@ordewell/core 0.8.1 → 0.9.1

package/dist/index.d.mts

@@ -1,11 +1,11 @@
 import { W as RunnerId, E as PlanStatus, L as LegacyPlanState, n as IsolationMergeResult, j as IsolationLandedTask, I as IWorktreeIsolation, w as IsolationTaskStatus, P as PlanIsolation, a3 as SkillsService, _ as SkillInfo, N as RepoGroupLayout, c as DiscoveredModel, a9 as Task, S as ResearchProgress, O as ResearchLogEntry, C as ConversationMessage, ao as UsageRecord, ah as TaskSnapshot, a as AwaitingReason, g as IsolationHandoff, s as IsolationRun, t as IsolationTaskRecord, aa as TaskIsolation, x as IsolationView, o as IsolationOutcome, K as RepairEvidence, am as TreeSnapshot, av as Verdict, ag as TaskSkillSnapshot, $ as SkillLoad, Q as QueuedMessage, A as ActiveTaskSession, V as ResearchToolType, G as PlannerUsage, z as PlanState } from './Task-1Q19y7sZ.mjs';
 export { B as BUILTIN_SKILL_NAMES, D as DEFAULT_RUNNERS, b as DiscoveredMode, d as IntegrationDisposal, e as InvalidSkill, f as IsolationAvailability, h as IsolationHandoffRepo, i as IsolationInactiveReason, k as IsolationLanding, l as IsolationMergeBlock, m as IsolationMergeBlockReason, p as IsolationPruneResult, q as IsolationRemoval, r as IsolationRepo, u as IsolationTaskRef, v as IsolationTaskRepo, M as Message, y as PlanModificationWarnings, F as PlannerTaskView, H as PreparedTask, J as PreservedWork, R as RefusedRemoval, T as ResearchStep, U as ResearchStepOutcome, X as ShadowedSkill, Y as SkillAppliesTo, Z as SkillCatalog, a0 as SkillLoadNotice, a1 as SkillMetadata, a2 as SkillSource, a4 as StreamEvent, a5 as StreamStepEvent, a6 as StreamThinkingEvent, a7 as SubagentLogEntry, a8 as SubagentOutcome, ab as TaskIsolationState, ac as TaskMode, ad as TaskModelAssignment, ae as TaskOutputSummary, af as TaskSkillNotice, ai as TaskStatus, aj as TaskType, ak as TaskWithParent, al as ThinkingBlock, an as UsageLine, ap as UsageTotals, aq as UserPromptEntry, ar as UserStep, as as ValidationCheck, at as ValidationContext, au as ValidationResult, aw as VerificationCheck, ax as addPlannerUsage, ay as addTaskToPlan, az as addUsage, aA as createEmptyPlan, aB as createSkillsService, aC as createTask, aD as emptyWarnings, aE as flattenTasks, aF as flattenTasksWithParents, aG as inheritedOps, aH as inheritedSkills, aI as isAwaitingReason, aJ as isMeasured, aK as isSkillName, aL as isUserMessage, aM as keepExecutionState, aN as migrateLegacyPlan, aO as migrateLoadedTasks, aP as migratePlanState, aQ as migrateTask, aR as opsFlag, aS as partedPromptUsage, aT as plannerContextFill, aU as plannerTaskView, aV as removeTaskFromPlan, aW as renumberTasks, aX as skillNames, aY as updateTaskInPlan, aZ as usageLine, a_ as validateModifiedPlan, a$ as warningsText } from './Task-1Q19y7sZ.mjs';
-import { R as TaskOp, M as MergeGateView, j as EditCatalog, u as SessionBroadcaster, A as ApplyTaskOpsResult, w as SessionNotice, v as SessionMessage, K as TaskLogEvent, H as SurfacePlan, I as SurfacePlanState } from './plan-utils-BMayhGBj.mjs';
-export { a as ApprovalBlock, b as ApprovalStatus, C as CHECKPOINT_TRUNCATE_LENGTH, c as ConversationInput, d as ConversationView, D as DiffRow, e as DiffRowKind, f as DiffStat, g as DisplayBlock, E as EMPTY_CONVERSATION, h as EMPTY_HOLD, i as EMPTY_TASK_LOG, G as GatedConversation, L as LocalEntry, k as MessageBlock, l as MessageRole, N as NOT_STARTED, m as NO_TURN, n as NewTaskFields, O as OutputPreview, P as PlanBlock, o as PlanMarkerStatus, p as PromptHold, S as SerializedConversationMessage, q as SerializedPlan, r as SerializedQueuedMessage, s as SerializedTask, t as SerializedTaskStatus, x as SkillLoadBlock, y as SkillToken, z as SubagentBlock, B as SubagentChild, F as SubagentStatus, J as SurfaceTask, T as TakenPrompt, Q as TaskLogView, U as TaskRef, V as TaskRowAction, W as TaskRowContext, X as TaskRowIsolation, Y as TaskRowKind, Z as TaskRowPlacement, _ as TaskRowSubject, $ as TaskRowView, a0 as TaskStatusKind, a1 as ThinkingDisplayBlock, a2 as ToolBlock, a3 as ToolHeadline, a4 as ToolStatus, a5 as TurnGate, a6 as UsageBlock, a7 as aheadOfDraft, a8 as applyTaskOps, a9 as approvalLabel, aa as awaitingLabel, ab as canMergeTasks, ac as canSetDependencies, ad as canSplitTask, ae as capConflictFiles, af as classifyOutcome, ag as coalesceTaskLog, ah as dependencyCandidates, ai as dependentsNotice, aj as dependentsOf, ak as diffRows, al as diffStat, am as diffSummary, an as digestTaskLog, ao as drainNext, ap as executionSummary, aq as followTurn, ar as fromTranscript, as as hasHiddenDetail, at as holdPrompt, au as isTaskRunning, av as loadedSkillTokens, aw as markAction, ax as markRequestFor, ay as namedRepos, az as newTaskFields, aA as opsEditable, aB as outputLines, aC as outputPreview, aD as parseTaskOpsJson, aE as pastGateConfirmation, aF as reduceConversation, aG as reduceTaskLog, aH as replayTaskLog, aI as runnerToolSubject, aJ as serializePlan, aK as serializeTask, aL as serializeTaskStatus, aM as skillTokens, aN as stopTurn, aO as summarizeToolCall, aP as surfacePlan, aQ as surfacePlanState, aR as taskLogForSurface, aS as taskRowActions, aT as taskRowView, aU as taskStartedNotice, aV as taskStatusKind, aW as textHasTaskOps, aX as titledRefs, aY as toTaskLogEvent, aZ as toolHeadline, a_ as trimToolOutput, a$ as truncateCheckpointSummary, b0 as unsendAll, b1 as unsendLatest } from './plan-utils-BMayhGBj.mjs';
-import { I as IFileSystem, R as ReadFileOpts, T as ToolOutcome, b as GrepOptions, a as GlobOptions, F as FindSymbolOptions } from './IFileSystem-DXJCRw5x.mjs';
-export { G as GREP_DEFAULT_HEAD_LIMIT, c as GrepOutputMode, S as SEARCH_EXCLUSIONS } from './IFileSystem-DXJCRw5x.mjs';
-import { I as IApproval, m as ApprovalRequest, h as ApprovalDecision, g as ApprovalAnswer, s as IRunner, r as IConfig, e as AiProvider, W as ProviderModelLists, j as ApprovalMode, t as IRunnerSession, c as AgentProcessDeps, A as AgentAdapter, P as OrdewellMcpServer, U as PlannerToolHandler, a2 as RunnerRegistry, Y as QueuedTaskMessage, N as OrchestratorOption, aa as TaskModeAgentAdapter, d as AgentStartOptions, b as AgentEvent, k as ApprovalPolicy, a9 as TaskCompleteArgs, o as CheckpointAnswer, a5 as StructuredTurnEnd, a4 as StructuredEvent, af as TaskStartOptions, ag as TaskTokenScope, $ as RunnerManifest, ae as TaskRunnerFlags } from './IRunner-XVUddYVX.mjs';
-export { a as AgentAdapterFactory, f as AllProviderModels, i as ApprovalKind, l as ApprovalPolicyOptions, n as ApprovalSource, C as CatalogModel, p as CheckpointArgs, D as DENY_ALL, q as DiscoveryCommand, E as EditPlanArgs, F as FetchAllProviderModelsOptions, L as LineBuffer, u as ListModelsArgs, v as ListRunnersArgs, w as LoadSkillArgs, M as McpClientConfig, x as McpCredential, y as McpTool, z as McpToolContext, B as McpToolReply, G as ModelCatalog, H as ModelShortcut, O as ORCHESTRATOR_SHORTCUTS, J as ORDEWELL_MCP_PATH, K as ORDEWELL_MCP_SERVER_NAME, Q as OwnerOnlyFile, R as PLANNER_TOOLS, S as PlannerStartOptions, T as PlannerTokenScope, V as ProviderCredentialSource, X as ProviderModelsResult, Z as RunnerEntry, _ as RunnerFeatures, a0 as RunnerMode, a1 as RunnerModelDiscovery, a3 as SpawnFn, a6 as SubmitPlanArgs, a7 as TASK_COMPLETE_TOOL, a8 as TASK_TOOLS, ab as TaskModeUnsupportedError, ac as TaskOutputArgs, ad as TaskQueryArgs, ah as TaskToolHandler, ai as approvalScopes, aj as collectProviderCredentials, ak as enabledRunners, al as fetchAllProviderModels, am as isGranted, an as isRunnerApproval, ao as knownModelId, ap as mcpClientConfig, aq as ownerOnlyConfigFile, ar as resolveModelShortcut, as as resolveProvider, at as sharedMcpServer, au as toApprovalDecision, av as toOrchestratorOptions } from './IRunner-XVUddYVX.mjs';
+import { R as TaskOp, M as MergeGateView, j as EditCatalog, u as SessionBroadcaster, A as ApplyTaskOpsResult, w as SessionNotice, v as SessionMessage, K as TaskLogEvent, H as SurfacePlan, I as SurfacePlanState } from './plan-utils-BmUp_Lko.mjs';
+export { a as ApprovalBlock, b as ApprovalStatus, C as CHECKPOINT_TRUNCATE_LENGTH, c as ConversationInput, d as ConversationView, D as DiffRow, e as DiffRowKind, f as DiffStat, g as DisplayBlock, E as EMPTY_CONVERSATION, h as EMPTY_HOLD, i as EMPTY_TASK_LOG, G as GatedConversation, L as LocalEntry, k as MessageBlock, l as MessageRole, N as NOT_STARTED, m as NO_TURN, n as NewTaskFields, O as OutputPreview, P as PlanBlock, o as PlanMarkerStatus, p as PromptHold, S as SerializedConversationMessage, q as SerializedPlan, r as SerializedQueuedMessage, s as SerializedTask, t as SerializedTaskStatus, x as SkillLoadBlock, y as SkillToken, z as SubagentBlock, B as SubagentChild, F as SubagentStatus, J as SurfaceTask, T as TakenPrompt, Q as TaskLogView, U as TaskRef, V as TaskRowAction, W as TaskRowContext, X as TaskRowIsolation, Y as TaskRowKind, Z as TaskRowPlacement, _ as TaskRowSubject, $ as TaskRowView, a0 as TaskStatusKind, a1 as ThinkingDisplayBlock, a2 as ToolBlock, a3 as ToolHeadline, a4 as ToolStatus, a5 as TurnGate, a6 as UsageBlock, a7 as aheadOfDraft, a8 as applyTaskOps, a9 as approvalLabel, aa as awaitingLabel, ab as canMergeTasks, ac as canSetDependencies, ad as canSplitTask, ae as capConflictFiles, af as classifyOutcome, ag as coalesceTaskLog, ah as dependencyCandidates, ai as dependentsNotice, aj as dependentsOf, ak as diffRows, al as diffStat, am as diffSummary, an as digestTaskLog, ao as drainNext, ap as executionSummary, aq as followTurn, ar as fromTranscript, as as hasHiddenDetail, at as holdPrompt, au as isTaskRunning, av as loadedSkillTokens, aw as markAction, ax as markRequestFor, ay as namedRepos, az as newTaskFields, aA as opsEditable, aB as outputLines, aC as outputPreview, aD as parseTaskOpsJson, aE as pastGateConfirmation, aF as reduceConversation, aG as reduceTaskLog, aH as replayTaskLog, aI as runnerToolSubject, aJ as serializePlan, aK as serializeTask, aL as serializeTaskStatus, aM as skillTokens, aN as stopTurn, aO as summarizeToolCall, aP as surfacePlan, aQ as surfacePlanState, aR as taskLogForSurface, aS as taskRowActions, aT as taskRowView, aU as taskStartedNotice, aV as taskStatusKind, aW as textHasTaskOps, aX as titledRefs, aY as toTaskLogEvent, aZ as toolHeadline, a_ as trimToolOutput, a$ as truncateCheckpointSummary, b0 as unsendAll, b1 as unsendLatest } from './plan-utils-BmUp_Lko.mjs';
+import { I as IFileSystem, R as ReadFileOpts, T as ToolOutcome, b as GrepOptions, a as GlobOptions, F as FindSymbolOptions } from './IFileSystem-Cy-TAWvu.mjs';
+export { G as GREP_DEFAULT_HEAD_LIMIT, c as GrepOutputMode, S as SEARCH_EXCLUSIONS } from './IFileSystem-Cy-TAWvu.mjs';
+import { a7 as ResearchShell, I as IApproval, o as ApprovalRequest, i as ApprovalDecision, h as ApprovalAnswer, y as IRunner, x as IConfig, f as AiProvider, a3 as ProviderModelLists, l as ApprovalModeSetting, z as IRunnerSession, d as AgentProcessDeps, a as AgentAdapter, W as OrdewellMcpServer, a0 as PlannerToolHandler, af as RunnerRegistry, a5 as QueuedTaskMessage, V as OrchestratorOption, ap as TaskModeAgentAdapter, e as AgentStartOptions, c as AgentEvent, a1 as ProjectMcpServer, m as ApprovalPolicy, ao as TaskCompleteArgs, q as CheckpointAnswer, ak as StructuredTurnEnd, aj as StructuredEvent, au as TaskStartOptions, av as TaskTokenScope, ac as RunnerManifest, at as TaskRunnerFlags } from './IRunner-D6YfbmHn.mjs';
+export { A as AUTO_COMMANDS, b as AgentAdapterFactory, g as AllProviderModels, j as ApprovalKind, k as ApprovalMode, n as ApprovalPolicyOptions, p as ApprovalSource, C as CatalogModel, r as CheckpointArgs, s as CommandClassification, t as CommandTier, u as CommandWords, D as DEFAULT_PLANNER_ALLOWLIST, v as DENY_ALL, w as DiscoveryCommand, E as EditPlanArgs, F as FetchAllProviderModelsOptions, G as GIT_READONLY_SUBCOMMANDS, L as LineBuffer, B as ListModelsArgs, H as ListRunnersArgs, J as LoadSkillArgs, M as McpClientConfig, K as McpCredential, N as McpTool, O as McpToolContext, P as McpToolReply, Q as ModelCatalog, R as ModelShortcut, S as ORCHESTRATOR_SHORTCUTS, T as ORDEWELL_MCP_PATH, U as ORDEWELL_MCP_SERVER_NAME, X as OwnerOnlyFile, Y as PLANNER_TOOLS, Z as PlannerAllowlist, _ as PlannerStartOptions, $ as PlannerTokenScope, a2 as ProviderCredentialSource, a4 as ProviderModelsResult, a6 as REFUSED_COMMANDS, a8 as ResearchShellDeps, a9 as RunCommandArgs, aa as RunnerEntry, ab as RunnerFeatures, ad as RunnerMode, ae as RunnerModelDiscovery, ag as ShellDialect, ah as SpawnFn, ai as StandingDecision, al as SubmitPlanArgs, am as TASK_COMPLETE_TOOL, an as TASK_TOOLS, aq as TaskModeUnsupportedError, ar as TaskOutputArgs, as as TaskQueryArgs, aw as TaskToolHandler, ax as approvalScopes, ay as classifyCommand, az as clearResearchShellCache, aA as collectProviderCredentials, aB as commandAllowedBy, aC as effectiveApprovalMode, aD as enabledRunners, aE as fetchAllProviderModels, aF as isGranted, aG as isRunnerApproval, aH as knownModelId, aI as mcpClientConfig, aJ as ownerOnlyConfigFile, aK as parseAllowlist, aL as parseApprovalModeSetting, aM as researchShellWarning, aN as researchToolsPath, aO as resolveModelShortcut, aP as resolveProvider, aQ as resolveResearchShell, aR as scopeAllowed, aS as sharedMcpServer, aT as toApprovalDecision, aU as toOrchestratorOptions, aV as toolAllowed } from './IRunner-D6YfbmHn.mjs';
 import { R as RunnerModeInfo } from './ModeResolver-DE-o2lRF.mjs';
 export { M as ManifestLookup, a as autonomyLevelLabel, b as buildModeGuide, f as filteredBuildModes, p as parseAutonomyLevel, r as resolveDefaultMode, c as resolveTaskMode, d as runnerModesFrom } from './ModeResolver-DE-o2lRF.mjs';
 import { ChildProcess } from 'child_process';
@@ -31,188 +31,12 @@ interface SessionData {
 }
 
 /**
- * Tiered classification for the planner's `bash` tool.
- *
- * The planner is a read-only researcher: it never edits files, and the runners
- * do the real work. But research legitimately means running things — querying a
- * cloud control plane (`az`, `gh`), reproducing a failure (`npm test`), or
- * shaping output (`jq`). The old allowlist refused all of that, so the model's
- * only escape was to guess.
- *
- * Three tiers replace the flat allowlist:
- *
- *   auto    read-only inspection — runs with no prompt (the historical list)
- *   ask     anything else that is not obviously destructive — one approval,
- *           remembered for the rest of the session at `scope` granularity
- *   refuse  writes, privilege escalation, and anything that would smuggle
- *           arbitrary code past this classifier — never runs, never prompts
- *
- * `refuse` is deliberately not promptable. A planner that can `rm` is a planner
- * that can silently break the workspace it was asked to reason about, and the
- * architecture already says mutation belongs to the runners.
- *
- * Classification walks every segment of the command line (pipes, `&&`, `;`, and
- * command substitution) rather than matching substrings against the raw string.
- * The old substring denylist both over-matched (`ls docs/removed` tripped `rm`)
- * and under-matched (`$(rm -rf /)` was invisible once chaining was allowed).
- *
- * A segment is classified by the command that will actually execute, not by the
- * name at the front of it: wrappers are unwrapped first, recursively, so
- * `timeout 10 env nice rm -rf x` is an `rm`. See {@link WRAPPER_FAMILY}. A
- * runner that feeds its command arguments nobody can see is unwrapped the same
- * way but never runs unprompted ({@link XARGS_TARGETS}), and one that hands its
- * command to a shell is refused ({@link REFUSED_RUNNERS}).
- *
- * A permitted binary is permitted with the flags it is known to be read-only
- * with, not with any flag at all: several of them will run a helper program or
- * write a file when asked to, so `auto` is a per-binary flag allowlist and an
- * unrecognised flag is refused. See {@link FLAG_POLICY}.
- *
- * The lexer is dialect-aware, because the interpreter that will actually run
- * the command decides what the tokens are, and getting that wrong is not a
- * cosmetic error here — it is the difference between classifying what runs and
- * classifying something else. See {@link Dialect}.
- */
-
-/**
- * `env` is deliberately absent. Given a command it is a wrapper, classified by
- * what it actually runs (see {@link WRAPPER_FAMILY}); given none it prints the
- * whole process environment — provider credentials included — into the research
- * log, which is a disclosure the developer should get to see coming.
- *
- * Membership here is necessary but not sufficient: every name in this list also
- * declares the flags it is read-only with in {@link FLAG_POLICY}.
- */
-declare const AUTO_COMMANDS: string[];
-/**
- * `ls-remote` is deliberately absent, and it is the one entry here that is
- * read-only against the repository. It reaches the network: it contacts
- * whatever host the named remote or URL resolves to, which routes around the
- * web fetcher's per-origin approval and its request-forgery guard. So it
- * prompts rather than running silently.
- *
- * Prompting only became the right answer once {@link scopeFor} widened. Under
- * the old scope it would have been remembered as `git ls-remote`, so one
- * approval of the workspace's own remote would have authorised a listing
- * against any host at all — which is the same hole with an approval dialog in
- * front of it. The scope now carries the destination.
+ * The SSRF guard for anything that leaves the machine on the planner's behalf.
+ * An unguarded `http://169.254.169.254/` would hand a prompt-injected planner
+ * the cloud metadata credentials, so every outbound host is vetted here: IP
+ * literals by range, names by every address DNS answers with.
  */
-declare const GIT_READONLY_SUBCOMMANDS: string[];
-/**
- * Never runs, with or without approval.
- *
- * The `cmd.exe` builtins at the end matter as much as the POSIX names above
- * them. `del`, `rd`, `move`, and friends mutate exactly what `rm` and `mv` do,
- * and on Windows they are what a model reaches for — so without them the whole
- * refusal tier was bypassable on that platform by writing the command the way
- * the platform spells it. Listed unconditionally rather than per-platform: a
- * POSIX box has no `del` to refuse, so the extra names cost nothing there.
- */
-declare const REFUSED_COMMANDS: string[];
-/**
- * Options threaded through classification.
- *
- * `dialect` is keyed to the interpreter rather than the OS on purpose: a Windows
- * host that has Git Bash runs the planner's commands in a POSIX shell (see
- * {@link resolveResearchShell}), and classifying those under cmd.exe rules
- * would be the same mismatch in the other direction. Callers pass the dialect of
- * the shell they are actually going to use; omitting it falls back to the host
- * default.
- */
-interface CommandPolicyOptions {
-    dialect?: ShellDialect;
-    /**
-     * `CDPATH` is set in the environment the command will run in. A relative
-     * `cd` may then land in a directory the command line never names, so `cd`
-     * stops being navigation the classifier can follow.
-     */
-    cdpathSet?: boolean;
-}
-type CommandTier = 'auto' | 'ask' | 'refuse';
-interface CommandClassification {
-    tier: CommandTier;
-    /** What a grant covers, for `ask`. Derived from the non-auto segments only. */
-    scope: string;
-    /** Populated for `refuse`: why, in a sentence the model can act on. */
-    reason?: string;
-}
-/**
- * Classify one command line. Output redirection is refused outright unless the
- * target provably writes nothing — `/dev/null`, or an fd duplication like
- * `2>&1` — since a planner that writes files has stopped being a planner.
- */
-declare function classifyCommand(command: string, opts?: CommandPolicyOptions): CommandClassification;
-
-/**
- * Which interpreter runs the planner's `bash` tool, and in which language.
- *
- * `AUTO_COMMANDS` — the read-only tier that runs with no prompt — is `ls`, `cat`,
- * `wc`, `head`, `tail`, `du`, `df`, `file`, `sort`, `uniq`, `basename`, `find`,
- * `grep`. That set is POSIX, and passing it to `shell: true` on Windows means
- * cmd.exe, where most of those names do not exist and `find` is an unrelated
- * program that returns plausible wrong output instead of an error. The planner's
- * whole research surface degraded to guessing, quietly.
- *
- * Rather than write a Windows dialect of every research command — a second
- * behavior to keep in step forever — this finds a POSIX shell to run the
- * existing ones in. Git for Windows ships a full one, and git is already a
- * prerequisite for everything Ordewell does, so in practice it is there. Failing
- * that, cmd.exe is used and the classifier is told so, because the one thing
- * that must never happen is classifying a command in one language and running it
- * in another: `commandPolicy` reads {@link ResearchShell.dialect} for exactly
- * that reason.
- *
- * POSIX resolves to `{ file: null }`, meaning "use `shell: true`" — byte for
- * byte what the adapters did before this module existed.
- *
- * Windows paths are built with `path.win32` explicitly, not the host-flavoured
- * `path`, so the probe is the same on a Windows host as it is under a Linux
- * test runner.
- */
-type ShellDialect = 'posix' | 'cmd';
-interface ResearchShell {
-    /**
-     * Executable that takes a command string, or null to use the host default
-     * via `shell: true`.
-     */
-    file: string | null;
-    /** Arguments preceding the command string. */
-    args: string[];
-    /** The language the command string will be interpreted in. */
-    dialect: ShellDialect;
-    /**
-     * Directory holding this shell's POSIX utilities, when it brings its own.
-     * Prepended to PATH for the search subprocesses (`grep`, `tree`) that
-     * `execFile` starts without a shell, so they resolve too.
-     */
-    utilsDir: string | null;
-}
-interface ResearchShellDeps {
-    platform?: NodeJS.Platform;
-    exists?: (candidate: string) => boolean;
-    env?: NodeJS.ProcessEnv;
-}
-/**
- * The shell the planner's `bash` tool should use on this host. Resolved once per
- * process — the answer cannot change while Ordewell runs, and the probe costs a
- * handful of `stat` calls.
- */
-declare function resolveResearchShell(deps?: ResearchShellDeps): ResearchShell;
-/** Test seam: drop the per-process cache so the next call re-probes. */
-declare function clearResearchShellCache(): void;
-/**
- * PATH for the search subprocesses the adapters start without a shell, with the
- * research shell's own utilities in front. Without this, `grep` — the fallback
- * when ripgrep is absent — is unresolvable on a Windows box even when a
- * perfectly good `grep.exe` sits in the Git tree beside the shell.
- */
-declare function researchToolsPath(shell: ResearchShell, basePath: string | undefined): string;
-/**
- * A message explaining a degraded research surface, or null when there is
- * nothing to explain. Surfaced by the adapters on the first refused command so
- * the limitation is visible rather than inferred from bad answers.
- */
-declare function researchShellWarning(shell: ResearchShell): string | null;
+type ResolveAll = (host: string) => Promise<string[]>;
 
 /**
  * The policy half of the planner's filesystem: path confinement, the tiered
@@ -227,7 +51,10 @@ declare function researchShellWarning(shell: ResearchShell): string | null;
  * record.
  */
 declare abstract class BaseFileSystem implements IFileSystem {
+    private readonly resolveWebHost;
     private approval;
+    private outboundSecrets;
+    constructor(resolveWebHost?: ResolveAll);
     /**
      * The interpreter `execBashImpl` will hand the command to. Owned here rather
      * than per-adapter because {@link classifyCommand} has to be told the same
@@ -237,6 +64,7 @@ declare abstract class BaseFileSystem implements IFileSystem {
     protected readonly researchShell: ResearchShell;
     /** Surfaces inject the human channel here; without it, external access is denied. */
     setApproval(approval: IApproval): void;
+    setOutboundSecrets(secrets: () => Iterable<string>): void;
     abstract getWorkspaceRoot(): string;
     protected abstract readFileImpl(absPath: string, opts?: ReadFileOpts): Promise<ToolOutcome>;
     protected abstract globImpl(pattern: string, absRoot: string, headLimit: number): Promise<ToolOutcome>;
@@ -288,8 +116,95 @@ declare abstract class BaseFileSystem implements IFileSystem {
     bash(command: string, signal?: AbortSignal): Promise<ToolOutcome>;
 }
 
+/**
+ * The one decision every planner web read goes through, whichever runner
+ * plans and whichever path carries the bytes (ADR-0027). A fetch names the
+ * URL it reads; a search names its query and the provider that receives it.
+ */
+type WebRead = {
+    kind: 'fetch';
+    url: string;
+}
+/** `provider` keys the grant; `providerLabel`, when given, names it to the person asked. */
+ | {
+    kind: 'search';
+    query: string;
+    provider: string;
+    providerLabel?: string;
+    note?: string;
+};
+/** A refusal's `reason` is written for the planner: it says what to do next. */
+type WebReadDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: string;
+};
+interface DecideOptions {
+    /**
+     * Research subagents run in the background where nothing can prompt
+     * (ADR-0008, T6). When false, a read that would ask is refused with the gap
+     * to report, rather than raising a prompt nobody can answer.
+     */
+    prompting?: boolean;
+}
+interface WebReadPolicyOptions {
+    approval: IApproval;
+    /** The secrets Ordewell holds — provider keys, MCP tokens — read per request. */
+    secrets?: () => Iterable<string>;
+    /** Defaults to `process.env`; its credential-named values are secrets too. */
+    env?: () => Record<string, string | undefined>;
+    /** How many web reads one planner turn may make; read per request, so a settings change applies at once. */
+    budget?: () => number;
+    /** The planner turn in progress; a new one starts a new budget. */
+    turn?: () => string | undefined;
+    /** Override DNS resolution (every answer for a name) in tests. */
+    resolveHost?: ResolveAll;
+}
+declare const DEFAULT_WEB_READ_BUDGET = 40;
+declare class WebReadPolicy {
+    private readonly approval;
+    private readonly resolveHost;
+    private readonly secrets;
+    private readonly env;
+    private readonly budget;
+    private readonly turn;
+    private spent;
+    constructor(opts: WebReadPolicyOptions);
+    /**
+     * Every check that needs no network runs first, then the budget and the
+     * approval, and only then is a fetch's host resolved: a lookup is itself a
+     * request, so `<data>.attacker.example` would leave through DNS even for a
+     * read that is then excluded, over budget or declined.
+     */
+    decide(read: WebRead, opts?: DecideOptions): Promise<WebReadDecision>;
+    private subagentRefusal;
+    /**
+     * Whether a search through `provider` would run without asking anyone, for
+     * a runner whose own search raises no request and is set on or off when
+     * its session starts (ADR-0027). A zero budget disables it; no query is
+     * known yet, so secrets and individual reads cannot be checked or counted.
+     */
+    searchesUnasked(provider: string): boolean;
+    /** The last check, the one that leaves the machine: every DNS answer for the host must be public. */
+    private resolved;
+    private refuse;
+    private vetFetch;
+    private vetSearch;
+    private spend;
+    private refund;
+    private carriesSecret;
+}
+
 interface IWebFetcher {
-    confirm(url: string): Promise<boolean>;
+    /**
+     * The web-read policy's decision (ADR-0027), for a read this fetcher will
+     * carry or one a runner carries natively, such as Claude's `WebFetch`.
+     * `fetch` and `search` decide for themselves; never call both.
+     */
+    decide(read: WebRead): Promise<WebReadDecision>;
+    /** Whether a runner's own search through `provider` would run unasked; see `WebReadPolicy.searchesUnasked`. */
+    searchesUnasked?(provider: string): boolean;
     fetch(url: string): Promise<ToolOutcome>;
     /**
      * Optional web search. A fetcher without it makes the `web_search` tool
@@ -297,6 +212,13 @@ interface IWebFetcher {
      * degradation `fetch` already uses when no fetcher is wired at all.
      */
     search?(query: string): Promise<ToolOutcome>;
+    /**
+     * A variant of this fetcher for a research subagent: same policy, cache,
+     * transport and budget, but a read that would ask a person is refused
+     * instead (ADR-0027, ADR-0008 T6). Absent means subagents get no web tools
+     * and the `fetch`/`web_search` tools report themselves unavailable.
+     */
+    forSubagent?(): IWebFetcher;
 }
 
 /**
@@ -327,6 +249,195 @@ declare function resolveWithin(root: string, target: string, from?: string): Res
 /** The directory a grant covers for `target` — its parent for files, itself for directories. */
 declare function grantScopeFor(abs: string, kind: 'file' | 'directory'): string;
 
+/**
+ * A web-search backend behind a narrow seam (ADR-0027). The fetcher carries
+ * the bytes through its vetted transport; a provider owns only the endpoint,
+ * how to read its results, and how it reacts when it pushes back. `id` flows
+ * into the web-read policy's `search` decision, so an approval names the third
+ * party that receives the query.
+ *
+ * One provider exists today (DuckDuckGo's lite endpoint, zero-configuration).
+ * The seam exists so adding another is one class, not a refactor.
+ */
+/** One search result: a title, its URL, and an optional snippet. */
+interface SearchHit {
+    title: string;
+    url: string;
+    snippet?: string;
+}
+/**
+ * The fetcher's vetted page fetch, as a provider sees it. `status` is carried
+ * so a provider can tell 429/403 ("pushed back") from a plain error, and the
+ * body so it can tell a results page from a challenge.
+ */
+type SearchPage = {
+    ok: true;
+    status: number;
+    body: string;
+} | {
+    ok: false;
+    status?: number;
+    error: string;
+};
+type SearchTransport = (url: string) => Promise<SearchPage>;
+/**
+ * What one lookup produced. `blocked` means the provider pushed back and
+ * marked itself unavailable; `none` is a plain 200 with nothing parseable,
+ * which is not a block; `error` is anything else that went wrong.
+ */
+type SearchOutcome = {
+    kind: 'hits';
+    hits: SearchHit[];
+} | {
+    kind: 'none';
+} | {
+    kind: 'blocked';
+    reason: string;
+} | {
+    kind: 'error';
+    error: string;
+};
+interface ISearchProvider {
+    /** The id that names this backend in the web-read policy's `search` decision. */
+    readonly id: string;
+    /** The human name shown wherever the query's destination is named. */
+    readonly name: string;
+    /** Whether a recent push-back has left the provider in cooldown; no request may go out. */
+    coolingDown(): boolean;
+    /** Run one query through `get`, which fetches through the fetcher's pinned transport. */
+    search(query: string, get: SearchTransport): Promise<SearchOutcome>;
+}
+
+declare function looksLikeChallenge(html: string): boolean;
+/**
+ * Pull result links out of the lite endpoint's markup. A result's snippet is
+ * looked for only between its link and the next one: a result with no snippet
+ * must not borrow its neighbour's.
+ */
+declare function parseSearchHits(html: string): SearchHit[];
+/**
+ * The provider's shared instance: one process-wide provider means the cooldown
+ * a push-back starts is seen by every session, not just the one that hit it.
+ * `now` is injectable so tests drive the cooldown without waiting.
+ */
+declare class DuckDuckGoSearchProvider implements ISearchProvider {
+    readonly id = "duckduckgo";
+    readonly name = "DuckDuckGo";
+    private failures;
+    private cooldownUntil;
+    private readonly now;
+    constructor(now?: () => number);
+    coolingDown(): boolean;
+    search(query: string, get: SearchTransport): Promise<SearchOutcome>;
+    private block;
+}
+/** The one provider every session's fetcher shares, so a cooldown is process-wide. */
+declare const sharedSearchProvider: DuckDuckGoSearchProvider;
+
+interface CachedPage {
+    body: string;
+    isHtml: boolean;
+}
+interface WebResponseCacheOptions {
+    ttlMs?: number;
+    maxEntries?: number;
+    maxBytes?: number;
+    now?: () => number;
+}
+declare class WebResponseCache {
+    private readonly entries;
+    private readonly ttlMs;
+    private readonly maxEntries;
+    private readonly maxBytes;
+    private readonly now;
+    private bytes;
+    constructor(opts?: WebResponseCacheOptions);
+    getFetch(url: string): CachedPage | undefined;
+    /** `maxAgeMs` is the response's own freshness; it shortens the TTL, never extends it. */
+    setFetch(url: string, page: CachedPage, maxAgeMs?: number): void;
+    getSearch(providerAndQuery: string): SearchHit[] | undefined;
+    setSearch(providerAndQuery: string, hits: SearchHit[]): void;
+    private get;
+    private set;
+    private delete;
+}
+/** The one cache every session's fetcher shares, so a page fetched once is reused across planners. */
+declare const sharedWebResponseCache: WebResponseCache;
+
+/**
+ * The concrete `fetch`/`web_search` implementation, in core so the web server
+ * and the VS Code extension share one behavior.
+ *
+ * Whether a read happens is the web-read policy's to decide (ADR-0027); this
+ * carries it. A redirect to another origin is put to the policy again here,
+ * since it saw only the first URL. Search goes through a pluggable provider
+ * behind the same transport; results and pages are cached in an injected,
+ * process-wide cache that saves the network but never the decision.
+ */
+/** The slice of a `fetch` Response the fetcher reads; the platform `fetch` satisfies it. */
+interface WebResponse {
+    ok: boolean;
+    status: number;
+    headers: {
+        get(name: string): string | null;
+    };
+    body: unknown;
+    text(): Promise<string>;
+}
+type WebTransport = (url: string, init: {
+    signal: AbortSignal;
+    headers: Record<string, string>;
+    redirect: 'manual';
+}) => Promise<WebResponse>;
+interface HttpWebFetcherOptions {
+    policy: WebReadDecider;
+    /**
+     * Injected in tests; defaults to a node:http(s) transport whose sockets
+     * connect only to addresses `resolveHost` answered and the guard vetted.
+     */
+    fetchImpl?: WebTransport;
+    maxChars?: number;
+    timeoutMs?: number;
+    /** Override DNS resolution (every answer for a name) in tests. */
+    resolveHost?: ResolveAll;
+    /** Shared across sessions in production; a fresh one per instance is the test default. */
+    cache?: WebResponseCache;
+    /** Shared across sessions so the search cooldown is process-wide. */
+    searchProvider?: ISearchProvider;
+    /** False for a research subagent, which must never prompt (see {@link forSubagent}). */
+    prompting?: boolean;
+}
+type WebReadDecider = Pick<WebReadPolicy, 'decide'> & Partial<Pick<WebReadPolicy, 'searchesUnasked'>>;
+declare class HttpWebFetcher implements IWebFetcher {
+    private readonly policy;
+    private readonly fetchImpl;
+    private readonly maxChars;
+    private readonly timeoutMs;
+    private readonly resolveHost;
+    private readonly cache;
+    private readonly searchProvider;
+    private readonly prompting;
+    constructor(opts: HttpWebFetcherOptions);
+    decide(read: WebRead): Promise<WebReadDecision>;
+    private get decideOptions();
+    forSubagent(): IWebFetcher;
+    searchesUnasked(provider: string): boolean;
+    fetch(url: string): Promise<ToolOutcome>;
+    search(query: string): Promise<ToolOutcome>;
+    private get;
+    private render;
+    private getSearchPage;
+    private request;
+    /**
+     * Why a redirect must not be followed, or `undefined` if it may. The policy
+     * decided only the first URL, so a hop to another origin is a new read with
+     * the same decision; otherwise a redirect would carry the fetch past an
+     * exclusion, a Guarded grant or the budget.
+     */
+    private refuseRedirect;
+    private hop;
+}
+
 /**
  * The bridge between "core needs an answer" and "a human somewhere is looking
  * at a UI". Core cannot prompt: the human may be at a browser, a TUI, a CLI
@@ -603,7 +714,9 @@ declare abstract class BaseConfig implements IConfig {
     get workspaceRepos(): string[];
     get worktreeLinks(): string[];
     get conflictRepairAttempts(): number;
-    get approvalMode(): ApprovalMode;
+    get approvalMode(): ApprovalModeSetting;
+    get webReadBudget(): number;
+    get approvalDefaults(): boolean;
     get approvalPreApproved(): string[];
     protected static detectProvider(fallback: AiProvider): AiProvider;
 }
@@ -856,6 +969,16 @@ type LiveOutputLookup = (taskId: string, opts: LiveTailOptions) => LiveTail | nu
  */
 declare function renderTaskQueryAnswer(query: TaskQuery, tasks: readonly Task[], catalog: TaskQueryCatalog, liveOutput?: LiveOutputLookup): string;
 
+/**
+ * A person's approvals of project MCP servers, kept across sessions
+ * (ADR-0028). Keyed by repository root and scope, which names the server
+ * and hashes its definition: a changed definition is a new question.
+ */
+interface ProjectServerApprovals {
+    approved(repoRoot: string, scope: string): boolean;
+    remember(repoRoot: string, scope: string): void;
+}
+
 interface CliAgentAiServiceDeps extends Partial<AgentProcessDeps> {
     /** Overrides adapter construction. Tests supply a fake agent; production picks by runner id. */
     createAdapter?: (runner: string, deps: AgentProcessDeps) => AgentAdapter | null;
@@ -863,6 +986,8 @@ interface CliAgentAiServiceDeps extends Partial<AgentProcessDeps> {
     workspaceRoot?: () => string;
     /** Where a conversation's planner tools are served (ADR-0022). Absent: no conversation can start. */
     mcpServer?: OrdewellMcpServer;
+    /** A person's approvals of project MCP servers, kept across sessions (ADR-0028). Defaults to Ordewell's data directory. */
+    projectServerApprovals?: ProjectServerApprovals;
 }
 /**
  * A coding agent driven as Ordewell's planner (ADR-0009).
@@ -883,6 +1008,7 @@ declare class CliAgentAiService implements IAiService {
     private readonly processDeps;
     private readonly makeAdapter;
     private readonly workspaceRoot;
+    private environmentSecrets;
     private adapter;
     /**
      * The agent's own session id, kept across a process death so the next turn
@@ -890,10 +1016,20 @@ declare class CliAgentAiService implements IAiService {
      * every session boundary — nothing from one goal may reach the next.
      */
     private lastNativeSessionId;
+    /** `gate` is what the agent's own tool requests are decided against; absent, only Ordewell's tools are allowed (ADR-0026). */
     private conversation;
+    /**
+     * What the runner's own session-wide search is decided against
+     * (ADR-0027), asked again before every turn: the session's mode, its
+     * exclusions or its budget can change between turns. Absent, it is off.
+     */
+    private searchesUnasked;
     private readonly mcpServer;
+    private readonly projectServerApprovals;
     /** The planner token the running process was spawned with; revoked with the process (ADR-0022, A3). */
     private plannerToken;
+    /** The {@link PlannerStartOptions.nativeSearch} the running process was spawned with. */
+    private adapterNativeSearch;
     private activeAbort;
     /**
      * Every subagent this conversation has reported starting, and finishing.
@@ -916,6 +1052,7 @@ declare class CliAgentAiService implements IAiService {
     plannerToolsAttached(): boolean;
     /** The agent's own session id, a resumption hint only — Ordewell's transcript is authoritative (T4). */
     nativeSessionId(): string | null;
+    heldSecrets(): readonly string[];
     reset(): void;
     startConversation(req: ConversationRequest): Promise<ConversationTurn>;
     continueConversation(userMessage: string, onProgress: (progress: ResearchProgress) => void, signal?: AbortSignal): Promise<ConversationTurn>;
@@ -946,13 +1083,27 @@ declare class CliAgentAiService implements IAiService {
     private startWithTools;
     /** Kill the planner process, and with it the token it was spawned with. */
     private disposeAdapter;
+    /** Whether the web-read policy lets the runner's own session-wide search run unasked now (ADR-0027). */
+    private nativeSearch;
     /**
      * The live agent process, restarted from its own session id if it died
      * between turns. Resume is a hint: when it fails, the caller's next
      * `startConversation` reseeds from Ordewell's transcript, which is the same
      * degradation `restoreChat` already performs on every surface.
+     *
+     * Also restarted when the policy's decision on the runner's own search has
+     * changed since the process was spawned: the running thread would otherwise
+     * keep searching unasked after Full turned Guarded. Codex 0.162 applies
+     * `thread/resume`'s `config.web_search` either way (checked live).
      */
     private ensureAdapter;
+    /**
+     * What the planner gets of the repository's config, its runner being
+     * launched without it (ADR-0028): the instruction files, which are text, in
+     * its system prompt, and the project MCP servers it may start. Decided once
+     * per conversation, so a respawn starts the same servers without asking.
+     */
+    private repoConfig;
     private plannerModel;
     /**
      * A plan from one-shot agent sessions: only what a submit_plan call
@@ -1025,6 +1176,12 @@ interface ConversationRequest {
      */
     initialMessage?: string;
     plannerTools?: PlannerToolsOffer;
+    /**
+     * The session's approval policy, which a harness planner's own tool
+     * requests are decided against as the API planner's are (ADR-0026). Absent:
+     * nobody can be asked, so they are denied.
+     */
+    approval?: IApproval;
     /**
      * The workspace's skill catalog. Every planner is shown the task skills it
      * may attach; only one with tools is shown the planner skills, which load
@@ -1065,6 +1222,8 @@ type ConversationTurn =
     researchLog: ResearchLogEntry[];
 };
 interface IAiService {
+    /** Credential values from the harness planner's effective environment, for the outbound secret check. */
+    heldSecrets?(): readonly string[];
     /**
      * Begin the planner conversation: collect workspace context, run the
      * research/tool loop, and return the first planner turn. The service
@@ -2642,7 +2801,8 @@ declare const ORDEWELL_SETTABLE_ENV: readonly string[];
  * a known escalation from "can change a setting" to "can run code as the user":
  *
  * - The approval-mode and pre-approved-scope variables switch the consent gate
- *   off, so every later command runs unprompted.
+ *   off, so every later command runs unprompted; the web-read budget bounds
+ *   how much a planner may send out unasked in Full.
  * - The settings-path override is honoured by the settings service, which
  *   creates directories recursively when persisting — admitting it turns the
  *   same write into an arbitrary-path file write.
@@ -2731,8 +2891,11 @@ declare abstract class StdioAgentAdapter implements AgentAdapter {
     /** What this process is to the user — a planner or a task's runner — for the words a failure is reported in. */
     protected role: 'planner' | 'task';
     constructor(deps: AgentProcessDeps);
-    /** The command line that starts this agent in its read-only mode. */
-    protected abstract spawnSpec(opts: AgentStartOptions): SpawnSpec;
+    /**
+     * The command line that starts this agent in its read-only mode, given the
+     * workspace's own variables (ADR-0016) the process will run under.
+     */
+    protected abstract spawnSpec(opts: AgentStartOptions, workspace: Record<string, string>): SpawnSpec;
     /** The bytes written to stdin to open one user turn. Must end with a newline. */
     protected abstract turnPayload(message: string): string;
     /**
@@ -2817,7 +2980,7 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
     private readonly steers;
     /** The last turn's `result` ended it, so a steer's echo now opens a turn the CLI started for that message. */
     private turnClosed;
-    protected spawnSpec(opts: AgentStartOptions): SpawnSpec;
+    protected spawnSpec(opts: AgentStartOptions, workspace: Record<string, string>): SpawnSpec;
     /**
      * A task's run: the manifest decides what its mode and effort mean
      * (ADR-0001), and this adds only the protocol around them. No tool list and
@@ -2826,6 +2989,13 @@ declare class ClaudeCodeAdapter extends StdioAgentAdapter implements TaskModeAge
      * without it `-p` refuses them silently and nothing can ever surface one.
      */
     private taskSpawnSpec;
+    /**
+     * What user-only settings stop the CLI loading that is not the
+     * repository's to choose (ADR-0028): the user's own local-scope servers,
+     * under the `CLAUDE_CONFIG_DIR` the planner runs with, and the project
+     * servers approved for it.
+     */
+    private plannerServers;
     /** The file holding the token lives exactly as long as the process that reads it. */
     private ordewellServerArgs;
     private removeMcpConfig;
@@ -2952,6 +3122,8 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
     private readonly interruptedTurnIds;
     /** A task's approval requests still waiting for an answer, by the request id as a string. */
     private readonly openPermissions;
+    /** The tool each MCP server's latest call is for, which names the tool an approval asks about when its question does not. */
+    private readonly mcpCallsInProgress;
     /**
      * The files each in-flight `fileChange` item touches. Its approval request
      * names only the item, and a person deciding needs to see the files.
@@ -3074,6 +3246,12 @@ declare class CodexAdapter extends StdioAgentAdapter implements TaskModeAgentAda
      * failed request and plans around, rather than waiting on.
      */
     private answerServerRequest;
+    /**
+     * A planner's approval for a tool of the user's own MCP server, held for the
+     * planner's envelope to answer (ADR-0026). Codex names the server; the tool
+     * is in its question, or else the call it last started on that server.
+     */
+    private holdMcpToolApproval;
     /** A tool item entering `inProgress` — announce the call so the timeline moves. */
     private emitItemStart;
     private emitItemDone;
@@ -3135,6 +3313,8 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
     private taskTurn;
     /** An abort was posted during the current task turn, so the idle that follows ends it as interrupted. */
     private interruptRequested;
+    /** The user's MCP servers, as `/mcp` last listed them: what tells a planner's MCP tool request from a built-in's (ADR-0026). */
+    private mcpServers;
     private readonly permissions;
     /** Messages handed into the running task turn, until the model reads them (ADR-0023). Kept across turns: the server keeps the message too. */
     private readonly steers;
@@ -3213,7 +3393,7 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
      * only 2.x answers `/api/info` with its version. A 1.x server — or one that
      * answers with anything else — keeps the 1.x protocol this class speaks.
      */
-    private speaksV2;
+    private v2Version;
     private role;
     /**
      * Turn one settled assistant message into events. The settled response is
@@ -3281,8 +3461,11 @@ declare class OpenCodeAdapter implements TaskModeAgentAdapter {
     private request;
     private headers;
     nativeSessionId(): string | null;
+    unusableProjectServers(): ProjectMcpServer[];
     /** Asks the server, which lists every MCP server it has with the state of its connection. */
     mcpAttached(): Promise<boolean>;
+    /** 2.x lists its servers as `{ name, status: { status } }`, and only once it has started connecting them. */
+    private v2McpStatus;
     dispose(): void;
     private exitMessage;
 }
@@ -5914,4 +6097,4 @@ declare const DEFAULT_MAX_PARALLEL = 5;
  */
 declare function parseMaxParallel(value: unknown): number | null;
 
-export { ALL_PROVIDERS, AUTO_COMMANDS, AbstractRunner, AbstractRunnerSession, ActiveTaskSession, type AdoptSessionResponse, type Adr0013IsolationRun, type Adr0013PlanIsolation, type Adr0013TaskRecord, AgentAdapter, AgentEvent, AgentProcessDeps, AgentStartOptions, AiProvider, AlreadyExecutingError, ApplyTaskOpsResult, ApprovalAnswer, type ApprovalAnswerResponse, ApprovalDecision, ApprovalMode, ApprovalPolicy, ApprovalRequest, type ApprovalsResponse, type AskOptions, AwaitingReason, BaseAiService, BaseConfig, BaseFileSystem, BufferedTaskOutputSource, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CMD_EXE_MAX_COMMAND_LINE, CORE_PLANNER_PROMPT, type CancelPlanningResponse, type CappedRows, CheckpointAnswer, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandClassification, type CommandDescriptor, CommandLineTooLongError, type CommandTier, type CommandsResponse, type ComposeOptions, ConsoleLogger, ContextCollector, type Continuability, ConversationBusyError, type ConversationCompactResponse, type ConversationCompaction, ConversationEditError, type ConversationFork, type ConversationForkResponse, ConversationMessage, type ConversationRequest, type ConversationRewind, type ConversationRewindResponse, type ConversationTurn, type ConversationVariant, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DEFAULT_MAX_PARALLEL, type DaemonErrorCode, DiscoveredModel, EmbeddedNewlineError, type EnvAdmission, EnvConfig, type ErrorBody, type ExecImpl, ExecutableNotFoundError, type ExecuteResponse, FindSymbolOptions, type ForceSendResponse, GIT_READONLY_SUBCOMMANDS, GREP_PCRE_PROBE_ARGS, GeminiService, type GeneratePlanResponse, type GitExecFn, GlobOptions, type GrepInvocation, GrepOptions, type GrepRegex, HARNESS_PLANNER_REASON, type HasBinFn, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IRunner, IRunnerSession, IWorktreeIsolation, type IsolationDiffResponse, IsolationHandoff, IsolationLandedTask, type IsolationMergeResponse, IsolationMergeResult, IsolationOutcome, IsolationRun, IsolationTaskRecord, IsolationTaskStatus, IsolationView, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, type LaunchDeps, type LaunchPlan, LegacyPlanState, type LiveOutputLookup, type LiveTail, type LiveTailOptions, type MappedTool, type MergeGateEntry, type MergeGateResponse, MergeGateView, ModelResolver, type ModelResolverDeps, type ModelsResponse, type ModifyPlanRequest, NoPlanError, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OUTPUT_LINES_DEFAULT, OUTPUT_LINES_MAX, type OkResponse, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, OrdewellMcpServer, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanIsolation, PlanParseError, type PlanRequest, type PlanResponse, PlanState, PlanStatus, PlanStore, Planner, type PlannerBackendEntry, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerSubmission, PlannerToolHandler, PlannerTurnDiscardedError, PlannerTurnStoppedError, type PlannerUsability, PlannerUsage, type PrdBlock, type PrdResponse, type PriorOutput, ProviderModelLists, type ProviderRegistration, QueuedMessage, QueuedTaskMessage, REFUSED_COMMANDS, ReadFileOpts, type RemoveMessageResponse, RepairEvidence, type RepairLoopOpts, type RepairVerdict, RepoGroupLayout, type ResearchChat, ResearchLogEntry, ResearchProgress, type ResearchShell, type ResearchShellDeps, ResearchToolType, type ResearchTurn, type ResolveConflictResponse, type RewindTarget, type RewindTargetsResponse, RunnerApprovals, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerManifest, RunnerModeInfo, RunnerRegistry, type RunnerSpawnOptions, type RunnersResponse, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STATE_DIR_IGNORE, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SaveSession, Session, SessionBroadcaster, type SessionData, type SessionDeps, type SessionListResponse, SessionMessage, type SessionMeta, SessionNotFoundError, SessionNotice, type SessionPlanner, type SessionResponse, type SessionRuntimeSettings, type SettingsResponse, SettingsService, type SettingsUpdateResponse, type ShellDialect, SkillInfo, type SkillInvocation, SkillLoad, SkillsService, type SpawnSpec, StdioAgentAdapter, type StopResponse, StructuredEvent, StructuredRunner, type StructuredRunnerDeps, StructuredSession, StructuredTurnEnd, SurfacePlan, SurfacePlanState, TASK_QUERY_ANSWER_MAX_CHARS, TASK_QUERY_ANSWER_OR_OPS, TASK_QUERY_FIELDS, TASK_QUERY_PROTOCOL, TASK_QUERY_REMINDER, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, type TaskAttemptSnapshot, TaskCompleteArgs, TaskControlError, TaskIsolation, type TaskLogAttemptsResponse, TaskLogEvent, type TaskLogFile, type TaskLogLocation, TaskLogRecorder, type TaskLogRecorderDeps, type TaskLogResponse, type TaskMessageResponse, TaskModeAgentAdapter, TaskOp, TaskOrchestrator, type TaskOrchestratorDeps, type TaskOrchestratorOptions, type TaskOutputSource, type TaskQuery, type TaskQueryCatalog, type TaskQueryField, TaskRunnerFlags, TaskSkillSnapshot, TaskSnapshot, TaskStartOptions, TaskTokenScope, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, TreeSnapshot, UsageRecord, type UserSettings, Verdict, VerdictEngine, type VerdictListener, WINDOWS_MAX_COMMAND_LINE, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, type WorkspacesResponse, type WorktreeIsolationDeps, abbreviateHome, admitSettingsEnv, applyHeadLimit, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConflictRepairPrompt, buildConflictResolutionPrompt, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildSplitPrompt, buildSubagentSystemPrompt, canContinue, clampThinkingEffort, classifyCommand, classifyPlannerReply, clearAugmentedPathCache, clearDaemonToken, clearResearchShellCache, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, composeContinuationPrompt, configuredProviders, continuability, createAiService, createSession, createTaskAdapter, createWorktreeIsolation, daemonTokenPath, defaultLogger, definitionPattern, deleteSession, describeMergeResult, discoverGeminiModels, effectiveAllowlist, ensureDir, ensurePrivateDir, ensureStateDirIgnored, executionLogBlock, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, globalDataDir, grantScopeFor, grepRegexFromProbe, idSegment, includeGlobFor, isCliProvider, isExecutableResolved, isOpenAiProvider, killTree, languageForId, listSessions, listTaskLogAttempts, loadSession, loadSessionPlanState, loadState, mapAgentTool, migrateOldConfigDir, migratePlanIsolation, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, openTaskLog, parseMaxParallel, parseTaskQueryJson, pendingEditRulesBlock, planDirectLaunch, plannerBackendEntries, plannerMessage, plannerTranscript, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, reEmitTaskQueryPrompt, readDaemonToken, readTaskLog, referencePattern, removedPluginNotice, renderPlanMap, renderPriorOutputs, renderTaskQueryAnswer, repairLoop, researchShellWarning, researchToolsPath, resolveProviderFromPrefix, resolveResearchShell, resolveSkillInvocation, resolveTaskRunnerFlags, resolveWithin, resubmitEditPrompt, resubmitPlanPrompt, retargetTaskRunner, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, sessionDataDir, sessionRuntimeSettings, stateExists, stripAnsi, stripModelPrefix, summarizeOutput, supportsTaskMode, taskOpsRejectedPrompt, taskQuerySignature, textHasTaskQuery, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, windowsCommandLine, withPath, writePrivateFile };
+export { ALL_PROVIDERS, AbstractRunner, AbstractRunnerSession, ActiveTaskSession, type AdoptSessionResponse, type Adr0013IsolationRun, type Adr0013PlanIsolation, type Adr0013TaskRecord, AgentAdapter, AgentEvent, AgentProcessDeps, AgentStartOptions, AiProvider, AlreadyExecutingError, ApplyTaskOpsResult, ApprovalAnswer, type ApprovalAnswerResponse, ApprovalDecision, ApprovalModeSetting, ApprovalPolicy, ApprovalRequest, type ApprovalsResponse, type AskOptions, AwaitingReason, BaseAiService, BaseConfig, BaseFileSystem, BufferedTaskOutputSource, CLAUDE_CODE_MANIFEST, CLI_PROVIDERS, CMD_EXE_MAX_COMMAND_LINE, CORE_PLANNER_PROMPT, type CachedPage, type CancelPlanningResponse, type CappedRows, CheckpointAnswer, type CheckpointListener, ClaudeCodeAdapter, CliAgentAiService, type CliAgentAiServiceDeps, CodexAdapter, type CommandDescriptor, CommandLineTooLongError, type CommandsResponse, type ComposeOptions, ConsoleLogger, ContextCollector, type Continuability, ConversationBusyError, type ConversationCompactResponse, type ConversationCompaction, ConversationEditError, type ConversationFork, type ConversationForkResponse, ConversationMessage, type ConversationRequest, type ConversationRewind, type ConversationRewindResponse, type ConversationTurn, type ConversationVariant, DAEMON_SUBPROTOCOL, DAEMON_TOKEN_SUBPROTOCOL_PREFIX, DEFAULT_MAX_PARALLEL, DEFAULT_WEB_READ_BUDGET, type DaemonErrorCode, type DecideOptions, DiscoveredModel, DuckDuckGoSearchProvider, EmbeddedNewlineError, type EnvAdmission, EnvConfig, type ErrorBody, type ExecImpl, ExecutableNotFoundError, type ExecuteResponse, FindSymbolOptions, type ForceSendResponse, GREP_PCRE_PROBE_ARGS, GeminiService, type GeneratePlanResponse, type GitExecFn, GlobOptions, type GrepInvocation, GrepOptions, type GrepRegex, HARNESS_PLANNER_REASON, type HasBinFn, HttpWebFetcher, type HttpWebFetcherOptions, type IAiService, IApproval, IConfig, IFileSystem, type ILogger, type INotification, IRunner, IRunnerSession, type ISearchProvider, IWorktreeIsolation, type IsolationDiffResponse, IsolationHandoff, IsolationLandedTask, type IsolationMergeResponse, IsolationMergeResult, IsolationOutcome, IsolationRun, IsolationTaskRecord, IsolationTaskStatus, IsolationView, JSON_REPAIR_INSTRUCTION, type KillTreeDeps, type LaunchDeps, type LaunchPlan, LegacyPlanState, type LiveOutputLookup, type LiveTail, type LiveTailOptions, type MappedTool, type MergeGateEntry, type MergeGateResponse, MergeGateView, ModelResolver, type ModelResolverDeps, type ModelsResponse, type ModifyPlanRequest, NoPlanError, type NotificationAction, OPENCODE_MANIFEST, ORDEWELL_SETTABLE_ENV, OUTPUT_LINES_DEFAULT, OUTPUT_LINES_MAX, type OkResponse, OpenAiService, OpenCodeAdapter, type OrchestratorObserver, OrchestratorOption, OrdewellMcpServer, PROVIDER_CREDENTIAL_ENV, PROVIDER_DETECT_PRIORITY, PROVIDER_LABEL, PROVIDER_PRIORITY, PROVIDER_SHORT_LABEL, type PendingApproval, PendingApprovals, type PendingApprovalsOptions, PlanEditError, PlanIsolation, PlanParseError, type PlanRequest, type PlanResponse, PlanState, PlanStatus, PlanStore, Planner, type PlannerBackendEntry, type PlannerModelCandidate, type PlannerModelChoice, PlannerModelMemory, type PlannerModelRecall, type PlannerModelStore, type PlannerReplyClassification, type PlannerSubmission, PlannerToolHandler, PlannerTurnDiscardedError, PlannerTurnStoppedError, type PlannerUsability, PlannerUsage, type PrdBlock, type PrdResponse, type PriorOutput, ProviderModelLists, type ProviderRegistration, QueuedMessage, QueuedTaskMessage, ReadFileOpts, type RemoveMessageResponse, RepairEvidence, type RepairLoopOpts, type RepairVerdict, RepoGroupLayout, type ResearchChat, ResearchLogEntry, ResearchProgress, ResearchShell, ResearchToolType, type ResearchTurn, type ResolveConflictResponse, type RewindTarget, type RewindTargetsResponse, RunnerApprovals, type RunnerCatalog, RunnerId, RunnerInstallation, RunnerManifest, RunnerModeInfo, RunnerRegistry, type RunnerSpawnOptions, type RunnersResponse, SETTINGS_ENV_ALLOWLIST, SETTINGS_ENV_REFUSED, STATE_DIR, STATE_DIR_IGNORE, STOPPED_TOOL_RESULT, SYMBOL_LANGUAGES, type SaveSession, type SearchHit, type SearchOutcome, type SearchPage, type SearchTransport, Session, SessionBroadcaster, type SessionData, type SessionDeps, type SessionListResponse, SessionMessage, type SessionMeta, SessionNotFoundError, SessionNotice, type SessionPlanner, type SessionResponse, type SessionRuntimeSettings, type SettingsResponse, SettingsService, type SettingsUpdateResponse, SkillInfo, type SkillInvocation, SkillLoad, SkillsService, type SpawnSpec, StdioAgentAdapter, type StopResponse, StructuredEvent, StructuredRunner, type StructuredRunnerDeps, StructuredSession, StructuredTurnEnd, SurfacePlan, SurfacePlanState, TASK_QUERY_ANSWER_MAX_CHARS, TASK_QUERY_ANSWER_OR_OPS, TASK_QUERY_FIELDS, TASK_QUERY_PROTOCOL, TASK_QUERY_REMINDER, TRUNCATED_PLAN_REPAIR_INSTRUCTION, Task, type TaskAttemptSnapshot, TaskCompleteArgs, TaskControlError, TaskIsolation, type TaskLogAttemptsResponse, TaskLogEvent, type TaskLogFile, type TaskLogLocation, TaskLogRecorder, type TaskLogRecorderDeps, type TaskLogResponse, type TaskMessageResponse, TaskModeAgentAdapter, TaskOp, TaskOrchestrator, type TaskOrchestratorDeps, type TaskOrchestratorOptions, type TaskOutputSource, type TaskQuery, type TaskQueryCatalog, type TaskQueryField, TaskRunnerFlags, TaskSkillSnapshot, TaskSnapshot, TaskStartOptions, TaskTokenScope, type TokenCarriers, type ToolCall, ToolOutcome, type ToolResult, TreeSnapshot, UsageRecord, type UserSettings, Verdict, VerdictEngine, type VerdictListener, WINDOWS_MAX_COMMAND_LINE, type WebRead, type WebReadDecision, type WebResponse, WebResponseCache, type WebResponseCacheOptions, type WebTransport, type WorkspaceCheckDeps, WorkspaceNotAProjectError, WorkspaceNotFoundError, type WorkspaceProjectCheckDeps, type WorkspacesResponse, type WorktreeIsolationDeps, abbreviateHome, admitSettingsEnv, applyHeadLimit, assertWorkspaceExists, assertWorkspaceIsProject, augmentPromptWithPriorOutputs, augmentedPath, bearerHeaderValue, buildConflictRepairPrompt, buildConflictResolutionPrompt, buildConversationSystemPrompt, buildFallbackGrepArgs, buildGlobArgs, buildGrepArgs, buildMergePrompt, buildModifyDuringExecutionPrompt, buildModifyPlanPrompt, buildPlanWithResults, buildResearchPrompt, buildResearchToolsPrompt, buildSplitPrompt, buildSubagentSystemPrompt, canContinue, clampThinkingEffort, classifyPlannerReply, clearAugmentedPathCache, clearDaemonToken, clearState, clipboardCopyCommand, coerceAssignments, collectDirectDependencyOutputs, composeAugmentedPrompt, composeContinuationPrompt, configuredProviders, continuability, createAiService, createSession, createTaskAdapter, createWorktreeIsolation, daemonTokenPath, defaultLogger, definitionPattern, deleteSession, describeMergeResult, discoverGeminiModels, effectiveAllowlist, ensureDir, ensurePrivateDir, ensureStateDirIgnored, executionLogBlock, extractPrdBlock, extractPresentedToken, filterFallbackByAnchoredInclude, filterModelsForPrompt, formatSearchOutput, generatePlanWithRepair, getLatestSession, getProviderMeta, getSettingsPath, getStateDir, globalDataDir, grantScopeFor, grepRegexFromProbe, idSegment, includeGlobFor, isCliProvider, isExecutableResolved, isOpenAiProvider, killTree, languageForId, listSessions, listTaskLogAttempts, loadSession, loadSessionPlanState, loadState, looksLikeChallenge, mapAgentTool, migrateOldConfigDir, migratePlanIsolation, mintDaemonToken, mintSessionId, modelContextBlock, modifyValidationFeedback, normalizeAgentArgs, normalizeGeminiModel, openTaskLog, parseMaxParallel, parseSearchHits, parseTaskQueryJson, pendingEditRulesBlock, planDirectLaunch, plannerBackendEntries, plannerMessage, plannerTranscript, prefixModelId, providerForRunner, reEmitPlanPrompt, reEmitTaskOpsPrompt, reEmitTaskQueryPrompt, readDaemonToken, readTaskLog, referencePattern, removedPluginNotice, renderPlanMap, renderPriorOutputs, renderTaskQueryAnswer, repairLoop, resolveProviderFromPrefix, resolveSkillInvocation, resolveTaskRunnerFlags, resolveWithin, resubmitEditPrompt, resubmitPlanPrompt, retargetTaskRunner, runnerAssignment, runnerForProvider, sanitizeSlug, savePrdMarkdown, saveSession, saveState, sessionDataDir, sessionRuntimeSettings, sharedSearchProvider, sharedWebResponseCache, stateExists, stripAnsi, stripModelPrefix, summarizeOutput, supportsTaskMode, taskOpsRejectedPrompt, taskQuerySignature, textHasTaskQuery, tokenSubprotocols, tokensMatch, truncatedPlanReEmitPrompt, wellKnownBinDirs, windowsCommandLine, withPath, writePrivateFile };