commandmate 0.3.2 → 0.3.3

package/.next/types/app/api/ollama/models/route.ts

@@ -0,0 +1,343 @@
+// File: /home/runner/work/CommandMate/CommandMate/src/app/api/ollama/models/route.ts
+import * as entry from '../../../../../../src/app/api/ollama/models/route.js'
+import type { NextRequest } from 'next/server.js'
+
+type TEntry = typeof import('../../../../../../src/app/api/ollama/models/route.js')
+
+// Check that the entry is a valid entry
+checkFields<Diff<{
+  GET?: Function
+  HEAD?: Function
+  OPTIONS?: Function
+  POST?: Function
+  PUT?: Function
+  DELETE?: Function
+  PATCH?: Function
+  config?: {}
+  generateStaticParams?: Function
+  revalidate?: RevalidateRange<TEntry> | false
+  dynamic?: 'auto' | 'force-dynamic' | 'error' | 'force-static'
+  dynamicParams?: boolean
+  fetchCache?: 'auto' | 'force-no-store' | 'only-no-store' | 'default-no-store' | 'default-cache' | 'only-cache' | 'force-cache'
+  preferredRegion?: 'auto' | 'global' | 'home' | string | string[]
+  runtime?: 'nodejs' | 'experimental-edge' | 'edge'
+  maxDuration?: number
+  
+}, TEntry, ''>>()
+
+// Check the prop type of the entry function
+if ('GET' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'GET'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<PageParams>,
+      {
+        __tag__: 'GET'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'GET',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'GET',
+        __return_type__: ReturnType<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('HEAD' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'HEAD'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<PageParams>,
+      {
+        __tag__: 'HEAD'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'HEAD',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'HEAD',
+        __return_type__: ReturnType<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('OPTIONS' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'OPTIONS'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<PageParams>,
+      {
+        __tag__: 'OPTIONS'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'OPTIONS',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'OPTIONS',
+        __return_type__: ReturnType<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('POST' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'POST'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<PageParams>,
+      {
+        __tag__: 'POST'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'POST',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'POST',
+        __return_type__: ReturnType<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('PUT' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'PUT'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<PageParams>,
+      {
+        __tag__: 'PUT'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'PUT',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'PUT',
+        __return_type__: ReturnType<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('DELETE' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'DELETE'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<PageParams>,
+      {
+        __tag__: 'DELETE'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'DELETE',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'DELETE',
+        __return_type__: ReturnType<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('PATCH' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'PATCH'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<PageParams>,
+      {
+        __tag__: 'PATCH'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'PATCH',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'PATCH',
+        __return_type__: ReturnType<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+}
+
+// Check the arguments and return type of the generateStaticParams function
+if ('generateStaticParams' in entry) {
+  checkFields<Diff<{ params: PageParams }, FirstArg<MaybeField<TEntry, 'generateStaticParams'>>, 'generateStaticParams'>>()
+  checkFields<Diff<{ __tag__: 'generateStaticParams', __return_type__: any[] | Promise<any[]> }, { __tag__: 'generateStaticParams', __return_type__: ReturnType<MaybeField<TEntry, 'generateStaticParams'>> }>>()
+}
+
+type PageParams = any
+export interface PageProps {
+  params?: any
+  searchParams?: any
+}
+export interface LayoutProps {
+  children?: React.ReactNode
+
+  params?: any
+}
+
+// =============
+// Utility types
+type RevalidateRange<T> = T extends { revalidate: any } ? NonNegative<T['revalidate']> : never
+
+// If T is unknown or any, it will be an empty {} type. Otherwise, it will be the same as Omit<T, keyof Base>.
+type OmitWithTag<T, K extends keyof any, _M> = Omit<T, K>
+type Diff<Base, T extends Base, Message extends string = ''> = 0 extends (1 & T) ? {} : OmitWithTag<T, keyof Base, Message>
+
+type FirstArg<T extends Function> = T extends (...args: [infer T, any]) => any ? unknown extends T ? any : T : never
+type SecondArg<T extends Function> = T extends (...args: [any, infer T]) => any ? unknown extends T ? any : T : never
+type MaybeField<T, K extends string> = T extends { [k in K]: infer G } ? G extends Function ? G : never : never
+
+type ParamCheck<T> = {
+  __tag__: string
+  __param_position__: string
+  __param_type__: T
+}
+
+function checkFields<_ extends { [k in keyof any]: never }>() {}
+
+// https://github.com/sindresorhus/type-fest
+type Numeric = number | bigint
+type Zero = 0 | 0n
+type Negative<T extends Numeric> = T extends Zero ? never : `${T}` extends `-${string}` ? T : never
+type NonNegative<T extends Numeric> = T extends Zero ? T : Negative<T> extends never ? T : '__invalid_negative_number__'

package/README.md

@@ -1,5 +1,6 @@
 # CommandMate
 
+[![GitHub Stars](https://img.shields.io/github/stars/Kewton/CommandMate?style=social)](https://github.com/Kewton/CommandMate)
 ![npm version](https://img.shields.io/npm/v/commandmate)
 ![npm downloads](https://img.shields.io/npm/dm/commandmate)
 ![license](https://img.shields.io/github/license/Kewton/CommandMate)
@@ -16,12 +17,17 @@
 
 Not a "remote control" — a **mobile dev cockpit**.
 
-AI writes code for you. That was supposed to mean freedom.
-Instead, you're watching a terminal, afraid to walk away.
-Your friends are at dinner. Your kid needs a bath. You just want ten minutes on the couch.
-But close the lid and every session dies. So you sit there — babysitting the machine that was supposed to babysit your code.
+```bash
+npx commandmate
+```
+
+**From install to mobile monitoring in 60 seconds.** macOS / Linux · Node.js v20+ · npm · git · tmux · openssl
 
-CommandMate changes that. Auto Yes keeps the agent moving. Sessions survive in the background. And a Web UI on your phone means you can check in, review diffs, edit instructions, and send screenshots — from anywhere.
+---
+
+AI writes code for you — but you're stuck watching a terminal, afraid to walk away.
+Close the lid and every session dies.
+**CommandMate keeps it alive, and puts the controls on your phone.**
 
 Of course, it works great on desktop too — the two-column layout gives you a full overview of all sessions and worktrees at a glance.
 
@@ -29,83 +35,69 @@ Of course, it works great on desktop too — the two-column layout gives you a f
   <img src="./docs/images/demo-desktop.gif" alt="CommandMate desktop demo" width="600">
 </p>
 
-```bash
-npx commandmate
-```
-
 ---
 
-## The 6 Pillars
+## Key Features
 
-| Pillar | What it does | Why it matters |
-|--------|-------------|----------------|
+| Feature | What it does | Why it matters |
+|---------|-------------|----------------|
 | **Auto Yes Mode** | Agent runs without stopping for confirmations | No babysitting — Claude Code keeps working while you're away |
 | **Git Worktree Sessions** | One session per worktree, parallel execution | Multiple tasks progress simultaneously |
 | **Mobile Web UI** | Full session control from any browser | Monitor and steer from your phone |
 | **File Viewer** | Browse worktree files from the browser | Review code changes without touching your PC |
 | **Markdown Editor** | Edit Markdown files in the browser | Update AI instructions on the go |
 | **Screenshot Instructions** | Attach images to your prompts | Snap a bug → "Fix this" — the agent sees the screenshot |
+| **Token Authentication** | SHA-256 hashed token + HTTPS + rate limiting | Secure remote access — no credentials leaked, brute-force protected |
+| **Scheduled Execution** | Cron-based auto-run via CMATE.md | Daily reviews, nightly tests — Claude Code works on a schedule |
 
 ---
 
-## Quick Start
+## Use Cases
 
-**Prerequisites:** macOS / Linux, Node.js v20+, npm, git, tmux, openssl
-
-```bash
-# Install & start in one command
-npx commandmate
-
-# Or install globally
-npm install -g commandmate
-commandmate init
-commandmate start --daemon
-```
-
-Open http://localhost:3000 in your browser.
-
-See the [CLI Setup Guide](./docs/en/user-guide/cli-setup-guide.md) for details.
+| Scenario | How CommandMate helps |
+|----------|----------------------|
+| **Couch coding** | Start a task on your PC, then monitor and steer from the sofa |
+| **Commute review** | Review AI-generated code changes on the train |
+| **Overnight runs** | Let Claude Code work all night — check progress from bed |
+| **Visual bug fix** | Snap a UI bug on your phone, send it with "Fix this" |
+| **Parallel tasks** | Run multiple worktree sessions, manage them all from one dashboard |
 
 ---
 
 ## Comparison
 
-| Feature | CommandMate | Happy Coder | claude-squad | Omnara |
-|---------|:-----------:|:-----------:|:------------:|:------:|
-| Auto Yes Mode | Yes | No | Yes (TUI only) | No |
-| Git Worktree Management | Yes | No | Yes (TUI only) | No |
-| Mobile Web UI | Yes | Yes | **No** | Yes |
-| File Viewer | Yes | No | No | No |
-| Markdown Editor | Yes | No | No | No |
-| Screenshot Instructions | Yes | No | Not possible | No |
-| Free / OSS | Yes | Free + Paid | Yes | $20/mo |
-| Runs 100% Locally | Yes | Server-routed | Yes | Cloud fallback |
+| Feature | CommandMate | Remote Control (Official) | Happy Coder | claude-squad | Omnara |
+|---------|:-----------:|:------------------------:|:-----------:|:------------:|:------:|
+| Auto Yes Mode | Yes | No | No | Yes (TUI only) | No |
+| Git Worktree Management | Yes | No | No | Yes (TUI only) | No |
+| Parallel Sessions | Yes | **No (1 only)** | Yes | Yes | No |
+| Mobile Web UI | Yes | Yes (claude.ai) | Yes | **No** | Yes |
+| File Viewer | Yes | No | No | No | No |
+| Markdown Editor | Yes | No | No | No | No |
+| Screenshot Instructions | Yes | No | No | Not possible | No |
+| Scheduled Execution | Yes | No | No | No | No |
+| Survives Laptop Close | Yes (daemon) | **No (terminal must stay open)** | Yes | Yes | Yes |
+| Token Authentication | Yes | N/A (Anthropic account) | N/A (app) | No | N/A (cloud) |
+| Free / OSS | Yes | Requires Pro/Max | Free + Paid | Yes | $20/mo |
+| Runs 100% Locally | Yes | Via Anthropic API | Server-routed | Yes | Cloud fallback |
 
 ---
 
-## Workflow
+## Screenshots
 
-```
-1. Start tasks on your PC
-   $ commandmate start --daemon
-   → Claude Code begins working with Auto Yes
+### Desktop
 
-2. Close your laptop and go
+![Desktop view](./docs/images/screenshot-desktop.png)
 
-3. Check in from your phone
-   → Web UI shows all sessions at a glance
+### Mobile
 
-4. Review code changes
-   → File Viewer lets you read diffs on mobile
+| Top Page | Worktree (History) | Worktree (Terminal) |
+|----------|-------------------|-------------------|
+| ![Mobile view](./docs/images/screenshot-mobile.png) | ![Mobile - History](./docs/images/screenshot-worktree-mobile.png) | ![Mobile - Terminal](./docs/images/screenshot-worktree-mobile-terminal.png) |
 
-5. Adjust direction
-   → Edit a Markdown instruction file, or type a new prompt
+### Worktree Detail (Desktop)
 
-6. Snap a bug
-   → Screenshot Instructions: attach a photo and say "Fix this"
-
-7. Claude Code sees the image and starts fixing
-```
+![Desktop - Worktree detail](./docs/images/screenshot-worktree-desktop.png)
 
 ---
 
@@ -115,7 +107,7 @@ Runs **100% locally**. No external server, no cloud relay, no account required.
 
 - Fully open-source ([MIT License](./LICENSE))
 - Local database, local sessions
-- For remote access, use a VPN or authenticated reverse proxy
+- For remote access, use a tunneling service ([Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/), [ngrok](https://ngrok.com/), [Pinggy](https://pinggy.io/)), a VPN, or an authenticated reverse proxy
 
 See the [Security Guide](./docs/security-guide.md) and [Trust & Safety](./docs/en/TRUST_AND_SAFETY.md) for details.
 
@@ -136,6 +128,25 @@ Each Git worktree gets its own tmux session, so multiple tasks run in parallel w
 
 ---
 
+<details>
+<summary><strong>Quick Start (detailed)</strong></summary>
+
+```bash
+# Install & start in one command
+npx commandmate
+
+# Or install globally
+npm install -g commandmate
+commandmate init
+commandmate start --daemon
+```
+
+Open http://localhost:3000 in your browser.
+
+See the [CLI Setup Guide](./docs/en/user-guide/cli-setup-guide.md) for details.
+
+</details>
+
 <details>
 <summary><strong>CLI Commands</strong></summary>
 
@@ -196,25 +207,6 @@ See `commandmate --help` for all options.
 
 </details>
 
-<details>
-<summary><strong>Screenshots</strong></summary>
-
-### Desktop
-
-![Desktop view](./docs/images/screenshot-desktop.png)
-
-### Worktree Detail View (Message / Console / History)
-
-| Desktop | Mobile (History) | Mobile (Terminal) |
-|---------|-----------------|-------------------|
-| ![Desktop - Worktree detail](./docs/images/screenshot-worktree-desktop.png) | ![Mobile - History](./docs/images/screenshot-worktree-mobile.png) | ![Mobile - Terminal](./docs/images/screenshot-worktree-mobile-terminal.png) |
-
-### Top Page (Mobile)
-
-![Mobile view](./docs/images/screenshot-mobile.png)
-
-</details>
-
 <details>
 <summary><strong>Troubleshooting & FAQ</strong></summary>
 
@@ -258,7 +250,13 @@ Claude Code sets `CLAUDECODE=1` to prevent nesting. CommandMate removes this aut
 A: CommandMate runs a web server on your PC. To access it from your phone, your phone and PC must be on the same network (Wi-Fi). Run `commandmate init` and enable external access — this sets `CM_BIND=0.0.0.0`. Then open `http://<your-PC-IP>:3000` in your phone's browser.
 
 **Q: Can I access it from outside my home network?**
-A: Yes. Use a tunneling service like [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) to securely expose your local server without opening router ports. Alternatively, a VPN or an authenticated reverse proxy (Basic Auth, OIDC, etc.) also works. **Do not** expose the server directly to the internet without authentication.
+A: Yes. Use a tunneling service to securely expose your local server without opening router ports:
+
+- [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) — free, requires Cloudflare account
+- [ngrok](https://ngrok.com/) — free tier available, easy setup
+- [Pinggy](https://pinggy.io/) — no sign-up required, simple SSH-based tunnel
+
+Alternatively, a VPN or an authenticated reverse proxy (Basic Auth, OIDC, etc.) also works. **Do not** expose the server directly to the internet without authentication.
 
 **Q: Does it work on iPhone / Android?**
 A: Yes. CommandMate's Web UI is responsive and works on any modern mobile browser (Safari, Chrome, etc.). No app install required.

package/dist/server/src/config/schedule-config.js

@@ -10,7 +10,7 @@
  * [S4-014] UUID v4 format validation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UUID_V4_PATTERN = exports.DEFAULT_PERMISSIONS = exports.CODEX_SANDBOXES = exports.CLAUDE_PERMISSIONS = exports.MAX_SCHEDULE_CRON_LENGTH = exports.MAX_SCHEDULE_MESSAGE_LENGTH = exports.MAX_SCHEDULE_NAME_LENGTH = void 0;
+exports.UUID_V4_PATTERN = exports.DEFAULT_PERMISSIONS = exports.VIBE_LOCAL_PERMISSIONS = exports.GEMINI_PERMISSIONS = exports.CODEX_SANDBOXES = exports.CLAUDE_PERMISSIONS = exports.MAX_SCHEDULE_CRON_LENGTH = exports.MAX_SCHEDULE_MESSAGE_LENGTH = exports.MAX_SCHEDULE_NAME_LENGTH = void 0;
 exports.isValidUuidV4 = isValidUuidV4;
 // =============================================================================
 // Validation Constants
@@ -28,10 +28,16 @@ exports.MAX_SCHEDULE_CRON_LENGTH = 100;
 exports.CLAUDE_PERMISSIONS = ['default', 'acceptEdits', 'plan', 'dontAsk', 'bypassPermissions'];
 /** Allowed sandbox values for codex CLI (--sandbox) */
 exports.CODEX_SANDBOXES = ['read-only', 'workspace-write', 'danger-full-access'];
+/** Allowed permission values for gemini CLI (no permission flags) */
+exports.GEMINI_PERMISSIONS = [];
+/** Allowed permission values for vibe-local CLI (no permission flags) */
+exports.VIBE_LOCAL_PERMISSIONS = [];
 /** Default permission per CLI tool */
 exports.DEFAULT_PERMISSIONS = {
     claude: 'acceptEdits',
     codex: 'workspace-write',
+    gemini: '',
+    'vibe-local': '',
 };
 // =============================================================================
 // UUID Validation

package/dist/server/src/lib/auto-yes-manager.js

@@ -403,7 +403,7 @@ async function captureAndCleanOutput(worktreeId, cliToolId) {
     // captureSessionOutput() default is 1000 lines, but tmux buffer capture
     // requires 5000 to avoid truncating long outputs.
     const output = await (0, cli_session_1.captureSessionOutput)(worktreeId, cliToolId, 5000);
-    return (0, cli_patterns_1.stripAnsi)(output);
+    return (0, cli_patterns_1.stripBoxDrawing)((0, cli_patterns_1.stripAnsi)(output));
 }
 /**
  * Process stop condition check using delta-based approach.
@@ -465,7 +465,7 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
     try {
         // 1. Detect prompt
         const promptOptions = (0, cli_patterns_1.buildDetectPromptOptions)(cliToolId);
-        const promptDetection = (0, prompt_detector_1.detectPrompt)(cleanOutput, promptOptions);
+        const promptDetection = (0, prompt_detector_1.detectPrompt)((0, cli_patterns_1.stripBoxDrawing)(cleanOutput), promptOptions);
         if (!promptDetection.isPrompt || !promptDetection.promptData) {
             // No prompt detected - reset lastAnsweredPromptKey (Issue #306)
             pollerState.lastAnsweredPromptKey = null;

package/dist/server/src/lib/claude-executor.js

@@ -30,7 +30,7 @@ exports.EXECUTION_TIMEOUT_MS = 5 * 60 * 1000;
 /** Maximum message length sent to claude -p */
 exports.MAX_MESSAGE_LENGTH = 10000;
 /** Allowed CLI tool identifiers for scheduled execution */
-exports.ALLOWED_CLI_TOOLS = new Set(['claude', 'codex']);
+exports.ALLOWED_CLI_TOOLS = new Set(['claude', 'codex', 'gemini', 'vibe-local']);
 // =============================================================================
 // Executor
 // =============================================================================
@@ -55,17 +55,27 @@ function truncateOutput(output) {
  *
  * - claude: -p <message> --output-format text --permission-mode <permission>
  * - codex: exec <message> --sandbox <permission>
+ * - gemini: -p <message>
+ * - vibe-local: [-p <message> -y] or [--model <model> -p <message> -y]
  * - others: -p <message> (fallback)
  *
  * @param message - Prompt message
  * @param cliToolId - CLI tool identifier
  * @param permission - Permission mode (claude: --permission-mode, codex: --sandbox)
+ * @param options - Additional options (e.g., model for vibe-local)
  * @returns Array of CLI arguments
  */
-function buildCliArgs(message, cliToolId, permission) {
+function buildCliArgs(message, cliToolId, permission, options) {
     switch (cliToolId) {
         case 'codex':
             return ['exec', message, '--sandbox', permission ?? 'workspace-write'];
+        case 'gemini':
+            return ['-p', message];
+        case 'vibe-local':
+            if (options?.model) {
+                return ['--model', options.model, '-p', message, '-y'];
+            }
+            return ['-p', message, '-y'];
         case 'claude':
         default:
             return ['-p', message, '--output-format', 'text', '--permission-mode', permission ?? 'acceptEdits'];
@@ -78,9 +88,10 @@ function buildCliArgs(message, cliToolId, permission) {
  * @param cwd - Working directory (worktree path from DB)
  * @param cliToolId - CLI tool to use (default: 'claude')
  * @param permission - Permission mode (claude: --permission-mode, codex: --sandbox)
+ * @param options - Additional options (e.g., model for vibe-local)
  * @returns Execution result with output and status
  */
-async function executeClaudeCommand(message, cwd, cliToolId = 'claude', permission) {
+async function executeClaudeCommand(message, cwd, cliToolId = 'claude', permission, options) {
     // Validate cliToolId against whitelist [SEC-001]
     if (!exports.ALLOWED_CLI_TOOLS.has(cliToolId)) {
         return {
@@ -94,7 +105,7 @@ async function executeClaudeCommand(message, cwd, cliToolId = 'claude', permissi
     const truncatedMessage = message.length > exports.MAX_MESSAGE_LENGTH
         ? message.substring(0, exports.MAX_MESSAGE_LENGTH)
         : message;
-    const args = buildCliArgs(truncatedMessage, cliToolId, permission);
+    const args = buildCliArgs(truncatedMessage, cliToolId, permission, options);
     return new Promise((resolve) => {
         const child = (0, child_process_1.execFile)(cliToolId, args, {
             cwd,