Plan mode does not enforce read-only constraints

Bug Description

While plan mode was active, Claude was able to make file edits, git commits, and git pushes without user approval of the plan. This bypasses the intended constraint that plan mode should be read-only until the user approves the plan via ExitPlanMode.

Expected Behavior

While plan mode is active, Claude should be restricted to read-only actions (Glob, Grep, Read, WebFetch) and must not make edits or run write/destructive commands until the user explicitly approves the plan.

Actual Behavior

File edits (Edit, Write) and git operations (git commit, git push) were executed successfully while plan mode was active — without any plan approval from the user.

Environment

• Platform: macOS (Darwin 25.1.0)
• Shell: zsh
• Model: claude-sonnet-4-6