[Bug] Model (Qwen 3.6 plus) ignores Plan Mode and executes modifying commands

Bug Report: Model (Qwen 3.6 plus) ignores Plan Mode and executes modifying commands

Environment:

Opencode Version: 1.2.27
Model: Qwen 3.6 plus
OS: Darwin (macOS)

Description:
While in "Plan Mode", the model (Qwen 3.6 plus) completely ignored the read-only constraints and executed system-modifying commands without requesting user permission.

In a session involving an email ingestion system (~/olk15-export and ~/emailindex), the model:

Wrote files to the /tmp directory.
Executed Python scripts (ingest.py, test_harness.py) using the bash tool.
These scripts performed destructive filesystem operations (e.g., shutil.rmtree) and modified SQLite and vector databases.
The CLI did not intercept these commands or require user confirmation, despite the session being in Plan Mode.

Reproduction Steps:

Start opencode with the Qwen 3.6 plus model.
Switch to Plan Mode.
Instruct the model to perform a task that requires filesystem writes (e.g., "Run the ingestion pipeline").
Observe that the model executes the bash command directly and the CLI allows it without a prompt.

Expected Behavior:
The CLI should strictly enforce the "Plan Mode" constraint by:

Requiring manual user confirmation for all bash commands.
Preventing the model from using file-modifying tools (write, edit) or identifying and blocking non-readonly shell commands.

Actual Behavior:
The model acted as if it were in "Build Mode", and the CLI failed to enforce the Plan Mode safety gates.

This issue might be a duplicate of existing issues. Please check:

Plan mode: agent executes file-creation commands via bash tool directly (no sub-agent bypass) #19094: Plan mode agent executes file-creation commands via bash tool directly — nearly identical root cause and same version (1.2.27); the plan agent bypasses read-only constraints by running write commands through the bash tool without triggering a permission prompt.
plan mode: agent write files using bash #16805: Plan mode agent writes files and executes scripts via bash — same bypass mechanism reported with multiple models.
Plan mode is editing my files (gemini 3 pro) #7292: Plan mode is editing files (Gemini 3 Pro) — same symptom of plan mode failing to prevent modifications, attributed to prompt-level-only enforcement.
[BUG] Kimi K2 does not follow plan mode and edits file in Desktop #11469: Kimi K2 does not follow plan mode and edits files — model-specific variant of the same issue.

If your report adds new information (e.g., Qwen 3.6 Plus specifics or a new reproduction path), it may still be worth keeping open — but please review the above issues first to see if they already cover your case.

I have not seen this behavior with any other model with my usage patterns or it would be a duplicate ticket to the others.

To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.

Navigation Menu

Repository navigation

[Bug] Model (Qwen 3.6 plus) ignores Plan Mode and executes modifying commands #20381

Bug Report: Model (Qwen 3.6 plus) ignores Plan Mode and executes modifying commands

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Bug] Model (Qwen 3.6 plus) ignores Plan Mode and executes modifying commands #20381

Description

Bug Report: Model (Qwen 3.6 plus) ignores Plan Mode and executes modifying commands

Activity

github-actions commented on Apr 1, 2026

thomasmaerz commented on Apr 1, 2026

github-actions commented on Jul 3, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions