@orion-agents/orion-code 0.1.1 → 0.1.3

package/dist/commands/index.js

@@ -21,6 +21,7 @@ const ui_view_model_1 = require("../runtime/ui-view-model");
 const task_manager_1 = require("../services/task-manager");
 const agent_runner_1 = require("../services/agent-runner");
 const config_1 = require("../services/config");
+const tool_allowlist_1 = require("../services/tool-allowlist");
 const box_1 = require("../ui/box");
 const stream_markdown_1 = require("../ui/stream-markdown");
 const progress_1 = require("../ui/progress");
@@ -40,7 +41,9 @@ const prompt_context_1 = require("../services/prompt-context");
 const doctor_1 = require("../services/doctor");
 const model_context_1 = require("../services/model-context");
 const token_estimate_1 = require("../utils/token-estimate");
+const mask_1 = require("../utils/mask");
 const model_catalog_1 = require("../services/model-catalog");
+const model_registry_1 = require("../services/model-registry");
 const workspace_diff_1 = require("../services/workspace-diff");
 const commit_plan_1 = require("../services/commit-plan");
 const tool_artifacts_1 = require("../core/tool-artifacts");
@@ -107,8 +110,42 @@ function formatRendererStatus(ctx) {
                     : DIM('custom');
     return `${BRAND(snapshot.renderer.name)} ${status} ${DIM(snapshot.renderer.capabilityLabels.join(', '))}`;
 }
-function formatModelAliasHelp() {
-    return Object.keys((0, model_catalog_1.getModelCatalogAliases)()).sort().join(', ');
+function getProfileByModelId(registry, modelId) {
+    if (!registry)
+        return undefined;
+    const normalized = modelId.trim();
+    if (!normalized)
+        return undefined;
+    if (registry.profiles.has(normalized))
+        return registry.profiles.get(normalized);
+    for (const profile of registry.profiles.values()) {
+        if (modelId === profile.model)
+            return profile;
+    }
+    return undefined;
+}
+function resolveModelFromRegistry(config, selector) {
+    if (!config.modelRegistry)
+        return undefined;
+    const trimmed = selector.trim();
+    if (!trimmed)
+        return undefined;
+    return (0, model_registry_1.lookupProfile)(config.modelRegistry, trimmed) ?? undefined;
+}
+function listConfiguredModelCatalogEntries(registry) {
+    if (!registry)
+        return [];
+    return registry.enabledProfiles.map(profile => {
+        const provider = registry.providers.get(profile.provider);
+        return {
+            name: profile.id,
+            alias: profile.aliases?.[0],
+            provider: provider?.displayName ?? profile.provider,
+            contextWindow: profile.resolvedContextWindow,
+            maxOutputTokens: profile.resolvedMaxOutputTokens,
+            source: `${profile.contextSource}/${profile.outputSource}`,
+        };
+    });
 }
 function formatLoopBudgetSource(stats) {
     const source = stats.loopBudgetSource ?? 'unknown';
@@ -168,9 +205,9 @@ function formatLoopStatsLines(stats, detail = false) {
         ];
         lines.push(`Verify     ${verificationParts.join(' ')}`);
     }
-    if (typeof stats.loopBudgetMaxLlmRequests === 'number'
-        || typeof stats.loopBudgetMaxToolCalls === 'number'
-        || typeof stats.loopBudgetMaxModelVisibleBytes === 'number') {
+    if (typeof stats.loopBudgetMaxLlmRequests === 'number' ||
+        typeof stats.loopBudgetMaxToolCalls === 'number' ||
+        typeof stats.loopBudgetMaxModelVisibleBytes === 'number') {
         const caps = [
             typeof stats.loopBudgetMaxLlmRequests === 'number'
                 ? `${stats.llmRequests}/${stats.loopBudgetMaxLlmRequests} LLM`
@@ -386,7 +423,9 @@ function formatTraceEventLine(event) {
                 event.providerLastRetryErrorType
                     ? `last=${event.providerLastRetryErrorType}${event.providerLastRetryStatus ? `/${event.providerLastRetryStatus}` : ''}`
                     : '',
-                event.providerRetryErrorTypes?.length ? `types=${event.providerRetryErrorTypes.join(',')}` : '',
+                event.providerRetryErrorTypes?.length
+                    ? `types=${event.providerRetryErrorTypes.join(',')}`
+                    : '',
                 event.providerFinalModel ? `final=${event.providerFinalModel}` : '',
             ].filter(Boolean);
             return `${prefix} ${parts.join(' ')}`;
@@ -394,7 +433,7 @@ function formatTraceEventLine(event) {
         case 'provider_fallback': {
             const path = event.providerFallbackFromModel && event.providerFallbackToModel
                 ? `${event.providerFallbackFromModel}->${event.providerFallbackToModel}`
-                : event.providerFinalModel ?? 'active';
+                : (event.providerFinalModel ?? 'active');
             const parts = [
                 `count=${event.providerFallbackCount ?? 0}`,
                 `path=${path}`,
@@ -464,13 +503,13 @@ function formatTraceEventLine(event) {
                 `llm=${typeof event.llmRequests === 'number' ? event.llmRequests : 'unknown'}`,
                 `tools=${typeof event.toolCalls === 'number' ? event.toolCalls : 'unknown'}`,
             ];
-            if (event.loopBudgetSource
-                || typeof event.loopBudgetMaxLlmRequests === 'number'
-                || typeof event.loopBudgetMaxToolCalls === 'number'
-                || typeof event.loopBudgetMaxModelVisibleBytes === 'number') {
+            if (event.loopBudgetSource ||
+                typeof event.loopBudgetMaxLlmRequests === 'number' ||
+                typeof event.loopBudgetMaxToolCalls === 'number' ||
+                typeof event.loopBudgetMaxModelVisibleBytes === 'number') {
                 const source = event.loopBudgetSource === 'config' && event.loopBudgetBaseProfile
                     ? `config/${event.loopBudgetBaseProfile}`
-                    : event.loopBudgetSource ?? 'unknown';
+                    : (event.loopBudgetSource ?? 'unknown');
                 const caps = [
                     typeof event.loopBudgetMaxLlmRequests === 'number'
                         ? `${typeof event.llmRequests === 'number' ? event.llmRequests : '?'}/${event.loopBudgetMaxLlmRequests}llm`
@@ -503,7 +542,9 @@ function formatTraceEventLine(event) {
         case 'workspace_snapshot': {
             const state = event.workspaceGitAvailable === false
                 ? WARN('not-git')
-                : event.workspaceDirty ? WARN('dirty') : SUCCESS('clean');
+                : event.workspaceDirty
+                    ? WARN('dirty')
+                    : SUCCESS('clean');
             const files = event.workspaceFiles?.length
                 ? ` files=${event.workspaceFiles.slice(0, 6).join(', ')}${event.workspaceFiles.length > 6 ? ', ...' : ''}`
                 : '';
@@ -522,11 +563,21 @@ function formatTraceEventLine(event) {
                 `resolved=${resolved.length}`,
             ];
             const details = [
-                added.length ? `new: ${added.slice(0, 6).join(', ')}${added.length > 6 ? ', ...' : ''}` : '',
-                changed.length ? `changed: ${changed.slice(0, 6).join(', ')}${changed.length > 6 ? ', ...' : ''}` : '',
-                modifiedPreExisting.length ? `pre-existing modified: ${modifiedPreExisting.slice(0, 6).join(', ')}${modifiedPreExisting.length > 6 ? ', ...' : ''}` : '',
-                resolved.length ? `resolved: ${resolved.slice(0, 6).join(', ')}${resolved.length > 6 ? ', ...' : ''}` : '',
-            ].filter(Boolean).join(' | ');
+                added.length
+                    ? `new: ${added.slice(0, 6).join(', ')}${added.length > 6 ? ', ...' : ''}`
+                    : '',
+                changed.length
+                    ? `changed: ${changed.slice(0, 6).join(', ')}${changed.length > 6 ? ', ...' : ''}`
+                    : '',
+                modifiedPreExisting.length
+                    ? `pre-existing modified: ${modifiedPreExisting.slice(0, 6).join(', ')}${modifiedPreExisting.length > 6 ? ', ...' : ''}`
+                    : '',
+                resolved.length
+                    ? `resolved: ${resolved.slice(0, 6).join(', ')}${resolved.length > 6 ? ', ...' : ''}`
+                    : '',
+            ]
+                .filter(Boolean)
+                .join(' | ');
             return `${prefix} ${parts.join(' ')}${details ? ` ${DIM(details)}` : ''}${event.note ? ` ${DIM(event.note)}` : ''}`;
         }
         case 'verification_profile': {
@@ -617,7 +668,10 @@ function latestToolTrace(events) {
         const call = event.type === 'tool_call'
             ? event
             : callId
-                ? events.slice(0, index).reverse().find(candidate => candidate.type === 'tool_call' && candidate.callId === callId)
+                ? events
+                    .slice(0, index)
+                    .reverse()
+                    .find(candidate => candidate.type === 'tool_call' && candidate.callId === callId)
                 : undefined;
         return { call, result };
     }
@@ -776,9 +830,7 @@ function handleLastTool(ctx, args = '') {
         for (const pair of pairs.slice(-30)) {
             const source = pair.result ?? pair.call;
             const name = source?.name ?? 'tool';
-            const status = pair.result
-                ? (pair.result.success === false ? '✗' : '✓')
-                : '…';
+            const status = pair.result ? (pair.result.success === false ? '✗' : '✓') : '…';
             const duration = typeof pair.result?.duration === 'number'
                 ? ` (${formatDurationMs(pair.result.duration)})`
                 : '';
@@ -796,7 +848,11 @@ function handleLastTool(ctx, args = '') {
     const name = source?.name ?? 'tool';
     const inputLabel = lastToolInputLabel(name);
     const callId = source?.callId ?? call?.callId;
-    const status = result ? (result.success === false ? ERROR('error') : SUCCESS('ok')) : WARN('running');
+    const status = result
+        ? result.success === false
+            ? ERROR('error')
+            : SUCCESS('ok')
+        : WARN('running');
     // Resolve sequence number from the trace events
     let seqLabel = '';
     if (options.ref && /^#?\d+$/.test(options.ref)) {
@@ -958,7 +1014,10 @@ function handleCheckpoint(ctx, args = '') {
         }
         for (const checkpoint of checkpoints.slice(0, 20)) {
             console.log(`${ACCENT(checkpoint.turnId)} ${DIM(formatDateTime(checkpoint.createdAt))}`);
-            const files = checkpoint.files.map(file => file.path).slice(0, 8).join(', ');
+            const files = checkpoint.files
+                .map(file => file.path)
+                .slice(0, 8)
+                .join(', ');
             console.log(`  ${DIM(`${checkpoint.files.length} file(s)${files ? `: ${files}` : ''}`)}`);
         }
         console.log();
@@ -977,9 +1036,7 @@ function handleCheckpoint(ctx, args = '') {
     }
     const { checkpoint, ambiguous } = findCheckpointByRef(ctx, ref);
     if (!checkpoint) {
-        console.log(ERROR(ambiguous
-            ? `Checkpoint prefix is ambiguous: ${ref}`
-            : `Checkpoint not found: ${ref}`));
+        console.log(ERROR(ambiguous ? `Checkpoint prefix is ambiguous: ${ref}` : `Checkpoint not found: ${ref}`));
         console.log(DIM('Run /checkpoint to list available checkpoint ids.'));
         return { success: false };
     }
@@ -1299,19 +1356,35 @@ function showConfig(ctx) {
     console.log();
     console.log(HEADER('Configuration'));
     console.log(DIM('─'.repeat(40)));
+    const allowlist = (0, tool_allowlist_1.resolveProjectToolAllowlist)(ctx.cwd);
+    const allowlistSummary = allowlist.rules.length === 0 && allowlist.invalid.length === 0
+        ? '(none)'
+        : `${allowlist.rules.length} rule(s)` +
+            (allowlist.invalid.length > 0 ? `, ${allowlist.invalid.length} invalid (ignored)` : '');
     const summary = {
         name: ctx.config.name,
         model: ctx.config.model,
         apiBaseUrl: ctx.config.apiBaseUrl || '(default OpenAI)',
-        apiKey: ctx.config.apiKey ? `${ctx.config.apiKey.slice(0, 7)}***` : '(not set)',
+        apiKey: (0, mask_1.maskSecret)(ctx.config.apiKey),
         mode: ctx.config.mode,
         logLevel: ctx.config.logLevel,
         toolConfirmation: ctx.config.toolConfirmation,
+        allowedTools: allowlistSummary,
     };
     const llmSummary = ctx.llm?.getConfigSummary() ?? {};
     for (const [key, val] of Object.entries(summary)) {
         console.log(`  ${ACCENT(key.padEnd(16))} ${DIM(val)}`);
     }
+    if (allowlist.rules.length > 0 || allowlist.invalid.length > 0) {
+        console.log();
+        console.log(HEADER('  Project allowedTools:'));
+        for (const rule of allowlist.rules) {
+            console.log(`  ${ACCENT(rule.effect.padEnd(6))} ${DIM(rule.tool)}${DIM(rule.pattern ? `(${rule.pattern})` : '')}`);
+        }
+        for (const entry of allowlist.invalid) {
+            console.log(`  ${WARN('invalid')} ${DIM(entry)}`);
+        }
+    }
     console.log();
     console.log(HEADER('  LLM Settings:'));
     for (const [key, val] of Object.entries(llmSummary)) {
@@ -1326,14 +1399,29 @@ function handleModel(ctx, args) {
     if (!args || trimmedArgs === '?' || trimmedArgs === 'info') {
         console.log();
         if (ctx.llm) {
-            const currentModel = ctx.llm.getModel();
+            const currentModel = ctx.store.getSnapshot().currentModel || ctx.llm.getModel();
+            const profile = getProfileByModelId(ctx.config.modelRegistry, currentModel);
             const aliasEntry = (0, model_catalog_1.getModelCatalogEntry)(currentModel);
-            const contextInfo = (0, model_context_1.resolveModelContext)(currentModel);
+            const contextInfo = profile
+                ? {
+                    id: profile.model,
+                    label: profile.displayName || profile.id,
+                    contextWindow: profile.resolvedContextWindow,
+                    maxOutputTokens: profile.resolvedMaxOutputTokens,
+                    source: 'config',
+                    matchedId: profile.model,
+                }
+                : (0, model_context_1.resolveModelContext)(currentModel);
             const compactStats = getCommandAutoCompact(ctx, currentModel).getStats();
             console.log(HEADER('Current Model'));
             console.log(DIM('─'.repeat(40)));
             console.log(`  Model    ${BRAND(currentModel)}`);
-            if (aliasEntry) {
+            if (profile) {
+                console.log(`  Alias    ${ACCENT(profile.aliases?.[0] ? `(${profile.aliases[0]})` : 'none')}`);
+                const provider = ctx.config.modelRegistry?.providers.get(profile.provider);
+                console.log(`  Provider ${DIM(provider?.displayName || profile.provider)}`);
+            }
+            else if (aliasEntry) {
                 console.log(`  Alias    ${ACCENT(aliasEntry.alias)}`);
                 console.log(`  Provider ${DIM(aliasEntry.provider)}`);
             }
@@ -1350,49 +1438,12 @@ function handleModel(ctx, args) {
         console.log();
         return { success: true };
     }
-    // 显示模型列表
-    if (trimmedArgs === 'list' || trimmedArgs === 'ls') {
+    // /model list|ls|help 已移除，统一由 /models 承接（交互式选择切换）
+    if (trimmedArgs === 'list' || trimmedArgs === 'ls' || trimmedArgs === 'help') {
         console.log();
-        console.log(HEADER('Available Models'));
-        console.log(DIM('─'.repeat(40)));
-        const currentModel = ctx.llm?.getModel() || '';
-        const modelPicker = (0, ui_view_model_1.createModelPickerState)({
-            currentModel,
-            models: (0, model_catalog_1.listModelCatalogEntries)().map(model => {
-                const contextInfo = (0, model_context_1.resolveModelContext)(model.name);
-                return {
-                    ...model,
-                    contextWindow: contextInfo.contextWindow,
-                    maxOutputTokens: contextInfo.maxOutputTokens,
-                    source: contextInfo.source,
-                };
-            }),
-        });
-        for (const item of modelPicker.visibleItems) {
-            const marker = item.isCurrent ? SUCCESS('●') : DIM('○');
-            const alias = item.alias ? `(${item.alias})` : '';
-            const context = `${formatTokenCount(item.contextWindow ?? 0)} ctx`;
-            const current = item.isCurrent ? BRAND('(current)') : '';
-            console.log(`  ${marker} ${ACCENT(item.name)} ${DIM(alias)} ${DIM(context)} ${current}`);
-            console.log(`      ${DIM(item.provider ?? 'unknown')}`);
-        }
-        console.log();
-        console.log(DIM('Use /model <name|alias> to switch, e.g. /model sonnet'));
-        console.log();
-        return { success: true };
-    }
-    // 显示帮助
-    if (trimmedArgs === 'help') {
-        console.log();
-        console.log(HEADER('/model Command Help'));
-        console.log(DIM('─'.repeat(40)));
-        console.log();
-        console.log(`  ${ACCENT('/model')}           Show current model`);
-        console.log(`  ${ACCENT('/model list')}      Show available models`);
-        console.log(`  ${ACCENT('/model <name>')}    Switch to specific model`);
-        console.log(`  ${ACCENT('/model <alias>')}   Switch using alias (opus, sonnet, haiku)`);
-        console.log();
-        console.log(DIM(`Aliases: ${formatModelAliasHelp()}`));
+        console.log(WARN(`/model ${trimmedArgs} was removed.`));
+        console.log(DIM('Use /models to switch models interactively,'));
+        console.log(DIM('or /model <name|alias> to switch directly, e.g. /model sonnet'));
         console.log();
         return { success: true };
     }
@@ -1403,21 +1454,83 @@ function handleModel(ctx, args) {
         return { success: false };
     }
     // 解析别名
-    const resolvedModel = (0, model_catalog_1.resolveModelAlias)(args);
+    const registryProfile = resolveModelFromRegistry(ctx.config, args);
+    const resolvedModel = registryProfile ? registryProfile.model : (0, model_catalog_1.resolveModelAlias)(args);
+    const resolvedProfileId = registryProfile ? registryProfile.id : resolvedModel;
     ctx.llm.setModel(resolvedModel);
     getCommandAutoCompact(ctx, resolvedModel);
-    ctx.store.setState({ currentModel: resolvedModel });
-    console.log(SUCCESS(`✔ Model changed to ${BRAND(resolvedModel)}`));
-    const contextInfo = (0, model_context_1.resolveModelContext)(resolvedModel);
+    ctx.store.setState({ currentModel: resolvedProfileId });
+    console.log(SUCCESS(`✔ Model changed to ${BRAND(resolvedProfileId)}`));
+    const contextInfo = registryProfile
+        ? {
+            contextWindow: registryProfile.resolvedContextWindow,
+            maxOutputTokens: registryProfile.resolvedMaxOutputTokens,
+            source: 'resolved',
+        }
+        : (0, model_context_1.resolveModelContext)(resolvedModel);
     console.log(DIM(`  Context window ${formatTokenCount(contextInfo.contextWindow)} tokens (${contextInfo.source})`));
     console.log();
     return { success: true };
 }
+/**
+ * /models — 交互式选择切换模型。
+ * 交互式渲染器返回结构化 modelPicker 请求（渲染器弹出选择层，选中即 /model <id>）；
+ * 非交互式渲染器直接打印候选列表并提示 /model <name|alias>。
+ */
+function handleModels(ctx, _args) {
+    console.log();
+    const currentModel = ctx.store.getSnapshot().currentModel || ctx.llm?.getModel() || '';
+    const configuredModels = listConfiguredModelCatalogEntries(ctx.config.modelRegistry);
+    const candidates = configuredModels.length > 0
+        ? configuredModels
+        : (0, model_catalog_1.listModelCatalogEntries)().map(model => {
+            const contextInfo = (0, model_context_1.resolveModelContext)(model.name);
+            return {
+                name: model.name,
+                alias: model.alias,
+                provider: model.provider,
+                contextWindow: contextInfo.contextWindow,
+                maxOutputTokens: contextInfo.maxOutputTokens,
+                source: contextInfo.source,
+            };
+        });
+    const ui = commandUICapabilities(ctx);
+    if (ui.structuredPickers) {
+        return {
+            success: true,
+            modelPicker: {
+                models: candidates,
+                currentModel,
+                title: 'Switch Model',
+                maxVisibleItems: 12,
+            },
+        };
+    }
+    // 非交互式渲染器：打印候选列表
+    console.log(HEADER('Available Models'));
+    console.log(DIM('─'.repeat(40)));
+    const modelPicker = (0, ui_view_model_1.createModelPickerState)({ currentModel, models: candidates });
+    for (const item of modelPicker.visibleItems) {
+        const marker = item.isCurrent ? SUCCESS('●') : DIM('○');
+        const alias = item.alias ? `(${item.alias})` : '';
+        const context = `${formatTokenCount(item.contextWindow ?? 0)} ctx`;
+        const current = item.isCurrent ? BRAND('(current)') : '';
+        console.log(`  ${marker} ${ACCENT(item.name)} ${DIM(alias)} ${DIM(context)} ${current}`);
+        console.log(`      ${DIM(item.provider ?? 'unknown')}`);
+    }
+    console.log();
+    console.log(DIM('Use /model <name|alias> to switch, e.g. /model sonnet'));
+    console.log();
+    return { success: true };
+}
 function normalizePermissionMode(raw) {
     const value = raw.trim().toLowerCase();
     if (!value)
         return null;
-    if (value === 'accept' || value === 'acceptedits' || value === 'accept-edits' || value === 'edit') {
+    if (value === 'accept' ||
+        value === 'acceptedits' ||
+        value === 'accept-edits' ||
+        value === 'edit') {
         return 'acceptEdits';
     }
     if (value === 'default' || value === 'ask')
@@ -1445,9 +1558,7 @@ function handleMode(ctx, args) {
         console.log();
         return { success: true };
     }
-    const next = trimmed === 'next'
-        ? (0, types_1.getNextPermissionMode)(current)
-        : normalizePermissionMode(trimmed);
+    const next = trimmed === 'next' ? (0, types_1.getNextPermissionMode)(current) : normalizePermissionMode(trimmed);
     if (!next || !types_1.PERMISSION_MODES.includes(next)) {
         return {
             success: false,
@@ -1481,10 +1592,14 @@ function handleTask(ctx, args) {
         if (tasks.length > 0) {
             console.log();
             for (const t of tasks) {
-                const statusIcon = t.status === 'completed' ? SUCCESS('✓')
-                    : t.status === 'failed' ? ERROR('✗')
-                        : t.status === 'running' ? WARN('◌')
-                            : t.status === 'cancelled' ? DIM('⊘')
+                const statusIcon = t.status === 'completed'
+                    ? SUCCESS('✓')
+                    : t.status === 'failed'
+                        ? ERROR('✗')
+                        : t.status === 'running'
+                            ? WARN('◌')
+                            : t.status === 'cancelled'
+                                ? DIM('⊘')
                                 : DIM('○');
                 console.log(`  ${statusIcon} ${ACCENT(t.name)} ${DIM(`(${t.id.slice(0, 8)})`)}`);
                 console.log(`    ${DIM(`[${t.priority}]`)} ${t.description.slice(0, 60)}`);
@@ -1583,7 +1698,9 @@ async function handleChat(ctx, input) {
         console.log();
         return { success: false };
     }
-    const activeSession = ctx.getSession?.() ?? ctx.ensureSession?.() ?? (ctx.sessionId ? (0, session_storage_1.loadSessionMeta)(ctx.sessionId) : null);
+    const activeSession = ctx.getSession?.() ??
+        ctx.ensureSession?.() ??
+        (ctx.sessionId ? (0, session_storage_1.loadSessionMeta)(ctx.sessionId) : null);
     const sessionId = activeSession?.id ?? ctx.sessionId;
     const runtimeTools = (0, tools_1.getRuntimeTools)();
     const skillResolution = (0, skills_1.resolveSkillsForTurn)({
@@ -1693,7 +1810,10 @@ async function handleChat(ctx, input) {
         },
     };
     try {
-        const messages = [{ role: 'system', content: systemPrompt }, ...snapshot.conversationHistory];
+        const messages = [
+            { role: 'system', content: systemPrompt },
+            ...snapshot.conversationHistory,
+        ];
         for await (const event of (0, framework_1.query)({
             messages,
             tools: skillResolution.tools,
@@ -1703,6 +1823,7 @@ async function handleChat(ctx, input) {
             costTracker: snapshot.costTracker,
             permissionMode: snapshot.permissionMode,
             toolConfirmation: ctx.config.toolConfirmation,
+            toolAllowlist: (0, tool_allowlist_1.resolveProjectToolAllowlist)(ctx.cwd).evaluator,
             toolContext: {
                 cwd: ctx.cwd,
                 config: {
@@ -1839,7 +1960,9 @@ async function handleChat(ctx, input) {
             const stats = [
                 finalUsage ? `tokens: ${finalUsage.promptTokens}+${finalUsage.completionTokens}` : '',
                 finalModel ? finalModel : '',
-            ].filter(Boolean).join('  ');
+            ]
+                .filter(Boolean)
+                .join('  ');
             if (stats) {
                 writeLine(DIM(stats));
             }
@@ -1982,13 +2105,13 @@ function handleSkill(ctx, args) {
     const registry = (0, skills_1.getSkillsRegistry)();
     registry.initialize();
     if (!trimmed) {
-        const names = registry.getAllSkills().map(skill => skill.name).sort();
+        const names = registry
+            .getAllSkills()
+            .map(skill => skill.name)
+            .sort();
         return {
             success: false,
-            error: [
-                'Usage: /skill <name> <task>',
-                `Loaded skills: ${names.join(', ') || 'none'}`,
-            ].join('\n'),
+            error: ['Usage: /skill <name> <task>', `Loaded skills: ${names.join(', ') || 'none'}`].join('\n'),
         };
     }
     const parsed = (0, skills_1.parseSkillCommandInput)(`/skill ${trimmed}`);
@@ -2001,11 +2124,13 @@ function handleSkill(ctx, args) {
             error: `Invalid skill reference: ${parsed.skillPath}`,
         };
     }
-    const skill = referencedSkill || registry.getAllSkills()
-        .find(candidate => (0, skills_1.skillActivationNames)(candidate)
-        .some(name => (0, skills_1.normalizeRequestedSkillName)(name) === requestedName));
+    const skill = referencedSkill ||
+        registry
+            .getAllSkills()
+            .find(candidate => (0, skills_1.skillActivationNames)(candidate).some(name => (0, skills_1.normalizeRequestedSkillName)(name) === requestedName));
     if (!skill) {
-        const suggestions = registry.getAllSkills()
+        const suggestions = registry
+            .getAllSkills()
             .map(candidate => candidate.name)
             .filter(name => name.includes(requestedName) || requestedName.includes(name))
             .slice(0, 5);
@@ -2035,7 +2160,9 @@ function handleSkill(ctx, args) {
                 skillFile ? `SKILL.md ${skillFile}` : '',
                 resourceRoot ? `Root     ${resourceRoot}` : '',
                 `Use: /skill ${usageSelector} <task>`,
-            ].filter(Boolean).join('\n'),
+            ]
+                .filter(Boolean)
+                .join('\n'),
         };
     }
     return {
@@ -2080,54 +2207,103 @@ function handleDoctor(ctx) {
     return { success: !(0, doctor_1.hasDoctorFailures)(report) };
 }
 function handleStorage(_ctx, args) {
+    const usage = '/storage [doctor|status|repair [--dry-run|--yes] [--plan=<token>]|cleanup [--dry-run|--yes] [--plan=<token>]]';
     const trimmed = args.trim();
-    const [action = 'doctor'] = trimmed.split(/\s+/);
-    const confirmed = hasCommandFlag(trimmed, '--yes');
+    const tokens = trimmed ? trimmed.split(/\s+/u) : [];
+    const action = tokens[0] ?? 'doctor';
+    const flags = tokens.slice(1);
+    const acceptsMutationFlags = action === 'cleanup' || action === 'repair';
+    const planFlags = flags.filter(flag => flag.startsWith('--plan='));
+    const invalidTokens = flags.filter(flag => !acceptsMutationFlags ||
+        (flag !== '--dry-run' && flag !== '--yes' && !flag.startsWith('--plan=')) ||
+        (flag.startsWith('--plan=') && flag.length === '--plan='.length));
+    if (planFlags.length > 1)
+        invalidTokens.push(...planFlags.slice(1));
+    if (invalidTokens.length > 0) {
+        return {
+            success: false,
+            error: `Unknown /storage option: ${invalidTokens.join(', ')}. Usage: ${usage}`,
+        };
+    }
+    const confirmed = flags.includes('--yes');
+    const explicitDryRun = flags.includes('--dry-run');
+    const planToken = planFlags[0]?.slice('--plan='.length);
+    const decodedPlan = planToken ? (0, storage_maintenance_1.deserializeStorageMaintenancePlan)(planToken) : undefined;
+    if (planToken && !decodedPlan) {
+        return { success: false, error: `Invalid or corrupted storage plan token. Usage: ${usage}` };
+    }
     if (action === 'cleanup') {
-        const dryRun = hasCommandFlag(trimmed, '--dry-run') || !confirmed;
-        const result = (0, storage_maintenance_1.cleanupStorage)({ dryRun });
+        if (decodedPlan && decodedPlan.kind !== 'cleanup') {
+            return { success: false, error: 'The supplied storage plan is not a cleanup plan.' };
+        }
+        const dryRun = explicitDryRun || !confirmed;
+        if (!dryRun && !decodedPlan) {
+            return {
+                success: false,
+                error: 'Cleanup requires the exact preview plan. Run /storage cleanup first.',
+            };
+        }
+        const consumedPlan = !dryRun && planToken ? (0, storage_maintenance_1.consumeStorageMaintenancePlan)(planToken) : undefined;
+        if (!dryRun && (!consumedPlan || consumedPlan.kind !== 'cleanup')) {
+            return {
+                success: false,
+                error: 'The storage cleanup plan expired, was already used, or is not valid in this process.',
+            };
+        }
+        const plan = dryRun
+            ? decodedPlan?.kind === 'cleanup'
+                ? decodedPlan.plan
+                : (0, storage_maintenance_1.collectStorageCleanupPlan)()
+            : consumedPlan
+                .plan;
+        const result = (0, storage_maintenance_1.cleanupStorage)({ dryRun }, plan);
         console.log();
         console.log((0, storage_maintenance_1.formatStorageCleanupResult)(result));
-        if (!confirmed) {
-            console.log(DIM('Preview only. Run /storage cleanup --yes to apply these deletions.'));
+        if (dryRun) {
+            const portablePlan = planToken ?? (0, storage_maintenance_1.serializeStorageMaintenancePlan)({ kind: 'cleanup', plan });
+            console.log(DIM(`Preview only. Run /storage cleanup --plan=${portablePlan} --yes to apply this plan.`));
         }
         console.log();
         return { success: true };
     }
     if (action === 'repair') {
-        if (!confirmed) {
-            const report = (0, storage_maintenance_1.collectStorageReport)();
-            const repairable = report.issues.filter(issue => issue.kind === 'missing-project-metadata' || issue.kind === 'invalid-project-metadata');
+        if (decodedPlan && decodedPlan.kind !== 'repair') {
+            return { success: false, error: 'The supplied storage plan is not a repair plan.' };
+        }
+        const plan = decodedPlan?.kind === 'repair' ? decodedPlan.plan : (0, storage_maintenance_1.collectProjectMetadataRepairPlan)();
+        if (explicitDryRun || !confirmed) {
             console.log();
             console.log(HEADER('Orion Code Storage Repair Preview'));
             console.log(DIM('─'.repeat(40)));
-            console.log(`  Repairable metadata entries ${ACCENT(String(repairable.length))}`);
-            for (const issue of repairable.slice(0, 12)) {
-                console.log(`  ${DIM('•')} ${DIM(issue.path ?? issue.projectKey ?? issue.kind)}`);
+            console.log(`  Repairable metadata entries ${ACCENT(String(plan.actions.length))}`);
+            for (const action of plan.actions.slice(0, 12)) {
+                console.log(`  ${DIM('•')} ${DIM(action.metadataPath)}`);
             }
-            console.log(DIM('  Preview only. Run /storage repair --yes to apply metadata changes.'));
+            const portablePlan = planToken ?? (0, storage_maintenance_1.serializeStorageMaintenancePlan)({ kind: 'repair', plan });
+            console.log(DIM(`  Preview only. Writable repair is disabled; /storage repair --plan=${portablePlan} --yes will fail closed.`));
             console.log();
             return { success: true };
         }
-        const result = (0, storage_maintenance_1.repairProjectMetadata)();
-        console.log();
-        console.log(HEADER('Orion Code Storage Repair'));
-        console.log(DIM('─'.repeat(40)));
-        console.log(`  Repaired ${ACCENT(String(result.repaired.length))}`);
-        console.log(`  Skipped  ${DIM(String(result.skipped.length))}`);
-        for (const project of result.repaired.slice(0, 12)) {
-            console.log(`  ${SUCCESS('✓')} ${DIM(project)}`);
+        if (!decodedPlan) {
+            return {
+                success: false,
+                error: 'Repair requires the exact preview plan. Run /storage repair first.',
+            };
         }
-        if (result.repaired.length > 12) {
-            console.log(DIM(`  ... ${result.repaired.length - 12} more`));
+        const consumedPlan = planToken ? (0, storage_maintenance_1.consumeStorageMaintenancePlan)(planToken) : undefined;
+        if (!consumedPlan || consumedPlan.kind !== 'repair') {
+            return {
+                success: false,
+                error: 'The storage repair plan expired, was already used, or is not valid in this process.',
+            };
         }
-        console.log();
-        return { success: true };
+        const result = (0, storage_maintenance_1.repairProjectMetadata)(consumedPlan.plan);
+        return { success: false, error: result.blockedReason };
     }
     if (action !== 'doctor' && action !== 'status') {
         return {
             success: false,
-            error: 'Usage: /storage [doctor|status|repair [--yes]|cleanup [--dry-run|--yes]]',
+            error: `Usage: ${usage}`,
         };
     }
     const report = (0, storage_maintenance_1.collectStorageReport)();
@@ -2155,9 +2331,7 @@ function handleCommitPlan(ctx, args) {
     return { success: plan.diff.isGitRepo };
 }
 function handleTools(ctx) {
-    const tools = ctx.store.getSnapshot().tools.length > 0
-        ? ctx.store.getSnapshot().tools
-        : (0, tools_1.getRuntimeTools)();
+    const tools = ctx.store.getSnapshot().tools.length > 0 ? ctx.store.getSnapshot().tools : (0, tools_1.getRuntimeTools)();
     const staticTools = tools.filter(tool => !tool.name.startsWith('mcp__'));
     const mcpTools = tools.filter(tool => tool.name.startsWith('mcp__'));
     console.log();
@@ -2190,8 +2364,10 @@ function handleTodos(ctx) {
         return { success: true };
     }
     for (const todo of todos) {
-        const marker = todo.status === 'completed' ? SUCCESS('✓')
-            : todo.status === 'in_progress' ? WARN('›')
+        const marker = todo.status === 'completed'
+            ? SUCCESS('✓')
+            : todo.status === 'in_progress'
+                ? WARN('›')
                 : DIM('○');
         console.log(`  ${marker} ${todo.content}`);
         if (todo.activeForm && todo.activeForm !== todo.content) {
@@ -2250,13 +2426,14 @@ async function handleCompact(ctx, args) {
     console.log(DIM((0, agent_status_1.compactStatus)()));
     try {
         const modelId = ctx.llm?.getModel() ?? ctx.store.getSnapshot().currentModel;
-        const coordinator = ctx.compactCoordinator ?? new coordinator_1.CompactCoordinator({
-            modelId,
-            llm: ctx.llm,
-            outputReserveTokens: ctx.llm?.getMaxTokens?.(),
-            getContextCapsule: () => ctx.store.getSnapshot().harnessState?.capsule,
-            getHarnessState: () => ctx.store.getSnapshot().harnessState,
-        });
+        const coordinator = ctx.compactCoordinator ??
+            new coordinator_1.CompactCoordinator({
+                modelId,
+                llm: ctx.llm,
+                outputReserveTokens: ctx.llm?.getMaxTokens?.(),
+                getContextCapsule: () => ctx.store.getSnapshot().harnessState?.capsule,
+                getHarnessState: () => ctx.store.getSnapshot().harnessState,
+            });
         coordinator.configure({
             modelId,
             llm: ctx.llm,
@@ -2470,9 +2647,7 @@ function handleSessions(ctx, args = '') {
     const query = scope.query?.trim();
     // If there's a search query, use the session index
     if (query && !query.startsWith('--')) {
-        const allSessions = scope.allProjects
-            ? (0, session_storage_1.listSessions)()
-            : (0, session_storage_1.listProjectSessions)(scope.projectPath);
+        const allSessions = scope.allProjects ? (0, session_storage_1.listSessions)() : (0, session_storage_1.listProjectSessions)(scope.projectPath);
         const matchedIds = (0, session_index_1.searchSessions)(query, allSessions.map(session => ({
             id: session.id,
             projectPath: session.projectPath,
@@ -2489,12 +2664,18 @@ function handleSessions(ctx, args = '') {
         }
         // Rebuild session list in matched order
         const sessionMap = new Map(allSessions.map(s => [s.id, s]));
-        const matchedSessions = matchedIds.map(id => sessionMap.get(id)).filter(Boolean);
+        const matchedSessions = matchedIds
+            .map(id => sessionMap.get(id))
+            .filter(Boolean);
         console.log();
         console.log(HEADER(`Sessions (search: "${query}") — ${matchedSessions.length} matches`));
         console.log(DIM('─'.repeat(40)));
         console.log();
-        printSessionRows(matchedSessions, { indexed: true, showProject: scope.allProjects, showIndexSummary: true });
+        printSessionRows(matchedSessions, {
+            indexed: true,
+            showProject: scope.allProjects,
+            showIndexSummary: true,
+        });
         console.log();
         console.log(DIM(`Searched ${allSessions.length} sessions, found ${matchedSessions.length} matches`));
         console.log(DIM('Use /resume <number|session-id|name> to restore a session'));
@@ -2525,8 +2706,7 @@ function handleResume(ctx, args) {
     const ui = commandUICapabilities(ctx);
     const scope = parseSessionScopeArgs(args, ctx.cwd);
     const sessionRef = scope.query;
-    const scopedSessions = (scope.allProjects ? (0, session_storage_1.listSessions)() : (0, session_storage_1.listProjectSessions)(scope.projectPath))
-        .filter(session => (session.messageCount ?? 0) > 0);
+    const scopedSessions = (scope.allProjects ? (0, session_storage_1.listSessions)() : (0, session_storage_1.listProjectSessions)(scope.projectPath)).filter(session => (session.messageCount ?? 0) > 0);
     if (!sessionRef) {
         const lastSession = scopedSessions[0];
         if (!lastSession) {
@@ -2564,14 +2744,18 @@ function handleResume(ctx, args) {
         return restoreSession(ctx, scopedSessions[pickerIndex], false);
     }
     // Resume specific session
-    const result = (0, session_storage_1.lookupSessionRef)(sessionRef, scope.projectPath, { allProjects: scope.allProjects });
+    const result = (0, session_storage_1.lookupSessionRef)(sessionRef, scope.projectPath, {
+        allProjects: scope.allProjects,
+    });
     if (result.status === 'ambiguous') {
         printSessionConflict(sessionRef, result.matches);
         return { success: false };
     }
     if (result.status === 'not_found') {
         console.log(ERROR(`Session not found: ${sessionRef}`));
-        console.log(DIM(scope.allProjects ? 'Use /sessions --all to list sessions' : 'Use /sessions to list project sessions, or /resume <id> --all'));
+        console.log(DIM(scope.allProjects
+            ? 'Use /sessions --all to list sessions'
+            : 'Use /sessions to list project sessions, or /resume <id> --all'));
         console.log();
         return { success: false };
     }
@@ -2596,7 +2780,9 @@ function restoreSession(ctx, session, isLast) {
     if (history.length > 0) {
         const eventSummary = checkpoint?.summary.text ?? generateRestoredSessionEventSummary(history);
         ctx.store.setState({ conversationHistory: history });
-        ctx.store.setState({ harnessState: (0, session_storage_1.loadSessionHarnessState)(resumed.id) ?? resumed.harnessState });
+        ctx.store.setState({
+            harnessState: (0, session_storage_1.loadSessionHarnessState)(resumed.id) ?? resumed.harnessState,
+        });
         (0, framework_1.resetToolState)();
         ctx.sessionRestored?.({
             sessionId: resumed.id,
@@ -2674,7 +2860,9 @@ function handleSessionRename(ctx, args) {
         console.log();
         return { success: false };
     }
-    const scopedSessions = scope.allProjects ? (0, session_storage_1.listSessions)() : (0, session_storage_1.listProjectSessions)(scope.projectPath);
+    const scopedSessions = scope.allProjects
+        ? (0, session_storage_1.listSessions)()
+        : (0, session_storage_1.listProjectSessions)(scope.projectPath);
     const pickerIndex = parsePickerIndex(ref, scopedSessions.length);
     let session = pickerIndex !== null ? scopedSessions[pickerIndex] : null;
     if (!session) {
@@ -2685,7 +2873,9 @@ function handleSessionRename(ctx, args) {
         }
         if (result.status === 'not_found') {
             console.log(ERROR(`Session not found: ${ref}`));
-            console.log(DIM(scope.allProjects ? 'Use /sessions --all to list sessions' : 'Use /sessions to list project sessions'));
+            console.log(DIM(scope.allProjects
+                ? 'Use /sessions --all to list sessions'
+                : 'Use /sessions to list project sessions'));
             console.log();
             return { success: false };
         }
@@ -2844,7 +3034,7 @@ const COMMANDS = [
         name: 'target',
         aliases: ['goal'],
         description: 'Create, view, pause, resume, or clear a persistent goal target',
-        argumentHint: '[objective | pause | resume | clear --yes | status | edit <text> | budget <tokens>]',
+        argumentHint: '[objective | pause | resume | clear --yes | status | edit <text> | replace <text> | confirm <criterion-id> | budget <tokens>]',
         category: 'workflow',
         priority: 3,
         type: 'builtin',
@@ -2921,7 +3111,7 @@ const COMMANDS = [
         type: 'builtin',
         execution: 'builtin',
         risk: 'read-only',
-        execute: (ctx) => handleTodos(ctx),
+        execute: ctx => handleTodos(ctx),
     },
     // Sessions and context lifecycle
     {
@@ -3014,7 +3204,7 @@ const COMMANDS = [
         type: 'builtin',
         execution: 'builtin',
         risk: 'read-only',
-        execute: (ctx) => handleSkills(ctx),
+        execute: ctx => handleSkills(ctx),
     },
     {
         name: 'skill',
@@ -3049,7 +3239,7 @@ const COMMANDS = [
         type: 'builtin',
         execution: 'builtin',
         risk: 'read-only',
-        execute: (ctx) => handleTools(ctx),
+        execute: ctx => handleTools(ctx),
     },
     {
         name: 'edit-preview',
@@ -3059,7 +3249,7 @@ const COMMANDS = [
         type: 'builtin',
         execution: 'builtin',
         risk: 'read-only',
-        execute: (ctx) => handleEditPreview(ctx),
+        execute: ctx => handleEditPreview(ctx),
     },
     {
         name: 'mcp',
@@ -3069,7 +3259,7 @@ const COMMANDS = [
         type: 'builtin',
         execution: 'builtin',
         risk: 'read-only',
-        execute: (ctx) => handleMcp(ctx),
+        execute: ctx => handleMcp(ctx),
     },
     {
         name: 'safety',
@@ -3079,13 +3269,13 @@ const COMMANDS = [
         type: 'builtin',
         execution: 'builtin',
         risk: 'read-only',
-        execute: (ctx) => showSafety(ctx),
+        execute: ctx => showSafety(ctx),
     },
     // Model and runtime configuration
     {
         name: 'model',
         description: 'Show or change the current model',
-        argumentHint: '[model|list|help]',
+        argumentHint: '[model|info]',
         category: 'model',
         priority: 10,
         type: 'builtin',
@@ -3093,9 +3283,20 @@ const COMMANDS = [
         risk: 'state-write',
         execute: (ctx, args) => handleModel(ctx, args),
     },
+    {
+        name: 'models',
+        description: 'Switch the current model interactively',
+        argumentHint: '',
+        category: 'model',
+        priority: 10,
+        type: 'builtin',
+        execution: 'builtin',
+        risk: 'state-write',
+        execute: (ctx, args) => handleModels(ctx, args),
+    },
     {
         name: 'mode',
-        aliases: ['permissions', 'perm'],
+        aliases: ['perm'],
         description: 'Show or change tool permission mode',
         argumentHint: '[default|accept-edits|plan|auto|next]',
         category: 'model',
@@ -3113,7 +3314,7 @@ const COMMANDS = [
         type: 'builtin',
         execution: 'builtin',
         risk: 'read-only',
-        execute: (ctx) => showConfig(ctx),
+        execute: ctx => showConfig(ctx),
     },
     // System commands
     {
@@ -3136,7 +3337,7 @@ const COMMANDS = [
         type: 'builtin',
         execution: 'builtin',
         risk: 'read-only',
-        execute: (ctx) => showStatus(ctx),
+        execute: ctx => showStatus(ctx),
     },
     {
         name: 'clear',
@@ -3164,6 +3365,18 @@ const COMMANDS = [
         rendererScope: ['tui'],
         execute: () => ({ success: true }),
     },
+    {
+        name: 'permissions',
+        description: 'Set the tool confirmation policy (TUI). No argument opens a picker; with an argument applies immediately.',
+        argumentHint: '[allow|ask|deny]',
+        category: 'system',
+        priority: 33,
+        type: 'builtin',
+        execution: 'renderer-local',
+        risk: 'state-write',
+        rendererScope: ['tui'],
+        execute: () => ({ success: true }),
+    },
     {
         name: 'redraw',
         description: 'Redraw the TUI-owned live region',
@@ -3184,7 +3397,7 @@ const COMMANDS = [
         type: 'builtin',
         execution: 'builtin',
         risk: 'state-write',
-        execute: (ctx) => handleExit(ctx),
+        execute: ctx => handleExit(ctx),
     },
     // Diagnostics
     {
@@ -3196,12 +3409,12 @@ const COMMANDS = [
         type: 'builtin',
         execution: 'builtin',
         risk: 'read-only',
-        execute: (ctx) => handleDoctor(ctx),
+        execute: ctx => handleDoctor(ctx),
     },
     {
         name: 'storage',
         description: 'Inspect, repair, or clean Orion Code storage layout',
-        argumentHint: '[doctor|repair [--yes]|cleanup [--dry-run|--yes]]',
+        argumentHint: '[doctor|repair [--dry-run|--yes] [--plan=<token>]|cleanup [--dry-run|--yes] [--plan=<token>]]',
         category: 'diagnostics',
         priority: 8,
         type: 'builtin',
@@ -3218,7 +3431,7 @@ const COMMANDS = [
         type: 'builtin',
         execution: 'builtin',
         risk: 'read-only',
-        execute: (ctx) => handleUsage(ctx),
+        execute: ctx => handleUsage(ctx),
     },
     {
         name: 'loop-stats',
@@ -3229,7 +3442,7 @@ const COMMANDS = [
         type: 'builtin',
         execution: 'builtin',
         risk: 'read-only',
-        execute: (ctx) => handleLoopStats(ctx),
+        execute: ctx => handleLoopStats(ctx),
     },
     {
         name: 'trace',
@@ -3286,7 +3499,7 @@ const COMMANDS = [
         execution: 'builtin',
         risk: 'read-only',
         deprecated: { since: 'v0.1.1', replacement: '/usage', removeIn: 'v0.3.0' },
-        execute: (ctx) => handleCost(ctx),
+        execute: ctx => handleCost(ctx),
     },
     {
         name: 'agents',
@@ -3297,7 +3510,7 @@ const COMMANDS = [
         execution: 'builtin',
         risk: 'read-only',
         isHidden: true,
-        execute: (ctx) => showAgents(ctx),
+        execute: ctx => showAgents(ctx),
     },
     {
         name: 'migrate',
@@ -3355,8 +3568,8 @@ function getCommands() {
     return sortCommands(COMMANDS);
 }
 function getVisibleCommands(renderer) {
-    return sortCommands(COMMANDS.filter(command => !command.isHidden
-        && (!renderer || !command.rendererScope || command.rendererScope.includes(renderer))));
+    return sortCommands(COMMANDS.filter(command => !command.isHidden &&
+        (!renderer || !command.rendererScope || command.rendererScope.includes(renderer))));
 }
 function findCommand(name) {
     return COMMANDS.find(c => c.name === name || c.aliases?.includes(name));