manual 模式下Write Edit 工具调用 不申请权限，总是直接改

What version of Kimi Code is running?

0.23.6

Which open platform/subscription were you using?

Kimi Code (OAuth)

Which model were you using?

kimi-for-coding

What platform is your computer?

Darwin 24.6.0 x86_64 i386

What issue are you seeing?

manual 模式下Write Edit 工具调用 不申请权限，总是直接改

What steps can reproduce the bug?

default_model = "kimi-code/kimi-for-coding"

[providers."managed:kimi-code"]
type = "kimi"
api_key = ""
base_url = "https://api.kimi.com/coding/v1"

[providers."managed:kimi-code".oauth]
storage = "file"
key = "oauth/kimi-code"

[services.moonshot_search]
base_url = "https://api.kimi.com/coding/v1/search"
api_key = ""

[services.moonshot_search.oauth]
storage = "file"
key = "oauth/kimi-code"

[services.moonshot_fetch]
base_url = "https://api.kimi.com/coding/v1/fetch"
api_key = ""

[services.moonshot_fetch.oauth]
storage = "file"
key = "oauth/kimi-code"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Read"
reason = "只读工具自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Grep"
reason = "只读工具自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Glob"
reason = "只读工具自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(ls *)"
reason = "只读 Bash 命令自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(find *)"
reason = "只读 Bash 命令自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(which *)"
reason = "只读 Bash 命令自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(date *)"
reason = "只读 Bash 命令自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(pwd *)"
reason = "只读 Bash 命令自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(cd *)"
reason = "只读 Bash 命令自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(strings *)"
reason = "只读二进制字符串提取，自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(wc *)"
reason = "只读统计命令，自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(tail *)"
reason = "只读文件查看，自动放行"

[[permission.rules]]
decision = "deny"
scope = "user"
pattern = "Bash(sed -i*)"
reason = "sed -i 会原地修改文件，拦截"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(sed *)"
reason = "sed 只读输出自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(git status*)"
reason = "git 只读命令自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(git diff*)"
reason = "git 只读命令自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(git log*)"
reason = "git 只读命令自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(git show*)"
reason = "git 只读命令自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(git branch*)"
reason = "git 只读命令自动放行"

[[permission.rules]]
decision = "allow"
scope = "user"
pattern = "Bash(git remote*)"
reason = "git 只读命令自动放行"

[thinking]
enabled = true

全局配置，没有项目级配置

What is the expected behavior?

No response

Additional information

No response

No source file or test is named. Start by reproducing the report with Kimi Code 0.23.6, OAuth, manual mode, and the shown global permission rules, focusing on Write and Edit tool calls. Trace the permission decision entry point and add coverage showing that manual mode requests approval before modifying files, while preserving the configured read-only allowances.