[Bug] Plan-accept context clear leaks previous skill's disallowed-tools to fresh context

Bug Description
A skill's disallowed-tools leaks past the plan-accept context clear and disables those tools for the first turn of the fresh context.

Version: 2.1.220 (macOS, CLI)
Setting in play: "showClearContextOnPlanAccept": true

What happens

A plugin skill that declares disallowed-tools: Bash, NotebookEdit, Task, Agent, WebFetch, WebSearch drafts a plan and calls ExitPlanMode. The user accepts, context is cleared (SessionStart:clear), and the plan is re-injected as a fresh user prompt. On the FIRST turn of that fresh context, the previous skill's disallowed-tools denylist is still applied: Bash, Agent, WebFetch and WebSearch are absent from the tool set. The restriction disappears on the next user message.

Concrete failure: the first thing needing Bash is another skill's !...`` preload, so the skill fails to load with

Shell command permission check failed for pattern "!"/path/to/skills/<skill>/../../scripts/read-config.sh"": Permission to use Bash has been denied.

Note the message is the tool-level variant (no with command <cmd> clause), i.e. the whole Bash tool was denied, not the specific command. Bash is allowed blanket-wide in both user and project settings, and the skill carries the matching pre-approval pattern in allowed-tools.

Transcript evidence (session 0e3bb974, 2026-07-26)

• 10:43:10 planning skill (own disallowed-tools incl. Bash) calls ExitPlanMode
• 10:57:05 plan accepted, SessionStart:clear fires, plan re-injected as a user prompt
• 10:57:10 model calls the build skill -> preload denied (message above)
• 10:57:10 deferred_tools_delta for that turn contains no Bash, no WebFetch, no WebSearch, no Agent
• 10:57:18 model runs ToolSearch("select:Bash,BashOutput,KillShell") -> returns only TaskOutput, TaskStop, so Bash was genuinely not in the registry
• 11:00:48 next user message -> deferred_tools_delta re-adds WebFetch + WebSearch, agent_listing_delta re-adds all agent types
• 11:00:53 same build skill loads fine, preload resolves normally

Reproduced in 4 sessions (2026-07-25 21:09, 23:47; 2026-07-26 08:03, 10:57), each preceded by SessionStart:clear.

Expected

After the plan-accept context clear, the fresh context should start with the full, unrestricted tool set. The exited skill's disallowed-tools should not apply to it.

Impact

Any post-plan flow whose first action needs a tool the planning skill denied fails immediately, with a message that points at the wrong culprit (it names the preload "pattern", suggesting a bad allowed-tools entry, while the real cause is the tool-level denial). Workaround: send any extra message before the first tool use, or set showClearContextOnPlanAccept: false.

Environment Info

• Platform: darwin
• Terminal: vscode
• Version: 2.1.220
• Feedback ID: 8304bd0d-ebb3-426e-8fac-dc4fa5943127

Errors

[]