Modes

Plan and Work are product modes, not Crystal types. PlanMode is stored on the session and restored on resume. It is not written to config.json. Switching does not start a new transcript.

/plan, Tab, and Shift+Tab flip the mode, replace the live system message, and refresh the chrome. The rest of the conversation stays. A new session starts in Work.

Each mode has its own system text and tool executor. A turn uses the executor that is current when the model request runs. The plugin model purpose for that turn is plan or work.

Catalogs

Both catalogs start from the built-in tools for that catalog, then add:

1. Disk plugins listed for that catalog.
2. External tools listed for that catalog.
3. skill, when skills are enabled.
4. describe_image, when an image describer is configured.

disabledBuiltInTools then removes matching built-in names. view_image is not on the text catalog. It is added only to the multimodal executor, and only while the session model accepts images. The same disable list can remove it.

Mode	Built-in tools	Side effects
Plan	read, list, tree, glob, grep, search, todowrite, todoread, question, plus skill and describe_image when those features are on, plus view_image on image turns	No edit, write, bash, bash_start, bash_status, bash_logs, or bash_stop. Those names are not in the Plan catalog.
Work	The Plan built-ins, plus edit, write, and bash. When a background-task registry exists, also bash_start, bash_status, bash_logs, and bash_stop	After approval. bash uses bashTimeoutSeconds.

External tools listed for Plan stay on the Plan catalog. Their floor is Write + Workspace. Declared path arguments can raise authority or become Forbidden. A tool-provided classifier can raise risk or authority. It cannot lower them. They still go through approval.

Plan rejects side effects twice

The Plan catalog omits the side-effect tools, so a normal turn cannot call them. If a call arrives anyway, approval rejects it before classification:

Plan mode does not allow <name>.

That check covers edit, write, bash, bash_start, and bash_stop. bash_status and bash_logs are reads, but they are only built for Work.

A write or edit into a read-only session directory is also rejected before classification:

Writing to a read-only session directory is not allowed. Change its access with /access.

Work does not skip approval. See Approval and Safety.