gemini-cli - 💡(How to fix) Fix Agent instructed to use incorrect path for `write_file` in Plan Mode (Policy Denial) [1 comments, 2 participants]

What happened?

When operating in Plan Mode, the agent is restricted to using write_file and replace exclusively for writing .md plans. The system instructions explicitly tell the agent to write the plan to the workspace plans directory (e.g., /Users/<user>/workspace/<project>/.gemini/plans/plan.md).

However, the underlying security policy engine only accepts tool calls targeting the temporary session directory (e.g., /Users/<user>/.gemini/tmp/<project-session>/plans/plan.md).

To Reproduce Steps to reproduce the behavior:

1. Start the Gemini CLI in a project workspace.
2. Enter Plan Mode.
3. The system prompt instructs the agent: "You may ONLY use this tool to write or update plans (.md files) in the plans directory: /Users/username/workspace/my-project/.gemini/plans/".
4. Have the agent attempt to create a plan file using write_file exactly as instructed at /Users/username/workspace/my-project/.gemini/plans/plan.md.
5. The tool execution fails with the following policy error:

   "Tool execution denied by policy. You are in Plan Mode and cannot modify source code. You may ONLY use write_file or replace to save plans to the designated plans directory as .md files."

6. Workaround Discovery: Have the agent attempt to create the file at the temporary session path instead (e.g., /Users/username/.gemini/tmp/my-project-session/plans/plan.md).
7. The write succeeds and actually writes to the project directory correctly.

What did you expect to happen?

The system instructions and the security policy engine must be aligned. Either: A. The policy engine should accept the workspace path (e.g., .../.gemini/plans/plan.md) directly since that's what the agent is instructed to use. B. The system prompt should instruct the agent to use the temporary session path for write_file in Plan Mode.

Client information

Run gemini to enter the interactive CLI, then run the /about command.

> /about
 About Gemini CLI                                                                                                                                                                       │
│                                                                                                                                                                                        │
│ CLI Version                                                     0.38.0                                                                                                                 │
│ Git Commit                                                      3f0873a83                                                                                                              │
│ Model                                                           gemini-3.1-pro-preview                                                                                                 │
│ Sandbox                                                         no sandbox                                                                                                             │
│ OS                                                              darwin                                                                                                                 │
│ Auth Method                                                     Signed in with Google ([email protected])                                                                     │
│ Tier                                                            Gemini Code Assist in Google One AI Pro

Login information

Login in via google account.

Anything else we need to know?

The bug is not that write_file is fundamentally broken, but rather a context mapping mismatch between what the LLM is prompted to do and what the Policy Engine (likely in plan.toml or the tool executor sandbox logic) enforces. While recent PRs (like those around v0.36.0) addressed missing session IDs in paths, they did not resolve the core contradiction where the agent is prompted with the raw project path but the policy expects the temp storage path.

If the agent follows the system instructions and provides the workspace path, it receives a strict policy denial. If the agent ignores the prompt and provides the temporary session path (workaround), the tool execution succeeds, and the CLI secretly maps that write back to the workspace plans directory under the hood. This disconnect completely breaks the automated Plan Mode workflow because the agent is instructed to use a path that the security policy is designed to reject.