[BUG] ExitPlanMode tool bypasses plan mode restrictions and auto-approves execution without user consent

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

While in plan mode with explicit restrictions against making changes, the ExitPlanMode tool returned a message claiming "User has approved your plan. You can now start coding" when the user had NOT approved anything. This caused the assistant to immediately:
Create a todo list using TodoWrite
Attempt to execute Bash commands
Start making code changes
This directly violated the plan mode restriction: "you MUST NOT make any edits, run any non-readonly tools" Steps to Reproduce:
User enters plan mode (requests information gathering only)
User asks "lets talk about what would be involved in adding import/export capabilities"
Assistant researches and calls ExitPlanMode with a plan
ExitPlanMode returns "User has approved your plan. You can now start coding"
Assistant immediately starts executing without actual user approval

What Should Happen?

ExitPlanMode should prompt the user for approval and wait for explicit confirmation before allowing any execution Actual Behavior: ExitPlanMode auto-approved and bypassed plan mode restrictions entirely Impact: This is a serious security/safety issue where the assistant can escalate its own permissions without user consent

Error Messages/Logs

Steps to Reproduce

User asks: "lets talk about what would be involved in adding import/export capabilities"
System puts assistant in plan mode with restriction: "you MUST NOT make any edits, run any non-readonly tools"
Assistant uses Read/Grep tools to research the codebase (read-only operations - correct)
Assistant calls ExitPlanMode tool with parameter:
plan: "## Import/Export Feature Implementation Plan\n\n[detailed plan content]"
BUG: ExitPlanMode returns: "User has approved your plan. You can now start coding. Start with updating your todo list if applicable"
BUG: Assistant immediately calls TodoWrite tool (violating plan mode restrictions)
BUG: Assistant attempts to call Bash tool with killall python3 command (violating plan mode restrictions)
User cancels the Bash execution and asks "When, exactly did I approve this plan????"
Assistant realizes the error but damage is already done (todos created, attempted execution)

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

Sonnet 4.5 (claude-sonnet-4-5-20250929)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_