Module plan_mode 

BP-3 (§2 module 8 plan_mode, catalog rows “Plan-mode enter/exit tools” and “Plan mode (read-only research phase)”): the model-invocable restriction mode.

Three parts, one state object:

• EnterPlanModeTool / ExitPlanModeTool — the two tools the module is DEFINED by (design §2 module 8 “D1 plan enter/exit tools”). Both are ordinary crate::tools::Tools registered by crate::tools::ToolRegistry::from_config when the module is active, so they are advertised, permission-gated, and evidence-checkable exactly like every other tool.
• PlanModeState — the shared mode flag plus the accumulated plan text. Lives on crate::tools::ToolContext (an Arc, shared with every clone of the context), so the agent’s permission gate and the tools see one state.
• deny_rules — the module’s actual RESTRICTION. plan_mode’s §2.1 dependency edge is plan_mode → permissions.rules | permissions.sandbox (“a restriction mechanism”), and this is that edge honored literally: while the mode is active the agent folds these patterns into the permissions engine’s DENY tier, the same first-match deny→ask→allow evaluation every other rule gets. There is no second, parallel enforcement path.

Exit requires an approval, not a flag flip. exit_plan_mode carries the plan into a crate::permissions::ApprovalRequest answered by whatever crate::permissions::PermissionsApprovalHandler the embedder installed — under an SDK-owned runtime that is the frontend request broker (crate::server), i.e. the same door harness.v1.approvals.list lists and harness.v1.runtimes.respond answers. No handler installed means no human can answer, so the exit is refused and the mode stays on (fail-closed, the same posture crate::permissions::resolve_ask takes).

Structs

EnterPlanModeTool

enter_plan_mode — start the read-only research phase.

ExitPlanModeTool

exit_plan_mode — present the plan for approval and, if approved, leave the read-only phase.

PlanModeState

The shared plan-mode state: whether the read-only research phase is active, and the plan accumulated so far.

Constants

ENTER_PLAN_MODE

Registered name of the enter tool (Claude Code’s EnterPlanMode).

EXIT_PLAN_MODE

Registered name of the exit tool (Claude Code’s ExitPlanMode).

Functions

deny_rules

The permissions-engine DENY patterns that narrow the tool surface to a read-only research phase while plan mode is active — an EMPTY vector when it is not, so a session that never enters plan mode evaluates byte-identically to one built before this module existed.