Upstream 2283979199 (Preapprove agent tmp directory access) extended the
agent.ts whitelistedDirs with Global.Path.tmp/*, and the new v1.14.33 test
asserts tmp/agent-work -> allow on the explore agent. Kilo's patchAgents
replaces the whole explore permission and had only Truncate.GLOB in its
external_directory block, so both /some/other/path (expected ask) and
tmp/agent-work (expected allow) resolved to deny via the outer '*':'deny'
catch-all (findLast picks it over any defaults external_directory rule).
Commit d2e21c5006 tried to fix this by dropping the '*':'ask' on the
assumption that defaults already provided it — that rationale was wrong,
since defaults' rules come before the patch's catch-all in the merged
ruleset. Mirror upstream's inline shape instead: thread whitelistedDirs
through to patchAgents and rebuild the explore external_directory as
{ '*':'ask', ...whitelistedDirs -> 'allow' }, matching what upstream's
explore does natively.
Mark IJbema
279b604537