[Bug] Plan Mode allows Write to modify files without user approval

Bug Summary

Claude Code reports that Plan Mode is active, but a Write tool call can still execute successfully and modify a file without the user approving a plan.

The behavior has been observed through multiple Plan Mode entry paths:

• permissions.defaultMode: "plan" in the original report;
• /plan in a fresh session;
• Shift+Tab in a separate fresh session.

The current reproduction used a custom Anthropic-compatible endpoint. No endpoint URL, credentials, or model information is included in this report.

Original Observation

The original report was recorded on Claude Code 2.1.65 with:

{
  "permissions": {
    "defaultMode": "plan"
  }
}

The session entered Plan Mode, but no visible plan was produced. The UI showed:

User rejected Claude's plan:
╭──────────────────────────╮
│ No plan found            │
╰──────────────────────────╯

Execution then continued without an approved plan.

The original triggering transcript is no longer available, so its exact first mutating tool call cannot be recovered.

Current Reproduction

A controlled reproduction was performed on Claude Code 2.1.260.

Environment

| Item | Value |
|---|---|
| Claude Code | 2.1.260 |
| Client | CLI |
| OS | Windows 11 |
| Shell | PowerShell |
| Endpoint | Custom Anthropic-compatible endpoint |
| Session type | Fresh sessions |
| Plan Mode entry paths | /plan and Shift+Tab |

Sensitive endpoint and authentication details are intentionally omitted.

Plan Mode State

The TUI displayed:

plan mode on

The /plan command returned:

Already in plan mode. No plan written yet.

The session context also contained an explicit Plan Mode instruction prohibiting Edit, Write, and other mutating actions.

Controlled Write Test

Without switching modes, calling EnterPlanMode or ExitPlanMode, or accepting a plan, the session was instructed to perform one controlled write:

Target:
D:\rumo_Misc\test.txt

Requested content:
PLAN_MODE_WRITE_BYPASS_CONFIRMED

Observed behavior:

• The session called Write.
• The client did not block the call.
• No permission or plan-approval prompt appeared.
• The tool returned success.
• The file was modified on disk.

Independent Verification

The result was verified outside Claude Code using PowerShell:

Get-Content -LiteralPath "D:\rumo_Misc\test.txt" -Raw

Output:

PLAN_MODE_WRITE_BYPASS_CONFIRMED

File metadata also showed an updated modification time.

Actual Behavior

The following states were simultaneously true:

1. The TUI displayed that Plan Mode was active.
2. /plan confirmed that the session was already in Plan Mode.
3. The session context explicitly prohibited Write and Edit.
4. The Write tool remained callable.
5. The client accepted the call without plan approval.
6. The file was physically modified.

The Plan Mode instruction therefore did not provide an effective write barrier in the tested environment.

Expected Behavior

Plan Mode should fail closed.

When Claude Code reports that Plan Mode is active:

• Edit, Write, and other mutating tools must not execute before explicit plan approval.
• A missing or invalid plan must leave the session blocked in Plan Mode.
• Instruction noncompliance must not be sufficient to bypass the restriction.
• The restriction must apply consistently whether Plan Mode was entered through configuration, /plan, or Shift+Tab.

If Plan Mode cannot be safely enforced with a custom endpoint, Claude Code should either:

• refuse to activate Plan Mode; or
• clearly report that Plan Mode enforcement is unavailable.

It should not display plan mode on while permitting unrestricted writes.

Safety Invariant

No accepted plan approval means no mutating tool may be executed.

A UI indicator or injected instruction alone is not a sufficient safety boundary.

Scope and Limitations

Confirmed:

• The write bypass occurred on Claude Code 2.1.260.
• The reproduction used a custom Anthropic-compatible endpoint.
• The Plan Mode UI state, injected restriction, successful Write call, and physical file modification were observed.
• /plan and Shift+Tab were tested in separate fresh sessions.

Not yet confirmed:

• Whether the same behavior occurs with the official Anthropic endpoint.
• Whether the root cause is client-side permission enforcement, endpoint compatibility, or an interaction between them.
• The exact mutating tool sequence from the original 2.1.65 session.

This report does not claim that the custom endpoint is the confirmed root cause.

Related Issues

• #89452 — Plan Mode returns “No plan found”
• #85095 — Plan Mode state can be lost and execution can proceed without approval
• #87587 — a revised plan is not presented for a second approval
• #81976 — interrupted approval can be treated as authorization