Plan mode does not prevent write operations via Bash tool

Bug Description

When plan mode is active, the system reminder clearly states:

"you MUST NOT make any edits, run any non-readonly tools, or otherwise make any changes to the system"

However, Bash tool calls that modify files are NOT blocked. Only the Edit and Write tools respect plan mode restrictions. The Bash tool happily executes destructive commands like git mv, git commit, git push, file writes via python3 -c "open().write()", etc.

Reproduction Steps

1. Enter plan mode (/plan)
2. Use Bash tool to execute write operations:

``bash
git mv file_a file_b # succeeds
echo "test" > new_file.txt # succeeds
python3 -c "open('x.py','w').write('hello')" # succeeds
git commit -m "msg" # succeeds
git push origin master # succeeds
``

1. All commands succeed despite plan mode being active

Expected Behavior

In plan mode, either:

• Option A: All Bash commands with write side effects should be blocked (or at least warned)
• Option B: The Bash tool should be completely disabled in plan mode (only Read/Glob/Grep allowed)
• Option C: A pre-execution hook should detect write patterns (git mv, git commit, >, tee, cp, mv, etc.) and block them

Actual Behavior

Plan mode system reminder is treated as a soft suggestion. The model (Claude) sometimes ignores it and executes write operations via Bash, especially when the user says things like "继续" (continue) which the model interprets as approval to proceed.

Impact

In my session, while plan mode was active, I accidentally executed:

• git mv (moved 40+ files)
• Multiple file edits via python3
• git commit + git push to remote

All changes went through to origin/master despite plan mode being "active".

Environment

• Claude Code CLI
• Model: claude-opus-4-6 (1M context)
• OS: Ubuntu 24.04