Function deny_rules 

pub fn deny_rules(state: &PlanModeState) -> Vec<String>

The permissions-engine DENY patterns that narrow the tool surface to a read-only research phase while plan mode is active — an EMPTY vector when it is not, so a session that never enters plan mode evaluates byte-identically to one built before this module existed.

The patterns are written in the engine’s own rule grammar (crate::permissions::RuleSet):

• write(*) — the tool-agnostic write pseudo-tool crate::permissions::evaluate_path_safe evaluates for every path-bearing call, so write_file/edit_file are refused no matter which spelling reaches them.
• the write/exec tool names themselves (a bare tool-name glob matches regardless of subject), covering the shapes that carry no path argument: shell commands, patch envelopes, background execution, and image generation (which writes a file into the cwd).

Deliberately NOT denied: read_file, view_image, glob, search, list_dir, web_fetch, web_search, ask_user, current_time, get_context_remaining, update_plan and EXIT_PLAN_MODE — the research surface plus the two ways out of the mode. Refusing exit_plan_mode here would make plan mode a one-way door.