Repository navigation
Plan mode does not prevent write operations via Bash tool #22641
Description
Description
Note: this issue was written by the OpenCode agent itself, after it noticed it
was able to execute a write operation while in plan mode.
While in plan mode (read-only), the agent was able to execute git commit --amend through the Bash tool. Plan mode should block all write operations, but
the command ran successfully and modified the git history.
Plugins
No response
OpenCode version
1.3.13
Steps to reproduce
- Enable plan mode
- Ask the agent to amend a git commit message
- The agent executes
git commit --amend -m "..."via the Bash tool - The command succeeds instead of being blocked
Screenshot and/or share link
No response
Operating System
Ubuntu 24.04.3 LTS
Terminal
xfce4-terminal
Metadata
Metadata
Assignees
Labels
No labels
Activity
github-actions commentedon Apr 15, 2026
This issue might be a duplicate of existing issues. Please check:
These all describe the same root cause: plan mode read-only enforcement is prompt-level only, not enforced at the tool executor level, so the bash tool can still execute write operations (including
git commit --amend) regardless of the mode.j3mdamas commentedon Apr 15, 2026
Additional context: The bug may be related to context/mode switching. I
frequently use the tab key to switch between plan mode and build mode during a
session. It's possible the plan mode constraint is not consistently enforced
after switching back from build mode. In my case, the agent was able to execute
both
git commit --amendandrmwhile in plan mode, but on a later attempt(after another mode switch), the plan mode restriction was correctly enforced and
the agent refused to write. This suggests the enforcement may be inconsistent
across mode transitions rather than completely absent.
ariane-emory commentedon Apr 16, 2026
This is the expected behaviour, not a bug.
CloudedQuartz commentedon Apr 17, 2026
That is expected behaviour given how the current configuration works but still not a good thing, and it would be great if there would be either stricter prompting or a subagent to ensure its a 'read only' command before it gets run. or maybe instead of a bash tool, in plan mode only expose a bash subagent that runs the query only if it is read only.
MartinEmrich commentedon Apr 21, 2026
IMHO this is not expected behavior. I expect Plan mode to not change anything. OpenCode just "hoping" that the model adheres to the Plan mode instructions is not enough. It should not execute any tool calls apart from safely filtered readonly tools.
Even the documentation states that write, bash and other write tools are disabled by default: https://opencode.ai/docs/en/modes/#plan
fix(plan-mode): enforce bash restriction and scope subagent permissio…
github-actions commentedon Jul 3, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.