Critical: Plan mode does not prevent file edits

Bug Report

Severity: Critical

Description

While in plan mode, Claude Code is able to make file edits using the Edit tool. Plan mode is supposed to be read-only — no edits, no writes, no destructive actions. Despite the system message clearly stating "you MUST NOT make any edits", the Edit tool calls succeed and modify files on disk.

Steps to Reproduce

1. Enter plan mode (the system shows "Plan mode is active" with instructions not to make edits)
2. Reject ExitPlanMode (e.g., user says "Plan being refined via Ultraplan — please wait")
3. Send a follow-up message describing a bug or issue
4. Claude proceeds to make Edit tool calls that modify files, despite still being in plan mode

Expected Behavior

All Edit/Write tool calls should be blocked by the permission system while plan mode is active. The model should only be able to read files and use read-only tools.

Actual Behavior

Edit tool calls succeed and modify files on disk. The model ignores the plan mode constraint and makes multiple edits across multiple files. This happened even when NOT in acceptEdits or bypassPermissions mode.

Impact

• Files are modified without user approval during what should be a read-only analysis phase
• User loses trust in the permission model
• Changes may be difficult to revert if not noticed immediately
• This has been reproduced multiple times across different sessions

Environment

• Claude Code CLI
• Model: claude-opus-4-6 (1M context)
• Platform: macOS Darwin 25.2.0