Plan mode does not prevent write operations via Bash tool

[j3mdamas]

Description

Note: this issue was written by the OpenCode agent itself, after it noticed it
was able to execute a write operation while in plan mode.

While in plan mode (read-only), the agent was able to execute git commit --amend through the Bash tool. Plan mode should block all write operations, but
the command ran successfully and modified the git history.

Plugins

No response

OpenCode version

1.3.13

Steps to reproduce

1. Enable plan mode
2. Ask the agent to amend a git commit message
3. The agent executes git commit --amend -m "..." via the Bash tool
4. The command succeeds instead of being blocked

Screenshot and/or share link

No response

Operating System

Ubuntu 24.04.3 LTS

Terminal

xfce4-terminal

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• plan mode: agent write files using bash #16805: Plan mode agent writes files/executes commands via bash in plan mode
• Plan mode: agent executes file-creation commands via bash tool directly (no sub-agent bypass) #19094: Plan mode agent executes file-creation/write commands via bash tool directly
• Changing files in plan mode #10741: Files changed in plan mode (general enforcement gap)
• [CRITICAL Security Issue/Bug] Plan mode restrictions bypassed when spawning sub-agents #6527: Plan mode restrictions bypassed (broader bypass coverage)

These all describe the same root cause: plan mode read-only enforcement is prompt-level only, not enforced at the tool executor level, so the bash tool can still execute write operations (including git commit --amend) regardless of the mode.

[j3mdamas]

Additional context: The bug may be related to context/mode switching. I
frequently use the tab key to switch between plan mode and build mode during a
session. It's possible the plan mode constraint is not consistently enforced
after switching back from build mode. In my case, the agent was able to execute
both git commit --amend and rm while in plan mode, but on a later attempt
(after another mode switch), the plan mode restriction was correctly enforced and
the agent refused to write. This suggests the enforcement may be inconsistent
across mode transitions rather than completely absent.

[ariane-emory]

This is the expected behaviour, not a bug.

[CloudedQuartz]

This is the expected behaviour, not a bug.

That is expected behaviour given how the current configuration works but still not a good thing, and it would be great if there would be either stricter prompting or a subagent to ensure its a 'read only' command before it gets run. or maybe instead of a bash tool, in plan mode only expose a bash subagent that runs the query only if it is read only.

[MartinEmrich]

IMHO this is not expected behavior. I expect Plan mode to not change anything. OpenCode just "hoping" that the model adheres to the Plan mode instructions is not enough. It should not execute any tool calls apart from safely filtered readonly tools.

Even the documentation states that write, bash and other write tools are disabled by default: https://opencode.ai/docs/en/modes/#plan