Plan mode restrictions can be bypassed by LLM

Description

In plan mode, the LLM can bypass the read-only restrictions by directly calling tools like Bash or Edit without going through ExitPlanMode.

Steps to Reproduce

1. Enter plan mode (e.g., via /plan or complex task request)
2. System prompt states: "you MUST NOT make any edits... run any non-readonly tools"
3. LLM can still call Bash (e.g., git checkout -b) or Edit directly
4. These tools execute successfully despite plan mode being active

Expected Behavior

Plan mode should enforce read-only restrictions at the tool execution level, not just via system prompt instructions.

Actual Behavior

• ExitPlanMode correctly requires user approval
• But other tools (Bash, Edit, Write) can be called directly
• LLM may ignore system prompt instructions (intentionally or not)

Environment

• Claude Code version: 2.0.64
• OS: macOS (Darwin 25.1.0)

Suggested Fix

Consider enforcing plan mode restrictions at the tool execution layer, similar to how ExitPlanMode requires user approval. This would prevent LLM from bypassing restrictions regardless of prompt adherence.