feat(phase 5): /allow CRUD slash command (list, add, remove, clear)

Phase 5 of the plan. No clean equivalent in opencode or pi — both
manage allowlist entries only via the interactive permission
prompt's "allow always" answer. dirge adds explicit CRUD so users
can inspect, manually add, drop one, or clear all entries without
editing the session JSON.

## Commands

- `/allow` or `/allow list` — show numbered entries
- `/allow add <tool> <pattern>` — add a (tool, pattern) entry,
  e.g. `/allow add bash 'cargo *'`
- `/allow remove <idx>` — drop one entry by 0-based index from
  the `list` output
- `/allow clear` — drop all entries

The `add` form preserves pattern strings containing spaces by
re-deriving the args from the raw `text` slice (rather than
relying on the SmallVec `parts[2]` which would get truncated at
the first whitespace). Same approach `/cd` uses for paths.

## State sync

Both surfaces stay aligned:
- `PermissionChecker::session_allowlist` (in-memory, used by
  `check` / `check_path`) — updated via the existing
  `add_session_allowlist` and the two new
  `remove_session_allowlist_at(idx)` + `clear_session_allowlist`.
- `Session::permission_allowlist` (persisted to JSON, restored
  on resume via `load_session_allowlist`) — mirrored
  manually in the slash handler so save/load round-trips show
  the user-edited list.

Without the session-side mirror, a `/allow add foo bar` would
stay in memory for this run but vanish on `-c` resume. Dedup at
the session level too so `save()` writes a clean list.

## Tests

3 new permission tests, written failing first:

- `remove_session_allowlist_at_returns_removed_entry`:
  remove(1) on [bash:cargo*, bash:git*, read:/tmp/*] yields
  Some(("bash","git *")) and the surviving entries shift down.
- `remove_session_allowlist_at_out_of_range_returns_none`:
  remove(99) returns None without panicking; existing entries
  intact.
- `clear_session_allowlist_empties_the_list`: clear() drops
  all entries.

The slash handler itself is not unit-tested (requires the full
UI loop fixtures); manual smoke test:

```
$ dirge --restrictive
> bash 'echo hi'
> (a) allow always
> /allow list      → [0] bash echo *
> /allow add read /tmp/*
> /allow list      → [0] bash echo *  [1] read /tmp/*
> /allow remove 0
> /allow list      → [0] read /tmp/*
> /allow clear
> /allow list      → empty
```

## Docs

`/help` text gets four new lines covering each subcommand.

## Test plan

- [x] `cargo test --features plugin` -> 649 pass (was 646).
- [x] `cargo build --all-features` -> compiles.
- [x] `cargo build --no-default-features` -> compiles.

## Plan status

| Phase | PR | Done |
|---|---|---|
| 1 | #69 | first-wins block + docs |
| 2 | #70 | sibling-branch pruning + notification |
| 3 | #71 | structured tool-call persistence |
| 4 | #72 | branch summary metadata in /tree |
| 5 | this | /allow CRUD |
| 6 | — | skipped per user request (cost tracking) |

5 of 6 phases complete; Phase 6 (cost tracking) skipped.

Author: Yogthos

src/permission/checker.rs

@@ -286,14 +286,30 @@ impl PermissionChecker {
         }
     }
 
-    #[allow(dead_code)]
     pub fn allowlist_entries(&self) -> Vec<(String, String)> {
         self.session_allowlist
             .iter()
             .map(|(t, p)| (t.clone(), p.original.clone()))
             .collect()
     }
 
+    /// Remove the allowlist entry at the given index (0-based,
+    /// matching the display order in `/allow list`). Returns the
+    /// removed `(tool, pattern)` on success, or `None` if the
+    /// index is out of range. Used by `/allow remove <n>`.
+    pub fn remove_session_allowlist_at(&mut self, idx: usize) -> Option<(String, String)> {
+        if idx >= self.session_allowlist.len() {
+            return None;
+        }
+        let (tool, pat) = self.session_allowlist.remove(idx);
+        Some((tool, pat.original.clone()))
+    }
+
+    /// Remove ALL allowlist entries. Used by `/allow clear`.
+    pub fn clear_session_allowlist(&mut self) {
+        self.session_allowlist.clear();
+    }
+
     pub fn set_mode(&mut self, mode: SecurityMode) {
         self.mode = mode;
     }
@@ -397,6 +413,53 @@ mod tests {
         assert!(matches!(r2, CheckResult::Allowed));
     }
 
+    /// Phase 5 — `/allow remove <idx>` plumbs through to
+    /// `remove_session_allowlist_at`. Returns the removed entry's
+    /// (tool, pattern) so the slash handler can confirm to the
+    /// user what was removed.
+    #[test]
+    fn remove_session_allowlist_at_returns_removed_entry() {
+        let mut checker = fresh_checker();
+        checker.add_session_allowlist("bash".to_string(), "cargo *");
+        checker.add_session_allowlist("bash".to_string(), "git *");
+        checker.add_session_allowlist("read".to_string(), "/tmp/*");
+        assert_eq!(checker.allowlist_entries().len(), 3);
+
+        let removed = checker.remove_session_allowlist_at(1);
+        assert_eq!(removed, Some(("bash".to_string(), "git *".to_string())),);
+        // After removal, the indices shift: original [0]bash:cargo*,
+        // [2]read:/tmp/* are now at [0] and [1].
+        let after = checker.allowlist_entries();
+        assert_eq!(after.len(), 2);
+        assert_eq!(after[0], ("bash".to_string(), "cargo *".to_string()));
+        assert_eq!(after[1], ("read".to_string(), "/tmp/*".to_string()));
+    }
+
+    /// Out-of-range index returns None rather than panicking. The
+    /// slash handler shows a clear error in that case.
+    #[test]
+    fn remove_session_allowlist_at_out_of_range_returns_none() {
+        let mut checker = fresh_checker();
+        checker.add_session_allowlist("bash".to_string(), "cargo *");
+        assert_eq!(checker.remove_session_allowlist_at(99), None);
+        assert_eq!(checker.remove_session_allowlist_at(1), None);
+        // Existing entry still there.
+        assert_eq!(checker.allowlist_entries().len(), 1);
+    }
+
+    /// `clear` empties the allowlist entirely. Different from
+    /// `reset_to_new` (which clears EVERYTHING) — this is the
+    /// user-facing nuke for just allowlist grants.
+    #[test]
+    fn clear_session_allowlist_empties_the_list() {
+        let mut checker = fresh_checker();
+        checker.add_session_allowlist("bash".to_string(), "cargo *");
+        checker.add_session_allowlist("bash".to_string(), "git *");
+        assert_eq!(checker.allowlist_entries().len(), 2);
+        checker.clear_session_allowlist();
+        assert!(checker.allowlist_entries().is_empty());
+    }
+
     // Adding the same (tool, pattern) twice must not duplicate the
     // entry. The audit flagged that "allow always" picks for the
     // same command repeated across a long session accumulate

src/ui/slash.rs

@@ -1149,6 +1149,143 @@ pub async fn handle_slash(
                 }
             }
         }
+        "/allow" => {
+            // Phase 5: CRUD for the session permission allowlist.
+            // Subcommands: list (default), add <tool> <pattern>,
+            // remove <idx>, clear. Without this, users can only
+            // create allowlist entries via the interactive "(a)
+            // allow always" prompt; there's no way to inspect or
+            // undo a bad grant short of editing the session JSON.
+            let sub = parts.get(1).copied().unwrap_or("list");
+            let perm = match permission {
+                Some(p) => p,
+                None => {
+                    renderer.write_line(
+                        "permission system unavailable (--no-tools mode?)",
+                        c_error(),
+                    )?;
+                    return Ok(());
+                }
+            };
+            match sub {
+                "list" => {
+                    let entries = {
+                        let guard = perm.lock().unwrap_or_else(|e| e.into_inner());
+                        guard.allowlist_entries()
+                    };
+                    if entries.is_empty() {
+                        renderer.write_line(
+                            "session allowlist is empty (use '(a) allow always' in a permission prompt to add entries)",
+                            c_agent(),
+                        )?;
+                    } else {
+                        renderer.write_line(
+                            &format!("session allowlist ({} entries):", entries.len()),
+                            c_agent(),
+                        )?;
+                        for (i, (tool, pat)) in entries.iter().enumerate() {
+                            renderer
+                                .write_line(&format!("  [{}] {} {}", i, tool, pat), c_result())?;
+                        }
+                        renderer.write_line(
+                            "use '/allow remove <idx>' to drop a single entry; '/allow clear' to drop all",
+                            theme::dim(),
+                        )?;
+                    }
+                }
+                "add" => {
+                    // `/allow add <tool> <pattern>` — third part is
+                    // the tool, rest is the pattern (may contain
+                    // spaces, so re-derive from raw text).
+                    let raw_args = text.trim().strip_prefix("/allow").unwrap_or("").trim();
+                    let rest = raw_args.strip_prefix("add").unwrap_or("").trim();
+                    let mut it = rest.splitn(2, char::is_whitespace);
+                    let tool = it.next().unwrap_or("");
+                    let pattern = it.next().unwrap_or("").trim();
+                    if tool.is_empty() || pattern.is_empty() {
+                        renderer.write_line(
+                            "usage: /allow add <tool> <pattern>  (e.g. /allow add bash 'cargo *')",
+                            c_error(),
+                        )?;
+                    } else {
+                        {
+                            let mut guard = perm.lock().unwrap_or_else(|e| e.into_inner());
+                            guard.add_session_allowlist(tool.to_string(), pattern);
+                        }
+                        // Mirror into session.permission_allowlist
+                        // so the entry persists across save/load.
+                        let entry = crate::session::PermissionAllowEntry {
+                            tool: tool.to_string(),
+                            pattern: pattern.to_string(),
+                        };
+                        // Dedup at the session level too — checker
+                        // dedupes but we want save() to write a
+                        // clean list.
+                        if !session
+                            .permission_allowlist
+                            .iter()
+                            .any(|e| e.tool == entry.tool && e.pattern == entry.pattern)
+                        {
+                            session.permission_allowlist.push(entry);
+                        }
+                        renderer.write_line(&format!("added: {} {}", tool, pattern), c_agent())?;
+                    }
+                }
+                "remove" => {
+                    let idx_str = parts.get(2).copied().unwrap_or("");
+                    let idx: usize = match idx_str.parse() {
+                        Ok(n) => n,
+                        Err(_) => {
+                            renderer.write_line(
+                                "usage: /allow remove <idx>  (run /allow list to see indices)",
+                                c_error(),
+                            )?;
+                            return Ok(());
+                        }
+                    };
+                    let removed = {
+                        let mut guard = perm.lock().unwrap_or_else(|e| e.into_inner());
+                        guard.remove_session_allowlist_at(idx)
+                    };
+                    match removed {
+                        Some((tool, pat)) => {
+                            // Mirror removal into the session
+                            // allowlist too.
+                            session
+                                .permission_allowlist
+                                .retain(|e| !(e.tool == tool && e.pattern == pat));
+                            renderer.write_line(
+                                &format!("removed [{}]: {} {}", idx, tool, pat),
+                                c_agent(),
+                            )?;
+                        }
+                        None => {
+                            renderer.write_line(
+                                &format!("no allowlist entry at index {}", idx),
+                                c_error(),
+                            )?;
+                        }
+                    }
+                }
+                "clear" => {
+                    {
+                        let mut guard = perm.lock().unwrap_or_else(|e| e.into_inner());
+                        guard.clear_session_allowlist();
+                    }
+                    session.permission_allowlist.clear();
+                    renderer.write_line("session allowlist cleared", c_agent())?;
+                }
+                other => {
+                    renderer.write_line(
+                        &format!(
+                            "unknown /allow subcommand {:?}; try: list, add, remove, clear",
+                            other,
+                        ),
+                        c_error(),
+                    )?;
+                }
+            }
+        }
         "/help" => {
             renderer.write_line("commands:", c_agent())?;
             renderer.write_line("  /model [name]          show or switch model", c_result())?;
@@ -1223,6 +1360,22 @@ pub async fn handle_slash(
                 "  /toggle <feat> [on|off] toggle a feature (e.g. /toggle todo)",
                 c_result(),
             )?;
+            renderer.write_line(
+                "  /allow list            list session allowlist entries",
+                c_result(),
+            )?;
+            renderer.write_line(
+                "  /allow add <tool> <pat> add an allowlist entry",
+                c_result(),
+            )?;
+            renderer.write_line(
+                "  /allow remove <idx>    drop one allowlist entry",
+                c_result(),
+            )?;
+            renderer.write_line(
+                "  /allow clear           drop all allowlist entries",
+                c_result(),
+            )?;
             #[cfg(feature = "loop")]
             {
                 let _ = renderer.write_line(