@orion-agents/orion-code 0.3.1 → 0.3.4

package/CHANGELOG.md

@@ -22,6 +22,132 @@ which is **not** a pass.
 
 ## [Unreleased]
 
+## [0.3.4] — CANDIDATE
+
+> **Status: candidate.** This stabilization work is isolated on the v0.3.4 worktree. It is not
+> merged, tagged or published to npm, and exact-artifact qualification remains a separate gate.
+
+### Changed
+
+- Bind Settings writes to the active Workspace and Context revision in addition to the Settings
+  document revision, so a stale browser tab cannot apply a valid patch to another Workspace.
+- Preserve lexical symbolic-link identity while projecting a contained target as a file or
+  directory, and expose the true changed-file total separately from the bounded Review page.
+- Split exact-tgz qualification into a script-disabled identity stage and a separate lifecycle-
+  enabled consumer/native stage.
+
+### Fixed
+
+- Keep split terminal surrogate pairs intact across delayed PTY callbacks, wait for browser write
+  capacity without animation-frame spin, and drain reconnect data in replay, live-tail, exit order.
+- Reject blank Session renames without changing durable metadata, and keep active-turn state intact
+  when a busy-rejected slash command fails.
+- Isolate concurrent command transcript capture so interleaved output cannot cross Sessions or
+  leave the process-wide console bridge installed.
+- Project cold and resident Composer model, Effort and permission changes from the actor Runtime's
+  canonical Session instead of a pre-actor metadata copy.
+- Detect binary content on every file page, render contained directory symlinks as expandable and
+  label Review truncation against the true repository total.
+
+### Security
+
+- Redact URL userinfo and structured sensitive keys before browser/evidence projection; evaluate
+  file aliases plus canonical targets and block sensitive current or rename-source Git diffs before
+  starting a content process.
+- Require matching, canonical-digest-verified terminal receipts and durable receipt facts before a
+  modern tool result can project success.
+- Fail release qualification for a failed live canary or duplicated runtime run and manifest
+  evidence instead of accepting a structurally complete but non-independent matrix.
+
+## [0.3.3] — CANDIDATE
+
+> **Status: candidate.** The implementation and local qualification remain isolated on the v0.3.3
+> worktree. It is not merged, tagged, published to npm or represented as a completed release receipt.
+
+### Added
+
+- Add the bundled `orion-blocksmith` pixel-workshop style as a closed built-in appearance option,
+  composed with system/light/dark themes and reduced motion without remote assets or executable
+  theme packages.
+- Add a bounded Web Session actor registry with three running slots, four resident actors, FIFO
+  overflow admission, cancellable queued turns, idle LRU eviction and explicit per-Session runtime
+  revisions.
+- Add the v0.3.3 OpenAPI, migration guide and exact-artifact WEB33-P0-01..12 plus
+  WEB33-P0-16..24 qualification contract.
+
+### Changed
+
+- Make foreground Session selection browser-tab-local so a running, approval-waiting or queued
+  Session continues while another Session is viewed or submitted.
+- Route Session commands and Composer mutations through exact Workspace, Context, Session runtime
+  and control revisions; stale operations fail closed instead of following a global active Session.
+- Keep a single Workbench SSE connection while projecting Session-tagged runtime state into bounded
+  per-Session browser caches.
+- Package runtime JavaScript and declarations without generated source-map files, preserving local
+  build maps while keeping the published artifact within the existing unpacked-size budget.
+
+### Fixed
+
+- Remove the global pending barrier from warm same-Workspace Session selection and restore cached
+  content immediately while a guarded snapshot refreshes in the background.
+- Keep the collapsed Work Panel as a right-side full-height 48px rail across desktop and drawer
+  breakpoints without moving it below the conversation or creating horizontal page overflow.
+- Keep the only persistent Settings entry at the lower-left project rail and restore focus after a
+  successful Settings save.
+- Raise Orion Blocksmith light-theme muted text contrast to WCAG AA for small labels and empty-state
+  copy.
+
+### Security
+
+- Serialize same-Workspace mutating Tool steps through a shared arbiter while preserving independent
+  actors for non-conflicting work; stale file baselines are rejected before side effects.
+- Bind queued-turn cancellation, approvals, Goal/Plan controls and structured Context references to
+  the intended Session actor, with zero cross-Session provider, Tool, journal or file effects on
+  revision conflict.
+
+## [0.3.2] — CANDIDATE
+
+> **Status: candidate.** Source, API and browser qualification are being frozen together. This is
+> not a Git tag, GitHub Release or npm publication until the exact-artifact receipts exist.
+
+### Added
+
+- Add an IDE-style left project navigator that expands, collapses to a 48px rail and mouse-resizes
+  from 240–480px while preserving a 560px conversation floor and responsive drawer preferences.
+- Add a Composer Control Center for BUILD/PLAN/AUTO, Session permission, model, Effort and
+  Runtime-projected Context usage, including pending/last-good/error/retry states.
+- Add structured file/folder/review/session/Skill Context references with Host-side containment,
+  sensitive-data, revision, digest and prompt-budget validation.
+- Add durable Plan review with exact-digest approve, continue-planning and cancel operations that
+  survive refresh, replay and Host restart without auto-executing an unreviewed Plan.
+- Add revisioned queue edit/move/remove and Session-scoped tab-local draft recovery.
+- Add the v0.3.2 OpenAPI, mode/permission contract, migration guide and exact-artifact
+  WEB32-P0-01..12 qualification contract.
+
+### Changed
+
+- Replace the three Composer mode buttons with accessible menus and keep workflow mode independent
+  from tool authorization; explicit Deny and hard Policy remain stronger than AUTO or Allow.
+- Make active-turn model changes deferred to the next logical request and require verified compact
+  before switching to a smaller safe context window, with complete rollback on failure.
+- Project provider or explicitly estimated Context usage from Runtime instead of reconstructing
+  token capacity in the browser.
+
+### Fixed
+
+- Keep the left/right desktop widths stable across narrow-screen drawers, reloads and 200% zoom;
+  bound controls and Context chips without covering the textarea or send action.
+- Consume expected UI mutation rejections after the shared operation layer has projected the error,
+  preventing a deliberate 409 CAS conflict from becoming an unhandled browser page error.
+- Require a matching active-session snapshot after replay reset before re-enabling the Composer.
+
+### Security
+
+- Bind Composer, queue and Plan mutations to exact Workspace/Session/Context/control revisions and
+  fail stale operations with zero provider, ToolGateway, file or queue side effects.
+- Revalidate every structured Context reference at prompt assembly and keep sensitive/raw content
+  out of the DOM, SSE, screenshots and release evidence.
+
 ## [0.3.1] — CANDIDATE
 
 > **Status: candidate.** This branch carries the v0.3 Web quality and long-session recovery fixes.

package/README.md

@@ -2,14 +2,20 @@
 
 Local-first, goal-driven coding agent for the terminal and browser.
 
-> v0.3.1 candidate — one Orion runtime with a local Web Workbench, replayable browser state and
-> the existing TUI/terminal surfaces. Candidate source is not an npm publication or Git tag.
+> v0.3.4 candidate — a compatible security, terminal-ordering and release-evidence stabilization of
+> the v0.3.3 multi-Session Web Workbench. Candidate source is not an npm publication, Git tag, or
+> merge-ready release.
 
 [中文说明](README.zh-CN.md) ·
-[v0.3.1 professional shell plan](docs/plan/v0.3.1-web-workbench-professional-shell-plan.md) ·
-[v0.3.1 Web API](docs/architecture/v0.3.1-web-api.yaml) ·
-[v0.3.1 E2E plan](docs/test/v0.3.1-web-workbench-e2e-plan.md) ·
-[v0.3.1 migration](docs/migration/v0.3.0-to-v0.3.1.md) ·
+[v0.3.4 stabilization plan](docs/plan/v0.3.4-stabilization-plan.md) ·
+[v0.3.4 contract](docs/architecture/v0.3.4-stabilization-contract.md) ·
+[v0.3.4 E2E plan](docs/test/v0.3.4-stabilization-e2e-plan.md) ·
+[v0.3.4 migration](docs/migration/v0.3.3-to-v0.3.4.md) ·
+[v0.3.3 plan](docs/plan/v0.3.3-plan.md) ·
+[v0.3.3 Web API](docs/architecture/v0.3.3-web-api.yaml) ·
+[mode/permission contract](docs/architecture/agent-mode-permission-contract.md) ·
+[v0.3.3 E2E plan](docs/test/v0.3.3-web-workbench-e2e-plan.md) ·
+[v0.3.3 migration](docs/migration/v0.3.2-to-v0.3.3.md) ·
 [v0.3.0 Web plan](docs/plan/v0.3.0-web-workbench-plan.md) ·
 [Settings plan](docs/plan/v0.3.0-settings-integration-plan.md) ·
 [Node compatibility](docs/plan/v0.3.0-node-runtime-compatibility-plan.md) ·
@@ -18,19 +24,46 @@ Local-first, goal-driven coding agent for the terminal and browser.
 [Settings migration](docs/migration/v0.2.2-to-v0.3.0-settings.md) ·
 [real-state gallery](docs/assets/screenshots/v0.3.0-web/README.md)
 
-## What v0.3.1 includes
-
-- **One runtime, two interactive surfaces.** `orion web` uses the same product bootstrap,
-  AgentRuntimeController, Session/Thread stores, ToolGateway, approvals, Goals, Plans, Skills and
-  MCP boundaries as the terminal product; the browser does not run a second agent loop.
+## What v0.3.4 stabilizes
+
+- **Context-bound writes.** Settings mutations now carry the active Workspace and Context revision;
+  stale tabs fail with no write or Runtime apply. Blank Session renames and busy slash commands also
+  fail without corrupting durable or active-turn state.
+- **One sensitive-data boundary.** Structured credentials, URL userinfo, canonical file targets,
+  Git diff paths, tool artifacts and concurrent command output are checked and redacted before they
+  reach browser or evidence surfaces.
+- **Deterministic Terminal transport.** Split surrogate pairs, browser write backpressure and
+  reconnect races preserve complete Unicode and the required replay, live-tail, exit and close
+  order.
+- **Honest durable/read projections.** Tool receipt and journal facts must validate as a pair;
+  symbolic links expose an effective target kind without losing lexical identity, and Review
+  distinguishes total changed files from its bounded visible page.
+- **Fail-closed release proof.** Failed live canaries, duplicate runtime evidence and lifecycle
+  scripts hidden inside a supposedly safe package-install stage are release blockers.
+
+## What v0.3.3 includes
+
+- **One execution spine, bounded Web Session actors.** Web Sessions use the same product bootstrap,
+  AgentRuntimeController, Session/Thread stores, ToolGateway, approvals, Goals, Plans, Skills and MCP
+  boundaries as the terminal product. Up to three Session turns may run concurrently with four
+  resident actors; the TUI and terminal surfaces keep their single-active-Session contract.
+- **Orion Blocksmith.** A bundled pixel-workshop style combines with system/light/dark themes without
+  remote assets, dynamic theme code or a second settings source. Classic remains available as an
+  explicit built-in style.
 - **Recoverable Web workbench.** The React workbench includes workspace/session navigation,
   transcript and tool activity, BUILD/PLAN/AUTO, follow-ups, interrupt, approvals, Goal/Plan,
   model/effort settings, Skills/MCP and diagnostics. Snapshots plus cursor replay repair refreshes
   and SSE reconnects.
 - **Professional project shell.** The left navigator shows registered projects with lazy Session
-  pages while the center remains the only Agent conversation. A resizable right dock provides
-  Agent, Review, Terminal, Files and Git surfaces; files/Git/review are bounded read models and the
-  terminal is an explicit, ephemeral real PTY isolated from Session history and SSE.
+  pages, resizes from 240–480px and collapses to a 48px rail while the center remains the only Agent
+  conversation. A resizable right dock provides Agent, Review, Terminal, Files and Git surfaces;
+  narrow screens use mutually exclusive drawers without overwriting desktop preferences.
+- **Composer Control Center.** Mode, Session permission, model, Effort and Context are accessible
+  menus beside the textarea. Runtime current/last-good/pending/error state is explicit; active-turn
+  model changes defer safely and smaller-context switches run verified Compact first.
+- **Reviewable plans and bounded context.** PLAN commits a durable review state and never starts
+  implementation before exact-digest approval. Structured file/folder/review/session/Skill refs,
+  revisioned queue editing and Session-scoped drafts keep prompt intent visible and recoverable.
 - **Local security boundary.** The host binds only `127.0.0.1`; writes require an exact Origin,
   process nonce, JSON body and idempotency key. Responses use a restrictive CSP, browser payloads
   are redacted, and large tool results are byte-paged instead of placed on the event stream.
@@ -80,10 +113,10 @@ user extension boundaries.
 Node.js 22.12+, 24, and 26 are supported. Use Node 24 LTS for production or Node 26 Current for
 current development environments. Node 20 is upstream EOL and is no longer a v0.3 runtime.
 
-After the immutable `0.3.1` npm receipt exists:
+After the immutable `0.3.4` npm receipt exists:
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.1
+npm install -g @orion-agents/orion-code@0.3.4
 orion --version
 orion doctor
 ```
@@ -160,15 +193,16 @@ the browser to select a workspace and session, run or steer work, answer approva
 runtime state. Closing or refreshing a tab leaves pending approvals owned by the runtime; stopping
 the host aborts them fail-closed.
 
-The browser exposes Plan receipts exactly as committed (`body`, `returnMode`, `digest`). It does not
-insert an extra review gate: after PLAN commits, the existing runtime restores BUILD/AUTO and starts
-implementation in a separate logical turn.
+The browser exposes Plan receipts exactly as committed and enters a durable `awaiting_review`
+state. Approve starts a separate BUILD logical request, Continue Planning starts a separate PLAN
+request with feedback, and Cancel performs no execution. Each operation binds the exact plan digest
+and survives refresh or Host restart; stale review actions fail with no side effects.
 
 The project navigator does not create multiple runtimes. Cross-project Session selection is one
-atomic, revision-guarded Context transition. The right dock is 320–720px on desktop and is adjusted
-with an IDE-style mouse drag; there is no keyboard fine-resize control. Narrow layouts use drawers
-without overwriting the saved desktop width. Files, Git and Review are read-only; terminal creation
-requires an explicit gesture and its short-lived ticket and output never enter the Workbench SSE.
+atomic, revision-guarded Context transition. The left dock is 240–480px or a 48px rail; the right is
+320–720px. Both use IDE-style mouse drag where applicable and there is no keyboard fine resize.
+Narrow layouts use drawers without overwriting desktop widths. Files, Git and Review are read-only;
+terminal creation requires an explicit gesture and its ticket/output never enter Workbench SSE.
 
 #### Host-managed Settings
 
@@ -189,13 +223,14 @@ legacy appearance import and rollback details.
 
 ### BUILD, PLAN, AUTO
 
-Press `Shift+Tab` to cycle `BUILD → PLAN → AUTO`. The status bar and input border show the current
-mode. Mode controls workflow behavior; Authority, approval, containment, and sandbox policy remain
-independent.
+Use the Composer mode menu to select `BUILD`, `PLAN` or `AUTO`; the adjacent permission menu selects
+Project default, Ask, Allow or Deny. Mode controls workflow behavior while Authority, approval,
+containment and sandbox policy remain independent. Allow and AUTO require explicit risk handling and
+never override hard policy or explicit Deny.
 
 - **BUILD** is normal collaborative implementation.
 - **PLAN** explores with the same available tool universe, commits a decision-complete PlanReceipt,
-  exits automatically, restores BUILD/AUTO, and starts implementation in a separate logical turn.
+  and waits for durable approve / continue-planning / cancel review.
 - **AUTO** removes interactive approval prompts within the configured Authority; hard policy and
   sandbox boundaries still fail closed.
 
@@ -205,7 +240,8 @@ Start a task-scoped plan with:
 /plan refactor the storage boundary and verify crash recovery
 ```
 
-There is no `exit_plan_mode` tool and no `/mode` command.
+There is no `exit_plan_mode` tool. Web users select mode from the Composer; terminal surfaces retain
+their existing mode controls.
 
 ### Durable Goal mode
 
@@ -267,10 +303,13 @@ npm run test:web-e2e -- --grep @settings
 
 Release qualification additionally builds one exact tarball and installs that unchanged hash on
 Node 22/24/26 for package identity, native SQLite, TUI, terminal, print, Web, Goal, subagent, Skill,
-MCP, Compact, and resume journeys. WEB31-P0-01..12 additionally qualify the multi-project shell,
-read-only engineering panels, real PTY and responsive/accessibility contract. See the
-[`v0.3.1 Web Workbench plan`](docs/plan/v0.3.1-web-workbench-professional-shell-plan.md) and
-[`v0.3.1 E2E qualification plan`](docs/test/v0.3.1-web-workbench-e2e-plan.md).
+MCP, Compact, and resume journeys. WEB33-P0-01..12 qualify the built-in appearance contract, while
+WEB33-P0-16..24 qualify parallel Session actors, foreground-local switching, bounded queues, the
+right rail and the single Settings entry. See the [`v0.3.3 plan`](docs/plan/v0.3.3-plan.md) and
+[`v0.3.3 E2E qualification plan`](docs/test/v0.3.3-web-workbench-e2e-plan.md). The security and
+stabilization delta is defined by the
+[`v0.3.4 test plan`](docs/test/v0.3.4-stabilization-e2e-plan.md), which does not treat source gates
+as release evidence.
 
 ## Security
 

package/README.zh-CN.md

@@ -2,14 +2,19 @@
 
 面向终端与浏览器、本地优先的目标驱动 Coding Agent。
 
-> v0.3.1 候选版本：一套 Orion Runtime，同时提供本地 Web Workbench 与既有 TUI/terminal。
-> Candidate 源码不代表已经创建 npm 发布或 Git tag。
+> v0.3.4 候选版本：对 v0.3.3 多 Session Web Workbench 进行兼容的安全、终端顺序与发布证据
+> 稳定化。Candidate 源码不代表已创建 npm 发布、Git tag 或达到可合并状态。
 
 [English](README.md) ·
-[v0.3.1 专业工作台方案](docs/plan/v0.3.1-web-workbench-professional-shell-plan.md) ·
-[v0.3.1 Web API](docs/architecture/v0.3.1-web-api.yaml) ·
-[v0.3.1 E2E 方案](docs/test/v0.3.1-web-workbench-e2e-plan.md) ·
-[v0.3.1 迁移](docs/migration/v0.3.0-to-v0.3.1.md) ·
+[v0.3.4 稳定化方案](docs/plan/v0.3.4-stabilization-plan.md) ·
+[v0.3.4 合同](docs/architecture/v0.3.4-stabilization-contract.md) ·
+[v0.3.4 E2E 方案](docs/test/v0.3.4-stabilization-e2e-plan.md) ·
+[v0.3.4 迁移](docs/migration/v0.3.3-to-v0.3.4.md) ·
+[v0.3.3 方案](docs/plan/v0.3.3-plan.md) ·
+[v0.3.3 Web API](docs/architecture/v0.3.3-web-api.yaml) ·
+[模式/权限合同](docs/architecture/agent-mode-permission-contract.md) ·
+[v0.3.3 E2E 方案](docs/test/v0.3.3-web-workbench-e2e-plan.md) ·
+[v0.3.3 迁移](docs/migration/v0.3.2-to-v0.3.3.md) ·
 [v0.3.0 Web 方案](docs/plan/v0.3.0-web-workbench-plan.md) ·
 [Settings 方案](docs/plan/v0.3.0-settings-integration-plan.md) ·
 [Node 兼容方案](docs/plan/v0.3.0-node-runtime-compatibility-plan.md) ·
@@ -18,17 +23,36 @@
 [Settings 迁移](docs/migration/v0.2.2-to-v0.3.0-settings.md) ·
 [真实状态图册](docs/assets/screenshots/v0.3.0-web/README.md)
 
-## v0.3.1 包含什么
-
-- **一个 Runtime、两个交互界面。** `orion web` 与终端产品共用 product bootstrap、
-  AgentRuntimeController、Session/Thread、ToolGateway、审批、Goal、Plan、Skills 和 MCP；浏览器不另起
-  一套 agent loop。
+## v0.3.4 稳定了什么
+
+- **Context 绑定写入。** Settings mutation 现在同时携带活动 Workspace 与 Context revision；陈旧页面
+  不会写入或应用到另一个 Runtime。空 Session 名称和 busy slash command 也会保持持久态与活动回合不变。
+- **统一敏感数据边界。** 结构化凭据、URL userinfo、canonical 文件目标、Git diff 路径、tool artifact
+  和并发命令输出在进入浏览器或证据前统一检查与脱敏。
+- **确定的 Terminal 传输。** PTY 代理对分片、浏览器写入背压与重连竞态都保持完整 Unicode，以及
+  replay、live tail、exit、close 的严格顺序。
+- **诚实的 durable/read 投影。** Tool receipt 与 journal fact 必须成对校验；symlink 在保留 lexical
+  类型的同时投影有效目标类型；Review 将仓库真实总数与有界可见页分开显示。
+- **Fail-closed 发布证据。** live canary 失败、重复 Runtime 证据，或混入“安全安装阶段”的生命周期
+  script 都会阻止发布。
+
+## v0.3.3 包含什么
+
+- **一条执行主干、有界 Web Session actors。** Web Session 与终端产品共用 product bootstrap、
+  AgentRuntimeController、Session/Thread、ToolGateway、审批、Goal、Plan、Skills 和 MCP。Web 最多允许
+  3 个 Session turn 并行、4 个 actor 常驻；TUI/terminal 继续保持单活动 Session 合同。
+- **Orion 方块工坊。** 内置像素工坊风格可与 system/light/dark 组合，不加载远程资产、动态主题代码或
+  第二份 Settings 真相；classic 继续作为显式内置风格提供。
 - **可恢复的 Web 工作台。** React 界面覆盖工作区/会话、对话与工具活动、BUILD/PLAN/AUTO、follow-up、
   interrupt、审批、Goal/Plan、模型/effort、Skills/MCP 和诊断。快照与 cursor replay 负责刷新和 SSE
   重连恢复。
 - **专业项目工作台。** 左侧展示已注册项目并懒加载 Session，中间仍是唯一 Agent 会话。右侧可变宽面板
-  提供 Agent、审阅、终端、文件和 Git；文件/Git/审阅是有界只读投影，终端是显式启动、与 Session
-  history 和 SSE 隔离的临时真实 PTY。
+  提供 Agent、审阅、终端、文件和 Git；左栏可在 240–480px 鼠标调宽或折叠为 48px rail，窄屏使用互斥
+  drawer 且不覆盖桌面偏好。
+- **Composer Control Center。** 模式、Session 权限、模型、Effort 与 Context 都在输入框旁的可访问菜单中；
+  Runtime 明确投影 current/last-good/pending/error，active turn 模型切换会安全延迟，切小上下文前先 Compact。
+- **可审核 Plan 与有界 Context。** PLAN 写入 durable review 后等待 exact-digest 批准；结构化文件/目录/
+  Review/Session/Skill 引用、带 revision 的队列编辑与 Session 草稿恢复让输入意图可见且可恢复。
 - **本地安全边界。** Host 只绑定 `127.0.0.1`；写请求必须携带精确 Origin、进程 nonce、JSON body 和
   幂等键。响应设置严格 CSP，浏览器 payload 经过脱敏，大型工具结果按字节分页读取。
 - **Host 管理的 Settings。** 外观、默认模型、工作区 Effort 与全局工具确认策略统一进入严格、带
@@ -71,10 +95,10 @@ MCP 仍是用户可见的扩展边界。
 支持 Node.js 22.12+、24 和 26。生产环境建议使用 Node 24 LTS，当前开发环境也支持 Node 26
 Current。Node 20 已结束上游维护，不再属于 v0.3 Runtime 合同。
 
-当 npm 已存在不可变的 `0.3.1` 发布凭据后：
+当 npm 已存在不可变的 `0.3.4` 发布凭据后：
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.1
+npm install -g @orion-agents/orion-code@0.3.4
 orion --version
 orion doctor
 ```
@@ -144,18 +168,19 @@ orion commit
 
 ### 本地 Web Workbench
 
-`orion web` 在同一个 loopback origin 提供打包后的客户端与 `/api/v1/*`，v0.3.1 不提供 LAN bind。
+`orion web` 在同一个 loopback origin 提供打包后的客户端与 `/api/v1/*`，不提供 LAN bind。
 Provider 凭据仍通过 Orion 配置/环境变量管理；浏览器负责选择工作区和会话、执行或 steer 任务、回答
 审批并查看运行态。关闭或刷新 tab 不会替用户批准/拒绝，pending approval 仍由 Runtime 持有；停止
 Host 时会 abort 并 fail-closed。
 
-浏览器只展示已提交 Plan receipt 的 `body`、`returnMode`、`digest`，不会额外插入 review gate。
-PLAN 提交后仍由既有 Runtime 恢复 BUILD/AUTO，并在新的 logical turn 中启动实现。
+浏览器展示已提交 Plan receipt，并进入 durable `awaiting_review`。批准会创建独立 BUILD request；继续规划
+携带反馈创建独立 PLAN request；取消不产生执行副作用。三种操作均绑定 exact digest，刷新或 Host restart
+后可恢复，stale review fail-closed。
 
 多项目导航不会创建多个 Runtime；跨项目 Session 选择是一次带 revision guard 的原子 Context 切换。
-桌面右栏可用 IDE 式鼠标拖动在 320–720px 间调整，不提供键盘精细调宽；窄屏自动使用 drawer，且不覆盖
-桌面宽度偏好。文件、Git 和审阅保持只读；创建终端需要显式 user gesture，短期 ticket 与输出均不进入
-Workbench SSE。
+桌面左栏可在 240–480px 调整或折叠为 48px rail，右栏为 320–720px；均采用 IDE 式鼠标拖动且不提供
+键盘精细调宽。窄屏自动使用 drawer，且不覆盖桌面宽度偏好。文件、Git 和审阅保持只读；创建终端需要
+显式 user gesture，短期 ticket 与输出均不进入 Workbench SSE。
 
 #### Host 管理的 Settings
 
@@ -171,12 +196,13 @@ Web API，页面只显示 readiness，打开本地配置文件的动作也不接
 
 ### BUILD、PLAN、AUTO
 
-按 `Shift+Tab` 循环 `BUILD → PLAN → AUTO`。状态栏和输入框边框会显示当前模式。Mode 决定工作流，
-Authority、approval、路径边界和 sandbox policy 是独立状态轴。
+使用 Composer 模式菜单选择 `BUILD`、`PLAN` 或 `AUTO`；旁边的权限菜单选择 Project default、Ask、
+Allow 或 Deny。Mode 决定工作流，Authority、approval、路径边界和 sandbox policy 是独立状态轴；Allow
+与 AUTO 不会覆盖 hard policy 或显式 Deny。
 
 - **BUILD**：正常协作开发。
-- **PLAN**：使用同一套可用工具完成探索；将 decision-complete plan 写入 durable PlanReceipt；自动退出
-  Plan、恢复 BUILD/AUTO，并在新的 logical turn 中执行。
+- **PLAN**：使用同一套可用工具完成探索；将 decision-complete plan 写入 durable PlanReceipt；等待
+  批准、继续规划或取消。
 - **AUTO**：在已配置 Authority 内取消交互确认；hard policy 与 sandbox 边界仍然 fail closed。
 
 任务式进入：
@@ -185,7 +211,7 @@ Authority、approval、路径边界和 sandbox policy 是独立状态轴。
 /plan 重构 storage boundary 并验证 crash recovery
 ```
 
-不存在 `exit_plan_mode` 工具，也没有 `/mode` 命令。
+不存在 `exit_plan_mode` 工具。Web 通过 Composer 选择模式；终端界面保留原有模式控制。
 
 ### Durable Goal
 
@@ -244,9 +270,10 @@ npm run test:web-e2e -- --grep @settings
 
 正式准出还会只构建一次 exact tarball，并在 Node 22/24/26 安装同一个 hash，验证 package identity、
 native SQLite、TUI、terminal、print、Web、Goal、subagent、Skill、MCP、Compact 与 resume；
-WEB31-P0-01..12 还会验证多项目工作台、只读工程面板、真实 PTY、响应式与无障碍合同。详见
-[`v0.3.1 Web Workbench 方案`](docs/plan/v0.3.1-web-workbench-professional-shell-plan.md)与
-[`v0.3.1 E2E 资格计划`](docs/test/v0.3.1-web-workbench-e2e-plan.md)。
+WEB33-P0-01..12 验证内置外观合同，WEB33-P0-16..24 验证并行 Session actors、标签页本地前台切换、
+有界队列、右侧 rail 与唯一 Settings 入口。详见 [`v0.3.3 方案`](docs/plan/v0.3.3-plan.md)与
+[`v0.3.3 E2E 资格计划`](docs/test/v0.3.3-web-workbench-e2e-plan.md)。v0.3.4 的安全与稳定化增量见
+[`v0.3.4 测试计划`](docs/test/v0.3.4-stabilization-e2e-plan.md)；它不会把 source gate 当成发布凭据。
 
 ## 安全
 

package/dist/commands/model-command-handlers.js

@@ -408,6 +408,24 @@ async function handleModel(ctx, args) {
     if (!ctx.llm) {
         return { success: false, error: 'LLM not initialized. Configure a provider first.' };
     }
+    if (ctx.sessionComposerControls) {
+        try {
+            const receipt = await ctx.sessionComposerControls.selectModel({ modelId: args.trim() });
+            const selected = ctx.sessionComposerControls.describe().model;
+            write(SUCCESS(`✔ Model changed to ${BRAND(selected.modelId)}`));
+            write(DIM(`  Context window ${formatTokenCount(selected.contextWindow)} tokens (${selected.providerLabel ?? 'configured provider'})`));
+            if (receipt.compacted)
+                write(DIM('  Context compacted before switching models.'));
+            write();
+            return result(true);
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
     // 解析别名
     const registryProfile = resolveModelFromRegistry(ctx.config, args);
     const resolvedModel = registryProfile ? registryProfile.model : (0, model_catalog_1.resolveModelAlias)(args);
@@ -553,13 +571,35 @@ async function handlePermissions(ctx, args) {
         ctx.store.setPermissionMode('acceptEdits');
         return { success: true, output: 'Tool edit policy changed to allow-edits.' };
     }
-    if (!['allow', 'ask', 'deny'].includes(value)) {
+    if (!['allow', 'ask', 'deny', 'inherit', 'default'].includes(value)) {
         return {
             success: false,
-            error: `Unknown tool policy: ${value}. Use one of: show, ask, allow, deny, allow-edits, audit.`,
+            error: `Unknown tool policy: ${value}. Use one of: show, ask, allow, deny, inherit, allow-edits, audit.`,
         };
     }
-    const toolConfirmation = value;
+    const toolConfirmation = ['inherit', 'default'].includes(value)
+        ? null
+        : value;
+    if (ctx.sessionComposerControls) {
+        try {
+            const receipt = await ctx.sessionComposerControls.setPermissionOverride(toolConfirmation);
+            if (snapshot.permissionMode === 'acceptEdits')
+                ctx.store.setPermissionMode('default');
+            return {
+                success: true,
+                output: `Session tool confirmation changed to ${receipt.current.effective} (${receipt.current.source}).`,
+            };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: `Tool confirmation was not changed: ${error instanceof Error ? error.message : String(error)}`,
+            };
+        }
+    }
+    if (toolConfirmation === null) {
+        return { success: false, error: 'Session permission inheritance is unavailable.' };
+    }
     try {
         await updateDurableSettings(ctx, 'permissions', [
             { op: 'set', key: 'permissions.toolConfirmation', value: toolConfirmation },
@@ -657,18 +697,23 @@ async function handleEffort(ctx, args) {
     }
     try {
         if (parsed.scope === 'session') {
-            const activeSession = session ?? ctx.ensureSession?.();
-            if (!activeSession) {
-                return { success: false, error: 'Cannot persist effort without an active session.' };
+            if (ctx.sessionComposerControls) {
+                await ctx.sessionComposerControls.setEffort(parsed.preference);
             }
-            const persisted = (0, session_storage_1.updateSessionEffort)(activeSession.id, parsed.preference);
-            if (!persisted) {
-                return { success: false, error: `Session ${activeSession.id} is no longer available.` };
+            else {
+                const activeSession = session ?? ctx.ensureSession?.();
+                if (!activeSession) {
+                    return { success: false, error: 'Cannot persist effort without an active session.' };
+                }
+                const persisted = (0, session_storage_1.updateSessionEffort)(activeSession.id, parsed.preference);
+                if (!persisted) {
+                    return { success: false, error: `Session ${activeSession.id} is no longer available.` };
+                }
+                if (persisted.effortPreference === undefined)
+                    delete activeSession.effortPreference;
+                else
+                    activeSession.effortPreference = persisted.effortPreference;
             }
-            if (persisted.effortPreference === undefined)
-                delete activeSession.effortPreference;
-            else
-                activeSession.effortPreference = persisted.effortPreference;
         }
         else {
             const key = parsed.scope === 'project'
@@ -687,7 +732,7 @@ async function handleEffort(ctx, args) {
         };
     }
     let effective = ctx.store.getSnapshot().resolvedEffort ?? current;
-    if (parsed.scope === 'session') {
+    if (parsed.scope === 'session' && !ctx.sessionComposerControls) {
         effective = (0, effort_1.resolveProfileEffort)(profile, {
             session: parsed.preference,
             project: projectConfig.defaultEffort,

package/dist/commands/types.d.ts

@@ -10,6 +10,7 @@ import type { OrionCodeCLIConfig, UIRenderer } from '../services/config';
 import type { SessionMeta } from '../services/session-storage';
 import type { CompactCoordinator } from '../services/compact';
 import type { ModelCoordinator } from '../runtime/model-coordinator';
+import type { SessionComposerControlServiceV1 } from '../runtime/session-composer-control';
 import type { SessionGoalV1 } from '../runtime/goals/types';
 import type { OrionRuntimeDiagnosticsV1 } from '../runtime/orion-runtime-v1';
 import type { ThreadSessionRuntimeActivationV1 } from '../runtime/thread-session-view';
@@ -25,6 +26,8 @@ export interface CommandContext {
     compactCoordinator?: CompactCoordinator;
     /** Transactional model/profile switch owner. */
     modelCoordinator?: ModelCoordinator;
+    /** Shared Session-scoped model/effort/permission authority used by Web and slash commands. */
+    sessionComposerControls?: SessionComposerControlServiceV1;
     /** 当前会话 ID（用于记录消息） */
     sessionId?: string;
     /** Lazily create or return the active session. */
@@ -69,6 +72,9 @@ export interface CommandContext {
     updateSettings?: (input: RuntimeSettingsMutationV1) => Promise<SettingsUpdateResultV1>;
     /** Execute explicit compaction through the v0.2 maintenance transaction. */
     compact?: (input: import('../runtime/agent-runtime-runner').AgentRuntimeCompactInputV1) => Promise<import('../runtime/agent-runtime-runner').AgentRuntimeCompactResultV1>;
+    /** Resolve the latest durable Plan review through the active Session runtime. */
+    reviewPlan?: NonNullable<import('../runtime/agent-runtime-runner').AgentRuntimeRunnerV1['reviewPlan']>;
+    getPlanReviewState?: NonNullable<import('../runtime/agent-runtime-runner').AgentRuntimeRunnerV1['planReviewState']>;
 }
 /** 命令执行结果 */
 export interface CommandResult {

package/dist/commands/workflow-command-handlers.d.ts

@@ -1,6 +1,6 @@
 /** Handler implementations for the workflow-command-handlers boundary. */
 import { type CommandContext, type CommandResult } from './types';
-declare function handlePlan(ctx: CommandContext, args: string): CommandResult;
+declare function handlePlan(ctx: CommandContext, args: string): Promise<CommandResult>;
 declare function handleDiff(ctx: CommandContext, args: string): CommandResult;
 declare function handleCommitPlan(ctx: CommandContext, args: string): CommandResult;
 declare function continueAsSlashChat(name: string, args: string): CommandResult;