Accept /yolo toggle and list it among built-in commands

Bare /yolo already toggled; the ticket also named an explicit
toggle argument. PRODUCT now includes /yolo in the slash list.

Author: TheGreatAxios

docs/IMPLEMENTATION.md

@@ -127,7 +127,8 @@ src/
     commands/
       registry.ts         Extensible slash-command registry
       built-in.ts         /help, /model, /settings, /permissions, /plugins,
-                          /clear, /new, /mcp (connect providers from /model)
+                          /clear, /new, /mcp (connect providers from /model),
+                          /yolo
   tui/
     shell.ts              Transcript, header, status line, prompt, overlays
     product-host.ts        Creates the CliRenderer, wires the event bridge
@@ -143,7 +144,7 @@ docs/
 
 ### Auto Mode
 
-Auto mode defaults **on** (`config.auto = true` from `loadConfig`; pass `--no-auto` to start off, or `--auto` to force on). It is toggled only via those CLI flags — there is currently no in-session key bound to it. The permission gate reads the flag (`getAuto`/`setAuto` in `src/permission/gate.ts`) on the next tool call. Skip-permissions (`--dangerously-skip-permissions`) has a mid-session TUI toggle: `/yolo [on|off]` wires `getSkipPermissions`/`setSkipPermissions` so the gate and pre-gate sandboxes honor the change on the next tool call without rebuilding plugins.
+Auto mode defaults **on** (`config.auto = true` from `loadConfig`; pass `--no-auto` to start off, or `--auto` to force on). It is toggled only via those CLI flags — there is currently no in-session key bound to it. The permission gate reads the flag (`getAuto`/`setAuto` in `src/permission/gate.ts`) on the next tool call. Skip-permissions (`--dangerously-skip-permissions`) has a mid-session TUI toggle: `/yolo [on|off|toggle]` (bare `/yolo` also toggles) wires `getSkipPermissions`/`setSkipPermissions` so the gate and pre-gate sandboxes honor the change on the next tool call without rebuilding plugins.
 
 When auto is on, the gate auto-allows workspace file tools in `AUTO_ALLOWED_TOOLS` and any `run_shell` that does not match the auto-shell policy. The policy (`autoShellRuleForCall` / `AUTO_SHELL_RULES` in `src/permission/auto-shell-policy.ts`) peels wrappers via `expandShellSubjects` (`bash`/`sh`/`zsh -c`, `xargs`, transparent prefixes), then applies:
 
@@ -285,7 +286,7 @@ Printed by `corbits --help` / `-h` from `CLI_HELP_TEXT` in `src/config/index.ts`
 | `--model <id>` | provider default | Select a model for the active provider |
 | `--profile <name>` | — | Settings profile |
 | `--force` | false | Override an existing run state |
-| `--dangerously-skip-permissions` | false | Auto-allow anything not denied by the authorization layer (gate + pre-gate workspace sandboxes; secret-guard / authz hard denies remain). Mid-session TUI twin: `/yolo [on\|off]` via `setSkipPermissions` |
+| `--dangerously-skip-permissions` | false | Auto-allow anything not denied by the authorization layer (gate + pre-gate workspace sandboxes; secret-guard / authz hard denies remain). Mid-session TUI twin: `/yolo [on\|off\|toggle]` via `setSkipPermissions` |
 | `--auto` | true (default) | Force auto mode on (workspace writes + unconstrained shell without prompts) |
 | `--no-auto` | false | Start with auto mode off (ask on every consequential action); no in-session key toggles it |
 | `--help`, `-h` | — | Show help (exit 0 via `CliHelpError`) |

docs/PRODUCT.md

@@ -90,7 +90,7 @@ Continues from the last saved state in the working directory.
 
 ## Slash Commands (TUI)
 
-The TUI has an extensible slash-command framework. Built-ins include `/help` (shortcut + command overlay), `/model` (models-only picker for connected accounts; **Alt+A** adds a provider), `/settings`, `/permissions`, `/plugins`, `/clear`, `/new`, and `/mcp`, plus a `/<name>` command per available workflow. Plugins can register additional commands.
+The TUI has an extensible slash-command framework. Built-ins include `/help` (shortcut + command overlay), `/model` (models-only picker for connected accounts; **Alt+A** adds a provider), `/settings`, `/permissions`, `/plugins`, `/clear`, `/new`, `/mcp`, and `/yolo` (mid-session twin of `--dangerously-skip-permissions`; `/yolo [on|off|toggle]`, bare `/yolo` toggles), plus a `/<name>` command per available workflow. Plugins can register additional commands.
 
 Providers are **models-first**: there is no standalone `/login` command. `/model` opens a **models-only list** (Recent, Favorites, then connected provider/model rows) — type-to-filter owns printable keys, so Connect is never a bare letter. **Alt+A** opens a dedicated add-provider selector over every first-class kind (OpenAI dual-path ChatGPT OAuth or API key, xAI, OpenCode Zen, Anthropic, Google, OpenCode Go, Z.AI Coding Plan, Custom), each annotated with its live account count and never filtered out for “already connected.” **Alt+F** toggles favorite on the highlighted model. Advanced provider drill-down (edit/delete/tiers) stays on the advanced surface, not a bare printable key while the model list is filtering. OAuth providers open their existing browser login with a named account step so multiple accounts per kind coexist (`codex/work`, …). API-key providers use the same named-instance step before the key (auth-only form: instance name + key + fixed catalog base URL), so personal and team keys land as distinct catalog rows (`openai/default`, `anthropic/work`, …); reusing a name re-keys that instance after confirm. Custom remains a free-form single endpoint (full manual form). Successful connect refreshes the catalog and reopens the model list focused on the new account’s default model. OpenCode Go routes each model by its protocol metadata (chat completions, OpenAI responses, or Anthropic messages) and can show subscription usage in the status bar when active (rolling 5h / weekly / monthly windows when the usage API responds; omitted on auth or network failure). When Go returns a quota or rate-limit error — including some HTTP 400 responses that carry limit payloads — Corbits classifies them so quota aborts cleanly and short provider rate limits remain retryable. On a free-tier or subscription quota hit, wait for the window to reset or use OpenCode Zen free models.
 

src/tui/commands/built-in.test.ts

@@ -91,6 +91,11 @@ describe("/yolo command", () => {
       text: "Yolo mode off — permission gate restored.",
     });
     expect(skip).toBe(false);
+    expect(getCommand("yolo")!.handler("toggle", ctx)).toEqual({
+      type: "message",
+      text: "Yolo mode on — permission gate bypassed. Secret-guard and authz hard denies still apply.",
+    });
+    expect(skip).toBe(true);
   });
 
   it("turns skip-permissions on and off explicitly", () => {
@@ -122,7 +127,7 @@ describe("/yolo command", () => {
     };
     expect(getCommand("yolo")!.handler("maybe", ctx)).toEqual({
       type: "message",
-      text: "Usage: /yolo [on|off]",
+      text: "Usage: /yolo [on|off|toggle]",
     });
   });
 

src/tui/commands/built-in.ts

@@ -193,10 +193,11 @@ export function registerBuiltInCommands(): void {
   registerCommand({
     name: "yolo",
     description: "Toggle skip-permissions for this session (gate bypass; secret-guard and authz remain)",
-    argumentHint: "[on|off]",
+    argumentHint: "[on|off|toggle]",
     subcommands: [
       { name: "on", description: "Enable skip-permissions" },
       { name: "off", description: "Disable skip-permissions" },
+      { name: "toggle", description: "Toggle skip-permissions" },
     ],
     handler: (args, ctx) => {
       if (ctx.getSkipPermissions === undefined || ctx.setSkipPermissions === undefined) {
@@ -208,10 +209,10 @@ export function registerBuiltInCommands(): void {
         next = true;
       } else if (arg === "off") {
         next = false;
-      } else if (arg.length === 0) {
+      } else if (arg.length === 0 || arg === "toggle") {
         next = !ctx.getSkipPermissions();
       } else {
-        return { type: "message", text: "Usage: /yolo [on|off]" };
+        return { type: "message", text: "Usage: /yolo [on|off|toggle]" };
       }
       ctx.setSkipPermissions(next);
       if (next) {