feat(security): add /elevate command and audit events

src/commands/builtin/index.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect, vi } from 'vitest';
 
-import { createModelCommand } from './index.js';
+import { createElevateCommand, createModelCommand } from './index.js';
 
 describe('builtin /model command', () => {
   it('passes through the full argument string', async () => {
@@ -35,3 +35,35 @@ describe('builtin /model command', () => {
     expect(result).toEqual({ handled: true, text: 'switched' });
   });
 });
+
+describe('builtin /elevate command', () => {
+  it('passes through the full argument string', async () => {
+    const cmd = createElevateCommand();
+    const setElevation = vi.fn(() => 'ok');
+
+    const result = await cmd.execute(['10m', 'reason', '--yes'], {
+      channel: 'test',
+      senderId: 'user',
+      sessionId: 's1',
+      rawInput: '/elevate 10m reason --yes',
+      services: { setElevation },
+    });
+
+    expect(setElevation).toHaveBeenCalledWith('10m reason --yes');
+    expect(result).toEqual({ handled: true, text: 'ok' });
+  });
+
+  it('shows status when no args are provided', async () => {
+    const cmd = createElevateCommand();
+    const getElevation = vi.fn(() => 'status');
+    const result = await cmd.execute([], {
+      channel: 'test',
+      senderId: 'user',
+      sessionId: 's1',
+      rawInput: '/elevate',
+      services: { getElevation },
+    });
+    expect(getElevation).toHaveBeenCalledOnce();
+    expect(result).toEqual({ handled: true, text: 'status' });
+  });
+});