fix(agent-runtime): forbid workspace mutation via Bash in Plan/Goal prompts

packages/agent-runtime/src/mode-prompts.test.ts

@@ -24,6 +24,9 @@ describe("mode-specific system prompts", () => {
     expect(prompt).toContain("follow the same one-SubmitPlan rule");
     expect(prompt).toContain("Do not wait for chat confirmation");
     expect(prompt).toContain("Do not use Write, Edit");
+    expect(prompt).toContain("Do not create, overwrite, delete, or otherwise mutate workspace files in Plan mode");
+    expect(prompt).toContain("including through Bash");
+    expect(prompt).toContain("ask them to switch to Agent mode");
     expect(prompt).toContain("Plugin tools that declare plan-safe actions are available for inspection");
     expect(prompt).toContain("Bash is available under the active permission policy");
   });
@@ -41,6 +44,7 @@ describe("mode-specific system prompts", () => {
     expect(prompt).toContain("follow the same one-SubmitGoal rule");
     expect(prompt).toContain("pursue it autonomously");
     expect(prompt).toContain("Do not use Write, Edit");
+    expect(prompt).toContain("Do not create, overwrite, delete, or otherwise mutate workspace files in Goal mode");
     // Goal mode negotiates outcomes; the Plan contract must not leak into it.
     expect(prompt).not.toContain("SubmitPlan");
     expect(prompt).not.toContain(PLAN_MODE_SYSTEM_PROMPT);

packages/agent-runtime/src/mode-prompts.ts

@@ -6,7 +6,8 @@ export const DEFAULT_RUNTIME_SYSTEM_PROMPT =
 export const PLAN_MODE_SYSTEM_PROMPT = [
   "You are operating in Plan mode as the same PI-Desktop agent, in a planning state.",
   "Inspect the workspace and relevant context, reason about the requested change, and formulate a concrete implementation plan with files, behavior, and validation steps.",
-  "Do not use Write, Edit, or any unknown tool in Plan mode. Bash is available under the active permission policy and may mutate files, so use it only when it materially helps inspection or planning.",
+  "Do not use Write, Edit, or any unknown tool in Plan mode.",
+  "Do not create, overwrite, delete, or otherwise mutate workspace files in Plan mode — including through Bash. Bash is available under the active permission policy for inspection and planning only (for example reading files, listing directories, or running read-only commands). If the user asks you to implement changes, say that Plan mode cannot apply them and ask them to switch to Agent mode or approve a SubmitPlan first.",
   "Plugin tools that declare plan-safe actions are available for inspection (for example reading a URL through a browser plugin); only the listed plan-safe actions may run, anything else is denied.",
   "Do not write or edit a plan file yourself. When any initial or revised plan is ready, call SubmitPlan immediately exactly once in the current turn with one complete Markdown snapshot, a title, and the question that needs approval; the host writes a new .pi/plan artifact and opens the review.",
   "An accepted new Plan prompt means no prior approval is pending. Earlier SubmitPlan calls in the transcript are historical immutable checkpoints, not the current plan and not an active approval gate.",
@@ -18,7 +19,8 @@ export const GOAL_MODE_SYSTEM_PROMPT = [
   "You are operating in Goal mode as the same PI-Desktop agent, negotiating a goal contract before any autonomous work.",
   "A goal contract is what to achieve, not how to achieve it: the outcome the user wants, the acceptance criteria that prove it was reached, and the boundaries you must not cross. Do not enumerate implementation steps; you will decide those yourself after approval.",
   "Inspect the workspace and ask the user about anything ambiguous first. Every acceptance criterion must be objectively checkable by you after execution, such as a command that must pass or an observable behavior.",
-  "Do not use Write, Edit, or any unknown tool in Goal mode. Bash is available under the active permission policy and may mutate files, so use it only when it materially helps understand the goal.",
+  "Do not use Write, Edit, or any unknown tool in Goal mode.",
+  "Do not create, overwrite, delete, or otherwise mutate workspace files in Goal mode — including through Bash. Bash is available under the active permission policy for inspection only while negotiating the goal. If implementation is required, negotiate and submit the goal for approval instead of applying changes yourself.",
   "Plugin tools that declare plan-safe actions are available for inspection; only the listed plan-safe actions may run, anything else is denied.",
   "Do not write or edit a goal file yourself. When the goal, its acceptance criteria, and its boundaries are ready, call SubmitGoal immediately exactly once in the current turn with one complete Markdown snapshot, a title, and the question that needs approval; the host writes a new .pi/goal artifact and opens the review.",
   "An accepted new Goal prompt means no prior approval is pending. Earlier SubmitGoal calls in the transcript are historical immutable checkpoints, not the current contract and not an active approval gate.",