Function is_plan_file_only_write 

pub fn is_plan_file_only_write(
    command: &str,
    workdir: &Path,
    plan_file: &Path,
) -> bool

True when command’s ONLY effect is writing the plan file: every segment classifies read-only once its plan-file redirects are set aside, no command/process substitution appears anywhere (expanding heredoc bodies included), and at least one redirect actually targets the plan file.

The plan-mode escape hatch for models that author the plan via shell (echo … > plan.md, cat > plan.md <<'EOF') instead of write_file — observed doom-looping for minutes against the generic denial. Anchored in the is_plan_safe_build_command style (worst-segment rule, fail-closed on anything unprovable):

• substitutions refuse outright (echo $(date) > plan.md); quoted- delimiter heredoc bodies are exempt — they are provably literal, and plans legitimately quote shell snippets;
• tee/dd refuse (multi-target argv parsing buys nothing over >);
• a cwd-changing builtin refuses: cd/pushd/popd classify ReadOnly (they only move the shell’s own cwd), so cd /tmp && echo x > plan.md passed every check above while the redirect landed in a different directory entirely. The match below is lexical and cannot model a cwd that moves mid-command, so the honest answer is to refuse;
• every redirect must resolve to a safe device or the plan file; $VAR, ~, globs, and dangling > all fail the lexical match (fail-closed);
• >> append is allowed — same file, legitimate incremental authoring;
• with the plan-file redirects stripped, the segment must classify ReadOnly (unknown heads fail-safe to ShellMutation and refuse).

Residual power is content-level only: arbitrary bytes into the plan file, which write_file’s carve-out already grants.