commandmate 0.3.2 → 0.3.3

package/dist/server/src/lib/cli-patterns.js

@@ -4,10 +4,11 @@
  * Shared between response-poller.ts and API routes
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CLAUDE_SESSION_ERROR_REGEX_PATTERNS = exports.CLAUDE_SESSION_ERROR_PATTERNS = exports.GEMINI_PROMPT_PATTERN = exports.MAX_PASTED_TEXT_RETRIES = exports.PASTED_TEXT_DETECT_DELAY = exports.PASTED_TEXT_PATTERN = exports.CODEX_SEPARATOR_PATTERN = exports.CODEX_PROMPT_PATTERN = exports.CLAUDE_TRUST_DIALOG_PATTERN = exports.CLAUDE_SEPARATOR_PATTERN = exports.CLAUDE_PROMPT_PATTERN = exports.CODEX_THINKING_PATTERN = exports.CLAUDE_THINKING_PATTERN = exports.CLAUDE_SPINNER_CHARS = void 0;
+exports.CLAUDE_SESSION_ERROR_REGEX_PATTERNS = exports.CLAUDE_SESSION_ERROR_PATTERNS = exports.VIBE_LOCAL_THINKING_PATTERN = exports.VIBE_LOCAL_PROMPT_PATTERN = exports.GEMINI_THINKING_PATTERN = exports.GEMINI_PROMPT_PATTERN = exports.MAX_PASTED_TEXT_RETRIES = exports.PASTED_TEXT_DETECT_DELAY = exports.PASTED_TEXT_PATTERN = exports.CODEX_SEPARATOR_PATTERN = exports.CODEX_PROMPT_PATTERN = exports.CLAUDE_TRUST_DIALOG_PATTERN = exports.CLAUDE_SEPARATOR_PATTERN = exports.CLAUDE_PROMPT_PATTERN = exports.CODEX_THINKING_PATTERN = exports.CLAUDE_THINKING_PATTERN = exports.CLAUDE_SPINNER_CHARS = void 0;
 exports.detectThinking = detectThinking;
 exports.getCliToolPatterns = getCliToolPatterns;
 exports.stripAnsi = stripAnsi;
+exports.stripBoxDrawing = stripBoxDrawing;
 exports.buildDetectPromptOptions = buildDetectPromptOptions;
 const logger_1 = require("./logger");
 const logger = (0, logger_1.createLogger)('cli-patterns');
@@ -113,9 +114,29 @@ exports.PASTED_TEXT_DETECT_DELAY = 500;
  */
 exports.MAX_PASTED_TEXT_RETRIES = 3;
 /**
- * Gemini shell prompt pattern
+ * Gemini interactive REPL prompt pattern
+ * Gemini CLI shows a `>` or `❯` prompt when waiting for user input in interactive mode.
+ * Also matches shell prompts as fallback for session initialization phase.
  */
-exports.GEMINI_PROMPT_PATTERN = /^(%|\$|.*@.*[%$#])\s*$/m;
+exports.GEMINI_PROMPT_PATTERN = /^[>❯]\s*$/m;
+/**
+ * Gemini thinking/processing pattern
+ * Gemini CLI shows braille spinner characters and status text while processing.
+ */
+exports.GEMINI_THINKING_PATTERN = /[\u2800-\u28FF]|Thinking\.\.\./;
+/**
+ * Vibe Local prompt pattern
+ * vibe-local (vibe-coder) shows `ctx:N% ❯` prompt when waiting for user input.
+ * The prompt line includes a context usage percentage prefix.
+ * Examples: "ctx:9% ❯", "ctx:30% ❯", "ctx:9% ❯ /model"
+ */
+exports.VIBE_LOCAL_PROMPT_PATTERN = /ctx:\d+%\s*[>❯]/m;
+/**
+ * Vibe Local thinking/processing pattern
+ * vibe-local shows spinner characters and status text while processing.
+ * Matches braille spinners, "Thinking", and tool execution indicators.
+ */
+exports.VIBE_LOCAL_THINKING_PATTERN = /[\u2800-\u28FF]|Thinking|⠋|⠙|⠹|⠸|⠼|⠴|⠦|⠧|⠇|⠏|Running|Executing/;
 /**
  * Detect if CLI tool is showing "thinking" indicator
  */
@@ -131,8 +152,10 @@ function detectThinking(cliToolId, content) {
             result = exports.CODEX_THINKING_PATTERN.test(content);
             break;
         case 'gemini':
-            // Gemini doesn't have a thinking indicator in one-shot mode
-            result = false;
+            result = exports.GEMINI_THINKING_PATTERN.test(content);
+            break;
+        case 'vibe-local':
+            result = exports.VIBE_LOCAL_THINKING_PATTERN.test(content);
             break;
         default:
             result = exports.CLAUDE_THINKING_PATTERN.test(content);
@@ -186,12 +209,36 @@ function getCliToolPatterns(cliToolId) {
         case 'gemini':
             return {
                 promptPattern: exports.GEMINI_PROMPT_PATTERN,
-                separatorPattern: /^gemini\s+--\s+/m,
-                thinkingPattern: /(?!)/m, // Never matches - one-shot execution
+                separatorPattern: /^[─━]{3,}$/m,
+                thinkingPattern: exports.GEMINI_THINKING_PATTERN,
+                skipPatterns: [
+                    /^[>❯]\s*$/, // Prompt line
+                    exports.GEMINI_THINKING_PATTERN, // Thinking indicators
+                    /^\s*$/, // Empty lines
+                    /Gemini\s+\d+\.\d+/, // Version line
+                    exports.PASTED_TEXT_PATTERN, // [Pasted text #N +XX lines]
+                ],
+            };
+        case 'vibe-local':
+            return {
+                promptPattern: exports.VIBE_LOCAL_PROMPT_PATTERN,
+                separatorPattern: /^[·]{10,}$/m, // vibe-local uses middle dot separators
+                thinkingPattern: exports.VIBE_LOCAL_THINKING_PATTERN,
                 skipPatterns: [
-                    /^gemini\s+--\s+/, // Command line itself
-                    exports.GEMINI_PROMPT_PATTERN, // Shell prompt lines
+                    exports.VIBE_LOCAL_PROMPT_PATTERN, // Prompt line (ctx:N% ❯)
+                    exports.VIBE_LOCAL_THINKING_PATTERN, // Thinking indicators
                     /^\s*$/, // Empty lines
+                    /vibe-local|vibe-coder/, // Version/banner lines
+                    /ctx:\s*\d+%/, // Context usage indicator
+                    /Model\s+\w/, // Model info line
+                    /Engine\s+\w/, // Engine info line
+                    /Mode\s+/, // Mode info line
+                    /RAM\s+/, // RAM info line
+                    /CWD\s+/, // Working directory line
+                    /^[·]{10,}$/, // Middle dot separator lines
+                    /✦\s*Ready/, // Status bar "Ready" indicator
+                    /ESC:\s*stop/, // Status bar "ESC: stop" hint
+                    exports.PASTED_TEXT_PATTERN, // [Pasted text #N +XX lines]
                 ],
             };
         default:
@@ -222,6 +269,23 @@ const ANSI_PATTERN = /\x1b\[[0-9;]*[a-zA-Z]|\x1b\][^\x07]*\x07|\[[0-9;]*m/g;
 function stripAnsi(str) {
     return str.replace(ANSI_PATTERN, '');
 }
+/**
+ * Strip box-drawing border characters from CLI output.
+ * Gemini CLI wraps Action Required prompts in ╭─╮│╰─╯ borders.
+ * Removes │ (U+2502) prefix/suffix and border-only lines (╭╮╰╯─).
+ *
+ * @param str - Input string (typically after stripAnsi())
+ * @returns String with box-drawing borders removed
+ */
+function stripBoxDrawing(str) {
+    return str.split('\n').map(line => {
+        // Remove border-only lines (╭──╮, ╰──╯, │ only, etc.)
+        if (/^[\u2502\u256D\u256E\u256F\u2570\u2500\s]+$/.test(line))
+            return '';
+        // Strip leading │ + optional space, trailing space + │
+        return line.replace(/^\u2502\s?/, '').replace(/\s*\u2502$/, '');
+    }).join('\n');
+}
 /**
  * Build DetectPromptOptions for a given CLI tool.
  * Centralizes cliToolId-to-options mapping logic (DRY - MF-001).

package/dist/server/src/lib/cli-tools/gemini.js

@@ -1,18 +1,33 @@
 "use strict";
 /**
  * Gemini CLI tool implementation
- * Provides integration with Google's Gemini CLI
+ * Provides integration with Google's Gemini CLI in interactive mode
+ *
+ * @remarks Issue #368: Rewritten from non-interactive pipe mode to interactive REPL mode.
+ * Previous implementation used `echo 'msg' | gemini` which caused the process to exit
+ * immediately, making response polling impossible. Now launches `gemini` in interactive
+ * mode within tmux (same approach as Claude/Codex).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GeminiTool = void 0;
 const base_1 = require("./base");
 const tmux_1 = require("../tmux");
-const child_process_1 = require("child_process");
-const util_1 = require("util");
-const execAsync = (0, util_1.promisify)(child_process_1.exec);
+const pasted_text_helper_1 = require("../pasted-text-helper");
+/**
+ * Extract error message from unknown error type (DRY)
+ */
+function getErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Wait for Gemini CLI to initialize after launch (banner + auth + dialog) */
+const GEMINI_INIT_WAIT_MS = 6000;
+/** Interval for polling trust dialog detection */
+const TRUST_DIALOG_POLL_INTERVAL_MS = 1000;
+/** Max attempts to detect trust dialog (10 * 1000ms = 10s polling window) */
+const TRUST_DIALOG_MAX_ATTEMPTS = 10;
 /**
  * Gemini CLI tool implementation
- * Manages Gemini sessions using tmux
+ * Manages Gemini interactive sessions using tmux
  */
 class GeminiTool extends base_1.BaseCLITool {
     id = 'gemini';
@@ -30,8 +45,7 @@ class GeminiTool extends base_1.BaseCLITool {
     }
     /**
      * Start a new Gemini session for a worktree
-     * Note: Gemini uses non-interactive mode, so we just create a tmux session
-     * for running one-shot commands
+     * Launches `gemini` in interactive REPL mode within tmux
      *
      * @param worktreeId - Worktree ID
      * @param worktreePath - Worktree path
@@ -50,22 +64,59 @@ class GeminiTool extends base_1.BaseCLITool {
             return;
         }
         try {
-            // Create tmux session for running Gemini commands
+            // Create tmux session with large history buffer
             await (0, tmux_1.createSession)({
                 sessionName,
                 workingDirectory: worktreePath,
                 historyLimit: 50000,
             });
+            // Wait a moment for the session to be created
+            await new Promise((resolve) => setTimeout(resolve, 100));
+            // Start Gemini CLI in interactive mode (no flags = interactive REPL)
+            await (0, tmux_1.sendKeys)(sessionName, 'gemini', true);
+            // Wait for Gemini to initialize
+            await new Promise((resolve) => setTimeout(resolve, GEMINI_INIT_WAIT_MS));
+            // Auto-handle "Do you trust this folder?" dialog on first run
+            await this.handleTrustDialog(sessionName);
             console.log(`✓ Started Gemini session: ${sessionName}`);
         }
         catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
+            const errorMessage = getErrorMessage(error);
             throw new Error(`Failed to start Gemini session: ${errorMessage}`);
         }
     }
     /**
-     * Send a message to Gemini session (non-interactive mode)
-     * Executes a one-shot Gemini command and captures the output
+     * Handle Gemini "Do you trust this folder?" dialog
+     * On first run in a new directory, Gemini shows a trust confirmation.
+     * Auto-selects "1. Trust folder" to allow execution.
+     */
+    async handleTrustDialog(sessionName) {
+        for (let i = 0; i < TRUST_DIALOG_MAX_ATTEMPTS; i++) {
+            try {
+                const output = await (0, tmux_1.capturePane)(sessionName, 50);
+                if (output.includes('Do you trust this folder?')) {
+                    // Option 1 "Trust folder" is pre-selected (● marker).
+                    // Send Enter to confirm the selection.
+                    await (0, tmux_1.sendSpecialKey)(sessionName, 'Enter');
+                    await new Promise((resolve) => setTimeout(resolve, 2000));
+                    console.log('✓ Auto-trusted folder for Gemini session');
+                    return;
+                }
+                // Check if Gemini interactive prompt is already showing (no dialog needed)
+                if (output.match(/^[>❯]\s*$/m)) {
+                    console.log('✓ Gemini prompt detected - no trust dialog needed');
+                    return;
+                }
+            }
+            catch {
+                // Capture may fail during initialization - continue polling
+            }
+            await new Promise((resolve) => setTimeout(resolve, TRUST_DIALOG_POLL_INTERVAL_MS));
+        }
+        console.log('⚠ Trust dialog detection timed out - proceeding anyway');
+    }
+    /**
+     * Send a message to Gemini interactive session
      *
      * @param worktreeId - Worktree ID
      * @param message - Message to send
@@ -78,15 +129,22 @@ class GeminiTool extends base_1.BaseCLITool {
             throw new Error(`Gemini session ${sessionName} does not exist. Start the session first.`);
         }
         try {
-            // Escape the message for shell execution
-            const escapedMessage = message.replace(/'/g, "'\\''");
-            // Execute Gemini in non-interactive mode using stdin piping
-            // This approach bypasses the TUI and executes in one-shot mode
-            await (0, tmux_1.sendKeys)(sessionName, `echo '${escapedMessage}' | gemini`, true);
+            // Send message to Gemini (without Enter)
+            await (0, tmux_1.sendKeys)(sessionName, message, false);
+            // Wait a moment for the text to be typed
+            await new Promise((resolve) => setTimeout(resolve, 100));
+            // Send Enter key separately
+            await (0, tmux_1.sendSpecialKey)(sessionName, 'C-m');
+            // Wait a moment for the message to be processed
+            await new Promise((resolve) => setTimeout(resolve, 200));
+            // Detect [Pasted text] and resend Enter for multi-line messages
+            if (message.includes('\n')) {
+                await (0, pasted_text_helper_1.detectAndResendIfPastedText)(sessionName);
+            }
             console.log(`✓ Sent message to Gemini session: ${sessionName}`);
         }
         catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
+            const errorMessage = getErrorMessage(error);
             throw new Error(`Failed to send message to Gemini: ${errorMessage}`);
         }
     }
@@ -98,12 +156,13 @@ class GeminiTool extends base_1.BaseCLITool {
     async killSession(worktreeId) {
         const sessionName = this.getSessionName(worktreeId);
         try {
-            // Send Ctrl+D to exit Gemini gracefully
             const exists = await (0, tmux_1.hasSession)(sessionName);
             if (exists) {
-                // Send Ctrl+D (ASCII 4)
-                await execAsync(`tmux send-keys -t "${sessionName}" C-d`);
-                // Wait a moment for Gemini to exit
+                // Send Ctrl+C to interrupt any running operation
+                await (0, tmux_1.sendSpecialKey)(sessionName, 'C-c');
+                await new Promise((resolve) => setTimeout(resolve, 300));
+                // Send /quit to exit Gemini gracefully
+                await (0, tmux_1.sendKeys)(sessionName, '/quit', true);
                 await new Promise((resolve) => setTimeout(resolve, 500));
             }
             // Kill the tmux session
@@ -113,7 +172,7 @@ class GeminiTool extends base_1.BaseCLITool {
             }
         }
         catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
+            const errorMessage = getErrorMessage(error);
             console.error(`Error stopping Gemini session: ${errorMessage}`);
             throw error;
         }

package/dist/server/src/lib/cli-tools/manager.js

@@ -1,17 +1,18 @@
 "use strict";
 /**
  * CLI Tool Manager
- * Singleton class to manage multiple CLI tools (Claude, Codex, Gemini)
+ * Singleton class to manage multiple CLI tools (Claude, Codex, Gemini, Vibe Local)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLIToolManager = void 0;
 const claude_1 = require("./claude");
 const codex_1 = require("./codex");
 const gemini_1 = require("./gemini");
+const vibe_local_1 = require("./vibe-local");
 const response_poller_1 = require("../response-poller");
 /**
  * CLI Tool Manager (Singleton)
- * Provides centralized access to all CLI tools
+ * Provides centralized access to all CLI tools (Issue #368: includes Vibe Local)
  */
 class CLIToolManager {
     static instance;
@@ -25,6 +26,7 @@ class CLIToolManager {
         this.tools.set('claude', new claude_1.ClaudeTool());
         this.tools.set('codex', new codex_1.CodexTool());
         this.tools.set('gemini', new gemini_1.GeminiTool());
+        this.tools.set('vibe-local', new vibe_local_1.VibeLocalTool());
     }
     /**
      * Get singleton instance

package/dist/server/src/lib/cli-tools/types.js

@@ -3,10 +3,72 @@
  * Type definitions and interfaces for CLI tools
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CLI_TOOL_IDS = void 0;
+exports.OLLAMA_MODEL_PATTERN = exports.CLI_TOOL_DISPLAY_NAMES = exports.CLI_TOOL_IDS = void 0;
+exports.isCliToolType = isCliToolType;
+exports.getCliToolDisplayName = getCliToolDisplayName;
+exports.getCliToolDisplayNameSafe = getCliToolDisplayNameSafe;
 /**
  * CLI Tool IDs constant array
  * T2.1: Single source of truth for CLI tool IDs
  * CLIToolType is derived from this constant (DRY principle)
  */
-exports.CLI_TOOL_IDS = ['claude', 'codex', 'gemini'];
+exports.CLI_TOOL_IDS = ['claude', 'codex', 'gemini', 'vibe-local'];
+/**
+ * CLI tool display names for UI rendering
+ * Issue #368: Centralized display name mapping
+ *
+ * Usage: UI display (tab headers, message lists, settings).
+ * For internal logs/debug, use tool.name (BaseCLITool.name) instead.
+ */
+exports.CLI_TOOL_DISPLAY_NAMES = {
+    claude: 'Claude',
+    codex: 'Codex',
+    gemini: 'Gemini',
+    'vibe-local': 'Vibe Local',
+};
+/**
+ * Check if a string is a valid CLIToolType
+ * Issue #368: Type guard for safe casting of untrusted CLI tool ID strings
+ *
+ * @param value - String to check
+ * @returns True if value is a valid CLIToolType
+ */
+function isCliToolType(value) {
+    return exports.CLI_TOOL_IDS.includes(value);
+}
+/**
+ * Get the display name for a CLI tool ID
+ * Issue #368: Centralized display name function for DRY compliance
+ *
+ * @param id - CLI tool type identifier
+ * @returns Human-readable display name
+ */
+function getCliToolDisplayName(id) {
+    return exports.CLI_TOOL_DISPLAY_NAMES[id] ?? id;
+}
+/**
+ * Get the display name for a CLI tool ID string, with fallback for unknown IDs
+ * Issue #368: Safe wrapper for UI components receiving untyped cliToolId strings
+ *
+ * Unlike getCliToolDisplayName(), this accepts optional/untyped strings and
+ * returns a fallback value ('Assistant') for null, undefined, or unknown IDs.
+ *
+ * @param cliToolId - Optional CLI tool ID string (may be untyped)
+ * @param fallback - Fallback display name for missing/unknown IDs (default: 'Assistant')
+ * @returns Human-readable display name or fallback
+ */
+function getCliToolDisplayNameSafe(cliToolId, fallback = 'Assistant') {
+    if (!cliToolId)
+        return fallback;
+    if (isCliToolType(cliToolId))
+        return getCliToolDisplayName(cliToolId);
+    return fallback;
+}
+/**
+ * Ollama model name validation pattern.
+ * Allows: alphanumeric start, followed by alphanumeric, dots, underscores, colons, slashes, hyphens.
+ * Max 100 characters. Used for defense-in-depth validation at point of use.
+ *
+ * [SEC-001] Shared between API route validation and CLI command construction
+ */
+exports.OLLAMA_MODEL_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._:/-]*$/;

package/dist/server/src/lib/cli-tools/vibe-local.js

@@ -0,0 +1,163 @@
+"use strict";
+/**
+ * Vibe Local CLI tool implementation
+ * Provides integration with vibe-local (vibe-coder) in interactive mode
+ *
+ * @remarks Issue #368: Rewritten from non-interactive pipe mode to interactive REPL mode.
+ * Previous implementation used `echo 'msg' | vibe-local` which caused the process to exit
+ * immediately with "(Cancelled)" + "Goodbye!", making response polling impossible.
+ * Now launches `vibe-local -y` in interactive mode within tmux (same approach as Claude/Codex/Gemini).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VibeLocalTool = void 0;
+const base_1 = require("./base");
+const types_1 = require("./types");
+const tmux_1 = require("../tmux");
+const pasted_text_helper_1 = require("../pasted-text-helper");
+const db_instance_1 = require("../db-instance");
+const db_1 = require("../db");
+/**
+ * Extract error message from unknown error type (DRY)
+ */
+function getErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * Wait for vibe-local to initialize after launch.
+ * vibe-local shows a permission check prompt, banner, and model loading.
+ */
+const VIBE_LOCAL_INIT_WAIT_MS = 5000;
+/**
+ * Vibe Local CLI tool implementation
+ * Manages vibe-local interactive sessions using tmux
+ */
+class VibeLocalTool extends base_1.BaseCLITool {
+    id = 'vibe-local';
+    name = 'Vibe Local';
+    command = 'vibe-local';
+    /**
+     * Check if vibe-local session is running for a worktree
+     */
+    async isRunning(worktreeId) {
+        const sessionName = this.getSessionName(worktreeId);
+        return await (0, tmux_1.hasSession)(sessionName);
+    }
+    /**
+     * Start a new vibe-local session for a worktree
+     * Launches `vibe-local -y` in interactive mode within tmux
+     *
+     * @param worktreeId - Worktree ID
+     * @param worktreePath - Worktree path
+     */
+    async startSession(worktreeId, worktreePath) {
+        const vibeLocalAvailable = await this.isInstalled();
+        if (!vibeLocalAvailable) {
+            throw new Error('vibe-local is not installed or not in PATH');
+        }
+        const sessionName = this.getSessionName(worktreeId);
+        const exists = await (0, tmux_1.hasSession)(sessionName);
+        if (exists) {
+            console.log(`Vibe Local session ${sessionName} already exists`);
+            return;
+        }
+        try {
+            // Create tmux session with large history buffer
+            await (0, tmux_1.createSession)({
+                sessionName,
+                workingDirectory: worktreePath,
+                historyLimit: 50000,
+            });
+            // Wait a moment for the session to be created
+            await new Promise((resolve) => setTimeout(resolve, 100));
+            // Read Ollama model preference from DB
+            // [SEC-001] Re-validate model name at point of use (defense-in-depth)
+            let vibeLocalCommand = 'vibe-local -y';
+            try {
+                const db = (0, db_instance_1.getDbInstance)();
+                const wt = (0, db_1.getWorktreeById)(db, worktreeId);
+                if (wt?.vibeLocalModel && types_1.OLLAMA_MODEL_PATTERN.test(wt.vibeLocalModel)) {
+                    vibeLocalCommand = `vibe-local -y -m ${wt.vibeLocalModel}`;
+                }
+            }
+            catch {
+                // DB read failure is non-fatal; use default model
+            }
+            // Start vibe-local in interactive mode with auto-approve (-y)
+            // -y flag skips the permission confirmation prompt
+            await (0, tmux_1.sendKeys)(sessionName, vibeLocalCommand, true);
+            // Wait for vibe-local to initialize (banner + model loading)
+            await new Promise((resolve) => setTimeout(resolve, VIBE_LOCAL_INIT_WAIT_MS));
+            console.log(`✓ Started Vibe Local session: ${sessionName}`);
+        }
+        catch (error) {
+            const errorMessage = getErrorMessage(error);
+            throw new Error(`Failed to start Vibe Local session: ${errorMessage}`);
+        }
+    }
+    /**
+     * Send a message to vibe-local interactive session
+     *
+     * @param worktreeId - Worktree ID
+     * @param message - Message to send
+     */
+    async sendMessage(worktreeId, message) {
+        const sessionName = this.getSessionName(worktreeId);
+        const exists = await (0, tmux_1.hasSession)(sessionName);
+        if (!exists) {
+            throw new Error(`Vibe Local session ${sessionName} does not exist. Start the session first.`);
+        }
+        try {
+            // Send message to vibe-local (without Enter)
+            await (0, tmux_1.sendKeys)(sessionName, message, false);
+            // Wait a moment for the text to be typed
+            await new Promise((resolve) => setTimeout(resolve, 100));
+            // vibe-local uses IME mode: first Enter creates a new line,
+            // second Enter on empty line submits the message.
+            // Send Enter twice with a short delay between.
+            await (0, tmux_1.sendSpecialKey)(sessionName, 'C-m');
+            await new Promise((resolve) => setTimeout(resolve, 200));
+            await (0, tmux_1.sendSpecialKey)(sessionName, 'C-m');
+            // Wait a moment for the message to be processed
+            await new Promise((resolve) => setTimeout(resolve, 200));
+            // Detect [Pasted text] and resend Enter for multi-line messages
+            if (message.includes('\n')) {
+                await (0, pasted_text_helper_1.detectAndResendIfPastedText)(sessionName);
+            }
+            console.log(`✓ Sent message to Vibe Local session: ${sessionName}`);
+        }
+        catch (error) {
+            const errorMessage = getErrorMessage(error);
+            throw new Error(`Failed to send message to Vibe Local: ${errorMessage}`);
+        }
+    }
+    /**
+     * Kill vibe-local session
+     *
+     * @param worktreeId - Worktree ID
+     */
+    async killSession(worktreeId) {
+        const sessionName = this.getSessionName(worktreeId);
+        try {
+            const exists = await (0, tmux_1.hasSession)(sessionName);
+            if (exists) {
+                // Send Ctrl+C to interrupt any running operation
+                await (0, tmux_1.sendSpecialKey)(sessionName, 'C-c');
+                await new Promise((resolve) => setTimeout(resolve, 300));
+                // Send Ctrl+C again to ensure exit
+                await (0, tmux_1.sendSpecialKey)(sessionName, 'C-c');
+                await new Promise((resolve) => setTimeout(resolve, 500));
+            }
+            // Kill the tmux session
+            const killed = await (0, tmux_1.killSession)(sessionName);
+            if (killed) {
+                console.log(`✓ Stopped Vibe Local session: ${sessionName}`);
+            }
+        }
+        catch (error) {
+            const errorMessage = getErrorMessage(error);
+            console.error(`Error stopping Vibe Local session: ${errorMessage}`);
+            throw error;
+        }
+    }
+}
+exports.VibeLocalTool = VibeLocalTool;

package/dist/server/src/lib/cmate-parser.js

@@ -24,6 +24,7 @@ exports.parseSchedulesSection = parseSchedulesSection;
 exports.readCmateFile = readCmateFile;
 const fs_1 = require("fs");
 const path_1 = __importDefault(require("path"));
+const types_1 = require("../lib/cli-tools/types");
 const schedule_config_1 = require("../config/schedule-config");
 const cmate_constants_1 = require("../config/cmate-constants");
 Object.defineProperty(exports, "CMATE_FILENAME", { enumerable: true, get: function () { return cmate_constants_1.CMATE_FILENAME; } });
@@ -193,13 +194,34 @@ function parseSchedulesSection(rows) {
         const enabled = enabledStr === undefined ||
             enabledStr === '' ||
             enabledStr.toLowerCase() === 'true';
-        // Parse permission with validation
+        // Parse and validate CLI tool ID [SEC-002]
         const resolvedCliToolId = cliToolId?.trim() || 'claude';
+        if (!(0, types_1.isCliToolType)(resolvedCliToolId)) {
+            console.warn(`[cmate-parser] Skipping entry "${sanitizedName}" with invalid CLI tool: "${resolvedCliToolId}"`);
+            continue;
+        }
         const defaultPermission = schedule_config_1.DEFAULT_PERMISSIONS[resolvedCliToolId] ?? '';
         let permission = permissionStr?.trim() || defaultPermission;
         // Validate permission against allowed values
-        const allowedValues = resolvedCliToolId === 'codex' ? schedule_config_1.CODEX_SANDBOXES : schedule_config_1.CLAUDE_PERMISSIONS;
-        if (permission && !allowedValues.includes(permission)) {
+        let allowedValues;
+        switch (resolvedCliToolId) {
+            case 'codex':
+                allowedValues = schedule_config_1.CODEX_SANDBOXES;
+                break;
+            case 'gemini':
+            case 'vibe-local':
+                // No permission flags for gemini/vibe-local; only empty string is valid
+                allowedValues = [];
+                if (permission) {
+                    console.warn(`[cmate-parser] Permission "${permission}" ignored for ${resolvedCliToolId} in entry "${sanitizedName}" (no permission flags supported)`);
+                    permission = '';
+                }
+                break;
+            default:
+                allowedValues = schedule_config_1.CLAUDE_PERMISSIONS;
+                break;
+        }
+        if (allowedValues.length > 0 && permission && !allowedValues.includes(permission)) {
             console.warn(`[cmate-parser] Invalid permission "${permission}" for ${resolvedCliToolId} in entry "${sanitizedName}", using default "${defaultPermission}"`);
             permission = defaultPermission;
         }

package/dist/server/src/lib/db-migrations.js

@@ -19,7 +19,7 @@ const db_1 = require("./db");
  * Current schema version
  * Increment this when adding new migrations
  */
-exports.CURRENT_SCHEMA_VERSION = 17;
+exports.CURRENT_SCHEMA_VERSION = 19;
 /**
  * Migration registry
  * All migrations should be added to this array in order
@@ -811,6 +811,55 @@ const migrations = [
             db.exec('DROP TABLE IF EXISTS scheduled_executions');
             console.log('✓ Dropped scheduled_executions and execution_logs tables');
         }
+    },
+    {
+        version: 18,
+        name: 'add-selected-agents-column',
+        up: (db) => {
+            // Issue #368: Add selected_agents column for agent selection persistence
+            // NOTE (R1-010): The literal values 'claude', 'codex' in the SQL CASE below
+            // are fixed at migration time and do NOT sync with TypeScript CLI_TOOL_IDS.
+            // Changes to CLI_TOOL_IDS will not retroactively affect already-migrated data.
+            // Migration tests cover all CLIToolType values to catch sync issues.
+            // Step 1: Add column
+            db.exec(`
+        ALTER TABLE worktrees ADD COLUMN selected_agents TEXT;
+      `);
+            // Step 2: Initialize existing data based on cli_tool_id
+            // - If cli_tool_id is 'claude' or 'codex' -> default ["claude","codex"]
+            // - Otherwise (e.g. 'gemini', 'vibe-local') -> [cli_tool_id, "claude"]
+            db.exec(`
+        UPDATE worktrees SET selected_agents =
+          CASE
+            WHEN cli_tool_id NOT IN ('claude', 'codex')
+            THEN json_array(cli_tool_id, 'claude')
+            ELSE '["claude","codex"]'
+          END;
+      `);
+            console.log('✓ Added selected_agents column to worktrees table');
+            console.log('✓ Initialized selected_agents based on cli_tool_id');
+        },
+        down: () => {
+            // selected_agents is a nullable TEXT column; dropping it requires table recreation
+            // which is disproportionate for a rollback. The column is harmless if unused.
+            console.log('No rollback for selected_agents column (SQLite limitation)');
+        }
+    },
+    {
+        version: 19,
+        name: 'add-vibe-local-model-column',
+        up: (db) => {
+            // Issue #368: Add vibe_local_model column for Ollama model selection
+            // NULL means use the default model (vibe-local decides)
+            db.exec(`
+        ALTER TABLE worktrees ADD COLUMN vibe_local_model TEXT DEFAULT NULL;
+      `);
+            console.log('✓ Added vibe_local_model column to worktrees table');
+        },
+        down: () => {
+            // vibe_local_model is a nullable TEXT column; harmless if unused
+            console.log('No rollback for vibe_local_model column (SQLite limitation)');
+        }
     }
 ];
 /**