one-code-extension 0.4.1 → 0.5.0

package/extensions/lib/one-code-settings.ts

@@ -1,9 +1,9 @@
 /**
  * One Code's own settings files — the writable half of "own state, borrowed
- * config" (docs/decisions/memory-state.md). `~/.claude` is Claude Code's
+ * config" (working-docs/decisions/memory-state.md). `~/.claude` is Claude Code's
  * directory and One Code only ever *reads* it; anything One Code persists that
- * looks like a settings key (its own `subagentModel` / `autoMode.classifierModel`,
- * the allow rules `/allow` records) lands here instead, so One Code never mutates
+ * looks like a settings key (its own `subagentModel` or the allow rules `/allow`
+ * records) lands here instead, so One Code never mutates
  * Claude Code's config and a value that means nothing to Claude Code (a model it
  * cannot run, say) never ends up in Claude Code's file.
  *
@@ -22,23 +22,43 @@
 
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { writeJsonAtomic } from "./atomic-write.ts";
+import { readJsonFile, writeJsonAtomic } from "./atomic-write.ts";
 import { findProjectRoot } from "./git.ts";
 import { projectSlug } from "./memory.ts";
-import { oneCodeStateDir } from "./paths.ts";
+import { oneCodeStateDir, tryRealpath } from "./paths.ts";
 
 /** `~/.onecode/settings.json` — One Code's user-scope settings (writable). */
 export function oneCodeSettingsPath(home: string, env: NodeJS.ProcessEnv = process.env): string {
 	return join(oneCodeStateDir(env, home), "settings.json");
 }
 
+/**
+ * The project a per-repo setting belongs to: the git repository root when
+ * there is one (shared by worktrees and subdirectories), else the cwd, through
+ * symlinks so an aliased checkout is the same project.
+ */
+export function oneCodeProjectRoot(cwd: string): string {
+	const root = findProjectRoot(cwd) ?? cwd;
+	return tryRealpath(root) ?? root;
+}
+
 /**
  * `~/.onecode/projects/<slug>/settings.json` — One Code's per-repo settings
- * (writable). Keyed by the git repository root when there is one (shared by
- * worktrees and subdirectories), else the cwd — the same slug the memory dir uses.
+ * (writable), for `oneCodeProjectRoot`. The slug is the memory dir's
+ * (`projectSlug`), but of the resolved root, where the memory dir slugs the
+ * root as found. It is lossy (`my_app` and `my-app` share a file), so a setting
+ * that grants trust records the root it was given for (claude-external-includes.ts).
  */
 export function oneCodeProjectSettingsPath(cwd: string, home: string, env: NodeJS.ProcessEnv = process.env): string {
-	return join(oneCodeStateDir(env, home), "projects", projectSlug(findProjectRoot(cwd) ?? cwd), "settings.json");
+	return oneCodeProjectSettingsPathFor(oneCodeProjectRoot(cwd), home, env);
+}
+
+/** Resolve a project settings path without moving existing permission or trust state. */
+export function oneCodeProjectSettingsPathFor(root: string, home: string, env: NodeJS.ProcessEnv = process.env): string {
+	const projects = join(oneCodeStateDir(env, home), "projects");
+	const legacy = join(projects, root.replace(/[^A-Za-z0-9-]/g, "-"), "settings.json");
+	if (existsSync(legacy)) return legacy;
+	return join(projects, projectSlug(root), "settings.json");
 }
 
 /**
@@ -61,3 +81,49 @@ export function readSettingsForWrite(path: string): Record<string, unknown> {
 export function writeSettings(path: string, file: Record<string, unknown>): void {
 	writeJsonAtomic(path, file);
 }
+
+/** User-only upgrade advice, enabled unless explicitly disabled in One Code's settings. */
+export function readSuggestNewerModels(home: string, env: NodeJS.ProcessEnv = process.env): boolean {
+	const file = readJsonFile<{ suggestNewerModels?: unknown }>(oneCodeSettingsPath(home, env));
+	return file?.suggestNewerModels !== false;
+}
+
+/** Claude Code's `workflowSizeGuideline` values: under 5, 10 or 50 agents, or no guideline. */
+export type WorkflowSizeGuideline = "small" | "medium" | "large" | "unrestricted";
+
+const WORKFLOW_SIZES: readonly WorkflowSizeGuideline[] = ["small", "medium", "large", "unrestricted"];
+
+export interface WorkflowSettings {
+	/** Whether the workflow tool is offered at all. */
+	enabled: boolean;
+	sizeGuideline: WorkflowSizeGuideline;
+	/** True when a settings file set the guideline (the description says "configured"). */
+	sizeConfigured: boolean;
+}
+
+interface WorkflowSettingsFile {
+	enableWorkflows?: unknown;
+	disableWorkflows?: unknown;
+	workflowSizeGuideline?: unknown;
+}
+
+/**
+ * The workflow settings Claude Code reads, from One Code's own files (user,
+ * then the project file, which wins): `enableWorkflows` (default true),
+ * `disableWorkflows` (true turns workflows off whatever `enableWorkflows`
+ * says, as in Claude Code) and `workflowSizeGuideline` (default "medium"; an
+ * unknown value is ignored). Read leniently: a malformed file is skipped.
+ */
+export function readWorkflowSettings(cwd: string, home: string, env: NodeJS.ProcessEnv = process.env): WorkflowSettings {
+	const files = [oneCodeSettingsPath(home, env), oneCodeProjectSettingsPath(cwd, home, env)].map((path) => readJsonFile<WorkflowSettingsFile>(path));
+	let enable = true;
+	let disable = false;
+	let size: WorkflowSizeGuideline | undefined;
+	for (const file of files) {
+		if (!file || typeof file !== "object") continue;
+		if (typeof file.enableWorkflows === "boolean") enable = file.enableWorkflows;
+		if (file.disableWorkflows === true) disable = true;
+		if (WORKFLOW_SIZES.includes(file.workflowSizeGuideline as WorkflowSizeGuideline)) size = file.workflowSizeGuideline as WorkflowSizeGuideline;
+	}
+	return { enabled: enable && !disable, sizeGuideline: size ?? "medium", sizeConfigured: size !== undefined };
+}

package/extensions/lib/open-browser.ts

@@ -0,0 +1,63 @@
+/**
+ * Hand a URL to the desktop's default handler (no dependency, a platform
+ * command). Shared by the MCP sign-in flow (`mcp/oauth/browser.ts`, which also
+ * screens the URL it is given) and the artifact viewer (`extensions/artifacts`,
+ * which only ever opens `file:` URLs it built itself).
+ *
+ * The child is detached and unref'd once it starts, so the caller never
+ * blocks on the browser process. A launch failure resolves to false: a box
+ * with no browser falls back to printing the target. On Windows the URL never passes
+ * through `cmd.exe`: `cmd /c start "" <url>` cut a URL at its first `&` and
+ * handed the rest to cmd's parser as further commands. `rundll32
+ * url.dll,FileProtocolHandler` takes the URL as one argument, by its System32
+ * path so no PATH entry can stand in for it.
+ */
+
+import { spawn } from "node:child_process";
+import { system32Path } from "./paths.ts";
+
+export interface OpenerPlan {
+	command: string;
+	args: string[];
+}
+
+/** The command and argv that open `url` on `platform`. Pure. */
+export function openerPlan(url: string, platform: NodeJS.Platform = process.platform, env: Record<string, string | undefined> = process.env): OpenerPlan {
+	if (platform === "darwin") return { command: "open", args: [url] };
+	if (platform === "win32") return { command: system32Path("rundll32.exe", env), args: ["url.dll,FileProtocolHandler", url] };
+	return { command: "xdg-open", args: [url] };
+}
+
+/**
+ * Why a browser opened from here would not reach the user, or undefined when
+ * it would. Over SSH the opener runs on the remote machine's desktop, and a
+ * Linux or BSD box with neither X nor Wayland has no desktop at all. Pure.
+ */
+export function noDisplayReason(platform: NodeJS.Platform = process.platform, env: Record<string, string | undefined> = process.env): string | undefined {
+	if (env.SSH_CONNECTION || env.SSH_TTY) return "this session runs over SSH";
+	if (platform !== "darwin" && platform !== "win32" && !env.DISPLAY && !env.WAYLAND_DISPLAY) return "no graphical display is available";
+	return undefined;
+}
+
+/**
+ * Start `plan` detached. Resolves true once the opener has started, false when
+ * it could not: a missing `xdg-open` is reported by an `error` event after
+ * `spawn` returns, so success waits for the `spawn` event. The child stays
+ * ref'd until then, so a one-shot run cannot exit mid-launch.
+ */
+export function launchOpener(plan: OpenerPlan): Promise<boolean> {
+	return new Promise((resolve) => {
+		let child: ReturnType<typeof spawn>;
+		try {
+			child = spawn(plan.command, plan.args, { stdio: "ignore", detached: true });
+		} catch {
+			resolve(false);
+			return;
+		}
+		child.once("error", () => resolve(false));
+		child.once("spawn", () => {
+			child.unref();
+			resolve(true);
+		});
+	});
+}

package/extensions/lib/openrouter-generation.ts

@@ -0,0 +1,94 @@
+/** A best-effort attribution lookup, bounded across auth, retries, and response-body reads. */
+export async function openRouterProviderName(
+	generationId: string | undefined,
+	getApiKey: () => Promise<string | undefined>,
+	signal: AbortSignal,
+): Promise<string | undefined> {
+	if (!generationId || signal.aborted) return;
+	const controller = new AbortController();
+	const cancel = () => controller.abort();
+	signal.addEventListener("abort", cancel, { once: true });
+	const timeout = setTimeout(cancel, 8_000);
+	let retryTimer: ReturnType<typeof setTimeout> | undefined;
+	let releaseRetry: (() => void) | undefined;
+	const stopped = new Promise<undefined>((resolve) => {
+		controller.signal.addEventListener("abort", () => {
+			clearTimeout(retryTimer);
+			releaseRetry?.();
+			resolve(undefined);
+		}, { once: true });
+	});
+	const lookup = async (): Promise<string | undefined> => {
+		let apiKey: string | undefined;
+		try {
+			apiKey = await getApiKey();
+		} catch {
+			return;
+		}
+		if (!apiKey || controller.signal.aborted) return;
+		while (!controller.signal.aborted) {
+			try {
+				const response = await fetch(`https://openrouter.ai/api/v1/generation?id=${encodeURIComponent(generationId)}`, {
+					headers: { Authorization: `Bearer ${apiKey}` },
+					signal: controller.signal,
+				});
+				if (controller.signal.aborted) return;
+				if (response.ok) {
+					const body = await response.json() as { data?: { provider_name?: unknown } } | null;
+					const provider = body?.data?.provider_name;
+					if (typeof provider === "string" && provider.trim()) return provider.trim();
+				} else {
+					await response.body?.cancel();
+					if (response.status === 401 || response.status === 403) return;
+				}
+			} catch {
+				// Generation metadata can lag or fail independently of the completed model call.
+			}
+			if (controller.signal.aborted) return;
+			await new Promise<void>((resolve) => {
+				releaseRetry = resolve;
+				retryTimer = setTimeout(resolve, 1_000);
+			});
+		}
+	};
+	try {
+		return await Promise.race([lookup(), stopped]);
+	} finally {
+		clearTimeout(timeout);
+		signal.removeEventListener("abort", cancel);
+		controller.abort();
+	}
+}
+
+/** Per model object: the stream detector asks on every chunk of every provider. */
+const openRouterByModel = new WeakMap<object, boolean>();
+
+export function isOpenRouter(model: { provider: string; baseUrl?: string } | undefined): boolean {
+	if (!model) return false;
+	if (model.provider === "openrouter") return true;
+	const known = openRouterByModel.get(model);
+	if (known !== undefined) return known;
+	let result = false;
+	try {
+		const hostname = new URL(model.baseUrl ?? "").hostname;
+		result = hostname === "openrouter.ai" || hostname.endsWith(".openrouter.ai");
+	} catch {
+		// No or malformed base URL: not OpenRouter.
+	}
+	openRouterByModel.set(model, result);
+	return result;
+}
+
+/** How the upstream provider failed: a blocked call, a call cut off mid-stream, or a stream gone silent. */
+export type UpstreamFailure = "blocked-call" | "corrupt-stream" | { stalledSeconds: number };
+
+export function toolCallCorruptionNotice(modelId: string, providerName: string | undefined, failure: UpstreamFailure = "blocked-call"): string {
+	const stalled = typeof failure === "object";
+	const what = stalled ? `stopped streaming for ${modelId} (no data for ${failure.stalledSeconds} s)` : `is corrupting tool calls for ${modelId}`;
+	const provider = providerName
+		? `OpenRouter upstream provider ${providerName} ${what}.`
+		: `An OpenRouter upstream provider ${what}; the provider could not be identified.`;
+	const outcome = failure === "blocked-call" ? "The call was blocked and the turn stopped." : stalled ? "The turn was stopped." : "The reply was cut off and the turn stopped.";
+	const ignore = JSON.stringify([providerName ?? "PROVIDER_NAME"]);
+	return `${provider} ${outcome} Add the provider to compat.openRouterRouting.ignore for this model in pi's models.json ("ignore": ${ignore}), or switch models.`;
+}

package/extensions/lib/operation-deadline.ts

@@ -0,0 +1,30 @@
+/** Bound an awaited operation, including dependencies that do not accept an abort signal. */
+export async function runWithDeadline<T>(
+	call: (signal: AbortSignal) => Promise<T>,
+	options: { signal?: AbortSignal; timeoutMs: number; message: string },
+): Promise<T> {
+	options.signal?.throwIfAborted();
+	const controller = new AbortController();
+	const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
+	// A one-shot process must live until the awaited operation settles.
+	const timer = setTimeout(() => controller.abort(new Error(options.message)), options.timeoutMs);
+	let rejectAbort: () => void = () => {};
+	const aborted = new Promise<never>((_, reject) => {
+		rejectAbort = () => reject(signal.reason);
+		signal.addEventListener("abort", rejectAbort, { once: true });
+	});
+	try {
+		const result = await Promise.race([
+			Promise.resolve().then(() => {
+				signal.throwIfAborted();
+				return call(signal);
+			}),
+			aborted,
+		]);
+		signal.throwIfAborted();
+		return result;
+	} finally {
+		clearTimeout(timer);
+		signal.removeEventListener("abort", rejectAbort);
+	}
+}

package/extensions/lib/original-command.ts

@@ -22,10 +22,10 @@ export interface OriginalCommandRecord {
 	toolCallId: string;
 	command: string;
 	/**
-	 * The directory the wrapper `cd`s into (the worktree). The pre-gate and the
-	 * recoverability judge run on the original command against THIS cwd, so a
-	 * worktree session keeps the containment fast path and the prompt shows the
-	 * command the model wrote, not `cd '…' && (…)` (PERMISSIONS-REVIEW-2026-09-05 L3).
+	 * The directory the wrapper `cd`s into (the worktree). The pre-gate runs on
+	 * the original command against THIS cwd, so a worktree session keeps the
+	 * containment fast path and the prompt shows the command the model wrote,
+	 * not `cd '…' && (…)` (PERMISSIONS-REVIEW-2026-09-05 L3).
 	 */
 	cwd?: string;
 }

package/extensions/lib/package-version.ts

@@ -3,7 +3,7 @@
  * banner never hardcodes (and drifts from) the released version.
  *
  * The bundled app sets CC_VERSION to the app package version, which is kept in
- * lockstep with this package (docs/decisions/distribution.md). When the
+ * lockstep with this package (working-docs/decisions/distribution.md). When the
  * extension is loaded directly via plain `pi` there is no CC_VERSION, so this
  * reads the extension's own package.json instead of falling back to a stale
  * literal.

package/extensions/lib/panel-focus.ts

@@ -0,0 +1,134 @@
+/**
+ * Which One Code panels hold the keyboard, over the event bus (jiti modules
+ * cannot share state), so a permission prompt waits for a panel to close
+ * instead of taking its place. Pure: no pi imports.
+ *
+ * pi shows a dialog (`ctx.ui.select`, `input`, `confirm`) in the slot a
+ * `ctx.ui.custom` panel occupies: the dialog replaces the panel and takes its
+ * focus, the panel never comes back, and an Enter typed for the panel answers
+ * the dialog. Claude Code holds a permission dialog while a command's panel
+ * is open. So every panel goes through `panelFactory`, which reports when its
+ * component gains and loses focus, and the permissions extension queues its
+ * prompts until no panel is focused (`PanelFocus.whenClear`).
+ *
+ * Focus is read from pi-tui's own `focused` flag, which `setFocus` sets on a
+ * component that has the property: a panel that something else displaced
+ * reports itself gone at once, so a prompt can never wait on a panel that is
+ * no longer on screen.
+ */
+
+export const PANEL_FOCUS_CHANNEL = "one-code:panel-focus";
+
+/** One panel's focus change; `id` is an object unique to the panel. */
+export interface PanelFocusEvent {
+	id: object;
+	focused: boolean;
+}
+
+interface Emitter {
+	emit(channel: string, data: unknown): void;
+}
+
+function findDescriptor(target: object, key: string): PropertyDescriptor | undefined {
+	for (let at: object | null = target; at; at = Object.getPrototypeOf(at)) {
+		const found = Object.getOwnPropertyDescriptor(at, key);
+		if (found) return found;
+	}
+	return undefined;
+}
+
+/** Report every write to the component's `focused` flag, keeping whatever the component does with it. */
+function watchFocus(component: object, onChange: (focused: boolean) => void): void {
+	const own = findDescriptor(component, "focused");
+	let value: unknown = own && "value" in own ? own.value : undefined;
+	Object.defineProperty(component, "focused", {
+		configurable: true,
+		enumerable: true,
+		get: () => (own?.get ? own.get.call(component) : value),
+		set: (next: unknown) => {
+			if (own?.set) own.set.call(component, next);
+			else value = next;
+			onChange(Boolean(next));
+		},
+	});
+}
+
+/**
+ * A `ctx.ui.custom` factory that reports its panel's focus on
+ * `PANEL_FOCUS_CHANNEL`: `ctx.ui.custom(panelFactory(pi.events, (tui, theme,
+ * keybindings, done) => …))`. The panel counts as gone when it loses focus or
+ * calls `done`.
+ */
+export function panelFactory<A extends unknown[], C>(events: Emitter, factory: (...args: A) => C): (...args: A) => C {
+	return (...args: A): C => {
+		const id = {};
+		const report = (focused: boolean) => events.emit(PANEL_FOCUS_CHANNEL, { id, focused } satisfies PanelFocusEvent);
+		const done = args[3];
+		if (typeof done === "function") {
+			args[3] = ((...result: unknown[]) => {
+				report(false);
+				return done(...result);
+			}) as A[3];
+		}
+		const watch = (component: unknown) => {
+			if (component && typeof component === "object") watchFocus(component, report);
+			return component;
+		};
+		const made = factory(...args);
+		return (made instanceof Promise ? made.then(watch) : watch(made)) as C;
+	};
+}
+
+/**
+ * `ctx.ui` with a `custom` whose panels report their focus:
+ * `panelUi(pi.events, ctx.ui).custom<T>((tui, theme, keybindings, done) => …)`.
+ */
+export function panelUi<U extends { custom: (...args: any[]) => any }>(events: Emitter, ui: U): Pick<U, "custom"> {
+	const custom = (factory: (...args: unknown[]) => unknown, ...rest: unknown[]) => ui.custom(panelFactory(events, factory), ...rest);
+	return { custom: custom as U["custom"] };
+}
+
+/** The focused panels, fed from `PANEL_FOCUS_CHANNEL`. */
+export class PanelFocus {
+	private readonly focused = new Set<object>();
+	private waiters = new Set<() => void>();
+
+	note(data: unknown): void {
+		const event = data as Partial<PanelFocusEvent> | undefined;
+		if (!event || typeof event.id !== "object" || event.id === null) return;
+		if (event.focused) this.focused.add(event.id);
+		else this.focused.delete(event.id);
+		if (this.focused.size === 0) this.release();
+	}
+
+	/** True while a panel holds the keyboard. */
+	get busy(): boolean {
+		return this.focused.size > 0;
+	}
+
+	/** Resolves once no panel is focused, or when `signal` aborts. */
+	whenClear(signal?: AbortSignal): Promise<void> {
+		if (!this.busy || signal?.aborted) return Promise.resolve();
+		return new Promise((resolve) => {
+			const finish = () => {
+				this.waiters.delete(finish);
+				signal?.removeEventListener("abort", finish);
+				resolve();
+			};
+			this.waiters.add(finish);
+			signal?.addEventListener("abort", finish, { once: true });
+		});
+	}
+
+	/** Forget every panel (a new session) and let waiting prompts through. */
+	reset(): void {
+		this.focused.clear();
+		this.release();
+	}
+
+	private release(): void {
+		const waiting = this.waiters;
+		this.waiters = new Set();
+		for (const finish of waiting) finish();
+	}
+}

package/extensions/lib/paths.ts

@@ -6,7 +6,7 @@
  * (settings, skills, agents, plugins, CLAUDE.md); everything One Code
  * *generates* — plan files, and over time the rest of its state — lands in
  * One Code's own `~/.onecode`, so neither product's artifacts mingle with the
- * other's. See "Own state, borrowed config" in docs/decisions.md.
+ * other's. See "Own state, borrowed config" in working-docs/decisions.md.
  */
 
 import { realpathSync } from "node:fs";
@@ -21,6 +21,19 @@ export function claudeConfigDir(env: Record<string, string | undefined> = proces
 	return env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude");
 }
 
+/**
+ * Claude Code's organization-managed root: `managed-settings.json`
+ * (lib/claude-settings.ts) and the managed CLAUDE.md and rules all live here.
+ * On Windows it is `C:\Program Files\ClaudeCode`, the only Windows path the
+ * Claude Code binary names (2.1.292); `C:\ProgramData\ClaudeCode` is not read.
+ * The Windows policy registry keys are a separate source, not read here.
+ */
+export function claudeManagedDir(platform: NodeJS.Platform = process.platform): string {
+	if (platform === "darwin") return "/Library/Application Support/ClaudeCode";
+	if (platform === "win32") return "C:\\Program Files\\ClaudeCode";
+	return "/etc/claude-code";
+}
+
 /**
  * The user-scope Claude Code dir for a given `home` — `claudeConfigDir` for
  * callers that thread a `home` (tests, `~`-expansion). `CLAUDE_CONFIG_DIR`
@@ -158,7 +171,9 @@ export function foldsCase(): boolean {
  * the safety floor — so "under this directory" means one thing everywhere.
  */
 export function comparablePath(path: string): string {
-	const normalized = forwardSlashes(resolve(path)).replace(/\/+$/, "");
+	const absolute = resolve(path);
+	// Backslashes separate Windows paths, but name literal sibling files on POSIX.
+	const normalized = (process.platform === "win32" ? forwardSlashes(absolute) : absolute).replace(/\/+$/, "");
 	return foldsCase() ? normalized.toLowerCase() : normalized;
 }
 

package/extensions/lib/permission-gate.ts

@@ -30,11 +30,20 @@
  */
 
 import { getAgentDir, type InlineExtension } from "@earendil-works/pi-coding-agent";
+import { withKeepAlive } from "../lsp/keep-alive.ts";
+import { bashParserReady } from "./bash-parser.ts";
 import { findProjectRoot } from "./git.ts";
+import { SUBAGENT_HANDBACK } from "./subagent-handback.ts";
+import { autoMemoryEnabled } from "./auto-memory.ts";
 import { memoryDir } from "./memory.ts";
-import { claudeConfigDir, oneCodeStateDir } from "./paths.ts";
+import type { PowerShellParse } from "./powershell-parser.ts";
+import { usesClaudeCodeFastPaths } from "./model-tier.ts";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { claudeConfigDir, claudeJsonPath, oneCodeStateDir } from "./paths.ts";
 import { sessionResultsDir } from "./persisted-output.ts";
-import { sessionScratchpadDir } from "./scratchpad.ts";
+import { powerShellParser } from "./shell-spawn.ts";
+import { isPrivateScratchpad, sessionScratchpadDir } from "./scratchpad.ts";
 import { decide, extractSubject, isPathSubjectTool, normalizeToolName, type PermissionMode, parseRules } from "../permissions/matcher.ts";
 import { projectAllowApproved } from "../permissions/project-trust.ts";
 import { loadPermissionSettings, normalizePermissionMode } from "../permissions/settings.ts";
@@ -64,8 +73,33 @@ export function runtimeProtectedDirs(): string[] {
 	return [...new Set(roots.flatMap((dir) => [dir, resolvedOrSelf(dir)]))];
 }
 
+/**
+ * The harness's own secret stores, files and directories, which a read tool
+ * outside the working space must not read unclassified: One Code's settings
+ * (web search API keys, the model tiers) and MCP OAuth token store, pi's
+ * `models.json` (custom-provider `apiKey` values) and `auth.json`, Claude
+ * Code's user settings (`env` keys, `apiKeyHelper`) and `.claude.json`. The
+ * basename denylist (`auto-mode/sensitive.ts`) cannot name these without
+ * flagging every project's `settings.json`. Literal and resolved spelling, as
+ * for `runtimeProtectedDirs`; `DecideInput.secretPaths` is the consumer.
+ */
+export function runtimeSecretPaths(home: string = homedir()): string[] {
+	const stateDir = oneCodeStateDir(process.env, home);
+	const agentDir = getAgentDir();
+	const paths = [
+		join(stateDir, "settings.json"),
+		join(stateDir, "mcp-auth"),
+		join(agentDir, "models.json"),
+		join(agentDir, "auth.json"),
+		join(claudeConfigDir(), "settings.json"),
+		join(claudeConfigDir(), ".credentials.json"),
+		claudeJsonPath(home),
+	];
+	return [...new Set(paths.flatMap((path) => [path, resolvedOrSelf(path)]))];
+}
+
 /** Tools the runtime itself injects; never gate them. */
-const DEFAULT_INTERNAL_TOOLS = new Set(["structured_output"]);
+const DEFAULT_INTERNAL_TOOLS = new Set(["structured_output", SUBAGENT_HANDBACK]);
 
 /** The parent permissions extension publishes its live mode here (in-process children read it). */
 export const MODE_ENV = "CC_PERMISSION_MODE";
@@ -78,6 +112,24 @@ export function localGateMode(envValue: string | undefined, defaultMode: Permiss
 	return normalizePermissionMode(envValue) ?? defaultMode ?? "acceptEdits";
 }
 
+/**
+ * PowerShell's own parse of a `powershell` call's command line, for decide(),
+ * from the process-wide parse server on the tool's own executable
+ * (lib/powershell-parser.ts). Undefined for another tool, in
+ * bypassPermissions (nothing is judged), or when the parser cannot answer (no
+ * PowerShell, a timeout, a crash, Constrained Language Mode): the gate then
+ * clears nothing and the line is classified, prompted or denied. The server's
+ * child is unref'd, so the await holds the event loop open itself (a one-shot
+ * run would otherwise exit mid-parse).
+ */
+export async function parsePowerShell(tool: string, command: string | undefined, mode: PermissionMode): Promise<PowerShellParse | undefined> {
+	if (tool !== "powershell" || !command || mode === "bypassPermissions") return undefined;
+	const parser = powerShellParser();
+	if (!parser) return undefined;
+	const outcome = await withKeepAlive(() => parser.parse(command));
+	return outcome.ok ? outcome.parse : undefined;
+}
+
 export function permissionGateFactory(
 	cwd: string,
 	home: string,
@@ -105,9 +157,11 @@ export function permissionGateFactory(
 	);
 	// Memory writes work inside agent sessions too — otherwise the protected
 	// `.claude` check turns them into "needs interactive approval" and the
-	// harness blocks its own feature (same rationale as in decide()).
-	const memoryDirPath = memoryDir(home, projectRoot);
+	// harness blocks its own feature (same rationale as in decide()). With
+	// auto-memory off the folder gets no grant, as in the parent's gate.
+	const memoryDirPath = autoMemoryEnabled(projectRoot) ? memoryDir(home, projectRoot) : undefined;
 	const protectedDirs = runtimeProtectedDirs();
+	const secretPaths = runtimeSecretPaths(home);
 
 	return {
 		name: "agent-permission-gate",
@@ -117,6 +171,7 @@ export function permissionGateFactory(
 			// until the session runs — derived on first tool call, then pinned.
 			let scratchpadDirPath: string | undefined;
 			pi.on("tool_call", async (event, ctx) => {
+				await bashParserReady();
 				if (neverGate.has(event.toolName)) return undefined;
 				const runCwd = ctx?.cwd ?? cwd;
 				const sessionId = ctx?.sessionManager?.getSessionId?.();
@@ -137,13 +192,17 @@ export function permissionGateFactory(
 							cwd: runCwd,
 							signal: ctx?.signal,
 							sessionId,
+							model: ctx?.model,
 						});
 					}
 				} catch (error) {
 					return { block: true, reason: `Permission bridge failed (${(error as Error).message}); denied to fail safe.` };
 				}
 
-				if (!scratchpadDirPath && sessionId) scratchpadDirPath = sessionScratchpadDir(runCwd, sessionId);
+				if (!scratchpadDirPath && sessionId) {
+					const candidate = sessionScratchpadDir(runCwd, sessionId);
+					if (isPrivateScratchpad(candidate)) scratchpadDirPath = candidate;
+				}
 				const tool = normalizeToolName(event.toolName);
 				const subject = extractSubject(tool, event.input as Record<string, unknown>);
 				// Path tools (writers and the read tier) are judged by where the path
@@ -156,6 +215,9 @@ export function permissionGateFactory(
 				// No classifier is reachable without the bridge, so auto mode is judged
 				// as acceptEdits — which decide() confines to the working directory.
 				const mode = liveMode === "auto" ? "acceptEdits" : liveMode;
+				// PowerShell is judged from its own parse, as in the parent's gate;
+				// without one it clears nothing and the call is denied here.
+				const powershellParse = await parsePowerShell(tool, subject, mode);
 				const result = decide({
 					toolName: event.toolName,
 					subject,
@@ -173,6 +235,10 @@ export function permissionGateFactory(
 					// the subject (the tmpdir fallback sits under a symlinked /var on macOS).
 					resultsDirPath: resolvedOrSelf(sessionResultsDir(ctx)),
 					protectedDirs,
+					secretPaths,
+					claudeCodeFastPaths: usesClaudeCodeFastPaths(ctx?.model),
+					blockReadsOutsideWorkingDirectories: settings.blockReadsOutsideWorkingDirectories,
+					powershellParse,
 				});
 				if (result.decision === "allow") return undefined;
 				const ruleNote = result.rule ? ` (rule: ${result.rule.raw})` : "";