commandmate 0.26.1 → 0.27.0

package/dist/server/src/lib/hooks/sources/opencode/turn-gate.js

@@ -55,13 +55,40 @@
  * the window where a reconnect lands between a turn's end and its trailing
  * repeat.
  *
+ * ## Which session's turn is the *instance's* turn (Issue #1900)
+ *
+ * One opencode server can carry several sessions at once (#1758 §5.6.1
+ * measured two busy simultaneously), and a sub-agent runs in a session of its
+ * own. Every frame is tagged with its `sessionID`, but CommandMate's unit of
+ * state is the **instance** — `(worktree, tool, instance)` — so an idle that
+ * belongs to a sub-agent used to be published as the instance's `stop` while
+ * the session the human is waiting on was still working. Downstream that is not
+ * a cosmetic error: `mergeStructuredStatus` lets a structured `ready` overwrite
+ * a scraper `running`, so `commandmate wait` returned 0 mid-turn.
+ *
+ * So the gate also decides *whose* completion counts:
+ *
+ *  - A session first seen busy while **nothing else is busy** becomes the
+ *    **primary** session — the one whose turn is the instance's turn. A session
+ *    that goes busy *during* another session's turn cannot take the title,
+ *    which is exactly the shape a sub-agent has.
+ *  - A session ever seen with a non-empty `info.parentID` is a **child** and can
+ *    never be primary. `parentID` is in the server's own `Session` schema
+ *    (verified against `GET /doc` on 1.18.21) and is the only positive statement
+ *    opencode makes about the relationship.
+ *  - An idle from any other session is dropped as `foreign-session` **while the
+ *    primary is still busy**. Once the primary's own turn has closed the rule
+ *    lifts: at that point the instance is not working, so letting a stray idle
+ *    through cannot cut a live turn short — which bounds the cost of inferring
+ *    the primary wrongly to "one turn is closed late by the scraper".
+ *
  * The gate is a pure state machine over frame types so it can be driven from
  * fixtures. The subscription owns one per connection.
  *
  * @module lib/hooks/sources/opencode/turn-gate
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_TRACKED_USER_MESSAGES = exports.MAX_TRACKED_TURN_SESSIONS = void 0;
+exports.MAX_TRACKED_CHILD_SESSIONS = exports.MAX_TRACKED_USER_MESSAGES = exports.MAX_TRACKED_TURN_SESSIONS = void 0;
 exports.createTurnGate = createTurnGate;
 const event_mapper_1 = require("../event-mapper");
 /**
@@ -81,6 +108,14 @@ exports.MAX_TRACKED_TURN_SESSIONS = 64;
  * re-announced `user_prompt_submit` for a prompt from thousands of turns ago.
  */
 exports.MAX_TRACKED_USER_MESSAGES = 512;
+/**
+ * Cap on remembered child sessions.
+ *
+ * Same order as the session cap and for the same reason. Forgetting the oldest
+ * costs the `parentID` half of the primary rule for an ancient sub-agent; the
+ * "cannot take the title mid-turn" half is unaffected.
+ */
+exports.MAX_TRACKED_CHILD_SESSIONS = 64;
 /** `properties.sessionID`, or null. */
 function sessionIdOf(payload) {
     const properties = (0, event_mapper_1.isPlainObject)(payload.properties) ? payload.properties : {};
@@ -96,6 +131,24 @@ function errorName(payload) {
     const properties = (0, event_mapper_1.isPlainObject)(payload.properties) ? payload.properties : {};
     return (0, event_mapper_1.readNestedString)(properties, ['error', 'name']);
 }
+/**
+ * The session this frame declares a parent for, or null (Issue #1900).
+ *
+ * `Session.parentID` is optional in opencode's own schema and present only on a
+ * sub-agent's session, so a non-empty value is a positive identification. Read
+ * off `info.id` rather than `properties.sessionID` because those differ on
+ * `message.updated`, whose `info` is a *message* and carries no `parentID` at
+ * all — which is what keeps this generic read from mislabelling one.
+ */
+function childSessionOf(payload) {
+    const properties = (0, event_mapper_1.isPlainObject)(payload.properties) ? payload.properties : {};
+    const info = (0, event_mapper_1.isPlainObject)(properties.info) ? properties.info : null;
+    if (info === null)
+        return null;
+    if (!(0, event_mapper_1.readNestedString)(info, ['parentID']))
+        return null;
+    return (0, event_mapper_1.readNestedString)(info, ['id']) ?? (0, event_mapper_1.readNestedString)(properties, ['sessionID']);
+}
 /** `properties.info.role` / `properties.info.id` for `message.updated`. */
 function messageInfo(payload) {
     const properties = (0, event_mapper_1.isPlainObject)(payload.properties) ? payload.properties : {};
@@ -122,16 +175,56 @@ function trim(keys, max) {
  * @param maxUserMessages - Cap on remembered user-message ids; defaults to
  *   {@link MAX_TRACKED_USER_MESSAGES}
  */
-function createTurnGate(maxSessions = exports.MAX_TRACKED_TURN_SESSIONS, maxUserMessages = exports.MAX_TRACKED_USER_MESSAGES) {
+function createTurnGate(maxSessions = exports.MAX_TRACKED_TURN_SESSIONS, maxUserMessages = exports.MAX_TRACKED_USER_MESSAGES, maxChildSessions = exports.MAX_TRACKED_CHILD_SESSIONS) {
     const phases = new Map();
     const announced = new Set();
+    const children = new Set();
+    let primary = null;
     const remember = (sessionId, phase) => {
         phases.delete(sessionId);
         phases.set(sessionId, phase);
         trim(phases, maxSessions);
     };
+    /** Whether the instance's own turn is open. */
+    const primaryIsBusy = () => primary !== null && phases.get(primary) === 'busy';
+    /**
+     * Take the title, if this session is allowed to and nobody holds it.
+     *
+     * Called after the session has been recorded busy, so `primaryIsBusy()` here
+     * asks about a *different* session — the one whose turn this new arrival is
+     * running inside.
+     */
+    const adoptPrimary = (sessionId) => {
+        if (children.has(sessionId))
+            return;
+        if (primary === sessionId)
+            return;
+        if (primaryIsBusy())
+            return;
+        primary = sessionId;
+    };
+    /** Whether this idle belongs to somebody else's turn. */
+    const isForeign = (sessionId) => {
+        if (children.has(sessionId))
+            return true;
+        return primary !== null && sessionId !== primary && primaryIsBusy();
+    };
+    const armSession = (sessionId) => {
+        remember(sessionId, 'busy');
+        adoptPrimary(sessionId);
+    };
     return {
         observe(type, payload) {
+            // Before the dispatch and for every frame: parentage arrives on
+            // `session.created` / `session.updated`, which are not the frames the
+            // turn rules below look at.
+            const child = childSessionOf(payload);
+            if (child !== null) {
+                children.add(child);
+                trim(children, maxChildSessions);
+                if (primary === child)
+                    primary = null;
+            }
             if (type === 'message.updated') {
                 const { role, id } = messageInfo(payload);
                 // Only the user's own message is `user_prompt_submit`; the assistant's
@@ -155,7 +248,7 @@ function createTurnGate(maxSessions = exports.MAX_TRACKED_TURN_SESSIONS, maxUser
                 const sessionId = sessionIdOf(payload);
                 if (sessionId === null)
                     return { kind: 'ignored' };
-                remember(sessionId, 'busy');
+                armSession(sessionId);
                 return { kind: 'armed', sessionId };
             }
             if (type === 'session.error') {
@@ -172,6 +265,15 @@ function createTurnGate(maxSessions = exports.MAX_TRACKED_TURN_SESSIONS, maxUser
             const sessionId = sessionIdOf(payload);
             if (sessionId === null)
                 return { kind: 'ignored' };
+            // Issue #1900. Checked before the phase rules so the reason names the
+            // real cause: a sub-agent's idle is not "a turn we did not watch start",
+            // it is a turn that is not this instance's. Recorded as idle on the way
+            // out so the session does not sit armed forever and reappear as a
+            // synthesised completion after the next reconnect.
+            if (isForeign(sessionId)) {
+                remember(sessionId, 'idle');
+                return { kind: 'suppressed', sessionId, reason: 'foreign-session' };
+            }
             const phase = phases.get(sessionId);
             if (phase === undefined) {
                 return { kind: 'suppressed', sessionId, reason: 'never-armed' };
@@ -185,9 +287,22 @@ function createTurnGate(maxSessions = exports.MAX_TRACKED_TURN_SESSIONS, maxUser
         isArmed(sessionId) {
             return phases.get(sessionId) === 'busy';
         },
+        arm(sessionId) {
+            armSession(sessionId);
+        },
+        armedSessions() {
+            return [...phases.entries()]
+                .filter(([, phase]) => phase === 'busy')
+                .map(([sessionId]) => sessionId);
+        },
+        primarySession() {
+            return primary;
+        },
         reset() {
             phases.clear();
-            // `announced` is deliberately kept — see the module comment.
+            primary = null;
+            // `announced` and `children` are deliberately kept — see the module
+            // comment and {@link TurnGate.reset}.
         },
     };
 }

package/dist/server/src/lib/hooks/sources/pending-decisions.js

@@ -29,9 +29,11 @@ exports.MAX_OPEN_DECISIONS_PER_INSTANCE = void 0;
 exports.openDecisionSlot = openDecisionSlot;
 exports.closeDecisionSlot = closeDecisionSlot;
 exports.listOpenDecisions = listOpenDecisions;
+exports.recordDecisionDelivery = recordDecisionDelivery;
 exports.fillDecisionSlot = fillDecisionSlot;
 exports.resetPendingDecisions = resetPendingDecisions;
 exports.answerPendingDecision = answerPendingDecision;
+exports.answerPendingDecisionWithReceipt = answerPendingDecisionWithReceipt;
 const auto_yes_state_1 = require("../../../lib/auto-yes-state");
 const logger_1 = require("../../../lib/logger");
 const logger = (0, logger_1.createLogger)('lib/hooks/sources/pending-decisions');
@@ -50,7 +52,7 @@ function keyOf(ref) {
 /** Register a decision as in flight. Always paired with {@link closeDecisionSlot}. */
 function openDecisionSlot(ref, decision) {
     const key = keyOf(ref);
-    const slot = { key, ref, decision, body: null };
+    const slot = { key, ref, decision, body: null, delivery: null };
     const open = pendingByInstance.get(key) ?? [];
     open.push(slot);
     while (open.length > exports.MAX_OPEN_DECISIONS_PER_INSTANCE)
@@ -80,6 +82,25 @@ function closeDecisionSlot(slot) {
 function listOpenDecisions(ref) {
     return (pendingByInstance.get(keyOf(ref)) ?? []).map((slot) => slot.decision);
 }
+/**
+ * Record what became of the verdict for an open slot (Issue #1898).
+ *
+ * Called from a source's own `decide()`, beside — not instead of — filling the
+ * body: a push source that wrote a body delivered it, and a pull source that
+ * POSTed it somewhere has an HTTP result nobody else can see.
+ *
+ * @returns Whether a slot was still open to record against
+ */
+function recordDecisionDelivery(ref, decisionId, delivery) {
+    const open = pendingByInstance.get(keyOf(ref));
+    if (!open)
+        return false;
+    const slot = open.find((candidate) => candidate.decision.id === decisionId);
+    if (!slot)
+        return false;
+    slot.delivery = delivery;
+    return true;
+}
 /** Fill the slot a push source is answering, if it is still open. */
 function fillDecisionSlot(ref, decisionId, body) {
     const open = pendingByInstance.get(keyOf(ref));
@@ -107,6 +128,18 @@ function resetPendingDecisions() {
  *   ack of a request whose answer went elsewhere.
  */
 async function answerPendingDecision(source, ref, decision, verdict) {
+    return (await answerPendingDecisionWithReceipt(source, ref, decision, verdict)).body;
+}
+/**
+ * Answer one decision and keep the receipt (Issue #1898).
+ *
+ * The same call as {@link answerPendingDecision} — one slot, one `decide()`,
+ * one close — and the reason it exists separately is that the receiver routes
+ * only ever want the body, while a caller that adjudicated *on the agent's
+ * behalf* (opencode's ingest, the Auto-Yes re-check) has to know whether the
+ * verdict landed before it decides that no dialog is open.
+ */
+async function answerPendingDecisionWithReceipt(source, ref, decision, verdict) {
     const slot = openDecisionSlot(ref, decision);
     try {
         await source.decide(ref, decision, verdict);
@@ -122,6 +155,11 @@ async function answerPendingDecision(source, ref, decision, verdict) {
             decisionId: decision.id,
             error: error instanceof Error ? error.message : String(error),
         });
+        slot.delivery = {
+            delivered: false,
+            reason: error instanceof Error ? `decide-threw:${error.message}` : 'decide-threw',
+        };
     }
-    return closeDecisionSlot(slot);
+    const delivery = slot.delivery;
+    return { body: closeDecisionSlot(slot), delivery };
 }

package/dist/server/src/lib/hooks/tool-input-normalization-state.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * In-memory record of the last `tool_input` this server had to normalise
+ * (Issue #1902).
+ *
+ * `readPermissionToolInput` turns copilot's string `tool_input` into an object
+ * so the request can be adjudicated at all. That is a rewrite of what the agent
+ * sent, and the design policy's discoverability rule (§7 of
+ * `docs/design/multi-agent-state-architecture.md`) is that a judgement or an
+ * automatic action which only exists in the server log does not exist: an
+ * operator has to be able to read *"the tool_input was a string, so it was read
+ * as a patch"* out of the CLI.
+ *
+ * So the same record `permission-decision-service` acts on is kept here per
+ * session and published by `buildCurrentOutput` as
+ * `structuredEvents.toolInputNormalization` — which is what `capture --json`
+ * prints verbatim and what `wait` polls.
+ *
+ * Exposure only: nothing reads this back to decide anything. The decision uses
+ * the normalisation carried on the payload itself, not this record.
+ *
+ * The module is a near-copy of `polling/auto-yes-suppression-state` on purpose;
+ * that similarity is the convention for a per-session diagnostic, and the
+ * `globalThis` indirection is load-bearing for the same reason it is there
+ * (#1736): the writer is `/api/hooks/permission-request` and the reader is
+ * `/api/worktrees/:id/current-output`, which `next dev` bundles separately and
+ * would otherwise give a private copy of this map each.
+ *
+ * @module lib/hooks/tool-input-normalization-state
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordToolInputNormalization = recordToolInputNormalization;
+exports.getLastToolInputNormalization = getLastToolInputNormalization;
+exports.clearToolInputNormalizations = clearToolInputNormalizations;
+const auto_yes_state_1 = require("../../lib/auto-yes-state");
+/** compositeKey -> the most recent normalisation for that session. */
+const lastNormalizations = globalThis.__toolInputNormalizations ??
+    (globalThis.__toolInputNormalizations = new Map());
+/**
+ * Record that `instanceId`'s last permission request arrived in a shape this
+ * server had to rewrite before it could judge it.
+ *
+ * Recorded for every verdict, not only for allows: the operator's question is
+ * "why did this get adjudicated the way it did", and suppressing the record on
+ * the suppressed path would remove the answer exactly when it is asked.
+ *
+ * @param at - Epoch ms; defaults to now. Overridable so tests are deterministic.
+ */
+function recordToolInputNormalization(worktreeId, cliToolId, instanceId, normalization, toolName, at = Date.now()) {
+    lastNormalizations.set((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId), {
+        ...normalization,
+        toolName,
+        at,
+    });
+}
+/**
+ * @returns The last normalisation for this session, or null — the ordinary case
+ *   for every tool but copilot, and for copilot sessions that have not edited a
+ *   file yet.
+ */
+function getLastToolInputNormalization(worktreeId, cliToolId, instanceId) {
+    return lastNormalizations.get((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId)) ?? null;
+}
+/** Drop every recorded normalisation. Test seam. */
+function clearToolInputNormalizations() {
+    lastNormalizations.clear();
+}

package/dist/server/src/lib/hooks/tool-input-normalization.js

@@ -0,0 +1,157 @@
+"use strict";
+/**
+ * Reading a `tool_input` that did not arrive as an object (Issue #1902).
+ *
+ * Every permission parser in `sources/` requires `tool_input` to be a plain
+ * object, and copilot 1.0.80's `Edit` breaks that: its `PreToolUse` sends the
+ * whole apply-patch envelope as a **bare string**.
+ *
+ * ```json
+ * {"hook_event_name":"PreToolUse","tool_name":"Edit",
+ *  "tool_input":"*** Begin Patch\n*** Add File: note4.txt\n+yo\n*** End Patch\n"}
+ * ```
+ *
+ * The object check answered null for that payload, null became
+ * `unknown-payload`, and `unknown-payload` is a no-decision — so **every file
+ * edit copilot made fell through to a dialog**, no matter what Auto-Yes or the
+ * contract said, and the screen-scraping poller answered it two to four seconds
+ * later. `Read` and `Bash` were unaffected because their `tool_input` is an
+ * object, which is why the symptom looked like "Auto-Yes works, except for
+ * edits".
+ *
+ * ## What normalising must not become
+ *
+ * A silent rewrite. The adjudicated shape is no longer the shape the agent
+ * sent, and an operator reading `capture --json` has to be able to see that —
+ * hence {@link ToolInputNormalization}, which is carried on the payload,
+ * recorded per session by `./tool-input-normalization-state`, and published in
+ * `structuredEvents.toolInputNormalization`. The reason code is the point: it
+ * says *"the tool_input was a string, so it was read as a patch"* rather than
+ * leaving a `{ patch }` object that nothing explains.
+ *
+ * ## Where the deny patterns are applied — and why not to the body
+ *
+ * To the envelope's **action header lines** (`*** Add File: note4.txt`,
+ * `*** Update File: …`, `*** Delete File: …`, `*** Move to: …`), never to the
+ * hunk bodies.
+ *
+ * That is not a new rule; it is the one `PRIMARY_TOOL_INPUT_KEYS` already
+ * states. `Write.content` and `Edit.new_string` are deliberately excluded from
+ * the matching surface there, because a deny pattern is a statement about the
+ * *action* and matching it against a file body suppresses an edit for quoting
+ * the very string the contract is trying to keep out of the shell. A patch body
+ * is exactly those two fields fused into one string. Matching it would make
+ * copilot's `Edit` strictly stricter than Claude's `Edit` and `Write` for the
+ * same action, so a contract that runs unattended on Claude would deadlock on
+ * copilot the first time an agent wrote a shell script — and the escalation
+ * would be a dialog nobody is watching.
+ *
+ * The header lines carry the verb *and* the path, so both kinds of contract
+ * still work: `Delete File` blocks deletions, `\.env` blocks a path.
+ *
+ * Under-matching is the one thing worth guarding, since it ends in an
+ * unattended approval rather than a dialog. So the summary is only used when it
+ * is trustworthy: **no header line found, or more than
+ * {@link MAX_PATCH_ACTION_LINES} of them, falls back to the whole envelope** —
+ * over-matching, which costs a dialog, the same direction
+ * `collectToolInputMatchTexts` already falls in for an unknown tool.
+ *
+ * @module lib/hooks/tool-input-normalization
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_PATCH_ACTION_LINES = exports.PATCH_ENVELOPE_OPENING = exports.TEXT_TOOL_INPUT_KEY = exports.PATCH_TOOL_INPUT_KEY = void 0;
+exports.isPatchEnvelope = isPatchEnvelope;
+exports.collectPatchMatchTexts = collectPatchMatchTexts;
+exports.readPermissionToolInput = readPermissionToolInput;
+/** Key a string `tool_input` recognised as an apply-patch envelope is stored under. */
+exports.PATCH_TOOL_INPUT_KEY = 'patch';
+/** Key any other string `tool_input` is stored under. */
+exports.TEXT_TOOL_INPUT_KEY = 'text';
+/** The opening line of an apply-patch envelope. */
+exports.PATCH_ENVELOPE_OPENING = '*** Begin Patch';
+/** Column-0 prefix of an envelope's structural lines. */
+const PATCH_ACTION_PREFIX = '*** ';
+/** Structural lines that name no action, so nothing is judged against them. */
+const PATCH_ENVELOPE_MARKERS = new Set(['Begin Patch', 'End Patch']);
+/**
+ * How much of the string is examined for the opening marker.
+ *
+ * Bounded so a multi-megabyte patch does not get copied by `trimStart()` just
+ * to look at its first sixteen characters.
+ */
+const PATCH_OPENING_SCAN_LENGTH = 64;
+/**
+ * Most action lines a patch may have before its summary stops being trusted.
+ *
+ * A patch touching more files than this is not summarised at all — see the
+ * module comment on why the fallback goes to over-matching.
+ */
+exports.MAX_PATCH_ACTION_LINES = 64;
+/** Whether a string opens an apply-patch envelope. */
+function isPatchEnvelope(raw) {
+    return raw.slice(0, PATCH_OPENING_SCAN_LENGTH).trimStart().startsWith(exports.PATCH_ENVELOPE_OPENING);
+}
+/**
+ * The strings a deny pattern is matched against for a patch (Issue #1902).
+ *
+ * The envelope's action headers, verbatim and including the `*** ` prefix, so a
+ * contract can name either the verb or the path. Falls back to the whole
+ * envelope when there is no header to summarise or too many to trust; see the
+ * module comment.
+ *
+ * @param patch - The raw envelope, exactly as the agent sent it
+ * @returns Texts to match, never empty for a non-empty patch
+ */
+function collectPatchMatchTexts(patch) {
+    const actions = [];
+    for (const rawLine of patch.split('\n')) {
+        // Content lines inside a hunk are prefixed (` `, `+`, `-`), so a `*** ` at
+        // column 0 is structural. A CRLF payload leaves the `\r` on the line.
+        const line = rawLine.endsWith('\r') ? rawLine.slice(0, -1) : rawLine;
+        if (!line.startsWith(PATCH_ACTION_PREFIX))
+            continue;
+        const action = line.slice(PATCH_ACTION_PREFIX.length).trim();
+        if (action === '' || PATCH_ENVELOPE_MARKERS.has(action))
+            continue;
+        actions.push(`${PATCH_ACTION_PREFIX}${action}`);
+        if (actions.length > exports.MAX_PATCH_ACTION_LINES)
+            return [patch];
+    }
+    return actions.length > 0 ? actions : [patch];
+}
+/**
+ * Read a `tool_input` field, normalising a string into an object.
+ *
+ * Only copilot calls this today, because copilot is the only tool measured
+ * sending a string (#1902). It lives here rather than in `sources/copilot/`
+ * because the shape is not copilot-specific — the apply-patch envelope is a
+ * format several tools speak — and a second copy is a second place for the
+ * deny-pattern surface to be decided differently.
+ *
+ * @param value - `body.tool_input`, whatever it turned out to be
+ * @returns The readable input, or null when there is nothing to adjudicate —
+ *   which every caller must turn into a no-decision, i.e. a dialog
+ */
+function readPermissionToolInput(value) {
+    if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+        return { toolInput: value, normalization: null };
+    }
+    if (typeof value === 'string') {
+        // An empty string is the string case's version of an absent `tool_input`:
+        // nothing for the deny patterns to be judged against, so the request is
+        // unadjudicatable rather than harmless.
+        if (value === '')
+            return null;
+        const isPatch = isPatchEnvelope(value);
+        const key = isPatch ? exports.PATCH_TOOL_INPUT_KEY : exports.TEXT_TOOL_INPUT_KEY;
+        return {
+            toolInput: { [key]: value },
+            normalization: {
+                reason: isPatch ? 'string-tool-input-as-patch' : 'string-tool-input-as-text',
+                key,
+                receivedType: 'string',
+            },
+        };
+    }
+    return null;
+}

package/dist/server/src/lib/job-executor.js

@@ -18,6 +18,7 @@ exports.resolveModelOption = resolveModelOption;
 exports.executeSchedule = executeSchedule;
 const crypto_1 = require("crypto");
 const claude_executor_1 = require("./session/claude-executor");
+const cmate_cli_tool_parser_1 = require("../lib/cmate-cli-tool-parser");
 const logger_1 = require("../lib/logger");
 const logger = (0, logger_1.createLogger)('job-executor');
 // =============================================================================
@@ -104,16 +105,27 @@ function recoverRunningLogs() {
 // =============================================================================
 /**
  * Resolve the model option for a scheduled execution (DR1-004).
- * Centralizes per-tool model resolution strategy:
- * - copilot: from CMATE.md ScheduleEntry.model
- * - vibe-local: from DB worktree.vibe_local_model
+ *
+ * Two sources, because a model reaches a schedule two different ways:
+ * - **the CMATE.md CLI Tool column** (`<tool> --model <name>`), for every tool in
+ *   {@link TOOLS_WITH_MODEL_SUPPORT};
+ * - **the DB** (`worktree.vibe_local_model`), for vibe-local, whose model is
+ *   chosen in the worktree's Agent settings rather than written in the file.
+ *
+ * Issue #1914: the first branch used to read `entry.cliToolId === 'copilot'`,
+ * a second hard-coded copy of the parser's Set. That is what made
+ * `buildCliArgs()`'s `opencode run -m …` branch unreachable — the parser would
+ * have to start accepting `opencode --model x` *and* somebody would have to
+ * remember this line. Reading the Set means adding an id in one place wires the
+ * whole path, and a tool added to the Set can no longer have its model silently
+ * dropped here.
  *
  * @param entry - Schedule entry from CMATE.md
  * @param worktree - Worktree row from DB
  * @returns ExecuteCommandOptions with model, or undefined
  */
 function resolveModelOption(entry, worktree) {
-    if (entry.cliToolId === 'copilot' && entry.model) {
+    if (entry.model && cmate_cli_tool_parser_1.TOOLS_WITH_MODEL_SUPPORT.has(entry.cliToolId)) {
         return { model: entry.model };
     }
     if (entry.cliToolId === 'vibe-local' && worktree.vibe_local_model) {