one-code-extension 0.4.0 → 0.5.0

package/docs/guide/permissions-modes-and-auto-mode.md

@@ -24,15 +24,21 @@ For each tool call, the gate checks the following in order:
 3. **`ask` rules.** A matching `ask` rule prompts you, even in a mode that
    would otherwise approve the call.
 4. **`allow` rules.** A matching `allow` rule approves the call without a
-   prompt.
+   prompt. A shell rule doesn't cover the command's redirects outside the
+   working directory: with `Bash(echo:*)`, `echo x >> ~/.zshrc` still
+   prompts you, and in auto mode it goes to the classifier.
 5. **The mode's default.** Anything no rule covers is decided by the current
    permission mode.
 
 A handful of tools are always allowed because other tools sit behind them:
 `tool_search`, `skill`, `Agent`, `SendMessage`, `list_agents`, `workflow`,
 `ask_user_question`, `lsp_diagnostics`, `list_mcp_resources`, the task-list
-tools, `schedule_wakeup`, and the plan-mode tools. The tool calls these
-tools make in turn (a subagent's own edits, for example) are still gated.
+tools, `cron_list`, `cron_delete`, and the plan-mode tools. The tool calls
+these tools make in turn (a subagent's own edits, for example) are still
+gated. `cron_create` and `schedule_wakeup` are allowed too, except in auto
+mode, where the classifier reviews what the scheduled prompt asks for unless an
+allow rule names the tool, as in Claude Code. A fired prompt's own tool calls
+go through the usual checks.
 
 ## Permission rules
 
@@ -73,15 +79,22 @@ they are hard to sidestep. They apply when they match the raw line, any
 subcommand of a compound line (`&&`, `||`, `;`, `|`, `&`, or a newline), or
 the payload of a wrapper. Wrappers such as `env`, `command`, `nice`,
 `timeout`, and `xargs` are peeled, `sh -c '…'` and the other shells are
-expanded, and the command word is reduced to its lowercased basename, so
+expanded (so is a heredoc or here-string fed to a shell, as in
+`sh <<'EOF'`), and the command word is reduced to its lowercased basename, so
 `/bin/rm`, `\rm`, and `RM` all match a rule written for `rm`.
 
 `allow` rules are matched against the literal spelling only, and a compound
 command line is allowed only when an `allow` rule covers every one of its
-subcommands, or when an exact rule matches the whole line. A line that
-contains command substitution (`$(…)` or backticks), `eval`, `exec`, a pipe
-into an interpreter, or a base64 decode is never covered by a prefix or
-wildcard `allow` rule.
+subcommands, or when an exact rule matches the whole line. `eval`, `sh`, and
+`xargs` are subcommands like any other, so each needs a rule of its own.
+
+The commands inside a command substitution (`$(…)` or backticks) or a
+process substitution (`<(…)`) must be covered too, because they run. A rule
+can cover them, or One Code covers the whole substitution when it can prove
+the substitution only reads files inside the project. So
+`Bash(git commit:*)` allows `git commit -m "$(cat <<'EOF' … EOF)"`, but it
+doesn't allow `npm test $(curl …)`. A line containing a subshell, a loop, or
+a function is never covered by a prefix or wildcard `allow` rule.
 
 ### PowerShell rule patterns
 
@@ -109,11 +122,32 @@ Add `global` at the end to save it for every repository instead:
 /allow Bash(npm test:*) global
 ```
 
-To review the current mode and every loaded rule, including which project
-rules are trusted and which rules couldn't be parsed, run `/permissions`.
-
 Rules One Code adds are saved under `~/.onecode`, never under `~/.claude`.
 
+### Manage permissions in the panel
+
+Run `/permissions` to open the permissions panel. It has the same tabs as
+Claude Code's:
+
+- **Recently denied**: calls the auto-mode classifier blocked in this
+  session. See [Approve a call auto mode denied](#approve-a-call-auto-mode-denied).
+- **Allow**, **Ask**, and **Deny**: every rule, with the file it came from.
+  Type to filter the list. Choose **Add a new rule…** to add one, and pick
+  whether it's saved for this project or for every project.
+- **Auto mode**: the classifier's own rules and environment. See
+  [Configure auto mode](#configure-auto-mode).
+- **Workspace**: the working directory and any extra directories. See
+  [Workspace directories](#workspace-directories).
+
+Use ←/→ to switch tabs, ↑/↓ to move, Enter to open a row, and Esc to close.
+The footer always shows the keys that work where you are.
+
+The panel only changes One Code's own files and this session's grants. A
+rule from Claude Code's settings, the repository's `.claude` files, or
+managed settings is listed but read-only, and its detail view names the file
+to change instead. Whatever you change is passed to the model when the panel
+closes, so it knows a rule is gone.
+
 ## Permission modes
 
 A mode sets the default answer for actions no rule covers. **Auto is the
@@ -123,7 +157,7 @@ stops risky ones, so you're not prompted for every step.
 | Mode | Badge | What it does |
 |---|---|---|
 | Manual | `⏸ manual mode on` | Prompts for anything not already allowed. The `--permission-mode` value is `default`. |
-| Accept edits | `⏵⏵ accept edits on` | File edits inside the working directory run without a prompt. Everything else still prompts. The flag value is `acceptEdits`. |
+| Accept edits | `⏵⏵ accept edits on` | File edits inside the working directory run without a prompt. With a frontier or workhorse model, so do in-project `mkdir`, `touch`, `cp`, `mv`, `rm`, and `rmdir` commands. Everything else still prompts. The flag value is `acceptEdits`. |
 | Plan | `⏸ plan mode on` | Read-only investigation plus one plan file. See [Plan mode](#plan-mode). The flag value is `plan`. |
 | Auto | `⏵⏵ auto mode on` | A classifier screens each action. See [Auto mode](#auto-mode). The flag value is `auto`. |
 | Bypass permissions | `⏵⏵ bypass permissions on` | Runs everything without prompts, including writes to protected paths. The flag value is `bypassPermissions`; `--dangerously-skip-permissions` also selects it. |
@@ -208,7 +242,8 @@ and these choices:
   - A file inside the working directory: that tool anywhere in the working
     directory.
   - A file outside the working directory: that tool within the file's
-    directory only.
+    directory only. For a file directly in your home directory, only that
+    file.
   - A URL: that host.
 - **No, tell the agent what to do differently.** Deny it, with an optional
   note that is passed to the model as the reason.
@@ -225,9 +260,25 @@ action that would have prompted is denied and the model is told why.
 Reads and edits are confined to the working directory by default:
 
 - Reading a file inside the working directory is allowed in every mode.
-  Reading outside it prompts in manual mode, goes to the classifier in auto
-  mode, and is denied in don't-ask mode.
-- Accept-edits mode approves edits only inside the working directory.
+  Reading outside it prompts in manual mode and is denied in don't-ask
+  mode. In auto mode it runs without the classifier with a frontier or
+  workhorse model, after a one-time question (see [Reads outside the
+  working directories](#reads-outside-the-working-directories)), and goes
+  to the classifier with a cheap or tiny model.
+- A shell command that only reads inside the working directory (`ls`,
+  `git status`, `head README.md`) runs without a prompt in every mode, the
+  way Claude Code's shell tools approve one themselves. The same analysis
+  auto mode uses decides it, so a command it can't prove read-only prompts,
+  and one that reads outside the working directory is treated like an
+  outside read.
+- Accept-edits mode approves edits only inside the working directory. With
+  a frontier or workhorse model it also approves a command line made only
+  of `mkdir`, `touch`, `cp`, `mv`, `rm`, and `rmdir` whose paths all stay
+  inside, as Claude Code does. Removing or moving the working directory
+  itself, a `.git` directory, or a directory that holds one still prompts.
+  So does any of these commands that would remove, overwrite, or create a
+  protected path or a credential file, even inside a directory it names
+  (`cp settings.json .claude`, `rm -rf .husky`).
 - The harness's own session directories count as inside: the auto-memory
   folder, the session scratchpad, persisted tool output, the plan file, and
   this project's own session transcripts (with auto mode's decision log next
@@ -237,6 +288,33 @@ Reads and edits are confined to the working directory by default:
 Paths are compared after resolving symlinks, so a symlink inside the project
 that points outside it counts as outside.
 
+### Workspace directories
+
+To let One Code read another directory without asking, add it to the
+workspace. It works like Claude Code's additional working directories:
+
+- Run `/add-dir PATH`, then choose **Yes, for this session** or **Yes, and
+  remember this directory**. A remembered directory is saved to this
+  project's One Code settings.
+- Start One Code with `--add-dir PATH`. To add several, separate them with
+  `:` (`;` on Windows).
+- List them under `permissions.additionalDirectories` in your settings.
+- Add or remove them in the **Workspace** tab of `/permissions`.
+
+Reading inside a workspace directory then works like reading inside the
+working directory, and accept-edits mode can edit files there. A
+credential file inside a workspace directory, such as a key under `.ssh`,
+still prompts. With a cheap or tiny model, auto mode also sends every write
+or delete in a workspace directory to the classifier; with a frontier or
+workhorse model it treats them like writes in the working directory.
+
+The filesystem root, your home directory, and any directory that contains
+it (such as `/Users`) can't be added; add something narrower. If a settings file lists one of them, One Code ignores it and warns
+you. Directories listed in the repository's own `.claude` settings apply
+only after you trust the repository (see [Trusting a project](#trusting-a-project)).
+The system prompt lists the workspace directories that were in force when
+the session started.
+
 In auto mode, a shell command that reads outside the working directory, a
 bare `env`, or a `printenv` is never treated as safe by the deterministic
 check and always goes to the classifier.
@@ -250,7 +328,7 @@ Protected directories, including everything inside them:
 
 `.git`, `.config/git`, `.vscode`, `.idea`, `.husky`, `.cargo`,
 `.devcontainer`, `.yarn`, `.mvn`, `.claude`, `.onecode`,
-`Library/LaunchAgents`, `.config/fish`, `.local/bin`.
+`Library/LaunchAgents`, `.config/fish`, `.local/bin`, `.ssh`.
 
 `.claude/worktrees` and `.onecode/plans` are ordinary working space and are
 exempt.
@@ -285,6 +363,7 @@ current session only.
 | Hooks in `.claude/settings.json` or `.claude/settings.local.json` | At startup: "Run this project's hooks?", listing each command. | `~/.onecode/hooks/project-approvals.json` |
 | MCP servers in `.mcp.json` | At startup, for each new server. See [MCP servers](skills-plugins-and-mcp.md#mcp-servers). | `~/.onecode/mcp/project-approvals.json` |
 | `permissions.allow` rules in the project's settings files | The first time such a rule would decide a call: "Trust this repository's allow rules?" | `~/.onecode/permissions/project-allow-approvals.json` |
+| `permissions.additionalDirectories` in the project's settings files | The first time a read inside one of them would skip a prompt. The same question covers the project's allow rules. | `~/.onecode/permissions/project-allow-approvals.json` |
 
 `deny` and `ask` rules from a project never prompt; they only tighten the
 gate. Hooks and servers from your user settings, managed settings, or an
@@ -315,12 +394,14 @@ shows the plan. Nothing runs until you choose. The choices are:
 2. **Approve into auto mode**, when a classifier model is available.
 3. **Approve into accept-edits mode.**
 4. **Approve into manual mode.**
-5. **Keep planning.** No mode change; the model refines the plan file.
+5. **Keep planning.** You're asked what to change, and the model gets your
+   answer and refines the plan file. No mode change.
 
 The initial highlight is the option that restores your previous mode, or
 manual mode when that isn't offered. It never lands on a more permissive
-option by default. Press the number of a choice to pick it directly, or
-**Esc** to keep planning.
+option by default. Press the number of a choice to pick it directly. **Esc**
+rejects the plan and stops the turn; the session stays in plan mode until you
+tell the model how to go on.
 
 In a non-interactive run there's no one to approve, so `exit_plan_mode`
 refuses and the session stays in plan mode with the plan on disk.
@@ -333,24 +414,72 @@ classifier.
 
 ### What is approved without a classifier call
 
+Which actions skip the classifier depends on the tier of the model making
+the call (see [Prompting adapts to the
+model](providers-and-models.md#prompting-adapts-to-the-model)). Frontier
+and workhorse models get Claude Code's shortcuts. Cheap and tiny models
+get a stricter set: Claude Code doesn't run auto mode on Haiku 4.5 and
+older at all, and smaller models are the likeliest to take a risky
+action nobody asked for.
+
+With every model:
+
 - Actions a deterministic analysis proves safe. Read-only shell commands
-  inside the working directory are the common case. This analysis can only
-  ever conclude "safe"; anything it can't parse or recognize goes to the
+  inside the working directory are the common case (they run without a
+  prompt in every mode, see [the working directory
+  boundary](#the-working-directory-boundary)), including multi-line
+  commands, heredocs, and substitutions whose own commands are read-only
+  (`diff <(git show HEAD:a) a`). An in-project redirect such as
+  `echo hi > notes.txt` counts too. This analysis can only ever conclude
+  "safe"; anything it can't parse or recognize, or a value that only exists
+  when the command runs (an environment variable, say), goes to the
   classifier rather than through.
 - Edits and writes to files inside the project that are not credential
   files, not protected paths, and not files that run code on their own
   (build wrappers, CI workflows, editor auto-run configuration).
-- Deleting or resetting files inside the project **when git can recover
-  them**. A tracked, committed file can be restored, so removing it is
-  approved. An untracked or modified file can't, so removing it goes to
-  the classifier. Claude Code trusts the whole project directory here; One
-  Code checks recoverability first.
+
+With a frontier or workhorse model, also everything accept-edits mode
+would approve, as in Claude Code:
+
+- Edits and writes anywhere in the working directory and the workspace
+  directories, including CI workflows and build wrappers. Protected paths
+  are still judged.
+- Command lines made only of `mkdir`, `touch`, `cp`, `mv`, `rm`, and
+  `rmdir` whose paths all stay inside. `sed` isn't included; it goes to the
+  classifier.
+- Reads outside the working directories, except credential files (see
+  [Reads outside the working directories](#reads-outside-the-working-directories)).
+
+A subagent's calls are judged by the subagent's own model, so a subagent
+on a cheaper model gets the stricter set. When you switch the session to a
+model on the other side of this line, One Code shows a notice.
 
 ### What goes to the classifier
 
-Everything else: destructive commands git can't undo, anything that
-reaches outside the project, network-affecting commands, writes to
-protected paths, and reads outside the working directory.
+Everything else: `git reset --hard` and other destructive commands,
+deleting files with a cheap or tiny model, anything that reaches outside
+the project other than the reads described earlier, network-affecting
+commands, and writes to protected paths.
+
+### Reads outside the working directories
+
+With a frontier or workhorse model, the first time auto mode reads a file
+outside the working directories, One Code asks once, as Claude Code does:
+
+- **Yes, keep allowing reads outside the working directories** allows the
+  read and doesn't ask again.
+- **No, block reads outside the working directories from now on** refuses
+  the read and saves `permissions.blockReadsOutsideWorkingDirectories: true`
+  to `~/.onecode/settings.json`. From then on the read tools refuse any path
+  outside the working directories, in every mode except bypass and in every
+  project.
+- **No, ask again next time** refuses this read and asks again on the next.
+
+The question isn't asked in a one-shot run, or when you already answered
+it in One Code or in Claude Code. To undo **Block**, remove the setting.
+You can also set it yourself in any settings file. Reading a credential
+file outside the working directories, such as a key under `~/.ssh`, still
+goes to the classifier.
 
 The classifier is Claude Code's two-stage ruleset, embedded verbatim:
 
@@ -369,7 +498,29 @@ consult its classifier approves nothing.
 A blocked action is reported to the model with the reason so it can choose
 a safer route. You're not prompted per action while auto mode runs. After
 repeated blocks in a row, auto mode pauses and the next action prompts you;
-approving it resumes auto mode.
+approving it resumes auto mode. As in Claude Code, any action that runs
+without a block, such as a read, also breaks the run and resumes auto mode.
+A pause after 20 blocks in total waits for your approval. So that an
+unattended session isn't held indefinitely, the first of these prompts after three blocks in a row denies
+the action if nobody answers within two minutes, as Claude Code does, and
+shows a countdown. A later prompt in the same run of blocks waits for you.
+To change the wait, set `CLAUDE_CODE_TICKLISH_WHISPER_TIMEOUT_MS`, Claude
+Code's variable for it, to a number of milliseconds.
+
+### Approve a call auto mode denied
+
+When the classifier blocks a call, a notice says so and points to
+`/permissions`. If the block was wrong, open the **Recently denied** tab:
+
+- Press Enter on the call to approve it. The model is told it may retry.
+- Press `r` to approve it and have the model retry right away.
+
+Approvals apply when you close the panel. An approval covers that exact call
+once: the same tool, the same input, and the same directory. The retry then
+runs without the classifier, and the next call is judged as usual. Deny
+rules and the safety floor still apply to it. Claude Code handles this
+differently: it tells the model permission was granted, but judges the
+retry again.
 
 Allow rules that are broad enough to pre-approve arbitrary execution, such
 as `Bash(*)`, a wildcarded interpreter, or a rule that allows delegation to
@@ -378,18 +529,31 @@ Session grants from the approval prompt don't apply in auto mode either.
 
 ### The classifier model
 
-The classifier runs on a model from the same provider as your session,
-chosen automatically as the cheapest model that is at least as capable as
-the floor: a Sonnet-class model when your session runs a Sonnet-class or
-stronger model, a Haiku-class model otherwise. A weak classifier is a
-measurably weaker boundary; in testing, a Haiku-class classifier scored an
-explicitly requested recursive delete far below the block threshold that a
-Sonnet-class classifier applied to the same command.
-
-To choose the classifier yourself, run `/auto-mode model <provider/model-id>`.
-`/auto-mode model clear` returns to automatic selection. The choice is saved
-to `~/.onecode/settings.json`. When auto mode is active, the banner shows
-the classifier in use.
+The classifier stays on your session's provider unless you choose otherwise.
+For the models people use most, a pairing table built from measured scores
+picks it: an Opus session screens with Sonnet 5.5, a Sonnet 5.5 session with
+Haiku 5.5, and GPT-6 Astra with GPT-6.1 Sol. Where no smaller model of the same
+vendor comes close enough, like GPT-6.1 Sol, your own model screens. For any
+other model, it runs on the cheapest model in your session's tier or above that
+costs less than your own: there's no point screening a model with a weaker or
+more expensive one, and a model at the same price saves nothing. Either way,
+the pick has to fit your session's context window and can't be an experimental
+(`-exp`) build. If nothing meets all of that, your own model screens its calls.
+The table and the rest of the rules are in
+[Automatic model selection](providers-and-models.md#automatic-model-selection).
+
+To choose the classifier yourself, run `/auto-mode model`, or
+`/auto-mode model <provider/model-id>`. The choice is saved in
+`~/.onecode/settings.json`, never in a project's settings, and
+`/auto-mode model clear` goes back to the automatic pick. A model on another
+provider gets your messages, so it's used only on the provider you chose it
+on; after you switch providers, the automatic pick takes over until you choose
+again. One Code warns when your choice has a newer model in its line, sits two
+or more tiers below your session model, or has a smaller context window than
+your session's.
+
+When auto mode is on, the banner shows which classifier is in use, and a
+notice tells you when your own model is screening and why.
 
 ### The safety floor
 
@@ -402,6 +566,11 @@ is blocked in a non-interactive one:
 - `~/.onecode/settings.json` and any `~/.onecode/projects/<slug>/settings.json`
 - `~/.claude.json`
 - Managed settings files
+- The files that record which projects you approved:
+  `~/.onecode/hooks/project-approvals.json`,
+  `~/.onecode/mcp/project-approvals.json`,
+  `~/.onecode/permissions/project-allow-approvals.json` and
+  `~/.onecode/lsp/trusted-projects.json`
 
 ### Configure auto mode
 
@@ -409,6 +578,13 @@ Run `/auto-mode` (or `/auto-mode config`) to see the effective
 configuration: the files it was read from, the environment description,
 any extra rules, and which classifier model is in use.
 
+The **Auto mode** tab of `/permissions` edits the same configuration. It
+lists each section's built-in rules and your own, and you can add a rule
+as a plain sentence, edit it, or delete it. The environment opens in an
+editor. Changes are saved to `~/.onecode/settings.json` and apply from the
+next classifier call. The built-in rules are always in effect. Unlike Claude
+Code's panel, this one has no switch to turn a section's built-ins off.
+
 Run `/auto-mode setup` to have a model draft a configuration for your
 environment. It asks how you use One Code here, offers to scan recent shell
 history for evidence, proposes an environment description and extra rules,
@@ -425,15 +601,15 @@ The configuration keys, under `autoMode`, follow Claude Code's own schema:
 | `soft_deny` | string array | Extra rules that block unless you explicitly asked for the action. |
 | `allow` | string array | Extra rules that approve. |
 | `classifyAllShell` | boolean | Send every shell command to the classifier, even ones a narrow allow rule covers. |
-| `classifierModel` | string | The classifier model, as `provider/model-id`. |
+| `classifierModel` | string | One Code's own key: the classifier model, `provider/model-id`, instead of the automatic pick. Set it with `/auto-mode model`. |
 | `logDecisions` | boolean | Append every gate decision to `auto-mode-decisions.jsonl` next to the session files. |
 
 One Code reads `autoMode` from `~/.claude/settings.json`,
-`~/.onecode/settings.json`, and managed settings. It never reads `autoMode`
-from a project's `.claude/settings.json` or `.claude/settings.local.json`,
-because a checked-in file must not be able to loosen the classifier for
-whoever clones it. `classifierModel` is read only from `~/.onecode` and
-managed settings.
+`~/.onecode/settings.json`, and managed settings, except `classifierModel`,
+which it reads only from `~/.onecode/settings.json` and managed settings.
+It never reads `autoMode` from a project's `.claude/settings.json` or
+`.claude/settings.local.json`, because a checked-in file must not be able
+to loosen the classifier for whoever clones it.
 
 To see the classifier's verdicts while you work, set `CC_AUTO_MODE_DEBUG=1`
 before launching; each decision is printed to stderr with its stage,

package/docs/guide/providers-and-models.md

@@ -74,8 +74,9 @@ run on different models:
   for routine work and a stronger one for the hard parts.
 - **A cheaper subagent tier.** Subagents, workflow agents, the auto-mode
   classifier, and the reader model behind web fetch and recaps all run on
-  their own model. By default One Code picks these for you; see the next
-  section. `/subagent` and `/auto-mode model` set them by hand.
+  their own model. One Code picks these automatically; see the next section.
+  `/subagent` sets the subagent default by hand, and `/auto-mode model` the
+  classifier.
 
 This matters most for `ultracode` workflows, which fan work out across many
 agents at once. Running those agents on a cheap tier keeps a large fan-out
@@ -84,55 +85,79 @@ affordable while the parent session stays on a frontier model.
 ## Automatic model selection
 
 For its side roles, One Code chooses a model from the **same provider** as
-your session; automatic picks never send your data to another provider. The
-choice is the cheapest model that clears a capability floor:
-
-- **Subagents and the classifier** share one rule: a Sonnet-class model when
-  your session runs a Sonnet-class or stronger model, and a Haiku-class model
-  otherwise. This is Claude Code's classifier rule, applied to delegated work
-  too, so on most providers both roles land on the same model. A subagent is
-  never dearer than your main model; if nothing cheaper qualifies, it runs on
-  the main model.
-- **The reader** (web fetch answers, recaps) uses the cheapest capable
-  model.
+your session; automatic picks never send your data to another provider. Each
+role has its own rule, built on the model tiers that
+[Prompting adapts to the model](#prompting-adapts-to-the-model) describes:
+
+- **Subagents and the classifier** first check a pairing table for the
+  models people use most. Each pair comes from measured scores and prices,
+  so a pick is the cheapest model of the same vendor that comes close enough
+  to your main model. Subagents get a looser bar than the classifier, which
+  judges your tool calls with thinking off:
+
+  | Main model | Subagents | Classifier |
+  |---|---|---|
+  | Opus 5.5, Opus 5, Opus 4.8, Fable 5 and 5.1 | Sonnet 5.5 | Sonnet 5.5 |
+  | Sonnet 5.5, Sonnet 5 | Haiku 5.5 | Haiku 5.5 |
+  | GPT-6 Astra, GPT-5.6 Sol | GPT-6.1 Sol | GPT-6.1 Sol |
+  | GPT-6.1 Sol, GPT-6 Sol | GPT-6 Luna | main model |
+  | GPT-5.6 Terra, GPT-5.6 Luna | GPT-6 Luna | GPT-6 Luna |
+  | Gemini 4 Argon, Gemini 3.1 Pro, Gemini 3.5 to 3.7 Flash | Gemini 3.8 Flash | Gemini 3.8 Flash |
+  | DeepSeek V4 Pro, DeepSeek V4 Flash | DeepSeek V4.1 Flash | DeepSeek V4.1 Flash |
+  | GLM-5.3 | GLM-5.3 Flash | GLM-5.3 Flash |
+  | MiMo V2.6 Pro | MiMo V2.6 Flash | main model |
+  | Qwen3.8 Max | Qwen3.8 Flash | Qwen3.8 Flash |
+
+  Haiku 5.5, GPT-6 Luna, Gemini 3.8 Flash, DeepSeek V4.1 Flash, GLM-5.3
+  Flash, MiMo V2.6 Flash, Qwen3.8 Flash, Kimi K3, Grok 4.7, Muse Spark 1.3,
+  MiniMax M3, Step 5 and Mistral Large 4 keep their own model for both: no
+  smaller model of theirs comes close enough. The paired model has to be on
+  your provider and can't cost more there than your main model; the
+  classifier's pick must also fit your session's context window.
+- **Everything else** takes the cheapest model in your session's tier or
+  above that's cheaper than your main model. That covers a model the table
+  doesn't name, a pair your provider doesn't serve, and a vendor that has
+  shipped a model newer than the table: the table steps aside for that
+  vendor until it's updated. A cheap-tier session never gets upgraded. The
+  classifier's pick also has to fit your session's whole context window and
+  is never an experimental build (a `-exp` model). If nothing qualifies,
+  your own model does the job. The pick is redone when you switch models.
+- **The reader** (web fetch answers, recaps) uses the cheapest model that
+  isn't tiny.
+
+You can choose the subagent and classifier models yourself with `/subagent`
+and `/auto-mode model`. Naming a model is choosing it, even on another
+provider. One Code still tells you when a choice looks off, when you make it
+and again when a session starts (for the classifier, only when auto mode is
+on):
+
+- **A newer model is available** in the same line at about the same price.
+  GPT-5.6 Sol gets "GPT-6.1 Sol is newer and costs less". The same notice
+  appears when you pick an older main model with `/model`.
+- **The model is far weaker than your session's**: two or more tiers below
+  it, like a cheap-tier classifier for a frontier session.
+- **The classifier's context window is smaller than your session's.** It
+  still screens, but once the conversation outgrows it, each call asks for
+  your approval until you `/compact`.
+- **The classifier is a moving alias or an experimental build**, like a
+  `-latest` id. The model behind it can change without notice, and your
+  permission checks change with it. Automatic selection never picks one.
+
+`suggestNewerModels: false` in `~/.onecode/settings.json` turns off the
+newer-model notices; the others can't be turned off. `/doctor report`
+lists them all under the model they apply to.
 
 Claude Code's model aliases work everywhere: `sonnet`, `haiku`, `opus` and
 `fable` resolve to a model of that name when your provider has one, and
 otherwise to the matching class within your provider (`haiku` the cheapest
-capable model, `sonnet` the cheapest Sonnet-class model, `opus` and `fable`
-your main model). They never switch providers.
-
-Capability is judged by tier (see the next section). One Code excludes
-models that can't call tools, have no price, or are a generation behind: a
-model released more than a year after its vendor's newest drops one tier,
-and one more than two years behind never gets picked automatically.
-Provider aliases such as `:free` or `:online` variants are skipped.
-
-### Measured selection with Artificial Analysis
-
-If you have an [Artificial Analysis](https://artificialanalysis.ai) API key,
-One Code uses measured coding ability instead of name-based tiers for these
-picks: a candidate must score at least the lower of your session model's
-coding index and a Sonnet 5 reference (the reader gets 10 percent
-tolerance; subagents and the classifier get none). The score can also move
-a model to a more scaffolded prompt: a model whose coding index is below 85
-percent of the Sonnet 5 reference gets at most the cheap register, and one
-below 60 percent at most the tiny register. A score never moves a model to
-a leaner register than its name class allows. Models sold under several
-providers share one release date for this purpose, so a Codex or Azure
-listing is scored like its OpenAI twin. Set `AA_API_KEY`, or add the key to `~/.onecode/settings.json`:
+non-tiny model, `sonnet` the cheapest workhorse-tier model, `opus` and
+`fable` your main model). They never switch providers.
 
-```json
-{
-  "capabilityIndex": {
-    "artificialAnalysisApiKey": "…"
-  }
-}
-```
-
-The snapshot is cached under `~/.onecode/cache/` and refreshed at most once
-a day. Without a key, selection uses tiers alone. The measured index never
-changes the prompt tier itself.
+An automatic pick is always a model the public catalogs know and consider
+current. It skips a model that a newer one from the same vendor replaces at
+about the same price, one more than two years older than its vendor's newest
+release, and anything deprecated, unable to call tools, or unpriced.
+Provider aliases such as `:free` or `:online` variants are skipped too.
 
 `/doctor report` shows the model each role gets and why, and `/doctor
 presets` offers three coordinated presets; see
@@ -145,14 +170,72 @@ the system prompt to match:
 
 | Tier | Models | Prompt |
 |---|---|---|
-| Frontier | Opus and Fable, current generation. | Claude Code's terse prompt. |
-| Workhorse | Sonnet-class models and comparable third-party models. | Claude Code's full prompt. |
-| Cheap | Haiku-class models and comparable "flash", "mini", or "small" models. | The verbose prompt Claude Code gives Haiku. |
-| Tiny | Sub-Haiku models. | The verbose prompt plus extra scaffolding and the `grep`, `find`, and `ls` tools. |
-
-The tier is derived from the model's name, release date, and price. You
-don't configure it; set `CC_PROMPT_TIER` to force one when you want to
-experiment. `/doctor report` shows the tier in use.
+| Frontier | Opus and Fable, current generation, Sonnet 5.5 and later, Haiku 5 and later, and OpenAI's GPT-6 Astra and Sol, served by Anthropic and OpenAI themselves. | A short, terse prompt. |
+| Workhorse | A vendor's large current models. | A full, detailed prompt. |
+| Cheap | A vendor's smaller models, and large ones a year or more behind its newest. | The full prompt, with longer, more explicit tool descriptions. |
+| Tiny | Small models: under 40 billion parameters, or, when the size isn't published, a name with `nano`, `micro`, `lite` or `tiny` in it. | The cheap tier's prompt plus extra scaffolding and the `grep`, `find`, and `ls` tools. |
+
+Frontier is a fixed list, decided by model version. Haiku 5 and later get
+the frontier prompt only: when One Code picks a model for subagents or the
+classifier, or decides how strict the permission gate is, a Haiku counts at
+its catalog tier, so it never stands in for Opus. Everything else
+comes from three public catalogs: [models.dev](https://models.dev) for
+release dates and prices, OpenRouter's model list, and Hugging Face for
+parameter counts. Each model is compared with its own vendor's current
+lineup, not with other vendors:
+
+- When every current model of a vendor publishes its size, size decides: a
+  model is workhorse when it has at least half the parameters of the
+  vendor's largest current model.
+- Otherwise price decides, for all of that vendor's models: a model is
+  workhorse when its price is at least 30 percent of the median price of
+  the vendor's current models. The median keeps a premium `-pro` or `-fast`
+  model from setting the bar.
+- When price decides and a vendor has fewer than three current priced
+  models, there's nothing to compare against, so its models count as cheap.
+- A workhorse model more than a year older than its vendor's newest
+  workhorse model drops to cheap. Age never makes a model tiny.
+
+A model no catalog knows is tiny when its name gives a small size (`27b`)
+or one of those small-model words, or when it has no price or runs on a
+custom provider. Otherwise it's cheap.
+
+One Code ships with a copy of all three catalogs and refreshes them once a
+day in the background from interactive sessions; a one-shot `-p` run only
+reads the copy on disk. A refresh changes the subagent default, the reader
+and the permission checks right away. The prompt tier and the classifier
+pick change at your next session or model switch, never in the middle of
+one. Set `"refreshModelCatalog": false` in `~/.onecode/settings.json` (or
+`PI_OFFLINE=1`) to stay on the copy you have.
+
+If you disagree with a tier, set it yourself in `~/.onecode/settings.json`.
+Key it by `provider/id`, or by the model id alone, spelled exactly as the
+provider spells it (on OpenRouter that includes the vendor, as in
+`z-ai/glm-5.3-flash`). An id alone applies on every provider that uses it:
+
+```json
+{
+  "modelTiers": {
+    "openrouter/qwen/qwen3.8-max-0902": "workhorse",
+    "glm-5.3-flash": "cheap"
+  }
+}
+```
+
+This setting is read from your user settings only, never from a project.
+`CC_PROMPT_TIER` forces one tier for the session's prompt when you want to
+experiment. `/doctor report` shows the tier in use and the rule that set it.
+
+The tier also decides which permission shortcuts apply in auto and
+accept-edits modes (see [What is approved without a classifier
+call](permissions-modes-and-auto-mode.md#what-is-approved-without-a-classifier-call)).
+`CC_PROMPT_TIER` never changes the permission checks; `modelTiers` does,
+because it states what the model is.
+
+Like Claude Code, One Code gives frontier models and Sonnet 5 or later no
+task list: the `task_create` family is left out, along with the prompt line
+that points at it. Set `CLAUDE_CODE_ENABLE_TODO_TOOLS=1` to turn the task
+tools back on for them.
 
 ## Web search on providers without a search API