@orion-agents/orion-code 0.1.2 → 0.1.4

package/README.md

@@ -2,7 +2,7 @@
 
 > **Goal-driven coding agent for the terminal.**
 >
-> v0.1.2 — Goal continuity and evidence audit
+> v0.1.4 — Goal continuity, model config & shell sandbox POC
 
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js](https://img.shields.io/badge/node-%3E%3D20.0-green.svg)](https://nodejs.org)
@@ -35,8 +35,8 @@ Orion Code is a terminal-based coding agent. It wraps LLM APIs in a harness of s
 ### Install & Run
 
 ```bash
-# Install the v0.1.2 release:
-npm install -g @orion-agents/orion-code@0.1.2
+# Install the v0.1.4 release:
+npm install -g @orion-agents/orion-code@0.1.4
 
 # Or run from a checked-out source tree:
 npm ci
@@ -73,6 +73,10 @@ orion -p "review the current git diff"
 echo "summarize this project" | orion --print
 ```
 
+> **Pre-release note.** `0.1.4` is the in-development line on the `v0.1.4` branch and is
+> not on npm yet — `0.1.3` is the current published release. Until `v0.1.4` is tagged and
+> published, install from a source checkout. This note is removed at release.
+
 ### TUI startup banner
 
 The default TUI displays a portable sky-blue pixel banner: a compact landscape
@@ -147,6 +151,78 @@ Configuration: `~/.orion-code/orion.json` | Priority: `CLI flags > config > env
 The renderer is a runtime choice rather than a persisted setting: `orion` starts
 the TUI, while `--ui terminal` selects the technical renderer.
 
+### Project tool rules (`allowedTools`)
+
+Per-project permission rules live under `projects["<absolute path>"].allowedTools`.
+They are scoped to a single repository and are evaluated on top of each tool's own
+policy — they can tighten the gate, never loosen it.
+
+```json
+{
+  "projects": {
+    "/Users/me/work/api": {
+      "allowedTools": [
+        "exec_command(git status*)",
+        "exec_command(npm test*)",
+        "ask:exec_command(git push*)",
+        "deny:read_file(*.env)"
+      ]
+    }
+  }
+}
+```
+
+- Grammar: `[allow|ask|deny:]tool[(subject glob)]`; `*` matches any run of characters,
+  `?` a single one, and `*` as the tool name matches every tool.
+- The subject is the call's `command` / `file_path` / `path` / `url` / `pattern` / `query`
+  argument, whichever comes first.
+- Conflicts resolve most-restrictive-first (`deny` > `ask` > `allow`), independent of order.
+- `allow` only skips an interactive confirmation. It never overrides a tool's own `deny`,
+  never escapes plan mode, and never auto-approves a destructive invocation.
+- Malformed entries are ignored and listed by `/config` rather than silently applied.
+
+### Shell execution sandbox (`sandbox`)
+
+`exec_command` can run inside an OS-level sandbox. This is a **security POC**: the
+backend is probed at runtime and a configured-but-unusable sandbox **fails closed**
+(refuses to run) rather than silently degrading to an unsandboxed execution.
+
+```json
+{
+  "sandbox": {
+    "profile": "none",
+    "backend": "auto",
+    "allowNetwork": false,
+    "writableRoots": [],
+    "image": "alpine:latest"
+  }
+}
+```
+
+- **Ownership** — `sandbox` lives in the global config (`~/.orion-code/orion.json`)
+  and can be overridden per project under `projects["<path>"].sandbox`. Project
+  keys win individually; absent keys inherit the global value.
+- **`profile`** — `none` (default, no isolation, identical to the legacy `sh -c`),
+  `read-only` (no writes anywhere, no network), or `workspace-write` (writes
+  confined to the workspace + temp dirs, network still blocked unless
+  `allowNetwork: true`). An unknown value (e.g. written by a newer Orion) is a
+  hard failure, never a downgrade to `none`.
+- **`backend`** — `auto` (default, picks the first usable backend), `seatbelt`
+  (macOS `sandbox-exec`), `bubblewrap` (Linux `bwrap`), or `docker`. Each backend
+  is validated with a real execution probe; `which`-based guessing is never used.
+- **`image`** — required only for `docker`; names the container image to run in.
+- **`writableRoots`** — extra host roots the `workspace-write` profile may write
+  to (in addition to the cwd and temp). Non-string / empty entries are dropped.
+- **Migration / rollback** — adding the `sandbox` key is backward compatible: the
+  default `profile: "none"` reproduces the previous behaviour exactly. Removing the
+  key (or reverting to a pre-sandbox version) is a safe rollback; older Orion
+  simply ignores the unknown field. No secrets are stored, so no redaction is
+  required.
+- **Known limitations** — `seatbelt` cannot be nested inside another sandbox (e.g.
+  when Orion itself runs inside an app sandbox); `docker` runs the command in a
+  separate process tree and only constrains what is bind-mounted (the image rootfs
+  is made read-only via `--read-only`); none of the backends constrain CPU/memory.
+
 ## Interactive Commands
 
 | Command                | Description                                                                 |
@@ -204,6 +280,23 @@ See the [v0.1.2 release notes](https://github.com/orion-agents/orion-code/blob/m
 [Goal evidence and recovery guide](https://github.com/orion-agents/orion-code/blob/main/docs/goals/goal-evidence-and-recovery.md),
 and [execution plan](https://github.com/orion-agents/orion-code/blob/main/docs/plan/v0.1.2-execution-plan.md).
 
+## Research-to-Evidence (v0.1.4, experimental)
+
+> **Status: experimental.** Turns the read-only `research` subagent output into a **traceable, recoverable** research→evidence loop.
+
+Hard guarantees (any violation is a No-Go; never published):
+
+- **Only specialized WebSearch / WebFetch** — no generic MCP, no write/exec grant.
+- **SSRF / DNS-rebind / redirect / body-size / timeout** re-use the existing guards: a lexical SSRF pre-check at selection, and the full per-hop guard set delegated to the real WebFetch tool.
+- A **claim must bind a source** to reach `observed`; a claim with no independent verification stays `partial`/`unmet` and is never counted as verified/complete.
+- A **security-gate failure becomes `blocked`/`failed` with a structured reason** — never faked as a hit; provider fallback only swaps the provider, never downgrades a source status or writes a failure as a success.
+- Research evidence (web) and execution-verification evidence (file / test / build / file facts) are **kept distinct**; a web summary cannot stand in for execution verification.
+- Packet + source metadata are saved **atomically with a CAS token**; project / session / Goal scope isolation; resume only derives state and never replays external side effects; old schema versions fail closed.
+
+Modules: `src/runtime/subagents/{research-types,research-contract,research-citation,web-research-adapter,research-renderer,research-artifact,research-quality}.ts`.
+
+> Real-terminal (PTY) and external-state evidence are marked `not_run` in CI; local tests are not treated as release completion.
+
 ## Development
 
 ```bash

package/README.zh-CN.md

@@ -3,7 +3,7 @@
 > **Orion Code — 通用 Agent 驾驭框架**
 > 一个 CLI 驱动的编码 Agent，具备安全边界、工具编排、记忆系统和上下文管理。
 >
-> v0.1.2 — Goal 连续性与证据审计
+> v0.1.4 — Goal 连续性、模型配置与命令沙箱 POC
 
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js](https://img.shields.io/badge/node-%3E%3D20.0-green.svg)](https://nodejs.org)
@@ -104,16 +104,19 @@ npm start -- --print "review the current git diff"
 
 ### 全局安装
 
-固定安装 v0.1.2：
+固定安装 v0.1.4：
 
 ```bash
-npm install -g @orion-agents/orion-code@0.1.2
+npm install -g @orion-agents/orion-code@0.1.4
 # 任意目录运行
 orion
 ```
 
 也可以在源码工作树中使用 `npm ci && npm run build && npm start`。
 
+> **预发布说明**：`0.1.4` 是 `v0.1.4` 分支上的开发版本，尚未发布到 npm——当前已发布版本
+> 仍是 `0.1.3`。在 `v0.1.4` 打 tag 并发布之前，请从源码工作树安装。该说明将在发版时移除。
+
 公众体验、交互优化和新增工作流优先落在 TUI。`terminal-ui` 不作为与
 TUI 并行发展的公众产品；Ink 只保留迁移期兼容，不再增加产品能力。
 
@@ -173,6 +176,69 @@ v0.1.2 只覆盖单 Session、单 Active Goal，不承诺多 Goal 调度或无
 CLI 参数 > ~/.orion-code/orion.json > 环境变量 > 内部默认
 ```
 
+### 项目级工具规则（`allowedTools`）
+
+权限规则写在 `projects["<项目绝对路径>"].allowedTools`，只作用于该仓库。规则叠加在
+工具自身的权限策略之上：**只能收紧，不能放宽**。
+
+```json
+{
+  "projects": {
+    "/Users/me/work/api": {
+      "allowedTools": [
+        "exec_command(git status*)",
+        "exec_command(npm test*)",
+        "ask:exec_command(git push*)",
+        "deny:read_file(*.env)"
+      ]
+    }
+  }
+}
+```
+
+- 语法：`[allow|ask|deny:]工具名[(参数通配)]`；`*` 匹配任意字符串，`?` 匹配单个字符，
+  工具名写 `*` 表示匹配所有工具。
+- 参数通配匹配的是调用参数中的 `command` / `file_path` / `path` / `url` / `pattern` /
+  `query`（按此顺序取第一个非空字符串）。
+- 冲突时按“最严格优先”解析：`deny` > `ask` > `allow`，与书写顺序无关。
+- `allow` 仅用于免去交互确认，**不会**覆盖工具自身的 `deny`、**不会**突破 plan 模式的
+  只读约束，也**不会**自动放行破坏性调用。
+- 无法解析的条目会被忽略而不是静默放行，可通过 `/config` 查看解析结果与非法条目。
+
+### 命令执行沙箱（`sandbox`）
+
+`exec_command` 可在操作系统级沙箱内执行。这是**安全 POC**：后端在运行
+时实测探测，已配置但不可用的沙箱会**fail closed**（拒绝执行），而不会静默降级为
+无沙箱执行。
+
+```json
+{
+  "sandbox": {
+    "profile": "none",
+    "backend": "auto",
+    "allowNetwork": false,
+    "writableRoots": [],
+    "image": "alpine:latest"
+  }
+}
+```
+
+- **归属** — `sandbox` 位于全局配置（`~/.orion-code/orion.json`），并可在项目级
+  `projects["<项目绝对路径>"].sandbox` 覆盖。项目级按 key 单独覆盖，缺省 key 继承全局。
+- **`profile`** — `none`（默认，不隔离，等价于旧版 `sh -c`）、`read-only`（任何位置不可写、无网络）、
+  `workspace-write`（写权限限定在工作区与临时目录，除非 `allowNetwork: true` 否则仍禁网）。
+  未知取值（如新版 Orion 写入的更严格值）一律硬失败，绝不降级为 `none`。
+- **`backend`** — `auto`（默认，自动选首个可用后端）、`seatbelt`（macOS `sandbox-exec`）、
+  `bubblewrap`（Linux `bwrap`）或 `docker`。每个后端都用真实执行探针校验，从不靠 `which` 推断。
+- **`image`** — 仅 `docker` 需要，指定运行所用的容器镜像。
+- **`writableRoots`** — `workspace-write` 可写入的额外宿主根目录（除工作区与临时目录外）。
+  非字符串 / 空项会被丢弃。
+- **迁移 / 回滚** — 新增 `sandbox` 完全向后兼容：默认 `profile: "none"` 与旧行为完全一致。
+  删除该 key（或回退到沙箱前的版本）是安全回滚；旧版 Orion 会忽略该未知字段。不涉及任何敏感信息，无需脱敏。
+- **已知限制** — `seatbelt` 不能嵌套在另一沙箱内（例如 Orion 自身运行在应用沙箱中时）；
+  `docker` 在独立进程树中运行命令，只约束被 bind-mount 的部分（镜像根文件系统已通过 `--read-only` 设为只读）；
+  各后端均不限制 CPU / 内存。
+
 ### 环境变量
 
 | 变量                            | 默认值        | 说明                            |
@@ -399,7 +465,24 @@ orion-code/
 
 ## 版本历史
 
-### v0.1.2（当前版本）
+### v0.1.4（开发中，未发布）
+
+- 版本元数据对齐：`package.json` / `package-lock.json` 升至 `0.1.4`，`orion --version`、
+  出站 `User-Agent` 与崩溃/遥测上报不再误报 `0.1.3`；
+- 类型安全推进：外部边界（LLM provider、MCP wire、工具返回）由 `any` 收窄为 `unknown` +
+  类型守卫，顺带修复被 `any` 掩盖的真实缺陷；
+- 可靠性：持久化与鉴权路径不再静默吞掉异常，ESLint 启用 `no-empty` 门禁。
+
+### v0.1.3（最新已发布版本）
+
+- `/model` 与 `/models` 拆分：`/model` 只显示当前模型信息，`/models` 承接交互式切换；
+- `modelRegistry` 成为模型展示与切换的唯一事实源，静态 catalog 退为 legacy fallback；
+- 内置 catalog 补全（火山方舟 / xf-yun / deepseek 等），未配置上下文时正确回退；
+- 命令沙箱 POC、只读 Git 工具与工具 allowlist 的安全基线。
+
+> 完整变更与交付状态（已发布 / 已合并 / 候选）以 `CHANGELOG.md` 为准。
+
+### v0.1.2（已发布）
 
 - 单 Session、单 Active Goal 的 typed continuation；
 - restart/resume 后安全暂停，必须显式恢复；
@@ -419,6 +502,25 @@ orion-code/
 
 ---
 
+## Research-to-Evidence（v0.1.4，实验性）
+
+> **状态标记：experimental（实验性）。** 把只读 `research` 子 agent 的结果转化为**可追踪、可恢复**的研究→证据闭环。
+
+核心保证（违反任一即 No-Go，绝不发布）：
+
+- **只接专用 WebSearch / WebFetch**，不暴露通用 MCP、不授予 write/exec。
+- **SSRF / DNS 重解析 / 重定向 / 响应大小 / 超时** 全部走既有守卫：选择期做 lexical SSRF 预检，逐跳防护委托给真实 WebFetch 工具。
+- **claim 必须有 source 绑定**才能进入 `observed`；无独立验证的 claim 永远停在 `partial`/`unmet`，绝不被算作已验证/完成。
+- **安全闸门失败 → `blocked`/`failed` + 结构化原因**，绝不伪装成命中；provider fallback 只换 provider，不降级 source status，也不把失败写成成功。
+- 研究证据（web）与执行验证证据（file / 测试 / 构建 / 文件事实）**明确区分**，web 摘要不能替代执行验证。
+- 包与源元数据**原子 CAS 保存**，project / session / Goal 作用域隔离；恢复只推导状态、不重放外部副作用；旧 schema 版本 fail-closed。
+
+模块：`src/runtime/subagents/{research-types,research-contract,research-citation,web-research-adapter,research-renderer,research-artifact,research-quality}.ts`。
+
+> 真实终端（PTY）与外部状态证据在 CI 中标记为 `not_run`；本地测试不视为发布完成。
+
+---
+
 ## 开发
 
 ```bash
@@ -439,6 +541,9 @@ npm run lint
 
 # 格式化
 npm run format
+
+# 发布前只读检查（不会 tag / push / publish）
+npm run release:check
 ```
 
 ---

package/dist/commands/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/commands/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,SAAS,CAAC;AA8RjB,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,MAAM,CAErF;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CASrE;AAikDD,iBAAe,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAoVpF;AAixDD,wBAAgB,WAAW,IAAI,YAAY,EAAE,CAE5C;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,YAAY,CAAC,GAAG,YAAY,EAAE,CAQ1F;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAElE;AAED,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAED,OAAO,EAAE,UAAU,IAAI,WAAW,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/commands/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAIL,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,SAAS,CAAC;AA4UjB,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,MAAM,CAErF;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CASrE;AA+nDD,iBAAe,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAqVpF;AAyyDD,wBAAgB,WAAW,IAAI,YAAY,EAAE,CAE5C;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,YAAY,CAAC,GAAG,YAAY,EAAE,CAQ1F;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAElE;AAED,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAED,OAAO,EAAE,UAAU,IAAI,WAAW,EAAE,CAAC"}

package/dist/commands/index.js

@@ -21,6 +21,7 @@ const ui_view_model_1 = require("../runtime/ui-view-model");
 const task_manager_1 = require("../services/task-manager");
 const agent_runner_1 = require("../services/agent-runner");
 const config_1 = require("../services/config");
+const tool_allowlist_1 = require("../services/tool-allowlist");
 const box_1 = require("../ui/box");
 const stream_markdown_1 = require("../ui/stream-markdown");
 const progress_1 = require("../ui/progress");
@@ -40,7 +41,9 @@ const prompt_context_1 = require("../services/prompt-context");
 const doctor_1 = require("../services/doctor");
 const model_context_1 = require("../services/model-context");
 const token_estimate_1 = require("../utils/token-estimate");
+const mask_1 = require("../utils/mask");
 const model_catalog_1 = require("../services/model-catalog");
+const model_registry_1 = require("../services/model-registry");
 const workspace_diff_1 = require("../services/workspace-diff");
 const commit_plan_1 = require("../services/commit-plan");
 const tool_artifacts_1 = require("../core/tool-artifacts");
@@ -107,8 +110,42 @@ function formatRendererStatus(ctx) {
                     : DIM('custom');
     return `${BRAND(snapshot.renderer.name)} ${status} ${DIM(snapshot.renderer.capabilityLabels.join(', '))}`;
 }
-function formatModelAliasHelp() {
-    return Object.keys((0, model_catalog_1.getModelCatalogAliases)()).sort().join(', ');
+function getProfileByModelId(registry, modelId) {
+    if (!registry)
+        return undefined;
+    const normalized = modelId.trim();
+    if (!normalized)
+        return undefined;
+    if (registry.profiles.has(normalized))
+        return registry.profiles.get(normalized);
+    for (const profile of registry.profiles.values()) {
+        if (modelId === profile.model)
+            return profile;
+    }
+    return undefined;
+}
+function resolveModelFromRegistry(config, selector) {
+    if (!config.modelRegistry)
+        return undefined;
+    const trimmed = selector.trim();
+    if (!trimmed)
+        return undefined;
+    return (0, model_registry_1.lookupProfile)(config.modelRegistry, trimmed) ?? undefined;
+}
+function listConfiguredModelCatalogEntries(registry) {
+    if (!registry)
+        return [];
+    return registry.enabledProfiles.map(profile => {
+        const provider = registry.providers.get(profile.provider);
+        return {
+            name: profile.id,
+            alias: profile.aliases?.[0],
+            provider: provider?.displayName ?? profile.provider,
+            contextWindow: profile.resolvedContextWindow,
+            maxOutputTokens: profile.resolvedMaxOutputTokens,
+            source: `${profile.contextSource}/${profile.outputSource}`,
+        };
+    });
 }
 function formatLoopBudgetSource(stats) {
     const source = stats.loopBudgetSource ?? 'unknown';
@@ -1319,19 +1356,35 @@ function showConfig(ctx) {
     console.log();
     console.log(HEADER('Configuration'));
     console.log(DIM('─'.repeat(40)));
+    const allowlist = (0, tool_allowlist_1.resolveProjectToolAllowlist)(ctx.cwd);
+    const allowlistSummary = allowlist.rules.length === 0 && allowlist.invalid.length === 0
+        ? '(none)'
+        : `${allowlist.rules.length} rule(s)` +
+            (allowlist.invalid.length > 0 ? `, ${allowlist.invalid.length} invalid (ignored)` : '');
     const summary = {
         name: ctx.config.name,
         model: ctx.config.model,
         apiBaseUrl: ctx.config.apiBaseUrl || '(default OpenAI)',
-        apiKey: ctx.config.apiKey ? `${ctx.config.apiKey.slice(0, 7)}***` : '(not set)',
+        apiKey: (0, mask_1.maskSecret)(ctx.config.apiKey),
         mode: ctx.config.mode,
         logLevel: ctx.config.logLevel,
         toolConfirmation: ctx.config.toolConfirmation,
+        allowedTools: allowlistSummary,
     };
     const llmSummary = ctx.llm?.getConfigSummary() ?? {};
     for (const [key, val] of Object.entries(summary)) {
         console.log(`  ${ACCENT(key.padEnd(16))} ${DIM(val)}`);
     }
+    if (allowlist.rules.length > 0 || allowlist.invalid.length > 0) {
+        console.log();
+        console.log(HEADER('  Project allowedTools:'));
+        for (const rule of allowlist.rules) {
+            console.log(`  ${ACCENT(rule.effect.padEnd(6))} ${DIM(rule.tool)}${DIM(rule.pattern ? `(${rule.pattern})` : '')}`);
+        }
+        for (const entry of allowlist.invalid) {
+            console.log(`  ${WARN('invalid')} ${DIM(entry)}`);
+        }
+    }
     console.log();
     console.log(HEADER('  LLM Settings:'));
     for (const [key, val] of Object.entries(llmSummary)) {
@@ -1346,14 +1399,29 @@ function handleModel(ctx, args) {
     if (!args || trimmedArgs === '?' || trimmedArgs === 'info') {
         console.log();
         if (ctx.llm) {
-            const currentModel = ctx.llm.getModel();
+            const currentModel = ctx.store.getSnapshot().currentModel || ctx.llm.getModel();
+            const profile = getProfileByModelId(ctx.config.modelRegistry, currentModel);
             const aliasEntry = (0, model_catalog_1.getModelCatalogEntry)(currentModel);
-            const contextInfo = (0, model_context_1.resolveModelContext)(currentModel);
+            const contextInfo = profile
+                ? {
+                    id: profile.model,
+                    label: profile.displayName || profile.id,
+                    contextWindow: profile.resolvedContextWindow,
+                    maxOutputTokens: profile.resolvedMaxOutputTokens,
+                    source: 'config',
+                    matchedId: profile.model,
+                }
+                : (0, model_context_1.resolveModelContext)(currentModel);
             const compactStats = getCommandAutoCompact(ctx, currentModel).getStats();
             console.log(HEADER('Current Model'));
             console.log(DIM('─'.repeat(40)));
             console.log(`  Model    ${BRAND(currentModel)}`);
-            if (aliasEntry) {
+            if (profile) {
+                console.log(`  Alias    ${ACCENT(profile.aliases?.[0] ? `(${profile.aliases[0]})` : 'none')}`);
+                const provider = ctx.config.modelRegistry?.providers.get(profile.provider);
+                console.log(`  Provider ${DIM(provider?.displayName || profile.provider)}`);
+            }
+            else if (aliasEntry) {
                 console.log(`  Alias    ${ACCENT(aliasEntry.alias)}`);
                 console.log(`  Provider ${DIM(aliasEntry.provider)}`);
             }
@@ -1370,49 +1438,12 @@ function handleModel(ctx, args) {
         console.log();
         return { success: true };
     }
-    // 显示模型列表
-    if (trimmedArgs === 'list' || trimmedArgs === 'ls') {
-        console.log();
-        console.log(HEADER('Available Models'));
-        console.log(DIM('─'.repeat(40)));
-        const currentModel = ctx.llm?.getModel() || '';
-        const modelPicker = (0, ui_view_model_1.createModelPickerState)({
-            currentModel,
-            models: (0, model_catalog_1.listModelCatalogEntries)().map(model => {
-                const contextInfo = (0, model_context_1.resolveModelContext)(model.name);
-                return {
-                    ...model,
-                    contextWindow: contextInfo.contextWindow,
-                    maxOutputTokens: contextInfo.maxOutputTokens,
-                    source: contextInfo.source,
-                };
-            }),
-        });
-        for (const item of modelPicker.visibleItems) {
-            const marker = item.isCurrent ? SUCCESS('●') : DIM('○');
-            const alias = item.alias ? `(${item.alias})` : '';
-            const context = `${formatTokenCount(item.contextWindow ?? 0)} ctx`;
-            const current = item.isCurrent ? BRAND('(current)') : '';
-            console.log(`  ${marker} ${ACCENT(item.name)} ${DIM(alias)} ${DIM(context)} ${current}`);
-            console.log(`      ${DIM(item.provider ?? 'unknown')}`);
-        }
+    // /model list|ls|help 已移除，统一由 /models 承接（交互式选择切换）
+    if (trimmedArgs === 'list' || trimmedArgs === 'ls' || trimmedArgs === 'help') {
         console.log();
-        console.log(DIM('Use /model <name|alias> to switch, e.g. /model sonnet'));
-        console.log();
-        return { success: true };
-    }
-    // 显示帮助
-    if (trimmedArgs === 'help') {
-        console.log();
-        console.log(HEADER('/model Command Help'));
-        console.log(DIM('─'.repeat(40)));
-        console.log();
-        console.log(`  ${ACCENT('/model')}           Show current model`);
-        console.log(`  ${ACCENT('/model list')}      Show available models`);
-        console.log(`  ${ACCENT('/model <name>')}    Switch to specific model`);
-        console.log(`  ${ACCENT('/model <alias>')}   Switch using alias (opus, sonnet, haiku)`);
-        console.log();
-        console.log(DIM(`Aliases: ${formatModelAliasHelp()}`));
+        console.log(WARN(`/model ${trimmedArgs} was removed.`));
+        console.log(DIM('Use /models to switch models interactively,'));
+        console.log(DIM('or /model <name|alias> to switch directly, e.g. /model sonnet'));
         console.log();
         return { success: true };
     }
@@ -1423,16 +1454,75 @@ function handleModel(ctx, args) {
         return { success: false };
     }
     // 解析别名
-    const resolvedModel = (0, model_catalog_1.resolveModelAlias)(args);
+    const registryProfile = resolveModelFromRegistry(ctx.config, args);
+    const resolvedModel = registryProfile ? registryProfile.model : (0, model_catalog_1.resolveModelAlias)(args);
+    const resolvedProfileId = registryProfile ? registryProfile.id : resolvedModel;
     ctx.llm.setModel(resolvedModel);
     getCommandAutoCompact(ctx, resolvedModel);
-    ctx.store.setState({ currentModel: resolvedModel });
-    console.log(SUCCESS(`✔ Model changed to ${BRAND(resolvedModel)}`));
-    const contextInfo = (0, model_context_1.resolveModelContext)(resolvedModel);
+    ctx.store.setState({ currentModel: resolvedProfileId });
+    console.log(SUCCESS(`✔ Model changed to ${BRAND(resolvedProfileId)}`));
+    const contextInfo = registryProfile
+        ? {
+            contextWindow: registryProfile.resolvedContextWindow,
+            maxOutputTokens: registryProfile.resolvedMaxOutputTokens,
+            source: 'resolved',
+        }
+        : (0, model_context_1.resolveModelContext)(resolvedModel);
     console.log(DIM(`  Context window ${formatTokenCount(contextInfo.contextWindow)} tokens (${contextInfo.source})`));
     console.log();
     return { success: true };
 }
+/**
+ * /models — 交互式选择切换模型。
+ * 交互式渲染器返回结构化 modelPicker 请求（渲染器弹出选择层，选中即 /model <id>）；
+ * 非交互式渲染器直接打印候选列表并提示 /model <name|alias>。
+ */
+function handleModels(ctx, _args) {
+    console.log();
+    const currentModel = ctx.store.getSnapshot().currentModel || ctx.llm?.getModel() || '';
+    const configuredModels = listConfiguredModelCatalogEntries(ctx.config.modelRegistry);
+    const candidates = configuredModels.length > 0
+        ? configuredModels
+        : (0, model_catalog_1.listModelCatalogEntries)().map(model => {
+            const contextInfo = (0, model_context_1.resolveModelContext)(model.name);
+            return {
+                name: model.name,
+                alias: model.alias,
+                provider: model.provider,
+                contextWindow: contextInfo.contextWindow,
+                maxOutputTokens: contextInfo.maxOutputTokens,
+                source: contextInfo.source,
+            };
+        });
+    const ui = commandUICapabilities(ctx);
+    if (ui.structuredPickers) {
+        return {
+            success: true,
+            modelPicker: {
+                models: candidates,
+                currentModel,
+                title: 'Switch Model',
+                maxVisibleItems: 12,
+            },
+        };
+    }
+    // 非交互式渲染器：打印候选列表
+    console.log(HEADER('Available Models'));
+    console.log(DIM('─'.repeat(40)));
+    const modelPicker = (0, ui_view_model_1.createModelPickerState)({ currentModel, models: candidates });
+    for (const item of modelPicker.visibleItems) {
+        const marker = item.isCurrent ? SUCCESS('●') : DIM('○');
+        const alias = item.alias ? `(${item.alias})` : '';
+        const context = `${formatTokenCount(item.contextWindow ?? 0)} ctx`;
+        const current = item.isCurrent ? BRAND('(current)') : '';
+        console.log(`  ${marker} ${ACCENT(item.name)} ${DIM(alias)} ${DIM(context)} ${current}`);
+        console.log(`      ${DIM(item.provider ?? 'unknown')}`);
+    }
+    console.log();
+    console.log(DIM('Use /model <name|alias> to switch, e.g. /model sonnet'));
+    console.log();
+    return { success: true };
+}
 function normalizePermissionMode(raw) {
     const value = raw.trim().toLowerCase();
     if (!value)
@@ -1733,6 +1823,7 @@ async function handleChat(ctx, input) {
             costTracker: snapshot.costTracker,
             permissionMode: snapshot.permissionMode,
             toolConfirmation: ctx.config.toolConfirmation,
+            toolAllowlist: (0, tool_allowlist_1.resolveProjectToolAllowlist)(ctx.cwd).evaluator,
             toolContext: {
                 cwd: ctx.cwd,
                 config: {
@@ -3184,7 +3275,7 @@ const COMMANDS = [
     {
         name: 'model',
         description: 'Show or change the current model',
-        argumentHint: '[model|list|help]',
+        argumentHint: '[model|info]',
         category: 'model',
         priority: 10,
         type: 'builtin',
@@ -3192,9 +3283,20 @@ const COMMANDS = [
         risk: 'state-write',
         execute: (ctx, args) => handleModel(ctx, args),
     },
+    {
+        name: 'models',
+        description: 'Switch the current model interactively',
+        argumentHint: '',
+        category: 'model',
+        priority: 10,
+        type: 'builtin',
+        execution: 'builtin',
+        risk: 'state-write',
+        execute: (ctx, args) => handleModels(ctx, args),
+    },
     {
         name: 'mode',
-        aliases: ['permissions', 'perm'],
+        aliases: ['perm'],
         description: 'Show or change tool permission mode',
         argumentHint: '[default|accept-edits|plan|auto|next]',
         category: 'model',
@@ -3263,6 +3365,18 @@ const COMMANDS = [
         rendererScope: ['tui'],
         execute: () => ({ success: true }),
     },
+    {
+        name: 'permissions',
+        description: 'Set the tool confirmation policy (TUI). No argument opens a picker; with an argument applies immediately.',
+        argumentHint: '[allow|ask|deny]',
+        category: 'system',
+        priority: 33,
+        type: 'builtin',
+        execution: 'renderer-local',
+        risk: 'state-write',
+        rendererScope: ['tui'],
+        execute: () => ({ success: true }),
+    },
     {
         name: 'redraw',
         description: 'Redraw the TUI-owned live region',