fix(edge-worker): let repository.model win over the global default when no explicit model is requested

[yscivideo]

fix(edge-worker): let repository.model win over the global default when no explicit model is requested

The bug

The per-repository model config field is unreachable. RunnerSelectionService.determineRunnerSelection() always resolves modelOverride to a value — when no model label or [model=...] description tag is present, it fills in the global default (claudeDefaultModel || defaultModel || "opus"):

const resolvedModelOverride =
    modelOverride ||
    defaultModelByRunner[runnerType] ||
    this.getDefaultModelForRunner(runnerType);

Then in RunnerConfigBuilder.buildIssueConfig():

const finalModel =
    modelOverride ||            // ← always set, so…
    input.repository.model ||   // ← …this can never win
    this.runnerSelector.getDefaultModelForRunner(runnerType);

The comment on the config says // Priority order: label override > repository config > global default, but in practice the repository tier is dead code. The same applies to repository.fallbackModel (shadowed by the always-inferred fallbackModelOverride).

Real-world symptom: a self-hosted user pins "model": "claude-opus-4-8" (or any model) on a repository, configures no global default, and every session still launches with the bare alias "opus" — which the bundled SDK resolves to whatever it considers latest, silently ignoring the pin. The Linear timeline shows Using model: claude-opus-4-7 while the config says otherwise.

The fix

determineRunnerSelection() now returns modelOverride / fallbackModelOverride only when a model was explicitly requested (label or description tag). When nothing explicit is present it returns undefined for both, letting the existing precedence chain in buildIssueConfig() work as documented:

• model: explicit label/tag → repository.model → global default (unchanged expression, now reachable).
• fallbackModel: explicit override → repository.fallbackModel (newly reachable, mirroring the fix) → inferred from the final model via inferFallbackModel() (extracted to a public method; preserves the existing behavior where a customized default primary steps its fallback down, e.g. default sonnet → fallback haiku) → runner-default fallback.

The four resume-runner-switch branches in buildIssueConfig() (labels changed on an existing session) now clear their overrides instead of re-filling with the switched-to runner's default, so repository.model also resolves on continuation turns — safe because the compatibility gate below blocks any foreign-runner repository model from leaking into a resumed session (covered by a dedicated regression test).

Cross-runner safety

An agent-only selector (label codex/gemini/cursor or [agent=...] tag) with no model tag would otherwise fall through to repository.model, handing e.g. a Claude model string to a Codex runner. buildIssueConfig therefore gates repository.model / repository.fallbackModel by runner compatibility (via the extracted inferRunnerFromModel): a value is applied only when its inferred runner is unknown (custom/proxy model names still pass) or matches the resolved runner; incompatible values are skipped with a debug log and the runner default applies. Cursor is special-cased: it legitimately runs GPT model ids, so codex-inferred models stay compatible on a cursor runner. Covered by regression tests for the codex/gemini label, [agent=codex] tag, cursor+GPT, and resume-switch cases.

Behavior change

One existing expectation changes: when an explicit model label conflicts with the resolved runner type (e.g. labels ["claude", "gpt-5-codex"]), the conflicting model is reset and modelOverride is now undefined (previously the global default) — the final model then resolves through repository.model / global default downstream, same effective model when no repo pin exists.

Tests

• Selector: no labels/tags → both overrides undefined; explicit labels still resolve as before.
• Builder precedence (wired through the real RunnerSelectionService): no label + repository.model set → repo model wins; explicit label + repository.model set → label wins; neither → global default.
• Fallback: customized default primary with no explicit anything → fallback is inferred from the final model (not the hardcoded runner literal), so the fallback can no longer silently equal the primary.

pnpm test:packages green (747/747 in edge-worker), pnpm typecheck clean, pnpm lint clean on touched files.

Known follow-up (out of scope here)

inferFallbackModel() matches bare aliases (fable/opus/sonnet/haiku) but not full versioned IDs, so a repository.model like "claude-fable-5" gets the generic claude fallback (sonnet) rather than the one-tier-down opus. The fallback is always a valid same-provider model, so this is a quality nit, not a safety issue — a natural follow-up is prefix-matching in inferFallbackModel's claude branch, mirroring what inferRunnerFromModel already does.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AAAaJDxxUWmhtYySCfSQHD