Plan mode is editing my files (gemini 3 pro)

[mintchaos]

Description

Twice now when working on a plan I've provided plan feedback and instead of updating the plan it's gone ahead and made the changes.

I think both times were with gemini 3 pro. (which I've been working with with because gemini are the blessed models at the day job).

A share link of this happening to me is attached, along with a screenshot.

You can see that my second prompt resulted in a pretty good plan. My third prompt was plan refinement, but it went ahead and started making changes with sed and rm

I haven't altered any agent settings. The only thing in my opencode.jsonc is a local nixos mcp server.

It looks like there are attempts to prevent this.

opencode/packages/opencode/src/tool/bash.txt

Line 29 in d5f0e3f

- Avoid using Bash with the `find`, `grep`, `cat`, `head`, `tail`, `sed`, `awk`, or `echo` commands, unless explicitly instructed or when these commands are truly necessary for the task. Instead, always prefer using the dedicated tools for these commands:

opencode/packages/opencode/src/agent/agent.ts

Line 87 in d5f0e3f

"*": "deny",

opencode/packages/opencode/src/session/prompt/plan.txt

Lines 4 to 6 in d5f0e3f

	CRITICAL: Plan mode ACTIVE - you are in READ-ONLY phase. STRICTLY FORBIDDEN:
	ANY file edits, modifications, or system changes. Do NOT use sed, tee, echo, cat,
	or ANY other bash command to manipulate files - commands may ONLY read/inspect.

But it's obviously not working. I wonder if there should be more granular permissions around the bash tool? maybe enforcing more granular permissions? I would feel better if bash was more locked down.

Plugins

none

OpenCode version

1

Steps to reproduce

1. use gemini 3 pro
2. use native plan agent
3. ask it to make a plan
4. ask for a change
5. plan agent makes the changes 😱

Screenshot and/or share link

Session share: https://opncd.ai/share/mvxL26AW

Here's a screenshot of the session showing it in on the plan agent.

Operating System

nixos (linux kernel v 6.18.3)

Terminal

terminal inside zed editor, I think the other time this happened was in ghostty on mac os.

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• Files were modified even being under 'Plan Mode' #5475: Files were modified even being under 'Plan Mode' - Plan mode executing changes unexpectedly
• Planning Mode instructions may be too strict #4627: Planning Mode instructions may be too strict - Model gets stuck in loops due to strict plan mode constraints
• Gemini 3 never follows instructions in plan mode and always requests to modify code #4478: Gemini 3 never follows instructions in plan mode and always requests to modify code - Specific issue with Gemini 3 Pro in plan mode
• Plan mode refuses to provide file edit instructions, leading to a deadlock. The agent thinks it is instructed to edit files, which is not the case. System instructions should help the AI understand this. #4391: Plan mode refuses to provide file edit instructions, leading to a deadlock - Agent blocked from providing guidance
• Subagent with specific model results in model change in build and plan mode #6636: Subagent with specific model results in model change in build and plan mode - Related model/agent behavior issue

Feel free to ignore if none of these address your specific case.