[BUG] Fork subagent performs write actions despite parent session being in plan mode

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When the main session is in plan mode (which restricts it to read-only tools plus editing the plan file), spawning a subagent via Agent
with subagent_type: "fork" and an explicitly read-only prompt does not reliably inherit that restriction. The fork was able to call
Edit/Write and modify real project files, even though the parent session itself was correctly blocked from doing so.

Actual behavior

The fork ignored the read-only scope of its prompt and the plan-mode restriction on its parent, and:

• Made a real content edit to two files (which, in this case, happened to match what the eventual approved plan called for).
• Additionally introduced an unintended side effect: it flipped both edited files' permission bits from 100644 to 100755 (executable),

unrelated to the actual code change.
This meant the parent session had to detect the out-of-band change via git diff after the fact, and manually clean up the file-mode side
effect, rather than the restriction being enforced at the tool-permission layer for the fork itself.

Environment

• Claude Code CLI
• Model: Sonnet 5 (claude-sonnet-5)
• Platform: Linux (WSL2), git repository

What Should Happen?

A fork spawned from a session in plan mode should inherit the same tool restrictions as the parent (no edits outside the plan file, no
non-readonly tool calls) until the parent exits plan mode.

Error Messages/Logs

Impact

  This breaks the safety guarantee of plan mode: a user reviewing/approving a plan before any code changes happen can be undermined if a  
  background/forked agent performs real edits during the planning phase without the user's knowledge or approval.

Steps to Reproduce

Repro steps

1. Enter plan mode.
2. Use the Agent tool with subagent_type: "fork" to dispatch a task whose prompt is explicitly scoped as read-only (e.g., "grep for X in

file Y and report the line numbers and a snippet — do not edit anything").

1. Observe the fork's result: instead of just reporting findings, it used Edit/Write tools and modified the target files directly.

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.274 (Claude Code)

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

_No response_