total-recall-brain 3.47.0 → 3.47.2

package/scaffold/.agent/skills/total-recall/plugins/git/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "git",
   "name": "Git",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "The whole git CLI through Total Recall: sign-in from the auth store, guarded commits and pushes, undo, fleet state, and the intent behind every change.",
   "author": "Total Recall",
   "license": "MIT",
@@ -10,13 +10,28 @@
     "software-development"
   ],
   "gate": {
-    "tasks": ["Run any git command", "Commit or push with identity, secret and rule checks", "Sign git in through the auth store", "Undo a destructive git command", "Check repository state across the mesh", "Keep the git CLI current on every node"],
+    "tasks": [
+      "Run any git command",
+      "Commit or push with identity, secret and rule checks",
+      "Sign git in through the auth store",
+      "Undo a destructive git command",
+      "Check repository state across the mesh",
+      "Keep the git CLI current on every node"
+    ],
     "owned_commands": [
-      { "pattern": "(^|[;&|(]\\s*)git(\\s+-C\\s+\\S+)?\\s+[a-z]", "use": "total-recall git <same git command and arguments>" }
+      {
+        "pattern": "(^|[;&|(]\\s*)git(\\s+-C\\s+\\S+)?\\s+[a-z]",
+        "use": "total-recall git <same git command and arguments>"
+      }
     ]
   },
   "tasks": [
-    { "intent": "Check and update the git CLI", "schedule": "17 6 * * *", "command": "cli update --scheduled", "placement": "per-node" }
+    {
+      "intent": "Check and update the git CLI",
+      "schedule": "17 6 * * *",
+      "command": "cli update --scheduled",
+      "placement": "per-node"
+    }
   ],
   "cli": {
     "answers_help": true,
@@ -33,57 +48,253 @@
         "description": "Read a stat or patch for unstaged, staged or base-relative changes",
         "effect": "read",
         "args": [
-          { "name": "patch", "flag": "--patch", "type": "boolean", "label": "Show patch" },
-          { "name": "cached", "flag": "--cached", "type": "boolean", "label": "Use staged changes" },
-          { "name": "base", "flag": "--base", "type": "string", "label": "Base ref" }
+          {
+            "name": "patch",
+            "flag": "--patch",
+            "type": "boolean",
+            "label": "Show patch"
+          },
+          {
+            "name": "cached",
+            "flag": "--cached",
+            "type": "boolean",
+            "label": "Use staged changes"
+          },
+          {
+            "name": "base",
+            "flag": "--base",
+            "type": "string",
+            "label": "Base ref"
+          }
+        ]
+      },
+      {
+        "name": "commit",
+        "description": "Check identity, conflicts, HEAD, secrets and repository rules, then run git's own commit with your arguments",
+        "effect": "write",
+        "timeout_ms": 600000,
+        "args": [
+          {
+            "name": "args",
+            "type": "string",
+            "label": "git commit arguments",
+            "positional": true
+          }
+        ]
+      },
+      {
+        "name": "push",
+        "description": "Check outgoing commits for secrets and rules, turn --force into --force-with-lease, then run git's own push",
+        "effect": "write",
+        "timeout_ms": 600000,
+        "args": [
+          {
+            "name": "args",
+            "type": "string",
+            "label": "git push arguments",
+            "positional": true
+          }
+        ]
+      },
+      {
+        "name": "credential-helper",
+        "description": "Git credential helper: give git the mapped auth-store credential (get); store and erase do nothing",
+        "effect": "read"
+      },
+      {
+        "name": "auth",
+        "description": "Sign-in: status (live check, no secret shown), map <host> <KEY>, setup (helper entries for this machine)",
+        "effect": "write",
+        "args": [
+          {
+            "name": "action",
+            "type": "string",
+            "label": "status | map | setup",
+            "positional": true
+          }
+        ]
+      },
+      {
+        "name": "cli",
+        "description": "Git CLI metadata (version, path, install source, upstream, release notes); --all-nodes for the mesh; cli update updates git through its installer",
+        "effect": "write",
+        "timeout_ms": 600000
+      },
+      {
+        "name": "undo",
+        "description": "Restore refs, index and files from the snapshot taken before a destructive git command; --list shows snapshots",
+        "effect": "destructive",
+        "args": [
+          {
+            "name": "event",
+            "type": "string",
+            "label": "Snapshot",
+            "positional": true
+          },
+          {
+            "name": "list",
+            "flag": "--list",
+            "type": "boolean",
+            "label": "List snapshots"
+          }
+        ]
+      },
+      {
+        "name": "fleet",
+        "description": "Dirty, unpushed, behind, diverged, stale stashes and abandoned worktrees across registered repositories; --all-nodes for the mesh",
+        "effect": "read",
+        "timeout_ms": 600000
+      },
+      {
+        "name": "unmerged",
+        "description": "Branches with commits not in the default branch, worktrees with uncommitted changes and detached worktrees holding commits on no branch; --registered for every registered repository",
+        "effect": "read",
+        "output": "json",
+        "timeout_ms": 600000,
+        "args": [
+          {
+            "name": "registered",
+            "flag": "--registered",
+            "type": "boolean",
+            "label": "Every registered repository"
+          }
+        ]
+      },
+      {
+        "name": "where",
+        "description": "Machines and checkouts that contain a commit",
+        "effect": "read",
+        "args": [
+          {
+            "name": "commit",
+            "type": "string",
+            "label": "Commit",
+            "required": true,
+            "positional": true
+          }
         ]
       },
-      { "name": "commit", "description": "Check identity, conflicts, HEAD, secrets and repository rules, then run git's own commit with your arguments", "effect": "write", "timeout_ms": 600000, "args": [
-        { "name": "args", "type": "string", "label": "git commit arguments", "positional": true }
-      ] },
-      { "name": "push", "description": "Check outgoing commits for secrets and rules, turn --force into --force-with-lease, then run git's own push", "effect": "write", "timeout_ms": 600000, "args": [
-        { "name": "args", "type": "string", "label": "git push arguments", "positional": true }
-      ] },
-      { "name": "credential-helper", "description": "Git credential helper: give git the mapped auth-store credential (get); store and erase do nothing", "effect": "read" },
-      { "name": "auth", "description": "Sign-in: status (live check, no secret shown), map <host> <KEY>, setup (helper entries for this machine)", "effect": "write", "args": [
-        { "name": "action", "type": "string", "label": "status | map | setup", "positional": true }
-      ] },
-      { "name": "cli", "description": "Git CLI metadata (version, path, install source, upstream, release notes); --all-nodes for the mesh; cli update updates git through its installer", "effect": "write", "timeout_ms": 600000 },
-      { "name": "undo", "description": "Restore refs, index and files from the snapshot taken before a destructive git command; --list shows snapshots", "effect": "destructive", "args": [
-        { "name": "event", "type": "string", "label": "Snapshot", "positional": true },
-        { "name": "list", "flag": "--list", "type": "boolean", "label": "List snapshots" }
-      ] },
-      { "name": "fleet", "description": "Dirty, unpushed, behind, diverged, stale stashes and abandoned worktrees across registered repositories; --all-nodes for the mesh", "effect": "read", "timeout_ms": 600000 },
-      { "name": "unmerged", "description": "Branches with commits not in the default branch, worktrees with uncommitted changes and detached worktrees holding commits on no branch; --registered for every registered repository", "effect": "read", "output": "json", "timeout_ms": 600000, "args": [
-        { "name": "registered", "flag": "--registered", "type": "boolean", "label": "Every registered repository" }
-      ] },
-      { "name": "where", "description": "Machines and checkouts that contain a commit", "effect": "read", "args": [
-        { "name": "commit", "type": "string", "label": "Commit", "required": true, "positional": true }
-      ] },
-      { "name": "why", "description": "Blame one line plus the session, tracker item, decision and rules recorded when it was committed", "effect": "read", "args": [
-        { "name": "location", "type": "string", "label": "file:line", "required": true, "positional": true }
-      ] },
-      { "name": "group", "description": "Group a dirty tree into commits by the agent session that wrote each change; --apply commits the groups", "effect": "write" },
-      { "name": "message", "description": "Draft a commit message from the staged diff, the active tracker and its action log", "effect": "read" },
-      { "name": "bisect-agent", "description": "Find the first bad commit with the repository's quality gate as the test", "effect": "write", "timeout_ms": 600000, "args": [
-        { "name": "good", "type": "string", "label": "Good commit", "required": true, "positional": true },
-        { "name": "bad", "type": "string", "label": "Bad commit", "required": true, "positional": true }
-      ] },
-      { "name": "resolve", "description": "Propose a resolution for each conflicted file from both sides' recorded intent; --apply writes it", "effect": "write" },
-      { "name": "handoff", "description": "Pack a branch, its tracker and related memory into one SSSS bundle for another agent or machine", "effect": "write", "args": [
-        { "name": "branch", "type": "string", "label": "Branch", "required": true, "positional": true },
-        { "name": "out", "flag": "--out", "type": "string", "label": "Output file" }
-      ] },
-      { "name": "worktree-list", "description": "Read registered worktrees for the current repository", "effect": "read" },
-      { "name": "worktree-create", "description": "Create a detached worktree at a specified path and base ref", "effect": "write", "args": [
-        { "name": "path", "type": "string", "label": "Worktree path", "required": true, "positional": true },
-        { "name": "base", "flag": "--base", "type": "string", "label": "Base ref" }
-      ] },
-      { "name": "worktree-remove", "description": "Remove an owned linked worktree, with explicit force for dirty content", "effect": "destructive", "args": [
-        { "name": "path", "type": "string", "label": "Worktree path", "required": true, "positional": true },
-        { "name": "force", "flag": "--force", "type": "boolean", "label": "Allow removal of dirty content" }
-      ] },
-      { "name": "worktree", "description": "Compatibility form: worktree list, create or remove", "effect": "destructive" },
+      {
+        "name": "why",
+        "description": "Blame one line plus the session, tracker item, decision and rules recorded when it was committed",
+        "effect": "read",
+        "args": [
+          {
+            "name": "location",
+            "type": "string",
+            "label": "file:line",
+            "required": true,
+            "positional": true
+          }
+        ]
+      },
+      {
+        "name": "group",
+        "description": "Group a dirty tree into commits by the agent session that wrote each change; --apply commits the groups",
+        "effect": "write"
+      },
+      {
+        "name": "message",
+        "description": "Draft a commit message from the staged diff, the active tracker and its action log",
+        "effect": "read"
+      },
+      {
+        "name": "bisect-agent",
+        "description": "Find the first bad commit with the repository's quality gate as the test",
+        "effect": "write",
+        "timeout_ms": 600000,
+        "args": [
+          {
+            "name": "good",
+            "type": "string",
+            "label": "Good commit",
+            "required": true,
+            "positional": true
+          },
+          {
+            "name": "bad",
+            "type": "string",
+            "label": "Bad commit",
+            "required": true,
+            "positional": true
+          }
+        ]
+      },
+      {
+        "name": "resolve",
+        "description": "Propose a resolution for each conflicted file from both sides' recorded intent; --apply writes it",
+        "effect": "write"
+      },
+      {
+        "name": "handoff",
+        "description": "Pack a branch, its tracker and related memory into one SSSS bundle for another agent or machine",
+        "effect": "write",
+        "args": [
+          {
+            "name": "branch",
+            "type": "string",
+            "label": "Branch",
+            "required": true,
+            "positional": true
+          },
+          {
+            "name": "out",
+            "flag": "--out",
+            "type": "string",
+            "label": "Output file"
+          }
+        ]
+      },
+      {
+        "name": "worktree-list",
+        "description": "Read registered worktrees for the current repository",
+        "effect": "read"
+      },
+      {
+        "name": "worktree-create",
+        "description": "Create a detached worktree at a specified path and base ref",
+        "effect": "write",
+        "args": [
+          {
+            "name": "path",
+            "type": "string",
+            "label": "Worktree path",
+            "required": true,
+            "positional": true
+          },
+          {
+            "name": "base",
+            "flag": "--base",
+            "type": "string",
+            "label": "Base ref"
+          }
+        ]
+      },
+      {
+        "name": "worktree-remove",
+        "description": "Remove an owned linked worktree, with explicit force for dirty content",
+        "effect": "destructive",
+        "args": [
+          {
+            "name": "path",
+            "type": "string",
+            "label": "Worktree path",
+            "required": true,
+            "positional": true
+          },
+          {
+            "name": "force",
+            "flag": "--force",
+            "type": "boolean",
+            "label": "Allow removal of dirty content"
+          }
+        ]
+      },
+      {
+        "name": "worktree",
+        "description": "Compatibility form: worktree list, create or remove",
+        "effect": "destructive"
+      },
       {
         "name": "identity",
         "description": "Show who commits here and which identities the history publishes; exits 1 on a missing or machine-derived identity (--json for machine output)",
@@ -101,10 +312,21 @@
         "tag": "tr-git-home",
         "module": "ui/home.js",
         "description": "Repository audit, diff stats, and linked worktrees",
-        "tokens": ["color-text", "color-surface", "color-border", "spacing-md", "radius-md"],
+        "tokens": [
+          "color-text",
+          "color-surface",
+          "color-border",
+          "spacing-md",
+          "radius-md"
+        ],
         "optional_tokens": [
-          "color-background", "color-accent", "color-muted", "color-danger",
-          "typography-body-font-family", "typography-heading-font-family", "typography-mono-font-family"
+          "color-background",
+          "color-accent",
+          "color-muted",
+          "color-danger",
+          "typography-body-font-family",
+          "typography-heading-font-family",
+          "typography-mono-font-family"
         ]
       }
     ]
@@ -139,7 +361,13 @@
     "badge": "Repository Hygiene",
     "font": "space-grotesk"
   },
-  "startup_check": { "command": "unmerged", "args": ["--json"], "timeout_ms": 20000 },
+  "startup_check": {
+    "command": "unmerged",
+    "args": [
+      "--json"
+    ],
+    "timeout_ms": 20000
+  },
   "status": {
     "command": "audit",
     "refresh_seconds": 60
@@ -154,5 +382,12 @@
       "total-recall ssss status"
     ],
     "owned": "Secret-firewalled commits and pushes, worktree management, unmerged branch detection, and fleet repository hygiene."
-  }
+  },
+  "skills": [
+    {
+      "id": "git",
+      "path": "./skills/git/SKILL.md",
+      "description": "The whole git CLI through Total Recall: sign-in from the auth store, guarded commits and pushes, undo, fleet state, and the intent behind every change."
+    }
+  ]
 }

package/scaffold/.agent/skills/total-recall/plugins/git/skills/git/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: git
+description: "The whole git CLI through Total Recall: sign-in from the auth store, guarded commits and pushes, undo, fleet state, and the intent behind every change."
+version: 2.3.0
+repo_scoped: false
+---
+
+# Git
+
+The whole git CLI through Total Recall: sign-in from the auth store, guarded commits and pushes, undo, fleet state, and the intent behind every change.
+
+## When to Use
+
+Use the `git` Total Recall plugin (`total-recall git`) instead of ad-hoc scripts or raw commands whenever working on git tasks.
+
+## Commands
+
+```bash
+total-recall git --help
+total-recall git audit  # Summarise branch, worktree, upstream and stash state (--json for machine output)
+total-recall git diff  # Read a stat or patch for unstaged, staged or base-relative changes
+total-recall git commit  # Check identity, conflicts, HEAD, secrets and repository rules, then run git's own commit with your arguments
+total-recall git push  # Check outgoing commits for secrets and rules, turn --force into --force-with-lease, then run git's own push
+total-recall git credential-helper  # Git credential helper: give git the mapped auth-store credential (get); store and erase do nothing
+total-recall git auth  # Sign-in: status (live check, no secret shown), map <host> <KEY>, setup (helper entries for this machine)
+total-recall git cli  # Git CLI metadata (version, path, install source, upstream, release notes); --all-nodes for the mesh; cli update updates git through its installer
+total-recall git undo  # Restore refs, index and files from the snapshot taken before a destructive git command; --list shows snapshots
+total-recall git fleet  # Dirty, unpushed, behind, diverged, stale stashes and abandoned worktrees across registered repositories; --all-nodes for the mesh
+total-recall git unmerged  # Branches with commits not in the default branch, worktrees with uncommitted changes and detached worktrees holding commits on no branch; --registered for every registered repository
+total-recall git where  # Machines and checkouts that contain a commit
+total-recall git why  # Blame one line plus the session, tracker item, decision and rules recorded when it was committed
+```
+
+## Owned Raw Commands
+
+This plugin owns: `(^|[;&|(]\s*)git(\s+-C\s+\S+)?\s+[a-z]`.

package/scaffold/.agent/skills/total-recall/plugins/mesh/package-lock.json

@@ -15,7 +15,7 @@
       "devDependencies": {
         "jsdom": "^29.1.1",
         "supertest": "^7.3.1",
-        "total-recall-brain": "3.45.0",
+        "total-recall-brain": "3.47.0",
         "vitest": "^4.1.12"
       }
     },
@@ -7177,9 +7177,9 @@
       }
     },
     "node_modules/total-recall-brain": {
-      "version": "3.45.0",
-      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.45.0.tgz",
-      "integrity": "sha512-HDYfROazZbsLHQsFPnlBcSpe1HL1QEi7JG8x/eNRUI06RxVQsZWl8LwBo2lTWjWRDrKmCy7BUmSXQDuWF3lrEw==",
+      "version": "3.47.0",
+      "resolved": "https://registry.npmjs.org/total-recall-brain/-/total-recall-brain-3.47.0.tgz",
+      "integrity": "sha512-S4UIdbbTyxw7C4+rix+7oHMm/6gYkcxwNBcP6kRDySX40p5IgqVTKgHk1n8rmaKiyYFoIX/HZHlHSjNrHgn0Gw==",
       "dev": true,
       "license": "MIT",
       "workspaces": [

package/scaffold/.agent/skills/total-recall/plugins/mesh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tr-plugin-mesh",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "type": "module",
   "description": "Headscale and Tailscale SSH control-server mesh administration and node discovery",
   "scripts": {
@@ -22,7 +22,8 @@
     "capability/",
     "src/",
     "!src/**/*.spec.mjs",
-    "!src/**/*.test.mjs"
+    "!src/**/*.test.mjs",
+    "skills/"
   ],
   "overrides": {
     "@ssss/cli": "npm:@gregiteen/ssss-cli@0.14.5"

package/scaffold/.agent/skills/total-recall/plugins/mesh/plugin.json

@@ -2,15 +2,16 @@
   "$schema": "https://github.com/gregiteen/total-recall/blob/main/metadata.plugin.schema.json",
   "id": "mesh",
   "name": "Headscale",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Control-server mesh administration, Tailscale SSH, and peer node discovery.",
   "license": "MIT",
-  "requires": [
-    {
-      "id": "auth",
-      "range": ">=1.2.1"
-    }
-  ],
+  "reuse": {
+    "commands": [
+      "total-recall auth secret",
+      "total-recall deploy status"
+    ],
+    "owned": "Control-server mesh administration, Headscale server provisioning/updates, Tailscale SSH, and peer node discovery."
+  },
   "branding": {
     "name": "Headscale",
     "color": "#818cf8",
@@ -59,11 +60,25 @@
     }
   ],
   "gate": {
-    "tasks": ["Run a command on another machine", "Copy a file to another machine", "Check or enroll machines on the mesh", "Mesh access, policy and the control server"],
+    "tasks": [
+      "Run a command on another machine",
+      "Copy a file to another machine",
+      "Check or enroll machines on the mesh",
+      "Mesh access, policy and the control server"
+    ],
     "owned_commands": [
-      { "pattern": "ssh\\s", "use": "total-recall mesh exec <node> \"<command>\"" },
-      { "pattern": "scp\\s", "use": "total-recall mesh file put <node> <source> <destination>" },
-      { "pattern": "tailscale\\s+(status|ping)\\b", "use": "total-recall mesh status" }
+      {
+        "pattern": "ssh\\s",
+        "use": "total-recall mesh exec <node> \"<command>\""
+      },
+      {
+        "pattern": "scp\\s",
+        "use": "total-recall mesh file put <node> <source> <destination>"
+      },
+      {
+        "pattern": "tailscale\\s+(status|ping)\\b",
+        "use": "total-recall mesh status"
+      }
     ]
   },
   "cli": {
@@ -181,8 +196,19 @@
         "effect": "write",
         "output": "json",
         "args": [
-          { "name": "ip", "type": "string", "label": "Mesh IPv4 address", "positional": true, "required": true },
-          { "name": "port", "flag": "--port", "type": "string", "label": "Leader port" }
+          {
+            "name": "ip",
+            "type": "string",
+            "label": "Mesh IPv4 address",
+            "positional": true,
+            "required": true
+          },
+          {
+            "name": "port",
+            "flag": "--port",
+            "type": "string",
+            "label": "Leader port"
+          }
         ]
       },
       {
@@ -544,5 +570,12 @@
       "parseChecksum",
       "consoleConfig"
     ]
-  }
+  },
+  "skills": [
+    {
+      "id": "mesh",
+      "path": "./skills/mesh/SKILL.md",
+      "description": "Control-server mesh administration, Tailscale SSH, and peer node discovery."
+    }
+  ]
 }

package/scaffold/.agent/skills/total-recall/plugins/mesh/skills/mesh/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: mesh
+description: "Control-server mesh administration, Tailscale SSH, and peer node discovery."
+version: 0.3.0
+repo_scoped: false
+---
+
+# Headscale
+
+Control-server mesh administration, Tailscale SSH, and peer node discovery.
+
+## When to Use
+
+Use the `mesh` Total Recall plugin (`total-recall mesh`) instead of ad-hoc scripts or raw commands whenever working on headscale tasks.
+
+## Commands
+
+```bash
+total-recall mesh --help
+total-recall mesh file  # Transfer a file through authenticated mesh access and verify its destination hash
+total-recall mesh status  # Inspect live mesh state
+total-recall mesh view  # Read independent owner observations for mesh screens
+total-recall mesh nodes  # Mesh nodes operation
+total-recall mesh doctor  # Mesh doctor operation
+total-recall mesh ssh  # Mesh ssh operation
+total-recall mesh exec  # Mesh exec operation
+total-recall mesh access  # Mesh access operation
+total-recall mesh ping  # Mesh ping operation
+total-recall mesh leader  # Read the elected leader and its server port
+total-recall mesh leader-pin  # Change the pinned leader address and optional server port
+total-recall mesh enroll  # Mesh enroll operation
+```
+
+## Owned Raw Commands
+
+This plugin owns: `ssh\s`, `scp\s`, `tailscale\s+(status|ping)\b`.

package/scaffold/.agent/skills/total-recall/plugins/meta-harness/cli.mjs

@@ -134,6 +134,7 @@ async function runOperation(argv) {
     ...Object.fromEntries([['goal', '--goal'], ['maxTurns', '--max-turns'], ['maxBudgetUsd', '--max-budget-usd'], ['maxTokens', '--max-tokens'],
       ['resultSchema', '--result-schema'], ['approvalPolicy', '--approvals'], ['questionTimeoutMs', '--question-timeout-ms']]
       .filter(([, flag]) => value(flag) !== undefined).map(([key, flag]) => [key, ['maxTurns', 'maxBudgetUsd', 'maxTokens', 'questionTimeoutMs'].includes(key) ? Number(value(flag)) : value(flag)])) });
+  const modelOption = () => (value('--model') === undefined ? {} : { model: value('--model') });
   let result;
   if (operation === 'status') result = {...await inspectNode(value('--node') || 'local'),documentation:documentationStatus()};
   else if (operation === 'catalog') result = { adapters: getActiveAdapters(), permissions: ['read', 'write', 'send', 'destructive'] };
@@ -176,7 +177,7 @@ async function runOperation(argv) {
   else if (operation === 'route') {
     const task = positional.join(' ');
     if (!task) throw new Error('route requires a task description');
-    const options = { ...controls(), jev: has('--jev'), preferLocal: has('--prefer-local'), preferFrontier: has('--prefer-frontier'), node: value('--node'), cwd: value('--cwd'), allowUnknownAuth: has('--allow-unknown-auth'), ...remoteTimeout() };
+    const options = { ...controls(), jev: has('--jev'), preferLocal: has('--prefer-local'), preferFrontier: has('--prefer-frontier'), node: value('--node'), cwd: value('--cwd'), allowUnknownAuth: has('--allow-unknown-auth'), ...modelOption(), ...remoteTimeout() };
     result = has('--execute') ? await executeRoutedTask(task, { ...options, gate: has('--gate'), gateOptions: { tier: value('--tier') || 'fast' } }) : await routeTask(task, options);
     if (!result.ok) process.exitCode = 1;
   }
@@ -192,7 +193,7 @@ async function runOperation(argv) {
     result = await coordinateTask(task, {
       ...controls(), mode: value('--mode') || 'pipeline', execute: has('--execute'), orchestrator: value('--orchestrator'), explorer: value('--explorer'), architect: value('--architect'), implementer: value('--implementer'), verifier: value('--verifier'),
       branch: value('--branch'), subagents: !has('--no-subagents'), autoReview: has('--auto-review'), gate: has('--gate'), gateOptions: { tier: value('--tier') || 'fast' }, allowSameFamily: has('--allow-same-family'), reviewer: value('--reviewer'),
-      node: value('--node') || 'local', cwd: value('--cwd'), allowUnknownAuth: has('--allow-unknown-auth'), ...remoteTimeout(),
+      node: value('--node') || 'local', cwd: value('--cwd'), allowUnknownAuth: has('--allow-unknown-auth'), ...modelOption(), ...remoteTimeout(),
     });
     if (!result.ok) process.exitCode = 1;
   }
@@ -399,7 +400,9 @@ async function runOperation(argv) {
   else if(operation==='dispatch') {
     if(!args.includes('--stdin'))throw new Error('Task requests must arrive through stdin: pass --stdin with JSON {agent, cwd, prompt}');
     const input=fs.readFileSync(0,'utf8');if(Buffer.byteLength(input)>65536)throw new Error('Task request too large');
-    const request=validateDispatchRequest({...JSON.parse(input),...controls()});
+    const body=JSON.parse(input);
+    if(value('--model')!==undefined && body?.model!==undefined && body.model!==value('--model'))throw new Error('--model and the request model differ; give the model once');
+    const request=validateDispatchRequest({...body,...controls(),...modelOption()});
     // A-107: a local dispatch streams its agent's events to a live log, announced before it starts.
     const progressFile=(request.node||'local')==='local'?path.join(configDir(),'jobs',`${process.env.TR_METAHARNESS_JOB || `dispatch-${Date.now().toString(36)}-${request.agent}`}.events.jsonl`):undefined;
     if(progressFile)console.error(JSON.stringify({progress:progressFile,agent:request.agent}));