PreToolUse read-only hook

Plan mode feels read-only. Reverse-engineering (Armin Ronacher, 2025-12-17) showed it is a short injected prompt - “MUST NOT make any edits” - not a sandboxed tool lockdown. A March 2026 write-up demonstrated Claude modifying a .zshrc while plan mode was active. Writing MUST NOT in all caps is not a security boundary.

Make it actually read-only

Wire a PreToolUse hook that denies Write and Edit when permission_mode is plan, with one exception for the plan file under ~/.claude/plans/:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Write|Edit|NotebookEdit",
        "hooks": [
          {
            "type": "command",
            "command": "~/.claude/hooks/block-plan-writes.sh"
          }
        ]
      }
    ]
  }
}

The script reads the hook payload on stdin and exits non-zero (blocking the call) when the condition matches. This costs nothing in capability: the agent never legitimately writes anywhere else while planning.

For untrusted repos or unattended runs, climb the sandbox ladder instead. Decision tree for when to use plan mode: Plan mode decision tree. Full article: Claude Code plan mode.