[code-review] browser/mobile_device classified as read-only — Plan mode allows state-mutating JS execution without confirmation

[topcheer]

File: internal/permission/mode.go
Lines: 100-108
Severity: High

Problem

browser and mobile_device are listed in IsReadOnlyTool() (line 102). But browser can execute arbitrary JavaScript (action="evaluate"), click, type, upload files. mobile_device can tap, type, install/uninstall apps. These are state-mutating operations. In Plan mode (config_policy.go:156-159), IsReadOnlyTool returns true → auto-allowed without confirmation. Plan mode's read-only guarantee is violated.

Trigger Scenario

1. Agent is in Plan mode (supposed to be strictly read-only)
2. Agent calls browser(action="evaluate", expression="document.title='hacked'")
3. IsReadOnlyTool("browser") returns true → Plan mode returns Allow
4. JavaScript executes — state modified in Plan mode

Expected vs Actual

• Expected: browser and mobile_device require confirmation in Plan mode (not read-only)
• Actual: Both auto-allowed in Plan mode — read-only guarantee violated

Fix

Remove browser and mobile_device from the IsReadOnlyTool() read-only list.

[topcheer]

Fixed in 6da4121. Removed browser and mobile_device from IsReadOnlyTool(). These tools can mutate state (JS evaluation, clicks, typing, app install/uninstall) and must not be auto-allowed in Plan mode's read-only guarantee.