@opengsd/gsd-core 1.11.0 → 1.13.0

package/gsd-core/bin/lib/health-diagnostic-rules/state-consistency.cjs

@@ -111,7 +111,13 @@ const RULE_W024 = {
 function buildValidPhaseSet(snapshot) {
     const valid = new Set();
     for (const dir of snapshot.phaseDirs.value) {
-        const token = extractPhaseToken(dir);
+        // #612: the pre-migration source of this third was
+        // `collectDiskPhases(planBase, convention)`, whose keys came from the
+        // convention-aware extractor. Left convention-less here, a bracket repo's
+        // `GSD.02-05-slug` contributes `GSD.02` instead of `05`, so every STATE.md
+        // reference to a real phase falls outside the valid set and W002 fires on
+        // all of them.
+        const token = extractPhaseToken(dir, snapshot.phaseIdConvention);
         if (token)
             valid.add(token);
     }
@@ -233,31 +239,71 @@ const RULE_W021 = {
     description: "Phase's integer prefix implies a different milestone than its ROADMAP section (phase_id_convention: milestone-prefixed)",
     repairable: false,
     check: (snapshot) => {
-        const convention = snapshot.config.value?.['phase_id_convention'];
-        if (convention !== 'milestone-prefixed')
-            return [];
         const diagnostics = [];
-        for (const entry of snapshot.roadmapDeclaredPhases.value) {
-            // `entry.milestone === null` means the builder never found this phase
-            // heading inside any versioned (`v\d+\.\d+`) section — the original
-            // `checkMilestonePrefixMismatches` only ever iterates phases found
-            // WITHIN a section, so a phase outside any section is equivalently
-            // never checked here.
-            if (entry.milestone === null)
-                continue;
-            const expectedMilestone = getMilestoneFromPhaseId(entry.phaseId);
-            if (expectedMilestone === null || expectedMilestone === entry.milestone)
-                continue;
-            diagnostics.push({
-                code: 'W021',
-                severity: SEVERITY.WARNING,
-                message: `Phase ${entry.phaseId}: integer prefix implies ${expectedMilestone} but listed under ${entry.milestone}`,
-                remedy: adviseRemedy('gsd-tools roadmap upgrade --convention milestone-prefixed'),
-            });
+        // Two INDEPENDENT gates, evaluated in the order the pre-migration
+        // `cmdValidateHealth` block emitted them (milestone-prefixed first, then
+        // bracket). They are deliberately NOT written as if/else: the two read
+        // DIFFERENT config bases and can both be true at once.
+        //
+        //   milestone-prefixed — `snapshot.config` (ROOT config only), exactly as
+        //     this gate has always read it. Federating THIS one silently moved a
+        //     legacy convention's answer in BOTH directions on workstream repos: a
+        //     W021 that fires at base vanishing, and one silent at base firing.
+        //   bracket — `snapshot.phaseIdConvention` (federated workstream -> root),
+        //     because the bracket reads this half reports on are themselves
+        //     federated; gating it on the root answer would split the check against
+        //     the reads it describes.
+        //
+        // A workstream that overrides a `milestone-prefixed` ROOT to `bracket` is
+        // the case that makes the distinction observable, and it is the reason an
+        // early `return` here would be a bug: the root-configured M-NN gate must
+        // still fire, or the repo looks healthier than it is.
+        const rootConvention = snapshot.config.value?.['phase_id_convention'];
+        if (rootConvention === 'milestone-prefixed') {
+            diagnostics.push(...checkMilestonePrefixW021(snapshot));
+        }
+        // #612: an ADDITIVE sibling branch — the milestone-prefixed gate above is
+        // untouched. Gated strictly on the ACTIVE convention, never on
+        // project_code presence: reads are selected per convention, and a CHECK
+        // that can fail a repo runs only for the convention that repo opted into.
+        if (snapshot.phaseIdConvention === 'bracket') {
+            for (const mm of snapshot.roadmapBracketIncoherences.value) {
+                diagnostics.push({
+                    code: 'W021',
+                    severity: SEVERITY.WARNING,
+                    message: mm.kind === 'missing-bracket'
+                        ? `Phase ${mm.phaseId}: heading is not in bracket form under the 'bracket' convention (expected \`[CODE.${mm.sectionMilestone}] ${mm.phaseId}:\`)`
+                        : `Phase ${mm.phaseId}: bracket milestone ${mm.phaseMilestone} does not match its section milestone ${mm.sectionMilestone}`,
+                    remedy: adviseRemedy('Bracket migration lands with the #612 migrator (PR-3); until then, manually align the bracket milestone in this heading to match the enclosing section.'),
+                });
+            }
         }
         return diagnostics;
     },
 };
+/** The milestone-prefixed half of W021, unchanged by #612. */
+function checkMilestonePrefixW021(snapshot) {
+    const diagnostics = [];
+    for (const entry of snapshot.roadmapDeclaredPhases.value) {
+        // `entry.milestone === null` means the builder never found this phase
+        // heading inside any versioned (`v\d+\.\d+`) section — the original
+        // `checkMilestonePrefixMismatches` only ever iterates phases found
+        // WITHIN a section, so a phase outside any section is equivalently
+        // never checked here.
+        if (entry.milestone === null)
+            continue;
+        const expectedMilestone = getMilestoneFromPhaseId(entry.phaseId);
+        if (expectedMilestone === null || expectedMilestone === entry.milestone)
+            continue;
+        diagnostics.push({
+            code: 'W021',
+            severity: SEVERITY.WARNING,
+            message: `Phase ${entry.phaseId}: integer prefix implies ${expectedMilestone} but listed under ${entry.milestone}`,
+            remedy: adviseRemedy('gsd-tools roadmap upgrade --convention milestone-prefixed'),
+        });
+    }
+    return diagnostics;
+}
 // ─── W026 — STATE says milestone complete but ROADMAP lists unstarted phase ─
 const RULE_W026 = {
     code: 'W026',
@@ -282,7 +328,14 @@ const RULE_W026 = {
             // unwindowed `phaseDirNames2` (`verify.cts:2372-2382`, a direct
             // `readdirSync` of the phases dir), not the current-milestone-windowed
             // `phaseDirs`.
-            const hasDirectory = matchPhaseDirs(snapshot.allPhaseDirNames.value, normalized).matches.length > 0;
+            // #612: the directory read widens with the heading read that produced
+            // `currentMilestoneRoadmapPhaseIds`, or every bracket phase resolves to
+            // nothing, reads as unstarted, and this UNGATED warning false-fires on
+            // any bracket repo whose STATE says the milestone is complete. #2528
+            // moved the read onto the shared selector; the convention rides along,
+            // since the selector's primary match IS the `phaseTokenMatches` call this
+            // line used to make directly.
+            const hasDirectory = matchPhaseDirs(snapshot.allPhaseDirNames.value, normalized, snapshot.phaseIdConvention).matches.length > 0;
             if (!hasDirectory)
                 unstarted.push(phaseId);
         }

package/gsd-core/bin/lib/health-diagnostic-rules/worktree-health.cjs

@@ -35,10 +35,8 @@
  * src/health-diagnostic-rules/worktree-health.cts, compiled to
  * gsd-core/bin/lib/health-diagnostic-rules/worktree-health.cjs (gitignored).
  */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-const node_path_1 = __importDefault(require("node:path"));
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const shellCmdProjection = require("../shell-command-projection.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const healthDiagnosticMod = require("../health-diagnostic-types.cjs");
 const { SEVERITY, adviseRemedy } = healthDiagnosticMod;
@@ -121,15 +119,31 @@ function checkW017(snapshot) {
 // against `process.cwd()`. Per this batch's brief: the interpolated command
 // (with the real path) lives in `message`; `remedy.args.command` stays a
 // static `<path>` template, mirroring the split the brief specifies.
+// ─── #3663 — path-comparison provenance helper ─────────────────────────────
+//
+// snapshot.cwd is raw process-cwd-derived — path.resolve() normalizes
+// separators and relative segments but NOT casing, and a process launched via
+// a differently-cased path echoes that spelling back. finding.path is
+// `git worktree list`-derived, which self-normalizes to the canonical
+// on-disk casing (forward slashes). Comparing those two spellings strictly
+// misclassifies the ACTIVE worktree as stale on win32 — so the comparison
+// folds case ONLY on win32 (case-insensitive filesystem, via the Shell
+// Command Projection seam's toComparablePathKey — the platform-conditional
+// fold policy lives there, not per call site) and stays case-sensitive on
+// POSIX, where differently-cased paths are genuinely different directories.
+// No realpath resolution — that would change symlink matching behavior.
+function isActiveWorktreePath(activeCwd, worktreePath, platform = process.platform) {
+    const active = shellCmdProjection.toComparablePathKey(activeCwd, platform);
+    const worktree = shellCmdProjection.toComparablePathKey(worktreePath, platform);
+    return active === worktree || active.startsWith(worktree + '/');
+}
 function checkW027(snapshot) {
     const diagnostics = [];
     const activeCwd = snapshot.cwd;
     for (const finding of snapshot.worktreeHealth.value) {
         if (finding.kind !== 'stale')
             continue;
-        const normalizedWorktree = node_path_1.default.resolve(finding.path);
-        const isActiveWorktree = activeCwd === normalizedWorktree || activeCwd.startsWith(normalizedWorktree + node_path_1.default.sep);
-        if (isActiveWorktree)
+        if (isActiveWorktreePath(activeCwd, finding.path))
             continue;
         diagnostics.push({
             code: 'W027',
@@ -170,4 +184,4 @@ const RULES = [
         check: checkW027,
     },
 ];
-module.exports = { RULES };
+module.exports = { RULES, isActiveWorktreePath };

package/gsd-core/bin/lib/health-diagnostic.cjs

@@ -103,7 +103,7 @@ const CONSISTENCY_RULES = [
 // (`verify.cts:2405-2553`) — ported verbatim, not reinvented.
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspaceMod = require("./planning-workspace.cjs");
-const { planningRoot, planningDir } = planningWorkspaceMod;
+const { planningDir } = planningWorkspaceMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const configLoaderMod = require("./config-loader.cjs");
 const { CONFIG_DEFAULTS } = configLoaderMod;
@@ -113,6 +113,12 @@ const { getMilestoneInfo } = roadmapParserMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const stateMod = require("./state.cjs");
 const { writeStateMd } = stateMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const frontmatter = require("./frontmatter.cjs");
+const { extractFrontmatter } = frontmatter;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const stateTransitionMod = require("./state-transition.cjs");
+const { rebuildStateTransaction } = stateTransitionMod;
 const clock_cjs_1 = require("./clock.cjs");
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
@@ -160,7 +166,13 @@ function evaluateConsistencyRules(snapshot) {
  * document for the read side.
  */
 function repairPaths(cwd) {
-    const rootBase = planningRoot(cwd);
+    // #3749: the project root is PROJECT-aware but deliberately NOT workstream-
+    // scoped — under GSD_PROJECT, config.json/MILESTONES.md/milestones belong to
+    // `.planning/<project>/` (the same base init.new-project's config_path
+    // names); under GSD_WORKSTREAM they stay at the workstream PARENT, keeping
+    // the documented root-vs-workstream split. planningDir(cwd, null) is exactly
+    // that base: project env honored, ws env suppressed.
+    const rootBase = planningDir(cwd, null);
     const wsBase = planningDir(cwd);
     return {
         rootBase,
@@ -268,7 +280,15 @@ function runRepairAction(cwd, action, paths) {
             stateContent += `**Status:** Resuming\n\n`;
             stateContent += `## Session Log\n\n`;
             stateContent += `- ${clock_cjs_1.realClock.localToday()}: STATE.md regenerated by ${slash('health')} --repair\n`;
-            writeStateMd(statePath, stateContent, cwd);
+            // ADR-3473 §8.6: `/gsd-health --repair` is a factory reset, so
+            // preservation must not run; the snapshot of the file being replaced is
+            // still captured, and `{}` is the correct, legal snapshot of a
+            // STATE.md that had no parseable frontmatter — which is the usual
+            // reason this repair fires.
+            const priorState = node_fs_1.default.existsSync(statePath) ? ((0, shell_command_projection_cjs_1.platformReadSync)(statePath) ?? '') : '';
+            writeStateMd(statePath, stateContent, rebuildStateTransaction({
+                snapshot: extractFrontmatter(priorState, statePath),
+            }), cwd);
             return { success: true, path: 'STATE.md', extraDetails };
         }
         case REMEDY_ACTION.ADD_NYQUIST_KEY:

package/gsd-core/bin/lib/host-integration.cjs

@@ -72,7 +72,7 @@ const INTERFACE_POINTS = Object.freeze(['command', 'dispatch', 'model', 'hooks',
 const SAFE_DEFAULTS = {
     embeddingMode: 'declarative',
     commandSurface: 'prose-only',
-    dispatch: { namedDispatch: false, nested: false, maxDepth: 0, background: false, subagentToolkit: 'read-only', backgroundDispatch: false, isolation: 'none' },
+    dispatch: { namedDispatch: false, nested: false, maxDepth: 0, background: false, subagentToolkit: 'read-only', backgroundDispatch: false, isolation: 'none', maxConcurrency: 1 },
     modelMode: 'passive',
     hookBus: 'none',
     stateIO: 'session-log-append',
@@ -84,7 +84,7 @@ const PROFILE_BASELINES = Object.freeze({
     'programmatic-cli': Object.freeze({
         embeddingMode: 'imperative',
         commandSurface: 'slash-file',
-        dispatch: Object.freeze({ namedDispatch: true, nested: true, maxDepth: -1, background: true, subagentToolkit: 'full', backgroundDispatch: true, isolation: 'none' }),
+        dispatch: Object.freeze({ namedDispatch: true, nested: true, maxDepth: -1, background: true, subagentToolkit: 'full', backgroundDispatch: true, isolation: 'none', maxConcurrency: 1 }),
         modelMode: 'passive',
         hookBus: 'host',
         stateIO: 'filesystem',
@@ -95,7 +95,7 @@ const PROFILE_BASELINES = Object.freeze({
     'declarative-cli': Object.freeze({
         embeddingMode: 'declarative',
         commandSurface: 'slash-file',
-        dispatch: Object.freeze({ namedDispatch: true, nested: false, maxDepth: 1, background: false, subagentToolkit: 'full', backgroundDispatch: false, isolation: 'none' }),
+        dispatch: Object.freeze({ namedDispatch: true, nested: false, maxDepth: 1, background: false, subagentToolkit: 'full', backgroundDispatch: false, isolation: 'none', maxConcurrency: 1 }),
         modelMode: 'passive',
         hookBus: 'host',
         stateIO: 'filesystem',
@@ -106,7 +106,7 @@ const PROFILE_BASELINES = Object.freeze({
     'ide': Object.freeze({
         embeddingMode: 'imperative',
         commandSurface: 'palette',
-        dispatch: Object.freeze({ namedDispatch: true, nested: true, maxDepth: 5, background: true, subagentToolkit: 'full', backgroundDispatch: true, isolation: 'none' }),
+        dispatch: Object.freeze({ namedDispatch: true, nested: true, maxDepth: 5, background: true, subagentToolkit: 'full', backgroundDispatch: true, isolation: 'none', maxConcurrency: 1 }),
         modelMode: 'active',
         hookBus: 'engine',
         stateIO: 'sandboxed-storage',
@@ -235,7 +235,7 @@ const DEFAULT_ENGINE = {
     axes: {
         embeddingMode: 'imperative',
         commandSurface: 'slash-file',
-        dispatch: { namedDispatch: true, nested: true, maxDepth: -1, background: true, subagentToolkit: 'full', backgroundDispatch: true, isolation: 'none' },
+        dispatch: { namedDispatch: true, nested: true, maxDepth: -1, background: true, subagentToolkit: 'full', backgroundDispatch: true, isolation: 'none', maxConcurrency: 1 },
         modelMode: 'active',
         hookBus: 'host',
         stateIO: 'filesystem',
@@ -246,6 +246,19 @@ const DEFAULT_ENGINE = {
     known: HOST_INTEGRATION_AXES,
 };
 // ---------------------------------------------------------------------------
+// isPositiveSafeInteger — shared predicate (#3673)
+// ---------------------------------------------------------------------------
+/**
+ * True iff `v` is a positive (>0) JS safe integer. Single source of truth for
+ * the dispatch.maxConcurrency contract: used by negotiateHostCapabilities
+ * below, and by gsd-core/bin/gsd-tools.cjs's routeDispatchCapacity (which
+ * requires this module's compiled output rather than reimplementing the
+ * predicate), so the two consumers cannot silently diverge.
+ */
+function isPositiveSafeInteger(v) {
+    return typeof v === 'number' && Number.isSafeInteger(v) && v > 0;
+}
+// ---------------------------------------------------------------------------
 // negotiateHostCapabilities
 // ---------------------------------------------------------------------------
 /**
@@ -335,6 +348,7 @@ function negotiateHostCapabilities(host, engine = DEFAULT_ENGINE) {
     let effectiveSubagentToolkit;
     let effectiveMaxDepth;
     let effectiveIsolation;
+    let effectiveMaxConcurrency;
     if (hostDispatch === null) {
         // Host didn't declare dispatch at all — fail-closed to most-restrictive values
         warnings.push(`host did not declare 'dispatch'`);
@@ -345,6 +359,7 @@ function negotiateHostCapabilities(host, engine = DEFAULT_ENGINE) {
         effectiveSubagentToolkit = 'read-only';
         effectiveMaxDepth = 0;
         effectiveIsolation = 'none';
+        effectiveMaxConcurrency = 1;
     }
     else {
         // N1: observability warnings for 'undocumented' sentinel on dispatch fields
@@ -408,6 +423,41 @@ function negotiateHostCapabilities(host, engine = DEFAULT_ENGINE) {
         const eDepthNum = engineDispatch.maxDepth < 0 ? Infinity : engineDispatch.maxDepth;
         const minDepth = Math.min(hDepthNum, eDepthNum);
         effectiveMaxDepth = minDepth === Infinity ? -1 : minDepth;
+        // maxConcurrency (#3673, ADR-1239 Phase 1): a positive-safe-integer
+        // passthrough with a fail-closed floor of 1. UNLIKE maxDepth, there is no
+        // min(host, engine) reduction here — the design doc explicitly rejects an
+        // engine-side ceiling for this field (no competing intrinsic worker
+        // ceiling to cap against at the negotiation layer); a `--jobs N` cap is
+        // applied later, at the Phase 4 scheduler.
+        const hostMaxConcurrency = hostDispatch.maxConcurrency;
+        if (hostMaxConcurrency === UNDOCUMENTED) {
+            warnings.push(`dispatch.maxConcurrency is undocumented — degraded closed (1)`);
+            effectiveMaxConcurrency = 1;
+        }
+        else if (isPositiveSafeInteger(hostMaxConcurrency)) {
+            effectiveMaxConcurrency = hostMaxConcurrency;
+        }
+        else if (hostMaxConcurrency === undefined) {
+            warnings.push(`host did not declare 'dispatch.maxConcurrency' — treating as 1`);
+            effectiveMaxConcurrency = 1;
+        }
+        else if (typeof hostMaxConcurrency !== 'number') {
+            warnings.push(`host dispatch.maxConcurrency is not a number — treating as 1`);
+            effectiveMaxConcurrency = 1;
+        }
+        else if (!Number.isSafeInteger(hostMaxConcurrency)) {
+            if (Number.isInteger(hostMaxConcurrency)) {
+                warnings.push(`host dispatch.maxConcurrency is an unsafe integer — treating as 1`);
+            }
+            else {
+                warnings.push(`host dispatch.maxConcurrency is not an integer — treating as 1`);
+            }
+            effectiveMaxConcurrency = 1;
+        }
+        else {
+            warnings.push(`host dispatch.maxConcurrency is non-positive — treating as 1`);
+            effectiveMaxConcurrency = 1;
+        }
         // If namedDispatch is false, cap maxDepth/nested/background/backgroundDispatch to 0/false/false/false (struct consistency)
         if (!effectiveNamedDispatch) {
             effectiveMaxDepth = 0;
@@ -424,6 +474,7 @@ function negotiateHostCapabilities(host, engine = DEFAULT_ENGINE) {
         subagentToolkit: effectiveSubagentToolkit,
         backgroundDispatch: effectiveBackgroundDispatch,
         isolation: effectiveIsolation,
+        maxConcurrency: effectiveMaxConcurrency,
     };
     // ---------------------------------------------------------------------------
     // Assemble effective axes
@@ -653,10 +704,25 @@ function extensionEventSurfaceFor(extensionEvents) {
  * per-host branch ADR-1239 exists to remove. Omit `prompt` entirely and the
  * resolution is byte-identical to Phase 2's (the unconsumed-resolver shape).
  *
- * Argv order is base args → cwd flag → prompt, so the prompt stays the final
- * positional token for the hosts that read it that way.
+ * Argv order is base args → model flag → cwd flag → prompt, so the prompt
+ * stays the final positional token for the hosts that read it that way. The
+ * model flag is placed BEFORE the cwd flag (not after, and not appended at
+ * the very end) purely to keep it clear of that trailing positional — the
+ * model value itself is never the prompt-adjacent token a host might scan
+ * for last.
+ *
+ * `model` (Phase 4, #3714) is optional, descriptor-gated exactly like prompt:
+ * a `modelFlag` string on the descriptor names the flag that pins the
+ * spawned executor's model (codex: `--model`); `null`/absent means the host
+ * exposes no such override on this exec path, and `[modelFlag, model]` is
+ * appended ONLY when both the descriptor's `modelFlag` and the caller's
+ * `model` are non-empty strings. Omitting `model` entirely (or passing it to
+ * a host with no `modelFlag`) is byte-identical to the resolver's behavior
+ * before this parameter existed. This function decides no policy about WHICH
+ * model to pass or what 'inherit' means — that is entirely the caller's job;
+ * this seam only shapes descriptor + values into argv.
  */
-function resolveOrchestratorExec(orchestratorExec, cwd, prompt) {
+function resolveOrchestratorExec(orchestratorExec, cwd, prompt, model) {
     if (!orchestratorExec || typeof orchestratorExec !== 'object' || Array.isArray(orchestratorExec)) {
         return { ok: false, reason: 'missing_command' };
     }
@@ -676,11 +742,22 @@ function resolveOrchestratorExec(orchestratorExec, cwd, prompt) {
     if (oe.promptFlag !== undefined && oe.promptFlag !== null && typeof oe.promptFlag !== 'string') {
         return { ok: false, reason: 'invalid_prompt_flag' };
     }
+    if (oe.modelFlag !== undefined && oe.modelFlag !== null && typeof oe.modelFlag !== 'string') {
+        return { ok: false, reason: 'invalid_model_flag' };
+    }
     // An executor spawned with no instruction is a hang, not a degraded run —
     // fail closed rather than launching a prompt-less process.
     if (prompt !== undefined && (typeof prompt !== 'string' || prompt.length === 0)) {
         return { ok: false, reason: 'invalid_prompt' };
     }
+    // Unlike `prompt` — where empty is a hang, not a degraded run, hence the
+    // fail-closed check above — an absent/null/empty model is simply "use the
+    // host default", the same benign degradation `cwdFlag: null` already
+    // expresses. Only a present-but-non-string value (number/bool/array/object)
+    // is a caller error; null/undefined/'' fall through to "omit the flag".
+    if (model !== undefined && model !== null && typeof model !== 'string') {
+        return { ok: false, reason: 'invalid_model' };
+    }
     // Leading-dash guard, mirroring worktree-safety.cts's `unsafe_leading_dash`
     // check on git arguments. A positional prompt (or a cwd) beginning with '-'
     // is parsed by the spawned CLI as a FLAG, not a value — the same failure the
@@ -695,10 +772,17 @@ function resolveOrchestratorExec(orchestratorExec, cwd, prompt) {
     if (cwd.startsWith('-')) {
         return { ok: false, reason: 'unsafe_leading_dash_cwd' };
     }
+    if (typeof model === 'string' && model.startsWith('-')) {
+        return { ok: false, reason: 'unsafe_leading_dash_model' };
+    }
     const baseArgs = Array.isArray(oe.args) ? [...oe.args] : [];
-    const args = typeof oe.cwdFlag === 'string' && oe.cwdFlag.length > 0
-        ? [...baseArgs, oe.cwdFlag, cwd]
-        : baseArgs;
+    let args = baseArgs;
+    if (typeof oe.modelFlag === 'string' && oe.modelFlag.length > 0 && typeof model === 'string' && model.length > 0) {
+        args = [...args, oe.modelFlag, model];
+    }
+    args = typeof oe.cwdFlag === 'string' && oe.cwdFlag.length > 0
+        ? [...args, oe.cwdFlag, cwd]
+        : args;
     if (typeof prompt === 'string') {
         if (typeof oe.promptFlag === 'string' && oe.promptFlag.length > 0) {
             args.push(oe.promptFlag, prompt);
@@ -720,6 +804,7 @@ module.exports = {
     EXTENSION_EVENT_SURFACES,
     degradationFor,
     profileOf,
+    isPositiveSafeInteger,
     negotiateHostCapabilities,
     shouldFlattenDispatch,
     resolveDispatchType,