/plan mode strips tool set to 4 tools, breaking /fleet and read-only workflows

[Arithmomaniac]

Describe the bug

When a session enters plan mode (/plan or [[PLAN]] prefix), the available tool set drops from ~47 tools to just 4: powershell, report_intent, skill, task. A tools_changed_notice confirms the removal.

File reading still works via powershell and task(explore), and the model can ask clarifying questions via plain text. But the following tools have no workaround:

• read_agent / list_agents — cannot retrieve results from background agents. /fleet launches agents via task(mode: "background") but their results are silently lost.
• sql — todo tracking and session store queries fail, despite the system prompt referencing SQL tables and todo status.

Affected version

0.0.421-0

Steps to reproduce the behavior

1. Start a Copilot CLI session
2. Have a normal conversation — process log shows tool_count: 47
3. Enter plan mode via /plan <prompt>
4. The model receives a tools_changed_notice listing nearly all tools as "no longer available" — only powershell, report_intent, skill, task remain (process log: tool_count: 4)
5. Use /fleet to launch parallel work
6. Fleet dispatches background agents via task(mode: "background")
7. The model tries to call read_agent to retrieve results — tool does not exist
8. Background agent results that don't leave filesystem artifacts (e.g., investigation-only or API-call agents) are permanently lost

Expected behavior

Plan mode should retain tools that have no workaround:

Tool	Why it's needed	Workaround?
read_agent, list_agents	Retrieve background agent results	❌ None
sql	Todo tracking, session store queries	❌ None
ask_user	Clarifying questions during planning	⚠️ Degraded — model falls back to plain text questions, but the system prompt explicitly says "use the ask_user tool to confirm assumptions," creating a mismatch between instructions and available tools

Additional context

• OS: Windows 11 (x86_64), Windows Terminal, PowerShell 7
• The model generates incorrect self-diagnoses about tool availability (e.g., "read_agent may never have been available") because it only sees the current restricted set.
• The system prompt still references SQL tables, todo tracking, and ask_user usage, but these tools are unavailable — causing silent failures or instruction-tool mismatches.
• Related: Feature Request: Plan Mode Tool-Layer Enforcement #1171 requests plan mode to block write tools — this issue is the inverse: read-only tools with no workaround are being blocked.