Add a /model picker that switches between the seven supported models with cross-provider greying, and rename /s and /n to /safe and /normal.

Author: alexylon

CHANGELOG.md

@@ -6,6 +6,8 @@ All notable changes to Sofos are documented in this file.
 
 ### Added
 
+- **A new `/model` command opens an inline picker that lets you switch the active model.** Up and Down highlight an entry, Enter confirms, Esc cancels. Each row shows the model id, a short description, and a `(current)` tag on the model you are using right now. Models on the other provider are greyed out and tagged `(re-launch session to activate)`, because the underlying API client is built once at startup and cannot swap providers mid-session. The cursor skips greyed rows so you cannot land on a model the running session cannot reach. Typing `/model <name>` switches directly without opening the picker; same-provider switches happen in place, cross-provider attempts are refused with a clear "re-launch with `--model <name>`" message.
+- **`--model` now lists the supported models when it rejects a value.** Passing `--model gpt-9.9` (or any slug outside the supported set) exits with `[supported models: claude-opus-4-7, claude-sonnet-4-6, claude-haiku-4-5, gpt-5.5, gpt-5.4, gpt-5.4-mini, gpt-5.3-codex]`, mirroring the existing `--reasoning-effort` rejection so the failure mode is consistent.
 - **An inline suggestion list appears the moment you type `/`.** As soon as the input begins with a slash, a small panel below the input box lists every available slash command together with a short description, filtered by what you have typed so far. Up and Down highlight an entry, Enter runs it, Tab inserts it into the input so you can finish typing arguments, and Esc closes the panel. The Tab autocomplete that previously worked silently for a single match still does, but it now goes through the same suggestion list.
 - **New `view_image` tool lets the model open an image on demand.** Given a local image file path or an `http(s)://` URL, the tool attaches the image to the conversation so the model can describe it. For a folder of images, the model is told to call `list_directory` first and then `view_image` once per file. Supports JPEG, PNG, GIF, and WebP up to 20 MB per local file; URLs are passed through to the model provider, which fetches them on its side. External paths reuse the same Read-permission prompt as `read_file`, so granting access to a directory once covers both tools. Local images larger than 2048 pixels on the long side are downscaled proportionally before they reach the model so a 4K screenshot does not burn through the per-image token budget; smaller images are sent unchanged.
 
@@ -17,7 +19,7 @@ All notable changes to Sofos are documented in this file.
 
 - **Shell command and process substitution are now blocked in bash commands.** Constructs such as `echo $(rm bad)`, backtick substitution, and process substitution `<(cmd)` / `>(cmd)` previously slipped past the permission system because only the outer command name was checked. They are now refused before the command runs, with a clear message that names the marker. Single-quoted literals and arithmetic expansion `$((expr))` continue to work.
 - **Workspace symlinks can no longer route bash reads outside the workspace.** When a bash command names a workspace-relative path that resolves through a symlink to a file outside the workspace, the path is now sent through the same external-path prompt that absolute and tilde paths already use.
-- **MCP tools are filtered out in safe mode by default.** Previously safe mode only restricted Sofos's native tools, so any tool exposed by a configured MCP server still ran in safe-mode sessions. Each MCP server entry now has a `safe_mode` setting — `disabled` (default, filtered), `read_only`, or `allow` — and only servers whose setting opts them in have their tools listed to the model when safe mode is on. The startup banner and `/s` confirmation list which servers were filtered out and which were opted in so the user can see the actual scope of the session.
+- **MCP tools are filtered out in safe mode by default.** Previously safe mode only restricted Sofos's native tools, so any tool exposed by a configured MCP server still ran in safe-mode sessions. Each MCP server entry now has a `safe_mode` setting — `disabled` (default, filtered), `read_only`, or `allow` — and only servers whose setting opts them in have their tools listed to the model when safe mode is on. The startup banner and `/safe` confirmation list which servers were filtered out and which were opted in so the user can see the actual scope of the session.
 
 ### Changed
 
@@ -244,7 +246,7 @@ All notable changes to Sofos are documented in this file.
 
 - **Claude Opus 4.7 adaptive-thinking support.** Opus 4.7 rejects the older `{thinking: {type: "enabled", budget_tokens: N}}` shape; sofos now sends `{thinking: {type: "adaptive"}, output_config: {effort}}` instead. `/think on` maps to `effort: high`, `/think off` to `effort: low`. Status line and startup banner show `Adaptive thinking effort: high|low` instead of a fake token budget.
 - **Confirmation modal now fits short terminals.** The 4-choice permission prompt grows the viewport when it can; when it can't, drops the separators / hint row and scrolls the choice list around the cursor with `▴` / `▾` cues.
-- **Visible feedback on `/s` and `/n`** (safe-mode toggles). Now prints a one-line status (`Safe mode: enabled / read-only tools only; no writes or bash`, `Safe mode: disabled / all tools available`, or a dimmed `already enabled/disabled`).
+- **Visible feedback on `/safe` and `/normal`** (safe-mode toggles). Now prints a one-line status (`Safe mode: enabled / read-only tools only; no writes or bash`, `Safe mode: disabled / all tools available`, or a dimmed `already enabled/disabled`).
 
 ### Security
 

README.md

@@ -182,17 +182,19 @@ sofos --resume
 
 ### Interactive commands
 
-| Command | Description |
-|---|---|
-| `/resume` | Open the session picker and resume a saved conversation. |
-| `/clear` | Clear the current conversation history and start a fresh session id. |
-| `/compact` | Compact older context to reduce token usage. |
-| `/think` | Show the current reasoning-effort setting. |
+| Command                                     | Description |
+|---------------------------------------------|---|
+| `/resume`                                   | Open the session picker and resume a saved conversation. |
+| `/clear`                                    | Clear the current conversation history and start a fresh session id. |
+| `/compact`                                  | Compact older context to reduce token usage. |
+| `/think`                                    | Show the current reasoning-effort setting. |
 | `/think off\|low\|medium\|high\|xhigh\|max` | Change reasoning effort when the active model supports the selected level. |
-| `/s` | Enable safe mode: read-only native tools. Prompt changes to `:`. |
-| `/n` | Return to normal mode. Prompt changes to `>`. |
-| `/exit`, `/quit`, `/q`, `Ctrl+D` | Save the session and exit with a cost summary. |
-| `ESC` or `Ctrl+C` while busy | Interrupt the current AI turn. |
+| `/model`                                    | Open the model picker. Highlight an entry with **Up / Down**, **Enter** to switch, **Esc** to cancel. Models on the other provider are greyed out (the API client is fixed at startup) and the cursor skips them. |
+| `/model <name>`                             | Switch directly to a named model without opening the picker. Same-provider only — cross-provider switches require relaunching with `--model <name>`. |
+| `/safe`                                     | Enable safe mode: read-only native tools. Prompt changes to `:`. |
+| `/normal`                                   | Return to normal mode. Prompt changes to `>`. |
+| `/exit`, `/quit`, `/q`, `Ctrl+D`            | Save the session and exit with a cost summary. |
+| `ESC` or `Ctrl+C` while busy                | Interrupt the current AI turn. |
 
 ### Input behaviour
 
@@ -258,6 +260,20 @@ Supported formats: JPEG, PNG, GIF, and WebP. Local images are capped at 20 MB. I
 
 ## Models and reasoning effort
 
+Sofos supports seven models, in `/model` picker order:
+
+| Model | Provider |
+|---|---|
+| `claude-opus-4-7` | Anthropic |
+| `claude-sonnet-4-6` (default) | Anthropic |
+| `claude-haiku-4-5` | Anthropic |
+| `gpt-5.5` | OpenAI |
+| `gpt-5.4` | OpenAI |
+| `gpt-5.4-mini` | OpenAI |
+| `gpt-5.3-codex` | OpenAI |
+
+`--model <name>` accepts only the values above; any other slug is refused at startup with the supported list. The same whitelist drives the inline `/model` picker, so the two surfaces never disagree about which models exist.
+
 Sofos exposes six reasoning levels:
 
 ```text
@@ -278,20 +294,20 @@ sofos -e xhigh --model gpt-5.5        # Highest OpenAI gpt-5 reasoning level.
 
 Support matrix:
 
-| Effort | Opus 4.7 | Opus 4.6 | Sonnet 4.6 | Haiku 4.5 / older Claude | OpenAI gpt-5 reasoning models |
-|---|:---:|:---:|:---:|:---:|:---:|
-| `off` | ✓ | ✓ | ✓ | ✓ | ✓ |
-| `low` | ✓ | ✓ | ✓ | ✓ | ✓ |
-| `medium` | ✓ | ✓ | ✓ | ✓ | ✓ |
-| `high` | ✓ | ✓ | ✓ | ✓ | ✓ |
-| `xhigh` | ✓ | ✗ | ✗ | ✗ | ✓ |
-| `max` | ✓ | ✓ | ✓ | ✗ | ✗ |
+| Effort | Opus 4.7 | Sonnet 4.6 | Haiku 4.5 | OpenAI gpt-5 reasoning models |
+|---|:---:|:---:|:---:|:---:|
+| `off` | ✓ | ✓ | ✓ | ✓ |
+| `low` | ✓ | ✓ | ✓ | ✓ |
+| `medium` | ✓ | ✓ | ✓ | ✓ |
+| `high` | ✓ | ✓ | ✓ | ✓ |
+| `xhigh` | ✓ | ✗ | ✗ | ✓ |
+| `max` | ✓ | ✓ | ✗ | ✗ |
 
 Provider mapping:
 
 - **OpenAI** sends `reasoning.effort`; `off` maps to minimal reasoning and suppresses reasoning summaries.
-- **Claude Opus 4.7, Opus 4.6, and Sonnet 4.6** use adaptive thinking. The provider chooses the token budget from the effort level.
-- **Older Claude models** use fixed legacy thinking budgets for `low`, `medium`, and `high`. `off` disables extended thinking.
+- **Claude Opus 4.7 and Sonnet 4.6** use adaptive thinking. The provider chooses the token budget from the effort level.
+- **Claude Haiku 4.5** uses fixed legacy thinking budgets for `low`, `medium`, and `high`. `off` disables extended thinking.
 
 ---
 
@@ -323,7 +339,7 @@ Clipboard pastes are not routed through a tool: pressing Ctrl-V in the prompt at
 
 ### Safe mode tools
 
-Safe mode is enabled with `--safe-mode` or `/s`. It restricts the native tool set to:
+Safe mode is enabled with `--safe-mode` or `/safe`. It restricts the native tool set to:
 
 - `list_directory`;
 - `read_file`;

STRUCTURE.md

@@ -551,6 +551,8 @@ Rules:
 
 It contains:
 
+- the `SUPPORTED_MODELS` whitelist — every model id accepted by `--model` and shown in the `/model` picker, with its description and provider;
+- helpers `canonical_model`, `model_support_error`, and `supported_models_label` that share one source of truth with the CLI rejection message and the picker rows;
 - model registry entries;
 - context-window sizes;
 - auto-compaction thresholds;
@@ -562,7 +564,8 @@ It contains:
 Rules:
 
 - Model capability checks should use this registry instead of hard-coded scattered checks.
-- Adding a supported model should be primarily a registry change plus any provider-specific wire support if needed.
+- Adding a supported model is one struct literal in `SUPPORTED_MODELS` — the `Model` struct carries the user-facing description and provider alongside the context window, effort matrix, and pricing, so there is no separate `lookup` table to keep in sync.
+- Removing a model is one deletion in `SUPPORTED_MODELS`. The CLI and the picker share that array as their source of truth, so nothing else has to be touched.
 
 ### 4.7 `api/truncate.rs`
 
@@ -608,7 +611,7 @@ It contains:
 - available-tool refresh;
 - one-shot prompt execution;
 - status-line snapshots;
-- `/think`, `/s`, `/n`, and `/clear` state handlers;
+- `/think`, `/safe`, `/normal`, and `/clear` state handlers;
 - shared interrupt and mid-turn steering buffers.
 
 Rules:
@@ -759,6 +762,11 @@ It contains:
 - `slash_popup.rs` — state for the inline slash-command suggestion list;
 - `sgr.rs` — SGR escape helpers.
 
+The TUI also carries two modal pickers as fields on `app::App` and corresponding job/event variants:
+
+- the resume picker (`Picker` + `UiEvent::ShowResumePicker` + `Job::ResumeSelected`) drives `/resume`;
+- the model picker (`ModelPicker` + `UiEvent::ShowModelPicker` + `Job::ModelSelected`) drives `/model`. Rows on the other provider are flagged unavailable on the `ModelPickerEntry`, the renderer greys them out, and the navigation helper in `app.rs` skips past them so the cursor only lands on a model the running session can switch to.
+
 Rules:
 
 - The TUI owns terminal interaction and event routing; it does not decide provider request structure.
@@ -1298,8 +1306,8 @@ Built-in commands include:
 - `/clear`;
 - `/compact`;
 - `/think`;
-- `/s`;
-- `/n`;
+- `/safe`;
+- `/normal`;
 - `/exit`, `/quit`, `/q`.
 
 Rules:

src/api/anthropic/mod.rs

@@ -59,19 +59,14 @@ mod tests {
     }
 
     #[test]
-    fn requires_adaptive_thinking_covers_all_1m_anthropic_models() {
-        // Opus 4.7 requires adaptive (legacy shape 400s); Opus 4.6 and
-        // Sonnet 4.6 accept both but Anthropic recommends adaptive,
-        // so sofos opts them in too. Earlier 4.x models stay on the
-        // manual budget shape.
+    fn requires_adaptive_thinking_covers_supported_anthropic_models() {
+        // Opus 4.7 requires adaptive (legacy shape 400s); Sonnet 4.6
+        // accepts both shapes but Anthropic recommends adaptive, so
+        // sofos opts it in too. Haiku 4.5 stays on the legacy
+        // `budget_tokens` shape.
         assert!(requires_adaptive_thinking("claude-opus-4-7"));
-        assert!(requires_adaptive_thinking("claude-opus-4-7-20260301"));
-        assert!(requires_adaptive_thinking("claude-opus-4-6"));
         assert!(requires_adaptive_thinking("claude-sonnet-4-6"));
-        assert!(!requires_adaptive_thinking("claude-opus-4-5"));
-        assert!(!requires_adaptive_thinking("claude-sonnet-4-5"));
         assert!(!requires_adaptive_thinking("claude-haiku-4-5"));
-        assert!(!requires_adaptive_thinking(""));
     }
 
     #[test]
@@ -92,21 +87,16 @@ mod tests {
     #[test]
     fn anthropic_beta_for_matches_model_info_predicate() {
         // The beta header and the request body's `context_management`
-        // are gated off the same `ModelInfo::supports_server_compaction`
-        // flag. An earlier version used a separate prefix list here that
-        // could disagree with `ModelInfo` — e.g. `claude-opus-4-5` would
-        // pick up the compaction beta even though the body never carried
-        // the matching field. Cross-check the two sources of truth so any
-        // future drift surfaces here instead of as a wire-format 400.
-        for model in [
-            "claude-opus-4-7",
-            "claude-opus-4-6",
-            "claude-sonnet-4-6",
-            "claude-haiku-4-5",
-            "claude-opus-4-5",
-            "claude-sonnet-3-7",
-            "some-unknown-future-model",
-        ] {
+        // are gated off the same `Model::supports_server_compaction`
+        // flag. An earlier version used a separate prefix list here
+        // that could disagree with the per-model record; cross-check
+        // the two sources of truth so any future drift surfaces here
+        // instead of as a wire-format 400. Iterates the whitelist so
+        // every supported model is covered automatically.
+        let supported_models = crate::api::model_info::SUPPORTED_MODELS
+            .iter()
+            .map(|m| m.name);
+        for model in supported_models.chain(std::iter::once("some-unknown-future-model")) {
             let expected = crate::api::model_info::lookup(model).supports_server_compaction;
             let header = anthropic_beta_for(model);
             assert_eq!(

src/api/anthropic/wire.rs

@@ -39,7 +39,7 @@ pub(super) const BETA_TOKEN_EFFICIENT_AND_COMPACT: &str =
     "token-efficient-tools-2025-02-19,compact-2026-01-12";
 
 /// Pick the `anthropic-beta` value for `model`. Compaction is gated
-/// off the same `ModelInfo::supports_server_compaction` flag the
+/// off the same `Model::supports_server_compaction` flag the
 /// request builder uses to attach the `context_management` field, so
 /// the beta header and the body field can never disagree about which
 /// models speak server-side compaction.
@@ -73,8 +73,8 @@ pub fn legacy_thinking_budget(effort: ReasoningEffort) -> u32 {
     match effort {
         ReasoningEffort::Off | ReasoningEffort::Low => LEGACY_THINKING_BUDGET_LOW,
         ReasoningEffort::Medium => LEGACY_THINKING_BUDGET_MEDIUM,
-        // Legacy-thinking models (Sonnet 4.5, Opus 4.5, Haiku 4.5) only
-        // expose budget tiers up to High. `XHigh` and `Max` are
+        // Legacy-thinking models (Haiku 4.5) only expose budget tiers
+        // up to High. `XHigh` and `Max` are
         // adaptive-only rungs that upstream validation refuses to pair
         // with a legacy model, so this branch is unreachable in
         // practice; clamp defensively to the highest legal budget.

src/api/mod.rs

@@ -6,7 +6,7 @@ pub mod truncate;
 pub mod types;
 pub mod utils;
 
-pub use model_info::ModelInfo;
+pub use model_info::Model;
 
 pub use anthropic::AnthropicClient;
 pub use morph::MorphClient;