pinsay-cli 0.6.10 → 0.7.1

package/dist/cli.js

@@ -15,7 +15,7 @@ var init_build_constants = __esm({
   "src/build-constants.ts"() {
     "use strict";
     BUILD_DEFAULT_SERVER = true ? "https://app.pinsay.dev" : "https://app.pinsay.dev";
-    BUILD_CLI_VERSION = true ? "0.6.10" : "0.0.0-dev";
+    BUILD_CLI_VERSION = true ? "0.7.1" : "0.0.0-dev";
   }
 });
 
@@ -705,7 +705,7 @@ var init_map = __esm({
 });
 
 // src/auth.ts
-import { promises as fs17 } from "node:fs";
+import { promises as fs18 } from "node:fs";
 import { dirname as dirname8 } from "node:path";
 async function readApiKey(cwd2, server) {
   const { key } = await resolveApiKey(cwd2, server);
@@ -730,7 +730,7 @@ async function resolveToken(server, cwd2, explicitApiKey) {
     return void 0;
   const cacheFile = tokenCacheFile(server, apiKey);
   try {
-    const cached = JSON.parse(await fs17.readFile(cacheFile, "utf8"));
+    const cached = JSON.parse(await fs18.readFile(cacheFile, "utf8"));
     const token = typeof cached?.token === "string" ? cached.token.trim() : "";
     if (token && !isJwtExpired(token))
       return token;
@@ -747,8 +747,8 @@ async function resolveToken(server, cwd2, explicitApiKey) {
     );
     if (login?.token) {
       try {
-        await fs17.mkdir(dirname8(cacheFile), { recursive: true });
-        await fs17.writeFile(cacheFile, JSON.stringify({ token: login.token }), "utf8");
+        await fs18.mkdir(dirname8(cacheFile), { recursive: true });
+        await fs18.writeFile(cacheFile, JSON.stringify({ token: login.token }), "utf8");
       } catch {
       }
       return login.token;
@@ -770,7 +770,7 @@ var init_auth = __esm({
 
 // src/vite/resolve.ts
 import { existsSync as existsSync3, readFileSync } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 function entryOf(json, hash) {
   if (!json || typeof json !== "object")
     return void 0;
@@ -799,11 +799,11 @@ function resolveSource(cwd2, hash) {
   const miss = { kind: "unknown", path: null, component: null };
   if (!hash || !/^[0-9a-f]{8}$/.test(hash))
     return miss;
-  const manifestPath = join17(cwd2, ".pinsay", "manifest.json");
+  const manifestPath = join18(cwd2, ".pinsay", "manifest.json");
   const current = normalise(entryOf(readJson2(manifestPath), hash));
   if (current)
     return { kind: "manifest", path: current.path, component: current.component };
-  const prevPath = join17(cwd2, ".pinsay", "manifest.prev.json");
+  const prevPath = join18(cwd2, ".pinsay", "manifest.prev.json");
   const previous = normalise(entryOf(readJson2(prevPath), hash));
   if (previous) {
     return {
@@ -1103,6 +1103,12 @@ async function statusCommand(cwd2, parsed, positionals = []) {
     console.error(`Invalid status: ${newStatusStr}. Must be open, ready, applied, or archived.`);
     process.exit(2);
   }
+  if (statusNum === 3) {
+    console.error(
+      'Marking a comment as \'applied\' is not permitted via `pinsay status`.\nUse `pinsay apply --mark <id> --reply "<explanation>"` (or `pinsay reply <id> "<text>"`) to record a properly structured reply.'
+    );
+    process.exit(2);
+  }
   await api(server, `/api/comments/${id}`, {
     method: "PATCH",
     body: { status: statusNum },
@@ -4741,14 +4747,66 @@ async function updateCommand(cwd2, options) {
 // src/commands/apply.ts
 init_config();
 init_api();
+
+// src/lib/notify-update.ts
+import { promises as fs17 } from "node:fs";
+import { join as join17 } from "node:path";
+init_build_constants();
+async function checkAndNotifyUpdates(options) {
+  const result = {
+    cliUpdateAvailable: false,
+    skillsUpdateAvailable: false
+  };
+  if (options.silent || !options.meta)
+    return result;
+  const meta = options.meta;
+  if (meta.latestCliVersion && compareSemver(BUILD_CLI_VERSION, meta.latestCliVersion) < 0) {
+    result.cliUpdateAvailable = true;
+    console.error(
+      `\x1B[33m\u{1F4A1} Update available for pinsay-cli: ${BUILD_CLI_VERSION} \u2192 ${meta.latestCliVersion}\x1B[0m
+\x1B[33m   Run 'npx -y pinsay@latest' to update.\x1B[0m
+`
+    );
+  }
+  if (meta.skillVersion && options.config && options.cwd) {
+    try {
+      const files = skillFilesFor(options.config);
+      let hasStale = false;
+      for (const rel of files) {
+        const abs = join17(options.cwd, rel);
+        try {
+          await fs17.access(abs);
+          const installed = await readStamp(abs);
+          if (installed && installed !== meta.skillVersion) {
+            hasStale = true;
+            break;
+          }
+        } catch {
+        }
+      }
+      if (hasStale) {
+        result.skillsUpdateAvailable = true;
+        console.error(
+          `\x1B[33m\u{1F4A1} Local AI skills are out of date with the server.\x1B[0m
+\x1B[33m   Run 'npx pinsay-cli update' to refresh your prompt skills.\x1B[0m
+`
+        );
+      }
+    } catch {
+    }
+  }
+  return result;
+}
+
+// src/commands/apply.ts
 init_auth();
 init_build_constants();
 
 // src/apply/run.ts
 init_resolve();
 init_api();
-import { promises as fs19 } from "node:fs";
-import { join as join19, dirname as dirname9 } from "node:path";
+import { promises as fs20 } from "node:fs";
+import { join as join20, dirname as dirname9 } from "node:path";
 import { spawnSync } from "node:child_process";
 
 // src/apply/queue.ts
@@ -4906,8 +4964,8 @@ async function fetchQueue(ctx, filter) {
 
 // src/apply/context.ts
 init_api();
-import { promises as fs18 } from "node:fs";
-import { join as join18 } from "node:path";
+import { promises as fs19 } from "node:fs";
+import { join as join19 } from "node:path";
 init_config();
 async function loadProjectContext(ctx) {
   const branding = await getBranding(ctx.server);
@@ -4918,7 +4976,7 @@ async function loadProjectContext(ctx) {
     if (config.delegation === "off")
       delegation = "off";
     const relPath = isMultiProject(config) ? stackFileRelPath(ctx.project) : stackFileRelPath();
-    const stackRaw = await fs18.readFile(join18(ctx.cwd, relPath), "utf8");
+    const stackRaw = await fs19.readFile(join19(ctx.cwd, relPath), "utf8");
     stack = JSON.parse(stackRaw);
   } catch {
   }
@@ -5235,22 +5293,34 @@ function buildApplyPrompt(items, context, opts) {
   }
   lines.push("## When you finish an item");
   lines.push(
-    'Run exactly: `npx pinsay-cli apply --mark <id> --reply "<what changed>" --model <your-model-id> --tool <your-tool-name>`'
+    'Run exactly: `npx pinsay-cli apply --mark <id> --reply "<what changed>" --models "<planner-id>=planner,<worker-id>=implementer,<reviewer-id>=reviewer" --tool <your-tool-name>`'
+  );
+  lines.push(
+    '(Separate style: after each item; Single style: run `npx pinsay-cli apply --mark all --reply "..." --models "..." --tool <your-tool-name>`'
   );
   lines.push(
-    '(Separate style: after each item; Single style: run `npx pinsay-cli apply --mark all --reply "..." --model <your-model-id> --tool <your-tool-name>`'
+    "once at the end). Never run git push. `--models` is MANDATORY and MUST list EVERY model that touched the item and its role:"
   );
   lines.push(
-    "once at the end). Never run git push. `--model` (e.g. `claude-sonnet-5`, `gpt-5.2`) and `--tool` (e.g."
+    "the planner/reviewer (your own model id) and each worker model you delegated to (`implementer`). NEVER guess or hardcode"
   );
   lines.push(
-    "`claude-code`, `opencode`, `cursor`, `windsurf`, `antigravity`) record which model and agent you are"
+    'outdated model names from memory (like "gemini-2.5-pro"). Always inspect your active runtime model name directly. Use exact'
   );
   lines.push(
-    "running as. ALWAYS pass both explicitly, even on a project you ran `init` on \u2014 `--tool` silently falls back"
+    'model ids (e.g. `claude-opus-5-5`, `claude-sonnet-5-5`, `gpt-5.2`), never aliases like "haiku" or "sonnet". With one'
   );
   lines.push(
-    "to whichever tool happened to run `init`, which is wrong the moment a different tool applies a comment later."
+    "model and no delegation, pass just yours as `<your-model-id>=implementer`. Explicit role `=<role>` is required on each entry."
+  );
+  lines.push(
+    "`--tool` (e.g. `claude-code`, `opencode`, `cursor`, `windsurf`, `antigravity`) records which agent you are running as."
+  );
+  lines.push(
+    "ALWAYS pass both explicitly, even on a project you ran `init` on \u2014 `--tool` silently falls back to whichever tool happened"
+  );
+  lines.push(
+    "to run `init`, which is wrong the moment a different tool applies a comment later."
   );
   return lines.join("\n") + "\n";
 }
@@ -5278,10 +5348,10 @@ function detectAiTool(override) {
 async function ensureToolRegistered(ctx, tool) {
   const config = await readConfig(ctx.cwd).catch(() => ({}));
   const relStackPath = isMultiProject(config) ? stackFileRelPath(ctx.project) : stackFileRelPath();
-  const stackPath = join19(ctx.cwd, relStackPath);
+  const stackPath = join20(ctx.cwd, relStackPath);
   let stackData = {};
   try {
-    const raw = await fs19.readFile(stackPath, "utf8");
+    const raw = await fs20.readFile(stackPath, "utf8");
     stackData = JSON.parse(raw);
   } catch {
   }
@@ -5300,8 +5370,8 @@ async function ensureToolRegistered(ctx, tool) {
         }
       );
       if (res) {
-        await fs19.mkdir(dirname9(stackPath), { recursive: true });
-        await fs19.writeFile(stackPath, JSON.stringify(res, null, 2) + "\n", "utf8");
+        await fs20.mkdir(dirname9(stackPath), { recursive: true });
+        await fs20.writeFile(stackPath, JSON.stringify(res, null, 2) + "\n", "utf8");
         return;
       }
     } catch {
@@ -5310,8 +5380,8 @@ async function ensureToolRegistered(ctx, tool) {
   aiTools.push(tool);
   stackData.aiTools = aiTools;
   try {
-    await fs19.mkdir(dirname9(stackPath), { recursive: true });
-    await fs19.writeFile(stackPath, JSON.stringify(stackData, null, 2) + "\n", "utf8");
+    await fs20.mkdir(dirname9(stackPath), { recursive: true });
+    await fs20.writeFile(stackPath, JSON.stringify(stackData, null, 2) + "\n", "utf8");
   } catch {
   }
 }
@@ -5385,9 +5455,9 @@ async function runApply(options, ctx) {
         console.error(`Failed to spawn opencode: ${res.error.message}`);
       }
     } else if (tool === "cursor") {
-      const promptFile = join19(ctx.cwd, ".pinsay/apply-prompt.md");
-      await fs19.mkdir(join19(ctx.cwd, ".pinsay"), { recursive: true });
-      await fs19.writeFile(promptFile, prompt, "utf8");
+      const promptFile = join20(ctx.cwd, ".pinsay/apply-prompt.md");
+      await fs20.mkdir(join20(ctx.cwd, ".pinsay"), { recursive: true });
+      await fs20.writeFile(promptFile, prompt, "utf8");
       console.log(`Saved apply prompt to ${promptFile}`);
     } else if (tool === "clipboard") {
       const copied = copyToClipboard(prompt);
@@ -5475,6 +5545,106 @@ function commitUrlFor(sha, remoteUrl) {
   return null;
 }
 
+// src/apply/models.ts
+var MODEL_ROLES = ["planner", "implementer", "reviewer"];
+var MAX_AI_MODELS = 8;
+var MODEL_RE = /^[A-Za-z0-9][A-Za-z0-9._:/+-]*$/;
+var ModelsError = class extends Error {
+};
+function normalizeEntry(raw) {
+  const model = typeof raw.model === "string" ? raw.model.trim() : "";
+  if (!model || model.length > 64 || !MODEL_RE.test(model)) {
+    throw new ModelsError(
+      `Invalid model id "${String(raw.model ?? "")}": use the exact model id (1-64 chars, letters/digits and . _ : / + -), e.g. "claude-opus-5-5".`
+    );
+  }
+  let role = null;
+  if (raw.role !== void 0 && raw.role !== null && raw.role !== "") {
+    const r = String(raw.role).trim().toLowerCase();
+    if (!MODEL_ROLES.includes(r)) {
+      throw new ModelsError(
+        `Invalid role "${String(raw.role)}" for model "${model}": expected one of ${MODEL_ROLES.join(", ")}.`
+      );
+    }
+    role = r;
+  }
+  return { model, role };
+}
+function parseModelsFlag(value) {
+  const out = [];
+  for (const part of value.split(",")) {
+    const p = part.trim();
+    if (!p)
+      continue;
+    const eq = p.indexOf("=");
+    out.push(
+      eq === -1 ? normalizeEntry({ model: p }) : normalizeEntry({ model: p.slice(0, eq), role: p.slice(eq + 1) })
+    );
+  }
+  return out;
+}
+function dedupeModels(entries) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const e of entries) {
+    const key = `${e.model.toLowerCase()}|${e.role ?? ""}`;
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    out.push(e);
+  }
+  if (out.length > MAX_AI_MODELS) {
+    throw new ModelsError(`Too many models (${out.length}); at most ${MAX_AI_MODELS} entries are allowed.`);
+  }
+  return out;
+}
+function mergeModels(...sources) {
+  return dedupeModels(sources.flatMap((s) => s ?? []));
+}
+function primaryModel(entries) {
+  return (entries.find((e) => e.role === "implementer") ?? entries[0])?.model;
+}
+function resolveModels(flags, env = process.env) {
+  const explicit = !!(flags.models || flags.model);
+  const modelsStr = explicit ? flags.models : env["PINSAY_AI_MODELS"];
+  const modelStr = explicit ? flags.model : env["PINSAY_AI_MODEL"];
+  return mergeModels(
+    modelsStr ? parseModelsFlag(modelsStr) : void 0,
+    modelStr ? [normalizeEntry({ model: modelStr })] : void 0
+  );
+}
+function resolveModelsFromArgs(args, env = process.env) {
+  const hasArray = args?.models !== void 0 && args.models !== null;
+  const single = typeof args?.model === "string" && args.model ? args.model : void 0;
+  if (!hasArray && !single) {
+    return resolveModels({}, env);
+  }
+  let fromArray;
+  if (hasArray) {
+    if (!Array.isArray(args.models))
+      throw new ModelsError("models must be an array of {model, role?}.");
+    fromArray = args.models.map(
+      (m) => typeof m === "string" ? normalizeEntry({ model: m }) : normalizeEntry(m ?? {})
+    );
+  }
+  return mergeModels(fromArray, single ? [normalizeEntry({ model: single })] : void 0);
+}
+function modelsBody(entries) {
+  if (entries.length === 0)
+    return {};
+  return { aiModels: entries, aiModel: primaryModel(entries) };
+}
+function distinctModelCount(entries) {
+  return new Set(entries.map((e) => e.model.toLowerCase())).size;
+}
+var DELEGATION_WARNING = '\u26A0 Delegation is on for this project, but fewer than 2 distinct models were reported. Pass every model that worked on the item (planner, worker, reviewer) via --models "<planner>=planner,<worker>=implementer,<reviewer>=reviewer".';
+function delegationWarning(delegation, entries) {
+  return delegation === "auto" && distinctModelCount(entries) < 2 ? DELEGATION_WARNING : null;
+}
+function describeModels(entries) {
+  return entries.length === 0 ? "(none)" : entries.map((e) => `${e.model}${e.role ? `=${e.role}` : ""}`).join(", ");
+}
+
 // src/apply/mark.ts
 async function markApplied(options, ctx) {
   if (!options.noCommit && !isStaged(ctx.cwd)) {
@@ -5488,10 +5658,19 @@ async function markApplied(options, ctx) {
   const projectCtx = await loadProjectContext(ctx);
   const email = getUserEmail(ctx.cwd);
   const appliedByLabel = options.tool ? `${email} via ${options.tool}` : email;
+  const models = mergeModels(
+    options.models,
+    options.model ? [normalizeEntry({ model: options.model })] : void 0
+  );
+  const aiModelFields = modelsBody(models);
+  const warning = delegationWarning(projectCtx.delegation ?? "auto", models);
+  if (warning)
+    console.error(warning);
   if (options.dryRun) {
     console.log(`[dry-run] Would mark comment ${options.id} as applied`);
     console.log(`[dry-run] Reply: ${options.reply}`);
     console.log(`[dry-run] AppliedBy: ${appliedByLabel}`);
+    console.log(`[dry-run] Models: ${describeModels(models)}`);
     return {
       committed: false,
       patchedIds: typeof options.id === "number" ? [options.id] : []
@@ -5535,7 +5714,7 @@ async function markApplied(options, ctx) {
           // Structured AI attribution on the reply itself (Reply.AiTool/AiModel), distinct from the
           // free-text appliedByLabel above — see CommentService.Normalize server-side.
           aiTool: options.tool || void 0,
-          aiModel: options.model || void 0
+          ...aiModelFields
         },
         token: ctx.token
       });
@@ -5579,7 +5758,7 @@ async function markApplied(options, ctx) {
         // against a deployed build.
         commitSha: sha || null,
         aiTool: options.tool || void 0,
-        aiModel: options.model || void 0
+        ...aiModelFields
       },
       token: ctx.token
     });
@@ -5599,9 +5778,10 @@ async function markApplied(options, ctx) {
 }
 async function markFailed(id, reason, ctx, tool, model) {
   const replyBody = `Could not apply: ${reason}`;
+  const models = typeof model === "string" ? model ? [normalizeEntry({ model })] : [] : model ?? [];
   await api(ctx.server, `/api/comments/${id}/replies`, {
     method: "POST",
-    body: { body: replyBody, aiTool: tool || void 0, aiModel: model || void 0 },
+    body: { body: replyBody, aiTool: tool || void 0, ...modelsBody(models) },
     token: ctx.token
   });
   await postEvent(ctx.server, ctx.token, {
@@ -5636,6 +5816,20 @@ async function exitIfWorkspaceFrozen(server, token) {
   } catch {
   }
 }
+function parseModelFlags(parsed) {
+  try {
+    return resolveModels({
+      models: typeof parsed["models"] === "string" ? parsed["models"] : void 0,
+      model: typeof parsed["model"] === "string" ? parsed["model"] : void 0
+    });
+  } catch (err) {
+    if (err instanceof ModelsError) {
+      console.error(err.message);
+      process.exit(2);
+    }
+    throw err;
+  }
+}
 async function applyCommand(cwd2, parsed, positionals = []) {
   const root = await findRepoRoot(cwd2);
   const config = await readConfig(root);
@@ -5672,6 +5866,12 @@ async function applyCommand(cwd2, parsed, positionals = []) {
       console.error(tooOldMessage(BUILD_CLI_VERSION, minCli));
       process.exit(5);
     }
+    await checkAndNotifyUpdates({
+      meta,
+      config,
+      cwd: root,
+      silent: Boolean(parsed["json"])
+    });
   } catch (err) {
     if (!(err instanceof ApiError && err.code === 404)) {
     }
@@ -5710,8 +5910,10 @@ async function applyCommand(cwd2, parsed, positionals = []) {
       markId = parsedNum;
     }
     const reply = typeof parsed["reply"] === "string" ? parsed["reply"] : "";
-    if (!reply) {
-      console.error('--reply "<text>" is required when using --mark');
+    if (!reply || reply.trim().length < 15 || /^(done|fixed|applied|ok|yes)$/i.test(reply.trim())) {
+      console.error(
+        '--reply "<text>" is required when using --mark and must provide a substantive explanation of the changes (at least 15 characters, e.g. "Applied \u2713 \u2014 updated logo source in header").'
+      );
       process.exit(2);
     }
     const noCommit = parsed["no-commit"] === true;
@@ -5723,7 +5925,20 @@ async function applyCommand(cwd2, parsed, positionals = []) {
         `\u26A0 --tool not passed \u2014 defaulting to "${config.aiTool}" (recorded when this project was initialized). Pass --tool <your-tool-name> explicitly if you are not that tool.`
       );
     }
-    const model = (typeof parsed["model"] === "string" ? parsed["model"] : void 0) || process.env.PINSAY_AI_MODEL;
+    const models = parseModelFlags(parsed);
+    if (models.length === 0) {
+      console.error(
+        '--models "<model>=<role>" is mandatory when marking a comment as applied.\nSpecify your actual active runtime model and role (e.g. --models "<active-model>=implementer").\nIf multiple models or subagents participated (planner, implementer, reviewer), list all of them separated by commas.\nNever guess or hardcode model names from memory.'
+      );
+      process.exit(2);
+    }
+    const missingRole = models.find((m) => !m.role);
+    if (missingRole) {
+      console.error(
+        `Invalid --models entry "${missingRole.model}": explicit role is required. Expected "<model>=<role>" where role is one of: planner, implementer, reviewer (e.g. "${missingRole.model}=implementer").`
+      );
+      process.exit(2);
+    }
     const markStatus = typeof parsed["status"] === "string" ? parsed["status"] : void 0;
     const markEnv = typeof parsed["env"] === "string" ? parsed["env"] : void 0;
     const marked = await markApplied(
@@ -5733,7 +5948,7 @@ async function applyCommand(cwd2, parsed, positionals = []) {
         noCommit,
         dryRun,
         tool: tool2,
-        model,
+        models,
         filter: markStatus !== void 0 || markEnv !== void 0 ? { status: markStatus, environment: markEnv } : void 0
       },
       clientCtx
@@ -5763,8 +5978,8 @@ async function applyCommand(cwd2, parsed, positionals = []) {
         `\u26A0 --tool not passed \u2014 defaulting to "${config.aiTool}" (recorded when this project was initialized). Pass --tool <your-tool-name> explicitly if you are not that tool.`
       );
     }
-    const failModel = (typeof parsed["model"] === "string" ? parsed["model"] : void 0) || process.env.PINSAY_AI_MODEL;
-    await markFailed(failId, reason, clientCtx, failTool, failModel);
+    const failModels = parseModelFlags(parsed);
+    await markFailed(failId, reason, clientCtx, failTool, failModels);
     process.exit(0);
   }
   if (parsed["json"] === true && !parsed["plan"] && !parsed["tool"]) {
@@ -5806,6 +6021,12 @@ async function applyAllProjects(root, cwd2, config, server, parsed) {
       console.error(tooOldMessage(BUILD_CLI_VERSION, minCli));
       process.exit(5);
     }
+    await checkAndNotifyUpdates({
+      meta,
+      config,
+      cwd: root,
+      silent: Boolean(parsed["json"])
+    });
   } catch (err) {
     if (!(err instanceof ApiError && err.code === 404)) {
     }
@@ -5857,7 +6078,7 @@ init_build_constants();
 
 // src/mcp/server.ts
 import { readFileSync as readFileSync3 } from "node:fs";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 
 // node_modules/zod/v3/external.js
 var external_exports = {};
@@ -11242,9 +11463,24 @@ var TOOL_PINSAY_GET_COMMENT = {
     additionalProperties: false
   }
 };
+var MODELS_NOTICE = "Pass `models` with EVERY model that touched the item and its role (planner/reviewer = your own id, implementer = each worker model you delegated to), using exact model ids, not aliases.";
+var MODELS_PROPERTY = {
+  type: "array",
+  maxItems: 8,
+  description: 'ALWAYS pass this: EVERY model that worked on the item, each with its role. Include the planner/reviewer (your own model id) and every worker model you delegated to (role "implementer"). Use exact model ids, not aliases like "haiku"/"sonnet". With one model and no delegation, pass just yours as implementer.',
+  items: {
+    type: "object",
+    properties: {
+      model: { type: "string", description: 'Exact model id, e.g. "claude-opus-5-5"' },
+      role: { type: "string", enum: ["planner", "implementer", "reviewer"] }
+    },
+    required: ["model"],
+    additionalProperties: false
+  }
+};
 var TOOL_PINSAY_MARK_APPLIED = {
   name: "pinsay_mark_applied",
-  description: `Mark one comment applied and post the reply on it, recording the optional commitUrl, the git user.email as the applier, and the tool/model attribution. Runs no git command and records no commit sha, so a comment marked this way is never flipped to Live by \`npx pinsay-cli status --deployed\`. Use it when a human will commit the change; to commit now, use pinsay_commit_and_mark. Returns {id, status, commitUrl}. ${UNTRUSTED_NOTICE}`,
+  description: `Mark one comment applied and post the reply on it, recording the optional commitUrl, the git user.email as the applier, and the tool/model attribution. Runs no git command and records no commit sha, so a comment marked this way is never flipped to Live by \`npx pinsay-cli status --deployed\`. Use it when a human will commit the change; to commit now, use pinsay_commit_and_mark. Returns {id, status, commitUrl}. ${MODELS_NOTICE} ${UNTRUSTED_NOTICE}`,
   inputSchema: {
     type: "object",
     properties: {
@@ -11266,8 +11502,9 @@ var TOOL_PINSAY_MARK_APPLIED = {
       },
       model: {
         type: "string",
-        description: 'The model id you are running as (e.g. "claude-sonnet-5", "gpt-5.2"). Always pass this too.'
-      }
+        description: 'Legacy single model id (role unset); prefer `models`. Exact id, not an alias (e.g. "claude-sonnet-5-5", "gpt-5.2").'
+      },
+      models: MODELS_PROPERTY
     },
     required: ["id", "reply"],
     additionalProperties: false
@@ -11275,7 +11512,7 @@ var TOOL_PINSAY_MARK_APPLIED = {
 };
 var TOOL_PINSAY_COMMIT_AND_MARK = {
   name: "pinsay_commit_and_mark",
-  description: `Commit the applied changes with git and mark the comments applied, posting the same reply on each and recording its commit URL. Paths in files are relative to the repository root and must exist inside it; they are staged first. Omit files to commit what is already staged (errors when nothing is). The commit takes everything in the index, not only files. The project's commitStyle decides the commits: "single" makes one commit for all ids; "separate" makes one commit per id, and with more than one id files is required and each entry is prefixed "<id>:" to assign it to that comment (e.g. "12:src/Button.tsx"; unprefixed entries go to the first id). Never pushes. Returns [{id, commitUrl}]. ${UNTRUSTED_NOTICE}`,
+  description: `Commit the applied changes with git and mark the comments applied, posting the same reply on each and recording its commit URL. Paths in files are relative to the repository root and must exist inside it; they are staged first. Omit files to commit what is already staged (errors when nothing is). The commit takes everything in the index, not only files. The project's commitStyle decides the commits: "single" makes one commit for all ids; "separate" makes one commit per id, and with more than one id files is required and each entry is prefixed "<id>:" to assign it to that comment (e.g. "12:src/Button.tsx"; unprefixed entries go to the first id). Never pushes. Returns [{id, commitUrl}]. ${MODELS_NOTICE} ${UNTRUSTED_NOTICE}`,
   inputSchema: {
     type: "object",
     properties: {
@@ -11303,8 +11540,9 @@ var TOOL_PINSAY_COMMIT_AND_MARK = {
       },
       model: {
         type: "string",
-        description: 'The model id you are running as (e.g. "claude-sonnet-5", "gpt-5.2"). Always pass this too.'
-      }
+        description: 'Legacy single model id (role unset); prefer `models`. Exact id, not an alias (e.g. "claude-sonnet-5-5", "gpt-5.2").'
+      },
+      models: MODELS_PROPERTY
     },
     required: ["ids", "reply"],
     additionalProperties: false
@@ -11312,7 +11550,7 @@ var TOOL_PINSAY_COMMIT_AND_MARK = {
 };
 var TOOL_PINSAY_REPLY = {
   name: "pinsay_reply",
-  description: `Post a reply on a comment, visible to its author and the other stakeholders, with tool/model attribution. Does not change the comment's status; to close a comment out with a reply, use pinsay_mark_applied or pinsay_commit_and_mark. Returns {replyId}. ${UNTRUSTED_NOTICE}`,
+  description: `Post a reply on a comment, visible to its author and the other stakeholders, with tool/model attribution. Does not change the comment's status; to close a comment out with a reply, use pinsay_mark_applied or pinsay_commit_and_mark. Returns {replyId}. ${MODELS_NOTICE} ${UNTRUSTED_NOTICE}`,
   inputSchema: {
     type: "object",
     properties: {
@@ -11330,8 +11568,9 @@ var TOOL_PINSAY_REPLY = {
       },
       model: {
         type: "string",
-        description: 'The model id you are running as (e.g. "claude-sonnet-5", "gpt-5.2"). Always pass this too.'
-      }
+        description: 'Legacy single model id (role unset); prefer `models`. Exact id, not an alias (e.g. "claude-sonnet-5-5", "gpt-5.2").'
+      },
+      models: MODELS_PROPERTY
     },
     required: ["id", "body"],
     additionalProperties: false
@@ -11411,7 +11650,7 @@ var ALL_TOOLS = [
 // src/mcp/tools.ts
 init_api();
 import { existsSync as existsSync4, readFileSync as readFileSync2 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join20, relative as relative5, resolve as resolve4 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join21, relative as relative5, resolve as resolve4 } from "node:path";
 import { spawnSync as spawnSync3 } from "node:child_process";
 init_build_constants();
 init_projection();
@@ -11670,6 +11909,15 @@ async function handleGetComment(args, ctx) {
     throw err;
   }
 }
+function parseModelsArgs(args) {
+  try {
+    return resolveModelsFromArgs(args);
+  } catch (err) {
+    if (err instanceof ModelsError)
+      throw mcpError("forbidden", err.message);
+    throw err;
+  }
+}
 async function handleMarkApplied(args, ctx) {
   const id = Number(args?.id);
   const reply = args?.reply;
@@ -11680,7 +11928,7 @@ async function handleMarkApplied(args, ctx) {
   const appliedByLabel = email;
   const commitUrl = args.commitUrl || null;
   const tool = args.tool || ctx.configAiTool;
-  const model = args.model || process.env.PINSAY_AI_MODEL;
+  const models = parseModelsArgs(args);
   await api(ctx.server, `/api/comments/${id}`, {
     method: "PATCH",
     body: {
@@ -11689,7 +11937,7 @@ async function handleMarkApplied(args, ctx) {
       appliedByLabel,
       commitUrl,
       aiTool: tool || void 0,
-      aiModel: model || void 0
+      ...modelsBody(models)
     },
     token: ctx.token
   });
@@ -11709,7 +11957,7 @@ async function handleCommitAndMark(args, ctx) {
   const reply = args?.reply;
   const files = args?.files;
   const tool = args?.tool || ctx.configAiTool;
-  const model = args?.model || process.env.PINSAY_AI_MODEL;
+  const models = parseModelsArgs(args);
   if (!Array.isArray(ids) || ids.length === 0 || typeof reply !== "string") {
     throw mcpError("git", "ids (non-empty array) and reply (string) are required");
   }
@@ -11800,7 +12048,7 @@ async function handleCommitAndMark(args, ctx) {
             // so the same fix that shipped for `pinsay apply` has to hold here.
             commitSha: sha,
             aiTool: tool || void 0,
-            aiModel: model || void 0
+            ...modelsBody(models)
           },
           token: ctx.token
         });
@@ -11846,7 +12094,7 @@ async function handleCommitAndMark(args, ctx) {
           // Same reason as the single-comment path above.
           commitSha: sha,
           aiTool: tool || void 0,
-          aiModel: model || void 0
+          ...modelsBody(models)
         },
         token: ctx.token
       });
@@ -11888,7 +12136,7 @@ async function handleCommitAndMark(args, ctx) {
           // stays "applied" forever even once the fix ships.
           commitSha: sha,
           aiTool: tool || void 0,
-          aiModel: model || void 0
+          ...modelsBody(models)
         },
         token: ctx.token
       });
@@ -11909,10 +12157,10 @@ async function handleReply(args, ctx) {
     throw mcpError("forbidden", "id and body are required");
   }
   const tool = args?.tool || ctx.configAiTool;
-  const model = args?.model || process.env.PINSAY_AI_MODEL;
+  const models = parseModelsArgs(args);
   const res = await api(ctx.server, `/api/comments/${id}/replies`, {
     method: "POST",
-    body: { body, aiTool: tool || void 0, aiModel: model || void 0 },
+    body: { body, aiTool: tool || void 0, ...modelsBody(models) },
     token: ctx.token
   });
   return { replyId: res?.id ?? res?.data?.id ?? null };
@@ -11942,7 +12190,7 @@ async function handleResolveSource(args, ctx) {
   if (!hash || typeof hash !== "string") {
     throw mcpError("forbidden", "hash is required");
   }
-  const manifestPath = join20(ctx.cwd, ".pinsay/manifest.json");
+  const manifestPath = join21(ctx.cwd, ".pinsay/manifest.json");
   if (!existsSync4(manifestPath)) {
     return { path: null, reason: "no-manifest" };
   }
@@ -12122,12 +12370,12 @@ function createMcpServer(ctx) {
     let configObj = {};
     let stackObj = {};
     try {
-      const configPath = join21(ctx.cwd, ".pinsay/config.json");
+      const configPath = join22(ctx.cwd, ".pinsay/config.json");
       configObj = JSON.parse(readFileSync3(configPath, "utf8"));
     } catch {
     }
     try {
-      const stackPath = join21(ctx.cwd, ".pinsay/stack.json");
+      const stackPath = join22(ctx.cwd, ".pinsay/stack.json");
       stackObj = JSON.parse(readFileSync3(stackPath, "utf8"));
     } catch {
     }
@@ -12192,8 +12440,8 @@ function createMcpServer(ctx) {
 async function runMcpServer(ctx, logFile) {
   if (logFile) {
     try {
-      const fs20 = await import("node:fs");
-      const logStream = fs20.createWriteStream(logFile, { flags: "a" });
+      const fs21 = await import("node:fs");
+      const logStream = fs21.createWriteStream(logFile, { flags: "a" });
       const origWrite = process.stderr.write;
       process.stderr.write = function(chunk, encoding, cb) {
         logStream.write(chunk);
@@ -12616,6 +12864,11 @@ Options:
   --reply <text>     Reply text for applied comment (required with --mark)
   --no-commit        Skip git commit during --mark (PATCH only)
   --dry-run          Print what --mark would do without making git/API changes
+  --models <list>    Every model that worked on the item, with its role, for --mark/--fail:
+                     "<id>=<role>,<id>=<role>" (role: planner|implementer|reviewer, optional;
+                     e.g. "claude-opus-5-5=planner,claude-sonnet-5-5=implementer,claude-opus-5-5=reviewer").
+                     Env fallback: PINSAY_AI_MODELS
+  --model <id>       One model id (role unset); merged after --models. Env: PINSAY_AI_MODEL
   --fail <id>        Mark apply failed with a reply
   --reason <text>    Failure reason (required with --fail)
   --status <status>  Filter queue by status (open, ready, applied, archived)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinsay-cli",
-  "version": "0.6.10",
+  "version": "0.7.1",
   "description": "Click-to-comment feedback for your web app: install the widget, then turn pending comments into AI apply prompts.",
   "type": "module",
   "license": "MIT",