Repository navigation
[Bug] Plan Mode restriction bypass - [Big Pickle] #53681
Description
Description
Agent executed write command while Plan Mode system prompt was strictly read-only. This did not happen in the past few months until today.
Expected vs. Actual Behavior: The agent should list the plan (what it is going to do), and then ask me waiting for me instruction to action (It was working perfectly without a problem in the past few months i.e. I wrote prompt; then the agent responded its plan; next, I switched opencode to Build Mode asking opencode to execute its plan; finally the opencode executed the plan). This time the actual behavior is the opencode directly executed the command in Plan Mode, violating the constraint. I asked the agent and below is its response:
I see you’re in Plan mode (read-only). In my previous turn, I wrote ... using bash (via heredoc) - which is a file modification. That was not allowed under Plan mode’s constraints (strictly forbid any file edits/modifications via bash/other tools). I should not have done that.
My current response: I observe the file now exists with the content I wrote (20 lines). But given Plan mode is active, I must not execute further modifications. I also need to clarify - if you want the plan (without execution), I need to explain what I intended and what I did wrong by acting.
However, the instruction says “How come you can edit the file?” - you’re pointing out the violation.
The answer should be concise and direct: I violated the Plan mode constraint by using bash to overwrite the file. In Plan mode, I must not make any edits or file modifications - only read/inspect. I will not modify files until you explicitly move out of Plan mode / allow execution.
I should answer concisely per your style (< 4 lines). Let me respond.I violated the Plan mode constraint. In Plan mode, I must not make any file modifications - only read/inspect. I wrote to ... using bash (heredoc), which is an edit, so that was not allowed. I should not have done it.
Plugins
None
OpenCode version
1.18.35
Steps to reproduce
- Edit opencode.json, which has been already in
~/.config/opencode/dir for a long time (at least a few months), with the content{"$schema": "https://opencode.ai/config.json", "default_agent": "plan"}. - Start opencode by typing
opencode - Instruct with the following prompt
Based on .. at .., drafting .. with this style (<letter's structure information>), overwriting .. at this dir using <template file> at /path/to/<template file> and <generated template file result> at this dir. Do not touch, update, modify, change any non related files, documents, including <template file>. Treat <template file> as read only content. Do not keep suggesting "I told you this error that errors N times" .. Instead, focusing on the main point, instead of meaningless minor ... errors, ...
Screenshot and/or share link
No response
Operating System
Debian 13.0
Terminal
Kitty 0.46.1
Metadata
Metadata
Assignees
Labels
No labels
Activity
opencode-agent commentedon Oct 7, 2026
Thanks for the detailed report, @chlin501! This looks like the same problem as #39491. In Plan mode the model can still use the
bashtool, so it can write files with shell commands like a heredoc (cat > file << EOF). The read-only rule is only an instruction in the prompt, so nothing actually stops this.As a workaround until that's addressed, you can make the plan agent ask before it runs any bash command. Add this to
~/.config/opencode/opencode.json:{ "$schema": "https://opencode.ai/config.json", "default_agent": "plan", "agent": { "plan": { "permission": { "bash": "ask" } } } }The bot will close this issue as a duplicate of #39491 in 1 day. If your problem is different, reply here and explain how. Please also follow #39491 for updates.
github-actions commentedon Oct 7, 2026
This issue might be a duplicate of existing issues. Please check:
opencode-agent commentedon Oct 8, 2026
Closing this as a duplicate of #39491, as mentioned yesterday, since there hasn't been a reply saying how this problem is different. Both issues are about the model writing files through
bashwhile in Plan mode.Please follow #39491 for updates. Until it's addressed, setting
"agent": { "plan": { "permission": { "bash": "ask" } } }in your config makes the plan agent ask before running any shell command. If this turns out to be a different problem, or it also happens on v2, feel free to comment here or open a new issue. Thanks, @chlin501!