Earlier quoted context omitted.
Plan mode disabled the tools, so I don’t see how it would do that. A sandboxed devcontainer is worth setting up though. Lets me run it with —dangerously-skip-permissions
I don't know either but I've seen it write to files in plan mode. Very confusing.
But here are fine prints, it has "exit plan mode" tool, documented here: https://minusx.ai/blog/decoding-claude-code/#appendix
So it can exit plan mode on its own and you wouldn't know!