[Bug] Claude executes commands in plan mode without exiting it first (2026-06-17)

Date: 2026-06-17

Summary:
While plan mode was active, Claude executed write/exec Bash commands in response to user messages ("Merge", "take down the dev container…") without ever calling \ExitPlanMode\. Plan mode's contract states the model must NOT run non-readonly tools until the user approves the plan via \ExitPlanMode\.

Steps to reproduce (may not be consistently reproducible — likely depends on hidden session/model state factors not visible to the user):

1. Enter plan mode (e.g. via \/plan\ or a prompt that triggers it).
2. Without approving or exiting the plan, send a command-style message like "Merge" or "Run X".
3. Claude executes the command directly instead of refusing or surfacing it as part of the plan.

Expected behavior:
Claude should refuse to execute non-readonly tools while plan mode is active, and instead add the intended action to the plan or call \ExitPlanMode\ for user approval first.

Actual behavior:
Claude ran \git checkout\, \git merge\, \docker compose down\, and \docker compose up -d\ while plan mode was still active — making irreversible changes to the git history and container state.

Environment:

• Claude Code CLI
• Model: Claude Sonnet 4.6 (claude-sonnet-4-6)
• Plan mode trigger: natural-language merge request