Add batch reads, @file completion, interruptible commands, tool sets

Tools, six built-in to fourteen:
- read_many_files: up to 20 paths read concurrently, each with its own window.
  An unreadable path is reported in its own block instead of throwing.
- multi_edit: several edits to one file, validated in memory first so a late
  failure cannot leave the file half-written.
- list_dir: ignore-aware depth-limited tree.
- git_status/diff/log/show/blame: read-only, spawned with a fixed argv rather
  than a shell string, which is what makes them safe to auto-approve.

toolSets gates them. core is always on; edit-plus and git are optional. A
disabled set reaches neither the wire nor the system prompt, since a prompt
naming an absent tool teaches calls that cannot succeed.

Interface:
- Reasoning streams to a collapsed panel, ctrl-r expands, dropped when the turn
  ends: it is progress, not the answer.
- The tool in flight is named from tool-input-start, before its arguments finish
  streaming, and cleared on its result.
- Prompts typed mid-turn queue and drain in order. esc clears the queue as well
  as aborting.
- @ opens a path picker fed by the ignore-aware walker. Prefix matches rank
  above substring matches, so @src/ means "under src/". The walk runs on the
  first @, not at startup.

ctrl-c kills the command in flight and keeps the turn. The call throws rather
than returning, so the model cannot read a killed command as one that ran and
failed on its own terms. The kill takes the whole process tree: killing cmd /c
alone left the real command holding both pipes open, so the read never returned
and the interrupt did nothing for 19 seconds.

Two pruning fixes:
- A tool result whose tool call was pruned is now dropped with it. Pruning
  counts messages, so the cut landed between an assistant tool-call and the tool
  message answering it, producing 400 "No tool call found for function call
  output with call_id ...". The reverse pairing is left alone: a call awaiting
  its result is what a suspended approval looks like.
- ignore.ts called statFs without importing it, so walk() crashed on the first
  symlink.

482 tests, up from 404. Docs synced across README, ROADMAP, TODO, and all of
docs/: tool sets, the new tools, ctrl-c semantics, the tool-start event, and the
two hand-maintained tool-name lists recorded as a known weakness.

src/session.ts

@@ -16,7 +16,13 @@ import type { PluginHost } from './plugins';
 import { systemPrompt } from './prompt';
 import { prunePreservingItems } from './prune';
 import { createSkillTool, renderSkills, type Skill } from './skills';
-import { MUTATING_TOOLS, onBashOutput, tools as builtinTools } from './tools';
+import {
+  MUTATING_TOOLS,
+  disabledToolNames,
+  onBashOutput,
+  tools as builtinTools,
+  type ToolSetName,
+} from './tools';
 
 export type ApprovalRequest = {
   approvalId: string;
@@ -30,6 +36,7 @@ export type ApprovalDecision = 'once' | 'always' | 'deny';
 export type AgentEvent =
   | { type: 'text'; text: string }
   | { type: 'reasoning'; text: string }
+  | { type: 'tool-start'; id: string; name: string }
   | { type: 'tool-call'; id: string; name: string; input: unknown }
   | { type: 'tool-output'; id: string; chunk: string }
   | { type: 'tool-result'; id: string; name: string; output: unknown }
@@ -48,6 +55,8 @@ export type SessionOptions = {
   maxSteps?: number;
   /** MCP and subagent tools merged on top of the built-ins. */
   extraTools?: ToolSet;
+  /** Tool sets offered this session; omit for all of them. `core` is always on. */
+  toolSets?: readonly ToolSetName[];
   /** Tool names that never prompt, e.g. the read-only subagent tool. */
   autoApprove?: readonly string[];
   /** Prune the history once the estimated token count crosses this. */
@@ -121,9 +130,14 @@ export class Session {
     return this.variant;
   }
 
-  /** Tool names offered this turn; a read-only variant hides the rest. */
+  /**
+   * Tool names offered this turn. A read-only variant hides the mutating tools;
+   * a disabled tool set is withheld from the wire and from the prompt, since a
+   * prompt that names an absent tool teaches calls that cannot succeed.
+   */
   activeTools(): string[] {
-    const all = Object.keys(this.tools);
+    const withheld = new Set(disabledToolNames(this.opts.toolSets));
+    const all = Object.keys(this.tools).filter((name) => !withheld.has(name));
     if (!this.variant.allowTools) return all;
     return all.filter((name) => this.variant.allowTools!.includes(name));
   }
@@ -300,6 +314,11 @@ export class Session {
             case 'reasoning-delta':
               yield { type: 'reasoning', text: part.text };
               break;
+            case 'tool-input-start':
+              // Arrives before the arguments finish streaming, so the UI can name
+              // the tool while the model is still writing its input.
+              yield { type: 'tool-start', id: part.id, name: part.toolName };
+              break;
             case 'tool-call':
               yield { type: 'tool-call', id: part.toolCallId, name: part.toolName, input: part.input };
               break;