Agent violated plan mode restrictions and made changes to files

What version of Codex CLI is running?

codex-cli 0.144.1

What subscription do you have?

PRo

Which model were you using?

gpt-5.4-mini

What platform is your computer?

Darwin 25.5.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

none

Codex doctor report

{
  "schemaVersion": 1,
  "generatedAt": "1783867217s since unix epoch",
  "overallStatus": "warning",
  "codexVersion": "0.144.1",
  "checks": {
    "app_server.status": {
      "id": "app_server.status",
      "category": "app-server",
      "status": "ok",
      "summary": "background server is not running",
      "details": {
        "control socket": "/Users/mike/.codex/app-server-control/app-server-control.sock",
        "daemon state dir": "/Users/mike/.codex/app-server-daemon",
        "mode": "ephemeral",
        "pid file": "/Users/mike/.codex/app-server-daemon/app-server.pid (missing)",
        "settings": "/Users/mike/.codex/app-server-daemon/settings.json (missing)",
        "status": "not running",
        "update-loop pid file": "/Users/mike/.codex/app-server-daemon/app-server-updater.pid (missing)"
      },
      "remediation": null,
      "durationMs": 0
    },
    "auth.credentials": {
      "id": "auth.credentials",
      "category": "auth",
      "status": "ok",
      "summary": "auth is configured",
      "details": {
        "auth file": "/Users/mike/.codex/auth.json",
        "auth storage mode": "File",
        "stored API key": "false",
        "stored ChatGPT tokens": "true",
        "stored agent identity": "false",
        "stored auth mode": "chatgpt"
      },
      "remediation": null,
      "durationMs": 0
    },
    "config.load": {
      "id": "config.load",
      "category": "config",
      "status": "ok",
      "summary": "config loaded",
      "details": {
        "CODEX_HOME": "/Users/mike/.codex",
        "config.toml": "/Users/mike/.codex/config.toml",
        "config.toml parse": "ok",
        "cwd": "/Users/mike",
        "enabled feature flags": "shell_tool, unified_exec, shell_snapshot, code_mode_host, terminal_resize_reflow, sqlite, hooks, enable_request_compression, multi_agent, apps, tool_search_always_defer_mcp_tools, tool_suggest, plugins, in_app_browser, browser_use, browser_use_full_cdp_access, browser_use_external, computer_use, remote_plugin, plugin_sharing, image_generation, resize_all_images, skill_mcp_dependency_install, mentions_v2, steer, guardian_approval, goals, collaboration_modes, tool_call_mcp_elicitation, auth_elicitation, personality, fast_mode, tui_app_server, remote_compaction_v2, workspace_dependencies",
        "feature flag overrides": "none",
        "feature flags enabled": "35",
        "log dir": "/Users/mike/.codex/log",
        "mcp servers": "0",
        "model": "gpt-5.4-mini",
        "model provider": "openai",
        "sqlite home": "/Users/mike/.codex"
      },
      "remediation": null,
      "durationMs": 0
    },
    "git.environment": {
      "id": "git.environment",
      "category": "git",
      "status": "ok",
      "summary": "git version 2.48.1",
      "details": {
        "PATH git #1": "/opt/homebrew/bin/git",
        "PATH git #2": "/usr/bin/git",
        "PATH git entries": "2",
        "git build options": "git version 2.48.1; cpu: arm64; no commit associated with this build; sizeof-long: 8; sizeof-size_t: 8; shell-path: /bin/sh; feature: fsmonitor--daemon; libcurl: 8.7.1; zlib: 1.2.12",
        "git exec path": "/opt/homebrew/opt/git/libexec/git-core",
        "git version": "git version 2.48.1",
        "repo detected": "false",
        "selected git": "/opt/homebrew/bin/git"
      },
      "remediation": null,
      "durationMs": 143
    },
    "installation": {
      "id": "installation",
      "category": "install",
      "status": "ok",
      "summary": "installation looks consistent",
      "details": {
        "PATH codex #1": "/opt/homebrew/bin/codex",
        "current executable": "/opt/homebrew/bin/codex",
        "install context": "brew",
        "managed by bun": "false",
        "managed by npm": "false",
        "managed by pnpm": "false",
        "managed package root": "not set"
      },
      "remediation": null,
      "durationMs": 3
    },
    "mcp.config": {
      "id": "mcp.config",
      "category": "mcp",
      "status": "ok",
      "summary": "no MCP servers configured",
      "details": {},
      "remediation": null,
      "durationMs": 0
    },
    "network.env": {
      "id": "network.env",
      "category": "network",
      "status": "ok",
      "summary": "network-related environment looks readable",
      "details": {
        "proxy env vars": "none"
      },
      "remediation": null,
      "durationMs": 0
    },
    "network.provider_reachability": {
      "id": "network.provider_reachability",
      "category": "reachability",
      "status": "ok",
      "summary": "active provider endpoints are reachable over HTTP",
      "details": {
        "ChatGPT base URL": "https://chatgpt.com/backend-api/ reachable (HTTP 404)",
        "reachability mode": "ChatGPT auth"
      },
      "remediation": null,
      "durationMs": 343
    },
    "network.websocket_reachability": {
      "id": "network.websocket_reachability",
      "category": "websocket",
      "status": "ok",
      "summary": "Responses WebSocket handshake succeeded",
      "details": {
        "DNS": "2 IPv4, 0 IPv6, first IPv4",
        "auth mode": "chatgpt",
        "connect timeout": "15000 ms",
        "endpoint": "wss://chatgpt.com/backend-api/<redacted>",
        "handshake result": "HTTP 101 Switching Protocols",
        "model provider": "openai",
        "models etag present": "true",
        "provider name": "OpenAI",
        "proxy env vars": "none",
        "reasoning header": "false",
        "server model present": "false",
        "supports websockets": "true",
        "wire API": "responses"
      },
      "remediation": null,
      "durationMs": 760
    },
    "runtime.provenance": {
      "id": "runtime.provenance",
      "category": "runtime",
      "status": "ok",
      "summary": "running brew on macos-aarch64",
      "details": {
        "commit": "unknown",
        "current executable": "/opt/homebrew/bin/codex",
        "install method": "brew",
        "platform": "macos-aarch64",
        "version": "0.144.1"
      },
      "remediation": null,
      "durationMs": 0
    },
    "runtime.search": {
      "id": "runtime.search",
      "category": "search",
      "status": "ok",
      "summary": "search is OK (system)",
      "details": {
        "search command": "rg",
        "search command readiness": "ripgrep 15.1.0",
        "search provider": "system"
      },
      "remediation": null,
      "durationMs": 4
    },
    "sandbox.helpers": {
      "id": "sandbox.helpers",
      "category": "sandbox",
      "status": "ok",
      "summary": "sandbox configuration is readable",
      "details": {
        "approval policy": "OnRequest",
        "codex-linux-sandbox helper": "none",
        "execve wrapper helper": "/Users/mike/.codex/tmp/arg0/codex-arg0lMb45o/codex-execve-wrapper",
        "filesystem sandbox": "restricted",
        "network sandbox": "restricted"
      },
      "remediation": null,
      "durationMs": 0
    },
    "state.paths": {
      "id": "state.paths",
      "category": "state",
      "status": "ok",
      "summary": "state paths and databases are inspectable",
      "details": {
        "CODEX_HOME": "/Users/mike/.codex (dir)",
        "active rollout files": "72 files, 380372207 total bytes, 5282947 average bytes",
        "archived rollout files": "0 files, 0 total bytes, 0 average bytes",
        "goals DB": "/Users/mike/.codex/goals_1.sqlite (file)",
        "goals DB integrity": "ok",
        "log DB": "/Users/mike/.codex/logs_2.sqlite (file)",
        "log DB integrity": "ok",
        "log dir": "/Users/mike/.codex/log (dir)",
        "memories DB": "/Users/mike/.codex/memories_1.sqlite (file)",
        "memories DB integrity": "ok",
        "sqlite home": "/Users/mike/.codex (dir)",
        "state DB": "/Users/mike/.codex/state_5.sqlite (file)",
        "state DB integrity": "ok"
      },
      "remediation": null,
      "durationMs": 209
    },
    "state.rollout_db_parity": {
      "id": "state.rollout_db_parity",
      "category": "threads",
      "status": "ok",
      "summary": "rollout files and state DB thread inventory agree",
      "details": {
        "default model provider": "openai",
        "rollout DB active files": "72",
        "rollout DB active rows": "72",
        "rollout DB archive mismatches": "0",
        "rollout DB archived files": "0",
        "rollout DB archived rows": "0",
        "rollout DB duplicate DB paths": "0",
        "rollout DB duplicate rollout thread ids": "0",
        "rollout DB malformed file names": "0",
        "rollout DB missing active rows": "0",
        "rollout DB missing archived rows": "0",
        "rollout DB model providers": "openai=72",
        "rollout DB rows": "72",
        "rollout DB scan cap reached": "false",
        "rollout DB scan errors": "0",
        "rollout DB sources": "cli=72",
        "rollout DB stale rows": "0"
      },
      "remediation": null,
      "durationMs": 1682
    },
    "system.environment": {
      "id": "system.environment",
      "category": "system",
      "status": "ok",
      "summary": "OS language en-US",
      "details": {
        "EDITOR": "not set",
        "LANG": "C.UTF-8",
        "LC_CTYPE": "UTF-8",
        "VISUAL": "not set",
        "os": "Mac OS 26.5.1 [64-bit]",
        "os language": "en-US",
        "os type": "Mac OS",
        "os version": "26.5.1"
      },
      "remediation": null,
      "durationMs": 6
    },
    "terminal.env": {
      "id": "terminal.env",
      "category": "terminal",
      "status": "warning",
      "summary": "height 20 rows - content may scroll off (recommended >=24)",
      "details": {
        "color output": "enabled",
        "effective locale": "UTF-8",
        "stderr is terminal": "true",
        "stdin is terminal": "true",
        "stdout is terminal": "true",
        "terminal": "Apple Terminal",
        "terminal size": "174x20"
      },
      "issues": [
        {
          "severity": "warning",
          "cause": "height 20 rows - content may scroll off (recommended >=24)",
          "measured": "174 x 20",
          "expected": ">= 24 rows",
          "remedy": "resize the window to at least 24 rows",
          "fields": [
            "terminal size"
          ]
        }
      ],
      "remediation": null,
      "durationMs": 0
    },
    "terminal.title": {
      "id": "terminal.title",
      "category": "title",
      "status": "ok",
      "summary": "terminal title default",
      "details": {
        "terminal title activity": "true",
        "terminal title items": "activity, project-name",
        "terminal title project source": "cwd",
        "terminal title project value": "mike",
        "terminal title source": "default"
      },
      "remediation": null,
      "durationMs": 0
    },
    "updates.status": {
      "id": "updates.status",
      "category": "updates",
      "status": "ok",
      "summary": "update configuration is locally consistent",
      "details": {
        "cached latest version": "0.144.1",
        "check for update on startup": "true",
        "last checked at": "2026-07-12T01:23:14.759870Z",
        "latest version": "0.144.1",
        "latest version status": "current version is not older",
        "update action": "brew upgrade --cask codex",
        "version cache": "/Users/mike/.codex/version.json"
      },
      "remediation": null,
      "durationMs": 112
    }
  }
}

What issue are you seeing?

In plan mode, the tool that allows the agent to modify and patch files should be moved to a read-only mode. I was working on a larger markdown strategy document, in plan mode to get the session to plan changes to the document first, but it made changes anyway.

› you made changes to the filesystem while in plan mode only, how did that happen? I know it was only a markdown plan file, but aren't all file writes blocked in plan mode?


• Yes. In plan mode, file writes are supposed to be blocked, including markdown. I made a mistake and applied a patch anyway, which I should not have done.

  The correct behavior would have been to keep it read-only and only return the proposed plan text in chat. If you want, I can either revert that file change or keep using
  this as a pure planning exercise and not touch the filesystem again until you explicitly switch out of plan mode.

It did not run external commands, it used the tools to edit the file, typically done by applying a diff, which it showed as it was performing the change.

What steps can reproduce the bug?

After planning out the initial changes, the plan shown was unclear that it was only going to update my strategy plan document, and not actually update my code. So I told it to stay in plan mode instead of selecting the "exit plan mode and implement now" option. Then, I provided this instruction:

this is a documentation / plan change only. we're not making any code changes. just updating the launch plan.

which caused it to make the changes even though it was still in plan mode.

What is the expected behavior?

Plan mode should make all codex tools also enforce read-only mechanisms, including attempting to filter any shell commands that could be used to write to files.

Additional information

_No response_