[jefft72]

Summary

Builds the complete AgentSession workflow on top of persisted native-plan state, including collaboration-mode transitions, restricted planning tools, plan submission events, durable resolution, and an exact one-shot implementation continuation.
Also serializes prompt preparation, extension commands, runtime mutations, and replacement reservations so queued or concurrent work cannot cross a terminal plan submission or session handoff boundary.

Reasoning

Plan mode is a capability boundary, not only a system-prompt variation.
Custom tools, same-name overrides, extension interception, queued prompts, and mutable runtime settings must not reopen write paths while the model is expected to inspect context and produce a plan only.

Accepting a plan must likewise create one authoritative implementation turn.
The session needs to preserve that turn through failures and reloads, prevent competing input from overtaking it, and consume it only after the exact user message has entered durable history.

Changes

• Restores collaboration mode, a pending plan, and an accepted continuation from session history, while allowing callers to select and persist an initial mode when no incompatible lifecycle state exists.
• Adds public collaboration, plan-submission, and plan-resolution events plus guarded accessors for the active mode, pending artifact, and one-shot continuation.
• Maintains a separate plan-mode tool registry containing only canonical built-in read, grep, find, and ls implementations allowed by policy, together with the intrinsic submit_plan tool.
• Prevents custom or embedding-provided same-name tools and extension tool-call or tool-result hooks from being treated as trusted plan-mode inspection capabilities.
• Rebuilds the system prompt for the active collaboration mode with explicit planning rules, the exact available tool set, and no suggestion that additional custom tools may be present.
• Updates SDK and service-based session creation to propagate collaboration mode and to apply tools, excludeTools, noTools: "all", and noTools: "builtin" consistently without suppressing intrinsic plan submission.
• Stops the agent after a successful submit_plan, clears queued and post-run work, permits failed submissions to be repaired, and prevents retry or continuation logic from running past terminal submission.
• Resolves plans only while the session is stable, rolls back mode and tool state if persistence fails, clears stale queues, and returns a frozen implementation continuation only for an implement resolution.
• Submits accepted continuations through a trusted path that bypasses input and message-replacement interception, freezes the exact initial user message, and restores the same continuation if that message is not persisted.
• Adds prompt-preflight, extension-command, runtime-mutation, and replacement leases so replacement cannot overlap model changes, compaction, reload, navigation, bash, or queue mutations, and plan resolution cannot overtake prompt preparation.

Testing

• Final rebased stack: npm run check passed.
• Final rebased stack: focused Vitest validation across 28 affected files passed all 451 tests.
• This intermediate branch was not checked independently after reconstruction.

[jefft72]

Closing to rebuild on a clean base.

This stack does not build. Two separate defects are present, and the first masks the second:

1. A stray closing brace committed in feat: enforce native plan collaboration policy #64 stops packages/coding-agent/src/core/agent-session.ts from parsing at all.
2. From feat: activate accepted plans in routed sessions #65 onward the stack imports five modules that exist only on the task profile stack: evolved.ts, harness-descriptors.ts, profile-router.ts, profiles.ts, and runtime-telemetry.ts.

Replacement stacks:

• plan/* for native plan mode standing alone on main
• plan-harness/* for the plan and profile integration

The branch behind this PR is retained unchanged as a backup.