New components for the webchat control UI:

1. Mode switcher (ui/src/ui/chat/mode-switcher.ts):
   - Chip/pill in chat toolbar showing current execution mode
   - Dropdown menu with 4 modes: Ask permissions, Accept edits, Plan mode, Bypass permissions
   - Each mode maps to existing session fields (execSecurity + execAsk)
   - Keyboard shortcuts: Ctrl+1 through Ctrl+4
   - No new protocol schema — pure UI abstraction

2. Plan cards (ui/src/ui/chat/plan-cards.ts):
   - Expandable <details>/<summary> cards for plan events in message thread
   - Step checklist with status markers (pending/in_progress/completed/cancelled)
   - Accent left-border to distinguish from tool cards
   - formatPlanAsMarkdown() for sidebar/detail view

3. CSS (plan-cards.css, layout.css additions):
   - Plan card styles mirroring tool-cards.css patterns
   - Mode switcher chip + dropdown menu styles

…syntax

Mode switcher:
- Add type='button' to chip and menu item buttons (prevent form submission)
- Remove redundant inline style='position: relative' (already in CSS)
- Show 'Ctrl+N' in shortcut labels, not just 'N'
- Use Ctrl only, not Cmd — Cmd+1-4 is browser tab switching on macOS

Plan cards:
- Use standard markdown checkbox syntax ([ ] and [x]) instead of non-standard
  [~] and [>] markers that markdown-it-task-lists doesn't recognize
- Cancelled steps: '- [ ] ~~label~~ (cancelled)' instead of '- [~] ~~label~~'
- In-progress steps: '- [ ] **label** (in progress)' instead of '- [>] **label**'

mode-switcher.test.ts (15 tests):
- resolveCurrentMode: all 4 mode mappings, unknown fallback, undefined fallback
- handleModeShortcut: Ctrl+1-4 match, Ctrl+5 no match, Cmd+1 blocked (macOS),
  Ctrl+Cmd blocked, plain digit blocked, preventDefault called/not called

plan-cards.test.ts (8 tests):
- formatPlanAsMarkdown: title h2, explanation italics, all 4 step statuses,
  activeForm substitution, absent activeForm, missing explanation, empty steps

- handleModeShortcut: reject Ctrl+Shift and Ctrl+Alt combos (not just Cmd)
- Add aria-hidden='true' to all decorative SVGs in mode-switcher and plan-cards
- Add 2 tests: Ctrl+Shift+1 and Ctrl+Alt+1 return null

- aria-expanded now renders as string 'true'/'false' instead of boolean
  (Lit boolean binding removes the attribute entirely when false)
- formatPlanAsMarkdown() normalizes newlines in title, explanation, and
  step labels to prevent broken markdown structure

Critical bug found in review: the Plan mode entry mapped to
execSecurity:'deny' which would block ALL exec including read-only
commands (ls, cat, git status). This directly contradicts #67538's
plan-mode design where read-only exec MUST work for research.

Worse, this UI toggle didn't actually activate #67538's mutation gate —
it just set deny flags on a separate session field. Two parallel 'plan
mode' mechanisms that didn't talk to each other.

Fix: remove Plan mode from the 4-mode switcher. The remaining 3 modes
(Ask/Accept/Bypass) cleanly map to execSecurity/execAsk without
collision. Plan mode UI toggle requires a protocol contract change
(planMode field in sessions.patch) and lands as a separate PR after
#67538 merges.

- Mode count: 4 → 3 (Ask, Accept, Bypass with shortcuts Ctrl+1/2/3)
- Removed unused listIcon SVG constant
- Tooltip updated: 'Ctrl+1-3' instead of 'Ctrl+1-4'
- Tests updated: removed Plan mode test, added test that Ctrl+4 returns null
- Test for resolveCurrentMode('deny','off') now expects fallback to Ask

…tic dismissal, hide input

Five user-reported bugs from end-to-end test:

1. Agent never auto-continued after Accept. Fix: send synthetic
   [PLAN_DECISION] user-turn message via handleSendChatInternal
   after sessions.patch succeeds. New buildPlanDecisionUserMessage
   helper in app.ts.

2. Optimistic card dismissal — clear UI state BEFORE round-trip;
   restore on error. Closes the stale-card double-click failure.

3. Revise popup → inline textarea. window.prompt's Cancel returned
   null which still fired reject; new textarea is opt-in via
   handlePlanApprovalReviseOpen and Cancel correctly does nothing.

4. Hide chat input bar while plan-approval card is showing.

5. Differentiate Accept vs Accept-Allow-Edits in [PLAN_DECISION] text.

Files (6 modified, all UI).

…efault permissions mode

Two UX fixes from end-to-end test:

1. Auto-open the full plan in the right sidebar when an approval
   event arrives. Previously the user had to click "Open plan" to
   see the full markdown — now it pops open automatically. New
   openPlanInSidebar() method on the app + optional callback on
   PlanApprovalHost that handlePlanApprovalEvent invokes after
   setting state.

2. New "Default permissions" mode entry in mode-switcher that clears
   execSecurity/execAsk overrides (sends explicit `null` to
   sessions.patch). When the user picks this, the runtime falls back
   to whatever's in agents.defaults / per-agent config (the "normal
   agentic" mode the operator configured). Reorders chip:
   Default / Ask / Accept / Plan / Bypass. Fixes the user complaint
   that exiting plan mode locked them into Ask instead of restoring
   their config-default permissions.

Files:
- ui/src/ui/app.ts: openPlanInSidebar() method
- ui/src/ui/app-tool-stream.ts: openPlanInSidebar callback hook
- ui/src/ui/chat/mode-switcher.ts: Default mode entry + shortcut renumber
- ui/src/ui/app-render.ts: explicit null for execSecurity/execAsk on
  Default mode select

…live plan, allow-edits gate, scroll preserve

Five fixes from end-to-end test:

1. Stall after rejection: buildPlanDecisionUserMessage reject now reads
   "Your next response MUST include an exit_plan_mode tool call. Do
   NOT just acknowledge with chat text — call the tool. Do NOT stop
   after a one-line 'Revising' message."

2. Default permissions as post-approval state: handlePlanApprovalDecision
   now sends execSecurity:null + execAsk:null on approve/edit so chip
   falls back to "Default" not the prior Ask preset. Reject leaves
   them alone (still in plan mode).

3. Accept-allow-edits gate spelled out: ">95% confidence to deviate;
   else use read-only tools / spawn subagents to validate; record
   deviation via update_plan; continue autonomously until completion,
   real blocker, or destructive action requiring confirmation."

4. Live plan view: maybeForwardLivePlanUpdate detects update_plan tool
   calls and refreshes the right sidebar markdown in-place. New
   refreshLivePlanSidebar method on app — boxes tick off live as
   the agent steps through the approved plan.

5. Open Plan scroll: handleOpenSidebar captures chat-thread scrollTop
   pre-reflow and restores after RAF. Sticky-bottom if user was at
   bottom; absolute restore otherwise.

Required PR-8 backend follow-up (commit 3bd8ae6 on
feat/plan-mode-integration): enter_plan_mode tool result content tells
the agent to call exit_plan_mode next.

Files (2 modified):
- ui/src/ui/app.ts: buildPlanDecisionUserMessage rewrite, exec*:null
  on approve/edit, refreshLivePlanSidebar, handleOpenSidebar scroll
  preserve
- ui/src/ui/app-tool-stream.ts: maybeForwardLivePlanUpdate detector

…DECISION] approve/edit messages