@addozhang/dsh-discord 0.2.0 → 0.2.2

package/README.md

@@ -17,6 +17,7 @@ This is a function/namespace plugin (`inject: ['apiProxy', 'credentials', 'setti
 - **Stream rendering** — typing indicators, a single edited head message, per-tool activity rows, fenced long-answer splitting, one-time finalize; the activity message is deleted when the turn ends.
 - **Approvals & questions** — DSH ask frames become Discord buttons, select menus, and a free-text modal; ownership is enforced (the asker — or the thread owner on later turns — clicks), expiry sweeps fail closed, and remote resolution retires the controls.
 - **Session control** — `/steer`, `/stop`, `/queue list|remove` with turn-ownership checks; `/project bind|list|info` for guild↔workspace binding; `/guild forget` for operator cleanup.
+- **Model selection** — `/model show` reads the session's live model directory (current selection, routability, catalog groups); `/model select` walks an interactive provider → model → reasoning cascade (any authorized member by default; restrictable to Host operators), or applies a typed `provider/model` directly.
 - **Settings card** — token onboarding (paste + Connect; stored in the Host credential service, never in settings or logs), connect/disconnect, guild allowlist, thread auto-archive, and bot language.
 - **Bilingual copy** — every Discord-visible string ships in Chinese and English; the bot language defaults to following the DSH language preference and can be pinned from the card.
 - **Hardened by design** — deny-first authorization inside an explicit guild allowlist, mention suppression via `allowed_mentions` plus byte-level neutralization on every wire body, at-most-once DSH submission with unknown-preserving reconciliation, durable bindings that survive restarts, and a READY sweep that rebuilds the deleted category/control channel while treating a deleted workspace channel as user intent (the mapping retires; the workspace stays bindable).
@@ -61,9 +62,10 @@ All keys live in the `dsh-discord` settings namespace and can be set either from
 | `enabled` | `false` | Adapter master switch; the card's Connect starts it once a token is stored. |
 | `allowedGuildIds` | `[]` | Guild allowlist. Anything outside is ignored with zero adapter or DSH calls. |
 | `memberUserIds` / `memberRoleIds` | `[]` | Member-level authorization inside an allowed guild. |
-| `administratorUserIds` / `administratorRoleIds` | `[]` | Workspace-administrator level (`/project bind`, preset changes). |
+| `administratorUserIds` / `administratorRoleIds` | `[]` | Workspace-administrator level (`/project bind`). |
 | `deniedUserIds` / `deniedRoleIds` | `[]` | Deny entries; they win over every grant above. |
-| `hostOperatorUserIds` | `[]` | Host operators (`/guild forget`). |
+| `hostOperatorUserIds` | `[]` | Host operators (`/guild forget`; `/model select` when `modelSelectOperatorOnly` is enabled). |
+| `modelSelectOperatorOnly` | `false` | Restrict `/model select` to Host operators (`settings.yaml` only; the card does not expose it). Default `false`: any authorized member may switch, and the switch still updates the Host default. |
 | `defaultVerbosity` | `essential-tools` | Tool-activity row granularity: `text-only`, `essential-tools`, or `full-tools`. |
 | `language` | `auto` | Bot-visible copy language: `auto` follows the DSH language preference (non-Chinese renders English), or pin `zh`/`en`. |
 | `streamUpdateIntervalMs` | `800` | Coalescing budget for stream edits (250–10000). |
@@ -86,7 +88,8 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 2. Boot the profile and open the web UI.
 3. In **Settings → Discord**, paste the bot token (Developer Portal → your application → Bot → Reset Token) and press **Connect**. The token is stored by the Host credential service — never in settings, logs, or the client.
 4. Fill in **Allowed servers** (server IDs via Discord's Developer Mode → right-click a server → Copy Server ID). Everything outside this allowlist is ignored.
-5. Pick the bot language and mention the bot in a bound channel to start a session.
+5. `/model select` works for any authorized member by default (single-user deployments). To restrict it to Host operators, add their IDs under `hostOperatorUserIds` and set `modelSelectOperatorOnly: true` in `settings.yaml`. `/guild forget` always requires a Host operator.
+6. Pick the bot language and mention the bot in a bound channel to start a session.
 
 ## Commands
 
@@ -96,10 +99,9 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 | `/project list` / `info` | any channel | list workspaces / inspect this channel's binding |
 | `/queue list`, `/queue remove` | session thread | inspect and trim the pending queue |
 | `/steer`, `/stop` | session thread | steer or cancel the running turn (owner only) |
+| `/model show` / `select` | session thread | show the live model directory; `select` without arguments walks the interactive provider → model → reasoning cascade (any authorized member by default) |
 | `/guild forget` | any channel | operator-only removal of adapter records |
 
-`/model` remains registered ahead of its interactive provider → model → thinking/reasoning cascade (next milestone); `/preset`, `/skill`, and `/host` are deregistered until the router wires them — see Known limitations.
-
 ## Design notes
 
 - The settings card is the first-run onboarding surface: the token entry writes the credential service's `DSH_DISCORD_BOT_TOKEN` ref over the plugin management channel, then triggers the start chain. Disconnect keeps the credential; an empty reconnect uses it.
@@ -112,7 +114,7 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 ## Known Limitations and Deferred Work
 
 - **`/session new|resume` is not registered** — the selector and cold-adoption modules are implemented and unit-tested, but the Host RPC face cannot back them yet (`sessions.list` v1 returns bare ids; no `session.inspect`). They return with the next milestone.
-- **`/model` is registered but not routed yet** — its control module (model catalog with guarded selection) is implemented and unit-tested; the interactive provider → model → thinking/reasoning cascade lands with the router-wiring milestone. `/preset`, `/skill`, and `/host` stay deregistered until the same pass wires them (the `/preset` thread-context guard rides along).
+- **`/preset`, `/skill`, and `/host` stay deregistered** — their control modules are implemented and unit-tested and return when the router wires them (the `/preset` thread-context guard rides along).
 - **Verbosity is a single global setting** (the DSH ecosystem has per-channel precedent).
 - **Deferred after a Kimaki parity pass**: reconcile-interactions wiring, typing pause during ask waits, fail-closed binding/session-owner store wiring, and credential-rotation watching.
 - **Known tension**: the 250ms minimum stream-edit interval against Discord's edit budget under heavy load (429s self-heal), and typing has no duration-capped watchdog.
@@ -121,7 +123,7 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 
 ```sh
 pnpm install --ignore-scripts
-pnpm test          # 642 tests incl. gateway/REST twin E2E
+pnpm test          # 650 tests incl. gateway/REST twin E2E
 pnpm typecheck
 pnpm lint
 pnpm build         # lib + client bundle

package/README.zh.md

@@ -17,6 +17,7 @@
 - **流式渲染** — typing 指示、单条头消息编辑、逐工具活动行、代码围栏感知的长文分段、一次性收尾；Turn 结束时活动消息会被删除。
 - **审批与提问** — DSH ask 帧渲染为 Discord 按钮、下拉菜单与自由文本弹窗；所有权强制校验（提问者——或后续 Turn 的线程属主——才能点击），超时清扫 fail-closed，远端决议自动退役控件。
 - **会话控制** — `/steer`、`/stop`、`/queue list|remove` 带运行所有权校验；`/project bind|list|info` 管理 Guild↔工作区绑定；`/guild forget` 供操作员清理。
+- **模型切换** — `/model show` 读取会话的实时模型目录（当前选择、可服务状态、目录分组）；`/model select` 走交互式 provider → 模型 → 推理强度级联（默认对所有授权成员开放，可通过设置收紧为仅 Host 操作员），也可直接填写 `provider/model` 应用。
 - **设置卡片** — Token 引导（粘贴 + 连接；存入 Host 凭据服务，绝不写入设置或日志）、连接/断开、服务器白名单、线程自动归档、Bot 语言。
 - **双语文案** — 所有 Discord 可见文案提供中英双语；Bot 语言默认跟随 DSH 语言偏好，也可从卡片固定。
 - **安全设计** — 显式服务器白名单内的 deny-first 授权、每条 wire 请求携带 `allowed_mentions` 并做字节级提及中和、至多一次的 DSH 提交与保留 unknown 的对账、重启后持久的绑定，以及 READY 扫描：被删的 category/控制频道会重建，被删的工作区频道视为用户意图（解除映射，workspace 保持可重新绑定）。
@@ -61,9 +62,10 @@ dsh plugin --profile web rm @addozhang/dsh-discord   # 卸载；先执行 /guild
 | `enabled` | `false` | 适配器总开关；卡片 Connect 在 Token 存入后启动。 |
 | `allowedGuildIds` | `[]` | 服务器白名单。白名单之外零响应、零 DSH 调用。 |
 | `memberUserIds` / `memberRoleIds` | `[]` | 白名单 Guild 内的成员级授权。 |
-| `administratorUserIds` / `administratorRoleIds` | `[]` | 工作区管理员级（`/project bind`、预设修改）。 |
+| `administratorUserIds` / `administratorRoleIds` | `[]` | 工作区管理员级（`/project bind`）。 |
 | `deniedUserIds` / `deniedRoleIds` | `[]` | 拒绝名单；优先级高于上述一切授权。 |
-| `hostOperatorUserIds` | `[]` | Host 操作员（`/guild forget`）。 |
+| `hostOperatorUserIds` | `[]` | Host 操作员（`/guild forget`；启用 `modelSelectOperatorOnly` 后也包括 `/model select`）。 |
+| `modelSelectOperatorOnly` | `false` | 将 `/model select` 限制为 Host 操作员（仅 `settings.yaml`，卡片不展示）。默认 `false`：任何授权成员均可切换，且切换仍会更新 Host 默认。 |
 | `defaultVerbosity` | `essential-tools` | 工具活动行粒度：`text-only`、`essential-tools`、`full-tools`。 |
 | `language` | `auto` | Bot 可见文案语言：`auto` 跟随 DSH 语言偏好（非中文渲染英文），或固定 `zh`/`en`。 |
 | `streamUpdateIntervalMs` | `800` | 流式编辑合并间隔（250–10000）。 |
@@ -86,7 +88,8 @@ dsh-discord:
 2. 启动 profile 并打开 Web 界面。
 3. 在 **Settings → Discord** 中粘贴 Bot Token（开发者门户 → 你的应用 → Bot → Reset Token）并点击 **Connect**。Token 由 Host 凭据服务保存——绝不写入设置、日志或客户端。
 4. 填写 **允许的服务器**（服务器 ID 获取方式：Discord 开发者模式 → 右键服务器 → 复制服务器 ID）。白名单之外的一切都会被忽略。
-5. 选择 Bot 语言，然后在已绑定的频道 @机器人 开始会话。
+5. `/model select` 默认对任何授权成员开放（单人自用部署）。如需限制为 Host 操作员：在 `hostOperatorUserIds` 中加入其用户 ID，并把 `modelSelectOperatorOnly` 设为 `true`（`settings.yaml`）。`/guild forget` 始终需要 Host 操作员。
+6. 选择 Bot 语言，然后在已绑定的频道 @机器人 开始会话。
 
 ## 命令
 
@@ -96,9 +99,9 @@ dsh-discord:
 | `/project list` / `info` | 任意频道 | 列出工作区 / 查看当前频道绑定 |
 | `/queue list`, `/queue remove` | 会话线程 | 查看与移除待处理队列 |
 | `/steer`, `/stop` | 会话线程 | 插话或取消运行中的 Turn（仅属主） |
+| `/model show` / `select` | 会话线程 | 查看实时模型目录；`select` 不带参数时走交互式 provider → 模型 → 推理强度级联（默认对所有授权成员开放） |
 | `/guild forget` | 任意频道 | 仅操作员：移除适配器记录 |
 
-`/model` 保持注册，等待其交互式 provider → 模型 → thinking/reasoning 级联（下个里程碑）；`/preset`、`/skill`、`/host` 已取消注册，待路由接线后回归——见已知限制。
 
 ## 设计说明
 
@@ -112,7 +115,7 @@ dsh-discord:
 ## 已知限制与推迟项
 
 - **`/session new|resume` 未注册** — 选择器与冷收养模块已实现并通过单元测试，但 Host RPC 面尚不支持（`sessions.list` v1 只返回裸 id；缺少 `session.inspect`）。将在下个里程碑回归。
-- **`/model` 已注册但尚未接线** — 其控制模块（模型目录与受控选择）已实现并通过单元测试；交互式 provider → 模型 → thinking/reasoning 级联将随路由接线里程碑落地。`/preset`、`/skill`、`/host` 保持注销状态，同一次接线时回归（`/preset` 的会话线程守卫一并处理）。
+- **`/preset`、`/skill`、`/host` 保持注销状态** — 控制模块已实现并通过单元测试，待路由接线时回归（`/preset` 的会话线程守卫一并处理）。
 - **verbosity 为全局设置**（DSH 生态有按频道设置的先例）。
 - **经 Kimaki 对齐后有意推迟**：reconcile-interactions 接线、ask 等待期暂停 typing、fail-closed 绑定/会话属主 store 接线、凭据轮换监听。
 - **已知张力**：流式编辑 250ms 下限与高负载下 Discord 编辑预算的冲突（429 自愈），以及 typing 缺少时长上限看门狗。
@@ -121,7 +124,7 @@ dsh-discord:
 
 ```sh
 pnpm install --ignore-scripts
-pnpm test          # 642 tests incl. gateway/REST twin E2E
+pnpm test          # 650 tests incl. gateway/REST twin E2E
 pnpm typecheck
 pnpm lint
 pnpm build         # lib + client bundle

package/lib/client/slot-contract.d.ts

@@ -16,6 +16,8 @@ interface DiscordPluginsLocale {
     discordDescription: string;
     discordAllowedGuildIds: string;
     discordGuildIdHelp: string;
+    discordHostOperators: string;
+    discordHostOperatorsHelp: string;
     discordLanguageAuto: string;
     discordTokenLabel: string;
     discordTokenPlaceholder: string;
@@ -30,6 +32,8 @@ interface DiscordPluginsLocale {
     discordLanguage: string;
     discordLanguageHint: string;
     discordInvalidLanguage: string;
+    discordModelOperatorOnly: string;
+    discordModelOperatorOnlyHint: string;
     discordInvalidIds: string;
     discordInvalidArchive: string;
     discordStatusConnected: string;

package/lib/client.js

@@ -951,7 +951,7 @@ var DiscordCardForm = class {
     const value = section?.[field];
     if (Array.isArray(value)) return value.join("\n");
     if (typeof value === "string") return value;
-    if (typeof value === "number") return String(value);
+    if (typeof value === "boolean" || typeof value === "number") return String(value);
     return "";
   }
   snapshot() {

package/lib/discord/commands.js

@@ -31,7 +31,9 @@ export const MILESTONE_ONE_COMMANDS = [
     leaf('stop', 'Cancel the running turn of this thread'),
     grouped('model', 'Show or select the session model', [
         { name: 'show' },
-        { name: 'select', options: [{ name: 'model', required: true }, { name: 'reasoning', required: false }] },
+        // select without a typed model opens the interactive provider → model
+        // → reasoning cascade (16.35); typing `provider/model` applies directly.
+        { name: 'select', options: [{ name: 'model', required: false }, { name: 'reasoning', required: false }] },
     ]),
     grouped('guild', 'Guild-scoped adapter operations', [
         { name: 'forget' },

package/lib/dsh/api-proxy-face.d.ts

@@ -66,8 +66,61 @@ export interface DshApiProxyFace {
                 sessionId: string;
             }>;
         }>>;
+        models(request: RpcRequestShape<{
+            sessionId: string;
+        }>): Promise<RpcResponseShape<SessionModelsShape>>;
+        selectModel(request: RpcRequestShape<{
+            sessionId: string;
+            provider: string;
+            model: string;
+            reasoningEffort?: string;
+        }>): Promise<RpcResponseShape<{
+            selected: ModelSelectionShape;
+        }>>;
     };
 }
+/** One reasoning effort a model's adapter advertises (sessions.d.ts). */
+import type { DshModelPort } from '../features/model-control.js';
+export interface ModelReasoningEffortShape {
+    id: string;
+    name: string;
+    description?: string;
+}
+/** Exact-route reasoning metadata for one catalog model. */
+export interface ModelReasoningShape {
+    efforts: ModelReasoningEffortShape[];
+    defaultEffort?: string;
+}
+/** One model inside a provider group (sessions.d.ts ModelCatalogModel). */
+export interface ModelCatalogModelShape {
+    id: string;
+    name: string;
+    description?: string;
+    reasoning?: ModelReasoningShape;
+}
+/** One provider group and its models (sessions.d.ts ModelProviderGroup). */
+export interface ModelProviderGroupShape {
+    id: string;
+    name: string;
+    models: ModelCatalogModelShape[];
+}
+/** The detached model directory `session.models` returns for one session. */
+export interface SessionModelsShape {
+    current: ModelSelectionShape;
+    routable: boolean;
+    groups: ModelProviderGroupShape[];
+    failures: Array<{
+        id: string;
+        name: string;
+        message: string;
+    }>;
+}
+/** The complete provider/model/reasoning selection (dsh-agent ModelSelection). */
+export interface ModelSelectionShape {
+    provider: string;
+    model: string;
+    reasoningEffort?: string;
+}
 /** Signature-layer narrow request form (RpcId brand erased at this seam). */
 export interface RpcRequestShape<P> {
     rpcId: string;
@@ -251,3 +304,47 @@ export declare function createClientRespondPort(dsh: {
 }, options?: ApiProxyFaceOptions): {
     respond(rpcId: string, value: unknown): Promise<RespondOutcome>;
 };
+export type SessionModelsOutcome = {
+    outcome: 'completed';
+    models: SessionModelsShape;
+} | {
+    outcome: 'failed';
+} | {
+    outcome: 'unknown';
+};
+/**
+ * The session's detached model directory: the live selection, whether the
+ * current route still serves, and the per-provider catalog groups the
+ * /model cascade browses.
+ */
+export declare function sessionModels(dsh: DshApiProxyFace, request: {
+    sessionId: string;
+}, options?: ApiProxyFaceOptions): Promise<SessionModelsOutcome>;
+export type SelectModelOutcome = {
+    outcome: 'completed';
+    selected: ModelSelectionShape;
+} | {
+    outcome: 'rejected';
+    reason: string;
+} | {
+    outcome: 'unknown';
+};
+/**
+ * Select the complete model selection for one session (session.selectModel):
+ * the session switches immediately and the Host records the choice as the
+ * default for sessions that have not logged their own — the response only
+ * proves the session switch, so callers must not claim the persistence
+ * outcome (design.md §7).
+ */
+export declare function selectSessionModel(dsh: DshApiProxyFace, request: {
+    sessionId: string;
+    provider: string;
+    model: string;
+    reasoningEffort?: string;
+}, options?: ApiProxyFaceOptions): Promise<SelectModelOutcome>;
+/**
+ * The /model surface over the real session RPCs: the per-session live
+ * directory (`session.models`) and the guarded selection mutation
+ * (`session.selectModel`) — the shapes model-control reasons about.
+ */
+export declare function createModelPort(dsh: DshApiProxyFace, options?: ApiProxyFaceOptions): DshModelPort;

package/lib/dsh/api-proxy-face.js

@@ -368,3 +368,82 @@ export function createClientRespondPort(dsh, options = {}) {
         },
     };
 }
+/** Bounded window for the per-session model directory read. */
+const MODELS_TIMEOUT_MS = 10_000;
+/**
+ * The session's detached model directory: the live selection, whether the
+ * current route still serves, and the per-provider catalog groups the
+ * /model cascade browses.
+ */
+export async function sessionModels(dsh, request, options = {}) {
+    const timeoutMs = options.timeoutMs ?? MODELS_TIMEOUT_MS;
+    let response;
+    try {
+        response = await withRpcTimeout(dsh.sessions.models(mintRequest({ sessionId: request.sessionId })), timeoutMs);
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            options.log?.('discord_models_timeout', { sessionId: request.sessionId });
+            return { outcome: 'unknown' };
+        }
+        options.log?.('discord_models_threw', { cause: String(cause), sessionId: request.sessionId });
+        return { outcome: 'unknown' };
+    }
+    const result = response?.result;
+    if (result === undefined || !result.ok) {
+        options.log?.('discord_models_malformed', {
+            sessionId: request.sessionId,
+            code: result?.ok === false ? result.error.code : 'malformed',
+        });
+        return { outcome: 'failed' };
+    }
+    return { outcome: 'completed', models: result.value };
+}
+/**
+ * Select the complete model selection for one session (session.selectModel):
+ * the session switches immediately and the Host records the choice as the
+ * default for sessions that have not logged their own — the response only
+ * proves the session switch, so callers must not claim the persistence
+ * outcome (design.md §7).
+ */
+export async function selectSessionModel(dsh, request, options = {}) {
+    const timeoutMs = options.timeoutMs ?? PROMPT_TIMEOUT_MS;
+    let response;
+    try {
+        response = await withRpcTimeout(dsh.sessions.selectModel(mintRequest({
+            sessionId: request.sessionId,
+            provider: request.provider,
+            model: request.model,
+            ...(request.reasoningEffort === undefined ? {} : { reasoningEffort: request.reasoningEffort }),
+        })), timeoutMs);
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            options.log?.('discord_model_select_timeout', { sessionId: request.sessionId });
+            return { outcome: 'unknown' };
+        }
+        options.log?.('discord_model_select_threw', { cause: String(cause), sessionId: request.sessionId });
+        return { outcome: 'unknown' };
+    }
+    const result = response?.result;
+    if (result === undefined) {
+        options.log?.('discord_model_select_malformed', { sessionId: request.sessionId });
+        return { outcome: 'unknown' };
+    }
+    if (result.ok) {
+        return { outcome: 'completed', selected: result.value.selected };
+    }
+    options.log?.('discord_model_select_rejected', { code: result.error.code, sessionId: request.sessionId });
+    return { outcome: 'rejected', reason: result.error.code };
+}
+/**
+ * The /model surface over the real session RPCs: the per-session live
+ * directory (`session.models`) and the guarded selection mutation
+ * (`session.selectModel`) — the shapes model-control reasons about.
+ */
+export function createModelPort(dsh, options = {}) {
+    return {
+        models: sessionId => sessionModels(dsh, { sessionId }, options),
+        selectModel: request => selectSessionModel(dsh, request, options),
+    };
+}

package/lib/features/ask-wiring.d.ts

@@ -55,6 +55,15 @@ export interface AskWiringDeps {
         reason?: string;
         messageId?: string;
     }>;
+    /**
+     * Edit an already-posted control message (PATCH). Retirement greys the
+     * controls out on the ORIGINAL message — a POST would only add a new,
+     * empty message while the live buttons stayed behind (16.41).
+     */
+    editMessage(channelId: string, messageId: string, payload: unknown): Promise<{
+        stored: boolean;
+        reason?: string;
+    }>;
 }
 export declare function createAskWiring(deps: AskWiringDeps): {
     /** Retire a rendered control (clear components) once the ask is settled. */

package/lib/features/ask-wiring.js

@@ -14,8 +14,16 @@ import { renderQuestionControls } from './question-view.js';
 import { abandonUnrenderableQuestion } from './question-expiry.js';
 import { handleRemoteResolution } from './question-routing.js';
 export function createAskWiring(deps) {
-    /** Discord message refs for rendered controls, keyed by ask id. */
+    /** Discord message refs + rendered rows for controls, keyed by ask id. */
     const controlMessages = new Map();
+    function disabledComponents(components) {
+        if (!Array.isArray(components))
+            return [];
+        return components.map(row => ({
+            ...row,
+            components: (row.components ?? []).map(control => ({ ...control, disabled: true })),
+        }));
+    }
     const disableControl = async (key) => {
         const target = controlMessages.get(key);
         if (target === undefined)
@@ -24,9 +32,11 @@ export function createAskWiring(deps) {
         // Retirement is best-effort: a failed disable must never fail the ask's
         // settled outcome — the registry TTL keeps stray clicks answerable.
         try {
-            const posted = await deps.postMessage(target.channelId, { components: [] });
-            if (!posted.stored)
-                deps.log('discord_control_disable_failed', { key });
+            const patched = await deps.editMessage(target.channelId, target.messageId, {
+                components: disabledComponents(target.components),
+            });
+            if (!patched.stored)
+                deps.log('discord_control_disable_failed', { key, reason: patched.reason });
         }
         catch (cause) {
             deps.log('discord_control_disable_failed', { key, cause: String(cause) });
@@ -77,7 +87,7 @@ export function createAskWiring(deps) {
             void deps.postMessage(input.threadId, payload)
                 .then(sent => {
                 if (sent.stored && sent.messageId !== undefined) {
-                    controlMessages.set(input.approvalId, { channelId: input.threadId, messageId: sent.messageId });
+                    controlMessages.set(input.approvalId, { channelId: input.threadId, messageId: sent.messageId, components: payload.components });
                 }
             })
                 .catch((cause) => { deps.log('discord_approval_render_failed', String(cause)); });
@@ -136,7 +146,7 @@ export function createAskWiring(deps) {
                     abandonQuestion(sent.reason ?? 'post rejected');
                     return;
                 }
-                controlMessages.set(input.rpcId, { channelId: input.threadId, messageId: sent.messageId });
+                controlMessages.set(input.rpcId, { channelId: input.threadId, messageId: sent.messageId, components: payload.components });
             })
                 .catch((cause) => { abandonQuestion(String(cause)); });
         },

package/lib/features/interaction-router.d.ts

@@ -14,6 +14,7 @@ import type { WorkspaceResolver } from './project-bind.js';
 import type { CancelOutcome, PromptOutcome, QueueRemoveOutcome, WorkspaceDetailOutcome } from '../dsh/api-proxy-face.js';
 import type { TurnTracker } from './turn-ownership.js';
 import { type DshApprovalRespondPort } from './approval-routing.js';
+import { type DshModelPort } from './model-control.js';
 import type { QuestionInteractionOutcome } from './question-routing.js';
 import type { ApprovalStore } from './approval-store.js';
 import type { ChannelBinding } from '../state/records.js';
@@ -82,6 +83,13 @@ export interface InteractionRouterDeps {
      * fresh; task 16.37).
      */
     purgeChannelBinding: (guildId: string, channelId: string) => Promise<void>;
+    /** The session's live model directory + selection mutation (/model surface). */
+    model: DshModelPort;
+    /**
+     * Whether /model select stays Host-operator-only (default). Single-user
+     * deployments flip this so any authorized member can switch (16.42).
+     */
+    modelSelectOperatorOnly: () => boolean;
     log: (event: string, detail?: unknown) => void;
     warn: (event: string, detail?: unknown) => void;
 }

package/lib/features/interaction-router.js

@@ -13,6 +13,33 @@ import { projectInfo } from './project-info.js';
 import { planSteer } from './steer-control.js';
 import { planStop } from './stop-control.js';
 import { handleApprovalClick } from './approval-routing.js';
+import { applyModelSelection } from './model-control.js';
+/** Discord interactive-component id for string select menus. */
+const SELECT_MENU = 3;
+/** `provider/model` — or `provider/model (effort)` when an effort is set. */
+function modelSelectionLabel(selection) {
+    return selection.reasoningEffort === undefined
+        ? `${selection.provider}/${selection.model}`
+        : `${selection.provider}/${selection.model} (${selection.reasoningEffort})`;
+}
+function selectMenuRow(customId, placeholder, options) {
+    return [{
+            type: 1,
+            components: [{ type: SELECT_MENU, custom_id: customId, placeholder, options, max_values: 1 }],
+        }];
+}
+/** The ephemeral outcome line for a /model selection attempt. */
+function renderModelApply(copy, result) {
+    switch (result.outcome) {
+        case 'applied': return copy.modelApplied(modelSelectionLabel(result.selected));
+        case 'rejected': return copy.modelSelectRejected(result.reason);
+        case 'unknown': return copy.modelSelectUnknown;
+        case 'refused':
+            return result.reason === 'not-host-operator' ? copy.modelSelectOperatorOnly
+                : result.reason === 'invalid-reasoning-effort' ? copy.modelInvalidReasoning
+                    : copy.modelNotInCatalog;
+    }
+}
 export function createInteractionRouter(deps) {
     /** Authorize one interaction against the live policy table. */
     function authorize(event) {
@@ -368,6 +395,94 @@ export function createInteractionRouter(deps) {
                     }]);
                 return;
             }
+            if (event.commandName === 'model') {
+                const options = event.data['options'];
+                const subcommand = Array.isArray(options) ? options[0] : undefined;
+                const subName = subcommand?.name;
+                const sessionId = deps.sessionForThread(event.guildId, event.channelId);
+                if (sessionId === undefined) {
+                    await followUp(deps.copy.modelNeedsThread);
+                    return;
+                }
+                if (subName === 'select') {
+                    // Host-operator authority by default: the switch reaches the
+                    // Host-wide default selection (design.md §7). A deployment may
+                    // relax it for single-user use (16.42).
+                    const requireOperator = deps.modelSelectOperatorOnly();
+                    const decision = authorize(event);
+                    if (!decision.allowed || (requireOperator && decision.level !== 'host-operator')) {
+                        await followUp(deps.copy.modelSelectOperatorOnly);
+                        return;
+                    }
+                    const wireOptions = Array.isArray(subcommand?.options) ? subcommand.options : [];
+                    const typedModel = wireOptions.find(option => option.name === 'model')?.value;
+                    const typedReasoning = wireOptions.find(option => option.name === 'reasoning')?.value;
+                    if (typeof typedModel === 'string' && typedModel !== '') {
+                        // Typed form: `provider/model` plus an optional reasoning
+                        // effort, validated against the live catalog before mutation.
+                        const separator = typedModel.indexOf('/');
+                        if (separator <= 0 || separator === typedModel.length - 1) {
+                            await followUp(deps.copy.modelTypedParseFailed);
+                            return;
+                        }
+                        const result = await applyModelSelection(deps.model, {
+                            decision,
+                            sessionId,
+                            provider: typedModel.slice(0, separator),
+                            model: typedModel.slice(separator + 1),
+                            requireHostOperator: requireOperator,
+                            ...(typeof typedReasoning === 'string' && typedReasoning !== '' ? { reasoningEffort: typedReasoning } : {}),
+                        });
+                        await followUp(renderModelApply(deps.copy, result));
+                        return;
+                    }
+                    // Interactive cascade, stage 1: the provider.
+                    const directory = await deps.model.models(sessionId);
+                    if (directory.outcome !== 'completed') {
+                        await followUp(deps.copy.modelShowUnavailable);
+                        return;
+                    }
+                    if (directory.models.groups.length === 0) {
+                        await followUp(deps.copy.modelSelectNoModels);
+                        return;
+                    }
+                    const failures = directory.models.failures.length > 0
+                        ? deps.copy.modelShowFailures(directory.models.failures.map(failure => failure.name).join(', '))
+                        : '';
+                    const truncated = directory.models.groups.length > 25
+                        ? deps.copy.modelCascadeTruncated(25, directory.models.groups.length)
+                        : '';
+                    const menuId = deps.registry.register({ kind: 'model', stage: 'provider', sessionId, expiresAtMs: Date.now() + 15 * 60 * 1000 });
+                    await followUp(deps.copy.modelCascadeProviderHeader(modelSelectionLabel(directory.models.current), `${failures}${truncated}`), selectMenuRow(menuId, deps.copy.modelCascadeProviderPlaceholder, directory.models.groups.slice(0, 25).map(group => ({
+                        label: group.name,
+                        value: group.id,
+                        description: `${String(group.models.length)} models`,
+                    }))));
+                    return;
+                }
+                // show (default): the member-readable live model directory.
+                const directory = await deps.model.models(sessionId);
+                if (directory.outcome !== 'completed') {
+                    await followUp(deps.copy.modelShowUnavailable);
+                    return;
+                }
+                const current = directory.models.current;
+                const selection = current.reasoningEffort === undefined
+                    ? `${current.provider}/${current.model}`
+                    : `${current.provider}/${current.model} (${current.reasoningEffort})`;
+                let content = deps.copy.modelShowHeader(selection, directory.models.groups.length);
+                if (current.reasoningEffort !== undefined)
+                    content += deps.copy.modelShowReasoning(current.reasoningEffort);
+                if (!directory.models.routable)
+                    content += deps.copy.modelShowNotRoutable;
+                if (directory.models.groups.length === 0)
+                    content += deps.copy.modelShowNoGroups;
+                if (directory.models.failures.length > 0) {
+                    content += deps.copy.modelShowFailures(directory.models.failures.map(failure => failure.name).join(', '));
+                }
+                await followUp(content);
+                return;
+            }
             // Terminal guard: a recognized interaction type with an unhandled
             // command name must still answer, never strand on the deferred ack.
             await followUp(deps.copy.unknownSubcommand);
@@ -476,6 +591,136 @@ export function createInteractionRouter(deps) {
         if (posted.outcome !== 'completed')
             deps.log('discord_followup_failed', posted.outcome);
     }
+    /** One cascade stage: ack, re-authorize, then advance or apply (16.35). */
+    async function routeModelComponent(event, interactionToken) {
+        const customId = event.data['custom_id'];
+        if (typeof customId !== 'string')
+            return;
+        const resolved = deps.registry.resolve(customId, Date.now());
+        const context = resolved.found ? resolved.context : undefined;
+        const rest = await deps.rest();
+        if (rest === undefined)
+            return;
+        // Ack BEFORE the catalog reads and the DSH round trip: component
+        // interactions must receive an initial response within 3s.
+        const acked = await rest.request('POST', `/interactions/${event.interactionId}/${interactionToken}/callback`, { type: 6 });
+        if (acked.outcome !== 'completed')
+            deps.log('discord_ack_failed', acked.outcome);
+        const followUp = async (content, components) => {
+            const posted = await rest.request('POST', `/webhooks/${deps.applicationId()}/${interactionToken}`, {
+                content,
+                flags: OUTBOUND_EPHEMERAL_FLAGS,
+                ...(components === undefined ? {} : { components }),
+            });
+            if (posted.outcome !== 'completed') {
+                deps.log('discord_followup_failed', posted.outcome === 'rejected' ? `HTTP ${String(posted.status)}` : posted.reason);
+            }
+        };
+        if (context === undefined) {
+            await followUp(deps.copy.modelCascadeExpired);
+            return;
+        }
+        // Every stage re-checks Host-operator authority: a forwarded menu must
+        // not let another member drive — or enumerate — the selection surface.
+        const requireOperator = deps.modelSelectOperatorOnly();
+        const decision = authorize(event);
+        if (!decision.allowed || (requireOperator && decision.level !== 'host-operator')) {
+            await followUp(deps.copy.modelSelectOperatorOnly);
+            return;
+        }
+        const sessionId = typeof context['sessionId'] === 'string' ? context['sessionId'] : undefined;
+        const stage = context['stage'];
+        if (sessionId === undefined || typeof stage !== 'string') {
+            await followUp(deps.copy.modelCascadeExpired);
+            return;
+        }
+        const value = event.selectValues[0];
+        if (typeof value !== 'string' || value === '') {
+            await followUp(deps.copy.modelCascadeExpired);
+            return;
+        }
+        try {
+            if (stage === 'provider') {
+                const directory = await deps.model.models(sessionId);
+                const group = directory.outcome === 'completed'
+                    ? directory.models.groups.find(candidate => candidate.id === value)
+                    : undefined;
+                if (group === undefined || group.models.length === 0) {
+                    await followUp(deps.copy.modelSelectNoModels);
+                    return;
+                }
+                const truncated = group.models.length > 25 ? deps.copy.modelCascadeTruncated(25, group.models.length) : '';
+                const menuId = deps.registry.register({ kind: 'model', stage: 'model', sessionId, provider: group.id, expiresAtMs: Date.now() + 15 * 60 * 1000 });
+                await followUp(deps.copy.modelCascadeModelHeader(group.name) + truncated, selectMenuRow(menuId, deps.copy.modelCascadeModelPlaceholder, group.models.slice(0, 25).map(model => ({
+                    label: model.name !== '' ? model.name : model.id,
+                    value: model.id,
+                    ...(model.description === undefined ? {} : { description: model.description.slice(0, 100) }),
+                }))));
+                return;
+            }
+            if (stage === 'model') {
+                const provider = typeof context['provider'] === 'string' ? context['provider'] : undefined;
+                if (provider === undefined) {
+                    await followUp(deps.copy.modelCascadeExpired);
+                    return;
+                }
+                const directory = await deps.model.models(sessionId);
+                const group = directory.outcome === 'completed'
+                    ? directory.models.groups.find(candidate => candidate.id === provider)
+                    : undefined;
+                const model = group?.models.find(candidate => candidate.id === value);
+                const efforts = model?.reasoning?.efforts ?? [];
+                if (efforts.length === 0) {
+                    // No reasoning metadata: apply with the provider/default behavior.
+                    const result = await applyModelSelection(deps.model, { decision, sessionId, provider, model: value, requireHostOperator: requireOperator });
+                    await followUp(renderModelApply(deps.copy, result));
+                    return;
+                }
+                const menuId = deps.registry.register({ kind: 'model', stage: 'reasoning', sessionId, provider, model: value, expiresAtMs: Date.now() + 15 * 60 * 1000 });
+                const defaultEffort = model?.reasoning?.defaultEffort;
+                const options = [
+                    {
+                        label: deps.copy.modelCascadeReasoningDefault,
+                        value: '__default__',
+                        description: (defaultEffort === undefined
+                            ? deps.copy.modelCascadeReasoningDefaultHint
+                            : `${deps.copy.modelCascadeReasoningDefaultHint} (${defaultEffort})`).slice(0, 100),
+                    },
+                    ...efforts.slice(0, 24).map(effort => ({
+                        label: effort.name,
+                        value: effort.id,
+                        ...(effort.description === undefined ? {} : { description: effort.description.slice(0, 100) }),
+                    })),
+                ];
+                const modelLabel = model?.name !== undefined && model.name !== '' ? model.name : value;
+                await followUp(deps.copy.modelCascadeReasoningHeader(modelLabel), selectMenuRow(menuId, deps.copy.modelCascadeReasoningPlaceholder, options));
+                return;
+            }
+            if (stage === 'reasoning') {
+                const provider = typeof context['provider'] === 'string' ? context['provider'] : undefined;
+                const model = typeof context['model'] === 'string' ? context['model'] : undefined;
+                if (provider === undefined || model === undefined) {
+                    await followUp(deps.copy.modelCascadeExpired);
+                    return;
+                }
+                const result = await applyModelSelection(deps.model, {
+                    decision,
+                    sessionId,
+                    provider,
+                    model,
+                    requireHostOperator: requireOperator,
+                    ...(value === '__default__' ? {} : { reasoningEffort: value }),
+                });
+                await followUp(renderModelApply(deps.copy, result));
+                return;
+            }
+            await followUp(deps.copy.modelCascadeExpired);
+        }
+        catch (cause) {
+            deps.warn('discord_model_cascade_failed', String(cause));
+            await deps.componentFollowUp(event.interactionId, interactionToken, deps.copy.commandFailed).catch(() => { });
+        }
+    }
     async function settleQuestionInteraction(event, interactionToken, outcome) {
         if (outcome.outcome === 'modal-requested') {
             const rest = await deps.rest();
@@ -578,6 +823,10 @@ export function createInteractionRouter(deps) {
                 await routeGuildForGetComponent(event, interactionToken);
                 return;
             }
+            if (bindContext?.['kind'] === 'model') {
+                await routeModelComponent(event, interactionToken);
+                return;
+            }
             // A not-found custom_id means the control was never registered or has
             // been retired by its TTL (approval/question registry entries stay
             // resolvable until expiry; claimed-vs-resolved state lives in the

package/lib/features/model-control.d.ts

@@ -1,24 +1,21 @@
 /**
  * `/model show` and the guarded `/model select` (design.md §7, tasks 10.2 +
- * 10.3). A successful `session.selectModel` changes the addressed session AND
- * attempts to persist that choice as the host default for future sessions, so
- * mutation is restricted to the explicit global Host-operator allowlist —
- * Guild-local administrators are denied. The confirmation states BOTH facts
- * and nothing more: `applied-with-host-default`, `partial-session-only` (the
- * session changed but persistence did not land), or a plain rejection/unknown.
- * Catalog and reasoning-effort validation happen before any DSH call.
+ * 10.3 + 16.35). Selection goes through `session.selectModel`: the session
+ * switches immediately and the Host records the choice as the default for
+ * sessions that have not logged their own — the RPC response only proves the
+ * session switch, so the confirmation states the session change and the
+ * default request, never a persistence outcome. Because the switch reaches
+ * the Host-wide default, mutation is restricted to the explicit global
+ * Host-operator allowlist — Guild-local administrators are denied. Provider/
+ * model/reasoning validation runs against the session's live catalog before
+ * any mutation.
  */
 import type { AccessDecision } from '../policy/authorization.js';
+import type { ModelSelectionShape, SessionModelsShape } from '../dsh/api-proxy-face.js';
 export interface DshModelPort {
-    catalog(): Promise<{
+    models(sessionId: string): Promise<{
         outcome: 'completed';
-        providers: ReadonlyArray<{
-            provider: string;
-            models: ReadonlyArray<{
-                id: string;
-                reasonings: readonly string[];
-            }>;
-        }>;
+        models: SessionModelsShape;
     } | {
         outcome: 'failed';
     } | {
@@ -26,12 +23,12 @@ export interface DshModelPort {
     }>;
     selectModel(request: {
         sessionId: string;
-        modelId: string;
-        reasoning?: string;
+        provider: string;
+        model: string;
+        reasoningEffort?: string;
     }): Promise<{
         outcome: 'completed';
-        sessionApplied: boolean;
-        defaultPersisted: boolean;
+        selected: ModelSelectionShape;
     } | {
         outcome: 'rejected';
         reason: string;
@@ -39,41 +36,40 @@ export interface DshModelPort {
         outcome: 'unknown';
     }>;
 }
-export type ModelCatalogView = {
-    outcome: 'ok';
-    providers: ReadonlyArray<{
-        provider: string;
-        models: ReadonlyArray<{
-            id: string;
-            reasonings: readonly string[];
-        }>;
-    }>;
+export type ModelsView = {
+    outcome: 'completed';
+    models: SessionModelsShape;
 } | {
     outcome: 'failed';
-    reason: 'model-catalog-unavailable' | 'model-catalog-unknown';
+} | {
+    outcome: 'unknown';
 };
-export declare function showModelCatalog(port: DshModelPort, _request: {
+/** `/model show`: the session's live model directory (current + browsable groups). */
+export declare function showModels(port: DshModelPort, request: {
     sessionId: string;
-}): Promise<ModelCatalogView>;
-export type ModelSelectResult = {
-    outcome: 'applied-with-host-default';
-    sessionApplied: boolean;
-    defaultPersisted: boolean;
-} | {
-    outcome: 'partial-session-only';
-    sessionApplied: boolean;
-    defaultPersisted: boolean;
+}): Promise<ModelsView>;
+export type ModelApplyResult = {
+    outcome: 'applied';
+    selected: ModelSelectionShape;
 } | {
     outcome: 'rejected';
+    reason: string;
 } | {
     outcome: 'unknown';
 } | {
     outcome: 'refused';
     reason: 'not-host-operator' | 'model-not-in-catalog' | 'invalid-reasoning-effort';
 };
-export declare function selectModel(port: DshModelPort, request: {
+export declare function applyModelSelection(port: DshModelPort, request: {
     decision: AccessDecision;
     sessionId: string;
-    modelId: string;
-    reasoning?: string | undefined;
-}): Promise<ModelSelectResult>;
+    provider: string;
+    model: string;
+    reasoningEffort?: string | undefined;
+    /**
+     * Keep the Host-operator restriction (default). Single-user deployments
+     * may drop it so any authorized member of the allowlisted guild can
+     * switch — the switch still reaches the Host-wide default (16.42).
+     */
+    requireHostOperator?: boolean | undefined;
+}): Promise<ModelApplyResult>;

package/lib/features/model-control.js

@@ -1,51 +1,57 @@
 /**
  * `/model show` and the guarded `/model select` (design.md §7, tasks 10.2 +
- * 10.3). A successful `session.selectModel` changes the addressed session AND
- * attempts to persist that choice as the host default for future sessions, so
- * mutation is restricted to the explicit global Host-operator allowlist —
- * Guild-local administrators are denied. The confirmation states BOTH facts
- * and nothing more: `applied-with-host-default`, `partial-session-only` (the
- * session changed but persistence did not land), or a plain rejection/unknown.
- * Catalog and reasoning-effort validation happen before any DSH call.
+ * 10.3 + 16.35). Selection goes through `session.selectModel`: the session
+ * switches immediately and the Host records the choice as the default for
+ * sessions that have not logged their own — the RPC response only proves the
+ * session switch, so the confirmation states the session change and the
+ * default request, never a persistence outcome. Because the switch reaches
+ * the Host-wide default, mutation is restricted to the explicit global
+ * Host-operator allowlist — Guild-local administrators are denied. Provider/
+ * model/reasoning validation runs against the session's live catalog before
+ * any mutation.
  */
-export async function showModelCatalog(port, _request) {
-    const catalog = await port.catalog();
-    if (catalog.outcome === 'failed')
-        return { outcome: 'failed', reason: 'model-catalog-unavailable' };
-    if (catalog.outcome === 'unknown')
-        return { outcome: 'failed', reason: 'model-catalog-unknown' };
-    return { outcome: 'ok', providers: catalog.providers };
+/** `/model show`: the session's live model directory (current + browsable groups). */
+export async function showModels(port, request) {
+    return port.models(request.sessionId);
 }
-export async function selectModel(port, request) {
-    // Host-operator authority ONLY: a Guild administrator is not enough,
-    // because the selection attempts to persist a host-wide default.
-    if (!request.decision.allowed || request.decision.level !== 'host-operator') {
+export async function applyModelSelection(port, request) {
+    const requireOperator = request.requireHostOperator ?? true;
+    if (requireOperator) {
+        // Host-operator authority ONLY: a Guild administrator is not enough,
+        // because the switch reaches the Host-wide default selection.
+        if (!request.decision.allowed || request.decision.level !== 'host-operator') {
+            return { outcome: 'refused', reason: 'not-host-operator' };
+        }
+    }
+    if (!request.decision.allowed) {
         return { outcome: 'refused', reason: 'not-host-operator' };
     }
-    const catalog = await port.catalog();
-    if (catalog.outcome !== 'completed') {
+    const directory = await port.models(request.sessionId);
+    if (directory.outcome !== 'completed') {
+        return { outcome: 'refused', reason: 'model-not-in-catalog' };
+    }
+    const group = directory.models.groups.find(candidate => candidate.id === request.provider);
+    if (group === undefined) {
         return { outcome: 'refused', reason: 'model-not-in-catalog' };
     }
-    const model = catalog.providers
-        .flatMap(provider => provider.models)
-        .find(candidate => candidate.id === request.modelId);
+    const model = group.models.find(candidate => candidate.id === request.model);
     if (model === undefined) {
         return { outcome: 'refused', reason: 'model-not-in-catalog' };
     }
-    if (request.reasoning !== undefined && !model.reasonings.includes(request.reasoning)) {
-        return { outcome: 'refused', reason: 'invalid-reasoning-effort' };
+    if (request.reasoningEffort !== undefined) {
+        const efforts = model.reasoning?.efforts ?? [];
+        if (!efforts.some(effort => effort.id === request.reasoningEffort)) {
+            return { outcome: 'refused', reason: 'invalid-reasoning-effort' };
+        }
     }
     const selected = await port.selectModel({
         sessionId: request.sessionId,
-        modelId: request.modelId,
-        ...(request.reasoning === undefined ? {} : { reasoning: request.reasoning }),
+        provider: request.provider,
+        model: request.model,
+        ...(request.reasoningEffort === undefined ? {} : { reasoningEffort: request.reasoningEffort }),
     });
     if (selected.outcome !== 'completed') {
-        return selected.outcome === 'rejected' ? { outcome: 'rejected' } : { outcome: 'unknown' };
-    }
-    // State exactly what DSH proved — both facts, never overstated.
-    if (selected.sessionApplied && selected.defaultPersisted) {
-        return { outcome: 'applied-with-host-default', sessionApplied: true, defaultPersisted: true };
+        return selected.outcome === 'rejected' ? { outcome: 'rejected', reason: selected.reason } : { outcome: 'unknown' };
     }
-    return { outcome: 'partial-session-only', sessionApplied: selected.sessionApplied, defaultPersisted: selected.defaultPersisted };
+    return { outcome: 'applied', selected: selected.selected };
 }

package/lib/i18n.d.ts

@@ -84,6 +84,31 @@ declare const zh: {
     unboundNoticeAdministrator: string;
     unboundNoticeMember: string;
     interruptedMarker: string;
+    modelNeedsThread: string;
+    modelShowUnavailable: string;
+    modelShowHeader: (sel: string, groups: number) => string;
+    modelShowReasoning: (effort: string) => string;
+    modelShowNotRoutable: string;
+    modelShowFailures: (names: string) => string;
+    modelShowNoGroups: string;
+    modelSelectOperatorOnly: string;
+    modelSelectNoModels: string;
+    modelCascadeProviderHeader: (current: string, extra: string) => string;
+    modelCascadeProviderPlaceholder: string;
+    modelCascadeModelHeader: (provider: string) => string;
+    modelCascadeModelPlaceholder: string;
+    modelCascadeReasoningHeader: (model: string) => string;
+    modelCascadeReasoningPlaceholder: string;
+    modelCascadeReasoningDefault: string;
+    modelCascadeReasoningDefaultHint: string;
+    modelCascadeTruncated: (shown: number, total: number) => string;
+    modelCascadeExpired: string;
+    modelApplied: (sel: string) => string;
+    modelSelectUnknown: string;
+    modelSelectRejected: (reason: string) => string;
+    modelNotInCatalog: string;
+    modelInvalidReasoning: string;
+    modelTypedParseFailed: string;
     approvalRequired: (label: string) => string;
 };
 export type CopyTable = typeof zh;

package/lib/i18n.js

@@ -92,6 +92,32 @@ const zh = {
     unboundNoticeMember: '💡 此频道未绑定工作区；请工作区管理员运行 `/project bind`。',
     // ── stream renderer ──────────────────────────────────────────────────
     interruptedMarker: '*（已被中断）*',
+    // ── /model show / select ─────────────────────────────────────────────
+    modelNeedsThread: '⚠️ /model 需要在已绑定 Session 的任务线程中使用（先在项目频道 @ 机器人）。',
+    modelShowUnavailable: '⚠️ 模型目录暂时不可用，请稍后重试。',
+    modelShowHeader: (sel, groups) => `**当前模型：** \`${sel}\`\n**可用 provider：** ${String(groups)}`,
+    modelShowReasoning: (effort) => `\n**推理强度：** \`${effort}\``,
+    modelShowNotRoutable: '\n⚠️ 当前 provider 暂时无法服务请求。',
+    modelShowFailures: (names) => `\n⚠️ 目录加载失败的 provider：${names}`,
+    modelShowNoGroups: '\n（当前没有 provider 提供模型）',
+    modelSelectOperatorOnly: '⚠️ 只有 Host 操作员可以切换模型（此操作会切换当前 Session 并更新 Host 默认）。',
+    modelSelectNoModels: '⚠️ 当前没有 provider 提供模型，无法选择。',
+    modelCascadeProviderHeader: (current, extra) => `当前模型：\`${current}\`${extra}\n请选择 provider：`,
+    modelCascadeProviderPlaceholder: '选择 provider',
+    modelCascadeModelHeader: (provider) => `Provider：**${provider}**\n请选择模型：`,
+    modelCascadeModelPlaceholder: '选择模型',
+    modelCascadeReasoningHeader: (model) => `模型：**${model}**\n请选择推理强度：`,
+    modelCascadeReasoningPlaceholder: '选择推理强度',
+    modelCascadeReasoningDefault: '跟随默认',
+    modelCascadeReasoningDefaultHint: '使用 provider/默认推理行为',
+    modelCascadeTruncated: (shown, total) => `（共 ${String(total)} 项，仅显示前 ${String(shown)} 项）`,
+    modelCascadeExpired: '⚠️ 该选择已过期，请重新运行 /model select。',
+    modelApplied: (sel) => `✅ 已应用到当前 Session：\`${sel}\`，并已请求 DSH 记为 Host 默认。`,
+    modelSelectUnknown: '⚠️ 选择结果未知（请求可能未送达），请用 /model show 确认。',
+    modelSelectRejected: (reason) => `⚠️ DSH 拒绝了此次选择：${reason}`,
+    modelNotInCatalog: '⚠️ 该 provider/模型不在当前会话的目录中。',
+    modelInvalidReasoning: '⚠️ 该推理强度对此模型无效。',
+    modelTypedParseFailed: '⚠️ 模型需按 `provider/model` 格式填写，或留空进入交互式选择。',
     // ── approval / question cards ────────────────────────────────────────
     approvalRequired: (label) => `Approval required — ${label}`,
 };
@@ -171,6 +197,32 @@ const en = {
     unboundNoticeAdministrator: '💡 This channel is not bound to a workspace. A workspace administrator can run `/project bind` to create and bind the project channel.',
     unboundNoticeMember: '💡 This channel is not bound to a workspace; ask a workspace administrator to run `/project bind`.',
     interruptedMarker: '*(interrupted)*',
+    // ── /model show / select ─────────────────────────────────────────────
+    modelNeedsThread: '⚠️ /model needs a thread bound to a Session (mention the bot in a project channel first).',
+    modelShowUnavailable: '⚠️ The model catalog is temporarily unavailable; try again later.',
+    modelShowHeader: (sel, groups) => `**Current model:** \`${sel}\`\n**Available providers:** ${String(groups)}`,
+    modelShowReasoning: effort => `\n**Reasoning effort:** \`${effort}\``,
+    modelShowNotRoutable: '\n⚠️ The current provider is not serving requests right now.',
+    modelShowFailures: names => `\n⚠️ Providers failing catalog lookup: ${names}`,
+    modelShowNoGroups: '\n(no providers currently advertise models)',
+    modelSelectOperatorOnly: '⚠️ Only Host operators can switch the model (it switches this Session and updates the Host default).',
+    modelSelectNoModels: '⚠️ No providers currently advertise models; nothing to select.',
+    modelCascadeProviderHeader: (current, extra) => `Current model: \`${current}\`${extra}\nSelect a provider:`,
+    modelCascadeProviderPlaceholder: 'Select a provider',
+    modelCascadeModelHeader: provider => `Provider: **${provider}**\nSelect a model:`,
+    modelCascadeModelPlaceholder: 'Select a model',
+    modelCascadeReasoningHeader: model => `Model: **${model}**\nSelect a reasoning effort:`,
+    modelCascadeReasoningPlaceholder: 'Select a reasoning effort',
+    modelCascadeReasoningDefault: 'Provider default',
+    modelCascadeReasoningDefaultHint: 'Use the provider/default reasoning behavior',
+    modelCascadeTruncated: (shown, total) => `(${String(total)} total, showing the first ${String(shown)})`,
+    modelCascadeExpired: '⚠️ This selection expired; run /model select again.',
+    modelApplied: sel => `✅ Applied to this session: \`${sel}\`. DSH has also been asked to record it as the Host default.`,
+    modelSelectUnknown: '⚠️ The selection outcome is unknown (the request may not have landed); check /model show.',
+    modelSelectRejected: reason => `⚠️ DSH rejected the selection: ${reason}`,
+    modelNotInCatalog: "⚠️ That provider/model is not in this session's catalog.",
+    modelInvalidReasoning: '⚠️ That reasoning effort is not valid for this model.',
+    modelTypedParseFailed: '⚠️ The model must be `provider/model`, or left empty for the interactive cascade.',
     // ── approval / question cards ────────────────────────────────────────
     approvalRequired: label => `Approval required — ${label}`,
 };

package/lib/index.js

@@ -10,7 +10,7 @@ import { createRestThreadPort } from './discord/thread-port.js';
 import { createComponentRegistry } from './discord/components.js';
 import { buildCommandRegistrations } from './discord/commands.js';
 import { startDiscordAdapter } from './compose.js';
-import { createWorkspaceCatalogPort, createWorkspaceResolver, readWorkspaceDetail, promptSession, createSessionViaProxy, cancelSessionViaProxy, steerSession, removeQueueItemViaProxy } from './dsh/api-proxy-face.js';
+import { createModelPort, createWorkspaceCatalogPort, createWorkspaceResolver, readWorkspaceDetail, promptSession, createSessionViaProxy, cancelSessionViaProxy, steerSession, removeQueueItemViaProxy } from './dsh/api-proxy-face.js';
 import { createApprovalStore } from './features/approval-store.js';
 import { createAskWiring } from './features/ask-wiring.js';
 import { sweepExpiredApprovals } from './features/approval-expiry.js';
@@ -225,6 +225,21 @@ export function apply(ctx, config = DEFAULT_DISCORD_SETTINGS) {
                     return { stored: false, reason: `HTTP ${String(sent.status)}: response missing message id` };
                 return { stored: true, messageId: sent.body.id };
             },
+            editMessage: async (channelId, messageId, payload) => {
+                const rest = await sharedRest();
+                if (rest === undefined)
+                    return { stored: false, reason: 'rest unavailable' };
+                const patched = await rest.request('PATCH', `/channels/${channelId}/messages/${messageId}`, payload);
+                if (patched.outcome !== 'completed') {
+                    return {
+                        stored: false,
+                        reason: patched.outcome === 'rejected'
+                            ? `HTTP ${String(patched.status)} ${patched.error.message}`
+                            : patched.reason,
+                    };
+                }
+                return { stored: true };
+            },
         });
         const componentFollowUp = async (_interactionId, interactionToken, content) => {
             const rest = await sharedRest();
@@ -685,6 +700,8 @@ export function apply(ctx, config = DEFAULT_DISCORD_SETTINGS) {
                 await channelTable.delete(bindChannelKey(guildId, channelId));
                 rpcLog('discord_reconcile_channel_retired', { channelId, reason: 'discord-deleted' });
             },
+            model: createModelPort(apiProxy, { log: rpcLog }),
+            modelSelectOperatorOnly: () => current.modelSelectOperatorOnly,
             log: rpcLog,
             warn: (event, detail) => {
                 emitLog(ctx, 'warn', { event, detail: typeof detail === 'string' ? detail : JSON.stringify(detail ?? null) });

package/lib/settings.d.ts

@@ -23,6 +23,13 @@ export interface DiscordSettings {
     questionTimeoutMs: number;
     /** Task-thread auto-archive; Discord supports exactly these four values. */
     threadAutoArchiveMinutes: ThreadAutoArchiveMinutes;
+    /**
+     * Restrict /model select to the explicit Host-operator allowlist (the
+     * switch reaches the Host-wide default). Defaults to false — single-user
+     * deployments let any authorized member switch (16.42); set true to
+     * re-tighten to the operator allowlist.
+     */
+    modelSelectOperatorOnly: boolean;
 }
 /** The archive durations Discord's API accepts (minutes). */
 export type ThreadAutoArchiveMinutes = 60 | 1440 | 4320 | 10080;

package/lib/settings.js

@@ -20,6 +20,7 @@ export const DEFAULT_DISCORD_SETTINGS = Object.freeze({
     approvalTimeoutMs: 10 * 60_000,
     questionTimeoutMs: 30 * 60_000,
     threadAutoArchiveMinutes: 1440,
+    modelSelectOperatorOnly: false,
 });
 const discordIdList = z.array(z.string()).default([]);
 export const DiscordSettingsSchema = z.object({
@@ -41,6 +42,7 @@ export const DiscordSettingsSchema = z.object({
     typingIntervalMs: z.number().step(1).min(1_000).max(30_000).default(7_000),
     approvalTimeoutMs: z.number().step(1).min(30_000).max(86_400_000).default(600_000),
     questionTimeoutMs: z.number().step(1).min(30_000).max(86_400_000).default(1_800_000),
+    modelSelectOperatorOnly: z.boolean().default(false),
 });
 const DISCORD_SNOWFLAKE = /^\d{17,20}$/u;
 const ID_FIELDS = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@addozhang/dsh-discord",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Discord-first adapter for DeepSeek Harness",
   "license": "MIT",
   "type": "module",