@addozhang/dsh-discord 0.2.1 → 0.2.3

package/README.md

@@ -11,12 +11,18 @@ A Discord-first adapter for [DeepSeek Harness](https://github.com/deepseek-ai):
 
 This is a function/namespace plugin (`inject: ['apiProxy', 'credentials', 'settings', 'storageDomain', 'connection']`). It mounts the Discord Gateway, command surface, stream renderer, and the settings card onto a DSH web profile; session state lives in DSH and durable adapter bindings live in the profile's storage domain.
 
+<p align="center">
+  <img src="docs/images/discord-task-lifecycle.jpg" alt="One task lifecycle: the @mention anchors a thread, tool activity rows stream while the answer edits in place, and the final answer lands as Markdown tables" width="720">
+</p>
+
 ## Features
 
 - **Mention-driven sessions** — an authorized `@bot <task>` in a bound channel anchors a thread (the author's message becomes the first post), creates the DSH session, and submits the prompt at most once. Follow-ups inside the thread queue without a mention.
 - **Stream rendering** — typing indicators, a single edited head message, per-tool activity rows, fenced long-answer splitting, one-time finalize; the activity message is deleted when the turn ends.
-- **Approvals & questions** — DSH ask frames become Discord buttons, select menus, and a free-text modal; ownership is enforced (the asker — or the thread owner on later turns — clicks), expiry sweeps fail closed, and remote resolution retires the controls.
+- **Approvals & questions** — DSH ask frames become Discord buttons, select menus, and a free-text modal; ownership is enforced (the asker — or the thread owner on later turns — clicks), expiry sweeps fail closed, and settled controls grey out in place.
+
 - **Session control** — `/steer`, `/stop`, `/queue list|remove` with turn-ownership checks; `/project bind|list|info` for guild↔workspace binding; `/guild forget` for operator cleanup.
+- **Model selection** — `/model show` reads the session's live model directory (current selection, routability, catalog groups); `/model select` walks an interactive provider → model → reasoning cascade (any authorized member by default; restrictable to Host operators), or applies a typed `provider/model` directly.
 - **Settings card** — token onboarding (paste + Connect; stored in the Host credential service, never in settings or logs), connect/disconnect, guild allowlist, thread auto-archive, and bot language.
 - **Bilingual copy** — every Discord-visible string ships in Chinese and English; the bot language defaults to following the DSH language preference and can be pinned from the card.
 - **Hardened by design** — deny-first authorization inside an explicit guild allowlist, mention suppression via `allowed_mentions` plus byte-level neutralization on every wire body, at-most-once DSH submission with unknown-preserving reconciliation, durable bindings that survive restarts, and a READY sweep that rebuilds the deleted category/control channel while treating a deleted workspace channel as user intent (the mapping retires; the workspace stays bindable).
@@ -61,9 +67,10 @@ All keys live in the `dsh-discord` settings namespace and can be set either from
 | `enabled` | `false` | Adapter master switch; the card's Connect starts it once a token is stored. |
 | `allowedGuildIds` | `[]` | Guild allowlist. Anything outside is ignored with zero adapter or DSH calls. |
 | `memberUserIds` / `memberRoleIds` | `[]` | Member-level authorization inside an allowed guild. |
-| `administratorUserIds` / `administratorRoleIds` | `[]` | Workspace-administrator level (`/project bind`, preset changes). |
+| `administratorUserIds` / `administratorRoleIds` | `[]` | Workspace-administrator level (`/project bind`). |
 | `deniedUserIds` / `deniedRoleIds` | `[]` | Deny entries; they win over every grant above. |
-| `hostOperatorUserIds` | `[]` | Host operators (`/guild forget`). |
+| `hostOperatorUserIds` | `[]` | Host operators (`/guild forget`; `/model select` when `modelSelectOperatorOnly` is enabled). |
+| `modelSelectOperatorOnly` | `false` | Restrict `/model select` to Host operators (`settings.yaml` only; the card does not expose it). Default `false`: any authorized member may switch, and the switch still updates the Host default. |
 | `defaultVerbosity` | `essential-tools` | Tool-activity row granularity: `text-only`, `essential-tools`, or `full-tools`. |
 | `language` | `auto` | Bot-visible copy language: `auto` follows the DSH language preference (non-Chinese renders English), or pin `zh`/`en`. |
 | `streamUpdateIntervalMs` | `800` | Coalescing budget for stream edits (250–10000). |
@@ -80,13 +87,18 @@ dsh-discord:
 
 The settings card exposes the three high-frequency fields (guild allowlist, auto-archive, language) plus the connection and token surface; every other key is fully supported through `settings.yaml`. An invalid stored section preserves the last known-good configuration.
 
+<p align="center">
+  <img src="docs/images/settings-card.png" alt="The Discord settings card: connection, guild allowlist, auto-archive, bot language" width="560">
+</p>
+
 ## Setup
 
 1. Invite the bot to your guild with at least: View Channels, **Manage Channels** (the adapter provisions its category and workspace home channels), Send Messages, Create Public Threads, Send Messages in Threads, Attach Files, Read Message History.
 2. Boot the profile and open the web UI.
 3. In **Settings → Discord**, paste the bot token (Developer Portal → your application → Bot → Reset Token) and press **Connect**. The token is stored by the Host credential service — never in settings, logs, or the client.
 4. Fill in **Allowed servers** (server IDs via Discord's Developer Mode → right-click a server → Copy Server ID). Everything outside this allowlist is ignored.
-5. Pick the bot language and mention the bot in a bound channel to start a session.
+5. `/model select` works for any authorized member by default (single-user deployments). To restrict it to Host operators, add their IDs under `hostOperatorUserIds` and set `modelSelectOperatorOnly: true` in `settings.yaml`. `/guild forget` always requires a Host operator.
+6. Pick the bot language and mention the bot in a bound channel to start a session.
 
 ## Commands
 
@@ -96,9 +108,9 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 | `/project list` / `info` | any channel | list workspaces / inspect this channel's binding |
 | `/queue list`, `/queue remove` | session thread | inspect and trim the pending queue |
 | `/steer`, `/stop` | session thread | steer or cancel the running turn (owner only) |
+| `/model show` / `select` | session thread | show the live model directory; `select` without arguments walks the interactive provider → model → reasoning cascade (any authorized member by default) |
 | `/guild forget` | any channel | operator-only removal of adapter records |
 
-
 ## Design notes
 
 - The settings card is the first-run onboarding surface: the token entry writes the credential service's `DSH_DISCORD_BOT_TOKEN` ref over the plugin management channel, then triggers the start chain. Disconnect keeps the credential; an empty reconnect uses it.
@@ -111,7 +123,7 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 ## Known Limitations and Deferred Work
 
 - **`/session new|resume` is not registered** — the selector and cold-adoption modules are implemented and unit-tested, but the Host RPC face cannot back them yet (`sessions.list` v1 returns bare ids; no `session.inspect`). They return with the next milestone.
-- **`/model` is registered but not routed yet** — its control module (model catalog with guarded selection) is implemented and unit-tested; the interactive provider → model → thinking/reasoning cascade lands with the router-wiring milestone. `/preset`, `/skill`, and `/host` stay deregistered until the same pass wires them (the `/preset` thread-context guard rides along).
+- **`/preset`, `/skill`, and `/host` stay deregistered** — their control modules are implemented and unit-tested and return when the router wires them (the `/preset` thread-context guard rides along).
 - **Verbosity is a single global setting** (the DSH ecosystem has per-channel precedent).
 - **Deferred after a Kimaki parity pass**: reconcile-interactions wiring, typing pause during ask waits, fail-closed binding/session-owner store wiring, and credential-rotation watching.
 - **Known tension**: the 250ms minimum stream-edit interval against Discord's edit budget under heavy load (429s self-heal), and typing has no duration-capped watchdog.
@@ -120,7 +132,7 @@ The settings card exposes the three high-frequency fields (guild allowlist, auto
 
 ```sh
 pnpm install --ignore-scripts
-pnpm test          # 642 tests incl. gateway/REST twin E2E
+pnpm test          # 650 tests incl. gateway/REST twin E2E
 pnpm typecheck
 pnpm lint
 pnpm build         # lib + client bundle

package/README.zh.md

@@ -11,12 +11,18 @@
 
 本插件为 function/namespace 插件（`inject: ['apiProxy', 'credentials', 'settings', 'storageDomain', 'connection']`）：将 Discord Gateway、命令面、流式渲染器与设置卡片挂载到 DSH web profile；会话状态保存在 DSH，适配器的持久绑定保存在 profile 的存储域中。
 
+<p align="center">
+  <img src="docs/images/discord-task-lifecycle.jpg" alt="一次任务的完整生命周期：@提及锚定线程、工具活动行随回答流式编辑、最终以 Markdown 表格落地" width="720">
+</p>
+
 ## 功能
 
 - **@提及驱动会话** — 在已绑定的频道中，被授权的 `@机器人 <任务>` 会锚定一个线程（你的消息成为首帖）、创建 DSH 会话，并且至多提交一次。线程内的后续消息无需 @ 即可排队。
 - **流式渲染** — typing 指示、单条头消息编辑、逐工具活动行、代码围栏感知的长文分段、一次性收尾；Turn 结束时活动消息会被删除。
-- **审批与提问** — DSH ask 帧渲染为 Discord 按钮、下拉菜单与自由文本弹窗；所有权强制校验（提问者——或后续 Turn 的线程属主——才能点击），超时清扫 fail-closed，远端决议自动退役控件。
+- **审批与提问** — DSH ask 帧渲染为 Discord 按钮、下拉菜单与自由文本弹窗；所有权强制校验（提问者——或后续 Turn 的线程属主——才能点击），超时清扫 fail-closed，结算后的控件原地置灰。
+
 - **会话控制** — `/steer`、`/stop`、`/queue list|remove` 带运行所有权校验；`/project bind|list|info` 管理 Guild↔工作区绑定；`/guild forget` 供操作员清理。
+- **模型切换** — `/model show` 读取会话的实时模型目录（当前选择、可服务状态、目录分组）；`/model select` 走交互式 provider → 模型 → 推理强度级联（默认对所有授权成员开放，可通过设置收紧为仅 Host 操作员），也可直接填写 `provider/model` 应用。
 - **设置卡片** — Token 引导（粘贴 + 连接；存入 Host 凭据服务，绝不写入设置或日志）、连接/断开、服务器白名单、线程自动归档、Bot 语言。
 - **双语文案** — 所有 Discord 可见文案提供中英双语；Bot 语言默认跟随 DSH 语言偏好，也可从卡片固定。
 - **安全设计** — 显式服务器白名单内的 deny-first 授权、每条 wire 请求携带 `allowed_mentions` 并做字节级提及中和、至多一次的 DSH 提交与保留 unknown 的对账、重启后持久的绑定，以及 READY 扫描：被删的 category/控制频道会重建，被删的工作区频道视为用户意图（解除映射，workspace 保持可重新绑定）。
@@ -61,9 +67,10 @@ dsh plugin --profile web rm @addozhang/dsh-discord   # 卸载；先执行 /guild
 | `enabled` | `false` | 适配器总开关；卡片 Connect 在 Token 存入后启动。 |
 | `allowedGuildIds` | `[]` | 服务器白名单。白名单之外零响应、零 DSH 调用。 |
 | `memberUserIds` / `memberRoleIds` | `[]` | 白名单 Guild 内的成员级授权。 |
-| `administratorUserIds` / `administratorRoleIds` | `[]` | 工作区管理员级（`/project bind`、预设修改）。 |
+| `administratorUserIds` / `administratorRoleIds` | `[]` | 工作区管理员级（`/project bind`）。 |
 | `deniedUserIds` / `deniedRoleIds` | `[]` | 拒绝名单；优先级高于上述一切授权。 |
-| `hostOperatorUserIds` | `[]` | Host 操作员（`/guild forget`）。 |
+| `hostOperatorUserIds` | `[]` | Host 操作员（`/guild forget`；启用 `modelSelectOperatorOnly` 后也包括 `/model select`）。 |
+| `modelSelectOperatorOnly` | `false` | 将 `/model select` 限制为 Host 操作员（仅 `settings.yaml`，卡片不展示）。默认 `false`：任何授权成员均可切换，且切换仍会更新 Host 默认。 |
 | `defaultVerbosity` | `essential-tools` | 工具活动行粒度：`text-only`、`essential-tools`、`full-tools`。 |
 | `language` | `auto` | Bot 可见文案语言：`auto` 跟随 DSH 语言偏好（非中文渲染英文），或固定 `zh`/`en`。 |
 | `streamUpdateIntervalMs` | `800` | 流式编辑合并间隔（250–10000）。 |
@@ -80,13 +87,18 @@ dsh-discord:
 
 设置卡片暴露三个高频项（服务器白名单、自动归档、语言）以及连接与 Token 面；其余键完全支持通过 `settings.yaml` 配置。非法的已存配置会保留最近一次有效配置。
 
+<p align="center">
+  <img src="docs/images/settings-card.png" alt="Discord 设置卡片：连接状态、服务器白名单、归档、语言" width="560">
+</p>
+
 ## 初始设置
 
 1. 以至少以下权限把 Bot 邀请到你的服务器：查看频道、**管理频道**（适配器要创建自己的分类和工作区频道）、发送消息、创建公共线程、在线程中发送消息、上传文件、读取消息历史。
 2. 启动 profile 并打开 Web 界面。
 3. 在 **Settings → Discord** 中粘贴 Bot Token（开发者门户 → 你的应用 → Bot → Reset Token）并点击 **Connect**。Token 由 Host 凭据服务保存——绝不写入设置、日志或客户端。
 4. 填写 **允许的服务器**（服务器 ID 获取方式：Discord 开发者模式 → 右键服务器 → 复制服务器 ID）。白名单之外的一切都会被忽略。
-5. 选择 Bot 语言，然后在已绑定的频道 @机器人 开始会话。
+5. `/model select` 默认对任何授权成员开放（单人自用部署）。如需限制为 Host 操作员：在 `hostOperatorUserIds` 中加入其用户 ID，并把 `modelSelectOperatorOnly` 设为 `true`（`settings.yaml`）。`/guild forget` 始终需要 Host 操作员。
+6. 选择 Bot 语言，然后在已绑定的频道 @机器人 开始会话。
 
 ## 命令
 
@@ -96,6 +108,7 @@ dsh-discord:
 | `/project list` / `info` | 任意频道 | 列出工作区 / 查看当前频道绑定 |
 | `/queue list`, `/queue remove` | 会话线程 | 查看与移除待处理队列 |
 | `/steer`, `/stop` | 会话线程 | 插话或取消运行中的 Turn（仅属主） |
+| `/model show` / `select` | 会话线程 | 查看实时模型目录；`select` 不带参数时走交互式 provider → 模型 → 推理强度级联（默认对所有授权成员开放） |
 | `/guild forget` | 任意频道 | 仅操作员：移除适配器记录 |
 
 
@@ -111,7 +124,7 @@ dsh-discord:
 ## 已知限制与推迟项
 
 - **`/session new|resume` 未注册** — 选择器与冷收养模块已实现并通过单元测试，但 Host RPC 面尚不支持（`sessions.list` v1 只返回裸 id；缺少 `session.inspect`）。将在下个里程碑回归。
-- **`/model` 已注册但尚未接线** — 其控制模块（模型目录与受控选择）已实现并通过单元测试；交互式 provider → 模型 → thinking/reasoning 级联将随路由接线里程碑落地。`/preset`、`/skill`、`/host` 保持注销状态，同一次接线时回归（`/preset` 的会话线程守卫一并处理）。
+- **`/preset`、`/skill`、`/host` 保持注销状态** — 控制模块已实现并通过单元测试，待路由接线时回归（`/preset` 的会话线程守卫一并处理）。
 - **verbosity 为全局设置**（DSH 生态有按频道设置的先例）。
 - **经 Kimaki 对齐后有意推迟**：reconcile-interactions 接线、ask 等待期暂停 typing、fail-closed 绑定/会话属主 store 接线、凭据轮换监听。
 - **已知张力**：流式编辑 250ms 下限与高负载下 Discord 编辑预算的冲突（429 自愈），以及 typing 缺少时长上限看门狗。
@@ -120,7 +133,7 @@ dsh-discord:
 
 ```sh
 pnpm install --ignore-scripts
-pnpm test          # 642 tests incl. gateway/REST twin E2E
+pnpm test          # 650 tests incl. gateway/REST twin E2E
 pnpm typecheck
 pnpm lint
 pnpm build         # lib + client bundle

package/lib/client/slot-contract.d.ts

@@ -16,6 +16,8 @@ interface DiscordPluginsLocale {
     discordDescription: string;
     discordAllowedGuildIds: string;
     discordGuildIdHelp: string;
+    discordHostOperators: string;
+    discordHostOperatorsHelp: string;
     discordLanguageAuto: string;
     discordTokenLabel: string;
     discordTokenPlaceholder: string;
@@ -30,6 +32,8 @@ interface DiscordPluginsLocale {
     discordLanguage: string;
     discordLanguageHint: string;
     discordInvalidLanguage: string;
+    discordModelOperatorOnly: string;
+    discordModelOperatorOnlyHint: string;
     discordInvalidIds: string;
     discordInvalidArchive: string;
     discordStatusConnected: string;

package/lib/client.js

@@ -951,7 +951,7 @@ var DiscordCardForm = class {
     const value = section?.[field];
     if (Array.isArray(value)) return value.join("\n");
     if (typeof value === "string") return value;
-    if (typeof value === "number") return String(value);
+    if (typeof value === "boolean" || typeof value === "number") return String(value);
     return "";
   }
   snapshot() {

package/lib/discord/commands.js

@@ -31,7 +31,9 @@ export const MILESTONE_ONE_COMMANDS = [
     leaf('stop', 'Cancel the running turn of this thread'),
     grouped('model', 'Show or select the session model', [
         { name: 'show' },
-        { name: 'select', options: [{ name: 'model', required: true }, { name: 'reasoning', required: false }] },
+        // select without a typed model opens the interactive provider → model
+        // → reasoning cascade (16.35); typing `provider/model` applies directly.
+        { name: 'select', options: [{ name: 'model', required: false }, { name: 'reasoning', required: false }] },
     ]),
     grouped('guild', 'Guild-scoped adapter operations', [
         { name: 'forget' },

package/lib/dsh/api-proxy-face.d.ts

@@ -66,8 +66,61 @@ export interface DshApiProxyFace {
                 sessionId: string;
             }>;
         }>>;
+        models(request: RpcRequestShape<{
+            sessionId: string;
+        }>): Promise<RpcResponseShape<SessionModelsShape>>;
+        selectModel(request: RpcRequestShape<{
+            sessionId: string;
+            provider: string;
+            model: string;
+            reasoningEffort?: string;
+        }>): Promise<RpcResponseShape<{
+            selected: ModelSelectionShape;
+        }>>;
     };
 }
+/** One reasoning effort a model's adapter advertises (sessions.d.ts). */
+import type { DshModelPort } from '../features/model-control.js';
+export interface ModelReasoningEffortShape {
+    id: string;
+    name: string;
+    description?: string;
+}
+/** Exact-route reasoning metadata for one catalog model. */
+export interface ModelReasoningShape {
+    efforts: ModelReasoningEffortShape[];
+    defaultEffort?: string;
+}
+/** One model inside a provider group (sessions.d.ts ModelCatalogModel). */
+export interface ModelCatalogModelShape {
+    id: string;
+    name: string;
+    description?: string;
+    reasoning?: ModelReasoningShape;
+}
+/** One provider group and its models (sessions.d.ts ModelProviderGroup). */
+export interface ModelProviderGroupShape {
+    id: string;
+    name: string;
+    models: ModelCatalogModelShape[];
+}
+/** The detached model directory `session.models` returns for one session. */
+export interface SessionModelsShape {
+    current: ModelSelectionShape;
+    routable: boolean;
+    groups: ModelProviderGroupShape[];
+    failures: Array<{
+        id: string;
+        name: string;
+        message: string;
+    }>;
+}
+/** The complete provider/model/reasoning selection (dsh-agent ModelSelection). */
+export interface ModelSelectionShape {
+    provider: string;
+    model: string;
+    reasoningEffort?: string;
+}
 /** Signature-layer narrow request form (RpcId brand erased at this seam). */
 export interface RpcRequestShape<P> {
     rpcId: string;
@@ -251,3 +304,47 @@ export declare function createClientRespondPort(dsh: {
 }, options?: ApiProxyFaceOptions): {
     respond(rpcId: string, value: unknown): Promise<RespondOutcome>;
 };
+export type SessionModelsOutcome = {
+    outcome: 'completed';
+    models: SessionModelsShape;
+} | {
+    outcome: 'failed';
+} | {
+    outcome: 'unknown';
+};
+/**
+ * The session's detached model directory: the live selection, whether the
+ * current route still serves, and the per-provider catalog groups the
+ * /model cascade browses.
+ */
+export declare function sessionModels(dsh: DshApiProxyFace, request: {
+    sessionId: string;
+}, options?: ApiProxyFaceOptions): Promise<SessionModelsOutcome>;
+export type SelectModelOutcome = {
+    outcome: 'completed';
+    selected: ModelSelectionShape;
+} | {
+    outcome: 'rejected';
+    reason: string;
+} | {
+    outcome: 'unknown';
+};
+/**
+ * Select the complete model selection for one session (session.selectModel):
+ * the session switches immediately and the Host records the choice as the
+ * default for sessions that have not logged their own — the response only
+ * proves the session switch, so callers must not claim the persistence
+ * outcome (design.md §7).
+ */
+export declare function selectSessionModel(dsh: DshApiProxyFace, request: {
+    sessionId: string;
+    provider: string;
+    model: string;
+    reasoningEffort?: string;
+}, options?: ApiProxyFaceOptions): Promise<SelectModelOutcome>;
+/**
+ * The /model surface over the real session RPCs: the per-session live
+ * directory (`session.models`) and the guarded selection mutation
+ * (`session.selectModel`) — the shapes model-control reasons about.
+ */
+export declare function createModelPort(dsh: DshApiProxyFace, options?: ApiProxyFaceOptions): DshModelPort;

package/lib/dsh/api-proxy-face.js

@@ -368,3 +368,82 @@ export function createClientRespondPort(dsh, options = {}) {
         },
     };
 }
+/** Bounded window for the per-session model directory read. */
+const MODELS_TIMEOUT_MS = 10_000;
+/**
+ * The session's detached model directory: the live selection, whether the
+ * current route still serves, and the per-provider catalog groups the
+ * /model cascade browses.
+ */
+export async function sessionModels(dsh, request, options = {}) {
+    const timeoutMs = options.timeoutMs ?? MODELS_TIMEOUT_MS;
+    let response;
+    try {
+        response = await withRpcTimeout(dsh.sessions.models(mintRequest({ sessionId: request.sessionId })), timeoutMs);
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            options.log?.('discord_models_timeout', { sessionId: request.sessionId });
+            return { outcome: 'unknown' };
+        }
+        options.log?.('discord_models_threw', { cause: String(cause), sessionId: request.sessionId });
+        return { outcome: 'unknown' };
+    }
+    const result = response?.result;
+    if (result === undefined || !result.ok) {
+        options.log?.('discord_models_malformed', {
+            sessionId: request.sessionId,
+            code: result?.ok === false ? result.error.code : 'malformed',
+        });
+        return { outcome: 'failed' };
+    }
+    return { outcome: 'completed', models: result.value };
+}
+/**
+ * Select the complete model selection for one session (session.selectModel):
+ * the session switches immediately and the Host records the choice as the
+ * default for sessions that have not logged their own — the response only
+ * proves the session switch, so callers must not claim the persistence
+ * outcome (design.md §7).
+ */
+export async function selectSessionModel(dsh, request, options = {}) {
+    const timeoutMs = options.timeoutMs ?? PROMPT_TIMEOUT_MS;
+    let response;
+    try {
+        response = await withRpcTimeout(dsh.sessions.selectModel(mintRequest({
+            sessionId: request.sessionId,
+            provider: request.provider,
+            model: request.model,
+            ...(request.reasoningEffort === undefined ? {} : { reasoningEffort: request.reasoningEffort }),
+        })), timeoutMs);
+    }
+    catch (cause) {
+        if (cause instanceof RpcTimeoutError) {
+            options.log?.('discord_model_select_timeout', { sessionId: request.sessionId });
+            return { outcome: 'unknown' };
+        }
+        options.log?.('discord_model_select_threw', { cause: String(cause), sessionId: request.sessionId });
+        return { outcome: 'unknown' };
+    }
+    const result = response?.result;
+    if (result === undefined) {
+        options.log?.('discord_model_select_malformed', { sessionId: request.sessionId });
+        return { outcome: 'unknown' };
+    }
+    if (result.ok) {
+        return { outcome: 'completed', selected: result.value.selected };
+    }
+    options.log?.('discord_model_select_rejected', { code: result.error.code, sessionId: request.sessionId });
+    return { outcome: 'rejected', reason: result.error.code };
+}
+/**
+ * The /model surface over the real session RPCs: the per-session live
+ * directory (`session.models`) and the guarded selection mutation
+ * (`session.selectModel`) — the shapes model-control reasons about.
+ */
+export function createModelPort(dsh, options = {}) {
+    return {
+        models: sessionId => sessionModels(dsh, { sessionId }, options),
+        selectModel: request => selectSessionModel(dsh, request, options),
+    };
+}

package/lib/features/interaction-router.d.ts

@@ -14,6 +14,7 @@ import type { WorkspaceResolver } from './project-bind.js';
 import type { CancelOutcome, PromptOutcome, QueueRemoveOutcome, WorkspaceDetailOutcome } from '../dsh/api-proxy-face.js';
 import type { TurnTracker } from './turn-ownership.js';
 import { type DshApprovalRespondPort } from './approval-routing.js';
+import { type DshModelPort } from './model-control.js';
 import type { QuestionInteractionOutcome } from './question-routing.js';
 import type { ApprovalStore } from './approval-store.js';
 import type { ChannelBinding } from '../state/records.js';
@@ -82,6 +83,13 @@ export interface InteractionRouterDeps {
      * fresh; task 16.37).
      */
     purgeChannelBinding: (guildId: string, channelId: string) => Promise<void>;
+    /** The session's live model directory + selection mutation (/model surface). */
+    model: DshModelPort;
+    /**
+     * Whether /model select stays Host-operator-only (default). Single-user
+     * deployments flip this so any authorized member can switch (16.42).
+     */
+    modelSelectOperatorOnly: () => boolean;
     log: (event: string, detail?: unknown) => void;
     warn: (event: string, detail?: unknown) => void;
 }

package/lib/features/interaction-router.js

@@ -13,6 +13,33 @@ import { projectInfo } from './project-info.js';
 import { planSteer } from './steer-control.js';
 import { planStop } from './stop-control.js';
 import { handleApprovalClick } from './approval-routing.js';
+import { applyModelSelection } from './model-control.js';
+/** Discord interactive-component id for string select menus. */
+const SELECT_MENU = 3;
+/** `provider/model` — or `provider/model (effort)` when an effort is set. */
+function modelSelectionLabel(selection) {
+    return selection.reasoningEffort === undefined
+        ? `${selection.provider}/${selection.model}`
+        : `${selection.provider}/${selection.model} (${selection.reasoningEffort})`;
+}
+function selectMenuRow(customId, placeholder, options) {
+    return [{
+            type: 1,
+            components: [{ type: SELECT_MENU, custom_id: customId, placeholder, options, max_values: 1 }],
+        }];
+}
+/** The ephemeral outcome line for a /model selection attempt. */
+function renderModelApply(copy, result) {
+    switch (result.outcome) {
+        case 'applied': return copy.modelApplied(modelSelectionLabel(result.selected));
+        case 'rejected': return copy.modelSelectRejected(result.reason);
+        case 'unknown': return copy.modelSelectUnknown;
+        case 'refused':
+            return result.reason === 'not-host-operator' ? copy.modelSelectOperatorOnly
+                : result.reason === 'invalid-reasoning-effort' ? copy.modelInvalidReasoning
+                    : copy.modelNotInCatalog;
+    }
+}
 export function createInteractionRouter(deps) {
     /** Authorize one interaction against the live policy table. */
     function authorize(event) {
@@ -368,6 +395,94 @@ export function createInteractionRouter(deps) {
                     }]);
                 return;
             }
+            if (event.commandName === 'model') {
+                const options = event.data['options'];
+                const subcommand = Array.isArray(options) ? options[0] : undefined;
+                const subName = subcommand?.name;
+                const sessionId = deps.sessionForThread(event.guildId, event.channelId);
+                if (sessionId === undefined) {
+                    await followUp(deps.copy.modelNeedsThread);
+                    return;
+                }
+                if (subName === 'select') {
+                    // Host-operator authority by default: the switch reaches the
+                    // Host-wide default selection (design.md §7). A deployment may
+                    // relax it for single-user use (16.42).
+                    const requireOperator = deps.modelSelectOperatorOnly();
+                    const decision = authorize(event);
+                    if (!decision.allowed || (requireOperator && decision.level !== 'host-operator')) {
+                        await followUp(deps.copy.modelSelectOperatorOnly);
+                        return;
+                    }
+                    const wireOptions = Array.isArray(subcommand?.options) ? subcommand.options : [];
+                    const typedModel = wireOptions.find(option => option.name === 'model')?.value;
+                    const typedReasoning = wireOptions.find(option => option.name === 'reasoning')?.value;
+                    if (typeof typedModel === 'string' && typedModel !== '') {
+                        // Typed form: `provider/model` plus an optional reasoning
+                        // effort, validated against the live catalog before mutation.
+                        const separator = typedModel.indexOf('/');
+                        if (separator <= 0 || separator === typedModel.length - 1) {
+                            await followUp(deps.copy.modelTypedParseFailed);
+                            return;
+                        }
+                        const result = await applyModelSelection(deps.model, {
+                            decision,
+                            sessionId,
+                            provider: typedModel.slice(0, separator),
+                            model: typedModel.slice(separator + 1),
+                            requireHostOperator: requireOperator,
+                            ...(typeof typedReasoning === 'string' && typedReasoning !== '' ? { reasoningEffort: typedReasoning } : {}),
+                        });
+                        await followUp(renderModelApply(deps.copy, result));
+                        return;
+                    }
+                    // Interactive cascade, stage 1: the provider.
+                    const directory = await deps.model.models(sessionId);
+                    if (directory.outcome !== 'completed') {
+                        await followUp(deps.copy.modelShowUnavailable);
+                        return;
+                    }
+                    if (directory.models.groups.length === 0) {
+                        await followUp(deps.copy.modelSelectNoModels);
+                        return;
+                    }
+                    const failures = directory.models.failures.length > 0
+                        ? deps.copy.modelShowFailures(directory.models.failures.map(failure => failure.name).join(', '))
+                        : '';
+                    const truncated = directory.models.groups.length > 25
+                        ? deps.copy.modelCascadeTruncated(25, directory.models.groups.length)
+                        : '';
+                    const menuId = deps.registry.register({ kind: 'model', stage: 'provider', sessionId, expiresAtMs: Date.now() + 15 * 60 * 1000 });
+                    await followUp(deps.copy.modelCascadeProviderHeader(modelSelectionLabel(directory.models.current), `${failures}${truncated}`), selectMenuRow(menuId, deps.copy.modelCascadeProviderPlaceholder, directory.models.groups.slice(0, 25).map(group => ({
+                        label: group.name,
+                        value: group.id,
+                        description: `${String(group.models.length)} models`,
+                    }))));
+                    return;
+                }
+                // show (default): the member-readable live model directory.
+                const directory = await deps.model.models(sessionId);
+                if (directory.outcome !== 'completed') {
+                    await followUp(deps.copy.modelShowUnavailable);
+                    return;
+                }
+                const current = directory.models.current;
+                const selection = current.reasoningEffort === undefined
+                    ? `${current.provider}/${current.model}`
+                    : `${current.provider}/${current.model} (${current.reasoningEffort})`;
+                let content = deps.copy.modelShowHeader(selection, directory.models.groups.length);
+                if (current.reasoningEffort !== undefined)
+                    content += deps.copy.modelShowReasoning(current.reasoningEffort);
+                if (!directory.models.routable)
+                    content += deps.copy.modelShowNotRoutable;
+                if (directory.models.groups.length === 0)
+                    content += deps.copy.modelShowNoGroups;
+                if (directory.models.failures.length > 0) {
+                    content += deps.copy.modelShowFailures(directory.models.failures.map(failure => failure.name).join(', '));
+                }
+                await followUp(content);
+                return;
+            }
             // Terminal guard: a recognized interaction type with an unhandled
             // command name must still answer, never strand on the deferred ack.
             await followUp(deps.copy.unknownSubcommand);
@@ -476,6 +591,136 @@ export function createInteractionRouter(deps) {
         if (posted.outcome !== 'completed')
             deps.log('discord_followup_failed', posted.outcome);
     }
+    /** One cascade stage: ack, re-authorize, then advance or apply (16.35). */
+    async function routeModelComponent(event, interactionToken) {
+        const customId = event.data['custom_id'];
+        if (typeof customId !== 'string')
+            return;
+        const resolved = deps.registry.resolve(customId, Date.now());
+        const context = resolved.found ? resolved.context : undefined;
+        const rest = await deps.rest();
+        if (rest === undefined)
+            return;
+        // Ack BEFORE the catalog reads and the DSH round trip: component
+        // interactions must receive an initial response within 3s.
+        const acked = await rest.request('POST', `/interactions/${event.interactionId}/${interactionToken}/callback`, { type: 6 });
+        if (acked.outcome !== 'completed')
+            deps.log('discord_ack_failed', acked.outcome);
+        const followUp = async (content, components) => {
+            const posted = await rest.request('POST', `/webhooks/${deps.applicationId()}/${interactionToken}`, {
+                content,
+                flags: OUTBOUND_EPHEMERAL_FLAGS,
+                ...(components === undefined ? {} : { components }),
+            });
+            if (posted.outcome !== 'completed') {
+                deps.log('discord_followup_failed', posted.outcome === 'rejected' ? `HTTP ${String(posted.status)}` : posted.reason);
+            }
+        };
+        if (context === undefined) {
+            await followUp(deps.copy.modelCascadeExpired);
+            return;
+        }
+        // Every stage re-checks Host-operator authority: a forwarded menu must
+        // not let another member drive — or enumerate — the selection surface.
+        const requireOperator = deps.modelSelectOperatorOnly();
+        const decision = authorize(event);
+        if (!decision.allowed || (requireOperator && decision.level !== 'host-operator')) {
+            await followUp(deps.copy.modelSelectOperatorOnly);
+            return;
+        }
+        const sessionId = typeof context['sessionId'] === 'string' ? context['sessionId'] : undefined;
+        const stage = context['stage'];
+        if (sessionId === undefined || typeof stage !== 'string') {
+            await followUp(deps.copy.modelCascadeExpired);
+            return;
+        }
+        const value = event.selectValues[0];
+        if (typeof value !== 'string' || value === '') {
+            await followUp(deps.copy.modelCascadeExpired);
+            return;
+        }
+        try {
+            if (stage === 'provider') {
+                const directory = await deps.model.models(sessionId);
+                const group = directory.outcome === 'completed'
+                    ? directory.models.groups.find(candidate => candidate.id === value)
+                    : undefined;
+                if (group === undefined || group.models.length === 0) {
+                    await followUp(deps.copy.modelSelectNoModels);
+                    return;
+                }
+                const truncated = group.models.length > 25 ? deps.copy.modelCascadeTruncated(25, group.models.length) : '';
+                const menuId = deps.registry.register({ kind: 'model', stage: 'model', sessionId, provider: group.id, expiresAtMs: Date.now() + 15 * 60 * 1000 });
+                await followUp(deps.copy.modelCascadeModelHeader(group.name) + truncated, selectMenuRow(menuId, deps.copy.modelCascadeModelPlaceholder, group.models.slice(0, 25).map(model => ({
+                    label: model.name !== '' ? model.name : model.id,
+                    value: model.id,
+                    ...(model.description === undefined ? {} : { description: model.description.slice(0, 100) }),
+                }))));
+                return;
+            }
+            if (stage === 'model') {
+                const provider = typeof context['provider'] === 'string' ? context['provider'] : undefined;
+                if (provider === undefined) {
+                    await followUp(deps.copy.modelCascadeExpired);
+                    return;
+                }
+                const directory = await deps.model.models(sessionId);
+                const group = directory.outcome === 'completed'
+                    ? directory.models.groups.find(candidate => candidate.id === provider)
+                    : undefined;
+                const model = group?.models.find(candidate => candidate.id === value);
+                const efforts = model?.reasoning?.efforts ?? [];
+                if (efforts.length === 0) {
+                    // No reasoning metadata: apply with the provider/default behavior.
+                    const result = await applyModelSelection(deps.model, { decision, sessionId, provider, model: value, requireHostOperator: requireOperator });
+                    await followUp(renderModelApply(deps.copy, result));
+                    return;
+                }
+                const menuId = deps.registry.register({ kind: 'model', stage: 'reasoning', sessionId, provider, model: value, expiresAtMs: Date.now() + 15 * 60 * 1000 });
+                const defaultEffort = model?.reasoning?.defaultEffort;
+                const options = [
+                    {
+                        label: deps.copy.modelCascadeReasoningDefault,
+                        value: '__default__',
+                        description: (defaultEffort === undefined
+                            ? deps.copy.modelCascadeReasoningDefaultHint
+                            : `${deps.copy.modelCascadeReasoningDefaultHint} (${defaultEffort})`).slice(0, 100),
+                    },
+                    ...efforts.slice(0, 24).map(effort => ({
+                        label: effort.name,
+                        value: effort.id,
+                        ...(effort.description === undefined ? {} : { description: effort.description.slice(0, 100) }),
+                    })),
+                ];
+                const modelLabel = model?.name !== undefined && model.name !== '' ? model.name : value;
+                await followUp(deps.copy.modelCascadeReasoningHeader(modelLabel), selectMenuRow(menuId, deps.copy.modelCascadeReasoningPlaceholder, options));
+                return;
+            }
+            if (stage === 'reasoning') {
+                const provider = typeof context['provider'] === 'string' ? context['provider'] : undefined;
+                const model = typeof context['model'] === 'string' ? context['model'] : undefined;
+                if (provider === undefined || model === undefined) {
+                    await followUp(deps.copy.modelCascadeExpired);
+                    return;
+                }
+                const result = await applyModelSelection(deps.model, {
+                    decision,
+                    sessionId,
+                    provider,
+                    model,
+                    requireHostOperator: requireOperator,
+                    ...(value === '__default__' ? {} : { reasoningEffort: value }),
+                });
+                await followUp(renderModelApply(deps.copy, result));
+                return;
+            }
+            await followUp(deps.copy.modelCascadeExpired);
+        }
+        catch (cause) {
+            deps.warn('discord_model_cascade_failed', String(cause));
+            await deps.componentFollowUp(event.interactionId, interactionToken, deps.copy.commandFailed).catch(() => { });
+        }
+    }
     async function settleQuestionInteraction(event, interactionToken, outcome) {
         if (outcome.outcome === 'modal-requested') {
             const rest = await deps.rest();
@@ -578,6 +823,10 @@ export function createInteractionRouter(deps) {
                 await routeGuildForGetComponent(event, interactionToken);
                 return;
             }
+            if (bindContext?.['kind'] === 'model') {
+                await routeModelComponent(event, interactionToken);
+                return;
+            }
             // A not-found custom_id means the control was never registered or has
             // been retired by its TTL (approval/question registry entries stay
             // resolvable until expiry; claimed-vs-resolved state lives in the

package/lib/features/model-control.d.ts

@@ -1,24 +1,21 @@
 /**
  * `/model show` and the guarded `/model select` (design.md §7, tasks 10.2 +
- * 10.3). A successful `session.selectModel` changes the addressed session AND
- * attempts to persist that choice as the host default for future sessions, so
- * mutation is restricted to the explicit global Host-operator allowlist —
- * Guild-local administrators are denied. The confirmation states BOTH facts
- * and nothing more: `applied-with-host-default`, `partial-session-only` (the
- * session changed but persistence did not land), or a plain rejection/unknown.
- * Catalog and reasoning-effort validation happen before any DSH call.
+ * 10.3 + 16.35). Selection goes through `session.selectModel`: the session
+ * switches immediately and the Host records the choice as the default for
+ * sessions that have not logged their own — the RPC response only proves the
+ * session switch, so the confirmation states the session change and the
+ * default request, never a persistence outcome. Because the switch reaches
+ * the Host-wide default, mutation is restricted to the explicit global
+ * Host-operator allowlist — Guild-local administrators are denied. Provider/
+ * model/reasoning validation runs against the session's live catalog before
+ * any mutation.
  */
 import type { AccessDecision } from '../policy/authorization.js';
+import type { ModelSelectionShape, SessionModelsShape } from '../dsh/api-proxy-face.js';
 export interface DshModelPort {
-    catalog(): Promise<{
+    models(sessionId: string): Promise<{
         outcome: 'completed';
-        providers: ReadonlyArray<{
-            provider: string;
-            models: ReadonlyArray<{
-                id: string;
-                reasonings: readonly string[];
-            }>;
-        }>;
+        models: SessionModelsShape;
     } | {
         outcome: 'failed';
     } | {
@@ -26,12 +23,12 @@ export interface DshModelPort {
     }>;
     selectModel(request: {
         sessionId: string;
-        modelId: string;
-        reasoning?: string;
+        provider: string;
+        model: string;
+        reasoningEffort?: string;
     }): Promise<{
         outcome: 'completed';
-        sessionApplied: boolean;
-        defaultPersisted: boolean;
+        selected: ModelSelectionShape;
     } | {
         outcome: 'rejected';
         reason: string;
@@ -39,41 +36,40 @@ export interface DshModelPort {
         outcome: 'unknown';
     }>;
 }
-export type ModelCatalogView = {
-    outcome: 'ok';
-    providers: ReadonlyArray<{
-        provider: string;
-        models: ReadonlyArray<{
-            id: string;
-            reasonings: readonly string[];
-        }>;
-    }>;
+export type ModelsView = {
+    outcome: 'completed';
+    models: SessionModelsShape;
 } | {
     outcome: 'failed';
-    reason: 'model-catalog-unavailable' | 'model-catalog-unknown';
+} | {
+    outcome: 'unknown';
 };
-export declare function showModelCatalog(port: DshModelPort, _request: {
+/** `/model show`: the session's live model directory (current + browsable groups). */
+export declare function showModels(port: DshModelPort, request: {
     sessionId: string;
-}): Promise<ModelCatalogView>;
-export type ModelSelectResult = {
-    outcome: 'applied-with-host-default';
-    sessionApplied: boolean;
-    defaultPersisted: boolean;
-} | {
-    outcome: 'partial-session-only';
-    sessionApplied: boolean;
-    defaultPersisted: boolean;
+}): Promise<ModelsView>;
+export type ModelApplyResult = {
+    outcome: 'applied';
+    selected: ModelSelectionShape;
 } | {
     outcome: 'rejected';
+    reason: string;
 } | {
     outcome: 'unknown';
 } | {
     outcome: 'refused';
     reason: 'not-host-operator' | 'model-not-in-catalog' | 'invalid-reasoning-effort';
 };
-export declare function selectModel(port: DshModelPort, request: {
+export declare function applyModelSelection(port: DshModelPort, request: {
     decision: AccessDecision;
     sessionId: string;
-    modelId: string;
-    reasoning?: string | undefined;
-}): Promise<ModelSelectResult>;
+    provider: string;
+    model: string;
+    reasoningEffort?: string | undefined;
+    /**
+     * Keep the Host-operator restriction (default). Single-user deployments
+     * may drop it so any authorized member of the allowlisted guild can
+     * switch — the switch still reaches the Host-wide default (16.42).
+     */
+    requireHostOperator?: boolean | undefined;
+}): Promise<ModelApplyResult>;

package/lib/features/model-control.js

@@ -1,51 +1,57 @@
 /**
  * `/model show` and the guarded `/model select` (design.md §7, tasks 10.2 +
- * 10.3). A successful `session.selectModel` changes the addressed session AND
- * attempts to persist that choice as the host default for future sessions, so
- * mutation is restricted to the explicit global Host-operator allowlist —
- * Guild-local administrators are denied. The confirmation states BOTH facts
- * and nothing more: `applied-with-host-default`, `partial-session-only` (the
- * session changed but persistence did not land), or a plain rejection/unknown.
- * Catalog and reasoning-effort validation happen before any DSH call.
+ * 10.3 + 16.35). Selection goes through `session.selectModel`: the session
+ * switches immediately and the Host records the choice as the default for
+ * sessions that have not logged their own — the RPC response only proves the
+ * session switch, so the confirmation states the session change and the
+ * default request, never a persistence outcome. Because the switch reaches
+ * the Host-wide default, mutation is restricted to the explicit global
+ * Host-operator allowlist — Guild-local administrators are denied. Provider/
+ * model/reasoning validation runs against the session's live catalog before
+ * any mutation.
  */
-export async function showModelCatalog(port, _request) {
-    const catalog = await port.catalog();
-    if (catalog.outcome === 'failed')
-        return { outcome: 'failed', reason: 'model-catalog-unavailable' };
-    if (catalog.outcome === 'unknown')
-        return { outcome: 'failed', reason: 'model-catalog-unknown' };
-    return { outcome: 'ok', providers: catalog.providers };
+/** `/model show`: the session's live model directory (current + browsable groups). */
+export async function showModels(port, request) {
+    return port.models(request.sessionId);
 }
-export async function selectModel(port, request) {
-    // Host-operator authority ONLY: a Guild administrator is not enough,
-    // because the selection attempts to persist a host-wide default.
-    if (!request.decision.allowed || request.decision.level !== 'host-operator') {
+export async function applyModelSelection(port, request) {
+    const requireOperator = request.requireHostOperator ?? true;
+    if (requireOperator) {
+        // Host-operator authority ONLY: a Guild administrator is not enough,
+        // because the switch reaches the Host-wide default selection.
+        if (!request.decision.allowed || request.decision.level !== 'host-operator') {
+            return { outcome: 'refused', reason: 'not-host-operator' };
+        }
+    }
+    if (!request.decision.allowed) {
         return { outcome: 'refused', reason: 'not-host-operator' };
     }
-    const catalog = await port.catalog();
-    if (catalog.outcome !== 'completed') {
+    const directory = await port.models(request.sessionId);
+    if (directory.outcome !== 'completed') {
+        return { outcome: 'refused', reason: 'model-not-in-catalog' };
+    }
+    const group = directory.models.groups.find(candidate => candidate.id === request.provider);
+    if (group === undefined) {
         return { outcome: 'refused', reason: 'model-not-in-catalog' };
     }
-    const model = catalog.providers
-        .flatMap(provider => provider.models)
-        .find(candidate => candidate.id === request.modelId);
+    const model = group.models.find(candidate => candidate.id === request.model);
     if (model === undefined) {
         return { outcome: 'refused', reason: 'model-not-in-catalog' };
     }
-    if (request.reasoning !== undefined && !model.reasonings.includes(request.reasoning)) {
-        return { outcome: 'refused', reason: 'invalid-reasoning-effort' };
+    if (request.reasoningEffort !== undefined) {
+        const efforts = model.reasoning?.efforts ?? [];
+        if (!efforts.some(effort => effort.id === request.reasoningEffort)) {
+            return { outcome: 'refused', reason: 'invalid-reasoning-effort' };
+        }
     }
     const selected = await port.selectModel({
         sessionId: request.sessionId,
-        modelId: request.modelId,
-        ...(request.reasoning === undefined ? {} : { reasoning: request.reasoning }),
+        provider: request.provider,
+        model: request.model,
+        ...(request.reasoningEffort === undefined ? {} : { reasoningEffort: request.reasoningEffort }),
     });
     if (selected.outcome !== 'completed') {
-        return selected.outcome === 'rejected' ? { outcome: 'rejected' } : { outcome: 'unknown' };
-    }
-    // State exactly what DSH proved — both facts, never overstated.
-    if (selected.sessionApplied && selected.defaultPersisted) {
-        return { outcome: 'applied-with-host-default', sessionApplied: true, defaultPersisted: true };
+        return selected.outcome === 'rejected' ? { outcome: 'rejected', reason: selected.reason } : { outcome: 'unknown' };
     }
-    return { outcome: 'partial-session-only', sessionApplied: selected.sessionApplied, defaultPersisted: selected.defaultPersisted };
+    return { outcome: 'applied', selected: selected.selected };
 }

package/lib/i18n.d.ts

@@ -84,6 +84,31 @@ declare const zh: {
     unboundNoticeAdministrator: string;
     unboundNoticeMember: string;
     interruptedMarker: string;
+    modelNeedsThread: string;
+    modelShowUnavailable: string;
+    modelShowHeader: (sel: string, groups: number) => string;
+    modelShowReasoning: (effort: string) => string;
+    modelShowNotRoutable: string;
+    modelShowFailures: (names: string) => string;
+    modelShowNoGroups: string;
+    modelSelectOperatorOnly: string;
+    modelSelectNoModels: string;
+    modelCascadeProviderHeader: (current: string, extra: string) => string;
+    modelCascadeProviderPlaceholder: string;
+    modelCascadeModelHeader: (provider: string) => string;
+    modelCascadeModelPlaceholder: string;
+    modelCascadeReasoningHeader: (model: string) => string;
+    modelCascadeReasoningPlaceholder: string;
+    modelCascadeReasoningDefault: string;
+    modelCascadeReasoningDefaultHint: string;
+    modelCascadeTruncated: (shown: number, total: number) => string;
+    modelCascadeExpired: string;
+    modelApplied: (sel: string) => string;
+    modelSelectUnknown: string;
+    modelSelectRejected: (reason: string) => string;
+    modelNotInCatalog: string;
+    modelInvalidReasoning: string;
+    modelTypedParseFailed: string;
     approvalRequired: (label: string) => string;
 };
 export type CopyTable = typeof zh;

package/lib/i18n.js

@@ -92,6 +92,32 @@ const zh = {
     unboundNoticeMember: '💡 此频道未绑定工作区；请工作区管理员运行 `/project bind`。',
     // ── stream renderer ──────────────────────────────────────────────────
     interruptedMarker: '*（已被中断）*',
+    // ── /model show / select ─────────────────────────────────────────────
+    modelNeedsThread: '⚠️ /model 需要在已绑定 Session 的任务线程中使用（先在项目频道 @ 机器人）。',
+    modelShowUnavailable: '⚠️ 模型目录暂时不可用，请稍后重试。',
+    modelShowHeader: (sel, groups) => `**当前模型：** \`${sel}\`\n**可用 provider：** ${String(groups)}`,
+    modelShowReasoning: (effort) => `\n**推理强度：** \`${effort}\``,
+    modelShowNotRoutable: '\n⚠️ 当前 provider 暂时无法服务请求。',
+    modelShowFailures: (names) => `\n⚠️ 目录加载失败的 provider：${names}`,
+    modelShowNoGroups: '\n（当前没有 provider 提供模型）',
+    modelSelectOperatorOnly: '⚠️ 只有 Host 操作员可以切换模型（此操作会切换当前 Session 并更新 Host 默认）。',
+    modelSelectNoModels: '⚠️ 当前没有 provider 提供模型，无法选择。',
+    modelCascadeProviderHeader: (current, extra) => `当前模型：\`${current}\`${extra}\n请选择 provider：`,
+    modelCascadeProviderPlaceholder: '选择 provider',
+    modelCascadeModelHeader: (provider) => `Provider：**${provider}**\n请选择模型：`,
+    modelCascadeModelPlaceholder: '选择模型',
+    modelCascadeReasoningHeader: (model) => `模型：**${model}**\n请选择推理强度：`,
+    modelCascadeReasoningPlaceholder: '选择推理强度',
+    modelCascadeReasoningDefault: '跟随默认',
+    modelCascadeReasoningDefaultHint: '使用 provider/默认推理行为',
+    modelCascadeTruncated: (shown, total) => `（共 ${String(total)} 项，仅显示前 ${String(shown)} 项）`,
+    modelCascadeExpired: '⚠️ 该选择已过期，请重新运行 /model select。',
+    modelApplied: (sel) => `✅ 已应用到当前 Session：\`${sel}\`，并已请求 DSH 记为 Host 默认。`,
+    modelSelectUnknown: '⚠️ 选择结果未知（请求可能未送达），请用 /model show 确认。',
+    modelSelectRejected: (reason) => `⚠️ DSH 拒绝了此次选择：${reason}`,
+    modelNotInCatalog: '⚠️ 该 provider/模型不在当前会话的目录中。',
+    modelInvalidReasoning: '⚠️ 该推理强度对此模型无效。',
+    modelTypedParseFailed: '⚠️ 模型需按 `provider/model` 格式填写，或留空进入交互式选择。',
     // ── approval / question cards ────────────────────────────────────────
     approvalRequired: (label) => `Approval required — ${label}`,
 };
@@ -171,6 +197,32 @@ const en = {
     unboundNoticeAdministrator: '💡 This channel is not bound to a workspace. A workspace administrator can run `/project bind` to create and bind the project channel.',
     unboundNoticeMember: '💡 This channel is not bound to a workspace; ask a workspace administrator to run `/project bind`.',
     interruptedMarker: '*(interrupted)*',
+    // ── /model show / select ─────────────────────────────────────────────
+    modelNeedsThread: '⚠️ /model needs a thread bound to a Session (mention the bot in a project channel first).',
+    modelShowUnavailable: '⚠️ The model catalog is temporarily unavailable; try again later.',
+    modelShowHeader: (sel, groups) => `**Current model:** \`${sel}\`\n**Available providers:** ${String(groups)}`,
+    modelShowReasoning: effort => `\n**Reasoning effort:** \`${effort}\``,
+    modelShowNotRoutable: '\n⚠️ The current provider is not serving requests right now.',
+    modelShowFailures: names => `\n⚠️ Providers failing catalog lookup: ${names}`,
+    modelShowNoGroups: '\n(no providers currently advertise models)',
+    modelSelectOperatorOnly: '⚠️ Only Host operators can switch the model (it switches this Session and updates the Host default).',
+    modelSelectNoModels: '⚠️ No providers currently advertise models; nothing to select.',
+    modelCascadeProviderHeader: (current, extra) => `Current model: \`${current}\`${extra}\nSelect a provider:`,
+    modelCascadeProviderPlaceholder: 'Select a provider',
+    modelCascadeModelHeader: provider => `Provider: **${provider}**\nSelect a model:`,
+    modelCascadeModelPlaceholder: 'Select a model',
+    modelCascadeReasoningHeader: model => `Model: **${model}**\nSelect a reasoning effort:`,
+    modelCascadeReasoningPlaceholder: 'Select a reasoning effort',
+    modelCascadeReasoningDefault: 'Provider default',
+    modelCascadeReasoningDefaultHint: 'Use the provider/default reasoning behavior',
+    modelCascadeTruncated: (shown, total) => `(${String(total)} total, showing the first ${String(shown)})`,
+    modelCascadeExpired: '⚠️ This selection expired; run /model select again.',
+    modelApplied: sel => `✅ Applied to this session: \`${sel}\`. DSH has also been asked to record it as the Host default.`,
+    modelSelectUnknown: '⚠️ The selection outcome is unknown (the request may not have landed); check /model show.',
+    modelSelectRejected: reason => `⚠️ DSH rejected the selection: ${reason}`,
+    modelNotInCatalog: "⚠️ That provider/model is not in this session's catalog.",
+    modelInvalidReasoning: '⚠️ That reasoning effort is not valid for this model.',
+    modelTypedParseFailed: '⚠️ The model must be `provider/model`, or left empty for the interactive cascade.',
     // ── approval / question cards ────────────────────────────────────────
     approvalRequired: label => `Approval required — ${label}`,
 };

package/lib/index.js

@@ -10,7 +10,7 @@ import { createRestThreadPort } from './discord/thread-port.js';
 import { createComponentRegistry } from './discord/components.js';
 import { buildCommandRegistrations } from './discord/commands.js';
 import { startDiscordAdapter } from './compose.js';
-import { createWorkspaceCatalogPort, createWorkspaceResolver, readWorkspaceDetail, promptSession, createSessionViaProxy, cancelSessionViaProxy, steerSession, removeQueueItemViaProxy } from './dsh/api-proxy-face.js';
+import { createModelPort, createWorkspaceCatalogPort, createWorkspaceResolver, readWorkspaceDetail, promptSession, createSessionViaProxy, cancelSessionViaProxy, steerSession, removeQueueItemViaProxy } from './dsh/api-proxy-face.js';
 import { createApprovalStore } from './features/approval-store.js';
 import { createAskWiring } from './features/ask-wiring.js';
 import { sweepExpiredApprovals } from './features/approval-expiry.js';
@@ -700,6 +700,8 @@ export function apply(ctx, config = DEFAULT_DISCORD_SETTINGS) {
                 await channelTable.delete(bindChannelKey(guildId, channelId));
                 rpcLog('discord_reconcile_channel_retired', { channelId, reason: 'discord-deleted' });
             },
+            model: createModelPort(apiProxy, { log: rpcLog }),
+            modelSelectOperatorOnly: () => current.modelSelectOperatorOnly,
             log: rpcLog,
             warn: (event, detail) => {
                 emitLog(ctx, 'warn', { event, detail: typeof detail === 'string' ? detail : JSON.stringify(detail ?? null) });

package/lib/settings.d.ts

@@ -23,6 +23,13 @@ export interface DiscordSettings {
     questionTimeoutMs: number;
     /** Task-thread auto-archive; Discord supports exactly these four values. */
     threadAutoArchiveMinutes: ThreadAutoArchiveMinutes;
+    /**
+     * Restrict /model select to the explicit Host-operator allowlist (the
+     * switch reaches the Host-wide default). Defaults to false — single-user
+     * deployments let any authorized member switch (16.42); set true to
+     * re-tighten to the operator allowlist.
+     */
+    modelSelectOperatorOnly: boolean;
 }
 /** The archive durations Discord's API accepts (minutes). */
 export type ThreadAutoArchiveMinutes = 60 | 1440 | 4320 | 10080;

package/lib/settings.js

@@ -20,6 +20,7 @@ export const DEFAULT_DISCORD_SETTINGS = Object.freeze({
     approvalTimeoutMs: 10 * 60_000,
     questionTimeoutMs: 30 * 60_000,
     threadAutoArchiveMinutes: 1440,
+    modelSelectOperatorOnly: false,
 });
 const discordIdList = z.array(z.string()).default([]);
 export const DiscordSettingsSchema = z.object({
@@ -41,6 +42,7 @@ export const DiscordSettingsSchema = z.object({
     typingIntervalMs: z.number().step(1).min(1_000).max(30_000).default(7_000),
     approvalTimeoutMs: z.number().step(1).min(30_000).max(86_400_000).default(600_000),
     questionTimeoutMs: z.number().step(1).min(30_000).max(86_400_000).default(1_800_000),
+    modelSelectOperatorOnly: z.boolean().default(false),
 });
 const DISCORD_SNOWFLAKE = /^\d{17,20}$/u;
 const ID_FIELDS = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@addozhang/dsh-discord",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Discord-first adapter for DeepSeek Harness",
   "license": "MIT",
   "type": "module",