…e, activeForm, hydration

Ports three Hermes todo-tool features that OpenClaw's update_plan
was missing, plus adds plan hydration for post-compaction recovery.

## cancelled status (Hermes parity)
Add "cancelled" as a fourth plan step status. Hermes uses this to
mark steps that were started but abandoned due to failure, keeping
them visible in history instead of silently dropping them.
Ref: Hermes tools/todo_tool.py Status enum.

## merge mode (Hermes parity)
Add optional merge: boolean parameter (default false). When true,
incoming steps update existing ones by matching step text and new
steps are appended. When false, the entire plan is replaced.
Ref: Hermes tools/todo_tool.py write(todos, merge=False).

## activeForm field (Claude Code TodoWrite parity)
Add optional activeForm: string field on plan steps. Shows the
present-continuous form while in_progress (e.g. "Running tests"
instead of "Run tests"). Small schema addition with disproportionate
UX impact for plan rendering.

## Post-compaction plan hydration (Hermes parity)
New src/agents/plan-hydration.ts helper that formats active
(pending/in_progress) plan items for injection after context
compression. The injected text uses factual phrasing ("Your active
plan was preserved...") to avoid triggering the planning-only retry
guard's promise-language detection.
Ref: Hermes run_agent.py:6754-6756 + tools/todo_tool.py:format_for_injection().

Note: the compaction hook point in compact.ts is not wired in this
PR — that requires a follow-up to integrate with the compaction
checkpoint system (#62146). This PR provides the formatter; the
hook wiring is the next step.

Part of GPT 5.4 Enhancement v3 sprint. Tracking: #66345.

…ne, types

Phase 3.C of the GPT 5.4 parity sprint. Implements plan mode as an
opt-in feature where mutation tools are blocked during Phase A (plan)
until the user approves the plan, then Phase B (execute) runs normally
with full tool access.

## Plan mode mutation gate (mutation-gate.ts)
- Blocks 11 mutation tools by exact name: apply_patch, edit, exec,
  gateway, message, nodes, process, sessions_send, sessions_spawn,
  subagents, write
- Blocks suffix patterns: *.write, *.edit, *.delete
- Allows: read, web_search, web_fetch, memory_search, memory_get,
  update_plan, exit_plan_mode, session_status
- Special exec whitelist: read-only commands (ls, cat, git status,
  grep, find, etc.) are allowed; mutating commands are blocked
- 30 unit tests covering all paths

## Approval state machine (approval.ts)
- States: none → pending → approved | edited | rejected | timed_out
- approve: transitions to normal mode, records confirmedAt
- edit: re-enters plan mode with edited plan
- reject/timeout: transitions to normal mode, aborts turn
- buildApprovedPlanInjection(): generates system message for Phase B
- 7 unit tests

## Types (types.ts)
- PlanMode, PlanApprovalState, PlanModeSessionState
- DEFAULT_PLAN_MODE_STATE

Built independently of PR #61845. Plan mode is NEVER auto-enabled —
it requires explicit user opt-in via config, slash command, or UI
toggle (entry points follow in a separate commit).

Tracking: #66345, #67520.

Phase 4.1 of the GPT 5.4 parity sprint. Extends the skill metadata
schema with an optional planTemplate field that auto-populates
update_plan when the skill is activated.

## Schema extension (types.ts)
- New SkillPlanTemplateStep type: { step: string, activeForm?: string }
- New planTemplate?: SkillPlanTemplateStep[] field on OpenClawSkillMetadata
- Parsed from YAML frontmatter `plan-template` in SKILL.md

## Skill planner (skill-planner.ts)
- buildPlanTemplatePayload(): converts template to update_plan args
  (all steps start as "pending")
- hasSkillPlanTemplate(): quick check for non-empty templates
- 7 unit tests

## Example frontmatter
```yaml
plan-template:
  - step: "Run test suite"
    activeForm: "Running test suite"
  - step: "Build artifacts"
    activeForm: "Building artifacts"
```

Note: the runtime wiring in skills-runtime.ts to auto-call
update_plan on activation follows once #67514 (task-system parity)
merges with the extended update_plan schema.

Tracking: #66345, #67522.

Phase 4.2 of the GPT 5.4 parity sprint. Adds a PlanStore class for
cross-session task coordination, modeled after Claude Code's Tasks
API concept.

## PlanStore (plan-store.ts)
- read(namespace): loads plan from ~/.openclaw/plans/<ns>/plan.json
- write(namespace, plan): persists plan to disk with auto-mkdir
- lock(namespace): file-level exclusive lock with O_EXCL + 10s
  stale-lock auto-cleanup to prevent deadlocks from crashes
- mergeSteps(): merge incoming steps into existing plan by matching
  step text, appending new steps, preserving existing order.
  Tracks updatedBy (session key) and updatedAt per step.

## Schema (StoredPlan, StoredPlanStep)
- StoredPlanStep: step, status (4 values), activeForm?, updatedBy?,
  updatedAt?
- StoredPlan: namespace, steps[], createdAt, updatedAt

## Tests (8 tests)
- Read/write round-trip + nested directory creation
- Lock acquisition, release, and concurrent contention
- Merge: update by text match, append new, preserve order

Default behavior (no namespace configured): plan is session-scoped,
PlanStore is not used. Cross-session coordination only activates when
planStore.namespace is set in config.

Tracking: #66345, #67523.

…rge mode

The execute() third param is an AbortSignal/context, not a plan context,
so context?.previousPlan was always undefined and merge mode was a no-op.
Fall back to replace until PlanStore (#67542) provides previous-plan lookup.

…efault deny, confirmedAt

- Block shell compound operators (&&, ||, |, ;, >, >>, backticks, $())
  in exec/bash commands to prevent chaining past the prefix allowlist
- Add "bash" to the mutation tool blocklist (alias for exec)
- Default to blocked for unknown tools (fail-closed, not fail-open)
- Clear confirmedAt on "edit" transition to prevent stale approval leaking
- Remove unused PlanApprovalState import

… errors, lock ownership

- Validate namespace to prevent path traversal (reject "..", absolute paths)
- Atomic write: write to temp file then rename to prevent mid-write corruption
- Fix file handle leak: ensure handle.close() in finally on open errors
- Distinguish ENOENT from parse/permission errors in read() instead of
  swallowing all errors
- Verify lock ownership token before unlinking on release to prevent
  one process from deleting another's lock

…egex (oxlint)

…itelist

Two Codex P1 issues at 95%+ confidence:

1. Newlines as shell separators: "ls\nrm -rf tmp" bypassed the
   compound operator check because \n wasn't in the regex.
   Added \n and \r to the operator detection pattern.

2. Dangerous flags on allowed prefixes: "find . -delete" passed
   because "find" is whitelisted. Added a dangerous-flag check
   for -delete, -exec, -execdir, --delete, -rf, -i that runs
   after the operator check but before the prefix allowlist.

Added 4 new test cases covering both vectors + bash alias.

`env` as a prefix allows arbitrary command execution (e.g.
`env npm install`). Remove it — users who need environment
variables can use `printenv` which is already allowlisted.

- Convert args from mappings to arrays
- Replace sendAgentMessage with state.addInboundMessage
- Replace waitForToolCall with waitForOutboundMessage + lambda predicates
- Replace assertions: blocks with assert: actions
- Add waitForGatewayHealthy + waitForQaChannelReady setup
- Use ref: state / ref: env for runtime objects
- Fix gpt54-plan-mode-default-off scenario ID to match filename
- Simplify injection-scan to baseline check (scanner unit-tested in #67512)

- Add explicit tests for bash tool blocked in plan mode, shell compound
  operators (redirect, pipe, semicolon), newlines in commands, and
  dangerous flags (find -delete, find -exec)
- Add early-return guard in resolvePlanApproval for stale timeouts that
  fire after the user has already acted on the approval
- Add test verifying stale timeout is ignored after approval is resolved

- Add parsePlanTemplate() helper in frontmatter.ts to parse the
  plan-template YAML field into SkillPlanTemplateStep[]
- Include planTemplate in resolveOpenClawMetadata output
- Add resolveSkillPlanTemplate() in skills-runtime.ts that scans
  activated skill entries and returns an update_plan payload via
  buildPlanTemplatePayload when a plan template is found

Replace O(n) linear scan with a Set when checking whether incoming
steps already exist, improving merge performance for large plans.

- Add plan-hydration.test.ts: tests formatPlanForHydration returns null
  for empty/all-completed/all-cancelled steps, filters out completed and
  cancelled steps, includes pending and in_progress with correct markers,
  and validates preserved plan header format
- Add update-plan-tool.parity.test.ts: tests cancelled status is accepted
  in schema, activeForm field is preserved in output, and merge=true with
  no previousPlan falls back to replace

…ear confirmedAt

Three fixes at 95%+ confidence from Copilot review:

1. Remove -i from DANGEROUS_FLAGS — blocks grep -i (case-insensitive
   search), the most common grep usage in plan mode. The remaining
   flags (-delete, -exec, -execdir, --delete, -rf) are genuinely
   dangerous.

2. Add read-only suffix patterns (.read, .search, .list, .get, .view)
   so MCP read tools like custom_mcp.read pass the fail-closed default.
   Mutation suffixes (.write, .edit, .delete) are still blocked.

3. Clear confirmedAt on reject and timeout transitions in the approval
   state machine. Previously only edit cleared it; reject/timeout
   spread current which could leak a stale confirmedAt.

Three fixes from Copilot review:

1. mergeSteps: only set updatedBy when sessionKey is truthy, avoiding
   undefined overwriting existing attribution
2. write(): validate plan.namespace matches the namespace argument
   to prevent accidental mismatches
3. Added tests: path traversal rejection + namespace mismatch in write

Filename is interpolated into the BLOCKED string. A crafted file path
containing brackets or newlines could confuse the model about what
content is blocked. Strip ], [, and newlines from the filename.

…g in mergeSteps

1. read(): verify plan.namespace matches requested namespace to catch
   file corruption or misrouted reads
2. mergeSteps(): deduplicate incoming steps by tracking appended step
   texts in a Set, preventing duplicate step entries when incoming
   contains the same step text multiple times

…ject/timeout

- mutation-gate: use word-boundary matching for DANGEROUS_FLAGS to prevent
  substring false positives (e.g. -exec matching -executable, -delete matching
  -delete-old). Added tests for find -executable and grep -rfl.
- approval: reject and timeout now stay in plan mode instead of transitioning
  to normal mode, preventing fail-open after rejection.

Now that activeForm is explicitly declared, disallow arbitrary extra keys
on plan step objects to catch malformed input early.

Change from truthy check to explicit undefined check so that plans with
no namespace field (backward-compat) pass through, while non-undefined
mismatches still throw a corruption error.

Decision 4 from adversarial audit: defines how plan rejection, editing,
and revision work across all surfaces (web, CLI, messaging).

## State machine changes

- reject: stays in plan mode (fail-closed), increments rejectionCount,
  captures user feedback. Agent receives [PLAN_DECISION] injection on
  next turn with feedback text and revision instructions.
- edit: transitions to normal mode (user edits count as approval),
  records confirmedAt. Edited plan is the approved plan.
- timeout: stays in plan mode. Agent told proposal expired, may
  re-propose.
- After 3+ rejections: injection adds "consider asking the user to
  clarify their goal" guidance.

## New exports

- buildPlanDecisionInjection(): generates the structured [PLAN_DECISION]
  block for rejection/expiry context injection
- PlanModeSessionState now tracks feedback and rejectionCount

## UI contract (documented in types.ts)

Web/Desktop: [Approve] [Edit] [Reject + Feedback] buttons + persistent
  "Plan Mode Active" banner + [Exit Plan Mode] escape hatch
Messaging: [Approve] [Reject] inline buttons, user types feedback as
  next message after rejection. No Edit on messaging (limitation).

## Tests

14 test cases covering: approve, edit, reject with feedback, rejection
accumulation, timeout, stale timeout, enteredAt preservation, feedback
clearing on approval, plan decision injection format.

…bosity

Additions to the GPT-5.4 prompt overlay (interaction_style, output_contract,
execution_bias sections):

- Identity Enforcement: prime GPT-5.4 to adopt SOUL.md as primary identity,
  ban corporate default patterns
- Voice Calibration: counter flat/analytical drift, anti-sycophancy reinforcement
- Response Length Discipline: 200-word target with 95% confidence self-evaluation
  gate leveraging thinking mode, file-offload for genuine long-form
- Investigation Discipline: prevent partial-findings-then-ask pattern, force
  parallel tool calls for independent lookups
- Plan Confidence Gate: 95%+ → execute without approval, 80-94% → state
  uncertainty and begin, <80% → iterate privately through research