@yeaft/webchat-agent 1.0.550 → 1.0.552

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "1.0.550",
+  "version": "1.0.552",
   "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
   "main": "index.js",
   "type": "module",

package/workbench/file-ops.js

@@ -4,6 +4,7 @@ import { join, basename, dirname, extname, isAbsolute, relative, resolve } from
 import { platform } from 'os';
 import ctx from '../context.js';
 import { resolveAndValidatePath, BINARY_EXTENSIONS, VIDEO_EXTENSIONS } from './utils.js';
+import { resolveWorkItemPath } from './work-item-path.js';
 import { sendWorkbenchResult } from './request-routing.js';
 
 export const MAX_WORKBENCH_PREVIEW_BYTES = 20 * 1024 * 1024;
@@ -271,7 +272,7 @@ export async function handleWriteFile(msg) {
   const workDir = msg.workDir || conv?.workDir || ctx.CONFIG.workDir;
 
   try {
-    const resolved = resolveAndValidatePath(filePath, workDir);
+    const resolved = await resolveWorkItemPath(msg, filePath, workDir);
     await writeFile(resolved, content, 'utf-8');
 
     sendWorkbenchResult(ctx, msg, {
@@ -300,7 +301,8 @@ export async function handleWriteFile(msg) {
 }
 
 export async function handleListDirectory(msg) {
-  const { conversationId, requestId, dirPath, _requestUserId, _requestClientId } = msg;
+  const { conversationId, requestId, _requestUserId, _requestClientId } = msg;
+  const dirPath = msg.dirPath || (msg.workbenchRoute?.runtimeProvider === 'work-center' ? msg.workDir : msg.dirPath);
   const directoryPickerScope = msg.directoryPickerScope === 'agent' ? 'agent' : undefined;
   const conv = ctx.conversations.get(conversationId);
   const workDir = msg.workDir || conv?.workDir || ctx.CONFIG.workDir;
@@ -362,7 +364,7 @@ export async function handleListDirectory(msg) {
   }
 
   try {
-    const resolved = resolveAndValidatePath(dirPath, workDir);
+    const resolved = await resolveWorkItemPath(msg, dirPath, workDir);
     const entries = await readdir(resolved, { withFileTypes: true });
     const result = [];
 
@@ -426,7 +428,7 @@ export async function handleCreateFile(msg) {
   const workDir = msg.workDir || conv?.workDir || ctx.CONFIG.workDir;
 
   try {
-    const resolved = resolveAndValidatePath(filePath, workDir);
+    const resolved = await resolveWorkItemPath(msg, filePath, workDir);
     if (isDirectory) {
       await mkdir(resolved, { recursive: true });
     } else {
@@ -464,7 +466,7 @@ export async function handleDeleteFiles(msg) {
 
     for (const p of paths) {
       try {
-        const resolved = resolveAndValidatePath(p, workDir);
+        const resolved = await resolveWorkItemPath(msg, p, workDir);
         const s = await stat(resolved);
         if (s.isDirectory()) {
           await rm(resolved, { recursive: true, force: true });
@@ -503,7 +505,7 @@ export async function handleMoveFiles(msg) {
     if (!paths || paths.length === 0) throw new Error('No paths specified');
     if (!destination) throw new Error('No destination specified');
 
-    const destResolved = resolveAndValidatePath(destination, workDir);
+    const destResolved = await resolveWorkItemPath(msg, destination, workDir);
     // Ensure destination directory exists
     await mkdir(destResolved, { recursive: true });
 
@@ -512,9 +514,9 @@ export async function handleMoveFiles(msg) {
 
     for (const p of paths) {
       try {
-        const srcResolved = resolveAndValidatePath(p, workDir);
+        const srcResolved = await resolveWorkItemPath(msg, p, workDir);
         const name = (newName && paths.length === 1) ? newName : basename(srcResolved);
-        const destPath = join(destResolved, name);
+        const destPath = await resolveWorkItemPath(msg, join(destResolved, name), workDir);
         if (existsSync(destPath)) {
           throw new Error('Target already exists: ' + name);
         }
@@ -551,7 +553,7 @@ export async function handleCopyFiles(msg) {
     if (!paths || paths.length === 0) throw new Error('No paths specified');
     if (!destination) throw new Error('No destination specified');
 
-    const destResolved = resolveAndValidatePath(destination, workDir);
+    const destResolved = await resolveWorkItemPath(msg, destination, workDir);
     await mkdir(destResolved, { recursive: true });
 
     const copied = [];
@@ -559,7 +561,7 @@ export async function handleCopyFiles(msg) {
 
     for (const p of paths) {
       try {
-        const srcResolved = resolveAndValidatePath(p, workDir);
+        const srcResolved = await resolveWorkItemPath(msg, p, workDir);
         const name = basename(srcResolved);
         let destPath = join(destResolved, name);
 
@@ -574,9 +576,19 @@ export async function handleCopyFiles(msg) {
           } while (existsSync(destPath));
         }
 
+        await resolveWorkItemPath(msg, destPath, workDir);
         const srcStat = await stat(srcResolved);
         if (srcStat.isDirectory()) {
-          await cp(srcResolved, destPath, { recursive: true });
+          await cp(srcResolved, destPath, {
+            recursive: true,
+            ...(msg.workbenchRoute?.runtimeProvider === 'work-center' ? {
+              filter: async (source, target) => {
+                await resolveWorkItemPath(msg, source, workDir);
+                await resolveWorkItemPath(msg, target, workDir);
+                return true;
+              },
+            } : {}),
+          });
         } else {
           await copyFile(srcResolved, destPath);
         }
@@ -611,7 +623,7 @@ export async function handleUploadToDir(msg) {
   try {
     if (!files || files.length === 0) throw new Error('No files specified');
 
-    const targetDir = resolveAndValidatePath(dirPath || workDir, workDir);
+    const targetDir = await resolveWorkItemPath(msg, dirPath || workDir, workDir);
     await mkdir(targetDir, { recursive: true });
 
     const saved = [];
@@ -619,7 +631,7 @@ export async function handleUploadToDir(msg) {
 
     for (const file of files) {
       try {
-        const dest = join(targetDir, file.name);
+        const dest = await resolveWorkItemPath(msg, join(targetDir, file.name), workDir);
         const buffer = Buffer.from(file.data, 'base64');
         await writeFile(dest, buffer);
         saved.push(file.name);

package/workbench/file-search.js

@@ -1,6 +1,7 @@
 import { readdir, stat } from 'fs/promises';
 import { join, relative, resolve } from 'path';
 import ctx from '../context.js';
+import { resolveWorkItemPath } from './work-item-path.js';
 import { sendWorkbenchResult } from './request-routing.js';
 
 export async function handleFileSearch(msg) {
@@ -15,7 +16,9 @@ export async function handleFileSearch(msg) {
       return;
     }
 
-    const resolved = resolve(searchRoot);
+    const resolved = msg.workbenchRoute?.runtimeProvider === 'work-center'
+      ? await resolveWorkItemPath(msg, searchRoot, workDir)
+      : resolve(searchRoot);
     const results = [];
     const MAX_RESULTS = 100;
     const lowerQuery = query.toLowerCase();

package/workbench/git-ops.js

@@ -1,9 +1,28 @@
-import { readFile, writeFile } from 'fs/promises';
-import { join, resolve } from 'path';
+import { readFile, realpath, writeFile } from 'fs/promises';
+import { join, relative, resolve } from 'path';
 import ctx from '../context.js';
 import { execAsync, resolveAndValidatePath, getGitRoot, validateGitPath } from './utils.js';
+import { resolveWorkItemPath } from './work-item-path.js';
 import { sendWorkbenchResult } from './request-routing.js';
 
+// Git paths and bulk operations are repository-scoped. A WorkItem must own
+// that root, rather than silently widening a subdirectory workspace to it.
+async function getWorkbenchGitRoot(msg, workDir) {
+  if (msg.workbenchRoute?.runtimeProvider !== 'work-center') return getGitRoot(workDir);
+  // Do not fall back to cwd on lookup failure: Git itself may ascend from it.
+  const { stdout } = await execAsync('git rev-parse --show-toplevel', {
+    cwd: workDir, timeout: 5000, windowsHide: true,
+  });
+  const gitRoot = stdout.trim();
+  const [workspace, repository] = await Promise.all([realpath(workDir), realpath(gitRoot)]);
+  if (relative(workspace, repository) !== '') {
+    const error = new Error('Git requires the WorkItem workspace to be the repository root. Files and Terminal remain available.');
+    error.code = 'WORK_ITEM_GIT_ROOT_REQUIRED';
+    throw error;
+  }
+  return gitRoot;
+}
+
 export async function handleGitStatus(msg) {
   const { conversationId, _requestUserId } = msg;
   const conv = ctx.conversations.get(conversationId);
@@ -11,15 +30,7 @@ export async function handleGitStatus(msg) {
 
   try {
     // Get git repo root to ensure paths are consistent
-    let gitRoot = workDir;
-    try {
-      const { stdout: rootOut } = await execAsync('git rev-parse --show-toplevel', {
-        cwd: workDir,
-        timeout: 5000,
-        windowsHide: true
-      });
-      gitRoot = rootOut.trim();
-    } catch {}
+    const gitRoot = await getWorkbenchGitRoot(msg, workDir);
 
     const { stdout: statusOut } = await execAsync('git status --porcelain', {
       cwd: gitRoot,
@@ -76,6 +87,7 @@ export async function handleGitStatus(msg) {
       conversationId,
       _requestUserId,
       error: e.message,
+      ...(e.code ? { errorCode: e.code } : {}),
       isGitRepo: !e.message.includes('not a git repository') && !e.message.includes('ENOENT')
     });
   }
@@ -100,20 +112,14 @@ export async function handleGitDiff(msg) {
     }
 
     // Get git repo root — git status paths are relative to this, not workDir
-    let gitRoot = workDir;
-    try {
-      const { stdout: rootOut } = await execAsync('git rev-parse --show-toplevel', {
-        cwd: workDir,
-        timeout: 5000,
-        windowsHide: true
-      });
-      gitRoot = rootOut.trim();
-    } catch {}
+    const gitRoot = await getWorkbenchGitRoot(msg, workDir);
 
     if (untracked) {
       // Untracked files: resolve path relative to git root
       const fullPath = resolve(gitRoot, filePath);
-      const resolved = resolveAndValidatePath(fullPath, gitRoot);
+      // The root check above proved canonical workspace ownership. Validate
+      // against that same Git root, including when cwd is a symlink alias.
+      const resolved = await resolveWorkItemPath(msg, resolveAndValidatePath(fullPath, gitRoot), gitRoot);
       const content = await readFile(resolved, 'utf-8');
       sendWorkbenchResult(ctx, msg, {
         type: 'git_diff_result',
@@ -205,7 +211,7 @@ export async function handleGitAdd(msg) {
   const workDir = msg.workDir || conv?.workDir || ctx.CONFIG.workDir;
 
   try {
-    const gitRoot = await getGitRoot(workDir);
+    const gitRoot = await getWorkbenchGitRoot(msg, workDir);
 
     if (addAll) {
       await execAsync('git add -A', { cwd: gitRoot, timeout: 10000, windowsHide: true });
@@ -229,7 +235,7 @@ export async function handleGitReset(msg) {
   const workDir = msg.workDir || conv?.workDir || ctx.CONFIG.workDir;
 
   try {
-    const gitRoot = await getGitRoot(workDir);
+    const gitRoot = await getWorkbenchGitRoot(msg, workDir);
 
     if (resetAll) {
       await execAsync('git reset HEAD', { cwd: gitRoot, timeout: 10000, windowsHide: true });
@@ -258,7 +264,7 @@ export async function handleGitRestore(msg) {
       return;
     }
 
-    const gitRoot = await getGitRoot(workDir);
+    const gitRoot = await getWorkbenchGitRoot(msg, workDir);
     await execAsync(`git restore -- "${filePath}"`, { cwd: gitRoot, timeout: 10000, windowsHide: true });
     sendWorkbenchResult(ctx, msg, { type: 'git_op_result', conversationId, _requestUserId, operation: 'restore', success: true, message: `Restored: ${filePath}` });
   } catch (e) {
@@ -277,7 +283,7 @@ export async function handleGitCommit(msg) {
       return;
     }
 
-    const gitRoot = await getGitRoot(workDir);
+    const gitRoot = await getWorkbenchGitRoot(msg, workDir);
 
     // Write commit message to temp file to avoid shell injection
     const tmpFile = join(gitRoot, '.git', 'WEBCHAT_COMMIT_MSG');
@@ -303,7 +309,7 @@ export async function handleGitPush(msg) {
   const workDir = msg.workDir || conv?.workDir || ctx.CONFIG.workDir;
 
   try {
-    const gitRoot = await getGitRoot(workDir);
+    const gitRoot = await getWorkbenchGitRoot(msg, workDir);
     const { stdout, stderr } = await execAsync('git push', {
       cwd: gitRoot, timeout: 60000, windowsHide: true
     });

package/workbench/work-item-path.js

@@ -0,0 +1,41 @@
+import { lstat, realpath } from 'node:fs/promises';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+
+function assertWithin(root, candidate) {
+  const path = relative(root, candidate);
+  if (path === '..' || path.startsWith(`..${sep}`) || isAbsolute(path)) {
+    const error = new Error('File is outside the WorkItem workspace.');
+    error.code = 'FILE_OUTSIDE_WORKSPACE';
+    throw error;
+  }
+}
+
+/**
+ * Resolve a WorkItem file operation without following a symlink outside its
+ * Agent-resolved workspace. New destinations validate the nearest existing
+ * ancestor; dangling symlinks fail closed. Other Workbench routes keep their
+ * existing path-picker behavior. This is not a concurrent filesystem sandbox.
+ */
+export async function resolveWorkItemPath(msg, filePath, workDir) {
+  const candidate = resolve(workDir, filePath);
+  if (msg.workbenchRoute?.runtimeProvider !== 'work-center') return candidate;
+  if (!isAbsolute(workDir)) throw new Error('WorkItem workspace must be absolute.');
+  const root = await realpath(workDir);
+  // Check both lexical and canonical ownership. Return the original path so a
+  // delete/rename still operates on a symlink itself, not on its target.
+  assertWithin(resolve(workDir), candidate);
+  let ancestor = candidate;
+  for (;;) {
+    try {
+      await lstat(ancestor);
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+      const parent = dirname(ancestor);
+      if (parent === ancestor) throw error;
+      ancestor = parent;
+      continue;
+    }
+    assertWithin(root, await realpath(ancestor));
+    return candidate;
+  }
+}

package/yeaft/work-center/assignment.js

@@ -162,17 +162,21 @@ function availableModel(config, ref) {
   if (models.length === 0) return null;
   const parsed = parseModelRef(ref);
   return models.find(model => model.ref === ref)
-    || models.find(model => !parsed.providerName && model.id === parsed.modelId)
+    || models.find(model => model.id === parsed.modelId
+      && (!parsed.providerName || model.provider === parsed.providerName))
     || null;
 }
 
-export function resolveWorkItemModel(config, vp, rawPolicy) {
+export function resolveWorkItemModel(config, vp, rawPolicy, modelTags = {}) {
   const policy = normalizeModelPolicy(rawPolicy);
   let model;
   let source;
   if (policy.mode === 'specific') {
     model = policy.model;
     source = 'stage-specific';
+  } else if (policy.mode === 'tag') {
+    model = modelTags[policy.tag] || null;
+    source = `tag:${policy.tag}`;
   } else if (policy.mode === 'primary') {
     model = config.primaryModel || config.model || null;
     source = 'agent-primary';
@@ -191,8 +195,9 @@ export function resolveWorkItemModel(config, vp, rawPolicy) {
   if (Array.isArray(config.availableModels) && config.availableModels.length > 0 && !available) {
     throw policyError(`Configured Work Center model is unavailable: ${model}`);
   }
+  if (policy.mode === 'tag' && available?.ref) model = available.ref;
   const effortOptions = Array.isArray(available?.effortOptions) ? available.effortOptions : [];
-  const effortOrder = ['minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'ultra'];
+  const effortOrder = ['medium', 'high', 'xhigh'];
   const requestedIndex = effortOrder.indexOf(policy.effort);
   const effort = !policy.effort || effortOptions.length === 0
     ? null

package/yeaft/work-center/coordinator.js

@@ -20,7 +20,10 @@ import { isDynamicWorkItem } from './execution-mode.js';
 import { applyCoordinatorReplan } from './plan-mutation.js';
 import { buildWorkItemAttachmentContext } from './attachments.js';
 import { sanitizeDiagnosticText } from './debug-projection.js';
-import { generatedActionGraphRules } from './workflow.js';
+import {
+  DEFAULT_WORK_CENTER_MODEL_TAGS,
+  generatedActionGraphRules,
+} from './workflow.js';
 import { workItemCapabilityContext } from './capabilities.js';
 
 const COORDINATOR_MAX_REPLY_CHARS = 8_000;
@@ -900,7 +903,12 @@ export class WorkItemCoordinator {
             ...(settings?.modelPolicy || {}),
             effort: settings?.actionModelPolicies?.triage?.effort || settings?.modelPolicy?.effort || 'high',
           };
-          resolved = resolveWorkItemModel(runtime.config, assignment.vp, coordinatorPolicy);
+          resolved = resolveWorkItemModel(
+            runtime.config,
+            assignment.vp,
+            coordinatorPolicy,
+            settings?.modelTags || DEFAULT_WORK_CENTER_MODEL_TAGS,
+          );
         } catch (error) {
           throw coordinatorExecutionError(error, 'selection', language);
         }

package/yeaft/work-center/planner.js

@@ -1,5 +1,5 @@
 import { resolveWorkItemModel, selectWorkItemVp } from './assignment.js';
-import { resolveWorkflowSnapshot } from './workflow.js';
+import { normalizeWorkCenterSettings, resolveWorkflowSnapshot } from './workflow.js';
 
 function publicVp(vp) {
   return vp ? {
@@ -17,6 +17,7 @@ function publicVp(vp) {
 }
 
 export function previewWorkCenterPlan({ settings, workflowId, stageOverrides, registry, config }) {
+  const normalizedSettings = normalizeWorkCenterSettings(settings);
   const workflow = resolveWorkflowSnapshot(settings, workflowId, stageOverrides);
   const vps = registry.listVps();
   const syntheticRuns = [];
@@ -28,7 +29,12 @@ export function previewWorkCenterPlan({ settings, workflowId, stageOverrides, re
         vps,
         priorRuns: syntheticRuns,
       });
-      const model = resolveWorkItemModel(config, assignment.vp, stage.modelPolicy);
+      const model = resolveWorkItemModel(
+        config,
+        assignment.vp,
+        stage.modelPolicy,
+        normalizedSettings.modelTags,
+      );
       syntheticRuns.push({
         actionType: stage.type,
         roleSnapshot: { actionType: stage.type },

package/yeaft/work-center/projection.js

@@ -970,6 +970,11 @@ export function projectWorkItemDetail(detail, options = {}) {
   }
   const projected = {
     id: detail.id,
+    // The browser needs the Agent-resolved workspace only to bind an explicitly
+    // selected WorkItem Workbench. It is not included in board/list projections.
+    workbench: typeof detail.workDir === 'string' && detail.workDir.trim()
+      ? { workDir: detail.workDir.trim() }
+      : null,
     revision: detail.revision,
     planRevision: count(detail.planRevision),
     ledgerRevision: count(detail.ledgerRevision),

package/yeaft/work-center/runner.js

@@ -37,7 +37,11 @@ import { loadMCPConfig } from '../config.js';
 import { MCPManager } from '../mcp.js';
 import { buildMcpFlattenedTools } from '../tools/mcp-tools.js';
 import { recallWorkspaceSessionContext } from './workspace-context.js';
-import { applyGeneratedPlan, BUILT_IN_ACTION_TYPES } from './workflow.js';
+import {
+  applyGeneratedPlan,
+  BUILT_IN_ACTION_TYPES,
+  DEFAULT_WORK_CENTER_MODEL_TAGS,
+} from './workflow.js';
 import { isDynamicWorkItem, usesMainlineContext } from './execution-mode.js';
 import {
   applyAdditivePlanProposal,
@@ -1081,8 +1085,10 @@ export class WorkItemRunner {
   async run({ workItem, action, run, signal, ownerBootId, onProgress, registerProgressReader, registerInputWake, onEngineEvent = null }) {
     assertCreateVpActionAuthority(workItem, action, this.registry);
     const runtime = await this.runtimeProvider();
+    const settings = this.policyProvider ? await this.policyProvider() : null;
     const currentSettings = ['ai', 'coordinator'].includes(workItem?.workflowSnapshot?.planningMode)
-      && this.policyProvider ? await this.policyProvider() : null;
+      ? settings
+      : null;
     const currentModelPolicy = currentSettings?.actionModelPolicies?.[action.type]
       || currentSettings?.actionModelPolicies?.custom
       || currentSettings?.modelPolicy
@@ -1125,7 +1131,16 @@ export class WorkItemRunner {
       error.retryable = false;
       throw error;
     }
-    const resolvedModel = resolveWorkItemModel(runtime.config, vp, executionAction.modelPolicy);
+    const fallbackModel = runtime.config.primaryModel || runtime.config.model || null;
+    const modelTags = settings?.modelTags || Object.fromEntries(
+      Object.keys(DEFAULT_WORK_CENTER_MODEL_TAGS).map(tag => [tag, fallbackModel]),
+    );
+    const resolvedModel = resolveWorkItemModel(
+      runtime.config,
+      vp,
+      executionAction.modelPolicy,
+      modelTags,
+    );
     const memoryBlock = recallWorkItemMemory(
       { ...runtime, yeaftDir: runtime.yeaftDir || this.yeaftDir },
       workItem,

package/yeaft/work-center/workflow.js

@@ -21,12 +21,35 @@ export const BUILT_IN_ACTION_TYPES = Object.freeze([
 ]);
 const STAGE_TYPES = new Set(BUILT_IN_ACTION_TYPES);
 const ASSIGNMENT_MODES = new Set(['auto', 'pool', 'fixed', 'planned']);
-const MODEL_MODES = new Set(['inherit', 'primary', 'fast', 'specific']);
-const MODEL_EFFORTS = new Set(['minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'ultra']);
+const MODEL_MODES = new Set(['inherit', 'primary', 'fast', 'specific', 'tag']);
+const MODEL_EFFORTS = new Set(['medium', 'high', 'xhigh']);
 const WORKSPACE_MODES = new Set(['shared', 'read', 'isolated-write', 'integrate']);
-const HIGH_EFFORT_ACTION_TYPES = new Set(['triage', 'research', 'design', 'diagnose', 'review']);
 const ACTION_CONTEXT_QUOTE_MAX_BYTES = 8 * 1024;
 
+export const DEFAULT_WORK_CENTER_MODEL_TAGS = Object.freeze({
+  fast: 'gpt-5.6-luna',
+  balanced: 'gpt-5.6-sol',
+  ultimate: 'gpt-6-astra',
+});
+
+const ULTIMATE_ACTION_TYPES = new Set(['triage', 'research', 'design', 'diagnose', 'review']);
+const FAST_ACTION_TYPES = new Set(['document', 'deliver', 'write']);
+
+function normalizeModelTags(value) {
+  const source = value && typeof value === 'object' && !Array.isArray(value)
+    ? value
+    : DEFAULT_WORK_CENTER_MODEL_TAGS;
+  return Object.fromEntries(Object.entries(source)
+    .map(([tag, model]) => [canonicalActionId(tag), typeof model === 'string' ? model.trim() : ''])
+    .filter(([tag, model]) => tag && model));
+}
+
+function defaultActionModelTag(type) {
+  if (ULTIMATE_ACTION_TYPES.has(type)) return { tag: 'ultimate', effort: 'xhigh' };
+  if (FAST_ACTION_TYPES.has(type)) return { tag: 'fast', effort: 'medium' };
+  return { tag: 'balanced', effort: 'high' };
+}
+
 const DEFAULT_STAGE_INSTRUCTIONS = Object.freeze({
   triage: 'Turn the request into an executable contract. Inspect relevant repository facts before deciding the flow. Classify the WorkItem, identify constraints, risks, dependencies, and missing acceptance criteria, then plan only the Actions needed for this task. Do not implement. If the goal or acceptance criteria must change, submit a contractPatch and explain why.',
   research: 'Answer the Action objective with verifiable evidence. Search the repository and, when needed, authoritative external sources. Separate observed facts from inference, record unresolved uncertainty, and produce a concise conclusion that a later Action can use.',
@@ -97,26 +120,26 @@ const DEFAULT_SOFTWARE_CHANGE_STAGES = Object.freeze([
   {
     id: 'triage', name: 'Triage', type: 'triage',
     assignmentPolicy: { mode: 'auto', capability: 'triage', candidateVpIds: [], fixedVpId: null, separateFromStageTypes: [] },
-    modelPolicy: { mode: 'inherit', model: null, effort: null },
+    modelPolicy: { mode: 'tag', tag: 'ultimate', effort: 'xhigh' },
     maxAttempts: 2,
   },
   {
     id: 'implement', name: 'Implement', type: 'implement',
     assignmentPolicy: { mode: 'auto', capability: 'implement', candidateVpIds: [], fixedVpId: null, separateFromStageTypes: [] },
-    modelPolicy: { mode: 'inherit', model: null, effort: null },
+    modelPolicy: { mode: 'tag', tag: 'balanced', effort: 'high' },
     maxAttempts: 2,
   },
   {
     id: 'review', name: 'Review', type: 'review',
     assignmentPolicy: { mode: 'auto', capability: 'review', candidateVpIds: [], fixedVpId: null, separateFromStageTypes: ['implement'] },
-    modelPolicy: { mode: 'inherit', model: null, effort: null },
+    modelPolicy: { mode: 'tag', tag: 'ultimate', effort: 'xhigh' },
     maxAttempts: 2,
     changesRequestedStageId: 'implement',
   },
   {
     id: 'deliver', name: 'Deliver', type: 'deliver',
     assignmentPolicy: { mode: 'auto', capability: 'deliver', candidateVpIds: [], fixedVpId: null, separateFromStageTypes: [] },
-    modelPolicy: { mode: 'inherit', model: null, effort: null },
+    modelPolicy: { mode: 'tag', tag: 'fast', effort: 'medium' },
     maxAttempts: 2,
   },
 ]);
@@ -183,14 +206,18 @@ export function normalizeModelPolicy(value) {
   const source = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
   const mode = MODEL_MODES.has(source.mode) ? source.mode : 'inherit';
   const model = typeof source.model === 'string' && source.model.trim() ? source.model.trim() : null;
+  const tag = typeof source.tag === 'string' && source.tag.trim()
+    ? canonicalActionId(source.tag)
+    : null;
   const effort = MODEL_EFFORTS.has(source.effort) ? source.effort : null;
   if (mode === 'specific' && !model) throw new Error('Specific Work Center model policy requires a model');
-  return { mode, model, effort };
+  if (mode === 'tag' && !tag) throw new Error('Tagged Work Center model policy requires a tag');
+  return { mode, model, tag, effort };
 }
 
 export function defaultActionModelPolicy(type, fallback = null) {
-  const base = normalizeModelPolicy(fallback);
-  return { ...base, effort: HIGH_EFFORT_ACTION_TYPES.has(type) ? 'high' : 'medium' };
+  if (fallback) return normalizeModelPolicy(fallback);
+  return normalizeModelPolicy({ mode: 'tag', ...defaultActionModelTag(type) });
 }
 
 export function normalizeActionModelPolicies(value, fallback = null) {
@@ -308,8 +335,9 @@ export function defaultWorkCenterSettings() {
     maxConcurrentActions: 3,
     defaultWorkDir: '',
     globalInstructions: '',
-    modelPolicy: { mode: 'inherit', model: null, effort: null },
-    coordinatorModelPolicy: { mode: 'inherit', model: null, effort: 'high' },
+    modelTags: { ...DEFAULT_WORK_CENTER_MODEL_TAGS },
+    modelPolicy: normalizeModelPolicy({ mode: 'tag', tag: 'balanced', effort: 'high' }),
+    coordinatorModelPolicy: normalizeModelPolicy({ mode: 'tag', tag: 'ultimate', effort: 'xhigh' }),
     actionModelPolicies: normalizeActionModelPolicies(),
     actionInstructions: normalizeActionInstructions(),
     workflows: [normalizeWorkflowDefinition({
@@ -347,6 +375,7 @@ export function normalizeWorkCenterSettings(value) {
     maxConcurrentActions: Math.min(Math.max(Number(source.maxConcurrentActions) || 3, 1), 12),
     defaultWorkDir: typeof source.defaultWorkDir === 'string' ? source.defaultWorkDir.trim() : '',
     globalInstructions: normalizeGlobalInstructions(source.globalInstructions),
+    modelTags: normalizeModelTags(source.modelTags),
     modelPolicy: normalizeModelPolicy(source.modelPolicy || migratedModelPolicy),
     coordinatorModelPolicy: normalizeModelPolicy(
       source.coordinatorModelPolicy || { ...(source.modelPolicy || migratedModelPolicy), effort: 'high' },