@visual-z/xeno 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # xeno changelog
 
+## 0.5.0 — 2026-10-09
+
+- Place the Control Panel in a persistent right sidebar, with a drawer on narrow terminals. Preserve the composer, drafts, attachments, scrolling and input focus.
+- Save confirmed model and thinking choices for later launches, and restore the exact available model from recent sessions.
+- Add explicit `--yolo` / `-y` runs across interactive, print and control sessions. The flag applies only to the current process; tool selection, file checks and cancellation still apply.
+- Request the exact required verification command after shell-only changes instead of ending without the declared acceptance receipt.
+- Preserve saved tool selections when reopening sessions, including extension-enabled sessions, while respecting explicit CLI filters and current approval rules.
+- Keep raw terminal input continuous during startup handoff so Enter executes early commands correctly; restore the original terminal mode even if the renderer fails to mount.
+- Prefer automatic Session version checks after reading files, while retaining explicit version receipts and conflict rejection. Keep the ten-tool coding default after separate live trials did not support reducing it.
+
 ## 0.4.0 — 2026-10-09
 
 - Add the goal, evidence progress and Context Lens workbench through `/control`. Keep execution outcomes separate from verified acceptance and explain the sources retained in the actual model context.

package/README.md

@@ -17,7 +17,7 @@ is ever summarized by a model, and nothing is ever rewritten in place.
 messages[]                             frozen system prefix + handoff + this node's events
 ```
 
-Version **0.4.0**. The on-disk session format will still change; `0.x` is that
+Version **0.5.0**. The on-disk session format will still change; `0.x` is that
 statement. Published as `@visual-z/xeno`; the license is `UNLICENSED` (readable and installable, no reuse granted).
 
 ## Install
@@ -107,7 +107,7 @@ xeno [-m <model>] [--provider <name>] [--api-key <key>]
      [--tools names] [--exclude-tools names] [--no-tools]
      [--tool-profile coding|readonly|research|data|full]
      [--acceptance-file <contract.json>]
-     [--allow-tools names] [--approve|--no-approve]
+     [--allow-tools names] [--yolo|-y] [--approve|--no-approve]
      [--theme <name|path>] [--use-theme <name>] [--no-themes]
      [--tui-mode regular|fullscreen]
      [--skill <path>] [--no-skills|-ns]
@@ -265,9 +265,10 @@ mode `0600`.
 ## Isolation
 
 This is not a sandbox. Tools run with the permissions of the user who
-started xeno. `read` / `write` / `edit` stay inside the workspace root;
-`bash` does not — it asks before it runs so you can see the command. That
-ask is the last look at what is about to happen, **not a security
+started xeno. `read` / `write` / `edit` stay inside the workspace root.
+Shell entry points (`exec_command`, `environment`, `bash`, `target`) ask
+before they run so you can see the command. That ask is the last look at
+what is about to happen, **not a security
 boundary**.
 
 For untrusted repositories, generated code you do not intend to watch, or
@@ -279,17 +280,43 @@ Project trust (`/trust`, `--approve`) only decides whether to load
 It does not change what tools can do. `AGENTS.md` is loaded whether the
 project is trusted or not.
 
-New sessions default to the nine-tool `coding` profile: read, grep, find,
-write, edit, exec_command, write_stdin, history and note. `readonly`,
+New sessions default to the ten-tool `coding` profile: read, grep, find,
+write, edit, environment, exec_command, write_stdin, history and note. `readonly`,
 `research` (with branch/resolve), `data` (with query) and `full` choose other
 builtin defaults. Extensions remain available; explicit `--tools` overrides
-the profile and exclusions apply last. Resumed sessions keep their frozen tools.
+the profile and exclusions apply last. Default session resume keeps the frozen
+tool selection; explicit tool flags apply at a resource checkpoint. `/reload`
+reselects tools using the current settings.
+Tool selection does not bypass permission checks; restoring a tool does not
+restore approvals from the previous process.
+
+After reading an existing file, normally omit `read_handle` and `expected_sha256`
+when writing or editing it: Session checks the latest observed file version.
+Pass an exact receipt only to select a specific observation; a stale version
+still requires a fresh read. Without any prior observation, omission provides
+no stale-version protection.
 
 `--tools` / `--exclude-tools` / `--no-tools` remove tools from the schema
 the model sees. `--allow-tools exec_command` lets commands run without asking, which
 is what a CI job that has no tty has to pass explicitly. Without a tty,
 an `ask` is a deny that names that flag.
 
+`--yolo` (or `-y`) allows every available tool without an approval prompt for
+the current process. It works in interactive, print, and app-server modes;
+resumed sessions use the current invocation's choice. Tool exclusions,
+read-only branch capabilities, input checks and file path limits still apply.
+YOLO does not enable project trust or get saved in settings or session history.
+Without the flag, the next launch uses the default approval rules again.
+
+```bash
+bun run agent --yolo                 # interactive session from this checkout
+bun run agent --yolo -c              # continue with approvals skipped
+bun run agent --yolo -p "run tests"   # explicit approval-free automation
+```
+
+The installed CLI accepts `xeno --yolo` in version 0.5.0 and later. To
+allow only host commands, use `--allow-tools exec_command,environment`.
+
 ## Workspace data
 
 Opening a session does not snapshot the working directory. File tools save the

package/docs/app-server.md

@@ -70,7 +70,9 @@ bun run agent --control-socket /tmp/xeno-control-private/control.sock
 
 ## TUI 与终端状态
 
-常驻 Goal 区展示原始目标、验收状态、执行状态和观察/重试数。`/control` 打开同一会话的面板：Tab 切 Goal / Progress / Context Lens，左右键切上下文来源/省略事件/handoff 恢复引用，上下键翻阅，R 刷新，I 取消，A 选择当前声明的人验条件。远程开始的普通 turn 会更新当前 TUI，并可在面板取消。TUI 输入的 steering 在同一 turn 的原有边界消费，followup 等原 turn 释放后执行；远程取消也把未发送内容归还编辑器。既有隔离 skill / shell 保留各自执行入口，当前协议不新增远程 skill/shell 方法。
+常驻 Goal 区展示原始目标、验收状态、执行状态和观察/重试数。`/control` 在右侧栏打开同一会话的面板，保留底部输入框和草稿；窄窗口改为消息区内的右侧抽屉，尺寸不足时提示放大。F6 切换面板与编辑器焦点，Esc 回到编辑器并保留面板，Q 关闭并恢复状态侧栏。面板有焦点时，Tab 切 Goal / Progress / Context Lens，左右键切上下文来源/省略事件/handoff 恢复引用，上下键或 PageUp/PageDown 翻阅，R 刷新，I 取消，A 选择当前声明的人验条件；其它文字输入会回到原编辑器。长目标和证据换行显示，缩放保留页签、滚动和草稿。
+
+远程开始的普通 turn 会更新当前 TUI，并可在面板取消。TUI 输入的 steering 在同一 turn 的原有边界消费，followup 等原 turn 释放后执行；远程取消也把未发送内容归还编辑器。既有隔离 skill / shell 保留各自执行入口，当前协议不新增远程 skill/shell 方法。
 
 无验收合同保持 `unverified`；模型结束 `model_end` 不等于目标 `verified`。Progress 的观察、产物、验收、新诊断和原样重试均带日志来源；数量不是完成百分比。Context Lens 复用实际 dispatch 的投影，只过滤检查视图，不修改 frozen prefix、handoff 或消息。
 

package/docs/providers.md

@@ -15,6 +15,10 @@ xeno 内置 Pi 0.99.1 和 OpenCode 所用 Models.dev 的固定源并集，另加
 
 `/model` 只显示已接入且凭据可用的模型，最近使用的排在最前。保存位置与手写配置相同：key 在 `~/.xeno/auth.json`（0600），端点和启用的模型在 `~/.xeno/models.json` 的 `providers.<id>`。
 
+确认模型或 thinking 后会自动保存到 `~/.xeno/settings.json`，下次新会话沿用，不需要额外按 Ctrl+S。模型菜单、`/model <provider/model>`、命令面板与模型循环共用这一行为；thinking 菜单、`/thinking <level>` 与快捷键也会保存。保存失败会提示本次已生效但下次启动不能保证沿用，不会切到另一个供应商。
+
+显式启动参数只覆盖本次运行；`--continue` / `--resume` 沿用会话日志里的模型与 thinking，恢复和扩展程序化切换不会改写个人默认。未保存默认模型的旧配置先尝试可认证的最近选择，再按目录兜底；明确的配置层级顺序保持不变。
+
 ## Grok 官方账户
 
 输入 `/provider grok`，xeno 打开官方确认网页并显示 user code；在浏览器批准后，当前会话直接取得凭据。Esc 取消会中止轮询，取消后返回的 token 不会写入。过期时自动刷新，刷新响应未轮换 refresh token 时保留原值；失败会明确要求重新登录。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visual-z/xeno",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "license": "UNLICENSED",
   "type": "module",
   "description": "Segmented append-only agent log with pure context and handoff projections",

package/src/apps/preferences.ts

@@ -0,0 +1,20 @@
+/** User intent owns personal defaults; CLI overrides and restored/extension state only own a session. */
+import { mergeSettings, type Settings } from "../core/settings.ts";
+import { writeUserSettings } from "../store/resources.ts";
+import { describeError } from "./render.ts";
+import type { App } from "./startup.ts";
+
+export type PreferenceOrigin = "user" | "session";
+
+export async function commitUserSettings(app: App, patch: Settings): Promise<boolean> {
+  const ui = app.ui;
+  if (!ui) return false;
+  ui.settings = mergeSettings({ builtin: ui.settings, user: patch });
+  try { await writeUserSettings(patch); }
+  catch (error) {
+    app.io.say(app.io.palette.yellow(`  The change is active in this session, but could not save settings for the next startup: ${describeError(error)}`));
+    return false;
+  }
+  ui.userOverrides = mergeSettings({ builtin: ui.userOverrides, user: patch });
+  return true;
+}

package/src/apps/shell.ts

@@ -58,14 +58,15 @@ import { registerSessionRoot } from "../store/session-browser.ts";
 import { createSession, findSessionByPrefix, listSessions, truncationNote, sessionsDir } from "../store/sessions.ts";
 import { exportSessionArchive, importSessionArchive } from "../store/session-archive.ts";
 import { resolveTuiMode } from "../core/tui-mode.ts";
-import { recordRecent } from "../core/model-picker.ts";
+import { modelPreferencePatch, thinkingPreferencePatch } from "../core/model-preferences.ts";
 import { flattenTree, treeFromPoints, LEFT_BRANCH_MARK, EMPTY_TREE_MESSAGE, type TreeNode, type NodeParent, type TreePoint } from "../core/session-tree.ts";
 import { cycle } from "../core/cycle.ts";
 import { THINKING_LEVELS, asThinkingLevel as asEffort, supportedThinkingLevels, clampThinkingLevel } from "../core/thinking.ts";
 import { modelKey } from "../core/session-position.ts";
 import { defaultKeymap, listBindings } from "../core/keymap.ts";
-import { settingPatch, mergeSettings } from "../core/settings.ts";
-import { writeUserSettings, resolveTheme } from "../store/resources.ts";
+import { settingPatch } from "../core/settings.ts";
+import { resolveTheme } from "../store/resources.ts";
+import { commitUserSettings, type PreferenceOrigin } from "./preferences.ts";
 import { colorEnabled } from "./render.ts";
 import { createStyle, IDENTITY } from "../tui/style.ts";
 import { lastAssistantText, toHtml } from "../core/export.ts";
@@ -144,9 +145,9 @@ async function bindExtensions(app: App, tui?: Ui): Promise<void> {
     },
     setModel: async model => {
       if (typeof model !== "object" || !model || !("provider" in model) || !("id" in model)) return false;
-      await switchByPattern(app, String(model.provider) + "/" + String(model.id)); return app.providerConfig.spec.id === model.id && app.providerConfig.spec.provider === model.provider;
+      await switchByPattern(app, String(model.provider) + "/" + String(model.id), "session"); return app.providerConfig.spec.id === model.id && app.providerConfig.spec.provider === model.provider;
     },
-    setThinking: async level => { await applyThinkingCommand(app, level, tui ?? null); },
+    setThinking: async level => { await applyThinkingCommand(app, level, tui ?? null, "session"); },
     exec: (command, args, options) => app.session.runExtensionCommand(command, args, options),
   });
   if (!initializedExtensions.has(registry)) {
@@ -822,7 +823,8 @@ async function commitSetting(app: App, field: string, value: string, tui: Ui | n
   }
   if (key === "thinking") {
     const effort = asEffort(value);
-    if (!effort || !await applyThinking(app, effort, tui)) return;
+    if (effort) await applyThinking(app, effort, tui);
+    return;
   }
   const parsed = settingPatch(key === "status" ? "statusBar" : field, value);
   if (parsed.diagnostics.length) { app.io.say(C.yellow(parsed.diagnostics.join("\n"))); return; }
@@ -833,12 +835,12 @@ async function commitSetting(app: App, field: string, value: string, tui: Ui | n
     app.ui.theme = theme;
     app.ui.style = colorEnabled() ? createStyle(theme.colors) : IDENTITY;
   }
-  await writeUserSettings(parsed.settings);
-  app.ui.settings = mergeSettings({ builtin: app.ui.settings, user: parsed.settings });
-  app.ui.userOverrides = mergeSettings({ builtin: app.ui.userOverrides, user: parsed.settings });
-  if (key === "enableskillcommands") { await reloadAppResources(app); await tui?.refreshResources(); }
-  if (tui) tui.toast(`${field} · ${value}`, "success");
-  else app.io.say(C.dim(`  ${field} ${value}`));
+  const saved = await commitUserSettings(app, parsed.settings);
+  if (saved && key === "enableskillcommands") { await reloadAppResources(app); await tui?.refreshResources(); }
+  if (saved) {
+    if (tui) tui.toast(`${field} · ${value}`, "success");
+    else app.io.say(C.dim(`  ${field} ${value}`));
+  }
   tui?.applyConfiguration();
   if (key === "theme") tui?.followTheme();
   tui?.redraw();
@@ -856,7 +858,7 @@ function effortSupported(spec: ModelSpec, level: Effort): boolean {
  * must not cut: a cut drops the prefix cache, and thinking blocks stay
  * valid because the model did not change.
  */
-async function applyThinking(app: App, level: Effort, tui: Ui | null): Promise<boolean> {
+async function applyThinking(app: App, level: Effort, tui: Ui | null, origin: PreferenceOrigin = "user"): Promise<boolean> {
   const C = app.io.palette;
   if (!effortSupported(app.providerConfig.spec, level)) {
     app.io.say(
@@ -874,19 +876,20 @@ async function applyThinking(app: App, level: Effort, tui: Ui | null): Promise<b
   if (app.ui !== undefined) {
     app.ui.settings = { ...app.ui.settings, thinking: level };
   }
+  if (origin === "user") await commitUserSettings(app, thinkingPreferencePatch(app.providerConfig.spec, level));
   app.io.say(C.dim(`  thinking ${level}`));
   tui?.redraw();
   return true;
 }
 
-async function applyThinkingCommand(app: App, level: string | undefined, tui: Ui | null): Promise<Outcome> {
+async function applyThinkingCommand(app: App, level: string | undefined, tui: Ui | null, origin: PreferenceOrigin = "user"): Promise<Outcome> {
   if (level !== undefined) {
     const effort = asEffort(level);
     if (effort === undefined) {
       app.io.say(app.io.palette.yellow("  thinking must be " + THINKING_LEVELS.join("|")));
       return "continue";
     }
-    await applyThinking(app, effort, tui);
+    await applyThinking(app, effort, tui, origin);
     return "continue";
   }
   if (tui) {
@@ -1486,7 +1489,7 @@ async function adoptCredential(app: App, ready: readonly ModelSpec[]): Promise<v
   const got = app.credentialOf(spec);
   if (!got.ok) return;
   if (app.credential.ok || app.session.state.handoff !== null || app.session.state.events.some((e) => e.t === "assistant")) {
-    await switchToModel(app, spec);
+    await switchToModel(app, spec, undefined, "session");
     return;
   }
   const nextConfig: ProviderConfig = {
@@ -1511,7 +1514,7 @@ async function adoptCredential(app: App, ready: readonly ModelSpec[]): Promise<v
   app.io.say(C.green(`  now ${spec.name}`) + C.dim(`  ${spec.id}`));
 }
 
-async function switchByPattern(app: App, pattern: string): Promise<void> {
+async function switchByPattern(app: App, pattern: string, origin: PreferenceOrigin = "user"): Promise<void> {
   const C = app.io.palette;
   const found = scopedModels([pattern], app.catalog, true), selected = found.entries[0];
   if (!selected) {
@@ -1519,16 +1522,11 @@ async function switchByPattern(app: App, pattern: string): Promise<void> {
     app.io.say(C.red(`  ${diagnostic.ok ? found.diagnostics.join("; ") : diagnostic.reason}`));
     return;
   }
-  await switchToModel(app, selected.model, selected.thinking);
+  await switchToModel(app, selected.model, selected.thinking, origin);
 }
 
-export async function switchToModel(app: App, spec: ModelSpec, thinking?: Effort): Promise<void> {
+export async function switchToModel(app: App, spec: ModelSpec, thinking?: Effort, origin: PreferenceOrigin = "user"): Promise<void> {
   const C = app.io.palette;
-  if (spec.id === app.providerConfig.spec.id && spec.provider === app.providerConfig.spec.provider) {
-    if (thinking) await applyThinking(app, clampThinkingLevel(spec, thinking), null);
-    app.io.say(C.dim(`  already on ${spec.id}`));
-    return;
-  }
   const got = app.credentialOf(spec);
   if (!got.ok) {
     app.io.say(C.red(`\n  ${got.reason}\n`));
@@ -1537,6 +1535,12 @@ export async function switchToModel(app: App, spec: ModelSpec, thinking?: Effort
     }
     return;
   }
+  if (spec.id === app.providerConfig.spec.id && spec.provider === app.providerConfig.spec.provider) {
+    if (thinking) await applyThinking(app, clampThinkingLevel(spec, thinking), null, "session");
+    if (origin === "user") await rememberModelSelection(app, spec, thinking);
+    app.io.say(C.dim(`  already on ${spec.id}`));
+    return;
+  }
   const nextConfig: ProviderConfig = {
     spec,
     maxTokens: outputTokenBudget(spec),
@@ -1554,15 +1558,15 @@ export async function switchToModel(app: App, spec: ModelSpec, thinking?: Effort
   app.providerConfig = nextConfig;
   app.credential = got;
   app.io.say(C.green(`  now ${spec.name}`) + C.dim(`  ${spec.id}`));
-  await rememberRecentModel(app, spec);
+  if (origin === "user") await rememberModelSelection(app, spec, thinking);
 }
 
-/** Recency feeds the picker's first section; a write failure only costs ordering. */
-async function rememberRecentModel(app: App, spec: ModelSpec): Promise<void> {
+/** N.8 must accept the checkpoint before a user choice can own the next startup. */
+async function rememberModelSelection(app: App, spec: ModelSpec, explicitThinking: Effort | undefined): Promise<void> {
   if (!app.ui) return;
-  const recentModels = recordRecent(app.ui.settings.recentModels ?? [], modelKey(spec));
-  app.ui.settings = { ...app.ui.settings, recentModels };
-  try { await writeUserSettings({ recentModels }); } catch { /* ordering only */ }
+  const effort = app.providerConfig.effort;
+  const patch = modelPreferencePatch(spec, app.ui.settings.recentModels ?? [], effort);
+  await commitUserSettings(app, explicitThinking === undefined ? patch : { ...patch, ...thinkingPreferencePatch(spec, effort) });
 }
 
 function sessionDirOf(app: App): string | undefined {

package/src/apps/startup-input.ts

@@ -7,7 +7,7 @@
 type StartupStdin = Pick<NodeJS.ReadStream, "isTTY" | "isRaw" | "setRawMode" | "setEncoding" | "on" | "off" | "resume" | "pause" | "unshift">;
 export interface StartupInput {
   phase(name: string): void;
-  /** Pause, restore the shell's mode and replay held bytes to the next input owner. */
+  /** Pause and replay held bytes while keeping raw mode for the next input owner. */
   handoff(): void;
   /** Final cleanup discards unsubmitted input instead of leaking it to the shell. */
   restore(): void;
@@ -45,9 +45,14 @@ export function createStartupInput(opts: {
     stdin.off("data", receive);
     signals.off("SIGINT", interrupt); signals.off("SIGTERM", terminate); signals.off("SIGHUP", hangup);
     pasting = false; partial = "";
+  };
+  const restore = () => {
+    if (closed) return;
+    closed = true; release(); pending = [];
+    // D20: ownership transfer must not expose a cooked-mode gap that turns CR into LF.
+    // Final cleanup also restores termios when the next renderer never mounted.
     stdin.setRawMode(wasRaw);
   };
-  const restore = () => { closed = true; release(); pending = []; };
   const cancel = (code: number) => {
     if (!active) return;
     restore();

package/src/apps/startup.ts

@@ -177,6 +177,8 @@ export interface Args {
   /** `--no-builtin-tools`. False when the flag was not passed. */
   noBuiltinTools: boolean;
   allowTools: string[];
+  /** `--yolo` / `-y`: skip tool approval for this process only. */
+  yolo: boolean;
   /** `--approve` true, `--no-approve` false. Omitted when neither. */
   approve?: boolean;
   configCommand?: boolean;
@@ -271,6 +273,7 @@ const KNOWN_FLAGS: readonly string[] = [
   "--no-tools", "-nt",
   "--no-builtin-tools",
   "--allow-tools",
+  "--yolo", "-y",
   "--approve", "-a",
   "--no-approve", "-na",
   "--theme",
@@ -343,7 +346,7 @@ export function parseArgs(argv: string[], options: { deferExtensions?: boolean;
     model: "", provider: "", apiKey: "", listModels: false, modelsCommand: false, modelsRefresh: false, fresh: false,
     noContextFiles: false, appendSystemPrompt: [],
     systemPrompt: null,
-    excludeTools: [], noTools: false, noBuiltinTools: false, allowTools: [],
+    excludeTools: [], noTools: false, noBuiltinTools: false, allowTools: [], yolo: false,
     print: false,
     theme: "",
     thinking: "",
@@ -428,6 +431,7 @@ export function parseArgs(argv: string[], options: { deferExtensions?: boolean;
     else if (a === "--no-tools" || a === "-nt") args.noTools = true;
     else if (a === "--no-builtin-tools" || a === "-nbt") args.noBuiltinTools = true;
     else if (a === "--allow-tools") args.allowTools = parseToolList(argv[++i] ?? "");
+    else if (a === "--yolo" || a === "-y") args.yolo = true;
     else if (a === "--approve" || a === "-a") args.approve = true;
     else if (a === "--no-approve" || a === "-na") args.approve = false;
     else if (a === "--theme") {
@@ -853,10 +857,14 @@ export function toolSelectionOf(args: Args) {
  * the provider bills, and an extra field there would look like a tool
  * argument.
  */
-export function sessionToolCatalog(args: Args, extensions?: ExtensionRegistry, previous: readonly unknown[] = []) {
+export function sessionToolCatalog(args: Args, extensions?: ExtensionRegistry, previous: readonly unknown[] = [], builtinDefaults?: readonly string[]) {
   const custom = [...extensions?.definitions().values() ?? []].map(({ name, description, input_schema }) => ({ name, description, input_schema, source: "extension" as const }));
-  const available = [...TOOL_DEFINITIONS.filter(tool => !extensions?.tools.has(tool.name) && (!tool.optional || args.tools?.includes(tool.name))).map((t) => ({ ...t, source: "builtin" as const })), ...custom];
-  const selected = selectTools(available, toolSelectionOf(args));
+  // O.7/D6: a cold app open uses saved capabilities as defaults, never today's profile.
+  // Explicit selection still wins; extension loading and current exclusions remain live.
+  const retained = builtinDefaults !== undefined && args.tools === undefined && args.toolProfile === undefined ? new Set(builtinDefaults) : undefined;
+  const available = [...TOOL_DEFINITIONS.filter(tool => !extensions?.tools.has(tool.name) &&
+    (retained === undefined ? !tool.optional || args.tools?.includes(tool.name) : retained.has(tool.name))).map((t) => ({ ...t, source: "builtin" as const })), ...custom];
+  const selected = selectTools(available, { ...toolSelectionOf(args), ...(retained ? { profile: "full" as const } : {}) });
   const deferred = selected.filter(tool => tool.source === "extension" && extensions?.tools.get(tool.name)?.exposure === "deferred")
     .map(({ name, description, input_schema }) => ({ name, description, input_schema }));
   const deferredNames = new Set(deferred.map(tool => tool.name));
@@ -909,7 +917,7 @@ export function createSessionFor(opts: {
     ...(args.pathRoot === undefined ? {} : { pathRoot: args.pathRoot }),
     allow: names,
     deferredTools: deferred,
-    rules: rulesWithAllowTools(args.allowTools),
+    rules: rulesWithAllowTools(args.allowTools, { yolo: args.yolo }),
     sessionRules,
     askSlot,
     ...(opts.extensions ? { extensions: opts.extensions.definitions(), extensionHooks: opts.extensions.toolHooks() } : {}),
@@ -1097,10 +1105,19 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
   opts.startupPhase?.("Opening session history");
   await session.start();
   resources.slash = { ...resources.slash, skills: new Map((session.config.skills ?? []).map(skill => [skill.name, skill])) };
-  if (resources.extensions.loaded.length || session.config.frozen.tools.some(tool =>
-    typeof tool === "object" && tool !== null && "name" in tool && typeof tool.name === "string" && unknownToolNames([tool.name]).length)) {
-    await session.reloadResources({ system: resources.system, tools: visibleSchemas(opts.args, resources.extensions, session.config.frozen.tools) });
+  const restoredTools = sessionToolCatalog(opts.args, resources.extensions, session.config.frozen.tools,
+    priorCursor === null ? undefined : declaredToolNames(session.config.frozen.tools));
+  const refreshResources = resources.extensions.loaded.length > 0 || session.config.frozen.tools.some(tool =>
+    typeof tool === "object" && tool !== null && "name" in tool && typeof tool.name === "string" && unknownToolNames([tool.name]).length);
+  const explicitTools = opts.args.tools !== undefined || opts.args.toolProfile !== undefined || opts.args.noTools ||
+    opts.args.noBuiltinTools || opts.args.excludeTools.length > 0;
+  if (refreshResources || (priorCursor !== null && explicitTools)) {
+    await session.reloadResources({ system: refreshResources ? resources.system : session.config.frozen.system, tools: restoredTools.schemas });
   }
+  // Admission follows this app's selected declaration; current process approval rules stay intact.
+  // Keep this out of Session.start(): an SDK caller can intentionally supply a narrower allowlist.
+  session.config.tools.allow = declaredToolNames(session.config.frozen.tools);
+  session.config.tools.deferredTools = restoredTools.deferred;
   if (restoring.id !== spec.id || restoring.provider !== spec.provider) {
     await session.switchModel(createProvider(providerConfig, credential.ok ? credential.key : "", retryHandler(opts.io),
       { sessionId: providerSessionId(session.config.logDir), ...(oauth(spec, credential) ? { oauth: true } : {}), ...(opts.effects ? { effects: opts.effects } : {}) }));
@@ -1455,7 +1472,7 @@ export function printCliHelp(flags?: ReadonlyMap<string, ExtensionFlag>): void {
           "            [--acceptance-file contract.json]\n" +
           "            [--control-socket /private/directory/control.sock]\n" +
           "            [--no-builtin-tools]\n" +
-          "            [--allow-tools names] [--approve|--no-approve]\n" +
+          "            [--allow-tools names] [--yolo|-y] [--approve|--no-approve]\n" +
           "            [--theme <name|path>] [--use-theme name] [--no-themes] [--thinking level] [--models patterns]\n" +
           "            [--skill <path>] [--no-skills]\n" +
           "            [--prompt-template <path>] [--no-prompt-templates]\n" +
@@ -1481,7 +1498,10 @@ export function printCliHelp(flags?: ReadonlyMap<string, ExtensionFlag>): void {
           "  --tools is a strict allowlist; excluded tools leave the schema.\n" +
           "  New sessions use coding (10 tools); full exposes default built-ins.\n" +
           "  --no-builtin-tools drops built-ins and keeps any other source; --tools still wins.\n" +
-          "  bash asks before it runs. --allow-tools bash skips the ask for this process.\n" +
+          "  Shell entry points (exec_command, environment, bash, target) ask before they run.\n" +
+          "  --allow-tools exec_command skips asks for that tool for this process.\n" +
+          "  --yolo (-y) skips all tool approvals for this process, including resumed sessions.\n" +
+          "  Tool exclusions and path limits still apply; YOLO does not change project trust.\n" +
           "  --time-budget <seconds> tells the model, once, when 75% of the run's wall-clock budget is used.\n" +
           "  --state-dir <dir> keeps snapshots, observations and sessions out of the workspace.\n" +
           "  --checkpoint-shell enables best-effort Git recovery for command changes; ignored files and external effects are excluded.\n" +