@chibitek/chibi 0.1.168 → 0.1.170

package/dist-server/proxy-paths.js

@@ -21,6 +21,7 @@ var SPAWNED_PROXIES = {
   hook: resolveProxy("hooks/omb-hook"),
   // the RTK add-on's Claude PreToolUse hook (bypassPermissions turns only)
   rtkHook: resolveProxy("hooks/rtk-hook"),
+  planHook: resolveProxy("hooks/plan-hook"),
   // Loaded by the external `pi` process via `-e`, not by this server — but
   // resolved through the same single source of truth so the packaged layout
   // check can assert it ships.

package/dist-server/server/atomic-engine-release.js

@@ -5,28 +5,28 @@
 // download whose size or SHA-512 differs from the pin below.
 //
 // Generated by scripts/release-engine.mjs. Do not edit by hand.
-export const ATOMIC_ENGINE_VERSION = "0.21.4-7eb41cb";
+export const ATOMIC_ENGINE_VERSION = "0.21.4-4cc340e";
 const ASSETS = [
     {
-        version: "0.21.4-7eb41cb",
+        version: "0.21.4-4cc340e",
         platform: "darwin-arm64",
-        url: "https://ugmbfkqvogfuvufzjxtb.supabase.co/storage/v1/object/public/atomic-updates/atomic/K_5FMcrZFZ5AE2K-Lydn-Tis/atomic-engine-0.21.4-7eb41cb-darwin-arm64.tar.gz",
-        bytes: 114827855,
-        sha512: "357648850bc4042960fa0f1ef01415f9066c1beb445f5a0edd66a2f9c05e8fcf68b1d692ec6d81bb45c80b7d7dadedf828721d8020c6e12639de7730370177af",
+        url: "https://ugmbfkqvogfuvufzjxtb.supabase.co/storage/v1/object/public/atomic-updates/atomic/K_5FMcrZFZ5AE2K-Lydn-Tis/atomic-engine-0.21.4-4cc340e-darwin-arm64.tar.gz",
+        bytes: 115631334,
+        sha512: "666626a535dce48f22087e26f7c14702dda4028b2c6759952017cffa73f37d86b16f5d8b6f81fb0efb535cb285ba4ddb6a5da3fd7e709ea0aa8b2b8c783e0c17",
     },
     {
-        version: "0.21.4-7eb41cb",
+        version: "0.21.4-4cc340e",
         platform: "win32-x64",
-        url: "https://ugmbfkqvogfuvufzjxtb.supabase.co/storage/v1/object/public/atomic-updates/atomic/K_5FMcrZFZ5AE2K-Lydn-Tis/atomic-engine-0.21.4-7eb41cb-win32-x64.tar.gz",
-        bytes: 102379095,
-        sha512: "e3f3ff51513df37f79165e9408395d771f6136cfeb3207417741b421347f7f183209a2865c70fe3175a20dc35ef5bc409213bd3bbc5f8b614d7d08f2ff8edd07",
+        url: "https://ugmbfkqvogfuvufzjxtb.supabase.co/storage/v1/object/public/atomic-updates/atomic/K_5FMcrZFZ5AE2K-Lydn-Tis/atomic-engine-0.21.4-4cc340e-win32-x64.tar.gz",
+        bytes: 103355479,
+        sha512: "4a074d1d2254ce697ed7ddf794b6d56e1f62374d1ae5f533f7fea12c7f18af46f47f33fd38f9e09d3ca048ef027882b6b271dd229f40a9ffcb7f3f23db5d1bb0",
     },
     {
-        version: "0.21.4-acc9ee6",
+        version: "0.21.4-4cc340e",
         platform: "darwin-x64",
-        url: "https://ugmbfkqvogfuvufzjxtb.supabase.co/storage/v1/object/public/atomic-updates/atomic/K_5FMcrZFZ5AE2K-Lydn-Tis/atomic-engine-0.21.4-acc9ee6-darwin-x64.tar.gz",
-        bytes: 92108962,
-        sha512: "12c3fcba9ff17ec2a53fdbd39e8f14fb23786be256f2e19ce63ba011c2317231e58052b1b1b0a5bdcd7be2b23d9cf7edaeb267ad312e1ac862e128ac70f3aa00",
+        url: "https://ugmbfkqvogfuvufzjxtb.supabase.co/storage/v1/object/public/atomic-updates/atomic/K_5FMcrZFZ5AE2K-Lydn-Tis/atomic-engine-0.21.4-4cc340e-darwin-x64.tar.gz",
+        bytes: 92883251,
+        sha512: "eec5fcbbcdbe44db76f938cb3dd98fedfc6c644cc054c75d0ad3daaf66e39f60dc6b75fa3f8cdbbc2cc3760a2ea7d3fc608a1cf7a42c4a020e6cd4d6dc823df0",
     },
 ];
 /** The package for this computer, or null when none is published for it. */

package/dist-server/server/bot-work-modes.js

@@ -0,0 +1,212 @@
+// Atomic Engineering, 2026-10-31. Per-bot composer modes and paired confirmation.
+// Pending confirmations exist only in memory; restarting never commits one.
+import { randomUUID } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { writeFileAtomic } from "./atomic.js";
+import { approvalModeForOrigin } from "./auto-approve.js";
+import { PASS } from "./routes/table.js";
+import { approvalModeFor, supportsApprovalMode } from "../shared/approval-mode.js";
+export const WORK_MODES = ["plan", "ask", "edits", "full"];
+const valid = (value) => WORK_MODES.includes(value);
+export class BotWorkModes {
+    selections = {};
+    allowed = [...WORK_MODES];
+    pending = new Map();
+    file;
+    constructor(file) {
+        this.file = file;
+        if (!existsSync(file))
+            return;
+        try {
+            const data = JSON.parse(readFileSync(file, "utf8"));
+            if (Array.isArray(data.allowed))
+                this.allowed = ["ask", ...data.allowed.filter((mode) => valid(mode) && mode !== "ask")];
+            for (const [id, entry] of Object.entries(data.selections ?? {})) {
+                const item = entry;
+                if (item && valid(item.mode) && typeof item.sessionId === "string")
+                    this.selections[id] = item;
+            }
+        }
+        catch {
+            this.allowed = ["ask"];
+        }
+    }
+    save() { writeFileAtomic(this.file, JSON.stringify({ allowed: this.allowed, selections: this.selections })); }
+    selected(botId) { return this.selections[botId]?.mode; }
+    availability(drivers) {
+        return WORK_MODES.filter(mode => this.allowed.includes(mode) && drivers.length > 0 && drivers.every(driver => supportsApprovalMode(driver, mode)));
+    }
+    settings() { return { allowed: this.allowed }; }
+    permits(mode) { return mode === "plan" || !valid(mode) || this.allowed.includes(mode); }
+    expired(live) {
+        return [...new Set(Object.values(this.selections).filter(item => item.mode !== "ask" && !live(item.sessionId)).map(item => item.sessionId))].flatMap(id => this.revoke(id));
+    }
+    configure(modes) {
+        if (!Array.isArray(modes) || !modes.every(valid))
+            throw new Error("Invalid available modes");
+        this.allowed = [...new Set(["ask", ...modes])];
+        const changed = Object.keys(this.selections).filter(id => this.selections[id].mode !== "plan" && !this.allowed.includes(this.selections[id].mode));
+        for (const id of changed)
+            this.selections[id].mode = "ask";
+        this.pending.clear();
+        this.save();
+        return changed;
+    }
+    set(botId, mode, sessionId) {
+        this.selections[botId] = { mode, sessionId };
+        for (const [id, item] of this.pending)
+            if (item.botId === botId)
+                this.pending.delete(id);
+        this.save();
+    }
+    request(botId, mode, sessionId, revision) {
+        for (const [id, item] of this.pending)
+            if (item.botId === botId || item.expiresAt <= Date.now())
+                this.pending.delete(id);
+        const nonce = randomUUID(), expiresAt = Date.now() + 120_000;
+        this.pending.set(nonce, { botId, mode, sessionId, revision, expiresAt });
+        return { nonce, expiresAt, mode, botId };
+    }
+    confirm(nonce, botId, mode, sessionId, revision) {
+        const item = this.pending.get(nonce);
+        if (!item || item.botId !== botId || item.mode !== mode || item.sessionId !== sessionId || item.revision !== revision || item.expiresAt <= Date.now())
+            return false;
+        this.pending.delete(nonce);
+        this.set(botId, mode, sessionId);
+        return true;
+    }
+    revoke(sessionId) {
+        const ids = Object.keys(this.selections).filter(id => this.selections[id].sessionId === sessionId);
+        for (const id of ids)
+            if (this.selections[id].mode !== "plan")
+                this.selections[id].mode = "ask";
+        for (const [id, item] of this.pending)
+            if (item.sessionId === sessionId)
+                this.pending.delete(id);
+        if (ids.length)
+            this.save();
+        return ids.filter(id => this.selections[id].mode !== "plan");
+    }
+}
+export function pairedModeAuthority(auth, desktopManaged) {
+    return desktopManaged && auth.kind === "session" && auth.via === "bearer" && auth.scopes.includes("admin");
+}
+export function createBotWorkModeRoutes(deps) {
+    return async ({ path, method, auth, req, res, readBody, json }) => {
+        const settings = path === "/api/work-modes";
+        const match = /^\/api\/bots\/([\w-]+)\/work-mode$/.exec(path);
+        if (!settings && !match)
+            return PASS;
+        if (!pairedModeAuthority(auth, deps.desktopManaged) || auth.kind !== "session" || !deps.live(auth.session.id))
+            return json(res, 403, { error: "Mode changes require an Administrator's paired device connected to the desktop app." });
+        const body = method === "POST" || method === "PUT" ? await readBody(req) : {};
+        if (!deps.live(auth.session.id))
+            return json(res, 403, { error: "Pairing expired" });
+        if (settings) {
+            if (method === "GET")
+                return json(res, 200, deps.modes.settings());
+            if (method !== "PUT")
+                return json(res, 405, { error: "Method not allowed" });
+            try {
+                if (!Array.isArray(body.allowed) || !body.allowed.every(valid))
+                    return json(res, 400, { error: "Invalid available modes" });
+                const affected = deps.affected(["ask", ...body.allowed]);
+                const ids = [...new Set([...affected, ...deps.modes.configure(body.allowed)])];
+                for (const id of ids) {
+                    deps.modes.set(id, "ask", auth.session.id);
+                    deps.apply(id, "ask", true);
+                    await deps.stop(id);
+                    deps.changed(id);
+                }
+                return json(res, 200, deps.modes.settings());
+            }
+            catch {
+                return json(res, 400, { error: "Could not change available modes" });
+            }
+        }
+        const id = match[1], bot = deps.bot(id);
+        if (!bot)
+            return json(res, 404, { error: "No such bot" });
+        const status = () => ({ current: deps.bot(id)?.current ?? "ask", available: deps.modes.availability(bot.drivers) });
+        if (method === "GET")
+            return json(res, 200, status());
+        if (method !== "POST")
+            return json(res, 405, { error: "Method not allowed" });
+        if (!valid(body.mode))
+            return json(res, 400, { error: "Invalid mode" });
+        if (body.mode !== "ask" && !deps.modes.availability(bot.drivers).includes(body.mode))
+            return json(res, 409, { error: "This mode is unavailable in Settings or on this engine." });
+        if (bot.current === "plan" && body.mode !== "plan") {
+            if (bot.busy)
+                return json(res, 409, { error: "Stop planning before approving the plan." });
+            if (typeof body.nonce !== "string")
+                return json(res, 200, { ...status(), confirmation: deps.modes.request(id, body.mode, auth.session.id, bot.revision) });
+            if (body.mode === "ask" && !deps.modes.confirm(body.nonce, id, "ask", auth.session.id, bot.revision))
+                return json(res, 409, { error: "Plan confirmation expired or changed." });
+        }
+        if (body.mode === "ask") {
+            deps.modes.set(id, "ask", auth.session.id);
+            deps.apply(id, "ask");
+            await deps.stop(id);
+            deps.changed(id);
+            return json(res, 200, status());
+        }
+        if (bot.busy)
+            return json(res, 409, { error: "Stop this bot's active threads before changing mode." });
+        if (!deps.modes.availability(bot.drivers).includes(body.mode))
+            return json(res, 409, { error: "This mode is unavailable in Settings or on one of this bot's engines." });
+        if (body.mode === "plan") {
+            deps.modes.set(id, "plan", auth.session.id);
+            deps.apply(id, "plan");
+            deps.changed(id);
+            return json(res, 200, status());
+        }
+        if (typeof body.nonce !== "string")
+            return json(res, 200, { ...status(), confirmation: deps.modes.request(id, body.mode, auth.session.id, bot.revision) });
+        if (!deps.modes.confirm(body.nonce, id, body.mode, auth.session.id, bot.revision))
+            return json(res, 409, { error: "This confirmation expired or the bot changed. Choose the mode again." });
+        deps.apply(id, body.mode);
+        deps.changed(id);
+        return json(res, 200, status());
+    };
+}
+export function ownBotApprovalMode(bot, driver, peerInitiated, permitted = true) {
+    if (!permitted)
+        return "ask";
+    const mode = approvalModeForOrigin(approvalModeFor(bot), { peerInitiated });
+    if (mode === "plan")
+        return mode;
+    return supportsApprovalMode(driver, mode) ? mode : "ask";
+}
+export function legacyGodModeCovers(bot, active, overridden) {
+    if (!active || overridden || approvalModeFor(bot) === "plan")
+        return false;
+    const grant = bot.approvalGrant;
+    return !(grant && !(grant.threadOnly && grant.threadId !== bot.threadId));
+}
+export function dispatchWorkMode(mode, driver) {
+    if (mode === "plan" && !supportsApprovalMode(driver, mode))
+        throw new Error("This engine cannot enforce Plan. Choose Ask in the mode picker first.");
+    return mode;
+}
+/** Recovery lowers elevated targets without implicitly approving any Plan. */
+export function trustedPlanTransitionAllowed(mode, approved, scope) {
+    if (mode === "plan" || approved || (scope.allThreads && mode === "ask"))
+        return true;
+    const targets = scope.threadOnly ? [scope.thread] : scope.allThreads ? [scope.bot, ...scope.threads] : [scope.bot, scope.thread];
+    return !targets.includes("plan");
+}
+export function trustedPlanChangeForStore(store, botId, mode, message) {
+    const target = typeof message.threadId === "string" ? store.projectBotForTask(botId, message.threadId) : null;
+    return trustedPlanTransitionAllowed(mode, message.approvePlan === true, {
+        bot: approvalModeFor(store.bot(botId)), thread: target ? approvalModeFor(target) : undefined,
+        threadOnly: message.threadOnly === true, allThreads: message.allThreads === true,
+        threads: store.tasks(botId).map(task => approvalModeFor(store.projectBotForTask(botId, task.threadId))),
+    });
+}
+export function invalidAllThreadScope(mode, message) {
+    return message.allThreads !== undefined && (typeof message.allThreads !== "boolean" ||
+        (message.allThreads && (message.threadId !== undefined || message.threadOnly === true ||
+            message.modelSelection !== undefined || message.updateBotDefault !== undefined ||
+            (mode !== "full" && mode !== "ask"))));
+}

package/dist-server/server/config.js

@@ -1386,7 +1386,7 @@ function injectedEnvironment(cfg, driver) {
 // preconfigured for https://ollama.com/v1 and lists as unavailable until an
 // Ollama API key is saved (or OLLAMA_API_KEY is set).
 const ATOMIC_FLEET = {
-    "atomic-engine": { driver: "customAcp", displayName: "Atomic Engine", config: { cli: "atomic acp" } },
+    "atomic-engine": { driver: "atomicEngine", displayName: "Atomic Engine", config: { cli: "atomic acp" } },
     ollamaCloud: { driver: "ollamaCloud", displayName: "Ollama Cloud" },
 };
 function plainObject(value) {
@@ -1485,11 +1485,12 @@ export function instanceConfigs(cfg, onDevice = onDeviceFleet(), accountKeys = i
                 map[id] = { ...entry };
         }
     }
-    // A persisted Atomic fleet entry may predate (or have lost) its defaults:
-    // older fleet saves wrote atomic-engine without `config.cli`, which left it
-    // "needs its command" and out of the picker. Put the defaults back under
-    // whatever is saved; an explicit saved value always wins.
+    // Migrate the shipped Atomic Engine and restore missing CLI defaults.
+    // Preserve explicitly customized commands and other drivers.
     for (const [id, fallback] of Object.entries(ATOMIC_FLEET)) {
+        const savedCli = map[id]?.config?.cli;
+        if (id === "atomic-engine" && map[id]?.driver === "customAcp" && (savedCli === undefined || savedCli === "atomic acp"))
+            map[id] = { ...map[id], driver: "atomicEngine" };
         if (Object.hasOwn(map, id))
             map[id] = withFleetDefaults(map[id], fallback);
     }

package/dist-server/server/drivers/acp/core.js

@@ -673,6 +673,8 @@ export function createAcpDriver(support) {
                         // never leave an unknown server request hanging — the agent blocks
                         return send({ jsonrpc: "2.0", id: msg.id, error: { code: -32601, message: "method not found" } });
                     }
+                    if (current.turn.approvalMode === "plan")
+                        return send({ jsonrpc: "2.0", id: msg.id, result: { outcome: { outcome: "cancelled" } } });
                     const params = msg.params ?? {};
                     current.flushAssistantText();
                     const options = Array.isArray(params.options) ? params.options : [];
@@ -1008,11 +1010,11 @@ export function createAcpDriver(support) {
             };
             const sendTurn = async (turn) => {
                 const { threadId } = turn;
+                if (turn.approvalMode === "plan" && !supportsApprovalMode(DRIVER_KIND, "plan"))
+                    throw new Error("Plan is not available for this engine yet");
                 if (active.has(threadId))
                     throw new Error("a turn is already running on this thread");
-                // Provider-instance `fullAuto` predates per-bot approval levels. Every
-                // harness turn now carries the bot's mode, so Ask/Auto must explicitly
-                // put the native agent back into its interactive mode. Otherwise a
+                // Explicit bot modes override legacy instance fullAuto. Otherwise a
                 // legacy Grok bypassPermissions / Cursor --force / Droid auto-high /
                 // Antigravity yolo setting would silently outrank the selector. Calls
                 // that omit approvalMode retain the old adapter-level behavior for
@@ -1041,7 +1043,7 @@ export function createAcpDriver(support) {
                 let cliTurn = resolvedModel !== undefined && resolvedModel !== turn.model
                     ? { ...turn, model: resolvedModel }
                     : turn;
-                const mcpServers = acpMcpServers(turn);
+                const mcpServers = turn.approvalMode === "plan" ? [] : acpMcpServers(turn);
                 let launch;
                 try {
                     launch = support.resolveCommand

package/dist-server/server/drivers/acp/custom.js

@@ -153,41 +153,55 @@ const support = {
     },
     snapshot: (env, config, instanceId) => customAcpSnapshot(env, config.cli, instanceId),
 };
-const base = createAcpDriver(support);
-export const CustomAcpDriver = {
-    ...base,
-    // decodeAcpConfig never throws (a missing cli falls back to defaultCli,
-    // which is empty here). Turn every blank-command path into the same
-    // teaching shadow row instead of a bare spawn ENOENT at first send.
-    decodeConfig(raw) {
-        const decoded = base.decodeConfig(raw);
-        if (!decoded.cli.trim())
-            throw new Error(CONFIGURE_HINT);
-        return decoded;
-    },
-    async create(input) {
-        if (!input.config.cli.trim())
-            throw new Error(CONFIGURE_HINT);
-        const instance = await base.create(input);
-        const asset = atomicEngineAsset();
-        if (!asset || !isAtomicEngine(input.instanceId, input.config.cli) || input.config.cli.trim() !== DEFAULT_ATOMIC_ENGINE_CLI)
-            return instance;
-        // Atomic Engine is installed by Atomic itself, the same way on every OS.
-        const install = {
-            managed: { label: "Install Atomic Engine", downloadBytes: asset.bytes },
-        };
-        return {
-            ...instance,
-            get models() {
-                return instance.models;
-            },
-            install,
-            installRuntime: async (onProgress) => {
-                await installAtomicEngine({
-                    // "verifying" is part of the download as far as setup's progress bar goes
-                    onProgress: (progress) => onProgress?.({ ...progress, phase: progress.phase === "verifying" ? "downloading" : progress.phase }),
-                });
-            },
-        };
+function customDriver(options) {
+    const base = createAcpDriver(options);
+    return {
+        ...base,
+        // decodeAcpConfig never throws (a missing cli falls back to defaultCli,
+        // which is empty here). Turn every blank-command path into the same
+        // teaching shadow row instead of a bare spawn ENOENT at first send.
+        decodeConfig(raw) {
+            const decoded = base.decodeConfig(raw);
+            if (!decoded.cli.trim())
+                throw new Error(CONFIGURE_HINT);
+            return decoded;
+        },
+        async create(input) {
+            if (!input.config.cli.trim())
+                throw new Error(CONFIGURE_HINT);
+            const instance = await base.create(input);
+            const asset = atomicEngineAsset();
+            if (!asset || !isAtomicEngine(input.instanceId, input.config.cli) || input.config.cli.trim() !== DEFAULT_ATOMIC_ENGINE_CLI)
+                return instance;
+            // Atomic Engine is installed by Atomic itself, the same way on every OS.
+            const install = {
+                managed: { label: "Install Atomic Engine", downloadBytes: asset.bytes },
+            };
+            return {
+                ...instance,
+                get models() {
+                    return instance.models;
+                },
+                install,
+                installRuntime: async (onProgress) => {
+                    await installAtomicEngine({
+                        // "verifying" is part of the download as far as setup's progress bar goes
+                        onProgress: (progress) => onProgress?.({ ...progress, phase: progress.phase === "verifying" ? "downloading" : progress.phase }),
+                    });
+                },
+            };
+        },
+    };
+}
+export const CustomAcpDriver = customDriver(support);
+export const AtomicEngineDriver = customDriver({
+    ...support, driverKind: "atomicEngine", displayName: "Atomic Engine", defaultCli: DEFAULT_ATOMIC_ENGINE_CLI,
+    async configureSession(context) {
+        await support.configureSession?.(context);
+        const modeId = context.turn.approvalMode === "plan" ? "atomic-plan-v1" : "default";
+        const reply = await context.request("session/set_mode", { sessionId: context.sessionId, modeId });
+        if (modeId === "atomic-plan-v1" && (reply?._meta?.atomicPlanVersion !== 1 || reply?._meta?.mode !== modeId)) {
+            throw new Error("Update Atomic Engine before using Plan: this build does not enforce read-only tools");
+        }
     },
-};
+});

package/dist-server/server/drivers/builtIn.js

@@ -13,7 +13,7 @@ import { MuseCodeDriver } from "./muse-code.js";
 import { OpenCodeDriver } from "./acp/opencode-go.js";
 import { QwenAgentDriver } from "./acp/qwen.js";
 import { VibeAgentDriver } from "./acp/vibe.js";
-import { CustomAcpDriver } from "./acp/custom.js";
+import { AtomicEngineDriver, CustomAcpDriver } from "./acp/custom.js";
 import { HermesAgentDriver } from "./acp/hermes.js";
 import { OpenAICompatDriver } from "./openai-compat.js";
 import { PiDriver } from "./pi.js";
@@ -35,6 +35,7 @@ export const ALL_BUILT_IN_DRIVERS = [
     VibeAgentDriver,
     HermesAgentDriver,
     CustomAcpDriver,
+    AtomicEngineDriver,
     PiDriver,
     OpenAICompatDriver,
     ClaudeDriver,

package/dist-server/server/drivers/chat-mcp-tools.js

@@ -425,6 +425,7 @@ export async function mountChatTools(integrations, signal, computerUse = false,
     return {
         definitions, validate, close,
         customTool: (name) => customTools.get(name),
+        planReadOnly: (name) => { const tool = registered.get(name); return tool?.client instanceof ChatBoxClient && ["screenshot", "get_screen_size"].includes(tool.name); },
         async execute(name, args, callSignal) {
             validate(name, args);
             if (callSignal.aborted) {

package/dist-server/server/drivers/claude.js

@@ -1,3 +1,4 @@
+import { claudePlanHook, planToolAllowed, PLAN_REFUSAL } from "../plan-policy.js";
 import { firstText } from "./claude-message.js";
 // Claude driver — upstream ClaudeDriver skeleton over agentcal's
 // drivers/claude.js runtime (stream-json both directions, prompt over
@@ -624,6 +625,12 @@ export async function createPermissionBroker(opts) {
                     continue;
                 }
                 const ask = { id: askId, kind, tool: msg.tool ?? "tool", input: msg.input ?? {}, at: Date.now() };
+                if (opts.plan && kind === "permission" && !planToolAllowed(ask.tool)) {
+                    const behavior = "deny";
+                    conn.write(JSON.stringify({ t: "answer", id: askId, behavior, source: "system", message: PLAN_REFUSAL }) + "\n");
+                    opts.onResolve({ ...ask, behavior, source: "system" });
+                    continue;
+                }
                 const sessionKey = kind === "permission" && opts.sessionAllows && (opts.canAllowForSession?.(ask) ?? true)
                     ? sessionAllowKey(ask)
                     : null;
@@ -1002,11 +1009,9 @@ export const ClaudeDriver = {
             const relaunch = logicalTurnId !== undefined;
             if (active.has(threadId) && !relaunch)
                 throw new Error("a turn is already running on this thread");
-            // A bot-level mode is authoritative for this turn. In particular, an
-            // old provider instance may still be configured with
-            // `bypassPermissions`; Ask/Auto must restore Claude's interactive
-            // broker instead of inheriting that silent bypass. Calls without a
-            // per-turn mode keep the legacy adapter behavior.
+            const plan = turn.approvalMode === "plan";
+            if (plan)
+                turn = { ...turn, integrations: undefined, mcpFromUserConfig: false, pluginDirs: [] };
             const permissionMode = turn.approvalMode === undefined
                 ? config.permissionMode
                 : turn.approvalMode === "full" ? "bypassPermissions"
@@ -1049,7 +1054,9 @@ export const ClaudeDriver = {
             ];
             // A Team Room turn without shared files: no built-in tools at all
             // (an empty --tools list), so only the turn's MCP servers remain.
-            if (turn.builtinTools === false)
+            if (plan)
+                args.push("--tools", "Read,Glob,Grep", "--strict-mcp-config", "--setting-sources", "");
+            else if (turn.builtinTools === false)
                 args.push("--tools", "");
             else if (config.tools !== undefined)
                 args.push("--tools", config.tools.join(","));
@@ -1075,22 +1082,8 @@ export const ClaudeDriver = {
                     cliVersionChecked = true;
                 }
             }
-            const isolated = !inheritsUserConfig(turnEnvironment);
-            if (isolated) {
-                // A bot gets the tools and instructions its owner gave it, not
-                // whatever this machine's Claude Code happens to be set up with.
-                // Without these the CLI silently adds, to EVERY turn of every bot:
-                // the desktop's own MCP servers and claude.ai connectors (one
-                // measured desktop mounted 407 extra tools, ~10k tokens), its skill
-                // and agent listings, its hooks, and its personal CLAUDE.md. Every
-                // model call in the session then re-reads all of it.
-                // Each flag only on a CLI that accepts it: an unknown flag is an
-                // argument error that would fail every turn (CLAUDE_FLAG_FLOORS).
-                // The MCP half has a switch (Plugins → MCP servers → "Also use my
-                // Claude Code MCP servers"): with it on, the CLI loads the servers
-                // and connectors from the person's own Claude Code config — the way
-                // Codex's `features.codexUserMcp` does for config.toml — while skills, hooks and the
-                // personal CLAUDE.md stay out.
+            const isolated = plan || !inheritsUserConfig(turnEnvironment);
+            if (isolated && !plan) {
                 if (!turn.mcpFromUserConfig && claudeCliSupports(cliVersion, "--strict-mcp-config"))
                     args.push("--strict-mcp-config");
                 if (claudeCliSupports(cliVersion, "--setting-sources"))
@@ -1207,7 +1200,7 @@ export const ClaudeDriver = {
             // of MCP servers, so a server the bot's OWN project declares would
             // otherwise vanish with the machine's. Merge it last: a project file
             // can add servers but never shadow a harness-owned mount.
-            if (isolated && turn.cwd) {
+            if (isolated && turn.cwd && !plan) {
                 for (const [name, server] of Object.entries(projectMcpServers(turn.cwd))) {
                     if (Object.hasOwn(mcpServers, name))
                         continue;
@@ -1250,6 +1243,12 @@ export const ClaudeDriver = {
                 args.push("--allowedTools", allowed.join(","));
             }
             const env = environment(turnModel);
+            if (plan) {
+                env.OMB_PLAN_NODE = process.execPath;
+                env.OMB_PLAN_HOOK = SPAWNED_PROXIES.planHook;
+                if (process.versions.electron)
+                    env.ELECTRON_RUN_AS_NODE = "1";
+            }
             const authSettings = isolated && !injected.injected
                 ? readClaudeAuthSettings(env, input.environment) : {};
             // Harness hooks (item 0.2): one helper command for the events the
@@ -1286,6 +1285,7 @@ export const ClaudeDriver = {
             const hookBlock = {
                 ...(hooks ? claudeHookSettings(HOOK_HELPER_PATH) : {}),
                 ...(rtkHook ? { PreToolUse: rtkHookSettings(RTK_HOOK_PATH) } : {}),
+                ...(plan ? { PreToolUse: claudePlanHook(process.execPath, SPAWNED_PROXIES.planHook) } : {}),
             };
             if (Object.keys(hookBlock).length)
                 settings.hooks = hookBlock;
@@ -1404,10 +1404,9 @@ export const ClaudeDriver = {
                 // process keeps its existing proxy connection and broker across turns.
                 if (socketPath) {
                     // remembers which tool each pending ask came from, so the resolved
-                    // event can scope approvals to real desktop-control tools only
                     const askTools = new Map();
                     broker = await createPermissionBroker({
-                        socketPaths: brokerSocketCandidates(threadId, botId),
+                        socketPaths: brokerSocketCandidates(threadId, botId), plan,
                         isActive: () => Boolean(sessions.get(threadId)?.turn),
                         inputOnAllow: (ask) => {
                             const current = sessions.get(threadId)?.turn?.input ?? turn;
@@ -1455,6 +1454,10 @@ export const ClaudeDriver = {
                             });
                         },
                         onResolve: (resolved) => {
+                            if (plan && resolved.behavior === "deny") {
+                                emit({ ...base(threadId, turnId), type: "item.started", itemType: "tool", itemId: resolved.id, title: "Plan blocked an action" });
+                                emit({ ...base(threadId, turnId), type: "item.completed", itemType: "tool", itemId: resolved.id, ok: false, output: PLAN_REFUSAL });
+                            }
                             const eventTurnId = sessions.get(threadId)?.turn?.turnId ?? turnId;
                             emit({
                                 ...base(threadId, eventTurnId),

package/dist-server/server/drivers/codex-approval-presets.js

@@ -0,0 +1,34 @@
+// Explicit on start, resume and every turn so elevated permissions never stick.
+export function namedApprovalParams(mode) {
+    if (mode === "plan")
+        return {
+            thread: { approvalPolicy: "never", approvalsReviewer: "user", sandbox: "read-only" },
+            turn: { approvalPolicy: "never", approvalsReviewer: "user", sandboxPolicy: { type: "readOnly" } },
+        };
+    if (mode === "full") {
+        return {
+            thread: {
+                approvalPolicy: "never",
+                approvalsReviewer: "user",
+                sandbox: "danger-full-access",
+            },
+            turn: {
+                approvalPolicy: "never",
+                approvalsReviewer: "user",
+                sandboxPolicy: { type: "dangerFullAccess" },
+            },
+        };
+    }
+    return {
+        thread: {
+            approvalPolicy: "on-request",
+            approvalsReviewer: mode === "auto" ? "auto_review" : "user",
+            sandbox: "workspace-write",
+        },
+        turn: {
+            approvalPolicy: "on-request",
+            approvalsReviewer: mode === "auto" ? "auto_review" : "user",
+            sandboxPolicy: { type: "workspaceWrite" },
+        },
+    };
+}