@ordewell/core 0.7.1 → 0.8.0

package/dist/IRunner-XVUddYVX.d.mts

@@ -0,0 +1,1165 @@
+import { ChildProcess } from 'child_process';
+import { ao as UsageRecord, a8 as SubagentOutcome, W as RunnerId, ag as TaskSkillSnapshot } from './Task-1Q19y7sZ.mjs';
+import { z } from 'zod/v4';
+
+/**
+ * The planner's single approval seam. Every capability that reaches beyond the
+ * default read-only, in-workspace envelope — a path outside the workspace root,
+ * a shell command outside the auto-allowed set, a URL fetch — routes through
+ * one `request()` so the policy has exactly one owner (the same "one repair
+ * owner" shape as PlanRepair).
+ *
+ * Surfaces supply the human channel. VS Code answers with a modal; the web
+ * server currently has no prompt UI, so it denies unless the scope was
+ * pre-approved through config. Denial is always a visible, actionable tool
+ * result — never a silent success.
+ */
+/**
+ * `runner_tool` is a task runner's own tool request (ADR-0018, A1): it waits
+ * for an answer as long as it takes, and never passes through the planner's
+ * policy — the runner's mode already decided it needed asking.
+ */
+type ApprovalKind = 'external_path' | 'shell_command' | 'url_fetch' | 'runner_tool';
+interface ApprovalRequest {
+    kind: ApprovalKind;
+    /** The concrete thing being asked about: an absolute path, a command line, a URL. */
+    subject: string;
+    /**
+     * What a grant covers. Approving remembers this, not `subject`, so reading a
+     * second file from an already-approved directory does not prompt again.
+     */
+    scope: string;
+    /**
+     * Every scope one answer settles, when a command needs more than one — its
+     * own and each outside directory it touches — so it prompts once rather than
+     * once per scope. `scope` is the first. Absent means `scope` alone.
+     */
+    scopes?: string[];
+    /** One-line context for the prompt. */
+    detail?: string;
+    /** The task whose runner asked; absent for the planner's own requests. */
+    taskId?: string;
+    /** "Allow for this task" can be offered: the runner proposed its own session-scoped grant. */
+    allowForTask?: boolean;
+}
+/**
+ * An answer, from whoever gives it — a person on any surface, or later the
+ * supervisor (#28). `allowForTask` is Allow plus the runner's own grant for
+ * the rest of the task; `note` goes back to the agent with a denial.
+ */
+type ApprovalDecision = {
+    decision: 'allow';
+} | {
+    decision: 'allowForTask';
+} | {
+    decision: 'deny';
+    note?: string;
+};
+/** What an answer may be given as: a planner prompt's yes/no still is one. */
+type ApprovalAnswer = boolean | ApprovalDecision;
+declare function toApprovalDecision(answer: ApprovalAnswer): ApprovalDecision;
+declare function isGranted(decision: ApprovalDecision): boolean;
+declare function approvalScopes(request: ApprovalRequest): string[];
+declare function isRunnerApproval(request: ApprovalRequest): boolean;
+interface IApproval {
+    request(req: ApprovalRequest): Promise<boolean>;
+}
+/** Denies everything. The safe default when a surface wires no approval channel. */
+declare const DENY_ALL: IApproval;
+
+/**
+ * The tools of the Ordewell MCP server, per token role (ADR-0022), and the
+ * handler interfaces the session side implements to answer them.
+ *
+ * Every handler method is optional so each tool can be wired on its own; one
+ * left unset answers its call with a "not available" error rather than
+ * disappearing from `tools/list`, so the list a runner sees never depends on
+ * how far the wiring has got.
+ */
+declare const taskCompleteInput: z.ZodObject<{
+    status: z.ZodEnum<{
+        failed: "failed";
+        blocked: "blocked";
+        done: "done";
+    }>;
+    summary: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const checkpointInput: z.ZodObject<{
+    question: z.ZodString;
+}, z.core.$strip>;
+declare const listRunnersInput: z.ZodObject<{}, z.core.$strip>;
+declare const listModelsInput: z.ZodObject<{
+    runner: z.ZodString;
+}, z.core.$strip>;
+declare const loadSkillInput: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
+declare const submitPlanInput: z.ZodObject<{
+    tasks: z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        order: z.ZodOptional<z.ZodNumber>;
+        title: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        type: z.ZodOptional<z.ZodEnum<{
+            ai: "ai";
+            user: "user";
+        }>>;
+        dependencies: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        prompt: z.ZodOptional<z.ZodString>;
+        userSteps: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            order: z.ZodOptional<z.ZodNumber>;
+            instruction: z.ZodString;
+        }, z.core.$loose>>>;
+        assignedRunner: z.ZodOptional<z.ZodString>;
+        assignedModel: z.ZodOptional<z.ZodObject<{
+            modelId: z.ZodString;
+            modelLabel: z.ZodOptional<z.ZodString>;
+            thinkingEffort: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>>;
+        taskMode: z.ZodOptional<z.ZodString>;
+        autonomy: z.ZodOptional<z.ZodEnum<{
+            AFK: "AFK";
+            HITL: "HITL";
+        }>>;
+        sliceType: z.ZodOptional<z.ZodEnum<{
+            AFK: "AFK";
+            HITL: "HITL";
+        }>>;
+        ops: z.ZodOptional<z.ZodBoolean>;
+        userStoriesCovered: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        skills: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        subtasks: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    }, z.core.$loose>>;
+}, z.core.$strip>;
+declare const editPlanInput: z.ZodObject<{
+    ops: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        op: z.ZodLiteral<"update">;
+        taskId: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+        changes: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodLiteral<"add">;
+        task: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        handle: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodLiteral<"remove">;
+        taskId: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodLiteral<"reorder">;
+        taskIds: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodLiteral<"merge">;
+        taskIds: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        merged: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        handle: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodLiteral<"split">;
+        taskId: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+        parts: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        handle: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodLiteral<"rearm">;
+        taskId: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+        changes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>]>>;
+}, z.core.$strip>;
+declare const taskQueryInput: z.ZodObject<{
+    tasks: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+    fields: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        skills: "skills";
+        description: "description";
+        prompt: "prompt";
+        userSteps: "userSteps";
+        verdict: "verdict";
+        outputSummary: "outputSummary";
+        userStoriesCovered: "userStoriesCovered";
+    }>>>;
+    catalog: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+declare const taskOutputInput: z.ZodObject<{
+    task: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    lines: z.ZodOptional<z.ZodNumber>;
+    since: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+type TaskCompleteArgs = z.infer<typeof taskCompleteInput>;
+type CheckpointArgs = z.infer<typeof checkpointInput>;
+type ListRunnersArgs = z.infer<typeof listRunnersInput>;
+type ListModelsArgs = z.infer<typeof listModelsInput>;
+type LoadSkillArgs = z.infer<typeof loadSkillInput>;
+type SubmitPlanArgs = z.infer<typeof submitPlanInput>;
+type EditPlanArgs = z.infer<typeof editPlanInput>;
+type TaskQueryArgs = z.infer<typeof taskQueryInput>;
+type TaskOutputArgs = z.infer<typeof taskOutputInput>;
+/** What a handler answers with. `isError` marks a refusal the caller should act on. */
+interface McpToolReply {
+    text: string;
+    isError?: boolean;
+}
+/**
+ * How a checkpoint call ended. `withdrawn` is the attempt going away under it
+ * (verdict, cancel, retry, stop) or the call being refused, not a verdict on
+ * the question.
+ */
+type CheckpointAnswer = {
+    kind: 'continue';
+} | {
+    kind: 'rejected';
+    reason: string;
+} | {
+    kind: 'withdrawn';
+    why: string;
+};
+interface McpToolContext {
+    /** Aborts when the token is revoked or the caller cancels — a waiting handler must stop. */
+    signal: AbortSignal;
+}
+type Run<A> = (args: A, context: McpToolContext) => Promise<McpToolReply>;
+interface TaskToolHandler {
+    taskComplete?: Run<TaskCompleteArgs>;
+    checkpoint?: Run<CheckpointArgs>;
+}
+interface PlannerToolHandler {
+    loadSkill?: Run<LoadSkillArgs>;
+    listRunners?: Run<ListRunnersArgs>;
+    listModels?: Run<ListModelsArgs>;
+    submitPlan?: Run<SubmitPlanArgs>;
+    editPlan?: Run<EditPlanArgs>;
+    taskQuery?: Run<TaskQueryArgs>;
+    taskOutput?: Run<TaskOutputArgs>;
+}
+interface McpTool<H> {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: 'object';
+        [key: string]: unknown;
+    };
+    annotations?: {
+        readOnlyHint: boolean;
+    };
+    /** Validate `args` and hand them to the handler's method for this tool. */
+    call(handler: H, args: unknown, context: McpToolContext): Promise<McpToolReply>;
+}
+/** The task tool whose call settles the attempt (ADR-0022, V1). */
+declare const TASK_COMPLETE_TOOL = "task_complete";
+declare const TASK_TOOLS: readonly McpTool<TaskToolHandler>[];
+declare const PLANNER_TOOLS: readonly McpTool<PlannerToolHandler>[];
+
+/**
+ * The Ordewell MCP server (ADR-0022): one loopback listener per process,
+ * shared by every session in it, where the caller's token alone decides which
+ * tools it sees and which session and task its calls reach.
+ */
+declare const ORDEWELL_MCP_PATH = "/mcp";
+interface OrdewellMcpServerOptions {
+    /** How often a call that is still waiting tells its caller so. */
+    heartbeatMs?: number;
+}
+interface TaskTokenScope {
+    sessionId: string;
+    taskId: string;
+    /** The attempt generation the token is good for; a later attempt gets a new token. */
+    attempt: number;
+}
+interface PlannerTokenScope {
+    sessionId: string;
+}
+/** Where a runner reaches the server and what it presents there. Never put either half in a prompt. */
+interface McpCredential {
+    url: string;
+    token: string;
+}
+declare class OrdewellMcpServer {
+    private readonly grants;
+    private http;
+    private listening;
+    private boundUrl;
+    private boundHost;
+    private readonly heartbeatMs;
+    constructor(options?: OrdewellMcpServerOptions);
+    /** The listener's URL, once the first token has started it. */
+    get url(): string | undefined;
+    issueTaskToken(scope: TaskTokenScope, handler?: TaskToolHandler): Promise<McpCredential>;
+    issuePlannerToken(scope: PlannerTokenScope, handler?: PlannerToolHandler): Promise<McpCredential>;
+    /** Refuse every later request carrying `token`, and abort the calls it has in flight. */
+    revoke(token: string): void;
+    dispose(): Promise<void>;
+    private issue;
+    private start;
+    private handle;
+}
+/** The process's one server, which the daemon and the extension host hand to every session they build. */
+declare function sharedMcpServer(): OrdewellMcpServer;
+
+/** The server's name in every runner's MCP configuration, and so in its tool names (`mcp__ordewell__*`). */
+declare const ORDEWELL_MCP_SERVER_NAME = "ordewell";
+interface McpClientConfig {
+    name: typeof ORDEWELL_MCP_SERVER_NAME;
+    url: string;
+    headers: Record<string, string>;
+}
+/**
+ * The one shape every runner adapter renders its own MCP configuration from.
+ * The token travels only in `headers`: the adapter writes it to an owner-only
+ * file or an environment variable, never a prompt or a process argument
+ * (ADR-0022, A4/A5).
+ */
+declare function mcpClientConfig(credential: McpCredential): McpClientConfig;
+/** A runner's MCP configuration on disk, and the way to take it back off. */
+interface OwnerOnlyFile {
+    path: string;
+    /** Delete the file. Idempotent. */
+    remove(): void;
+}
+/**
+ * Write a configuration that carries a token where only the user can read it,
+ * for a runner that takes its MCP servers from a file (ADR-0022, A5). The
+ * directory is private too, so the name cannot be raced before the mode lands.
+ */
+declare function ownerOnlyConfigFile(fileName: string, contents: string): OwnerOnlyFile;
+
+/**
+ * The harness-planner transport contract (ADR-0009).
+ *
+ * One adapter per coding agent, each speaking that agent's own programmatic
+ * protocol and normalizing it to the event union below. Everything above this
+ * line — reply classification, the repair loop, plan validation, the four
+ * surfaces — is already provider-agnostic, so an adapter is the entire cost of
+ * teaching Ordewell to plan with another agent.
+ */
+/**
+ * One normalized event from a running agent turn. Deliberately smaller than
+ * any single agent's native protocol: this is the intersection Ordewell can act
+ * on, not a lossless re-encoding. Event fidelity differs by agent — `thinking`
+ * is rich on Claude Code and absent elsewhere — so consumers must tolerate a
+ * turn that emits nothing but `assistant_text` and `turn_end`.
+ */
+type AgentEvent = 
+/**
+ * A complete run of the assistant's reply. Concatenated in order to form the
+ * turn's text. When the same run already streamed as `assistant_text_delta`,
+ * this is the authoritative copy of it — it replaces the deltas, it is not
+ * appended after them.
+ */
+{
+    type: 'assistant_text';
+    text: string;
+}
+/**
+ * An incremental piece of the assistant's reply, for agents that stream
+ * partial messages. The planner's own text only: a subagent's words never
+ * arrive here, so they can never become the reply.
+ */
+ | {
+    type: 'assistant_text_delta';
+    text: string;
+}
+/**
+ * Reasoning the agent chose to expose. Never contributes to the reply text.
+ * Like `assistant_text`, it supersedes deltas already streamed for it.
+ */
+ | {
+    type: 'thinking';
+    text: string;
+    subagentId?: string;
+} | {
+    type: 'thinking_delta';
+    text: string;
+    subagentId?: string;
+}
+/** `subagentId` marks a call made inside a subagent rather than by the planner itself. */
+ | {
+    type: 'tool_call';
+    id: string;
+    name: string;
+    args: Record<string, unknown>;
+    subagentId?: string;
+} | {
+    type: 'tool_result';
+    id: string;
+    name: string;
+    output: string;
+    success: boolean;
+    subagentId?: string;
+}
+/** One model call's usage, as the agent reported it — never estimated. */
+ | {
+    type: 'usage';
+    record: UsageRecord;
+}
+/** The agent delegated `brief` to a subagent, whose events carry `subagentId` until it finishes. */
+ | {
+    type: 'subagent_started';
+    subagentId: string;
+    brief: string;
+    model?: string;
+} | {
+    type: 'subagent_finished';
+    subagentId: string;
+    outcome: SubagentOutcome;
+    digest: string;
+}
+/**
+ * The agent asked to do something its mode does not cover. A planner always
+ * auto-denies it (T1) — a planner that can mutate is not a planner — and the
+ * adapter answers so the turn does not hang. A task's request stays open
+ * until {@link TaskModeAgentAdapter.answerPermission} (ADR-0018, A1).
+ *
+ * `input` and `suggestions` are the raw request; `suggestions` are the
+ * agent's own session-scoped grants, what "Allow for this task" answers with.
+ * `decided` marks a request the task's mode already answered — the adapter
+ * replied as the manifest says that mode does — so it is shown, never asked.
+ */
+ | {
+    type: 'permission_request';
+    id: string;
+    name: string;
+    detail: string;
+    input?: Record<string, unknown>;
+    suggestions?: unknown[];
+    toolUseId?: string;
+    decided?: ApprovalDecision;
+}
+/** The agent withdrew an open request — an interrupt cancels the call it was for. It takes no answer now. */
+ | {
+    type: 'permission_cancelled';
+    id: string;
+}
+/**
+ * The agent delegated work to a subagent it left running in the background,
+ * and may end its turn before that work reports. Ordewell's conversation is
+ * request/response: a turn that ends hands control back to the user, and
+ * anything the agent says afterwards arrives with no turn open and is lost.
+ * Naming the launch is what lets the service ask for the results in time.
+ */
+ | {
+    type: 'background_agent';
+    id: string;
+}
+/**
+ * The agent finished its turn and is waiting for the next user message.
+ * `interrupted` marks a turn cut short by {@link TaskModeAgentAdapter.interrupt}
+ * rather than one the agent chose to end.
+ */
+ | {
+    type: 'turn_end';
+    interrupted?: boolean;
+}
+/**
+ * The model has a message handed over by {@link TaskModeAgentAdapter.steer},
+ * by the runner's own account rather than because the write succeeded
+ * (ADR-0023, D3). With no turn open, the runner opened one for it.
+ */
+ | {
+    type: 'message_delivered';
+    id: string;
+}
+/**
+ * The runner let go of a message it accepted from `steer` without showing it
+ * to the model — Codex does, for one its turn ended before consuming. It is
+ * Ordewell's to send again (ADR-0023, D4).
+ */
+ | {
+    type: 'message_dropped';
+    id: string;
+}
+/** The turn failed. Carries the agent's own words — never a Ordewell paraphrase. */
+ | {
+    type: 'error';
+    message: string;
+};
+interface AgentStartCommon {
+    /** Workspace root. The agent works from here and, in read-only mode, cannot leave it. */
+    cwd: string;
+    /** Model id from the runner's own discovery catalog. Omitted means the agent's default. */
+    model?: string;
+    /**
+     * The agent's own session id from a previous run. For the planner a hint
+     * only: Ordewell's transcript is the source of truth (T4), so a failed resume
+     * degrades to a fresh session seeded from the stored history, not an error.
+     */
+    resumeSessionId?: string;
+}
+/** The read-only planner (ADR-0008/0009). The only start `CliAgentAiService` can express. */
+interface PlannerStartOptions extends AgentStartCommon {
+    kind: 'planner';
+    /** The planner system prompt, in its harness variant. */
+    systemPrompt: string;
+    /** Variant / reasoning effort id from that model's `variants` list. */
+    effort?: string;
+    /** The Ordewell MCP server to inject, pre-authorized (ADR-0022). Only for an adapter with {@link AgentAdapter.mcpAttached}. */
+    mcp?: McpClientConfig;
+}
+/**
+ * What a runner manifest says the task's mode and effort mean (ADR-0001),
+ * resolved from the runner manifest — see `resolveTaskRunnerFlags`.
+ * The adapter adds only its protocol flags around these.
+ */
+interface TaskRunnerFlags {
+    /** The runner's own permission-mode value for the task's mode. */
+    permissionMode: string;
+    /** The task's raw effort id, present only alongside a model. Each adapter maps it to its own protocol. */
+    effort?: string;
+    /** The manifest's further settings for the task's mode, by setting name — see `RunnerFeatures.modeSettings`. */
+    modeSettings: Record<string, string>;
+}
+/** A plan task driven over the runner's programmatic protocol (ADR-0018, C1). */
+interface TaskStartOptions extends AgentStartCommon {
+    kind: 'task';
+    /** The task's runner mode id, as the plan names it. */
+    mode: string;
+    flags: TaskRunnerFlags;
+    /**
+     * The Ordewell MCP server and this attempt's token (ADR-0022), injected
+     * with its tools pre-approved. A task is never started without it: its
+     * `task_complete` call is how it reports it is done.
+     */
+    mcp?: McpClientConfig;
+}
+/**
+ * The explicit start switch. Discriminated so that a read-only planner and a
+ * mutating task can never be confused by a missing field: every caller names
+ * which one it is starting.
+ */
+type AgentStartOptions = PlannerStartOptions | TaskStartOptions;
+/** A runner asked to start in task mode that has no task-mode connector yet. */
+declare class TaskModeUnsupportedError extends Error {
+    readonly runner: string;
+    constructor(runner: string);
+}
+interface AgentAdapter {
+    /** The runner id this adapter drives — `claude-code`, `codex`, `opencode`. */
+    readonly agentId: string;
+    /** Spawn the agent — read-only for a planner, in the task's mode for a task — ready to receive messages. */
+    start(opts: AgentStartOptions): Promise<void>;
+    /**
+     * Send one user message and stream the turn's events until it ends. Resolves
+     * when the agent yields the floor; rejects only when the transport itself
+     * failed in a way no `error` event could describe.
+     *
+     * `onActivity`, when given, fires on raw transport traffic — every stdio
+     * line or stream chunk the process produces — independent of whether that
+     * traffic becomes an `AgentEvent`. An adapter may legitimately emit nothing
+     * for long stretches (a subagent's filtered output, most often); a caller
+     * using presence-of-events as a liveness signal would read that silence as
+     * a hang. `onActivity` is the seam that keeps liveness detection from being
+     * coupled to what each adapter chooses to surface.
+     */
+    send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal, onActivity?: () => void): Promise<void>;
+    /** The agent's native session id once it has announced one. Resumption hint only. */
+    nativeSessionId(): string | null;
+    /** Kill the process and release its resources. Idempotent. */
+    dispose(): void;
+    /**
+     * Whether the Ordewell MCP server passed in the start options' `mcp` is
+     * connected, as the runner itself reports it (ADR-0022, S4). Absent on an
+     * adapter that cannot inject the server at all, which cannot run tasks.
+     */
+    mcpAttached?(): Promise<boolean>;
+}
+/** What an adapter adds to run a task rather than a planner (ADR-0018). */
+interface TaskModeAgentAdapter extends AgentAdapter {
+    mcpAttached(): Promise<boolean>;
+    /**
+     * Ask the running turn to stop, keeping the process and its session. Resolves
+     * true once the agent acknowledged it; the turn then ends with
+     * `turn_end { interrupted: true }`. False means the agent did not answer
+     * within `timeoutMs`, and the caller must fall back to killing it.
+     */
+    interrupt(timeoutMs: number): Promise<boolean>;
+    /**
+     * Registers the listener for what the agent does after a turn has ended and
+     * before the next message — a turn it opens itself when background work
+     * finishes, most often. Without one that output is dropped, which is right
+     * for a planner and wrong for a task, which may report completion there.
+     */
+    onOutOfTurn?(listener: (event: AgentEvent) => void): void;
+    /** Registers a listener for the process ending, for any reason. Fires at most once. */
+    onProcessExit(listener: (code: number) => void): void;
+    /**
+     * Hand a message to the running turn, for the runner to show the model at
+     * its next step boundary (ADR-0023, D1–D2). Resolves true once the runner
+     * accepted it: handed over, not yet delivered — the turn's events later
+     * carry `message_delivered` or `message_dropped` for `id`. False when the
+     * runner refused it or no turn is running; the caller keeps it for the
+     * turn's end. Absent on an adapter whose runner cannot take a message
+     * mid-turn.
+     */
+    steer?(id: string, text: string): Promise<boolean>;
+    /**
+     * Answer an open `permission_request`. False when the id is not open — it
+     * was answered, cancelled, or never asked.
+     */
+    answerPermission(id: string, decision: ApprovalDecision): boolean;
+}
+type SpawnFn = (command: string, args: string[], options: {
+    env: NodeJS.ProcessEnv;
+    stdio: Array<'pipe' | 'ignore'>;
+    cwd: string;
+    /** Set by the Windows batch route, where `args` is already a quoted command line. */
+    windowsVerbatimArguments?: boolean;
+    /** Set on POSIX so the runner leads its own process group (see `spawnInOwnGroup`). */
+    detached?: boolean;
+}) => ChildProcess;
+/**
+ * The single injected boundary between Ordewell and the operating system.
+ * Tests feed
+ * recorded agent output through `spawn` (and, for HTTP-transport agents,
+ * `fetch`) so one test exercises adapter parsing, event mapping, reply
+ * classification and the repair loop as a single observable behavior.
+ */
+interface AgentProcessDeps {
+    spawn: SpawnFn;
+    fetch: typeof globalThis.fetch;
+    /** Resolves the PATH agents are spawned under. Defaults to the augmented PATH. */
+    resolvePath?: () => Promise<string>;
+    /** Host platform. Defaults to the real one; injected so OS-specific behavior is testable anywhere. */
+    platform?: NodeJS.Platform;
+    /** True when `workspace` names an existing directory. Defaults to a real filesystem check. */
+    isDirectory?: (workspace: string) => boolean;
+    /** True when `candidate` names an existing, spawnable file. Defaults to a real filesystem check. */
+    exists?: (candidate: string) => boolean;
+    /** The workspace's own variables for a cwd (ADR-0016). Defaults to {@link resolveWorkspaceEnv}. */
+    workspaceEnv?: (cwd: string) => Promise<Record<string, string>>;
+}
+/** Builds the adapter for one runner id, or null when that runner cannot plan. */
+type AgentAdapterFactory = (runner: string, deps: AgentProcessDeps) => AgentAdapter | null;
+/**
+ * Split a stream of chunks into complete lines. Every agent transport here is
+ * newline-delimited JSON of some shape, and a chunk boundary lands mid-object
+ * often enough that parsing per-chunk silently drops events.
+ */
+declare class LineBuffer {
+    private buffer;
+    push(chunk: string, onLine: (line: string) => void): void;
+    /** Anything left unterminated when the stream closed. */
+    flush(): string;
+}
+
+interface RunnerManifest {
+    name: string;
+    displayName: string;
+    runner: {
+        command: string;
+    };
+    features: RunnerFeatures;
+    modelDiscovery: RunnerModelDiscovery;
+    contextFile?: string;
+    contextFileAltPath?: string;
+    modes?: RunnerMode[];
+}
+interface RunnerFeatures {
+    permissionModeValues?: Record<string, string>;
+    modeSettings?: Record<string, Record<string, string>>;
+}
+type ModelDiscoveryParser = 'claude-help' | 'opencode-models' | 'opencode-models-verbose' | 'anthropic-models' | 'line-by-line' | 'json' | 'json-table';
+interface DiscoveryCommand {
+    command: string;
+    args: string[];
+    parser?: ModelDiscoveryParser;
+}
+type ApiAuthMethod = {
+    type: 'env';
+    varName: string;
+    header: string;
+    prefix?: string;
+} | {
+    type: 'file';
+    path: string;
+    jsonPath: string;
+    header: string;
+    prefix?: string;
+};
+interface ApiDiscoveryConfig {
+    url: string;
+    headers?: Record<string, string>;
+    auth: ApiAuthMethod[];
+    parser: ModelDiscoveryParser;
+}
+interface RunnerModelDiscovery {
+    method: 'command' | 'hardcoded';
+    command?: string;
+    args?: string[];
+    parser?: ModelDiscoveryParser;
+    jsonPath?: string;
+    /**
+     * Stdio JSON-RPC discovery (Codex `app-server`): spawn the command, send
+     * `initialize` then `model/list`, and read the catalog from the response.
+     * Tried BEFORE apiDiscovery and command discovery. When the call fails,
+     * `cacheFile` (the runner's own on-disk catalog cache, `~` expanded) is
+     * read before falling through to the remaining discovery methods.
+     */
+    appServer?: {
+        command: string;
+        args: string[];
+        cacheFile?: string;
+    };
+    /**
+     * Optional last-resort list for a CLI that cannot enumerate
+     * models. Used only when command discovery fails entirely or the CLI is
+     * unavailable. Built-in manifests must NOT use this: anything listed here is
+     * shown to the user as available even when it isn't.
+     */
+    fallbackModels?: {
+        modelId: string;
+        modelLabel: string;
+    }[];
+    /**
+     * Stable `--model` aliases that the runner's CLI always accepts but its help
+     * text may omit (e.g. Claude's 'haiku'). Merged into successful discovery
+     * results to fill gaps — discovered models take precedence, missing aliases
+     * are appended — and used as the last resort when discovery fails entirely.
+     * Unlike `fallbackModels`, entries must be stable CLI-accepted aliases
+     * (contracts that always resolve), not arbitrary model IDs.
+     */
+    canonicalAliases?: {
+        modelId: string;
+        modelLabel: string;
+    }[];
+    /**
+     * HTTP API discovery — tried BEFORE command discovery. When the runner's CLI
+     * has no model-listing subcommand (Claude Code), an API endpoint can serve as
+     * the authoritative source. Auth methods are tried in order; the first that
+     * yields a token is used. If no auth method yields a token or the request
+     * fails, discovery falls through to `discoveryCommands` + `canonicalAliases`.
+     */
+    apiDiscovery?: ApiDiscoveryConfig;
+    preferredPatterns?: {
+        id: string;
+        label: string;
+    }[];
+    variants?: {
+        id: string;
+        label: string;
+    }[];
+    discoveryCommands?: DiscoveryCommand[];
+}
+interface RunnerMode {
+    id: string;
+    label: string;
+    description: string;
+    /** CLI value passed to the runner's permission/mode flag. Defaults to id if omitted. */
+    cliValue?: string;
+    /** Marks this mode as the runner's most permissive mode — the resolved default when autonomous mode is ON. */
+    autonomous?: boolean;
+    /** Marks this mode as the runner's conservative build mode — the resolved default when autonomous mode is OFF. */
+    safe?: boolean;
+}
+interface RunnerEntry {
+    manifest: RunnerManifest;
+}
+
+/**
+ * Decides whether one out-of-envelope capability may run, and remembers the
+ * answer for the rest of the session.
+ *
+ * Grants are keyed on {@link ApprovalRequest.scope}, never on the concrete
+ * subject: approving a read of `/tmp/foo/a.log` grants `/tmp/foo/*`, and
+ * approving `az group list` grants `az group`. Without that, a planner doing
+ * real research would prompt on every single call and the feature would be
+ * unusable.
+ *
+ * `mode` is the policy floor:
+ *   ask     consult the human channel; no channel means deny (headless, web)
+ *   allow   grant everything the tier system did not already refuse
+ *   deny    grant nothing beyond `preApproved`
+ *
+ * Note the ordering: `preApproved` is honored under every mode including
+ * `deny`, because it is an explicit operator decision rather than a default.
+ */
+type ApprovalMode = 'ask' | 'allow' | 'deny';
+interface ApprovalPolicyOptions {
+    mode?: ApprovalMode;
+    /** Scopes granted up front from config. A trailing `*` matches by prefix. */
+    preApproved?: string[];
+    /** The human channel. Absent means there is nobody to ask. */
+    ask?: (req: ApprovalRequest) => Promise<boolean>;
+    /** Called whenever a decision is reached, for surfacing in a UI or a log. */
+    onDecision?: (req: ApprovalRequest, granted: boolean, source: ApprovalSource) => void;
+}
+type ApprovalSource = 'pre-approved' | 'remembered' | 'mode' | 'asked' | 'no-channel';
+declare class ApprovalPolicy implements IApproval {
+    private readonly mode;
+    private readonly preApproved;
+    private readonly asker?;
+    private readonly onDecision?;
+    private readonly granted;
+    private readonly refused;
+    /** One in-flight ask per scope: a parallel tool round must not prompt twice for the same thing. */
+    private readonly inFlight;
+    private generation;
+    constructor(opts?: ApprovalPolicyOptions);
+    request(req: ApprovalRequest): Promise<boolean>;
+    /** Scopes the user has granted this session — for display and for persistence. */
+    grantedScopes(): string[];
+    /** Drop every session-scoped decision. Called on session reset. */
+    reset(): void;
+}
+
+interface CatalogModel {
+    id: string;
+    name: string;
+    description: string;
+    pricing: {
+        prompt: string;
+        completion: string;
+    };
+    contextLength: number;
+}
+declare class ModelCatalog {
+    static fetchModels(apiKey: string, baseUrl?: string, fetchImpl?: typeof fetch): Promise<CatalogModel[]>;
+    /**
+     * Delete the on-disk catalog cache for a base URL so the next fetch re-runs.
+     * Used by the resolver's `invalidate()` in production (no injected fetch);
+     * best-effort — a missing file or unreadable dir is a no-op.
+     */
+    static clearCache(baseUrl?: string): void;
+    private static readCache;
+    private static writeCache;
+}
+
+interface ModelShortcut {
+    label: string;
+    id: string;
+    provider: string;
+    description: string;
+    pricing?: string;
+}
+declare const ORCHESTRATOR_SHORTCUTS: ModelShortcut[];
+declare function resolveModelShortcut(input: string, shortcuts: ModelShortcut[]): string | null;
+/**
+ * Resolves a value to a model id ONLY when it is in the supplied catalog
+ * option list — either directly or via a shortcut label. Free-typed, unknown,
+ * or not-currently-available values return null, so callers never store an id
+ * the user couldn't have selected from the list. Keeps model-setting list-only.
+ */
+declare function knownModelId(value: string, optionIds: string[], shortcuts: ModelShortcut[]): string | null;
+
+type ProviderModelLists = Record<string, string[]>;
+interface OrchestratorOption {
+    id: string;
+    label: string;
+    provider: string;
+    apiProvider: AiProvider;
+    description?: string;
+    pricing?: string;
+    /** The model's context window when the catalog reports one (#49). */
+    contextWindow?: number;
+}
+
+interface FetchAllProviderModelsOptions {
+    apiKeys: Record<string, string>;
+    baseUrls: Record<string, string>;
+    fetchImpl?: typeof fetch;
+}
+type AllProviderModels = Record<string, CatalogModel[]>;
+/**
+ * Result of a picker-catalog fetch fan-out: the per-provider model lists plus
+ * the per-provider failures. `errors` is keyed by provider id and holds the
+ * failure message for any provider whose catalog fetch rejected — the seam the
+ * surfaces (CLI, VS Code) use to flag "this configured provider didn't work"
+ * rather than silently showing a short list.
+ */
+interface ProviderModelsResult {
+    models: AllProviderModels;
+    errors: Record<string, string>;
+}
+/** The provider config fields the discovery fan-out needs. */
+interface ProviderCredentialSource {
+    getProviderApiKey(provider: AiProvider): string;
+    getProviderBaseUrl(provider: AiProvider): string;
+    openaiCompatibleBaseUrl: string;
+}
+/**
+ * Collect the API keys and base URLs the picker fan-out should probe, applying
+ * the single "configured" policy shared by every surface (CLI + VS Code):
+ *  - a preset is discovered only when it has an API key (OpenRouter included —
+ *    its public catalog is not probed keyless, matching the product rule that
+ *    only key-configured providers appear);
+ *  - `openai_compatible` is discovered only when an explicit endpoint is set
+ *    (keyless local servers like ollama / LM Studio).
+ * Base URLs are handed through only for providers that pass the gate, so the
+ * fan-out never touches an unconfigured third-party endpoint.
+ */
+declare function collectProviderCredentials(config: ProviderCredentialSource): {
+    apiKeys: Record<string, string>;
+    baseUrls: Record<string, string>;
+};
+declare function fetchAllProviderModels(opts: FetchAllProviderModelsOptions): Promise<ProviderModelsResult>;
+declare function resolveProvider(modelId: string, providerModelLists: Record<string, string[]>): AiProvider | null;
+declare function toOrchestratorOptions(providerModels: AllProviderModels, shortcuts: ModelShortcut[]): OrchestratorOption[];
+
+/**
+ * Who plans. Mostly LLM vendors reached over HTTP; the last three are *harness
+ * planners* (ADR-0009) — a coding agent CLI already installed on the machine,
+ * driven as the planner over its own programmatic transport and authenticated
+ * by the subscription the user already holds. They are runners in the provider
+ * axis, deliberately: "what plans for me?" is one question, and it belongs in
+ * one setting. `isCliProvider` is the single guard that tells the two kinds
+ * apart.
+ */
+type AiProvider = 'google' | 'openrouter' | 'openai_compatible' | 'openai' | 'xai' | 'groq' | 'deepseek' | 'together' | 'mistral' | 'anthropic' | 'fireworks' | 'perplexity' | 'zhipu' | 'kimi' | 'cerebras' | 'deepinfra' | 'doubao' | 'qwen' | 'hunyuan' | 'baichuan' | 'minimax' | 'yi' | 'stepfun' | 'siliconflow' | 'cohere' | 'novita' | 'claude-code' | 'codex' | 'opencode';
+interface IConfig {
+    aiProvider: AiProvider;
+    apiKey: string;
+    planningModel: string;
+    enabledRunners: string[];
+    maxParallelSessions: number;
+    researchEnabled: boolean;
+    researchMaxSteps: number;
+    researchMaxFileSize: number;
+    openAiBaseUrl: string;
+    openAiApiKey: string;
+    /** Provider keys + base URL the ModelResolver uses to fetch the picker catalogs. */
+    openrouterKey: string;
+    geminiKey: string;
+    geminiBaseUrl?: string;
+    /** Base URL + API key for a user-provided OpenAI-compatible endpoint (ollama, vLLM, LM Studio, etc.). */
+    openaiCompatibleBaseUrl: string;
+    openaiCompatibleApiKey: string;
+    orchestratorModel: string;
+    geminiModel: string;
+    /** Model for research subagents (issue #34); defaults to the (cheap) planner model. */
+    researchSubagentModel: string;
+    /**
+     * Thinking effort / model variant for a harness planner (ADR-0009), chosen
+     * from the agent's own discovered variants. Separate from the per-task
+     * efforts the plan carries — this one is the planner's own dial.
+     */
+    plannerThinkingEffort?: string;
+    planMapEnabled: boolean;
+    autonomousMode: boolean;
+    /**
+     * Run each AI task in its own git worktree and integrate the results on a
+     * per-run branch (ADR-0013). Non-git workspaces fall back to the shared
+     * workspace root regardless of this flag.
+     */
+    worktreeIsolation: boolean;
+    /**
+     * Shell command run in a fresh task worktree instead of symlinking ignored
+     * artifacts from the main worktree — for repos where sharing `node_modules`
+     * or a virtualenv is wrong.
+     */
+    worktreeSetupCommand?: string;
+    /**
+     * Repositories of the repo group listed by hand, relative to the workspace
+     * (ADR-0014). When non-empty the group is exactly these, replacing the
+     * repositories auto-detected directly inside the folder; needed for ones
+     * deeper than that, which are never auto-detected.
+     */
+    workspaceRepos: string[];
+    /**
+     * Extra paths or globs, relative to each repo root, linked from the real repo
+     * into its task worktree where they exist — gitignored local state such as
+     * `*.tfstate` that a task must use, not a copy of.
+     */
+    worktreeLinks: string[];
+    /**
+     * How many conflict repairs one task may go through before its conflict is
+     * left for a person (ADR-0015); 0 turns repair off.
+     */
+    conflictRepairAttempts: number;
+    /**
+     * What to do when planner research reaches outside its default envelope — an
+     * out-of-workspace path, or a shell command beyond the auto-allowed read-only
+     * set. `ask` prompts the user (and denies where no surface can prompt, such as
+     * headless runs); `allow` and `deny` skip the prompt entirely.
+     */
+    approvalMode: ApprovalMode;
+    /** Scopes granted up front, so CI and power users never see a prompt. Trailing `*` matches by prefix. */
+    approvalPreApproved: string[];
+    /** Get the base URL for an OpenAI-compatible provider. */
+    getProviderBaseUrl(provider: AiProvider): string;
+    /** Get the API key for a provider. */
+    getProviderApiKey(provider: AiProvider): string;
+    /**
+     * Push the canonical provider routing lists in (sole producer: ModelResolver).
+     * Config consumes them when resolving a chosen model id to its serving API.
+     */
+    setProviderModelLists(lists: ProviderModelLists): void;
+}
+declare function enabledRunners(cfg: IConfig): RunnerId[];
+
+declare class RunnerRegistry {
+    private readonly runners;
+    get(id: string): RunnerEntry | undefined;
+    getManifest(id: string): RunnerManifest | undefined;
+    list(): RunnerEntry[];
+    listEnabled(config: IConfig): RunnerEntry[];
+    listEnabledIds(config: IConfig): string[];
+}
+
+/** How a structured turn ended. `failed` carries the agent's own words in the preceding `error` event. */
+type StructuredTurnEnd = 'completed' | 'interrupted' | 'failed';
+/**
+ * One normalized event from a structured task (ADR-0018, O1b): the adapter's
+ * events, with the turn made explicit at both ends and the message queue (M1)
+ * alongside. Subagent work carries its `subagentId`. The source for the
+ * full-fidelity task log, never for verdicts.
+ */
+type StructuredEvent = Exclude<AgentEvent, {
+    type: 'turn_end' | 'permission_cancelled' | 'message_delivered' | 'message_dropped';
+}>
+/**
+ * `text` is the user message the turn answers; `messageId` is set when it had
+ * waited in the queue, `forced` when it was force sent (ADR-0023, Q2).
+ */
+ | {
+    type: 'turn_start';
+    text: string;
+    messageId?: string;
+    forced?: boolean;
+} | {
+    type: 'turn_end';
+    reason: StructuredTurnEnd;
+}
+/**
+ * Waiting in Ordewell's queue — again, for a message the runner was handed
+ * and let go of (ADR-0023, D4). `forced` puts it ahead of the rest, behind
+ * earlier forced ones (F2); a message already listed moves there.
+ */
+ | {
+    type: 'message_queued';
+    messageId: string;
+    text: string;
+    forced?: boolean;
+} | {
+    type: 'message_removed';
+    messageId: string;
+} | {
+    type: 'message_undelivered';
+    messageId: string;
+    text: string;
+}
+/** The runner accepted the message into its running turn; it can no longer be taken back (ADR-0023, D3). */
+ | {
+    type: 'message_handed_over';
+    messageId: string;
+}
+/** The model read the message inside the running turn, at this point of it (ADR-0023, Q2). */
+ | {
+    type: 'message_delivered';
+    messageId: string;
+    text: string;
+}
+/** An open `permission_request` was answered, by whoever answered it (ADR-0018, A1). */
+ | {
+    type: 'permission_decided';
+    id: string;
+    decision: ApprovalDecision;
+}
+/** An open `permission_request` can no longer be answered: the runner withdrew it, or its process is gone. */
+ | {
+    type: 'permission_withdrawn';
+    id: string;
+};
+interface QueuedTaskMessage {
+    id: string;
+    text: string;
+    /** The runner has it and owes a delivery, so it cannot be taken back (ADR-0023, Q1). */
+    handedOver?: boolean;
+    /** Force sent: it goes out as soon as the running turn is interrupted (ADR-0023, F1). */
+    forced?: boolean;
+}
+interface IRunnerSession {
+    id: string;
+    taskId: string;
+    onOutput(callback: (text: string) => void): void;
+    onExit(callback: (code: number) => void): void;
+    kill(): void;
+    getOutput(): string;
+    write(text: string): void;
+    /** `working` while a turn runs; `idle` between turns, waiting for a message. */
+    turnState(): 'working' | 'idle';
+    onTurnEnd(listener: (reason: StructuredTurnEnd) => void): void;
+    onEvent(listener: (event: StructuredEvent) => void): void;
+    /**
+     * Send a user message: at once when idle; while a turn runs, handed to the
+     * runner for its next step where it can take one, otherwise queued until
+     * the turn ends (ADR-0023). Returns its id, for {@link removeQueued}.
+     */
+    sendMessage(text: string): string;
+    /**
+     * Force send (ADR-0023, F1–F3): interrupt the running turn, as
+     * {@link interrupt} does, and deliver this message as the turn that
+     * replaces it, ahead of anything still queued. The task does not wait for
+     * input in between. With no turn running it is {@link sendMessage}.
+     */
+    forceSend(text: string): string;
+    /** Force send a message still queued, by id. False once it was handed over or delivered. */
+    forceSendQueued(id: string): boolean;
+    /** Take a message back before the runner has it. False once it was handed over or delivered. */
+    removeQueued(id: string): boolean;
+    /** Messages not yet delivered, oldest first: queued ones, and ones handed over that the runner owes. */
+    queued(): QueuedTaskMessage[];
+    /**
+     * Stop the running turn, keeping the session: a soft interrupt first, then —
+     * if the runner does not answer in time — kill and resume. Either way the
+     * turn ends `interrupted`. Resolves once it has.
+     */
+    interrupt(): Promise<void>;
+    /** The runner's own session id once announced — what a continue resumes (ADR-0018, K1). */
+    nativeSessionId(): string | null;
+    /**
+     * Answer a `permission_request` this session emitted, by its event id. False
+     * when it is no longer open — answered, withdrawn, or never asked.
+     */
+    answerPermission(id: string, decision: ApprovalDecision): boolean;
+    /**
+     * The runner's `task_complete` calls on this attempt's token (ADR-0022):
+     * the only completion evidence, for `VerdictEngine` to weigh.
+     */
+    onTaskComplete(listener: (report: TaskCompleteArgs) => void): void;
+    /**
+     * Answers the runner's `checkpoint` calls (ADR-0022, V5): the call stays
+     * open until the returned promise settles, and its result is the answer.
+     * `signal` aborts when the caller goes away.
+     */
+    onToolCheckpoint(handler: (question: string, signal: AbortSignal) => Promise<CheckpointAnswer>): void;
+}
+interface IRunner {
+    spawn(opts: {
+        taskId: string;
+        runner: string;
+        prompt: string;
+        modelId?: string;
+        thinkingEffort?: string;
+        modelVariants?: string[];
+        mode?: string;
+        cwd: string;
+        registry?: RunnerRegistry;
+        /** Task order and title — surfaces use these to label task_started/output events. */
+        order?: number;
+        title?: string;
+        /**
+         * The owning plan session. Task ids are only unique within one plan, so
+         * a runner that keys anything by task (the attempt's MCP token) needs this
+         * to keep two plans' identically named tasks apart.
+         */
+        planSessionId?: string;
+        /**
+         * The workspace's own variables (ADR-0016), under the runner's: a
+         * manifest's env still wins over them.
+         */
+        env?: Record<string, string>;
+        /** The runner's own session to continue in (ADR-0018, K1). */
+        resumeSessionId?: string;
+        /**
+         * Which run of the task this is, from 1. A structured runner binds the
+         * attempt's MCP token to it (ADR-0022, A2).
+         */
+        attempt?: number;
+        /**
+         * The task skills already rendered into `prompt`, as resolved for this
+         * attempt. Runners ignore it; it is for what wraps one to record (task logs).
+         */
+        skills?: readonly TaskSkillSnapshot[];
+        /** Something the user should know about how the spawn went that did not stop it — a respawn, most often. */
+        onNotice?: (message: string) => void;
+    }): Promise<IRunnerSession>;
+    stop(sessionId: string): void;
+    stopAll(): void;
+    activeCount: number;
+}
+
+export { type RunnerManifest as $, type AgentAdapter as A, type McpToolReply as B, type CatalogModel as C, DENY_ALL as D, type EditPlanArgs as E, type FetchAllProviderModelsOptions as F, ModelCatalog as G, type ModelShortcut as H, type IApproval as I, ORDEWELL_MCP_PATH as J, ORDEWELL_MCP_SERVER_NAME as K, LineBuffer as L, type McpClientConfig as M, type OrchestratorOption as N, ORCHESTRATOR_SHORTCUTS as O, OrdewellMcpServer as P, type OwnerOnlyFile as Q, PLANNER_TOOLS as R, type PlannerStartOptions as S, type PlannerTokenScope as T, type PlannerToolHandler as U, type ProviderCredentialSource as V, type ProviderModelLists as W, type ProviderModelsResult as X, type QueuedTaskMessage as Y, type RunnerEntry as Z, type RunnerFeatures as _, type AgentAdapterFactory as a, type RunnerMode as a0, type RunnerModelDiscovery as a1, RunnerRegistry as a2, type SpawnFn as a3, type StructuredEvent as a4, type StructuredTurnEnd as a5, type SubmitPlanArgs as a6, TASK_COMPLETE_TOOL as a7, TASK_TOOLS as a8, type TaskCompleteArgs as a9, type TaskModeAgentAdapter as aa, TaskModeUnsupportedError as ab, type TaskOutputArgs as ac, type TaskQueryArgs as ad, type TaskRunnerFlags as ae, type TaskStartOptions as af, type TaskTokenScope as ag, type TaskToolHandler as ah, approvalScopes as ai, collectProviderCredentials as aj, enabledRunners as ak, fetchAllProviderModels as al, isGranted as am, isRunnerApproval as an, knownModelId as ao, mcpClientConfig as ap, ownerOnlyConfigFile as aq, resolveModelShortcut as ar, resolveProvider as as, sharedMcpServer as at, toApprovalDecision as au, toOrchestratorOptions as av, type AgentEvent as b, type AgentProcessDeps as c, type AgentStartOptions as d, type AiProvider as e, type AllProviderModels as f, type ApprovalAnswer as g, type ApprovalDecision as h, type ApprovalKind as i, type ApprovalMode as j, ApprovalPolicy as k, type ApprovalPolicyOptions as l, type ApprovalRequest as m, type ApprovalSource as n, type CheckpointAnswer as o, type CheckpointArgs as p, type DiscoveryCommand as q, type IConfig as r, type IRunner as s, type IRunnerSession as t, type ListModelsArgs as u, type ListRunnersArgs as v, type LoadSkillArgs as w, type McpCredential as x, type McpTool as y, type McpToolContext as z };