@gavin-hu/my-pi-agent 0.19.0 → 0.20.0

package/extensions/file-browse/view/raw-html.ts

@@ -26,6 +26,7 @@
  */
 
 import { decodeCodePoint, escapeHtml } from "../../../lib/escape.ts";
+import { emitImage, emitImageLink, EXTERNAL_ATTRS } from "./emit.ts";
 import { resolveImage, resolveLink } from "./urls.ts";
 
 /** Elements re-emitted with sanitized attributes. */
@@ -139,6 +140,12 @@ const BLOCK_OPEN = /^ {0,3}<(\/?)([a-zA-Z][a-zA-Z0-9-]*)/;
 const COMMENT_OPEN = /^ {0,3}<!--/;
 const DECLARATION_OPEN = /^ {0,3}<[!?]/;
 /** The five XML references, plus numeric ones, are the only refs decoded in a value. */
+/**
+ * The five references an attribute value may carry, decoded.
+ *
+ * Not the Markdown renderer's table: a tag's attribute is not running text, and decoding
+ * `&nbsp;` or `&mdash;` inside one would invent characters the author did not write.
+ */
 const ATTRIBUTE_ENTITIES: Record<string, string> = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'" };
 const ATTRIBUTE_ENTITY = /&(?:#([0-9]{1,7})|#[xX]([0-9a-fA-F]{1,6})|([a-zA-Z]+));/g;
 
@@ -407,7 +414,7 @@ function sanitizeOpenTag(tag: RawTag, baseDir: string): string {
 			const target = href === undefined ? undefined : resolveLink(href, baseDir);
 			if (target !== undefined) {
 				out.push(` href="${escapeHtml(target.href)}"`);
-				if (target.external) out.push(' target="_blank" rel="noopener noreferrer"');
+				if (target.external) out.push(EXTERNAL_ATTRS);
 			}
 			break;
 		}
@@ -456,16 +463,14 @@ function sanitizeImage(tag: RawTag, baseDir: string): string {
 	const src = attribute(tag, "src");
 	const target = src === undefined ? undefined : resolveImage(src, baseDir);
 	if (target === undefined) return alt === "" ? "" : escapeHtml(alt);
-	if (!target.image) {
-		const label = alt === "" ? target.href : alt;
-		return `<a href="${escapeHtml(target.href)}" target="_blank" rel="noopener noreferrer">${escapeHtml(label)}</a>`;
-	}
-	const out: string[] = [` class="md-img" src="${escapeHtml(target.href)}" alt="${escapeHtml(alt)}"`];
-	const width = numeric(attribute(tag, "width"));
-	if (width !== undefined) out.push(` width="${width}"`);
-	const height = numeric(attribute(tag, "height"));
-	if (height !== undefined) out.push(` height="${height}"`);
-	const title = attribute(tag, "title");
-	if (title !== undefined) out.push(` title="${escapeHtml(title)}"`);
-	return `<img${out.join("")} loading="lazy" decoding="async">`;
+	if (!target.image) return emitImageLink(target.href, alt === "" ? target.href : alt);
+	// The element is `emit.ts`'s, so an `<img>` written as HTML and the same one written as
+	// Markdown are the same element, down to the lazy decoding.
+	return emitImage({
+		href: target.href,
+		alt,
+		title: attribute(tag, "title"),
+		width: numeric(attribute(tag, "width")),
+		height: numeric(attribute(tag, "height")),
+	});
 }

package/extensions/job/runtime.ts

@@ -29,6 +29,7 @@ import {
 	type KillTreeFn,
 	type SpawnedProcess,
 	type SpawnFn,
+	startTokenOf,
 	type StdinSink,
 } from "../../lib/spawn.ts";
 import { loadConfig, type JobsConfig } from "./config.ts";
@@ -38,7 +39,6 @@ import { defaultInterval } from "../../lib/timer.ts";
 import { clipLabel } from "../../lib/tui/columns.ts";
 import { compareJobs, formatLogs } from "./format.ts";
 import { readLogTail } from "./logs.ts";
-import { defaultStartToken, type LivenessFn, type StartTokenFn } from "./process.ts";
 import {
 	loadRegistries,
 	mergeRecords,
@@ -114,9 +114,9 @@ export interface SendResult {
 
 export interface RuntimeOptions {
 	spawn?: SpawnFn;
-	liveness?: LivenessFn;
+	liveness?: typeof isPidAlive;
 	killTree?: KillTreeFn;
-	startToken?: StartTokenFn;
+	startToken?: typeof startTokenOf;
 	now?: () => number;
 	/** Platform seam: whether this is Windows. Defaults to the running platform. */
 	isWindows?: () => boolean;
@@ -183,7 +183,7 @@ export function createJobsRuntime(options: RuntimeOptions = {}): JobsRuntime {
 	const spawn = options.spawn ?? defaultSpawn;
 	const liveness = options.liveness ?? isPidAlive;
 	const killTree = options.killTree ?? defaultKillTree;
-	const startToken = options.startToken ?? defaultStartToken;
+	const startToken = options.startToken ?? startTokenOf;
 	const now = options.now ?? (() => Date.now());
 	const isWindows = options.isWindows ?? (() => process.platform === "win32");
 

package/extensions/plan/feedback.ts

@@ -37,6 +37,12 @@ export interface PlanAnnotation {
 	comment: string;
 	/** Who wrote it; `""`/absent is the plan owner, the only writer before sharing. */
 	author?: string;
+	/**
+	 * Set when a refinement carried this comment onto a block other than the text it was
+	 * written on: the note is still the reviewer's, but where it sits is this build's best
+	 * guess, and the page says so instead of presenting a guess as her own anchor.
+	 */
+	moved?: true;
 }
 
 /** Most annotations one save may carry. */
@@ -51,8 +57,12 @@ export const MAX_AUTHOR_LENGTH = 40;
 /** The name a reviewer write is stored under, or why it cannot be decided. */
 export type AuthorClaim = { name: string } | { status: number; message: string };
 
-/** A stored feedback line, capturing its author and comment. */
-const MARKER_LINE = /^\s*>\s*\[!REVIEW\]\s?(.*)$/;
+/**
+ * A stored feedback line, capturing whether a refinement moved it, its author, and its
+ * comment. The flag is inside the marker tag rather than the comment, so the text a
+ * reviewer wrote stays exactly what she typed.
+ */
+const MARKER_LINE = /^\s*>\s*\[!REVIEW(\s+moved)?\]\s?(.*)$/;
 /** The author prefix inside a marker body (`@alice: note`). */
 const AUTHOR_PREFIX = /^@([^:]{1,40}):\s?(.*)$/;
 
@@ -121,6 +131,8 @@ interface StoredMarker {
 	at: number;
 	comment: string;
 	author: string;
+	/** Whether a refinement carried this comment off the text it was written on. */
+	moved: boolean;
 }
 
 /** The plan body without markers, plus the markers that were removed from it. */
@@ -134,20 +146,23 @@ function scanMarkers(plan: string): { clean: string; markers: StoredMarker[] } {
 			clean.push(line);
 			return;
 		}
-		const body = match[1].trim();
+		const body = (match[2] ?? "").trim();
 		if (body === "") return;
 		const authored = AUTHOR_PREFIX.exec(body);
 		const author = authored ? normalizeAuthor(authored[1]) : "";
 		const comment = (authored ? authored[2] : body).trim();
-		if (comment) markers.push({ at: clean.length - 1, comment, author });
+		if (comment) markers.push({ at: clean.length - 1, comment, author, moved: match[1] !== undefined });
 	});
 	return { clean: clean.join("\n"), markers };
 }
 
 /** One marker line in its stored form. */
-function markerLine(author: string, comment: string): string {
+function markerLine(author: string, comment: string, moved = false): string {
 	const body = sanitizeLine(comment);
-	return author ? `> ${REVIEW_MARKER} @${author}: ${body}` : `> ${REVIEW_MARKER} ${body}`;
+	// The flag rides inside the tag, where it cannot be confused with the comment: after
+	// the closing bracket, a comment that begins "moved …" would read as the flag.
+	const tag = moved ? "[!REVIEW moved]" : REVIEW_MARKER;
+	return author ? `> ${tag} @${author}: ${body}` : `> ${tag} ${body}`;
 }
 
 /** A marker waiting to be placed after clean-plan line `at`. */
@@ -220,6 +235,7 @@ export function readFeedback(plan: string): FeedbackRead {
 			comment: marker.comment,
 		};
 		if (marker.author) annotation.author = marker.author;
+		if (marker.moved) annotation.moved = true;
 		return annotation;
 	});
 	return { body: clean, blocks, annotations };
@@ -231,12 +247,17 @@ export function parseFeedback(plan: string): PlanAnnotation[] {
 }
 
 /** Sanitized, non-empty comments with the anchor they land on. */
-function storableComments(annotations: readonly PlanAnnotation[]): Array<{ anchor: number; comment: string }> {
-	const items: Array<{ anchor: number; comment: string }> = [];
+function storableComments(
+	annotations: readonly PlanAnnotation[],
+): Array<{ anchor: number; comment: string; moved: boolean }> {
+	const items: Array<{ anchor: number; comment: string; moved: boolean }> = [];
 	for (const annotation of annotations) {
 		const comment = sanitizeLine(annotation.comment);
 		if (comment.length === 0 || comment.length > MAX_COMMENT_LENGTH) continue;
-		items.push({ anchor: annotation.anchor, comment });
+		// Editing a moved note's text does not put it back on its old block, so the fact
+		// that a refinement placed it where it sits survives the save: the page posts back
+		// the annotation it was handed, flag included, and this keeps it.
+		items.push({ anchor: annotation.anchor, comment, moved: annotation.moved === true });
 	}
 	return items;
 }
@@ -251,13 +272,13 @@ export function formatFeedback(plan: string, annotations: PlanAnnotation[], opti
 	const { clean, markers } = scanMarkers(plan);
 	const kept = markers
 		.filter((marker) => marker.author !== author)
-		.map((marker) => ({ at: marker.at, line: markerLine(marker.author, marker.comment) }));
+		.map((marker) => ({ at: marker.at, line: markerLine(marker.author, marker.comment, marker.moved) }));
 	const blocks = planBlocks(clean);
 	const added = storableComments(annotations).map((item) => ({
 		// A marker beside a block, never after a blank line: an anchor that names
 		// blank space is written where the page can read it back as a thread.
 		at: contentBlockAt(blocks, item.anchor)?.end ?? -1,
-		line: markerLine(author, item.comment),
+		line: markerLine(author, item.comment, item.moved),
 	}));
 	return compose(clean, [...kept, ...added]);
 }
@@ -428,13 +449,16 @@ export function carryFeedback(previous: string, next: string): string {
 
 	const placed = markers.map((marker) => {
 		const block = blockAt(oldBlocks, marker.at);
-		const line = markerLine(marker.author, marker.comment);
-		if (block === undefined) return { at: tail, line };
+		// The flag means "this note is no longer on the text it was written about", so it
+		// is decided by the carry in hand: a block whose text survived proves the anchor,
+		// and anything after that is a guess the page has to admit to.
+		const keep = (moved: boolean): string => markerLine(marker.author, marker.comment, moved);
+		if (block === undefined) return { at: tail, line: keep(true) };
 		if (block.kind !== "blank") {
 			const match = queues.get(blockKey(block))?.shift();
-			if (match !== undefined) return { at: match.end, line };
+			if (match !== undefined) return { at: match.end, line: keep(false) };
 		}
-		return { at: bySection(block) ?? tail, line };
+		return { at: bySection(block) ?? tail, line: keep(true) };
 	});
 	return compose(cleanNext, placed);
 }
@@ -453,7 +477,7 @@ export function displayFeedback(plan: string): string {
 			if (fenced.has(index)) return line;
 			const match = MARKER_LINE.exec(line);
 			if (!match) return line;
-			const body = match[1].trim();
+			const body = (match[2] ?? "").trim();
 			if (body === "") return line;
 			const authored = AUTHOR_PREFIX.exec(body);
 			const author = authored ? normalizeAuthor(authored[1]) : "";

package/extensions/plan/format.ts

@@ -72,16 +72,23 @@ export function mergeSummary(merged: TodoMerge, steps: PlanStep[]): string {
 	const total = steps.length;
 	const counted = `${merged.added + merged.skipped} of ${total} plan step${total === 1 ? "" : "s"}`;
 	const notes = [
+		merged.replaced > 0
+			? `${merged.replaced} stale item${merged.replaced === 1 ? "" : "s"} from the earlier approval replaced`
+			: "",
 		merged.skipped > 0 ? `${merged.skipped} already present` : "",
 		merged.kept > 0 ? `${merged.kept} existing kept` : "",
 		merged.deferred > 0 ? `${merged.deferred} deferred, list full` : "",
 	].filter(Boolean);
 	const suffix = notes.length > 0 ? ` (${notes.join(", ")})` : "";
 	const tick = `Tick each one off in the file with ${SET_PLAN_STEPS_TOOL} as you finish it, passing the step's text as \`expected\`.`;
+	const touched =
+		merged.stale > 0
+			? ` ${merged.stale} older item${merged.stale === 1 ? "" : "s"} no longer match${merged.stale === 1 ? "es" : ""} this plan but ${merged.stale === 1 ? "was" : "were"} left alone: ${merged.stale === 1 ? "it was" : "they were"} started or finished, so check ${merged.stale === 1 ? "it" : "them"} yourself.`
+			: "";
 	if (merged.added === 0 && merged.skipped === 0) {
-		return ` The todo list is full, so no plan steps were added${suffix}. Keep these steps in mind. ${tick}`;
+		return ` The todo list is full, so no plan steps were added${suffix}.${touched} Keep these steps in mind. ${tick}`;
 	}
 	if (merged.added === 0)
-		return ` ${total === 1 ? "The plan's step is" : "Every plan step is"} already in the todo list${suffix}. ${tick}`;
-	return ` Merged ${counted} into the todo list${suffix}. ${tick}`;
+		return ` ${total === 1 ? "The plan's step is" : "Every plan step is"} already in the todo list${suffix}.${touched} ${tick}`;
+	return ` Merged ${counted} into the todo list${suffix}.${touched} ${tick}`;
 }

package/extensions/plan/index.ts

@@ -24,7 +24,14 @@ import { isExtensionEnabled } from "../../lib/env.ts";
 import { sanitizeLine } from "../../lib/format.ts";
 import { lastGoal, isPursuedGoal, type PublishedGoal } from "../../lib/goal-state.ts";
 import { READ_ONLY_SUMMARY, PLAN_ENTER_REQUEST, type PlanEnterRequest } from "../../lib/plan-entry.ts";
-import { ASK_USER_QUESTION_TOOL, SUBAGENT_READ_ONLY_PARAM, SUBAGENT_TOOL } from "../../lib/tool-names.ts";
+import { isBoardRead } from "../../lib/policy.ts";
+import {
+	ASK_USER_QUESTION_TOOL,
+	BOARD_READ_ACTION,
+	BOARD_TOOL,
+	SUBAGENT_READ_ONLY_PARAM,
+	SUBAGENT_TOOL,
+} from "../../lib/tool-names.ts";
 import { clip } from "../../lib/tui/columns.ts";
 import { STATUS_KEYS } from "../../lib/tui/glyphs.ts";
 import { planModeNotice, registerCommands } from "./commands.ts";
@@ -168,6 +175,15 @@ export default function planMode(pi: ExtensionAPI): void {
 			}
 			return undefined;
 		}
+		// `board` stays active so planning can read the board it is about to add cards
+		// to. The action is the truth here, not the annotation: the same tool writes, so
+		// `readOnlyHint` cannot say it, and every verb but the read is refused by name.
+		if (toolName === BOARD_TOOL) {
+			if (isBoardRead(input)) return undefined;
+			const action = (input as { action?: unknown } | undefined)?.action;
+			const verb = typeof action === "string" && action.trim() !== "" ? action.trim() : "board";
+			return `Plan mode: \`${verb}\` changes the board — only \`${BOARD_READ_ACTION}\` reads it. ${BLOCKED_GUIDANCE}`;
+		}
 		const blocked = policy.check(toolName);
 		if (blocked) return `Plan mode: ${blocked.reason}`;
 		// `bash` is allowed by the policy so read-only git stays possible; this is

package/extensions/plan/plan-files.ts

@@ -0,0 +1,88 @@
+/**
+ * How a plan file reaches the disk, and what it leaves behind (one job).
+ *
+ * Two writes, one subject: the plan itself, atomically so a crash cannot truncate
+ * the artifact a review is reading, and the revision a refinement replaces, kept
+ * beside it so the two can be compared. Keeping them together is deliberate — the
+ * revision has to be written with the same care as the plan, and before the rename
+ * that overwrites it, or the text is gone.
+ *
+ * A revision is a dotfile named for its plan (`.‹plan›-r001.md`): `isPlanFileName`
+ * and every scan that reads the directory as an index skip it, so a revision is
+ * never listed, reviewed, approved, or opened by `plan_path`.
+ *
+ * Value-only, as a store helper must be: the paths and the text are the caller's.
+ */
+
+import { randomBytes } from "node:crypto";
+import { readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+
+/**
+ * How many replaced revisions a plan keeps, as dotfiles beside it.
+ *
+ * A refinement overwrites the file it replaces, because the reviewed artifact has to
+ * be the executed one — so the text the reviewer read was gone the moment it was
+ * refined: a comment `carryFeedback` mis-anchored could not be checked against what
+ * she actually saw, and two revisions could not be diffed. Five is a chain deep
+ * enough to answer "what changed since I last looked" and short enough that a plan
+ * refined all afternoon does not leave fifty files in the store.
+ */
+const MAX_REVISIONS = 5;
+
+/**
+ * Write a plan atomically: a hidden sibling temp file, then a rename. A crash
+ * or a full disk mid-write leaves the previous file intact instead of a
+ * truncated plan, and the temp name is a dotfile, so neither `latest()` nor a
+ * plan lookup ever mistakes it for a plan.
+ */
+export function writeAtomic(path: string, content: string): void {
+	const temp = join(dirname(path), `.${basename(path)}.${randomBytes(6).toString("hex")}.tmp`);
+	try {
+		writeFileSync(temp, content, { encoding: "utf-8", flag: "wx" });
+		renameSync(temp, path);
+	} catch (error) {
+		try {
+			unlinkSync(temp);
+		} catch {
+			// The temp file was never created, or the rename already moved it.
+		}
+		throw error;
+	}
+}
+
+/** The prefix a plan's revisions share, so one chain is one `startsWith`. */
+function revisionPrefix(path: string): string {
+	return `.${basename(path).replace(/\.md$/i, "")}-r`;
+}
+
+/** The number a revision's name carries, so the newest is the highest. */
+function revisionNumber(name: string): number {
+	const digits = /-r(\d+)\.md$/i.exec(name)?.[1];
+	return digits === undefined ? 0 : Number.parseInt(digits, 10);
+}
+
+/** Keep `previous` as `path`'s next revision, and drop all but the newest few. */
+export function keepRevision(path: string, previous: string): string {
+	const dir = dirname(path);
+	const prefix = revisionPrefix(path);
+	let names: string[];
+	try {
+		names = readdirSync(dir).filter((name) => name.startsWith(prefix) && revisionNumber(name) > 0);
+	} catch {
+		names = [];
+	}
+	const next = Math.max(0, ...names.map(revisionNumber)) + 1;
+	const target = join(dir, `${prefix}${String(next).padStart(3, "0")}.md`);
+	writeAtomic(target, previous);
+	// Oldest first, so what stays is the newest chain.
+	const chain = [...names, basename(target)].sort((a, b) => revisionNumber(a) - revisionNumber(b));
+	for (const name of chain.slice(0, Math.max(0, chain.length - MAX_REVISIONS))) {
+		try {
+			unlinkSync(join(dir, name));
+		} catch {
+			// A revision that vanished is one fewer to prune.
+		}
+	}
+	return target;
+}

package/extensions/plan/plans.ts

@@ -21,7 +21,6 @@
  * This module owns paths and bytes only; tool wiring lives in `tools.ts`.
  */
 
-import { randomBytes } from "node:crypto";
 import {
 	existsSync,
 	lstatSync,
@@ -38,6 +37,7 @@ import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { CONFIG_DIR_NAME, getAgentDir, type ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { resolveEffectiveCwd } from "../../lib/env.ts";
+import { keepRevision, writeAtomic } from "./plan-files.ts";
 import { sanitizeLine, shortenPath } from "../../lib/format.ts";
 import { isInside, isInsideReal } from "../../lib/path.ts";
 import { repoKeyFor } from "../../lib/repo-key.ts";
@@ -69,6 +69,11 @@ export interface StoredPlan {
 /** A plan written to disk, carrying the title that named it. */
 export interface WrittenPlan extends StoredPlan {
 	title: string;
+	/**
+	 * The revision this write replaced, when it refined an existing plan: the text as the
+	 * reviewer last read it, kept beside the plan.
+	 */
+	replaced?: { path: string; relativePath: string };
 }
 
 /** One row of the plan index: enough to choose a plan without opening it. */
@@ -195,27 +200,6 @@ function resolvePlanArg(dir: string, planPath: string): string {
 	return isAbsolute(text) ? resolve(text) : resolve(dir, text);
 }
 
-/**
- * Write a plan atomically: a hidden sibling temp file, then a rename. A crash
- * or a full disk mid-write leaves the previous file intact instead of a
- * truncated plan, and the temp name is a dotfile, so neither `latest()` nor a
- * plan lookup ever mistakes it for a plan.
- */
-function writeAtomic(path: string, content: string): void {
-	const temp = join(dirname(path), `.${basename(path)}.${randomBytes(6).toString("hex")}.tmp`);
-	try {
-		writeFileSync(temp, content, { encoding: "utf-8", flag: "wx" });
-		renameSync(temp, path);
-	} catch (error) {
-		try {
-			unlinkSync(temp);
-		} catch {
-			// The temp file was never created, or the rename already moved it.
-		}
-		throw error;
-	}
-}
-
 function uniquePath(dir: string, base: string): string {
 	const taken = (candidate: string): boolean => {
 		try {
@@ -367,8 +351,20 @@ export function createPlanStore(pi: ExtensionAPI, options: { now?: () => Date }
 			throw new Error(`The plan is too large with its review comments (${nextBytes} bytes).`);
 		}
 
+		// Both are kept: the plan is what the review and the model read from now on, and the
+		// revision is what they read before this call — the only thing a diff, or a comment
+		// carried onto a block that moved, can be answered against.
+		// A refinement that changed nothing has nothing to keep: the copy would be the plan.
+		const replaced = previous === undefined || previous === content ? undefined : keepRevision(path, previous);
 		writeAtomic(path, content);
-		return { path, relativePath: shortenPath(path), title, content, bytes: nextBytes };
+		return {
+			path,
+			relativePath: shortenPath(path),
+			title,
+			content,
+			bytes: nextBytes,
+			...(replaced === undefined ? {} : { replaced: { path: replaced, relativePath: shortenPath(replaced) } }),
+		};
 	};
 
 	const read = async (cwd: string, planPath: string): Promise<StoredPlan | undefined> => {

package/extensions/plan/policy.ts

@@ -17,12 +17,14 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { createReadOnlyPolicy, WORKSPACE_READERS, type ReadOnlyPolicy } from "../../lib/policy.ts";
 import {
 	ASK_USER_QUESTION_TOOL,
+	BOARD_TOOL,
 	GOAL_TOOL,
 	SUBAGENT_TOOL,
 	TODO_TOOL,
 	WEB_FETCH_TOOL,
 	WEB_SEARCH_TOOL,
 } from "../../lib/tool-names.ts";
+
 import { ENTER_TOOL } from "./runtime.ts";
 
 /**
@@ -41,12 +43,15 @@ export const PLAN_SAFE_TOOLS = [
 ];
 
 /**
- * Tools that may stay active while planning. `subagent` is here so it is not
- * filtered out, but it is not in {@link PLAN_SAFE_TOOLS}: the `tool_call` guard
- * forces it read-only before the path backstop would see it. `powershell` is
- * deliberately absent — it is default-denied like any other shell.
+ * Tools that may stay active while planning. Two of them are here so they are not
+ * filtered out, without being in {@link PLAN_SAFE_TOOLS}: the `tool_call` guard
+ * narrows each before the path backstop would see it. `subagent` is forced
+ * read-only per call, and `board` admits only its `list` action — a model planning
+ * work should be able to read the board it is about to add cards to, and the hint
+ * cannot say that because the same tool writes. `powershell` is deliberately
+ * absent — it is default-denied like any other shell.
  */
-export const PLAN_ALLOWED_TOOLS = [...PLAN_SAFE_TOOLS, SUBAGENT_TOOL];
+export const PLAN_ALLOWED_TOOLS = [...PLAN_SAFE_TOOLS, SUBAGENT_TOOL, BOARD_TOOL];
 /**
  * Tools always blocked while planning, even when annotated read-only.
  * `enter_plan_mode` is denied so it stays hidden while planning; the guard exempts

package/extensions/plan/runtime.ts

@@ -28,7 +28,7 @@ import { GLYPHS, STATUS_KEYS } from "../../lib/tui/glyphs.ts";
 import { paint } from "../../lib/tui/tokens.ts";
 import { createPlanStore, type PlanStore } from "./plans.ts";
 import { sameSections, sectionDigests, type SectionDigest } from "./plan-text.ts";
-import type { PlanModeEntry, ReviewBaselineEntry } from "./types.ts";
+import type { PlanModeEntry, ReviewBaselineEntry, SeededStepsEntry } from "./types.ts";
 
 /** Tool the model calls to leave plan mode after approval. */
 export const EXIT_TOOL = "exit_plan_mode";
@@ -44,6 +44,8 @@ export const SET_PLAN_STEPS_TOOL = "set_plan_steps";
 export const STATE_TYPE = PLAN_MODE_ENTRY_TYPE;
 /** Custom-entry type used for a plan's review baseline. */
 export const BASELINE_TYPE = "plan-baseline";
+/** Custom-entry type used for the steps one approval seeded, so a re-approval can replace them. */
+export const SEEDED_TYPE = "plan-seeded";
 
 /** Longest plan-file basename shown in the footer chip. */
 const STATUS_NAME_LENGTH = 28;
@@ -79,12 +81,18 @@ export interface PlanRuntime {
 	reviewed(path: string): SectionDigest[] | undefined;
 	/** Remember what a review just showed, as a session entry on this branch. */
 	markReviewed(path: string, content: string): void;
+	/** The step texts the last approval of this plan appended, or undefined. */
+	seeded(path: string): string[] | undefined;
+	/** Record what this approval appended, so a re-approval can replace it. */
+	markSeeded(path: string, steps: readonly string[]): void;
 }
 
 /** What the branch carries: the last plan-mode state, and a baseline per plan. */
 interface BranchState {
 	mode: PlanModeEntry | undefined;
 	baselines: Map<string, SectionDigest[]>;
+	/** The step texts each approval appended, per plan path. */
+	seeded: Map<string, string[]>;
 }
 
 /** Well-formed `{ title, digest }` pairs from untrusted branch data, or undefined. */
@@ -106,6 +114,7 @@ function readSections(value: unknown): SectionDigest[] | undefined {
 function readBranchState(ctx: ExtensionContext): BranchState {
 	let mode: PlanModeEntry | undefined;
 	const baselines = new Map<string, SectionDigest[]>();
+	const seeded = new Map<string, string[]>();
 	for (const raw of ctx.sessionManager.getBranch()) {
 		const entry = raw as { type?: string; customType?: string; data?: unknown };
 		if (entry.type !== "custom") continue;
@@ -119,6 +128,16 @@ function readBranchState(ctx: ExtensionContext): BranchState {
 			mode = removed ? { enabled: data.enabled, removed } : { enabled: data.enabled };
 			continue;
 		}
+		if (entry.customType === SEEDED_TYPE) {
+			const data = entry.data as { path?: unknown; steps?: unknown } | null | undefined;
+			if (typeof data?.path !== "string" || !Array.isArray(data.steps)) continue;
+			// Branch data is untrusted: keep only the strings a step can be.
+			seeded.set(
+				resolve(data.path),
+				data.steps.filter((text): text is string => typeof text === "string"),
+			);
+			continue;
+		}
 		if (entry.customType !== BASELINE_TYPE) continue;
 		const data = entry.data as { path?: unknown; sections?: unknown } | null | undefined;
 		if (typeof data?.path !== "string") continue;
@@ -128,7 +147,7 @@ function readBranchState(ctx: ExtensionContext): BranchState {
 		// still answers a lookup for the plan it names.
 		if (sections) baselines.set(resolve(data.path), sections);
 	}
-	return { mode, baselines };
+	return { mode, baselines, seeded };
 }
 
 /** Compare two paths, resolving symlinks when possible so `/tmp` and `/private/tmp` match. */
@@ -161,6 +180,8 @@ export function createPlanRuntime(
 	// can mark what changed. Persisted with the branch, so `/resume` and `/tree`
 	// compare against the review this branch actually showed.
 	const reviewedPlans = new Map<string, SectionDigest[]>();
+	/** The steps each approval appended, so the next approval can replace its own leftovers. */
+	const seededPlans = new Map<string, string[]>();
 	// Tools plan mode deactivated, so disabling restores exactly those and does
 	// not re-activate a tool another extension intentionally hid.
 	let removedForPlan: string[] = [];
@@ -236,6 +257,8 @@ export function createPlanRuntime(
 			// never showed has no digest here, so nothing looks changed until it does.
 			reviewedPlans.clear();
 			for (const [path, sections] of branch.baselines) reviewedPlans.set(path, sections);
+			seededPlans.clear();
+			for (const [path, steps] of branch.seeded) seededPlans.set(path, steps);
 			const persisted = branch.mode;
 			// `--plan` starts a fresh session in plan mode; an explicit persisted
 			// choice (including a later disable) wins over the launch flag.
@@ -260,6 +283,12 @@ export function createPlanRuntime(
 			setStatus(ctx);
 		},
 		reviewed: (path) => reviewedPlans.get(resolve(path)),
+		seeded: (path) => seededPlans.get(resolve(path)),
+		markSeeded: (path, steps) => {
+			const key = resolve(path);
+			seededPlans.set(key, [...steps]);
+			pi.appendEntry(SEEDED_TYPE, { path: key, steps: [...steps] } satisfies SeededStepsEntry);
+		},
 		markReviewed: (path, content) => {
 			const key = resolve(path);
 			const sections = sectionDigests(content);