fix(core): ask before shell commands in plan mode - #54165

Issue for this PR

Closes #53955

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

In Plan mode the agent is supposed to plan, not mutate the repository. The Plan agent's
permission set in packages/core/src/plugin/plan.ts denies the edit tool outside the Plan
directory, but it never declares a rule for the shell tool. Permission.evaluate uses
findLast, so every shell command falls through to the agent default (* -> allow) and
bash / python / git / rm / mv all run without any prompt. The Plan system reminder
is the only thing asking the model not to change files, and a model that ignores it can edit
the worktree through the shell — which is exactly what #53955 reports (the reporter saw a
shell command create src/repl.rs, edit and delete src/main.rs, and run git add /
git commit with no permission prompt).

The published agent docs describe Plan mode as setting both file edits and bash to
ask, so this is the documented behaviour not being implemented rather than a new policy.

The change is one additive rule:

item.permissions.push({ action: "shell", resource: "*", effect: "ask" })

The action string is "shell", not "bash": that is the tool's own export const name = "shell", and it is what tool/plugin/shell.ts passes to permission.assert. Read-only
commands keep working after one confirmation, while a destructive command now has to be
approved. explore is deliberately left alone — other built-in agents stay on the * -> allow
default, which an existing test/agent.test.ts case pins.

How did you verify your code works?

Added a case to the existing plan plugin mutations block in
packages/core/test/plugin/plan.test.ts:

it.effect("asks before running shell commands", () =>
  Effect.gen(function* () {
    const { planAgent } = yield* run()
    expect(Permission.evaluate("shell", "ls", planAgent.permissions).effect).toBe("ask")
    expect(Permission.evaluate("shell", "rm -rf src", planAgent.permissions).effect).toBe("ask")
  }),
)

Red-baselined both ways on the current v2 tip: with only the source hunk reverted to stock
the new case fails (12 pass / 1 fail, reading allow), and with the change it passes
(13 pass / 0 fail). tsgo -b tsconfig.json tsconfig.tests.json is clean for packages/core
and oxlint reports 0 warnings / 0 errors on both files.

Screenshots / recordings

Not a UI change.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

Added by the opencode bot (AI-generated).

Related: #53530, #39491, #34190