Plan mode is editing my files (gemini 3 pro)

[mintchaos]

Description

Twice now when working on a plan I've provided plan feedback and instead of updating the plan it's gone ahead and made the changes.

I think both times were with gemini 3 pro. (which I've been working with with because gemini are the blessed models at the day job).

A share link of this happening to me is attached, along with a screenshot.

You can see that my second prompt resulted in a pretty good plan. My third prompt was plan refinement, but it went ahead and started making changes with sed and rm

I haven't altered any agent settings. The only thing in my opencode.jsonc is a local nixos mcp server.

It looks like there are attempts to prevent this. https://github.com/anomalyco/opencode/blob/d5f0e3fcccdf71aea9e7fd76874685bf36ab025c/packages/opencode/src/tool/bash.txt#L29

https://github.com/anomalyco/opencode/blob/d5f0e3fcccdf71aea9e7fd76874685bf36ab025c/packages/opencode/src/agent/agent.ts#L87

https://github.com/anomalyco/opencode/blob/d5f0e3fcccdf71aea9e7fd76874685bf36ab025c/packages/opencode/src/session/prompt/plan.txt#L4-L6

But it's obviously not working. I wonder if there should be more granular permissions around the bash tool? maybe enforcing more granular permissions? I would feel better if bash was more locked down.

Plugins

none

OpenCode version

1

Steps to reproduce

1. use gemini 3 pro
2. use native plan agent
3. ask it to make a plan
4. ask for a change
5. plan agent makes the changes 😱

Screenshot and/or share link

Session share: https://opncd.ai/share/mvxL26AW

Here's a screenshot of the session showing it in on the plan agent.

Operating System

nixos (linux kernel v 6.18.3)

Terminal

terminal inside zed editor, I think the other time this happened was in ghostty on mac os.