Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/agent-permissions.md`:
- Line 7: The docs reference the wrong enforcement layer for blocked bash
commands. Update the text in agent-permissions.md to point to bash-approval.ts,
since requiresApproval(...) is only called from use-chat.ts and the actual
blocklist matching lives in packages/cli/src/lib/bash-approval.ts; use that
symbol to guide readers to the correct implementation location.

In `@packages/cli/src/hooks/use-chat.ts`:
- Around line 135-168: Move the bash input parsing for `toolCall.toolName ===
"bash"` inside the same `try/catch` that wraps `executeLocalTool` in
`use-chat.ts`, so malformed input from `toolInputSchemas.bash.parse` is also
converted into a terminal `output-error`. Keep the approval logic
(`requiresApproval`, `requestBashApproval`, `rememberSessionAllow`) intact, but
ensure any parse failure or other bash setup error is caught and passed to
`chat.addToolOutput` with `state: "output-error"` and `errorText` instead of
escaping before the catch.
- Line 126: The tool-call mode lookup in use-chat should not default from the
last message blindly, because the latest assistant/tool-continuation message may
have no metadata and can incorrectly fall back to BUILD. Update the mode
selection logic around the message metadata lookup so it scans backward for the
most recent metadata-bearing message and uses that message’s mode instead of
chat.messages.at(-1), ensuring executeLocalTool still respects PLAN-mode
read-only behavior.

In `@packages/cli/src/lib/bash-approval-ui.ts`:
- Around line 31-50: The requestBashApproval flow can hang because
DialogProvider.open() replaces the current dialog without settling the existing
one, so the promise in bash-approval-ui.ts never resolves when a reentrant
dialog opens. Update DialogProvider.open() to close or otherwise settle any
existing dialog before assigning the new currentDialog, and make sure the
existing dialog’s onClose path is triggered so requestBashApproval is not left
pending.

In `@packages/cli/src/lib/bash-approval.ts`:
- Around line 20-21: Expand the approval blocklist in bash-approval.ts so
destructive commands are caught in more common forms: update the rm pattern used
in the approval checks to match uppercase recursive flags like rm -R and mixed
forms like rm -Rf, and update the git push pattern to also catch refspec force
syntax such as git push origin +main in the same validation logic. Keep the
changes localized to the existing regexes near the rm and git push rules so the
Build-mode dialog still blocks these variants.

In `@packages/cli/src/lib/local-tools.ts`:
- Around line 141-151: The gitStatus result in local-tools is undercounting
dirty worktree entries because it only adds modified and deleted files to
unstaged, so other non-clean states can be missed. Update the git status mapping
to include all dirty worktree buckets from the git status object when computing
unstaged, and adjust the summary formatting in gitStatus so it reflects the full
dirty state rather than only staged/modified/untracked counts.

In `@packages/cli/src/lib/ripgrep.ts`:
- Around line 44-46: The argv built in ripgrep’s argument assembly is not stable
enough for the output parser used by local-tools. In the ripgrep helper that
constructs args for `rg`, make sure the search always produces
`file:line:content` and cannot treat the search term as an option: add the
appropriate flag to always include filenames and insert the end-of-options
separator before `pattern` and `resolved`. This should be fixed in the
argument-building logic in the ripgrep utility so
`packages/cli/src/lib/local-tools.ts` receives consistent matches.

In `@packages/shared/src/schemas.ts`:
- Around line 60-65: The gitDiff schema’s ref field is currently free-form, so
option-like values starting with a dash can be forwarded to git and treated as
flags. Harden the validation in the schema definition for gitDiff.ref by
rejecting leading-dash inputs (or otherwise constraining the accepted ref shape)
before they reach the git call site, and keep the behavior aligned with the
existing staged/compare description.

---

Nitpick comments:
In `@packages/cli/src/providers/dialog/index.tsx`:
- Around line 33-38: The close callback in the dialog provider is performing the
onClose side effect inside the setCurrentDialog updater, which can be replayed
by React. Update the close useCallback in the dialog context so it first reads
the current dialog from state, calls currentDialog.onClose if present, and then
clears the dialog state separately; keep the logic out of the state updater and
preserve the existing close behavior.

In `@packages/shared/src/schemas.test.ts`:
- Around line 31-43: The getToolContracts tests are too permissive for Mode.PLAN
because they only assert inclusion and would miss accidental tool leaks. Tighten
the assertions in schemas.test.ts around getToolContracts so the PLAN case
verifies the exact returned contract only contains the expected git tools and
excludes write/bash tools, while the BUILD case still confirms the full expected
set; use getToolContracts and Mode as the anchor points.