feat(joe): pick Agent Joe's model from the composer (#599)

Joe's session was created without a --model flag, so it ran on whatever the
Claude CLI defaulted to — no way to move it without editing code. It now has
the same model control a session has.

The choice cannot live on the session: Joe's session is recreated on demand.
It is stored as the archive setting `agent_model`, written by the set_model
handler and read when the session is created or restarted. With no explicit
choice Joe follows the latest known Claude model, so it stops being stranded
on whatever was newest the day its session was created. A live process keeps
its model until setModel() restarts it.

On the client the model half of the agent control is no longer suppressed for
the orchestrator variant; the harness half stays hidden, since Joe is
Claude-only. That also forces activeSessionProvider to 'claude' in the
orchestrator view — Joe's session is not in the sessions list, so the old
fallback used the default new-session provider, and a Codex/OpenCode default
would have pushed a foreign model onto Joe's Claude process.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: alari76

docs/ORCHESTRATOR-SPEC.md

@@ -110,6 +110,14 @@ Agent Joe is a `ClaudeProcess` session with:
 - `permissionMode: 'acceptEdits'` (it needs to read reports, write memory, spawn sessions)
 - Working directory: `~/.codekin/orchestrator/` (its own workspace)
 
+**Model**: picked from the model control in Joe's composer, exactly as in a
+regular session. Because Joe's session is recreated on demand, the choice is
+stored outside it — archive setting `agent_model`, written by the `set_model`
+WebSocket handler and read by `ensureOrchestratorRunning`. With no explicit
+choice, Joe tracks the latest known Claude model (`getDefaultClaudeModel()`),
+so it is never stranded on whatever was newest the day its session was created.
+A model change restarts Joe's CLI process, like it does for a session.
+
 Methods exposed by `SessionManager`:
 ```typescript
 // In session-manager.ts

server/orchestrator-manager.test.ts

@@ -26,6 +26,10 @@ vi.mock('./config.js', () => ({
   getAgentDisplayName: () => 'TestAgent',
 }))
 
+vi.mock('./anthropic-models.js', () => ({
+  getDefaultClaudeModel: () => 'claude-latest-test',
+}))
+
 import {
   ORCHESTRATOR_DIR,
   ensureOrchestratorDir,
@@ -34,17 +38,23 @@ import {
   ensureOrchestratorRunning,
   ensureOrchestratorMcpConfig,
   getOrchestratorSessionId,
+  getOrchestratorModel,
+  setOrchestratorModel,
   readTemplateVersion,
   CLAUDE_MD_TEMPLATE_VERSION,
   ORCHESTRATOR_ALLOWED_TOOLS,
 } from './orchestrator-manager.js'
 
-function fakeSessionManager(existingSession?: any) {
+function fakeSessionManager(existingSession?: any, settings: Record<string, string> = {}) {
   return {
     get: vi.fn((id: string) => existingSession && existingSession.id === id ? existingSession : undefined),
     create: vi.fn((_name: string, _dir: string, opts?: any) => ({ id: opts?.id ?? 'new-id', ...opts })),
     startClaude: vi.fn(),
     persistToDisk: vi.fn(),
+    archive: {
+      getSetting: vi.fn((key: string, fallback = '') => settings[key] ?? fallback),
+      setSetting: vi.fn((key: string, value: string) => { settings[key] = value }),
+    },
   } as any
 }
 
@@ -213,11 +223,64 @@ describe('ensureOrchestratorRunning', () => {
         id: 'test-uuid-1234',
         permissionMode: 'acceptEdits',
         allowedTools: ORCHESTRATOR_ALLOWED_TOOLS,
+        model: 'claude-latest-test',
       }),
     )
     expect(sm.startClaude).toHaveBeenCalledWith('test-uuid-1234')
   })
 
+  it('creates the session with the stored model when one was chosen', () => {
+    mockExistsSync.mockReturnValue(false)
+
+    const sm = fakeSessionManager(undefined, { agent_model: 'claude-sonnet-5' })
+    ensureOrchestratorRunning(sm)
+
+    expect(sm.create).toHaveBeenCalledWith(
+      'Agent TestAgent',
+      '/tmp/test-data/orchestrator',
+      expect.objectContaining({ model: 'claude-sonnet-5' }),
+    )
+  })
+
+  it('adopts the stored model when restarting a stopped session', () => {
+    mockExistsSync.mockImplementation((p: string) =>
+      typeof p === 'string' && p.endsWith('.session-id') ? true : false,
+    )
+    mockReadFileSync.mockReturnValue('test-uuid-1234')
+
+    const session = {
+      id: 'test-uuid-1234',
+      model: 'claude-opus-4-7',
+      allowedTools: ['Bash(curl:*)', 'CronCreate', 'CronDelete', 'CronList'],
+      claudeProcess: { isAlive: () => false },
+    }
+    const sm = fakeSessionManager(session, { agent_model: 'claude-sonnet-5' })
+    ensureOrchestratorRunning(sm)
+
+    expect(session.model).toBe('claude-sonnet-5')
+    expect(sm.persistToDisk).toHaveBeenCalled()
+    expect(sm.startClaude).toHaveBeenCalledWith('test-uuid-1234')
+  })
+
+  it('leaves a live session on the model its process was started with', () => {
+    mockExistsSync.mockImplementation((p: string) =>
+      typeof p === 'string' && p.endsWith('.session-id') ? true : false,
+    )
+    mockReadFileSync.mockReturnValue('test-uuid-1234')
+
+    const session = {
+      id: 'test-uuid-1234',
+      model: 'claude-opus-4-7',
+      allowedTools: ['Bash(curl:*)', 'CronCreate', 'CronDelete', 'CronList'],
+      claudeProcess: { isAlive: () => true },
+    }
+    const sm = fakeSessionManager(session, { agent_model: 'claude-sonnet-5' })
+    ensureOrchestratorRunning(sm)
+
+    expect(session.model).toBe('claude-opus-4-7')
+    expect(sm.startClaude).not.toHaveBeenCalled()
+  })
+
   it('restarts Claude when session exists but process not alive', () => {
     // Make the session-id file exist with our stable ID
     mockExistsSync.mockImplementation((p: string) =>
@@ -320,6 +383,25 @@ describe('ensureOrchestratorMcpConfig', () => {
   })
 })
 
+describe('orchestrator model preference', () => {
+  it('falls back to the latest known Claude model when unset', () => {
+    const sm = fakeSessionManager()
+    expect(getOrchestratorModel(sm)).toBe('claude-latest-test')
+  })
+
+  it('returns the stored choice when set', () => {
+    const sm = fakeSessionManager(undefined, { agent_model: 'claude-opus-5' })
+    expect(getOrchestratorModel(sm)).toBe('claude-opus-5')
+  })
+
+  it('round-trips a saved choice', () => {
+    const sm = fakeSessionManager()
+    setOrchestratorModel(sm, 'claude-fable-5')
+    expect(sm.archive.setSetting).toHaveBeenCalledWith('agent_model', 'claude-fable-5')
+    expect(getOrchestratorModel(sm)).toBe('claude-fable-5')
+  })
+})
+
 describe('getOrchestratorSessionId', () => {
   it('returns null when no ID file exists', () => {
     mockExistsSync.mockReturnValue(false)

server/orchestrator-manager.ts

@@ -11,11 +11,15 @@ import { fileURLToPath } from 'url'
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs'
 import { randomUUID } from 'crypto'
 import { DATA_DIR, AGENT_DISPLAY_NAME, getAgentDisplayName } from './config.js'
+import { getDefaultClaudeModel } from './anthropic-models.js'
 import type { SessionManager } from './session-manager.js'
 
 export const ORCHESTRATOR_DIR = join(DATA_DIR, 'orchestrator')
 const SESSION_ID_FILE = join(ORCHESTRATOR_DIR, '.session-id')
 
+/** Archive settings key holding the user's explicit model choice for the agent. */
+const MODEL_SETTING_KEY = 'agent_model'
+
 const PROFILE_TEMPLATE = `# User Profile
 
 Agent ${AGENT_DISPLAY_NAME} will learn about you over time and update this file.
@@ -474,6 +478,23 @@ export function isOrchestratorSession(source: string | undefined): boolean {
   return source === 'orchestrator'
 }
 
+/**
+ * The model the orchestrator runs on. An explicit choice (made from the chat
+ * composer) wins; otherwise the agent tracks the latest known Claude model, so
+ * it never gets stranded on whatever was newest when the session was created.
+ */
+export function getOrchestratorModel(sessions: SessionManager): string {
+  return sessions.archive.getSetting(MODEL_SETTING_KEY, '') || getDefaultClaudeModel()
+}
+
+/**
+ * Persist the orchestrator's model choice. The session itself is recreated on
+ * demand, so the preference has to live outside it.
+ */
+export function setOrchestratorModel(sessions: SessionManager, model: string): void {
+  sessions.archive.setSetting(MODEL_SETTING_KEY, model)
+}
+
 /**
  * Ensure the orchestrator session exists and is running.
  * Creates it if missing, starts Claude if not alive.
@@ -483,6 +504,8 @@ export function ensureOrchestratorRunning(sessions: SessionManager): string {
   ensureOrchestratorDir()
   const stableId = getOrCreateOrchestratorId()
 
+  const model = getOrchestratorModel(sessions)
+
   // Check if session already exists
   const existing = sessions.get(stableId)
   if (existing) {
@@ -495,6 +518,13 @@ export function ensureOrchestratorRunning(sessions: SessionManager): string {
     }
     // Session exists — start Claude if not alive
     if (!existing.claudeProcess?.isAlive()) {
+      // Adopt the stored/latest model on the way back up. Only safe while the
+      // process is down: a live process is already bound to its --model flag,
+      // and setModel() is the path that restarts it.
+      if (existing.model !== model) {
+        existing.model = model
+        sessions.persistToDisk()
+      }
       console.log('[orchestrator] Restarting orchestrator Claude process')
       sessions.startClaude(stableId)
     }
@@ -509,6 +539,7 @@ export function ensureOrchestratorRunning(sessions: SessionManager): string {
     id: stableId,
     permissionMode: 'acceptEdits',
     allowedTools: ORCHESTRATOR_ALLOWED_TOOLS,
+    model,
   })
 
   // Start Claude

server/ws-message-handler.test.ts

@@ -4,6 +4,14 @@ import { describe, it, expect, vi, beforeEach } from 'vitest'
 // Mock config so REPOS_ROOT covers test paths
 vi.mock('./config.js', () => ({ REPOS_ROOT: '/projects' }))
 
+// The orchestrator manager reads DATA_DIR from the (mocked) config at import
+// time, so stub it out — only the two model helpers are used here.
+const setOrchestratorModelMock = vi.hoisted(() => vi.fn())
+vi.mock('./orchestrator-manager.js', () => ({
+  isOrchestratorSession: (source: string | undefined) => source === 'orchestrator',
+  setOrchestratorModel: setOrchestratorModelMock,
+}))
+
 // Mock fs.realpathSync — defaults to identity (no real filesystem); individual
 // tests can override the implementation to simulate symlink canonicalization.
 const realpathSyncMock = vi.fn((p: string) => p)
@@ -447,6 +455,22 @@ describe('handleWsMessage', () => {
 
       expect(ctx.sessions.setModel).not.toHaveBeenCalled()
     })
+
+    it('does not persist a preference for an ordinary session', () => {
+      handleWsMessage({ type: 'set_model', model: 'claude-sonnet-4-6' } as WsClientMessage, ctx)
+
+      expect(setOrchestratorModelMock).not.toHaveBeenCalled()
+    })
+
+    it('persists the choice when the session is the orchestrator', () => {
+      const orchestrator = mockSession({ source: 'orchestrator' })
+      ;(ctx.sessions.get as ReturnType<typeof vi.fn>).mockReturnValue(orchestrator)
+
+      handleWsMessage({ type: 'set_model', model: 'claude-opus-5' } as WsClientMessage, ctx)
+
+      expect(ctx.sessions.setModel).toHaveBeenCalledWith('sess-1', 'claude-opus-5')
+      expect(setOrchestratorModelMock).toHaveBeenCalledWith(ctx.sessions, 'claude-opus-5')
+    })
   })
 
   /* ---- set_permission_mode ---- */

server/ws-message-handler.ts

@@ -11,6 +11,7 @@ import { resolve as pathResolve } from 'path'
 import type { WebSocket } from 'ws'
 import { getDefaultClaudeModel, triggerCliProbeIfNeeded } from './anthropic-models.js'
 import { REPOS_ROOT } from './config.js'
+import { isOrchestratorSession, setOrchestratorModel } from './orchestrator-manager.js'
 import type { SessionManager } from './session-manager.js'
 import { VALID_PERMISSION_MODES, VALID_PROVIDERS } from './types.js'
 import type { WsClientMessage, WsServerMessage } from './types.js'
@@ -200,6 +201,11 @@ export function handleWsMessage(msg: WsClientMessage, ctx: WsHandlerContext): vo
           break
         }
         sessions.setModel(sessionId, msg.model)
+        // The orchestrator's model is a standing preference, not a per-session
+        // one — its session is recreated on demand, so persist the choice.
+        if (isOrchestratorSession(sessions.get(sessionId)?.source)) {
+          setOrchestratorModel(sessions, msg.model)
+        }
       }
       break
     }

src/App.tsx

@@ -260,8 +260,13 @@ export default function App({ onSwitchMachine, onDisconnectMachine }: AppProps =
   const [claudeDisabled, setClaudeDisabled] = useState(false)
   const [openCodeDisabled, setOpenCodeDisabled] = useState(false)
   const [codexDisabled, setCodexDisabled] = useState(false)
-  // Derive the active session's provider (falls back to the default for new sessions)
-  const activeSessionProvider = sessions.find(s => s.id === activeSessionId)?.provider ?? currentProvider
+  // Derive the active session's provider (falls back to the default for new
+  // sessions). The orchestrator session is not in `sessions`, and it always
+  // runs on Claude — without this the fallback would hand it another
+  // provider's model list.
+  const activeSessionProvider = view === 'orchestrator'
+    ? 'claude'
+    : sessions.find(s => s.id === activeSessionId)?.provider ?? currentProvider
 
   const activeOpenCodeWd = activeSessionProvider === 'opencode'
     ? sessions.find(s => s.id === activeSessionId)?.workingDir
@@ -763,6 +768,9 @@ export default function App({ onSwitchMachine, onDisconnectMachine }: AppProps =
             slashCommands={allCommands}
             currentModel={currentModel}
             onModelChange={handleModelChange}
+            /* Claude models, not availableModels: the orchestrator always runs
+               on Claude, while availableModels follows the default provider. */
+            availableModels={claudeModels}
             currentPermissionMode={currentPermissionMode}
             onPermissionModeChange={handlePermissionModeChange}
             disabled={!settings.token}

src/components/InputBar.tsx

@@ -668,7 +668,10 @@ export const InputBar = forwardRef<InputBarHandle, InputBarProps>(function Input
   // Session state (left) and actions (right). The orchestrator variant is a
   // filter over these plus an accent flag — not a second layout.
   const showPermission = !isOrchestrator && !!currentPermissionMode && !!onPermissionModeChange
-  const showModel = !isOrchestrator && !!currentModel && !!onModelChange
+  // The orchestrator keeps its model picker — it is one agent, so "what is
+  // answering me" is as much a question there as in a session. Its harness is
+  // fixed to Claude, so only the model half of the control applies.
+  const showModel = !!currentModel && !!onModelChange
   const showProvider = !isOrchestrator && !!sessionProvider && !!onProviderChange
   // Harness and model read as one fact ("what is answering me"), so they share
   // one control; it appears as soon as either half is known.

src/components/OrchestratorContent.tsx

@@ -39,6 +39,8 @@ export interface OrchestratorContentProps {
   slashCommands: SlashCommand[]
   currentModel: string | null
   onModelChange: (model: string) => void
+  /** Claude models offered in the composer — the orchestrator is Claude-only. */
+  availableModels?: import('../types').ModelOption[]
   currentPermissionMode: PermissionMode
   onPermissionModeChange: (mode: PermissionMode) => void
   disabled: boolean
@@ -68,6 +70,7 @@ export function OrchestratorContent({
   slashCommands,
   currentModel,
   onModelChange,
+  availableModels,
   currentPermissionMode,
   onPermissionModeChange,
   disabled,
@@ -127,6 +130,7 @@ export function OrchestratorContent({
             onValueChange={() => {}}
             currentModel={currentModel}
             onModelChange={onModelChange}
+            availableModels={availableModels}
             isMobile={isMobile}
             currentPermissionMode={currentPermissionMode}
             onPermissionModeChange={onPermissionModeChange}