@ordewell/core 0.9.0 → 0.10.0

package/dist/{IRunner-BiQio8gJ.d.ts → IRunner-C7_SSpzG.d.ts}

@@ -1,5 +1,5 @@
 import { ChildProcess } from 'child_process';
-import { ao as UsageRecord, a8 as SubagentOutcome, W as RunnerId, ag as TaskSkillSnapshot } from './Task-1Q19y7sZ.js';
+import { ao as UsageRecord, aa as SubagentOutcome, $ as RunnerId, aj as TaskSkillSnapshot } from './Task-CxwnCJLi.js';
 import { z } from 'zod/v4';
 
 /**
@@ -20,7 +20,7 @@ import { z } from 'zod/v4';
  *   - an **MCP tool rule**, `mcp:find-*`: a glob over the tool's own name,
  *     without the server, case-insensitive.
  *   - a **scope pattern**, anything starting with `/`, `~`, `http://`,
- *     `https://`, `mcp__` or a drive letter: matched against an approval's
+ *     `https://`, `web_search:`, `mcp__`, `mcp-server:` or a drive letter: matched against an approval's
  *     scope as ADR-0008 always matched pre-approved entries, `*` matching any
  *     run of characters.
  *
@@ -74,6 +74,290 @@ declare function scopeAllowed(list: PlannerAllowlist, scope: string): boolean;
  */
 declare const DEFAULT_PLANNER_ALLOWLIST: readonly string[];
 
+/**
+ * Which interpreter runs the planner's `bash` tool, and in which language.
+ *
+ * `AUTO_COMMANDS` — the read-only tier that runs with no prompt — is `ls`, `cat`,
+ * `wc`, `head`, `tail`, `du`, `df`, `file`, `sort`, `uniq`, `basename`, `find`,
+ * `grep`. That set is POSIX, and passing it to `shell: true` on Windows means
+ * cmd.exe, where most of those names do not exist and `find` is an unrelated
+ * program that returns plausible wrong output instead of an error. The planner's
+ * whole research surface degraded to guessing, quietly.
+ *
+ * Rather than write a Windows dialect of every research command — a second
+ * behavior to keep in step forever — this finds a POSIX shell to run the
+ * existing ones in. Git for Windows ships a full one, and git is already a
+ * prerequisite for everything Ordewell does, so in practice it is there. Failing
+ * that, cmd.exe is used and the classifier is told so, because the one thing
+ * that must never happen is classifying a command in one language and running it
+ * in another: `commandPolicy` reads {@link ResearchShell.dialect} for exactly
+ * that reason.
+ *
+ * POSIX resolves to `{ file: null }`, meaning "use `shell: true`" — byte for
+ * byte what the adapters did before this module existed.
+ *
+ * Windows paths are built with `path.win32` explicitly, not the host-flavoured
+ * `path`, so the probe is the same on a Windows host as it is under a Linux
+ * test runner.
+ */
+type ShellDialect = 'posix' | 'cmd';
+interface ResearchShell {
+    /**
+     * Executable that takes a command string, or null to use the host default
+     * via `shell: true`.
+     */
+    file: string | null;
+    /** Arguments preceding the command string. */
+    args: string[];
+    /** The language the command string will be interpreted in. */
+    dialect: ShellDialect;
+    /**
+     * Directory holding this shell's POSIX utilities, when it brings its own.
+     * Prepended to PATH for the search subprocesses (`grep`, `tree`) that
+     * `execFile` starts without a shell, so they resolve too.
+     */
+    utilsDir: string | null;
+}
+interface ResearchShellDeps {
+    platform?: NodeJS.Platform;
+    exists?: (candidate: string) => boolean;
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * The shell the planner's `bash` tool should use on this host. Resolved once per
+ * process — the answer cannot change while Ordewell runs, and the probe costs a
+ * handful of `stat` calls.
+ */
+declare function resolveResearchShell(deps?: ResearchShellDeps): ResearchShell;
+/** Test seam: drop the per-process cache so the next call re-probes. */
+declare function clearResearchShellCache(): void;
+/**
+ * PATH for the search subprocesses the adapters start without a shell, with the
+ * research shell's own utilities in front. Without this, `grep` — the fallback
+ * when ripgrep is absent — is unresolvable on a Windows box even when a
+ * perfectly good `grep.exe` sits in the Git tree beside the shell.
+ */
+declare function researchToolsPath(shell: ResearchShell, basePath: string | undefined): string;
+/**
+ * A message explaining a degraded research surface, or null when there is
+ * nothing to explain. Surfaced by the adapters on the first refused command so
+ * the limitation is visible rather than inferred from bad answers.
+ */
+declare function researchShellWarning(shell: ResearchShell): string | null;
+
+/**
+ * Tiered classification for the planner's `bash` tool.
+ *
+ * The planner is a read-only researcher: it never edits files, and the runners
+ * do the real work. But research legitimately means running things — querying a
+ * cloud control plane (`az`, `gh`), reproducing a failure (`npm test`), or
+ * shaping output (`jq`). The old allowlist refused all of that, so the model's
+ * only escape was to guess.
+ *
+ * Three tiers replace the flat allowlist:
+ *
+ *   auto    read-only inspection — runs with no prompt (the historical list)
+ *   ask     anything else that is not obviously destructive — one approval,
+ *           remembered for the rest of the session at `scope` granularity
+ *   refuse  writes, privilege escalation, and anything that would smuggle
+ *           arbitrary code past this classifier — never runs, never prompts
+ *
+ * `refuse` is deliberately not promptable. A planner that can `rm` is a planner
+ * that can silently break the workspace it was asked to reason about, and the
+ * architecture already says mutation belongs to the runners.
+ *
+ * Classification walks every segment of the command line (pipes, `&&`, `;`, and
+ * command substitution) rather than matching substrings against the raw string.
+ * The old substring denylist both over-matched (`ls docs/removed` tripped `rm`)
+ * and under-matched (`$(rm -rf /)` was invisible once chaining was allowed).
+ *
+ * A segment is classified by the command that will actually execute, not by the
+ * name at the front of it: wrappers are unwrapped first, recursively, so
+ * `timeout 10 env nice rm -rf x` is an `rm`. See {@link WRAPPER_FAMILY}. A
+ * runner that feeds its command arguments nobody can see is unwrapped the same
+ * way but never runs unprompted ({@link XARGS_TARGETS}), and one that hands its
+ * command to a shell is refused ({@link REFUSED_RUNNERS}).
+ *
+ * A permitted binary is permitted with the flags it is known to be read-only
+ * with, not with any flag at all: several of them will run a helper program or
+ * write a file when asked to, so `auto` is a per-binary flag allowlist and an
+ * unrecognised flag is refused. See {@link FLAG_POLICY}.
+ *
+ * The lexer is dialect-aware, because the interpreter that will actually run
+ * the command decides what the tokens are, and getting that wrong is not a
+ * cosmetic error here — it is the difference between classifying what runs and
+ * classifying something else. See {@link Dialect}.
+ */
+
+/**
+ * `env` is deliberately absent. Given a command it is a wrapper, classified by
+ * what it actually runs (see {@link WRAPPER_FAMILY}); given none it prints the
+ * whole process environment — provider credentials included — into the research
+ * log, which is a disclosure the developer should get to see coming.
+ *
+ * Membership here is necessary but not sufficient: every name in this list also
+ * declares the flags it is read-only with in {@link FLAG_POLICY}.
+ */
+declare const AUTO_COMMANDS: string[];
+/**
+ * `ls-remote` is deliberately absent, and it is the one entry here that is
+ * read-only against the repository. It reaches the network: it contacts
+ * whatever host the named remote or URL resolves to, which routes around the
+ * web fetcher's per-origin approval and its request-forgery guard. So it
+ * prompts rather than running silently.
+ *
+ * Prompting only became the right answer once {@link scopeFor} widened. Under
+ * the old scope it would have been remembered as `git ls-remote`, so one
+ * approval of the workspace's own remote would have authorised a listing
+ * against any host at all — which is the same hole with an approval dialog in
+ * front of it. The scope now carries the destination.
+ */
+declare const GIT_READONLY_SUBCOMMANDS: string[];
+/**
+ * Never runs, with or without approval.
+ *
+ * The `cmd.exe` builtins at the end matter as much as the POSIX names above
+ * them. `del`, `rd`, `move`, and friends mutate exactly what `rm` and `mv` do,
+ * and on Windows they are what a model reaches for — so without them the whole
+ * refusal tier was bypassable on that platform by writing the command the way
+ * the platform spells it. Listed unconditionally rather than per-platform: a
+ * POSIX box has no `del` to refuse, so the extra names cost nothing there.
+ */
+declare const REFUSED_COMMANDS: string[];
+/**
+ * Options threaded through classification.
+ *
+ * `dialect` is keyed to the interpreter rather than the OS on purpose: a Windows
+ * host that has Git Bash runs the planner's commands in a POSIX shell (see
+ * {@link resolveResearchShell}), and classifying those under cmd.exe rules
+ * would be the same mismatch in the other direction. Callers pass the dialect of
+ * the shell they are actually going to use; omitting it falls back to the host
+ * default.
+ */
+interface CommandPolicyOptions {
+    dialect?: ShellDialect;
+    /** Only flags generated from vetted DNS answers by BaseFileSystem, never caller input. */
+    trustedWebResolves?: ReadonlySet<string>;
+    autonomous?: boolean;
+    approvalMode?: 'ask' | 'allow' | 'deny';
+    /**
+     * `CDPATH` is set in the environment the command will run in. A relative
+     * `cd` may then land in a directory the command line never names, so `cd`
+     * stops being navigation the classifier can follow.
+     */
+    cdpathSet?: boolean;
+    /** The planner's standing approvals (ADR-0026); an `ask` command they cover carries {@link CommandClassification.allowedBy}. */
+    allow?: PlannerAllowlist;
+}
+type CommandTier = 'auto' | 'ask' | 'refuse';
+interface CommandClassification {
+    tier: CommandTier;
+    /** A human must approve this invocation even when its origin was already granted. */
+    perInvocation?: boolean;
+    /** Separate grants for commands that name several origins. */
+    scopes?: string[];
+    webUrls?: URL[];
+    webOutboundTexts?: string[];
+    /** What a grant covers, for `ask`. Derived from the non-auto segments only. */
+    scope: string;
+    /** Populated for `refuse`: why, in a sentence the model can act on. */
+    reason?: string;
+    /** For `ask`: the allowlist rule that pre-approves every part of the command that needed asking. */
+    allowedBy?: string;
+}
+/**
+ * Classify one command line. Output redirection is refused outright unless the
+ * target provably writes nothing — `/dev/null`, or an fd duplication like
+ * `2>&1` — since a planner that writes files has stopped being a planner.
+ */
+declare function classifyCommand(command: string, opts?: CommandPolicyOptions): CommandClassification;
+
+/**
+ * Decides whether one out-of-envelope capability may run, and remembers the
+ * answer for the rest of the session.
+ *
+ * Grants are keyed on {@link ApprovalRequest.scope}, never on the concrete
+ * subject: approving a read of `/tmp/foo/a.log` grants `/tmp/foo/*`, and
+ * approving `az group list` grants `az group list`. Without that, a planner
+ * doing real research would prompt on every single call and the feature would
+ * be unusable.
+ *
+ * `mode` is the policy floor:
+ *   ask     consult the human channel; no channel means deny (headless, web)
+ *   allow   grant everything the tier system did not already refuse
+ *   deny    grant nothing beyond `preApproved` — the allowlist-only mode
+ *
+ * Note the ordering: `preApproved` is honored under every mode including
+ * `deny`, because it is an explicit operator decision rather than a default.
+ * Its entries are allowlist rules (see `plannerAllowlist.ts`), and both it and
+ * `mode` may be read afresh on every request, so a settings change applies to
+ * the next call.
+ */
+type ApprovalMode = 'ask' | 'allow' | 'deny';
+/**
+ * The configured mode. `auto` follows the autonomy level (ADR-0026): Guarded
+ * asks, Full runs the allowlist alone and asks nobody, so a planner in Full
+ * never waits on a person and never acts outside its standing approvals.
+ * Web reads are the exception at both levels.
+ */
+type ApprovalModeSetting = ApprovalMode | 'auto';
+declare function effectiveApprovalMode(setting: ApprovalModeSetting, autonomous: boolean, kind?: ApprovalKind): ApprovalMode;
+/** A configured mode as written: `allowlist` is the user-facing name of `deny`, and anything unknown is `auto`. */
+declare function parseApprovalModeSetting(raw: string | undefined): ApprovalModeSetting;
+interface ApprovalPolicyOptions {
+    /** Read per request, for the kind being asked about. */
+    mode?: ApprovalMode | ((kind: ApprovalKind) => ApprovalMode);
+    autonomous?: () => boolean;
+    /** Allowlist entries granted up front from config (ADR-0026). */
+    preApproved?: readonly string[] | (() => readonly string[]);
+    /** The human channel. Absent means there is nobody to ask. */
+    ask?: (req: ApprovalRequest) => Promise<boolean>;
+    /** Called whenever a decision is reached, for surfacing in a UI or a log. */
+    onDecision?: (req: ApprovalRequest, granted: boolean, source: ApprovalSource) => void;
+}
+/**
+ * Why a request was decided as it was. The next four are refusals reached
+ * before the policy itself is consulted (ADR-0027's web-read guards), handed
+ * to {@link ApprovalPolicy.record} so they surface like any other decision:
+ * an `!` allowlist exclusion, the scheme and SSRF guard, the outbound secret
+ * check, and the per-turn web-read budget. `unsupported` comes after: an
+ * approved project MCP server the planner's runner version cannot give the
+ * planner as tools of their own (ADR-0028).
+ */
+type ApprovalSource = 'pre-approved' | 'remembered' | 'mode' | 'asked' | 'no-channel' | 'excluded' | 'guard' | 'secret' | 'budget' | 'unsupported';
+declare class ApprovalPolicy implements IApproval {
+    private readonly modeOf;
+    private readonly autonomousOf;
+    private readonly entriesOf;
+    private parsed;
+    private readonly asker?;
+    private readonly onDecision?;
+    private readonly granted;
+    private readonly refused;
+    /** One in-flight ask per scope: a parallel tool round must not prompt twice for the same thing. */
+    private readonly inFlight;
+    private generation;
+    constructor(opts?: ApprovalPolicyOptions);
+    request(req: ApprovalRequest): Promise<boolean>;
+    commandPolicy(): Pick<CommandPolicyOptions, 'autonomous' | 'approvalMode'>;
+    /**
+     * What `request` would answer without a person, for a caller that may never
+     * prompt (a research subagent): the same standing grants, remembered
+     * refusals and mode the interactive path uses, stopping at `ask`.
+     */
+    peek(req: ApprovalRequest): StandingDecision;
+    private standing;
+    /** Report a decision a guard reached before this policy was asked. */
+    record(req: ApprovalRequest, granted: boolean, source: ApprovalSource): void;
+    grantsUnasked({ kind, scope }: Pick<ApprovalRequest, 'kind' | 'scope'>): boolean;
+    /** The standing approvals, parsed from the entries in force now. */
+    allowlist(): PlannerAllowlist;
+    /** Scopes the user has granted this session — for display and for persistence. */
+    grantedScopes(): string[];
+    /** Drop every session-scoped decision. Called on session reset. */
+    reset(): void;
+}
+
 /**
  * The planner's single approval seam. Every capability that reaches beyond the
  * default read-only, in-workspace envelope — a path outside the workspace root,
@@ -91,11 +375,17 @@ declare const DEFAULT_PLANNER_ALLOWLIST: readonly string[];
  * for an answer as long as it takes, and never passes through the planner's
  * policy — the runner's mode already decided it needed asking. `mcp_tool` is
  * a harness planner reaching for an MCP tool the user configured (ADR-0026),
- * scoped to that one tool.
+ * scoped to that one tool. `web_search` is scoped to the search provider, the
+ * party that receives every query (ADR-0027). `mcp_server` is starting an MCP
+ * server the repository declares for a planner, scoped to its definition
+ * (ADR-0028). `task_start` is the planner asking to start work through the
+ * command seam in Guarded (ADR-0029), asked afresh every time.
  */
-type ApprovalKind = 'external_path' | 'shell_command' | 'url_fetch' | 'mcp_tool' | 'runner_tool';
+type ApprovalKind = 'external_path' | 'shell_command' | 'url_fetch' | 'web_search' | 'mcp_tool' | 'mcp_server' | 'runner_tool' | 'task_start';
 interface ApprovalRequest {
     kind: ApprovalKind;
+    /** Credentials, data and redirects need a fresh human answer for each invocation. */
+    perInvocation?: boolean;
     /** The concrete thing being asked about: an absolute path, a command line, a URL. */
     subject: string;
     /**
@@ -143,10 +433,32 @@ declare function toApprovalDecision(answer: ApprovalAnswer): ApprovalDecision;
 declare function isGranted(decision: ApprovalDecision): boolean;
 declare function approvalScopes(request: ApprovalRequest): string[];
 declare function isRunnerApproval(request: ApprovalRequest): boolean;
+type StandingDecision = {
+    decision: 'allow' | 'deny';
+    source: 'pre-approved' | 'remembered' | 'mode';
+} | {
+    decision: 'deny';
+    source: 'excluded';
+} | {
+    decision: 'ask';
+    source: 'no-channel';
+};
 interface IApproval {
     request(req: ApprovalRequest): Promise<boolean>;
     /** The standing approvals a command is classified against, when this approval has any (ADR-0026). */
     allowlist?(): PlannerAllowlist;
+    commandPolicy?(): Pick<CommandPolicyOptions, 'autonomous' | 'approvalMode'>;
+    /** Surface a decision reached before `request` was called, as `request`'s own are. */
+    record?(req: ApprovalRequest, granted: boolean, source: ApprovalSource): void;
+    /**
+     * Resolve a request without a person (ADR-0027): `allow` when it is already
+     * granted or the mode allows without asking, `deny` when a refusal is
+     * remembered or the mode forbids, `ask` when it would still need a prompt. A
+     * background research subagent never prompts, so `ask` means refused.
+     */
+    peek?(req: ApprovalRequest): StandingDecision;
+    /** Whether `request` would grant this scope now without asking anyone. Nothing is asked or recorded. */
+    grantsUnasked?(req: Pick<ApprovalRequest, 'kind' | 'scope'>): boolean;
 }
 /** Denies everything. The safe default when a surface wires no approval channel. */
 declare const DENY_ALL: IApproval;
@@ -179,6 +491,12 @@ declare const listModelsInput: z.ZodObject<{
 declare const runCommandInput: z.ZodObject<{
     command: z.ZodString;
 }, z.core.$strip>;
+declare const fetchInput: z.ZodObject<{
+    url: z.ZodString;
+}, z.core.$strip>;
+declare const webSearchInput: z.ZodObject<{
+    query: z.ZodString;
+}, z.core.$strip>;
 declare const loadSkillInput: z.ZodObject<{
     name: z.ZodString;
 }, z.core.$strip>;
@@ -189,8 +507,8 @@ declare const submitPlanInput: z.ZodObject<{
         title: z.ZodString;
         description: z.ZodOptional<z.ZodString>;
         type: z.ZodOptional<z.ZodEnum<{
-            ai: "ai";
             user: "user";
+            ai: "ai";
         }>>;
         dependencies: z.ZodOptional<z.ZodArray<z.ZodString>>;
         prompt: z.ZodOptional<z.ZodString>;
@@ -204,7 +522,7 @@ declare const submitPlanInput: z.ZodObject<{
             modelLabel: z.ZodOptional<z.ZodString>;
             thinkingEffort: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>>;
-        taskMode: z.ZodOptional<z.ZodString>;
+        readOnly: z.ZodOptional<z.ZodBoolean>;
         autonomy: z.ZodOptional<z.ZodEnum<{
             AFK: "AFK";
             HITL: "HITL";
@@ -264,20 +582,91 @@ declare const taskQueryInput: z.ZodObject<{
     catalog: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 declare const taskOutputInput: z.ZodObject<{
+    attempt: z.ZodOptional<z.ZodNumber>;
+    kinds: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        text: "text";
+        error: "error";
+        command: "command";
+        thinking: "thinking";
+        task_skills: "task_skills";
+        turn_start: "turn_start";
+        command_output: "command_output";
+        compaction: "compaction";
+        runner_loaded: "runner_loaded";
+        turn_end: "turn_end";
+        text_delta: "text_delta";
+        thinking_delta: "thinking_delta";
+        tool_call: "tool_call";
+        tool_result: "tool_result";
+        subagent_started: "subagent_started";
+        subagent_finished: "subagent_finished";
+        usage: "usage";
+        message_queued: "message_queued";
+        message_removed: "message_removed";
+        message_undelivered: "message_undelivered";
+        message_handed_over: "message_handed_over";
+        message_delivered: "message_delivered";
+        approval_requested: "approval_requested";
+        approval_decided: "approval_decided";
+        approval_withdrawn: "approval_withdrawn";
+        runner_ended: "runner_ended";
+    }>>>;
+    task: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    lines: z.ZodOptional<z.ZodNumber>;
+    since: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+declare const taskDiffInput: z.ZodObject<{
     task: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    repo: z.ZodOptional<z.ZodString>;
+    path: z.ZodOptional<z.ZodString>;
     lines: z.ZodOptional<z.ZodNumber>;
     since: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
+declare const runPlanInput: z.ZodObject<{}, z.core.$strip>;
+declare const oneTaskInput: z.ZodObject<{
+    task: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+}, z.core.$strip>;
+declare const retryTaskInput: z.ZodObject<{
+    task: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    from: z.ZodEnum<{
+        fresh: "fresh";
+        session: "session";
+    }>;
+    message: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const skipTaskInput: z.ZodObject<{
+    task: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    reason: z.ZodString;
+}, z.core.$strip>;
+declare const messageTaskInput: z.ZodObject<{
+    task: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    text: z.ZodString;
+}, z.core.$strip>;
+declare const answerApprovalInput: z.ZodObject<{
+    task: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    approval: z.ZodOptional<z.ZodString>;
+    answer: z.ZodString;
+    note: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 type TaskCompleteArgs = z.infer<typeof taskCompleteInput>;
 type CheckpointArgs = z.infer<typeof checkpointInput>;
 type ListRunnersArgs = z.infer<typeof listRunnersInput>;
 type ListModelsArgs = z.infer<typeof listModelsInput>;
 type LoadSkillArgs = z.infer<typeof loadSkillInput>;
 type RunCommandArgs = z.infer<typeof runCommandInput>;
+type FetchArgs = z.infer<typeof fetchInput>;
+type WebSearchArgs = z.infer<typeof webSearchInput>;
 type SubmitPlanArgs = z.infer<typeof submitPlanInput>;
 type EditPlanArgs = z.infer<typeof editPlanInput>;
 type TaskQueryArgs = z.infer<typeof taskQueryInput>;
 type TaskOutputArgs = z.infer<typeof taskOutputInput>;
+type TaskDiffArgs = z.infer<typeof taskDiffInput>;
+type RunPlanArgs = z.infer<typeof runPlanInput>;
+type OneTaskArgs = z.infer<typeof oneTaskInput>;
+type RetryTaskArgs = z.infer<typeof retryTaskInput>;
+type MessageTaskArgs = z.infer<typeof messageTaskInput>;
+type SkipTaskArgs = z.infer<typeof skipTaskInput>;
+type AnswerApprovalArgs = z.infer<typeof answerApprovalInput>;
 /** What a handler answers with. `isError` marks a refusal the caller should act on. */
 interface McpToolReply {
     text: string;
@@ -309,12 +698,24 @@ interface TaskToolHandler {
 interface PlannerToolHandler {
     loadSkill?: Run<LoadSkillArgs>;
     runCommand?: Run<RunCommandArgs>;
+    fetch?: Run<FetchArgs>;
+    webSearch?: Run<WebSearchArgs>;
     listRunners?: Run<ListRunnersArgs>;
     listModels?: Run<ListModelsArgs>;
     submitPlan?: Run<SubmitPlanArgs>;
     editPlan?: Run<EditPlanArgs>;
     taskQuery?: Run<TaskQueryArgs>;
     taskOutput?: Run<TaskOutputArgs>;
+    taskDiff?: Run<TaskDiffArgs>;
+    runPlan?: Run<RunPlanArgs>;
+    runTask?: Run<OneTaskArgs>;
+    stopTask?: Run<OneTaskArgs>;
+    stopRun?: Run<RunPlanArgs>;
+    retryTask?: Run<RetryTaskArgs>;
+    skipTask?: Run<SkipTaskArgs>;
+    messageTask?: Run<MessageTaskArgs>;
+    answerApproval?: Run<AnswerApprovalArgs>;
+    mergeAll?: Run<RunPlanArgs>;
 }
 interface McpTool<H> {
     name: string;
@@ -331,7 +732,19 @@ interface McpTool<H> {
 }
 /** The task tool whose call settles the attempt (ADR-0022, V1). */
 declare const TASK_COMPLETE_TOOL = "task_complete";
+/**
+ * How a task is told to end. It rides in the runner's instructions rather than
+ * in the first message: a runner compacts its own context and rewrites that
+ * message into a summary, while its instructions are re-applied whole.
+ */
+declare const TASK_COMPLETION_CONTRACT: string;
 declare const TASK_TOOLS: readonly McpTool<TaskToolHandler>[];
+/**
+ * The planner's execution tools (ADR-0029, #91): each call goes to the
+ * session's command seam, which checks it, asks the user where consent needs
+ * one, and records it. The API planner offers the same tools as its own.
+ */
+declare const PLANNER_EXECUTION_TOOLS: readonly McpTool<PlannerToolHandler>[];
 declare const PLANNER_TOOLS: readonly McpTool<PlannerToolHandler>[];
 
 /**
@@ -352,11 +765,19 @@ interface TaskTokenScope {
 }
 interface PlannerTokenScope {
     sessionId: string;
+    /**
+     * Planner tools this token neither lists nor serves, by their names on the
+     * server: the ones a runner carries natively instead (ADR-0027), which a
+     * model would otherwise pick over its own.
+     */
+    hidden?: readonly string[];
 }
 /** Where a runner reaches the server and what it presents there. Never put either half in a prompt. */
 interface McpCredential {
     url: string;
     token: string;
+    /** The planner tools the token hides ({@link PlannerTokenScope.hidden}), so the runner is told of and pre-allows only what it is served. */
+    hidden?: readonly string[];
 }
 declare class OrdewellMcpServer {
     private readonly grants;
@@ -370,6 +791,8 @@ declare class OrdewellMcpServer {
     get url(): string | undefined;
     issueTaskToken(scope: TaskTokenScope, handler?: TaskToolHandler): Promise<McpCredential>;
     issuePlannerToken(scope: PlannerTokenScope, handler?: PlannerToolHandler): Promise<McpCredential>;
+    /** Every token still good here: secrets the outbound check keeps out of a URL (ADR-0027). */
+    heldTokens(): string[];
     /** Refuse every later request carrying `token`, and abort the calls it has in flight. */
     revoke(token: string): void;
     dispose(): Promise<void>;
@@ -386,6 +809,8 @@ interface McpClientConfig {
     name: typeof ORDEWELL_MCP_SERVER_NAME;
     url: string;
     headers: Record<string, string>;
+    /** Planner tools the token hides: a runner must neither pre-allow nor mention them. */
+    hidden?: readonly string[];
 }
 /**
  * The one shape every runner adapter renders its own MCP configuration from.
@@ -407,6 +832,50 @@ interface OwnerOnlyFile {
  */
 declare function ownerOnlyConfigFile(fileName: string, contents: string): OwnerOnlyFile;
 
+/**
+ * One MCP server a repository declares. `definition` is the entry as
+ * Ordewell parsed it, in the runner's own shape: an approved server is
+ * handed to the runner as exactly this, never re-read from the file.
+ */
+interface ProjectMcpServer {
+    name: string;
+    /** The file that declares it, relative to the workspace. */
+    source: string;
+    transport: 'stdio' | 'remote';
+    /** What would run, as written: the command line, or the URL. */
+    target: string;
+    /** The variables it sets, or the headers it sends, by name. */
+    names: string[];
+    definition: Record<string, unknown>;
+}
+
+/**
+ * What a runner command is to the runner that offers it: a `builtin` of the
+ * harness itself (`/compact`, `/model`), a `skill`, or any other `command` —
+ * a user's or a project's custom command, an MCP prompt.
+ */
+type RunnerCommandKind = 'command' | 'skill' | 'builtin';
+/**
+ * One slash command a task's runner offers, as the runner itself reported it
+ * (#66). Ordewell transports it and records it; it never interprets one.
+ */
+interface RunnerCommand {
+    name: string;
+    description: string;
+    /** How the runner describes its arguments (`<model>`, `[name]`); absent when it takes none it names. */
+    argumentHint?: string;
+    kind: RunnerCommandKind;
+    /** Other names the runner answers to for the same command. */
+    aliases?: string[];
+}
+/** An MCP server a runner loaded for a task, and the state the runner reported it in. */
+interface RunnerMcpServer {
+    name: string;
+    status?: string;
+}
+/** The command `name` names, by its own name or an alias. */
+declare function findRunnerCommand(commands: readonly RunnerCommand[], name: string): RunnerCommand | undefined;
+
 /**
  * The harness-planner transport contract (ADR-0009).
  *
@@ -559,6 +1028,28 @@ type AgentEvent =
  | {
     type: 'error';
     message: string;
+}
+/**
+ * What the runner loaded for this process from the user's and the
+ * project's own setup (#66): its commands and skills, and its MCP servers.
+ * Once per process, as it starts its first turn.
+ */
+ | {
+    type: 'runner_loaded';
+    commands: RunnerCommand[];
+    mcpServers: RunnerMcpServer[];
+}
+/** The runner compacted its own context: asked to (`manual`) or on its own (`auto`). */
+ | {
+    type: 'compaction';
+    trigger: 'manual' | 'auto';
+    preTokens?: number;
+    postTokens?: number;
+}
+/** What a runner command that runs without the model printed, as the runner reported it. */
+ | {
+    type: 'command_output';
+    text: string;
 };
 /**
  * What a planner's permission request is for, read from the runner's own
@@ -575,12 +1066,25 @@ type PlannerAsk =
 } | {
     kind: 'fetch';
     url: string;
+}
+/**
+ * A search the runner carries itself, at `provider`; Ordewell decides it, it does not run it.
+ * `providerLabel` names that party in the approval.
+ */
+ | {
+    kind: 'search';
+    query: string;
+    provider: string;
+    providerLabel?: string;
 } | {
     kind: 'path';
     path: string;
     directory: boolean;
-} | {
+}
+/** `note` is why, for a tool the runner knows the planner must not use, in place of the envelope's generic refusal. */
+ | {
     kind: 'other';
+    note?: string;
 };
 interface AgentStartCommon {
     /** Workspace root. The agent works from here and, in read-only mode, cannot leave it. */
@@ -603,6 +1107,20 @@ interface PlannerStartOptions extends AgentStartCommon {
     effort?: string;
     /** The Ordewell MCP server to inject, pre-authorized (ADR-0022). Only for an adapter with {@link AgentAdapter.mcpAttached}. */
     mcp?: McpClientConfig;
+    /**
+     * Whether the runner's own search is on, for a runner whose search raises
+     * no permission request and is set on or off when its session starts
+     * (ADR-0027). Decided once, before the planner token is issued, so the
+     * tools the token serves and the session's config cannot disagree. Absent
+     * means off.
+     */
+    nativeSearch?: boolean;
+    /**
+     * The repository's own MCP servers this planner may start, as approved
+     * (ADR-0028). The runner is launched without the repository's config, so
+     * these are the only ones it gets, and each is handed over as parsed.
+     */
+    projectServers?: ProjectMcpServer[];
 }
 /**
  * What a runner manifest says the task's mode and effort mean (ADR-0001),
@@ -670,6 +1188,19 @@ interface AgentAdapter {
      * adapter that cannot inject the server at all, which cannot run tasks.
      */
     mcpAttached?(): Promise<boolean>;
+    /**
+     * The approved project servers (ADR-0028) this runner started but cannot
+     * give the planner as tools of their own, known once `start` resolved.
+     * Absent on an adapter that gives the planner every one it starts.
+     */
+    unusableProjectServers?(): ProjectMcpServer[];
+    /**
+     * Whether `abs`, already resolved on disk, is output this runner saved
+     * outside the workspace for this session and told its planner to read back
+     * (ADR-0032). The planner reads it as it reads the workspace. Absent on a
+     * runner that saves none.
+     */
+    savedOutput?(abs: string): boolean;
     /**
      * Answer an open `permission_request`. False when the id is not open — it
      * was answered, cancelled, or never asked. Absent on an adapter that leaves
@@ -694,8 +1225,11 @@ interface TaskModeAgentAdapter extends AgentAdapter {
      * for a planner and wrong for a task, which may report completion there.
      */
     onOutOfTurn?(listener: (event: AgentEvent) => void): void;
-    /** Registers a listener for the process ending, for any reason. Fires at most once. */
-    onProcessExit(listener: (code: number) => void): void;
+    /**
+     * Registers a listener for the process ending, for any reason. Fires at most
+     * once. `lastWords` is how it ended, with its stderr tail.
+     */
+    onProcessExit(listener: (code: number, lastWords?: string) => void): void;
     /**
      * Hand a message to the running turn, for the runner to show the model at
      * its next step boundary (ADR-0023, D1–D2). Resolves true once the runner
@@ -707,6 +1241,18 @@ interface TaskModeAgentAdapter extends AgentAdapter {
      */
     steer?(id: string, text: string): Promise<boolean>;
     answerPermission(id: string, decision: ApprovalDecision): boolean;
+    /**
+     * The slash commands the runner offers this session — its built-ins, the
+     * user's and the project's skills and custom commands (#66) — as it
+     * reported them. Empty until it has; absent on a runner that reports none.
+     */
+    commands?(): RunnerCommand[];
+    /**
+     * Run the runner's own command `name` as a turn, the way {@link send} runs
+     * a message: resolves when the turn ends. Absent on a runner whose
+     * commands cannot be invoked over its protocol.
+     */
+    invokeCommand?(name: string, args: string, onEvent: (event: AgentEvent) => void, signal?: AbortSignal): Promise<void>;
 }
 type SpawnFn = (command: string, args: string[], options: {
     env: NodeJS.ProcessEnv;
@@ -860,73 +1406,21 @@ interface RunnerMode {
     autonomous?: boolean;
     /** Marks this mode as the runner's conservative build mode — the resolved default when autonomous mode is OFF. */
     safe?: boolean;
+    /** Marks this mode as the runner's read-only mode — what a task the planner marks read-only runs in (ADR-0031). */
+    readOnly?: boolean;
+    /** The mode runs under an OS sandbox, so a host where the runner's sandbox cannot start cannot offer it. */
+    sandboxed?: boolean;
+    /**
+     * Why this mode cannot be used on this host. Set by the registry from a host
+     * probe, never by a manifest: a mode with a reason is listed, so the user is
+     * told, but never assigned, kept or run.
+     */
+    unavailable?: string;
 }
 interface RunnerEntry {
     manifest: RunnerManifest;
 }
 
-/**
- * Decides whether one out-of-envelope capability may run, and remembers the
- * answer for the rest of the session.
- *
- * Grants are keyed on {@link ApprovalRequest.scope}, never on the concrete
- * subject: approving a read of `/tmp/foo/a.log` grants `/tmp/foo/*`, and
- * approving `az group list` grants `az group list`. Without that, a planner
- * doing real research would prompt on every single call and the feature would
- * be unusable.
- *
- * `mode` is the policy floor:
- *   ask     consult the human channel; no channel means deny (headless, web)
- *   allow   grant everything the tier system did not already refuse
- *   deny    grant nothing beyond `preApproved` — the allowlist-only mode
- *
- * Note the ordering: `preApproved` is honored under every mode including
- * `deny`, because it is an explicit operator decision rather than a default.
- * Its entries are allowlist rules (see `plannerAllowlist.ts`), and both it and
- * `mode` may be read afresh on every request, so a settings change applies to
- * the next call.
- */
-type ApprovalMode = 'ask' | 'allow' | 'deny';
-/**
- * The configured mode. `auto` follows the autonomy level (ADR-0026): Guarded
- * asks, Full runs the allowlist alone and asks nobody, so a planner in Full
- * never waits on a person and never acts outside its standing approvals.
- */
-type ApprovalModeSetting = ApprovalMode | 'auto';
-declare function effectiveApprovalMode(setting: ApprovalModeSetting, autonomous: boolean): ApprovalMode;
-/** A configured mode as written: `allowlist` is the user-facing name of `deny`, and anything unknown is `auto`. */
-declare function parseApprovalModeSetting(raw: string | undefined): ApprovalModeSetting;
-interface ApprovalPolicyOptions {
-    mode?: ApprovalMode | (() => ApprovalMode);
-    /** Allowlist entries granted up front from config (ADR-0026). */
-    preApproved?: readonly string[] | (() => readonly string[]);
-    /** The human channel. Absent means there is nobody to ask. */
-    ask?: (req: ApprovalRequest) => Promise<boolean>;
-    /** Called whenever a decision is reached, for surfacing in a UI or a log. */
-    onDecision?: (req: ApprovalRequest, granted: boolean, source: ApprovalSource) => void;
-}
-type ApprovalSource = 'pre-approved' | 'remembered' | 'mode' | 'asked' | 'no-channel';
-declare class ApprovalPolicy implements IApproval {
-    private readonly modeOf;
-    private readonly entriesOf;
-    private parsed;
-    private readonly asker?;
-    private readonly onDecision?;
-    private readonly granted;
-    private readonly refused;
-    /** One in-flight ask per scope: a parallel tool round must not prompt twice for the same thing. */
-    private readonly inFlight;
-    private generation;
-    constructor(opts?: ApprovalPolicyOptions);
-    request(req: ApprovalRequest): Promise<boolean>;
-    /** The standing approvals, parsed from the entries in force now. */
-    allowlist(): PlannerAllowlist;
-    /** Scopes the user has granted this session — for display and for persistence. */
-    grantedScopes(): string[];
-    /** Drop every session-scoped decision. Called on session reset. */
-    reset(): void;
-}
-
 interface CatalogModel {
     id: string;
     name: string;
@@ -1102,6 +1596,8 @@ interface IConfig {
     approvalPreApproved: string[];
     /** Whether the built-in allowlist of read-only command families and MCP tools applies. */
     approvalDefaults: boolean;
+    /** How many fetches and searches one planner turn may make (ADR-0027). User-only, like the approval settings. */
+    webReadBudget: number;
     /** Get the base URL for an OpenAI-compatible provider. */
     getProviderBaseUrl(provider: AiProvider): string;
     /** Get the API key for a provider. */
@@ -1116,6 +1612,9 @@ declare function enabledRunners(cfg: IConfig): RunnerId[];
 
 declare class RunnerRegistry {
     private readonly runners;
+    private readonly unavailableModes;
+    /** Mark modes of a runner unusable on this host, by mode id and reason; an empty record clears them. */
+    setUnavailableModes(id: string, reasons: Record<string, string>): void;
     get(id: string): RunnerEntry | undefined;
     getManifest(id: string): RunnerManifest | undefined;
     list(): RunnerEntry[];
@@ -1125,6 +1624,11 @@ declare class RunnerRegistry {
 
 /** How a structured turn ended. `failed` carries the agent's own words in the preceding `error` event. */
 type StructuredTurnEnd = 'completed' | 'interrupted' | 'failed';
+/**
+ * Who sent a task message that is not the user's: Ordewell itself, for the
+ * completion reminder (ADR-0018, W1). Absent means the user.
+ */
+type TaskMessageFrom = 'ordewell';
 /**
  * One normalized event from a structured task (ADR-0018, O1b): the adapter's
  * events, with the turn made explicit at both ends and the message queue (M1)
@@ -1136,13 +1640,17 @@ type StructuredEvent = Exclude<AgentEvent, {
 }>
 /**
  * `text` is the user message the turn answers; `messageId` is set when it had
- * waited in the queue, `forced` when it was force sent (ADR-0023, Q2).
+ * waited in the queue, `forced` when it was force sent (ADR-0023, Q2), `from`
+ * when Ordewell sent it. `command` is set on a turn that runs the runner's
+ * own command (#66); `text` is then that command as the runner read it.
  */
  | {
     type: 'turn_start';
     text: string;
     messageId?: string;
     forced?: boolean;
+    from?: TaskMessageFrom;
+    command?: InvokedCommand;
 } | {
     type: 'turn_end';
     reason: StructuredTurnEnd;
@@ -1150,13 +1658,15 @@ type StructuredEvent = Exclude<AgentEvent, {
 /**
  * Waiting in Ordewell's queue — again, for a message the runner was handed
  * and let go of (ADR-0023, D4). `forced` puts it ahead of the rest, behind
- * earlier forced ones (F2); a message already listed moves there.
+ * earlier forced ones (F2); a message already listed moves there, still
+ * handed over if it was.
  */
  | {
     type: 'message_queued';
     messageId: string;
     text: string;
     forced?: boolean;
+    from?: TaskMessageFrom;
 } | {
     type: 'message_removed';
     messageId: string;
@@ -1164,6 +1674,7 @@ type StructuredEvent = Exclude<AgentEvent, {
     type: 'message_undelivered';
     messageId: string;
     text: string;
+    from?: TaskMessageFrom;
 }
 /** The runner accepted the message into its running turn; it can no longer be taken back (ADR-0023, D3). */
  | {
@@ -1175,6 +1686,7 @@ type StructuredEvent = Exclude<AgentEvent, {
     type: 'message_delivered';
     messageId: string;
     text: string;
+    from?: TaskMessageFrom;
 }
 /** An open `permission_request` was answered, by whoever answered it (ADR-0018, A1). */
  | {
@@ -1187,13 +1699,19 @@ type StructuredEvent = Exclude<AgentEvent, {
     type: 'permission_withdrawn';
     id: string;
 };
+/** A runner command a user invoked, with its arguments as typed. */
+interface InvokedCommand {
+    name: string;
+    args?: string;
+}
 interface QueuedTaskMessage {
     id: string;
     text: string;
     /** The runner has it and owes a delivery, so it cannot be taken back (ADR-0023, Q1). */
     handedOver?: boolean;
-    /** Force sent: it goes out as soon as the running turn is interrupted (ADR-0023, F1). */
+    /** Force sent: it goes first once the running turn is interrupted (ADR-0023, F1). Every listed message can be, handed over or not. */
     forced?: boolean;
+    from?: TaskMessageFrom;
 }
 interface IRunnerSession {
     id: string;
@@ -1211,8 +1729,9 @@ interface IRunnerSession {
      * Send a user message: at once when idle; while a turn runs, handed to the
      * runner for its next step where it can take one, otherwise queued until
      * the turn ends (ADR-0023). Returns its id, for {@link removeQueued}.
+     * `from` marks a message Ordewell sent rather than the user.
      */
-    sendMessage(text: string): string;
+    sendMessage(text: string, from?: TaskMessageFrom): string;
     /**
      * Force send (ADR-0023, F1–F3): interrupt the running turn, as
      * {@link interrupt} does, and deliver this message as the turn that
@@ -1220,7 +1739,11 @@ interface IRunnerSession {
      * input in between. With no turn running it is {@link sendMessage}.
      */
     forceSend(text: string): string;
-    /** Force send a message still queued, by id. False once it was handed over or delivered. */
+    /**
+     * Force send a message not yet delivered, by id — queued, or handed over,
+     * which is not sent twice: the interrupt makes it go first (ADR-0023, F1).
+     * False once it was delivered.
+     */
     forceSendQueued(id: string): boolean;
     /** Take a message back before the runner has it. False once it was handed over or delivered. */
     removeQueued(id: string): boolean;
@@ -1234,6 +1757,20 @@ interface IRunnerSession {
     interrupt(): Promise<void>;
     /** The runner's own session id once announced — what a continue resumes (ADR-0018, K1). */
     nativeSessionId(): string | null;
+    /**
+     * The slash commands the runner offers this task (#66): its built-ins and
+     * the user's and the project's skills and custom commands. Empty for a
+     * runner that reports none.
+     */
+    commands(): RunnerCommand[];
+    /**
+     * Run the runner's own command `name` as a turn of its own: at once when
+     * idle, otherwise queued behind the running turn — never handed into it,
+     * where a runner reads it as text. A runner whose commands cannot be invoked
+     * over its protocol is sent `/name args` as a message. Returns its id, as
+     * {@link sendMessage} does.
+     */
+    invokeCommand(name: string, args?: string): string;
     /**
      * Answer a `permission_request` this session emitted, by its event id. False
      * when it is no longer open — answered, withdrawn, or never asked.
@@ -1296,4 +1833,4 @@ interface IRunner {
     activeCount: number;
 }
 
-export { type ProviderModelsResult as $, type AgentAdapter as A, type McpCredential as B, type CatalogModel as C, DEFAULT_PLANNER_ALLOWLIST as D, type EditPlanArgs as E, type FetchAllProviderModelsOptions as F, type McpTool as G, type McpToolContext as H, type IApproval as I, type McpToolReply as J, ModelCatalog as K, LineBuffer as L, type McpClientConfig as M, type ModelShortcut as N, ORCHESTRATOR_SHORTCUTS as O, ORDEWELL_MCP_PATH as P, ORDEWELL_MCP_SERVER_NAME as Q, type OrchestratorOption as R, OrdewellMcpServer as S, type OwnerOnlyFile as T, PLANNER_TOOLS as U, type PlannerAllowlist as V, type PlannerStartOptions as W, type PlannerTokenScope as X, type PlannerToolHandler as Y, type ProviderCredentialSource as Z, type ProviderModelLists as _, type AgentAdapterFactory as a, type QueuedTaskMessage as a0, type RunCommandArgs as a1, type RunnerEntry as a2, type RunnerFeatures as a3, type RunnerManifest as a4, type RunnerMode as a5, type RunnerModelDiscovery as a6, RunnerRegistry as a7, type SpawnFn as a8, type StructuredEvent as a9, resolveModelShortcut as aA, resolveProvider as aB, scopeAllowed as aC, sharedMcpServer as aD, toApprovalDecision as aE, toOrchestratorOptions as aF, toolAllowed as aG, type StructuredTurnEnd as aa, type SubmitPlanArgs as ab, TASK_COMPLETE_TOOL as ac, TASK_TOOLS as ad, type TaskCompleteArgs as ae, type TaskModeAgentAdapter as af, TaskModeUnsupportedError as ag, type TaskOutputArgs as ah, type TaskQueryArgs as ai, type TaskRunnerFlags as aj, type TaskStartOptions as ak, type TaskTokenScope as al, type TaskToolHandler as am, approvalScopes as an, collectProviderCredentials as ao, commandAllowedBy as ap, effectiveApprovalMode as aq, enabledRunners as ar, fetchAllProviderModels as as, isGranted as at, isRunnerApproval as au, knownModelId as av, mcpClientConfig as aw, ownerOnlyConfigFile as ax, parseAllowlist as ay, parseApprovalModeSetting as az, type AgentEvent as b, type AgentProcessDeps as c, type AgentStartOptions as d, type AiProvider as e, type AllProviderModels as f, type ApprovalAnswer as g, type ApprovalDecision as h, type ApprovalKind as i, type ApprovalMode as j, type ApprovalModeSetting as k, ApprovalPolicy as l, type ApprovalPolicyOptions as m, type ApprovalRequest as n, type ApprovalSource as o, type CheckpointAnswer as p, type CheckpointArgs as q, type CommandWords as r, DENY_ALL as s, type DiscoveryCommand as t, type IConfig as u, type IRunner as v, type IRunnerSession as w, type ListModelsArgs as x, type ListRunnersArgs as y, type LoadSkillArgs as z };
+export { type OwnerOnlyFile as $, AUTO_COMMANDS as A, type IRunnerSession as B, type CatalogModel as C, DEFAULT_PLANNER_ALLOWLIST as D, type EditPlanArgs as E, type FetchAllProviderModelsOptions as F, GIT_READONLY_SUBCOMMANDS as G, type InvokedCommand as H, type IApproval as I, type ListModelsArgs as J, type ListRunnersArgs as K, LineBuffer as L, type LoadSkillArgs as M, type McpClientConfig as N, type McpCredential as O, type McpTool as P, type McpToolContext as Q, type McpToolReply as R, type MessageTaskArgs as S, ModelCatalog as T, type ModelShortcut as U, ORCHESTRATOR_SHORTCUTS as V, ORDEWELL_MCP_PATH as W, ORDEWELL_MCP_SERVER_NAME as X, type OneTaskArgs as Y, type OrchestratorOption as Z, OrdewellMcpServer as _, type AgentAdapter as a, researchToolsPath as a$, PLANNER_EXECUTION_TOOLS as a0, PLANNER_TOOLS as a1, type PlannerAllowlist as a2, type PlannerStartOptions as a3, type PlannerTokenScope as a4, type PlannerToolHandler as a5, type ProjectMcpServer as a6, type ProviderCredentialSource as a7, type ProviderModelLists as a8, type ProviderModelsResult as a9, type TaskDiffArgs as aA, type TaskMessageFrom as aB, type TaskModeAgentAdapter as aC, TaskModeUnsupportedError as aD, type TaskOutputArgs as aE, type TaskQueryArgs as aF, type TaskRunnerFlags as aG, type TaskStartOptions as aH, type TaskTokenScope as aI, type TaskToolHandler as aJ, approvalScopes as aK, classifyCommand as aL, clearResearchShellCache as aM, collectProviderCredentials as aN, commandAllowedBy as aO, effectiveApprovalMode as aP, enabledRunners as aQ, fetchAllProviderModels as aR, findRunnerCommand as aS, isGranted as aT, isRunnerApproval as aU, knownModelId as aV, mcpClientConfig as aW, ownerOnlyConfigFile as aX, parseAllowlist as aY, parseApprovalModeSetting as aZ, researchShellWarning as a_, type QueuedTaskMessage as aa, REFUSED_COMMANDS as ab, type ResearchShell as ac, type ResearchShellDeps as ad, type RetryTaskArgs as ae, type RunCommandArgs as af, type RunPlanArgs as ag, type RunnerCommand as ah, type RunnerCommandKind as ai, type RunnerEntry as aj, type RunnerFeatures as ak, type RunnerManifest as al, type RunnerMcpServer as am, type RunnerMode as an, type RunnerModelDiscovery as ao, RunnerRegistry as ap, type ShellDialect as aq, type SpawnFn as ar, type StandingDecision as as, type StructuredEvent as at, type StructuredTurnEnd as au, type SubmitPlanArgs as av, TASK_COMPLETE_TOOL as aw, TASK_COMPLETION_CONTRACT as ax, TASK_TOOLS as ay, type TaskCompleteArgs as az, type AgentAdapterFactory as b, resolveModelShortcut as b0, resolveProvider as b1, resolveResearchShell as b2, scopeAllowed as b3, sharedMcpServer as b4, toApprovalDecision as b5, toOrchestratorOptions as b6, toolAllowed as b7, type AgentEvent as c, type AgentProcessDeps as d, type AgentStartOptions as e, type AiProvider as f, type AllProviderModels as g, type AnswerApprovalArgs as h, type ApprovalAnswer as i, type ApprovalDecision as j, type ApprovalKind as k, type ApprovalMode as l, type ApprovalModeSetting as m, ApprovalPolicy as n, type ApprovalPolicyOptions as o, type ApprovalRequest as p, type ApprovalSource as q, type CheckpointAnswer as r, type CheckpointArgs as s, type CommandClassification as t, type CommandTier as u, type CommandWords as v, DENY_ALL as w, type DiscoveryCommand as x, type IConfig as y, type IRunner as z };