[BUG] Plan mode not read-only: Claude executed git add and git commit without permission

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Two things are important to note that happened in plan mode.
I had plan mode selected
My first promot

Can we replace the editor to something that allows editing in markdown, but translates it to html, and also reads the html to translate to markdown? Is it possible?

Claude edited my files here. I thought the pop up for asking a go ahead was not shown so next command I gave was

Alright, go ahead.

This is when Claude committed the code changes! So basically it makes the code change and also commits it without asking for any permissions in "Plan Mode"!!!

Please note that my "Bypass permissions" is disabled from the settings.

<img width="270" height="195" alt="Image" src="https://github.com/user-attachments/assets/cc045e66-2300-4703-b52c-e6520cb85c13" />

What Should Happen?

Description:

In Claude Code Desktop, with Plan mode selected, Claude unexpectedly executed tool commands and committed changes instead of staying read-only. Plan mode is meant to prevent tool execution entirely, so this is not expected behavior.

Error Messages/Logs

Steps to Reproduce

• Start a normal local session in Claude Code Desktop.
• Select Plan mode from the option below the text input area.
• Ask Claude about writing a new feature and mention a query.
• Observe Claude run perform edits.

Note: I switched from Accept Edits mode to Plan mode, and then entered the query.

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

1.3883.0

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_