@kontextmind/kxm 0.7.201 → 0.7.203

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.201",
+      "version": "0.7.203",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/CHANGELOG.md

@@ -225,6 +225,26 @@ All notable user-facing changes are documented here. The project follows [Semant
 
 ### Changed
 
+- **OpenRouter GLM 5.3 Flash is $0.15 / $0.50 again.**
+  Checked 2026-10-21 against `https://openrouter.ai/api/v1/models`
+  (`z-ai/glm-5.3-flash`: prompt `0.00000015`, completion `0.0000005`,
+  cache read `0.00000003`). `openrouter/z-ai/glm-5.3-flash` moves from
+  $0.047076 input and $0.12 output (cache read $0.006) to $0.15 input and
+  $0.50 output (cache read $0.03) per 1M tokens. The coding-plan row
+  `zai-coding-cn/glm-5.3-flash` keeps its own tier at $0.15 / $0.50 (cache
+  read $0.03). This list price is volatile
+  and has flipped between those two tiers for several days. Trust the weekly
+  OpenRouter refresh over the static row. The inventory `standard` rates for
+  `z-ai/glm-5.3-flash` match. `.kxm/prices.yaml` is dated 2026-10-21.
+- **`kxm vision assert` defaults to the admitted OpenRouter GLM route.**
+  The built-in route is `openrouter/z-ai/glm-5.3-flash`, invoked as
+  `pi --model openrouter/z-ai/glm-5.3-flash`. The old default
+  `zai-coding-cn/glm-5.3-flash` is not allowlisted, and that id no longer
+  has a special argv. `kxm init` admits the vision route and does not add
+  a model file or a roster entry for it. A live accuracy witness is
+  `test/core/vision-accuracy.test.ts`. It calls Pi only when
+  `OPENROUTER_API_KEY` is set; otherwise it checks
+  `test/fixtures/vision/` and does not use the network.
 - **`kxm init` starts the writer on Grok 4.7.** The starter model file is
   `.kxm/models/grok-grok-4-7.yaml` (`grok` / `grok-4.7`, selector
   `xai/grok-4.7`, alias `grok-default`). The writer roster, the built-in

package/docs/audits/2026-10-gap-audit.md

@@ -17,7 +17,7 @@ Each fix is a small pull request with squash auto-merge. None of them needs a se
 
 `kxm suggest` used to treat a keyword as a substring. "guide" and "build" took the feature workflow because they contain `ui`, "author" took vulnerability remediation because it contains `auth`, and "change" took bug-fix because it contains `hang`. Hyphenated keywords such as `circuit-breaker` still match as one token. A prompt with no keyword still selects `feature-implementation` at score 0.
 
-`kxm vision assert` accepted `--route` and then ignored it. The flag now selects that Pi model after admission. An unknown route names `kxm routes admit`. A native-vendor id is refused before `pi` starts. The CLI reference documents the command. The built-in default route is unchanged. See decision 2.
+`kxm vision assert` accepted `--route` and then ignored it. The flag now selects that Pi model after admission. An unknown route names `kxm routes admit`. A native-vendor id is refused before `pi` starts. The CLI reference documents the command. That pull request left the built-in default route unchanged. Decision 2 changes it.
 
 `kxm init` outside any Git worktree now says to run `git init` and then `kxm init` again. A directory that is not the worktree root still says to run from that root. `kxm hub view` says to start the hub when nothing is listening on a loopback URL, and names the tunnel and `kxm hub bind` for any other URL. An auth proxy or redirect keeps its existing probe note.
 
@@ -66,9 +66,7 @@ Observed on 2026-10-21, before the runner split:
 
 ### 2. The built-in vision route
 
-`kxm vision assert` still defaults to `zai-coding-cn/glm-5.3-flash` and, for that id only, still runs `pi --provider zai-coding-cn --model glm-5.3-flash`. `.kxm/routes.yaml` removed `zai-coding-cn/*` on 2026-09-27 because that provider is not allowlisted. The admitted replacement in this checkout is `openrouter/z-ai/glm-5.3-flash`. A vision call here with no `--route` still fail-closes, and pull request #412 names `kxm routes admit` in that message. `kxm init` does not admit a vision route.
-
-Changing the default needs a vision accuracy witness on the admitted id. This pass kept the verified default argv.
+Approved 2026-10-21 in [pull request #419](https://github.com/kontextmind/kxm/pull/419). `kxm vision assert` defaults to `openrouter/z-ai/glm-5.3-flash` and runs `pi --model <id>` for every route, including that default. `zai-coding-cn/glm-5.3-flash` no longer has a special argv. `kxm init` admits the vision selector and does not write a model file for it. The accuracy witness is `test/fixtures/vision/` and `test/core/vision-accuracy.test.ts`. That test calls Pi only when `OPENROUTER_API_KEY` is set.
 
 ### 3. The starter writer model
 

package/docs/contributing/decisions.md

@@ -2,7 +2,7 @@
 title: "Decisions"
 description: "Decisions of medium significance or higher made by automated KXM work in this repository. One entry per decision: the options evaluated with their weights, and why the selected option won. Recorded the turn the decision is taken."
 audience: "agents and maintainers"
-updated: "2026-10-11"
+updated: "2026-10-21"
 ---
 
 # Decisions
@@ -229,3 +229,26 @@ Evidence: `plugins/kxm/src/cli/plugins.ts`, `plugins/kxm/src/session-work.ts`, a
   unverified gate.
 Evidence: `plans/implementation-plan.md`, `plans/plan-python-migration.md`,
 `python/kxm-control/tests/test_mg1.py`, and `.github/workflows/ci.yml`.
+
+## 2026-10-21 — How `kxm init` admits the vision route (routing)
+
+- Context: Eddie approved moving `kxm vision assert` to
+  `openrouter/z-ai/glm-5.3-flash` and asked `kxm init` to admit that route
+  when the change stays small. The gate checks `.kxm/routes.yaml` only.
+  Workforce lint treats an admitted selector with no model file as a warning
+  (`admitted_unrouted`), and a model file that no roster names as an error
+  (`route_unused`).
+- Options:
+  - Admit the selector and skip the model file — weight 0.9. Vision works
+    on a fresh project, and dispatch rosters stay the writer and the planner.
+    The warning does not fail init or `workforce lint`.
+  - Add a model file and put it on a roster — weight 0.3. Clears the warning,
+    but it also makes GLM a dispatch candidate for whichever role receives it.
+  - Leave init unchanged — weight 0.2. A new project still fail-closes on the
+    new default until someone admits the route by hand.
+- Selected: admit the selector only. No model file, no roster entry.
+- Solid recommendation: when a vision role exists, give the route its own
+  read-only model file and roster so the warning goes away without sharing
+  the writer.
+- Interim recommendation: the admitted selector is enough for `kxm vision assert`.
+Evidence: `plugins/kxm/src/template.ts`, `plugins/kxm/src/workforce-names.mjs`, and `test/core/vision-gate.test.ts`.

package/docs/contributing/harness-routing-internals.md

@@ -76,7 +76,7 @@ On the capture machine, `kxm harness list` showed `claude` detected but logged o
 
 ### Price catalog and inventory
 
-`.kxm/prices.yaml` is dated `2026-10-20`. A run on that date can record a list estimate. Any other day records `providerMetadata.priceCatalogStale: true` and no list estimate. The list prices below come from `.kxm/models/inventory.yaml`. OpenRouter and Nous were fetched at `2026-10-17T13:45:00.000Z`. `pi`, `grok`, and `agy` were not installed for that refresh, so models that exist only in those CLIs stay, including the previous `agy` rows, and the Gemini 4 Argon and Claude 5.5 `agy` rows were added by hand from `agy models`. Prices are USD per 1M tokens. The checkout has no routing records yet, so none of the examples has recorded latency; for latency, run a bounded side-by-side experiment and compare p50 and p95 in `kxm routing report`.
+`.kxm/prices.yaml` is dated `2026-10-21`. A run on that date can record a list estimate. Any other day records `providerMetadata.priceCatalogStale: true` and no list estimate. The list prices below come from `.kxm/models/inventory.yaml`. OpenRouter and Nous were fetched at `2026-10-17T13:45:00.000Z`. The `z-ai/glm-5.3-flash` standard tier was set from the OpenRouter models API on 2026-10-21 ($0.15 input, $0.50 output, $0.03 cache read). Its Nous discount tier is still the 2026-10-17 rate. `pi`, `grok`, and `agy` were not installed for that refresh, so models that exist only in those CLIs stay, including the previous `agy` rows, and the Gemini 4 Argon and Claude 5.5 `agy` rows were added by hand from `agy models`. Prices are USD per 1M tokens. The checkout has no routing records yet, so none of the examples has recorded latency; for latency, run a bounded side-by-side experiment and compare p50 and p95 in `kxm routing report`.
 
 ## The developer roster
 
@@ -182,7 +182,7 @@ The code differs from that decision: `.kxm/routes.yaml` admits `google/gemini-3.
 |---|---|---|---|
 | Qwen3.8 Flash | `qwen-token-plan/qwen3.8-flash`: removed from the admitted list on 2026-09-27; `qwen-token-plan` is not allowlisted | `openrouter/qwen/qwen3.8-flash`: admitted, route `pi-qwen3-8-flash-openrouter`, read-only fallback for planner and reviewer-cli | `prices.yaml` keeps both rows. |
 | Qwen3.7 Plus | none | `openrouter/qwen/qwen3.7-plus`: route `pi-qwen3-7-plus-openrouter`, writer #2 | The only admitted Pi writer: exact model, `edit` permission. OpenRouter list on 2026-10-17 is $0.32 input and $1.28 output per 1M tokens, 1,000,000 context, tools supported. |
-| GLM 5.3 and 5.3 Flash | `zai-coding-cn/glm-5.3` and `…/glm-5.3-flash`: removed from the admitted list on 2026-09-27; `zai-coding-cn` is not allowlisted. The flash coding-plan row keeps $0.15 / $0.50 (cache read $0.03). `zai-coding-cn/glm-5.3` output is $1.40 | `openrouter/z-ai/glm-5.3-flash`: admitted, route `pi-glm-5-3-flash-openrouter`, read-only fallback for reviewer-arch. Its own tier, verified 2026-10-20: $0.047076 input, $0.12 output, $0.006 cache read | Z.ai has no native harness. The two flash rows do not share a YAML anchor. |
+| GLM 5.3 and 5.3 Flash | `zai-coding-cn/glm-5.3` and `…/glm-5.3-flash`: removed from the admitted list on 2026-09-27; `zai-coding-cn` is not allowlisted. The flash coding-plan row keeps $0.15 / $0.50 (cache read $0.03). `zai-coding-cn/glm-5.3` output is $1.40 | `openrouter/z-ai/glm-5.3-flash`: admitted, route `pi-glm-5-3-flash-openrouter`, read-only fallback for reviewer-arch. Its own tier, verified 2026-10-21: $0.15 input, $0.50 output, $0.03 cache read. This list price is volatile and has flipped with $0.047076 / $0.12 / $0.006 for several days; trust the weekly refresh over the static row | Z.ai has no native harness. The two flash rows do not share a YAML anchor. |
 | DeepSeek V4.1 Flash | `qwen-token-plan/deepseek-v4.1-flash`: removed from the admitted list on 2026-09-27 | `deepseek/deepseek-v4.1-flash` in the OpenRouter feed | Bills a DeepSeek model through Alibaba's plan. `deepseek` is a native-vendor Pi brake, so this is not a route. |
 
 The developer runner is stricter. Its only Pi writer is `openrouter/qwen/qwen3.7-plus`, and it does not allowlist `qwen-token-plan` or `zai-coding-cn`. Today OpenRouter is the right answer here for Qwen3.7 Plus, Qwen3.8 Flash and GLM 5.3 Flash. `qwen/qwen3-coder-plus` is retired.

package/docs/reference/cli-reference.md

@@ -922,13 +922,13 @@ kxm vision assert --image <path> --question <text> [--route <id>] [--timeout-ms
 |---|---|---|---|
 | `--image` | `<path>` | required | Screenshot file. A missing file fails closed with `image unreadable` |
 | `--question` | `<text>` | required | Yes/no assertion, trimmed to 500 characters inside the prompt |
-| `--route` | `<id>` | `zai-coding-cn/glm-5.3-flash` | Admitted route id. The default keeps the verified Pi command `--provider zai-coding-cn --model glm-5.3-flash`. Any other id is `pi --model <id>` after the native-vendor brake |
+| `--route` | `<id>` | `openrouter/z-ai/glm-5.3-flash` | Admitted route id. Pi is invoked as `pi --model <id>` after the native-vendor brake |
 | `--timeout-ms` | `<n>` | `90000` | Integer from 5000 through 300000 |
 | `--expect` | `true` or `false` | none | Exit 0 only when the verdict equals this value |
 
 - Global options apply, except `--dry-run`, which exits 2 with `dry_run_unsupported` because the command calls Pi.
-- The route must be listed under `admitted` in `.kxm/routes.yaml`. Otherwise the command exits 1 and the `divergence` names the id and `kxm routes admit --model <id>`.
-- This repository does not admit the default `zai-coding-cn/glm-5.3-flash` (`zai-coding-cn` is not an allowlisted harness). Pass `--route openrouter/z-ai/glm-5.3-flash`, which is admitted here, or admit the route you pass.
+- The route must be listed under `admitted` in `.kxm/routes.yaml`. Otherwise the command exits 1 and the `divergence` names the id and `kxm routes admit --model <id>`. `kxm init` admits the default. This repository already admits `openrouter/z-ai/glm-5.3-flash`.
+- A live accuracy witness for that id is `test/fixtures/vision/manifest.json` plus `test/core/vision-accuracy.test.ts`. It calls Pi only when `OPENROUTER_API_KEY` is set. Otherwise it checks the fixture set and does not call the network. Run it with `node --disable-warning=ExperimentalWarning --experimental-strip-types --test --test-force-exit test/core/vision-accuracy.test.ts`.
 - A native-vendor id such as `xai/grok-4.7` or `anthropic/fable` is refused before Pi starts, even when that id is admitted. The `divergence` is the Pi brake message.
 - Exit 0 when the verdict resolves and, if `--expect` is set, matches it. Exit 1 for a fail-closed divergence. Exit 2 when `--image` or `--question` is missing, `--expect` is not `true` or `false`, or `--timeout-ms` is not an integer.
 - JSON keys: `ok`, `command` (`vision assert`), `verdict` (`true`, `false`, or `null`), `route`, `raw`, `divergence` when the gate fails closed, and `expect` when `--expect` is set.

package/docs/reference/config-reference.md

@@ -398,8 +398,10 @@ resultSchema: kxm.assignment-result.v1
 
 `kxm init` creates `planner` (`role: planner`, alias `coordinator`) and `writer`
 (`role: writer`, alias `implementer`) without `harness` or `model`, and admits
-`anthropic/fable` and `xai/grok-4.7` in `.kxm/routes.yaml`. The model files are
-`claude-fable` and `grok-grok-4-7`. An interactive `kxm init` can add
+`anthropic/fable`, `xai/grok-4.7`, and the vision route
+`openrouter/z-ai/glm-5.3-flash` in `.kxm/routes.yaml`. The model files are
+`claude-fable` and `grok-grok-4-7`. The vision route has no model file and is
+not a roster entry. An interactive `kxm init` can add
 workflow-guide agents for reviewed pairs whose harness is authenticated, and
 admits their selectors too, but skips Google guide candidates because the
 Runtime cannot reach the `antigravity` Pi provider yet. `kxm run` and the

package/docs/start/first-workflow.md

@@ -258,7 +258,7 @@ The file is a `kxm.workflow.v1` definition. `coordinator` names the agent that o
 
 ### Why start with `first` and not `default`
 
-`kxm init` also writes a `default` workflow. Its coordinator plans on `claude` / `anthropic/fable`, its implementer writes the checkout on `grok` / `xai/grok-4.7`, and a `test` gate runs `npm test`; `kxm init` admits exactly those two models in `.kxm/routes.yaml`. You can drive it, but even a simulated drive runs `npm test` in your checkout, and a live drive spends both subscriptions and passes the implement step only when Grok changes the checkout. `first` calls no model and runs no command, so it is the safer first run. [Steps the Runtime does not execute yet](../reference/config-reference.md#steps-the-runtime-does-not-execute-yet) lists every setting that makes a drive hand the run off.
+`kxm init` also writes a `default` workflow. Its coordinator plans on `claude` / `anthropic/fable`, its implementer writes the checkout on `grok` / `xai/grok-4.7`, and a `test` gate runs `npm test`. `kxm init` admits those two models and the vision route `openrouter/z-ai/glm-5.3-flash` in `.kxm/routes.yaml`. The vision id has no model file and is not on a roster. You can drive it, but even a simulated drive runs `npm test` in your checkout, and a live drive spends both subscriptions and passes the implement step only when Grok changes the checkout. `first` calls no model and runs no command, so it is the safer first run. [Steps the Runtime does not execute yet](../reference/config-reference.md#steps-the-runtime-does-not-execute-yet) lists every setting that makes a drive hand the run off.
 
 ### Two kinds of runs
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.201",
+  "version": "0.7.203",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.201",
+  "version": "0.7.203",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/cli.js

@@ -18825,7 +18825,7 @@ function coreTemplate(projectId, projectName, variant) {
     files.set(".kxm/routes.yaml", {
       schema: "kxm.routes.v2",
       updatedAt: "2026-10-21T00:00:00.000Z",
-      admitted: ["anthropic/fable", "xai/grok-4.7"],
+      admitted: ["anthropic/fable", "xai/grok-4.7", "openrouter/z-ai/glm-5.3-flash"],
       disabled: []
     });
     files.set(".kxm/models/grok-grok-4-7.yaml", {
@@ -28904,9 +28904,6 @@ function parseVisionVerdict(raw) {
   return match ? match[1] === "true" : null;
 }
 function visionPiArgs(route) {
-  if (route === VISION_GATE_DEFAULT_ROUTE) {
-    return { ok: true, args: ["--provider", "zai-coding-cn", "--model", "glm-5.3-flash", "-p", "--no-session"] };
-  }
   const validation = validateHarnessModelPair("pi", route);
   if (!validation.valid) {
     return { ok: false, divergence: validation.message ?? "route_not_pi" };
@@ -28959,7 +28956,7 @@ var init_vision_gate = __esm({
     "use strict";
     init_harness();
     init_routes();
-    VISION_GATE_DEFAULT_ROUTE = "zai-coding-cn/glm-5.3-flash";
+    VISION_GATE_DEFAULT_ROUTE = "openrouter/z-ai/glm-5.3-flash";
     QUESTION_MAX_CHARS = 500;
     RAW_MAX_CHARS = 2e3;
   }
@@ -58732,7 +58729,7 @@ function createProgram(ctx, result, argv) {
   }
   const visionCmd = addGlobalOptions(program2.command("vision").description("Judge captured UI screenshots through the admitted vision gate"));
   visionCmd.helpCommand("help", "Show vision help");
-  addGlobalOptions(visionCmd.command("assert").description("Assert a UI state on a screenshot (deterministic vision gate)")).requiredOption("--image <path>", "Path to the captured screenshot").requiredOption("--question <text>", "Yes/no assertion to verify on the screenshot").option("--route <id>", `Vision route (default ${"zai-coding-cn/glm-5.3-flash"})`).option("--timeout-ms <n>", "Transport timeout in milliseconds (5000-300000)").option("--expect <bool>", "Exit 0 only when the verdict matches true|false").action(async function visionAssertAction(options) {
+  addGlobalOptions(visionCmd.command("assert").description("Assert a UI state on a screenshot (deterministic vision gate)")).requiredOption("--image <path>", "Path to the captured screenshot").requiredOption("--question <text>", "Yes/no assertion to verify on the screenshot").option("--route <id>", `Vision route (default ${"openrouter/z-ai/glm-5.3-flash"})`).option("--timeout-ms <n>", "Transport timeout in milliseconds (5000-300000)").option("--expect <bool>", "Exit 0 only when the verdict matches true|false").action(async function visionAssertAction(options) {
     result.code = await cmdVisionAssert(runtimeFrom(ctx, this), options ?? {});
   });
   const harnessCmd = addGlobalOptions(program2.command("harness").description("Detect coding-agent harnesses and authentication"));

package/plugins/kxm/dist/mcp-server.js

@@ -25462,7 +25462,7 @@ function sessionTokenFixHint(policy) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.201";
+var VERSION = "0.7.203";
 var CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();

package/plugins/kxm/dist/runtime-supervisor.js

@@ -15973,7 +15973,7 @@ function coreTemplate(projectId, projectName, variant) {
     files.set(".kxm/routes.yaml", {
       schema: "kxm.routes.v2",
       updatedAt: "2026-10-21T00:00:00.000Z",
-      admitted: ["anthropic/fable", "xai/grok-4.7"],
+      admitted: ["anthropic/fable", "xai/grok-4.7", "openrouter/z-ai/glm-5.3-flash"],
       disabled: []
     });
     files.set(".kxm/models/grok-grok-4-7.yaml", {

package/plugins/kxm/dist/runtime.js

@@ -15946,7 +15946,7 @@ function coreTemplate(projectId, projectName, variant) {
     files.set(".kxm/routes.yaml", {
       schema: "kxm.routes.v2",
       updatedAt: "2026-10-21T00:00:00.000Z",
-      admitted: ["anthropic/fable", "xai/grok-4.7"],
+      admitted: ["anthropic/fable", "xai/grok-4.7", "openrouter/z-ai/glm-5.3-flash"],
       disabled: []
     });
     files.set(".kxm/models/grok-grok-4-7.yaml", {

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.201",
+  "version": "0.7.203",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/skills/kxm-browser-verify/SKILL.md

@@ -106,5 +106,5 @@ kxm vision assert --image .kxm/artifacts/browser/shot.png \
 ```
 
 - Exit 0 only when the verdict resolves and matches `--expect`; fail-closed divergences (`route_not_admitted`, `image unreadable`, `verdict unreadable`, or the Pi native-vendor brake) exit 1.
-- The route must be admitted in `.kxm/routes.yaml`. The built-in default is `zai-coding-cn/glm-5.3-flash` (the verified Pi invocation `--provider zai-coding-cn --model glm-5.3-flash`). This checkout does not admit that id. Pass `--route openrouter/z-ai/glm-5.3-flash`, which is admitted here. `--route` selects the Pi model; a native-vendor id is refused before Pi starts.
+- The route must be admitted in `.kxm/routes.yaml`. The built-in default is `openrouter/z-ai/glm-5.3-flash`, invoked as `pi --model openrouter/z-ai/glm-5.3-flash`. `kxm init` admits that id, and this checkout already admits it. `--route` selects the Pi model; a native-vendor id is refused before Pi starts.
 - The gate is a supplement to deterministic Playwright assertions, never a replacement.

package/plugins/kxm/src/cli.ts

@@ -757,7 +757,7 @@ function createProgram(ctx: CliContext, result: { code: number }, argv: readonly
   addGlobalOptions(visionCmd.command("assert").description("Assert a UI state on a screenshot (deterministic vision gate)"))
     .requiredOption("--image <path>", "Path to the captured screenshot")
     .requiredOption("--question <text>", "Yes/no assertion to verify on the screenshot")
-    .option("--route <id>", `Vision route (default ${"zai-coding-cn/glm-5.3-flash"})`)
+    .option("--route <id>", `Vision route (default ${"openrouter/z-ai/glm-5.3-flash"})`)
     .option("--timeout-ms <n>", "Transport timeout in milliseconds (5000-300000)")
     .option("--expect <bool>", "Exit 0 only when the verdict matches true|false")
     .action(async function visionAssertAction(this: Command, options: { image?: string; question?: string; route?: string; timeoutMs?: string; expect?: string }) { result.code = await cmdVisionAssert(runtimeFrom(ctx, this), options ?? {}); });

package/plugins/kxm/src/mcp-server.ts

@@ -11,7 +11,7 @@ import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 import { sessionTokenFixHint } from "./session-token-hint.ts";
 
-const VERSION = "0.7.201";
+const VERSION = "0.7.203";
 const CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();

package/plugins/kxm/src/template.ts

@@ -209,14 +209,16 @@ function coreTemplate(projectId: string, projectName: string, variant: KxmTempla
       });
       files.set(".kxm/workflows/default.yaml", { ...workflow, coordinator: "planner", limits, steps });
     }
-    // The two models the template names, and nothing else. A fresh project can
-    // be driven without falling through to an unadmitted default model.
+    // The two roster models the template names, plus the vision selector the
+    // built-in gate defaults to. That selector has no model file and is not a
+    // roster route. A fresh project can be driven without falling through to
+    // an unadmitted default model.
     // Route ids follow <harness>-<model-slug>. grok-default and fable-default
     // remain aliases so an existing --route flag still resolves.
     files.set(".kxm/routes.yaml", {
       schema: "kxm.routes.v2",
       updatedAt: "2026-10-21T00:00:00.000Z",
-      admitted: ["anthropic/fable", "xai/grok-4.7"],
+      admitted: ["anthropic/fable", "xai/grok-4.7", "openrouter/z-ai/glm-5.3-flash"],
       disabled: [],
     });
     files.set(".kxm/models/grok-grok-4-7.yaml", {

package/plugins/kxm/src/vision-gate.ts

@@ -10,7 +10,7 @@ import { isRouteAdmitted } from "./routes.ts";
  * `divergence` reason. Transport is injectable so tests run without
  * network. */
 
-export const VISION_GATE_DEFAULT_ROUTE = "zai-coding-cn/glm-5.3-flash";
+export const VISION_GATE_DEFAULT_ROUTE = "openrouter/z-ai/glm-5.3-flash";
 const QUESTION_MAX_CHARS = 500;
 const RAW_MAX_CHARS = 2000;
 
@@ -54,13 +54,9 @@ export function parseVisionVerdict(raw: string): boolean | null {
 }
 
 /** Pi argv for an admitted vision route, without the prompt.
- * The verified default keeps `--provider zai-coding-cn --model glm-5.3-flash`.
- * Every other id is `pi --model <id>` after the native-vendor brake, so
- * `--route` selects the model instead of only the admission check. */
+ * Every id, including the default, is `pi --model <id>` after the
+ * native-vendor brake, so `--route` selects the model. */
 export function visionPiArgs(route: string): { ok: true; args: readonly string[] } | { ok: false; divergence: string } {
-  if (route === VISION_GATE_DEFAULT_ROUTE) {
-    return { ok: true, args: ["--provider", "zai-coding-cn", "--model", "glm-5.3-flash", "-p", "--no-session"] };
-  }
   const validation = validateHarnessModelPair("pi", route);
   if (!validation.valid) {
     return { ok: false, divergence: validation.message ?? "route_not_pi" };