v1.7.2

Highlights

• Orchestrator tool-gating now strips disabled tools from the LLM schema. Plugin-injected agents bypassed opencode's tools: → permission: normalize step, so the orchestrator kept seeing read/edit/write/bash/webfetch/outline/task and retrying them despite the runtime deny. Each agent now declares permission: directly; opencode's resolveTools removes the disabled tools before they ever reach the model.
• Planner doc-format rule. Planner output is decisions plus file:line references — max 5 lines per snippet, 30 combined per document. End-to-end check: a sentiment-classification concept that produced ~62 k tokens of Java in the buggy run now lands at 147 lines / 6 code-lines.
• Spawn allowlist no longer collides with permission.task = "deny". The string form is opencode's signal that an agent cannot use the built-in blocking task tool — we now only honour the per-agent object form of permission.task as a spawn allowlist, so an orchestrator that hides task can still spawn.

86 unit tests pass.