The real reason why plan mode is dead is because you can just conversationally instruct the agent to not make changes to the repository or to make changes to selected documents only, and it will listen. There was a time when we needed to enforce this via selected tool use, but we have surpassed that.
tcdent · · focus · HN ↗
Feathercrown · · focus · HN ↗
diegof79 · · focus · HN ↗
You can use Docker’s sbx or similar VM/containers for that.