Add Pro Plan model routing for plan-first changes

[dumbjack]

Summary

• Add Pro Plan as a visible TUI mode that plans and reviews with deepseek-v4-pro, executes with deepseek-v4-flash, and keeps the existing Plan Confirmation gate.
• Resolve each Pro Plan turn to existing Plan / Agent / YOLO semantics by phase, so planning and review stay read-only while accepted execution uses the normal implementation tool policy.
• Force implementation-like Pro Plan planning turns through update_plan before implementation, including engine-level blocking for non-update_plan tools until the plan is recorded.
• Add Pro Plan to /mode, mode picker, footer/header/composer UI, localization strings, README, and mode docs.

Why this helps

Claude Code now exposes the same public workflow pattern through /model opusplan: use the strongest model in Plan mode, then switch to a faster model for execution. Anthropic's docs frame the motivation around large coding tasks: planning before broad edits avoids expensive wrong diffs, and the stronger model has the most leverage on architecture and hard reasoning while implementation is usually more mechanical.

Pro Plan brings that pattern to DeepSeek TUI with DeepSeek-native models and the existing Plan Confirmation gate:

• It gives users a guided path for larger implementation tasks: plan first, explicitly accept the plan, execute, then run a read-only review before the workflow is considered done.
• It uses deepseek-v4-pro only where it has the most leverage, planning and review, while letting deepseek-v4-flash handle the implementation pass. This is not meant to make tiny edits cheaper; it is meant to reduce expensive-model usage and rework on larger, riskier tasks.
• It keeps the existing Plan and Agent contracts instead of introducing a separate permission system. Pro Plan is mostly routing and state management around behaviors users already know.
• It makes the plan gate harder to accidentally bypass: implementation-like planning turns must record an update_plan before write-capable tools can run.
• It preserves a human checkpoint. Users can accept with normal approvals, accept with temporary execution auto-approval, revise the plan, or exit back to Agent mode.

Prior-art references:

• Anthropic model configuration docs: opusplan uses Opus during plan mode and switches to Sonnet for execution.
• Claude Code best-practices docs: planning is most useful for uncertain, multi-file, or unfamiliar changes, while small clear edits can be done directly.

Safety / Reviewability

• Raw AppMode::ProPlan fails closed to Plan-mode tools, read-only sandboxing, and Never approval if any path bypasses phase resolution.
• The YOLO accept option stays inside the Pro Plan pipeline: execution can be auto-approved, but review returns to read-only Pro review.
• Pro Plan temporarily disables auto-model routing and restores the previous auto-model setting after leaving the mode.
• Kept evaluation notes out of the PR diff so reviewers only need to inspect the product docs and implementation.

Validation

• cargo fmt
• cargo check -p deepseek-tui
• cargo test -p deepseek-tui pro_plan --quiet
• cargo test -p deepseek-tui --quiet
• Manual TUI smoke test with /mode pro-plan: an implementation-style Chinese planning request attempted read_file, was blocked by the plan guard, then called update_plan and opened Plan Confirmation. I exited via option 4 to avoid applying the smoke-test README edit.

[gemini-code-assist]

Code Review

This pull request introduces 'Pro Plan' mode, a model-routing workflow that utilizes deepseek-v4-pro for planning and review phases and deepseek-v4-flash for implementation. It includes a new ProPlanRouter state machine to manage phase transitions and updates the TUI and engine to enforce plan confirmation, handle automatic model switching, and provide phase-specific status updates. Feedback identifies the use of unstable Rust 'let chains' which could cause compilation errors on stable toolchains. Additionally, several new user-facing strings and labels are hardcoded in English and should be moved to the localization system to maintain internationalization standards.

[gemini-code-assist]

The use of 'let chains' (if let ... && ...) is an unstable Rust feature (see RFC 2497). Unless this repository explicitly requires a nightly toolchain via a rust-toolchain.toml file, this will cause compilation errors on stable Rust. Please refactor these to use nested if let statements or matches!. This pattern also appears on lines 1582, 1633, and 5590.

[gemini-code-assist]

These follow-up messages and status labels are hardcoded in English. To maintain consistency with the project's internationalization (i18n) standards, these strings should be moved to MessageId in crates/tui/src/localization.rs and retrieved using the tr() function. This applies to several new user-facing strings in this file, including:

• Phase labels (lines 1654-1657)
• System messages (lines 5532, 5566, 5601)
• Tool blocking status (line 1976)

[gemini-code-assist]

The plan option labels and descriptions are hardcoded English strings. These should be localized using the established MessageId and tr() pattern to ensure they are translated correctly for users in different locales.

[dumbjack]

Addressed the current review pass in e915c79/e5efe93:

• Refactored the new ProPlan let-chain sites in tui.rs into nested control flow to avoid toolchain/reviewer ambiguity.
• Routed the Plan Confirmation modal through the existing localization registry and added translations for shipped locales.
• Localized the ProPlan phase status labels. The queued follow-up strings remain English intentionally because they are model-steering instructions with exact <pro_plan ...> control tags, not user-facing UI chrome.
• Merged latest origin/main and resolved the ui.rs approval conflict while preserving ProPlan read-only turn blocking.

Local validation:

• cargo fmt
• cargo check -p deepseek-tui
• cargo test -p deepseek-tui localization --quiet
• cargo test -p deepseek-tui plan_prompt --quiet
• cargo test -p deepseek-tui pro_plan --quiet
• cargo test -p deepseek-tui --quiet

[dumbjack]

Polished this for reviewability in 872691c:

• Removed the unlinked benchmark/eval notes from the PR diff, reducing the review surface by 400+ lines while keeping the user-facing Pro Plan docs.
• Reworded Pro Plan docs/comments to describe the feature neutrally as plan/execute/review routing.
• Made Pro Plan model display show the currently routed model (pro-plan: deepseek-v4-pro / pro-plan: deepseek-v4-flash).
• Added a regression test proving Pro Plan temporarily disables auto-model routing and restores the prior auto-model state on exit.
• Re-ran cargo fmt, cargo check -p deepseek-tui, cargo test -p deepseek-tui pro_plan --quiet, and cargo test -p deepseek-tui --quiet.

The PR is now marked ready for review.