Map --read-only/--plan-only for the `agent` tool to its native --permission-mode (agent v0.24.0)

[konard]

Summary

@link-assistant/agent v0.24.0
(PR link-assistant/agent#272,
merged 2026-06-17, closing
link-assistant/agent#271)
added a native, enforceable permission system — --permission-mode
(auto | plan | readonly | ask), an OpenCode-compatible --permission
JSON policy, and a read-only shell allowlist (ls, pwd, cat, grep, head,
tail, stat, file, find/read-only, git diff/log/status, …).

agent-commander v0.6.2 has not picked this up. Its tool matrix and
buildAgentCommand still treat agent as having no permission system:

• README tool matrix: agent → Read-only Mode "❌ not enforceable".
• "Agent-specific Features" → "Unrestricted access: No sandbox, no permissions
  system - full autonomous execution".
• Read-only Planning Mode section: "--tool agent --read-only is rejected
  because @link-assistant/agent has no native permission system."

So start-agent --tool agent --read-only (and --plan-only) fails before
launch, even though the underlying CLI can now enforce exactly that.

Impact

This blocks the read-only / planning path for the agent tool behind
agent-commander's uniform --read-only flag — the one tool that is fully
controlled by the link-assistant org. Concretely it blocks the Formal-AI desktop
app (link-assistant/formal-ai#511),
which wants to run basic read-only terminal operations (ls ~, pwd,
cat <file>) through agent-commander → agent, and currently has to fall back
to another tool or to raw --tool-arg passthrough.

Desired behavior

Map --read-only / --plan-only for the agent tool to the new native mode,
reaching parity with the other tools in the matrix:

• agent + --read-only → agent --permission-mode readonly
  (deny edits/writes, allow read-only shell, never ask — works with single-shot
  --prompt).
• agent + --plan-only → agent --permission-mode plan (or keep --read-only
  → readonly and --plan-only → plan, matching agent's own distinction).
• Stop rejecting --tool agent --read-only; remove the "not enforceable" row and
  the "no permissions system" note from the README/docs.
• Optionally surface --permission '<json>' passthrough for fine-grained
  OpenCode-style policies (agent already accepts it).

References

• agent permission docs: https://github.com/link-assistant/agent/blob/main/docs/permissions.md
• agent v0.24.0 / PR #272 (native permission system, JS + Rust)
• agent #271 (closed COMPLETED) — original request originated from this consumer
• agent-commander Add hard read-only / no-shell tool mode for planning tasks #20 (closed) — added enforceable read-only for claude/codex/opencode/qwen/gemini
• Downstream consumer: Unknown prompt: Выполни ls ~ в терминале formal-ai#511

Environment

• agent-commander: v0.6.2 (latest; rust_0.2.4)
• agent: v0.24.0 (native permission system present)