fix: resolve the session agent so the plan guard cannot fail open

[willytop8]

The bug this fixes

A live canary against a real OpenCode 1.18.25 TUI showed the planning-only restriction merged in #64 never firing in practice. With the Plan agent selected, /goal make index.js print goodbye produced:

stopped: False | stopReason: '' | executionContext: None
history: ['set', 'auto-continue', 'warning', 'auto-continue']

The goal was created live, ran the auto-continue loop, and edited the file. Reproduced twice, with and without an agent pin on the command config.

Root cause

The guard read only the cached execution context, populated from chat.message / chat.params / session.updated. OpenCode runs command.execute.before before any of those fire, so the context is empty for the first command in a session — exactly the case a freshly opened Plan-mode session hits. isRestrictedAgent(undefined) returns false, so the restriction failed open precisely where it mattered most.

The unit tests in #64 passed because they drove a chat.message or session.updated first. They encoded my assumption about the host rather than the host's actual behavior.

Fix

Fall back to the session record (Session.agent), which carries the selected agent from the moment the user picks it. Confirmed present in 1.18 and verified to read plan after switching.

• The cached context is still preferred, so a known agent costs no extra session fetch.
• A host that cannot report the agent still fails open rather than holding every goal.

Verification

Re-ran the same live canary that found the bug, using the documented install config. With the fix:

	before	after
turnCount (auto-continues)	multiple	0
stopped	false	true
stopReason	''	plan agent active
history	set, auto-continue, warning, auto-continue	set, paused

Zero auto-continues means no unattended work.

Also verified live in the same run: sessionTitleStatus renders correctly in the real TUI —
⏸ make index.js print goodbye instead of hi · 0/10 · 0s · 25k/200k, with ▶ for a running goal.

npm run release:check → exit 0: 414 tests (411 before; +3 new), mutation 68/68, benchmark 100, 0 vulnerabilities.

The new regression test reproduces the live failure exactly — agent visible only on the session record, no execution context — and was confirmed to fail against the pre-fix code.

Honest scope

The README now states precisely what the restriction does and does not prevent. It stops the goal loop (zero auto-continues). It cannot stop a model acting on the single routed command turn, because command.execute.before does not fully intercept command text — the already-documented limitation. In the canary the free test model did edit the file on that one turn despite being told not to; the plugin correctly held the goal and never continued it.

🤖 Generated with Claude Code