@namzu/cli 36.6.0 → 37.0.1

package/dist/chunks/{chunk-IKGTBMN2.js → chunk-6HDBRUB7.js}

@@ -2,16 +2,19 @@ import { createRequire as __namzuCreateRequire } from 'node:module';
 const require = __namzuCreateRequire(import.meta.url);
 import {
   openManagedWorktrees
-} from "./chunk-DZEWXEUN.js";
+} from "./chunk-3NCL3Y53.js";
 import {
   createBrowserControl
 } from "./chunk-WHODOMXA.js";
 import {
   connectMcpServers
-} from "./chunk-Z6GVIPO2.js";
+} from "./chunk-JH2O55TT.js";
+import {
+  openInBrowser
+} from "./chunk-UFZGVNFQ.js";
 import {
   createSessionSkillCatalog
-} from "./chunk-VE322URM.js";
+} from "./chunk-FKLDO6SF.js";
 import {
   SAVE_SKILL_TOOL_NAME,
   WORKFLOW_TOOL_DESCRIPTION,
@@ -27,10 +30,7 @@ import {
   viewFromJournal,
   workflowOffered,
   workflowRefusal
-} from "./chunk-LFHTKWQ5.js";
-import {
-  openInBrowser
-} from "./chunk-V6WLAAXC.js";
+} from "./chunk-4GDOFBZF.js";
 import {
   CredentialRefreshRejectedError,
   CredentialWithdrawnError,
@@ -38,15 +38,16 @@ import {
   ensureFreshStoredCodexCredential,
   readSubscriptionCredential,
   sameOAuthCredential
-} from "./chunk-P7NKAQ6I.js";
+} from "./chunk-DFU5KG3V.js";
 import {
   debugRequested
 } from "./chunk-GNBMKISG.js";
 import {
+  LOCAL_CONFIG_FILE,
   configuredPassthroughTools,
   resolveToolResultScreens,
   unmatchedPassthroughTools
-} from "./chunk-UFPOA63T.js";
+} from "./chunk-YCVR5E2Z.js";
 import {
   formatSize,
   homePath,
@@ -74,30 +75,20 @@ import {
   requiresCredentialForModel,
   resolveChainCapabilities,
   unresolvedMembers
-} from "./chunk-EOPRQEHH.js";
+} from "./chunk-SEKX6IR5.js";
 import {
   PROVIDER_REGISTRY,
   missingCredentialMessage,
   unsupportedProviderMessage
 } from "./chunk-6LLJQ3KY.js";
-import {
-  cliLogger
-} from "./chunk-TUN5WPEN.js";
 import {
   isPermissionMode,
   permissionModeLabel
-} from "./chunk-OTG2DGSA.js";
-import {
-  probeCapabilities
-} from "./chunk-OH6TB27S.js";
-import {
-  activeZenCatalogue,
-  isOfferableModel
-} from "./chunk-U3JIZFOS.js";
+} from "./chunk-D7FPVZDC.js";
 import {
   conversationLogPath,
   ensureSessionStarted
-} from "./chunk-XQWG6PQN.js";
+} from "./chunk-I6XWCKKW.js";
 import {
   INSTRUCTIONS_FILENAME,
   MAX_CHARS_PER_FILE,
@@ -107,16 +98,31 @@ import {
 } from "./chunk-H6B6AROX.js";
 import {
   ensurePrivateStateDirectory
-} from "./chunk-GZHWOIKT.js";
+} from "./chunk-HHKKHUJK.js";
+import {
+  compilePermissions,
+  isPermissionEffect
+} from "./chunk-QVMTUMTW.js";
+import {
+  cliLogger
+} from "./chunk-23SR4YFL.js";
+import {
+  probeCapabilities
+} from "./chunk-OH6TB27S.js";
+import {
+  activeZenCatalogue,
+  isOfferableModel
+} from "./chunk-U3JIZFOS.js";
 import {
   restrictToOwner
-} from "./chunk-AY6EUCML.js";
+} from "./chunk-ZRAALEF2.js";
 import {
   namzuHomePath
-} from "./chunk-PH72277Q.js";
+} from "./chunk-WWE4W2R6.js";
 import {
   AgentManager,
   AgentRegistry,
+  AuthorizationGate,
   BOOT_EVENT_NAMES,
   BackgroundJobRegistry,
   CODING_AGENT_DELEGATION_DOCTRINE,
@@ -148,6 +154,7 @@ import {
   MarkdownMemoryStore,
   MemoryContentRejectedError,
   MemoryNameConflictError,
+  NOOP_LOGGER,
   PLAN_MODE_DOCTRINE,
   PluginLifecycleManager,
   PluginRegistry,
@@ -221,6 +228,7 @@ import {
   isCompactionMessage,
   isEntityId,
   isProjectInstructionMessageSource,
+  isReminderMessage,
   isReviewExempt,
   isTerminalAgentTaskState,
   isTerminalStatus,
@@ -228,8 +236,10 @@ import {
   isTrustedReadOnly,
   isTurnInProgressError,
   isolationOf,
+  lexShellCommandLine,
   mapTools,
   mcpJsonSchemaToZod,
+  modelReadsImages,
   openSessionTokenBudget,
   parseWorkflowMeta,
   query,
@@ -238,6 +248,7 @@ import {
   refineEvidenceRecallTerms,
   requireOpenProject,
   resolveContextWindow,
+  resolveModelPricing,
   resolveNamzuHome,
   resolveWithinReal,
   resumeSession,
@@ -252,7 +263,7 @@ import {
   windowsShellNotice,
   withProviderFallback,
   wrapUntrusted
-} from "./chunk-2JVVUMXC.js";
+} from "./chunk-FLUVTAXY.js";
 import {
   __name
 } from "./chunk-76FLAFCG.js";
@@ -303,6 +314,46 @@ function createCurrentCredentialReader() {
 }
 __name(createCurrentCredentialReader, "createCurrentCredentialReader");
 
+// src/integrations/providers/image-input.ts
+var TextOnlyModels = class {
+  static {
+    __name(this, "TextOnlyModels");
+  }
+  known = /* @__PURE__ */ new Set();
+  key(providerId, model) {
+    return `${providerId}/${model}`;
+  }
+  add(providerId, model) {
+    this.known.add(this.key(providerId, model));
+  }
+  has(providerId, model) {
+    return this.known.has(this.key(providerId, model));
+  }
+  /** Whether a request for `model` through `provider` may carry images. */
+  reads(provider, model) {
+    return !this.has(provider.id, model) && modelReadsImages(provider, model);
+  }
+  /**
+   * `provider`, answering for what this conversation has learned. A proxy and
+   * not a copy, so every other member (private state, later-added methods)
+   * stays the provider's own.
+   */
+  informing(provider) {
+    const prefix = `${provider.id}/`;
+    if (![...this.known].some((entry) => entry.startsWith(prefix))) return provider;
+    const known = this;
+    return new Proxy(provider, {
+      get(target, property) {
+        if (property === "supportsImageInputFor") {
+          return (model) => !known.has(target.id, model) && (target.supportsImageInputFor?.(model) ?? true);
+        }
+        const value = Reflect.get(target, property, target);
+        return typeof value === "function" ? value.bind(target) : value;
+      }
+    });
+  }
+};
+
 // src/integrations/web/open-url.ts
 var OPEN_URL_TOOL_NAME = "open_url";
 var inputSchema = {
@@ -367,10 +418,10 @@ var tail = Promise.resolve();
 var nextStart = 0;
 function cancelled(promise, signal) {
   signal.throwIfAborted();
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve11, reject) => {
     const abort = /* @__PURE__ */ __name(() => reject(signal.reason), "abort");
     signal.addEventListener("abort", abort, { once: true });
-    promise.then(resolve9, reject).finally(() => signal.removeEventListener("abort", abort));
+    promise.then(resolve11, reject).finally(() => signal.removeEventListener("abort", abort));
   });
 }
 __name(cancelled, "cancelled");
@@ -411,8 +462,8 @@ async function searchExa(query2, limit, context) {
   const deadline = Date.now() + DEADLINE_MS;
   const previous = tail;
   let release;
-  tail = new Promise((resolve9) => {
-    release = resolve9;
+  tail = new Promise((resolve11) => {
+    release = resolve11;
   });
   let acquired = false;
   try {
@@ -929,7 +980,7 @@ __name(oneLine, "oneLine");
 // src/tui/agent.ts
 import { SubprocessComputerUseHost } from "@namzu/computer-use";
 import { realpath as realpath4, stat as stat4 } from "node:fs/promises";
-import { join as join13, parse, resolve as resolve8 } from "node:path";
+import { join as join14, parse, resolve as resolve10 } from "node:path";
 
 // src/checkpoints/store.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
@@ -2334,6 +2385,11 @@ function createSessionDirectories(cwd, directories) {
 }
 __name(createSessionDirectories, "createSessionDirectories");
 
+// src/context/doctrine.ts
+var NAMZU_PLAN_FILE_DOCTRINE = `## Plan mode
+
+You are in plan mode. Read, search and think; the only file you may change is the plan file named in the plan-mode reminder. Any other \`edit\`, \`write\` or shell command that changes state will be refused. Write the plan into the plan file, then call \`exit_plan_mode\` so the user can approve it; do not ask for approval in plain text. If the user sends you back with feedback, revise the plan file and call it again.`;
+
 // src/context/project-tracker.ts
 import { realpathSync } from "node:fs";
 import { dirname as dirname2, isAbsolute as isAbsolute3, join as join3, relative as relative3, resolve as resolve3, sep as sep2 } from "node:path";
@@ -3943,7 +3999,7 @@ async function searchConversationCore(sessions, sessionId, request, signal, acti
         result.excludedToolResults = (result.excludedToolResults ?? 0) + page.excludedToolResults;
       if (page.excludedSummaries)
         result.excludedSummaries = (result.excludedSummaries ?? 0) + page.excludedSummaries;
-      const matches2 = page.matches.map(
+      const matches = page.matches.map(
         (match) => ({
           seq: match.seq,
           recordedAt: match.recordedAt,
@@ -3958,11 +4014,11 @@ async function searchConversationCore(sessions, sessionId, request, signal, acti
           ...match.characterOffset === void 0 ? {} : { byteOffset: match.byteOffset }
         })
       );
-      const bytes = Buffer.byteLength(JSON.stringify(matches2));
+      const bytes = Buffer.byteLength(JSON.stringify(matches));
       if (outputBytes + bytes > OUTPUT_BYTES)
         throw new Error("Evidence exceeded its output allowance.");
       outputBytes += bytes;
-      result.matches.push(...matches2);
+      result.matches.push(...matches);
       result.unavailable += page.unavailable.length;
       result.incomplete ||= page.incomplete || page.unavailable.length > 0;
       state.omitted ||= page.incomplete || page.unavailable.length > 0;
@@ -4235,15 +4291,15 @@ function newScan(terms) {
   return { terms, started: false };
 }
 __name(newScan, "newScan");
-function advanceScan(scans, scan, nextCursor, excerpts, hasDerivedSummaries, canRefine) {
-  scan.started = true;
-  scan.cursor = nextCursor;
+function advanceScan(scans, scan2, nextCursor, excerpts, hasDerivedSummaries, canRefine) {
+  scan2.started = true;
+  scan2.cursor = nextCursor;
   if (!canRefine || scans.length !== 1 || !nextCursor) return;
   if (hasDerivedSummaries) {
-    scans.push({ ...newScan(scan.terms), excludeDerivedSummaries: true });
+    scans.push({ ...newScan(scan2.terms), excludeDerivedSummaries: true });
     return;
   }
-  const focused = refineEvidenceRecallTerms(scan.terms, excerpts);
+  const focused = refineEvidenceRecallTerms(scan2.terms, excerpts);
   if (focused) scans.push(newScan(focused));
 }
 __name(advanceScan, "advanceScan");
@@ -4268,8 +4324,8 @@ function createConversationEvidenceRecall(sessions, sessionId, assertOwner, reso
       let excludedSummaries = 0;
       const scans = [newScan(terms)];
       for (let pages = 0; pages < RECALL_PAGES; pages++) {
-        const scan = [...scans].reverse().find((s) => !s.started || s.cursor);
-        if (!scan) break;
+        const scan2 = [...scans].reverse().find((s) => !s.started || s.cursor);
+        if (!scan2) break;
         signal.throwIfAborted();
         const remaining = maxReadBytes - scannedBytes;
         if (remaining < 1024 * 1024) {
@@ -4280,12 +4336,12 @@ function createConversationEvidenceRecall(sessions, sessionId, assertOwner, reso
           sessions,
           sessionId,
           {
-            terms: scan.terms,
+            terms: scan2.terms,
             matchMode: "token",
             excludeSuccessfulTools: CONVERSATION_RETRIEVAL_TOOLS,
-            excludeDerivedSummaries: scan.excludeDerivedSummaries ?? false,
+            excludeDerivedSummaries: scan2.excludeDerivedSummaries ?? false,
             maxReadBytes: remaining,
-            ...scan.cursor ? { cursor: scan.cursor } : {}
+            ...scan2.cursor ? { cursor: scan2.cursor } : {}
           },
           signal,
           active
@@ -4316,7 +4372,7 @@ function createConversationEvidenceRecall(sessions, sessionId, assertOwner, reso
         }
         advanceScan(
           scans,
-          scan,
+          scan2,
           page.nextCursor,
           page.matches.map((match) => match.text),
           page.matches.some((match) => match.source === "compaction_shed:summary"),
@@ -4326,9 +4382,9 @@ function createConversationEvidenceRecall(sessions, sessionId, assertOwner, reso
       }
       assertOwner(turnId);
       signal.throwIfAborted();
-      const continuations = [...scans].reverse().filter((scan) => scan.cursor !== void 0).map((scan) => ({
+      const continuations = [...scans].reverse().filter((scan2) => scan2.cursor !== void 0).map((scan2) => ({
         toolName: "search_conversation",
-        input: { cursor: scan.cursor }
+        input: { cursor: scan2.cursor }
       }));
       return {
         candidates,
@@ -4433,6 +4489,150 @@ function createTaskContextStep(store, tenantId, now = Date.now) {
 }
 __name(createTaskContextStep, "createTaskContextStep");
 
+// src/integrations/small-model/route.ts
+function parseSmallModel(value, activeProviderId, isKnownProvider) {
+  const slash = value.indexOf("/");
+  if (slash > 0 && slash < value.length - 1) {
+    const head = value.slice(0, slash);
+    if (isKnownProvider(head)) return { providerId: head, model: value.slice(slash + 1) };
+  }
+  return { providerId: activeProviderId, model: value };
+}
+__name(parseSmallModel, "parseSmallModel");
+var NOT_A_CHAT_MODEL = /embed|moderat|whisper|transcri|tts|speech|image|dall-?e|realtime|audio/iu;
+function price(providerId, model) {
+  if (model.inputPrice !== void 0 && model.outputPrice !== void 0) {
+    return model.inputPrice + model.outputPrice;
+  }
+  const rates = resolveModelPricing(providerId, model.id);
+  return rates === void 0 ? void 0 : rates.inputCostPer1M + rates.outputCostPer1M;
+}
+__name(price, "price");
+function cheapestTextModel(providerId, models, offerable = () => true) {
+  let best;
+  for (const model of models) {
+    if (!model.supportsStreaming) continue;
+    if (model.inputModalities !== void 0 && !model.inputModalities.includes("text")) continue;
+    if (NOT_A_CHAT_MODEL.test(model.id)) continue;
+    if (!offerable(model)) continue;
+    const cost = price(providerId, model);
+    if (cost === void 0) continue;
+    if (best === void 0) {
+      best = { model, cost };
+      continue;
+    }
+    if (cost !== best.cost) {
+      if (cost < best.cost) best = { model, cost };
+      continue;
+    }
+    const window = model.contextWindow ?? 0;
+    const bestWindow = best.model.contextWindow ?? 0;
+    if (window > bestWindow || window === bestWindow && model.id.length < best.model.id.length) {
+      best = { model, cost };
+    }
+  }
+  return best?.model;
+}
+__name(cheapestTextModel, "cheapestTextModel");
+
+// src/integrations/small-model/side-model.ts
+function estimateTokens(text) {
+  return Math.ceil(text.length / 4);
+}
+__name(estimateTokens, "estimateTokens");
+function createSideModel(deps) {
+  const routes = /* @__PURE__ */ new Map();
+  const resolve11 = /* @__PURE__ */ __name(async (sessionId, signal) => {
+    const active = deps.active();
+    if (deps.configured !== void 0) {
+      const target = parseSmallModel(deps.configured, active.providerId, deps.isKnownProvider);
+      return { ...target, source: "configured" };
+    }
+    try {
+      const provider = await deps.buildProvider(sessionId, active);
+      if (provider.listModels === void 0) return { ...active, source: "main" };
+      const listing = await runPickerProviderOperation(
+        signal,
+        (operationSignal) => provider.listModels(operationSignal)
+      );
+      const cheapest = cheapestTextModel(
+        active.providerId,
+        listing,
+        (model) => deps.offerable ? deps.offerable(active.providerId, model) : true
+      );
+      if (cheapest !== void 0) {
+        return {
+          providerId: active.providerId,
+          model: cheapest.id,
+          source: "cheapest"
+        };
+      }
+    } catch (error) {
+      deps.debug?.("side model: listing failed, using the conversation model", error);
+    }
+    return { ...active, source: "main" };
+  }, "resolve");
+  const route = /* @__PURE__ */ __name((sessionId, signal) => {
+    const active = deps.active();
+    const key = `${active.providerId}
+${active.model}
+${deps.configured ?? ""}`;
+    let pending = routes.get(key);
+    if (pending === void 0) {
+      pending = resolve11(sessionId, signal);
+      routes.set(key, pending);
+      void pending.then((value) => {
+        if (signal.aborted && value.source === "main" && routes.get(key) === pending) {
+          routes.delete(key);
+        }
+      });
+    }
+    return pending;
+  }, "route");
+  const ask = /* @__PURE__ */ __name(async (request) => {
+    try {
+      request.signal.throwIfAborted();
+      const chosen = await route(request.sessionId, request.signal);
+      const provider = await deps.buildProvider(request.sessionId, chosen);
+      const estimatedPromptTokens = estimateTokens(request.instruction) + estimateTokens(request.body);
+      const send = /* @__PURE__ */ __name(async () => {
+        const response = await collectChatCompletion(
+          provider.chatStream({
+            model: chosen.model,
+            messages: [createSystemMessage(request.instruction), createUserMessage(request.body)],
+            maxTokens: request.maxTokens,
+            signal: request.signal
+          })
+        );
+        return { value: response.message.content ?? "", usage: response.usage };
+      }, "send");
+      if (request.timing === "in-turn") {
+        const text = await deps.ledger.chargeNow({
+          turnId: request.turnId,
+          sessionId: request.sessionId,
+          estimatedPromptTokens,
+          signal: request.signal,
+          request: send
+        });
+        return text?.trim() ? text : void 0;
+      }
+      const result = await send();
+      void deps.ledger.chargeLater({
+        turnId: request.turnId,
+        sessionId: request.sessionId,
+        estimatedPromptTokens,
+        usage: result.usage
+      });
+      return result.value.trim() ? result.value : void 0;
+    } catch (error) {
+      deps.debug?.("side model: request failed", error);
+      return void 0;
+    }
+  }, "ask");
+  return { route, ask };
+}
+__name(createSideModel, "createSideModel");
+
 // src/integrations/state/retention.ts
 var CLI_CHECKPOINT_RETENTION = 10;
 
@@ -6275,9 +6475,68 @@ async function createSubagentRuntime(input) {
       throw error;
     }
   }, "gatewayForTurn");
+  const queuedSideSpend = /* @__PURE__ */ new Map();
+  const releasedTurns = /* @__PURE__ */ new Set();
+  const countSideSpend = /* @__PURE__ */ __name(async (budget, spend) => {
+    const controller = new AbortController();
+    await chargeLabelRequest({
+      budget,
+      sessionId: spend.sessionId,
+      estimatedPromptTokens: spend.estimatedPromptTokens,
+      signal: controller.signal,
+      request: /* @__PURE__ */ __name(async () => ({ value: true, usage: spend.usage }), "request")
+    }).catch(() => void 0);
+  }, "countSideSpend");
+  const countQueuedSideSpend = /* @__PURE__ */ __name(async (turnId, pending) => {
+    const queued = queuedSideSpend.get(turnId);
+    if (queued === void 0) return;
+    queuedSideSpend.delete(turnId);
+    const runtime = await pending.catch(() => void 0);
+    if (runtime === void 0) return;
+    for (const spend of queued) await countSideSpend(runtime.budget, spend);
+  }, "countQueuedSideSpend");
+  const sideLedger = {
+    async chargeNow(input2) {
+      const turn = await parents.get(input2.turnId)?.catch(() => void 0);
+      if (!turn || closed) return void 0;
+      return chargeLabelRequest({
+        budget: turn.budget,
+        sessionId: input2.sessionId,
+        estimatedPromptTokens: input2.estimatedPromptTokens,
+        signal: input2.signal,
+        request: input2.request
+      });
+    },
+    async chargeLater(input2) {
+      const spend = {
+        sessionId: input2.sessionId,
+        estimatedPromptTokens: input2.estimatedPromptTokens,
+        usage: input2.usage
+      };
+      if (!releasedTurns.has(input2.turnId)) {
+        const queue = queuedSideSpend.get(input2.turnId) ?? [];
+        queue.push(spend);
+        queuedSideSpend.set(input2.turnId, queue);
+        return;
+      }
+      await openSessionTokenBudget({
+        store: tokenBudgetStore,
+        scope: { rootSessionId: input2.sessionId, rootTurnId: input2.turnId }
+      }).then(
+        (budget) => countSideSpend(budget, spend),
+        () => void 0
+      );
+    }
+  };
   const releaseTurn = /* @__PURE__ */ __name(async (turnId) => {
     const pending = parents.get(turnId);
     if (!pending) return;
+    await countQueuedSideSpend(turnId, pending);
+    releasedTurns.add(turnId);
+    if (releasedTurns.size > 256) {
+      const oldest = releasedTurns.values().next().value;
+      if (oldest !== void 0) releasedTurns.delete(oldest);
+    }
     parents.delete(turnId);
     await pending.then(
       (runtime) => runtime.close(),
@@ -7335,6 +7594,7 @@ ${JSON.stringify(launch.schema)}`;
     gatewayForTurn,
     completionInboxForTurn,
     releaseTurn,
+    sideLedger,
     agentTool,
     waitForTaskTool,
     agentTaskListTool,
@@ -7732,11 +7992,11 @@ var WorkflowRunRegistry = class {
   whenIdle(signal) {
     const going = /* @__PURE__ */ __name(() => [...this.runs.values()].some((run2) => !run2.finalized), "going");
     if (!going() || signal?.aborted) return Promise.resolve();
-    return new Promise((resolve9) => {
+    return new Promise((resolve11) => {
       const done = /* @__PURE__ */ __name(() => {
         off();
         signal?.removeEventListener("abort", done);
-        resolve9();
+        resolve11();
       }, "done");
       const off = this.subscribe(() => {
         if (!going()) done();
@@ -7933,8 +8193,8 @@ function createWorkflowHost(options) {
       let launching = true;
       let settleLaunch = /* @__PURE__ */ __name(() => {
       }, "settleLaunch");
-      const launch = new Promise((resolve9) => {
-        settleLaunch = resolve9;
+      const launch = new Promise((resolve11) => {
+        settleLaunch = resolve11;
       });
       const detach = /* @__PURE__ */ __name(() => {
         if (!launching) return;
@@ -8743,28 +9003,249 @@ function createLiveModeControl(options) {
 }
 __name(createLiveModeControl, "createLiveModeControl");
 
+// src/permissions/local-settings.ts
+import { execFile as execFile3 } from "node:child_process";
+import { existsSync, readFileSync, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { appendFile as appendFile3, mkdir as mkdir5, readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname as dirname3, isAbsolute as isAbsolute6, join as join13, resolve as resolve8 } from "node:path";
+function localConfigPath(cwd) {
+  return resolve8(cwd, LOCAL_CONFIG_FILE);
+}
+__name(localConfigPath, "localConfigPath");
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord2, "isRecord");
+function addAllowRules(permissions, additions) {
+  const out = { ...permissions };
+  for (const [tool, wanted] of Object.entries(additions)) {
+    const existing = out[tool];
+    if (existing === void 0) {
+      out[tool] = wanted;
+      continue;
+    }
+    if (isPermissionEffect(existing)) continue;
+    if (!isRecord2(existing)) continue;
+    if (isPermissionEffect(wanted)) {
+      continue;
+    }
+    const table = { ...existing };
+    for (const [pattern, effect] of Object.entries(wanted)) {
+      if (table[pattern] === void 0) table[pattern] = effect;
+    }
+    out[tool] = table;
+  }
+  return out;
+}
+__name(addAllowRules, "addAllowRules");
+function writeLocalAllows(cwd, additions) {
+  const path = localConfigPath(cwd);
+  let document = {};
+  if (existsSync(path)) {
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync(path, "utf-8"));
+    } catch (cause) {
+      return {
+        path,
+        error: `${LOCAL_CONFIG_FILE} is not valid JSON (${cause instanceof Error ? cause.message : String(cause)})`
+      };
+    }
+    if (!isRecord2(parsed)) return { path, error: `${LOCAL_CONFIG_FILE} is not a JSON object` };
+    document = parsed;
+  }
+  const permissions = isRecord2(document.permissions) ? document.permissions : {};
+  if (document.permissions !== void 0 && !isRecord2(document.permissions)) {
+    return { path, error: `${LOCAL_CONFIG_FILE} has a permissions value that is not a table` };
+  }
+  document = { ...document, permissions: addAllowRules(permissions, additions) };
+  try {
+    const staging = `${path}.${process.pid}.tmp`;
+    writeFileSync2(staging, `${JSON.stringify(document, null, "	")}
+`, { mode: 384 });
+    renameSync2(staging, path);
+  } catch (cause) {
+    return { path, error: cause instanceof Error ? cause.message : String(cause) };
+  }
+  return { path };
+}
+__name(writeLocalAllows, "writeLocalAllows");
+function git2(args, cwd, env) {
+  return new Promise((done) => {
+    execFile3(
+      "git",
+      [...args],
+      { cwd, env, timeout: 15e3, windowsHide: true },
+      (error, stdout) => {
+        const code = error === null ? 0 : typeof error.code === "number" ? error.code : 1;
+        done({ code, stdout: String(stdout ?? "") });
+      }
+    );
+  });
+}
+__name(git2, "git");
+function globalIgnorePath(configured, env) {
+  const home = env.HOME ?? env.USERPROFILE ?? homedir();
+  const value = configured.trim();
+  if (value === "~" || value.startsWith("~/")) return join13(home, value.slice(2));
+  if (value !== "" && isAbsolute6(value)) return value;
+  const xdg = env.XDG_CONFIG_HOME;
+  if (xdg && isAbsolute6(xdg)) return join13(xdg, "git", "ignore");
+  return join13(home, ".config", "git", "ignore");
+}
+__name(globalIgnorePath, "globalIgnorePath");
+async function ensureLocalConfigIgnored(cwd, env = process.env) {
+  try {
+    const inside = await git2(["rev-parse", "--is-inside-work-tree"], cwd, env);
+    if (inside.code !== 0 || inside.stdout.trim() !== "true") return { state: "not-a-repository" };
+    const ignored = /* @__PURE__ */ __name(async () => (await git2(["check-ignore", "--", LOCAL_CONFIG_FILE], cwd, env)).code === 0, "ignored");
+    if (await ignored()) return { state: "ignored", written: false };
+    const configured = await git2(["config", "--global", "--get", "core.excludesfile"], cwd, env);
+    const file = globalIgnorePath(configured.code === 0 ? configured.stdout : "", env);
+    const line = `**/${LOCAL_CONFIG_FILE}`;
+    await mkdir5(dirname3(file), { recursive: true });
+    let existing = "";
+    try {
+      existing = await readFile5(file, "utf-8");
+    } catch {
+    }
+    const why = /* @__PURE__ */ __name(async () => (await git2(["ls-files", "--error-unmatch", "--", LOCAL_CONFIG_FILE], cwd, env)).code === 0 ? "tracked" : "not-read", "why");
+    if (existing.includes(line)) {
+      const reason = await why();
+      return { state: reason, reason: `${line} is in ${file} but git does not ignore the file` };
+    }
+    if (existing === "") await writeFile3(file, `${line}
+`, "utf-8");
+    else await appendFile3(file, `${existing.endsWith("\n") ? "" : "\n"}${line}
+`, "utf-8");
+    if (!await ignored()) {
+      const reason = await why();
+      return { state: reason, reason: `wrote ${line} to ${file} but git still does not ignore it` };
+    }
+    return { state: "ignored", written: true };
+  } catch (cause) {
+    return { state: "failed", reason: cause instanceof Error ? cause.message : String(cause) };
+  }
+}
+__name(ensureLocalConfigIgnored, "ensureLocalConfigIgnored");
+function logIgnoreOutcome(outcome) {
+  if (outcome.state === "ignored" || outcome.state === "not-a-repository") return;
+  cliLogger().warn("The local config may be tracked by git", {
+    "namzu.config.local.state": outcome.state,
+    "namzu.config.local.reason": outcome.reason
+  });
+}
+__name(logIgnoreOutcome, "logIgnoreOutcome");
+
 // src/permissions/session-allow.ts
 var WEB_FETCH_TOOL = "web_fetch";
 var MAX_LABEL_COMMAND = 60;
-function isRecord2(value) {
+var MAX_RULES_PER_ANSWER = 5;
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-__name(isRecord2, "isRecord");
+__name(isRecord3, "isRecord");
 function alwaysAsked(call) {
   return call.escalation !== void 0 || call.requiresApproval === true || call.authorization?.explicitReview === true || call.isDestructive === true;
 }
 __name(alwaysAsked, "alwaysAsked");
-function allowFor(call, commands) {
+var NO_PREFIX_PROGRAMS = /* @__PURE__ */ new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "fish",
+  "csh",
+  "tcsh",
+  "ksh",
+  "dash",
+  "cmd",
+  "powershell",
+  "pwsh",
+  "env",
+  "xargs",
+  "command",
+  "builtin",
+  "noglob",
+  "nice",
+  "stdbuf",
+  "nohup",
+  "timeout",
+  "time",
+  "watch",
+  "ionice",
+  "chrt",
+  "setsid",
+  "taskset",
+  "strace",
+  "ltrace",
+  "script",
+  "flock",
+  "unshare",
+  "nsenter",
+  "sudo",
+  "doas",
+  "pkexec",
+  "su",
+  "runuser"
+]);
+var SUBCOMMAND = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+var ASSIGNMENT = /^[A-Za-z_]\w*=/;
+var PLAIN_PROGRAM = /^[\w./+@:-]+$/;
+var NOT_EXACT = /[\n\r;&|<>`$()*?{}\\]/;
+function programName(word) {
+  return word.slice(word.lastIndexOf("/") + 1);
+}
+__name(programName, "programName");
+function twoWordPrefix(command) {
+  const words = command.trim().split(/\s+/).filter(Boolean);
+  const [program, subcommand] = words;
+  if (words.length < 2 || program === void 0 || subcommand === void 0) return void 0;
+  if (ASSIGNMENT.test(program)) return void 0;
+  if (!PLAIN_PROGRAM.test(program) || NO_PREFIX_PROGRAMS.has(programName(program))) return void 0;
+  if (!SUBCOMMAND.test(subcommand)) return void 0;
+  return `${program} ${subcommand}`;
+}
+__name(twoWordPrefix, "twoWordPrefix");
+function allowForCommand(tool, command) {
+  if (NOT_EXACT.test(command)) return void 0;
+  const prefix = programName(command.split(/\s+/)[0] ?? "") === "cd" ? void 0 : twoWordPrefix(command);
+  if (prefix !== void 0) return { kind: "prefix", tool, prefix };
+  return { kind: "command", tool, command };
+}
+__name(allowForCommand, "allowForCommand");
+function plainCommands(line) {
+  const lexed = lexShellCommandLine(line, { dialect: "bash" });
+  if (!lexed.complete || lexed.opaque || lexed.commands.length === 0) return void 0;
+  if (lexed.redirections.length > 0 || lexed.compoundWords.length > 0) return void 0;
+  const out = [];
+  for (const command of lexed.commands) {
+    if (command.origin !== "line" || command.redirections.length > 0) return void 0;
+    const text = command.text.trim();
+    if (text === "") return void 0;
+    out.push(text);
+  }
+  return out;
+}
+__name(plainCommands, "plainCommands");
+function allowsFor(call, commands) {
   if (alwaysAsked(call)) return void 0;
-  const input = isRecord2(call.input) ? call.input : void 0;
+  const input = isRecord3(call.input) ? call.input : void 0;
   const commandArgument = commands.get(call.name);
   if (commandArgument !== void 0) {
     const line = input?.[commandArgument];
     if (typeof line !== "string") return void 0;
-    const command = line.trim();
-    if (command === "" || /[\n\r;&|<>`$()*?{}\\]/.test(command)) return void 0;
     if (input?.dangerously_disable_sandbox === true) return void 0;
-    return { kind: "command", tool: call.name, command };
+    if (line.trim() === "" || /[\n\r]/.test(line.trim())) return void 0;
+    const parts = plainCommands(line);
+    if (parts === void 0) return void 0;
+    const out = [];
+    for (const part of parts) {
+      const allow = allowForCommand(call.name, part);
+      if (allow === void 0) return void 0;
+      if (!out.some((existing) => sameAllow(existing, allow))) out.push(allow);
+    }
+    return out.length > 0 && out.length <= MAX_RULES_PER_ANSWER ? out : void 0;
   }
   if (call.name === WEB_FETCH_TOOL) {
     const url = input?.url;
@@ -8772,29 +9253,32 @@ function allowFor(call, commands) {
     try {
       const host = new URL(url).hostname;
       if (host === "" || host.includes("*")) return void 0;
-      return { kind: "host", tool: call.name, host };
+      return [{ kind: "host", tool: call.name, host }];
     } catch {
       return void 0;
     }
   }
-  if (call.name.startsWith("mcp__")) return { kind: "tool", tool: call.name };
+  if (call.name.startsWith("mcp__")) return [{ kind: "tool", tool: call.name }];
   return void 0;
 }
-__name(allowFor, "allowFor");
+__name(allowsFor, "allowsFor");
 function allowsForBatch(calls, commands) {
   if (calls.length === 0) return void 0;
   const out = [];
   for (const call of calls) {
-    const allow = allowFor(call, commands);
-    if (!allow) return void 0;
-    if (!out.some((existing) => sameAllow(existing, allow))) out.push(allow);
+    const allows = allowsFor(call, commands);
+    if (!allows) return void 0;
+    for (const allow of allows) {
+      if (!out.some((existing) => sameAllow(existing, allow))) out.push(allow);
+    }
   }
-  return out;
+  return out.length <= MAX_RULES_PER_ANSWER ? out : void 0;
 }
 __name(allowsForBatch, "allowsForBatch");
 function sameAllow(a, b) {
   if (a.kind !== b.kind || a.tool !== b.tool) return false;
   if (a.kind === "command" && b.kind === "command") return a.command === b.command;
+  if (a.kind === "prefix" && b.kind === "prefix") return a.prefix === b.prefix;
   if (a.kind === "host" && b.kind === "host") return a.host === b.host;
   return true;
 }
@@ -8808,6 +9292,8 @@ function describeAllows(allows) {
     switch (allow.kind) {
       case "command":
         return `${shorten(allow.command)} commands`;
+      case "prefix":
+        return `${shorten(allow.prefix)} * commands`;
       case "host":
         return allow.host;
       case "tool":
@@ -8817,47 +9303,237 @@ function describeAllows(allows) {
   return parts.length <= 1 ? parts[0] ?? "" : `${parts.slice(0, -1).join(", ")} and ${parts.at(-1)}`;
 }
 __name(describeAllows, "describeAllows");
-function matches(allow, toolName2, toolInput, commands) {
-  if (allow.tool !== toolName2) return false;
-  switch (allow.kind) {
-    case "tool":
-      return true;
-    case "host": {
-      const url = isRecord2(toolInput) ? toolInput.url : void 0;
-      if (typeof url !== "string") return false;
-      try {
-        return new URL(url).hostname === allow.host;
-      } catch {
-        return false;
-      }
-    }
-    case "command": {
-      const argument = commands.get(toolName2);
-      if (argument === void 0 || !isRecord2(toolInput)) return false;
-      const line = toolInput[argument];
-      return typeof line === "string" && line.trim() === allow.command && toolInput.dangerously_disable_sandbox !== true;
+function permissionsForAllows(allows) {
+  const table = {};
+  const pattern = /* @__PURE__ */ __name((tool, glob) => {
+    const existing = table[tool];
+    const patterns = typeof existing === "object" ? existing : {};
+    patterns[glob] = "allow";
+    table[tool] = patterns;
+  }, "pattern");
+  for (const allow of allows) {
+    switch (allow.kind) {
+      case "command":
+        pattern(allow.tool, allow.command);
+        break;
+      case "prefix":
+        pattern(allow.tool, `${allow.prefix} *`);
+        break;
+      case "host":
+        pattern(allow.tool, `http://${allow.host}/*`);
+        pattern(allow.tool, `https://${allow.host}/*`);
+        break;
+      case "tool":
+        table[allow.tool] = "allow";
+        break;
     }
   }
+  return table;
 }
-__name(matches, "matches");
-function createSessionAllows(commands) {
+__name(permissionsForAllows, "permissionsForAllows");
+function createSessionAllows(_commands, options = {}) {
   const entries = [];
+  let gate;
+  const rebuild = /* @__PURE__ */ __name(() => {
+    const { rules } = compilePermissions(permissionsForAllows(entries));
+    gate = rules.length === 0 ? void 0 : new AuthorizationGate(
+      {
+        enabled: true,
+        rules: [...rules],
+        allowReadOnlyTools: false,
+        denyDangerousPatterns: false,
+        logDecisions: false
+      },
+      NOOP_LOGGER
+    );
+  }, "rebuild");
+  const allowed = /* @__PURE__ */ __name((call) => {
+    if (isRecord3(call.toolInput) && call.toolInput.dangerously_disable_sandbox === true)
+      return false;
+    const result = gate?.evaluate(call);
+    return result !== void 0 && result.matchedRule !== null && result.decision === "allow";
+  }, "allowed");
   return {
     add(allows) {
-      for (const allow of allows) {
-        if (!entries.some((existing) => sameAllow(existing, allow))) entries.push(allow);
+      const fresh = allows.filter(
+        (allow) => !entries.some((existing) => sameAllow(existing, allow))
+      );
+      entries.push(...fresh);
+      if (fresh.length > 0) rebuild();
+      const cwd = typeof options.cwd === "function" ? options.cwd() : options.cwd;
+      if (cwd === void 0) return void 0;
+      const write = (options.persist ?? writeLocalAllows)(cwd, permissionsForAllows(allows));
+      if (write.error !== void 0) {
+        cliLogger().warn("Could not save a remembered answer", {
+          "namzu.config.local.path": write.path,
+          "namzu.config.local.error": write.error
+        });
+        return `Could not save this answer to ${LOCAL_CONFIG_FILE}: ${write.error}. It holds for this session only.`;
       }
+      void (options.keepIgnored ?? ensureLocalConfigIgnored)(cwd).then(logIgnoreOutcome);
+      return void 0;
     },
     list: /* @__PURE__ */ __name(() => [...entries], "list"),
     rule: {
       type: "predicate",
-      description: "allowed for this session by an answer at a prompt",
-      decide: /* @__PURE__ */ __name((call) => entries.some((allow) => matches(allow, call.toolName, call.toolInput, commands)) ? "allow" : null, "decide")
+      description: "allowed by an answer at a prompt",
+      decide: /* @__PURE__ */ __name((call) => allowed(call) ? "allow" : null, "decide")
     }
   };
 }
 __name(createSessionAllows, "createSessionAllows");
 
+// src/plan/approval.ts
+var KEEP_PLANNING_PLACEHOLDER = "Tell namzu what to change";
+function planApprovalRows(bypassAvailable) {
+  return [
+    bypassAvailable ? {
+      id: "approve-auto",
+      label: "Yes, and approve every tool without asking",
+      mode: "auto"
+    } : {
+      id: "approve-accept-edits",
+      label: "Yes, and auto-approve edits",
+      mode: "accept-edits"
+    },
+    {
+      id: "approve-ask",
+      label: "Yes, and ask before each edit",
+      mode: "prompt"
+    },
+    { id: "keep-planning", label: "No, keep planning" }
+  ];
+}
+__name(planApprovalRows, "planApprovalRows");
+var EXIT_PLAN_MODE_TOOL_NAME = "exit_plan_mode";
+
+// src/plan/plan-file.ts
+import { readFile as readFile6 } from "node:fs/promises";
+import { isAbsolute as isAbsolute7, resolve as resolve9 } from "node:path";
+var WRITERS = /* @__PURE__ */ new Set(["write", "edit"]);
+function isPlanFileWrite(planPath, cwd) {
+  const target = resolve9(planPath);
+  return (call) => {
+    if (!WRITERS.has(call.name)) return false;
+    const input = call.input;
+    if (input === null || typeof input !== "object") return false;
+    const path = input.path;
+    if (typeof path !== "string" || path.length === 0 || path.includes("\0")) return false;
+    return resolve9(isAbsolute7(path) ? path : resolve9(cwd, path)) === target;
+  };
+}
+__name(isPlanFileWrite, "isPlanFileWrite");
+async function readPlan(planPath) {
+  try {
+    const text = await readFile6(planPath, "utf8");
+    return text.trim().length > 0 ? text : void 0;
+  } catch {
+    return void 0;
+  }
+}
+__name(readPlan, "readPlan");
+
+// src/plan/exit-plan-mode-tool.ts
+function approvedPlanText(plan, planPath, answer) {
+  return [
+    `The user approved your plan and moved this session to "${permissionModeLabel(answer.mode)}". You can start the work now; if a task list fits it, open one first.`,
+    "",
+    `The plan is saved at ${planPath} if you need to refer back to it.`,
+    ...answer.feedback ? ["", `The user added: ${answer.feedback}`] : [],
+    "",
+    "## Approved plan",
+    plan
+  ].join("\n");
+}
+__name(approvedPlanText, "approvedPlanText");
+function buildExitPlanModeTool(host) {
+  return defineTool({
+    name: EXIT_PLAN_MODE_TOOL_NAME,
+    description: "Present the finished plan for the user to approve and leave plan mode. Write the plan to the plan file first; this tool reads it from there and takes no arguments. The user picks how to continue (auto-approve edits, or ask before each edit) or sends you back to planning with feedback. Call it only while in plan mode, only when the plan is ready, and never ask for approval of a plan any other way.",
+    inputSchema: mcpJsonSchemaToZod({
+      type: "object",
+      properties: {},
+      additionalProperties: false
+    }),
+    category: "custom",
+    permissions: [],
+    // Asks the person, changes nothing itself: the mode switch is theirs.
+    readOnly: true,
+    destructive: false,
+    concurrencySafe: false,
+    // A person reads a whole plan before answering.
+    timeoutMs: 30 * 6e4,
+    presentCall: /* @__PURE__ */ __name(() => ({
+      kind: "generic",
+      label: "Present plan for approval",
+      presentation: "activity"
+    }), "presentCall"),
+    // The transcript already shows the approved plan (the host writes it when the
+    // person approves); the tool's own result is for the model.
+    presentResult: /* @__PURE__ */ __name((_input, result) => {
+      if (result.success)
+        return {
+          kind: "generic",
+          label: "Plan approved",
+          visibility: "hidden"
+        };
+      const outcome = result.data?.outcome;
+      return outcome === "keep-planning" ? { kind: "generic", label: "Kept planning", outcome: "cancelled" } : void 0;
+    }, "presentResult"),
+    async execute(_input, context) {
+      context.abortSignal?.throwIfAborted();
+      if (host.mode() !== "plan") {
+        return {
+          success: false,
+          output: "",
+          error: "You are not in plan mode, so there is no plan to put up for approval. If your plan was already approved, carry on with the work."
+        };
+      }
+      const planPath = host.planPath();
+      const plan = await readPlan(planPath);
+      if (plan === void 0) {
+        return {
+          success: false,
+          output: "",
+          error: `There is no plan to approve: ${planPath} is missing or empty. Write the plan to that file first, then call ${EXIT_PLAN_MODE_TOOL_NAME}.`
+        };
+      }
+      const ask = host.approval();
+      if (!ask) {
+        return {
+          success: false,
+          output: "",
+          error: "Nobody can approve a plan in this session, and you cannot leave plan mode yourself. End your reply with the plan and tell the user to switch the permission mode when they want it carried out."
+        };
+      }
+      let answer;
+      try {
+        answer = await ask(
+          { plan, planPath, bypassAvailable: host.bypassAvailable() },
+          context.abortSignal
+        );
+      } catch {
+        answer = { kind: "keep-planning" };
+      }
+      context.abortSignal?.throwIfAborted();
+      if (answer.kind === "approve") {
+        return {
+          success: true,
+          output: approvedPlanText(plan, planPath, answer),
+          data: { outcome: "approved", mode: answer.mode }
+        };
+      }
+      return {
+        success: false,
+        output: "",
+        error: answer.feedback ? `The user did not approve the plan and wants you to keep planning. What they said: ${answer.feedback}` : "The user did not approve the plan yet and has not said what to change. Stay in plan mode and ask what they want different, or refine the plan.",
+        data: { outcome: "keep-planning" }
+      };
+    }
+  });
+}
+__name(buildExitPlanModeTool, "buildExitPlanModeTool");
+
 // src/provider-retry.ts
 var TERMINAL_PROVIDER_RETRY = {
   maxRetries: 10,
@@ -8872,6 +9548,175 @@ function terminalProviderRetry(restartableOutput) {
 }
 __name(terminalProviderRetry, "terminalProviderRetry");
 
+// src/reminders/index.ts
+import { existsSync as existsSync2 } from "node:fs";
+
+// src/reminders/frame.ts
+var TAG = /^<system-reminder kind="([a-z-]+)"(?: form="([a-z]+)")?>/;
+function frameReminder(kind, text, form) {
+  const open3 = form ? `<system-reminder kind="${kind}" form="${form}">` : `<system-reminder kind="${kind}">`;
+  return `${open3}
+${text.trim()}
+</system-reminder>`;
+}
+__name(frameReminder, "frameReminder");
+function reminderKindOf(message2) {
+  if (!isReminderMessage(message2) || typeof message2.content !== "string") return void 0;
+  const kind = TAG.exec(message2.content)?.[1];
+  return kind === "plan-mode" || kind === "plan-reentry" || kind === "plan-exit" || kind === "task-nudge" ? kind : void 0;
+}
+__name(reminderKindOf, "reminderKindOf");
+function isOperatorTurn(message2) {
+  if (message2.role !== "user") return false;
+  const source = message2.source;
+  return source === void 0 || source.type === "goal-round" || source.type === "runtime-context" && source.kind === "steering";
+}
+__name(isOperatorTurn, "isOperatorTurn");
+
+// src/reminders/plan-mode.ts
+var PLAN_REMINDER_EVERY_N_TURNS = 5;
+var PLAN_REMINDER_FULL_EVERY_N = 5;
+function scan(messages) {
+  let turns = 0;
+  let hasReminder = false;
+  let sent = 0;
+  let hasExited = false;
+  let inStretch = true;
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message2 = messages[i];
+    const kind = reminderKindOf(message2);
+    if (kind === "plan-exit") {
+      hasExited = true;
+      if (!hasReminder) inStretch = false;
+      break;
+    }
+    if (kind === "plan-mode" || kind === "plan-reentry") {
+      if (inStretch) hasReminder = true;
+      if (kind === "plan-mode") sent++;
+      continue;
+    }
+    if (!hasReminder && isOperatorTurn(message2)) turns++;
+  }
+  return { turnsSinceReminder: turns, hasReminder, sent, hasExited };
+}
+__name(scan, "scan");
+function fullText(input) {
+  const file = input.planExists ? `A plan already exists at ${input.planPath}. Read it, then revise it in place with the edit tool.` : `No plan exists yet. Create it at ${input.planPath} with the write tool.`;
+  const ending = input.canAsk ? "Your turn ends in exactly one of two ways: you ask the user a question with ask_user_question to settle something you cannot decide yourself, or you call exit_plan_mode once the plan file is ready for approval." : "Your turn ends by calling exit_plan_mode once the plan file is ready for approval.";
+  return `Plan mode is on. Change nothing except the plan file: no edits, no commands that change state, no commits. This overrides every other instruction you have.
+
+${file} It is the only file you may write; build the plan up in it as you learn.
+
+How to plan:
+1. Understand the request. Read the code it touches and look for existing functions and patterns to reuse before proposing new ones. For wide questions, send read-only explore agents; one is usually enough.
+2. Decide on one approach. Weigh alternatives briefly and keep only the one you recommend.
+3. Write the plan file: why the change is needed, the recommended approach, the files to change, what existing code it reuses, and how to verify the result end to end.
+4. Finish. ${ending} Never ask for approval in plain text ("does this look right?"); exit_plan_mode is how the user is asked.`;
+}
+__name(fullText, "fullText");
+function sparseText(input) {
+  return `Plan mode is still on (full rules above). Only ${input.planPath} may be written. End the turn by ${input.canAsk ? "asking the user a question or " : ""}calling exit_plan_mode.`;
+}
+__name(sparseText, "sparseText");
+function reentryText(input) {
+  return `You are back in plan mode after leaving it earlier. A plan from that session is at ${input.planPath}. Before planning anything new, read it and compare it with the current request: if this is a different task, start over and overwrite it; if it continues the same task, revise it and drop what no longer applies. Edit the plan file one way or the other before you call exit_plan_mode.`;
+}
+__name(reentryText, "reentryText");
+function exitText(input) {
+  return `You have left plan mode. You can edit files and run tools again.${input.planExists ? ` The plan is at ${input.planPath} if you need to refer to it.` : ""}`;
+}
+__name(exitText, "exitText");
+function planModeReminders(input) {
+  const stretch = scan(input.messages);
+  if (input.mode !== "plan") {
+    return stretch.hasReminder ? [frameReminder("plan-exit", exitText(input))] : [];
+  }
+  if (stretch.hasReminder && stretch.turnsSinceReminder < PLAN_REMINDER_EVERY_N_TURNS) return [];
+  const full = (stretch.sent + 1) % PLAN_REMINDER_FULL_EVERY_N === 1;
+  const out = [
+    frameReminder(
+      "plan-mode",
+      full ? fullText(input) : sparseText(input),
+      full ? "full" : "sparse"
+    )
+  ];
+  if (!stretch.hasReminder && stretch.hasExited && input.planExists) {
+    out.push(frameReminder("plan-reentry", reentryText(input)));
+  }
+  return out;
+}
+__name(planModeReminders, "planModeReminders");
+
+// src/reminders/task-nudge.ts
+var TASK_NUDGE_AFTER_TURNS = 10;
+var TASK_NUDGE_EVERY_TURNS = 10;
+var TASK_TOOLS = /* @__PURE__ */ new Set(["task_create", "task_update"]);
+function taskNudgeCounts(messages) {
+  let sinceTaskTool = 0;
+  let sinceNudge = 0;
+  let sawTool = false;
+  let sawNudge = false;
+  for (let i = messages.length - 1; i >= 0 && !(sawTool && sawNudge); i--) {
+    const message2 = messages[i];
+    if (message2.role === "assistant") {
+      if (!sawTool && message2.toolCalls?.some((call) => TASK_TOOLS.has(call.function.name))) {
+        sawTool = true;
+      }
+      if (!sawTool) sinceTaskTool++;
+      if (!sawNudge) sinceNudge++;
+    } else if (!sawNudge && reminderKindOf(message2) === "task-nudge") {
+      sawNudge = true;
+    }
+  }
+  return { sinceTaskTool, sinceNudge };
+}
+__name(taskNudgeCounts, "taskNudgeCounts");
+function listText(tasks) {
+  return tasks.map((task) => `#${task.id}. [${task.status}] ${task.subject}`).join("\n");
+}
+__name(listText, "listText");
+function taskNudge(messages, tasks) {
+  if (messages.length === 0) return [];
+  const { sinceTaskTool, sinceNudge } = taskNudgeCounts(messages);
+  if (sinceTaskTool < TASK_NUDGE_AFTER_TURNS || sinceNudge < TASK_NUDGE_EVERY_TURNS) return [];
+  const head = "You have not used the task tools for a while. If this work has steps worth tracking, add them with task_create and keep their status current with task_update (in_progress when you start one, completed when it is done); if the list has gone stale, tidy it. Only do so if it fits the work; otherwise ignore this note.";
+  return [
+    frameReminder(
+      "task-nudge",
+      tasks.length > 0 ? `${head}
+
+The task list now:
+${listText(tasks)}` : head
+    )
+  ];
+}
+__name(taskNudge, "taskNudge");
+
+// src/reminders/index.ts
+function createCliReminderSource(options) {
+  return async ({ messages }) => {
+    const out = [];
+    if (options.planPath) {
+      const planPath = options.planPath();
+      out.push(
+        ...planModeReminders({
+          messages,
+          mode: options.mode(),
+          planPath,
+          planExists: (options.planExists ?? existsSync2)(planPath),
+          canAsk: options.canAsk === true
+        })
+      );
+    }
+    if (options.tasks) {
+      const nudge = taskNudge(messages, []);
+      if (nudge.length > 0) out.push(...taskNudge(messages, await options.tasks()));
+    }
+    return out;
+  };
+}
+__name(createCliReminderSource, "createCliReminderSource");
+
 // src/skills/directory.ts
 function createSkillDirectoryResolver(options) {
   return async (skill, context) => {
@@ -9021,24 +9866,24 @@ async function resolveModelSwitch(request, options) {
     listed.set(detected.entry.id, listing);
     return listing.kind === "ok" && listing.models.some((candidate) => candidate.id === model);
   }, "inspect");
-  const resolve9 = /* @__PURE__ */ __name((detected) => ({
+  const resolve11 = /* @__PURE__ */ __name((detected) => ({
     kind: "resolved",
     selection: { id: detected.entry.id, model }
   }), "resolve");
   const first = selected ?? usable.find(({ entry }) => entry.id === options.currentProvider);
-  if (first && await inspect(first)) return resolve9(first);
+  if (first && await inspect(first)) return resolve11(first);
   const candidates = selected ? [selected] : usable;
-  const matches2 = selected ? [] : (await Promise.all(
+  const matches = selected ? [] : (await Promise.all(
     candidates.filter((candidate) => candidate !== first).map(async (candidate) => await inspect(candidate) ? candidate : void 0)
   )).filter((candidate) => candidate !== void 0);
   signal?.throwIfAborted();
-  const uniqueMatch = matches2.length === 1 ? matches2[0] : void 0;
-  if (uniqueMatch) return resolve9(uniqueMatch);
-  if (matches2.length > 1) {
+  const uniqueMatch = matches.length === 1 ? matches[0] : void 0;
+  if (uniqueMatch) return resolve11(uniqueMatch);
+  if (matches.length > 1) {
     return {
       kind: "rejected",
-      reason: `Model "${model}" is available from multiple providers. Specify one: ${matches2.map(({ entry }) => entry.id).join(", ")}.`,
-      choices: matches2.map(({ entry }) => ({ provider: entry.id, model }))
+      reason: `Model "${model}" is available from multiple providers. Specify one: ${matches.map(({ entry }) => entry.id).join(", ")}.`,
+      choices: matches.map(({ entry }) => ({ provider: entry.id, model }))
     };
   }
   const choices = candidates.flatMap((candidate) => {
@@ -9109,6 +9954,8 @@ function createCliToolPresenter(registry) {
 __name(createCliToolPresenter, "createCliToolPresenter");
 
 // src/tui/agent.ts
+var WEB_FETCH_MAX_BYTES = 10 * 1024 * 1024;
+var WEB_EXTRACT_MAX_TOKENS = 8192;
 async function observeWithSignal(operation, signal) {
   signal.throwIfAborted();
   let rejectAbort = /* @__PURE__ */ __name(() => {
@@ -9187,8 +10034,8 @@ var SessionOperationOwner = class {
     })()[Symbol.asyncIterator]();
     let settled = false;
     let settle;
-    const settlement = new Promise((resolve9) => {
-      settle = resolve9;
+    const settlement = new Promise((resolve11) => {
+      settle = resolve11;
     });
     let operationTail = Promise.resolve();
     let returnStarted = false;
@@ -9457,14 +10304,14 @@ function clipRequestContext(prompt, limit, kind) {
 __name(clipRequestContext, "clipRequestContext");
 async function createAgentSession(prefs, detected, options = {}) {
   if (options.palEnvironment) {
-    const { createPalAgentSession } = await import("./agent-session-F5XU36CE.js");
+    const { createPalAgentSession } = await import("./agent-session-D4Z3TOX3.js");
     return createPalAgentSession(prefs, detected, options);
   }
-  const { palAtWorkspace } = await import("./store-QLMY3B43.js");
+  const { palAtWorkspace } = await import("./store-XPSGZANO.js");
   if (palAtWorkspace(options.cwd ?? process.cwd()))
     throw new Error("This Pal requires its owned virtual computer. Open it with namzu pal chat.");
   const commandArguments = builtinCommandArguments();
-  const sessionAllows = createSessionAllows(commandArguments);
+  const sessionAllows = createSessionAllows(commandArguments, { cwd: /* @__PURE__ */ __name(() => cwd, "cwd") });
   const sessionRules = [...options.rules ?? [], sessionAllows.rule];
   const fileObservations = /* @__PURE__ */ new Map();
   const observationsFor = /* @__PURE__ */ __name((id, prior) => {
@@ -9494,7 +10341,7 @@ async function createAgentSession(prefs, detected, options = {}) {
     }
     return seeded;
   }, "observationsFor");
-  const requestedCwd = resolve8(options.cwd ?? process.cwd());
+  const requestedCwd = resolve10(options.cwd ?? process.cwd());
   let cwd;
   try {
     const entry2 = await stat4(requestedCwd);
@@ -9526,13 +10373,13 @@ async function createAgentSession(prefs, detected, options = {}) {
       paths = options.conversationSessions.paths;
       projectId = options.conversationSessions.projectId;
     } else {
-      const home = resolve8(options.stateRoot ?? resolveNamzuHome());
+      const home = resolve10(options.stateRoot ?? resolveNamzuHome());
       ensurePrivateStateDirectory(home, "projects");
       const project = await ensureProject({ home, cwd: cliProjectRoot(cwd) });
       paths = new SessionPaths({ home, slug: project.slug });
       projectId = project.projectId;
     }
-    ensurePrivateStateDirectory(resolve8(paths.projectDir(), ".."), paths.slug);
+    ensurePrivateStateDirectory(resolve10(paths.projectDir(), ".."), paths.slug);
     ensurePrivateStateDirectory(paths.projectDir(), "memory");
   } catch (error) {
     return emptySession(
@@ -9801,8 +10648,8 @@ async function createAgentSession(prefs, detected, options = {}) {
   const ownedJobs = jobRegistry ? bindOwner(jobRegistry, jobOwner) : void 0;
   const directories = [];
   for (const dir of options.additionalDirectories ?? []) {
-    const absolute = resolve8(cwd, dir);
-    if (absolute !== resolve8(cwd) && !directories.includes(absolute)) directories.push(absolute);
+    const absolute = resolve10(cwd, dir);
+    if (absolute !== resolve10(cwd) && !directories.includes(absolute)) directories.push(absolute);
   }
   const sessionDirectories = createSessionDirectories(cwd, directories);
   const checkpoints = new FileCheckpointStore(
@@ -9866,6 +10713,8 @@ async function createAgentSession(prefs, detected, options = {}) {
   let computerUseHost;
   let computerUseTool;
   let computerUseError;
+  const textOnlyModels = new TextOnlyModels();
+  let turnReadsImages = textOnlyModels.reads(provider, model);
   const computerUseProviderRefusal = options.enableComputerUse === true && computerUsePackage?.state === "present" ? computerUseUnavailableReason(provider) : void 0;
   if (computerUseProviderRefusal !== void 0) {
     toolsets.push(
@@ -9886,7 +10735,7 @@ async function createAgentSession(prefs, detected, options = {}) {
       toolsets.push(
         readyWhen(
           toolset("computer-use", [computerUseTool]),
-          () => computerUseHasControl(candidate.capabilities)
+          () => turnReadsImages && computerUseHasControl(candidate.capabilities)
         )
       );
       computerUseHost = candidate;
@@ -10002,7 +10851,26 @@ async function createAgentSession(prefs, detected, options = {}) {
     webSearchTool = createWebSearchTool();
     toolsets.push(toolset("web-search", [webSearchTool]));
   }
-  const webCapability = options.web?.fetch ? { fetch: new GuardedFetchProvider() } : void 0;
+  let sideModel;
+  const webCapability = options.web?.fetch ? {
+    // A page may be ten mebibytes, as in the reference; the guard's own
+    // default is two.
+    fetch: new GuardedFetchProvider({ maxBytes: WEB_FETCH_MAX_BYTES }),
+    // The answer to a prompt about a page comes from the small model. It is
+    // read at call time: the model exists once the delegation runtime does,
+    // and a page fetched without one is returned as markdown instead.
+    extract: {
+      extract: /* @__PURE__ */ __name(async (request) => sideModel?.ask({
+        sessionId: request.sessionId,
+        turnId: request.turnId,
+        instruction: request.instruction,
+        body: request.body,
+        maxTokens: WEB_EXTRACT_MAX_TOKENS,
+        signal: request.signal ?? new AbortController().signal,
+        timing: "in-turn"
+      }), "extract")
+    }
+  } : void 0;
   if (webCapability) toolsets.push(toolset("web-fetch", [WebFetchTool]));
   const delegationScopes = /* @__PURE__ */ new Map();
   const delegationLimits = /* @__PURE__ */ new Map();
@@ -10086,6 +10954,18 @@ async function createAgentSession(prefs, detected, options = {}) {
     )
   ] : [], "savedAgentsSteps");
   const directChildReports = /* @__PURE__ */ new Set();
+  const providerForModel = /* @__PURE__ */ __name(async (invokingSessionId, providerId, selectedModel) => {
+    if (!invokingSessionId && (providerId === "zen" || providerId === "zen-go"))
+      throw new Error("A delegated provider requires its invoking conversation.");
+    await ensureRegistered(providerId);
+    const credential = await currentCredentialFor(providerId);
+    return constructProvider(
+      providerId,
+      providerId === primary.id && credential ? { ...credential, apiKey: currentToken ?? credential.apiKey } : credential,
+      selectedModel,
+      { sessionId: invokingSessionId }
+    );
+  }, "providerForModel");
   let subagentRuntime;
   let allowedAgentIds = [];
   try {
@@ -10200,28 +11080,19 @@ async function createAgentSession(prefs, detected, options = {}) {
             }
           })
         );
-        const matches2 = catalogues.flat();
+        const matches = catalogues.flat();
         return JSON.stringify({
-          models: matches2.slice(0, 40),
-          omitted: Math.max(0, matches2.length - 40),
+          models: matches.slice(0, 40),
+          omitted: Math.max(0, matches.length - 40),
           guidance: "Use exact IDs. Omitted capability fields are unknown, not unsupported. Narrow query when results are omitted."
         });
       }, "listModels"),
       buildProvider: /* @__PURE__ */ __name(async (invokingSessionId, selection) => {
         const providerId = selection ? selection.provider : turnRouteTarget?.provider ?? primary.id;
         const selectedModel = selection?.model ?? turnRouteTarget?.model ?? model;
-        if (!invokingSessionId && (providerId === "zen" || providerId === "zen-go"))
-          throw new Error("A delegated provider requires its invoking conversation.");
-        await ensureRegistered(providerId);
-        const credential = await currentCredentialFor(providerId);
-        const childProvider = constructProvider(
-          providerId,
-          providerId === primary.id && credential ? { ...credential, apiKey: currentToken ?? credential.apiKey } : credential,
-          selectedModel,
-          { sessionId: invokingSessionId }
-        );
+        const childProvider = await providerForModel(invokingSessionId, providerId, selectedModel);
         if (selection?.effort) await prepareDelegatedEffort(childProvider, selectedModel);
-        return childProvider;
+        return textOnlyModels.informing(childProvider);
       }, "buildProvider"),
       configureWebSearch: /* @__PURE__ */ __name((childProvider, childModel, toolsets2) => {
         if (webSearch.mode === "off") return void 0;
@@ -10242,6 +11113,21 @@ async function createAgentSession(prefs, detected, options = {}) {
       authorizationGate: gateFor(sessionRules)
     });
     subagentRuntime = sub;
+    sideModel = createSideModel({
+      active: /* @__PURE__ */ __name(() => ({
+        providerId: turnRouteTarget?.provider ?? primary.id,
+        model: turnRouteTarget?.model ?? model
+      }), "active"),
+      configured: options.smallModel,
+      isKnownProvider: /* @__PURE__ */ __name((id) => findDetected(detected, id) != null, "isKnownProvider"),
+      buildProvider: /* @__PURE__ */ __name((sessionId, target) => providerForModel(sessionId, target.providerId, target.model), "buildProvider"),
+      offerable: /* @__PURE__ */ __name((providerId, listed) => {
+        const found = findDetected(detected, providerId);
+        return found != null && canSelectModel(found.entry, found.apiKey, listed.id) && isOfferableModel(providerId, listed.id);
+      }, "offerable"),
+      ledger: sub.sideLedger,
+      debug: /* @__PURE__ */ __name((message2, error) => cliLogger().debug(message2, exceptionAttributes(error)), "debug")
+    });
     const agentToolsets = [toolset("agents", [sub.agentTool, sub.waitForTaskTool])];
     if (sub.modelCatalogueTool)
       agentToolsets.push(toolset("agents:model-catalogue", [sub.modelCatalogueTool]));
@@ -10260,7 +11146,7 @@ async function createAgentSession(prefs, detected, options = {}) {
       runsDirectory: /* @__PURE__ */ __name((turnId) => {
         if (options.ephemeral) return void 0;
         const owner = delegationScopes.get(turnId) ?? scope;
-        return join13(paths.sessionDir({ sessionId: owner.sessionId }), "runs");
+        return join14(paths.sessionDir({ sessionId: owner.sessionId }), "runs");
       }, "runsDirectory"),
       refusal: /* @__PURE__ */ __name((turnId) => {
         const auth = delegatedWorkflowAuth.get(turnId);
@@ -10343,6 +11229,7 @@ async function createAgentSession(prefs, detected, options = {}) {
       );
     }
     subagentRuntime = void 0;
+    sideModel = void 0;
     cliLogger().warn("sub-agent runtime unavailable this session", exceptionAttributes(err));
   }
   const modelSwitchHandlers = /* @__PURE__ */ new Map();
@@ -10375,6 +11262,13 @@ async function createAgentSession(prefs, detected, options = {}) {
             action: "answer_question",
             selectedOptionIds: [...answer.selectedOptionIds],
             ...answer.freeText !== void 0 ? { freeText: answer.freeText } : {},
+            ...answer.answers ? {
+              answers: answer.answers.map((entry2) => ({
+                questionId: entry2.questionId,
+                selectedOptionIds: [...entry2.selectedOptionIds],
+                ...entry2.freeText !== void 0 ? { freeText: entry2.freeText } : {}
+              }))
+            } : {},
             questionId: request.question.questionId
           };
         case "abort":
@@ -10387,13 +11281,26 @@ async function createAgentSession(prefs, detected, options = {}) {
       toolset("ask-user-question", [buildAskUserQuestionTool({ resumeHandler: parkQuestion })])
     );
   }
+  let currentPlanHost;
+  if (options.planApproval && !options.ephemeral) {
+    toolsets.push(
+      toolset("plan-mode", [
+        buildExitPlanModeTool({
+          mode: /* @__PURE__ */ __name(() => currentPlanHost?.mode() ?? "prompt", "mode"),
+          planPath: /* @__PURE__ */ __name(() => currentPlanHost?.planPath ?? paths.planFile({ sessionId: scope.sessionId }), "planPath"),
+          bypassAvailable: /* @__PURE__ */ __name(() => currentPlanHost?.bypassAvailable() ?? false, "bypassAvailable"),
+          approval: /* @__PURE__ */ __name(() => currentPlanHost?.approval, "approval")
+        })
+      ])
+    );
+  }
   if (options.extraTools && options.extraTools.length > 0) {
     toolsets.push(toolset("extra", options.extraTools));
   }
   if (options.openUrl) toolsets.push(toolset("open-url", [createOpenUrlTool()]));
   const decisionTool = maybeCreateDecisionTool(options.decision, process.env);
   if (decisionTool) toolsets.push(toolset("decide", [decisionTool]));
-  const operatorPals = await import("./operator-tools-JRMP2OHZ.js");
+  const operatorPals = await import("./operator-tools-GKYGHHPM.js");
   toolsets.push(
     readyWhen(
       toolset(
@@ -10712,7 +11619,8 @@ async function createAgentSession(prefs, detected, options = {}) {
           (input) => subagentRuntime?.launchesReadOnlyAgent(input) === true
         ),
         { unattendedSandboxEscape },
-        screenPolicyFor(() => liveManager())
+        screenPolicyFor(() => liveManager()),
+        options.planApproval && !options.ephemeral ? isPlanFileWrite(paths.planFile({ sessionId: entry2.sessionId }), cwd) : void 0
       ), "handlerFor")
     });
     const resumeHandler = modeControl.handler;
@@ -10905,8 +11813,8 @@ async function createAgentSession(prefs, detected, options = {}) {
           if (mapped) yield mapped;
         }
         if (settled) break;
-        await new Promise((resolve9) => {
-          wake = resolve9;
+        await new Promise((resolve11) => {
+          wake = resolve11;
         });
         wake = void 0;
       }
@@ -10929,7 +11837,9 @@ async function createAgentSession(prefs, detected, options = {}) {
       return lastAutoRoute;
     },
     get imageAttachmentsSupported() {
-      return providerForSession(scope.sessionId).capabilities?.supportsVision;
+      const current = providerForSession(scope.sessionId);
+      if (options.routing) return current.capabilities?.supportsVision;
+      return textOnlyModels.reads(current, model) ? current.capabilities?.supportsVision : false;
     },
     get documentAttachmentsSupported() {
       return providerForSession(scope.sessionId).capabilities?.supportsDocuments;
@@ -10941,7 +11851,7 @@ async function createAgentSession(prefs, detected, options = {}) {
       return reasoningEffortDefault;
     },
     ...reasoningSettled ? { reasoningSettled } : {},
-    compact: /* @__PURE__ */ __name((messages) => operations.promise(void 0, async (signal) => {
+    compact: /* @__PURE__ */ __name((messages, instructions) => operations.promise(void 0, async (signal) => {
       const sessionId = scope.sessionId;
       const sessions = options.conversationSessions;
       await prepareProviderCredential(signal);
@@ -10949,7 +11859,8 @@ async function createAgentSession(prefs, detected, options = {}) {
         config: compactionConfigFor(options.compaction),
         provider: providerForSession(sessionId),
         model,
-        signal
+        signal,
+        ...instructions ? { instructions } : {}
       };
       if (sessions && !options.ephemeral) {
         if (sessions.projectId !== scope.projectId || sessions.tenantId !== scope.tenantId)
@@ -11010,7 +11921,7 @@ async function createAgentSession(prefs, detected, options = {}) {
           const live = host.registry.list();
           const known = new Set(live.map((view) => view.runId));
           const saved = options.ephemeral ? [] : await listWorkflowRuns(
-            join13(paths.sessionDir({ sessionId: scope.sessionId }), "runs")
+            join14(paths.sessionDir({ sessionId: scope.sessionId }), "runs")
           ).catch(() => []);
           return [
             ...[...live].sort((a, b) => b.startedAt - a.startedAt),
@@ -11025,6 +11936,7 @@ async function createAgentSession(prefs, detected, options = {}) {
         reset: /* @__PURE__ */ __name(() => host.registry.reset(), "reset")
       }))(workflowHost)
     } : {},
+    ...sideModel ? { sideModel } : {},
     ...subagentRuntime ? {
       subagents: subagentRuntime.activity,
       onSubagentReport: /* @__PURE__ */ __name((listener) => {
@@ -11219,6 +12131,13 @@ async function createAgentSession(prefs, detected, options = {}) {
     errorKind: null,
     // Reads the same object the handler mutates, at call time.
     allowForSession: /* @__PURE__ */ __name((allows) => sessionAllows.add(allows), "allowForSession"),
+    notifyHooks: /* @__PURE__ */ __name((info) => {
+      if (!sessionPlugins) return;
+      void sessionPlugins.manager.executeHooks("notification", {
+        sessionId: scope.sessionId,
+        notification: info
+      }).catch(() => []);
+    }, "notifyHooks"),
     commandArguments,
     setPermissionMode: /* @__PURE__ */ __name(async (mode, reason) => {
       await Promise.all(
@@ -11239,6 +12158,8 @@ async function createAgentSession(prefs, detected, options = {}) {
         let runManager = manager;
         lastSendInteractive = opts?.onPermission !== void 0;
         const turnScope = { ...scope };
+        const planPath = options.planApproval && !options.ephemeral ? paths.planFile({ sessionId: turnScope.sessionId }) : void 0;
+        const planModeWrite = planPath ? isPlanFileWrite(planPath, cwd) : void 0;
         const initialMode = opts?.permissionMode ?? options.permissionMode ?? (opts?.onPermission || opts?.reviewHold ? "prompt" : "auto");
         const modeControl = createLiveModeControl({
           initial: initialMode,
@@ -11264,7 +12185,8 @@ async function createAgentSession(prefs, detected, options = {}) {
               (input) => subagentRuntime?.launchesReadOnlyAgent(input) === true
             ),
             { unattendedSandboxEscape },
-            screenPolicyFor(() => runManager)
+            screenPolicyFor(() => runManager),
+            planModeWrite
           ), "handlerFor")
         });
         const resumeHandler = modeControl.handler;
@@ -11301,6 +12223,8 @@ async function createAgentSession(prefs, detected, options = {}) {
           const autoRoute = await autoRouteFor(messages, turnScope.sessionId, signal);
           const turnWebSearch = autoRoute ? routedWebSearch(autoRoute) : nativeWebSearch;
           const turnSkills = await turnSkillsFor(autoRoute?.model ?? model);
+          const turnProvider = autoRoute?.provider ?? providerForSession(turnScope.sessionId);
+          turnReadsImages = textOnlyModels.reads(turnProvider, autoRoute?.model ?? model);
           const curatedMemory = readMemory(void 0, cwd);
           for (const notice of formatMemoryDiagnostics(curatedMemory)) {
             yield { kind: "context", text: notice, shed: false };
@@ -11315,6 +12239,12 @@ async function createAgentSession(prefs, detected, options = {}) {
           }
           const curatedMemoryPrompt = composeMemoryPrompt(curatedMemory);
           currentOnQuestion = opts?.onQuestion;
+          currentPlanHost = planPath ? {
+            mode: /* @__PURE__ */ __name(() => modeControl.current(), "mode"),
+            planPath,
+            approval: opts?.onPlanExit,
+            bypassAvailable: opts?.bypassAvailable ?? (() => false)
+          } : void 0;
           const [environmentFacts, turnSnapshot] = await Promise.all([
             readEnvironmentFacts(cwd),
             readTurnSnapshot(cwd)
@@ -11432,7 +12362,7 @@ async function createAgentSession(prefs, detected, options = {}) {
             // Present only while the turn runs under `plan`. A mode change
             // is rare, so the cached prefix it re-keys is a price paid once
             // per switch rather than once per turn.
-            !residentContext && opts?.permissionMode === "plan" ? PLAN_MODE_DOCTRINE : void 0,
+            !residentContext && opts?.permissionMode === "plan" ? planPath ? NAMZU_PLAN_FILE_DOCTRINE : PLAN_MODE_DOCTRINE : void 0,
             residentContext ? void 0 : environmentPrompt,
             residentContext ? void 0 : opts?.extraSystem,
             residentContext ? void 0 : opts?.systemNote,
@@ -11453,6 +12383,14 @@ async function createAgentSession(prefs, detected, options = {}) {
           }
           claimTurn(turnId);
           const turnTaskStore = selectTaskStore(turnScope);
+          const reminderSource = options.reminders ? createCliReminderSource({
+            mode: /* @__PURE__ */ __name(() => modeControl.current(), "mode"),
+            ...planPath ? {
+              planPath: /* @__PURE__ */ __name(() => planPath, "planPath"),
+              canAsk: Boolean(options.askUser && subagentRuntime)
+            } : {},
+            tasks: /* @__PURE__ */ __name(() => turnTaskStore.list({ sessionId: turnScope.sessionId }), "tasks")
+          }) : void 0;
           let ephemeralLog;
           if (options.ephemeral) {
             ephemeralLog = new InMemorySessionLog({
@@ -11477,7 +12415,7 @@ async function createAgentSession(prefs, detected, options = {}) {
           }
           try {
             for await (const event of runTurn({
-              provider: autoRoute?.provider ?? providerForSession(turnScope.sessionId),
+              provider: textOnlyModels.informing(turnProvider),
               fileReadTracker: await observationsFor(turnScope.sessionId, messages),
               compactionConfig: compactionConfigFor(options.compaction),
               retainedToolPreviewChars: options.conversationSessions ? options.compaction?.retainedToolPreviewChars ?? 4e3 : void 0,
@@ -11494,7 +12432,10 @@ async function createAgentSession(prefs, detected, options = {}) {
               // is a fallback that fails for the reason the fallback exists to
               // survive. Building a driver is a client object, not a request.
               // A routed turn has no fallback chain, like a pinned resume.
-              fallbackProviders: autoRoute ? [] : fallbackPlan.build(currentToken, turnScope.sessionId),
+              fallbackProviders: autoRoute ? [] : fallbackPlan.build(currentToken, turnScope.sessionId).map((member) => ({
+                ...member,
+                provider: textOnlyModels.informing(member.provider)
+              })),
               model: autoRoute?.model ?? model,
               toolsets: runToolsets,
               ...screensConfig !== void 0 ? { toolResultGuardrails: screensConfig } : {},
@@ -11535,6 +12476,7 @@ async function createAgentSession(prefs, detected, options = {}) {
                 ...memoryContextSteps(curatedMemoryPrompt, storedMemory.prompt)
               ],
               taskStore: turnTaskStore,
+              ...reminderSource ? { reminders: reminderSource } : {},
               systemPrompt,
               messages,
               projectInstructionContext: projectInstructions.createTurnContext(),
@@ -11555,7 +12497,12 @@ async function createAgentSession(prefs, detected, options = {}) {
                 task_update: options.toolLoading === "deferred" ? "deferred" : "active",
                 task_list: options.toolLoading === "deferred" ? "deferred" : "active"
               },
-              onSessionEvent: options.onSessionEvent,
+              onSessionEvent: /* @__PURE__ */ __name((event2) => {
+                if (event2.type === "capability_warning" && event2.contentSource === "history" && event2.model !== void 0) {
+                  textOnlyModels.add(event2.providerId, event2.model);
+                }
+                options.onSessionEvent?.(event2);
+              }, "onSessionEvent"),
               ...sandbox.provider ? { sandboxProvider: sandbox.provider } : {},
               ...options.sandbox?.teardownTimeoutMs !== void 0 ? {
                 sandboxTeardownTimeoutMs: options.sandbox.teardownTimeoutMs
@@ -11975,13 +12922,17 @@ function gateFor(rules) {
   return { ...VERIFICATION_GATE, rules: [...rules ?? []] };
 }
 __name(gateFor, "gateFor");
+var MAX_OUTPUT_CONTINUATIONS = 3;
 var COMPACTION_CONFIG = {
   strategy: "salience",
+  // Give up on compaction that keeps failing or keeps refilling, and say so
+  // once. The kernel leaves this off, so the CLI asks.
+  circuitBreaker: true,
   // On, and this is the CLI making a choice rather than taking a default.
   // A session's transcript is the only record of what was compacted away;
   // the size trade this costs is the operator's to see and turn off.
   recordShedHistory: true,
-  triggerThreshold: 0.7,
+  // No `triggerThreshold`: the kernel derives it from the model's window.
   resetThreshold: 0.4,
   keepRecentMessages: 6,
   // Reclaim from stale tool output before summarizing. A CLI session is
@@ -12049,6 +13000,7 @@ async function* runTurn({
   onApprovalPolicy,
   reviewAllowedCalls,
   taskStore,
+  reminders,
   systemPrompt,
   messages,
   projectInstructionContext,
@@ -12073,6 +13025,7 @@ async function* runTurn({
   const readsOnly = declaredReadOnly(turnManager);
   try {
     const events = query({
+      maxOutputContinuations: MAX_OUTPUT_CONTINUATIONS,
       ...retainedToolPreviewChars !== void 0 ? { retainedToolPreviewChars } : {},
       ...fileReadTracker ? { fileReadTracker } : {},
       ...structuredOutput ? { structuredOutput } : {},
@@ -12133,6 +13086,7 @@ async function* runTurn({
       ...systemPrompt ? { systemPrompt } : {},
       projectInstructionContext,
       messages: [...messages],
+      ...reminders ? { reminders } : {},
       ...opts?.inboundMessages ? { inboundMessages: opts.inboundMessages } : {},
       ...opts?.waitForInbound ? { waitForInbound: opts.waitForInbound } : {},
       ...opts?.durableInbound ? { durableInbound: opts.durableInbound } : {},
@@ -12206,12 +13160,13 @@ async function* runTurn({
   }
 }
 __name(runTurn, "runTurn");
-function makeResumeHandler(approval, onPermission, mode = onPermission ? "prompt" : "auto", exempt = () => false, escapePolicy = {}, screen) {
+function makeResumeHandler(approval, onPermission, mode = onPermission ? "prompt" : "auto", exempt = () => false, escapePolicy = {}, screen, planModeWrite) {
   return createReviewHandler({
     mode,
     prompt: onPermission,
     exempt,
     remembered: approval,
+    ...planModeWrite ? { planModeWrite } : {},
     ...screen ? { screenConsent: screen.consent, capturesScreen: screen.capturesScreen } : {},
     // Refused unless the operator wrote `sandbox.allowUnattendedEscape`: a
     // session with nobody to ask has nobody to consent to leaving the
@@ -12270,7 +13225,9 @@ function withRuntimeMountedTools(manager) {
 __name(withRuntimeMountedTools, "withRuntimeMountedTools");
 function reviewExemptionFor(mode, manager, launchesReadOnlyAgent) {
   const exemptLookup = withRuntimeMountedTools(manager);
-  return (name, input) => isPromptExempt(exemptLookup, name, input) || mode !== "strict" && name === AGENT_LAUNCH_TOOL && launchesReadOnlyAgent(input) || mode !== "strict" && mode !== "plan" && confirmsItself(name, input) || mode !== "strict" && mode !== "plan" && name === SAVE_SKILL_TOOL_NAME && manager.has(SAVE_SKILL_TOOL_NAME);
+  return (name, input) => isPromptExempt(exemptLookup, name, input) || // Presenting a plan asks the person on its own screen and changes nothing;
+  // `plan` is the one mode it is for. Outside it the tool refuses by itself.
+  name === EXIT_PLAN_MODE_TOOL_NAME && manager.has(EXIT_PLAN_MODE_TOOL_NAME) || mode !== "strict" && name === AGENT_LAUNCH_TOOL && launchesReadOnlyAgent(input) || mode !== "strict" && mode !== "plan" && confirmsItself(name, input) || mode !== "strict" && mode !== "plan" && name === SAVE_SKILL_TOOL_NAME && manager.has(SAVE_SKILL_TOOL_NAME);
 }
 __name(reviewExemptionFor, "reviewExemptionFor");
 function confirmsItself(name, input) {
@@ -12335,6 +13292,21 @@ function toAgentEvent(event, presenter, readsOnly) {
         ...event.messageId ? { messageId: event.messageId } : {},
         ...event.turnId ? { turnId: event.turnId } : {}
       };
+    case "plugin_hook_completed": {
+      const result = event.result;
+      if ((result.action === "continue" || result.action === "skip") && result.halt) {
+        return {
+          kind: "hook-notice",
+          text: `A hook stopped this turn: ${result.halt.reason}`
+        };
+      }
+      if ((result.action === "continue" || result.action === "skip") && result.notice) {
+        return { kind: "hook-notice", text: `A hook says: ${result.notice}` };
+      }
+      return null;
+    }
+    case "plugin_hook_executing":
+      return event.statusMessage ? { kind: "hook-status", text: event.statusMessage } : null;
     case "reasoning_started":
       return { kind: "reasoning", text: "" };
     case "reasoning_delta":
@@ -12560,6 +13532,7 @@ function toAgentEvent(event, presenter, readsOnly) {
         reclaimedTokens: event.reclaimedTokens
       };
     case "compaction_failed":
+      if (event.cause === "breaker_open") return null;
       return {
         kind: "context",
         text: describeCompactionFailure(event),
@@ -12585,6 +13558,10 @@ function describeCompactionFailure(event) {
       return `context could not be reduced further \u2014 nothing left to shed. ${held}; later passes will answer the same`;
     case "split_tool_pair":
       return `context not compacted \u2014 the reducer produced a history splitting a tool call from its result, so it was refused. ${held}; this is a bug in the reducer`;
+    case "breaker_open":
+      return "automatic compaction paused for this reply after repeated attempts that shed nothing";
+    case "refilling":
+      return event.error ?? "The context filled up again right after being compacted, three times in a row. A file being read or a tool output is probably too large for the context window. Try reading it in smaller parts.";
   }
 }
 __name(describeCompactionFailure, "describeCompactionFailure");
@@ -12882,6 +13859,8 @@ export {
   renderStoredMemorySection,
   allowsForBatch,
   describeAllows,
+  KEEP_PLANNING_PLACEHOLDER,
+  planApprovalRows,
   assistantTranscriptTexts,
   projectTurnConversation,
   resolveModelSwitch,
@@ -12911,4 +13890,4 @@ export {
   RESULT_SUMMARY_WHOLE_MAX,
   resultSummaryLine
 };
-//# sourceMappingURL=chunk-IKGTBMN2.js.map
+//# sourceMappingURL=chunk-6HDBRUB7.js.map