agentic-qe 3.14.2 → 3.14.4

package/dist/routing/security/cyber-pin.js

@@ -2,16 +2,28 @@
  * Agentic QE v3 - Cyber Verification Pin
  * ADR-093: Opus 4.7 Migration
  *
- * Security and pentest agents may trip Opus 4.7's real-time cybersecurity
- * safeguards until the organization is enrolled in Anthropic's Cyber
- * Verification Program. This module pins those agents to a fallback model
- * until `AQE_CYBER_VERIFIED=true`.
+ * Security and pentest agents may trip the real-time cybersecurity
+ * safeguards that ship with Opus 4.7 and later Opus/Fable-class models until
+ * the organization is enrolled in Anthropic's Cyber Verification Program.
+ * This module pins those agents to a fallback model until
+ * `AQE_CYBER_VERIFIED=true`.
  *
  * Applied in BOTH:
  *   - HybridRouter.chat() — catches direct routing calls
  *   - MultiModelExecutor.consult() — catches advisor escalations
  *
- * so security agents cannot reach 4.7 by any code path until verified.
+ * HybridRouter also re-pins its fallback candidates (default model and
+ * fallback chain), so a failed primary cannot escalate a pinned agent. Scope:
+ * the pin covers the Opus/Fable-class models that ship these safeguards; it
+ * does NOT restrict ordinary Sonnet routing (security tasks may route to the
+ * default Sonnet).
+
+ *
+ * 2026-09 model refresh: the gate was generalized from Opus 4.7 only to every
+ * Opus/Fable model at or above 4.7, including the Claude Code aliases
+ * `opus` / `fable` (see {@link isCyberGatedModel}). Routing tier 4 and the
+ * default advisor now target Opus 5.5; matching 4.7 alone would have left the
+ * pin unreachable.
  */
 /**
  * Agent names subject to the cyber pin. These are the agents covered by
@@ -28,23 +40,58 @@ export const CYBER_PINNED_AGENTS = [
     'qe-security-reviewer',
 ];
 /**
- * Fallback advisor model for cyber-pinned agents. Sonnet 4.6 on OpenRouter.
+ * Fallback model for pinned requests. Deliberately Sonnet 4.6 — the model
+ * docs/security/cyber-verification-application.md names for security agents —
+ * rather than DEFAULT_SONNET_MODEL, so the pin's target stays the documented,
+ * reviewed model across default bumps. (Claude Code maps model IDs to its
+ * `sonnet` alias, so on that provider the fallback runs on the CLI's Sonnet.)
+ * Sonnet 4.6 is served until at least 2027-02-17.
+ */
+const CYBER_PIN_SONNET = 'claude-sonnet-4-6';
+/**
+ * Fallback advisor model for cyber-pinned agents, in OpenRouter form.
  * Used by MultiModelExecutor.consult.
  */
-export const CYBER_PIN_ADVISOR_FALLBACK = 'anthropic/claude-sonnet-4.6';
+export const CYBER_PIN_ADVISOR_FALLBACK = `anthropic/${CYBER_PIN_SONNET.replace('4-6', '4.6')}`;
 /**
  * Fallback chat model for cyber-pinned agents when targeting the Anthropic
  * provider directly. Used by HybridRouter.chat.
  */
-export const CYBER_PIN_CHAT_FALLBACK = 'claude-sonnet-4-6';
+export const CYBER_PIN_CHAT_FALLBACK = CYBER_PIN_SONNET;
 /**
- * Returns true if the model ID targets Opus 4.7 in any known form:
- * canonical (claude-opus-4-7), OpenRouter (anthropic/claude-opus-4.7),
- * or Bedrock (anthropic.claude-opus-4-7-v1:0).
+ * Family + version in any known ID form: canonical (claude-opus-5-5),
+ * OpenRouter (anthropic/claude-opus-5.5), Bedrock (anthropic.claude-opus-4-7-v1:0)
+ * and dated snapshots (claude-opus-4-5-20251101). The minor version is at most
+ * two digits so a date suffix (claude-opus-4-20250514) is not read as one.
  */
-export function isOpus47(modelId) {
-    return (modelId.includes('claude-opus-4-7') || modelId.includes('claude-opus-4.7'));
+const CLI_GATED_ALIASES = new Set(['opus', 'fable']);
+const OPUS_FABLE_ID = /claude-(opus|fable)-(\d+)(?:[-.](\d{1,2})(?!\d))?/;
+/** First Opus/Fable version that ships the cyber safeguards. */
+const CYBER_GATE_MIN = { major: 4, minor: 7 };
+/**
+ * Returns true if the model ID is an Opus- or Fable-class model at or above
+ * 4.7 (claude-opus-4-7, claude-opus-4-8, claude-opus-5, claude-opus-5-5,
+ * claude-fable-5, claude-fable-5-1, …) in canonical, OpenRouter or Bedrock
+ * form. Sonnet, Haiku and Opus below 4.7 are not gated.
+ */
+export function isCyberGatedModel(modelId) {
+    const id = modelId.trim().toLowerCase();
+    // Claude Code CLI aliases resolve to the latest Opus/Fable (>= 4.7).
+    if (CLI_GATED_ALIASES.has(id))
+        return true;
+    const match = OPUS_FABLE_ID.exec(id);
+    if (!match)
+        return false;
+    const major = Number(match[2]);
+    const minor = match[3] === undefined ? 0 : Number(match[3]);
+    return (major > CYBER_GATE_MIN.major ||
+        (major === CYBER_GATE_MIN.major && minor >= CYBER_GATE_MIN.minor));
 }
+/**
+ * @deprecated Use {@link isCyberGatedModel}. Kept as an alias for existing
+ * callers; it matches every cyber-gated model, not only Opus 4.7.
+ */
+export const isOpus47 = isCyberGatedModel;
 /**
  * Returns true if the agent is cyber-pinned and env does not grant
  * Cyber Verification bypass. Case-sensitive "true" only — '1', 'yes',
@@ -68,8 +115,23 @@ export function shouldCyberPin(agentName, env = process.env) {
 export function applyCyberPin(agentName, requestedModel, fallback, env = process.env) {
     if (!shouldCyberPin(agentName, env))
         return requestedModel;
-    if (!isOpus47(requestedModel))
+    if (!isCyberGatedModel(requestedModel))
         return requestedModel;
     return fallback;
 }
+/**
+ * The pinned Sonnet 4.6 fallback in the model-ID form a given provider
+ * expects, so a pinned request stays routable (OpenRouter needs the dotted
+ * `anthropic/…` slug, Bedrock the `anthropic.…-v1:0` form).
+ */
+export function cyberPinFallbackFor(provider) {
+    switch (provider) {
+        case 'openrouter':
+            return CYBER_PIN_ADVISOR_FALLBACK;
+        case 'bedrock':
+            return 'anthropic.claude-sonnet-4-6-v1:0';
+        default:
+            return CYBER_PIN_CHAT_FALLBACK;
+    }
+}
 //# sourceMappingURL=cyber-pin.js.map

package/dist/routing/value-score.js

@@ -52,6 +52,6 @@ export const MEASURED_QE_TEST_GEN = [
     { model: 'qwen2.5-coder:7b', quality: 0.50, costPerInstance: 0 }, // 2026-06-29: stock 7B coder = 4/8 (50%) — beats general qwen3:8b (38%), 16× faster; ~25pp below 30B (PEFT-tune target)
     { model: 'qwen2.5-coder:1.5b', quality: 0.08, costPerInstance: 0 }, // 2026-06-29: stock 1.5B coder = 1/8 (8%); below floor, size dominates coder-tuning at tiny scale
     { model: 'z-ai/glm-5.2', quality: 0.71, costPerInstance: 0.0065 }, // A12: diverse, higher per-model best
-    { model: 'claude-sonnet-4-6', quality: 0.83, costPerInstance: 0.045 }, // D3: frontier ceiling
+    { model: 'claude-sonnet-4-6', quality: 0.83, costPerInstance: 0.045 }, // D3: measured frontier reference as of 2026-06-24 (not re-run on newer models)
 ];
 //# sourceMappingURL=value-score.js.map

package/dist/shared/git/index.d.ts

@@ -3,4 +3,5 @@
  */
 export { GitAnalyzer } from './git-analyzer';
 export type { GitAnalyzerConfig, GitCommit, GitBlameInfo, FileHistory, } from './git-analyzer';
+export { assertSafeGitRef, getGitRefError } from './ref-validation';
 //# sourceMappingURL=index.d.ts.map

package/dist/shared/git/index.js

@@ -2,4 +2,5 @@
  * Agentic QE v3 - Git Analysis Utilities
  */
 export { GitAnalyzer } from './git-analyzer.js';
+export { assertSafeGitRef, getGitRefError } from './ref-validation.js';
 //# sourceMappingURL=index.js.map

package/dist/shared/git/ref-validation.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Agentic QE v3 - Git ref validation
+ *
+ * Caller-supplied refs (MCP tool arguments, CLI flags) are passed to git as
+ * positional argv entries. Even without a shell, a value beginning with "-"
+ * is parsed by git as an option (e.g. `--output=<path>` makes `git diff`
+ * create or truncate an arbitrary file), so refs must be validated at the
+ * boundary before reaching git.
+ */
+/**
+ * Returns an error message when `ref` is not a safe git revision argument,
+ * or undefined when it is safe. Accepts ordinary revisions such as `main`,
+ * `origin/main`, `HEAD~3`, `v1.2.0^{commit}` and commit SHAs.
+ */
+export declare function getGitRefError(ref: unknown, label?: string): string | undefined;
+/**
+ * Throws when `ref` is not a safe git revision argument.
+ */
+export declare function assertSafeGitRef(ref: unknown, label?: string): asserts ref is string;
+//# sourceMappingURL=ref-validation.d.ts.map

package/dist/shared/git/ref-validation.js

@@ -0,0 +1,43 @@
+/**
+ * Agentic QE v3 - Git ref validation
+ *
+ * Caller-supplied refs (MCP tool arguments, CLI flags) are passed to git as
+ * positional argv entries. Even without a shell, a value beginning with "-"
+ * is parsed by git as an option (e.g. `--output=<path>` makes `git diff`
+ * create or truncate an arbitrary file), so refs must be validated at the
+ * boundary before reaching git.
+ */
+const MAX_GIT_REF_LENGTH = 256;
+// Whitespace and ASCII control characters are never valid in a revision.
+// eslint-disable-next-line no-control-regex
+const UNSAFE_REF_CHARS = /[\s\x00-\x1f\x7f]/;
+/**
+ * Returns an error message when `ref` is not a safe git revision argument,
+ * or undefined when it is safe. Accepts ordinary revisions such as `main`,
+ * `origin/main`, `HEAD~3`, `v1.2.0^{commit}` and commit SHAs.
+ */
+export function getGitRefError(ref, label = 'git ref') {
+    if (typeof ref !== 'string' || ref.length === 0) {
+        return `Invalid ${label}: must be a non-empty string`;
+    }
+    if (ref.length > MAX_GIT_REF_LENGTH) {
+        return `Invalid ${label}: longer than ${MAX_GIT_REF_LENGTH} characters`;
+    }
+    if (ref.startsWith('-')) {
+        return `Invalid ${label} "${ref}": must not start with "-"`;
+    }
+    if (UNSAFE_REF_CHARS.test(ref)) {
+        return `Invalid ${label}: must not contain whitespace or control characters`;
+    }
+    return undefined;
+}
+/**
+ * Throws when `ref` is not a safe git revision argument.
+ */
+export function assertSafeGitRef(ref, label = 'git ref') {
+    const error = getGitRefError(ref, label);
+    if (error) {
+        throw new Error(error);
+    }
+}
+//# sourceMappingURL=ref-validation.js.map

package/dist/shared/llm/anthropic-params.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Agentic QE v3 - Anthropic Messages API parameter policy
+ *
+ * Newer Claude models reject request fields that older ones accepted:
+ * `temperature` / `top_p` / `top_k` return 400 ("`temperature` is deprecated
+ * for this model") on Opus 4.7+, Sonnet 5 and the Fable family, and effort
+ * must be sent as `output_config.effort` (a nested `thinking.effort` is
+ * rejected). Every Anthropic-format request builder applies this policy so a
+ * model bump cannot silently break calls.
+ */
+import { type EffortLevel } from './effort-resolver';
+export interface AnthropicParamPolicy {
+    /** Whether `temperature` (and other sampling params) may be sent. */
+    sendSampling: boolean;
+    /** Whether `output_config.effort` is accepted. */
+    supportsEffort: boolean;
+}
+/**
+ * Parameter policy for a model ID (canonical, dated, Bedrock, or OpenRouter
+ * form). Models missing from the registry get the conservative policy:
+ * no sampling params (current models reject them; retired models no longer
+ * serve requests) and no effort.
+ */
+export declare function getAnthropicParamPolicy(model: string): AnthropicParamPolicy;
+export interface AnthropicParamInput {
+    temperature?: number;
+    /**
+     * Explicit effort. When omitted, flagship (Opus/Fable-class) models get the
+     * fleet effort (QE_EFFORT_LEVEL > config/fleet-defaults.yaml > xhigh, per
+     * ADR-093); other models keep their API default to avoid raising cost on
+     * every Sonnet/Haiku call.
+     */
+    effort?: EffortLevel;
+}
+/**
+ * Add sampling and effort fields to an Anthropic Messages request body
+ * according to the model's policy. Mutates and returns `body`.
+ */
+export declare function applyAnthropicParams(body: Record<string, unknown>, model: string, input: AnthropicParamInput): Record<string, unknown>;
+//# sourceMappingURL=anthropic-params.d.ts.map

package/dist/shared/llm/anthropic-params.js

@@ -0,0 +1,51 @@
+/**
+ * Agentic QE v3 - Anthropic Messages API parameter policy
+ *
+ * Newer Claude models reject request fields that older ones accepted:
+ * `temperature` / `top_p` / `top_k` return 400 ("`temperature` is deprecated
+ * for this model") on Opus 4.7+, Sonnet 5 and the Fable family, and effort
+ * must be sent as `output_config.effort` (a nested `thinking.effort` is
+ * rejected). Every Anthropic-format request builder applies this policy so a
+ * model bump cannot silently break calls.
+ */
+import { getModelCapabilities, getModelInfo } from './model-registry.js';
+import { resolveEffortLevel } from './effort-resolver.js';
+/**
+ * Parameter policy for a model ID (canonical, dated, Bedrock, or OpenRouter
+ * form). Models missing from the registry get the conservative policy:
+ * no sampling params (current models reject them; retired models no longer
+ * serve requests) and no effort.
+ */
+export function getAnthropicParamPolicy(model) {
+    try {
+        const caps = getModelCapabilities(model);
+        return {
+            sendSampling: caps.supportsSamplingParams !== false,
+            supportsEffort: caps.supportsEffortXHigh === true,
+        };
+    }
+    catch {
+        return { sendSampling: false, supportsEffort: false };
+    }
+}
+/**
+ * Add sampling and effort fields to an Anthropic Messages request body
+ * according to the model's policy. Mutates and returns `body`.
+ */
+export function applyAnthropicParams(body, model, input) {
+    const policy = getAnthropicParamPolicy(model);
+    if (policy.sendSampling && input.temperature !== undefined) {
+        body.temperature = input.temperature;
+    }
+    if (policy.supportsEffort) {
+        const effort = input.effort ?? (isFlagship(model) ? resolveEffortLevel() : undefined);
+        if (effort !== undefined) {
+            body.output_config = { effort };
+        }
+    }
+    return body;
+}
+function isFlagship(model) {
+    return getModelInfo(model)?.tier === 'flagship';
+}
+//# sourceMappingURL=anthropic-params.js.map

package/dist/shared/llm/cost-tracker.d.ts

@@ -7,14 +7,27 @@
  */
 import { LLMProviderType, TokenUsage, CostInfo, CostPeriod, CostSummary } from './interfaces';
 /**
- * Token pricing per model (cost per 1M tokens in USD)
- * Prices as of early 2025 - should be updated periodically
+ * Token pricing per model (cost per 1M tokens in USD).
+ * Current-generation prices verified 2026-09-27 (Anthropic docs, OpenRouter
+ * catalog). Models missing here fall back to the model registry via
+ * `resolveModelPricing()` before being treated as free/local.
  */
 export declare const MODEL_PRICING: Record<string, {
     input: number;
     output: number;
     provider: LLMProviderType;
 }>;
+/**
+ * Resolve per-million-token pricing for a model. Exact `MODEL_PRICING` keys
+ * win; otherwise the model registry is consulted (it normalizes provider
+ * IDs such as `anthropic/claude-sonnet-5` or dated Anthropic IDs). Returns
+ * `undefined` only when neither source knows the model, which callers treat
+ * as a free/local model.
+ */
+export declare function resolveModelPricing(model: string): {
+    input: number;
+    output: number;
+} | undefined;
 /**
  * Usage record for a single request
  */

package/dist/shared/llm/cost-tracker.js

@@ -6,25 +6,41 @@
  * Supports cost limits, alerts, and detailed breakdowns.
  */
 import { randomUUID } from 'crypto';
+import { getModelCost } from './model-registry.js';
 /**
- * Token pricing per model (cost per 1M tokens in USD)
- * Prices as of early 2025 - should be updated periodically
+ * Token pricing per model (cost per 1M tokens in USD).
+ * Current-generation prices verified 2026-09-27 (Anthropic docs, OpenRouter
+ * catalog). Models missing here fall back to the model registry via
+ * `resolveModelPricing()` before being treated as free/local.
  */
 export const MODEL_PRICING = {
-    // Claude models
+    // Claude models — current generation (2026-09 model refresh)
+    'claude-sonnet-5': { input: 2.0, output: 10.0, provider: 'claude' },
+    'claude-opus-5': { input: 5.0, output: 25.0, provider: 'claude' },
+    'claude-opus-5-5': { input: 4.0, output: 20.0, provider: 'claude' },
+    'claude-fable-5-1': { input: 10.0, output: 50.0, provider: 'claude' },
+    'claude-fable-5': { input: 10.0, output: 50.0, provider: 'claude' },
+    'claude-opus-4-8': { input: 5.0, output: 25.0, provider: 'claude' },
     // ADR-093: Opus 4.7 (2026-04-16), Sonnet 4.6, Haiku 4.5 (Apr 2026 cluster)
     'claude-opus-4-7': { input: 5.0, output: 25.0, provider: 'claude' },
     'claude-sonnet-4-6': { input: 3.0, output: 15.0, provider: 'claude' },
     'claude-haiku-4-5-20251001': { input: 1.0, output: 5.0, provider: 'claude' },
-    // Retiring 2026-06-15 — kept for existing traffic during transition
-    'claude-opus-4-5-20251101': { input: 15.0, output: 75.0, provider: 'claude' },
+    'claude-haiku-4-5': { input: 1.0, output: 5.0, provider: 'claude' },
+    // Previous generation, still served
+    'claude-opus-4-5-20251101': { input: 5.0, output: 25.0, provider: 'claude' },
+    'claude-opus-4-6': { input: 5.0, output: 25.0, provider: 'claude' },
+    // Retired — kept only to price historical usage records
     'claude-sonnet-4-20250514': { input: 3.0, output: 15.0, provider: 'claude' },
     'claude-3-5-haiku-20241022': { input: 1.0, output: 5.0, provider: 'claude' },
-    // Legacy Claude models
+    // Legacy Claude models (retired)
     'claude-3-opus-20240229': { input: 15.0, output: 75.0, provider: 'claude' },
     'claude-3-sonnet-20240229': { input: 3.0, output: 15.0, provider: 'claude' },
     'claude-3-haiku-20240307': { input: 0.25, output: 1.25, provider: 'claude' },
-    // OpenAI models
+    // OpenAI models — GPT-6 generation (OpenRouter pass-through pricing)
+    'gpt-6-astra': { input: 10.0, output: 50.0, provider: 'openai' },
+    'gpt-6-sol': { input: 2.0, output: 10.0, provider: 'openai' },
+    'gpt-6-luna': { input: 0.1, output: 0.5, provider: 'openai' },
+    // OpenAI legacy generation
     'gpt-4o': { input: 5.0, output: 15.0, provider: 'openai' },
     'gpt-4o-mini': { input: 0.15, output: 0.6, provider: 'openai' },
     'gpt-4-turbo': { input: 10.0, output: 30.0, provider: 'openai' },
@@ -38,7 +54,18 @@ export const MODEL_PRICING = {
     'mixtral': { input: 0, output: 0, provider: 'ollama' },
     'phi3': { input: 0, output: 0, provider: 'ollama' },
     'qwen2': { input: 0, output: 0, provider: 'ollama' },
-    // OpenRouter models (provider prefixed)
+    // OpenRouter models (provider prefixed) — current generation
+    'anthropic/claude-sonnet-5': { input: 2.0, output: 10.0, provider: 'openrouter' },
+    'anthropic/claude-opus-5': { input: 5.0, output: 25.0, provider: 'openrouter' },
+    'anthropic/claude-opus-5.5': { input: 4.0, output: 20.0, provider: 'openrouter' },
+    'anthropic/claude-haiku-4.5': { input: 1.0, output: 5.0, provider: 'openrouter' },
+    'openai/gpt-6-sol': { input: 2.0, output: 10.0, provider: 'openrouter' },
+    'openai/gpt-6-luna': { input: 0.1, output: 0.5, provider: 'openrouter' },
+    'google/gemini-3.8-flash': { input: 0.75, output: 3.75, provider: 'openrouter' },
+    'meta-llama/llama-4-maverick': { input: 0.1875, output: 0.6525, provider: 'openrouter' },
+    'openai/gpt-oss-120b': { input: 0.15, output: 0.6, provider: 'openrouter' },
+    'qwen/qwen3-coder': { input: 0.3, output: 1.0, provider: 'openrouter' },
+    // OpenRouter legacy slugs (retired upstream for Claude 3.x)
     'anthropic/claude-3.5-sonnet': { input: 3.0, output: 15.0, provider: 'openrouter' },
     'anthropic/claude-3.5-sonnet:beta': { input: 3.0, output: 15.0, provider: 'openrouter' },
     'anthropic/claude-3-opus': { input: 15.0, output: 75.0, provider: 'openrouter' },
@@ -57,6 +84,8 @@ export const MODEL_PRICING = {
     'mistralai/mistral-7b-instruct': { input: 0.06, output: 0.06, provider: 'openrouter' },
     // AWS Bedrock models (ARN-style model IDs)
     // Pricing reflects Bedrock's pricing which may differ slightly from Anthropic direct
+    // Bedrock sets its own Claude pricing; this row is unverified since the
+    // 2026-09 refresh (direct API / OpenRouter Opus 4.5 is $5/$25).
     'anthropic.claude-opus-4-5-v1:0': { input: 15.0, output: 75.0, provider: 'bedrock' },
     'anthropic.claude-opus-4-v1:0': { input: 15.0, output: 75.0, provider: 'bedrock' },
     'anthropic.claude-sonnet-4-5-v2:0': { input: 3.0, output: 15.0, provider: 'bedrock' },
@@ -79,6 +108,11 @@ export const MODEL_PRICING = {
     'azure/text-embedding-3-small': { input: 0.02, output: 0, provider: 'azure-openai' },
     'azure/text-embedding-3-large': { input: 0.13, output: 0, provider: 'azure-openai' },
     // Google Gemini models (direct API)
+    'gemini-3.8-flash': { input: 0.75, output: 3.75, provider: 'gemini' },
+    'gemini-3.5-flash': { input: 1.5, output: 9.0, provider: 'gemini' },
+    'gemini-3.1-pro-preview': { input: 2.0, output: 12.0, provider: 'gemini' },
+    'gemini-2.5-flash': { input: 0.3, output: 2.5, provider: 'gemini' },
+    'gemini-2.5-pro': { input: 1.25, output: 10.0, provider: 'gemini' },
     'gemini-pro': { input: 0.5, output: 1.5, provider: 'gemini' },
     'gemini-1.0-pro': { input: 0.5, output: 1.5, provider: 'gemini' },
     'gemini-1.5-pro': { input: 3.5, output: 10.5, provider: 'gemini' },
@@ -91,6 +125,24 @@ export const MODEL_PRICING = {
     // Gemini embedding models
     'text-embedding-004': { input: 0.025, output: 0, provider: 'gemini' },
 };
+/**
+ * Resolve per-million-token pricing for a model. Exact `MODEL_PRICING` keys
+ * win; otherwise the model registry is consulted (it normalizes provider
+ * IDs such as `anthropic/claude-sonnet-5` or dated Anthropic IDs). Returns
+ * `undefined` only when neither source knows the model, which callers treat
+ * as a free/local model.
+ */
+export function resolveModelPricing(model) {
+    const pricing = MODEL_PRICING[model];
+    if (pricing) {
+        return { input: pricing.input, output: pricing.output };
+    }
+    const registryCost = getModelCost(model);
+    if (registryCost.inputCostPerMillion > 0 || registryCost.outputCostPerMillion > 0) {
+        return { input: registryCost.inputCostPerMillion, output: registryCost.outputCostPerMillion };
+    }
+    return undefined;
+}
 /**
  * Cost tracker for LLM usage
  */
@@ -106,7 +158,7 @@ export class CostTracker {
      * Calculate cost for a given usage
      */
     static calculateCost(model, usage) {
-        const pricing = MODEL_PRICING[model];
+        const pricing = resolveModelPricing(model);
         if (!pricing) {
             // Unknown model - assume Ollama (local) for safety
             return {
@@ -134,7 +186,7 @@ export class CostTracker {
      * Get cost per token for a model
      */
     static getCostPerToken(model) {
-        const pricing = MODEL_PRICING[model];
+        const pricing = resolveModelPricing(model);
         if (!pricing) {
             return { input: 0, output: 0 };
         }

package/dist/shared/llm/index.d.ts

@@ -45,13 +45,13 @@ export { type LLMProviderType, type MessageRole, type Message, type TokenUsage,
 export { ClaudeProvider, DEFAULT_CLAUDE_CONFIG, OpenAIProvider, DEFAULT_OPENAI_CONFIG, OllamaProvider, DEFAULT_OLLAMA_CONFIG, OpenRouterProvider, DEFAULT_OPENROUTER_CONFIG, GeminiProvider, DEFAULT_GEMINI_CONFIG, AzureOpenAIProvider, DEFAULT_AZURE_OPENAI_CONFIG, BedrockProvider, DEFAULT_BEDROCK_CONFIG, } from './providers';
 export { CircuitBreaker, CircuitBreakerManager, DEFAULT_CIRCUIT_BREAKER_CONFIG, } from './circuit-breaker';
 export { LLMCache, LLMResponseCache, DEFAULT_CACHE_CONFIG, type CacheableResponse, } from './cache';
-export { CostTracker, MODEL_PRICING, getGlobalCostTracker, resetGlobalCostTracker, } from './cost-tracker';
+export { CostTracker, MODEL_PRICING, resolveModelPricing, getGlobalCostTracker, resetGlobalCostTracker, } from './cost-tracker';
 export { registerProvider, tryRegisterProvider, unregisterProvider, resetProviderRegistry, isRegisteredProvider, getRegisteredProvider, listRegisteredProviders, registeredProviderTypes, createRegisteredProvider, registeredBillingDeclaration, validateProviderType, validateProviderInstance, type ProviderFactory, type ProviderRegistrationOptions, type ProviderRegistrationSource, type RegisteredProvider, } from './provider-registry';
 export { ExternalCliProvider, validateExternalCliConfig, resolvesOnPath, DEFAULT_EXTERNAL_CLI_TIMEOUT_MS, DEFAULT_EXTERNAL_CLI_CONCURRENCY, EXTERNAL_CLI_DEFAULT_MODEL, type ExternalCliProviderConfig, } from './providers/external-cli';
 export { registerExternalProviders, sanitizeExternalProviders, type ExternalProviderRegistrationResult, } from './router/external-provider-config';
 export { ProviderManager, createProviderManager, createQEProviderManager, DEFAULT_PROVIDER_MANAGER_CONFIG, } from './provider-manager';
 export { mapModelId, normalizeModelId, getCanonicalName, getModelFamily, getModelTier, isModelAvailableOnProvider, getSupportedProviders, listCanonicalModels, listModelsByProvider, listModelsByFamily, listModelsByTier, getModelMapping, MODEL_MAPPINGS, type ProviderType, type ModelMapping, } from './model-mapping';
-export { getModelCapabilities, getModelCost, getModelInfo, listModels, findModelsByCapability, findModelsByCost, findCheapestModel, findBestModelInBudget, getRecommendedModels, getDeprecationStatus, estimateRequestCost, compareModels, MODEL_REGISTRY, type ModelCapabilities, type ModelCostInfo, type ModelInfo, } from './model-registry';
+export { getModelCapabilities, getModelCost, getModelInfo, listModels, findModelsByCapability, findModelsByCost, findCheapestModel, findBestModelInBudget, getRecommendedModels, getDeprecationStatus, estimateRequestCost, compareModels, MODEL_REGISTRY, DEFAULT_SONNET_MODEL, DEFAULT_OPUS_MODEL, DEFAULT_HAIKU_MODEL, CLAUDE_TIER_MODELS, getClaudeModelForTier, RETIRING_MODELS, type ModelCapabilities, type ModelCostInfo, type ModelInfo, } from './model-registry';
 export { RouterMetricsCollector, createRouterMetricsCollector, getGlobalRouterMetrics, resetGlobalRouterMetrics, CostMetricsCollector, createCostMetricsCollector, getGlobalCostMetrics, resetGlobalCostMetrics, type RoutingDecisionRecord, type ProviderCallRecord, type FallbackRecord, type RouterMetricsSummary, type ProviderMetrics as RouterProviderMetrics, type AgentMetrics, type MetricsTimeWindow, type CostRecord, type CostTrend, type CostBreakdown, type BudgetAlert, type CostOptimizationSuggestion, } from './metrics';
 export { HybridRouter, createHybridRouter, createQERouter, } from './router';
 export type { ExtendedProviderType, RoutingMode, RoutingDecision, RouterConfig, ChatParams, ChatResponse, FallbackChain, } from './router';

package/dist/shared/llm/index.js

@@ -52,7 +52,7 @@ export { CircuitBreaker, CircuitBreakerManager, DEFAULT_CIRCUIT_BREAKER_CONFIG,
 // Cache
 export { LLMCache, LLMResponseCache, DEFAULT_CACHE_CONFIG, } from './cache.js';
 // Cost tracker
-export { CostTracker, MODEL_PRICING, getGlobalCostTracker, resetGlobalCostTracker, } from './cost-tracker.js';
+export { CostTracker, MODEL_PRICING, resolveModelPricing, getGlobalCostTracker, resetGlobalCostTracker, } from './cost-tracker.js';
 // External provider registration (ADR-127 / issue #628)
 export { registerProvider, tryRegisterProvider, unregisterProvider, resetProviderRegistry, isRegisteredProvider, getRegisteredProvider, listRegisteredProviders, registeredProviderTypes, createRegisteredProvider, registeredBillingDeclaration, validateProviderType, validateProviderInstance, } from './provider-registry.js';
 export { ExternalCliProvider, validateExternalCliConfig, resolvesOnPath, DEFAULT_EXTERNAL_CLI_TIMEOUT_MS, DEFAULT_EXTERNAL_CLI_CONCURRENCY, EXTERNAL_CLI_DEFAULT_MODEL, } from './providers/external-cli.js';
@@ -62,7 +62,7 @@ export { ProviderManager, createProviderManager, createQEProviderManager, DEFAUL
 // Model mapping (ADR-043)
 export { mapModelId, normalizeModelId, getCanonicalName, getModelFamily, getModelTier, isModelAvailableOnProvider, getSupportedProviders, listCanonicalModels, listModelsByProvider, listModelsByFamily, listModelsByTier, getModelMapping, MODEL_MAPPINGS, } from './model-mapping.js';
 // Model registry (ADR-043)
-export { getModelCapabilities, getModelCost, getModelInfo, listModels, findModelsByCapability, findModelsByCost, findCheapestModel, findBestModelInBudget, getRecommendedModels, getDeprecationStatus, estimateRequestCost, compareModels, MODEL_REGISTRY, } from './model-registry.js';
+export { getModelCapabilities, getModelCost, getModelInfo, listModels, findModelsByCapability, findModelsByCost, findCheapestModel, findBestModelInBudget, getRecommendedModels, getDeprecationStatus, estimateRequestCost, compareModels, MODEL_REGISTRY, DEFAULT_SONNET_MODEL, DEFAULT_OPUS_MODEL, DEFAULT_HAIKU_MODEL, CLAUDE_TIER_MODELS, getClaudeModelForTier, RETIRING_MODELS, } from './model-registry.js';
 // Metrics (ADR-043 Milestone 11)
 export { RouterMetricsCollector, createRouterMetricsCollector, getGlobalRouterMetrics, resetGlobalRouterMetrics, CostMetricsCollector, createCostMetricsCollector, getGlobalCostMetrics, resetGlobalCostMetrics, } from './metrics/index.js';
 // HybridRouter (ADR-043: Intelligent provider routing)

package/dist/shared/llm/interfaces.d.ts

@@ -178,7 +178,7 @@ export interface LLMConfig {
  */
 export interface ClaudeConfig extends LLMConfig {
     /** Claude model version */
-    model: 'claude-opus-4-7' | 'claude-sonnet-4-6' | 'claude-haiku-4-5-20251001' | string;
+    model: 'claude-opus-5' | 'claude-sonnet-5' | 'claude-opus-4-7' | 'claude-sonnet-4-6' | 'claude-haiku-4-5-20251001' | string;
     /** Anthropic API version */
     anthropicVersion?: string;
     /** Maximum thinking tokens for extended thinking */

package/dist/shared/llm/metrics/cost-metrics.js

@@ -9,7 +9,8 @@
  * - Cost optimization insights
  */
 import { ALL_PROVIDER_TYPES } from '../router/types.js';
-import { MODEL_PRICING } from '../cost-tracker.js';
+import { resolveModelPricing } from '../cost-tracker.js';
+import { DEFAULT_SONNET_MODEL } from '../model-registry.js';
 // ============================================================================
 // CostMetricsCollector Implementation
 // ============================================================================
@@ -244,7 +245,7 @@ export class CostMetricsCollector {
         const byModel = this.getCostByModel('24h');
         // Check for expensive models that could use cheaper alternatives
         for (const [model, breakdown] of byModel) {
-            const pricing = MODEL_PRICING[model];
+            const pricing = resolveModelPricing(model);
             if (pricing && breakdown.totalCost > 1) {
                 // Suggest cheaper alternatives
                 if (model.includes('opus')) {
@@ -253,7 +254,7 @@ export class CostMetricsCollector {
                         description: `Consider using Sonnet instead of Opus for non-critical tasks`,
                         estimatedSavings: breakdown.totalCost * 0.5,
                         currentCost: breakdown.totalCost,
-                        suggestedModel: 'claude-sonnet-4-6',
+                        suggestedModel: DEFAULT_SONNET_MODEL,
                     });
                 }
                 if (model === 'gpt-4o') {
@@ -330,7 +331,7 @@ export class CostMetricsCollector {
     // Private Helper Methods
     // ==========================================================================
     calculateCost(model, inputTokens, outputTokens) {
-        const pricing = MODEL_PRICING[model];
+        const pricing = resolveModelPricing(model);
         if (!pricing) {
             return {
                 inputCost: 0,