Do not monkeypatch diff when in restricted mode kw_diff actually disabled restricted mode when 2 revisions were given, because it effectively disables the extension in this case. But the commands working with diff and patch need restricted mode always enabled, i.e. expansion enabled when writing to the working directory and - crucial for these commands - no expansion when reading the filelog.