[jefft72]

Summary

Adds a focused AgentSession integration suite for native plan mode using the faux provider and real session, tool, extension, queue, and persistence boundaries.
The coverage exercises both the expected planning workflow and the failure or concurrency paths that could otherwise leak mutation capabilities, lose an accepted continuation, or deliver stale input after submission.

Reasoning

The core plan invariants depend on event ordering across asynchronous input hooks, agent turns, queues, persistence, extension commands, and public session mutations.
Isolated schema tests cannot prove that the canonical tool boundary remains intact or that a terminal plan submission wins races against prompts already in preflight.

Accepted continuations also need durable exactly-once behavior rather than best-effort delivery.
The suite verifies that the same authorization survives restart and write failure, remains protected from extension rewriting, and is consumed only by its persisted user turn.

Changes

• Extends the shared test harness with collaboration-mode selection, built-in tool exclusions, injected session managers, and the configuration needed to restore plan-aware sessions.
• Verifies that plan mode exposes only canonical built-in inspection tools plus submit_plan, intersects those reads with allow and deny policies, and never certifies custom or embedding-provided impostor tools.
• Proves that extension tool interception and unavailable mutating tools cannot execute or alter protected files during plan-mode tool calls.
• Covers prompt-preflight, extension-command, and runtime-replacement leases across mode changes, plan resolution, model settings, navigation, compaction, reload, bash execution, and nested command-owned replacement.
• Exercises FIFO prompt preflight ordering and confirms that terminal submission discards prompts waiting behind the planning run without allowing later input to overtake earlier work.
• Verifies that queued follow-ups and next-turn context block mode changes and branch navigation so plan-era input cannot cross into a different collaboration branch.
• Covers repairable validation failures, replacement plan drafts, terminal agent and retry shutdown after successful submission, and queue clearing after the final plan is accepted by the tool.
• Injects persistence failures into mode changes, plan resolution, and continuation user-message writes to verify rollback, retryability, and preservation of the authoritative continuation token.
• Confirms that trusted continuations bypass input handling and message replacement, retain their exact frozen user content, still enter the normal agent-start lifecycle, and cannot be submitted twice.
• Restores pending continuations from session history, rejects competing prompts and mode changes until persistence, and verifies that discard resolution produces no implementation continuation.

Testing

• Final rebased stack: npm run check passed.
• Final rebased stack: focused Vitest validation across 28 affected files passed all 451 tests.
• This intermediate branch was not checked independently after reconstruction.

[jefft72]

Closing to rebuild on a clean base.

This stack does not build. Two separate defects are present, and the first masks the second:

1. A stray closing brace committed in feat: enforce native plan collaboration policy #64 stops packages/coding-agent/src/core/agent-session.ts from parsing at all.
2. From feat: activate accepted plans in routed sessions #65 onward the stack imports five modules that exist only on the task profile stack: evolved.ts, harness-descriptors.ts, profile-router.ts, profiles.ts, and runtime-telemetry.ts.

Replacement stacks:

• plan/* for native plan mode standing alone on main
• plan-harness/* for the plan and profile integration

The branch behind this PR is retained unchanged as a backup.