@chibitek/chibi 0.1.168 → 0.1.170

package/dist-server/server/drivers/codex.js

@@ -1,3 +1,4 @@
+import { namedApprovalParams } from "./codex-approval-presets.js";
 import { codexToolSurfaceArgs } from "./codex-tool-surface.js";
 import { codexImage } from "./codex-image.js";
 // Official Codex app-server over newline-delimited JSON-RPC on stdio.
@@ -183,40 +184,6 @@ function additionalPermissionSummary(permissions, reason) {
 const plainRecord = (value) => value && typeof value === "object" && !Array.isArray(value)
     ? value
     : null;
-/** Codex persists these values on its native thread. Keep them explicit on
- * start, resume, and every turn so switching modes cannot leave a more
- * permissive sandbox/reviewer stuck to the next request. */
-/** Ask and Edits both run Codex's workspace-write sandbox with the person as
- * reviewer: Codex has no narrower "edits only" mode, so the selector never
- * offers Edits for it (supportsApprovalMode) and a stray value asks. */
-function namedApprovalParams(mode) {
-    if (mode === "full") {
-        return {
-            thread: {
-                approvalPolicy: "never",
-                approvalsReviewer: "user",
-                sandbox: "danger-full-access",
-            },
-            turn: {
-                approvalPolicy: "never",
-                approvalsReviewer: "user",
-                sandboxPolicy: { type: "dangerFullAccess" },
-            },
-        };
-    }
-    return {
-        thread: {
-            approvalPolicy: "on-request",
-            approvalsReviewer: mode === "auto" ? "auto_review" : "user",
-            sandbox: "workspace-write",
-        },
-        turn: {
-            approvalPolicy: "on-request",
-            approvalsReviewer: mode === "auto" ? "auto_review" : "user",
-            sandboxPolicy: { type: "workspaceWrite" },
-        },
-    };
-}
 /** Linked repos besides the working folder become extra writable roots of
  * Codex's workspace-write sandbox (the app-server's equivalent of the CLI's
  * --add-dir). Full access already reaches them; read-only and a named
@@ -559,6 +526,9 @@ export const CodexDriver = {
             // instance's legacy fullAuto setting. Harness turns always send an
             // explicit mode, which takes precedence.
             const approvalMode = turn.approvalMode ?? (config.fullAuto ? "full" : "ask");
+            // Plan has no MCP/harness tools, even when a user opted into native MCP.
+            if (approvalMode === "plan")
+                turn = { ...turn, integrations: undefined, mcpFromUserConfig: false };
             // The person's servers this turn mounts. One that would clobber a
             // harness-owned variable is left out, not fatal: the rest still mount.
             const customServers = {};
@@ -627,7 +597,7 @@ export const CodexDriver = {
                 // The harness's own mounts above are never switched off by this.
                 if (!turn.mcpFromUserConfig) {
                     const harnessMounts = new Set(["openmausbot_connectors", "atomic_accounts", "agents", "computer", "browser", "openmausbot_phone"]);
-                    appServerArgs.push(...codexUserMcpOffArgs(new Map([...declaredInCodexConfig].filter(([name]) => !harnessMounts.has(name)))));
+                    appServerArgs.push(...codexUserMcpOffArgs(new Map([...declaredInCodexConfig].filter(([name]) => approvalMode === "plan" || !harnessMounts.has(name)))));
                     // Same rule for the person's plugins (a `git ls-remote` per Git
                     // marketplace at every start) and personal skills (listed in the
                     // model's context on every call). Sign-in is untouched.
@@ -656,6 +626,8 @@ export const CodexDriver = {
                     const prefix = "mcp_servers.openmausbot_phone";
                     appServerArgs.push("-c", `${prefix}.command=${JSON.stringify(bridge.command)}`, "-c", `${prefix}.args=${JSON.stringify(bridge.args)}`, "-c", `${prefix}.env_vars=${JSON.stringify(Object.keys(bridge.env))}`, "-c", `${prefix}.default_tools_approval_mode="auto"`);
                 }
+                if (approvalMode === "plan")
+                    appServerArgs.push("-c", 'web_search="disabled"', "-c", "features.apps=false", "-c", "features.multi_agent=false");
                 const child = spawnCli(config.cli, appServerArgs, {
                     cwd: childCwd,
                     env,
@@ -925,6 +897,10 @@ export const CodexDriver = {
                             : isAdditionalPermission
                                 ? { permissions: allow ? grantedPermissions(params.permissions) : {}, scope: "turn" }
                                 : { decision: allow ? (legacy ? "approved" : "accept") : legacy ? "denied" : "decline" };
+                    if (approvalMode === "plan" && isPermission) {
+                        send({ jsonrpc: "2.0", id: msg.id, result: permissionResult(false) });
+                        return;
+                    }
                     if (autoAcceptPermissions && isPermission && !serverConfirm) {
                         return send({
                             jsonrpc: "2.0",

package/dist-server/server/drivers/openai-chat.js

@@ -1,3 +1,4 @@
+import { PLAN_REFUSAL } from "../plan-policy.js";
 import { newEventId, newId } from "../contracts.js";
 import { redactSecretsInText } from "../redact.js";
 import { toolDetailPreview } from "../tool-summary.js";
@@ -423,8 +424,8 @@ export function createOpenAIChatRuntime(options) {
                             // so it is honoured here: without it every single tool call on
                             // an OpenAI-compatible engine stops for a card, and a Chief's
                             // delegated Full access cannot help either.
-                            const allowed = turn.approvalMode === "full"
-                                || await approval.ask(call.function.name, inputPreview ?? "This tool has no arguments.", tools.customTool?.(call.function.name));
+                            const allowed = (turn.approvalMode !== "plan" || tools.planReadOnly?.(call.function.name) === true) && (turn.approvalMode === "full"
+                                || await approval.ask(call.function.name, inputPreview ?? "This tool has no arguments.", tools.customTool?.(call.function.name)));
                             abort.signal.throwIfAborted();
                             emit({ ...base(turn.threadId, turnId), type: "item.started", itemType: "tool", itemId: call.id,
                                 title: call.function.name, ...(inputPreview ? { input: inputPreview } : {}),
@@ -444,7 +445,7 @@ export function createOpenAIChatRuntime(options) {
                             }
                             else {
                                 denials.push(call.function.name);
-                                result = { ok: false, text: "Permission denied or expired; the tool was not executed." };
+                                result = { ok: false, text: turn.approvalMode === "plan" && tools.planReadOnly?.(call.function.name) !== true ? PLAN_REFUSAL : "Permission denied or expired; the tool was not executed." };
                             }
                         }
                         catch (error) {

package/dist-server/server/hooks/plan-hook.js

@@ -0,0 +1,17 @@
+// Atomic Engineering, 2026-10-31. Claude PreToolUse Plan guard.
+import { readFileSync } from "node:fs";
+import { planToolAllowed, PLAN_REFUSAL } from "../plan-policy.js";
+try {
+    const event = JSON.parse(readFileSync(0, "utf8"));
+    if (event.hook_event_name === "PreToolUse" && planToolAllowed(event.tool_name)) {
+        // No permission override: reads still obey Claude's normal access checks.
+    }
+    else {
+        process.stderr.write(PLAN_REFUSAL);
+        process.exitCode = 2;
+    }
+}
+catch {
+    process.stderr.write(PLAN_REFUSAL);
+    process.exitCode = 2;
+}

package/dist-server/server/index.js

@@ -34,7 +34,7 @@ import { CLOUD_COMPUTER_BUSY_ERROR } from "../shared/computer-contention.js";
 import { approvalModeFor, supportsApprovalMode, modelSwitchNeedsAsk, isEmergencyApprovalDowngrade, isApprovalMode, } from "../shared/approval-mode.js";
 import { escapeAttribute } from "../src/lib/composer-attachments.js";
 import { credentialResumeOutcome, credentialIsConfigured, isCredentialTargetId, } from "../shared/credential-request.js";
-import { approvalHeldNote, approvalHeldReason, approvalModeForOrigin, autoVerdict, deliverFullAccessApproval, delegationInheritsFullAccess } from "./auto-approve.js";
+import { approvalHeldNote, approvalHeldReason, autoVerdict, deliverFullAccessApproval, delegationInheritsFullAccess } from "./auto-approve.js";
 import { updateClaudeCli } from "./claude-update.js";
 import { failedRunDetail } from "./turn-failure.js";
 import { configuredAccountDirectory, assertSeparateClaudeAccount, claudeAccountInfo, createClaudeAccountSchema, instanceSettingsSchema, newClaudeAccount } from "./claude-accounts.js";
@@ -99,6 +99,7 @@ import { decodeGeneratedImage } from "./generated-image.js";
 import { MAX_MCP_SERVERS, listMcpServers, mcpServerNameError, parseMcpServerMutation, parseMcpServersImport, parseStoredMcpServer, isRemoteMcpServer, mcpReadOnlyAutoAllow, } from "./mcp-registry.js";
 import { mcpLaunchBlocker, mcpLaunchBlockerReason, mcpSecretStorage, mcpServerSecretView, moveParkedArgToEnv, receiveMcpSecretsSaveResult, setMcpSecretSender, storeMcpServerSecrets, } from "./mcp-secrets.js";
 import { probeMcpServer } from "./mcp-probe.js";
+import { createInteractiveMcpProbe } from "./mcp-interactive-probe.js";
 import { McpToolHintStore, readOnlyToolAllowed } from "./mcp-tool-hints.js";
 import { McpAuthStateStore } from "./mcp-auth-state.js";
 import { McpHealthStore } from "./mcp-health.js";
@@ -251,6 +252,7 @@ import { PHONE_SECRET_PROTOCOL_VERSION, PhoneSecretBridge, PhoneSecretError, Pho
 // Keep these two last: a route module may import any server module, and
 // loading the table after everything above leaves module start-up order as is.
 import { json, onJsonBody, parsedBodyOf, readBody } from "./harness/http.js";
+import { BotWorkModes, createBotWorkModeRoutes, ownBotApprovalMode, legacyGodModeCovers, dispatchWorkMode, trustedPlanChangeForStore, invalidAllThreadScope } from "./bot-work-modes.js";
 import { ROUTES, dispatchRoutes } from "./routes/table.js";
 import { createThreadStopRoutes } from "./routes/thread-stop.js";
 import { createThreadImageRoutes } from "./routes/thread-images.js";
@@ -4171,8 +4173,8 @@ function checkedTaskModelSwitch(current, raw, updateBotDefault, resetApprovalToA
     }
     for (const target of updateBotDefault ? [current, profile] : [current]) {
         const mode = approvalModeFor(target);
-        if (resetApprovalToAsk && mode === "custom" && !trusted) {
-            return { ok: false, status: 403, error: "Leaving Custom approval requires confirmation in the packaged desktop app" };
+        if (resetApprovalToAsk && (mode === "plan" || (mode === "custom" && !trusted))) {
+            return { ok: false, status: 403, error: "Approve the plan or change Custom permissions in the app before switching models" };
         }
         if (!resetApprovalToAsk && modelSwitchNeedsAsk(mode, registry.cliTarget(target.modelSelection.instanceId)?.driverKind, registry.cliTarget(checked.selection.instanceId)?.driverKind)) {
             return { ok: false, status: 400, error: "Confirm switching this model with Ask permissions first (resetApprovalToAsk)" };
@@ -4324,7 +4326,7 @@ const wireBot = (bot) => {
     const visible = approvalGrant && !approvalGrant.threadOnly
         ? { ...rest, approvalMode: "ask", autoApprove: false }
         : rest;
-    return { ...visible, waitingForTeammates: activeCoordinationForThread(bot.threadId) && !threadBusy(bot.id, bot.threadId),
+    return { ...visible, workMode: godModeCovers(bot) ? "full" : botWorkModes.permits(approvalModeFor(visible)) ? approvalModeFor(visible) : "ask", workModeWorkspaceOverride: godModeCovers(bot), waitingForTeammates: activeCoordinationForThread(bot.threadId) && !threadBusy(bot.id, bot.threadId),
         screenLive: screenLiveForBot(bot.id), avatarUrl: visible.avatarUrl ?? null, ...(tasks ? { tasks: tasks.map(wireTask) } : {}) };
 };
 /** The correlated private response carries the requested value so Electron
@@ -4450,7 +4452,7 @@ async function botOverview(bot) {
             autoApprove: bot.autoApprove,
             approvalMode: approvalModeForTurn(bot),
             // GOD MODE skips the peer check for every bot, whatever its engine
-            approvePeerComms: bot.approvePeerComms && !godModeActive(),
+            approvePeerComms: bot.approvePeerComms && !godModeCovers(bot),
             peers: bot.peers,
             browser: bot.browser,
             chiefOfStaff: bot.chiefOfStaff,
@@ -4489,36 +4491,15 @@ async function botOverview(bot) {
         recent,
     });
 }
-/** Defense in depth for hand-edited/corrupt durable records: elevated
- * approval semantics require an implemented provider mapping. The trusted transition enforces
- * this too, but no provider dispatch or later permission callback relies on
- * persistence having been produced exclusively by that route. Delegation
- * uses the receiving bot's grant, never the sender's (approvalModeForOrigin) —
- * with one deliberate exception: a Chief of Staff with Full access makes the
- * threads it delegates Full too (delegatedFullAccess), so the grant the
- * person gave the Chief covers the work the Chief hands out. */
+// Enforce engine permissions on every turn, including delegated work.
+const botWorkModes = new BotWorkModes(join(DATA_DIR, "bot-work-modes.json"));
+for (const id of botWorkModes.expired(id => sessions.isLive(id)))
+    store.setAllThreadApprovalMode(id, "ask", true);
 const approvalModeForTurn = (bot, peerInitiated = false) => godModeElevates(bot) ? "full" : ownApprovalModeForTurn(bot, peerInitiated);
 /** The bot's (or thread's) own level for a turn, GOD MODE aside. */
-const ownApprovalModeForTurn = (bot, peerInitiated = false) => {
-    const mode = approvalModeForOrigin(approvalModeFor(bot), { peerInitiated });
-    if (!supportsApprovalMode(registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, mode)) {
-        return "ask";
-    }
-    return mode;
-};
-/** GOD MODE covers this bot or thread: the switch is on, this server allows
- * it, and no approval change of this bot's own is still being confirmed
- * (approvalModeFor keeps that inert as Ask, and so does GOD MODE). It is
- * decided per request and never written to a bot record, so turning it off
- * returns every bot to its own level. Every engine is covered: one that
- * implements Full runs its turns at Full (godModeElevates); on any other the
- * harness answers each tool permission request the engine sends
- * (request.opened), so no engine keeps asking under GOD MODE. */
+const ownApprovalModeForTurn = (bot, peerInitiated = false) => ownBotApprovalMode(bot, registry.cliTarget(bot.modelSelection.instanceId)?.driverKind, peerInitiated, botWorkModes.permits(approvalModeFor(bot)));
 function godModeCovers(bot) {
-    if (!godModeActive())
-        return false;
-    const grant = bot.approvalGrant;
-    return !(grant && !(grant.threadOnly && grant.threadId !== bot.threadId));
+    return legacyGodModeCovers(bot, godModeActive() && botWorkModes.permits("full"), botWorkModes.selected(bot.id) !== undefined);
 }
 /** GOD MODE runs this bot or thread at Full, whatever its own level says:
  * it is covered (godModeCovers) and its engine implements Full. */
@@ -4563,7 +4544,7 @@ function peerReviewRequired(bot, threadId) {
 /** "Ask me before contacting other bots" is skipped with Full access on the
  * source conversation, and for every bot while GOD MODE is on. */
 function peerApprovalWaived(botId, threadId) {
-    return godModeActive() || fullAccessForSource(botId, threadId);
+    return fullAccessForSource(botId, threadId) || Boolean(store.projectBotForTask(botId, threadId) && godModeCovers(store.projectBotForTask(botId, threadId)));
 }
 /** Full access flows down a Chief of Staff's delegation. The person gave the
  * Chief Full access so its work runs without prompts; a teammate stopping
@@ -4577,7 +4558,7 @@ function peerApprovalWaived(botId, threadId) {
 function delegatedFullAccess(from, fromThreadId, target) {
     // Chibi's GOD MODE never reaches the Private Bot, and the Private Bot's
     // never reaches Chibi: each runs a linked handoff at its own level.
-    if (isPersonalBot(from) !== isPersonalBot(target))
+    if (isPersonalBot(from) !== isPersonalBot(target) || approvalModeFor(target) === "plan")
         return false;
     return delegationInheritsFullAccess({
         senderIsChief: Boolean(from.chiefOfStaff),
@@ -4681,7 +4662,7 @@ function handleDesktopTrustedApprovalMessage(raw) {
     const grantBusy = (bot) => bot.approvalGrant?.threadOnly
         ? threadBusy(bot.id, bot.approvalGrant.threadId) : bot.busy ||
         Boolean(bot.approvalGrant?.allThreads && store.tasks(bot.id).some(task => threadBusy(bot.id, task.threadId)));
-    const grantSupported = (bot, mode) => supportsApprovalMode(registry.cliTarget(grantTarget(bot)?.modelSelection.instanceId ?? "")?.driverKind, mode) &&
+    const grantSupported = (bot, mode) => botWorkModes.permits(mode) && supportsApprovalMode(registry.cliTarget(grantTarget(bot)?.modelSelection.instanceId ?? "")?.driverKind, mode) &&
         (!bot.approvalGrant?.allThreads || store.tasks(bot.id).every(task => supportsApprovalMode(registry.cliTarget((task.modelSelection ?? bot.modelSelection).instanceId)?.driverKind, mode)));
     const clearGrant = (bot) => store.patchBot(bot.id, {
         ...(!bot.approvalGrant?.threadOnly ? { approvalMode: "ask", autoApprove: false } : {}),
@@ -4896,6 +4877,10 @@ function handleDesktopTrustedApprovalMessage(raw) {
         respond({ ok: false, error: "The approval mode is invalid" });
         return true;
     }
+    if (!botWorkModes.permits(mode)) {
+        respond({ ok: false, error: "This mode is disabled in Settings" });
+        return true;
+    }
     const existing = store.bot(botId);
     if (!existing) {
         respond({ ok: false, error: "No such bot" });
@@ -4903,15 +4888,16 @@ function handleDesktopTrustedApprovalMessage(raw) {
     }
     const currentMode = approvalModeFor(existing);
     const threadId = message.threadId;
-    if (message.allThreads !== undefined && (typeof message.allThreads !== "boolean" ||
-        (message.allThreads && (threadId !== undefined || message.threadOnly === true ||
-            message.modelSelection !== undefined || message.updateBotDefault !== undefined ||
-            (mode !== "full" && mode !== "ask"))))) {
+    if (!trustedPlanChangeForStore(store, botId, mode, message)) {
+        respond({ ok: false, error: "Approve the plan in the app before leaving Plan" });
+        return true;
+    }
+    if (invalidAllThreadScope(mode, message)) {
         respond({ ok: false, error: "Invalid all-threads approval scope" });
         return true;
     }
     if (message.allThreads === true && mode === "ask") {
-        const updated = store.setAllThreadApprovalMode(botId, "ask");
+        const updated = store.setAllThreadApprovalMode(botId, "ask", message.approvePlan !== true);
         void stopBotForEmergencyApprovalDowngrade(botId).then(() => respond({ ok: true, bot: wireBot(store.bot(botId) ?? updated) }), () => respond({ ok: false, error: "Approval was reset to Ask, but an active turn could not be stopped" }));
         return true;
     }
@@ -6048,6 +6034,10 @@ function closeSessionStreams(sessionId) {
 }
 sessions.onSessionRevoked((sessionId) => {
     providerAuthSessions.revokeOwner(sessionId);
+    for (const id of botWorkModes.revoke(sessionId)) {
+        store.setAllThreadApprovalMode(id, "ask", true);
+        void interruptBotWork(id);
+    }
     closeSessionStreams(sessionId);
 });
 /** Every frame is numbered, and the last few hundred are kept, so a client
@@ -10817,7 +10807,7 @@ async function startTurn(botId, text, opts) {
                 text: dispatchContext.turnText,
                 refreshSystemPrompt: true,
                 images: turnImages,
-                approvalMode: approvalModeForTurn(bot, commsDepth > 0),
+                approvalMode: dispatchWorkMode(approvalModeForTurn(bot, commsDepth > 0), registry.cliTarget(instance.instanceId)?.driverKind),
                 model,
                 effort,
                 variant,
@@ -12769,7 +12759,7 @@ failover) {
                 text,
                 refreshSystemPrompt: true,
                 images: turnImages,
-                approvalMode: roomTurnApprovalMode(readyBot, orchestration),
+                approvalMode: dispatchWorkMode(roomTurnApprovalMode(readyBot, orchestration), registry.cliTarget(instance.instanceId)?.driverKind),
                 system: roomSystem.text,
                 systemStable: roomSystem.stable,
                 systemVolatile: roomSystem.volatile,
@@ -13610,8 +13600,9 @@ function handoffAuthorizations(from, sourceThreadId, raw) {
         conversationBotName: from.name,
     });
 }
-/** How long "Sign in" on a bridge server waits for the person's browser sign-in. */
-const MCP_SIGN_IN_TIMEOUT_MS = 180_000;
+/** Test and Reconnect share a single browser-allowed probe per connection.
+ * Bot MCP sessions remain independent to preserve request routing. */
+const interactiveMcpProbe = createInteractiveMcpProbe();
 /** The interview's view of this computer (GET /api/bot-interview/context):
  * only tools that exist here, each with a plain status. The Personal Bot
  * sees only connections marked Personal; a company bot never sees those. */
@@ -16043,6 +16034,24 @@ ROUTES.push(createMcpMarketplaceRoutes({
     fromBot: (req) => authorizedInternalCapability(req.headers.authorization) !== null,
     sessionExpired: (auth) => auth.kind === "session" && !sessions.isLive(auth.session.id),
 }));
+ROUTES.push(createBotWorkModeRoutes({
+    modes: botWorkModes, desktopManaged: DESKTOP_MANAGED, live: id => sessions.isLive(id),
+    bot: id => {
+        const bot = store.bot(id);
+        if (!bot)
+            return undefined;
+        const targets = [bot, ...store.tasks(id).map(task => store.projectBotForTask(id, task.threadId)).filter(Boolean)];
+        return { busy: targets.some(target => threadBusy(id, target.threadId)),
+            revision: JSON.stringify(targets.map(target => [target.threadId, target.modelSelection, target.approvalMode, target.approvalGrant, store.messagesFor(target.threadId).at(-1)?.id])),
+            drivers: targets.map(target => registry.cliTarget(target.modelSelection.instanceId)?.driverKind),
+            current: targets.some(target => approvalModeFor(target) === "plan") ? "plan" : wireBot(bot).workMode ?? "ask" };
+    },
+    stop: interruptBotWork,
+    apply: (id, mode, preservePlan) => { store.setAllThreadApprovalMode(id, mode, preservePlan); },
+    affected: allowed => store.bots.filter(bot => [bot, ...store.tasks(bot.id).map(task => store.projectBotForTask(bot.id, task.threadId)).filter(Boolean)].some(target => ![...allowed, "auto", "custom", "plan"].includes(godModeCovers(target) ? "full" : approvalModeFor(target)))).map(bot => bot.id),
+    changed: id => { const bot = store.bot(id); if (bot)
+        broadcast({ kind: "bot", bot: wireBot(bot) }); },
+}));
 // Settings → AI & accounts → Local models: Ollama's models, pulls and removals.
 ROUTES.push(createLocalModelRoutes({
     ollamaUrl: process.env.OMB_OLLAMA_URL || undefined,
@@ -21283,8 +21292,12 @@ const handleRequest = async (req, res) => {
             else {
                 requestedApprovalMode = approvalModeFor(existingBot ?? {});
             }
+            if (!botWorkModes.permits(requestedApprovalMode))
+                return json(res, 403, { error: "This mode is disabled in Settings" });
             const currentApprovalMode = approvalModeFor(existingBot ?? {});
             const approvalChangeRequested = body.approvalMode !== undefined || body.autoApprove !== undefined;
+            if (currentApprovalMode === "plan" && requestedApprovalMode !== "plan")
+                return json(res, 403, { error: "Approve the plan in the app before leaving Plan" });
             if (existingBot?.busy && approvalChangeRequested && requestedApprovalMode !== currentApprovalMode) {
                 return json(res, 409, {
                     error: "stop this bot's turn before changing its approval level",
@@ -21299,13 +21312,13 @@ const handleRequest = async (req, res) => {
             const targetSelection = normalizedSelection ?? existingBot?.modelSelection;
             if (normalizedSelection && selectedTask) {
                 const mode = approvalModeFor(selectedTask);
-                if ((mode === "full" || mode === "custom") &&
+                if ((mode === "full" || mode === "custom" || mode === "plan") &&
                     (!supportsApprovalMode(registry.cliTarget(normalizedSelection.instanceId)?.driverKind, mode) ||
                         registry.cliTarget(normalizedSelection.instanceId)?.driverKind !== registry.cliTarget(selectedTask.modelSelection.instanceId)?.driverKind)) {
                     return json(res, 400, { error: "Choose Ask for the selected thread before changing providers with elevated permissions" });
                 }
             }
-            if ((requestedApprovalMode === "full" || requestedApprovalMode === "custom") &&
+            if ((requestedApprovalMode === "full" || requestedApprovalMode === "custom" || requestedApprovalMode === "plan") &&
                 (body.approvalMode !== undefined || normalizedSelection !== undefined) &&
                 (!targetSelection || !supportsApprovalMode(registry.cliTarget(targetSelection.instanceId)?.driverKind, requestedApprovalMode) ||
                     (existingBot && normalizedSelection && registry.cliTarget(normalizedSelection.instanceId)?.driverKind !== registry.cliTarget(existingBot.modelSelection.instanceId)?.driverKind))) {
@@ -23009,14 +23022,19 @@ const handleRequest = async (req, res) => {
                 if (!checked.ok)
                     return json(res, checked.status, { error: checked.error });
                 patch.modelSelection = checked.selection;
+                if (approvalModeFor(current) === "plan" && !supportsApprovalMode(registry.cliTarget(checked.selection.instanceId)?.driverKind, "plan"))
+                    return json(res, 400, { error: "Choose Ask before switching from Plan to this engine" });
             }
             if (body.approvalMode !== undefined || body.autoApprove !== undefined) {
                 if (body.autoApprove !== undefined && typeof body.autoApprove !== "boolean")
                     return json(res, 400, { error: "autoApprove must be a boolean" });
                 const mode = body.approvalMode ?? (body.autoApprove ? "auto" : "ask");
-                // Elevated modes still require the trusted desktop transition. A
-                // thread settings PATCH cannot manufacture that grant.
-                if (mode !== "ask" && mode !== "auto" && mode !== "edits")
+                if (!botWorkModes.permits(mode))
+                    return json(res, 403, { error: "This mode is disabled in Settings" });
+                if (approvalModeFor(current) === "plan" && mode !== "plan")
+                    return json(res, 403, { error: "Approve the plan in the app before leaving Plan" });
+                // A settings PATCH cannot manufacture an elevated grant.
+                if (mode !== "ask" && mode !== "auto" && mode !== "edits" && mode !== "plan")
                     return json(res, 403, { error: "Full and Custom access require trusted desktop confirmation" });
                 if (approvalModeFor(current) === "custom")
                     return json(res, 403, { error: "Leaving Custom approval requires confirmation in the packaged desktop app" });
@@ -23995,7 +24013,7 @@ const handleRequest = async (req, res) => {
             const testBlocked = mcpLaunchBlocker(parsed.server);
             if (testBlocked)
                 return json(res, 409, { error: `${mcpTest[1]} cannot start yet: ${mcpLaunchBlockerReason(testBlocked)}`, code: testBlocked });
-            if (mcpProbesInFlight >= MAX_CONCURRENT_MCP_PROBES) {
+            if (mcpProbesInFlight >= MAX_CONCURRENT_MCP_PROBES && !interactiveMcpProbe.has(bridgedMcpServer(parsed.server, true))) {
                 return json(res, 429, { error: "Two MCP connection tests are already running." });
             }
             const controller = new AbortController();
@@ -24006,11 +24024,9 @@ const handleRequest = async (req, res) => {
             res.once("close", disconnect);
             mcpProbesInFlight += 1;
             try {
-                // `?connect=1`: the person's own sign-in through a bridge's browser
-                // page (Mochii, Nexus). It waits for them, not for a machine.
-                const connecting = url.searchParams.get("connect") === "1";
-                // A person's click: the one start besides Reconnect that may open a browser.
-                const probed = await probeMcpServer(bridgedMcpServer(parsed.server, true), connecting ? MCP_SIGN_IN_TIMEOUT_MS : undefined, controller.signal);
+                // Test may open a browser even without ?connect=1. Keep its callback
+                // listener alive for the same MFA window as Reconnect.
+                const probed = await interactiveMcpProbe(bridgedMcpServer(parsed.server, true), controller.signal);
                 if (probed.ok) {
                     mcpAuthState.noteOk(mcpTest[1]);
                     mcpHealth.noteOk(mcpTest[1]);
@@ -24049,7 +24065,7 @@ const handleRequest = async (req, res) => {
             const reconnectBlocked = mcpLaunchBlocker(parsed.server);
             if (reconnectBlocked)
                 return json(res, 409, { error: `${name} cannot start yet: ${mcpLaunchBlockerReason(reconnectBlocked)}`, code: reconnectBlocked });
-            if (mcpProbesInFlight >= MAX_CONCURRENT_MCP_PROBES) {
+            if (mcpProbesInFlight >= MAX_CONCURRENT_MCP_PROBES && !interactiveMcpProbe.has(bridgedMcpServer(parsed.server, true))) {
                 return json(res, 429, { error: "Two MCP connection tests are already running." });
             }
             const controller = new AbortController();
@@ -24060,7 +24076,7 @@ const handleRequest = async (req, res) => {
             res.once("close", disconnect);
             mcpProbesInFlight += 1;
             try {
-                const probed = await probeMcpServer(bridgedMcpServer(parsed.server, true), MCP_SIGN_IN_TIMEOUT_MS, controller.signal);
+                const probed = await interactiveMcpProbe(bridgedMcpServer(parsed.server, true), controller.signal);
                 if (probed.ok) {
                     mcpAuthState.noteOk(name);
                     mcpHealth.noteOk(name);

package/dist-server/server/mcp-interactive-probe.js

@@ -0,0 +1,60 @@
+// One browser-allowed probe per resolved connection. Bot MCP sessions remain
+// independent: sharing those would misroute server-initiated requests.
+import { createHash } from "node:crypto";
+import { probeMcpServer } from "./mcp-probe.js";
+import { MCP_SIGN_IN_TIMEOUT_MS } from "./mcp-remote-bridge.js";
+const cancelled = () => ({ ok: false, error: "Connection test was cancelled." });
+function connectionKey(spec) {
+    // Include every resolved argument and credential value, never just the
+    // display name/URL. Only a digest is retained as the map key, never logged.
+    return createHash("sha256").update(JSON.stringify(spec, (_key, value) => {
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+            return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)));
+        }
+        return value;
+    })).digest("hex");
+}
+export function createInteractiveMcpProbe(probe = probeMcpServer) {
+    const pending = new Map();
+    const run = (spec, signal) => {
+        if (signal?.aborted)
+            return Promise.resolve(cancelled());
+        const key = connectionKey(spec);
+        let entry = pending.get(key);
+        if (!entry) {
+            const controller = new AbortController();
+            entry = { controller, result: Promise.resolve().then(() => probe(spec, MCP_SIGN_IN_TIMEOUT_MS, controller.signal)), callers: 0 };
+            pending.set(key, entry);
+            const current = entry;
+            const clear = () => { if (pending.get(key) === current)
+                pending.delete(key); };
+            void current.result.then(clear, clear);
+        }
+        const current = entry;
+        current.callers += 1;
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const release = () => {
+                if (settled)
+                    return false;
+                settled = true;
+                signal?.removeEventListener("abort", abort);
+                current.callers -= 1;
+                if (!current.callers && pending.get(key) === current) {
+                    pending.delete(key);
+                    current.controller.abort();
+                }
+                return true;
+            };
+            const abort = () => { if (release())
+                resolve(cancelled()); };
+            signal?.addEventListener("abort", abort, { once: true });
+            void current.result.then((result) => { if (release())
+                resolve(result); }, (error) => { if (release())
+                reject(error); });
+            if (signal?.aborted)
+                abort();
+        });
+    };
+    return Object.assign(run, { has: (spec) => pending.has(connectionKey(spec)) });
+}

package/dist-server/server/mcp-remote-bridge.js

@@ -19,6 +19,7 @@ import { basename, dirname } from "node:path";
 /** The bundled bridge's exit code when it needed a browser sign-in and was
  * told not to open one (EX_NOPERM). */
 export const MCP_SIGN_IN_REQUIRED_EXIT = 77;
+export const MCP_SIGN_IN_TIMEOUT_MS = 300_000;
 /** Set on a bridge's environment: never open a browser, exit instead. */
 export const MCP_NO_BROWSER_ENV = "ATOMIC_MCP_NO_BROWSER";
 /** The line the bundled bridge writes to stderr before that exit. */
@@ -63,6 +64,13 @@ export function bridgeMcpRemote(spec, options) {
     const target = mcpRemoteTarget(spec);
     if (!target)
         return spec;
+    // A stable redirect host prevents saved OAuth clients becoming invalid when
+    // an upstream/platform default changes. Preserve an explicitly configured host.
+    const extraArgs = target.extraArgs.includes("--host")
+        ? [...target.extraArgs]
+        : [...target.extraArgs, "--host", "localhost"];
+    if (!extraArgs.includes("--auth-timeout"))
+        extraArgs.push("--auth-timeout", String(MCP_SIGN_IN_TIMEOUT_MS / 1_000));
     const noBrowser = options.allowBrowser ? {} : { [MCP_NO_BROWSER_ENV]: "1" };
     const env = { ...spec.env };
     // A stale flag from an older start must not outlive a person's click.
@@ -71,16 +79,15 @@ export function bridgeMcpRemote(spec, options) {
     // A bundled entry keeps its own script: the desktop app already repoints
     // it at the current Resources copy on launch (electron/chibitek-defaults.mjs).
     if (target.bundled)
-        return { ...spec, env: { ...env, ...noBrowser } };
-    // Without a built bridge the npx form stays as configured: it may still
-    // open a browser, which is what this release did before. Never silently
-    // drop a server the person added.
+        return { ...spec, args: [spec.args[0], target.url, ...extraArgs], env: { ...env, ...noBrowser } };
+    // Keep the redirect stable even in a dev checkout without a built bridge.
+    // The unbundled command retains its existing browser behavior.
     if (!options.bridge)
-        return spec;
+        return { ...spec, args: [...spec.args.slice(0, spec.args.length - target.extraArgs.length), ...extraArgs] };
     return {
         ...spec,
         command: options.execPath,
-        args: [options.bridge, target.url, ...target.extraArgs],
+        args: [options.bridge, target.url, ...extraArgs],
         env: { ...env, ELECTRON_RUN_AS_NODE: "1", ...noBrowser },
     };
 }

package/dist-server/server/plan-policy.js

@@ -0,0 +1,14 @@
+// Atomic Engineering, 2026-10-31. Harness-owned Plan tool policy.
+// Unknown tools, MCP annotations and shell command strings are never trusted.
+export const PLAN_READ_TOOLS = ["Read", "Glob", "Grep"];
+export const PLAN_REFUSAL = "Plan mode blocked this action. Review the plan and approve it in Atomic before making changes.";
+export function planToolAllowed(tool) {
+    return typeof tool === "string" && PLAN_READ_TOOLS.includes(tool);
+}
+export function claudePlanHook(node, helper) {
+    const quote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
+    const command = process.platform === "win32"
+        ? '"%OMB_PLAN_NODE%" "%OMB_PLAN_HOOK%" || exit /b 2'
+        : `${quote(node)} ${quote(helper)} || exit 2`;
+    return [{ matcher: "", hooks: [{ type: "command", command, timeout: 5 }] }];
+}

package/dist-server/server/proxy-paths.js

@@ -44,6 +44,7 @@ export const SPAWNED_PROXIES = {
     hook: resolveProxy("hooks/omb-hook"),
     // the RTK add-on's Claude PreToolUse hook (bypassPermissions turns only)
     rtkHook: resolveProxy("hooks/rtk-hook"),
+    planHook: resolveProxy("hooks/plan-hook"),
     // Loaded by the external `pi` process via `-e`, not by this server — but
     // resolved through the same single source of truth so the packaged layout
     // check can assert it ships.

package/dist-server/server/store.js

@@ -2618,16 +2618,16 @@ export class Store {
         return task;
     }
     /** One durable write: never leave only part of a bot's threads updated. */
-    setAllThreadApprovalMode(botId, mode) {
+    setAllThreadApprovalMode(botId, mode, preservePlan = false) {
         const bot = this.bot(botId);
         if (!bot)
             return null;
         const patch = { approvalMode: mode, autoApprove: false, alwaysAllow: [] };
-        const tasks = (bot.tasks ?? []).map(task => ({ ...task, ...patch }));
-        const next = { ...bot, ...patch, approvalGrant: undefined, tasks };
+        const tasks = (bot.tasks ?? []).map(task => preservePlan && approvalModeFor(this.projectBotForTask(botId, task.threadId)) === "plan" ? { ...task } : { ...task, ...patch });
+        const next = { ...bot, ...(preservePlan && approvalModeFor(bot) === "plan" ? {} : patch), approvalGrant: undefined, tasks };
         this.saveBots(this.bots.map(candidate => candidate === bot ? next : candidate));
         bot.tasks?.forEach((task, index) => Object.assign(task, tasks[index]));
-        Object.assign(bot, patch, { approvalGrant: undefined });
+        Object.assign(bot, { ...next, tasks: bot.tasks });
         this.emit({ type: "bot", botId });
         return bot;
     }

package/dist-server/shared/approval-mode.js

@@ -2,13 +2,15 @@
  * permission mode, passed through: OpenMausBot never decides a permission
  * itself (Full access aside, which answers residual prompts because that is
  * what the person granted). The order is the order the selector shows. */
-export const APPROVAL_MODES = ["ask", "edits", "auto", "full", "custom"];
+export const APPROVAL_MODES = ["ask", "edits", "auto", "full", "custom", "plan"];
 /** Only providers with an implemented permission mapping may expose a level.
  * `edits` (auto-accept edits) exists where the engine has such a mode:
  * Claude and Grok `acceptEdits`, Antigravity `auto_edit`, Qwen `auto-edit`,
  * Gemini `auto_edit`, Mistral Vibe `accept-edits`. Codex's Ask already runs `workspace-write`, so an edits
  * level would change nothing there. */
 export function supportsApprovalMode(driverKind, mode) {
+    if (mode === "plan")
+        return ["atomicEngine", "codex", "claudeAgent", "grok", "openai-compat", "minimax", "mistral", "ollamaCloud"].includes(driverKind ?? "");
     if (mode === "custom")
         return driverKind === "codex";
     if (mode === "edits")

package/dist-server/shared/engine-choices.js

@@ -127,7 +127,7 @@ export function engineBrand(engine) {
         const name = engine.managed?.organizationName?.trim() || (generic(engine.displayName) ? "OpenAI-compatible endpoint" : engine.displayName.trim());
         return { key: `endpoint:${name.toLowerCase()}`, name, group: "flatPlans" };
     }
-    if (engine.driverKind === "customAcp") {
+    if (["customAcp", "atomicEngine"].includes(engine.driverKind)) {
         if (engine.instanceId === ATOMIC_ENGINE_ID || /^atomic engine$/i.test(engine.displayName.trim()))
             return { key: "atomic-engine", name: "Atomic Engine", group: "atomic" };
         const name = generic(engine.displayName) ? "Custom agent" : engine.displayName.trim();