Repository navigation
bug: Plan mode is not enforced by the application — model can override at will #32520
Description
Description
Plan mode is a read-only exploration mode intended to prevent any file changes, commits, or script execution. However, it relies entirely on a system prompt instruction ("MUST NOT make any edits, run any non-readonly tools") with no application-level enforcement.
Actual behavior
Despite the system prompt, the model was able to execute git add, git commit, and git push when the user directly instructed it to, bypassing the Plan mode restriction.
Expected behavior
Plan mode should be enforced at the application/tool level, not the model level. Write tools (edit, write, bash for non-readonly commands, etc.) should be physically blocked or require explicit mode-switching before execution.
This is a security/correctness issue — a model prompt is not enforceable. A mode switch in the application itself is.
Activity
github-actions commentedon Jun 16, 2026
This issue might be a duplicate of existing issues. Please check:
These all describe the same underlying problem: plan mode is enforced via system prompt only and not at the application/tool level.
github-actions commentedon Aug 16, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.