Add persistent local agent tools

PLAN.md

@@ -413,11 +413,14 @@ the same conversation without prefill when its KV payload is compatible.
 
 ## Phase 4 — agent chat and tools
 
-Status: **basic local chat implemented**. The conversation area streams
+Status: **solid local agent base implemented**. The conversation area streams
 multi-turn DeepSeek Flash output, persists and rehydrates structured reasoning
 and answers, renders Markdown, follows new output, restores sessions at their
 latest message, reports context use and generation speed, and supports Stop.
-Tool turns and the coding-agent runtime remain open.
+DeepSeek DSML and GLM tool turns now execute off the UI thread, persist semantic
+tool roles, resume the same checkpoint, and expose the complete `ds4_agent.c`
+starting tool set. Context compaction and richer partial-tool presentation
+remain open.
 
 Every chat feature must persist its semantic state and rehydrate it when a
 session is reopened in the same implementation slice. In-memory-only chat
@@ -431,23 +434,27 @@ ephemeral presentation preferences are the only exception.
    decode, HTTP, and KV telemetry; tool-call cards, queued input, and inline
    chat-prefill progress remain. Local turns must call the same session registry
    and KV path used by the HTTP endpoint.
-2. Port the native agent turn loop from `ds4_agent.c`, including model-specific
-   system prompts and DeepSeek DSML/GLM tool-call parsing.
-3. Implement the local tool set with the project directory as its boundary:
+2. **Implemented:** port the native agent turn loop from `ds4_agent.c`, including
+   model-specific system prompts and DeepSeek DSML/GLM tool-call parsing.
+3. **Implemented starting set:** implement the local tool set with the project directory as its boundary:
    - shell command execution
    - file read and continuation
    - file write
    - anchored edit
    - text/file search
-   - opt-in Dev Brain knowledge lookup and memory storage
-4. Stream assistant tokens and partial tool calls into Iced while inference and
-   tools run on workers. Preserve cooperative interruption and a valid KV
-   prefix at every stop point.
-5. Require confirmation for commands or writes outside the project boundary,
-   destructive actions, and network tools. Add web search/page visiting only
-   after the local tool loop is stable.
-6. Port context compaction and system-prompt reinjection after ordinary
-   multi-turn operation is correct.
+   - directory listing
+   - asynchronous shell status/stop
+   - approved visible-Chrome Google search and rendered page visits
+   - opt-in Dev Brain knowledge lookup and memory storage remains separate
+4. **Partially implemented:** assistant tokens and compact completed tool calls
+   stream into Iced while inference and tools run on workers. Cooperative Stop
+   covers generation and tool work; richer partial-call cards remain.
+5. **Partially implemented:** file tools enforce the project boundary and web
+   tools require visible-browser approval. Destructive shell-command approval
+   remains before broader distribution.
+6. The full tool system prompt is derived into every local generation, including
+   reopened sessions. Port context compaction before prompts approach their
+   configured context limit.
 
 ### Native macOS menus (required with chat)
 
@@ -594,8 +601,9 @@ notarization, and delivery remain open.
    then porting every parser/route/state machine and its fixtures. Keep HTTP
    conversation state transient except for opaque KV cache files. **In
    progress; no route is considered complete until differential tests pass.**
-3. Local transcript/KV persistence and the conversation UI are implemented;
-   port the agent tools after the shared endpoint lifecycle is stable.
+3. Local transcript/KV persistence, the conversation UI, and the native agent
+   starting tool set are implemented. Add context compaction and richer
+   partial-tool surfaces next.
 4. Add the opt-in Dev Brain tool after local file/search boundaries and agent
    approvals are stable.
 5. Add bDS2-style A2UI render tools and native inline surfaces after the core