@ordewell/core 0.6.4 → 0.7.1

package/dist/index.d.ts

@@ -1,16 +1,17 @@
-import { aG as RunnerId, ag as PlanStatus, a6 as LegacyPlanState, I as IApproval, k as ApprovalDecision, p as ApprovalRequest, j as ApprovalAnswer, L as ITerminalRunner, J as IConfig, h as AiProvider, as as ProviderModelLists, m as ApprovalMode, X as IsolationMergeResult, T as IsolationLandedTask, N as IWorktreeIsolation, a2 as IsolationTaskStatus, ad as PlanIsolation, aL as RunnerTransport, az as RepoGroupLayout, M as ITerminalSession, w as DiscoveredModel, aV as Task, f as AgentProcessDeps, c as AgentAdapter, aB as ResearchProgress, aA as ResearchLogEntry, u as ConversationMessage, bb as UsageRecord, b2 as TaskSnapshot, r as AwaitingReason, Q as IsolationHandoff, $ as IsolationRun, a0 as IsolationTaskRecord, aW as TaskIsolation, a3 as IsolationView, Y as IsolationOutcome, ay as RepairEvidence, b9 as TreeSnapshot, bi as Verdict, aJ as RunnerRegistry, ax as QueuedTaskMessage, aw as QueuedMessage, b as ActiveTaskSession, ac as OrchestratorOption, aZ as TaskModeAgentAdapter, g as AgentStartOptions, e as AgentEvent, aE as ResearchToolType, ai as PlannerUsage, n as ApprovalPolicy, af as PlanState, aH as RunnerInvocation, A as AbstractRunner, a as AbstractTerminalSession, aM as RunnerVersionProbe, aR as StructuredSessionCapability, b3 as TaskStartOptions, aS as StructuredTurnEnd, aQ as StructuredEvent, aK as RunnerSpawnOptions, K as IPluginStore, aI as RunnerPluginManifest, aF as ResolveContext, b1 as TaskRunnerFlags } from './Task-xqdxugt2.js';
-export { d as AgentAdapterFactory, i as AllProviderModels, l as ApprovalKind, o as ApprovalPolicyOptions, q as ApprovalSource, B as BlockingPrompt, C as CMD_EXE_MAX_COMMAND_LINE, s as CatalogModel, t as CommandLineTooLongError, D as DENY_ALL, v as DiscoveredMode, x as DiscoveryCommand, E as EmbeddedNewlineError, y as ExecutableNotFoundError, F as FetchAllProviderModelsOptions, H as HeadlessRunner, z as HeadlessRunnerDeps, G as HeadlessSession, O as IntegrationDisposal, P as IsolationAvailability, R as IsolationHandoffRepo, S as IsolationInactiveReason, U as IsolationLanding, V as IsolationMergeBlock, W as IsolationMergeBlockReason, Z as IsolationPruneResult, _ as IsolationRepo, a1 as IsolationTaskRepo, a4 as LaunchDeps, a5 as LaunchPlan, a7 as LineBuffer, a8 as Message, a9 as ModelCatalog, aa as ModelShortcut, ab as ORCHESTRATOR_SHORTCUTS, ae as PlanModificationWarnings, ah as PlannerStartOptions, aj as PluginCloneFn, ak as PluginEntry, al as PluginFeatures, am as PluginMode, an as PluginModelDiscovery, ao as PluginRunnerDef, ap as PreparedLaunch, aq as PreparedTask, ar as ProviderCredentialSource, at as ProviderModelsResult, au as PtySize, av as PtyWrapOptions, aC as ResearchStep, aD as ResearchStepOutcome, aN as StreamEvent, aO as StreamStepEvent, aP as StreamThinkingEvent, aT as SubagentLogEntry, aU as SubagentOutcome, aX as TaskIsolationState, aY as TaskMode, a_ as TaskModeUnsupportedError, a$ as TaskModelAssignment, b0 as TaskOutputSummary, b4 as TaskStatus, b5 as TaskTransport, b6 as TaskType, b7 as TaskWithParent, b8 as ThinkingBlock, ba as UsageLine, bc as UsageTotals, bd as UserPromptEntry, be as UserStep, bf as ValidationCheck, bg as ValidationContext, bh as ValidationResult, bj as VerificationCheck, bk as WINDOWS_MAX_COMMAND_LINE, bl as addPlannerUsage, bm as addTaskToPlan, bn as addUsage, bo as approvalScopes, bp as buildShellInvocation, bq as collectProviderCredentials, br as createEmptyPlan, bs as createTask, bt as emptyWarnings, bu as enabledRunners, bv as fetchAllProviderModels, bw as flattenTasks, bx as flattenTasksWithParents, by as isAwaitingReason, bz as isExecutableResolved, bA as isGranted, bB as isMeasured, bC as isReservedRunnerName, bD as isRunnerApproval, bE as isRunnerTransport, bF as isStructuredSession, bG as keepExecutionState, bH as knownModelId, bI as migrateLegacyPlan, bJ as migratePlanState, bK as migrateTask, bL as partedPromptUsage, bM as planDirectLaunch, bN as planShellLaunch, bO as plannerContextFill, bP as posixShellQuote, bQ as removeTaskFromPlan, bR as renumberTasks, bS as resolveModelShortcut, bT as resolveProvider, bU as stripAnsi, bV as toApprovalDecision, bW as toOrchestratorOptions, bX as updateTaskInPlan, bY as usageLine, bZ as validateModifiedPlan, b_ as warningsText, b$ as windowsCommandLine, c0 as wrapWithPty } from './Task-xqdxugt2.js';
-import { u as TaskOp, M as MergeGateView, m as SessionBroadcaster, A as ApplyTaskOpsResult, n as SessionMessage, o as SessionNotice, s as TaskLogEvent } from './plan-utils-Br8UAoiu.js';
-export { a as ApprovalBlock, b as ApprovalStatus, C as CHECKPOINT_TRUNCATE_LENGTH, c as ConversationInput, d as ConversationView, D as DisplayBlock, E as EMPTY_CONVERSATION, e as EMPTY_HOLD, f as EMPTY_TASK_LOG, G as GatedConversation, L as LocalEntry, g as MessageBlock, h as MessageRole, N as NO_TURN, O as OutputPreview, P as PlanBlock, i as PlanMarkerStatus, j as PromptHold, S as SerializedPlan, k as SerializedTask, l as SerializedTaskStatus, p as SubagentBlock, q as SubagentChild, r as SubagentStatus, T as TakenPrompt, t as TaskLogView, v as TaskRef, w as ThinkingDisplayBlock, x as ToolBlock, y as ToolHeadline, z as ToolStatus, B as TurnGate, U as UsageBlock, F as aheadOfDraft, H as applyTaskOps, I as canMergeTasks, J as canSetDependencies, K as canSplitTask, Q as capConflictFiles, R as classifyOutcome, V as coalesceTaskLog, W as dependencyCandidates, X as dependentsOf, Y as digestTaskLog, Z as drainNext, _ as executionSummary, $ as followTurn, a0 as fromTranscript, a1 as hasHiddenDetail, a2 as holdPrompt, a3 as outputLines, a4 as outputPreview, a5 as parseTaskOpsJson, a6 as reduceConversation, a7 as reduceTaskLog, a8 as replayTaskLog, a9 as runnerToolSubject, aa as serializePlan, ab as serializeTask, ac as serializeTaskStatus, ad as stopTurn, ae as summarizeToolCall, af as taskStartedNotice, ag as textHasTaskOps, ah as toTaskLogEvent, ai as toolHeadline, aj as trimToolOutput, ak as truncateCheckpointSummary, al as unsendAll, am as unsendLatest } from './plan-utils-Br8UAoiu.js';
-import { I as IFileSystem, R as ReadFileOpts, T as ToolOutcome, b as GrepOptions, a as GlobOptions, F as FindSymbolOptions } from './IFileSystem-DQEKyC6H.js';
-export { G as GREP_DEFAULT_HEAD_LIMIT, c as GrepOutputMode, S as SEARCH_EXCLUSIONS } from './IFileSystem-DQEKyC6H.js';
-import { R as RunnerModeInfo } from './ModeResolver-ByNpC0EP.js';
-export { M as ManifestLookup, a as autonomyLevelLabel, b as buildModeGuide, f as filteredBuildModes, p as parseAutonomyLevel, r as resolveDefaultMode, c as resolveTaskMode, d as runnerModesFrom } from './ModeResolver-ByNpC0EP.js';
+import { a$ as RunnerId, ax as PlanStatus, ab as LegacyPlanState, L as IApproval, k as ApprovalDecision, p as ApprovalRequest, j as ApprovalAnswer, O as ITerminalRunner, M as IConfig, h as AiProvider, aM as ProviderModelLists, m as ApprovalMode, _ as IsolationMergeResult, W as IsolationLandedTask, Q as IWorktreeIsolation, a7 as IsolationTaskStatus, au as PlanIsolation, b4 as RunnerTransport, aU as RepoGroupLayout, P as ITerminalSession, y as DiscoveredModel, bh as Task, f as AgentProcessDeps, c as AgentAdapter, ar as OrdewellMcpServer, aW as ResearchProgress, aV as ResearchLogEntry, w as ConversationMessage, aA as PlannerToolHandler, bE as UsageRecord, bt as TaskSnapshot, r as AwaitingReason, T as IsolationHandoff, a3 as IsolationRun, a4 as IsolationTaskRecord, bj as TaskIsolation, a8 as IsolationView, $ as IsolationOutcome, aT as RepairEvidence, bC as TreeSnapshot, bL as Verdict, b2 as RunnerRegistry, aR as QueuedTaskMessage, aQ as QueuedMessage, b as ActiveTaskSession, aq as OrchestratorOption, bm as TaskModeAgentAdapter, g as AgentStartOptions, e as AgentEvent, aZ as ResearchToolType, aB as PlannerUsage, n as ApprovalPolicy, aw as PlanState, bi as TaskCompleteArgs, t as CheckpointAnswer, b0 as RunnerInvocation, A as AbstractRunner, a as AbstractTerminalSession, b5 as RunnerVersionProbe, ba as StructuredSessionCapability, bu as TaskStartOptions, bw as TaskTokenScope, bb as StructuredTurnEnd, b9 as StructuredEvent, b3 as RunnerSpawnOptions, N as IPluginStore, b1 as RunnerPluginManifest, a_ as ResolveContext, bs as TaskRunnerFlags } from './Task-BnLxkVQF.js';
+export { d as AgentAdapterFactory, i as AllProviderModels, l as ApprovalKind, o as ApprovalPolicyOptions, q as ApprovalSource, B as BlockingPrompt, C as CMD_EXE_MAX_COMMAND_LINE, s as CatalogModel, u as CheckpointArgs, v as CommandLineTooLongError, D as DENY_ALL, x as DiscoveredMode, z as DiscoveryCommand, E as EditPlanArgs, F as EmbeddedNewlineError, G as ExecutableNotFoundError, H as FetchAllProviderModelsOptions, I as HeadlessRunner, J as HeadlessRunnerDeps, K as HeadlessSession, R as IntegrationDisposal, S as IsolationAvailability, U as IsolationHandoffRepo, V as IsolationInactiveReason, X as IsolationLanding, Y as IsolationMergeBlock, Z as IsolationMergeBlockReason, a0 as IsolationPruneResult, a1 as IsolationRemoval, a2 as IsolationRepo, a5 as IsolationTaskRef, a6 as IsolationTaskRepo, a9 as LaunchDeps, aa as LaunchPlan, ac as LineBuffer, ad as ListModelsArgs, ae as ListRunnersArgs, af as McpClientConfig, ag as McpCredential, ah as McpTool, ai as McpToolContext, aj as McpToolReply, ak as Message, al as ModelCatalog, am as ModelShortcut, an as ORCHESTRATOR_SHORTCUTS, ao as ORDEWELL_MCP_PATH, ap as ORDEWELL_MCP_SERVER_NAME, as as OwnerOnlyFile, at as PLANNER_TOOLS, av as PlanModificationWarnings, ay as PlannerStartOptions, az as PlannerTokenScope, aC as PluginCloneFn, aD as PluginEntry, aE as PluginFeatures, aF as PluginMode, aG as PluginModelDiscovery, aH as PluginRunnerDef, aI as PreparedLaunch, aJ as PreparedTask, aK as PreservedWork, aL as ProviderCredentialSource, aN as ProviderModelsResult, aO as PtySize, aP as PtyWrapOptions, aS as RefusedRemoval, aX as ResearchStep, aY as ResearchStepOutcome, b6 as StreamEvent, b7 as StreamStepEvent, b8 as StreamThinkingEvent, bc as SubagentLogEntry, bd as SubagentOutcome, be as SubmitPlanArgs, bf as TASK_COMPLETE_TOOL, bg as TASK_TOOLS, bk as TaskIsolationState, bl as TaskMode, bn as TaskModeUnsupportedError, bo as TaskModelAssignment, bp as TaskOutputArgs, bq as TaskOutputSummary, br as TaskQueryArgs, bv as TaskStatus, bx as TaskToolHandler, by as TaskTransport, bz as TaskType, bA as TaskWithParent, bB as ThinkingBlock, bD as UsageLine, bF as UsageTotals, bG as UserPromptEntry, bH as UserStep, bI as ValidationCheck, bJ as ValidationContext, bK as ValidationResult, bM as VerificationCheck, bN as WINDOWS_MAX_COMMAND_LINE, bO as addPlannerUsage, bP as addTaskToPlan, bQ as addUsage, bR as approvalScopes, bS as buildShellInvocation, bT as collectProviderCredentials, bU as createEmptyPlan, bV as createTask, bW as emptyWarnings, bX as enabledRunners, bY as fetchAllProviderModels, bZ as flattenTasks, b_ as flattenTasksWithParents, b$ as inheritedOps, c0 as isAwaitingReason, c1 as isExecutableResolved, c2 as isGranted, c3 as isMeasured, c4 as isReservedRunnerName, c5 as isRunnerApproval, c6 as isRunnerTransport, c7 as isStructuredSession, c8 as keepExecutionState, c9 as knownModelId, ca as mcpClientConfig, cb as migrateLegacyPlan, cc as migratePlanState, cd as migrateTask, ce as opsFlag, cf as ownerOnlyConfigFile, cg as partedPromptUsage, ch as planDirectLaunch, ci as planShellLaunch, cj as plannerContextFill, ck as posixShellQuote, cl as removeTaskFromPlan, cm as renumberTasks, cn as resolveModelShortcut, co as resolveProvider, cp as sharedMcpServer, cq as stripAnsi, cr as toApprovalDecision, cs as toOrchestratorOptions, ct as updateTaskInPlan, cu as usageLine, cv as validateModifiedPlan, cw as warningsText, cx as windowsCommandLine, cy as wrapWithPty } from './Task-BnLxkVQF.js';
+import { z as TaskOp, M as MergeGateView, r as SessionBroadcaster, A as ApplyTaskOpsResult, s as SessionMessage, t as SessionNotice, x as TaskLogEvent } from './plan-utils--kQRzSE-.js';
+export { a as ApprovalBlock, b as ApprovalStatus, C as CHECKPOINT_TRUNCATE_LENGTH, c as ConversationInput, d as ConversationView, D as DiffRow, e as DiffRowKind, f as DiffStat, g as DisplayBlock, E as EMPTY_CONVERSATION, h as EMPTY_HOLD, i as EMPTY_TASK_LOG, G as GatedConversation, L as LocalEntry, j as MessageBlock, k as MessageRole, N as NOT_STARTED, l as NO_TURN, m as NewTaskFields, O as OutputPreview, P as PlanBlock, n as PlanMarkerStatus, o as PromptHold, S as SerializedPlan, p as SerializedTask, q as SerializedTaskStatus, u as SubagentBlock, v as SubagentChild, w as SubagentStatus, T as TakenPrompt, y as TaskLogView, B as TaskRef, F as TaskRowAction, H as TaskRowContext, I as TaskRowIsolation, J as TaskRowKind, K as TaskRowPlacement, Q as TaskRowSubject, R as TaskRowView, U as TaskStatusKind, V as ThinkingDisplayBlock, W as ToolBlock, X as ToolHeadline, Y as ToolStatus, Z as TurnGate, _ as UsageBlock, $ as aheadOfDraft, a0 as applyTaskOps, a1 as approvalLabel, a2 as awaitingLabel, a3 as canMergeTasks, a4 as canSetDependencies, a5 as canSplitTask, a6 as capConflictFiles, a7 as classifyOutcome, a8 as coalesceTaskLog, a9 as dependencyCandidates, aa as dependentsNotice, ab as dependentsOf, ac as diffRows, ad as diffStat, ae as diffSummary, af as digestTaskLog, ag as drainNext, ah as executionSummary, ai as followTurn, aj as fromTranscript, ak as hasHiddenDetail, al as holdPrompt, am as isTaskRunning, an as markAction, ao as markRequestFor, ap as namedRepos, aq as newTaskFields, ar as opsEditable, as as outputLines, at as outputPreview, au as parseTaskOpsJson, av as pastGateConfirmation, aw as reduceConversation, ax as reduceTaskLog, ay as replayTaskLog, az as runnerToolSubject, aA as serializePlan, aB as serializeTask, aC as serializeTaskStatus, aD as stopTurn, aE as summarizeToolCall, aF as taskRowActions, aG as taskRowView, aH as taskStartedNotice, aI as taskStatusKind, aJ as textHasTaskOps, aK as titledRefs, aL as toTaskLogEvent, aM as toolHeadline, aN as trimToolOutput, aO as truncateCheckpointSummary, aP as unsendAll, aQ as unsendLatest } from './plan-utils--kQRzSE-.js';
+import { I as IFileSystem, R as ReadFileOpts, T as ToolOutcome, b as GrepOptions, a as GlobOptions, F as FindSymbolOptions } from './IFileSystem-DofiRcCo.js';
+export { G as GREP_DEFAULT_HEAD_LIMIT, c as GrepOutputMode, S as SEARCH_EXCLUSIONS } from './IFileSystem-DofiRcCo.js';
+import { R as RunnerModeInfo } from './ModeResolver-DkMYf4uS.js';
+export { M as ManifestLookup, a as autonomyLevelLabel, b as buildModeGuide, f as filteredBuildModes, p as parseAutonomyLevel, r as resolveDefaultMode, c as resolveTaskMode, d as runnerModesFrom } from './ModeResolver-DkMYf4uS.js';
 import { ChildProcess } from 'child_process';
-import { b as PlanParseError } from './parsing-COPG8-Ep.js';
-export { P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, T as TASK_OPS_ENVELOPE_KEY, c as TASK_QUERY_ENVELOPE_KEY, d as checkDepsResolve, e as checkImmutableLog, f as checkInProgress, g as checkNoCycles, h as checkUniqueIds, i as escapeControlCharsInStrings, j as extractJsonObject, k as extractObjectWithBalance, l as extractObjectsWithKey, m as looksLikePlanAttempt, o as opensWithJsonObject, p as parsePartialPlan, n as parsePlanJson, s as stripModelNoise, q as stripTrailingCommas, v as validatePlanModification } from './parsing-COPG8-Ep.js';
-export { resolveOrderLabel, taskOrderLabel } from './order-labels.js';
+import { b as PlanParseError } from './parsing-ddZXZFP4.js';
+export { P as PLAN_ENVELOPE_KEY, a as PartialPlanTask, c as PlanTaskError, d as PlanTasksResult, T as TASK_OPS_ENVELOPE_KEY, e as TASK_QUERY_ENVELOPE_KEY, f as checkDepsResolve, g as checkImmutableLog, h as checkInProgress, i as checkNoCycles, j as checkUniqueIds, k as escapeControlCharsInStrings, l as extractJsonObject, m as extractObjectWithBalance, n as extractObjectsWithKey, o as looksLikePlanAttempt, p as opensWithJsonObject, q as parsePartialPlan, r as parsePlanJson, s as stripModelNoise, t as stripTrailingCommas, v as validatePlanModification, u as validatePlanTasks } from './parsing-ddZXZFP4.js';
+export { resolveOrderLabel, taskOrderLabel, taskRef, titledTaskRef } from './order-labels.js';
 import 'events';
+import 'zod/v4';
 
 interface SessionMeta {
     id: string;
@@ -935,6 +936,8 @@ interface CliAgentAiServiceDeps extends Partial<AgentProcessDeps> {
     createAdapter?: (runner: string, deps: AgentProcessDeps) => AgentAdapter | null;
     /** Workspace root the agent explores. Defaults to the host process's cwd. */
     workspaceRoot?: () => string;
+    /** Where a conversation's planner tools are served (ADR-0022). Absent: every planner gets the envelopes. */
+    mcpServer?: OrdewellMcpServer;
 }
 /**
  * A coding agent driven as Ordewell's planner (ADR-0009).
@@ -963,6 +966,11 @@ declare class CliAgentAiService implements IAiService {
      */
     private lastNativeSessionId;
     private conversation;
+    private readonly mcpServer;
+    /** The planner token the running process was spawned with; revoked with the process (ADR-0022, A3). */
+    private plannerToken;
+    /** Whether the running planner was spawned with its tools and the CLI reported them connected. */
+    private toolsAttached;
     private activeAbort;
     /**
      * Every subagent this conversation has reported starting, and finishing.
@@ -981,6 +989,8 @@ declare class CliAgentAiService implements IAiService {
      * on the old model. No conversation yet is vacuously "current".
      */
     conversationMatchesConfig(): boolean;
+    /** Whether this conversation's planner submits through the Ordewell MCP server rather than the envelopes. */
+    plannerToolsAttached(): boolean;
     /** The agent's own session id, a resumption hint only — Ordewell's transcript is authoritative (T4). */
     nativeSessionId(): string | null;
     reset(): void;
@@ -1008,6 +1018,10 @@ declare class CliAgentAiService implements IAiService {
      * mode from here without changing this signature.
      */
     private startAdapter;
+    /** Spawn with the Ordewell server injected. False, with nothing left running, when it did not connect. */
+    private startWithTools;
+    /** Kill the planner process, and with it the token it was spawned with. */
+    private disposeAdapter;
     /**
      * The live agent process, restarted from its own session id if it died
      * between turns. Resume is a hint: when it fails, the caller's next
@@ -1036,6 +1050,15 @@ declare class CliAgentAiService implements IAiService {
     sendPlanningPrompt(prompt: string, runners: RunnerId[], runnerModes?: Record<RunnerId, RunnerModeInfo[]>, autonomousDefault?: boolean): Promise<Task[]>;
 }
 
+/**
+ * The planner tools a session offers its conversation (ADR-0022). A backend
+ * that can inject the Ordewell MCP server into its planner issues a planner
+ * token bound to `sessionId` and these handlers; any other ignores the offer.
+ */
+interface PlannerToolsOffer {
+    sessionId: string;
+    handler: PlannerToolHandler;
+}
 /**
  * Everything the conversation loop needs to start planning (ADR-0002).
  * The AI service keeps the tool-use message history internally across turns;
@@ -1072,6 +1095,7 @@ interface ConversationRequest {
      * carries the user's new message.
      */
     initialMessage?: string;
+    plannerTools?: PlannerToolsOffer;
 }
 /**
  * One planner turn's outcome. The planner talks to the user (`message`),
@@ -1134,6 +1158,13 @@ interface IAiService {
      * `continueConversation`, restart instead so the new model takes effect.
      */
     conversationMatchesConfig?(): boolean;
+    /**
+     * Whether the planner reads the catalog and submits plans through Ordewell's
+     * MCP tools (ADR-0022). Optional, and false when absent: only a harness
+     * planner the server attached to has them, and every other planner keeps
+     * the per-turn catalog and the envelopes.
+     */
+    plannerToolsAttached?(): boolean;
     /**
      * Optional: prune bulky raw tool output out of the live conversation, in
      * place, keeping subagent digests. Returns the characters removed. Absent
@@ -1486,6 +1517,12 @@ interface IsolationRunControllerDeps {
     notifications: INotification;
     workspaceRoot: () => string;
     listener: IsolationRunListener;
+    /**
+     * The tasks no clean-up of the whole run may take a worktree from: an
+     * attempt is running them, or the plan has them in progress or waiting on
+     * the user mid-attempt.
+     */
+    liveTasks: () => ReadonlySet<string>;
 }
 /**
  * The lifecycle of a plan's isolation run (ADR-0013, ADR-0014, ADR-0020),
@@ -1502,6 +1539,7 @@ declare class IsolationRunController {
     private readonly notifications;
     private readonly workspaceRoot;
     private readonly listener;
+    private readonly liveTasks;
     private run;
     /** Copied paths already reported for the current run: every task gets the same copies. */
     private reportedCopies;
@@ -1530,6 +1568,7 @@ declare class IsolationRunController {
     get blocked(): boolean;
     /** What the plan persists of isolated execution; null when no run ever isolated. */
     get planIsolation(): PlanIsolation | null;
+    /** The one guard of every action on the run: a plan that never isolated is a request refused, not a fault. */
     requireRun(): IsolationRun;
     /** A task's record in the open run, only while that run isolates. */
     openRecord(taskId: string): IsolationTaskRecord | undefined;
@@ -1573,20 +1612,27 @@ declare class IsolationRunController {
      */
     continueBlocked(how: 'stash' | 'shared'): Promise<(() => Promise<void>) | null>;
     /**
-     * The one place an attempt's working directory is decided: the worktree
-     * prepared for it in an isolated run, the kept one for a conflict repair,
-     * else the workspace root. `worktree` says which. Does not itself report a
-     * worktree it creates as a change — the caller does once the attempt is
-     * committed as running, so a spawn abandoned or failed after this settles
-     * is not misreported as a change that stuck.
+     * The working directory of an attempt that may run in a worktree — which
+     * attempts do is the attempt kind's to say (see `attemptKind.attemptCwd`):
+     * the worktree prepared for it in an isolated run, the kept one for a
+     * conflict repair, else the workspace root. `worktree` says which. Does not
+     * itself report a worktree it creates as a change — the caller does once
+     * the attempt is committed as running, so a spawn abandoned or failed after
+     * this settles is not misreported as a change that stuck.
      */
     attemptCwd(task: Task, opts: {
         repair: boolean;
-        ops?: boolean;
     }): Promise<{
         cwd: string;
         worktree: boolean;
     }>;
+    /** The workspace root, for an attempt that runs outside any worktree. */
+    workspaceCwd(task: Task): Promise<{
+        cwd: string;
+        worktree: boolean;
+    }>;
+    private reopenCwd;
+    private prepareCwd;
     /**
      * Land a task's work on the run's integration branches. The record is
      * reported changed once the landing is set and before the first merge, so
@@ -1623,10 +1669,11 @@ declare class IsolationRunController {
      */
     refreshInHead(): Promise<boolean>;
     /**
-     * The tracked state of the workspace as an ops task starts, for
-     * {@link filesChangedSince} (ADR-0020). Null where the check does not run:
-     * a run that shares the workspace root, where every task's edits land in
-     * it, or a workspace git cannot isolate at all.
+     * The tracked state of the workspace as an attempt whose tree is checked
+     * starts (see `attemptKind.checksTree`), for {@link filesChangedSince}
+     * (ADR-0020). Null where the check does not run: a run that shares the
+     * workspace root, where every task's edits land in it, or a workspace git
+     * cannot isolate at all.
      */
     snapshotWorkspace(): Promise<TreeSnapshot | null>;
     /** Tracked files changed since `snapshot`; none when the run has since gone on in the workspace root. */
@@ -1641,7 +1688,9 @@ declare class IsolationRunController {
     /**
      * Mark which added task resolves which conflict. The resolver merges the
      * conflicted task's branch by hand in its own worktree; once that lands, the
-     * conflicted task can land in turn.
+     * conflicted task can land in turn — through the same merge, so a resolver
+     * that did not really bring it along conflicts again instead of being taken
+     * at its word.
      */
     linkResolver(resolverId: string, conflictedId: string): void;
     /** The conflicted task a landed resolver was added for, forgotten as it is returned. */
@@ -1656,11 +1705,28 @@ declare class IsolationRunController {
      * HEAD somehow does not contain stays for the next run's sweep.
      */
     merge(): Promise<IsolationMergeResult>;
-    /** Worktrees and task branches go; the integration branch and the record stay for review and merge. */
+    /**
+     * Worktrees and task branches go; the integration branch and the record stay
+     * for review and merge. Refused while a task of the run is still live.
+     */
     cleanup(): Promise<void>;
-    /** The run and everything it made go, and the plan forgets it; the next run starts afresh. */
+    /**
+     * The run and everything it made go, and the plan forgets it; the next run
+     * starts afresh. Refused while a task of the run is still live.
+     */
     discard(): Promise<void>;
+    /** The records of tasks still live, whose worktrees no clean-up of the whole run may take. */
+    private liveRecords;
+    private refuseWhileLive;
+    /**
+     * Clear a settled run up once everything it landed is merged — and only
+     * when nothing else is left in it: a live task, or a worktree holding work
+     * that never landed, keeps the whole run, worktrees and branches, rather
+     * than leaving that work to a deletion.
+     */
     private clearMerged;
+    /** Say what a removal kept back instead of deleting: where the work went, or which worktree stayed. */
+    private report;
     private forget;
     private assess;
     private activate;
@@ -1977,8 +2043,18 @@ declare class TaskOrchestrator {
      * task whose spawn always throws.
      */
     private onHold;
-    /** The plan's isolation run and the open run's lifecycle (ADR-0013); see {@link IsolationRunController}. */
-    private runs;
+    /**
+     * Tasks Mark complete is landing after it ended their attempt: in progress
+     * with no attempt for as long as that takes, and not orphans for it.
+     */
+    private completing;
+    /**
+     * The plan's isolation run and the open run's lifecycle (ADR-0013); see
+     * {@link IsolationRunController}. Read and acted on there directly, except
+     * Merge all: that goes through {@link mergeRun}, which keeps it apart from
+     * ops tasks and starts the tasks its merge lets through.
+     */
+    readonly runs: IsolationRunController;
     /** A passed attempt's work onto the integration branch, and the conflict repair a landing may need. */
     private landing;
     private registry;
@@ -2023,13 +2099,24 @@ declare class TaskOrchestrator {
     private envForTask;
     approveCheckpoint(taskId: string): void;
     rejectCheckpoint(taskId: string, reason?: string): void;
-    private atCheckpoint;
+    /** What the task's waiting checkpoint asks, whole; undefined once it settles or when none waits. */
+    getCheckpointQuestion(taskId: string): string | undefined;
+    awaitsCheckpoint(taskId: string): boolean;
     /**
      * Send a structured task a user message (ADR-0018, M1). Mid-turn it queues
      * behind the turn; a task waiting for input takes it at once and is back in
      * progress. Returns the message's id, for {@link removeQueuedTaskMessage}.
      */
     sendTaskMessage(taskId: string, text: string): string;
+    /**
+     * Force send (ADR-0023, F1–F3): interrupt the running turn and deliver the
+     * message as the next one, ahead of anything queued, without the task
+     * waiting for input in between. A task already waiting for input just takes it.
+     */
+    forceSendTaskMessage(taskId: string, text: string): string;
+    private messageTask;
+    /** Force send a message still queued behind the running turn; false once the runner has it. */
+    forceSendQueuedTaskMessage(taskId: string, id: string): boolean;
     /** Take back a message still queued behind a turn; false once it was delivered. */
     removeQueuedTaskMessage(taskId: string, id: string): boolean;
     /** Stop a structured task's running turn; it then waits for input like any turn that ends without its marker. */
@@ -2064,30 +2151,13 @@ declare class TaskOrchestrator {
     /** Task id → session id of every attempt whose runner is up; a spawn in flight has no session yet. */
     get activeSessionMap(): Map<string, string>;
     getAttempt(taskId: string): TaskAttemptSnapshot | undefined;
-    /** Where a task's isolated work stands; null when the plan has no isolation run to speak of. */
-    getTaskIsolation(taskId: string): TaskIsolation | null;
-    /**
-     * The plan's isolation as a surface shows it, for one with no stream to have
-     * told it — a reconnected webview, a session just loaded. Null without a run.
-     */
-    isolationView(): IsolationView | null;
     getAttemptSession(taskId: string): ITerminalSession | undefined;
     get queuedCount(): number;
-    /** A run is waiting on the user to stash or to go on without isolation. */
-    get awaitingIsolationChoice(): boolean;
-    /**
-     * Take over a plan's persisted isolation, or none for a plan that has not
-     * isolated yet, pruning what a crashed process left behind. Silent on the
-     * observer: adopting is not a change to persist.
-     */
-    adoptIsolation(state: PlanIsolation | null): Promise<void>;
-    reviewRunDiff(): Promise<string>;
     /**
      * "Merge all"; a settled run that merged everything is cleared up and
      * forgotten. During a run it merges what has landed and the run goes on:
      * the tasks waiting at a merge gate for that work then start (ADR-0020).
-     * Never while an ops task runs, and no ops task starts until it ends — the
-     * one overlap the plan cannot order, because the merge is the user's.
+     * Never alongside ops work, either way round ({@link mergeExcludes}).
      */
     mergeRun(): Promise<IsolationMergeResult>;
     /**
@@ -2102,13 +2172,7 @@ declare class TaskOrchestrator {
      * the task has started, and for every other task.
      */
     getMergeGate(taskId: string): string[];
-    /** Worktrees and task branches go; the integration branch and the record stay for review and merge. */
-    cleanupRun(): Promise<void>;
-    /** The run and everything it made go, and the plan forgets it; the next run starts afresh. */
-    discardRun(): Promise<void>;
     private watchBlockingPrompts;
-    /** What the plan persists of isolated execution; null when no run ever isolated. */
-    get isolationRecord(): PlanIsolation | null;
     /** The transport the plan's latest run copied from the setting; null before its first run. */
     get runnerTransport(): RunnerTransport | null;
     /** Take over a saved plan's copied transport. The next run copies the setting afresh. */
@@ -2136,6 +2200,30 @@ declare class TaskOrchestrator {
     start(): Promise<void>;
     private haltOnFailure;
     stop(): void;
+    /** Name the tasks a stop took down, so none is mistaken for one still at work. */
+    private sayStopped;
+    /**
+     * A task in progress with no attempt has nothing running it: a stop, a plan
+     * load or anything else that ended its attempt left its status behind. It
+     * is put back to not started, and said, so it can be retried rather than
+     * read as running — or, in an isolated run, count as live work forever.
+     */
+    private recoverOrphans;
+    /**
+     * Task ids still live, whose worktrees no clean-up of the whole run may
+     * take: an attempt is running them, or the plan has them in progress or
+     * waiting on the user mid-attempt — at a checkpoint, or for input. One
+     * waiting on the user's decision instead (a conflict, a usage limit, files
+     * an ops task changed) is not: no runner is at work on it, and a clean-up
+     * keeps what it holds on a branch before its worktree goes.
+     */
+    private liveTaskIds;
+    /**
+     * Whether the run may close with its handoff: no task is live. A handoff
+     * tells the user the run has finished, and a Merge all after it clears the
+     * run up, so neither may happen under a task the plan still shows at work.
+     */
+    private get settled();
     onUserTaskComplete(taskId: string): Promise<void>;
     private onVerdict;
     private afterVerdict;
@@ -2161,24 +2249,17 @@ declare class TaskOrchestrator {
      * the ending attempt freed and never one more than the run allows.
      */
     private settleUnlanded;
-    /**
-     * Mark which added task resolves which conflict. The resolver merges the
-     * conflicted task's branch by hand in its own worktree; once that lands, the
-     * conflicted task's branch is already on the integration branch and it can
-     * land in turn — through the same merge, so a resolver that did not really
-     * bring it along conflicts again instead of being taken at its word.
-     */
-    linkConflictResolver(resolverId: string, conflictedId: string): void;
     private landResolved;
     getReadyTasks(): Task[];
     private readiness;
     /**
-     * Open the run a task starts in, and for a change task decide whether it
-     * isolates (ADR-0020): an ops task needs no worktree, so it never waits on
-     * that choice. False while a dirty tree waits on the user; `resume` is what
-     * their choice replays.
+     * Open the run a task starts in, and decide whether it isolates if the
+     * task's next attempt needs that ({@link decidesIsolation}). False while a
+     * dirty tree waits on the user; `resume` is what their choice replays.
      */
     private openFor;
+    /** The kind a task's next attempt starts as, short of a repair or a continue: what is weighed before one exists. */
+    private nextAttemptKind;
     /**
      * Cancel a running (or scheduled) task: kill its session and return it to
      * 'pending' — "not executed". The task is put on hold so the scheduler
@@ -2290,11 +2371,6 @@ declare class TaskOrchestrator {
     private abandonSpawn;
     private tell;
     private say;
-    /**
-     * Whether the run in force, or else the next one, gives each task its own
-     * worktrees, and of which repo group — what the planner is told.
-     */
-    plannerIsolation(): Promise<IsolatedExecution>;
     /**
      * Replay the start a dirty tree turned away. `stash` puts the user's tracked
      * changes on the git stash first, so the run isolates; `shared` runs this one
@@ -2487,7 +2563,9 @@ declare class RunnerInstallation {
      * typing a real goal is the failure this exists to prevent.
      *
      * "Usable" is deliberately shallow: the binary answers `--version`, and the
-     * runner declares a planner transport. Whether the user's subscription is
+     * runner has a connector to plan over. Plugin runners have none yet: a
+     * manifest-level planner capability, so a plugin can declare itself
+     * plannable, is a follow-up. Whether the user's subscription is
      * live cannot be known without spending a turn on it, so an expired login
      * surfaces where it actually bites — as the agent's own error text on the
      * first turn.
@@ -2641,7 +2719,7 @@ interface EnvAdmission {
  */
 declare function admitSettingsEnv(env: Record<string, unknown>): EnvAdmission;
 
-/** Whether a runner's tasks can run on the structured transport. */
+/** Whether a runner's tasks can run on the structured transport (ADR-0018, S3). */
 declare function supportsTaskMode(runner: string): boolean;
 /** The adapter that drives one task. Throws {@link TaskModeUnsupportedError} for a runner without a connector. */
 declare function createTaskAdapter(runner: string, deps: AgentProcessDeps): TaskModeAgentAdapter;
@@ -2727,20 +2805,10 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     protected static parse<T>(line: string): T | null;
 }
 
-/**
- * Claude Code as a planner, over its bidirectional streaming-JSON transport
- * (ADR-0009).
- *
- * `-p --input-format stream-json --output-format stream-json` keeps one process
- * alive across turns: user messages go in as JSON lines, and the session's
- * assistant blocks, tool uses, tool results and turn boundaries come back the
- * same way. It is the richest of the three streams — partial messages and
- * separate thinking blocks — which is why this agent went first.
- */
 declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAgentAdapter {
     readonly agentId = "claude-code";
-    private interruptCount;
-    /** Interrupts sent and not yet acknowledged, by request id. */
+    private controlCount;
+    /** Control requests sent and not yet answered, by request id. */
     private readonly pendingControl;
     /** An interrupt was sent during the current turn, so an aborted result is that interrupt, not a failure. */
     private interruptRequested;
@@ -2779,6 +2847,14 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     private requestedMode;
     /** The session `--resume` asked for, until the CLI's `init` shows it was taken up. */
     private pendingResume;
+    /** The `--mcp-config` file of the running process, which holds its token; removed with the process. */
+    private mcpConfig;
+    /** Whether this process was given the server, so its tools' requests are Ordewell's own. */
+    private givenOrdewell;
+    /** Messages written into a running task turn, by the `uuid` their echo will carry, until it does (ADR-0023). */
+    private readonly steers;
+    /** The last turn's `result` ended it, so a steer's echo now opens a turn the CLI started for that message. */
+    private turnClosed;
     protected spawnSpec(opts: AgentStartOptions): SpawnSpec;
     /**
      * A task's run: the manifest decides what its mode and effort mean
@@ -2789,6 +2865,12 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
      * without it `-p` refuses them silently and nothing can ever surface one.
      */
     private taskSpawnSpec;
+    /** The file holding the token lives exactly as long as the process that reads it. */
+    private ordewellServerArgs;
+    private removeMcpConfig;
+    start(opts: AgentStartOptions): Promise<void>;
+    /** Asks the CLI itself, which reports `pending` until its connection attempt settles. */
+    mcpAttached(): Promise<boolean>;
     /**
      * Claude Code's soft interrupt: the turn stops, the process and its session
      * stay. The CLI acknowledges on the control channel, then closes the turn
@@ -2796,6 +2878,17 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
      * as an interrupted `turn_end`.
      */
     interrupt(timeoutMs: number): Promise<boolean>;
+    /**
+     * A `user` line written mid-turn is Claude Code's own queue (ADR-0023): the
+     * CLI attaches it to the next tool result, or runs it as a turn of its own
+     * after `result` — an interrupted one included — so it never lets go of one,
+     * and nothing is ever reported dropped. Refused while an interrupt is in
+     * flight, and before a `--resume` is taken up: a refused resume closes stdin
+     * with the message unread.
+     */
+    steer(id: string, text: string): Promise<boolean>;
+    /** Send a control request and wait for its answer; null when none came in time or the process ended. */
+    private control;
     /**
      * A `--resume` the CLI cannot find is answered at once with an error result
      * and no `init`, after which it waits on stdin for input it never reads — a
@@ -2813,6 +2906,13 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     dispose(): void;
     private clearFollowOnTimer;
     protected turnPayload(message: string): string;
+    private openTurnState;
+    /**
+     * The echo of a steered message: the model has it. After a closed turn it
+     * opens the CLI's own turn for the message, which then runs like one Ordewell
+     * sent. The first prompt is echoed too, and is no steer.
+     */
+    private steerDelivered;
     protected handleLine(line: string, emit: (event: AgentEvent) => void): void;
     /**
      * `--permission-mode auto` on a model or account without auto mode is not
@@ -2880,10 +2980,7 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     private startOpts;
     /** Whether this turn has already emitted prose — see the `agentMessage` case. */
     private turnHasText;
-    /**
-     * The turn in flight. Its id arrives with `turn/started` or the `turn/start`
-     * response, whichever lands first; `turn/interrupt` cannot be sent without it.
-     */
+    /** The turn in flight. `turn/interrupt` and `turn/steer` cannot be sent before it has an id. */
     private turn;
     /** The JSON-RPC id of the `turn/start` that opened {@link turn}. */
     private turnRequestId;
@@ -2891,6 +2988,12 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     private endedTurnId;
     /** An interrupt was asked for during this turn, so however it ends, it was cut short. */
     private interruptRequested;
+    /**
+     * Turns an interrupt cut short. Codex leaves their command running and
+     * reports it when it ends, inside whatever turn is live by then — a report
+     * that belongs to no turn of the agent's any more (ADR-0023, F4).
+     */
+    private readonly interruptedTurnIds;
     /** An interrupt asked for before Codex named the turn, sent once it does. */
     private interruptOnStart;
     /** A task's approval requests still waiting for an answer, by the request id as a string. */
@@ -2900,11 +3003,16 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
      * names only the item, and a person deciding needs to see the files.
      */
     private readonly fileChangePaths;
+    /** The row each announced file of an in-flight `fileChange` item is shown under, by the file's shown path. */
+    private readonly fileChangeRows;
     /** Requests this adapter sent and awaits an answer to, by JSON-RPC id. */
     private readonly pendingRequests;
     private resumeAttempted;
     private resumeFallbackSent;
     private sandbox;
+    /** The Ordewell server's startup state, as Codex last reported it for this thread. */
+    private mcpStartup;
+    private mcpStartupSettled;
     /**
      * Subagent threads this session has spawned, keyed by the child thread id.
      * Codex runs a subagent in its own thread and replays both threads' events on
@@ -2931,6 +3039,12 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
      */
     private startThread;
     private threadParams;
+    /**
+     * Codex's own startup report for the server, which it sends once the thread
+     * has tried to connect (ADR-0022, S4). A report that came before this was
+     * asked is kept, so asking late still gets the answer.
+     */
+    mcpAttached(): Promise<boolean>;
     private effort;
     /**
      * `turn/interrupt` names the turn as well as the thread, so an interrupt
@@ -2938,6 +3052,17 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
      * with an empty result, then ends the turn as `interrupted`.
      */
     interrupt(timeoutMs: number): Promise<boolean>;
+    /**
+     * `turn/steer` into the running turn (ADR-0023). Codex answers with the
+     * turn's id at once — acceptance, not delivery — and shows the input to the
+     * model after the item in flight, as a `userMessage` item carrying the
+     * `clientUserMessageId` sent; that item is the delivery. The request needs
+     * the turn's id, so a steer asked for before Codex named the turn waits for
+     * it, as an interrupt does. Refused when the turn has ended or is another one.
+     */
+    steer(id: string, text: string): Promise<boolean>;
+    /** The one way input reaches a running turn: a task message, or a deny note. */
+    private requestSteer;
     /**
      * Answer an open approval in its own result schema. Codex's decline carries
      * no message, so a deny note reaches the agent as input steered into the
@@ -2947,7 +3072,15 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     protected turnPayload(message: string): string;
     protected handleLine(line: string, emit: (event: AgentEvent) => void): void;
     private turnStarted;
+    /**
+     * Ahead of the event that ends the turn: a steer Codex accepted and the turn
+     * never consumed is gone — Codex keeps no queue across turns — and one not
+     * yet accepted never will be (ADR-0023, D4).
+     */
     private closeTurn;
+    private fromInterruptedTurn;
+    /** The `userMessage` item a steer turns into once the item before it completes: the model has it. */
+    private steerDelivered;
     /**
      * The child thread id when `threadId` names a subagent's thread, or undefined
      * for the planner's own. Codex replays both threads on one stream and only
@@ -2987,6 +3120,16 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     /** A tool item entering `inProgress` — announce the call so the timeline moves. */
     private emitItemStart;
     private emitItemDone;
+    /**
+     * One row per changed file: a patch is several files, and one row naming
+     * them all reads as a single cut-off path. The first file keeps the item's
+     * id, which an approval for the patch points at. Announcing a file twice
+     * returns the row it already has, so a change first seen completed still
+     * gets its call.
+     */
+    private announceFileChange;
+    /** Relative to the task's worktree, where every path but a stray one lies; a move names both ends. */
+    private shownChangePath;
     /**
      * A `collabAgentToolCall` — the planner spawning, waiting on or messaging a
      * subagent. The call itself is planner-level tool activity; the lifecycle it
@@ -3034,17 +3177,18 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
     private readonly processEnded;
     private planner;
     private task;
-    /** Whether this turn has already emitted reply text — see {@link emitPart}. */
-    private turnHasText;
     /** The last assistant message already settled — the baseline {@link recoverReply} measures a new reply against. */
     private lastAssistantId;
     private taskTurn;
     /** An abort was posted during the current task turn, so the idle that follows ends it as interrupted. */
     private interruptRequested;
-    /** A task's requests waiting for an answer, by request id, with the session that asked. */
-    private readonly openPermissions;
+    private readonly permissions;
+    /** Messages handed into the running task turn, until the model reads them (ADR-0023). Kept across turns: the server keeps the message too. */
+    private readonly steers;
     /** Set once the server turns out to speak the 2.x API, which then owns the session. */
     private v2;
+    /** The Ordewell server this process was configured with; null when none was given or its config could not be merged. */
+    private ordewell;
     constructor(deps: AgentProcessDeps);
     start(opts: AgentStartOptions): Promise<void>;
     send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal, onActivity?: () => void): Promise<void>;
@@ -3058,6 +3202,20 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
      * {@link recoverReply}, never applies.
      */
     private sendTask;
+    /**
+     * The prompt that carries a task message: the mode as the agent, the task
+     * model and effort, and only `question` withheld. A steer names its own
+     * `messageID` so the frames can be told apart from the first prompt's.
+     */
+    private taskPromptBody;
+    /** Hand a message into the running task turn (ADR-0023, D2), naming it so its delivery is observable. */
+    steer(id: string, text: string): Promise<boolean>;
+    /**
+     * Messages handed over but unread when the turn ended. Each is deleted from
+     * the session — so the next turn's re-send is not a duplicate — and reported
+     * dropped, which is what puts it back in Ordewell's queue.
+     */
+    private dropUnreadSteers;
     /**
      * Whatever of the turn's own messages the stream missed. Each part is
      * emitted once, so a turn the stream saw whole adds nothing here; one that
@@ -3145,52 +3303,21 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
      * none of this turn's business.
      */
     private onFrame;
-    /**
-     * Stream one piece of a reply text part. The part's paragraph break goes out
-     * with its first visible delta, so the deltas add up to exactly the text the
-     * completed part then re-sends; a part that is only whitespace so far is
-     * held back, for the reason {@link emitPart} drops one.
-     */
-    private onTextDelta;
-    /**
-     * Deny one permission request (T1). OpenCode blocks the turn until the
-     * request is answered, so this must answer — `reject` rather than a silent
-     * drop, which is the same "absent answer is a denial" invariant ADR-0008
-     * states for Ordewell's own tools. The refusal is announced so the timeline
-     * shows the planner reaching for something it may not have.
-     */
-    private denyPermission;
-    /**
-     * A task's request. Under a mode whose manifest sets `approvals: auto` —
-     * `build`, which the terminal transport runs with `--auto` — it is answered
-     * at once with what `run --auto` answers, so the same plan behaves the same
-     * on both transports (ADR-0001), and announced already decided so the log
-     * still shows it. Any other mode leaves it open for an approval card.
-     */
-    private askPermission;
+    /** A planner's request is refused (T1); a task's is answered at once or left open for a card. */
+    private onPermissionAsked;
     /**
      * `POST /permission/:id/reply` is the current answer. The per-session path
      * it replaced is tried only when a server too old to know the new one 404s.
      */
     private replyPermission;
-    /**
-     * Open `/event` for one turn and wait until it is connected. The stream
-     * stopped being best-effort the moment permission answers moved onto it: a
-     * request raised before we connect is one nobody answers, and the turn
-     * hangs on it. Waiting is bounded so a server that never opens `/event`
-     * still gets its turn.
-     */
+    /** `/event` for one turn — see {@link openEventStream}. Load-bearing for {@link onPermissionAsked}. */
     private openStream;
-    /**
-     * Server-sent events from `/event`: the turn's live text, reasoning, tool
-     * activity and usage, and the only channel permission requests arrive on —
-     * so the stream is load-bearing for {@link denyPermission}.
-     */
-    private streamEvents;
     private json;
     private request;
     private headers;
     nativeSessionId(): string | null;
+    /** Asks the server, which lists every MCP server it has with the state of its connection. */
+    mcpAttached(): Promise<boolean>;
     dispose(): void;
     private exitMessage;
 }
@@ -3219,6 +3346,22 @@ interface ForkedDialogue {
     researchLog: ResearchLogEntry[];
 }
 
+/** A read made through a planner tool: refused once the turn's budget is gone, else answered, told to land when the budget asks it to. */
+type ToolRead<T> = {
+    status: 'refused';
+} | {
+    status: 'answered';
+    value: T;
+    landNow: boolean;
+};
+/** A plan or task edit handed to the open turn over a channel other than its reply (ADR-0022). */
+type PlannerSubmission = {
+    kind: 'plan';
+    tasks: Task[];
+} | {
+    kind: 'task_ops';
+    ops: TaskOp[];
+};
 /** Everything (re)opening a conversation needs besides the dialogue itself. */
 type ConversationOpening = Omit<ConversationRequest, 'goal' | 'onProgress' | 'signal' | 'priorHistory' | 'initialMessage'>;
 /**
@@ -3333,13 +3476,36 @@ declare class PlannerConversation {
     private savedInBackground;
     private turnsInFlight;
     private compacting;
-    private openTurnId;
+    private openTurn;
     constructor(host: PlannerConversationHost);
     get transcript(): readonly ConversationMessage[];
     /** Whether a user turn is between its transcript append and its settled outcome. */
     get isTurnInFlight(): boolean;
     /** The user turn being answered, for what the host raises during it — an approval the turn's research asks for. */
     get currentTurnId(): string | undefined;
+    /**
+     * Hand the open turn a plan (already validated) or a task edit. The turn
+     * settles with it exactly as with the same plan or ops parsed out of its
+     * reply, and it wins over any envelope that reply carries. A later
+     * submission replaces an earlier one. False when no user turn is open.
+     */
+    submit(submission: PlannerSubmission): boolean;
+    /**
+     * The edit the open turn already holds, for a further edit in the same reply
+     * to join rather than replace. Empty when it holds nothing; null when it holds
+     * a whole plan, which an edit cannot be layered on.
+     */
+    pendingOps(): TaskOp[] | null;
+    /** Whether the turn would park this edit until a batch boundary instead of applying it as it settles. */
+    editWouldQueue(ops: TaskOp[]): boolean;
+    /**
+     * A read the planner makes through a tool. It spends the same per-turn budget
+     * as an envelope read, so a planner cannot read more by switching channels:
+     * past the soft limit, or on a repeated question, the answer still comes but
+     * is told to land the turn; at the hard limit it is refused. `signature`
+     * names the question, for the repeat check.
+     */
+    read<T>(signature: string, answer: () => Promise<T>): Promise<ToolRead<T>>;
     /** Whether the model still holds this conversation in memory. */
     get isActive(): boolean;
     append(role: ConversationMessage['role'], content: string, opts?: {
@@ -3472,6 +3638,13 @@ declare class PlannerConversation {
      * would cost it the chance to fix the edit.
      */
     private drainTaskQueries;
+    /**
+     * The backend's answer, with what was handed in while it ran standing in
+     * for whatever its reply carried. Taken once: a corrective re-send after a
+     * rejected edit must not settle on the same submission again. A stopped
+     * turn commits nothing, the same as a stopped reply with a plan in it.
+     */
+    private claimSubmission;
     /**
      * Render one read out of live state. Never persisted to the transcript: the
      * detail is context for the planner's next reply, and re-sending it on every
@@ -3498,7 +3671,8 @@ declare class PlannerConversation {
      *
      * The host's catalog is allowlist-filtered, so a restricted allowlist stays a
      * hard bound on every turn, and reads the plan's runners live, so a runner
-     * admitted mid-session by a retarget is shown like every other.
+     * admitted mid-session by a retarget is shown like every other. A planner
+     * with Ordewell's tools gets a reminder to read the catalog instead.
      */
     private catalogBlock;
     /**
@@ -3534,6 +3708,10 @@ declare class SkillsService {
     constructor(workspaceRoot?: string | undefined);
     private localDir;
     private globalDir;
+    private readSeedManifest;
+    private recordSeed;
+    /** A seed the user never edited: safe to replace with a newer built-in. */
+    private isUntouchedSeed;
     private seed;
     seedBuiltinSkill(name: string): boolean;
     /** Removes a retired built-in's seed from the global dir, but only if it's untouched by the user. */
@@ -3579,11 +3757,14 @@ interface SessionEventRelayDeps {
     /** Where isolation notices go, for a host whose notifications are not seen by the user. */
     onNotice?: (notice: SessionNotice) => void;
     store: Pick<PlanStore, 'allTasks' | 'snapshot'>;
-    orchestrator: Pick<TaskOrchestrator, 'getIdleSince' | 'getTaskIsolation' | 'getQueuedTaskMessages' | 'getMergeGate' | 'mergeGateView'>;
+    orchestrator: Pick<TaskOrchestrator, 'getIdleSince' | 'getQueuedTaskMessages' | 'getMergeGate' | 'mergeGateView'>;
+    runs: Pick<IsolationRunController, 'taskIsolation'>;
     /** Shared with the Session, which snapshots, restores and clears it. */
     usage: PlannerUsageLedger;
     /** How many of a task's runner requests wait for an answer (ADR-0018, A1). */
     awaitingApproval?: (taskId: string) => number;
+    /** What a task's waiting checkpoint asks, whole. */
+    checkpointQuestion?: (taskId: string) => string | undefined;
 }
 /** Every orchestrator event the relay announces; `onTaskSettled` is persistence only, so it is the Session's. */
 type RelayObserver = Required<Omit<OrchestratorObserver, 'onTaskSettled'>>;
@@ -3598,8 +3779,10 @@ declare class SessionEventRelay {
     private readonly onNotice?;
     private readonly store;
     private readonly orchestrator;
+    private readonly runs;
     private readonly usage;
     private readonly awaitingApproval;
+    private readonly checkpointQuestion;
     /**
      * The in-flight turn's subagent activity, grouped one run per subagent so a
      * replay nests each step under its own brief/result. Folded into the plan's
@@ -3665,16 +3848,6 @@ declare function openTaskLog(location: TaskLogLocation, taskId: string): TaskLog
  */
 declare function readTaskLog(location: TaskLogLocation, taskId: string, attempt: number): TaskLogEvent[];
 
-/**
- * A direct (non-planner) plan edit the session refused. Distinct from a plain
- * Error so a surface can tell "you asked for something invalid" from "something
- * broke" and say which — the HTTP routes used to collapse both into 404/500,
- * which read to the TUI and VS Code as the edit silently doing nothing. Carries
- * no status code: core is transport-agnostic, the route maps it.
- */
-declare class PlanEditError extends Error {
-    constructor(message: string);
-}
 /**
  * Options for plan generation. Progress is not overridable: every planner
  * progress event is translated to a SessionMessage inside the Session and
@@ -3692,6 +3865,8 @@ interface SessionRuntimeSettings {
     modelAllowlist?: Record<string, string[]>;
     /** Read once as a run starts, never per spawn (ADR-0018, S1). Absent means terminal. */
     runnerTransport?: RunnerTransport;
+    /** Absent means the user never chose, and `config.enabledRunners` (the host's defaults) decides. */
+    enabledRunners?: RunnerId[];
 }
 declare function sessionRuntimeSettings(settings: UserSettings): SessionRuntimeSettings;
 /**
@@ -3724,10 +3899,10 @@ interface ConversationRewind extends ConversationFork {
 type SaveSession = (plan: LegacyPlanState, goal: string, workspace: string, sessionId: string) => void;
 /**
  * Everything a delivery surface constructs to host a session. Structural config
- * (enabledRunners, orchestratorModel, providerModelLists) is snapshotted inside
- * `config` at construction and never re-read from the environment. Runtime
- * settings (tdd, verification) are read live via the `settings` callback so a toggle
- * between generate and execute takes effect.
+ * (orchestratorModel, providerModelLists) is snapshotted inside `config` at
+ * construction and never re-read from the environment. Runtime settings (tdd,
+ * verification, enabled runners) are read live via the `settings` callback so a
+ * toggle between operations takes effect.
  */
 interface SessionDeps {
     config: IConfig;
@@ -3744,7 +3919,7 @@ interface SessionDeps {
     onNotice?: (notice: SessionNotice) => void;
     /** Shared across sessions — sole producer of model catalogs and routing lists. */
     modelResolver: ModelResolver;
-    /** Live runtime settings (tdd, verification). Read at each operation that needs them. */
+    /** Live runtime settings (tdd, verification, enabled runners). Read at each operation that needs them. */
     settings: () => SessionRuntimeSettings;
     /**
      * Host-assigned session id. When set, every persist writes under this id so
@@ -3780,6 +3955,8 @@ interface SessionDeps {
     saveSession?: SaveSession;
     /** Where a structured task's log is saved (ADR-0018, P1). Defaults to a file per attempt beside the session's. */
     openTaskLog?: (location: TaskLogLocation, taskId: string) => TaskLogFile;
+    /** The Ordewell MCP server a harness planner's tools are served from (ADR-0022). Defaults to the process's one. */
+    mcpServer?: OrdewellMcpServer;
 }
 /**
  * The composition root: builds every collaborator a Session drives and wires
@@ -3802,6 +3979,8 @@ interface SessionParts {
     planner: SessionPlanner;
     store: PlanStore;
     orchestrator: TaskOrchestrator;
+    /** The orchestrator's own: Session reads the run and acts on it there, Merge all aside. */
+    runs: IsolationRunController;
     events: SessionEventRelay;
     usage: PlannerUsageLedger;
     approvals: PendingApprovals;
@@ -3830,6 +4009,7 @@ declare class Session {
     private readonly events;
     private readonly planner;
     private readonly orchestrator;
+    private readonly runs;
     private readonly store;
     private readonly config;
     private readonly registry;
@@ -3852,6 +4032,8 @@ declare class Session {
     private currentSessionId;
     private readonly skillsService;
     private readonly conversation;
+    private readonly editor;
+    private readonly plannerTools;
     constructor(parts: SessionParts);
     /**
      * Answer an outstanding approval. Every surface funnels here — the web
@@ -3912,6 +4094,14 @@ declare class Session {
      * session.
      */
     reset(): void;
+    /**
+     * What a planner may assign right now: every enabled runner, its modes, and
+     * its allowlisted models — read as of this call, so a runner enabled or an
+     * allowlist edited since planning started is in it (#69). Discovers a
+     * runner's models the first time it is asked for.
+     */
+    liveCatalog(): Promise<TaskQueryCatalog>;
+    private catalogOf;
     private runnerModesFor;
     /**
      * The catalog a model/task-mode edit is checked against — the same
@@ -3922,6 +4112,8 @@ declare class Session {
      * allowlist itself, the same way `coerceAssignments` does.
      */
     private editCatalog;
+    /** The runners enabled right now — a toggle made since the session was built counts (#69). */
+    private enabledRunners;
     /**
      * The allowlist in force right now. Unset means no restriction — falling
      * back to the one planning started under would keep a restriction the user
@@ -3937,6 +4129,8 @@ declare class Session {
      * variants, not as an id-only stub. Never triggers discovery itself.
      */
     private models;
+    /** What a runner offers, as `runnerAssignment` needs it. Spawns the runner's CLI to list models. */
+    private catalogFor;
     get planState(): LegacyPlanState | null;
     /**
      * The live plan in the shape a saved session is read back as. The disk
@@ -4008,6 +4202,26 @@ declare class Session {
      */
     compactConversation(signal?: AbortSignal): Promise<ConversationCompaction>;
     rewindTargets(): RewindTarget[];
+    /**
+     * Hand the planner turn in flight a validated plan or a task edit; the turn
+     * commits it as it would the same JSON in the planner's reply. False when
+     * no turn is open.
+     */
+    submitToTurn(submission: PlannerSubmission): boolean;
+    /**
+     * A plan the planner submitted through its tool, already checked against the
+     * live catalog. Its runners join `plan.runners` here, so a runner enabled
+     * since planning started is not snapped back by the commit (#69).
+     */
+    private submitPlanFromTool;
+    /**
+     * A task edit the planner made through its tool. Checked against the live
+     * catalog, then handed to the open turn, which commits it as it would the
+     * same ops in a taskOps reply — including parking it behind a running batch,
+     * which the envelope does before any check, so a queued edit is not checked
+     * here either. Edits made in one reply join one batch.
+     */
+    private editPlanFromTool;
     /** Whether the planner conversation is live (started and not yet committed to a plan). */
     get isConversationActive(): boolean;
     /**
@@ -4071,12 +4285,21 @@ declare class Session {
     private finishedWork;
     approveCheckpoint(taskId: string): void;
     rejectCheckpoint(taskId: string, reason?: string): void;
+    /** Whether an answer would reach the task: it waits at a checkpoint and a runner is left to hear it. */
+    awaitsCheckpoint(taskId: string): boolean;
     /**
      * A user message to a structured task (ADR-0018, M1); throws
      * `TaskControlError` for one that cannot take it. A task waiting for input
      * is back in progress, and saved so before any surface is told.
      */
     sendTaskMessage(taskId: string, text: string): string;
+    /**
+     * Force send (ADR-0023, F1): interrupt the task's running turn and deliver
+     * this message next. Throws `TaskControlError` where a plain message would,
+     * and for a task on the terminal transport.
+     */
+    forceSendTaskMessage(taskId: string, text: string): string;
+    forceSendQueuedTaskMessage(taskId: string, id: string): boolean;
     removeQueuedTaskMessage(taskId: string, id: string): boolean;
     interruptTask(taskId: string): Promise<void>;
     getQueuedMessages(): QueuedMessage[];
@@ -4117,14 +4340,7 @@ declare class Session {
      */
     discardRun(): Promise<void>;
     private requireSettledRun;
-    /**
-     * The opt-in way through a merge conflict: add an AI task, on the conflicted
-     * task's own runner and model, that merges its branch by hand in a worktree
-     * of its own. When that task lands, the conflicted one lands through it (see
-     * {@link TaskOrchestrator.linkConflictResolver}). The automatic answer to a
-     * conflict is a repair, a new attempt of the same task (ADR-0015); a task is
-     * only ever added to the plan by this call.
-     */
+    /** Add the task that merges a conflicted task's branch by hand; see {@link PlanEditor.addConflictResolver}. */
     resolveConflictAsTask(taskId: string): Promise<LegacyPlanState | null>;
     stopExecution(): void;
     /**
@@ -4133,88 +4349,19 @@ declare class Session {
      * broadcast — in that order, once. A store op returning false aborts
      * before anything is persisted. PlanStore is the single authority for
      * task state; LegacyPlanState.tasks is populated only at persist time.
+     * Direct edits reach it through the {@link PlanEditor}, which adds the
+     * reschedule they owe.
      */
     private mutatePlan;
-    /**
-     * The direct-edit seam: {@link mutatePlan} plus the reschedule every
-     * structural edit owes an armed scheduler. Nothing else wakes one after a
-     * hand edit — the queue-drain path never runs, because a direct edit never
-     * queues — so a task the edit just unblocked would sit ready and never
-     * start. `tick()` no-ops while the scheduler is idle, so this costs nothing
-     * during plain planning. The planner-driven path re-ticks in
-     * {@link PlannerConversation} instead (`afterEdit`); it must not tick twice.
-     */
-    private editPlan;
-    /**
-     * Patch one task's fields. A hand-set dependency list, or a type flip
-     * between AI and MAN, are the patches that can leave a task incoherent
-     * (unschedulable, or carrying fields that mean nothing for its new type),
-     * so both go through the same {@link validateTaskEdit} guard the planner's
-     * task-ops applier uses (as the 'direct' actor, which skips the lock rule)
-     * rather than a second copy of the rules — and throws, so the surface can
-     * say why. Gated on the task existing so an edit to an unknown id still
-     * falls through to the no-op `store.update` below instead of throwing.
-     */
+    /** Patch one task's fields, checked as the planner's task ops are; see {@link PlanEditor.updateTask}. */
     updateTask(taskId: string, changes: Partial<Task>): Promise<LegacyPlanState | null>;
-    /**
-     * Move one task onto a different runner. Distinct from {@link updateTask}
-     * because a runner change is never a single-field edit: the task's model,
-     * thinking effort and mode are all scoped to its runner, so they are
-     * re-derived from the new runner's catalog (see {@link retargetTaskRunner}).
-     * That needs discovery, which is why it is not a branch inside `updateTask`.
-     *
-     * The runner is also admitted into `plan.runners` — see {@link admitRunner}.
-     */
+    /** Move one task onto a different runner, re-deriving what is scoped to it; see {@link PlanEditor.setTaskRunner}. */
     setTaskRunner(taskId: string, runner: RunnerId): Promise<LegacyPlanState | null>;
-    /** What a runner offers, as {@link runnerAssignment} needs it. Spawns the runner's CLI to list models. */
-    private catalogFor;
-    /**
-     * What a *derived* assignment may draw from: the runner's catalog narrowed to
-     * the user's allowlist. Deriving from the full catalog would hand a task the
-     * runner's first model regardless of a restriction the user set — the next
-     * planner turn's `coerceAssignments` would snap it back anyway, so the user
-     * would see their pick silently change instead of never being offered.
-     *
-     * `catalogFor` stays unnarrowed because {@link admitRunner} caches it as what
-     * the runner really offers, which is what effort clamping needs.
-     */
-    private allowedCatalog;
-    /**
-     * Make a runner a first-class member of this plan. Without this, the next
-     * planner turn's `coerceAssignments` would treat it as disallowed and snap
-     * every task on it back, silently undoing the user's choice; and that same
-     * pass clamps efforts against `modelsCache`, so a catalog missing from there
-     * makes the effort we just derived read as unverifiable.
-     */
-    private admitRunner;
-    /**
-     * Replace one task's dependency list — the named entry point the surfaces'
-     * dependency pickers call. The guard itself lives in {@link updateTask}, so
-     * a dependency list arriving as a plain field patch is rejected by the same
-     * rule instead of slipping past it.
-     */
+    /** Replace one task's dependency list, under the same guard as a field patch; see {@link PlanEditor.setTaskDependencies}. */
     setTaskDependencies(taskId: string, dependencies: string[]): Promise<LegacyPlanState | null>;
-    /**
-     * Delete one task. A running task is cancelled first: the plan can drop it
-     * either way, but nothing can reach its runner afterwards — the tmux session
-     * outlives the plan and the orchestrator keeps counting it as active. The
-     * planner-driven path refuses instead (see {@link applyTaskOps}); a user
-     * deleting their own task means it.
-     */
+    /** Delete one task, cancelling its runner first if it runs; see {@link PlanEditor.removeTask}. */
     removeTask(taskId: string): Promise<LegacyPlanState | null>;
-    /**
-     * Add one task, filling in whatever the caller left unset. A task with no
-     * runnable assignment is not a lighter task but an unspawnable one, so the
-     * runner falls back to the plan's first and the model, effort and mode are
-     * derived from that runner's catalog — the same derivation a runner change
-     * uses ({@link runnerAssignment}), which is why this is async like
-     * {@link setTaskRunner}. Anything the caller did choose survives when the
-     * runner offers it.
-     *
-     * Dependencies naming tasks that don't exist are dropped rather than rejected:
-     * the caller is a picker over the current plan, so a stale id means the plan
-     * moved on, not that the whole task should be refused.
-     */
+    /** Add one task, deriving what the caller left unset; see {@link PlanEditor.addTask}. */
     addTask(draft: Partial<Task>): Promise<LegacyPlanState | null>;
     /**
      * Planner-driven merge: validate compatibility up front, then ask the planner
@@ -4239,6 +4386,19 @@ declare class Session {
     get aiServiceInstance(): IAiService;
 }
 
+/**
+ * A request on the plan the session refused: a direct (non-planner) edit that
+ * is not valid, or an isolation action on a plan with no isolated run to act
+ * on. Distinct from a plain Error so a surface can tell "you asked for
+ * something invalid" from "something broke" and say which — the HTTP routes
+ * used to collapse both into 404/500, which read to the TUI and VS Code as the
+ * edit silently doing nothing. Carries no status code: core is
+ * transport-agnostic, the route maps it.
+ */
+declare class PlanEditError extends Error {
+    constructor(message: string);
+}
+
 /**
  * Where Ordewell keeps machine-global data (settings, daemon tokens, caches,
  * user plugins). A single home for everything not tied to a project directory,
@@ -4263,15 +4423,28 @@ declare function writePrivateFile(filePath: string, content: string): void;
 
 type VerdictListener = (taskId: string, verdict: Verdict) => void;
 type CheckpointListener = (taskId: string, summary: string) => void;
+/** A tool-raised checkpoint whose call went away while its attempt lives on, so nothing is left to answer it. */
+type CheckpointWithdrawnListener = (taskId: string) => void;
 /** Fires on every idleSince transition (null→timestamp on silence, timestamp→null on resume/teardown). */
 type IdleListener = (taskId: string, idleSince: string | null) => void;
 declare class VerdictEngine {
     private markerSeen;
+    private pendingVerdicts;
+    private structuredSessions;
     private markerTails;
     private checkpointCarry;
     private pausedSessions;
     private listeners;
     private checkpointListeners;
+    private withdrawnListeners;
+    /**
+     * The open `checkpoint` tool call per task (ADR-0022, V5): settling it is how
+     * an answer reaches a runner that asked through the tool, where the marker's
+     * answer is typed into the session instead.
+     */
+    private toolCheckpoints;
+    /** The question a task's checkpoint asks, whole, for as long as it waits — by either route. */
+    private checkpointQuestions;
     private idleListeners;
     /**
      * Per-task generation. Replaced on every watch(), clear() and verdict.
@@ -4298,6 +4471,7 @@ declare class VerdictEngine {
     private openApprovals;
     onVerdict(listener: VerdictListener): void;
     onCheckpoint(listener: CheckpointListener): void;
+    onCheckpointWithdrawn(listener: CheckpointWithdrawnListener): void;
     onIdleChange(listener: IdleListener): void;
     /** Advisory silence timestamp for a task, or null if it isn't idle. */
     getIdleSince(taskId: string): string | null;
@@ -4319,15 +4493,40 @@ declare class VerdictEngine {
      * `\n`-terminated line, and the leading newline flushes a partial line.
      */
     private resumeToken;
+    /** What a task's waiting checkpoint asks, untruncated; undefined when none waits. */
+    getCheckpointQuestion(taskId: string): string | undefined;
     approveCheckpoint(taskId: string): void;
     rejectCheckpoint(taskId: string, reason: string): void;
     /**
      * Attach to a spawned session: scan the output tail for the task's completion
      * marker (delivering a verdict immediately while leaving interactive sessions
      * open), scan for checkpoint markers, and on exit produce a failed verdict
-     * when the marker was never observed.
+     * when the marker was never observed. A structured session's `task_complete`
+     * call is evidence too (ADR-0022, V2): whichever signal comes first decides.
+     *
+     * Returns the attempt's generation, what {@link signalComplete} is checked against.
+     */
+    watch(task: Task, session: ITerminalSession): number;
+    /**
+     * The runner's own `task_complete` call (ADR-0022, V1/V3): settles the
+     * attempt exactly as the marker does, unless that attempt is no longer the
+     * task's current one or another signal already settled it.
      */
-    watch(task: Task, session: ITerminalSession): void;
+    signalComplete(taskId: string, generation: number, report: TaskCompleteArgs): void;
+    /** The runner was told something after its evidence so far, so only what it reports from here counts. */
+    private supersede;
+    private acceptVerdict;
+    private publishVerdict;
+    /**
+     * The runner's `checkpoint` call (ADR-0022, V5): raised through the same
+     * listeners as the marker, so the task waits on the user the same way, and
+     * settled by {@link approveCheckpoint} or {@link rejectCheckpoint}. It is
+     * withdrawn, never left hanging, once the attempt is over or the call goes.
+     */
+    raiseCheckpoint(taskId: string, generation: number, question: string, signal: AbortSignal): Promise<CheckpointAnswer>;
+    /** The open `checkpoint` call can no longer be answered: refuse it, and let the task out of the wait. */
+    private callWentAway;
+    private withdrawToolCheckpoint;
     private approvalOpened;
     private approvalClosed;
     /** Scan only the new text plus the unmatched carry, so a long run stays linear. */
@@ -4478,6 +4677,8 @@ declare function buildSubagentSystemPrompt(): string;
 interface ConversationVariant {
     /** Harness planner (ADR-0009): the agent owns its own tools and research budget. */
     harness?: boolean;
+    /** The planner reads the catalog and submits the plan through Ordewell's MCP tools (ADR-0022), not the JSON envelope. */
+    plannerTools?: boolean;
     /** Every AI task gets its own worktree (ADR-0013), so file overlap no longer forces an order; of every repo of a group (ADR-0014). */
     isolatedExecution?: IsolatedExecution;
 }
@@ -4497,13 +4698,13 @@ declare function buildModifyDuringExecutionPrompt(executionLog: TaskSnapshot[],
  * task-ops protocol (with the "merge" op) is injected alongside it by
  * `planContextBlock`. The model emits a single taskOps merge op.
  */
-declare function buildMergePrompt(taskIds: string[], tasks: readonly Task[]): string;
+declare function buildMergePrompt(taskIds: string[], tasks: readonly Task[], tools?: boolean): string;
 /**
  * User-message prompt for a planner-driven split: asks the model to decompose
  * one task into a sequence of smaller tasks. The model decides the breakdown —
  * the user does not hand-type the parts.
  */
-declare function buildSplitPrompt(taskId: string, tasks: readonly Task[]): string;
+declare function buildSplitPrompt(taskId: string, tasks: readonly Task[], tools?: boolean): string;
 /**
  * Runner prompt for the opt-in task that resolves an integration conflict
  * (ADR-0013). The resolver's own worktree starts at the integration tip, so the
@@ -4682,6 +4883,18 @@ declare function summarizeOutput(reviewReason: string | undefined, output: strin
     capturedAt: string;
 };
 declare function collectDirectDependencyOutputs(task: Task, allTasks: readonly Task[]): PriorOutput[];
+/**
+ * Break marker tokens carried in a predecessor's captured output. Interactive
+ * runners echo the prompt they are given, and the watcher scans that terminal
+ * output — a quoted marker would settle this task on the previous one's
+ * evidence. Hyphenated rather than spaced: the scanner also reads a
+ * whitespace-flattened view of the terminal, which would rejoin a space.
+ *
+ * A completion marker also loses its id: transcripts are bound to a task by
+ * that id, and a dependent's transcript quoting it would answer for the
+ * predecessor the next time the predecessor runs.
+ */
+declare function defuseMarkers(text: string): string;
 declare function renderPriorOutputs(outputs: PriorOutput[]): string;
 declare function augmentPromptWithPriorOutputs(task: Task, allTasks: readonly Task[]): string;
 /**
@@ -4699,6 +4912,8 @@ interface ComposeOptions {
     tddEnabled?: boolean;
     /** An ops task's last attempt, as its output ended (ADR-0020); absent on a first attempt. */
     previousAttempt?: string;
+    /** The runner is given the `task_complete` and `checkpoint` tools (ADR-0022); the markers stay as their fallback. */
+    completionTool?: boolean;
 }
 declare function composeAugmentedPrompt(task: Task, allTasks: readonly Task[], opts?: ComposeOptions): string;
 /**
@@ -4709,6 +4924,7 @@ declare function composeAugmentedPrompt(task: Task, allTasks: readonly Task[], o
  */
 declare function composeContinuationPrompt(task: Task, message: string, opts?: {
     ops?: boolean;
+    completionTool?: boolean;
 }): string;
 
 type ExecFileFn = (command: string, args: string[]) => Promise<{
@@ -4853,6 +5069,8 @@ interface StructuredRunnerDeps {
     /** Overrides adapter construction; production picks by runner id and refuses runners without a connector. */
     createAdapter?: (runner: string, deps: AgentProcessDeps) => TaskModeAgentAdapter;
     interruptGraceMs?: number;
+    /** Serves the task tools of the runners that take them (ADR-0022). Defaults to the process's one server. */
+    mcp?: OrdewellMcpServer;
 }
 interface SessionLaunch {
     runner: string;
@@ -4860,14 +5078,20 @@ interface SessionLaunch {
     createAdapter: (runner: string, deps: AgentProcessDeps) => TaskModeAgentAdapter;
     startOptions: TaskStartOptions;
     interruptGraceMs: number;
+    /** Where this attempt's task tools are served, when its runner takes them (ADR-0022). */
+    tools?: {
+        server: OrdewellMcpServer;
+        scope: TaskTokenScope;
+    };
 }
 /**
  * One task driven over its runner's programmatic protocol (ADR-0018). It *is*
  * an `ITerminalSession`, so everything downstream of `onOutput` is unchanged;
  * what a terminal cannot do sits on {@link StructuredSessionCapability}.
  *
- * Ordewell owns the message queue (M1): a message sent mid-turn waits for the
- * turn to end rather than being typed into a runner that is busy.
+ * Ordewell owns the message queue (M1). A message sent mid-turn is handed to a
+ * runner that can take one at its next step (ADR-0023); otherwise it waits for
+ * the turn to end rather than being typed into a runner that is busy.
  */
 declare class StructuredSession extends AbstractTerminalSession implements StructuredSessionCapability {
     private readonly launch;
@@ -4893,17 +5117,54 @@ declare class StructuredSession extends AbstractTerminalSession implements Struc
      * requests — while an approval must be answerable by id across the session.
      */
     private readonly permissions;
+    /** The launch's start options, with this attempt's server once its token is issued. */
+    private startOptions;
+    /** This attempt's MCP token, until the session ends (ADR-0022, A2). */
+    private toolToken;
+    private checkpointHandler;
     constructor(id: string, taskId: string, launch: SessionLaunch);
     /** Start the runner and send the task's prompt as its first turn. */
     start(prompt: string): Promise<void>;
     getOutput(): string;
-    /** A reply typed at the task — a checkpoint answer, most often — is a user message. */
+    onTaskComplete(listener: (report: TaskCompleteArgs) => void): void;
+    onToolCheckpoint(handler: (question: string, signal: AbortSignal) => Promise<CheckpointAnswer>): void;
+    /**
+     * A server that cannot start costs the task its tools, not its run: the
+     * prompt still teaches the marker (ADR-0022, S2).
+     */
+    private issueTools;
+    private revokeTools;
+    protected baseHandleExit(code: number): void;
+    /**
+     * A reply typed at the task — a checkpoint answer, most often — is a user
+     * message like any other: into the running turn where the runner takes one,
+     * else the next turn. A runner that stopped to ask reads it at once either way.
+     */
     write(text: string): void;
     kill(): void;
     turnState(): 'working' | 'idle';
     onTurnEnd(listener: (reason: StructuredTurnEnd) => void): void;
     onEvent(listener: (event: StructuredEvent) => void): void;
     sendMessage(text: string): string;
+    /**
+     * Force send (ADR-0023, F1–F3): interrupt the running turn — and the tool
+     * call in flight — then deliver this message as the turn that replaces it,
+     * ahead of everything still queued. With no turn to interrupt it is a plain
+     * {@link sendMessage}.
+     */
+    forceSend(text: string): string;
+    /** Force send a message still waiting in the queue. False once the runner has it, or it is gone. */
+    forceSendQueued(id: string): boolean;
+    /**
+     * Behind earlier forced messages and ahead of the rest, handed-over ones
+     * included: what the runner already has is the runner's to order (F2). Held
+     * back from steering while the interrupt runs, it opens the next turn — and
+     * a queue that is not empty when the turn ends is what keeps the task out of
+     * "waiting for input" between the two (F3).
+     */
+    private force;
+    private runningTurn;
+    /** No runner can recall a message once offered to it, so only a queued one comes back. */
     removeQueued(id: string): boolean;
     queued(): QueuedTaskMessage[];
     nativeSessionId(): string | null;
@@ -4921,6 +5182,16 @@ declare class StructuredSession extends AbstractTerminalSession implements Struc
     private startAdapter;
     private openTurn;
     private deliver;
+    /**
+     * Offer the oldest queued message to the running turn (ADR-0023, D2), one at
+     * a time so the runner takes them in the order they were sent. A refusal
+     * leaves it, and everything behind it, for the turn's end.
+     */
+    private offerNext;
+    private steered;
+    private delivered;
+    /** Back to waiting in Ordewell's queue, removable again; the log hears of it only if it had shown as handed over. */
+    private requeue;
     private route;
     /**
      * The runner spoke with no message of ours in flight. When it is working — a
@@ -4935,9 +5206,17 @@ declare class StructuredSession extends AbstractTerminalSession implements Struc
     /**
      * A queued message goes out as the turn closes, and the state never passes
      * through `idle` on the way, so a listener told the turn ended can already
-     * see the task is not waiting.
+     * see the task is not waiting. Nor does a message the runner owes, or one
+     * still being offered: the runner is about to read it, or Ordewell to send
+     * it (ADR-0023, D5).
      */
     private endTurn;
+    /**
+     * Between turns the oldest message opens the next one — but only once it is
+     * back in Ordewell's hands: while it is on offer or owed, nothing overtakes it.
+     */
+    private deliverNext;
+    private undeliverQueued;
     private emitEvent;
 }
 /**
@@ -4951,6 +5230,7 @@ declare class StructuredRunner extends AbstractRunner<StructuredSession> {
     private readonly processDeps;
     private readonly createAdapter;
     private readonly interruptGraceMs;
+    private readonly mcp;
     constructor(deps?: StructuredRunnerDeps);
     spawn(opts: RunnerSpawnOptions): Promise<ITerminalSession>;
 }
@@ -5445,4 +5725,4 @@ declare const DEFAULT_MAX_PARALLEL = 3;
  */
 declare function parseMaxParallel(value: unknown): number | null;
 
-export { ALLOWED_PLUGIN_HOSTS, ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractTerminalSession, ActiveTaskSession, type Adr0013IsolationRun, type Adr0013PlanIsolation, type Adr0013TaskRecord, AgentAdapter, AgentEvent, AgentProcessDeps, AgentStartOptions, AiProvider, ApplyTaskOpsResult, ApprovalAnswer, ApprovalDecision, ApprovalMode, ApprovalPolicy, ApprovalRequest, type AskOptions, AwaitingReason, BUILTIN_SKILL_NAMES, BaseAiService, BaseConfig, BaseFileSystem, BufferedTaskOutputSource, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CORE_PLANNER_PROMPT, type CappedRows, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, type CommandTier, type ComposeOptions, ConsoleLogger, ContextCollector, type Continuability, ConversationBusyError, type ConversationCompaction, ConversationEditError, type ConversationFork, ConversationMessage, type ConversationRequest, type ConversationRewind, type ConversationTurn, type ConversationVariant, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DEFAULT_MAX_PARALLEL, DiscoveredModel, type EnvAdmission, EnvConfig, type ExecFileFn, type ExecImpl, FindSymbolOptions, FsPluginStore, GIT_READONLY_SUBCOMMANDS, GREP_PCRE_PROBE_ARGS, GeminiService, type GitExecFn, GlobOptions, type GrepInvocation, GrepOptions, type GrepRegex, type HasBinFn, HomeTranscriptReader, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IPluginStore, ITerminalRunner, ITerminalSession, IWorktreeIsolation, IsolationHandoff, IsolationLandedTask, IsolationMergeResult, IsolationOutcome, IsolationRun, IsolationTaskRecord, IsolationTaskStatus, IsolationView, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, LegacyPlanState, type LiveOutputLookup, type LiveTail, type LiveTailOptions, type MappedTool, MergeGateView, ModelResolver, type ModelResolverDeps, type ModifyPlanRequest, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OUTPUT_LINES_DEFAULT, OUTPUT_LINES_MAX, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, PLUGIN_NAME_PATTERN, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanIsolation, PlanParseError, type PlanRequest, PlanState, PlanStatus, PlanStore, Planner, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerRuntimeToggles, PlannerUsage, type PluginSource, type PrdBlock, type PriorOutput, type ProbeFn, ProviderModelLists, type ProviderRegistration, QueuedMessage, QueuedTaskMessage, REFUSED_COMMANDS, ReadFileOpts, RepairEvidence, type RepairLoopOpts, type RepairVerdict, RepoGroupLayout, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchToolType, type ResearchTurn, ResolveContext, type RewindTarget, RunnerApprovals, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerInvocation, type RunnerMode, RunnerModeInfo, RunnerPluginManifest, RunnerRegistry, RunnerSpawnOptions, RunnerTransport, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SaveSession, Session, SessionBroadcaster, type SessionData, type SessionDeps, SessionMessage, type SessionMeta, SessionNotice, type SessionPlanner, type SessionRuntimeSettings, SettingsService, type ShellDialect, type SkillInfo, type SkillMetadata, SkillsService, type SpawnSpec, StdioAgentAdapter, StructuredEvent, StructuredRunner, type StructuredRunnerDeps, StructuredSession, StructuredSessionCapability, StructuredTurnEnd, TASK_QUERY_ANSWER_MAX_CHARS, TASK_QUERY_ANSWER_OR_OPS, TASK_QUERY_FIELDS, TASK_QUERY_PROTOCOL, TASK_QUERY_REMINDER, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, type TaskAttemptSnapshot, TaskControlError, TaskIsolation, TaskLogEvent, type TaskLogFile, type TaskLogLocation, TaskLogRecorder, type TaskLogRecorderDeps, TaskModeAgentAdapter, TaskOp, TaskOrchestrator, type TaskOrchestratorDeps, type TaskOrchestratorOptions, type TaskOutputAttempt, type TaskOutputSource, type TaskQuery, type TaskQueryCatalog, type TaskQueryField, TaskRunnerFlags, TaskSnapshot, TaskStartOptions, TmuxRunner, type TmuxRunnerDeps, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, type TranscriptQuery, type TranscriptReader, type TransportRoute, TransportRouter, TreeSnapshot, UsageRecord, type UserSettings, Verdict, VerdictEngine, type VerdictListener, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, type WorktreeIsolationDeps, admitSettingsEnv, applyHeadLimit, assertInstallablePluginUrl, assertPlainPluginName, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConflictRepairPrompt, buildConflictResolutionPrompt, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildRunnerInvocation, buildSplitPrompt, buildSubagentSystemPrompt, canContinue, clampThinkingEffort, classifyCommand, classifyPlannerReply, classifyPluginSource, clearAugmentedPathCache, clearDaemonToken, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, composeContinuationPrompt, configuredProviders, continuability, createAiService, createSession, createSkillsService, createTaskAdapter, createTaskOrchestrator, createWorktreeIsolation, daemonTokenPath, defaultLogger, definitionPattern, deleteSession, describeMergeResult, discoverGeminiModels, effectiveAllowlist, ensureDir, ensurePrivateDir, ensureStateDirIgnored, executionLogBlock, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, globalDataDir, grantScopeFor, grepRegexFromProbe, hasTmux, idSegment, includeGlobFor, isCliProvider, isOpenAiProvider, isPlainPluginName, isValidManifest, killTree, languageForId, listSessions, listTaskLogAttempts, loadSession, loadSessionPlanState, loadState, mapAgentTool, migrateOldConfigDir, migratePlanIsolation, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, openTaskLog, parseMaxParallel, parseTaskQueryJson, pendingEditRulesBlock, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, reEmitTaskQueryPrompt, readDaemonToken, readTaskLog, referencePattern, renderPlanMap, renderPriorOutputs, renderTaskQueryAnswer, repairLoop, researchShellWarning, researchToolsPath, resolveArgs, resolvePluginInstallDir, resolveProviderFromPrefix, resolveResearchShell, resolveSkillInvocation, resolveTaskRunnerFlags, resolveWithin, retargetTaskRunner, routeTransport, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, sessionDataDir, sessionRuntimeSettings, stateExists, stripModelPrefix, summarizeOutput, supportsTaskMode, taskOpsRejectedPrompt, taskQuerySignature, textHasTaskQuery, tmuxSessionName, tmuxSocketName, tmuxWindowName, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, withPath, writePrivateFile };
+export { ALLOWED_PLUGIN_HOSTS, ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractTerminalSession, ActiveTaskSession, type Adr0013IsolationRun, type Adr0013PlanIsolation, type Adr0013TaskRecord, AgentAdapter, AgentEvent, AgentProcessDeps, AgentStartOptions, AiProvider, ApplyTaskOpsResult, ApprovalAnswer, ApprovalDecision, ApprovalMode, ApprovalPolicy, ApprovalRequest, type AskOptions, AwaitingReason, BUILTIN_SKILL_NAMES, BaseAiService, BaseConfig, BaseFileSystem, BufferedTaskOutputSource, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CORE_PLANNER_PROMPT, type CappedRows, CheckpointAnswer, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, type CommandTier, type ComposeOptions, ConsoleLogger, ContextCollector, type Continuability, ConversationBusyError, type ConversationCompaction, ConversationEditError, type ConversationFork, ConversationMessage, type ConversationRequest, type ConversationRewind, type ConversationTurn, type ConversationVariant, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DEFAULT_MAX_PARALLEL, DiscoveredModel, type EnvAdmission, EnvConfig, type ExecFileFn, type ExecImpl, FindSymbolOptions, FsPluginStore, GIT_READONLY_SUBCOMMANDS, GREP_PCRE_PROBE_ARGS, GeminiService, type GitExecFn, GlobOptions, type GrepInvocation, GrepOptions, type GrepRegex, type HasBinFn, HomeTranscriptReader, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IPluginStore, ITerminalRunner, ITerminalSession, IWorktreeIsolation, IsolationHandoff, IsolationLandedTask, IsolationMergeResult, IsolationOutcome, IsolationRun, IsolationTaskRecord, IsolationTaskStatus, IsolationView, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, LegacyPlanState, type LiveOutputLookup, type LiveTail, type LiveTailOptions, type MappedTool, MergeGateView, ModelResolver, type ModelResolverDeps, type ModifyPlanRequest, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OUTPUT_LINES_DEFAULT, OUTPUT_LINES_MAX, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, OrdewellMcpServer, PLUGIN_NAME_PATTERN, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanIsolation, PlanParseError, type PlanRequest, PlanState, PlanStatus, PlanStore, Planner, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerRuntimeToggles, type PlannerSubmission, PlannerToolHandler, PlannerUsage, type PluginSource, type PrdBlock, type PriorOutput, type ProbeFn, ProviderModelLists, type ProviderRegistration, QueuedMessage, QueuedTaskMessage, REFUSED_COMMANDS, ReadFileOpts, RepairEvidence, type RepairLoopOpts, type RepairVerdict, RepoGroupLayout, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchToolType, type ResearchTurn, ResolveContext, type RewindTarget, RunnerApprovals, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerInvocation, type RunnerMode, RunnerModeInfo, RunnerPluginManifest, RunnerRegistry, RunnerSpawnOptions, RunnerTransport, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SaveSession, Session, SessionBroadcaster, type SessionData, type SessionDeps, SessionMessage, type SessionMeta, SessionNotice, type SessionPlanner, type SessionRuntimeSettings, SettingsService, type ShellDialect, type SkillInfo, type SkillMetadata, SkillsService, type SpawnSpec, StdioAgentAdapter, StructuredEvent, StructuredRunner, type StructuredRunnerDeps, StructuredSession, StructuredSessionCapability, StructuredTurnEnd, TASK_QUERY_ANSWER_MAX_CHARS, TASK_QUERY_ANSWER_OR_OPS, TASK_QUERY_FIELDS, TASK_QUERY_PROTOCOL, TASK_QUERY_REMINDER, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, type TaskAttemptSnapshot, TaskCompleteArgs, TaskControlError, TaskIsolation, TaskLogEvent, type TaskLogFile, type TaskLogLocation, TaskLogRecorder, type TaskLogRecorderDeps, TaskModeAgentAdapter, TaskOp, TaskOrchestrator, type TaskOrchestratorDeps, type TaskOrchestratorOptions, type TaskOutputAttempt, type TaskOutputSource, type TaskQuery, type TaskQueryCatalog, type TaskQueryField, TaskRunnerFlags, TaskSnapshot, TaskStartOptions, TaskTokenScope, TmuxRunner, type TmuxRunnerDeps, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, type TranscriptQuery, type TranscriptReader, type TransportRoute, TransportRouter, TreeSnapshot, UsageRecord, type UserSettings, Verdict, VerdictEngine, type VerdictListener, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, type WorktreeIsolationDeps, admitSettingsEnv, applyHeadLimit, assertInstallablePluginUrl, assertPlainPluginName, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConflictRepairPrompt, buildConflictResolutionPrompt, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildRunnerInvocation, buildSplitPrompt, buildSubagentSystemPrompt, canContinue, clampThinkingEffort, classifyCommand, classifyPlannerReply, classifyPluginSource, clearAugmentedPathCache, clearDaemonToken, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, composeContinuationPrompt, configuredProviders, continuability, createAiService, createSession, createSkillsService, createTaskAdapter, createTaskOrchestrator, createWorktreeIsolation, daemonTokenPath, defaultLogger, definitionPattern, defuseMarkers, deleteSession, describeMergeResult, discoverGeminiModels, effectiveAllowlist, ensureDir, ensurePrivateDir, ensureStateDirIgnored, executionLogBlock, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, globalDataDir, grantScopeFor, grepRegexFromProbe, hasTmux, idSegment, includeGlobFor, isCliProvider, isOpenAiProvider, isPlainPluginName, isValidManifest, killTree, languageForId, listSessions, listTaskLogAttempts, loadSession, loadSessionPlanState, loadState, mapAgentTool, migrateOldConfigDir, migratePlanIsolation, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, openTaskLog, parseMaxParallel, parseTaskQueryJson, pendingEditRulesBlock, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, reEmitTaskQueryPrompt, readDaemonToken, readTaskLog, referencePattern, renderPlanMap, renderPriorOutputs, renderTaskQueryAnswer, repairLoop, researchShellWarning, researchToolsPath, resolveArgs, resolvePluginInstallDir, resolveProviderFromPrefix, resolveResearchShell, resolveSkillInvocation, resolveTaskRunnerFlags, resolveWithin, retargetTaskRunner, routeTransport, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, sessionDataDir, sessionRuntimeSettings, stateExists, stripModelPrefix, summarizeOutput, supportsTaskMode, taskOpsRejectedPrompt, taskQuerySignature, textHasTaskQuery, tmuxSessionName, tmuxSocketName, tmuxWindowName, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, withPath, writePrivateFile };