[BUG] Plan-mode dropdown stays checked after approval but no longer gates follow-up prompts

Summary

When Plan mode is selected from the Claude Code mode dropdown, only the
first user prompt of the session is gated by plan mode. After Claude calls
ExitPlanMode and the user approves the plan, the dropdown's checkmark
visually persists, but subsequent prompts in the same session execute in
normal mode — the gate doesn't re-arm.

The persistent checkmark strongly implies session-level state, so the UI
and runtime disagree on what "Plan mode" means once a plan completes.

Repro

1. Start a new Claude Code session (CLI 2.1.126, macOS).
2. Open the mode dropdown (Shift+Cmd+M) and select Plan mode.
3. Send a prompt that warrants a plan (e.g. /init).
4. Claude enters plan mode, writes the plan, calls ExitPlanMode.
5. Approve the plan. Claude executes it.
6. Without re-toggling the dropdown, send a follow-up prompt that

requests a different change — ideally one with shared-state effects
(e.g. "now enable branch protection via gh").

1. Claude executes immediately with no EnterPlanMode reminder, even

though the dropdown still shows the Plan mode item checked.

Expected

One of:

• Session-sticky: the checkmark means "every prompt in this session

goes through plan mode until I uncheck it." Each new prompt re-arms the
plan-mode system reminder.

• One-shot, but visually honest: the checkmark clears after

ExitPlanMode + approval, so the UI matches the runtime.

• At minimum: a tooltip / first-run hint explaining "Plan mode applies

to your next prompt only."

Actual

The checkmark persists indefinitely. Plan mode auto-fires only on the
first prompt of the session. After the first ExitPlanMode + approval,
the gate lifts silently.

Why it matters

In my session I selected plan mode for a setup task, the plan was
approved, and Claude executed it correctly. I then asked a follow-up
("we have GitHub Team now, fix the branch-tracking gap") that resulted in
Claude calling the GitHub API to enable branch protection on a real
private repo — a hard-to-reverse, visible-to-others action.

That's exactly the class of action plan mode is meant to gate. Because the
dropdown still showed Plan mode, I expected Claude to plan first; Claude
executed without planning. Branch protection happens to be reversible, but
the same mismatch could have triggered a force-push or a destructive
gh api -X DELETE with worse consequences.

When I pointed this out, Claude correctly identified that ExitPlanMode
ends the session-wide block and the dropdown toggle does not re-arm — but
this is the opposite of what the persistent checkmark suggests.

Suggested fixes (in priority order)

1. Make the dropdown selection session-sticky: while "Plan mode" is

checked, every new user prompt should inject the plan-mode system
reminder (i.e. behave as if EnterPlanMode was called for that turn).

1. If one-shot semantics are intentional, clear the checkmark after

ExitPlanMode + approval so the UI matches reality.

1. Add a tooltip on the Plan-mode menu item: *"Applies to your next

prompt only — re-select for follow-ups."*

Environment

• Claude Code 2.1.126 (CLI)
• macOS Darwin 24.6.0
• Model: Claude Opus 4.7 (1M context)
• Account: GitHub Team plan (no relevance to the bug, but the actual

shared-state action that surfaced this was gh api -X PUT /repos/.../branches/main/protection).