Simplify Galaxy permissions and preserve explicit user authorization

app/src/ai/agent/api.rs

@@ -143,6 +143,7 @@ pub struct RequestParams {
     /// `custom_model_providers`: the selected model's `config_key` indexes into this
     /// registry. `None` when no custom router is selected.
     pub custom_model_routers: Option<warp_multi_agent_api::request::settings::CustomModelRouters>,
+    pub permission_mode: crate::ai::execution_profiles::PermissionMode,
     pub autonomy_level: warp_multi_agent_api::AutonomyLevel,
     pub isolation_level: warp_multi_agent_api::IsolationLevel,
     pub web_search_enabled: bool,
@@ -237,6 +238,7 @@ impl RequestParams {
             api_keys: None,
             custom_model_providers: None,
             custom_model_routers: None,
+            permission_mode: Default::default(),
             autonomy_level: Default::default(),
             isolation_level: Default::default(),
             web_search_enabled: false,
@@ -446,6 +448,8 @@ impl RequestParams {
             api_keys,
             custom_model_providers,
             custom_model_routers,
+            permission_mode: BlocklistAIPermissions::as_ref(app)
+                .get_permission_mode(app, terminal_view_id),
             autonomy_level,
             isolation_level,
             web_search_enabled,

app/src/ai/agent/api/impl.rs

@@ -34,12 +34,29 @@ pub(crate) fn prepare_direct_provider_params(
         &mut supported_cli_agent_tools,
         params.orchestration_enabled,
     );
+    if params.permission_mode == crate::ai::execution_profiles::PermissionMode::ReadOnly {
+        supported_tools.retain(is_read_only_tool);
+        supported_cli_agent_tools.retain(is_read_only_tool);
+    }
     if params.should_redact_secrets {
         redaction::redact_inputs(&mut params.input);
     }
     (supported_tools, supported_cli_agent_tools)
 }
 
+fn is_read_only_tool(tool: &api::ToolType) -> bool {
+    matches!(
+        tool,
+        api::ToolType::ReadFiles
+            | api::ToolType::SearchCodebase
+            | api::ToolType::Grep
+            | api::ToolType::FileGlob
+            | api::ToolType::FileGlobV2
+            | api::ToolType::ReadSkill
+            | api::ToolType::ReadDocuments
+    )
+}
+
 fn get_supported_tools(params: &RequestParams) -> Vec<api::ToolType> {
     let mut supported_tools = vec![
         api::ToolType::Grep,

app/src/ai/agent/api/impl_tests.rs

@@ -37,6 +37,7 @@ fn request_params_with_ask_user_question_enabled(ask_user_question_enabled: bool
         api_keys: None,
         custom_model_providers: None,
         custom_model_routers: None,
+        permission_mode: Default::default(),
         autonomy_level: api::AutonomyLevel::Supervised,
         isolation_level: api::IsolationLevel::None,
         web_search_enabled: false,
@@ -199,3 +200,20 @@ fn remote_supported_tools_omit_search_codebase_when_remote_is_not_connected() {
     assert!(!supported_tools.contains(&api::ToolType::SearchCodebase));
     assert!(!supported_cli_agent_tools.contains(&api::ToolType::SearchCodebase));
 }
+
+#[test]
+fn read_only_mode_filters_even_explicit_tool_overrides() {
+    let mut params = request_params_with_ask_user_question_enabled(true);
+    params.permission_mode = crate::ai::execution_profiles::PermissionMode::ReadOnly;
+    params.supported_tools_override = Some(vec![
+        api::ToolType::Grep,
+        api::ToolType::ReadFiles,
+        api::ToolType::RunShellCommand,
+        api::ToolType::ApplyFileDiffs,
+        api::ToolType::CallMcpTool,
+        api::ToolType::RunAgents,
+    ]);
+    let (base, cli) = super::prepare_direct_provider_params(&mut params);
+    assert_eq!(base, vec![api::ToolType::Grep, api::ToolType::ReadFiles]);
+    assert_eq!(cli, base);
+}