@openlines/opl-pi-sht 0.1.18 → 0.1.20

package/extensions/opl-footer/index.ts

@@ -5,10 +5,12 @@ import type { TUI } from "@earendil-works/pi-tui";
 
 import type { SegmentContext, StatusLineSegmentId, UsageStats, SessionStats, SessionEvent, ThinkingLevelEvent, AssistantMessageEvent, ToolResultEvent, UserBashEvent } from "./types.js";
 import { renderSegment } from "./segments/index.js";
+import { createAgentStatusTracker } from "./segments/status.js";
 import { getGitStatus, invalidateGitStatus, invalidateGitBranch } from "./git-status.js";
 import { getEffectiveConfig } from "./config.js";
 import { getIcons } from "./icons.js";
 import { getDefaultColors, fg } from "./theme.js";
+import { showFooterConfigurator } from "./configure.js";
 
 const GIT_BRANCH_PATTERNS: RegExp[] = [
   /\bgit\s+(checkout|switch|branch\s+-[dDmM]|merge|rebase|pull|reset|worktree)/,
@@ -112,8 +114,16 @@ export default function footer(pi: ExtensionAPI) {
   let ttftRecordedThisTurn = false;
   let agentStartMs = 0;
   let lastTurnaroundMs = 0;
+  let statusTracker = createAgentStatusTracker();
   const toolStartTimes = new Map<string, number>();
 
+  pi.registerCommand("configure-opl", {
+    description: "Interactively configure the OPL footer layout",
+    handler: async (_args, ctx) => {
+      await showFooterConfigurator(ctx, () => tuiRef?.requestRender());
+    },
+  });
+
   // Track session start
   pi.on("session_start", async (_event: unknown, ctx: ExtensionContext) => {
     sessionStartTime = Date.now();
@@ -128,6 +138,7 @@ export default function footer(pi: ExtensionAPI) {
     ttftRecordedThisTurn = false;
     agentStartMs = 0;
     lastTurnaroundMs = 0;
+    statusTracker = createAgentStatusTracker();
     toolStartTimes.clear();
 
     if (ctx.hasUI) {
@@ -141,6 +152,8 @@ export default function footer(pi: ExtensionAPI) {
   // authoritative "fully done, no auto-continuation" signal.
   pi.on("agent_start", async (_event: unknown, _ctx: ExtensionContext) => {
     if (agentStartMs === 0) agentStartMs = Date.now();
+    statusTracker.agentStarted();
+    tuiRef?.requestRender();
   });
 
   pi.on("agent_settled", async (_event: unknown, _ctx: ExtensionContext) => {
@@ -148,6 +161,8 @@ export default function footer(pi: ExtensionAPI) {
       lastTurnaroundMs = Date.now() - agentStartMs;
       agentStartMs = 0;
     }
+    statusTracker.agentSettled();
+    tuiRef?.requestRender();
   });
 
   pi.on("turn_start", async (_event: unknown, _ctx: ExtensionContext) => {
@@ -163,6 +178,8 @@ export default function footer(pi: ExtensionAPI) {
 
   pi.on("tool_execution_start", async (event: { toolCallId: string }, _ctx: ExtensionContext) => {
     toolStartTimes.set(event.toolCallId, Date.now());
+    statusTracker.toolStarted(event.toolCallId);
+    tuiRef?.requestRender();
   });
 
   pi.on("tool_execution_end", async (event: { toolCallId: string }, _ctx: ExtensionContext) => {
@@ -173,6 +190,8 @@ export default function footer(pi: ExtensionAPI) {
       toolMsThisTurn += elapsed;
       toolStartTimes.delete(event.toolCallId);
     }
+    statusTracker.toolEnded(event.toolCallId);
+    tuiRef?.requestRender();
   });
 
   pi.on("message_update", async (_event: unknown, _ctx: ExtensionContext) => {
@@ -298,6 +317,7 @@ export default function footer(pi: ExtensionAPI) {
       colors,
       icons: getIcons(effectiveConfig.icons),
       sessionStats: { prompts: branchPrompts, apiCalls: branchApiCalls, toolCalls: branchToolCalls, llmMs, toolMs, ttftSamples, lastTurnaroundMs },
+      agentStatus: statusTracker.status(),
     };
   }
 

package/extensions/opl-footer/segments/index.ts

@@ -13,6 +13,7 @@ import { planModeSegment } from "./plan-mode.js";
 import { chatModeSegment } from "./chat-mode.js";
 import { modeSwitcherSegment } from "./mode-switcher.js";
 import { sessionStatsSegment, perfStatsSegment } from "./session-stats.js";
+import { statusSegment } from "./status.js";
 
 const SEGMENTS = {
   pi: piSegment,
@@ -35,6 +36,7 @@ const SEGMENTS = {
   mode_switcher: modeSwitcherSegment,
   session_stats: sessionStatsSegment,
   perf_stats: perfStatsSegment,
+  status: statusSegment,
 };
 
 export function renderSegment(id: StatusLineSegmentId, ctx: SegmentContext): RenderedSegment {

package/extensions/opl-footer/segments/status.ts

@@ -0,0 +1,37 @@
+import type { AgentStatus, RenderedSegment, SegmentContext } from "../types.js";
+import { applyColor } from "../theme.js";
+
+export function deriveAgentStatus(agentActive: boolean, activeToolCount: number): AgentStatus {
+  if (!agentActive) return "ready";
+  return activeToolCount > 0 ? "waiting" : "working";
+}
+
+export function createAgentStatusTracker() {
+  let agentActive = false;
+  const activeToolIds = new Set<string>();
+
+  return {
+    agentStarted() { agentActive = true; },
+    agentSettled() {
+      agentActive = false;
+      activeToolIds.clear();
+    },
+    toolStarted(id: string) { activeToolIds.add(id); },
+    toolEnded(id: string) { activeToolIds.delete(id); },
+    status() { return deriveAgentStatus(agentActive, activeToolIds.size); },
+  };
+}
+
+const STATUS_DISPLAY = {
+  working: ["Working", "accent"],
+  waiting: ["Waiting", "warning"],
+  ready: ["Ready", "success"],
+} as const;
+
+export const statusSegment = {
+  id: "status" as const,
+  render(ctx: SegmentContext): RenderedSegment {
+    const [label, color] = STATUS_DISPLAY[ctx.agentStatus];
+    return { content: applyColor(ctx.theme, color, label), visible: true };
+  },
+};

package/extensions/opl-footer/segments/tokens.ts

@@ -52,7 +52,7 @@ export const cacheReadSegment = {
   render(ctx: SegmentContext): RenderedSegment {
     const { cacheRead } = ctx.usageStats;
     if (!cacheRead) return { content: "", visible: false };
-    return { content: val(ctx, formatTokens(cacheRead)), visible: true };
+    return { content: lbl(ctx, "Read ") + val(ctx, formatTokens(cacheRead)), visible: true };
   },
 };
 
@@ -61,6 +61,6 @@ export const cacheWriteSegment = {
   render(ctx: SegmentContext): RenderedSegment {
     const { cacheWrite } = ctx.usageStats;
     if (!cacheWrite) return { content: "", visible: false };
-    return { content: val(ctx, formatTokens(cacheWrite)), visible: true };
+    return { content: lbl(ctx, "Write ") + val(ctx, formatTokens(cacheWrite)), visible: true };
   },
 };

package/extensions/opl-footer/types.ts

@@ -53,6 +53,7 @@ export type StatusLineSegmentId =
   | "mode_switcher"
   | "session_stats"
   | "perf_stats"
+  | "status"
   | "separator"
   | `text:${string}`;
 
@@ -109,6 +110,8 @@ export interface SessionStats {
 }
 
 // Context passed to segment render functions
+export type AgentStatus = "working" | "waiting" | "ready";
+
 export interface SegmentContext {
   model: { id: string; name?: string; reasoning?: boolean; contextWindow?: number; provider?: string; baseUrl?: string } | undefined;
   isLocalModel: boolean;
@@ -126,6 +129,7 @@ export interface SegmentContext {
   colors: ColorScheme;
   icons: IconSet;
   sessionStats: SessionStats;
+  agentStatus: AgentStatus;
 }
 
 // Minimal event shapes used by the opl-footer handlers

package/extensions/opl-input/README.md

@@ -80,4 +80,4 @@ Invalid theme tokens fall back to the theme's `border` token; invalid hex render
 
 ## Architecture
 
-`index.ts` installs the editor integration; `mode-style.ts` resolves Bash > published mode appearance > compiled fallback; `config.ts` loads editor and companion settings; and `utils.ts` handles color and rendering helpers. `opl-modes` is the sole publisher of active mode appearance through `globalThis.__agentMode`.
+`index.ts` installs the editor integration and disposes companion render timers on editor replacement or session shutdown; `mode-style.ts` resolves Bash > published mode appearance > compiled fallback; `config.ts` loads editor and companion settings; and `utils.ts` handles color and rendering helpers. `opl-modes` is the sole publisher of active mode appearance through `globalThis.__agentMode`.

package/extensions/opl-input/index.ts

@@ -4,7 +4,7 @@ import type { KeybindingsManager } from "@earendil-works/pi-coding-agent";
 import { visibleWidth } from "@earendil-works/pi-tui";
 import { CONFIG, COMPANION_PADDING, MIN_WIDTH_FOR_COMPANION } from "./config.js";
 import { resolveModeStyle, type ModeAppearance } from "./mode-style.js";
-import { applyColor, CompanionAnimator } from "./utils.js";
+import { applyColor, CompanionAnimator, startRenderTimer } from "./utils.js";
 
 // ─── Helpers ──────────────────────────────────────────────────────────────
 const ANSI_RE = /\x1b\[[0-9;]*m|\x1b\[0?m/g;
@@ -28,7 +28,7 @@ class ChatInput extends CustomEditor {
 	private uiTheme: Theme;
 	private inputTheme: EditorTheme;
 	private animator = new CompanionAnimator();
-	private companionTimer: ReturnType<typeof setInterval> | null = null;
+	private stopCompanionTimer: (() => void) | null = null;
 
 	constructor(
 		tui: TUI,
@@ -43,10 +43,15 @@ class ChatInput extends CustomEditor {
 		this.inputTheme = theme;
 
 		// Animate companion even when idle — tick drives state machine
-		this.companionTimer = setInterval(() => {
+		this.stopCompanionTimer = startRenderTimer(() => {
 			this.animator.tick(Date.now());
 			this.tui.requestRender();
-		}, 100);
+		});
+	}
+
+	dispose(): void {
+		this.stopCompanionTimer?.();
+		this.stopCompanionTimer = null;
 	}
 
 	private isBashMode(): boolean {
@@ -275,10 +280,21 @@ class ChatInput extends CustomEditor {
 
 // ─── Extension entry ──────────────────────────────────────────────────────
 export default function (pi: ExtensionAPI) {
+	let activeEditor: ChatInput | null = null;
+
 	pi.on("session_start", async (_event, ctx) => {
+		activeEditor?.dispose();
+		activeEditor = null;
 		ctx.ui.setEditorComponent((tui: TUI, theme: EditorTheme, kb: KeybindingsManager) => {
+			activeEditor?.dispose();
 			const companionColorFn = (s: string) => applyColor(ctx.ui.theme, CONFIG.COMPANION_COLOR, s);
-			return new ChatInput(tui, theme, kb, companionColorFn, ctx.ui.theme);
+			activeEditor = new ChatInput(tui, theme, kb, companionColorFn, ctx.ui.theme);
+			return activeEditor;
 		});
 	});
-}
+
+	pi.on("session_shutdown", async () => {
+		activeEditor?.dispose();
+		activeEditor = null;
+	});
+}

package/extensions/opl-input/utils.ts

@@ -56,6 +56,11 @@ function hexToAnsi(hex: string): string {
 	return `\x1b[38;2;${r};${g};${b}m`;
 }
 
+export function startRenderTimer(render: () => void): () => void {
+	const timer = setInterval(render, 100);
+	return () => clearInterval(timer);
+}
+
 export function applyColor(theme: Theme, color: string, text: string): string {
 	if (isHexColor(color)) {
 		return `${hexToAnsi(color)}${text}\x1b[0m`;

package/extensions/opl-modes/README.md

@@ -17,9 +17,11 @@ Plans are Markdown files under `.pi/plans/` with the `plan-` filename prefix. `p
 
 ### Mode behavior
 
-Chat and plan modes replace the active tools with configurable read-only tool lists and restrict Bash to safe inspection patterns. Destructive patterns are checked even when a command matches a safe pattern. User-provided safe and destructive pattern arrays replace the built-in lists, rather than extending them.
+Chat and plan modes replace the active tools with configurable read-only tool lists and restrict Bash to safe inspection patterns. Destructive patterns are checked even when a command matches a safe pattern. Valid user-provided safe and destructive pattern arrays replace the built-in lists, rather than extending them. An explicit empty per-mode array replaces that policy with none; a malformed non-empty per-mode array is ignored and inherits the existing policy.
 
-Custom modes can add or override modes with prompts, tool lists, Bash patterns, model overrides, visibility, enabled state, `plan_complete` permission, execute-handoff permission, labels, and `appearance`. Appearance is published to `opl-input` and `opl-footer`, so every mode owns its input prefix/border and footer identity color.
+The shared destructive base also blocks file mutation primitives (`rm`, `find -delete`/`-exec`, `truncate`, `git clean`/`update-ref`/`tag -d`, `sudo`, shell spawns, and output redirects). `env` and `printenv` are no longer safe-listed, since they could dump provider API keys into the model context. Destructive matching also runs against a quote/backslash-stripped command skeleton, so `r"m"` cannot dodge `\brm\b`; this is still a heuristic backstop, not a process-isolation boundary.
+
+Custom modes can add or override modes with prompts, tool lists, Bash patterns, model overrides, visibility, enabled state, `plan_complete` permission, execute-handoff permission, labels, and `appearance`. Appearance is published to `opl-input` and `opl-footer`, so every mode owns its input prefix/border and footer identity color. A custom mode that omits its own `safePatterns`/`destructivePatterns` inherits the whole shared base; a mode overrides a component with its own array or disables all gating with `unrestrictedBash: true`. Built-in `off` and `execute` stay unrestricted.
 
 ### Execute handoff
 
@@ -31,7 +33,7 @@ Any mode can start plan execution via the mode picker's `Execute:` entries or `/
 
 A custom mode with no `tools` array inherits **all** tools, including `write` and `edit` — it is write-capable by default. Always specify an explicit read-only tool list for restrictive modes.
 
-Mode state is persisted in session entries and restored on session resume or branch changes. The `mode-switcher` entry type and legacy chat/plan event identifiers are compatibility contracts.
+Mode state is persisted in session entries and restored on session resume or branch changes. The `mode-switcher` entry type and legacy chat/plan event identifiers are compatibility contracts. On resume, an unknown mode name in a session entry is ignored (falling back to normal), and plan filenames containing path separators or `..` are dropped, so a stale or foreign branch cannot leave the session unrestricted or point plan reads outside `.pi/plans/`.
 
 ## Configuration
 
@@ -80,7 +82,8 @@ Create `~/.pi/agent/configs/opl-modes.json` or copy [`configs/opl-modes.json.sam
 | `defaultNotifyTemplate` | Notification template for custom modes; `{Name}` is capitalized mode name. |
 | `modes.chat.tools` / `modes.plan.tools` | Replace the respective built-in read-only tool lists. |
 | `chatAllowedTools` / `planAllowedTools` | **Deprecated compatibility aliases** for the built-in tool lists. They are used only when the corresponding `modes.<name>.tools` is omitted; migrate to `modes.chat.tools` or `modes.plan.tools`. |
-| `bashPatterns.safePatterns` / `bashPatterns.destructivePatterns` | Replace the shared Bash policy for built-in chat and plan. Per-mode pattern fields intentionally override this shared policy when those modes need to differ. |
+| `bashPatterns.safePatterns` / `bashPatterns.destructivePatterns` | Shared Bash policy applied to every mode by default; a mode overrides with its own `modes.<name>.safePatterns`/`destructivePatterns` or disables gating with `modes.<name>.unrestrictedBash: true`. |
+| `modes.<name>.unrestrictedBash` | Set `true` to exempt a custom mode from the Bash policy entirely (no safe/destructive patterns). |
 | `lazyTools` | Tool names withheld from the active set at rest and enabled on demand (see Lazy tool loading below). |
 | `modes.<name>` | Add or override a mode, including `model`, `tools`, patterns, `allowPlanComplete`, `allowExecute`, `visible`, `enabled`, `prompt`, `labels`, and `appearance`. |
 
@@ -105,7 +108,7 @@ Use `modes.<name>.appearance` to keep any mode's visual identity with its defini
 
 `prefix`, `prefixColor`, and `borderColor` style `opl-input`; omitted fields use its compiled mode defaults. `modeColor` styles the value in `opl-footer`'s `mode_switcher` segment; if omitted, the footer uses hardcoded `muted`. Colors accept Pi theme tokens or six-digit hex strings.
 
-Model overrides are resolved through Pi's model registry when entering a mode and the previously active model is restored on exit when applicable. Use Pi theme color tokens for widget label colors.
+Model overrides are resolved through Pi's model registry when entering a mode and the previously active model is restored on exit when applicable. Changes are serialized, so a rapid mode exit cannot leave a superseded mode model active. Use Pi theme color tokens for widget label colors.
 
 ### Lazy tool loading
 

package/extensions/opl-modes/config.ts

@@ -3,7 +3,7 @@
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import type { ModeSwitcherUserConfig, ModeDefinition } from "./types.js";
+import type { ModeSwitcherUserConfig, ModeDefinition, PartialModeDefinition } from "./types.js";
 
 // ─── Plan File Constants ────────────────────────────────────────────────────
 
@@ -46,13 +46,13 @@ const DEFAULT_CHAT_MODE_TOOLS: string[] = [
 // ─── Bash Safety ─────────────────────────────────────────────────────────────
 
 /** Default safe command patterns — only these are allowed in read-only modes (chat and plan). */
-const DEFAULT_SAFE_PATTERNS: RegExp[] = [
+export const DEFAULT_SAFE_PATTERNS: RegExp[] = [
   /^\s*cat\b/, /^\s*head\b/, /^\s*tail\b/, /^\s*less\b/, /^\s*more\b/,
   /^\s*grep\b/, /^\s*find\b/, /^\s*ls\b/, /^\s*pwd\b/, /^\s*cd\b/,
   /^\s*echo\b/, /^\s*printf\b/, /^\s*wc\b/, /^\s*sort\b/,
   /^\s*diff\b/, /^\s*file\b/, /^\s*stat\b/, /^\s*du\b/, /^\s*df\b/,
   /^\s*tree\b/, /^\s*which\b/, /^\s*whereis\b/, /^\s*type\b/,
-  /^\s*env\b/, /^\s*printenv\b/, /^\s*uname\b/, /^\s*whoami\b/,
+  /^\s*uname\b/, /^\s*whoami\b/,
   /^\s*date\b/, /^\s*uptime\b/, /^\s*ps\b/, /^\s*free\b/,
   /^\s*rg\b/, /^\s*fd\b/, /^\s*bat\b/, /^\s*jq\b/,
   /^\s*git\s+(status|log|diff|show|branch|remote)/i,
@@ -63,15 +63,16 @@ const DEFAULT_SAFE_PATTERNS: RegExp[] = [
 ];
 
 /** Default destructive command patterns — always blocked in read-only modes, even if matching a safe pattern. */
-const DEFAULT_DESTRUCTIVE_PATTERNS: RegExp[] = [
+export const DEFAULT_DESTRUCTIVE_PATTERNS: RegExp[] = [
   /\brm\b/i, /\brmdir\b/i, /\bmv\b/i, /\bcp\b/i,
   /\bmkdir\b/i, /\btouch\b/i, /\bchmod\b/i, /\bchown\b/i,
-  /\btee\b/i, /\bdd\b/i, /\bshred\b/i,
+  /\btee\b/i, /\bdd\b/i, /\bshred\b/i, /\btruncate\b/i,
+  /\s-(delete|exec|execdir)\b/i,
   /(^|[^<])>(?!>|&)/, />>/,
   /\bnpm\s+(install|uninstall|update|ci)/i,
   /\byarn\s+(add|remove|install)/i,
   /\bpip\s+(install|uninstall)/i,
-  /\bgit\s+(add|commit|push|merge|rebase|reset|checkout|branch\s+-)/i,
+  /\bgit\s+(add|commit|push|merge|rebase|reset|checkout|branch\s+-|clean|update-ref|tag\s+-|cherry-pick|revert|am|apply)/i,
   /\bsudo\b/i, /\bsu\b/i, /\bkill\b/i, /\bpkill\b/i,
   /\b(sh|bash|zsh)\b/i,
   /\b(vim?|nano|emacs|code|subl)\b/i,
@@ -207,10 +208,14 @@ const DEFAULT_CONFIG = {
 
 const CONFIG_PATH = join(homedir(), ".pi", "agent", "configs", "opl-modes.json");
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 export function loadUserConfig(path = CONFIG_PATH): ModeSwitcherUserConfig {
   try {
-    const raw = readFileSync(path, "utf8");
-    return JSON.parse(raw) as ModeSwitcherUserConfig;
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return isRecord(parsed) ? parsed as ModeSwitcherUserConfig : {};
   } catch {
     return {};
   }
@@ -356,10 +361,49 @@ export const USER_CONFIG = {
 /** Mode Registry — stores all registered mode definitions. */
 export const MODE_REGISTRY = new Map<string, ModeDefinition>();
 
-/** Helper to convert string patterns to RegExp. */
-function compilePatterns(patterns: string[] | undefined): RegExp[] | undefined {
-  if (!patterns) return undefined;
-  return patterns.map((p) => new RegExp(p, "i"));
+/** Compile a valid pattern array. Undefined means malformed input or no usable patterns. */
+export function compilePatterns(patterns: unknown): RegExp[] | undefined {
+  if (!Array.isArray(patterns)) return undefined;
+  if (patterns.length === 0) return [];
+  const compiled: RegExp[] = [];
+  for (const pattern of patterns) {
+    if (typeof pattern !== "string") return undefined;
+    try {
+      compiled.push(new RegExp(pattern, "i"));
+    } catch {
+      console.warn(`[opl-modes] Invalid pattern: "${pattern}" — ignoring the override`);
+      return undefined;
+    }
+  }
+  return compiled;
+}
+
+/** Resolve the Bash pattern pair for a newly registered custom mode from the shared
+ *  base (top-level bashPatterns), with per-mode overrides and an explicit opt-out.
+ *  Omitted components inherit; explicit arrays (even empty) replace; `unrestrictedBash`
+ *  disables Bash gating entirely for that mode. */
+export function resolveCustomPatterns(def: {
+  safePatterns?: unknown;
+  destructivePatterns?: unknown;
+  unrestrictedBash?: boolean;
+}): { safe?: RegExp[]; destructive?: RegExp[] } {
+  if (def.unrestrictedBash) return { safe: undefined, destructive: undefined };
+  return {
+    safe: compilePatterns(def.safePatterns) ?? SAFE_COMMAND_PATTERNS,
+    destructive: compilePatterns(def.destructivePatterns) ?? DESTRUCTIVE_PATTERNS,
+  };
+}
+
+export function mergeModeDefinition(existing: ModeDefinition, def: PartialModeDefinition): ModeDefinition {
+  return {
+    ...existing,
+    ...def,
+    tools: def.tools ?? existing.tools,
+    safePatterns: compilePatterns(def.safePatterns) ?? existing.safePatterns,
+    destructivePatterns: compilePatterns(def.destructivePatterns) ?? existing.destructivePatterns,
+    labels: { ...existing.labels, ...def.labels },
+    appearance: def.appearance ?? existing.appearance,
+  };
 }
 
 /** Register a mode with the registry. Called by extensions at startup. */
@@ -433,25 +477,20 @@ function initModeRegistry(): void {
   });
 
   // Merge user-defined modes from config (can override built-ins or add new ones).
-  if (userConfig.modes) {
-    for (const [name, def] of Object.entries(userConfig.modes)) {
+  if (isRecord(userConfig.modes)) {
+    for (const [name, rawDefinition] of Object.entries(userConfig.modes)) {
+      if (!isRecord(rawDefinition)) continue;
+      const def = rawDefinition as PartialModeDefinition;
       const existing = MODE_REGISTRY.get(name);
       if (existing) {
-        registerMode(name, {
-          ...existing,
-          ...def,
-          tools: def.tools ?? existing.tools,
-          safePatterns: def.safePatterns ? compilePatterns(def.safePatterns) : existing.safePatterns,
-          destructivePatterns: def.destructivePatterns ? compilePatterns(def.destructivePatterns) : existing.destructivePatterns,
-          labels: { ...existing.labels, ...def.labels },
-          appearance: def.appearance ?? existing.appearance,
-        });
+        registerMode(name, mergeModeDefinition(existing, def));
       } else {
+        const patterns = resolveCustomPatterns(def);
         registerMode(name, {
           prompt: def.prompt ?? "",
           tools: def.tools,
-          safePatterns: compilePatterns(def.safePatterns),
-          destructivePatterns: compilePatterns(def.destructivePatterns),
+          safePatterns: patterns.safe,
+          destructivePatterns: patterns.destructive,
           allowPlanComplete: def.allowPlanComplete ?? false,
           allowExecute: def.allowExecute ?? true,
           visible: def.visible ?? true,

package/extensions/opl-modes/index.ts

@@ -52,6 +52,7 @@ import {
 } from "./config.js";
 import {
   isSafeCommand,
+  isDestructive,
   extractPlanText,
   isPlanLike,
   ensurePlanDir,
@@ -60,6 +61,7 @@ import {
   sanitizePlanName,
   extractTextFromMessage,
   applyLabelColor,
+  createLatestModelQueue,
 } from "./utils.js";
 import {
   getMode,
@@ -117,6 +119,7 @@ export default function modeSwitcher(pi: ExtensionAPI) {
   let savedToolNames: string[] | null = null;
   // ─── Saved model for restoring ─────────────────────────────────────────────
   let savedModel: Model<any> | null = null;
+  const queueModelChange = createLatestModelQueue();
   const MAX_REFINE_CYCLES = 5;
 
   function saveAndSetActiveTools(toolNames: string[]): void {
@@ -126,22 +129,22 @@ export default function modeSwitcher(pi: ExtensionAPI) {
     pi.setActiveTools(applyLazyPolicy(toolNames));
   }
 
-  /**
-   * Resolve and switch to a specific model, notifying on failure, then refresh
-   * the footer via updateStatus. No savedModel bookkeeping — callers that need
-   * restore semantics use applyModeModel instead.
-   */
+  /** Queue model changes so a superseded async switch cannot finish after its restore. */
+  function setQueuedModel(ctx: ExtensionContext, model: Model<any>, label: string): Promise<void> {
+    return queueModelChange(async () => {
+      const success = await pi.setModel(model);
+      if (!success && ctx.hasUI) ctx.ui.notify(`[mode-switcher] No API key for model ${label}`, "error");
+      updateStatus(ctx);
+    }).then(() => undefined);
+  }
+
   async function switchToModel(ctx: ExtensionContext, modelRef: { provider: string; id: string }): Promise<void> {
     const resolved = ctx.modelRegistry.find(modelRef.provider, modelRef.id);
     if (!resolved) {
       if (ctx.hasUI) ctx.ui.notify(`[mode-switcher] Model not found: ${modelRef.provider}/${modelRef.id}`, "warning");
       return;
     }
-    const success = await pi.setModel(resolved);
-    if (!success && ctx.hasUI) {
-      ctx.ui.notify(`[mode-switcher] No API key for model ${modelRef.provider}/${modelRef.id}`, "error");
-    }
-    updateStatus(ctx);
+    await setQueuedModel(ctx, resolved, `${modelRef.provider}/${modelRef.id}`);
   }
 
   /**
@@ -166,9 +169,7 @@ export default function modeSwitcher(pi: ExtensionAPI) {
     if (savedModel === null) return;
     const toRestore = savedModel;
     savedModel = null;
-    pi.setModel(toRestore).then(() => {
-      updateStatus(ctx);
-    });
+    void setQueuedModel(ctx, toRestore, `${toRestore.provider}/${toRestore.id}`);
   }
 
   /**
@@ -575,10 +576,10 @@ export default function modeSwitcher(pi: ExtensionAPI) {
       }
     }
 
-    // Check destructive patterns (if defined, must not match any)
+    // Check destructive patterns (if defined, must not match any) — also against
+    // a quote/backslash-stripped skeleton so r"m"/r\m obfuscation can't dodge \brm\b.
     if (modeDef.destructivePatterns && modeDef.destructivePatterns.length > 0) {
-      const matchesDestructive = modeDef.destructivePatterns.some((pattern) => pattern.test(command));
-      if (matchesDestructive) {
+      if (isDestructive(command, modeDef.destructivePatterns)) {
         return {
           block: true,
           reason: `[mode-switcher] Command blocked — destructive pattern in ${mode} mode: ${command}`,

package/extensions/opl-modes/state.ts

@@ -88,6 +88,13 @@ function persist(pi: { appendEntry: (type: string, data?: unknown) => void }): v
   } satisfies AgentModeBlob);
 }
 
+/** Reject activePlanFile values that could escape PLAN_DIR via path components or traversal. */
+function normalizePlanFile(file: string | null | undefined): string | null {
+  if (!file) return null;
+  if (file.includes("/") || file.includes("\\") || file.includes("..")) return null;
+  return file;
+}
+
 /**
  * Restore state from the most recent relevant session entry on the current branch.
  * Checks for native mode-switcher entries first; falls back to legacy plan-mode/chat-mode entries
@@ -102,9 +109,11 @@ export function restore(
 
     if (entry.customType === ENTRY_TYPE) {
       const data = entry.data as AgentModeBlob | undefined;
-      if (data?.mode) {
+      // Fail closed: only apply modes the registry actually knows, otherwise a stale or
+      // foreign-branch entry would leave the session unrestricted (no tools, no patterns).
+      if (data?.mode && getModeDefinition(data.mode)) {
         state.mode = data.mode;
-        state.activePlanFile = data.activePlanFile ?? null;
+        state.activePlanFile = normalizePlanFile(data.activePlanFile);
         state.refining = false;
         syncGlobalThis();
         return true;
@@ -121,7 +130,7 @@ export function restore(
       const data = entry.data as { mode?: string; activePlanFile?: string | null } | undefined;
       if (data?.mode === "plan" || data?.mode === "execute") {
         state.mode = data.mode as AgentMode;
-        state.activePlanFile = data.activePlanFile ?? null;
+        state.activePlanFile = normalizePlanFile(data.activePlanFile);
         state.refining = false;
         syncGlobalThis();
         return true;

package/extensions/opl-modes/types.ts

@@ -125,6 +125,8 @@ export interface UserModeDefinition {
   tools?: string[];
   safePatterns?: string[];
   destructivePatterns?: string[];
+  /** Set true to skip Bash gating entirely for this mode (no safe/destructive patterns). */
+  unrestrictedBash?: boolean;
   labels?: ModeLabelConfig;
   appearance?: ModeAppearanceConfig;
   allowPlanComplete?: boolean;

package/extensions/opl-modes/utils.ts

@@ -7,10 +7,29 @@ import { join } from "node:path";
 import { SAFE_COMMAND_PATTERNS, DESTRUCTIVE_PATTERNS, PLAN_DIR, PLAN_FILE_PREFIX } from "./config.js";
 import type { PlanFileSummary } from "./types.js";
 
+/** Serialize async model changes so the final requested model wins. */
+export function createLatestModelQueue() {
+  let latest = 0;
+  let tail = Promise.resolve();
+
+  return <T>(change: () => Promise<T>): Promise<T | undefined> => {
+    const request = ++latest;
+    tail = tail.catch(() => undefined).then(() => request === latest ? change() : undefined);
+    return tail as Promise<T | undefined>;
+  };
+}
+
 /** Check if command matches safe patterns and not destructive patterns. */
 export function isSafeCommand(command: string): boolean {
   return SAFE_COMMAND_PATTERNS.some((p) => p.test(command))
-    && !DESTRUCTIVE_PATTERNS.some((p) => p.test(command));
+    && !isDestructive(command, DESTRUCTIVE_PATTERNS);
+}
+
+/** Whether a command, or its quote/backslash-stripped skeleton, matches any destructive
+ *  pattern. Stripping defeats shell expands like `r"m"` -> `rm` that dodge \brm\b. */
+export function isDestructive(command: string, patterns: RegExp[]): boolean {
+  const skeleton = command.replace(/["'\\]/g, "");
+  return patterns.some((p) => p.test(command) || p.test(skeleton));
 }
 
 const PLAN_ACTION_VERB = /^\s*\d+\.\s+(?:\*{1,2})?(?:add|creat|updat|fix|remov|refactor|implement|modif|chang|edit|writ|build|run|install|configur|set\s+up|delet|mov|renam|inject|migrat|replac|extract|test|deploy|integrat|convert)/i;

package/extensions/opl-webaccess/README.md

@@ -14,6 +14,7 @@ Provides configurable web search and readable URL/PDF retrieval with session-bac
 
 - Searches through `gemini`, `tavily`, `ddgs`, `searxng`, or `exa`; multiple queries run concurrently and results include citations where available.
 - Extracts HTML with Readability and Markdown conversion, falls back to full-document Turndown conversion, passes PDF responses to the PDF extractor, and returns plain text, Markdown, and JSON directly.
+- Restricts `fetch_content` to http/https, caps each response at 10 MB, and applies a 30s timeout; Gemini keys are sent via the `x-goog-api-key` header rather than the query string.
 - Caps initial tool output at 30,000 characters, then keeps it for retrieval for one hour or until the session ends.
 - Honors abort signals and returns provider, HTTP, and per-result failures through the tool boundary rather than throwing.