feat: Enhance OAuth module and OpenRouter client functionality

- Updated OAuth module to include unused imports for better clarity.
- Refactored OpenRouterClient to improve chat functionality and added support for tools in chat requests.
- Modified internet tools (Download, Fetch, Search) to use a more flexible internet mode check.
- Introduced new Bash tools for managing background jobs (BashOutput, BashKill).
- Enhanced workflow tool to parse and execute workflow scripts with arguments.
- Updated status and workflow views to reflect new agent and findings counts.
- Added IPC protocol definitions for client requests and state payloads.

src/app/harness.rs

@@ -18,7 +18,58 @@ impl Harness {
         if mode.auto_approve() {
             return Verdict::Allow;
         }
-        Verdict::Allow
+        if matches!(mode, super::state::types::AgentMode::Plan) {
+            return Verdict::Block("mutating tools are disabled in Plan mode".to_string());
+        }
+        Verdict::Escalate
+    }
+
+    pub fn gate_tool_call(
+        tool_name: &str,
+        args: &serde_json::Value,
+        mode: &super::state::types::AgentMode,
+        workspace_roots: &[&std::path::Path],
+    ) -> Verdict {
+        if let Err(e) = Self::run_catastrophic_guard(tool_name, args, workspace_roots) {
+            return Verdict::Block(e);
+        }
+        if !crate::tool::tool_is_risky(tool_name) {
+            return Verdict::Allow;
+        }
+        Self::classify(tool_name, mode)
+    }
+
+    fn run_catastrophic_guard(
+        tool_name: &str,
+        args: &serde_json::Value,
+        workspace_roots: &[&std::path::Path],
+    ) -> Result<(), String> {
+        use super::catastrophic::CatastrophicGuard;
+        match tool_name {
+            "bash" => {
+                let cmd = args.get("command").and_then(|v| v.as_str()).unwrap_or("");
+                CatastrophicGuard::check_all(cmd, workspace_roots)
+            }
+            "git_operator" => {
+                let operation = args.get("operation").and_then(|v| v.as_str()).unwrap_or("");
+                let arg_list: Vec<String> = args
+                    .get("args")
+                    .and_then(|v| v.as_array())
+                    .map(|arr| arr.iter().filter_map(|v| v.as_str().map(|s| s.to_string())).collect())
+                    .unwrap_or_default();
+                let cmd = format!("git {} {}", operation, arg_list.join(" "));
+                CatastrophicGuard::check_all(&cmd, workspace_roots)
+            }
+            "delete" => {
+                let path = args.get("path").and_then(|v| v.as_str()).unwrap_or("");
+                CatastrophicGuard::check_delete_path(std::path::Path::new(path), workspace_roots)
+            }
+            "web_download" | "download" => {
+                let path = args.get("path").and_then(|v| v.as_str()).unwrap_or("");
+                CatastrophicGuard::check_download_path(std::path::Path::new(path))
+            }
+            _ => Ok(()),
+        }
     }
 }