fix(delegate-task): Wave 1 - fix polling timeout, resource cleanup, tool restrictions, idle dedup, auth-plugins JSONC, CLI runner hang

- fix(delegate-task): return error on poll timeout instead of silent null
- fix(delegate-task): ensure toast and session cleanup on all error paths with try/finally
- fix(delegate-task): apply agent tool restrictions in sync-prompt-sender
- fix(plugin): add symmetric idle dedup to prevent double hook triggers
- fix(cli): replace regex-based JSONC editing with jsonc-parser in auth-plugins
- fix(cli): abort event stream after completion and restore no-timeout default

All changes verified with tests and typecheck.

src/tools/look-at/session-poller.ts

@@ -0,0 +1,42 @@
+import type { createOpencodeClient } from "@opencode-ai/sdk"
+import { log } from "../../shared"
+
+type Client = ReturnType<typeof createOpencodeClient>
+
+export interface PollOptions {
+  pollIntervalMs?: number
+  timeoutMs?: number
+}
+
+const DEFAULT_POLL_INTERVAL_MS = 1000
+const DEFAULT_TIMEOUT_MS = 120_000
+
+export async function pollSessionUntilIdle(
+  client: Client,
+  sessionID: string,
+  options?: PollOptions,
+): Promise<void> {
+  const pollInterval = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS
+  const timeout = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS
+  const startTime = Date.now()
+
+  while (Date.now() - startTime < timeout) {
+    const statusResult = await client.session.status().catch((error) => {
+      log(`[look_at] session.status error (treating as idle):`, error)
+      return { data: undefined, error }
+    })
+
+    if (statusResult.error || !statusResult.data) {
+      return
+    }
+
+    const sessionStatus = statusResult.data[sessionID]
+    if (!sessionStatus || sessionStatus.type === "idle") {
+      return
+    }
+
+    await new Promise((resolve) => setTimeout(resolve, pollInterval))
+  }
+
+  throw new Error(`[look_at] Polling timed out after ${timeout}ms waiting for session ${sessionID} to become idle`)
+}