dsh-packycode-api 1.1.3 → 1.1.5

package/lib/index.js

@@ -1,10 +1,10 @@
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { homedir, tmpdir } from "node:os";
-import { isAbsolute, join, posix, sep, win32 } from "node:path";
+import { dirname, isAbsolute, join, posix, resolve, sep, win32 } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { HarnessError, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { spawn } from "node:child_process";
-import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs";
 import { mkdtemp, readFile, readdir, realpath, rename, rm, writeFile } from "node:fs/promises";
 import { createServer } from "node:http";
 import { defineTool } from "@deepseek-ai/dsh-tools";
@@ -544,7 +544,8 @@ function createBalanceReader({ listKeys, getHosts, fetchImpl = ambientFetch, now
 * model does not support is refused before the request is sent: Claude Opus
 * 5.5 (platform.claude.com effort docs), GPT-6.1 Sol and GPT-6 Astra
 * `reasoning.effort` (developers.openai.com model pages), DeepSeek thinking
-* mode (`thinking` toggle plus `low|high|max` effort).
+* mode (`thinking` toggle plus `low|high|max` effort), and Grok 4.7
+* (docs.x.ai/developers/grok-4-7).
 *
 * @module dsh-packycode-api/catalog
 */
@@ -586,6 +587,11 @@ const ALWAYS_THINKING_LEVELS = Object.freeze({
 	xhigh: "xhigh",
 	max: "max"
 });
+/** Grok 4.7 supports low | medium | high | xhigh, with no off or max. */
+const GROK_LEVELS = Object.freeze({
+	...ALWAYS_THINKING_LEVELS,
+	max: null
+});
 const PACKYCODE_MODELS = Object.freeze([
 	Object.freeze({
 		id: "deepseek-flash",
@@ -632,6 +638,20 @@ const PACKYCODE_MODELS = Object.freeze([
 		maxTokens: 128e3,
 		thinkingLevelMap: ALWAYS_THINKING_LEVELS
 	}),
+	Object.freeze({
+		id: "grok-4.7",
+		name: "Grok 4.7",
+		api: "openai-responses",
+		provider: PROVIDER,
+		baseUrl: RESPONSES_BASE,
+		reasoning: true,
+		input: Object.freeze(["text", "image"]),
+		cost: NO_COST,
+		contextWindow: 5e5,
+		maxTokens: 5e5,
+		thinkingLevelMap: GROK_LEVELS,
+		compat: Object.freeze({ supportsLongCacheRetention: false })
+	}),
 	Object.freeze({
 		id: "claude-opus-5-5",
 		name: "Claude Opus 5.5",
@@ -1275,12 +1295,104 @@ function hostPath(lookup) {
 		return;
 	}
 }
+/** The only PTC program this adapter emits; its JSON literal also works in Python. */
+const PLAN_REVIEW_PROGRAM_PREFIX = "return await tools.exit_plan_mode(";
+/** Parse durable arguments without evaluating model-authored code. */
+function parsedArguments(value) {
+	try {
+		return typeof value === "string" ? JSON.parse(value) : value;
+	} catch {
+		return;
+	}
+}
+/**
+* Recover only the public plan, never arbitrary tool arguments or PTC code.
+* The PTC allowlist is deliberately the exact, single-call program we emit.
+*/
+function planOfCall(block) {
+	if (block?.type !== "tool-call") return void 0;
+	const args = parsedArguments(block.arguments);
+	let plan;
+	if (block.name === "exit_plan_mode") plan = args?.plan;
+	else if (block.name === "run_code" && typeof args?.code === "string") {
+		const code = args.code;
+		if (!code.startsWith(PLAN_REVIEW_PROGRAM_PREFIX) || !code.endsWith(")")) return void 0;
+		const review = parsedArguments(code.slice(34, -1));
+		if (review === null || typeof review !== "object" || Object.keys(review).length !== 1) return void 0;
+		plan = review.plan;
+	}
+	return typeof plan === "string" && plan.trim() !== "" ? plan : void 0;
+}
+/** Keep the latest complete plan and its review from the persisted model transcript. */
+function planReviewContext(messages) {
+	let latest;
+	for (const message of messages) {
+		if (message?.role !== "assistant") continue;
+		for (const block of Array.isArray(message.content) ? message.content : []) {
+			const plan = planOfCall(block);
+			if (plan !== void 0) latest = {
+				plan,
+				id: block.id
+			};
+		}
+	}
+	if (latest === void 0) return void 0;
+	let review;
+	for (const message of messages) {
+		if (message?.role !== "user") continue;
+		for (const block of Array.isArray(message.content) ? message.content : []) {
+			if (block?.type !== "tool-result" || latest.id === void 0 || block.toolCallId !== latest.id) continue;
+			const text = typeof block.content === "string" ? block.content : (Array.isArray(block.content) ? block.content : []).filter((part) => part?.type === "text" && typeof part.text === "string").map((part) => part.text).join("\n");
+			review = `[计划审阅${block.isError === true ? "未批准/失败" : "结果"}]\n${text}`;
+		}
+	}
+	return {
+		id: latest.id,
+		turn: {
+			label: "计划审阅上下文",
+			parts: [{
+				kind: "text",
+				text: `[最近提交的完整计划；提交本身不代表已批准]\n${latest.plan}\n\n${review ?? "[尚无计划审阅结果；不要把提交视为实施许可]"}`
+			}]
+		}
+	};
+}
+/**
+* Select the review transport from this request's actual direct-tool catalog.
+* `run_code` binds `tools` in both supported host language flavors.
+*/
+function planReviewCall(options, plan) {
+	if (plan.trim() === "") throw new Error("Claude Code submitted an empty plan; no review or implementation was authorized.");
+	const context = planReviewContext([{
+		role: "assistant",
+		content: [{
+			type: "tool-call",
+			name: "exit_plan_mode",
+			arguments: { plan }
+		}]
+	}]).turn;
+	if (textLength(context.parts) + context.label.length + 3 >= MAX_PROMPT_CHARS$1) throw new Error("The submitted plan exceeds the CLI delegation budget (48,000 characters). Shorten or split it before review; no plan constraints were truncated and no implementation was authorized.");
+	const tools = Array.isArray(options?.tools) ? options.tools : [];
+	if (tools.some((tool) => tool?.name === "exit_plan_mode")) return {
+		name: "exit_plan_mode",
+		args: JSON.stringify({ plan })
+	};
+	if (tools.some((tool) => tool?.name === "run_code")) return {
+		name: "run_code",
+		args: JSON.stringify({
+			code: `${PLAN_REVIEW_PROGRAM_PREFIX}${JSON.stringify({ plan })})`,
+			description: "Present completed plan for user review"
+		})
+	};
+	throw new Error("Claude Code submitted a plan, but this request has neither exit_plan_mode nor run_code available for host review; no implementation was authorized.");
+}
 /**
 * Flatten one message's content into ordered parts: text, image, and file.
 * Tool calls and results become short text so a turn that started on another
-* model still reads coherently; reasoning is not carried.
+* model still reads coherently; reasoning is not carried. The latest review
+* result is carried in full separately, not through the general 8k tool cap.
 */
-function collectParts(blocks, parts) {
+function collectParts(blocks, parts, reviewId) {
 	for (const block of Array.isArray(blocks) ? blocks : []) {
 		if (block === null || typeof block !== "object") continue;
 		switch (block.type) {
@@ -1314,6 +1426,7 @@ function collectParts(blocks, parts) {
 				});
 				break;
 			case "tool-result": {
+				if (reviewId !== void 0 && block.toolCallId === reviewId) break;
 				if (typeof block.content === "string") {
 					parts.push({
 						kind: "text",
@@ -1355,10 +1468,12 @@ const textLength = (parts) => parts.reduce((sum, part) => sum + (part.kind === "
 */
 function delegatedTurns(options) {
 	const messages = Array.isArray(options?.messages) ? options.messages : [];
+	const review = planReviewContext(messages);
+	const reserved = review === void 0 ? 0 : textLength(review.turn.parts) + review.turn.label.length + 3;
 	const turns = [];
 	for (const message of messages) {
 		if (message === null || typeof message !== "object" || message.role === "system") continue;
-		const parts = collectParts(message.content, []);
+		const parts = collectParts(message.content, [], review?.id);
 		if (parts.length === 0 || textLength(parts) === 0 && !parts.some((part) => part.kind !== "text")) continue;
 		const label = message.role === "user" ? "用户" : message.role === "assistant" ? "助手" : String(message.role);
 		turns.push({
@@ -1366,8 +1481,11 @@ function delegatedTurns(options) {
 			parts
 		});
 	}
+	const newest = turns.at(-1);
+	const newestSize = newest === void 0 ? 0 : textLength(newest.parts) + newest.label.length + 3;
+	if (review !== void 0 && reserved + newestSize > MAX_PROMPT_CHARS$1) throw new Error("The complete plan, its review, and the latest request exceed the CLI delegation budget (48,000 characters). Shorten or split the plan/request before continuing; plan constraints were not truncated.");
 	const kept = [];
-	let used = 0;
+	let used = reserved;
 	for (let index = turns.length - 1; index >= 0; index -= 1) {
 		const turn = turns[index];
 		const size = textLength(turn.parts) + turn.label.length + 3;
@@ -1383,9 +1501,11 @@ function delegatedTurns(options) {
 		});
 		break;
 	}
+	const truncated = kept.length < turns.length || kept[0]?.clipped === true;
+	if (review !== void 0) kept.unshift(review.turn);
 	return {
 		turns: kept,
-		truncated: kept.length < turns.length || kept[0]?.clipped === true
+		truncated
 	};
 }
 /** Keep the last `budget` characters of a turn's text, and every part after them. */
@@ -1898,7 +2018,8 @@ function createClaudeCliAdapter({ inner, runner, modelIds = CLI_BACKED_MODEL_IDS
 				default: break;
 			}
 			if (submittedPlan !== void 0) {
-				yield* blocks.toolCall(`plan-${randomUUID()}`, "exit_plan_mode", JSON.stringify({ plan: submittedPlan }));
+				const review = planReviewCall(options, submittedPlan);
+				yield* blocks.toolCall(`plan-${randomUUID()}`, review.name, review.args);
 				yield {
 					type: "usage",
 					usage: turnUsage(lastRequest, finished)
@@ -2304,10 +2425,11 @@ function resolveSpawnCommand(binary, { platform = process.platform, exists = exi
 *   consumes the streaming protocol, and instructions appended to the CLI's
 *   own system prompt ({@link DEFAULT_APPEND_SYSTEM_PROMPT} when blank). The
 *   CLI's system prompt and tool set are never replaced: they are part of
-*   what the official client sends.
+*   what the official client sends. Plan runs supply an absolute private
+*   planDirectory below the child's working directory.
 * @returns argv after the binary name.
 */
-function buildClaudeArgs({ mode = DEFAULT_CLAUDE_MODE, model, stream = false, appendSystemPrompt, searchBridge, disableNativeSearch = false } = {}) {
+function buildClaudeArgs({ mode = DEFAULT_CLAUDE_MODE, model, stream = false, appendSystemPrompt, searchBridge, disableNativeSearch = false, planDirectory } = {}) {
 	const spec = CLAUDE_CLI_MODES[mode];
 	if (spec === void 0) throw new Error(`claude_code mode must be one of ${Object.keys(CLAUDE_CLI_MODES).join(", ")}`);
 	const args = stream ? [
@@ -2334,16 +2456,31 @@ function buildClaudeArgs({ mode = DEFAULT_CLAUDE_MODE, model, stream = false, ap
 		args.push("--permission-mode", spec.permissionMode);
 		if (searchBridge !== void 0) args.push("--allowedTools", searchBridge.toolName);
 	} else args.push("--allowedTools", ...spec.allowedTools, ...searchBridge === void 0 ? [] : [searchBridge.toolName]);
+	if (mode === "plan") {
+		args.push("--permission-prompt-tool", "stdio");
+		if (planDirectory !== void 0 && (typeof planDirectory !== "string" || !isAbsolute(planDirectory))) throw new Error("claude_code plan directory must be an absolute path");
+		args.push("--settings", JSON.stringify({
+			...planDirectory === void 0 ? {} : { plansDirectory: planDirectory },
+			permissions: { ask: ["ExitPlanMode"] }
+		}));
+	}
 	if (disableNativeSearch || searchBridge !== void 0) args.push("--disallowedTools", "WebSearch");
 	if (searchBridge !== void 0) args.push("--mcp-config", searchBridge.configPath);
 	return args;
 }
-/** How many permission prompts one plan-mode run will refuse before stopping. */
+/** How many permission denials one plan-mode run may recover from. */
 const MAX_PLAN_DENIALS = 8;
-/** A plan file larger than this is not read into the turn. */
+/** A plan file or submitted plan larger than this is not returned into the turn. */
 const PLAN_FILE_MAX_BYTES = 2e5;
-const PLAN_FILE_CLOCK_SKEW_MS = 2e3;
+const PLAN_DIRECTORY_PREFIX = ".dsh-packycode-plan-";
+const PLAN_FS = Object.freeze({
+	mkdtempSync,
+	realpathSync,
+	lstatSync,
+	rmSync
+});
 const PLAN_EXIT_DENY = "Write the plan to the plan file first, starting with a # heading, then call ExitPlanMode again.";
+const PLAN_TOO_LARGE_DENY = "The plan exceeds the 200000-byte review limit. Write a complete, shorter plan without dropping constraints, then call ExitPlanMode again.";
 const PLAN_ACTION_DENY = "Plan mode is active. Do not edit files or run commands that change the system. Continue read-only exploration, write the plan file, and call ExitPlanMode.";
 const PLAN_DIALOG_ERROR = "Plan mode cannot ask the user from the CLI. Decide and continue, or call ExitPlanMode.";
 const PLAN_DENY_LIMIT_MESSAGE = "claude_code plan mode stopped after too many denied permission prompts";
@@ -2357,11 +2494,58 @@ function planMarkdown(value) {
 	if (typeof value !== "string") return void 0;
 	const trimmed = value.trim();
 	if (trimmed === "") return void 0;
-	const bounded = trimmed.length > PLAN_FILE_MAX_BYTES ? trimmed.slice(0, PLAN_FILE_MAX_BYTES) : trimmed;
-	return /^#\s+\S/u.test(bounded) ? bounded : `# Plan\n\n${bounded}`;
+	const markdown = /^#\s+\S/u.test(trimmed) ? trimmed : `# Plan\n\n${trimmed}`;
+	return Buffer.byteLength(markdown) > PLAN_FILE_MAX_BYTES ? void 0 : markdown;
+}
+/** Own exactly one newly created, owner-only directory, never a shared CLI home. */
+function createOwnedPlanDirectory(fs, cwd) {
+	const parent = fs.realpathSync(cwd ?? process.cwd());
+	const directory = fs.mkdtempSync(join(parent, PLAN_DIRECTORY_PREFIX));
+	if (!isAbsolute(directory) || dirname(directory) !== parent || !directory.startsWith(join(parent, PLAN_DIRECTORY_PREFIX))) throw new Error("PackyCode plan directory ownership could not be established");
+	const identity = fs.lstatSync(directory);
+	if (!identity.isDirectory() || identity.isSymbolicLink()) throw new Error("PackyCode plan directory ownership could not be established");
+	const canonical = directory;
+	let removed = false;
+	const isOwned = () => {
+		try {
+			const current = fs.lstatSync(directory);
+			return current.isDirectory() && !current.isSymbolicLink() && current.dev === identity.dev && current.ino === identity.ino && fs.realpathSync(directory) === canonical;
+		} catch {
+			return false;
+		}
+	};
+	const owned = {
+		directory: canonical,
+		isOwned,
+		close() {
+			if (removed) return;
+			let current;
+			try {
+				current = fs.lstatSync(directory);
+			} catch (error) {
+				if (error?.code === "ENOENT") {
+					removed = true;
+					return;
+				}
+				throw error;
+			}
+			if (!current.isDirectory() || current.isSymbolicLink() || !isOwned()) throw new Error("PackyCode plan directory ownership changed; refusing to remove it");
+			fs.rmSync(canonical, {
+				recursive: true,
+				force: true
+			});
+			removed = true;
+		}
+	};
+	if (!isOwned()) {
+		owned.close();
+		throw new Error("PackyCode plan directory ownership could not be established");
+	}
+	return owned;
 }
-/** Whether `file` is the root itself or a path inside it, after resolving links. */
+/** Whether a file stays inside the immutable canonical directory bound to the run. */
 function pathInside(root, file, realpath) {
+	if (typeof root !== "string" || !isAbsolute(root) || typeof file !== "string" || !isAbsolute(file)) return false;
 	let rootReal;
 	let fileReal;
 	try {
@@ -2370,87 +2554,104 @@ function pathInside(root, file, realpath) {
 	} catch {
 		return false;
 	}
+	if (rootReal !== resolve(root)) return false;
 	const prefix = rootReal.endsWith(sep) ? rootReal : `${rootReal}${sep}`;
-	return fileReal === rootReal || fileReal.startsWith(prefix);
+	return fileReal.startsWith(prefix);
+}
+/** A descriptor-based bounded read also rejects a replaced leaf before reading it. */
+function readBoundedPlanFile(file, expected) {
+	const fd = openSync(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+	try {
+		const info = fstatSync(fd);
+		if (!info.isFile() || expected !== void 0 && (info.dev !== expected.dev || info.ino !== expected.ino)) return void 0;
+		if (info.size > PLAN_FILE_MAX_BYTES) throw Object.assign(/* @__PURE__ */ new Error(PLAN_TOO_LARGE_DENY), { code: "CLAUDE_PLAN_TOO_LARGE" });
+		const bytes = Buffer.allocUnsafe(200001);
+		let length = 0;
+		while (length < bytes.length) {
+			const count = readSync(fd, bytes, length, bytes.length - length, null);
+			if (count === 0) break;
+			length += count;
+		}
+		if (length > PLAN_FILE_MAX_BYTES) throw Object.assign(/* @__PURE__ */ new Error(PLAN_TOO_LARGE_DENY), { code: "CLAUDE_PLAN_TOO_LARGE" });
+		return bytes.subarray(0, length).toString("utf8");
+	} finally {
+		closeSync(fd);
+	}
 }
 /**
-* The plan a CLI `ExitPlanMode` request is submitting.
-*
-* The tool's own schema does not carry the plan; the CLI injects `plan` and
-* `planFilePath` from the file it told the model to write. Text on the request
-* wins. A path is read only when it resolves inside this run's config home or
-* `~/.claude/plans`, is a markdown file written for this run, and is bounded.
-* Anything else is ignored — a model-supplied path is not a licence to read
-* the disk.
-* @param input - the control request's `input`.
-* @param options - config home, when the run started, and file-system seams.
-* @returns plan markdown, or undefined when the request has none yet.
-*/
-function readSubmittedPlan(input, { configDir, startedAt = Date.now(), home = homedir(), readFile = (file) => readFileSync(file, "utf8"), stat = statSync, realpath = realpathSync } = {}) {
-	const inline = planMarkdown(input?.plan);
-	if (inline !== void 0) return inline;
+* The plan a CLI ExitPlanMode request submits. Inline text remains valid; a
+* file must resolve inside this invocation's explicitly bound canonical
+* planDirectory. Shared config homes and ~/.claude/plans are never searched.
+* The caller supplies scrub so secrets are removed before the size check.
+* @param input - the control request's input.
+* @param options - the bound private plan directory, redactor, and filesystem seams.
+* @returns bounded plan markdown, or undefined when the request has none yet.
+*/
+function readSubmittedPlan(input, { planDirectory, scrub = (value) => value, onRejected = () => void 0, readFile = readBoundedPlanFile, stat = statSync, realpath = realpathSync } = {}) {
+	if (typeof input?.plan === "string") {
+		const text = scrub(input.plan);
+		const inline = planMarkdown(text);
+		if (inline !== void 0) return inline;
+		if (text.trim() !== "") {
+			onRejected("too-large");
+			return;
+		}
+	}
 	const requested = typeof input?.planFilePath === "string" ? input.planFilePath : "";
-	if (requested === "") return void 0;
-	if (![configDir, join(home, ".claude", "plans")].filter((root) => typeof root === "string" && root !== "").some((root) => pathInside(root, requested, realpath))) return void 0;
-	let file;
+	if (!pathInside(planDirectory, requested, realpath)) return void 0;
 	try {
-		file = realpath(requested);
+		const file = realpath(requested);
+		if (!file.toLowerCase().endsWith(".md")) return void 0;
 		const info = stat(file);
-		if (!info.isFile() || info.size > PLAN_FILE_MAX_BYTES || info.mtimeMs < startedAt - PLAN_FILE_CLOCK_SKEW_MS) return void 0;
-	} catch {
+		if (!info.isFile()) return void 0;
+		if (info.size > PLAN_FILE_MAX_BYTES) {
+			onRejected("too-large");
+			return;
+		}
+		const text = readFile(file, info);
+		if (typeof text !== "string") return void 0;
+		const safe = scrub(text);
+		const plan = planMarkdown(safe);
+		if (plan === void 0 && safe.trim() !== "") onRejected("too-large");
+		return plan;
+	} catch (error) {
+		if (error?.code === "CLAUDE_PLAN_TOO_LARGE") onRejected("too-large");
 		return;
 	}
-	if (!file.toLowerCase().endsWith(".md")) return void 0;
+}
+/**
+* A file-only completion from the CLI is accepted only from this run's new
+* private plans directory. There is no shared-directory/mtime fallback. If
+* more than one eligible file exists, do not guess which session submitted it.
+* @param options - the bound private plan directory, redactor, and filesystem seams.
+* @returns plan markdown, or undefined when absent or ambiguous.
+*/
+function findPlanWrittenDuringRun({ planDirectory, scrub = (value) => value, onRejected = () => void 0, readdir = readdirSync, readFile = readBoundedPlanFile, stat = statSync, realpath = realpathSync } = {}) {
+	if (typeof planDirectory !== "string" || !isAbsolute(planDirectory)) return void 0;
+	let names;
 	try {
-		return planMarkdown(readFile(file));
+		names = readdir(planDirectory);
 	} catch {
 		return;
 	}
-}
-/**
-* The plan file a print-mode CLI wrote and then returned without calling
-* `ExitPlanMode`. `-p` often has no interactive plan tool, so the file is
-* what DSH reviews. Only a markdown file under this run's config `plans`
-* directory or `~/.claude/plans`, newer than the run, is eligible. The newest
-* one wins.
-* @param options - config home, when the run started, and file-system seams.
-* @returns plan markdown, or undefined when this run wrote none.
-*/
-function findPlanWrittenDuringRun({ configDir, startedAt = Date.now(), home = homedir(), readdir = readdirSync, readFile = (file) => readFileSync(file, "utf8"), stat = statSync, realpath = realpathSync } = {}) {
-	const roots = [typeof configDir === "string" && configDir !== "" ? join(configDir, "plans") : "", join(home, ".claude", "plans")].filter((root) => root !== "");
-	let newest;
-	let newestMtime = -Infinity;
-	for (const root of roots) {
-		let names;
-		try {
-			names = readdir(root);
-		} catch {
-			continue;
-		}
-		for (const name of names) {
-			if (typeof name !== "string" || !name.toLowerCase().endsWith(".md")) continue;
-			const candidate = join(root, name);
-			let info;
-			try {
-				info = stat(candidate);
-			} catch {
-				continue;
-			}
-			if (!info.isFile() || info.mtimeMs < startedAt - PLAN_FILE_CLOCK_SKEW_MS || info.mtimeMs < newestMtime) continue;
-			const text = readSubmittedPlan({ planFilePath: candidate }, {
-				configDir,
-				startedAt,
-				home,
-				readFile,
-				stat,
-				realpath
-			});
-			if (text === void 0) continue;
-			newest = text;
-			newestMtime = info.mtimeMs;
-		}
+	let found;
+	for (const name of names) {
+		if (typeof name !== "string" || !name.toLowerCase().endsWith(".md")) continue;
+		const candidate = join(planDirectory, name);
+		if (dirname(candidate) !== planDirectory) continue;
+		const text = readSubmittedPlan({ planFilePath: candidate }, {
+			planDirectory,
+			scrub,
+			onRejected,
+			readFile,
+			stat,
+			realpath
+		});
+		if (text === void 0) continue;
+		if (found !== void 0) return void 0;
+		found = text;
 	}
-	return newest;
+	return found;
 }
 /**
 * Build what the CLI reads from stdin for one run.
@@ -2579,6 +2780,22 @@ function toolResultText(content) {
 	return content.map((part) => part?.type === "text" && typeof part.text === "string" ? part.text : "").join(" ");
 }
 /**
+* Native plan/permission gates sometimes produce no control_request at all.
+* Recognize their specific messages, never generic is_error, ENOENT, EACCES,
+* a failed search, or a command's nonzero exit. An associated assistant tool
+* use is required, so arbitrary user text cannot spend the denial budget.
+*/
+function nativePermissionDenial(name, text) {
+	if (typeof name !== "string") return false;
+	if ([
+		"Write",
+		"Edit",
+		"NotebookEdit"
+	].includes(name) && /^Cannot (?:write to|edit|modify) [\s\S]+ while in plan mode\.(?:\s|$)/u.test(text)) return true;
+	if (["Bash", "PowerShell"].includes(name) && text.startsWith("Auto mode could not evaluate this action and is blocking it for safety")) return true;
+	return text.startsWith(PLAN_ACTION_DENY) || text.startsWith(PLAN_EXIT_DENY) || /^Permission to use [^\n]+ (?:has been|was) denied\b/u.test(text) || /^Claude requested permissions to use [^\n]+, but you haven['’]t granted it yet\b/u.test(text) || /^The user doesn['’]t want to proceed with this tool use\b/u.test(text);
+}
+/**
 * Read one `--output-format stream-json` line.
 *
 * The CLI prints both partial deltas (`stream_event`) and each finished
@@ -2701,7 +2918,7 @@ function describeRunKey(credential) {
 *   seams.
 * @returns `{ run(options), stream(options) }`.
 */
-function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_CLAUDE_CONFIG_DIR, resolveCredential, spawnImpl = spawn, timeoutMs = DEFAULT_CLAUDE_TIMEOUT_MS, startupTimeoutMs = DEFAULT_CLAUDE_STARTUP_TIMEOUT_MS, platform = process.platform, createSearchBridge } = {}) {
+function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_CLAUDE_CONFIG_DIR, resolveCredential, spawnImpl = spawn, timeoutMs = DEFAULT_CLAUDE_TIMEOUT_MS, startupTimeoutMs = DEFAULT_CLAUDE_STARTUP_TIMEOUT_MS, platform = process.platform, createSearchBridge, planFs = PLAN_FS } = {}) {
 	if (typeof resolveCredential !== "function") throw new Error("the Claude Code CLI runner needs resolveCredential");
 	const owners = /* @__PURE__ */ new Set();
 	let disposed = false;
@@ -2725,7 +2942,6 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 		if (disposed || signal?.aborted) throw new Error("claude_code was aborted");
 		const cancellation = new AbortController();
 		const runSignal = signal === void 0 ? cancellation.signal : AbortSignal.any([signal, cancellation.signal]);
-		const startedAt = Date.now();
 		const state = {
 			stdout: "",
 			stderr: "",
@@ -2733,10 +2949,10 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 			silent: false,
 			sawOutput: false,
 			settled: false,
-			denies: 0,
-			startedAt
+			denies: 0
 		};
 		let child;
+		let plans;
 		let bridge;
 		let bridgeClosing;
 		let pendingBridge;
@@ -2789,13 +3005,18 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 					owners.delete(owner);
 					done();
 				});
+				plans?.close();
 				return;
 			}
 			try {
 				await closeBridge();
 			} finally {
-				owners.delete(owner);
-				done();
+				try {
+					plans?.close();
+				} finally {
+					owners.delete(owner);
+					done();
+				}
 			}
 		};
 		const checkAborted = () => {
@@ -2812,6 +3033,10 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 			}
 		};
 		try {
+			if (mode === "plan") {
+				plans = createOwnedPlanDirectory(planFs, cwd);
+				state.planDirectory = plans.directory;
+			}
 			const credential = await setup(resolveCredential({
 				model,
 				signal: runSignal
@@ -2846,7 +3071,8 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 				stream,
 				appendSystemPrompt,
 				searchBridge: bridge,
-				disableNativeSearch: typeof createSearchBridge === "function"
+				disableNativeSearch: typeof createSearchBridge === "function",
+				planDirectory: plans?.directory
 			});
 			child = spawnImpl(command.command, [...command.args, ...args], {
 				cwd,
@@ -2877,17 +3103,26 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 			child.stderr?.setEncoding?.("utf8");
 			let controlBuffer = "";
 			let stdinEnded = false;
+			const onStdinError = () => {
+				if (state.settled || runSignal.aborted || typeof state.plan === "string") return;
+				state.stdinFailed = true;
+				kill();
+			};
 			const endStdin = () => {
 				if (stdinEnded) return;
 				stdinEnded = true;
 				try {
 					child.stdin?.end?.();
-				} catch {}
+				} catch {
+					onStdinError();
+				}
 			};
 			const writeStdin = (frame) => {
 				try {
 					child.stdin?.write?.(frame);
-				} catch {}
+				} catch {
+					onStdinError();
+				}
 			};
 			const controlResponse = (requestId, response) => {
 				writeStdin(`${JSON.stringify({
@@ -2904,12 +3139,22 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 				endStdin();
 				kill();
 			};
-			const refuseControl = (requestId, kind) => {
-				state.denies += 1;
+			const toolUses = /* @__PURE__ */ new Map();
+			const deniedTools = /* @__PURE__ */ new Set();
+			const deniedRequests = /* @__PURE__ */ new Set();
+			const countDenial = (requestId, toolId) => {
+				const duplicate = requestId !== void 0 && deniedRequests.has(requestId) || toolId !== void 0 && deniedTools.has(toolId);
+				if (requestId !== void 0) deniedRequests.add(requestId);
+				if (toolId !== void 0) deniedTools.add(toolId);
+				if (!duplicate) state.denies += 1;
 				if (state.denies > MAX_PLAN_DENIALS) {
 					stopForDenials();
-					return;
+					return false;
 				}
+				return true;
+			};
+			const refuseControl = (requestId, kind, toolId) => {
+				if (!countDenial(requestId, toolId)) return;
 				if (kind === "dialog") {
 					writeStdin(`${JSON.stringify({
 						type: "control_response",
@@ -2928,10 +3173,12 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 			};
 			/**
 			* Plan mode keeps stdin open so a permission prompt can be answered.
-			* `ExitPlanMode` with a plan stops the child; it is never allowed,
-			* because allowing it would make the CLI start editing in this process.
+			* ExitPlanMode is never allowed: stop with the submitted plan instead.
+			* Native hard denials share the same budget, keyed by tool_use_id so the
+			* tool_result following a control denial cannot charge it a second time.
 			*/
 			const handlePlanLine = (line) => {
+				if (state.denyExhausted === true || typeof state.plan === "string") return;
 				const trimmed = line.trim();
 				if (!trimmed.startsWith("{")) return;
 				let message;
@@ -2941,44 +3188,64 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 					return;
 				}
 				if (message?.type === "result") {
+					state.resultError = message.is_error === true;
 					endStdin();
 					return;
 				}
+				if (state.resultError !== void 0) return;
+				if (message?.type === "assistant") {
+					for (const block of Array.isArray(message.message?.content) ? message.message.content : []) {
+						if (block?.type !== "tool_use" || typeof block.id !== "string") continue;
+						toolUses.set(block.id, {
+							name: block.name,
+							input: block.input
+						});
+						if (toolUses.size > 512) toolUses.delete(toolUses.keys().next().value);
+					}
+					return;
+				}
+				if (message?.type === "user") {
+					for (const block of Array.isArray(message.message?.content) ? message.message.content : []) {
+						if (block?.type !== "tool_result" || block.is_error !== true || typeof block.tool_use_id !== "string") continue;
+						if (nativePermissionDenial(toolUses.get(block.tool_use_id)?.name, toolResultText(block.content).trim()) && !countDenial(void 0, block.tool_use_id)) return;
+					}
+					return;
+				}
 				if (message?.type !== "control_request") return;
 				const requestId = message.request_id;
 				const request = message.request;
 				if (typeof requestId !== "string" || request === null || typeof request !== "object") {
-					state.denies += 1;
-					if (state.denies > MAX_PLAN_DENIALS) stopForDenials();
+					countDenial(typeof requestId === "string" ? requestId : void 0, void 0);
 					return;
 				}
+				const toolId = typeof request.tool_use_id === "string" ? request.tool_use_id : [...toolUses].reverse().find(([, tool]) => tool.name === request.tool_name && JSON.stringify(tool.input) === JSON.stringify(request.input))?.[0];
 				if (request.subtype !== "can_use_tool") {
-					refuseControl(requestId, "dialog");
+					refuseControl(requestId, "dialog", toolId);
 					return;
 				}
 				if (request.tool_name === "ExitPlanMode") {
-					const plan = readSubmittedPlan(request.input, {
-						configDir,
-						startedAt
-					});
+					let tooLarge = false;
+					const plan = typeof request.input?.plan === "string" || plans?.isOwned() ? readSubmittedPlan(request.input, {
+						planDirectory: plans?.directory,
+						scrub,
+						onRejected: (reason) => {
+							tooLarge = reason === "too-large";
+						}
+					}) : void 0;
 					if (plan !== void 0) {
-						state.plan = scrub(plan);
+						state.plan = plan;
 						endStdin();
 						kill();
 						return;
 					}
-					state.denies += 1;
-					if (state.denies > MAX_PLAN_DENIALS) {
-						stopForDenials();
-						return;
-					}
+					if (!countDenial(requestId, toolId)) return;
 					controlResponse(requestId, {
 						behavior: "deny",
-						message: PLAN_EXIT_DENY
+						message: tooLarge ? PLAN_TOO_LARGE_DENY : PLAN_EXIT_DENY
 					});
 					return;
 				}
-				refuseControl(requestId, "tool");
+				refuseControl(requestId, "tool", toolId);
 			};
 			child.stdout?.on("data", (chunk) => {
 				state.sawOutput = true;
@@ -3008,18 +3275,32 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 				child.on("close", (code, killSignal) => {
 					if (state.settled) return;
 					state.settled = true;
+					if (mode === "plan" && controlBuffer.trim() !== "") handlePlanLine(controlBuffer);
 					if (state.timedOut) return reject(/* @__PURE__ */ new Error(`claude_code timed out after ${Math.round(timeoutMs / 1e3)}s`));
 					if (state.silent) {
 						const detail = state.stderr.trim().split("\n").slice(-4).join(" ").slice(0, 400);
 						return reject(/* @__PURE__ */ new Error(`Claude Code CLI printed nothing within ${Math.round(startupTimeoutMs / 1e3)}s of starting and was stopped${detail === "" ? "" : `: ${detail}`}`));
 					}
 					if (signal?.aborted) return reject(/* @__PURE__ */ new Error("claude_code was aborted"));
+					if (state.stdinFailed === true) return reject(/* @__PURE__ */ new Error("claude_code could not write to CLI input"));
 					if (state.denyExhausted === true) return reject(/* @__PURE__ */ new Error(PLAN_DENY_LIMIT_MESSAGE));
 					if (typeof state.plan === "string") return resolve({
 						code,
 						killSignal
 					});
 					if (runSignal.aborted) return reject(/* @__PURE__ */ new Error("claude_code was aborted"));
+					if (mode === "plan" && code === 0 && state.resultError === false && plans?.isOwned()) {
+						let tooLarge = false;
+						const written = findPlanWrittenDuringRun({
+							planDirectory: plans.directory,
+							scrub,
+							onRejected: (reason) => {
+								tooLarge ||= reason === "too-large";
+							}
+						});
+						if (tooLarge) return reject(/* @__PURE__ */ new Error(PLAN_TOO_LARGE_DENY));
+						if (written !== void 0) state.plan = written;
+					}
 					resolve({
 						code,
 						killSignal
@@ -3033,7 +3314,7 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 				throw error;
 			});
 			closed.catch(() => void 0);
-			child.stdin?.on?.("error", () => void 0);
+			child.stdin?.on?.("error", onStdinError);
 			if (mode === "plan") writeStdin(input);
 			else child.stdin?.end?.(input);
 			if (runSignal.aborted) kill();
@@ -3217,13 +3498,6 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 					const event = readClaudeStreamEvents(JSON.parse(scrub(buffer.trim()))).find((item) => item.type === "result");
 					if (event !== void 0) sawResult = event.result;
 				} catch {}
-				if (mode === "plan" && typeof state.plan !== "string" && exitStatus?.code === 0) {
-					const written = findPlanWrittenDuringRun({
-						configDir,
-						startedAt: state.startedAt
-					});
-					if (written !== void 0) state.plan = scrub(written);
-				}
 				if (typeof state.plan === "string") {
 					if (deltaKind !== void 0) {
 						const tail = deltaRedactor.flush({ boundary: true });
@@ -3272,7 +3546,11 @@ function createClaudeRunner({ binary = findClaudeBinary(), configDir = DEFAULT_C
 				};
 			} finally {
 				stopIfAbandoned();
-				await closeBridge();
+				try {
+					await closed.catch(() => void 0);
+				} finally {
+					await closeBridge();
+				}
 			}
 		},
 		/** Revoke bridges and stop every invocation when the plugin unloads. */
@@ -4084,13 +4362,15 @@ function claudeModeFor(sandbox, approval) {
 	}
 }
 /**
-* Whether this session should run the CLI in plan mode.
+* Whether a prepared model request should run the CLI in plan mode.
 *
-* The model request runs inside `agent/pre-step`, before the plan-mode service
-* appends `plan/mode`. `pending` is that not-yet-logged selection and wins over
-* the logged `active` bit, matching the `plan:policy` section. Without the
-* service, the logged projection is the only signal. A missing session, a
-* missing service, or a throw means plan mode is off — never a failed turn.
+* This selection is for request preparation only, not an executing tool batch.
+* `pending` is the selection used for the proposed request assembly and wins
+* over logged `active`, matching `plan:policy`. An accepted pre-step commits
+* it; reading after that boundary sees the same selection as logged `active`.
+* Without the service, the logged projection is the only signal. A missing
+* session, a missing service, or a throw means plan mode is off — never a
+* failed turn.
 * @param ctx - the plugin context; services are read without an inject requirement.
 * @param session - the session whose plan state is read.
 * @returns true when the CLI must plan instead of acting.
@@ -4108,7 +4388,30 @@ function planModeForSession(ctx, session) {
 		return false;
 	}
 }
-/** `pending` is the selection the in-flight request was assembled with. */
+/**
+* Whether a tool in the current batch must plan, using logged active state.
+*
+* Approval queues `pending: false`; it does not authorize remaining tools in
+* that batch to implement. Likewise, pending entry must not change a tool's
+* current mode before the next accepted pre-step commits it.
+* @param ctx - the plugin context.
+* @param session - the executing tool's session.
+* @param agent - the trusted executing agent, when provided by the tool runtime.
+*/
+function planModeForToolExecution(ctx, session, agent) {
+	if (session === void 0 || session === null) return false;
+	try {
+		const caller = agent ?? ctx.get?.("agents")?.currentInitiator?.();
+		if (caller?.session === session) {
+			const state = ctx.get?.("planMode")?.get?.(caller);
+			if (state !== void 0 && state !== null) return state.active === true;
+		}
+		return ctx.get?.("sessionProjections")?.stateOf?.(session, "plan")?.active === true;
+	} catch {
+		return false;
+	}
+}
+/** `pending` is the selection the proposed request was assembled with. */
 function planSelected(state) {
 	if (typeof state?.pending === "boolean") return state.pending;
 	return state?.active === true;
@@ -4161,7 +4464,8 @@ const CLAUDE_TOOL_INSTRUCTIONS = "This task was delegated to Claude Code by anot
 const CLAUDE_TOOL_PLAN_INSTRUCTIONS = "This task was delegated to Claude Code while DeepSeek Harness is in plan mode. Explore read-only, write a complete markdown plan that starts with a # heading to the CLI plan file, then call ExitPlanMode. Do not edit the project or start implementing. Reply with the plan text only.";
 /**
 * @param options - the CLI runner, the most a run may do for a session, and
-*   whether that session is in DSH plan mode.
+*   whether the executing batch's logged state is DSH plan mode (not a
+*   pending selection for the next model request).
 * @returns the tool definition to register.
 */
 function createClaudeCodeTool({ runner, modeCeiling, planActive }) {
@@ -4225,7 +4529,7 @@ function createClaudeCodeTool({ runner, modeCeiling, planActive }) {
 			const requested = typeof args.cwd === "string" ? args.cwd.trim() : "";
 			const cwd = requested === "" ? sessionCwd : isAbsolute(requested) ? requested : sessionCwd === void 0 ? requested : join(sessionCwd, requested);
 			const session = exec?.agent?.session;
-			const planning = planActive?.(session) === true;
+			const planning = planActive?.(session, exec?.agent) === true;
 			return await runner.run({
 				prompt: args.prompt,
 				mode: planning ? "plan" : capClaudeMode(args.mode, modeCeiling(session)) ?? "edit",
@@ -4612,6 +4916,134 @@ var PackyCodeKeyRing = class {
 	}
 };
 //#endregion
+//#region src/preferences.js
+/**
+* Where the plugin's preferences are read from and written to, on both
+* settings generations DSH has shipped.
+*
+* - DSH 0.1.5 installs a settings *section*: the section hands back a live
+*   source and writes go through `settings.update(namespace, patch)`.
+* - DSH 0.2 has no sections: a preference is a *volatile* Config field of the
+*   plugin's own row, read through a live reference, written through
+*   `settings.update(rowId, patch)`, and announced by `loader/volatile-update`.
+*   Only volatile fields are writable there, so the host overrides stay
+*   read-only while web search and model visibility are editable.
+*
+* @module dsh-packycode-api/preferences
+*/
+/**
+* Mark a preference editable without restarting the plugin. DSH 0.2 stores
+* plugin preferences as volatile Config fields and writes only those. The
+* peer dependency requires the schema version that implements `volatile()`.
+*/
+const live = (schema) => schema.volatile();
+/** Read a Config field that may arrive as a volatile reference. */
+const fieldValue = (value) => value !== null && typeof value === "object" && typeof value.get === "function" ? value.get() : value;
+/** A preference target nothing can write to yet. */
+function unwritable(message) {
+	return {
+		writable: false,
+		set: async () => {
+			throw new Error(message);
+		}
+	};
+}
+/**
+* Connect the preferences to the settings service the host provides.
+* @param settingsCtx - the scope the `settings` inject handed over.
+* @param options - the plugin context and Config, the section namespace, the
+*   current source and how to replace it, what to do when the section changes,
+*   and the preference targets this fills in (host overrides, search, models).
+*/
+function connectSettings(settingsCtx, { ctx, Config, namespace, source, setSource, onChange, hostPreference, searchPreference, modelPreference }) {
+	const settings = settingsCtx.settings;
+	if (typeof settings?.installSection === "function") {
+		try {
+			settings.installSection(ctx, namespace, Config, source(), {
+				setSource: (current) => setSource(typeof current === "function" ? () => current() ?? {} : () => current ?? {}),
+				onChange
+			});
+			if (typeof settings.update === "function") {
+				const write = (patch) => settings.update(namespace, patch);
+				const target = {
+					writable: settings.writable !== false,
+					set: write
+				};
+				Object.assign(hostPreference, target);
+				Object.assign(searchPreference, target);
+				Object.assign(modelPreference, target);
+			}
+		} catch (error) {
+			ctx.logger?.warn?.("packycode-api: host overrides unavailable, defaults stand: %s", error.message);
+		}
+		return;
+	}
+	if (typeof settings?.update !== "function") return;
+	const rowId = ctx.fiber?.entry?.options?.id ?? namespace;
+	const target = {
+		writable: settings.writable !== false,
+		set: (patch) => settings.update(rowId, patch)
+	};
+	Object.assign(searchPreference, target);
+	Object.assign(modelPreference, target);
+	if (typeof settings.configure === "function") {
+		const scope = typeof settingsCtx.effect === "function" ? settingsCtx : ctx;
+		try {
+			scope.effect(() => settings.configure({ auto: false }, ctx.fiber), "packycode-api: settings page policy");
+		} catch (error) {
+			ctx.logger?.warn?.("packycode-api: could not hide the generated settings page: %s", error.message);
+		}
+	}
+}
+//#endregion
+//#region src/model-selection.js
+/** Profile preferences for the models advertised in PackyCode's picker. */
+/** Store exclusions so new catalog models are selected by default as well. */
+function readHiddenModels(preference) {
+	const value = fieldValue(preference?.hiddenModels);
+	if (!Array.isArray(value)) return [];
+	const hidden = new Set(value);
+	return PACKYCODE_MODEL_IDS.filter((id) => hidden.has(id));
+}
+function createModelSelectionController({ readPreference, writePreference, isWritable, onChange }) {
+	const hidden = () => readHiddenModels(readPreference());
+	let advertised = hidden().join(",");
+	const reconcile = () => {
+		const next = hidden().join(",");
+		if (next === advertised) return;
+		onChange?.();
+		advertised = next;
+	};
+	const status = () => {
+		const excluded = new Set(hidden());
+		return {
+			writable: isWritable() === true,
+			models: PACKYCODE_MODELS.map(({ id, name }) => ({
+				id,
+				name,
+				selected: !excluded.has(id)
+			}))
+		};
+	};
+	return Object.freeze({
+		status,
+		reconcile,
+		isVisible: (id) => !hidden().includes(id),
+		async update({ selectedIds } = {}) {
+			if (!Array.isArray(selectedIds) || selectedIds.some((id) => !PACKYCODE_MODEL_IDS.includes(id))) throw new Error("That PackyCode model selection is not supported");
+			if (isWritable() !== true) throw new Error("PackyCode settings are not writable in this profile");
+			const selected = new Set(selectedIds);
+			try {
+				await writePreference({ hiddenModels: PACKYCODE_MODEL_IDS.filter((id) => !selected.has(id)) });
+			} catch {
+				throw new Error("PackyCode could not save the model selection");
+			}
+			reconcile();
+			return status();
+		}
+	});
+}
+//#endregion
 //#region src/plugin-version.js
 /**
 * Version self-knowledge for the settings panel.
@@ -4934,85 +5366,6 @@ function createPackyCodePluginManager({ fetchImpl = ambientFetch, runCommand = s
 	});
 }
 //#endregion
-//#region src/preferences.js
-/**
-* Where the plugin's preferences are read from and written to, on both
-* settings generations DSH has shipped.
-*
-* - DSH 0.1.5 installs a settings *section*: the section hands back a live
-*   source and writes go through `settings.update(namespace, patch)`.
-* - DSH 0.2 has no sections: a preference is a *volatile* Config field of the
-*   plugin's own row, read through a live reference, written through
-*   `settings.update(rowId, patch)`, and announced by `loader/volatile-update`.
-*   Only volatile fields are writable there, so the host overrides stay
-*   read-only while the web search preference is editable.
-*
-* @module dsh-packycode-api/preferences
-*/
-/**
-* Mark a preference editable without restarting the plugin. DSH 0.2 stores
-* plugin preferences as volatile Config fields and writes only those; an older
-* schema library has no `volatile()` and keeps a plain field.
-*/
-const live = (schema) => typeof schema.volatile === "function" ? schema.volatile() : schema;
-/** Read a Config field that may arrive as a volatile reference. */
-const fieldValue = (value) => value !== null && typeof value === "object" && typeof value.get === "function" ? value.get() : value;
-/** A preference target nothing can write to yet. */
-function unwritable(message) {
-	return {
-		writable: false,
-		set: async () => {
-			throw new Error(message);
-		}
-	};
-}
-/**
-* Connect the preferences to the settings service the host provides.
-* @param settingsCtx - the scope the `settings` inject handed over.
-* @param options - the plugin context and Config, the section namespace, the
-*   current source and how to replace it, what to do when the section changes,
-*   and the two preference targets this fills in (host overrides, search).
-*/
-function connectSettings(settingsCtx, { ctx, Config, namespace, source, setSource, onChange, hostPreference, searchPreference }) {
-	const settings = settingsCtx.settings;
-	if (typeof settings?.installSection === "function") {
-		try {
-			settings.installSection(ctx, namespace, Config, source(), {
-				setSource: (current) => setSource(typeof current === "function" ? () => current() ?? {} : () => current ?? {}),
-				onChange
-			});
-			if (typeof settings.update === "function") {
-				const write = (patch) => settings.update(namespace, patch);
-				Object.assign(hostPreference, {
-					writable: true,
-					set: write
-				});
-				Object.assign(searchPreference, {
-					writable: true,
-					set: write
-				});
-			}
-		} catch (error) {
-			ctx.logger?.warn?.("packycode-api: host overrides unavailable, defaults stand: %s", error.message);
-		}
-		return;
-	}
-	if (typeof settings?.update !== "function") return;
-	const rowId = ctx.fiber?.entry?.options?.id ?? namespace;
-	Object.assign(searchPreference, {
-		writable: settings.writable !== false,
-		set: (patch) => settings.update(rowId, patch)
-	});
-	if (typeof settings.configure === "function") {
-		const scope = typeof settingsCtx.effect === "function" ? settingsCtx : ctx;
-		try {
-			scope.effect(() => settings.configure({ auto: false }, ctx.fiber), "packycode-api: settings page policy");
-		} catch (error) {
-			ctx.logger?.warn?.("packycode-api: could not hide the generated settings page: %s", error.message);
-		}
-	}
-}
-//#endregion
 //#region src/provider.js
 /**
 * The PackyCode pi-ai provider, built in code so the user configures no route.
@@ -5042,7 +5395,7 @@ function keyRingAuth() {
 }
 /** Build the route's pi-ai provider (unguarded; the plugin wraps its streams). */
 function createPackyCodeProvider() {
-	return createProvider({
+	const provider = createProvider({
 		id: PROVIDER,
 		name: DISPLAY_NAME,
 		baseUrl: DEFAULT_API_HOST,
@@ -5054,6 +5407,15 @@ function createPackyCodeProvider() {
 			"anthropic-messages": anthropicMessagesApi()
 		}
 	});
+	const requestOptions = (model, options) => model.api === "openai-responses" && !model.id.startsWith("gpt-") ? {
+		...options,
+		cacheRetention: "none"
+	} : options;
+	return Object.freeze({
+		...provider,
+		stream: (model, context, options) => provider.stream(model, context, requestOptions(model, options)),
+		streamSimple: (model, context, options) => provider.streamSimple(model, context, requestOptions(model, options))
+	});
 }
 /**
 * Observe a pi-ai event stream and hand a key-level failure to the plugin.
@@ -5134,7 +5496,7 @@ function guardKeyRotation(stream, { onKeyFailure, key } = {}) {
 //#region src/route.js
 /**
 * The HTTP model route: the pi-ai provider profile and the adapter that
-* serves the catalog's HTTP models (DeepSeek and GPT) with the ring's keys.
+* serves the catalog's HTTP models (DeepSeek, GPT and Grok) with the ring's keys.
 *
 * @module dsh-packycode-api/route
 */
@@ -5224,7 +5586,7 @@ function createPackyCodeProfile(provider) {
 *   supplies none, and the attachment store image input is read from.
 * @returns a `PiAiAdapter` serving the `packycode` route.
 */
-function createRouteAdapter({ ring, keys, fallbackSessionId, resolveAttachments }) {
+function createRouteAdapter({ ring, keys, fallbackSessionId, resolveAttachments, isModelVisible = () => true }) {
 	const raw = createPackyCodeProvider();
 	/**
 	* The gateway's Codex-group check refuses a Responses request that carries
@@ -5257,7 +5619,11 @@ function createRouteAdapter({ ring, keys, fallbackSessionId, resolveAttachments
 		streamSimple: guarded("streamSimple")
 	});
 	const profiles = /* @__PURE__ */ new Map([[PROVIDER, createPackyCodeProfile(provider)]]);
-	return new PiAiAdapter({
+	return new class extends PiAiAdapter {
+		async listModels(provider) {
+			return (await super.listModels(provider)).filter((model) => isModelVisible(model.id));
+		}
+	}({
 		profiles: () => profiles,
 		resolveApiKey: async () => {
 			const active = await keys.active();
@@ -5282,7 +5648,7 @@ function createRouteAdapter({ ring, keys, fallbackSessionId, resolveAttachments
 * Every reply carries only what this plugin owns: key labels and state, the
 * balance and group projections the host built, host overrides, whether this
 * device has the Claude Code CLI, the plugin version, and the web search
-* preference. Key material never crosses this boundary.
+* preference and model visibility. Key material never crosses this boundary.
 *
 * @module dsh-packycode-api/rpc
 */
@@ -5292,7 +5658,11 @@ const ok = (value) => ({
 });
 const failed = (message) => ({
 	ok: false,
-	error: { message }
+	error: {
+		code: "packycode/request-failed",
+		message,
+		details: {}
+	}
 });
 /** Only sentences this plugin authored may reach the browser. */
 const SAFE_MESSAGE = /^(?:PackyCode|That |Unknown |PackyCode's |add |the )[\s\S]{0,180}$/u;
@@ -5304,7 +5674,7 @@ const keyId = (payload) => String(payload?.id ?? "");
 *   web search controller (without one, its endpoints refuse).
 * @returns a handler for `connection.rpc.handle(CHANNEL, handler)`.
 */
-function createPackyCodeRpc({ ring, balance, groups, hosts, preference, claudeCli, pluginManager, search }) {
+function createPackyCodeRpc({ ring, balance, groups, hosts, preference, claudeCli, pluginManager, search, modelSelection }) {
 	const need = (service, message) => {
 		if (service === void 0) throw new Error(message);
 		return service;
@@ -5313,6 +5683,7 @@ function createPackyCodeRpc({ ring, balance, groups, hosts, preference, claudeCl
 	const manager = () => need(pluginManager, "PackyCode plugin version is unavailable");
 	const webSearch = () => need(search, "PackyCode web search is unavailable in this runtime");
 	const groupReader = () => need(groups, "PackyCode key groups are unavailable in this runtime");
+	const models = () => need(modelSelection, "PackyCode model selection is unavailable in this runtime");
 	const status = async () => ({
 		...await ring.list(),
 		hosts: hosts(),
@@ -5377,7 +5748,9 @@ function createPackyCodeRpc({ ring, balance, groups, hosts, preference, claudeCl
 		"search/update": (payload) => webSearch().update({
 			searchProvider: payload?.searchProvider,
 			searchBackend: payload?.searchBackend
-		})
+		}),
+		"models/status": () => models().status(),
+		"models/update": (payload) => models().update({ selectedIds: payload?.selectedIds })
 	};
 	return async (endpoint, payload, signal) => {
 		try {
@@ -6122,9 +6495,11 @@ const FOREIGN_ROUTERS = Object.freeze({
 });
 /** Normalize a stored preference; anything unknown reads as the default. */
 function readSearchChoice(value) {
+	const provider = fieldValue(value?.searchProvider);
+	const selectedBackend = fieldValue(value?.searchBackend);
 	return {
-		mode: SEARCH_MODES.includes(value?.searchProvider) ? value.searchProvider : SEARCH_MODE_DEFAULT,
-		backend: SEARCH_BACKENDS.includes(value?.searchBackend) ? value.searchBackend : DEFAULT_SEARCH_BACKEND
+		mode: SEARCH_MODES.includes(provider) ? provider : SEARCH_MODE_DEFAULT,
+		backend: SEARCH_BACKENDS.includes(selectedBackend) ? selectedBackend : DEFAULT_SEARCH_BACKEND
 	};
 }
 /** Only sentences this plugin wrote reach the browser. */
@@ -6308,7 +6683,9 @@ const Config = z.object({
 	*/
 	searchProvider: live(z.union([...SEARCH_MODES]).default(SEARCH_MODE_DEFAULT)),
 	/** Which PackyCode model runs a search: `deepseek` or `gpt`. */
-	searchBackend: live(z.union([...SEARCH_BACKENDS]).default(DEFAULT_SEARCH_BACKEND))
+	searchBackend: live(z.union([...SEARCH_BACKENDS]).default(DEFAULT_SEARCH_BACKEND)),
+	/** Only the picker is filtered; an existing session can keep its model. */
+	hiddenModels: live(z.array(z.string()).default([]))
 });
 function apply(ctx, config) {
 	const ring = new PackyCodeKeyRing(ctx.credentials);
@@ -6316,7 +6693,8 @@ function apply(ctx, config) {
 		apiHost: normalizeHost(config?.apiHost, DEFAULT_API_HOST),
 		statusHost: normalizeHost(config?.statusHost, DEFAULT_STATUS_HOST),
 		searchProvider: fieldValue(config?.searchProvider),
-		searchBackend: fieldValue(config?.searchBackend)
+		searchBackend: fieldValue(config?.searchBackend),
+		hiddenModels: fieldValue(config?.hiddenModels)
 	});
 	const hosts = () => {
 		const current = source() ?? {};
@@ -6362,6 +6740,17 @@ function apply(ctx, config) {
 	};
 	const fallbackSessionId = `${PLUGIN_ID}-${randomUUID()}`;
 	const attachments = () => ctx.get?.("attachments") ?? ctx.attachments;
+	const modelPreference = {
+		writable: false,
+		set: void 0
+	};
+	let refreshModels = () => {};
+	const modelSelection = createModelSelectionController({
+		readPreference: () => source() ?? {},
+		writePreference: (patch) => modelPreference.set(patch),
+		isWritable: () => modelPreference.writable === true && typeof modelPreference.set === "function",
+		onChange: () => refreshModels()
+	});
 	/**
 	* The Claude Code CLI runner. PackyCode serves its Claude models only to the
 	* official CLI, so CLI-backed models are run by that CLI itself — with this
@@ -6420,12 +6809,13 @@ function apply(ctx, config) {
 		const configured = config?.claudeCliMode;
 		return configured === void 0 || configured === "auto" ? claudeModeForSession(ctx, session) : configured;
 	};
-	ctx.llm.registerAdapter([PROVIDER], createClaudeCliAdapter({
+	const registration = ctx.llm.registerAdapter([PROVIDER], createClaudeCliAdapter({
 		inner: createRouteAdapter({
 			ring,
 			keys,
 			fallbackSessionId,
-			resolveAttachments: attachments
+			resolveAttachments: attachments,
+			isModelVisible: modelSelection.isVisible
 		}),
 		runner: claudeRunner,
 		resolveMode: () => {
@@ -6436,6 +6826,10 @@ function apply(ctx, config) {
 		resolveAttachments: attachments,
 		explainKey: (runKey) => keys.describe(runKey)
 	}));
+	refreshModels = () => {
+		if (typeof registration?.replace === "function") registration.replace([PROVIDER]);
+		else ctx.emit?.("llm/adapters-updated");
+	};
 	ctx.llm.registerConfigurableProviders([{
 		provider: PROVIDER,
 		displayName: DISPLAY_NAME,
@@ -6487,12 +6881,15 @@ function apply(ctx, config) {
 		onChange: () => {
 			balance.invalidate();
 			groups.invalidate();
+			modelSelection.reconcile();
 			search.reconcile();
 		},
 		hostPreference,
-		searchPreference
+		searchPreference,
+		modelPreference
 	}));
 	ctx.on?.("loader/volatile-update", () => {
+		modelSelection.reconcile();
 		search.reconcile();
 	});
 	/**
@@ -6514,7 +6911,8 @@ function apply(ctx, config) {
 		preference: hostPreference,
 		claudeCli,
 		pluginManager: createPackyCodePluginManager(),
-		search
+		search,
+		modelSelection
 	});
 	/**
 	* Connection registers a channel through `owner.webServer`, read on its own
@@ -6531,9 +6929,9 @@ function apply(ctx, config) {
 		ctx.effect(() => toolsCtx.tools.register(createClaudeCodeTool({
 			runner: claudeRunner,
 			modeCeiling: cliModeCeiling,
-			planActive: (session) => planModeForSession(ctx, session)
+			planActive: (session, agent) => planModeForToolExecution(ctx, session, agent)
 		})), "packycode-api: claude_code tool");
 	});
 }
 //#endregion
-export { AUTO_CLAUDE_MODE, CHANNEL, CLAUDE_CLI_MODES, CLAUDE_INSTALL_COMMAND, CLAUDE_MISSING_MESSAGE, CLAUDE_NPM_PACKAGE, CLAUDE_TOOL_INSTRUCTIONS, CLI_BACKED_MODEL_IDS, CLI_IMAGE_LIMITS, Config, DEFAULT_API_HOST, DEFAULT_APPEND_SYSTEM_PROMPT, DEFAULT_SEARCH_BACKEND, DEFAULT_STATUS_HOST, DISPLAY_NAME, LEGACY_STATUS_HOSTS, PACKYCODE_AUTO_SEARCH_PROVIDER_ID, PACKYCODE_MODELS, PACKYCODE_MODEL_IDS, PACKYCODE_SEARCH_PROVIDER_ID, PLUGIN_ID, PROVIDER, PackyCodeKeyRing, SEARCH_BACKENDS, SEARCH_BACKEND_MODELS, SEARCH_MODES, SETTINGS_NAMESPACE, TITLE_MODEL_ID, TITLE_MODEL_ROUTES, accountHostOrder, apply, assertApiKey, buildClaudeArgs, buildClaudeEnvironment, buildClaudeInput, buildDelegatedContent, buildSearchRequest, capClaudeMode, catalogCoverage, classifyClientPolicy, classifyGatewayFailure, claudeBinaryCandidates, claudeModeFor, claudeModeForSession, cliSearchInstructions, createBalanceReader, createClaudeCliAdapter, createClaudeCliManager, createClaudeCodeTool, createClaudeRunner, createClaudeSearchBridge, createGroupReader, createKeyChooser, createPackyCodeAutoSearchProvider, createPackyCodeProfile, createPackyCodeProvider, createPackyCodeRpc, createPackyCodeSearchProvider, createProfileSearchComposition, createRouteAdapter, createSearchComposition, createSearchController, delegationInstructions, describeRunKey, explainCliClientPolicyFailure, explainCliGroupFailure, explainClientPolicyFailure, explainNpmFailure, findClaudeBinary, guardKeyRotation, inject, keyNote, locateClaudeBinary, locateNpm, name, normalizeFailureMessage, normalizeHost, npmCandidates, parseBillingSubscription, parseBillingUsage, parseClaudeResult, parseClaudeVersion, parseMessagesSearchResponse, parsePricing, parseResponsesSearchResponse, parseSelectedGroups, parseTokenUsage, pickKeyForModel, planModeForSession, readClaudeStreamEvents, readSearchChoice, renderAuxiliaryPrompt, renderDelegatedPrompt, resolveSpawnCommand, statusHostOrder, summarizeToolUse };
+export { AUTO_CLAUDE_MODE, CHANNEL, CLAUDE_CLI_MODES, CLAUDE_INSTALL_COMMAND, CLAUDE_MISSING_MESSAGE, CLAUDE_NPM_PACKAGE, CLAUDE_TOOL_INSTRUCTIONS, CLI_BACKED_MODEL_IDS, CLI_IMAGE_LIMITS, Config, DEFAULT_API_HOST, DEFAULT_APPEND_SYSTEM_PROMPT, DEFAULT_SEARCH_BACKEND, DEFAULT_STATUS_HOST, DISPLAY_NAME, LEGACY_STATUS_HOSTS, PACKYCODE_AUTO_SEARCH_PROVIDER_ID, PACKYCODE_MODELS, PACKYCODE_MODEL_IDS, PACKYCODE_SEARCH_PROVIDER_ID, PLUGIN_ID, PROVIDER, PackyCodeKeyRing, SEARCH_BACKENDS, SEARCH_BACKEND_MODELS, SEARCH_MODES, SETTINGS_NAMESPACE, TITLE_MODEL_ID, TITLE_MODEL_ROUTES, accountHostOrder, apply, assertApiKey, buildClaudeArgs, buildClaudeEnvironment, buildClaudeInput, buildDelegatedContent, buildSearchRequest, capClaudeMode, catalogCoverage, classifyClientPolicy, classifyGatewayFailure, claudeBinaryCandidates, claudeModeFor, claudeModeForSession, cliSearchInstructions, createBalanceReader, createClaudeCliAdapter, createClaudeCliManager, createClaudeCodeTool, createClaudeRunner, createClaudeSearchBridge, createGroupReader, createKeyChooser, createModelSelectionController, createPackyCodeAutoSearchProvider, createPackyCodeProfile, createPackyCodeProvider, createPackyCodeRpc, createPackyCodeSearchProvider, createProfileSearchComposition, createRouteAdapter, createSearchComposition, createSearchController, delegationInstructions, describeRunKey, explainCliClientPolicyFailure, explainCliGroupFailure, explainClientPolicyFailure, explainNpmFailure, findClaudeBinary, guardKeyRotation, inject, keyNote, locateClaudeBinary, locateNpm, name, normalizeFailureMessage, normalizeHost, npmCandidates, parseBillingSubscription, parseBillingUsage, parseClaudeResult, parseClaudeVersion, parseMessagesSearchResponse, parsePricing, parseResponsesSearchResponse, parseSelectedGroups, parseTokenUsage, pickKeyForModel, planModeForSession, planModeForToolExecution, readClaudeStreamEvents, readHiddenModels, readSearchChoice, renderAuxiliaryPrompt, renderDelegatedPrompt, resolveSpawnCommand, statusHostOrder, summarizeToolUse };