDirSync(oldPlugins, newPlugins);
   }
-  /**
-   * Claude Code's soft interrupt: the turn stops, the process and its session
-   * stay. The CLI acknowledges on the control channel, then closes the turn
-   * with an `error_during_execution` result, which {@link handleLine} reports
-   * as an interrupted `turn_end`.
-   */
-  interrupt(timeoutMs) {
-    if (!this.process) return Promise.resolve(false);
-    this.interruptCount += 1;
-    const requestId = `ordewell-interrupt-${this.interruptCount}`;
-    this.interruptRequested = true;
-    return new Promise((resolve7) => {
-      const settle = (ok) => {
+}
+
+// src/utils/privateFile.ts
+var import_fs2 = require("fs");
+var import_path = require("path");
+var import_crypto2 = require("crypto");
+var DIR_MODE = 448;
+var FILE_MODE = 384;
+var POSIX_MODES = process.platform !== "win32";
+function ensurePrivateDir(dir) {
+  if (POSIX_MODES) {
+    (0, import_fs2.mkdirSync)(dir, { recursive: true, mode: DIR_MODE });
+    return;
+  }
+  (0, import_fs2.mkdirSync)(dir, { recursive: true });
+}
+function writePrivateFile(filePath, content) {
+  const dir = (0, import_path.dirname)(filePath);
+  ensurePrivateDir(dir);
+  const tempPath = (0, import_path.join)(dir, `.${(0, import_path.basename)(filePath)}.${(0, import_crypto2.randomBytes)(8).toString("hex")}.tmp`);
+  const fd = (0, import_fs2.openSync)(tempPath, "wx", POSIX_MODES ? FILE_MODE : void 0);
+  try {
+    (0, import_fs2.writeSync)(fd, content);
+  } finally {
+    (0, import_fs2.closeSync)(fd);
+  }
+  try {
+    (0, import_fs2.renameSync)(tempPath, filePath);
+  } catch (err) {
+    try {
+      (0, import_fs2.unlinkSync)(tempPath);
+    } catch {
+    }
+    throw err;
+  }
+}
+
+// src/utils/daemonToken.ts
+var BEARER_PREFIX = "bearer ";
+var DAEMON_TOKEN_SUBPROTOCOL_PREFIX = "ordewell.token.";
+var DAEMON_SUBPROTOCOL = "ordewell.v1";
+function configDir() {
+  return globalDataDir();
+}
+function daemonTokenPath(port) {
+  return (0, import_path2.join)(configDir(), `server-${port}.token`);
+}
+function mintDaemonToken(port) {
+  const token = (0, import_crypto3.randomBytes)(32).toString("base64url");
+  const file = daemonTokenPath(port);
+  writePrivateFile(file, token);
+  return { token, file };
+}
+function readDaemonToken(port) {
+  try {
+    const token = (0, import_fs3.readFileSync)(daemonTokenPath(port), "utf8").trim();
+    return token === "" ? void 0 : token;
+  } catch {
+    return void 0;
+  }
+}
+function clearDaemonToken(port) {
+  try {
+    (0, import_fs3.unlinkSync)(daemonTokenPath(port));
+  } catch {
+  }
+}
+function bearerHeaderValue(token) {
+  return `Bearer ${token}`;
+}
+function tokenSubprotocols(token) {
+  return [DAEMON_SUBPROTOCOL, `${DAEMON_TOKEN_SUBPROTOCOL_PREFIX}${token}`];
+}
+function extractPresentedToken(carriers) {
+  const authorization = carriers.authorization;
+  if (authorization && authorization.toLowerCase().startsWith(BEARER_PREFIX)) {
+    const value = authorization.slice(BEARER_PREFIX.length).trim();
+    if (value !== "") return value;
+  }
+  for (const offered of (carriers.secWebSocketProtocol ?? "").split(",")) {
+    const value = offered.trim();
+    if (!value.startsWith(DAEMON_TOKEN_SUBPROTOCOL_PREFIX)) continue;
+    const token = value.slice(DAEMON_TOKEN_SUBPROTOCOL_PREFIX.length);
+    if (token !== "") return token;
+  }
+  return void 0;
+}
+function tokensMatch(presented, expected) {
+  if (presented === void 0) return false;
+  const a = Buffer.from(presented, "utf8");
+  const b = Buffer.from(expected, "utf8");
+  if (a.length !== b.length) return false;
+  return (0, import_crypto3.timingSafeEqual)(a, b);
+}
+
+// src/services/mcp/tools.ts
+var import_v4 = require("zod/v4");
+var taskCompleteInput = import_v4.z.object({
+  status: import_v4.z.enum(["done", "blocked", "failed"]).describe("'done' only when the task is fully complete. 'blocked' or 'failed' end the attempt without passing."),
+  summary: import_v4.z.string().describe("What was done, handed to the tasks that depend on this one."),
+  reason: import_v4.z.string().optional().describe("Why the task is blocked or failed. Expected for anything but 'done'.")
+});
+var checkpointInput = import_v4.z.object({
+  question: import_v4.z.string().min(1).describe("The question for the user. The call returns their answer.")
+});
+var listRunnersInput = import_v4.z.object({});
+var listModelsInput = import_v4.z.object({
+  runner: import_v4.z.string().min(1).describe("A runner id from list_runners.")
+});
+var taskRef = import_v4.z.union([import_v4.z.string().min(1), import_v4.z.number().int().min(0)]).describe('A task id, "#order", a bare order, or a title.');
+var modelAssignment = import_v4.z.looseObject({
+  modelId: import_v4.z.string(),
+  modelLabel: import_v4.z.string().optional(),
+  thinkingEffort: import_v4.z.string().optional().describe("A variant id from that model's variants list.")
+});
+var planTask = import_v4.z.looseObject({
+  id: import_v4.z.string().optional(),
+  order: import_v4.z.number().optional(),
+  title: import_v4.z.string(),
+  description: import_v4.z.string().optional(),
+  type: import_v4.z.enum(["ai", "user"]).optional(),
+  dependencies: import_v4.z.array(import_v4.z.string()).optional(),
+  prompt: import_v4.z.string().optional(),
+  userSteps: import_v4.z.array(import_v4.z.looseObject({ order: import_v4.z.number().optional(), instruction: import_v4.z.string() })).optional(),
+  assignedRunner: import_v4.z.string().optional(),
+  assignedModel: modelAssignment.optional(),
+  taskMode: import_v4.z.string().optional(),
+  autonomy: import_v4.z.enum(["AFK", "HITL"]).optional(),
+  sliceType: import_v4.z.enum(["AFK", "HITL"]).optional(),
+  ops: import_v4.z.boolean().optional(),
+  userStoriesCovered: import_v4.z.array(import_v4.z.string()).optional(),
+  subtasks: import_v4.z.array(import_v4.z.record(import_v4.z.string(), import_v4.z.unknown())).optional()
+});
+var submitPlanInput = import_v4.z.object({
+  tasks: import_v4.z.array(planTask).min(1).describe("The whole plan, in order.")
+});
+var taskFields = import_v4.z.record(import_v4.z.string(), import_v4.z.unknown());
+var handle = import_v4.z.string().optional();
+var taskOp = import_v4.z.discriminatedUnion("op", [
+  import_v4.z.object({ op: import_v4.z.literal("update"), taskId: taskRef, changes: taskFields }),
+  import_v4.z.object({ op: import_v4.z.literal("add"), task: taskFields, handle }),
+  import_v4.z.object({ op: import_v4.z.literal("remove"), taskId: taskRef }),
+  import_v4.z.object({ op: import_v4.z.literal("reorder"), taskIds: import_v4.z.array(taskRef) }),
+  import_v4.z.object({ op: import_v4.z.literal("merge"), taskIds: import_v4.z.array(taskRef), merged: taskFields, handle }),
+  import_v4.z.object({ op: import_v4.z.literal("split"), taskId: taskRef, parts: import_v4.z.array(taskFields), handle }),
+  import_v4.z.object({ op: import_v4.z.literal("rearm"), taskId: taskRef, changes: taskFields.optional() })
+]);
+var editPlanInput = import_v4.z.object({
+  ops: import_v4.z.array(taskOp).min(1).describe("Applied as one batch; every ref resolves against the plan before any op runs.")
+});
+var taskQueryInput = import_v4.z.object({
+  tasks: import_v4.z.array(taskRef).optional(),
+  fields: import_v4.z.array(import_v4.z.enum(TASK_QUERY_TASK_FIELDS)).optional().describe("Omit to read every field. A task's output is read with task_output."),
+  catalog: import_v4.z.boolean().optional().describe("Also return every runner with its models, thinking-effort variants and modes.")
+}).refine((q) => (q.tasks?.length ?? 0) > 0 || q.catalog === true, { message: "Name at least one task, or set catalog: true." });
+var taskOutputInput = import_v4.z.object({
+  task: taskRef,
+  lines: import_v4.z.number().int().min(1).optional().describe(`How many lines to return; the default is 80 and anything over ${OUTPUT_LINES_MAX} is cut to ${OUTPUT_LINES_MAX}.`),
+  since: import_v4.z.number().int().min(0).optional().describe("A previous answer's nextOffset: return only what came after it.")
+});
+function checkpointReply(answer2) {
+  switch (answer2.kind) {
+    case "continue":
+      return { text: "continue" };
+    case "rejected":
+      return { text: `rejected: ${answer2.reason}` };
+    case "withdrawn":
+      return { text: `The checkpoint was withdrawn: ${answer2.why}`, isError: true };
+  }
+}
+function tool(name, description, input, pick, annotations) {
+  return {
+    name,
+    description,
+    inputSchema: { ...import_v4.z.toJSONSchema(input, { io: "input" }), type: "object" },
+    ...annotations ? { annotations } : {},
+    async call(handler, args, context) {
+      const run = pick(handler);
+      if (!run) return { text: `${name} is not available in this session.`, isError: true };
+      const parsed = input.safeParse(args ?? {});
+      if (!parsed.success) return { text: `Invalid ${name} arguments: ${import_v4.z.prettifyError(parsed.error)}`, isError: true };
+      return run(parsed.data, context);
+    }
+  };
+}
+var TASK_TOOLS = [
+  tool(
+    "task_complete",
+    "Report that this task has ended, and how. Call it once, as your last action.",
+    taskCompleteInput,
+    (h) => h.taskComplete?.bind(h)
+  ),
+  tool(
+    "checkpoint",
+    "Ask the user a question and wait for the answer, which is this call's result.",
+    checkpointInput,
+    (h) => h.checkpoint?.bind(h)
+  )
+];
+var PLANNER_READ_ONLY = { readOnlyHint: true };
+var PLANNER_TOOLS = [
+  tool(
+    "list_runners",
+    "List the runners enabled right now, each with its modes and default mode. Call it just before submit_plan.",
+    listRunnersInput,
+    (h) => h.listRunners?.bind(h),
+    PLANNER_READ_ONLY
+  ),
+  tool(
+    "list_models",
+    "List the models a runner may use right now, with labels and thinking-effort variants.",
+    listModelsInput,
+    (h) => h.listModels?.bind(h),
+    PLANNER_READ_ONLY
+  ),
+  tool(
+    "submit_plan",
+    "Submit the whole plan. It is checked against the live runners and models; an error names the task, the field and what would be accepted.",
+    submitPlanInput,
+    (h) => h.submitPlan?.bind(h),
+    PLANNER_READ_ONLY
+  ),
+  tool(
+    "edit_plan",
+    "Change the current plan with task operations: update, add, remove, reorder, merge, split or rearm.",
+    editPlanInput,
+    (h) => h.editPlan?.bind(h),
+    PLANNER_READ_ONLY
+  ),
+  tool(
+    "task_query",
+    "Read the long fields of plan tasks that the plan summary leaves out (prompt, user steps, verdict, output summary), and optionally the live runner catalog. Read a task before you rewrite it.",
+    taskQueryInput,
+    (h) => h.taskQuery?.bind(h),
+    PLANNER_READ_ONLY
+  ),
+  tool(
+    "task_output",
+    "Read the recent output of a running task, to check what its runner is doing; paged by offset. A task that is not running answers with its verdict, output summary and a digest of its last attempt.",
+    taskOutputInput,
+    (h) => h.taskOutput?.bind(h),
+    PLANNER_READ_ONLY
+  )
+];
+
+// src/services/mcp/OrdewellMcpServer.ts
+var ORDEWELL_MCP_PATH = "/mcp";
+var DEFAULT_HEARTBEAT_MS = 3e4;
+var OrdewellMcpServer = class {
+  grants = /* @__PURE__ */ new Map();
+  http;
+  listening;
+  boundUrl;
+  boundHost;
+  heartbeatMs;
+  constructor(options = {}) {
+    this.heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
+  }
+  /** The listener's URL, once the first token has started it. */
+  get url() {
+    return this.boundUrl;
+  }
+  issueTaskToken(scope, handler = {}) {
+    return this.issue({ role: "task", scope: { ...scope }, handler, revoked: new AbortController() });
+  }
+  issuePlannerToken(scope, handler = {}) {
+    return this.issue({ role: "planner", scope: { ...scope }, handler, revoked: new AbortController() });
+  }
+  /** Refuse every later request carrying `token`, and abort the calls it has in flight. */
+  revoke(token) {
+    const grant = this.grants.get(token);
+    if (!grant) return;
+    this.grants.delete(token);
+    grant.revoked.abort();
+  }
+  async dispose() {
+    for (const token of [...this.grants.keys()]) this.revoke(token);
+    const http = this.http;
+    this.http = void 0;
+    this.listening = void 0;
+    this.boundUrl = void 0;
+    this.boundHost = void 0;
+    if (!http) return;
+    http.closeAllConnections();
+    await new Promise((resolve7) => http.close(() => resolve7()));
+  }
+  async issue(grant) {
+    const url = await this.start();
+    const token = (0, import_crypto4.randomBytes)(32).toString("base64url");
+    this.grants.set(token, grant);
+    return { url, token };
+  }
+  start() {
+    this.listening ??= new Promise((resolve7, reject) => {
+      const http = (0, import_http.createServer)((req, res) => {
+        this.handle(req, res).catch(() => {
+          if (!res.headersSent) reply(res, 500, "Internal error");
+          else res.destroy();
+        });
+      });
+      http.once("error", (err) => {
+        this.listening = void 0;
+        reject(err);
+      });
+      http.listen(0, "127.0.0.1", () => {
+        const address = http.address();
+        if (address === null || typeof address === "string") {
+          reject(new Error("Ordewell MCP server bound to no TCP port"));
+          return;
+        }
+        this.boundHost = `127.0.0.1:${address.port}`;
+        this.boundUrl = `http://${this.boundHost}${ORDEWELL_MCP_PATH}`;
+        resolve7(this.boundUrl);
+      });
+      http.unref();
+      this.http = http;
+    });
+    return this.listening;
+  }
+  async handle(req, res) {
+    if (req.headers.host !== this.boundHost || req.headers.origin !== void 0) {
+      reply(res, 403, "Forbidden");
+      return;
+    }
+    const token = extractPresentedToken({ authorization: req.headers.authorization });
+    const grant = token === void 0 ? void 0 : this.grants.get(token);
+    if (!grant) {
+      reply(res, 401, "Unauthorized");
+      return;
+    }
+    if (new URL(req.url ?? "/", `http://${this.boundHost}`).pathname !== ORDEWELL_MCP_PATH) {
+      reply(res, 404, "Not found");
+      return;
+    }
+    const mcp = new import_server.Server({ name: "ordewell", version: "1" }, { capabilities: { tools: {} } });
+    if (grant.role === "task") serveTools(mcp, TASK_TOOLS, grant.handler, grant.revoked.signal, this.heartbeatMs);
+    else serveTools(mcp, PLANNER_TOOLS, grant.handler, grant.revoked.signal, this.heartbeatMs);
+    const transport = new import_streamableHttp.StreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+    res.on("close", () => {
+      void transport.close();
+      void mcp.close();
+    });
+    await mcp.connect(transport);
+    await transport.handleRequest(req, res);
+  }
+};
+function serveTools(mcp, tools, handler, revoked, heartbeatMs) {
+  mcp.setRequestHandler(import_types.ListToolsRequestSchema, () => ({
+    tools: tools.map(({ name, description, inputSchema, annotations }) => ({ name, description, inputSchema, ...annotations ? { annotations } : {} }))
+  }));
+  mcp.setRequestHandler(import_types.CallToolRequestSchema, async (request, extra) => {
+    const tool2 = tools.find((t) => t.name === request.params.name);
+    if (!tool2) throw new import_types.McpError(import_types.ErrorCode.InvalidParams, `Unknown tool: ${request.params.name}`);
+    const progressToken = request.params._meta?.progressToken;
+    let beats = 0;
+    const heartbeat = progressToken === void 0 ? void 0 : setInterval(() => {
+      beats += 1;
+      extra.sendNotification({ method: "notifications/progress", params: { progressToken, progress: beats } }).catch(() => void 0);
+    }, heartbeatMs);
+    try {
+      const result = await tool2.call(handler, request.params.arguments, { signal: AbortSignal.any([revoked, extra.signal]) });
+      return { content: [{ type: "text", text: result.text }], isError: result.isError ?? false };
+    } catch (err) {
+      return { content: [{ type: "text", text: err instanceof Error ? err.message : String(err) }], isError: true };
+    } finally {
+      clearInterval(heartbeat);
+    }
+  });
+}
+function reply(res, status, message) {
+  res.writeHead(status, { "content-type": "text/plain" }).end(message);
+}
+var shared;
+function sharedMcpServer() {
+  shared ??= new OrdewellMcpServer();
+  return shared;
+}
+
+// src/services/mcp/clientConfig.ts
+var import_fs4 = require("fs");
+var import_os = require("os");
+var import_path3 = require("path");
+var ORDEWELL_MCP_SERVER_NAME = "ordewell";
+function mcpClientConfig(credential) {
+  return {
+    name: ORDEWELL_MCP_SERVER_NAME,
+    url: credential.url,
+    headers: { Authorization: bearerHeaderValue(credential.token) }
+  };
+}
+function ownerOnlyConfigFile(fileName, contents) {
+  const dir = (0, import_fs4.mkdtempSync)((0, import_path3.join)((0, import_os.tmpdir)(), "ordewell-mcp-"));
+  const path27 = (0, import_path3.join)(dir, fileName);
+  (0, import_fs4.writeFileSync)(path27, contents, { mode: 384 });
+  return { path: path27, remove: () => (0, import_fs4.rmSync)(dir, { recursive: true, force: true }) };
+}
+
+// src/services/harness/ClaudeCodeAdapter.ts
+var DISALLOWED_TOOLS = ["Edit", "Write", "MultiEdit", "NotebookEdit", "KillShell"];
+var TASK_DISALLOWED_TOOLS = ["AskUserQuestion"];
+var PROTOCOL_ARGS = [
+  "-p",
+  "--input-format",
+  "stream-json",
+  "--output-format",
+  "stream-json",
+  "--verbose",
+  "--include-partial-messages"
+];
+var ASYNC_LAUNCH_MARKER = "Async agent launched successfully";
+var FOLLOW_ON_TURN_GRACE_MS = 5e3;
+var MCP_ATTACH_TIMEOUT_MS = 1e4;
+var MCP_STATUS_POLL_MS = 100;
+var DEFAULT_DENIAL = "Denied in Ordewell. Continue without it, or say what you need.";
+var ORDEWELL_TASK_TOOLS = ["task_complete", "checkpoint"];
+var SUBAGENT_TOOLS = /* @__PURE__ */ new Set(["Agent", "Task"]);
+function usageRecord(usage, model, subagentId) {
+  const record = {
+    source: "claude-code",
+    ...partedPromptUsage({ uncached: usage.input_tokens, cacheRead: usage.cache_read_input_tokens, cacheWrite: usage.cache_creation_input_tokens })
+  };
+  if (model) record.model = model;
+  if (usage.output_tokens !== void 0) record.outputTokens = usage.output_tokens;
+  if (subagentId) record.subagentId = subagentId;
+  return record;
+}
+function subagentFinalCall(result) {
+  if (typeof result !== "object" || result === null) return null;
+  const { usage, resolvedModel } = result;
+  if (typeof usage !== "object" || usage === null) return null;
+  return { usage, model: typeof resolvedModel === "string" ? resolvedModel : void 0 };
+}
+function notificationOutcome(status) {
+  if (status === "completed") return "done";
+  if (status === "killed" || status === "stopped") return "stopped";
+  return "failed";
+}
+function blocksOf(msg) {
+  return Array.isArray(msg.message?.content) ? msg.message.content : [];
+}
+function flattenContent(content) {
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content.map((block) => typeof block === "string" ? block : typeof block?.text === "string" ? block.text : "").filter(Boolean).join("\n");
+  }
+  return "";
+}
+function editDiff(result) {
+  if (!result || typeof result !== "object") return "";
+  const { type, content, structuredPatch } = result;
+  if (type === "create" && typeof content === "string") return markedLines(content, "+");
+  return structuredPatchText(structuredPatch);
+}
+var ClaudeCodeAdapter = class extends StdioAgentAdapter {
+  agentId = "claude-code";
+  controlCount = 0;
+  /** Control requests sent and not yet answered, by request id. */
+  pendingControl = /* @__PURE__ */ new Map();
+  /** An interrupt was sent during the current turn, so an aborted result is that interrupt, not a failure. */
+  interruptRequested = false;
+  /** A task's tool requests still waiting for an answer, by request id, with what the answer echoes back. */
+  openPermissions = /* @__PURE__ */ new Map();
+  /** Whether this turn has already emitted reply text — see {@link handleLine}. */
+  turnHasText = false;
+  /** The text block streaming now follows earlier reply text, so its first delta opens the paragraph. */
+  pendingBreak = false;
+  /** The model answering the planner's current message, as its `message_start` named it. */
+  plannerModel;
+  /**
+   * The session's `total_cost_usd` as last reported. Undefined after a resume:
+   * the CLI restores the resumed session's running total, and what Ordewell
+   * already counted of it is not ours to know here.
+   */
+  reportedCostUsd = 0;
+  /**
+   * Subagents started and not yet finished, keyed by the `Agent` call's id.
+   * Kept across turns: a backgrounded one reports after its turn has ended.
+   */
+  openSubagents = /* @__PURE__ */ new Map();
+  /** Subagent messages already counted. A message arrives as one line per content block, each repeating its usage. */
+  countedSubagentMessages = /* @__PURE__ */ new Set();
+  /** Background tasks (shells, agents) the CLI reports as still running, as of its last `background_tasks_changed`. */
+  backgroundTaskCount = 0;
+  /**
+   * A task's turn whose `result` arrived while background work was still open.
+   * The CLI reports that result when the model stops talking, then opens a turn
+   * of its own when the work finishes; a turn ended at the first result would
+   * lose everything said after it, the completion marker included.
+   */
+  resultHeld = false;
+  followOnTimer = null;
+  /** The mode a task asked for, to hold the CLI to it once its `init` says what it started in. */
+  requestedMode = null;
+  /** The session `--resume` asked for, until the CLI's `init` shows it was taken up. */
+  pendingResume = null;
+  /** The `--mcp-config` file of the running process, which holds its token; removed with the process. */
+  mcpConfig = null;
+  /** `mcp__ordewell__`, once this process was given the server. */
+  ordewellToolPrefix = null;
+  spawnSpec(opts) {
+    if (opts.kind === "task") return this.taskSpawnSpec(opts);
+    const args = [
+      ...PROTOCOL_ARGS,
+      // The read-only guarantee, enforced at spawn rather than by prompt.
+      "--permission-mode",
+      "plan",
+      "--disallowedTools",
+      DISALLOWED_TOOLS.join(","),
+      "--append-system-prompt",
+      opts.systemPrompt
+    ];
+    if (opts.mcp) args.push(...this.ordewellServerArgs(opts.mcp, PLANNER_TOOLS.map((t) => t.name)));
+    if (opts.model) args.push("--model", opts.model);
+    if (opts.effort && opts.effort !== "adaptive") args.push("--effort", opts.effort);
+    if (opts.resumeSessionId) {
+      args.push("--resume", opts.resumeSessionId);
+      this.reportedCostUsd = void 0;
+      this.pendingResume = opts.resumeSessionId;
+    }
+    return { command: "claude", args };
+  }
+  /**
+   * A task's run: the manifest decides what its mode and effort mean
+   * (ADR-0001), and this adds only the protocol around them. No tool list and
+   * no system prompt — the task's prompt is its first turn, as on the terminal
+   * transport. `--permission-prompt-tool stdio` routes the questions the mode
+   * leaves open to the control channel, where the adapter must answer them;
+   * without it `-p` refuses them silently and nothing can ever surface one.
+   */
+  taskSpawnSpec(opts) {
+    this.requestedMode = opts.flags.permissionMode;
+    const args = [
+      ...PROTOCOL_ARGS,
+      "--permission-prompt-tool",
+      "stdio",
+      "--permission-mode",
+      opts.flags.permissionMode,
+      "--disallowedTools",
+      TASK_DISALLOWED_TOOLS.join(","),
+      ...opts.flags.effort ? claudeThinkingArgs(opts.flags.effort) : []
+    ];
+    if (opts.model) args.push("--model", opts.model);
+    if (opts.resumeSessionId) {
+      args.push("--resume", opts.resumeSessionId);
+      this.reportedCostUsd = void 0;
+      this.pendingResume = opts.resumeSessionId;
+    }
+    if (opts.mcp) args.push(...this.ordewellServerArgs(opts.mcp, ORDEWELL_TASK_TOOLS));
+    return { command: "claude", args };
+  }
+  /**
+   * `--mcp-config` takes a path as well as inline JSON; the path keeps the
+   * token out of the argv every local user can list (ADR-0022, A5). The file
+   * lives exactly as long as the process that reads it. `alwaysLoad` because
+   * the CLI otherwise defers MCP tools behind its tool search, and a model
+   * that has to look an Ordewell tool up first tends to go on without it.
+   */
+  ordewellServerArgs(mcp, tools) {
+    this.removeMcpConfig();
+    const config = { mcpServers: { [mcp.name]: { type: "http", url: mcp.url, headers: mcp.headers, alwaysLoad: true } } };
+    const file = ownerOnlyConfigFile("mcp.json", JSON.stringify(config));
+    this.mcpConfig = file;
+    void this.processEnded.then(() => file.remove());
+    const prefix = `mcp__${mcp.name}__`;
+    this.ordewellToolPrefix = prefix;
+    return ["--mcp-config", file.path, "--allowedTools", tools.map((tool2) => `${prefix}${tool2}`).join(",")];
+  }
+  removeMcpConfig() {
+    this.mcpConfig?.remove();
+    this.mcpConfig = null;
+  }
+  async start(opts) {
+    try {
+      await super.start(opts);
+    } catch (err) {
+      this.removeMcpConfig();
+      throw err;
+    }
+  }
+  /** Asks the CLI itself, which reports `pending` until its connection attempt settles. */
+  async mcpAttached() {
+    if (!this.mcpConfig) return false;
+    const deadline = Date.now() + MCP_ATTACH_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      const answer2 = await this.control({ subtype: "mcp_status" }, deadline - Date.now());
+      const status = answer2?.response?.mcpServers?.find((s) => s.name === ORDEWELL_MCP_SERVER_NAME)?.status;
+      if (status === "connected") return true;
+      if (status !== "pending") return false;
+      await new Promise((resolve7) => setTimeout(resolve7, MCP_STATUS_POLL_MS));
+    }
+    return false;
+  }
+  /**
+   * Claude Code's soft interrupt: the turn stops, the process and its session
+   * stay. The CLI acknowledges on the control channel, then closes the turn
+   * with an `error_during_execution` result, which {@link handleLine} reports
+   * as an interrupted `turn_end`.
+   */
+  async interrupt(timeoutMs) {
+    if (!this.process) return false;
+    this.interruptRequested = true;
+    return (await this.control({ subtype: "interrupt" }, timeoutMs))?.subtype === "success";
+  }
+  /** Send a control request and wait for its answer; null when none came in time or the process ended. */
+  control(request, timeoutMs) {
+    if (!this.process) return Promise.resolve(null);
+    this.controlCount += 1;
+    const requestId = `ordewell-${request.subtype}-${this.controlCount}`;
+    return new Promise((resolve7) => {
+      const settle = (response) => {
         if (!this.pendingControl.delete(requestId)) return;
         clearTimeout(timer);
-        resolve7(ok);
+        resolve7(response);
       };
-      const timer = setTimeout(() => settle(false), timeoutMs);
+      const timer = setTimeout(() => settle(null), timeoutMs);
       timer.unref?.();
       this.pendingControl.set(requestId, settle);
-      void this.processEnded.then(() => settle(false));
-      this.writeLine({ type: "control_request", request_id: requestId, request: { subtype: "interrupt" } });
+      void this.processEnded.then(() => settle(null));
+      this.writeLine({ type: "control_request", request_id: requestId, request });
     });
   }
   /**
@@ -14781,6 +15551,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
   }
   dispose() {
     this.clearFollowOnTimer();
+    this.removeMcpConfig();
     super.dispose();
   }
   clearFollowOnTimer() {
@@ -14831,12 +15602,18 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
           emit({ type: "permission_request", id, name: msg.request.tool_name ?? "unknown", detail: JSON.stringify(input) });
           return;
         }
+        const name = msg.request.tool_name ?? "unknown";
+        if (this.ordewellToolPrefix && name.startsWith(this.ordewellToolPrefix)) {
+          this.writeLine({ type: "control_response", response: { subtype: "success", request_id: id, response: { behavior: "allow", updatedInput: input } } });
+          emit({ type: "permission_request", id, name, detail: JSON.stringify(input), input, decided: { decision: "allow" } });
+          return;
+        }
         const suggestions = msg.request.permission_suggestions ?? [];
         this.openPermissions.set(id, { input, suggestions });
         emit({
           type: "permission_request",
           id,
-          name: msg.request.tool_name ?? "unknown",
+          name,
           detail: JSON.stringify(input),
           input,
           suggestions,
@@ -14852,7 +15629,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
       }
       case "control_response": {
         const requestId = msg.response?.request_id;
-        if (requestId) this.pendingControl.get(requestId)?.(msg.response?.subtype === "success");
+        if (requestId) this.pendingControl.get(requestId)?.(msg.response ?? null);
         return;
       }
       case "assistant":
@@ -14880,6 +15657,7 @@ ${block.text}` : block.text });
           if (block.type !== "tool_result") continue;
           const id = block.tool_use_id ?? "";
           const output = flattenContent(block.content);
+          const diff = block.is_error === true ? "" : editDiff(msg.tool_use_result);
           const subagent = subagentId ? void 0 : this.openSubagents.get(id);
           if (!subagentId && output.includes(ASYNC_LAUNCH_MARKER)) {
             emit({ type: "background_agent", id });
@@ -14887,7 +15665,7 @@ ${block.text}` : block.text });
           } else if (subagent) {
             this.finishForegroundSubagent(id, msg.tool_use_result, output, block.is_error === true, emit);
           }
-          emit({ type: "tool_result", id, name: "", output, success: block.is_error !== true, subagentId });
+          emit({ type: "tool_result", id, name: "", output: diff || output, success: block.is_error !== true, subagentId });
         }
         return;
       case "system":
@@ -15023,6 +15801,9 @@ ${block.text}` : block.text });
   }
 };
 
+// src/services/harness/CodexAdapter.ts
+var import_path4 = require("path");
+
 // src/services/harness/codexSandbox.ts
 var PROBE_TIMEOUT_MS = 1e4;
 var USERNS_FAILURE = /bwrap|bubblewrap|user namespace|RTM_NEWADDR/i;
@@ -15082,6 +15863,17 @@ function runProbe(deps, cwd, env, flags) {
 
 // src/services/harness/CodexAdapter.ts
 var HANDSHAKE_TIMEOUT_MS = 3e4;
+var MCP_ATTACH_TIMEOUT_MS2 = 1e4;
+var CHANGE_NAMES = { add: "Add", update: "Update", delete: "Delete" };
+function changeName(change) {
+  return CHANGE_NAMES[change.kind?.type ?? ""] ?? "file_change";
+}
+function changeDiff(change) {
+  const diff = change.diff ?? "";
+  if (change.kind?.type === "add") return markedLines(diff, "+");
+  if (change.kind?.type === "delete") return markedLines(diff, "-");
+  return diff;
+}
 function subagentOutcome(status) {
   switch (status) {
     case "completed":
@@ -15115,6 +15907,28 @@ var DECLINE_RESULTS = {
   execCommandApproval: { decision: "denied" },
   applyPatchApproval: { decision: "denied" }
 };
+function shownToolName(item) {
+  const tool2 = item.tool ?? "mcp_tool";
+  return item.server === ORDEWELL_MCP_SERVER_NAME ? `mcp__${ORDEWELL_MCP_SERVER_NAME}__${tool2}` : tool2;
+}
+function mcpHeaderEnv(mcp) {
+  return Object.fromEntries(Object.keys(mcp.headers).map((header, i) => [header, `ORDEWELL_MCP_TOKEN_${i}`]));
+}
+function ordewellServerConfig(mcp) {
+  return {
+    url: mcp.url,
+    env_http_headers: mcpHeaderEnv(mcp),
+    default_tools_approval_mode: "approve"
+  };
+}
+var TASK_TOOLS_NOTE = [
+  "This task has two tools from the `ordewell` MCP server: `task_complete` and `checkpoint`.",
+  "They are not in your tool list up front. Find them with the tool discovery you have (the `exec` tool's `ALL_TOOLS` list) and call them by their full names, `mcp__ordewell__task_complete` and `mcp__ordewell__checkpoint`.",
+  "Look for them before you finish; the task is reported complete through `task_complete`."
+].join(" ");
+function isOrdewellElicitation(method, params) {
+  return method === "mcpServer/elicitation/request" && params.serverName === ORDEWELL_MCP_SERVER_NAME;
+}
 var REVIEW_DECISIONS = { allow: "accept", allowForTask: "acceptForSession", deny: "decline" };
 var TASK_APPROVALS = {
   "item/commandExecution/requestApproval": {
@@ -15189,11 +16003,16 @@ var CodexAdapter = class extends StdioAgentAdapter {
    * names only the item, and a person deciding needs to see the files.
    */
   fileChangePaths = /* @__PURE__ */ new Map();
+  /** The row each announced file of an in-flight `fileChange` item is shown under, by the file's shown path. */
+  fileChangeRows = /* @__PURE__ */ new Map();
   /** Requests this adapter sent and awaits an answer to, by JSON-RPC id. */
   pendingRequests = /* @__PURE__ */ new Map();
   resumeAttempted = false;
   resumeFallbackSent = false;
   sandbox = "default";
+  /** The Ordewell server's startup state, as Codex last reported it for this thread. */
+  mcpStartup = null;
+  mcpStartupSettled = null;
   /**
    * Subagent threads this session has spawned, keyed by the child thread id.
    * Codex runs a subagent in its own thread and replays both threads' events on
@@ -15202,7 +16021,9 @@ var CodexAdapter = class extends StdioAgentAdapter {
   subagents = /* @__PURE__ */ new Map();
   spawnSpec(opts) {
     this.startOpts = opts;
-    return { command: "codex", args: ["app-server"] };
+    const headers = opts.mcp ? mcpHeaderEnv(opts.mcp) : {};
+    const env = Object.fromEntries(Object.entries(headers).map(([header, name]) => [name, opts.mcp.headers[header]]));
+    return { command: "codex", args: ["app-server"], ...opts.mcp ? { env } : {} };
   }
   /**
    * `initialize`, then `thread/start`, both before the first user message. A
@@ -15269,7 +16090,11 @@ ${this.exitMessage()}`);
       cwd: opts?.cwd,
       ...opts?.model ? { model: opts.model } : {}
     };
-    const legacyLandlock = this.sandbox === "legacy-landlock" ? { config: { features: { use_legacy_landlock: true } } } : {};
+    const config = {
+      ...this.sandbox === "legacy-landlock" ? { features: { use_legacy_landlock: true } } : {},
+      ...opts?.mcp ? { mcp_servers: { [opts.mcp.name]: ordewellServerConfig(opts.mcp) } } : {}
+    };
+    const threadConfig = Object.keys(config).length ? { config } : {};
     if (opts?.kind === "task") {
       const { approvalPolicy, approvalsReviewer } = opts.flags.modeSettings;
       return {
@@ -15277,14 +16102,15 @@ ${this.exitMessage()}`);
         sandbox: opts.flags.permissionMode,
         ...approvalPolicy ? { approvalPolicy } : {},
         ...approvalsReviewer ? { approvalsReviewer } : {},
-        ...legacyLandlock
+        ...opts.mcp ? { developerInstructions: TASK_TOOLS_NOTE } : {},
+        ...threadConfig
       };
     }
     return {
       ...common,
       sandbox: "read-only",
       approvalPolicy: "never",
-      ...legacyLandlock,
+      ...threadConfig,
       // `developerInstructions` layers on top of Codex's own base prompt, the
       // way Claude Code's `--append-system-prompt` does. `baseInstructions`
       // replaces it — which takes Codex's description of its own tools with
@@ -15293,6 +16119,32 @@ ${this.exitMessage()}`);
       developerInstructions: opts?.systemPrompt
     };
   }
+  /**
+   * Codex's own startup report for the server, which it sends once the thread
+   * has tried to connect (ADR-0022, S4). A report that came before this was
+   * asked is kept, so asking late still gets the answer.
+   */
+  async mcpAttached() {
+    if (!this.startOpts?.mcp || !this.process) return false;
+    const deadline = Date.now() + MCP_ATTACH_TIMEOUT_MS2;
+    while (this.mcpStartup === null || this.mcpStartup === "starting") {
+      const left = deadline - Date.now();
+      if (left <= 0) return false;
+      const ended = await Promise.race([
+        new Promise((resolve7) => {
+          this.mcpStartupSettled = () => resolve7(false);
+        }),
+        this.processEnded.then(() => true),
+        new Promise((resolve7) => {
+          const t = setTimeout(() => resolve7(false), left);
+          t.unref?.();
+        })
+      ]);
+      this.mcpStartupSettled = null;
+      if (ended) return false;
+    }
+    return this.mcpStartup === "ready";
+  }
   effort() {
     const opts = this.startOpts;
     return opts?.kind === "task" ? opts.flags.effort : opts?.effort;
@@ -15464,6 +16316,13 @@ ${this.exitMessage()}`);
         if (this.openPermissions.delete(id)) emit({ type: "permission_cancelled", id });
         return;
       }
+      case "mcpServer/startupStatus/updated": {
+        const startup = msg.params;
+        if (startup?.name !== ORDEWELL_MCP_SERVER_NAME || !startup.status) return;
+        this.mcpStartup = startup.status;
+        this.mcpStartupSettled?.();
+        return;
+      }
       case "thread/tokenUsage/updated":
         this.emitUsage(msg.params, emit);
         return;
@@ -15602,6 +16461,10 @@ ${this.exitMessage()}`);
     const method = msg.method;
     const params = msg.params ?? {};
     const approval = TASK_APPROVALS[method];
+    if (isOrdewellElicitation(method, params)) {
+      this.writeLine({ jsonrpc: "2.0", id: msg.id, result: { action: "accept", content: {} } });
+      return;
+    }
     if (approval && (method !== "mcpServer/elicitation/request" || isYesNoElicitation(params))) {
       const id = String(msg.id);
       const input = this.approvalInput(method, params);
@@ -15642,6 +16505,10 @@ ${this.exitMessage()}`);
    */
   answerServerRequest(msg, emit) {
     const method = msg.method;
+    if (isOrdewellElicitation(method, msg.params ?? {})) {
+      this.writeLine({ jsonrpc: "2.0", id: msg.id, result: { action: "accept", content: {} } });
+      return;
+    }
     const result = DECLINE_RESULTS[method];
     if (result) {
       this.writeLine({ jsonrpc: "2.0", id: msg.id, result });
@@ -15668,7 +16535,7 @@ ${this.exitMessage()}`);
         emit({ type: "tool_call", id: item.id, name: "shell", args: { command: item.command, cwd: item.cwd }, ...subagentId ? { subagentId } : {} });
         return;
       case "mcpToolCall":
-        emit({ type: "tool_call", id: item.id, name: item.tool ?? "mcp_tool", args: item.arguments ?? {}, ...subagentId ? { subagentId } : {} });
+        emit({ type: "tool_call", id: item.id, name: shownToolName(item), args: item.arguments ?? {}, ...subagentId ? { subagentId } : {} });
         return;
       case "dynamicToolCall":
         emit({ type: "tool_call", id: item.id, name: item.tool ?? "tool", args: item.arguments ?? {}, ...subagentId ? { subagentId } : {} });
@@ -15680,7 +16547,7 @@ ${this.exitMessage()}`);
         const paths = (item.changes ?? []).map((change) => change.path).filter((path27) => !!path27);
         this.fileChangePaths.set(item.id, paths);
         if (this.startOpts?.kind === "task") {
-          emit({ type: "tool_call", id: item.id, name: "file_change", args: { path: paths.join(", ") }, ...subagentId ? { subagentId } : {} });
+          for (const change of item.changes ?? []) this.announceFileChange(item.id, change, emit, subagentId);
         }
         return;
       }
@@ -15737,7 +16604,7 @@ ${item.text}` : item.text });
         emit({
           type: "tool_result",
           id,
-          name: item.tool ?? "tool",
+          name: item.type === "mcpToolCall" ? shownToolName(item) : item.tool ?? "tool",
           output: item.error ?? flattenText(item.result) ?? "",
           success: item.status !== "error" && item.success !== false && !item.error,
           ...subagentId ? { subagentId } : {}
@@ -15751,8 +16618,11 @@ ${item.text}` : item.text });
       case "fileChange":
         this.fileChangePaths.delete(id);
         if (this.startOpts?.kind === "task") {
-          const diff = (item.changes ?? []).map((change) => change.diff ?? "").join("\n");
-          emit({ type: "tool_result", id, name: "file_change", output: diff, success: item.status === "completed", ...subagentId ? { subagentId } : {} });
+          for (const change of item.changes ?? []) {
+            const row = this.announceFileChange(id, change, emit, subagentId);
+            emit({ type: "tool_result", id: row, name: changeName(change), output: changeDiff(change), success: item.status === "completed", ...subagentId ? { subagentId } : {} });
+          }
+          this.fileChangeRows.delete(id);
           return;
         }
         emit({ type: "tool_result", id, name: "file_change", output: JSON.stringify(item), success: false, ...subagentId ? { subagentId } : {} });
@@ -15761,6 +16631,34 @@ ${item.text}` : item.text });
         return;
     }
   }
+  /**
+   * One row per changed file: a patch is several files, and one row naming
+   * them all reads as a single cut-off path. The first file keeps the item's
+   * id, which an approval for the patch points at. Announcing a file twice
+   * returns the row it already has, so a change first seen completed still
+   * gets its call.
+   */
+  announceFileChange(itemId, change, emit, subagentId) {
+    const rows = this.fileChangeRows.get(itemId) ?? /* @__PURE__ */ new Map();
+    this.fileChangeRows.set(itemId, rows);
+    const path27 = this.shownChangePath(change);
+    const known = rows.get(path27);
+    if (known) return known;
+    const row = rows.size === 0 ? itemId : `${itemId}:${path27}`;
+    rows.set(path27, row);
+    emit({ type: "tool_call", id: row, name: changeName(change), args: { path: path27 }, ...subagentId ? { subagentId } : {} });
+    return row;
+  }
+  /** Relative to the task's worktree, where every path but a stray one lies; a move names both ends. */
+  shownChangePath(change) {
+    const shown = (path27) => {
+      const cwd = this.startOpts?.cwd;
+      const rel = cwd ? (0, import_path4.relative)(cwd, path27) : path27;
+      return rel && rel !== ".." && !rel.startsWith(`..${import_path4.sep}`) && !(0, import_path4.isAbsolute)(rel) ? rel : path27;
+    };
+    const from = shown(change.path ?? "");
+    return change.kind?.move_path ? `${from} \u2192 ${shown(change.kind.move_path)}` : from;
+  }
   /**
    * A `collabAgentToolCall` — the planner spawning, waiting on or messaging a
    * subagent. The call itself is planner-level tool activity; the lifecycle it
@@ -15800,7 +16698,45 @@ ${item.text}` : item.text });
 };
 
 // src/services/harness/OpenCodeAdapter.ts
-var import_crypto2 = require("crypto");
+var import_crypto5 = require("crypto");
+
+// src/services/harness/openCodeOrdewell.ts
+function ordewellToolPrefix(mcp) {
+  return `${mcp.name}_`;
+}
+function isOrdewellTool(mcp, permission) {
+  return !!mcp && !!permission && permission.startsWith(ordewellToolPrefix(mcp));
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function deepMerge(base, over) {
+  const merged = { ...base };
+  for (const [key, value] of Object.entries(over)) {
+    const current = merged[key];
+    merged[key] = isRecord2(current) && isRecord2(value) ? deepMerge(current, value) : value;
+  }
+  return merged;
+}
+function mergeOrdewellConfig(existing, mcp) {
+  let base = {};
+  if (existing?.trim()) {
+    let parsed;
+    try {
+      parsed = JSON.parse(existing);
+    } catch {
+      return null;
+    }
+    if (!isRecord2(parsed)) return null;
+    base = parsed;
+  }
+  const policy = typeof base.permission === "string" ? { "*": base.permission } : base.permission;
+  const ours = {
+    mcp: { [mcp.name]: { type: "remote", url: mcp.url, headers: mcp.headers, enabled: true } },
+    permission: { [`${ordewellToolPrefix(mcp)}*`]: "allow" }
+  };
+  return JSON.stringify(deepMerge({ ...base, ...policy === void 0 ? {} : { permission: policy } }, ours));
+}
 
 // src/services/harness/OpenCodeV2.ts
 var STREAM_CONNECT_TIMEOUT_MS = 5e3;
@@ -15883,12 +16819,16 @@ var OpenCodeV2 = class {
     const created = await this.host.json("POST", "/api/session", {
       agent: this.agent,
       ...this.model ? { model: this.model } : {},
-      permissions: this.role === "planner" ? PLANNER_RULES : TASK_RULES
+      permissions: [...this.role === "planner" ? PLANNER_RULES : TASK_RULES, ...this.ordewellRules()]
     });
     if (!created?.data?.id) throw new Error(`The OpenCode ${this.role} server did not return a session id.`);
     this.sessionId = created.data.id;
     await this.applyInstructions();
   }
+  /** Allow the Ordewell server's tools, so a call never waits on a person (ADR-0022, S3). */
+  ordewellRules() {
+    return this.opts.mcp ? [{ action: `${ordewellToolPrefix(this.opts.mcp)}*`, resource: "*", effect: "allow" }] : [];
+  }
   /** The planner's system prompt rides on the session as an instruction entry — a prompt has no system field. */
   async applyInstructions() {
     if (this.opts.kind !== "planner" || !this.opts.systemPrompt) return;
@@ -16026,8 +16966,8 @@ var OpenCodeV2 = class {
     });
     return true;
   }
-  async replyPermission(id, sessionId, reply) {
-    await this.host.request("POST", `/api/session/${sessionId}/permission/${id}/reply`, reply);
+  async replyPermission(id, sessionId, reply2) {
+    await this.host.request("POST", `/api/session/${sessionId}/permission/${id}/reply`, reply2);
   }
   async openStream(state, turn, onEvent, onActivity) {
     const streamAbort = new AbortController();
@@ -16267,6 +17207,11 @@ var OpenCodeV2 = class {
     const request = this.permissionRequest(ask);
     if (!request || state.seen.has(`perm:${request.id}`)) return;
     state.seen.add(`perm:${request.id}`);
+    if (isOrdewellTool(this.opts.mcp, request.name)) {
+      void this.replyPermission(request.id, session, { decision: "once" }).catch(() => {
+      });
+      return;
+    }
     onEvent(request);
     void this.replyPermission(request.id, session, { decision: "reject" }).catch(() => {
     });
@@ -16282,7 +17227,7 @@ var OpenCodeV2 = class {
     const request = this.permissionRequest(ask);
     if (!request || state.seen.has(`perm:${request.id}`)) return;
     state.seen.add(`perm:${request.id}`);
-    if (this.opts.kind === "task" && this.opts.flags.modeSettings.approvals === AUTO_APPROVALS) {
+    if (isOrdewellTool(this.opts.mcp, request.name) || this.opts.kind === "task" && this.opts.flags.modeSettings.approvals === AUTO_APPROVALS) {
       onEvent({ ...request, decided: { decision: "allow" } });
       void this.replyPermission(request.id, session, { decision: "once" }).catch(() => {
       });
@@ -16301,6 +17246,8 @@ var RECOVERY_POLL_INTERVAL_MS = 2e3;
 var RECOVERY_TIMEOUT_MS = 9e5;
 var STATUS_POLL_INTERVAL_MS = 1e3;
 var SERVER_USERNAME = "opencode";
+var MCP_ATTACH_TIMEOUT_MS3 = 1e4;
+var MCP_STATUS_POLL_MS2 = 200;
 var DISABLED_TOOLS = {
   question: false,
   edit: false,
@@ -16317,20 +17264,20 @@ function splitModelId2(id) {
 }
 function describeError(err) {
   const visited = /* @__PURE__ */ new Set();
-  const lines = [];
+  const lines2 = [];
   let current = err;
   while (current && !visited.has(current)) {
     visited.add(current);
     if (!(current instanceof Error)) {
-      lines.push(String(current));
+      lines2.push(String(current));
       break;
     }
     const code = current.code;
     const suffix = typeof code === "string" && !current.message.includes(code) ? ` (${code})` : "";
-    lines.push(`${current.message}${suffix}`);
+    lines2.push(`${current.message}${suffix}`);
     current = current.cause;
   }
-  return lines.join(": ");
+  return lines2.join(": ");
 }
 function permissionName(ask) {
   return ask.permission ?? ask.action ?? "permission";
@@ -16366,6 +17313,12 @@ function unwrapFileToolOutput(output) {
   const inner = output.match(/<content>\n?([\s\S]*?)\n?<\/content>/);
   return inner ? inner[1] : output;
 }
+function editDiff2(tool2, state) {
+  const { diff, exists } = state?.metadata ?? {};
+  if (typeof diff === "string" && diff) return hunksOf(diff);
+  const content = state?.input?.content;
+  return tool2 === "write" && exists === false && typeof content === "string" ? markedLines(content, "+") : "";
+}
 function delay2(ms, signal) {
   return new Promise((resolve7) => {
     const timer = setTimeout(resolve7, ms);
@@ -16418,6 +17371,8 @@ var OpenCodeAdapter = class {
   openPermissions = /* @__PURE__ */ new Map();
   /** Set once the server turns out to speak the 2.x API, which then owns the session. */
   v2 = null;
+  /** The Ordewell server this process was configured with; null when none was given or its config could not be merged. */
+  ordewell = null;
   async start(opts) {
     if (opts.kind === "task") this.task = opts;
     else this.planner = opts;
@@ -16432,9 +17387,19 @@ var OpenCodeAdapter = class {
       throw new ExecutableNotFoundError("opencode", PATH);
     }
     const workspaceEnv = await (this.deps.workspaceEnv ?? workspaceEnvOf)(opts.cwd);
-    const password = (0, import_crypto2.randomBytes)(24).toString("base64url");
+    const password = (0, import_crypto5.randomBytes)(24).toString("base64url");
+    const ordewellConfig = opts.mcp ? mergeOrdewellConfig(workspaceEnv.OPENCODE_CONFIG_CONTENT ?? process.env.OPENCODE_CONFIG_CONTENT, opts.mcp) : null;
+    if (opts.mcp && ordewellConfig === null) {
+      console.error("[opencode] OPENCODE_CONFIG_CONTENT is not a JSON object, so the Ordewell tools were not injected.");
+    }
+    this.ordewell = ordewellConfig === null ? null : opts.mcp ?? null;
     this.process = this.deps.spawn(launch.file, launch.args, {
-      env: runnerEnv(PATH, { ...workspaceEnv, OPENCODE_SERVER_USERNAME: SERVER_USERNAME, OPENCODE_SERVER_PASSWORD: password }),
+      env: runnerEnv(PATH, {
+        ...workspaceEnv,
+        ...ordewellConfig === null ? {} : { OPENCODE_CONFIG_CONTENT: ordewellConfig },
+        OPENCODE_SERVER_USERNAME: SERVER_USERNAME,
+        OPENCODE_SERVER_PASSWORD: password
+      }),
       stdio: ["pipe", "pipe", "pipe"],
       cwd: opts.cwd,
       windowsVerbatimArguments: launch.verbatim
@@ -16484,7 +17449,7 @@ ${this.stderrTail.trim()}` : ""}`);
         processEnded: this.processEnded,
         isExited: () => this.exited,
         exitMessage: () => this.exitMessage()
-      }, opts, this.role());
+      }, { ...opts, mcp: this.ordewell ?? void 0 }, this.role());
       try {
         await this.v2.start();
       } catch (err) {
@@ -16537,12 +17502,12 @@ ${this.stderrTail.trim()}` : ""}`);
         ...this.planner?.effort ? { variant: this.planner.effort } : {},
         ...this.planner?.systemPrompt ? { system: this.planner.systemPrompt } : {}
       };
-      const reply = await this.json("POST", `/session/${this.sessionId}/message`, body, signal);
+      const reply2 = await this.json("POST", `/session/${this.sessionId}/message`, body, signal);
       if (signal?.aborted) {
         this.dispose();
         return;
       }
-      this.settle(reply, turn, onEvent);
+      this.settle(reply2, turn, onEvent);
     } catch (err) {
       if (signal?.aborted) {
         this.dispose();
@@ -16648,13 +17613,13 @@ ${this.stderrTail.trim()}` : ""}`);
         break;
       }
     }
-    for (const reply of messages.slice(start)) {
-      const id = reply.info?.id;
-      if (reply.info?.role !== "assistant" || !id) continue;
-      for (const part of reply.parts ?? []) {
+    for (const reply2 of messages.slice(start)) {
+      const id = reply2.info?.id;
+      if (reply2.info?.role !== "assistant" || !id) continue;
+      for (const part of reply2.parts ?? []) {
         if (part.messageID === id) this.emitPart(part, turn, onEvent);
       }
-      this.countUsage(reply.info, turn, onEvent);
+      this.countUsage(reply2.info, turn, onEvent);
     }
   }
   /**
@@ -16764,18 +17729,18 @@ ${this.stderrTail.trim()}` : ""}`);
    * their text, reasoning and usage — reach Ordewell over the stream or not at
    * all.
    */
-  settle(reply, turn, onEvent) {
-    const failure = typeof reply?.error === "string" ? reply.error : reply?.error?.message ?? reply?.info?.error?.data?.message;
+  settle(reply2, turn, onEvent) {
+    const failure = typeof reply2?.error === "string" ? reply2.error : reply2?.error?.message ?? reply2?.info?.error?.data?.message;
     if (failure) {
       onEvent({ type: "error", message: failure });
       return;
     }
-    const assistantId = reply?.info?.id;
-    for (const part of reply?.parts ?? []) {
+    const assistantId = reply2?.info?.id;
+    for (const part of reply2?.parts ?? []) {
       if (part.type !== "tool" && assistantId && part.messageID !== assistantId) continue;
       this.emitPart(part, turn, onEvent);
     }
-    if (reply?.info) this.countUsage(reply.info, turn, onEvent);
+    if (reply2?.info) this.countUsage(reply2.info, turn, onEvent);
     if (assistantId) this.lastAssistantId = assistantId;
     onEvent({ type: "turn_end" });
   }
@@ -16852,7 +17817,7 @@ ${this.stderrTail.trim()}` : ""}`);
         type: "tool_result",
         id: callId,
         name,
-        output: unwrapFileToolOutput(part.state?.output ?? part.state?.error ?? ""),
+        output: status === "completed" && editDiff2(name, part.state) || unwrapFileToolOutput(part.state?.output ?? part.state?.error ?? ""),
         success: status === "completed",
         subagentId
       });
@@ -16986,6 +17951,11 @@ ${this.stderrTail.trim()}` : ""}`);
     const id = ask.id;
     if (!id || seen.has(`perm:${id}`)) return;
     seen.add(`perm:${id}`);
+    if (isOrdewellTool(this.ordewell, permissionName(ask))) {
+      void this.replyPermission(id, ask.sessionID ?? this.sessionId ?? "", { reply: "once" }).catch(() => {
+      });
+      return;
+    }
     onEvent({ type: "permission_request", id, name: permissionName(ask), detail: permissionDetail(ask) });
     void this.replyPermission(id, ask.sessionID ?? this.sessionId ?? "", { reply: "reject" }).catch(() => {
     });
@@ -17012,7 +17982,7 @@ ${this.stderrTail.trim()}` : ""}`);
       ...ask.always?.length ? { suggestions: ask.always } : {},
       ...ask.tool?.callID ? { toolUseId: ask.tool.callID } : {}
     };
-    if (this.task?.flags.modeSettings.approvals === AUTO_APPROVALS2) {
+    if (isOrdewellTool(this.ordewell, request.name) || this.task?.flags.modeSettings.approvals === AUTO_APPROVALS2) {
       onEvent({ ...request, decided: { decision: "allow" } });
       void this.replyPermission(id, sessionId, { reply: "once" }).catch(() => {
       });
@@ -17025,10 +17995,10 @@ ${this.stderrTail.trim()}` : ""}`);
    * `POST /permission/:id/reply` is the current answer. The per-session path
    * it replaced is tried only when a server too old to know the new one 404s.
    */
-  async replyPermission(id, sessionId, reply) {
-    const response = await this.request("POST", `/permission/${id}/reply`, reply);
+  async replyPermission(id, sessionId, reply2) {
+    const response = await this.request("POST", `/permission/${id}/reply`, reply2);
     if (response.status !== 404) return;
-    await this.request("POST", `/session/${sessionId}/permissions/${id}`, { response: reply.reply });
+    await this.request("POST", `/session/${sessionId}/permissions/${id}`, { response: reply2.reply });
   }
   /**
    * Open `/event` for one turn and wait until it is connected. The stream
@@ -17107,6 +18077,19 @@ ${this.stderrTail.trim()}` : ""}`);
   nativeSessionId() {
     return this.sessionId;
   }
+  /** Asks the server, which lists every MCP server it has with the state of its connection. */
+  async mcpAttached() {
+    if (!this.ordewell || !this.baseUrl) return false;
+    const deadline = Date.now() + MCP_ATTACH_TIMEOUT_MS3;
+    while (Date.now() < deadline && !this.exited) {
+      const servers = await this.json("GET", "/mcp").catch(() => null);
+      const status = servers?.[this.ordewell.name]?.status;
+      if (status === "connected") return true;
+      if (status !== void 0 && status !== "pending") return false;
+      await delay2(MCP_STATUS_POLL_MS2);
+    }
+    return false;
+  }
   dispose() {
     if (this.disposed) return;
     this.disposed = true;
@@ -17129,9 +18112,13 @@ var TASK_MODE_ADAPTERS = {
   codex: (deps) => new CodexAdapter(deps),
   opencode: (deps) => new OpenCodeAdapter(deps)
 };
+var ORDEWELL_TOOL_RUNNERS = /* @__PURE__ */ new Set(["claude-code", "codex", "opencode"]);
 function supportsTaskMode(runner) {
   return Object.hasOwn(TASK_MODE_ADAPTERS, runner);
 }
+function takesOrdewellTools(runner) {
+  return ORDEWELL_TOOL_RUNNERS.has(runner);
+}
 function createTaskAdapter(runner, deps) {
   if (!supportsTaskMode(runner)) throw new TaskModeUnsupportedError(runner);
   return TASK_MODE_ADAPTERS[runner](deps);
@@ -17144,6 +18131,9 @@ function routeTransport(requested, runner, registry) {
   const name = registry?.get(runner)?.manifest.displayName ?? runner;
   return { transport: "terminal", fallback: `no structured connector for ${name} yet` };
 }
+function givesCompletionTool(requested, runner, registry) {
+  return routeTransport(requested, runner, registry).transport === "structured" && takesOrdewellTools(runner);
+}
 var TransportRouter = class {
   constructor(runners) {
     this.runners = runners;
@@ -17282,6 +18272,11 @@ var TaskOrchestrator = class _TaskOrchestrator {
       this.emit("onTaskSettled", { taskId });
       this.emit("onCheckpoint", { taskId, taskTitle: task.title, summary });
     });
+    this.verifier.onCheckpointWithdrawn((taskId) => {
+      if (!this.atCheckpoint(taskId)) return;
+      this.store.markInProgress(taskId);
+      this.emit("onTaskChanged");
+    });
     this.verifier.onIdleChange(() => this.emit("onTaskChanged"));
   }
   /**
@@ -17368,7 +18363,7 @@ var TaskOrchestrator = class _TaskOrchestrator {
       this.notifications.warn(message);
     };
     if (resolved.blockedEnvrc) {
-      warn(`blocked:${resolved.blockedEnvrc}`, `direnv has blocked ${resolved.blockedEnvrc}, so tasks start without its variables. Run \`direnv allow\` in ${path14.dirname(resolved.blockedEnvrc)} to use them.`);
+      warn(`blocked:${resolved.blockedEnvrc}`, `direnv has blocked ${resolved.blockedEnvrc}, so tasks start without its variables. Run \`direnv allow\` in ${path15.dirname(resolved.blockedEnvrc)} to use them.`);
     }
     if (resolved.trackedEnvFile) {
       warn(`tracked:${resolved.trackedEnvFile}`, `Ignored ${resolved.trackedEnvFile}: git tracks it, and a committed file must not choose the environment agents run in. Untrack it to use it.`);
@@ -18199,17 +19194,19 @@ ${summary || "(empty \u2014 no output captured)"}`);
         this.abandonSpawn(task, attempt);
         return false;
       }
-      const finalPrompt = attempt.continuation ? composeContinuationPrompt(task, attempt.continuation.message, { ops: attempt.ops }) : composeAugmentedPrompt(attempt.repair ? { ...task, prompt: this.landing.repairPrompt(task) } : task, this.store.planTasks, {
+      const transport = attempt.continuation ? "structured" : this.planTransport ?? "terminal";
+      const completionTool = givesCompletionTool(transport, attempt.runner, this.registry);
+      const finalPrompt = attempt.continuation ? composeContinuationPrompt(task, attempt.continuation.message, { ops: attempt.ops, completionTool }) : composeAugmentedPrompt(attempt.repair ? { ...task, prompt: this.landing.repairPrompt(task) } : task, this.store.planTasks, {
         planMapEnabled: this.config.planMapEnabled,
         // A merge to resolve is not new behaviour to drive test-first.
         tddEnabled: !attempt.repair && this.tddEnabled(),
         // An ops task's effects outlive a failed attempt and are never rolled
         // back, so the next one is told what the last one did (ADR-0020).
-        previousAttempt: attempt.ops ? this.opsPreviousAttempt(task.id) : void 0
+        previousAttempt: attempt.ops ? this.opsPreviousAttempt(task.id) : void 0,
+        completionTool
       });
       this.lingering.close(task.id);
       const env = await this.envForTask(cwd);
-      const transport = attempt.continuation ? "structured" : this.planTransport ?? "terminal";
       const session = await this.terminalRunner.spawn({
         taskId: task.id,
         runner: attempt.runner,
@@ -18224,7 +19221,8 @@ ${summary || "(empty \u2014 no output captured)"}`);
         title: task.title,
         env,
         transport,
-        resumeSessionId: attempt.continuation?.resumeSessionId
+        resumeSessionId: attempt.continuation?.resumeSessionId,
+        attempt: attempt.attempt
       });
       if (this.attempts.get(task.id) !== attempt) {
         this.abandonSpawn(task, attempt, session);
@@ -18512,62 +19510,16 @@ var Planner = class {
 ${errors.map((e) => `- ${e}`).join("\n")}`
         );
       }
-    });
-  }
-};
-
-// src/services/ModelDiscovery.ts
-var path16 = __toESM(require("path"));
-var import_child_process5 = require("child_process");
-var import_util3 = require("util");
-var fsSync3 = __toESM(require("fs"));
-var osMod = __toESM(require("os"));
-
-// src/utils/globalDataDir.ts
-var fs7 = __toESM(require("fs"));
-var path15 = __toESM(require("path"));
-var os5 = __toESM(require("os"));
-function globalDataDir() {
-  return path15.join(os5.homedir(), ".ordewell");
-}
-function copyDirSync(src, dest) {
-  fs7.mkdirSync(dest, { recursive: true });
-  const entries = fs7.readdirSync(src, { withFileTypes: true });
-  for (const entry of entries) {
-    const srcPath = path15.join(src, entry.name);
-    const destPath = path15.join(dest, entry.name);
-    if (entry.isDirectory()) {
-      copyDirSync(srcPath, destPath);
-    } else {
-      fs7.copyFileSync(srcPath, destPath);
-    }
-  }
-}
-var migrated = false;
-function migrateOldConfigDir() {
-  if (migrated) return;
-  migrated = true;
-  const oldDir = path15.join(os5.homedir(), ".config", "ordewell");
-  if (!fs7.existsSync(oldDir)) return;
-  const newDir = globalDataDir();
-  const liftFile = (name) => {
-    const oldFile = path15.join(oldDir, name);
-    const newFile = path15.join(newDir, name);
-    if (fs7.existsSync(oldFile) && !fs7.existsSync(newFile)) {
-      fs7.mkdirSync(newDir, { recursive: true });
-      fs7.copyFileSync(oldFile, newFile);
-    }
-  };
-  liftFile("settings.json");
-  liftFile(".env");
-  const oldPlugins = path15.join(oldDir, "plugins");
-  const newPlugins = path15.join(newDir, "plugins");
-  if (fs7.existsSync(oldPlugins) && !fs7.existsSync(newPlugins)) {
-    copyDirSync(oldPlugins, newPlugins);
+    });
   }
-}
+};
 
 // src/services/ModelDiscovery.ts
+var path16 = __toESM(require("path"));
+var import_child_process5 = require("child_process");
+var import_util3 = require("util");
+var fsSync3 = __toESM(require("fs"));
+var osMod = __toESM(require("os"));
 var execAsync3 = (0, import_util3.promisify)(import_child_process5.exec);
 var defaultExec2 = async (command, options) => {
   const PATH = await augmentedPath();
@@ -18943,8 +19895,8 @@ function parseClaudeHelp(stdout) {
   return models;
 }
 function parseOpencodeModels(stdout, manifest) {
-  const lines = stdout.split("\n").map((l) => l.trim()).filter((l) => /^[A-Za-z0-9._-]+\/[^\s"{}]+$/.test(l));
-  if (lines.length === 0) return [];
+  const lines2 = stdout.split("\n").map((l) => l.trim()).filter((l) => /^[A-Za-z0-9._-]+\/[^\s"{}]+$/.test(l));
+  if (lines2.length === 0) return [];
   const preferred = manifest.modelDiscovery.preferredPatterns;
   const prefLabels = /* @__PURE__ */ new Map();
   if (preferred) {
@@ -18954,14 +19906,14 @@ function parseOpencodeModels(stdout, manifest) {
   }
   const seen = /* @__PURE__ */ new Set();
   const models = [];
-  for (const id of lines) {
+  for (const id of lines2) {
     if (prefLabels.has(id) && !seen.has(id)) {
       seen.add(id);
       const provider = id.split("/")[0];
       models.push({ modelId: id, modelLabel: prefLabels.get(id), runnerProvider: provider, variants: [] });
     }
   }
-  for (const id of lines) {
+  for (const id of lines2) {
     if (!seen.has(id)) {
       seen.add(id);
       const provider = id.split("/")[0];
@@ -19774,6 +20726,7 @@ var CliAgentAiService = class {
     };
     this.makeAdapter = deps.createAdapter ?? defaultAdapter;
     this.workspaceRoot = deps.workspaceRoot ?? (() => process.cwd());
+    this.mcpServer = deps.mcpServer;
   }
   config;
   runner;
@@ -19788,6 +20741,11 @@ var CliAgentAiService = class {
    */
   lastNativeSessionId = null;
   conversation = null;
+  mcpServer;
+  /** The planner token the running process was spawned with; revoked with the process (ADR-0022, A3). */
+  plannerToken = null;
+  /** Whether the running planner was spawned with its tools and the CLI reported them connected. */
+  toolsAttached = false;
   activeAbort = null;
   /**
    * Every subagent this conversation has reported starting, and finishing.
@@ -19810,6 +20768,10 @@ var CliAgentAiService = class {
     if (!this.conversation) return true;
     return this.conversation.startOptions.model === this.plannerModel() && this.conversation.startOptions.effort === this.config.plannerThinkingEffort;
   }
+  /** Whether this conversation's planner submits through the Ordewell MCP server rather than the envelopes. */
+  plannerToolsAttached() {
+    return this.toolsAttached;
+  }
   /** The agent's own session id, a resumption hint only — Ordewell's transcript is authoritative (T4). */
   nativeSessionId() {
     return this.adapter?.nativeSessionId() ?? null;
@@ -19817,8 +20779,8 @@ var CliAgentAiService = class {
   reset() {
     this.activeAbort?.abort();
     this.activeAbort = null;
-    this.adapter?.dispose();
-    this.adapter = null;
+    this.disposeAdapter();
+    this.toolsAttached = false;
     this.lastNativeSessionId = null;
     this.conversation = null;
     this.subagents.started.clear();
@@ -19845,9 +20807,23 @@ var CliAgentAiService = class {
       model: this.plannerModel(),
       effort: this.config.plannerThinkingEffort
     };
-    await this.startAdapter(startOptions);
+    const tools = req.plannerTools && this.mcpServer ? {
+      offer: req.plannerTools,
+      systemPrompt: buildConversationSystemPrompt(
+        req.goal,
+        contextStr,
+        req.modelsByRunner,
+        req.runners,
+        req.runnerModes,
+        req.autonomousDefault ?? true,
+        req.verificationEnabled ?? false,
+        { harness: true, isolatedExecution: req.isolatedExecution, plannerTools: true }
+      )
+    } : void 0;
+    await this.startAdapter(startOptions, tools);
     this.conversation = {
       startOptions,
+      tools,
       runners: req.runners,
       runnerModes: req.runnerModes,
       autonomousDefault: req.autonomousDefault
@@ -20052,10 +21028,7 @@ var CliAgentAiService = class {
       settle(id, "The agent ended the turn without reporting this call's result.", false, "not_executed");
     }
     this.lastNativeSessionId = adapter.nativeSessionId() ?? this.lastNativeSessionId;
-    if (error || signal?.aborted) {
-      adapter.dispose();
-      this.adapter = null;
-    }
+    if (error || signal?.aborted) this.disposeAdapter();
     return { text: text2, researchLog, error, aborted: signal?.aborted, backgroundAgents };
   }
   // --- Process lifecycle ---
@@ -20064,13 +21037,50 @@ var CliAgentAiService = class {
    * type: the read-only boundary (ADR-0008/0009) cannot be crossed into task
    * mode from here without changing this signature.
    */
-  async startAdapter(opts) {
+  async startAdapter(opts, tools) {
     const adapter = this.makeAdapter(this.runner, this.processDeps);
     if (!adapter) throw new Error(`No planner adapter is available for "${this.runner}".`);
+    this.toolsAttached = false;
+    if (tools && this.mcpServer && adapter.mcpAttached) {
+      if (await this.startWithTools(adapter, opts, tools, this.mcpServer)) return adapter;
+      return this.startAdapter(opts);
+    }
     await adapter.start(opts);
     this.adapter = adapter;
     return adapter;
   }
+  /** Spawn with the Ordewell server injected. False, with nothing left running, when it did not connect. */
+  async startWithTools(adapter, opts, tools, server) {
+    let credential;
+    try {
+      credential = await server.issuePlannerToken({ sessionId: tools.offer.sessionId }, tools.offer.handler);
+    } catch {
+      return false;
+    }
+    try {
+      await adapter.start({ ...opts, systemPrompt: tools.systemPrompt, mcp: mcpClientConfig(credential) });
+      if (await adapter.mcpAttached()) {
+        this.adapter = adapter;
+        this.plannerToken = credential.token;
+        this.toolsAttached = true;
+        return true;
+      }
+    } catch (err) {
+      adapter.dispose();
+      server.revoke(credential.token);
+      throw err;
+    }
+    adapter.dispose();
+    server.revoke(credential.token);
+    return false;
+  }
+  /** Kill the planner process, and with it the token it was spawned with. */
+  disposeAdapter() {
+    this.adapter?.dispose();
+    this.adapter = null;
+    if (this.plannerToken) this.mcpServer?.revoke(this.plannerToken);
+    this.plannerToken = null;
+  }
   /**
    * The live agent process, restarted from its own session id if it died
    * between turns. Resume is a hint: when it fails, the caller's next
@@ -20081,7 +21091,7 @@ var CliAgentAiService = class {
     if (this.adapter) return this.adapter;
     const conversation = this.conversation;
     if (!conversation) throw new Error("No active planner conversation.");
-    await this.startAdapter({ ...conversation.startOptions, resumeSessionId: this.lastNativeSessionId ?? void 0 });
+    await this.startAdapter({ ...conversation.startOptions, resumeSessionId: this.lastNativeSessionId ?? void 0 }, conversation.tools);
     return this.adapter;
   }
   plannerModel() {
@@ -20100,7 +21110,9 @@ var CliAgentAiService = class {
     const previous = this.adapter;
     const previousConversation = this.conversation;
     const previousSessionId = this.lastNativeSessionId;
+    const previousTools = { token: this.plannerToken, attached: this.toolsAttached };
     this.adapter = null;
+    this.plannerToken = null;
     const startOptions = {
       kind: "planner",
       cwd: this.workspaceRoot(),
@@ -20130,6 +21142,8 @@ var CliAgentAiService = class {
     } finally {
       oneShotAdapter?.dispose();
       this.adapter = previous;
+      this.plannerToken = previousTools.token;
+      this.toolsAttached = previousTools.attached;
       this.conversation = previousConversation;
       this.lastNativeSessionId = previousSessionId;
     }
@@ -20225,6 +21239,173 @@ function createAiService(config, deps) {
   return new OpenAiService(config);
 }
 
+// src/services/plannerTools.ts
+function runnersOf(tasks) {
+  return [...new Set(flattenTasks(tasks).filter((t) => t.type !== "user").map((t) => t.assignedRunner))];
+}
+function plannerToolHandler(host) {
+  return {
+    async listRunners() {
+      const catalog = await host.liveCatalog();
+      return answer({
+        autonomy: autonomyLevelLabel(catalog.autonomousDefault),
+        runners: catalog.runners.map((id) => {
+          const modes = catalog.modes[id] ?? [];
+          const offered = [...filteredBuildModes(modes, catalog.autonomousDefault), ...modes.filter((m) => m.id === "plan")];
+          return {
+            id,
+            defaultMode: resolveDefaultMode(modes, catalog.autonomousDefault) ?? null,
+            modes: offered.map(({ id: modeId2, label, description }) => ({ id: modeId2, label, description }))
+          };
+        })
+      });
+    },
+    async listModels({ runner }) {
+      const catalog = await host.liveCatalog();
+      if (!catalog.runners.includes(runner)) return notEnabled(runner, catalog.runners);
+      return answer({
+        runner,
+        models: (catalog.models[runner] ?? []).map((m) => ({
+          modelId: m.modelId,
+          modelLabel: m.modelLabel,
+          variants: (m.variants ?? []).map((v) => ({ id: v.id, label: v.label }))
+        }))
+      });
+    },
+    async submitPlan({ tasks }) {
+      const catalog = await host.liveCatalog();
+      const result = validatePlanTasks({ tasks }, catalog.runners, catalog.modes, catalog.autonomousDefault);
+      if (!result.ok) return { isError: true, text: JSON.stringify({ ok: false, errors: result.errors, enabledRunners: catalog.runners }) };
+      const runners = runnersOf(result.tasks);
+      const coerced = coercions(result.tasks, host.coerce(result.tasks, runners));
+      if (!host.submitPlan(result.tasks, runners)) {
+        return { isError: true, text: JSON.stringify({ ok: false, errors: [{ field: "tasks", message: "No planning turn is open to take the plan." }] }) };
+      }
+      return answer({
+        ok: true,
+        tasks: result.tasks.length,
+        coerced,
+        next: "The plan is committed when this reply ends. Tell the user briefly what you submitted; do not repeat the plan as JSON."
+      });
+    },
+    async taskQuery({ tasks, fields, catalog }) {
+      const query = { tasks: (tasks ?? []).map(String), fields: fields ?? [...TASK_QUERY_TASK_FIELDS], catalog: catalog === true };
+      return read(host, taskQuerySignature(query), async () => ({
+        tasks: query.tasks.map((ref) => taskDetail(host.tasks(), ref, query.fields ?? [])),
+        ...query.catalog ? { catalog: catalogDetail(await host.liveCatalog()) } : {}
+      }));
+    },
+    async taskOutput({ task: ref, lines: lines2, since }) {
+      const task = findTask(host.tasks(), String(ref));
+      if (!task) return { isError: true, text: JSON.stringify({ ok: false, error: `No task matches "${ref}" in the current plan.` }) };
+      const maxLines = Math.min(lines2 ?? OUTPUT_LINES_DEFAULT, OUTPUT_LINES_MAX);
+      return read(host, JSON.stringify(["output", task.id, maxLines, since ?? null]), async () => {
+        const head = { task: { id: task.id, order: task.order, title: task.title, status: task.status } };
+        const tail = host.liveOutput(task.id, { maxLines, sinceOffset: since });
+        if (tail?.running) {
+          const fitted = fitTail(tail.text, OUTPUT_TAIL_MAX_CHARS);
+          return { ...head, running: true, output: fitted.text, nextOffset: tail.nextOffset, ...fitted.trimmed ? { trimmedToFit: true } : {} };
+        }
+        return {
+          ...head,
+          running: false,
+          reason: "This task is not running, so there is no live output: its outcome is below.",
+          verdict: verdictDetail(task.verdict),
+          outputSummary: outputSummaryDetail(task),
+          lastAttempt: host.lastAttempt(task.id)
+        };
+      });
+    },
+    async editPlan({ ops }) {
+      const outcome = await host.editPlan(ops);
+      if (!outcome.ok) return { isError: true, text: JSON.stringify({ ok: false, errors: outcome.errors.map(opError) }) };
+      return answer({
+        ok: true,
+        summary: outcome.summary,
+        queued: outcome.queued,
+        next: outcome.queued ? "A task you named is running, so the edit is parked and nothing was checked: it is applied between task batches, when the user's message comes back to you. Tell the user it is queued." : "The edit is applied when this reply ends, and the user is shown what changed. Tell them briefly; do not repeat it as JSON."
+      });
+    }
+  };
+}
+function opError(message) {
+  const match = /^op (\d+) \((\w+)\): ([\s\S]*)$/.exec(message);
+  return match ? { op: Number(match[1]), kind: match[2], message: match[3] } : { message };
+}
+async function read(host, signature, answerRead) {
+  const result = await host.read(signature, answerRead);
+  if (result.status === "refused") {
+    return { isError: true, text: JSON.stringify({ ok: false, error: "You have used every read this message allows. Nothing was read: answer the user in prose, or call edit_plan for the change you came to make." }) };
+  }
+  return answer({ ...result.value, ...result.landNow ? { note: TASK_READ_ANSWER_OR_EDIT } : {} });
+}
+function verdictDetail(verdict) {
+  if (!verdict) return null;
+  return {
+    outcome: verdict.outcome,
+    reason: verdict.reason,
+    checks: verdict.checks.map((c) => ({ name: c.name, result: c.skipped ? "skipped" : c.passed ? "pass" : "fail" }))
+  };
+}
+function outputSummaryDetail({ outputSummary }) {
+  return outputSummary ? { reviewReason: outputSummary.reviewReason, ...outputSummary.logTail ? { logTail: outputSummary.logTail } : {} } : null;
+}
+function taskDetail(plan, ref, fields) {
+  const task = findTask(plan, ref);
+  if (!task) return { ref, error: "no task matches this reference in the current plan." };
+  const wants = (field) => fields.includes(field);
+  return {
+    id: task.id,
+    order: task.order,
+    title: task.title,
+    status: task.status,
+    type: task.type === "user" ? "user" : "ai",
+    ...wants("description") ? { description: task.description || null } : {},
+    ...wants("prompt") ? { prompt: task.prompt || null } : {},
+    ...wants("userSteps") ? { userSteps: task.userSteps?.length ? task.userSteps.map((s) => ({ order: s.order, instruction: s.instruction, completed: s.completed === true })) : null } : {},
+    ...wants("verdict") ? { verdict: verdictDetail(task.verdict) } : {},
+    ...wants("outputSummary") ? { outputSummary: outputSummaryDetail(task) } : {},
+    ...wants("userStoriesCovered") ? { userStoriesCovered: task.userStoriesCovered?.length ? task.userStoriesCovered : null } : {}
+  };
+}
+function catalogDetail(catalog) {
+  return {
+    runners: catalog.runners.map((id) => {
+      const modes = catalog.modes[id] ?? [];
+      const defaultMode = resolveDefaultMode(modes, catalog.autonomousDefault);
+      return {
+        id,
+        models: (catalog.models[id] ?? []).map((m) => ({
+          modelId: m.modelId,
+          modelLabel: m.modelLabel,
+          variants: (m.variants ?? []).map((v) => ({ id: v.id, label: v.label }))
+        })),
+        modes: modes.map((m) => ({ id: m.id, label: m.label, description: m.description, default: m.id === defaultMode }))
+      };
+    })
+  };
+}
+function answer(body) {
+  return { text: JSON.stringify(body) };
+}
+function notEnabled(runner, enabled) {
+  return { isError: true, text: `Runner "${runner}" is not enabled. Enabled runners: ${enabled.join(", ") || "(none)"}.` };
+}
+function coercions(submitted, landed) {
+  return submitted.flatMap((task, i) => {
+    const after = landed[i];
+    const out = [];
+    if (after.assignedRunner !== task.assignedRunner) {
+      out.push({ taskId: task.id, field: "assignedRunner", from: task.assignedRunner, to: after.assignedRunner });
+    }
+    const [fromModel, toModel] = [task.assignedModel?.modelId ?? null, after.assignedModel?.modelId ?? null];
+    if (fromModel !== toModel) out.push({ taskId: task.id, field: "assignedModel", from: fromModel, to: toModel });
+    const [fromEffort, toEffort] = [task.assignedModel?.thinkingEffort ?? null, after.assignedModel?.thinkingEffort ?? null];
+    if (fromEffort !== toEffort) out.push({ taskId: task.id, field: "thinkingEffort", from: fromEffort, to: toEffort });
+    return out;
+  });
+}
+
 // src/services/PlannerConversation.ts
 var import_uuid7 = require("uuid");
 
@@ -20241,8 +21422,8 @@ function summaryRequest(planLines) {
     ...planLines ? ["<current_plan>", ...planLines, "</current_plan>"] : []
   ].join("\n");
 }
-function extractSummary(reply) {
-  const matches = [...reply.matchAll(new RegExp(`${SUMMARY_OPEN}([\\s\\S]*?)${SUMMARY_CLOSE}`, "g"))];
+function extractSummary(reply2) {
+  const matches = [...reply2.matchAll(new RegExp(`${SUMMARY_OPEN}([\\s\\S]*?)${SUMMARY_CLOSE}`, "g"))];
   const summary = matches.at(-1)?.[1].trim();
   return summary || null;
 }
@@ -20261,6 +21442,7 @@ function keptTail(transcript) {
 
 // src/services/PlannerConversation.ts
 var CATALOG_MODEL_CAP = 100;
+var PLANNER_TOOLS_REMINDER = "Runners, models and modes may have changed since you last read them: call list_runners and list_models just before submit_plan.";
 var MAX_TASK_QUERIES = 3;
 var MAX_TASK_QUERIES_HARD = 6;
 function freshReadBudget() {
@@ -20290,7 +21472,7 @@ var PlannerConversation = class {
   savedInBackground = 0;
   turnsInFlight = 0;
   compacting = false;
-  openTurnId = null;
+  openTurn = null;
   get transcript() {
     return this.host.plan()?.conversationHistory ?? [];
   }
@@ -20300,7 +21482,48 @@ var PlannerConversation = class {
   }
   /** The user turn being answered, for what the host raises during it — an approval the turn's research asks for. */
   get currentTurnId() {
-    return this.openTurnId ?? void 0;
+    return this.openTurn?.stream.turnId;
+  }
+  /**
+   * Hand the open turn a plan (already validated) or a task edit. The turn
+   * settles with it exactly as with the same plan or ops parsed out of its
+   * reply, and it wins over any envelope that reply carries. A later
+   * submission replaces an earlier one. False when no user turn is open.
+   */
+  submit(submission) {
+    if (!this.openTurn) return false;
+    this.openTurn.submitted = submission;
+    return true;
+  }
+  /**
+   * The edit the open turn already holds, for a further edit in the same reply
+   * to join rather than replace. Empty when it holds nothing; null when it holds
+   * a whole plan, which an edit cannot be layered on.
+   */
+  pendingOps() {
+    const held = this.openTurn?.submitted;
+    if (!held) return [];
+    return held.kind === "task_ops" ? held.ops : null;
+  }
+  /** Whether the turn would park this edit until a batch boundary instead of applying it as it settles. */
+  editWouldQueue(ops) {
+    return this.editTouchesLiveWork({ kind: "task_ops", ops, text: "", researchLog: [] });
+  }
+  /**
+   * A read the planner makes through a tool. It spends the same per-turn budget
+   * as an envelope read, so a planner cannot read more by switching channels:
+   * past the soft limit, or on a repeated question, the answer still comes but
+   * is told to land the turn; at the hard limit it is refused. `signature`
+   * names the question, for the repeat check.
+   */
+  async read(signature, answer2) {
+    const reads = this.openTurn?.reads;
+    if (!reads) return { status: "answered", value: await answer2(), landNow: false };
+    if (reads.answered >= MAX_TASK_QUERIES_HARD) return { status: "refused" };
+    const landNow = reads.seen.has(signature) || reads.answered >= MAX_TASK_QUERIES;
+    reads.seen.add(signature);
+    reads.answered++;
+    return { status: "answered", value: await answer2(), landNow };
   }
   /** Whether the model still holds this conversation in memory. */
   get isActive() {
@@ -20588,15 +21811,16 @@ ${message}` : message;
   async userTurn(prompt, signal, run) {
     const turnId = (0, import_uuid7.v4)();
     const stream = new TurnStream(turnId, (p) => this.host.onProgress(p));
-    this.openTurnId = turnId;
+    const turn = { stream, signal, reads: freshReadBudget() };
+    this.openTurn = turn;
     this.host.broadcast({ type: "planner_turn_started", turnId, prompt });
     let outcome = "error";
     try {
-      const settled = await this.inTurn(() => run({ stream, signal, reads: freshReadBudget() }));
+      const settled = await this.inTurn(() => run(turn));
       outcome = settled.outcome;
       return settled.plan;
     } finally {
-      if (this.openTurnId === turnId) this.openTurnId = null;
+      if (this.openTurn === turn) this.openTurn = null;
       this.host.broadcast({ type: "planner_turn_ended", turnId, outcome: signal?.aborted ? "stopped" : outcome });
     }
   }
@@ -20647,10 +21871,11 @@ ${message}` : message;
    * ops JSON still gets its two corrective retries; charging it for the read
    * would cost it the chance to fix the edit.
    */
-  async drainTaskQueries(turn, { reads, signal, stream }) {
+  async drainTaskQueries(turn, userTurn) {
+    const { reads, signal, stream } = userTurn;
     const ai = this.host.aiService();
     const carried = [];
-    let current = turn;
+    let current = this.claimSubmission(turn, userTurn);
     while (current.kind === "task_query") {
       carried.push(...current.researchLog);
       if (reads.answered >= MAX_TASK_QUERIES_HARD || !ai.hasActiveConversation() || signal?.aborted) {
@@ -20664,17 +21889,30 @@ ${message}` : message;
       const insist = reads.seen.has(signature) || reads.answered >= MAX_TASK_QUERIES;
       reads.seen.add(signature);
       reads.answered++;
-      const answer = this.taskQueryAnswer(current.query);
-      current = await ai.continueConversation(
-        insist ? `${answer}
+      const answer2 = this.taskQueryAnswer(current.query);
+      current = this.claimSubmission(await ai.continueConversation(
+        insist ? `${answer2}
 
-${TASK_QUERY_ANSWER_OR_OPS}` : answer,
+${TASK_QUERY_ANSWER_OR_OPS}` : answer2,
         stream.sink(),
         signal
-      );
+      ), userTurn);
     }
     return carried.length > 0 ? { ...current, researchLog: [...carried, ...current.researchLog] } : current;
   }
+  /**
+   * The backend's answer, with what was handed in while it ran standing in
+   * for whatever its reply carried. Taken once: a corrective re-send after a
+   * rejected edit must not settle on the same submission again. A stopped
+   * turn commits nothing, the same as a stopped reply with a plan in it.
+   */
+  claimSubmission(turn, userTurn) {
+    const submitted = userTurn.submitted;
+    userTurn.submitted = void 0;
+    if (!submitted || userTurn.signal?.aborted) return turn;
+    const { text: text2, researchLog } = turn;
+    return submitted.kind === "plan" ? { kind: "plan", tasks: submitted.tasks, text: text2, researchLog } : { kind: "task_ops", ops: submitted.ops, text: text2, researchLog };
+  }
   /**
    * Render one read out of live state. Never persisted to the transcript: the
    * detail is context for the planner's next reply, and re-sending it on every
@@ -20718,7 +21956,7 @@ The plan is unchanged. Rephrase the request, or adjust the tasks manually.`,
         return { retry: { errors: applied.errors, corrective: taskOpsRejectedPrompt(applied.errors) } };
       },
       maxRepairs: 2,
-      onExhausted: ({ reply, errors }) => invalidOps(errors, reply.researchLog)
+      onExhausted: ({ reply: reply2, errors }) => invalidOps(errors, reply2.researchLog)
     });
     if ("plan" in settled) {
       await this.host.afterEdit();
@@ -20781,10 +22019,12 @@ The plan is unchanged. Rephrase the request, or adjust the tasks manually.`,
    *
    * The host's catalog is allowlist-filtered, so a restricted allowlist stays a
    * hard bound on every turn, and reads the plan's runners live, so a runner
-   * admitted mid-session by a retarget is shown like every other.
+   * admitted mid-session by a retarget is shown like every other. A planner
+   * with Ordewell's tools gets a reminder to read the catalog instead.
    */
   catalogBlock() {
     if (!this.host.plan()) return null;
+    if (this.host.aiService().plannerToolsAttached?.()) return PLANNER_TOOLS_REMINDER;
     const { runners, models, modes, autonomousDefault } = this.host.catalog();
     const modelLines = runners.map((runner) => {
       const list = models[runner] ?? [];
@@ -20817,19 +22057,20 @@ The plan is unchanged. Rephrase the request, or adjust the tasks manually.`,
    */
   planContextBlock() {
     const tasks = this.host.tasks();
-    const lines = this.currentPlanLines();
-    if (!lines) return null;
+    const lines2 = this.currentPlanLines();
+    if (!lines2) return null;
+    const tools = this.host.aiService().plannerToolsAttached?.() ?? false;
     const locked = tasks.filter((t) => t.status === "in_progress");
     const execNote = this.host.hasLiveWork() ? `
 Execution is RUNNING${locked.length ? ` \u2014 these tasks are locked: ${locked.map((t) => `#${t.order}`).join(", ")}` : ""}. Any task edits you emit will be queued and applied between batches.` : "";
     return [
       "<current_plan>",
-      ...lines,
+      ...lines2,
       "</current_plan>",
       "The block above is the CURRENT task plan \u2014 short fields only. Choose how to respond:",
       "- To answer a question or discuss, reply in plain prose (no JSON).",
-      TASK_QUERY_REMINDER,
-      ...taskOpsProtocol(execNote)
+      tools ? TASK_READ_TOOLS_REMINDER : TASK_QUERY_REMINDER,
+      ...taskOpsProtocol(execNote, tools)
     ].filter(Boolean).join("\n");
   }
   /** One line per task with stable references — null until the plan has tasks. */
@@ -21105,6 +22346,7 @@ function retargetTaskRunner(task, runner, catalog) {
 }
 
 // src/services/SkillsService.ts
+var import_crypto6 = require("crypto");
 var fs9 = __toESM(require("fs"));
 var path19 = __toESM(require("path"));
 
@@ -21122,6 +22364,11 @@ function builtinSkillsDir() {
 // src/services/SkillsService.ts
 var BUILTIN_SKILL_NAMES = ["grilling", "to-spec", "improve-codebase-architecture"];
 var RETIRED_BUILTIN_SKILL_NAMES = ["grill-me"];
+var PRIOR_BUILTIN_HASHES = {
+  grilling: ["d5d4cb8589fbb4a0f3296bae15033f2297ef682aaf5615a3dee258451f96e5c3"],
+  "improve-codebase-architecture": ["b5154b5e3baca9a5f244634453e83706d742011c31163648c2b8395a2524dd9c"]
+};
+var SEED_MANIFEST = ".seeded.json";
 function parseSkillFile(filePath, name, source) {
   const raw = fs9.readFileSync(filePath, "utf8");
   const frontmatter = {};
@@ -21161,6 +22408,13 @@ function copyDirSync2(src, dest) {
     else fs9.copyFileSync(srcPath, destPath);
   }
 }
+function fileHash(file) {
+  try {
+    return (0, import_crypto6.createHash)("sha256").update(fs9.readFileSync(file)).digest("hex");
+  } catch {
+    return void 0;
+  }
+}
 function readDir(dir, source) {
   if (!fs9.existsSync(dir)) return [];
   const entries = fs9.readdirSync(dir, { withFileTypes: true });
@@ -21185,21 +22439,59 @@ var SkillsService = class {
   globalDir() {
     return path19.join(globalDataDir(), "skills");
   }
+  readSeedManifest() {
+    try {
+      const parsed = JSON.parse(fs9.readFileSync(path19.join(this.globalDir(), SEED_MANIFEST), "utf8"));
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        return Object.fromEntries(
+          Object.entries(parsed).filter((entry) => typeof entry[1] === "string")
+        );
+      }
+    } catch {
+    }
+    return {};
+  }
+  recordSeed(name, hash) {
+    const manifest = this.readSeedManifest();
+    if (manifest[name] === hash) return;
+    manifest[name] = hash;
+    try {
+      fs9.mkdirSync(this.globalDir(), { recursive: true });
+      fs9.writeFileSync(path19.join(this.globalDir(), SEED_MANIFEST), JSON.stringify(manifest, null, 2));
+    } catch (err) {
+      console.warn(`Could not record seeded skill ${name}: ${String(err)}`);
+    }
+  }
+  /** A seed the user never edited: safe to replace with a newer built-in. */
+  isUntouchedSeed(name, currentHash) {
+    if (currentHash === void 0) return false;
+    return this.readSeedManifest()[name] === currentHash || (PRIOR_BUILTIN_HASHES[name] ?? []).includes(currentHash);
+  }
   seed(name) {
     const dest = path19.join(this.globalDir(), name);
-    if (fs9.existsSync(dest)) return false;
+    const exists = fs9.existsSync(dest);
     let srcDir;
     try {
       srcDir = path19.join(builtinSkillsDir(), name);
     } catch (err) {
-      console.warn(`Could not locate built-in skills dir: ${String(err)}`);
+      if (!exists) console.warn(`Could not locate built-in skills dir: ${String(err)}`);
       return false;
     }
     if (!fs9.existsSync(srcDir)) {
-      console.warn(`Built-in skill not found in package: ${name}`);
+      if (!exists) console.warn(`Built-in skill not found in package: ${name}`);
       return false;
     }
+    const srcHash = fileHash(path19.join(srcDir, "SKILL.md"));
+    if (exists) {
+      const currentHash = fileHash(path19.join(dest, "SKILL.md"));
+      if (currentHash !== void 0 && currentHash === srcHash) {
+        this.recordSeed(name, currentHash);
+        return false;
+      }
+      if (!this.isUntouchedSeed(name, currentHash)) return false;
+    }
     copyDirSync2(srcDir, dest);
+    if (srcHash) this.recordSeed(name, srcHash);
     return true;
   }
   seedBuiltinSkill(name) {
@@ -21555,9 +22847,9 @@ var fs10 = __toESM(require("fs"));
 var path20 = __toESM(require("path"));
 
 // src/utils/sessionId.ts
-var import_crypto3 = require("crypto");
+var import_crypto7 = require("crypto");
 function mintSessionId() {
-  return `session-${(0, import_crypto3.randomBytes)(16).toString("hex")}`;
+  return `session-${(0, import_crypto7.randomBytes)(16).toString("hex")}`;
 }
 
 // src/utils/sessionStore.ts
@@ -21894,7 +23186,12 @@ function lastAttemptDigest(location, taskId) {
   return events.length > 0 ? digestTaskLog(events, OPS_RETRY_DIGEST_CALLS) : null;
 }
 function sessionRuntimeSettings(settings) {
-  return { ...plannerRuntimeToggles(settings), modelAllowlist: settings.modelAllowlist, runnerTransport: settings.runnerTransport };
+  return {
+    ...plannerRuntimeToggles(settings),
+    modelAllowlist: settings.modelAllowlist,
+    runnerTransport: settings.runnerTransport,
+    enabledRunners: settings.enabledRunners
+  };
 }
 var SKILL_TOKEN = /(^|\s)\/([a-z][a-z0-9_-]*)([,.!?;:]*)(?=\s|$)/gi;
 function resolveSkillInvocation(text2, skillsService) {
@@ -21918,14 +23215,14 @@ function resolveSkillInvocation(text2, skillsService) {
     return `${lead}${skill.content}${punct}`;
   });
 }
-function liveAiService(config, workspaceRoot) {
+function liveAiService(config, workspaceRoot, mcpServer) {
   let live = null;
   let liveProvider = null;
   return () => {
     const provider = config.aiProvider;
     if (live && liveProvider === provider) return live;
     live?.reset();
-    live = createAiService(config, { workspaceRoot });
+    live = createAiService(config, { workspaceRoot, mcpServer });
     liveProvider = provider;
     return live;
   };
@@ -21935,7 +23232,7 @@ function isPlannerApproval(request) {
 }
 function createSession(deps) {
   const pinnedAiService = deps.aiService;
-  const aiService = pinnedAiService ? () => pinnedAiService : liveAiService(deps.config, deps.workspaceRoot);
+  const aiService = pinnedAiService ? () => pinnedAiService : liveAiService(deps.config, deps.workspaceRoot, deps.mcpServer ?? sharedMcpServer());
   const store = new PlanStore();
   const taskLogs = new TaskLogRecorder({
     broadcast: deps.broadcast,
@@ -22065,6 +23362,16 @@ var Session = class {
   currentSessionId;
   skillsService;
   conversation;
+  plannerTools = plannerToolHandler({
+    liveCatalog: () => this.liveCatalog(),
+    coerce: (tasks, runners) => coerceAssignments(tasks, this.allowlist(), runners, this.models()),
+    submitPlan: (tasks, runners) => this.submitPlanFromTool(tasks, runners),
+    editPlan: (ops) => this.editPlanFromTool(ops),
+    tasks: () => this.store.planTasks,
+    read: (signature, answer2) => this.conversation.read(signature, answer2),
+    liveOutput: (taskId, opts) => this.orchestrator.getLiveOutput(taskId, opts),
+    lastAttempt: (taskId) => lastAttemptDigest(this.taskLogLocation, taskId)
+  });
   constructor(parts) {
     this.config = parts.config;
     this.registry = parts.registry;
@@ -22093,17 +23400,7 @@ var Session = class {
       aiService: () => this.aiService(),
       onProgress: (p) => this.events.progress(p),
       opening: (runners) => this.conversationOpening(runners),
-      catalog: () => {
-        const runners = this.plan?.runners ?? [];
-        return {
-          runners,
-          // Allowlist-filtered: neither the per-turn block nor a read may offer
-          // a model the planner is forbidden to assign.
-          models: filterModelsForPrompt(this.models(), this.allowlist()),
-          modes: this.runnerModesFor(runners),
-          autonomousDefault: this.config.autonomousMode
-        };
-      },
+      catalog: () => this.catalogOf(this.plan?.runners ?? []),
       tasks: () => this.store.planTasks,
       liveOutput: (taskId, opts) => this.orchestrator.getLiveOutput(taskId, opts),
       hasLiveWork: () => this.hasLiveWork,
@@ -22127,8 +23424,8 @@ var Session = class {
    * server's HTTP route, the VS Code webview, the TUI prompt — so the decision
    * path is identical regardless of who is looking.
    */
-  resolveApproval(id, answer) {
-    return this.approvals.resolve(id, answer);
+  resolveApproval(id, answer2) {
+    return this.approvals.resolve(id, answer2);
   }
   /** Requests still waiting for an answer, replayed to a surface that connects mid-prompt. */
   outstandingApprovals() {
@@ -22248,6 +23545,27 @@ var Session = class {
     this.modelsCache = {};
     this.remintSessionId();
   }
+  /**
+   * What a planner may assign right now: every enabled runner, its modes, and
+   * its allowlisted models — read as of this call, so a runner enabled or an
+   * allowlist edited since planning started is in it (#69). Discovers a
+   * runner's models the first time it is asked for.
+   */
+  async liveCatalog() {
+    const runners = this.enabledRunners();
+    this.modelsCache = { ...this.modelsCache, ...await this.modelResolver.modelsForRunners(runners) };
+    return this.catalogOf(runners);
+  }
+  catalogOf(runners) {
+    return {
+      runners,
+      // Allowlist-filtered: neither the per-turn block nor a read may offer
+      // a model the planner is forbidden to assign.
+      models: filterModelsForPrompt(this.models(), this.allowlist()),
+      modes: this.runnerModesFor(runners),
+      autonomousDefault: this.config.autonomousMode
+    };
+  }
   runnerModesFor(runners) {
     return runnerModesFrom(this.registry, runners);
   }
@@ -22259,13 +23577,17 @@ var Session = class {
    * allowlist here — {@link checkModelAndModeValidity} narrows by
    * allowlist itself, the same way `coerceAssignments` does.
    */
-  editCatalog() {
+  editCatalog(runners = this.plan?.runners ?? []) {
     return {
       modelsByRunner: this.models(),
-      runnerModes: this.runnerModesFor(this.plan?.runners ?? []),
+      runnerModes: this.runnerModesFor(runners),
       perRunnerAllowlist: this.allowlist()
     };
   }
+  /** The runners enabled right now — a toggle made since the session was built counts (#69). */
+  enabledRunners() {
+    return this.settingsFn().enabledRunners ?? this.config.enabledRunners;
+  }
   /**
    * The allowlist in force right now. Unset means no restriction — falling
    * back to the one planning started under would keep a restriction the user
@@ -22367,7 +23689,7 @@ var Session = class {
     this.goal = goal;
     this.remintSessionId();
     this.beginFreshPlan();
-    const enabled = this.config.enabledRunners;
+    const enabled = this.enabledRunners();
     const chosenRunners = runners.filter((r) => enabled.includes(r));
     if (chosenRunners.length === 0) throw new Error("None of the requested runners are enabled");
     const { modelsByRunner, runnerModes, settings } = await this.plannerCatalog(chosenRunners);
@@ -22411,7 +23733,7 @@ var Session = class {
     this.goal = this.resolveSkillInvocation(goal);
     this.remintSessionId();
     this.beginFreshPlan();
-    const enabled = this.config.enabledRunners;
+    const enabled = this.enabledRunners();
     const chosenRunners = runners.filter((r) => enabled.includes(r));
     if (chosenRunners.length === 0) throw new Error("None of the requested runners are enabled");
     const opening = await this.conversationOpening(chosenRunners);
@@ -22489,6 +23811,49 @@ var Session = class {
   rewindTargets() {
     return this.conversation.rewindTargets();
   }
+  /**
+   * Hand the planner turn in flight a validated plan or a task edit; the turn
+   * commits it as it would the same JSON in the planner's reply. False when
+   * no turn is open.
+   */
+  submitToTurn(submission) {
+    return this.conversation.submit(submission);
+  }
+  /**
+   * A plan the planner submitted through its tool, already checked against the
+   * live catalog. Its runners join `plan.runners` here, so a runner enabled
+   * since planning started is not snapped back by the commit (#69).
+   */
+  submitPlanFromTool(tasks, runners) {
+    if (!this.plan || !this.conversation.submit({ kind: "plan", tasks })) return false;
+    for (const runner of runners) this.admitRunner(runner, this.modelsCache[runner] ?? []);
+    return true;
+  }
+  /**
+   * A task edit the planner made through its tool. Checked against the live
+   * catalog, then handed to the open turn, which commits it as it would the
+   * same ops in a taskOps reply — including parking it behind a running batch,
+   * which the envelope does before any check, so a queued edit is not checked
+   * here either. Edits made in one reply join one batch.
+   */
+  async editPlanFromTool(ops) {
+    const refuse = (message) => ({ ok: false, errors: [message] });
+    const catalog = await this.liveCatalog();
+    if (!this.plan || this.store.planTasks.length === 0) return refuse("There is no plan to edit yet: submit one with submit_plan.");
+    const held = this.conversation.pendingOps();
+    if (!held) return refuse("A whole plan was submitted in this reply and replaces the plan when it ends: make the edit in your next reply.");
+    const batch = [...held, ...ops];
+    const queued = this.conversation.editWouldQueue(batch);
+    let summary = [];
+    if (!queued) {
+      const result = applyTaskOps(this.store.planTasks, batch, catalog.runners, this.editCatalog(catalog.runners));
+      if (!result.ok) return { ok: false, errors: result.errors };
+      summary = result.summary;
+      for (const runner of runnersOf(result.tasks)) this.admitRunner(runner, this.modelsCache[runner] ?? []);
+    }
+    if (!this.conversation.submit({ kind: "task_ops", ops: batch })) return refuse("No planning turn is open to take the edit.");
+    return { ok: true, summary, queued };
+  }
   /** Whether the planner conversation is live (started and not yet committed to a plan). */
   get isConversationActive() {
     return this.conversation.isActive;
@@ -22534,7 +23899,8 @@ var Session = class {
       // usage line can show context fill (#49). Unknown stays absent.
       contextWindow: this.modelResolver.contextWindowFor?.(this.config.orchestratorModel),
       fs: this.fsAdapter,
-      fetcher: this.fetcher
+      fetcher: this.fetcher,
+      plannerTools: { sessionId: this.sessionId, handler: this.plannerTools }
     };
   }
   /**
@@ -22652,7 +24018,7 @@ var Session = class {
       ])
     );
     try {
-      const modelsByRunner = await this.modelResolver.modelsForRunners(this.config.enabledRunners);
+      const modelsByRunner = await this.modelResolver.modelsForRunners(this.enabledRunners());
       const runnerModes = this.runnerModesFor(this.plan?.runners ?? ["claude-code"]);
       const { modelAllowlist } = this.settingsFn();
       const result = await this.planner.modifyDuringExecution({
@@ -22999,7 +24365,7 @@ var Session = class {
     if (!this.plan) throw new Error("No active plan state");
     const check = canMergeTasks(this.store.planTasks, taskIds);
     if (!check.ok) throw new Error(check.error ?? "These tasks cannot be merged");
-    const prompt = buildMergePrompt(taskIds, this.store.planTasks);
+    const prompt = buildMergePrompt(taskIds, this.store.planTasks, this.aiService().plannerToolsAttached?.());
     return this.continueConversation(prompt, options);
   }
   /**
@@ -23011,7 +24377,7 @@ var Session = class {
     if (!this.plan) throw new Error("No active plan state");
     const check = canSplitTask(this.store.planTasks, taskId);
     if (!check.ok) throw new Error(check.error ?? "This task cannot be split");
-    const prompt = buildSplitPrompt(taskId, this.store.planTasks);
+    const prompt = buildSplitPrompt(taskId, this.store.planTasks, this.aiService().plannerToolsAttached?.());
     return this.continueConversation(prompt, options);
   }
   loadPlan(plan, goal, workspace, opts) {
@@ -23051,41 +24417,6 @@ var Session = class {
   }
 };
 
-// src/utils/privateFile.ts
-var import_fs2 = require("fs");
-var import_path = require("path");
-var import_crypto4 = require("crypto");
-var DIR_MODE = 448;
-var FILE_MODE = 384;
-var POSIX_MODES = process.platform !== "win32";
-function ensurePrivateDir(dir) {
-  if (POSIX_MODES) {
-    (0, import_fs2.mkdirSync)(dir, { recursive: true, mode: DIR_MODE });
-    return;
-  }
-  (0, import_fs2.mkdirSync)(dir, { recursive: true });
-}
-function writePrivateFile(filePath, content) {
-  const dir = (0, import_path.dirname)(filePath);
-  ensurePrivateDir(dir);
-  const tempPath = (0, import_path.join)(dir, `.${(0, import_path.basename)(filePath)}.${(0, import_crypto4.randomBytes)(8).toString("hex")}.tmp`);
-  const fd = (0, import_fs2.openSync)(tempPath, "wx", POSIX_MODES ? FILE_MODE : void 0);
-  try {
-    (0, import_fs2.writeSync)(fd, content);
-  } finally {
-    (0, import_fs2.closeSync)(fd);
-  }
-  try {
-    (0, import_fs2.renameSync)(tempPath, filePath);
-  } catch (err) {
-    try {
-      (0, import_fs2.unlinkSync)(tempPath);
-    } catch {
-    }
-    throw err;
-  }
-}
-
 // src/conversation/reduce.ts
 var EMPTY_CONVERSATION = { blocks: [], nextId: 1 };
 function isUnsettledSegment(block, turnId) {
@@ -23767,9 +25098,9 @@ var HeadlessRunner = class extends AbstractRunner {
 // src/services/TmuxRunner.ts
 var import_child_process11 = require("child_process");
 var import_util5 = require("util");
-var import_os = require("os");
-var import_path2 = require("path");
-var import_fs3 = require("fs");
+var import_os2 = require("os");
+var import_path5 = require("path");
+var import_fs5 = require("fs");
 
 // src/utils/tmux.ts
 var import_child_process10 = require("child_process");
@@ -23867,7 +25198,7 @@ var TmuxSession = class extends AbstractTerminalSession {
    * lets the user keep poking at a finished task's terminal.
    */
   async start(command, args, cwd, env) {
-    (0, import_fs3.writeFileSync)(this.logPath, "");
+    (0, import_fs5.writeFileSync)(this.logPath, "");
     const envAssignments = Object.entries(env ?? {}).map(([k, v]) => `${k}=${posixShellQuote(v)}`).join(" ");
     const inner = [command, ...args].map(posixShellQuote).join(" ");
     const prefix = envAssignments ? `env ${envAssignments} ` : "";
@@ -23890,7 +25221,7 @@ var TmuxSession = class extends AbstractTerminalSession {
   readLog() {
     let content;
     try {
-      content = (0, import_fs3.existsSync)(this.logPath) ? (0, import_fs3.readFileSync)(this.logPath, "utf8") : "";
+      content = (0, import_fs5.existsSync)(this.logPath) ? (0, import_fs5.readFileSync)(this.logPath, "utf8") : "";
     } catch {
       return false;
     }
@@ -23946,7 +25277,7 @@ var TmuxSession = class extends AbstractTerminalSession {
     this.tmux(["pipe-pane", "-t", this.target]).catch(() => {
     });
     try {
-      (0, import_fs3.unlinkSync)(this.logPath);
+      (0, import_fs5.unlinkSync)(this.logPath);
     } catch {
     }
     this.baseHandleExit(code);
@@ -23983,7 +25314,7 @@ var TmuxRunner = class extends AbstractRunner {
     this.execFileImpl = deps.execFileImpl ?? defaultExecFile3;
     this.resolvePath = deps.resolvePath ?? augmentedPath;
     this.pollIntervalMs = deps.pollIntervalMs ?? 500;
-    this.logDir = deps.logDir ?? (0, import_os.tmpdir)();
+    this.logDir = deps.logDir ?? (0, import_os2.tmpdir)();
     this.clipboardCommand = deps.clipboardCommand ?? (() => clipboardCopyCommand());
     this.runnerVersion = deps.runnerVersion ?? probeRunnerVersion;
   }
@@ -24103,7 +25434,7 @@ var TmuxRunner = class extends AbstractRunner {
       windowName,
       this.execFileImpl,
       this.pollIntervalMs,
-      (0, import_path2.join)(this.logDir, `${id}.log`),
+      (0, import_path5.join)(this.logDir, `${id}.log`),
       this.socket
     );
     invocation.env = { ...opts.env, ...invocation.env, PATH: await this.resolvePath() };
@@ -24131,9 +25462,9 @@ var KEY_ARGS = {
 };
 var FALLBACK_KEY_ARGS = ["file_path", "path", "notebook_path", "description", "pattern", "command", "url", "query", "prompt"];
 function toolLine(name, args) {
-  const { tool } = mapAgentTool(name);
-  const normalized = normalizeAgentArgs(tool, args);
-  const preferred = KEY_ARGS[tool];
+  const { tool: tool2 } = mapAgentTool(name);
+  const normalized = normalizeAgentArgs(tool2, args);
+  const preferred = KEY_ARGS[tool2];
   for (const key of preferred ? [preferred, ...FALLBACK_KEY_ARGS] : FALLBACK_KEY_ARGS) {
     const value = normalized[key];
     if (typeof value !== "string") continue;
@@ -24196,6 +25527,7 @@ var StructuredSession = class extends AbstractTerminalSession {
   constructor(id, taskId, launch) {
     super(id, taskId);
     this.launch = launch;
+    this.startOptions = launch.startOptions;
     this.text = new PlainTextChannel((text2) => {
       this.output += text2;
       this.outputEmitter.emit("output", text2);
@@ -24224,9 +25556,20 @@ var StructuredSession = class extends AbstractTerminalSession {
    * requests — while an approval must be answerable by id across the session.
    */
   permissions = /* @__PURE__ */ new Map();
+  /** The launch's start options, with this attempt's server once its token is issued. */
+  startOptions;
+  /** This attempt's MCP token, until the session ends (ADR-0022, A2). */
+  toolToken = null;
+  checkpointHandler = null;
   /** Start the runner and send the task's prompt as its first turn. */
   async start(prompt) {
-    await this.startAdapter(this.launch.startOptions);
+    await this.issueTools();
+    try {
+      await this.startAdapter(this.startOptions);
+    } catch (err) {
+      this.revokeTools();
+      throw err;
+    }
     this.state = "working";
     setImmediate(() => {
       if (!this.exited) this.deliver(prompt);
@@ -24235,6 +25578,49 @@ var StructuredSession = class extends AbstractTerminalSession {
   getOutput() {
     return this.output;
   }
+  onTaskComplete(listener) {
+    this.structuredEmitter.on("taskComplete", listener);
+  }
+  onToolCheckpoint(handler) {
+    this.checkpointHandler = handler;
+  }
+  /**
+   * A server that cannot start costs the task its tools, not its run: the
+   * prompt still teaches the marker (ADR-0022, S2).
+   */
+  async issueTools() {
+    const tools = this.launch.tools;
+    if (!tools) return;
+    try {
+      const credential = await tools.server.issueTaskToken(tools.scope, {
+        taskComplete: async (report) => {
+          this.structuredEmitter.emit("taskComplete", report);
+          return { text: "Recorded. End your turn now." };
+        },
+        checkpoint: async ({ question }, { signal }) => {
+          if (!this.checkpointHandler) return { text: "checkpoint is not available in this session.", isError: true };
+          return checkpointReply(await this.checkpointHandler(question, signal));
+        }
+      });
+      if (this.exited) {
+        tools.server.revoke(credential.token);
+        return;
+      }
+      this.toolToken = credential.token;
+      this.startOptions = { ...this.startOptions, mcp: mcpClientConfig(credential) };
+    } catch (err) {
+      console.error(`[structured] No Ordewell tools for task ${this.taskId.slice(0, 8)}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  revokeTools() {
+    if (this.toolToken === null) return;
+    this.launch.tools?.server.revoke(this.toolToken);
+    this.toolToken = null;
+  }
+  baseHandleExit(code) {
+    this.revokeTools();
+    super.baseHandleExit(code);
+  }
   /** A reply typed at the task — a checkpoint answer, most often — is a user message. */
   write(text2) {
     const message = text2.trim();
@@ -24332,12 +25718,12 @@ var StructuredSession = class extends AbstractTerminalSession {
    * session id after an abort.
    */
   async restartInterrupted(turn) {
-    const resumeSessionId = this.nativeSessionId() ?? this.launch.startOptions.resumeSessionId;
+    const resumeSessionId = this.nativeSessionId() ?? this.startOptions.resumeSessionId;
     this.generation += 1;
     turn.abort.abort();
     if (this.adapter) this.withdrawPermissions(this.adapter);
     try {
-      await this.startAdapter({ ...this.launch.startOptions, resumeSessionId });
+      await this.startAdapter({ ...this.startOptions, resumeSessionId });
     } catch (err) {
       this.text.line(`Could not restart ${this.launch.runner} after the interrupt: ${err instanceof Error ? err.message : String(err)}`);
       this.endTurn(turn, "interrupted");
@@ -24475,11 +25861,13 @@ var StructuredRunner = class extends AbstractRunner {
   processDeps;
   createAdapter;
   interruptGraceMs;
+  mcp;
   constructor(deps = {}) {
     super();
     this.processDeps = deps.process ?? {};
     this.createAdapter = deps.createAdapter ?? createTaskAdapter;
     this.interruptGraceMs = deps.interruptGraceMs ?? DEFAULT_INTERRUPT_GRACE_MS;
+    this.mcp = deps.mcp ?? sharedMcpServer();
   }
   async spawn(opts) {
     const manifest = opts.registry?.get(opts.runner)?.manifest;
@@ -24506,7 +25894,8 @@ var StructuredRunner = class extends AbstractRunner {
         flags: resolveTaskRunnerFlags(manifest, { mode: opts.mode ?? "default", model: opts.modelId, thinkingEffort: opts.thinkingEffort }),
         resumeSessionId: opts.resumeSessionId
       },
-      interruptGraceMs: this.interruptGraceMs
+      interruptGraceMs: this.interruptGraceMs,
+      ...takesOrdewellTools(opts.runner) ? { tools: { server: this.mcp, scope: { sessionId: opts.planSessionId ?? "", taskId: opts.taskId, attempt: opts.attempt ?? 1 } } } : {}
     });
     console.error(`[structured] Starting ${opts.runner} [${opts.mode ?? "default"}] (${opts.modelId || "default"}) for task ${opts.taskId.slice(0, 8)}`);
     this.registerSession(id, session);
@@ -24520,73 +25909,12 @@ var StructuredRunner = class extends AbstractRunner {
   }
 };
 
-// src/utils/daemonToken.ts
-var import_crypto5 = require("crypto");
-var import_fs4 = require("fs");
-var import_path3 = require("path");
-var BEARER_PREFIX = "bearer ";
-var DAEMON_TOKEN_SUBPROTOCOL_PREFIX = "ordewell.token.";
-var DAEMON_SUBPROTOCOL = "ordewell.v1";
-function configDir() {
-  return globalDataDir();
-}
-function daemonTokenPath(port) {
-  return (0, import_path3.join)(configDir(), `server-${port}.token`);
-}
-function mintDaemonToken(port) {
-  const token = (0, import_crypto5.randomBytes)(32).toString("base64url");
-  const file = daemonTokenPath(port);
-  writePrivateFile(file, token);
-  return { token, file };
-}
-function readDaemonToken(port) {
-  try {
-    const token = (0, import_fs4.readFileSync)(daemonTokenPath(port), "utf8").trim();
-    return token === "" ? void 0 : token;
-  } catch {
-    return void 0;
-  }
-}
-function clearDaemonToken(port) {
-  try {
-    (0, import_fs4.unlinkSync)(daemonTokenPath(port));
-  } catch {
-  }
-}
-function bearerHeaderValue(token) {
-  return `Bearer ${token}`;
-}
-function tokenSubprotocols(token) {
-  return [DAEMON_SUBPROTOCOL, `${DAEMON_TOKEN_SUBPROTOCOL_PREFIX}${token}`];
-}
-function extractPresentedToken(carriers) {
-  const authorization = carriers.authorization;
-  if (authorization && authorization.toLowerCase().startsWith(BEARER_PREFIX)) {
-    const value = authorization.slice(BEARER_PREFIX.length).trim();
-    if (value !== "") return value;
-  }
-  for (const offered of (carriers.secWebSocketProtocol ?? "").split(",")) {
-    const value = offered.trim();
-    if (!value.startsWith(DAEMON_TOKEN_SUBPROTOCOL_PREFIX)) continue;
-    const token = value.slice(DAEMON_TOKEN_SUBPROTOCOL_PREFIX.length);
-    if (token !== "") return token;
-  }
-  return void 0;
-}
-function tokensMatch(presented, expected) {
-  if (presented === void 0) return false;
-  const a = Buffer.from(presented, "utf8");
-  const b = Buffer.from(expected, "utf8");
-  if (a.length !== b.length) return false;
-  return (0, import_crypto5.timingSafeEqual)(a, b);
-}
-
 // src/plugins/RunnerRegistry.ts
 var fs13 = __toESM(require("fs"));
 var path24 = __toESM(require("path"));
 var os6 = __toESM(require("os"));
 var import_child_process13 = require("child_process");
-var import_crypto6 = require("crypto");
+var import_crypto8 = require("crypto");
 
 // src/plugins/FsPluginStore.ts
 var fs12 = __toESM(require("fs"));
@@ -24610,8 +25938,8 @@ function resolvePluginInstallDir(pluginsDir, name) {
   assertPlainPluginName(name);
   const root = path22.resolve(pluginsDir);
   const dest = path22.resolve(root, name);
-  const relative5 = path22.relative(root, dest);
-  if (relative5 !== name || relative5 === "" || path22.isAbsolute(relative5)) {
+  const relative6 = path22.relative(root, dest);
+  if (relative6 !== name || relative6 === "" || path22.isAbsolute(relative6)) {
     throw new Error(`Plugin install path escapes the plugins directory: ${JSON.stringify(name)}`);
   }
   return dest;
@@ -25225,7 +26553,7 @@ var RunnerRegistry = class {
   }
   installFromGit(url) {
     const validated = assertInstallablePluginUrl(url);
-    const tmpDir = path24.join(os6.tmpdir(), `ordewell-plugin-${(0, import_crypto6.randomBytes)(12).toString("hex")}`);
+    const tmpDir = path24.join(os6.tmpdir(), `ordewell-plugin-${(0, import_crypto8.randomBytes)(12).toString("hex")}`);
     this.store.ensureDir(tmpDir);
     try {
       try {
@@ -25645,11 +26973,15 @@ var PlannerModelMemory = class {
   NO_TURN,
   OPENCODE_MANIFEST,
   ORCHESTRATOR_SHORTCUTS,
+  ORDEWELL_MCP_PATH,
+  ORDEWELL_MCP_SERVER_NAME,
   ORDEWELL_SETTABLE_ENV,
   OUTPUT_LINES_DEFAULT,
   OUTPUT_LINES_MAX,
   OpenAiService,
   OpenCodeAdapter,
+  OrdewellMcpServer,
+  PLANNER_TOOLS,
   PLAN_ENVELOPE_KEY,
   PLUGIN_NAME_PATTERN,
   PROVIDER_CREDENTIAL_ENV,
@@ -25686,6 +27018,7 @@ var PlannerModelMemory = class {
   TASK_QUERY_FIELDS,
   TASK_QUERY_PROTOCOL,
   TASK_QUERY_REMINDER,
+  TASK_TOOLS,
   TRUNCATED_PLAN_REPAIR_INSTRUCTION,
   TaskControlError,
   TaskLogRecorder,
@@ -25769,10 +27102,14 @@ var PlannerModelMemory = class {
   daemonTokenPath,
   defaultLogger,
   definitionPattern,
+  defuseMarkers,
   deleteSession,
   dependencyCandidates,
   dependentsOf,
   describeMergeResult,
+  diffRows,
+  diffStat,
+  diffSummary,
   digestTaskLog,
   discoverGeminiModels,
   drainNext,
@@ -25835,6 +27172,7 @@ var PlannerModelMemory = class {
   loadState,
   looksLikePlanAttempt,
   mapAgentTool,
+  mcpClientConfig,
   migrateLegacyPlan,
   migrateOldConfigDir,
   migratePlanIsolation,
@@ -25850,6 +27188,7 @@ var PlannerModelMemory = class {
   opensWithJsonObject,
   outputLines,
   outputPreview,
+  ownerOnlyConfigFile,
   parseAutonomyLevel,
   parseMaxParallel,
   parsePartialPlan,
@@ -25908,6 +27247,7 @@ var PlannerModelMemory = class {
   serializeTaskStatus,
   sessionDataDir,
   sessionRuntimeSettings,
+  sharedMcpServer,
   stateExists,
   stopTurn,
   stripAnsi,
@@ -25941,6 +27281,7 @@ var PlannerModelMemory = class {
   usageLine,
   validateModifiedPlan,
   validatePlanModification,
+  validatePlanTasks,
   warningsText,
   wellKnownBinDirs,
   windowsCommandLine,