agentic-qe 3.14.2 → 3.14.4

package/dist/context/sources/git-source.js

@@ -1,17 +1,24 @@
 /**
  * Git Source - Recent commit context for target files
  */
-import { execSync } from 'child_process';
+import { execFileSync } from 'node:child_process';
 export class GitContextSource {
+    cwd;
     id = 'git';
     name = 'Git History';
     priority = 60;
     maxTokens = 1500;
+    constructor(cwd) {
+        this.cwd = cwd;
+    }
     async gather(request) {
         const fragments = [];
         for (const file of request.targetFiles.slice(0, 5)) { // Cap at 5 files
             try {
-                const log = execSync(`git log --oneline -5 -- "${file}" 2>/dev/null || true`, { encoding: 'utf-8', timeout: 5000 }).trim();
+                // filePaths can originate from MCP tool arguments. Pass each path as
+                // one argv element; interpolating it into a shell command would allow
+                // command execution via quotes or shell metacharacters.
+                const log = execFileSync('git', ['log', '--oneline', '-5', '--', file], { cwd: this.cwd ?? process.cwd(), encoding: 'utf-8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
                 if (log) {
                     const content = `Recent commits for ${file}:\n${log}`;
                     fragments.push({

package/dist/coordination/cancelled-task-settlement.d.ts

@@ -0,0 +1,11 @@
+import type { TaskExecution } from './queen-types.js';
+/**
+ * A late domain result closes the callback boundary after cancellation, but
+ * must not replace the terminal decision or count as a normal task outcome.
+ * A settled callback does not prove that arbitrary external effects stopped.
+ */
+export declare function settleCancelledTask(tasks: Map<string, TaskExecution>, taskId: string): {
+    ignored: boolean;
+    settledNow: boolean;
+};
+//# sourceMappingURL=cancelled-task-settlement.d.ts.map

package/dist/coordination/cancelled-task-settlement.js

@@ -0,0 +1,15 @@
+/**
+ * A late domain result closes the callback boundary after cancellation, but
+ * must not replace the terminal decision or count as a normal task outcome.
+ * A settled callback does not prove that arbitrary external effects stopped.
+ */
+export function settleCancelledTask(tasks, taskId) {
+    const execution = tasks.get(taskId);
+    if (execution?.status !== 'cancelled')
+        return { ignored: false, settledNow: false };
+    if (!execution.cancellationResultPending)
+        return { ignored: true, settledNow: false };
+    tasks.set(taskId, { ...execution, cancellationResultPending: false });
+    return { ignored: true, settledNow: true };
+}
+//# sourceMappingURL=cancelled-task-settlement.js.map

package/dist/coordination/consensus/providers/claude-provider.d.ts

@@ -3,7 +3,7 @@
  * MM-003: Claude implementation for multi-model consensus verification
  *
  * Provides security finding verification using Claude models from Anthropic.
- * Supports Claude 3.5 Sonnet and Claude 3 Opus with configurable parameters.
+ * Supports current Claude models (Sonnet 5, Opus 5.5, Haiku 4.5) with configurable parameters.
  *
  * @see docs/plans/AQE_V3_IMPROVEMENTS_PLAN.md - Phase 2: Multi-Model Verification
  */
@@ -12,7 +12,7 @@ import { BaseModelProvider } from '../model-provider';
 /**
  * Claude-specific API model versions (distinct from routing ClaudeModel)
  */
-export type ClaudeAPIModel = 'claude-sonnet-4-6' | 'claude-opus-4-7' | 'claude-haiku-4-5' | 'claude-3-5-sonnet-20241022' | 'claude-3-5-sonnet-latest' | 'claude-3-opus-20240229' | 'claude-3-opus-latest';
+export type ClaudeAPIModel = 'claude-sonnet-5' | 'claude-opus-5' | 'claude-opus-5-5' | 'claude-haiku-4-5' | 'claude-sonnet-4-6' | 'claude-opus-4-7';
 /**
  * Configuration for Claude provider
  */

package/dist/coordination/consensus/providers/claude-provider.js

@@ -3,13 +3,15 @@
  * MM-003: Claude implementation for multi-model consensus verification
  *
  * Provides security finding verification using Claude models from Anthropic.
- * Supports Claude 3.5 Sonnet and Claude 3 Opus with configurable parameters.
+ * Supports current Claude models (Sonnet 5, Opus 5.5, Haiku 4.5) with configurable parameters.
  *
  * @see docs/plans/AQE_V3_IMPROVEMENTS_PLAN.md - Phase 2: Multi-Model Verification
  */
 import { toErrorMessage, toError } from '../../../shared/error-utils.js';
 import { BaseModelProvider, } from '../model-provider.js';
 import { PromptCacheLatch } from '../../../shared/prompt-cache-latch.js';
+import { getAnthropicParamPolicy } from '../../../shared/llm/anthropic-params.js';
+import { DEFAULT_SONNET_MODEL, getModelCost } from '../../../shared/llm/model-registry.js';
 // ============================================================================
 // Claude Model Provider Implementation
 // ============================================================================
@@ -34,21 +36,18 @@ export class ClaudeModelProvider extends BaseModelProvider {
     id = 'claude';
     name = 'Claude (Anthropic)';
     type = 'claude';
-    // Cost per million tokens (as of 2024)
-    // Claude 3.5 Sonnet: $3 input, $15 output per 1M tokens
-    // Claude 3 Opus: $15 input, $75 output per 1M tokens
+    // Per-token cost; set from the model registry in updateCostForModel().
     costPerToken = {
         input: 3 / 1_000_000, // Will be overridden per model
         output: 15 / 1_000_000,
     };
     supportedModels = [
+        'claude-sonnet-5',
+        'claude-opus-5',
+        'claude-opus-5-5',
+        'claude-haiku-4-5',
         'claude-sonnet-4-6',
         'claude-opus-4-7',
-        'claude-haiku-4-5',
-        'claude-3-5-sonnet-20241022',
-        'claude-3-5-sonnet-latest',
-        'claude-3-opus-20240229',
-        'claude-3-opus-latest',
     ];
     config;
     apiKey;
@@ -72,7 +71,7 @@ export class ClaudeModelProvider extends BaseModelProvider {
         this.baseUrl = config.baseUrl || process.env.ANTHROPIC_BASE_URL || 'https://api.anthropic.com';
         this.config = {
             apiKey,
-            defaultModel: config.defaultModel || 'claude-sonnet-4-6',
+            defaultModel: config.defaultModel || DEFAULT_SONNET_MODEL,
             baseUrl: this.baseUrl,
             defaultTimeout: config.defaultTimeout || 30000,
             maxRetries: config.maxRetries ?? 3,
@@ -118,7 +117,8 @@ export class ClaudeModelProvider extends BaseModelProvider {
         const request = {
             model,
             max_tokens: maxTokens,
-            temperature,
+            // Omitted for models that reject sampling params (Opus 4.7+, Sonnet 5).
+            temperature: getAnthropicParamPolicy(model).sendSampling ? temperature : undefined,
             system: systemPrompt,
             messages: [
                 {
@@ -253,20 +253,13 @@ Focus on accuracy over speed. It's better to mark something as "INCONCLUSIVE" if
      * Update cost based on model selection
      */
     updateCostForModel(model) {
-        if (model.includes('opus')) {
-            // Claude 3 Opus: $15 input, $75 output per 1M tokens
-            this.costPerToken = {
-                input: 15 / 1_000_000,
-                output: 75 / 1_000_000,
-            };
-        }
-        else {
-            // Claude 3.5 Sonnet: $3 input, $15 output per 1M tokens
-            this.costPerToken = {
-                input: 3 / 1_000_000,
-                output: 15 / 1_000_000,
-            };
-        }
+        // Registry pricing; unknown models fall back to Sonnet-class pricing.
+        const cost = getModelCost(model);
+        const known = cost.inputCostPerMillion > 0 || cost.outputCostPerMillion > 0;
+        this.costPerToken = {
+            input: (known ? cost.inputCostPerMillion : 3) / 1_000_000,
+            output: (known ? cost.outputCostPerMillion : 15) / 1_000_000,
+        };
     }
     /**
      * Sleep for specified milliseconds

package/dist/coordination/consensus/providers/gemini-provider.d.ts

@@ -3,7 +3,7 @@
  * MM-005: Google Gemini implementation for multi-model consensus verification
  *
  * Provides security finding verification using Google's Gemini models.
- * Supports Gemini Pro and Gemini Pro Vision with configurable parameters.
+ * Supports Gemini 2.5 and 3.x models with configurable parameters.
  *
  * @see docs/plans/AQE_V3_IMPROVEMENTS_PLAN.md - Phase 2: Multi-Model Verification
  */
@@ -12,7 +12,17 @@ import { BaseModelProvider } from '../model-provider';
 /**
  * Gemini-specific model versions
  */
-export type GeminiModel = 'gemini-1.5-pro-latest' | 'gemini-1.5-pro' | 'gemini-1.5-flash-latest' | 'gemini-1.5-flash' | 'gemini-pro';
+export type GeminiModel = 'gemini-2.5-pro' | 'gemini-2.5-flash' | 'gemini-3.8-flash' | 'gemini-3.5-flash' | 'gemini-3.5-flash-lite' | 'gemini-3.1-pro-preview'
+/** @deprecated Retired by Google — kept for config compatibility only. */
+ | 'gemini-1.5-pro-latest'
+/** @deprecated Retired by Google — kept for config compatibility only. */
+ | 'gemini-1.5-pro'
+/** @deprecated Retired by Google — kept for config compatibility only. */
+ | 'gemini-1.5-flash-latest'
+/** @deprecated Retired by Google — kept for config compatibility only. */
+ | 'gemini-1.5-flash'
+/** @deprecated Retired by Google — kept for config compatibility only. */
+ | 'gemini-pro';
 /**
  * Configuration for Gemini provider
  */
@@ -43,7 +53,7 @@ export interface GeminiProviderConfig {
  * ```typescript
  * const provider = new GeminiModelProvider({
  *   apiKey: process.env.GOOGLE_API_KEY,
- *   defaultModel: 'gemini-1.5-pro-latest',
+ *   defaultModel: 'gemini-2.5-pro',
  * });
  *
  * const response = await provider.complete(prompt);
@@ -118,7 +128,7 @@ export declare class GeminiModelProvider extends BaseModelProvider {
  * ```typescript
  * const provider = createGeminiProvider({
  *   apiKey: process.env.GOOGLE_API_KEY,
- *   defaultModel: 'gemini-1.5-pro-latest',
+ *   defaultModel: 'gemini-2.5-pro',
  * });
  * ```
  */

package/dist/coordination/consensus/providers/gemini-provider.js

@@ -3,12 +3,32 @@
  * MM-005: Google Gemini implementation for multi-model consensus verification
  *
  * Provides security finding verification using Google's Gemini models.
- * Supports Gemini Pro and Gemini Pro Vision with configurable parameters.
+ * Supports Gemini 2.5 and 3.x models with configurable parameters.
  *
  * @see docs/plans/AQE_V3_IMPROVEMENTS_PLAN.md - Phase 2: Multi-Model Verification
  */
 import { toErrorMessage, toError } from '../../../shared/error-utils.js';
 import { BaseModelProvider, } from '../model-provider.js';
+/**
+ * Cost per million tokens (USD). 2.5 rows match the shared Gemini provider;
+ * 3.x rows come from the OpenRouter catalog (2026-09-27) and, apart from
+ * gemini-3.5-flash, are not yet verified against the Gemini ListModels API.
+ * Retired 1.x rows are kept so configs pinned to them still price correctly.
+ */
+const GEMINI_MODEL_COSTS = {
+    'gemini-2.5-pro': { input: 1.25, output: 10 },
+    'gemini-2.5-flash': { input: 0.3, output: 2.5 },
+    'gemini-3.8-flash': { input: 0.75, output: 3.75 },
+    'gemini-3.5-flash': { input: 1.5, output: 9 },
+    'gemini-3.5-flash-lite': { input: 0.3, output: 2.5 },
+    'gemini-3.1-pro-preview': { input: 2, output: 12 },
+    // Deprecated (retired)
+    'gemini-1.5-pro-latest': { input: 3.5, output: 10.5 },
+    'gemini-1.5-pro': { input: 3.5, output: 10.5 },
+    'gemini-1.5-flash-latest': { input: 0.35, output: 1.05 },
+    'gemini-1.5-flash': { input: 0.35, output: 1.05 },
+    'gemini-pro': { input: 0.5, output: 1.5 },
+};
 // ============================================================================
 // Gemini Model Provider Implementation
 // ============================================================================
@@ -23,7 +43,7 @@ import { BaseModelProvider, } from '../model-provider.js';
  * ```typescript
  * const provider = new GeminiModelProvider({
  *   apiKey: process.env.GOOGLE_API_KEY,
- *   defaultModel: 'gemini-1.5-pro-latest',
+ *   defaultModel: 'gemini-2.5-pro',
  * });
  *
  * const response = await provider.complete(prompt);
@@ -33,20 +53,18 @@ export class GeminiModelProvider extends BaseModelProvider {
     id = 'gemini';
     name = 'Google Gemini';
     type = 'gemini';
-    // Cost per million tokens (as of 2024)
-    // Gemini Pro: $0.50 input, $1.50 output per 1M tokens (up to 128k context)
-    // Gemini 1.5 Pro: $3.50 input, $10.50 output per 1M tokens
-    // Gemini 1.5 Flash: $0.35 input, $1.05 output per 1M tokens
+    // Overridden per model from GEMINI_MODEL_COSTS in the constructor
     costPerToken = {
-        input: 3.5 / 1_000_000, // Will be overridden per model
-        output: 10.5 / 1_000_000,
+        input: 1.25 / 1_000_000,
+        output: 10 / 1_000_000,
     };
     supportedModels = [
-        'gemini-1.5-pro-latest',
-        'gemini-1.5-pro',
-        'gemini-1.5-flash-latest',
-        'gemini-1.5-flash',
-        'gemini-pro',
+        'gemini-2.5-pro',
+        'gemini-2.5-flash',
+        'gemini-3.8-flash',
+        'gemini-3.5-flash',
+        'gemini-3.5-flash-lite',
+        'gemini-3.1-pro-preview',
     ];
     config;
     apiKey;
@@ -68,7 +86,7 @@ export class GeminiModelProvider extends BaseModelProvider {
         this.baseUrl = config.baseUrl || 'https://generativelanguage.googleapis.com';
         this.config = {
             apiKey,
-            defaultModel: config.defaultModel || 'gemini-1.5-pro-latest',
+            defaultModel: config.defaultModel || 'gemini-2.5-pro',
             baseUrl: this.baseUrl,
             defaultTimeout: config.defaultTimeout || 30000,
             maxRetries: config.maxRetries ?? 3,
@@ -273,27 +291,12 @@ Focus on accuracy over speed. It's better to mark something as "INCONCLUSIVE" if
      * Update cost based on model selection
      */
     updateCostForModel(model) {
-        if (model.includes('flash')) {
-            // Gemini 1.5 Flash: $0.35 input, $1.05 output per 1M tokens
-            this.costPerToken = {
-                input: 0.35 / 1_000_000,
-                output: 1.05 / 1_000_000,
-            };
-        }
-        else if (model.includes('1.5')) {
-            // Gemini 1.5 Pro: $3.50 input, $10.50 output per 1M tokens
-            this.costPerToken = {
-                input: 3.5 / 1_000_000,
-                output: 10.5 / 1_000_000,
-            };
-        }
-        else {
-            // Gemini Pro: $0.50 input, $1.50 output per 1M tokens
-            this.costPerToken = {
-                input: 0.5 / 1_000_000,
-                output: 1.5 / 1_000_000,
-            };
-        }
+        // Unknown models are priced as the default tier (gemini-2.5-pro)
+        const pricing = GEMINI_MODEL_COSTS[model] ?? GEMINI_MODEL_COSTS['gemini-2.5-pro'];
+        this.costPerToken = {
+            input: pricing.input / 1_000_000,
+            output: pricing.output / 1_000_000,
+        };
     }
     /**
      * Sleep for specified milliseconds
@@ -321,7 +324,7 @@ Focus on accuracy over speed. It's better to mark something as "INCONCLUSIVE" if
  * ```typescript
  * const provider = createGeminiProvider({
  *   apiKey: process.env.GOOGLE_API_KEY,
- *   defaultModel: 'gemini-1.5-pro-latest',
+ *   defaultModel: 'gemini-2.5-pro',
  * });
  * ```
  */

package/dist/coordination/consensus/providers/ollama-provider.d.ts

@@ -2,7 +2,7 @@
  * Agentic QE v3 - Ollama Model Provider
  * Local/on-prem model support for multi-model consensus verification
  *
- * Ollama provides access to local LLMs (Llama, Mistral, Codellama, etc.)
+ * Ollama provides access to local LLMs (Qwen3, gpt-oss, Llama 4, Gemma, etc.)
  * for privacy-sensitive verification or air-gapped environments.
  *
  * @see https://ollama.ai
@@ -12,9 +12,10 @@ import { ModelCompletionOptions, ModelHealthResult } from '../interfaces';
 import { BaseModelProvider } from '../model-provider';
 /**
  * Popular models available through Ollama
- * These are models that can be pulled and run locally
+ * These are models that can be pulled and run locally. Tag availability
+ * varies by Ollama library version — `ollama pull` to confirm.
  */
-export type OllamaModel = 'llama3.1' | 'llama3.1:70b' | 'llama3.1:8b' | 'llama3.2' | 'llama3.2:3b' | 'llama3.2:1b' | 'codellama' | 'codellama:34b' | 'codellama:13b' | 'codellama:7b' | 'mistral' | 'mistral:7b' | 'mistral-nemo' | 'mixtral' | 'mixtral:8x7b' | 'qwen2.5' | 'qwen2.5:72b' | 'qwen2.5:32b' | 'qwen2.5:14b' | 'qwen2.5:7b' | 'qwen2.5-coder' | 'deepseek-coder-v2' | 'deepseek-v2' | 'phi3' | 'phi3:14b' | 'phi3:medium' | 'gemma2' | 'gemma2:27b' | 'gemma2:9b' | 'gemma2:2b' | 'starcoder2' | 'starcoder2:15b' | 'starcoder2:7b' | string;
+export type OllamaModel = 'qwen3-coder:30b' | 'qwen3:30b-a3b' | 'gpt-oss:20b' | 'gpt-oss:120b' | 'llama4:scout' | 'gemma4' | string;
 /**
  * Configuration for Ollama provider
  */
@@ -67,7 +68,7 @@ export declare function getCodeOllamaModels(): OllamaModel[];
  * ```typescript
  * const provider = new OllamaModelProvider({
  *   baseUrl: 'http://localhost:11434',
- *   defaultModel: 'codellama:34b',
+ *   defaultModel: 'qwen3-coder:30b',
  * });
  *
  * const result = await provider.complete('Analyze this code for vulnerabilities...');
@@ -133,18 +134,18 @@ export declare class OllamaModelProvider extends BaseModelProvider {
  *
  * @example
  * ```typescript
- * // Default (localhost:11434, llama3.1)
+ * // Default (localhost:11434, qwen3-coder:30b)
  * const provider = createOllamaProvider();
  *
  * // Custom model
  * const provider = createOllamaProvider({
- *   defaultModel: 'codellama:34b',
+ *   defaultModel: 'gpt-oss:20b',
  * });
  *
  * // Remote Ollama server
  * const provider = createOllamaProvider({
  *   baseUrl: 'http://gpu-server:11434',
- *   defaultModel: 'llama3.1:70b',
+ *   defaultModel: 'gpt-oss:120b',
  * });
  * ```
  */

package/dist/coordination/consensus/providers/ollama-provider.js

@@ -2,7 +2,7 @@
  * Agentic QE v3 - Ollama Model Provider
  * Local/on-prem model support for multi-model consensus verification
  *
- * Ollama provides access to local LLMs (Llama, Mistral, Codellama, etc.)
+ * Ollama provides access to local LLMs (Qwen3, gpt-oss, Llama 4, Gemma, etc.)
  * for privacy-sensitive verification or air-gapped environments.
  *
  * @see https://ollama.ai
@@ -20,10 +20,10 @@ import { resolveOllamaBaseUrl } from '../../../shared/llm/ollama-url.js';
  */
 export function getRecommendedOllamaModels() {
     return [
-        'llama3.1:70b', // Best reasoning
-        'codellama:34b', // Best for code analysis
-        'qwen2.5:72b', // Strong multilingual
-        'mistral', // Good balance
+        'qwen3-coder:30b', // Best for code analysis (ADR-111 default)
+        'gpt-oss:120b', // Best reasoning
+        'qwen3:30b-a3b', // Strong general-purpose MoE
+        'llama4:scout', // Different model family for consensus diversity
     ];
 }
 /**
@@ -31,10 +31,9 @@ export function getRecommendedOllamaModels() {
  */
 export function getLightweightOllamaModels() {
     return [
-        'llama3.2:3b',
-        'phi3',
-        'gemma2:2b',
-        'qwen2.5:7b',
+        'gpt-oss:20b',
+        'qwen3:30b-a3b', // MoE: ~3B active params, fast despite its size
+        'gemma4',
     ];
 }
 /**
@@ -42,10 +41,9 @@ export function getLightweightOllamaModels() {
  */
 export function getCodeOllamaModels() {
     return [
-        'codellama:34b',
-        'qwen2.5-coder',
-        'deepseek-coder-v2',
-        'starcoder2:15b',
+        'qwen3-coder:30b',
+        'gpt-oss:120b',
+        'gpt-oss:20b',
     ];
 }
 // ============================================================================
@@ -53,7 +51,7 @@ export function getCodeOllamaModels() {
 // ============================================================================
 const DEFAULT_CONFIG = {
     baseUrl: resolveOllamaBaseUrl(OLLAMA_CONSTANTS.DEFAULT_BASE_URL),
-    defaultModel: 'llama3.1',
+    defaultModel: 'qwen3-coder:30b',
     defaultTimeout: CONSENSUS_CONSTANTS.OLLAMA_TIMEOUT_MS, // 5 minutes (local models can be slow)
     maxRetries: 2,
     retryDelayMs: CONSENSUS_CONSTANTS.OLLAMA_RETRY_DELAY_MS,
@@ -69,7 +67,7 @@ const DEFAULT_CONFIG = {
  * ```typescript
  * const provider = new OllamaModelProvider({
  *   baseUrl: 'http://localhost:11434',
- *   defaultModel: 'codellama:34b',
+ *   defaultModel: 'qwen3-coder:30b',
  * });
  *
  * const result = await provider.complete('Analyze this code for vulnerabilities...');
@@ -294,18 +292,18 @@ Format your response with: verdict (confirmed/rejected/uncertain), confidence (0
  *
  * @example
  * ```typescript
- * // Default (localhost:11434, llama3.1)
+ * // Default (localhost:11434, qwen3-coder:30b)
  * const provider = createOllamaProvider();
  *
  * // Custom model
  * const provider = createOllamaProvider({
- *   defaultModel: 'codellama:34b',
+ *   defaultModel: 'gpt-oss:20b',
  * });
  *
  * // Remote Ollama server
  * const provider = createOllamaProvider({
  *   baseUrl: 'http://gpu-server:11434',
- *   defaultModel: 'llama3.1:70b',
+ *   defaultModel: 'gpt-oss:120b',
  * });
  * ```
  */

package/dist/coordination/consensus/providers/openai-provider.d.ts

@@ -3,7 +3,7 @@
  * MM-004: OpenAI implementation for multi-model consensus verification
  *
  * Provides security finding verification using OpenAI GPT models.
- * Supports GPT-4, GPT-4-turbo with configurable parameters.
+ * Supports the GPT-6 family (sol, luna, astra) with configurable parameters.
  *
  * @see docs/plans/AQE_V3_IMPROVEMENTS_PLAN.md - Phase 2: Multi-Model Verification
  */
@@ -12,7 +12,17 @@ import { BaseModelProvider } from '../model-provider';
 /**
  * OpenAI-specific model versions
  */
-export type OpenAIModel = 'gpt-4' | 'gpt-4-turbo' | 'gpt-4-turbo-preview' | 'gpt-4-0125-preview' | 'gpt-4-1106-preview';
+export type OpenAIModel = 'gpt-6-sol' | 'gpt-6-luna' | 'gpt-6-astra' | 'gpt-5.6-sol' | 'gpt-5.4-mini'
+/** @deprecated Legacy GPT-4 generation — kept for config compatibility only. */
+ | 'gpt-4'
+/** @deprecated Legacy GPT-4 generation — kept for config compatibility only. */
+ | 'gpt-4-turbo'
+/** @deprecated Legacy GPT-4 generation — kept for config compatibility only. */
+ | 'gpt-4-turbo-preview'
+/** @deprecated Legacy GPT-4 generation — kept for config compatibility only. */
+ | 'gpt-4-0125-preview'
+/** @deprecated Legacy GPT-4 generation — kept for config compatibility only. */
+ | 'gpt-4-1106-preview';
 /**
  * Configuration for OpenAI provider
  */
@@ -45,7 +55,7 @@ export interface OpenAIProviderConfig {
  * ```typescript
  * const provider = new OpenAIModelProvider({
  *   apiKey: process.env.OPENAI_API_KEY,
- *   defaultModel: 'gpt-4-turbo',
+ *   defaultModel: 'gpt-6-sol',
  * });
  *
  * const response = await provider.complete(prompt);
@@ -120,7 +130,7 @@ export declare class OpenAIModelProvider extends BaseModelProvider {
  * ```typescript
  * const provider = createOpenAIProvider({
  *   apiKey: process.env.OPENAI_API_KEY,
- *   defaultModel: 'gpt-4-turbo',
+ *   defaultModel: 'gpt-6-sol',
  * });
  * ```
  */

package/dist/coordination/consensus/providers/openai-provider.js

@@ -3,13 +3,30 @@
  * MM-004: OpenAI implementation for multi-model consensus verification
  *
  * Provides security finding verification using OpenAI GPT models.
- * Supports GPT-4, GPT-4-turbo with configurable parameters.
+ * Supports the GPT-6 family (sol, luna, astra) with configurable parameters.
  *
  * @see docs/plans/AQE_V3_IMPROVEMENTS_PLAN.md - Phase 2: Multi-Model Verification
  */
 import { BaseModelProvider, } from '../model-provider.js';
 import { CONSENSUS_CONSTANTS } from '../../constants.js';
 import { toErrorMessage, toError } from '../../../shared/error-utils.js';
+import { applyOpenAIParams } from '../../../shared/llm/openai-params.js';
+/**
+ * Cost per million tokens (USD), from the OpenAI API catalog (2026-09-27).
+ * Legacy GPT-4 rows are kept so configs pinned to them still price correctly.
+ */
+const OPENAI_MODEL_COSTS = {
+    'gpt-6-astra': { input: 10, output: 50 },
+    'gpt-6-sol': { input: 2, output: 10 },
+    'gpt-6-luna': { input: 0.1, output: 0.5 },
+    'gpt-5.4-mini': { input: 0.75, output: 4.5 },
+    // Deprecated (legacy GPT-4 generation)
+    'gpt-4': { input: 30, output: 60 },
+    'gpt-4-turbo': { input: 10, output: 30 },
+    'gpt-4-turbo-preview': { input: 10, output: 30 },
+    'gpt-4-0125-preview': { input: 10, output: 30 },
+    'gpt-4-1106-preview': { input: 10, output: 30 },
+};
 // ============================================================================
 // OpenAI Model Provider Implementation
 // ============================================================================
@@ -24,7 +41,7 @@ import { toErrorMessage, toError } from '../../../shared/error-utils.js';
  * ```typescript
  * const provider = new OpenAIModelProvider({
  *   apiKey: process.env.OPENAI_API_KEY,
- *   defaultModel: 'gpt-4-turbo',
+ *   defaultModel: 'gpt-6-sol',
  * });
  *
  * const response = await provider.complete(prompt);
@@ -34,19 +51,17 @@ export class OpenAIModelProvider extends BaseModelProvider {
     id = 'openai';
     name = 'OpenAI GPT';
     type = 'openai';
-    // Cost per million tokens (as of 2024)
-    // GPT-4: $30 input, $60 output per 1M tokens
-    // GPT-4-turbo: $10 input, $30 output per 1M tokens
+    // Overridden per model from OPENAI_MODEL_COSTS in the constructor
     costPerToken = {
-        input: 10 / 1_000_000, // Will be overridden per model
-        output: 30 / 1_000_000,
+        input: 2 / 1_000_000,
+        output: 10 / 1_000_000,
     };
     supportedModels = [
-        'gpt-4',
-        'gpt-4-turbo',
-        'gpt-4-turbo-preview',
-        'gpt-4-0125-preview',
-        'gpt-4-1106-preview',
+        'gpt-6-sol',
+        'gpt-6-luna',
+        'gpt-6-astra',
+        'gpt-5.6-sol',
+        'gpt-5.4-mini',
     ];
     config;
     apiKey;
@@ -69,7 +84,7 @@ export class OpenAIModelProvider extends BaseModelProvider {
         this.config = {
             apiKey,
             organization: config.organization || '',
-            defaultModel: config.defaultModel || 'gpt-4-turbo',
+            defaultModel: config.defaultModel || 'gpt-6-sol',
             baseUrl: this.baseUrl,
             defaultTimeout: config.defaultTimeout || CONSENSUS_CONSTANTS.MODEL_TIMEOUT_MS,
             maxRetries: config.maxRetries ?? CONSENSUS_CONSTANTS.DEFAULT_RETRY_ATTEMPTS,
@@ -105,12 +120,7 @@ export class OpenAIModelProvider extends BaseModelProvider {
                 content: prompt,
             },
         ];
-        const request = {
-            model,
-            messages,
-            temperature,
-            max_tokens: maxTokens,
-        };
+        const request = applyOpenAIParams({ model, messages }, model, { maxTokens, temperature });
         if (this.config.enableLogging) {
             console.log(`[OpenAI] Sending request to ${model}`);
         }
@@ -243,20 +253,12 @@ Focus on accuracy over speed. It's better to mark something as "INCONCLUSIVE" if
      * Update cost based on model selection
      */
     updateCostForModel(model) {
-        if (model === 'gpt-4' && !model.includes('turbo')) {
-            // GPT-4: $30 input, $60 output per 1M tokens
-            this.costPerToken = {
-                input: 30 / 1_000_000,
-                output: 60 / 1_000_000,
-            };
-        }
-        else {
-            // GPT-4-turbo: $10 input, $30 output per 1M tokens
-            this.costPerToken = {
-                input: 10 / 1_000_000,
-                output: 30 / 1_000_000,
-            };
-        }
+        // Unknown models are priced as the default tier (gpt-6-sol)
+        const pricing = OPENAI_MODEL_COSTS[model] ?? OPENAI_MODEL_COSTS['gpt-6-sol'];
+        this.costPerToken = {
+            input: pricing.input / 1_000_000,
+            output: pricing.output / 1_000_000,
+        };
     }
     /**
      * Sleep for specified milliseconds
@@ -284,7 +286,7 @@ Focus on accuracy over speed. It's better to mark something as "INCONCLUSIVE" if
  * ```typescript
  * const provider = createOpenAIProvider({
  *   apiKey: process.env.OPENAI_API_KEY,
- *   defaultModel: 'gpt-4-turbo',
+ *   defaultModel: 'gpt-6-sol',
  * });
  * ```
  */