What changed
The Pi extension previously activated all hooks as soon as task_plan.md existed on disk. Plan injection, pre-tool recitation, post-write reminders, and auto-continue could start while the user was still reviewing a draft plan.
v3.3.0 adds an explicit confirmation step (PR #193 by @Dikshj, closes #190). The extension stays passive until the active plan is approved with /plan-execute. Before approval it shows a status line only. Approval is scoped to the current session and plan path, resets on session lifecycle events, and /plan-execute reset returns the plan to passive review mode. A plan whose SHA-256 attestation shows tampering cannot be approved.
This gates initial hook activation only. The v3 gate mode, which gates stopping on an incomplete plan, is unchanged.
Verification
- Python suite: 188 passed, 5 skipped, 0 failed
- Pi extension vitest suite: 21 passed
- scripts/sync-ide-folders.py --verify: all IDE folders in sync
- Supply-chain review on PR #193: no new dependencies, no install scripts, no bin shims, no network calls