Detailed Analysis
A Claude Code user on Windows has reported a behavioral discrepancy between Plan mode and normal mode when working with file system access and directory permissions. In Plan mode, the system repeatedly requests read permissions for folders and files that the user considers to be within the designated working directory, flagging them as "outside Working directories." Normal mode, by contrast, operates as expected — establishing a workspace and navigating the repository without the same friction. The user's current workaround involves completing a Plan mode session and then manually transferring the resulting plan into a fresh non-Plan session, a process they acknowledge is cumbersome due to repeated file confirmation prompts.
The core issue appears to center on how Claude Code's Plan mode handles or inherits context about the working directory environment. In normal agentic operation, Claude Code presumably establishes and retains workspace context, granting it access to the file tree within a defined scope. Plan mode, which is designed to allow users to review and approve a proposed course of action before execution, may apply a more restrictive permission model by default — potentially sandboxing or limiting file system visibility as a safety precaution to prevent unintended reads or writes during the planning phase. This could be an intentional design decision rather than a bug, though the user's experience suggests the behavior is not clearly communicated or easily configurable.
This report touches on a broader tension in agentic AI tooling between safety constraints and usability. Plan mode exists precisely to give users oversight over what an AI agent intends to do before it acts — a feature aligned with principles of human-in-the-loop AI deployment. However, if the safety scaffolding around that mode creates excessive friction by withholding directory context, it undermines the planning process itself, since Claude cannot reason effectively about a codebase it cannot see. The user's workaround — plan in one session, execute in another — partially defeats the purpose of an integrated planning workflow.
The issue also highlights challenges specific to Windows environments for developer-facing AI tools, which have historically been developed and tested more extensively on Unix-based systems. Path handling, permission models, and working directory resolution can behave differently on Windows, potentially introducing edge cases that surface in more restricted operational modes like Plan. Whether this is a platform-specific bug, a general Plan mode limitation, or a configuration issue remains unresolved in the post, and the absence of an official response or documentation reference leaves the user without a definitive path forward.
As AI coding assistants mature and Plan-style agentic features become more standard across tools like Claude Code, GitHub Copilot Workspace, and others, the design of permission and context inheritance across different operational modes will become increasingly important. Users adopting these tools for complex, multi-file repository work will expect consistent environmental awareness regardless of which mode they operate in. Addressing this kind of friction — whether through clearer documentation, configurable permission scopes in Plan mode, or automatic context propagation — will be essential to making agentic planning features genuinely useful rather than theoretically appealing but practically limited.
Read original article →