[liuedcson]

Problem

Plan mode exited and the model started executing as soon as exit_plan_mode ran. A host that only rendered the tool result was never a blocking gate, and the tool could not tell a real reviewer from one that could not answer. The earlier revision of this PR also assumed the desktop app was an SDK stdio peer; it is an in-process mode: "rpc" host, so that bridge could not fix the reported behavior.

Fix

A plan review is now a persisted, request-bound state, separate from leaving plan mode.

• One boundary, one spelling. The plan-file restriction is decided by a shared helper before the ordinary permission prompt. A forbidden edit is refused without asking; a write to the plan file still goes through the normal permission policy. A failed persist or an embedder that records no entries cannot drop the live restriction.
• Submission and exit are separate. step-plan records review: { id, planHash, outcome } with pending before the review is shown and the decision afterwards. Only one review may be pending; changing modes, starting a new /plan task, navigating branches, or shutting down invalidates its signal, so a late approval cannot unlock a new round. Restoring a pending review records it as unanswered.
• Who decides. The tool uses the host's native ui.reviewPlan when available, otherwise the host's structured ui.clarify question (used by the in-process Web/Desktop host, which already has a clarification panel and broker), otherwise the TUI dialog. Closing a structured question counts as a dismissal, matching Escape in the TUI. Free text is feedback, never approval. A malformed or missing answer is not a decision.
• SDK stdio peers opt in. ctx.ui.reviewPlan exists only when the peer advertises capabilities.planReview: true at initialization. Unsupported peers keep the external handoff instead of waiting for a request they cannot answer. Timeouts and aborts emit user_dialog.cancelled; failed writes and shutdown settle immediately; an oversized proposal returns an actionable request to shorten it instead of a misleading "dismissed".
• No proposal keeps plan mode on. The model may answer a read-only request directly, but a missing or unchanged plan file no longer disables the mode: only the user leaves with /plan.
• Approval is bound to the reviewed snapshot. The tool rereads the plan and compares the hash before leaving plan mode; a changed or unreadable file requires a new review.
• The turn actually ends. A new stopTurn result flag ends the turn on a single control decision, independent of sibling results. Sequential batches give later calls paired skipped results instead of executing them; parallel calls already in flight still settle. The existing all-results terminate behavior is unchanged.

Behavioral impact

• TUI: unchanged dialog, but dismissal and unanswered reviews stop the turn; a rendering error stays a tool error instead of being recorded as a user decision.
• Web/Desktop (in-process mode: "rpc"): the plan review blocks through the existing clarification channel and ends the turn unless the user approves. No new desktop-side protocol is required. A dedicated plan surface can consume intent.kind === "plan_review" later; the current panel shows the proposal text.
• Headless and RPC hosts without a review bridge: the proposal still exits plan mode and is handed to the caller, but the turn ends immediately instead of letting the model continue.
• Plan-mode entry still leaves the tool block byte-identical, so the cached prefix is preserved. /plan <task> still expands a leading skill or prompt template.

Tests

• pnpm run check (Biome, dependency/layer/public-boundary checks, tsgo --noEmit, browser smoke).
• ./test.sh with an isolated HOME: VALIDATION_EXIT=0, 6,986 tests passed / 65 skipped across all packages (coding-agent 5,159; agent-core 540; providers 461; CLI 751; others 92).
• Focused coverage:
  • real ExtensionRunner capability probing (TUI / unbridged rpc / bridged rpc);
  • request-bound review state, single pending review, mode-change invalidation, restore-as-unanswered, hash recheck, failed persist;
  • SDK stdio opt-in, timeout/abort/late-frame/cancel-frame, failed write, shutdown, oversized proposal;
  • real AgentSession end-to-end: mixed batch through sdk-stdio, embedded rpc clarify approval and dismissal, no-proposal direct answer, /plan template expansion;
  • Agent Loop control barrier with a throwing result hook and paired skipped results;
  • CLI TUI abort closing the native review and the unanswered transcript summary.