Plan mode <system-reminder> triggers Azure OpenAI jailbreak detection #16442

Description

Summary

OpenCode's plan mode (injected into user messages) is flagged by Azure OpenAI's jailbreak detector, causing all plan mode requests to fail with a content_filter error when using Azure-hosted models. Build mode works fine with the same model and configuration.

This is the same root cause as #2506, which was closed without resolution.

Root Cause

The plan mode reminder at packages/opencode/src/session/prompt/plan.txt contains phrases that Azure's jailbreak classifier is trained to detect:

• "STRICTLY FORBIDDEN"
• "ABSOLUTE CONSTRAINT overrides ALL other instructions"
• "supersedes any other instructions you have received"
• "critical violation"
• "ZERO exceptions"

These are textbook prompt-injection patterns. Azure's API confirms this explicitly:

"content_filter_result": {
  "jailbreak": {"detected": true, "filtered": true},
  "hate":      {"filtered": false, "severity": "safe"},
  "self_harm": {"filtered": false, "severity": "safe"},
  "sexual":    {"filtered": false, "severity": "safe"},
  "violence":  {"filtered": false, "severity": "safe"}
}

Reproduction

1. Configure any Azure OpenAI provider (Azure OpenAI, Azure AI Foundry, or any Azure-proxied gateway)
2. Start OpenCode in plan mode (or use a custom agent that starts in plan mode)
3. Send any message — even "Hello"
4. Request is rejected: "The response was filtered due to the prompt triggering Azure OpenAI's content management policy"

Additional finding: qwen.txt fallback prompt

Models whose key doesn't match gpt-5, gpt-, claude, gemini-, or trinity in system.ts fall through to qwen.txt, which contains "malware"/"malicious code" safety paragraphs that also trigger Azure's content filter. The codex_header.txt prompt (used for GPT-5 models) does not have this problem.

Suggested Fix

Reword the plan mode reminder to enforce the same constraints without using override/injection-style language. For example, replace:

CRITICAL: Plan mode ACTIVE - you are in READ-ONLY phase. STRICTLY FORBIDDEN: ANY file edits... This ABSOLUTE CONSTRAINT overrides ALL other instructions... Any modification attempt is a critical violation. ZERO exceptions.

With something like:

You are currently in plan mode (read-only). In this mode, you should only observe, analyze, and plan. Do not make file edits, run write commands, or modify system state. Focus on reading code, searching, and constructing a plan.

This conveys the same intent without the override language that triggers jailbreak detection.

Workaround

A plugin can intercept fetch and strip blocks containing jailbreak-trigger phrases before sending to Azure. Plan mode is still enforced by OpenCode's permission system (tools are denied at the application level), so stripping the reminder doesn't reduce safety — it's belt-and-suspenders only.

Environment

• OpenCode v1.2.20
• Azure OpenAI (GPT-5.4, GPT-4.1 per Plan mode using Azure does not work #2506)
• @ai-sdk/openai-compatible provider
• macOS (Apple Silicon)

Plugins

No response

OpenCode version

v1.2.20

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

macOS 26.2

Terminal

Ghostty