VS Code extension 0.70 (agent-core-v2 default, #2916): config permission rules never applied - every Bash command prompts in manual mode

What version of Kimi Code is running?

VS Code extension 0.70 (sessions run on agent-core-v2 by default since #2916). Extension 0.67 (v1 engine) did not have this problem.

Which open platform/subscription were you using?

Kimi Code membership (OAuth).

What platform is your computer?

Windows 10/11, VS Code extension host, Bash tool running through cygwin/Git Bash.

What issue are you seeing?

In manual permission mode, every Bash tool call raises an approval prompt even when matching [[permission.rules]] allow entries exist in ~/.kimi-code/config.toml — including a blanket decision = "allow" / pattern = "Bash" rule and specific prefix rules like Bash(pwd*). A bare pwd still prompts.

kimi doctor sees the config file fine. Editing config.toml, reloading the window, restarting VS Code, and starting a brand-new conversation make no difference.

Rolling back with kimi.useAgentCoreV1 = true + window reload immediately restores correct behavior with the same config: rules fire, no prompts.

What steps can reproduce the bug?

1. ~/.kimi-code/config.toml: default_permission_mode = "manual" plus [[permission.rules]] decision = "allow", pattern = "Bash(pwd*)".
2. VS Code extension 0.70 (v2 default), open a new session, have the agent run pwd.
3. An approval prompt appears. Expected: none (rule matches). The same setup under v1 produces no prompt.

Root cause pointer

This looks like the VS Code extension manifestation of the root cause established in #2070 (comment, 2026-08-02): agent-core-v2 registers the permission config section but never ingests it into the Agent rule model (addRules() has zero production callers; bindBootstrap injects only defaultPermissionMode). The over-prompting symptom matches #2100 (kimi web). Before 0.70 the extension ran agent-core (v1), which is why extension users only started hitting this with #2916. Every extension session on 0.70+ is affected.

What is the expected behavior?

v2 loads [[permission.rules]] at session start and applies them to Bash calls (docs: "matched in order — the first matching rule takes effect"), as v1 does.

Ask

Please review/merge #2337, and confirm it covers the VS Code extension host and Bash tool calls — not only kimi web + MCP tools. Happy to re-test on v2 once a fix lands.

Start by reviewing the agent-core-v2 permission config registration, addRules(), and bindBootstrap, then inspect PR #2337 for its current coverage. Reproduce the issue in the VS Code extension host with a Bash pwd call and confirm that permission.rules are loaded and applied in manual mode without an approval prompt.