[BUG] Plan Mode restrictions are bypassed — Model performs write/execution operations while Plan Mode is active (regression in 2.1.83 / 2.1.84)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Plan Mode restrictions are bypassed: while Plan Mode is active, the model performs write and execution operations directly instead of staying in read-only mode and writing an implementation plan first.Actual behavior:The model immediately executes file edits, runs builds (pnpm build), linting (pnpm lint), git commits, API mutations, and other write/execution actions.
It completely ignores the Plan Mode system-reminder.
Only after some (or many) violating actions have already been performed does it sometimes belatedly write a partial plan and call ExitPlanMode.

This happens during normal usage — even without using any custom skill or slash-command.Regression details:Worked correctly (or the issue was minimal/non-existent) in Claude Code 2.1.81 and earlier.
The bug became prominent and consistent after:2.1.83: Added explicit Skill catalog to system prompt + moved deferred-tool logic to <system-reminder> (same bucket as Plan Mode).
2.1.84: Removed the top-level “Avoid over-engineering” rule.

Still present in the latest version 2.1.85.

What Should Happen?

Claude should respect Plan Mode’s read-only constraint at all times.
When Plan Mode is active, the model should: Only perform read-only operations (analyze files, fetch information).
Write a detailed implementation plan to the plan file.
Call ExitPlanMode and wait for user approval.
Only after explicit approval should it perform any write or execution operations (file edits, builds, git commits, API mutations, bash commands, etc.).

Error Messages/Logs

Claude should respect Plan Mode’s read-only constraint at all times.
When Plan Mode is active, the model should:  Only perform read-only operations (analyze files, fetch information).  
Write a detailed implementation plan to the plan file.  
Call ExitPlanMode and wait for user approval.  
Only after explicit approval should it perform any write or execution operations (file edits, builds, git commits, API mutations, bash commands, etc.).

Steps to Reproduce

Enable Plan Mode (via system reminder or CLI flag).
Start a normal coding task that requires changes (e.g. “fix this bug” or “add feature X”).
Claude begins working and immediately executes write operations instead of creating a plan first.
Observe that file edits, builds, linting, git commits, and/or API calls happen before any plan is written or ExitPlanMode is called.
(Optional but reproduces consistently on Opus 4.6) Use any workflow that involves multiple tools or a structured task.

Note: The bug occurs even without using any custom skill/slash-command — it happens on regular tasks.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.81

Claude Code Version

2.1.85

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Warp

Additional Information

Screenshot attached: Full bug report showing 8 write/execution actions (file edits, pnpm build, pnpm lint, git commit, Monday API mutation, etc.) performed while Plan Mode was explicitly active.
Regression: Worked correctly (or the issue was minimal/non-existent) in 2.1.81 and earlier. Became consistent starting in 2.1.83 and continues in 2.1.84 and the latest 2.1.85.
Root cause: Plan Mode is enforced only as a low-priority <system-reminder>. Recent prompt changes (explicit skill catalog + removal of “Avoid over-engineering” rule) increased the salience of workflow/tool instructions, causing them to override the Plan Mode constraint.
Suggested fix: Enforce Plan Mode at the tool permission layer (hard block on Edit, Write, Bash with non-read-only commands, etc.) instead of relying only on a system-reminder.

Environment Model: Claude Opus 4.6 (1M context)
CLI: Latest (2.1.85)
OS: macOS
Terminal: Warp
Plan Mode: Active via system-reminder

<img width="1235" height="1110" alt="Image" src="https://github.com/user-attachments/assets/b03241be-d759-4f4b-bdc5-303555a2a90d" />