dorfl 0.10.1 → 0.11.1

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,OAAO,EAAS,MAAM,WAAW,CAAC;AAmH1C,OAAO,EAAiB,KAAK,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAwCvE,OAAO,EAAgB,KAAK,mBAAmB,EAAC,MAAM,qBAAqB,CAAC;AA+xB5E;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,OAAO,GACb,MAAM,CAoCR;AA6RD,wBAAgB,YAAY,IAAI,OAAO,CA47GtC;AAaD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACpC,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,OAAO,GACZ,MAAM,CAyBR;AA+FD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBzE"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,OAAO,EAAS,MAAM,WAAW,CAAC;AAyH1C,OAAO,EAAiB,KAAK,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAwCvE,OAAO,EAAgB,KAAK,mBAAmB,EAAC,MAAM,qBAAqB,CAAC;AA8yB5E;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,OAAO,GACb,MAAM,CAoCR;AA6RD,wBAAgB,YAAY,IAAI,OAAO,CAiiHtC;AAaD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACpC,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,OAAO,GACZ,MAAM,CAyBR;AA+FD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,MAAM,CAAC,IAAI,GAAE,MAAM,EAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBzE"}

package/dist/cli.js

@@ -35,7 +35,7 @@ import { shouldUseColor } from './output.js';
 import { resolveRepoConfig, resolveRepoConfigFromLoaded, loadRepoConfigFromContent, REPO_CONFIG_FILENAME, } from './repo-config.js';
 import { ensureMirrorMain, readRepoConfigFromMirrorMain, encodeRepoKey, } from './repo-mirror.js';
 import { identityEnv } from './identity.js';
-import { harnessFlagOverrides, doFlagOverrides, doNeedsAgentCmd, NO_AGENT_CMD_MESSAGE, reviewFlagOverrides, freshWorktreeGateFlagOverrides, mergeRetriesFlagOverrides, noPRFlagOverrides, } from './do-config.js';
+import { harnessFlagOverrides, doFlagOverrides, doNeedsAgentCmd, NO_AGENT_CMD_MESSAGE, reviewFlagOverrides, freshWorktreeGateFlagOverrides, mergeRetriesFlagOverrides, noPRFlagOverrides, triageModelFlagOverrides, } from './do-config.js';
 import { harnessReviewGate, harnessTaskAcceptanceGate } from './review-gate.js';
 import { harnessSurfaceGate } from './surface-gate.js';
 import { harnessTriageGate } from './triage-gate.js';
@@ -43,8 +43,8 @@ import { harnessApplyDecider } from './apply-decide.js';
 import { harnessTaskReviewGate } from './tasker-review-loop.js';
 import { runVerify } from './verify.js';
 import { renderPrompt } from './prompt.js';
-import { resolvePromptGuidance } from './config.js';
-import { gc, RETAIN_REASON_TEXT } from './gc.js';
+import { resolvePromptGuidance, applyModelFallbacks } from './config.js';
+import { gc, resolveArbiterKeyFromCwd, enumerateWorkspaceArbiters, RETAIN_REASON_TEXT, } from './gc.js';
 import { runPrdToSpec, } from './prd-to-spec.js';
 import { resyncProtocol } from './resync-protocol.js';
 import { sweepRemoteMergedBranches } from './reap-branches.js';
@@ -107,7 +107,9 @@ function flagOverrides(flags, command) {
  * `resolveRepoConfig` instead.
  */
 function resolveGlobalConfig(fileConfig, flags) {
-    return mergeConfig({ ...fileConfig, ...envOverrides(), ...flags });
+    const config = mergeConfig({ ...fileConfig, ...envOverrides(), ...flags });
+    applyModelFallbacks(config);
+    return config;
 }
 /**
  * Load BOTH the global config file AND the per-machine `config.override.json`
@@ -274,7 +276,7 @@ function buildRegistrySetAdvanceTick(options) {
                 noPR: config.noPR,
                 harness,
                 agentCmd: config.agentCmd,
-                model: config.model,
+                model: config.buildModel,
                 sessionsDir: config.sessionsDir,
                 review: config.review,
                 reviewModel: config.reviewModel,
@@ -299,12 +301,12 @@ function buildRegistrySetAdvanceTick(options) {
                 arbiter: arbiter ?? config.defaultArbiter,
                 doOptions,
                 surfaceGate: harnessSurfaceGate({ harness, agentCmd: config.agentCmd }),
-                surfaceModel: config.model,
+                surfaceModel: config.triageModel,
                 applyDecide: harnessApplyDecider({ harness, agentCmd: config.agentCmd }),
-                applyModel: config.model,
+                applyModel: config.triageModel,
                 observationTriage: config.observationTriage,
                 triageGate: harnessTriageGate({ harness, agentCmd: config.agentCmd }),
-                triageModel: config.model,
+                triageModel: config.triageModel,
                 // The ANSWERED-MERGE LAND DISPATCH context (task
                 // `apply-rung-merge-disposition`, spec `land-time-reverify-and-parallel-
                 // merge-ceiling`): the dispatcher cuts a per-job worktree via
@@ -396,6 +398,8 @@ function runFlagOverrides(flags, command) {
     // flag > env > per-repo > global > default — mirroring the `do` command (the
     // fleet inherits the review gate via the converged `performIntegration` core).
     Object.assign(overrides, reviewFlagOverrides(flags));
+    // `--triage-model` (the advance lifecycle gates' model) rides the SAME chain.
+    Object.assign(overrides, triageModelFlagOverrides(flags));
     // `--fresh-worktree-gate`/`--no-fresh-worktree-gate` rides the SAME chain: gate
     // the REBASED tip in a clean throwaway worktree (ON by default). The `run` fleet
     // caller additionally downgrades it to today's gate at `perRepoMax > 1` (the
@@ -872,6 +876,7 @@ export function buildProgram() {
         .option('--no-pr', 'propose without opening a PR: push the branch but deliberately skip the review request, even on an authed GitHub arbiter (the explicit suppress-PR intent). Resolved flag > env > per-repo > global > default off.')
         .option('--agent-cmd <cmd>', 'command to run one agent on a task prompt')
         .option('--model <id>', 'model the agent runs on (routing intent; auth/keys stay the harness\u2019s job). pi: passed as --model; null/shell: substitutes a {model} placeholder in agentCmd. Resolved flag > env > per-repo > global > default (unset).')
+        .option('--build-model <id>', 'model the BUILD agent runs on (the builder-specific override of --model). Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).')
         .option('--harness <adapter>', 'harness adapter that launches the agent + reports liveness: null (default, shells out to agentCmd) or pi (the pi CLI)')
         .option('--pi-bin <path>', 'pi CLI binary the pi harness invokes (default: pi on PATH)')
         .option('--sessions-dir <dir>', 'HOST-ONLY root folder under which pi session files are generated (--session <dir>/<id>.jsonl). Default: pi per-cwd folder under ~/.pi/agent/sessions. Resolved flag > env > global > default (no per-repo).')
@@ -879,6 +884,7 @@ export function buildProgram() {
         .option('--review', 'run Gate 2 (PR/code review) after verify, before the done-move, on every item (overrides config). Resolved flag > env > per-repo > global > default off.')
         .option('--no-review', 'do NOT run Gate 2 this tick (overrides config)')
         .option('--review-model <id>', 'model the Gate-2 review agent runs on (de-correlated from the builder; routing intent). Resolved flag > env > per-repo > global > default.')
+        .option('--triage-model <id>', 'model the advance lifecycle gates (surface, apply, triage) run on. Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).')
         .option('--review-max-rounds <n>', 'bound the revise/review loop; on exhaustion force needs-attention (default 2)')
         .option('--fresh-worktree-gate', 'run the acceptance gate (prepare then verify) against the REBASED tip in a CLEAN throwaway worktree (the tree that integrates). ON by default; the `run` fleet uses it only when same-repo concurrency is off (perRepoMax=1), else today\u2019s in-build-worktree gate.')
         .option('--no-fresh-worktree-gate', 'run the acceptance gate in the build worktree (the pre-rebase tree) — the opt-out for when the per-gate install cost is too high')
@@ -1420,6 +1426,7 @@ export function buildProgram() {
         .option('--allow-backlog', 'do task:<slug> ONLY: also FIND, CLAIM, and COMPLETE a task that lives in tasks/backlog/ (staging), driving it in place WITHOUT promoting it to the pool (so no advance leg / run daemon can claim it out from under you). The done-move goes tasks/backlog/ -> tasks/done/ directly (your explicit drive IS the promotion). EXPLICIT-INVOCATION-ONLY: default off, never set by run/auto-pick/advance or config/env.')
         .option('--agent-cmd <cmd>', 'command to run the agent on the task prompt')
         .option('--model <id>', 'model the agent runs on (routing intent; resolved flag > env > per-repo > global > default)')
+        .option('--build-model <id>', 'model the BUILD agent runs on (the builder-specific override of --model). Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).')
         .option('--harness <adapter>', 'harness adapter that launches the agent: null (default, shells out to agentCmd) or pi (the pi CLI)')
         .option('--pi-bin <path>', 'pi CLI binary the pi harness invokes (default: pi on PATH)')
         .option('--sessions-dir <dir>', 'HOST-ONLY root folder under which the pi session file is generated (--session <dir>/<id>.jsonl). Default: pi per-cwd folder under ~/.pi/agent/sessions. Resolved flag > env > global > default (no per-repo).')
@@ -1427,6 +1434,7 @@ export function buildProgram() {
         .option('--review', 'run Gate 2 (PR/code review) after verify, before the done-move (overrides config). Resolved flag > env > per-repo > global > default off.')
         .option('--no-review', 'do NOT run Gate 2 this invocation (overrides config)')
         .option('--review-model <id>', 'model the Gate-2 review agent runs on (de-correlated from the builder; routing intent). Resolved flag > env > per-repo > global > default.')
+        .option('--triage-model <id>', 'model the advance lifecycle gates (surface, apply, triage) run on. Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).')
         .option('--review-max-rounds <n>', 'bound the revise/review loop; on exhaustion force needs-attention (default 2)')
         .option('--tasker-loop', 'run the tasker IMPROVER loop on `do spec:<slug>` (review→edit→converge over the produced task set). ON by default; --no-tasker-loop skips it. DISTINCT from the acceptance gate (--review).')
         .option('--no-tasker-loop', 'skip the tasker improver loop on `do spec:<slug>`')
@@ -1649,7 +1657,7 @@ export function buildProgram() {
                 noPR: remoteConfig.noPR,
                 harness: remoteHarness,
                 agentCmd: remoteConfig.agentCmd,
-                model: remoteConfig.model,
+                model: remoteConfig.buildModel,
                 sessionsDir: remoteConfig.sessionsDir,
                 review: remoteConfig.review,
                 reviewModel: remoteConfig.reviewModel,
@@ -1820,7 +1828,7 @@ export function buildProgram() {
             noPR: config.noPR,
             harness,
             agentCmd: config.agentCmd,
-            model: config.model,
+            model: config.buildModel,
             // The HOST-ONLY sessions root (resolved Config → DoOptions bridge, like
             // model/agentCmd): the path generator turns it into
             // `<sessionsDir>/<id>.jsonl` for `--session`. Without this map the key
@@ -2082,7 +2090,7 @@ export function buildProgram() {
                 noPR: remoteConfig.noPR,
                 harness: isoHarness,
                 agentCmd: remoteConfig.agentCmd,
-                model: remoteConfig.model,
+                model: remoteConfig.buildModel,
                 sessionsDir: remoteConfig.sessionsDir,
                 review: remoteConfig.review,
                 reviewModel: remoteConfig.reviewModel,
@@ -2122,18 +2130,18 @@ export function buildProgram() {
                     harness: isoHarness,
                     agentCmd: remoteConfig.agentCmd,
                 }),
-                surfaceModel: remoteConfig.model,
+                surfaceModel: remoteConfig.triageModel,
                 applyDecide: harnessApplyDecider({
                     harness: isoHarness,
                     agentCmd: remoteConfig.agentCmd,
                 }),
-                applyModel: remoteConfig.model,
+                applyModel: remoteConfig.triageModel,
                 observationTriage: remoteConfig.observationTriage,
                 triageGate: harnessTriageGate({
                     harness: isoHarness,
                     agentCmd: remoteConfig.agentCmd,
                 }),
-                triageModel: remoteConfig.model,
+                triageModel: remoteConfig.triageModel,
                 note: (message) => console.error(`>> ${message}`),
                 env: process.env,
             };
@@ -2222,7 +2230,7 @@ export function buildProgram() {
             noPR: config.noPR,
             harness,
             agentCmd: config.agentCmd,
-            model: config.model,
+            model: config.buildModel,
             sessionsDir: config.sessionsDir,
             review: config.review,
             reviewModel: config.reviewModel,
@@ -2258,12 +2266,12 @@ export function buildProgram() {
             arbiter: flags.arbiter ?? config.defaultArbiter,
             doOptions,
             surfaceGate: harnessSurfaceGate({ harness, agentCmd: config.agentCmd }),
-            surfaceModel: config.model,
+            surfaceModel: config.triageModel,
             applyDecide: harnessApplyDecider({ harness, agentCmd: config.agentCmd }),
-            applyModel: config.model,
+            applyModel: config.triageModel,
             observationTriage: config.observationTriage,
             triageGate: harnessTriageGate({ harness, agentCmd: config.agentCmd }),
-            triageModel: config.model,
+            triageModel: config.triageModel,
             note: (message) => console.error(`>> ${message}`),
         };
         // `--watch` tails ONE pi session, so it only fits the single-named-item form
@@ -2332,7 +2340,7 @@ export function buildProgram() {
     program
         .command('gc')
         .helpGroup(ADVANCED_GROUP)
-        .description('Re-apply the provably-safe deletion predicate (ADR \u00a74) across every job worktree under workspacesDir/work/*: reap the provably-safe ones (clean tree AND branch tip reachable on the arbiter \u2014 merged or pushed) via git worktree remove (+ prune, never rm -rf), and report each RETAINED one with a reason. The catch-up for when end-of-job auto-reap did not run (runner crash/kill). --force overrides the predicate (discards un-saved work) \u2014 loud, never default.')
+        .description('Re-apply the provably-safe deletion predicate (ADR \u00a74) to job worktrees under workspacesDir/work/*: reap the provably-safe ones (clean tree AND branch tip reachable on the arbiter \u2014 merged or pushed) via git worktree remove (+ prune, never rm -rf), and report each RETAINED one with a reason. The catch-up for when end-of-job auto-reap did not run (runner crash/kill). SCOPE: by DEFAULT this is ARBITER-SCOPED \u2014 it acts ONLY on worktrees belonging to the arbiter resolved from the cwd (the same arbiter do --isolated/the mirror uses), so a gc in repo A can never reap repo B\u2019s worktrees. Pass --all-arbiters to sweep across EVERY arbiter (loud + global), or --arbiter <remote-or-url> to target a specific one. --force overrides the predicate (discards un-saved work) and requires --yes \u2014 loud, never default; --all-arbiters --force must be opted into explicitly, never reached by default.')
         .option('-c, --config <path>', 'config file path', defaultConfigPath())
         .option('--workspace <dir>', 'execution working area to sweep (default: workspacesDir / ~/.dorfl)')
         .option('--force', 'OVERRIDE the predicate: remove worktrees even with un-saved work (requires --yes; never the default)')
@@ -2340,7 +2348,8 @@ export function buildProgram() {
         .option('--ledger [repoPath]', 'SWEEP the work/ lifecycle LEDGER instead of job worktrees: REPORT (never delete) every slug present in more than one work/ status folder (the one-slug-one-folder belt-and-suspenders), with its folders + candidate canonical folder, for a HUMAN to resolve. Defaults to the cwd repo.')
         .option('--reap-stale-locks', '(with --ledger) OPT-IN: also CLEAR every ORPHAN lock the report finds via the SAME leased delete `release-lock` uses, so one command sweeps all orphaned locks instead of N hand-run release-locks. Reaps the `cleared-stale` class: a held `active` lock that is EITHER terminal on `<arbiter>/main` (stranded between the durable move and the release) OR non-terminal + SURFACED (`needsAnswers:true` + sidecar on `<arbiter>/main`) = the crash-window orphan the ordered bounce transition leaves when step 1 lands but step 2 never runs. A `kept-in-flight` (active + non-terminal + NOT surfaced — a healthy build) is NEVER reaped, even with this flag. A concurrent change to a lock ref makes its leased delete REJECT (reported), never --force. WITHOUT this flag `gc --ledger` stays report-only (fail-loud, deletes nothing).')
         .option('--remote-branches', 'SWEEP the arbiter’s remote work/* BRANCHES instead of job worktrees: delete (via git push --delete, NEVER --force) exactly those PROVABLY MERGED into <arbiter>/main (git merge-base --is-ancestor, the SAME predicate the worktree reaper uses), and RETAIN the rest with a reason. An in-flight/un-merged branch (the recovery point) is NEVER touched. Provider-agnostic plain git — works on a --bare arbiter. The merged-only complement of `requeue --reset`.')
-        .option('--arbiter <remote>', '(with --remote-branches) the arbiter git remote whose work/* branches to sweep (default: origin); resolved from --cwd')
+        .option('--arbiter <remote-or-url>', 'SCOPE the worktree sweep to a SPECIFIC arbiter (a remote NAME resolved from --cwd, or a direct arbiter URL) instead of the cwd\u2019s. (With --remote-branches / --ledger it names the arbiter git remote whose work/* branches / locks to sweep; default there: origin.)')
+        .option('--all-arbiters', 'GLOBAL, LOUD override: sweep worktrees across EVERY arbiter under workspacesDir/work/* (today\u2019s pre-scoping behaviour), not just the cwd\u2019s. Prints a banner naming every arbiter it will act on before doing anything; combining it with --force still requires --yes. This is the destructive cross-repo path \u2014 opt into it explicitly.')
         .option('--cwd <dir>', '(with --remote-branches) the local repo/clone whose --arbiter remote points at the arbiter to sweep (default: cwd); only remote refs are read + deleted, never the working tree')
         .option('--dry-run', '(with --remote-branches) REPORT which merged branches WOULD be reaped without deleting anything (a read-only preview)')
         .option('--json', 'output the raw result as JSON')
@@ -2511,6 +2520,68 @@ export function buildProgram() {
             console.log(`Summary: ${reapedCount} ${verb}, ${sweep.retained.length} retained.`);
             return;
         }
+        // SCOPE RESOLUTION (this task): the worktree reaper is ARBITER-SCOPED by
+        // default. `--all-arbiters` restores the GLOBAL (cross-arbiter) sweep behind
+        // a LOUD banner; `--arbiter <remote-or-url>` targets a specific arbiter; the
+        // bare default resolves the arbiter from the cwd (the SAME resolution
+        // `do --isolated` / the mirror uses). With NO resolvable cwd arbiter and
+        // neither flag, we REFUSE (never silently fall back to global) — gc used to
+        // default to global, and a global `gc --force --yes` from repo A could
+        // irreversibly discard repo B's un-pushed work.
+        let arbiterKey;
+        if (flags.allArbiters !== true) {
+            if (flags.arbiter !== undefined && flags.arbiter.trim() !== '') {
+                // An explicit arbiter: a direct URL (contains `://`, a scp-like `:`,
+                // or an absolute path) is keyed directly; otherwise it is a remote NAME
+                // resolved from the cwd (default `origin`).
+                const spec = flags.arbiter.trim();
+                const looksLikeUrl = spec.includes('://') ||
+                    spec.startsWith('/') ||
+                    /^[^/]+@/.test(spec);
+                // A remote NAME resolves from --cwd if given (consistent with the
+                // other gc sub-modes), else the process cwd.
+                const resolveFrom = flags.cwd ?? process.cwd();
+                arbiterKey = looksLikeUrl
+                    ? encodeRepoKey(spec)
+                    : resolveArbiterKeyFromCwd(resolveFrom, spec, process.env);
+                if (arbiterKey === undefined) {
+                    console.error(`refusing: could not resolve arbiter '${spec}' \u2014 not a URL and ` +
+                        'no git remote with that name in the cwd. Pass a remote name that ' +
+                        'exists here, an arbiter URL, or --all-arbiters.');
+                    process.exit(1);
+                }
+            }
+            else {
+                arbiterKey = resolveArbiterKeyFromCwd(flags.cwd ?? process.cwd(), config.defaultArbiter, process.env);
+                if (arbiterKey === undefined) {
+                    console.error('refusing: `gc` is now ARBITER-SCOPED and could not resolve an ' +
+                        `arbiter from the current directory (no '${config.defaultArbiter}' ` +
+                        'git remote, or not inside a repo). It will NOT fall back to a ' +
+                        'global cross-arbiter sweep. Run it from a repo with an arbiter ' +
+                        'remote, pass --arbiter <remote-or-url>, or --all-arbiters to sweep ' +
+                        'every arbiter.');
+                    process.exit(1);
+                }
+            }
+        }
+        else {
+            // GLOBAL sweep: LOUD banner naming EVERY arbiter it will act on before
+            // doing anything (this task's "loud" requirement). Global + --force must be
+            // opted into explicitly (the --yes gate below still applies), never reached
+            // by default.
+            const arbiters = enumerateWorkspaceArbiters(workspacesDir, process.env);
+            console.error('>> --all-arbiters: operating GLOBALLY across ALL arbiters under ' +
+                `${workspacesDir}/work/* (NOT scoped to the current repo).`);
+            if (arbiters.length > 0) {
+                console.error('>> arbiters in scope:');
+                for (const a of arbiters) {
+                    console.error(`>>   - ${a.url ?? a.key ?? '(malformed mirror)'}`);
+                }
+            }
+            else {
+                console.error('>> (no worktrees found under any arbiter)');
+            }
+        }
         // `--force` discards un-saved work, so it is gated behind an explicit
         // confirmation (`--yes`) — loud + intentional, NEVER the default (ADR §4).
         if (flags.force && !flags.yes) {
@@ -2525,6 +2596,7 @@ export function buildProgram() {
         }
         const result = gc({
             workspacesDir,
+            arbiterKey,
             force: flags.force === true,
             note: (message) => console.error(`>> ${message}`),
         });
@@ -3012,6 +3084,7 @@ export function buildProgram() {
         .option('--tasks-land-in <where>', 'where an intake-authored TASK (emitted DIRECTLY from an issue) lands: `backlog` (staged, not agent-eligible) or `ready` (the agent POOL). The task twin of --specs-land-in: the EXPLICIT operator override at the top of the placement precedence (explicit flag > configured default > built-in staging; the caller selects the trusted-vs-untrusted default from the origin-trust stamp). Resolved flag > env (DORFL_TASKS_LAND_IN) > per-repo > global > built-in.')
         .option('--agent-cmd <cmd>', 'command to run the decision agent')
         .option('--model <id>', 'model the decision agent runs on (routing intent; resolved flag > env > per-repo > global > default)')
+        .option('--intake-model <id>', 'model the intake decision agent runs on (the builder-specific override of --model). Unset at every level inherits --model. Resolved flag > env > per-repo > global > fallback to model > default (unset).')
         .option('--harness <adapter>', 'harness adapter that launches the decision agent: null (default) or pi')
         .option('--pi-bin <path>', 'pi CLI binary the pi harness invokes (default: pi on PATH)')
         .option('--sessions-dir <dir>', 'HOST-ONLY root folder under which the pi session file is generated')
@@ -3033,6 +3106,11 @@ export function buildProgram() {
                 ...harnessFlagOverrides(flags),
                 // `--no-pr` (the PR-INTENT axis) rides the SAME chain.
                 ...noPRFlagOverrides(flags),
+                // `--intake-model` rides the SAME chain (falls back to `model`
+                // when unset at all levels via `applyModelFallbacks`).
+                ...(flags.intakeModel !== undefined
+                    ? { intakeModel: flags.intakeModel }
+                    : {}),
             },
         });
         if (resolved.message) {
@@ -3137,7 +3215,7 @@ export function buildProgram() {
             explicitTasksLandIn,
             harness,
             agentCmd: config.agentCmd,
-            model: config.model,
+            model: config.intakeModel,
             sessionsDir: config.sessionsDir,
             // Host-only runner IDENTITY — scopes intake's `gh`/git ops (not the
             // decision/review AGENT launches); absent ⇒ ambient.