From bedd9083317df05c0fff6426daf8a34b31b25f33 Mon Sep 17 00:00:00 2001
From: kingwl <kingwenlu@gmail.com>
Date: Fri, 10 Jul 2026 21:24:07 +0800
Subject: [PATCH] =?UTF-8?q?test(mode):=20pin=20the=20mode-both=20compositi?=
 =?UTF-8?q?on=20=E2=80=94=20one=20visibility=20rule,=20both=20surfaces?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A review finding claimed plan mode under the registry's 'both'
presentation leaves non-allowlisted native schemas on the wire. The
claim misreads the filter predicate — 'keep visible plus run_code' IS
'drop everything else' — and the SDK re-render shares the same visible()
predicate, which is precisely the remedy the finding requests. This
test refutes it empirically on unchanged code (first run green) and
stays as the regression pin: plan + both = [exit_plan_mode, read,
run_code] on the wire, read documented and write absent in the SDK.
---
 packages/mode/mode/tests/mode.spec.ts | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/packages/mode/mode/tests/mode.spec.ts b/packages/mode/mode/tests/mode.spec.ts
index ea4134f9f7..21a15fb2db 100644
--- a/packages/mode/mode/tests/mode.spec.ts
+++ b/packages/mode/mode/tests/mode.spec.ts
@@ -379,6 +379,29 @@ describe('the soft layer', () => {
     expect(sdk).not.toContain('write(args:')
   })
 
+  it('filters native wire schemas by the allowlist under mode both, alongside the pruned SDK', async () => {
+    class FakeRuntime extends CodeRuntime {
+      readonly language = 'typescript'
+      readonly isolation = 'fake'
+      run(_request: CodeRunRequest): Promise<CodeRunResult> { return Promise.resolve({ logs: [] }) }
+    }
+    const ctx = new Context()
+    await ctx.plugin(SystemPrompt)
+    await ctx.plugin(ToolRegistry, { mode: 'both' })
+    await ctx.plugin(FakeRuntime)
+    await ctx.plugin(ModesService)
+    registerNamedTools(ctx, ['read', 'write'])
+    const agent = agentWithSession()
+    agent.session.append('mode/set', { mode: PLAN_MODE })
+    const assembly = await ctx.systemPrompt.assemble({ agent })
+    // ONE visibility rule covers both surfaces: the denied write is absent
+    // from the native wire schemas AND from the SDK declaration.
+    expect(assembly.tools.map(tool => tool.name).sort()).toEqual(['exit_plan_mode', 'read', 'run_code'])
+    const sdk = assembly.sections.find(section => section.name === 'tools:sdk')?.text ?? ''
+    expect(sdk).toContain('read(args:')
+    expect(sdk).not.toContain('write(args:')
+  })
+
   it('leaves the Code Mode SDK section untouched in the default mode', async () => {
     class FakeRuntime extends CodeRuntime {
       readonly language = 'typescript'