immediately of course we see this seemingly devastating bug where plan mode is able to invoke an edit tool even though it shouldn't be able to: https://github.com/anthropics/claude-code/issues/39201
The way that plan mode works is... how else? by invoking a EnterPlanModeTool which emits a prompt that says "you definitely can't edit files." There are *numerous* mechanisms in the code to try and enforce this programmatically, including special arguments to all tools (prePlanMode?), the mode parameter in the toolPermissionContext which can be set to 'plan', a planAgent which explicitly disables the edit tool, handlers like hasExitedPlanModeInSession(), checks when getting model parameters for if mode == plan, plan mode transition handlers that set the global state dict, a prepareContextForPlanMode in the permissionSetup module that declares itself the centralized plan-mode entrypoint....
clearly! they! work!
