[BUG] Plan mode does not hard-block write tools — model can make edits and user approval bypasses the constraint

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

What's Wrong?

<img width="633" height="790" alt="Image" src="https://github.com/user-attachments/assets/5b3cf4a7-246a-4343-a97e-23a11292b40f" />
<img width="638" height="680" alt="Image" src="https://github.com/user-attachments/assets/124b70a7-51c5-4b7a-9f84-d29e1beb5a36" />
<img width="612" height="819" alt="Image" src="https://github.com/user-attachments/assets/ae0d3bce-972e-4d9c-8912-b55d1482314b" />

Plan mode instructs the model not to make edits, but this is enforced only at the instruction level (system prompt), not at the tool execution layer. If the model ignores the instruction and issues Edit/Write/Bash tool calls, the user's per-tool approval in the permission UI allows them to execute — silently bypassing plan mode's guarantee.

Actual Behavior

Model made multiple file edits and ran Bash commands during an active plan mode session. All executed successfully because per-tool user approvals bypassed the plan mode constraint. There was no warning or indication that plan mode was being violated.

What Should Happen?

Expected Behavior

Plan mode should hard-block Edit, Write, and Bash (write) tool calls at the permission layer — the same way other permission controls work. A plan mode violation should not be approvable via the normal per-tool prompt, or at minimum the prompt should warn: "This action would normally be blocked by plan mode."

Error Messages/Logs

Check uploaded screenshots

Steps to Reproduce

Steps to Reproduce

1. Enter plan mode (e.g. via /plan or a planning prompt)
2. Observe the system reminder: "MUST NOT make any edits"
3. Model proceeds to call Edit/Write/Bash tools anyway
4. User sees normal per-tool approval prompts (no indication that plan mode should be blocking this)
5. User approves → edits are applied despite plan mode being active

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.84

Claude Code Version

2.1.86

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

Environment

• OS: Windows 11 Enterprise
• Shell: Git Bash
• Claude Code: VS Code extension (latest)
• Interface: VSCode native extension

Impact

Plan mode's "review before execute" guarantee is not reliable. Users who enter plan mode expecting zero side effects can end up with unintended file changes if they habitually approve tool calls.