Plan mode allows Edit tool despite explicit restrictions

Bug Description

Component: Plan mode - Core restriction enforcement
Summary: Plan mode allowed Edit tool on settings.local.json despite explicit system reminders that only the plan file should be editable

Environment

• Claude Code Version: 2.0.73
• OS: macOS 15.1 (Darwin 25.1.0, ARM64)
• Model: claude-opus-4-5-20251101

What Happened

During an active plan mode session, Claude received multiple system reminders stating:

Plan mode is active. The user indicated that they do not want you to execute yet -- you MUST NOT make any edits (with the exception of the plan file mentioned below), run any non-readonly tools (including changing configs or making commits), or otherwise make any changes to the system.

No plan file exists yet. You should create your plan at /Users/[user]/.claude/plans/[plan-id].md using the Write tool. You should build your plan incrementally by writing to or editing this file. NOTE that this is the only file you are allowed to edit - other than this you are only allowed to take READ-ONLY actions.

Despite these explicit restrictions, Claude was able to successfully execute:

Edit tool on /Users/[user]/[project]/.claude/settings.local.json
Changed line 2 from "model": "opus-4-5" to "model": "claude-opus-4-5-20251101"

The edit was successfully applied to the file system.

Expected Behavior

Plan mode should enforce restrictions and either:

1. Block the Edit tool call from executing on any file except the designated plan file
2. Return an error message when attempting to edit non-plan files
3. Require explicit user confirmation to exit plan mode before allowing edits

The system should enforce the "MUST NOT make any edits" directive regardless of the file being edited.

Steps to Reproduce

1. Enter plan mode (user triggers EnterPlanMode)
2. Receive system reminder about plan mode restrictions
3. Attempt to use Edit tool on any file other than the designated plan file (e.g., .claude/settings.local.json)
4. Observe that the edit goes through despite restrictions

Error Messages

No error was thrown. The Edit tool executed successfully and returned:

The file [filepath] has been updated.

Additional Context

• This was discovered when fixing a model configuration issue (changing "opus-4-5" to the correct model ID)
• The edit itself was correct and helpful, but the fact that it bypassed plan mode restrictions is concerning
• User correctly identified this as a potential safety issue since unintended changes could be made during what should be a read-only planning phase
• The restriction appears to be documented but not enforced at the tool execution level

Security Implications

This could allow unintended modifications to the codebase during plan mode, defeating the purpose of having a separate planning phase where changes should only be proposed, not executed.

Related Issues

Also reported to compound-engineering plugin: https://github.com/EveryInc/compound-engineering-plugin/issues/57