@oh-my-pi/pi-coding-agent 15.10.0 → 15.10.1

package/src/tools/image-gen.ts

@@ -1,6 +1,6 @@
 import * as os from "node:os";
 import * as path from "node:path";
-import { getAntigravityUserAgent, getEnvApiKey, type Model } from "@oh-my-pi/pi-ai";
+import { type ApiKey, getAntigravityUserAgent, getEnvApiKey, type Model, withAuth } from "@oh-my-pi/pi-ai";
 import {
 	CODEX_BASE_URL,
 	getCodexAccountId,
@@ -20,6 +20,7 @@ import {
 } from "@oh-my-pi/pi-utils";
 import * as z from "zod/v4";
 import packageJson from "../../package.json" with { type: "json" };
+
 import { isAuthenticated, type ModelRegistry } from "../config/model-registry";
 import type { CustomTool } from "../extensibility/custom-tools/types";
 import { ohMyPiXAIUserAgent, resolveXAIHttpCredentials } from "../lib/xai-http";
@@ -864,7 +865,10 @@ async function generateOpenAIHostedImage(
 
 	if (!response.ok) {
 		const errorText = await response.text();
-		throw new Error(`OpenAI image request failed (${response.status}): ${getOpenAIResponseErrorMessage(errorText)}`);
+		throw Object.assign(
+			new Error(`OpenAI image request failed (${response.status}): ${getOpenAIResponseErrorMessage(errorText)}`),
+			{ status: response.status },
+		);
 	}
 
 	const contentType = response.headers.get("content-type") ?? "";
@@ -1037,13 +1041,16 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 					throw new Error("Missing active GPT model for OpenAI image generation");
 				}
 
-				const parsed = await generateOpenAIHostedImage(
-					apiKey.apiKey,
-					apiKey.model,
-					params,
-					resolvedImages,
-					requestSignal,
+				const hostedModel = apiKey.model;
+				const hostedKey: ApiKey = ctx.modelRegistry.resolver(hostedModel.provider, {
 					sessionId,
+					baseUrl: hostedModel.baseUrl,
+				});
+
+				const parsed = await withAuth(
+					hostedKey,
+					key => generateOpenAIHostedImage(key, hostedModel, params, resolvedImages, requestSignal, sessionId),
+					{ signal: requestSignal },
 				);
 
 				if (parsed.images.length === 0) {
@@ -1088,38 +1095,57 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 				}
 
 				const prompt = assemblePrompt(params);
-				const requestBody = buildAntigravityRequest(
-					prompt,
-					model,
-					apiKey.projectId,
-					params.aspect_ratio,
-					params.image_size,
-					resolvedImages,
-				);
-
-				const response = await fetch(`${ANTIGRAVITY_ENDPOINT}/v1internal:streamGenerateContent?alt=sse`, {
-					method: "POST",
-					headers: {
-						Authorization: `Bearer ${apiKey.apiKey}`,
-						"Content-Type": "application/json",
-						Accept: "text/event-stream",
-						"User-Agent": getAntigravityUserAgent(),
-					},
-					body: JSON.stringify(requestBody),
-					signal: requestSignal,
+				const antigravityKey: ApiKey = ctx.modelRegistry.resolver("google-antigravity", {
+					sessionId,
 				});
 
-				if (!response.ok) {
-					const errorText = await response.text();
-					let message = errorText;
-					try {
-						const parsed = JSON.parse(errorText) as { error?: { message?: string } };
-						message = parsed.error?.message ?? message;
-					} catch {
-						// Keep raw text.
-					}
-					throw new Error(`Antigravity image request failed (${response.status}): ${message}`);
-				}
+				const response = await withAuth(
+					antigravityKey,
+					async key => {
+						// On a retry the resolver yields the raw stored credential JSON
+						// ({ token, projectId }); the initial seed is the already-parsed
+						// access token. Tolerate both, falling back to the seed projectId.
+						const rotated = parseAntigravityCredentials(key);
+						const bearer = rotated?.accessToken ?? key;
+						const projectId = rotated?.projectId ?? apiKey.projectId!;
+						const requestBody = buildAntigravityRequest(
+							prompt,
+							model,
+							projectId,
+							params.aspect_ratio,
+							params.image_size,
+							resolvedImages,
+						);
+
+						const resp = await fetch(`${ANTIGRAVITY_ENDPOINT}/v1internal:streamGenerateContent?alt=sse`, {
+							method: "POST",
+							headers: {
+								Authorization: `Bearer ${bearer}`,
+								"Content-Type": "application/json",
+								Accept: "text/event-stream",
+								"User-Agent": getAntigravityUserAgent(),
+							},
+							body: JSON.stringify(requestBody),
+							signal: requestSignal,
+						});
+
+						if (!resp.ok) {
+							const errorText = await resp.text();
+							let message = errorText;
+							try {
+								const parsedErr = JSON.parse(errorText) as { error?: { message?: string } };
+								message = parsedErr.error?.message ?? message;
+							} catch {
+								// Keep raw text.
+							}
+							throw Object.assign(new Error(`Antigravity image request failed (${resp.status}): ${message}`), {
+								status: resp.status,
+							});
+						}
+						return resp;
+					},
+					{ signal: requestSignal },
+				);
 
 				const parsed = await parseAntigravitySseForImage(response, requestSignal);
 				const responseText = parsed.text.length > 0 ? parsed.text.join(" ") : undefined;
@@ -1191,28 +1217,41 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 					: xaiBaseBody;
 				const xaiEndpoint = isEdit ? "/images/edits" : "/images/generations";
 
-				const xaiResponse = await fetch(`${xaiCreds.baseURL}${xaiEndpoint}`, {
-					method: "POST",
-					headers: {
-						Authorization: `Bearer ${xaiCreds.apiKey}`,
-						"Content-Type": "application/json",
-						"User-Agent": ohMyPiXAIUserAgent(),
-					},
-					body: JSON.stringify(xaiBody),
-					signal: requestSignal,
+				const xaiKey: ApiKey = ctx.modelRegistry.resolver(xaiCreds.provider, {
+					sessionId,
+					baseUrl: xaiCreds.baseURL,
 				});
 
-				const xaiRawText = await xaiResponse.text();
-				if (!xaiResponse.ok) {
-					let message = xaiRawText;
-					try {
-						const parsedErr = JSON.parse(xaiRawText) as { error?: { message?: string } };
-						message = parsedErr.error?.message ?? message;
-					} catch {
-						// Keep raw text.
-					}
-					throw new Error(`xAI image request failed (${xaiResponse.status}): ${message}`);
-				}
+				const xaiRawText = await withAuth(
+					xaiKey,
+					async key => {
+						const resp = await fetch(`${xaiCreds.baseURL}${xaiEndpoint}`, {
+							method: "POST",
+							headers: {
+								Authorization: `Bearer ${key}`,
+								"Content-Type": "application/json",
+								"User-Agent": ohMyPiXAIUserAgent(),
+							},
+							body: JSON.stringify(xaiBody),
+							signal: requestSignal,
+						});
+						const rawText = await resp.text();
+						if (!resp.ok) {
+							let message = rawText;
+							try {
+								const parsedErr = JSON.parse(rawText) as { error?: { message?: string } };
+								message = parsedErr.error?.message ?? message;
+							} catch {
+								// Keep raw text.
+							}
+							throw Object.assign(new Error(`xAI image request failed (${resp.status}): ${message}`), {
+								status: resp.status,
+							});
+						}
+						return rawText;
+					},
+					{ signal: requestSignal },
+				);
 
 				const xaiData = JSON.parse(xaiRawText) as {
 					data?: Array<{ b64_json?: string; url?: string }>;
@@ -1269,30 +1308,34 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 					messages: [{ role: "user" as const, content: contentParts }],
 				};
 
-				const response = await fetch("https://openrouter.ai/api/v1/chat/completions", {
-					method: "POST",
-					headers: {
-						"Content-Type": "application/json",
-						Authorization: `Bearer ${apiKey.apiKey}`,
-						"HTTP-Referer": "https://omp.sh/",
-						"X-OpenRouter-Title": "Oh-My-Pi",
-						"X-OpenRouter-Categories": "cli-agent",
-					},
-					body: JSON.stringify(requestBody),
-					signal: requestSignal,
-				});
-
-				const rawText = await response.text();
-				if (!response.ok) {
-					let message = rawText;
-					try {
-						const parsed = JSON.parse(rawText) as { error?: { message?: string } };
-						message = parsed.error?.message ?? message;
-					} catch {
-						// Keep raw text.
+				const rawText = await withAuth(apiKey.apiKey, async key => {
+					const resp = await fetch("https://openrouter.ai/api/v1/chat/completions", {
+						method: "POST",
+						headers: {
+							"Content-Type": "application/json",
+							Authorization: `Bearer ${key}`,
+							"HTTP-Referer": "https://omp.sh/",
+							"X-OpenRouter-Title": "Oh-My-Pi",
+							"X-OpenRouter-Categories": "cli-agent",
+						},
+						body: JSON.stringify(requestBody),
+						signal: requestSignal,
+					});
+					const text = await resp.text();
+					if (!resp.ok) {
+						let message = text;
+						try {
+							const parsed = JSON.parse(text) as { error?: { message?: string } };
+							message = parsed.error?.message ?? message;
+						} catch {
+							// Keep raw text.
+						}
+						throw Object.assign(new Error(`OpenRouter image request failed (${resp.status}): ${message}`), {
+							status: resp.status,
+						});
 					}
-					throw new Error(`OpenRouter image request failed (${response.status}): ${message}`);
-				}
+					return text;
+				});
 
 				const data = JSON.parse(rawText) as OpenRouterResponse;
 				const message = data.choices?.[0]?.message;
@@ -1360,30 +1403,34 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 				generationConfig,
 			};
 
-			const response = await fetch(
-				`https://generativelanguage.googleapis.com/v1beta/models/${encodeURIComponent(model)}:generateContent`,
-				{
-					method: "POST",
-					headers: {
-						"Content-Type": "application/json",
-						"x-goog-api-key": apiKey.apiKey,
+			const rawText = await withAuth(apiKey.apiKey, async key => {
+				const resp = await fetch(
+					`https://generativelanguage.googleapis.com/v1beta/models/${encodeURIComponent(model)}:generateContent`,
+					{
+						method: "POST",
+						headers: {
+							"Content-Type": "application/json",
+							"x-goog-api-key": key,
+						},
+						body: JSON.stringify(requestBody),
+						signal: requestSignal,
 					},
-					body: JSON.stringify(requestBody),
-					signal: requestSignal,
-				},
-			);
-
-			const rawText = await response.text();
-			if (!response.ok) {
-				let message = rawText;
-				try {
-					const parsed = JSON.parse(rawText) as { error?: { message?: string } };
-					message = parsed.error?.message ?? message;
-				} catch {
-					// Keep raw text.
+				);
+				const text = await resp.text();
+				if (!resp.ok) {
+					let message = text;
+					try {
+						const parsed = JSON.parse(text) as { error?: { message?: string } };
+						message = parsed.error?.message ?? message;
+					} catch {
+						// Keep raw text.
+					}
+					throw Object.assign(new Error(`Gemini image request failed (${resp.status}): ${message}`), {
+						status: resp.status,
+					});
 				}
-				throw new Error(`Gemini image request failed (${response.status}): ${message}`);
-			}
+				return text;
+			});
 
 			const data = JSON.parse(rawText) as GeminiGenerateContentResponse;
 			const responseParts = combineParts(data);

package/src/tools/inspect-image-renderer.ts

@@ -2,8 +2,8 @@ import type { Component } from "@oh-my-pi/pi-tui";
 import { Text } from "@oh-my-pi/pi-tui";
 import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import type { Theme } from "../modes/theme/theme";
-import { renderStatusLine } from "../tui";
-import { formatExpandHint, replaceTabs, shortenPath, truncateToWidth } from "./render-utils";
+import { framedBlock, renderStatusLine } from "../tui";
+import { formatErrorDetail, formatExpandHint, replaceTabs, shortenPath, truncateToWidth } from "./render-utils";
 
 interface InspectImageRenderArgs {
 	path?: string;
@@ -27,17 +27,21 @@ const INSPECT_OUTPUT_COLLAPSED_LINES = 4;
 const INSPECT_OUTPUT_EXPANDED_LINES = 16;
 const INSPECT_OUTPUT_LINE_WIDTH = 120;
 
+function questionLine(question: string, uiTheme: Theme): string {
+	return `${uiTheme.fg("dim", "Question:")} ${uiTheme.fg("accent", truncateToWidth(replaceTabs(question), INSPECT_QUESTION_PREVIEW_WIDTH))}`;
+}
+
 export const inspectImageToolRenderer = {
 	renderCall(args: InspectImageRenderArgs, _options: RenderResultOptions, uiTheme: Theme): Component {
 		const rawPath = args.path ?? "";
 		const pathDisplay = rawPath ? shortenPath(rawPath) : "…";
-		const header = renderStatusLine({ icon: "pending", title: "Inspect Image", description: pathDisplay }, uiTheme);
+		const header = renderStatusLine({ icon: "pending", title: "Inspect", description: pathDisplay }, uiTheme);
 		const question = args.question?.trim();
-		if (!question) {
-			return new Text(header, 0, 0);
-		}
-		const questionLine = ` ${uiTheme.fg("dim", uiTheme.tree.last)} ${uiTheme.fg("dim", "Question:")} ${uiTheme.fg("accent", truncateToWidth(replaceTabs(question), INSPECT_QUESTION_PREVIEW_WIDTH))}`;
-		return new Text(`${header}\n${questionLine}`, 0, 0);
+		// Call is at most a status line plus a one-line question — too small to box.
+		// The container renders a lone Text cleanly with no chrome.
+		if (!question) return new Text(header, 0, 0);
+		const tree = ` ${uiTheme.fg("dim", uiTheme.tree.last)} ${questionLine(question, uiTheme)}`;
+		return new Text(`${header}\n${tree}`, 0, 0);
 	},
 
 	renderResult(
@@ -49,55 +53,73 @@ export const inspectImageToolRenderer = {
 		const details = result.details;
 		const rawPath = details?.imagePath ?? args?.path ?? "";
 		const pathDisplay = rawPath ? shortenPath(rawPath) : "image";
-		const metaParts: string[] = [];
-		if (details?.model) metaParts.push(details.model);
-		if (details?.mimeType) metaParts.push(details.mimeType);
 		const header = renderStatusLine(
 			{
 				icon: result.isError ? "error" : "success",
-				title: "Inspect Image",
+				title: "Inspect",
 				description: pathDisplay,
 			},
 			uiTheme,
 		);
 
-		const lines: string[] = [header];
 		const question = args?.question?.trim();
-		if (question) {
-			lines.push(
-				` ${uiTheme.fg("dim", uiTheme.tree.branch)} ${uiTheme.fg("dim", "Question:")} ${uiTheme.fg("accent", truncateToWidth(replaceTabs(question), INSPECT_QUESTION_PREVIEW_WIDTH))}`,
-			);
-		}
-
 		const outputText = result.content.find(content => content.type === "text")?.text?.trimEnd() ?? "";
-		if (!outputText) {
-			lines.push(uiTheme.fg("dim", "(no output)"));
-			if (metaParts.length > 0) {
-				lines.push("");
-				lines.push(uiTheme.fg("dim", metaParts.join(" · ")));
-			}
-			return new Text(lines.join("\n"), 0, 0);
-		}
 
-		lines.push("");
-		const outputLines = replaceTabs(outputText).split("\n");
-		const maxLines = options.expanded ? INSPECT_OUTPUT_EXPANDED_LINES : INSPECT_OUTPUT_COLLAPSED_LINES;
-		for (const line of outputLines.slice(0, maxLines)) {
-			lines.push(uiTheme.fg("toolOutput", truncateToWidth(line, INSPECT_OUTPUT_LINE_WIDTH)));
+		if (result.isError) {
+			return framedBlock(uiTheme, width => {
+				const bodyLines: string[] = [];
+				if (question) bodyLines.push(questionLine(question, uiTheme));
+				bodyLines.push(formatErrorDetail(outputText || "inspection failed", uiTheme));
+				return {
+					header,
+					sections: [{ lines: bodyLines }],
+					state: "error",
+					borderColor: "error",
+					applyBg: false,
+					width,
+				};
+			});
 		}
 
-		if (outputLines.length > maxLines) {
-			const remaining = outputLines.length - maxLines;
-			const hint = formatExpandHint(uiTheme, options.expanded, true);
-			lines.push(`${uiTheme.fg("dim", `… ${remaining} more lines`)}${hint ? ` ${hint}` : ""}`);
-		}
+		const metaParts: string[] = [];
+		if (details?.model) metaParts.push(details.model);
+		if (details?.mimeType) metaParts.push(details.mimeType);
+		const metaLine = metaParts.length > 0 ? uiTheme.fg("dim", metaParts.join(" · ")) : "";
 
-		if (metaParts.length > 0) {
-			lines.push("");
-			lines.push(uiTheme.fg("dim", metaParts.join(" · ")));
+		// No answer text: nothing worth boxing — keep it to a clean status line
+		// (plus a trailing meta line, when present).
+		if (!outputText) {
+			return new Text(metaLine ? `${header}\n${metaLine}` : header, 0, 0);
 		}
 
-		return new Text(lines.join("\n"), 0, 0);
+		return framedBlock(uiTheme, width => {
+			const bodyLines: string[] = [];
+			if (question) {
+				bodyLines.push(questionLine(question, uiTheme));
+				bodyLines.push("");
+			}
+
+			const outputLines = replaceTabs(outputText).split("\n");
+			const maxLines = options.expanded ? INSPECT_OUTPUT_EXPANDED_LINES : INSPECT_OUTPUT_COLLAPSED_LINES;
+			for (const line of outputLines.slice(0, maxLines)) {
+				bodyLines.push(uiTheme.fg("toolOutput", truncateToWidth(line, INSPECT_OUTPUT_LINE_WIDTH)));
+			}
+			if (outputLines.length > maxLines) {
+				const remaining = outputLines.length - maxLines;
+				const hint = formatExpandHint(uiTheme, options.expanded, true);
+				bodyLines.push(`${uiTheme.fg("dim", `… ${remaining} more lines`)}${hint ? ` ${hint}` : ""}`);
+			}
+
+			return {
+				header,
+				headerMeta: metaLine || undefined,
+				sections: [{ lines: bodyLines }],
+				state: "success",
+				borderColor: "borderMuted",
+				applyBg: false,
+				width,
+			};
+		});
 	},
 	mergeCallAndResult: true,
 };

package/src/tools/inspect-image.ts

@@ -4,6 +4,7 @@ import { type Api, completeSimple, type Model } from "@oh-my-pi/pi-ai";
 import { prompt } from "@oh-my-pi/pi-utils";
 import * as z from "zod/v4";
 import { extractTextContent } from "../commit/utils";
+
 import { expandRoleAlias, resolveModelFromString } from "../config/model-resolver";
 import inspectImageDescription from "../prompts/tools/inspect-image.md" with { type: "text" };
 import inspectImageSystemPromptTemplate from "../prompts/tools/inspect-image-system.md" with { type: "text" };
@@ -136,7 +137,13 @@ export class InspectImageTool implements AgentTool<typeof inspectImageSchema, In
 					},
 				],
 			},
-			{ apiKey, signal },
+			{
+				apiKey: modelRegistry.resolver(model.provider, {
+					sessionId: this.session.getSessionId?.() ?? undefined,
+					baseUrl: model.baseUrl,
+				}),
+				signal,
+			},
 			{ telemetry, oneshotKind: "inspect_image", completeImpl: this.completeImageRequest },
 		);
 

package/src/tools/job.ts

@@ -396,7 +396,7 @@ export const jobToolRenderer = {
 	inline: true,
 
 	renderCall(args: JobRenderArgs, _options: RenderResultOptions, uiTheme: Theme): Component {
-		const text = renderStatusLine({ icon: "pending", title: "Job", description: describeTarget(args) }, uiTheme);
+		const text = renderStatusLine({ icon: "pending", title: describeTarget(args) || "Job" }, uiTheme);
 		return new Text(text, 0, 0);
 	},
 
@@ -410,7 +410,7 @@ export const jobToolRenderer = {
 
 		if (jobs.length === 0) {
 			const fallback = result.content?.find(c => c.type === "text")?.text || "No jobs to process";
-			const header = renderStatusLine({ icon: "warning", title: "Job", description: describeTarget(args) }, uiTheme);
+			const header = renderStatusLine({ icon: "warning", title: describeTarget(args) || "Job" }, uiTheme);
 			return new Text([header, formatEmptyMessage(fallback, uiTheme)].join("\n"), 0, 0);
 		}
 
@@ -433,8 +433,7 @@ export const jobToolRenderer = {
 			{
 				icon: headerIcon,
 				spinnerFrame: counts.running > 0 ? options.spinnerFrame : undefined,
-				title: "Job",
-				description,
+				title: description,
 				meta,
 			},
 			uiTheme,

package/src/tools/memory-render.ts

@@ -4,7 +4,10 @@
  *
  * These keep the transcript terse — one status line plus, for `retain`, one
  * `Remember: …` line per stored item — instead of the generic JSON arg tree,
- * which exploded multi-line memory blobs into an unreadable wall.
+ * which exploded multi-line memory blobs into an unreadable wall. The tool
+ * container is a transparent passthrough, so these renderers stay frameless:
+ * a status line with a couple of dim bullets reads far cleaner than boxing a
+ * one-line memory note.
  */
 import type { Component } from "@oh-my-pi/pi-tui";
 import { Text } from "@oh-my-pi/pi-tui";

package/src/tools/plan-mode-guard.ts

@@ -1,4 +1,3 @@
-import * as path from "node:path";
 import { resolveLocalUrlToPath, resolveVaultUrlToPath } from "../internal-urls";
 import type { ToolSession } from ".";
 import { normalizeLocalScheme, resolveToCwd } from "./path-utils";
@@ -6,10 +5,19 @@ import { ToolError } from "./tool-errors";
 
 const VAULT_SCHEME_PREFIX = "vault:";
 const LOCAL_SCHEME_PREFIX = "local:";
-const PLAN_ALIAS_FILE = "PLAN.md";
-const LOCAL_PLAN_ALIAS = "local://PLAN.md";
 
-function resolveRawPath(session: ToolSession, targetPath: string): string {
+/** True when `targetPath` addresses the session-local artifact sandbox
+ *  (`local://…`). Those files are not part of the working tree, so plan mode
+ *  treats them as freely writable scratch/plan space. */
+function targetsLocalSandbox(targetPath: string): boolean {
+	return normalizeLocalScheme(targetPath).startsWith(LOCAL_SCHEME_PREFIX);
+}
+
+/**
+ * Resolve a write/edit target to its absolute filesystem path, honoring the
+ * `local://` and `vault://` schemes. Plain paths resolve against the session cwd.
+ */
+export function resolvePlanPath(session: ToolSession, targetPath: string): string {
 	const normalized = normalizeLocalScheme(targetPath);
 	if (normalized.startsWith(LOCAL_SCHEME_PREFIX)) {
 		return resolveLocalUrlToPath(normalized, {
@@ -25,37 +33,12 @@ function resolveRawPath(session: ToolSession, targetPath: string): string {
 	return resolveToCwd(normalized, session.cwd);
 }
 
-function isPlanAliasTarget(session: ToolSession, targetPath: string, resolved: string): boolean {
-	const normalized = normalizeLocalScheme(targetPath);
-	if (normalized === LOCAL_PLAN_ALIAS) return true;
-	return resolved === resolveToCwd(PLAN_ALIAS_FILE, session.cwd);
-}
-
 /**
- * Resolve a write/edit target to its absolute filesystem path.
- *
- * In plan mode, transparently redirects `PLAN.md` aliases and targets whose
- * basename matches the plan file's basename to the canonical plan file
- * location at `state.planFilePath`. This lets `write` and `edit` accept the
- * habitual plan filename after approval even when the active artifact has a
- * titled path such as `local://APPROVED.md`.
- *
- * Outside plan mode (or when the basename does not match) this is a no-op.
+ * Plan mode keeps the working tree read-only while letting the agent draft its
+ * plan. Writes and edits to the `local://` artifact sandbox are allowed (that is
+ * where the plan and any scratch notes live); anything that would touch the
+ * working tree — or rename/delete a file — is rejected.
  */
-export function resolvePlanPath(session: ToolSession, targetPath: string): string {
-	const resolved = resolveRawPath(session, targetPath);
-
-	const state = session.getPlanModeState?.();
-	if (!state?.enabled) return resolved;
-
-	const planResolved = resolveRawPath(session, state.planFilePath);
-	if (resolved === planResolved) return resolved;
-	if (isPlanAliasTarget(session, targetPath, resolved)) return planResolved;
-	if (path.basename(resolved) !== path.basename(planResolved)) return resolved;
-
-	return planResolved;
-}
-
 export function enforcePlanModeWrite(
 	session: ToolSession,
 	targetPath: string,
@@ -64,9 +47,6 @@ export function enforcePlanModeWrite(
 	const state = session.getPlanModeState?.();
 	if (!state?.enabled) return;
 
-	const resolvedTarget = resolvePlanPath(session, targetPath);
-	const resolvedPlan = resolvePlanPath(session, state.planFilePath);
-
 	if (options?.move) {
 		throw new ToolError("Plan mode: renaming files is not allowed.");
 	}
@@ -75,7 +55,9 @@ export function enforcePlanModeWrite(
 		throw new ToolError("Plan mode: deleting files is not allowed.");
 	}
 
-	if (resolvedTarget !== resolvedPlan) {
-		throw new ToolError(`Plan mode: only the plan file may be modified (${state.planFilePath}).`);
-	}
+	if (targetsLocalSandbox(targetPath)) return;
+
+	throw new ToolError(
+		"Plan mode: the working tree is read-only. Write your plan to a local://<slug>-plan.md file instead.",
+	);
 }