fix: restrict write and apply_patch permissions for plan mode

[shssoichiro]

Context

This was discovered while debugging #8358. The permissions in agent.ts were restricting the directories where the Plan agent can use the Edit tool, but not the ApplyPatch and Write tools. This change also applies the restrictions to ApplyPatch and Write to ensure that Plan mode cannot edit outside of the plans directory.

Get in Touch

ExpedientFalcon on Discord.

[kilo-code-bot]

WARNING: These new apply_patch/write rules do not enforce the plan-mode restriction.

WriteTool and ApplyPatchTool both call ctx.ask({ permission: "edit", ... }), so the path check still comes from the existing edit rules. PermissionNext.disabled() also maps write to edit, but not apply_patch, which means this block leaves apply_patch exposed to the model while not changing the runtime restriction. The fix likely needs to reuse the edit permission for apply_patch tool gating instead of adding separate apply_patch/write entries here.

[shssoichiro]

Oh. Well then this patch isn't needed.

[kilo-code-bot]

Code Review Summary

Status: 1 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Fix these issues in Kilo Cloud

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/opencode/src/agent/agent.ts	237	Separate apply_patch/write permission entries do not affect runtime edit checks, so apply_patch remains available and the new restriction is ineffective.

Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

None.

Files Reviewed (1 files)

• packages/opencode/src/agent/agent.ts - 1 issue

---

_{Reviewed by gpt-5.4-20260305 · 453,687 tokens}

[kilo-code-bot]

Closing this PR — its guidance and changes have been incorporated into PR #8417, which takes a more comprehensive approach to hardening plan mode permissions (including sub-agent restriction propagation, read-only bash enforcement, and MCP tool access). Thanks for identifying the apply_patch/write permission gap!