[Bug]: Agent profile tools/disallowedTools ignored in interactive mode (works in -p mode with KIMI_CODE_EXPERIMENTAL_FLAG=1)

What version of Kimi Code is running?

0.34.0

Which open platform/subscription were you using?

Windsurf (WS/glm)

Which model were you using?

GLM (via Windsurf provider)

What platform is your computer?

macOS (Darwin, arm64)

What issue are you seeing?

Custom agent profiles declare tools (allowlist) and disallowedTools (denylist) in frontmatter. These fields are completely ignored in interactive mode — the model has access to the full, unrestricted tool set regardless of the profile's tool policy.

The same profile works correctly in -p (prompt) mode when combined with KIMI_CODE_EXPERIMENTAL_FLAG=1 — the tool policy is enforced and blocked tools are hidden from the model's schema.

Summary:

Mode	Without flag	With KIMI_CODE_EXPERIMENTAL_FLAG=1
-p (prompt)	Tool policy ignored	Tool policy enforced
Interactive	Tool policy ignored	Tool policy still ignored

The documentation states:

tools — Allowlist of tool names. Omit to allow all tools.
disallowedTools — Denylist with the same syntax and matching rules, applied after tools.
tools and disallowedTools shape the tools shown to the model and are enforced again before execution.

This does not match actual behavior in interactive mode.

What steps can reproduce the bug?

1. Create a custom agent profile at ~/.kimi-code/agents/test-restricted.md:

---
name: test-restricted
override: true
description: Test agent with restricted tools.
tools:
  - mcp__lean-ctx__ctx_read
  - mcp__lean-ctx__ctx_glob
  - mcp__lean-ctx__ctx_search
---

You are a read-only test agent.

2. Run in interactive mode with the experimental flag:

KIMI_CODE_EXPERIMENTAL_FLAG=1 kimi --agent=test-restricted

3. Ask the model to run ctx_shell:

> try ctx_shell with command echo test

4. Observe: ctx_shell executes successfully despite not being in the tools allowlist.

Compare with prompt mode (same profile, same flag):

KIMI_CODE_EXPERIMENTAL_FLAG=1 kimi -p "Use ctx_shell with command 'echo test'" --agent=test-restricted

Result: model correctly reports ctx_shell is not in its tool set and refuses to use it.

What is the expected behavior?

tools and disallowedTools should be enforced in interactive mode the same way they are in -p mode with KIMI_CODE_EXPERIMENTAL_FLAG=1. If the experimental flag is required for tool policy enforcement, this should be documented in the agents customization page.

Additional information

Verified with 3 independent test scenarios:

1. disallowedTools without tools — ignored in both modes (without flag)
2. tools allowlist (explicit, excluding ctx_shell) — ignored in interactive mode, enforced in -p mode with flag
3. Sub-agents via Agent tool — tool policy from sub-agent profile also ignored

Related: #2398 covers the flag requirement for -p mode. This issue covers the interactive mode gap — the flag does not enable tool policy enforcement in interactive sessions.

The system prompt from the profile IS applied correctly (model follows instructions in both modes), but the tool policy is only enforced in -p mode with the experimental flag.

This makes per-agent tool restrictions impossible in interactive sessions — a significant gap for multi-agent orchestration patterns where different agents need different capability boundaries.

---

中文摘要： 自定义 agent profile 中的 tools（白名单）和 disallowedTools（黑名单）字段在交互模式下完全被忽略。设置 KIMI_CODE_EXPERIMENTAL_FLAG=1 后，-p 模式下 tool policy 正常生效，但交互模式下仍然无效。System prompt 正常生效，但 tool 限制在交互模式下不生效。文档中描述的功能与交互模式的实际行为不符。

Start by comparing the interactive-mode and -p prompt-mode paths, using custom agent tool-policy handling with KIMI_CODE_EXPERIMENTAL_FLAG=1 as the entry point. Reproduce the test-restricted profile case with ctx_shell, then trace where tools and disallowedTools are applied. Done means interactive sessions enforce the same allowlist and denylist behavior as prompt mode, including sub-agents, with coverage for the reported scenarios.