[Bug]: Claude Auto + Plan silently approves native plan-mode write requests (V2) #15503

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Related but not the same:

• [Bug]: Plan mode performs real write / side-effecting actions (file edits, git commits, MCP tool calls) before the plan is approved #3744 (closed when V2 landed in feat(orchestrator): introduce new orchestrator #2829): Full access + Plan writing before approval, on V1.
• fix(server): Claude threads no longer stay stuck in plan mode Claude entered itself #15224: Claude entering plan mode on its own.
• fix(server): Claude asks before commands in Auto-accept edits #13786 fixed the same allow-everything callback branch for Auto-accept edits. Auto and Full access were left unchanged.

Area

apps/server

Steps to reproduce

1. In a scratch directory, create calc.py and make sure there's no probe.txt:

   def average(xs):
       """Return the arithmetic mean of a non-empty list."""
       total = 0
       for i in range(1, len(xs)):
           total += xs[i]
       return total / len(xs)

2. From a V2 thread, call delegate_task with the Claude provider, model: "claude-sonnet-5-5", runtimeMode: "auto", interactionMode: "plan".
3. Task: read calc.py, fix the off-by-one with the Edit tool, then run echo probe > probe.txt. Attempt each step even in plan mode, so the test shows whether the harness blocks the writes.

Expected behavior

While Plan remains selected, T3 should not silently authorize the write requests Claude routes through its plan-mode permission callback. If Auto + Plan intentionally permits implementation writes, that exception should be explained in the Plan UI and documentation.

Actual behavior

Both writes ran with no prompt:

• The CLI's system/init message reported "permissionMode":"plan".
• Edit returned "The file … has been updated successfully".
• echo probe > probe.txt returned "(Bash completed with no output)" and created the file.
• The final result had "permission_denials":[].

A Full access + Plan run started about 3 seconds later attempted neither write. The model chose to respect plan mode, so that run didn't test enforcement.

Where it seems to come from. Anthropic documents that native Plan mode routes file edits and shell writes to canUseTool, rather than denying them before the callback (Agent SDK permissions, Plan mode):

File edits are never auto-approved in plan mode, even when an allow rule matches. They prompt through your canUseTool callback instead. On Claude Code v2.1.212 or later, shell commands that modify files, such as touch and rm, reach your canUseTool callback the same way.

T3 selects permissionMode: "plan", but its Auto no-approval branch returns allow, which authorizes these requests. This explains the observed writes. ClaudeAdapterV2 always passes canUseTool (the query-open log shows hasCanUseTool: true). After the ExitPlanMode capture, the if (!requiresClaudeApproval(context)) branch returns allow without checking for plan mode. requiresClaudeApproval depends only on the access level and approval policy.

Impact

Major degradation or frequent failure

Version or commit

0.0.46-nightly.20261004.2644. The branch above is unchanged on main at ee7b49d.

Environment

Linux desktop app, Claude Code 2.1.289, claude-sonnet-5-5, stock Claude provider instance (no launch arguments)

Notes

• I tested through delegate_task. A composer thread with Auto + Plan should take the same adapter path, but I haven't checked it in the UI.
• There are no allow rules in user, project or local Claude settings.

Contribution

Once the intended Auto + Plan policy is confirmed, I'd like to contribute a focused fix with callback-level regression tests, preserving read-only investigation and plan capture.