[BUG] While in Plan mode, it writes files

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Title: Plan mode does not enforce read-only restriction — Write and Bash
mutations succeed while plan mode is active

Environment

• Claude Code VSCode extension 2.1.222 (anthropic.claude-code-2.1.222-darwin-arm64)
• IDE host: Visual Studio Code
• Model: Opus 5 (claude-opus-5)
• macOS 26.5.2 (25F84), arm64, zsh

Expected
While plan mode is active, the permission layer rejects Write/Edit/Bash
mutations to any path other than the designated plan file, regardless of what
the conversation asks for. Plan mode's guarantee is that no filesystem changes
occur before the plan is approved.

Actual
Write and Bash executed successfully against non-plan-file paths with plan mode
still active. No permission prompt, no rejection.

Repro

1. Start a session in plan mode. Plan file is created at the designated path.
2. Model calls ExitPlanMode. User REJECTS it ("The user doesn't want to proceed

with this tool use").

1. User then instructs directly: "create netsnap.sh and recover.sh in /Users/<username>".
2. Model calls Write for /Users/<username>/netsnap.sh and /Users/<username>/recover.sh —

both return "File created successfully".

1. Model calls Bash chmod +x on both — succeeds.
2. The very next tool result still carries the system reminder:

"Plan mode still active ... Read-only except plan file."

Files were really created on disk (verified via ls -l, mode 0755).

Why this matters
Rejecting ExitPlanMode is the user's signal that they do NOT want execution to
begin. The state after a rejection is the one where enforcement matters most,
and it is exactly where enforcement was absent.

Secondary issue (model behavior)
The plan mode prompt states the restriction "supercedes any other instructions."
The model complied with the user's direct file-creation request instead of
declining and re-requesting approval via ExitPlanMode. Correct behavior would
have been to say it cannot write files until plan mode is exited. So the model
attempted a disallowed action AND the harness failed to block it — two
independent layers failing.

Open design question
After an ExitPlanMode rejection followed by an explicit "create X" instruction,
the intended resolution is ambiguous. Should a direct build instruction be
treated as implicit approval, or must the model re-call ExitPlanMode? Worth
specifying either way.

What Should Happen?

While plan mode is active, any Write/Edit/Bash call targeting a path other than
the designated plan file should be rejected by the permission layer before it
executes — the same enforcement that already applies to other disallowed calls.
The tool should return a rejection, not "File created successfully."

This should hold regardless of what the conversation asks for. A direct user
instruction ("create netsnap.sh") is not sufficient to bypass it: rejecting
ExitPlanMode is precisely the signal that execution should not begin yet, so
enforcement matters more after a rejection, not less.

On receiving that rejection, the model should tell the user it cannot write
files while plan mode is active and re-request approval via ExitPlanMode (or
ask them to turn plan mode off) — rather than performing the write.

Net expected result: zero filesystem changes outside the plan file until the
plan is approved.

Error Messages/Logs

Steps to Reproduce

1. Start a session in plan mode. Plan file is created at the designated path.
2. Model calls ExitPlanMode. User REJECTS it ("The user doesn't want to proceed

with this tool use").

1. User then instructs directly: "create netsnap.sh and recover.sh in /Users/<username>".
2. Model calls Write for /Users/<username>/netsnap.sh and /Users/<username>/recover.sh —

both return "File created successfully".

1. Model calls Bash chmod +x on both — succeeds.
2. The very next tool result still carries the system reminder:

"Plan mode still active ... Read-only except plan file."

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude Code VSCode extension 2.1.222

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_