@ordewell/core 0.7.2 → 0.8.0

package/dist/Task-BpzIbunq.d.mts

@@ -1,2599 +0,0 @@
-import { ChildProcess } from 'child_process';
-import { EventEmitter } from 'events';
-import { z } from 'zod/v4';
-
-/**
- * Why isolated execution is unavailable for a workspace. The orchestrator needs
- * the reason, not just a boolean: `dirty` is offered a stash or an explicit
- * "run without isolation", while the others fall back to the shared
- * workspace root with a one-line notice.
- */
-type IsolationInactiveReason = 'disabled' | 'git-missing' | 'not-git' | 'no-commits' | 'dirty';
-/**
- * `repos` names, relative to the workspace, the repositories behind the answer:
- * when active, the ones that will isolate, with `shared` the paths every task
- * will share live — loose entries of the workspace root, or, for a lone
- * repository, the repositories nested inside it; otherwise the dirty ones of a
- * `dirty` group, or the commitless ones of a `no-commits` group. A group of one
- * names none.
- */
-type IsolationAvailability = {
-    active: true;
-    repos?: string[];
-    shared?: string[];
-} | {
-    active: false;
-    reason: IsolationInactiveReason;
-    repos?: string[];
-};
-/**
- * Where a run's tasks work, as the planner is told it: the repos of the group
- * and the paths shared live between tasks. A lone repository is `['.']` with
- * nothing shared, unless it holds nested repositories, which are shared live
- * and named in `shared`.
- */
-interface RepoGroupLayout {
-    repos: string[];
-    shared: string[];
-}
-type IsolationOutcome = 'merged' | 'conflict' | 'failed';
-/**
- * `active` — worktree exists, a runner may be writing to it.
- * `kept` — released with its worktree and branch preserved for inspection.
- * `conflict` — integration stopped on a merge conflict; worktree and refs kept.
- * `repairing` — a conflict repair (ADR-0015) is working in the kept worktree;
- *   one that ends without landing leaves the task `conflict` again.
- * `failed` — integration hit a git error other than a conflict; refs kept.
- * `merged` — landed on the integration branch; worktree and task branch removed.
- */
-type IsolationTaskStatus = 'active' | 'kept' | 'conflict' | 'repairing' | 'failed' | 'merged';
-/** One repo's share of a task: its worktree inside the task workspace. */
-interface IsolationTaskRepo {
-    /** Absolute path of this repo's worktree: the task workspace joined with the repo's path. */
-    worktree: string;
-    /**
-     * Paths linked from the real workspace and kept out of the task's commit:
-     * the artifacts bootstrapped from the real repo, and a lone repository's
-     * nested repositories (`run.shared`). Recorded because a symlink is not
-     * matched by an ignore rule such as `node_modules/` and would otherwise be
-     * committed.
-     */
-    linked: string[];
-    /** Whether the task brought commits to this repo; unknown until it first integrates. */
-    changed?: boolean;
-    /**
-     * The integration tip right after the task landed here: what the user's
-     * HEAD must contain for the task's work to count as merged (ADR-0020).
-     */
-    landedTip?: string;
-}
-interface IsolationTaskRecord {
-    taskId: string;
-    order: number;
-    title: string;
-    /** One branch name, the same in every repo, so a task is one name to look up across the group. */
-    branch: string;
-    /**
-     * Absolute path of the task workspace, holding one worktree per repo at the
-     * repo's path. The Runner's cwd is inside it when the workspace is a repo
-     * subdirectory; for a group of one it is the worktree.
-     */
-    workspace: string;
-    /** For the task as a whole: landing is atomic across the repos it changed. */
-    status: IsolationTaskStatus;
-    /** Keyed by repo path. */
-    repos: Record<string, IsolationTaskRepo>;
-    /** The repo whose merge stopped the task from landing, while `status` is `conflict` or `failed`. */
-    conflictRepo?: string;
-    /**
-     * What a `failed` landing stopped on, in words a surface can repeat — a
-     * missing worktree is the common one. Cleared by the next landing attempt,
-     * so a stale reason cannot outlive the failure it explains.
-     */
-    landingError?: string;
-    /** Repo-relative paths, in `conflictRepo`, that conflicted; set only while `status` is `conflict` or `repairing`. */
-    conflictFiles?: string[];
-    /**
-     * Conflict repairs started for this task (ADR-0015). Counted when one starts,
-     * so a crash cannot hand the spent attempt back; absent reads as none.
-     */
-    repairs?: number;
-    /**
-     * Keyed by repo path: each changed repo's integration tip when the repair in
-     * flight started — what the task branch must contain before it may land.
-     * Set only while `status` is `repairing`.
-     */
-    repairBase?: Record<string, string>;
-    /**
-     * Every file a repair was started for, across all of them: as `conflictFiles`
-     * names it in a group of one, prefixed with its repo's path in a group.
-     */
-    repairedFiles?: string[];
-    /**
-     * Set once the task's landed work is in the checked-out HEAD of every repo
-     * it changed — merged into the user's branch, by Merge all or by hand. What
-     * a merge gate waits for (ADR-0020).
-     */
-    inHead?: true;
-}
-/**
- * A task's landing in flight: each changed repo's integration tip from before
- * the task's merge. On the run rather than the task record because it must
- * outlive that record — a retry drops and recreates it — until every repo is
- * back at its tip or the task has landed.
- */
-interface IsolationLanding {
-    taskId: string;
-    /** Keyed by repo path. */
-    tips: Record<string, string>;
-}
-/**
- * One repository of the group (ADR-0014). Every git operation on it runs in
- * `root`, never in the workspace root.
- */
-interface IsolationRepo {
-    /** Relative to the workspace root; `.` when the workspace is itself the repository. */
-    path: string;
-    /**
-     * Absolute: the workspace root joined with `path`. For a group of one that is
-     * the workspace root, which may be a subdirectory of the repository.
-     */
-    root: string;
-    /** The commit checked out at run start. Switching branches mid-run does not retarget it. */
-    baseRef: string;
-    /** Branch name checked out at run start; absent on a detached HEAD. */
-    baseBranch?: string;
-    integrationBranch: string;
-}
-/**
- * One Execute-Plan click or one manual task run over the workspace's repo
- * group. Plain JSON on purpose: the orchestrator persists it with the plan
- * state so a resumed session can find its integration branches again. The
- * module mutates `tasks` in place.
- */
-interface IsolationRun {
-    id: string;
-    workspaceRoot: string;
-    repos: IsolationRepo[];
-    /**
-     * Workspace paths outside every isolated repo, linked live into each task
-     * workspace: loose entries of the workspace root, the entries beside a deeper
-     * repo, and `sharedRepos`. For a lone repository, the repositories nested
-     * inside it, which cannot be isolated with it and so are linked live instead.
-     * Empty when a group of one holds no nested repositories.
-     */
-    shared: string[];
-    /** Repos of the group that could not be isolated — no commits, or git refused a worktree — and are among `shared`. */
-    sharedRepos: string[];
-    /** Keyed by task id — ids are unique within one plan and a run belongs to one plan. */
-    tasks: Record<string, IsolationTaskRecord>;
-    /**
-     * Set before a task's first merge and cleared once it has landed or been
-     * rolled back. One found set — after a crash, or a rollback git refused —
-     * names exactly what to return each repo's integration branch to.
-     */
-    landing?: IsolationLanding;
-}
-/**
- * What a plan persists of isolated execution (`LegacyPlanState.isolation`): its
- * run, and which added tasks resolve which conflicts. Belongs to that plan and
- * its branches alone, so a copy of the plan (a fork) must not carry it.
- */
-interface PlanIsolation {
-    run: IsolationRun;
-    /** Resolver task id → the conflicted task whose branch it merges. */
-    resolvers: Record<string, string>;
-}
-/**
- * A task's isolation as a surface shows it. `kept` covers every record whose
- * worktree stays for inspection — a failed verdict, an interrupted attempt, an
- * integration git refused — because to the user they are one thing: work that
- * did not land and can be looked at. `none` is a task with no worktree in a plan
- * that has an isolation run.
- */
-type TaskIsolationState = 'none' | 'active' | 'integrated' | 'conflict' | 'repairing' | 'kept';
-type TaskIsolation = {
-    state: 'none';
-} | {
-    state: Exclude<TaskIsolationState, 'none'>;
-    branch: string;
-    /** The task workspace; for a group of one, the task's worktree. */
-    worktree: string;
-    /** Paths of the repos the task changed. */
-    repos: string[];
-    conflictRepo?: string;
-    /** Repo-relative paths, in `conflictRepo`, that conflicted. */
-    conflictFiles?: string[];
-    /** The conflict repair running or last run, of the most a task may have; absent before its first. */
-    repair?: {
-        attempt: number;
-        limit: number;
-    };
-    /** What {@link IsolationTaskRecord.repairedFiles} says. */
-    repairedFiles?: string[];
-};
-interface IsolationLandedTask {
-    taskId: string;
-    order: number;
-    title: string;
-    /** Set when the task landed only after a conflict repair (ADR-0015): the files it was started for. */
-    repairedFiles?: string[];
-}
-interface IsolationHandoffRepo {
-    path: string;
-    integrationBranch: string;
-    baseRef: string;
-    /** Tasks whose work landed in this repo, in plan order. */
-    landed: IsolationLandedTask[];
-}
-interface IsolationHandoff {
-    repos: IsolationHandoffRepo[];
-    /** Tasks that landed on the integration branches, in plan order. */
-    landed: IsolationLandedTask[];
-}
-/** A plan's isolation as a surface shows it: a mark for each task the run touched, and its handoff. */
-interface IsolationView {
-    tasks: Record<string, TaskIsolation>;
-    handoff: IsolationHandoff;
-}
-/**
- * Why "Merge all" would not touch a repo. `partial-landing`: a task's landing
- * was interrupted and could not be rolled back there, so its integration
- * branch holds part of a task.
- */
-type IsolationMergeBlockReason = 'merge-in-progress' | 'conflict' | 'uncommitted-changes' | 'partial-landing' | 'git-error';
-interface IsolationMergeBlock {
-    repo: string;
-    reason: IsolationMergeBlockReason;
-    /** The files that would conflict, or the user's uncommitted ones the merge also changes; empty for the other reasons. */
-    files: string[];
-}
-/**
- * How "Merge all" went.
- * - `merged`: every repo with work on its integration branch took it.
- * - `blocked`: the preflight found repos that could not, so nothing was
- *   touched anywhere; `blocked` says which and why.
- * - `conflict` / `failed`: a merge stopped in `repo` — on git older than 2.38,
- *   which cannot preflight, or for a reason no preflight could foresee. That
- *   merge was aborted, leaving `repo` as it was; `landed` names the repos
- *   merged before it, which stay merged, and is absent when there are none.
- *
- * A group of one is blocked only by a partial landing; otherwise its one merge
- * lands or is aborted whole, so it reports as it always has.
- */
-type IsolationMergeResult = {
-    outcome: 'merged';
-} | {
-    outcome: 'blocked';
-    blocked: IsolationMergeBlock[];
-} | {
-    outcome: 'conflict' | 'failed';
-    repo: string;
-    files?: string[];
-    landed?: string[];
-};
-/**
- * What `discard` does with each repo's integration branch: `keep` it for review
- * or merge, `delete` it, or delete it only in the repos whose checked-out HEAD
- * already contains it (`delete-merged`) — the one way that can never give up
- * landed work the user has not merged.
- */
-type IntegrationDisposal = 'keep' | 'delete' | 'delete-merged';
-/**
- * Whether a conflict repair's work may land. `not-merged`: the task branch in
- * `repo` does not contain the tip the repair started from. `conflict-markers`:
- * it adds leftover conflict markers to `files`. `failed`: git could not tell.
- */
-type RepairEvidence = {
-    ok: true;
-} | {
-    ok: false;
-    reason: 'not-merged' | 'conflict-markers' | 'failed';
-    repo: string;
-    files?: string[];
-};
-interface PreparedTask {
-    cwd: string;
-    branch: string;
-    /**
-     * Paths, relative to the task workspace, that are copies rather than links
-     * because a hard link was impossible (Windows, another volume). Edits to them
-     * stay in the task, so the user is told.
-     */
-    copied: string[];
-    /** What the attempt this one replaces left unlanded, kept on a branch before its worktree went; absent when nothing was. */
-    preserved?: PreservedWork[];
-}
-/** A task as a removal names it. */
-type IsolationTaskRef = Pick<IsolationTaskRecord, 'taskId' | 'order' | 'title'>;
-/**
- * Work a removal found that had not landed — edits never committed, or
- * commits only the task's branch carried — committed and kept on `branch`,
- * a branch of its own under `ordewell-preserved/`, before the worktree went.
- */
-interface PreservedWork {
-    /** Absent for a leftover directory no task record owned. */
-    task?: IsolationTaskRef;
-    repo: string;
-    branch: string;
-    /** The commit `branch` points at. */
-    commit: string;
-}
-/** A worktree a removal left in place, because the work in it could not be kept any other way. */
-interface RefusedRemoval {
-    /** Absent for a leftover directory no task record owned. */
-    task?: IsolationTaskRef;
-    worktree: string;
-    /** What stopped git keeping it, in words a surface can repeat. */
-    reason: string;
-}
-/**
- * What removing task worktrees did in place of deleting work. A removal never
- * deletes work that has not landed: it keeps it on a branch first
- * (`preserved`), and where it cannot, it leaves that worktree alone
- * (`refused`) — so the record of a refused task stays too.
- */
-interface IsolationRemoval {
-    preserved: PreservedWork[];
-    refused: RefusedRemoval[];
-}
-/**
- * What a crash-recovery prune found and left alone: task records that were
- * `active` yet still held unlanded work, so the prune kept them as `kept`
- * rather than deleting work no one else has.
- */
-interface IsolationPruneResult extends IsolationRemoval {
-    kept: IsolationTaskRef[];
-}
-/**
- * The tracked changes of a workspace's repos at one moment, against each
- * repo's HEAD: repo path → file path → the content it held then. What an ops
- * task's tree check compares against (ADR-0020).
- */
-type TreeSnapshot = Record<string, Record<string, string>>;
-interface IWorktreeIsolation {
-    /**
-     * A repo group with at least one repo to isolate, a clean tracked tree in
-     * each, and the config enabled; otherwise the reason it is not.
-     */
-    isActive(workspaceRoot: string): Promise<IsolationAvailability>;
-    /**
-     * Put the tracked changes of every dirty repo of the group on its git stash,
-     * the user's way out of a `dirty` refusal. Untracked files stay: they never
-     * block isolation.
-     */
-    stash(workspaceRoot: string): Promise<void>;
-    /**
-     * Mint a run: resolve each repo's base ref to a commit now, and share the
-     * repos that cannot be isolated. Only meaningful after `isActive` said yes;
-     * throws when no repo of the group can be isolated after all.
-     */
-    startRun(workspaceRoot: string): Promise<IsolationRun>;
-    /**
-     * Create the task workspace — one worktree per isolated repo from its
-     * integration tip, the shared paths linked in — and return the cwd to spawn
-     * the Runner into. A second `prepare` for the same task is a retry: the old
-     * attempt is discarded and the workspace recreated from the tips, so the
-     * task sees everything its predecessors have integrated.
-     */
-    prepare(task: Task, run: IsolationRun): Promise<PreparedTask>;
-    /**
-     * Hand a conflicted task's kept workspace to a conflict repair (ADR-0015)
-     * as it is — nothing is re-cut — and return the same cwd. Records each
-     * changed repo's integration tip as `repairBase`, counts the repair, and
-     * moves the task to `repairing`. Throws for a task that is not `conflict`.
-     */
-    reopen(task: Task, run: IsolationRun): Promise<PreparedTask>;
-    /**
-     * The evidence a repair must show before it lands: its work committed, and
-     * in each repo of `repairBase` the task branch containing that tip
-     * (`git merge-base --is-ancestor`) and adding no leftover conflict markers
-     * (`git diff --check`; whitespace warnings do not count). Changes nothing
-     * else: a task that fails stays `repairing` until released.
-     */
-    verifyRepair(task: Task, run: IsolationRun): Promise<RepairEvidence>;
-    /**
-     * Land the task atomically across the repos it changed: commit each
-     * worktree, then `git merge --no-ff` the task branch into each changed
-     * repo's integration branch. If any merge conflicts or fails, it is aborted
-     * and the merges already made for the task are reset away, so `merged`
-     * always means the whole task landed. Serialized inside the module; among
-     * tasks waiting at once the lowest plan order goes first. On anything but
-     * `merged` the worktrees and refs stay, and nothing is resolved here: a
-     * conflict is repaired, if at all, by a new attempt of the task in its own
-     * worktree (ADR-0015), never inside this queue.
-     *
-     * `persist` is called once `run.landing` is set and before the first
-     * merge; the caller saves the run there, synchronously, which is what
-     * lets `pruneOrphans` finish a landing a crash interrupted.
-     */
-    integrate(task: Task, run: IsolationRun, persist?: () => void): Promise<IsolationOutcome>;
-    /**
-     * `keep: false` removes the task's worktree, branch and record (retry, task
-     * removal), keeping whatever had not landed on a branch first; a record
-     * whose work cannot be kept stays, off `active`. `keep: true` leaves the
-     * worktree and branch exactly as they are
-     * for inspection — a failed verdict, a stop, a cancel — and only moves the task off `active`,
-     * so a crash-recovery prune does not sweep it away; a repair it ends leaves
-     * the task `conflict`, as it was before the repair. Takes the run rather than
-     * a bare task id: ids are only unique within one plan, and one daemon serves
-     * many (ADR-0007).
-     */
-    release(run: IsolationRun, taskId: string, opts: {
-        keep: boolean;
-    }): Promise<IsolationRemoval>;
-    /** End of run: park the integration branch for review and report what landed. */
-    handoff(run: IsolationRun): Promise<IsolationHandoff>;
-    /**
-     * Drop what a crash left behind: a landing it interrupted is rolled back in
-     * every repo, a repair it interrupted leaves its task `conflict`, then stale
-     * active worktrees and directories no record owns go. An `active` record
-     * that still holds unlanded work — commits its branch alone carries, or
-     * edits in its worktree — is not a crash orphan: it may belong to a runner
-     * another host is still driving, so it is kept as `kept` and named in the
-     * result. A leftover directory holding work is kept on a branch before it
-     * goes, as {@link release} does.
-     */
-    pruneOrphans(run: IsolationRun): Promise<IsolationPruneResult>;
-    /** Unified diff of each repo's integration branch against its base ref. */
-    reviewDiff(run: IsolationRun): Promise<string>;
-    /**
-     * Mark the landed tasks whose work the checked-out HEAD now contains in
-     * every repo they changed (`git merge-base --is-ancestor`), and return their
-     * ids. Only adds marks: a task found merged stays merged.
-     */
-    findInHead(run: IsolationRun): Promise<string[]>;
-    /**
-     * The tracked changes of each committed repo of the workspace's group,
-     * except those in `exclude`; null when there is no repo to snapshot.
-     * Untracked and ignored files never count.
-     */
-    snapshotTree(workspaceRoot: string, exclude: readonly string[]): Promise<TreeSnapshot | null>;
-    /**
-     * Tracked files whose content differs from what `snapshot` recorded: new
-     * changes, and further changes to files already changed then. Paths are
-     * from the workspace root. A repo git cannot read now is left out.
-     */
-    changedSince(workspaceRoot: string, snapshot: TreeSnapshot): Promise<string[]>;
-    /**
-     * "Merge all": merge each repo's integration branch into whatever the user
-     * has checked out there. The one irreversible step, so it only ever happens
-     * when a caller asks for it. Every repo with work is preflighted first — no
-     * merge of the user's in progress, no conflict against their HEAD, no
-     * uncommitted edit to a file the merge changes — and unless all pass,
-     * nothing is merged anywhere. Only a merge Ordewell itself just started is
-     * ever aborted; nothing of the user's is reset. Waits for a landing in
-     * flight and holds the next back, so a merge during a run takes the
-     * integration branches between two landings, never part of one.
-     */
-    mergeIntoCheckedOut(run: IsolationRun): Promise<IsolationMergeResult>;
-    /**
-     * Remove every worktree and task branch of the run, and settle each repo's
-     * integration branch as `integration` says. Anything but `keep` also clears
-     * the run's task records, except those of worktrees it refused to remove.
-     * Work that had not landed is kept on a branch first, as {@link release} does.
-     */
-    discard(run: IsolationRun, opts: {
-        integration: IntegrationDisposal;
-    }): Promise<IsolationRemoval>;
-    /**
-     * Clear what other runs left in each repo of `run`'s group: every
-     * `ordewell/<run-id>/…` branch the repo's checked-out HEAD already contains.
-     * Never a branch of `run` itself, one a worktree has checked out, or any
-     * branch of a run that still has a worktree — that run may be live in
-     * another plan. Tries every repo, then throws naming those where git failed.
-     */
-    sweep(run: IsolationRun): Promise<void>;
-}
-
-/** Reads a runner's `--version` line, or undefined when it will not say. */
-type RunnerVersionProbe = (command: string, PATH: string) => Promise<string | undefined>;
-
-/** One source for the spawn options, so a runner built on this base cannot drift from the interface. */
-type RunnerSpawnOptions = Parameters<ITerminalRunner['spawn']>[0];
-declare abstract class AbstractTerminalSession implements ITerminalSession {
-    id: string;
-    taskId: string;
-    protected exited: boolean;
-    protected outputEmitter: EventEmitter<any>;
-    protected exitEmitter: EventEmitter<any>;
-    constructor(id: string, taskId: string);
-    protected baseHandleExit(code: number): void;
-    onOutput(callback: (text: string) => void): void;
-    onExit(callback: (code: number) => void): void;
-    abstract kill(): void;
-    abstract getOutput(): string;
-    abstract write(text: string): void;
-}
-declare abstract class AbstractRunner<S extends ITerminalSession> implements ITerminalRunner {
-    protected sessions: Map<string, S>;
-    get activeCount(): number;
-    stop(sessionId: string): void;
-    stopAll(): void;
-    protected registerSession(id: string, session: S): void;
-    abstract spawn(opts: RunnerSpawnOptions): Promise<ITerminalSession>;
-}
-
-declare function stripAnsi(text: string): string;
-declare function posixShellQuote(s: string): string;
-/**
- * Wrap a command for execution inside a POSIX login shell, which is what
- * resolves runner binaries managed by nvm/volta/asdf.
- *
- * Deliberately POSIX-only. This used to take a `platform` and emit
- * `powershell.exe -Command "'claude' '-p' '…'"` for Windows, which PowerShell
- * cannot run at all: a quoted string in leading position is parsed in
- * expression mode, so the invocation died with a parse error before the runner
- * started — a task that failed instantly, every time, on that platform. Windows
- * has no login-shell equivalent to emulate (its PATH comes from the registry
- * and is already inherited), so {@link planShellLaunch} starts the runner
- * directly there instead of routing it through a shell. Platform choice belongs
- * to that function; this one only knows how to phrase the POSIX half.
- */
-declare function buildShellInvocation(command: string, args: string[]): {
-    shellPath: string;
-    shellArgs: string[];
-};
-/** A terminal size in cells. */
-interface PtySize {
-    cols: number;
-    rows: number;
-}
-/**
- * Options for {@link wrapWithPty}. `size` sets the PTY's window size before the
- * wrapped command starts. `controlChannel` makes the wrapper listen on its fd 3
- * for `"<cols> <rows>"` lines and resize the PTY live — the caller spawns the
- * child with an extra pipe there and writes resize requests into it.
- */
-interface PtyWrapOptions {
-    size?: PtySize;
-    controlChannel?: boolean;
-    /** Decides which `script` is on the host; defaults to this process's platform. */
-    platform?: NodeJS.Platform;
-}
-/**
- * Wrap a command in `script` to allocate the PTY some runners require when
- * headless; `-e` propagates the child's exit code so verification still works.
- *
- * POSIX-only by nature — there is no `script` on Windows, which
- * `HeadlessRunner`'s `hasScriptCmd` probe already discovers, so this is never
- * reached there.
- *
- * `script` sizes its PTY off the terminal it is attached to; spawned off a pipe
- * (every transport here) it allocates 0x0, which a runner TUI renders as
- * garbage. `stty` fixes the size on the PTY slave before the command starts, so
- * the TUI reads its true dimensions via ioctl.
- *
- * The control channel can only live on a *separate* fd from the agent's stdin,
- * so the wrapper saves the PTY on fd 4 first: POSIX sends an asynchronous
- * command's stdin to `/dev/null`, so the watcher's own stdin cannot be the PTY.
- * A background job also inherits an fd 0 that is not the terminal; `stty` names
- * fd 4 explicitly for that reason.
- */
-declare function wrapWithPty(command: string, args: string[], opts?: PtyWrapOptions): {
-    command: string;
-    args: string[];
-};
-
-/**
- * cmd.exe's command-line buffer. A longer line is truncated rather than
- * rejected, which would corrupt a planner's system prompt or a task's prompt
- * mid-sentence and produce a confident answer to half a question — so the
- * batch route refuses instead. See {@link CommandLineTooLongError}.
- */
-declare const CMD_EXE_MAX_COMMAND_LINE = 8191;
-/**
- * CreateProcess's own ceiling, which the native and PowerShell routes are
- * bounded by instead. Windows truncates here too, so the same refusal applies —
- * it is simply four times further away.
- */
-declare const WINDOWS_MAX_COMMAND_LINE = 32767;
-interface LaunchPlan {
-    /** The executable handed to `spawn()` or `vscode.window.createTerminal`. */
-    file: string;
-    /** Arguments for `file`. Pass verbatim when {@link verbatim} is set. */
-    args: string[];
-    /**
-     * Windows batch route only: `args` is already a quoted command line and must
-     * not be re-quoted. Maps to `windowsVerbatimArguments` for `spawn`, and to
-     * the string form of `shellArgs` for a VS Code terminal.
-     */
-    verbatim?: boolean;
-}
-/** Test seam: every OS touchpoint is injectable, and production uses the defaults. */
-interface LaunchDeps {
-    platform?: NodeJS.Platform;
-    /** The PATH executables are looked up on. Defaults to the augmented PATH. */
-    resolvePath?: () => Promise<string>;
-    /** True when `candidate` names an existing file. */
-    exists?: (candidate: string) => boolean;
-    /** Absolute path to the Windows command interpreter. */
-    comSpec?: () => string;
-    /** Absolute path to Windows PowerShell. */
-    powerShell?: () => string;
-    /** PATHEXT, as the environment reports it. */
-    pathExt?: () => string;
-}
-/**
- * Thrown when a command's arguments do not fit the buffer of the only
- * interpreter that can start it. Windows truncates rather than rejecting, and a
- * system prompt cut off mid-sentence makes the planner answer half a question
- * confidently — the silent success this repo refuses — so this is raised
- * instead. `TaskOrchestrator.startTask` catches it and holds the task, so the
- * message is what the user reads: it names the fix, because they cannot infer
- * it from a truncated prompt.
- */
-declare class CommandLineTooLongError extends Error {
-    readonly command: string;
-    readonly length: number;
-    readonly limit: number;
-    constructor(command: string, length: number, limit?: number);
-}
-/**
- * Thrown when only a batch shim resolved for a multi-line argument. cmd.exe
- * reads up to the first CR/LF and discards the rest with no error and exit code
- * 0 — quoting does not help — so the agent would get the first paragraph of its
- * prompt without the completion marker instruction, then exit looking successful.
- */
-declare class EmbeddedNewlineError extends Error {
-    readonly command: string;
-    constructor(command: string);
-}
-/**
- * Thrown when `command` cannot be resolved to a real file. Kept distinguishable
- * from `WorkspaceNotFoundError` (utils/workspace) even though both a missing
- * cwd and a missing binary surface as the same `spawn` ENOENT to Node — the two
- * are checked, and named, separately so the failure names the actual cause.
- */
-declare class ExecutableNotFoundError extends Error {
-    readonly command: string;
-    readonly searchedPath: string;
-    constructor(command: string, searchedPath: string);
-}
-/**
- * Whether `command` actually resolves to a file, given the plan
- * {@link planDirectLaunch} produced for it and the PATH it was resolved
- * against.
- *
- * POSIX is deliberately identity in `planDirectLaunch` (execvp does its own
- * PATH search), so the search is repeated here instead. Windows already did
- * the search inside `planDirectLaunch` — signalled by the returned file
- * differing from the bare command name it was given; an unresolved command
- * comes back unchanged.
- */
-declare function isExecutableResolved(command: string, plan: LaunchPlan, PATH: string, deps?: LaunchDeps): boolean;
-/** The verbatim command line cmd.exe receives after `/d /s /c`, before wrapping. */
-declare function windowsCommandLine(file: string, args: string[]): string;
-/**
- * How to start `command` with `args` through `spawn()`, with no shell.
- *
- * POSIX returns its input unchanged — execvp already searches PATH, and adding
- * a resolution step there would be a new way for a working setup to break.
- *
- * Windows resolves the command against PATH × PATHEXT, preferring a native
- * executable (spawned directly) over a batch shim (through cmd.exe) over a
- * PowerShell script shim (through `powershell.exe -File`). A command that
- * resolves to nothing is returned unchanged, so the caller's existing ENOENT —
- * which names what the user typed — is what surfaces rather than a second,
- * vaguer error from here.
- *
- * The tiers are tried in preference order and the first that *fits* wins, with
- * one deliberate exception: an overflowing batch shim does not fall through to
- * PowerShell. Overflow means a very large prompt, which is precisely where
- * `-File` argument fidelity is least worth betting on, and where a clear held
- * task beats a plausibly-mangled one. So capacity does not reorder the tiers —
- * a `.ps1` beside a too-long `.cmd` still raises.
- *
- * A line break does reorder them: cmd.exe cannot carry one at any length, so a
- * `.ps1` beside a `.cmd` wins, and a lone `.cmd` raises.
- *
- * @throws {CommandLineTooLongError} when the selected route's buffer cannot
- * carry the arguments.
- * @throws {EmbeddedNewlineError} when the arguments span lines and only the
- * batch route resolved.
- */
-declare function planDirectLaunch(command: string, args: string[], deps?: LaunchDeps): Promise<LaunchPlan>;
-/**
- * How to start `command` for a surface that hands an executable and arguments
- * to a terminal — the VS Code runner today, a Windows TUI later.
- *
- * On POSIX this is the login shell, unchanged: `bash -lc` runs the user's
- * profile, which is how nvm/volta/asdf-managed runner binaries resolve at all.
- * Windows has no login-shell equivalent (its PATH comes from the registry and
- * is already inherited), so it takes the direct route instead. That is not just
- * a simplification: it means the runner's own exit code is the terminal's exit
- * code, rather than a `$LASTEXITCODE` that PowerShell propagates unreliably —
- * and the exit code is half of what {@link VerdictEngine} judges a task on.
- */
-declare function planShellLaunch(command: string, args: string[], deps?: LaunchDeps): Promise<LaunchPlan>;
-
-type SpawnFn = (command: string, args: string[], options: {
-    env: NodeJS.ProcessEnv;
-    stdio: Array<'pipe' | 'ignore'>;
-    cwd: string;
-    /** Set by the Windows batch route, where `args` is already a quoted command line. */
-    windowsVerbatimArguments?: boolean;
-    /** Set on POSIX so the runner leads its own process group (see `spawnInOwnGroup`). */
-    detached?: boolean;
-}) => ChildProcess;
-/** Test seam: every OS touchpoint is injectable; production uses the defaults. */
-interface HeadlessRunnerDeps {
-    spawnImpl?: SpawnFn;
-    hasScriptCmd?: () => boolean;
-    resolvePath?: () => Promise<string>;
-    /**
-     * Overrides for executable resolution ({@link planDirectLaunch}). Only the
-     * Windows branch consults them, so a POSIX test never needs to pass anything.
-     */
-    launchDeps?: LaunchDeps;
-    /** Reads the runner's version, for a manifest whose command line differs by major version. */
-    runnerVersion?: RunnerVersionProbe;
-}
-declare class HeadlessSession extends AbstractTerminalSession {
-    private spawnImpl;
-    readonly interactive: boolean;
-    private platform;
-    private process;
-    private outputBuffer;
-    private controlStream;
-    constructor(id: string, taskId: string, spawnImpl: SpawnFn, interactive?: boolean, platform?: NodeJS.Platform);
-    get isStarted(): boolean;
-    start(launch: LaunchPlan, cwd: string, resolvedPath: string, env?: Record<string, string>, options?: {
-        controlChannel?: boolean;
-    }): void;
-    kill(): void;
-    getOutput(): string;
-    write(text: string): void;
-    /** Closes the runner's stdin: what it has read so far is all it will get. */
-    endInput(): void;
-    /** PTY resize requests from a surface that owns the terminal rendering the wrapper. */
-    writeControl(text: string): void;
-}
-
-/** Everything needed to start one runner process, resolved before any child exists. */
-interface PreparedLaunch {
-    launch: LaunchPlan;
-    resolvedPath: string;
-    env: Record<string, string>;
-    /** True when the invocation was wrapped in `script` to allocate a PTY. */
-    pty: boolean;
-    /** True when the started process needs an explicit Enter sent to submit its pre-filled prompt. */
-    submitPromptKey: boolean;
-    /**
-     * True when nothing can be typed into the run: no TTY, no interactive shape,
-     * and the prompt already in its arguments. Its stdin is then closed, because
-     * a CLI such as `codex exec` reads a piped stdin to its end before starting.
-     */
-    closeStdin: boolean;
-}
-declare class HeadlessRunner extends AbstractRunner<HeadlessSession> {
-    private spawnImpl;
-    private hasScriptCmd;
-    private resolvePath;
-    private launchDeps;
-    private runnerVersion;
-    private spawnCount;
-    /**
-     * Session shape: a piped subprocess is not a terminal, so runners get their
-     * non-interactive subcommand. The VS Code runner owns a pseudoterminal and
-     * overrides this to true. Autonomy is a separate axis (see `ResolveContext`)
-     * and stays on either way — no surface has a human answering permission
-     * prompts on the orchestrator's behalf.
-     */
-    protected readonly defaultInteractive: boolean;
-    constructor(deps?: HeadlessRunnerDeps);
-    /**
-     * Unique per spawn, not per task: a retry reuses its task id and ids often
-     * share a prefix, and a shared registry key let the old attempt's exit
-     * unregister the new one. Unlike TmuxRunner, nothing outside this process
-     * keys on the id, so a counter is enough to scope it to the attempt.
-     */
-    protected nextSessionId(taskId: string): string;
-    protected createSession(id: string, taskId: string): HeadlessSession;
-    /** Everything up to, but not including, spawning — so a surface that owns its own child reaches the same decisions. */
-    protected prepareLaunch(opts: RunnerSpawnOptions, ptyOptions?: PtyWrapOptions): Promise<PreparedLaunch>;
-    spawn(opts: RunnerSpawnOptions): Promise<ITerminalSession>;
-}
-
-/**
- * What one model call consumed, as its provider or runner reported it. Shared
- * by the planner's usage line (#49) and per-attempt task usage (#26): a record
- * says nothing about who asked for the call, so either can hold a list of them.
- *
- * Every measure is optional because backends report different subsets. An
- * absent field means "not reported" — never zero — so a total can tell the two
- * apart.
- */
-interface UsageRecord {
-    /** The provider or runner id that reported the call — `openai`, `claude-code`, … */
-    source: string;
-    model?: string;
-    inputTokens?: number;
-    outputTokens?: number;
-    /** The share of `inputTokens` served from the provider's prompt cache. */
-    cachedInputTokens?: number;
-    /**
-     * Filled only from a provider's or runner's own report, never from a price
-     * table or an estimate: prices go stale, and a subscription runner has no
-     * per-token price at all. No report means no cost, not a guessed one.
-     */
-    reportedCost?: {
-        amount: number;
-        currency: string;
-    };
-    /** The model's context window, when the runner itself reports it. */
-    contextWindow?: number;
-    /** Set when a subagent made the call; its usage still counts toward the total. */
-    subagentId?: string;
-}
-/**
- * A running sum of {@link UsageRecord}s. A measure stays absent until some
- * record reports it. Cost is kept per currency: two runners may bill in
- * different ones, and there is no honest exchange rate to fold them together.
- */
-interface UsageTotals {
-    inputTokens?: number;
-    outputTokens?: number;
-    cachedInputTokens?: number;
-    reportedCost?: Record<string, number>;
-}
-/**
- * The input side of a call whose provider reports its prompt in parts — the
- * uncached tail, with cache reads and cache writes beside it rather than inside
- * it (Anthropic, and OpenCode after it). The prompt the model saw is all three;
- * only the reads were served from cache, since a write is billed as fresh
- * input. A part left unreported adds nothing, and with no part reported there
- * is no measure at all.
- */
-declare function partedPromptUsage(parts: {
-    uncached?: number;
-    cacheRead?: number;
-    cacheWrite?: number;
-}): Pick<UsageRecord, 'inputTokens' | 'cachedInputTokens'>;
-declare function addUsage(totals: UsageTotals, record: UsageRecord): UsageTotals;
-/**
- * What the planner has consumed over a session (#49). `totals` includes every
- * `bySubagent` entry. `lastPromptTokens` and `contextWindow` track the
- * planner's own calls only — a subagent runs its own model, whose window says
- * nothing about the planner's.
- */
-interface PlannerUsage {
-    totals: UsageTotals;
-    bySubagent?: Record<string, UsageTotals>;
-    lastPromptTokens?: number;
-    contextWindow?: number;
-}
-declare function addPlannerUsage(usage: PlannerUsage, record: UsageRecord): PlannerUsage;
-/** Whether any measure was reported: a token line of nothing but blanks says nothing. */
-declare function isMeasured(totals: UsageTotals): boolean;
-/** What the token line shows of a ledger — live from its broadcast, or reloaded from the saved one. */
-interface UsageLine {
-    totals: UsageTotals;
-    bySubagent?: Record<string, UsageTotals>;
-    contextFill?: {
-        usedTokens: number;
-        windowTokens: number;
-    };
-}
-declare function usageLine(usage: PlannerUsage): UsageLine;
-/**
- * The last planner prompt against its window, or undefined while either is
- * unknown. `usedTokens` is the prompt total as reported, cached tokens
- * included: a cached token still occupies the window, so subtracting the
- * cached share would understate how full the context is. A window of 0 is
- * treated as unknown — never guessed.
- */
-declare function plannerContextFill(usage: PlannerUsage): {
-    usedTokens: number;
-    windowTokens: number;
-} | undefined;
-
-/**
- * The planner's single approval seam. Every capability that reaches beyond the
- * default read-only, in-workspace envelope — a path outside the workspace root,
- * a shell command outside the auto-allowed set, a URL fetch — routes through
- * one `request()` so the policy has exactly one owner (the same "one repair
- * owner" shape as PlanRepair).
- *
- * Surfaces supply the human channel. VS Code answers with a modal; the web
- * server currently has no prompt UI, so it denies unless the scope was
- * pre-approved through config. Denial is always a visible, actionable tool
- * result — never a silent success.
- */
-/**
- * `runner_tool` is a task runner's own tool request (ADR-0018, A1): it waits
- * for an answer as long as it takes, and never passes through the planner's
- * policy — the runner's mode already decided it needed asking.
- */
-type ApprovalKind = 'external_path' | 'shell_command' | 'url_fetch' | 'runner_tool';
-interface ApprovalRequest {
-    kind: ApprovalKind;
-    /** The concrete thing being asked about: an absolute path, a command line, a URL. */
-    subject: string;
-    /**
-     * What a grant covers. Approving remembers this, not `subject`, so reading a
-     * second file from an already-approved directory does not prompt again.
-     */
-    scope: string;
-    /**
-     * Every scope one answer settles, when a command needs more than one — its
-     * own and each outside directory it touches — so it prompts once rather than
-     * once per scope. `scope` is the first. Absent means `scope` alone.
-     */
-    scopes?: string[];
-    /** One-line context for the prompt. */
-    detail?: string;
-    /** The task whose runner asked; absent for the planner's own requests. */
-    taskId?: string;
-    /** "Allow for this task" can be offered: the runner proposed its own session-scoped grant. */
-    allowForTask?: boolean;
-}
-/**
- * An answer, from whoever gives it — a person on any surface, or later the
- * supervisor (#28). `allowForTask` is Allow plus the runner's own grant for
- * the rest of the task; `note` goes back to the agent with a denial.
- */
-type ApprovalDecision = {
-    decision: 'allow';
-} | {
-    decision: 'allowForTask';
-} | {
-    decision: 'deny';
-    note?: string;
-};
-/** What an answer may be given as: a planner prompt's yes/no still is one. */
-type ApprovalAnswer = boolean | ApprovalDecision;
-declare function toApprovalDecision(answer: ApprovalAnswer): ApprovalDecision;
-declare function isGranted(decision: ApprovalDecision): boolean;
-declare function approvalScopes(request: ApprovalRequest): string[];
-declare function isRunnerApproval(request: ApprovalRequest): boolean;
-interface IApproval {
-    request(req: ApprovalRequest): Promise<boolean>;
-}
-/** Denies everything. The safe default when a surface wires no approval channel. */
-declare const DENY_ALL: IApproval;
-
-/**
- * The tools of the Ordewell MCP server, per token role (ADR-0022), and the
- * handler interfaces the session side implements to answer them.
- *
- * Every handler method is optional so each tool can be wired on its own; one
- * left unset answers its call with a "not available" error rather than
- * disappearing from `tools/list`, so the list a runner sees never depends on
- * how far the wiring has got.
- */
-declare const taskCompleteInput: z.ZodObject<{
-    status: z.ZodEnum<{
-        failed: "failed";
-        blocked: "blocked";
-        done: "done";
-    }>;
-    summary: z.ZodString;
-    reason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-declare const checkpointInput: z.ZodObject<{
-    question: z.ZodString;
-}, z.core.$strip>;
-declare const listRunnersInput: z.ZodObject<{}, z.core.$strip>;
-declare const listModelsInput: z.ZodObject<{
-    runner: z.ZodString;
-}, z.core.$strip>;
-declare const submitPlanInput: z.ZodObject<{
-    tasks: z.ZodArray<z.ZodObject<{
-        id: z.ZodOptional<z.ZodString>;
-        order: z.ZodOptional<z.ZodNumber>;
-        title: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-        type: z.ZodOptional<z.ZodEnum<{
-            user: "user";
-            ai: "ai";
-        }>>;
-        dependencies: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        prompt: z.ZodOptional<z.ZodString>;
-        userSteps: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            order: z.ZodOptional<z.ZodNumber>;
-            instruction: z.ZodString;
-        }, z.core.$loose>>>;
-        assignedRunner: z.ZodOptional<z.ZodString>;
-        assignedModel: z.ZodOptional<z.ZodObject<{
-            modelId: z.ZodString;
-            modelLabel: z.ZodOptional<z.ZodString>;
-            thinkingEffort: z.ZodOptional<z.ZodString>;
-        }, z.core.$loose>>;
-        taskMode: z.ZodOptional<z.ZodString>;
-        autonomy: z.ZodOptional<z.ZodEnum<{
-            AFK: "AFK";
-            HITL: "HITL";
-        }>>;
-        sliceType: z.ZodOptional<z.ZodEnum<{
-            AFK: "AFK";
-            HITL: "HITL";
-        }>>;
-        ops: z.ZodOptional<z.ZodBoolean>;
-        userStoriesCovered: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        subtasks: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
-    }, z.core.$loose>>;
-}, z.core.$strip>;
-declare const editPlanInput: z.ZodObject<{
-    ops: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-        op: z.ZodLiteral<"update">;
-        taskId: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
-        changes: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    }, z.core.$strip>, z.ZodObject<{
-        op: z.ZodLiteral<"add">;
-        task: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-        handle: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodObject<{
-        op: z.ZodLiteral<"remove">;
-        taskId: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
-    }, z.core.$strip>, z.ZodObject<{
-        op: z.ZodLiteral<"reorder">;
-        taskIds: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
-    }, z.core.$strip>, z.ZodObject<{
-        op: z.ZodLiteral<"merge">;
-        taskIds: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
-        merged: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-        handle: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodObject<{
-        op: z.ZodLiteral<"split">;
-        taskId: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
-        parts: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        handle: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodObject<{
-        op: z.ZodLiteral<"rearm">;
-        taskId: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
-        changes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, z.core.$strip>]>>;
-}, z.core.$strip>;
-declare const taskQueryInput: z.ZodObject<{
-    tasks: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
-    fields: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-        description: "description";
-        prompt: "prompt";
-        userSteps: "userSteps";
-        verdict: "verdict";
-        outputSummary: "outputSummary";
-        userStoriesCovered: "userStoriesCovered";
-    }>>>;
-    catalog: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strip>;
-declare const taskOutputInput: z.ZodObject<{
-    task: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
-    lines: z.ZodOptional<z.ZodNumber>;
-    since: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>;
-type TaskCompleteArgs = z.infer<typeof taskCompleteInput>;
-type CheckpointArgs = z.infer<typeof checkpointInput>;
-type ListRunnersArgs = z.infer<typeof listRunnersInput>;
-type ListModelsArgs = z.infer<typeof listModelsInput>;
-type SubmitPlanArgs = z.infer<typeof submitPlanInput>;
-type EditPlanArgs = z.infer<typeof editPlanInput>;
-type TaskQueryArgs = z.infer<typeof taskQueryInput>;
-type TaskOutputArgs = z.infer<typeof taskOutputInput>;
-/** What a handler answers with. `isError` marks a refusal the caller should act on. */
-interface McpToolReply {
-    text: string;
-    isError?: boolean;
-}
-/**
- * How a checkpoint call ended. `withdrawn` is the attempt going away under it
- * (verdict, cancel, retry, stop) or the call being refused, not a verdict on
- * the question.
- */
-type CheckpointAnswer = {
-    kind: 'continue';
-} | {
-    kind: 'rejected';
-    reason: string;
-} | {
-    kind: 'withdrawn';
-    why: string;
-};
-interface McpToolContext {
-    /** Aborts when the token is revoked or the caller cancels — a waiting handler must stop. */
-    signal: AbortSignal;
-}
-type Run<A> = (args: A, context: McpToolContext) => Promise<McpToolReply>;
-interface TaskToolHandler {
-    taskComplete?: Run<TaskCompleteArgs>;
-    checkpoint?: Run<CheckpointArgs>;
-}
-interface PlannerToolHandler {
-    listRunners?: Run<ListRunnersArgs>;
-    listModels?: Run<ListModelsArgs>;
-    submitPlan?: Run<SubmitPlanArgs>;
-    editPlan?: Run<EditPlanArgs>;
-    taskQuery?: Run<TaskQueryArgs>;
-    taskOutput?: Run<TaskOutputArgs>;
-}
-interface McpTool<H> {
-    name: string;
-    description: string;
-    inputSchema: {
-        type: 'object';
-        [key: string]: unknown;
-    };
-    annotations?: {
-        readOnlyHint: boolean;
-    };
-    /** Validate `args` and hand them to the handler's method for this tool. */
-    call(handler: H, args: unknown, context: McpToolContext): Promise<McpToolReply>;
-}
-/** The task tool whose call settles the attempt (ADR-0022, V1). */
-declare const TASK_COMPLETE_TOOL = "task_complete";
-declare const TASK_TOOLS: readonly McpTool<TaskToolHandler>[];
-declare const PLANNER_TOOLS: readonly McpTool<PlannerToolHandler>[];
-
-/**
- * The Ordewell MCP server (ADR-0022): one loopback listener per process,
- * shared by every session in it, where the caller's token alone decides which
- * tools it sees and which session and task its calls reach.
- */
-declare const ORDEWELL_MCP_PATH = "/mcp";
-interface OrdewellMcpServerOptions {
-    /** How often a call that is still waiting tells its caller so. */
-    heartbeatMs?: number;
-}
-interface TaskTokenScope {
-    sessionId: string;
-    taskId: string;
-    /** The attempt generation the token is good for; a later attempt gets a new token. */
-    attempt: number;
-}
-interface PlannerTokenScope {
-    sessionId: string;
-}
-/** Where a runner reaches the server and what it presents there. Never put either half in a prompt. */
-interface McpCredential {
-    url: string;
-    token: string;
-}
-declare class OrdewellMcpServer {
-    private readonly grants;
-    private http;
-    private listening;
-    private boundUrl;
-    private boundHost;
-    private readonly heartbeatMs;
-    constructor(options?: OrdewellMcpServerOptions);
-    /** The listener's URL, once the first token has started it. */
-    get url(): string | undefined;
-    issueTaskToken(scope: TaskTokenScope, handler?: TaskToolHandler): Promise<McpCredential>;
-    issuePlannerToken(scope: PlannerTokenScope, handler?: PlannerToolHandler): Promise<McpCredential>;
-    /** Refuse every later request carrying `token`, and abort the calls it has in flight. */
-    revoke(token: string): void;
-    dispose(): Promise<void>;
-    private issue;
-    private start;
-    private handle;
-}
-/** The process's one server, which the daemon and the extension host hand to every session they build. */
-declare function sharedMcpServer(): OrdewellMcpServer;
-
-/** The server's name in every runner's MCP configuration, and so in its tool names (`mcp__ordewell__*`). */
-declare const ORDEWELL_MCP_SERVER_NAME = "ordewell";
-interface McpClientConfig {
-    name: typeof ORDEWELL_MCP_SERVER_NAME;
-    url: string;
-    headers: Record<string, string>;
-}
-/**
- * The one shape every runner adapter renders its own MCP configuration from.
- * The token travels only in `headers`: the adapter writes it to an owner-only
- * file or an environment variable, never a prompt or a process argument
- * (ADR-0022, A4/A5).
- */
-declare function mcpClientConfig(credential: McpCredential): McpClientConfig;
-/** A runner's MCP configuration on disk, and the way to take it back off. */
-interface OwnerOnlyFile {
-    path: string;
-    /** Delete the file. Idempotent. */
-    remove(): void;
-}
-/**
- * Write a configuration that carries a token where only the user can read it,
- * for a runner that takes its MCP servers from a file (ADR-0022, A5). The
- * directory is private too, so the name cannot be raced before the mode lands.
- */
-declare function ownerOnlyConfigFile(fileName: string, contents: string): OwnerOnlyFile;
-
-/**
- * The harness-planner transport contract (ADR-0009).
- *
- * One adapter per coding agent, each speaking that agent's own programmatic
- * protocol and normalizing it to the event union below. Everything above this
- * line — reply classification, the repair loop, plan validation, the four
- * surfaces — is already provider-agnostic, so an adapter is the entire cost of
- * teaching Ordewell to plan with another agent.
- */
-/**
- * One normalized event from a running agent turn. Deliberately smaller than
- * any single agent's native protocol: this is the intersection Ordewell can act
- * on, not a lossless re-encoding. Event fidelity differs by agent — `thinking`
- * is rich on Claude Code and absent elsewhere — so consumers must tolerate a
- * turn that emits nothing but `assistant_text` and `turn_end`.
- */
-type AgentEvent = 
-/**
- * A complete run of the assistant's reply. Concatenated in order to form the
- * turn's text. When the same run already streamed as `assistant_text_delta`,
- * this is the authoritative copy of it — it replaces the deltas, it is not
- * appended after them.
- */
-{
-    type: 'assistant_text';
-    text: string;
-}
-/**
- * An incremental piece of the assistant's reply, for agents that stream
- * partial messages. The planner's own text only: a subagent's words never
- * arrive here, so they can never become the reply.
- */
- | {
-    type: 'assistant_text_delta';
-    text: string;
-}
-/**
- * Reasoning the agent chose to expose. Never contributes to the reply text.
- * Like `assistant_text`, it supersedes deltas already streamed for it.
- */
- | {
-    type: 'thinking';
-    text: string;
-    subagentId?: string;
-} | {
-    type: 'thinking_delta';
-    text: string;
-    subagentId?: string;
-}
-/** `subagentId` marks a call made inside a subagent rather than by the planner itself. */
- | {
-    type: 'tool_call';
-    id: string;
-    name: string;
-    args: Record<string, unknown>;
-    subagentId?: string;
-} | {
-    type: 'tool_result';
-    id: string;
-    name: string;
-    output: string;
-    success: boolean;
-    subagentId?: string;
-}
-/** One model call's usage, as the agent reported it — never estimated. */
- | {
-    type: 'usage';
-    record: UsageRecord;
-}
-/** The agent delegated `brief` to a subagent, whose events carry `subagentId` until it finishes. */
- | {
-    type: 'subagent_started';
-    subagentId: string;
-    brief: string;
-    model?: string;
-} | {
-    type: 'subagent_finished';
-    subagentId: string;
-    outcome: SubagentOutcome;
-    digest: string;
-}
-/**
- * The agent asked to do something its mode does not cover. A planner always
- * auto-denies it (T1) — a planner that can mutate is not a planner — and the
- * adapter answers so the turn does not hang. A task's request stays open
- * until {@link TaskModeAgentAdapter.answerPermission} (ADR-0018, A1).
- *
- * `input` and `suggestions` are the raw request; `suggestions` are the
- * agent's own session-scoped grants, what "Allow for this task" answers with.
- * `decided` marks a request the task's mode already answered — the adapter
- * replied as the manifest says that mode does — so it is shown, never asked.
- */
- | {
-    type: 'permission_request';
-    id: string;
-    name: string;
-    detail: string;
-    input?: Record<string, unknown>;
-    suggestions?: unknown[];
-    toolUseId?: string;
-    decided?: ApprovalDecision;
-}
-/** The agent withdrew an open request — an interrupt cancels the call it was for. It takes no answer now. */
- | {
-    type: 'permission_cancelled';
-    id: string;
-}
-/**
- * The agent delegated work to a subagent it left running in the background,
- * and may end its turn before that work reports. Ordewell's conversation is
- * request/response: a turn that ends hands control back to the user, and
- * anything the agent says afterwards arrives with no turn open and is lost.
- * Naming the launch is what lets the service ask for the results in time.
- */
- | {
-    type: 'background_agent';
-    id: string;
-}
-/**
- * The agent finished its turn and is waiting for the next user message.
- * `interrupted` marks a turn cut short by {@link TaskModeAgentAdapter.interrupt}
- * rather than one the agent chose to end.
- */
- | {
-    type: 'turn_end';
-    interrupted?: boolean;
-}
-/**
- * The model has a message handed over by {@link TaskModeAgentAdapter.steer},
- * by the runner's own account rather than because the write succeeded
- * (ADR-0023, D3). With no turn open, the runner opened one for it.
- */
- | {
-    type: 'message_delivered';
-    id: string;
-}
-/**
- * The runner let go of a message it accepted from `steer` without showing it
- * to the model — Codex does, for one its turn ended before consuming. It is
- * Ordewell's to send again (ADR-0023, D4).
- */
- | {
-    type: 'message_dropped';
-    id: string;
-}
-/** The turn failed. Carries the agent's own words — never a Ordewell paraphrase. */
- | {
-    type: 'error';
-    message: string;
-};
-interface AgentStartCommon {
-    /** Workspace root. The agent works from here and, in read-only mode, cannot leave it. */
-    cwd: string;
-    /** Model id from the runner's own discovery catalog. Omitted means the agent's default. */
-    model?: string;
-    /**
-     * The agent's own session id from a previous run. For the planner a hint
-     * only: Ordewell's transcript is the source of truth (T4), so a failed resume
-     * degrades to a fresh session seeded from the stored history, not an error.
-     */
-    resumeSessionId?: string;
-}
-/** The read-only planner (ADR-0008/0009). The only start `CliAgentAiService` can express. */
-interface PlannerStartOptions extends AgentStartCommon {
-    kind: 'planner';
-    /** The planner system prompt, in its harness variant. */
-    systemPrompt: string;
-    /** Variant / reasoning effort id from that model's `variants` list. */
-    effort?: string;
-    /** The Ordewell MCP server to inject, pre-authorized (ADR-0022). Only for an adapter with {@link AgentAdapter.mcpAttached}. */
-    mcp?: McpClientConfig;
-}
-/**
- * What a runner manifest says the task's mode and effort mean (ADR-0001),
- * resolved by the same code terminal tasks use — see `resolveTaskRunnerFlags`.
- * The adapter adds only its protocol flags around these.
- */
-interface TaskRunnerFlags {
-    /** The runner's own permission-mode value for the task's mode. */
-    permissionMode: string;
-    /** The task's raw effort id, present only alongside a model. Each adapter maps it to its own protocol. */
-    effort?: string;
-    /** The manifest's further settings for the task's mode, by setting name — see `PluginFeatures.modeSettings`. */
-    modeSettings: Record<string, string>;
-}
-/** A plan task driven over the runner's programmatic protocol (ADR-0018, C1). */
-interface TaskStartOptions extends AgentStartCommon {
-    kind: 'task';
-    /** The task's runner mode id, as the plan names it. */
-    mode: string;
-    flags: TaskRunnerFlags;
-    /**
-     * The Ordewell MCP server and this attempt's token (ADR-0022). An adapter
-     * that can inject it does, with its tools pre-approved; one that cannot
-     * ignores it, and the task completes by its marker.
-     */
-    mcp?: McpClientConfig;
-}
-/**
- * The explicit start switch. Discriminated so that a read-only planner and a
- * mutating task can never be confused by a missing field: every caller names
- * which one it is starting.
- */
-type AgentStartOptions = PlannerStartOptions | TaskStartOptions;
-/** A runner asked to start in task mode that has no task-mode connector yet. */
-declare class TaskModeUnsupportedError extends Error {
-    readonly runner: string;
-    constructor(runner: string);
-}
-interface AgentAdapter {
-    /** The runner id this adapter drives — `claude-code`, `codex`, `opencode`. */
-    readonly agentId: string;
-    /** Spawn the agent — read-only for a planner, in the task's mode for a task — ready to receive messages. */
-    start(opts: AgentStartOptions): Promise<void>;
-    /**
-     * Send one user message and stream the turn's events until it ends. Resolves
-     * when the agent yields the floor; rejects only when the transport itself
-     * failed in a way no `error` event could describe.
-     *
-     * `onActivity`, when given, fires on raw transport traffic — every stdio
-     * line or stream chunk the process produces — independent of whether that
-     * traffic becomes an `AgentEvent`. An adapter may legitimately emit nothing
-     * for long stretches (a subagent's filtered output, most often); a caller
-     * using presence-of-events as a liveness signal would read that silence as
-     * a hang. `onActivity` is the seam that keeps liveness detection from being
-     * coupled to what each adapter chooses to surface.
-     */
-    send(message: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal, onActivity?: () => void): Promise<void>;
-    /** The agent's native session id once it has announced one. Resumption hint only. */
-    nativeSessionId(): string | null;
-    /** Kill the process and release its resources. Idempotent. */
-    dispose(): void;
-    /**
-     * Whether the Ordewell MCP server passed in {@link PlannerStartOptions.mcp}
-     * is connected, as the runner itself reports it (ADR-0022, S4). Absent on an
-     * adapter that cannot inject the server at all.
-     */
-    mcpAttached?(): Promise<boolean>;
-}
-/** What an adapter adds to run a task rather than a planner (ADR-0018). */
-interface TaskModeAgentAdapter extends AgentAdapter {
-    /**
-     * Ask the running turn to stop, keeping the process and its session. Resolves
-     * true once the agent acknowledged it; the turn then ends with
-     * `turn_end { interrupted: true }`. False means the agent did not answer
-     * within `timeoutMs`, and the caller must fall back to killing it.
-     */
-    interrupt(timeoutMs: number): Promise<boolean>;
-    /**
-     * Registers the listener for what the agent does after a turn has ended and
-     * before the next message — a turn it opens itself when background work
-     * finishes, most often. Without one that output is dropped, which is right
-     * for a planner and wrong for a task, whose marker may be said there.
-     */
-    onOutOfTurn?(listener: (event: AgentEvent) => void): void;
-    /** Registers a listener for the process ending, for any reason. Fires at most once. */
-    onProcessExit(listener: (code: number) => void): void;
-    /**
-     * Hand a message to the running turn, for the runner to show the model at
-     * its next step boundary (ADR-0023, D1–D2). Resolves true once the runner
-     * accepted it: handed over, not yet delivered — the turn's events later
-     * carry `message_delivered` or `message_dropped` for `id`. False when the
-     * runner refused it or no turn is running; the caller keeps it for the
-     * turn's end. Absent on an adapter whose runner cannot take a message
-     * mid-turn.
-     */
-    steer?(id: string, text: string): Promise<boolean>;
-    /**
-     * Answer an open `permission_request`. False when the id is not open — it
-     * was answered, cancelled, or never asked.
-     */
-    answerPermission(id: string, decision: ApprovalDecision): boolean;
-}
-/**
- * The single injected boundary between Ordewell and the operating system —
- * the same pattern `HeadlessRunnerDeps` uses for task execution. Tests feed
- * recorded agent output through `spawn` (and, for HTTP-transport agents,
- * `fetch`) so one test exercises adapter parsing, event mapping, reply
- * classification and the repair loop as a single observable behavior.
- */
-interface AgentProcessDeps {
-    spawn: SpawnFn;
-    fetch: typeof globalThis.fetch;
-    /** Resolves the PATH agents are spawned under. Defaults to the augmented PATH. */
-    resolvePath?: () => Promise<string>;
-    /** Host platform. Defaults to the real one; injected so OS-specific behavior is testable anywhere. */
-    platform?: NodeJS.Platform;
-    /** True when `workspace` names an existing directory. Defaults to a real filesystem check. */
-    isDirectory?: (workspace: string) => boolean;
-    /** True when `candidate` names an existing, spawnable file. Defaults to a real filesystem check. */
-    exists?: (candidate: string) => boolean;
-    /** The workspace's own variables for a cwd (ADR-0016). Defaults to {@link resolveWorkspaceEnv}. */
-    workspaceEnv?: (cwd: string) => Promise<Record<string, string>>;
-}
-/** Builds the adapter for one runner id, or null when that runner cannot plan. */
-type AgentAdapterFactory = (runner: string, deps: AgentProcessDeps) => AgentAdapter | null;
-/**
- * Split a stream of chunks into complete lines. Every agent transport here is
- * newline-delimited JSON of some shape, and a chunk boundary lands mid-object
- * often enough that parsing per-chunk silently drops events.
- */
-declare class LineBuffer {
-    private buffer;
-    push(chunk: string, onLine: (line: string) => void): void;
-    /** Anything left unterminated when the stream closed. */
-    flush(): string;
-}
-
-interface RunnerPluginManifest {
-    name: string;
-    displayName: string;
-    description: string;
-    version: string;
-    author?: string;
-    homepage?: string;
-    runner: PluginRunnerDef;
-    features: PluginFeatures;
-    modelDiscovery: PluginModelDiscovery;
-    contextFile?: string;
-    contextFileAltPath?: string;
-    modes?: PluginMode[];
-}
-interface PluginRunnerDef {
-    command: string;
-    argsTemplate: string[];
-    promptInArgs: boolean;
-    env?: Record<string, string>;
-    /** When true, the runner requires a PTY. HeadlessRunner wraps with `script` to allocate one. */
-    requiresTty?: boolean;
-    /**
-     * True when this runner's interactive prompt flag (e.g. opencode's
-     * `--prompt`) only pre-fills its TUI's composer instead of running it, so a
-     * surface driving that TUI unattended must send an explicit Enter after
-     * launch. Only takes effect while the resolved invocation is interactive —
-     * see `RunnerInvocation.submitPromptKey`.
-     */
-    submitPromptKey?: boolean;
-    /**
-     * Screens the agent can stop on before starting the task, waiting for a
-     * human — a folder-trust or permission-mode confirmation. Ordewell never
-     * answers one; seeing it, the task's user is told where to.
-     */
-    blockingPrompts?: BlockingPrompt[];
-    /**
-     * The command lines a later major version of the runner takes instead of
-     * `argsTemplate`/`env`, for a runner whose CLI changed shape between majors.
-     * The one with the highest `minMajor` the installed version reaches wins; an
-     * install whose version cannot be read keeps the base template.
-     */
-    versioned?: VersionedInvocation[];
-}
-interface VersionedInvocation {
-    minMajor: number;
-    argsTemplate: string[];
-    env?: Record<string, string>;
-}
-interface BlockingPrompt {
-    /** Text the prompt shows; matched ignoring case and whitespace. */
-    phrase: string;
-    /** Completes "<runner> is asking …", e.g. "whether to trust this folder". */
-    asks: string;
-}
-interface PluginFeatures {
-    modelSelection: boolean;
-    thinkingEffort: boolean;
-    planMode: boolean;
-    planModeFlag: string;
-    buildModeFlag?: string;
-    /** Flag appended when headless mode is on, so the agent never prompts for permission (e.g. Claude's --dangerously-skip-permissions). */
-    headlessFlag?: string;
-    thinkingFlag?: string;
-    thinkingValueEnabled?: string;
-    thinkingValueDisabled?: string;
-    thinkingValueAdaptive?: string;
-    /** Maps mode IDs to the CLI --permission-mode value. Used by {{feature:permissionModeVal}}. */
-    permissionModeValues?: Record<string, string>;
-    /**
-     * Further per-mode settings for runners whose permission story has more than
-     * one axis (Codex: sandbox, approval policy, approvals reviewer). Keyed by
-     * setting name, then by mode id; a mode a map does not name leaves that
-     * setting to the runner's own default. Codex declares `approvalPolicy`
-     * (`-a` / `approval_policy`) and `approvalsReviewer` (`approvals_reviewer`);
-     * the terminal template reads them too, through `{{feature:approvalPolicyVal}}`
-     * and the `*Config` tokens.
-     */
-    modeSettings?: Record<string, Record<string, string>>;
-}
-type PluginParser = 'claude-help' | 'opencode-models' | 'opencode-models-verbose' | 'anthropic-models' | 'line-by-line' | 'json' | 'json-table';
-interface DiscoveryCommand {
-    command: string;
-    args: string[];
-    parser?: PluginParser;
-}
-type ApiAuthMethod = {
-    type: 'env';
-    varName: string;
-    header: string;
-    prefix?: string;
-} | {
-    type: 'file';
-    path: string;
-    jsonPath: string;
-    header: string;
-    prefix?: string;
-};
-interface ApiDiscoveryConfig {
-    url: string;
-    headers?: Record<string, string>;
-    auth: ApiAuthMethod[];
-    parser: PluginParser;
-}
-interface PluginModelDiscovery {
-    method: 'command' | 'hardcoded';
-    command?: string;
-    args?: string[];
-    parser?: PluginParser;
-    jsonPath?: string;
-    /**
-     * Stdio JSON-RPC discovery (Codex `app-server`): spawn the command, send
-     * `initialize` then `model/list`, and read the catalog from the response.
-     * Tried BEFORE apiDiscovery and command discovery. When the call fails,
-     * `cacheFile` (the runner's own on-disk catalog cache, `~` expanded) is
-     * read before falling through to the remaining discovery methods.
-     */
-    appServer?: {
-        command: string;
-        args: string[];
-        cacheFile?: string;
-    };
-    /**
-     * Optional last-resort list for user plugins whose CLI cannot enumerate
-     * models. Used only when command discovery fails entirely or the CLI is
-     * unavailable. Built-in manifests must NOT use this: anything listed here is
-     * shown to the user as available even when it isn't.
-     */
-    fallbackModels?: {
-        modelId: string;
-        modelLabel: string;
-    }[];
-    /**
-     * Stable `--model` aliases that the runner's CLI always accepts but its help
-     * text may omit (e.g. Claude's 'haiku'). Merged into successful discovery
-     * results to fill gaps — discovered models take precedence, missing aliases
-     * are appended — and used as the last resort when discovery fails entirely.
-     * Unlike `fallbackModels`, entries must be stable CLI-accepted aliases
-     * (contracts that always resolve), not arbitrary model IDs.
-     */
-    canonicalAliases?: {
-        modelId: string;
-        modelLabel: string;
-    }[];
-    /**
-     * HTTP API discovery — tried BEFORE command discovery. When the runner's CLI
-     * has no model-listing subcommand (Claude Code), an API endpoint can serve as
-     * the authoritative source. Auth methods are tried in order; the first that
-     * yields a token is used. If no auth method yields a token or the request
-     * fails, discovery falls through to `discoveryCommands` + `canonicalAliases`.
-     */
-    apiDiscovery?: ApiDiscoveryConfig;
-    preferredPatterns?: {
-        id: string;
-        label: string;
-    }[];
-    variants?: {
-        id: string;
-        label: string;
-    }[];
-    discoveryCommands?: DiscoveryCommand[];
-}
-interface PluginMode {
-    id: string;
-    label: string;
-    description: string;
-    /** CLI value passed to the runner's permission/mode flag. Defaults to id if omitted. */
-    cliValue?: string;
-    /** Marks this mode as the runner's most permissive mode — the resolved default when autonomous mode is ON. */
-    autonomous?: boolean;
-    /** Marks this mode as the runner's conservative build mode — the resolved default when autonomous mode is OFF. */
-    safe?: boolean;
-}
-interface PluginEntry {
-    manifest: RunnerPluginManifest;
-    source: 'builtin' | 'user';
-    installPath?: string;
-}
-interface ResolveContext {
-    prompt: string;
-    model?: string;
-    thinkingEffort?: string;
-    /** All variant ids the assigned model offers — lets {{opencodeVariantConfig}} disable the non-chosen ones. */
-    modelVariants?: string[];
-    mode: string;
-    /**
-     * Autonomy axis: when true, resolve {{if headless}} blocks and the
-     * {{feature:headless}} token so the agent never stops to ask for permission.
-     * True for every orchestrated task run — nobody is watching the terminal on
-     * Ordewell's behalf — independently of the session *shape* below.
-     */
-    headless?: boolean;
-    /**
-     * Session-shape axis: true when the runner is launched onto a real TTY the
-     * user can attach to (a tmux window, a VS Code pseudoterminal), so the
-     * runner's own TUI should come up rather than its non-interactive
-     * subcommand. Defaults to `!headless` for callers that predate the split.
-     */
-    interactive?: boolean;
-    /** The task's working directory — needed by runners whose autonomy flags name a path. */
-    cwd?: string;
-    /** The installed runner's `--version`, read only for a manifest with `versioned` invocations. */
-    runnerVersion?: string;
-}
-interface RunnerInvocation {
-    command: string;
-    args: string[];
-    env: Record<string, string>;
-    promptInArgs: boolean;
-    /** True when a surface running this invocation on a real TTY must send an explicit Enter once the process starts. */
-    submitPromptKey: boolean;
-}
-/**
- * Persistent storage seam for plugin manifests. The RunnerRegistry delegates
- * all filesystem operations to this interface so the plugin lifecycle is
- * testable without real I/O.
- */
-interface IPluginStore {
-    /** Path to the user plugins directory (~/.ordewell/plugins/). */
-    getUserPluginsDir(): string;
-    /** List subdirectory names inside the user plugins directory. */
-    listUserPluginDirs(): string[];
-    /** List entry names directly inside a directory. Returns [] when unreadable. */
-    listDir(dir: string): string[];
-    /** Read and parse a manifest.json from pluginDir. Returns null on failure. */
-    loadManifest(pluginDir: string): RunnerPluginManifest | null;
-    /** Recursively copy sourceDir to destDir. */
-    copyDir(sourceDir: string, destDir: string): void;
-    /** Recursively remove a directory. */
-    removeDir(dir: string): void;
-    /** Ensure a directory exists (mkdir -p). */
-    ensureDir(dir: string): void;
-    /** Write a text file. */
-    writeFile(filePath: string, content: string): void;
-    /** Read a UTF-8 text file. Returns null on ENOENT or read error. */
-    readFile(filePath: string): string | null;
-    /** True if path exists and is a directory. */
-    dirExists(path: string): boolean;
-    /** True if path exists. */
-    exists(path: string): boolean;
-}
-
-/**
- * Decides whether one out-of-envelope capability may run, and remembers the
- * answer for the rest of the session.
- *
- * Grants are keyed on {@link ApprovalRequest.scope}, never on the concrete
- * subject: approving a read of `/tmp/foo/a.log` grants `/tmp/foo/*`, and
- * approving `az group list` grants `az group`. Without that, a planner doing
- * real research would prompt on every single call and the feature would be
- * unusable.
- *
- * `mode` is the policy floor:
- *   ask     consult the human channel; no channel means deny (headless, web)
- *   allow   grant everything the tier system did not already refuse
- *   deny    grant nothing beyond `preApproved`
- *
- * Note the ordering: `preApproved` is honored under every mode including
- * `deny`, because it is an explicit operator decision rather than a default.
- */
-type ApprovalMode = 'ask' | 'allow' | 'deny';
-interface ApprovalPolicyOptions {
-    mode?: ApprovalMode;
-    /** Scopes granted up front from config. A trailing `*` matches by prefix. */
-    preApproved?: string[];
-    /** The human channel. Absent means there is nobody to ask. */
-    ask?: (req: ApprovalRequest) => Promise<boolean>;
-    /** Called whenever a decision is reached, for surfacing in a UI or a log. */
-    onDecision?: (req: ApprovalRequest, granted: boolean, source: ApprovalSource) => void;
-}
-type ApprovalSource = 'pre-approved' | 'remembered' | 'mode' | 'asked' | 'no-channel';
-declare class ApprovalPolicy implements IApproval {
-    private readonly mode;
-    private readonly preApproved;
-    private readonly asker?;
-    private readonly onDecision?;
-    private readonly granted;
-    private readonly refused;
-    /** One in-flight ask per scope: a parallel tool round must not prompt twice for the same thing. */
-    private readonly inFlight;
-    private generation;
-    constructor(opts?: ApprovalPolicyOptions);
-    request(req: ApprovalRequest): Promise<boolean>;
-    /** Scopes the user has granted this session — for display and for persistence. */
-    grantedScopes(): string[];
-    /** Drop every session-scoped decision. Called on session reset. */
-    reset(): void;
-}
-
-interface CatalogModel {
-    id: string;
-    name: string;
-    description: string;
-    pricing: {
-        prompt: string;
-        completion: string;
-    };
-    contextLength: number;
-}
-declare class ModelCatalog {
-    static fetchModels(apiKey: string, baseUrl?: string, fetchImpl?: typeof fetch): Promise<CatalogModel[]>;
-    /**
-     * Delete the on-disk catalog cache for a base URL so the next fetch re-runs.
-     * Used by the resolver's `invalidate()` in production (no injected fetch);
-     * best-effort — a missing file or unreadable dir is a no-op.
-     */
-    static clearCache(baseUrl?: string): void;
-    private static readCache;
-    private static writeCache;
-}
-
-interface ModelShortcut {
-    label: string;
-    id: string;
-    provider: string;
-    description: string;
-    pricing?: string;
-}
-declare const ORCHESTRATOR_SHORTCUTS: ModelShortcut[];
-declare function resolveModelShortcut(input: string, shortcuts: ModelShortcut[]): string | null;
-/**
- * Resolves a value to a model id ONLY when it is in the supplied catalog
- * option list — either directly or via a shortcut label. Free-typed, unknown,
- * or not-currently-available values return null, so callers never store an id
- * the user couldn't have selected from the list. Keeps model-setting list-only.
- */
-declare function knownModelId(value: string, optionIds: string[], shortcuts: ModelShortcut[]): string | null;
-
-type ProviderModelLists = Record<string, string[]>;
-interface OrchestratorOption {
-    id: string;
-    label: string;
-    provider: string;
-    apiProvider: AiProvider;
-    description?: string;
-    pricing?: string;
-    /** The model's context window when the catalog reports one (#49). */
-    contextWindow?: number;
-}
-
-interface FetchAllProviderModelsOptions {
-    apiKeys: Record<string, string>;
-    baseUrls: Record<string, string>;
-    fetchImpl?: typeof fetch;
-}
-type AllProviderModels = Record<string, CatalogModel[]>;
-/**
- * Result of a picker-catalog fetch fan-out: the per-provider model lists plus
- * the per-provider failures. `errors` is keyed by provider id and holds the
- * failure message for any provider whose catalog fetch rejected — the seam the
- * surfaces (CLI, VS Code) use to flag "this configured provider didn't work"
- * rather than silently showing a short list.
- */
-interface ProviderModelsResult {
-    models: AllProviderModels;
-    errors: Record<string, string>;
-}
-/** The provider config fields the discovery fan-out needs. */
-interface ProviderCredentialSource {
-    getProviderApiKey(provider: AiProvider): string;
-    getProviderBaseUrl(provider: AiProvider): string;
-    openaiCompatibleBaseUrl: string;
-}
-/**
- * Collect the API keys and base URLs the picker fan-out should probe, applying
- * the single "configured" policy shared by every surface (CLI + VS Code):
- *  - a preset is discovered only when it has an API key (OpenRouter included —
- *    its public catalog is not probed keyless, matching the product rule that
- *    only key-configured providers appear);
- *  - `openai_compatible` is discovered only when an explicit endpoint is set
- *    (keyless local servers like ollama / LM Studio).
- * Base URLs are handed through only for providers that pass the gate, so the
- * fan-out never touches an unconfigured third-party endpoint.
- */
-declare function collectProviderCredentials(config: ProviderCredentialSource): {
-    apiKeys: Record<string, string>;
-    baseUrls: Record<string, string>;
-};
-declare function fetchAllProviderModels(opts: FetchAllProviderModelsOptions): Promise<ProviderModelsResult>;
-declare function resolveProvider(modelId: string, providerModelLists: Record<string, string[]>): AiProvider | null;
-declare function toOrchestratorOptions(providerModels: AllProviderModels, shortcuts: ModelShortcut[]): OrchestratorOption[];
-
-/**
- * Who plans. Mostly LLM vendors reached over HTTP; the last three are *harness
- * planners* (ADR-0009) — a coding agent CLI already installed on the machine,
- * driven as the planner over its own programmatic transport and authenticated
- * by the subscription the user already holds. They are runners in the provider
- * axis, deliberately: "what plans for me?" is one question, and it belongs in
- * one setting. `isCliProvider` is the single guard that tells the two kinds
- * apart.
- */
-type AiProvider = 'google' | 'openrouter' | 'openai_compatible' | 'openai' | 'xai' | 'groq' | 'deepseek' | 'together' | 'mistral' | 'anthropic' | 'fireworks' | 'perplexity' | 'zhipu' | 'kimi' | 'cerebras' | 'deepinfra' | 'doubao' | 'qwen' | 'hunyuan' | 'baichuan' | 'minimax' | 'yi' | 'stepfun' | 'siliconflow' | 'cohere' | 'novita' | 'claude-code' | 'codex' | 'opencode';
-interface IConfig {
-    aiProvider: AiProvider;
-    apiKey: string;
-    planningModel: string;
-    enabledRunners: string[];
-    maxParallelSessions: number;
-    researchEnabled: boolean;
-    researchMaxSteps: number;
-    researchMaxFileSize: number;
-    openAiBaseUrl: string;
-    openAiApiKey: string;
-    /** Provider keys + base URL the ModelResolver uses to fetch the picker catalogs. */
-    openrouterKey: string;
-    geminiKey: string;
-    geminiBaseUrl?: string;
-    /** Base URL + API key for a user-provided OpenAI-compatible endpoint (ollama, vLLM, LM Studio, etc.). */
-    openaiCompatibleBaseUrl: string;
-    openaiCompatibleApiKey: string;
-    orchestratorModel: string;
-    geminiModel: string;
-    /** Model for research subagents (issue #34); defaults to the (cheap) planner model. */
-    researchSubagentModel: string;
-    /**
-     * Thinking effort / model variant for a harness planner (ADR-0009), chosen
-     * from the agent's own discovered variants. Separate from the per-task
-     * efforts the plan carries — this one is the planner's own dial.
-     */
-    plannerThinkingEffort?: string;
-    planMapEnabled: boolean;
-    autonomousMode: boolean;
-    /**
-     * Run each AI task in its own git worktree and integrate the results on a
-     * per-run branch (ADR-0013). Non-git workspaces fall back to the shared
-     * workspace root regardless of this flag.
-     */
-    worktreeIsolation: boolean;
-    /**
-     * Shell command run in a fresh task worktree instead of symlinking ignored
-     * artifacts from the main worktree — for repos where sharing `node_modules`
-     * or a virtualenv is wrong.
-     */
-    worktreeSetupCommand?: string;
-    /**
-     * Repositories of the repo group listed by hand, relative to the workspace
-     * (ADR-0014). When non-empty the group is exactly these, replacing the
-     * repositories auto-detected directly inside the folder; needed for ones
-     * deeper than that, which are never auto-detected.
-     */
-    workspaceRepos: string[];
-    /**
-     * Extra paths or globs, relative to each repo root, linked from the real repo
-     * into its task worktree where they exist — gitignored local state such as
-     * `*.tfstate` that a task must use, not a copy of.
-     */
-    worktreeLinks: string[];
-    /**
-     * How many conflict repairs one task may go through before its conflict is
-     * left for a person (ADR-0015); 0 turns repair off.
-     */
-    conflictRepairAttempts: number;
-    /**
-     * What to do when planner research reaches outside its default envelope — an
-     * out-of-workspace path, or a shell command beyond the auto-allowed read-only
-     * set. `ask` prompts the user (and denies where no surface can prompt, such as
-     * headless runs); `allow` and `deny` skip the prompt entirely.
-     */
-    approvalMode: ApprovalMode;
-    /** Scopes granted up front, so CI and power users never see a prompt. Trailing `*` matches by prefix. */
-    approvalPreApproved: string[];
-    /** Get the base URL for an OpenAI-compatible provider. */
-    getProviderBaseUrl(provider: AiProvider): string;
-    /** Get the API key for a provider. */
-    getProviderApiKey(provider: AiProvider): string;
-    /**
-     * Push the canonical provider routing lists in (sole producer: ModelResolver).
-     * Config consumes them when resolving a chosen model id to its serving API.
-     */
-    setProviderModelLists(lists: ProviderModelLists): void;
-}
-declare function enabledRunners(cfg: IConfig): RunnerId[];
-
-/** True when a name belongs to a built-in runner and is therefore not installable. */
-declare function isReservedRunnerName(name: string): boolean;
-/** Clone seam: takes a validated URL and a destination, or throws. */
-type PluginCloneFn = (url: string, destDir: string) => void;
-declare class RunnerRegistry {
-    private plugins;
-    private store;
-    private clone;
-    constructor(store?: IPluginStore, clone?: PluginCloneFn);
-    private loadBuiltins;
-    loadUserPlugins(): void;
-    get(id: string): PluginEntry | undefined;
-    getManifest(id: string): RunnerPluginManifest | undefined;
-    list(): PluginEntry[];
-    listEnabled(config: IConfig): PluginEntry[];
-    listEnabledIds(config: IConfig): string[];
-    isBuiltIn(id: string): boolean;
-    installFromPath(sourcePath: string): RunnerPluginManifest;
-    installFromGit(url: string): RunnerPluginManifest;
-    /**
-     * The single destination-building step both install routes share: the name is
-     * constrained to a plain segment and the resolved destination is asserted to
-     * be inside the plugins directory before anything is copied.
-     */
-    private registerInstalled;
-    remove(name: string): void;
-    createSkeleton(name: string, outputDir: string): string;
-}
-
-interface ITerminalSession {
-    id: string;
-    taskId: string;
-    onOutput(callback: (text: string) => void): void;
-    onExit(callback: (code: number) => void): void;
-    kill(): void;
-    getOutput(): string;
-    write(text: string): void;
-    /**
-     * True when the session runs the agent as a raw-mode TUI (a real PTY for the
-     * VS Code terminal, a tmux window). Such a surface submits an input line on
-     * the Enter keystroke (`\r`), so a synchronized resume token terminated with
-     * `\n` only types the line and never sends it. A line-oriented piped session
-     * (`defaultInteractive = false`) leaves this false and accepts `\n`.
-     */
-    readonly interactive?: boolean;
-    /**
-     * Optional transport-level control channel: PTY resize requests for a session
-     * whose runner renders a TUI. Absent on transports without a resizable PTY
-     * (a plain piped subprocess); surfaces must feature-detect before calling.
-     */
-    writeControl?(text: string): void;
-}
-/**
- * How Ordewell drives a task's runner (ADR-0018): through its screen and
- * keyboard, or through its programmatic protocol.
- */
-type RunnerTransport = 'terminal' | 'structured';
-declare function isRunnerTransport(value: unknown): value is RunnerTransport;
-/** How a structured turn ended. `failed` carries the agent's own words in the preceding `error` event. */
-type StructuredTurnEnd = 'completed' | 'interrupted' | 'failed';
-/**
- * One normalized event from a structured task (ADR-0018, O1b): the adapter's
- * events, with the turn made explicit at both ends and the message queue (M1)
- * alongside. Subagent work carries its `subagentId`. The source for the
- * full-fidelity task log, never for verdicts.
- */
-type StructuredEvent = Exclude<AgentEvent, {
-    type: 'turn_end' | 'permission_cancelled' | 'message_delivered' | 'message_dropped';
-}>
-/**
- * `text` is the user message the turn answers; `messageId` is set when it had
- * waited in the queue, `forced` when it was force sent (ADR-0023, Q2).
- */
- | {
-    type: 'turn_start';
-    text: string;
-    messageId?: string;
-    forced?: boolean;
-} | {
-    type: 'turn_end';
-    reason: StructuredTurnEnd;
-}
-/**
- * Waiting in Ordewell's queue — again, for a message the runner was handed
- * and let go of (ADR-0023, D4). `forced` puts it ahead of the rest, behind
- * earlier forced ones (F2); a message already listed moves there.
- */
- | {
-    type: 'message_queued';
-    messageId: string;
-    text: string;
-    forced?: boolean;
-} | {
-    type: 'message_removed';
-    messageId: string;
-} | {
-    type: 'message_undelivered';
-    messageId: string;
-    text: string;
-}
-/** The runner accepted the message into its running turn; it can no longer be taken back (ADR-0023, D3). */
- | {
-    type: 'message_handed_over';
-    messageId: string;
-}
-/** The model read the message inside the running turn, at this point of it (ADR-0023, Q2). */
- | {
-    type: 'message_delivered';
-    messageId: string;
-    text: string;
-}
-/** An open `permission_request` was answered, by whoever answered it (ADR-0018, A1). */
- | {
-    type: 'permission_decided';
-    id: string;
-    decision: ApprovalDecision;
-}
-/** An open `permission_request` can no longer be answered: the runner withdrew it, or its process is gone. */
- | {
-    type: 'permission_withdrawn';
-    id: string;
-};
-interface QueuedTaskMessage {
-    id: string;
-    text: string;
-    /** The runner has it and owes a delivery, so it cannot be taken back (ADR-0023, Q1). */
-    handedOver?: boolean;
-    /** Force sent: it goes out as soon as the running turn is interrupted (ADR-0023, F1). */
-    forced?: boolean;
-}
-/**
- * What a session driven over its runner's protocol can do that a terminal
- * cannot (ADR-0018, S2). Optional: callers feature-detect it with
- * {@link isStructuredSession}, and code that does not look behaves as it did.
- */
-interface StructuredSessionCapability {
-    readonly transport: 'structured';
-    /** `working` while a turn runs; `idle` between turns, waiting for a message. */
-    turnState(): 'working' | 'idle';
-    onTurnEnd(listener: (reason: StructuredTurnEnd) => void): void;
-    onEvent(listener: (event: StructuredEvent) => void): void;
-    /**
-     * Send a user message: at once when idle; while a turn runs, handed to the
-     * runner for its next step where it can take one, otherwise queued until
-     * the turn ends (ADR-0023). Returns its id, for {@link removeQueued}.
-     */
-    sendMessage(text: string): string;
-    /**
-     * Force send (ADR-0023, F1–F3): interrupt the running turn, as
-     * {@link interrupt} does, and deliver this message as the turn that
-     * replaces it, ahead of anything still queued. The task does not wait for
-     * input in between. With no turn running it is {@link sendMessage}.
-     */
-    forceSend(text: string): string;
-    /** Force send a message still queued, by id. False once it was handed over or delivered. */
-    forceSendQueued(id: string): boolean;
-    /** Take a message back before the runner has it. False once it was handed over or delivered. */
-    removeQueued(id: string): boolean;
-    /** Messages not yet delivered, oldest first: queued ones, and ones handed over that the runner owes. */
-    queued(): QueuedTaskMessage[];
-    /**
-     * Stop the running turn, keeping the session: a soft interrupt first, then —
-     * if the runner does not answer in time — kill and resume. Either way the
-     * turn ends `interrupted`. Resolves once it has.
-     */
-    interrupt(): Promise<void>;
-    /** The runner's own session id once announced — what a continue resumes (ADR-0018, K1). */
-    nativeSessionId(): string | null;
-    /**
-     * Answer a `permission_request` this session emitted, by its event id. False
-     * when it is no longer open — answered, withdrawn, or never asked.
-     */
-    answerPermission(id: string, decision: ApprovalDecision): boolean;
-    /**
-     * The runner's `task_complete` calls on this attempt's token (ADR-0022):
-     * completion evidence beside the marker, for `VerdictEngine` to weigh.
-     */
-    onTaskComplete(listener: (report: TaskCompleteArgs) => void): void;
-    /**
-     * Answers the runner's `checkpoint` calls (ADR-0022, V5): the call stays
-     * open until the returned promise settles, and its result is the answer.
-     * `signal` aborts when the caller goes away.
-     */
-    onToolCheckpoint(handler: (question: string, signal: AbortSignal) => Promise<CheckpointAnswer>): void;
-}
-declare function isStructuredSession(session: ITerminalSession): session is ITerminalSession & StructuredSessionCapability;
-
-interface ITerminalRunner {
-    spawn(opts: {
-        taskId: string;
-        runner: string;
-        prompt: string;
-        modelId?: string;
-        thinkingEffort?: string;
-        modelVariants?: string[];
-        mode?: string;
-        headless?: boolean;
-        cwd: string;
-        registry?: RunnerRegistry;
-        /** Task order and title — surfaces use these to label task_started/output events. */
-        order?: number;
-        title?: string;
-        /**
-         * The owning plan session. Task ids are only unique within one plan, so
-         * transports that key OS resources by task (tmux windows, log files) need
-         * this to keep two plans' identically named tasks apart.
-         */
-        planSessionId?: string;
-        /**
-         * The workspace's own variables (ADR-0016), under the runner's: a
-         * manifest's env still wins over them.
-         */
-        env?: Record<string, string>;
-        /**
-         * The transport the plan asks for (ADR-0018, S1). A router decides per
-         * task whether the runner can honour it; any other runner ignores it.
-         */
-        transport?: RunnerTransport;
-        /**
-         * The runner's own session to continue in (ADR-0018, K1). Only the
-         * structured transport can honour it; a terminal session comes back fresh,
-         * which is why a continue refuses one.
-         */
-        resumeSessionId?: string;
-        /**
-         * Which run of the task this is, from 1. A structured runner binds the
-         * attempt's MCP token to it (ADR-0022, A2).
-         */
-        attempt?: number;
-    }): Promise<ITerminalSession>;
-    stop(sessionId: string): void;
-    stopAll(): void;
-    activeCount: number;
-}
-
-interface UserStep {
-    order: number;
-    instruction: string;
-    completed: boolean;
-}
-/** One deterministic signal gathered while verifying a completed task. */
-interface VerificationCheck {
-    name: 'exit_code' | 'completion_marker' | 'task_complete' | 'manual';
-    passed: boolean;
-    /** A check that did not apply. Skipped checks don't affect the verdict. */
-    skipped: boolean;
-    detail: string;
-}
-/** Evidence-based verdict for a completed task. Single end-to-end outcome produced by verification. */
-interface Verdict {
-    outcome: 'pass' | 'fail';
-    reason: string;
-    checks: VerificationCheck[];
-    decidedAt: string;
-}
-interface TaskOutputSummary {
-    reviewReason: string;
-    logTail: string;
-    capturedAt: string;
-}
-type TaskType = 'ai' | 'user';
-type TaskStatus = 'pending' | 'approved' | 'in_progress' | 'completed' | 'failed' | 'blocked' | 'awaiting_user';
-type TaskMode = string;
-/**
- * Why an `awaiting_user` task waits (ADR-0018, W1): a structured turn that
- * ended without the done marker, a checkpoint question, work that did not
- * land, or an ops task that changed tracked files (ADR-0020). Saved, so no
- * surface has to guess it from whether an attempt is live.
- */
-type AwaitingReason = 'input' | 'checkpoint' | 'conflict' | 'files-changed';
-declare function isAwaitingReason(value: unknown): value is AwaitingReason;
-interface TaskModelAssignment {
-    modelId: string;
-    modelLabel: string;
-    thinkingEffort?: string;
-    /**
-     * All variant ids the model offered when this assignment was made. Carried
-     * on the assignment because runners need it at spawn time (opencode's TUI
-     * only honors an assigned variant when the others are config-disabled) and
-     * the discovery catalog isn't available there.
-     */
-    availableVariants?: string[];
-}
-type RunnerId = string;
-/**
- * How a task's latest attempt was driven (ADR-0018). Recorded only when its
- * plan asked for the structured transport, so a terminal plan's tasks carry
- * nothing new.
- */
-interface TaskTransport {
-    kind: RunnerTransport;
-    /** Why a plan that asked for structured ran this task on the terminal — never a silent downgrade (S3). */
-    fallback?: string;
-    /** The runner's own session id of a structured attempt, once it ends: what a continue resumes (K1). */
-    nativeSessionId?: string;
-}
-interface Task {
-    id: string;
-    order: number;
-    title: string;
-    description: string;
-    type: TaskType;
-    status: TaskStatus;
-    dependencies: string[];
-    prompt?: string;
-    userSteps?: UserStep[];
-    subtasks: Task[];
-    verdict?: Verdict;
-    outputSummary?: TaskOutputSummary;
-    assignedModel?: TaskModelAssignment;
-    assignedRunner: RunnerId;
-    thinkingEffort?: string;
-    taskMode?: TaskMode;
-    completionMarker: string;
-    autonomy?: 'AFK' | 'HITL';
-    sliceType?: 'HITL' | 'AFK';
-    userStoriesCovered?: string[];
-    transport?: TaskTransport;
-    /** Set only while `status` is `awaiting_user`, and not always then — a usage-limit pause has none. */
-    awaitingReason?: AwaitingReason;
-    /**
-     * An ops task (ADR-0020): it changes no repository files, runs at the
-     * workspace root rather than in a worktree, and waits for the change tasks
-     * it depends on to be merged into the user's branch. Top-level AI tasks
-     * only; absent means a change task.
-     */
-    ops?: boolean;
-    /**
-     * The dependencies, by title, whose work was not merged into the user's
-     * branch when the user force-started this task past its merge gate
-     * (ADR-0020). Cleared when the task is retried.
-     */
-    forcedPastGate?: string[];
-}
-interface DiscoveredMode {
-    id: string;
-    label: string;
-    description: string;
-}
-type ResearchToolType = 'read_file' | 'read_files' | 'glob' | 'grep' | 'find_symbol' | 'list_dir' | 'bash' | 'fetch' | 'web_search' | 'spawn_research_agent'
-/**
- * A tool belonging to a harness planner's own toolbox (ADR-0009) that has no
- * Ordewell equivalent — Edit, WebFetch, TodoWrite, whatever a coding agent
- * ships next. The real name travels in `toolLabel` rather than being
- * relabelled as a tool it is not; the union stays closed so the
- * exhaustiveness checks in every surface's icon/label switch survive.
- */
- | 'agent_tool';
-/**
- * What happened when a research tool call ran, for honest per-surface
- * rendering. The broadcast seam carries this on every `research_step_done` so
- * surfaces do not have to pattern-match refusal text to tell a refused `rm`
- * from a successful `rm` — the old render path flipped a `✓` for both.
- */
-type ResearchStepOutcome = 'success' | 'failure' | 'refused' | 'denied' | 'not_executed';
-interface ResearchStep {
-    id: string;
-    tool: ResearchToolType;
-    /** The tool's own name when it came from a harness planner — always set for `agent_tool`. */
-    toolLabel?: string;
-    args: string;
-    result: string;
-    success: boolean;
-    outcome: ResearchStepOutcome;
-    /** The model's tool_call id, so a surface can match `tool_result` to the
-     * pending `tool_call` it announced — robust under parallel same-tool rounds. */
-    toolCallId?: string;
-    /** The research subagent that ran the call, so a reload regroups it under that subagent. */
-    subagentId?: string;
-    timestamp: string;
-    thinkingText?: string;
-}
-interface UserPromptEntry {
-    id: string;
-    type: 'user_prompt' | 'system';
-    content: string;
-    timestamp: string;
-}
-type SubagentOutcome = 'done' | 'failed' | 'stopped';
-/**
- * One subagent's whole run, logged when it finishes: what it was asked, how it
- * ended and what it reported. Its steps stay separate entries carrying the same
- * `subagentId`, so an older reader that knows only steps still shows them.
- */
-interface SubagentLogEntry {
-    id: string;
-    type: 'subagent';
-    subagentId: string;
-    brief: string;
-    model?: string;
-    outcome: SubagentOutcome;
-    digest: string;
-    usage?: UsageTotals;
-    timestamp: string;
-}
-type ResearchLogEntry = ResearchStep | UserPromptEntry | SubagentLogEntry;
-interface ResearchProgress {
-    type: 'thinking' | 'tool_call' | 'tool_result' | 'plan_token' | 'interrupted' | 'liveness' | 'text_delta' | 'text_retracted' | 'usage' | 'subagent_started' | 'subagent_finished';
-    /** Minted by whoever runs the turn and passed through untouched; absent outside a turn. */
-    turnId?: string;
-    /** One continuous run of model text — text before a tool call is its own segment. */
-    segmentId?: string;
-    text?: string;
-    tool?: string;
-    /** Harness planners (ADR-0009): the agent's own name for a tool Ordewell has no member for. */
-    toolLabel?: string;
-    toolArgs?: string;
-    toolResult?: string;
-    planToken?: string;
-    step?: ResearchStep;
-    /** The model's tool_call id, threaded on tool_call and tool_result so a
-     * surface can match the result to its pending call — robust under parallel
-     * same-tool rounds where LIFO-by-name matching mislabels summaries. */
-    toolCallId?: string;
-    /** Present when this event originates from (or reports on) one spawned research subagent (issue #34). */
-    subagentId?: string;
-    record?: UsageRecord;
-    brief?: string;
-    model?: string;
-    outcome?: SubagentOutcome;
-    digest?: string;
-    usage?: UsageTotals;
-}
-interface ThinkingBlock {
-    id: string;
-    text: string;
-}
-interface StreamThinkingEvent {
-    type: 'thinking';
-    block: ThinkingBlock;
-}
-interface StreamStepEvent {
-    type: 'step';
-    step: ResearchStep;
-}
-type StreamEvent = StreamThinkingEvent | StreamStepEvent;
-interface DiscoveredModel {
-    modelId: string;
-    modelLabel: string;
-    runnerProvider?: string;
-    /**
-     * Human-facing provider name as the runner itself reports it (e.g.
-     * "OpenCode Zen" for `runnerProvider: 'opencode'`). Populated from the
-     * runner's own provider catalog when available; when absent the UI derives a
-     * label from `runnerProvider` by title-casing.
-     */
-    runnerProviderLabel?: string;
-    /**
-     * The runner whose catalog listed this model. Stamped once, at the single
-     * `ModelDiscovery.discover` choke point, so a flat cross-runner list can
-     * still say where each entry came from — `runnerProvider` alone cannot:
-     * OpenCode reports most of its catalog as `openrouter`, which names the
-     * serving backend, not the agent Ordewell would spawn.
-     */
-    runnerId?: string;
-    /** The runner's display name (`OpenCode`), from its manifest. */
-    runnerLabel?: string;
-    variants: {
-        id: string;
-        label: string;
-    }[];
-    /**
-     * The model's context window when the runner or catalog reports it (#49).
-     * Read by the planner-model lookup so context fill can be shown; absent when
-     * unknown rather than defaulted to zero.
-     */
-    contextWindow?: number;
-}
-type PlanStatus = 'draft' | 'approved' | 'rejected' | 'running' | 'completed';
-/**
- * One entry of the planner's persisted dialogue (ADR-0002). The single source
- * of truth for both UI redisplay and conversational context. Tool-call results
- * are NOT stored here — they live in the AI service's tool-use history;
- * `researchLog` remains the persisted tool trace for the UI.
- */
-interface ConversationMessage {
-    role: 'user' | 'assistant';
-    content: string;
-    timestamp: string;
-    /**
-     * Timeline marker: 'plan_generated' records the point in the dialogue where
-     * the plan was committed (the UI anchors the plan card there on restore);
-     * 'system' is a host-injected notice; 'compaction' is the summary a
-     * user-triggered compaction left in place of the earlier messages — always
-     * the transcript's first entry. Absent for ordinary chat turns, so
-     * sessions saved before markers existed degrade gracefully.
-     */
-    kind?: 'plan_generated' | 'system' | 'compaction';
-}
-interface QueuedMessage {
-    id: string;
-    text: string;
-    timestamp: string;
-}
-interface PlanModificationWarnings {
-    deletedCompleted: string[];
-    changedCompleted: string[];
-    deletedInProgress: string[];
-    modifiedInProgress: string[];
-    brokenDependencies: string[];
-}
-declare function emptyWarnings(): PlanModificationWarnings;
-interface LegacyPlanState {
-    tasks: Task[];
-    generatedAt: string;
-    status: PlanStatus;
-    runners: RunnerId[];
-    lastUpdated: string;
-    researchLog?: ResearchLogEntry[];
-    /** The planner dialogue — user messages and assistant messages, in order (ADR-0002). */
-    conversationHistory?: ConversationMessage[];
-    /** Full markdown PRD once written by the planner (PRD mode), also saved to .scratch/<slug>/PRD.md. */
-    prdMarkdown?: string;
-    /** Follow-ups queued while tasks execute — applied as plan modifications between batches. */
-    queuedMessages?: QueuedMessage[];
-    /**
-     * The plan's isolation run (ADR-0013), written from the orchestrator at
-     * persist time and read back only when a saved plan is adopted. It names
-     * branches and worktrees that belong to this plan alone: a fork of the plan
-     * must leave it behind rather than share it.
-     */
-    isolation?: PlanIsolation;
-    /**
-     * The `runnerTransport` setting as the plan's latest run copied it when it
-     * started (ADR-0018, S1): the plan, not the live setting, says what runs.
-     */
-    runnerTransport?: RunnerTransport;
-    /** Kept so a reopened session shows the same token line (#49). */
-    plannerUsage?: PlannerUsage;
-}
-interface Message {
-    id: string;
-    role: 'user' | 'planner' | 'system';
-    content: string;
-    timestamp: number;
-}
-interface TaskSnapshot extends Task {
-    completedAt: number;
-    verdict?: Verdict;
-    retryCount: number;
-    finalized: boolean;
-}
-type PlanState = {
-    phase: 'planning';
-    history: Message[];
-    message: string;
-    pendingTasks: Task[];
-} | {
-    phase: 'executing';
-    history: Message[];
-    message: string;
-    executionLog: TaskSnapshot[];
-    pendingTasks: Task[];
-    goal: string;
-    runners: string[];
-    status: PlanStatus;
-};
-declare function migratePlanState(raw: unknown): PlanState;
-declare function migrateLegacyPlan(legacy: LegacyPlanState): PlanState;
-
-declare function createTask(overrides?: Partial<Task>): Task;
-/**
- * The `ops` flag as a task stores it (ADR-0020), however it arrived. Only a
- * literal `true` on an AI task marks an ops task: the planner's JSON is
- * untyped, and a quoted "true" read as ops would move a task out of its
- * worktree. Anything else is a change task, stored absent so saved plans need
- * no migration. Whether the task may be ops at all — a subtask may not — is
- * for whoever knows where it sits: parsing drops the flag, an edit refuses it.
- */
-declare function opsFlag(value: unknown, type?: Task['type']): true | undefined;
-/**
- * The flag of a task a merge or a split makes from others: what the edit
- * chose, else ops only when every task it came from was. A merge that takes
- * in a change edits files, so it is a change; a split part runs where its
- * task did.
- */
-declare function inheritedOps(from: readonly Pick<Task, 'ops'>[], chosen?: boolean): boolean;
-/** The runner set a plan has until one is chosen: the one runner every host ships. */
-declare const DEFAULT_RUNNERS: readonly RunnerId[];
-declare function createEmptyPlan(): LegacyPlanState;
-declare function flattenTasks(tasks: readonly Task[]): Task[];
-/** A flattened task with the parent it hangs under, null for a top-level task. */
-interface TaskWithParent {
-    task: Task;
-    parent: Task | null;
-}
-declare function flattenTasksWithParents(tasks: readonly Task[]): TaskWithParent[];
-declare function migrateTask(task: Record<string, unknown>): Task;
-declare function addTaskToPlan(tasks: readonly Task[], partial: Partial<Task>): Task[];
-declare function removeTaskFromPlan(tasks: readonly Task[], taskId: string): Task[];
-declare function updateTaskInPlan(tasks: readonly Task[], taskId: string, changes: Partial<Task>): Task[];
-declare function renumberTasks(tasks: readonly Task[]): Task[];
-/**
- * Lay a planner-written task list over the plan it rewrites without letting it
- * change execution state. A planner restates tasks; it never witnessed one run,
- * so the status it writes is not evidence. A settled task is kept exactly as
- * it stands wherever the rewrite names it, and put back beside its old
- * neighbour where the rewrite leaves it out. Every other task keeps the status
- * it had; a task the rewrite adds starts pending.
- */
-declare function keepExecutionState(current: readonly Task[], rewrite: Task[]): Task[];
-declare function validateModifiedPlan(original: Task[], modified: Task[]): PlanModificationWarnings;
-interface ActiveTaskSession {
-    id: string;
-    taskId: string;
-}
-interface ValidationResult {
-    valid: boolean;
-    errors: string[];
-}
-interface ValidationContext {
-    executionLog: TaskSnapshot[];
-    oldPending: Task[];
-    newPending: Task[];
-    activeSessions: Map<string, ActiveTaskSession>;
-}
-type ValidationCheck = (ctx: ValidationContext) => ValidationResult;
-declare function warningsText(w: PlanModificationWarnings): string | null;
-
-export { type IsolationMergeResult as $, AbstractRunner as A, type BlockingPrompt as B, CMD_EXE_MAX_COMMAND_LINE as C, DEFAULT_RUNNERS as D, type DiscoveryCommand as E, type EditPlanArgs as F, EmbeddedNewlineError as G, ExecutableNotFoundError as H, type FetchAllProviderModelsOptions as I, HeadlessRunner as J, type HeadlessRunnerDeps as K, HeadlessSession as L, type IApproval as M, type IConfig as N, type IPluginStore as O, type ITerminalRunner as P, type ITerminalSession as Q, type IWorktreeIsolation as R, type IntegrationDisposal as S, type IsolationAvailability as T, type IsolationHandoff as U, type IsolationHandoffRepo as V, type IsolationInactiveReason as W, type IsolationLandedTask as X, type IsolationLanding as Y, type IsolationMergeBlock as Z, type IsolationMergeBlockReason as _, AbstractTerminalSession as a, type ResolveContext as a$, type IsolationOutcome as a0, type IsolationPruneResult as a1, type IsolationRemoval as a2, type IsolationRepo as a3, type IsolationRun as a4, type IsolationTaskRecord as a5, type IsolationTaskRef as a6, type IsolationTaskRepo as a7, type IsolationTaskStatus as a8, type IsolationView as a9, type PlannerTokenScope as aA, type PlannerToolHandler as aB, type PlannerUsage as aC, type PluginCloneFn as aD, type PluginEntry as aE, type PluginFeatures as aF, type PluginMode as aG, type PluginModelDiscovery as aH, type PluginRunnerDef as aI, type PreparedLaunch as aJ, type PreparedTask as aK, type PreservedWork as aL, type ProviderCredentialSource as aM, type ProviderModelLists as aN, type ProviderModelsResult as aO, type PtySize as aP, type PtyWrapOptions as aQ, type QueuedMessage as aR, type QueuedTaskMessage as aS, type RefusedRemoval as aT, type RepairEvidence as aU, type RepoGroupLayout as aV, type ResearchLogEntry as aW, type ResearchProgress as aX, type ResearchStep as aY, type ResearchStepOutcome as aZ, type ResearchToolType as a_, type LaunchDeps as aa, type LaunchPlan as ab, type LegacyPlanState as ac, LineBuffer as ad, type ListModelsArgs as ae, type ListRunnersArgs as af, type McpClientConfig as ag, type McpCredential as ah, type McpTool as ai, type McpToolContext as aj, type McpToolReply as ak, type Message as al, ModelCatalog as am, type ModelShortcut as an, ORCHESTRATOR_SHORTCUTS as ao, ORDEWELL_MCP_PATH as ap, ORDEWELL_MCP_SERVER_NAME as aq, type OrchestratorOption as ar, OrdewellMcpServer as as, type OwnerOnlyFile as at, PLANNER_TOOLS as au, type PlanIsolation as av, type PlanModificationWarnings as aw, type PlanState as ax, type PlanStatus as ay, type PlannerStartOptions as az, type ActiveTaskSession as b, flattenTasksWithParents as b$, type RunnerId as b0, type RunnerInvocation as b1, type RunnerPluginManifest as b2, RunnerRegistry as b3, type RunnerSpawnOptions as b4, type RunnerTransport as b5, type RunnerVersionProbe as b6, type StreamEvent as b7, type StreamStepEvent as b8, type StreamThinkingEvent as b9, type TaskType as bA, type TaskWithParent as bB, type ThinkingBlock as bC, type TreeSnapshot as bD, type UsageLine as bE, type UsageRecord as bF, type UsageTotals as bG, type UserPromptEntry as bH, type UserStep as bI, type ValidationCheck as bJ, type ValidationContext as bK, type ValidationResult as bL, type Verdict as bM, type VerificationCheck as bN, WINDOWS_MAX_COMMAND_LINE as bO, addPlannerUsage as bP, addTaskToPlan as bQ, addUsage as bR, approvalScopes as bS, buildShellInvocation as bT, collectProviderCredentials as bU, createEmptyPlan as bV, createTask as bW, emptyWarnings as bX, enabledRunners as bY, fetchAllProviderModels as bZ, flattenTasks as b_, type StructuredEvent as ba, type StructuredSessionCapability as bb, type StructuredTurnEnd as bc, type SubagentLogEntry as bd, type SubagentOutcome as be, type SubmitPlanArgs as bf, TASK_COMPLETE_TOOL as bg, TASK_TOOLS as bh, type Task as bi, type TaskCompleteArgs as bj, type TaskIsolation as bk, type TaskIsolationState as bl, type TaskMode as bm, type TaskModeAgentAdapter as bn, TaskModeUnsupportedError as bo, type TaskModelAssignment as bp, type TaskOutputArgs as bq, type TaskOutputSummary as br, type TaskQueryArgs as bs, type TaskRunnerFlags as bt, type TaskSnapshot as bu, type TaskStartOptions as bv, type TaskStatus as bw, type TaskTokenScope as bx, type TaskToolHandler as by, type TaskTransport as bz, type AgentAdapter as c, inheritedOps as c0, isAwaitingReason as c1, isExecutableResolved as c2, isGranted as c3, isMeasured as c4, isReservedRunnerName as c5, isRunnerApproval as c6, isRunnerTransport as c7, isStructuredSession as c8, keepExecutionState as c9, knownModelId as ca, mcpClientConfig as cb, migrateLegacyPlan as cc, migratePlanState as cd, migrateTask as ce, opsFlag as cf, ownerOnlyConfigFile as cg, partedPromptUsage as ch, planDirectLaunch as ci, planShellLaunch as cj, plannerContextFill as ck, posixShellQuote as cl, removeTaskFromPlan as cm, renumberTasks as cn, resolveModelShortcut as co, resolveProvider as cp, sharedMcpServer as cq, stripAnsi as cr, toApprovalDecision as cs, toOrchestratorOptions as ct, updateTaskInPlan as cu, usageLine as cv, validateModifiedPlan as cw, warningsText as cx, windowsCommandLine as cy, wrapWithPty as cz, type AgentAdapterFactory as d, type AgentEvent as e, type AgentProcessDeps as f, type AgentStartOptions as g, type AiProvider as h, type AllProviderModels as i, type ApprovalAnswer as j, type ApprovalDecision as k, type ApprovalKind as l, type ApprovalMode as m, ApprovalPolicy as n, type ApprovalPolicyOptions as o, type ApprovalRequest as p, type ApprovalSource as q, type AwaitingReason as r, type CatalogModel as s, type CheckpointAnswer as t, type CheckpointArgs as u, CommandLineTooLongError as v, type ConversationMessage as w, DENY_ALL as x, type DiscoveredMode as y, type DiscoveredModel as z };