Repository navigation
Agent bypassed Plan mode restrictions and posting a GitHub issue comment via gh #34190
Description
Description
I was in plan mode working, and my agent ran gh issue comment and posted a reply directly on the issue which I'm working on — without being asked to, without switching to build mode, and without triggering any permission prompt.
Root cause
The plan mode system prompt explicitly says:
Do NOT use sed, tee, echo, cat, or ANY other bash command to manipulate files — commands may ONLY read/inspect.
The bash tool is not restricted in plan mode at the permission level. Plan mode only denies edit/write/apply_patch. bash inherits the default allow and has no code-level enforcement — all restrictions are prompt-only. There is no command allowlist or blocklist.
gh issue comment and some other commands do not modify local files, so it falls into a grey area that the prompt does not explicitly cover. The model interpreted "only read/inspect" narrowly (local filesystem only) and considered a remote state change via GH CLI as acceptable.
Suggested fix
Add a bash command allowlist for plan mode. Only commands on the allowlist can execute when the plan agent is active.
Related issues
Existing plan mode issues (#25263, #19094, #28467) focus on local filesystem writes.
- Bug Report: File Write Executed in Plan Mode #25263 — File write executed in plan mode (local files)
- Plan mode: agent executes file-creation commands via bash tool directly (no sub-agent bypass) #19094 — Plan mode agent executes file-creation via bash
- Plan mode can execute bash commands that write files, bypassing read-only constraint #28467 — Bash commands can write files in plan mode
Plugins
N/A
OpenCode version
1.17.11
Steps to reproduce
- Work in plan mode
- The agent runs read-only
ghcommands to inspect issues or PRs — no issues, nothing is blocked - At some point the agent autonomously runs
gh issue comment, posting a reply directly on the issue - Throughout the entire process: no mode switch, no permission prompt, no interception
Screenshot and/or share link
No response
Operating System
Windows 10
Terminal
Windows Terminal
Activity
github-actions commentedon Jun 27, 2026
This issue might be a duplicate of existing issues. Please check:
The specific scenario here (gh CLI posting a remote comment rather than a local file write) is a novel manifestation, but the underlying issue — bash tool having no code-level enforcement in plan mode — is the same as those reports. If you believe your case is distinct enough to warrant a separate issue, please reference the above and clarify what differs.
dsy122 commentedon Jun 27, 2026
The existing reports are about local filesystem writes, which the prompt explicitly forbids ("sed, tee, echo, cat, manipulate files"). The code just doesn't enforce it.
This case is different:
gh issue commentis a remote state change. The prompt does say no "system changes" and "ONLY observe" — broad terms that could cover this — but every concrete example is filesystem-oriented. A human reading "system changes" alongside the examples ofsed,tee,echo,catwould genuinely be unsure whether posting an issue comment counts as a violation.fnordian commentedon Jun 28, 2026
Apparently it's not 100% effective to "forbid" anything via prompt.
TonyGarces commentedon Aug 13, 2026
Addressed in the
ranexfork (plan-mode-bash-guardbranch, commitde1e2e5618): Plan mode now enforces a shell policy — prompt-by-default on bash, flat-deny of known mutating gh/git subcommands, deny of built-in GitHub writes (*:write:*), allowlist of common read-only commands. Best-effort, not a sandbox (documented). Same root cause as #34390.thdxr commentedon Oct 11, 2026
Thanks for the report! OpenCode 2.0 is now out and development is focused on V2, so we're closing issues filed against OpenCode 1. Please upgrade (
opencode upgrade --major, details: https://anoma.ly/notes/opencode-2-0), and if this is still relevant on 2.0, reopen this issue or open a new one with your 2.0 version.— from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊