3025fbaeb3
Review finding with a real in-repo instance: the structured runtime's per-spawn final-assembly wrapper (prepend, post-next) re-injects structured_output OUTSIDE the mode filter, so a structured child in plan mode would see a tool the gate then denies — the soft policy and the hard gate telling different stories. The suggested fix (make the mode filter outermost) cannot beat that instance: prepend unshifts, so the per-spawn listener always registers later and wraps outer. Two-part resolution instead. Semantically, structured_output enters the shipped plan allowlist — it is a child's pure result channel, the same ask/report class as ask_user_question and exit_plan_mode, so the filter, the re-injection, and the gate now agree wherever a structured child runs in plan mode. Mechanically, the filter registers with prepend anyway: it now wraps outside every append-registered listener regardless of load order (regression test pins a pre-registered post-next mutator being filtered), narrowing the documented cosmetic residual to prepend-after-load listeners only, where the gate still covers execution. Severity note: no execution breach existed — the gate held throughout; this closes the prompt-honesty gap.
mode/ — session-mode policy family
Session modes: named, logged, per-agent policy states, with plan mode as the first shipped definition. A single product package — there is no interface/implementation seam here, because a mode's variable parts are config values (allowlist, section text), not swappable implementations.
| Package | Role | ctx key |
|---|---|---|
mode/ |
mode/set vocabulary + fold, the ctx.modes service (list/get/set with the turn-boundary flush), the soft layer (assemble filter + mode:policy section), the hard layer (tools/pre-execute deny-by-default gate), and the model-facing exit_plan_mode review tool |
ctx.modes |
The mode in force is a pure function of the session log (SessionEventMap['mode/set'], last one wins), so resume and fork restore it with no extra machinery; the default mode is the absence of policy, keeping the plugin invisible until a mode is set. UIs read flips off session/event: the stdio app exposes /mode, the ACP bridge maps the vocabulary to the session-mode picker. RFC: plan mode.