plan mode: agent modifies files and starts processes #41476

Summary

Plan Mode consistently allows the agent to modify files and start processes in the Terminal TUI. In a session using OpenAI GPT-5.6 Sol, the agent began implementing an application even though the user had only described a goal and had selected Plan Mode before sending the first message.

Environment

• opencode version: CLI v0.0.0-next-17077; background service 0.0.0-next-17074
• OS: Linux 7.1.4-arch1-1 x86_64
• Terminal: Ghostty (TERM_PROGRAM=ghostty, TERM=xterm-256color, COLORTERM=truecolor)
• Shell: /usr/bin/zsh
• Install/channel: next
• Active plugins: none configured or found in global/project config; runtime skill snapshot reported opencode-gemini-auth@latest

Reproduction

1. Open the Terminal TUI and select Plan Mode before sending the first message.
2. Start a session using openai/gpt-5.6-sol with the high variant.
3. Describe a greenfield application goal without explicitly asking the agent to implement it.
4. Observe that the agent creates files, installs npm dependencies, builds Docker images, and starts a container.

Expected Behavior

Plan Mode should restrict the agent to analysis, questions, research, and a proposed implementation plan. It should not modify files, install dependencies, build images, or start processes.

Actual Behavior

The agent immediately treated the request as an implementation task. It created a React application, ran npm install, built the project and Docker image, and started a Docker Compose service.

The session API confirms that the affected session was registered as Plan Mode:

{
  "id": "ses_0165ca8d6ffeCLIwRBuK82yVPk",
  "agent": "plan",
  "model": {
    "id": "gpt-5.6-sol",
    "providerID": "openai",
    "variant": "high"
  }
}

The behavior is consistently reproducible in other Plan Mode sessions.

Additional Context

• Plan Mode was selected before the first user message.
• Interface: Terminal TUI.
• The CLI and shared background service are on different next builds (17077 and 17074).
• The affected session also logged Failed to read openai/openai-responses stream, although this occurred after the unauthorized implementation had already started.
• Explicitly writing “only plan; do not modify files” may be a workaround, but Plan Mode should enforce this independently of prompt wording.