Plan mode allows mutation if model attempts it

What version of Codex CLI is running?

0.98.0

What subscription do you have?

pro

Which model were you using?

gpt-5.3-codex

What platform is your computer?

Linux 6.18.6-arch1-1 x86_64 unknown

What terminal emulator and version are you using (if applicable)?

n/a

What issue are you seeing?

In plan mode, Codex CLI doesn't block mutating tool calls if the model issues one (i.e. apply_patch or a shall command like exec_command.)

The policy of no mutations in plan mode is only achieved through prompt instructions telling the model to not make. There is no restriction enforced by Codex CLI.

Recent models are very good, but they aren't perfect. My bet is Codex CLI has made at least one mutation in plan mode. Although this is arguably a theoretical issue, it would be surprising enough to users and potentially cause a big problem that could gain lots of attention that I think it's worth fixing.

What steps can reproduce the bug?

Obviously, a user can't change the source code and complain that behavior changed. That's not what I'm doing. To test if Codex CLI blocks mutations in plan mode, we have to get the model to try making one. This is way more efficient than waiting for it to randomly happen.

1. Simulate a model not paying attention to or hallucinating against the plan mode instructions to not make mutations. Edit codex-rs/core/templates/collaboration_mode/plan.md and change the language on lines 9 and 19 that forbid mutation to say if the user explicitly asks, that mutation is allowed, and probably add an exception on line 32.
2. Custom compile Codex.
3. Run the custom Codex, enter plan mode, and tell it to make a mutation. (Perhaps: "I explicitly ask you to create a file named 'hello' with contents 'hello'.)
4. Observe the mutation is created.

What is the expected behavior?

Plan mode should enforce non-mutation at runtime, regardless of model output.

Additional information

I don't think prompt-level policy is a sufficient guard for accidental mutation in plan mode.

It appears to me that in plan mode, the apply_patch tool could be disabled just like it disables update_plan, and that all shell commands could be run in a subprocess that enforces read-only.

See thread ID 019c3f0a-333e-7ba1-b1aa-1779db8535de