MCP filesystem tools bypass plan mode edit: deny permission rule #30291

Description

When plan mode is configured with "edit": "deny" in opencode.json, MCP filesystem tools (e.g., filesystem_edit_file, filesystem_write_file) are not blocked. They execute successfully despite the explicit deny rule.

The "edit" permission rule appears to only gate opencode's native edit tools, not MCP tools that perform equivalent file-modification operations. Since MCP tools are dispatched through the MCP protocol with their own permission namespace (e.g., filesystem_edit_file), the "edit" deny rule never sees them.

Steps to Reproduce

1. Configure an agent with "edit": "deny" (e.g., the default plan agent or a custom plan agent):

   "plan": {
     "mode": "primary",
     "permission": {
       "edit": "deny",
       ...
     }
   }

2. Ensure an MCP filesystem server is configured (e.g., @anthropic/claude-code's filesystem MCP or any MCP server providing filesystem_edit_file/filesystem_write_file tools).
3. Enter plan mode and ask the agent to modify a file.
4. The agent uses the MCP filesystem tool to write/edit the file successfully.

Expected Behavior

Plan mode with "edit": "deny" should block ALL file-modifying tools, including those provided by MCP servers. This is the core invariant of plan mode being read-only.

Actual Behavior

MCP filesystem tools bypass the "edit" deny rule because the permission system doesn't map MCP tool names to the edit permission key. The AI sees the MCP tools as available and uses them.

Environment

• opencode version: latest
• MCP filesystem server configured
• Plan mode active with "edit": "deny"

Related Issues

• plan agent bypass #24615 — plan agent bypass (similar symptom, different root cause — was about default permissions being lost)
• Opencode ignoring deny permissions? #25515 — edit: deny ignored at agent level
• Plan mode can execute bash commands that write files, bypassing read-only constraint #28467 — plan mode bash commands can write files (bash, not MCP tools)
• fix(opencode): inherit MCP tool allow permissions in subagent sessions #30288 — MCP tool allow permissions in subagent sessions (PR, related area)