dsh-packycode-api 1.1.2 → 1.1.4

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.1.4
+
+- **Carry the reviewed plan into the next CLI turn.** The plan previously existed only in `exit_plan_mode` arguments, which the delegated transcript dropped; a fresh CLI then saw only “Plan approved”. The latest complete plan and its matching review result are now recovered from durable native or adapter-generated PTC tool calls, so approval, revision, resume and fork keep their constraints. They are reserved before trimming older chat; an oversized plan/request fails explicitly rather than silently losing constraints. Unrelated tool arguments and arbitrary PTC programs are not forwarded.
+- **Use the actual CLI permission protocol.** Plan runs now request `--permission-prompt-tool stdio` as well as `--permission-mode plan`, making `ExitPlanMode` available to the official print-mode CLI and routing its permission request to the host. A targeted ask rule prevents an existing `ExitPlanMode` allow rule from skipping the handoff. Repeated permission refusals are bounded, including native plan-mode tool-result denials, without counting ordinary execution errors or counting one refusal twice.
+- **Plans belong to one invocation.** Each plan run creates one private temporary planning-artifact directory inside its working directory (the official CLI rejects custom plan directories outside the project root), and supplies it through additive `plansDirectory` settings while preserving the credential/config home and other permission/MCP settings. It never changes project code or project settings; an unwritable workspace fails explicitly rather than using a shared fallback. File fallback and submitted paths are restricted to that directory; shared/global plans and a prior run's recent file are never candidates. Owned resources are cleaned on completion, cancellation, startup failure and unload.
+- **Review follows the host's tool presentation.** Native catalogs receive `exit_plan_mode`; PTC catalogs receive the real `run_code` transport calling `tools.exit_plan_mode`. Missing review transports fail closed instead of inventing an unavailable direct tool call.
+- **Leave plan mode at the correct boundary.** Model preparation can follow a selected pending mode, but `claude_code` execution reads the currently committed mode. Approval's pending exit no longer gives later tools in the same batch edit/full permission before the next accepted step.
+- **Secret-free release preflight.** The OIDC diagnostic now prints only identity claims and the registry exchange status, never the returned credential body, and fails when the publisher is rejected. Truncating a body before regex redaction could previously expose a token prefix. Added regressions for long credential bodies and the registry's successful `201` response. Tag publication now packs and publishes the verified versioned tarball, matching the locally inspected artifact rather than independently repacking the workspace.
+- Added `scripts/cli-plan-check.mjs`, a real-official-CLI/local-fake-gateway check for stdio handoff, private plan files, concurrent ownership, native denials, MCP search and cleanup. It uses no real credentials or quota and does not start DSH.
+- Validation: full offline suite, both bundles and the versioned tarball; official CLI 2.1.295 against local fixtures passed stdio plan handoff, existing-allow-rule interception, concurrent/private plan ownership, native denial limits, MCP and cleanup, plus the existing read-only/edit/full search checks. Actual bundled DSH 0.2.0-rc.2 plan/tool controllers and its Node PTC subprocess passed 50 offline assertions. The built HTTP route answered through `deepseek-flash`, `gpt-6.1-sol` and `gpt-6-astra`, and key rotation and secret-free RPC projections passed the gateway check. The available key does not cover Claude: actual Claude upstream and a running desktop DSH UI integration are not claimed.
+
+## 1.1.3
+
+- **Plan review when the CLI has no ExitPlanMode.** Print mode often does not offer that tool, so a plan-mode turn wrote `~/.dsh/packycode-claude-cli/plans/*.md` and came back as ordinary text. A plan file written during the run is now submitted through DSH's `exit_plan_mode` when the CLI returns. An older file in that directory is ignored.
+
 ## 1.1.2
 
 - **Claude CLI follows DSH plan mode.** While the current session's plan mode is on (including a selection that applies on this step but is not logged yet), a Claude model turn and the `claude_code` tool run the local CLI with `--permission-mode plan`. That wins over the session permission preset and over an explicit `claudeCliMode` pin. The CLI may explore read-only; other permission prompts are denied, and after eight denials the run stops instead of hanging. `ExitPlanMode` is never allowed inside the CLI process. A submitted plan becomes the assistant's `exit_plan_mode` tool call, so DSH's existing review approves it and the next step implements. The delegation tool returns the plan text for the parent model to submit. Session titles stay read-only. A host without the plan-mode service behaves as before.

package/README.en.md

@@ -44,7 +44,7 @@ Open the desktop application's **Plugins** page, click **Add plugin**, and enter
 dsh-packycode-api
 ```
 
-Choose the **official** install source, then click **Install**. To pin a version, enter `dsh-packycode-api@1.1.2`.
+Choose the **official** install source, then click **Install**. To pin a version, enter `dsh-packycode-api@1.1.4`.
 
 Then **manually restart the desktop application**. Refreshing the page does not reload the plugin inside the Host process.
 
@@ -63,7 +63,7 @@ Choose a model from the `PackyCode` group. `deepseek-flash`, `gpt-6.1-sol`, and
 
 The **Plugins** page shows the installed state and version, and is also where you enable, disable, or uninstall.
 
-**For non-desktop profiles only:** `dsh plugin --profile <name> add dsh-packycode-api@1.1.2`. Do not use it for `desktop` — the CLI refuses it (`profile "desktop" is managed exclusively by the Electron application`).
+**For non-desktop profiles only:** `dsh plugin --profile <name> add dsh-packycode-api@1.1.4`. Do not use it for `desktop` — the CLI refuses it (`profile "desktop" is managed exclusively by the Electron application`).
 
 A local checkout can be linked with `dsh plugin --profile <name> add link:/path/to/dsh-packycode-api`.
 
@@ -153,7 +153,7 @@ A model in the list does not mean the current token group allows it. When changi
 - The `cc` group accepts only the official Claude CLI. A normal API client gets `403 This API endpoint is only accessible via the official Claude CLI`. This plugin runs the local `claude` binary for that group instead of switching the token to `cc-sale` or pretending to be the official client. If the token has no group the official CLI may use, the three Claude models still will not run.
 - Selecting a Claude model when the CLI is missing fails that turn with an install hint. It does not surface as a missing binary name alone.
 - The CLI receives this plugin's endpoint and current key (`ANTHROPIC_BASE_URL` / `ANTHROPIC_AUTH_TOKEN`) and an isolated config directory, `~/.dsh/packycode-claude-cli`. Without that isolation, `env` in `~/.claude/settings.json` would override the plugin key.
-- CLI permission follows the session by default: `read-only` stays read-only, `workspace-write` may edit, and `danger-full-access` with approval disabled may use `full`. The CLI cannot ask the DSH user for approval, so a session that still asks never gets `full`. `claudeCliMode` can pin `read-only`, `edit`, or `full`. DSH plan mode wins over that mapping and over the pin: the CLI runs with `--permission-mode plan`, and `ExitPlanMode` submits the plan to DSH's review instead of editing in the same process. The previous mode returns after approval or `/plan off`. Session titles stay out of plan mode. An empty `claudeCliPath` is looked up automatically; an empty `claudeCliCwd` uses the session workspace.
+- CLI permission follows the session by default: `read-only` stays read-only, `workspace-write` may edit, and `danger-full-access` with approval disabled may use `full`. The CLI cannot ask the DSH user for approval, so a session that still asks never gets `full`. `claudeCliMode` can pin `read-only`, `edit`, or `full`. DSH plan mode wins over that mapping and over the pin: the CLI runs read-only with `--permission-mode plan --permission-prompt-tool stdio`, using one private hidden temporary plan directory inside the working directory per invocation (the CLI rejects custom plan directories outside the project root). This stores only planning artifacts, changes no project code or settings, and fails explicitly for an unwritable workspace. `ExitPlanMode` hands the plan to DSH for review; it never starts implementation in that CLI process. File fallback reads only this invocation's directory, which is cleaned afterwards. Review works in native and PTC tool modes, and the complete plan and review feedback reach the next turn; exceeding the conversation budget fails explicitly instead of silently truncating constraints. Approval or `/plan off` takes effect from the next step; delegations in the same tool batch keep the current plan state. Session titles stay out of plan mode. An empty `claudeCliPath` is looked up automatically; an empty `claudeCliCwd` uses the session workspace.
 - Thinking and tool activity (`▸ Bash`, `▸ Read`, and `✗` on failure) appear in that turn's reasoning block. They are progress, not DSH tool calls. The CLI's own tools are outside the DSH sandbox.
 - The reasoning block opens with `▸ 启动 Claude Code CLI…` and then shows the CLI's version and model once it is up. When the gateway throttles or is busy (429, 503 `账号并发排队已满` / per-account wait queue full, and similar), the CLI retries up to 10 times on its own; each retry now shows as `↻ 网关返回 HTTP 503，CLI 自动重试 n/10` instead of looking hung. When the retries run out, the turn says PackyCode's Claude upstream is busy, not that the key is bad. A CLI that prints nothing for 2 minutes after starting is stopped and reported.
 - The conversation and its images reach the CLI over stdin (`--input-format stream-json`), not argv: a Windows command line is length-limited and cannot carry an image. Images in the conversation are sent to Claude as images, at the HTTP route's request size (at most 2048×2048, about 1 MiB each; at most 20 images and 20 MiB per turn, dropping the oldest first). An image left out is named with its read-only local copy, which the CLI can open with Read.
@@ -214,6 +214,8 @@ pnpm run check
 
 `node scripts/cli-search-check.mjs` runs the real CLI against a local test gateway and MCP bridge; Claude responses and search data are mocked by default, with no quota consumed. It checks all three permission modes, native-search exclusion and temporary-resource cleanup. `--live --backend deepseek` or `--live --backend gpt` sends the read-only mode's one search to the real backend (edit/full remain mocked). This does not verify actual Claude upstream turns or a running DSH integration.
 
+`node scripts/cli-plan-check.mjs` checks plan mode with the real CLI and a local fake gateway: stdio handoff, concurrent plan ownership, invocation-only file fallback, stale-plan exclusion, actual denial limits and cleanup. It reads no real credentials, spends no quota and starts no DSH instance.
+
 Read [AGENTS.md](AGENTS.md) before agent-assisted changes or a release. Publishing is the [Publish workflow](.github/workflows/publish.yml), triggered by pushing a `v*` tag. Do not run `npm publish` locally.
 
 ## License

package/README.md

@@ -48,7 +48,7 @@
 dsh-packycode-api
 ```
 
-在**安装源**中选择**官方源**，然后点击**安装**。需要固定版本时填入 `dsh-packycode-api@1.1.2`。
+在**安装源**中选择**官方源**，然后点击**安装**。需要固定版本时填入 `dsh-packycode-api@1.1.4`。
 
 完成后**手动重启桌面应用**。仅刷新页面不会重新加载 Host 里的插件。
 
@@ -67,7 +67,7 @@ dsh-packycode-api
 
 桌面应用的**插件**页可以看到已安装状态与版本，也可以在那里启用、停用或卸载。
 
-**仅用于非 desktop profile：** `dsh plugin --profile <name> add dsh-packycode-api@1.1.2`。不要对 `desktop` 使用它 —— CLI 会直接拒绝（`profile "desktop" is managed exclusively by the Electron application`）。
+**仅用于非 desktop profile：** `dsh plugin --profile <name> add dsh-packycode-api@1.1.4`。不要对 `desktop` 使用它 —— CLI 会直接拒绝（`profile "desktop" is managed exclusively by the Electron application`）。
 
 本地开发可以用绝对路径：`dsh plugin --profile <name> add link:/path/to/dsh-packycode-api`。
 
@@ -157,7 +157,7 @@ Claude Code CLI → 本机临时 MCP web_search → 插件选定的 DeepSeek/GPT
 - `cc`（Claude Code 专用）只接受官方 Claude CLI。用普通 API 客户端调 Claude 会 403：`This API endpoint is only accessible via the official Claude CLI`。本插件因此调用本机 `claude`，而不是改去 `cc-sale`，也不是伪造客户端身份。令牌如果没有开放给官方 CLI 的分组，这三个模型仍然不可用。
 - 选了 Claude 模型但本机没有 CLI 时，这一回合会直接说明未安装，并指向设置页的安装按钮。
 - CLI 使用插件配置的地址和当前 Key（`ANTHROPIC_BASE_URL` / `ANTHROPIC_AUTH_TOKEN`），以及独立配置目录 `~/.dsh/packycode-claude-cli`。不隔离的话，`~/.claude/settings.json` 里的 `env` 会盖掉插件 Key。
-- CLI 权限默认跟随当前会话：`read-only` → 只读，`workspace-write` → 可编辑，`danger-full-access` 且不再审批 → `full`。CLI 不能向 DSH 弹审批，所以只要会话还要审批，就不会给它 `full`。也可把设置项 `claudeCliMode` 固定成 `read-only` / `edit` / `full`。DSH 计划模式优先于该映射和这个固定档：CLI 以 `--permission-mode plan` 只读探索，调用 `ExitPlanMode` 后把计划交给 DSH 审阅，批准或 `/plan off` 之后才恢复原来的档位。会话标题不进入计划模式。`claudeCliPath` 留空则自动查找；`claudeCliCwd` 留空则用当前会话工作区。
+- CLI 权限默认跟随当前会话：`read-only` → 只读，`workspace-write` → 可编辑，`danger-full-access` 且不再审批 → `full`。CLI 不能向 DSH 弹审批，所以只要会话还要审批，就不会给它 `full`。也可把设置项 `claudeCliMode` 固定成 `read-only` / `edit` / `full`。DSH 计划模式优先于该映射和这个固定档：CLI 以 `--permission-mode plan --permission-prompt-tool stdio` 只读探索，每轮在工作目录内创建一个独占的隐藏临时计划目录（CLI 不接受工作区外的自定义计划目录）；只存计划工件，不改项目代码或设置，工作区不可写时明确失败。`ExitPlanMode` 交给 DSH 审阅，不允许 CLI 在同一进程开始实施；只在本轮目录中查找未显式提交的计划，结束时清理。原生和 PTC 工具模式都支持审阅，完整计划及审阅反馈会带到下一轮；超过对话预算会明确报错，不静默截断约束。批准或 `/plan off` 在下一步生效，同一工具批次内的委派仍遵守当前计划状态。会话标题不进入计划模式。`claudeCliPath` 留空则自动查找；`claudeCliCwd` 留空则用当前会话工作区。
 - 思考过程和工具调用（`▸ Bash`、`▸ Read`，失败时带 `✗`）会出现在这一回合的思考区。它们是进度，不是 DSH 的工具调用。CLI 自己的工具不受 DSH 沙箱约束。
 - 思考区第一行是「▸ 启动 Claude Code CLI…」，CLI 起来后显示版本和模型。网关限流或繁忙（429、503 `账号并发排队已满` 等）时，CLI 会自己重试最多 10 次，每次重试都会显示成 `↻ 网关返回 HTTP 503，CLI 自动重试 n/10`，不再像卡住。重试用完仍失败时，会说明是 PackyCode 的 Claude 上游繁忙，不是 Key 的问题。CLI 启动后 2 分钟内没有任何输出会被停止并报告原因。
 - 对话记录和图片通过 stdin 交给 CLI（`--input-format stream-json`），不走命令行参数：Windows 命令行长度有上限，而且命令行带不了图片。对话里的图片会以图片形式发给 Claude（与 HTTP 路由相同的压缩规格：每张不超过 2048×2048、约 1 MiB；一回合最多 20 张、合计 20 MiB，超出时先舍弃最早的）。没随消息发出的图片会写明本机只读副本的路径，CLI 需要时可以用 Read 读取。
@@ -218,6 +218,8 @@ pnpm run check
 
 Claude CLI 的 MCP 接口验证用 `node scripts/cli-search-check.mjs`：运行真实 CLI，普通 Claude 响应和搜索数据默认由本地测试服务模拟，不消费额度；会检查三种权限模式、原生搜索禁用和临时资源清理。加 `--live --backend deepseek` 或 `--live --backend gpt` 会让只读模式的那一次搜索走真实后端（其它两种模式仍模拟）。这不等于验证了真实 Claude 上游对话或运行中的 DSH 集成。
 
+计划模式另用 `node scripts/cli-plan-check.mjs` 验证：真实 CLI 对接本地模拟网关，检查 stdio 计划提交、并发计划归属、本轮文件回退、旧计划隔离、实际拒绝次数上限和清理；不读取真实凭据、不消费额度、不启动 DSH。
+
 使用 Agent 修改或发布时，先读 [AGENTS.md](AGENTS.md)。发布由推送 `v*` 标签触发 [Publish workflow](.github/workflows/publish.yml)，不要在本机执行 `npm publish`。
 
 ## License

package/lib/index.js

@@ -1,10 +1,10 @@
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { homedir, tmpdir } from "node:os";
-import { isAbsolute, join, posix, sep, win32 } from "node:path";
+import { dirname, isAbsolute, join, posix, resolve, sep, win32 } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { HarnessError, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { spawn } from "node:child_process";
-import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs";
 import { mkdtemp, readFile, readdir, realpath, rename, rm, writeFile } from "node:fs/promises";
 import { createServer } from "node:http";
 import { defineTool } from "@deepseek-ai/dsh-tools";
@@ -1275,12 +1275,104 @@ function hostPath(lookup) {
 		return;
 	}
 }
+/** The only PTC program this adapter emits; its JSON literal also works in Python. */
+const PLAN_REVIEW_PROGRAM_PREFIX = "return await tools.exit_plan_mode(";
+/** Parse durable arguments without evaluating model-authored code. */
+function parsedArguments(value) {
+	try {
+		return typeof value === "string" ? JSON.parse(value) : value;
+	} catch {
+		return;
+	}
+}
+/**
+* Recover only the public plan, never arbitrary tool arguments or PTC code.
+* The PTC allowlist is deliberately the exact, single-call program we emit.
+*/
+function planOfCall(block) {
+	if (block?.type !== "tool-call") return void 0;
+	const args = parsedArguments(block.arguments);
+	let plan;
+	if (block.name === "exit_plan_mode") plan = args?.plan;
+	else if (block.name === "run_code" && typeof args?.code === "string") {
+		const code = args.code;
+		if (!code.startsWith(PLAN_REVIEW_PROGRAM_PREFIX) || !code.endsWith(")")) return void 0;
+		const review = parsedArguments(code.slice(34, -1));
+		if (review === null || typeof review !== "object" || Object.keys(review).length !== 1) return void 0;
+		plan = review.plan;
+	}
+	return typeof plan === "string" && plan.trim() !== "" ? plan : void 0;
+}
+/** Keep the latest complete plan and its review from the persisted model transcript. */
+function planReviewContext(messages) {
+	let latest;
+	for (const message of messages) {
+		if (message?.role !== "assistant") continue;
+		for (const block of Array.isArray(message.content) ? message.content : []) {
+			const plan = planOfCall(block);
+			if (plan !== void 0) latest = {
+				plan,
+				id: block.id
+			};
+		}
+	}
+	if (latest === void 0) return void 0;
+	let review;
+	for (const message of messages) {
+		if (message?.role !== "user") continue;
+		for (const block of Array.isArray(message.content) ? message.content : []) {
+			if (block?.type !== "tool-result" || latest.id === void 0 || block.toolCallId !== latest.id) continue;
+			const text = typeof block.content === "string" ? block.content : (Array.isArray(block.content) ? block.content : []).filter((part) => part?.type === "text" && typeof part.text === "string").map((part) => part.text).join("\n");
+			review = `[计划审阅${block.isError === true ? "未批准/失败" : "结果"}]\n${text}`;
+		}
+	}
+	return {
+		id: latest.id,
+		turn: {
+			label: "计划审阅上下文",
+			parts: [{
+				kind: "text",
+				text: `[最近提交的完整计划；提交本身不代表已批准]\n${latest.plan}\n\n${review ?? "[尚无计划审阅结果；不要把提交视为实施许可]"}`
+			}]
+		}
+	};
+}
+/**
+* Select the review transport from this request's actual direct-tool catalog.
+* `run_code` binds `tools` in both supported host language flavors.
+*/
+function planReviewCall(options, plan) {
+	if (plan.trim() === "") throw new Error("Claude Code submitted an empty plan; no review or implementation was authorized.");
+	const context = planReviewContext([{
+		role: "assistant",
+		content: [{
+			type: "tool-call",
+			name: "exit_plan_mode",
+			arguments: { plan }
+		}]
+	}]).turn;
+	if (textLength(context.parts) + context.label.length + 3 >= MAX_PROMPT_CHARS$1) throw new Error("The submitted plan exceeds the CLI delegation budget (48,000 characters). Shorten or split it before review; no plan constraints were truncated and no implementation was authorized.");
+	const tools = Array.isArray(options?.tools) ? options.tools : [];
+	if (tools.some((tool) => tool?.name === "exit_plan_mode")) return {
+		name: "exit_plan_mode",
+		args: JSON.stringify({ plan })
+	};
+	if (tools.some((tool) => tool?.name === "run_code")) return {
+		name: "run_code",
+		args: JSON.stringify({
+			code: `${PLAN_REVIEW_PROGRAM_PREFIX}${JSON.stringify({ plan })})`,
+			description: "Present completed plan for user review"
+		})
+	};
+	throw new Error("Claude Code submitted a plan, but this request has neither exit_plan_mode nor run_code available for host review; no implementation was authorized.");
+}
 /**
 * Flatten one message's content into ordered parts: text, image, and file.
 * Tool calls and results become short text so a turn that started on another
-* model still reads coherently; reasoning is not carried.
+* model still reads coherently; reasoning is not carried. The latest review
+* result is carried in full separately, not through the general 8k tool cap.
 */
-function collectParts(blocks, parts) {
+function collectParts(blocks, parts, reviewId) {
 	for (const block of Array.isArray(blocks) ? blocks : []) {
 		if (block === null || typeof block !== "object") continue;
 		switch (block.type) {
@@ -1314,6 +1406,7 @@ function collectParts(blocks, parts) {
 				});
 				break;
 			case "tool-result": {
+				if (reviewId !== void 0 && block.toolCallId === reviewId) break;
 				if (typeof block.content === "string") {
 					parts.push({
 						kind: "text",
@@ -1355,10 +1448,12 @@ const textLength = (parts) => parts.reduce((sum, part) => sum + (part.kind === "
 */
 function delegatedTurns(options) {
 	const messages = Array.isArray(options?.messages) ? options.messages : [];
+	const review = planReviewContext(messages);
+	const reserved = review === void 0 ? 0 : textLength(review.turn.parts) + review.turn.label.length + 3;
 	const turns = [];
 	for (const message of messages) {
 		if (message === null || typeof message !== "object" || message.role === "system") continue;
-		const parts = collectParts(message.content, []);
+		const parts = collectParts(message.content, [], review?.id);
 		if (parts.length === 0 || textLength(parts) === 0 && !parts.some((part) => part.kind !== "text")) continue;
 		const label = message.role === "user" ? "用户" : message.role === "assistant" ? "助手" : String(message.role);
 		turns.push({
@@ -1366,8 +1461,11 @@ function delegatedTurns(options) {
 			parts
 		});
 	}
+	const newest = turns.at(-1);
+	const newestSize = newest === void 0 ? 0 : textLength(newest.parts) + newest.label.length + 3;
+	if (review !== void 0 && reserved + newestSize > MAX_PROMPT_CHARS$1) throw new Error("The complete plan, its review, and the latest request exceed the CLI delegation budget (48,000 characters). Shorten or split the plan/request before continuing; plan constraints were not truncated.");
 	const kept = [];
-	let used = 0;
+	let used = reserved;
 	for (let index = turns.length - 1; index >= 0; index -= 1) {
 		const turn = turns[index];
 		const size = textLength(turn.parts) + turn.label.length + 3;
@@ -1383,9 +1481,11 @@ function delegatedTurns(options) {
 		});
 		break;
 	}
+	const truncated = kept.length < turns.length || kept[0]?.clipped === true;
+	if (review !== void 0) kept.unshift(review.turn);
 	return {
 		turns: kept,
-		truncated: kept.length < turns.length || kept[0]?.clipped === true
+		truncated
 	};
 }
 /** Keep the last `budget` characters of a turn's text, and every part after them. */
@@ -1430,7 +1530,7 @@ const plainDescription = (part) => part.kind === "image" ? `[图片 ${attachment
 function delegationInstructions(options, cwd, { plan = false } = {}) {
 	const system = typeof options?.system === "string" && options.system.trim() !== "" ? options.system.trim() : "";
 	return [
-		plan ? "本回合 DeepSeek Harness 处于计划模式。只做只读探索，把完整实施计划写成以一级标题开头的 Markdown，写入 CLI 指定的计划文件，然后调用 ExitPlanMode 提交审阅。不要修改项目、不要开始实施。用户消息是 DeepSeek Harness 会话的近期对话记录，最后一条是当前请求；其中的图片已作为图片随消息附上，「只读副本」路径也可以用 Read 工具读取。" : "本回合由 DeepSeek Harness 委派给 Claude Code 执行。用户消息是 DeepSeek Harness 会话的近期对话记录，最后一条是当前请求；其中的图片已作为图片随消息附上，「只读副本」路径也可以用 Read 工具读取。请用你自己的工具完成任务，直接输出最终结果；不要反问、不要复述流程。",
+		plan ? "本回合 DeepSeek Harness 处于计划模式。只做只读探索，把完整实施计划写成以一级标题开头的 Markdown，写入 CLI 指定的计划文件。若有 ExitPlanMode 就调用它；没有也在写完后停下来。不要修改项目、不要开始实施。DeepSeek Harness 会用这份计划打开审阅。用户消息是 DeepSeek Harness 会话的近期对话记录，最后一条是当前请求；其中的图片已作为图片随消息附上，「只读副本」路径也可以用 Read 工具读取。" : "本回合由 DeepSeek Harness 委派给 Claude Code 执行。用户消息是 DeepSeek Harness 会话的近期对话记录，最后一条是当前请求；其中的图片已作为图片随消息附上，「只读副本」路径也可以用 Read 工具读取。请用你自己的工具完成任务，直接输出最终结果；不要反问、不要复述流程。",
 		cwd === void 0 ? void 0 : `工作目录：${cwd}`,
 		system === "" ? void 0 : `补充说明（来自 DeepSeek Harness，其中提到的工具你未必拥有）：${system.slice(0, 2e3)}`
 	].filter((part) => part !== void 0).join("\n");
@@ -1898,7 +1998,8 @@ function createClaudeCliAdapter({ inner, runner, modelIds = CLI_BACKED_MODEL_IDS
 				default: break;
 			}
 			if (submittedPlan !== void 0) {
-				yield* blocks.toolCall(`plan-${randomUUID()}`, "exit_plan_mode", JSON.stringify({ plan: submittedPlan }));
+				const review = planReviewCall(options, submittedPlan);
+				yield* blocks.toolCall(`plan-${randomUUID()}`, review.name, review.args);
 				yield {
 					type: "usage",
 					usage: turnUsage(lastRequest, finished)
@@ -2304,10 +2405,11 @@ function resolveSpawnCommand(binary, { platform = process.platform, exists = exi
 *   consumes the streaming protocol, and instructions appended to the CLI's
 *   own system prompt ({@link DEFAULT_APPEND_SYSTEM_PROMPT} when blank). The
 *   CLI's system prompt and tool set are never replaced: they are part of
-*   what the official client sends.
+*   what the official client sends. Plan runs supply an absolute private
+*   planDirectory below the child's working directory.
 * @returns argv after the binary name.
 */
-function buildClaudeArgs({ mode = DEFAULT_CLAUDE_MODE, model, stream = false, appendSystemPrompt, searchBridge, disableNativeSearch = false } = {}) {
+function buildClaudeArgs({ mode = DEFAULT_CLAUDE_MODE, model, stream = false, appendSystemPrompt, searchBridge, disableNativeSearch = false, planDirectory } = {}) {
 	const spec = CLAUDE_CLI_MODES[mode];
 	if (spec === void 0) throw new Error(`claude_code mode must be one of ${Object.keys(CLAUDE_CLI_MODES).join(", ")}`);
 	const args = stream ? [
@@ -2334,16 +2436,31 @@ function buildClaudeArgs({ mode = DEFAULT_CLAUDE_MODE, model, stream = false, ap
 		args.push("--permission-mode", spec.permissionMode);
 		if (searchBridge !== void 0) args.push("--allowedTools", searchBridge.toolName);
 	} else args.push("--allowedTools", ...spec.allowedTools, ...searchBridge === void 0 ? [] : [searchBridge.toolName]);
+	if (mode === "plan") {
+		args.push("--permission-prompt-tool", "stdio");
+		if (planDirectory !== void 0 && (typeof planDirectory !== "string" || !isAbsolute(planDirectory))) throw new Error("claude_code plan directory must be an absolute path");
+		args.push("--settings", JSON.stringify({
+			...planDirectory === void 0 ? {} : { plansDirectory: planDirectory },
+			permissions: { ask: ["ExitPlanMode"] }
+		}));
+	}
 	if (disableNativeSearch || searchBridge !== void 0) args.push("--disallowedTools", "WebSearch");
 	if (searchBridge !== void 0) args.push("--mcp-config", searchBridge.configPath);
 	return args;
 }
-/** How many permission prompts one plan-mode run will refuse before stopping. */
+/** How many permission denials one plan-mode run may recover from. */
 const MAX_PLAN_DENIALS = 8;
-/** A plan file larger than this is not read into the turn. */
+/** A plan file or submitted plan larger than this is not returned into the turn. */
 const PLAN_FILE_MAX_BYTES = 2e5;
-const PLAN_FILE_CLOCK_SKEW_MS = 2e3;
+const PLAN_DIRECTORY_PREFIX = ".dsh-packycode-plan-";
+const PLAN_FS = Object.freeze({
+	mkdtempSync,
+	realpathSync,
+	lstatSync,
+	rmSync
+});
 const PLAN_EXIT_DENY = "Write the plan to the plan file first, starting with a # heading, then call ExitPlanMode again.";
+const PLAN_TOO_LARGE_DENY = "The plan exceeds the 200000-byte review limit. Write a complete, shorter plan without dropping constraints, then call ExitPlanMode again.";
 const PLAN_ACTION_DENY = "Plan mode is active. Do not edit files or run commands that change the system. Continue read-only exploration, write the plan file, and call ExitPlanMode.";
 const PLAN_DIALOG_ERROR = "Plan mode cannot ask the user from the CLI. Decide and continue, or call ExitPlanMode.";
 const PLAN_DENY_LIMIT_MESSAGE = "claude_code plan mode stopped after too many denied permission prompts";
@@ -2357,11 +2474,58 @@ function planMarkdown(value) {
 	if (typeof value !== "string") return void 0;
 	const trimmed = value.trim();
 	if (trimmed === "") return void 0;
-	const bounded = trimmed.length > PLAN_FILE_MAX_BYTES ? trimmed.slice(0, PLAN_FILE_MAX_BYTES) : trimmed;
-	return /^#\s+\S/u.test(bounded) ? bounded : `# Plan\n\n${bounded}`;
+	const markdown = /^#\s+\S/u.test(trimmed) ? trimmed : `# Plan\n\n${trimmed}`;
+	return Buffer.byteLength(markdown) > PLAN_FILE_MAX_BYTES ? void 0 : markdown;
+}
+/** Own exactly one newly created, owner-only directory, never a shared CLI home. */
+function createOwnedPlanDirectory(fs, cwd) {
+	const parent = fs.realpathSync(cwd ?? process.cwd());
+	const directory = fs.mkdtempSync(join(parent, PLAN_DIRECTORY_PREFIX));
+	if (!isAbsolute(directory) || dirname(directory) !== parent || !directory.startsWith(join(parent, PLAN_DIRECTORY_PREFIX))) throw new Error("PackyCode plan directory ownership could not be established");
+	const identity = fs.lstatSync(directory);
+	if (!identity.isDirectory() || identity.isSymbolicLink()) throw new Error("PackyCode plan directory ownership could not be established");
+	const canonical = directory;
+	let removed = false;
+	const isOwned = () => {
+		try {
+			const current = fs.lstatSync(directory);
+			return current.isDirectory() && !current.isSymbolicLink() && current.dev === identity.dev && current.ino === identity.ino && fs.realpathSync(directory) === canonical;
+		} catch {
+			return false;
+		}
+	};
+	const owned = {
+		directory: canonical,
+		isOwned,
+		close() {
+			if (removed) return;
+			let current;
+			try {
+				current = fs.lstatSync(directory);
+			} catch (error) {
+				if (error?.code === "ENOENT") {
+					removed = true;
+					return;
+				}
+				throw error;
+			}
+			if (!current.isDirectory() || current.isSymbolicLink() || !isOwned()) throw new Error("PackyCode plan directory ownership changed; refusing to remove it");
+			fs.rmSync(canonical, {
+				recursive: true,
+				force: true
+			});
+			removed = true;
+		}
+	};
+	if (!isOwned()) {
+		owned.close();
+		throw new Error("PackyCode plan directory ownership could not be established");
+	}
+	return owned;
 }
-/** Whether `file` is the root itself or a path inside it, after resolving links. */
+/** Whether a file stays inside the immutable canonical directory bound to the run. */
 function pathInside(root, file, realpath) {
+	if (typeof root !== "string" || !isAbsolute(root) || typeof file !== "string" || !isAbsolute(file)) return false;
 	let rootReal;
 	let fileReal;
 	try {
@@ -2370,42 +2534,104 @@ function pathInside(root, file, realpath) {
 	} catch {
 		return false;
 	}
+	if (rootReal !== resolve(root)) return false;
 	const prefix = rootReal.endsWith(sep) ? rootReal : `${rootReal}${sep}`;
-	return fileReal === rootReal || fileReal.startsWith(prefix);
+	return fileReal.startsWith(prefix);
+}
+/** A descriptor-based bounded read also rejects a replaced leaf before reading it. */
+function readBoundedPlanFile(file, expected) {
+	const fd = openSync(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+	try {
+		const info = fstatSync(fd);
+		if (!info.isFile() || expected !== void 0 && (info.dev !== expected.dev || info.ino !== expected.ino)) return void 0;
+		if (info.size > PLAN_FILE_MAX_BYTES) throw Object.assign(/* @__PURE__ */ new Error(PLAN_TOO_LARGE_DENY), { code: "CLAUDE_PLAN_TOO_LARGE" });
+		const bytes = Buffer.allocUnsafe(200001);
+		let length = 0;
+		while (length < bytes.length) {
+			const count = readSync(fd, bytes, length, bytes.length - length, null);
+			if (count === 0) break;
+			length += count;
+		}
+		if (length > PLAN_FILE_MAX_BYTES) throw Object.assign(/* @__PURE__ */ new Error(PLAN_TOO_LARGE_DENY), { code: "CLAUDE_PLAN_TOO_LARGE" });
+		return bytes.subarray(0, length).toString("utf8");
+	} finally {
+		closeSync(fd);
+	}
 }
 /**
-* The plan a CLI `ExitPlanMode` request is submitting.
-*
-* The tool's own schema does not carry the plan; the CLI injects `plan` and
-* `planFilePath` from the file it told the model to write. Text on the request
-* wins. A path is read only when it resolves inside this run's config home or
-* `~/.claude/plans`, is a markdown file written for this run, and is bounded.
-* Anything else is ignored — a model-supplied path is not a licence to read
-* the disk.
-* @param input - the control request's `input`.
-* @param options - config home, when the run started, and file-system seams.
-* @returns plan markdown, or undefined when the request has none yet.
-*/
-function readSubmittedPlan(input, { configDir, startedAt = Date.now(), home = homedir(), readFile = (file) => readFileSync(file, "utf8"), stat = statSync, realpath = realpathSync } = {}) {
-	const inline = planMarkdown(input?.plan);
-	if (inline !== void 0) return inline;
+* The plan a CLI ExitPlanMode request submits. Inline text remains valid; a
+* file must resolve inside this invocation's explicitly bound canonical
+* planDirectory. Shared config homes and ~/.claude/plans are never searched.
+* The caller supplies scrub so secrets are removed before the size check.
+* @param input - the control request's input.
+* @param options - the bound private plan directory, redactor, and filesystem seams.
+* @returns bounded plan markdown, or undefined when the request has none yet.
+*/
+function readSubmittedPlan(input, { planDirectory, scrub = (value) => value, onRejected = () => void 0, readFile = readBoundedPlanFile, stat = statSync, realpath = realpathSync } = {}) {
+	if (typeof input?.plan === "string") {
+		const text = scrub(input.plan);
+		const inline = planMarkdown(text);
+		if (inline !== void 0) return inline;
+		if (text.trim() !== "") {
+			onRejected("too-large");
+			return;
+		}
+	}
 	const requested = typeof input?.planFilePath === "string" ? input.planFilePath : "";
-	if (requested === "") return void 0;
-	if (![configDir, join(home, ".claude", "plans")].filter((root) => typeof root === "string" && root !== "").some((root) => pathInside(root, requested, realpath))) return void 0;
-	let file;
+	if (!pathInside(planDirectory, requested, realpath)) return void 0;
 	try {
-		file = realpath(requested);
+		const file = realpath(requested);
+		if (!file.toLowerCase().endsWith(".md")) return void 0;
 		const info = stat(file);
-		if (!info.isFile() || info.size > PLAN_FILE_MAX_BYTES || info.mtimeMs < startedAt - PLAN_FILE_CLOCK_SKEW_MS) return void 0;
-	} catch {
+		if (!info.isFile()) return void 0;
+		if (info.size > PLAN_FILE_MAX_BYTES) {
+			onRejected("too-large");
+			return;
+		}
+		const text = readFile(file, info);
+		if (typeof text !== "string") return void 0;
+		const safe = scrub(text);
+		const plan = planMarkdown(safe);
+		if (plan === void 0 && safe.trim() !== "") onRejected("too-large");
+		return plan;
+	} catch (error) {
+		if (error?.code === "CLAUDE_PLAN_TOO_LARGE") onRejected("too-large");
 		return;
 	}
-	if (!file.toLowerCase().endsWith(".md")) return void 0;
+}
+/**
+* A file-only completion from the CLI is accepted only from this run's new
+* private plans directory. There is no shared-directory/mtime fallback. If
+* more than one eligible file exists, do not guess which session submitted it.
+* @param options - the bound private plan directory, redactor, and filesystem seams.
+* @returns plan markdown, or undefined when absent or ambiguous.
+*/
+function findPlanWrittenDuringRun({ planDirectory, scrub = (value) => value, onRejected = () => void 0, readdir = readdirSync, readFile = readBoundedPlanFile, stat = statSync, realpath = realpathSync } = {}) {
+	if (typeof planDirectory !== "string" || !isAbsolute(planDirectory)) return void 0;
+	let names;
 	try {
-		return planMarkdown(readFile(file));
+		names = readdir(planDirectory);
 	} catch {
 		return;
 	}
+	let found;
+	for (const name of names) {
+		if (typeof name !== "string" || !name.toLowerCase().endsWith(".md")) continue;
+		const candidate = join(planDirectory, name);
+		if (dirname(candidate) !== planDirectory) continue;
+		const text = readSubmittedPlan({ planFilePath: candidate }, {
+			planDirectory,
+			scrub,
+			onRejected,
+			readFile,
+			stat,
+			realpath
+		});
+		if (text === void 0) continue;
+		if (found !== void 0) return void 0;
+		found = text;
+	}
+	return found;
 }
 /**
 * Build what the CLI reads from stdin for one run.
@@ -2534,6 +2760,22 @@ function toolResultText(content) {
 	return content.map((part) => part?.type === "text" && typeof part.text === "string" ? part.text : "").join(" ");
 }
 /**
+* Native plan/permission gates sometimes produce no control_request at all.
+* Recognize their specific messages, never generic is_error, ENOENT, EACCES,
+* a failed search, or a command's nonzero exit. An associated assistant tool
+* use is required, so arbitrary user text cannot spend the denial budget.
+*/
+function nativePermissionDenial(name, text) {
+	if (typeof name !== "string") return false;
+	if ([
+		"Write",
+		"Edit",
+		"NotebookEdit"
+	].includes(name) && /^Cannot (?:write to|edit|modify) [\s\S]+ while in plan mode\.(?:\s|$)/u.test(text)) return true;
+	if (["Bash", "PowerShell"].includes(name) && text.startsWith("Auto mode could not evaluate this action and is blocking it for safety")) return true;
+	return text.startsWith(PLAN_ACTION_DENY) || text.startsWith(PLAN_EXIT_DENY) || /^Permission to use [^\n]+ (?:has been|was) denied\b/u.test(text) || /^Claude requested permissions to use [^\n]+, but you haven['’]t granted it yet\b/u.test(text) || /^The user doesn['’]t want to proceed with this tool use\b/u.test(text);
+}
+/**
 * Read one `--output-format stream-json` line.
 *
 * The CLI prints both partial deltas (`stream_event`) and each finished
@@ -2656,7 +2898,7 @@ function describeRunKey(credential) {
 *   seams.
 * @returns `{ run(options), stream(options) }`.
 */
-function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_CLAUDE_CONFIG_DIR, resolveCredential, spawnImpl = spawn, timeoutMs = DEFAULT_CLAUDE_TIMEOUT_MS, startupTimeoutMs = DEFAULT_CLAUDE_STARTUP_TIMEOUT_MS, platform = process.platform, createSearchBridge } = {}) {
+function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_CLAUDE_CONFIG_DIR, resolveCredential, spawnImpl = spawn, timeoutMs = DEFAULT_CLAUDE_TIMEOUT_MS, startupTimeoutMs = DEFAULT_CLAUDE_STARTUP_TIMEOUT_MS, platform = process.platform, createSearchBridge, planFs = PLAN_FS } = {}) {
 	if (typeof resolveCredential !== "function") throw new Error("the Claude Code CLI runner needs resolveCredential");
 	const owners = /* @__PURE__ */ new Set();
 	let disposed = false;
@@ -2689,8 +2931,8 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 			settled: false,
 			denies: 0
 		};
-		const startedAt = Date.now();
 		let child;
+		let plans;
 		let bridge;
 		let bridgeClosing;
 		let pendingBridge;
@@ -2743,13 +2985,18 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 					owners.delete(owner);
 					done();
 				});
+				plans?.close();
 				return;
 			}
 			try {
 				await closeBridge();
 			} finally {
-				owners.delete(owner);
-				done();
+				try {
+					plans?.close();
+				} finally {
+					owners.delete(owner);
+					done();
+				}
 			}
 		};
 		const checkAborted = () => {
@@ -2766,6 +3013,10 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 			}
 		};
 		try {
+			if (mode === "plan") {
+				plans = createOwnedPlanDirectory(planFs, cwd);
+				state.planDirectory = plans.directory;
+			}
 			const credential = await setup(resolveCredential({
 				model,
 				signal: runSignal
@@ -2800,7 +3051,8 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 				stream,
 				appendSystemPrompt,
 				searchBridge: bridge,
-				disableNativeSearch: typeof createSearchBridge === "function"
+				disableNativeSearch: typeof createSearchBridge === "function",
+				planDirectory: plans?.directory
 			});
 			child = spawnImpl(command.command, [...command.args, ...args], {
 				cwd,
@@ -2831,17 +3083,26 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 			child.stderr?.setEncoding?.("utf8");
 			let controlBuffer = "";
 			let stdinEnded = false;
+			const onStdinError = () => {
+				if (state.settled || runSignal.aborted || typeof state.plan === "string") return;
+				state.stdinFailed = true;
+				kill();
+			};
 			const endStdin = () => {
 				if (stdinEnded) return;
 				stdinEnded = true;
 				try {
 					child.stdin?.end?.();
-				} catch {}
+				} catch {
+					onStdinError();
+				}
 			};
 			const writeStdin = (frame) => {
 				try {
 					child.stdin?.write?.(frame);
-				} catch {}
+				} catch {
+					onStdinError();
+				}
 			};
 			const controlResponse = (requestId, response) => {
 				writeStdin(`${JSON.stringify({
@@ -2858,12 +3119,22 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 				endStdin();
 				kill();
 			};
-			const refuseControl = (requestId, kind) => {
-				state.denies += 1;
+			const toolUses = /* @__PURE__ */ new Map();
+			const deniedTools = /* @__PURE__ */ new Set();
+			const deniedRequests = /* @__PURE__ */ new Set();
+			const countDenial = (requestId, toolId) => {
+				const duplicate = requestId !== void 0 && deniedRequests.has(requestId) || toolId !== void 0 && deniedTools.has(toolId);
+				if (requestId !== void 0) deniedRequests.add(requestId);
+				if (toolId !== void 0) deniedTools.add(toolId);
+				if (!duplicate) state.denies += 1;
 				if (state.denies > MAX_PLAN_DENIALS) {
 					stopForDenials();
-					return;
+					return false;
 				}
+				return true;
+			};
+			const refuseControl = (requestId, kind, toolId) => {
+				if (!countDenial(requestId, toolId)) return;
 				if (kind === "dialog") {
 					writeStdin(`${JSON.stringify({
 						type: "control_response",
@@ -2882,10 +3153,12 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 			};
 			/**
 			* Plan mode keeps stdin open so a permission prompt can be answered.
-			* `ExitPlanMode` with a plan stops the child; it is never allowed,
-			* because allowing it would make the CLI start editing in this process.
+			* ExitPlanMode is never allowed: stop with the submitted plan instead.
+			* Native hard denials share the same budget, keyed by tool_use_id so the
+			* tool_result following a control denial cannot charge it a second time.
 			*/
 			const handlePlanLine = (line) => {
+				if (state.denyExhausted === true || typeof state.plan === "string") return;
 				const trimmed = line.trim();
 				if (!trimmed.startsWith("{")) return;
 				let message;
@@ -2895,44 +3168,64 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 					return;
 				}
 				if (message?.type === "result") {
+					state.resultError = message.is_error === true;
 					endStdin();
 					return;
 				}
+				if (state.resultError !== void 0) return;
+				if (message?.type === "assistant") {
+					for (const block of Array.isArray(message.message?.content) ? message.message.content : []) {
+						if (block?.type !== "tool_use" || typeof block.id !== "string") continue;
+						toolUses.set(block.id, {
+							name: block.name,
+							input: block.input
+						});
+						if (toolUses.size > 512) toolUses.delete(toolUses.keys().next().value);
+					}
+					return;
+				}
+				if (message?.type === "user") {
+					for (const block of Array.isArray(message.message?.content) ? message.message.content : []) {
+						if (block?.type !== "tool_result" || block.is_error !== true || typeof block.tool_use_id !== "string") continue;
+						if (nativePermissionDenial(toolUses.get(block.tool_use_id)?.name, toolResultText(block.content).trim()) && !countDenial(void 0, block.tool_use_id)) return;
+					}
+					return;
+				}
 				if (message?.type !== "control_request") return;
 				const requestId = message.request_id;
 				const request = message.request;
 				if (typeof requestId !== "string" || request === null || typeof request !== "object") {
-					state.denies += 1;
-					if (state.denies > MAX_PLAN_DENIALS) stopForDenials();
+					countDenial(typeof requestId === "string" ? requestId : void 0, void 0);
 					return;
 				}
+				const toolId = typeof request.tool_use_id === "string" ? request.tool_use_id : [...toolUses].reverse().find(([, tool]) => tool.name === request.tool_name && JSON.stringify(tool.input) === JSON.stringify(request.input))?.[0];
 				if (request.subtype !== "can_use_tool") {
-					refuseControl(requestId, "dialog");
+					refuseControl(requestId, "dialog", toolId);
 					return;
 				}
 				if (request.tool_name === "ExitPlanMode") {
-					const plan = readSubmittedPlan(request.input, {
-						configDir,
-						startedAt
-					});
+					let tooLarge = false;
+					const plan = typeof request.input?.plan === "string" || plans?.isOwned() ? readSubmittedPlan(request.input, {
+						planDirectory: plans?.directory,
+						scrub,
+						onRejected: (reason) => {
+							tooLarge = reason === "too-large";
+						}
+					}) : void 0;
 					if (plan !== void 0) {
-						state.plan = scrub(plan);
+						state.plan = plan;
 						endStdin();
 						kill();
 						return;
 					}
-					state.denies += 1;
-					if (state.denies > MAX_PLAN_DENIALS) {
-						stopForDenials();
-						return;
-					}
+					if (!countDenial(requestId, toolId)) return;
 					controlResponse(requestId, {
 						behavior: "deny",
-						message: PLAN_EXIT_DENY
+						message: tooLarge ? PLAN_TOO_LARGE_DENY : PLAN_EXIT_DENY
 					});
 					return;
 				}
-				refuseControl(requestId, "tool");
+				refuseControl(requestId, "tool", toolId);
 			};
 			child.stdout?.on("data", (chunk) => {
 				state.sawOutput = true;
@@ -2962,18 +3255,32 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 				child.on("close", (code, killSignal) => {
 					if (state.settled) return;
 					state.settled = true;
+					if (mode === "plan" && controlBuffer.trim() !== "") handlePlanLine(controlBuffer);
 					if (state.timedOut) return reject(/* @__PURE__ */ new Error(`claude_code timed out after ${Math.round(timeoutMs / 1e3)}s`));
 					if (state.silent) {
 						const detail = state.stderr.trim().split("\n").slice(-4).join(" ").slice(0, 400);
 						return reject(/* @__PURE__ */ new Error(`Claude Code CLI printed nothing within ${Math.round(startupTimeoutMs / 1e3)}s of starting and was stopped${detail === "" ? "" : `: ${detail}`}`));
 					}
 					if (signal?.aborted) return reject(/* @__PURE__ */ new Error("claude_code was aborted"));
+					if (state.stdinFailed === true) return reject(/* @__PURE__ */ new Error("claude_code could not write to CLI input"));
 					if (state.denyExhausted === true) return reject(/* @__PURE__ */ new Error(PLAN_DENY_LIMIT_MESSAGE));
 					if (typeof state.plan === "string") return resolve({
 						code,
 						killSignal
 					});
 					if (runSignal.aborted) return reject(/* @__PURE__ */ new Error("claude_code was aborted"));
+					if (mode === "plan" && code === 0 && state.resultError === false && plans?.isOwned()) {
+						let tooLarge = false;
+						const written = findPlanWrittenDuringRun({
+							planDirectory: plans.directory,
+							scrub,
+							onRejected: (reason) => {
+								tooLarge ||= reason === "too-large";
+							}
+						});
+						if (tooLarge) return reject(/* @__PURE__ */ new Error(PLAN_TOO_LARGE_DENY));
+						if (written !== void 0) state.plan = written;
+					}
 					resolve({
 						code,
 						killSignal
@@ -2987,7 +3294,7 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 				throw error;
 			});
 			closed.catch(() => void 0);
-			child.stdin?.on?.("error", () => void 0);
+			child.stdin?.on?.("error", onStdinError);
 			if (mode === "plan") writeStdin(input);
 			else child.stdin?.end?.(input);
 			if (runSignal.aborted) kill();
@@ -3167,6 +3474,10 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 					yield* drain();
 				}
 				await completion;
+				if (buffer.trim().startsWith("{")) try {
+					const event = readClaudeStreamEvents(JSON.parse(scrub(buffer.trim()))).find((item) => item.type === "result");
+					if (event !== void 0) sawResult = event.result;
+				} catch {}
 				if (typeof state.plan === "string") {
 					if (deltaKind !== void 0) {
 						const tail = deltaRedactor.flush({ boundary: true });
@@ -3196,10 +3507,6 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 					};
 					return;
 				}
-				if (buffer.trim().startsWith("{")) try {
-					const event = readClaudeStreamEvents(JSON.parse(scrub(buffer.trim()))).find((item) => item.type === "result");
-					if (event !== void 0) sawResult = event.result;
-				} catch {}
 				if (sawResult === void 0) throw new Error(failureMessage(void 0, void 0, state.stderr));
 				if (sawResult.is_error === true || exitStatus?.code !== 0) throw new Error(failureMessage(sawResult, exitStatus?.code ?? exitStatus?.killSignal, state.stderr));
 				const usage = sawResult.usage ?? {};
@@ -3219,7 +3526,11 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 				};
 			} finally {
 				stopIfAbandoned();
-				await closeBridge();
+				try {
+					await closed.catch(() => void 0);
+				} finally {
+					await closeBridge();
+				}
 			}
 		},
 		/** Revoke bridges and stop every invocation when the plugin unloads. */
@@ -4031,13 +4342,15 @@ function claudeModeFor(sandbox, approval) {
 	}
 }
 /**
-* Whether this session should run the CLI in plan mode.
+* Whether a prepared model request should run the CLI in plan mode.
 *
-* The model request runs inside `agent/pre-step`, before the plan-mode service
-* appends `plan/mode`. `pending` is that not-yet-logged selection and wins over
-* the logged `active` bit, matching the `plan:policy` section. Without the
-* service, the logged projection is the only signal. A missing session, a
-* missing service, or a throw means plan mode is off — never a failed turn.
+* This selection is for request preparation only, not an executing tool batch.
+* `pending` is the selection used for the proposed request assembly and wins
+* over logged `active`, matching `plan:policy`. An accepted pre-step commits
+* it; reading after that boundary sees the same selection as logged `active`.
+* Without the service, the logged projection is the only signal. A missing
+* session, a missing service, or a throw means plan mode is off — never a
+* failed turn.
 * @param ctx - the plugin context; services are read without an inject requirement.
 * @param session - the session whose plan state is read.
 * @returns true when the CLI must plan instead of acting.
@@ -4055,7 +4368,30 @@ function planModeForSession(ctx, session) {
 		return false;
 	}
 }
-/** `pending` is the selection the in-flight request was assembled with. */
+/**
+* Whether a tool in the current batch must plan, using logged active state.
+*
+* Approval queues `pending: false`; it does not authorize remaining tools in
+* that batch to implement. Likewise, pending entry must not change a tool's
+* current mode before the next accepted pre-step commits it.
+* @param ctx - the plugin context.
+* @param session - the executing tool's session.
+* @param agent - the trusted executing agent, when provided by the tool runtime.
+*/
+function planModeForToolExecution(ctx, session, agent) {
+	if (session === void 0 || session === null) return false;
+	try {
+		const caller = agent ?? ctx.get?.("agents")?.currentInitiator?.();
+		if (caller?.session === session) {
+			const state = ctx.get?.("planMode")?.get?.(caller);
+			if (state !== void 0 && state !== null) return state.active === true;
+		}
+		return ctx.get?.("sessionProjections")?.stateOf?.(session, "plan")?.active === true;
+	} catch {
+		return false;
+	}
+}
+/** `pending` is the selection the proposed request was assembled with. */
 function planSelected(state) {
 	if (typeof state?.pending === "boolean") return state.pending;
 	return state?.active === true;
@@ -4108,7 +4444,8 @@ const CLAUDE_TOOL_INSTRUCTIONS = "This task was delegated to Claude Code by anot
 const CLAUDE_TOOL_PLAN_INSTRUCTIONS = "This task was delegated to Claude Code while DeepSeek Harness is in plan mode. Explore read-only, write a complete markdown plan that starts with a # heading to the CLI plan file, then call ExitPlanMode. Do not edit the project or start implementing. Reply with the plan text only.";
 /**
 * @param options - the CLI runner, the most a run may do for a session, and
-*   whether that session is in DSH plan mode.
+*   whether the executing batch's logged state is DSH plan mode (not a
+*   pending selection for the next model request).
 * @returns the tool definition to register.
 */
 function createClaudeCodeTool({ runner, modeCeiling, planActive }) {
@@ -4172,7 +4509,7 @@ function createClaudeCodeTool({ runner, modeCeiling, planActive }) {
 			const requested = typeof args.cwd === "string" ? args.cwd.trim() : "";
 			const cwd = requested === "" ? sessionCwd : isAbsolute(requested) ? requested : sessionCwd === void 0 ? requested : join(sessionCwd, requested);
 			const session = exec?.agent?.session;
-			const planning = planActive?.(session) === true;
+			const planning = planActive?.(session, exec?.agent) === true;
 			return await runner.run({
 				prompt: args.prompt,
 				mode: planning ? "plan" : capClaudeMode(args.mode, modeCeiling(session)) ?? "edit",
@@ -6478,9 +6815,9 @@ function apply(ctx, config) {
 		ctx.effect(() => toolsCtx.tools.register(createClaudeCodeTool({
 			runner: claudeRunner,
 			modeCeiling: cliModeCeiling,
-			planActive: (session) => planModeForSession(ctx, session)
+			planActive: (session, agent) => planModeForToolExecution(ctx, session, agent)
 		})), "packycode-api: claude_code tool");
 	});
 }
 //#endregion
-export { AUTO_CLAUDE_MODE, CHANNEL, CLAUDE_CLI_MODES, CLAUDE_INSTALL_COMMAND, CLAUDE_MISSING_MESSAGE, CLAUDE_NPM_PACKAGE, CLAUDE_TOOL_INSTRUCTIONS, CLI_BACKED_MODEL_IDS, CLI_IMAGE_LIMITS, Config, DEFAULT_API_HOST, DEFAULT_APPEND_SYSTEM_PROMPT, DEFAULT_SEARCH_BACKEND, DEFAULT_STATUS_HOST, DISPLAY_NAME, LEGACY_STATUS_HOSTS, PACKYCODE_AUTO_SEARCH_PROVIDER_ID, PACKYCODE_MODELS, PACKYCODE_MODEL_IDS, PACKYCODE_SEARCH_PROVIDER_ID, PLUGIN_ID, PROVIDER, PackyCodeKeyRing, SEARCH_BACKENDS, SEARCH_BACKEND_MODELS, SEARCH_MODES, SETTINGS_NAMESPACE, TITLE_MODEL_ID, TITLE_MODEL_ROUTES, accountHostOrder, apply, assertApiKey, buildClaudeArgs, buildClaudeEnvironment, buildClaudeInput, buildDelegatedContent, buildSearchRequest, capClaudeMode, catalogCoverage, classifyClientPolicy, classifyGatewayFailure, claudeBinaryCandidates, claudeModeFor, claudeModeForSession, cliSearchInstructions, createBalanceReader, createClaudeCliAdapter, createClaudeCliManager, createClaudeCodeTool, createClaudeRunner, createClaudeSearchBridge, createGroupReader, createKeyChooser, createPackyCodeAutoSearchProvider, createPackyCodeProfile, createPackyCodeProvider, createPackyCodeRpc, createPackyCodeSearchProvider, createProfileSearchComposition, createRouteAdapter, createSearchComposition, createSearchController, delegationInstructions, describeRunKey, explainCliClientPolicyFailure, explainCliGroupFailure, explainClientPolicyFailure, explainNpmFailure, findClaudeBinary, guardKeyRotation, inject, keyNote, locateClaudeBinary, locateNpm, name, normalizeFailureMessage, normalizeHost, npmCandidates, parseBillingSubscription, parseBillingUsage, parseClaudeResult, parseClaudeVersion, parseMessagesSearchResponse, parsePricing, parseResponsesSearchResponse, parseSelectedGroups, parseTokenUsage, pickKeyForModel, planModeForSession, readClaudeStreamEvents, readSearchChoice, renderAuxiliaryPrompt, renderDelegatedPrompt, resolveSpawnCommand, statusHostOrder, summarizeToolUse };
+export { AUTO_CLAUDE_MODE, CHANNEL, CLAUDE_CLI_MODES, CLAUDE_INSTALL_COMMAND, CLAUDE_MISSING_MESSAGE, CLAUDE_NPM_PACKAGE, CLAUDE_TOOL_INSTRUCTIONS, CLI_BACKED_MODEL_IDS, CLI_IMAGE_LIMITS, Config, DEFAULT_API_HOST, DEFAULT_APPEND_SYSTEM_PROMPT, DEFAULT_SEARCH_BACKEND, DEFAULT_STATUS_HOST, DISPLAY_NAME, LEGACY_STATUS_HOSTS, PACKYCODE_AUTO_SEARCH_PROVIDER_ID, PACKYCODE_MODELS, PACKYCODE_MODEL_IDS, PACKYCODE_SEARCH_PROVIDER_ID, PLUGIN_ID, PROVIDER, PackyCodeKeyRing, SEARCH_BACKENDS, SEARCH_BACKEND_MODELS, SEARCH_MODES, SETTINGS_NAMESPACE, TITLE_MODEL_ID, TITLE_MODEL_ROUTES, accountHostOrder, apply, assertApiKey, buildClaudeArgs, buildClaudeEnvironment, buildClaudeInput, buildDelegatedContent, buildSearchRequest, capClaudeMode, catalogCoverage, classifyClientPolicy, classifyGatewayFailure, claudeBinaryCandidates, claudeModeFor, claudeModeForSession, cliSearchInstructions, createBalanceReader, createClaudeCliAdapter, createClaudeCliManager, createClaudeCodeTool, createClaudeRunner, createClaudeSearchBridge, createGroupReader, createKeyChooser, createPackyCodeAutoSearchProvider, createPackyCodeProfile, createPackyCodeProvider, createPackyCodeRpc, createPackyCodeSearchProvider, createProfileSearchComposition, createRouteAdapter, createSearchComposition, createSearchController, delegationInstructions, describeRunKey, explainCliClientPolicyFailure, explainCliGroupFailure, explainClientPolicyFailure, explainNpmFailure, findClaudeBinary, guardKeyRotation, inject, keyNote, locateClaudeBinary, locateNpm, name, normalizeFailureMessage, normalizeHost, npmCandidates, parseBillingSubscription, parseBillingUsage, parseClaudeResult, parseClaudeVersion, parseMessagesSearchResponse, parsePricing, parseResponsesSearchResponse, parseSelectedGroups, parseTokenUsage, pickKeyForModel, planModeForSession, planModeForToolExecution, readClaudeStreamEvents, readSearchChoice, renderAuxiliaryPrompt, renderDelegatedPrompt, resolveSpawnCommand, statusHostOrder, summarizeToolUse };

package/package.json

@@ -1,7 +1,6 @@
 {
   "name": "dsh-packycode-api",
-  "version": "1.1.2",
-  "packageManager": "pnpm@10.32.1",
+  "version": "1.1.4",
   "description": "Use a PackyCode (PackyAPI) API key in DeepSeek Harness through a built-in multi-protocol model route with key rotation and balance display",
   "type": "module",
   "main": "./lib/index.js",
@@ -40,11 +39,6 @@
       "platform": "web"
     }
   },
-  "scripts": {
-    "build": "tsdown --config tsdown.config.mjs",
-    "test": "node --test tests/*.test.mjs",
-    "check": "pnpm run test && pnpm run build && pnpm pack --pack-destination .artifacts"
-  },
   "keywords": [
     "dsh-plugin",
     "deepseek-harness",
@@ -97,5 +91,10 @@
     "@earendil-works/pi-ai": "0.85.1",
     "react": "18.3.1",
     "tsdown": "0.22.2"
+  },
+  "scripts": {
+    "build": "tsdown --config tsdown.config.mjs",
+    "test": "node --test tests/*.test.mjs",
+    "check": "pnpm run test && pnpm run build && pnpm pack --pack-destination .artifacts"
   }
-}
+}