pan-wizard 3.33.0 → 3.35.0

package/hooks/dist/pan-cost-logger.js

@@ -655,6 +655,7 @@ function buildCostRecord(data, cwd) {
   let cacheWrite = 0;
   // { h1, m5 } when the source carried the cache-write lifetime split (M13).
   let ttlSplit = null;
+  let longPrompt = null;
   let durationMs = null;
   // token_source records WHICH path produced the counts: `agent-transcript` (the
   // subagent's own conversation file — see resolveAgentTranscript), `transcript`
@@ -717,6 +718,9 @@ function buildCostRecord(data, cwd) {
     if (typeof fromTranscript.cache_write_1h_tokens === 'number' && rawCw <= SLICE_MAX.cache_write) {
       ttlSplit = { h1: fromTranscript.cache_write_1h_tokens, m5: fromTranscript.cache_write_5m_tokens || 0 };
     }
+    // The long-prompt part of the slice, kept only when nothing was clamped (a clamped
+    // total no longer contains it).
+    if (fromTranscript.long_prompt && !clamped) longPrompt = fromTranscript.long_prompt;
     durationMs = durationFromSpan(fromTranscript.first_ts, fromTranscript.last_ts); // as measured — see SLICE_MAX
     if (!model) model = fromTranscript.model;
     if (fromTranscript.lineCount > since) {
@@ -809,6 +813,8 @@ function buildCostRecord(data, cwd) {
     cache_write_tokens: cacheWrite,
     // The lifetime split of cache_write_tokens, present only when measured (M13).
     ...(ttlSplit ? { cache_write_1h_tokens: ttlSplit.h1, cache_write_5m_tokens: ttlSplit.m5 } : {}),
+    // Tokens of the requests whose prompt was over LONG_PROMPT_THRESHOLD, when any were.
+    ...(longPrompt ? { long_prompt: longPrompt } : {}),
     cost_usd: null,
     duration_ms: durationMs,
     phase,
@@ -938,6 +944,7 @@ function readUsageFromTranscript(transcriptPath, sessionId, sinceLine = 0) {
     totals.cache_read_input_tokens += extractNumber(usage, 'cache_read_input_tokens');
     totals.cache_creation_input_tokens += extractNumber(usage, 'cache_creation_input_tokens');
     addCacheTtlSplit(totals, usage);
+    addLongPrompt(totals, usage);
   }
   totals.lineCount = seen;
   return totals;
@@ -958,6 +965,29 @@ function addCacheTtlSplit(totals, usage) {
   totals.cache_write_5m_tokens = (totals.cache_write_5m_tokens || 0) + extractNumber(cc, 'ephemeral_5m_input_tokens');
 }
 
+// Haiku 5.5 bills a request whose prompt (input plus cache reads and writes) is over
+// this many tokens at higher rates, request by request. A row sums many requests, so
+// the tokens of those over it are kept apart as `long_prompt`, and the read side
+// (lib/cost.cjs computeCost) prices them at the model's long rate. A copy of
+// LONG_PROMPT_THRESHOLD in lib/cost.cjs: hooks require nothing from lib, and
+// tests/cost-long-prompt.test.cjs pins the two equal.
+const LONG_PROMPT_THRESHOLD = 100000;
+
+/** Add one request's usage to `totals.long_prompt` when its prompt is over the threshold. */
+function addLongPrompt(totals, usage) {
+  const inp = extractNumber(usage, 'input_tokens');
+  const cr = extractNumber(usage, 'cache_read_input_tokens');
+  const cw = extractNumber(usage, 'cache_creation_input_tokens');
+  if (inp + cr + cw <= LONG_PROMPT_THRESHOLD) return;
+  const lp = totals.long_prompt || (totals.long_prompt = { above: LONG_PROMPT_THRESHOLD, input_tokens: 0, output_tokens: 0, cache_read_tokens: 0, cache_write_tokens: 0, cache_write_1h_tokens: 0 });
+  lp.input_tokens += inp;
+  lp.output_tokens += extractNumber(usage, 'output_tokens');
+  lp.cache_read_tokens += cr;
+  lp.cache_write_tokens += cw;
+  const cc = usage && usage.cache_creation;
+  if (cc && typeof cc === 'object') lp.cache_write_1h_tokens += extractNumber(cc, 'ephemeral_1h_input_tokens');
+}
+
 /**
  * Append record to .planning/metrics/tokens.jsonl. Silently succeeds
  * even if the file or directory can't be written — hook must not block.

package/hooks/dist/pan-guard.js

@@ -0,0 +1,244 @@
+#!/usr/bin/env node
+'use strict';
+// PAN guard — a pre-tool hook (program A7).
+//
+// Registered on the hosts with a pre-tool event that can deny a call: Claude Code
+// and Codex (`PreToolUse`), Gemini CLI (`BeforeTool`) and Copilot CLI (`preToolUse`).
+// OpenCode registers no hooks. The command carries `--host <runtime>`, because the
+// payload and the way to deny differ per host.
+//
+// Rules, over the files a tool call is about to write:
+//   secret_write          the written text holds a credential (known token shapes,
+//                         or a long key=value secret)
+//   state_write           a direct write to PAN's own state: state.md, findings.jsonl,
+//                         the token ledger (pan-tools owns those)
+//   undeclared_test_edit  a test file the phase in flight does not declare in any
+//                         unfinished plan's files_modified
+//
+// Mode, from the planning tree's config.json `hooks.guard`:
+//   off      nothing
+//   report   (default) every match is appended to <planning>/guard.jsonl, the call proceeds
+//   enforce  as report, and a secret_write is denied; the other rules still only report
+//            until the writers of PAN's state go through pan-tools verbs (A7b)
+//
+// Inert outside a PAN project. Fail-open on anything it cannot parse; never fail-open
+// on a matched deny. Never writes outside the planning tree.
+
+const fs = require('fs');
+const path = require('path');
+
+const TOKEN_RE = /\b(?:sk-ant-[A-Za-z0-9_-]{10,}|sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{30,}|-----BEGIN (?:RSA |EC |OPENSSH |)PRIVATE KEY-----)/;
+const SECRET_KV_RE = /\b(api[_-]?key|access[_-]?token|auth[_-]?token|refresh[_-]?token|client[_-]?secret|secret[_-]?key|password|passwd)\b["']?\s*[:=]\s*["']([^"'\s]{12,})["']/i;
+const TEST_PATH_RE = /(^|\/)(tests?|__tests__|specs?)\//i;
+const TEST_FILE_RE = /(\.(test|spec)\.[a-z0-9]+|(^|\/)test_[^/]+\.py|_test\.(py|go)|Tests?\.(java|kt|cs))$/i;
+const MODES = ['off', 'report', 'enforce'];
+
+// ─── R39: one run per hook when Claude and Copilot share a project ───────────
+// Copilot CLI also runs the hooks in a repository's .claude/settings.json and
+// .claude/settings.local.json. Measured 2026-09-26 (Copilot CLI 1.0.88, repository
+// hooks loaded): in a project with both the Claude and the Copilot install, every
+// PAN hook ran twice under Copilot — once from .github/hooks/pan.json, once from the
+// Claude settings. The Copilot project copy (this file under .github/hooks) steps
+// aside whenever the project's Claude settings register the same script, so the hook
+// runs once, and runs again from here the moment the Claude registration is gone.
+// Both files are repository hooks to Copilot and load under the same trust rule, so
+// deferring never leaves zero. Only this copy defers: Claude Code never reads
+// .github/hooks, Gemini and Codex never read .claude/settings.json, and a global
+// Copilot copy loads where repository hooks may not. Identical in every hook
+// Copilot registers — tests/copilot-hook-dedupe.test.cjs pins the copies.
+function deferToClaudeRegistration(projectDir, hookFile = __filename) {
+  // Assembled, not written as a literal: the installer rewrites every quoted .claude
+  // literal in a hook copy to that runtime's own directory, and this one must stay Claude's.
+  const claudeDir = ['.', 'claude'].join('');
+  try {
+    const hooksDir = path.dirname(hookFile);
+    if (path.basename(hooksDir) !== 'hooks' || path.basename(path.dirname(hooksDir)) !== '.github') return false;
+    if (typeof projectDir !== 'string' || !projectDir) return false;
+    const script = path.basename(hookFile);
+    for (const name of ['settings.json', 'settings.local.json']) {
+      let settings;
+      try { settings = JSON.parse(fs.readFileSync(path.join(projectDir, claudeDir, name), 'utf8')); } catch { continue; }
+      const events = settings && typeof settings.hooks === 'object' ? settings.hooks : null;
+      if (!events) continue;
+      for (const groups of Object.values(events)) {
+        if (!Array.isArray(groups)) continue;
+        for (const group of groups) {
+          const handlers = group && Array.isArray(group.hooks) ? group.hooks : [];
+          if (handlers.some((h) => h && typeof h.command === 'string' && h.command.includes(script))) return true;
+        }
+      }
+    }
+  } catch { /* fail open: run this copy */ }
+  return false;
+}
+
+
+function planningDirName() {
+  const raw = process.env.PAN_PLANNING_DIR || '';
+  if (raw.trim()) {
+    const rel = raw.trim().replace(/\\/g, '/');
+    const bad = rel.startsWith('/') || /^[A-Za-z]:/.test(rel) || rel.split('/').includes('..');
+    if (!bad) return rel;
+  }
+  const track = (process.env.PAN_TRACK || '').trim();
+  if (track && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(track)) return `.planning/tracks/${track}`;
+  return '.planning';
+}
+
+function readJson(p) {
+  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return null; }
+}
+
+/** A value that is a placeholder, not a credential. */
+function isPlaceholder(v) {
+  return /^(?:\$\{|\$[A-Z_]|process\.env|os\.environ|<|xxx|your[_-]|changeme|example|dummy|placeholder|redacted|\*+$)/i.test(v);
+}
+
+function hasSecret(text) {
+  if (typeof text !== 'string' || !text) return false;
+  if (TOKEN_RE.test(text)) return true;
+  const m = text.match(SECRET_KV_RE);
+  return !!(m && !isPlaceholder(m[2]) && /\d/.test(m[2]) && /[A-Za-z]/.test(m[2]));
+}
+
+/**
+ * The tool call as `{tool, writes: [{path, text}], command}`, whatever the host.
+ * Claude/Codex/Gemini send `tool_name` + `tool_input`; Copilot sends `toolName` +
+ * `toolArgs` (a JSON string).
+ */
+function normalise(payload) {
+  const p = payload && typeof payload === 'object' ? payload : {};
+  const tool = String(p.tool_name || p.toolName || p.tool || '');
+  let input = p.tool_input || p.toolArgs || p.input || {};
+  if (typeof input === 'string') { try { input = JSON.parse(input); } catch { input = { command: input }; } }
+  if (!input || typeof input !== 'object') input = {};
+  const writes = [];
+  const file = input.file_path || input.filePath || input.path || input.notebook_path || input.absolute_path;
+  const texts = [input.content, input.new_string, input.newString, input.new_source, input.file_text, input.text]
+    .concat(Array.isArray(input.edits) ? input.edits.map((e) => e && (e.new_string || e.newString)) : [])
+    .filter((t) => typeof t === 'string');
+  if (typeof file === 'string' && file && (texts.length || /write|edit|create|replace|notebook/i.test(tool))) {
+    writes.push({ path: file, text: texts.join('\n') });
+  }
+  const command = typeof input.command === 'string' ? input.command : (Array.isArray(input.command) ? input.command.join(' ') : '');
+  // Codex edits files through apply_patch: the patch names its files and carries the text.
+  if (/\*\*\* (?:Add|Update) File: /.test(command)) {
+    let cur = null;
+    for (const line of command.split(/\r?\n/)) {
+      const m = line.match(/^\*\*\* (?:Add|Update) File: (.+)$/);
+      if (m) { cur = { path: m[1].trim(), text: '' }; writes.push(cur); continue; }
+      if (cur && line.startsWith('+')) cur.text += line.slice(1) + '\n';
+    }
+  }
+  return { tool, writes, command };
+}
+
+/** Project-relative POSIX path, or null when the path is outside the project. */
+function rel(projectDir, p) {
+  const abs = path.resolve(projectDir, p);
+  const r = path.relative(projectDir, abs).replace(/\\/g, '/');
+  return r.startsWith('..') || path.isAbsolute(r) ? null : r;
+}
+
+function isTestFile(r) {
+  return TEST_PATH_RE.test(r) || TEST_FILE_RE.test(r);
+}
+
+/** files_modified of the unfinished plans of the phase state.md names, or null when none is in flight. */
+function declaredFiles(projectDir, planningRel) {
+  let state;
+  try { state = fs.readFileSync(path.join(projectDir, planningRel, 'state.md'), 'utf8'); } catch { return null; }
+  const m = state.match(/\*\*Current Phase:\*\*[ \t]*([0-9]+(?:\.[0-9]+)?)/i) || state.match(/^Phase:[ \t]*([0-9]+(?:\.[0-9]+)?)/m);
+  if (!m) return null;
+  const want = String(parseFloat(m[1]));
+  const phasesDir = path.join(projectDir, planningRel, 'phases');
+  let dir;
+  try { dir = fs.readdirSync(phasesDir).find((d) => { const n = d.match(/^(\d+(?:\.\d+)?)-/); return n && String(parseFloat(n[1])) === want; }); } catch { return null; }
+  if (!dir) return null;
+  const full = path.join(phasesDir, dir);
+  const names = fs.readdirSync(full);
+  const done = new Set(names.filter((n) => n.endsWith('-summary.md')).map((n) => n.replace(/-summary\.md$/, '')));
+  const out = new Set();
+  let plans = 0;
+  for (const n of names.filter((x) => x.endsWith('-plan.md'))) {
+    if (done.has(n.replace(/-plan\.md$/, ''))) continue;
+    plans++;
+    const text = fs.readFileSync(path.join(full, n), 'utf8').replace(/\r\n/g, '\n');
+    const fm = text.match(/^---\n([\s\S]*?)\n---/);
+    if (!fm) continue;
+    const inline = fm[1].match(/^files_modified:[ \t]*\[([^\]]*)\]/m);
+    if (inline) inline[1].split(',').map((s) => s.trim().replace(/^["']|["']$/g, '')).filter(Boolean).forEach((f) => out.add(f.replace(/^\.\//, '')));
+    const block = fm[1].match(/^files_modified:[ \t]*\n((?:[ \t]+-.*\n?)+)/m);
+    if (block) block[1].split('\n').map((l) => l.replace(/^[ \t]+-[ \t]*/, '').trim().replace(/^["']|["']$/g, '')).filter(Boolean).forEach((f) => out.add(f.replace(/^\.\//, '')));
+  }
+  return plans ? out : null;
+}
+
+/** The rule matches for one normalised call. */
+function evaluate(call, projectDir, planningRel) {
+  const hits = [];
+  const declared = call.writes.length ? declaredFiles(projectDir, planningRel) : null;
+  const ownState = new Set([`${planningRel}/state.md`, `${planningRel}/findings.jsonl`, `${planningRel}/metrics/tokens.jsonl`]);
+  for (const w of call.writes) {
+    const r = rel(projectDir, w.path);
+    if (hasSecret(w.text)) hits.push({ rule: 'secret_write', path: r || w.path });
+    if (!r) continue;
+    if (ownState.has(r)) hits.push({ rule: 'state_write', path: r });
+    if (declared && isTestFile(r) && !declared.has(r)) hits.push({ rule: 'undeclared_test_edit', path: r });
+  }
+  return hits;
+}
+
+function decide(hits, mode) {
+  if (mode !== 'enforce') return null;
+  return hits.find((h) => h.rule === 'secret_write') || null;
+}
+
+/** The host whose deny format this call needs: Copilot by payload shape, else the --host flag. */
+function hostOf(payload, flagHost) {
+  const p = payload && typeof payload === 'object' ? payload : {};
+  if (typeof p.toolName === 'string' && p.tool_name === undefined) return 'copilot';
+  return flagHost;
+}
+
+function main() {
+  const flagHost = (process.argv[process.argv.indexOf('--host') + 1] || 'claude').toLowerCase();
+  let raw = '';
+  try { raw = fs.readFileSync(0, 'utf8'); } catch { return; }
+  let payload;
+  try { payload = JSON.parse(raw); } catch { return; } // fail open
+  const projectDir = (payload && (payload.cwd || payload.workspace || payload.project_dir)) || process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  if (deferToClaudeRegistration(projectDir)) return; // the Claude registration covers this call under Copilot
+  // The payload names the host better than the registration does: Copilot sends its own
+  // camelCase payload (toolName, toolArgs) even to a hook registered in .claude/settings.json,
+  // and denies only on the JSON decision, so a Copilot payload gets Copilot's deny whatever
+  // --host says. The flag decides for the snake_case hosts (Claude Code, Codex, Gemini).
+  const host = hostOf(payload, flagHost);
+  const planningRel = planningDirName();
+  const planning = path.join(projectDir, planningRel);
+  if (!fs.existsSync(planning)) return; // not a PAN project
+  const cfg = readJson(path.join(planning, 'config.json')) || {};
+  const mode = MODES.includes(cfg.hooks && cfg.hooks.guard) ? cfg.hooks.guard : 'report';
+  if (mode === 'off') return;
+  let hits = [];
+  try { hits = evaluate(normalise(payload), projectDir, planningRel); } catch { return; } // fail open
+  if (!hits.length) return;
+  const deny = decide(hits, mode);
+  try {
+    const ts = new Date().toISOString();
+    const lines = hits.map((h) => JSON.stringify({ ts, host, mode, rule: h.rule, path: h.path, tool: normalise(payload).tool, action: deny && h === deny ? 'denied' : 'reported' }));
+    fs.appendFileSync(path.join(planning, 'guard.jsonl'), lines.join('\n') + '\n');
+  } catch { /* the log is best effort; a deny below still stands */ }
+  if (!deny) return;
+  const reason = `PAN guard: this write puts a credential into ${deny.path}. Keep secrets out of the repository (an environment variable or a local, ignored file), then retry. (hooks.guard: enforce)`;
+  if (host === 'copilot') {
+    process.stdout.write(JSON.stringify({ permissionDecision: 'deny', permissionDecisionReason: reason }) + '\n');
+    return;
+  }
+  process.stderr.write(reason + '\n');
+  process.exitCode = 2;
+}
+
+if (require.main === module) main();
+
+module.exports = { normalise, evaluate, decide, hasSecret, declaredFiles, isTestFile, hostOf, deferToClaudeRegistration };

package/hooks/dist/pan-statusline.js

@@ -13,7 +13,7 @@ const os = require('os');
  *
  * @param {Object} data - Parsed stdin JSON from Claude Code.
  * @param {Object} [deps] - Optional dep injection for testing.
- *   {fs, path, homeDir, tmpDir} — defaults to real modules + OS paths.
+ *   {fs, path, homeDir, tmpDir, configDir} — defaults to real modules + OS paths (configDir: CLAUDE_CONFIG_DIR, ignored when homeDir is given).
  * @returns {string} The statusline content.
  */
 function buildStatuslineOutput(data, deps) {
@@ -30,6 +30,54 @@ function buildStatuslineOutput(data, deps) {
   const session = data.session_id || '';
   const remaining = data.context_window?.remaining_percentage;
 
+  // The per-user 0700 bridge directory, or null when it is not safe to write into.
+  // Mirrors bridgeDir() in pan-context-monitor.js (the reader).
+  let bridgeSubdirMemo;
+  const secureBridgeDir = () => {
+    if (bridgeSubdirMemo !== undefined) return bridgeSubdirMemo;
+    bridgeSubdirMemo = null;
+    const uid = (typeof process.getuid === 'function' ? process.getuid() : process.env.USERNAME || 'win');
+    const sub = pathMod.join(tmpDir, `pan-hooks-${uid}`);
+    // Fail CLOSED if the per-user dir is pre-planted/symlinked/owned by someone
+    // else: mkdirSync{recursive} silently no-ops on an existing dir, so verify
+    // ownership+mode before writing (M60).
+    try {
+      fsMod.mkdirSync(sub, { recursive: true, mode: 0o700 });
+      const st = fsMod.lstatSync(sub);
+      // Symlink check is cross-platform; POSIX ownership/mode checks apply only
+      // where getuid exists (Windows fakes mode bits; gating on them there
+      // disabled the bridge entirely, N15).
+      let secure = !st.isSymbolicLink();
+      if (secure && typeof process.getuid === 'function') {
+        secure = st.uid === process.getuid() && (st.mode & 0o077) === 0;
+      }
+      if (secure) bridgeSubdirMemo = sub;
+    } catch { /* not safe */ }
+    return bridgeSubdirMemo;
+  };
+
+  // Usage limits (Claude Code subscriptions: `rate_limits.five_hour` / `seven_day`).
+  // Account-wide, so one file for every session; `pan-tools cost limits` and the
+  // focus-auto weekly stop read it. Written only when the host sent the block.
+  const limits = data.rate_limits && typeof data.rate_limits === 'object' ? data.rate_limits : null;
+  const limitWin = (w) => (w && Number.isFinite(Number(w.used_percentage))
+    ? { used_percentage: Number(w.used_percentage), ...(Number.isFinite(Number(w.resets_at)) ? { resets_at: Number(w.resets_at) } : {}) }
+    : null);
+  const fiveHour = limits ? limitWin(limits.five_hour) : null;
+  const sevenDay = limits ? limitWin(limits.seven_day) : null;
+  if ((fiveHour || sevenDay) && d.skipBridge !== true) {
+    try {
+      const sub = secureBridgeDir();
+      if (sub) {
+        fsMod.writeFileSync(pathMod.join(sub, 'claude-limits.json'), JSON.stringify({
+          ...(fiveHour ? { five_hour: fiveHour } : {}),
+          ...(sevenDay ? { seven_day: sevenDay } : {}),
+          timestamp: Math.floor(Date.now() / 1000),
+        }), { mode: 0o600 });
+      }
+    } catch { /* best-effort */ }
+  }
+
   // Context window bar — shows USED percentage scaled so 80% real = 100% shown.
   let ctx = '';
   if (remaining != null) {
@@ -39,34 +87,23 @@ function buildStatuslineOutput(data, deps) {
 
     if (session && d.skipBridge !== true) {
       try {
-        // Write the bridge file into a per-user 0700 subdir so another user on
+        // The session bridge goes into the per-user 0700 subdir so another user on
         // a shared host can't symlink-attack the predictable session path.
-        // Mirrors bridgeDir() in pan-context-monitor.js (the reader).
-        const uid = (typeof process.getuid === 'function' ? process.getuid() : process.env.USERNAME || 'win');
-        const bridgeSubdir = pathMod.join(tmpDir, `pan-hooks-${uid}`);
-        // Fail CLOSED if the per-user dir is pre-planted/symlinked/owned by
-        // someone else — mkdirSync{recursive} silently no-ops on an existing dir,
-        // so verify ownership+mode before writing the session bridge (M60).
-        let secure = false;
-        try {
-          fsMod.mkdirSync(bridgeSubdir, { recursive: true, mode: 0o700 });
-          const st = fsMod.lstatSync(bridgeSubdir);
-          // Symlink check is cross-platform; POSIX ownership/mode checks apply
-          // only where getuid exists (Windows fakes mode bits — gating on them
-          // there disabled the bridge entirely, N15).
-          secure = !st.isSymbolicLink();
-          if (secure && typeof process.getuid === 'function') {
-            secure = st.uid === process.getuid() && (st.mode & 0o077) === 0;
-          }
-        } catch { secure = false; }
-        if (secure) {
+        const bridgeSubdir = secureBridgeDir();
+        if (bridgeSubdir) {
           const bridgePath = pathMod.join(bridgeSubdir, `claude-ctx-${session}.json`);
+          // Token counts and the model id let the context monitor measure against
+          // the window the host compacts at, not the model window (O7).
+          const cw = data.context_window || {};
           fsMod.writeFileSync(bridgePath, JSON.stringify({
             session_id: session,
             remaining_percentage: remaining,
             used_pct: used,
+            ...(Number.isFinite(cw.total_input_tokens) ? { total_input_tokens: cw.total_input_tokens } : {}),
+            ...(Number.isFinite(cw.context_window_size) ? { context_window_size: cw.context_window_size } : {}),
+            ...(data.model && data.model.id ? { model_id: data.model.id } : {}),
             timestamp: Math.floor(Date.now() / 1000),
-          }));
+          }), { mode: 0o600 });
         }
       } catch { /* bridge is best-effort */ }
     }
@@ -118,7 +155,10 @@ function buildStatuslineOutput(data, deps) {
 
   // Current task from todos
   let task = '';
-  const todosDir = pathMod.join(homeDir, '.claude', 'todos');
+  // Claude Code keeps its todos in CLAUDE_CONFIG_DIR when that is set (a given
+  // homeDir is a test seam and ignores it).
+  const configDir = d.configDir !== undefined ? d.configDir : (d.homeDir ? '' : (process.env.CLAUDE_CONFIG_DIR || ''));
+  const todosDir = configDir ? pathMod.join(configDir, 'todos') : pathMod.join(homeDir, '.claude', 'todos');
   let todosExists = false;
   try { todosExists = fsMod.statSync(todosDir).isDirectory(); } catch { /* missing */ }
   if (session && todosExists) {
@@ -154,7 +194,16 @@ function buildStatuslineOutput(data, deps) {
   const head = `${panUpdate}\x1b[2m${model}\x1b[0m`;
   const taskSegment = task ? ` │ \x1b[1m${task}\x1b[0m` : '';
   const dirSegment = ` │ \x1b[2m${dirname}\x1b[0m`;
-  return `${head}${taskSegment}${dirSegment}${ctx}${cacheBadge}${thinkingBadge}`;
+  // Usage-limit badge: the window closer to its cap, green below 70%, yellow below
+  // 90%, red from 90% (focus-auto's default weekly stop).
+  let limitBadge = '';
+  const shown = [fiveHour && ['5h', fiveHour.used_percentage], sevenDay && ['7d', sevenDay.used_percentage]].filter(Boolean);
+  if (shown.length) {
+    const worst = Math.max(...shown.map(([, v]) => v));
+    const color = worst >= 90 ? '' : worst >= 70 ? '' : '';
+    limitBadge = ` ${color}${shown.map(([k, v]) => `${k} ${Math.round(v)}%`).join(' · ')}`;
+  }
+  return `${head}${taskSegment}${dirSegment}${ctx}${cacheBadge}${thinkingBadge}${limitBadge}`;
 }
 
 // ─── Stdin driver ───────────────────────────────────────────────────────────

package/hooks/dist/pan-stop-guard.js

@@ -73,6 +73,10 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 
+// The CLI the block reason tells the agent to run. Installs and the plugin put the
+// core beside hooks/; no `pan-tools` bin is on PATH.
+const PAN_TOOLS = `node "${path.join(__dirname, '..', 'pan-wizard-core', 'bin', 'pan-tools.cjs').split(path.sep).join('/')}"`;
+
 // ─── R39: one run per hook when Claude and Copilot share a project ───────────
 // Copilot CLI also runs the hooks in a repository's .claude/settings.json and
 // .claude/settings.local.json. Measured 2026-09-26 (Copilot CLI 1.0.88, repository
@@ -205,8 +209,9 @@ function buildStopDecision({ stopHookActive, config, stateContent, roadmapConten
       `Continue the chain now: if the current phase is finished, follow transition.md's ` +
       `offer_next_phase Route A and spawn Phase ${nextPhase} as a Task subagent ` +
       `(plan-phase orchestrator, ARGUMENTS='${nextPhase} --auto'); if the current phase is ` +
-      `mid-flight, resume it instead. If the user explicitly asked to stop, first run: ` +
-      `pan-tools config-set workflow.auto_advance false — then stop. ` +
+      `mid-flight, resume it instead. If the user explicitly asked to stop, first run ` +
+      `\`${PAN_TOOLS} config-set workflow.auto_advance false\` (under mode: yolo, which arms this ` +
+      `guard by itself, set \`workflow.stop_guard false\` the same way instead) — then stop. ` +
       `(Disable this guard permanently with workflow.stop_guard: false.)`
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pan-wizard",
-  "version": "3.33.0",
+  "version": "3.35.0",
   "description": "Command a bot army for your codebase: a reasoning-tier Mission Control delegates whole-project goals to specialist squads and ships behind a human merge gate. Five AI CLIs, zero context rot.",
   "bin": {
     "pan-wizard": "bin/install.js"

package/pan-wizard-core/bin/lib/agents-md.cjs

@@ -82,19 +82,56 @@ function removeAgentsMdSection(existing) {
 }
 
 /**
- * Ensure CLAUDE.md bridges to AGENTS.md via a marker-fenced @AGENTS.md import
- * (Claude Code's documented pattern for adopting the universal rules file).
- * Idempotent; preserves all user content.
+ * PAN's block in CLAUDE.md: the @AGENTS.md import, and Claude Code's "Compact
+ * instructions" section (memory optimisation O8). Claude Code reads a section of
+ * that name in the project-root CLAUDE.md when it summarises a conversation, and
+ * re-reads CLAUDE.md from disk after compaction. The section names what the summary
+ * must keep for PAN work to resume where it stopped.
+ *
+ * Codex is deliberately left out: its `compact_prompt` replaces the built-in
+ * compaction prompt rather than adding to it, and the default OpenAI provider
+ * ignores it (read 2026-10-04), so PAN would be swapping a tuned prompt for one
+ * that may never run. PAN's state re-injection after compaction covers Codex.
+ */
+function buildClaudeMdBridge() {
+  return [
+    PAN_AGENTS_BEGIN,
+    '@AGENTS.md',
+    '',
+    '# Compact instructions',
+    '',
+    'When this conversation is compacted, keep what PAN work needs to resume where it stopped:',
+    '- the current phase and plan, and the task in progress with its stopping point (`.planning/state.md` records them; keep that path);',
+    '- decisions made in this session that `.planning/state.md` does not yet hold;',
+    '- the files changed since the last commit.',
+    'Leave out file contents and command output: they can be read again.',
+    PAN_AGENTS_END,
+  ].join('\n');
+}
+
+/**
+ * Ensure CLAUDE.md carries PAN's block: the marker-fenced @AGENTS.md import
+ * (Claude Code's documented pattern for adopting the universal rules file) and
+ * the compact instructions. Idempotent; preserves all user content. An older PAN
+ * bridge (the import alone) is replaced in place, so a reinstall or `memory
+ * rebuild` brings existing projects up to date.
  * @param {string|null} existing - Current CLAUDE.md content, or null if absent
  * @returns {string} New file content
  */
 function ensureClaudeMdImport(existing) {
-  const block = `${PAN_AGENTS_BEGIN}\n@AGENTS.md\n${PAN_AGENTS_END}`;
+  const block = buildClaudeMdBridge();
   if (!existing || !existing.trim()) {
     return block + '\n';
   }
-  if (existing.includes(PAN_AGENTS_BEGIN)) {
-    return existing; // bridge (or another PAN block) already present
+  const beginIdx = existing.indexOf(PAN_AGENTS_BEGIN);
+  const endIdx = existing.indexOf(PAN_AGENTS_END);
+  if (beginIdx !== -1) {
+    // PAN's own bridge: bring it up to date. Any other PAN block is left alone.
+    if (endIdx > beginIdx && /^@AGENTS\.md\s*$/m.test(existing.slice(beginIdx, endIdx))) {
+      const eol = existing.includes('\r\n') ? '\r\n' : '\n';
+      return existing.slice(0, beginIdx) + block.replace(/\n/g, eol) + existing.slice(endIdx + PAN_AGENTS_END.length);
+    }
+    return existing;
   }
   if (/^@AGENTS\.md\s*$/m.test(existing)) {
     return existing; // user already imports AGENTS.md themselves
@@ -118,6 +155,7 @@ module.exports = {
   buildAgentsMdSection,
   upsertAgentsMdSection,
   removeAgentsMdSection,
+  buildClaudeMdBridge,
   ensureClaudeMdImport,
   removeClaudeMdImport,
 };

package/pan-wizard-core/bin/lib/bridge.cjs

@@ -23,8 +23,9 @@
  *     ]
  *   }
  *
- * Populating this file is the host runtime's responsibility (Claude Code's
- * MCP list API, etc.). This module reads the cache and reasons over it.
+ * Nothing populates this file on its own: no hook or host writes it.
+ * `bridge cache --servers <json>` (or an external script) seeds it; this module
+ * reads the cache and reasons over it.
  */
 
 const fs = require('fs');
@@ -184,7 +185,7 @@ function recommendForPhase(cwd, phaseNum, opts) {
       phase: String(phaseNum),
       runtime: cache.runtime,
       recommendations: [],
-      reason: 'no MCP tools cached — run `pan-tools bridge cache` or ensure host runtime populates .planning/bridge/available-tools.json',
+      reason: 'no MCP tools cached — seed .planning/bridge/available-tools.json with `pan-tools bridge cache --servers <json>`; no hook or host writes it',
     };
   }
 
@@ -240,8 +241,8 @@ function cmdBridgeRecommend(cwd, phaseNum, opts, raw) {
 }
 
 function cmdBridgeCache(cwd, serversJson, runtime, raw) {
-  // For scripted cache writes. Normally the host runtime writes the file,
-  // but this CLI path lets users seed it for testing or from external scripts.
+  // The cache's only writer: no hook or host runtime populates the file, so this
+  // CLI path (or an external script) is how users seed it.
   if (!serversJson) {
     // No payload — just echo the current cache path/state.
     output(listTools(cwd), raw);

package/pan-wizard-core/bin/lib/campaign.cjs

@@ -66,12 +66,14 @@ function writeScheduleFile(cwd, schedule) {
  * @returns {object|{error}} the written descriptor
  */
 function writeSchedule(cwd, opts, now) {
-  const cadence = opts.cadence || 'daily';
+  // An update keeps the stored cadence like every other field: `--pause` on an
+  // hourly campaign used to set it back to daily.
+  const existing = readSchedule(cwd) || {};
+  const cadence = opts.cadence || existing.cadence || 'daily';
   if (parseCadence(cadence) === null) {
     return { error: `Invalid cadence "${cadence}". Use hourly | daily | weekly | Nh | Nd.` };
   }
   const at = now || new Date();
-  const existing = readSchedule(cwd) || {};
   const schedule = {
     goal: opts.goal ?? existing.goal ?? null,
     source: opts.source ?? existing.source ?? 'backlog',

package/pan-wizard-core/bin/lib/commands-learnings.cjs

@@ -299,6 +299,23 @@ function formatLearningEntry(learning) {
   return lines.join('\n');
 }
 
+/**
+ * A summary's `key-files` as one list. The summary templates write `{created, modified}`;
+ * older summaries carry a flat list. Only the flat list was read, so summaries PAN writes
+ * gave no co-change learnings, and one beside a flat-list summary crashed on `.includes`.
+ * @param {Object} fm - Summary frontmatter
+ * @returns {string[]}
+ */
+function keyFileList(fm) {
+  const kf = fm['key-files'] || fm.key_files;
+  if (Array.isArray(kf)) return kf.map(String);
+  if (kf && typeof kf === 'object') {
+    const list = (v) => (Array.isArray(v) ? v : (v ? [v] : []));
+    return [...new Set([...list(kf.created), ...list(kf.modified)].map(String))];
+  }
+  return [];
+}
+
 /**
  * Extract learnings from session summaries and error patterns.
  * Reads session history + error patterns, extracts file co-change patterns
@@ -347,7 +364,7 @@ function cmdLearningsExtract(cwd, raw) {
   const fileCoChanges = new Map(); // file -> Set of co-changed files
 
   for (const { frontmatter } of summaries) {
-    const keyFiles = Array.isArray(frontmatter['key-files']) ? frontmatter['key-files'] : [];
+    const keyFiles = keyFileList(frontmatter);
     if (keyFiles.length < 2) continue;
     for (const file of keyFiles) {
       if (!fileCoChanges.has(file)) fileCoChanges.set(file, new Set());
@@ -368,7 +385,7 @@ function cmdLearningsExtract(cwd, raw) {
       // Count co-occurrences
       let count = 0;
       for (const { frontmatter } of summaries) {
-        const kf = frontmatter['key-files'] || [];
+        const kf = keyFileList(frontmatter);
         if (kf.includes(file) && kf.includes(coFile)) count++;
       }
       if (count < 2) continue;