Add Discuss mode, separate from Plan

Read-only was conflated with plan mode: picking it pushed the agent
toward proposing a plan even when the user just wanted to talk safely.

- Mode.DISCUSS: same read-only enforcement as plan mode, but no
  planning contract — the agent explores and describes changes in
  chat instead of proposing them
- propose_plan is now always registered (the GUI flips a live
  session's mode via set_mode) and rejected outside plan mode, with
  a discuss-appropriate message
- GUI mode menu: Discuss / Plan / Ask for approval / Full access /
  Custom, ordered by how much the agent may do

Author: rohitprasad15

platform/coworker/agent.py

@@ -35,6 +35,13 @@
 from .tools.shell import LocalExecutor
 from .tools.todo import TodoList
 
+# Appended each turn while discuss mode is active: enforcement-only read-only, with no
+# pressure toward a plan proposal (that's what distinguishes it from plan mode).
+_DISCUSS_MODE_CONTEXT = """\
+Discuss mode is active: write and shell tools are disabled. Explore and answer freely; if
+the user asks for a change, describe it in chat instead of attempting it (they can switch
+to plan or approval mode to have you make it)."""
+
 # Appended to the latest user message every turn while plan mode is active. The mode can
 # flip mid-session (plan approval), so this can't live in the static instructions.
 _PLAN_MODE_CONTEXT = """\
@@ -219,10 +226,10 @@ def build_engine(
         auto_allow_tools=set(config.auto_allow),
         roots=root_list or None,
     )
-    # Sessions that START in plan mode get the exit door: propose_plan, whose approval
-    # flips `permissions.mode` live (the engine handles the round-trip).
-    if mode is Mode.PLAN:
-        registry.register(propose_plan_tool())
+    # The plan-mode exit door. Always registered (surfaces can flip a live session into
+    # plan mode via set_mode, and the registry is fixed at build); the engine rejects the
+    # call whenever the session isn't actually in plan mode.
+    registry.register(propose_plan_tool())
 
     # Per-turn ephemeral context, appended to the latest user message since mid-thread system
     # messages aren't reliable across providers. Two producers: the plan-mode reminder (mode can
@@ -238,6 +245,8 @@ def context_provider() -> str:
         parts = []
         if permissions.mode is Mode.PLAN:
             parts.append(_PLAN_MODE_CONTEXT)
+        elif permissions.mode is Mode.DISCUSS:
+            parts.append(_DISCUSS_MODE_CONTEXT)
         if roots_context is not None:
             ctx = roots_context()
             if ctx:

platform/coworker/engine.py

@@ -395,8 +395,21 @@ async def _handle_plan_proposal(self, tool_call: ToolCall) -> AsyncIterator[Even
         the user's feedback so the agent can revise."""
         args = tool_call.arguments or {}
         plan = str(args.get("plan", ""))
-        if self.plan_approver is None:
-            result: dict[str, Any] = {
+        if self.permissions.mode is not Mode.PLAN:
+            # The tool is always registered (mode can flip mid-session), but proposing a
+            # plan only means something while the session is actually in plan mode. The
+            # right next step differs by mode: discuss stays read-only, so the agent
+            # should talk through the change; write-capable modes should just do it.
+            if self.permissions.mode is Mode.DISCUSS:
+                error = (
+                    "not in plan mode — this is discuss mode (read-only), so describe "
+                    "the proposed changes in chat instead"
+                )
+            else:
+                error = "not in plan mode — proceed with the work directly"
+            result: dict[str, Any] = {"approved": False, "error": error}
+        elif self.plan_approver is None:
+            result = {
                 "approved": False,
                 "error": "plan approval isn't available here",
             }

platform/coworker/permissions.py

@@ -15,12 +15,20 @@
 
 
 class Mode(str, Enum):
-    PLAN = "plan"  # read-only
+    DISCUSS = "discuss"  # read-only conversation: no edits, no planning workflow
+    PLAN = (
+        "plan"  # read-only + the planning contract (explore → propose_plan → execute)
+    )
     INTERACTIVE = "interactive"  # ask for approval (default)
     AUTO = "auto"  # full access
     CUSTOM = "custom"  # interactive + auto-allow the config's `auto_allow` tools
 
 
+# Modes whose enforcement is read-only. DISCUSS and PLAN share the same gate; they differ
+# only in intent — PLAN additionally drives the agent toward a propose_plan approval.
+READ_ONLY_MODES = frozenset({Mode.DISCUSS, Mode.PLAN})
+
+
 @dataclass
 class Decision:
     allowed: bool
@@ -74,9 +82,11 @@ def evaluate(
         is_shell = tool_name == SHELL_TOOL
         consequential = is_write or is_shell or requires_approval
 
-        # Plan mode: read-only.
-        if self.mode is Mode.PLAN and consequential:
-            return Decision(False, "plan mode is read-only", needs_user=False)
+        # Discuss / plan modes: read-only.
+        if self.mode in READ_ONLY_MODES and consequential:
+            return Decision(
+                False, f"{self.mode.value} mode is read-only", needs_user=False
+            )
 
         # Path scoping for writes that name a path (all modes): must land in a writable root.
         if is_write:

platform/coworker/server/run.py

@@ -114,7 +114,9 @@ def main(argv=None) -> None:
     parser.add_argument("--cwd", default=None, help="optional seed/default workspace")
     parser.add_argument("--model", default=cfg.model)
     parser.add_argument(
-        "--mode", default=cfg.mode, choices=["plan", "interactive", "auto"]
+        "--mode",
+        default=cfg.mode,
+        choices=["discuss", "plan", "interactive", "auto"],
     )
     parser.add_argument("--host", default=cfg.host)
     parser.add_argument("--port", type=int, default=cfg.port)

platform/surfaces/gui/src/components/Composer.tsx

@@ -5,7 +5,8 @@ import { Dropdown, type Option } from "./Dropdown";
 import { Icon } from "./Icon";
 
 const PERMISSION_OPTIONS: Option[] = [
-  { value: "plan", label: "Read-only", description: "Suggest changes — don't edit files or run commands" },
+  { value: "discuss", label: "Discuss", description: "Chat and explore — no edits or commands" },
+  { value: "plan", label: "Plan", description: "Explore read-only, propose a plan for approval, then build" },
   { value: "interactive", label: "Ask for approval", description: "Ask before edits and commands" },
   { value: "auto", label: "Full access", description: "Run everything without asking" },
   { value: "custom", label: "Custom", description: "Use auto-allow rules from config.toml" },

platform/tests/test_plan_mode.py

@@ -172,13 +172,79 @@ def test_build_engine_plan_mode_wiring(tmp_path):
         engine.executor.close()
 
 
-def test_build_engine_interactive_has_no_propose_plan(tmp_path):
+def test_build_engine_interactive_registers_tool_without_reminder(tmp_path):
     from coworker.agent import build_engine
     from coworker.agents import code_agent
 
+    # The tool is always registered (the GUI can flip a live session into plan mode via
+    # set_mode), but the per-turn reminder only appears while actually planning.
     engine = build_engine(agent=code_agent(), workspace=tmp_path, provider=_Stub())
     try:
-        assert "propose_plan" not in engine.registry.names()
+        assert "propose_plan" in engine.registry.names()
         assert "Plan mode is active" not in engine.context_provider()
     finally:
         engine.executor.close()
+
+
+def test_discuss_mode_blocks_writes_without_plan_pressure(tmp_path):
+    engine, permissions = _plan_engine(
+        tmp_path,
+        [
+            _tool_turn("write_file", {"path": "x.py", "content": "x"}),
+            _text_turn("here's what I'd change instead"),
+        ],
+    )
+    permissions.mode = Mode.DISCUSS
+    events = _collect(engine, "tweak x.py")
+    assert not (tmp_path / "x.py").exists()
+    assert any(
+        m.get("role") == "tool" and "discuss mode is read-only" in m["content"]
+        for m in engine.messages
+    )
+
+
+def test_propose_plan_in_discuss_mode_says_describe_instead(tmp_path):
+    engine, permissions = _plan_engine(
+        tmp_path,
+        [_tool_turn("propose_plan", {"plan": "p"}), _text_turn("ok, describing")],
+    )
+    permissions.mode = Mode.DISCUSS
+    events = _collect(engine, "go")
+    assert EventType.PLAN_PROPOSED not in [e.type for e in events]
+    assert any(
+        m.get("role") == "tool" and "describe the proposed changes" in m["content"]
+        for m in engine.messages
+    )
+
+
+def test_build_engine_discuss_reminder_not_plan_contract(tmp_path):
+    from coworker.agent import build_engine
+    from coworker.agents import code_agent
+
+    engine = build_engine(
+        agent=code_agent(), workspace=tmp_path, provider=_Stub(), mode=Mode.DISCUSS
+    )
+    try:
+        ctx = engine.context_provider()
+        assert "Discuss mode is active" in ctx
+        assert "propose_plan" not in ctx  # no planning pressure in discuss mode
+    finally:
+        engine.executor.close()
+
+
+def test_propose_plan_outside_plan_mode_is_rejected(tmp_path):
+    async def approve(args):  # pragma: no cover - must not be called
+        raise AssertionError("approver should not run outside plan mode")
+
+    engine, permissions = _plan_engine(
+        tmp_path,
+        [_tool_turn("propose_plan", {"plan": "p"}), _text_turn("ok, proceeding")],
+        plan_approver=approve,
+    )
+    permissions.mode = Mode.INTERACTIVE  # session was flipped out of plan mode
+    events = _collect(engine, "go")
+    assert EventType.PLAN_PROPOSED not in [e.type for e in events]
+    assert any(
+        m.get("role") == "tool" and "not in plan mode" in m["content"]
+        for m in engine.messages
+    )