Repository navigation
plan mode: agent executed state-changing shell commands without switching to build #59219
Closed as duplicate
Description
Summary
While the session was in plan mode, the agent ran shell commands that made external writes (curl PUT/POST to a Jira REST API). These commands were neither blocked nor prompted for approval. The agent also never received a plan-mode / read-only reminder, so it behaved exactly as it would in build mode.
Environment
- opencode version: 2.1.4
- OS: Linux 7.0.0-38-generic x86_64 (Ubuntu)
- Terminal: TERM=xterm-256color, COLORTERM=truecolor
- Shell: /bin/zsh
- Install/channel: latest (autoupdate: true)
- Active plugins: @cortexkit/opencode-magic-context@latest; local plugins in ~/.config/opencode/plugin/: auto-models.ts, copilot-budget.ts, delegation-nudge.ts
- Config: no
permissionblock in the active config;agent.planonly overridescolor - Model: github-copilot/claude-opus-5.5
Reproduction
- Start a session with the plan agent selected.
- Ask for a change against an external system (here: "set these Jira issues to To Do and assign them").
- The agent loads a skill, then runs
curl -X PUT .../assigneeandcurl -X POST .../transitionsthrough the shell tool.
Expected Behavior
In plan mode, state-changing actions should be blocked, or at least require approval. The agent should also be told it is in plan / read-only mode, so it proposes a plan and asks the user to switch to build.
Actual Behavior
- The commands ran without a permission prompt (all returned HTTP 204), and 7 Jira issues were modified.
- The model's context contained no plan-mode system reminder, so it had no indication that it should stay read-only.
- A
questiontool call ran mid-task (scope confirmation), which also did not surface plan mode.
Additional Context
- Reproduced once so far.
- Possibly related to the code-mode
executetool / v2 tool layout, or to a plugin altering the system prompt. Not yet verified with plugins disabled. - Impact: users who rely on plan mode as a safety boundary can get unintended writes to production systems.
Activity
opencode-agent commentedon Oct 26, 2026
Thanks for the detailed report, @danlii. I think this is a duplicate of #53955.
On v2 (including 2.1.4), the Plan agent's only restriction is on the file-editing tools:
edit/write/patchare blocked outside~/.opencode/plan/. It has no rule for theshelltool. Shell commands likecurl -X PUT …are covered only by the Plan mode reminder telling the model not to make changes, so they ran without a permission prompt. #53955 tracks this gap and has been reproduced. #54165 proposed asking before shell commands in Plan mode but was closed without being merged.Possible duplicates and related issues, ordered by likelihood:
default_agent, the Plan mode reminder is added only after the first response, so the model doesn't see it at first (fix proposed in fix(plugin): persist the Plan-mode reminder before the first prompt under default_agent #58395)generalsubagentThe missing reminder may be a separate problem. Plan mode should add it when the session starts or you switch to Plan, and put it back on every request if it is missing. Plugins that rewrite the conversation context (for example
@cortexkit/opencode-magic-context) or Plan being selected throughdefault_agent(#58287) could explain why it wasn't there. If you can still reproduce a missing reminder with plugins disabled and Plan selected explicitly (Tab in the TUI or--agent plan), please reply with the steps.The bot will close this issue as a duplicate in 1 day unless you reply explaining how your problem is different.
danlii commentedon Oct 26, 2026
Follow-up: later in the same session the agent received a "You are NO LONGER in Plan mode" reminder when switching to build, and a "You are in Plan mode" reminder after switching back to plan. The plan-mode instructions are injected on a mode switch, but were never injected when the session started in plan mode. That initial turn is when the writes happened.
samvallad33 commentedon Oct 26, 2026
Hi danlii,
How long before you noticed the 7 Jira tickets had moved?
When the model alone decides what is safe, writes slip through, and yours trace back to the session opening in plan mode with no reminder. Want to see how I find starting points like that?
Sam
opencode-agent commentedon Oct 27, 2026
We haven't heard back, so I'm closing this as a duplicate of #53955, as mentioned earlier. In Plan mode on v2, including 2.1.4, the Plan agent blocks only the file-editing tools. Shell commands like your
curl -X PUT/POSTcalls to Jira run without a permission prompt. Please follow #53955 for updates on that.The missing Plan mode reminder may be a separate problem. It could come from a plugin that rewrites the conversation context, or from Plan being set as the
default_agent(#58287). If you can still get a session with no reminder after disabling plugins and choosing Plan explicitly (Tab in the TUI or--agent plan), please open a new issue with the steps. Thanks again for the detailed report, @danlii!