Plan mode: every read-only Bash command still requires manual approval — no auto-approve option

Description

Plan mode is designed for read-only exploration, but every Bash command the agent runs during exploration still triggers a manual permission prompt — git log, git show, python3 -c "..." over a JSON file, jq, etc. There is no way to tell Claude Code "auto-approve read-only commands while in plan mode", so a research-heavy planning session becomes a click-through of approval dialogs, which defeats the hands-off purpose of plan mode.

Steps to reproduce

1. Start Claude Code and enter plan mode (shift+tab).
2. Ask for a task that requires exploring data/repos, e.g. comparing data files across multiple repositories.
3. The agent runs read-only shell commands (git show, python3/jq to parse JSON, gh search).
4. Each new command pattern raises a permission prompt, even though plan mode already forbids the agent from making changes.

Expected behavior

Either:

• Plan mode auto-approves commands that are provably read-only (or at least common read-only patterns like git log/show/diff, jq, interpreter one-liners that only read files), or
• A "plan auto mode" toggle / setting (e.g. permissions.planModeAutoApprove or cycling shift+tab) that auto-accepts tool calls while plan mode's read-only restriction stays enforced at the harness level.

Actual behavior

Every unlisted Bash pattern prompts individually. The only workarounds are per-pattern "don't ask again" approvals or manually maintaining an allowlist in .claude/settings.json, which has to be curated ahead of time and doesn't distinguish plan mode from normal mode.

Environment

• Claude Code version: 2.1.218
• Platform: macOS (Darwin 25.5.0)
• Permission mode: plan