[BUG] ExitPlanMode auto-approved without user interaction under acceptEdits permission mode (v2.1.63)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

When using defaultMode: "acceptEdits" in .claude/settings.json, the ExitPlanMode tool is auto-approved without showing any approval dialog to the user. The tool immediately returns:

"User has approved your plan. You can now start coding."

...but the user never saw the plan, never approved it, and had no opportunity to reject it.

This occurs 100% of the time under acceptEdits mode — not intermittently. The acceptEdits permission mode treats ExitPlanMode as a regular tool call (like Edit/Write) rather than as a workflow approval gate that should always require explicit user interaction.

Why this is distinct from #29548

Issue #29548 reports intermittent auto-approval in general contexts. This issue reports that acceptEdits mode makes it deterministic and 100% reproducible — the approval dialog is NEVER shown. The user expectation is that acceptEdits auto-approves file edits (Edit/Write tools), NOT workflow decisions like plan approvals.

Controlled experiment performed

To confirm the behavior, we ran a deliberate test:

1. Entered plan mode via EnterPlanMode
2. Wrote a trivial test plan to the plan file
3. Called ExitPlanMode
4. Result: Immediately returned "User has approved your plan" — no dialog, no prompt, no user interaction whatsoever
5. The agent proceeded to execute immediately

This was reproduced twice in the same session with identical results.

What Should Happen?

ExitPlanMode should always present an approval/rejection dialog to the user, regardless of the permission mode. Interactive workflow gates (ExitPlanMode, AskUserQuestion) should be exempt from acceptEdits auto-approval because they are not file edits — they are user decision points.

Expected behavior under acceptEdits:

• Edit/Write tool calls → auto-approved (correct current behavior)
• ExitPlanMode → approval dialog shown, user reviews and approves/rejects
• AskUserQuestion → options shown, user selects (see also #29618)

Steps to Reproduce

1. Set "defaultMode": "acceptEdits" in .claude/settings.json
2. Start a session
3. Enter plan mode (via EnterPlanMode or Shift+Tab)
4. Write any plan to the plan file
5. Call ExitPlanMode
6. Observe: No approval dialog appears. Tool immediately returns false approval message.

Reproduction rate: 100% under acceptEdits mode.

Is this a regression?

Yes, this worked in a previous version.

Last Working Version

2.1.62

Claude Code Version

2.1.63 (Claude Code)

Platform

Anthropic API

Operating System

Linux (WSL2 — Linux 6.6.87.2-microsoft-standard-WSL2)

Terminal/Shell

zsh

Additional Information

• Related issues: #29548 (intermittent auto-approval), #29618 (AskUserQuestion same problem), #9701 (security implications of auto-approval)
• The PAI (Personal AI Infrastructure) community also tracked this as danielmiessler/Personal_AI_Infrastructure#537, closed as a Claude Code platform issue
• The security implications from #9701 apply here: under acceptEdits, an agent can call ExitPlanMode, receive false approval, and immediately execute operations that the user intended to review first — effectively escalating its own permissions from plan-mode read-only to full execution without user consent